From: Greg Kroah-Hartman Date: Thu, 17 Dec 2009 01:31:14 +0000 (-0800) Subject: start 2.6.31.9 review cycle X-Git-Tag: v2.6.27.42~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=96dc50708eaa59b7025773c7c5712c21d3d80e4f;p=thirdparty%2Fkernel%2Fstable-queue.git start 2.6.31.9 review cycle --- diff --git a/queue-2.6.31/acpi-use-the-arb_disable-for-the-cpu-which-model-id-is-less-than-0x0f.patch b/review-2.6.31/acpi-use-the-arb_disable-for-the-cpu-which-model-id-is-less-than-0x0f.patch similarity index 95% rename from queue-2.6.31/acpi-use-the-arb_disable-for-the-cpu-which-model-id-is-less-than-0x0f.patch rename to review-2.6.31/acpi-use-the-arb_disable-for-the-cpu-which-model-id-is-less-than-0x0f.patch index ff72d59fdbf..cfe856fe4e1 100644 --- a/queue-2.6.31/acpi-use-the-arb_disable-for-the-cpu-which-model-id-is-less-than-0x0f.patch +++ b/review-2.6.31/acpi-use-the-arb_disable-for-the-cpu-which-model-id-is-less-than-0x0f.patch @@ -20,7 +20,7 @@ So we still use the ARB_DISABLE for the cpu which mode id is less than 0x0f. http://bugzilla.kernel.org/show_bug.cgi?id=14700 Signed-off-by: Zhao Yakui -Acked-by: Pallipadi, Venkatesh +Acked-by: Venkatesh Pallipadi Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman diff --git a/queue-2.6.31/alsa-hda-terradici-hda-controllers-does-not-support-64-bit-mode.patch b/review-2.6.31/alsa-hda-terradici-hda-controllers-does-not-support-64-bit-mode.patch similarity index 100% rename from queue-2.6.31/alsa-hda-terradici-hda-controllers-does-not-support-64-bit-mode.patch rename to review-2.6.31/alsa-hda-terradici-hda-controllers-does-not-support-64-bit-mode.patch diff --git a/queue-2.6.31/alsa-hrtimer-fix-lock-up.patch b/review-2.6.31/alsa-hrtimer-fix-lock-up.patch similarity index 100% rename from queue-2.6.31/alsa-hrtimer-fix-lock-up.patch rename to review-2.6.31/alsa-hrtimer-fix-lock-up.patch diff --git a/queue-2.6.31/asus-laptop-change-light-sens-default-values.patch b/review-2.6.31/asus-laptop-change-light-sens-default-values.patch similarity index 100% rename from queue-2.6.31/asus-laptop-change-light-sens-default-values.patch rename to review-2.6.31/asus-laptop-change-light-sens-default-values.patch diff --git a/queue-2.6.31/ath5k-allow-setting-txpower-to-0.patch b/review-2.6.31/ath5k-allow-setting-txpower-to-0.patch similarity index 100% rename from queue-2.6.31/ath5k-allow-setting-txpower-to-0.patch rename to review-2.6.31/ath5k-allow-setting-txpower-to-0.patch diff --git a/queue-2.6.31/ath5k-enable-eeprom-checksum-check.patch b/review-2.6.31/ath5k-enable-eeprom-checksum-check.patch similarity index 100% rename from queue-2.6.31/ath5k-enable-eeprom-checksum-check.patch rename to review-2.6.31/ath5k-enable-eeprom-checksum-check.patch diff --git a/queue-2.6.31/au1x00-fix-crash-when-trying-register_netdev.patch b/review-2.6.31/au1x00-fix-crash-when-trying-register_netdev.patch similarity index 100% rename from queue-2.6.31/au1x00-fix-crash-when-trying-register_netdev.patch rename to review-2.6.31/au1x00-fix-crash-when-trying-register_netdev.patch diff --git a/queue-2.6.31/b43legacy-avoid-ppc-fault-during-resume.patch b/review-2.6.31/b43legacy-avoid-ppc-fault-during-resume.patch similarity index 100% rename from queue-2.6.31/b43legacy-avoid-ppc-fault-during-resume.patch rename to review-2.6.31/b43legacy-avoid-ppc-fault-during-resume.patch diff --git a/queue-2.6.31/b44-fix-wedge-when-using-netconsole.patch b/review-2.6.31/b44-fix-wedge-when-using-netconsole.patch similarity index 100% rename from queue-2.6.31/b44-fix-wedge-when-using-netconsole.patch rename to review-2.6.31/b44-fix-wedge-when-using-netconsole.patch diff --git a/queue-2.6.31/b44-wol-setup-one-bit-off-stack-corruption-kernel-panic-fix.patch b/review-2.6.31/b44-wol-setup-one-bit-off-stack-corruption-kernel-panic-fix.patch similarity index 100% rename from queue-2.6.31/b44-wol-setup-one-bit-off-stack-corruption-kernel-panic-fix.patch rename to review-2.6.31/b44-wol-setup-one-bit-off-stack-corruption-kernel-panic-fix.patch diff --git a/queue-2.6.31/backlight-lcd-fix-wrong-sizeof.patch b/review-2.6.31/backlight-lcd-fix-wrong-sizeof.patch similarity index 100% rename from queue-2.6.31/backlight-lcd-fix-wrong-sizeof.patch rename to review-2.6.31/backlight-lcd-fix-wrong-sizeof.patch diff --git a/queue-2.6.31/bsdacct-fix-uid-gid-misreporting.patch b/review-2.6.31/bsdacct-fix-uid-gid-misreporting.patch similarity index 100% rename from queue-2.6.31/bsdacct-fix-uid-gid-misreporting.patch rename to review-2.6.31/bsdacct-fix-uid-gid-misreporting.patch diff --git a/queue-2.6.31/debugfs-fix-create-mutex-racy-fops-and-private-data.patch b/review-2.6.31/debugfs-fix-create-mutex-racy-fops-and-private-data.patch similarity index 100% rename from queue-2.6.31/debugfs-fix-create-mutex-racy-fops-and-private-data.patch rename to review-2.6.31/debugfs-fix-create-mutex-racy-fops-and-private-data.patch diff --git a/queue-2.6.31/devpts_get_tty-should-validate-inode.patch b/review-2.6.31/devpts_get_tty-should-validate-inode.patch similarity index 100% rename from queue-2.6.31/devpts_get_tty-should-validate-inode.patch rename to review-2.6.31/devpts_get_tty-should-validate-inode.patch diff --git a/queue-2.6.31/drm-i915-avoid-null-dereference-with-component_only-tv_modes.patch b/review-2.6.31/drm-i915-avoid-null-dereference-with-component_only-tv_modes.patch similarity index 100% rename from queue-2.6.31/drm-i915-avoid-null-dereference-with-component_only-tv_modes.patch rename to review-2.6.31/drm-i915-avoid-null-dereference-with-component_only-tv_modes.patch diff --git a/queue-2.6.31/drm-i915-fix-crt-hotplug-detect-by-checking-really-no-channels-attached.patch b/review-2.6.31/drm-i915-fix-crt-hotplug-detect-by-checking-really-no-channels-attached.patch similarity index 100% rename from queue-2.6.31/drm-i915-fix-crt-hotplug-detect-by-checking-really-no-channels-attached.patch rename to review-2.6.31/drm-i915-fix-crt-hotplug-detect-by-checking-really-no-channels-attached.patch diff --git a/queue-2.6.31/drm-i915-fix-lvds-stability-issue-on-ironlake.patch b/review-2.6.31/drm-i915-fix-lvds-stability-issue-on-ironlake.patch similarity index 100% rename from queue-2.6.31/drm-i915-fix-lvds-stability-issue-on-ironlake.patch rename to review-2.6.31/drm-i915-fix-lvds-stability-issue-on-ironlake.patch diff --git a/queue-2.6.31/drm-i915-pineview-only-has-lvds-and-crt-ports.patch b/review-2.6.31/drm-i915-pineview-only-has-lvds-and-crt-ports.patch similarity index 100% rename from queue-2.6.31/drm-i915-pineview-only-has-lvds-and-crt-ports.patch rename to review-2.6.31/drm-i915-pineview-only-has-lvds-and-crt-ports.patch diff --git a/queue-2.6.31/drm-i915-save-restore-blc-histogram-control-reg-across-suspend-resume.patch b/review-2.6.31/drm-i915-save-restore-blc-histogram-control-reg-across-suspend-resume.patch similarity index 100% rename from queue-2.6.31/drm-i915-save-restore-blc-histogram-control-reg-across-suspend-resume.patch rename to review-2.6.31/drm-i915-save-restore-blc-histogram-control-reg-across-suspend-resume.patch diff --git a/queue-2.6.31/drm-radeon-kms-add-quirk-for-his-x1300-board.patch b/review-2.6.31/drm-radeon-kms-add-quirk-for-his-x1300-board.patch similarity index 100% rename from queue-2.6.31/drm-radeon-kms-add-quirk-for-his-x1300-board.patch rename to review-2.6.31/drm-radeon-kms-add-quirk-for-his-x1300-board.patch diff --git a/queue-2.6.31/drm-radeon-kms-fix-legacy-crtc2-dpms.patch b/review-2.6.31/drm-radeon-kms-fix-legacy-crtc2-dpms.patch similarity index 100% rename from queue-2.6.31/drm-radeon-kms-fix-legacy-crtc2-dpms.patch rename to review-2.6.31/drm-radeon-kms-fix-legacy-crtc2-dpms.patch diff --git a/queue-2.6.31/e100-use-pci-pool-to-work-around-gfp_atomic-order-5-memory-allocation-failure.patch b/review-2.6.31/e100-use-pci-pool-to-work-around-gfp_atomic-order-5-memory-allocation-failure.patch similarity index 100% rename from queue-2.6.31/e100-use-pci-pool-to-work-around-gfp_atomic-order-5-memory-allocation-failure.patch rename to review-2.6.31/e100-use-pci-pool-to-work-around-gfp_atomic-order-5-memory-allocation-failure.patch diff --git a/queue-2.6.31/ext3-fix-data-filesystem-corruption-when-write-fails-to-copy-data.patch b/review-2.6.31/ext3-fix-data-filesystem-corruption-when-write-fails-to-copy-data.patch similarity index 100% rename from queue-2.6.31/ext3-fix-data-filesystem-corruption-when-write-fails-to-copy-data.patch rename to review-2.6.31/ext3-fix-data-filesystem-corruption-when-write-fails-to-copy-data.patch diff --git a/queue-2.6.31/firewire-ohci-handle-receive-packets-with-a-data-length-of-zero.patch b/review-2.6.31/firewire-ohci-handle-receive-packets-with-a-data-length-of-zero.patch similarity index 100% rename from queue-2.6.31/firewire-ohci-handle-receive-packets-with-a-data-length-of-zero.patch rename to review-2.6.31/firewire-ohci-handle-receive-packets-with-a-data-length-of-zero.patch diff --git a/queue-2.6.31/futex-take-mmap_sem-for-get_user_pages-in-fault_in_user_writeable.patch b/review-2.6.31/futex-take-mmap_sem-for-get_user_pages-in-fault_in_user_writeable.patch similarity index 100% rename from queue-2.6.31/futex-take-mmap_sem-for-get_user_pages-in-fault_in_user_writeable.patch rename to review-2.6.31/futex-take-mmap_sem-for-get_user_pages-in-fault_in_user_writeable.patch diff --git a/queue-2.6.31/gro-fix-illegal-merging-of-trailer-trash.patch b/review-2.6.31/gro-fix-illegal-merging-of-trailer-trash.patch similarity index 100% rename from queue-2.6.31/gro-fix-illegal-merging-of-trailer-trash.patch rename to review-2.6.31/gro-fix-illegal-merging-of-trailer-trash.patch diff --git a/queue-2.6.31/hfs-fix-a-potential-buffer-overflow.patch b/review-2.6.31/hfs-fix-a-potential-buffer-overflow.patch similarity index 100% rename from queue-2.6.31/hfs-fix-a-potential-buffer-overflow.patch rename to review-2.6.31/hfs-fix-a-potential-buffer-overflow.patch diff --git a/queue-2.6.31/hrtimer-fix-proc-timer_list-regression.patch b/review-2.6.31/hrtimer-fix-proc-timer_list-regression.patch similarity index 100% rename from queue-2.6.31/hrtimer-fix-proc-timer_list-regression.patch rename to review-2.6.31/hrtimer-fix-proc-timer_list-regression.patch diff --git a/queue-2.6.31/ide-fix-ioctl-to-pass-requested-transfer-mode-to-ide_find_dma_mode-instead-of-udma6.patch b/review-2.6.31/ide-fix-ioctl-to-pass-requested-transfer-mode-to-ide_find_dma_mode-instead-of-udma6.patch similarity index 100% rename from queue-2.6.31/ide-fix-ioctl-to-pass-requested-transfer-mode-to-ide_find_dma_mode-instead-of-udma6.patch rename to review-2.6.31/ide-fix-ioctl-to-pass-requested-transfer-mode-to-ide_find_dma_mode-instead-of-udma6.patch diff --git a/queue-2.6.31/ide-serialize-cmd643-and-cmd646-to-fix-a-hardware-bug-with-ssd.patch b/review-2.6.31/ide-serialize-cmd643-and-cmd646-to-fix-a-hardware-bug-with-ssd.patch similarity index 100% rename from queue-2.6.31/ide-serialize-cmd643-and-cmd646-to-fix-a-hardware-bug-with-ssd.patch rename to review-2.6.31/ide-serialize-cmd643-and-cmd646-to-fix-a-hardware-bug-with-ssd.patch diff --git a/queue-2.6.31/ip_fragment-also-adjust-skb-truesize-for-packets-not-owned-by-a-socket.patch b/review-2.6.31/ip_fragment-also-adjust-skb-truesize-for-packets-not-owned-by-a-socket.patch similarity index 100% rename from queue-2.6.31/ip_fragment-also-adjust-skb-truesize-for-packets-not-owned-by-a-socket.patch rename to review-2.6.31/ip_fragment-also-adjust-skb-truesize-for-packets-not-owned-by-a-socket.patch diff --git a/queue-2.6.31/ipvs-zero-usvc-and-udest.patch b/review-2.6.31/ipvs-zero-usvc-and-udest.patch similarity index 100% rename from queue-2.6.31/ipvs-zero-usvc-and-udest.patch rename to review-2.6.31/ipvs-zero-usvc-and-udest.patch diff --git a/queue-2.6.31/ipw2100-fix-rebooting-hang-with-driver-loaded.patch b/review-2.6.31/ipw2100-fix-rebooting-hang-with-driver-loaded.patch similarity index 100% rename from queue-2.6.31/ipw2100-fix-rebooting-hang-with-driver-loaded.patch rename to review-2.6.31/ipw2100-fix-rebooting-hang-with-driver-loaded.patch diff --git a/queue-2.6.31/jbd2-don-t-wipe-the-journal-on-a-failed-journal-checksum.patch b/review-2.6.31/jbd2-don-t-wipe-the-journal-on-a-failed-journal-checksum.patch similarity index 100% rename from queue-2.6.31/jbd2-don-t-wipe-the-journal-on-a-failed-journal-checksum.patch rename to review-2.6.31/jbd2-don-t-wipe-the-journal-on-a-failed-journal-checksum.patch diff --git a/queue-2.6.31/jffs2-fix-long-standing-bug-with-symlink-garbage-collection.patch b/review-2.6.31/jffs2-fix-long-standing-bug-with-symlink-garbage-collection.patch similarity index 100% rename from queue-2.6.31/jffs2-fix-long-standing-bug-with-symlink-garbage-collection.patch rename to review-2.6.31/jffs2-fix-long-standing-bug-with-symlink-garbage-collection.patch diff --git a/queue-2.6.31/kvm-s390-make-psw-available-on-all-exits-not-just-a-subset.patch b/review-2.6.31/kvm-s390-make-psw-available-on-all-exits-not-just-a-subset.patch similarity index 100% rename from queue-2.6.31/kvm-s390-make-psw-available-on-all-exits-not-just-a-subset.patch rename to review-2.6.31/kvm-s390-make-psw-available-on-all-exits-not-just-a-subset.patch diff --git a/queue-2.6.31/mac80211-fix-bug-in-computing-crc-over-dynamic-ies-in-beacon.patch b/review-2.6.31/mac80211-fix-bug-in-computing-crc-over-dynamic-ies-in-beacon.patch similarity index 100% rename from queue-2.6.31/mac80211-fix-bug-in-computing-crc-over-dynamic-ies-in-beacon.patch rename to review-2.6.31/mac80211-fix-bug-in-computing-crc-over-dynamic-ies-in-beacon.patch diff --git a/queue-2.6.31/matroxfb-fix-problems-with-display-stability.patch b/review-2.6.31/matroxfb-fix-problems-with-display-stability.patch similarity index 100% rename from queue-2.6.31/matroxfb-fix-problems-with-display-stability.patch rename to review-2.6.31/matroxfb-fix-problems-with-display-stability.patch diff --git a/review-2.6.31/mbox b/review-2.6.31/mbox new file mode 100644 index 00000000000..f1892e404c9 --- /dev/null +++ b/review-2.6.31/mbox @@ -0,0 +1,7683 @@ +From gregkh@mini.kroah.org Wed Dec 16 17:15:57 2009 +Message-Id: <20091217011411.258723779@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:11 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [00/90] 2.6.31.9-stable review + +This is the start of the stable review cycle for the 2.6.31.9 release. +There are 90 patches in this series, all will be posted as a response to +this one. If anyone has any issues with these being applied, please let +us know. If anyone is a maintainer of the proper subsystem, and wants +to add a Signed-off-by: line to the patch, please respond with it. + +Responses should be made by Friday, December 19, 00:00:00 UTC. +Anything received after that time might be too late. + +The whole patch series can be found in one patch at: + kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.31.9-rc1.gz +and the diffstat can be found below. + + +thanks, + +greg k-h + +-------------- + + Documentation/kernel-parameters.txt | 2 + + Documentation/video4linux/gspca.txt | 1 + + Makefile | 2 +- + arch/arm/mach-pxa/em-x270.c | 11 +- + arch/powerpc/kernel/vector.S | 2 +- + arch/s390/include/asm/kvm.h | 3 +- + arch/s390/kvm/kvm-s390.c | 25 ++- + arch/sparc/Makefile | 2 + + arch/sparc/kernel/ldc.c | 4 +- + arch/sparc/kernel/of_device_64.c | 14 +- + arch/sparc/lib/mcount.S | 5 +- + arch/sparc/mm/init_64.h | 2 +- + arch/x86/include/asm/mce.h | 6 + + arch/x86/kernel/acpi/cstate.c | 2 +- + arch/x86/kernel/amd_iommu.c | 8 +- + arch/x86/kernel/amd_iommu_init.c | 2 +- + arch/x86/kernel/cpu/intel_cacheinfo.c | 5 +- + arch/x86/kernel/cpu/mcheck/mce.c | 3 +- + arch/x86/kernel/cpu/mcheck/therm_throt.c | 29 +++- + arch/x86/kernel/cpu/perfctr-watchdog.c | 2 +- + arch/x86/kernel/pci-calgary_64.c | 12 +- + arch/x86/kernel/pci-dma.c | 2 +- + arch/x86/kernel/pci-gart_64.c | 2 +- + arch/x86/kernel/reboot.c | 8 + + arch/x86/kernel/setup.c | 3 + + drivers/ata/pata_hpt37x.c | 32 ++-- + drivers/ata/pata_hpt3x2n.c | 17 +- + drivers/firewire/ohci.c | 12 +- + drivers/gpu/drm/i915/i915_drv.h | 5 + + drivers/gpu/drm/i915/i915_reg.h | 2 + + drivers/gpu/drm/i915/i915_suspend.c | 2 + + drivers/gpu/drm/i915/intel_crt.c | 4 +- + drivers/gpu/drm/i915/intel_display.c | 66 ++++-- + drivers/gpu/drm/i915/intel_tv.c | 11 +- + drivers/gpu/drm/radeon/radeon_atombios.c | 8 + + drivers/gpu/drm/radeon/radeon_legacy_crtc.c | 7 +- + drivers/ide/cmd64x.c | 6 +- + drivers/ide/ide-ioctls.c | 2 +- + drivers/ide/ide-probe.c | 9 - + drivers/ide/slc90e66.c | 3 +- + drivers/isdn/i4l/isdn_ppp.c | 342 ++++++++++++-------------- + drivers/md/bitmap.c | 24 ++- + drivers/md/bitmap.h | 2 +- + drivers/md/md.c | 3 +- + drivers/md/md.h | 1 + + drivers/media/common/tuners/mxl5007t.c | 2 +- + drivers/media/video/gspca/ov519.c | 1 + + drivers/net/au1000_eth.c | 15 +- + drivers/net/b44.c | 6 +- + drivers/net/e100.c | 17 +- + drivers/net/smc91x.c | 2 +- + drivers/net/smsc9420.c | 14 + + drivers/net/wireless/ath/ath5k/eeprom.c | 3 +- + drivers/net/wireless/ath/ath5k/phy.c | 2 - + drivers/net/wireless/b43legacy/rfkill.c | 7 + + drivers/net/wireless/ipw2x00/ipw2100.c | 11 + + drivers/net/wireless/p54/p54usb.c | 10 +- + drivers/platform/x86/asus-laptop.c | 4 +- + drivers/platform/x86/thinkpad_acpi.c | 36 +--- + drivers/serial/8250.c | 8 +- + drivers/serial/suncore.c | 37 ++-- + drivers/serial/suncore.h | 5 +- + drivers/serial/sunhv.c | 2 +- + drivers/serial/sunsab.c | 9 +- + drivers/serial/sunsu.c | 36 +++- + drivers/serial/sunzilog.c | 8 +- + drivers/ssb/sprom.c | 20 ++- + drivers/usb/class/usbtmc.c | 14 +- + drivers/usb/core/usb.c | 31 ++-- + drivers/usb/musb/musb_gadget_ep0.c | 1 - + drivers/usb/serial/option.c | 37 +++ + drivers/usb/storage/transport.c | 17 +- + drivers/usb/storage/unusual_devs.h | 7 + + drivers/usb/storage/usb.c | 18 +- + drivers/video/backlight/lcd.c | 2 +- + drivers/video/matrox/g450_pll.c | 3 +- + fs/debugfs/inode.c | 55 +++-- + fs/devpts/inode.c | 16 +- + fs/ext3/inode.c | 18 +- + fs/hfs/catalog.c | 4 + + fs/hfs/dir.c | 11 + + fs/hfs/super.c | 7 +- + fs/jbd2/journal.c | 7 + + fs/jffs2/gc.c | 3 +- + include/linux/hrtimer.h | 4 +- + include/linux/isdn_ppp.h | 2 +- + include/linux/kvm.h | 8 +- + include/linux/usb_usual.h | 4 +- + kernel/acct.c | 3 +- + kernel/futex.c | 10 +- + kernel/sysctl.c | 3 +- + mm/mincore.c | 37 +++ + mm/pagewalk.c | 16 ++- + net/8021q/vlan.c | 7 +- + net/core/dev.c | 22 ++- + net/core/rtnetlink.c | 4 +- + net/core/skbuff.c | 3 +- + net/ipv4/ip_output.c | 2 +- + net/mac80211/util.c | 2 +- + net/netfilter/ipvs/ip_vs_ctl.c | 4 + + net/sunrpc/auth_gss/auth_gss.c | 2 +- + sound/core/hrtimer.c | 15 +- + sound/pci/hda/hda_intel.c | 5 + + 103 files changed, 872 insertions(+), 502 deletions(-) + +From gregkh@mini.kroah.org Wed Dec 16 17:15:58 2009 +Message-Id: <20091217011557.947684930@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:12 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ming Zhao +Subject: [01/90] USB: option: add pid for ZTE + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: zhao.ming9@zte.com.cn + +commit 8d87cacda7c8db5c131bfcaaa1d90bfe918c2ebc upstream. + +This patch adds ZTE modem devices. + +Signed-off-by: Ming Zhao +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 36 ++++++++++++++++++++++++++++++++++++ + 1 file changed, 36 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -577,12 +577,48 @@ static struct usb_device_id option_ids[] + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0086, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0104, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0106, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0108, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0113, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0117, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0118, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0121, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0122, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0123, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0124, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0125, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0126, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0128, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0142, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0143, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0144, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0145, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0146, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0147, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0148, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0149, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0150, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0151, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0152, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0153, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0154, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0155, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0156, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0157, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0158, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0159, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0160, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0161, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0162, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0014, 0xff, 0xff, 0xff) }, /* ZTE CDMA products */ + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0027, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0059, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0060, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0141, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) }, + + +From gregkh@mini.kroah.org Wed Dec 16 17:15:58 2009 +Message-Id: <20091217011558.080872855@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:13 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Stern +Subject: [02/90] USB: usb-storage: fix bug in fill_inquiry + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alan Stern + +commit f3f6faa9edf67c1018270793e0547b0f81abb47e upstream. + +This patch (as1312) fixes a minor bug in usb-storage. The +fill_inquiry() routine neglects to pre-load the inquiry data buffer +with spaces. As a result, if the vendor name is shorter than 8 +characters or the product name is shorter than 16, the remainder will +be filled with garbage. + +The patch also removes some unnecessary calls to strlen(). + +Signed-off-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/usb.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +--- a/drivers/usb/storage/usb.c ++++ b/drivers/usb/storage/usb.c +@@ -228,6 +228,7 @@ void fill_inquiry_response(struct us_dat + if (data_len<36) // You lose. + return; + ++ memset(data+8, ' ', 28); + if(data[0]&0x20) { /* USB device currently not connected. Return + peripheral qualifier 001b ("...however, the + physical device is not currently connected +@@ -237,15 +238,15 @@ void fill_inquiry_response(struct us_dat + device, it may return zeros or ASCII spaces + (20h) in those fields until the data is + available from the device."). */ +- memset(data+8,0,28); + } else { + u16 bcdDevice = le16_to_cpu(us->pusb_dev->descriptor.bcdDevice); +- memcpy(data+8, us->unusual_dev->vendorName, +- strlen(us->unusual_dev->vendorName) > 8 ? 8 : +- strlen(us->unusual_dev->vendorName)); +- memcpy(data+16, us->unusual_dev->productName, +- strlen(us->unusual_dev->productName) > 16 ? 16 : +- strlen(us->unusual_dev->productName)); ++ int n; ++ ++ n = strlen(us->unusual_dev->vendorName); ++ memcpy(data+8, us->unusual_dev->vendorName, min(8, n)); ++ n = strlen(us->unusual_dev->productName); ++ memcpy(data+16, us->unusual_dev->productName, min(16, n)); ++ + data[32] = 0x30 + ((bcdDevice>>12) & 0x0F); + data[33] = 0x30 + ((bcdDevice>>8) & 0x0F); + data[34] = 0x30 + ((bcdDevice>>4) & 0x0F); + + +From gregkh@mini.kroah.org Wed Dec 16 17:15:58 2009 +Message-Id: <20091217011558.216332496@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:14 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jay Fenlason , + Stefan Richter +Subject: [03/90] firewire: ohci: handle receive packets with a data length of zero + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jay Fenlason + +commit 8c0c0cc2d9f4c523fde04bdfe41e4380dec8ee54 upstream. + +Queueing to receive an ISO packet with a payload length of zero +silently does nothing in dualbuffer mode, and crashes the kernel in +packet-per-buffer mode. Return an error in dualbuffer mode, because +the DMA controller won't let us do what we want, and work correctly in +packet-per-buffer mode. + +Signed-off-by: Jay Fenlason +Signed-off-by: Stefan Richter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firewire/ohci.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/firewire/ohci.c ++++ b/drivers/firewire/ohci.c +@@ -2180,6 +2180,13 @@ static int ohci_queue_iso_receive_dualbu + page = payload >> PAGE_SHIFT; + offset = payload & ~PAGE_MASK; + rest = p->payload_length; ++ /* ++ * The controllers I've tested have not worked correctly when ++ * second_req_count is zero. Rather than do something we know won't ++ * work, return an error ++ */ ++ if (rest == 0) ++ return -EINVAL; + + /* FIXME: make packet-per-buffer/dual-buffer a context option */ + while (rest > 0) { +@@ -2233,7 +2240,7 @@ static int ohci_queue_iso_receive_packet + unsigned long payload) + { + struct iso_context *ctx = container_of(base, struct iso_context, base); +- struct descriptor *d = NULL, *pd = NULL; ++ struct descriptor *d, *pd; + struct fw_iso_packet *p = packet; + dma_addr_t d_bus, page_bus; + u32 z, header_z, rest; +@@ -2271,8 +2278,9 @@ static int ohci_queue_iso_receive_packet + d->data_address = cpu_to_le32(d_bus + (z * sizeof(*d))); + + rest = payload_per_buffer; ++ pd = d; + for (j = 1; j < z; j++) { +- pd = d + j; ++ pd++; + pd->control = cpu_to_le16(DESCRIPTOR_STATUS | + DESCRIPTOR_INPUT_MORE); + + + +From gregkh@mini.kroah.org Wed Dec 16 17:15:58 2009 +Message-Id: <20091217011558.346236779@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:15 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jaroslav Kysela , + Takashi Iwai +Subject: [04/90] ALSA: hda - Terradici HDA controllers does not support 64-bit mode + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jaroslav Kysela + +commit 396087eaead95fcb29eb36f1e59517aeb58c545e upstream. + +Confirmed from vendor and tests in RedHat bugzilla #536782 . + +Signed-off-by: Jaroslav Kysela +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_intel.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2392,6 +2392,11 @@ static int __devinit azx_create(struct s + } + } + ++ /* disable 64bit DMA address for Teradici */ ++ /* it does not work with device 6549:1200 subsys e4a2:040b */ ++ if (chip->driver_type == AZX_DRIVER_TERA) ++ gcap &= ~ICH6_GCAP_64OK; ++ + /* allow 64bit DMA address if supported by H/W */ + if ((gcap & ICH6_GCAP_64OK) && !pci_set_dma_mask(pci, DMA_BIT_MASK(64))) + pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(64)); + + +From gregkh@mini.kroah.org Wed Dec 16 17:15:58 2009 +Message-Id: <20091217011558.481887504@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:16 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Takashi Iwai +Subject: [05/90] ALSA: hrtimer - Fix lock-up + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Takashi Iwai + +commit fcfdebe70759c74e2e701f69aaa7f0e5e32cf5a6 upstream. + +The timer stop callback can be called from snd_timer_interrupt(), which +is called from the hrtimer callback. Since hrtimer_cancel() waits for +the callback completion, this eventually results in a lock-up. + +This patch fixes the problem by just toggling a flag at stop callback +and call hrtimer_cancel() later. + +Reported-and-tested-by: Wojtek Zabolotny +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/hrtimer.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +--- a/sound/core/hrtimer.c ++++ b/sound/core/hrtimer.c +@@ -37,14 +37,22 @@ static unsigned int resolution; + struct snd_hrtimer { + struct snd_timer *timer; + struct hrtimer hrt; ++ atomic_t running; + }; + + static enum hrtimer_restart snd_hrtimer_callback(struct hrtimer *hrt) + { + struct snd_hrtimer *stime = container_of(hrt, struct snd_hrtimer, hrt); + struct snd_timer *t = stime->timer; ++ ++ if (!atomic_read(&stime->running)) ++ return HRTIMER_NORESTART; ++ + hrtimer_forward_now(hrt, ns_to_ktime(t->sticks * resolution)); + snd_timer_interrupt(stime->timer, t->sticks); ++ ++ if (!atomic_read(&stime->running)) ++ return HRTIMER_NORESTART; + return HRTIMER_RESTART; + } + +@@ -58,6 +66,7 @@ static int snd_hrtimer_open(struct snd_t + hrtimer_init(&stime->hrt, CLOCK_MONOTONIC, HRTIMER_MODE_REL); + stime->timer = t; + stime->hrt.function = snd_hrtimer_callback; ++ atomic_set(&stime->running, 0); + t->private_data = stime; + return 0; + } +@@ -78,16 +87,18 @@ static int snd_hrtimer_start(struct snd_ + { + struct snd_hrtimer *stime = t->private_data; + ++ atomic_set(&stime->running, 0); ++ hrtimer_cancel(&stime->hrt); + hrtimer_start(&stime->hrt, ns_to_ktime(t->sticks * resolution), + HRTIMER_MODE_REL); ++ atomic_set(&stime->running, 1); + return 0; + } + + static int snd_hrtimer_stop(struct snd_timer *t) + { + struct snd_hrtimer *stime = t->private_data; +- +- hrtimer_cancel(&stime->hrt); ++ atomic_set(&stime->running, 0); + return 0; + } + + + +From gregkh@mini.kroah.org Wed Dec 16 17:15:58 2009 +Message-Id: <20091217011558.635603496@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:17 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Bob Copeland , + "John W. Linville" +Subject: [06/90] ath5k: allow setting txpower to 0 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Bob Copeland + +commit 2eb2fa67e5462a36e98172fb92c78bc405b3035f upstream. + +As a holdover from earlier code when we used to set +the power limit to '0' after a reset to configure the +default transmit power, ath5k interprets txpower=0 as +12.5 dBm. Fix that by just passing 0 through. + +This fixes http://bugzilla.kernel.org/show_bug.cgi?id=14567 + +Reported-by: Daniel Folkers +Tested-by: Daniel Folkers +Signed-off-by: Bob Copeland +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath5k/phy.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/net/wireless/ath/ath5k/phy.c ++++ b/drivers/net/wireless/ath/ath5k/phy.c +@@ -2931,8 +2931,6 @@ ath5k_hw_txpower(struct ath5k_hw *ah, st + ATH5K_ERR(ah->ah_sc, "invalid tx power: %u\n", txpower); + return -EINVAL; + } +- if (txpower == 0) +- txpower = AR5K_TUNE_DEFAULT_TXPOWER; + + /* Reset TX power values */ + memset(&ah->ah_txpower, 0, sizeof(ah->ah_txpower)); + + +From gregkh@mini.kroah.org Wed Dec 16 17:15:58 2009 +Message-Id: <20091217011558.748938366@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:18 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + jirislaby@gmail.com, + rjw@sisk.pl, + me@bobcopeland.com, + david.quan@atheros.com, + "Luis R. Rodriguez" , + "John W. Linville" +Subject: [07/90] ath5k: enable EEPROM checksum check + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Luis R. Rodriguez + +commit 512414b0bed0d376ac4d5ec1dd6f0b1a3551febc upstream. + +Without this we have no gaurantee of the integrity of the +EEPROM and are likely to encounter a lot of bogus bug reports +due to actual issues on the EEPROM. With the EEPROM checksum +check in place we can easily rule those issues out. + +If you run patch during a revert *you* have a card with a busted +EEPROM and only older kernel will support that concoction. This +patch is a trade off between not accepitng bogus EEPROMs and +avoiding bogus bug reports allowing developers to focus instead +on real concrete issues. + +If stable keeps bogus bug reports because of a possibly busted EEPROM +feel free to apply this there too. + +Tested on an AR5414 + +Cc: jirislaby@gmail.com +Cc: akpm@linux-foundation.org +Cc: rjw@sisk.pl +Cc: me@bobcopeland.com +Cc: david.quan@atheros.com +Signed-off-by: Luis R. Rodriguez +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath5k/eeprom.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/net/wireless/ath/ath5k/eeprom.c ++++ b/drivers/net/wireless/ath/ath5k/eeprom.c +@@ -97,6 +97,7 @@ ath5k_eeprom_init_header(struct ath5k_hw + struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom; + int ret; + u16 val; ++ u32 cksum, offset; + + /* + * Read values from EEPROM and store them in the capability structure +@@ -111,7 +112,6 @@ ath5k_eeprom_init_header(struct ath5k_hw + if (ah->ah_ee_version < AR5K_EEPROM_VERSION_3_0) + return 0; + +-#ifdef notyet + /* + * Validate the checksum of the EEPROM date. There are some + * devices with invalid EEPROMs. +@@ -124,7 +124,6 @@ ath5k_eeprom_init_header(struct ath5k_hw + ATH5K_ERR(ah->ah_sc, "Invalid EEPROM checksum 0x%04x\n", cksum); + return -EIO; + } +-#endif + + AR5K_EEPROM_READ_HDR(AR5K_EEPROM_ANT_GAIN(ah->ah_ee_version), + ee_ant_gain); + + +From gregkh@mini.kroah.org Wed Dec 16 17:15:58 2009 +Message-Id: <20091217011558.884142808@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:19 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alexey Dobriyan , + Serge Hallyn , + David Howells , + James Morris +Subject: [08/90] bsdacct: fix uid/gid misreporting + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alexey Dobriyan + +commit 4b731d50ff3df6b9141a6c12b088e8eb0109e83c upstream. + +commit d8e180dcd5bbbab9cd3ff2e779efcf70692ef541 "bsdacct: switch +credentials for writing to the accounting file" introduced credential +switching during final acct data collecting. However, uid/gid pair +continued to be collected from current which became credentials of who +created acct file, not who exits. + +Addresses http://bugzilla.kernel.org/show_bug.cgi?id=14676 + +Signed-off-by: Alexey Dobriyan +Reported-by: Juho K. Juopperi +Acked-by: Serge Hallyn +Acked-by: David Howells +Reviewed-by: Michal Schmidt +Cc: James Morris +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/acct.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/kernel/acct.c ++++ b/kernel/acct.c +@@ -536,7 +536,8 @@ static void do_acct_process(struct bsd_a + do_div(elapsed, AHZ); + ac.ac_btime = get_seconds() - elapsed; + /* we really need to bite the bullet and change layout */ +- current_uid_gid(&ac.ac_uid, &ac.ac_gid); ++ ac.ac_uid = orig_cred->uid; ++ ac.ac_gid = orig_cred->gid; + #if ACCT_VERSION==2 + ac.ac_ahz = AHZ; + #endif + + +From gregkh@mini.kroah.org Wed Dec 16 17:15:59 2009 +Message-Id: <20091217011559.013115552@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:20 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mathieu Desnoyers +Subject: [09/90] debugfs: fix create mutex racy fops and private data + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mathieu Desnoyers + +commit d3a3b0adad0865c12e39b712ca89efbd0a3a0dbc upstream. + +Setting fops and private data outside of the mutex at debugfs file +creation introduces a race where the files can be opened with the wrong +file operations and private data. It is easy to trigger with a process +waiting on file creation notification. + +Signed-off-by: Mathieu Desnoyers +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + fs/debugfs/inode.c | 55 ++++++++++++++++++++++++++++++----------------------- + 1 file changed, 32 insertions(+), 23 deletions(-) + +--- a/fs/debugfs/inode.c ++++ b/fs/debugfs/inode.c +@@ -32,7 +32,9 @@ static struct vfsmount *debugfs_mount; + static int debugfs_mount_count; + static bool debugfs_registered; + +-static struct inode *debugfs_get_inode(struct super_block *sb, int mode, dev_t dev) ++static struct inode *debugfs_get_inode(struct super_block *sb, int mode, dev_t dev, ++ void *data, const struct file_operations *fops) ++ + { + struct inode *inode = new_inode(sb); + +@@ -44,14 +46,18 @@ static struct inode *debugfs_get_inode(s + init_special_inode(inode, mode, dev); + break; + case S_IFREG: +- inode->i_fop = &debugfs_file_operations; ++ inode->i_fop = fops ? fops : &debugfs_file_operations; ++ inode->i_private = data; + break; + case S_IFLNK: + inode->i_op = &debugfs_link_operations; ++ inode->i_fop = fops; ++ inode->i_private = data; + break; + case S_IFDIR: + inode->i_op = &simple_dir_inode_operations; +- inode->i_fop = &simple_dir_operations; ++ inode->i_fop = fops ? fops : &simple_dir_operations; ++ inode->i_private = data; + + /* directory inodes start off with i_nlink == 2 + * (for "." entry) */ +@@ -64,7 +70,8 @@ static struct inode *debugfs_get_inode(s + + /* SMP-safe */ + static int debugfs_mknod(struct inode *dir, struct dentry *dentry, +- int mode, dev_t dev) ++ int mode, dev_t dev, void *data, ++ const struct file_operations *fops) + { + struct inode *inode; + int error = -EPERM; +@@ -72,7 +79,7 @@ static int debugfs_mknod(struct inode *d + if (dentry->d_inode) + return -EEXIST; + +- inode = debugfs_get_inode(dir->i_sb, mode, dev); ++ inode = debugfs_get_inode(dir->i_sb, mode, dev, data, fops); + if (inode) { + d_instantiate(dentry, inode); + dget(dentry); +@@ -81,12 +88,13 @@ static int debugfs_mknod(struct inode *d + return error; + } + +-static int debugfs_mkdir(struct inode *dir, struct dentry *dentry, int mode) ++static int debugfs_mkdir(struct inode *dir, struct dentry *dentry, int mode, ++ void *data, const struct file_operations *fops) + { + int res; + + mode = (mode & (S_IRWXUGO | S_ISVTX)) | S_IFDIR; +- res = debugfs_mknod(dir, dentry, mode, 0); ++ res = debugfs_mknod(dir, dentry, mode, 0, data, fops); + if (!res) { + inc_nlink(dir); + fsnotify_mkdir(dir, dentry); +@@ -94,18 +102,20 @@ static int debugfs_mkdir(struct inode *d + return res; + } + +-static int debugfs_link(struct inode *dir, struct dentry *dentry, int mode) ++static int debugfs_link(struct inode *dir, struct dentry *dentry, int mode, ++ void *data, const struct file_operations *fops) + { + mode = (mode & S_IALLUGO) | S_IFLNK; +- return debugfs_mknod(dir, dentry, mode, 0); ++ return debugfs_mknod(dir, dentry, mode, 0, data, fops); + } + +-static int debugfs_create(struct inode *dir, struct dentry *dentry, int mode) ++static int debugfs_create(struct inode *dir, struct dentry *dentry, int mode, ++ void *data, const struct file_operations *fops) + { + int res; + + mode = (mode & S_IALLUGO) | S_IFREG; +- res = debugfs_mknod(dir, dentry, mode, 0); ++ res = debugfs_mknod(dir, dentry, mode, 0, data, fops); + if (!res) + fsnotify_create(dir, dentry); + return res; +@@ -139,7 +149,9 @@ static struct file_system_type debug_fs_ + + static int debugfs_create_by_name(const char *name, mode_t mode, + struct dentry *parent, +- struct dentry **dentry) ++ struct dentry **dentry, ++ void *data, ++ const struct file_operations *fops) + { + int error = 0; + +@@ -164,13 +176,16 @@ static int debugfs_create_by_name(const + if (!IS_ERR(*dentry)) { + switch (mode & S_IFMT) { + case S_IFDIR: +- error = debugfs_mkdir(parent->d_inode, *dentry, mode); ++ error = debugfs_mkdir(parent->d_inode, *dentry, mode, ++ data, fops); + break; + case S_IFLNK: +- error = debugfs_link(parent->d_inode, *dentry, mode); ++ error = debugfs_link(parent->d_inode, *dentry, mode, ++ data, fops); + break; + default: +- error = debugfs_create(parent->d_inode, *dentry, mode); ++ error = debugfs_create(parent->d_inode, *dentry, mode, ++ data, fops); + break; + } + dput(*dentry); +@@ -221,19 +236,13 @@ struct dentry *debugfs_create_file(const + if (error) + goto exit; + +- error = debugfs_create_by_name(name, mode, parent, &dentry); ++ error = debugfs_create_by_name(name, mode, parent, &dentry, ++ data, fops); + if (error) { + dentry = NULL; + simple_release_fs(&debugfs_mount, &debugfs_mount_count); + goto exit; + } +- +- if (dentry->d_inode) { +- if (data) +- dentry->d_inode->i_private = data; +- if (fops) +- dentry->d_inode->i_fop = fops; +- } + exit: + return dentry; + } + + +From gregkh@mini.kroah.org Wed Dec 16 17:15:59 2009 +Message-Id: <20091217011559.147532119@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:21 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Sukadev Bhattiprolu +Subject: [10/90] devpts_get_tty() should validate inode + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Sukadev Bhattiprolu + +commit edfacdd6f81119b9005615593f2cbd94b8c7e2d8 upstream. + +devpts_get_tty() assumes that the inode passed in is associated with a valid +pty. But if the only reference to the pty is via a bind-mount, the inode +passed to devpts_get_tty() while valid, would refer to a pty that no longer +exists. + +With a lot of debug effort, Grzegorz Nosek developed a small program (see +below) to reproduce a crash on recent kernels. This crash is a regression +introduced by the commit: + + commit 527b3e4773628b30d03323a2cb5fb0d84441990f + Author: Sukadev Bhattiprolu + Date: Mon Oct 13 10:43:08 2008 +0100 + +To fix, ensure that the dentry associated with the inode has not yet been +deleted/unhashed by devpts_pty_kill(). + +See also: +https://lists.linux-foundation.org/pipermail/containers/2009-July/019273.html + +tty-bug.c: + +#define _GNU_SOURCE +#include +#include +#include +#include +#include +#include +#include + +#include + +void dummy(int sig) +{ +} + +static int child(void *unused) +{ + int fd; + + signal(SIGINT, dummy); signal(SIGHUP, dummy); + pause(); /* cheesy synchronisation to wait for /dev/pts/0 to appear */ + + mount("/dev/pts/0", "/dev/console", NULL, MS_BIND, NULL); + sleep(2); + + fd = open("/dev/console", O_RDWR); + dup(0); dup(0); + write(1, "Hello world!\n", sizeof("Hello world!\n")-1); + return 0; +} + +int main(void) +{ + pid_t pid; + char *stack; + + stack = malloc(16384); + pid = clone(child, stack+16384, CLONE_NEWNS|SIGCHLD, NULL); + + open("/dev/ptmx", O_RDWR|O_NOCTTY|O_NONBLOCK); + + unlockpt(fd); grantpt(fd); + + sleep(2); + kill(pid, SIGHUP); + sleep(1); + return 0; /* exit before child opens /dev/console */ +} + +Reported-by: Grzegorz Nosek +Signed-off-by: Sukadev Bhattiprolu +Tested-by: Serge Hallyn +Signed-off-by: Greg Kroah-Hartman + +--- + fs/devpts/inode.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +--- a/fs/devpts/inode.c ++++ b/fs/devpts/inode.c +@@ -518,11 +518,23 @@ int devpts_pty_new(struct inode *ptmx_in + + struct tty_struct *devpts_get_tty(struct inode *pts_inode, int number) + { ++ struct dentry *dentry; ++ struct tty_struct *tty; ++ + BUG_ON(pts_inode->i_rdev == MKDEV(TTYAUX_MAJOR, PTMX_MINOR)); + ++ /* Ensure dentry has not been deleted by devpts_pty_kill() */ ++ dentry = d_find_alias(pts_inode); ++ if (!dentry) ++ return NULL; ++ ++ tty = NULL; + if (pts_inode->i_sb->s_magic == DEVPTS_SUPER_MAGIC) +- return (struct tty_struct *)pts_inode->i_private; +- return NULL; ++ tty = (struct tty_struct *)pts_inode->i_private; ++ ++ dput(dentry); ++ ++ return tty; + } + + void devpts_pty_kill(struct tty_struct *tty) + + +From gregkh@mini.kroah.org Wed Dec 16 17:15:59 2009 +Message-Id: <20091217011559.279090025@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:22 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andi Kleen , + Andrew Morton , + Nick Piggin , + Darren Hart , + Peter Zijlstra , + Thomas Gleixner +Subject: [11/90] futex: Take mmap_sem for get_user_pages in fault_in_user_writeable + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Andi Kleen + +commit 722d0172377a5697919b9f7e5beb95165b1dec4e upstream. + +get_user_pages() must be called with mmap_sem held. + +Signed-off-by: Andi Kleen +Cc: Andrew Morton +Cc: Nick Piggin +Cc: Darren Hart +Cc: Peter Zijlstra +LKML-Reference: <20091208121942.GA21298@basil.fritz.box> +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/futex.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -303,8 +303,14 @@ void put_futex_key(int fshared, union fu + */ + static int fault_in_user_writeable(u32 __user *uaddr) + { +- int ret = get_user_pages(current, current->mm, (unsigned long)uaddr, +- 1, 1, 0, NULL, NULL); ++ struct mm_struct *mm = current->mm; ++ int ret; ++ ++ down_read(&mm->mmap_sem); ++ ret = get_user_pages(current, mm, (unsigned long)uaddr, ++ 1, 1, 0, NULL, NULL); ++ up_read(&mm->mmap_sem); ++ + return ret < 0 ? ret : 0; + } + + + +From gregkh@mini.kroah.org Wed Dec 16 17:15:59 2009 +Message-Id: <20091217011559.424543346@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:23 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + WANG Cong , + Eugene Teo , + Roman Zippel , + Al Viro , + Christoph Hellwig , + Alexey Dobriyan , + Dave Anderson +Subject: [12/90] hfs: fix a potential buffer overflow + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Amerigo Wang + +commit ec81aecb29668ad71f699f4e7b96ec46691895b6 upstream. + +A specially-crafted Hierarchical File System (HFS) filesystem could cause +a buffer overflow to occur in a process's kernel stack during a memcpy() +call within the hfs_bnode_read() function (at fs/hfs/bnode.c:24). The +attacker can provide the source buffer and length, and the destination +buffer is a local variable of a fixed length. This local variable (passed +as "&entry" from fs/hfs/dir.c:112 and allocated on line 60) is stored in +the stack frame of hfs_bnode_read()'s caller, which is hfs_readdir(). +Because the hfs_readdir() function executes upon any attempt to read a +directory on the filesystem, it gets called whenever a user attempts to +inspect any filesystem contents. + +[amwang@redhat.com: modify this patch and fix coding style problems] +Signed-off-by: WANG Cong +Cc: Eugene Teo +Cc: Roman Zippel +Cc: Al Viro +Cc: Christoph Hellwig +Cc: Alexey Dobriyan +Cc: Dave Anderson +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/hfs/catalog.c | 4 ++++ + fs/hfs/dir.c | 11 +++++++++++ + fs/hfs/super.c | 7 ++++++- + 3 files changed, 21 insertions(+), 1 deletion(-) + +--- a/fs/hfs/catalog.c ++++ b/fs/hfs/catalog.c +@@ -289,6 +289,10 @@ int hfs_cat_move(u32 cnid, struct inode + err = hfs_brec_find(&src_fd); + if (err) + goto out; ++ if (src_fd.entrylength > sizeof(entry) || src_fd.entrylength < 0) { ++ err = -EIO; ++ goto out; ++ } + + hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset, + src_fd.entrylength); +--- a/fs/hfs/dir.c ++++ b/fs/hfs/dir.c +@@ -79,6 +79,11 @@ static int hfs_readdir(struct file *filp + filp->f_pos++; + /* fall through */ + case 1: ++ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) { ++ err = -EIO; ++ goto out; ++ } ++ + hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength); + if (entry.type != HFS_CDR_THD) { + printk(KERN_ERR "hfs: bad catalog folder thread\n"); +@@ -109,6 +114,12 @@ static int hfs_readdir(struct file *filp + err = -EIO; + goto out; + } ++ ++ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) { ++ err = -EIO; ++ goto out; ++ } ++ + hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength); + type = entry.type; + len = hfs_mac2asc(sb, strbuf, &fd.key->cat.CName); +--- a/fs/hfs/super.c ++++ b/fs/hfs/super.c +@@ -409,8 +409,13 @@ static int hfs_fill_super(struct super_b + /* try to get the root inode */ + hfs_find_init(HFS_SB(sb)->cat_tree, &fd); + res = hfs_cat_find_brec(sb, HFS_ROOT_CNID, &fd); +- if (!res) ++ if (!res) { ++ if (fd.entrylength > sizeof(rec) || fd.entrylength < 0) { ++ res = -EIO; ++ goto bail; ++ } + hfs_bnode_read(fd.bnode, &rec, fd.entryoffset, fd.entrylength); ++ } + if (res) { + hfs_find_exit(&fd); + goto bail_no_root; + + +From gregkh@mini.kroah.org Wed Dec 16 17:15:59 2009 +Message-Id: <20091217011559.541241545@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:24 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Feng Tang , + Heiko Carstens , + Thomas Gleixner +Subject: [13/90] hrtimer: Fix /proc/timer_list regression + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Feng Tang + +commit 8629ea2eaba8ca0de2e38ce1b4a825e16255976e upstream. + +commit 507e1231 (timer stats: Optimize by adding quick check to avoid +function calls) introduced a regression in /proc/timer_list. + +/proc/timer_list shows now + #0: , tick_sched_timer, S:01, <(null)>, /-1 +instead of + #0: , tick_sched_timer, S:01, hrtimer_start, swapper/0 + +Revert the hrtimer quick check for now. The optimization needs more +thought, but this is neither 2.6.32-rc7 nor stable material. + +[ tglx: - Removed unrelated changes from the original patch + - Prevent unneccesary call to timer_stats_update_stats + - massaged the changelog ] + +Signed-off-by: Feng Tang +LKML-Reference: +Cc: Heiko Carstens +Signed-off-by: Andrew Morton +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/hrtimer.h | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/include/linux/hrtimer.h ++++ b/include/linux/hrtimer.h +@@ -448,7 +448,7 @@ extern void timer_stats_update_stats(voi + + static inline void timer_stats_account_hrtimer(struct hrtimer *timer) + { +- if (likely(!timer->start_site)) ++ if (likely(!timer_stats_active)) + return; + timer_stats_update_stats(timer, timer->start_pid, timer->start_site, + timer->function, timer->start_comm, 0); +@@ -459,8 +459,6 @@ extern void __timer_stats_hrtimer_set_st + + static inline void timer_stats_hrtimer_set_start_info(struct hrtimer *timer) + { +- if (likely(!timer_stats_active)) +- return; + __timer_stats_hrtimer_set_start_info(timer, __builtin_return_address(0)); + } + + + +From gregkh@mini.kroah.org Wed Dec 16 17:15:59 2009 +Message-Id: <20091217011559.676670596@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:25 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Theodore Tso" +Subject: [14/90] jbd2: dont wipe the journal on a failed journal checksum + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Theodore Ts'o + +commit e6a47428de84e19fda52f21ab73fde2906c40d09 upstream. + +If there is a failed journal checksum, don't reset the journal. This +allows for userspace programs to decide how to recover from this +situation. It may be that ignoring the journal checksum failure might +be a better way of recovering the file system. Once we add per-block +checksums, we can definitely do better. Until then, a system +administrator can try backing up the file system image (or taking a +snapshot) and and trying to determine experimentally whether ignoring +the checksum failure or aborting the journal replay results in less +data loss. + +Signed-off-by: "Theodore Ts'o" +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jbd2/journal.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -1421,6 +1421,13 @@ int jbd2_journal_load(journal_t *journal + if (jbd2_journal_recover(journal)) + goto recovery_error; + ++ if (journal->j_failed_commit) { ++ printk(KERN_ERR "JBD2: journal transaction %u on %s " ++ "is corrupt.\n", journal->j_failed_commit, ++ journal->j_devname); ++ return -EIO; ++ } ++ + /* OK, we've finished with the dynamic journal bits: + * reinitialise the dynamic contents of the superblock in memory + * and reset them on disk. */ + + +From gregkh@mini.kroah.org Wed Dec 16 17:15:59 2009 +Message-Id: <20091217011559.807451173@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:26 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Carsten Otte , + Avi Kivity +Subject: [15/90] KVM: s390: Make psw available on all exits, not just a subset + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Carsten Otte + +commit d7b0b5eb3000c6fb902f08c619fcd673a23d8fab upstream. + +This patch moves s390 processor status word into the base kvm_run +struct and keeps it up-to date on all userspace exits. + +The userspace ABI is broken by this, however there are no applications +in the wild using this. A capability check is provided so users can +verify the updated API exists. + +Signed-off-by: Carsten Otte +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/include/asm/kvm.h | 3 ++- + arch/s390/kvm/kvm-s390.c | 25 +++++++++++++++++-------- + include/linux/kvm.h | 8 ++++++-- + 3 files changed, 25 insertions(+), 11 deletions(-) + +--- a/arch/s390/include/asm/kvm.h ++++ b/arch/s390/include/asm/kvm.h +@@ -1,6 +1,5 @@ + #ifndef __LINUX_KVM_S390_H + #define __LINUX_KVM_S390_H +- + /* + * asm-s390/kvm.h - KVM s390 specific structures and definitions + * +@@ -24,6 +23,8 @@ struct kvm_ioapic_state { + /* no IOAPIC for s390 */ + }; + ++#define __KVM_S390 ++ + /* for KVM_GET_REGS and KVM_SET_REGS */ + struct kvm_regs { + /* general purpose regs for s390 */ +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -115,10 +115,16 @@ long kvm_arch_dev_ioctl(struct file *fil + + int kvm_dev_ioctl_check_extension(long ext) + { ++ int r; ++ + switch (ext) { ++ case KVM_CAP_S390_PSW: ++ r = 1; ++ break; + default: +- return 0; ++ r = 0; + } ++ return r; + } + + /* Section: vm related */ +@@ -422,8 +428,10 @@ static int kvm_arch_vcpu_ioctl_set_initi + vcpu_load(vcpu); + if (atomic_read(&vcpu->arch.sie_block->cpuflags) & CPUSTAT_RUNNING) + rc = -EBUSY; +- else +- vcpu->arch.sie_block->gpsw = psw; ++ else { ++ vcpu->run->psw_mask = psw.mask; ++ vcpu->run->psw_addr = psw.addr; ++ } + vcpu_put(vcpu); + return rc; + } +@@ -505,9 +513,6 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v + + switch (kvm_run->exit_reason) { + case KVM_EXIT_S390_SIEIC: +- vcpu->arch.sie_block->gpsw.mask = kvm_run->s390_sieic.mask; +- vcpu->arch.sie_block->gpsw.addr = kvm_run->s390_sieic.addr; +- break; + case KVM_EXIT_UNKNOWN: + case KVM_EXIT_S390_RESET: + break; +@@ -515,6 +520,9 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v + BUG(); + } + ++ vcpu->arch.sie_block->gpsw.mask = kvm_run->psw_mask; ++ vcpu->arch.sie_block->gpsw.addr = kvm_run->psw_addr; ++ + might_fault(); + + do { +@@ -529,8 +537,6 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v + /* intercept cannot be handled in-kernel, prepare kvm-run */ + kvm_run->exit_reason = KVM_EXIT_S390_SIEIC; + kvm_run->s390_sieic.icptcode = vcpu->arch.sie_block->icptcode; +- kvm_run->s390_sieic.mask = vcpu->arch.sie_block->gpsw.mask; +- kvm_run->s390_sieic.addr = vcpu->arch.sie_block->gpsw.addr; + kvm_run->s390_sieic.ipa = vcpu->arch.sie_block->ipa; + kvm_run->s390_sieic.ipb = vcpu->arch.sie_block->ipb; + rc = 0; +@@ -542,6 +548,9 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v + rc = 0; + } + ++ kvm_run->psw_mask = vcpu->arch.sie_block->gpsw.mask; ++ kvm_run->psw_addr = vcpu->arch.sie_block->gpsw.addr; ++ + if (vcpu->sigset_active) + sigprocmask(SIG_SETMASK, &sigsaved, NULL); + +--- a/include/linux/kvm.h ++++ b/include/linux/kvm.h +@@ -104,6 +104,11 @@ struct kvm_run { + __u64 cr8; + __u64 apic_base; + ++#ifdef __KVM_S390 ++ /* the processor status word for s390 */ ++ __u64 psw_mask; /* psw upper half */ ++ __u64 psw_addr; /* psw lower half */ ++#endif + union { + /* KVM_EXIT_UNKNOWN */ + struct { +@@ -155,8 +160,6 @@ struct kvm_run { + /* KVM_EXIT_S390_SIEIC */ + struct { + __u8 icptcode; +- __u64 mask; /* psw upper half */ +- __u64 addr; /* psw lower half */ + __u16 ipa; + __u32 ipb; + } s390_sieic; +@@ -453,6 +456,7 @@ struct kvm_irq_routing { + }; + + #endif ++#define KVM_CAP_S390_PSW 42 + + /* + * ioctls for VM fds + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:00 2009 +Message-Id: <20091217011559.935025982@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:27 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + NeilBrown +Subject: [16/90] md/bitmap: protect against bitmap removal while being updated. + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: NeilBrown + +commit aa5cbd103887011b4830355f88fb055f9ad2d556 upstream. + +A write intent bitmap can be removed from an array while the +array is active. +When this happens, all IO is suspended and flushed before the +bitmap is removed. +However it is possible that bitmap_daemon_work is still running to +clear old bits from the bitmap. If it is, it can dereference the +bitmap after it has been freed. + +So introduce a new mutex to protect bitmap_daemon_work and get it +before destroying a bitmap. + +This is suitable for any current -stable kernel. + +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/bitmap.c | 24 ++++++++++++++++++------ + drivers/md/bitmap.h | 2 +- + drivers/md/md.c | 3 ++- + drivers/md/md.h | 1 + + 4 files changed, 22 insertions(+), 8 deletions(-) + +--- a/drivers/md/bitmap.c ++++ b/drivers/md/bitmap.c +@@ -1077,23 +1077,31 @@ static bitmap_counter_t *bitmap_get_coun + * out to disk + */ + +-void bitmap_daemon_work(struct bitmap *bitmap) ++void bitmap_daemon_work(mddev_t *mddev) + { ++ struct bitmap *bitmap; + unsigned long j; + unsigned long flags; + struct page *page = NULL, *lastpage = NULL; + int blocks; + void *paddr; + +- if (bitmap == NULL) ++ /* Use a mutex to guard daemon_work against ++ * bitmap_destroy. ++ */ ++ mutex_lock(&mddev->bitmap_mutex); ++ bitmap = mddev->bitmap; ++ if (bitmap == NULL) { ++ mutex_unlock(&mddev->bitmap_mutex); + return; ++ } + if (time_before(jiffies, bitmap->daemon_lastrun + bitmap->daemon_sleep*HZ)) + goto done; + + bitmap->daemon_lastrun = jiffies; + if (bitmap->allclean) { + bitmap->mddev->thread->timeout = MAX_SCHEDULE_TIMEOUT; +- return; ++ goto done; + } + bitmap->allclean = 1; + +@@ -1202,6 +1210,7 @@ void bitmap_daemon_work(struct bitmap *b + done: + if (bitmap->allclean == 0) + bitmap->mddev->thread->timeout = bitmap->daemon_sleep * HZ; ++ mutex_unlock(&mddev->bitmap_mutex); + } + + static bitmap_counter_t *bitmap_get_counter(struct bitmap *bitmap, +@@ -1538,9 +1547,9 @@ void bitmap_flush(mddev_t *mddev) + */ + sleep = bitmap->daemon_sleep; + bitmap->daemon_sleep = 0; +- bitmap_daemon_work(bitmap); +- bitmap_daemon_work(bitmap); +- bitmap_daemon_work(bitmap); ++ bitmap_daemon_work(mddev); ++ bitmap_daemon_work(mddev); ++ bitmap_daemon_work(mddev); + bitmap->daemon_sleep = sleep; + bitmap_update_sb(bitmap); + } +@@ -1571,6 +1580,7 @@ static void bitmap_free(struct bitmap *b + kfree(bp); + kfree(bitmap); + } ++ + void bitmap_destroy(mddev_t *mddev) + { + struct bitmap *bitmap = mddev->bitmap; +@@ -1578,7 +1588,9 @@ void bitmap_destroy(mddev_t *mddev) + if (!bitmap) /* there was no bitmap */ + return; + ++ mutex_lock(&mddev->bitmap_mutex); + mddev->bitmap = NULL; /* disconnect from the md device */ ++ mutex_unlock(&mddev->bitmap_mutex); + if (mddev->thread) + mddev->thread->timeout = MAX_SCHEDULE_TIMEOUT; + +--- a/drivers/md/bitmap.h ++++ b/drivers/md/bitmap.h +@@ -282,7 +282,7 @@ void bitmap_close_sync(struct bitmap *bi + void bitmap_cond_end_sync(struct bitmap *bitmap, sector_t sector); + + void bitmap_unplug(struct bitmap *bitmap); +-void bitmap_daemon_work(struct bitmap *bitmap); ++void bitmap_daemon_work(mddev_t *mddev); + #endif + + #endif +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -361,6 +361,7 @@ static mddev_t * mddev_find(dev_t unit) + + mutex_init(&new->open_mutex); + mutex_init(&new->reconfig_mutex); ++ mutex_init(&new->bitmap_mutex); + INIT_LIST_HEAD(&new->disks); + INIT_LIST_HEAD(&new->all_mddevs); + init_timer(&new->safemode_timer); +@@ -6595,7 +6596,7 @@ void md_check_recovery(mddev_t *mddev) + + + if (mddev->bitmap) +- bitmap_daemon_work(mddev->bitmap); ++ bitmap_daemon_work(mddev); + + if (mddev->ro) + return; +--- a/drivers/md/md.h ++++ b/drivers/md/md.h +@@ -289,6 +289,7 @@ struct mddev_s + * hot-adding a bitmap. It should + * eventually be settable by sysfs. + */ ++ struct mutex bitmap_mutex; + + struct list_head all_mddevs; + }; + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:00 2009 +Message-Id: <20091217011600.063985666@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:28 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Sergei Shtylyov , + Jeff Garzik +Subject: [17/90] pata_hpt{37x|3x2n}: fix timing register masks (take 2) + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Sergei Shtylyov + +commit 5600c70e576199a7552e1c0fff43f3fe16f5566e upstream. + +These drivers inherited from the older 'hpt366' IDE driver the buggy timing +register masks in their set_piomode() metods. As a result, too low command +cycle active time is programmed for slow PIO modes. Quite fortunately, it's +later "fixed up" by the set_dmamode() methods which also "helpfully" reprogram +the command timings, usually to PIO mode 4; unfortunately, setting an UltraDMA +mode #N also reprograms already set PIO data timings, usually to MWDMA mode # +max(N, 2) timings... + +However, the drivers added some breakage of their own too: the bit that they +set/clear to control the FIFO is sometimes wrong -- it's actually the MSB of +the command cycle setup time; also, setting it in DMA mode is wrong as this +bit is only for PIO actually and clearing it for PIO modes is not needed as +no mode in any timing table has it set... + +Fix all this, inverting the masks while at it, like in the 'hpt366' and +'pata_hpt366' drivers; bump the drivers' versions, accounting for recent +patches that forgot to do it... + +Signed-off-by: Sergei Shtylyov +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/pata_hpt37x.c | 32 +++++++++++++++----------------- + drivers/ata/pata_hpt3x2n.c | 17 ++++++++--------- + 2 files changed, 23 insertions(+), 26 deletions(-) + +--- a/drivers/ata/pata_hpt37x.c ++++ b/drivers/ata/pata_hpt37x.c +@@ -24,7 +24,7 @@ + #include + + #define DRV_NAME "pata_hpt37x" +-#define DRV_VERSION "0.6.12" ++#define DRV_VERSION "0.6.14" + + struct hpt_clock { + u8 xfer_speed; +@@ -404,9 +404,8 @@ static void hpt370_set_piomode(struct at + + pci_read_config_dword(pdev, addr1, ®); + mode = hpt37x_find_mode(ap, adev->pio_mode); +- mode &= ~0x8000000; /* No FIFO in PIO */ +- mode &= ~0x30070000; /* Leave config bits alone */ +- reg &= 0x30070000; /* Strip timing bits */ ++ mode &= 0xCFC3FFFF; /* Leave DMA bits alone */ ++ reg &= ~0xCFC3FFFF; /* Strip timing bits */ + pci_write_config_dword(pdev, addr1, reg | mode); + } + +@@ -423,8 +422,7 @@ static void hpt370_set_dmamode(struct at + { + struct pci_dev *pdev = to_pci_dev(ap->host->dev); + u32 addr1, addr2; +- u32 reg; +- u32 mode; ++ u32 reg, mode, mask; + u8 fast; + + addr1 = 0x40 + 4 * (adev->devno + 2 * ap->port_no); +@@ -436,11 +434,12 @@ static void hpt370_set_dmamode(struct at + fast |= 0x01; + pci_write_config_byte(pdev, addr2, fast); + ++ mask = adev->dma_mode < XFER_UDMA_0 ? 0x31C001FF : 0x303C0000; ++ + pci_read_config_dword(pdev, addr1, ®); + mode = hpt37x_find_mode(ap, adev->dma_mode); +- mode |= 0x8000000; /* FIFO in MWDMA or UDMA */ +- mode &= ~0xC0000000; /* Leave config bits alone */ +- reg &= 0xC0000000; /* Strip timing bits */ ++ mode &= mask; ++ reg &= ~mask; + pci_write_config_dword(pdev, addr1, reg | mode); + } + +@@ -508,9 +507,8 @@ static void hpt372_set_piomode(struct at + mode = hpt37x_find_mode(ap, adev->pio_mode); + + printk("Find mode for %d reports %X\n", adev->pio_mode, mode); +- mode &= ~0x80000000; /* No FIFO in PIO */ +- mode &= ~0x30070000; /* Leave config bits alone */ +- reg &= 0x30070000; /* Strip timing bits */ ++ mode &= 0xCFC3FFFF; /* Leave DMA bits alone */ ++ reg &= ~0xCFC3FFFF; /* Strip timing bits */ + pci_write_config_dword(pdev, addr1, reg | mode); + } + +@@ -527,8 +525,7 @@ static void hpt372_set_dmamode(struct at + { + struct pci_dev *pdev = to_pci_dev(ap->host->dev); + u32 addr1, addr2; +- u32 reg; +- u32 mode; ++ u32 reg, mode, mask; + u8 fast; + + addr1 = 0x40 + 4 * (adev->devno + 2 * ap->port_no); +@@ -539,12 +536,13 @@ static void hpt372_set_dmamode(struct at + fast &= ~0x07; + pci_write_config_byte(pdev, addr2, fast); + ++ mask = adev->dma_mode < XFER_UDMA_0 ? 0x31C001FF : 0x303C0000; ++ + pci_read_config_dword(pdev, addr1, ®); + mode = hpt37x_find_mode(ap, adev->dma_mode); + printk("Find mode for DMA %d reports %X\n", adev->dma_mode, mode); +- mode &= ~0xC0000000; /* Leave config bits alone */ +- mode |= 0x80000000; /* FIFO in MWDMA or UDMA */ +- reg &= 0xC0000000; /* Strip timing bits */ ++ mode &= mask; ++ reg &= ~mask; + pci_write_config_dword(pdev, addr1, reg | mode); + } + +--- a/drivers/ata/pata_hpt3x2n.c ++++ b/drivers/ata/pata_hpt3x2n.c +@@ -25,7 +25,7 @@ + #include + + #define DRV_NAME "pata_hpt3x2n" +-#define DRV_VERSION "0.3.4" ++#define DRV_VERSION "0.3.7" + + enum { + HPT_PCI_FAST = (1 << 31), +@@ -185,9 +185,8 @@ static void hpt3x2n_set_piomode(struct a + + pci_read_config_dword(pdev, addr1, ®); + mode = hpt3x2n_find_mode(ap, adev->pio_mode); +- mode &= ~0x8000000; /* No FIFO in PIO */ +- mode &= ~0x30070000; /* Leave config bits alone */ +- reg &= 0x30070000; /* Strip timing bits */ ++ mode &= 0xCFC3FFFF; /* Leave DMA bits alone */ ++ reg &= ~0xCFC3FFFF; /* Strip timing bits */ + pci_write_config_dword(pdev, addr1, reg | mode); + } + +@@ -204,8 +203,7 @@ static void hpt3x2n_set_dmamode(struct a + { + struct pci_dev *pdev = to_pci_dev(ap->host->dev); + u32 addr1, addr2; +- u32 reg; +- u32 mode; ++ u32 reg, mode, mask; + u8 fast; + + addr1 = 0x40 + 4 * (adev->devno + 2 * ap->port_no); +@@ -216,11 +214,12 @@ static void hpt3x2n_set_dmamode(struct a + fast &= ~0x07; + pci_write_config_byte(pdev, addr2, fast); + ++ mask = adev->dma_mode < XFER_UDMA_0 ? 0x31C001FF : 0x303C0000; ++ + pci_read_config_dword(pdev, addr1, ®); + mode = hpt3x2n_find_mode(ap, adev->dma_mode); +- mode |= 0x8000000; /* FIFO in MWDMA or UDMA */ +- mode &= ~0xC0000000; /* Leave config bits alone */ +- reg &= 0xC0000000; /* Strip timing bits */ ++ mode &= mask; ++ reg &= ~mask; + pci_write_config_dword(pdev, addr1, reg | mode); + } + + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:00 2009 +Message-Id: <20091217011600.203236971@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:29 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Igor Grinberg , + Mike Rapoport , + Eric Miao +Subject: [18/90] [ARM] pxa/em-x270: fix usb hub power up/reset sequence + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Igor Grinberg + +commit 1b82e4c32fba96d8805b1e2126ba5382e56fac32 upstream. + +Signed-off-by: Igor Grinberg +Signed-off-by: Mike Rapoport +Signed-off-by: Eric Miao +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-pxa/em-x270.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/arch/arm/mach-pxa/em-x270.c ++++ b/arch/arm/mach-pxa/em-x270.c +@@ -497,16 +497,15 @@ static int em_x270_usb_hub_init(void) + goto err_free_vbus_gpio; + + /* USB Hub power-on and reset */ +- gpio_direction_output(usb_hub_reset, 0); ++ gpio_direction_output(usb_hub_reset, 1); ++ gpio_direction_output(GPIO9_USB_VBUS_EN, 0); + regulator_enable(em_x270_usb_ldo); +- gpio_set_value(usb_hub_reset, 1); + gpio_set_value(usb_hub_reset, 0); ++ gpio_set_value(usb_hub_reset, 1); + regulator_disable(em_x270_usb_ldo); + regulator_enable(em_x270_usb_ldo); +- gpio_set_value(usb_hub_reset, 1); +- +- /* enable VBUS */ +- gpio_direction_output(GPIO9_USB_VBUS_EN, 1); ++ gpio_set_value(usb_hub_reset, 0); ++ gpio_set_value(GPIO9_USB_VBUS_EN, 1); + + return 0; + + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:00 2009 +Message-Id: <20091217011600.331719222@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:30 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Michael Buesch , + "John W. Linville" +Subject: [19/90] ssb: Fix range check in sprom write + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Michael Buesch + +commit e33761e6f23881de9f3ee77cc2204ab2e26f3d9a upstream. + +The range check in the sprom image parser hex2sprom() is broken. +One sprom word is 4 hex characters. +This fixes the check and also adds much better sanity checks to the code. +We better make sure the image is OK by doing some sanity checks to avoid +bricking the device by accident. + +Signed-off-by: Michael Buesch +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ssb/sprom.c | 20 ++++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +--- a/drivers/ssb/sprom.c ++++ b/drivers/ssb/sprom.c +@@ -13,6 +13,8 @@ + + #include "ssb_private.h" + ++#include ++ + + static const struct ssb_sprom *fallback_sprom; + +@@ -33,17 +35,27 @@ static int sprom2hex(const u16 *sprom, c + static int hex2sprom(u16 *sprom, const char *dump, size_t len, + size_t sprom_size_words) + { +- char tmp[5] = { 0 }; +- int cnt = 0; ++ char c, tmp[5] = { 0 }; ++ int err, cnt = 0; + unsigned long parsed; + +- if (len < sprom_size_words * 2) ++ /* Strip whitespace at the end. */ ++ while (len) { ++ c = dump[len - 1]; ++ if (!isspace(c) && c != '\0') ++ break; ++ len--; ++ } ++ /* Length must match exactly. */ ++ if (len != sprom_size_words * 4) + return -EINVAL; + + while (cnt < sprom_size_words) { + memcpy(tmp, dump, 4); + dump += 4; +- parsed = simple_strtoul(tmp, NULL, 16); ++ err = strict_strtoul(tmp, 16, &parsed); ++ if (err) ++ return err; + sprom[cnt++] = swab16((u16)parsed); + } + + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:00 2009 +Message-Id: <20091217011600.472766906@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:31 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Roel Kluin , + Trond Myklebust +Subject: [20/90] SUNRPC: IS_ERR/PTR_ERR confusion + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Roel Kluin + +commit 480e3243df156e39eea6c91057e2ae612a6bbe19 upstream. + +IS_ERR returns 1 or 0, PTR_ERR returns the error value. + +Signed-off-by: Roel Kluin +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/auth_gss/auth_gss.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/sunrpc/auth_gss/auth_gss.c ++++ b/net/sunrpc/auth_gss/auth_gss.c +@@ -485,7 +485,7 @@ gss_refresh_upcall(struct rpc_task *task + dprintk("RPC: %5u gss_refresh_upcall for uid %u\n", task->tk_pid, + cred->cr_uid); + gss_msg = gss_setup_upcall(task->tk_client, gss_auth, cred); +- if (IS_ERR(gss_msg) == -EAGAIN) { ++ if (PTR_ERR(gss_msg) == -EAGAIN) { + /* XXX: warning on the first, under the assumption we + * shouldn't normally hit this case on a refresh. */ + warn_gssd(); + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:00 2009 +Message-Id: <20091217011600.604399403@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:32 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Russ Dill +Subject: [21/90] USB: Close usb_find_interface race v3 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Russ Dill + +commit c2d284ee04ab6f6718de2ddcf1b43160e046c41d upstream. + +USB drivers that create character devices call usb_register_dev in their +probe function. This associates the usb_interface device with that minor +number and creates the character device and announces it to the world. +However, the driver's probe function is called before the new +usb_interface is added to the driver's klist_devices. + +This is a problem because userspace will respond to the character device +creation announcement by opening the character device. The driver's open +function will the call usb_find_interface to find the usb_interface +associated with that minor number. usb_find_interface will walk the +driver's list of devices and find the usb_interface with the matching +minor number. + +Because the announcement happens before the usb_interface is added to the +driver's klist_devices, a race condition exists. A straightforward fix +is to walk the list of devices on usb_bus_type instead since the device +is added to that list before the announcement occurs. + +bus_find_device calls get_device to bump the reference count on the found +device. It is arguable that the reference count should be dropped by the +caller of usb_find_interface instead of usb_find_interface, however, +the current users of usb_find_interface do not expect this. + +The original version of this patch only matched against minor number +instead of driver and minor number. This version matches against both. + +Signed-off-by: Russ Dill +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/usb.c | 31 ++++++++++++++++--------------- + 1 file changed, 16 insertions(+), 15 deletions(-) + +--- a/drivers/usb/core/usb.c ++++ b/drivers/usb/core/usb.c +@@ -132,7 +132,7 @@ EXPORT_SYMBOL_GPL(usb_altnum_to_altsetti + + struct find_interface_arg { + int minor; +- struct usb_interface *interface; ++ struct device_driver *drv; + }; + + static int __find_interface(struct device *dev, void *data) +@@ -143,12 +143,10 @@ static int __find_interface(struct devic + if (!is_usb_interface(dev)) + return 0; + ++ if (dev->driver != arg->drv) ++ return 0; + intf = to_usb_interface(dev); +- if (intf->minor != -1 && intf->minor == arg->minor) { +- arg->interface = intf; +- return 1; +- } +- return 0; ++ return intf->minor == arg->minor; + } + + /** +@@ -156,21 +154,24 @@ static int __find_interface(struct devic + * @drv: the driver whose current configuration is considered + * @minor: the minor number of the desired device + * +- * This walks the driver device list and returns a pointer to the interface +- * with the matching minor. Note, this only works for devices that share the +- * USB major number. ++ * This walks the bus device list and returns a pointer to the interface ++ * with the matching minor and driver. Note, this only works for devices ++ * that share the USB major number. + */ + struct usb_interface *usb_find_interface(struct usb_driver *drv, int minor) + { + struct find_interface_arg argb; +- int retval; ++ struct device *dev; + + argb.minor = minor; +- argb.interface = NULL; +- /* eat the error, it will be in argb.interface */ +- retval = driver_for_each_device(&drv->drvwrap.driver, NULL, &argb, +- __find_interface); +- return argb.interface; ++ argb.drv = &drv->drvwrap.driver; ++ ++ dev = bus_find_device(&usb_bus_type, NULL, &argb, __find_interface); ++ ++ /* Drop reference count from bus_find_device */ ++ put_device(dev); ++ ++ return dev ? to_usb_interface(dev) : NULL; + } + EXPORT_SYMBOL_GPL(usb_find_interface); + + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:00 2009 +Message-Id: <20091217011600.734038780@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:33 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Sergei Shtylyov , + Anand Gadiyar +Subject: [22/90] USB: musb_gadget_ep0: fix unhandled endpoint 0 IRQs, again + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Sergei Shtylyov + +commit 196f1b7a387546f425df2f1fad26772e3d513aea upstream. + +Commit a5073b52833e4df8e16c93dc4cbb7e0c558c74a2 (musb_gadget: fix +unhandled endpoint 0 IRQs) somehow missed its key change: + +"The gadget EP0 code routinely ignores an interrupt at end of +the data phase because of musb_g_ep0_giveback() resetting the +state machine to "idle, waiting for SETUP" phase prematurely." + +So, the majority of the cases of unhandled IRQs is still unfixed... + +Signed-off-by: Sergei Shtylyov +Signed-off-by: Anand Gadiyar +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_gadget_ep0.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/usb/musb/musb_gadget_ep0.c ++++ b/drivers/usb/musb/musb_gadget_ep0.c +@@ -199,7 +199,6 @@ service_in_request(struct musb *musb, co + static void musb_g_ep0_giveback(struct musb *musb, struct usb_request *req) + { + musb_g_giveback(&musb->endpoints[0].ep_in, req, 0); +- musb->ep0_state = MUSB_EP0_STAGE_SETUP; + } + + /* + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:00 2009 +Message-Id: <20091217011600.862764776@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:34 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Zhang Le +Subject: [23/90] USB: option.c: add support for D-Link DWM-162-U5 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Zhang Le + +commit 54a8e144acad6506920f385f4ef2779664f05b21 upstream. + +Add D-Link DWM-162-U5 device id 1e0e:ce16 into option driver. The device +has 4 interfaces, of which 1 is handled by storage and the other 3 by +option driver. + +The device appears first as CD-only 05c6:2100 device and must be switched +to 1e0e:ce16 mode either by using "eject CD" or usb_modeswitch. + +The MessageContent for usb_modeswitch.conf is: +"55534243e0c26a85000000000000061b000000020000000000000000000000" + +Signed-off-by: Zhang Le +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -632,6 +632,7 @@ static struct usb_device_id option_ids[] + { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_G450) }, + { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_HSDPA_MINICARD ) }, /* Toshiba 3G HSDPA == Novatel Expedite EU870D MiniCard */ + { USB_DEVICE(ALINK_VENDOR_ID, 0x9000) }, ++ { USB_DEVICE(ALINK_VENDOR_ID, 0xce16) }, + { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) }, + { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S) }, + { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) }, + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:01 2009 +Message-Id: <20091217011600.998528574@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:35 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Stern +Subject: [24/90] USB: usb-storage: add BAD_SENSE flag + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alan Stern + +commit a0bb108112a872c0b0c4b3ef4974f95fb75b155d upstream. + +This patch (as1311) fixes a problem in usb-storage: Some devices are +pretty broken when it comes to reporting sense data. The information +they send back indicates that they have more than 18 bytes of sense +data available, but when the system asks for more than 18 they fail or +hang. The symptom is that probing fails with multiple resets. + +The patch adds a new BAD_SENSE flag to indicate that usb-storage +should never ask for more than 18 bytes of sense data. The flag can +be set in an unusual_devs entry or via the "quirks=" module parameter, +and it is set automatically whenever a REQUEST SENSE command for more +than 18 bytes fails or times out. + +An unusual_devs entry is added for the Agfa photo frame, which uses a +Prolific chip having this bug. + +Signed-off-by: Alan Stern +Tested-by: Daniel Kukula +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/kernel-parameters.txt | 2 ++ + drivers/usb/storage/transport.c | 17 +++++++++++++---- + drivers/usb/storage/unusual_devs.h | 7 +++++++ + drivers/usb/storage/usb.c | 3 +++ + include/linux/usb_usual.h | 4 +++- + 5 files changed, 28 insertions(+), 5 deletions(-) + +--- a/Documentation/kernel-parameters.txt ++++ b/Documentation/kernel-parameters.txt +@@ -2561,6 +2561,8 @@ and is between 256 and 4096 characters. + to a common usb-storage quirk flag as follows: + a = SANE_SENSE (collect more than 18 bytes + of sense data); ++ b = BAD_SENSE (don't collect more than 18 ++ bytes of sense data); + c = FIX_CAPACITY (decrease the reported + device capacity by one sector); + h = CAPACITY_HEURISTICS (decrease the +--- a/drivers/usb/storage/transport.c ++++ b/drivers/usb/storage/transport.c +@@ -666,10 +666,11 @@ void usb_stor_invoke_transport(struct sc + * to wait for at least one CHECK_CONDITION to determine + * SANE_SENSE support + */ +- if ((srb->cmnd[0] == ATA_16 || srb->cmnd[0] == ATA_12) && ++ if (unlikely((srb->cmnd[0] == ATA_16 || srb->cmnd[0] == ATA_12) && + result == USB_STOR_TRANSPORT_GOOD && + !(us->fflags & US_FL_SANE_SENSE) && +- !(srb->cmnd[2] & 0x20)) { ++ !(us->fflags & US_FL_BAD_SENSE) && ++ !(srb->cmnd[2] & 0x20))) { + US_DEBUGP("-- SAT supported, increasing auto-sense\n"); + us->fflags |= US_FL_SANE_SENSE; + } +@@ -718,6 +719,12 @@ Retry_Sense: + if (test_bit(US_FLIDX_TIMED_OUT, &us->dflags)) { + US_DEBUGP("-- auto-sense aborted\n"); + srb->result = DID_ABORT << 16; ++ ++ /* If SANE_SENSE caused this problem, disable it */ ++ if (sense_size != US_SENSE_SIZE) { ++ us->fflags &= ~US_FL_SANE_SENSE; ++ us->fflags |= US_FL_BAD_SENSE; ++ } + goto Handle_Errors; + } + +@@ -727,10 +734,11 @@ Retry_Sense: + * (small) sense request. This fixes some USB GSM modems + */ + if (temp_result == USB_STOR_TRANSPORT_FAILED && +- (us->fflags & US_FL_SANE_SENSE) && +- sense_size != US_SENSE_SIZE) { ++ sense_size != US_SENSE_SIZE) { + US_DEBUGP("-- auto-sense failure, retry small sense\n"); + sense_size = US_SENSE_SIZE; ++ us->fflags &= ~US_FL_SANE_SENSE; ++ us->fflags |= US_FL_BAD_SENSE; + goto Retry_Sense; + } + +@@ -754,6 +762,7 @@ Retry_Sense: + */ + if (srb->sense_buffer[7] > (US_SENSE_SIZE - 8) && + !(us->fflags & US_FL_SANE_SENSE) && ++ !(us->fflags & US_FL_BAD_SENSE) && + (srb->sense_buffer[0] & 0x7C) == 0x70) { + US_DEBUGP("-- SANE_SENSE support enabled\n"); + us->fflags |= US_FL_SANE_SENSE; +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -838,6 +838,13 @@ UNUSUAL_DEV( 0x066f, 0x8000, 0x0001, 0x0 + US_SC_DEVICE, US_PR_DEVICE, NULL, + US_FL_FIX_CAPACITY ), + ++/* Reported by Daniel Kukula */ ++UNUSUAL_DEV( 0x067b, 0x1063, 0x0100, 0x0100, ++ "Prolific Technology, Inc.", ++ "Prolific Storage Gadget", ++ US_SC_DEVICE, US_PR_DEVICE, NULL, ++ US_FL_BAD_SENSE ), ++ + /* Reported by Rogerio Brito */ + UNUSUAL_DEV( 0x067b, 0x2317, 0x0001, 0x001, + "Prolific Technology, Inc.", +--- a/drivers/usb/storage/usb.c ++++ b/drivers/usb/storage/usb.c +@@ -460,6 +460,9 @@ static void adjust_quirks(struct us_data + case 'a': + f |= US_FL_SANE_SENSE; + break; ++ case 'b': ++ f |= US_FL_BAD_SENSE; ++ break; + case 'c': + f |= US_FL_FIX_CAPACITY; + break; +--- a/include/linux/usb_usual.h ++++ b/include/linux/usb_usual.h +@@ -56,7 +56,9 @@ + US_FLAG(SANE_SENSE, 0x00008000) \ + /* Sane Sense (> 18 bytes) */ \ + US_FLAG(CAPACITY_OK, 0x00010000) \ +- /* READ CAPACITY response is correct */ ++ /* READ CAPACITY response is correct */ \ ++ US_FLAG(BAD_SENSE, 0x00020000) \ ++ /* Bad Sense (never more than 18 bytes) */ + + #define US_FLAG(name, value) US_FL_##name = value , + enum { US_DO_ALL_FLAGS }; + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:01 2009 +Message-Id: <20091217011601.125726102@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:36 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andre Herms +Subject: [25/90] USB: usbtmc: repeat usb_bulk_msg until whole message is transfered + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Andre Herms + +commit ec412b92dbe3ea839716853eea058d1bcc5e6ca4 upstream. + +usb_bulk_msg() transfers only bytes up to the maximum packet size. +It must be repeated by the usbtmc driver until all bytes of a TMC message +are transfered. + +Without this patch, ETIMEDOUT is reported when writing TMC messages +larger than the maximum USB bulk size and the transfer remains incomplete. +The user will notice that the device hangs and must be reset by either closing +the application or pulling the plug. + +Signed-off-by: Andre Herms +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/usbtmc.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/drivers/usb/class/usbtmc.c ++++ b/drivers/usb/class/usbtmc.c +@@ -545,10 +545,16 @@ static ssize_t usbtmc_write(struct file + n_bytes = roundup(12 + this_part, 4); + memset(buffer + 12 + this_part, 0, n_bytes - (12 + this_part)); + +- retval = usb_bulk_msg(data->usb_dev, +- usb_sndbulkpipe(data->usb_dev, +- data->bulk_out), +- buffer, n_bytes, &actual, USBTMC_TIMEOUT); ++ do { ++ retval = usb_bulk_msg(data->usb_dev, ++ usb_sndbulkpipe(data->usb_dev, ++ data->bulk_out), ++ buffer, n_bytes, ++ &actual, USBTMC_TIMEOUT); ++ if (retval != 0) ++ break; ++ n_bytes -= actual; ++ } while (n_bytes); + + data->bTag_last_write = data->bTag; + data->bTag++; + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:01 2009 +Message-Id: <20091217011601.254418435@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:37 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Roel Kluin , + Michael Krufky , + Mauro Carvalho Chehab +Subject: [26/90] V4L/DVB: Fix test in copy_reg_bits() + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Roel Kluin + +commit c95a419a5604ec8a23cd73f61e9bb151e8cbe89b upstream. + +The reg_pair2[j].reg was tested twice. + +Signed-off-by: Roel Kluin +Acked-by: Michael Krufky +Signed-off-by: Andrew Morton +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/common/tuners/mxl5007t.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/common/tuners/mxl5007t.c ++++ b/drivers/media/common/tuners/mxl5007t.c +@@ -196,7 +196,7 @@ static void copy_reg_bits(struct reg_pai + i = j = 0; + + while (reg_pair1[i].reg || reg_pair1[i].val) { +- while (reg_pair2[j].reg || reg_pair2[j].reg) { ++ while (reg_pair2[j].reg || reg_pair2[j].val) { + if (reg_pair1[i].reg != reg_pair2[j].reg) { + j++; + continue; + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:01 2009 +Message-Id: <20091217011601.389918723@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:38 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dave Jones , + Ingo Molnar +Subject: [27/90] x86: Add new Intel CPU cache size descriptors + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Dave Jones + +commit 85160b92fbd35321104819283c91bfed2b553e3c upstream. + +The latest rev of Intel doc AP-485 details new cache descriptors +that we don't yet support. 12MB, 18MB and 24MB 24-way assoc L3 +caches. + +Signed-off-by: Dave Jones +LKML-Reference: <20091110184924.GA20337@redhat.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/intel_cacheinfo.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/x86/kernel/cpu/intel_cacheinfo.c ++++ b/arch/x86/kernel/cpu/intel_cacheinfo.c +@@ -101,6 +101,9 @@ static const struct _cache_table __cpuin + { 0xe2, LVL_3, 2048 }, /* 16-way set assoc, 64 byte line size */ + { 0xe3, LVL_3, 4096 }, /* 16-way set assoc, 64 byte line size */ + { 0xe4, LVL_3, 8192 }, /* 16-way set assoc, 64 byte line size */ ++ { 0xea, LVL_3, 12288 }, /* 24-way set assoc, 64 byte line size */ ++ { 0xeb, LVL_3, 18432 }, /* 24-way set assoc, 64 byte line size */ ++ { 0xec, LVL_3, 24576 }, /* 24-way set assoc, 64 byte line size */ + { 0x00, 0, 0} + }; + + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:01 2009 +Message-Id: <20091217011601.522223439@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:39 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Joerg Roedel +Subject: [28/90] x86/amd-iommu: attach devices to pre-allocated domains early + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Joerg Roedel + +commit be831297716036de5b24308447ecb69f1706a846 upstream. + +For some devices the ACPI table may define unity map +requirements which must me met when the IOMMU is enabled. So +we need to attach devices to their domains as early as +possible so that these mappings are in place when needed. +This patch assigns the domains right after they are +allocated. Otherwise this can result in I/O page faults +before a driver binds to a device and BIOS is still using +it. + +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/amd_iommu.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/amd_iommu.c ++++ b/arch/x86/kernel/amd_iommu.c +@@ -1873,10 +1873,10 @@ static void prealloc_protection_domains( + struct pci_dev *dev = NULL; + struct dma_ops_domain *dma_dom; + struct amd_iommu *iommu; +- u16 devid; ++ u16 devid, __devid; + + while ((dev = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, dev)) != NULL) { +- devid = calc_devid(dev->bus->number, dev->devfn); ++ __devid = devid = calc_devid(dev->bus->number, dev->devfn); + if (devid > amd_iommu_last_bdf) + continue; + devid = amd_iommu_alias_table[devid]; +@@ -1891,6 +1891,10 @@ static void prealloc_protection_domains( + init_unity_mappings_for_device(dma_dom, devid); + dma_dom->target_dev = devid; + ++ attach_device(iommu, &dma_dom->domain, devid); ++ if (__devid != devid) ++ attach_device(iommu, &dma_dom->domain, __devid); ++ + list_add_tail(&dma_dom->list, &iommu_pd_list); + } + } + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:01 2009 +Message-Id: <20091217011601.657714019@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:40 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Joerg Roedel +Subject: [29/90] x86/amd-iommu: un__init iommu_setup_msi + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Joerg Roedel + +commit 9f800de38b05d84809e89f16671d636a140eede7 upstream. + +This function may be called on the resume path and can not +be dropped after booting. + +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/amd_iommu_init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/amd_iommu_init.c ++++ b/arch/x86/kernel/amd_iommu_init.c +@@ -915,7 +915,7 @@ static int __init init_iommu_all(struct + * + ****************************************************************************/ + +-static int __init iommu_setup_msi(struct amd_iommu *iommu) ++static int iommu_setup_msi(struct amd_iommu *iommu) + { + int r; + + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:01 2009 +Message-Id: <20091217011601.788409461@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:41 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mikael Pettersson , + Andreas Herrmann , + Joerg Roedel , + Ingo Molnar +Subject: [30/90] x86, apic: Enable lapic nmi watchdog on AMD Family 11h + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mikael Pettersson + +commit 7d1849aff6687a135a8da3a75e32a00e3137a5e2 upstream. + +The x86 lapic nmi watchdog does not recognize AMD Family 11h, +resulting in: + + NMI watchdog: CPU not supported + +As far as I can see from available documentation (the BKDM), +family 11h looks identical to family 10h as far as the PMU +is concerned. + +Extending the check to accept family 11h results in: + + Testing NMI watchdog ... OK. + +I've been running with this change on a Turion X2 Ultra ZM-82 +laptop for a couple of weeks now without problems. + +Signed-off-by: Mikael Pettersson +Cc: Andreas Herrmann +Cc: Joerg Roedel +LKML-Reference: <19223.53436.931768.278021@pilspetsen.it.uu.se> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/perfctr-watchdog.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/cpu/perfctr-watchdog.c ++++ b/arch/x86/kernel/cpu/perfctr-watchdog.c +@@ -711,7 +711,7 @@ static void probe_nmi_watchdog(void) + switch (boot_cpu_data.x86_vendor) { + case X86_VENDOR_AMD: + if (boot_cpu_data.x86 != 6 && boot_cpu_data.x86 != 15 && +- boot_cpu_data.x86 != 16) ++ boot_cpu_data.x86 != 16 && boot_cpu_data.x86 != 17) + return; + wd_ops = &k7_wd_ops; + break; + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:02 2009 +Message-Id: <20091217011601.921010092@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:42 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Leann Ogasawara , + "H. Peter Anvin" +Subject: [31/90] x86: ASUS P4S800 reboot=bios quirk + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Leann Ogasawara + +commit 4832ddda2ec4df96ea1eed334ae2dbd65fc1f541 upstream. + +Bug reporter noted their system with an ASUS P4S800 motherboard would +hang when rebooting unless reboot=b was specified. Their dmidecode +didn't contain descriptive System Information for Manufacturer or +Product Name, so I used their Base Board Information to create a +reboot quirk patch. The bug reporter confirmed this patch resolves +the reboot hang. + +Handle 0x0001, DMI type 1, 25 bytes +System Information + Manufacturer: System Manufacturer + Product Name: System Name + Version: System Version + Serial Number: SYS-1234567890 + UUID: E0BFCD8B-7948-D911-A953-E486B4EEB67F + Wake-up Type: Power Switch + +Handle 0x0002, DMI type 2, 8 bytes +Base Board Information + Manufacturer: ASUSTeK Computer INC. + Product Name: P4S800 + Version: REV 1.xx + Serial Number: xxxxxxxxxxx + +BugLink: http://bugs.launchpad.net/bugs/366682 + +ASUS P4S800 will hang when rebooting unless reboot=b is specified. +Add a quirk to reboot through the bios. + +Signed-off-by: Leann Ogasawara +LKML-Reference: <1259972107.4629.275.camel@emiko> +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/reboot.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/arch/x86/kernel/reboot.c ++++ b/arch/x86/kernel/reboot.c +@@ -257,6 +257,14 @@ static struct dmi_system_id __initdata r + DMI_MATCH(DMI_PRODUCT_NAME, "SBC-FITPC2"), + }, + }, ++ { /* Handle problems with rebooting on ASUS P4S800 */ ++ .callback = set_bios_reboot, ++ .ident = "ASUS P4S800", ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."), ++ DMI_MATCH(DMI_BOARD_NAME, "P4S800"), ++ }, ++ }, + { } + }; + + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:02 2009 +Message-Id: <20091217011602.051155536@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:43 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Darrick J. Wong" , + Muli Ben-Yehuda , + FUJITA Tomonori , + Joerg Roedel , + Yinghai Lu , + "Jon D. Mason" , + Corinna Schultz , + Ingo Molnar +Subject: [32/90] x86, Calgary IOMMU quirk: Find nearest matching Calgary while walking up the PCI tree + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Darrick J. Wong + +commit 4528752f49c1f4025473d12bc5fa9181085c3f22 upstream. + +On a multi-node x3950M2 system, there's a slight oddity in the +PCI device tree for all secondary nodes: + + 30:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev e1) + \-33:00.0 PCI bridge: IBM CalIOC2 PCI-E Root Port (rev 01) + \-34:00.0 RAID bus controller: LSI Logic / Symbios Logic MegaRAID SAS 1078 (rev 04) + +...as compared to the primary node: + + 00:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev e1) + \-01:00.0 VGA compatible controller: ATI Technologies Inc ES1000 (rev 02) + 03:00.0 PCI bridge: IBM CalIOC2 PCI-E Root Port (rev 01) + \-04:00.0 RAID bus controller: LSI Logic / Symbios Logic MegaRAID SAS 1078 (rev 04) + +In both nodes, the LSI RAID controller hangs off a CalIOC2 +device, but on the secondary nodes, the BIOS hides the VGA +device and substitutes the device tree ending with the disk +controller. + +It would seem that Calgary devices don't necessarily appear at +the top of the PCI tree, which means that the current code to +find the Calgary IOMMU that goes with a particular device is +buggy. + +Rather than walk all the way to the top of the PCI +device tree and try to match bus number with Calgary descriptor, +the code needs to examine each parent of the particular device; +if it encounters a Calgary with a matching bus number, simply +use that. + +Otherwise, we BUG() when the bus number of the Calgary doesn't +match the bus number of whatever's at the top of the device tree. + +Extra note: This patch appears to work correctly for the x3950 +that came before the x3950 M2. + +Signed-off-by: Darrick J. Wong +Acked-by: Muli Ben-Yehuda +Cc: FUJITA Tomonori +Cc: Joerg Roedel +Cc: Yinghai Lu +Cc: Jon D. Mason +Cc: Corinna Schultz +LKML-Reference: <20091202230556.GG10295@tux1.beaverton.ibm.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/pci-calgary_64.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/arch/x86/kernel/pci-calgary_64.c ++++ b/arch/x86/kernel/pci-calgary_64.c +@@ -318,13 +318,15 @@ static inline struct iommu_table *find_i + + pdev = to_pci_dev(dev); + ++ /* search up the device tree for an iommu */ + pbus = pdev->bus; +- +- /* is the device behind a bridge? Look for the root bus */ +- while (pbus->parent) ++ do { ++ tbl = pci_iommu(pbus); ++ if (tbl && tbl->it_busno == pbus->number) ++ break; ++ tbl = NULL; + pbus = pbus->parent; +- +- tbl = pci_iommu(pbus); ++ } while (pbus); + + BUG_ON(tbl && (tbl->it_busno != pbus->number)); + + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:02 2009 +Message-Id: <20091217011602.184023170@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:44 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tejun Heo , + FUJITA Tomonori , + Matteo Frigo , + Ingo Molnar +Subject: [33/90] x86: Fix iommu=nodac parameter handling + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Tejun Heo + +commit 2ae8bb75db1f3de422eb5898f2a063c46c36dba8 upstream. + +iommu=nodac should forbid dac instead of enabling it. Fix it. + +Signed-off-by: Tejun Heo +Acked-by: FUJITA Tomonori +Cc: Matteo Frigo +LKML-Reference: <4AE5B52A.4050408@kernel.org> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/pci-dma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/pci-dma.c ++++ b/arch/x86/kernel/pci-dma.c +@@ -203,7 +203,7 @@ static __init int iommu_setup(char *p) + if (!strncmp(p, "allowdac", 8)) + forbid_dac = 0; + if (!strncmp(p, "nodac", 5)) +- forbid_dac = -1; ++ forbid_dac = 1; + if (!strncmp(p, "usedac", 6)) { + forbid_dac = -1; + return 1; + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:02 2009 +Message-Id: <20091217011602.311747508@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:45 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dave Jones , + Ingo Molnar +Subject: [34/90] x86: Fix typo in Intel CPU cache size descriptor + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Dave Jones + +commit e02e0e1a130b9ca37c5186d38ad4b3aaf58bb149 upstream. + +I double-checked the datasheet. One of the existing +descriptors has a typo: it should be 2MB not 2038 KB. + +Signed-off-by: Dave Jones +LKML-Reference: <20091110200120.GA27090@redhat.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/intel_cacheinfo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/cpu/intel_cacheinfo.c ++++ b/arch/x86/kernel/cpu/intel_cacheinfo.c +@@ -93,7 +93,7 @@ static const struct _cache_table __cpuin + { 0xd1, LVL_3, 1024 }, /* 4-way set assoc, 64 byte line size */ + { 0xd2, LVL_3, 2048 }, /* 4-way set assoc, 64 byte line size */ + { 0xd6, LVL_3, 1024 }, /* 8-way set assoc, 64 byte line size */ +- { 0xd7, LVL_3, 2038 }, /* 8-way set assoc, 64 byte line size */ ++ { 0xd7, LVL_3, 2048 }, /* 8-way set assoc, 64 byte line size */ + { 0xd8, LVL_3, 4096 }, /* 12-way set assoc, 64 byte line size */ + { 0xdc, LVL_3, 2048 }, /* 12-way set assoc, 64 byte line size */ + { 0xdd, LVL_3, 4096 }, /* 12-way set assoc, 64 byte line size */ + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:02 2009 +Message-Id: <20091217011602.441871371@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:46 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Joe Perches , + Ingo Molnar +Subject: [35/90] x86: GART: pci-gart_64.c: Use correct length in strncmp + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Joe Perches + +commit 41855b77547fa18d90ed6a5d322983d3fdab1959 upstream. + +Signed-off-by: Joe Perches +LKML-Reference: <1257818330.12852.72.camel@Joe-Laptop.home> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/pci-gart_64.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/pci-gart_64.c ++++ b/arch/x86/kernel/pci-gart_64.c +@@ -856,7 +856,7 @@ void __init gart_parse_options(char *p) + #endif + if (isdigit(*p) && get_option(&p, &arg)) + iommu_size = arg; +- if (!strncmp(p, "fullflush", 8)) ++ if (!strncmp(p, "fullflush", 9)) + iommu_fullflush = 1; + if (!strncmp(p, "nofullflush", 11)) + iommu_fullflush = 0; + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:02 2009 +Message-Id: <20091217011602.574123357@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:47 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alex Deucher , + Dave Airlie +Subject: [36/90] drm/radeon/kms: Add quirk for HIS X1300 board + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alex Deucher + +commit 4e3f9b78ff917cc5c833858fdb5d96bc262e0bf3 upstream. + +Board is DVI+VGA, not DVI+DVI + +Signed-off-by: Alex Deucher +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_atombios.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/gpu/drm/radeon/radeon_atombios.c ++++ b/drivers/gpu/drm/radeon/radeon_atombios.c +@@ -134,6 +134,14 @@ static bool radeon_atom_apply_quirks(str + } + } + ++ /* HIS X1300 is DVI+VGA, not DVI+DVI */ ++ if ((dev->pdev->device == 0x7146) && ++ (dev->pdev->subsystem_vendor == 0x17af) && ++ (dev->pdev->subsystem_device == 0x2058)) { ++ if (supported_device == ATOM_DEVICE_DFP1_SUPPORT) ++ return false; ++ } ++ + /* Funky macbooks */ + if ((dev->pdev->device == 0x71C5) && + (dev->pdev->subsystem_vendor == 0x106b) && + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:02 2009 +Message-Id: <20091217011602.713264453@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:48 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alex Deucher , + Dave Airlie +Subject: [37/90] drm/radeon/kms: fix legacy crtc2 dpms + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alex Deucher + +commit 8de21525439e6b5bb8d8c81e49094d867bf82f6d upstream. + +noticed by Matthijs Kooijman on fdo bug 22140 + +Signed-off-by: Alex Deucher +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_legacy_crtc.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c ++++ b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c +@@ -291,8 +291,7 @@ void radeon_crtc_dpms(struct drm_crtc *c + uint32_t mask; + + if (radeon_crtc->crtc_id) +- mask = (RADEON_CRTC2_EN | +- RADEON_CRTC2_DISP_DIS | ++ mask = (RADEON_CRTC2_DISP_DIS | + RADEON_CRTC2_VSYNC_DIS | + RADEON_CRTC2_HSYNC_DIS | + RADEON_CRTC2_DISP_REQ_EN_B); +@@ -304,7 +303,7 @@ void radeon_crtc_dpms(struct drm_crtc *c + switch (mode) { + case DRM_MODE_DPMS_ON: + if (radeon_crtc->crtc_id) +- WREG32_P(RADEON_CRTC2_GEN_CNTL, RADEON_CRTC2_EN, ~mask); ++ WREG32_P(RADEON_CRTC2_GEN_CNTL, RADEON_CRTC2_EN, ~(RADEON_CRTC2_EN | mask)); + else { + WREG32_P(RADEON_CRTC_GEN_CNTL, RADEON_CRTC_EN, ~(RADEON_CRTC_EN | + RADEON_CRTC_DISP_REQ_EN_B)); +@@ -318,7 +317,7 @@ void radeon_crtc_dpms(struct drm_crtc *c + case DRM_MODE_DPMS_OFF: + drm_vblank_pre_modeset(dev, radeon_crtc->crtc_id); + if (radeon_crtc->crtc_id) +- WREG32_P(RADEON_CRTC2_GEN_CNTL, mask, ~mask); ++ WREG32_P(RADEON_CRTC2_GEN_CNTL, mask, ~(RADEON_CRTC2_EN | mask)); + else { + WREG32_P(RADEON_CRTC_GEN_CNTL, RADEON_CRTC_DISP_REQ_EN_B, ~(RADEON_CRTC_EN | + RADEON_CRTC_DISP_REQ_EN_B)); + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:02 2009 +Message-Id: <20091217011602.837916977@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:49 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Vasanthakumar Thiagarajan , + "John W. Linville" +Subject: [38/90] mac80211: Fix bug in computing crc over dynamic IEs in beacon + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Vasanthakumar Thiagarajan + +commit 1814077fd12a9cdf478c10076e9c42094e9d9250 upstream. + +On a 32-bit machine, BIT() macro does not give the required +bit value if the bit is mroe than 31. In ieee802_11_parse_elems_crc(), +BIT() is suppossed to get the bit value more than 31 (42 (id of ERP_INFO_IE), +37 (CHANNEL_SWITCH_IE), (42), 32 (POWER_CONSTRAINT_IE), 45 (HT_CAP_IE), +61 (HT_INFO_IE)). As we do not get the required bit value for the above +IEs, crc over these IEs are never calculated, so any dynamic change in these +IEs after the association is not really handled on 32-bit platforms. +This patch fixes this issue. + +Signed-off-by: Vasanthakumar Thiagarajan +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/util.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -537,7 +537,7 @@ u32 ieee802_11_parse_elems_crc(u8 *start + if (elen > left) + break; + +- if (calc_crc && id < 64 && (filter & BIT(id))) ++ if (calc_crc && id < 64 && (filter & (1ULL << id))) + crc = crc32_be(crc, pos - 2, elen + 2); + + switch (id) { + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:03 2009 +Message-Id: <20091217011602.968830252@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:50 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Naoya Horiguchi , + Andi Kleen , + Wu Fengguang , + Hugh Dickins , + Mel Gorman , + Lee Schermerhorn , + Andy Whitcroft , + David Rientjes +Subject: [39/90] mm: hugetlb: fix hugepage memory leak in mincore() + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Naoya Horiguchi + +commit 4f16fc107d9c9b8a72aa19b189a9216e90a7aaef upstream. + +Most callers of pmd_none_or_clear_bad() check whether the target page is +in a hugepage or not, but mincore() and walk_page_range() do not check it. + So if we use mincore() on a hugepage on x86 machine, the hugepage memory +is leaked as shown below. This patch fixes it by extending mincore() +system call to support hugepages. + +Details +======= +My test program (leak_mincore) works as follows: + - creat() and mmap() a file on hugetlbfs (file size is 200MB == 100 hugepages,) + - read()/write() something on it, + - call mincore() for first ten pages and printf() the values of *vec + - munmap() and unlink() the file on hugetlbfs + +Without my patch +---------------- +$ cat /proc/meminfo| grep "HugePage" +HugePages_Total: 1000 +HugePages_Free: 1000 +HugePages_Rsvd: 0 +HugePages_Surp: 0 +$ ./leak_mincore +vec[0] 0 +vec[1] 0 +vec[2] 0 +vec[3] 0 +vec[4] 0 +vec[5] 0 +vec[6] 0 +vec[7] 0 +vec[8] 0 +vec[9] 0 +$ cat /proc/meminfo |grep "HugePage" +HugePages_Total: 1000 +HugePages_Free: 999 +HugePages_Rsvd: 0 +HugePages_Surp: 0 +$ ls /hugetlbfs/ +$ + +Return values in *vec from mincore() are set to 0, while the hugepage +should be in memory, and 1 hugepage is still accounted as used while +there is no file on hugetlbfs. + +With my patch +------------- +$ cat /proc/meminfo| grep "HugePage" +HugePages_Total: 1000 +HugePages_Free: 1000 +HugePages_Rsvd: 0 +HugePages_Surp: 0 +$ ./leak_mincore +vec[0] 1 +vec[1] 1 +vec[2] 1 +vec[3] 1 +vec[4] 1 +vec[5] 1 +vec[6] 1 +vec[7] 1 +vec[8] 1 +vec[9] 1 +$ cat /proc/meminfo |grep "HugePage" +HugePages_Total: 1000 +HugePages_Free: 1000 +HugePages_Rsvd: 0 +HugePages_Surp: 0 +$ ls /hugetlbfs/ +$ + +Return value in *vec set to 1 and no memory leaks. + +[akpm@linux-foundation.org: cleanup] +[akpm@linux-foundation.org: build fix] +Signed-off-by: Naoya Horiguchi +Cc: Andi Kleen +Cc: Wu Fengguang +Cc: Hugh Dickins +Cc: Mel Gorman +Cc: Lee Schermerhorn +Cc: Andy Whitcroft +Cc: David Rientjes +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/mincore.c | 37 +++++++++++++++++++++++++++++++++++++ + 1 file changed, 37 insertions(+) + +--- a/mm/mincore.c ++++ b/mm/mincore.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -72,6 +73,42 @@ static long do_mincore(unsigned long add + if (!vma || addr < vma->vm_start) + return -ENOMEM; + ++#ifdef CONFIG_HUGETLB_PAGE ++ if (is_vm_hugetlb_page(vma)) { ++ struct hstate *h; ++ unsigned long nr_huge; ++ unsigned char present; ++ ++ i = 0; ++ nr = min(pages, (vma->vm_end - addr) >> PAGE_SHIFT); ++ h = hstate_vma(vma); ++ nr_huge = ((addr + pages * PAGE_SIZE - 1) >> huge_page_shift(h)) ++ - (addr >> huge_page_shift(h)) + 1; ++ nr_huge = min(nr_huge, ++ (vma->vm_end - addr) >> huge_page_shift(h)); ++ while (1) { ++ /* hugepage always in RAM for now, ++ * but generally it needs to be check */ ++ ptep = huge_pte_offset(current->mm, ++ addr & huge_page_mask(h)); ++ present = !!(ptep && ++ !huge_pte_none(huge_ptep_get(ptep))); ++ while (1) { ++ vec[i++] = present; ++ addr += PAGE_SIZE; ++ /* reach buffer limit */ ++ if (i == nr) ++ return nr; ++ /* check hugepage border */ ++ if (!((addr & ~huge_page_mask(h)) ++ >> PAGE_SHIFT)) ++ break; ++ } ++ } ++ return nr; ++ } ++#endif ++ + /* + * Calculate how many pages there are left in the last level of the + * PTE array for our address. + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:03 2009 +Message-Id: <20091217011603.095665584@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:51 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Naoya Horiguchi , + Andi Kleen , + Wu Fengguang , + Hugh Dickins , + Mel Gorman , + Lee Schermerhorn , + Andy Whitcroft , + David Rientjes +Subject: [40/90] mm: hugetlb: fix hugepage memory leak in walk_page_range() + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Naoya Horiguchi + +commit d33b9f45bd24a6391bc05e2b5a13c1b5787ca9c2 upstream. + +Most callers of pmd_none_or_clear_bad() check whether the target page is +in a hugepage or not, but walk_page_range() do not check it. So if we +read /proc/pid/pagemap for the hugepage on x86 machine, the hugepage +memory is leaked as shown below. This patch fixes it. + +Details +======= +My test program (leak_pagemap) works as follows: + - creat() and mmap() a file on hugetlbfs (file size is 200MB == 100 hugepages,) + - read()/write() something on it, + - call page-types with option -p (walk around the page tables), + - munmap() and unlink() the file on hugetlbfs + +Without my patches +------------------ +$ cat /proc/meminfo |grep "HugePage" +HugePages_Total: 1000 +HugePages_Free: 1000 +HugePages_Rsvd: 0 +HugePages_Surp: 0 +$ ./leak_pagemap +[snip output] +$ cat /proc/meminfo |grep "HugePage" +HugePages_Total: 1000 +HugePages_Free: 900 +HugePages_Rsvd: 0 +HugePages_Surp: 0 +$ ls /hugetlbfs/ +$ + +100 hugepages are accounted as used while there is no file on hugetlbfs. + +With my patches +--------------- +$ cat /proc/meminfo |grep "HugePage" +HugePages_Total: 1000 +HugePages_Free: 1000 +HugePages_Rsvd: 0 +HugePages_Surp: 0 +$ ./leak_pagemap +[snip output] +$ cat /proc/meminfo |grep "HugePage" +HugePages_Total: 1000 +HugePages_Free: 1000 +HugePages_Rsvd: 0 +HugePages_Surp: 0 +$ ls /hugetlbfs +$ + +No memory leaks. + +Signed-off-by: Naoya Horiguchi +Cc: Andi Kleen +Cc: Wu Fengguang +Cc: Hugh Dickins +Cc: Mel Gorman +Cc: Lee Schermerhorn +Cc: Andy Whitcroft +Cc: David Rientjes +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/pagewalk.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +--- a/mm/pagewalk.c ++++ b/mm/pagewalk.c +@@ -1,6 +1,7 @@ + #include + #include + #include ++#include + + static int walk_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end, + struct mm_walk *walk) +@@ -107,6 +108,7 @@ int walk_page_range(unsigned long addr, + pgd_t *pgd; + unsigned long next; + int err = 0; ++ struct vm_area_struct *vma; + + if (addr >= end) + return err; +@@ -117,11 +119,22 @@ int walk_page_range(unsigned long addr, + pgd = pgd_offset(walk->mm, addr); + do { + next = pgd_addr_end(addr, end); ++ ++ /* skip hugetlb vma to avoid hugepage PMD being cleared ++ * in pmd_none_or_clear_bad(). */ ++ vma = find_vma(walk->mm, addr); ++ if (vma && is_vm_hugetlb_page(vma)) { ++ if (vma->vm_end < next) ++ next = vma->vm_end; ++ continue; ++ } ++ + if (pgd_none_or_clear_bad(pgd)) { + if (walk->pte_hole) + err = walk->pte_hole(addr, next, walk); + if (err) + break; ++ pgd++; + continue; + } + if (walk->pgd_entry) +@@ -131,7 +144,8 @@ int walk_page_range(unsigned long addr, + err = walk_pud_range(pgd, addr, next, walk); + if (err) + break; +- } while (pgd++, addr = next, addr != end); ++ pgd++; ++ } while (addr = next, addr != end); + + return err; + } + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:03 2009 +Message-Id: <20091217011603.224089240@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:52 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Benjamin Herrenschmidt +Subject: [41/90] powerpc: Fix usage of 64-bit instruction in 32-bit altivec code + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Benjamin Herrenschmidt + +commit e090aa80321b64c3b793f3b047e31ecf1af9538d upstream. + +e821ea70f3b4873b50056a1e0f74befed1014c09 introduced a bug by copying +some 64-bit originated code as-is to be used by both 32 and 64-bit +but this code contains a 64-bit ony "cmpdi" instruction. + +This changes it to cmpwi, which is fine since VRSAVE can only contains +a 32-bit value anyway. + +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kernel/vector.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/powerpc/kernel/vector.S ++++ b/arch/powerpc/kernel/vector.S +@@ -58,7 +58,7 @@ _GLOBAL(load_up_altivec) + * all 1's + */ + mfspr r4,SPRN_VRSAVE +- cmpdi 0,r4,0 ++ cmpwi 0,r4,0 + bne+ 1f + li r4,-1 + mtspr SPRN_VRSAVE,r4 + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:03 2009 +Message-Id: <20091217011603.362701500@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:53 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ian Jackson , + Alan Cox +Subject: [42/90] Serial: Do not read IIR in serial8250_start_tx when UART_BUG_TXEN + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ian Jackson + +commit 68cb4f8e246bbbc649980be0628cae9265870a91 upstream. + +Do not read IIR in serial8250_start_tx when UART_BUG_TXEN + +Reading the IIR clears some oustanding interrupts so it is not safe. +Instead, simply transmit immediately if the buffer is empty without +regard to IIR. + +Signed-off-by: Ian Jackson +Reviewed-by: Markus Armbruster +Reviewed-by: Jiri Kosina +Cc: Alan Cox +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/serial/8250.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +--- a/drivers/serial/8250.c ++++ b/drivers/serial/8250.c +@@ -1337,14 +1337,12 @@ static void serial8250_start_tx(struct u + serial_out(up, UART_IER, up->ier); + + if (up->bugs & UART_BUG_TXEN) { +- unsigned char lsr, iir; ++ unsigned char lsr; + lsr = serial_in(up, UART_LSR); + up->lsr_saved_flags |= lsr & LSR_SAVE_FLAGS; +- iir = serial_in(up, UART_IIR) & 0x0f; + if ((up->port.type == PORT_RM9000) ? +- (lsr & UART_LSR_THRE && +- (iir == UART_IIR_NO_INT || iir == UART_IIR_THRI)) : +- (lsr & UART_LSR_TEMT && iir & UART_IIR_NO_INT)) ++ (lsr & UART_LSR_THRE) : ++ (lsr & UART_LSR_TEMT)) + transmit_chars(up); + } + } + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:03 2009 +Message-Id: <20091217011603.486845303@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:54 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mikulas Patocka , + "David S. Miller" +Subject: [43/90] ide: Serialize CMD643 and CMD646 to fix a hardware bug with SSD + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mikulas Patocka + +[ Upstream commit 9bd7496f5dd488e109e91d9d5743915fb4dfbfde ] + +CMD646 corrupts data on concurrent transfers on both channels when IDE SSD is +connected to one of the channels. + +Setup that demonstrates this hardware bug: Ultra 5, onboard CMD646, rev 3. +/dev/hda is 8GB Seagate ST38410A in MWDMA2 +/dev/hdd is 32GB SSD SiliconHardDisk in MWDMA2 + +- When reading /dev/hdd (for example with dd or fsck), reads from /dev/hda + are corrupted, there are twiddled single bits 1->0 and some full 32-bit + words corrupted, sometimes commands fail (which switches /dev/hda to + PIO mode but the corruptions happen even in PIO). +- Reads from /dev/hdd don't seem to be corrupted (i.e. fsck passes fine). +- When I connected normal rotating harddisk to /dev/hdd, there was no + corruption, so the corruption is something specific to SSD. +- I tried the same setup on a PCI card with CMD649 and saw no corruption. + +This patch serializes the operation for CMD646 and 643 (I didn't test +CMD643 but it may have the same hw bug too because it's earlier design). +CMD649 is good. I don't know anything about CMD 648. + +Signed-off-by: Mikulas Patocka +Tested-by: Frans Pop +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ide/cmd64x.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/ide/cmd64x.c ++++ b/drivers/ide/cmd64x.c +@@ -379,7 +379,8 @@ static const struct ide_port_info cmd64x + .enablebits = {{0x00,0x00,0x00}, {0x51,0x08,0x08}}, + .port_ops = &cmd64x_port_ops, + .host_flags = IDE_HFLAG_CLEAR_SIMPLEX | +- IDE_HFLAG_ABUSE_PREFETCH, ++ IDE_HFLAG_ABUSE_PREFETCH | ++ IDE_HFLAG_SERIALIZE, + .pio_mask = ATA_PIO5, + .mwdma_mask = ATA_MWDMA2, + .udma_mask = 0x00, /* no udma */ +@@ -389,7 +390,8 @@ static const struct ide_port_info cmd64x + .init_chipset = init_chipset_cmd64x, + .enablebits = {{0x51,0x04,0x04}, {0x51,0x08,0x08}}, + .port_ops = &cmd648_port_ops, +- .host_flags = IDE_HFLAG_ABUSE_PREFETCH, ++ .host_flags = IDE_HFLAG_ABUSE_PREFETCH | ++ IDE_HFLAG_SERIALIZE, + .pio_mask = ATA_PIO5, + .mwdma_mask = ATA_MWDMA2, + .udma_mask = ATA_UDMA2, + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:03 2009 +Message-Id: <20091217011603.624534895@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:55 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Hemant Pedanekar , + Bartlomiej Zolnierkiewicz , + Sergei Shtylyov , + "David S. Miller" +Subject: [44/90] ide: fix ioctl to pass requested transfer mode to ide_find_dma_mode instead of UDMA6 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Hemant Pedanekar + +[ Upstream commit 28c1969ff887bc2a7df39272850dece01de03285 ] + +Currently, ide_cmd_ioctl when invoked for setting DMA transfer mode calls +ide_find_dma_mode with requested mode as XFER_UDMA_6. This prevents setting DMA +mode to any other value than the default (maximum) supported by the device (or +UDMA6, if supported) irrespective of the actual requested transfer mode and +returns error. + +For example, setting mode to UDMA2 using hdparm, where UDMA4 is the default +transfer mode gives following error: + # ./hdparm -d1 -Xudma2 /dev/hda + /dev/hda:hda: UDMA/66 mode selected + setting using_dma to 1 (on) + hda: UDMA/66 mode selected + setting xfermode to 66 (UltraDMA mode2) + HDIO_DRIVE_CMD(setxfermode) failed: Invalid argument + using_dma = 1 (on) + +This patch fixes the issue. + +Signed-off-by: Hemant Pedanekar +Acked-by: Bartlomiej Zolnierkiewicz +Acked-by: Sergei Shtylyov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ide/ide-ioctls.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/ide/ide-ioctls.c ++++ b/drivers/ide/ide-ioctls.c +@@ -162,7 +162,7 @@ static int ide_cmd_ioctl(ide_drive_t *dr + if (tf->command == ATA_CMD_SET_FEATURES && + tf->feature == SETFEATURES_XFER && + tf->nsect >= XFER_SW_DMA_0) { +- xfer_rate = ide_find_dma_mode(drive, XFER_UDMA_6); ++ xfer_rate = ide_find_dma_mode(drive, tf->nsect); + if (xfer_rate != tf->nsect) { + err = -EINVAL; + goto abort; + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:03 2009 +Message-Id: <20091217011603.801085521@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:56 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [45/90] Revert "ide: try to use PIO Mode 0 during probe if possible" + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: David S. Miller + +[ Upstream commit 0fb18c4777ff424c1db694af98443a201fa4fc30 ] + +This reverts commit 6029336426a2b43e4bc6f4a84be8789a047d139e. + +Ok, we really do need to revert this, even with Bart's sis5513.c +fix in there. + +The problem is that several driver's ->set_pio_mode() method +depends upon the drive->media type being set properly. Most +of them use this to enable prefetching, which can only be done +for disk media. + +But the commit being reverted here calls ->set_pio_mode() before +it's setup. Actually it considers everything disk because that +is the default media type set by ide_port_init_devices_data(). + +The set of drivers that depend upon the media type in their +->set_pio_method() are: + +drivers/ide/alim15x3.c +drivers/ide/it8172.c +drivers/ide/it8213.c +drivers/ide/pdc202xx_old.c +drivers/ide/piix.c +drivers/ide/qd65xx.c +drivers/ide/sis5513.c +drivers/ide/slc90e66.c + +And it is possible that we could fix this by guarding the prefetching +and other media dependent setting changes with a test on +IDE_PFLAG_PROBING in hwif->port_flags, that's simply too risky for +2.6.32-rcX and -stable. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ide/ide-probe.c | 9 --------- + 1 file changed, 9 deletions(-) + +--- a/drivers/ide/ide-probe.c ++++ b/drivers/ide/ide-probe.c +@@ -1035,15 +1035,6 @@ static void ide_port_init_devices(ide_hw + if (port_ops && port_ops->init_dev) + port_ops->init_dev(drive); + } +- +- ide_port_for_each_dev(i, drive, hwif) { +- /* +- * default to PIO Mode 0 before we figure out +- * the most suited mode for the attached device +- */ +- if (port_ops && port_ops->set_pio_mode) +- port_ops->set_pio_mode(drive, 0); +- } + } + + static void ide_init_port(ide_hwif_t *hwif, unsigned int port, + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:04 2009 +Message-Id: <20091217011603.954645418@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:57 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Bartlomiej Zolnierkiewicz , + Sergei Shtylyov , + "David S. Miller" +Subject: [46/90] slc90e66: fix UDMA handling + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Bartlomiej Zolnierkiewicz + +[ Upstream commit ee31527a02b0a8e1aa4a5e4084d2db5fa34737ed ] + +Fix checking of the currently programmed UDMA mode. + +Signed-off-by: Bartlomiej Zolnierkiewicz +Acked-by: Sergei Shtylyov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ide/slc90e66.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/ide/slc90e66.c ++++ b/drivers/ide/slc90e66.c +@@ -91,8 +91,7 @@ static void slc90e66_set_dma_mode(ide_dr + + if (!(reg48 & u_flag)) + pci_write_config_word(dev, 0x48, reg48|u_flag); +- /* FIXME: (reg4a & a_speed) ? */ +- if ((reg4a & u_speed) != u_speed) { ++ if ((reg4a & a_speed) != u_speed) { + pci_write_config_word(dev, 0x4a, reg4a & ~a_speed); + pci_read_config_word(dev, 0x4a, ®4a); + pci_write_config_word(dev, 0x4a, reg4a|u_speed); + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:04 2009 +Message-Id: <20091217011604.090632427@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:58 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alexander Beregalov , + "David S. Miller" +Subject: [47/90] Au1x00: fix crash when trying register_netdev() + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alexander Beregalov + +[ Upstream commit 63edaf647607795a065e6956a79c47f500dc8447 ] + +Andreas Lohre reported that the driver crashes when trying +to register_netdev(), he sugessted to move dev->netdev_ops initialization +before calling register_netdev(), it worked for him. + +Reported-by: Andreas Lohre +Signed-off-by: Alexander Beregalov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/au1000_eth.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +--- a/drivers/net/au1000_eth.c ++++ b/drivers/net/au1000_eth.c +@@ -1089,7 +1089,14 @@ static struct net_device * au1000_probe( + return NULL; + } + +- if ((err = register_netdev(dev)) != 0) { ++ dev->base_addr = base; ++ dev->irq = irq; ++ dev->netdev_ops = &au1000_netdev_ops; ++ SET_ETHTOOL_OPS(dev, &au1000_ethtool_ops); ++ dev->watchdog_timeo = ETH_TX_TIMEOUT; ++ ++ err = register_netdev(dev); ++ if (err != 0) { + printk(KERN_ERR "%s: Cannot register net device, error %d\n", + DRV_NAME, err); + free_netdev(dev); +@@ -1207,12 +1214,6 @@ static struct net_device * au1000_probe( + aup->tx_db_inuse[i] = pDB; + } + +- dev->base_addr = base; +- dev->irq = irq; +- dev->netdev_ops = &au1000_netdev_ops; +- SET_ETHTOOL_OPS(dev, &au1000_ethtool_ops); +- dev->watchdog_timeo = ETH_TX_TIMEOUT; +- + /* + * The boot code uses the ethernet controller, so reset it to start + * fresh. au1000_init() expects that the device is in reset state. + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:04 2009 +Message-Id: <20091217011604.223046724@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:14:59 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Stanislav Brabec , + "David S. Miller" +Subject: [48/90] b44 WOL setup: one-bit-off stack corruption kernel panic fix + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + + +From: Stanislav Brabec + +[ Upstream commit: e0188829cb724e7d12a2d4e343b368ff1d6e1471 ] + +About 50% of shutdowns of b44 Ethernet adapter ends by kernel panic +with kernels compiled with stack-protector. + +Checking b44_magic_pattern() return values, one call of +b44_magic_pattern() returns 127. It means, that set_bit(128, pmask) +was called on line 1509. It means that bit 0 of 17th byte of pmask was +overwritten. But pmask has only 16 bytes. Stack corruption happens. + +It seems that set_bit() on line 1509 always writes one bit off. + +The fix does not only solve the stack corruption, but also makes Wake +On LAN working on my onboard B44 on Asus A7V-333X mainboard. + +It seems that this problem affects all kernel versions since commit +725ad800 ([PATCH] b44: add wol for old nic) on 2006-06-20. + +Signed-off-by: Stanislav Brabec +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/b44.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/net/b44.c ++++ b/drivers/net/b44.c +@@ -1505,8 +1505,7 @@ static int b44_magic_pattern(u8 *macaddr + for (k = 0; k< ethaddr_bytes; k++) { + ppattern[offset + magicsync + + (j * ETH_ALEN) + k] = macaddr[k]; +- len++; +- set_bit(len, (unsigned long *) pmask); ++ set_bit(len++, (unsigned long *) pmask); + } + } + return len - 1; + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:04 2009 +Message-Id: <20091217011604.354502244@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:00 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [49/90] b44: Fix wedge when using netconsole. + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + + +From: David S. Miller + +[ Upstream commit 0cae200eec6330cd2c20b24279597be1da50dc93 ] + +Fixes kernel bugzilla #14691 + +Due to the way netpoll works, it is perfectly legal to see +NAPI already scheduled when new device events are pending +in b44_interrupt(). + +So logging a message about it is wrong and in fact harmful. + +Based upon a patch by Andreas Mohr. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/b44.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/net/b44.c ++++ b/drivers/net/b44.c +@@ -913,9 +913,6 @@ static irqreturn_t b44_interrupt(int irq + bp->istat = istat; + __b44_disable_ints(bp); + __napi_schedule(&bp->napi); +- } else { +- printk(KERN_ERR PFX "%s: Error, poll already scheduled\n", +- dev->name); + } + + irq_ack: + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:04 2009 +Message-Id: <20091217011604.483828174@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:01 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Roger Oksanen , + "David S. Miller" +Subject: [50/90] e100: Use pci pool to work around GFP_ATOMIC order 5 memory allocation failure + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + + +From: Roger Oksanen + +[ Upstream commit 98468efddb101f8a29af974101c17ba513b07be1 ] + +pci_alloc_consistent uses GFP_ATOMIC allocation that may fail on some systems +with limited memory (Bug #14265). pci_pool_alloc allows waiting with +GFP_KERNEL. + +Tested-by: Karol Lewandowski +Signed-off-by: Roger Oksanen +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/e100.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +--- a/drivers/net/e100.c ++++ b/drivers/net/e100.c +@@ -156,6 +156,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -601,6 +602,7 @@ struct nic { + struct mem *mem; + dma_addr_t dma_addr; + ++ struct pci_pool *cbs_pool; + dma_addr_t cbs_dma_addr; + u8 adaptive_ifs; + u8 tx_threshold; +@@ -1779,9 +1781,7 @@ static void e100_clean_cbs(struct nic *n + nic->cb_to_clean = nic->cb_to_clean->next; + nic->cbs_avail++; + } +- pci_free_consistent(nic->pdev, +- sizeof(struct cb) * nic->params.cbs.count, +- nic->cbs, nic->cbs_dma_addr); ++ pci_pool_free(nic->cbs_pool, nic->cbs, nic->cbs_dma_addr); + nic->cbs = NULL; + nic->cbs_avail = 0; + } +@@ -1799,8 +1799,8 @@ static int e100_alloc_cbs(struct nic *ni + nic->cb_to_use = nic->cb_to_send = nic->cb_to_clean = NULL; + nic->cbs_avail = 0; + +- nic->cbs = pci_alloc_consistent(nic->pdev, +- sizeof(struct cb) * count, &nic->cbs_dma_addr); ++ nic->cbs = pci_pool_alloc(nic->cbs_pool, GFP_KERNEL, ++ &nic->cbs_dma_addr); + if (!nic->cbs) + return -ENOMEM; + +@@ -2827,7 +2827,11 @@ static int __devinit e100_probe(struct p + DPRINTK(PROBE, ERR, "Cannot register net device, aborting.\n"); + goto err_out_free; + } +- ++ nic->cbs_pool = pci_pool_create(netdev->name, ++ nic->pdev, ++ nic->params.cbs.count * sizeof(struct cb), ++ sizeof(u32), ++ 0); + DPRINTK(PROBE, INFO, "addr 0x%llx, irq %d, MAC addr %pM\n", + (unsigned long long)pci_resource_start(pdev, use_io ? 1 : 0), + pdev->irq, netdev->dev_addr); +@@ -2857,6 +2861,7 @@ static void __devexit e100_remove(struct + unregister_netdev(netdev); + e100_free(nic); + pci_iounmap(pdev, nic->csr); ++ pci_pool_destroy(nic->cbs_pool); + free_netdev(netdev); + pci_release_regions(pdev); + pci_disable_device(pdev); + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:04 2009 +Message-Id: <20091217011604.615316659@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:02 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Herbert Xu , + "David S. Miller" +Subject: [51/90] gro: Fix illegal merging of trailer trash + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + + +From: Herbert Xu + +[ Upstream commit 69c0cab120a85471054614418b447349caba22d7 ] + +When we've merged skb's with page frags, and subsequently receive +a trailer skb (< MSS) that is not completely non-linear (this can +occur on Intel NICs if the packet size falls below the threshold), +GRO ends up producing an illegal GSO skb with a frag_list. + +This is harmless unless the skb is then forwarded through an +interface that requires software GSO, whereupon the GSO code +will BUG. + +This patch detects this case in GRO and avoids merging the +trailer skb. + +Reported-by: Mark Wagner +Signed-off-by: Herbert Xu +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/core/skbuff.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -2704,7 +2704,8 @@ int skb_gro_receive(struct sk_buff **hea + + NAPI_GRO_CB(skb)->free = 1; + goto done; +- } ++ } else if (skb_gro_len(p) != pinfo->gso_size) ++ return -E2BIG; + + headroom = skb_headroom(p); + nskb = netdev_alloc_skb(p->dev, headroom + skb_gro_offset(p)); + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:04 2009 +Message-Id: <20091217011604.755061670@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:03 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Patrick McHardy , + "David S. Miller" +Subject: [52/90] ip_fragment: also adjust skb->truesize for packets not owned by a socket + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + + +From: Patrick McHardy + +[ Upstream commit b2722b1c3a893ec6021508da15b32282ec79f4da ] + +When a large packet gets reassembled by ip_defrag(), the head skb +accounts for all the fragments in skb->truesize. If this packet is +refragmented again, skb->truesize is not re-adjusted to reflect only +the head size since its not owned by a socket. If the head fragment +then gets recycled and reused for another received fragment, it might +exceed the defragmentation limits due to its large truesize value. + +skb_recycle_check() explicitly checks for linear skbs, so any recycled +skb should reflect its true size in skb->truesize. Change ip_fragment() +to also adjust the truesize value of skbs not owned by a socket. + +Reported-and-tested-by: Ben Menchaca +Signed-off-by: Patrick McHardy +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/ip_output.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -500,8 +500,8 @@ int ip_fragment(struct sk_buff *skb, int + if (skb->sk) { + frag->sk = skb->sk; + frag->destructor = sock_wfree; +- truesizes += frag->truesize; + } ++ truesizes += frag->truesize; + } + + /* Everything is OK. Generate! */ + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:05 2009 +Message-Id: <20091217011604.896113614@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:04 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [53/90] Revert "isdn: isdn_ppp: Use SKB list facilities instead of home-grown implementation." + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + + +From: David S. Miller + +[ Upstream commit e29d4363174949a7a4e46f670993d7ff43342c1c ] + +This reverts commit 38783e671399b5405f1fd177d602c400a9577ae6. + +It causes kernel bugzilla #14594 + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/isdn/i4l/isdn_ppp.c | 348 ++++++++++++++++++++------------------------ + include/linux/isdn_ppp.h | 2 + 2 files changed, 162 insertions(+), 188 deletions(-) + +--- a/drivers/isdn/i4l/isdn_ppp.c ++++ b/drivers/isdn/i4l/isdn_ppp.c +@@ -1535,10 +1535,8 @@ static int isdn_ppp_mp_bundle_array_init + int sz = ISDN_MAX_CHANNELS*sizeof(ippp_bundle); + if( (isdn_ppp_bundle_arr = kzalloc(sz, GFP_KERNEL)) == NULL ) + return -ENOMEM; +- for (i = 0; i < ISDN_MAX_CHANNELS; i++) { ++ for( i = 0; i < ISDN_MAX_CHANNELS; i++ ) + spin_lock_init(&isdn_ppp_bundle_arr[i].lock); +- skb_queue_head_init(&isdn_ppp_bundle_arr[i].frags); +- } + return 0; + } + +@@ -1571,7 +1569,7 @@ static int isdn_ppp_mp_init( isdn_net_lo + if ((lp->netdev->pb = isdn_ppp_mp_bundle_alloc()) == NULL) + return -ENOMEM; + lp->next = lp->last = lp; /* nobody else in a queue */ +- skb_queue_head_init(&lp->netdev->pb->frags); ++ lp->netdev->pb->frags = NULL; + lp->netdev->pb->frames = 0; + lp->netdev->pb->seq = UINT_MAX; + } +@@ -1583,29 +1581,28 @@ static int isdn_ppp_mp_init( isdn_net_lo + + static u32 isdn_ppp_mp_get_seq( int short_seq, + struct sk_buff * skb, u32 last_seq ); +-static void isdn_ppp_mp_discard(ippp_bundle *mp, struct sk_buff *from, +- struct sk_buff *to); +-static void isdn_ppp_mp_reassembly(isdn_net_dev *net_dev, isdn_net_local *lp, +- struct sk_buff *from, struct sk_buff *to, +- u32 lastseq); +-static void isdn_ppp_mp_free_skb(ippp_bundle *mp, struct sk_buff *skb); ++static struct sk_buff * isdn_ppp_mp_discard( ippp_bundle * mp, ++ struct sk_buff * from, struct sk_buff * to ); ++static void isdn_ppp_mp_reassembly( isdn_net_dev * net_dev, isdn_net_local * lp, ++ struct sk_buff * from, struct sk_buff * to ); ++static void isdn_ppp_mp_free_skb( ippp_bundle * mp, struct sk_buff * skb ); + static void isdn_ppp_mp_print_recv_pkt( int slot, struct sk_buff * skb ); + + static void isdn_ppp_mp_receive(isdn_net_dev * net_dev, isdn_net_local * lp, +- struct sk_buff *skb) ++ struct sk_buff *skb) + { +- struct sk_buff *newfrag, *frag, *start, *nextf; +- u32 newseq, minseq, thisseq; +- isdn_mppp_stats *stats; + struct ippp_struct *is; ++ isdn_net_local * lpq; ++ ippp_bundle * mp; ++ isdn_mppp_stats * stats; ++ struct sk_buff * newfrag, * frag, * start, *nextf; ++ u32 newseq, minseq, thisseq; + unsigned long flags; +- isdn_net_local *lpq; +- ippp_bundle *mp; + int slot; + + spin_lock_irqsave(&net_dev->pb->lock, flags); +- mp = net_dev->pb; +- stats = &mp->stats; ++ mp = net_dev->pb; ++ stats = &mp->stats; + slot = lp->ppp_slot; + if (slot < 0 || slot >= ISDN_MAX_CHANNELS) { + printk(KERN_ERR "%s: lp->ppp_slot(%d)\n", +@@ -1616,19 +1613,20 @@ static void isdn_ppp_mp_receive(isdn_net + return; + } + is = ippp_table[slot]; +- if (++mp->frames > stats->max_queue_len) ++ if( ++mp->frames > stats->max_queue_len ) + stats->max_queue_len = mp->frames; +- ++ + if (is->debug & 0x8) + isdn_ppp_mp_print_recv_pkt(lp->ppp_slot, skb); + +- newseq = isdn_ppp_mp_get_seq(is->mpppcfg & SC_IN_SHORT_SEQ, +- skb, is->last_link_seqno); ++ newseq = isdn_ppp_mp_get_seq(is->mpppcfg & SC_IN_SHORT_SEQ, ++ skb, is->last_link_seqno); ++ + + /* if this packet seq # is less than last already processed one, + * toss it right away, but check for sequence start case first + */ +- if (mp->seq > MP_LONGSEQ_MAX && (newseq & MP_LONGSEQ_MAXBIT)) { ++ if( mp->seq > MP_LONGSEQ_MAX && (newseq & MP_LONGSEQ_MAXBIT) ) { + mp->seq = newseq; /* the first packet: required for + * rfc1990 non-compliant clients -- + * prevents constant packet toss */ +@@ -1638,7 +1636,7 @@ static void isdn_ppp_mp_receive(isdn_net + spin_unlock_irqrestore(&mp->lock, flags); + return; + } +- ++ + /* find the minimum received sequence number over all links */ + is->last_link_seqno = minseq = newseq; + for (lpq = net_dev->queue;;) { +@@ -1659,31 +1657,22 @@ static void isdn_ppp_mp_receive(isdn_net + * packets */ + newfrag = skb; + +- /* Insert new fragment into the proper sequence slot. */ +- skb_queue_walk(&mp->frags, frag) { +- if (MP_SEQ(frag) == newseq) { +- isdn_ppp_mp_free_skb(mp, newfrag); +- newfrag = NULL; +- break; +- } +- if (MP_LT(newseq, MP_SEQ(frag))) { +- __skb_queue_before(&mp->frags, frag, newfrag); +- newfrag = NULL; +- break; +- } +- } +- if (newfrag) +- __skb_queue_tail(&mp->frags, newfrag); ++ /* if this new fragment is before the first one, then enqueue it now. */ ++ if ((frag = mp->frags) == NULL || MP_LT(newseq, MP_SEQ(frag))) { ++ newfrag->next = frag; ++ mp->frags = frag = newfrag; ++ newfrag = NULL; ++ } + +- frag = skb_peek(&mp->frags); +- start = ((MP_FLAGS(frag) & MP_BEGIN_FRAG) && +- (MP_SEQ(frag) == mp->seq)) ? frag : NULL; +- if (!start) +- goto check_overflow; ++ start = MP_FLAGS(frag) & MP_BEGIN_FRAG && ++ MP_SEQ(frag) == mp->seq ? frag : NULL; + +- /* main fragment traversing loop ++ /* ++ * main fragment traversing loop + * + * try to accomplish several tasks: ++ * - insert new fragment into the proper sequence slot (once that's done ++ * newfrag will be set to NULL) + * - reassemble any complete fragment sequence (non-null 'start' + * indicates there is a continguous sequence present) + * - discard any incomplete sequences that are below minseq -- due +@@ -1692,46 +1681,71 @@ static void isdn_ppp_mp_receive(isdn_net + * come to complete such sequence and it should be discarded + * + * loop completes when we accomplished the following tasks: ++ * - new fragment is inserted in the proper sequence ('newfrag' is ++ * set to NULL) + * - we hit a gap in the sequence, so no reassembly/processing is + * possible ('start' would be set to NULL) + * + * algorithm for this code is derived from code in the book + * 'PPP Design And Debugging' by James Carlson (Addison-Wesley) + */ +- skb_queue_walk_safe(&mp->frags, frag, nextf) { +- thisseq = MP_SEQ(frag); ++ while (start != NULL || newfrag != NULL) { + +- /* check for misplaced start */ +- if (start != frag && (MP_FLAGS(frag) & MP_BEGIN_FRAG)) { +- printk(KERN_WARNING"isdn_mppp(seq %d): new " +- "BEGIN flag with no prior END", thisseq); +- stats->seqerrs++; +- stats->frame_drops++; +- isdn_ppp_mp_discard(mp, start, frag); +- start = frag; +- } else if (MP_LE(thisseq, minseq)) { +- if (MP_FLAGS(frag) & MP_BEGIN_FRAG) ++ thisseq = MP_SEQ(frag); ++ nextf = frag->next; ++ ++ /* drop any duplicate fragments */ ++ if (newfrag != NULL && thisseq == newseq) { ++ isdn_ppp_mp_free_skb(mp, newfrag); ++ newfrag = NULL; ++ } ++ ++ /* insert new fragment before next element if possible. */ ++ if (newfrag != NULL && (nextf == NULL || ++ MP_LT(newseq, MP_SEQ(nextf)))) { ++ newfrag->next = nextf; ++ frag->next = nextf = newfrag; ++ newfrag = NULL; ++ } ++ ++ if (start != NULL) { ++ /* check for misplaced start */ ++ if (start != frag && (MP_FLAGS(frag) & MP_BEGIN_FRAG)) { ++ printk(KERN_WARNING"isdn_mppp(seq %d): new " ++ "BEGIN flag with no prior END", thisseq); ++ stats->seqerrs++; ++ stats->frame_drops++; ++ start = isdn_ppp_mp_discard(mp, start,frag); ++ nextf = frag->next; ++ } ++ } else if (MP_LE(thisseq, minseq)) { ++ if (MP_FLAGS(frag) & MP_BEGIN_FRAG) + start = frag; +- else { ++ else { + if (MP_FLAGS(frag) & MP_END_FRAG) +- stats->frame_drops++; +- __skb_unlink(skb, &mp->frags); ++ stats->frame_drops++; ++ if( mp->frags == frag ) ++ mp->frags = nextf; + isdn_ppp_mp_free_skb(mp, frag); ++ frag = nextf; + continue; +- } ++ } + } +- +- /* if we have end fragment, then we have full reassembly +- * sequence -- reassemble and process packet now ++ ++ /* if start is non-null and we have end fragment, then ++ * we have full reassembly sequence -- reassemble ++ * and process packet now + */ +- if (MP_FLAGS(frag) & MP_END_FRAG) { +- minseq = mp->seq = (thisseq+1) & MP_LONGSEQ_MASK; +- /* Reassemble the packet then dispatch it */ +- isdn_ppp_mp_reassembly(net_dev, lp, start, frag, thisseq); ++ if (start != NULL && (MP_FLAGS(frag) & MP_END_FRAG)) { ++ minseq = mp->seq = (thisseq+1) & MP_LONGSEQ_MASK; ++ /* Reassemble the packet then dispatch it */ ++ isdn_ppp_mp_reassembly(net_dev, lp, start, nextf); ++ ++ start = NULL; ++ frag = NULL; + +- start = NULL; +- frag = NULL; +- } ++ mp->frags = nextf; ++ } + + /* check if need to update start pointer: if we just + * reassembled the packet and sequence is contiguous +@@ -1742,25 +1756,26 @@ static void isdn_ppp_mp_receive(isdn_net + * below low watermark and set start to the next frag or + * clear start ptr. + */ +- if (nextf != (struct sk_buff *)&mp->frags && ++ if (nextf != NULL && + ((thisseq+1) & MP_LONGSEQ_MASK) == MP_SEQ(nextf)) { +- /* if we just reassembled and the next one is here, +- * then start another reassembly. +- */ +- if (frag == NULL) { ++ /* if we just reassembled and the next one is here, ++ * then start another reassembly. */ ++ ++ if (frag == NULL) { + if (MP_FLAGS(nextf) & MP_BEGIN_FRAG) +- start = nextf; +- else { +- printk(KERN_WARNING"isdn_mppp(seq %d):" +- " END flag with no following " +- "BEGIN", thisseq); ++ start = nextf; ++ else ++ { ++ printk(KERN_WARNING"isdn_mppp(seq %d):" ++ " END flag with no following " ++ "BEGIN", thisseq); + stats->seqerrs++; + } + } +- } else { +- if (nextf != (struct sk_buff *)&mp->frags && +- frag != NULL && +- MP_LT(thisseq, minseq)) { ++ ++ } else { ++ if ( nextf != NULL && frag != NULL && ++ MP_LT(thisseq, minseq)) { + /* we've got a break in the sequence + * and we not at the end yet + * and we did not just reassembled +@@ -1769,39 +1784,41 @@ static void isdn_ppp_mp_receive(isdn_net + * discard all the frames below low watermark + * and start over */ + stats->frame_drops++; +- isdn_ppp_mp_discard(mp, start, nextf); ++ mp->frags = isdn_ppp_mp_discard(mp,start,nextf); + } + /* break in the sequence, no reassembly */ +- start = NULL; +- } +- if (!start) +- break; +- } +- +-check_overflow: ++ start = NULL; ++ } ++ ++ frag = nextf; ++ } /* while -- main loop */ ++ ++ if (mp->frags == NULL) ++ mp->frags = frag; ++ + /* rather straighforward way to deal with (not very) possible +- * queue overflow +- */ ++ * queue overflow */ + if (mp->frames > MP_MAX_QUEUE_LEN) { + stats->overflows++; +- skb_queue_walk_safe(&mp->frags, frag, nextf) { +- if (mp->frames <= MP_MAX_QUEUE_LEN) +- break; +- __skb_unlink(frag, &mp->frags); +- isdn_ppp_mp_free_skb(mp, frag); ++ while (mp->frames > MP_MAX_QUEUE_LEN) { ++ frag = mp->frags->next; ++ isdn_ppp_mp_free_skb(mp, mp->frags); ++ mp->frags = frag; + } + } + spin_unlock_irqrestore(&mp->lock, flags); + } + +-static void isdn_ppp_mp_cleanup(isdn_net_local *lp) ++static void isdn_ppp_mp_cleanup( isdn_net_local * lp ) + { +- struct sk_buff *skb, *tmp; +- +- skb_queue_walk_safe(&lp->netdev->pb->frags, skb, tmp) { +- __skb_unlink(skb, &lp->netdev->pb->frags); +- isdn_ppp_mp_free_skb(lp->netdev->pb, skb); ++ struct sk_buff * frag = lp->netdev->pb->frags; ++ struct sk_buff * nextfrag; ++ while( frag ) { ++ nextfrag = frag->next; ++ isdn_ppp_mp_free_skb(lp->netdev->pb, frag); ++ frag = nextfrag; + } ++ lp->netdev->pb->frags = NULL; + } + + static u32 isdn_ppp_mp_get_seq( int short_seq, +@@ -1838,115 +1855,72 @@ static u32 isdn_ppp_mp_get_seq( int shor + return seq; + } + +-static void isdn_ppp_mp_discard(ippp_bundle *mp, struct sk_buff *from, +- struct sk_buff *to) ++struct sk_buff * isdn_ppp_mp_discard( ippp_bundle * mp, ++ struct sk_buff * from, struct sk_buff * to ) + { +- if (from) { +- struct sk_buff *skb, *tmp; +- int freeing = 0; +- +- skb_queue_walk_safe(&mp->frags, skb, tmp) { +- if (skb == to) +- break; +- if (skb == from) +- freeing = 1; +- if (!freeing) +- continue; +- __skb_unlink(skb, &mp->frags); +- isdn_ppp_mp_free_skb(mp, skb); ++ if( from ) ++ while (from != to) { ++ struct sk_buff * next = from->next; ++ isdn_ppp_mp_free_skb(mp, from); ++ from = next; + } +- } ++ return from; + } + +-static unsigned int calc_tot_len(struct sk_buff_head *queue, +- struct sk_buff *from, struct sk_buff *to) +-{ +- unsigned int tot_len = 0; +- struct sk_buff *skb; +- int found_start = 0; +- +- skb_queue_walk(queue, skb) { +- if (skb == from) +- found_start = 1; +- if (!found_start) +- continue; +- tot_len += skb->len - MP_HEADER_LEN; +- if (skb == to) +- break; +- } +- return tot_len; +-} +- +-/* Reassemble packet using fragments in the reassembly queue from +- * 'from' until 'to', inclusive. +- */ +-static void isdn_ppp_mp_reassembly(isdn_net_dev *net_dev, isdn_net_local *lp, +- struct sk_buff *from, struct sk_buff *to, +- u32 lastseq) ++void isdn_ppp_mp_reassembly( isdn_net_dev * net_dev, isdn_net_local * lp, ++ struct sk_buff * from, struct sk_buff * to ) + { +- ippp_bundle *mp = net_dev->pb; +- unsigned int tot_len; +- struct sk_buff *skb; ++ ippp_bundle * mp = net_dev->pb; + int proto; ++ struct sk_buff * skb; ++ unsigned int tot_len; + + if (lp->ppp_slot < 0 || lp->ppp_slot >= ISDN_MAX_CHANNELS) { + printk(KERN_ERR "%s: lp->ppp_slot(%d) out of range\n", + __func__, lp->ppp_slot); + return; + } +- +- tot_len = calc_tot_len(&mp->frags, from, to); +- +- if (MP_FLAGS(from) == (MP_BEGIN_FRAG | MP_END_FRAG)) { +- if (ippp_table[lp->ppp_slot]->debug & 0x40) ++ if( MP_FLAGS(from) == (MP_BEGIN_FRAG | MP_END_FRAG) ) { ++ if( ippp_table[lp->ppp_slot]->debug & 0x40 ) + printk(KERN_DEBUG "isdn_mppp: reassembly: frame %d, " +- "len %d\n", MP_SEQ(from), from->len); ++ "len %d\n", MP_SEQ(from), from->len ); + skb = from; + skb_pull(skb, MP_HEADER_LEN); +- __skb_unlink(skb, &mp->frags); + mp->frames--; + } else { +- struct sk_buff *walk, *tmp; +- int found_start = 0; ++ struct sk_buff * frag; ++ int n; + +- if (ippp_table[lp->ppp_slot]->debug & 0x40) +- printk(KERN_DEBUG"isdn_mppp: reassembling frames %d " +- "to %d, len %d\n", MP_SEQ(from), lastseq, +- tot_len); ++ for(tot_len=n=0, frag=from; frag != to; frag=frag->next, n++) ++ tot_len += frag->len - MP_HEADER_LEN; + +- skb = dev_alloc_skb(tot_len); +- if (!skb) ++ if( ippp_table[lp->ppp_slot]->debug & 0x40 ) ++ printk(KERN_DEBUG"isdn_mppp: reassembling frames %d " ++ "to %d, len %d\n", MP_SEQ(from), ++ (MP_SEQ(from)+n-1) & MP_LONGSEQ_MASK, tot_len ); ++ if( (skb = dev_alloc_skb(tot_len)) == NULL ) { + printk(KERN_ERR "isdn_mppp: cannot allocate sk buff " +- "of size %d\n", tot_len); +- +- found_start = 0; +- skb_queue_walk_safe(&mp->frags, walk, tmp) { +- if (walk == from) +- found_start = 1; +- if (!found_start) +- continue; ++ "of size %d\n", tot_len); ++ isdn_ppp_mp_discard(mp, from, to); ++ return; ++ } + +- if (skb) { +- unsigned int len = walk->len - MP_HEADER_LEN; +- skb_copy_from_linear_data_offset(walk, MP_HEADER_LEN, +- skb_put(skb, len), +- len); +- } +- __skb_unlink(walk, &mp->frags); +- isdn_ppp_mp_free_skb(mp, walk); ++ while( from != to ) { ++ unsigned int len = from->len - MP_HEADER_LEN; + +- if (walk == to) +- break; ++ skb_copy_from_linear_data_offset(from, MP_HEADER_LEN, ++ skb_put(skb,len), ++ len); ++ frag = from->next; ++ isdn_ppp_mp_free_skb(mp, from); ++ from = frag; + } + } +- if (!skb) +- return; +- + proto = isdn_ppp_strip_proto(skb); + isdn_ppp_push_higher(net_dev, lp, skb, proto); + } + +-static void isdn_ppp_mp_free_skb(ippp_bundle *mp, struct sk_buff *skb) ++static void isdn_ppp_mp_free_skb(ippp_bundle * mp, struct sk_buff * skb) + { + dev_kfree_skb(skb); + mp->frames--; +--- a/include/linux/isdn_ppp.h ++++ b/include/linux/isdn_ppp.h +@@ -157,7 +157,7 @@ typedef struct { + + typedef struct { + int mp_mrru; /* unused */ +- struct sk_buff_head frags; /* fragments sl list */ ++ struct sk_buff * frags; /* fragments sl list -- use skb->next */ + long frames; /* number of frames in the frame list */ + unsigned int seq; /* last processed packet seq #: any packets + * with smaller seq # will be dropped + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:05 2009 +Message-Id: <20091217011605.019497617@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:05 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jarek Poplawski , + Eric Dumazet , + "David S. Miller" +Subject: [54/90] net: Fix the rollback test in dev_change_name() + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + + +From: Eric Dumazet + +[ Upstream commit 91e9c07bd635353d1a278bdb38dbb56ac371bcb8 ] + +net: Fix the rollback test in dev_change_name() + +In dev_change_name() an err variable is used for storing the original +call_netdevice_notifiers() errno (negative) and testing for a rollback +error later, but the test for non-zero is wrong, because the err might +have positive value as well - from dev_alloc_name(). It means the +rollback for a netdevice with a number > 0 will never happen. (The err +test is reordered btw. to make it more readable.) + +Signed-off-by: Jarek Poplawski +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/core/dev.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -933,14 +933,15 @@ rollback: + ret = notifier_to_errno(ret); + + if (ret) { +- if (err) { +- printk(KERN_ERR +- "%s: name change rollback failed: %d.\n", +- dev->name, ret); +- } else { ++ /* err >= 0 after dev_alloc_name() or stores the first errno */ ++ if (err >= 0) { + err = ret; + memcpy(dev->name, oldname, IFNAMSIZ); + goto rollback; ++ } else { ++ printk(KERN_ERR ++ "%s: name change rollback failed: %d.\n", ++ dev->name, ret); + } + } + + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:05 2009 +Message-Id: <20091217011605.149734203@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:06 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Russell King , + Eric Miao , + "David S. Miller" +Subject: [55/90] NET: smc91x: Fix irq flags + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + + +From: Russell King - ARM Linux + +[ Upstream commit d5ccd67bb77ced5249067d05171992a7d5020393 ] + +smc91x.h defines SMC_IRQ_FLAGS to be -1 when it wants the interrupt +flags to be taken from the resource structure. However, d280ead +changed this to checking for non-zero resource flags. + +Unfortunately, this means that on some platforms, we end up passing +'-1' to request_irq rather than the desired result. Combine the two +conditions into one so that the IRQ flags are taken from the resource +if either SMC_IRQ_FLAGS is -1 or the resource flags specify an +interrupt trigger. + +This restores network on at least the Versatile platform. + +Signed-off-by: Russell King +Acked-by: Eric Miao +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/smc91x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/smc91x.c ++++ b/drivers/net/smc91x.c +@@ -2283,7 +2283,7 @@ static int __devinit smc_drv_probe(struc + + ndev->irq = ires->start; + +- if (ires->flags & IRQF_TRIGGER_MASK) ++ if (irq_flags == -1 || ires->flags & IRQF_TRIGGER_MASK) + irq_flags = ires->flags & IRQF_TRIGGER_MASK; + + ret = smc_request_attrib(pdev, ndev); + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:05 2009 +Message-Id: <20091217011605.286045484@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:07 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Steve Glendinning , + "David S. Miller" +Subject: [56/90] smsc9420: prevent BUG() if ethtool is called with interface down + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + + +From: Steve Glendinning + +[ Upstream commit 6c53b1b15e222244358d3cbbefd2a13920faa352 ] + +This patch fixes a null pointer dereference BUG() if ethtool is used on +an smsc9420 interface while it is down, because the phy_dev is only +allocated while the interface is up. + +Signed-off-by: Steve Glendinning +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/smsc9420.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/drivers/net/smsc9420.c ++++ b/drivers/net/smsc9420.c +@@ -252,6 +252,9 @@ static int smsc9420_ethtool_get_settings + { + struct smsc9420_pdata *pd = netdev_priv(dev); + ++ if (!pd->phy_dev) ++ return -ENODEV; ++ + cmd->maxtxpkt = 1; + cmd->maxrxpkt = 1; + return phy_ethtool_gset(pd->phy_dev, cmd); +@@ -262,6 +265,9 @@ static int smsc9420_ethtool_set_settings + { + struct smsc9420_pdata *pd = netdev_priv(dev); + ++ if (!pd->phy_dev) ++ return -ENODEV; ++ + return phy_ethtool_sset(pd->phy_dev, cmd); + } + +@@ -290,6 +296,10 @@ static void smsc9420_ethtool_set_msgleve + static int smsc9420_ethtool_nway_reset(struct net_device *netdev) + { + struct smsc9420_pdata *pd = netdev_priv(netdev); ++ ++ if (!pd->phy_dev) ++ return -ENODEV; ++ + return phy_start_aneg(pd->phy_dev); + } + +@@ -312,6 +322,10 @@ smsc9420_ethtool_getregs(struct net_devi + for (i = 0; i < 0x100; i += (sizeof(u32))) + data[j++] = smsc9420_reg_read(pd, i); + ++ // cannot read phy registers if the net device is down ++ if (!phy_dev) ++ return; ++ + for (i = 0; i <= 31; i++) + data[j++] = smsc9420_mii_read(phy_dev->bus, phy_dev->addr, i); + } + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:05 2009 +Message-Id: <20091217011605.421274510@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:08 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eric Dumazet , + "David S. Miller" +Subject: [57/90] vlan: Fix register_vlan_dev() error path + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + + +From: Eric Dumazet + +[ Upstream commit 6b863d1d3239eff0f45c2e6e672f5b56db828db0 ] + +In case register_netdevice() returns an error, and a new vlan_group +was allocated and inserted in vlan_group_hash[] we call +vlan_group_free() without deleting group from hash table. Future +lookups can give infinite loops or crashes. + +We must delete the vlan_group using RCU safe procedure. + +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/8021q/vlan.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/net/8021q/vlan.c ++++ b/net/8021q/vlan.c +@@ -287,8 +287,11 @@ out_uninit_applicant: + if (ngrp) + vlan_gvrp_uninit_applicant(real_dev); + out_free_group: +- if (ngrp) +- vlan_group_free(ngrp); ++ if (ngrp) { ++ hlist_del_rcu(&ngrp->hlist); ++ /* Free the group, after all cpu's are done. */ ++ call_rcu(&ngrp->rcu, vlan_rcu_free); ++ } + return err; + } + + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:05 2009 +Message-Id: <20091217011605.553623715@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:09 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [58/90] sparc64: Fix definition of VMEMMAP_SIZE. + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + + +From: David S. Miller + +[ Upstream commit bffbc94a4d2c1769c3826fceddd2dbb75e72c80b ] + +This was the cause of various boot failures on V480, V880, etc. +systems. + +Kernel image memory was being overwritten because the vmemmap[] +array was being sized to small. So if you had physical memory +addresses past a certain point, the early bootup would spam +all over variables in the kernel data section. + +The vmemmap mappings map page structs, not page struct pointers. +And that was the key thinko in the macro definition. + +This was fixable thanks to the help, reports, and tireless patience +of Hermann Lauer. + +Reported-by: Hermann Lauer +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/mm/init_64.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/sparc/mm/init_64.h ++++ b/arch/sparc/mm/init_64.h +@@ -45,7 +45,7 @@ extern void free_initmem(void); + #define VMEMMAP_ALIGN(x) (((x)+VMEMMAP_CHUNK-1UL)&VMEMMAP_CHUNK_MASK) + + #define VMEMMAP_SIZE ((((1UL << MAX_PHYSADDR_BITS) >> PAGE_SHIFT) * \ +- sizeof(struct page *)) >> VMEMMAP_CHUNK_SHIFT) ++ sizeof(struct page)) >> VMEMMAP_CHUNK_SHIFT) + extern unsigned long vmemmap_table[VMEMMAP_SIZE]; + #endif + + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:05 2009 +Message-Id: <20091217011605.681672604@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:10 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [59/90] sunsab: Do not set sunsab_reg.cons right before registering minors. + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + + +From: David S. Miller + +[ Upstream commit 4e68e188411ea98e40309700cf0c89ad4469ac1d ] + +Other Sun serial drivers do not do this, and if we keep it this way +it ends up registering all serial devices as consoles rather than +just the one which we explicitly register via sunserial_console_match() +which uses add_preferred_console(). + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/serial/sunsab.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/serial/sunsab.c ++++ b/drivers/serial/sunsab.c +@@ -1116,7 +1116,6 @@ static int __init sunsab_init(void) + if (!sunsab_ports) + return -ENOMEM; + +- sunsab_reg.cons = SUNSAB_CONSOLE(); + err = sunserial_register_minors(&sunsab_reg, num_channels); + if (err) { + kfree(sunsab_ports); + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:05 2009 +Message-Id: <20091217011605.824429156@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:11 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [60/90] sunsu: Fix detection of SU ports which are RSC console or control. + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + + +From: David S. Miller + +[ Upstream commit 8301d386afc55c877bafe2c6c7dc75a96ddd2838 ] + +These device nodes are named "rsc-console" and "rsc-control" rather +than 'serial', but the device_type property is 'serial' so we'll +tip off of that for detection. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/serial/sunsu.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/serial/sunsu.c ++++ b/drivers/serial/sunsu.c +@@ -1517,6 +1517,10 @@ static const struct of_device_id su_matc + .name = "serial", + .compatible = "su", + }, ++ { ++ .type = "serial", ++ .compatible = "su", ++ }, + {}, + }; + MODULE_DEVICE_TABLE(of, su_match); +@@ -1548,6 +1552,12 @@ static int __init sunsu_init(void) + num_uart++; + } + } ++ for_each_node_by_type(dp, "serial") { ++ if (of_device_is_compatible(dp, "su")) { ++ if (su_get_type(dp) == SU_PORT_PORT) ++ num_uart++; ++ } ++ } + + if (num_uart) { + err = sunserial_register_minors(&sunsu_reg, num_uart); + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:06 2009 +Message-Id: <20091217011605.938263178@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:12 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [61/90] serial: suncore: Add ignore_line argument to sunserial_console_match(). + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + + +From: David S. Miller + +[ Upstream commit 4e3533d05b6e5e66d1cda27f6671251c99c62894 ] + +This tells the logic to ignore the line match when deciding whether the +device is the OpenFirmware specified console device or not. + +This is going to be used in the SU driver for rsc-console detection. + +There is probably a better way to handle this, but this is the least +intrusive solution for now which we can validate won't break any other +cases. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/serial/suncore.c | 19 ++++++++++--------- + drivers/serial/suncore.h | 2 +- + drivers/serial/sunsab.c | 6 ++++-- + drivers/serial/sunsu.c | 3 ++- + drivers/serial/sunzilog.c | 6 ++++-- + 5 files changed, 21 insertions(+), 15 deletions(-) + +--- a/drivers/serial/suncore.c ++++ b/drivers/serial/suncore.c +@@ -53,20 +53,21 @@ void sunserial_unregister_minors(struct + EXPORT_SYMBOL(sunserial_unregister_minors); + + int sunserial_console_match(struct console *con, struct device_node *dp, +- struct uart_driver *drv, int line) ++ struct uart_driver *drv, int line, bool ignore_line) + { +- int off; +- + if (!con || of_console_device != dp) + return 0; + +- off = 0; +- if (of_console_options && +- *of_console_options == 'b') +- off = 1; ++ if (!ignore_line) { ++ int off = 0; + +- if ((line & 1) != off) +- return 0; ++ if (of_console_options && ++ *of_console_options == 'b') ++ off = 1; ++ ++ if ((line & 1) != off) ++ return 0; ++ } + + con->index = line; + drv->cons = con; +--- a/drivers/serial/suncore.h ++++ b/drivers/serial/suncore.h +@@ -26,7 +26,7 @@ extern int sunserial_register_minors(str + extern void sunserial_unregister_minors(struct uart_driver *, int); + + extern int sunserial_console_match(struct console *, struct device_node *, +- struct uart_driver *, int); ++ struct uart_driver *, int, bool); + extern void sunserial_console_termios(struct console *); + + #endif /* !(_SERIAL_SUN_H) */ +--- a/drivers/serial/sunsab.c ++++ b/drivers/serial/sunsab.c +@@ -1027,10 +1027,12 @@ static int __devinit sab_probe(struct of + goto out1; + + sunserial_console_match(SUNSAB_CONSOLE(), op->node, +- &sunsab_reg, up[0].port.line); ++ &sunsab_reg, up[0].port.line, ++ false); + + sunserial_console_match(SUNSAB_CONSOLE(), op->node, +- &sunsab_reg, up[1].port.line); ++ &sunsab_reg, up[1].port.line, ++ false); + + err = uart_add_one_port(&sunsab_reg, &up[0].port); + if (err) +--- a/drivers/serial/sunsu.c ++++ b/drivers/serial/sunsu.c +@@ -1468,7 +1468,8 @@ static int __devinit su_probe(struct of_ + up->port.ops = &sunsu_pops; + + sunserial_console_match(SUNSU_CONSOLE(), dp, +- &sunsu_reg, up->port.line); ++ &sunsu_reg, up->port.line, ++ false); + err = uart_add_one_port(&sunsu_reg, &up->port); + if (err) + goto out_unmap; +--- a/drivers/serial/sunzilog.c ++++ b/drivers/serial/sunzilog.c +@@ -1416,7 +1416,8 @@ static int __devinit zs_probe(struct of_ + + if (!keyboard_mouse) { + if (sunserial_console_match(SUNZILOG_CONSOLE(), op->node, +- &sunzilog_reg, up[0].port.line)) ++ &sunzilog_reg, up[0].port.line, ++ false)) + up->flags |= SUNZILOG_FLAG_IS_CONS; + err = uart_add_one_port(&sunzilog_reg, &up[0].port); + if (err) { +@@ -1425,7 +1426,8 @@ static int __devinit zs_probe(struct of_ + return err; + } + if (sunserial_console_match(SUNZILOG_CONSOLE(), op->node, +- &sunzilog_reg, up[1].port.line)) ++ &sunzilog_reg, up[1].port.line, ++ false)) + up->flags |= SUNZILOG_FLAG_IS_CONS; + err = uart_add_one_port(&sunzilog_reg, &up[1].port); + if (err) { + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:06 2009 +Message-Id: <20091217011606.083503274@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:13 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [62/90] serial: suncore: Fix RSC/LOM handling in sunserial_console_termios(). + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + + +From: David S. Miller + +[ Upstream commit 457931de3b0925dc2eb941bc7d611a509be36dff ] + +RSC and LOM devices have fixed speed settings. + +We already had some code to match and handle "rsc" named devices on +E250 systems, but we also have to handle 'rsc-console', 'rsc-control', +and 'lom-console'. + +Also, in order to get this right regardless of what 'output-device' +happens to be, explicitly pass the UART device node pointer to this +routine. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/serial/suncore.c | 18 ++++++++++-------- + drivers/serial/suncore.h | 3 ++- + drivers/serial/sunhv.c | 2 +- + drivers/serial/sunsab.c | 2 +- + drivers/serial/sunzilog.c | 2 +- + 5 files changed, 15 insertions(+), 12 deletions(-) + +--- a/drivers/serial/suncore.c ++++ b/drivers/serial/suncore.c +@@ -77,23 +77,24 @@ int sunserial_console_match(struct conso + } + EXPORT_SYMBOL(sunserial_console_match); + +-void +-sunserial_console_termios(struct console *con) ++void sunserial_console_termios(struct console *con, struct device_node *uart_dp) + { +- struct device_node *dp; +- const char *od, *mode, *s; ++ const char *mode, *s; + char mode_prop[] = "ttyX-mode"; + int baud, bits, stop, cflag; + char parity; + +- dp = of_find_node_by_path("/options"); +- od = of_get_property(dp, "output-device", NULL); +- if (!strcmp(od, "rsc")) { +- mode = of_get_property(of_console_device, ++ if (!strcmp(uart_dp->name, "rsc") || ++ !strcmp(uart_dp->name, "rsc-console") || ++ !strcmp(uart_dp->name, "rsc-control")) { ++ mode = of_get_property(uart_dp, + "ssp-console-modes", NULL); + if (!mode) + mode = "115200,8,n,1,-"; ++ } else if (!strcmp(uart_dp->name, "lom-console")) { ++ mode = "9600,8,n,1,-"; + } else { ++ struct device_node *dp; + char c; + + c = 'a'; +@@ -102,6 +103,7 @@ sunserial_console_termios(struct console + + mode_prop[3] = c; + ++ dp = of_find_node_by_path("/options"); + mode = of_get_property(dp, mode_prop, NULL); + if (!mode) + mode = "9600,8,n,1,-"; +--- a/drivers/serial/suncore.h ++++ b/drivers/serial/suncore.h +@@ -27,6 +27,7 @@ extern void sunserial_unregister_minors( + + extern int sunserial_console_match(struct console *, struct device_node *, + struct uart_driver *, int, bool); +-extern void sunserial_console_termios(struct console *); ++extern void sunserial_console_termios(struct console *, ++ struct device_node *); + + #endif /* !(_SERIAL_SUN_H) */ +--- a/drivers/serial/sunhv.c ++++ b/drivers/serial/sunhv.c +@@ -566,7 +566,7 @@ static int __devinit hv_probe(struct of_ + goto out_free_con_read_page; + + sunserial_console_match(&sunhv_console, op->node, +- &sunhv_reg, port->line); ++ &sunhv_reg, port->line, false); + + err = uart_add_one_port(&sunhv_reg, port); + if (err) +--- a/drivers/serial/sunsab.c ++++ b/drivers/serial/sunsab.c +@@ -883,7 +883,7 @@ static int sunsab_console_setup(struct c + printk("Console: ttyS%d (SAB82532)\n", + (sunsab_reg.minor - 64) + con->index); + +- sunserial_console_termios(con); ++ sunserial_console_termios(con, to_of_device(up->port.dev)->node); + + switch (con->cflag & CBAUD) { + case B150: baud = 150; break; +--- a/drivers/serial/sunzilog.c ++++ b/drivers/serial/sunzilog.c +@@ -1180,7 +1180,7 @@ static int __init sunzilog_console_setup + (sunzilog_reg.minor - 64) + con->index, con->index); + + /* Get firmware console settings. */ +- sunserial_console_termios(con); ++ sunserial_console_termios(con, to_of_device(up->port.dev)->node); + + /* Firmware console speed is limited to 150-->38400 baud so + * this hackish cflag thing is OK. + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:06 2009 +Message-Id: <20091217011606.209811936@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:14 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [63/90] sunsu: Pass true ignore_line to console match when RSC or LOM console. + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + + +From: David S. Miller + +[ Upstream commit 1917d17b903955b8b2903626a2e01d071a5d0ec9 ] + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/serial/sunsu.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/serial/sunsu.c ++++ b/drivers/serial/sunsu.c +@@ -1409,6 +1409,7 @@ static int __devinit su_probe(struct of_ + struct uart_sunsu_port *up; + struct resource *rp; + enum su_type type; ++ bool ignore_line; + int err; + + type = su_get_type(dp); +@@ -1467,9 +1468,14 @@ static int __devinit su_probe(struct of_ + + up->port.ops = &sunsu_pops; + ++ ignore_line = false; ++ if (!strcmp(dp->name, "rsc-console") || ++ !strcmp(dp->name, "lom-console")) ++ ignore_line = true; ++ + sunserial_console_match(SUNSU_CONSOLE(), dp, + &sunsu_reg, up->port.line, +- false); ++ ignore_line); + err = uart_add_one_port(&sunsu_reg, &up->port); + if (err) + goto out_unmap; + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:06 2009 +Message-Id: <20091217011606.338794179@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:15 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [64/90] sunsu: Use sunserial_console_termios() in sunsu_console_setup(). + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + + +From: David S. Miller + +[ Upstream commit be24656a5e2d68bfd0744f0742c4aceef2cf44b5 ] + +Be like the other Sun serial drivers otherwise the special handling of +OpenFirmware options and hard-coded overrides for LOM/RSC consoles +will not be handled. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/serial/sunsu.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +--- a/drivers/serial/sunsu.c ++++ b/drivers/serial/sunsu.c +@@ -1329,11 +1329,9 @@ static void sunsu_console_write(struct c + */ + static int __init sunsu_console_setup(struct console *co, char *options) + { ++ static struct ktermios dummy; ++ struct ktermios termios; + struct uart_port *port; +- int baud = 9600; +- int bits = 8; +- int parity = 'n'; +- int flow = 'n'; + + printk("Console: ttyS%d (SU)\n", + (sunsu_reg.minor - 64) + co->index); +@@ -1352,10 +1350,15 @@ static int __init sunsu_console_setup(st + */ + spin_lock_init(&port->lock); + +- if (options) +- uart_parse_options(options, &baud, &parity, &bits, &flow); ++ /* Get firmware console settings. */ ++ sunserial_console_termios(co, to_of_device(port->dev)->node); + +- return uart_set_options(port, co, baud, parity, bits, flow); ++ memset(&termios, 0, sizeof(struct ktermios)); ++ termios.c_cflag = co->cflag; ++ port->mctrl |= TIOCM_DTR; ++ port->ops->set_termios(port, &termios, &dummy); ++ ++ return 0; + } + + static struct console sunsu_console = { + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:06 2009 +Message-Id: <20091217011606.474016081@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:16 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [65/90] sparc64: Dont specify IRQF_SHARED for LDC interrupts. + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + + +From: David S. Miller + +[ Upstream commit 08a036d583409e3517e3d15b7478d029b25f2cf2 ] + +IRQF_SHARED and IRQF_DISABLED don't mix. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/kernel/ldc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/sparc/kernel/ldc.c ++++ b/arch/sparc/kernel/ldc.c +@@ -1242,13 +1242,13 @@ int ldc_bind(struct ldc_channel *lp, con + snprintf(lp->tx_irq_name, LDC_IRQ_NAME_MAX, "%s TX", name); + + err = request_irq(lp->cfg.rx_irq, ldc_rx, +- IRQF_SAMPLE_RANDOM | IRQF_DISABLED | IRQF_SHARED, ++ IRQF_SAMPLE_RANDOM | IRQF_DISABLED, + lp->rx_irq_name, lp); + if (err) + return err; + + err = request_irq(lp->cfg.tx_irq, ldc_tx, +- IRQF_SAMPLE_RANDOM | IRQF_DISABLED | IRQF_SHARED, ++ IRQF_SAMPLE_RANDOM | IRQF_DISABLED, + lp->tx_irq_name, lp); + if (err) { + free_irq(lp->cfg.rx_irq, lp); + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:06 2009 +Message-Id: <20091217011606.605472719@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:17 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [66/90] sparc64: Fix overly strict range type matching for PCI devices. + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + + +From: David S. Miller + +[ Upstream commit 4230fa3b89ea1c413766bd411a8315a3d05aa6c7 ] + +When we are trying to see if a range property entry applies +to a given address, we are overly strict about the type. + +We should only allow I/O ranges for I/O addresses, and only allow +CONFIG space ranges for CONFIG space address. + +However for MEM ranges, they come in 32-bit and 64-bit flavors. +And a lack of an exact match is OK if the range is 32-bit and +the address is 64-bit. We can assign a 64-bit address properly +into a 32-bit parent range just fine. + +So allow it. + +Reported-by: Patrick Finnegan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/kernel/of_device_64.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/arch/sparc/kernel/of_device_64.c ++++ b/arch/sparc/kernel/of_device_64.c +@@ -104,9 +104,19 @@ static int of_bus_pci_map(u32 *addr, con + int i; + + /* Check address type match */ +- if ((addr[0] ^ range[0]) & 0x03000000) +- return -EINVAL; ++ if (!((addr[0] ^ range[0]) & 0x03000000)) ++ goto type_match; ++ ++ /* Special exception, we can map a 64-bit address into ++ * a 32-bit range. ++ */ ++ if ((addr[0] & 0x03000000) == 0x03000000 && ++ (range[0] & 0x03000000) == 0x02000000) ++ goto type_match; ++ ++ return -EINVAL; + ++type_match: + if (of_out_of_range(addr + 1, range + 1, range + na + pna, + na - 1, ns)) + return -EINVAL; + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:06 2009 +Message-Id: <20091217011606.755651686@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:18 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [67/90] sparc64: Fix stack debugging IRQ stack regression. + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + + +From: David S. Miller + +[ Upstream commit 166e553a575f09485f6d0df8a1ef3c5991f7d953 ] + +Commit 4f70f7a91bffdcc39f088748dc678953eb9a3fbd +(sparc64: Implement IRQ stacks.) has two bugs. + +First, the softirq range check forgets to subtract STACK_BIAS +before comparing with %sp. Next, on failure the wrong label +is jumped to, resulting in a bogus stack being loaded. + +Reported-by: Igor Kovalenko +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/lib/mcount.S | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/arch/sparc/lib/mcount.S ++++ b/arch/sparc/lib/mcount.S +@@ -64,8 +64,9 @@ mcount: + 2: sethi %hi(softirq_stack), %g3 + or %g3, %lo(softirq_stack), %g3 + ldx [%g3 + %g1], %g7 ++ sub %g7, STACK_BIAS, %g7 + cmp %sp, %g7 +- bleu,pt %xcc, 2f ++ bleu,pt %xcc, 3f + sethi %hi(THREAD_SIZE), %g3 + add %g7, %g3, %g7 + cmp %sp, %g7 +@@ -75,7 +76,7 @@ mcount: + * again, we are already trying to output the stack overflow + * message. + */ +- sethi %hi(ovstack), %g7 ! cant move to panic stack fast enough ++3: sethi %hi(ovstack), %g7 ! cant move to panic stack fast enough + or %g7, %lo(ovstack), %g7 + add %g7, OVSTACKSIZE, %g3 + sub %g3, STACK_BIAS + 192, %g3 + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:06 2009 +Message-Id: <20091217011606.867357237@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:19 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [68/90] sparc: Set UTS_MACHINE correctly. + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + + +From: David S. Miller + +[ Upstream commit 7f5620a5fcd658f219e85831d3691908f1eccbde ] + +"ARCH" can be just about anything, so we shouldn't end up +with UTS_MACHINE of "sparc" in a 64-bit kernel build just +because someone set the personality using 'sparc32' or +similar. CONFIG_SPARC64 drives the compilation and +therefore provides the definitive value, not "ARCH". + +This mirrors commit 8c6531f7a99f29ba8817ffb12cc9ecf190049bd6 +(x86: correctly set UTS_MACHINE for "make ARCH=x86") + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/Makefile | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/sparc/Makefile ++++ b/arch/sparc/Makefile +@@ -27,6 +27,7 @@ AS := $(AS) -32 + LDFLAGS := -m elf32_sparc + CHECKFLAGS += -D__sparc__ + export BITS := 32 ++UTS_MACHINE := sparc + + #KBUILD_CFLAGS += -g -pipe -fcall-used-g5 -fcall-used-g7 + KBUILD_CFLAGS += -m32 -pipe -mno-fpu -fcall-used-g5 -fcall-used-g7 +@@ -50,6 +51,7 @@ CHECKFLAGS += -D__sparc__ -D__sparc + + LDFLAGS := -m elf64_sparc + export BITS := 64 ++UTS_MACHINE := sparc64 + + KBUILD_CFLAGS += -m64 -pipe -mno-fpu -mcpu=ultrasparc -mcmodel=medlow \ + -ffixed-g4 -ffixed-g5 -fcall-used-g7 -Wno-sign-compare \ + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:07 2009 +Message-Id: <20091217011607.003608176@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:20 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jan Beulich , + Hidetoshi Seto , + Ingo Molnar +Subject: [69/90] x86/mce: Set up timer unconditionally + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jan Beulich + +commit bc09effabf0c5c6c7021e5ef9af15a23579b32a8 upstream. + +mce_timer must be passed to setup_timer() in all cases, no +matter whether it is going to be actually used. Otherwise, when +the CPU gets brought down, its call to del_timer_sync() will +never return, as the timer won't have a base associated, and +hence lock_timer_base() will loop infinitely. + +Signed-off-by: Jan Beulich +Signed-off-by: Hidetoshi Seto +LKML-Reference: <4B1DB831.2030801@jp.fujitsu.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/mcheck/mce.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/x86/kernel/cpu/mcheck/mce.c ++++ b/arch/x86/kernel/cpu/mcheck/mce.c +@@ -1327,13 +1327,14 @@ static void mce_init_timer(void) + struct timer_list *t = &__get_cpu_var(mce_timer); + int *n = &__get_cpu_var(next_interval); + ++ setup_timer(t, mcheck_timer, smp_processor_id()); ++ + if (mce_ignore_ce) + return; + + *n = check_interval * HZ; + if (!*n) + return; +- setup_timer(t, mcheck_timer, smp_processor_id()); + t->expires = round_jiffies(jiffies + *n); + add_timer_on(t, smp_processor_id()); + } + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:07 2009 +Message-Id: <20091217011607.132146579@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:21 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Larry Finger , + "John W. Linville" +Subject: [70/90] b43legacy: avoid PPC fault during resume + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Larry Finger + +commit 316a4d966cae3c2dec83ebb1ee1a3515f97b30ff upstream. + +For PPC architecture with PHY Revision < 3, a read of the register +B43_MMIO_HWENABLED_LO will cause a CPU fault unless b43legacy_status() +returns a value of 2 (B43legacy_STAT_STARTED); however, one finds that +the driver is unable to associate after resuming from hibernation unless +this routine returns 1. To satisfy both conditions, the routine is rewritten +to return TRUE whenever b43legacy_status() returns a value < 2. + +This patch fixes the second problem listed in the postings for Red Hat +Bugzilla #538523. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/b43legacy/rfkill.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/net/wireless/b43legacy/rfkill.c ++++ b/drivers/net/wireless/b43legacy/rfkill.c +@@ -34,6 +34,13 @@ bool b43legacy_is_hw_radio_enabled(struc + & B43legacy_MMIO_RADIO_HWENABLED_HI_MASK)) + return 1; + } else { ++ /* To prevent CPU fault on PPC, do not read a register ++ * unless the interface is started; however, on resume ++ * for hibernation, this routine is entered early. When ++ * that happens, unconditionally return TRUE. ++ */ ++ if (b43legacy_status(dev) < B43legacy_STAT_STARTED) ++ return 1; + if (b43legacy_read16(dev, B43legacy_MMIO_RADIO_HWENABLED_LO) + & B43legacy_MMIO_RADIO_HWENABLED_LO_MASK) + return 1; + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:07 2009 +Message-Id: <20091217011607.262223579@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:22 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Larry Finger , + "John W. Linville" +Subject: [71/90] p54usb: Remove DMA buffer from stack + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Larry Finger + +commit 21d6c270f11c7d0ab5aafa48a6e79ba514f4e5e7 upstream. + +On 2.6.32-rc6 from wireless-testing, the following warning is emitted: + +------------[ cut here ]------------ +WARNING: at lib/dma-debug.c:860 check_for_stack+0xaa/0xe0() +Hardware name: HP Pavilion dv2700 Notebook PC +ehci_hcd 0000:00:02.1: DMA-API: device driver maps memory fromstack + [addr=ffff8800b6e2bca8] +Modules linked in: +Pid: 16378, comm: modprobe Not tainted 2.6.32-rc6-wl #244 +Call Trace: + [] warn_slowpath_common+0x78/0xb0 + [] warn_slowpath_fmt+0x3c/0x40 + [] check_for_stack+0xaa/0xe0 + [] debug_dma_map_page+0xfd/0x170 + [] usb_hcd_submit_urb+0x3da/0x9c0 [usbcore] + [] ? lockdep_init_map+0x5f/0x5d0 + [] usb_submit_urb+0xe5/0x260 [usbcore] + [] usb_start_wait_urb+0x5e/0xf0 [usbcore] + [] ? usb_init_urb+0x23/0x40 [usbcore] + [] usb_bulk_msg+0xc4/0x150 [usbcore] + [] T.719+0x31/0x40 [p54usb] + [] p54u_upload_firmware_3887+0x2f/0x490 [p54usb] + [] ? p54_parse_firmware+0x427/0x450 [p54common] + +---[ end trace f77df0316ddad3de ]--- + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/p54/p54usb.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/p54/p54usb.c ++++ b/drivers/net/wireless/p54/p54usb.c +@@ -427,12 +427,16 @@ static const char p54u_romboot_3887[] = + static int p54u_firmware_reset_3887(struct ieee80211_hw *dev) + { + struct p54u_priv *priv = dev->priv; +- u8 buf[4]; ++ u8 *buf; + int ret; + +- memcpy(&buf, p54u_romboot_3887, sizeof(buf)); ++ buf = kmalloc(4, GFP_KERNEL); ++ if (!buf) ++ return -ENOMEM; ++ memcpy(buf, p54u_romboot_3887, 4); + ret = p54u_bulk_msg(priv, P54U_PIPE_DATA, +- buf, sizeof(buf)); ++ buf, 4); ++ kfree(buf); + if (ret) + dev_err(&priv->udev->dev, "(p54usb) unable to jump to " + "boot ROM (%d)!\n", ret); + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:07 2009 +Message-Id: <20091217011607.388210554@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:23 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Greg KH +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Yong Wang , + Borislav Petkov , + Arjan van de Ven , + Ingo Molnar +Subject: [72/90] [PATCH .31-stable] x86: Under BIOS control, restore APs APIC_LVTTHMR to the BSP value + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Yong Wang + +Upstream commit a2202aa29289db64ca7988b12343158b67b27f10. + +On platforms where bios handles the thermal monitor interrupt, +APIC_LVTTHMR on each logical CPU is programmed to generate a SMI and OS +can't touch it. + +Unfortunately AP bringup sequence using INIT-SIPI-SIPI clear all +the LVT entries except the mask bit. Essentially this results in +all LVT entries including the thermal monitoring interrupt set to masked +(clearing the bios programmed value for APIC_LVTTHMR). + +And this leads to kernel take over the thermal monitoring interrupt +on AP's but not on BSP (leaving the bios programmed value only on BSP). + +As a result of this, we have seen system hangs when the thermal +monitoring interrupt is generated. + +Fix this by reading the initial value of thermal LVT entry on BSP +and if bios has taken over the control, then program the same value +on all AP's and leave the thermal monitoring interrupt control +on all the logical cpu's to the bios. + +Signed-off-by: Yong Wang +Reviewed-by: Suresh Siddha +Cc: Borislav Petkov +Cc: Arjan van de Ven +LKML-Reference: <20091110013824.GA24940@ywang-moblin2.bj.intel.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/mce.h | 6 ++++++ + arch/x86/kernel/cpu/mcheck/therm_throt.c | 29 ++++++++++++++++++++++++++++- + arch/x86/kernel/setup.c | 3 +++ + 3 files changed, 37 insertions(+), 1 deletion(-) + +--- a/arch/x86/include/asm/mce.h ++++ b/arch/x86/include/asm/mce.h +@@ -214,5 +214,11 @@ void mce_log_therm_throt_event(__u64 sta + static inline void mce_log_therm_throt_event(__u64 status) {} + #endif + ++#ifdef CONFIG_X86_THERMAL_VECTOR ++extern void mcheck_intel_therm_init(void); ++#else ++static inline void mcheck_intel_therm_init(void) { } ++#endif ++ + #endif /* __KERNEL__ */ + #endif /* _ASM_X86_MCE_H */ +--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c ++++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c +@@ -49,6 +49,8 @@ static DEFINE_PER_CPU(struct thermal_sta + + static atomic_t therm_throt_en = ATOMIC_INIT(0); + ++static u32 lvtthmr_init __read_mostly; ++ + #ifdef CONFIG_SYSFS + #define define_therm_throt_sysdev_one_ro(_name) \ + static SYSDEV_ATTR(_name, 0444, therm_throt_sysdev_show_##_name, NULL) +@@ -254,6 +256,18 @@ asmlinkage void smp_thermal_interrupt(st + ack_APIC_irq(); + } + ++void __init mcheck_intel_therm_init(void) ++{ ++ /* ++ * This function is only called on boot CPU. Save the init thermal ++ * LVT value on BSP and use that value to restore APs' thermal LVT ++ * entry BIOS programmed later ++ */ ++ if (cpu_has(&boot_cpu_data, X86_FEATURE_ACPI) && ++ cpu_has(&boot_cpu_data, X86_FEATURE_ACC)) ++ lvtthmr_init = apic_read(APIC_LVTTHMR); ++} ++ + void intel_init_thermal(struct cpuinfo_x86 *c) + { + unsigned int cpu = smp_processor_id(); +@@ -270,7 +284,20 @@ void intel_init_thermal(struct cpuinfo_x + * since it might be delivered via SMI already: + */ + rdmsr(MSR_IA32_MISC_ENABLE, l, h); +- h = apic_read(APIC_LVTTHMR); ++ ++ /* ++ * The initial value of thermal LVT entries on all APs always reads ++ * 0x10000 because APs are woken up by BSP issuing INIT-SIPI-SIPI ++ * sequence to them and LVT registers are reset to 0s except for ++ * the mask bits which are set to 1s when APs receive INIT IPI. ++ * Always restore the value that BIOS has programmed on AP based on ++ * BSP's info we saved since BIOS is always setting the same value ++ * for all threads/cores ++ */ ++ apic_write(APIC_LVTTHMR, lvtthmr_init); ++ ++ h = lvtthmr_init; ++ + if ((l & MSR_IA32_MISC_ENABLE_TM1) && (h & APIC_DM_SMI)) { + printk(KERN_DEBUG + "CPU%d: Thermal monitoring handled by SMI\n", cpu); +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -107,6 +107,7 @@ + #ifdef CONFIG_X86_64 + #include + #endif ++#include + + #ifndef ARCH_SETUP + #define ARCH_SETUP +@@ -1030,6 +1031,8 @@ void __init setup_arch(char **cmdline_p) + conswitchp = &dummy_con; + #endif + #endif ++ ++ mcheck_intel_therm_init(); + } + + #ifdef CONFIG_X86_32 + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:07 2009 +Message-Id: <20091217011607.520619682@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:24 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Zhao Yakui , + Venkatesh Pallipadi , + Len Brown +Subject: [73/90] ACPI: Use the ARB_DISABLE for the CPU which model id is less than 0x0f. + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Zhao Yakui + +commit 03a05ed1152944000151d57b71000de287a1eb02 upstream. + +Currently, ARB_DISABLE is a NOP on all of the recent Intel platforms. +For such platforms, reduce contention on c3_lock by skipping the fake +ARB_DISABLE. + +The cpu model id on one laptop is 14. If we disable ARB_DISABLE on this box, +the box can't be booted correctly. But if we still enable ARB_DISABLE on this +box, the box can be booted correctly. + +So we still use the ARB_DISABLE for the cpu which mode id is less than 0x0f. + +http://bugzilla.kernel.org/show_bug.cgi?id=14700 + +Signed-off-by: Zhao Yakui +Acked-by: Venkatesh Pallipadi +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/acpi/cstate.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/acpi/cstate.c ++++ b/arch/x86/kernel/acpi/cstate.c +@@ -48,7 +48,7 @@ void acpi_processor_power_init_bm_check( + * P4, Core and beyond CPUs + */ + if (c->x86_vendor == X86_VENDOR_INTEL && +- (c->x86 > 0xf || (c->x86 == 6 && c->x86_model >= 14))) ++ (c->x86 > 0xf || (c->x86 == 6 && c->x86_model >= 0x0f))) + flags->bm_control = 0; + } + EXPORT_SYMBOL(acpi_processor_power_init_bm_check); + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:07 2009 +Message-Id: <20091217011607.648675624@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:25 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Thomas Renninger , + =?ISO-8859-15?q?Peter=20K=C3=BCppers?= , + Michael Franzl , + Ian Turner , + Corentin Chary , + Len Brown +Subject: [74/90] asus-laptop: change light sens default values. + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Corentin Chary + +commit d951d4cc84e8b5ddb8e0ab81cf6a72cc73fdd668 upstream. + +The light sensor disable brightness key and +/sys/class/backlight/ control. There was a lot of report +from users who didn't understand why they couldn't change their +brightness, including: + +https://bugs.launchpad.net/bugs/222171 +https://bugzilla.novell.com/show_bug.cgi?id=514747 +http://bugzilla.kernel.org/show_bug.cgi?id=13671 +http://bugzilla.kernel.org/show_bug.cgi?id=14432 + +Now the light sensor is disabled, and if the user want to enable +it, the level should be ok. + +The funny thing is that comments where ok, not code. + +Cc: stable@kernel.org +Cc: Thomas Renninger +Cc: Peter Küppers +Cc: Michael Franzl +Cc: Ian Turner +Signed-off-by: Corentin Chary +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/asus-laptop.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/platform/x86/asus-laptop.c ++++ b/drivers/platform/x86/asus-laptop.c +@@ -1172,8 +1172,8 @@ static int asus_hotk_add(struct acpi_dev + hotk->ledd_status = 0xFFF; + + /* Set initial values of light sensor and level */ +- hotk->light_switch = 1; /* Default to light sensor disabled */ +- hotk->light_level = 0; /* level 5 for sensor sensitivity */ ++ hotk->light_switch = 0; /* Default to light sensor disabled */ ++ hotk->light_level = 5; /* level 5 for sensor sensitivity */ + + if (ls_switch_handle) + set_light_sens_switch(hotk->light_switch); + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:07 2009 +Message-Id: <20091217011607.777680705@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:26 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jean Delvare , + Richard Purdie +Subject: [75/90] backlight: lcd - Fix wrong sizeof + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jean Delvare + +commit 1e0fa6bd8c7468067f2e988c7a416dafd0651c34 upstream. + +Which is why I have always preferred sizeof(struct foo) over +sizeof(var). + +Signed-off-by: Jean Delvare +Signed-off-by: Richard Purdie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/backlight/lcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/video/backlight/lcd.c ++++ b/drivers/video/backlight/lcd.c +@@ -56,7 +56,7 @@ static int fb_notifier_callback(struct n + + static int lcd_register_fb(struct lcd_device *ld) + { +- memset(&ld->fb_notif, 0, sizeof(&ld->fb_notif)); ++ memset(&ld->fb_notif, 0, sizeof(ld->fb_notif)); + ld->fb_notif.notifier_call = fb_notifier_callback; + return fb_register_client(&ld->fb_notif); + } + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:08 2009 +Message-Id: <20091217011607.913966145@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:27 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Chris Wilson , + David Woodhouse , + Zhenyu Wang , + Zhenyu Wang , + Eric Anholt +Subject: [76/90] drm/i915: Avoid NULL dereference with component_only tv_modes + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Chris Wilson + +commit d271817baecbccb47da0d9f28c285a0dae8a06b7 upstream. + +In commit d2d9f2324, the guard for a valid video mode was removed. This +caused the regression: + + kernel crash during kms graphic boot on Intel GM4500 platform + https://bugzilla.redhat.com/show_bug.cgi?id=540218 + +This patches changes the logic slightly not to rely on a coupled +variable, but to just check whether the video_modes is valid before +dereferencing. + +Signed-off-by: Chris Wilson +Cc: David Woodhouse +Cc: Zhenyu Wang +[ickle: Actually reference the correct bug report] +Acked-by: Zhenyu Wang +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_tv.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_tv.c ++++ b/drivers/gpu/drm/i915/intel_tv.c +@@ -1212,20 +1212,17 @@ intel_tv_mode_set(struct drm_encoder *en + tv_ctl |= TV_TRILEVEL_SYNC; + if (tv_mode->pal_burst) + tv_ctl |= TV_PAL_BURST; ++ + scctl1 = 0; +- /* dda1 implies valid video levels */ +- if (tv_mode->dda1_inc) { ++ if (tv_mode->dda1_inc) + scctl1 |= TV_SC_DDA1_EN; +- } +- + if (tv_mode->dda2_inc) + scctl1 |= TV_SC_DDA2_EN; +- + if (tv_mode->dda3_inc) + scctl1 |= TV_SC_DDA3_EN; +- + scctl1 |= tv_mode->sc_reset; +- scctl1 |= video_levels->burst << TV_BURST_LEVEL_SHIFT; ++ if (video_levels) ++ scctl1 |= video_levels->burst << TV_BURST_LEVEL_SHIFT; + scctl1 |= tv_mode->dda1_inc << TV_SCDDA1_INC_SHIFT; + + scctl2 = tv_mode->dda2_size << TV_SCDDA2_SIZE_SHIFT | + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:08 2009 +Message-Id: <20091217011608.038270093@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:28 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Zhenyu Wang , + Eric Anholt +Subject: [77/90] drm/i915: Fix CRT hotplug detect by checking really no channels attached + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Zhenyu Wang + +commit 8e9e0eea9955bffbe5e5cd6355157cabddc31f17 upstream. + +For CRT hotplug detect status, we have four test results as blue +channel only, green channel only, both blue and green channel, and +no channel attached. Origin code only marks both blue and green channel +case as connected, but ignore other possible connected states. This one +trys to detect CRT by checking no channel attached case instead. + +Signed-off-by: Zhenyu Wang +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_crt.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_crt.c ++++ b/drivers/gpu/drm/i915/intel_crt.c +@@ -234,8 +234,8 @@ static bool intel_crt_detect_hotplug(str + } while (time_after(timeout, jiffies)); + } + +- if ((I915_READ(PORT_HOTPLUG_STAT) & CRT_HOTPLUG_MONITOR_MASK) == +- CRT_HOTPLUG_MONITOR_COLOR) ++ if ((I915_READ(PORT_HOTPLUG_STAT) & CRT_HOTPLUG_MONITOR_MASK) != ++ CRT_HOTPLUG_MONITOR_NONE) + return true; + + return false; + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:08 2009 +Message-Id: <20091217011608.173172682@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:29 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Zhenyu Wang , + Eric Anholt +Subject: [78/90] drm/i915: Fix LVDS stability issue on Ironlake + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Zhenyu Wang + +commit 1b3c7a47f993bf9ab6c4c7cc3bbf5588052b58f4 upstream. + +In disable sequence, all output ports on PCH have to be disabled +before PCH transcoder, but LVDS port was left always enabled. This +one fixes that by disable LVDS port properly during pipe disable +process, and resolved stability issue seen on Ironlake. Also move +panel fitting disable time just after pipe disable to align with +the spec. + +Signed-off-by: Zhenyu Wang +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_display.c | 60 +++++++++++++++++++++++------------ + 1 file changed, 41 insertions(+), 19 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -1182,6 +1182,15 @@ static void igdng_crtc_dpms(struct drm_c + case DRM_MODE_DPMS_STANDBY: + case DRM_MODE_DPMS_SUSPEND: + DRM_DEBUG("crtc %d dpms on\n", pipe); ++ ++ if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) { ++ temp = I915_READ(PCH_LVDS); ++ if ((temp & LVDS_PORT_EN) == 0) { ++ I915_WRITE(PCH_LVDS, temp | LVDS_PORT_EN); ++ POSTING_READ(PCH_LVDS); ++ } ++ } ++ + if (HAS_eDP) { + /* enable eDP PLL */ + igdng_enable_pll_edp(crtc); +@@ -1366,8 +1375,6 @@ static void igdng_crtc_dpms(struct drm_c + case DRM_MODE_DPMS_OFF: + DRM_DEBUG("crtc %d dpms off\n", pipe); + +- i915_disable_vga(dev); +- + /* Disable display plane */ + temp = I915_READ(dspcntr_reg); + if ((temp & DISPLAY_PLANE_ENABLE) != 0) { +@@ -1377,6 +1384,8 @@ static void igdng_crtc_dpms(struct drm_c + I915_READ(dspbase_reg); + } + ++ i915_disable_vga(dev); ++ + /* disable cpu pipe, disable after all planes disabled */ + temp = I915_READ(pipeconf_reg); + if ((temp & PIPEACONF_ENABLE) != 0) { +@@ -1397,9 +1406,15 @@ static void igdng_crtc_dpms(struct drm_c + } else + DRM_DEBUG("crtc %d is disabled\n", pipe); + +- if (HAS_eDP) { +- igdng_disable_pll_edp(crtc); ++ udelay(100); ++ ++ /* Disable PF */ ++ temp = I915_READ(pf_ctl_reg); ++ if ((temp & PF_ENABLE) != 0) { ++ I915_WRITE(pf_ctl_reg, temp & ~PF_ENABLE); ++ I915_READ(pf_ctl_reg); + } ++ I915_WRITE(pf_win_size, 0); + + /* disable CPU FDI tx and PCH FDI rx */ + temp = I915_READ(fdi_tx_reg); +@@ -1425,6 +1440,13 @@ static void igdng_crtc_dpms(struct drm_c + + udelay(100); + ++ if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) { ++ temp = I915_READ(PCH_LVDS); ++ I915_WRITE(PCH_LVDS, temp & ~LVDS_PORT_EN); ++ I915_READ(PCH_LVDS); ++ udelay(100); ++ } ++ + /* disable PCH transcoder */ + temp = I915_READ(transconf_reg); + if ((temp & TRANS_ENABLE) != 0) { +@@ -1444,6 +1466,8 @@ static void igdng_crtc_dpms(struct drm_c + } + } + ++ udelay(100); ++ + /* disable PCH DPLL */ + temp = I915_READ(pch_dpll_reg); + if ((temp & DPLL_VCO_ENABLE) != 0) { +@@ -1451,14 +1475,20 @@ static void igdng_crtc_dpms(struct drm_c + I915_READ(pch_dpll_reg); + } + +- temp = I915_READ(fdi_rx_reg); +- if ((temp & FDI_RX_PLL_ENABLE) != 0) { +- temp &= ~FDI_SEL_PCDCLK; +- temp &= ~FDI_RX_PLL_ENABLE; +- I915_WRITE(fdi_rx_reg, temp); +- I915_READ(fdi_rx_reg); ++ if (HAS_eDP) { ++ igdng_disable_pll_edp(crtc); + } + ++ temp = I915_READ(fdi_rx_reg); ++ temp &= ~FDI_SEL_PCDCLK; ++ I915_WRITE(fdi_rx_reg, temp); ++ I915_READ(fdi_rx_reg); ++ ++ temp = I915_READ(fdi_rx_reg); ++ temp &= ~FDI_RX_PLL_ENABLE; ++ I915_WRITE(fdi_rx_reg, temp); ++ I915_READ(fdi_rx_reg); ++ + /* Disable CPU FDI TX PLL */ + temp = I915_READ(fdi_tx_reg); + if ((temp & FDI_TX_PLL_ENABLE) != 0) { +@@ -1467,16 +1497,8 @@ static void igdng_crtc_dpms(struct drm_c + udelay(100); + } + +- /* Disable PF */ +- temp = I915_READ(pf_ctl_reg); +- if ((temp & PF_ENABLE) != 0) { +- I915_WRITE(pf_ctl_reg, temp & ~PF_ENABLE); +- I915_READ(pf_ctl_reg); +- } +- I915_WRITE(pf_win_size, 0); +- + /* Wait for the clocks to turn off. */ +- udelay(150); ++ udelay(100); + break; + } + } + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:08 2009 +Message-Id: <20091217011608.305374103@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:30 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jesse Barnes , + Eric Anholt , + Stefan Bader +Subject: [79/90] drm/i915: save/restore BLC histogram control reg across suspend/resume + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jesse Barnes + +commit 0eb96d6ed38430b72897adde58f5477a6b71757a upstream. + +Turns out some machines, like the ThinkPad X40 don't come back if you +don't save/restore this register. + +Signed-off-by: Jesse Barnes +Signed-off-by: Eric Anholt +Cc: Stefan Bader +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_drv.h | 1 + + drivers/gpu/drm/i915/i915_reg.h | 2 ++ + drivers/gpu/drm/i915/i915_suspend.c | 2 ++ + 3 files changed, 5 insertions(+) + +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -264,6 +264,7 @@ typedef struct drm_i915_private { + u32 saveDSPASURF; + u32 saveDSPATILEOFF; + u32 savePFIT_PGM_RATIOS; ++ u32 saveBLC_HIST_CTL; + u32 saveBLC_PWM_CTL; + u32 saveBLC_PWM_CTL2; + u32 saveFPB0; +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -915,6 +915,8 @@ + #define BACKLIGHT_DUTY_CYCLE_SHIFT (0) + #define BACKLIGHT_DUTY_CYCLE_MASK (0xffff) + ++#define BLC_HIST_CTL 0x61260 ++ + /* TV port control */ + #define TV_CTL 0x68000 + /** Enables the TV encoder */ +--- a/drivers/gpu/drm/i915/i915_suspend.c ++++ b/drivers/gpu/drm/i915/i915_suspend.c +@@ -416,6 +416,7 @@ int i915_save_state(struct drm_device *d + dev_priv->savePP_CONTROL = I915_READ(PP_CONTROL); + dev_priv->savePFIT_PGM_RATIOS = I915_READ(PFIT_PGM_RATIOS); + dev_priv->saveBLC_PWM_CTL = I915_READ(BLC_PWM_CTL); ++ dev_priv->saveBLC_HIST_CTL = I915_READ(BLC_HIST_CTL); + if (IS_I965G(dev)) + dev_priv->saveBLC_PWM_CTL2 = I915_READ(BLC_PWM_CTL2); + if (IS_MOBILE(dev) && !IS_I830(dev)) +@@ -560,6 +561,7 @@ int i915_restore_state(struct drm_device + + I915_WRITE(PFIT_PGM_RATIOS, dev_priv->savePFIT_PGM_RATIOS); + I915_WRITE(BLC_PWM_CTL, dev_priv->saveBLC_PWM_CTL); ++ I915_WRITE(BLC_HIST_CTL, dev_priv->saveBLC_HIST_CTL); + I915_WRITE(PP_ON_DELAYS, dev_priv->savePP_ON_DELAYS); + I915_WRITE(PP_OFF_DELAYS, dev_priv->savePP_OFF_DELAYS); + I915_WRITE(PP_DIVISOR, dev_priv->savePP_DIVISOR); + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:08 2009 +Message-Id: <20091217011608.432875928@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:31 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Shaohua Li , + Zhenyu Wang , + Eric Anholt +Subject: [80/90] drm/i915: PineView only has LVDS and CRT ports + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Zhenyu Wang + +commit 103a196f4224dc6872081305cf7f82ebf67aa7bd upstream. + +PineView only has 2 ports for LVDS and CRT. Don't enable other +ports for it. + +Cc: Shaohua Li +Signed-off-by: Zhenyu Wang +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_drv.h | 4 ++++ + drivers/gpu/drm/i915/intel_display.c | 6 +++--- + 2 files changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -838,6 +838,7 @@ extern int i915_wait_ring(struct drm_dev + #define IS_I85X(dev) ((dev)->pci_device == 0x3582) + #define IS_I855(dev) ((dev)->pci_device == 0x3582) + #define IS_I865G(dev) ((dev)->pci_device == 0x2572) ++#define IS_I8XX(dev) (IS_I830(dev) || IS_845G(dev) || IS_I85X(dev) || IS_I865G(dev)) + + #define IS_I915G(dev) ((dev)->pci_device == 0x2582 || (dev)->pci_device == 0x258a) + #define IS_I915GM(dev) ((dev)->pci_device == 0x2592) +@@ -899,9 +900,12 @@ extern int i915_wait_ring(struct drm_dev + */ + #define HAS_128_BYTE_Y_TILING(dev) (IS_I9XX(dev) && !(IS_I915G(dev) || \ + IS_I915GM(dev))) ++#define SUPPORTS_DIGITAL_OUTPUTS(dev) (IS_I9XX(dev) && !IS_IGD(dev)) + #define SUPPORTS_INTEGRATED_HDMI(dev) (IS_G4X(dev) || IS_IGDNG(dev)) + #define SUPPORTS_INTEGRATED_DP(dev) (IS_G4X(dev) || IS_IGDNG(dev)) + #define SUPPORTS_EDP(dev) (IS_IGDNG_M(dev)) ++#define SUPPORTS_TV(dev) (IS_I9XX(dev) && IS_MOBILE(dev) && \ ++ !IS_IGDNG(dev) && !IS_IGD(dev)) + #define I915_HAS_HOTPLUG(dev) (IS_I945G(dev) || IS_I945GM(dev) || IS_I965G(dev)) + /* dsparb controlled by hw only */ + #define DSPARB_HWCONTROL(dev) (IS_G4X(dev) || IS_IGDNG(dev)) +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -3347,7 +3347,7 @@ static void intel_setup_outputs(struct d + if (I915_READ(PCH_DP_D) & DP_DETECTED) + intel_dp_init(dev, PCH_DP_D); + +- } else if (IS_I9XX(dev)) { ++ } else if (SUPPORTS_DIGITAL_OUTPUTS(dev)) { + bool found = false; + + if (I915_READ(SDVOB) & SDVO_DETECTED) { +@@ -3374,10 +3374,10 @@ static void intel_setup_outputs(struct d + + if (SUPPORTS_INTEGRATED_DP(dev) && (I915_READ(DP_D) & DP_DETECTED)) + intel_dp_init(dev, DP_D); +- } else ++ } else if (IS_I8XX(dev)) + intel_dvo_init(dev); + +- if (IS_I9XX(dev) && IS_MOBILE(dev) && !IS_IGDNG(dev)) ++ if (SUPPORTS_TV(dev)) + intel_tv_init(dev); + + list_for_each_entry(connector, &dev->mode_config.connector_list, head) { + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:08 2009 +Message-Id: <20091217011608.568487962@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:32 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jan Kara +Subject: [81/90] ext3: Fix data / filesystem corruption when write fails to copy data + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jan Kara + +commit 68eb3db08344286733adac48304d9fb7a0e53b27 upstream. + +When ext3_write_begin fails after allocating some blocks or +generic_perform_write fails to copy data to write, we truncate blocks already +instantiated beyond i_size. Although these blocks were never inside i_size, we +have to truncate pagecache of these blocks so that corresponding buffers get +unmapped. Otherwise subsequent __block_prepare_write (called because we are +retrying the write) will find the buffers mapped, not call ->get_block, and +thus the page will be backed by already freed blocks leading to filesystem and +data corruption. + +Reported-by: James Y Knight +Signed-off-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext3/inode.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +--- a/fs/ext3/inode.c ++++ b/fs/ext3/inode.c +@@ -1137,6 +1137,16 @@ static int do_journal_get_write_access(h + return ext3_journal_get_write_access(handle, bh); + } + ++/* ++ * Truncate blocks that were not used by write. We have to truncate the ++ * pagecache as well so that corresponding buffers get properly unmapped. ++ */ ++static void ext3_truncate_failed_write(struct inode *inode) ++{ ++ truncate_inode_pages(inode->i_mapping, inode->i_size); ++ ext3_truncate(inode); ++} ++ + static int ext3_write_begin(struct file *file, struct address_space *mapping, + loff_t pos, unsigned len, unsigned flags, + struct page **pagep, void **fsdata) +@@ -1195,7 +1205,7 @@ write_begin_failed: + unlock_page(page); + page_cache_release(page); + if (pos + len > inode->i_size) +- ext3_truncate(inode); ++ ext3_truncate_failed_write(inode); + } + if (ret == -ENOSPC && ext3_should_retry_alloc(inode->i_sb, &retries)) + goto retry; +@@ -1290,7 +1300,7 @@ static int ext3_ordered_write_end(struct + page_cache_release(page); + + if (pos + len > inode->i_size) +- ext3_truncate(inode); ++ ext3_truncate_failed_write(inode); + return ret ? ret : copied; + } + +@@ -1316,7 +1326,7 @@ static int ext3_writeback_write_end(stru + page_cache_release(page); + + if (pos + len > inode->i_size) +- ext3_truncate(inode); ++ ext3_truncate_failed_write(inode); + return ret ? ret : copied; + } + +@@ -1369,7 +1379,7 @@ static int ext3_journalled_write_end(str + page_cache_release(page); + + if (pos + len > inode->i_size) +- ext3_truncate(inode); ++ ext3_truncate_failed_write(inode); + return ret ? ret : copied; + } + + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:08 2009 +Message-Id: <20091217011608.696291429@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:33 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Deon van der Merwe , + Julian Anastasov , + Simon Horman , + Patrick McHardy +Subject: [82/90] ipvs: zero usvc and udest + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Simon Horman + +commit 258c889362aa95d0ab534b38ce8c15d3009705b1 upstream. + +Make sure that any otherwise uninitialised fields of usvc are zero. + +This has been obvserved to cause a problem whereby the port of +fwmark services may end up as a non-zero value which causes +scheduling of a destination server to fail for persisitent services. + +As observed by Deon van der Merwe . +This fix suggested by Julian Anastasov . + +For good measure also zero udest. + +Cc: Deon van der Merwe +Acked-by: Julian Anastasov +Signed-off-by: Simon Horman +Signed-off-by: Patrick McHardy +Signed-off-by: Greg Kroah-Hartman + +--- + net/netfilter/ipvs/ip_vs_ctl.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/net/netfilter/ipvs/ip_vs_ctl.c ++++ b/net/netfilter/ipvs/ip_vs_ctl.c +@@ -2713,6 +2713,8 @@ static int ip_vs_genl_parse_service(stru + if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr)))) + return -EINVAL; + ++ memset(usvc, 0, sizeof(*usvc)); ++ + usvc->af = nla_get_u16(nla_af); + #ifdef CONFIG_IP_VS_IPV6 + if (usvc->af != AF_INET && usvc->af != AF_INET6) +@@ -2900,6 +2902,8 @@ static int ip_vs_genl_parse_dest(struct + if (!(nla_addr && nla_port)) + return -EINVAL; + ++ memset(udest, 0, sizeof(*udest)); ++ + nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr)); + udest->port = nla_get_u16(nla_port); + + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:08 2009 +Message-Id: <20091217011608.830966337@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:34 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Zhu Yi , + "John W. Linville" +Subject: [83/90] ipw2100: fix rebooting hang with driver loaded + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Zhu Yi + +commit 52ce3e9a7db754b78cf2cbabc87013f921b25b28 upstream. + +Add PCI .shutdown method so that we can disable the device during +shutdown or reboot. Without this, the reboot doesn't work well on +some platforms. + +This fixes http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2124 + +Tested-by: pablo +Signed-off-by: Zhu Yi +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ipw2x00/ipw2100.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/net/wireless/ipw2x00/ipw2100.c ++++ b/drivers/net/wireless/ipw2x00/ipw2100.c +@@ -6487,6 +6487,16 @@ static int ipw2100_resume(struct pci_dev + } + #endif + ++static void ipw2100_shutdown(struct pci_dev *pci_dev) ++{ ++ struct ipw2100_priv *priv = pci_get_drvdata(pci_dev); ++ ++ /* Take down the device; powers it off, etc. */ ++ ipw2100_down(priv); ++ ++ pci_disable_device(pci_dev); ++} ++ + #define IPW2100_DEV_ID(x) { PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, x } + + static struct pci_device_id ipw2100_pci_id_table[] __devinitdata = { +@@ -6550,6 +6560,7 @@ static struct pci_driver ipw2100_pci_dri + .suspend = ipw2100_suspend, + .resume = ipw2100_resume, + #endif ++ .shutdown = ipw2100_shutdown, + }; + + /** + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:09 2009 +Message-Id: <20091217011608.959719502@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:35 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + David Woodhouse +Subject: [84/90] jffs2: Fix long-standing bug with symlink garbage collection. + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: David Woodhouse + +commit 2e16cfca6e17ae37ae21feca080a6f2eca9087dc upstream. + +Ever since jffs2_garbage_collect_metadata() was first half-written in +February 2001, it's been broken on architectures where 'char' is signed. +When garbage collecting a symlink with target length above 127, the payload +length would end up negative, causing interesting and bad things to happen. + +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jffs2/gc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/jffs2/gc.c ++++ b/fs/jffs2/gc.c +@@ -700,7 +700,8 @@ static int jffs2_garbage_collect_metadat + struct jffs2_raw_inode ri; + struct jffs2_node_frag *last_frag; + union jffs2_device_node dev; +- char *mdata = NULL, mdatalen = 0; ++ char *mdata = NULL; ++ int mdatalen = 0; + uint32_t alloclen, ilen; + int ret; + + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:09 2009 +Message-Id: <20091217011609.093584674@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:36 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Cox , + Petr Vandrovec , + Pekka Enberg , + "Paul A. Clarke" +Subject: [85/90] matroxfb: fix problems with display stability + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alan Cox + +commit 8c651311a3a08c1e4815de6933e00a760e498dae upstream. + +Regression caused in 2.6.23 and then despite repeated requests never fixed +or dealt with (Petr promised to sort it in 2008 but seems to have +forgotten). + +Enough is enough - remove the problem line that was added. If it upsets +someone they've had two years to deal with it and at the very least it'll +rattle their cage and wake them up. + +Addresses http://bugzilla.kernel.org/show_bug.cgi?id=9709 + +Signed-off-by: Alan Cox +Reported-by: Damon +Tested-by: Ruud van Melick +Cc: Petr Vandrovec +Cc: Pekka Enberg +Cc: Paul A. Clarke +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/matrox/g450_pll.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/video/matrox/g450_pll.c ++++ b/drivers/video/matrox/g450_pll.c +@@ -341,7 +341,8 @@ static int __g450_setclk(WPMINFO unsigne + M1064_XDVICLKCTRL_C1DVICLKEN | + M1064_XDVICLKCTRL_DVILOOPCTL | + M1064_XDVICLKCTRL_P1LOOPBWDTCTL; +- matroxfb_DAC_out(PMINFO M1064_XDVICLKCTRL,tmp); ++ /* Setting this breaks PC systems so don't do it */ ++ /* matroxfb_DAC_out(PMINFO M1064_XDVICLKCTRL,tmp); */ + matroxfb_DAC_out(PMINFO M1064_XPWRCTRL, + xpwrctrl); + + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:09 2009 +Message-Id: <20091217011609.228623383@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:37 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + David Miller +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + netdev@vger.kernel.org, + marcel@holtmann.org, + "Eric W. Biederman" +Subject: [86/90] net: Fix userspace RTM_NEWLINK notifications. + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +commit d90a909e1f3e006a1d57fe11fd417173b6494701 upstream. + +I received some bug reports about userspace programs having problems +because after RTM_NEWLINK was received they could not immeidate +access files under /proc/sys/net/ because they had not been +registered yet. + +The problem was trivailly fixed by moving the userspace +notification from rtnetlink_event to the end of register_netdevice. + +Signed-off-by: Eric W. Biederman +Cc: David Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/dev.c | 11 +++++++++++ + net/core/rtnetlink.c | 4 +--- + 2 files changed, 12 insertions(+), 3 deletions(-) + +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -4808,6 +4808,11 @@ int register_netdevice(struct net_device + rollback_registered(dev); + dev->reg_state = NETREG_UNREGISTERED; + } ++ /* ++ * Prevent userspace races by waiting until the network ++ * device is fully setup before sending notifications. ++ */ ++ rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U); + + out: + return ret; +@@ -5343,6 +5348,12 @@ int dev_change_net_namespace(struct net_ + /* Notify protocols, that a new device appeared. */ + call_netdevice_notifiers(NETDEV_REGISTER, dev); + ++ /* ++ * Prevent userspace races by waiting until the network ++ * device is fully setup before sending notifications. ++ */ ++ rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U); ++ + synchronize_net(); + err = 0; + out: +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -1347,13 +1347,11 @@ static int rtnetlink_event(struct notifi + case NETDEV_UNREGISTER: + rtmsg_ifinfo(RTM_DELLINK, dev, ~0U); + break; +- case NETDEV_REGISTER: +- rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U); +- break; + case NETDEV_UP: + case NETDEV_DOWN: + rtmsg_ifinfo(RTM_NEWLINK, dev, IFF_UP|IFF_RUNNING); + break; ++ case NETDEV_REGISTER: + case NETDEV_CHANGE: + case NETDEV_GOING_DOWN: + break; + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:09 2009 +Message-Id: <20091217011609.364392349@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:38 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + WANG Cong , + Ingo Molnar , + Peter Zijlstra , + James Morris , + Alexey Dobriyan +Subject: [87/90] sysctl_max_map_count should be non-negative + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Amerigo Wang + +commit 70da2340fbc68e91e701762f785479ab495a0869 upstream. + +Jan Engelhardt reported we have this problem: + +setting max_map_count to a value large enough results in programs dying at +first try. This is on 2.6.31.6: + +15:59 borg:/proc/sys/vm # echo $[1<<31-1] >max_map_count +15:59 borg:/proc/sys/vm # cat max_map_count +1073741824 +15:59 borg:/proc/sys/vm # echo $[1<<31] >max_map_count +15:59 borg:/proc/sys/vm # cat max_map_count +Killed + +This is because we have a chance to make 'max_map_count' negative. but +it's meaningless. Make it only accept non-negative values. + +Reported-by: Jan Engelhardt +Signed-off-by: WANG Cong +Cc: Ingo Molnar +Cc: Peter Zijlstra +Cc: James Morris +Cc: Alexey Dobriyan +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/sysctl.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -1539,7 +1539,8 @@ static struct ctl_table debug_table[] = + .data = &show_unhandled_signals, + .maxlen = sizeof(int), + .mode = 0644, +- .proc_handler = proc_dointvec ++ .proc_handler = proc_dointvec, ++ .extra1 = &zero, + }, + #endif + { .ctl_name = 0 } + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:09 2009 +Message-Id: <20091217011609.499502645@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:39 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Henrique de Moraes Holschuh , + Len Brown +Subject: [88/90] thinkpad-acpi: fix default brightness_mode for R50e/R51 + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Henrique de Moraes Holschuh + +commit a9f8eacca4e9e8693de9b896c1fa7aadaa9402e8 upstream. + +According to a report, the R50e wants EC-based brightness control, +even if it uses an Intel GPU. The current driver default was reported +to not work at all. + +This bug can be worked around by the "brightness_mode=3" module +parameter. + +Change the default of the R50e and R51 2xxx models (which use the same +EC firmware, 1V) to TPACPI_BRGHT_Q_EC, but keep TPACPI_BRGHT_Q_ASK set +for now, as I'd like to get more reports. + +This fixes a regression caused by commit +59fe4fe34d7afdf63208124f313be9056feaa2f4, +"thinkpad-acpi: fix incorrect use of TPACPI_BRGHT_MODE_ECNVRAM" + +Kernel 2.6.31 also needs this fix. + +Reported-by: Ferenc Wagner +Tested-by: Ferenc Wagner +Signed-off-by: Henrique de Moraes Holschuh +Cc: stable@kernel.org +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/thinkpad_acpi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -5663,8 +5663,8 @@ static const struct tpacpi_quirk brightn + + /* Models with Intel Extreme Graphics 2 */ + TPACPI_Q_IBM('1', 'U', TPACPI_BRGHT_Q_NOEC), +- TPACPI_Q_IBM('1', 'V', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_NOEC), +- TPACPI_Q_IBM('1', 'W', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_NOEC), ++ TPACPI_Q_IBM('1', 'V', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC), ++ TPACPI_Q_IBM('1', 'W', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC), + + /* Models with Intel GMA900 */ + TPACPI_Q_IBM('7', '0', TPACPI_BRGHT_Q_NOEC), /* T43, R52 */ + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:09 2009 +Message-Id: <20091217011609.621838406@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:40 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Henrique de Moraes Holschuh , + Len Brown +Subject: [89/90] thinkpad-acpi: preserve rfkill state across suspend/resume + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Henrique de Moraes Holschuh + +commit 208b996b6c460285650d39b2330f8ef82c007d10 upstream. + +Since the rfkill rework in 2.6.31, the driver is always resuming with +the radios disabled. + +Change thinkpad-acpi to ask the firmware to resume with the radios in +the last state. This fixes the Bluetooth and WWAN rfkill switches. + +Note that it means we respect the firmware's oddities. Should the +user toggle the hardware rfkill switch on and off, it might cause the +radios to resume enabled. + +UWB is an unknown quantity since it has nowhere the same level of +firmware support (no control over state storage in NVRAM, for +example), and might need further fixing. Testers welcome. + +This change fixes a regression from 2.6.30. + +Reported-by: Jerone Young +Reported-by: Ian Molton +Signed-off-by: Henrique de Moraes Holschuh +Tested-by: Ian Molton +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/thinkpad_acpi.c | 32 +++++--------------------------- + 1 file changed, 5 insertions(+), 27 deletions(-) + +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -3406,15 +3406,6 @@ enum { + + #define TPACPI_RFK_BLUETOOTH_SW_NAME "tpacpi_bluetooth_sw" + +-static void bluetooth_suspend(pm_message_t state) +-{ +- /* Try to make sure radio will resume powered off */ +- if (!acpi_evalf(NULL, NULL, "\\BLTH", "vd", +- TP_ACPI_BLTH_PWR_OFF_ON_RESUME)) +- vdbg_printk(TPACPI_DBG_RFKILL, +- "bluetooth power down on resume request failed\n"); +-} +- + static int bluetooth_get_status(void) + { + int status; +@@ -3448,10 +3439,9 @@ static int bluetooth_set_status(enum tpa + #endif + + /* We make sure to keep TP_ACPI_BLUETOOTH_RESUMECTRL off */ ++ status = TP_ACPI_BLUETOOTH_RESUMECTRL; + if (state == TPACPI_RFK_RADIO_ON) +- status = TP_ACPI_BLUETOOTH_RADIOSSW; +- else +- status = 0; ++ status |= TP_ACPI_BLUETOOTH_RADIOSSW; + + if (!acpi_evalf(hkey_handle, NULL, "SBDC", "vd", status)) + return -EIO; +@@ -3590,7 +3580,6 @@ static struct ibm_struct bluetooth_drive + .read = bluetooth_read, + .write = bluetooth_write, + .exit = bluetooth_exit, +- .suspend = bluetooth_suspend, + .shutdown = bluetooth_shutdown, + }; + +@@ -3608,15 +3597,6 @@ enum { + + #define TPACPI_RFK_WWAN_SW_NAME "tpacpi_wwan_sw" + +-static void wan_suspend(pm_message_t state) +-{ +- /* Try to make sure radio will resume powered off */ +- if (!acpi_evalf(NULL, NULL, "\\WGSV", "qvd", +- TP_ACPI_WGSV_PWR_OFF_ON_RESUME)) +- vdbg_printk(TPACPI_DBG_RFKILL, +- "WWAN power down on resume request failed\n"); +-} +- + static int wan_get_status(void) + { + int status; +@@ -3649,11 +3629,10 @@ static int wan_set_status(enum tpacpi_rf + } + #endif + +- /* We make sure to keep TP_ACPI_WANCARD_RESUMECTRL off */ ++ /* We make sure to set TP_ACPI_WANCARD_RESUMECTRL */ ++ status = TP_ACPI_WANCARD_RESUMECTRL; + if (state == TPACPI_RFK_RADIO_ON) +- status = TP_ACPI_WANCARD_RADIOSSW; +- else +- status = 0; ++ status |= TP_ACPI_WANCARD_RADIOSSW; + + if (!acpi_evalf(hkey_handle, NULL, "SWAN", "vd", status)) + return -EIO; +@@ -3791,7 +3770,6 @@ static struct ibm_struct wan_driver_data + .read = wan_read, + .write = wan_write, + .exit = wan_exit, +- .suspend = wan_suspend, + .shutdown = wan_shutdown, + }; + + + +From gregkh@mini.kroah.org Wed Dec 16 17:16:09 2009 +Message-Id: <20091217011609.752672621@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 17:15:41 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Rafal Milecki , + Jean-Francois Moine , + Mauro Carvalho Chehab , + Surbhi Palande +Subject: [90/90] V4L/DVB (13116): gspca - ov519: Webcam 041e:4067 added. + +2.6.31-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Rafal Milecki + +commit 518c8df77c21b7d1690dd8b96eb0e54c4ec1c9c1 upstream. + +Signed-off-by: Rafal Milecki +Signed-off-by: Jean-Francois Moine +Signed-off-by: Mauro Carvalho Chehab +Cc: Surbhi Palande +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/video4linux/gspca.txt | 1 + + drivers/media/video/gspca/ov519.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/Documentation/video4linux/gspca.txt ++++ b/Documentation/video4linux/gspca.txt +@@ -37,6 +37,7 @@ ov519 041e:405f Creative Live! VISTA VF + ov519 041e:4060 Creative Live! VISTA VF0350 + ov519 041e:4061 Creative Live! VISTA VF0400 + ov519 041e:4064 Creative Live! VISTA VF0420 ++ov519 041e:4067 Creative Live! Cam Video IM (VF0350) + ov519 041e:4068 Creative Live! VISTA VF0470 + spca561 0458:7004 Genius VideoCAM Express V2 + sunplus 0458:7006 Genius Dsc 1.3 Smart +--- a/drivers/media/video/gspca/ov519.c ++++ b/drivers/media/video/gspca/ov519.c +@@ -3364,6 +3364,7 @@ static const __devinitdata struct usb_de + {USB_DEVICE(0x041e, 0x4061), .driver_info = BRIDGE_OV519 }, + {USB_DEVICE(0x041e, 0x4064), + .driver_info = BRIDGE_OV519 | BRIDGE_INVERT_LED }, ++ {USB_DEVICE(0x041e, 0x4067), .driver_info = BRIDGE_OV519 }, + {USB_DEVICE(0x041e, 0x4068), + .driver_info = BRIDGE_OV519 | BRIDGE_INVERT_LED }, + {USB_DEVICE(0x045e, 0x028c), .driver_info = BRIDGE_OV519 }, + + diff --git a/queue-2.6.31/md-bitmap-protect-against-bitmap-removal-while-being-updated.patch b/review-2.6.31/md-bitmap-protect-against-bitmap-removal-while-being-updated.patch similarity index 100% rename from queue-2.6.31/md-bitmap-protect-against-bitmap-removal-while-being-updated.patch rename to review-2.6.31/md-bitmap-protect-against-bitmap-removal-while-being-updated.patch diff --git a/queue-2.6.31/mm-hugetlb-fix-hugepage-memory-leak-in-mincore.patch b/review-2.6.31/mm-hugetlb-fix-hugepage-memory-leak-in-mincore.patch similarity index 100% rename from queue-2.6.31/mm-hugetlb-fix-hugepage-memory-leak-in-mincore.patch rename to review-2.6.31/mm-hugetlb-fix-hugepage-memory-leak-in-mincore.patch diff --git a/queue-2.6.31/mm-hugetlb-fix-hugepage-memory-leak-in-walk_page_range.patch b/review-2.6.31/mm-hugetlb-fix-hugepage-memory-leak-in-walk_page_range.patch similarity index 100% rename from queue-2.6.31/mm-hugetlb-fix-hugepage-memory-leak-in-walk_page_range.patch rename to review-2.6.31/mm-hugetlb-fix-hugepage-memory-leak-in-walk_page_range.patch diff --git a/queue-2.6.31/net-fix-the-rollback-test-in-dev_change_name.patch b/review-2.6.31/net-fix-the-rollback-test-in-dev_change_name.patch similarity index 100% rename from queue-2.6.31/net-fix-the-rollback-test-in-dev_change_name.patch rename to review-2.6.31/net-fix-the-rollback-test-in-dev_change_name.patch diff --git a/queue-2.6.31/net-fix-userspace-rtm_newlink-notifications.patch b/review-2.6.31/net-fix-userspace-rtm_newlink-notifications.patch similarity index 100% rename from queue-2.6.31/net-fix-userspace-rtm_newlink-notifications.patch rename to review-2.6.31/net-fix-userspace-rtm_newlink-notifications.patch diff --git a/queue-2.6.31/net-smc91x-fix-irq-flags.patch b/review-2.6.31/net-smc91x-fix-irq-flags.patch similarity index 100% rename from queue-2.6.31/net-smc91x-fix-irq-flags.patch rename to review-2.6.31/net-smc91x-fix-irq-flags.patch diff --git a/queue-2.6.31/p54usb-remove-dma-buffer-from-stack.patch b/review-2.6.31/p54usb-remove-dma-buffer-from-stack.patch similarity index 100% rename from queue-2.6.31/p54usb-remove-dma-buffer-from-stack.patch rename to review-2.6.31/p54usb-remove-dma-buffer-from-stack.patch diff --git a/queue-2.6.31/pata_hpt-37x-3x2n-fix-timing-register-masks-take-2.patch b/review-2.6.31/pata_hpt-37x-3x2n-fix-timing-register-masks-take-2.patch similarity index 100% rename from queue-2.6.31/pata_hpt-37x-3x2n-fix-timing-register-masks-take-2.patch rename to review-2.6.31/pata_hpt-37x-3x2n-fix-timing-register-masks-take-2.patch diff --git a/queue-2.6.31/powerpc-fix-usage-of-64-bit-instruction-in-32-bit-altivec-code.patch b/review-2.6.31/powerpc-fix-usage-of-64-bit-instruction-in-32-bit-altivec-code.patch similarity index 100% rename from queue-2.6.31/powerpc-fix-usage-of-64-bit-instruction-in-32-bit-altivec-code.patch rename to review-2.6.31/powerpc-fix-usage-of-64-bit-instruction-in-32-bit-altivec-code.patch diff --git a/queue-2.6.31/pxa-em-x270-fix-usb-hub-power-up-reset-sequence.patch b/review-2.6.31/pxa-em-x270-fix-usb-hub-power-up-reset-sequence.patch similarity index 100% rename from queue-2.6.31/pxa-em-x270-fix-usb-hub-power-up-reset-sequence.patch rename to review-2.6.31/pxa-em-x270-fix-usb-hub-power-up-reset-sequence.patch diff --git a/queue-2.6.31/revert-ide-try-to-use-pio-mode-0-during-probe-if-possible.patch b/review-2.6.31/revert-ide-try-to-use-pio-mode-0-during-probe-if-possible.patch similarity index 100% rename from queue-2.6.31/revert-ide-try-to-use-pio-mode-0-during-probe-if-possible.patch rename to review-2.6.31/revert-ide-try-to-use-pio-mode-0-during-probe-if-possible.patch diff --git a/queue-2.6.31/revert-isdn-isdn_ppp-use-skb-list-facilities-instead-of-home-grown-implementation.patch b/review-2.6.31/revert-isdn-isdn_ppp-use-skb-list-facilities-instead-of-home-grown-implementation.patch similarity index 100% rename from queue-2.6.31/revert-isdn-isdn_ppp-use-skb-list-facilities-instead-of-home-grown-implementation.patch rename to review-2.6.31/revert-isdn-isdn_ppp-use-skb-list-facilities-instead-of-home-grown-implementation.patch diff --git a/queue-2.6.31/serial-do-not-read-iir-in-serial8250_start_tx-when-uart_bug_txen.patch b/review-2.6.31/serial-do-not-read-iir-in-serial8250_start_tx-when-uart_bug_txen.patch similarity index 100% rename from queue-2.6.31/serial-do-not-read-iir-in-serial8250_start_tx-when-uart_bug_txen.patch rename to review-2.6.31/serial-do-not-read-iir-in-serial8250_start_tx-when-uart_bug_txen.patch diff --git a/queue-2.6.31/serial-suncore-add-ignore_line-argument-to-sunserial_console_match.patch b/review-2.6.31/serial-suncore-add-ignore_line-argument-to-sunserial_console_match.patch similarity index 100% rename from queue-2.6.31/serial-suncore-add-ignore_line-argument-to-sunserial_console_match.patch rename to review-2.6.31/serial-suncore-add-ignore_line-argument-to-sunserial_console_match.patch diff --git a/queue-2.6.31/serial-suncore-fix-rsc-lom-handling-in-sunserial_console_termios.patch b/review-2.6.31/serial-suncore-fix-rsc-lom-handling-in-sunserial_console_termios.patch similarity index 100% rename from queue-2.6.31/serial-suncore-fix-rsc-lom-handling-in-sunserial_console_termios.patch rename to review-2.6.31/serial-suncore-fix-rsc-lom-handling-in-sunserial_console_termios.patch diff --git a/queue-2.6.31/series b/review-2.6.31/series similarity index 100% rename from queue-2.6.31/series rename to review-2.6.31/series diff --git a/queue-2.6.31/slc90e66-fix-udma-handling.patch b/review-2.6.31/slc90e66-fix-udma-handling.patch similarity index 100% rename from queue-2.6.31/slc90e66-fix-udma-handling.patch rename to review-2.6.31/slc90e66-fix-udma-handling.patch diff --git a/queue-2.6.31/smsc9420-prevent-bug-if-ethtool-is-called-with-interface-down.patch b/review-2.6.31/smsc9420-prevent-bug-if-ethtool-is-called-with-interface-down.patch similarity index 100% rename from queue-2.6.31/smsc9420-prevent-bug-if-ethtool-is-called-with-interface-down.patch rename to review-2.6.31/smsc9420-prevent-bug-if-ethtool-is-called-with-interface-down.patch diff --git a/queue-2.6.31/sparc-set-uts_machine-correctly.patch b/review-2.6.31/sparc-set-uts_machine-correctly.patch similarity index 100% rename from queue-2.6.31/sparc-set-uts_machine-correctly.patch rename to review-2.6.31/sparc-set-uts_machine-correctly.patch diff --git a/queue-2.6.31/sparc64-don-t-specify-irqf_shared-for-ldc-interrupts.patch b/review-2.6.31/sparc64-don-t-specify-irqf_shared-for-ldc-interrupts.patch similarity index 100% rename from queue-2.6.31/sparc64-don-t-specify-irqf_shared-for-ldc-interrupts.patch rename to review-2.6.31/sparc64-don-t-specify-irqf_shared-for-ldc-interrupts.patch diff --git a/queue-2.6.31/sparc64-fix-definition-of-vmemmap_size.patch b/review-2.6.31/sparc64-fix-definition-of-vmemmap_size.patch similarity index 100% rename from queue-2.6.31/sparc64-fix-definition-of-vmemmap_size.patch rename to review-2.6.31/sparc64-fix-definition-of-vmemmap_size.patch diff --git a/queue-2.6.31/sparc64-fix-overly-strict-range-type-matching-for-pci-devices.patch b/review-2.6.31/sparc64-fix-overly-strict-range-type-matching-for-pci-devices.patch similarity index 100% rename from queue-2.6.31/sparc64-fix-overly-strict-range-type-matching-for-pci-devices.patch rename to review-2.6.31/sparc64-fix-overly-strict-range-type-matching-for-pci-devices.patch diff --git a/queue-2.6.31/sparc64-fix-stack-debugging-irq-stack-regression.patch b/review-2.6.31/sparc64-fix-stack-debugging-irq-stack-regression.patch similarity index 100% rename from queue-2.6.31/sparc64-fix-stack-debugging-irq-stack-regression.patch rename to review-2.6.31/sparc64-fix-stack-debugging-irq-stack-regression.patch diff --git a/queue-2.6.31/ssb-fix-range-check-in-sprom-write.patch b/review-2.6.31/ssb-fix-range-check-in-sprom-write.patch similarity index 100% rename from queue-2.6.31/ssb-fix-range-check-in-sprom-write.patch rename to review-2.6.31/ssb-fix-range-check-in-sprom-write.patch diff --git a/queue-2.6.31/sunrpc-is_err-ptr_err-confusion.patch b/review-2.6.31/sunrpc-is_err-ptr_err-confusion.patch similarity index 100% rename from queue-2.6.31/sunrpc-is_err-ptr_err-confusion.patch rename to review-2.6.31/sunrpc-is_err-ptr_err-confusion.patch diff --git a/queue-2.6.31/sunsab-do-not-set-sunsab_reg.cons-right-before-registering-minors.patch b/review-2.6.31/sunsab-do-not-set-sunsab_reg.cons-right-before-registering-minors.patch similarity index 100% rename from queue-2.6.31/sunsab-do-not-set-sunsab_reg.cons-right-before-registering-minors.patch rename to review-2.6.31/sunsab-do-not-set-sunsab_reg.cons-right-before-registering-minors.patch diff --git a/queue-2.6.31/sunsu-fix-detection-of-su-ports-which-are-rsc-console-or-control.patch b/review-2.6.31/sunsu-fix-detection-of-su-ports-which-are-rsc-console-or-control.patch similarity index 100% rename from queue-2.6.31/sunsu-fix-detection-of-su-ports-which-are-rsc-console-or-control.patch rename to review-2.6.31/sunsu-fix-detection-of-su-ports-which-are-rsc-console-or-control.patch diff --git a/queue-2.6.31/sunsu-pass-true-ignore_line-to-console-match-when-rsc-or-lom-console.patch b/review-2.6.31/sunsu-pass-true-ignore_line-to-console-match-when-rsc-or-lom-console.patch similarity index 100% rename from queue-2.6.31/sunsu-pass-true-ignore_line-to-console-match-when-rsc-or-lom-console.patch rename to review-2.6.31/sunsu-pass-true-ignore_line-to-console-match-when-rsc-or-lom-console.patch diff --git a/queue-2.6.31/sunsu-use-sunserial_console_termios-in-sunsu_console_setup.patch b/review-2.6.31/sunsu-use-sunserial_console_termios-in-sunsu_console_setup.patch similarity index 100% rename from queue-2.6.31/sunsu-use-sunserial_console_termios-in-sunsu_console_setup.patch rename to review-2.6.31/sunsu-use-sunserial_console_termios-in-sunsu_console_setup.patch diff --git a/queue-2.6.31/sysctl_max_map_count-should-be-non-negative.patch b/review-2.6.31/sysctl_max_map_count-should-be-non-negative.patch similarity index 100% rename from queue-2.6.31/sysctl_max_map_count-should-be-non-negative.patch rename to review-2.6.31/sysctl_max_map_count-should-be-non-negative.patch diff --git a/queue-2.6.31/thinkpad-acpi-fix-default-brightness_mode-for-r50e-r51.patch b/review-2.6.31/thinkpad-acpi-fix-default-brightness_mode-for-r50e-r51.patch similarity index 100% rename from queue-2.6.31/thinkpad-acpi-fix-default-brightness_mode-for-r50e-r51.patch rename to review-2.6.31/thinkpad-acpi-fix-default-brightness_mode-for-r50e-r51.patch diff --git a/queue-2.6.31/thinkpad-acpi-preserve-rfkill-state-across-suspend-resume.patch b/review-2.6.31/thinkpad-acpi-preserve-rfkill-state-across-suspend-resume.patch similarity index 100% rename from queue-2.6.31/thinkpad-acpi-preserve-rfkill-state-across-suspend-resume.patch rename to review-2.6.31/thinkpad-acpi-preserve-rfkill-state-across-suspend-resume.patch diff --git a/queue-2.6.31/usb-close-usb_find_interface-race-v3.patch b/review-2.6.31/usb-close-usb_find_interface-race-v3.patch similarity index 100% rename from queue-2.6.31/usb-close-usb_find_interface-race-v3.patch rename to review-2.6.31/usb-close-usb_find_interface-race-v3.patch diff --git a/queue-2.6.31/usb-musb_gadget_ep0-fix-unhandled-endpoint-0-irqs-again.patch b/review-2.6.31/usb-musb_gadget_ep0-fix-unhandled-endpoint-0-irqs-again.patch similarity index 100% rename from queue-2.6.31/usb-musb_gadget_ep0-fix-unhandled-endpoint-0-irqs-again.patch rename to review-2.6.31/usb-musb_gadget_ep0-fix-unhandled-endpoint-0-irqs-again.patch diff --git a/queue-2.6.31/usb-option-add-pid-for-zte.patch b/review-2.6.31/usb-option-add-pid-for-zte.patch similarity index 100% rename from queue-2.6.31/usb-option-add-pid-for-zte.patch rename to review-2.6.31/usb-option-add-pid-for-zte.patch diff --git a/queue-2.6.31/usb-option.c-add-support-for-d-link-dwm-162-u5.patch b/review-2.6.31/usb-option.c-add-support-for-d-link-dwm-162-u5.patch similarity index 100% rename from queue-2.6.31/usb-option.c-add-support-for-d-link-dwm-162-u5.patch rename to review-2.6.31/usb-option.c-add-support-for-d-link-dwm-162-u5.patch diff --git a/queue-2.6.31/usb-usb-storage-add-bad_sense-flag.patch b/review-2.6.31/usb-usb-storage-add-bad_sense-flag.patch similarity index 100% rename from queue-2.6.31/usb-usb-storage-add-bad_sense-flag.patch rename to review-2.6.31/usb-usb-storage-add-bad_sense-flag.patch diff --git a/queue-2.6.31/usb-usb-storage-fix-bug-in-fill_inquiry.patch b/review-2.6.31/usb-usb-storage-fix-bug-in-fill_inquiry.patch similarity index 100% rename from queue-2.6.31/usb-usb-storage-fix-bug-in-fill_inquiry.patch rename to review-2.6.31/usb-usb-storage-fix-bug-in-fill_inquiry.patch diff --git a/queue-2.6.31/usb-usbtmc-repeat-usb_bulk_msg-until-whole-message-is-transfered.patch b/review-2.6.31/usb-usbtmc-repeat-usb_bulk_msg-until-whole-message-is-transfered.patch similarity index 100% rename from queue-2.6.31/usb-usbtmc-repeat-usb_bulk_msg-until-whole-message-is-transfered.patch rename to review-2.6.31/usb-usbtmc-repeat-usb_bulk_msg-until-whole-message-is-transfered.patch diff --git a/queue-2.6.31/v4l-dvb-13116-gspca-ov519-webcam-041e-4067-added.patch b/review-2.6.31/v4l-dvb-13116-gspca-ov519-webcam-041e-4067-added.patch similarity index 100% rename from queue-2.6.31/v4l-dvb-13116-gspca-ov519-webcam-041e-4067-added.patch rename to review-2.6.31/v4l-dvb-13116-gspca-ov519-webcam-041e-4067-added.patch diff --git a/queue-2.6.31/v4l-dvb-fix-test-in-copy_reg_bits.patch b/review-2.6.31/v4l-dvb-fix-test-in-copy_reg_bits.patch similarity index 100% rename from queue-2.6.31/v4l-dvb-fix-test-in-copy_reg_bits.patch rename to review-2.6.31/v4l-dvb-fix-test-in-copy_reg_bits.patch diff --git a/queue-2.6.31/vlan-fix-register_vlan_dev-error-path.patch b/review-2.6.31/vlan-fix-register_vlan_dev-error-path.patch similarity index 100% rename from queue-2.6.31/vlan-fix-register_vlan_dev-error-path.patch rename to review-2.6.31/vlan-fix-register_vlan_dev-error-path.patch diff --git a/queue-2.6.31/x86-add-new-intel-cpu-cache-size-descriptors.patch b/review-2.6.31/x86-add-new-intel-cpu-cache-size-descriptors.patch similarity index 100% rename from queue-2.6.31/x86-add-new-intel-cpu-cache-size-descriptors.patch rename to review-2.6.31/x86-add-new-intel-cpu-cache-size-descriptors.patch diff --git a/queue-2.6.31/x86-amd-iommu-attach-devices-to-pre-allocated-domains-early.patch b/review-2.6.31/x86-amd-iommu-attach-devices-to-pre-allocated-domains-early.patch similarity index 100% rename from queue-2.6.31/x86-amd-iommu-attach-devices-to-pre-allocated-domains-early.patch rename to review-2.6.31/x86-amd-iommu-attach-devices-to-pre-allocated-domains-early.patch diff --git a/queue-2.6.31/x86-amd-iommu-un__init-iommu_setup_msi.patch b/review-2.6.31/x86-amd-iommu-un__init-iommu_setup_msi.patch similarity index 100% rename from queue-2.6.31/x86-amd-iommu-un__init-iommu_setup_msi.patch rename to review-2.6.31/x86-amd-iommu-un__init-iommu_setup_msi.patch diff --git a/queue-2.6.31/x86-apic-enable-lapic-nmi-watchdog-on-amd-family-11h.patch b/review-2.6.31/x86-apic-enable-lapic-nmi-watchdog-on-amd-family-11h.patch similarity index 100% rename from queue-2.6.31/x86-apic-enable-lapic-nmi-watchdog-on-amd-family-11h.patch rename to review-2.6.31/x86-apic-enable-lapic-nmi-watchdog-on-amd-family-11h.patch diff --git a/queue-2.6.31/x86-asus-p4s800-reboot-bios-quirk.patch b/review-2.6.31/x86-asus-p4s800-reboot-bios-quirk.patch similarity index 100% rename from queue-2.6.31/x86-asus-p4s800-reboot-bios-quirk.patch rename to review-2.6.31/x86-asus-p4s800-reboot-bios-quirk.patch diff --git a/queue-2.6.31/x86-calgary-iommu-quirk-find-nearest-matching-calgary-while-walking-up-the-pci-tree.patch b/review-2.6.31/x86-calgary-iommu-quirk-find-nearest-matching-calgary-while-walking-up-the-pci-tree.patch similarity index 100% rename from queue-2.6.31/x86-calgary-iommu-quirk-find-nearest-matching-calgary-while-walking-up-the-pci-tree.patch rename to review-2.6.31/x86-calgary-iommu-quirk-find-nearest-matching-calgary-while-walking-up-the-pci-tree.patch diff --git a/queue-2.6.31/x86-fix-iommu-nodac-parameter-handling.patch b/review-2.6.31/x86-fix-iommu-nodac-parameter-handling.patch similarity index 100% rename from queue-2.6.31/x86-fix-iommu-nodac-parameter-handling.patch rename to review-2.6.31/x86-fix-iommu-nodac-parameter-handling.patch diff --git a/queue-2.6.31/x86-fix-typo-in-intel-cpu-cache-size-descriptor.patch b/review-2.6.31/x86-fix-typo-in-intel-cpu-cache-size-descriptor.patch similarity index 92% rename from queue-2.6.31/x86-fix-typo-in-intel-cpu-cache-size-descriptor.patch rename to review-2.6.31/x86-fix-typo-in-intel-cpu-cache-size-descriptor.patch index add25ad893a..74a972b4438 100644 --- a/queue-2.6.31/x86-fix-typo-in-intel-cpu-cache-size-descriptor.patch +++ b/review-2.6.31/x86-fix-typo-in-intel-cpu-cache-size-descriptor.patch @@ -11,8 +11,6 @@ I double-checked the datasheet. One of the existing descriptors has a typo: it should be 2MB not 2038 KB. Signed-off-by: Dave Jones -Cc: # .3x.x: 85160b9: x86: Add new Intel CPU cache size descriptors -Cc: # .3x.x LKML-Reference: <20091110200120.GA27090@redhat.com> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman diff --git a/queue-2.6.31/x86-gart-pci-gart_64.c-use-correct-length-in-strncmp.patch b/review-2.6.31/x86-gart-pci-gart_64.c-use-correct-length-in-strncmp.patch similarity index 100% rename from queue-2.6.31/x86-gart-pci-gart_64.c-use-correct-length-in-strncmp.patch rename to review-2.6.31/x86-gart-pci-gart_64.c-use-correct-length-in-strncmp.patch diff --git a/queue-2.6.31/x86-mce-set-up-timer-unconditionally.patch b/review-2.6.31/x86-mce-set-up-timer-unconditionally.patch similarity index 100% rename from queue-2.6.31/x86-mce-set-up-timer-unconditionally.patch rename to review-2.6.31/x86-mce-set-up-timer-unconditionally.patch diff --git a/queue-2.6.31/x86-under-bios-control-restore-ap-s-apic_lvtthmr-to-the-bsp-value.patch b/review-2.6.31/x86-under-bios-control-restore-ap-s-apic_lvtthmr-to-the-bsp-value.patch similarity index 100% rename from queue-2.6.31/x86-under-bios-control-restore-ap-s-apic_lvtthmr-to-the-bsp-value.patch rename to review-2.6.31/x86-under-bios-control-restore-ap-s-apic_lvtthmr-to-the-bsp-value.patch