From: Greg Kroah-Hartman Date: Wed, 1 Jul 2009 00:27:54 +0000 (-0700) Subject: add mbox for .30 and remove 2 patches X-Git-Tag: v2.6.27.26~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=47800071333f5b5842cf27889f3e7c6e848a0e13;p=thirdparty%2Fkernel%2Fstable-queue.git add mbox for .30 and remove 2 patches --- diff --git a/queue-2.6.30/mbox b/queue-2.6.30/mbox new file mode 100644 index 00000000000..3c5b4142233 --- /dev/null +++ b/queue-2.6.30/mbox @@ -0,0 +1,10587 @@ +From gregkh@mini.kroah.org Tue Jun 30 17:24:11 2009 +Message-Id: <20090701002411.182474102@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:22:50 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Yinghai Lu , + Ingo Molnar , + "H. Peter Anvin" , + Thomas Gleixner +Subject: [patch 001/108] firmware_map: fix hang with x86/32bit +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=firmware_map-fix-hang-with-x86-32bit.patch +Content-Length: 4211 +Lines: 113 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Yinghai Lu + +commit 3b0fde0fac19c180317eb0601b3504083f4b9bf5 upstream. + +Addresses http://bugzilla.kernel.org/show_bug.cgi?id=13484 + +Peer reported: +| The bug is introduced from kernel 2.6.27, if E820 table reserve the memory +| above 4G in 32bit OS(BIOS-e820: 00000000fff80000 - 0000000120000000 +| (reserved)), system will report Int 6 error and hang up. The bug is caused by +| the following code in drivers/firmware/memmap.c, the resource_size_t is 32bit +| variable in 32bit OS, the BUG_ON() will be invoked to result in the Int 6 +| error. I try the latest 32bit Ubuntu and Fedora distributions, all hit this +| bug. +|====== +|static int firmware_map_add_entry(resource_size_t start, resource_size_t end, +| const char *type, +| struct firmware_map_entry *entry) + +and it only happen with CONFIG_PHYS_ADDR_T_64BIT is not set. + +it turns out we need to pass u64 instead of resource_size_t for that. + +[akpm@linux-foundation.org: add comment] +Reported-and-tested-by: Peer Chen +Signed-off-by: Yinghai Lu +Cc: Ingo Molnar +Acked-by: H. Peter Anvin +Cc: Thomas Gleixner +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firmware/memmap.c | 16 +++++++++------- + include/linux/firmware-map.h | 12 ++++-------- + 2 files changed, 13 insertions(+), 15 deletions(-) + +--- a/drivers/firmware/memmap.c ++++ b/drivers/firmware/memmap.c +@@ -31,8 +31,12 @@ + * information is necessary as for the resource tree. + */ + struct firmware_map_entry { +- resource_size_t start; /* start of the memory range */ +- resource_size_t end; /* end of the memory range (incl.) */ ++ /* ++ * start and end must be u64 rather than resource_size_t, because e820 ++ * resources can lie at addresses above 4G. ++ */ ++ u64 start; /* start of the memory range */ ++ u64 end; /* end of the memory range (incl.) */ + const char *type; /* type of the memory range */ + struct list_head list; /* entry for the linked list */ + struct kobject kobj; /* kobject for each entry */ +@@ -101,7 +105,7 @@ static LIST_HEAD(map_entries); + * Common implementation of firmware_map_add() and firmware_map_add_early() + * which expects a pre-allocated struct firmware_map_entry. + **/ +-static int firmware_map_add_entry(resource_size_t start, resource_size_t end, ++static int firmware_map_add_entry(u64 start, u64 end, + const char *type, + struct firmware_map_entry *entry) + { +@@ -132,8 +136,7 @@ static int firmware_map_add_entry(resour + * + * Returns 0 on success, or -ENOMEM if no memory could be allocated. + **/ +-int firmware_map_add(resource_size_t start, resource_size_t end, +- const char *type) ++int firmware_map_add(u64 start, u64 end, const char *type) + { + struct firmware_map_entry *entry; + +@@ -157,8 +160,7 @@ int firmware_map_add(resource_size_t sta + * + * Returns 0 on success, or -ENOMEM if no memory could be allocated. + **/ +-int __init firmware_map_add_early(resource_size_t start, resource_size_t end, +- const char *type) ++int __init firmware_map_add_early(u64 start, u64 end, const char *type) + { + struct firmware_map_entry *entry; + +--- a/include/linux/firmware-map.h ++++ b/include/linux/firmware-map.h +@@ -24,21 +24,17 @@ + */ + #ifdef CONFIG_FIRMWARE_MEMMAP + +-int firmware_map_add(resource_size_t start, resource_size_t end, +- const char *type); +-int firmware_map_add_early(resource_size_t start, resource_size_t end, +- const char *type); ++int firmware_map_add(u64 start, u64 end, const char *type); ++int firmware_map_add_early(u64 start, u64 end, const char *type); + + #else /* CONFIG_FIRMWARE_MEMMAP */ + +-static inline int firmware_map_add(resource_size_t start, resource_size_t end, +- const char *type) ++static inline int firmware_map_add(u64 start, u64 end, const char *type) + { + return 0; + } + +-static inline int firmware_map_add_early(resource_size_t start, +- resource_size_t end, const char *type) ++static inline int firmware_map_add_early(u64 start, u64 end, const char *type) + { + return 0; + } + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:12 2009 +Message-Id: <20090701002411.695417787@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:22:51 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Nick Piggin , + Al Viro +Subject: [patch 002/108] fs: remove incorrect I_NEW warnings +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=fs-remove-incorrect-i_new-warnings.patch +Content-Length: 1335 +Lines: 42 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Nick Piggin + +commit 545b9fd3d737afc0bb5203b1e79194a471605acd upstream. + +Some filesystems can call in to sync an inode that is still in the +I_NEW state (eg. ext family, when mounted with -osync). This is OK +because the filesystem has sole access to the new inode, so it can +modify i_state without races (because no other thread should be +modifying it, by definition of I_NEW). Ie. a false positive, so +remove the warnings. + +The races are described here 7ef0d7377cb287e08f3ae94cebc919448e1f5dff, +which is also where the warnings were introduced. + +Reported-by: Stephen Hemminger +Signed-off-by: Nick Piggin +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fs-writeback.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -289,7 +289,6 @@ __sync_single_inode(struct inode *inode, + int ret; + + BUG_ON(inode->i_state & I_SYNC); +- WARN_ON(inode->i_state & I_NEW); + + /* Set I_SYNC, reset I_DIRTY */ + dirty = inode->i_state & I_DIRTY; +@@ -314,7 +313,6 @@ __sync_single_inode(struct inode *inode, + } + + spin_lock(&inode_lock); +- WARN_ON(inode->i_state & I_NEW); + inode->i_state &= ~I_SYNC; + if (!(inode->i_state & I_FREEING)) { + if (!(inode->i_state & I_DIRTY) && + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:12 2009 +Message-Id: <20090701002412.207950874@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:22:52 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Shaohua Li , + Jesse Barnes +Subject: [patch 003/108] PCI: disable ASPM on VIA root-port-under-bridge configurations +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=pci-disable-aspm-on-via-root-port-under-bridge-configurations.patch +Content-Length: 933 +Lines: 30 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Shaohua Li + +commit 8e822df700694ca6850d1e0c122fd7004b2778d8 upstream. + +VIA has a strange chipset, it has root port under a bridge. Disable ASPM +for such strange chipset. + +Tested-by: Wolfgang Denk +Signed-off-by: Shaohua Li +Signed-off-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/pcie/aspm.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/pci/pcie/aspm.c ++++ b/drivers/pci/pcie/aspm.c +@@ -638,6 +638,10 @@ void pcie_aspm_init_link_state(struct pc + if (pdev->pcie_type != PCI_EXP_TYPE_ROOT_PORT && + pdev->pcie_type != PCI_EXP_TYPE_DOWNSTREAM) + return; ++ /* VIA has a strange chipset, root port is under a bridge */ ++ if (pdev->pcie_type == PCI_EXP_TYPE_ROOT_PORT && ++ pdev->bus->self) ++ return; + down_read(&pci_bus_sem); + if (list_empty(&pdev->subordinate->devices)) + goto out; + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:12 2009 +Message-Id: <20090701002412.598019788@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:22:53 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Gleb Natapov , + Avi Kivity +Subject: [patch 004/108] KVM: VMX: Fix handling of a fault during NMI unblocked due to IRET +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=kvm-vmx-fix-handling-of-a-fault-during-nmi-unblocked-due-to-iret.patch +Content-Length: 2331 +Lines: 67 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Gleb Natapov + +commit 7b4a25cb296e2a73d2e87a4af65361d45d450a27 upstream. + +Bit 12 is undefined in any of the following cases: + If the VM exit sets the valid bit in the IDT-vectoring information field. + If the VM exit is due to a double fault. + +Signed-off-by: Gleb Natapov +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/vmx.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -3248,36 +3248,41 @@ static void update_tpr_threshold(struct + static void vmx_complete_interrupts(struct vcpu_vmx *vmx) + { + u32 exit_intr_info; +- u32 idt_vectoring_info; ++ u32 idt_vectoring_info = vmx->idt_vectoring_info; + bool unblock_nmi; + u8 vector; + int type; + bool idtv_info_valid; + u32 error; + ++ idtv_info_valid = idt_vectoring_info & VECTORING_INFO_VALID_MASK; + exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO); + if (cpu_has_virtual_nmis()) { + unblock_nmi = (exit_intr_info & INTR_INFO_UNBLOCK_NMI) != 0; + vector = exit_intr_info & INTR_INFO_VECTOR_MASK; + /* +- * SDM 3: 25.7.1.2 ++ * SDM 3: 27.7.1.2 (September 2008) + * Re-set bit "block by NMI" before VM entry if vmexit caused by + * a guest IRET fault. ++ * SDM 3: 23.2.2 (September 2008) ++ * Bit 12 is undefined in any of the following cases: ++ * If the VM exit sets the valid bit in the IDT-vectoring ++ * information field. ++ * If the VM exit is due to a double fault. + */ +- if (unblock_nmi && vector != DF_VECTOR) ++ if ((exit_intr_info & INTR_INFO_VALID_MASK) && unblock_nmi && ++ vector != DF_VECTOR && !idtv_info_valid) + vmcs_set_bits(GUEST_INTERRUPTIBILITY_INFO, + GUEST_INTR_STATE_NMI); + } else if (unlikely(vmx->soft_vnmi_blocked)) + vmx->vnmi_blocked_time += + ktime_to_ns(ktime_sub(ktime_get(), vmx->entry_time)); + +- idt_vectoring_info = vmx->idt_vectoring_info; +- idtv_info_valid = idt_vectoring_info & VECTORING_INFO_VALID_MASK; + vector = idt_vectoring_info & VECTORING_INFO_VECTOR_MASK; + type = idt_vectoring_info & VECTORING_INFO_TYPE_MASK; + if (vmx->vcpu.arch.nmi_injected) { + /* +- * SDM 3: 25.7.1.2 ++ * SDM 3: 27.7.1.2 (September 2008) + * Clear bit "block by NMI" before VM entry if a NMI delivery + * faulted. + */ + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:13 2009 +Message-Id: <20090701002413.036101160@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:22:54 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Gleb Natapov , + Avi Kivity +Subject: [patch 005/108] KVM: Move "exit due to NMI" handling into vmx_complete_interrupts() +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=kvm-move-exit-due-to-nmi-handling-into-vmx_complete_interrupts.patch +Content-Length: 1931 +Lines: 60 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Gleb Natapov + +commit 20f65983e30f222e5383f77206e3f571d1d64610 upstream. + +To save us one reading of VM_EXIT_INTR_INFO. + +Signed-off-by: Gleb Natapov +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/vmx.c | 21 ++++++++++----------- + 1 file changed, 10 insertions(+), 11 deletions(-) + +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -3255,8 +3255,17 @@ static void vmx_complete_interrupts(stru + bool idtv_info_valid; + u32 error; + +- idtv_info_valid = idt_vectoring_info & VECTORING_INFO_VALID_MASK; + exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO); ++ ++ /* We need to handle NMIs before interrupts are enabled */ ++ if ((exit_intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR && ++ (exit_intr_info & INTR_INFO_VALID_MASK)) { ++ KVMTRACE_0D(NMI, &vmx->vcpu, handler); ++ asm("int $2"); ++ } ++ ++ idtv_info_valid = idt_vectoring_info & VECTORING_INFO_VALID_MASK; ++ + if (cpu_has_virtual_nmis()) { + unblock_nmi = (exit_intr_info & INTR_INFO_UNBLOCK_NMI) != 0; + vector = exit_intr_info & INTR_INFO_VECTOR_MASK; +@@ -3386,7 +3395,6 @@ static void fixup_rmode_irq(struct vcpu_ + static void vmx_vcpu_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run) + { + struct vcpu_vmx *vmx = to_vmx(vcpu); +- u32 intr_info; + + /* Record the guest's net vcpu time for enforced NMI injections. */ + if (unlikely(!cpu_has_virtual_nmis() && vmx->soft_vnmi_blocked)) +@@ -3515,15 +3523,6 @@ static void vmx_vcpu_run(struct kvm_vcpu + asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS)); + vmx->launched = 1; + +- intr_info = vmcs_read32(VM_EXIT_INTR_INFO); +- +- /* We need to handle NMIs before interrupts are enabled */ +- if ((intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR && +- (intr_info & INTR_INFO_VALID_MASK)) { +- KVMTRACE_0D(NMI, vcpu, handler); +- asm("int $2"); +- } +- + vmx_complete_interrupts(vmx); + } + + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:13 2009 +Message-Id: <20090701002413.194902498@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:22:55 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andi Kleen , + Huang Ying , + Avi Kivity +Subject: [patch 006/108] KVM: Add VT-x machine check support +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=kvm-add-vt-x-machine-check-support.patch +Content-Length: 5436 +Lines: 164 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Andi Kleen + +commit a0861c02a981c943573478ea13b29b1fb958ee5b upstream. + +VT-x needs an explicit MC vector intercept to handle machine checks in the +hyper visor. + +It also has a special option to catch machine checks that happen +during VT entry. + +Do these interceptions and forward them to the Linux machine check +handler. Make it always look like user space is interrupted because +the machine check handler treats kernel/user space differently. + +Thanks to Jiang Yunhong for help and testing. + +Signed-off-by: Andi Kleen +Signed-off-by: Huang Ying +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/vmx.h | 1 + arch/x86/kernel/cpu/mcheck/mce_64.c | 1 + arch/x86/kvm/vmx.c | 50 ++++++++++++++++++++++++++++++++++-- + 3 files changed, 50 insertions(+), 2 deletions(-) + +--- a/arch/x86/include/asm/vmx.h ++++ b/arch/x86/include/asm/vmx.h +@@ -247,6 +247,7 @@ enum vmcs_field { + #define EXIT_REASON_MSR_READ 31 + #define EXIT_REASON_MSR_WRITE 32 + #define EXIT_REASON_MWAIT_INSTRUCTION 36 ++#define EXIT_REASON_MCE_DURING_VMENTRY 41 + #define EXIT_REASON_TPR_BELOW_THRESHOLD 43 + #define EXIT_REASON_APIC_ACCESS 44 + #define EXIT_REASON_EPT_VIOLATION 48 +--- a/arch/x86/kernel/cpu/mcheck/mce_64.c ++++ b/arch/x86/kernel/cpu/mcheck/mce_64.c +@@ -420,6 +420,7 @@ void do_machine_check(struct pt_regs * r + out2: + atomic_dec(&mce_entry); + } ++EXPORT_SYMBOL_GPL(do_machine_check); + + #ifdef CONFIG_X86_MCE_INTEL + /*** +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -32,6 +32,7 @@ + #include + #include + #include ++#include + + #define __ex(x) __kvm_handle_fault_on_reboot(x) + +@@ -97,6 +98,7 @@ struct vcpu_vmx { + int soft_vnmi_blocked; + ktime_t entry_time; + s64 vnmi_blocked_time; ++ u32 exit_reason; + }; + + static inline struct vcpu_vmx *to_vmx(struct kvm_vcpu *vcpu) +@@ -213,6 +215,13 @@ static inline int is_external_interrupt( + == (INTR_TYPE_EXT_INTR | INTR_INFO_VALID_MASK); + } + ++static inline int is_machine_check(u32 intr_info) ++{ ++ return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VECTOR_MASK | ++ INTR_INFO_VALID_MASK)) == ++ (INTR_TYPE_HARD_EXCEPTION | MC_VECTOR | INTR_INFO_VALID_MASK); ++} ++ + static inline int cpu_has_vmx_msr_bitmap(void) + { + return (vmcs_config.cpu_based_exec_ctrl & CPU_BASED_USE_MSR_BITMAPS); +@@ -478,7 +487,7 @@ static void update_exception_bitmap(stru + { + u32 eb; + +- eb = (1u << PF_VECTOR) | (1u << UD_VECTOR); ++ eb = (1u << PF_VECTOR) | (1u << UD_VECTOR) | (1u << MC_VECTOR); + if (!vcpu->fpu_active) + eb |= 1u << NM_VECTOR; + if (vcpu->guest_debug & KVM_GUESTDBG_ENABLE) { +@@ -2585,6 +2594,31 @@ static int handle_rmode_exception(struct + return 0; + } + ++/* ++ * Trigger machine check on the host. We assume all the MSRs are already set up ++ * by the CPU and that we still run on the same CPU as the MCE occurred on. ++ * We pass a fake environment to the machine check handler because we want ++ * the guest to be always treated like user space, no matter what context ++ * it used internally. ++ */ ++static void kvm_machine_check(void) ++{ ++#if defined(CONFIG_X86_MCE) && defined(CONFIG_X86_64) ++ struct pt_regs regs = { ++ .cs = 3, /* Fake ring 3 no matter what the guest ran on */ ++ .flags = X86_EFLAGS_IF, ++ }; ++ ++ do_machine_check(®s, 0); ++#endif ++} ++ ++static int handle_machine_check(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run) ++{ ++ /* already handled by vcpu_run */ ++ return 1; ++} ++ + static int handle_exception(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run) + { + struct vcpu_vmx *vmx = to_vmx(vcpu); +@@ -2596,6 +2630,9 @@ static int handle_exception(struct kvm_v + vect_info = vmx->idt_vectoring_info; + intr_info = vmcs_read32(VM_EXIT_INTR_INFO); + ++ if (is_machine_check(intr_info)) ++ return handle_machine_check(vcpu, kvm_run); ++ + if ((vect_info & VECTORING_INFO_VALID_MASK) && + !is_page_fault(intr_info)) + printk(KERN_ERR "%s: unexpected, vectoring info 0x%x " +@@ -3150,6 +3187,7 @@ static int (*kvm_vmx_exit_handlers[])(st + [EXIT_REASON_WBINVD] = handle_wbinvd, + [EXIT_REASON_TASK_SWITCH] = handle_task_switch, + [EXIT_REASON_EPT_VIOLATION] = handle_ept_violation, ++ [EXIT_REASON_MCE_DURING_VMENTRY] = handle_machine_check, + }; + + static const int kvm_vmx_max_exit_handlers = +@@ -3161,8 +3199,8 @@ static const int kvm_vmx_max_exit_handle + */ + static int kvm_handle_exit(struct kvm_run *kvm_run, struct kvm_vcpu *vcpu) + { +- u32 exit_reason = vmcs_read32(VM_EXIT_REASON); + struct vcpu_vmx *vmx = to_vmx(vcpu); ++ u32 exit_reason = vmx->exit_reason; + u32 vectoring_info = vmx->idt_vectoring_info; + + KVMTRACE_3D(VMEXIT, vcpu, exit_reason, (u32)kvm_rip_read(vcpu), +@@ -3257,6 +3295,14 @@ static void vmx_complete_interrupts(stru + + exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO); + ++ vmx->exit_reason = vmcs_read32(VM_EXIT_REASON); ++ ++ /* Handle machine checks before interrupts are enabled */ ++ if ((vmx->exit_reason == EXIT_REASON_MCE_DURING_VMENTRY) ++ || (vmx->exit_reason == EXIT_REASON_EXCEPTION_NMI ++ && is_machine_check(exit_intr_info))) ++ kvm_machine_check(); ++ + /* We need to handle NMIs before interrupts are enabled */ + if ((exit_intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR && + (exit_intr_info & INTR_INFO_VALID_MASK)) { + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:13 2009 +Message-Id: <20090701002413.536284495@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:22:56 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Avi Kivity +Subject: [patch 007/108] KVM: Disable large pages on misaligned memory slots +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=kvm-disable-large-pages-on-misaligned-memory-slots.patch +Content-Length: 1356 +Lines: 43 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Avi Kivity + +commit ac04527f7947020c5890090b2ac87af4e98d977e upstream. + +If a slots guest physical address and host virtual address unequal (mod +large page size), then we would erronously try to back guest large pages +with host large pages. Detect this misalignment and diable large page +support for the trouble slot. + +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + virt/kvm/kvm_main.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -919,7 +919,7 @@ int __kvm_set_memory_region(struct kvm * + { + int r; + gfn_t base_gfn; +- unsigned long npages; ++ unsigned long npages, ugfn; + int largepages; + unsigned long i; + struct kvm_memory_slot *memslot; +@@ -1010,6 +1010,14 @@ int __kvm_set_memory_region(struct kvm * + new.lpage_info[0].write_count = 1; + if ((base_gfn+npages) % KVM_PAGES_PER_HPAGE) + new.lpage_info[largepages-1].write_count = 1; ++ ugfn = new.userspace_addr >> PAGE_SHIFT; ++ /* ++ * If the gfn and userspace address are not aligned wrt each ++ * other, disable large page support for this slot ++ */ ++ if ((base_gfn ^ ugfn) & (KVM_PAGES_PER_HPAGE - 1)) ++ for (i = 0; i < largepages; ++i) ++ new.lpage_info[i].write_count = 1; + } + + /* Allocate page dirty bitmap if needed */ + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:14 2009 +Message-Id: <20090701002414.000432799@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:22:57 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Avi Kivity +Subject: [patch 008/108] KVM: Prevent overflow in largepages calculation +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=kvm-prevent-overflow-in-largepages-calculation.patch +Content-Length: 699 +Lines: 27 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Avi Kivity + +commit 09f8ca74ae6c2d78b2c7f6c0751ed0cbe815a3d9 upstream. + +If userspace specifies a memory slot that is larger than 8 petabytes, it +could overflow the largepages variable. + +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + virt/kvm/kvm_main.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -920,8 +920,7 @@ int __kvm_set_memory_region(struct kvm * + int r; + gfn_t base_gfn; + unsigned long npages, ugfn; +- int largepages; +- unsigned long i; ++ unsigned long largepages, i; + struct kvm_memory_slot *memslot; + struct kvm_memory_slot old, new; + + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:14 2009 +Message-Id: <20090701002414.580133016@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:22:58 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Marcelo Tosatti , + Avi Kivity +Subject: [patch 009/108] KVM: x86: check for cr3 validity in ioctl_set_sregs +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=kvm-x86-check-for-cr3-validity-in-ioctl_set_sregs.patch +Content-Length: 1730 +Lines: 49 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Marcelo Tosatti + +commit 59839dfff5eabca01cc4e20b45797a60a80af8cb upstream. + +Matt T. Yourst notes that kvm_arch_vcpu_ioctl_set_sregs lacks validity +checking for the new cr3 value: + +"Userspace callers of KVM_SET_SREGS can pass a bogus value of cr3 to +the kernel. This will trigger a NULL pointer access in gfn_to_rmap() +when userspace next tries to call KVM_RUN on the affected VCPU and kvm +attempts to activate the new non-existent page table root. + +This happens since kvm only validates that cr3 points to a valid guest +physical memory page when code *inside* the guest sets cr3. However, kvm +currently trusts the userspace caller (e.g. QEMU) on the host machine to +always supply a valid page table root, rather than properly validating +it along with the rest of the reloaded guest state." + +http://sourceforge.net/tracker/?func=detail&atid=893831&aid=2687641&group_id=180599 + +Check for a valid cr3 address in kvm_arch_vcpu_ioctl_set_sregs, triple +fault in case of failure. + +Signed-off-by: Marcelo Tosatti +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/x86.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -3934,7 +3934,13 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct + + vcpu->arch.cr2 = sregs->cr2; + mmu_reset_needed |= vcpu->arch.cr3 != sregs->cr3; +- vcpu->arch.cr3 = sregs->cr3; ++ ++ down_read(&vcpu->kvm->slots_lock); ++ if (gfn_to_memslot(vcpu->kvm, sregs->cr3 >> PAGE_SHIFT)) ++ vcpu->arch.cr3 = sregs->cr3; ++ else ++ set_bit(KVM_REQ_TRIPLE_FAULT, &vcpu->requests); ++ up_read(&vcpu->kvm->slots_lock); + + kvm_set_cr8(vcpu, sregs->cr8); + + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:15 2009 +Message-Id: <20090701002415.081558754@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:22:59 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Avi Kivity +Subject: [patch 010/108] KVM: VMX: Handle vmx instruction vmexits +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=kvm-vmx-handle-vmx-instruction-vmexits.patch +Content-Length: 1809 +Lines: 48 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Avi Kivity + +commit e3c7cb6ad7191e92ba89d00a7ae5f5dd1ca0c214 upstream. + +IF a guest tries to use vmx instructions, inject a #UD to let it know the +instruction is not implemented, rather than crashing. + +This prevents guest userspace from crashing the guest kernel. + +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/vmx.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -3015,6 +3015,12 @@ static int handle_vmcall(struct kvm_vcpu + return 1; + } + ++static int handle_vmx_insn(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run) ++{ ++ kvm_queue_exception(vcpu, UD_VECTOR); ++ return 1; ++} ++ + static int handle_invlpg(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run) + { + u64 exit_qualification = vmcs_read64(EXIT_QUALIFICATION); +@@ -3182,6 +3188,15 @@ static int (*kvm_vmx_exit_handlers[])(st + [EXIT_REASON_HLT] = handle_halt, + [EXIT_REASON_INVLPG] = handle_invlpg, + [EXIT_REASON_VMCALL] = handle_vmcall, ++ [EXIT_REASON_VMCLEAR] = handle_vmx_insn, ++ [EXIT_REASON_VMLAUNCH] = handle_vmx_insn, ++ [EXIT_REASON_VMPTRLD] = handle_vmx_insn, ++ [EXIT_REASON_VMPTRST] = handle_vmx_insn, ++ [EXIT_REASON_VMREAD] = handle_vmx_insn, ++ [EXIT_REASON_VMRESUME] = handle_vmx_insn, ++ [EXIT_REASON_VMWRITE] = handle_vmx_insn, ++ [EXIT_REASON_VMOFF] = handle_vmx_insn, ++ [EXIT_REASON_VMON] = handle_vmx_insn, + [EXIT_REASON_TPR_BELOW_THRESHOLD] = handle_tpr_below_threshold, + [EXIT_REASON_APIC_ACCESS] = handle_apic_access, + [EXIT_REASON_WBINVD] = handle_wbinvd, + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:15 2009 +Message-Id: <20090701002415.528425884@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:00 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andrea Arcangeli , + Marcelo Tosatti , + Avi Kivity +Subject: [patch 011/108] KVM: protect concurrent make_all_cpus_request +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=kvm-protect-concurrent-make_all_cpus_request.patch +Content-Length: 2023 +Lines: 63 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Marcelo Tosatti + +commit 84261923d3dddb766736023bead6fa07b7e218d5 upstream. + +make_all_cpus_request contains a race condition which can +trigger false request completed status, as follows: + +CPU0 CPU1 + +if (test_and_set_bit(req,&vcpu->requests)) + .... if (test_and_set_bit(req,&vcpu->requests)) + .. return +proceed to smp_call_function_many(wait=1) + +Use a spinlock to serialize concurrent CPUs. + +Signed-off-by: Andrea Arcangeli +Signed-off-by: Marcelo Tosatti +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/kvm_host.h | 1 + + virt/kvm/kvm_main.c | 3 +++ + 2 files changed, 4 insertions(+) + +--- a/include/linux/kvm_host.h ++++ b/include/linux/kvm_host.h +@@ -125,6 +125,7 @@ struct kvm_kernel_irq_routing_entry { + struct kvm { + struct mutex lock; /* protects the vcpus array and APIC accesses */ + spinlock_t mmu_lock; ++ spinlock_t requests_lock; + struct rw_semaphore slots_lock; + struct mm_struct *mm; /* userspace tied to this vm */ + int nmemslots; +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -581,6 +581,7 @@ static bool make_all_cpus_request(struct + cpumask_clear(cpus); + + me = get_cpu(); ++ spin_lock(&kvm->requests_lock); + for (i = 0; i < KVM_MAX_VCPUS; ++i) { + vcpu = kvm->vcpus[i]; + if (!vcpu) +@@ -597,6 +598,7 @@ static bool make_all_cpus_request(struct + smp_call_function_many(cpus, ack_flush, NULL, 1); + else + called = false; ++ spin_unlock(&kvm->requests_lock); + put_cpu(); + free_cpumask_var(cpus); + return called; +@@ -817,6 +819,7 @@ static struct kvm *kvm_create_vm(void) + kvm->mm = current->mm; + atomic_inc(&kvm->mm->mm_count); + spin_lock_init(&kvm->mmu_lock); ++ spin_lock_init(&kvm->requests_lock); + kvm_io_bus_init(&kvm->pio_bus); + mutex_init(&kvm->lock); + kvm_io_bus_init(&kvm->mmio_bus); + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:16 2009 +Message-Id: <20090701002415.739953685@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:01 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Izik Eidus , + Avi Kivity +Subject: [patch 012/108] KVM: Fix dirty bit tracking for slots with large pages +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=kvm-fix-dirty-bit-tracking-for-slots-with-large-pages.patch +Content-Length: 782 +Lines: 30 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Izik Eidus + +commit e244584fe3a5c20deddeca246548ac86dbc6e1d1 upstream. + +When slot is already allocated and being asked to be tracked we need +to break the large pages. + +This code flush the mmu when someone ask a slot to start dirty bit +tracking. + +Signed-off-by: Izik Eidus +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + virt/kvm/kvm_main.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -1030,6 +1030,8 @@ int __kvm_set_memory_region(struct kvm * + if (!new.dirty_bitmap) + goto out_free; + memset(new.dirty_bitmap, 0, dirty_bytes); ++ if (old.npages) ++ kvm_arch_flush_shadow(kvm); + } + #endif /* not defined CONFIG_S390 */ + + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:16 2009 +Message-Id: <20090701002416.135885567@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:02 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eric Paris , + Mimi Zohar , + James Morris +Subject: [patch 013/108] IMA: use current_cred() instead of current->cred +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=ima-use-current_cred-instead-of-current-cred.patch +Content-Length: 1457 +Lines: 40 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Eric Paris + +commit 37bcbf13d32e4e453e9def79ee72bd953b88302f upstream. + +Proper invocation of the current credentials is to use current_cred() not +current->cred. This patches makes IMA use the new method. + +Signed-off-by: Eric Paris +Acked-by: Mimi Zohar +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + security/integrity/ima/ima_audit.c | 2 +- + security/integrity/ima/ima_main.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/security/integrity/ima/ima_audit.c ++++ b/security/integrity/ima/ima_audit.c +@@ -50,7 +50,7 @@ void integrity_audit_msg(int audit_msgno + + ab = audit_log_start(current->audit_context, GFP_KERNEL, audit_msgno); + audit_log_format(ab, "integrity: pid=%d uid=%u auid=%u ses=%u", +- current->pid, current->cred->uid, ++ current->pid, current_cred()->uid, + audit_get_loginuid(current), + audit_get_sessionid(current)); + audit_log_task_context(ab); +--- a/security/integrity/ima/ima_main.c ++++ b/security/integrity/ima/ima_main.c +@@ -196,7 +196,7 @@ int ima_path_check(struct path *path, in + struct dentry *dentry = dget(path->dentry); + struct vfsmount *mnt = mntget(path->mnt); + +- file = dentry_open(dentry, mnt, O_RDONLY, current->cred); ++ file = dentry_open(dentry, mnt, O_RDONLY, current_cred()); + rc = get_path_measurement(iint, file, dentry->d_name.name); + } + out: + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:17 2009 +Message-Id: <20090701002416.562974968@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:03 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eric Paris , + Mimi Zohar , + James Morris +Subject: [patch 014/108] IMA: Handle dentry_open failures +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=ima-handle-dentry_open-failures.patch +Content-Length: 1255 +Lines: 44 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Eric Paris + +commit f06dd16a03f6f7f72fab4db03be36e28c28c6fd6 upstream. + +Currently IMA does not handle failures from dentry_open(). This means that we +leave a pointer set to ERR_PTR(errno) and then try to use it just a few lines +later in fput(). Oops. + +Signed-off-by: Eric Paris +Acked-by: Mimi Zohar +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + security/integrity/ima/ima_main.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/security/integrity/ima/ima_main.c ++++ b/security/integrity/ima/ima_main.c +@@ -128,10 +128,6 @@ static int get_path_measurement(struct i + { + int rc = 0; + +- if (IS_ERR(file)) { +- pr_info("%s dentry_open failed\n", filename); +- return rc; +- } + iint->opencount++; + iint->readcount++; + +@@ -197,6 +193,12 @@ int ima_path_check(struct path *path, in + struct vfsmount *mnt = mntget(path->mnt); + + file = dentry_open(dentry, mnt, O_RDONLY, current_cred()); ++ if (IS_ERR(file)) { ++ pr_info("%s dentry_open failed\n", dentry->d_name.name); ++ rc = PTR_ERR(file); ++ file = NULL; ++ goto out; ++ } + rc = get_path_measurement(iint, file, dentry->d_name.name); + } + out: + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:17 2009 +Message-Id: <20090701002417.180909517@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:04 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eric Paris , + Mimi Zohar , + James Morris +Subject: [patch 015/108] IMA: open all files O_LARGEFILE +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=ima-open-all-files-o_largefile.patch +Content-Length: 1077 +Lines: 30 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Eric Paris + +commit 1a62e958fa4aaeeb752311b4f5e16b2a86737b23 upstream. + +If IMA tried to measure a file which was larger than 4G dentry_open would fail +with -EOVERFLOW since IMA wasn't passing O_LARGEFILE. This patch passes +O_LARGEFILE to all IMA opens to avoid this problem. + +Signed-off-by: Eric Paris +Acked-by: Mimi Zohar +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + security/integrity/ima/ima_main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/security/integrity/ima/ima_main.c ++++ b/security/integrity/ima/ima_main.c +@@ -192,7 +192,8 @@ int ima_path_check(struct path *path, in + struct dentry *dentry = dget(path->dentry); + struct vfsmount *mnt = mntget(path->mnt); + +- file = dentry_open(dentry, mnt, O_RDONLY, current_cred()); ++ file = dentry_open(dentry, mnt, O_RDONLY | O_LARGEFILE, ++ current_cred()); + if (IS_ERR(file)) { + pr_info("%s dentry_open failed\n", dentry->d_name.name); + rc = PTR_ERR(file); + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:17 2009 +Message-Id: <20090701002417.581497504@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:05 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andy Gospodarek , + Alexander Duyck , + "David S. Miller" +Subject: [patch 016/108] e1000e: stop unnecessary polling when using msi-x +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=e1000e-stop-unnecessary-polling-when-using-msi-x.patch +Content-Length: 1469 +Lines: 44 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Andy Gospodarek + +[ Upstream commit 679e8a0f0ae3333e94b1d374d07775fce9066025 ] + +The last hunk of this commit: + + commit 12d04a3c12b420f23398b4d650127642469a60a6 + Author: Alexander Duyck + Date: Wed Mar 25 22:05:03 2009 +0000 + + e1000e: commonize tx cleanup routine to match e1000 & igb + +changed the logic for determining if we should call napi_complete or +not at then end of a napi poll. + +If the NIC is using MSI-X with no work to do in ->poll, net_rx_action +can just spin indefinitely on older kernels and for 2 jiffies on newer +kernels since napi_complete is never called and budget isn't +decremented. + +Discovered and verified while testing driver backport to an older +kernel. + +Signed-off-by: Andy Gospodarek +Acked-by: Alexander Duyck +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/e1000e/netdev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/e1000e/netdev.c ++++ b/drivers/net/e1000e/netdev.c +@@ -1996,7 +1996,7 @@ static int e1000_clean(struct napi_struc + struct e1000_adapter *adapter = container_of(napi, struct e1000_adapter, napi); + struct e1000_hw *hw = &adapter->hw; + struct net_device *poll_dev = adapter->netdev; +- int tx_cleaned = 0, work_done = 0; ++ int tx_cleaned = 1, work_done = 0; + + adapter = netdev_priv(poll_dev); + + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:18 2009 +Message-Id: <20090701002417.910884894@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:06 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Michael Buesch , + "David S. Miller" +Subject: [patch 017/108] pegasus usb-net: Fix endianness bugs +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=pegasus-usb-net-fix-endianness-bugs.patch +Content-Length: 2980 +Lines: 93 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Michael Buesch + +[ Upstream commit e3453f6342110d60edb37be92c4a4f668ca8b0c4 ] + +This fixes various endianness bugs. Some harmless and some real ones. +This is tested on a PowerPC-64 machine. + +Signed-off-by: Michael Buesch +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/pegasus.c | 29 +++++++++++++++++------------ + 1 file changed, 17 insertions(+), 12 deletions(-) + +--- a/drivers/net/usb/pegasus.c ++++ b/drivers/net/usb/pegasus.c +@@ -297,7 +297,7 @@ static int update_eth_regs_async(pegasus + + pegasus->dr.bRequestType = PEGASUS_REQT_WRITE; + pegasus->dr.bRequest = PEGASUS_REQ_SET_REGS; +- pegasus->dr.wValue = 0; ++ pegasus->dr.wValue = cpu_to_le16(0); + pegasus->dr.wIndex = cpu_to_le16(EthCtrl0); + pegasus->dr.wLength = cpu_to_le16(3); + pegasus->ctrl_urb->transfer_buffer_length = 3; +@@ -446,11 +446,12 @@ static int write_eprom_word(pegasus_t * + int i; + __u8 tmp, d[4] = { 0x3f, 0, 0, EPROM_WRITE }; + int ret; ++ __le16 le_data = cpu_to_le16(data); + + set_registers(pegasus, EpromOffset, 4, d); + enable_eprom_write(pegasus); + set_register(pegasus, EpromOffset, index); +- set_registers(pegasus, EpromData, 2, &data); ++ set_registers(pegasus, EpromData, 2, &le_data); + set_register(pegasus, EpromCtrl, EPROM_WRITE); + + for (i = 0; i < REG_TIMEOUT; i++) { +@@ -923,29 +924,32 @@ static struct net_device_stats *pegasus_ + + static inline void disable_net_traffic(pegasus_t * pegasus) + { +- int tmp = 0; ++ __le16 tmp = cpu_to_le16(0); + +- set_registers(pegasus, EthCtrl0, 2, &tmp); ++ set_registers(pegasus, EthCtrl0, sizeof(tmp), &tmp); + } + + static inline void get_interrupt_interval(pegasus_t * pegasus) + { +- __u8 data[2]; ++ u16 data; ++ u8 interval; + +- read_eprom_word(pegasus, 4, (__u16 *) data); ++ read_eprom_word(pegasus, 4, &data); ++ interval = data >> 8; + if (pegasus->usb->speed != USB_SPEED_HIGH) { +- if (data[1] < 0x80) { ++ if (interval < 0x80) { + if (netif_msg_timer(pegasus)) + dev_info(&pegasus->intf->dev, "intr interval " + "changed from %ums to %ums\n", +- data[1], 0x80); +- data[1] = 0x80; ++ interval, 0x80); ++ interval = 0x80; ++ data = (data & 0x00FF) | ((u16)interval << 8); + #ifdef PEGASUS_WRITE_EEPROM +- write_eprom_word(pegasus, 4, *(__u16 *) data); ++ write_eprom_word(pegasus, 4, data); + #endif + } + } +- pegasus->intr_interval = data[1]; ++ pegasus->intr_interval = interval; + } + + static void set_carrier(struct net_device *net) +@@ -1299,7 +1303,8 @@ static int pegasus_blacklisted(struct us + /* Special quirk to keep the driver from handling the Belkin Bluetooth + * dongle which happens to have the same ID. + */ +- if ((udd->idVendor == VENDOR_BELKIN && udd->idProduct == 0x0121) && ++ if ((udd->idVendor == cpu_to_le16(VENDOR_BELKIN)) && ++ (udd->idProduct == cpu_to_le16(0x0121)) && + (udd->bDeviceClass == USB_CLASS_WIRELESS_CONTROLLER) && + (udd->bDeviceProtocol == 1)) + return 1; + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:18 2009 +Message-Id: <20090701002418.219188826@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:07 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Neil Horman , + "David S. Miller" +Subject: [patch 018/108] ipv4: fix NULL pointer + success return in route lookup path +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=ipv4-fix-null-pointer-success-return-in-route-lookup-path.patch +Content-Length: 2348 +Lines: 61 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Neil Horman + +[ Upstream commit 73e42897e8e5619eacb787d2ce69be12f47cfc21 ] + +Don't drop route if we're not caching + + I recently got a report of an oops on a route lookup. Maxime was +testing what would happen if route caching was turned off (doing so by setting +making rt_caching always return 0), and found that it triggered an oops. I +looked at it and found that the problem stemmed from the fact that the route +lookup routines were returning success from their lookup paths (which is good), +but never set the **rp pointer to anything (which is bad). This happens because +in rt_intern_hash, if rt_caching returns false, we call rt_drop and return 0. +This almost emulates slient success. What we should be doing is assigning *rp = +rt and _not_ dropping the route. This way, during slow path lookups, when we +create a new route cache entry, we don't immediately discard it, rather we just +don't add it into the cache hash table, but we let this one lookup use it for +the purpose of this route request. Maxime has tested and reports it prevents +the oops. There is still a subsequent routing issue that I'm looking into +further, but I'm confident that, even if its related to this same path, this +patch makes sense to take. + +Signed-off-by: Neil Horman +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/route.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -1081,8 +1081,16 @@ restart: + now = jiffies; + + if (!rt_caching(dev_net(rt->u.dst.dev))) { +- rt_drop(rt); +- return 0; ++ /* ++ * If we're not caching, just tell the caller we ++ * were successful and don't touch the route. The ++ * caller hold the sole reference to the cache entry, and ++ * it will be released when the caller is done with it. ++ * If we drop it here, the callers have no way to resolve routes ++ * when we're not caching. Instead, just point *rp at rt, so ++ * the caller gets a single use out of the route ++ */ ++ goto report_and_exit; + } + + rthp = &rt_hash_table[hash].chain; +@@ -1210,6 +1218,8 @@ restart: + rcu_assign_pointer(rt_hash_table[hash].chain, rt); + + spin_unlock_bh(rt_hash_lock_addr(hash)); ++ ++report_and_exit: + *rp = rt; + return 0; + } + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:18 2009 +Message-Id: <20090701002418.436619378@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:08 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Neil Horman , + "David S. Miller" +Subject: [patch 019/108] ipv4 routing: Ensure that route cache entries are usable and reclaimable with caching is off +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=ipv4-routing-ensure-that-route-cache-entries-are-usable-and-reclaimable-with-caching-is-off.patch +Content-Length: 3485 +Lines: 90 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Neil Horman + +[ Upstream commit b6280b47a7a42970d098a3059f4ebe7e55e90d8d ] + +When route caching is disabled (rt_caching returns false), We still use route +cache entries that are created and passed into rt_intern_hash once. These +routes need to be made usable for the one call path that holds a reference to +them, and they need to be reclaimed when they're finished with their use. To be +made usable, they need to be associated with a neighbor table entry (which they +currently are not), otherwise iproute_finish2 just discards the packet, since we +don't know which L2 peer to send the packet to. To do this binding, we need to +follow the path a bit higher up in rt_intern_hash, which calls +arp_bind_neighbour, but not assign the route entry to the hash table. +Currently, if caching is off, we simply assign the route to the rp pointer and +are reutrn success. This patch associates us with a neighbor entry first. + +Secondly, we need to make sure that any single use routes like this are known to +the garbage collector when caching is off. If caching is off, and we try to +hash in a route, it will leak when its refcount reaches zero. To avoid this, +this patch calls rt_free on the route cache entry passed into rt_intern_hash. +This places us on the gc list for the route cache garbage collector, so that +when its refcount reaches zero, it will be reclaimed (Thanks to Alexey for this +suggestion). + +I've tested this on a local system here, and with these patches in place, I'm +able to maintain routed connectivity to remote systems, even if I set +/proc/sys/net/ipv4/rt_cache_rebuild_count to -1, which forces rt_caching to +return false. + +Signed-off-by: Neil Horman +Reported-by: Jarek Poplawski +Reported-by: Maxime Bizon +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/route.c | 26 +++++++++++++++++++++++--- + 1 file changed, 23 insertions(+), 3 deletions(-) + +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -1089,8 +1089,27 @@ restart: + * If we drop it here, the callers have no way to resolve routes + * when we're not caching. Instead, just point *rp at rt, so + * the caller gets a single use out of the route ++ * Note that we do rt_free on this new route entry, so that ++ * once its refcount hits zero, we are still able to reap it ++ * (Thanks Alexey) ++ * Note also the rt_free uses call_rcu. We don't actually ++ * need rcu protection here, this is just our path to get ++ * on the route gc list. + */ +- goto report_and_exit; ++ ++ if (rt->rt_type == RTN_UNICAST || rt->fl.iif == 0) { ++ int err = arp_bind_neighbour(&rt->u.dst); ++ if (err) { ++ if (net_ratelimit()) ++ printk(KERN_WARNING ++ "Neighbour table failure & not caching routes.\n"); ++ rt_drop(rt); ++ return err; ++ } ++ } ++ ++ rt_free(rt); ++ goto skip_hashing; + } + + rthp = &rt_hash_table[hash].chain; +@@ -1204,7 +1223,8 @@ restart: + #if RT_CACHE_DEBUG >= 2 + if (rt->u.dst.rt_next) { + struct rtable *trt; +- printk(KERN_DEBUG "rt_cache @%02x: %pI4", hash, &rt->rt_dst); ++ printk(KERN_DEBUG "rt_cache @%02x: %pI4", ++ hash, &rt->rt_dst); + for (trt = rt->u.dst.rt_next; trt; trt = trt->u.dst.rt_next) + printk(" . %pI4", &trt->rt_dst); + printk("\n"); +@@ -1219,7 +1239,7 @@ restart: + + spin_unlock_bh(rt_hash_lock_addr(hash)); + +-report_and_exit: ++skip_hashing: + *rp = rt; + return 0; + } + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:18 2009 +Message-Id: <20090701002418.606152665@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:09 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Stephen Hemminger , + "David S. Miller" +Subject: [patch 020/108] sky2: dont look for VPD size +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=sky2-don-t-look-for-vpd-size.patch +Content-Length: 2395 +Lines: 74 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Stephen Hemminger + +[ Upstream commit 6cc90a5a6061428358d0f726a53fb44af5254111 ] + +The code to compute VPD size didn't handle some systems that use +chip without VPD. Also some of the newer chips use some additional +registers to store the actual size, and wasn't worth putting the +additional complexity in, so just remove the code. + +No big loss since the code to set the VPD size was only a +convenience so that utilities would not read the extra space past +the end of the available VPD. + +Move the first PCI config read earlier to detect bad hardware +where it returns all ones and refuse loading driver before furthur +damage. + +Signed-off-by: Stephen Hemminger +Tested-by: Andy Whitcroft +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/sky2.c | 31 ++++++++++++++++--------------- + 1 file changed, 16 insertions(+), 15 deletions(-) + +--- a/drivers/net/sky2.c ++++ b/drivers/net/sky2.c +@@ -4365,6 +4365,22 @@ static int __devinit sky2_probe(struct p + goto err_out; + } + ++ /* Get configuration information ++ * Note: only regular PCI config access once to test for HW issues ++ * other PCI access through shared memory for speed and to ++ * avoid MMCONFIG problems. ++ */ ++ err = pci_read_config_dword(pdev, PCI_DEV_REG2, ®); ++ if (err) { ++ dev_err(&pdev->dev, "PCI read config failed\n"); ++ goto err_out; ++ } ++ ++ if (~reg == 0) { ++ dev_err(&pdev->dev, "PCI configuration read error\n"); ++ goto err_out; ++ } ++ + err = pci_request_regions(pdev, DRV_NAME); + if (err) { + dev_err(&pdev->dev, "cannot obtain PCI resources\n"); +@@ -4390,21 +4406,6 @@ static int __devinit sky2_probe(struct p + } + } + +- /* Get configuration information +- * Note: only regular PCI config access once to test for HW issues +- * other PCI access through shared memory for speed and to +- * avoid MMCONFIG problems. +- */ +- err = pci_read_config_dword(pdev, PCI_DEV_REG2, ®); +- if (err) { +- dev_err(&pdev->dev, "PCI read config failed\n"); +- goto err_out_free_regions; +- } +- +- /* size of available VPD, only impact sysfs */ +- err = pci_vpd_truncate(pdev, 1ul << (((reg & PCI_VPD_ROM_SZ) >> 14) + 8)); +- if (err) +- dev_warn(&pdev->dev, "Can't set VPD size\n"); + + #ifdef __BIG_ENDIAN + /* The sk98lin vendor driver uses hardware byte swapping but + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:19 2009 +Message-Id: <20090701002418.865780488@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:10 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Eric W. Biederman" , + "David S. Miller" +Subject: [patch 021/108] tun: Fix unregister race +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=tun-fix-unregister-race.patch +Content-Length: 1621 +Lines: 54 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Eric W. Biederman + +[ Upstream commit f0a4d0e5b5bfd271e6737f7c095994835b70d450 ] + +It is possible for tun_chr_close to race with dellink on the +a tun device. In which case if __tun_get runs before dellink +but dellink runs before tun_chr_close calls unregister_netdevice +we will attempt to unregister the netdevice after it is already +gone. + +The two cases are already serialized on the rtnl_lock, so I have +gone for the cheap simple fix of moving rtnl_lock to cover __tun_get +in tun_chr_close. Eliminating the possibility of the tun device +being unregistered between __tun_get and unregister_netdevice in +tun_chr_close. + +Signed-off-by: Eric W. Biederman +Tested-by: David Woodhouse +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/tun.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -1275,21 +1275,22 @@ static int tun_chr_open(struct inode *in + static int tun_chr_close(struct inode *inode, struct file *file) + { + struct tun_file *tfile = file->private_data; +- struct tun_struct *tun = __tun_get(tfile); ++ struct tun_struct *tun; + + ++ rtnl_lock(); ++ tun = __tun_get(tfile); + if (tun) { + DBG(KERN_INFO "%s: tun_chr_close\n", tun->dev->name); + +- rtnl_lock(); + __tun_detach(tun); + + /* If desireable, unregister the netdevice. */ + if (!(tun->flags & TUN_PERSIST)) + unregister_netdevice(tun->dev); + +- rtnl_unlock(); + } ++ rtnl_unlock(); + + tun = tfile->tun; + if (tun) + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:19 2009 +Message-Id: <20090701002419.250025565@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:11 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dave Jones , + "David S. Miller" +Subject: [patch 022/108] via-velocity: Fix velocity driver unmapping incorrect size. +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=via-velocity-fix-velocity-driver-unmapping-incorrect-size.patch +Content-Length: 901 +Lines: 27 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Dave Jones + +[ Upstream commit f6b24caaf933a466397915a08e30e885a32f905a ] + +When a packet is greater than ETH_ZLEN, we end up assigning the +boolean result of a comparison to the size we unmap. + +Signed-off-by: Dave Jones +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/via-velocity.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/via-velocity.c ++++ b/drivers/net/via-velocity.c +@@ -1845,7 +1845,7 @@ static void velocity_free_tx_buf(struct + */ + if (tdinfo->skb_dma) { + +- pktlen = (skb->len > ETH_ZLEN ? : ETH_ZLEN); ++ pktlen = max_t(unsigned int, skb->len, ETH_ZLEN); + for (i = 0; i < tdinfo->nskb_dma; i++) { + #ifdef VELOCITY_ZERO_COPY_SUPPORT + pci_unmap_single(vptr->pdev, tdinfo->skb_dma[i], le16_to_cpu(td->tdesc1.len), PCI_DMA_TODEVICE); + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:19 2009 +Message-Id: <20090701002419.672727891@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:12 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [patch 023/108] x25: Fix sleep from timer on socket destroy. +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=x25-fix-sleep-from-timer-on-socket-destroy.patch +Content-Length: 2651 +Lines: 98 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: David S. Miller + +[ Upstream commit 14ebaf81e13ce66bff275380b246796fd16cbfa1 ] + +If socket destuction gets delayed to a timer, we try to +lock_sock() from that timer which won't work. + +Use bh_lock_sock() in that case. + +Signed-off-by: David S. Miller +Tested-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + include/net/x25.h | 2 +- + net/x25/af_x25.c | 23 ++++++++++++++++++----- + net/x25/x25_timer.c | 2 +- + 3 files changed, 20 insertions(+), 7 deletions(-) + +--- a/include/net/x25.h ++++ b/include/net/x25.h +@@ -187,7 +187,7 @@ extern int x25_addr_ntoa(unsigned char + extern int x25_addr_aton(unsigned char *, struct x25_address *, + struct x25_address *); + extern struct sock *x25_find_socket(unsigned int, struct x25_neigh *); +-extern void x25_destroy_socket(struct sock *); ++extern void x25_destroy_socket_from_timer(struct sock *); + extern int x25_rx_call_request(struct sk_buff *, struct x25_neigh *, unsigned int); + extern void x25_kill_by_neigh(struct x25_neigh *); + +--- a/net/x25/af_x25.c ++++ b/net/x25/af_x25.c +@@ -332,14 +332,14 @@ static unsigned int x25_new_lci(struct x + /* + * Deferred destroy. + */ +-void x25_destroy_socket(struct sock *); ++static void __x25_destroy_socket(struct sock *); + + /* + * handler for deferred kills. + */ + static void x25_destroy_timer(unsigned long data) + { +- x25_destroy_socket((struct sock *)data); ++ x25_destroy_socket_from_timer((struct sock *)data); + } + + /* +@@ -349,12 +349,10 @@ static void x25_destroy_timer(unsigned l + * will touch it and we are (fairly 8-) ) safe. + * Not static as it's used by the timer + */ +-void x25_destroy_socket(struct sock *sk) ++static void __x25_destroy_socket(struct sock *sk) + { + struct sk_buff *skb; + +- sock_hold(sk); +- lock_sock(sk); + x25_stop_heartbeat(sk); + x25_stop_timer(sk); + +@@ -385,7 +383,22 @@ void x25_destroy_socket(struct sock *sk) + /* drop last reference so sock_put will free */ + __sock_put(sk); + } ++} + ++void x25_destroy_socket_from_timer(struct sock *sk) ++{ ++ sock_hold(sk); ++ bh_lock_sock(sk); ++ __x25_destroy_socket(sk); ++ bh_unlock_sock(sk); ++ sock_put(sk); ++} ++ ++static void x25_destroy_socket(struct sock *sk) ++{ ++ sock_hold(sk); ++ lock_sock(sk); ++ __x25_destroy_socket(sk); + release_sock(sk); + sock_put(sk); + } +--- a/net/x25/x25_timer.c ++++ b/net/x25/x25_timer.c +@@ -113,7 +113,7 @@ static void x25_heartbeat_expiry(unsigne + (sk->sk_state == TCP_LISTEN && + sock_flag(sk, SOCK_DEAD))) { + bh_unlock_sock(sk); +- x25_destroy_socket(sk); ++ x25_destroy_socket_from_timer(sk); + return; + } + break; + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:20 2009 +Message-Id: <20090701002419.889885576@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:13 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Stephen Hemminger , + Jay Vosburgh , + "David S. Miller" +Subject: [patch 024/108] bonding: fix multiple module load problem +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=bonding-fix-multiple-module-load-problem.patch +Content-Length: 1185 +Lines: 37 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Stephen Hemminger + +[ Upstream commit 130aa61a77b8518f1ea618e1b7d214d60b405f10 ] + +Some users still load bond module multiple times to create bonding +devices. This accidentally was broken by a later patch about +the time sysfs was fixed. According to Jay, it was broken +by: + commit b8a9787eddb0e4665f31dd1d64584732b2b5d051 + Author: Jay Vosburgh + Date: Fri Jun 13 18:12:04 2008 -0700 + + bonding: Allow setting max_bonds to zero + +Note: sysfs and procfs still produce WARN() messages when this is done +so the sysfs method is the recommended API. + +Signed-off-by: Stephen Hemminger +Signed-off-by: Jay Vosburgh +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/bonding/bond_sysfs.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/bonding/bond_sysfs.c ++++ b/drivers/net/bonding/bond_sysfs.c +@@ -1538,6 +1538,7 @@ int bond_create_sysfs(void) + printk(KERN_ERR + "network device named %s already exists in sysfs", + class_attr_bonding_masters.attr.name); ++ ret = 0; + } + + return ret; + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:20 2009 +Message-Id: <20090701002420.141480274@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:14 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Joerg Roedel , + lethal@linux-sh.org, + just.for.lkml@googlemail.com, + hancockrwd@gmail.com, + jens.axboe@oracle.com, + bharrosh@panasas.com, + FUJITA Tomonori , + Ingo Molnar +Subject: [patch 025/108] dma-debug: change hash_bucket_find from first-fit to best-fit +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=dma-debug-change-hash_bucket_find-from-first-fit-to-best-fit.patch +Content-Length: 2890 +Lines: 89 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Joerg Roedel + +commit 7caf6a49bb17d0377210693af5737563b31aa5ee upstream. + +Some device drivers map the same physical address multiple times to a +dma address. Without an IOMMU this results in the same dma address being +put into the dma-debug hash multiple times. With a first-fit match in +hash_bucket_find() this function may return the wrong dma_debug_entry. + +This can result in false positive warnings. This patch fixes it by +changing the first-fit behavior of hash_bucket_find() into a best-fit +algorithm. + +Reported-by: Torsten Kaiser +Reported-by: FUJITA Tomonori +Signed-off-by: Joerg Roedel +Cc: lethal@linux-sh.org +Cc: just.for.lkml@googlemail.com +Cc: hancockrwd@gmail.com +Cc: jens.axboe@oracle.com +Cc: bharrosh@panasas.com +Cc: FUJITA Tomonori +Cc: Linus Torvalds +LKML-Reference: <20090605104132.GE24836@amd.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + lib/dma-debug.c | 43 +++++++++++++++++++++++++++++++++++++++---- + 1 file changed, 39 insertions(+), 4 deletions(-) + +--- a/lib/dma-debug.c ++++ b/lib/dma-debug.c +@@ -185,15 +185,50 @@ static void put_hash_bucket(struct hash_ + static struct dma_debug_entry *hash_bucket_find(struct hash_bucket *bucket, + struct dma_debug_entry *ref) + { +- struct dma_debug_entry *entry; ++ struct dma_debug_entry *entry, *ret = NULL; ++ int matches = 0, match_lvl, last_lvl = 0; + + list_for_each_entry(entry, &bucket->list, list) { +- if ((entry->dev_addr == ref->dev_addr) && +- (entry->dev == ref->dev)) ++ if ((entry->dev_addr != ref->dev_addr) || ++ (entry->dev != ref->dev)) ++ continue; ++ ++ /* ++ * Some drivers map the same physical address multiple ++ * times. Without a hardware IOMMU this results in the ++ * same device addresses being put into the dma-debug ++ * hash multiple times too. This can result in false ++ * positives being reported. Therfore we implement a ++ * best-fit algorithm here which returns the entry from ++ * the hash which fits best to the reference value ++ * instead of the first-fit. ++ */ ++ matches += 1; ++ match_lvl = 0; ++ entry->size == ref->size ? ++match_lvl : match_lvl; ++ entry->type == ref->type ? ++match_lvl : match_lvl; ++ entry->direction == ref->direction ? ++match_lvl : match_lvl; ++ ++ if (match_lvl == 3) { ++ /* perfect-fit - return the result */ + return entry; ++ } else if (match_lvl > last_lvl) { ++ /* ++ * We found an entry that fits better then the ++ * previous one ++ */ ++ last_lvl = match_lvl; ++ ret = entry; ++ } + } + +- return NULL; ++ /* ++ * If we have multiple matches but no perfect-fit, just return ++ * NULL. ++ */ ++ ret = (matches == 1) ? ret : NULL; ++ ++ return ret; + } + + /* + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:20 2009 +Message-Id: <20090701002420.426675306@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:15 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dirk Eibach , + Jiri Slaby +Subject: [patch 026/108] char: moxa, prevent opening unavailable ports +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=char-moxa-prevent-opening-unavailable-ports.patch +Content-Length: 1431 +Lines: 47 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Dirk Eibach + +commit a90b037583d5f1ae3e54e9c687c79df82d1d34a4 upstream. + +In moxa.c there are 32 minor numbers reserved for each device. The number +of ports actually available per device is stored in +moxa_board_conf->numPorts. This number is not considered in moxa_open(). +Opening a port that is not available results in a kernel oops. This patch +adds a test to moxa_open() that prevents opening unavailable ports. + +[akpm@linux-foundation.org: avoid multiple returns] +Signed-off-by: Dirk Eibach +Signed-off-by: Jiri Slaby +Cc: Alan Cox +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/moxa.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/char/moxa.c ++++ b/drivers/char/moxa.c +@@ -1184,6 +1184,11 @@ static int moxa_open(struct tty_struct * + return -ENODEV; + } + ++ if (port % MAX_PORTS_PER_BOARD >= brd->numPorts) { ++ retval = -ENODEV; ++ goto out_unlock; ++ } ++ + ch = &brd->ports[port % MAX_PORTS_PER_BOARD]; + ch->port.count++; + tty->driver_data = ch; +@@ -1208,8 +1213,8 @@ static int moxa_open(struct tty_struct * + moxa_close_port(tty); + } else + ch->port.flags |= ASYNC_NORMAL_ACTIVE; ++out_unlock: + mutex_unlock(&moxa_openlock); +- + return retval; + } + + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:20 2009 +Message-Id: <20090701002420.652198255@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:16 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jiri Slaby , + Alan Cox +Subject: [patch 027/108] serial: refactor ASYNC_ flags +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=serial-refactor-async_-flags.patch +Content-Length: 7376 +Lines: 162 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jiri Slaby + +commit 70beaed22cbe12979e55d99b370e147e2e168562 upstream. + +Define ASYNCB_* flags which are bit numbers of the ASYNC_* flags. +This is useful for {test,set,clear}_bit. + +Also convert each ASYNC_% to be (1 << ASYNCB_%) and define masks +with the macros, not constants. + +Tested with: +#include "PATH_TO_KERNEL/include/linux/serial.h" +static struct { + unsigned int new, old; +} as[] = { + { ASYNC_HUP_NOTIFY, 0x0001 }, + { ASYNC_FOURPORT, 0x0002 }, +... + { ASYNC_BOOT_ONLYMCA, 0x00400000 }, + { ASYNC_INTERNAL_FLAGS, 0xFFC00000 } +}; +... + for (a = 0; a < ARRAY_SIZE(as); a++) + if (as[a].old != as[a].new) + printf("%.8x != %.8x\n", as[a].old, as[a].new); + +Signed-off-by: Jiri Slaby +Signed-off-by: Alan Cox +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/serial.h | 116 +++++++++++++++++++++++++++++-------------------- + 1 file changed, 69 insertions(+), 47 deletions(-) + +--- a/include/linux/serial.h ++++ b/include/linux/serial.h +@@ -96,54 +96,76 @@ struct serial_uart_config { + + /* + * Definitions for async_struct (and serial_struct) flags field ++ * ++ * Define ASYNCB_* for convenient use with {test,set,clear}_bit. + */ +-#define ASYNC_HUP_NOTIFY 0x0001 /* Notify getty on hangups and closes +- on the callout port */ +-#define ASYNC_FOURPORT 0x0002 /* Set OU1, OUT2 per AST Fourport settings */ +-#define ASYNC_SAK 0x0004 /* Secure Attention Key (Orange book) */ +-#define ASYNC_SPLIT_TERMIOS 0x0008 /* Separate termios for dialin/callout */ +- +-#define ASYNC_SPD_MASK 0x1030 +-#define ASYNC_SPD_HI 0x0010 /* Use 56000 instead of 38400 bps */ +- +-#define ASYNC_SPD_VHI 0x0020 /* Use 115200 instead of 38400 bps */ +-#define ASYNC_SPD_CUST 0x0030 /* Use user-specified divisor */ +- +-#define ASYNC_SKIP_TEST 0x0040 /* Skip UART test during autoconfiguration */ +-#define ASYNC_AUTO_IRQ 0x0080 /* Do automatic IRQ during autoconfiguration */ +-#define ASYNC_SESSION_LOCKOUT 0x0100 /* Lock out cua opens based on session */ +-#define ASYNC_PGRP_LOCKOUT 0x0200 /* Lock out cua opens based on pgrp */ +-#define ASYNC_CALLOUT_NOHUP 0x0400 /* Don't do hangups for cua device */ +- +-#define ASYNC_HARDPPS_CD 0x0800 /* Call hardpps when CD goes high */ +- +-#define ASYNC_SPD_SHI 0x1000 /* Use 230400 instead of 38400 bps */ +-#define ASYNC_SPD_WARP 0x1010 /* Use 460800 instead of 38400 bps */ +- +-#define ASYNC_LOW_LATENCY 0x2000 /* Request low latency behaviour */ +- +-#define ASYNC_BUGGY_UART 0x4000 /* This is a buggy UART, skip some safety +- * checks. Note: can be dangerous! */ +- +-#define ASYNC_AUTOPROBE 0x8000 /* Port was autoprobed by PCI or PNP code */ +- +-#define ASYNC_FLAGS 0x7FFF /* Possible legal async flags */ +-#define ASYNC_USR_MASK 0x3430 /* Legal flags that non-privileged +- * users can set or reset */ +- +-/* Internal flags used only by kernel/chr_drv/serial.c */ +-#define ASYNC_INITIALIZED 0x80000000 /* Serial port was initialized */ +-#define ASYNC_NORMAL_ACTIVE 0x20000000 /* Normal device is active */ +-#define ASYNC_BOOT_AUTOCONF 0x10000000 /* Autoconfigure port on bootup */ +-#define ASYNC_CLOSING 0x08000000 /* Serial port is closing */ +-#define ASYNC_CTS_FLOW 0x04000000 /* Do CTS flow control */ +-#define ASYNC_CHECK_CD 0x02000000 /* i.e., CLOCAL */ +-#define ASYNC_SHARE_IRQ 0x01000000 /* for multifunction cards +- --- no longer used */ +-#define ASYNC_CONS_FLOW 0x00800000 /* flow control for console */ +- +-#define ASYNC_BOOT_ONLYMCA 0x00400000 /* Probe only if MCA bus */ +-#define ASYNC_INTERNAL_FLAGS 0xFFC00000 /* Internal flags */ ++#define ASYNCB_HUP_NOTIFY 0 /* Notify getty on hangups and closes ++ * on the callout port */ ++#define ASYNCB_FOURPORT 1 /* Set OU1, OUT2 per AST Fourport settings */ ++#define ASYNCB_SAK 2 /* Secure Attention Key (Orange book) */ ++#define ASYNCB_SPLIT_TERMIOS 3 /* Separate termios for dialin/callout */ ++#define ASYNCB_SPD_HI 4 /* Use 56000 instead of 38400 bps */ ++#define ASYNCB_SPD_VHI 5 /* Use 115200 instead of 38400 bps */ ++#define ASYNCB_SKIP_TEST 6 /* Skip UART test during autoconfiguration */ ++#define ASYNCB_AUTO_IRQ 7 /* Do automatic IRQ during ++ * autoconfiguration */ ++#define ASYNCB_SESSION_LOCKOUT 8 /* Lock out cua opens based on session */ ++#define ASYNCB_PGRP_LOCKOUT 9 /* Lock out cua opens based on pgrp */ ++#define ASYNCB_CALLOUT_NOHUP 10 /* Don't do hangups for cua device */ ++#define ASYNCB_HARDPPS_CD 11 /* Call hardpps when CD goes high */ ++#define ASYNCB_SPD_SHI 12 /* Use 230400 instead of 38400 bps */ ++#define ASYNCB_LOW_LATENCY 13 /* Request low latency behaviour */ ++#define ASYNCB_BUGGY_UART 14 /* This is a buggy UART, skip some safety ++ * checks. Note: can be dangerous! */ ++#define ASYNCB_AUTOPROBE 15 /* Port was autoprobed by PCI or PNP code */ ++#define ASYNCB_LAST_USER 15 ++ ++/* Internal flags used only by kernel */ ++#define ASYNCB_INITIALIZED 31 /* Serial port was initialized */ ++#define ASYNCB_NORMAL_ACTIVE 29 /* Normal device is active */ ++#define ASYNCB_BOOT_AUTOCONF 28 /* Autoconfigure port on bootup */ ++#define ASYNCB_CLOSING 27 /* Serial port is closing */ ++#define ASYNCB_CTS_FLOW 26 /* Do CTS flow control */ ++#define ASYNCB_CHECK_CD 25 /* i.e., CLOCAL */ ++#define ASYNCB_SHARE_IRQ 24 /* for multifunction cards, no longer used */ ++#define ASYNCB_CONS_FLOW 23 /* flow control for console */ ++#define ASYNCB_BOOT_ONLYMCA 22 /* Probe only if MCA bus */ ++#define ASYNCB_FIRST_KERNEL 22 ++ ++#define ASYNC_HUP_NOTIFY (1U << ASYNCB_HUP_NOTIFY) ++#define ASYNC_FOURPORT (1U << ASYNCB_FOURPORT) ++#define ASYNC_SAK (1U << ASYNCB_SAK) ++#define ASYNC_SPLIT_TERMIOS (1U << ASYNCB_SPLIT_TERMIOS) ++#define ASYNC_SPD_HI (1U << ASYNCB_SPD_HI) ++#define ASYNC_SPD_VHI (1U << ASYNCB_SPD_VHI) ++#define ASYNC_SKIP_TEST (1U << ASYNCB_SKIP_TEST) ++#define ASYNC_AUTO_IRQ (1U << ASYNCB_AUTO_IRQ) ++#define ASYNC_SESSION_LOCKOUT (1U << ASYNCB_SESSION_LOCKOUT) ++#define ASYNC_PGRP_LOCKOUT (1U << ASYNCB_PGRP_LOCKOUT) ++#define ASYNC_CALLOUT_NOHUP (1U << ASYNCB_CALLOUT_NOHUP) ++#define ASYNC_HARDPPS_CD (1U << ASYNCB_HARDPPS_CD) ++#define ASYNC_SPD_SHI (1U << ASYNCB_SPD_SHI) ++#define ASYNC_LOW_LATENCY (1U << ASYNCB_LOW_LATENCY) ++#define ASYNC_BUGGY_UART (1U << ASYNCB_BUGGY_UART) ++#define ASYNC_AUTOPROBE (1U << ASYNCB_AUTOPROBE) ++ ++#define ASYNC_FLAGS ((1U << ASYNCB_LAST_USER) - 1) ++#define ASYNC_USR_MASK (ASYNC_SPD_HI|ASYNC_SPD_VHI| \ ++ ASYNC_CALLOUT_NOHUP|ASYNC_SPD_SHI|ASYNC_LOW_LATENCY) ++#define ASYNC_SPD_CUST (ASYNC_SPD_HI|ASYNC_SPD_VHI) ++#define ASYNC_SPD_WARP (ASYNC_SPD_HI|ASYNC_SPD_SHI) ++#define ASYNC_SPD_MASK (ASYNC_SPD_HI|ASYNC_SPD_VHI|ASYNC_SPD_SHI) ++ ++#define ASYNC_INITIALIZED (1U << ASYNCB_INITIALIZED) ++#define ASYNC_NORMAL_ACTIVE (1U << ASYNCB_NORMAL_ACTIVE) ++#define ASYNC_BOOT_AUTOCONF (1U << ASYNCB_BOOT_AUTOCONF) ++#define ASYNC_CLOSING (1U << ASYNCB_CLOSING) ++#define ASYNC_CTS_FLOW (1U << ASYNCB_CTS_FLOW) ++#define ASYNC_CHECK_CD (1U << ASYNCB_CHECK_CD) ++#define ASYNC_SHARE_IRQ (1U << ASYNCB_SHARE_IRQ) ++#define ASYNC_CONS_FLOW (1U << ASYNCB_CONS_FLOW) ++#define ASYNC_BOOT_ONLYMCA (1U << ASYNCB_BOOT_ONLYMCA) ++#define ASYNC_INTERNAL_FLAGS (~((1U << ASYNCB_FIRST_KERNEL) - 1)) + + /* + * Multiport serial configuration structure --- external structure + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:21 2009 +Message-Id: <20090701002421.050263995@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:17 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jiri Slaby , + Alan Cox +Subject: [patch 028/108] rocket: fix test_bit parameters +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=rocket-fix-test_bit-parameters.patch +Content-Length: 1497 +Lines: 46 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jiri Slaby + +commit a391ad0f09014856bbc4eeea309593eba977b3b0 upstream. + +Switch from ASYNC_* to ASYNCB_*, because {test,set}_bit expect +bit number, not mask. + +Signed-off-by: Jiri Slaby +Signed-off-by: Alan Cox +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/rocket.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/char/rocket.c ++++ b/drivers/char/rocket.c +@@ -934,7 +934,7 @@ static int rp_open(struct tty_struct *tt + /* + * Info->count is now 1; so it's safe to sleep now. + */ +- if (!test_bit(ASYNC_INITIALIZED, &port->flags)) { ++ if (!test_bit(ASYNCB_INITIALIZED, &port->flags)) { + cp = &info->channel; + sSetRxTrigger(cp, TRIG_1); + if (sGetChanStatus(cp) & CD_ACT) +@@ -958,7 +958,7 @@ static int rp_open(struct tty_struct *tt + sEnRxFIFO(cp); + sEnTransmit(cp); + +- set_bit(ASYNC_INITIALIZED, &info->port.flags); ++ set_bit(ASYNCB_INITIALIZED, &info->port.flags); + + /* + * Set up the tty->alt_speed kludge +@@ -1641,7 +1641,7 @@ static int rp_write(struct tty_struct *t + /* Write remaining data into the port's xmit_buf */ + while (1) { + /* Hung up ? */ +- if (!test_bit(ASYNC_NORMAL_ACTIVE, &info->port.flags)) ++ if (!test_bit(ASYNCB_NORMAL_ACTIVE, &info->port.flags)) + goto end; + c = min(count, XMIT_BUF_SIZE - info->xmit_cnt - 1); + c = min(c, XMIT_BUF_SIZE - info->xmit_head); + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:21 2009 +Message-Id: <20090701002421.479018764@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:18 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jiri Slaby , + Alan Cox +Subject: [patch 029/108] epca: fix test_bit parameters +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=epca-fix-test_bit-parameters.patch +Content-Length: 1711 +Lines: 50 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jiri Slaby + +commit c3301a5c04800bcf8afc8a815bf9e570a4e25a08 upstream. + +Switch from ASYNC_* to ASYNCB_*, because test_bit expects +bit number, not mask. + +Signed-off-by: Jiri Slaby +Signed-off-by: Alan Cox +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/epca.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/char/epca.c ++++ b/drivers/char/epca.c +@@ -1518,7 +1518,7 @@ static void doevent(int crd) + if (event & MODEMCHG_IND) { + /* A modem signal change has been indicated */ + ch->imodem = mstat; +- if (test_bit(ASYNC_CHECK_CD, &ch->port.flags)) { ++ if (test_bit(ASYNCB_CHECK_CD, &ch->port.flags)) { + /* We are now receiving dcd */ + if (mstat & ch->dcd) + wake_up_interruptible(&ch->port.open_wait); +@@ -1765,9 +1765,9 @@ static void epcaparam(struct tty_struct + * that the driver will wait on carrier detect. + */ + if (ts->c_cflag & CLOCAL) +- clear_bit(ASYNC_CHECK_CD, &ch->port.flags); ++ clear_bit(ASYNCB_CHECK_CD, &ch->port.flags); + else +- set_bit(ASYNC_CHECK_CD, &ch->port.flags); ++ set_bit(ASYNCB_CHECK_CD, &ch->port.flags); + mval = ch->m_dtr | ch->m_rts; + } /* End CBAUD not detected */ + iflag = termios2digi_i(ch, ts->c_iflag); +@@ -2244,7 +2244,8 @@ static void do_softint(struct work_struc + if (test_and_clear_bit(EPCA_EVENT_HANGUP, &ch->event)) { + tty_hangup(tty); + wake_up_interruptible(&ch->port.open_wait); +- clear_bit(ASYNC_NORMAL_ACTIVE, &ch->port.flags); ++ clear_bit(ASYNCB_NORMAL_ACTIVE, ++ &ch->port.flags); + } + } + tty_kref_put(tty); + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:22 2009 +Message-Id: <20090701002421.984876144@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:19 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andreas Herrmann , + Ingo Molnar +Subject: [patch 030/108] x86: Detect use of extended APIC ID for AMD CPUs +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=x86-detect-use-of-extended-apic-id-for-amd-cpus.patch +Content-Length: 3253 +Lines: 96 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Andreas Herrmann + +commit 42937e81a82b6bbc51a309c83da140b3a7ca5945 upstream. + +Booting a 32-bit kernel on Magny-Cours results in the following panic: + + ... + Using APIC driver default + ... + Overriding APIC driver with bigsmp + ... + Getting VERSION: 80050010 + Getting VERSION: 80050010 + Getting ID: 10000000 + Getting ID: ef000000 + Getting LVT0: 700 + Getting LVT1: 10000 + Kernel panic - not syncing: Boot APIC ID in local APIC unexpected (16 vs 0) + Pid: 1, comm: swapper Not tainted 2.6.30-rcX #2 + Call Trace: + [] ? panic+0x38/0xd3 + [] ? native_smp_prepare_cpus+0x259/0x31f + [] ? kernel_init+0x3e/0x141 + [] ? kernel_init+0x0/0x141 + [] ? kernel_thread_helper+0x7/0x10 + +The reason is that default_get_apic_id handled extension of local APIC +ID field just in case of XAPIC. + +Thus for this AMD CPU, default_get_apic_id() returns 0 and +bigsmp_get_apic_id() returns 16 which leads to the respective kernel +panic. + +This patch introduces a Linux specific feature flag to indicate +support for extended APIC id (8 bits instead of 4 bits width) and sets +the flag on AMD CPUs if applicable. + +Signed-off-by: Andreas Herrmann +LKML-Reference: <20090608135509.GA12431@alberich.amd.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/apic.h | 2 +- + arch/x86/include/asm/cpufeature.h | 1 + + arch/x86/kernel/cpu/amd.c | 10 ++++++++++ + 3 files changed, 12 insertions(+), 1 deletion(-) + +--- a/arch/x86/include/asm/apic.h ++++ b/arch/x86/include/asm/apic.h +@@ -410,7 +410,7 @@ static inline unsigned default_get_apic_ + { + unsigned int ver = GET_APIC_VERSION(apic_read(APIC_LVR)); + +- if (APIC_XAPIC(ver)) ++ if (APIC_XAPIC(ver) || boot_cpu_has(X86_FEATURE_EXTD_APICID)) + return (x >> 24) & 0xFF; + else + return (x >> 24) & 0x0F; +--- a/arch/x86/include/asm/cpufeature.h ++++ b/arch/x86/include/asm/cpufeature.h +@@ -94,6 +94,7 @@ + #define X86_FEATURE_TSC_RELIABLE (3*32+23) /* TSC is known to be reliable */ + #define X86_FEATURE_NONSTOP_TSC (3*32+24) /* TSC does not stop in C states */ + #define X86_FEATURE_CLFLUSH_MONITOR (3*32+25) /* "" clflush reqd with monitor */ ++#define X86_FEATURE_EXTD_APICID (3*32+26) /* has extended APICID (8 bits) */ + + /* Intel-defined CPU features, CPUID level 0x00000001 (ecx), word 4 */ + #define X86_FEATURE_XMM3 (4*32+ 0) /* "pni" SSE-3 */ +--- a/arch/x86/kernel/cpu/amd.c ++++ b/arch/x86/kernel/cpu/amd.c +@@ -6,6 +6,7 @@ + #include + #include + #include ++#include + + #ifdef CONFIG_X86_64 + # include +@@ -351,6 +352,15 @@ static void __cpuinit early_init_amd(str + (c->x86_model == 8 && c->x86_mask >= 8)) + set_cpu_cap(c, X86_FEATURE_K6_MTRR); + #endif ++#if defined(CONFIG_X86_LOCAL_APIC) && defined(CONFIG_PCI) ++ /* check CPU config space for extended APIC ID */ ++ if (c->x86 >= 0xf) { ++ unsigned int val; ++ val = read_pci_config(0, 24, 0, 0x68); ++ if ((val & ((1 << 17) | (1 << 18))) == ((1 << 17) | (1 << 18))) ++ set_cpu_cap(c, X86_FEATURE_EXTD_APICID); ++ } ++#endif + } + + static void __cpuinit init_amd(struct cpuinfo_x86 *c) + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:22 2009 +Message-Id: <20090701002422.510267149@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:20 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 031/108] USB: usbtmc: fix switch statment +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=usb-usbtmc-fix-switch-statment.patch +Content-Length: 1244 +Lines: 49 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Greg Kroah-Hartman + +commit a92b63e7e4c185b4dd9e87762e2cb716e54482d0 upstream. + +Steve Holland pointed out that we forgot to call break; in the switch +statment. This probably resolves a lot of the bug reports I've gotten +for the driver lately. + +Stupid me... + +Reported-by: Steve Holland +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/usbtmc.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/class/usbtmc.c ++++ b/drivers/usb/class/usbtmc.c +@@ -927,21 +927,27 @@ static long usbtmc_ioctl(struct file *fi + switch (cmd) { + case USBTMC_IOCTL_CLEAR_OUT_HALT: + retval = usbtmc_ioctl_clear_out_halt(data); ++ break; + + case USBTMC_IOCTL_CLEAR_IN_HALT: + retval = usbtmc_ioctl_clear_in_halt(data); ++ break; + + case USBTMC_IOCTL_INDICATOR_PULSE: + retval = usbtmc_ioctl_indicator_pulse(data); ++ break; + + case USBTMC_IOCTL_CLEAR: + retval = usbtmc_ioctl_clear(data); ++ break; + + case USBTMC_IOCTL_ABORT_BULK_OUT: + retval = usbtmc_ioctl_abort_bulk_out(data); ++ break; + + case USBTMC_IOCTL_ABORT_BULK_IN: + retval = usbtmc_ioctl_abort_bulk_in(data); ++ break; + } + + mutex_unlock(&data->io_mutex); + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:23 2009 +Message-Id: <20090701002422.816483097@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:21 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Michael Krufky , + Mauro Carvalho Chehab +Subject: [patch 032/108] DVB: lgdt3305: fix 64bit division in function lgdt3305_set_if +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=dvb-lgdt3305-fix-64bit-division-in-function-lgdt3305_set_if.patch +Content-Length: 1274 +Lines: 53 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Michael Krufky + +(cherry picked from commit 511da457340d3b30336f7a6731bad9bbe3ffaf08) + +Signed-off-by: Michael Krufky +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/frontends/lgdt3305.c | 17 +++-------------- + 1 file changed, 3 insertions(+), 14 deletions(-) + +--- a/drivers/media/dvb/frontends/lgdt3305.c ++++ b/drivers/media/dvb/frontends/lgdt3305.c +@@ -19,6 +19,7 @@ + * + */ + ++#include + #include + #include "dvb_math.h" + #include "lgdt3305.h" +@@ -496,27 +497,15 @@ static int lgdt3305_set_if(struct lgdt33 + + nco = if_freq_khz / 10; + +-#define LGDT3305_64BIT_DIVISION_ENABLED 0 +- /* FIXME: 64bit division disabled to avoid linking error: +- * WARNING: "__udivdi3" [lgdt3305.ko] undefined! +- */ + switch (param->u.vsb.modulation) { + case VSB_8: +-#if LGDT3305_64BIT_DIVISION_ENABLED + nco <<= 24; +- nco /= 625; +-#else +- nco *= ((1 << 24) / 625); +-#endif ++ do_div(nco, 625); + break; + case QAM_64: + case QAM_256: +-#if LGDT3305_64BIT_DIVISION_ENABLED + nco <<= 28; +- nco /= 625; +-#else +- nco *= ((1 << 28) / 625); +-#endif ++ do_div(nco, 625); + break; + default: + return -EINVAL; + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:23 2009 +Message-Id: <20090701002423.303460286@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:22 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Hans Verkuil , + Mauro Carvalho Chehab , + Michael Krufky +Subject: [patch 033/108] V4L: ivtv/cx18: fix regression: class controls are no longer seen +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=v4l-ivtv-cx18-fix-regression-class-controls-are-no-longer-seen.patch +Content-Length: 1917 +Lines: 56 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Hans Verkuil + +(cherry picked from commit c6711c3e6d4976716633047c0f6bbd953d6831fb) + +A previous change (v4l2-common: remove v4l2_ctrl_query_fill_std) broke +the handling of class controls in VIDIOC_QUERYCTRL. The MPEG class control +was broken for all drivers that use the cx2341x module and the USER class +control was broken for ivtv and cx18. + +This change adds back proper class control support. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/cx18/cx18-controls.c | 2 ++ + drivers/media/video/cx2341x.c | 2 ++ + drivers/media/video/ivtv/ivtv-controls.c | 2 ++ + 3 files changed, 6 insertions(+) + +--- a/drivers/media/video/cx18/cx18-controls.c ++++ b/drivers/media/video/cx18/cx18-controls.c +@@ -61,6 +61,8 @@ int cx18_queryctrl(struct file *file, vo + + switch (qctrl->id) { + /* Standard V4L2 controls */ ++ case V4L2_CID_USER_CLASS: ++ return v4l2_ctrl_query_fill(qctrl, 0, 0, 0, 0); + case V4L2_CID_BRIGHTNESS: + case V4L2_CID_HUE: + case V4L2_CID_SATURATION: +--- a/drivers/media/video/cx2341x.c ++++ b/drivers/media/video/cx2341x.c +@@ -500,6 +500,8 @@ int cx2341x_ctrl_query(const struct cx23 + int err; + + switch (qctrl->id) { ++ case V4L2_CID_MPEG_CLASS: ++ return v4l2_ctrl_query_fill(qctrl, 0, 0, 0, 0); + case V4L2_CID_MPEG_STREAM_TYPE: + return v4l2_ctrl_query_fill(qctrl, + V4L2_MPEG_STREAM_TYPE_MPEG2_PS, +--- a/drivers/media/video/ivtv/ivtv-controls.c ++++ b/drivers/media/video/ivtv/ivtv-controls.c +@@ -60,6 +60,8 @@ int ivtv_queryctrl(struct file *file, vo + + switch (qctrl->id) { + /* Standard V4L2 controls */ ++ case V4L2_CID_USER_CLASS: ++ return v4l2_ctrl_query_fill(qctrl, 0, 0, 0, 0); + case V4L2_CID_BRIGHTNESS: + case V4L2_CID_HUE: + case V4L2_CID_SATURATION: + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:23 2009 +Message-Id: <20090701002423.713660817@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:23 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mike Isely , + Mauro Carvalho Chehab , + Michael Krufky +Subject: [patch 034/108] V4L: pvrusb2: Fix hardware scaling when used with cx25840 +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=v4l-pvrusb2-fix-hardware-scaling-when-used-with-cx25840.patch +Content-Length: 5165 +Lines: 131 + + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mike Isely + +(cherry picked from commit e17d787c513f41f59969247062561fff6340f211) + +The cx25840 module requires that its VBI initialization entry point be +called in order for hardware-scaled video capture to work properly - +even if we don't care about VBI. Making this behavior even more +subtle is that if the capture resolution is set to 720x480 - which is +the default that the pvrusb2 driver sets up - then the cx25840 +bypasses the hardware scaler. Therefore this problem does not +manifest itself until some other resolution, e.g. 640x480, is tried. +MythTV typically defaults to 640x480 or 480x480, which means that +things break whenever the driver is used with MythTV. + +This all has been known for a while (since at least Nov 2006), but +recent changes in the pvrusb2 driver (specifically in regards to +sub-device support) caused this to break again. VBI initialization +must happen *after* the chip's firmware is loaded, not before. With +this fix, 24xxx devices work correctly again. + +A related fix that is part of this changeset is that now we +re-initialize VBI any time after we issue a reset to the cx25840 +driver. Issuing a chip reset erases the state that the VBI setup +previously did. Until the HVR-1950 came along this subtlety went +unnoticed, because the pvrusb2 driver previously never issued such a +reset. But with the HVR-1950 we have to do that reset in order to +correctly transition from digital back to analog mode - and since the +HVR-1950 always starts in digital mode (required for the DVB side to +initialize correctly) then this device has never had a chance to work +correctly in analog mode! Analog capture on the HVR-1950 has been +broken this *ENTIRE* time. I had missed it until now because I've +usually been testing at the default 720x480 resolution which does not +require scaling... What fun. By re-initializing VBI after a cx25840 +chip reset, correct behavior is restored. + +Signed-off-by: Mike Isely +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/pvrusb2/pvrusb2-hdw.c | 55 ++++++++++++++++-------------- + 1 file changed, 31 insertions(+), 24 deletions(-) + +--- a/drivers/media/video/pvrusb2/pvrusb2-hdw.c ++++ b/drivers/media/video/pvrusb2/pvrusb2-hdw.c +@@ -1978,6 +1978,34 @@ static unsigned int pvr2_copy_i2c_addr_l + } + + ++static void pvr2_hdw_cx25840_vbi_hack(struct pvr2_hdw *hdw) ++{ ++ /* ++ Mike Isely 19-Nov-2006 - This bit of nuttiness ++ for cx25840 causes that module to correctly set up its video ++ scaling. This is really a problem in the cx25840 module itself, ++ but we work around it here. The problem has not been seen in ++ ivtv because there VBI is supported and set up. We don't do VBI ++ here (at least not yet) and thus we never attempted to even set ++ it up. ++ */ ++ struct v4l2_format fmt; ++ if (hdw->decoder_client_id != PVR2_CLIENT_ID_CX25840) { ++ /* We're not using a cx25840 so don't enable the hack */ ++ return; ++ } ++ ++ pvr2_trace(PVR2_TRACE_INIT, ++ "Module ID %u:" ++ " Executing cx25840 VBI hack", ++ hdw->decoder_client_id); ++ memset(&fmt, 0, sizeof(fmt)); ++ fmt.type = V4L2_BUF_TYPE_SLICED_VBI_CAPTURE; ++ v4l2_device_call_all(&hdw->v4l2_dev, hdw->decoder_client_id, ++ video, s_fmt, &fmt); ++} ++ ++ + static int pvr2_hdw_load_subdev(struct pvr2_hdw *hdw, + const struct pvr2_device_client_desc *cd) + { +@@ -2069,30 +2097,6 @@ static int pvr2_hdw_load_subdev(struct p + /* client-specific setup... */ + switch (mid) { + case PVR2_CLIENT_ID_CX25840: +- hdw->decoder_client_id = mid; +- { +- /* +- Mike Isely 19-Nov-2006 - This +- bit of nuttiness for cx25840 causes that module +- to correctly set up its video scaling. This is +- really a problem in the cx25840 module itself, +- but we work around it here. The problem has not +- been seen in ivtv because there VBI is supported +- and set up. We don't do VBI here (at least not +- yet) and thus we never attempted to even set it +- up. +- */ +- struct v4l2_format fmt; +- pvr2_trace(PVR2_TRACE_INIT, +- "Module ID %u:" +- " Executing cx25840 VBI hack", +- mid); +- memset(&fmt, 0, sizeof(fmt)); +- fmt.type = V4L2_BUF_TYPE_SLICED_VBI_CAPTURE; +- v4l2_device_call_all(&hdw->v4l2_dev, mid, +- video, s_fmt, &fmt); +- } +- break; + case PVR2_CLIENT_ID_SAA7115: + hdw->decoder_client_id = mid; + break; +@@ -2193,6 +2197,8 @@ static void pvr2_hdw_setup_low(struct pv + cptr->info->set_value(cptr,~0,cptr->info->default_value); + } + ++ pvr2_hdw_cx25840_vbi_hack(hdw); ++ + /* Set up special default values for the television and radio + frequencies here. It's not really important what these defaults + are, but I set them to something usable in the Chicago area just +@@ -4066,6 +4072,7 @@ int pvr2_hdw_cmd_decoder_reset(struct pv + if (hdw->decoder_client_id) { + v4l2_device_call_all(&hdw->v4l2_dev, hdw->decoder_client_id, + core, reset, 0); ++ pvr2_hdw_cx25840_vbi_hack(hdw); + return 0; + } + pvr2_trace(PVR2_TRACE_INIT, + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:24 2009 +Message-Id: <20090701002424.089082409@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:24 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mike Isely , + Mauro Carvalho Chehab , + Michael Krufky +Subject: [patch 035/108] V4L: pvrusb2: Re-fix hardware scaling on video standard change +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=v4l-pvrusb2-re-fix-hardware-scaling-on-video-standard-change.patch +Content-Length: 1499 +Lines: 39 + + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mike Isely + +(cherry picked from commit a6862da2f3c7ce3ec6644958bc8937b630b9e2c1) + +The cx25840 module's VBI initialization logic uses the current video +standard as part of its internal algorithm. This therefore means that +we probably need to make sure that the correct video standard has been +set before initializing VBI. (Normally we would not care about VBI, +but as described in an earlier changeset, VBI must be initialized +correctly on the cx25840 in order for the chip's hardware scaler to +operate correctly.) + +It's kind of messy to force the video standard to be set before +initializing VBI (mainly because we can't know what the app really +wants that early in the initialization process). So this patch does +the next best thing: VBI is re-initialized after any point where the +video standard has been set. + +Signed-off-by: Mike Isely +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/pvrusb2/pvrusb2-hdw.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/video/pvrusb2/pvrusb2-hdw.c ++++ b/drivers/media/video/pvrusb2/pvrusb2-hdw.c +@@ -2950,6 +2950,7 @@ static void pvr2_subdev_update(struct pv + vs = hdw->std_mask_cur; + v4l2_device_call_all(&hdw->v4l2_dev, 0, + core, s_std, vs); ++ pvr2_hdw_cx25840_vbi_hack(hdw); + } + hdw->tuner_signal_stale = !0; + hdw->cropcap_stale = !0; + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:24 2009 +Message-Id: <20090701002424.245854224@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:25 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Hans Verkuil , + Mauro Carvalho Chehab , + Michael Krufky +Subject: [patch 036/108] V4L: i2c modules must be linked before the v4l2 drivers +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=v4l-i2c-modules-must-be-linked-before-the-v4l2-drivers.patch +Content-Length: 7294 +Lines: 193 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Hans Verkuil + +(backported from commit df59f0b3df3cc35fa03ea395f5106d1625e3726a) + +Please note that this patch attached has been BACKPORTED to fit kernel +2.6.30.y + +Since i2c autoprobing is no longer supported by v4l2 we need to make sure +that the i2c modules are linked before the v4l2 modules. The v4l2 modules +now rely on the presence of the i2c modules, so these must have initialized +themselves before the v4l2 modules. + +The exception is the ir-kbd-i2c module, which is the only one still using +autoprobing. This one should be loaded at the end of the v4l2 module. Loading +it earlier actually causes problems with tveeprom. Once ir-kbd-i2c is no +longer autoprobing, then it has to move up as well. + +This is only an issue when everything is compiled into the kernel. + +Thanks to Marcus Swoboda for reporting this and Udo Steinberg for testing +this patch. + +Tested-by: Udo A. Steinberg +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/Makefile | 77 ++++++++++++++++++----------------- + drivers/media/video/saa7134/Makefile | 3 - + 2 files changed, 42 insertions(+), 38 deletions(-) + +--- a/drivers/media/video/Makefile ++++ b/drivers/media/video/Makefile +@@ -12,6 +12,8 @@ omap2cam-objs := omap24xxcam.o omap24xxc + + videodev-objs := v4l2-dev.o v4l2-ioctl.o v4l2-device.o + ++# V4L2 core modules ++ + obj-$(CONFIG_VIDEO_DEV) += videodev.o v4l2-int-device.o + ifeq ($(CONFIG_COMPAT),y) + obj-$(CONFIG_VIDEO_DEV) += v4l2-compat-ioctl32.o +@@ -23,21 +25,15 @@ ifeq ($(CONFIG_VIDEO_V4L1_COMPAT),y) + obj-$(CONFIG_VIDEO_DEV) += v4l1-compat.o + endif + +-obj-$(CONFIG_VIDEO_TUNER) += tuner.o ++# All i2c modules must come first: + +-obj-$(CONFIG_VIDEO_BT848) += bt8xx/ +-obj-$(CONFIG_VIDEO_IR_I2C) += ir-kbd-i2c.o ++obj-$(CONFIG_VIDEO_TUNER) += tuner.o + obj-$(CONFIG_VIDEO_TVAUDIO) += tvaudio.o + obj-$(CONFIG_VIDEO_TDA7432) += tda7432.o + obj-$(CONFIG_VIDEO_TDA9875) += tda9875.o +- + obj-$(CONFIG_VIDEO_SAA6588) += saa6588.o + obj-$(CONFIG_VIDEO_SAA5246A) += saa5246a.o + obj-$(CONFIG_VIDEO_SAA5249) += saa5249.o +-obj-$(CONFIG_VIDEO_CQCAM) += c-qcam.o +-obj-$(CONFIG_VIDEO_BWQCAM) += bw-qcam.o +-obj-$(CONFIG_VIDEO_W9966) += w9966.o +- + obj-$(CONFIG_VIDEO_TDA9840) += tda9840.o + obj-$(CONFIG_VIDEO_TEA6415C) += tea6415c.o + obj-$(CONFIG_VIDEO_TEA6420) += tea6420.o +@@ -54,11 +50,40 @@ obj-$(CONFIG_VIDEO_BT819) += bt819.o + obj-$(CONFIG_VIDEO_BT856) += bt856.o + obj-$(CONFIG_VIDEO_BT866) += bt866.o + obj-$(CONFIG_VIDEO_KS0127) += ks0127.o ++obj-$(CONFIG_VIDEO_VINO) += indycam.o ++obj-$(CONFIG_VIDEO_TVP5150) += tvp5150.o ++obj-$(CONFIG_VIDEO_TVP514X) += tvp514x.o ++obj-$(CONFIG_VIDEO_MSP3400) += msp3400.o ++obj-$(CONFIG_VIDEO_CS5345) += cs5345.o ++obj-$(CONFIG_VIDEO_CS53L32A) += cs53l32a.o ++obj-$(CONFIG_VIDEO_M52790) += m52790.o ++obj-$(CONFIG_VIDEO_TLV320AIC23B) += tlv320aic23b.o ++obj-$(CONFIG_VIDEO_WM8775) += wm8775.o ++obj-$(CONFIG_VIDEO_WM8739) += wm8739.o ++obj-$(CONFIG_VIDEO_VP27SMPX) += vp27smpx.o ++obj-$(CONFIG_VIDEO_CX25840) += cx25840/ ++obj-$(CONFIG_VIDEO_UPD64031A) += upd64031a.o ++obj-$(CONFIG_VIDEO_UPD64083) += upd64083.o ++obj-$(CONFIG_VIDEO_OV7670) += ov7670.o ++obj-$(CONFIG_VIDEO_TCM825X) += tcm825x.o ++obj-$(CONFIG_VIDEO_TVEEPROM) += tveeprom.o + +-obj-$(CONFIG_VIDEO_ZORAN) += zoran/ ++obj-$(CONFIG_SOC_CAMERA_MT9M001) += mt9m001.o ++obj-$(CONFIG_SOC_CAMERA_MT9M111) += mt9m111.o ++obj-$(CONFIG_SOC_CAMERA_MT9T031) += mt9t031.o ++obj-$(CONFIG_SOC_CAMERA_MT9V022) += mt9v022.o ++obj-$(CONFIG_SOC_CAMERA_OV772X) += ov772x.o ++obj-$(CONFIG_SOC_CAMERA_TW9910) += tw9910.o + ++# And now the v4l2 drivers: ++ ++obj-$(CONFIG_VIDEO_BT848) += bt8xx/ ++obj-$(CONFIG_VIDEO_ZORAN) += zoran/ ++obj-$(CONFIG_VIDEO_CQCAM) += c-qcam.o ++obj-$(CONFIG_VIDEO_BWQCAM) += bw-qcam.o ++obj-$(CONFIG_VIDEO_W9966) += w9966.o + obj-$(CONFIG_VIDEO_PMS) += pms.o +-obj-$(CONFIG_VIDEO_VINO) += vino.o indycam.o ++obj-$(CONFIG_VIDEO_VINO) += vino.o + obj-$(CONFIG_VIDEO_STRADIS) += stradis.o + obj-$(CONFIG_VIDEO_CPIA) += cpia.o + obj-$(CONFIG_VIDEO_CPIA_PP) += cpia_pp.o +@@ -69,17 +94,7 @@ obj-$(CONFIG_VIDEO_CX88) += cx88/ + obj-$(CONFIG_VIDEO_EM28XX) += em28xx/ + obj-$(CONFIG_VIDEO_CX231XX) += cx231xx/ + obj-$(CONFIG_VIDEO_USBVISION) += usbvision/ +-obj-$(CONFIG_VIDEO_TVP5150) += tvp5150.o +-obj-$(CONFIG_VIDEO_TVP514X) += tvp514x.o + obj-$(CONFIG_VIDEO_PVRUSB2) += pvrusb2/ +-obj-$(CONFIG_VIDEO_MSP3400) += msp3400.o +-obj-$(CONFIG_VIDEO_CS5345) += cs5345.o +-obj-$(CONFIG_VIDEO_CS53L32A) += cs53l32a.o +-obj-$(CONFIG_VIDEO_M52790) += m52790.o +-obj-$(CONFIG_VIDEO_TLV320AIC23B) += tlv320aic23b.o +-obj-$(CONFIG_VIDEO_WM8775) += wm8775.o +-obj-$(CONFIG_VIDEO_WM8739) += wm8739.o +-obj-$(CONFIG_VIDEO_VP27SMPX) += vp27smpx.o + obj-$(CONFIG_VIDEO_OVCAMCHIP) += ovcamchip/ + obj-$(CONFIG_VIDEO_CPIA2) += cpia2/ + obj-$(CONFIG_VIDEO_MXB) += mxb.o +@@ -92,19 +107,12 @@ obj-$(CONFIG_VIDEOBUF_DMA_CONTIG) += vid + obj-$(CONFIG_VIDEOBUF_VMALLOC) += videobuf-vmalloc.o + obj-$(CONFIG_VIDEOBUF_DVB) += videobuf-dvb.o + obj-$(CONFIG_VIDEO_BTCX) += btcx-risc.o +-obj-$(CONFIG_VIDEO_TVEEPROM) += tveeprom.o + + obj-$(CONFIG_VIDEO_M32R_AR_M64278) += arv.o + +-obj-$(CONFIG_VIDEO_CX25840) += cx25840/ +-obj-$(CONFIG_VIDEO_UPD64031A) += upd64031a.o +-obj-$(CONFIG_VIDEO_UPD64083) += upd64083.o + obj-$(CONFIG_VIDEO_CX2341X) += cx2341x.o + + obj-$(CONFIG_VIDEO_CAFE_CCIC) += cafe_ccic.o +-obj-$(CONFIG_VIDEO_OV7670) += ov7670.o +- +-obj-$(CONFIG_VIDEO_TCM825X) += tcm825x.o + + obj-$(CONFIG_USB_DABUSB) += dabusb.o + obj-$(CONFIG_USB_OV511) += ov511.o +@@ -134,24 +142,21 @@ obj-$(CONFIG_VIDEO_CX18) += cx18/ + obj-$(CONFIG_VIDEO_VIVI) += vivi.o + obj-$(CONFIG_VIDEO_CX23885) += cx23885/ + ++obj-$(CONFIG_VIDEO_OMAP2) += omap2cam.o ++obj-$(CONFIG_SOC_CAMERA) += soc_camera.o ++obj-$(CONFIG_SOC_CAMERA_PLATFORM) += soc_camera_platform.o ++# soc-camera host drivers have to be linked after camera drivers + obj-$(CONFIG_VIDEO_MX1) += mx1_camera.o + obj-$(CONFIG_VIDEO_MX3) += mx3_camera.o + obj-$(CONFIG_VIDEO_PXA27x) += pxa_camera.o + obj-$(CONFIG_VIDEO_SH_MOBILE_CEU) += sh_mobile_ceu_camera.o +-obj-$(CONFIG_VIDEO_OMAP2) += omap2cam.o +-obj-$(CONFIG_SOC_CAMERA) += soc_camera.o +-obj-$(CONFIG_SOC_CAMERA_MT9M001) += mt9m001.o +-obj-$(CONFIG_SOC_CAMERA_MT9M111) += mt9m111.o +-obj-$(CONFIG_SOC_CAMERA_MT9T031) += mt9t031.o +-obj-$(CONFIG_SOC_CAMERA_MT9V022) += mt9v022.o +-obj-$(CONFIG_SOC_CAMERA_OV772X) += ov772x.o +-obj-$(CONFIG_SOC_CAMERA_PLATFORM) += soc_camera_platform.o +-obj-$(CONFIG_SOC_CAMERA_TW9910) += tw9910.o + + obj-$(CONFIG_VIDEO_AU0828) += au0828/ + + obj-$(CONFIG_USB_VIDEO_CLASS) += uvc/ + ++obj-$(CONFIG_VIDEO_IR_I2C) += ir-kbd-i2c.o ++ + EXTRA_CFLAGS += -Idrivers/media/dvb/dvb-core + EXTRA_CFLAGS += -Idrivers/media/dvb/frontends + EXTRA_CFLAGS += -Idrivers/media/common/tuners +--- a/drivers/media/video/saa7134/Makefile ++++ b/drivers/media/video/saa7134/Makefile +@@ -3,8 +3,7 @@ saa7134-objs := saa7134-cards.o saa7134- + saa7134-ts.o saa7134-tvaudio.o saa7134-vbi.o \ + saa7134-video.o saa7134-input.o + +-obj-$(CONFIG_VIDEO_SAA7134) += saa7134.o saa7134-empress.o \ +- saa6752hs.o ++obj-$(CONFIG_VIDEO_SAA7134) += saa6752hs.o saa7134.o saa7134-empress.o + + obj-$(CONFIG_VIDEO_SAA7134_ALSA) += saa7134-alsa.o + + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:24 2009 +Message-Id: <20090701002424.559577537@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:26 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + John Stoffel , + James Bottomley +Subject: [patch 037/108] sym53c8xx: ratelimit parity errors +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=sym53c8xx-ratelimit-parity-errors.patch +Content-Length: 1007 +Lines: 30 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: John Stoffel + +commit 75be63bcf73ebdd1fdc1d49f6bf2d1326a1ba7de upstream. + +This makes a huge difference when you have a serial console on bootup to limit +these messages to a sane number. + +Signed-off-by: John Stoffel +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/sym53c8xx_2/sym_hipd.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/sym53c8xx_2/sym_hipd.c ++++ b/drivers/scsi/sym53c8xx_2/sym_hipd.c +@@ -2312,8 +2312,9 @@ static void sym_int_par (struct sym_hcb + int phase = cmd & 7; + struct sym_ccb *cp = sym_ccb_from_dsa(np, dsa); + +- printf("%s: SCSI parity error detected: SCR1=%d DBC=%x SBCL=%x\n", +- sym_name(np), hsts, dbc, sbcl); ++ if (printk_ratelimit()) ++ printf("%s: SCSI parity error detected: SCR1=%d DBC=%x SBCL=%x\n", ++ sym_name(np), hsts, dbc, sbcl); + + /* + * Check that the chip is connected to the SCSI BUS. + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:25 2009 +Message-Id: <20090701002424.978718378@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:27 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Karsten Keil +Subject: [patch 038/108] ISDN: Fix DMA alloc for hfcpci +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=isdn-fix-dma-alloc-for-hfcpci.patch +Content-Length: 3794 +Lines: 99 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Karsten Keil + +commit 8a745b9d91962991ce87a649a4dc3af3206c2c8b upstream. + +Replace wrong code with correct DMA API functions. + +Signed-off-by: Karsten Keil +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/isdn/hisax/hfc_pci.c | 41 ++++++++++++++++++++++++++++++----------- + drivers/isdn/hisax/hisax.h | 2 +- + 2 files changed, 31 insertions(+), 12 deletions(-) + +--- a/drivers/isdn/hisax/hfc_pci.c ++++ b/drivers/isdn/hisax/hfc_pci.c +@@ -82,8 +82,9 @@ release_io_hfcpci(struct IsdnCardState * + Write_hfc(cs, HFCPCI_INT_M2, cs->hw.hfcpci.int_m2); + pci_write_config_word(cs->hw.hfcpci.dev, PCI_COMMAND, 0); /* disable memory mapped ports + busmaster */ + del_timer(&cs->hw.hfcpci.timer); +- kfree(cs->hw.hfcpci.share_start); +- cs->hw.hfcpci.share_start = NULL; ++ pci_free_consistent(cs->hw.hfcpci.dev, 0x8000, ++ cs->hw.hfcpci.fifos, cs->hw.hfcpci.dma); ++ cs->hw.hfcpci.fifos = NULL; + iounmap((void *)cs->hw.hfcpci.pci_io); + } + +@@ -1663,8 +1664,19 @@ setup_hfcpci(struct IsdnCard *card) + dev_hfcpci); + i++; + if (tmp_hfcpci) { ++ dma_addr_t dma_mask = DMA_BIT_MASK(32) & ~0x7fffUL; + if (pci_enable_device(tmp_hfcpci)) + continue; ++ if (pci_set_dma_mask(tmp_hfcpci, dma_mask)) { ++ printk(KERN_WARNING ++ "HiSax hfc_pci: No suitable DMA available.\n"); ++ continue; ++ } ++ if (pci_set_consistent_dma_mask(tmp_hfcpci, dma_mask)) { ++ printk(KERN_WARNING ++ "HiSax hfc_pci: No suitable consistent DMA available.\n"); ++ continue; ++ } + pci_set_master(tmp_hfcpci); + if ((card->para[0]) && (card->para[0] != (tmp_hfcpci->resource[ 0].start & PCI_BASE_ADDRESS_IO_MASK))) + continue; +@@ -1693,22 +1705,29 @@ setup_hfcpci(struct IsdnCard *card) + printk(KERN_WARNING "HFC-PCI: No IO-Mem for PCI card found\n"); + return (0); + } ++ + /* Allocate memory for FIFOS */ +- /* Because the HFC-PCI needs a 32K physical alignment, we */ +- /* need to allocate the double mem and align the address */ +- if (!(cs->hw.hfcpci.share_start = kmalloc(65536, GFP_KERNEL))) { +- printk(KERN_WARNING "HFC-PCI: Error allocating memory for FIFO!\n"); ++ cs->hw.hfcpci.fifos = pci_alloc_consistent(cs->hw.hfcpci.dev, ++ 0x8000, &cs->hw.hfcpci.dma); ++ if (!cs->hw.hfcpci.fifos) { ++ printk(KERN_WARNING "HFC-PCI: Error allocating FIFO memory!\n"); ++ return 0; ++ } ++ if (cs->hw.hfcpci.dma & 0x7fff) { ++ printk(KERN_WARNING ++ "HFC-PCI: Error DMA memory not on 32K boundary (%lx)\n", ++ (u_long)cs->hw.hfcpci.dma); ++ pci_free_consistent(cs->hw.hfcpci.dev, 0x8000, ++ cs->hw.hfcpci.fifos, cs->hw.hfcpci.dma); + return 0; + } +- cs->hw.hfcpci.fifos = (void *) +- (((ulong) cs->hw.hfcpci.share_start) & ~0x7FFF) + 0x8000; +- pci_write_config_dword(cs->hw.hfcpci.dev, 0x80, (u_int) virt_to_bus(cs->hw.hfcpci.fifos)); ++ pci_write_config_dword(cs->hw.hfcpci.dev, 0x80, (u32)cs->hw.hfcpci.dma); + cs->hw.hfcpci.pci_io = ioremap((ulong) cs->hw.hfcpci.pci_io, 256); + printk(KERN_INFO +- "HFC-PCI: defined at mem %p fifo %p(%#x) IRQ %d HZ %d\n", ++ "HFC-PCI: defined at mem %p fifo %p(%lx) IRQ %d HZ %d\n", + cs->hw.hfcpci.pci_io, + cs->hw.hfcpci.fifos, +- (u_int) virt_to_bus(cs->hw.hfcpci.fifos), ++ (u_long)cs->hw.hfcpci.dma, + cs->irq, HZ); + + spin_lock_irqsave(&cs->lock, flags); +--- a/drivers/isdn/hisax/hisax.h ++++ b/drivers/isdn/hisax/hisax.h +@@ -703,7 +703,7 @@ struct hfcPCI_hw { + int nt_timer; + struct pci_dev *dev; + unsigned char *pci_io; /* start of PCI IO memory */ +- void *share_start; /* shared memory for Fifos start */ ++ dma_addr_t dma; /* dma handle for Fifos */ + void *fifos; /* FIFO memory */ + int last_bfifo_cnt[2]; /* marker saving last b-fifo frame count */ + struct timer_list timer; + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:25 2009 +Message-Id: <20090701002425.282771625@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:28 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dave Kleikamp +Subject: [patch 039/108] jfs: fix regression preventing coalescing of extents +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=jfs-fix-regression-preventing-coalescing-of-extents.patch +Content-Length: 1056 +Lines: 33 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Dave Kleikamp + +commit f7c52fd17a7dda42fc9e88c2b2678403419bfe63 upstream. + +Commit fec1878fe952b994125a3be7c94b1322db586f3b caused a regression in +which contiguous blocks being allocated to the end of an extent were +getting a new extent created. This typically results in files entirely +made up of 1-block extents even though the blocks are contiguous on +disk. + +Apparently grub doesn't handle a jfs file being fragmented into too many +extents, since it refuses to boot a kernel from jfs that was created by +the 2.6.30 kernel. + +Signed-off-by: Dave Kleikamp +Reported-by: Alex +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jfs/jfs_extent.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/jfs/jfs_extent.c ++++ b/fs/jfs/jfs_extent.c +@@ -391,6 +391,7 @@ int extHint(struct inode *ip, s64 offset + } + XADaddress(xp, xaddr); + XADlength(xp, xlen); ++ XADoffset(xp, prev); + /* + * only preserve the abnr flag within the xad flags + * of the returned hint. + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:25 2009 +Message-Id: <20090701002425.484463869@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:29 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Roel Kluin , + Anton Vorontsov , + David Brownell , + Benjamin Herrenschmidt , + Kumar Gala , + Grant Likely +Subject: [patch 040/108] spi: takes size of a pointer to determine the size of the pointed-to type +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=spi-takes-size-of-a-pointer-to-determine-the-size-of-the-pointed-to-type.patch +Content-Length: 1384 +Lines: 40 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Roel Kluin + +commit 021415468c889979117b1a07b96f7e36de33e995 upstream. + +Do not take the size of a pointer to determine the size of the pointed-to +type. + +Signed-off-by: Roel Kluin +Acked-by: Anton Vorontsov +Cc: David Brownell +Cc: Benjamin Herrenschmidt +Cc: Kumar Gala +Acked-by: Grant Likely +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi_mpc83xx.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/spi/spi_mpc83xx.c ++++ b/drivers/spi/spi_mpc83xx.c +@@ -711,12 +711,12 @@ static int of_mpc83xx_spi_get_chipselect + return 0; + } + +- pinfo->gpios = kmalloc(ngpios * sizeof(pinfo->gpios), GFP_KERNEL); ++ pinfo->gpios = kmalloc(ngpios * sizeof(*pinfo->gpios), GFP_KERNEL); + if (!pinfo->gpios) + return -ENOMEM; +- memset(pinfo->gpios, -1, ngpios * sizeof(pinfo->gpios)); ++ memset(pinfo->gpios, -1, ngpios * sizeof(*pinfo->gpios)); + +- pinfo->alow_flags = kzalloc(ngpios * sizeof(pinfo->alow_flags), ++ pinfo->alow_flags = kzalloc(ngpios * sizeof(*pinfo->alow_flags), + GFP_KERNEL); + if (!pinfo->alow_flags) { + ret = -ENOMEM; + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:25 2009 +Message-Id: <20090701002425.687060928@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:30 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mike Frysinger , + Alan Cox +Subject: [patch 041/108] serial: bfin_5xx: add missing spin_lock init +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=serial-bfin_5xx-add-missing-spin_lock-init.patch +Content-Length: 1017 +Lines: 28 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mike Frysinger + +commit 9c529a3d76dffae943868ebad07b042d15764712 upstream. + +The Blackfin serial driver never initialized the spin_lock that is part of +the serial core structure, but we never noticed because spin_lock's are +rarely enabled on UP systems. Yeah lockdep and friends. + +Signed-off-by: Mike Frysinger +Signed-off-by: Alan Cox +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/serial/bfin_5xx.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/serial/bfin_5xx.c ++++ b/drivers/serial/bfin_5xx.c +@@ -1058,6 +1058,7 @@ static void __init bfin_serial_init_port + bfin_serial_hw_init(); + + for (i = 0; i < nr_active_ports; i++) { ++ spin_lock_init(&bfin_serial_ports[i].port.lock); + bfin_serial_ports[i].port.uartclk = get_sclk(); + bfin_serial_ports[i].port.fifosize = BFIN_UART_TX_FIFO_SIZE; + bfin_serial_ports[i].port.ops = &bfin_serial_pops; + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:26 2009 +Message-Id: <20090701002426.050559424@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:31 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andreas Herrmann , + Yinghai Lu , + xiyou.wangcong@gmail.com, + Ingo Molnar +Subject: [patch 042/108] x86: memtest: remove 64-bit division +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=x86-memtest-remove-64-bit-division.patch +Content-Length: 2073 +Lines: 68 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Andreas Herrmann + +commit c9690998ef48ffefeccb91c70a7739eebdea57f9 upstream. + +Using gcc 3.3.5 a "make allmodconfig" + "CONFIG_KVM=n" +triggers a build error: + + arch/x86/mm/built-in.o(.init.text+0x43f7): In function `__change_page_attr': + arch/x86/mm/pageattr.c:114: undefined reference to `__udivdi3' + make: *** [.tmp_vmlinux1] Error 1 + +The culprit turned out to be a division in arch/x86/mm/memtest.c +For more info see this thread: + + http://marc.info/?l=linux-kernel&m=124416232620683 + +The patch entirely removes the division that caused the build +error. + +[ Impact: build fix with certain GCC versions ] + +Reported-by: Tetsuo Handa +Signed-off-by: Andreas Herrmann +Cc: Yinghai Lu +Cc: xiyou.wangcong@gmail.com +Cc: Andrew Morton +LKML-Reference: <20090608170939.GB12431@alberich.amd.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/mm/memtest.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/arch/x86/mm/memtest.c ++++ b/arch/x86/mm/memtest.c +@@ -40,23 +40,23 @@ static void __init reserve_bad_mem(u64 p + + static void __init memtest(u64 pattern, u64 start_phys, u64 size) + { +- u64 i, count; +- u64 *start; ++ u64 *p; ++ void *start, *end; + u64 start_bad, last_bad; + u64 start_phys_aligned; + size_t incr; + + incr = sizeof(pattern); + start_phys_aligned = ALIGN(start_phys, incr); +- count = (size - (start_phys_aligned - start_phys))/incr; + start = __va(start_phys_aligned); ++ end = start + size - (start_phys_aligned - start_phys); + start_bad = 0; + last_bad = 0; + +- for (i = 0; i < count; i++) +- start[i] = pattern; +- for (i = 0; i < count; i++, start++, start_phys_aligned += incr) { +- if (*start == pattern) ++ for (p = start; p < end; p++) ++ *p = pattern; ++ for (p = start; p < end; p++, start_phys_aligned += incr) { ++ if (*p == pattern) + continue; + if (start_phys_aligned == last_bad + incr) { + last_bad += incr; + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:26 2009 +Message-Id: <20090701002426.544692405@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:32 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Cliff Wickman , + Ingo Molnar +Subject: [patch 043/108] x86: Fix UV BAU activation descriptor init +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=x86-fix-uv-bau-activation-descriptor-init.patch +Content-Length: 2502 +Lines: 73 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Cliff Wickman + +commit 0e2595cdfd7df9f1128f7185152601ae5417483b upstream. + +The UV tlb shootdown code has a serious initialization error. + +An array of structures [32*8] is initialized as if it were [32]. +The array is indexed by (cpu number on the blade)*8, so the short +initialization works for up to 4 cpus on a blade. +But above that, we provide an invalid opcode to the hub's +broadcast assist unit. + +This patch changes the allocation of the array to use its symbolic +dimensions for better clarity. And initializes all 32*8 entries. + +Shortened 'UV_ACTIVATION_DESCRIPTOR_SIZE' to 'UV_ADP_SIZE' per Ingo's +recommendation. + +Tested on the UV simulator. + +Signed-off-by: Cliff Wickman +LKML-Reference: +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/uv/uv_bau.h | 2 +- + arch/x86/kernel/tlb_uv.c | 15 +++++++++++++-- + 2 files changed, 14 insertions(+), 3 deletions(-) + +--- a/arch/x86/include/asm/uv/uv_bau.h ++++ b/arch/x86/include/asm/uv/uv_bau.h +@@ -37,7 +37,7 @@ + #define UV_CPUS_PER_ACT_STATUS 32 + #define UV_ACT_STATUS_MASK 0x3 + #define UV_ACT_STATUS_SIZE 2 +-#define UV_ACTIVATION_DESCRIPTOR_SIZE 32 ++#define UV_ADP_SIZE 32 + #define UV_DISTRIBUTION_SIZE 256 + #define UV_SW_ACK_NPENDING 8 + #define UV_NET_ENDPOINT_INTD 0x38 +--- a/arch/x86/kernel/tlb_uv.c ++++ b/arch/x86/kernel/tlb_uv.c +@@ -715,7 +715,12 @@ uv_activation_descriptor_init(int node, + struct bau_desc *adp; + struct bau_desc *ad2; + +- adp = (struct bau_desc *)kmalloc_node(16384, GFP_KERNEL, node); ++ /* ++ * each bau_desc is 64 bytes; there are 8 (UV_ITEMS_PER_DESCRIPTOR) ++ * per cpu; and up to 32 (UV_ADP_SIZE) cpu's per blade ++ */ ++ adp = (struct bau_desc *)kmalloc_node(sizeof(struct bau_desc)* ++ UV_ADP_SIZE*UV_ITEMS_PER_DESCRIPTOR, GFP_KERNEL, node); + BUG_ON(!adp); + + pa = uv_gpa(adp); /* need the real nasid*/ +@@ -729,7 +734,13 @@ uv_activation_descriptor_init(int node, + (n << UV_DESC_BASE_PNODE_SHIFT | m)); + } + +- for (i = 0, ad2 = adp; i < UV_ACTIVATION_DESCRIPTOR_SIZE; i++, ad2++) { ++ /* ++ * initializing all 8 (UV_ITEMS_PER_DESCRIPTOR) descriptors for each ++ * cpu even though we only use the first one; one descriptor can ++ * describe a broadcast to 256 nodes. ++ */ ++ for (i = 0, ad2 = adp; i < (UV_ADP_SIZE*UV_ITEMS_PER_DESCRIPTOR); ++ i++, ad2++) { + memset(ad2, 0, sizeof(struct bau_desc)); + ad2->header.sw_ack_flag = 1; + /* + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:27 2009 +Message-Id: <20090701002426.887203672@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:33 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jack Steiner , + Ingo Molnar +Subject: [patch 044/108] x86, UV: Fix macros for multiple coherency domains +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=x86-uv-fix-macros-for-multiple-coherency-domains.patch +Content-Length: 3987 +Lines: 102 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jack Steiner + +commit c4ed3f04ba9defe22aa729d1646f970f791c03d7 upstream. + +Fix bug in the SGI UV macros that support systems with multiple +coherency domains. The macros used for referencing global MMR +(chipset registers) are failing to correctly "or" the NASID +(node identifier) bits that reside above M+N. These high bits +are supplied automatically by the chipset for memory accesses +coming from the processor socket. + +However, the bits must be present for references to the special +global MMR space used to map chipset registers. (See uv_hub.h +for more details ...) + +The bug results in references to invalid/incorrect nodes. + +Signed-off-by: Jack Steiner +LKML-Reference: <20090608154405.GA16395@sgi.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/uv/uv_hub.h | 6 ++++-- + arch/x86/kernel/apic/x2apic_uv_x.c | 15 +++++++++------ + 2 files changed, 13 insertions(+), 8 deletions(-) + +--- a/arch/x86/include/asm/uv/uv_hub.h ++++ b/arch/x86/include/asm/uv/uv_hub.h +@@ -133,6 +133,7 @@ struct uv_scir_s { + struct uv_hub_info_s { + unsigned long global_mmr_base; + unsigned long gpa_mask; ++ unsigned int gnode_extra; + unsigned long gnode_upper; + unsigned long lowmem_remap_top; + unsigned long lowmem_remap_base; +@@ -159,7 +160,8 @@ DECLARE_PER_CPU(struct uv_hub_info_s, __ + * p - PNODE (local part of nsids, right shifted 1) + */ + #define UV_NASID_TO_PNODE(n) (((n) >> 1) & uv_hub_info->pnode_mask) +-#define UV_PNODE_TO_NASID(p) (((p) << 1) | uv_hub_info->gnode_upper) ++#define UV_PNODE_TO_GNODE(p) ((p) |uv_hub_info->gnode_extra) ++#define UV_PNODE_TO_NASID(p) (UV_PNODE_TO_GNODE(p) << 1) + + #define UV_LOCAL_MMR_BASE 0xf4000000UL + #define UV_GLOBAL_MMR32_BASE 0xf8000000UL +@@ -173,7 +175,7 @@ DECLARE_PER_CPU(struct uv_hub_info_s, __ + #define UV_GLOBAL_MMR32_PNODE_BITS(p) ((p) << (UV_GLOBAL_MMR32_PNODE_SHIFT)) + + #define UV_GLOBAL_MMR64_PNODE_BITS(p) \ +- ((unsigned long)(p) << UV_GLOBAL_MMR64_PNODE_SHIFT) ++ ((unsigned long)(UV_PNODE_TO_GNODE(p)) << UV_GLOBAL_MMR64_PNODE_SHIFT) + + #define UV_APIC_PNODE_SHIFT 6 + +--- a/arch/x86/kernel/apic/x2apic_uv_x.c ++++ b/arch/x86/kernel/apic/x2apic_uv_x.c +@@ -562,7 +562,7 @@ void __init uv_system_init(void) + union uvh_node_id_u node_id; + unsigned long gnode_upper, lowmem_redir_base, lowmem_redir_size; + int bytes, nid, cpu, lcpu, pnode, blade, i, j, m_val, n_val; +- int max_pnode = 0; ++ int gnode_extra, max_pnode = 0; + unsigned long mmr_base, present, paddr; + unsigned short pnode_mask; + +@@ -574,6 +574,13 @@ void __init uv_system_init(void) + mmr_base = + uv_read_local_mmr(UVH_RH_GAM_MMR_OVERLAY_CONFIG_MMR) & + ~UV_MMR_ENABLE; ++ pnode_mask = (1 << n_val) - 1; ++ node_id.v = uv_read_local_mmr(UVH_NODE_ID); ++ gnode_extra = (node_id.s.node_id & ~((1 << n_val) - 1)) >> 1; ++ gnode_upper = ((unsigned long)gnode_extra << m_val); ++ printk(KERN_DEBUG "UV: N %d, M %d, gnode_upper 0x%lx, gnode_extra 0x%x\n", ++ n_val, m_val, gnode_upper, gnode_extra); ++ + printk(KERN_DEBUG "UV: global MMR base 0x%lx\n", mmr_base); + + for(i = 0; i < UVH_NODE_PRESENT_TABLE_DEPTH; i++) +@@ -607,11 +614,6 @@ void __init uv_system_init(void) + } + } + +- pnode_mask = (1 << n_val) - 1; +- node_id.v = uv_read_local_mmr(UVH_NODE_ID); +- gnode_upper = (((unsigned long)node_id.s.node_id) & +- ~((1 << n_val) - 1)) << m_val; +- + uv_bios_init(); + uv_bios_get_sn_info(0, &uv_type, &sn_partition_id, + &sn_coherency_id, &sn_region_size); +@@ -634,6 +636,7 @@ void __init uv_system_init(void) + uv_cpu_hub_info(cpu)->pnode_mask = pnode_mask; + uv_cpu_hub_info(cpu)->gpa_mask = (1 << (m_val + n_val)) - 1; + uv_cpu_hub_info(cpu)->gnode_upper = gnode_upper; ++ uv_cpu_hub_info(cpu)->gnode_extra = gnode_extra; + uv_cpu_hub_info(cpu)->global_mmr_base = mmr_base; + uv_cpu_hub_info(cpu)->coherency_domain_number = sn_coherency_id; + uv_cpu_hub_info(cpu)->scir.offset = SCIR_LOCAL_MMR_BASE + lcpu; + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:27 2009 +Message-Id: <20090701002427.223080661@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:34 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mark Langsdorf , + Joerg Roedel , + jbarnes@virtuousgeek.org, + Ingo Molnar +Subject: [patch 045/108] x86: enable GART-IOMMU only after setting up protection methods +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=x86-enable-gart-iommu-only-after-setting-up-protection-methods.patch +Content-Length: 1768 +Lines: 56 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mark Langsdorf + +commit fe2245c905631a3a353504fc04388ce3dfaf9d9e upstream. + +The current code to set up the GART as an IOMMU enables GART +translations before it removes the aperture from the kernel memory +map, sets the GART PTEs to UC, sets up the guard and scratch +pages, or does a wbinvd(). This leaves the possibility of cache +aliasing open and can cause system crashes. + +Re-order the code so as to enable the GART translations only +after all safeguards are in place and the tlb has been flushed. + +AMD has tested this patch on both Istanbul systems and 1st +generation Opteron systems with APG enabled and seen no adverse +effects. Istanbul systems with HT Assist enabled sometimes +see MCE errors due to cache artifacts with the unmodified +code. + +Signed-off-by: Mark Langsdorf +Cc: Joerg Roedel +Cc: akpm@linux-foundation.org +Cc: jbarnes@virtuousgeek.org +Signed-off-by: Ingo Molnar + +--- + arch/x86/kernel/pci-gart_64.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/pci-gart_64.c ++++ b/arch/x86/kernel/pci-gart_64.c +@@ -688,8 +688,6 @@ static __init int init_k8_gatt(struct ag + + agp_gatt_table = gatt; + +- enable_gart_translations(); +- + error = sysdev_class_register(&gart_sysdev_class); + if (!error) + error = sysdev_register(&device_gart); +@@ -845,6 +843,14 @@ void __init gart_iommu_init(void) + * the pages as Not-Present: + */ + wbinvd(); ++ ++ /* ++ * Now all caches are flushed and we can safely enable ++ * GART hardware. Doing it early leaves the possibility ++ * of stale cache entries that can lead to GART PTE ++ * errors. ++ */ ++ enable_gart_translations(); + + /* + * Try to workaround a bug (thanks to BenH): + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:27 2009 +Message-Id: <20090701002427.764470416@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:35 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Petr Tesarik , + Thomas Gleixner +Subject: [patch 046/108] x86: move rdtsc_barrier() into the TSC vread method +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=x86-move-rdtsc_barrier-into-the-tsc-vread-method.patch +Content-Length: 1904 +Lines: 62 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Petr Tesarik + +commit 7d96fd41cadc55f4e00231c8c71b8e25c779f122 upstream. + +The *fence instructions were moved to vsyscall_64.c by commit +cb9e35dce94a1b9c59d46224e8a94377d673e204. But this breaks the +vDSO, because vread methods are also called from there. + +Besides, the synchronization might be unnecessary for other +time sources than TSC. + +[ Impact: fix potential time warp in VDSO ] + +Signed-off-by: Petr Tesarik +LKML-Reference: <9d0ea9ea0f866bdc1f4d76831221ae117f11ea67.1243241859.git.ptesarik@suse.cz> +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/tsc.c | 11 ++++++++++- + arch/x86/kernel/vsyscall_64.c | 8 -------- + 2 files changed, 10 insertions(+), 9 deletions(-) + +--- a/arch/x86/kernel/tsc.c ++++ b/arch/x86/kernel/tsc.c +@@ -710,7 +710,16 @@ static cycle_t read_tsc(struct clocksour + #ifdef CONFIG_X86_64 + static cycle_t __vsyscall_fn vread_tsc(void) + { +- cycle_t ret = (cycle_t)vget_cycles(); ++ cycle_t ret; ++ ++ /* ++ * Surround the RDTSC by barriers, to make sure it's not ++ * speculated to outside the seqlock critical section and ++ * does not cause time warps: ++ */ ++ rdtsc_barrier(); ++ ret = (cycle_t)vget_cycles(); ++ rdtsc_barrier(); + + return ret >= __vsyscall_gtod_data.clock.cycle_last ? + ret : __vsyscall_gtod_data.clock.cycle_last; +--- a/arch/x86/kernel/vsyscall_64.c ++++ b/arch/x86/kernel/vsyscall_64.c +@@ -132,15 +132,7 @@ static __always_inline void do_vgettimeo + return; + } + +- /* +- * Surround the RDTSC by barriers, to make sure it's not +- * speculated to outside the seqlock critical section and +- * does not cause time warps: +- */ +- rdtsc_barrier(); + now = vread(); +- rdtsc_barrier(); +- + base = __vsyscall_gtod_data.clock.cycle_last; + mask = __vsyscall_gtod_data.clock.mask; + mult = __vsyscall_gtod_data.clock.mult; + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:28 2009 +Message-Id: <20090701002428.090919305@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:36 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Cliff Wickman , + Ingo Molnar +Subject: [patch 047/108] x86: Fix uv bau sending buffer initialization +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=x86-fix-uv-bau-sending-buffer-initialization.patch +Content-Length: 1477 +Lines: 48 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Cliff Wickman + +commit 9c26f52b900f7207135bafc8789e1a4f5d43e096 upstream. + +The initialization of the UV Broadcast Assist Unit's sending +buffers was making an invalid assumption about the +initialization of an MMR that defines its address. + +The BIOS will not be providing that MMR. So +uv_activation_descriptor_init() should unconditionally set it. + +Tested on UV simulator. + +Signed-off-by: Cliff Wickman +LKML-Reference: +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/tlb_uv.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +--- a/arch/x86/kernel/tlb_uv.c ++++ b/arch/x86/kernel/tlb_uv.c +@@ -711,7 +711,6 @@ uv_activation_descriptor_init(int node, + unsigned long pa; + unsigned long m; + unsigned long n; +- unsigned long mmr_image; + struct bau_desc *adp; + struct bau_desc *ad2; + +@@ -727,12 +726,8 @@ uv_activation_descriptor_init(int node, + n = pa >> uv_nshift; + m = pa & uv_mmask; + +- mmr_image = uv_read_global_mmr64(pnode, UVH_LB_BAU_SB_DESCRIPTOR_BASE); +- if (mmr_image) { +- uv_write_global_mmr64(pnode, (unsigned long) +- UVH_LB_BAU_SB_DESCRIPTOR_BASE, +- (n << UV_DESC_BASE_PNODE_SHIFT | m)); +- } ++ uv_write_global_mmr64(pnode, UVH_LB_BAU_SB_DESCRIPTOR_BASE, ++ (n << UV_DESC_BASE_PNODE_SHIFT | m)); + + /* + * initializing all 8 (UV_ITEMS_PER_DESCRIPTOR) descriptors for each + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:28 2009 +Message-Id: <20090701002428.381134605@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:37 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jean Delvare , + Steve Conklin , + Leann Ogasawara , + Ingo Molnar +Subject: [patch 048/108] x86: Add quirk for reboot stalls on a Dell Optiplex 360 +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=x86-add-quirk-for-reboot-stalls-on-a-dell-optiplex-360.patch +Content-Length: 1174 +Lines: 37 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jean Delvare + +commit 4a4aca641bc4598e77b866804f47c651ec4a764d upstream. + +The Dell Optiplex 360 hangs on reboot, just like the Optiplex 330, so +the same quirk is needed. + +Signed-off-by: Jean Delvare +Cc: Steve Conklin +Cc: Leann Ogasawara +LKML-Reference: <200906051202.38311.jdelvare@suse.de> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/reboot.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/arch/x86/kernel/reboot.c ++++ b/arch/x86/kernel/reboot.c +@@ -192,6 +192,15 @@ static struct dmi_system_id __initdata r + DMI_MATCH(DMI_BOARD_NAME, "0KP561"), + }, + }, ++ { /* Handle problems with rebooting on Dell Optiplex 360 with 0T656F */ ++ .callback = set_bios_reboot, ++ .ident = "Dell OptiPlex 360", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 360"), ++ DMI_MATCH(DMI_BOARD_NAME, "0T656F"), ++ }, ++ }, + { /* Handle problems with rebooting on Dell 2400's */ + .callback = set_bios_reboot, + .ident = "Dell PowerEdge 2400", + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:28 2009 +Message-Id: <20090701002428.620627552@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:38 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Yinghai Lu , + "H. Peter Anvin" +Subject: [patch 049/108] x86: handle initrd that extends into unusable memory +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=x86-handle-initrd-that-extends-into-unusable-memory.patch +Content-Length: 2138 +Lines: 72 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Yinghai Lu + +commit 8c5dd8f43367f4f266dd616f11658005bc2d20ef upstream. + +On a system where system memory (according e820) is not covered by +mtrr, mtrr_trim_memory converts a portion of memory to reserved, but +bootloader has already put the initrd in that range. + +Thus, we need to have 64bit to use relocate_initrd too. + +[ Impact: fix using initrd when mtrr_trim_memory happen ] + +Signed-off-by: Yinghai Lu +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/setup.c | 15 +++------------ + 1 file changed, 3 insertions(+), 12 deletions(-) + +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -293,15 +293,13 @@ static void __init reserve_brk(void) + + #ifdef CONFIG_BLK_DEV_INITRD + +-#ifdef CONFIG_X86_32 +- + #define MAX_MAP_CHUNK (NR_FIX_BTMAPS << PAGE_SHIFT) + static void __init relocate_initrd(void) + { + + u64 ramdisk_image = boot_params.hdr.ramdisk_image; + u64 ramdisk_size = boot_params.hdr.ramdisk_size; +- u64 end_of_lowmem = max_low_pfn << PAGE_SHIFT; ++ u64 end_of_lowmem = max_low_pfn_mapped << PAGE_SHIFT; + u64 ramdisk_here; + unsigned long slop, clen, mapaddr; + char *p, *q; +@@ -357,14 +355,13 @@ static void __init relocate_initrd(void) + ramdisk_image, ramdisk_image + ramdisk_size - 1, + ramdisk_here, ramdisk_here + ramdisk_size - 1); + } +-#endif + + static void __init reserve_initrd(void) + { + u64 ramdisk_image = boot_params.hdr.ramdisk_image; + u64 ramdisk_size = boot_params.hdr.ramdisk_size; + u64 ramdisk_end = ramdisk_image + ramdisk_size; +- u64 end_of_lowmem = max_low_pfn << PAGE_SHIFT; ++ u64 end_of_lowmem = max_low_pfn_mapped << PAGE_SHIFT; + + if (!boot_params.hdr.type_of_loader || + !ramdisk_image || !ramdisk_size) +@@ -394,14 +391,8 @@ static void __init reserve_initrd(void) + return; + } + +-#ifdef CONFIG_X86_32 + relocate_initrd(); +-#else +- printk(KERN_ERR "initrd extends beyond end of memory " +- "(0x%08llx > 0x%08llx)\ndisabling initrd\n", +- ramdisk_end, end_of_lowmem); +- initrd_start = 0; +-#endif ++ + free_early(ramdisk_image, ramdisk_end); + } + #else + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:29 2009 +Message-Id: <20090701002429.036408184@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:39 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Takashi Iwai +Subject: [patch 050/108] ALSA: ca0106 - Add missing registrations of vmaster controls +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=alsa-ca0106-add-missing-registrations-of-vmaster-controls.patch +Content-Length: 1035 +Lines: 38 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Takashi Iwai + +commit 601e1cc5df940b59e71c947726640811897d30df upstream. + +Although the vmaster controls are created, they aren't registered thus +they don't appear in the real world. Added the missing snd_ctl_add() +calls. + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/ca0106/ca0106_mixer.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/sound/pci/ca0106/ca0106_mixer.c ++++ b/sound/pci/ca0106/ca0106_mixer.c +@@ -841,6 +841,9 @@ int __devinit snd_ca0106_mixer(struct sn + snd_ca0106_master_db_scale); + if (!vmaster) + return -ENOMEM; ++ err = snd_ctl_add(card, vmaster); ++ if (err < 0) ++ return err; + add_slaves(card, vmaster, slave_vols); + + if (emu->details->spi_dac == 1) { +@@ -848,6 +851,9 @@ int __devinit snd_ca0106_mixer(struct sn + NULL); + if (!vmaster) + return -ENOMEM; ++ err = snd_ctl_add(card, vmaster); ++ if (err < 0) ++ return err; + add_slaves(card, vmaster, slave_sws); + } + return 0; + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:29 2009 +Message-Id: <20090701002429.246830955@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:40 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Takashi Iwai +Subject: [patch 051/108] ALSA: intel8x0 - Fix PCM position craziness +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=alsa-intel8x0-fix-pcm-position-craziness.patch +Content-Length: 2741 +Lines: 85 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Takashi Iwai + +commit f708eb1d71dc8ffb184da9f0bc53461c6dc10653 upstream. + +The PCM pointer callback sometimes returns invalid positions and this +screws up the hw_ptr updater in PCM core. Especially since now the +jiffies check is optional with xrun_debug, the invalid position is +handled as is, and causes serious sound skips, etc. + +This patch simplifies the position-fix strategy in intel8x0 to be more +robust: +- just falls back to the last position if bogus position is detected +- another sanity check for the backward move of the position due to + a race of register update and the base-index update + +This patch is applicable also for 2.6.30. + +Tested-by: David Miller +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/intel8x0.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +--- a/sound/pci/intel8x0.c ++++ b/sound/pci/intel8x0.c +@@ -356,8 +356,6 @@ struct ichdev { + unsigned int position; + unsigned int pos_shift; + unsigned int last_pos; +- unsigned long last_pos_jiffies; +- unsigned int jiffy_to_bytes; + int frags; + int lvi; + int lvi_frag; +@@ -844,7 +842,6 @@ static int snd_intel8x0_pcm_trigger(stru + case SNDRV_PCM_TRIGGER_PAUSE_RELEASE: + val = ICH_IOCE | ICH_STARTBM; + ichdev->last_pos = ichdev->position; +- ichdev->last_pos_jiffies = jiffies; + break; + case SNDRV_PCM_TRIGGER_SUSPEND: + ichdev->suspended = 1; +@@ -1048,7 +1045,6 @@ static int snd_intel8x0_pcm_prepare(stru + ichdev->pos_shift = (runtime->sample_bits > 16) ? 2 : 1; + } + snd_intel8x0_setup_periods(chip, ichdev); +- ichdev->jiffy_to_bytes = (runtime->rate * 4 * ichdev->pos_shift) / HZ; + return 0; + } + +@@ -1073,19 +1069,23 @@ static snd_pcm_uframes_t snd_intel8x0_pc + ptr1 == igetword(chip, ichdev->reg_offset + ichdev->roff_picb)) + break; + } while (timeout--); ++ ptr = ichdev->last_pos; + if (ptr1 != 0) { + ptr1 <<= ichdev->pos_shift; + ptr = ichdev->fragsize1 - ptr1; + ptr += position; +- ichdev->last_pos = ptr; +- ichdev->last_pos_jiffies = jiffies; +- } else { +- ptr1 = jiffies - ichdev->last_pos_jiffies; +- if (ptr1) +- ptr1 -= 1; +- ptr = ichdev->last_pos + ptr1 * ichdev->jiffy_to_bytes; +- ptr %= ichdev->size; ++ if (ptr < ichdev->last_pos) { ++ unsigned int pos_base, last_base; ++ pos_base = position / ichdev->fragsize1; ++ last_base = ichdev->last_pos / ichdev->fragsize1; ++ /* another sanity check; ptr1 can go back to full ++ * before the base position is updated ++ */ ++ if (pos_base == last_base) ++ ptr = ichdev->last_pos; ++ } + } ++ ichdev->last_pos = ptr; + spin_unlock(&chip->reg_lock); + if (ptr >= ichdev->size) + return 0; + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:29 2009 +Message-Id: <20090701002429.486907616@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:41 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Takashi Iwai +Subject: [patch 052/108] ALSA: hda - Get back Input Source for ALC262 toshiba-s06 model +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=alsa-hda-get-back-input-source-for-alc262-toshiba-s06-model.patch +Content-Length: 950 +Lines: 29 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Takashi Iwai + +commit ae14ef68e8e67ca5b8b29f0eb640f7c106617f4e upstream. + +The commit f9e336f65b666b8f1764d17e9b7c21c90748a37e + ALSA: hda - Unify capture mixer creation in realtek codes +removed the "Input Source" mixer element creation for toshiba-s06 model +because it contains a digital-mic input. + +This patch take the control back. + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -11122,6 +11122,7 @@ static struct alc_config_preset alc262_p + .capsrc_nids = alc262_dmic_capsrc_nids, + .dac_nids = alc262_dac_nids, + .adc_nids = alc262_dmic_adc_nids, /* ADC0 */ ++ .num_adc_nids = 1, /* single ADC */ + .dig_out_nid = ALC262_DIGOUT_NID, + .num_channel_mode = ARRAY_SIZE(alc262_modes), + .channel_mode = alc262_modes, + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:29 2009 +Message-Id: <20090701002429.681512248@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:42 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Takashi Iwai +Subject: [patch 053/108] ALSA: hda - Add quirk for Sony VAIO Z21MN +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=alsa-hda-add-quirk-for-sony-vaio-z21mn.patch +Content-Length: 884 +Lines: 24 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Takashi Iwai + +commit 376b508ffde3b17e105265f89b83bdb044b1c1ae upstream. + +It needs model=toshiba-s06 to work with the digital-mic. + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10915,6 +10915,7 @@ static struct snd_pci_quirk alc262_cfg_t + SND_PCI_QUIRK(0x104d, 0x8203, "Sony UX-90", ALC262_HIPPO), + SND_PCI_QUIRK(0x104d, 0x820f, "Sony ASSAMD", ALC262_SONY_ASSAMD), + SND_PCI_QUIRK(0x104d, 0x9016, "Sony VAIO", ALC262_AUTO), /* dig-only */ ++ SND_PCI_QUIRK(0x104d, 0x9025, "Sony VAIO Z21MN", ALC262_TOSHIBA_S06), + SND_PCI_QUIRK_MASK(0x104d, 0xff00, 0x9000, "Sony VAIO", + ALC262_SONY_ASSAMD), + SND_PCI_QUIRK(0x1179, 0x0001, "Toshiba dynabook SS RX1", + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:30 2009 +Message-Id: <20090701002429.939348846@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:43 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ondrej Zary , + Takashi Iwai +Subject: [patch 054/108] ALSA: cmi8330: fix MPU-401 PnP init copy&paste bug +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=alsa-cmi8330-fix-mpu-401-pnp-init-copy-paste-bug.patch +Content-Length: 689 +Lines: 26 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ondrej Zary + +commit c2a30d711852e4f39c8a79135b3caa701f7a8e02 upstream. + +Fix copy&paste bug in PnP MPU-401 initialization. + +Signed-off-by: Ondrej Zary +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/isa/cmi8330.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/isa/cmi8330.c ++++ b/sound/isa/cmi8330.c +@@ -338,7 +338,7 @@ static int __devinit snd_cmi8330_pnp(int + return -EBUSY; + + acard->mpu = pnp_request_card_device(card, id->devs[2].id, NULL); +- if (acard->play == NULL) ++ if (acard->mpu == NULL) + return -EBUSY; + + pdev = acard->cap; + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:30 2009 +Message-Id: <20090701002430.420296635@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:44 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Thomas Gleixner +Subject: [patch 055/108] x86: hpet: Mark per cpu interrupts IRQF_TIMER to prevent resume failure +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=x86-hpet-mark-per-cpu-interrupts-irqf_timer-to-prevent-resume-failure.patch +Content-Length: 1263 +Lines: 38 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Thomas Gleixner + +commit 507fa3a3d80365c595113a5ac3232309e3dbf5d8 upstream. + +timer interrupts are excluded from being disabled during suspend. The +clock events code manages the disabling of clock events on its own +because the timer interrupt needs to be functional before the resume +code reenables the device interrupts. + +The hpet per cpu timers request their interrupt without setting the +IRQF_TIMER flag so suspend_device_irqs() disables them as well which +results in a fatal resume failure on the boot CPU. + +Adding IRQF_TIMER to the interupt flags when requesting the hpet per +cpu timer interrupts solves the problem. + +Reported-by: Benjamin S. +Signed-off-by: Thomas Gleixner +Tested-by: Benjamin S. +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/hpet.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/x86/kernel/hpet.c ++++ b/arch/x86/kernel/hpet.c +@@ -510,7 +510,8 @@ static int hpet_setup_irq(struct hpet_de + { + + if (request_irq(dev->irq, hpet_interrupt_handler, +- IRQF_DISABLED|IRQF_NOBALANCING, dev->name, dev)) ++ IRQF_TIMER | IRQF_DISABLED | IRQF_NOBALANCING, ++ dev->name, dev)) + return -1; + + disable_irq(dev->irq); + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:30 2009 +Message-Id: <20090701002430.625001014@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:45 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Nicolas Pitre , + Russell King +Subject: [patch 056/108] ARM: 5545/2: add flush_kernel_dcache_page() for ARM +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=arm-5545-2-add-flush_kernel_dcache_page-for-arm.patch +Content-Length: 1180 +Lines: 36 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Nicolas Pitre + +commit 73be1591579084a8103a7005dd3172f3e9dd7362 upstream. + +Without this, the default implementation is a no op which is completely +wrong with a VIVT cache, and usage of sg_copy_buffer() produces +unpredictable results. + +Tested-by: Sebastian Andrzej Siewior + +Signed-off-by: Nicolas Pitre +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/include/asm/cacheflush.h | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/arch/arm/include/asm/cacheflush.h ++++ b/arch/arm/include/asm/cacheflush.h +@@ -429,6 +429,14 @@ static inline void flush_anon_page(struc + __flush_anon_page(vma, page, vmaddr); + } + ++#define ARCH_HAS_FLUSH_KERNEL_DCACHE_PAGE ++static inline void flush_kernel_dcache_page(struct page *page) ++{ ++ /* highmem pages are always flushed upon kunmap already */ ++ if ((cache_is_vivt() || cache_is_vipt_aliasing()) && !PageHighMem(page)) ++ __cpuc_flush_dcache_page(page_address(page)); ++} ++ + #define flush_dcache_mmap_lock(mapping) \ + spin_lock_irq(&(mapping)->tree_lock) + #define flush_dcache_mmap_unlock(mapping) \ + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:31 2009 +Message-Id: <20090701002430.902345957@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:46 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jack Morgenstein , + Roland Dreier +Subject: [patch 057/108] IB/mlx4: Add strong ordering to local inval and fast reg work requests +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=ib-mlx4-add-strong-ordering-to-local-inval-and-fast-reg-work-requests.patch +Content-Length: 1887 +Lines: 54 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jack Morgenstein + +commit 2ac6bf4ddc87c3b6b609f8fa82f6ebbffeac12f4 upstream. + +The ConnectX Programmer's Reference Manual states that the "SO" bit +must be set when posting Fast Register and Local Invalidate send work +requests. When this bit is set, the work request will be executed +only after all previous work requests on the send queue have been +executed. (If the bit is not set, Fast Register and Local Invalidate +WQEs may begin execution too early, which violates the defined +semantics for these operations) + +This fixes the issue with NFS/RDMA reported in + + +Signed-off-by: Jack Morgenstein +Signed-off-by: Roland Dreier +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/mlx4/qp.c | 4 ++++ + include/linux/mlx4/qp.h | 1 + + 2 files changed, 5 insertions(+) + +--- a/drivers/infiniband/hw/mlx4/qp.c ++++ b/drivers/infiniband/hw/mlx4/qp.c +@@ -1585,12 +1585,16 @@ int mlx4_ib_post_send(struct ib_qp *ibqp + break; + + case IB_WR_LOCAL_INV: ++ ctrl->srcrb_flags |= ++ cpu_to_be32(MLX4_WQE_CTRL_STRONG_ORDER); + set_local_inv_seg(wqe, wr->ex.invalidate_rkey); + wqe += sizeof (struct mlx4_wqe_local_inval_seg); + size += sizeof (struct mlx4_wqe_local_inval_seg) / 16; + break; + + case IB_WR_FAST_REG_MR: ++ ctrl->srcrb_flags |= ++ cpu_to_be32(MLX4_WQE_CTRL_STRONG_ORDER); + set_fmr_seg(wqe, wr); + wqe += sizeof (struct mlx4_wqe_fmr_seg); + size += sizeof (struct mlx4_wqe_fmr_seg) / 16; +--- a/include/linux/mlx4/qp.h ++++ b/include/linux/mlx4/qp.h +@@ -165,6 +165,7 @@ enum { + MLX4_WQE_CTRL_IP_CSUM = 1 << 4, + MLX4_WQE_CTRL_TCP_UDP_CSUM = 1 << 5, + MLX4_WQE_CTRL_INS_VLAN = 1 << 6, ++ MLX4_WQE_CTRL_STRONG_ORDER = 1 << 7, + }; + + struct mlx4_wqe_ctrl_seg { + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:31 2009 +Message-Id: <20090701002431.096318663@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:47 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Davide Libenzi +Subject: [patch 058/108] epoll: fix nested calls support +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=epoll-fix-nested-calls-support.patch +Content-Length: 3602 +Lines: 114 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Davide Libenzi + +commit 3fe4a975d662f11037cb710f8b4b158a3e38f9c0 upstream. + +This fixes a regression in 2.6.30. + +I unfortunately accepted a patch time ago, to drop the "current" usage +from possible IRQ context, w/out proper thought over it. The patch +switched to using the CPU id by bounding the nested call callback with a +get_cpu()/put_cpu(). + +Unfortunately the ep_call_nested() function can be called with a callback +that grabs sleepy locks (from own f_op->poll()), that results in epic +fails. The following patch uses the proper "context" depending on the +path where it is called, and on the kind of callback. + +This has been reported by Stefan Richter, that has also verified the patch +is his previously failing environment. + +Signed-off-by: Davide Libenzi +Reported-by: Stefan Richter +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/eventpoll.c | 21 ++++++++++++--------- + 1 file changed, 12 insertions(+), 9 deletions(-) + +--- a/fs/eventpoll.c ++++ b/fs/eventpoll.c +@@ -98,7 +98,7 @@ struct epoll_filefd { + struct nested_call_node { + struct list_head llink; + void *cookie; +- int cpu; ++ void *ctx; + }; + + /* +@@ -317,17 +317,17 @@ static void ep_nested_calls_init(struct + * @nproc: Nested call core function pointer. + * @priv: Opaque data to be passed to the @nproc callback. + * @cookie: Cookie to be used to identify this nested call. ++ * @ctx: This instance context. + * + * Returns: Returns the code returned by the @nproc callback, or -1 if + * the maximum recursion limit has been exceeded. + */ + static int ep_call_nested(struct nested_calls *ncalls, int max_nests, + int (*nproc)(void *, void *, int), void *priv, +- void *cookie) ++ void *cookie, void *ctx) + { + int error, call_nests = 0; + unsigned long flags; +- int this_cpu = get_cpu(); + struct list_head *lsthead = &ncalls->tasks_call_list; + struct nested_call_node *tncur; + struct nested_call_node tnode; +@@ -340,7 +340,7 @@ static int ep_call_nested(struct nested_ + * very much limited. + */ + list_for_each_entry(tncur, lsthead, llink) { +- if (tncur->cpu == this_cpu && ++ if (tncur->ctx == ctx && + (tncur->cookie == cookie || ++call_nests > max_nests)) { + /* + * Ops ... loop detected or maximum nest level reached. +@@ -352,7 +352,7 @@ static int ep_call_nested(struct nested_ + } + + /* Add the current task and cookie to the list */ +- tnode.cpu = this_cpu; ++ tnode.ctx = ctx; + tnode.cookie = cookie; + list_add(&tnode.llink, lsthead); + +@@ -364,10 +364,9 @@ static int ep_call_nested(struct nested_ + /* Remove the current task from the list */ + spin_lock_irqsave(&ncalls->lock, flags); + list_del(&tnode.llink); +- out_unlock: ++out_unlock: + spin_unlock_irqrestore(&ncalls->lock, flags); + +- put_cpu(); + return error; + } + +@@ -408,8 +407,12 @@ static int ep_poll_wakeup_proc(void *pri + */ + static void ep_poll_safewake(wait_queue_head_t *wq) + { ++ int this_cpu = get_cpu(); ++ + ep_call_nested(&poll_safewake_ncalls, EP_MAX_NESTS, +- ep_poll_wakeup_proc, NULL, wq); ++ ep_poll_wakeup_proc, NULL, wq, (void *) (long) this_cpu); ++ ++ put_cpu(); + } + + /* +@@ -663,7 +666,7 @@ static unsigned int ep_eventpoll_poll(st + * could re-enter here. + */ + pollflags = ep_call_nested(&poll_readywalk_ncalls, EP_MAX_NESTS, +- ep_poll_readyevents_proc, ep, ep); ++ ep_poll_readyevents_proc, ep, ep, current); + + return pollflags != -1 ? pollflags : 0; + } + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:31 2009 +Message-Id: <20090701002431.551098249@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:48 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Peter Zijlstra , + Ingo Molnar +Subject: [patch 059/108] lockdep: Select frame pointers on x86 +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=lockdep-select-frame-pointers-on-x86.patch +Content-Length: 973 +Lines: 30 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Peter Zijlstra + +commit 00540e5d54be972a94a3b2ce6da8621bebe731a2 upstream. + +x86 stack traces are a piece of crap without frame pointers, and its not +like the 'performance gain' of not having stack pointers matters when you +selected lockdep. + +Reported-by: Andrew Morton +LKML-Reference: +Signed-off-by: Peter Zijlstra +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + lib/Kconfig.debug | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/lib/Kconfig.debug ++++ b/lib/Kconfig.debug +@@ -440,7 +440,7 @@ config LOCKDEP + bool + depends on DEBUG_KERNEL && TRACE_IRQFLAGS_SUPPORT && STACKTRACE_SUPPORT && LOCKDEP_SUPPORT + select STACKTRACE +- select FRAME_POINTER if !X86 && !MIPS && !PPC && !ARM_UNWIND && !S390 ++ select FRAME_POINTER if !MIPS && !PPC && !ARM_UNWIND && !S390 + select KALLSYMS + select KALLSYMS_ALL + + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:32 2009 +Message-Id: <20090701002431.928514647@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:49 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mark Brown +Subject: [patch 060/108] ASoC: Remove odd bit clock ratios for WM8903 +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=asoc-remove-odd-bit-clock-ratios-for-wm8903.patch +Content-Length: 829 +Lines: 40 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mark Brown + +commit ba2533a47865ec0dbc72834287a8a048e9337a95 upstream. + +These are not supported since performance can not be guaranteed +when they are in use. + +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm8903.c | 4 ---- + 1 file changed, 4 deletions(-) + +--- a/sound/soc/codecs/wm8903.c ++++ b/sound/soc/codecs/wm8903.c +@@ -1215,22 +1215,18 @@ static struct { + int div; + } bclk_divs[] = { + { 10, 0 }, +- { 15, 1 }, + { 20, 2 }, + { 30, 3 }, + { 40, 4 }, + { 50, 5 }, +- { 55, 6 }, + { 60, 7 }, + { 80, 8 }, + { 100, 9 }, +- { 110, 10 }, + { 120, 11 }, + { 160, 12 }, + { 200, 13 }, + { 220, 14 }, + { 240, 15 }, +- { 250, 16 }, + { 300, 17 }, + { 320, 18 }, + { 440, 19 }, + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:32 2009 +Message-Id: <20090701002432.106047414@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:50 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mike Frysinger , + Hugh Dickins , + Matt Mackall , + Wu Fengguang +Subject: [patch 061/108] ramfs: ignore unknown mount options +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=ramfs-ignore-unknown-mount-options.patch +Content-Length: 1834 +Lines: 50 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mike Frysinger + +commit 0a8eba9b7f7aa3ad0305627c99ad4d6deedd871d upstream. + +On systems where CONFIG_SHMEM is disabled, mounting tmpfs filesystems can +fail when tmpfs options are used. This is because tmpfs creates a small +wrapper around ramfs which rejects unknown options, and ramfs itself only +supports a tiny subset of what tmpfs supports. This makes it pretty hard +to use the same userspace systems across different configuration systems. +As such, ramfs should ignore the tmpfs options when tmpfs is merely a +wrapper around ramfs. + +This used to work before commit c3b1b1cbf0 as previously, ramfs would +ignore all options. But now, we get: +ramfs: bad mount option: size=10M +mount: mounting mdev on /dev failed: Invalid argument + +Another option might be to restore the previous behavior, where ramfs +simply ignored all unknown mount options ... which is what Hugh prefers. + +Signed-off-by: Mike Frysinger +Signed-off-by: Hugh Dickins +Acked-by: Matt Mackall +Acked-by: Wu Fengguang +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ramfs/inode.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/fs/ramfs/inode.c ++++ b/fs/ramfs/inode.c +@@ -202,9 +202,12 @@ static int ramfs_parse_options(char *dat + return -EINVAL; + opts->mode = option & S_IALLUGO; + break; +- default: +- printk(KERN_ERR "ramfs: bad mount option: %s\n", p); +- return -EINVAL; ++ /* ++ * We might like to report bad mount options here; ++ * but traditionally ramfs has ignored all mount options, ++ * and as it is used as a !CONFIG_SHMEM simple substitute ++ * for tmpfs, better continue to ignore other mount options. ++ */ + } + } + + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:32 2009 +Message-Id: <20090701002432.385500243@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:51 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Bob Copeland , + "John W. Linville" +Subject: [patch 062/108] mac80211: fix minstrel single-rate memory corruption +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=mac80211-fix-minstrel-single-rate-memory-corruption.patch +Content-Length: 1975 +Lines: 49 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Bob Copeland + +commit 5ee58d7e6ad019675b4090582aec4fa1180d8703 upstream. + +The minstrel rate controller periodically looks up rate indexes in +a sampling table. When accessing a specific row and column, minstrel +correctly does a bounds check which, on the surface, appears to handle +the case where mi->n_rates < 2. However, mi->sample_idx is actually +defined as an unsigned, so the right hand side is taken to be a huge +positive number when negative, and the check will always fail. + +Consequently, the RC will overrun the array and cause random memory +corruption when communicating with a peer that has only a single rate. +The max value of mi->sample_idx is around 25 so casting to int should +have no ill effects. + +Without the change, uptime is a few minutes under load with an AP +that has a single hard-coded rate, and both the AP and STA could +potentially crash. With the change, both lasted 12 hours with a +steady load. + +Thanks to Ognjen Maric for providing the single-rate clue so I could +reproduce this. + +This fixes http://bugzilla.kernel.org/show_bug.cgi?id=12490 on the +regression list (also http://bugzilla.kernel.org/show_bug.cgi?id=13000). + +Reported-by: Sergey S. Kostyliov +Reported-by: Ognjen Maric +Signed-off-by: Bob Copeland +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/rc80211_minstrel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/mac80211/rc80211_minstrel.c ++++ b/net/mac80211/rc80211_minstrel.c +@@ -216,7 +216,7 @@ minstrel_get_next_sample(struct minstrel + unsigned int sample_ndx; + sample_ndx = SAMPLE_TBL(mi, mi->sample_idx, mi->sample_column); + mi->sample_idx++; +- if (mi->sample_idx > (mi->n_rates - 2)) { ++ if ((int) mi->sample_idx > (mi->n_rates - 2)) { + mi->sample_idx = 0; + mi->sample_column++; + if (mi->sample_column >= SAMPLE_COLUMNS) + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:32 2009 +Message-Id: <20090701002432.655132080@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:52 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Luis R. Rodriguez" , + "John W. Linville" +Subject: [patch 063/108] cfg80211: fix for duplicate userspace replies +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=cfg80211-fix-for-duplicate-userspace-replies.patch +Content-Length: 1555 +Lines: 46 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Luis R. Rodriguez + +commit 729e9c7663190d71fe5e29831634df80f38199c1 upstream. + +This fixes an incorrect assumption (BUG_ON) made in +cfg80211 when handling country IE regulatory requests. +The assumption was that we won't try to call_crda() +twice for the same event and therefore we will not +recieve two replies through nl80211 for the regulatory +request. As it turns out it is true we don't call_crda() +twice for the same event, however, kobject_uevent_env() +*might* send the udev event twice and/or userspace can +simply process the udev event twice. We remove the BUG_ON() +and simply ignore the duplicate request. + +For details refer to this thread: + +http://marc.info/?l=linux-wireless&m=124149987921337&w=2 + +Reported-by: Maxim Levitsky +Signed-off-by: Luis R. Rodriguez +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/reg.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/net/wireless/reg.c ++++ b/net/wireless/reg.c +@@ -2042,7 +2042,13 @@ static int __set_regdom(const struct iee + * the country IE rd with what CRDA believes that country should have + */ + +- BUG_ON(!country_ie_regdomain); ++ /* ++ * Userspace could have sent two replies with only ++ * one kernel request. By the second reply we would have ++ * already processed and consumed the country_ie_regdomain. ++ */ ++ if (!country_ie_regdomain) ++ return -EALREADY; + BUG_ON(rd == country_ie_regdomain); + + /* + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:33 2009 +Message-Id: <20090701002432.844204006@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:53 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Luis R. Rodriguez" , + "John W. Linville" +Subject: [patch 064/108] cfg80211: cleanup return calls on nl80211_set_reg() +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=cfg80211-cleanup-return-calls-on-nl80211_set_reg.patch +Content-Length: 1611 +Lines: 68 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Luis R. Rodriguez + +commit d0e18f833d23afefb6751a21d14a2cd71d2d4d66 upstream. + +This has no functional change, but it will make the race +fix easier to spot in my next patch. + +Signed-off-by: Luis R. Rodriguez +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/nl80211.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -2388,15 +2388,19 @@ static int nl80211_set_reg(struct sk_buf + goto bad_reg; + } + +- if (!reg_is_valid_request(alpha2)) +- return -EINVAL; ++ if (!reg_is_valid_request(alpha2)) { ++ r = -EINVAL; ++ goto bad_reg; ++ } + + size_of_regd = sizeof(struct ieee80211_regdomain) + + (num_rules * sizeof(struct ieee80211_reg_rule)); + + rd = kzalloc(size_of_regd, GFP_KERNEL); +- if (!rd) +- return -ENOMEM; ++ if (!rd) { ++ r = -ENOMEM; ++ goto bad_reg; ++ } + + rd->n_reg_rules = num_rules; + rd->alpha2[0] = alpha2[0]; +@@ -2413,8 +2417,10 @@ static int nl80211_set_reg(struct sk_buf + + rule_idx++; + +- if (rule_idx > NL80211_MAX_SUPP_REG_RULES) ++ if (rule_idx > NL80211_MAX_SUPP_REG_RULES) { ++ r = -EINVAL; + goto bad_reg; ++ } + } + + BUG_ON(rule_idx != num_rules); +@@ -2422,11 +2428,12 @@ static int nl80211_set_reg(struct sk_buf + mutex_lock(&cfg80211_mutex); + r = set_regdom(rd); + mutex_unlock(&cfg80211_mutex); ++ + return r; + + bad_reg: + kfree(rd); +- return -EINVAL; ++ return r; + } + + static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info) + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:33 2009 +Message-Id: <20090701002433.285649572@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:54 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Luis R. Rodriguez" , + "John W. Linville" +Subject: [patch 065/108] cfg80211: return immediately if num reg rules > NL80211_MAX_SUPP_REG_RULES +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=cfg80211-return-immediately-if-num-reg-rules-nl80211_max_supp_reg_rules.patch +Content-Length: 831 +Lines: 28 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Luis R. Rodriguez + +commit 4776c6e7f66f853011bc1fd6fe37fa63f0b6982c upstream. + +This has no functional change except we save a kfree(rd) and +allows us to clean this code up a bit after this. We do +avoid an unnecessary kfree(NULL) but calling that was OK too. + +Signed-off-by: Luis R. Rodriguez +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/nl80211.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -2385,7 +2385,7 @@ static int nl80211_set_reg(struct sk_buf + rem_reg_rules) { + num_rules++; + if (num_rules > NL80211_MAX_SUPP_REG_RULES) +- goto bad_reg; ++ return -EINVAL; + } + + if (!reg_is_valid_request(alpha2)) { + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:33 2009 +Message-Id: <20090701002433.711620126@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:55 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Luis R. Rodriguez" , + "John W. Linville" +Subject: [patch 066/108] cfg80211: fix in nl80211_set_reg() +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=cfg80211-fix-in-nl80211_set_reg.patch +Content-Length: 1563 +Lines: 59 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Luis R. Rodriguez + +commit 61405e97788b1bc4e7c5be5b4ec04a73fc11bac2 upstream. + +There is a race on access to last_request and its alpha2 +through reg_is_valid_request() and us possibly processing +first another regulatory request on another CPU. We avoid +this improbably race by locking with the cfg80211_mutex as +we should have done in the first place. While at it add +the assert on locking on reg_is_valid_request(). + +Signed-off-by: Luis R. Rodriguez +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/nl80211.c | 5 ++++- + net/wireless/reg.c | 2 ++ + 2 files changed, 6 insertions(+), 1 deletion(-) + +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -2388,6 +2388,8 @@ static int nl80211_set_reg(struct sk_buf + return -EINVAL; + } + ++ mutex_lock(&cfg80211_mutex); ++ + if (!reg_is_valid_request(alpha2)) { + r = -EINVAL; + goto bad_reg; +@@ -2425,13 +2427,14 @@ static int nl80211_set_reg(struct sk_buf + + BUG_ON(rule_idx != num_rules); + +- mutex_lock(&cfg80211_mutex); + r = set_regdom(rd); ++ + mutex_unlock(&cfg80211_mutex); + + return r; + + bad_reg: ++ mutex_unlock(&cfg80211_mutex); + kfree(rd); + return r; + } +--- a/net/wireless/reg.c ++++ b/net/wireless/reg.c +@@ -389,6 +389,8 @@ static int call_crda(const char *alpha2) + /* Used by nl80211 before kmalloc'ing our regulatory domain */ + bool reg_is_valid_request(const char *alpha2) + { ++ assert_cfg80211_lock(); ++ + if (!last_request) + return false; + + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:34 2009 +Message-Id: <20090701002434.033636810@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:56 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Luis R. Rodriguez" , + "John W. Linville" +Subject: [patch 067/108] ath9k: Fix bug when using a card with a busted EEPROM +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=ath9k-fix-bug-when-using-a-card-with-a-busted-eeprom.patch +Content-Length: 1812 +Lines: 56 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Luis R. Rodriguez + +backport of commit 85efc86eb7c6cbb1c8ce8d99b10b948be033fbb9 upstream. + +We fail if your EEPROM is busted but we were never propagated the +error back so such users could end up with a cryptic oops message +like: + +IP: [] ath9k_reg_apply_world_flags+0x29/0x130 [ath9k] +*pde = 00000000 +Oops: 0000 [#1] SMP +Modules linked in: ath9k(+) mac80211 cfg80211 +Pid: 4284, comm: insmod Not tainted (2.6.29-wl #3) 7660A14 +EIP: 0060:[] EFLAGS: 00010286 CPU: 1 +EIP is at ath9k_reg_apply_world_flags+0x29/0x130 [ath9k] + +Fix this by propagating the error and also lets not leave the +user in the dark and communicate what's going on. When this +happens you will now see this: + +ath9k 0000:16:00.0: PCI INT A -> GSI 16 (level, low) -> IRQ 16 +ath9k: Invalid EEPROM contents + +Signed-off-by: Luis R. Rodriguez +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath9k/main.c | 3 ++- + drivers/net/wireless/ath9k/regd.c | 2 +- + 2 files changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/ath9k/main.c ++++ b/drivers/net/wireless/ath9k/main.c +@@ -1416,7 +1416,8 @@ static int ath_init(u16 devid, struct at + for (i = 0; i < sc->keymax; i++) + ath9k_hw_keyreset(ah, (u16) i); + +- if (ath9k_regd_init(sc->sc_ah)) ++ error = ath9k_regd_init(sc->sc_ah); ++ if (error) + goto bad; + + /* default to MONITOR mode */ +--- a/drivers/net/wireless/ath9k/regd.c ++++ b/drivers/net/wireless/ath9k/regd.c +@@ -439,7 +439,7 @@ int ath9k_regd_init(struct ath_hw *ah) + u16 regdmn; + + if (!ath9k_regd_is_eeprom_valid(ah)) { +- DPRINTF(ah->ah_sc, ATH_DBG_REGULATORY, ++ DPRINTF(ah->ah_sc, ATH_DBG_FATAL, + "Invalid EEPROM contents\n"); + return -EINVAL; + } + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:34 2009 +Message-Id: <20090701002434.361785637@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:57 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Sujith , + "John W. Linville" +Subject: [patch 068/108] ath9k: Fix bug in calibration initialization +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=ath9k-fix-bug-in-calibration-initialization.patch +Content-Length: 4318 +Lines: 125 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Sujith + +commit 04d19ddd254b404703151ab25aa5041e50ff40f7 upstream. + +This patch fixes a bug in ath9k_hw_init_cal() where the wrong +calibration was being done for non-AR9285 chipsets. +Also add a few helpful comments. + +Signed-off-by: Sujith +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath9k/calib.c | 61 +++++++++++++------------------------ + 1 file changed, 22 insertions(+), 39 deletions(-) + +--- a/drivers/net/wireless/ath9k/calib.c ++++ b/drivers/net/wireless/ath9k/calib.c +@@ -919,83 +919,66 @@ static bool ar9285_clc(struct ath_hw *ah + return true; + } + +-bool ath9k_hw_init_cal(struct ath_hw *ah, +- struct ath9k_channel *chan) ++bool ath9k_hw_init_cal(struct ath_hw *ah, struct ath9k_channel *chan) + { + if (AR_SREV_9285(ah) && AR_SREV_9285_12_OR_LATER(ah)) { + if (!ar9285_clc(ah, chan)) + return false; +- } else if (AR_SREV_9280_10_OR_LATER(ah)) { +- REG_CLR_BIT(ah, AR_PHY_ADC_CTL, AR_PHY_ADC_CTL_OFF_PWDADC); +- REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_FLTR_CAL); +- REG_CLR_BIT(ah, AR_PHY_CL_CAL_CTL, AR_PHY_CL_CAL_ENABLE); ++ } else { ++ if (AR_SREV_9280_10_OR_LATER(ah)) { ++ REG_CLR_BIT(ah, AR_PHY_ADC_CTL, AR_PHY_ADC_CTL_OFF_PWDADC); ++ REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_FLTR_CAL); ++ } + +- /* Kick off the cal */ ++ /* Calibrate the AGC */ + REG_WRITE(ah, AR_PHY_AGC_CONTROL, +- REG_READ(ah, AR_PHY_AGC_CONTROL) | +- AR_PHY_AGC_CONTROL_CAL); ++ REG_READ(ah, AR_PHY_AGC_CONTROL) | ++ AR_PHY_AGC_CONTROL_CAL); + +- if (!ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL, +- AR_PHY_AGC_CONTROL_CAL, 0, +- AH_WAIT_TIMEOUT)) { ++ /* Poll for offset calibration complete */ ++ if (!ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_CAL, ++ 0, AH_WAIT_TIMEOUT)) { + DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE, + "offset calibration failed to complete in 1ms; " + "noisy environment?\n"); + return false; + } + +- REG_CLR_BIT(ah, AR_PHY_ADC_CTL, AR_PHY_ADC_CTL_OFF_PWDADC); +- REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_FLTR_CAL); +- REG_SET_BIT(ah, AR_PHY_CL_CAL_CTL, AR_PHY_CL_CAL_ENABLE); +- } +- +- /* Calibrate the AGC */ +- REG_WRITE(ah, AR_PHY_AGC_CONTROL, +- REG_READ(ah, AR_PHY_AGC_CONTROL) | +- AR_PHY_AGC_CONTROL_CAL); +- +- if (!ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_CAL, +- 0, AH_WAIT_TIMEOUT)) { +- DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE, +- "offset calibration failed to complete in 1ms; " +- "noisy environment?\n"); +- return false; +- } +- +- if (AR_SREV_9280_10_OR_LATER(ah)) { +- REG_SET_BIT(ah, AR_PHY_ADC_CTL, AR_PHY_ADC_CTL_OFF_PWDADC); +- REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_FLTR_CAL); ++ if (AR_SREV_9280_10_OR_LATER(ah)) { ++ REG_SET_BIT(ah, AR_PHY_ADC_CTL, AR_PHY_ADC_CTL_OFF_PWDADC); ++ REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_FLTR_CAL); ++ } + } + + /* Do PA Calibration */ + if (AR_SREV_9285(ah) && AR_SREV_9285_11_OR_LATER(ah)) + ath9k_hw_9285_pa_cal(ah); + +- /* Do NF Calibration */ ++ /* Do NF Calibration after DC offset and other calibrations */ + REG_WRITE(ah, AR_PHY_AGC_CONTROL, +- REG_READ(ah, AR_PHY_AGC_CONTROL) | +- AR_PHY_AGC_CONTROL_NF); ++ REG_READ(ah, AR_PHY_AGC_CONTROL) | AR_PHY_AGC_CONTROL_NF); + + ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL; + ++ /* Enable IQ, ADC Gain and ADC DC offset CALs */ + if (AR_SREV_9100(ah) || AR_SREV_9160_10_OR_LATER(ah)) { + if (ath9k_hw_iscal_supported(ah, ADC_GAIN_CAL)) { + INIT_CAL(&ah->adcgain_caldata); + INSERT_CAL(ah, &ah->adcgain_caldata); + DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE, +- "enabling ADC Gain Calibration.\n"); ++ "enabling ADC Gain Calibration.\n"); + } + if (ath9k_hw_iscal_supported(ah, ADC_DC_CAL)) { + INIT_CAL(&ah->adcdc_caldata); + INSERT_CAL(ah, &ah->adcdc_caldata); + DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE, +- "enabling ADC DC Calibration.\n"); ++ "enabling ADC DC Calibration.\n"); + } + if (ath9k_hw_iscal_supported(ah, IQ_MISMATCH_CAL)) { + INIT_CAL(&ah->iq_caldata); + INSERT_CAL(ah, &ah->iq_caldata); + DPRINTF(ah->ah_sc, ATH_DBG_CALIBRATE, +- "enabling IQ Calibration.\n"); ++ "enabling IQ Calibration.\n"); + } + + ah->cal_list_curr = ah->cal_list; + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:35 2009 +Message-Id: <20090701002434.723163004@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:58 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Sujith , + "John W. Linville" +Subject: [patch 069/108] ath9k: Fix bug in determining calibration support +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=ath9k-fix-bug-in-determining-calibration-support.patch +Content-Length: 905 +Lines: 29 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Sujith + +commit a451aa66dcb14efcb7addf1d8edcac8df76a97b6 upstream. + +ADC gain calibration has to be done for all non 2GHZ-HT20 channels. +Regression from "ath9k: use ieee80211_conf on ath9k_hw_iscal_supported()" + +Signed-off-by: Sujith +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath9k/calib.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/ath9k/calib.c ++++ b/drivers/net/wireless/ath9k/calib.c +@@ -284,8 +284,8 @@ static bool ath9k_hw_iscal_supported(str + return true; + case ADC_GAIN_CAL: + case ADC_DC_CAL: +- if (conf->channel->band == IEEE80211_BAND_5GHZ && +- conf_is_ht20(conf)) ++ if (!(conf->channel->band == IEEE80211_BAND_2GHZ && ++ conf_is_ht20(conf))) + return true; + break; + } + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:35 2009 +Message-Id: <20090701002435.151808471@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:23:59 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Sujith , + "John W. Linville" +Subject: [patch 070/108] ath9k: Fix bug in checking HT flag +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=ath9k-fix-bug-in-checking-ht-flag.patch +Content-Length: 942 +Lines: 27 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Sujith + +commit db2f63f60a087ed29ae04310c1076c61f77a5d20 upstream. + +The operating HT mode is stored in chanmode and +not channelFlags. + +Signed-off-by: Sujith +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath9k/calib.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath9k/calib.c ++++ b/drivers/net/wireless/ath9k/calib.c +@@ -883,7 +883,7 @@ bool ath9k_hw_calibrate(struct ath_hw *a + static bool ar9285_clc(struct ath_hw *ah, struct ath9k_channel *chan) + { + REG_SET_BIT(ah, AR_PHY_CL_CAL_CTL, AR_PHY_CL_CAL_ENABLE); +- if (chan->channelFlags & CHANNEL_HT20) { ++ if (IS_CHAN_HT20(chan)) { + REG_SET_BIT(ah, AR_PHY_CL_CAL_CTL, AR_PHY_PARALLEL_CAL_ENABLE); + REG_SET_BIT(ah, AR_PHY_TURBO, AR_PHY_FC_DYN2040_EN); + REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL, + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:35 2009 +Message-Id: <20090701002435.626499318@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:00 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Sujith , + "John W. Linville" +Subject: [patch 071/108] ath9k: Fix bug in scan termination +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=ath9k-fix-bug-in-scan-termination.patch +Content-Length: 789 +Lines: 27 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Sujith + +commit 9c07a7777f44c7e39accec5ad8c4293d6a9b2a47 upstream. + +A full HW reset needs to be done on termination of a scan run. +Not setting SC_OP_FULL_RESET resulted in doing a +fast channel change. + +Signed-off-by: Sujith +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath9k/main.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/ath9k/main.c ++++ b/drivers/net/wireless/ath9k/main.c +@@ -2772,6 +2772,7 @@ static void ath9k_sw_scan_complete(struc + mutex_lock(&sc->mutex); + aphy->state = ATH_WIPHY_ACTIVE; + sc->sc_flags &= ~SC_OP_SCANNING; ++ sc->sc_flags |= SC_OP_FULL_RESET; + mutex_unlock(&sc->mutex); + } + + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:36 2009 +Message-Id: <20090701002435.938429664@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:01 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Sujith , + "John W. Linville" +Subject: [patch 072/108] ath9k: Fix memleak on TX DMA failure +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=ath9k-fix-memleak-on-tx-dma-failure.patch +Content-Length: 931 +Lines: 30 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Sujith + +commit 675902ef822c114c0dac17ed10eed43eb8f5c9ec upstream. + +The driver-specific region has to be freed in case +of a DMA mapping failure. + +Signed-off-by: Sujith +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath9k/xmit.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/ath9k/xmit.c ++++ b/drivers/net/wireless/ath9k/xmit.c +@@ -1573,8 +1573,9 @@ static int ath_tx_setup_buffer(struct ie + skb->len, DMA_TO_DEVICE); + if (unlikely(dma_mapping_error(sc->dev, bf->bf_dmacontext))) { + bf->bf_mpdu = NULL; +- DPRINTF(sc, ATH_DBG_CONFIG, +- "dma_mapping_error() on TX\n"); ++ kfree(tx_info_priv); ++ tx_info->rate_driver_data[0] = NULL; ++ DPRINTF(sc, ATH_DBG_FATAL, "dma_mapping_error() on TX\n"); + return -ENOMEM; + } + + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:36 2009 +Message-Id: <20090701002436.136350710@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:02 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Sujith , + "John W. Linville" +Subject: [patch 073/108] ath9k: Initialize ANI timers +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=ath9k-initialize-ani-timers.patch +Content-Length: 1909 +Lines: 63 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Sujith + +commit 415f738ecf41b427921b503ecfd427e26f89dc23 upstream. + +The various ANI timers have to be initialized properly when +starting the calibration timer. + +Signed-off-by: Sujith +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath9k/main.c | 24 +++++++++++++++--------- + 1 file changed, 15 insertions(+), 9 deletions(-) + +--- a/drivers/net/wireless/ath9k/main.c ++++ b/drivers/net/wireless/ath9k/main.c +@@ -408,6 +408,18 @@ set_timer: + mod_timer(&sc->ani.timer, jiffies + msecs_to_jiffies(cal_interval)); + } + ++static void ath_start_ani(struct ath_softc *sc) ++{ ++ unsigned long timestamp = jiffies_to_msecs(jiffies); ++ ++ sc->ani.longcal_timer = timestamp; ++ sc->ani.shortcal_timer = timestamp; ++ sc->ani.checkani_timer = timestamp; ++ ++ mod_timer(&sc->ani.timer, ++ jiffies + msecs_to_jiffies(ATH_ANI_POLLINTERVAL)); ++} ++ + /* + * Update tx/rx chainmask. For legacy association, + * hard code chainmask to 1x1, for 11n association, use +@@ -920,9 +932,7 @@ static void ath9k_bss_assoc_info(struct + sc->nodestats.ns_avgtxrssi = ATH_RSSI_DUMMY_MARKER; + sc->nodestats.ns_avgtxrate = ATH_RATE_DUMMY_MARKER; + +- /* Start ANI */ +- mod_timer(&sc->ani.timer, +- jiffies + msecs_to_jiffies(ATH_ANI_POLLINTERVAL)); ++ ath_start_ani(sc); + } else { + DPRINTF(sc, ATH_DBG_CONFIG, "Bss Info DISSOC\n"); + sc->curaid = 0; +@@ -2271,12 +2281,8 @@ static int ath9k_add_interface(struct ie + + ath9k_hw_set_interrupts(sc->sc_ah, sc->imask); + +- if (conf->type == NL80211_IFTYPE_AP) { +- /* TODO: is this a suitable place to start ANI for AP mode? */ +- /* Start ANI */ +- mod_timer(&sc->ani.timer, +- jiffies + msecs_to_jiffies(ATH_ANI_POLLINTERVAL)); +- } ++ if (conf->type == NL80211_IFTYPE_AP) ++ ath_start_ani(sc); + + out: + mutex_unlock(&sc->mutex); + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:36 2009 +Message-Id: <20090701002436.333343967@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:03 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jouni Malinen , + "John W. Linville" +Subject: [patch 074/108] ath9k: Fix PCI FATAL interrupts by restoring RETRY_TIMEOUT disabling +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=ath9k-fix-pci-fatal-interrupts-by-restoring-retry_timeout-disabling.patch +Content-Length: 2718 +Lines: 78 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jouni Malinen + +commit f0214843ba23d9bf6dc6b8ad2c6ee27b60f0322e upstream. + +An earlier commit, 'ath9k: remove dummy PCI "retry timeout" fix', removed +code that was documented to disable RETRY_TIMEOUT register (PCI reg +0x41) since it was claimed to be a no-op. However, it turns out that +there are some combinations of hosts and ath9k-supported cards for +which this is not a no-op (reg 0x41 has value 0x80, not 0) and this +code (or something similar) is needed. In such cases, the driver may +be next to unusable due to very frequent PCI FATAL interrupts from the +card. + +Reverting the earlier commit, i.e., restoring the RETRY_TIMEOUT +disabling, seems to resolve the issue. Since the removal of this code +was not based on any known issue and was purely a cleanup change, the +safest option here is to just revert that commit. Should there be +desire to clean this up in the future, the change will need to be +tested with a more complete coverage of cards and host systems. + +http://bugzilla.kernel.org/show_bug.cgi?id=13483 + +Signed-off-by: Jouni Malinen +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath9k/pci.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +--- a/drivers/net/wireless/ath9k/pci.c ++++ b/drivers/net/wireless/ath9k/pci.c +@@ -87,6 +87,7 @@ static int ath_pci_probe(struct pci_dev + struct ath_softc *sc; + struct ieee80211_hw *hw; + u8 csz; ++ u32 val; + int ret = 0; + struct ath_hw *ah; + +@@ -133,6 +134,14 @@ static int ath_pci_probe(struct pci_dev + + pci_set_master(pdev); + ++ /* ++ * Disable the RETRY_TIMEOUT register (0x41) to keep ++ * PCI Tx retries from interfering with C3 CPU state. ++ */ ++ pci_read_config_dword(pdev, 0x40, &val); ++ if ((val & 0x0000ff00) != 0) ++ pci_write_config_dword(pdev, 0x40, val & 0xffff00ff); ++ + ret = pci_request_region(pdev, 0, "ath9k"); + if (ret) { + dev_err(&pdev->dev, "PCI memory region reserve error\n"); +@@ -244,12 +253,21 @@ static int ath_pci_resume(struct pci_dev + struct ieee80211_hw *hw = pci_get_drvdata(pdev); + struct ath_wiphy *aphy = hw->priv; + struct ath_softc *sc = aphy->sc; ++ u32 val; + int err; + + err = pci_enable_device(pdev); + if (err) + return err; + pci_restore_state(pdev); ++ /* ++ * Suspend/Resume resets the PCI configuration space, so we have to ++ * re-disable the RETRY_TIMEOUT register (0x41) to keep ++ * PCI Tx retries from interfering with C3 CPU state ++ */ ++ pci_read_config_dword(pdev, 0x40, &val); ++ if ((val & 0x0000ff00) != 0) ++ pci_write_config_dword(pdev, 0x40, val & 0xffff00ff); + + /* Enable LED */ + ath9k_hw_cfg_output(sc->sc_ah, ATH_LED_PIN, + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:37 2009 +Message-Id: <20090701002436.682141659@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:04 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Huang Ying , + Herbert Xu +Subject: [patch 075/108] crypto: aes-ni - Fix cbc mode IV saving +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=crypto-aes-ni-fix-cbc-mode-iv-saving.patch +Content-Length: 930 +Lines: 36 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Huang Ying + +commit e6efaa025384f86a18814a6b9f4e5d54484ab9ff upstream. + +Original implementation of aesni_cbc_dec do not save IV if input +length % 4 == 0. This will make decryption of next block failed. + +Signed-off-by: Huang Ying +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/crypto/aesni-intel_asm.S | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/arch/x86/crypto/aesni-intel_asm.S ++++ b/arch/x86/crypto/aesni-intel_asm.S +@@ -845,7 +845,7 @@ ENTRY(aesni_cbc_enc) + */ + ENTRY(aesni_cbc_dec) + cmp $16, LEN +- jb .Lcbc_dec_ret ++ jb .Lcbc_dec_just_ret + mov 480(KEYP), KLEN + add $240, KEYP + movups (IVP), IV +@@ -891,6 +891,7 @@ ENTRY(aesni_cbc_dec) + add $16, OUTP + cmp $16, LEN + jge .Lcbc_dec_loop1 +- movups IV, (IVP) + .Lcbc_dec_ret: ++ movups IV, (IVP) ++.Lcbc_dec_just_ret: + ret + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:37 2009 +Message-Id: <20090701002437.050628914@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:05 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dan Williams , + NeilBrown +Subject: [patch 076/108] md/raid5: add missing call to schedule() after prepare_to_wait() +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=md-raid5-add-missing-call-to-schedule-after-prepare_to_wait.patch +Content-Length: 911 +Lines: 31 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Dan Williams + +commit 7a3ab908948b6296ee7e81d42f7c176361c51975 upstream. + +In the unlikely event that reshape progresses past the current request +while it is waiting for a stripe we need to schedule() before retrying +for 2 reasons: +1/ Prevent list corruption from duplicated list_add() calls without + intervening list_del(). +2/ Give the reshape code a chance to make some progress to resolve the + conflict. + +Signed-off-by: Dan Williams +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/raid5.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -3696,6 +3696,7 @@ static int make_request(struct request_q + spin_unlock_irq(&conf->device_lock); + if (must_retry) { + release_stripe(sh); ++ schedule(); + goto retry; + } + } + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:37 2009 +Message-Id: <20090701002437.409563985@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:06 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Frederic Weisbecker , + Steven Rostedt +Subject: [patch 077/108] tracing/urgent: fix unbalanced ftrace_start_up +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=tracing-urgent-fix-unbalanced-ftrace_start_up.patch +Content-Length: 2986 +Lines: 81 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Frederic Weisbecker + +commit c85a17e22695969aa24a7ffa40cf26d6e6fcfd50 upstream. + +Perfcounter reports the following stats for a wide system +profiling: + + # + # (2364 samples) + # + # Overhead Symbol + # ........ ...... + # + 15.40% [k] mwait_idle_with_hints + 8.29% [k] read_hpet + 5.75% [k] ftrace_caller + 3.60% [k] ftrace_call + [...] + +This snapshot has been taken while neither the function tracer nor +the function graph tracer was running. +With dynamic ftrace, such results show a wrong ftrace behaviour +because all calls to ftrace_caller or ftrace_graph_caller (the patched +calls to mcount) are supposed to be patched into nop if none of those +tracers are running. + +The problem occurs after the first run of the function tracer. Once we +launch it a second time, the callsites will never be nopped back, +unless you set custom filters. +For example it happens during the self tests at boot time. +The function tracer selftest runs, and then the dynamic tracing is +tested too. After that, the callsites are left un-nopped. + +This is because the reset callback of the function tracer tries to +unregister two ftrace callbacks in once: the common function tracer +and the function tracer with stack backtrace, regardless of which +one is currently in use. +It then creates an unbalance on ftrace_start_up value which is expected +to be zero when the last ftrace callback is unregistered. When it +reaches zero, the FTRACE_DISABLE_CALLS is set on the next ftrace +command, triggering the patching into nop. But since it becomes +unbalanced, ie becomes lower than zero, if the kernel functions +are patched again (as in every further function tracer runs), they +won't ever be nopped back. + +Note that ftrace_call and ftrace_graph_call are still patched back +to ftrace_stub in the off case, but not the callers of ftrace_call +and ftrace_graph_caller. It means that the tracing is well deactivated +but we waste a useless call into every kernel function. + +This patch just unregisters the right ftrace_ops for the function +tracer on its reset callback and ignores the other one which is +not registered, fixing the unbalance. The problem also happens +is .30 + +Signed-off-by: Frederic Weisbecker +Cc: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/trace_functions.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/kernel/trace/trace_functions.c ++++ b/kernel/trace/trace_functions.c +@@ -193,9 +193,11 @@ static void tracing_start_function_trace + static void tracing_stop_function_trace(void) + { + ftrace_function_enabled = 0; +- /* OK if they are not registered */ +- unregister_ftrace_function(&trace_stack_ops); +- unregister_ftrace_function(&trace_ops); ++ ++ if (func_flags.val & TRACE_FUNC_OPT_STACK) ++ unregister_ftrace_function(&trace_stack_ops); ++ else ++ unregister_ftrace_function(&trace_ops); + } + + static int func_set_flag(u32 old_flags, u32 bit, int set) + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:38 2009 +Message-Id: <20090701002437.962186526@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:07 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jeff Layton , + Shirish Pargaonkar , + Steve French +Subject: [patch 078/108] cifs: fix fh_mutex locking in cifs_reopen_file +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=cifs-fix-fh_mutex-locking-in-cifs_reopen_file.patch +Content-Length: 1695 +Lines: 59 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jeff Layton + +commit f0a71eb820596bd8f6abf64beb4cb181edaa2341 upstream. + +Fixes a regression caused by commit a6ce4932fbdbcd8f8e8c6df76812014351c32892 + +When this lock was converted to a mutex, the locks were turned into +unlocks and vice-versa. + +Signed-off-by: Jeff Layton +Acked-by: Shirish Pargaonkar +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/file.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -491,9 +491,9 @@ static int cifs_reopen_file(struct file + return -EBADF; + + xid = GetXid(); +- mutex_unlock(&pCifsFile->fh_mutex); ++ mutex_lock(&pCifsFile->fh_mutex); + if (!pCifsFile->invalidHandle) { +- mutex_lock(&pCifsFile->fh_mutex); ++ mutex_unlock(&pCifsFile->fh_mutex); + FreeXid(xid); + return 0; + } +@@ -524,7 +524,7 @@ static int cifs_reopen_file(struct file + if (full_path == NULL) { + rc = -ENOMEM; + reopen_error_exit: +- mutex_lock(&pCifsFile->fh_mutex); ++ mutex_unlock(&pCifsFile->fh_mutex); + FreeXid(xid); + return rc; + } +@@ -566,14 +566,14 @@ reopen_error_exit: + cifs_sb->local_nls, cifs_sb->mnt_cifs_flags & + CIFS_MOUNT_MAP_SPECIAL_CHR); + if (rc) { +- mutex_lock(&pCifsFile->fh_mutex); ++ mutex_unlock(&pCifsFile->fh_mutex); + cFYI(1, ("cifs_open returned 0x%x", rc)); + cFYI(1, ("oplock: %d", oplock)); + } else { + reopen_success: + pCifsFile->netfid = netfid; + pCifsFile->invalidHandle = false; +- mutex_lock(&pCifsFile->fh_mutex); ++ mutex_unlock(&pCifsFile->fh_mutex); + pCifsInode = CIFS_I(inode); + if (pCifsInode) { + if (can_flush) { + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:38 2009 +Message-Id: <20090701002438.308543471@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:08 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jiri Slaby , + Alan Cox +Subject: [patch 079/108] vt_ioctl: fix lock imbalance +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=vt_ioctl-fix-lock-imbalance.patch +Content-Length: 804 +Lines: 29 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jiri Slaby + +commit a115902f67ef51fbbe83e214fb761aaa9734c1ce upstream. + +Don't return from switch/case directly in vt_ioctl. Set ret and break +instead so that we unlock BKL. + +Signed-off-by: Jiri Slaby +Signed-off-by: Alan Cox +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/vt_ioctl.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/char/vt_ioctl.c ++++ b/drivers/char/vt_ioctl.c +@@ -396,7 +396,8 @@ int vt_ioctl(struct tty_struct *tty, str + kbd = kbd_table + console; + switch (cmd) { + case TIOCLINUX: +- return tioclinux(tty, arg); ++ ret = tioclinux(tty, arg); ++ break; + case KIOCSOUND: + if (!perm) + goto eperm; + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:38 2009 +Message-Id: <20090701002438.502935424@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:09 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Lubomir Rintel , + "H. Peter Anvin" , + Ingo Molnar , + Steven Noonan +Subject: [patch 080/108] x86: Fix non-lazy GS handling in sys_vm86() +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=x86-fix-non-lazy-gs-handling-in-sys_vm86.patch +Content-Length: 1450 +Lines: 49 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Lubomir Rintel + +commit 3aa6b186f86c5d06d6d92d14311ffed51f091f40 upstream. + +This fixes a stack corruption panic or null dereference oops +due to a bad GS in resume_userspace() when returning from +sys_vm86() and calling lockdep_sys_exit(). + +Only a problem when CONFIG_LOCKDEP and CONFIG_CC_STACKPROTECTOR +enabled. + +Signed-off-by: Lubomir Rintel +Cc: H. Peter Anvin +LKML-Reference: <1244384628.2323.4.camel@bimbo> +Signed-off-by: Ingo Molnar +Cc: Steven Noonan +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/vm86_32.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/arch/x86/kernel/vm86_32.c ++++ b/arch/x86/kernel/vm86_32.c +@@ -287,10 +287,9 @@ static void do_sys_vm86(struct kernel_vm + info->regs.pt.ds = 0; + info->regs.pt.es = 0; + info->regs.pt.fs = 0; +- +-/* we are clearing gs later just before "jmp resume_userspace", +- * because it is not saved/restored. +- */ ++#ifndef CONFIG_X86_32_LAZY_GS ++ info->regs.pt.gs = 0; ++#endif + + /* + * The flags register is also special: we cannot trust that the user +@@ -343,7 +342,9 @@ static void do_sys_vm86(struct kernel_vm + __asm__ __volatile__( + "movl %0,%%esp\n\t" + "movl %1,%%ebp\n\t" ++#ifdef CONFIG_X86_32_LAZY_GS + "mov %2, %%gs\n\t" ++#endif + "jmp resume_userspace" + : /* no outputs */ + :"r" (&info->regs), "r" (task_thread_info(tsk)), "r" (0)); + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:38 2009 +Message-Id: <20090701002438.714465250@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:10 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andreas Herrmann , + Ingo Molnar +Subject: [patch 081/108] x86: Set cpu_llc_id on AMD CPUs +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=x86-set-cpu_llc_id-on-amd-cpus.patch +Content-Length: 1958 +Lines: 72 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Andreas Herrmann + +commit 99bd0c0fc4b04da54cb311953ef9489931c19c63 upstream. + +This counts when building sched domains in case NUMA information +is not available. + +( See cpu_coregroup_mask() which uses llc_shared_map which in turn is + created based on cpu_llc_id. ) + +Currently Linux builds domains as follows: +(example from a dual socket quad-core system) + + CPU0 attaching sched-domain: + domain 0: span 0-7 level CPU + groups: 0 1 2 3 4 5 6 7 + + ... + + CPU7 attaching sched-domain: + domain 0: span 0-7 level CPU + groups: 7 0 1 2 3 4 5 6 + +Ever since that is borked for multi-core AMD CPU systems. +This patch fixes that and now we get a proper: + + CPU0 attaching sched-domain: + domain 0: span 0-3 level MC + groups: 0 1 2 3 + domain 1: span 0-7 level CPU + groups: 0-3 4-7 + + ... + + CPU7 attaching sched-domain: + domain 0: span 4-7 level MC + groups: 7 4 5 6 + domain 1: span 0-7 level CPU + groups: 4-7 0-3 + +This allows scheduler to assign tasks to cores on different sockets +(i.e. that don't share last level cache) for performance reasons. + +Signed-off-by: Andreas Herrmann +LKML-Reference: <20090619085909.GJ5218@alberich.amd.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/amd.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/arch/x86/kernel/cpu/amd.c ++++ b/arch/x86/kernel/cpu/amd.c +@@ -258,13 +258,15 @@ static void __cpuinit amd_detect_cmp(str + { + #ifdef CONFIG_X86_HT + unsigned bits; ++ int cpu = smp_processor_id(); + + bits = c->x86_coreid_bits; +- + /* Low order bits define the core id (index of core in socket) */ + c->cpu_core_id = c->initial_apicid & ((1 << bits)-1); + /* Convert the initial APIC ID into the socket ID */ + c->phys_proc_id = c->initial_apicid >> bits; ++ /* use socket ID also for last level cache */ ++ per_cpu(cpu_llc_id, cpu) = c->phys_proc_id; + #endif + } + + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:39 2009 +Message-Id: <20090701002438.907510161@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:11 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Stern +Subject: [patch 082/108] usb-serial: replace shutdown with disconnect, release +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=usb-serial-replace-shutdown-with-disconnect-release.patch +Content-Length: 52260 +Lines: 1598 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alan Stern + +commit f9c99bb8b3a1ec81af68d484a551307326c2e933 upstream + +This patch splits up the shutdown method of usb_serial_driver into a +disconnect and a release method. + +The problem is that the usb-serial core was calling shutdown during +disconnect handling, but drivers didn't expect it to be called until +after all the open file references had been closed. The result was an +oops when the close method tried to use memory that had been +deallocated by shutdown. + +Signed-off-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/uc2322/aten2011.c | 4 +-- + drivers/usb/serial/aircable.c | 5 +--- + drivers/usb/serial/belkin_sa.c | 7 ++--- + drivers/usb/serial/cp210x.c | 6 ++-- + drivers/usb/serial/cyberjack.c | 20 ++++++++++++---- + drivers/usb/serial/cypress_m8.c | 11 ++++---- + drivers/usb/serial/digi_acceleport.c | 20 ++++++++++++---- + drivers/usb/serial/empeg.c | 8 ------ + drivers/usb/serial/ftdi_sio.c | 14 ----------- + drivers/usb/serial/garmin_gps.c | 16 ++++++++++-- + drivers/usb/serial/generic.c | 9 +++++-- + drivers/usb/serial/io_edgeport.c | 29 ++++++++++++++++------- + drivers/usb/serial/io_tables.h | 12 ++++++--- + drivers/usb/serial/io_ti.c | 22 +++++++++++++---- + drivers/usb/serial/ipaq.c | 7 ----- + drivers/usb/serial/iuu_phoenix.c | 6 ++-- + drivers/usb/serial/keyspan.c | 13 +++++++++- + drivers/usb/serial/keyspan.h | 12 ++++++--- + drivers/usb/serial/keyspan_pda.c | 4 +-- + drivers/usb/serial/kl5kusb105.c | 39 +++++++++++++++++-------------- + drivers/usb/serial/kobil_sct.c | 12 +++------ + drivers/usb/serial/mct_u232.c | 13 ++++------ + drivers/usb/serial/mos7720.c | 9 ++----- + drivers/usb/serial/mos7840.c | 42 +++++++++++++++++++++++++++++----- + drivers/usb/serial/omninet.c | 19 ++++++++++++--- + drivers/usb/serial/opticon.c | 14 ++++++++--- + drivers/usb/serial/option.c | 17 +++++++++---- + drivers/usb/serial/oti6858.c | 7 ++--- + drivers/usb/serial/pl2303.c | 5 +--- + drivers/usb/serial/sierra.c | 28 +++++++++++++++++++--- + drivers/usb/serial/spcp8x5.c | 5 +--- + drivers/usb/serial/symbolserial.c | 14 ++++++++--- + drivers/usb/serial/ti_usb_3410_5052.c | 10 +++----- + drivers/usb/serial/usb-serial.c | 29 ++++++++++------------- + drivers/usb/serial/visor.c | 13 ++++------ + drivers/usb/serial/whiteheat.c | 6 ++-- + include/linux/usb/serial.h | 12 ++++++--- + 37 files changed, 319 insertions(+), 200 deletions(-) + +--- a/drivers/staging/uc2322/aten2011.c ++++ b/drivers/staging/uc2322/aten2011.c +@@ -2336,7 +2336,7 @@ static int ATEN2011_startup(struct usb_s + return 0; + } + +-static void ATEN2011_shutdown(struct usb_serial *serial) ++static void ATEN2011_release(struct usb_serial *serial) + { + int i; + struct ATENINTL_port *ATEN2011_port; +@@ -2382,7 +2382,7 @@ static struct usb_serial_driver aten_ser + .tiocmget = ATEN2011_tiocmget, + .tiocmset = ATEN2011_tiocmset, + .attach = ATEN2011_startup, +- .shutdown = ATEN2011_shutdown, ++ .release = ATEN2011_release, + .read_bulk_callback = ATEN2011_bulk_in_callback, + .read_int_callback = ATEN2011_interrupt_callback, + }; +--- a/drivers/usb/serial/aircable.c ++++ b/drivers/usb/serial/aircable.c +@@ -364,7 +364,7 @@ static int aircable_attach(struct usb_se + return 0; + } + +-static void aircable_shutdown(struct usb_serial *serial) ++static void aircable_release(struct usb_serial *serial) + { + + struct usb_serial_port *port = serial->port[0]; +@@ -375,7 +375,6 @@ static void aircable_shutdown(struct usb + if (priv) { + serial_buf_free(priv->tx_buf); + serial_buf_free(priv->rx_buf); +- usb_set_serial_port_data(port, NULL); + kfree(priv); + } + } +@@ -601,7 +600,7 @@ static struct usb_serial_driver aircable + .num_ports = 1, + .attach = aircable_attach, + .probe = aircable_probe, +- .shutdown = aircable_shutdown, ++ .release = aircable_release, + .write = aircable_write, + .write_room = aircable_write_room, + .write_bulk_callback = aircable_write_bulk_callback, +--- a/drivers/usb/serial/belkin_sa.c ++++ b/drivers/usb/serial/belkin_sa.c +@@ -90,7 +90,7 @@ static int debug; + + /* function prototypes for a Belkin USB Serial Adapter F5U103 */ + static int belkin_sa_startup(struct usb_serial *serial); +-static void belkin_sa_shutdown(struct usb_serial *serial); ++static void belkin_sa_release(struct usb_serial *serial); + static int belkin_sa_open(struct tty_struct *tty, + struct usb_serial_port *port, struct file *filp); + static void belkin_sa_close(struct tty_struct *tty, +@@ -143,7 +143,7 @@ static struct usb_serial_driver belkin_d + .tiocmget = belkin_sa_tiocmget, + .tiocmset = belkin_sa_tiocmset, + .attach = belkin_sa_startup, +- .shutdown = belkin_sa_shutdown, ++ .release = belkin_sa_release, + }; + + +@@ -198,14 +198,13 @@ static int belkin_sa_startup(struct usb_ + } + + +-static void belkin_sa_shutdown(struct usb_serial *serial) ++static void belkin_sa_release(struct usb_serial *serial) + { + struct belkin_sa_private *priv; + int i; + + dbg("%s", __func__); + +- /* stop reads and writes on all ports */ + for (i = 0; i < serial->num_ports; ++i) { + /* My special items, the standard routines free my urbs */ + priv = usb_get_serial_port_data(serial->port[i]); +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -51,7 +51,7 @@ static int cp2101_tiocmset_port(struct u + unsigned int, unsigned int); + static void cp2101_break_ctl(struct tty_struct *, int); + static int cp2101_startup(struct usb_serial *); +-static void cp2101_shutdown(struct usb_serial *); ++static void cp2101_disconnect(struct usb_serial *); + + static int debug; + +@@ -131,7 +131,7 @@ static struct usb_serial_driver cp2101_d + .tiocmget = cp2101_tiocmget, + .tiocmset = cp2101_tiocmset, + .attach = cp2101_startup, +- .shutdown = cp2101_shutdown, ++ .disconnect = cp2101_disconnect, + }; + + /* Config request types */ +@@ -773,7 +773,7 @@ static int cp2101_startup(struct usb_ser + return 0; + } + +-static void cp2101_shutdown(struct usb_serial *serial) ++static void cp2101_disconnect(struct usb_serial *serial) + { + int i; + +--- a/drivers/usb/serial/cyberjack.c ++++ b/drivers/usb/serial/cyberjack.c +@@ -58,7 +58,8 @@ static int debug; + + /* Function prototypes */ + static int cyberjack_startup(struct usb_serial *serial); +-static void cyberjack_shutdown(struct usb_serial *serial); ++static void cyberjack_disconnect(struct usb_serial *serial); ++static void cyberjack_release(struct usb_serial *serial); + static int cyberjack_open(struct tty_struct *tty, + struct usb_serial_port *port, struct file *filp); + static void cyberjack_close(struct tty_struct *tty, +@@ -95,7 +96,8 @@ static struct usb_serial_driver cyberjac + .id_table = id_table, + .num_ports = 1, + .attach = cyberjack_startup, +- .shutdown = cyberjack_shutdown, ++ .disconnect = cyberjack_disconnect, ++ .release = cyberjack_release, + .open = cyberjack_open, + .close = cyberjack_close, + .write = cyberjack_write, +@@ -149,17 +151,25 @@ static int cyberjack_startup(struct usb_ + return 0; + } + +-static void cyberjack_shutdown(struct usb_serial *serial) ++static void cyberjack_disconnect(struct usb_serial *serial) + { + int i; + + dbg("%s", __func__); + +- for (i = 0; i < serial->num_ports; ++i) { ++ for (i = 0; i < serial->num_ports; ++i) + usb_kill_urb(serial->port[i]->interrupt_in_urb); ++} ++ ++static void cyberjack_release(struct usb_serial *serial) ++{ ++ int i; ++ ++ dbg("%s", __func__); ++ ++ for (i = 0; i < serial->num_ports; ++i) { + /* My special items, the standard routines free my urbs */ + kfree(usb_get_serial_port_data(serial->port[i])); +- usb_set_serial_port_data(serial->port[i], NULL); + } + } + +--- a/drivers/usb/serial/cypress_m8.c ++++ b/drivers/usb/serial/cypress_m8.c +@@ -171,7 +171,7 @@ struct cypress_buf { + static int cypress_earthmate_startup(struct usb_serial *serial); + static int cypress_hidcom_startup(struct usb_serial *serial); + static int cypress_ca42v2_startup(struct usb_serial *serial); +-static void cypress_shutdown(struct usb_serial *serial); ++static void cypress_release(struct usb_serial *serial); + static int cypress_open(struct tty_struct *tty, + struct usb_serial_port *port, struct file *filp); + static void cypress_close(struct tty_struct *tty, +@@ -215,7 +215,7 @@ static struct usb_serial_driver cypress_ + .id_table = id_table_earthmate, + .num_ports = 1, + .attach = cypress_earthmate_startup, +- .shutdown = cypress_shutdown, ++ .release = cypress_release, + .open = cypress_open, + .close = cypress_close, + .write = cypress_write, +@@ -241,7 +241,7 @@ static struct usb_serial_driver cypress_ + .id_table = id_table_cyphidcomrs232, + .num_ports = 1, + .attach = cypress_hidcom_startup, +- .shutdown = cypress_shutdown, ++ .release = cypress_release, + .open = cypress_open, + .close = cypress_close, + .write = cypress_write, +@@ -267,7 +267,7 @@ static struct usb_serial_driver cypress_ + .id_table = id_table_nokiaca42v2, + .num_ports = 1, + .attach = cypress_ca42v2_startup, +- .shutdown = cypress_shutdown, ++ .release = cypress_release, + .open = cypress_open, + .close = cypress_close, + .write = cypress_write, +@@ -613,7 +613,7 @@ static int cypress_ca42v2_startup(struct + } /* cypress_ca42v2_startup */ + + +-static void cypress_shutdown(struct usb_serial *serial) ++static void cypress_release(struct usb_serial *serial) + { + struct cypress_private *priv; + +@@ -626,7 +626,6 @@ static void cypress_shutdown(struct usb_ + if (priv) { + cypress_buf_free(priv->buf); + kfree(priv); +- usb_set_serial_port_data(serial->port[0], NULL); + } + } + +--- a/drivers/usb/serial/digi_acceleport.c ++++ b/drivers/usb/serial/digi_acceleport.c +@@ -460,7 +460,8 @@ static void digi_close(struct tty_struct + struct file *filp); + static int digi_startup_device(struct usb_serial *serial); + static int digi_startup(struct usb_serial *serial); +-static void digi_shutdown(struct usb_serial *serial); ++static void digi_disconnect(struct usb_serial *serial); ++static void digi_release(struct usb_serial *serial); + static void digi_read_bulk_callback(struct urb *urb); + static int digi_read_inb_callback(struct urb *urb); + static int digi_read_oob_callback(struct urb *urb); +@@ -522,7 +523,8 @@ static struct usb_serial_driver digi_acc + .tiocmget = digi_tiocmget, + .tiocmset = digi_tiocmset, + .attach = digi_startup, +- .shutdown = digi_shutdown, ++ .disconnect = digi_disconnect, ++ .release = digi_release, + }; + + static struct usb_serial_driver digi_acceleport_4_device = { +@@ -548,7 +550,8 @@ static struct usb_serial_driver digi_acc + .tiocmget = digi_tiocmget, + .tiocmset = digi_tiocmset, + .attach = digi_startup, +- .shutdown = digi_shutdown, ++ .disconnect = digi_disconnect, ++ .release = digi_release, + }; + + +@@ -1589,16 +1592,23 @@ static int digi_startup(struct usb_seria + } + + +-static void digi_shutdown(struct usb_serial *serial) ++static void digi_disconnect(struct usb_serial *serial) + { + int i; +- dbg("digi_shutdown: TOP, in_interrupt()=%ld", in_interrupt()); ++ dbg("digi_disconnect: TOP, in_interrupt()=%ld", in_interrupt()); + + /* stop reads and writes on all ports */ + for (i = 0; i < serial->type->num_ports + 1; i++) { + usb_kill_urb(serial->port[i]->read_urb); + usb_kill_urb(serial->port[i]->write_urb); + } ++} ++ ++ ++static void digi_release(struct usb_serial *serial) ++{ ++ int i; ++ dbg("digi_release: TOP, in_interrupt()=%ld", in_interrupt()); + + /* free the private data structures for all ports */ + /* number of regular ports + 1 for the out-of-band port */ +--- a/drivers/usb/serial/empeg.c ++++ b/drivers/usb/serial/empeg.c +@@ -91,7 +91,6 @@ static int empeg_chars_in_buffer(struct + static void empeg_throttle(struct tty_struct *tty); + static void empeg_unthrottle(struct tty_struct *tty); + static int empeg_startup(struct usb_serial *serial); +-static void empeg_shutdown(struct usb_serial *serial); + static void empeg_set_termios(struct tty_struct *tty, + struct usb_serial_port *port, struct ktermios *old_termios); + static void empeg_write_bulk_callback(struct urb *urb); +@@ -125,7 +124,6 @@ static struct usb_serial_driver empeg_de + .throttle = empeg_throttle, + .unthrottle = empeg_unthrottle, + .attach = empeg_startup, +- .shutdown = empeg_shutdown, + .set_termios = empeg_set_termios, + .write = empeg_write, + .write_room = empeg_write_room, +@@ -429,12 +427,6 @@ static int empeg_startup(struct usb_ser + } + + +-static void empeg_shutdown(struct usb_serial *serial) +-{ +- dbg("%s", __func__); +-} +- +- + static void empeg_set_termios(struct tty_struct *tty, + struct usb_serial_port *port, struct ktermios *old_termios) + { +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -714,7 +714,6 @@ static const char *ftdi_chip_name[] = { + /* function prototypes for a FTDI serial converter */ + static int ftdi_sio_probe(struct usb_serial *serial, + const struct usb_device_id *id); +-static void ftdi_shutdown(struct usb_serial *serial); + static int ftdi_sio_port_probe(struct usb_serial_port *port); + static int ftdi_sio_port_remove(struct usb_serial_port *port); + static int ftdi_open(struct tty_struct *tty, +@@ -770,7 +769,6 @@ static struct usb_serial_driver ftdi_sio + .ioctl = ftdi_ioctl, + .set_termios = ftdi_set_termios, + .break_ctl = ftdi_break_ctl, +- .shutdown = ftdi_shutdown, + }; + + +@@ -1460,18 +1458,6 @@ static int ftdi_mtxorb_hack_setup(struct + return 0; + } + +-/* ftdi_shutdown is called from usbserial:usb_serial_disconnect +- * it is called when the usb device is disconnected +- * +- * usbserial:usb_serial_disconnect +- * calls __serial_close for each open of the port +- * shutdown is called then (ie ftdi_shutdown) +- */ +-static void ftdi_shutdown(struct usb_serial *serial) +-{ +- dbg("%s", __func__); +-} +- + static void ftdi_sio_priv_release(struct kref *k) + { + struct ftdi_private *priv = container_of(k, struct ftdi_private, kref); +--- a/drivers/usb/serial/garmin_gps.c ++++ b/drivers/usb/serial/garmin_gps.c +@@ -1528,7 +1528,7 @@ static int garmin_attach(struct usb_seri + } + + +-static void garmin_shutdown(struct usb_serial *serial) ++static void garmin_disconnect(struct usb_serial *serial) + { + struct usb_serial_port *port = serial->port[0]; + struct garmin_data *garmin_data_p = usb_get_serial_port_data(port); +@@ -1537,8 +1537,17 @@ static void garmin_shutdown(struct usb_s + + usb_kill_urb(port->interrupt_in_urb); + del_timer_sync(&garmin_data_p->timer); ++} ++ ++ ++static void garmin_release(struct usb_serial *serial) ++{ ++ struct usb_serial_port *port = serial->port[0]; ++ struct garmin_data *garmin_data_p = usb_get_serial_port_data(port); ++ ++ dbg("%s", __func__); ++ + kfree(garmin_data_p); +- usb_set_serial_port_data(port, NULL); + } + + +@@ -1557,7 +1566,8 @@ static struct usb_serial_driver garmin_d + .throttle = garmin_throttle, + .unthrottle = garmin_unthrottle, + .attach = garmin_attach, +- .shutdown = garmin_shutdown, ++ .disconnect = garmin_disconnect, ++ .release = garmin_release, + .write = garmin_write, + .write_room = garmin_write_room, + .write_bulk_callback = garmin_write_bulk_callback, +--- a/drivers/usb/serial/generic.c ++++ b/drivers/usb/serial/generic.c +@@ -63,7 +63,8 @@ struct usb_serial_driver usb_serial_gene + .id_table = generic_device_ids, + .usb_driver = &generic_driver, + .num_ports = 1, +- .shutdown = usb_serial_generic_shutdown, ++ .disconnect = usb_serial_generic_disconnect, ++ .release = usb_serial_generic_release, + .throttle = usb_serial_generic_throttle, + .unthrottle = usb_serial_generic_unthrottle, + .resume = usb_serial_generic_resume, +@@ -413,7 +414,7 @@ void usb_serial_generic_unthrottle(struc + } + } + +-void usb_serial_generic_shutdown(struct usb_serial *serial) ++void usb_serial_generic_disconnect(struct usb_serial *serial) + { + int i; + +@@ -424,3 +425,7 @@ void usb_serial_generic_shutdown(struct + generic_cleanup(serial->port[i]); + } + ++void usb_serial_generic_release(struct usb_serial *serial) ++{ ++ dbg("%s", __func__); ++} +--- a/drivers/usb/serial/io_edgeport.c ++++ b/drivers/usb/serial/io_edgeport.c +@@ -225,7 +225,8 @@ static int edge_tiocmget(struct tty_str + static int edge_tiocmset(struct tty_struct *tty, struct file *file, + unsigned int set, unsigned int clear); + static int edge_startup(struct usb_serial *serial); +-static void edge_shutdown(struct usb_serial *serial); ++static void edge_disconnect(struct usb_serial *serial); ++static void edge_release(struct usb_serial *serial); + + #include "io_tables.h" /* all of the devices that this driver supports */ + +@@ -3195,21 +3196,16 @@ static int edge_startup(struct usb_seria + + + /**************************************************************************** +- * edge_shutdown ++ * edge_disconnect + * This function is called whenever the device is removed from the usb bus. + ****************************************************************************/ +-static void edge_shutdown(struct usb_serial *serial) ++static void edge_disconnect(struct usb_serial *serial) + { + struct edgeport_serial *edge_serial = usb_get_serial_data(serial); +- int i; + + dbg("%s", __func__); + + /* stop reads and writes on all ports */ +- for (i = 0; i < serial->num_ports; ++i) { +- kfree(usb_get_serial_port_data(serial->port[i])); +- usb_set_serial_port_data(serial->port[i], NULL); +- } + /* free up our endpoint stuff */ + if (edge_serial->is_epic) { + usb_kill_urb(edge_serial->interrupt_read_urb); +@@ -3220,9 +3216,24 @@ static void edge_shutdown(struct usb_ser + usb_free_urb(edge_serial->read_urb); + kfree(edge_serial->bulk_in_buffer); + } ++} ++ ++ ++/**************************************************************************** ++ * edge_release ++ * This function is called when the device structure is deallocated. ++ ****************************************************************************/ ++static void edge_release(struct usb_serial *serial) ++{ ++ struct edgeport_serial *edge_serial = usb_get_serial_data(serial); ++ int i; ++ ++ dbg("%s", __func__); ++ ++ for (i = 0; i < serial->num_ports; ++i) ++ kfree(usb_get_serial_port_data(serial->port[i])); + + kfree(edge_serial); +- usb_set_serial_data(serial, NULL); + } + + +--- a/drivers/usb/serial/io_tables.h ++++ b/drivers/usb/serial/io_tables.h +@@ -117,7 +117,8 @@ static struct usb_serial_driver edgeport + .throttle = edge_throttle, + .unthrottle = edge_unthrottle, + .attach = edge_startup, +- .shutdown = edge_shutdown, ++ .disconnect = edge_disconnect, ++ .release = edge_release, + .ioctl = edge_ioctl, + .set_termios = edge_set_termios, + .tiocmget = edge_tiocmget, +@@ -145,7 +146,8 @@ static struct usb_serial_driver edgeport + .throttle = edge_throttle, + .unthrottle = edge_unthrottle, + .attach = edge_startup, +- .shutdown = edge_shutdown, ++ .disconnect = edge_disconnect, ++ .release = edge_release, + .ioctl = edge_ioctl, + .set_termios = edge_set_termios, + .tiocmget = edge_tiocmget, +@@ -173,7 +175,8 @@ static struct usb_serial_driver edgeport + .throttle = edge_throttle, + .unthrottle = edge_unthrottle, + .attach = edge_startup, +- .shutdown = edge_shutdown, ++ .disconnect = edge_disconnect, ++ .release = edge_release, + .ioctl = edge_ioctl, + .set_termios = edge_set_termios, + .tiocmget = edge_tiocmget, +@@ -200,7 +203,8 @@ static struct usb_serial_driver epic_dev + .throttle = edge_throttle, + .unthrottle = edge_unthrottle, + .attach = edge_startup, +- .shutdown = edge_shutdown, ++ .disconnect = edge_disconnect, ++ .release = edge_release, + .ioctl = edge_ioctl, + .set_termios = edge_set_termios, + .tiocmget = edge_tiocmget, +--- a/drivers/usb/serial/io_ti.c ++++ b/drivers/usb/serial/io_ti.c +@@ -2664,7 +2664,7 @@ cleanup: + return -ENOMEM; + } + +-static void edge_shutdown(struct usb_serial *serial) ++static void edge_disconnect(struct usb_serial *serial) + { + int i; + struct edgeport_port *edge_port; +@@ -2674,12 +2674,22 @@ static void edge_shutdown(struct usb_ser + for (i = 0; i < serial->num_ports; ++i) { + edge_port = usb_get_serial_port_data(serial->port[i]); + edge_remove_sysfs_attrs(edge_port->port); ++ } ++} ++ ++static void edge_release(struct usb_serial *serial) ++{ ++ int i; ++ struct edgeport_port *edge_port; ++ ++ dbg("%s", __func__); ++ ++ for (i = 0; i < serial->num_ports; ++i) { ++ edge_port = usb_get_serial_port_data(serial->port[i]); + edge_buf_free(edge_port->ep_out_buf); + kfree(edge_port); +- usb_set_serial_port_data(serial->port[i], NULL); + } + kfree(usb_get_serial_data(serial)); +- usb_set_serial_data(serial, NULL); + } + + +@@ -2916,7 +2926,8 @@ static struct usb_serial_driver edgeport + .throttle = edge_throttle, + .unthrottle = edge_unthrottle, + .attach = edge_startup, +- .shutdown = edge_shutdown, ++ .disconnect = edge_disconnect, ++ .release = edge_release, + .port_probe = edge_create_sysfs_attrs, + .ioctl = edge_ioctl, + .set_termios = edge_set_termios, +@@ -2945,7 +2956,8 @@ static struct usb_serial_driver edgeport + .throttle = edge_throttle, + .unthrottle = edge_unthrottle, + .attach = edge_startup, +- .shutdown = edge_shutdown, ++ .disconnect = edge_disconnect, ++ .release = edge_release, + .port_probe = edge_create_sysfs_attrs, + .ioctl = edge_ioctl, + .set_termios = edge_set_termios, +--- a/drivers/usb/serial/ipaq.c ++++ b/drivers/usb/serial/ipaq.c +@@ -80,7 +80,6 @@ static void ipaq_close(struct tty_struct + struct usb_serial_port *port, struct file *filp); + static int ipaq_calc_num_ports(struct usb_serial *serial); + static int ipaq_startup(struct usb_serial *serial); +-static void ipaq_shutdown(struct usb_serial *serial); + static int ipaq_write(struct tty_struct *tty, struct usb_serial_port *port, + const unsigned char *buf, int count); + static int ipaq_write_bulk(struct usb_serial_port *port, +@@ -577,7 +576,6 @@ static struct usb_serial_driver ipaq_dev + .close = ipaq_close, + .attach = ipaq_startup, + .calc_num_ports = ipaq_calc_num_ports, +- .shutdown = ipaq_shutdown, + .write = ipaq_write, + .write_room = ipaq_write_room, + .chars_in_buffer = ipaq_chars_in_buffer, +@@ -992,11 +990,6 @@ static int ipaq_startup(struct usb_seria + return usb_reset_configuration(serial->dev); + } + +-static void ipaq_shutdown(struct usb_serial *serial) +-{ +- dbg("%s", __func__); +-} +- + static int __init ipaq_init(void) + { + int retval; +--- a/drivers/usb/serial/iuu_phoenix.c ++++ b/drivers/usb/serial/iuu_phoenix.c +@@ -122,8 +122,8 @@ static int iuu_startup(struct usb_serial + return 0; + } + +-/* Shutdown function */ +-static void iuu_shutdown(struct usb_serial *serial) ++/* Release function */ ++static void iuu_release(struct usb_serial *serial) + { + struct usb_serial_port *port = serial->port[0]; + struct iuu_private *priv = usb_get_serial_port_data(port); +@@ -1176,7 +1176,7 @@ static struct usb_serial_driver iuu_devi + .tiocmget = iuu_tiocmget, + .tiocmset = iuu_tiocmset, + .attach = iuu_startup, +- .shutdown = iuu_shutdown, ++ .release = iuu_release, + }; + + static int __init iuu_init(void) +--- a/drivers/usb/serial/keyspan.c ++++ b/drivers/usb/serial/keyspan.c +@@ -2682,7 +2682,7 @@ static int keyspan_startup(struct usb_se + return 0; + } + +-static void keyspan_shutdown(struct usb_serial *serial) ++static void keyspan_disconnect(struct usb_serial *serial) + { + int i, j; + struct usb_serial_port *port; +@@ -2722,6 +2722,17 @@ static void keyspan_shutdown(struct usb_ + usb_free_urb(p_priv->out_urbs[j]); + } + } ++} ++ ++static void keyspan_release(struct usb_serial *serial) ++{ ++ int i; ++ struct usb_serial_port *port; ++ struct keyspan_serial_private *s_priv; ++ ++ dbg("%s", __func__); ++ ++ s_priv = usb_get_serial_data(serial); + + /* dbg("Freeing serial->private."); */ + kfree(s_priv); +--- a/drivers/usb/serial/keyspan.h ++++ b/drivers/usb/serial/keyspan.h +@@ -42,7 +42,8 @@ static void keyspan_close (struct tty_s + struct usb_serial_port *port, + struct file *filp); + static int keyspan_startup (struct usb_serial *serial); +-static void keyspan_shutdown (struct usb_serial *serial); ++static void keyspan_disconnect (struct usb_serial *serial); ++static void keyspan_release (struct usb_serial *serial); + static int keyspan_write_room (struct tty_struct *tty); + + static int keyspan_write (struct tty_struct *tty, +@@ -569,7 +570,8 @@ static struct usb_serial_driver keyspan_ + .tiocmget = keyspan_tiocmget, + .tiocmset = keyspan_tiocmset, + .attach = keyspan_startup, +- .shutdown = keyspan_shutdown, ++ .disconnect = keyspan_disconnect, ++ .release = keyspan_release, + }; + + static struct usb_serial_driver keyspan_2port_device = { +@@ -589,7 +591,8 @@ static struct usb_serial_driver keyspan_ + .tiocmget = keyspan_tiocmget, + .tiocmset = keyspan_tiocmset, + .attach = keyspan_startup, +- .shutdown = keyspan_shutdown, ++ .disconnect = keyspan_disconnect, ++ .release = keyspan_release, + }; + + static struct usb_serial_driver keyspan_4port_device = { +@@ -609,7 +612,8 @@ static struct usb_serial_driver keyspan_ + .tiocmget = keyspan_tiocmget, + .tiocmset = keyspan_tiocmset, + .attach = keyspan_startup, +- .shutdown = keyspan_shutdown, ++ .disconnect = keyspan_disconnect, ++ .release = keyspan_release, + }; + + #endif +--- a/drivers/usb/serial/keyspan_pda.c ++++ b/drivers/usb/serial/keyspan_pda.c +@@ -795,7 +795,7 @@ static int keyspan_pda_startup(struct us + return 0; + } + +-static void keyspan_pda_shutdown(struct usb_serial *serial) ++static void keyspan_pda_release(struct usb_serial *serial) + { + dbg("%s", __func__); + +@@ -853,7 +853,7 @@ static struct usb_serial_driver keyspan_ + .tiocmget = keyspan_pda_tiocmget, + .tiocmset = keyspan_pda_tiocmset, + .attach = keyspan_pda_startup, +- .shutdown = keyspan_pda_shutdown, ++ .release = keyspan_pda_release, + }; + + +--- a/drivers/usb/serial/kl5kusb105.c ++++ b/drivers/usb/serial/kl5kusb105.c +@@ -73,7 +73,8 @@ static int debug; + * Function prototypes + */ + static int klsi_105_startup(struct usb_serial *serial); +-static void klsi_105_shutdown(struct usb_serial *serial); ++static void klsi_105_disconnect(struct usb_serial *serial); ++static void klsi_105_release(struct usb_serial *serial); + static int klsi_105_open(struct tty_struct *tty, + struct usb_serial_port *port, struct file *filp); + static void klsi_105_close(struct tty_struct *tty, +@@ -132,7 +133,8 @@ static struct usb_serial_driver kl5kusb1 + .tiocmget = klsi_105_tiocmget, + .tiocmset = klsi_105_tiocmset, + .attach = klsi_105_startup, +- .shutdown = klsi_105_shutdown, ++ .disconnect = klsi_105_disconnect, ++ .release = klsi_105_release, + .throttle = klsi_105_throttle, + .unthrottle = klsi_105_unthrottle, + }; +@@ -316,7 +318,7 @@ err_cleanup: + } /* klsi_105_startup */ + + +-static void klsi_105_shutdown(struct usb_serial *serial) ++static void klsi_105_disconnect(struct usb_serial *serial) + { + int i; + +@@ -326,33 +328,36 @@ static void klsi_105_shutdown(struct usb + for (i = 0; i < serial->num_ports; ++i) { + struct klsi_105_private *priv = + usb_get_serial_port_data(serial->port[i]); +- unsigned long flags; + + if (priv) { + /* kill our write urb pool */ + int j; + struct urb **write_urbs = priv->write_urb_pool; +- spin_lock_irqsave(&priv->lock, flags); + + for (j = 0; j < NUM_URBS; j++) { + if (write_urbs[j]) { +- /* FIXME - uncomment the following +- * usb_kill_urb call when the host +- * controllers get fixed to set +- * urb->dev = NULL after the urb is +- * finished. Otherwise this call +- * oopses. */ +- /* usb_kill_urb(write_urbs[j]); */ +- kfree(write_urbs[j]->transfer_buffer); ++ usb_kill_urb(write_urbs[j]); + usb_free_urb(write_urbs[j]); + } + } +- spin_unlock_irqrestore(&priv->lock, flags); +- kfree(priv); +- usb_set_serial_port_data(serial->port[i], NULL); + } + } +-} /* klsi_105_shutdown */ ++} /* klsi_105_disconnect */ ++ ++ ++static void klsi_105_release(struct usb_serial *serial) ++{ ++ int i; ++ ++ dbg("%s", __func__); ++ ++ for (i = 0; i < serial->num_ports; ++i) { ++ struct klsi_105_private *priv = ++ usb_get_serial_port_data(serial->port[i]); ++ ++ kfree(priv); ++ } ++} /* klsi_105_release */ + + static int klsi_105_open(struct tty_struct *tty, + struct usb_serial_port *port, struct file *filp) +--- a/drivers/usb/serial/kobil_sct.c ++++ b/drivers/usb/serial/kobil_sct.c +@@ -69,7 +69,7 @@ static int debug; + + /* Function prototypes */ + static int kobil_startup(struct usb_serial *serial); +-static void kobil_shutdown(struct usb_serial *serial); ++static void kobil_release(struct usb_serial *serial); + static int kobil_open(struct tty_struct *tty, + struct usb_serial_port *port, struct file *filp); + static void kobil_close(struct tty_struct *tty, struct usb_serial_port *port, +@@ -118,7 +118,7 @@ static struct usb_serial_driver kobil_de + .id_table = id_table, + .num_ports = 1, + .attach = kobil_startup, +- .shutdown = kobil_shutdown, ++ .release = kobil_release, + .ioctl = kobil_ioctl, + .set_termios = kobil_set_termios, + .tiocmget = kobil_tiocmget, +@@ -202,17 +202,13 @@ static int kobil_startup(struct usb_seri + } + + +-static void kobil_shutdown(struct usb_serial *serial) ++static void kobil_release(struct usb_serial *serial) + { + int i; + dbg("%s - port %d", __func__, serial->port[0]->number); + +- for (i = 0; i < serial->num_ports; ++i) { +- while (serial->port[i]->port.count > 0) +- kobil_close(NULL, serial->port[i], NULL); ++ for (i = 0; i < serial->num_ports; ++i) + kfree(usb_get_serial_port_data(serial->port[i])); +- usb_set_serial_port_data(serial->port[i], NULL); +- } + } + + +--- a/drivers/usb/serial/mct_u232.c ++++ b/drivers/usb/serial/mct_u232.c +@@ -92,7 +92,7 @@ static int debug; + * Function prototypes + */ + static int mct_u232_startup(struct usb_serial *serial); +-static void mct_u232_shutdown(struct usb_serial *serial); ++static void mct_u232_release(struct usb_serial *serial); + static int mct_u232_open(struct tty_struct *tty, + struct usb_serial_port *port, struct file *filp); + static void mct_u232_close(struct tty_struct *tty, +@@ -148,7 +148,7 @@ static struct usb_serial_driver mct_u232 + .tiocmget = mct_u232_tiocmget, + .tiocmset = mct_u232_tiocmset, + .attach = mct_u232_startup, +- .shutdown = mct_u232_shutdown, ++ .release = mct_u232_release, + }; + + +@@ -406,7 +406,7 @@ static int mct_u232_startup(struct usb_s + } /* mct_u232_startup */ + + +-static void mct_u232_shutdown(struct usb_serial *serial) ++static void mct_u232_release(struct usb_serial *serial) + { + struct mct_u232_private *priv; + int i; +@@ -416,12 +416,9 @@ static void mct_u232_shutdown(struct usb + for (i = 0; i < serial->num_ports; ++i) { + /* My special items, the standard routines free my urbs */ + priv = usb_get_serial_port_data(serial->port[i]); +- if (priv) { +- usb_set_serial_port_data(serial->port[i], NULL); +- kfree(priv); +- } ++ kfree(priv); + } +-} /* mct_u232_shutdown */ ++} /* mct_u232_release */ + + static int mct_u232_open(struct tty_struct *tty, + struct usb_serial_port *port, struct file *filp) +--- a/drivers/usb/serial/mos7720.c ++++ b/drivers/usb/serial/mos7720.c +@@ -1522,19 +1522,16 @@ static int mos7720_startup(struct usb_se + return 0; + } + +-static void mos7720_shutdown(struct usb_serial *serial) ++static void mos7720_release(struct usb_serial *serial) + { + int i; + + /* free private structure allocated for serial port */ +- for (i = 0; i < serial->num_ports; ++i) { ++ for (i = 0; i < serial->num_ports; ++i) + kfree(usb_get_serial_port_data(serial->port[i])); +- usb_set_serial_port_data(serial->port[i], NULL); +- } + + /* free private structure allocated for serial device */ + kfree(usb_get_serial_data(serial)); +- usb_set_serial_data(serial, NULL); + } + + static struct usb_driver usb_driver = { +@@ -1559,7 +1556,7 @@ static struct usb_serial_driver moschip7 + .throttle = mos7720_throttle, + .unthrottle = mos7720_unthrottle, + .attach = mos7720_startup, +- .shutdown = mos7720_shutdown, ++ .release = mos7720_release, + .ioctl = mos7720_ioctl, + .set_termios = mos7720_set_termios, + .write = mos7720_write, +--- a/drivers/usb/serial/mos7840.c ++++ b/drivers/usb/serial/mos7840.c +@@ -2673,16 +2673,16 @@ error: + } + + /**************************************************************************** +- * mos7840_shutdown ++ * mos7840_disconnect + * This function is called whenever the device is removed from the usb bus. + ****************************************************************************/ + +-static void mos7840_shutdown(struct usb_serial *serial) ++static void mos7840_disconnect(struct usb_serial *serial) + { + int i; + unsigned long flags; + struct moschip_port *mos7840_port; +- dbg("%s \n", " shutdown :entering.........."); ++ dbg("%s \n", " disconnect :entering.........."); + + if (!serial) { + dbg("%s", "Invalid Handler \n"); +@@ -2702,11 +2702,42 @@ static void mos7840_shutdown(struct usb_ + mos7840_port->zombie = 1; + spin_unlock_irqrestore(&mos7840_port->pool_lock, flags); + usb_kill_urb(mos7840_port->control_urb); ++ } ++ } ++ ++ dbg("%s", "Thank u :: "); ++ ++} ++ ++/**************************************************************************** ++ * mos7840_release ++ * This function is called when the usb_serial structure is freed. ++ ****************************************************************************/ ++ ++static void mos7840_release(struct usb_serial *serial) ++{ ++ int i; ++ struct moschip_port *mos7840_port; ++ dbg("%s", " release :entering.........."); ++ ++ if (!serial) { ++ dbg("%s", "Invalid Handler"); ++ return; ++ } ++ ++ /* check for the ports to be closed,close the ports and disconnect */ ++ ++ /* free private structure allocated for serial port * ++ * stop reads and writes on all ports */ ++ ++ for (i = 0; i < serial->num_ports; ++i) { ++ mos7840_port = mos7840_get_port_private(serial->port[i]); ++ dbg("mos7840_port %d = %p", i, mos7840_port); ++ if (mos7840_port) { + kfree(mos7840_port->ctrl_buf); + kfree(mos7840_port->dr); + kfree(mos7840_port); + } +- mos7840_set_port_private(serial->port[i], NULL); + } + + dbg("%s\n", "Thank u :: "); +@@ -2747,7 +2778,8 @@ static struct usb_serial_driver moschip7 + .tiocmget = mos7840_tiocmget, + .tiocmset = mos7840_tiocmset, + .attach = mos7840_startup, +- .shutdown = mos7840_shutdown, ++ .disconnect = mos7840_disconnect, ++ .release = mos7840_release, + .read_bulk_callback = mos7840_bulk_in_callback, + .read_int_callback = mos7840_interrupt_callback, + }; +--- a/drivers/usb/serial/omninet.c ++++ b/drivers/usb/serial/omninet.c +@@ -73,7 +73,8 @@ static void omninet_write_bulk_callback( + static int omninet_write(struct tty_struct *tty, struct usb_serial_port *port, + const unsigned char *buf, int count); + static int omninet_write_room(struct tty_struct *tty); +-static void omninet_shutdown(struct usb_serial *serial); ++static void omninet_disconnect(struct usb_serial *serial); ++static void omninet_release(struct usb_serial *serial); + static int omninet_attach(struct usb_serial *serial); + + static struct usb_device_id id_table[] = { +@@ -109,7 +110,8 @@ static struct usb_serial_driver zyxel_om + .write_room = omninet_write_room, + .read_bulk_callback = omninet_read_bulk_callback, + .write_bulk_callback = omninet_write_bulk_callback, +- .shutdown = omninet_shutdown, ++ .disconnect = omninet_disconnect, ++ .release = omninet_release, + }; + + +@@ -347,13 +349,22 @@ static void omninet_write_bulk_callback( + } + + +-static void omninet_shutdown(struct usb_serial *serial) ++static void omninet_disconnect(struct usb_serial *serial) + { + struct usb_serial_port *wport = serial->port[1]; +- struct usb_serial_port *port = serial->port[0]; ++ + dbg("%s", __func__); + + usb_kill_urb(wport->write_urb); ++} ++ ++ ++static void omninet_release(struct usb_serial *serial) ++{ ++ struct usb_serial_port *port = serial->port[0]; ++ ++ dbg("%s", __func__); ++ + kfree(usb_get_serial_port_data(port)); + } + +--- a/drivers/usb/serial/opticon.c ++++ b/drivers/usb/serial/opticon.c +@@ -464,7 +464,7 @@ error: + return retval; + } + +-static void opticon_shutdown(struct usb_serial *serial) ++static void opticon_disconnect(struct usb_serial *serial) + { + struct opticon_private *priv = usb_get_serial_data(serial); + +@@ -472,9 +472,16 @@ static void opticon_shutdown(struct usb_ + + usb_kill_urb(priv->bulk_read_urb); + usb_free_urb(priv->bulk_read_urb); ++} ++ ++static void opticon_release(struct usb_serial *serial) ++{ ++ struct opticon_private *priv = usb_get_serial_data(serial); ++ ++ dbg("%s", __func__); ++ + kfree(priv->bulk_in_buffer); + kfree(priv); +- usb_set_serial_data(serial, NULL); + } + + static int opticon_suspend(struct usb_interface *intf, pm_message_t message) +@@ -525,7 +532,8 @@ static struct usb_serial_driver opticon_ + .close = opticon_close, + .write = opticon_write, + .write_room = opticon_write_room, +- .shutdown = opticon_shutdown, ++ .disconnect = opticon_disconnect, ++ .release = opticon_release, + .throttle = opticon_throttle, + .unthrottle = opticon_unthrottle, + .ioctl = opticon_ioctl, +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -48,7 +48,8 @@ static int option_open(struct tty_struc + static void option_close(struct tty_struct *tty, struct usb_serial_port *port, + struct file *filp); + static int option_startup(struct usb_serial *serial); +-static void option_shutdown(struct usb_serial *serial); ++static void option_disconnect(struct usb_serial *serial); ++static void option_release(struct usb_serial *serial); + static int option_write_room(struct tty_struct *tty); + + static void option_instat_callback(struct urb *urb); +@@ -558,7 +559,8 @@ static struct usb_serial_driver option_1 + .tiocmget = option_tiocmget, + .tiocmset = option_tiocmset, + .attach = option_startup, +- .shutdown = option_shutdown, ++ .disconnect = option_disconnect, ++ .release = option_release, + .read_int_callback = option_instat_callback, + .suspend = option_suspend, + .resume = option_resume, +@@ -1129,7 +1131,14 @@ static void stop_read_write_urbs(struct + } + } + +-static void option_shutdown(struct usb_serial *serial) ++static void option_disconnect(struct usb_serial *serial) ++{ ++ dbg("%s", __func__); ++ ++ stop_read_write_urbs(serial); ++} ++ ++static void option_release(struct usb_serial *serial) + { + int i, j; + struct usb_serial_port *port; +@@ -1137,8 +1146,6 @@ static void option_shutdown(struct usb_s + + dbg("%s", __func__); + +- stop_read_write_urbs(serial); +- + /* Now free them */ + for (i = 0; i < serial->num_ports; ++i) { + port = serial->port[i]; +--- a/drivers/usb/serial/oti6858.c ++++ b/drivers/usb/serial/oti6858.c +@@ -160,7 +160,7 @@ static int oti6858_tiocmget(struct tty_s + static int oti6858_tiocmset(struct tty_struct *tty, struct file *file, + unsigned int set, unsigned int clear); + static int oti6858_startup(struct usb_serial *serial); +-static void oti6858_shutdown(struct usb_serial *serial); ++static void oti6858_release(struct usb_serial *serial); + + /* functions operating on buffers */ + static struct oti6858_buf *oti6858_buf_alloc(unsigned int size); +@@ -195,7 +195,7 @@ static struct usb_serial_driver oti6858_ + .write_room = oti6858_write_room, + .chars_in_buffer = oti6858_chars_in_buffer, + .attach = oti6858_startup, +- .shutdown = oti6858_shutdown, ++ .release = oti6858_release, + }; + + struct oti6858_private { +@@ -829,7 +829,7 @@ static int oti6858_ioctl(struct tty_stru + } + + +-static void oti6858_shutdown(struct usb_serial *serial) ++static void oti6858_release(struct usb_serial *serial) + { + struct oti6858_private *priv; + int i; +@@ -841,7 +841,6 @@ static void oti6858_shutdown(struct usb_ + if (priv) { + oti6858_buf_free(priv->buf); + kfree(priv); +- usb_set_serial_port_data(serial->port[i], NULL); + } + } + } +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -897,7 +897,7 @@ static void pl2303_break_ctl(struct tty_ + dbg("%s - error sending break = %d", __func__, result); + } + +-static void pl2303_shutdown(struct usb_serial *serial) ++static void pl2303_release(struct usb_serial *serial) + { + int i; + struct pl2303_private *priv; +@@ -909,7 +909,6 @@ static void pl2303_shutdown(struct usb_s + if (priv) { + pl2303_buf_free(priv->buf); + kfree(priv); +- usb_set_serial_port_data(serial->port[i], NULL); + } + } + } +@@ -1137,7 +1136,7 @@ static struct usb_serial_driver pl2303_d + .write_room = pl2303_write_room, + .chars_in_buffer = pl2303_chars_in_buffer, + .attach = pl2303_startup, +- .shutdown = pl2303_shutdown, ++ .release = pl2303_release, + }; + + static int __init pl2303_init(void) +--- a/drivers/usb/serial/sierra.c ++++ b/drivers/usb/serial/sierra.c +@@ -699,7 +699,7 @@ static int sierra_startup(struct usb_ser + return 0; + } + +-static void sierra_shutdown(struct usb_serial *serial) ++static void sierra_disconnect(struct usb_serial *serial) + { + int i, j; + struct usb_serial_port *port; +@@ -718,10 +718,29 @@ static void sierra_shutdown(struct usb_s + for (j = 0; j < N_IN_URB; j++) { + usb_kill_urb(portdata->in_urbs[j]); + usb_free_urb(portdata->in_urbs[j]); +- kfree(portdata->in_buffer[j]); + } ++ } ++} ++ ++static void sierra_release(struct usb_serial *serial) ++{ ++ int i, j; ++ struct usb_serial_port *port; ++ struct sierra_port_private *portdata; ++ ++ dev_dbg(&serial->dev->dev, "%s\n", __func__); ++ ++ for (i = 0; i < serial->num_ports; ++i) { ++ port = serial->port[i]; ++ if (!port) ++ continue; ++ portdata = usb_get_serial_port_data(port); ++ if (!portdata) ++ continue; ++ ++ for (j = 0; j < N_IN_URB; j++) ++ kfree(portdata->in_buffer[j]); + kfree(portdata); +- usb_set_serial_port_data(port, NULL); + } + } + +@@ -743,7 +762,8 @@ static struct usb_serial_driver sierra_d + .tiocmget = sierra_tiocmget, + .tiocmset = sierra_tiocmset, + .attach = sierra_startup, +- .shutdown = sierra_shutdown, ++ .disconnect = sierra_disconnect, ++ .release = sierra_release, + .read_int_callback = sierra_instat_callback, + }; + +--- a/drivers/usb/serial/spcp8x5.c ++++ b/drivers/usb/serial/spcp8x5.c +@@ -356,7 +356,7 @@ cleanup: + } + + /* call when the device plug out. free all the memory alloced by probe */ +-static void spcp8x5_shutdown(struct usb_serial *serial) ++static void spcp8x5_release(struct usb_serial *serial) + { + int i; + struct spcp8x5_private *priv; +@@ -366,7 +366,6 @@ static void spcp8x5_shutdown(struct usb_ + if (priv) { + free_ringbuf(priv->buf); + kfree(priv); +- usb_set_serial_port_data(serial->port[i] , NULL); + } + } + } +@@ -1043,7 +1042,7 @@ static struct usb_serial_driver spcp8x5_ + .write_bulk_callback = spcp8x5_write_bulk_callback, + .chars_in_buffer = spcp8x5_chars_in_buffer, + .attach = spcp8x5_startup, +- .shutdown = spcp8x5_shutdown, ++ .release = spcp8x5_release, + }; + + static int __init spcp8x5_init(void) +--- a/drivers/usb/serial/symbolserial.c ++++ b/drivers/usb/serial/symbolserial.c +@@ -268,7 +268,7 @@ error: + return retval; + } + +-static void symbol_shutdown(struct usb_serial *serial) ++static void symbol_disconnect(struct usb_serial *serial) + { + struct symbol_private *priv = usb_get_serial_data(serial); + +@@ -276,9 +276,16 @@ static void symbol_shutdown(struct usb_s + + usb_kill_urb(priv->int_urb); + usb_free_urb(priv->int_urb); ++} ++ ++static void symbol_release(struct usb_serial *serial) ++{ ++ struct symbol_private *priv = usb_get_serial_data(serial); ++ ++ dbg("%s", __func__); ++ + kfree(priv->int_buffer); + kfree(priv); +- usb_set_serial_data(serial, NULL); + } + + static struct usb_driver symbol_driver = { +@@ -300,7 +307,8 @@ static struct usb_serial_driver symbol_d + .attach = symbol_startup, + .open = symbol_open, + .close = symbol_close, +- .shutdown = symbol_shutdown, ++ .disconnect = symbol_disconnect, ++ .release = symbol_release, + .throttle = symbol_throttle, + .unthrottle = symbol_unthrottle, + }; +--- a/drivers/usb/serial/ti_usb_3410_5052.c ++++ b/drivers/usb/serial/ti_usb_3410_5052.c +@@ -97,7 +97,7 @@ struct ti_device { + /* Function Declarations */ + + static int ti_startup(struct usb_serial *serial); +-static void ti_shutdown(struct usb_serial *serial); ++static void ti_release(struct usb_serial *serial); + static int ti_open(struct tty_struct *tty, struct usb_serial_port *port, + struct file *file); + static void ti_close(struct tty_struct *tty, struct usb_serial_port *port, +@@ -231,7 +231,7 @@ static struct usb_serial_driver ti_1port + .id_table = ti_id_table_3410, + .num_ports = 1, + .attach = ti_startup, +- .shutdown = ti_shutdown, ++ .release = ti_release, + .open = ti_open, + .close = ti_close, + .write = ti_write, +@@ -259,7 +259,7 @@ static struct usb_serial_driver ti_2port + .id_table = ti_id_table_5052, + .num_ports = 2, + .attach = ti_startup, +- .shutdown = ti_shutdown, ++ .release = ti_release, + .open = ti_open, + .close = ti_close, + .write = ti_write, +@@ -474,7 +474,7 @@ free_tdev: + } + + +-static void ti_shutdown(struct usb_serial *serial) ++static void ti_release(struct usb_serial *serial) + { + int i; + struct ti_device *tdev = usb_get_serial_data(serial); +@@ -487,12 +487,10 @@ static void ti_shutdown(struct usb_seria + if (tport) { + ti_buf_free(tport->tp_write_buf); + kfree(tport); +- usb_set_serial_port_data(serial->port[i], NULL); + } + } + + kfree(tdev); +- usb_set_serial_data(serial, NULL); + } + + +--- a/drivers/usb/serial/usb-serial.c ++++ b/drivers/usb/serial/usb-serial.c +@@ -141,6 +141,14 @@ static void destroy_serial(struct kref * + if (serial->minor != SERIAL_TTY_NO_MINOR) + return_serial(serial); + ++ serial->type->release(serial); ++ ++ for (i = 0; i < serial->num_ports; ++i) { ++ port = serial->port[i]; ++ if (port) ++ put_device(&port->dev); ++ } ++ + /* If this is a "fake" port, we have to clean it up here, as it will + * not get cleaned up in port_release() as it was never registered with + * the driver core */ +@@ -148,9 +156,8 @@ static void destroy_serial(struct kref * + for (i = serial->num_ports; + i < serial->num_port_pointers; ++i) { + port = serial->port[i]; +- if (!port) +- continue; +- port_free(port); ++ if (port) ++ port_free(port); + } + } + +@@ -1062,10 +1069,6 @@ void usb_serial_disconnect(struct usb_in + serial->disconnected = 1; + mutex_unlock(&serial->disc_mutex); + +- /* Unfortunately, many of the sub-drivers expect the port structures +- * to exist when their shutdown method is called, so we have to go +- * through this awkward two-step unregistration procedure. +- */ + for (i = 0; i < serial->num_ports; ++i) { + port = serial->port[i]; + if (port) { +@@ -1079,14 +1082,7 @@ void usb_serial_disconnect(struct usb_in + device_del(&port->dev); + } + } +- serial->type->shutdown(serial); +- for (i = 0; i < serial->num_ports; ++i) { +- port = serial->port[i]; +- if (port) { +- put_device(&port->dev); +- serial->port[i] = NULL; +- } +- } ++ serial->type->disconnect(serial); + + /* let the last holder of this object + * cause it to be cleaned up */ +@@ -1262,7 +1258,8 @@ static void fixup_generic(struct usb_ser + set_to_generic_if_null(device, chars_in_buffer); + set_to_generic_if_null(device, read_bulk_callback); + set_to_generic_if_null(device, write_bulk_callback); +- set_to_generic_if_null(device, shutdown); ++ set_to_generic_if_null(device, disconnect); ++ set_to_generic_if_null(device, release); + } + + int usb_serial_register(struct usb_serial_driver *driver) +--- a/drivers/usb/serial/visor.c ++++ b/drivers/usb/serial/visor.c +@@ -48,7 +48,7 @@ static void visor_unthrottle(struct tty_ + static int visor_probe(struct usb_serial *serial, + const struct usb_device_id *id); + static int visor_calc_num_ports(struct usb_serial *serial); +-static void visor_shutdown(struct usb_serial *serial); ++static void visor_release(struct usb_serial *serial); + static void visor_write_bulk_callback(struct urb *urb); + static void visor_read_bulk_callback(struct urb *urb); + static void visor_read_int_callback(struct urb *urb); +@@ -203,7 +203,7 @@ static struct usb_serial_driver handspri + .attach = treo_attach, + .probe = visor_probe, + .calc_num_ports = visor_calc_num_ports, +- .shutdown = visor_shutdown, ++ .release = visor_release, + .write = visor_write, + .write_room = visor_write_room, + .write_bulk_callback = visor_write_bulk_callback, +@@ -228,7 +228,7 @@ static struct usb_serial_driver clie_5_d + .attach = clie_5_attach, + .probe = visor_probe, + .calc_num_ports = visor_calc_num_ports, +- .shutdown = visor_shutdown, ++ .release = visor_release, + .write = visor_write, + .write_room = visor_write_room, + .write_bulk_callback = visor_write_bulk_callback, +@@ -920,7 +920,7 @@ static int clie_5_attach(struct usb_seri + return generic_startup(serial); + } + +-static void visor_shutdown(struct usb_serial *serial) ++static void visor_release(struct usb_serial *serial) + { + struct visor_private *priv; + int i; +@@ -929,10 +929,7 @@ static void visor_shutdown(struct usb_se + + for (i = 0; i < serial->num_ports; i++) { + priv = usb_get_serial_port_data(serial->port[i]); +- if (priv) { +- usb_set_serial_port_data(serial->port[i], NULL); +- kfree(priv); +- } ++ kfree(priv); + } + } + +--- a/drivers/usb/serial/whiteheat.c ++++ b/drivers/usb/serial/whiteheat.c +@@ -144,7 +144,7 @@ static int whiteheat_firmware_attach(st + + /* function prototypes for the Connect Tech WhiteHEAT serial converter */ + static int whiteheat_attach(struct usb_serial *serial); +-static void whiteheat_shutdown(struct usb_serial *serial); ++static void whiteheat_release(struct usb_serial *serial); + static int whiteheat_open(struct tty_struct *tty, + struct usb_serial_port *port, struct file *filp); + static void whiteheat_close(struct tty_struct *tty, +@@ -190,7 +190,7 @@ static struct usb_serial_driver whitehea + .id_table = id_table_std, + .num_ports = 4, + .attach = whiteheat_attach, +- .shutdown = whiteheat_shutdown, ++ .release = whiteheat_release, + .open = whiteheat_open, + .close = whiteheat_close, + .write = whiteheat_write, +@@ -618,7 +618,7 @@ no_command_buffer: + } + + +-static void whiteheat_shutdown(struct usb_serial *serial) ++static void whiteheat_release(struct usb_serial *serial) + { + struct usb_serial_port *command_port; + struct usb_serial_port *port; +--- a/include/linux/usb/serial.h ++++ b/include/linux/usb/serial.h +@@ -181,8 +181,10 @@ static inline void usb_set_serial_data(s + * This will be called when the struct usb_serial structure is fully set + * set up. Do any local initialization of the device, or any private + * memory structure allocation at this point in time. +- * @shutdown: pointer to the driver's shutdown function. This will be +- * called when the device is removed from the system. ++ * @disconnect: pointer to the driver's disconnect function. This will be ++ * called when the device is unplugged or unbound from the driver. ++ * @release: pointer to the driver's release function. This will be called ++ * when the usb_serial data structure is about to be destroyed. + * @usb_driver: pointer to the struct usb_driver that controls this + * device. This is necessary to allow dynamic ids to be added to + * the driver from sysfs. +@@ -212,7 +214,8 @@ struct usb_serial_driver { + int (*attach)(struct usb_serial *serial); + int (*calc_num_ports) (struct usb_serial *serial); + +- void (*shutdown)(struct usb_serial *serial); ++ void (*disconnect)(struct usb_serial *serial); ++ void (*release)(struct usb_serial *serial); + + int (*port_probe)(struct usb_serial_port *port); + int (*port_remove)(struct usb_serial_port *port); +@@ -292,7 +295,8 @@ extern void usb_serial_generic_read_bulk + extern void usb_serial_generic_write_bulk_callback(struct urb *urb); + extern void usb_serial_generic_throttle(struct tty_struct *tty); + extern void usb_serial_generic_unthrottle(struct tty_struct *tty); +-extern void usb_serial_generic_shutdown(struct usb_serial *serial); ++extern void usb_serial_generic_disconnect(struct usb_serial *serial); ++extern void usb_serial_generic_release(struct usb_serial *serial); + extern int usb_serial_generic_register(int debug); + extern void usb_serial_generic_deregister(void); + + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:39 2009 +Message-Id: <20090701002439.222808279@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:12 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jiri Slaby , + Alan Cox +Subject: [patch 083/108] pcmcia/cm4000: fix lock imbalance +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=pcmcia-cm4000-fix-lock-imbalance.patch +Content-Length: 777 +Lines: 28 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jiri Slaby + +commit 69ae59d7d8df14413cf0a97b3e372d7dc8352563 upstream. + +Don't return from switch/case, break instead, so that we unlock BKL. + +Signed-off-by: Jiri Slaby +Signed-off-by: Alan Cox +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/pcmcia/cm4000_cs.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/char/pcmcia/cm4000_cs.c ++++ b/drivers/char/pcmcia/cm4000_cs.c +@@ -1575,7 +1575,8 @@ static long cmm_ioctl(struct file *filp, + clear_bit(LOCK_IO, &dev->flags); + wake_up_interruptible(&dev->ioq); + +- return 0; ++ rc = 0; ++ break; + case CM_IOCSPTS: + { + struct ptsreq krnptsreq; + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:39 2009 +Message-Id: <20090701002439.494893968@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:13 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jiri Slaby , + Alan Cox +Subject: [patch 084/108] n_r3964: fix lock imbalance +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=n_r3964-fix-lock-imbalance.patch +Content-Length: 2097 +Lines: 81 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jiri Slaby + +commit eca41044268887838fa122aa24475df8f23d614c upstream. + +There is omitted BKunL in r3964_read. + +Centralize the paths to one point with one unlock. + +Signed-off-by: Jiri Slaby +Signed-off-by: Alan Cox +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/n_r3964.c | 26 ++++++++++++++------------ + 1 file changed, 14 insertions(+), 12 deletions(-) + +--- a/drivers/char/n_r3964.c ++++ b/drivers/char/n_r3964.c +@@ -1062,7 +1062,7 @@ static ssize_t r3964_read(struct tty_str + struct r3964_client_info *pClient; + struct r3964_message *pMsg; + struct r3964_client_message theMsg; +- int count; ++ int ret; + + TRACE_L("read()"); + +@@ -1074,8 +1074,8 @@ static ssize_t r3964_read(struct tty_str + if (pMsg == NULL) { + /* no messages available. */ + if (file->f_flags & O_NONBLOCK) { +- unlock_kernel(); +- return -EAGAIN; ++ ret = -EAGAIN; ++ goto unlock; + } + /* block until there is a message: */ + wait_event_interruptible(pInfo->read_wait, +@@ -1085,29 +1085,31 @@ static ssize_t r3964_read(struct tty_str + /* If we still haven't got a message, we must have been signalled */ + + if (!pMsg) { +- unlock_kernel(); +- return -EINTR; ++ ret = -EINTR; ++ goto unlock; + } + + /* deliver msg to client process: */ + theMsg.msg_id = pMsg->msg_id; + theMsg.arg = pMsg->arg; + theMsg.error_code = pMsg->error_code; +- count = sizeof(struct r3964_client_message); ++ ret = sizeof(struct r3964_client_message); + + kfree(pMsg); + TRACE_M("r3964_read - msg kfree %p", pMsg); + +- if (copy_to_user(buf, &theMsg, count)) { +- unlock_kernel(); +- return -EFAULT; ++ if (copy_to_user(buf, &theMsg, ret)) { ++ ret = -EFAULT; ++ goto unlock; + } + +- TRACE_PS("read - return %d", count); +- return count; ++ TRACE_PS("read - return %d", ret); ++ goto unlock; + } ++ ret = -EPERM; ++unlock: + unlock_kernel(); +- return -EPERM; ++ return ret; + } + + static ssize_t r3964_write(struct tty_struct *tty, struct file *file, + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:39 2009 +Message-Id: <20090701002439.690770689@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:14 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + FUJITA Tomonori , + Alan Cox , + Jeff Garzik +Subject: [patch 085/108] parport_pc: set properly the dma_mask for parport_pc device +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=parport_pc-set-properly-the-dma_mask-for-parport_pc-device.patch +Content-Length: 1666 +Lines: 44 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: FUJITA Tomonori + +commit dfa7c4d869b7d3d37b70f1de856f2901b6ebfcf0 upstream. + +parport_pc_probe_port() creates the own 'parport_pc' device if the +device argument is NULL. Then parport_pc_probe_port() doesn't +initialize the dma_mask and coherent_dma_mask of the device and calls +dma_alloc_coherent with it. dma_alloc_coherent fails because +dma_alloc_coherent() doesn't accept the uninitialized dma_mask: + +http://lkml.org/lkml/2009/6/16/150 + +Long ago, X86_32 and X86_64 had the own dma_alloc_coherent +implementations; X86_32 accepted a device having dma_mask that is not +initialized however X86_64 didn't. When we merged them, we chose to +prohibit a device having dma_mask that is not initialized. I think +that it's good to require drivers to set up dma_mask (and +coherent_dma_mask) properly if the drivers want DMA. + +Signed-off-by: FUJITA Tomonori +Reported-by: Malcom Blaney +Tested-by: Malcom Blaney +Signed-off-by: Alan Cox +Acked-by: Jeff Garzik +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/parport/parport_pc.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/parport/parport_pc.c ++++ b/drivers/parport/parport_pc.c +@@ -2193,6 +2193,9 @@ struct parport *parport_pc_probe_port(un + if (IS_ERR(pdev)) + return NULL; + dev = &pdev->dev; ++ ++ dev->coherent_dma_mask = DMA_BIT_MASK(24); ++ dev->dma_mask = &dev->coherent_dma_mask; + } + + ops = kmalloc(sizeof(struct parport_operations), GFP_KERNEL); + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:40 2009 +Message-Id: <20090701002439.893135640@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:15 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jens Rottmann , + Alan Cox , + Jeff Garzik +Subject: [patch 086/108] parport_pc: after superio probing restore original register values +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=parport_pc-after-superio-probing-restore-original-register-values.patch +Content-Length: 4217 +Lines: 130 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jens Rottmann + +commit e2434dc1c19412639dd047a4d4eff8ed0e5d0d50 upstream. + +CONFIG_PARPORT_PC_SUPERIO probes for various superio chips by writing +byte sequences to a set of different potential I/O ranges. But the +probed ranges are not exclusive to parallel ports. Some of our boards +just happen to have a watchdog in one of them. Took us almost a week +to figure out why some distros reboot without warning after running +flawlessly for 3 hours. For exactly 170 = 0xAA minutes, that is ... + +Fixed by restoring original values after probing. Also fixed too small +request_region() in detect_and_report_it87(). + +Signed-off-by: Jens Rottmann +Signed-off-by: Alan Cox +Acked-by: Jeff Garzik +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/parport/parport_pc.c | 31 +++++++++++++++++++++++++------ + 1 file changed, 25 insertions(+), 6 deletions(-) + +--- a/drivers/parport/parport_pc.c ++++ b/drivers/parport/parport_pc.c +@@ -1413,11 +1413,13 @@ static void __devinit decode_smsc(int ef + + static void __devinit winbond_check(int io, int key) + { +- int devid,devrev,oldid,x_devid,x_devrev,x_oldid; ++ int origval, devid, devrev, oldid, x_devid, x_devrev, x_oldid; + + if (!request_region(io, 3, __func__)) + return; + ++ origval = inb(io); /* Save original value */ ++ + /* First probe without key */ + outb(0x20,io); + x_devid=inb(io+1); +@@ -1437,6 +1439,8 @@ static void __devinit winbond_check(int + oldid=inb(io+1); + outb(0xaa,io); /* Magic Seal */ + ++ outb(origval, io); /* in case we poked some entirely different hardware */ ++ + if ((x_devid == devid) && (x_devrev == devrev) && (x_oldid == oldid)) + goto out; /* protection against false positives */ + +@@ -1447,11 +1451,15 @@ out: + + static void __devinit winbond_check2(int io,int key) + { +- int devid,devrev,oldid,x_devid,x_devrev,x_oldid; ++ int origval[3], devid, devrev, oldid, x_devid, x_devrev, x_oldid; + + if (!request_region(io, 3, __func__)) + return; + ++ origval[0] = inb(io); /* Save original values */ ++ origval[1] = inb(io + 1); ++ origval[2] = inb(io + 2); ++ + /* First probe without the key */ + outb(0x20,io+2); + x_devid=inb(io+2); +@@ -1470,6 +1478,10 @@ static void __devinit winbond_check2(int + oldid=inb(io+2); + outb(0xaa,io); /* Magic Seal */ + ++ outb(origval[0], io); /* in case we poked some entirely different hardware */ ++ outb(origval[1], io + 1); ++ outb(origval[2], io + 2); ++ + if ((x_devid == devid) && (x_devrev == devrev) && (x_oldid == oldid)) + goto out; /* protection against false positives */ + +@@ -1480,11 +1492,13 @@ out: + + static void __devinit smsc_check(int io, int key) + { +- int id,rev,oldid,oldrev,x_id,x_rev,x_oldid,x_oldrev; ++ int origval, id, rev, oldid, oldrev, x_id, x_rev, x_oldid, x_oldrev; + + if (!request_region(io, 3, __func__)) + return; + ++ origval = inb(io); /* Save original value */ ++ + /* First probe without the key */ + outb(0x0d,io); + x_oldid=inb(io+1); +@@ -1508,6 +1522,8 @@ static void __devinit smsc_check(int io, + rev=inb(io+1); + outb(0xaa,io); /* Magic Seal */ + ++ outb(origval, io); /* in case we poked some entirely different hardware */ ++ + if ((x_id == id) && (x_oldrev == oldrev) && + (x_oldid == oldid) && (x_rev == rev)) + goto out; /* protection against false positives */ +@@ -1544,11 +1560,12 @@ static void __devinit detect_and_report_ + static void __devinit detect_and_report_it87(void) + { + u16 dev; +- u8 r; ++ u8 origval, r; + if (verbose_probing) + printk(KERN_DEBUG "IT8705 Super-IO detection, now testing port 2E ...\n"); +- if (!request_region(0x2e, 1, __func__)) ++ if (!request_region(0x2e, 2, __func__)) + return; ++ origval = inb(0x2e); /* Save original value */ + outb(0x87, 0x2e); + outb(0x01, 0x2e); + outb(0x55, 0x2e); +@@ -1568,8 +1585,10 @@ static void __devinit detect_and_report_ + outb(r | 8, 0x2F); + outb(0x02, 0x2E); /* Lock */ + outb(0x02, 0x2F); ++ } else { ++ outb(origval, 0x2e); /* Oops, sorry to disturb */ + } +- release_region(0x2e, 1); ++ release_region(0x2e, 2); + } + #endif /* CONFIG_PARPORT_PC_SUPERIO */ + + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:40 2009 +Message-Id: <20090701002440.077312404@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:16 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Prabhanjan Sarnaik , + Lennert Buytenhek , + "David S. Miller" +Subject: [patch 087/108] mv643xx_eth: fix unicast filter programming in promiscuous mode +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=mv643xx_eth-fix-unicast-filter-programming-in-promiscuous-mode.patch +Content-Length: 1898 +Lines: 56 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Prabhanjan Sarnaik + +commit 6877f54e6a3326c99aaf84b7bff6a3019da0b847 upstream. + +The Unicast Promiscious Mode (UPM) bit in the mv643xx_eth port +configuration register doesn't do exactly what its name would suggest: +setting this bit merely enables reception of all unicast frames with a +destination address that differs from our local MAC address in bits +[47:4]. In particular, it doesn't have any effect on unicast frames +with a destination address that matches our MAC address in bits [47:4] +-- these will still be tested against the 16-entry unicast address +filter table. + +Therefore, if the interface is set to promiscuous mode, just setting +the unicast promiscuous bit isn't enough -- we need to set all filter +bits in the unicast filter table to 1 as well. + +Reported-by: Sachin Sanap +Signed-off-by: Prabhanjan Sarnaik +Tested-by: Siddarth Gore +Tested-by: Mahavir Jain +Signed-off-by: Lennert Buytenhek +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/mv643xx_eth.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/net/mv643xx_eth.c ++++ b/drivers/net/mv643xx_eth.c +@@ -1751,12 +1751,12 @@ static void mv643xx_eth_program_unicast_ + + uc_addr_set(mp, dev->dev_addr); + +- port_config = rdlp(mp, PORT_CONFIG); ++ port_config = rdlp(mp, PORT_CONFIG) & ~UNICAST_PROMISCUOUS_MODE; ++ + nibbles = uc_addr_filter_mask(dev); + if (!nibbles) { + port_config |= UNICAST_PROMISCUOUS_MODE; +- wrlp(mp, PORT_CONFIG, port_config); +- return; ++ nibbles = 0xffff; + } + + for (i = 0; i < 16; i += 4) { +@@ -1777,7 +1777,6 @@ static void mv643xx_eth_program_unicast_ + wrl(mp, off, v); + } + +- port_config &= ~UNICAST_PROMISCUOUS_MODE; + wrlp(mp, PORT_CONFIG, port_config); + } + + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:40 2009 +Message-Id: <20090701002440.327606088@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:17 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "John W. Linville" +Subject: [patch 088/108] ath5k: avoid PCI FATAL interrupts by restoring RETRY_TIMEOUT disabling +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=ath5k-avoid-pci-fatal-interrupts-by-restoring-retry_timeout-disabling.patch +Content-Length: 1037 +Lines: 33 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jouni Malinen + +commit 8451d22dad40a66416b8d9c0952efa09ec5398c5 upstream. + +This reverts 'ath5k: remove dummy PCI "retry timeout" fix' on the +same theory as in 'ath9k: Fix PCI FATAL interrupts by restoring +RETRY_TIMEOUT disabling'. + +Reported-by: Bob Copeland +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath5k/base.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/net/wireless/ath5k/base.c ++++ b/drivers/net/wireless/ath5k/base.c +@@ -685,6 +685,13 @@ ath5k_pci_resume(struct pci_dev *pdev) + if (err) + return err; + ++ /* ++ * Suspend/Resume resets the PCI configuration space, so we have to ++ * re-disable the RETRY_TIMEOUT register (0x41) to keep ++ * PCI Tx retries from interfering with C3 CPU state ++ */ ++ pci_write_config_byte(pdev, 0x41, 0); ++ + err = request_irq(pdev->irq, ath5k_intr, IRQF_SHARED, "ath", sc); + if (err) { + ATH5K_ERR(sc, "request_irq failed\n"); + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:40 2009 +Message-Id: <20090701002440.509344548@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:18 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Clemens Ladisch , + Takashi Iwai +Subject: [patch 089/108] sound: seq_midi_event: fix decoding of (N)RPN events +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=sound-seq_midi_event-fix-decoding-of-rpn-events.patch +Content-Length: 1289 +Lines: 34 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Clemens Ladisch + +commit 6423f9ea8035138d70bae1a278d3b57b743f8b3e upstream. + +When decoding (N)RPN sequencer events into raw MIDI commands, the +extra_decode_xrpn() function had accidentally swapped the MSB and LSB +controller values of both the parameter number and the data value. + +Signed-off-by: Clemens Ladisch +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/seq/seq_midi_event.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/sound/core/seq/seq_midi_event.c ++++ b/sound/core/seq/seq_midi_event.c +@@ -504,10 +504,10 @@ static int extra_decode_xrpn(struct snd_ + if (dev->nostat && count < 12) + return -ENOMEM; + cmd = MIDI_CMD_CONTROL|(ev->data.control.channel & 0x0f); +- bytes[0] = ev->data.control.param & 0x007f; +- bytes[1] = (ev->data.control.param & 0x3f80) >> 7; +- bytes[2] = ev->data.control.value & 0x007f; +- bytes[3] = (ev->data.control.value & 0x3f80) >> 7; ++ bytes[0] = (ev->data.control.param & 0x3f80) >> 7; ++ bytes[1] = ev->data.control.param & 0x007f; ++ bytes[2] = (ev->data.control.value & 0x3f80) >> 7; ++ bytes[3] = ev->data.control.value & 0x007f; + if (cmd != dev->lastcmd && !dev->nostat) { + if (count < 9) + return -ENOMEM; + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:40 2009 +Message-Id: <20090701002440.703390309@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:19 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Rafael J. Wysocki" , + Jesse Barnes +Subject: [patch 090/108] PCI PM: Fix handling of devices without PM support by pci_target_state() +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=pci-pm-fix-handling-of-devices-without-pm-support-by-pci_target_state.patch +Content-Length: 1472 +Lines: 44 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Rafael J. Wysocki + +commit d2abdf62882d982c58e7a6b09ecdcfcc28075e2e upstream. + +If a PCI device is not power-manageable either by the platform, or +with the help of the native PCI PM interface, pci_target_state() will +return either PCI_D3hot, or PCI_POWER_ERROR for it, depending on +whether or not the device is configured to wake up the system. Alas, +none of these return values is correct, because each of them causes +pci_prepare_to_sleep() to return error code, although it should +complete successfully in such a case. + +Fix this problem by making pci_target_state() always return PCI_D0 +for devices that cannot be power managed. + +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/pci.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -1282,15 +1282,14 @@ pci_power_t pci_target_state(struct pci_ + default: + target_state = state; + } ++ } else if (!dev->pm_cap) { ++ target_state = PCI_D0; + } else if (device_may_wakeup(&dev->dev)) { + /* + * Find the deepest state from which the device can generate + * wake-up events, make it the target state and enable device + * to generate PME#. + */ +- if (!dev->pm_cap) +- return PCI_POWER_ERROR; +- + if (dev->pme_support) { + while (target_state + && !(dev->pme_support & (1 << target_state))) + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:41 2009 +Message-Id: <20090701002440.895036580@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:20 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Rafael J. Wysocki" , + Jesse Barnes +Subject: [patch 091/108] PCI PM: Follow PCI_PM_CTRL_NO_SOFT_RESET during transitions from D3 +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=pci-pm-follow-pci_pm_ctrl_no_soft_reset-during-transitions-from-d3.patch +Content-Length: 1442 +Lines: 38 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Rafael J. Wysocki + +commit f62795f1e892ca9269849fa83de97621da7e02c0 upstream. + +According to the PCI PM specification (PCI Bus Power Management +Interface Specification, Rev. 1.2, Section 5.4.1) we are supposed to +reinitialize devices that have PCI_PM_CTRL_NO_SOFT_RESET clear during +all transitions from PCI_D3hot to PCI_D0, but we only do it if the +device's current_state field is equal to PCI_UNKNOWN. + +This may lead to problems if a device with PCI_PM_CTRL_NO_SOFT_RESET +unset is put into PCI_D3hot at run time by its driver and +pci_set_power_state() is used to put it back into PCI_D0, because in +that case the device will remain uninitialized after +pci_set_power_state() has returned. Prevent that from happening by +modifying pci_raw_set_power_state() to reinitialize devices with +PCI_PM_CTRL_NO_SOFT_RESET unset during all transitions from D3 to D0. + +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Jesse Barnes +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/pci.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -480,6 +480,8 @@ static int pci_raw_set_power_state(struc + pmcsr &= ~PCI_PM_CTRL_STATE_MASK; + pmcsr |= state; + break; ++ case PCI_D3hot: ++ case PCI_D3cold: + case PCI_UNKNOWN: /* Boot-up */ + if ((pmcsr & PCI_PM_CTRL_STATE_MASK) == PCI_D3hot + && !(pmcsr & PCI_PM_CTRL_NO_SOFT_RESET)) + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:41 2009 +Message-Id: <20090701002441.091270814@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:21 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andrew Vasquez , + James Bottomley +Subject: [patch 092/108] qla2xxx: Correct (again) overflow during dump-processing on large-memory ISP23xx parts. +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=qla2xxx-correct-overflow-during-dump-processing-on-large-memory-isp23xx-parts.patch +Content-Length: 986 +Lines: 29 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Andrew Vasquez + +commit e18e963b7e533149676b5d387d0a56160df9f111 upstream. + +Commit 7b867cf76fbcc8d77867cbec6f509f71dce8a98f ([SCSI] qla2xxx: +Refactor qla data structures) inadvertently reverted +e792121ec85672c1fa48f79d13986a3f4f56c590 ([SCSI] qla2xxx: Correct +overflow during dump-processing on large-memory ISP23xx parts.). + +Signed-off-by: Andrew Vasquez +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_dbg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/qla2xxx/qla_dbg.c ++++ b/drivers/scsi/qla2xxx/qla_dbg.c +@@ -218,7 +218,7 @@ qla24xx_soft_reset(struct qla_hw_data *h + + static int + qla2xxx_dump_ram(struct qla_hw_data *ha, uint32_t addr, uint16_t *ram, +- uint16_t ram_words, void **nxt) ++ uint32_t ram_words, void **nxt) + { + int rval; + uint32_t cnt, stat, timer, words, idx; + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:41 2009 +Message-Id: <20090701002441.356908481@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:22 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dimitri Sivanich , + Christoph Lameter , + Nick Piggin , + Mel Gorman +Subject: [patch 093/108] mm: fix handling of pagesets for downed cpus +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=mm-fix-handling-of-pagesets-for-downed-cpus.patch +Content-Length: 1898 +Lines: 58 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Dimitri Sivanich + +commit 364df0ebfbbb1330bfc6ca159f4d6020efc15a12 upstream. + +After downing/upping a cpu, an attempt to set +/proc/sys/vm/percpu_pagelist_fraction results in an oops in +percpu_pagelist_fraction_sysctl_handler(). + +If a processor is downed then we need to set the pageset pointer back to +the boot pageset. + +Updates of the high water marks should not access pagesets of unpopulated +zones (those pointer go to the boot pagesets which would be no longer +functional if their size would be increased beyond zero). + +Signed-off-by: Dimitri Sivanich +Signed-off-by: Christoph Lameter +Reviewed-by: KOSAKI Motohiro +Cc: Nick Piggin +Cc: Mel Gorman +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/page_alloc.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -2812,7 +2812,7 @@ bad: + if (dzone == zone) + break; + kfree(zone_pcp(dzone, cpu)); +- zone_pcp(dzone, cpu) = NULL; ++ zone_pcp(dzone, cpu) = &boot_pageset[cpu]; + } + return -ENOMEM; + } +@@ -2827,7 +2827,7 @@ static inline void free_zone_pagesets(in + /* Free per_cpu_pageset if it is slab allocated */ + if (pset != &boot_pageset[cpu]) + kfree(pset); +- zone_pcp(zone, cpu) = NULL; ++ zone_pcp(zone, cpu) = &boot_pageset[cpu]; + } + } + +@@ -4501,7 +4501,7 @@ int percpu_pagelist_fraction_sysctl_hand + ret = proc_dointvec_minmax(table, write, file, buffer, length, ppos); + if (!write || (ret == -EINVAL)) + return ret; +- for_each_zone(zone) { ++ for_each_populated_zone(zone) { + for_each_online_cpu(cpu) { + unsigned long high; + high = zone->present_pages / percpu_pagelist_fraction; + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:41 2009 +Message-Id: <20090701002441.583020954@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:23 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mikulas Patocka , + Alasdair G Kergon +Subject: [patch 094/108] dm mpath: validate hw_handler argument count +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=dm-mpath-validate-hw_handler-argument-count.patch +Content-Length: 804 +Lines: 29 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mikulas Patocka + +commit e094f4f15f5169526c7200b9bde44b900548a81e upstream. + +Fix arg count parsing error in hw handlers. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-mpath.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/md/dm-mpath.c ++++ b/drivers/md/dm-mpath.c +@@ -699,6 +699,11 @@ static int parse_hw_handler(struct arg_s + if (!hw_argc) + return 0; + ++ if (hw_argc > as->argc) { ++ ti->error = "not enough arguments for hardware handler"; ++ return -EINVAL; ++ } ++ + m->hw_handler_name = kstrdup(shift(as), GFP_KERNEL); + request_module("scsi_dh_%s", m->hw_handler_name); + if (scsi_dh_handler_exist(m->hw_handler_name) == 0) { + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:42 2009 +Message-Id: <20090701002441.908488777@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:24 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mikulas Patocka , + Alasdair G Kergon +Subject: [patch 095/108] dm mpath: validate table argument count +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=dm-mpath-validate-table-argument-count.patch +Content-Length: 1060 +Lines: 36 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mikulas Patocka + +commit 0e0497c0c017664994819f4602dc07fd95896c52 upstream. + +The parser reads the argument count as a number but doesn't check that +sufficient arguments are supplied. This command triggers the bug: + +dmsetup create mpath --table "0 `blockdev --getsize /dev/mapper/cr0` + multipath 0 0 2 1 round-robin 1000 0 1 1 /dev/mapper/cr0 + round-robin 0 1 1 /dev/mapper/cr1 1000" +kernel BUG at drivers/md/dm-mpath.c:530! + +Signed-off-by: Mikulas Patocka +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-mpath.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/md/dm-mpath.c ++++ b/drivers/md/dm-mpath.c +@@ -553,6 +553,12 @@ static int parse_path_selector(struct ar + return -EINVAL; + } + ++ if (ps_argc > as->argc) { ++ dm_put_path_selector(pst); ++ ti->error = "not enough arguments for path selector"; ++ return -EINVAL; ++ } ++ + r = pst->create(&pg->ps, ps_argc, as->argv); + if (r) { + dm_put_path_selector(pst); + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:42 2009 +Message-Id: <20090701002442.075083210@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:25 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Milan Broz , + Alasdair G Kergon +Subject: [patch 096/108] dm: sysfs skip output when device is being destroyed +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=dm-sysfs-skip-output-when-device-is-being-destroyed.patch +Content-Length: 749 +Lines: 32 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Milan Broz + +commit 4d89b7b4e4726893453d0fb4ddbb5b3e16353994 upstream. + +Do not process sysfs attributes when device is being destroyed. + +Otherwise code can cause + BUG_ON(test_bit(DMF_FREEING, &md->flags)); +in dm_put() call. + +Signed-off-by: Milan Broz +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -1780,6 +1780,10 @@ struct mapped_device *dm_get_from_kobjec + if (&md->kobj != kobj) + return NULL; + ++ if (test_bit(DMF_FREEING, &md->flags) || ++ test_bit(DMF_DELETING, &md->flags)) ++ return NULL; ++ + dm_get(md); + return md; + } + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:42 2009 +Message-Id: <20090701002442.283134938@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:26 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mikulas Patocka , + Alasdair G Kergon +Subject: [patch 097/108] dm mpath: flush keventd queue in destructor +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=dm-mpath-flush-keventd-queue-in-destructor.patch +Content-Length: 1193 +Lines: 38 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mikulas Patocka + +commit 53b351f972a882ea8b6cdb19602535f1057c884a upstream. + +The commit fe9cf30eb8186ef267d1868dc9f12f2d0f40835a moves dm table event +submission from kmultipath queue to kernel kevent queue to avoid a +deadlock. + +There is a possibility of race condition because kevent queue is not flushed +in the multipath destructor. The scenario is: +- some event happens and is queued to keventd +- keventd thread is delayed due to scheuling latency or some other work +- multipath device is destroyed +- keventd now attempts to process work_struct that is residing in already + released memory. + +The patch flushes the keventd queue in multipath constructor. +I've already fixed similar bug in dm-raid1. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-mpath.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/md/dm-mpath.c ++++ b/drivers/md/dm-mpath.c +@@ -847,6 +847,7 @@ static void multipath_dtr(struct dm_targ + + flush_workqueue(kmpath_handlerd); + flush_workqueue(kmultipathd); ++ flush_scheduled_work(); + free_multipath(m); + } + + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:42 2009 +Message-Id: <20090701002442.471525145@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:27 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jonathan Brassow , + Alasdair G Kergon , + Arjan van de Ven +Subject: [patch 098/108] dm exception store: fix exstore lookup to be case insensitive +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=dm-exception-store-fix-exstore-lookup-to-be-case-insensitive.patch +Content-Length: 950 +Lines: 31 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jonathan Brassow + +commit f6bd4eb73cdf2a5bf954e497972842f39cabb7e3 upstream. + +When snapshots are created using 'p' instead of 'P' as the +exception store type, the device-mapper table loading fails. + +This patch makes the code case insensitive as intended and fixes some +regressions reported with device-mapper snapshots. + +Signed-off-by: Jonathan Brassow +Signed-off-by: Alasdair G Kergon +Cc: Arjan van de Ven +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-exception-store.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/dm-exception-store.c ++++ b/drivers/md/dm-exception-store.c +@@ -216,7 +216,7 @@ int dm_exception_store_create(struct dm_ + return -EINVAL; + } + +- type = get_type(argv[1]); ++ type = get_type(&persistent); + if (!type) { + ti->error = "Exception store type not recognised"; + r = -EINVAL; + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:43 2009 +Message-Id: <20090701002442.919795661@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:28 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mikulas Patocka , + Alasdair G Kergon +Subject: [patch 099/108] dm: use i_size_read +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=dm-use-i_size_read.patch +Content-Length: 2087 +Lines: 58 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mikulas Patocka + +commit 5657e8fa45cf230df278040c420fb80e06309d8f upstream. + +Use i_size_read() instead of reading i_size. + +If someone changes the size of the device simultaneously, i_size_read +is guaranteed to return a valid value (either the old one or the new one). + +i_size can return some intermediate invalid value (on 32-bit computers +with 64-bit i_size, the reads to both halves of i_size can be interleaved +with updates to i_size, resulting in garbage being returned). + +Signed-off-by: Mikulas Patocka +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-exception-store.h | 2 +- + drivers/md/dm-log.c | 2 +- + drivers/md/dm-table.c | 3 ++- + 3 files changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/md/dm-exception-store.h ++++ b/drivers/md/dm-exception-store.h +@@ -156,7 +156,7 @@ static inline void dm_consecutive_chunk_ + */ + static inline sector_t get_dev_size(struct block_device *bdev) + { +- return bdev->bd_inode->i_size >> SECTOR_SHIFT; ++ return i_size_read(bdev->bd_inode) >> SECTOR_SHIFT; + } + + static inline chunk_t sector_to_chunk(struct dm_exception_store *store, +--- a/drivers/md/dm-log.c ++++ b/drivers/md/dm-log.c +@@ -415,7 +415,7 @@ static int create_log_context(struct dm_ + buf_size = dm_round_up((LOG_OFFSET << SECTOR_SHIFT) + + bitset_size, ti->limits.hardsect_size); + +- if (buf_size > dev->bdev->bd_inode->i_size) { ++ if (buf_size > i_size_read(dev->bdev->bd_inode)) { + DMWARN("log device %s too small: need %llu bytes", + dev->name, (unsigned long long)buf_size); + kfree(lc); +--- a/drivers/md/dm-table.c ++++ b/drivers/md/dm-table.c +@@ -387,7 +387,8 @@ static void close_dev(struct dm_dev_inte + static int check_device_area(struct dm_dev_internal *dd, sector_t start, + sector_t len) + { +- sector_t dev_size = dd->dm_dev.bdev->bd_inode->i_size >> SECTOR_SHIFT; ++ sector_t dev_size = i_size_read(dd->dm_dev.bdev->bd_inode) >> ++ SECTOR_SHIFT; + + if (!dev_size) + return 1; + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:43 2009 +Message-Id: <20090701002443.184726273@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:29 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mel Gorman , + Christoph Lameter , + KOSAKI Motohiro , + Wu Fengguang +Subject: [patch 100/108] vmscan: properly account for the number of page cache pages zone_reclaim() can reclaim +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=vmscan-properly-account-for-the-number-of-page-cache-pages-zone_reclaim-can-reclaim.patch +Content-Length: 7823 +Lines: 181 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mel Gorman + +commit 90afa5de6f3fa89a733861e843377302479fcf7e upstream. + +A bug was brought to my attention against a distro kernel but it affects +mainline and I believe problems like this have been reported in various +guises on the mailing lists although I don't have specific examples at the +moment. + +The reported problem was that malloc() stalled for a long time (minutes in +some cases) if a large tmpfs mount was occupying a large percentage of +memory overall. The pages did not get cleaned or reclaimed by +zone_reclaim() because the zone_reclaim_mode was unsuitable, but the lists +are uselessly scanned frequencly making the CPU spin at near 100%. + +This patchset intends to address that bug and bring the behaviour of +zone_reclaim() more in line with expectations which were noticed during +investigation. It is based on top of mmotm and takes advantage of +Kosaki's work with respect to zone_reclaim(). + +Patch 1 fixes the heuristics that zone_reclaim() uses to determine if the + scan should go ahead. The broken heuristic is what was causing the + malloc() stall as it uselessly scanned the LRU constantly. Currently, + zone_reclaim is assuming zone_reclaim_mode is 1 and historically it + could not deal with tmpfs pages at all. This fixes up the heuristic so + that an unnecessary scan is more likely to be correctly avoided. + +Patch 2 notes that zone_reclaim() returning a failure automatically means + the zone is marked full. This is not always true. It could have + failed because the GFP mask or zone_reclaim_mode were unsuitable. + +Patch 3 introduces a counter zreclaim_failed that will increment each + time the zone_reclaim scan-avoidance heuristics fail. If that + counter is rapidly increasing, then zone_reclaim_mode should be + set to 0 as a temporarily resolution and a bug reported because + the scan-avoidance heuristic is still broken. + +This patch: + +On NUMA machines, the administrator can configure zone_reclaim_mode that +is a more targetted form of direct reclaim. On machines with large NUMA +distances for example, a zone_reclaim_mode defaults to 1 meaning that +clean unmapped pages will be reclaimed if the zone watermarks are not +being met. + +There is a heuristic that determines if the scan is worthwhile but the +problem is that the heuristic is not being properly applied and is +basically assuming zone_reclaim_mode is 1 if it is enabled. The lack of +proper detection can manfiest as high CPU usage as the LRU list is scanned +uselessly. + +Historically, once enabled it was depending on NR_FILE_PAGES which may +include swapcache pages that the reclaim_mode cannot deal with. Patch +vmscan-change-the-number-of-the-unmapped-files-in-zone-reclaim.patch by +Kosaki Motohiro noted that zone_page_state(zone, NR_FILE_PAGES) included +pages that were not file-backed such as swapcache and made a calculation +based on the inactive, active and mapped files. This is far superior when +zone_reclaim==1 but if RECLAIM_SWAP is set, then NR_FILE_PAGES is a +reasonable starting figure. + +This patch alters how zone_reclaim() works out how many pages it might be +able to reclaim given the current reclaim_mode. If RECLAIM_SWAP is set in +the reclaim_mode it will either consider NR_FILE_PAGES as potential +candidates or else use NR_{IN}ACTIVE}_PAGES-NR_FILE_MAPPED to discount +swapcache and other non-file-backed pages. If RECLAIM_WRITE is not set, +then NR_FILE_DIRTY number of pages are not candidates. If RECLAIM_SWAP is +not set, then NR_FILE_MAPPED are not. + +[kosaki.motohiro@jp.fujitsu.com: Estimate unmapped pages minus tmpfs pages] +[fengguang.wu@intel.com: Fix underflow problem in Kosaki's estimate] +Signed-off-by: Mel Gorman +Reviewed-by: Rik van Riel +Acked-by: Christoph Lameter +Cc: KOSAKI Motohiro +Cc: Wu Fengguang +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/sysctl/vm.txt | 12 ++++++---- + mm/vmscan.c | 52 ++++++++++++++++++++++++++++++++++++++------ + 2 files changed, 53 insertions(+), 11 deletions(-) + +--- a/Documentation/sysctl/vm.txt ++++ b/Documentation/sysctl/vm.txt +@@ -314,10 +314,14 @@ min_unmapped_ratio: + + This is available only on NUMA kernels. + +-A percentage of the total pages in each zone. Zone reclaim will only +-occur if more than this percentage of pages are file backed and unmapped. +-This is to insure that a minimal amount of local pages is still available for +-file I/O even if the node is overallocated. ++This is a percentage of the total pages in each zone. Zone reclaim will ++only occur if more than this percentage of pages are in a state that ++zone_reclaim_mode allows to be reclaimed. ++ ++If zone_reclaim_mode has the value 4 OR'd, then the percentage is compared ++against all file-backed unmapped pages including swapcache pages and tmpfs ++files. Otherwise, only unmapped pages backed by normal files but not tmpfs ++files and similar are considered. + + The default is 1 percent. + +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -2290,6 +2290,48 @@ int sysctl_min_unmapped_ratio = 1; + */ + int sysctl_min_slab_ratio = 5; + ++static inline unsigned long zone_unmapped_file_pages(struct zone *zone) ++{ ++ unsigned long file_mapped = zone_page_state(zone, NR_FILE_MAPPED); ++ unsigned long file_lru = zone_page_state(zone, NR_INACTIVE_FILE) + ++ zone_page_state(zone, NR_ACTIVE_FILE); ++ ++ /* ++ * It's possible for there to be more file mapped pages than ++ * accounted for by the pages on the file LRU lists because ++ * tmpfs pages accounted for as ANON can also be FILE_MAPPED ++ */ ++ return (file_lru > file_mapped) ? (file_lru - file_mapped) : 0; ++} ++ ++/* Work out how many page cache pages we can reclaim in this reclaim_mode */ ++static long zone_pagecache_reclaimable(struct zone *zone) ++{ ++ long nr_pagecache_reclaimable; ++ long delta = 0; ++ ++ /* ++ * If RECLAIM_SWAP is set, then all file pages are considered ++ * potentially reclaimable. Otherwise, we have to worry about ++ * pages like swapcache and zone_unmapped_file_pages() provides ++ * a better estimate ++ */ ++ if (zone_reclaim_mode & RECLAIM_SWAP) ++ nr_pagecache_reclaimable = zone_page_state(zone, NR_FILE_PAGES); ++ else ++ nr_pagecache_reclaimable = zone_unmapped_file_pages(zone); ++ ++ /* If we can't clean pages, remove dirty pages from consideration */ ++ if (!(zone_reclaim_mode & RECLAIM_WRITE)) ++ delta += zone_page_state(zone, NR_FILE_DIRTY); ++ ++ /* Watch for any possible underflows due to delta */ ++ if (unlikely(delta > nr_pagecache_reclaimable)) ++ delta = nr_pagecache_reclaimable; ++ ++ return nr_pagecache_reclaimable - delta; ++} ++ + /* + * Try to free up some pages from this zone through reclaim. + */ +@@ -2324,9 +2366,7 @@ static int __zone_reclaim(struct zone *z + reclaim_state.reclaimed_slab = 0; + p->reclaim_state = &reclaim_state; + +- if (zone_page_state(zone, NR_FILE_PAGES) - +- zone_page_state(zone, NR_FILE_MAPPED) > +- zone->min_unmapped_pages) { ++ if (zone_pagecache_reclaimable(zone) > zone->min_unmapped_pages) { + /* + * Free memory by calling shrink zone with increasing + * priorities until we have enough memory freed. +@@ -2384,10 +2424,8 @@ int zone_reclaim(struct zone *zone, gfp_ + * if less than a specified percentage of the zone is used by + * unmapped file backed pages. + */ +- if (zone_page_state(zone, NR_FILE_PAGES) - +- zone_page_state(zone, NR_FILE_MAPPED) <= zone->min_unmapped_pages +- && zone_page_state(zone, NR_SLAB_RECLAIMABLE) +- <= zone->min_slab_pages) ++ if (zone_pagecache_reclaimable(zone) <= zone->min_unmapped_pages && ++ zone_page_state(zone, NR_SLAB_RECLAIMABLE) <= zone->min_slab_pages) + return 0; + + if (zone_is_all_unreclaimable(zone)) + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:43 2009 +Message-Id: <20090701002443.452696983@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:30 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mel Gorman , + Christoph Lameter , + Wu Fengguang +Subject: [patch 101/108] vmscan: count the number of times zone_reclaim() scans and fails +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=vmscan-count-the-number-of-times-zone_reclaim-scans-and-fails.patch +Content-Length: 2400 +Lines: 71 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mel Gorman + +commit 24cf72518c79cdcda486ed26074ff8151291cf65 upstream. + +On NUMA machines, the administrator can configure zone_reclaim_mode that +is a more targetted form of direct reclaim. On machines with large NUMA +distances for example, a zone_reclaim_mode defaults to 1 meaning that +clean unmapped pages will be reclaimed if the zone watermarks are not +being met. + +There is a heuristic that determines if the scan is worthwhile but it is +possible that the heuristic will fail and the CPU gets tied up scanning +uselessly. Detecting the situation requires some guesswork and +experimentation so this patch adds a counter "zreclaim_failed" to +/proc/vmstat. If during high CPU utilisation this counter is increasing +rapidly, then the resolution to the problem may be to set +/proc/sys/vm/zone_reclaim_mode to 0. + +[akpm@linux-foundation.org: name things consistently] +Signed-off-by: Mel Gorman +Reviewed-by: Rik van Riel +Cc: Christoph Lameter +Reviewed-by: KOSAKI Motohiro +Cc: Wu Fengguang +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/vmstat.h | 3 +++ + mm/vmscan.c | 3 +++ + mm/vmstat.c | 3 +++ + 3 files changed, 9 insertions(+) + +--- a/include/linux/vmstat.h ++++ b/include/linux/vmstat.h +@@ -36,6 +36,9 @@ enum vm_event_item { PGPGIN, PGPGOUT, PS + FOR_ALL_ZONES(PGSTEAL), + FOR_ALL_ZONES(PGSCAN_KSWAPD), + FOR_ALL_ZONES(PGSCAN_DIRECT), ++#ifdef CONFIG_NUMA ++ PGSCAN_ZONE_RECLAIM_FAILED, ++#endif + PGINODESTEAL, SLABS_SCANNED, KSWAPD_STEAL, KSWAPD_INODESTEAL, + PAGEOUTRUN, ALLOCSTALL, PGROTATED, + #ifdef CONFIG_HUGETLB_PAGE +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -2452,6 +2452,9 @@ int zone_reclaim(struct zone *zone, gfp_ + ret = __zone_reclaim(zone, gfp_mask, order); + zone_clear_flag(zone, ZONE_RECLAIM_LOCKED); + ++ if (!ret) ++ count_vm_event(PGSCAN_ZONE_RECLAIM_FAILED); ++ + return ret; + } + #endif +--- a/mm/vmstat.c ++++ b/mm/vmstat.c +@@ -675,6 +675,9 @@ static const char * const vmstat_text[] + TEXTS_FOR_ZONES("pgscan_kswapd") + TEXTS_FOR_ZONES("pgscan_direct") + ++#ifdef CONFIG_NUMA ++ "zone_reclaim_failed", ++#endif + "pginodesteal", + "slabs_scanned", + "kswapd_steal", + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:43 2009 +Message-Id: <20090701002443.637484445@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:31 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Zygo Blaxell , + Jiri Kosina , + Steve Wise +Subject: [patch 102/108] lib/genalloc.c: remove unmatched write_lock() in gen_pool_destroy +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=lib-genalloc.c-remove-unmatched-write_lock-in-gen_pool_destroy.patch +Content-Length: 1147 +Lines: 32 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Zygo Blaxell + +commit 8e8a2dea0ca91fe2cb7de7ea212124cfe8c82c35 upstream. + +There is a call to write_lock() in gen_pool_destroy which is not balanced +by any corresponding write_unlock(). This causes problems with preemption +because the preemption-disable counter is incremented in the write_lock() +call, but never decremented by any call to write_unlock(). This bug is +gen_pool_destroy, and one of them is non-x86 arch-specific code. + +Signed-off-by: Zygo Blaxell +Cc: Jiri Kosina +Cc: Steve Wise +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + lib/genalloc.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/lib/genalloc.c ++++ b/lib/genalloc.c +@@ -85,7 +85,6 @@ void gen_pool_destroy(struct gen_pool *p + int bit, end_bit; + + +- write_lock(&pool->lock); + list_for_each_safe(_chunk, _next_chunk, &pool->chunks) { + chunk = list_entry(_chunk, struct gen_pool_chunk, next_chunk); + list_del(&chunk->next_chunk); + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:44 2009 +Message-Id: <20090701002444.090084909@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:32 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 103/108] CONFIG_FILE_LOCKING should not depend on CONFIG_BLOCK +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=config_file_locking-should-not-depend-on-config_block.patch +Content-Length: 1200 +Lines: 48 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Tomas Szepe + +commit 69050eee8e08a6234f29fe71a56f8c7c7d4d7186 upstream. + +CONFIG_FILE_LOCKING should not depend on CONFIG_BLOCK. + +This makes it possible to run complete systems out of a CONFIG_BLOCK=n +initramfs on current kernels again (this last worked on 2.6.27.*). + +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/Kconfig | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/fs/Kconfig ++++ b/fs/Kconfig +@@ -39,6 +39,13 @@ config FS_POSIX_ACL + bool + default n + ++source "fs/xfs/Kconfig" ++source "fs/gfs2/Kconfig" ++source "fs/ocfs2/Kconfig" ++source "fs/btrfs/Kconfig" ++ ++endif # BLOCK ++ + config FILE_LOCKING + bool "Enable POSIX file locking API" if EMBEDDED + default y +@@ -47,13 +54,6 @@ config FILE_LOCKING + for filesystems like NFS and for the flock() system + call. Disabling this option saves about 11k. + +-source "fs/xfs/Kconfig" +-source "fs/gfs2/Kconfig" +-source "fs/ocfs2/Kconfig" +-source "fs/btrfs/Kconfig" +- +-endif # BLOCK +- + source "fs/notify/Kconfig" + + source "fs/quota/Kconfig" + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:44 2009 +Message-Id: <20090701002444.463759633@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:33 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mike Frysinger , + Alan Cox +Subject: [patch 104/108] serial: bfin_5xx: fix building as module when early printk is enabled +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=serial-bfin_5xx-fix-building-as-module-when-early-printk-is-enabled.patch +Content-Length: 919 +Lines: 32 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mike Frysinger + +commit 607c268ef9a4675287e77f732071e426e62c2d86 upstream. + +Since early printk only makes sense/works when the serial driver is built +into the kernel, disable the option for this driver when it is going to be +built as a module. Otherwise we get build failures due to the ifdef +handling. + +Signed-off-by: Mike Frysinger +Signed-off-by: Alan Cox +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/serial/bfin_5xx.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/serial/bfin_5xx.c ++++ b/drivers/serial/bfin_5xx.c +@@ -38,6 +38,10 @@ + #include + #endif + ++#ifdef CONFIG_SERIAL_BFIN_MODULE ++# undef CONFIG_EARLY_PRINTK ++#endif ++ + /* UART name and device definitions */ + #define BFIN_SERIAL_NAME "ttyBF" + #define BFIN_SERIAL_MAJOR 204 + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:45 2009 +Message-Id: <20090701002444.956184017@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:34 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Sunil Mushran , + Joel Becker +Subject: [patch 105/108] ocfs2: Fix ocfs2_osb_dump() +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=ocfs2-fix-ocfs2_osb_dump.patch +Content-Length: 2789 +Lines: 79 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Sunil Mushran + +commit c3d38840abaa45c1c5a5fabbb8ffc9a0d1a764d1 upstream. + +Skip printing information that is not valid for local mounts. + +Signed-off-by: Sunil Mushran +Signed-off-by: Joel Becker +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ocfs2/super.c | 32 ++++++++++++++++++-------------- + 1 file changed, 18 insertions(+), 14 deletions(-) + +--- a/fs/ocfs2/super.c ++++ b/fs/ocfs2/super.c +@@ -232,20 +232,24 @@ static int ocfs2_osb_dump(struct ocfs2_s + "%10s => Opts: 0x%lX AtimeQuanta: %u\n", "Mount", + osb->s_mount_opt, osb->s_atime_quantum); + +- out += snprintf(buf + out, len - out, +- "%10s => Stack: %s Name: %*s Version: %d.%d\n", +- "Cluster", +- (*osb->osb_cluster_stack == '\0' ? +- "o2cb" : osb->osb_cluster_stack), +- cconn->cc_namelen, cconn->cc_name, +- cconn->cc_version.pv_major, cconn->cc_version.pv_minor); ++ if (cconn) { ++ out += snprintf(buf + out, len - out, ++ "%10s => Stack: %s Name: %*s " ++ "Version: %d.%d\n", "Cluster", ++ (*osb->osb_cluster_stack == '\0' ? ++ "o2cb" : osb->osb_cluster_stack), ++ cconn->cc_namelen, cconn->cc_name, ++ cconn->cc_version.pv_major, ++ cconn->cc_version.pv_minor); ++ } + + spin_lock(&osb->dc_task_lock); + out += snprintf(buf + out, len - out, + "%10s => Pid: %d Count: %lu WakeSeq: %lu " + "WorkSeq: %lu\n", "DownCnvt", +- task_pid_nr(osb->dc_task), osb->blocked_lock_count, +- osb->dc_wake_sequence, osb->dc_work_sequence); ++ (osb->dc_task ? task_pid_nr(osb->dc_task) : -1), ++ osb->blocked_lock_count, osb->dc_wake_sequence, ++ osb->dc_work_sequence); + spin_unlock(&osb->dc_task_lock); + + spin_lock(&osb->osb_lock); +@@ -265,14 +269,15 @@ static int ocfs2_osb_dump(struct ocfs2_s + + out += snprintf(buf + out, len - out, + "%10s => Pid: %d Interval: %lu Needs: %d\n", "Commit", +- task_pid_nr(osb->commit_task), osb->osb_commit_interval, ++ (osb->commit_task ? task_pid_nr(osb->commit_task) : -1), ++ osb->osb_commit_interval, + atomic_read(&osb->needs_checkpoint)); + + out += snprintf(buf + out, len - out, +- "%10s => State: %d NumTxns: %d TxnId: %lu\n", ++ "%10s => State: %d TxnId: %lu NumTxns: %d\n", + "Journal", osb->journal->j_state, +- atomic_read(&osb->journal->j_num_trans), +- osb->journal->j_trans_id); ++ osb->journal->j_trans_id, ++ atomic_read(&osb->journal->j_num_trans)); + + out += snprintf(buf + out, len - out, + "%10s => GlobalAllocs: %d LocalAllocs: %d " +@@ -300,7 +305,6 @@ static int ocfs2_osb_dump(struct ocfs2_s + + out += snprintf(buf + out, len - out, "%10s => %3s %10s\n", + "Slots", "Num", "RecoGen"); +- + for (i = 0; i < osb->max_slots; ++i) { + out += snprintf(buf + out, len - out, + "%10s %c %3d %10d\n", + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:45 2009 +Message-Id: <20090701002445.375631252@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:35 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Rainer Weikusat , + Borislav Petkov , + Bartlomiej Zolnierkiewicz +Subject: [patch 106/108] ide-cd: prevent null pointer deref via cdrom_newpc_intr +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=ide-cd-prevent-null-pointer-deref-via-cdrom_newpc_intr.patch +Content-Length: 1426 +Lines: 40 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Rainer Weikusat + +commit 39c58f37a10198054c656c28202fb1e6d22fd505 upstream. + +With 2.6.30, the error handling code in cdrom_newpc_intr was changed +to deal with partial request failures by normally completing the 'good' +parts of a request and only 'error' the last (and presumably, +incompletely transferred) bio associated with a particular +request. In order to do this, ide_complete_rq is called over +ide_cd_error_cmd() to partially complete the rq. The block layer +does partial completion only for requests with bio's and if the +rq doesn't have one (eg 'GPCMD_READ_DISC_INFO') the request is +completed as a whole and the drive->hwif->rq pointer set to NULL +afterwards. When calling ide_complete_rq again to report +the error, this null pointer is derefenced, resulting in a kernel +crash. + +This fixes http://bugzilla.kernel.org/show_bug.cgi?id=13399. + +Signed-off-by: Rainer Weikusat +Signed-off-by: Borislav Petkov +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ide/ide-cd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/ide/ide-cd.c ++++ b/drivers/ide/ide-cd.c +@@ -758,7 +758,7 @@ out_end: + rq->errors = -EIO; + } + +- if (uptodate == 0) ++ if (uptodate == 0 && rq->bio) + ide_cd_error_cmd(drive, cmd); + + /* make sure it's fully ended */ + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:46 2009 +Message-Id: <20090701002445.747864187@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:36 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jesse Barnes , + Eric Anholt , + Jie Luo +Subject: [patch 107/108] drm/i915: correct suspend/resume ordering +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=drm-i915-correct-suspend-resume-ordering.patch +Content-Length: 1394 +Lines: 44 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jesse Barnes + +commit 9e06dd39f2b6d7e35981e0d7aded618686b32ccb upstream. + +We need to save register state *after* idling GEM, clearing the ring, +and uninstalling the IRQ handler, or we might end up saving bogus +fence regs, for one. Our restore ordering should already be correct, +since we do GEM, ring and IRQ init after restoring the last register +state, which prevents us from clobbering things. + +I put this together to potentially address a bug, but I haven't heard +back if it fixes it yet. However I think it stands on its own, so I'm +sending it in. + +Signed-off-by: Jesse Barnes +Signed-off-by: Eric Anholt +Cc: Jie Luo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_drv.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_drv.c ++++ b/drivers/gpu/drm/i915/i915_drv.c +@@ -67,8 +67,6 @@ static int i915_suspend(struct drm_devic + + pci_save_state(dev->pdev); + +- i915_save_state(dev); +- + /* If KMS is active, we do the leavevt stuff here */ + if (drm_core_check_feature(dev, DRIVER_MODESET)) { + if (i915_gem_idle(dev)) +@@ -77,6 +75,8 @@ static int i915_suspend(struct drm_devic + drm_irq_uninstall(dev); + } + ++ i915_save_state(dev); ++ + intel_opregion_free(dev, 1); + + if (state.event == PM_EVENT_SUSPEND) { + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:46 2009 +Message-Id: <20090701002446.414993796@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:24:37 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Marcelo Tosatti , + Avi Kivity +Subject: [patch 108/108] KVM: x86: silence preempt warning on kvm_write_guest_time +References: <20090701002249.937782934@mini.kroah.org> +Content-Disposition: inline; filename=kvm-x86-silence-preempt-warning-on-kvm_write_guest_time.patch +Content-Length: 2120 +Lines: 65 + +2.6.30-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Matt T. Yourst + +commit 2dea4c84bc936731668b5a7a9fba5b436a422668 upstream. + +This issue just appeared in kvm-84 when running on 2.6.28.7 (x86-64) +with PREEMPT enabled. + +We're getting syslog warnings like this many (but not all) times qemu +tells KVM to run the VCPU: + +BUG: using smp_processor_id() in preemptible [00000000] code: +qemu-system-x86/28938 +caller is kvm_arch_vcpu_ioctl_run+0x5d1/0xc70 [kvm] +Pid: 28938, comm: qemu-system-x86 2.6.28.7-mtyrel-64bit +Call Trace: +debug_smp_processor_id+0xf7/0x100 +kvm_arch_vcpu_ioctl_run+0x5d1/0xc70 [kvm] +? __wake_up+0x4e/0x70 +? wake_futex+0x27/0x40 +kvm_vcpu_ioctl+0x2e9/0x5a0 [kvm] +enqueue_hrtimer+0x8a/0x110 +_spin_unlock_irqrestore+0x27/0x50 +vfs_ioctl+0x31/0xa0 +do_vfs_ioctl+0x74/0x480 +sys_futex+0xb4/0x140 +sys_ioctl+0x99/0xa0 +system_call_fastpath+0x16/0x1b + +As it turns out, the call trace is messed up due to gcc's inlining, but +I isolated the problem anyway: kvm_write_guest_time() is being used in a +non-thread-safe manner on preemptable kernels. + +Basically kvm_write_guest_time()'s body needs to be surrounded by +preempt_disable() and preempt_enable(), since the kernel won't let us +query any per-CPU data (indirectly using smp_processor_id()) without +preemption disabled. The attached patch fixes this issue by disabling +preemption inside kvm_write_guest_time(). + +[marcelo: surround only __get_cpu_var calls since the warning +is harmless] + +Signed-off-by: Marcelo Tosatti +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/x86.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -634,10 +634,12 @@ static void kvm_write_guest_time(struct + if ((!vcpu->time_page)) + return; + ++ preempt_disable(); + if (unlikely(vcpu->hv_clock_tsc_khz != __get_cpu_var(cpu_tsc_khz))) { + kvm_set_time_scale(__get_cpu_var(cpu_tsc_khz), &vcpu->hv_clock); + vcpu->hv_clock_tsc_khz = __get_cpu_var(cpu_tsc_khz); + } ++ preempt_enable(); + + /* Keep irq disabled to prevent changes to the clock */ + local_irq_save(flags); + + +From gregkh@mini.kroah.org Tue Jun 30 17:24:10 2009 +Message-Id: <20090701002249.937782934@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Tue, 30 Jun 2009 17:22:49 -0700 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 000/108] 2.6.30-stable review +Content-Length: 8787 +Lines: 170 + +This is the start of the stable review cycle for the 2.6.30.1 release. + +Sorry for the delay in getting this out, it's a big one. + +There are 108 patches in this series, all will be posted as a response +to this one. If anyone has any issues with these being applied, please +let us know. If anyone is a maintainer of the proper subsystem, and +wants to add a Signed-off-by: line to the patch, please respond with it. + +These patches are sent out with a number of different people on the Cc: +line. If you wish to be a reviewer, please email stable@kernel.org to +add your name to the list. If you want to be off the reviewer list, +also email us. + +Responses should be made by Friday, Jul 3, 00:00:00 2009 UTC. +Anything received after that time might be too late. + +The whole patch series can be found in one patch at: + kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.30.1-rc1.gz +and the diffstat can be found below. + + +thanks, + +greg k-h + + + Documentation/sysctl/vm.txt | 12 ++- + Makefile | 2 +- + arch/arm/include/asm/cacheflush.h | 8 ++ + arch/x86/crypto/aesni-intel_asm.S | 5 +- + arch/x86/include/asm/apic.h | 2 +- + arch/x86/include/asm/cpufeature.h | 1 + + arch/x86/include/asm/uv/uv_bau.h | 2 +- + arch/x86/include/asm/uv/uv_hub.h | 6 +- + arch/x86/include/asm/vmx.h | 1 + + arch/x86/kernel/apic/x2apic_uv_x.c | 15 ++-- + arch/x86/kernel/cpu/amd.c | 14 +++- + arch/x86/kernel/cpu/mcheck/mce_64.c | 1 + + arch/x86/kernel/hpet.c | 3 +- + arch/x86/kernel/pci-gart_64.c | 10 ++- + arch/x86/kernel/reboot.c | 9 ++ + arch/x86/kernel/setup.c | 15 +--- + arch/x86/kernel/tlb_uv.c | 24 ++++-- + arch/x86/kernel/tsc.c | 11 +++- + arch/x86/kernel/vm86_32.c | 9 +- + arch/x86/kernel/vsyscall_64.c | 8 -- + arch/x86/kvm/vmx.c | 101 ++++++++++++++++++++----- + arch/x86/kvm/x86.c | 10 ++- + arch/x86/mm/memtest.c | 14 ++-- + drivers/char/epca.c | 9 +- + drivers/char/moxa.c | 7 ++- + drivers/char/n_r3964.c | 26 ++++--- + drivers/char/pcmcia/cm4000_cs.c | 3 +- + drivers/char/rocket.c | 6 +- + drivers/char/vt_ioctl.c | 3 +- + drivers/firmware/memmap.c | 16 ++-- + drivers/gpu/drm/i915/i915_drv.c | 4 +- + drivers/ide/ide-cd.c | 2 +- + drivers/infiniband/hw/mlx4/qp.c | 4 + + drivers/isdn/hisax/hfc_pci.c | 41 ++++++++--- + drivers/isdn/hisax/hisax.h | 2 +- + drivers/md/dm-exception-store.c | 2 +- + drivers/md/dm-exception-store.h | 2 +- + drivers/md/dm-log.c | 2 +- + drivers/md/dm-mpath.c | 12 +++ + drivers/md/dm-table.c | 3 +- + drivers/md/dm.c | 4 + + drivers/md/raid5.c | 1 + + drivers/media/dvb/frontends/lgdt3305.c | 17 +---- + drivers/media/video/Makefile | 77 ++++++++++--------- + drivers/media/video/cx18/cx18-controls.c | 2 + + drivers/media/video/cx2341x.c | 2 + + drivers/media/video/ivtv/ivtv-controls.c | 2 + + drivers/media/video/pvrusb2/pvrusb2-hdw.c | 56 ++++++++------ + drivers/media/video/saa7134/Makefile | 3 +- + drivers/net/bonding/bond_sysfs.c | 1 + + drivers/net/e1000e/netdev.c | 2 +- + drivers/net/mv643xx_eth.c | 7 +- + drivers/net/sky2.c | 31 ++++---- + drivers/net/tun.c | 7 +- + drivers/net/usb/pegasus.c | 29 ++++--- + drivers/net/via-velocity.c | 2 +- + drivers/net/wireless/ath5k/base.c | 7 ++ + drivers/net/wireless/ath9k/calib.c | 67 ++++++---------- + drivers/net/wireless/ath9k/main.c | 28 +++++--- + drivers/net/wireless/ath9k/pci.c | 18 +++++ + drivers/net/wireless/ath9k/regd.c | 2 +- + drivers/net/wireless/ath9k/xmit.c | 5 +- + drivers/parport/parport_pc.c | 34 +++++++-- + drivers/pci/pci.c | 7 +- + drivers/pci/pcie/aspm.c | 4 + + drivers/scsi/qla2xxx/qla_dbg.c | 2 +- + drivers/scsi/sym53c8xx_2/sym_hipd.c | 5 +- + drivers/serial/bfin_5xx.c | 5 + + drivers/spi/spi_mpc83xx.c | 6 +- + drivers/staging/uc2322/aten2011.c | 4 +- + drivers/usb/class/usbtmc.c | 6 ++ + drivers/usb/serial/aircable.c | 5 +- + drivers/usb/serial/belkin_sa.c | 7 +- + drivers/usb/serial/cp210x.c | 6 +- + drivers/usb/serial/cyberjack.c | 20 ++++- + drivers/usb/serial/cypress_m8.c | 11 +-- + drivers/usb/serial/digi_acceleport.c | 20 ++++- + drivers/usb/serial/empeg.c | 8 -- + drivers/usb/serial/ftdi_sio.c | 14 ---- + drivers/usb/serial/garmin_gps.c | 16 +++- + drivers/usb/serial/generic.c | 9 ++- + drivers/usb/serial/io_edgeport.c | 29 +++++-- + drivers/usb/serial/io_tables.h | 12 ++- + drivers/usb/serial/io_ti.c | 22 ++++- + drivers/usb/serial/ipaq.c | 7 -- + drivers/usb/serial/iuu_phoenix.c | 6 +- + drivers/usb/serial/keyspan.c | 13 +++- + drivers/usb/serial/keyspan.h | 12 ++- + drivers/usb/serial/keyspan_pda.c | 4 +- + drivers/usb/serial/kl5kusb105.c | 39 ++++++---- + drivers/usb/serial/kobil_sct.c | 12 +-- + drivers/usb/serial/mct_u232.c | 13 +-- + drivers/usb/serial/mos7720.c | 9 +-- + drivers/usb/serial/mos7840.c | 42 +++++++++- + drivers/usb/serial/omninet.c | 19 ++++- + drivers/usb/serial/opticon.c | 14 +++- + drivers/usb/serial/option.c | 17 +++- + drivers/usb/serial/oti6858.c | 7 +- + drivers/usb/serial/pl2303.c | 5 +- + drivers/usb/serial/sierra.c | 28 ++++++- + drivers/usb/serial/spcp8x5.c | 5 +- + drivers/usb/serial/symbolserial.c | 14 +++- + drivers/usb/serial/ti_usb_3410_5052.c | 10 +-- + drivers/usb/serial/usb-serial.c | 29 +++---- + drivers/usb/serial/visor.c | 13 +-- + drivers/usb/serial/whiteheat.c | 6 +- + fs/Kconfig | 14 ++-- + fs/cifs/file.c | 10 +- + fs/eventpoll.c | 21 +++-- + fs/fs-writeback.c | 2 - + fs/jfs/jfs_extent.c | 1 + + fs/ocfs2/super.c | 32 +++++---- + fs/ramfs/inode.c | 9 ++- + include/linux/firmware-map.h | 12 +-- + include/linux/kvm_host.h | 1 + + include/linux/mlx4/qp.h | 1 + + include/linux/serial.h | 116 +++++++++++++++++------------ + include/linux/usb/serial.h | 12 ++- + include/linux/vmstat.h | 3 + + include/net/x25.h | 2 +- + kernel/trace/trace_functions.c | 8 +- + lib/Kconfig.debug | 2 +- + lib/dma-debug.c | 43 ++++++++++- + lib/genalloc.c | 1 - + mm/page_alloc.c | 6 +- + mm/vmscan.c | 55 ++++++++++++-- + mm/vmstat.c | 3 + + net/ipv4/route.c | 36 ++++++++- + net/mac80211/rc80211_minstrel.c | 2 +- + net/wireless/nl80211.c | 26 +++++-- + net/wireless/reg.c | 10 ++- + net/x25/af_x25.c | 23 +++++- + net/x25/x25_timer.c | 2 +- + security/integrity/ima/ima_audit.c | 2 +- + security/integrity/ima/ima_main.c | 13 ++- + sound/core/seq/seq_midi_event.c | 8 +- + sound/isa/cmi8330.c | 2 +- + sound/pci/ca0106/ca0106_mixer.c | 6 ++ + sound/pci/hda/patch_realtek.c | 2 + + sound/pci/intel8x0.c | 24 +++--- + sound/soc/codecs/wm8903.c | 4 - + virt/kvm/kvm_main.c | 18 ++++- + 142 files changed, 1230 insertions(+), 675 deletions(-) + diff --git a/queue-2.6.30/send_sigio_to_task-sanitize-the-usage-of-fown-signum.patch b/queue-2.6.30/send_sigio_to_task-sanitize-the-usage-of-fown-signum.patch deleted file mode 100644 index 08caee16a0c..00000000000 --- a/queue-2.6.30/send_sigio_to_task-sanitize-the-usage-of-fown-signum.patch +++ /dev/null @@ -1,68 +0,0 @@ -From 8eeee4e2f04fc551f50c9d9847da2d73d7d33728 Mon Sep 17 00:00:00 2001 -From: Oleg Nesterov -Date: Wed, 17 Jun 2009 00:27:10 +0200 -Subject: send_sigio_to_task: sanitize the usage of fown->signum - -From: Oleg Nesterov - -commit 8eeee4e2f04fc551f50c9d9847da2d73d7d33728 upstream. - -send_sigio_to_task() reads fown->signum several times, we can race with -F_SETSIG which changes ->signum lockless. In theory, this can fool -security checks or we can call group_send_sig_info() with the wrong -->si_signo which does not match "int sig". - -Change the code to cache ->signum. - -Signed-off-by: Oleg Nesterov -Signed-off-by: Linus Torvalds -Signed-off-by: Greg Kroah-Hartman - ---- - fs/fcntl.c | 16 +++++++++++----- - 1 file changed, 11 insertions(+), 5 deletions(-) - ---- a/fs/fcntl.c -+++ b/fs/fcntl.c -@@ -428,14 +428,20 @@ static inline int sigio_perm(struct task - } - - static void send_sigio_to_task(struct task_struct *p, -- struct fown_struct *fown, -+ struct fown_struct *fown, - int fd, - int reason) - { -- if (!sigio_perm(p, fown, fown->signum)) -+ /* -+ * F_SETSIG can change ->signum lockless in parallel, make -+ * sure we read it once and use the same value throughout. -+ */ -+ int signum = ACCESS_ONCE(fown->signum); -+ -+ if (!sigio_perm(p, fown, signum)) - return; - -- switch (fown->signum) { -+ switch (signum) { - siginfo_t si; - default: - /* Queue a rt signal with the appropriate fd as its -@@ -444,7 +450,7 @@ static void send_sigio_to_task(struct ta - delivered even if we can't queue. Failure to - queue in this case _should_ be reported; we fall - back to SIGIO in that case. --sct */ -- si.si_signo = fown->signum; -+ si.si_signo = signum; - si.si_errno = 0; - si.si_code = reason; - /* Make sure we are called with one of the POLL_* -@@ -456,7 +462,7 @@ static void send_sigio_to_task(struct ta - else - si.si_band = band_table[reason - POLL_IN]; - si.si_fd = fd; -- if (!group_send_sig_info(fown->signum, &si, p)) -+ if (!group_send_sig_info(signum, &si, p)) - break; - /* fall-through: fall back on the old plain SIGIO signal */ - case 0: diff --git a/queue-2.6.30/series b/queue-2.6.30/series index c720c4830bd..8a80955628a 100644 --- a/queue-2.6.30/series +++ b/queue-2.6.30/series @@ -72,8 +72,6 @@ ath9k-fix-bug-in-scan-termination.patch ath9k-fix-memleak-on-tx-dma-failure.patch ath9k-initialize-ani-timers.patch ath9k-fix-pci-fatal-interrupts-by-restoring-retry_timeout-disabling.patch -shift-current_cred-from-__f_setown-to-f_modown.patch -send_sigio_to_task-sanitize-the-usage-of-fown-signum.patch crypto-aes-ni-fix-cbc-mode-iv-saving.patch md-raid5-add-missing-call-to-schedule-after-prepare_to_wait.patch tracing-urgent-fix-unbalanced-ftrace_start_up.patch diff --git a/queue-2.6.30/shift-current_cred-from-__f_setown-to-f_modown.patch b/queue-2.6.30/shift-current_cred-from-__f_setown-to-f_modown.patch deleted file mode 100644 index a86ba87fe7d..00000000000 --- a/queue-2.6.30/shift-current_cred-from-__f_setown-to-f_modown.patch +++ /dev/null @@ -1,76 +0,0 @@ -From 2f38d70fb4e97e7d00e12eaac45790cf6ebd7b22 Mon Sep 17 00:00:00 2001 -From: Oleg Nesterov -Date: Tue, 16 Jun 2009 22:07:46 +0200 -Subject: shift current_cred() from __f_setown() to f_modown() - -From: Oleg Nesterov - -commit 2f38d70fb4e97e7d00e12eaac45790cf6ebd7b22 upstream. - -Shift current_cred() from __f_setown() to f_modown(). This reduces -the number of arguments and saves 48 bytes from fs/fcntl.o. - -[ Note: this doesn't clear euid/uid when pid is set to NULL. But if - f_owner.pid == NULL we never use f_owner.uid/euid. Otherwise we'd - have a bug anyway: we must not send signals if pid was reset to NULL. ] - -Signed-off-by: Oleg Nesterov -Acked-by: David Howells -Signed-off-by: Linus Torvalds -Signed-off-by: Greg Kroah-Hartman - ---- - fs/fcntl.c | 17 ++++++++++------- - 1 file changed, 10 insertions(+), 7 deletions(-) - ---- a/fs/fcntl.c -+++ b/fs/fcntl.c -@@ -198,15 +198,19 @@ static int setfl(int fd, struct file * f - } - - static void f_modown(struct file *filp, struct pid *pid, enum pid_type type, -- uid_t uid, uid_t euid, int force) -+ int force) - { - write_lock_irq(&filp->f_owner.lock); - if (force || !filp->f_owner.pid) { - put_pid(filp->f_owner.pid); - filp->f_owner.pid = get_pid(pid); - filp->f_owner.pid_type = type; -- filp->f_owner.uid = uid; -- filp->f_owner.euid = euid; -+ -+ if (pid) { -+ const struct cred *cred = current_cred(); -+ filp->f_owner.uid = cred->uid; -+ filp->f_owner.euid = cred->euid; -+ } - } - write_unlock_irq(&filp->f_owner.lock); - } -@@ -214,14 +218,13 @@ static void f_modown(struct file *filp, - int __f_setown(struct file *filp, struct pid *pid, enum pid_type type, - int force) - { -- const struct cred *cred = current_cred(); - int err; -- -+ - err = security_file_set_fowner(filp); - if (err) - return err; - -- f_modown(filp, pid, type, cred->uid, cred->euid, force); -+ f_modown(filp, pid, type, force); - return 0; - } - EXPORT_SYMBOL(__f_setown); -@@ -247,7 +250,7 @@ EXPORT_SYMBOL(f_setown); - - void f_delown(struct file *filp) - { -- f_modown(filp, NULL, PIDTYPE_PID, 0, 0, 1); -+ f_modown(filp, NULL, PIDTYPE_PID, 1); - } - - pid_t f_getown(struct file *filp)