From: Greg Kroah-Hartman Date: Wed, 12 Nov 2008 00:26:05 +0000 (-0800) Subject: start 2.6.27.5 review cycle X-Git-Tag: v2.6.27.6~2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5203edb95c1ed2b7bb1706eebad0867366aed5db;p=thirdparty%2Fkernel%2Fstable-queue.git start 2.6.27.5 review cycle --- diff --git a/queue-2.6.27/acpi-dock-avoid-check-_sta-method.patch b/review-2.6.27/acpi-dock-avoid-check-_sta-method.patch similarity index 100% rename from queue-2.6.27/acpi-dock-avoid-check-_sta-method.patch rename to review-2.6.27/acpi-dock-avoid-check-_sta-method.patch diff --git a/queue-2.6.27/alsa-hda-make-a-stac_dell_eq-option.patch b/review-2.6.27/alsa-hda-make-a-stac_dell_eq-option.patch similarity index 100% rename from queue-2.6.27/alsa-hda-make-a-stac_dell_eq-option.patch rename to review-2.6.27/alsa-hda-make-a-stac_dell_eq-option.patch diff --git a/queue-2.6.27/arm-5300-1-fixup-spitz-reset-during-boot.patch b/review-2.6.27/arm-5300-1-fixup-spitz-reset-during-boot.patch similarity index 100% rename from queue-2.6.27/arm-5300-1-fixup-spitz-reset-during-boot.patch rename to review-2.6.27/arm-5300-1-fixup-spitz-reset-during-boot.patch diff --git a/queue-2.6.27/arm-xsc3-fix-xsc3_l2_inv_range.patch b/review-2.6.27/arm-xsc3-fix-xsc3_l2_inv_range.patch similarity index 97% rename from queue-2.6.27/arm-xsc3-fix-xsc3_l2_inv_range.patch rename to review-2.6.27/arm-xsc3-fix-xsc3_l2_inv_range.patch index ea3982f42f1..121b611c1f4 100644 --- a/queue-2.6.27/arm-xsc3-fix-xsc3_l2_inv_range.patch +++ b/review-2.6.27/arm-xsc3-fix-xsc3_l2_inv_range.patch @@ -21,7 +21,7 @@ This issue was caught by drivers/dma/dmatest. Cc: Cc: Haavard Skinnemoen -Cc: Lothar WaÃ<9f>mann +Cc: Lothar Wafmann Cc: Lennert Buytenhek Cc: Eric Miao Signed-off-by: Dan Williams diff --git a/queue-2.6.27/cciss-fix-regression-firmware-not-displayed-in-procfs.patch b/review-2.6.27/cciss-fix-regression-firmware-not-displayed-in-procfs.patch similarity index 100% rename from queue-2.6.27/cciss-fix-regression-firmware-not-displayed-in-procfs.patch rename to review-2.6.27/cciss-fix-regression-firmware-not-displayed-in-procfs.patch diff --git a/queue-2.6.27/cciss-fix-sysfs-broken-symlink-regression.patch b/review-2.6.27/cciss-fix-sysfs-broken-symlink-regression.patch similarity index 100% rename from queue-2.6.27/cciss-fix-sysfs-broken-symlink-regression.patch rename to review-2.6.27/cciss-fix-sysfs-broken-symlink-regression.patch diff --git a/queue-2.6.27/cciss-new-hardware-support.patch b/review-2.6.27/cciss-new-hardware-support.patch similarity index 100% rename from queue-2.6.27/cciss-new-hardware-support.patch rename to review-2.6.27/cciss-new-hardware-support.patch diff --git a/queue-2.6.27/cgroups-fix-invalid-cgrp-dentry-before-cgroup-has-been-completely-removed.patch b/review-2.6.27/cgroups-fix-invalid-cgrp-dentry-before-cgroup-has-been-completely-removed.patch similarity index 100% rename from queue-2.6.27/cgroups-fix-invalid-cgrp-dentry-before-cgroup-has-been-completely-removed.patch rename to review-2.6.27/cgroups-fix-invalid-cgrp-dentry-before-cgroup-has-been-completely-removed.patch diff --git a/queue-2.6.27/cpqarry-fix-return-value-of-cpqarray_init.patch b/review-2.6.27/cpqarry-fix-return-value-of-cpqarray_init.patch similarity index 100% rename from queue-2.6.27/cpqarry-fix-return-value-of-cpqarray_init.patch rename to review-2.6.27/cpqarry-fix-return-value-of-cpqarray_init.patch diff --git a/queue-2.6.27/dca-fixup-initialization-dependency.patch b/review-2.6.27/dca-fixup-initialization-dependency.patch similarity index 100% rename from queue-2.6.27/dca-fixup-initialization-dependency.patch rename to review-2.6.27/dca-fixup-initialization-dependency.patch diff --git a/queue-2.6.27/ext3-wait-on-all-pending-commits-in-ext3_sync_fs.patch b/review-2.6.27/ext3-wait-on-all-pending-commits-in-ext3_sync_fs.patch similarity index 100% rename from queue-2.6.27/ext3-wait-on-all-pending-commits-in-ext3_sync_fs.patch rename to review-2.6.27/ext3-wait-on-all-pending-commits-in-ext3_sync_fs.patch diff --git a/queue-2.6.27/fix-__pfn_to_page-for-config_discontigmem-y.patch b/review-2.6.27/fix-__pfn_to_page-for-config_discontigmem-y.patch similarity index 100% rename from queue-2.6.27/fix-__pfn_to_page-for-config_discontigmem-y.patch rename to review-2.6.27/fix-__pfn_to_page-for-config_discontigmem-y.patch diff --git a/queue-2.6.27/hfs-fix-namelength-memory-corruption.patch b/review-2.6.27/hfs-fix-namelength-memory-corruption.patch similarity index 100% rename from queue-2.6.27/hfs-fix-namelength-memory-corruption.patch rename to review-2.6.27/hfs-fix-namelength-memory-corruption.patch diff --git a/queue-2.6.27/hfsplus-check-read_mapping_page-return-value.patch b/review-2.6.27/hfsplus-check-read_mapping_page-return-value.patch similarity index 100% rename from queue-2.6.27/hfsplus-check-read_mapping_page-return-value.patch rename to review-2.6.27/hfsplus-check-read_mapping_page-return-value.patch diff --git a/queue-2.6.27/hfsplus-fix-buffer-overflow-with-a-corrupted-image.patch b/review-2.6.27/hfsplus-fix-buffer-overflow-with-a-corrupted-image.patch similarity index 100% rename from queue-2.6.27/hfsplus-fix-buffer-overflow-with-a-corrupted-image.patch rename to review-2.6.27/hfsplus-fix-buffer-overflow-with-a-corrupted-image.patch diff --git a/queue-2.6.27/hid-fix-incorrent-length-condition-in-hidraw_write.patch b/review-2.6.27/hid-fix-incorrent-length-condition-in-hidraw_write.patch similarity index 100% rename from queue-2.6.27/hid-fix-incorrent-length-condition-in-hidraw_write.patch rename to review-2.6.27/hid-fix-incorrent-length-condition-in-hidraw_write.patch diff --git a/queue-2.6.27/hugetlb-pull-gigantic-page-initialisation-out-of-the-default-path.patch b/review-2.6.27/hugetlb-pull-gigantic-page-initialisation-out-of-the-default-path.patch similarity index 100% rename from queue-2.6.27/hugetlb-pull-gigantic-page-initialisation-out-of-the-default-path.patch rename to review-2.6.27/hugetlb-pull-gigantic-page-initialisation-out-of-the-default-path.patch diff --git a/queue-2.6.27/hugetlbfs-handle-pages-higher-order-than-max_order.patch b/review-2.6.27/hugetlbfs-handle-pages-higher-order-than-max_order.patch similarity index 98% rename from queue-2.6.27/hugetlbfs-handle-pages-higher-order-than-max_order.patch rename to review-2.6.27/hugetlbfs-handle-pages-higher-order-than-max_order.patch index d1d40b62b00..65725203df3 100644 --- a/queue-2.6.27/hugetlbfs-handle-pages-higher-order-than-max_order.patch +++ b/review-2.6.27/hugetlbfs-handle-pages-higher-order-than-max_order.patch @@ -1,7 +1,7 @@ From jejb@kernel.org Mon Nov 10 15:16:22 2008 From: Andy Whitcroft Date: Fri, 7 Nov 2008 00:06:24 GMT -Subject:hugetlbfs: handle pages higher order than MAX_ORDER +Subject: hugetlbfs: handle pages higher order than MAX_ORDER To: stable@kernel.org Message-ID: <200811070006.mA706OTv004171@hera.kernel.org> diff --git a/queue-2.6.27/i-oat-fix-async_tx.callback-checking.patch b/review-2.6.27/i-oat-fix-async_tx.callback-checking.patch similarity index 100% rename from queue-2.6.27/i-oat-fix-async_tx.callback-checking.patch rename to review-2.6.27/i-oat-fix-async_tx.callback-checking.patch diff --git a/queue-2.6.27/i-oat-fix-channel-resources-free-for-not-allocated-channels.patch b/review-2.6.27/i-oat-fix-channel-resources-free-for-not-allocated-channels.patch similarity index 100% rename from queue-2.6.27/i-oat-fix-channel-resources-free-for-not-allocated-channels.patch rename to review-2.6.27/i-oat-fix-channel-resources-free-for-not-allocated-channels.patch diff --git a/queue-2.6.27/i-oat-fix-dma_pin_iovec_pages-error-handling.patch b/review-2.6.27/i-oat-fix-dma_pin_iovec_pages-error-handling.patch similarity index 100% rename from queue-2.6.27/i-oat-fix-dma_pin_iovec_pages-error-handling.patch rename to review-2.6.27/i-oat-fix-dma_pin_iovec_pages-error-handling.patch diff --git a/queue-2.6.27/iwl3945-do-not-send-scan-command-if-channel-count-zero.patch b/review-2.6.27/iwl3945-do-not-send-scan-command-if-channel-count-zero.patch similarity index 100% rename from queue-2.6.27/iwl3945-do-not-send-scan-command-if-channel-count-zero.patch rename to review-2.6.27/iwl3945-do-not-send-scan-command-if-channel-count-zero.patch diff --git a/queue-2.6.27/iwl3945-fix-deadlock-on-suspend.patch b/review-2.6.27/iwl3945-fix-deadlock-on-suspend.patch similarity index 100% rename from queue-2.6.27/iwl3945-fix-deadlock-on-suspend.patch rename to review-2.6.27/iwl3945-fix-deadlock-on-suspend.patch diff --git a/queue-2.6.27/iwlwifi-allow-association-on-radar-channel-in-power-save.patch b/review-2.6.27/iwlwifi-allow-association-on-radar-channel-in-power-save.patch similarity index 100% rename from queue-2.6.27/iwlwifi-allow-association-on-radar-channel-in-power-save.patch rename to review-2.6.27/iwlwifi-allow-association-on-radar-channel-in-power-save.patch diff --git a/queue-2.6.27/iwlwifi-allow-consecutive-scans-in-unassociated-state.patch b/review-2.6.27/iwlwifi-allow-consecutive-scans-in-unassociated-state.patch similarity index 100% rename from queue-2.6.27/iwlwifi-allow-consecutive-scans-in-unassociated-state.patch rename to review-2.6.27/iwlwifi-allow-consecutive-scans-in-unassociated-state.patch diff --git a/queue-2.6.27/iwlwifi-don-t-fail-if-scan-is-issued-too-early.patch b/review-2.6.27/iwlwifi-don-t-fail-if-scan-is-issued-too-early.patch similarity index 100% rename from queue-2.6.27/iwlwifi-don-t-fail-if-scan-is-issued-too-early.patch rename to review-2.6.27/iwlwifi-don-t-fail-if-scan-is-issued-too-early.patch diff --git a/queue-2.6.27/iwlwifi-fix-suspend-to-ram-in-iwlwifi.patch b/review-2.6.27/iwlwifi-fix-suspend-to-ram-in-iwlwifi.patch similarity index 100% rename from queue-2.6.27/iwlwifi-fix-suspend-to-ram-in-iwlwifi.patch rename to review-2.6.27/iwlwifi-fix-suspend-to-ram-in-iwlwifi.patch diff --git a/queue-2.6.27/iwlwifi-generic-init-calibrations-framework.patch b/review-2.6.27/iwlwifi-generic-init-calibrations-framework.patch similarity index 100% rename from queue-2.6.27/iwlwifi-generic-init-calibrations-framework.patch rename to review-2.6.27/iwlwifi-generic-init-calibrations-framework.patch diff --git a/queue-2.6.27/iwlwifi-remove-ht-flags-from-rxon-when-not-in-ht-anymore.patch b/review-2.6.27/iwlwifi-remove-ht-flags-from-rxon-when-not-in-ht-anymore.patch similarity index 100% rename from queue-2.6.27/iwlwifi-remove-ht-flags-from-rxon-when-not-in-ht-anymore.patch rename to review-2.6.27/iwlwifi-remove-ht-flags-from-rxon-when-not-in-ht-anymore.patch diff --git a/queue-2.6.27/iwlwifi-use-correct-dma_mask.patch b/review-2.6.27/iwlwifi-use-correct-dma_mask.patch similarity index 100% rename from queue-2.6.27/iwlwifi-use-correct-dma_mask.patch rename to review-2.6.27/iwlwifi-use-correct-dma_mask.patch diff --git a/queue-2.6.27/jffs2-fix-lack-of-locking-in-thread_should_wake.patch b/review-2.6.27/jffs2-fix-lack-of-locking-in-thread_should_wake.patch similarity index 100% rename from queue-2.6.27/jffs2-fix-lack-of-locking-in-thread_should_wake.patch rename to review-2.6.27/jffs2-fix-lack-of-locking-in-thread_should_wake.patch diff --git a/queue-2.6.27/jffs2-fix-race-condition-in-jffs2_lzo_compress.patch b/review-2.6.27/jffs2-fix-race-condition-in-jffs2_lzo_compress.patch similarity index 100% rename from queue-2.6.27/jffs2-fix-race-condition-in-jffs2_lzo_compress.patch rename to review-2.6.27/jffs2-fix-race-condition-in-jffs2_lzo_compress.patch diff --git a/queue-2.6.27/keys-make-request-key-instantiate-the-per-user-keyrings.patch b/review-2.6.27/keys-make-request-key-instantiate-the-per-user-keyrings.patch similarity index 100% rename from queue-2.6.27/keys-make-request-key-instantiate-the-per-user-keyrings.patch rename to review-2.6.27/keys-make-request-key-instantiate-the-per-user-keyrings.patch diff --git a/queue-2.6.27/libata-fix-last_reset-timestamp-handling.patch b/review-2.6.27/libata-fix-last_reset-timestamp-handling.patch similarity index 100% rename from queue-2.6.27/libata-fix-last_reset-timestamp-handling.patch rename to review-2.6.27/libata-fix-last_reset-timestamp-handling.patch diff --git a/review-2.6.27/mbox b/review-2.6.27/mbox new file mode 100644 index 00000000000..2b63bca1a08 --- /dev/null +++ b/review-2.6.27/mbox @@ -0,0 +1,5617 @@ +From gregkh@mini.kroah.org Tue Nov 11 16:15:50 2008 +Message-Id: <20081112001550.504007585@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:02 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Arthur Jones , + Eric Sandeen , + +Subject: [patch 01/49] ext3: wait on all pending commits in ext3_sync_fs +Content-Disposition: inline; filename=ext3-wait-on-all-pending-commits-in-ext3_sync_fs.patch +Content-Length: 2255 +Lines: 73 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Arthur Jones + +commit c87591b719737b4e91eb1a9fa8fd55a4ff1886d6 upstream + +In ext3_sync_fs, we only wait for a commit to finish if we started it, but +there may be one already in progress which will not be synced. + +In the case of a data=ordered umount with pending long symlinks which are +delayed due to a long list of other I/O on the backing block device, this +causes the buffer associated with the long symlinks to not be moved to the +inode dirty list in the second phase of fsync_super. Then, before they +can be dirtied again, kjournald exits, seeing the UMOUNT flag and the +dirty pages are never written to the backing block device, causing long +symlink corruption and exposing new or previously freed block data to +userspace. + +This can be reproduced with a script created +by Eric Sandeen : + + #!/bin/bash + + umount /mnt/test2 + mount /dev/sdb4 /mnt/test2 + rm -f /mnt/test2/* + dd if=/dev/zero of=/mnt/test2/bigfile bs=1M count=512 + touch + /mnt/test2/thisisveryveryveryveryveryveryveryveryveryveryveryveryveryveryveryverylongfilename + ln -s + /mnt/test2/thisisveryveryveryveryveryveryveryveryveryveryveryveryveryveryveryverylongfilename + /mnt/test2/link + umount /mnt/test2 + mount /dev/sdb4 /mnt/test2 + ls /mnt/test2/ + umount /mnt/test2 + +To ensure all commits are synced, we flush all journal commits now when +sync_fs'ing ext3. + +Signed-off-by: Arthur Jones +Cc: Eric Sandeen +Cc: Theodore Ts'o +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext3/super.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/fs/ext3/super.c ++++ b/fs/ext3/super.c +@@ -2365,13 +2365,12 @@ static void ext3_write_super (struct sup + + static int ext3_sync_fs(struct super_block *sb, int wait) + { +- tid_t target; +- + sb->s_dirt = 0; +- if (journal_start_commit(EXT3_SB(sb)->s_journal, &target)) { +- if (wait) +- log_wait_commit(EXT3_SB(sb)->s_journal, target); +- } ++ if (wait) ++ ext3_force_commit(sb); ++ else ++ journal_start_commit(EXT3_SB(sb)->s_journal, NULL); ++ + return 0; + } + + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:50 2008 +Message-Id: <20081112001550.708816855@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:03 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ingo Molnar +Subject: [patch 02/49] x86: add DMI quirk for AMI BIOS which corrupts address 0xc000 during resume +Content-Disposition: inline; filename=x86-add-dmi-quirk-for-ami-bios-which-corrupts-address-0xc000-during-resume.patch +Content-Length: 2373 +Lines: 81 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ingo Molnar + +commit 5649b7c30316a51792808422ac03ee825d26aa5e upstream + +Alan Jenkins and Andy Wettstein reported a suspend/resume memory +corruption bug and extensively documented it here: + + http://bugzilla.kernel.org/show_bug.cgi?id=11237 + +The bug is that the BIOS overwrites 1K of memory at 0xc000 physical, +without registering it in e820 as reserved or giving the kernel any +idea about this. + +Detect AMI BIOSen and reserve that 1K. + +We paint this bug around with a very broad brush (reserving that 1K on all +AMI BIOS systems), as the bug was extremely hard to find and needed several +weeks and lots of debugging and patching. + +The bug was found via the CONFIG_X86_CHECK_BIOS_CORRUPTION=y debug feature, +if similar bugs are suspected then this feature can be enabled on other +systems as well to scan low memory for corrupted memory. + +Reported-by: Alan Jenkins +Reported-by: Andy Wettstein +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/setup.c | 27 +++++++++++++++++++++++++++ + 1 file changed, 27 insertions(+) + +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -578,6 +578,29 @@ static struct x86_quirks default_x86_qui + + struct x86_quirks *x86_quirks __initdata = &default_x86_quirks; + ++static int __init dmi_low_memory_corruption(const struct dmi_system_id *d) ++{ ++ printk(KERN_NOTICE ++ "%s detected: BIOS corrupts 0xc000, working it around.\n", ++ d->ident); ++ ++ reserve_early(0xc000, 0xc400, "BIOS quirk"); ++ ++ return 0; ++} ++ ++/* List of systems that have known low memory corruption BIOS problems */ ++static struct dmi_system_id __initdata bad_bios_dmi_table[] = { ++ { ++ .callback = dmi_low_memory_corruption, ++ .ident = "AMI BIOS", ++ .matches = { ++ DMI_MATCH(DMI_BIOS_VENDOR, "American Megatrends Inc."), ++ }, ++ }, ++ {} ++}; ++ + /* + * Determine if we were loaded by an EFI loader. If so, then we have also been + * passed the efi memmap, systab, etc., so we should use these data structures +@@ -601,6 +624,8 @@ void __init setup_arch(char **cmdline_p) + printk(KERN_INFO "Command line: %s\n", boot_command_line); + #endif + ++ dmi_check_system(bad_bios_dmi_table); ++ + early_cpu_init(); + early_ioremap_init(); + +@@ -885,3 +910,5 @@ void __init setup_arch(char **cmdline_p) + #endif + #endif + } ++ ++ + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:51 2008 +Message-Id: <20081112001550.943343100@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:04 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ingo Molnar +Subject: [patch 03/49] x86: reserve low 64K on AMI and Phoenix BIOS boxen +Content-Disposition: inline; filename=x86-reserve-low-64k-on-ami-and-phoenix-bios-boxen.patch +Content-Length: 1598 +Lines: 59 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ingo Molnar + +commit 1e22436eba84edfec9c25e5a25d09062c4f91ca9 upstream + +there's multiple reports about suspend/resume related low memory +corruption in this bugzilla: + + http://bugzilla.kernel.org/show_bug.cgi?id=11237 + +the common pattern is that the corruption is caused by the BIOS, +and that it affects some portion of the first 64K of physical RAM. + +So add a DMI quirk + +This will waste 64K RAM on 'good' systems too, but without knowing +the exact nature of this BIOS memory corruption this is the safest +approach. + +This might as well solve a wide range of suspend/resume breakages +under Linux. + +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/setup.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -581,10 +581,10 @@ struct x86_quirks *x86_quirks __initdata + static int __init dmi_low_memory_corruption(const struct dmi_system_id *d) + { + printk(KERN_NOTICE +- "%s detected: BIOS corrupts 0xc000, working it around.\n", ++ "%s detected: BIOS may corrupt low RAM, working it around.\n", + d->ident); + +- reserve_early(0xc000, 0xc400, "BIOS quirk"); ++ reserve_early(0x0, 0x10000, "BIOS quirk"); + + return 0; + } +@@ -598,6 +598,13 @@ static struct dmi_system_id __initdata b + DMI_MATCH(DMI_BIOS_VENDOR, "American Megatrends Inc."), + }, + }, ++ { ++ .callback = dmi_low_memory_corruption, ++ .ident = "Phoenix BIOS", ++ .matches = { ++ DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"), ++ }, ++ }, + {} + }; + + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:51 2008 +Message-Id: <20081112001551.124215739@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:05 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ingo Molnar +Subject: [patch 04/49] x86: add X86_RESERVE_LOW_64K +Content-Disposition: inline; filename=x86-add-x86_reserve_low_64k.patch +Content-Length: 2663 +Lines: 87 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ingo Molnar + +commit fc38151947477596aa27df6c4306ad6008dc6711 upstream. + +This bugzilla: + + http://bugzilla.kernel.org/show_bug.cgi?id=11237 + +Documents a wide range of systems where the BIOS utilizes the first +64K of physical memory during suspend/resume and other hardware events. + +Currently we reserve this memory on all AMI and Phoenix BIOS systems. +Life is too short to hunt subtle memory corruption problems like this, +so we try to be robust by default. + +Still, allow this to be overriden: allow users who want that first 64K +of memory to be available to the kernel disable the quirk, via +CONFIG_X86_RESERVE_LOW_64K=n. + +Also, allow the early reservation to overlap with other +early reservations. + +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/Kconfig | 20 ++++++++++++++++++++ + arch/x86/kernel/setup.c | 4 +++- + 2 files changed, 23 insertions(+), 1 deletion(-) + +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -1059,6 +1059,26 @@ config HIGHPTE + low memory. Setting this option will put user-space page table + entries in high memory. + ++config X86_RESERVE_LOW_64K ++ bool "Reserve low 64K of RAM on AMI/Phoenix BIOSen" ++ default y ++ help ++ Reserve the first 64K of physical RAM on BIOSes that are known ++ to potentially corrupt that memory range. A numbers of BIOSes are ++ known to utilize this area during suspend/resume, so it must not ++ be used by the kernel. ++ ++ Set this to N if you are absolutely sure that you trust the BIOS ++ to get all its memory reservations and usages right. ++ ++ If you have doubts about the BIOS (e.g. suspend/resume does not ++ work or there's kernel crashes after certain hardware hotplug ++ events) and it's not AMI or Phoenix, then you might want to enable ++ X86_CHECK_BIOS_CORRUPTION=y to allow the kernel to check typical ++ corruption patterns. ++ ++ Say Y if unsure. ++ + config MATH_EMULATION + bool + prompt "Math emulation" if X86_32 +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -584,13 +584,14 @@ static int __init dmi_low_memory_corrupt + "%s detected: BIOS may corrupt low RAM, working it around.\n", + d->ident); + +- reserve_early(0x0, 0x10000, "BIOS quirk"); ++ reserve_early_overlap_ok(0x0, 0x10000, "BIOS quirk"); + + return 0; + } + + /* List of systems that have known low memory corruption BIOS problems */ + static struct dmi_system_id __initdata bad_bios_dmi_table[] = { ++#ifdef CONFIG_X86_RESERVE_LOW_64K + { + .callback = dmi_low_memory_corruption, + .ident = "AMI BIOS", +@@ -606,6 +607,7 @@ static struct dmi_system_id __initdata b + }, + }, + {} ++#endif + }; + + /* + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:51 2008 +Message-Id: <20081112001551.291748415@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:06 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ingo Molnar +Subject: [patch 05/49] x86: fix CONFIG_X86_RESERVE_LOW_64K=y +Content-Disposition: inline; filename=x86-fix-config_x86_reserve_low_64k-y.patch +Content-Length: 1577 +Lines: 61 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Yinghai Lu + +commit 2216d199b1430d1c0affb1498a9ebdbd9c0de439 upstream + +The bad_bios_dmi_table() quirk never triggered because we do DMI setup +too late. Move it a bit earlier. + +Also change the CONFIG_X86_RESERVE_LOW_64K quirk to operate on the e820 +table directly instead of messing with early reservations - this handles +overlaps (which do occur in this low range of RAM) more gracefully. + +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/setup.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -584,7 +584,8 @@ static int __init dmi_low_memory_corrupt + "%s detected: BIOS may corrupt low RAM, working it around.\n", + d->ident); + +- reserve_early_overlap_ok(0x0, 0x10000, "BIOS quirk"); ++ e820_update_range(0, 0x10000, E820_RAM, E820_RESERVED); ++ sanitize_e820_map(e820.map, ARRAY_SIZE(e820.map), &e820.nr_map); + + return 0; + } +@@ -633,8 +634,6 @@ void __init setup_arch(char **cmdline_p) + printk(KERN_INFO "Command line: %s\n", boot_command_line); + #endif + +- dmi_check_system(bad_bios_dmi_table); +- + early_cpu_init(); + early_ioremap_init(); + +@@ -733,6 +732,10 @@ void __init setup_arch(char **cmdline_p) + + finish_e820_parsing(); + ++ dmi_scan_machine(); ++ ++ dmi_check_system(bad_bios_dmi_table); ++ + #ifdef CONFIG_X86_32 + probe_roms(); + #endif +@@ -815,8 +818,6 @@ void __init setup_arch(char **cmdline_p) + vsmp_init(); + #endif + +- dmi_scan_machine(); +- + io_delay_init(); + + /* + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:51 2008 +Message-Id: <20081112001551.483805856@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:07 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Yinghai Lu , + Ingo Molnar +Subject: [patch 06/49] x86: fix macro with bad_bios_dmi_table +Content-Disposition: inline; filename=x86-fix-macro-with-bad_bios_dmi_table.patch +Content-Length: 632 +Lines: 30 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Yinghai Lu + +commit a8b71a2810386a5ac8f43d2095fe3355f0d8db37 upstream. + +DMI tables need a blank NULL tail. + +fixes the crash on Ingo's test box. + +Signed-off-by: Yinghai Lu +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/setup.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -607,8 +607,8 @@ static struct dmi_system_id __initdata b + DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"), + }, + }, +- {} + #endif ++ {} + }; + + /* + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:51 2008 +Message-Id: <20081112001551.659780316@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:08 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Li Zefan , + Paul Menage , + Peter Zijlstra , + Ingo Molnar +Subject: [patch 07/49] cgroups: fix invalid cgrp->dentry before cgroup has been completely removed +Content-Disposition: inline; filename=cgroups-fix-invalid-cgrp-dentry-before-cgroup-has-been-completely-removed.patch +Content-Length: 1456 +Lines: 56 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Li Zefan + +commit 24eb089950ce44603b30a3145a2c8520e2b55bb1 upstream + +This fixes an oops when reading /proc/sched_debug. + +A cgroup won't be removed completely until finishing cgroup_diput(), so we +shouldn't invalidate cgrp->dentry in cgroup_rmdir(). Otherwise, when a +group is being removed while cgroup_path() gets called, we may trigger +NULL dereference BUG. + +The bug can be reproduced: + + # cat test.sh + #!/bin/sh + mount -t cgroup -o cpu xxx /mnt + for (( ; ; )) + { + mkdir /mnt/sub + rmdir /mnt/sub + } + # ./test.sh & + # cat /proc/sched_debug + +BUG: unable to handle kernel NULL pointer dereference at 00000038 +IP: [] cgroup_path+0x39/0x90 +.. +Call Trace: + [] ? print_cfs_rq+0x6e/0x75d + [] ? sched_debug_show+0x72d/0xc1e +.. + +Signed-off-by: Li Zefan +Acked-by: Paul Menage +Cc: Peter Zijlstra +Cc: Ingo Molnar +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/cgroup.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/kernel/cgroup.c ++++ b/kernel/cgroup.c +@@ -2443,7 +2443,6 @@ static int cgroup_rmdir(struct inode *un + list_del(&cgrp->sibling); + spin_lock(&cgrp->dentry->d_lock); + d = dget(cgrp->dentry); +- cgrp->dentry = NULL; + spin_unlock(&d->d_lock); + + cgroup_d_remove_dir(d); + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:52 2008 +Message-Id: <20081112001551.856749205@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:09 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andy Whitcroft , + Jon Tollefson , + Mel Gorman , + Nick Piggin , + Christoph Lameter +Subject: [patch 08/49] hugetlb: pull gigantic page initialisation out of the default path +Content-Disposition: inline; filename=hugetlb-pull-gigantic-page-initialisation-out-of-the-default-path.patch +Content-Length: 3954 +Lines: 131 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Andy Whitcroft + +commit 18229df5b613ed0732a766fc37850de2e7988e43 upstream + +As we can determine exactly when a gigantic page is in use we can optimise +the common regular page cases by pulling out gigantic page initialisation +into its own function. As gigantic pages are never released to buddy we +do not need a destructor. This effectivly reverts the previous change to +the main buddy allocator. It also adds a paranoid check to ensure we +never release gigantic pages from hugetlbfs to the main buddy. + +Signed-off-by: Andy Whitcroft +Cc: Jon Tollefson +Cc: Mel Gorman +Cc: Nick Piggin +Cc: Christoph Lameter +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/hugetlb.c | 12 +++++++++++- + mm/internal.h | 1 + + mm/page_alloc.c | 28 +++++++++++++++++++++------- + 3 files changed, 33 insertions(+), 8 deletions(-) + +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -455,6 +455,8 @@ static void update_and_free_page(struct + { + int i; + ++ VM_BUG_ON(h->order >= MAX_ORDER); ++ + h->nr_huge_pages--; + h->nr_huge_pages_node[page_to_nid(page)]--; + for (i = 0; i < pages_per_huge_page(h); i++) { +@@ -969,6 +971,14 @@ found: + return 1; + } + ++static void prep_compound_huge_page(struct page *page, int order) ++{ ++ if (unlikely(order > (MAX_ORDER - 1))) ++ prep_compound_gigantic_page(page, order); ++ else ++ prep_compound_page(page, order); ++} ++ + /* Put bootmem huge pages into the standard lists after mem_map is up */ + static void __init gather_bootmem_prealloc(void) + { +@@ -979,7 +989,7 @@ static void __init gather_bootmem_preall + struct hstate *h = m->hstate; + __ClearPageReserved(page); + WARN_ON(page_count(page) != 1); +- prep_compound_page(page, h->order); ++ prep_compound_huge_page(page, h->order); + prep_new_huge_page(h, page, page_to_nid(page)); + } + } +--- a/mm/internal.h ++++ b/mm/internal.h +@@ -17,6 +17,7 @@ void free_pgtables(struct mmu_gather *tl + unsigned long floor, unsigned long ceiling); + + extern void prep_compound_page(struct page *page, unsigned long order); ++extern void prep_compound_gigantic_page(struct page *page, unsigned long order); + + static inline void set_page_count(struct page *page, int v) + { +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -268,24 +268,39 @@ void prep_compound_page(struct page *pag + { + int i; + int nr_pages = 1 << order; ++ ++ set_compound_page_dtor(page, free_compound_page); ++ set_compound_order(page, order); ++ __SetPageHead(page); ++ for (i = 1; i < nr_pages; i++) { ++ struct page *p = page + i; ++ ++ __SetPageTail(p); ++ p->first_page = page; ++ } ++} ++ ++#ifdef CONFIG_HUGETLBFS ++void prep_compound_gigantic_page(struct page *page, unsigned long order) ++{ ++ int i; ++ int nr_pages = 1 << order; + struct page *p = page + 1; + + set_compound_page_dtor(page, free_compound_page); + set_compound_order(page, order); + __SetPageHead(page); +- for (i = 1; i < nr_pages; i++, p++) { +- if (unlikely((i & (MAX_ORDER_NR_PAGES - 1)) == 0)) +- p = pfn_to_page(page_to_pfn(page) + i); ++ for (i = 1; i < nr_pages; i++, p = mem_map_next(p, page, i)) { + __SetPageTail(p); + p->first_page = page; + } + } ++#endif + + static void destroy_compound_page(struct page *page, unsigned long order) + { + int i; + int nr_pages = 1 << order; +- struct page *p = page + 1; + + if (unlikely(compound_order(page) != order)) + bad_page(page); +@@ -293,9 +308,8 @@ static void destroy_compound_page(struct + if (unlikely(!PageHead(page))) + bad_page(page); + __ClearPageHead(page); +- for (i = 1; i < nr_pages; i++, p++) { +- if (unlikely((i & (MAX_ORDER_NR_PAGES - 1)) == 0)) +- p = pfn_to_page(page_to_pfn(page) + i); ++ for (i = 1; i < nr_pages; i++) { ++ struct page *p = page + i; + + if (unlikely(!PageTail(p) | + (p->first_page != page))) + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:52 2008 +Message-Id: <20081112001552.076721366@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:10 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andy Whitcroft , + Jon Tollefson , + Mel Gorman , + Nick Piggin , + Christoph Lameter +Subject: [patch 09/49] hugetlbfs: handle pages higher order than MAX_ORDER +Content-Disposition: inline; filename=hugetlbfs-handle-pages-higher-order-than-max_order.patch +Content-Length: 4470 +Lines: 142 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Andy Whitcroft + +commit 69d177c2fc702d402b17fdca2190d5a7e3ca55c5 upstream + +When working with hugepages, hugetlbfs assumes that those hugepages are +smaller than MAX_ORDER. Specifically it assumes that the mem_map is +contigious and uses that to optimise access to the elements of the mem_map +that represent the hugepage. Gigantic pages (such as 16GB pages on +powerpc) by definition are of greater order than MAX_ORDER (larger than +MAX_ORDER_NR_PAGES in size). This means that we can no longer make use of +the buddy alloctor guarentees for the contiguity of the mem_map, which +ensures that the mem_map is at least contigious for maximmally aligned +areas of MAX_ORDER_NR_PAGES pages. + +This patch adds new mem_map accessors and iterator helpers which handle +any discontiguity at MAX_ORDER_NR_PAGES boundaries. It then uses these to +implement gigantic page versions of copy_huge_page and clear_huge_page, +and to allow follow_hugetlb_page handle gigantic pages. + +Signed-off-by: Andy Whitcroft +Cc: Jon Tollefson +Cc: Mel Gorman +Cc: Nick Piggin +Cc: Christoph Lameter +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds + +--- + mm/hugetlb.c | 37 ++++++++++++++++++++++++++++++++++++- + mm/internal.h | 28 ++++++++++++++++++++++++++++ + 2 files changed, 64 insertions(+), 1 deletion(-) + +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -353,11 +353,26 @@ static int vma_has_reserves(struct vm_ar + return 0; + } + ++static void clear_gigantic_page(struct page *page, ++ unsigned long addr, unsigned long sz) ++{ ++ int i; ++ struct page *p = page; ++ ++ might_sleep(); ++ for (i = 0; i < sz/PAGE_SIZE; i++, p = mem_map_next(p, page, i)) { ++ cond_resched(); ++ clear_user_highpage(p, addr + i * PAGE_SIZE); ++ } ++} + static void clear_huge_page(struct page *page, + unsigned long addr, unsigned long sz) + { + int i; + ++ if (unlikely(sz > MAX_ORDER_NR_PAGES)) ++ return clear_gigantic_page(page, addr, sz); ++ + might_sleep(); + for (i = 0; i < sz/PAGE_SIZE; i++) { + cond_resched(); +@@ -365,12 +380,32 @@ static void clear_huge_page(struct page + } + } + ++static void copy_gigantic_page(struct page *dst, struct page *src, ++ unsigned long addr, struct vm_area_struct *vma) ++{ ++ int i; ++ struct hstate *h = hstate_vma(vma); ++ struct page *dst_base = dst; ++ struct page *src_base = src; ++ might_sleep(); ++ for (i = 0; i < pages_per_huge_page(h); ) { ++ cond_resched(); ++ copy_user_highpage(dst, src, addr + i*PAGE_SIZE, vma); ++ ++ i++; ++ dst = mem_map_next(dst, dst_base, i); ++ src = mem_map_next(src, src_base, i); ++ } ++} + static void copy_huge_page(struct page *dst, struct page *src, + unsigned long addr, struct vm_area_struct *vma) + { + int i; + struct hstate *h = hstate_vma(vma); + ++ if (unlikely(pages_per_huge_page(h) > MAX_ORDER_NR_PAGES)) ++ return copy_gigantic_page(dst, src, addr, vma); ++ + might_sleep(); + for (i = 0; i < pages_per_huge_page(h); i++) { + cond_resched(); +@@ -2113,7 +2148,7 @@ int follow_hugetlb_page(struct mm_struct + same_page: + if (pages) { + get_page(page); +- pages[i] = page + pfn_offset; ++ pages[i] = mem_map_offset(page, pfn_offset); + } + + if (vmas) +--- a/mm/internal.h ++++ b/mm/internal.h +@@ -54,6 +54,34 @@ static inline unsigned long page_order(s + } + + /* ++ * Return the mem_map entry representing the 'offset' subpage within ++ * the maximally aligned gigantic page 'base'. Handle any discontiguity ++ * in the mem_map at MAX_ORDER_NR_PAGES boundaries. ++ */ ++static inline struct page *mem_map_offset(struct page *base, int offset) ++{ ++ if (unlikely(offset >= MAX_ORDER_NR_PAGES)) ++ return pfn_to_page(page_to_pfn(base) + offset); ++ return base + offset; ++} ++ ++/* ++ * Iterator over all subpages withing the maximally aligned gigantic ++ * page 'base'. Handle any discontiguity in the mem_map. ++ */ ++static inline struct page *mem_map_next(struct page *iter, ++ struct page *base, int offset) ++{ ++ if (unlikely((offset & (MAX_ORDER_NR_PAGES - 1)) == 0)) { ++ unsigned long pfn = page_to_pfn(base) + offset; ++ if (!pfn_valid(pfn)) ++ return NULL; ++ return pfn_to_page(pfn); ++ } ++ return iter + 1; ++} ++ ++/* + * FLATMEM and DISCONTIGMEM configurations use alloc_bootmem_node, + * so all functions starting at paging_init should be marked __init + * in those cases. SPARSEMEM, however, allows for memory hotplug, + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:52 2008 +Message-Id: <20081112001552.250290632@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:11 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mike Miller , + FUJITA Tomonori , + Jens Axboe +Subject: [patch 10/49] cciss: fix regression firmware not displayed in procfs +Content-Disposition: inline; filename=cciss-fix-regression-firmware-not-displayed-in-procfs.patch +Content-Length: 2205 +Lines: 70 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mike Miller + +commit 22bece00dc1f28dd3374c55e464c9f02eb642876 upstream + +This regression was introduced by commit +6ae5ce8e8d4de666f31286808d2285aa6a50fa40 ("cciss: remove redundant code"). + +This patch fixes a regression where the controller firmware version is not +displayed in procfs. The previous patch would be called anytime something +changed. This will get called only once for each controller. + +Signed-off-by: Mike Miller +Cc: FUJITA Tomonori +Cc: Jens Axboe +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/cciss.c | 23 ++++++++++++++++++++++- + 1 file changed, 22 insertions(+), 1 deletion(-) + +--- a/drivers/block/cciss.c ++++ b/drivers/block/cciss.c +@@ -3403,7 +3403,8 @@ static int __devinit cciss_init_one(stru + int i; + int j = 0; + int rc; +- int dac; ++ int dac, return_code; ++ InquiryData_struct *inq_buff = NULL; + + i = alloc_cciss_hba(); + if (i < 0) +@@ -3509,6 +3510,25 @@ static int __devinit cciss_init_one(stru + /* Turn the interrupts on so we can service requests */ + hba[i]->access.set_intr_mask(hba[i], CCISS_INTR_ON); + ++ /* Get the firmware version */ ++ inq_buff = kzalloc(sizeof(InquiryData_struct), GFP_KERNEL); ++ if (inq_buff == NULL) { ++ printk(KERN_ERR "cciss: out of memory\n"); ++ goto clean4; ++ } ++ ++ return_code = sendcmd_withirq(CISS_INQUIRY, i, inq_buff, ++ sizeof(InquiryData_struct), 0, 0 , 0, TYPE_CMD); ++ if (return_code == IO_OK) { ++ hba[i]->firm_ver[0] = inq_buff->data_byte[32]; ++ hba[i]->firm_ver[1] = inq_buff->data_byte[33]; ++ hba[i]->firm_ver[2] = inq_buff->data_byte[34]; ++ hba[i]->firm_ver[3] = inq_buff->data_byte[35]; ++ } else { /* send command failed */ ++ printk(KERN_WARNING "cciss: unable to determine firmware" ++ " version of controller\n"); ++ } ++ + cciss_procinit(i); + + hba[i]->cciss_max_sectors = 2048; +@@ -3519,6 +3539,7 @@ static int __devinit cciss_init_one(stru + return 1; + + clean4: ++ kfree(inq_buff); + #ifdef CONFIG_CISS_SCSI_TAPE + kfree(hba[i]->scsi_rejects.complete); + #endif + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:52 2008 +Message-Id: <20081112001552.440437005@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:12 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mike Miller , + Jens Axboe +Subject: [patch 11/49] cciss: fix sysfs broken symlink regression +Content-Disposition: inline; filename=cciss-fix-sysfs-broken-symlink-regression.patch +Content-Length: 1242 +Lines: 35 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mike Miller + +commit 404443081ce5e6f68b5f7eda16c959835ff200c0 upstream + +Regression introduced by commit 6ae5ce8e8d4de666f31286808d2285aa6a50fa40 +("cciss: remove redundant code"). + +This patch fixes a broken symlink in sysfs that was introduced by the +above commit. We broke it in 2.6.27-rc on or about 20080804. Some +installers are broken if this symlink does not exist and they may not +detect the logical drives configured on the controller. It does not +require being backported into 2.6.26.x or earlier kernels. + +Signed-off-by: Mike Miller +Cc: Jens Axboe +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/cciss.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/block/cciss.c ++++ b/drivers/block/cciss.c +@@ -1365,6 +1365,7 @@ static void cciss_add_disk(ctlr_info_t * + disk->first_minor = drv_index << NWD_SHIFT; + disk->fops = &cciss_fops; + disk->private_data = &h->drv[drv_index]; ++ disk->driverfs_dev = &h->pdev->dev; + + /* Set up queue information */ + blk_queue_bounce_limit(disk->queue, h->pdev->dma_mask); + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:52 2008 +Message-Id: <20081112001552.666836100@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:13 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mike Miller , + Jens Axboe +Subject: [patch 12/49] cciss: new hardware support +Content-Disposition: inline; filename=cciss-new-hardware-support.patch +Content-Length: 1732 +Lines: 52 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mike Miller + +commit 77ca7286d10b798e4907af941f29672bf484db77 upstream + +cciss: new hardware support + +Add support for 2 new SAS/SATA controllers. + +Signed-off-by: Mike Miller +Cc: Jens Axboe +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/cciss.txt | 2 ++ + drivers/block/cciss.c | 4 ++++ + 2 files changed, 6 insertions(+) + +--- a/Documentation/cciss.txt ++++ b/Documentation/cciss.txt +@@ -26,6 +26,8 @@ This driver is known to work with the fo + * SA P410i + * SA P411 + * SA P812 ++ * SA P712m ++ * SA P711m + + Detecting drive failures: + ------------------------- +--- a/drivers/block/cciss.c ++++ b/drivers/block/cciss.c +@@ -96,6 +96,8 @@ static const struct pci_device_id cciss_ + {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x3245}, + {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x3247}, + {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x3249}, ++ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x324A}, ++ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x324B}, + {PCI_VENDOR_ID_HP, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, + PCI_CLASS_STORAGE_RAID << 8, 0xffff << 8, 0}, + {0,} +@@ -133,6 +135,8 @@ static struct board_type products[] = { + {0x3245103C, "Smart Array P410i", &SA5_access}, + {0x3247103C, "Smart Array P411", &SA5_access}, + {0x3249103C, "Smart Array P812", &SA5_access}, ++ {0x324A103C, "Smart Array P712m", &SA5_access}, ++ {0x324B103C, "Smart Array P711m", &SA5_access}, + {0xFFFF103C, "Unknown Smart Array", &SA5_access}, + }; + + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:52 2008 +Message-Id: <20081112001552.840807024@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:14 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andre Noll , + NeilBrown +Subject: [patch 13/49] md: linear: Fix a division by zero bug for very small arrays. +Content-Disposition: inline; filename=md-linear-fix-a-division-by-zero-bug-for-very-small-arrays.patch +Content-Length: 1300 +Lines: 40 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Andre Noll + +commit f1cd14ae52985634d0389e934eba25b5ecf24565 upstream + +Date: Thu, 6 Nov 2008 19:41:24 +1100 +Subject: [patch 13/49] md: linear: Fix a division by zero bug for very small arrays. + +We currently oops with a divide error on starting a linear software +raid array consisting of at least two very small (< 500K) devices. + +The bug is caused by the calculation of the hash table size which +tries to compute sector_div(sz, base) with "base" being zero due to +the small size of the component devices of the array. + +Fix this by requiring the hash spacing to be at least one which +implies that also "base" is non-zero. + +This bug has existed since about 2.6.14. + +Signed-off-by: Andre Noll +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/linear.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/md/linear.c ++++ b/drivers/md/linear.c +@@ -157,6 +157,8 @@ static linear_conf_t *linear_conf(mddev_ + + min_spacing = conf->array_sectors / 2; + sector_div(min_spacing, PAGE_SIZE/sizeof(struct dev_info *)); ++ if (min_spacing == 0) ++ min_spacing = 1; + + /* min_spacing is the minimum spacing that will fit the hash + * table in one PAGE. This may be much smaller than needed. + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:53 2008 +Message-Id: <20081112001553.005045497@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:15 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Thomas Backlund , + George Spelvin , + NeilBrown +Subject: [patch 14/49] md: fix bug in raid10 recovery. +Content-Disposition: inline; filename=md-fix-bug-in-raid10-recovery.patch +Content-Length: 868 +Lines: 33 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Neil Brown + +commit a53a6c85756339f82ff19e001e90cfba2d6299a8 upstream + +Adding a spare to a raid10 doesn't cause recovery to start. +This is due to an silly type in + commit 6c2fce2ef6b4821c21b5c42c7207cb9cf8c87eda +and so is a bug in 2.6.27 and .28-rc. + +Thanks to Thomas Backlund for bisecting to find this. + +Cc: Thomas Backlund +Cc: George Spelvin +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/raid10.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -1132,7 +1132,7 @@ static int raid10_add_disk(mddev_t *mdde + if (!enough(conf)) + return -EINVAL; + +- if (rdev->raid_disk) ++ if (rdev->raid_disk >= 0) + first = last = rdev->raid_disk; + + if (rdev->saved_raid_disk >= 0 && + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:53 2008 +Message-Id: <20081112001553.208290602@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:16 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Geert Uytterhoeven , + Richard Purdie , + David Woodhouse +Subject: [patch 15/49] JFFS2: fix race condition in jffs2_lzo_compress() +Content-Disposition: inline; filename=jffs2-fix-race-condition-in-jffs2_lzo_compress.patch +Content-Length: 1722 +Lines: 61 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Geert Uytterhoeven + +commit dc8a0843a435b2c0891e7eaea64faaf1ebec9b11 upstream + +deflate_mutex protects the globals lzo_mem and lzo_compress_buf. However, +jffs2_lzo_compress() unlocks deflate_mutex _before_ it has copied out the +compressed data from lzo_compress_buf. Correct this by moving the mutex +unlock after the copy. + +In addition, document what deflate_mutex actually protects. + +Signed-off-by: Geert Uytterhoeven +Acked-by: Richard Purdie +Signed-off-by: Andrew Morton +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jffs2/compr_lzo.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/fs/jffs2/compr_lzo.c ++++ b/fs/jffs2/compr_lzo.c +@@ -19,7 +19,7 @@ + + static void *lzo_mem; + static void *lzo_compress_buf; +-static DEFINE_MUTEX(deflate_mutex); ++static DEFINE_MUTEX(deflate_mutex); /* for lzo_mem and lzo_compress_buf */ + + static void free_workspace(void) + { +@@ -49,18 +49,21 @@ static int jffs2_lzo_compress(unsigned c + + mutex_lock(&deflate_mutex); + ret = lzo1x_1_compress(data_in, *sourcelen, lzo_compress_buf, &compress_size, lzo_mem); +- mutex_unlock(&deflate_mutex); +- + if (ret != LZO_E_OK) +- return -1; ++ goto fail; + + if (compress_size > *dstlen) +- return -1; ++ goto fail; + + memcpy(cpage_out, lzo_compress_buf, compress_size); +- *dstlen = compress_size; ++ mutex_unlock(&deflate_mutex); + ++ *dstlen = compress_size; + return 0; ++ ++ fail: ++ mutex_unlock(&deflate_mutex); ++ return -1; + } + + static int jffs2_lzo_decompress(unsigned char *data_in, unsigned char *cpage_out, + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:53 2008 +Message-Id: <20081112001553.449773668@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:17 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + David Woodhouse +Subject: [patch 16/49] JFFS2: Fix lack of locking in thread_should_wake() +Content-Disposition: inline; filename=jffs2-fix-lack-of-locking-in-thread_should_wake.patch +Content-Length: 1421 +Lines: 42 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: David Woodhouse + +commit b27cf88e9592953ae292d05324887f2f44979433 upstream + +The thread_should_wake() function trawls through the list of 'very +dirty' eraseblocks, determining whether the background GC thread should +wake. Doing this without holding the appropriate locks is a bad idea. + +OLPC Trac #8615 + +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jffs2/background.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/fs/jffs2/background.c ++++ b/fs/jffs2/background.c +@@ -85,15 +85,15 @@ static int jffs2_garbage_collect_thread( + for (;;) { + allow_signal(SIGHUP); + again: ++ spin_lock(&c->erase_completion_lock); + if (!jffs2_thread_should_wake(c)) { + set_current_state (TASK_INTERRUPTIBLE); ++ spin_unlock(&c->erase_completion_lock); + D1(printk(KERN_DEBUG "jffs2_garbage_collect_thread sleeping...\n")); +- /* Yes, there's a race here; we checked jffs2_thread_should_wake() +- before setting current->state to TASK_INTERRUPTIBLE. But it doesn't +- matter - We don't care if we miss a wakeup, because the GC thread +- is only an optimisation anyway. */ + schedule(); +- } ++ } else ++ spin_unlock(&c->erase_completion_lock); ++ + + /* This thread is purely an optimisation. But if it runs when + other things could be running, it actually makes things a + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:53 2008 +Message-Id: <20081112001553.648076663@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:18 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Haavard Skinnemoen , + Lothar Wafmann , + Lennert Buytenhek , + Eric Miao , + Dan Williams +Subject: [patch 17/49] ARM: xsc3: fix xsc3_l2_inv_range +Content-Disposition: inline; filename=arm-xsc3-fix-xsc3_l2_inv_range.patch +Content-Length: 1489 +Lines: 48 + + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Dan Williams + +commit c7cf72dcadbe39c2077b32460f86c9f8167be3be upstream + +When 'start' and 'end' are less than a cacheline apart and 'start' is +unaligned we are done after cleaning and invalidating the first +cacheline. So check for (start < end) which will not walk off into +invalid address ranges when (start > end). + +This issue was caught by drivers/dma/dmatest. + +2.6.27 is susceptible. + +Cc: +Cc: Haavard Skinnemoen +Cc: Lothar Wafmann +Cc: Lennert Buytenhek +Cc: Eric Miao +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mm/cache-xsc3l2.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/mm/cache-xsc3l2.c ++++ b/arch/arm/mm/cache-xsc3l2.c +@@ -97,7 +97,7 @@ static void xsc3_l2_inv_range(unsigned l + /* + * Clean and invalidate partial last cache line. + */ +- if (end & (CACHE_LINE_SIZE - 1)) { ++ if (start < end && (end & (CACHE_LINE_SIZE - 1))) { + xsc3_l2_clean_pa(end & ~(CACHE_LINE_SIZE - 1)); + xsc3_l2_inv_pa(end & ~(CACHE_LINE_SIZE - 1)); + end &= ~(CACHE_LINE_SIZE - 1); +@@ -106,7 +106,7 @@ static void xsc3_l2_inv_range(unsigned l + /* + * Invalidate all full cache lines between 'start' and 'end'. + */ +- while (start != end) { ++ while (start < end) { + xsc3_l2_inv_pa(start); + start += CACHE_LINE_SIZE; + } + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:53 2008 +Message-Id: <20081112001553.827221918@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:19 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + jejb@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Eric W. Biederman" , + David Woodhouse +Subject: [patch 18/49] MTD: Fix cfi_send_gen_cmd handling of x16 devices in x8 mode (v4) +Content-Disposition: inline; filename=mtd-fix-cfi_send_gen_cmd-handling-of-x16-devices-in-x8-mode.patch +Content-Length: 4996 +Lines: 133 + + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Eric W. Biederman + +commit 467622ef2acb01986eab37ef96c3632b3ea35999 upstream + +For "unlock" cycles to 16bit devices in 8bit compatibility mode we need +to use the byte addresses 0xaaa and 0x555. These effectively match +the word address 0x555 and 0x2aa, except the latter has its low bit set. + +Most chips don't care about the value of the 'A-1' pin in x8 mode, +but some -- like the ST M29W320D -- do. So we need to be careful to +set it where appropriate. + +cfi_send_gen_cmd is only ever passed addresses where the low byte +is 0x00, 0x55 or 0xaa. Of those, only addresses ending 0xaa are +affected by this patch, by masking in the extra low bit when the device +is known to be in compatibility mode. + +[dwmw2: Do it only when (cmd_ofs & 0xff) == 0xaa] +v4: Fix stupid typo in cfi_build_cmd_addr that failed to compile + I'm writing this patch way to late at night. +v3: Bring all of the work back into cfi_build_cmd_addr + including calling of map_bankwidth(map) and cfi_interleave(cfi) + So every caller doesn't need to. +v2: Only modified the address if we our device_type is larger than our + bus width. + +Signed-off-by: Eric W. Biederman +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/chips/cfi_cmdset_0002.c | 13 ------------- + drivers/mtd/chips/jedec_probe.c | 10 ++++------ + include/linux/mtd/cfi.h | 22 +++++++++++++++++++--- + 3 files changed, 23 insertions(+), 22 deletions(-) + +--- a/drivers/mtd/chips/cfi_cmdset_0002.c ++++ b/drivers/mtd/chips/cfi_cmdset_0002.c +@@ -362,19 +362,6 @@ struct mtd_info *cfi_cmdset_0002(struct + /* Set the default CFI lock/unlock addresses */ + cfi->addr_unlock1 = 0x555; + cfi->addr_unlock2 = 0x2aa; +- /* Modify the unlock address if we are in compatibility mode */ +- if ( /* x16 in x8 mode */ +- ((cfi->device_type == CFI_DEVICETYPE_X8) && +- (cfi->cfiq->InterfaceDesc == +- CFI_INTERFACE_X8_BY_X16_ASYNC)) || +- /* x32 in x16 mode */ +- ((cfi->device_type == CFI_DEVICETYPE_X16) && +- (cfi->cfiq->InterfaceDesc == +- CFI_INTERFACE_X16_BY_X32_ASYNC))) +- { +- cfi->addr_unlock1 = 0xaaa; +- cfi->addr_unlock2 = 0x555; +- } + + } /* CFI mode */ + else if (cfi->cfi_mode == CFI_MODE_JEDEC) { +--- a/drivers/mtd/chips/jedec_probe.c ++++ b/drivers/mtd/chips/jedec_probe.c +@@ -1808,9 +1808,7 @@ static inline u32 jedec_read_mfr(struct + * several first banks can contain 0x7f instead of actual ID + */ + do { +- uint32_t ofs = cfi_build_cmd_addr(0 + (bank << 8), +- cfi_interleave(cfi), +- cfi->device_type); ++ uint32_t ofs = cfi_build_cmd_addr(0 + (bank << 8), map, cfi); + mask = (1 << (cfi->device_type * 8)) - 1; + result = map_read(map, base + ofs); + bank++; +@@ -1824,7 +1822,7 @@ static inline u32 jedec_read_id(struct m + { + map_word result; + unsigned long mask; +- u32 ofs = cfi_build_cmd_addr(1, cfi_interleave(cfi), cfi->device_type); ++ u32 ofs = cfi_build_cmd_addr(1, map, cfi); + mask = (1 << (cfi->device_type * 8)) -1; + result = map_read(map, base + ofs); + return result.x[0] & mask; +@@ -2067,8 +2065,8 @@ static int jedec_probe_chip(struct map_i + + } + /* Ensure the unlock addresses we try stay inside the map */ +- probe_offset1 = cfi_build_cmd_addr(cfi->addr_unlock1, cfi_interleave(cfi), cfi->device_type); +- probe_offset2 = cfi_build_cmd_addr(cfi->addr_unlock2, cfi_interleave(cfi), cfi->device_type); ++ probe_offset1 = cfi_build_cmd_addr(cfi->addr_unlock1, map, cfi); ++ probe_offset2 = cfi_build_cmd_addr(cfi->addr_unlock2, map, cfi); + if ( ((base + probe_offset1 + map_bankwidth(map)) >= map->size) || + ((base + probe_offset2 + map_bankwidth(map)) >= map->size)) + goto retry; +--- a/include/linux/mtd/cfi.h ++++ b/include/linux/mtd/cfi.h +@@ -281,9 +281,25 @@ struct cfi_private { + /* + * Returns the command address according to the given geometry. + */ +-static inline uint32_t cfi_build_cmd_addr(uint32_t cmd_ofs, int interleave, int type) ++static inline uint32_t cfi_build_cmd_addr(uint32_t cmd_ofs, ++ struct map_info *map, struct cfi_private *cfi) + { +- return (cmd_ofs * type) * interleave; ++ unsigned bankwidth = map_bankwidth(map); ++ unsigned interleave = cfi_interleave(cfi); ++ unsigned type = cfi->device_type; ++ uint32_t addr; ++ ++ addr = (cmd_ofs * type) * interleave; ++ ++ /* Modify the unlock address if we are in compatiblity mode. ++ * For 16bit devices on 8 bit busses ++ * and 32bit devices on 16 bit busses ++ * set the low bit of the alternating bit sequence of the address. ++ */ ++ if (((type * interleave) > bankwidth) && ((uint8_t)cmd_ofs == 0xaa)) ++ addr |= (type >> 1)*interleave; ++ ++ return addr; + } + + /* +@@ -429,7 +445,7 @@ static inline uint32_t cfi_send_gen_cmd( + int type, map_word *prev_val) + { + map_word val; +- uint32_t addr = base + cfi_build_cmd_addr(cmd_addr, cfi_interleave(cfi), type); ++ uint32_t addr = base + cfi_build_cmd_addr(cmd_addr, map, cfi); + + val = cfi_build_cmd(cmd, map, cfi); + + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:54 2008 +Message-Id: <20081112001554.017819396@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:20 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + jejb@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alok N Kataria , + Ingo Molnar +Subject: [patch 19/49] x86: dont use tsc_khz to calculate lpj if notsc is passed +Content-Disposition: inline; filename=x86-don-t-use-tsc_khz-to-calculate-lpj-if-notsc-is-passed.patch +Content-Length: 1239 +Lines: 45 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alok Kataria + +commit 70de9a97049e0ba79dc040868564408d5ce697f9 upstream + +Impact: fix udelay when "notsc" boot parameter is passed + +With notsc passed on commandline, tsc may not be used for +udelays, make sure that we do not use tsc_khz to calculate +the lpj value in such cases. + +Reported-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Alok N Kataria +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/tsc.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/x86/kernel/tsc.c ++++ b/arch/x86/kernel/tsc.c +@@ -639,10 +639,6 @@ void __init tsc_init(void) + cpu_khz = calibrate_cpu(); + #endif + +- lpj = ((u64)tsc_khz * 1000); +- do_div(lpj, HZ); +- lpj_fine = lpj; +- + printk("Detected %lu.%03lu MHz processor.\n", + (unsigned long)cpu_khz / 1000, + (unsigned long)cpu_khz % 1000); +@@ -662,6 +658,10 @@ void __init tsc_init(void) + /* now allow native_sched_clock() to use rdtsc */ + tsc_disabled = 0; + ++ lpj = ((u64)tsc_khz * 1000); ++ do_div(lpj, HZ); ++ lpj_fine = lpj; ++ + use_tsc_delay(); + /* Check and install the TSC clocksource */ + dmi_check_system(bad_tsc_dmi_table); + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:54 2008 +Message-Id: <20081112001554.193107596@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:21 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Miklos Szeredi +Subject: [patch 20/49] net: unix: fix inflight counting bug in garbage collector +Content-Disposition: inline; filename=net-unix-fix-inflight-counting-bug-in-garbage-collector.patch +Content-Length: 6400 +Lines: 202 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Miklos Szeredi + +commit 6209344f5a3795d34b7f2c0061f49802283b6bdd upstream + +Previously I assumed that the receive queues of candidates don't +change during the GC. This is only half true, nothing can be received +from the queues (see comment in unix_gc()), but buffers could be added +through the other half of the socket pair, which may still have file +descriptors referring to it. + +This can result in inc_inflight_move_tail() erronously increasing the +"inflight" counter for a unix socket for which dec_inflight() wasn't +previously called. This in turn can trigger the "BUG_ON(total_refs < +inflight_refs)" in a later garbage collection run. + +Fix this by only manipulating the "inflight" counter for sockets which +are candidates themselves. Duplicating the file references in +unix_attach_fds() is also needed to prevent a socket becoming a +candidate for GC while the skb that contains it is not yet queued. + +Reported-by: Andrea Bittau +Signed-off-by: Miklos Szeredi +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + include/net/af_unix.h | 1 + + net/unix/af_unix.c | 31 ++++++++++++++++++++++++------- + net/unix/garbage.c | 49 +++++++++++++++++++++++++++++++++++++------------ + 3 files changed, 62 insertions(+), 19 deletions(-) + +--- a/include/net/af_unix.h ++++ b/include/net/af_unix.h +@@ -54,6 +54,7 @@ struct unix_sock { + atomic_long_t inflight; + spinlock_t lock; + unsigned int gc_candidate : 1; ++ unsigned int gc_maybe_cycle : 1; + wait_queue_head_t peer_wait; + }; + #define unix_sk(__sk) ((struct unix_sock *)__sk) +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -1300,14 +1300,23 @@ static void unix_destruct_fds(struct sk_ + sock_wfree(skb); + } + +-static void unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb) ++static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb) + { + int i; ++ ++ /* ++ * Need to duplicate file references for the sake of garbage ++ * collection. Otherwise a socket in the fps might become a ++ * candidate for GC while the skb is not yet queued. ++ */ ++ UNIXCB(skb).fp = scm_fp_dup(scm->fp); ++ if (!UNIXCB(skb).fp) ++ return -ENOMEM; ++ + for (i=scm->fp->count-1; i>=0; i--) + unix_inflight(scm->fp->fp[i]); +- UNIXCB(skb).fp = scm->fp; + skb->destructor = unix_destruct_fds; +- scm->fp = NULL; ++ return 0; + } + + /* +@@ -1366,8 +1375,11 @@ static int unix_dgram_sendmsg(struct kio + goto out; + + memcpy(UNIXCREDS(skb), &siocb->scm->creds, sizeof(struct ucred)); +- if (siocb->scm->fp) +- unix_attach_fds(siocb->scm, skb); ++ if (siocb->scm->fp) { ++ err = unix_attach_fds(siocb->scm, skb); ++ if (err) ++ goto out_free; ++ } + unix_get_secdata(siocb->scm, skb); + + skb_reset_transport_header(skb); +@@ -1536,8 +1548,13 @@ static int unix_stream_sendmsg(struct ki + size = min_t(int, size, skb_tailroom(skb)); + + memcpy(UNIXCREDS(skb), &siocb->scm->creds, sizeof(struct ucred)); +- if (siocb->scm->fp) +- unix_attach_fds(siocb->scm, skb); ++ if (siocb->scm->fp) { ++ err = unix_attach_fds(siocb->scm, skb); ++ if (err) { ++ kfree_skb(skb); ++ goto out_err; ++ } ++ } + + if ((err = memcpy_fromiovec(skb_put(skb,size), msg->msg_iov, size)) != 0) { + kfree_skb(skb); +--- a/net/unix/garbage.c ++++ b/net/unix/garbage.c +@@ -186,8 +186,17 @@ static void scan_inflight(struct sock *x + */ + struct sock *sk = unix_get_socket(*fp++); + if (sk) { +- hit = true; +- func(unix_sk(sk)); ++ struct unix_sock *u = unix_sk(sk); ++ ++ /* ++ * Ignore non-candidates, they could ++ * have been added to the queues after ++ * starting the garbage collection ++ */ ++ if (u->gc_candidate) { ++ hit = true; ++ func(u); ++ } + } + } + if (hit && hitlist != NULL) { +@@ -249,11 +258,11 @@ static void inc_inflight_move_tail(struc + { + atomic_long_inc(&u->inflight); + /* +- * If this is still a candidate, move it to the end of the +- * list, so that it's checked even if it was already passed +- * over ++ * If this still might be part of a cycle, move it to the end ++ * of the list, so that it's checked even if it was already ++ * passed over + */ +- if (u->gc_candidate) ++ if (u->gc_maybe_cycle) + list_move_tail(&u->link, &gc_candidates); + } + +@@ -267,6 +276,7 @@ void unix_gc(void) + struct unix_sock *next; + struct sk_buff_head hitlist; + struct list_head cursor; ++ LIST_HEAD(not_cycle_list); + + spin_lock(&unix_gc_lock); + +@@ -282,10 +292,14 @@ void unix_gc(void) + * + * Holding unix_gc_lock will protect these candidates from + * being detached, and hence from gaining an external +- * reference. This also means, that since there are no +- * possible receivers, the receive queues of these sockets are +- * static during the GC, even though the dequeue is done +- * before the detach without atomicity guarantees. ++ * reference. Since there are no possible receivers, all ++ * buffers currently on the candidates' queues stay there ++ * during the garbage collection. ++ * ++ * We also know that no new candidate can be added onto the ++ * receive queues. Other, non candidate sockets _can_ be ++ * added to queue, so we must make sure only to touch ++ * candidates. + */ + list_for_each_entry_safe(u, next, &gc_inflight_list, link) { + long total_refs; +@@ -299,6 +313,7 @@ void unix_gc(void) + if (total_refs == inflight_refs) { + list_move_tail(&u->link, &gc_candidates); + u->gc_candidate = 1; ++ u->gc_maybe_cycle = 1; + } + } + +@@ -325,14 +340,24 @@ void unix_gc(void) + list_move(&cursor, &u->link); + + if (atomic_long_read(&u->inflight) > 0) { +- list_move_tail(&u->link, &gc_inflight_list); +- u->gc_candidate = 0; ++ list_move_tail(&u->link, ¬_cycle_list); ++ u->gc_maybe_cycle = 0; + scan_children(&u->sk, inc_inflight_move_tail, NULL); + } + } + list_del(&cursor); + + /* ++ * not_cycle_list contains those sockets which do not make up a ++ * cycle. Restore these to the inflight list. ++ */ ++ while (!list_empty(¬_cycle_list)) { ++ u = list_entry(not_cycle_list.next, struct unix_sock, link); ++ u->gc_candidate = 0; ++ list_move_tail(&u->link, &gc_inflight_list); ++ } ++ ++ /* + * Now gc_candidates contains only garbage. Restore original + * inflight counters for these as well, and remove the skbuffs + * which are creating the cycle(s). + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:54 2008 +Message-Id: <20081112001554.380363029@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:22 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ivan Vecera , + Edward Hsu , + Jeff Garzik , + Martin Capitanio , + Francois Romieu +Subject: [patch 21/49] r8169: get ethtool settings through the generic mii helper +Content-Disposition: inline; filename=r8169-get-ethtool-settings-through-the-generic-mii-helper.patch +Content-Length: 6826 +Lines: 224 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Francois Romieu + +Upstream as ccdffb9a88b2907b159538d7bfd6256621db4f84 (post 2.6.27). + +It avoids to report unsupported link capabilities with +the fast-ethernet only 8101/8102. + +Signed-off-by: Francois Romieu +Tested-by: Martin Capitanio +Fixed-by: Ivan Vecera +Cc: Edward Hsu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/r8169.c | 97 ++++++++++++++++++++++++---------------------------- + 1 file changed, 45 insertions(+), 52 deletions(-) + +--- a/drivers/net/r8169.c ++++ b/drivers/net/r8169.c +@@ -370,8 +370,9 @@ struct ring_info { + }; + + enum features { +- RTL_FEATURE_WOL = (1 << 0), +- RTL_FEATURE_MSI = (1 << 1), ++ RTL_FEATURE_WOL = (1 << 0), ++ RTL_FEATURE_MSI = (1 << 1), ++ RTL_FEATURE_GMII = (1 << 2), + }; + + struct rtl8169_private { +@@ -406,13 +407,15 @@ struct rtl8169_private { + struct vlan_group *vlgrp; + #endif + int (*set_speed)(struct net_device *, u8 autoneg, u16 speed, u8 duplex); +- void (*get_settings)(struct net_device *, struct ethtool_cmd *); ++ int (*get_settings)(struct net_device *, struct ethtool_cmd *); + void (*phy_reset_enable)(void __iomem *); + void (*hw_start)(struct net_device *); + unsigned int (*phy_reset_pending)(void __iomem *); + unsigned int (*link_ok)(void __iomem *); + struct delayed_work task; + unsigned features; ++ ++ struct mii_if_info mii; + }; + + MODULE_AUTHOR("Realtek and the Linux r8169 crew "); +@@ -482,6 +485,23 @@ static int mdio_read(void __iomem *ioadd + return value; + } + ++static void rtl_mdio_write(struct net_device *dev, int phy_id, int location, ++ int val) ++{ ++ struct rtl8169_private *tp = netdev_priv(dev); ++ void __iomem *ioaddr = tp->mmio_addr; ++ ++ mdio_write(ioaddr, location, val); ++} ++ ++static int rtl_mdio_read(struct net_device *dev, int phy_id, int location) ++{ ++ struct rtl8169_private *tp = netdev_priv(dev); ++ void __iomem *ioaddr = tp->mmio_addr; ++ ++ return mdio_read(ioaddr, location); ++} ++ + static void rtl8169_irq_mask_and_ack(void __iomem *ioaddr) + { + RTL_W16(IntrMask, 0x0000); +@@ -850,7 +870,7 @@ static int rtl8169_rx_vlan_skb(struct rt + + #endif + +-static void rtl8169_gset_tbi(struct net_device *dev, struct ethtool_cmd *cmd) ++static int rtl8169_gset_tbi(struct net_device *dev, struct ethtool_cmd *cmd) + { + struct rtl8169_private *tp = netdev_priv(dev); + void __iomem *ioaddr = tp->mmio_addr; +@@ -867,65 +887,29 @@ static void rtl8169_gset_tbi(struct net_ + + cmd->speed = SPEED_1000; + cmd->duplex = DUPLEX_FULL; /* Always set */ ++ ++ return 0; + } + +-static void rtl8169_gset_xmii(struct net_device *dev, struct ethtool_cmd *cmd) ++static int rtl8169_gset_xmii(struct net_device *dev, struct ethtool_cmd *cmd) + { + struct rtl8169_private *tp = netdev_priv(dev); +- void __iomem *ioaddr = tp->mmio_addr; +- u8 status; +- +- cmd->supported = SUPPORTED_10baseT_Half | +- SUPPORTED_10baseT_Full | +- SUPPORTED_100baseT_Half | +- SUPPORTED_100baseT_Full | +- SUPPORTED_1000baseT_Full | +- SUPPORTED_Autoneg | +- SUPPORTED_TP; +- +- cmd->autoneg = 1; +- cmd->advertising = ADVERTISED_TP | ADVERTISED_Autoneg; +- +- if (tp->phy_auto_nego_reg & ADVERTISE_10HALF) +- cmd->advertising |= ADVERTISED_10baseT_Half; +- if (tp->phy_auto_nego_reg & ADVERTISE_10FULL) +- cmd->advertising |= ADVERTISED_10baseT_Full; +- if (tp->phy_auto_nego_reg & ADVERTISE_100HALF) +- cmd->advertising |= ADVERTISED_100baseT_Half; +- if (tp->phy_auto_nego_reg & ADVERTISE_100FULL) +- cmd->advertising |= ADVERTISED_100baseT_Full; +- if (tp->phy_1000_ctrl_reg & ADVERTISE_1000FULL) +- cmd->advertising |= ADVERTISED_1000baseT_Full; +- +- status = RTL_R8(PHYstatus); +- +- if (status & _1000bpsF) +- cmd->speed = SPEED_1000; +- else if (status & _100bps) +- cmd->speed = SPEED_100; +- else if (status & _10bps) +- cmd->speed = SPEED_10; +- +- if (status & TxFlowCtrl) +- cmd->advertising |= ADVERTISED_Asym_Pause; +- if (status & RxFlowCtrl) +- cmd->advertising |= ADVERTISED_Pause; + +- cmd->duplex = ((status & _1000bpsF) || (status & FullDup)) ? +- DUPLEX_FULL : DUPLEX_HALF; ++ return mii_ethtool_gset(&tp->mii, cmd); + } + + static int rtl8169_get_settings(struct net_device *dev, struct ethtool_cmd *cmd) + { + struct rtl8169_private *tp = netdev_priv(dev); + unsigned long flags; ++ int rc; + + spin_lock_irqsave(&tp->lock, flags); + +- tp->get_settings(dev, cmd); ++ rc = tp->get_settings(dev, cmd); + + spin_unlock_irqrestore(&tp->lock, flags); +- return 0; ++ return rc; + } + + static void rtl8169_get_regs(struct net_device *dev, struct ethtool_regs *regs, +@@ -1513,7 +1497,7 @@ static const struct rtl_cfg_info { + unsigned int align; + u16 intr_event; + u16 napi_event; +- unsigned msi; ++ unsigned features; + } rtl_cfg_infos [] = { + [RTL_CFG_0] = { + .hw_start = rtl_hw_start_8169, +@@ -1522,7 +1506,7 @@ static const struct rtl_cfg_info { + .intr_event = SYSErr | LinkChg | RxOverflow | + RxFIFOOver | TxErr | TxOK | RxOK | RxErr, + .napi_event = RxFIFOOver | TxErr | TxOK | RxOK | RxOverflow, +- .msi = 0 ++ .features = RTL_FEATURE_GMII + }, + [RTL_CFG_1] = { + .hw_start = rtl_hw_start_8168, +@@ -1531,7 +1515,7 @@ static const struct rtl_cfg_info { + .intr_event = SYSErr | LinkChg | RxOverflow | + TxErr | TxOK | RxOK | RxErr, + .napi_event = TxErr | TxOK | RxOK | RxOverflow, +- .msi = RTL_FEATURE_MSI ++ .features = RTL_FEATURE_GMII | RTL_FEATURE_MSI + }, + [RTL_CFG_2] = { + .hw_start = rtl_hw_start_8101, +@@ -1540,7 +1524,7 @@ static const struct rtl_cfg_info { + .intr_event = SYSErr | LinkChg | RxOverflow | PCSTimeout | + RxFIFOOver | TxErr | TxOK | RxOK | RxErr, + .napi_event = RxFIFOOver | TxErr | TxOK | RxOK | RxOverflow, +- .msi = RTL_FEATURE_MSI ++ .features = RTL_FEATURE_MSI + } + }; + +@@ -1552,7 +1536,7 @@ static unsigned rtl_try_msi(struct pci_d + u8 cfg2; + + cfg2 = RTL_R8(Config2) & ~MSIEnable; +- if (cfg->msi) { ++ if (cfg->features & RTL_FEATURE_MSI) { + if (pci_enable_msi(pdev)) { + dev_info(&pdev->dev, "no MSI. Back to INTx.\n"); + } else { +@@ -1578,6 +1562,7 @@ rtl8169_init_one(struct pci_dev *pdev, c + const struct rtl_cfg_info *cfg = rtl_cfg_infos + ent->driver_data; + const unsigned int region = cfg->region; + struct rtl8169_private *tp; ++ struct mii_if_info *mii; + struct net_device *dev; + void __iomem *ioaddr; + unsigned int i; +@@ -1602,6 +1587,14 @@ rtl8169_init_one(struct pci_dev *pdev, c + tp->pci_dev = pdev; + tp->msg_enable = netif_msg_init(debug.msg_enable, R8169_MSG_DEFAULT); + ++ mii = &tp->mii; ++ mii->dev = dev; ++ mii->mdio_read = rtl_mdio_read; ++ mii->mdio_write = rtl_mdio_write; ++ mii->phy_id_mask = 0x1f; ++ mii->reg_num_mask = 0x1f; ++ mii->supports_gmii = !!(cfg->features & RTL_FEATURE_GMII); ++ + /* enable device (incl. PCI PM wakeup and hotplug setup) */ + rc = pci_enable_device(pdev); + if (rc < 0) { + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:54 2008 +Message-Id: <20081112001554.571216896@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:23 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ivan Vecera , + Edward Hsu , + Jeff Garzik , + Martin Capitanio , + Francois Romieu +Subject: [patch 22/49] r8169: fix RxMissed register access +Content-Disposition: inline; filename=r8169-fix-rxmissed-register-access.patch +Content-Length: 2400 +Lines: 94 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Francois Romieu + +Upstream as 523a609496dbc3897e530db2a2f27650d125ea00 + +- the register is defined for the 8169 chipset only and there is + no 8169 beyond RTL_GIGA_MAC_VER_06. +- only the lower 3 bytes of the register are valid + +Fixes: +1. http://bugzilla.kernel.org/show_bug.cgi?id=10180 +2. http://bugzilla.kernel.org/show_bug.cgi?id=11062 (bits of) + +Tested by Hermann Gausterer and Adam Huffman. + +Signed-off-by: Francois Romieu +Cc: Edward Hsu +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/r8169.c | 25 ++++++++++++++----------- + 1 file changed, 14 insertions(+), 11 deletions(-) + +--- a/drivers/net/r8169.c ++++ b/drivers/net/r8169.c +@@ -2092,8 +2092,6 @@ static void rtl_hw_start_8168(struct net + + RTL_R8(IntrMask); + +- RTL_W32(RxMissed, 0); +- + rtl_set_rx_mode(dev); + + RTL_W8(ChipCmd, CmdTxEnb | CmdRxEnb); +@@ -2136,8 +2134,6 @@ static void rtl_hw_start_8101(struct net + + RTL_R8(IntrMask); + +- RTL_W32(RxMissed, 0); +- + rtl_set_rx_mode(dev); + + RTL_W8(ChipCmd, CmdTxEnb | CmdRxEnb); +@@ -2915,6 +2911,17 @@ static int rtl8169_poll(struct napi_stru + return work_done; + } + ++static void rtl8169_rx_missed(struct net_device *dev, void __iomem *ioaddr) ++{ ++ struct rtl8169_private *tp = netdev_priv(dev); ++ ++ if (tp->mac_version > RTL_GIGA_MAC_VER_06) ++ return; ++ ++ dev->stats.rx_missed_errors += (RTL_R32(RxMissed) & 0xffffff); ++ RTL_W32(RxMissed, 0); ++} ++ + static void rtl8169_down(struct net_device *dev) + { + struct rtl8169_private *tp = netdev_priv(dev); +@@ -2932,9 +2939,7 @@ core_down: + + rtl8169_asic_down(ioaddr); + +- /* Update the error counts. */ +- dev->stats.rx_missed_errors += RTL_R32(RxMissed); +- RTL_W32(RxMissed, 0); ++ rtl8169_rx_missed(dev, ioaddr); + + spin_unlock_irq(&tp->lock); + +@@ -3056,8 +3061,7 @@ static struct net_device_stats *rtl8169_ + + if (netif_running(dev)) { + spin_lock_irqsave(&tp->lock, flags); +- dev->stats.rx_missed_errors += RTL_R32(RxMissed); +- RTL_W32(RxMissed, 0); ++ rtl8169_rx_missed(dev, ioaddr); + spin_unlock_irqrestore(&tp->lock, flags); + } + +@@ -3082,8 +3086,7 @@ static int rtl8169_suspend(struct pci_de + + rtl8169_asic_down(ioaddr); + +- dev->stats.rx_missed_errors += RTL_R32(RxMissed); +- RTL_W32(RxMissed, 0); ++ rtl8169_rx_missed(dev, ioaddr); + + spin_unlock_irq(&tp->lock); + + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:54 2008 +Message-Id: <20081112001554.751218195@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:24 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ivan Vecera , + Edward Hsu , + Martin Capitanio , + Chiaki Ishikawa , + Jeff Garzik , + RyanKao , + Francois Romieu +Subject: [patch 23/49] r8169: wake up the PHY of the 8168 +Content-Disposition: inline; filename=r8169-wake-up-the-phy-of-the-8168.patch +Content-Length: 1239 +Lines: 39 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Francois Romieu + +Upstream as a2de6b89b74b28052e293fdb39975a5a03c432e0 + +This is typically needed when some other OS puts the PHY +to sleep due to the disabling of WOL options in the BIOS +of the system. + +Signed-off-by: Francois Romieu +Tested-by: Chiaki Ishikawa +Cc: Edward Hsu +Cc: RyanKao +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/r8169.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/net/r8169.c ++++ b/drivers/net/r8169.c +@@ -740,9 +740,13 @@ static int rtl8169_set_speed_xmii(struct + + auto_nego |= ADVERTISE_PAUSE_CAP | ADVERTISE_PAUSE_ASYM; + +- if ((tp->mac_version == RTL_GIGA_MAC_VER_12) || +- (tp->mac_version == RTL_GIGA_MAC_VER_17)) { +- /* Vendor specific (0x1f) and reserved (0x0e) MII registers. */ ++ if ((tp->mac_version == RTL_GIGA_MAC_VER_11) || ++ (tp->mac_version == RTL_GIGA_MAC_VER_12) || ++ (tp->mac_version >= RTL_GIGA_MAC_VER_17)) { ++ /* ++ * Wake up the PHY. ++ * Vendor specific (0x1f) and reserved (0x0e) MII registers. ++ */ + mdio_write(ioaddr, 0x1f, 0x0000); + mdio_write(ioaddr, 0x0e, 0x0000); + } + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:55 2008 +Message-Id: <20081112001554.936277120@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:25 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Maciej Sosnowski , + Dan Williams , + "David S. Miller" +Subject: [patch 24/49] I/OAT: fix channel resources free for not allocated channels +Content-Disposition: inline; filename=i-oat-fix-channel-resources-free-for-not-allocated-channels.patch +Content-Length: 1393 +Lines: 43 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Maciej Sosnowski + +commit c3d4f44f50b65b0b0290e357f8739cfb3f4bcaca upstream + +If the ioatdma driver is loaded but not used it does not allocate descriptors. +Before it frees channel resources it should first be sure +that they have been previously allocated. + +Signed-off-by: Maciej Sosnowski +Tested-by: Tom Picard +Signed-off-by: Dan Williams +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/ioat_dma.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/dma/ioat_dma.c ++++ b/drivers/dma/ioat_dma.c +@@ -801,6 +801,12 @@ static void ioat_dma_free_chan_resources + struct ioat_desc_sw *desc, *_desc; + int in_use_descs = 0; + ++ /* Before freeing channel resources first check ++ * if they have been previously allocated for this channel. ++ */ ++ if (ioat_chan->desccount == 0) ++ return; ++ + tasklet_disable(&ioat_chan->cleanup_task); + ioat_dma_memcpy_cleanup(ioat_chan); + +@@ -863,6 +869,7 @@ static void ioat_dma_free_chan_resources + ioat_chan->last_completion = ioat_chan->completion_addr = 0; + ioat_chan->pending = 0; + ioat_chan->dmacount = 0; ++ ioat_chan->desccount = 0; + ioat_chan->watchdog_completion = 0; + ioat_chan->last_compl_desc_addr_hw = 0; + ioat_chan->watchdog_tcp_cookie = + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:55 2008 +Message-Id: <20081112001555.151866392@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:26 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Maciej Sosnowski , + "David S. Miller" +Subject: [patch 25/49] I/OAT: fix dma_pin_iovec_pages() error handling +Content-Disposition: inline; filename=i-oat-fix-dma_pin_iovec_pages-error-handling.patch +Content-Length: 2313 +Lines: 80 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Maciej Sosnowski + +commit c2c0b4c5434c0a25f7f7796b29155d53805909f5 upstream + +Error handling needs to be modified in dma_pin_iovec_pages(). +It should return NULL instead of ERR_PTR +(pinned_list is checked for NULL in tcp_recvmsg() to determine +if iovec pages have been successfully pinned down). +In case of error for the first iovec, +local_list->nr_iovecs needs to be initialized. + +Signed-off-by: Maciej Sosnowski +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/iovlock.c | 17 ++++++----------- + 1 file changed, 6 insertions(+), 11 deletions(-) + +--- a/drivers/dma/iovlock.c ++++ b/drivers/dma/iovlock.c +@@ -55,7 +55,6 @@ struct dma_pinned_list *dma_pin_iovec_pa + int nr_iovecs = 0; + int iovec_len_used = 0; + int iovec_pages_used = 0; +- long err; + + /* don't pin down non-user-based iovecs */ + if (segment_eq(get_fs(), KERNEL_DS)) +@@ -72,23 +71,21 @@ struct dma_pinned_list *dma_pin_iovec_pa + local_list = kmalloc(sizeof(*local_list) + + (nr_iovecs * sizeof (struct dma_page_list)) + + (iovec_pages_used * sizeof (struct page*)), GFP_KERNEL); +- if (!local_list) { +- err = -ENOMEM; ++ if (!local_list) + goto out; +- } + + /* list of pages starts right after the page list array */ + pages = (struct page **) &local_list->page_list[nr_iovecs]; + ++ local_list->nr_iovecs = 0; ++ + for (i = 0; i < nr_iovecs; i++) { + struct dma_page_list *page_list = &local_list->page_list[i]; + + len -= iov[i].iov_len; + +- if (!access_ok(VERIFY_WRITE, iov[i].iov_base, iov[i].iov_len)) { +- err = -EFAULT; ++ if (!access_ok(VERIFY_WRITE, iov[i].iov_base, iov[i].iov_len)) + goto unpin; +- } + + page_list->nr_pages = num_pages_spanned(&iov[i]); + page_list->base_address = iov[i].iov_base; +@@ -109,10 +106,8 @@ struct dma_pinned_list *dma_pin_iovec_pa + NULL); + up_read(¤t->mm->mmap_sem); + +- if (ret != page_list->nr_pages) { +- err = -ENOMEM; ++ if (ret != page_list->nr_pages) + goto unpin; +- } + + local_list->nr_iovecs = i + 1; + } +@@ -122,7 +117,7 @@ struct dma_pinned_list *dma_pin_iovec_pa + unpin: + dma_unpin_iovec_pages(local_list); + out: +- return ERR_PTR(err); ++ return NULL; + } + + void dma_unpin_iovec_pages(struct dma_pinned_list *pinned_list) + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:55 2008 +Message-Id: <20081112001555.319009841@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:27 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + jejb@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Maciej Sosnowski , + "David S. Miller" +Subject: [patch 26/49] I/OAT: fix async_tx.callback checking +Content-Disposition: inline; filename=i-oat-fix-async_tx.callback-checking.patch +Content-Length: 1096 +Lines: 37 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Maciej Sosnowski + +commit 12ccea24e309d815d058cdc6ee8bf2c4b85f0c5f upstream + +async_tx.callback should be checked for the first +not the last descriptor in the chain. + +Signed-off-by: Maciej Sosnowski +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/ioat_dma.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/dma/ioat_dma.c ++++ b/drivers/dma/ioat_dma.c +@@ -519,7 +519,7 @@ static dma_cookie_t ioat1_tx_submit(stru + } + + hw->ctl = IOAT_DMA_DESCRIPTOR_CTL_CP_STS; +- if (new->async_tx.callback) { ++ if (first->async_tx.callback) { + hw->ctl |= IOAT_DMA_DESCRIPTOR_CTL_INT_GN; + if (first != new) { + /* move callback into to last desc */ +@@ -611,7 +611,7 @@ static dma_cookie_t ioat2_tx_submit(stru + } + + hw->ctl |= IOAT_DMA_DESCRIPTOR_CTL_CP_STS; +- if (new->async_tx.callback) { ++ if (first->async_tx.callback) { + hw->ctl |= IOAT_DMA_DESCRIPTOR_CTL_INT_GN; + if (first != new) { + /* move callback into to last desc */ + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:55 2008 +Message-Id: <20081112001555.500632784@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:28 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Maciej Sosnowski , + Dan Williams , + "David S. Miller" +Subject: [patch 27/49] dca: fixup initialization dependency +Content-Disposition: inline; filename=dca-fixup-initialization-dependency.patch +Content-Length: 813 +Lines: 29 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Dan Williams + +commit 1207e795568a368928dfd23d6817e47f2e8097e3 upstream + +Mark dca_init as a subsys_initcall since it needs to be ready to go +before dependent drivers start registering themselves. + +Reported-and-tested-by: Mark Rustad +Acked-by: Maciej Sosnowski +Signed-off-by: Dan Williams +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dca/dca-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/dca/dca-core.c ++++ b/drivers/dca/dca-core.c +@@ -270,6 +270,6 @@ static void __exit dca_exit(void) + dca_sysfs_exit(); + } + +-module_init(dca_init); ++subsys_initcall(dca_init); + module_exit(dca_exit); + + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:55 2008 +Message-Id: <20081112001555.684221061@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:29 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ron Rindjunsky , + Esti Kummer , + Tomas Winkler , + Zhu Yi , + "John W. Linville" +Subject: [patch 28/49] iwlwifi: allow consecutive scans in unassociated state +Content-Disposition: inline; filename=iwlwifi-allow-consecutive-scans-in-unassociated-state.patch +Content-Length: 1482 +Lines: 41 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ron Rindjunsky + +commit 681c0050ea3ac2e90c83d5af397d73eed848a372 upstream + +This patch allows consecutive scans requests when driver is in +unassociated state. + +Signed-off-by: Ron Rindjunsky +Signed-off-by: Esti Kummer +Signed-off-by: Tomas Winkler +Signed-off-by: Zhu Yi +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-agn.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-agn.c ++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c +@@ -3214,13 +3214,15 @@ static int iwl4965_mac_hw_scan(struct ie + + /* we don't schedule scan within next_scan_jiffies period */ + if (priv->next_scan_jiffies && +- time_after(priv->next_scan_jiffies, jiffies)) { ++ time_after(priv->next_scan_jiffies, jiffies)) { ++ IWL_DEBUG_SCAN("scan rejected: within next scan period\n"); + rc = -EAGAIN; + goto out_unlock; + } + /* if we just finished scan ask for delay */ +- if (priv->last_scan_jiffies && time_after(priv->last_scan_jiffies + +- IWL_DELAY_NEXT_SCAN, jiffies)) { ++ if (iwl_is_associated(priv) && priv->last_scan_jiffies && ++ time_after(priv->last_scan_jiffies + IWL_DELAY_NEXT_SCAN, jiffies)) { ++ IWL_DEBUG_SCAN("scan rejected: within previous scan period\n"); + rc = -EAGAIN; + goto out_unlock; + } + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:56 2008 +Message-Id: <20081112001555.895270371@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:30 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Emmanuel Grumbach , + Mohamed Abbas , + Tomas Winkler , + Zhu Yi , + "John W. Linville" +Subject: [patch 29/49] iwlwifi: allow association on radar channel in power save +Content-Disposition: inline; filename=iwlwifi-allow-association-on-radar-channel-in-power-save.patch +Content-Length: 6324 +Lines: 179 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Emmanuel Grumbach + +commit c90a74bae10dc2a4677d1bd06b6400db229d3e1e upstream + +This patch disables power save upon association and enables it back +after association. This allows to associate to AP on a radar channel +if power save is enabled. + +Radar and passive channels are not allowed for TX (required for association) +unless RX is received but PS may close the radio and no RX will be received +effectively failing association. + +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Mohamed Abbas +Signed-off-by: Tomas Winkler +Signed-off-by: Zhu Yi +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-agn.c | 24 +++++++++++++++---- + drivers/net/wireless/iwlwifi/iwl-dev.h | 1 + drivers/net/wireless/iwlwifi/iwl-power.c | 39 ++++++++++++++++++++++++++++++- + drivers/net/wireless/iwlwifi/iwl-power.h | 4 ++- + 4 files changed, 61 insertions(+), 7 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-agn.c ++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c +@@ -2486,6 +2486,7 @@ static void iwl4965_post_associate(struc + if (!priv->vif || !priv->is_open) + return; + ++ iwl_power_cancel_timeout(priv); + iwl_scan_cancel_timeout(priv, 200); + + conf = ieee80211_get_hw_conf(priv->hw); +@@ -2550,10 +2551,6 @@ static void iwl4965_post_associate(struc + break; + } + +- /* Enable Rx differential gain and sensitivity calibrations */ +- iwl_chain_noise_reset(priv); +- priv->start_calib = 1; +- + if (priv->iw_mode == IEEE80211_IF_TYPE_IBSS) + priv->assoc_station_added = 1; + +@@ -2561,7 +2558,12 @@ static void iwl4965_post_associate(struc + iwl_activate_qos(priv, 0); + spin_unlock_irqrestore(&priv->lock, flags); + +- iwl_power_update_mode(priv, 0); ++ iwl_power_enable_management(priv); ++ ++ /* Enable Rx differential gain and sensitivity calibrations */ ++ iwl_chain_noise_reset(priv); ++ priv->start_calib = 1; ++ + /* we have just associated, don't start scan too early */ + priv->next_scan_jiffies = jiffies + IWL_DELAY_NEXT_SCAN; + } +@@ -3548,6 +3550,16 @@ static void iwl4965_mac_reset_tsf(struct + /* Per mac80211.h: This is only used in IBSS mode... */ + if (priv->iw_mode != IEEE80211_IF_TYPE_IBSS) { + ++ /* switch to CAM during association period. ++ * the ucode will block any association/authentication ++ * frome during assiciation period if it can not hear ++ * the AP because of PM. the timer enable PM back is ++ * association do not complete ++ */ ++ if (priv->hw->conf.channel->flags & (IEEE80211_CHAN_PASSIVE_SCAN | ++ IEEE80211_CHAN_RADAR)) ++ iwl_power_disable_management(priv, 3000); ++ + IWL_DEBUG_MAC80211("leave - not in IBSS\n"); + mutex_unlock(&priv->mutex); + return; +@@ -4085,6 +4097,7 @@ static void iwl_setup_deferred_work(stru + /* FIXME : remove when resolved PENDING */ + INIT_WORK(&priv->scan_completed, iwl_bg_scan_completed); + iwl_setup_scan_deferred_work(priv); ++ iwl_setup_power_deferred_work(priv); + + if (priv->cfg->ops->lib->setup_deferred_work) + priv->cfg->ops->lib->setup_deferred_work(priv); +@@ -4104,6 +4117,7 @@ static void iwl_cancel_deferred_work(str + + cancel_delayed_work_sync(&priv->init_alive_start); + cancel_delayed_work(&priv->scan_check); ++ cancel_delayed_work_sync(&priv->set_power_save); + cancel_delayed_work(&priv->alive_start); + cancel_work_sync(&priv->beacon_update); + del_timer_sync(&priv->statistics_periodic); +--- a/drivers/net/wireless/iwlwifi/iwl-dev.h ++++ b/drivers/net/wireless/iwlwifi/iwl-dev.h +@@ -1047,6 +1047,7 @@ struct iwl_priv { + + struct tasklet_struct irq_tasklet; + ++ struct delayed_work set_power_save; + struct delayed_work init_alive_start; + struct delayed_work alive_start; + struct delayed_work scan_check; +--- a/drivers/net/wireless/iwlwifi/iwl-power.c ++++ b/drivers/net/wireless/iwlwifi/iwl-power.c +@@ -324,7 +324,7 @@ EXPORT_SYMBOL(iwl_power_update_mode); + * this will be usefull for rate scale to disable PM during heavy + * Tx/Rx activities + */ +-int iwl_power_disable_management(struct iwl_priv *priv) ++int iwl_power_disable_management(struct iwl_priv *priv, u32 ms) + { + u16 prev_mode; + int ret = 0; +@@ -337,6 +337,11 @@ int iwl_power_disable_management(struct + ret = iwl_power_update_mode(priv, 0); + priv->power_data.power_disabled = 1; + priv->power_data.user_power_setting = prev_mode; ++ cancel_delayed_work(&priv->set_power_save); ++ if (ms) ++ queue_delayed_work(priv->workqueue, &priv->set_power_save, ++ msecs_to_jiffies(ms)); ++ + + return ret; + } +@@ -431,3 +436,35 @@ int iwl_power_temperature_change(struct + return ret; + } + EXPORT_SYMBOL(iwl_power_temperature_change); ++ ++static void iwl_bg_set_power_save(struct work_struct *work) ++{ ++ struct iwl_priv *priv = container_of(work, ++ struct iwl_priv, set_power_save.work); ++ IWL_DEBUG(IWL_DL_STATE, "update power\n"); ++ ++ if (test_bit(STATUS_EXIT_PENDING, &priv->status)) ++ return; ++ ++ mutex_lock(&priv->mutex); ++ ++ /* on starting association we disable power managment ++ * until association, if association failed then this ++ * timer will expire and enable PM again. ++ */ ++ if (!iwl_is_associated(priv)) ++ iwl_power_enable_management(priv); ++ ++ mutex_unlock(&priv->mutex); ++} ++void iwl_setup_power_deferred_work(struct iwl_priv *priv) ++{ ++ INIT_DELAYED_WORK(&priv->set_power_save, iwl_bg_set_power_save); ++} ++EXPORT_SYMBOL(iwl_setup_power_deferred_work); ++ ++void iwl_power_cancel_timeout(struct iwl_priv *priv) ++{ ++ cancel_delayed_work(&priv->set_power_save); ++} ++EXPORT_SYMBOL(iwl_power_cancel_timeout); +--- a/drivers/net/wireless/iwlwifi/iwl-power.h ++++ b/drivers/net/wireless/iwlwifi/iwl-power.h +@@ -78,8 +78,10 @@ struct iwl_power_mgr { + u8 power_disabled; /* flag to disable using power saving level */ + }; + ++void iwl_setup_power_deferred_work(struct iwl_priv *priv); ++void iwl_power_cancel_timeout(struct iwl_priv *priv); + int iwl_power_update_mode(struct iwl_priv *priv, u8 refresh); +-int iwl_power_disable_management(struct iwl_priv *priv); ++int iwl_power_disable_management(struct iwl_priv *priv, u32 ms); + int iwl_power_enable_management(struct iwl_priv *priv); + int iwl_power_set_user_mode(struct iwl_priv *priv, u16 mode); + int iwl_power_set_system_mode(struct iwl_priv *priv, u16 mode); + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:56 2008 +Message-Id: <20081112001556.084678523@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:31 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Emmanuel Grumbach , + Zhu Yi , + "John W. Linville" +Subject: [patch 30/49] iwlwifi: remove HT flags from RXON when not in HT anymore +Content-Disposition: inline; filename=iwlwifi-remove-ht-flags-from-rxon-when-not-in-ht-anymore.patch +Content-Length: 2031 +Lines: 56 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Emmanuel Grumbach + +commit 42eb7c644afcdbcd7eac4d862046230856fbf531 upstream. + +This patch removes the HT flags from RXON when moving from HT to legacy. +This avoids keeping those flags set and possibly miss configuring firmware. + +If we are configured in HT, fat channel: channel 1 above, and move later +to legacy channel 11, we need to clear the FAT channel control flags in +RXON. If we don't, the firmware will understand this as channel 11 above +which is not possible due to regulatory constraints, leading to firmware +crash. + +Signed-off-by: Emmanuel Grumbach +Reviewed-by: Tomas Winkler +Signed-off-by: Zhu Yi +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-agn.c | 3 +-- + drivers/net/wireless/iwlwifi/iwl-core.c | 8 +++++++- + 2 files changed, 8 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-agn.c ++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c +@@ -2504,8 +2504,7 @@ static void iwl4965_post_associate(struc + + priv->staging_rxon.filter_flags |= RXON_FILTER_ASSOC_MSK; + +- if (priv->current_ht_config.is_ht) +- iwl_set_rxon_ht(priv, &priv->current_ht_config); ++ iwl_set_rxon_ht(priv, &priv->current_ht_config); + + iwl_set_rxon_chain(priv); + priv->staging_rxon.assoc_id = cpu_to_le16(priv->assoc_id); +--- a/drivers/net/wireless/iwlwifi/iwl-core.c ++++ b/drivers/net/wireless/iwlwifi/iwl-core.c +@@ -646,8 +646,14 @@ void iwl_set_rxon_ht(struct iwl_priv *pr + struct iwl_rxon_cmd *rxon = &priv->staging_rxon; + u32 val; + +- if (!ht_info->is_ht) ++ if (!ht_info->is_ht) { ++ rxon->flags &= ~(RXON_FLG_CHANNEL_MODE_MIXED_MSK | ++ RXON_FLG_CHANNEL_MODE_PURE_40_MSK | ++ RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK | ++ RXON_FLG_FAT_PROT_MSK | ++ RXON_FLG_HT_PROT_MSK); + return; ++ } + + /* Set up channel bandwidth: 20 MHz only, or 20/40 mixed if fat ok */ + if (iwl_is_fat_tx_allowed(priv, NULL)) + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:56 2008 +Message-Id: <20081112001556.291114536@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:32 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tomas Winkler , + Zhu Yi , + "John W. Linville" +Subject: [patch 31/49] iwlwifi: dont fail if scan is issued too early +Content-Disposition: inline; filename=iwlwifi-don-t-fail-if-scan-is-issued-too-early.patch +Content-Length: 2489 +Lines: 76 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Tomas Winkler + +commit 8d09a5e1c36d0dec5728e6c8b0bb5412de09b27b upstream + +This patch returns success and empty scan on scans requests that were +rejected because issued too early. The cached bss list from previous +scanning will be returned by mac80211. + +Signed-off-by: Tomas Winkler +Signed-off-by: Zhu Yi +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-agn.c | 12 +++++++++--- + drivers/net/wireless/iwlwifi/iwl-scan.c | 8 +------- + 2 files changed, 10 insertions(+), 10 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-agn.c ++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c +@@ -3213,20 +3213,26 @@ static int iwl4965_mac_hw_scan(struct ie + goto out_unlock; + } + +- /* we don't schedule scan within next_scan_jiffies period */ ++ /* We don't schedule scan within next_scan_jiffies period. ++ * Avoid scanning during possible EAPOL exchange, return ++ * success immediately. ++ */ + if (priv->next_scan_jiffies && + time_after(priv->next_scan_jiffies, jiffies)) { + IWL_DEBUG_SCAN("scan rejected: within next scan period\n"); +- rc = -EAGAIN; ++ queue_work(priv->workqueue, &priv->scan_completed); ++ rc = 0; + goto out_unlock; + } + /* if we just finished scan ask for delay */ + if (iwl_is_associated(priv) && priv->last_scan_jiffies && + time_after(priv->last_scan_jiffies + IWL_DELAY_NEXT_SCAN, jiffies)) { + IWL_DEBUG_SCAN("scan rejected: within previous scan period\n"); +- rc = -EAGAIN; ++ queue_work(priv->workqueue, &priv->scan_completed); ++ rc = 0; + goto out_unlock; + } ++ + if (len) { + IWL_DEBUG_SCAN("direct scan for %s [%d]\n ", + iwl_escape_essid(ssid, len), (int)len); +--- a/drivers/net/wireless/iwlwifi/iwl-scan.c ++++ b/drivers/net/wireless/iwlwifi/iwl-scan.c +@@ -464,11 +464,6 @@ void iwl_init_scan_params(struct iwl_pri + + int iwl_scan_initiate(struct iwl_priv *priv) + { +- if (priv->iw_mode == IEEE80211_IF_TYPE_AP) { +- IWL_ERROR("APs don't scan.\n"); +- return 0; +- } +- + if (!iwl_is_ready_rf(priv)) { + IWL_DEBUG_SCAN("Aborting scan due to not ready.\n"); + return -EIO; +@@ -480,8 +475,7 @@ int iwl_scan_initiate(struct iwl_priv *p + } + + if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) { +- IWL_DEBUG_SCAN("Scan request while abort pending. " +- "Queuing.\n"); ++ IWL_DEBUG_SCAN("Scan request while abort pending\n"); + return -EAGAIN; + } + + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:56 2008 +Message-Id: <20081112001556.495206887@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:33 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tomas Winkler , + Zhu Yi , + "John W. Linville" +Subject: [patch 32/49] iwlwifi: use correct DMA_MASK +Content-Disposition: inline; filename=iwlwifi-use-correct-dma_mask.patch +Content-Length: 1237 +Lines: 37 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Tomas Winkler + +commit 093d874c02e8d3091aa38596faf0ff2bfd4f0ceb upstream + +Use correct DMA_MASK: 4964 and 5000 support 36 bit addresses for +pci express memory access. + +Signed-off-by: Tomas Winkler +Signed-off-by: Zhu Yi +Signed-off-by: John W. Linville + +--- + drivers/net/wireless/iwlwifi/iwl-agn.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-agn.c ++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c +@@ -4225,13 +4225,13 @@ static int iwl4965_pci_probe(struct pci_ + + pci_set_master(pdev); + +- err = pci_set_dma_mask(pdev, DMA_64BIT_MASK); ++ err = pci_set_dma_mask(pdev, DMA_BIT_MASK(36)); + if (!err) +- err = pci_set_consistent_dma_mask(pdev, DMA_64BIT_MASK); ++ err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(36)); + if (err) { +- err = pci_set_dma_mask(pdev, DMA_32BIT_MASK); ++ err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32)); + if (!err) +- err = pci_set_consistent_dma_mask(pdev, DMA_32BIT_MASK); ++ err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32)); + /* both attempts failed: */ + if (err) { + printk(KERN_WARNING "%s: No suitable DMA available.\n", + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:56 2008 +Message-Id: <20081112001556.726719201@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:34 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Emmanuel Grumbach , + Tomas Winkler , + "Rafael J. Wysocki" , + "John W. Linville" +Subject: [patch 33/49] iwlwifi: fix suspend to RAM in iwlwifi +Content-Disposition: inline; filename=iwlwifi-fix-suspend-to-ram-in-iwlwifi.patch +Content-Length: 1371 +Lines: 41 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Tomas Winkler + +commit 10d0bd56966571d0324dfd9bbb8aa913a60bef5f upstream + +This patch fixes suspend to RAM after by moving +notify_mac out of iwlwifi mutex + +http://bugzilla.kernel.org/show_bug.cgi?id=11845 + +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Tomas Winkler +Tested-by: Carlos R. Mafra +Tested-by: Christian Borntraeger +Cc: Rafael J. Wysocki +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-agn.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-agn.c ++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c +@@ -2090,7 +2090,6 @@ static void iwl_alive_start(struct iwl_p + iwl4965_error_recovery(priv); + + iwl_power_update_mode(priv, 1); +- ieee80211_notify_mac(priv->hw, IEEE80211_NOTIFY_RE_ASSOC); + + if (test_and_clear_bit(STATUS_MODE_PENDING, &priv->status)) + iwl4965_set_mode(priv, priv->iw_mode); +@@ -2342,6 +2341,7 @@ static void iwl_bg_alive_start(struct wo + mutex_lock(&priv->mutex); + iwl_alive_start(priv); + mutex_unlock(&priv->mutex); ++ ieee80211_notify_mac(priv->hw, IEEE80211_NOTIFY_RE_ASSOC); + } + + static void iwl4965_bg_rf_kill(struct work_struct *work) + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:57 2008 +Message-Id: <20081112001556.891054053@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:35 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tomas Winkler , + Emmanuel Grumbach , + Zhu Yi , + "John W. Linville" +Subject: [patch 34/49] iwlwifi: generic init calibrations framework +Content-Disposition: inline; filename=iwlwifi-generic-init-calibrations-framework.patch +Content-Length: 9374 +Lines: 313 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Tomas Winkler + +commit 6e21f2c109edd746a10e08186484bae8168cdd0c upstream + +This patch allows variable number of init calibrations and allows +addition new HW. + +This patch also fixes critical bug. Only last calibration result +was applied. On reception of one calibration result all the calibration +was freed. + +Signed-off-by: Tomas Winkler +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Zhu Yi +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl-5000-hw.h | 7 +++ + drivers/net/wireless/iwlwifi/iwl-5000.c | 63 ++++------------------------- + drivers/net/wireless/iwlwifi/iwl-calib.c | 60 +++++++++++++++++++++++++++ + drivers/net/wireless/iwlwifi/iwl-core.c | 19 -------- + drivers/net/wireless/iwlwifi/iwl-core.h | 8 +++ + drivers/net/wireless/iwlwifi/iwl-dev.h | 14 ++---- + 6 files changed, 90 insertions(+), 81 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/iwl-5000.c ++++ b/drivers/net/wireless/iwlwifi/iwl-5000.c +@@ -445,48 +445,6 @@ static int iwl5000_send_Xtal_calib(struc + sizeof(cal_cmd), &cal_cmd); + } + +-static int iwl5000_send_calib_results(struct iwl_priv *priv) +-{ +- int ret = 0; +- +- struct iwl_host_cmd hcmd = { +- .id = REPLY_PHY_CALIBRATION_CMD, +- .meta.flags = CMD_SIZE_HUGE, +- }; +- +- if (priv->calib_results.lo_res) { +- hcmd.len = priv->calib_results.lo_res_len; +- hcmd.data = priv->calib_results.lo_res; +- ret = iwl_send_cmd_sync(priv, &hcmd); +- +- if (ret) +- goto err; +- } +- +- if (priv->calib_results.tx_iq_res) { +- hcmd.len = priv->calib_results.tx_iq_res_len; +- hcmd.data = priv->calib_results.tx_iq_res; +- ret = iwl_send_cmd_sync(priv, &hcmd); +- +- if (ret) +- goto err; +- } +- +- if (priv->calib_results.tx_iq_perd_res) { +- hcmd.len = priv->calib_results.tx_iq_perd_res_len; +- hcmd.data = priv->calib_results.tx_iq_perd_res; +- ret = iwl_send_cmd_sync(priv, &hcmd); +- +- if (ret) +- goto err; +- } +- +- return 0; +-err: +- IWL_ERROR("Error %d\n", ret); +- return ret; +-} +- + static int iwl5000_send_calib_cfg(struct iwl_priv *priv) + { + struct iwl5000_calib_cfg_cmd calib_cfg_cmd; +@@ -511,33 +469,30 @@ static void iwl5000_rx_calib_result(stru + struct iwl_rx_packet *pkt = (void *)rxb->skb->data; + struct iwl5000_calib_hdr *hdr = (struct iwl5000_calib_hdr *)pkt->u.raw; + int len = le32_to_cpu(pkt->len) & FH_RSCSR_FRAME_SIZE_MSK; +- +- iwl_free_calib_results(priv); ++ int index; + + /* reduce the size of the length field itself */ + len -= 4; + ++ /* Define the order in which the results will be sent to the runtime ++ * uCode. iwl_send_calib_results sends them in a row according to their ++ * index. We sort them here */ + switch (hdr->op_code) { + case IWL5000_PHY_CALIBRATE_LO_CMD: +- priv->calib_results.lo_res = kzalloc(len, GFP_ATOMIC); +- priv->calib_results.lo_res_len = len; +- memcpy(priv->calib_results.lo_res, pkt->u.raw, len); ++ index = IWL5000_CALIB_LO; + break; + case IWL5000_PHY_CALIBRATE_TX_IQ_CMD: +- priv->calib_results.tx_iq_res = kzalloc(len, GFP_ATOMIC); +- priv->calib_results.tx_iq_res_len = len; +- memcpy(priv->calib_results.tx_iq_res, pkt->u.raw, len); ++ index = IWL5000_CALIB_TX_IQ; + break; + case IWL5000_PHY_CALIBRATE_TX_IQ_PERD_CMD: +- priv->calib_results.tx_iq_perd_res = kzalloc(len, GFP_ATOMIC); +- priv->calib_results.tx_iq_perd_res_len = len; +- memcpy(priv->calib_results.tx_iq_perd_res, pkt->u.raw, len); ++ index = IWL5000_CALIB_TX_IQ_PERD; + break; + default: + IWL_ERROR("Unknown calibration notification %d\n", + hdr->op_code); + return; + } ++ iwl_calib_set(&priv->calib_results[index], pkt->u.raw, len); + } + + static void iwl5000_rx_calib_complete(struct iwl_priv *priv, +@@ -832,7 +787,7 @@ static int iwl5000_alive_notify(struct i + iwl5000_send_Xtal_calib(priv); + + if (priv->ucode_type == UCODE_RT) +- iwl5000_send_calib_results(priv); ++ iwl_send_calib_results(priv); + + return 0; + } +--- a/drivers/net/wireless/iwlwifi/iwl-5000-hw.h ++++ b/drivers/net/wireless/iwlwifi/iwl-5000-hw.h +@@ -129,6 +129,13 @@ struct iwl5000_shared { + __le32 padding2; + } __attribute__ ((packed)); + ++/* calibrations defined for 5000 */ ++/* defines the order in which results should be sent to the runtime uCode */ ++enum iwl5000_calib { ++ IWL5000_CALIB_LO, ++ IWL5000_CALIB_TX_IQ, ++ IWL5000_CALIB_TX_IQ_PERD, ++}; + + #endif /* __iwl_5000_hw_h__ */ + +--- a/drivers/net/wireless/iwlwifi/iwl-calib.c ++++ b/drivers/net/wireless/iwlwifi/iwl-calib.c +@@ -66,6 +66,66 @@ + #include "iwl-core.h" + #include "iwl-calib.h" + ++/***************************************************************************** ++ * INIT calibrations framework ++ *****************************************************************************/ ++ ++ int iwl_send_calib_results(struct iwl_priv *priv) ++{ ++ int ret = 0; ++ int i = 0; ++ ++ struct iwl_host_cmd hcmd = { ++ .id = REPLY_PHY_CALIBRATION_CMD, ++ .meta.flags = CMD_SIZE_HUGE, ++ }; ++ ++ for (i = 0; i < IWL_CALIB_MAX; i++) ++ if (priv->calib_results[i].buf) { ++ hcmd.len = priv->calib_results[i].buf_len; ++ hcmd.data = priv->calib_results[i].buf; ++ ret = iwl_send_cmd_sync(priv, &hcmd); ++ if (ret) ++ goto err; ++ } ++ ++ return 0; ++err: ++ IWL_ERROR("Error %d iteration %d\n", ret, i); ++ return ret; ++} ++EXPORT_SYMBOL(iwl_send_calib_results); ++ ++int iwl_calib_set(struct iwl_calib_result *res, const u8 *buf, int len) ++{ ++ if (res->buf_len != len) { ++ kfree(res->buf); ++ res->buf = kzalloc(len, GFP_ATOMIC); ++ } ++ if (unlikely(res->buf == NULL)) ++ return -ENOMEM; ++ ++ res->buf_len = len; ++ memcpy(res->buf, buf, len); ++ return 0; ++} ++EXPORT_SYMBOL(iwl_calib_set); ++ ++void iwl_calib_free_results(struct iwl_priv *priv) ++{ ++ int i; ++ ++ for (i = 0; i < IWL_CALIB_MAX; i++) { ++ kfree(priv->calib_results[i].buf); ++ priv->calib_results[i].buf = NULL; ++ priv->calib_results[i].buf_len = 0; ++ } ++} ++ ++/***************************************************************************** ++ * RUNTIME calibrations framework ++ *****************************************************************************/ ++ + /* "false alarms" are signals that our DSP tries to lock onto, + * but then determines that they are either noise, or transmissions + * from a distant wireless network (also "noise", really) that get +--- a/drivers/net/wireless/iwlwifi/iwl-core.c ++++ b/drivers/net/wireless/iwlwifi/iwl-core.c +@@ -956,22 +956,6 @@ err: + } + EXPORT_SYMBOL(iwl_init_drv); + +-void iwl_free_calib_results(struct iwl_priv *priv) +-{ +- kfree(priv->calib_results.lo_res); +- priv->calib_results.lo_res = NULL; +- priv->calib_results.lo_res_len = 0; +- +- kfree(priv->calib_results.tx_iq_res); +- priv->calib_results.tx_iq_res = NULL; +- priv->calib_results.tx_iq_res_len = 0; +- +- kfree(priv->calib_results.tx_iq_perd_res); +- priv->calib_results.tx_iq_perd_res = NULL; +- priv->calib_results.tx_iq_perd_res_len = 0; +-} +-EXPORT_SYMBOL(iwl_free_calib_results); +- + int iwl_set_tx_power(struct iwl_priv *priv, s8 tx_power, bool force) + { + int ret = 0; +@@ -999,10 +983,9 @@ int iwl_set_tx_power(struct iwl_priv *pr + } + EXPORT_SYMBOL(iwl_set_tx_power); + +- + void iwl_uninit_drv(struct iwl_priv *priv) + { +- iwl_free_calib_results(priv); ++ iwl_calib_free_results(priv); + iwlcore_free_geos(priv); + iwl_free_channel_map(priv); + kfree(priv->scan); +--- a/drivers/net/wireless/iwlwifi/iwl-core.h ++++ b/drivers/net/wireless/iwlwifi/iwl-core.h +@@ -186,7 +186,6 @@ struct ieee80211_hw *iwl_alloc_all(struc + void iwl_hw_detect(struct iwl_priv *priv); + + void iwl_clear_stations_table(struct iwl_priv *priv); +-void iwl_free_calib_results(struct iwl_priv *priv); + void iwl_reset_qos(struct iwl_priv *priv); + void iwl_set_rxon_chain(struct iwl_priv *priv); + int iwl_set_rxon_channel(struct iwl_priv *priv, +@@ -291,6 +290,13 @@ int iwl_scan_initiate(struct iwl_priv *p + void iwl_setup_rx_scan_handlers(struct iwl_priv *priv); + void iwl_setup_scan_deferred_work(struct iwl_priv *priv); + ++/******************************************************************************* ++ * Calibrations - implemented in iwl-calib.c ++ ******************************************************************************/ ++int iwl_send_calib_results(struct iwl_priv *priv); ++int iwl_calib_set(struct iwl_calib_result *res, const u8 *buf, int len); ++void iwl_calib_free_results(struct iwl_priv *priv); ++ + /***************************************************** + * S e n d i n g H o s t C o m m a n d s * + *****************************************************/ +--- a/drivers/net/wireless/iwlwifi/iwl-dev.h ++++ b/drivers/net/wireless/iwlwifi/iwl-dev.h +@@ -745,13 +745,10 @@ struct statistics_general_data { + u32 beacon_energy_c; + }; + +-struct iwl_calib_results { +- void *tx_iq_res; +- void *tx_iq_perd_res; +- void *lo_res; +- u32 tx_iq_res_len; +- u32 tx_iq_perd_res_len; +- u32 lo_res_len; ++/* Opaque calibration results */ ++struct iwl_calib_result { ++ void *buf; ++ size_t buf_len; + }; + + enum ucode_type { +@@ -813,6 +810,7 @@ enum { + + + #define IWL_MAX_NUM_QUEUES 20 /* FIXME: do dynamic allocation */ ++#define IWL_CALIB_MAX 3 + + struct iwl_priv { + +@@ -857,7 +855,7 @@ struct iwl_priv { + s32 last_temperature; + + /* init calibration results */ +- struct iwl_calib_results calib_results; ++ struct iwl_calib_result calib_results[IWL_CALIB_MAX]; + + /* Scan related variables */ + unsigned long last_scan_jiffies; + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:57 2008 +Message-Id: <20081112001557.075455073@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:36 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "John W. Linville" +Subject: [patch 35/49] zd1211rw: Add 2 device IDs +Content-Disposition: inline; filename=zd1211rw-add-2-device-ids.patch +Content-Length: 1505 +Lines: 38 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Daniel Drake + +commit 0feec9dfe7b8880ab3b4c38d7cc4107dd706ea7f upstream. + +07fa/1196 +Bewan BWIFI-USB54AR: Tested by night1308, this device is a ZD1211B with +an AL2230S radio. + +0ace/b215 +HP 802.11abg: Tested by Robert Philippe + +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/zd1211rw/zd_usb.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/wireless/zd1211rw/zd_usb.c ++++ b/drivers/net/wireless/zd1211rw/zd_usb.c +@@ -61,6 +61,7 @@ static struct usb_device_id usb_ids[] = + { USB_DEVICE(0x0105, 0x145f), .driver_info = DEVICE_ZD1211 }, + /* ZD1211B */ + { USB_DEVICE(0x0ace, 0x1215), .driver_info = DEVICE_ZD1211B }, ++ { USB_DEVICE(0x0ace, 0xb215), .driver_info = DEVICE_ZD1211B }, + { USB_DEVICE(0x157e, 0x300d), .driver_info = DEVICE_ZD1211B }, + { USB_DEVICE(0x079b, 0x0062), .driver_info = DEVICE_ZD1211B }, + { USB_DEVICE(0x1582, 0x6003), .driver_info = DEVICE_ZD1211B }, +@@ -82,6 +83,7 @@ static struct usb_device_id usb_ids[] = + { USB_DEVICE(0x0cde, 0x001a), .driver_info = DEVICE_ZD1211B }, + { USB_DEVICE(0x0586, 0x340a), .driver_info = DEVICE_ZD1211B }, + { USB_DEVICE(0x0471, 0x1237), .driver_info = DEVICE_ZD1211B }, ++ { USB_DEVICE(0x07fa, 0x1196), .driver_info = DEVICE_ZD1211B }, + /* "Driverless" devices that need ejecting */ + { USB_DEVICE(0x0ace, 0x2011), .driver_info = DEVICE_INSTALLER }, + { USB_DEVICE(0x0ace, 0x20ff), .driver_info = DEVICE_INSTALLER }, + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:57 2008 +Message-Id: <20081112001557.260637268@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:37 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Zhu Yi , + Tomas Winkler , + Reinette Chatre , + "John W. Linville" +Subject: [patch 36/49] iwl3945: fix deadlock on suspend +Content-Disposition: inline; filename=iwl3945-fix-deadlock-on-suspend.patch +Content-Length: 1203 +Lines: 37 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Zhu Yi + +commit d54bc4e3fc5c56600a13c9ebc0a7e1077ac05d59 upstream. + +This patch fixes iwl3945 deadlock during suspend by moving notify_mac out +of iwl3945 mutex. This is a portion of the same fix for iwlwifi by Tomas. + +Signed-off-by: Zhu Yi +Signed-off-by: Tomas Winkler +Signed-off-by: Reinette Chatre +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl3945-base.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c ++++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c +@@ -5761,7 +5761,6 @@ static void iwl3945_alive_start(struct i + if (priv->error_recovering) + iwl3945_error_recovery(priv); + +- ieee80211_notify_mac(priv->hw, IEEE80211_NOTIFY_RE_ASSOC); + return; + + restart: +@@ -6006,6 +6005,7 @@ static void iwl3945_bg_alive_start(struc + mutex_lock(&priv->mutex); + iwl3945_alive_start(priv); + mutex_unlock(&priv->mutex); ++ ieee80211_notify_mac(priv->hw, IEEE80211_NOTIFY_RE_ASSOC); + } + + static void iwl3945_bg_rf_kill(struct work_struct *work) + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:57 2008 +Message-Id: <20081112001557.419726901@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:38 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Reinette Chatre , + "John W. Linville" +Subject: [patch 37/49] iwl3945: do not send scan command if channel count zero +Content-Disposition: inline; filename=iwl3945-do-not-send-scan-command-if-channel-count-zero.patch +Content-Length: 1133 +Lines: 35 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Reinette Chatre + +commit 14b5433606289dbc5b6fd70ced11462f80e95003 upstream. + +Do not send scan command if no channels to scan. + +This avoids a Microcode error as reported in: +http://www.intellinuxwireless.org/bugzilla/show_bug.cgi?id=1650 +http://bugzilla.kernel.org/show_bug.cgi?id=11806 +http://marc.info/?l=linux-wireless&m=122437145211886&w=2 + +Signed-off-by: Reinette Chatre +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/iwl3945-base.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c ++++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c +@@ -6259,6 +6259,11 @@ static void iwl3945_bg_request_scan(stru + direct_mask, + (void *)&scan->data[le16_to_cpu(scan->tx_cmd.len)]); + ++ if (scan->channel_count == 0) { ++ IWL_DEBUG_SCAN("channel count %d\n", scan->channel_count); ++ goto done; ++ } ++ + cmd.len += le16_to_cpu(scan->tx_cmd.len) + + scan->channel_count * sizeof(struct iwl3945_scan_channel); + cmd.data = scan; + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:57 2008 +Message-Id: <20081112001557.625483150@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:39 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andrey Borzenkov , + Jens Axboe +Subject: [patch 38/49] cpqarry: fix return value of cpqarray_init() +Content-Disposition: inline; filename=cpqarry-fix-return-value-of-cpqarray_init.patch +Content-Length: 1600 +Lines: 48 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Andrey Borzenkov + +commit 2197d18ded232ef6eef63cce57b6b21eddf1b7b6 upstream. + +As reported by Dick Gevers on Compaq ProLiant: + +Oct 13 18:06:51 dvgcpl kernel: Compaq SMART2 Driver (v 2.6.0) +Oct 13 18:06:51 dvgcpl kernel: sys_init_module: 'cpqarray'->init +suspiciously returned 1, it should follow 0/-E convention +Oct 13 18:06:51 dvgcpl kernel: sys_init_module: loading module anyway... +Oct 13 18:06:51 dvgcpl kernel: Pid: 315, comm: modprobe Not tainted +2.6.27-desktop-0.rc8.2mnb #1 +Oct 13 18:06:51 dvgcpl kernel: [] ? printk+0x18/0x1e +Oct 13 18:06:51 dvgcpl kernel: [] sys_init_module+0x155/0x1c0 +Oct 13 18:06:51 dvgcpl kernel: [] syscall_call+0x7/0xb +Oct 13 18:06:51 dvgcpl kernel: ======================= + +Make it return 0 on success and -ENODEV if no array was found. + +Reported-by: Dick Gevers +Signed-off-by: Andrey Borzenkov +Cc: Jens Axboe +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/cpqarray.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/block/cpqarray.c ++++ b/drivers/block/cpqarray.c +@@ -567,7 +567,12 @@ static int __init cpqarray_init(void) + num_cntlrs_reg++; + } + +- return(num_cntlrs_reg); ++ if (num_cntlrs_reg) ++ return 0; ++ else { ++ pci_unregister_driver(&cpqarray_pci_driver); ++ return -ENODEV; ++ } + } + + /* Function to find the first free pointer into our hba[] array */ + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:57 2008 +Message-Id: <20081112001557.786037914@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:40 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Shaohua Li , + Len Brown +Subject: [patch 39/49] ACPI: dock: avoid check _STA method +Content-Disposition: inline; filename=acpi-dock-avoid-check-_sta-method.patch +Content-Length: 1255 +Lines: 42 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Shaohua Li + +commit 8b59560a3baf2e7c24e0fb92ea5d09eca92805db upstream. + +In some BIOSes, every _STA method call will send a notification again, +this cause freeze. And in some BIOSes, it appears _STA should be called +after _DCK. This tries to avoid calls _STA, and still keep the device +present check. + +http://bugzilla.kernel.org/show_bug.cgi?id=10431 + +Signed-off-by: Shaohua Li +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/dock.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/dock.c ++++ b/drivers/acpi/dock.c +@@ -604,14 +604,17 @@ static int handle_eject_request(struct d + static void dock_notify(acpi_handle handle, u32 event, void *data) + { + struct dock_station *ds = data; ++ struct acpi_device *tmp; + + switch (event) { + case ACPI_NOTIFY_BUS_CHECK: +- if (!dock_in_progress(ds) && dock_present(ds)) { ++ if (!dock_in_progress(ds) && acpi_bus_get_device(ds->handle, ++ &tmp)) { + begin_dock(ds); + dock(ds); + if (!dock_present(ds)) { + printk(KERN_ERR PREFIX "Unable to dock!\n"); ++ complete_dock(ds); + break; + } + atomic_notifier_call_chain(&dock_notifier_list, + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:58 2008 +Message-Id: <20081112001558.011849435@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:41 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dmitry Baryshkov , + Russell King , + Pavel Machek +Subject: [patch 40/49] ARM: 5300/1: fixup spitz reset during boot +Content-Disposition: inline; filename=arm-5300-1-fixup-spitz-reset-during-boot.patch +Content-Length: 2647 +Lines: 91 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Dmitry Baryshkov + +commit 69fc7eed5f56bce15b239e5110de2575a6970df4 upstream + +Some machines don't have the pullup/down on their reset +pin, so configuring the reset generating pin as input makes +them reset immediately. Fix that by making reset pin direction +configurable. + +This fixes the boot problem on Sharp Zaurus c3000 + +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Russell King +Signed-off-by: Pavel Machek +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-pxa/include/mach/reset.h | 9 ++++++--- + arch/arm/mach-pxa/reset.c | 9 ++++++--- + arch/arm/mach-pxa/spitz.c | 2 +- + arch/arm/mach-pxa/tosa.c | 2 +- + 4 files changed, 14 insertions(+), 8 deletions(-) + +--- a/arch/arm/mach-pxa/include/mach/reset.h ++++ b/arch/arm/mach-pxa/include/mach/reset.h +@@ -10,9 +10,12 @@ + extern unsigned int reset_status; + extern void clear_reset_status(unsigned int mask); + +-/* +- * register GPIO as reset generator ++/** ++ * init_gpio_reset() - register GPIO as reset generator ++ * ++ * @gpio - gpio nr ++ * @output - set gpio as out/low instead of input during normal work + */ +-extern int init_gpio_reset(int gpio); ++extern int init_gpio_reset(int gpio, int output); + + #endif /* __ASM_ARCH_RESET_H */ +--- a/arch/arm/mach-pxa/reset.c ++++ b/arch/arm/mach-pxa/reset.c +@@ -20,7 +20,7 @@ static void do_hw_reset(void); + + static int reset_gpio = -1; + +-int init_gpio_reset(int gpio) ++int init_gpio_reset(int gpio, int output) + { + int rc; + +@@ -30,9 +30,12 @@ int init_gpio_reset(int gpio) + goto out; + } + +- rc = gpio_direction_input(gpio); ++ if (output) ++ rc = gpio_direction_output(gpio, 0); ++ else ++ rc = gpio_direction_input(gpio); + if (rc) { +- printk(KERN_ERR "Can't configure reset_gpio for input\n"); ++ printk(KERN_ERR "Can't configure reset_gpio\n"); + gpio_free(gpio); + goto out; + } +--- a/arch/arm/mach-pxa/spitz.c ++++ b/arch/arm/mach-pxa/spitz.c +@@ -548,7 +548,7 @@ static void spitz_restart(char mode) + + static void __init common_init(void) + { +- init_gpio_reset(SPITZ_GPIO_ON_RESET); ++ init_gpio_reset(SPITZ_GPIO_ON_RESET, 1); + pm_power_off = spitz_poweroff; + arm_pm_restart = spitz_restart; + +--- a/arch/arm/mach-pxa/tosa.c ++++ b/arch/arm/mach-pxa/tosa.c +@@ -781,7 +781,7 @@ static void __init tosa_init(void) + gpio_set_wake(MFP_PIN_GPIO1, 1); + /* We can't pass to gpio-keys since it will drop the Reset altfunc */ + +- init_gpio_reset(TOSA_GPIO_ON_RESET); ++ init_gpio_reset(TOSA_GPIO_ON_RESET, 0); + + pm_power_off = tosa_poweroff; + arm_pm_restart = tosa_restart; + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:58 2008 +Message-Id: <20081112001558.228152973@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:42 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + David Howells +Subject: [patch 41/49] KEYS: Make request key instantiate the per-user keyrings +Content-Disposition: inline; filename=keys-make-request-key-instantiate-the-per-user-keyrings.patch +Content-Length: 1864 +Lines: 56 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: David Howells + +commit 1f8f5cf6e4f038552a3e47b66085452c08556d71 upstream + +Make request_key() instantiate the per-user keyrings so that it doesn't oops +if it needs to get hold of the user session keyring because there isn't a +session keyring in place. + +Signed-off-by: David Howells +Tested-by: Steve French +Tested-by: Rutger Nijlunsing +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + security/keys/internal.h | 1 + + security/keys/process_keys.c | 2 +- + security/keys/request_key.c | 4 ++++ + 3 files changed, 6 insertions(+), 1 deletion(-) + +--- a/security/keys/internal.h ++++ b/security/keys/internal.h +@@ -107,6 +107,7 @@ extern key_ref_t search_process_keyrings + + extern struct key *find_keyring_by_name(const char *name, bool skip_perm_check); + ++extern int install_user_keyrings(struct task_struct *tsk); + extern int install_thread_keyring(struct task_struct *tsk); + extern int install_process_keyring(struct task_struct *tsk); + +--- a/security/keys/process_keys.c ++++ b/security/keys/process_keys.c +@@ -40,7 +40,7 @@ struct key_user root_key_user = { + /* + * install user and user session keyrings for a particular UID + */ +-static int install_user_keyrings(struct task_struct *tsk) ++int install_user_keyrings(struct task_struct *tsk) + { + struct user_struct *user = tsk->user; + struct key *uid_keyring, *session_keyring; +--- a/security/keys/request_key.c ++++ b/security/keys/request_key.c +@@ -74,6 +74,10 @@ static int call_sbin_request_key(struct + + kenter("{%d},{%d},%s", key->serial, authkey->serial, op); + ++ ret = install_user_keyrings(tsk); ++ if (ret < 0) ++ goto error_alloc; ++ + /* allocate a new session keyring */ + sprintf(desc, "_req.%u", key->serial); + + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:58 2008 +Message-Id: <20081112001558.418868622@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:43 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tejun Heo , + Shane Huang , + Jeff Garzik +Subject: [patch 42/49] libata: fix last_reset timestamp handling +Content-Disposition: inline; filename=libata-fix-last_reset-timestamp-handling.patch +Content-Length: 2991 +Lines: 92 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Tejun Heo + +commit 19b723218bde79c60a394a3caee9eb156ac2d356 upstream + +ehc->last_reset is used to ensure that resets are not issued too +close to each other. It's initialized to jiffies minus one minute +on EH entry. However, when new links are initialized after PMP is +probed, new links have zero for this timestamp resulting in long wait +depending on the current jiffies. + +This patch makes last_set considered iff ATA_EHI_DID_RESET is set, in +which case last_reset is always initialized. As an added precaution, +WARN_ON() is added so that warning is printed if last_reset is +in future. + +This problem is spotted and debugged by Shane Huang. + +Signed-off-by: Tejun Heo +Cc: Shane Huang +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-eh.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -604,9 +604,6 @@ void ata_scsi_error(struct Scsi_Host *ho + if (ata_ncq_enabled(dev)) + ehc->saved_ncq_enabled |= 1 << devno; + } +- +- /* set last reset timestamp to some time in the past */ +- ehc->last_reset = jiffies - 60 * HZ; + } + + ap->pflags |= ATA_PFLAG_EH_IN_PROGRESS; +@@ -2209,17 +2206,21 @@ int ata_eh_reset(struct ata_link *link, + if (link->flags & ATA_LFLAG_NO_SRST) + softreset = NULL; + +- now = jiffies; +- deadline = ata_deadline(ehc->last_reset, ATA_EH_RESET_COOL_DOWN); +- if (time_before(now, deadline)) +- schedule_timeout_uninterruptible(deadline - now); ++ /* make sure each reset attemp is at least COOL_DOWN apart */ ++ if (ehc->i.flags & ATA_EHI_DID_RESET) { ++ now = jiffies; ++ WARN_ON(time_after(ehc->last_reset, now)); ++ deadline = ata_deadline(ehc->last_reset, ++ ATA_EH_RESET_COOL_DOWN); ++ if (time_before(now, deadline)) ++ schedule_timeout_uninterruptible(deadline - now); ++ } + + spin_lock_irqsave(ap->lock, flags); + ap->pflags |= ATA_PFLAG_RESETTING; + spin_unlock_irqrestore(ap->lock, flags); + + ata_eh_about_to_do(link, NULL, ATA_EH_RESET); +- ehc->last_reset = jiffies; + + ata_link_for_each_dev(dev, link) { + /* If we issue an SRST then an ATA drive (not ATAPI) +@@ -2285,7 +2286,6 @@ int ata_eh_reset(struct ata_link *link, + /* + * Perform reset + */ +- ehc->last_reset = jiffies; + if (ata_is_host_link(link)) + ata_eh_freeze_port(ap); + +@@ -2297,6 +2297,7 @@ int ata_eh_reset(struct ata_link *link, + reset == softreset ? "soft" : "hard"); + + /* mark that this EH session started with reset */ ++ ehc->last_reset = jiffies; + if (reset == hardreset) + ehc->i.flags |= ATA_EHI_DID_HARDRESET; + else +@@ -2404,7 +2405,7 @@ int ata_eh_reset(struct ata_link *link, + + /* reset successful, schedule revalidation */ + ata_eh_done(link, NULL, ATA_EH_RESET); +- ehc->last_reset = jiffies; ++ ehc->last_reset = jiffies; /* update to completion time */ + ehc->i.action |= ATA_EH_REVALIDATE; + + rc = 0; + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:58 2008 +Message-Id: <20081112001558.597878733@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:44 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Greg KH +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Matthew Ranostay , + Takashi Iwai +Subject: [patch 43/49] ALSA: hda: make a STAC_DELL_EQ option +Content-Disposition: inline; filename=alsa-hda-make-a-stac_dell_eq-option.patch +Content-Length: 2187 +Lines: 76 + + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Matthew Ranostay + +commit 6b3ab21ef1ac15db4b053ce0ba8eae0ef9361c8a upstream. + +Add support for explicitly enabling the EQ distortion hack for +systems without software biquad support. + +Signed-off-by: Matthew Ranostay +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_sigmatel.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/sound/pci/hda/patch_sigmatel.c ++++ b/sound/pci/hda/patch_sigmatel.c +@@ -67,6 +67,7 @@ enum { + enum { + STAC_92HD73XX_REF, + STAC_DELL_M6, ++ STAC_DELL_EQ, + STAC_92HD73XX_MODELS + }; + +@@ -560,9 +561,7 @@ static struct hda_verb dell_eq_core_init + }; + + static struct hda_verb dell_m6_core_init[] = { +- /* set master volume to max value without distortion +- * and direct control */ +- { 0x1f, AC_VERB_SET_VOLUME_KNOB_CONTROL, 0xec}, ++ { 0x1f, AC_VERB_SET_VOLUME_KNOB_CONTROL, 0xff}, + /* setup audio connections */ + { 0x0d, AC_VERB_SET_CONNECT_SEL, 0x00}, + { 0x0a, AC_VERB_SET_CONNECT_SEL, 0x01}, +@@ -1297,11 +1296,13 @@ static unsigned int dell_m6_pin_configs[ + static unsigned int *stac92hd73xx_brd_tbl[STAC_92HD73XX_MODELS] = { + [STAC_92HD73XX_REF] = ref92hd73xx_pin_configs, + [STAC_DELL_M6] = dell_m6_pin_configs, ++ [STAC_DELL_EQ] = dell_m6_pin_configs, + }; + + static const char *stac92hd73xx_models[STAC_92HD73XX_MODELS] = { + [STAC_92HD73XX_REF] = "ref", + [STAC_DELL_M6] = "dell-m6", ++ [STAC_DELL_EQ] = "dell-eq", + }; + + static struct snd_pci_quirk stac92hd73xx_cfg_tbl[] = { +@@ -3560,8 +3561,12 @@ again: + spec->gpio_data = 0x01; + + switch (spec->board_config) { +- case STAC_DELL_M6: ++ case STAC_DELL_EQ: + spec->init = dell_eq_core_init; ++ /* fallthru */ ++ case STAC_DELL_M6: ++ if (!spec->init) ++ spec->init = dell_m6_core_init; + switch (codec->subsystem_id) { + case 0x1028025e: /* Analog Mics */ + case 0x1028025f: +@@ -3570,8 +3575,6 @@ again: + break; + case 0x10280271: /* Digital Mics */ + case 0x10280272: +- spec->init = dell_m6_core_init; +- /* fall-through */ + case 0x10280254: + case 0x10280255: + stac92xx_set_config_reg(codec, 0x13, 0x90A60160); + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:58 2008 +Message-Id: <20081112001558.813857440@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:45 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Rafael J. Wysocki" , + Pavel Machek +Subject: [patch 44/49] Fix __pfn_to_page(pfn) for CONFIG_DISCONTIGMEM=y +Content-Disposition: inline; filename=fix-__pfn_to_page-for-config_discontigmem-y.patch +Content-Length: 1257 +Lines: 36 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Rafael J. Wysocki + +commit c5d712433ff57a66d8fb79a57a4fc7a7c3467b97 upstream + +Fix the __pfn_to_page(pfn) macro so that it doesn't evaluate its +argument twice in the CONFIG_DISCONTIGMEM=y case, because 'pfn' may +be a result of a funtion call having side effects. + +For example, the hibernation code applies pfn_to_page(pfn) to the +result of a function returning the pfn corresponding to the next set +bit in a bitmap and the current bit position is modified on each +call. This leads to "interesting" failures for CONFIG_DISCONTIGMEM=y +due to the current behavior of __pfn_to_page(pfn). + +Signed-off-by: Rafael J. Wysocki +Acked-by: Pavel Machek +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + include/asm-generic/memory_model.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/asm-generic/memory_model.h ++++ b/include/asm-generic/memory_model.h +@@ -34,7 +34,7 @@ + + #define __pfn_to_page(pfn) \ + ({ unsigned long __pfn = (pfn); \ +- unsigned long __nid = arch_pfn_to_nid(pfn); \ ++ unsigned long __nid = arch_pfn_to_nid(__pfn); \ + NODE_DATA(__nid)->node_mem_map + arch_local_page_offset(__pfn, __nid);\ + }) + + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:59 2008 +Message-Id: <20081112001559.015928933@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:46 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Pierre Ossman +Subject: [patch 45/49] mmc: increase SD write timeout for crappy cards +Content-Disposition: inline; filename=mmc-increase-sd-write-timeout-for-crappy-cards.patch +Content-Length: 926 +Lines: 35 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Pierre Ossman + +commit 493890e75d98810a3470b4aae23be628ee5e9667 upstream. + +It seems that some cards are slightly out of spec and occasionally +will not be able to complete a write in the alloted 250 ms [1]. +Incease the timeout slightly to allow even these cards to function +properly. + +[1] http://lkml.org/lkml/2008/9/23/390 + +Signed-off-by: Pierre Ossman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/core/core.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/mmc/core/core.c ++++ b/drivers/mmc/core/core.c +@@ -280,7 +280,11 @@ void mmc_set_data_timeout(struct mmc_dat + (card->host->ios.clock / 1000); + + if (data->flags & MMC_DATA_WRITE) +- limit_us = 250000; ++ /* ++ * The limit is really 250 ms, but that is ++ * insufficient for some crappy cards. ++ */ ++ limit_us = 300000; + else + limit_us = 100000; + + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:59 2008 +Message-Id: <20081112001559.213801288@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:47 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eric Sesterhenn , + Roman Zippel +Subject: [patch 46/49] hfsplus: fix Buffer overflow with a corrupted image (CVE-2008-4933) +Content-Disposition: inline; filename=hfsplus-fix-buffer-overflow-with-a-corrupted-image.patch +Content-Length: 6267 +Lines: 122 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Eric Sesterhenn + +commit efc7ffcb4237f8cb9938909041c4ed38f6e1bf40 upstream + +When an hfsplus image gets corrupted it might happen that the catalog +namelength field gets b0rked. If we mount such an image the memcpy() in +hfsplus_cat_build_key_uni() writes more than the 255 that fit in the name +field. Depending on the size of the overwritten data, we either only get +memory corruption or also trigger an oops like this: + +[ 221.628020] BUG: unable to handle kernel paging request at c82b0000 +[ 221.629066] IP: [] hfsplus_find_cat+0x10d/0x151 +[ 221.629066] *pde = 0ea29163 *pte = 082b0160 +[ 221.629066] Oops: 0002 [#1] PREEMPT DEBUG_PAGEALLOC +[ 221.629066] Modules linked in: +[ 221.629066] +[ 221.629066] Pid: 4845, comm: mount Not tainted (2.6.27-rc4-00123-gd3ee1b4-dirty #28) +[ 221.629066] EIP: 0060:[] EFLAGS: 00010206 CPU: 0 +[ 221.629066] EIP is at hfsplus_find_cat+0x10d/0x151 +[ 221.629066] EAX: 00000029 EBX: 00016210 ECX: 000042c2 EDX: 00000002 +[ 221.629066] ESI: c82d70ca EDI: c82b0000 EBP: c82d1bcc ESP: c82d199c +[ 221.629066] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068 +[ 221.629066] Process mount (pid: 4845, ti=c82d1000 task=c8224060 task.ti=c82d1000) +[ 221.629066] Stack: c080b3c4 c82aa8f8 c82d19c2 00016210 c080b3be c82d1bd4 c82aa8f0 00000300 +[ 221.629066] 01000000 750008b1 74006e00 74006900 65006c00 c82d6400 c013bd35 c8224060 +[ 221.629066] 00000036 00000046 c82d19f0 00000082 c8224548 c8224060 00000036 c0d653cc +[ 221.629066] Call Trace: +[ 221.629066] [] ? trace_hardirqs_off+0xb/0xd +[ 221.629066] [] ? trace_hardirqs_off_caller+0x14/0x9b +[ 221.629066] [] ? trace_hardirqs_off+0xb/0xd +[ 221.629066] [] ? trace_hardirqs_off_caller+0x14/0x9b +[ 221.629066] [] ? trace_hardirqs_off+0xb/0xd +[ 221.629066] [] ? native_sched_clock+0x82/0x96 +[ 221.629066] [] ? __kernel_text_address+0x1b/0x27 +[ 221.629066] [] ? dump_trace+0xca/0xd6 +[ 221.629066] [] ? save_stack_address+0x0/0x2c +[ 221.629066] [] ? save_stack_trace+0x1c/0x3a +[ 221.629066] [] ? save_trace+0x37/0x8d +[ 221.629066] [] ? add_lock_to_list+0x67/0x8d +[ 221.629066] [] ? validate_chain+0x8a4/0x9f4 +[ 221.629066] [] ? down+0xc/0x2f +[ 221.629066] [] ? __lock_acquire+0x68a/0x6e0 +[ 221.629066] [] ? trace_hardirqs_off+0xb/0xd +[ 221.629066] [] ? trace_hardirqs_off_caller+0x14/0x9b +[ 221.629066] [] ? trace_hardirqs_off+0xb/0xd +[ 221.629066] [] ? native_sched_clock+0x82/0x96 +[ 221.629066] [] ? mark_held_locks+0x43/0x5a +[ 221.629066] [] ? trace_hardirqs_on+0xb/0xd +[ 221.629066] [] ? trace_hardirqs_on_caller+0xf4/0x12f +[ 221.629066] [] ? _spin_unlock_irqrestore+0x42/0x58 +[ 221.629066] [] ? down+0x2b/0x2f +[ 221.629066] [] ? hfsplus_iget+0xa0/0x154 +[ 221.629066] [] ? hfsplus_fill_super+0x280/0x447 +[ 221.629066] [] ? native_sched_clock+0x82/0x96 +[ 221.629066] [] ? trace_hardirqs_off_caller+0x14/0x9b +[ 221.629066] [] ? trace_hardirqs_off_caller+0x14/0x9b +[ 221.629066] [] ? __lock_acquire+0x68a/0x6e0 +[ 221.629066] [] ? string+0x2b/0x74 +[ 221.629066] [] ? vsnprintf+0x2e9/0x512 +[ 221.629066] [] ? dump_trace+0xca/0xd6 +[ 221.629066] [] ? save_stack_trace+0x1c/0x3a +[ 221.629066] [] ? save_stack_trace+0x1c/0x3a +[ 221.629066] [] ? save_trace+0x37/0x8d +[ 221.629066] [] ? add_lock_to_list+0x67/0x8d +[ 221.629066] [] ? validate_chain+0x8a4/0x9f4 +[ 221.629066] [] ? up+0xc/0x2f +[ 221.629066] [] ? __lock_acquire+0x68a/0x6e0 +[ 221.629066] [] ? trace_hardirqs_off+0xb/0xd +[ 221.629066] [] ? trace_hardirqs_off_caller+0x14/0x9b +[ 221.629066] [] ? trace_hardirqs_off+0xb/0xd +[ 221.629066] [] ? native_sched_clock+0x82/0x96 +[ 221.629066] [] ? snprintf+0x1b/0x1d +[ 221.629066] [] ? disk_name+0x25/0x67 +[ 221.629066] [] ? get_sb_bdev+0xcd/0x10b +[ 221.629066] [] ? kstrdup+0x2a/0x4c +[ 221.629066] [] ? hfsplus_get_sb+0x13/0x15 +[ 221.629066] [] ? hfsplus_fill_super+0x0/0x447 +[ 221.629066] [] ? vfs_kern_mount+0x3b/0x76 +[ 221.629066] [] ? do_kern_mount+0x32/0xba +[ 221.629066] [] ? do_new_mount+0x46/0x74 +[ 221.629066] [] ? do_mount+0x175/0x193 +[ 221.629066] [] ? trace_hardirqs_on_caller+0xf4/0x12f +[ 221.629066] [] ? __get_free_pages+0x1e/0x24 +[ 221.629066] [] ? lock_kernel+0x19/0x8c +[ 221.629066] [] ? sys_mount+0x51/0x9b +[ 221.629066] [] ? sys_mount+0x64/0x9b +[ 221.629066] [] ? sysenter_do_call+0x12/0x31 +[ 221.629066] ======================= +[ 221.629066] Code: 89 c2 c1 e2 08 c1 e8 08 09 c2 8b 85 e8 fd ff ff 66 89 50 06 89 c7 53 83 c7 08 56 57 68 c4 b3 80 c0 e8 8c 5c ef ff 89 d9 c1 e9 02 a5 89 d9 83 e1 03 74 02 f3 a4 83 c3 06 8b 95 e8 fd ff ff 0f +[ 221.629066] EIP: [] hfsplus_find_cat+0x10d/0x151 SS:ESP 0068:c82d199c +[ 221.629066] ---[ end trace e417a1d67f0d0066 ]--- + +Since hfsplus_cat_build_key_uni() returns void and only has one callsite, +the check is performed at the callsite. + +Signed-off-by: Eric Sesterhenn +Reviewed-by: Pekka Enberg +Cc: Roman Zippel +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/hfsplus/catalog.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/fs/hfsplus/catalog.c ++++ b/fs/hfsplus/catalog.c +@@ -168,6 +168,11 @@ int hfsplus_find_cat(struct super_block + return -EIO; + } + ++ if (be16_to_cpu(tmp.thread.nodeName.length) > 255) { ++ printk(KERN_ERR "hfs: catalog name length corrupted\n"); ++ return -EIO; ++ } ++ + hfsplus_cat_build_key_uni(fd->search_key, be32_to_cpu(tmp.thread.parentID), + &tmp.thread.nodeName); + return hfs_brec_find(fd); + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:59 2008 +Message-Id: <20081112001559.404539218@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:48 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eric Sesterhenn , + Roman Zippel +Subject: [patch 47/49] hfsplus: check read_mapping_page() return value (CVE-2008-4934) +Content-Disposition: inline; filename=hfsplus-check-read_mapping_page-return-value.patch +Content-Length: 4650 +Lines: 105 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Eric Sesterhenn + +commit 649f1ee6c705aab644035a7998d7b574193a598a upstream. + +While testing more corrupted images with hfsplus, i came across +one which triggered the following bug: + +[15840.675016] BUG: unable to handle kernel paging request at fffffffb +[15840.675016] IP: [] kmap+0x15/0x56 +[15840.675016] *pde = 00008067 *pte = 00000000 +[15840.675016] Oops: 0000 [#1] PREEMPT DEBUG_PAGEALLOC +[15840.675016] Modules linked in: +[15840.675016] +[15840.675016] Pid: 11575, comm: ln Not tainted (2.6.27-rc4-00123-gd3ee1b4-dirty #29) +[15840.675016] EIP: 0060:[] EFLAGS: 00010202 CPU: 0 +[15840.675016] EIP is at kmap+0x15/0x56 +[15840.675016] EAX: 00000246 EBX: fffffffb ECX: 00000000 EDX: cab919c0 +[15840.675016] ESI: 000007dd EDI: cab0bcf4 EBP: cab0bc98 ESP: cab0bc94 +[15840.675016] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068 +[15840.675016] Process ln (pid: 11575, ti=cab0b000 task=cab919c0 task.ti=cab0b000) +[15840.675016] Stack: 00000000 cab0bcdc c0231cfb 00000000 cab0bce0 00000800 ca9290c0 fffffffb +[15840.675016] cab145d0 cab919c0 cab15998 22222222 22222222 22222222 00000001 cab15960 +[15840.675016] 000007dd cab0bcf4 cab0bd04 c022cb3a cab0bcf4 cab15a6c ca9290c0 00000000 +[15840.675016] Call Trace: +[15840.675016] [] ? hfsplus_block_allocate+0x6f/0x2d3 +[15840.675016] [] ? hfsplus_file_extend+0xc4/0x1db +[15840.675016] [] ? hfsplus_get_block+0x8c/0x19d +[15840.675016] [] ? sub_preempt_count+0x9d/0xab +[15840.675016] [] ? __block_prepare_write+0x147/0x311 +[15840.675016] [] ? __grab_cache_page+0x52/0x73 +[15840.675016] [] ? block_write_begin+0x79/0xd5 +[15840.675016] [] ? hfsplus_get_block+0x0/0x19d +[15840.675016] [] ? cont_write_begin+0x27f/0x2af +[15840.675016] [] ? hfsplus_get_block+0x0/0x19d +[15840.675016] [] ? tick_program_event+0x28/0x4c +[15840.675016] [] ? trace_hardirqs_off+0xb/0xd +[15840.675016] [] ? hfsplus_write_begin+0x2d/0x32 +[15840.675016] [] ? hfsplus_get_block+0x0/0x19d +[15840.675016] [] ? pagecache_write_begin+0x33/0x107 +[15840.675016] [] ? __page_symlink+0x3c/0xae +[15840.675016] [] ? __mark_inode_dirty+0x12f/0x137 +[15840.675016] [] ? page_symlink+0x19/0x1e +[15840.675016] [] ? hfsplus_symlink+0x41/0xa6 +[15840.675016] [] ? vfs_symlink+0x99/0x101 +[15840.675016] [] ? sys_symlinkat+0x6b/0xad +[15840.675016] [] ? sys_symlink+0x10/0x12 +[15840.675016] [] ? sysenter_do_call+0x12/0x31 +[15840.675016] ======================= +[15840.675016] Code: 00 00 75 10 83 3d 88 2f ec c0 02 75 07 89 d0 e8 12 56 05 00 5d c3 55 ba 06 00 00 00 89 e5 53 89 c3 b8 3d eb 7e c0 e8 16 74 00 00 <8b> 03 c1 e8 1e 69 c0 d8 02 00 00 05 b8 69 8e c0 2b 80 c4 02 00 +[15840.675016] EIP: [] kmap+0x15/0x56 SS:ESP 0068:cab0bc94 +[15840.675016] ---[ end trace 4fea40dad6b70e5f ]--- + +This happens because the return value of read_mapping_page() is passed on +to kmap unchecked. The bug is triggered after the first +read_mapping_page() in hfsplus_block_allocate(), this patch fixes all +three usages in this functions but leaves the ones further down in the +file unchanged. + +Signed-off-by: Eric Sesterhenn +Cc: Roman Zippel +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/hfsplus/bitmap.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/fs/hfsplus/bitmap.c ++++ b/fs/hfsplus/bitmap.c +@@ -32,6 +32,10 @@ int hfsplus_block_allocate(struct super_ + mutex_lock(&HFSPLUS_SB(sb).alloc_file->i_mutex); + mapping = HFSPLUS_SB(sb).alloc_file->i_mapping; + page = read_mapping_page(mapping, offset / PAGE_CACHE_BITS, NULL); ++ if (IS_ERR(page)) { ++ start = size; ++ goto out; ++ } + pptr = kmap(page); + curr = pptr + (offset & (PAGE_CACHE_BITS - 1)) / 32; + i = offset % 32; +@@ -73,6 +77,10 @@ int hfsplus_block_allocate(struct super_ + break; + page = read_mapping_page(mapping, offset / PAGE_CACHE_BITS, + NULL); ++ if (IS_ERR(page)) { ++ start = size; ++ goto out; ++ } + curr = pptr = kmap(page); + if ((size ^ offset) / PAGE_CACHE_BITS) + end = pptr + PAGE_CACHE_BITS / 32; +@@ -120,6 +128,10 @@ found: + offset += PAGE_CACHE_BITS; + page = read_mapping_page(mapping, offset / PAGE_CACHE_BITS, + NULL); ++ if (IS_ERR(page)) { ++ start = size; ++ goto out; ++ } + pptr = kmap(page); + curr = pptr; + end = pptr + PAGE_CACHE_BITS / 32; + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:59 2008 +Message-Id: <20081112001559.611949866@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:49 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Roman Zippel , + Eric Sesterhenn +Subject: [patch 48/49] hfs: fix namelength memory corruption (CVE-2008-5025) +Content-Disposition: inline; filename=hfs-fix-namelength-memory-corruption.patch +Content-Length: 1134 +Lines: 34 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Eric Sesterhenn + +commit d38b7aa7fc3371b52d036748028db50b585ade2e upstream + +Fix a stack corruption caused by a corrupted hfs filesystem. If the +catalog name length is corrupted the memcpy overwrites the catalog btree +structure. Since the field is limited to HFS_NAMELEN bytes in the +structure and the file format, we throw an error if it is too long. + +Cc: Roman Zippel +Signed-off-by: Eric Sesterhenn +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/hfs/catalog.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/fs/hfs/catalog.c ++++ b/fs/hfs/catalog.c +@@ -190,6 +190,10 @@ int hfs_cat_find_brec(struct super_block + + fd->search_key->cat.ParID = rec.thread.ParID; + len = fd->search_key->cat.CName.len = rec.thread.CName.len; ++ if (len > HFS_NAMELEN) { ++ printk(KERN_ERR "hfs: bad catalog namelength\n"); ++ return -EIO; ++ } + memcpy(fd->search_key->cat.CName.name, rec.thread.CName.name, len); + return hfs_brec_find(fd); + } + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:59 2008 +Message-Id: <20081112001559.797434194@mini.kroah.org> +References: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:50 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Paul Stoffregen , + Jiri Kosina +Subject: [patch 49/49] HID: fix incorrent length condition in hidraw_write() +Content-Disposition: inline; filename=hid-fix-incorrent-length-condition-in-hidraw_write.patch +Content-Length: 921 +Lines: 38 + +2.6.27-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jiri Kosina + +upstream commit 2b107d629dc0c35de606bb7b010b829cd247a93a + +From: Jiri Kosina + +The bound check on the buffer length + + if (count > HID_MIN_BUFFER_SIZE) + +is of course incorrent, the proper check is + + if (count > HID_MAX_BUFFER_SIZE) + +Fix it. + +Reported-by: Jerry Ryle +Signed-off-by: Jiri Kosina +Cc: Paul Stoffregen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hidraw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hid/hidraw.c ++++ b/drivers/hid/hidraw.c +@@ -113,7 +113,7 @@ static ssize_t hidraw_write(struct file + if (!dev->hid_output_raw_report) + return -ENODEV; + +- if (count > HID_MIN_BUFFER_SIZE) { ++ if (count > HID_MAX_BUFFER_SIZE) { + printk(KERN_WARNING "hidraw: pid %d passed too large report\n", + task_pid_nr(current)); + return -EINVAL; + +-- + +From gregkh@mini.kroah.org Tue Nov 11 16:15:50 2008 +Message-Id: <20081112001401.926965113@mini.kroah.org> +User-Agent: quilt/0.46-1 +Date: Tue, 11 Nov 2008 16:14:01 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + Chuck Ebbert , + Domenico Andreoli , + Willy Tarreau , + Rodrigo Rubira Branco , + Jake Edge , + Eugene Teo , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 00/49] 2.6.27.5 stable review +Content-Length: 4040 +Lines: 80 + +This is the start of the stable review cycle for the 2.6.27.5 release. +There are 49 patches in this series, all will be posted as a response to +this one. If anyone has any issues with these being applied, please let +us know. If anyone is a maintainer of the proper subsystem, and wants +to add a Signed-off-by: line to the patch, please respond with it. + +These patches are sent out with a number of different people on the Cc: +line. If you wish to be a reviewer, please email stable@kernel.org to +add your name to the list. If you want to be off the reviewer list, +also email us. + +Responses should be made by Friday, November 14, 00:00:01 UTC. Anything +received after that time might be too late. + +The whole patch series can be found in one patch at: + kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.27.5-rc1.gz +and the diffstat can be found below. + + +thanks, + +greg k-h + +------------ + Documentation/cciss.txt | 2 + Makefile | 2 + arch/arm/mach-pxa/include/mach/reset.h | 9 + + arch/arm/mach-pxa/reset.c | 9 + + arch/arm/mach-pxa/spitz.c | 2 + arch/arm/mach-pxa/tosa.c | 2 + arch/arm/mm/cache-xsc3l2.c | 4 + arch/x86/Kconfig | 20 ++++ + arch/x86/kernel/setup.c | 41 ++++++++ + arch/x86/kernel/tsc.c | 8 - + drivers/acpi/dock.c | 5 - + drivers/ata/libata-eh.c | 21 ++-- + drivers/block/cciss.c | 28 +++++ + drivers/block/cpqarray.c | 7 + + drivers/dca/dca-core.c | 2 + drivers/dma/ioat_dma.c | 11 +- + drivers/dma/iovlock.c | 17 +-- + drivers/hid/hidraw.c | 2 + drivers/md/linear.c | 2 + drivers/md/raid10.c | 2 + drivers/mmc/core/core.c | 6 + + drivers/mtd/chips/cfi_cmdset_0002.c | 13 -- + drivers/mtd/chips/jedec_probe.c | 10 -- + drivers/net/r8169.c | 134 ++++++++++++++-------------- + drivers/net/wireless/iwlwifi/iwl-5000-hw.h | 7 + + drivers/net/wireless/iwlwifi/iwl-5000.c | 63 +------------ + drivers/net/wireless/iwlwifi/iwl-agn.c | 57 ++++++++--- + drivers/net/wireless/iwlwifi/iwl-calib.c | 60 ++++++++++++ + drivers/net/wireless/iwlwifi/iwl-core.c | 27 +---- + drivers/net/wireless/iwlwifi/iwl-core.h | 8 + + drivers/net/wireless/iwlwifi/iwl-dev.h | 15 +-- + drivers/net/wireless/iwlwifi/iwl-power.c | 39 +++++++- + drivers/net/wireless/iwlwifi/iwl-power.h | 4 + drivers/net/wireless/iwlwifi/iwl-scan.c | 8 - + drivers/net/wireless/iwlwifi/iwl3945-base.c | 7 + + drivers/net/wireless/zd1211rw/zd_usb.c | 2 + fs/ext3/super.c | 11 +- + fs/hfs/catalog.c | 4 + fs/hfsplus/bitmap.c | 12 ++ + fs/hfsplus/catalog.c | 5 + + fs/jffs2/background.c | 10 +- + fs/jffs2/compr_lzo.c | 15 +-- + include/asm-generic/memory_model.h | 2 + include/linux/mtd/cfi.h | 22 +++- + include/net/af_unix.h | 1 + kernel/cgroup.c | 1 + mm/hugetlb.c | 49 +++++++++- + mm/internal.h | 29 ++++++ + mm/page_alloc.c | 28 ++++- + net/unix/af_unix.c | 31 +++++- + net/unix/garbage.c | 49 +++++++--- + security/keys/internal.h | 1 + security/keys/process_keys.c | 2 + security/keys/request_key.c | 4 + sound/pci/hda/patch_sigmatel.c | 15 +-- + 55 files changed, 647 insertions(+), 300 deletions(-) + diff --git a/queue-2.6.27/md-fix-bug-in-raid10-recovery.patch b/review-2.6.27/md-fix-bug-in-raid10-recovery.patch similarity index 100% rename from queue-2.6.27/md-fix-bug-in-raid10-recovery.patch rename to review-2.6.27/md-fix-bug-in-raid10-recovery.patch diff --git a/queue-2.6.27/md-linear-fix-a-division-by-zero-bug-for-very-small-arrays.patch b/review-2.6.27/md-linear-fix-a-division-by-zero-bug-for-very-small-arrays.patch similarity index 100% rename from queue-2.6.27/md-linear-fix-a-division-by-zero-bug-for-very-small-arrays.patch rename to review-2.6.27/md-linear-fix-a-division-by-zero-bug-for-very-small-arrays.patch diff --git a/queue-2.6.27/mmc-increase-sd-write-timeout-for-crappy-cards.patch b/review-2.6.27/mmc-increase-sd-write-timeout-for-crappy-cards.patch similarity index 100% rename from queue-2.6.27/mmc-increase-sd-write-timeout-for-crappy-cards.patch rename to review-2.6.27/mmc-increase-sd-write-timeout-for-crappy-cards.patch diff --git a/queue-2.6.27/mtd-fix-cfi_send_gen_cmd-handling-of-x16-devices-in-x8-mode.patch b/review-2.6.27/mtd-fix-cfi_send_gen_cmd-handling-of-x16-devices-in-x8-mode.patch similarity index 100% rename from queue-2.6.27/mtd-fix-cfi_send_gen_cmd-handling-of-x16-devices-in-x8-mode.patch rename to review-2.6.27/mtd-fix-cfi_send_gen_cmd-handling-of-x16-devices-in-x8-mode.patch diff --git a/queue-2.6.27/net-unix-fix-inflight-counting-bug-in-garbage-collector.patch b/review-2.6.27/net-unix-fix-inflight-counting-bug-in-garbage-collector.patch similarity index 100% rename from queue-2.6.27/net-unix-fix-inflight-counting-bug-in-garbage-collector.patch rename to review-2.6.27/net-unix-fix-inflight-counting-bug-in-garbage-collector.patch diff --git a/queue-2.6.27/r8169-fix-rxmissed-register-access.patch b/review-2.6.27/r8169-fix-rxmissed-register-access.patch similarity index 100% rename from queue-2.6.27/r8169-fix-rxmissed-register-access.patch rename to review-2.6.27/r8169-fix-rxmissed-register-access.patch diff --git a/queue-2.6.27/r8169-get-ethtool-settings-through-the-generic-mii-helper.patch b/review-2.6.27/r8169-get-ethtool-settings-through-the-generic-mii-helper.patch similarity index 100% rename from queue-2.6.27/r8169-get-ethtool-settings-through-the-generic-mii-helper.patch rename to review-2.6.27/r8169-get-ethtool-settings-through-the-generic-mii-helper.patch diff --git a/queue-2.6.27/r8169-wake-up-the-phy-of-the-8168.patch b/review-2.6.27/r8169-wake-up-the-phy-of-the-8168.patch similarity index 100% rename from queue-2.6.27/r8169-wake-up-the-phy-of-the-8168.patch rename to review-2.6.27/r8169-wake-up-the-phy-of-the-8168.patch diff --git a/queue-2.6.27/series b/review-2.6.27/series similarity index 100% rename from queue-2.6.27/series rename to review-2.6.27/series diff --git a/queue-2.6.27/x86-add-dmi-quirk-for-ami-bios-which-corrupts-address-0xc000-during-resume.patch b/review-2.6.27/x86-add-dmi-quirk-for-ami-bios-which-corrupts-address-0xc000-during-resume.patch similarity index 100% rename from queue-2.6.27/x86-add-dmi-quirk-for-ami-bios-which-corrupts-address-0xc000-during-resume.patch rename to review-2.6.27/x86-add-dmi-quirk-for-ami-bios-which-corrupts-address-0xc000-during-resume.patch diff --git a/queue-2.6.27/x86-add-x86_reserve_low_64k.patch b/review-2.6.27/x86-add-x86_reserve_low_64k.patch similarity index 100% rename from queue-2.6.27/x86-add-x86_reserve_low_64k.patch rename to review-2.6.27/x86-add-x86_reserve_low_64k.patch diff --git a/queue-2.6.27/x86-don-t-use-tsc_khz-to-calculate-lpj-if-notsc-is-passed.patch b/review-2.6.27/x86-don-t-use-tsc_khz-to-calculate-lpj-if-notsc-is-passed.patch similarity index 100% rename from queue-2.6.27/x86-don-t-use-tsc_khz-to-calculate-lpj-if-notsc-is-passed.patch rename to review-2.6.27/x86-don-t-use-tsc_khz-to-calculate-lpj-if-notsc-is-passed.patch diff --git a/queue-2.6.27/x86-fix-config_x86_reserve_low_64k-y.patch b/review-2.6.27/x86-fix-config_x86_reserve_low_64k-y.patch similarity index 100% rename from queue-2.6.27/x86-fix-config_x86_reserve_low_64k-y.patch rename to review-2.6.27/x86-fix-config_x86_reserve_low_64k-y.patch diff --git a/queue-2.6.27/x86-fix-macro-with-bad_bios_dmi_table.patch b/review-2.6.27/x86-fix-macro-with-bad_bios_dmi_table.patch similarity index 100% rename from queue-2.6.27/x86-fix-macro-with-bad_bios_dmi_table.patch rename to review-2.6.27/x86-fix-macro-with-bad_bios_dmi_table.patch diff --git a/queue-2.6.27/x86-reserve-low-64k-on-ami-and-phoenix-bios-boxen.patch b/review-2.6.27/x86-reserve-low-64k-on-ami-and-phoenix-bios-boxen.patch similarity index 100% rename from queue-2.6.27/x86-reserve-low-64k-on-ami-and-phoenix-bios-boxen.patch rename to review-2.6.27/x86-reserve-low-64k-on-ami-and-phoenix-bios-boxen.patch diff --git a/queue-2.6.27/zd1211rw-add-2-device-ids.patch b/review-2.6.27/zd1211rw-add-2-device-ids.patch similarity index 100% rename from queue-2.6.27/zd1211rw-add-2-device-ids.patch rename to review-2.6.27/zd1211rw-add-2-device-ids.patch