From: Greg Kroah-Hartman Date: Thu, 17 Dec 2009 04:12:51 +0000 (-0800) Subject: start 2.6.32.2 review cycle X-Git-Tag: v2.6.27.42~5 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ee3f27ef09c1b81fc74ef55de46a05e07d442eb5;p=thirdparty%2Fkernel%2Fstable-queue.git start 2.6.32.2 review cycle --- diff --git a/queue-2.6.32/acerhdf-add-new-bios-versions.patch b/review-2.6.32/acerhdf-add-new-bios-versions.patch similarity index 100% rename from queue-2.6.32/acerhdf-add-new-bios-versions.patch rename to review-2.6.32/acerhdf-add-new-bios-versions.patch diff --git a/queue-2.6.32/acpi-use-the-arb_disable-for-the-cpu-which-model-id-is-less-than-0x0f.patch b/review-2.6.32/acpi-use-the-arb_disable-for-the-cpu-which-model-id-is-less-than-0x0f.patch similarity index 95% rename from queue-2.6.32/acpi-use-the-arb_disable-for-the-cpu-which-model-id-is-less-than-0x0f.patch rename to review-2.6.32/acpi-use-the-arb_disable-for-the-cpu-which-model-id-is-less-than-0x0f.patch index ff72d59fdbf..cfe856fe4e1 100644 --- a/queue-2.6.32/acpi-use-the-arb_disable-for-the-cpu-which-model-id-is-less-than-0x0f.patch +++ b/review-2.6.32/acpi-use-the-arb_disable-for-the-cpu-which-model-id-is-less-than-0x0f.patch @@ -20,7 +20,7 @@ So we still use the ARB_DISABLE for the cpu which mode id is less than 0x0f. http://bugzilla.kernel.org/show_bug.cgi?id=14700 Signed-off-by: Zhao Yakui -Acked-by: Pallipadi, Venkatesh +Acked-by: Venkatesh Pallipadi Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman diff --git a/queue-2.6.32/alsa-hda-terradici-hda-controllers-does-not-support-64-bit-mode.patch b/review-2.6.32/alsa-hda-terradici-hda-controllers-does-not-support-64-bit-mode.patch similarity index 100% rename from queue-2.6.32/alsa-hda-terradici-hda-controllers-does-not-support-64-bit-mode.patch rename to review-2.6.32/alsa-hda-terradici-hda-controllers-does-not-support-64-bit-mode.patch diff --git a/queue-2.6.32/alsa-hrtimer-fix-lock-up.patch b/review-2.6.32/alsa-hrtimer-fix-lock-up.patch similarity index 100% rename from queue-2.6.32/alsa-hrtimer-fix-lock-up.patch rename to review-2.6.32/alsa-hrtimer-fix-lock-up.patch diff --git a/queue-2.6.32/asus-laptop-change-light-sens-default-values.patch b/review-2.6.32/asus-laptop-change-light-sens-default-values.patch similarity index 100% rename from queue-2.6.32/asus-laptop-change-light-sens-default-values.patch rename to review-2.6.32/asus-laptop-change-light-sens-default-values.patch diff --git a/queue-2.6.32/ath5k-allow-setting-txpower-to-0.patch b/review-2.6.32/ath5k-allow-setting-txpower-to-0.patch similarity index 100% rename from queue-2.6.32/ath5k-allow-setting-txpower-to-0.patch rename to review-2.6.32/ath5k-allow-setting-txpower-to-0.patch diff --git a/queue-2.6.32/ath5k-enable-eeprom-checksum-check.patch b/review-2.6.32/ath5k-enable-eeprom-checksum-check.patch similarity index 100% rename from queue-2.6.32/ath5k-enable-eeprom-checksum-check.patch rename to review-2.6.32/ath5k-enable-eeprom-checksum-check.patch diff --git a/queue-2.6.32/ath9k-fix-maximum-tx-fifo-settings-for-single-stream-devices.patch b/review-2.6.32/ath9k-fix-maximum-tx-fifo-settings-for-single-stream-devices.patch similarity index 100% rename from queue-2.6.32/ath9k-fix-maximum-tx-fifo-settings-for-single-stream-devices.patch rename to review-2.6.32/ath9k-fix-maximum-tx-fifo-settings-for-single-stream-devices.patch diff --git a/queue-2.6.32/ath9k-fix-processing-of-tx-ps-null-data-frames.patch b/review-2.6.32/ath9k-fix-processing-of-tx-ps-null-data-frames.patch similarity index 100% rename from queue-2.6.32/ath9k-fix-processing-of-tx-ps-null-data-frames.patch rename to review-2.6.32/ath9k-fix-processing-of-tx-ps-null-data-frames.patch diff --git a/queue-2.6.32/ath9k-fix-tx-hang-poll-routine.patch b/review-2.6.32/ath9k-fix-tx-hang-poll-routine.patch similarity index 100% rename from queue-2.6.32/ath9k-fix-tx-hang-poll-routine.patch rename to review-2.6.32/ath9k-fix-tx-hang-poll-routine.patch diff --git a/queue-2.6.32/ath9k-fix-tx-status-reporting.patch b/review-2.6.32/ath9k-fix-tx-status-reporting.patch similarity index 100% rename from queue-2.6.32/ath9k-fix-tx-status-reporting.patch rename to review-2.6.32/ath9k-fix-tx-status-reporting.patch diff --git a/queue-2.6.32/b43legacy-avoid-ppc-fault-during-resume.patch b/review-2.6.32/b43legacy-avoid-ppc-fault-during-resume.patch similarity index 100% rename from queue-2.6.32/b43legacy-avoid-ppc-fault-during-resume.patch rename to review-2.6.32/b43legacy-avoid-ppc-fault-during-resume.patch diff --git a/queue-2.6.32/b44-wol-setup-one-bit-off-stack-corruption-kernel-panic-fix.patch b/review-2.6.32/b44-wol-setup-one-bit-off-stack-corruption-kernel-panic-fix.patch similarity index 100% rename from queue-2.6.32/b44-wol-setup-one-bit-off-stack-corruption-kernel-panic-fix.patch rename to review-2.6.32/b44-wol-setup-one-bit-off-stack-corruption-kernel-panic-fix.patch diff --git a/queue-2.6.32/bcm63xx_enet-fix-compilation-failure-after-get_stats_count-removal.patch b/review-2.6.32/bcm63xx_enet-fix-compilation-failure-after-get_stats_count-removal.patch similarity index 100% rename from queue-2.6.32/bcm63xx_enet-fix-compilation-failure-after-get_stats_count-removal.patch rename to review-2.6.32/bcm63xx_enet-fix-compilation-failure-after-get_stats_count-removal.patch diff --git a/queue-2.6.32/bsdacct-fix-uid-gid-misreporting.patch b/review-2.6.32/bsdacct-fix-uid-gid-misreporting.patch similarity index 100% rename from queue-2.6.32/bsdacct-fix-uid-gid-misreporting.patch rename to review-2.6.32/bsdacct-fix-uid-gid-misreporting.patch diff --git a/queue-2.6.32/debugfs-fix-create-mutex-racy-fops-and-private-data.patch b/review-2.6.32/debugfs-fix-create-mutex-racy-fops-and-private-data.patch similarity index 100% rename from queue-2.6.32/debugfs-fix-create-mutex-racy-fops-and-private-data.patch rename to review-2.6.32/debugfs-fix-create-mutex-racy-fops-and-private-data.patch diff --git a/queue-2.6.32/devpts_get_tty-should-validate-inode.patch b/review-2.6.32/devpts_get_tty-should-validate-inode.patch similarity index 100% rename from queue-2.6.32/devpts_get_tty-should-validate-inode.patch rename to review-2.6.32/devpts_get_tty-should-validate-inode.patch diff --git a/queue-2.6.32/dm-avoid-_hash_lock-deadlock.patch b/review-2.6.32/dm-avoid-_hash_lock-deadlock.patch similarity index 100% rename from queue-2.6.32/dm-avoid-_hash_lock-deadlock.patch rename to review-2.6.32/dm-avoid-_hash_lock-deadlock.patch diff --git a/queue-2.6.32/dm-crypt-make-wipe-message-also-wipe-essiv-key.patch b/review-2.6.32/dm-crypt-make-wipe-message-also-wipe-essiv-key.patch similarity index 100% rename from queue-2.6.32/dm-crypt-make-wipe-message-also-wipe-essiv-key.patch rename to review-2.6.32/dm-crypt-make-wipe-message-also-wipe-essiv-key.patch diff --git a/queue-2.6.32/dm-crypt-move-private-iv-fields-to-structs.patch b/review-2.6.32/dm-crypt-move-private-iv-fields-to-structs.patch similarity index 100% rename from queue-2.6.32/dm-crypt-move-private-iv-fields-to-structs.patch rename to review-2.6.32/dm-crypt-move-private-iv-fields-to-structs.patch diff --git a/queue-2.6.32/dm-crypt-restructure-essiv-error-path.patch b/review-2.6.32/dm-crypt-restructure-essiv-error-path.patch similarity index 100% rename from queue-2.6.32/dm-crypt-restructure-essiv-error-path.patch rename to review-2.6.32/dm-crypt-restructure-essiv-error-path.patch diff --git a/queue-2.6.32/dm-crypt-separate-essiv-allocation-from-initialisation.patch b/review-2.6.32/dm-crypt-separate-essiv-allocation-from-initialisation.patch similarity index 100% rename from queue-2.6.32/dm-crypt-separate-essiv-allocation-from-initialisation.patch rename to review-2.6.32/dm-crypt-separate-essiv-allocation-from-initialisation.patch diff --git a/queue-2.6.32/dm-exception-store-free-tmp_store-on-persistent-flag-error.patch b/review-2.6.32/dm-exception-store-free-tmp_store-on-persistent-flag-error.patch similarity index 100% rename from queue-2.6.32/dm-exception-store-free-tmp_store-on-persistent-flag-error.patch rename to review-2.6.32/dm-exception-store-free-tmp_store-on-persistent-flag-error.patch diff --git a/queue-2.6.32/dm-snapshot-cope-with-chunk-size-larger-than-origin.patch b/review-2.6.32/dm-snapshot-cope-with-chunk-size-larger-than-origin.patch similarity index 100% rename from queue-2.6.32/dm-snapshot-cope-with-chunk-size-larger-than-origin.patch rename to review-2.6.32/dm-snapshot-cope-with-chunk-size-larger-than-origin.patch diff --git a/queue-2.6.32/dm-snapshot-only-take-lock-for-statustype-info-not-table.patch b/review-2.6.32/dm-snapshot-only-take-lock-for-statustype-info-not-table.patch similarity index 100% rename from queue-2.6.32/dm-snapshot-only-take-lock-for-statustype-info-not-table.patch rename to review-2.6.32/dm-snapshot-only-take-lock-for-statustype-info-not-table.patch diff --git a/queue-2.6.32/driver-core-fix-race-in-dev_driver_string.patch b/review-2.6.32/driver-core-fix-race-in-dev_driver_string.patch similarity index 100% rename from queue-2.6.32/driver-core-fix-race-in-dev_driver_string.patch rename to review-2.6.32/driver-core-fix-race-in-dev_driver_string.patch diff --git a/queue-2.6.32/drm-i915-add-the-missing-clonemask-for-display-port-on-ironlake.patch b/review-2.6.32/drm-i915-add-the-missing-clonemask-for-display-port-on-ironlake.patch similarity index 100% rename from queue-2.6.32/drm-i915-add-the-missing-clonemask-for-display-port-on-ironlake.patch rename to review-2.6.32/drm-i915-add-the-missing-clonemask-for-display-port-on-ironlake.patch diff --git a/queue-2.6.32/drm-i915-avoid-null-dereference-with-component_only-tv_modes.patch b/review-2.6.32/drm-i915-avoid-null-dereference-with-component_only-tv_modes.patch similarity index 100% rename from queue-2.6.32/drm-i915-avoid-null-dereference-with-component_only-tv_modes.patch rename to review-2.6.32/drm-i915-avoid-null-dereference-with-component_only-tv_modes.patch diff --git a/queue-2.6.32/drm-i915-fix-lvds-stability-issue-on-ironlake.patch b/review-2.6.32/drm-i915-fix-lvds-stability-issue-on-ironlake.patch similarity index 100% rename from queue-2.6.32/drm-i915-fix-lvds-stability-issue-on-ironlake.patch rename to review-2.6.32/drm-i915-fix-lvds-stability-issue-on-ironlake.patch diff --git a/queue-2.6.32/drm-i915-fix-sync-to-vblank-when-vga-output-is-turned-off.patch b/review-2.6.32/drm-i915-fix-sync-to-vblank-when-vga-output-is-turned-off.patch similarity index 100% rename from queue-2.6.32/drm-i915-fix-sync-to-vblank-when-vga-output-is-turned-off.patch rename to review-2.6.32/drm-i915-fix-sync-to-vblank-when-vga-output-is-turned-off.patch diff --git a/queue-2.6.32/drm-i915-pineview-only-has-lvds-and-crt-ports.patch b/review-2.6.32/drm-i915-pineview-only-has-lvds-and-crt-ports.patch similarity index 100% rename from queue-2.6.32/drm-i915-pineview-only-has-lvds-and-crt-ports.patch rename to review-2.6.32/drm-i915-pineview-only-has-lvds-and-crt-ports.patch diff --git a/queue-2.6.32/drm-i915-set-the-error-code-after-failing-to-insert-new-offset-into-mm-ht.patch b/review-2.6.32/drm-i915-set-the-error-code-after-failing-to-insert-new-offset-into-mm-ht.patch similarity index 100% rename from queue-2.6.32/drm-i915-set-the-error-code-after-failing-to-insert-new-offset-into-mm-ht.patch rename to review-2.6.32/drm-i915-set-the-error-code-after-failing-to-insert-new-offset-into-mm-ht.patch diff --git a/queue-2.6.32/drm-radeon-kms-add-quirk-for-his-x1300-board.patch b/review-2.6.32/drm-radeon-kms-add-quirk-for-his-x1300-board.patch similarity index 100% rename from queue-2.6.32/drm-radeon-kms-add-quirk-for-his-x1300-board.patch rename to review-2.6.32/drm-radeon-kms-add-quirk-for-his-x1300-board.patch diff --git a/queue-2.6.32/drm-radeon-kms-fix-legacy-crtc2-dpms.patch b/review-2.6.32/drm-radeon-kms-fix-legacy-crtc2-dpms.patch similarity index 100% rename from queue-2.6.32/drm-radeon-kms-fix-legacy-crtc2-dpms.patch rename to review-2.6.32/drm-radeon-kms-fix-legacy-crtc2-dpms.patch diff --git a/queue-2.6.32/drm-radeon-kms-fix-vram-setup-on-rs600.patch b/review-2.6.32/drm-radeon-kms-fix-vram-setup-on-rs600.patch similarity index 100% rename from queue-2.6.32/drm-radeon-kms-fix-vram-setup-on-rs600.patch rename to review-2.6.32/drm-radeon-kms-fix-vram-setup-on-rs600.patch diff --git a/queue-2.6.32/drm-radeon-kms-handle-vblanks-properly-with-dpms-on.patch b/review-2.6.32/drm-radeon-kms-handle-vblanks-properly-with-dpms-on.patch similarity index 100% rename from queue-2.6.32/drm-radeon-kms-handle-vblanks-properly-with-dpms-on.patch rename to review-2.6.32/drm-radeon-kms-handle-vblanks-properly-with-dpms-on.patch diff --git a/queue-2.6.32/drm-radeon-kms-rs6xx-rs740-clamp-vram-to-aperture-size.patch b/review-2.6.32/drm-radeon-kms-rs6xx-rs740-clamp-vram-to-aperture-size.patch similarity index 100% rename from queue-2.6.32/drm-radeon-kms-rs6xx-rs740-clamp-vram-to-aperture-size.patch rename to review-2.6.32/drm-radeon-kms-rs6xx-rs740-clamp-vram-to-aperture-size.patch diff --git a/queue-2.6.32/drm-ttm-fix-build-failure-due-to-missing-struct-page.patch b/review-2.6.32/drm-ttm-fix-build-failure-due-to-missing-struct-page.patch similarity index 100% rename from queue-2.6.32/drm-ttm-fix-build-failure-due-to-missing-struct-page.patch rename to review-2.6.32/drm-ttm-fix-build-failure-due-to-missing-struct-page.patch diff --git a/queue-2.6.32/ext3-fix-data-filesystem-corruption-when-write-fails-to-copy-data.patch b/review-2.6.32/ext3-fix-data-filesystem-corruption-when-write-fails-to-copy-data.patch similarity index 100% rename from queue-2.6.32/ext3-fix-data-filesystem-corruption-when-write-fails-to-copy-data.patch rename to review-2.6.32/ext3-fix-data-filesystem-corruption-when-write-fails-to-copy-data.patch diff --git a/queue-2.6.32/firewire-ohci-handle-receive-packets-with-a-data-length-of-zero.patch b/review-2.6.32/firewire-ohci-handle-receive-packets-with-a-data-length-of-zero.patch similarity index 100% rename from queue-2.6.32/firewire-ohci-handle-receive-packets-with-a-data-length-of-zero.patch rename to review-2.6.32/firewire-ohci-handle-receive-packets-with-a-data-length-of-zero.patch diff --git a/queue-2.6.32/futex-take-mmap_sem-for-get_user_pages-in-fault_in_user_writeable.patch b/review-2.6.32/futex-take-mmap_sem-for-get_user_pages-in-fault_in_user_writeable.patch similarity index 100% rename from queue-2.6.32/futex-take-mmap_sem-for-get_user_pages-in-fault_in_user_writeable.patch rename to review-2.6.32/futex-take-mmap_sem-for-get_user_pages-in-fault_in_user_writeable.patch diff --git a/queue-2.6.32/hfs-fix-a-potential-buffer-overflow.patch b/review-2.6.32/hfs-fix-a-potential-buffer-overflow.patch similarity index 100% rename from queue-2.6.32/hfs-fix-a-potential-buffer-overflow.patch rename to review-2.6.32/hfs-fix-a-potential-buffer-overflow.patch diff --git a/queue-2.6.32/hrtimer-fix-proc-timer_list-regression.patch b/review-2.6.32/hrtimer-fix-proc-timer_list-regression.patch similarity index 100% rename from queue-2.6.32/hrtimer-fix-proc-timer_list-regression.patch rename to review-2.6.32/hrtimer-fix-proc-timer_list-regression.patch diff --git a/queue-2.6.32/implement-early_io-re-un-map-for-ia64.patch b/review-2.6.32/implement-early_io-re-un-map-for-ia64.patch similarity index 100% rename from queue-2.6.32/implement-early_io-re-un-map-for-ia64.patch rename to review-2.6.32/implement-early_io-re-un-map-for-ia64.patch diff --git a/queue-2.6.32/intel-iommu-apply-bios-sanity-checks-for-interrupt-remapping-too.patch b/review-2.6.32/intel-iommu-apply-bios-sanity-checks-for-interrupt-remapping-too.patch similarity index 100% rename from queue-2.6.32/intel-iommu-apply-bios-sanity-checks-for-interrupt-remapping-too.patch rename to review-2.6.32/intel-iommu-apply-bios-sanity-checks-for-interrupt-remapping-too.patch diff --git a/queue-2.6.32/intel-iommu-check-for-an-rmrr-which-ends-before-it-starts.patch b/review-2.6.32/intel-iommu-check-for-an-rmrr-which-ends-before-it-starts.patch similarity index 100% rename from queue-2.6.32/intel-iommu-check-for-an-rmrr-which-ends-before-it-starts.patch rename to review-2.6.32/intel-iommu-check-for-an-rmrr-which-ends-before-it-starts.patch diff --git a/queue-2.6.32/intel-iommu-detect-dmar-in-hyperspace-at-probe-time.patch b/review-2.6.32/intel-iommu-detect-dmar-in-hyperspace-at-probe-time.patch similarity index 100% rename from queue-2.6.32/intel-iommu-detect-dmar-in-hyperspace-at-probe-time.patch rename to review-2.6.32/intel-iommu-detect-dmar-in-hyperspace-at-probe-time.patch diff --git a/queue-2.6.32/intel-iommu-fix-oops-with-intel_iommu-igfx_off.patch b/review-2.6.32/intel-iommu-fix-oops-with-intel_iommu-igfx_off.patch similarity index 100% rename from queue-2.6.32/intel-iommu-fix-oops-with-intel_iommu-igfx_off.patch rename to review-2.6.32/intel-iommu-fix-oops-with-intel_iommu-igfx_off.patch diff --git a/queue-2.6.32/intel-iommu-ignore-page-table-validation-in-pass-through-mode.patch b/review-2.6.32/intel-iommu-ignore-page-table-validation-in-pass-through-mode.patch similarity index 100% rename from queue-2.6.32/intel-iommu-ignore-page-table-validation-in-pass-through-mode.patch rename to review-2.6.32/intel-iommu-ignore-page-table-validation-in-pass-through-mode.patch diff --git a/queue-2.6.32/ip_fragment-also-adjust-skb-truesize-for-packets-not-owned-by-a-socket.patch b/review-2.6.32/ip_fragment-also-adjust-skb-truesize-for-packets-not-owned-by-a-socket.patch similarity index 100% rename from queue-2.6.32/ip_fragment-also-adjust-skb-truesize-for-packets-not-owned-by-a-socket.patch rename to review-2.6.32/ip_fragment-also-adjust-skb-truesize-for-packets-not-owned-by-a-socket.patch diff --git a/queue-2.6.32/ipvs-zero-usvc-and-udest.patch b/review-2.6.32/ipvs-zero-usvc-and-udest.patch similarity index 100% rename from queue-2.6.32/ipvs-zero-usvc-and-udest.patch rename to review-2.6.32/ipvs-zero-usvc-and-udest.patch diff --git a/queue-2.6.32/ipw2100-fix-rebooting-hang-with-driver-loaded.patch b/review-2.6.32/ipw2100-fix-rebooting-hang-with-driver-loaded.patch similarity index 100% rename from queue-2.6.32/ipw2100-fix-rebooting-hang-with-driver-loaded.patch rename to review-2.6.32/ipw2100-fix-rebooting-hang-with-driver-loaded.patch diff --git a/queue-2.6.32/jbd2-don-t-wipe-the-journal-on-a-failed-journal-checksum.patch b/review-2.6.32/jbd2-don-t-wipe-the-journal-on-a-failed-journal-checksum.patch similarity index 100% rename from queue-2.6.32/jbd2-don-t-wipe-the-journal-on-a-failed-journal-checksum.patch rename to review-2.6.32/jbd2-don-t-wipe-the-journal-on-a-failed-journal-checksum.patch diff --git a/queue-2.6.32/jffs2-fix-long-standing-bug-with-symlink-garbage-collection.patch b/review-2.6.32/jffs2-fix-long-standing-bug-with-symlink-garbage-collection.patch similarity index 100% rename from queue-2.6.32/jffs2-fix-long-standing-bug-with-symlink-garbage-collection.patch rename to review-2.6.32/jffs2-fix-long-standing-bug-with-symlink-garbage-collection.patch diff --git a/queue-2.6.32/kvm-fix-irq_source_id-size-verification.patch b/review-2.6.32/kvm-fix-irq_source_id-size-verification.patch similarity index 100% rename from queue-2.6.32/kvm-fix-irq_source_id-size-verification.patch rename to review-2.6.32/kvm-fix-irq_source_id-size-verification.patch diff --git a/queue-2.6.32/kvm-s390-fix-prefix-register-checking-in-arch-s390-kvm-sigp.c.patch b/review-2.6.32/kvm-s390-fix-prefix-register-checking-in-arch-s390-kvm-sigp.c.patch similarity index 100% rename from queue-2.6.32/kvm-s390-fix-prefix-register-checking-in-arch-s390-kvm-sigp.c.patch rename to review-2.6.32/kvm-s390-fix-prefix-register-checking-in-arch-s390-kvm-sigp.c.patch diff --git a/queue-2.6.32/kvm-s390-make-psw-available-on-all-exits-not-just-a-subset.patch b/review-2.6.32/kvm-s390-make-psw-available-on-all-exits-not-just-a-subset.patch similarity index 100% rename from queue-2.6.32/kvm-s390-make-psw-available-on-all-exits-not-just-a-subset.patch rename to review-2.6.32/kvm-s390-make-psw-available-on-all-exits-not-just-a-subset.patch diff --git a/queue-2.6.32/kvm-x86-emulator-limit-instructions-to-15-bytes.patch b/review-2.6.32/kvm-x86-emulator-limit-instructions-to-15-bytes.patch similarity index 100% rename from queue-2.6.32/kvm-x86-emulator-limit-instructions-to-15-bytes.patch rename to review-2.6.32/kvm-x86-emulator-limit-instructions-to-15-bytes.patch diff --git a/queue-2.6.32/kvm-x86-include-pvclock-msrs-in-msrs_to_save.patch b/review-2.6.32/kvm-x86-include-pvclock-msrs-in-msrs_to_save.patch similarity index 100% rename from queue-2.6.32/kvm-x86-include-pvclock-msrs-in-msrs_to_save.patch rename to review-2.6.32/kvm-x86-include-pvclock-msrs-in-msrs_to_save.patch diff --git a/queue-2.6.32/mac80211-fix-bug-in-computing-crc-over-dynamic-ies-in-beacon.patch b/review-2.6.32/mac80211-fix-bug-in-computing-crc-over-dynamic-ies-in-beacon.patch similarity index 100% rename from queue-2.6.32/mac80211-fix-bug-in-computing-crc-over-dynamic-ies-in-beacon.patch rename to review-2.6.32/mac80211-fix-bug-in-computing-crc-over-dynamic-ies-in-beacon.patch diff --git a/queue-2.6.32/mac80211-fix-dynamic-power-save-for-scanning.patch b/review-2.6.32/mac80211-fix-dynamic-power-save-for-scanning.patch similarity index 100% rename from queue-2.6.32/mac80211-fix-dynamic-power-save-for-scanning.patch rename to review-2.6.32/mac80211-fix-dynamic-power-save-for-scanning.patch diff --git a/queue-2.6.32/mac80211-fix-scan-abort-sanity-checks.patch b/review-2.6.32/mac80211-fix-scan-abort-sanity-checks.patch similarity index 100% rename from queue-2.6.32/mac80211-fix-scan-abort-sanity-checks.patch rename to review-2.6.32/mac80211-fix-scan-abort-sanity-checks.patch diff --git a/queue-2.6.32/mac80211-fixed-bug-in-mesh-portal-paths.patch b/review-2.6.32/mac80211-fixed-bug-in-mesh-portal-paths.patch similarity index 100% rename from queue-2.6.32/mac80211-fixed-bug-in-mesh-portal-paths.patch rename to review-2.6.32/mac80211-fixed-bug-in-mesh-portal-paths.patch diff --git a/queue-2.6.32/mac80211-revert-use-correct-sign-for-mesh-active-path-refresh.patch b/review-2.6.32/mac80211-revert-use-correct-sign-for-mesh-active-path-refresh.patch similarity index 100% rename from queue-2.6.32/mac80211-revert-use-correct-sign-for-mesh-active-path-refresh.patch rename to review-2.6.32/mac80211-revert-use-correct-sign-for-mesh-active-path-refresh.patch diff --git a/queue-2.6.32/matroxfb-fix-problems-with-display-stability.patch b/review-2.6.32/matroxfb-fix-problems-with-display-stability.patch similarity index 100% rename from queue-2.6.32/matroxfb-fix-problems-with-display-stability.patch rename to review-2.6.32/matroxfb-fix-problems-with-display-stability.patch diff --git a/review-2.6.32/mbox b/review-2.6.32/mbox new file mode 100644 index 00000000000..65a629b570b --- /dev/null +++ b/review-2.6.32/mbox @@ -0,0 +1,12665 @@ +From gregkh@mini.kroah.org Wed Dec 16 19:56:43 2009 +Message-Id: <20091217035457.723063696@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:54:57 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [000/151] 2.6.32.2-stable review + +This is the start of the stable review cycle for the 2.6.23.2 release. +There are 151 patches in this series, all will be posted as a response +to this one. If anyone has any issues with these being applied, please +let us know. If anyone is a maintainer of the proper subsystem, and +wants to add a Signed-off-by: line to the patch, please respond with it. + +Responses should be made by Friday, December 19, 00:00:00 UTC. +Anything received after that time might be too late. + +The whole patch series can be found in one patch at: + kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.32.2-rc1.gz +and the diffstat can be found below. + +thanks, + +greg k-h + +------------ + + Documentation/Changes | 2 + + Documentation/kernel-parameters.txt | 2 + + Documentation/video4linux/gspca.txt | 1 + + MAINTAINERS | 4 +- + Makefile | 2 +- + arch/arm/mach-pxa/em-x270.c | 11 +- + arch/ia64/include/asm/io.h | 2 + + arch/ia64/mm/ioremap.c | 11 ++ + arch/powerpc/kernel/vector.S | 2 +- + arch/s390/include/asm/kvm.h | 3 +- + arch/s390/kernel/head64.S | 3 + + arch/s390/kvm/kvm-s390.c | 25 ++- + arch/s390/kvm/sigp.c | 6 +- + arch/sparc/Makefile | 2 + + arch/sparc/kernel/ldc.c | 4 +- + arch/sparc/kernel/of_device_64.c | 14 ++- + arch/sparc/lib/mcount.S | 5 +- + arch/x86/Makefile_32.cpu | 7 + + arch/x86/include/asm/irq_vectors.h | 2 +- + arch/x86/include/asm/kvm_emulate.h | 2 +- + arch/x86/include/asm/mce.h | 6 + + arch/x86/kernel/acpi/cstate.c | 2 +- + arch/x86/kernel/amd_iommu.c | 8 +- + arch/x86/kernel/amd_iommu_init.c | 2 +- + arch/x86/kernel/apic/apic.c | 2 +- + arch/x86/kernel/cpu/intel_cacheinfo.c | 5 +- + arch/x86/kernel/cpu/mcheck/mce.c | 9 +- + arch/x86/kernel/cpu/mcheck/therm_throt.c | 29 +++- + arch/x86/kernel/cpu/perfctr-watchdog.c | 2 +- + arch/x86/kernel/pci-calgary_64.c | 12 +- + arch/x86/kernel/pci-dma.c | 2 +- + arch/x86/kernel/pci-gart_64.c | 2 +- + arch/x86/kernel/reboot.c | 8 + + arch/x86/kernel/setup.c | 3 + + arch/x86/kernel/tlb_uv.c | 4 +- + arch/x86/kvm/emulate.c | 5 +- + arch/x86/kvm/x86.c | 12 +- + arch/x86/xen/enlighten.c | 27 ++-- + arch/x86/xen/mmu.c | 2 +- + arch/x86/xen/smp.c | 1 + + arch/x86/xen/suspend.c | 17 ++- + arch/x86/xen/time.c | 7 +- + arch/x86/xen/xen-asm_64.S | 4 +- + arch/x86/xen/xen-ops.h | 2 + + drivers/ata/pata_hpt37x.c | 32 ++-- + drivers/ata/pata_hpt3x2n.c | 17 +- + drivers/base/core.c | 9 +- + drivers/base/power/runtime.c | 2 +- + drivers/firewire/ohci.c | 12 +- + drivers/gpu/drm/drm_irq.c | 34 +++- + drivers/gpu/drm/i915/i915_drv.h | 4 + + drivers/gpu/drm/i915/i915_gem.c | 1 + + drivers/gpu/drm/i915/intel_display.c | 67 +++++--- + drivers/gpu/drm/i915/intel_dp.c | 6 +- + drivers/gpu/drm/i915/intel_tv.c | 11 +- + drivers/gpu/drm/radeon/atombios_crtc.c | 8 +- + drivers/gpu/drm/radeon/radeon_atombios.c | 8 + + drivers/gpu/drm/radeon/radeon_legacy_crtc.c | 7 +- + drivers/gpu/drm/radeon/rs600.c | 15 ++- + drivers/gpu/drm/radeon/rs690.c | 19 +- + drivers/ide/slc90e66.c | 3 +- + drivers/macintosh/therm_adt746x.c | 13 ++- + drivers/macintosh/windfarm_smu_controls.c | 2 + + drivers/md/bitmap.c | 24 ++- + drivers/md/bitmap.h | 2 +- + drivers/md/dm-crypt.c | 170 +++++++++++++------ + drivers/md/dm-exception-store.c | 3 +- + drivers/md/dm-ioctl.c | 17 ++- + drivers/md/dm-snap.c | 12 +- + drivers/md/dm-uevent.c | 9 +- + drivers/md/md.c | 3 +- + drivers/md/md.h | 1 + + drivers/media/common/tuners/mxl5007t.c | 2 +- + drivers/media/video/gspca/ov519.c | 1 + + drivers/mtd/ubi/upd.c | 20 ++- + drivers/net/b44.c | 3 +- + drivers/net/bcm63xx_enet.c | 12 +- + drivers/net/wireless/ath/ath5k/eeprom.c | 3 +- + drivers/net/wireless/ath/ath5k/phy.c | 2 - + drivers/net/wireless/ath/ath9k/ath9k.h | 3 + + drivers/net/wireless/ath/ath9k/hw.c | 11 +- + drivers/net/wireless/ath/ath9k/hw.h | 1 + + drivers/net/wireless/ath/ath9k/mac.c | 6 +- + drivers/net/wireless/ath/ath9k/mac.h | 1 + + drivers/net/wireless/ath/ath9k/main.c | 9 +- + drivers/net/wireless/ath/ath9k/xmit.c | 20 ++- + drivers/net/wireless/b43legacy/rfkill.c | 7 + + drivers/net/wireless/ipw2x00/ipw2100.c | 11 ++ + drivers/net/wireless/rtl818x/rtl8187.h | 5 + + drivers/net/wireless/rtl818x/rtl8187_dev.c | 12 +- + drivers/net/wireless/rtl818x/rtl8187_rfkill.c | 4 +- + drivers/pci/dmar.c | 67 ++++++-- + drivers/pci/intel-iommu.c | 26 +++- + drivers/platform/x86/acerhdf.c | 63 ++++--- + drivers/platform/x86/asus-laptop.c | 4 +- + drivers/platform/x86/thinkpad_acpi.c | 36 +--- + drivers/serial/8250.c | 8 +- + drivers/ssb/sprom.c | 20 ++- + drivers/usb/class/usbtmc.c | 14 +- + drivers/usb/core/usb.c | 31 ++-- + drivers/usb/musb/musb_gadget_ep0.c | 1 - + drivers/usb/serial/option.c | 37 ++++ + drivers/usb/storage/transport.c | 17 ++- + drivers/usb/storage/unusual_devs.h | 7 + + drivers/usb/storage/usb.c | 18 ++- + drivers/video/matrox/g450_pll.c | 3 +- + drivers/xen/balloon.c | 38 +--- + drivers/xen/events.c | 3 + + drivers/xen/manage.c | 37 +++-- + drivers/xen/xenbus/xenbus_probe.c | 6 +- + fs/debugfs/inode.c | 55 ++++--- + fs/devpts/inode.c | 16 ++- + fs/ext3/inode.c | 18 ++- + fs/hfs/catalog.c | 4 + + fs/hfs/dir.c | 11 ++ + fs/hfs/super.c | 7 +- + fs/jbd2/journal.c | 7 + + fs/jffs2/gc.c | 3 +- + fs/nfs/write.c | 5 +- + include/drm/drmP.h | 1 + + include/drm/ttm/ttm_memory.h | 1 + + include/linux/hrtimer.h | 4 +- + include/linux/kvm.h | 8 +- + include/linux/perf_event.h | 2 +- + include/linux/usb_usual.h | 4 +- + include/linux/vmalloc.h | 2 + + include/net/tcp.h | 10 +- + include/trace/ftrace.h | 2 +- + kernel/acct.c | 3 +- + kernel/futex.c | 10 +- + kernel/perf_event.c | 6 +- + kernel/rcutree.c | 227 +++++++++++++++---------- + kernel/rcutree.h | 13 +- + kernel/rcutree_plugin.h | 4 +- + kernel/sched.c | 28 +++- + kernel/sched_debug.c | 4 + + kernel/sched_fair.c | 35 ++++- + kernel/sysctl.c | 3 +- + mm/memcontrol.c | 1 + + mm/memory.c | 4 +- + mm/mincore.c | 37 ++++ + mm/pagewalk.c | 16 ++- + mm/vmalloc.c | 2 + + net/core/dev.c | 11 ++ + net/core/rtnetlink.c | 4 +- + net/ipv4/ip_output.c | 2 +- + net/mac80211/cfg.c | 3 +- + net/mac80211/ieee80211_i.h | 1 + + net/mac80211/mesh.h | 5 +- + net/mac80211/mesh_hwmp.c | 2 +- + net/mac80211/rx.c | 1 - + net/mac80211/scan.c | 32 +++- + net/mac80211/util.c | 2 +- + net/netfilter/ipvs/ip_vs_ctl.c | 4 + + net/sunrpc/auth_gss/auth_gss.c | 2 +- + sound/core/hrtimer.c | 15 ++- + sound/pci/hda/hda_intel.c | 5 + + virt/kvm/irq_comm.c | 7 +- + 158 files changed, 1395 insertions(+), 617 deletions(-) + +From gregkh@mini.kroah.org Wed Dec 16 19:56:43 2009 +Message-Id: <20091217035643.118533253@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:54:58 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Stern +Subject: [001/151] USB: usb-storage: fix bug in fill_inquiry + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alan Stern + +commit f3f6faa9edf67c1018270793e0547b0f81abb47e upstream. + +This patch (as1312) fixes a minor bug in usb-storage. The +fill_inquiry() routine neglects to pre-load the inquiry data buffer +with spaces. As a result, if the vendor name is shorter than 8 +characters or the product name is shorter than 16, the remainder will +be filled with garbage. + +The patch also removes some unnecessary calls to strlen(). + +Signed-off-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/usb.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +--- a/drivers/usb/storage/usb.c ++++ b/drivers/usb/storage/usb.c +@@ -228,6 +228,7 @@ void fill_inquiry_response(struct us_dat + if (data_len<36) // You lose. + return; + ++ memset(data+8, ' ', 28); + if(data[0]&0x20) { /* USB device currently not connected. Return + peripheral qualifier 001b ("...however, the + physical device is not currently connected +@@ -237,15 +238,15 @@ void fill_inquiry_response(struct us_dat + device, it may return zeros or ASCII spaces + (20h) in those fields until the data is + available from the device."). */ +- memset(data+8,0,28); + } else { + u16 bcdDevice = le16_to_cpu(us->pusb_dev->descriptor.bcdDevice); +- memcpy(data+8, us->unusual_dev->vendorName, +- strlen(us->unusual_dev->vendorName) > 8 ? 8 : +- strlen(us->unusual_dev->vendorName)); +- memcpy(data+16, us->unusual_dev->productName, +- strlen(us->unusual_dev->productName) > 16 ? 16 : +- strlen(us->unusual_dev->productName)); ++ int n; ++ ++ n = strlen(us->unusual_dev->vendorName); ++ memcpy(data+8, us->unusual_dev->vendorName, min(8, n)); ++ n = strlen(us->unusual_dev->productName); ++ memcpy(data+16, us->unusual_dev->productName, min(16, n)); ++ + data[32] = 0x30 + ((bcdDevice>>12) & 0x0F); + data[33] = 0x30 + ((bcdDevice>>8) & 0x0F); + data[34] = 0x30 + ((bcdDevice>>4) & 0x0F); + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:43 2009 +Message-Id: <20091217035643.246560980@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:54:59 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ming Zhao +Subject: [002/151] USB: option: add pid for ZTE + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: zhao.ming9@zte.com.cn + +commit 8d87cacda7c8db5c131bfcaaa1d90bfe918c2ebc upstream. + +This patch adds ZTE modem devices. + +Signed-off-by: Ming Zhao +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 36 ++++++++++++++++++++++++++++++++++++ + 1 file changed, 36 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -580,12 +580,48 @@ static struct usb_device_id option_ids[] + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0086, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0104, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0106, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0108, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0113, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0117, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0118, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0121, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0122, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0123, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0124, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0125, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0126, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0128, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0142, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0143, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0144, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0145, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0146, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0147, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0148, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0149, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0150, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0151, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0152, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0153, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0154, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0155, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0156, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0157, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0158, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0159, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0160, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0161, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0162, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0014, 0xff, 0xff, 0xff) }, /* ZTE CDMA products */ + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0027, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0059, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0060, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0141, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) }, + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:43 2009 +Message-Id: <20091217035643.371242977@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:00 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jay Fenlason , + Stefan Richter +Subject: [003/151] firewire: ohci: handle receive packets with a data length of zero + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jay Fenlason + +commit 8c0c0cc2d9f4c523fde04bdfe41e4380dec8ee54 upstream. + +Queueing to receive an ISO packet with a payload length of zero +silently does nothing in dualbuffer mode, and crashes the kernel in +packet-per-buffer mode. Return an error in dualbuffer mode, because +the DMA controller won't let us do what we want, and work correctly in +packet-per-buffer mode. + +Signed-off-by: Jay Fenlason +Signed-off-by: Stefan Richter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firewire/ohci.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/firewire/ohci.c ++++ b/drivers/firewire/ohci.c +@@ -2209,6 +2209,13 @@ static int ohci_queue_iso_receive_dualbu + page = payload >> PAGE_SHIFT; + offset = payload & ~PAGE_MASK; + rest = p->payload_length; ++ /* ++ * The controllers I've tested have not worked correctly when ++ * second_req_count is zero. Rather than do something we know won't ++ * work, return an error ++ */ ++ if (rest == 0) ++ return -EINVAL; + + /* FIXME: make packet-per-buffer/dual-buffer a context option */ + while (rest > 0) { +@@ -2262,7 +2269,7 @@ static int ohci_queue_iso_receive_packet + unsigned long payload) + { + struct iso_context *ctx = container_of(base, struct iso_context, base); +- struct descriptor *d = NULL, *pd = NULL; ++ struct descriptor *d, *pd; + struct fw_iso_packet *p = packet; + dma_addr_t d_bus, page_bus; + u32 z, header_z, rest; +@@ -2300,8 +2307,9 @@ static int ohci_queue_iso_receive_packet + d->data_address = cpu_to_le32(d_bus + (z * sizeof(*d))); + + rest = payload_per_buffer; ++ pd = d; + for (j = 1; j < z; j++) { +- pd = d + j; ++ pd++; + pd->control = cpu_to_le16(DESCRIPTOR_STATUS | + DESCRIPTOR_INPUT_MORE); + + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:43 2009 +Message-Id: <20091217035643.505448694@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:01 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Paul E. McKenney" , + laijs@cn.fujitsu.com, + dipankar@in.ibm.com, + mathieu.desnoyers@polymtl.ca, + josh@joshtriplett.org, + dvhltc@us.ibm.com, + niv@us.ibm.com, + peterz@infradead.org, + rostedt@goodmis.org, + Valdis.Kletnieks@vt.edu, + dhowells@redhat.com, + Ingo Molnar +Subject: [004/151] rcu: Prepare for synchronization fixes: clean up for non-NO_HZ handling of ->completed counter + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Paul E. McKenney + +commit 281d150c5f8892f158747594ab49ce2823fd8b8c upstream. + +Impose a clear locking design on non-NO_HZ handling of the +->completed counter. This increases the distance between the +RCU and the CPU-hotplug mechanisms. + +Signed-off-by: Paul E. McKenney +Cc: laijs@cn.fujitsu.com +Cc: dipankar@in.ibm.com +Cc: mathieu.desnoyers@polymtl.ca +Cc: josh@joshtriplett.org +Cc: dvhltc@us.ibm.com +Cc: niv@us.ibm.com +Cc: peterz@infradead.org +Cc: rostedt@goodmis.org +Cc: Valdis.Kletnieks@vt.edu +Cc: dhowells@redhat.com +LKML-Reference: <12571987491353-git-send-email-> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/rcutree.c | 67 ++++++++++++++++++++++++------------------------------- + kernel/rcutree.h | 8 +++--- + 2 files changed, 34 insertions(+), 41 deletions(-) + +--- a/kernel/rcutree.c ++++ b/kernel/rcutree.c +@@ -176,9 +176,29 @@ static struct rcu_node *rcu_get_root(str + return &rsp->node[0]; + } + ++/* ++ * Record the specified "completed" value, which is later used to validate ++ * dynticks counter manipulations and CPU-offline checks. Specify ++ * "rsp->completed - 1" to unconditionally invalidate any future dynticks ++ * manipulations and CPU-offline checks. Such invalidation is useful at ++ * the beginning of a grace period. ++ */ ++static void dyntick_record_completed(struct rcu_state *rsp, long comp) ++{ ++ rsp->dynticks_completed = comp; ++} ++ + #ifdef CONFIG_SMP + + /* ++ * Recall the previously recorded value of the completion for dynticks. ++ */ ++static long dyntick_recall_completed(struct rcu_state *rsp) ++{ ++ return rsp->dynticks_completed; ++} ++ ++/* + * If the specified CPU is offline, tell the caller that it is in + * a quiescent state. Otherwise, whack it with a reschedule IPI. + * Grace periods can end up waiting on an offline CPU when that +@@ -335,28 +355,9 @@ void rcu_irq_exit(void) + set_need_resched(); + } + +-/* +- * Record the specified "completed" value, which is later used to validate +- * dynticks counter manipulations. Specify "rsp->completed - 1" to +- * unconditionally invalidate any future dynticks manipulations (which is +- * useful at the beginning of a grace period). +- */ +-static void dyntick_record_completed(struct rcu_state *rsp, long comp) +-{ +- rsp->dynticks_completed = comp; +-} +- + #ifdef CONFIG_SMP + + /* +- * Recall the previously recorded value of the completion for dynticks. +- */ +-static long dyntick_recall_completed(struct rcu_state *rsp) +-{ +- return rsp->dynticks_completed; +-} +- +-/* + * Snapshot the specified CPU's dynticks counter so that we can later + * credit them with an implicit quiescent state. Return 1 if this CPU + * is in dynticks idle mode, which is an extended quiescent state. +@@ -419,24 +420,8 @@ static int rcu_implicit_dynticks_qs(stru + + #else /* #ifdef CONFIG_NO_HZ */ + +-static void dyntick_record_completed(struct rcu_state *rsp, long comp) +-{ +-} +- + #ifdef CONFIG_SMP + +-/* +- * If there are no dynticks, then the only way that a CPU can passively +- * be in a quiescent state is to be offline. Unlike dynticks idle, which +- * is a point in time during the prior (already finished) grace period, +- * an offline CPU is always in a quiescent state, and thus can be +- * unconditionally applied. So just return the current value of completed. +- */ +-static long dyntick_recall_completed(struct rcu_state *rsp) +-{ +- return rsp->completed; +-} +- + static int dyntick_save_progress_counter(struct rcu_data *rdp) + { + return 0; +@@ -1144,6 +1129,7 @@ static void force_quiescent_state(struct + long lastcomp; + struct rcu_node *rnp = rcu_get_root(rsp); + u8 signaled; ++ u8 forcenow; + + if (!rcu_gp_in_progress(rsp)) + return; /* No grace period in progress, nothing to force. */ +@@ -1180,16 +1166,23 @@ static void force_quiescent_state(struct + if (rcu_process_dyntick(rsp, lastcomp, + dyntick_save_progress_counter)) + goto unlock_ret; ++ /* fall into next case. */ ++ ++ case RCU_SAVE_COMPLETED: + + /* Update state, record completion counter. */ ++ forcenow = 0; + spin_lock(&rnp->lock); + if (lastcomp == rsp->completed && +- rsp->signaled == RCU_SAVE_DYNTICK) { ++ rsp->signaled == signaled) { + rsp->signaled = RCU_FORCE_QS; + dyntick_record_completed(rsp, lastcomp); ++ forcenow = signaled == RCU_SAVE_COMPLETED; + } + spin_unlock(&rnp->lock); +- break; ++ if (!forcenow) ++ break; ++ /* fall into next case. */ + + case RCU_FORCE_QS: + +--- a/kernel/rcutree.h ++++ b/kernel/rcutree.h +@@ -204,11 +204,12 @@ struct rcu_data { + #define RCU_GP_IDLE 0 /* No grace period in progress. */ + #define RCU_GP_INIT 1 /* Grace period being initialized. */ + #define RCU_SAVE_DYNTICK 2 /* Need to scan dyntick state. */ +-#define RCU_FORCE_QS 3 /* Need to force quiescent state. */ ++#define RCU_SAVE_COMPLETED 3 /* Need to save rsp->completed. */ ++#define RCU_FORCE_QS 4 /* Need to force quiescent state. */ + #ifdef CONFIG_NO_HZ + #define RCU_SIGNAL_INIT RCU_SAVE_DYNTICK + #else /* #ifdef CONFIG_NO_HZ */ +-#define RCU_SIGNAL_INIT RCU_FORCE_QS ++#define RCU_SIGNAL_INIT RCU_SAVE_COMPLETED + #endif /* #else #ifdef CONFIG_NO_HZ */ + + #define RCU_JIFFIES_TILL_FORCE_QS 3 /* for rsp->jiffies_force_qs */ +@@ -274,9 +275,8 @@ struct rcu_state { + unsigned long jiffies_stall; /* Time at which to check */ + /* for CPU stalls. */ + #endif /* #ifdef CONFIG_RCU_CPU_STALL_DETECTOR */ +-#ifdef CONFIG_NO_HZ + long dynticks_completed; /* Value of completed @ snap. */ +-#endif /* #ifdef CONFIG_NO_HZ */ ++ /* Protected by fqslock. */ + }; + + #ifdef RCU_TREE_NONCORE + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:43 2009 +Message-Id: <20091217035643.635648125@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:02 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Paul E. McKenney" , + laijs@cn.fujitsu.com, + dipankar@in.ibm.com, + mathieu.desnoyers@polymtl.ca, + josh@joshtriplett.org, + dvhltc@us.ibm.com, + niv@us.ibm.com, + peterz@infradead.org, + rostedt@goodmis.org, + Valdis.Kletnieks@vt.edu, + dhowells@redhat.com, + Ingo Molnar +Subject: [005/151] rcu: Fix synchronization for rcu_process_gp_end() uses of ->completed counter + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Paul E. McKenney + +commit d09b62dfa336447c52a5ec9bb88adbc479b0f3b8 upstream. + +Impose a clear locking design on the rcu_process_gp_end() +function's use of the ->completed counter. This is done by +creating a ->completed field in the rcu_node structure, which +can safely be accessed under the protection of that structure's +lock. Performance and scalability are maintained by using a +form of double-checked locking, so that rcu_process_gp_end() +only acquires the leaf rcu_node structure's ->lock if a grace +period has recently ended. + +This fix reduces rcutorture failure rate by at least two orders +of magnitude under heavy stress with force_quiescent_state() +being invoked artificially often. Without this fix, +unsynchronized access to the ->completed field can cause +rcu_process_gp_end() to advance callbacks whose grace period has +not yet expired. (Bad idea!) + +Signed-off-by: Paul E. McKenney +Cc: laijs@cn.fujitsu.com +Cc: dipankar@in.ibm.com +Cc: mathieu.desnoyers@polymtl.ca +Cc: josh@joshtriplett.org +Cc: dvhltc@us.ibm.com +Cc: niv@us.ibm.com +Cc: peterz@infradead.org +Cc: rostedt@goodmis.org +Cc: Valdis.Kletnieks@vt.edu +Cc: dhowells@redhat.com +LKML-Reference: <12571987494069-git-send-email-> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/rcutree.c | 128 ++++++++++++++++++++++++++++++++++--------------------- + kernel/rcutree.h | 3 + + 2 files changed, 83 insertions(+), 48 deletions(-) + +--- a/kernel/rcutree.c ++++ b/kernel/rcutree.c +@@ -568,6 +568,76 @@ check_for_new_grace_period(struct rcu_st + } + + /* ++ * Advance this CPU's callbacks, but only if the current grace period ++ * has ended. This may be called only from the CPU to whom the rdp ++ * belongs. In addition, the corresponding leaf rcu_node structure's ++ * ->lock must be held by the caller, with irqs disabled. ++ */ ++static void ++__rcu_process_gp_end(struct rcu_state *rsp, struct rcu_node *rnp, struct rcu_data *rdp) ++{ ++ /* Did another grace period end? */ ++ if (rdp->completed != rnp->completed) { ++ ++ /* Advance callbacks. No harm if list empty. */ ++ rdp->nxttail[RCU_DONE_TAIL] = rdp->nxttail[RCU_WAIT_TAIL]; ++ rdp->nxttail[RCU_WAIT_TAIL] = rdp->nxttail[RCU_NEXT_READY_TAIL]; ++ rdp->nxttail[RCU_NEXT_READY_TAIL] = rdp->nxttail[RCU_NEXT_TAIL]; ++ ++ /* Remember that we saw this grace-period completion. */ ++ rdp->completed = rnp->completed; ++ } ++} ++ ++/* ++ * Advance this CPU's callbacks, but only if the current grace period ++ * has ended. This may be called only from the CPU to whom the rdp ++ * belongs. ++ */ ++static void ++rcu_process_gp_end(struct rcu_state *rsp, struct rcu_data *rdp) ++{ ++ unsigned long flags; ++ struct rcu_node *rnp; ++ ++ local_irq_save(flags); ++ rnp = rdp->mynode; ++ if (rdp->completed == ACCESS_ONCE(rnp->completed) || /* outside lock. */ ++ !spin_trylock(&rnp->lock)) { /* irqs already off, retry later. */ ++ local_irq_restore(flags); ++ return; ++ } ++ __rcu_process_gp_end(rsp, rnp, rdp); ++ spin_unlock_irqrestore(&rnp->lock, flags); ++} ++ ++/* ++ * Do per-CPU grace-period initialization for running CPU. The caller ++ * must hold the lock of the leaf rcu_node structure corresponding to ++ * this CPU. ++ */ ++static void ++rcu_start_gp_per_cpu(struct rcu_state *rsp, struct rcu_node *rnp, struct rcu_data *rdp) ++{ ++ /* Prior grace period ended, so advance callbacks for current CPU. */ ++ __rcu_process_gp_end(rsp, rnp, rdp); ++ ++ /* ++ * Because this CPU just now started the new grace period, we know ++ * that all of its callbacks will be covered by this upcoming grace ++ * period, even the ones that were registered arbitrarily recently. ++ * Therefore, advance all outstanding callbacks to RCU_WAIT_TAIL. ++ * ++ * Other CPUs cannot be sure exactly when the grace period started. ++ * Therefore, their recently registered callbacks must pass through ++ * an additional RCU_NEXT_READY stage, so that they will be handled ++ * by the next RCU grace period. ++ */ ++ rdp->nxttail[RCU_NEXT_READY_TAIL] = rdp->nxttail[RCU_NEXT_TAIL]; ++ rdp->nxttail[RCU_WAIT_TAIL] = rdp->nxttail[RCU_NEXT_TAIL]; ++} ++ ++/* + * Start a new RCU grace period if warranted, re-initializing the hierarchy + * in preparation for detecting the next grace period. The caller must hold + * the root node's ->lock, which is released before return. Hard irqs must +@@ -594,26 +664,14 @@ rcu_start_gp(struct rcu_state *rsp, unsi + dyntick_record_completed(rsp, rsp->completed - 1); + note_new_gpnum(rsp, rdp); + +- /* +- * Because this CPU just now started the new grace period, we know +- * that all of its callbacks will be covered by this upcoming grace +- * period, even the ones that were registered arbitrarily recently. +- * Therefore, advance all outstanding callbacks to RCU_WAIT_TAIL. +- * +- * Other CPUs cannot be sure exactly when the grace period started. +- * Therefore, their recently registered callbacks must pass through +- * an additional RCU_NEXT_READY stage, so that they will be handled +- * by the next RCU grace period. +- */ +- rdp->nxttail[RCU_NEXT_READY_TAIL] = rdp->nxttail[RCU_NEXT_TAIL]; +- rdp->nxttail[RCU_WAIT_TAIL] = rdp->nxttail[RCU_NEXT_TAIL]; +- + /* Special-case the common single-level case. */ + if (NUM_RCU_NODES == 1) { + rcu_preempt_check_blocked_tasks(rnp); + rnp->qsmask = rnp->qsmaskinit; + rnp->gpnum = rsp->gpnum; ++ rnp->completed = rsp->completed; + rsp->signaled = RCU_SIGNAL_INIT; /* force_quiescent_state OK. */ ++ rcu_start_gp_per_cpu(rsp, rnp, rdp); + spin_unlock_irqrestore(&rnp->lock, flags); + return; + } +@@ -646,6 +704,9 @@ rcu_start_gp(struct rcu_state *rsp, unsi + rcu_preempt_check_blocked_tasks(rnp); + rnp->qsmask = rnp->qsmaskinit; + rnp->gpnum = rsp->gpnum; ++ rnp->completed = rsp->completed; ++ if (rnp == rdp->mynode) ++ rcu_start_gp_per_cpu(rsp, rnp, rdp); + spin_unlock(&rnp->lock); /* irqs remain disabled. */ + } + +@@ -657,34 +718,6 @@ rcu_start_gp(struct rcu_state *rsp, unsi + } + + /* +- * Advance this CPU's callbacks, but only if the current grace period +- * has ended. This may be called only from the CPU to whom the rdp +- * belongs. +- */ +-static void +-rcu_process_gp_end(struct rcu_state *rsp, struct rcu_data *rdp) +-{ +- long completed_snap; +- unsigned long flags; +- +- local_irq_save(flags); +- completed_snap = ACCESS_ONCE(rsp->completed); /* outside of lock. */ +- +- /* Did another grace period end? */ +- if (rdp->completed != completed_snap) { +- +- /* Advance callbacks. No harm if list empty. */ +- rdp->nxttail[RCU_DONE_TAIL] = rdp->nxttail[RCU_WAIT_TAIL]; +- rdp->nxttail[RCU_WAIT_TAIL] = rdp->nxttail[RCU_NEXT_READY_TAIL]; +- rdp->nxttail[RCU_NEXT_READY_TAIL] = rdp->nxttail[RCU_NEXT_TAIL]; +- +- /* Remember that we saw this grace-period completion. */ +- rdp->completed = completed_snap; +- } +- local_irq_restore(flags); +-} +- +-/* + * Clean up after the prior grace period and let rcu_start_gp() start up + * the next grace period if one is needed. Note that the caller must + * hold rnp->lock, as required by rcu_start_gp(), which will release it. +@@ -695,7 +728,6 @@ static void cpu_quiet_msk_finish(struct + WARN_ON_ONCE(!rcu_gp_in_progress(rsp)); + rsp->completed = rsp->gpnum; + rsp->signaled = RCU_GP_IDLE; +- rcu_process_gp_end(rsp, rsp->rda[smp_processor_id()]); + rcu_start_gp(rsp, flags); /* releases root node's rnp->lock. */ + } + +@@ -1537,21 +1569,16 @@ static void __cpuinit + rcu_init_percpu_data(int cpu, struct rcu_state *rsp, int preemptable) + { + unsigned long flags; +- long lastcomp; + unsigned long mask; + struct rcu_data *rdp = rsp->rda[cpu]; + struct rcu_node *rnp = rcu_get_root(rsp); + + /* Set up local state, ensuring consistent view of global state. */ + spin_lock_irqsave(&rnp->lock, flags); +- lastcomp = rsp->completed; +- rdp->completed = lastcomp; +- rdp->gpnum = lastcomp; + rdp->passed_quiesc = 0; /* We could be racing with new GP, */ + rdp->qs_pending = 1; /* so set up to respond to current GP. */ + rdp->beenonline = 1; /* We have now been online. */ + rdp->preemptable = preemptable; +- rdp->passed_quiesc_completed = lastcomp - 1; + rdp->qlen_last_fqs_check = 0; + rdp->n_force_qs_snap = rsp->n_force_qs; + rdp->blimit = blimit; +@@ -1573,6 +1600,11 @@ rcu_init_percpu_data(int cpu, struct rcu + spin_lock(&rnp->lock); /* irqs already disabled. */ + rnp->qsmaskinit |= mask; + mask = rnp->grpmask; ++ if (rnp == rdp->mynode) { ++ rdp->gpnum = rnp->completed; /* if GP in progress... */ ++ rdp->completed = rnp->completed; ++ rdp->passed_quiesc_completed = rnp->completed - 1; ++ } + spin_unlock(&rnp->lock); /* irqs already disabled. */ + rnp = rnp->parent; + } while (rnp != NULL && !(rnp->qsmaskinit & mask)); +--- a/kernel/rcutree.h ++++ b/kernel/rcutree.h +@@ -84,6 +84,9 @@ struct rcu_node { + long gpnum; /* Current grace period for this node. */ + /* This will either be equal to or one */ + /* behind the root rcu_node's gpnum. */ ++ long completed; /* Last grace period completed for this node. */ ++ /* This will either be equal to or one */ ++ /* behind the root rcu_node's gpnum. */ + unsigned long qsmask; /* CPUs or groups that need to switch in */ + /* order for current grace period to proceed.*/ + /* In leaf rcu_node, each bit corresponds to */ + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:43 2009 +Message-Id: <20091217035643.762235033@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:03 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Paul E. McKenney" , + laijs@cn.fujitsu.com, + dipankar@in.ibm.com, + mathieu.desnoyers@polymtl.ca, + josh@joshtriplett.org, + dvhltc@us.ibm.com, + niv@us.ibm.com, + peterz@infradead.org, + rostedt@goodmis.org, + Valdis.Kletnieks@vt.edu, + dhowells@redhat.com, + Ingo Molnar +Subject: [006/151] rcu: Fix note_new_gpnum() uses of ->gpnum + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Paul E. McKenney + +commit 9160306e6f5b68bb64630c9031c517ca1cf463db upstream. + +Impose a clear locking design on the note_new_gpnum() +function's use of the ->gpnum counter. This is done by updating +rdp->gpnum only from the corresponding leaf rcu_node structure's +rnp->gpnum field, and even then only under the protection of +that same rcu_node structure's ->lock field. Performance and +scalability are maintained using a form of double-checked +locking, and excessive spinning is avoided by use of the +spin_trylock() function. The use of spin_trylock() is safe due +to the fact that CPUs who fail to acquire this lock will try +again later. The hierarchical nature of the rcu_node data +structure limits contention (which could be limited further if +need be using the RCU_FANOUT kernel parameter). + +Without this patch, obscure but quite possible races could +result in a quiescent state that occurred during one grace +period to be accounted to the following grace period, causing +this following grace period to end prematurely. Not good! + +Signed-off-by: Paul E. McKenney +Cc: laijs@cn.fujitsu.com +Cc: dipankar@in.ibm.com +Cc: mathieu.desnoyers@polymtl.ca +Cc: josh@joshtriplett.org +Cc: dvhltc@us.ibm.com +Cc: niv@us.ibm.com +Cc: peterz@infradead.org +Cc: rostedt@goodmis.org +Cc: Valdis.Kletnieks@vt.edu +Cc: dhowells@redhat.com +LKML-Reference: <12571987492350-git-send-email-> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/rcutree.c | 34 ++++++++++++++++++++++++++++------ + 1 file changed, 28 insertions(+), 6 deletions(-) + +--- a/kernel/rcutree.c ++++ b/kernel/rcutree.c +@@ -538,13 +538,33 @@ static void check_cpu_stall(struct rcu_s + /* + * Update CPU-local rcu_data state to record the newly noticed grace period. + * This is used both when we started the grace period and when we notice +- * that someone else started the grace period. +- */ ++ * that someone else started the grace period. The caller must hold the ++ * ->lock of the leaf rcu_node structure corresponding to the current CPU, ++ * and must have irqs disabled. ++ */ ++static void __note_new_gpnum(struct rcu_state *rsp, struct rcu_node *rnp, struct rcu_data *rdp) ++{ ++ if (rdp->gpnum != rnp->gpnum) { ++ rdp->qs_pending = 1; ++ rdp->passed_quiesc = 0; ++ rdp->gpnum = rnp->gpnum; ++ } ++} ++ + static void note_new_gpnum(struct rcu_state *rsp, struct rcu_data *rdp) + { +- rdp->qs_pending = 1; +- rdp->passed_quiesc = 0; +- rdp->gpnum = rsp->gpnum; ++ unsigned long flags; ++ struct rcu_node *rnp; ++ ++ local_irq_save(flags); ++ rnp = rdp->mynode; ++ if (rdp->gpnum == ACCESS_ONCE(rnp->gpnum) || /* outside lock. */ ++ !spin_trylock(&rnp->lock)) { /* irqs already off, retry later. */ ++ local_irq_restore(flags); ++ return; ++ } ++ __note_new_gpnum(rsp, rnp, rdp); ++ spin_unlock_irqrestore(&rnp->lock, flags); + } + + /* +@@ -635,6 +655,9 @@ rcu_start_gp_per_cpu(struct rcu_state *r + */ + rdp->nxttail[RCU_NEXT_READY_TAIL] = rdp->nxttail[RCU_NEXT_TAIL]; + rdp->nxttail[RCU_WAIT_TAIL] = rdp->nxttail[RCU_NEXT_TAIL]; ++ ++ /* Set state so that this CPU will detect the next quiescent state. */ ++ __note_new_gpnum(rsp, rnp, rdp); + } + + /* +@@ -662,7 +685,6 @@ rcu_start_gp(struct rcu_state *rsp, unsi + rsp->jiffies_force_qs = jiffies + RCU_JIFFIES_TILL_FORCE_QS; + record_gp_stall_check_time(rsp); + dyntick_record_completed(rsp, rsp->completed - 1); +- note_new_gpnum(rsp, rdp); + + /* Special-case the common single-level case. */ + if (NUM_RCU_NODES == 1) { + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:44 2009 +Message-Id: <20091217035643.889583556@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:04 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Paul E. McKenney" , + laijs@cn.fujitsu.com, + dipankar@in.ibm.com, + mathieu.desnoyers@polymtl.ca, + josh@joshtriplett.org, + dvhltc@us.ibm.com, + niv@us.ibm.com, + peterz@infradead.org, + rostedt@goodmis.org, + Valdis.Kletnieks@vt.edu, + dhowells@redhat.com, + Benjamin Gilbert , + Ingo Molnar +Subject: [007/151] rcu: Remove inline from forward-referenced functions + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Paul E. McKenney + +commit dbe01350fa8ce0c11948ab7d6be71a4d901be151 upstream. + +Some variants of gcc are reputed to dislike forward references +to functions declared "inline". Remove the "inline" keyword +from such functions. + +Signed-off-by: Paul E. McKenney +Cc: laijs@cn.fujitsu.com +Cc: dipankar@in.ibm.com +Cc: mathieu.desnoyers@polymtl.ca +Cc: josh@joshtriplett.org +Cc: dvhltc@us.ibm.com +Cc: niv@us.ibm.com +Cc: peterz@infradead.org +Cc: rostedt@goodmis.org +Cc: Valdis.Kletnieks@vt.edu +Cc: dhowells@redhat.com +Cc: Benjamin Gilbert +LKML-Reference: <12578890422402-git-send-email-> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/rcutree.h | 2 +- + kernel/rcutree_plugin.h | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/kernel/rcutree.h ++++ b/kernel/rcutree.h +@@ -301,7 +301,7 @@ DECLARE_PER_CPU(struct rcu_data, rcu_pre + #else /* #ifdef RCU_TREE_NONCORE */ + + /* Forward declarations for rcutree_plugin.h */ +-static inline void rcu_bootup_announce(void); ++static void rcu_bootup_announce(void); + long rcu_batches_completed(void); + static void rcu_preempt_note_context_switch(int cpu); + static int rcu_preempted_readers(struct rcu_node *rnp); +--- a/kernel/rcutree_plugin.h ++++ b/kernel/rcutree_plugin.h +@@ -33,7 +33,7 @@ DEFINE_PER_CPU(struct rcu_data, rcu_pree + /* + * Tell them what RCU they are running. + */ +-static inline void rcu_bootup_announce(void) ++static void rcu_bootup_announce(void) + { + printk(KERN_INFO + "Experimental preemptable hierarchical RCU implementation.\n"); +@@ -481,7 +481,7 @@ void exit_rcu(void) + /* + * Tell them what RCU they are running. + */ +-static inline void rcu_bootup_announce(void) ++static void rcu_bootup_announce(void) + { + printk(KERN_INFO "Hierarchical RCU implementation.\n"); + } + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:44 2009 +Message-Id: <20091217035644.018127687@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:05 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Arjan van de Ven , + Ingo Molnar +Subject: [008/151] perf_event: Fix invalid type in ioctl definition + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Arjan van de Ven + +commit 4c49b12853fbb5eff4849b7b6a1e895776f027a1 upstream. + +u64 is invalid in userspace headers, including ioctl +definitions; use __u64 instead + +Signed-off-by: Arjan van de Ven +LKML-Reference: <20091113214733.7cd76be9@infradead.org> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/perf_event.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/linux/perf_event.h ++++ b/include/linux/perf_event.h +@@ -219,7 +219,7 @@ struct perf_event_attr { + #define PERF_EVENT_IOC_DISABLE _IO ('$', 1) + #define PERF_EVENT_IOC_REFRESH _IO ('$', 2) + #define PERF_EVENT_IOC_RESET _IO ('$', 3) +-#define PERF_EVENT_IOC_PERIOD _IOW('$', 4, u64) ++#define PERF_EVENT_IOC_PERIOD _IOW('$', 4, __u64) + #define PERF_EVENT_IOC_SET_OUTPUT _IO ('$', 5) + + enum perf_event_ioc_flags { + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:44 2009 +Message-Id: <20091217035644.143280063@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:06 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Xiao Guangrong , + Peter Zijlstra , + Frederic Weisbecker , + Ingo Molnar +Subject: [009/151] perf_event: Initialize data.period in perf_swevent_hrtimer() + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Xiao Guangrong + +commit 59d069eb5ae9b033ed1c124c92e1532c4a958991 upstream. + +In current code in perf_swevent_hrtimer(), data.period is not +initialized, The result is obvious wrong: + + # ./perf record -f -e cpu-clock make + # ./perf report + # Samples: 1740 + # + # Overhead Command ...... + # ........ ........ .......................................... + # + 1025422183050275328.00% sh libc-2.9.90.so ... + 1025422183050275328.00% perl libperl.so ... + 1025422168240043264.00% perl [kernel] ... + 1025422030011210752.00% perl [kernel] ... + +Signed-off-by: Xiao Guangrong +Acked-by: Peter Zijlstra +Cc: Frederic Weisbecker +LKML-Reference: <4B14E220.2050107@cn.fujitsu.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/perf_event.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/kernel/perf_event.c ++++ b/kernel/perf_event.c +@@ -3949,6 +3949,7 @@ static enum hrtimer_restart perf_swevent + event->pmu->read(event); + + data.addr = 0; ++ data.period = event->hw.last_period; + regs = get_irq_regs(); + /* + * In case we exclude kernel IPs or are somehow not in interrupt + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:44 2009 +Message-Id: <20091217035644.274392244@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:07 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + =?ISO-8859-15?q?Kristian=20H=C3=B8gsberg?= , + "David S. Miller" , + Peter Zijlstra , + Paul Mackerras , + Frederic Weisbecker , + Ingo Molnar +Subject: [010/151] perf: Dont free perf_mmap_data until work has been done + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Kristian Høgsberg + +commit ec70ccd806111ba3caf596def91a8580138b12db upstream. + +In the CONFIG_PERF_USE_VMALLOC case, perf_mmap_data_free() only +schedules the cleanup of the perf_mmap_data struct. In that +case we have to wait until the work has been done before we free +data. + +Signed-off-by: Kristian Høgsberg +Cc: David S. Miller +Cc: Peter Zijlstra +Cc: Paul Mackerras +Cc: Frederic Weisbecker +LKML-Reference: <1259697901-1747-1-git-send-email-krh@bitplanet.net> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/perf_event.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/kernel/perf_event.c ++++ b/kernel/perf_event.c +@@ -2174,6 +2174,7 @@ static void perf_mmap_data_free(struct p + perf_mmap_free_page((unsigned long)data->user_page); + for (i = 0; i < data->nr_pages; i++) + perf_mmap_free_page((unsigned long)data->data_pages[i]); ++ kfree(data); + } + + #else +@@ -2214,6 +2215,7 @@ static void perf_mmap_data_free_work(str + perf_mmap_unmark_page(base + (i * PAGE_SIZE)); + + vfree(base); ++ kfree(data); + } + + static void perf_mmap_data_free(struct perf_mmap_data *data) +@@ -2319,7 +2321,6 @@ static void perf_mmap_data_free_rcu(stru + + data = container_of(rcu_head, struct perf_mmap_data, rcu_head); + perf_mmap_data_free(data); +- kfree(data); + } + + static void perf_mmap_data_release(struct perf_event *event) + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:44 2009 +Message-Id: <20091217035644.408542787@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:08 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Rafael J. Wysocki" +Subject: [011/151] PM / Runtime: Fix lockdep warning in __pm_runtime_set_status() + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Rafael J. Wysocki + +commit bab636b921017f0db6e0c2979438f50b898a9808 upstream. + +Lockdep complains about taking the parent lock in +__pm_runtime_set_status(), so mark it as nested. + +Signed-off-by: Rafael J. Wysocki +Reported-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/power/runtime.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -777,7 +777,7 @@ int __pm_runtime_set_status(struct devic + } + + if (parent) { +- spin_lock(&parent->power.lock); ++ spin_lock_nested(&parent->power.lock, SINGLE_DEPTH_NESTING); + + /* + * It is invalid to put an active child under a parent that is + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:44 2009 +Message-Id: <20091217035644.529151031@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:09 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mike Galbraith , + Arjan van de Ven , + Peter Zijlstra , + Ingo Molnar +Subject: [012/151] sched: Check for an idle shared cache in select_task_rq_fair() + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mike Galbraith + +commit a1f84a3ab8e002159498814eaa7e48c33752b04b upstream. + +When waking affine, check for an idle shared cache, and if +found, wake to that CPU/sibling instead of the waker's CPU. + +This improves pgsql+oltp ramp up by roughly 8%. Possibly more +for other loads, depending on overlap. The trade-off is a +roughly 1% peak downturn if tasks are truly synchronous. + +Signed-off-by: Mike Galbraith +Cc: Arjan van de Ven +Cc: Peter Zijlstra +LKML-Reference: <1256654138.17752.7.camel@marge.simson.net> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/sched_fair.c | 33 +++++++++++++++++++++++++++++---- + 1 file changed, 29 insertions(+), 4 deletions(-) + +--- a/kernel/sched_fair.c ++++ b/kernel/sched_fair.c +@@ -1398,11 +1398,36 @@ static int select_task_rq_fair(struct ta + want_sd = 0; + } + +- if (want_affine && (tmp->flags & SD_WAKE_AFFINE) && +- cpumask_test_cpu(prev_cpu, sched_domain_span(tmp))) { ++ if (want_affine && (tmp->flags & SD_WAKE_AFFINE)) { ++ int candidate = -1, i; + +- affine_sd = tmp; +- want_affine = 0; ++ if (cpumask_test_cpu(prev_cpu, sched_domain_span(tmp))) ++ candidate = cpu; ++ ++ /* ++ * Check for an idle shared cache. ++ */ ++ if (tmp->flags & SD_PREFER_SIBLING) { ++ if (candidate == cpu) { ++ if (!cpu_rq(prev_cpu)->cfs.nr_running) ++ candidate = prev_cpu; ++ } ++ ++ if (candidate == -1 || candidate == cpu) { ++ for_each_cpu(i, sched_domain_span(tmp)) { ++ if (!cpu_rq(i)->cfs.nr_running) { ++ candidate = i; ++ break; ++ } ++ } ++ } ++ } ++ ++ if (candidate >= 0) { ++ affine_sd = tmp; ++ want_affine = 0; ++ cpu = candidate; ++ } + } + + if (!want_sd && !want_affine) + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:44 2009 +Message-Id: <20091217035644.657581252@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:10 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mike Galbraith , + Peter Zijlstra , + arjan@infradead.org, + Ingo Molnar +Subject: [013/151] sched: Fix affinity logic in select_task_rq_fair() + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mike Galbraith + +commit fd210738f6601d0fb462df9a2fe5a41896ff6a8f upstream. + +Ingo Molnar reported: + +[ 26.804000] BUG: using smp_processor_id() in preemptible [00000000] code: events/1/10 +[ 26.808000] caller is vmstat_update+0x26/0x70 +[ 26.812000] Pid: 10, comm: events/1 Not tainted 2.6.32-rc5 #6887 +[ 26.816000] Call Trace: +[ 26.820000] [] ? printk+0x28/0x3c +[ 26.824000] [] debug_smp_processor_id+0xf0/0x110 +[ 26.824000] mount used greatest stack depth: 1464 bytes left +[ 26.828000] [] vmstat_update+0x26/0x70 +[ 26.832000] [] worker_thread+0x188/0x310 +[ 26.836000] [] ? worker_thread+0x127/0x310 +[ 26.840000] [] ? autoremove_wake_function+0x0/0x60 +[ 26.844000] [] ? worker_thread+0x0/0x310 +[ 26.848000] [] kthread+0x7c/0x90 +[ 26.852000] [] ? kthread+0x0/0x90 +[ 26.856000] [] kernel_thread_helper+0x7/0x10 +[ 26.860000] BUG: using smp_processor_id() in preemptible [00000000] code: events/1/10 +[ 26.864000] caller is vmstat_update+0x3c/0x70 + +Because this commit: + + a1f84a3: sched: Check for an idle shared cache in select_task_rq_fair() + +broke ->cpus_allowed. + +Signed-off-by: Mike Galbraith +Cc: Peter Zijlstra +Cc: arjan@infradead.org +LKML-Reference: <1257415066.12867.1.camel@marge.simson.net> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/sched_fair.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/kernel/sched_fair.c ++++ b/kernel/sched_fair.c +@@ -1415,6 +1415,8 @@ static int select_task_rq_fair(struct ta + + if (candidate == -1 || candidate == cpu) { + for_each_cpu(i, sched_domain_span(tmp)) { ++ if (!cpumask_test_cpu(i, &p->cpus_allowed)) ++ continue; + if (!cpu_rq(i)->cfs.nr_running) { + candidate = i; + break; + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:44 2009 +Message-Id: <20091217035644.782513558@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:11 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mike Galbraith , + Peter Zijlstra , + Ingo Molnar +Subject: [014/151] sched: Rate-limit newidle + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mike Galbraith + +commit 1b9508f6831e10d53256825de8904caa22d1ca2c upstream. + +Rate limit newidle to migration_cost. It's a win for all +stages of sysbench oltp tests. + +Signed-off-by: Mike Galbraith +Cc: Peter Zijlstra +LKML-Reference: +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/sched.c | 22 +++++++++++++++++++++- + kernel/sched_debug.c | 4 ++++ + 2 files changed, 25 insertions(+), 1 deletion(-) + +--- a/kernel/sched.c ++++ b/kernel/sched.c +@@ -591,6 +591,8 @@ struct rq { + + u64 rt_avg; + u64 age_stamp; ++ u64 idle_stamp; ++ u64 avg_idle; + #endif + + /* calc_load related fields */ +@@ -2384,6 +2386,17 @@ static int try_to_wake_up(struct task_st + if (rq != orig_rq) + update_rq_clock(rq); + ++ if (rq->idle_stamp) { ++ u64 delta = rq->clock - rq->idle_stamp; ++ u64 max = 2*sysctl_sched_migration_cost; ++ ++ if (delta > max) ++ rq->avg_idle = max; ++ else ++ update_avg(&rq->avg_idle, delta); ++ rq->idle_stamp = 0; ++ } ++ + WARN_ON(p->state != TASK_WAKING); + cpu = task_cpu(p); + +@@ -4429,6 +4442,11 @@ static void idle_balance(int this_cpu, s + int pulled_task = 0; + unsigned long next_balance = jiffies + HZ; + ++ this_rq->idle_stamp = this_rq->clock; ++ ++ if (this_rq->avg_idle < sysctl_sched_migration_cost) ++ return; ++ + for_each_domain(this_cpu, sd) { + unsigned long interval; + +@@ -4443,8 +4461,10 @@ static void idle_balance(int this_cpu, s + interval = msecs_to_jiffies(sd->balance_interval); + if (time_after(next_balance, sd->last_balance + interval)) + next_balance = sd->last_balance + interval; +- if (pulled_task) ++ if (pulled_task) { ++ this_rq->idle_stamp = 0; + break; ++ } + } + if (pulled_task || time_after(jiffies, this_rq->next_balance)) { + /* +--- a/kernel/sched_debug.c ++++ b/kernel/sched_debug.c +@@ -285,12 +285,16 @@ static void print_cpu(struct seq_file *m + + #ifdef CONFIG_SCHEDSTATS + #define P(n) SEQ_printf(m, " .%-30s: %d\n", #n, rq->n); ++#define P64(n) SEQ_printf(m, " .%-30s: %Ld\n", #n, rq->n); + + P(yld_count); + + P(sched_switch); + P(sched_count); + P(sched_goidle); ++#ifdef CONFIG_SMP ++ P64(avg_idle); ++#endif + + P(ttwu_count); + P(ttwu_local); + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:45 2009 +Message-Id: <20091217035644.913059330@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:12 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mike Galbraith , + Peter Zijlstra , + Ingo Molnar +Subject: [015/151] sched: Fix and clean up rate-limit newidle code + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mike Galbraith + +commit eae0c9dfb534cb3449888b9601228efa6480fdb5 upstream. + +Commit 1b9508f, "Rate-limit newidle" has been confirmed to fix +the netperf UDP loopback regression reported by Alex Shi. + +This is a cleanup and a fix: + + - moved to a more out of the way spot + + - fix to ensure that balancing doesn't try to balance + runqueues which haven't gone online yet, which can + mess up CPU enumeration during boot. + +Reported-by: Alex Shi +Reported-by: Zhang, Yanmin +Signed-off-by: Mike Galbraith +Acked-by: Peter Zijlstra +LKML-Reference: <1257821402.5648.17.camel@marge.simson.net> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/sched.c | 28 +++++++++++++++------------- + 1 file changed, 15 insertions(+), 13 deletions(-) + +--- a/kernel/sched.c ++++ b/kernel/sched.c +@@ -2386,17 +2386,6 @@ static int try_to_wake_up(struct task_st + if (rq != orig_rq) + update_rq_clock(rq); + +- if (rq->idle_stamp) { +- u64 delta = rq->clock - rq->idle_stamp; +- u64 max = 2*sysctl_sched_migration_cost; +- +- if (delta > max) +- rq->avg_idle = max; +- else +- update_avg(&rq->avg_idle, delta); +- rq->idle_stamp = 0; +- } +- + WARN_ON(p->state != TASK_WAKING); + cpu = task_cpu(p); + +@@ -2453,6 +2442,17 @@ out_running: + #ifdef CONFIG_SMP + if (p->sched_class->task_wake_up) + p->sched_class->task_wake_up(rq, p); ++ ++ if (unlikely(rq->idle_stamp)) { ++ u64 delta = rq->clock - rq->idle_stamp; ++ u64 max = 2*sysctl_sched_migration_cost; ++ ++ if (delta > max) ++ rq->avg_idle = max; ++ else ++ update_avg(&rq->avg_idle, delta); ++ rq->idle_stamp = 0; ++ } + #endif + out: + task_rq_unlock(rq, &flags); +@@ -4139,7 +4139,7 @@ static int load_balance(int this_cpu, st + unsigned long flags; + struct cpumask *cpus = __get_cpu_var(load_balance_tmpmask); + +- cpumask_setall(cpus); ++ cpumask_copy(cpus, cpu_online_mask); + + /* + * When power savings policy is enabled for the parent domain, idle +@@ -4302,7 +4302,7 @@ load_balance_newidle(int this_cpu, struc + int all_pinned = 0; + struct cpumask *cpus = __get_cpu_var(load_balance_tmpmask); + +- cpumask_setall(cpus); ++ cpumask_copy(cpus, cpu_online_mask); + + /* + * When power savings policy is enabled for the parent domain, idle +@@ -9542,6 +9542,8 @@ void __init sched_init(void) + rq->cpu = i; + rq->online = 0; + rq->migration_thread = NULL; ++ rq->idle_stamp = 0; ++ rq->avg_idle = 2*sysctl_sched_migration_cost; + INIT_LIST_HEAD(&rq->migration_queue); + rq_attach_root(rq, &def_root_domain); + #endif + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:45 2009 +Message-Id: <20091217035645.040589929@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:13 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Joerg Roedel +Subject: [016/151] x86/amd-iommu: attach devices to pre-allocated domains early + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Joerg Roedel + +commit be831297716036de5b24308447ecb69f1706a846 upstream. + +For some devices the ACPI table may define unity map +requirements which must me met when the IOMMU is enabled. So +we need to attach devices to their domains as early as +possible so that these mappings are in place when needed. +This patch assigns the domains right after they are +allocated. Otherwise this can result in I/O page faults +before a driver binds to a device and BIOS is still using +it. + +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/amd_iommu.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/amd_iommu.c ++++ b/arch/x86/kernel/amd_iommu.c +@@ -2047,10 +2047,10 @@ static void prealloc_protection_domains( + struct pci_dev *dev = NULL; + struct dma_ops_domain *dma_dom; + struct amd_iommu *iommu; +- u16 devid; ++ u16 devid, __devid; + + while ((dev = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, dev)) != NULL) { +- devid = calc_devid(dev->bus->number, dev->devfn); ++ __devid = devid = calc_devid(dev->bus->number, dev->devfn); + if (devid > amd_iommu_last_bdf) + continue; + devid = amd_iommu_alias_table[devid]; +@@ -2065,6 +2065,10 @@ static void prealloc_protection_domains( + init_unity_mappings_for_device(dma_dom, devid); + dma_dom->target_dev = devid; + ++ attach_device(iommu, &dma_dom->domain, devid); ++ if (__devid != devid) ++ attach_device(iommu, &dma_dom->domain, __devid); ++ + list_add_tail(&dma_dom->list, &iommu_pd_list); + } + } + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:45 2009 +Message-Id: <20091217035645.169446528@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:14 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Joerg Roedel +Subject: [017/151] x86/amd-iommu: un__init iommu_setup_msi + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Joerg Roedel + +commit 9f800de38b05d84809e89f16671d636a140eede7 upstream. + +This function may be called on the resume path and can not +be dropped after booting. + +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/amd_iommu_init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/amd_iommu_init.c ++++ b/arch/x86/kernel/amd_iommu_init.c +@@ -925,7 +925,7 @@ static int __init init_iommu_all(struct + * + ****************************************************************************/ + +-static int __init iommu_setup_msi(struct amd_iommu *iommu) ++static int iommu_setup_msi(struct amd_iommu *iommu) + { + int r; + + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:45 2009 +Message-Id: <20091217035645.294277007@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:15 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Darrick J. Wong" , + Muli Ben-Yehuda , + FUJITA Tomonori , + Joerg Roedel , + Yinghai Lu , + "Jon D. Mason" , + Corinna Schultz , + Ingo Molnar +Subject: [018/151] x86, Calgary IOMMU quirk: Find nearest matching Calgary while walking up the PCI tree + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Darrick J. Wong + +commit 4528752f49c1f4025473d12bc5fa9181085c3f22 upstream. + +On a multi-node x3950M2 system, there's a slight oddity in the +PCI device tree for all secondary nodes: + + 30:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev e1) + \-33:00.0 PCI bridge: IBM CalIOC2 PCI-E Root Port (rev 01) + \-34:00.0 RAID bus controller: LSI Logic / Symbios Logic MegaRAID SAS 1078 (rev 04) + +...as compared to the primary node: + + 00:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev e1) + \-01:00.0 VGA compatible controller: ATI Technologies Inc ES1000 (rev 02) + 03:00.0 PCI bridge: IBM CalIOC2 PCI-E Root Port (rev 01) + \-04:00.0 RAID bus controller: LSI Logic / Symbios Logic MegaRAID SAS 1078 (rev 04) + +In both nodes, the LSI RAID controller hangs off a CalIOC2 +device, but on the secondary nodes, the BIOS hides the VGA +device and substitutes the device tree ending with the disk +controller. + +It would seem that Calgary devices don't necessarily appear at +the top of the PCI tree, which means that the current code to +find the Calgary IOMMU that goes with a particular device is +buggy. + +Rather than walk all the way to the top of the PCI +device tree and try to match bus number with Calgary descriptor, +the code needs to examine each parent of the particular device; +if it encounters a Calgary with a matching bus number, simply +use that. + +Otherwise, we BUG() when the bus number of the Calgary doesn't +match the bus number of whatever's at the top of the device tree. + +Extra note: This patch appears to work correctly for the x3950 +that came before the x3950 M2. + +Signed-off-by: Darrick J. Wong +Acked-by: Muli Ben-Yehuda +Cc: FUJITA Tomonori +Cc: Joerg Roedel +Cc: Yinghai Lu +Cc: Jon D. Mason +Cc: Corinna Schultz +LKML-Reference: <20091202230556.GG10295@tux1.beaverton.ibm.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/pci-calgary_64.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/arch/x86/kernel/pci-calgary_64.c ++++ b/arch/x86/kernel/pci-calgary_64.c +@@ -318,13 +318,15 @@ static inline struct iommu_table *find_i + + pdev = to_pci_dev(dev); + ++ /* search up the device tree for an iommu */ + pbus = pdev->bus; +- +- /* is the device behind a bridge? Look for the root bus */ +- while (pbus->parent) ++ do { ++ tbl = pci_iommu(pbus); ++ if (tbl && tbl->it_busno == pbus->number) ++ break; ++ tbl = NULL; + pbus = pbus->parent; +- +- tbl = pci_iommu(pbus); ++ } while (pbus); + + BUG_ON(tbl && (tbl->it_busno != pbus->number)); + + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:45 2009 +Message-Id: <20091217035645.425455678@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:16 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tejun Heo , + FUJITA Tomonori , + Matteo Frigo , + Ingo Molnar +Subject: [019/151] x86: Fix iommu=nodac parameter handling + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Tejun Heo + +commit 2ae8bb75db1f3de422eb5898f2a063c46c36dba8 upstream. + +iommu=nodac should forbid dac instead of enabling it. Fix it. + +Signed-off-by: Tejun Heo +Acked-by: FUJITA Tomonori +Cc: Matteo Frigo +LKML-Reference: <4AE5B52A.4050408@kernel.org> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/pci-dma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/pci-dma.c ++++ b/arch/x86/kernel/pci-dma.c +@@ -214,7 +214,7 @@ static __init int iommu_setup(char *p) + if (!strncmp(p, "allowdac", 8)) + forbid_dac = 0; + if (!strncmp(p, "nodac", 5)) +- forbid_dac = -1; ++ forbid_dac = 1; + if (!strncmp(p, "usedac", 6)) { + forbid_dac = -1; + return 1; + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:45 2009 +Message-Id: <20091217035645.550452168@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:17 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Joe Perches , + Ingo Molnar +Subject: [020/151] x86: GART: pci-gart_64.c: Use correct length in strncmp + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Joe Perches + +commit 41855b77547fa18d90ed6a5d322983d3fdab1959 upstream. + +Signed-off-by: Joe Perches +LKML-Reference: <1257818330.12852.72.camel@Joe-Laptop.home> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/pci-gart_64.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/pci-gart_64.c ++++ b/arch/x86/kernel/pci-gart_64.c +@@ -856,7 +856,7 @@ void __init gart_parse_options(char *p) + #endif + if (isdigit(*p) && get_option(&p, &arg)) + iommu_size = arg; +- if (!strncmp(p, "fullflush", 8)) ++ if (!strncmp(p, "fullflush", 9)) + iommu_fullflush = 1; + if (!strncmp(p, "nofullflush", 11)) + iommu_fullflush = 0; + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:45 2009 +Message-Id: <20091217035645.678326175@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:18 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Leann Ogasawara , + "H. Peter Anvin" +Subject: [021/151] x86: ASUS P4S800 reboot=bios quirk + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Leann Ogasawara + +commit 4832ddda2ec4df96ea1eed334ae2dbd65fc1f541 upstream. + +Bug reporter noted their system with an ASUS P4S800 motherboard would +hang when rebooting unless reboot=b was specified. Their dmidecode +didn't contain descriptive System Information for Manufacturer or +Product Name, so I used their Base Board Information to create a +reboot quirk patch. The bug reporter confirmed this patch resolves +the reboot hang. + +Handle 0x0001, DMI type 1, 25 bytes +System Information + Manufacturer: System Manufacturer + Product Name: System Name + Version: System Version + Serial Number: SYS-1234567890 + UUID: E0BFCD8B-7948-D911-A953-E486B4EEB67F + Wake-up Type: Power Switch + +Handle 0x0002, DMI type 2, 8 bytes +Base Board Information + Manufacturer: ASUSTeK Computer INC. + Product Name: P4S800 + Version: REV 1.xx + Serial Number: xxxxxxxxxxx + +BugLink: http://bugs.launchpad.net/bugs/366682 + +ASUS P4S800 will hang when rebooting unless reboot=b is specified. +Add a quirk to reboot through the bios. + +Signed-off-by: Leann Ogasawara +LKML-Reference: <1259972107.4629.275.camel@emiko> +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/reboot.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/arch/x86/kernel/reboot.c ++++ b/arch/x86/kernel/reboot.c +@@ -259,6 +259,14 @@ static struct dmi_system_id __initdata r + DMI_MATCH(DMI_PRODUCT_NAME, "SBC-FITPC2"), + }, + }, ++ { /* Handle problems with rebooting on ASUS P4S800 */ ++ .callback = set_bios_reboot, ++ .ident = "ASUS P4S800", ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."), ++ DMI_MATCH(DMI_BOARD_NAME, "P4S800"), ++ }, ++ }, + { } + }; + + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:45 2009 +Message-Id: <20091217035645.802252912@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:19 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mikael Pettersson , + Andreas Herrmann , + Joerg Roedel , + Ingo Molnar +Subject: [022/151] x86, apic: Enable lapic nmi watchdog on AMD Family 11h + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mikael Pettersson + +commit 7d1849aff6687a135a8da3a75e32a00e3137a5e2 upstream. + +The x86 lapic nmi watchdog does not recognize AMD Family 11h, +resulting in: + + NMI watchdog: CPU not supported + +As far as I can see from available documentation (the BKDM), +family 11h looks identical to family 10h as far as the PMU +is concerned. + +Extending the check to accept family 11h results in: + + Testing NMI watchdog ... OK. + +I've been running with this change on a Turion X2 Ultra ZM-82 +laptop for a couple of weeks now without problems. + +Signed-off-by: Mikael Pettersson +Cc: Andreas Herrmann +Cc: Joerg Roedel +LKML-Reference: <19223.53436.931768.278021@pilspetsen.it.uu.se> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/perfctr-watchdog.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/cpu/perfctr-watchdog.c ++++ b/arch/x86/kernel/cpu/perfctr-watchdog.c +@@ -712,7 +712,7 @@ static void probe_nmi_watchdog(void) + switch (boot_cpu_data.x86_vendor) { + case X86_VENDOR_AMD: + if (boot_cpu_data.x86 != 6 && boot_cpu_data.x86 != 15 && +- boot_cpu_data.x86 != 16) ++ boot_cpu_data.x86 != 16 && boot_cpu_data.x86 != 17) + return; + wd_ops = &k7_wd_ops; + break; + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:46 2009 +Message-Id: <20091217035645.929446109@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:20 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Michael Buesch , + "John W. Linville" +Subject: [023/151] ssb: Fix range check in sprom write + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Michael Buesch + +commit e33761e6f23881de9f3ee77cc2204ab2e26f3d9a upstream. + +The range check in the sprom image parser hex2sprom() is broken. +One sprom word is 4 hex characters. +This fixes the check and also adds much better sanity checks to the code. +We better make sure the image is OK by doing some sanity checks to avoid +bricking the device by accident. + +Signed-off-by: Michael Buesch +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ssb/sprom.c | 20 ++++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +--- a/drivers/ssb/sprom.c ++++ b/drivers/ssb/sprom.c +@@ -13,6 +13,8 @@ + + #include "ssb_private.h" + ++#include ++ + + static const struct ssb_sprom *fallback_sprom; + +@@ -33,17 +35,27 @@ static int sprom2hex(const u16 *sprom, c + static int hex2sprom(u16 *sprom, const char *dump, size_t len, + size_t sprom_size_words) + { +- char tmp[5] = { 0 }; +- int cnt = 0; ++ char c, tmp[5] = { 0 }; ++ int err, cnt = 0; + unsigned long parsed; + +- if (len < sprom_size_words * 2) ++ /* Strip whitespace at the end. */ ++ while (len) { ++ c = dump[len - 1]; ++ if (!isspace(c) && c != '\0') ++ break; ++ len--; ++ } ++ /* Length must match exactly. */ ++ if (len != sprom_size_words * 4) + return -EINVAL; + + while (cnt < sprom_size_words) { + memcpy(tmp, dump, 4); + dump += 4; +- parsed = simple_strtoul(tmp, NULL, 16); ++ err = strict_strtoul(tmp, 16, &parsed); ++ if (err) ++ return err; + sprom[cnt++] = swab16((u16)parsed); + } + + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:46 2009 +Message-Id: <20091217035646.060484400@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:21 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Bob Copeland , + "John W. Linville" +Subject: [024/151] ath5k: allow setting txpower to 0 + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Bob Copeland + +commit 2eb2fa67e5462a36e98172fb92c78bc405b3035f upstream. + +As a holdover from earlier code when we used to set +the power limit to '0' after a reset to configure the +default transmit power, ath5k interprets txpower=0 as +12.5 dBm. Fix that by just passing 0 through. + +This fixes http://bugzilla.kernel.org/show_bug.cgi?id=14567 + +Reported-by: Daniel Folkers +Tested-by: Daniel Folkers +Signed-off-by: Bob Copeland +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath5k/phy.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/net/wireless/ath/ath5k/phy.c ++++ b/drivers/net/wireless/ath/ath5k/phy.c +@@ -2954,8 +2954,6 @@ ath5k_hw_txpower(struct ath5k_hw *ah, st + ATH5K_ERR(ah->ah_sc, "invalid tx power: %u\n", txpower); + return -EINVAL; + } +- if (txpower == 0) +- txpower = AR5K_TUNE_DEFAULT_TXPOWER; + + /* Reset TX power values */ + memset(&ah->ah_txpower, 0, sizeof(ah->ah_txpower)); + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:46 2009 +Message-Id: <20091217035646.187922809@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:22 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + jirislaby@gmail.com, + rjw@sisk.pl, + me@bobcopeland.com, + david.quan@atheros.com, + "Luis R. Rodriguez" , + "John W. Linville" +Subject: [025/151] ath5k: enable EEPROM checksum check + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Luis R. Rodriguez + +commit 512414b0bed0d376ac4d5ec1dd6f0b1a3551febc upstream. + +Without this we have no gaurantee of the integrity of the +EEPROM and are likely to encounter a lot of bogus bug reports +due to actual issues on the EEPROM. With the EEPROM checksum +check in place we can easily rule those issues out. + +If you run patch during a revert *you* have a card with a busted +EEPROM and only older kernel will support that concoction. This +patch is a trade off between not accepitng bogus EEPROMs and +avoiding bogus bug reports allowing developers to focus instead +on real concrete issues. + +If stable keeps bogus bug reports because of a possibly busted EEPROM +feel free to apply this there too. + +Tested on an AR5414 + +Cc: jirislaby@gmail.com +Cc: akpm@linux-foundation.org +Cc: rjw@sisk.pl +Cc: me@bobcopeland.com +Cc: david.quan@atheros.com +Signed-off-by: Luis R. Rodriguez +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath5k/eeprom.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/net/wireless/ath/ath5k/eeprom.c ++++ b/drivers/net/wireless/ath/ath5k/eeprom.c +@@ -97,6 +97,7 @@ ath5k_eeprom_init_header(struct ath5k_hw + struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom; + int ret; + u16 val; ++ u32 cksum, offset; + + /* + * Read values from EEPROM and store them in the capability structure +@@ -111,7 +112,6 @@ ath5k_eeprom_init_header(struct ath5k_hw + if (ah->ah_ee_version < AR5K_EEPROM_VERSION_3_0) + return 0; + +-#ifdef notyet + /* + * Validate the checksum of the EEPROM date. There are some + * devices with invalid EEPROMs. +@@ -124,7 +124,6 @@ ath5k_eeprom_init_header(struct ath5k_hw + ATH5K_ERR(ah->ah_sc, "Invalid EEPROM checksum 0x%04x\n", cksum); + return -EIO; + } +-#endif + + AR5K_EEPROM_READ_HDR(AR5K_EEPROM_ANT_GAIN(ah->ah_ee_version), + ee_ant_gain); + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:46 2009 +Message-Id: <20091217035646.312813630@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:23 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Feng Tang , + Heiko Carstens , + Thomas Gleixner +Subject: [026/151] hrtimer: Fix /proc/timer_list regression + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Feng Tang + +commit 8629ea2eaba8ca0de2e38ce1b4a825e16255976e upstream. + +commit 507e1231 (timer stats: Optimize by adding quick check to avoid +function calls) introduced a regression in /proc/timer_list. + +/proc/timer_list shows now + #0: , tick_sched_timer, S:01, <(null)>, /-1 +instead of + #0: , tick_sched_timer, S:01, hrtimer_start, swapper/0 + +Revert the hrtimer quick check for now. The optimization needs more +thought, but this is neither 2.6.32-rc7 nor stable material. + +[ tglx: - Removed unrelated changes from the original patch + - Prevent unneccesary call to timer_stats_update_stats + - massaged the changelog ] + +Signed-off-by: Feng Tang +LKML-Reference: +Cc: Heiko Carstens +Signed-off-by: Andrew Morton +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/hrtimer.h | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/include/linux/hrtimer.h ++++ b/include/linux/hrtimer.h +@@ -446,7 +446,7 @@ extern void timer_stats_update_stats(voi + + static inline void timer_stats_account_hrtimer(struct hrtimer *timer) + { +- if (likely(!timer->start_site)) ++ if (likely(!timer_stats_active)) + return; + timer_stats_update_stats(timer, timer->start_pid, timer->start_site, + timer->function, timer->start_comm, 0); +@@ -457,8 +457,6 @@ extern void __timer_stats_hrtimer_set_st + + static inline void timer_stats_hrtimer_set_start_info(struct hrtimer *timer) + { +- if (likely(!timer_stats_active)) +- return; + __timer_stats_hrtimer_set_start_info(timer, __builtin_return_address(0)); + } + + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:46 2009 +Message-Id: <20091217035646.448586018@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:24 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Takashi Iwai +Subject: [027/151] ALSA: hrtimer - Fix lock-up + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Takashi Iwai + +commit fcfdebe70759c74e2e701f69aaa7f0e5e32cf5a6 upstream. + +The timer stop callback can be called from snd_timer_interrupt(), which +is called from the hrtimer callback. Since hrtimer_cancel() waits for +the callback completion, this eventually results in a lock-up. + +This patch fixes the problem by just toggling a flag at stop callback +and call hrtimer_cancel() later. + +Reported-and-tested-by: Wojtek Zabolotny +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/hrtimer.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +--- a/sound/core/hrtimer.c ++++ b/sound/core/hrtimer.c +@@ -37,14 +37,22 @@ static unsigned int resolution; + struct snd_hrtimer { + struct snd_timer *timer; + struct hrtimer hrt; ++ atomic_t running; + }; + + static enum hrtimer_restart snd_hrtimer_callback(struct hrtimer *hrt) + { + struct snd_hrtimer *stime = container_of(hrt, struct snd_hrtimer, hrt); + struct snd_timer *t = stime->timer; ++ ++ if (!atomic_read(&stime->running)) ++ return HRTIMER_NORESTART; ++ + hrtimer_forward_now(hrt, ns_to_ktime(t->sticks * resolution)); + snd_timer_interrupt(stime->timer, t->sticks); ++ ++ if (!atomic_read(&stime->running)) ++ return HRTIMER_NORESTART; + return HRTIMER_RESTART; + } + +@@ -58,6 +66,7 @@ static int snd_hrtimer_open(struct snd_t + hrtimer_init(&stime->hrt, CLOCK_MONOTONIC, HRTIMER_MODE_REL); + stime->timer = t; + stime->hrt.function = snd_hrtimer_callback; ++ atomic_set(&stime->running, 0); + t->private_data = stime; + return 0; + } +@@ -78,16 +87,18 @@ static int snd_hrtimer_start(struct snd_ + { + struct snd_hrtimer *stime = t->private_data; + ++ atomic_set(&stime->running, 0); ++ hrtimer_cancel(&stime->hrt); + hrtimer_start(&stime->hrt, ns_to_ktime(t->sticks * resolution), + HRTIMER_MODE_REL); ++ atomic_set(&stime->running, 1); + return 0; + } + + static int snd_hrtimer_stop(struct snd_timer *t) + { + struct snd_hrtimer *stime = t->private_data; +- +- hrtimer_cancel(&stime->hrt); ++ atomic_set(&stime->running, 0); + return 0; + } + + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:46 2009 +Message-Id: <20091217035646.562099541@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:25 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jaroslav Kysela , + Takashi Iwai +Subject: [028/151] ALSA: hda - Terradici HDA controllers does not support 64-bit mode + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jaroslav Kysela + +commit 396087eaead95fcb29eb36f1e59517aeb58c545e upstream. + +Confirmed from vendor and tests in RedHat bugzilla #536782 . + +Signed-off-by: Jaroslav Kysela +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_intel.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2436,6 +2436,11 @@ static int __devinit azx_create(struct s + } + } + ++ /* disable 64bit DMA address for Teradici */ ++ /* it does not work with device 6549:1200 subsys e4a2:040b */ ++ if (chip->driver_type == AZX_DRIVER_TERA) ++ gcap &= ~ICH6_GCAP_64OK; ++ + /* allow 64bit DMA address if supported by H/W */ + if ((gcap & ICH6_GCAP_64OK) && !pci_set_dma_mask(pci, DMA_BIT_MASK(64))) + pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(64)); + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:46 2009 +Message-Id: <20091217035646.693037750@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:26 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Avi Kivity +Subject: [029/151] KVM: x86 emulator: limit instructions to 15 bytes + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Avi Kivity + +commit eb3c79e64a70fb8f7473e30fa07e89c1ecc2c9bb upstream. + +While we are never normally passed an instruction that exceeds 15 bytes, +smp games can cause us to attempt to interpret one, which will cause +large latencies in non-preempt hosts. + +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- a/arch/x86/include/asm/kvm_emulate.h ++++ b/arch/x86/include/asm/kvm_emulate.h +@@ -129,7 +129,7 @@ struct decode_cache { + u8 seg_override; + unsigned int d; + unsigned long regs[NR_VCPU_REGS]; +- unsigned long eip; ++ unsigned long eip, eip_orig; + /* modrm */ + u8 modrm; + u8 modrm_mod; +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c +index d226dff..7e8faea 100644 +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -622,6 +622,9 @@ static int do_insn_fetch(struct x86_emulate_ctxt *ctxt, + { + int rc = 0; + ++ /* x86 instructions are limited to 15 bytes. */ ++ if (eip + size - ctxt->decode.eip_orig > 15) ++ return X86EMUL_UNHANDLEABLE; + eip += ctxt->cs_base; + while (size--) { + rc = do_fetch_insn_byte(ctxt, ops, eip++, dest++); +@@ -880,7 +883,7 @@ x86_decode_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops) + /* Shadow copy of register state. Committed on successful emulation. */ + + memset(c, 0, sizeof(struct decode_cache)); +- c->eip = kvm_rip_read(ctxt->vcpu); ++ c->eip = c->eip_orig = kvm_rip_read(ctxt->vcpu); + ctxt->cs_base = seg_base(ctxt, VCPU_SREG_CS); + memcpy(c->regs, ctxt->vcpu->arch.regs, sizeof c->regs); + + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:46 2009 +Message-Id: <20091217035646.823076826@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:27 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Carsten Otte , + Avi Kivity +Subject: [030/151] KVM: s390: Fix prefix register checking in arch/s390/kvm/sigp.c + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Carsten Otte + +commit f50146bd7bdb75435638e60d4960edd9bcdf88b8 upstream. + +This patch corrects the checking of the new address for the prefix register. +On s390, the prefix register is used to address the cpu's lowcore (address +0...8k). This check is supposed to verify that the memory is readable and +present. +copy_from_guest is a helper function, that can be used to read from guest +memory. It applies prefixing, adds the start address of the guest memory in +user, and then calls copy_from_user. Previous code was obviously broken for +two reasons: +- prefixing should not be applied here. The current prefix register is + going to be updated soon, and the address we're looking for will be + 0..8k after we've updated the register +- we're adding the guest origin (gmsor) twice: once in subject code + and once in copy_from_guest + +With kuli, we did not hit this problem because (a) we were lucky with +previous prefix register content, and (b) our guest memory was mmaped +very low into user address space. + +Signed-off-by: Carsten Otte +Reported-by: Alexander Graf +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- a/arch/s390/kvm/sigp.c ++++ b/arch/s390/kvm/sigp.c +@@ -188,9 +188,9 @@ static int __sigp_set_prefix(struct kvm_vcpu *vcpu, u16 cpu_addr, u32 address, + + /* make sure that the new value is valid memory */ + address = address & 0x7fffe000u; +- if ((copy_from_guest(vcpu, &tmp, +- (u64) (address + vcpu->arch.sie_block->gmsor) , 1)) || +- (copy_from_guest(vcpu, &tmp, (u64) (address + ++ if ((copy_from_user(&tmp, (void __user *) ++ (address + vcpu->arch.sie_block->gmsor) , 1)) || ++ (copy_from_user(&tmp, (void __user *)(address + + vcpu->arch.sie_block->gmsor + PAGE_SIZE), 1))) { + *reg |= SIGP_STAT_INVALID_PARAMETER; + return 1; /* invalid parameter */ + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:47 2009 +Message-Id: <20091217035646.953520979@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:28 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Carsten Otte , + Avi Kivity +Subject: [031/151] KVM: s390: Make psw available on all exits, not just a subset + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Carsten Otte + +commit d7b0b5eb3000c6fb902f08c619fcd673a23d8fab upstream. + +This patch moves s390 processor status word into the base kvm_run +struct and keeps it up-to date on all userspace exits. + +The userspace ABI is broken by this, however there are no applications +in the wild using this. A capability check is provided so users can +verify the updated API exists. + +Signed-off-by: Carsten Otte +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/include/asm/kvm.h | 3 ++- + arch/s390/kvm/kvm-s390.c | 25 +++++++++++++++++-------- + include/linux/kvm.h | 8 ++++++-- + 3 files changed, 25 insertions(+), 11 deletions(-) + +--- a/arch/s390/include/asm/kvm.h ++++ b/arch/s390/include/asm/kvm.h +@@ -1,6 +1,5 @@ + #ifndef __LINUX_KVM_S390_H + #define __LINUX_KVM_S390_H +- + /* + * asm-s390/kvm.h - KVM s390 specific structures and definitions + * +@@ -15,6 +14,8 @@ + */ + #include + ++#define __KVM_S390 ++ + /* for KVM_GET_REGS and KVM_SET_REGS */ + struct kvm_regs { + /* general purpose regs for s390 */ +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -116,10 +116,16 @@ long kvm_arch_dev_ioctl(struct file *fil + + int kvm_dev_ioctl_check_extension(long ext) + { ++ int r; ++ + switch (ext) { ++ case KVM_CAP_S390_PSW: ++ r = 1; ++ break; + default: +- return 0; ++ r = 0; + } ++ return r; + } + + /* Section: vm related */ +@@ -419,8 +425,10 @@ static int kvm_arch_vcpu_ioctl_set_initi + vcpu_load(vcpu); + if (atomic_read(&vcpu->arch.sie_block->cpuflags) & CPUSTAT_RUNNING) + rc = -EBUSY; +- else +- vcpu->arch.sie_block->gpsw = psw; ++ else { ++ vcpu->run->psw_mask = psw.mask; ++ vcpu->run->psw_addr = psw.addr; ++ } + vcpu_put(vcpu); + return rc; + } +@@ -508,9 +516,6 @@ rerun_vcpu: + + switch (kvm_run->exit_reason) { + case KVM_EXIT_S390_SIEIC: +- vcpu->arch.sie_block->gpsw.mask = kvm_run->s390_sieic.mask; +- vcpu->arch.sie_block->gpsw.addr = kvm_run->s390_sieic.addr; +- break; + case KVM_EXIT_UNKNOWN: + case KVM_EXIT_INTR: + case KVM_EXIT_S390_RESET: +@@ -519,6 +524,9 @@ rerun_vcpu: + BUG(); + } + ++ vcpu->arch.sie_block->gpsw.mask = kvm_run->psw_mask; ++ vcpu->arch.sie_block->gpsw.addr = kvm_run->psw_addr; ++ + might_fault(); + + do { +@@ -538,8 +546,6 @@ rerun_vcpu: + /* intercept cannot be handled in-kernel, prepare kvm-run */ + kvm_run->exit_reason = KVM_EXIT_S390_SIEIC; + kvm_run->s390_sieic.icptcode = vcpu->arch.sie_block->icptcode; +- kvm_run->s390_sieic.mask = vcpu->arch.sie_block->gpsw.mask; +- kvm_run->s390_sieic.addr = vcpu->arch.sie_block->gpsw.addr; + kvm_run->s390_sieic.ipa = vcpu->arch.sie_block->ipa; + kvm_run->s390_sieic.ipb = vcpu->arch.sie_block->ipb; + rc = 0; +@@ -551,6 +557,9 @@ rerun_vcpu: + rc = 0; + } + ++ kvm_run->psw_mask = vcpu->arch.sie_block->gpsw.mask; ++ kvm_run->psw_addr = vcpu->arch.sie_block->gpsw.addr; ++ + if (vcpu->sigset_active) + sigprocmask(SIG_SETMASK, &sigsaved, NULL); + +--- a/include/linux/kvm.h ++++ b/include/linux/kvm.h +@@ -116,6 +116,11 @@ struct kvm_run { + __u64 cr8; + __u64 apic_base; + ++#ifdef __KVM_S390 ++ /* the processor status word for s390 */ ++ __u64 psw_mask; /* psw upper half */ ++ __u64 psw_addr; /* psw lower half */ ++#endif + union { + /* KVM_EXIT_UNKNOWN */ + struct { +@@ -167,8 +172,6 @@ struct kvm_run { + /* KVM_EXIT_S390_SIEIC */ + struct { + __u8 icptcode; +- __u64 mask; /* psw upper half */ +- __u64 addr; /* psw lower half */ + __u16 ipa; + __u32 ipb; + } s390_sieic; +@@ -474,6 +477,7 @@ struct kvm_irq_routing { + }; + + #endif ++#define KVM_CAP_S390_PSW 42 + + #ifdef KVM_CAP_MCE + /* x86 MCE */ + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:47 2009 +Message-Id: <20091217035647.086599672@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:29 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Marcelo Tosatti +Subject: [032/151] KVM: fix irq_source_id size verification + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Marcelo Tosatti + +commit cd5a2685de4a642fd0bd763e8c19711ef08dbe27 upstream. + +find_first_zero_bit works with bit numbers, not bytes. + +Fixes + +https://sourceforge.net/tracker/?func=detail&aid=2847560&group_id=180599&atid=893831 + +Reported-by: "Xu, Jiajun" +Signed-off-by: Marcelo Tosatti +Signed-off-by: Greg Kroah-Hartman + +--- + virt/kvm/irq_comm.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/virt/kvm/irq_comm.c ++++ b/virt/kvm/irq_comm.c +@@ -205,10 +205,9 @@ int kvm_request_irq_source_id(struct kvm + int irq_source_id; + + mutex_lock(&kvm->irq_lock); +- irq_source_id = find_first_zero_bit(bitmap, +- sizeof(kvm->arch.irq_sources_bitmap)); ++ irq_source_id = find_first_zero_bit(bitmap, BITS_PER_LONG); + +- if (irq_source_id >= sizeof(kvm->arch.irq_sources_bitmap)) { ++ if (irq_source_id >= BITS_PER_LONG) { + printk(KERN_WARNING "kvm: exhaust allocatable IRQ sources!\n"); + return -EFAULT; + } +@@ -228,7 +227,7 @@ void kvm_free_irq_source_id(struct kvm * + + mutex_lock(&kvm->irq_lock); + if (irq_source_id < 0 || +- irq_source_id >= sizeof(kvm->arch.irq_sources_bitmap)) { ++ irq_source_id >= BITS_PER_LONG) { + printk(KERN_ERR "kvm: IRQ source ID out of range!\n"); + return; + } + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:47 2009 +Message-Id: <20091217035647.215895711@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:30 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Glauber Costa , + Marcelo Tosatti +Subject: [033/151] KVM: x86: include pvclock MSRs in msrs_to_save + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Glauber Costa + +commit e3267cbbbfbcbe9c18833e89b10beabb1117cb55 upstream. + +For a while now, we are issuing a rdmsr instruction to find out which +msrs in our save list are really supported by the underlying machine. +However, it fails to account for kvm-specific msrs, such as the pvclock +ones. + +This patch moves then to the beginning of the list, and skip testing them. + +Signed-off-by: Glauber Costa +Signed-off-by: Marcelo Tosatti +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/x86.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -484,16 +484,19 @@ static inline u32 bit(int bitno) + * and KVM_SET_MSRS, and KVM_GET_MSR_INDEX_LIST. + * + * This list is modified at module load time to reflect the +- * capabilities of the host cpu. ++ * capabilities of the host cpu. This capabilities test skips MSRs that are ++ * kvm-specific. Those are put in the beginning of the list. + */ ++ ++#define KVM_SAVE_MSRS_BEGIN 2 + static u32 msrs_to_save[] = { ++ MSR_KVM_SYSTEM_TIME, MSR_KVM_WALL_CLOCK, + MSR_IA32_SYSENTER_CS, MSR_IA32_SYSENTER_ESP, MSR_IA32_SYSENTER_EIP, + MSR_K6_STAR, + #ifdef CONFIG_X86_64 + MSR_CSTAR, MSR_KERNEL_GS_BASE, MSR_SYSCALL_MASK, MSR_LSTAR, + #endif +- MSR_IA32_TSC, MSR_KVM_SYSTEM_TIME, MSR_KVM_WALL_CLOCK, +- MSR_IA32_PERF_STATUS, MSR_IA32_CR_PAT, MSR_VM_HSAVE_PA ++ MSR_IA32_TSC, MSR_IA32_PERF_STATUS, MSR_IA32_CR_PAT, MSR_VM_HSAVE_PA + }; + + static unsigned num_msrs_to_save; +@@ -2433,7 +2436,8 @@ static void kvm_init_msr_list(void) + u32 dummy[2]; + unsigned i, j; + +- for (i = j = 0; i < ARRAY_SIZE(msrs_to_save); i++) { ++ /* skip the first msrs in the list. KVM-specific */ ++ for (i = j = KVM_SAVE_MSRS_BEGIN; i < ARRAY_SIZE(msrs_to_save); i++) { + if (rdmsr_safe(msrs_to_save[i], &dummy[0], &dummy[1]) < 0) + continue; + if (j < i) + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:47 2009 +Message-Id: <20091217035647.346284061@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:31 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Thomas Gleixner , + Ingo Molnar , + Peter Zijlstra , + "H. Peter Anvin" , + Steven Rostedt , + Frederic Weisbecker , + Jeff Law , + gcc@gcc.gnu.org, + David Daney , + Andrew Haley , + Richard Guenther +Subject: [034/151] x86: Prevent GCC 4.4.x (pentium-mmx et al) function prologue wreckage + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Thomas Gleixner + +commit 746357d6a526d6da9d89a2ec645b28406e959c2e upstream. + +When the kernel is compiled with -pg for tracing GCC 4.4.x inserts +stack alignment of a function _before_ the mcount prologue if the +-march=pentium-mmx is set and -mtune=generic is not set. This breaks +the assumption of the function graph tracer which expects that the +mcount prologue + + push %ebp + mov %esp, %ebp + +is the first stack operation in a function because it needs to modify +the function return address on the stack to trap into the tracer +before returning to the real caller. + +The generated code is: + + push %edi + lea 0x8(%esp),%edi + and $0xfffffff0,%esp + pushl -0x4(%edi) + push %ebp + mov %esp,%ebp + +so the tracer modifies the copy of the return address which is stored +after the stack alignment and therefor does not trap the return which +in turn breaks the call chain logic of the tracer and leads to a +kernel panic. + +Aside of the fact that the generated code is horrible for no good +reason other -march -mtune options generate the expected: + + push %ebp + mov %esp,%ebp + and $0xfffffff0,%esp + +which does the same and keeps everything intact. + +After some experimenting we found out that this problem is restricted +to gcc4.4.x and to the following -march settings: + +i586, pentium, pentium-mmx, k6, k6-2, k6-3, winchip-c6, winchip2, c3, +geode + +By adding -mtune=generic the code generator produces always the +expected code. + +So forcing -mtune=generic when CONFIG_FUNCTION_GRAPH_TRACER=y is not +pretty, but at the moment the only way to prevent that the kernel +trips over gcc-shrooms induced code madness. + +Most distro kernels have CONFIG_X86_GENERIC=y anyway which forces +-mtune=generic as well so it will not impact those. + + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +Signed-off-by: Thomas Gleixner +LKML-Reference: +Cc: Linus Torvalds +Cc: Andrew Morton +Cc: Ingo Molnar +Cc: Peter Zijlstra +Cc: H. Peter Anvin +Cc: Steven Rostedt +Cc: Frederic Weisbecker , +Cc: Jeff Law +Cc: gcc@gcc.gnu.org +Cc: David Daney +Cc: Andrew Haley +Cc: Richard Guenther +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/Makefile_32.cpu | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/arch/x86/Makefile_32.cpu ++++ b/arch/x86/Makefile_32.cpu +@@ -46,6 +46,12 @@ cflags-$(CONFIG_MGEODEGX1) += -march=pen + # cpu entries + cflags-$(CONFIG_X86_GENERIC) += $(call tune,generic,$(call tune,i686)) + ++# Work around the pentium-mmx code generator madness of gcc4.4.x which ++# does stack alignment by generating horrible code _before_ the mcount ++# prologue (push %ebp, mov %esp, %ebp) which breaks the function graph ++# tracer assumptions ++cflags-$(CONFIG_FUNCTION_GRAPH_TRACER) += $(call cc-option,-mtune=generic) ++ + # Bug fix for binutils: this option is required in order to keep + # binutils from generating NOPL instructions against our will. + ifneq ($(CONFIG_X86_P6_NOP),y) + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:47 2009 +Message-Id: <20091217035647.478189845@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:32 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Thomas Gleixner +Subject: [035/151] x86: Use -maccumulate-outgoing-args for sane mcount prologues + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Thomas Gleixner + +commit b8b7d791a8ff01d2380089279a69afa99115fb23 upstream. + +commit 746357d (x86: Prevent GCC 4.4.x (pentium-mmx et al) function +prologue wreckage) uses -mtune=generic to work around the function +prologue problem with mcount on -march=pentium-mmx and others. + +Jakub pointed out that we can use -maccumulate-outgoing-args instead +which is selected by -mtune=generic and prevents the problem without +losing the -march specific optimizations. + +Pointed-out-by: Jakub Jelinek +Signed-off-by: Thomas Gleixner +Cc: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/Makefile_32.cpu | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/arch/x86/Makefile_32.cpu ++++ b/arch/x86/Makefile_32.cpu +@@ -49,8 +49,9 @@ cflags-$(CONFIG_X86_GENERIC) += $(call + # Work around the pentium-mmx code generator madness of gcc4.4.x which + # does stack alignment by generating horrible code _before_ the mcount + # prologue (push %ebp, mov %esp, %ebp) which breaks the function graph +-# tracer assumptions +-cflags-$(CONFIG_FUNCTION_GRAPH_TRACER) += $(call cc-option,-mtune=generic) ++# tracer assumptions. For i686, generic, core2 this is set by the ++# compiler anyway ++cflags-$(CONFIG_FUNCTION_GRAPH_TRACER) += $(call cc-option,-maccumulate-outgoing-args) + + # Bug fix for binutils: this option is required in order to keep + # binutils from generating NOPL instructions against our will. + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:47 2009 +Message-Id: <20091217035647.605378154@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:33 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Hidetoshi Seto , + Andi Kleen , + Huang Ying , + Jan Beulich , + "H. Peter Anvin" +Subject: [036/151] x86, mce: dont restart timer if disabled + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Hidetoshi Seto + +commit fe5ed91ddce85a0ed0e4f92c10b099873ef62167 upstream. + +Even it is in error path unlikely taken, add_timer_on() at +CPU_DOWN_FAILED* needs to be skipped if mce_timer is disabled. + +Signed-off-by: Hidetoshi Seto +Cc: Andi Kleen +Cc: Huang Ying +Cc: Jan Beulich +Signed-off-by: H. Peter Anvin +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/mcheck/mce.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/cpu/mcheck/mce.c ++++ b/arch/x86/kernel/cpu/mcheck/mce.c +@@ -1991,9 +1991,11 @@ mce_cpu_callback(struct notifier_block * + break; + case CPU_DOWN_FAILED: + case CPU_DOWN_FAILED_FROZEN: +- t->expires = round_jiffies(jiffies + ++ if (!mce_ignore_ce && check_interval) { ++ t->expires = round_jiffies(jiffies + + __get_cpu_var(mce_next_interval)); +- add_timer_on(t, cpu); ++ add_timer_on(t, cpu); ++ } + smp_call_function_single(cpu, mce_reenable_cpu, &action, 1); + break; + case CPU_POST_DEAD: + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:47 2009 +Message-Id: <20091217035647.738596809@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:34 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jan Beulich , + Hidetoshi Seto , + Ingo Molnar +Subject: [037/151] x86/mce: Set up timer unconditionally + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jan Beulich + +commit bc09effabf0c5c6c7021e5ef9af15a23579b32a8 upstream. + +mce_timer must be passed to setup_timer() in all cases, no +matter whether it is going to be actually used. Otherwise, when +the CPU gets brought down, its call to del_timer_sync() will +never return, as the timer won't have a base associated, and +hence lock_timer_base() will loop infinitely. + +Signed-off-by: Jan Beulich +Signed-off-by: Hidetoshi Seto +LKML-Reference: <4B1DB831.2030801@jp.fujitsu.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/mcheck/mce.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/x86/kernel/cpu/mcheck/mce.c ++++ b/arch/x86/kernel/cpu/mcheck/mce.c +@@ -1374,13 +1374,14 @@ static void mce_init_timer(void) + struct timer_list *t = &__get_cpu_var(mce_timer); + int *n = &__get_cpu_var(mce_next_interval); + ++ setup_timer(t, mcheck_timer, smp_processor_id()); ++ + if (mce_ignore_ce) + return; + + *n = check_interval * HZ; + if (!*n) + return; +- setup_timer(t, mcheck_timer, smp_processor_id()); + t->expires = round_jiffies(jiffies + *n); + add_timer_on(t, smp_processor_id()); + } + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:47 2009 +Message-Id: <20091217035647.865130289@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:35 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Cliff Wickman , + Ingo Molnar +Subject: [038/151] x86: SGI UV: Fix BAU initialization + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Cliff Wickman + +commit e38e2af1c57c3eb5211331a5b4fcaae0c4a2a918 upstream. + +A memory mapped register that affects the SGI UV Broadcast +Assist Unit's interrupt handling may sometimes be unintialized. + +Remove the condition on its initialization, as that condition +can be randomly satisfied by a hardware reset. + +Signed-off-by: Cliff Wickman +LKML-Reference: +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/tlb_uv.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/arch/x86/kernel/tlb_uv.c ++++ b/arch/x86/kernel/tlb_uv.c +@@ -817,10 +817,8 @@ static int __init uv_init_blade(int blad + */ + apicid = blade_to_first_apicid(blade); + pa = uv_read_global_mmr64(pnode, UVH_BAU_DATA_CONFIG); +- if ((pa & 0xff) != UV_BAU_MESSAGE) { +- uv_write_global_mmr64(pnode, UVH_BAU_DATA_CONFIG, ++ uv_write_global_mmr64(pnode, UVH_BAU_DATA_CONFIG, + ((apicid << 32) | UV_BAU_MESSAGE)); +- } + return 0; + } + + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:48 2009 +Message-Id: <20091217035647.992413232@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:36 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Cliff Wickman , + Ingo Molnar +Subject: [039/151] x86: Fix duplicated UV BAU interrupt vector + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Cliff Wickman + +commit 1d865fb728bd6bbcdfbd6ec1e2b8ade3b4805641 upstream. + +Interrupt vector 0xec has been doubly defined in irq_vectors.h + +It seems arbitrary whether LOCAL_PENDING_VECTOR or +UV_BAU_MESSAGE is the higher number. As long as they are +unique. If they are not unique we'll hit a BUG in +alloc_system_vector(). + +Signed-off-by: Cliff Wickman +LKML-Reference: +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/irq_vectors.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/include/asm/irq_vectors.h ++++ b/arch/x86/include/asm/irq_vectors.h +@@ -113,7 +113,7 @@ + */ + #define LOCAL_PENDING_VECTOR 0xec + +-#define UV_BAU_MESSAGE 0xec ++#define UV_BAU_MESSAGE 0xea + + /* + * Self IPI vector for machine checks + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:48 2009 +Message-Id: <20091217035648.120982645@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:37 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dave Jones , + Ingo Molnar +Subject: [040/151] x86: Add new Intel CPU cache size descriptors + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Dave Jones + +commit 85160b92fbd35321104819283c91bfed2b553e3c upstream. + +The latest rev of Intel doc AP-485 details new cache descriptors +that we don't yet support. 12MB, 18MB and 24MB 24-way assoc L3 +caches. + +Signed-off-by: Dave Jones +LKML-Reference: <20091110184924.GA20337@redhat.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/intel_cacheinfo.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/x86/kernel/cpu/intel_cacheinfo.c ++++ b/arch/x86/kernel/cpu/intel_cacheinfo.c +@@ -102,6 +102,9 @@ static const struct _cache_table __cpuin + { 0xe2, LVL_3, 2048 }, /* 16-way set assoc, 64 byte line size */ + { 0xe3, LVL_3, 4096 }, /* 16-way set assoc, 64 byte line size */ + { 0xe4, LVL_3, 8192 }, /* 16-way set assoc, 64 byte line size */ ++ { 0xea, LVL_3, 12288 }, /* 24-way set assoc, 64 byte line size */ ++ { 0xeb, LVL_3, 18432 }, /* 24-way set assoc, 64 byte line size */ ++ { 0xec, LVL_3, 24576 }, /* 24-way set assoc, 64 byte line size */ + { 0x00, 0, 0} + }; + + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:48 2009 +Message-Id: <20091217035648.247081156@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:38 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dave Jones , + Ingo Molnar +Subject: [041/151] x86: Fix typo in Intel CPU cache size descriptor + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Dave Jones + +commit e02e0e1a130b9ca37c5186d38ad4b3aaf58bb149 upstream. + +I double-checked the datasheet. One of the existing +descriptors has a typo: it should be 2MB not 2038 KB. + +Signed-off-by: Dave Jones +LKML-Reference: <20091110200120.GA27090@redhat.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/intel_cacheinfo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/cpu/intel_cacheinfo.c ++++ b/arch/x86/kernel/cpu/intel_cacheinfo.c +@@ -94,7 +94,7 @@ static const struct _cache_table __cpuin + { 0xd1, LVL_3, 1024 }, /* 4-way set assoc, 64 byte line size */ + { 0xd2, LVL_3, 2048 }, /* 4-way set assoc, 64 byte line size */ + { 0xd6, LVL_3, 1024 }, /* 8-way set assoc, 64 byte line size */ +- { 0xd7, LVL_3, 2038 }, /* 8-way set assoc, 64 byte line size */ ++ { 0xd7, LVL_3, 2048 }, /* 8-way set assoc, 64 byte line size */ + { 0xd8, LVL_3, 4096 }, /* 12-way set assoc, 64 byte line size */ + { 0xdc, LVL_3, 2048 }, /* 12-way set assoc, 64 byte line size */ + { 0xdd, LVL_3, 4096 }, /* 12-way set assoc, 64 byte line size */ + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:48 2009 +Message-Id: <20091217035648.371845216@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:39 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Sergei Shtylyov , + Jeff Garzik +Subject: [042/151] pata_hpt{37x|3x2n}: fix timing register masks (take 2) + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Sergei Shtylyov + +commit 5600c70e576199a7552e1c0fff43f3fe16f5566e upstream. + +These drivers inherited from the older 'hpt366' IDE driver the buggy timing +register masks in their set_piomode() metods. As a result, too low command +cycle active time is programmed for slow PIO modes. Quite fortunately, it's +later "fixed up" by the set_dmamode() methods which also "helpfully" reprogram +the command timings, usually to PIO mode 4; unfortunately, setting an UltraDMA +mode #N also reprograms already set PIO data timings, usually to MWDMA mode # +max(N, 2) timings... + +However, the drivers added some breakage of their own too: the bit that they +set/clear to control the FIFO is sometimes wrong -- it's actually the MSB of +the command cycle setup time; also, setting it in DMA mode is wrong as this +bit is only for PIO actually and clearing it for PIO modes is not needed as +no mode in any timing table has it set... + +Fix all this, inverting the masks while at it, like in the 'hpt366' and +'pata_hpt366' drivers; bump the drivers' versions, accounting for recent +patches that forgot to do it... + +Signed-off-by: Sergei Shtylyov +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/pata_hpt37x.c | 32 +++++++++++++++----------------- + drivers/ata/pata_hpt3x2n.c | 17 ++++++++--------- + 2 files changed, 23 insertions(+), 26 deletions(-) + +--- a/drivers/ata/pata_hpt37x.c ++++ b/drivers/ata/pata_hpt37x.c +@@ -24,7 +24,7 @@ + #include + + #define DRV_NAME "pata_hpt37x" +-#define DRV_VERSION "0.6.12" ++#define DRV_VERSION "0.6.14" + + struct hpt_clock { + u8 xfer_speed; +@@ -404,9 +404,8 @@ static void hpt370_set_piomode(struct at + + pci_read_config_dword(pdev, addr1, ®); + mode = hpt37x_find_mode(ap, adev->pio_mode); +- mode &= ~0x8000000; /* No FIFO in PIO */ +- mode &= ~0x30070000; /* Leave config bits alone */ +- reg &= 0x30070000; /* Strip timing bits */ ++ mode &= 0xCFC3FFFF; /* Leave DMA bits alone */ ++ reg &= ~0xCFC3FFFF; /* Strip timing bits */ + pci_write_config_dword(pdev, addr1, reg | mode); + } + +@@ -423,8 +422,7 @@ static void hpt370_set_dmamode(struct at + { + struct pci_dev *pdev = to_pci_dev(ap->host->dev); + u32 addr1, addr2; +- u32 reg; +- u32 mode; ++ u32 reg, mode, mask; + u8 fast; + + addr1 = 0x40 + 4 * (adev->devno + 2 * ap->port_no); +@@ -436,11 +434,12 @@ static void hpt370_set_dmamode(struct at + fast |= 0x01; + pci_write_config_byte(pdev, addr2, fast); + ++ mask = adev->dma_mode < XFER_UDMA_0 ? 0x31C001FF : 0x303C0000; ++ + pci_read_config_dword(pdev, addr1, ®); + mode = hpt37x_find_mode(ap, adev->dma_mode); +- mode |= 0x8000000; /* FIFO in MWDMA or UDMA */ +- mode &= ~0xC0000000; /* Leave config bits alone */ +- reg &= 0xC0000000; /* Strip timing bits */ ++ mode &= mask; ++ reg &= ~mask; + pci_write_config_dword(pdev, addr1, reg | mode); + } + +@@ -508,9 +507,8 @@ static void hpt372_set_piomode(struct at + mode = hpt37x_find_mode(ap, adev->pio_mode); + + printk("Find mode for %d reports %X\n", adev->pio_mode, mode); +- mode &= ~0x80000000; /* No FIFO in PIO */ +- mode &= ~0x30070000; /* Leave config bits alone */ +- reg &= 0x30070000; /* Strip timing bits */ ++ mode &= 0xCFC3FFFF; /* Leave DMA bits alone */ ++ reg &= ~0xCFC3FFFF; /* Strip timing bits */ + pci_write_config_dword(pdev, addr1, reg | mode); + } + +@@ -527,8 +525,7 @@ static void hpt372_set_dmamode(struct at + { + struct pci_dev *pdev = to_pci_dev(ap->host->dev); + u32 addr1, addr2; +- u32 reg; +- u32 mode; ++ u32 reg, mode, mask; + u8 fast; + + addr1 = 0x40 + 4 * (adev->devno + 2 * ap->port_no); +@@ -539,12 +536,13 @@ static void hpt372_set_dmamode(struct at + fast &= ~0x07; + pci_write_config_byte(pdev, addr2, fast); + ++ mask = adev->dma_mode < XFER_UDMA_0 ? 0x31C001FF : 0x303C0000; ++ + pci_read_config_dword(pdev, addr1, ®); + mode = hpt37x_find_mode(ap, adev->dma_mode); + printk("Find mode for DMA %d reports %X\n", adev->dma_mode, mode); +- mode &= ~0xC0000000; /* Leave config bits alone */ +- mode |= 0x80000000; /* FIFO in MWDMA or UDMA */ +- reg &= 0xC0000000; /* Strip timing bits */ ++ mode &= mask; ++ reg &= ~mask; + pci_write_config_dword(pdev, addr1, reg | mode); + } + +--- a/drivers/ata/pata_hpt3x2n.c ++++ b/drivers/ata/pata_hpt3x2n.c +@@ -25,7 +25,7 @@ + #include + + #define DRV_NAME "pata_hpt3x2n" +-#define DRV_VERSION "0.3.4" ++#define DRV_VERSION "0.3.7" + + enum { + HPT_PCI_FAST = (1 << 31), +@@ -185,9 +185,8 @@ static void hpt3x2n_set_piomode(struct a + + pci_read_config_dword(pdev, addr1, ®); + mode = hpt3x2n_find_mode(ap, adev->pio_mode); +- mode &= ~0x8000000; /* No FIFO in PIO */ +- mode &= ~0x30070000; /* Leave config bits alone */ +- reg &= 0x30070000; /* Strip timing bits */ ++ mode &= 0xCFC3FFFF; /* Leave DMA bits alone */ ++ reg &= ~0xCFC3FFFF; /* Strip timing bits */ + pci_write_config_dword(pdev, addr1, reg | mode); + } + +@@ -204,8 +203,7 @@ static void hpt3x2n_set_dmamode(struct a + { + struct pci_dev *pdev = to_pci_dev(ap->host->dev); + u32 addr1, addr2; +- u32 reg; +- u32 mode; ++ u32 reg, mode, mask; + u8 fast; + + addr1 = 0x40 + 4 * (adev->devno + 2 * ap->port_no); +@@ -216,11 +214,12 @@ static void hpt3x2n_set_dmamode(struct a + fast &= ~0x07; + pci_write_config_byte(pdev, addr2, fast); + ++ mask = adev->dma_mode < XFER_UDMA_0 ? 0x31C001FF : 0x303C0000; ++ + pci_read_config_dword(pdev, addr1, ®); + mode = hpt3x2n_find_mode(ap, adev->dma_mode); +- mode |= 0x8000000; /* FIFO in MWDMA or UDMA */ +- mode &= ~0xC0000000; /* Leave config bits alone */ +- reg &= 0xC0000000; /* Strip timing bits */ ++ mode &= mask; ++ reg &= ~mask; + pci_write_config_dword(pdev, addr1, reg | mode); + } + + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:48 2009 +Message-Id: <20091217035648.501745098@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:40 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Hendrik Brueckner , + Martin Schwidefsky +Subject: [043/151] [S390] s390: clear high-order bits of registers after sam64 + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Hendrik Brueckner + +commit cf87b7439ec81b9374e7772e44e9cb2eb9e57160 upstream. + +When the kernel is IPLed without the CLEAR option and switches +to 64-bit, the high-order half of the registers might contain +random values. This can cause addressing exceptions and the +kernel enters an interrupt loop. + +Initialize the high-order half of the general purpose registers +with zeros after switching to 64-bit mode. + +Signed-off-by: Hendrik Brueckner +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/kernel/head64.S | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/s390/kernel/head64.S ++++ b/arch/s390/kernel/head64.S +@@ -83,6 +83,8 @@ startup_continue: + slr %r0,%r0 # set cpuid to zero + sigp %r1,%r0,0x12 # switch to esame mode + sam64 # switch to 64 bit mode ++ llgfr %r13,%r13 # clear high-order half of base reg ++ lmh %r0,%r15,.Lzero64-.LPG1(%r13) # clear high-order half + lctlg %c0,%c15,.Lctl-.LPG1(%r13) # load control registers + lg %r12,.Lparmaddr-.LPG1(%r13) # pointer to parameter area + # move IPL device to lowcore +@@ -127,6 +129,7 @@ startup_continue: + .L4malign:.quad 0xffffffffffc00000 + .Lscan2g:.quad 0x80000000 + 0x20000 - 8 # 2GB + 128K - 8 + .Lnop: .long 0x07000700 ++.Lzero64:.fill 16,4,0x0 + #ifdef CONFIG_ZFCPDUMP + .Lcurrent_cpu: + .long 0x0 + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:48 2009 +Message-Id: <20091217035648.630575367@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:41 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Roel Kluin , + Michael Krufky , + Mauro Carvalho Chehab +Subject: [044/151] V4L/DVB: Fix test in copy_reg_bits() + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Roel Kluin + +commit c95a419a5604ec8a23cd73f61e9bb151e8cbe89b upstream. + +The reg_pair2[j].reg was tested twice. + +Signed-off-by: Roel Kluin +Acked-by: Michael Krufky +Signed-off-by: Andrew Morton +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/common/tuners/mxl5007t.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/common/tuners/mxl5007t.c ++++ b/drivers/media/common/tuners/mxl5007t.c +@@ -196,7 +196,7 @@ static void copy_reg_bits(struct reg_pai + i = j = 0; + + while (reg_pair1[i].reg || reg_pair1[i].val) { +- while (reg_pair2[j].reg || reg_pair2[j].reg) { ++ while (reg_pair2[j].reg || reg_pair2[j].val) { + if (reg_pair1[i].reg != reg_pair2[j].reg) { + j++; + continue; + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:48 2009 +Message-Id: <20091217035648.759753724@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:42 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alexey Dobriyan , + Serge Hallyn , + David Howells , + James Morris +Subject: [045/151] bsdacct: fix uid/gid misreporting + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alexey Dobriyan + +commit 4b731d50ff3df6b9141a6c12b088e8eb0109e83c upstream. + +commit d8e180dcd5bbbab9cd3ff2e779efcf70692ef541 "bsdacct: switch +credentials for writing to the accounting file" introduced credential +switching during final acct data collecting. However, uid/gid pair +continued to be collected from current which became credentials of who +created acct file, not who exits. + +Addresses http://bugzilla.kernel.org/show_bug.cgi?id=14676 + +Signed-off-by: Alexey Dobriyan +Reported-by: Juho K. Juopperi +Acked-by: Serge Hallyn +Acked-by: David Howells +Reviewed-by: Michal Schmidt +Cc: James Morris +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/acct.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/kernel/acct.c ++++ b/kernel/acct.c +@@ -536,7 +536,8 @@ static void do_acct_process(struct bsd_a + do_div(elapsed, AHZ); + ac.ac_btime = get_seconds() - elapsed; + /* we really need to bite the bullet and change layout */ +- current_uid_gid(&ac.ac_uid, &ac.ac_gid); ++ ac.ac_uid = orig_cred->uid; ++ ac.ac_gid = orig_cred->gid; + #if ACCT_VERSION==2 + ac.ac_ahz = AHZ; + #endif + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:49 2009 +Message-Id: <20091217035648.891078920@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:43 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Sebastian Andrzej Siewior , + Artem Bityutskiy +Subject: [046/151] UBI: flush wl before clearing update marker + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Sebastian Andrzej Siewior + +commit 6afaf8a484cbbfd2ccf58a4e5396d1f280469789 upstream. + +ubiupdatevol -t does the following: +- ubi_start_update() + - set_update_marker() + - for all LEBs ubi_eba_unmap_leb() + - clear_update_marker() + - ubi_wl_flush() + +ubi_wl_flush() physically erases all PEB, once it returns all PEBs are +empty. clear_update_marker() has the update marker written after return. +If there is a power cut between the last two functions then the UBI +volume has no longer the "update" marker set and may have some valid +LEBs while some of them may be gone. +If that volume in question happens to be a UBIFS volume, then mount +will fail with + +|UBIFS error (pid 1361): ubifs_read_node: bad node type (255 but expected 6) +|UBIFS error (pid 1361): ubifs_read_node: bad node at LEB 0:0 +|Not a node, first 24 bytes: +|00000000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff + +if there is at least one valid LEB and the wear-leveling worker managed +to clear LEB 0. + +The patch waits for the wl worker to finish prior clearing the "update" +marker on flash. The two new LEB which are scheduled for erasing after +clear_update_marker() should not matter because they are only visible to +UBI. + +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Artem Bityutskiy +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/ubi/upd.c | 20 +++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +--- a/drivers/mtd/ubi/upd.c ++++ b/drivers/mtd/ubi/upd.c +@@ -147,12 +147,14 @@ int ubi_start_update(struct ubi_device * + } + + if (bytes == 0) { ++ err = ubi_wl_flush(ubi); ++ if (err) ++ return err; ++ + err = clear_update_marker(ubi, vol, 0); + if (err) + return err; +- err = ubi_wl_flush(ubi); +- if (!err) +- vol->updating = 0; ++ vol->updating = 0; + } + + vol->upd_buf = vmalloc(ubi->leb_size); +@@ -362,16 +364,16 @@ int ubi_more_update_data(struct ubi_devi + + ubi_assert(vol->upd_received <= vol->upd_bytes); + if (vol->upd_received == vol->upd_bytes) { ++ err = ubi_wl_flush(ubi); ++ if (err) ++ return err; + /* The update is finished, clear the update marker */ + err = clear_update_marker(ubi, vol, vol->upd_bytes); + if (err) + return err; +- err = ubi_wl_flush(ubi); +- if (err == 0) { +- vol->updating = 0; +- err = to_write; +- vfree(vol->upd_buf); +- } ++ vol->updating = 0; ++ err = to_write; ++ vfree(vol->upd_buf); + } + + return err; + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:49 2009 +Message-Id: <20091217035649.016670805@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:44 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Theodore Tso" +Subject: [047/151] jbd2: dont wipe the journal on a failed journal checksum + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Theodore Ts'o + +commit e6a47428de84e19fda52f21ab73fde2906c40d09 upstream. + +If there is a failed journal checksum, don't reset the journal. This +allows for userspace programs to decide how to recover from this +situation. It may be that ignoring the journal checksum failure might +be a better way of recovering the file system. Once we add per-block +checksums, we can definitely do better. Until then, a system +administrator can try backing up the file system image (or taking a +snapshot) and and trying to determine experimentally whether ignoring +the checksum failure or aborting the journal replay results in less +data loss. + +Signed-off-by: "Theodore Ts'o" +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jbd2/journal.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -1253,6 +1253,13 @@ int jbd2_journal_load(journal_t *journal + if (jbd2_journal_recover(journal)) + goto recovery_error; + ++ if (journal->j_failed_commit) { ++ printk(KERN_ERR "JBD2: journal transaction %u on %s " ++ "is corrupt.\n", journal->j_failed_commit, ++ journal->j_devname); ++ return -EIO; ++ } ++ + /* OK, we've finished with the dynamic journal bits: + * reinitialise the dynamic contents of the superblock in memory + * and reset them on disk. */ + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:49 2009 +Message-Id: <20091217035649.141399735@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:45 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Sarah Sharp +Subject: [048/151] USB: xhci: Add correct email and files to MAINTAINERS entry. + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Sarah Sharp + +commit 36d0344c254a7b333272757f858c403ea3a2d29f upstream. + +Add the xHCI driver files to its MAINTAINERS entry so that I'm Cc'd on +cleanup patches. Update the email address to one I actually use for +sending patches and responding to Linux mailing list emails. + +Signed-off-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + MAINTAINERS | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/MAINTAINERS ++++ b/MAINTAINERS +@@ -5594,9 +5594,11 @@ S: Maintained + F: drivers/net/wireless/rndis_wlan.c + + USB XHCI DRIVER +-M: Sarah Sharp ++M: Sarah Sharp + L: linux-usb@vger.kernel.org + S: Supported ++F: drivers/usb/host/xhci* ++F: drivers/usb/host/pci-quirks* + + USB ZC0301 DRIVER + M: Luca Risolia + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:49 2009 +Message-Id: <20091217035649.269026296@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:46 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Sergei Shtylyov , + Anand Gadiyar +Subject: [049/151] USB: musb_gadget_ep0: fix unhandled endpoint 0 IRQs, again + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Sergei Shtylyov + +commit 196f1b7a387546f425df2f1fad26772e3d513aea upstream. + +Commit a5073b52833e4df8e16c93dc4cbb7e0c558c74a2 (musb_gadget: fix +unhandled endpoint 0 IRQs) somehow missed its key change: + +"The gadget EP0 code routinely ignores an interrupt at end of +the data phase because of musb_g_ep0_giveback() resetting the +state machine to "idle, waiting for SETUP" phase prematurely." + +So, the majority of the cases of unhandled IRQs is still unfixed... + +Signed-off-by: Sergei Shtylyov +Signed-off-by: Anand Gadiyar +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_gadget_ep0.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/usb/musb/musb_gadget_ep0.c ++++ b/drivers/usb/musb/musb_gadget_ep0.c +@@ -199,7 +199,6 @@ service_in_request(struct musb *musb, co + static void musb_g_ep0_giveback(struct musb *musb, struct usb_request *req) + { + musb_g_giveback(&musb->endpoints[0].ep_in, req, 0); +- musb->ep0_state = MUSB_EP0_STAGE_SETUP; + } + + /* + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:49 2009 +Message-Id: <20091217035649.394659875@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:47 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Zhang Le +Subject: [050/151] USB: option.c: add support for D-Link DWM-162-U5 + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Zhang Le + +commit 54a8e144acad6506920f385f4ef2779664f05b21 upstream. + +Add D-Link DWM-162-U5 device id 1e0e:ce16 into option driver. The device +has 4 interfaces, of which 1 is handled by storage and the other 3 by +option driver. + +The device appears first as CD-only 05c6:2100 device and must be switched +to 1e0e:ce16 mode either by using "eject CD" or usb_modeswitch. + +The MessageContent for usb_modeswitch.conf is: +"55534243e0c26a85000000000000061b000000020000000000000000000000" + +Signed-off-by: Zhang Le +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -635,6 +635,7 @@ static struct usb_device_id option_ids[] + { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_G450) }, + { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_HSDPA_MINICARD ) }, /* Toshiba 3G HSDPA == Novatel Expedite EU870D MiniCard */ + { USB_DEVICE(ALINK_VENDOR_ID, 0x9000) }, ++ { USB_DEVICE(ALINK_VENDOR_ID, 0xce16) }, + { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) }, + { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S) }, + { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) }, + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:49 2009 +Message-Id: <20091217035649.521288758@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:48 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andre Herms +Subject: [051/151] USB: usbtmc: repeat usb_bulk_msg until whole message is transfered + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Andre Herms + +commit ec412b92dbe3ea839716853eea058d1bcc5e6ca4 upstream. + +usb_bulk_msg() transfers only bytes up to the maximum packet size. +It must be repeated by the usbtmc driver until all bytes of a TMC message +are transfered. + +Without this patch, ETIMEDOUT is reported when writing TMC messages +larger than the maximum USB bulk size and the transfer remains incomplete. +The user will notice that the device hangs and must be reset by either closing +the application or pulling the plug. + +Signed-off-by: Andre Herms +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/usbtmc.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/drivers/usb/class/usbtmc.c ++++ b/drivers/usb/class/usbtmc.c +@@ -562,10 +562,16 @@ static ssize_t usbtmc_write(struct file + n_bytes = roundup(12 + this_part, 4); + memset(buffer + 12 + this_part, 0, n_bytes - (12 + this_part)); + +- retval = usb_bulk_msg(data->usb_dev, +- usb_sndbulkpipe(data->usb_dev, +- data->bulk_out), +- buffer, n_bytes, &actual, USBTMC_TIMEOUT); ++ do { ++ retval = usb_bulk_msg(data->usb_dev, ++ usb_sndbulkpipe(data->usb_dev, ++ data->bulk_out), ++ buffer, n_bytes, ++ &actual, USBTMC_TIMEOUT); ++ if (retval != 0) ++ break; ++ n_bytes -= actual; ++ } while (n_bytes); + + data->bTag_last_write = data->bTag; + data->bTag++; + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:49 2009 +Message-Id: <20091217035649.649378015@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:49 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Stern +Subject: [052/151] USB: usb-storage: add BAD_SENSE flag + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alan Stern + +commit a0bb108112a872c0b0c4b3ef4974f95fb75b155d upstream. + +This patch (as1311) fixes a problem in usb-storage: Some devices are +pretty broken when it comes to reporting sense data. The information +they send back indicates that they have more than 18 bytes of sense +data available, but when the system asks for more than 18 they fail or +hang. The symptom is that probing fails with multiple resets. + +The patch adds a new BAD_SENSE flag to indicate that usb-storage +should never ask for more than 18 bytes of sense data. The flag can +be set in an unusual_devs entry or via the "quirks=" module parameter, +and it is set automatically whenever a REQUEST SENSE command for more +than 18 bytes fails or times out. + +An unusual_devs entry is added for the Agfa photo frame, which uses a +Prolific chip having this bug. + +Signed-off-by: Alan Stern +Tested-by: Daniel Kukula +Signed-off-by: Greg Kroah-Hartman + +--- a/Documentation/kernel-parameters.txt ++++ b/Documentation/kernel-parameters.txt +@@ -2663,6 +2663,8 @@ and is between 256 and 4096 characters. It is defined in the file + to a common usb-storage quirk flag as follows: + a = SANE_SENSE (collect more than 18 bytes + of sense data); ++ b = BAD_SENSE (don't collect more than 18 ++ bytes of sense data); + c = FIX_CAPACITY (decrease the reported + device capacity by one sector); + h = CAPACITY_HEURISTICS (decrease the +diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c +index 589f6b4..cc313d1 100644 +--- a/drivers/usb/storage/transport.c ++++ b/drivers/usb/storage/transport.c +@@ -666,10 +666,11 @@ void usb_stor_invoke_transport(struct scsi_cmnd *srb, struct us_data *us) + * to wait for at least one CHECK_CONDITION to determine + * SANE_SENSE support + */ +- if ((srb->cmnd[0] == ATA_16 || srb->cmnd[0] == ATA_12) && ++ if (unlikely((srb->cmnd[0] == ATA_16 || srb->cmnd[0] == ATA_12) && + result == USB_STOR_TRANSPORT_GOOD && + !(us->fflags & US_FL_SANE_SENSE) && +- !(srb->cmnd[2] & 0x20)) { ++ !(us->fflags & US_FL_BAD_SENSE) && ++ !(srb->cmnd[2] & 0x20))) { + US_DEBUGP("-- SAT supported, increasing auto-sense\n"); + us->fflags |= US_FL_SANE_SENSE; + } +@@ -718,6 +719,12 @@ Retry_Sense: + if (test_bit(US_FLIDX_TIMED_OUT, &us->dflags)) { + US_DEBUGP("-- auto-sense aborted\n"); + srb->result = DID_ABORT << 16; ++ ++ /* If SANE_SENSE caused this problem, disable it */ ++ if (sense_size != US_SENSE_SIZE) { ++ us->fflags &= ~US_FL_SANE_SENSE; ++ us->fflags |= US_FL_BAD_SENSE; ++ } + goto Handle_Errors; + } + +@@ -727,10 +734,11 @@ Retry_Sense: + * (small) sense request. This fixes some USB GSM modems + */ + if (temp_result == USB_STOR_TRANSPORT_FAILED && +- (us->fflags & US_FL_SANE_SENSE) && +- sense_size != US_SENSE_SIZE) { ++ sense_size != US_SENSE_SIZE) { + US_DEBUGP("-- auto-sense failure, retry small sense\n"); + sense_size = US_SENSE_SIZE; ++ us->fflags &= ~US_FL_SANE_SENSE; ++ us->fflags |= US_FL_BAD_SENSE; + goto Retry_Sense; + } + +@@ -754,6 +762,7 @@ Retry_Sense: + */ + if (srb->sense_buffer[7] > (US_SENSE_SIZE - 8) && + !(us->fflags & US_FL_SANE_SENSE) && ++ !(us->fflags & US_FL_BAD_SENSE) && + (srb->sense_buffer[0] & 0x7C) == 0x70) { + US_DEBUGP("-- SANE_SENSE support enabled\n"); + us->fflags |= US_FL_SANE_SENSE; +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index d4f034e..64a0a2c 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -818,6 +818,13 @@ UNUSUAL_DEV( 0x066f, 0x8000, 0x0001, 0x0001, + US_SC_DEVICE, US_PR_DEVICE, NULL, + US_FL_FIX_CAPACITY ), + ++/* Reported by Daniel Kukula */ ++UNUSUAL_DEV( 0x067b, 0x1063, 0x0100, 0x0100, ++ "Prolific Technology, Inc.", ++ "Prolific Storage Gadget", ++ US_SC_DEVICE, US_PR_DEVICE, NULL, ++ US_FL_BAD_SENSE ), ++ + /* Reported by Rogerio Brito */ + UNUSUAL_DEV( 0x067b, 0x2317, 0x0001, 0x001, + "Prolific Technology, Inc.", +diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c +index 1599d86..f5c0264 100644 +--- a/drivers/usb/storage/usb.c ++++ b/drivers/usb/storage/usb.c +@@ -463,6 +463,9 @@ static void adjust_quirks(struct us_data *us) + case 'a': + f |= US_FL_SANE_SENSE; + break; ++ case 'b': ++ f |= US_FL_BAD_SENSE; ++ break; + case 'c': + f |= US_FL_FIX_CAPACITY; + break; +diff --git a/include/linux/usb_usual.h b/include/linux/usb_usual.h +index 3d15fb9..a4b947e 100644 +--- a/include/linux/usb_usual.h ++++ b/include/linux/usb_usual.h +@@ -56,7 +56,9 @@ + US_FLAG(SANE_SENSE, 0x00008000) \ + /* Sane Sense (> 18 bytes) */ \ + US_FLAG(CAPACITY_OK, 0x00010000) \ +- /* READ CAPACITY response is correct */ ++ /* READ CAPACITY response is correct */ \ ++ US_FLAG(BAD_SENSE, 0x00020000) \ ++ /* Bad Sense (never more than 18 bytes) */ + + #define US_FLAG(name, value) US_FL_##name = value , + enum { US_DO_ALL_FLAGS }; + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:49 2009 +Message-Id: <20091217035649.777133501@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:50 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Russ Dill +Subject: [053/151] USB: Close usb_find_interface race v3 + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Russ Dill + +commit c2d284ee04ab6f6718de2ddcf1b43160e046c41d upstream. + +USB drivers that create character devices call usb_register_dev in their +probe function. This associates the usb_interface device with that minor +number and creates the character device and announces it to the world. +However, the driver's probe function is called before the new +usb_interface is added to the driver's klist_devices. + +This is a problem because userspace will respond to the character device +creation announcement by opening the character device. The driver's open +function will the call usb_find_interface to find the usb_interface +associated with that minor number. usb_find_interface will walk the +driver's list of devices and find the usb_interface with the matching +minor number. + +Because the announcement happens before the usb_interface is added to the +driver's klist_devices, a race condition exists. A straightforward fix +is to walk the list of devices on usb_bus_type instead since the device +is added to that list before the announcement occurs. + +bus_find_device calls get_device to bump the reference count on the found +device. It is arguable that the reference count should be dropped by the +caller of usb_find_interface instead of usb_find_interface, however, +the current users of usb_find_interface do not expect this. + +The original version of this patch only matched against minor number +instead of driver and minor number. This version matches against both. + +Signed-off-by: Russ Dill +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/usb.c | 31 ++++++++++++++++--------------- + 1 file changed, 16 insertions(+), 15 deletions(-) + +--- a/drivers/usb/core/usb.c ++++ b/drivers/usb/core/usb.c +@@ -132,7 +132,7 @@ EXPORT_SYMBOL_GPL(usb_altnum_to_altsetti + + struct find_interface_arg { + int minor; +- struct usb_interface *interface; ++ struct device_driver *drv; + }; + + static int __find_interface(struct device *dev, void *data) +@@ -143,12 +143,10 @@ static int __find_interface(struct devic + if (!is_usb_interface(dev)) + return 0; + ++ if (dev->driver != arg->drv) ++ return 0; + intf = to_usb_interface(dev); +- if (intf->minor != -1 && intf->minor == arg->minor) { +- arg->interface = intf; +- return 1; +- } +- return 0; ++ return intf->minor == arg->minor; + } + + /** +@@ -156,21 +154,24 @@ static int __find_interface(struct devic + * @drv: the driver whose current configuration is considered + * @minor: the minor number of the desired device + * +- * This walks the driver device list and returns a pointer to the interface +- * with the matching minor. Note, this only works for devices that share the +- * USB major number. ++ * This walks the bus device list and returns a pointer to the interface ++ * with the matching minor and driver. Note, this only works for devices ++ * that share the USB major number. + */ + struct usb_interface *usb_find_interface(struct usb_driver *drv, int minor) + { + struct find_interface_arg argb; +- int retval; ++ struct device *dev; + + argb.minor = minor; +- argb.interface = NULL; +- /* eat the error, it will be in argb.interface */ +- retval = driver_for_each_device(&drv->drvwrap.driver, NULL, &argb, +- __find_interface); +- return argb.interface; ++ argb.drv = &drv->drvwrap.driver; ++ ++ dev = bus_find_device(&usb_bus_type, NULL, &argb, __find_interface); ++ ++ /* Drop reference count from bus_find_device */ ++ put_device(dev); ++ ++ return dev ? to_usb_interface(dev) : NULL; + } + EXPORT_SYMBOL_GPL(usb_find_interface); + + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:50 2009 +Message-Id: <20091217035649.905521468@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:51 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Igor Grinberg , + Mike Rapoport , + Eric Miao +Subject: [054/151] [ARM] pxa/em-x270: fix usb hub power up/reset sequence + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Igor Grinberg + +commit 1b82e4c32fba96d8805b1e2126ba5382e56fac32 upstream. + +Signed-off-by: Igor Grinberg +Signed-off-by: Mike Rapoport +Signed-off-by: Eric Miao +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-pxa/em-x270.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/arch/arm/mach-pxa/em-x270.c ++++ b/arch/arm/mach-pxa/em-x270.c +@@ -497,16 +497,15 @@ static int em_x270_usb_hub_init(void) + goto err_free_vbus_gpio; + + /* USB Hub power-on and reset */ +- gpio_direction_output(usb_hub_reset, 0); ++ gpio_direction_output(usb_hub_reset, 1); ++ gpio_direction_output(GPIO9_USB_VBUS_EN, 0); + regulator_enable(em_x270_usb_ldo); +- gpio_set_value(usb_hub_reset, 1); + gpio_set_value(usb_hub_reset, 0); ++ gpio_set_value(usb_hub_reset, 1); + regulator_disable(em_x270_usb_ldo); + regulator_enable(em_x270_usb_ldo); +- gpio_set_value(usb_hub_reset, 1); +- +- /* enable VBUS */ +- gpio_direction_output(GPIO9_USB_VBUS_EN, 1); ++ gpio_set_value(usb_hub_reset, 0); ++ gpio_set_value(GPIO9_USB_VBUS_EN, 1); + + return 0; + + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:50 2009 +Message-Id: <20091217035650.041095298@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:52 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + WANG Cong , + Eugene Teo , + Roman Zippel , + Al Viro , + Christoph Hellwig , + Alexey Dobriyan , + Dave Anderson +Subject: [055/151] hfs: fix a potential buffer overflow + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Amerigo Wang + +commit ec81aecb29668ad71f699f4e7b96ec46691895b6 upstream. + +A specially-crafted Hierarchical File System (HFS) filesystem could cause +a buffer overflow to occur in a process's kernel stack during a memcpy() +call within the hfs_bnode_read() function (at fs/hfs/bnode.c:24). The +attacker can provide the source buffer and length, and the destination +buffer is a local variable of a fixed length. This local variable (passed +as "&entry" from fs/hfs/dir.c:112 and allocated on line 60) is stored in +the stack frame of hfs_bnode_read()'s caller, which is hfs_readdir(). +Because the hfs_readdir() function executes upon any attempt to read a +directory on the filesystem, it gets called whenever a user attempts to +inspect any filesystem contents. + +[amwang@redhat.com: modify this patch and fix coding style problems] +Signed-off-by: WANG Cong +Cc: Eugene Teo +Cc: Roman Zippel +Cc: Al Viro +Cc: Christoph Hellwig +Cc: Alexey Dobriyan +Cc: Dave Anderson +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/hfs/catalog.c | 4 ++++ + fs/hfs/dir.c | 11 +++++++++++ + fs/hfs/super.c | 7 ++++++- + 3 files changed, 21 insertions(+), 1 deletion(-) + +--- a/fs/hfs/catalog.c ++++ b/fs/hfs/catalog.c +@@ -289,6 +289,10 @@ int hfs_cat_move(u32 cnid, struct inode + err = hfs_brec_find(&src_fd); + if (err) + goto out; ++ if (src_fd.entrylength > sizeof(entry) || src_fd.entrylength < 0) { ++ err = -EIO; ++ goto out; ++ } + + hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset, + src_fd.entrylength); +--- a/fs/hfs/dir.c ++++ b/fs/hfs/dir.c +@@ -79,6 +79,11 @@ static int hfs_readdir(struct file *filp + filp->f_pos++; + /* fall through */ + case 1: ++ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) { ++ err = -EIO; ++ goto out; ++ } ++ + hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength); + if (entry.type != HFS_CDR_THD) { + printk(KERN_ERR "hfs: bad catalog folder thread\n"); +@@ -109,6 +114,12 @@ static int hfs_readdir(struct file *filp + err = -EIO; + goto out; + } ++ ++ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) { ++ err = -EIO; ++ goto out; ++ } ++ + hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength); + type = entry.type; + len = hfs_mac2asc(sb, strbuf, &fd.key->cat.CName); +--- a/fs/hfs/super.c ++++ b/fs/hfs/super.c +@@ -409,8 +409,13 @@ static int hfs_fill_super(struct super_b + /* try to get the root inode */ + hfs_find_init(HFS_SB(sb)->cat_tree, &fd); + res = hfs_cat_find_brec(sb, HFS_ROOT_CNID, &fd); +- if (!res) ++ if (!res) { ++ if (fd.entrylength > sizeof(rec) || fd.entrylength < 0) { ++ res = -EIO; ++ goto bail; ++ } + hfs_bnode_read(fd.bnode, &rec, fd.entryoffset, fd.entrylength); ++ } + if (res) { + hfs_find_exit(&fd); + goto bail_no_root; + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:50 2009 +Message-Id: <20091217035650.161652420@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:53 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Roel Kluin , + Trond Myklebust +Subject: [056/151] SUNRPC: IS_ERR/PTR_ERR confusion + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Roel Kluin + +commit 480e3243df156e39eea6c91057e2ae612a6bbe19 upstream. + +IS_ERR returns 1 or 0, PTR_ERR returns the error value. + +Signed-off-by: Roel Kluin +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/auth_gss/auth_gss.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/sunrpc/auth_gss/auth_gss.c ++++ b/net/sunrpc/auth_gss/auth_gss.c +@@ -485,7 +485,7 @@ gss_refresh_upcall(struct rpc_task *task + dprintk("RPC: %5u gss_refresh_upcall for uid %u\n", task->tk_pid, + cred->cr_uid); + gss_msg = gss_setup_upcall(task->tk_client, gss_auth, cred); +- if (IS_ERR(gss_msg) == -EAGAIN) { ++ if (PTR_ERR(gss_msg) == -EAGAIN) { + /* XXX: warning on the first, under the assumption we + * shouldn't normally hit this case on a refresh. */ + warn_gssd(); + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:50 2009 +Message-Id: <20091217035650.285311596@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:54 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Trond Myklebust +Subject: [057/151] NFS: Fix nfs_migrate_page() + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Trond Myklebust + +commit 190f38e5cedc910940b1da9015f00458c18f97b4 upstream. + +The call to migrate_page() will cause the page->private field to be +cleared. +Also fix up the locking around the page->private transfer, so that we ensure +that calls to nfs_page_find_request() don't end up racing. + +Finally, fix up a double free bug: nfs_unlock_request() already calls +nfs_release_request() for us... + +Reported-by: Wu Fengguang +Tested-by: Andi Kleen +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/write.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -1612,15 +1612,16 @@ int nfs_migrate_page(struct address_spac + if (ret) + goto out_unlock; + page_cache_get(newpage); ++ spin_lock(&mapping->host->i_lock); + req->wb_page = newpage; + SetPagePrivate(newpage); +- set_page_private(newpage, page_private(page)); ++ set_page_private(newpage, (unsigned long)req); + ClearPagePrivate(page); + set_page_private(page, 0); ++ spin_unlock(&mapping->host->i_lock); + page_cache_release(page); + out_unlock: + nfs_clear_page_tag_locked(req); +- nfs_release_request(req); + out: + return ret; + } + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:50 2009 +Message-Id: <20091217035650.415039321@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:55 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + NeilBrown +Subject: [058/151] md/bitmap: protect against bitmap removal while being updated. + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: NeilBrown + +commit aa5cbd103887011b4830355f88fb055f9ad2d556 upstream. + +A write intent bitmap can be removed from an array while the +array is active. +When this happens, all IO is suspended and flushed before the +bitmap is removed. +However it is possible that bitmap_daemon_work is still running to +clear old bits from the bitmap. If it is, it can dereference the +bitmap after it has been freed. + +So introduce a new mutex to protect bitmap_daemon_work and get it +before destroying a bitmap. + +This is suitable for any current -stable kernel. + +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/bitmap.c | 24 ++++++++++++++++++------ + drivers/md/bitmap.h | 2 +- + drivers/md/md.c | 3 ++- + drivers/md/md.h | 1 + + 4 files changed, 22 insertions(+), 8 deletions(-) + +--- a/drivers/md/bitmap.c ++++ b/drivers/md/bitmap.c +@@ -1078,23 +1078,31 @@ static bitmap_counter_t *bitmap_get_coun + * out to disk + */ + +-void bitmap_daemon_work(struct bitmap *bitmap) ++void bitmap_daemon_work(mddev_t *mddev) + { ++ struct bitmap *bitmap; + unsigned long j; + unsigned long flags; + struct page *page = NULL, *lastpage = NULL; + int blocks; + void *paddr; + +- if (bitmap == NULL) ++ /* Use a mutex to guard daemon_work against ++ * bitmap_destroy. ++ */ ++ mutex_lock(&mddev->bitmap_mutex); ++ bitmap = mddev->bitmap; ++ if (bitmap == NULL) { ++ mutex_unlock(&mddev->bitmap_mutex); + return; ++ } + if (time_before(jiffies, bitmap->daemon_lastrun + bitmap->daemon_sleep*HZ)) + goto done; + + bitmap->daemon_lastrun = jiffies; + if (bitmap->allclean) { + bitmap->mddev->thread->timeout = MAX_SCHEDULE_TIMEOUT; +- return; ++ goto done; + } + bitmap->allclean = 1; + +@@ -1203,6 +1211,7 @@ void bitmap_daemon_work(struct bitmap *b + done: + if (bitmap->allclean == 0) + bitmap->mddev->thread->timeout = bitmap->daemon_sleep * HZ; ++ mutex_unlock(&mddev->bitmap_mutex); + } + + static bitmap_counter_t *bitmap_get_counter(struct bitmap *bitmap, +@@ -1541,9 +1550,9 @@ void bitmap_flush(mddev_t *mddev) + */ + sleep = bitmap->daemon_sleep; + bitmap->daemon_sleep = 0; +- bitmap_daemon_work(bitmap); +- bitmap_daemon_work(bitmap); +- bitmap_daemon_work(bitmap); ++ bitmap_daemon_work(mddev); ++ bitmap_daemon_work(mddev); ++ bitmap_daemon_work(mddev); + bitmap->daemon_sleep = sleep; + bitmap_update_sb(bitmap); + } +@@ -1574,6 +1583,7 @@ static void bitmap_free(struct bitmap *b + kfree(bp); + kfree(bitmap); + } ++ + void bitmap_destroy(mddev_t *mddev) + { + struct bitmap *bitmap = mddev->bitmap; +@@ -1581,7 +1591,9 @@ void bitmap_destroy(mddev_t *mddev) + if (!bitmap) /* there was no bitmap */ + return; + ++ mutex_lock(&mddev->bitmap_mutex); + mddev->bitmap = NULL; /* disconnect from the md device */ ++ mutex_unlock(&mddev->bitmap_mutex); + if (mddev->thread) + mddev->thread->timeout = MAX_SCHEDULE_TIMEOUT; + +--- a/drivers/md/bitmap.h ++++ b/drivers/md/bitmap.h +@@ -282,7 +282,7 @@ void bitmap_close_sync(struct bitmap *bi + void bitmap_cond_end_sync(struct bitmap *bitmap, sector_t sector); + + void bitmap_unplug(struct bitmap *bitmap); +-void bitmap_daemon_work(struct bitmap *bitmap); ++void bitmap_daemon_work(mddev_t *mddev); + #endif + + #endif +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -367,6 +367,7 @@ static mddev_t * mddev_find(dev_t unit) + + mutex_init(&new->open_mutex); + mutex_init(&new->reconfig_mutex); ++ mutex_init(&new->bitmap_mutex); + INIT_LIST_HEAD(&new->disks); + INIT_LIST_HEAD(&new->all_mddevs); + init_timer(&new->safemode_timer); +@@ -6629,7 +6630,7 @@ void md_check_recovery(mddev_t *mddev) + + + if (mddev->bitmap) +- bitmap_daemon_work(mddev->bitmap); ++ bitmap_daemon_work(mddev); + + if (mddev->ro) + return; +--- a/drivers/md/md.h ++++ b/drivers/md/md.h +@@ -289,6 +289,7 @@ struct mddev_s + * hot-adding a bitmap. It should + * eventually be settable by sysfs. + */ ++ struct mutex bitmap_mutex; + + struct list_head all_mddevs; + }; + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:50 2009 +Message-Id: <20091217035650.540334382@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:56 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andi Kleen , + Andrew Morton , + Nick Piggin , + Darren Hart , + Peter Zijlstra , + Thomas Gleixner +Subject: [059/151] futex: Take mmap_sem for get_user_pages in fault_in_user_writeable + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Andi Kleen + +commit 722d0172377a5697919b9f7e5beb95165b1dec4e upstream. + +get_user_pages() must be called with mmap_sem held. + +Signed-off-by: Andi Kleen +Cc: Andrew Morton +Cc: Nick Piggin +Cc: Darren Hart +Cc: Peter Zijlstra +LKML-Reference: <20091208121942.GA21298@basil.fritz.box> +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/futex.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -304,8 +304,14 @@ void put_futex_key(int fshared, union fu + */ + static int fault_in_user_writeable(u32 __user *uaddr) + { +- int ret = get_user_pages(current, current->mm, (unsigned long)uaddr, +- 1, 1, 0, NULL, NULL); ++ struct mm_struct *mm = current->mm; ++ int ret; ++ ++ down_read(&mm->mmap_sem); ++ ret = get_user_pages(current, mm, (unsigned long)uaddr, ++ 1, 1, 0, NULL, NULL); ++ up_read(&mm->mmap_sem); ++ + return ret < 0 ? ret : 0; + } + + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:50 2009 +Message-Id: <20091217035650.668559199@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:57 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Sukadev Bhattiprolu +Subject: [060/151] devpts_get_tty() should validate inode + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Sukadev Bhattiprolu + +commit edfacdd6f81119b9005615593f2cbd94b8c7e2d8 upstream. + +devpts_get_tty() assumes that the inode passed in is associated with a valid +pty. But if the only reference to the pty is via a bind-mount, the inode +passed to devpts_get_tty() while valid, would refer to a pty that no longer +exists. + +With a lot of debug effort, Grzegorz Nosek developed a small program (see +below) to reproduce a crash on recent kernels. This crash is a regression +introduced by the commit: + + commit 527b3e4773628b30d03323a2cb5fb0d84441990f + Author: Sukadev Bhattiprolu + Date: Mon Oct 13 10:43:08 2008 +0100 + +To fix, ensure that the dentry associated with the inode has not yet been +deleted/unhashed by devpts_pty_kill(). + +See also: +https://lists.linux-foundation.org/pipermail/containers/2009-July/019273.html + +tty-bug.c: + +#define _GNU_SOURCE +#include +#include +#include +#include +#include +#include +#include + +#include + +void dummy(int sig) +{ +} + +static int child(void *unused) +{ + int fd; + + signal(SIGINT, dummy); signal(SIGHUP, dummy); + pause(); /* cheesy synchronisation to wait for /dev/pts/0 to appear */ + + mount("/dev/pts/0", "/dev/console", NULL, MS_BIND, NULL); + sleep(2); + + fd = open("/dev/console", O_RDWR); + dup(0); dup(0); + write(1, "Hello world!\n", sizeof("Hello world!\n")-1); + return 0; +} + +int main(void) +{ + pid_t pid; + char *stack; + + stack = malloc(16384); + pid = clone(child, stack+16384, CLONE_NEWNS|SIGCHLD, NULL); + + open("/dev/ptmx", O_RDWR|O_NOCTTY|O_NONBLOCK); + + unlockpt(fd); grantpt(fd); + + sleep(2); + kill(pid, SIGHUP); + sleep(1); + return 0; /* exit before child opens /dev/console */ +} + +Reported-by: Grzegorz Nosek +Signed-off-by: Sukadev Bhattiprolu +Tested-by: Serge Hallyn +Signed-off-by: Greg Kroah-Hartman + +--- + fs/devpts/inode.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +--- a/fs/devpts/inode.c ++++ b/fs/devpts/inode.c +@@ -517,11 +517,23 @@ int devpts_pty_new(struct inode *ptmx_in + + struct tty_struct *devpts_get_tty(struct inode *pts_inode, int number) + { ++ struct dentry *dentry; ++ struct tty_struct *tty; ++ + BUG_ON(pts_inode->i_rdev == MKDEV(TTYAUX_MAJOR, PTMX_MINOR)); + ++ /* Ensure dentry has not been deleted by devpts_pty_kill() */ ++ dentry = d_find_alias(pts_inode); ++ if (!dentry) ++ return NULL; ++ ++ tty = NULL; + if (pts_inode->i_sb->s_magic == DEVPTS_SUPER_MAGIC) +- return (struct tty_struct *)pts_inode->i_private; +- return NULL; ++ tty = (struct tty_struct *)pts_inode->i_private; ++ ++ dput(dentry); ++ ++ return tty; + } + + void devpts_pty_kill(struct tty_struct *tty) + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:50 2009 +Message-Id: <20091217035650.799599096@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:58 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mathieu Desnoyers +Subject: [061/151] debugfs: fix create mutex racy fops and private data + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mathieu Desnoyers + +commit d3a3b0adad0865c12e39b712ca89efbd0a3a0dbc upstream. + +Setting fops and private data outside of the mutex at debugfs file +creation introduces a race where the files can be opened with the wrong +file operations and private data. It is easy to trigger with a process +waiting on file creation notification. + +Signed-off-by: Mathieu Desnoyers +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + fs/debugfs/inode.c | 55 ++++++++++++++++++++++++++++++----------------------- + 1 file changed, 32 insertions(+), 23 deletions(-) + +--- a/fs/debugfs/inode.c ++++ b/fs/debugfs/inode.c +@@ -32,7 +32,9 @@ static struct vfsmount *debugfs_mount; + static int debugfs_mount_count; + static bool debugfs_registered; + +-static struct inode *debugfs_get_inode(struct super_block *sb, int mode, dev_t dev) ++static struct inode *debugfs_get_inode(struct super_block *sb, int mode, dev_t dev, ++ void *data, const struct file_operations *fops) ++ + { + struct inode *inode = new_inode(sb); + +@@ -44,14 +46,18 @@ static struct inode *debugfs_get_inode(s + init_special_inode(inode, mode, dev); + break; + case S_IFREG: +- inode->i_fop = &debugfs_file_operations; ++ inode->i_fop = fops ? fops : &debugfs_file_operations; ++ inode->i_private = data; + break; + case S_IFLNK: + inode->i_op = &debugfs_link_operations; ++ inode->i_fop = fops; ++ inode->i_private = data; + break; + case S_IFDIR: + inode->i_op = &simple_dir_inode_operations; +- inode->i_fop = &simple_dir_operations; ++ inode->i_fop = fops ? fops : &simple_dir_operations; ++ inode->i_private = data; + + /* directory inodes start off with i_nlink == 2 + * (for "." entry) */ +@@ -64,7 +70,8 @@ static struct inode *debugfs_get_inode(s + + /* SMP-safe */ + static int debugfs_mknod(struct inode *dir, struct dentry *dentry, +- int mode, dev_t dev) ++ int mode, dev_t dev, void *data, ++ const struct file_operations *fops) + { + struct inode *inode; + int error = -EPERM; +@@ -72,7 +79,7 @@ static int debugfs_mknod(struct inode *d + if (dentry->d_inode) + return -EEXIST; + +- inode = debugfs_get_inode(dir->i_sb, mode, dev); ++ inode = debugfs_get_inode(dir->i_sb, mode, dev, data, fops); + if (inode) { + d_instantiate(dentry, inode); + dget(dentry); +@@ -81,12 +88,13 @@ static int debugfs_mknod(struct inode *d + return error; + } + +-static int debugfs_mkdir(struct inode *dir, struct dentry *dentry, int mode) ++static int debugfs_mkdir(struct inode *dir, struct dentry *dentry, int mode, ++ void *data, const struct file_operations *fops) + { + int res; + + mode = (mode & (S_IRWXUGO | S_ISVTX)) | S_IFDIR; +- res = debugfs_mknod(dir, dentry, mode, 0); ++ res = debugfs_mknod(dir, dentry, mode, 0, data, fops); + if (!res) { + inc_nlink(dir); + fsnotify_mkdir(dir, dentry); +@@ -94,18 +102,20 @@ static int debugfs_mkdir(struct inode *d + return res; + } + +-static int debugfs_link(struct inode *dir, struct dentry *dentry, int mode) ++static int debugfs_link(struct inode *dir, struct dentry *dentry, int mode, ++ void *data, const struct file_operations *fops) + { + mode = (mode & S_IALLUGO) | S_IFLNK; +- return debugfs_mknod(dir, dentry, mode, 0); ++ return debugfs_mknod(dir, dentry, mode, 0, data, fops); + } + +-static int debugfs_create(struct inode *dir, struct dentry *dentry, int mode) ++static int debugfs_create(struct inode *dir, struct dentry *dentry, int mode, ++ void *data, const struct file_operations *fops) + { + int res; + + mode = (mode & S_IALLUGO) | S_IFREG; +- res = debugfs_mknod(dir, dentry, mode, 0); ++ res = debugfs_mknod(dir, dentry, mode, 0, data, fops); + if (!res) + fsnotify_create(dir, dentry); + return res; +@@ -139,7 +149,9 @@ static struct file_system_type debug_fs_ + + static int debugfs_create_by_name(const char *name, mode_t mode, + struct dentry *parent, +- struct dentry **dentry) ++ struct dentry **dentry, ++ void *data, ++ const struct file_operations *fops) + { + int error = 0; + +@@ -164,13 +176,16 @@ static int debugfs_create_by_name(const + if (!IS_ERR(*dentry)) { + switch (mode & S_IFMT) { + case S_IFDIR: +- error = debugfs_mkdir(parent->d_inode, *dentry, mode); ++ error = debugfs_mkdir(parent->d_inode, *dentry, mode, ++ data, fops); + break; + case S_IFLNK: +- error = debugfs_link(parent->d_inode, *dentry, mode); ++ error = debugfs_link(parent->d_inode, *dentry, mode, ++ data, fops); + break; + default: +- error = debugfs_create(parent->d_inode, *dentry, mode); ++ error = debugfs_create(parent->d_inode, *dentry, mode, ++ data, fops); + break; + } + dput(*dentry); +@@ -221,19 +236,13 @@ struct dentry *debugfs_create_file(const + if (error) + goto exit; + +- error = debugfs_create_by_name(name, mode, parent, &dentry); ++ error = debugfs_create_by_name(name, mode, parent, &dentry, ++ data, fops); + if (error) { + dentry = NULL; + simple_release_fs(&debugfs_mount, &debugfs_mount_count); + goto exit; + } +- +- if (dentry->d_inode) { +- if (data) +- dentry->d_inode->i_private = data; +- if (fops) +- dentry->d_inode->i_fop = fops; +- } + exit: + return dentry; + } + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:51 2009 +Message-Id: <20091217035650.926077960@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:55:59 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Stern , + Oliver Neukum +Subject: [062/151] Driver core: fix race in dev_driver_string + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alan Stern + +commit 3589972e51fac1e02d0aaa576fa47f568cb94d40 upstream. + +This patch (as1310) works around a race in dev_driver_string(). If +the device is unbound while the function is running, dev->driver might +become NULL after we test it and before we dereference it. + +Signed-off-by: Alan Stern +Cc: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/core.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -56,7 +56,14 @@ static inline int device_is_not_partitio + */ + const char *dev_driver_string(const struct device *dev) + { +- return dev->driver ? dev->driver->name : ++ struct device_driver *drv; ++ ++ /* dev->driver can change to NULL underneath us because of unbinding, ++ * so be careful about accessing it. dev->bus and dev->class should ++ * never change once they are set, so they don't need special care. ++ */ ++ drv = ACCESS_ONCE(dev->driver); ++ return drv ? drv->name : + (dev->bus ? dev->bus->name : + (dev->class ? dev->class->name : "")); + } + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:51 2009 +Message-Id: <20091217035651.053387583@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:00 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ian Jackson , + Alan Cox +Subject: [063/151] Serial: Do not read IIR in serial8250_start_tx when UART_BUG_TXEN + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ian Jackson + +commit 68cb4f8e246bbbc649980be0628cae9265870a91 upstream. + +Do not read IIR in serial8250_start_tx when UART_BUG_TXEN + +Reading the IIR clears some oustanding interrupts so it is not safe. +Instead, simply transmit immediately if the buffer is empty without +regard to IIR. + +Signed-off-by: Ian Jackson +Reviewed-by: Markus Armbruster +Reviewed-by: Jiri Kosina +Cc: Alan Cox +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/serial/8250.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +--- a/drivers/serial/8250.c ++++ b/drivers/serial/8250.c +@@ -1339,14 +1339,12 @@ static void serial8250_start_tx(struct u + serial_out(up, UART_IER, up->ier); + + if (up->bugs & UART_BUG_TXEN) { +- unsigned char lsr, iir; ++ unsigned char lsr; + lsr = serial_in(up, UART_LSR); + up->lsr_saved_flags |= lsr & LSR_SAVE_FLAGS; +- iir = serial_in(up, UART_IIR) & 0x0f; + if ((up->port.type == PORT_RM9000) ? +- (lsr & UART_LSR_THRE && +- (iir == UART_IIR_NO_INT || iir == UART_IIR_THRI)) : +- (lsr & UART_LSR_TEMT && iir & UART_IIR_NO_INT)) ++ (lsr & UART_LSR_THRE) : ++ (lsr & UART_LSR_TEMT)) + transmit_chars(up); + } + } + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:51 2009 +Message-Id: <20091217035651.184091195@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:01 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Vasanthakumar Thiagarajan , + "John W. Linville" +Subject: [064/151] mac80211: Fix bug in computing crc over dynamic IEs in beacon + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Vasanthakumar Thiagarajan + +commit 1814077fd12a9cdf478c10076e9c42094e9d9250 upstream. + +On a 32-bit machine, BIT() macro does not give the required +bit value if the bit is mroe than 31. In ieee802_11_parse_elems_crc(), +BIT() is suppossed to get the bit value more than 31 (42 (id of ERP_INFO_IE), +37 (CHANNEL_SWITCH_IE), (42), 32 (POWER_CONSTRAINT_IE), 45 (HT_CAP_IE), +61 (HT_INFO_IE)). As we do not get the required bit value for the above +IEs, crc over these IEs are never calculated, so any dynamic change in these +IEs after the association is not really handled on 32-bit platforms. +This patch fixes this issue. + +Signed-off-by: Vasanthakumar Thiagarajan +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/util.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -579,7 +579,7 @@ u32 ieee802_11_parse_elems_crc(u8 *start + if (elen > left) + break; + +- if (calc_crc && id < 64 && (filter & BIT(id))) ++ if (calc_crc && id < 64 && (filter & (1ULL << id))) + crc = crc32_be(crc, pos - 2, elen + 2); + + switch (id) { + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:51 2009 +Message-Id: <20091217035651.312420775@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:02 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Javier Cardona , + Andrey Yurovsky , + "John W. Linville" +Subject: [065/151] mac80211: Fixed bug in mesh portal paths + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Javier Cardona + +commit 5d618cb81aeea19879975cd1f9a1e707694dfd7c upstream. + +Paths to mesh portals were being timed out immediately after each use in +intermediate forwarding nodes. mppath->exp_time is set to the expiration time +so assigning it to jiffies was marking the path as expired. + +Signed-off-by: Javier Cardona +Signed-off-by: Andrey Yurovsky +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/rx.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -1514,7 +1514,6 @@ ieee80211_rx_h_mesh_fwding(struct ieee80 + mpp_path_add(mesh_hdr->eaddr2, hdr->addr4, sdata); + } else { + spin_lock_bh(&mppath->state_lock); +- mppath->exp_time = jiffies; + if (compare_ether_addr(mppath->mpp, hdr->addr4) != 0) + memcpy(mppath->mpp, hdr->addr4, ETH_ALEN); + spin_unlock_bh(&mppath->state_lock); + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:51 2009 +Message-Id: <20091217035651.439580867@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:03 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Javier Cardona , + Andrey Yurovsky , + "John W. Linville" +Subject: [066/151] mac80211: Revert Use correct sign for mesh active path refresh + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Javier Cardona + +commit 7b324d28a94dac5a451e8cba66e8d324601e5b9a upstream. + +The patch ("mac80211: Use correct sign for mesh active path +refresh.") was actually a bug. Reverted it and improved the +explanation of how mesh path refresh works. + +Signed-off-by: Javier Cardona +Signed-off-by: Andrey Yurovsky +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/mesh.h | 5 +++-- + net/mac80211/mesh_hwmp.c | 2 +- + 2 files changed, 4 insertions(+), 3 deletions(-) + +--- a/net/mac80211/mesh.h ++++ b/net/mac80211/mesh.h +@@ -186,8 +186,9 @@ struct mesh_rmc { + */ + #define MESH_PREQ_MIN_INT 10 + #define MESH_DIAM_TRAVERSAL_TIME 50 +-/* Paths will be refreshed if they are closer than PATH_REFRESH_TIME to their +- * expiration ++/* A path will be refreshed if it is used PATH_REFRESH_TIME milliseconds before ++ * timing out. This way it will remain ACTIVE and no data frames will be ++ * unnecesarily held in the pending queue. + */ + #define MESH_PATH_REFRESH_TIME 1000 + #define MESH_MIN_DISCOVERY_TIMEOUT (2 * MESH_DIAM_TRAVERSAL_TIME) +--- a/net/mac80211/mesh_hwmp.c ++++ b/net/mac80211/mesh_hwmp.c +@@ -813,7 +813,7 @@ int mesh_nexthop_lookup(struct sk_buff * + } + + if (mpath->flags & MESH_PATH_ACTIVE) { +- if (time_after(jiffies, mpath->exp_time + ++ if (time_after(jiffies, mpath->exp_time - + msecs_to_jiffies(sdata->u.mesh.mshcfg.path_refresh_time)) + && !memcmp(sdata->dev->dev_addr, hdr->addr4, + ETH_ALEN) + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:51 2009 +Message-Id: <20091217035651.568432019@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:04 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Johannes Berg , + "John W. Linville" +Subject: [067/151] mac80211: fix scan abort sanity checks + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Johannes Berg + +commit 6d3560d4fc9c5b9fe1a07a63926ea70512c69c32 upstream. + +Since sometimes mac80211 queues up a scan request +to only act on it later, it must be allowed to +(internally) cancel a not-yet-running scan, e.g. +when the interface is taken down. This condition +was missing since we always checked only the +local->scanning variable which isn't yet set in +that situation. + +Reported-by: Luis R. Rodriguez +Signed-off-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/scan.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/net/mac80211/scan.c ++++ b/net/mac80211/scan.c +@@ -264,10 +264,14 @@ void ieee80211_scan_completed(struct iee + + mutex_lock(&local->scan_mtx); + +- if (WARN_ON(!local->scanning)) { +- mutex_unlock(&local->scan_mtx); +- return; +- } ++ /* ++ * It's ok to abort a not-yet-running scan (that ++ * we have one at all will be verified by checking ++ * local->scan_req next), but not to complete it ++ * successfully. ++ */ ++ if (WARN_ON(!local->scanning && !aborted)) ++ aborted = true; + + if (WARN_ON(!local->scan_req)) { + mutex_unlock(&local->scan_mtx); + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:51 2009 +Message-Id: <20091217035651.697075324@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:05 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "John W. Linville" +Subject: [068/151] wireless: correctly report signal value for IEEE80211_HW_SIGNAL_UNSPEC + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: John W. Linville + +commit 19deffbeba930030cfaf000b920333c6ba99ad52 upstream. + +This part was missed in "cfg80211: implement get_wireless_stats", +probably because sta_set_sinfo already existed and was only handling +dBm signals. + +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/cfg.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -338,7 +338,8 @@ static void sta_set_sinfo(struct sta_inf + sinfo->rx_packets = sta->rx_packets; + sinfo->tx_packets = sta->tx_packets; + +- if (sta->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) { ++ if ((sta->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) || ++ (sta->local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)) { + sinfo->filled |= STATION_INFO_SIGNAL; + sinfo->signal = (s8)sta->last_signal; + } + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:51 2009 +Message-Id: <20091217035651.824658024@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:06 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Larry Finger , + "John W. Linville" +Subject: [069/151] rtl8187: Fix wrong rfkill switch mask for some models + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Larry Finger + +commit 70d57139f932b9ca21026253d02af71cf53d764a upstream. + +There are different bits used to convey the setting of the rfkill +switch to the driver. The current driver only supports one of these +possibilities. These changes were derived from the latest version +of the vendor driver. + +This patch fixes the regression noted in kernel Bugzilla #14743. + +Signed-off-by: Larry Finger +Reported-and-tested-by: Antti Kaijanmäki +Tested-by: Hin-Tak Leung +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtl818x/rtl8187.h | 5 +++++ + drivers/net/wireless/rtl818x/rtl8187_dev.c | 12 ++++++++++-- + drivers/net/wireless/rtl818x/rtl8187_rfkill.c | 4 ++-- + 3 files changed, 17 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c ++++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c +@@ -1329,6 +1329,7 @@ static int __devinit rtl8187_probe(struc + struct ieee80211_channel *channel; + const char *chip_name; + u16 txpwr, reg; ++ u16 product_id = le16_to_cpu(udev->descriptor.idProduct); + int err, i; + + dev = ieee80211_alloc_hw(sizeof(*priv), &rtl8187_ops); +@@ -1488,6 +1489,13 @@ static int __devinit rtl8187_probe(struc + (*channel++).hw_value = txpwr & 0xFF; + (*channel++).hw_value = txpwr >> 8; + } ++ /* Handle the differing rfkill GPIO bit in different models */ ++ priv->rfkill_mask = RFKILL_MASK_8187_89_97; ++ if (product_id == 0x8197 || product_id == 0x8198) { ++ eeprom_93cx6_read(&eeprom, RTL8187_EEPROM_SELECT_GPIO, ®); ++ if (reg & 0xFF00) ++ priv->rfkill_mask = RFKILL_MASK_8198; ++ } + + /* + * XXX: Once this driver supports anything that requires +@@ -1516,9 +1524,9 @@ static int __devinit rtl8187_probe(struc + mutex_init(&priv->conf_mutex); + skb_queue_head_init(&priv->b_tx_status.queue); + +- printk(KERN_INFO "%s: hwaddr %pM, %s V%d + %s\n", ++ printk(KERN_INFO "%s: hwaddr %pM, %s V%d + %s, rfkill mask %d\n", + wiphy_name(dev->wiphy), dev->wiphy->perm_addr, +- chip_name, priv->asic_rev, priv->rf->name); ++ chip_name, priv->asic_rev, priv->rf->name, priv->rfkill_mask); + + #ifdef CONFIG_RTL8187_LEDS + eeprom_93cx6_read(&eeprom, 0x3F, ®); +--- a/drivers/net/wireless/rtl818x/rtl8187.h ++++ b/drivers/net/wireless/rtl818x/rtl8187.h +@@ -23,6 +23,7 @@ + #define RTL8187_EEPROM_TXPWR_CHAN_1 0x16 /* 3 channels */ + #define RTL8187_EEPROM_TXPWR_CHAN_6 0x1B /* 2 channels */ + #define RTL8187_EEPROM_TXPWR_CHAN_4 0x3D /* 2 channels */ ++#define RTL8187_EEPROM_SELECT_GPIO 0x3B + + #define RTL8187_REQT_READ 0xC0 + #define RTL8187_REQT_WRITE 0x40 +@@ -31,6 +32,9 @@ + + #define RTL8187_MAX_RX 0x9C4 + ++#define RFKILL_MASK_8187_89_97 0x2 ++#define RFKILL_MASK_8198 0x4 ++ + struct rtl8187_rx_info { + struct urb *urb; + struct ieee80211_hw *dev; +@@ -123,6 +127,7 @@ struct rtl8187_priv { + u8 noise; + u8 slot_time; + u8 aifsn[4]; ++ u8 rfkill_mask; + struct { + __le64 buf; + struct sk_buff_head queue; +--- a/drivers/net/wireless/rtl818x/rtl8187_rfkill.c ++++ b/drivers/net/wireless/rtl818x/rtl8187_rfkill.c +@@ -25,10 +25,10 @@ static bool rtl8187_is_radio_enabled(str + u8 gpio; + + gpio = rtl818x_ioread8(priv, &priv->map->GPIO0); +- rtl818x_iowrite8(priv, &priv->map->GPIO0, gpio & ~0x02); ++ rtl818x_iowrite8(priv, &priv->map->GPIO0, gpio & ~priv->rfkill_mask); + gpio = rtl818x_ioread8(priv, &priv->map->GPIO1); + +- return gpio & 0x02; ++ return gpio & priv->rfkill_mask; + } + + void rtl8187_rfkill_init(struct ieee80211_hw *hw) + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:52 2009 +Message-Id: <20091217035651.948970563@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:07 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Thomas Gleixner , + Cyrill Gorcunov , + Ingo Molnar +Subject: [070/151] x86: Fix bogus warning in apic_noop.apic_write() + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Thomas Gleixner + +commit a946d8f11f0da9cfc714248036fcfd3a794d1e27 upstream. + +apic_noop is used to provide dummy apic functions. It's installed +when the CPU has no APIC or when the APIC is disabled on the kernel +command line. + +The apic_noop implementation of apic_write() warns when the CPU has +an APIC or when the APIC is not disabled. + +That's bogus. The warning should only happen when the CPU has an +APIC _AND_ the APIC is not disabled. apic_noop.apic_read() has the +correct check. + +Signed-off-by: Thomas Gleixner +Cc: Cyrill Gorcunov +LKML-Reference: +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/apic/apic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/apic/apic.c ++++ b/arch/x86/kernel/apic/apic.c +@@ -246,7 +246,7 @@ static int modern_apic(void) + */ + static void native_apic_write_dummy(u32 reg, u32 v) + { +- WARN_ON_ONCE((cpu_has_apic || !disable_apic)); ++ WARN_ON_ONCE(cpu_has_apic && !disable_apic); + } + + static u32 native_apic_read_dummy(u32 reg) + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:52 2009 +Message-Id: <20091217035652.076973985@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:08 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Naoya Horiguchi , + Andi Kleen , + Wu Fengguang , + Hugh Dickins , + Mel Gorman , + Lee Schermerhorn , + Andy Whitcroft , + David Rientjes +Subject: [071/151] mm: hugetlb: fix hugepage memory leak in mincore() + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Naoya Horiguchi + +commit 4f16fc107d9c9b8a72aa19b189a9216e90a7aaef upstream. + +Most callers of pmd_none_or_clear_bad() check whether the target page is +in a hugepage or not, but mincore() and walk_page_range() do not check it. + So if we use mincore() on a hugepage on x86 machine, the hugepage memory +is leaked as shown below. This patch fixes it by extending mincore() +system call to support hugepages. + +Details +======= +My test program (leak_mincore) works as follows: + - creat() and mmap() a file on hugetlbfs (file size is 200MB == 100 hugepages,) + - read()/write() something on it, + - call mincore() for first ten pages and printf() the values of *vec + - munmap() and unlink() the file on hugetlbfs + +Without my patch +---------------- +$ cat /proc/meminfo| grep "HugePage" +HugePages_Total: 1000 +HugePages_Free: 1000 +HugePages_Rsvd: 0 +HugePages_Surp: 0 +$ ./leak_mincore +vec[0] 0 +vec[1] 0 +vec[2] 0 +vec[3] 0 +vec[4] 0 +vec[5] 0 +vec[6] 0 +vec[7] 0 +vec[8] 0 +vec[9] 0 +$ cat /proc/meminfo |grep "HugePage" +HugePages_Total: 1000 +HugePages_Free: 999 +HugePages_Rsvd: 0 +HugePages_Surp: 0 +$ ls /hugetlbfs/ +$ + +Return values in *vec from mincore() are set to 0, while the hugepage +should be in memory, and 1 hugepage is still accounted as used while +there is no file on hugetlbfs. + +With my patch +------------- +$ cat /proc/meminfo| grep "HugePage" +HugePages_Total: 1000 +HugePages_Free: 1000 +HugePages_Rsvd: 0 +HugePages_Surp: 0 +$ ./leak_mincore +vec[0] 1 +vec[1] 1 +vec[2] 1 +vec[3] 1 +vec[4] 1 +vec[5] 1 +vec[6] 1 +vec[7] 1 +vec[8] 1 +vec[9] 1 +$ cat /proc/meminfo |grep "HugePage" +HugePages_Total: 1000 +HugePages_Free: 1000 +HugePages_Rsvd: 0 +HugePages_Surp: 0 +$ ls /hugetlbfs/ +$ + +Return value in *vec set to 1 and no memory leaks. + +[akpm@linux-foundation.org: cleanup] +[akpm@linux-foundation.org: build fix] +Signed-off-by: Naoya Horiguchi +Cc: Andi Kleen +Cc: Wu Fengguang +Cc: Hugh Dickins +Cc: Mel Gorman +Cc: Lee Schermerhorn +Cc: Andy Whitcroft +Cc: David Rientjes +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- a/mm/mincore.c ++++ b/mm/mincore.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -72,6 +73,42 @@ static long do_mincore(unsigned long addr, unsigned char *vec, unsigned long pag + if (!vma || addr < vma->vm_start) + return -ENOMEM; + ++#ifdef CONFIG_HUGETLB_PAGE ++ if (is_vm_hugetlb_page(vma)) { ++ struct hstate *h; ++ unsigned long nr_huge; ++ unsigned char present; ++ ++ i = 0; ++ nr = min(pages, (vma->vm_end - addr) >> PAGE_SHIFT); ++ h = hstate_vma(vma); ++ nr_huge = ((addr + pages * PAGE_SIZE - 1) >> huge_page_shift(h)) ++ - (addr >> huge_page_shift(h)) + 1; ++ nr_huge = min(nr_huge, ++ (vma->vm_end - addr) >> huge_page_shift(h)); ++ while (1) { ++ /* hugepage always in RAM for now, ++ * but generally it needs to be check */ ++ ptep = huge_pte_offset(current->mm, ++ addr & huge_page_mask(h)); ++ present = !!(ptep && ++ !huge_pte_none(huge_ptep_get(ptep))); ++ while (1) { ++ vec[i++] = present; ++ addr += PAGE_SIZE; ++ /* reach buffer limit */ ++ if (i == nr) ++ return nr; ++ /* check hugepage border */ ++ if (!((addr & ~huge_page_mask(h)) ++ >> PAGE_SHIFT)) ++ break; ++ } ++ } ++ return nr; ++ } ++#endif ++ + /* + * Calculate how many pages there are left in the last level of the + * PTE array for our address. + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:52 2009 +Message-Id: <20091217035652.216077157@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:09 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Naoya Horiguchi , + Andi Kleen , + Wu Fengguang , + Hugh Dickins , + Mel Gorman , + Lee Schermerhorn , + Andy Whitcroft , + David Rientjes +Subject: [072/151] mm: hugetlb: fix hugepage memory leak in walk_page_range() + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Naoya Horiguchi + +commit d33b9f45bd24a6391bc05e2b5a13c1b5787ca9c2 upstream. + +Most callers of pmd_none_or_clear_bad() check whether the target page is +in a hugepage or not, but walk_page_range() do not check it. So if we +read /proc/pid/pagemap for the hugepage on x86 machine, the hugepage +memory is leaked as shown below. This patch fixes it. + +Details +======= +My test program (leak_pagemap) works as follows: + - creat() and mmap() a file on hugetlbfs (file size is 200MB == 100 hugepages,) + - read()/write() something on it, + - call page-types with option -p (walk around the page tables), + - munmap() and unlink() the file on hugetlbfs + +Without my patches +------------------ +$ cat /proc/meminfo |grep "HugePage" +HugePages_Total: 1000 +HugePages_Free: 1000 +HugePages_Rsvd: 0 +HugePages_Surp: 0 +$ ./leak_pagemap +[snip output] +$ cat /proc/meminfo |grep "HugePage" +HugePages_Total: 1000 +HugePages_Free: 900 +HugePages_Rsvd: 0 +HugePages_Surp: 0 +$ ls /hugetlbfs/ +$ + +100 hugepages are accounted as used while there is no file on hugetlbfs. + +With my patches +--------------- +$ cat /proc/meminfo |grep "HugePage" +HugePages_Total: 1000 +HugePages_Free: 1000 +HugePages_Rsvd: 0 +HugePages_Surp: 0 +$ ./leak_pagemap +[snip output] +$ cat /proc/meminfo |grep "HugePage" +HugePages_Total: 1000 +HugePages_Free: 1000 +HugePages_Rsvd: 0 +HugePages_Surp: 0 +$ ls /hugetlbfs +$ + +No memory leaks. + +Signed-off-by: Naoya Horiguchi +Cc: Andi Kleen +Cc: Wu Fengguang +Cc: Hugh Dickins +Cc: Mel Gorman +Cc: Lee Schermerhorn +Cc: Andy Whitcroft +Cc: David Rientjes +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/pagewalk.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +--- a/mm/pagewalk.c ++++ b/mm/pagewalk.c +@@ -1,6 +1,7 @@ + #include + #include + #include ++#include + + static int walk_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end, + struct mm_walk *walk) +@@ -107,6 +108,7 @@ int walk_page_range(unsigned long addr, + pgd_t *pgd; + unsigned long next; + int err = 0; ++ struct vm_area_struct *vma; + + if (addr >= end) + return err; +@@ -117,11 +119,22 @@ int walk_page_range(unsigned long addr, + pgd = pgd_offset(walk->mm, addr); + do { + next = pgd_addr_end(addr, end); ++ ++ /* skip hugetlb vma to avoid hugepage PMD being cleared ++ * in pmd_none_or_clear_bad(). */ ++ vma = find_vma(walk->mm, addr); ++ if (vma && is_vm_hugetlb_page(vma)) { ++ if (vma->vm_end < next) ++ next = vma->vm_end; ++ continue; ++ } ++ + if (pgd_none_or_clear_bad(pgd)) { + if (walk->pte_hole) + err = walk->pte_hole(addr, next, walk); + if (err) + break; ++ pgd++; + continue; + } + if (walk->pgd_entry) +@@ -131,7 +144,8 @@ int walk_page_range(unsigned long addr, + err = walk_pud_range(pgd, addr, next, walk); + if (err) + break; +- } while (pgd++, addr = next, addr != end); ++ pgd++; ++ } while (addr = next, addr != end); + + return err; + } + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:52 2009 +Message-Id: <20091217035652.337874793@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:10 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Benjamin Herrenschmidt +Subject: [073/151] powerpc/windfarm: Add detection for second cpu pump + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Bolko Maass + +commit 529586dc39b0ec47c6290c4e7bed6ea3ffd1d8fb upstream. + +Windfarm SMU control is explicitly missing support for a second CPU pump in G5 PowerMacs. Such machines actually exist (specifically Quads with a second pump), so this patch adds detection for it. + +Signed-off by: Bolko Maass +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/macintosh/windfarm_smu_controls.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/macintosh/windfarm_smu_controls.c ++++ b/drivers/macintosh/windfarm_smu_controls.c +@@ -202,6 +202,8 @@ static struct smu_fan_control *smu_fan_c + fct->ctrl.name = "cpu-front-fan-1"; + else if (!strcmp(l, "CPU A PUMP")) + fct->ctrl.name = "cpu-pump-0"; ++ else if (!strcmp(l, "CPU B PUMP")) ++ fct->ctrl.name = "cpu-pump-1"; + else if (!strcmp(l, "Slots Fan") || !strcmp(l, "Slots fan") || + !strcmp(l, "EXPANSION SLOTS INTAKE")) + fct->ctrl.name = "slots-fan"; + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:52 2009 +Message-Id: <20091217035652.466792154@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:11 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Darrick J. Wong" , + Benjamin Herrenschmidt +Subject: [074/151] powerpc/therm_adt746x: Record pwm invert bit at module load time] + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Darrick J. Wong + +commit 1496e89ae2a0962748e55165a590fa3209c6f158 upstream. + +In commit 0512a9a8e277a9de2820211eef964473b714ae65, we unilaterally zero the +"pwm invert" bit in the fan behavior configuration register. On my PowerBook +G4, this results in the fans going to full speed at low temperature and +shutting off at high temperature because the pwm invert bit is supposed to be +set. + +Therefore, record the pwm invert bit at driver load time, and write the bit +into the fan behavior control register. This restores correct behavior on my +PBG4 and should work around the bit being set to the wrong value after +suspend/resume (which is what the original patch was trying to fix). It also +fixes a minor omission where the pwm invert bit correction is NOT performed +when switching into automatic mode. + +Signed-off-by: Darrick J. Wong +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/macintosh/therm_adt746x.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/drivers/macintosh/therm_adt746x.c ++++ b/drivers/macintosh/therm_adt746x.c +@@ -79,6 +79,7 @@ struct thermostat { + u8 limits[3]; + int last_speed[2]; + int last_var[2]; ++ int pwm_inv[2]; + }; + + static enum {ADT7460, ADT7467} therm_type; +@@ -229,19 +230,23 @@ static void write_fan_speed(struct therm + + if (speed >= 0) { + manual = read_reg(th, MANUAL_MODE[fan]); ++ manual &= ~INVERT_MASK; + write_reg(th, MANUAL_MODE[fan], +- (manual|MANUAL_MASK) & (~INVERT_MASK)); ++ manual | MANUAL_MASK | th->pwm_inv[fan]); + write_reg(th, FAN_SPD_SET[fan], speed); + } else { + /* back to automatic */ + if(therm_type == ADT7460) { + manual = read_reg(th, + MANUAL_MODE[fan]) & (~MANUAL_MASK); +- ++ manual &= ~INVERT_MASK; ++ manual |= th->pwm_inv[fan]; + write_reg(th, + MANUAL_MODE[fan], manual|REM_CONTROL[fan]); + } else { + manual = read_reg(th, MANUAL_MODE[fan]); ++ manual &= ~INVERT_MASK; ++ manual |= th->pwm_inv[fan]; + write_reg(th, MANUAL_MODE[fan], manual&(~AUTO_MASK)); + } + } +@@ -418,6 +423,10 @@ static int probe_thermostat(struct i2c_c + + thermostat = th; + ++ /* record invert bit status because fw can corrupt it after suspend */ ++ th->pwm_inv[0] = read_reg(th, MANUAL_MODE[0]) & INVERT_MASK; ++ th->pwm_inv[1] = read_reg(th, MANUAL_MODE[1]) & INVERT_MASK; ++ + /* be sure to really write fan speed the first time */ + th->last_speed[0] = -2; + th->last_speed[1] = -2; + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:52 2009 +Message-Id: <20091217035652.596312032@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:12 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Benjamin Herrenschmidt +Subject: [075/151] powerpc: Fix usage of 64-bit instruction in 32-bit altivec code + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Benjamin Herrenschmidt + +commit e090aa80321b64c3b793f3b047e31ecf1af9538d upstream. + +e821ea70f3b4873b50056a1e0f74befed1014c09 introduced a bug by copying +some 64-bit originated code as-is to be used by both 32 and 64-bit +but this code contains a 64-bit ony "cmpdi" instruction. + +This changes it to cmpwi, which is fine since VRSAVE can only contains +a 32-bit value anyway. + +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kernel/vector.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/powerpc/kernel/vector.S ++++ b/arch/powerpc/kernel/vector.S +@@ -58,7 +58,7 @@ _GLOBAL(load_up_altivec) + * all 1's + */ + mfspr r4,SPRN_VRSAVE +- cmpdi 0,r4,0 ++ cmpwi 0,r4,0 + bne+ 1f + li r4,-1 + mtspr SPRN_VRSAVE,r4 + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:52 2009 +Message-Id: <20091217035652.724954569@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:13 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alex Deucher , + Dave Airlie +Subject: [076/151] drm/radeon/kms: Add quirk for HIS X1300 board + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alex Deucher + +commit 4e3f9b78ff917cc5c833858fdb5d96bc262e0bf3 upstream. + +Board is DVI+VGA, not DVI+DVI + +Signed-off-by: Alex Deucher +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_atombios.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/gpu/drm/radeon/radeon_atombios.c ++++ b/drivers/gpu/drm/radeon/radeon_atombios.c +@@ -135,6 +135,14 @@ static bool radeon_atom_apply_quirks(str + } + } + ++ /* HIS X1300 is DVI+VGA, not DVI+DVI */ ++ if ((dev->pdev->device == 0x7146) && ++ (dev->pdev->subsystem_vendor == 0x17af) && ++ (dev->pdev->subsystem_device == 0x2058)) { ++ if (supported_device == ATOM_DEVICE_DFP1_SUPPORT) ++ return false; ++ } ++ + /* Funky macbooks */ + if ((dev->pdev->device == 0x71C5) && + (dev->pdev->subsystem_vendor == 0x106b) && + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:52 2009 +Message-Id: <20091217035652.853830165@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:14 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alex Deucher , + Dave Airlie +Subject: [077/151] drm/radeon/kms: handle vblanks properly with dpms on + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alex Deucher + +commit 500b758725314ab1b5316eb0caa5b0fa26740e6b upstream. + +avivo chips + +Copied from pre-avivo code. + +Signed-off-by: Alex Deucher +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/atombios_crtc.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/radeon/atombios_crtc.c ++++ b/drivers/gpu/drm/radeon/atombios_crtc.c +@@ -241,6 +241,7 @@ void atombios_crtc_dpms(struct drm_crtc + { + struct drm_device *dev = crtc->dev; + struct radeon_device *rdev = dev->dev_private; ++ struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc); + + switch (mode) { + case DRM_MODE_DPMS_ON: +@@ -248,20 +249,19 @@ void atombios_crtc_dpms(struct drm_crtc + if (ASIC_IS_DCE3(rdev)) + atombios_enable_crtc_memreq(crtc, 1); + atombios_blank_crtc(crtc, 0); ++ drm_vblank_post_modeset(dev, radeon_crtc->crtc_id); ++ radeon_crtc_load_lut(crtc); + break; + case DRM_MODE_DPMS_STANDBY: + case DRM_MODE_DPMS_SUSPEND: + case DRM_MODE_DPMS_OFF: ++ drm_vblank_pre_modeset(dev, radeon_crtc->crtc_id); + atombios_blank_crtc(crtc, 1); + if (ASIC_IS_DCE3(rdev)) + atombios_enable_crtc_memreq(crtc, 0); + atombios_enable_crtc(crtc, 0); + break; + } +- +- if (mode != DRM_MODE_DPMS_OFF) { +- radeon_crtc_load_lut(crtc); +- } + } + + static void + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:53 2009 +Message-Id: <20091217035652.985723727@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:15 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alex Deucher , + Dave Airlie +Subject: [078/151] drm/radeon/kms: fix legacy crtc2 dpms + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alex Deucher + +commit 8de21525439e6b5bb8d8c81e49094d867bf82f6d upstream. + +noticed by Matthijs Kooijman on fdo bug 22140 + +Signed-off-by: Alex Deucher +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_legacy_crtc.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c ++++ b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c +@@ -292,8 +292,7 @@ void radeon_crtc_dpms(struct drm_crtc *c + uint32_t mask; + + if (radeon_crtc->crtc_id) +- mask = (RADEON_CRTC2_EN | +- RADEON_CRTC2_DISP_DIS | ++ mask = (RADEON_CRTC2_DISP_DIS | + RADEON_CRTC2_VSYNC_DIS | + RADEON_CRTC2_HSYNC_DIS | + RADEON_CRTC2_DISP_REQ_EN_B); +@@ -305,7 +304,7 @@ void radeon_crtc_dpms(struct drm_crtc *c + switch (mode) { + case DRM_MODE_DPMS_ON: + if (radeon_crtc->crtc_id) +- WREG32_P(RADEON_CRTC2_GEN_CNTL, RADEON_CRTC2_EN, ~mask); ++ WREG32_P(RADEON_CRTC2_GEN_CNTL, RADEON_CRTC2_EN, ~(RADEON_CRTC2_EN | mask)); + else { + WREG32_P(RADEON_CRTC_GEN_CNTL, RADEON_CRTC_EN, ~(RADEON_CRTC_EN | + RADEON_CRTC_DISP_REQ_EN_B)); +@@ -319,7 +318,7 @@ void radeon_crtc_dpms(struct drm_crtc *c + case DRM_MODE_DPMS_OFF: + drm_vblank_pre_modeset(dev, radeon_crtc->crtc_id); + if (radeon_crtc->crtc_id) +- WREG32_P(RADEON_CRTC2_GEN_CNTL, mask, ~mask); ++ WREG32_P(RADEON_CRTC2_GEN_CNTL, mask, ~(RADEON_CRTC2_EN | mask)); + else { + WREG32_P(RADEON_CRTC_GEN_CNTL, RADEON_CRTC_DISP_REQ_EN_B, ~(RADEON_CRTC_EN | + RADEON_CRTC_DISP_REQ_EN_B)); + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:53 2009 +Message-Id: <20091217035653.117673162@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:16 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alex Deucher , + Dave Airlie +Subject: [079/151] drm/radeon/kms: fix vram setup on rs600 + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alex Deucher + +commit 722f29434e72188b2d20f9b41f4b5952073ed568 upstream. + +also fix up rs690 mem width. + +should fix fdo bug 25408 + +Signed-off-by: Alex Deucher +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/rs600.c | 6 ++++++ + drivers/gpu/drm/radeon/rs690.c | 10 ++-------- + 2 files changed, 8 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/radeon/rs600.c ++++ b/drivers/gpu/drm/radeon/rs600.c +@@ -315,6 +315,12 @@ void rs600_vram_info(struct radeon_devic + /* FIXME: to do or is these values sane ? */ + rdev->mc.vram_is_ddr = true; + rdev->mc.vram_width = 128; ++ ++ rdev->mc.real_vram_size = RREG32(RADEON_CONFIG_MEMSIZE); ++ rdev->mc.mc_vram_size = rdev->mc.real_vram_size; ++ ++ rdev->mc.aper_base = drm_get_resource_start(rdev->ddev, 0); ++ rdev->mc.aper_size = drm_get_resource_len(rdev->ddev, 0); + } + + void rs600_bandwidth_update(struct radeon_device *rdev) +--- a/drivers/gpu/drm/radeon/rs690.c ++++ b/drivers/gpu/drm/radeon/rs690.c +@@ -131,19 +131,13 @@ void rs690_pm_info(struct radeon_device + + void rs690_vram_info(struct radeon_device *rdev) + { +- uint32_t tmp; + fixed20_12 a; + + rs400_gart_adjust_size(rdev); + /* DDR for all card after R300 & IGP */ + rdev->mc.vram_is_ddr = true; +- /* FIXME: is this correct for RS690/RS740 ? */ +- tmp = RREG32(RADEON_MEM_CNTL); +- if (tmp & R300_MEM_NUM_CHANNELS_MASK) { +- rdev->mc.vram_width = 128; +- } else { +- rdev->mc.vram_width = 64; +- } ++ rdev->mc.vram_width = 128; ++ + rdev->mc.real_vram_size = RREG32(RADEON_CONFIG_MEMSIZE); + rdev->mc.mc_vram_size = rdev->mc.real_vram_size; + + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:53 2009 +Message-Id: <20091217035653.247116914@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:17 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alex Deucher , + Dave Airlie +Subject: [080/151] drm/radeon/kms: rs6xx/rs740: clamp vram to aperture size + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alex Deucher + +commit 0088dbdb809e8799cb8f26da5ac64b15201fa99d upstream. + +Signed-off-by: Alex Deucher +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/rs600.c | 9 ++++++--- + drivers/gpu/drm/radeon/rs690.c | 9 ++++++++- + 2 files changed, 14 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/radeon/rs600.c ++++ b/drivers/gpu/drm/radeon/rs600.c +@@ -301,9 +301,7 @@ int rs600_mc_wait_for_idle(struct radeon + + void rs600_gpu_init(struct radeon_device *rdev) + { +- /* FIXME: HDP same place on rs600 ? */ + r100_hdp_reset(rdev); +- /* FIXME: is this correct ? */ + r420_pipes_init(rdev); + /* Wait for mc idle */ + if (rs600_mc_wait_for_idle(rdev)) +@@ -312,7 +310,6 @@ void rs600_gpu_init(struct radeon_device + + void rs600_vram_info(struct radeon_device *rdev) + { +- /* FIXME: to do or is these values sane ? */ + rdev->mc.vram_is_ddr = true; + rdev->mc.vram_width = 128; + +@@ -321,6 +318,12 @@ void rs600_vram_info(struct radeon_devic + + rdev->mc.aper_base = drm_get_resource_start(rdev->ddev, 0); + rdev->mc.aper_size = drm_get_resource_len(rdev->ddev, 0); ++ ++ if (rdev->mc.mc_vram_size > rdev->mc.aper_size) ++ rdev->mc.mc_vram_size = rdev->mc.aper_size; ++ ++ if (rdev->mc.real_vram_size > rdev->mc.aper_size) ++ rdev->mc.real_vram_size = rdev->mc.aper_size; + } + + void rs600_bandwidth_update(struct radeon_device *rdev) +--- a/drivers/gpu/drm/radeon/rs690.c ++++ b/drivers/gpu/drm/radeon/rs690.c +@@ -134,7 +134,7 @@ void rs690_vram_info(struct radeon_devic + fixed20_12 a; + + rs400_gart_adjust_size(rdev); +- /* DDR for all card after R300 & IGP */ ++ + rdev->mc.vram_is_ddr = true; + rdev->mc.vram_width = 128; + +@@ -143,6 +143,13 @@ void rs690_vram_info(struct radeon_devic + + rdev->mc.aper_base = drm_get_resource_start(rdev->ddev, 0); + rdev->mc.aper_size = drm_get_resource_len(rdev->ddev, 0); ++ ++ if (rdev->mc.mc_vram_size > rdev->mc.aper_size) ++ rdev->mc.mc_vram_size = rdev->mc.aper_size; ++ ++ if (rdev->mc.real_vram_size > rdev->mc.aper_size) ++ rdev->mc.real_vram_size = rdev->mc.aper_size; ++ + rs690_pm_info(rdev); + /* FIXME: we should enforce default clock in case GPU is not in + * default setup + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:53 2009 +Message-Id: <20091217035653.375160006@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:18 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Martin Michlmayr , + Thomas Hellstrom , + Dave Airlie +Subject: [081/151] drm/ttm: Fix build failure due to missing struct page + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Martin Michlmayr + +commit c3a73ba13bac7fd96030f39202b2d37fb19c46a6 upstream. + +drm/ttm fails to build on MIPS because "struct page" is not known: +| In file included from drivers/gpu/drm/ttm/ttm_memory.c:28: +| include/drm/ttm/ttm_memory.h:154: warning: 'struct page' declared inside parameter list +| include/drm/ttm/ttm_memory.h:154: warning: its scope is only this definition or declaration, which is probably not what you want +| include/drm/ttm/ttm_memory.h:156: warning: 'struct page' declared inside parameter list +| drivers/gpu/drm/ttm/ttm_memory.c:540: error: conflicting types for 'ttm_mem_global_alloc_page' +| include/drm/ttm/ttm_memory.h:154: error: previous declaration of 'ttm_mem_global_alloc_page' was here +| drivers/gpu/drm/ttm/ttm_memory.c:561: error: conflicting types for 'ttm_mem_global_free_page' +| include/drm/ttm/ttm_memory.h:156: error: previous declaration of 'ttm_mem_global_free_page' was here + +Signed-off-by: Martin Michlmayr +Acked-by: Thomas Hellstrom +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + include/drm/ttm/ttm_memory.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/include/drm/ttm/ttm_memory.h ++++ b/include/drm/ttm/ttm_memory.h +@@ -33,6 +33,7 @@ + #include + #include + #include ++#include + + /** + * struct ttm_mem_shrink - callback to shrink TTM memory usage. + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:53 2009 +Message-Id: <20091217035653.504981807@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:19 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Chris Wilson , + Eric Anholt +Subject: [082/151] drm/i915: Set the error code after failing to insert new offset into mm ht. + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Chris Wilson + +commit 5618ca6abc2d6f475b258badc017a5254cf43d1b upstream. + +Signed-off-by: Chris Wilson +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_gem.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/i915/i915_gem.c ++++ b/drivers/gpu/drm/i915/i915_gem.c +@@ -1288,6 +1288,7 @@ i915_gem_create_mmap_offset(struct drm_g + list->hash.key = list->file_offset_node->start; + if (drm_ht_insert_item(&mm->offset_hash, &list->hash)) { + DRM_ERROR("failed to add to map hash\n"); ++ ret = -ENOMEM; + goto out_free_mm; + } + + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:53 2009 +Message-Id: <20091217035653.632115849@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:20 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Zhao Yakui , + Eric Anholt +Subject: [083/151] drm/i915: Add the missing clonemask for display port on Ironlake + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Zhao Yakui + +commit 652af9d74e1a3a10bb10f0d8e8f42ddac26bbc1a upstream. + +Add the missing clonemask for display port on Ironlake. + +Signed-off-by: Zhao Yakui +Reviewed-by: Zhenyu Wang +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_dp.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_dp.c ++++ b/drivers/gpu/drm/i915/intel_dp.c +@@ -1254,11 +1254,11 @@ intel_dp_init(struct drm_device *dev, in + else + intel_output->type = INTEL_OUTPUT_DISPLAYPORT; + +- if (output_reg == DP_B) ++ if (output_reg == DP_B || output_reg == PCH_DP_B) + intel_output->clone_mask = (1 << INTEL_DP_B_CLONE_BIT); +- else if (output_reg == DP_C) ++ else if (output_reg == DP_C || output_reg == PCH_DP_C) + intel_output->clone_mask = (1 << INTEL_DP_C_CLONE_BIT); +- else if (output_reg == DP_D) ++ else if (output_reg == DP_D || output_reg == PCH_DP_D) + intel_output->clone_mask = (1 << INTEL_DP_D_CLONE_BIT); + + if (IS_eDP(intel_output)) { + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:53 2009 +Message-Id: <20091217035653.760116687@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:21 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jeremy Fitzhardinge +Subject: [084/151] xen/xenbus: make DEVICE_ATTR()s static + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jeremy Fitzhardinge + +commit db05fed0ad72f264e39bcb366795f7367384ec92 upstream. + +They don't need to be global, and may cause linker clashes. + +Signed-off-by: Jeremy Fitzhardinge +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/xen/xenbus/xenbus_probe.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/xen/xenbus/xenbus_probe.c ++++ b/drivers/xen/xenbus/xenbus_probe.c +@@ -454,21 +454,21 @@ static ssize_t xendev_show_nodename(stru + { + return sprintf(buf, "%s\n", to_xenbus_device(dev)->nodename); + } +-DEVICE_ATTR(nodename, S_IRUSR | S_IRGRP | S_IROTH, xendev_show_nodename, NULL); ++static DEVICE_ATTR(nodename, S_IRUSR | S_IRGRP | S_IROTH, xendev_show_nodename, NULL); + + static ssize_t xendev_show_devtype(struct device *dev, + struct device_attribute *attr, char *buf) + { + return sprintf(buf, "%s\n", to_xenbus_device(dev)->devicetype); + } +-DEVICE_ATTR(devtype, S_IRUSR | S_IRGRP | S_IROTH, xendev_show_devtype, NULL); ++static DEVICE_ATTR(devtype, S_IRUSR | S_IRGRP | S_IROTH, xendev_show_devtype, NULL); + + static ssize_t xendev_show_modalias(struct device *dev, + struct device_attribute *attr, char *buf) + { + return sprintf(buf, "xen:%s\n", to_xenbus_device(dev)->devicetype); + } +-DEVICE_ATTR(modalias, S_IRUSR | S_IRGRP | S_IROTH, xendev_show_modalias, NULL); ++static DEVICE_ATTR(modalias, S_IRUSR | S_IRGRP | S_IROTH, xendev_show_modalias, NULL); + + int xenbus_probe_node(struct xen_bus_type *bus, + const char *type, + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:54 2009 +Message-Id: <20091217035653.884061164@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:22 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ian Campbell , + Jeremy Fitzhardinge +Subject: [085/151] xen: re-register runstate area earlier on resume. + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ian Campbell + +commit be012920ecba161ad20303a3f6d9e96c58cf97c7 upstream. + +This is necessary to ensure the runstate area is available to +xen_sched_clock before any calls to printk which will require it in +order to provide a timestamp. + +I chose to pull the xen_setup_runstate_info out of xen_time_init into +the caller in order to maintain parity with calling +xen_setup_runstate_info separately from calling xen_time_resume. + +Signed-off-by: Ian Campbell +Signed-off-by: Jeremy Fitzhardinge +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/xen/enlighten.c | 2 ++ + arch/x86/xen/time.c | 5 ++--- + arch/x86/xen/xen-ops.h | 1 + + 3 files changed, 5 insertions(+), 3 deletions(-) + +--- a/arch/x86/xen/enlighten.c ++++ b/arch/x86/xen/enlighten.c +@@ -148,6 +148,8 @@ void xen_vcpu_restore(void) + HYPERVISOR_vcpu_op(VCPUOP_down, cpu, NULL)) + BUG(); + ++ xen_setup_runstate_info(cpu); ++ + xen_vcpu_setup(cpu); + + if (other_cpu && +--- a/arch/x86/xen/time.c ++++ b/arch/x86/xen/time.c +@@ -100,7 +100,7 @@ bool xen_vcpu_stolen(int vcpu) + return per_cpu(runstate, vcpu).state == RUNSTATE_runnable; + } + +-static void setup_runstate_info(int cpu) ++void xen_setup_runstate_info(int cpu) + { + struct vcpu_register_runstate_memory_area area; + +@@ -442,8 +442,6 @@ void xen_setup_timer(int cpu) + + evt->cpumask = cpumask_of(cpu); + evt->irq = irq; +- +- setup_runstate_info(cpu); + } + + void xen_teardown_timer(int cpu) +@@ -494,6 +492,7 @@ __init void xen_time_init(void) + + setup_force_cpu_cap(X86_FEATURE_TSC); + ++ xen_setup_runstate_info(cpu); + xen_setup_timer(cpu); + xen_setup_cpu_clockevents(); + } +--- a/arch/x86/xen/xen-ops.h ++++ b/arch/x86/xen/xen-ops.h +@@ -41,6 +41,7 @@ void __init xen_build_dynamic_phys_to_ma + + void xen_init_irq_ops(void); + void xen_setup_timer(int cpu); ++void xen_setup_runstate_info(int cpu); + void xen_teardown_timer(int cpu); + cycle_t xen_clocksource_read(void); + void xen_setup_cpu_clockevents(void); + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:54 2009 +Message-Id: <20091217035654.014917448@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:23 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jeremy Fitzhardinge +Subject: [086/151] xen: restore runstate_info even if !have_vcpu_info_placement + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jeremy Fitzhardinge + +commit 3905bb2aa7bb801b31946b37a4635ebac4009051 upstream. + +Even if have_vcpu_info_placement is not set, we still need to set up +the runstate area on each resumed vcpu. + +Signed-off-by: Jeremy Fitzhardinge +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/xen/enlighten.c | 25 +++++++++++-------------- + 1 file changed, 11 insertions(+), 14 deletions(-) + +--- a/arch/x86/xen/enlighten.c ++++ b/arch/x86/xen/enlighten.c +@@ -138,26 +138,23 @@ static void xen_vcpu_setup(int cpu) + */ + void xen_vcpu_restore(void) + { +- if (have_vcpu_info_placement) { +- int cpu; ++ int cpu; + +- for_each_online_cpu(cpu) { +- bool other_cpu = (cpu != smp_processor_id()); ++ for_each_online_cpu(cpu) { ++ bool other_cpu = (cpu != smp_processor_id()); + +- if (other_cpu && +- HYPERVISOR_vcpu_op(VCPUOP_down, cpu, NULL)) +- BUG(); ++ if (other_cpu && ++ HYPERVISOR_vcpu_op(VCPUOP_down, cpu, NULL)) ++ BUG(); + +- xen_setup_runstate_info(cpu); ++ xen_setup_runstate_info(cpu); + ++ if (have_vcpu_info_placement) + xen_vcpu_setup(cpu); + +- if (other_cpu && +- HYPERVISOR_vcpu_op(VCPUOP_up, cpu, NULL)) +- BUG(); +- } +- +- BUG_ON(!have_vcpu_info_placement); ++ if (other_cpu && ++ HYPERVISOR_vcpu_op(VCPUOP_up, cpu, NULL)) ++ BUG(); + } + } + + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:54 2009 +Message-Id: <20091217035654.138219109@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:24 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ian Campbell , + Jeremy Fitzhardinge +Subject: [087/151] xen: correctly restore pfn_to_mfn_list_list after resume + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ian Campbell + +commit fa24ba62ea2869308ffc9f0b286ac9650b4ca6cb upstream. + +pvops kernels >= 2.6.30 can currently only be saved and restored once. The +second attempt to save results in: + + ERROR Internal error: Frame# in pfn-to-mfn frame list is not in pseudophys + ERROR Internal error: entry 0: p2m_frame_list[0] is 0xf2c2c2c2, max 0x120000 + ERROR Internal error: Failed to map/save the p2m frame list + +I finally narrowed it down to: + + commit cdaead6b4e657f960d6d6f9f380e7dfeedc6a09b + Author: Jeremy Fitzhardinge + Date: Fri Feb 27 15:34:59 2009 -0800 + + xen: split construction of p2m mfn tables from registration + + Build the p2m_mfn_list_list early with the rest of the p2m table, but + register it later when the real shared_info structure is in place. + + Signed-off-by: Jeremy Fitzhardinge + +The unforeseen side-effect of this change was to cause the mfn list list to not +be rebuilt on resume. Prior to this change it would have been rebuilt via +xen_post_suspend() -> xen_setup_shared_info() -> xen_setup_mfn_list_list(). + +Fix by explicitly calling xen_build_mfn_list_list() from xen_post_suspend(). + +Signed-off-by: Ian Campbell +Signed-off-by: Jeremy Fitzhardinge +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/xen/mmu.c | 2 +- + arch/x86/xen/suspend.c | 2 ++ + arch/x86/xen/xen-ops.h | 1 + + 3 files changed, 4 insertions(+), 1 deletion(-) + +--- a/arch/x86/xen/mmu.c ++++ b/arch/x86/xen/mmu.c +@@ -185,7 +185,7 @@ static inline unsigned p2m_index(unsigne + } + + /* Build the parallel p2m_top_mfn structures */ +-static void __init xen_build_mfn_list_list(void) ++void xen_build_mfn_list_list(void) + { + unsigned pfn, idx; + +--- a/arch/x86/xen/suspend.c ++++ b/arch/x86/xen/suspend.c +@@ -27,6 +27,8 @@ void xen_pre_suspend(void) + + void xen_post_suspend(int suspend_cancelled) + { ++ xen_build_mfn_list_list(); ++ + xen_setup_shared_info(); + + if (suspend_cancelled) { +--- a/arch/x86/xen/xen-ops.h ++++ b/arch/x86/xen/xen-ops.h +@@ -25,6 +25,7 @@ extern struct shared_info *HYPERVISOR_sh + + void xen_setup_mfn_list_list(void); + void xen_setup_shared_info(void); ++void xen_build_mfn_list_list(void); + void xen_setup_machphys_mapping(void); + pgd_t *xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn); + void xen_ident_map_ISA(void); + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:54 2009 +Message-Id: <20091217035654.268686380@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:25 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ian Campbell , + Jeremy Fitzhardinge +Subject: [088/151] xen: register timer interrupt with IRQF_TIMER + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ian Campbell + +commit f350c7922faad3397c98c81a9e5658f5a1ef0214 upstream. + +Otherwise the timer is disabled by dpm_suspend_noirq() which in turn prevents +correct operation of stop_machine on multi-processor systems and breaks +suspend. + +Signed-off-by: Ian Campbell +Signed-off-by: Jeremy Fitzhardinge +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/xen/time.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/xen/time.c ++++ b/arch/x86/xen/time.c +@@ -434,7 +434,7 @@ void xen_setup_timer(int cpu) + name = ""; + + irq = bind_virq_to_irqhandler(VIRQ_TIMER, cpu, xen_timer_interrupt, +- IRQF_DISABLED|IRQF_PERCPU|IRQF_NOBALANCING, ++ IRQF_DISABLED|IRQF_PERCPU|IRQF_NOBALANCING|IRQF_TIMER, + name, NULL); + + evt = &per_cpu(xen_clock_events, cpu); + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:54 2009 +Message-Id: <20091217035654.398436035@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:26 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ian Campbell , + Jeremy Fitzhardinge +Subject: [089/151] xen: register runstate on secondary CPUs + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ian Campbell + +commit 028896721ac04f6fa0697f3ecac3f98761746363 upstream. + +The commit "xen: re-register runstate area earlier on resume" caused us +to never try and setup the runstate area for secondary CPUs. Ensure that +we do this... + +Signed-off-by: Ian Campbell +Signed-off-by: Jeremy Fitzhardinge +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/xen/smp.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/x86/xen/smp.c ++++ b/arch/x86/xen/smp.c +@@ -295,6 +295,7 @@ static int __cpuinit xen_cpu_up(unsigned + (unsigned long)task_stack_page(idle) - + KERNEL_STACK_OFFSET + THREAD_SIZE; + #endif ++ xen_setup_runstate_info(cpu); + xen_setup_timer(cpu); + xen_init_lock_cpu(cpu); + + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:54 2009 +Message-Id: <20091217035654.540949610@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:27 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jeremy Fitzhardinge +Subject: [090/151] xen: dont call dpm_resume_noirq() with interrupts disabled. + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jeremy Fitzhardinge + +commit 922cc38ab71d1360978e65207e4a4f4988987127 upstream. + +dpm_resume_noirq() takes a mutex, so it can't be called from a no-interrupt +context. Don't call it from within the stop-machine function, but just +afterwards, since we're resuming anyway, regardless of what happened. + +Signed-off-by: Jeremy Fitzhardinge +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/xen/manage.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/xen/manage.c ++++ b/drivers/xen/manage.c +@@ -43,7 +43,6 @@ static int xen_suspend(void *data) + if (err) { + printk(KERN_ERR "xen_suspend: sysdev_suspend failed: %d\n", + err); +- dpm_resume_noirq(PMSG_RESUME); + return err; + } + +@@ -69,7 +68,6 @@ static int xen_suspend(void *data) + } + + sysdev_resume(); +- dpm_resume_noirq(PMSG_RESUME); + + return 0; + } +@@ -108,6 +106,9 @@ static void do_suspend(void) + } + + err = stop_machine(xen_suspend, &cancelled, cpumask_of(0)); ++ ++ dpm_resume_noirq(PMSG_RESUME); ++ + if (err) { + printk(KERN_ERR "failed to start xen_suspend: %d\n", err); + goto out; +@@ -119,8 +120,6 @@ static void do_suspend(void) + } else + xs_suspend_cancel(); + +- dpm_resume_noirq(PMSG_RESUME); +- + resume_devices: + dpm_resume_end(PMSG_RESUME); + + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:54 2009 +Message-Id: <20091217035654.709032930@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:28 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jeremy Fitzhardinge +Subject: [091/151] xen: register runstate info for boot CPU early + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jeremy Fitzhardinge + +commit 499d19b82b586aef18727b9ae1437f8f37b66e91 upstream. + +printk timestamping uses sched_clock, which in turn relies on runstate +info under Xen. So make sure we set it up before any printks can +be called. + +Signed-off-by: Jeremy Fitzhardinge +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/xen/enlighten.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/x86/xen/enlighten.c ++++ b/arch/x86/xen/enlighten.c +@@ -1181,6 +1181,8 @@ asmlinkage void __init xen_start_kernel( + + xen_raw_console_write("about to get started...\n"); + ++ xen_setup_runstate_info(0); ++ + /* Start the world */ + #ifdef CONFIG_X86_32 + i386_start_kernel(); + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:55 2009 +Message-Id: <20091217035654.875765876@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:29 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ian Campbell , + Jeremy Fitzhardinge , + Thomas Gleixner +Subject: [092/151] xen: call clock resume notifier on all CPUs + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ian Campbell + +commit f6eafe3665bcc374c66775d58312d1c06c55303f upstream. + +tick_resume() is never called on secondary processors. Presumably this +is because they are offlined for suspend on native and so this is +normally taken care of in the CPU onlining path. Under Xen we keep all +CPUs online over a suspend. + +This patch papers over the issue for me but I will investigate a more +generic, less hacky, way of doing to the same. + +tick_suspend is also only called on the boot CPU which I presume should +be fixed too. + +Signed-off-by: Ian Campbell +Signed-off-by: Jeremy Fitzhardinge +Cc: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/xen/suspend.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +--- a/arch/x86/xen/suspend.c ++++ b/arch/x86/xen/suspend.c +@@ -1,4 +1,5 @@ + #include ++#include + + #include + #include +@@ -46,7 +47,19 @@ void xen_post_suspend(int suspend_cancel + + } + ++static void xen_vcpu_notify_restore(void *data) ++{ ++ unsigned long reason = (unsigned long)data; ++ ++ /* Boot processor notified via generic timekeeping_resume() */ ++ if ( smp_processor_id() == 0) ++ return; ++ ++ clockevents_notify(reason, NULL); ++} ++ + void xen_arch_resume(void) + { +- /* nothing */ ++ smp_call_function(xen_vcpu_notify_restore, ++ (void *)CLOCK_EVT_NOTIFY_RESUME, 1); + } + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:55 2009 +Message-Id: <20091217035655.039523877@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:30 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ian Campbell , + Jeremy Fitzhardinge +Subject: [093/151] xen: improve error handling in do_suspend. + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ian Campbell + +commit 65f63384b391bf4d384327d8a7c6de9860290b5c upstream. + +The existing error handling has a few issues: +- If freeze_processes() fails it exits with shutting_down = SHUTDOWN_SUSPEND. +- If dpm_suspend_noirq() fails it exits without resuming xenbus. +- If stop_machine() fails it exits without resuming xenbus or calling + dpm_resume_end(). +- xs_suspend()/xs_resume() and dpm_suspend_noirq()/dpm_resume_noirq() were not + nested in the obvious way. + +Fix by ensuring each failure case goto's the correct label. Treat a failure of +stop_machine() as a cancelled suspend in order to follow the correct resume +path. + +Signed-off-by: Ian Campbell +Signed-off-by: Jeremy Fitzhardinge +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/xen/manage.c | 20 +++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +--- a/drivers/xen/manage.c ++++ b/drivers/xen/manage.c +@@ -86,32 +86,32 @@ static void do_suspend(void) + err = freeze_processes(); + if (err) { + printk(KERN_ERR "xen suspend: freeze failed %d\n", err); +- return; ++ goto out; + } + #endif + + err = dpm_suspend_start(PMSG_SUSPEND); + if (err) { + printk(KERN_ERR "xen suspend: dpm_suspend_start %d\n", err); +- goto out; ++ goto out_thaw; + } + +- printk(KERN_DEBUG "suspending xenstore...\n"); +- xs_suspend(); +- + err = dpm_suspend_noirq(PMSG_SUSPEND); + if (err) { + printk(KERN_ERR "dpm_suspend_noirq failed: %d\n", err); +- goto resume_devices; ++ goto out_resume; + } + ++ printk(KERN_DEBUG "suspending xenstore...\n"); ++ xs_suspend(); ++ + err = stop_machine(xen_suspend, &cancelled, cpumask_of(0)); + + dpm_resume_noirq(PMSG_RESUME); + + if (err) { + printk(KERN_ERR "failed to start xen_suspend: %d\n", err); +- goto out; ++ cancelled = 1; + } + + if (!cancelled) { +@@ -120,15 +120,17 @@ static void do_suspend(void) + } else + xs_suspend_cancel(); + +-resume_devices: ++out_resume: + dpm_resume_end(PMSG_RESUME); + + /* Make sure timer events get retriggered on all CPUs */ + clock_was_set(); +-out: ++ ++out_thaw: + #ifdef CONFIG_PREEMPT + thaw_processes(); + #endif ++out: + shutting_down = SHUTDOWN_INVALID; + } + #endif /* CONFIG_PM_SLEEP */ + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:55 2009 +Message-Id: <20091217035655.194444555@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:31 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ian Campbell , + Jeremy Fitzhardinge +Subject: [094/151] xen: dont leak IRQs over suspend/resume. + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ian Campbell + +commit fed5ea87e02aaf902ff38c65b4514233db03dc09 upstream. + +On resume irq_info[*].evtchn is reset to 0 since event channel mappings +are not preserved over suspend/resume. The other contents of irq_info +is preserved to allow rebind_evtchn_irq() to function. + +However when a device resumes it will try to unbind from the +previous IRQ (e.g. blkfront goes blkfront_resume() -> blkif_free() -> +unbind_from_irqhandler() -> unbind_from_irq()). This will fail due to the +check for VALID_EVTCHN in unbind_from_irq() and the IRQ is leaked. The +device will then continue to resume and allocate a new IRQ, eventually +leading to find_unbound_irq() panic()ing. + +Fix this by changing unbind_from_irq() to handle teardown of interrupts +which have type!=IRQT_UNBOUND but are not currently bound to a specific +event channel. + +Signed-off-by: Ian Campbell +Signed-off-by: Jeremy Fitzhardinge +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/xen/events.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/xen/events.c ++++ b/drivers/xen/events.c +@@ -474,6 +474,9 @@ static void unbind_from_irq(unsigned int + bind_evtchn_to_cpu(evtchn, 0); + + evtchn_to_irq[evtchn] = -1; ++ } ++ ++ if (irq_info[irq].type != IRQT_UNBOUND) { + irq_info[irq] = mk_unbound_info(); + + dynamic_irq_cleanup(irq); + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:55 2009 +Message-Id: <20091217035655.322127547@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:32 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jeremy Fitzhardinge , + Jan Beulich +Subject: [095/151] xen: use iret for return from 64b kernel to 32b usermode + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jeremy Fitzhardinge + +commit 6aaf5d633bb6cead81b396d861d7bae4b9a0ba7e upstream. + +If Xen wants to return to a 32b usermode with sysret it must use the +right form. When using VCGF_in_syscall to trigger this, it looks at +the code segment and does a 32b sysret if it is FLAT_USER_CS32. +However, this is different from __USER32_CS, so it fails to return +properly if we use the normal Linux segment. + +So avoid the whole mess by dropping VCGF_in_syscall and simply use +plain iret to return to usermode. + +Signed-off-by: Jeremy Fitzhardinge +Acked-by: Jan Beulich +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/xen/xen-asm_64.S | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/x86/xen/xen-asm_64.S ++++ b/arch/x86/xen/xen-asm_64.S +@@ -96,7 +96,7 @@ ENTRY(xen_sysret32) + pushq $__USER32_CS + pushq %rcx + +- pushq $VGCF_in_syscall ++ pushq $0 + 1: jmp hypercall_iret + ENDPATCH(xen_sysret32) + RELOC(xen_sysret32, 1b+1) +@@ -151,7 +151,7 @@ ENTRY(xen_syscall32_target) + ENTRY(xen_sysenter_target) + lea 16(%rsp), %rsp /* strip %rcx, %r11 */ + mov $-ENOSYS, %rax +- pushq $VGCF_in_syscall ++ pushq $0 + jmp hypercall_iret + ENDPROC(xen_syscall32_target) + ENDPROC(xen_sysenter_target) + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:55 2009 +Message-Id: <20091217035655.451425681@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:33 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ian Campbell , + Jeremy Fitzhardinge +Subject: [096/151] xen: explicitly create/destroy stop_machine workqueues outside suspend/resume region. + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ian Campbell + +commit b4606f2165153833247823e8c04c5e88cb3d298b upstream. + +I have observed cases where the implicit stop_machine_destroy() done by +stop_machine() hangs while destroying the workqueues, specifically in +kthread_stop(). This seems to be because timer ticks are not restarted +until after stop_machine() returns. + +Fortunately stop_machine provides a facility to pre-create/post-destroy +the workqueues so use this to ensure that workqueues are only destroyed +after everything is really up and running again. + +I only actually observed this failure with 2.6.30. It seems that newer +kernels are somehow more robust against doing kthread_stop() without timer +interrupts (I tried some backports of some likely looking candidates but +did not track down the commit which added this robustness). However this +change seems like a reasonable belt&braces thing to do. + +Signed-off-by: Ian Campbell +Signed-off-by: Jeremy Fitzhardinge +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/xen/manage.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/xen/manage.c ++++ b/drivers/xen/manage.c +@@ -79,6 +79,12 @@ static void do_suspend(void) + + shutting_down = SHUTDOWN_SUSPEND; + ++ err = stop_machine_create(); ++ if (err) { ++ printk(KERN_ERR "xen suspend: failed to setup stop_machine %d\n", err); ++ goto out; ++ } ++ + #ifdef CONFIG_PREEMPT + /* If the kernel is preemptible, we need to freeze all the processes + to prevent them from being in the middle of a pagetable update +@@ -86,7 +92,7 @@ static void do_suspend(void) + err = freeze_processes(); + if (err) { + printk(KERN_ERR "xen suspend: freeze failed %d\n", err); +- goto out; ++ goto out_destroy_sm; + } + #endif + +@@ -129,7 +135,11 @@ out_resume: + out_thaw: + #ifdef CONFIG_PREEMPT + thaw_processes(); ++ ++out_destroy_sm: + #endif ++ stop_machine_destroy(); ++ + out: + shutting_down = SHUTDOWN_INVALID; + } + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:55 2009 +Message-Id: <20091217035655.580519111@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:34 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Gianluca Guida , + Jeremy Fitzhardinge +Subject: [097/151] Xen balloon: fix totalram_pages counting. + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Gianluca Guida + +commit 3d65c9488cadd2f11bd4d60c7266e639ece5d0d6 upstream. + +Change totalram_pages when a single page is added/removed to the +ballooned list. This avoid totalram_pages to be set erroneously to +max_pfn at boot. + +Signed-off-by: Gianluca Guida +Signed-off-by: Jeremy Fitzhardinge +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/xen/balloon.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/xen/balloon.c ++++ b/drivers/xen/balloon.c +@@ -136,6 +136,8 @@ static void balloon_append(struct page * + list_add(&page->lru, &ballooned_pages); + balloon_stats.balloon_low++; + } ++ ++ totalram_pages--; + } + + /* balloon_retrieve: rescue a page from the balloon, if it is not empty. */ +@@ -156,6 +158,8 @@ static struct page *balloon_retrieve(voi + else + balloon_stats.balloon_low--; + ++ totalram_pages++; ++ + return page; + } + +@@ -260,7 +264,6 @@ static int increase_reservation(unsigned + } + + balloon_stats.current_pages += nr_pages; +- totalram_pages = balloon_stats.current_pages; + + out: + spin_unlock_irqrestore(&balloon_lock, flags); +@@ -323,7 +326,6 @@ static int decrease_reservation(unsigned + BUG_ON(ret != nr_pages); + + balloon_stats.current_pages -= nr_pages; +- totalram_pages = balloon_stats.current_pages; + + spin_unlock_irqrestore(&balloon_lock, flags); + +@@ -422,7 +424,6 @@ static int __init balloon_init(void) + pr_info("xen_balloon: Initialising balloon driver.\n"); + + balloon_stats.current_pages = min(xen_start_info->nr_pages, max_pfn); +- totalram_pages = balloon_stats.current_pages; + balloon_stats.target_pages = balloon_stats.current_pages; + balloon_stats.balloon_low = 0; + balloon_stats.balloon_high = 0; + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:55 2009 +Message-Id: <20091217035655.709164511@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:35 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ian Campbell +Subject: [098/151] xen: try harder to balloon up under memory pressure. + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Ian Campbell + +commit bc2c0303226ec716854d3c208c7f84fe7aa35cd7 upstream. + +Currently if the balloon driver is unable to increase the guest's +reservation it assumes the failure was due to reaching its full +allocation, gives up on the ballooning operation and records the limit +it reached as the "hard limit". The driver will not try again until +the target is set again (even to the same value). + +However it is possible that ballooning has in fact failed due to +memory pressure in the host and therefore it is desirable to keep +attempting to reach the target in case memory becomes available. The +most likely scenario is that some guests are ballooning down while +others are ballooning up and therefore there is temporary memory +pressure while things stabilise. You would not expect a well behaved +toolstack to ask a domain to balloon to more than its allocation nor +would you expect it to deliberately over-commit memory by setting +balloon targets which exceed the total host memory. + +This patch drops the concept of a hard limit and causes the balloon +driver to retry increasing the reservation on a timer in the same +manner as when decreasing the reservation. + +Also if we partially succeed in increasing the reservation +(i.e. receive less pages than we asked for) then we may as well keep +those pages rather than returning them to Xen. + +Signed-off-by: Ian Campbell +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/xen/balloon.c | 31 +++++-------------------------- + 1 file changed, 5 insertions(+), 26 deletions(-) + +--- a/drivers/xen/balloon.c ++++ b/drivers/xen/balloon.c +@@ -66,8 +66,6 @@ struct balloon_stats { + /* We aim for 'current allocation' == 'target allocation'. */ + unsigned long current_pages; + unsigned long target_pages; +- /* We may hit the hard limit in Xen. If we do then we remember it. */ +- unsigned long hard_limit; + /* + * Drivers may alter the memory reservation independently, but they + * must inform the balloon driver so we avoid hitting the hard limit. +@@ -185,7 +183,7 @@ static void balloon_alarm(unsigned long + + static unsigned long current_target(void) + { +- unsigned long target = min(balloon_stats.target_pages, balloon_stats.hard_limit); ++ unsigned long target = balloon_stats.target_pages; + + target = min(target, + balloon_stats.current_pages + +@@ -221,23 +219,10 @@ static int increase_reservation(unsigned + set_xen_guest_handle(reservation.extent_start, frame_list); + reservation.nr_extents = nr_pages; + rc = HYPERVISOR_memory_op(XENMEM_populate_physmap, &reservation); +- if (rc < nr_pages) { +- if (rc > 0) { +- int ret; +- +- /* We hit the Xen hard limit: reprobe. */ +- reservation.nr_extents = rc; +- ret = HYPERVISOR_memory_op(XENMEM_decrease_reservation, +- &reservation); +- BUG_ON(ret != rc); +- } +- if (rc >= 0) +- balloon_stats.hard_limit = (balloon_stats.current_pages + rc - +- balloon_stats.driver_pages); ++ if (rc < 0) + goto out; +- } + +- for (i = 0; i < nr_pages; i++) { ++ for (i = 0; i < rc; i++) { + page = balloon_retrieve(); + BUG_ON(page == NULL); + +@@ -263,12 +248,12 @@ static int increase_reservation(unsigned + __free_page(page); + } + +- balloon_stats.current_pages += nr_pages; ++ balloon_stats.current_pages += rc; + + out: + spin_unlock_irqrestore(&balloon_lock, flags); + +- return 0; ++ return rc < 0 ? rc : rc != nr_pages; + } + + static int decrease_reservation(unsigned long nr_pages) +@@ -369,7 +354,6 @@ static void balloon_process(struct work_ + static void balloon_set_new_target(unsigned long target) + { + /* No need for lock. Not read-modify-write updates. */ +- balloon_stats.hard_limit = ~0UL; + balloon_stats.target_pages = target; + schedule_work(&balloon_worker); + } +@@ -428,7 +412,6 @@ static int __init balloon_init(void) + balloon_stats.balloon_low = 0; + balloon_stats.balloon_high = 0; + balloon_stats.driver_pages = 0UL; +- balloon_stats.hard_limit = ~0UL; + + init_timer(&balloon_timer); + balloon_timer.data = 0; +@@ -473,9 +456,6 @@ module_exit(balloon_exit); + BALLOON_SHOW(current_kb, "%lu\n", PAGES2KB(balloon_stats.current_pages)); + BALLOON_SHOW(low_kb, "%lu\n", PAGES2KB(balloon_stats.balloon_low)); + BALLOON_SHOW(high_kb, "%lu\n", PAGES2KB(balloon_stats.balloon_high)); +-BALLOON_SHOW(hard_limit_kb, +- (balloon_stats.hard_limit!=~0UL) ? "%lu\n" : "???\n", +- (balloon_stats.hard_limit!=~0UL) ? PAGES2KB(balloon_stats.hard_limit) : 0); + BALLOON_SHOW(driver_kb, "%lu\n", PAGES2KB(balloon_stats.driver_pages)); + + static ssize_t show_target_kb(struct sys_device *dev, struct sysdev_attribute *attr, +@@ -545,7 +525,6 @@ static struct attribute *balloon_info_at + &attr_current_kb.attr, + &attr_low_kb.attr, + &attr_high_kb.attr, +- &attr_hard_limit_kb.attr, + &attr_driver_kb.attr, + NULL + }; + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:55 2009 +Message-Id: <20091217035655.840261049@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:36 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Julia Lawall , + Alasdair G Kergon +Subject: [099/151] dm exception store: free tmp_store on persistent flag error + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Julia Lawall + +commit 613978f8711c7fd4d0aa856872375d2abd7c92ff upstream. + +Error handling code following a kmalloc should free the allocated data. + +Signed-off-by: Julia Lawall +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-exception-store.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/md/dm-exception-store.c ++++ b/drivers/md/dm-exception-store.c +@@ -216,7 +216,8 @@ int dm_exception_store_create(struct dm_ + type = get_type("N"); + else { + ti->error = "Persistent flag is not P or N"; +- return -EINVAL; ++ r = -EINVAL; ++ goto bad_type; + } + + if (!type) { + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:56 2009 +Message-Id: <20091217035655.965379342@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:37 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mikulas Patocka , + Alasdair G Kergon +Subject: [100/151] dm snapshot: only take lock for statustype info not table + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mikulas Patocka + +commit 94e76572b5dd37b1f0f4b3742ee8a565daead932 upstream. + +Take snapshot lock only for STATUSTYPE_INFO, not STATUSTYPE_TABLE. + +Commit 4c6fff445d7aa753957856278d4d93bcad6e2c14 +(dm-snapshot-lock-snapshot-while-supplying-status.patch) +introduced this use of the lock, but userspace applications using +libdevmapper have been found to request STATUSTYPE_TABLE while the device +is suspended and the lock is already held, leading to deadlock. Since +the lock is not necessary in this case, don't try to take it. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-snap.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -1152,10 +1152,11 @@ static int snapshot_status(struct dm_tar + unsigned sz = 0; + struct dm_snapshot *snap = ti->private; + +- down_write(&snap->lock); +- + switch (type) { + case STATUSTYPE_INFO: ++ ++ down_write(&snap->lock); ++ + if (!snap->valid) + DMEMIT("Invalid"); + else { +@@ -1171,6 +1172,9 @@ static int snapshot_status(struct dm_tar + else + DMEMIT("Unknown"); + } ++ ++ up_write(&snap->lock); ++ + break; + + case STATUSTYPE_TABLE: +@@ -1185,8 +1189,6 @@ static int snapshot_status(struct dm_tar + break; + } + +- up_write(&snap->lock); +- + return 0; + } + + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:56 2009 +Message-Id: <20091217035656.104519949@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:38 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Milan Broz , + Alasdair G Kergon +Subject: [101/151] dm crypt: move private iv fields to structs + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Milan Broz + +commit 6047359277517c4e56d8bfd6ea4966d7a3924151 upstream. + +Define private structures for IV so it's easy to add further attributes +in a following patch which fixes the way key material is wiped from +memory. Also move ESSIV destructor and remove unnecessary 'status' +operation. + +There are no functional changes in this patch. + +Signed-off-by: Milan Broz +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-crypt.c | 35 ++++++++++++++++++++++------------- + 1 file changed, 22 insertions(+), 13 deletions(-) + +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -71,10 +71,17 @@ struct crypt_iv_operations { + int (*ctr)(struct crypt_config *cc, struct dm_target *ti, + const char *opts); + void (*dtr)(struct crypt_config *cc); +- const char *(*status)(struct crypt_config *cc); + int (*generator)(struct crypt_config *cc, u8 *iv, sector_t sector); + }; + ++struct iv_essiv_private { ++ struct crypto_cipher *tfm; ++}; ++ ++struct iv_benbi_private { ++ int shift; ++}; ++ + /* + * Crypt: maps a linear range of a block device + * and encrypts / decrypts at the same time. +@@ -102,8 +109,8 @@ struct crypt_config { + struct crypt_iv_operations *iv_gen_ops; + char *iv_mode; + union { +- struct crypto_cipher *essiv_tfm; +- int benbi_shift; ++ struct iv_essiv_private essiv; ++ struct iv_benbi_private benbi; + } iv_gen_private; + sector_t iv_offset; + unsigned int iv_size; +@@ -169,6 +176,14 @@ static int crypt_iv_plain_gen(struct cry + return 0; + } + ++static void crypt_iv_essiv_dtr(struct crypt_config *cc) ++{ ++ struct iv_essiv_private *essiv = &cc->iv_gen_private.essiv; ++ ++ crypto_free_cipher(essiv->tfm); ++ essiv->tfm = NULL; ++} ++ + static int crypt_iv_essiv_ctr(struct crypt_config *cc, struct dm_target *ti, + const char *opts) + { +@@ -236,21 +251,15 @@ static int crypt_iv_essiv_ctr(struct cry + } + kfree(salt); + +- cc->iv_gen_private.essiv_tfm = essiv_tfm; ++ cc->iv_gen_private.essiv.tfm = essiv_tfm; + return 0; + } + +-static void crypt_iv_essiv_dtr(struct crypt_config *cc) +-{ +- crypto_free_cipher(cc->iv_gen_private.essiv_tfm); +- cc->iv_gen_private.essiv_tfm = NULL; +-} +- + static int crypt_iv_essiv_gen(struct crypt_config *cc, u8 *iv, sector_t sector) + { + memset(iv, 0, cc->iv_size); + *(u64 *)iv = cpu_to_le64(sector); +- crypto_cipher_encrypt_one(cc->iv_gen_private.essiv_tfm, iv, iv); ++ crypto_cipher_encrypt_one(cc->iv_gen_private.essiv.tfm, iv, iv); + return 0; + } + +@@ -273,7 +282,7 @@ static int crypt_iv_benbi_ctr(struct cry + return -EINVAL; + } + +- cc->iv_gen_private.benbi_shift = 9 - log; ++ cc->iv_gen_private.benbi.shift = 9 - log; + + return 0; + } +@@ -288,7 +297,7 @@ static int crypt_iv_benbi_gen(struct cry + + memset(iv, 0, cc->iv_size - sizeof(u64)); /* rest is cleared below */ + +- val = cpu_to_be64(((u64)sector << cc->iv_gen_private.benbi_shift) + 1); ++ val = cpu_to_be64(((u64)sector << cc->iv_gen_private.benbi.shift) + 1); + put_unaligned(val, (__be64 *)(iv + cc->iv_size - sizeof(u64))); + + return 0; + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:56 2009 +Message-Id: <20091217035656.222799487@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:39 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Milan Broz , + Alasdair G Kergon +Subject: [102/151] dm crypt: restructure essiv error path + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Milan Broz + +commit 5861f1be00b3b70f8ab5e5a81392a6cf69666cd2 upstream. + +Use kzfree for salt deallocation because it is derived from the volume +key. Use a common error path in ESSIV constructor. + +Required by a later patch which fixes the way key material is wiped +from memory. + +Signed-off-by: Milan Broz +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-crypt.c | 46 ++++++++++++++++++++++++++-------------------- + 1 file changed, 26 insertions(+), 20 deletions(-) + +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -187,15 +187,15 @@ static void crypt_iv_essiv_dtr(struct cr + static int crypt_iv_essiv_ctr(struct crypt_config *cc, struct dm_target *ti, + const char *opts) + { +- struct crypto_cipher *essiv_tfm; +- struct crypto_hash *hash_tfm; ++ struct crypto_cipher *essiv_tfm = NULL; ++ struct crypto_hash *hash_tfm = NULL; + struct hash_desc desc; + struct scatterlist sg; + unsigned int saltsize; +- u8 *salt; ++ u8 *salt = NULL; + int err; + +- if (opts == NULL) { ++ if (!opts) { + ti->error = "Digest algorithm missing for ESSIV mode"; + return -EINVAL; + } +@@ -204,15 +204,16 @@ static int crypt_iv_essiv_ctr(struct cry + hash_tfm = crypto_alloc_hash(opts, 0, CRYPTO_ALG_ASYNC); + if (IS_ERR(hash_tfm)) { + ti->error = "Error initializing ESSIV hash"; +- return PTR_ERR(hash_tfm); ++ err = PTR_ERR(hash_tfm); ++ goto bad; + } + + saltsize = crypto_hash_digestsize(hash_tfm); +- salt = kmalloc(saltsize, GFP_KERNEL); +- if (salt == NULL) { ++ salt = kzalloc(saltsize, GFP_KERNEL); ++ if (!salt) { + ti->error = "Error kmallocing salt storage in ESSIV"; +- crypto_free_hash(hash_tfm); +- return -ENOMEM; ++ err = -ENOMEM; ++ goto bad; + } + + sg_init_one(&sg, cc->key, cc->key_size); +@@ -220,39 +221,44 @@ static int crypt_iv_essiv_ctr(struct cry + desc.flags = CRYPTO_TFM_REQ_MAY_SLEEP; + err = crypto_hash_digest(&desc, &sg, cc->key_size, salt); + crypto_free_hash(hash_tfm); ++ hash_tfm = NULL; + + if (err) { + ti->error = "Error calculating hash in ESSIV"; +- kfree(salt); +- return err; ++ goto bad; + } + + /* Setup the essiv_tfm with the given salt */ + essiv_tfm = crypto_alloc_cipher(cc->cipher, 0, CRYPTO_ALG_ASYNC); + if (IS_ERR(essiv_tfm)) { + ti->error = "Error allocating crypto tfm for ESSIV"; +- kfree(salt); +- return PTR_ERR(essiv_tfm); ++ err = PTR_ERR(essiv_tfm); ++ goto bad; + } + if (crypto_cipher_blocksize(essiv_tfm) != + crypto_ablkcipher_ivsize(cc->tfm)) { + ti->error = "Block size of ESSIV cipher does " + "not match IV size of block cipher"; +- crypto_free_cipher(essiv_tfm); +- kfree(salt); +- return -EINVAL; ++ err = -EINVAL; ++ goto bad; + } + err = crypto_cipher_setkey(essiv_tfm, salt, saltsize); + if (err) { + ti->error = "Failed to set key for ESSIV cipher"; +- crypto_free_cipher(essiv_tfm); +- kfree(salt); +- return err; ++ goto bad; + } +- kfree(salt); ++ kzfree(salt); + + cc->iv_gen_private.essiv.tfm = essiv_tfm; + return 0; ++ ++bad: ++ if (essiv_tfm && !IS_ERR(essiv_tfm)) ++ crypto_free_cipher(essiv_tfm); ++ if (hash_tfm && !IS_ERR(hash_tfm)) ++ crypto_free_hash(hash_tfm); ++ kzfree(salt); ++ return err; + } + + static int crypt_iv_essiv_gen(struct crypt_config *cc, u8 *iv, sector_t sector) + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:56 2009 +Message-Id: <20091217035656.350302499@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:40 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mikulas Patocka , + Alasdair G Kergon +Subject: [103/151] dm: avoid _hash_lock deadlock + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mikulas Patocka + +commit 6076905b5ef39e0ea58db32583c9e0036c05e47b upstream. + +Fix a reported deadlock if there are still unprocessed multipath events +on a device that is being removed. + +_hash_lock is held during dev_remove while trying to send the +outstanding events. Sending the events requests the _hash_lock +again in dm_copy_name_and_uuid. + +This patch introduces a separate lock around regions that modify the +link to the hash table (dm_set_mdptr) or the name or uuid so that +dm_copy_name_and_uuid no longer needs _hash_lock. + +Additionally, dm_copy_name_and_uuid can only be called if md exists +so we can drop the dm_get() and dm_put() which can lead to a BUG() +while md is being freed. + +The deadlock: + #0 [ffff8106298dfb48] schedule at ffffffff80063035 + #1 [ffff8106298dfc20] __down_read at ffffffff8006475d + #2 [ffff8106298dfc60] dm_copy_name_and_uuid at ffffffff8824f740 + #3 [ffff8106298dfc90] dm_send_uevents at ffffffff88252685 + #4 [ffff8106298dfcd0] event_callback at ffffffff8824c678 + #5 [ffff8106298dfd00] dm_table_event at ffffffff8824dd01 + #6 [ffff8106298dfd10] __hash_remove at ffffffff882507ad + #7 [ffff8106298dfd30] dev_remove at ffffffff88250865 + #8 [ffff8106298dfd60] ctl_ioctl at ffffffff88250d80 + #9 [ffff8106298dfee0] do_ioctl at ffffffff800418c4 +#10 [ffff8106298dff00] vfs_ioctl at ffffffff8002fab9 +#11 [ffff8106298dff40] sys_ioctl at ffffffff8004bdaf +#12 [ffff8106298dff80] tracesys at ffffffff8005d28d (via system_call) + +Reported-by: guy keren +Signed-off-by: Mikulas Patocka +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-ioctl.c | 17 +++++++++++++---- + drivers/md/dm-uevent.c | 9 ++++----- + 2 files changed, 17 insertions(+), 9 deletions(-) + +--- a/drivers/md/dm-ioctl.c ++++ b/drivers/md/dm-ioctl.c +@@ -56,6 +56,11 @@ static void dm_hash_remove_all(int keep_ + */ + static DECLARE_RWSEM(_hash_lock); + ++/* ++ * Protects use of mdptr to obtain hash cell name and uuid from mapped device. ++ */ ++static DEFINE_MUTEX(dm_hash_cells_mutex); ++ + static void init_buckets(struct list_head *buckets) + { + unsigned int i; +@@ -206,7 +211,9 @@ static int dm_hash_insert(const char *na + list_add(&cell->uuid_list, _uuid_buckets + hash_str(uuid)); + } + dm_get(md); ++ mutex_lock(&dm_hash_cells_mutex); + dm_set_mdptr(md, cell); ++ mutex_unlock(&dm_hash_cells_mutex); + up_write(&_hash_lock); + + return 0; +@@ -224,7 +231,9 @@ static void __hash_remove(struct hash_ce + /* remove from the dev hash */ + list_del(&hc->uuid_list); + list_del(&hc->name_list); ++ mutex_lock(&dm_hash_cells_mutex); + dm_set_mdptr(hc->md, NULL); ++ mutex_unlock(&dm_hash_cells_mutex); + + table = dm_get_table(hc->md); + if (table) { +@@ -321,7 +330,9 @@ static int dm_hash_rename(uint32_t cooki + */ + list_del(&hc->name_list); + old_name = hc->name; ++ mutex_lock(&dm_hash_cells_mutex); + hc->name = new_name; ++ mutex_unlock(&dm_hash_cells_mutex); + list_add(&hc->name_list, _name_buckets + hash_str(new_name)); + + /* +@@ -1582,8 +1593,7 @@ int dm_copy_name_and_uuid(struct mapped_ + if (!md) + return -ENXIO; + +- dm_get(md); +- down_read(&_hash_lock); ++ mutex_lock(&dm_hash_cells_mutex); + hc = dm_get_mdptr(md); + if (!hc || hc->md != md) { + r = -ENXIO; +@@ -1596,8 +1606,7 @@ int dm_copy_name_and_uuid(struct mapped_ + strcpy(uuid, hc->uuid ? : ""); + + out: +- up_read(&_hash_lock); +- dm_put(md); ++ mutex_unlock(&dm_hash_cells_mutex); + + return r; + } +--- a/drivers/md/dm-uevent.c ++++ b/drivers/md/dm-uevent.c +@@ -139,14 +139,13 @@ void dm_send_uevents(struct list_head *e + list_del_init(&event->elist); + + /* +- * Need to call dm_copy_name_and_uuid from here for now. +- * Context of previous var adds and locking used for +- * hash_cell not compatable. ++ * When a device is being removed this copy fails and we ++ * discard these unsent events. + */ + if (dm_copy_name_and_uuid(event->md, event->name, + event->uuid)) { +- DMERR("%s: dm_copy_name_and_uuid() failed", +- __func__); ++ DMINFO("%s: skipping sending uevent for lost device", ++ __func__); + goto uevent_free; + } + + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:56 2009 +Message-Id: <20091217035656.480820893@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:41 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mikulas Patocka , + Alasdair G Kergon +Subject: [104/151] dm snapshot: cope with chunk size larger than origin + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Mikulas Patocka + +commit 8e87b9b81b3c370f7e53c1ab6e1c3519ef37a644 upstream. + +Under some special conditions the snapshot hash_size is calculated as zero. +This patch instead sets a minimum value of 64, the same as for the +pending exception table. + +rounddown_pow_of_two(0) is an undefined operation (it expands to shift +by -1). init_exception_table with an argument of 0 would fail with -ENOMEM. + +The way to trigger the problem is to create a snapshot with a chunk size +that is larger than the origin device. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-snap.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -553,6 +553,8 @@ static int init_hash_tables(struct dm_sn + hash_size = min(origin_dev_size, cow_dev_size) >> s->store->chunk_shift; + hash_size = min(hash_size, max_buckets); + ++ if (hash_size < 64) ++ hash_size = 64; + hash_size = rounddown_pow_of_two(hash_size); + if (init_exception_table(&s->complete, hash_size, + DM_CHUNK_CONSECUTIVE_BITS)) + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:56 2009 +Message-Id: <20091217035656.608211741@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:42 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Milan Broz , + Alasdair G Kergon +Subject: [105/151] dm crypt: separate essiv allocation from initialisation + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Milan Broz + +commit b95bf2d3d5a48b095bffe2a0cd8c40453cf59557 upstream. + +This patch separates the construction of IV from its initialisation. +(For ESSIV it is a hash calculation based on volume key.) + +Constructor code now preallocates hash tfm and salt array +and saves it in a private IV structure. + +The next patch requires this to reinitialise the wiped IV +without reallocating memory when resuming a suspended device. + +Signed-off-by: Milan Broz +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-crypt.c | 69 +++++++++++++++++++++++++++++++------------------- + 1 file changed, 43 insertions(+), 26 deletions(-) + +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -71,11 +71,14 @@ struct crypt_iv_operations { + int (*ctr)(struct crypt_config *cc, struct dm_target *ti, + const char *opts); + void (*dtr)(struct crypt_config *cc); ++ int (*init)(struct crypt_config *cc); + int (*generator)(struct crypt_config *cc, u8 *iv, sector_t sector); + }; + + struct iv_essiv_private { + struct crypto_cipher *tfm; ++ struct crypto_hash *hash_tfm; ++ u8 *salt; + }; + + struct iv_benbi_private { +@@ -176,12 +179,38 @@ static int crypt_iv_plain_gen(struct cry + return 0; + } + ++/* Initialise ESSIV - compute salt but no local memory allocations */ ++static int crypt_iv_essiv_init(struct crypt_config *cc) ++{ ++ struct iv_essiv_private *essiv = &cc->iv_gen_private.essiv; ++ struct hash_desc desc; ++ struct scatterlist sg; ++ int err; ++ ++ sg_init_one(&sg, cc->key, cc->key_size); ++ desc.tfm = essiv->hash_tfm; ++ desc.flags = CRYPTO_TFM_REQ_MAY_SLEEP; ++ ++ err = crypto_hash_digest(&desc, &sg, cc->key_size, essiv->salt); ++ if (err) ++ return err; ++ ++ return crypto_cipher_setkey(essiv->tfm, essiv->salt, ++ crypto_hash_digestsize(essiv->hash_tfm)); ++} ++ + static void crypt_iv_essiv_dtr(struct crypt_config *cc) + { + struct iv_essiv_private *essiv = &cc->iv_gen_private.essiv; + + crypto_free_cipher(essiv->tfm); + essiv->tfm = NULL; ++ ++ crypto_free_hash(essiv->hash_tfm); ++ essiv->hash_tfm = NULL; ++ ++ kzfree(essiv->salt); ++ essiv->salt = NULL; + } + + static int crypt_iv_essiv_ctr(struct crypt_config *cc, struct dm_target *ti, +@@ -189,9 +218,6 @@ static int crypt_iv_essiv_ctr(struct cry + { + struct crypto_cipher *essiv_tfm = NULL; + struct crypto_hash *hash_tfm = NULL; +- struct hash_desc desc; +- struct scatterlist sg; +- unsigned int saltsize; + u8 *salt = NULL; + int err; + +@@ -200,7 +226,7 @@ static int crypt_iv_essiv_ctr(struct cry + return -EINVAL; + } + +- /* Hash the cipher key with the given hash algorithm */ ++ /* Allocate hash algorithm */ + hash_tfm = crypto_alloc_hash(opts, 0, CRYPTO_ALG_ASYNC); + if (IS_ERR(hash_tfm)) { + ti->error = "Error initializing ESSIV hash"; +@@ -208,27 +234,14 @@ static int crypt_iv_essiv_ctr(struct cry + goto bad; + } + +- saltsize = crypto_hash_digestsize(hash_tfm); +- salt = kzalloc(saltsize, GFP_KERNEL); ++ salt = kzalloc(crypto_hash_digestsize(hash_tfm), GFP_KERNEL); + if (!salt) { + ti->error = "Error kmallocing salt storage in ESSIV"; + err = -ENOMEM; + goto bad; + } + +- sg_init_one(&sg, cc->key, cc->key_size); +- desc.tfm = hash_tfm; +- desc.flags = CRYPTO_TFM_REQ_MAY_SLEEP; +- err = crypto_hash_digest(&desc, &sg, cc->key_size, salt); +- crypto_free_hash(hash_tfm); +- hash_tfm = NULL; +- +- if (err) { +- ti->error = "Error calculating hash in ESSIV"; +- goto bad; +- } +- +- /* Setup the essiv_tfm with the given salt */ ++ /* Allocate essiv_tfm */ + essiv_tfm = crypto_alloc_cipher(cc->cipher, 0, CRYPTO_ALG_ASYNC); + if (IS_ERR(essiv_tfm)) { + ti->error = "Error allocating crypto tfm for ESSIV"; +@@ -242,14 +255,11 @@ static int crypt_iv_essiv_ctr(struct cry + err = -EINVAL; + goto bad; + } +- err = crypto_cipher_setkey(essiv_tfm, salt, saltsize); +- if (err) { +- ti->error = "Failed to set key for ESSIV cipher"; +- goto bad; +- } +- kzfree(salt); + ++ cc->iv_gen_private.essiv.salt = salt; + cc->iv_gen_private.essiv.tfm = essiv_tfm; ++ cc->iv_gen_private.essiv.hash_tfm = hash_tfm; ++ + return 0; + + bad: +@@ -257,7 +267,7 @@ bad: + crypto_free_cipher(essiv_tfm); + if (hash_tfm && !IS_ERR(hash_tfm)) + crypto_free_hash(hash_tfm); +- kzfree(salt); ++ kfree(salt); + return err; + } + +@@ -323,6 +333,7 @@ static struct crypt_iv_operations crypt_ + static struct crypt_iv_operations crypt_iv_essiv_ops = { + .ctr = crypt_iv_essiv_ctr, + .dtr = crypt_iv_essiv_dtr, ++ .init = crypt_iv_essiv_init, + .generator = crypt_iv_essiv_gen + }; + +@@ -1054,6 +1065,12 @@ static int crypt_ctr(struct dm_target *t + cc->iv_gen_ops->ctr(cc, ti, ivopts) < 0) + goto bad_ivmode; + ++ if (cc->iv_gen_ops && cc->iv_gen_ops->init && ++ cc->iv_gen_ops->init(cc) < 0) { ++ ti->error = "Error initialising IV"; ++ goto bad_slab_pool; ++ } ++ + cc->iv_size = crypto_ablkcipher_ivsize(tfm); + if (cc->iv_size) + /* at least a 64 bit sector number should fit in our buffer */ + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:56 2009 +Message-Id: <20091217035656.740124090@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:43 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Milan Broz , + Alasdair G Kergon +Subject: [106/151] dm crypt: make wipe message also wipe essiv key + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Milan Broz + +commit 542da317668c35036e8471822a564b609d05af66 upstream. + +The "wipe key" message is used to wipe the volume key from memory +temporarily, for example when suspending to RAM. + +But the initialisation vector in ESSIV mode is calculated from the +hashed volume key, so the wipe message should wipe this IV key too and +reinitialise it when the volume key is reinstated. + +This patch adds an IV wipe method called from a wipe message callback. +ESSIV is then reinitialised using the init function added by the +last patch. + +Signed-off-by: Milan Broz +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-crypt.c | 34 ++++++++++++++++++++++++++++++---- + 1 file changed, 30 insertions(+), 4 deletions(-) + +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -1,7 +1,7 @@ + /* + * Copyright (C) 2003 Christophe Saout + * Copyright (C) 2004 Clemens Fruhwirth +- * Copyright (C) 2006-2008 Red Hat, Inc. All rights reserved. ++ * Copyright (C) 2006-2009 Red Hat, Inc. All rights reserved. + * + * This file is released under the GPL. + */ +@@ -72,6 +72,7 @@ struct crypt_iv_operations { + const char *opts); + void (*dtr)(struct crypt_config *cc); + int (*init)(struct crypt_config *cc); ++ int (*wipe)(struct crypt_config *cc); + int (*generator)(struct crypt_config *cc, u8 *iv, sector_t sector); + }; + +@@ -199,6 +200,17 @@ static int crypt_iv_essiv_init(struct cr + crypto_hash_digestsize(essiv->hash_tfm)); + } + ++/* Wipe salt and reset key derived from volume key */ ++static int crypt_iv_essiv_wipe(struct crypt_config *cc) ++{ ++ struct iv_essiv_private *essiv = &cc->iv_gen_private.essiv; ++ unsigned salt_size = crypto_hash_digestsize(essiv->hash_tfm); ++ ++ memset(essiv->salt, 0, salt_size); ++ ++ return crypto_cipher_setkey(essiv->tfm, essiv->salt, salt_size); ++} ++ + static void crypt_iv_essiv_dtr(struct crypt_config *cc) + { + struct iv_essiv_private *essiv = &cc->iv_gen_private.essiv; +@@ -334,6 +346,7 @@ static struct crypt_iv_operations crypt_ + .ctr = crypt_iv_essiv_ctr, + .dtr = crypt_iv_essiv_dtr, + .init = crypt_iv_essiv_init, ++ .wipe = crypt_iv_essiv_wipe, + .generator = crypt_iv_essiv_gen + }; + +@@ -1310,6 +1323,7 @@ static void crypt_resume(struct dm_targe + static int crypt_message(struct dm_target *ti, unsigned argc, char **argv) + { + struct crypt_config *cc = ti->private; ++ int ret = -EINVAL; + + if (argc < 2) + goto error; +@@ -1319,10 +1333,22 @@ static int crypt_message(struct dm_targe + DMWARN("not suspended during key manipulation."); + return -EINVAL; + } +- if (argc == 3 && !strnicmp(argv[1], MESG_STR("set"))) +- return crypt_set_key(cc, argv[2]); +- if (argc == 2 && !strnicmp(argv[1], MESG_STR("wipe"))) ++ if (argc == 3 && !strnicmp(argv[1], MESG_STR("set"))) { ++ ret = crypt_set_key(cc, argv[2]); ++ if (ret) ++ return ret; ++ if (cc->iv_gen_ops && cc->iv_gen_ops->init) ++ ret = cc->iv_gen_ops->init(cc); ++ return ret; ++ } ++ if (argc == 2 && !strnicmp(argv[1], MESG_STR("wipe"))) { ++ if (cc->iv_gen_ops && cc->iv_gen_ops->wipe) { ++ ret = cc->iv_gen_ops->wipe(cc); ++ if (ret) ++ return ret; ++ } + return crypt_wipe_key(cc); ++ } + } + + error: + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:56 2009 +Message-Id: <20091217035656.868210204@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:44 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Bartlomiej Zolnierkiewicz , + Sergei Shtylyov , + "David S. Miller" +Subject: [107/151] slc90e66: fix UDMA handling + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Bartlomiej Zolnierkiewicz + +[ Upstream commit ee31527a02b0a8e1aa4a5e4084d2db5fa34737ed ] + +Fix checking of the currently programmed UDMA mode. + +Signed-off-by: Bartlomiej Zolnierkiewicz +Acked-by: Sergei Shtylyov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ide/slc90e66.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/ide/slc90e66.c ++++ b/drivers/ide/slc90e66.c +@@ -91,8 +91,7 @@ static void slc90e66_set_dma_mode(ide_dr + + if (!(reg48 & u_flag)) + pci_write_config_word(dev, 0x48, reg48|u_flag); +- /* FIXME: (reg4a & a_speed) ? */ +- if ((reg4a & u_speed) != u_speed) { ++ if ((reg4a & a_speed) != u_speed) { + pci_write_config_word(dev, 0x4a, reg4a & ~a_speed); + pci_read_config_word(dev, 0x4a, ®4a); + pci_write_config_word(dev, 0x4a, reg4a|u_speed); + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:57 2009 +Message-Id: <20091217035656.995669356@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:45 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Damian Lukowski , + =?ISO-8859-15?q?Ilpo=20J=C3=A4rvinen?= , + "David S. Miller" +Subject: [108/151] tcp: Stalling connections: Fix timeout calculation routine + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Damian Lukowski + +[ Upstream commit 07f29bc5bbae4e53e982ab956fed7207990a7786 ] + +This patch fixes a problem in the TCP connection timeout calculation. +Currently, timeout decisions are made on the basis of the current +tcp_time_stamp and retrans_stamp, which is usually set at the first +retransmission. +However, if the retransmission fails in tcp_retransmit_skb(), +retrans_stamp is not updated and remains zero. This leads to wrong +decisions in retransmits_timed_out() if tcp_time_stamp is larger than +the specified timeout, which is very likely. +In this case, the TCP connection dies after the first attempted +(and unsuccessful) retransmission. + +With this patch, tcp_skb_cb->when is used instead, when retrans_stamp +is not available. + +This bug has been introduced together with retransmits_timed_out() in +2.6.32, as the number of retransmissions has been used for timeout +decisions before. The corresponding commit was +6fa12c85031485dff38ce550c24f10da23b0adaa (Revert Backoff [v3]: +Calculate TCP's connection close threshold as a time value.). + +Thanks to Ilpo Järvinen for code suggestions and Frederic Leroy for +testing. + +Reported-by: Frederic Leroy +Signed-off-by: Damian Lukowski +Acked-by: Ilpo Järvinen +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + include/net/tcp.h | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -1263,14 +1263,20 @@ static inline struct sk_buff *tcp_write_ + * TCP connection after "boundary" unsucessful, exponentially backed-off + * retransmissions with an initial RTO of TCP_RTO_MIN. + */ +-static inline bool retransmits_timed_out(const struct sock *sk, ++static inline bool retransmits_timed_out(struct sock *sk, + unsigned int boundary) + { + unsigned int timeout, linear_backoff_thresh; ++ unsigned int start_ts; + + if (!inet_csk(sk)->icsk_retransmits) + return false; + ++ if (unlikely(!tcp_sk(sk)->retrans_stamp)) ++ start_ts = TCP_SKB_CB(tcp_write_queue_head(sk))->when; ++ else ++ start_ts = tcp_sk(sk)->retrans_stamp; ++ + linear_backoff_thresh = ilog2(TCP_RTO_MAX/TCP_RTO_MIN); + + if (boundary <= linear_backoff_thresh) +@@ -1279,7 +1285,7 @@ static inline bool retransmits_timed_out + timeout = ((2 << linear_backoff_thresh) - 1) * TCP_RTO_MIN + + (boundary - linear_backoff_thresh) * TCP_RTO_MAX; + +- return (tcp_time_stamp - tcp_sk(sk)->retrans_stamp) >= timeout; ++ return (tcp_time_stamp - start_ts) >= timeout; + } + + static inline struct sk_buff *tcp_send_head(struct sock *sk) + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:57 2009 +Message-Id: <20091217035657.124098529@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:46 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Patrick McHardy , + "David S. Miller" +Subject: [109/151] ip_fragment: also adjust skb->truesize for packets not owned by a socket + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Patrick McHardy + +[ Upstream commit b2722b1c3a893ec6021508da15b32282ec79f4da ] + +When a large packet gets reassembled by ip_defrag(), the head skb +accounts for all the fragments in skb->truesize. If this packet is +refragmented again, skb->truesize is not re-adjusted to reflect only +the head size since its not owned by a socket. If the head fragment +then gets recycled and reused for another received fragment, it might +exceed the defragmentation limits due to its large truesize value. + +skb_recycle_check() explicitly checks for linear skbs, so any recycled +skb should reflect its true size in skb->truesize. Change ip_fragment() +to also adjust the truesize value of skbs not owned by a socket. + +Reported-and-tested-by: Ben Menchaca +Signed-off-by: Patrick McHardy +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/ip_output.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -501,8 +501,8 @@ int ip_fragment(struct sk_buff *skb, int + if (skb->sk) { + frag->sk = skb->sk; + frag->destructor = sock_wfree; +- truesizes += frag->truesize; + } ++ truesizes += frag->truesize; + } + + /* Everything is OK. Generate! */ + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:57 2009 +Message-Id: <20091217035657.267598397@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:47 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Stanislav Brabec , + "David S. Miller" +Subject: [110/151] b44 WOL setup: one-bit-off stack corruption kernel panic fix + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Stanislav Brabec + +[ Upstream commit: e0188829cb724e7d12a2d4e343b368ff1d6e1471 ] + +About 50% of shutdowns of b44 Ethernet adapter ends by kernel panic +with kernels compiled with stack-protector. + +Checking b44_magic_pattern() return values, one call of +b44_magic_pattern() returns 127. It means, that set_bit(128, pmask) +was called on line 1509. It means that bit 0 of 17th byte of pmask was +overwritten. But pmask has only 16 bytes. Stack corruption happens. + +It seems that set_bit() on line 1509 always writes one bit off. + +The fix does not only solve the stack corruption, but also makes Wake +On LAN working on my onboard B44 on Asus A7V-333X mainboard. + +It seems that this problem affects all kernel versions since commit +725ad800 ([PATCH] b44: add wol for old nic) on 2006-06-20. + +Signed-off-by: Stanislav Brabec +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/b44.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/net/b44.c ++++ b/drivers/net/b44.c +@@ -1505,8 +1505,7 @@ static int b44_magic_pattern(u8 *macaddr + for (k = 0; k< ethaddr_bytes; k++) { + ppattern[offset + magicsync + + (j * ETH_ALEN) + k] = macaddr[k]; +- len++; +- set_bit(len, (unsigned long *) pmask); ++ set_bit(len++, (unsigned long *) pmask); + } + } + return len - 1; + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:57 2009 +Message-Id: <20091217035657.378247813@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:48 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [111/151] sparc64: Dont specify IRQF_SHARED for LDC interrupts. + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: David S. Miller + +[ Upstream commit 08a036d583409e3517e3d15b7478d029b25f2cf2 ] + +IRQF_SHARED and IRQF_DISABLED don't mix. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/kernel/ldc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/sparc/kernel/ldc.c ++++ b/arch/sparc/kernel/ldc.c +@@ -1242,13 +1242,13 @@ int ldc_bind(struct ldc_channel *lp, con + snprintf(lp->tx_irq_name, LDC_IRQ_NAME_MAX, "%s TX", name); + + err = request_irq(lp->cfg.rx_irq, ldc_rx, +- IRQF_SAMPLE_RANDOM | IRQF_DISABLED | IRQF_SHARED, ++ IRQF_SAMPLE_RANDOM | IRQF_DISABLED, + lp->rx_irq_name, lp); + if (err) + return err; + + err = request_irq(lp->cfg.tx_irq, ldc_tx, +- IRQF_SAMPLE_RANDOM | IRQF_DISABLED | IRQF_SHARED, ++ IRQF_SAMPLE_RANDOM | IRQF_DISABLED, + lp->tx_irq_name, lp); + if (err) { + free_irq(lp->cfg.rx_irq, lp); + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:57 2009 +Message-Id: <20091217035657.512017932@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:49 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [112/151] sparc64: Fix overly strict range type matching for PCI devices. + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: David S. Miller + +[ Upstream commit 4230fa3b89ea1c413766bd411a8315a3d05aa6c7 ] + +When we are trying to see if a range property entry applies +to a given address, we are overly strict about the type. + +We should only allow I/O ranges for I/O addresses, and only allow +CONFIG space ranges for CONFIG space address. + +However for MEM ranges, they come in 32-bit and 64-bit flavors. +And a lack of an exact match is OK if the range is 32-bit and +the address is 64-bit. We can assign a 64-bit address properly +into a 32-bit parent range just fine. + +So allow it. + +Reported-by: Patrick Finnegan +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/kernel/of_device_64.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/arch/sparc/kernel/of_device_64.c ++++ b/arch/sparc/kernel/of_device_64.c +@@ -104,9 +104,19 @@ static int of_bus_pci_map(u32 *addr, con + int i; + + /* Check address type match */ +- if ((addr[0] ^ range[0]) & 0x03000000) +- return -EINVAL; ++ if (!((addr[0] ^ range[0]) & 0x03000000)) ++ goto type_match; ++ ++ /* Special exception, we can map a 64-bit address into ++ * a 32-bit range. ++ */ ++ if ((addr[0] & 0x03000000) == 0x03000000 && ++ (range[0] & 0x03000000) == 0x02000000) ++ goto type_match; ++ ++ return -EINVAL; + ++type_match: + if (of_out_of_range(addr + 1, range + 1, range + na + pna, + na - 1, ns)) + return -EINVAL; + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:57 2009 +Message-Id: <20091217035657.634557488@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:50 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [113/151] sparc64: Fix stack debugging IRQ stack regression. + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: David S. Miller + +[ Upstream commit 166e553a575f09485f6d0df8a1ef3c5991f7d953 ] + +Commit 4f70f7a91bffdcc39f088748dc678953eb9a3fbd +(sparc64: Implement IRQ stacks.) has two bugs. + +First, the softirq range check forgets to subtract STACK_BIAS +before comparing with %sp. Next, on failure the wrong label +is jumped to, resulting in a bogus stack being loaded. + +Reported-by: Igor Kovalenko +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/lib/mcount.S | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/arch/sparc/lib/mcount.S ++++ b/arch/sparc/lib/mcount.S +@@ -64,8 +64,9 @@ mcount: + 2: sethi %hi(softirq_stack), %g3 + or %g3, %lo(softirq_stack), %g3 + ldx [%g3 + %g1], %g7 ++ sub %g7, STACK_BIAS, %g7 + cmp %sp, %g7 +- bleu,pt %xcc, 2f ++ bleu,pt %xcc, 3f + sethi %hi(THREAD_SIZE), %g3 + add %g7, %g3, %g7 + cmp %sp, %g7 +@@ -75,7 +76,7 @@ mcount: + * again, we are already trying to output the stack overflow + * message. + */ +- sethi %hi(ovstack), %g7 ! cant move to panic stack fast enough ++3: sethi %hi(ovstack), %g7 ! cant move to panic stack fast enough + or %g7, %lo(ovstack), %g7 + add %g7, OVSTACKSIZE, %g3 + sub %g3, STACK_BIAS + 192, %g3 + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:57 2009 +Message-Id: <20091217035657.762200531@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:51 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "David S. Miller" +Subject: [114/151] sparc: Set UTS_MACHINE correctly. + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: David S. Miller + +[ Upstream commit 7f5620a5fcd658f219e85831d3691908f1eccbde ] + +"ARCH" can be just about anything, so we shouldn't end up +with UTS_MACHINE of "sparc" in a 64-bit kernel build just +because someone set the personality using 'sparc32' or +similar. CONFIG_SPARC64 drives the compilation and +therefore provides the definitive value, not "ARCH". + +This mirrors commit 8c6531f7a99f29ba8817ffb12cc9ecf190049bd6 +(x86: correctly set UTS_MACHINE for "make ARCH=x86") + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/Makefile | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/sparc/Makefile ++++ b/arch/sparc/Makefile +@@ -27,6 +27,7 @@ AS := $(AS) -32 + LDFLAGS := -m elf32_sparc + CHECKFLAGS += -D__sparc__ + export BITS := 32 ++UTS_MACHINE := sparc + + #KBUILD_CFLAGS += -g -pipe -fcall-used-g5 -fcall-used-g7 + KBUILD_CFLAGS += -m32 -pipe -mno-fpu -fcall-used-g5 -fcall-used-g7 +@@ -46,6 +47,7 @@ CHECKFLAGS += -D__sparc__ -D__sparc + + LDFLAGS := -m elf64_sparc + export BITS := 64 ++UTS_MACHINE := sparc64 + + KBUILD_CFLAGS += -m64 -pipe -mno-fpu -mcpu=ultrasparc -mcmodel=medlow \ + -ffixed-g4 -ffixed-g5 -fcall-used-g7 -Wno-sign-compare \ + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:58 2009 +Message-Id: <20091217035657.891238507@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:52 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Larry Finger , + "John W. Linville" +Subject: [115/151] b43legacy: avoid PPC fault during resume + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Larry Finger + +commit 316a4d966cae3c2dec83ebb1ee1a3515f97b30ff upstream. + +For PPC architecture with PHY Revision < 3, a read of the register +B43_MMIO_HWENABLED_LO will cause a CPU fault unless b43legacy_status() +returns a value of 2 (B43legacy_STAT_STARTED); however, one finds that +the driver is unable to associate after resuming from hibernation unless +this routine returns 1. To satisfy both conditions, the routine is rewritten +to return TRUE whenever b43legacy_status() returns a value < 2. + +This patch fixes the second problem listed in the postings for Red Hat +Bugzilla #538523. + +Signed-off-by: Larry Finger +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/b43legacy/rfkill.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/net/wireless/b43legacy/rfkill.c ++++ b/drivers/net/wireless/b43legacy/rfkill.c +@@ -34,6 +34,13 @@ bool b43legacy_is_hw_radio_enabled(struc + & B43legacy_MMIO_RADIO_HWENABLED_HI_MASK)) + return 1; + } else { ++ /* To prevent CPU fault on PPC, do not read a register ++ * unless the interface is started; however, on resume ++ * for hibernation, this routine is entered early. When ++ * that happens, unconditionally return TRUE. ++ */ ++ if (b43legacy_status(dev) < B43legacy_STAT_STARTED) ++ return 1; + if (b43legacy_read16(dev, B43legacy_MMIO_RADIO_HWENABLED_LO) + & B43legacy_MMIO_RADIO_HWENABLED_LO_MASK) + return 1; + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:58 2009 +Message-Id: <20091217035658.016283887@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:53 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Johannes Berg , + Steven Rostedt , + Ingo Molnar +Subject: [116/151] tracing: Fix event format export + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Johannes Berg + +commit 811cb50baf63461ce0bdb234927046131fc7fa8b upstream. + +For some reason the export of the event print format to userspace +uses '#fmt' which breaks if the format string is anything but a plain +string, for example if it is built with macros then the macro names +are exported instead of their contents. + +Use + "\"%s\"", fmt +instead of + "%s", #fmt +to export the string and not the way it is built. + +For example, in net/mac80211/driver-trace.h for the trace event drv_start +there is: + + TP_printk( + LOCAL_PR_FMT, LOCAL_PR_ARG + ) + +Which use to produce: + + print fmt: LOCAL_PR_FMT, REC->wiphy_name + +Now produces: + + print fmt: "%s", REC->wiphy_name + +Signed-off-by: Johannes Berg +LKML-Reference: <20091113224009.GB23942@elte.hu> +Signed-off-by: Steven Rostedt +Cc: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + include/trace/ftrace.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/trace/ftrace.h ++++ b/include/trace/ftrace.h +@@ -159,7 +159,7 @@ + #undef __get_str + + #undef TP_printk +-#define TP_printk(fmt, args...) "%s, %s\n", #fmt, __stringify(args) ++#define TP_printk(fmt, args...) "\"%s\", %s\n", fmt, __stringify(args) + + #undef TP_fast_assign + #define TP_fast_assign(args...) args + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:58 2009 +Message-Id: <20091217035658.141592007@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:54 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + greg@kroah.com +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + linux-wireless@vger.kernel.org, + Sujith , + "Luis R. Rodriguez" +Subject: [117/151] ath9k: Fix TX hang poll routine + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + + +From: Sujith + +This is a backport of upstream commit: 332c556633b8c5fb4e890b1783122f2315526590 + +When TX is hung, the chip is reset. Ensure that +the chip is awake by using the PS wrappers. + + +Signed-off-by: Sujith +Signed-off-by: Luis R. Rodriguez +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/xmit.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -2065,7 +2065,9 @@ static void ath_tx_complete_poll_work(st + + if (needreset) { + DPRINTF(sc, ATH_DBG_RESET, "tx hung, resetting the chip\n"); ++ ath9k_ps_wakeup(sc); + ath_reset(sc, false); ++ ath9k_ps_restore(sc); + } + + ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work, + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:58 2009 +Message-Id: <20091217035658.273685245@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:55 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + greg@kroah.com +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + linux-wireless@vger.kernel.org, + "Luis R. Rodriguez" , + Vasanthakumar Thiagarajan , + Vivek Natarajan +Subject: [118/151] ath9k: fix processing of TX PS null data frames + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: "Luis R. Rodriguez" + +This is a backport of upstream commit: e7824a50662f7f79b1a739f705b4d906c31cf221 + +When mac80211 was telling us to go into Powersave we listened +and immediately turned RX off. This meant hardware would not +see the ACKs from the AP we're associated with and hardware +we'd end up retransmiting the null data frame in a loop +helplessly. + +Fix this by keeping track of the transmitted nullfunc frames +and only when we are sure the AP has sent back an ACK do we +go ahead and shut RX off. + + +Signed-off-by: Vasanthakumar Thiagarajan +Signed-off-by: Vivek Natarajan +Signed-off-by: Luis R. Rodriguez +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath9k/ath9k.h | 3 +++ + drivers/net/wireless/ath/ath9k/mac.c | 2 ++ + drivers/net/wireless/ath/ath9k/mac.h | 1 + + drivers/net/wireless/ath/ath9k/main.c | 9 ++++++++- + drivers/net/wireless/ath/ath9k/xmit.c | 16 ++++++++++++++++ + 5 files changed, 30 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath9k/ath9k.h ++++ b/drivers/net/wireless/ath/ath9k/ath9k.h +@@ -139,6 +139,7 @@ struct ath_buf { + dma_addr_t bf_daddr; /* physical addr of desc */ + dma_addr_t bf_buf_addr; /* physical addr of data buffer */ + bool bf_stale; ++ bool bf_isnullfunc; + u16 bf_flags; + struct ath_buf_state bf_state; + dma_addr_t bf_dmacontext; +@@ -524,6 +525,8 @@ struct ath_led { + #define SC_OP_BEACON_SYNC BIT(19) + #define SC_OP_BTCOEX_ENABLED BIT(20) + #define SC_OP_BT_PRIORITY_DETECTED BIT(21) ++#define SC_OP_NULLFUNC_COMPLETED BIT(22) ++#define SC_OP_PS_ENABLED BIT(23) + + struct ath_bus_ops { + void (*read_cachesize)(struct ath_softc *sc, int *csz); +--- a/drivers/net/wireless/ath/ath9k/mac.c ++++ b/drivers/net/wireless/ath/ath9k/mac.c +@@ -222,6 +222,8 @@ int ath9k_hw_txprocdesc(struct ath_hw *a + ds->ds_txstat.ts_status = 0; + ds->ds_txstat.ts_flags = 0; + ++ if (ads->ds_txstatus1 & AR_FrmXmitOK) ++ ds->ds_txstat.ts_status |= ATH9K_TX_ACKED; + if (ads->ds_txstatus1 & AR_ExcessiveRetries) + ds->ds_txstat.ts_status |= ATH9K_TXERR_XRETRY; + if (ads->ds_txstatus1 & AR_Filtered) +--- a/drivers/net/wireless/ath/ath9k/mac.h ++++ b/drivers/net/wireless/ath/ath9k/mac.h +@@ -76,6 +76,7 @@ + #define ATH9K_TXERR_FIFO 0x04 + #define ATH9K_TXERR_XTXOP 0x08 + #define ATH9K_TXERR_TIMER_EXPIRED 0x10 ++#define ATH9K_TX_ACKED 0x20 + + #define ATH9K_TX_BA 0x01 + #define ATH9K_TX_PWRMGMT 0x02 +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -2327,6 +2327,7 @@ static int ath9k_config(struct ieee80211 + + if (changed & IEEE80211_CONF_CHANGE_PS) { + if (conf->flags & IEEE80211_CONF_PS) { ++ sc->sc_flags |= SC_OP_PS_ENABLED; + if (!(ah->caps.hw_caps & + ATH9K_HW_CAP_AUTOSLEEP)) { + if ((sc->imask & ATH9K_INT_TIM_TIMER) == 0) { +@@ -2334,11 +2335,17 @@ static int ath9k_config(struct ieee80211 + ath9k_hw_set_interrupts(sc->sc_ah, + sc->imask); + } +- ath9k_hw_setrxabort(sc->sc_ah, 1); + } + sc->ps_enabled = true; ++ if ((sc->sc_flags & SC_OP_NULLFUNC_COMPLETED)) { ++ sc->sc_flags &= ~SC_OP_NULLFUNC_COMPLETED; ++ sc->ps_enabled = true; ++ ath9k_hw_setrxabort(sc->sc_ah, 1); ++ } + } else { + sc->ps_enabled = false; ++ sc->sc_flags &= ~(SC_OP_PS_ENABLED | ++ SC_OP_NULLFUNC_COMPLETED); + ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_AWAKE); + if (!(ah->caps.hw_caps & + ATH9K_HW_CAP_AUTOSLEEP)) { +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -1592,6 +1592,13 @@ static int ath_tx_setup_buffer(struct ie + } + + bf->bf_buf_addr = bf->bf_dmacontext; ++ ++ if (ieee80211_is_nullfunc(fc) && ieee80211_has_pm(fc)) { ++ bf->bf_isnullfunc = true; ++ sc->sc_flags &= ~SC_OP_NULLFUNC_COMPLETED; ++ } else ++ bf->bf_isnullfunc = false; ++ + return 0; + } + +@@ -1989,6 +1996,15 @@ static void ath_tx_processq(struct ath_s + if (ds == txq->axq_gatingds) + txq->axq_gatingds = NULL; + ++ if (bf->bf_isnullfunc && ++ (ds->ds_txstat.ts_status & ATH9K_TX_ACKED)) { ++ if ((sc->sc_flags & SC_OP_PS_ENABLED)) { ++ sc->ps_enabled = true; ++ ath9k_hw_setrxabort(sc->sc_ah, 1); ++ } else ++ sc->sc_flags |= SC_OP_NULLFUNC_COMPLETED; ++ } ++ + /* + * Remove ath_buf's of the same transmit unit from txq, + * however leave the last descriptor back as the holding + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:58 2009 +Message-Id: <20091217035658.407255478@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:56 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + greg@kroah.com +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + linux-wireless@vger.kernel.org, + "Luis R. Rodriguez" , + Kyungwan Nam , + Bennyam Malavazi , + Stephen Chen , + Shan Palanisamy , + Paul Shaw , + Vasanthakumar Thiagarajan +Subject: [119/151] ath9k: Fix maximum tx fifo settings for single stream devices + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: "Luis R. Rodriguez" + +This is a backport of upstream commit: f4709fdf683e1ed37b321c258b614ebe39752bf3 + +Atheros single stream AR9285 and AR9271 have half the PCU TX FIFO +buffer size of that of dual stream devices. Dual stream devices +have a max PCU TX FIFO size of 8 KB while single stream devices +have 4 KB. Single stream devices have an issue though and require +hardware only to use half of the amount of its capable PCU TX FIFO +size, 2 KB and this requires a change in software. + +Technically a change would not have been required (except for frame +burst considerations of 128 bytes) if these devices would have been +able to use the full 4 KB of the PCU TX FIFO size but our systems +engineers recommend 2 KB to be used only. We enforce this through +software by reducing the max frame triggger level to 2 KB. + +Fixing the max frame trigger level should then have a few benefits: + + * The PER will now be adjusted as designed for underruns when the + max trigger level is reached. This should help alleviate the + bus as the rate control algorithm chooses a slower rate which + should ensure frames are transmitted properly under high system + bus load. + + * The poll we use on our TX queues should now trigger and work + as designed for single stream devices. The hardware passes + data from each TX queue on the PCU TX FIFO queue respecting each + queue's priority. The new trigger level ensures this seeding of + the PCU TX FIFO queue occurs as designed which could mean avoiding + false resets and actually reseting hw correctly when a TX queue + is indeed stuck. + + * Some undocumented / unsupported behaviour could have been triggered + when the max trigger level level was being set to 4 KB on single + stream devices. Its not clear what this issue was to me yet. + +Cc: Kyungwan Nam +Cc: Bennyam Malavazi +Cc: Stephen Chen +Cc: Shan Palanisamy +Cc: Paul Shaw +Signed-off-by: Vasanthakumar Thiagarajan +Signed-off-by: Luis R. Rodriguez +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath9k/hw.c | 11 ++++++++++- + drivers/net/wireless/ath/ath9k/hw.h | 1 + + drivers/net/wireless/ath/ath9k/mac.c | 4 ++-- + 3 files changed, 13 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/hw.c ++++ b/drivers/net/wireless/ath/ath9k/hw.c +@@ -937,6 +937,11 @@ int ath9k_hw_init(struct ath_hw *ah) + DPRINTF(ah->ah_sc, ATH_DBG_RESET, "serialize_regmode is %d\n", + ah->config.serialize_regmode); + ++ if (AR_SREV_9285(ah) || AR_SREV_9271(ah)) ++ ah->config.max_txtrig_level = MAX_TX_FIFO_THRESHOLD >> 1; ++ else ++ ah->config.max_txtrig_level = MAX_TX_FIFO_THRESHOLD; ++ + if (!ath9k_hw_macversion_supported(ah->hw_version.macVersion)) { + DPRINTF(ah->ah_sc, ATH_DBG_FATAL, + "Mac Chip Rev 0x%02x.%x is not supported by " +@@ -3670,7 +3675,11 @@ void ath9k_hw_fill_cap_info(struct ath_h + pCap->keycache_size = AR_KEYTABLE_SIZE; + + pCap->hw_caps |= ATH9K_HW_CAP_FASTCC; +- pCap->tx_triglevel_max = MAX_TX_FIFO_THRESHOLD; ++ ++ if (AR_SREV_9285(ah) || AR_SREV_9271(ah)) ++ pCap->tx_triglevel_max = MAX_TX_FIFO_THRESHOLD >> 1; ++ else ++ pCap->tx_triglevel_max = MAX_TX_FIFO_THRESHOLD; + + if (AR_SREV_9285_10_OR_LATER(ah)) + pCap->num_gpio_pins = AR9285_NUM_GPIO; +--- a/drivers/net/wireless/ath/ath9k/hw.h ++++ b/drivers/net/wireless/ath/ath9k/hw.h +@@ -218,6 +218,7 @@ struct ath9k_ops_config { + #define AR_SPUR_FEEQ_BOUND_HT20 10 + int spurmode; + u16 spurchans[AR_EEPROM_MODAL_SPURS][2]; ++ u8 max_txtrig_level; + }; + + enum ath9k_int { +--- a/drivers/net/wireless/ath/ath9k/mac.c ++++ b/drivers/net/wireless/ath/ath9k/mac.c +@@ -70,7 +70,7 @@ bool ath9k_hw_updatetxtriglevel(struct a + u32 txcfg, curLevel, newLevel; + enum ath9k_int omask; + +- if (ah->tx_trig_level >= MAX_TX_FIFO_THRESHOLD) ++ if (ah->tx_trig_level >= ah->config.max_txtrig_level) + return false; + + omask = ath9k_hw_set_interrupts(ah, ah->mask_reg & ~ATH9K_INT_GLOBAL); +@@ -79,7 +79,7 @@ bool ath9k_hw_updatetxtriglevel(struct a + curLevel = MS(txcfg, AR_FTRIG); + newLevel = curLevel; + if (bIncTrigLevel) { +- if (curLevel < MAX_TX_FIFO_THRESHOLD) ++ if (curLevel < ah->config.max_txtrig_level) + newLevel++; + } else if (curLevel > MIN_TX_FIFO_THRESHOLD) + newLevel--; + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:58 2009 +Message-Id: <20091217035658.537655213@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:57 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + greg@kroah.com +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + linux-wireless@vger.kernel.org, + Felix Fietkau , + "Luis R. Rodriguez" +Subject: [120/151] ath9k: fix tx status reporting + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + + +From: Felix Fietkau + +This is a backport of upstream commit: e8c6342d989e241513baeba4b05a04b6b1f3bc8b + +This patch fixes a bug in ath9k's tx status check, which +caused mac80211 to consider regularly transmitted unicast frames +as un-acked. + +When checking the ts_status field for errors, it needs to be masked +with ATH9K_TXERR_FILT, because this field also contains other fields +like ATH9K_TX_ACKED. + +Without this patch, AP mode is pretty much unusable, as hostapd +checks the ACK status for the frames that it injects. + + +Signed-off-by: Felix Fietkau +Signed-off-by: Luis R. Rodriguez +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath9k/xmit.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -2020,7 +2020,7 @@ static void ath_tx_processq(struct ath_s + if (bf_isaggr(bf)) + txq->axq_aggr_depth--; + +- txok = (ds->ds_txstat.ts_status == 0); ++ txok = !(ds->ds_txstat.ts_status & ATH9K_TXERR_FILT); + txq->axq_tx_inprogress = false; + spin_unlock_bh(&txq->axq_lock); + + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:58 2009 +Message-Id: <20091217035658.668679326@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:58 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + greg@kroah.com +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + linux-wireless@vger.kernel.org, + Vivek Natarajan , + "John W. Linville" +Subject: [121/151] mac80211: Fix dynamic power save for scanning. + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + + +From: Vivek Natarajan + +Upstream commit: 7c3f4bbedc241ddcd3abe1f419c356e625231da1 + +Not only ps_sdata but also IEEE80211_CONF_PS is to be considered +before restoring PS in scan_ps_disable(). For instance, when ps_sdata +is set but CONF_PS is not set just because the dynamic timer is still +running, a sw scan leads to setting of CONF_PS in scan_ps_disable +instead of restarting the dynamic PS timer. +Also for the above case, a null data frame is to be sent after +returning to operating channel which was not happening with the +current implementation. This patch fixes this too. + + +Signed-off-by: Vivek Natarajan +Reviewed-by: Kalle Valo +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman +--- + net/mac80211/ieee80211_i.h | 1 + + net/mac80211/scan.c | 20 ++++++++++++++++---- + 2 files changed, 17 insertions(+), 4 deletions(-) + +--- a/net/mac80211/ieee80211_i.h ++++ b/net/mac80211/ieee80211_i.h +@@ -808,6 +808,7 @@ struct ieee80211_local { + unsigned int wmm_acm; /* bit field of ACM bits (BIT(802.1D tag)) */ + + bool pspolling; ++ bool scan_ps_enabled; + /* + * PS can only be enabled when we have exactly one managed + * interface (and monitors) in PS, this then points there. +--- a/net/mac80211/scan.c ++++ b/net/mac80211/scan.c +@@ -196,7 +196,8 @@ ieee80211_scan_rx(struct ieee80211_sub_i + static void ieee80211_scan_ps_enable(struct ieee80211_sub_if_data *sdata) + { + struct ieee80211_local *local = sdata->local; +- bool ps = false; ++ ++ local->scan_ps_enabled = false; + + /* FIXME: what to do when local->pspolling is true? */ + +@@ -204,12 +205,13 @@ static void ieee80211_scan_ps_enable(str + cancel_work_sync(&local->dynamic_ps_enable_work); + + if (local->hw.conf.flags & IEEE80211_CONF_PS) { +- ps = true; ++ local->scan_ps_enabled = true; + local->hw.conf.flags &= ~IEEE80211_CONF_PS; + ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS); + } + +- if (!ps || !(local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)) ++ if (!(local->scan_ps_enabled) || ++ !(local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)) + /* + * If power save was enabled, no need to send a nullfunc + * frame because AP knows that we are sleeping. But if the +@@ -230,7 +232,7 @@ static void ieee80211_scan_ps_disable(st + + if (!local->ps_sdata) + ieee80211_send_nullfunc(local, sdata, 0); +- else { ++ else if (local->scan_ps_enabled) { + /* + * In !IEEE80211_HW_PS_NULLFUNC_STACK case the hardware + * will send a nullfunc frame with the powersave bit set +@@ -246,6 +248,16 @@ static void ieee80211_scan_ps_disable(st + */ + local->hw.conf.flags |= IEEE80211_CONF_PS; + ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS); ++ } else if (local->hw.conf.dynamic_ps_timeout > 0) { ++ /* ++ * If IEEE80211_CONF_PS was not set and the dynamic_ps_timer ++ * had been running before leaving the operating channel, ++ * restart the timer now and send a nullfunc frame to inform ++ * the AP that we are awake. ++ */ ++ ieee80211_send_nullfunc(local, sdata, 0); ++ mod_timer(&local->dynamic_ps_timer, jiffies + ++ msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout)); + } + } + + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:58 2009 +Message-Id: <20091217035658.797276396@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:56:59 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Eric Anholt , + Li Peng , + Jesse Barnes , + Stefan Bader +Subject: [122/151] drm/i915: Fix sync to vblank when VGA output is turned off + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + + +From: Li Peng + +commit 778c902640530371a169ad1c03566e7c51b09874 upstream + +In current vblank-wait implementation, if we turn off VGA output, +drm_wait_vblank will still wait on the disabled pipe until timeout, +because vblank on the pipe is assumed be enabled. This would cause +slow system response on some system such as moblin. + +This patch resolve the issue by adding a drm helper function +drm_vblank_off which explicitly clear vblank_enabled[crtc], wake up +any waiting queue and save last vblank counter before turning off +crtc. It also slightly change drm_vblank_get to ensure that we will +will return immediately if trying to wait on a disabled pipe. + +Signed-off-by: Li Peng +Reviewed-by: Jesse Barnes +[anholt: hand-applied for conflicts with overlay changes] +Signed-off-by: Eric Anholt +Cc: Stefan Bader +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_irq.c | 34 ++++++++++++++++++++++++++-------- + drivers/gpu/drm/i915/intel_display.c | 1 + + include/drm/drmP.h | 1 + + 3 files changed, 28 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/drm_irq.c ++++ b/drivers/gpu/drm/drm_irq.c +@@ -429,15 +429,21 @@ int drm_vblank_get(struct drm_device *de + + spin_lock_irqsave(&dev->vbl_lock, irqflags); + /* Going from 0->1 means we have to enable interrupts again */ +- if (atomic_add_return(1, &dev->vblank_refcount[crtc]) == 1 && +- !dev->vblank_enabled[crtc]) { +- ret = dev->driver->enable_vblank(dev, crtc); +- DRM_DEBUG("enabling vblank on crtc %d, ret: %d\n", crtc, ret); +- if (ret) ++ if (atomic_add_return(1, &dev->vblank_refcount[crtc]) == 1) { ++ if (!dev->vblank_enabled[crtc]) { ++ ret = dev->driver->enable_vblank(dev, crtc); ++ DRM_DEBUG("enabling vblank on crtc %d, ret: %d\n", crtc, ret); ++ if (ret) ++ atomic_dec(&dev->vblank_refcount[crtc]); ++ else { ++ dev->vblank_enabled[crtc] = 1; ++ drm_update_vblank_count(dev, crtc); ++ } ++ } ++ } else { ++ if (!dev->vblank_enabled[crtc]) { + atomic_dec(&dev->vblank_refcount[crtc]); +- else { +- dev->vblank_enabled[crtc] = 1; +- drm_update_vblank_count(dev, crtc); ++ ret = -EINVAL; + } + } + spin_unlock_irqrestore(&dev->vbl_lock, irqflags); +@@ -464,6 +470,18 @@ void drm_vblank_put(struct drm_device *d + } + EXPORT_SYMBOL(drm_vblank_put); + ++void drm_vblank_off(struct drm_device *dev, int crtc) ++{ ++ unsigned long irqflags; ++ ++ spin_lock_irqsave(&dev->vbl_lock, irqflags); ++ DRM_WAKEUP(&dev->vbl_queue[crtc]); ++ dev->vblank_enabled[crtc] = 0; ++ dev->last_vblank[crtc] = dev->driver->get_vblank_counter(dev, crtc); ++ spin_unlock_irqrestore(&dev->vbl_lock, irqflags); ++} ++EXPORT_SYMBOL(drm_vblank_off); ++ + /** + * drm_vblank_pre_modeset - account for vblanks across mode sets + * @dev: DRM device +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -1845,6 +1845,7 @@ static void i9xx_crtc_dpms(struct drm_cr + intel_update_watermarks(dev); + /* Give the overlay scaler a chance to disable if it's on this pipe */ + //intel_crtc_dpms_video(crtc, FALSE); TODO ++ drm_vblank_off(dev, pipe); + + if (dev_priv->cfb_plane == plane && + dev_priv->display.disable_fbc) +--- a/include/drm/drmP.h ++++ b/include/drm/drmP.h +@@ -1295,6 +1295,7 @@ extern u32 drm_vblank_count(struct drm_d + extern void drm_handle_vblank(struct drm_device *dev, int crtc); + extern int drm_vblank_get(struct drm_device *dev, int crtc); + extern void drm_vblank_put(struct drm_device *dev, int crtc); ++extern void drm_vblank_off(struct drm_device *dev, int crtc); + extern void drm_vblank_cleanup(struct drm_device *dev); + /* Modesetting support */ + extern void drm_vblank_pre_modeset(struct drm_device *dev, int crtc); + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:59 2009 +Message-Id: <20091217035658.924129678@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:00 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + "Kirill A. Shutemov" , + KAMEZAWA Hiroyuki +Subject: [123/151] memcg: fix memory.memsw.usage_in_bytes for root cgroup + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Kirill A. Shutemov + +commit cd9b45b78a61e8df250e69385c74e729e5b66abf upstream. + +A memory cgroup has a memory.memsw.usage_in_bytes file. It shows the sum +of the usage of pages and swapents in the cgroup. Presently the root +cgroup's memsw.usage_in_bytes shows the wrong value - the number of +swapents are not added. + +So take MEM_CGROUP_STAT_SWAPOUT into account. + +Signed-off-by: Kirill A. Shutemov +Reviewed-by: Daisuke Nishimura +Acked-by: KAMEZAWA Hiroyuki +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/memcontrol.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -2541,6 +2541,7 @@ static u64 mem_cgroup_read(struct cgroup + val += idx_val; + mem_cgroup_get_recursive_idx_stat(mem, + MEM_CGROUP_STAT_SWAPOUT, &idx_val); ++ val += idx_val; + val <<= PAGE_SHIFT; + } else + val = res_counter_read_u64(&mem->memsw, name); + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:59 2009 +Message-Id: <20091217035659.056372096@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:01 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Henrique de Moraes Holschuh , + Len Brown +Subject: [124/151] thinkpad-acpi: fix default brightness_mode for R50e/R51 + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Henrique de Moraes Holschuh + +commit a9f8eacca4e9e8693de9b896c1fa7aadaa9402e8 upstream. + +According to a report, the R50e wants EC-based brightness control, +even if it uses an Intel GPU. The current driver default was reported +to not work at all. + +This bug can be worked around by the "brightness_mode=3" module +parameter. + +Change the default of the R50e and R51 2xxx models (which use the same +EC firmware, 1V) to TPACPI_BRGHT_Q_EC, but keep TPACPI_BRGHT_Q_ASK set +for now, as I'd like to get more reports. + +This fixes a regression caused by commit +59fe4fe34d7afdf63208124f313be9056feaa2f4, +"thinkpad-acpi: fix incorrect use of TPACPI_BRGHT_MODE_ECNVRAM" + +Kernel 2.6.31 also needs this fix. + +Reported-by: Ferenc Wagner +Tested-by: Ferenc Wagner +Signed-off-by: Henrique de Moraes Holschuh +Cc: stable@kernel.org +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/thinkpad_acpi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -6123,8 +6123,8 @@ static const struct tpacpi_quirk brightn + + /* Models with Intel Extreme Graphics 2 */ + TPACPI_Q_IBM('1', 'U', TPACPI_BRGHT_Q_NOEC), +- TPACPI_Q_IBM('1', 'V', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_NOEC), +- TPACPI_Q_IBM('1', 'W', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_NOEC), ++ TPACPI_Q_IBM('1', 'V', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC), ++ TPACPI_Q_IBM('1', 'W', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC), + + /* Models with Intel GMA900 */ + TPACPI_Q_IBM('7', '0', TPACPI_BRGHT_Q_NOEC), /* T43, R52 */ + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:59 2009 +Message-Id: <20091217035659.186337280@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:02 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Henrique de Moraes Holschuh , + Len Brown +Subject: [125/151] thinkpad-acpi: preserve rfkill state across suspend/resume + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Henrique de Moraes Holschuh + +commit 208b996b6c460285650d39b2330f8ef82c007d10 upstream. + +Since the rfkill rework in 2.6.31, the driver is always resuming with +the radios disabled. + +Change thinkpad-acpi to ask the firmware to resume with the radios in +the last state. This fixes the Bluetooth and WWAN rfkill switches. + +Note that it means we respect the firmware's oddities. Should the +user toggle the hardware rfkill switch on and off, it might cause the +radios to resume enabled. + +UWB is an unknown quantity since it has nowhere the same level of +firmware support (no control over state storage in NVRAM, for +example), and might need further fixing. Testers welcome. + +This change fixes a regression from 2.6.30. + +Reported-by: Jerone Young +Reported-by: Ian Molton +Signed-off-by: Henrique de Moraes Holschuh +Tested-by: Ian Molton +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/thinkpad_acpi.c | 32 +++++--------------------------- + 1 file changed, 5 insertions(+), 27 deletions(-) + +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -3866,15 +3866,6 @@ enum { + + #define TPACPI_RFK_BLUETOOTH_SW_NAME "tpacpi_bluetooth_sw" + +-static void bluetooth_suspend(pm_message_t state) +-{ +- /* Try to make sure radio will resume powered off */ +- if (!acpi_evalf(NULL, NULL, "\\BLTH", "vd", +- TP_ACPI_BLTH_PWR_OFF_ON_RESUME)) +- vdbg_printk(TPACPI_DBG_RFKILL, +- "bluetooth power down on resume request failed\n"); +-} +- + static int bluetooth_get_status(void) + { + int status; +@@ -3908,10 +3899,9 @@ static int bluetooth_set_status(enum tpa + #endif + + /* We make sure to keep TP_ACPI_BLUETOOTH_RESUMECTRL off */ ++ status = TP_ACPI_BLUETOOTH_RESUMECTRL; + if (state == TPACPI_RFK_RADIO_ON) +- status = TP_ACPI_BLUETOOTH_RADIOSSW; +- else +- status = 0; ++ status |= TP_ACPI_BLUETOOTH_RADIOSSW; + + if (!acpi_evalf(hkey_handle, NULL, "SBDC", "vd", status)) + return -EIO; +@@ -4050,7 +4040,6 @@ static struct ibm_struct bluetooth_drive + .read = bluetooth_read, + .write = bluetooth_write, + .exit = bluetooth_exit, +- .suspend = bluetooth_suspend, + .shutdown = bluetooth_shutdown, + }; + +@@ -4068,15 +4057,6 @@ enum { + + #define TPACPI_RFK_WWAN_SW_NAME "tpacpi_wwan_sw" + +-static void wan_suspend(pm_message_t state) +-{ +- /* Try to make sure radio will resume powered off */ +- if (!acpi_evalf(NULL, NULL, "\\WGSV", "qvd", +- TP_ACPI_WGSV_PWR_OFF_ON_RESUME)) +- vdbg_printk(TPACPI_DBG_RFKILL, +- "WWAN power down on resume request failed\n"); +-} +- + static int wan_get_status(void) + { + int status; +@@ -4109,11 +4089,10 @@ static int wan_set_status(enum tpacpi_rf + } + #endif + +- /* We make sure to keep TP_ACPI_WANCARD_RESUMECTRL off */ ++ /* We make sure to set TP_ACPI_WANCARD_RESUMECTRL */ ++ status = TP_ACPI_WANCARD_RESUMECTRL; + if (state == TPACPI_RFK_RADIO_ON) +- status = TP_ACPI_WANCARD_RADIOSSW; +- else +- status = 0; ++ status |= TP_ACPI_WANCARD_RADIOSSW; + + if (!acpi_evalf(hkey_handle, NULL, "SWAN", "vd", status)) + return -EIO; +@@ -4251,7 +4230,6 @@ static struct ibm_struct wan_driver_data + .read = wan_read, + .write = wan_write, + .exit = wan_exit, +- .suspend = wan_suspend, + .shutdown = wan_shutdown, + }; + + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:59 2009 +Message-Id: <20091217035659.320476787@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:03 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + WANG Cong , + Ingo Molnar , + Peter Zijlstra , + James Morris , + Alexey Dobriyan +Subject: [126/151] sysctl_max_map_count should be non-negative + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Amerigo Wang + +commit 70da2340fbc68e91e701762f785479ab495a0869 upstream. + +Jan Engelhardt reported we have this problem: + +setting max_map_count to a value large enough results in programs dying at +first try. This is on 2.6.31.6: + +15:59 borg:/proc/sys/vm # echo $[1<<31-1] >max_map_count +15:59 borg:/proc/sys/vm # cat max_map_count +1073741824 +15:59 borg:/proc/sys/vm # echo $[1<<31] >max_map_count +15:59 borg:/proc/sys/vm # cat max_map_count +Killed + +This is because we have a chance to make 'max_map_count' negative. but +it's meaningless. Make it only accept non-negative values. + +Reported-by: Jan Engelhardt +Signed-off-by: WANG Cong +Cc: Ingo Molnar +Cc: Peter Zijlstra +Cc: James Morris +Cc: Alexey Dobriyan +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/sysctl.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -1605,7 +1605,8 @@ static struct ctl_table debug_table[] = + .data = &show_unhandled_signals, + .maxlen = sizeof(int), + .mode = 0644, +- .proc_handler = proc_dointvec ++ .proc_handler = proc_dointvec, ++ .extra1 = &zero, + }, + #endif + { .ctl_name = 0 } + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:59 2009 +Message-Id: <20091217035659.451631921@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:04 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Zhu Yi , + "John W. Linville" +Subject: [127/151] ipw2100: fix rebooting hang with driver loaded + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Zhu Yi + +commit 52ce3e9a7db754b78cf2cbabc87013f921b25b28 upstream. + +Add PCI .shutdown method so that we can disable the device during +shutdown or reboot. Without this, the reboot doesn't work well on +some platforms. + +This fixes http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2124 + +Tested-by: pablo +Signed-off-by: Zhu Yi +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ipw2x00/ipw2100.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/net/wireless/ipw2x00/ipw2100.c ++++ b/drivers/net/wireless/ipw2x00/ipw2100.c +@@ -6487,6 +6487,16 @@ static int ipw2100_resume(struct pci_dev + } + #endif + ++static void ipw2100_shutdown(struct pci_dev *pci_dev) ++{ ++ struct ipw2100_priv *priv = pci_get_drvdata(pci_dev); ++ ++ /* Take down the device; powers it off, etc. */ ++ ipw2100_down(priv); ++ ++ pci_disable_device(pci_dev); ++} ++ + #define IPW2100_DEV_ID(x) { PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, x } + + static struct pci_device_id ipw2100_pci_id_table[] __devinitdata = { +@@ -6550,6 +6560,7 @@ static struct pci_driver ipw2100_pci_dri + .suspend = ipw2100_suspend, + .resume = ipw2100_resume, + #endif ++ .shutdown = ipw2100_shutdown, + }; + + /** + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:59 2009 +Message-Id: <20091217035659.581597734@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:05 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Alan Cox , + Petr Vandrovec , + Pekka Enberg , + "Paul A. Clarke" +Subject: [128/151] matroxfb: fix problems with display stability + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Alan Cox + +commit 8c651311a3a08c1e4815de6933e00a760e498dae upstream. + +Regression caused in 2.6.23 and then despite repeated requests never fixed +or dealt with (Petr promised to sort it in 2008 but seems to have +forgotten). + +Enough is enough - remove the problem line that was added. If it upsets +someone they've had two years to deal with it and at the very least it'll +rattle their cage and wake them up. + +Addresses http://bugzilla.kernel.org/show_bug.cgi?id=9709 + +Signed-off-by: Alan Cox +Reported-by: Damon +Tested-by: Ruud van Melick +Cc: Petr Vandrovec +Cc: Pekka Enberg +Cc: Paul A. Clarke +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/matrox/g450_pll.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/video/matrox/g450_pll.c ++++ b/drivers/video/matrox/g450_pll.c +@@ -368,7 +368,8 @@ static int __g450_setclk(struct matrox_f + M1064_XDVICLKCTRL_C1DVICLKEN | + M1064_XDVICLKCTRL_DVILOOPCTL | + M1064_XDVICLKCTRL_P1LOOPBWDTCTL; +- matroxfb_DAC_out(minfo, M1064_XDVICLKCTRL, tmp); ++ /* Setting this breaks PC systems so don't do it */ ++ /* matroxfb_DAC_out(minfo, M1064_XDVICLKCTRL, tmp); */ + matroxfb_DAC_out(minfo, M1064_XPWRCTRL, + xpwrctrl); + + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:59 2009 +Message-Id: <20091217035659.715358564@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:06 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Peter Feuerer , + Borislav Petkov , + Andreas Mohr , + Len Brown +Subject: [129/151] acerhdf: add new BIOS versions + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Peter Feuerer + +commit 360657463679dee44f0b167ffa61f563b4fee101 upstream. + +Added new BIOS versions for following netbooks: Acer 1410, Gateway LT31, +Packard Bell DOA150. As the Gateway LT31 machines have different register +values for setting and checking the off-state, the "cmd_off" variable has +been splitted up to "cmd_off" and "chk_off". + +Signed-off-by: Peter Feuerer +Cc: Borislav Petkov +Cc: Andreas Mohr +Signed-off-by: Andrew Morton +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/acerhdf.c | 63 ++++++++++++++++++++++++----------------- + 1 file changed, 37 insertions(+), 26 deletions(-) + +--- a/drivers/platform/x86/acerhdf.c ++++ b/drivers/platform/x86/acerhdf.c +@@ -52,7 +52,7 @@ + */ + #undef START_IN_KERNEL_MODE + +-#define DRV_VER "0.5.18" ++#define DRV_VER "0.5.20" + + /* + * According to the Atom N270 datasheet, +@@ -112,12 +112,14 @@ module_param_string(force_product, force + MODULE_PARM_DESC(force_product, "Force BIOS product and omit BIOS check"); + + /* +- * cmd_off: to switch the fan completely off / to check if the fan is off ++ * cmd_off: to switch the fan completely off ++ * chk_off: to check if the fan is off + * cmd_auto: to set the BIOS in control of the fan. The BIOS regulates then + * the fan speed depending on the temperature + */ + struct fancmd { + u8 cmd_off; ++ u8 chk_off; + u8 cmd_auto; + }; + +@@ -134,32 +136,41 @@ struct bios_settings_t { + /* Register addresses and values for different BIOS versions */ + static const struct bios_settings_t bios_tbl[] = { + /* AOA110 */ +- {"Acer", "AOA110", "v0.3109", 0x55, 0x58, {0x1f, 0x00} }, +- {"Acer", "AOA110", "v0.3114", 0x55, 0x58, {0x1f, 0x00} }, +- {"Acer", "AOA110", "v0.3301", 0x55, 0x58, {0xaf, 0x00} }, +- {"Acer", "AOA110", "v0.3304", 0x55, 0x58, {0xaf, 0x00} }, +- {"Acer", "AOA110", "v0.3305", 0x55, 0x58, {0xaf, 0x00} }, +- {"Acer", "AOA110", "v0.3307", 0x55, 0x58, {0xaf, 0x00} }, +- {"Acer", "AOA110", "v0.3308", 0x55, 0x58, {0x21, 0x00} }, +- {"Acer", "AOA110", "v0.3309", 0x55, 0x58, {0x21, 0x00} }, +- {"Acer", "AOA110", "v0.3310", 0x55, 0x58, {0x21, 0x00} }, ++ {"Acer", "AOA110", "v0.3109", 0x55, 0x58, {0x1f, 0x1f, 0x00} }, ++ {"Acer", "AOA110", "v0.3114", 0x55, 0x58, {0x1f, 0x1f, 0x00} }, ++ {"Acer", "AOA110", "v0.3301", 0x55, 0x58, {0xaf, 0xaf, 0x00} }, ++ {"Acer", "AOA110", "v0.3304", 0x55, 0x58, {0xaf, 0xaf, 0x00} }, ++ {"Acer", "AOA110", "v0.3305", 0x55, 0x58, {0xaf, 0xaf, 0x00} }, ++ {"Acer", "AOA110", "v0.3307", 0x55, 0x58, {0xaf, 0xaf, 0x00} }, ++ {"Acer", "AOA110", "v0.3308", 0x55, 0x58, {0x21, 0x21, 0x00} }, ++ {"Acer", "AOA110", "v0.3309", 0x55, 0x58, {0x21, 0x21, 0x00} }, ++ {"Acer", "AOA110", "v0.3310", 0x55, 0x58, {0x21, 0x21, 0x00} }, + /* AOA150 */ +- {"Acer", "AOA150", "v0.3114", 0x55, 0x58, {0x20, 0x00} }, +- {"Acer", "AOA150", "v0.3301", 0x55, 0x58, {0x20, 0x00} }, +- {"Acer", "AOA150", "v0.3304", 0x55, 0x58, {0x20, 0x00} }, +- {"Acer", "AOA150", "v0.3305", 0x55, 0x58, {0x20, 0x00} }, +- {"Acer", "AOA150", "v0.3307", 0x55, 0x58, {0x20, 0x00} }, +- {"Acer", "AOA150", "v0.3308", 0x55, 0x58, {0x20, 0x00} }, +- {"Acer", "AOA150", "v0.3309", 0x55, 0x58, {0x20, 0x00} }, +- {"Acer", "AOA150", "v0.3310", 0x55, 0x58, {0x20, 0x00} }, ++ {"Acer", "AOA150", "v0.3114", 0x55, 0x58, {0x20, 0x20, 0x00} }, ++ {"Acer", "AOA150", "v0.3301", 0x55, 0x58, {0x20, 0x20, 0x00} }, ++ {"Acer", "AOA150", "v0.3304", 0x55, 0x58, {0x20, 0x20, 0x00} }, ++ {"Acer", "AOA150", "v0.3305", 0x55, 0x58, {0x20, 0x20, 0x00} }, ++ {"Acer", "AOA150", "v0.3307", 0x55, 0x58, {0x20, 0x20, 0x00} }, ++ {"Acer", "AOA150", "v0.3308", 0x55, 0x58, {0x20, 0x20, 0x00} }, ++ {"Acer", "AOA150", "v0.3309", 0x55, 0x58, {0x20, 0x20, 0x00} }, ++ {"Acer", "AOA150", "v0.3310", 0x55, 0x58, {0x20, 0x20, 0x00} }, ++ /* Acer 1410 */ ++ {"Acer", "Aspire 1410", "v0.3120", 0x55, 0x58, {0x9e, 0x9e, 0x00} }, + /* special BIOS / other */ +- {"Gateway", "AOA110", "v0.3103", 0x55, 0x58, {0x21, 0x00} }, +- {"Gateway", "AOA150", "v0.3103", 0x55, 0x58, {0x20, 0x00} }, +- {"Packard Bell", "DOA150", "v0.3104", 0x55, 0x58, {0x21, 0x00} }, +- {"Packard Bell", "AOA110", "v0.3105", 0x55, 0x58, {0x21, 0x00} }, +- {"Packard Bell", "AOA150", "v0.3105", 0x55, 0x58, {0x20, 0x00} }, ++ {"Gateway", "AOA110", "v0.3103", 0x55, 0x58, {0x21, 0x21, 0x00} }, ++ {"Gateway", "AOA150", "v0.3103", 0x55, 0x58, {0x20, 0x20, 0x00} }, ++ {"Gateway ", "LT31 ", "v1.3103 ", 0x55, 0x58, ++ {0x10, 0x0f, 0x00} }, ++ {"Gateway ", "LT31 ", "v1.3201 ", 0x55, 0x58, ++ {0x10, 0x0f, 0x00} }, ++ {"Gateway ", "LT31 ", "v1.3302 ", 0x55, 0x58, ++ {0x10, 0x0f, 0x00} }, ++ {"Packard Bell", "DOA150", "v0.3104", 0x55, 0x58, {0x21, 0x21, 0x00} }, ++ {"Packard Bell", "DOA150", "v0.3105", 0x55, 0x58, {0x20, 0x20, 0x00} }, ++ {"Packard Bell", "AOA110", "v0.3105", 0x55, 0x58, {0x21, 0x21, 0x00} }, ++ {"Packard Bell", "AOA150", "v0.3105", 0x55, 0x58, {0x20, 0x20, 0x00} }, + /* pewpew-terminator */ +- {"", "", "", 0, 0, {0, 0} } ++ {"", "", "", 0, 0, {0, 0, 0} } + }; + + static const struct bios_settings_t *bios_cfg __read_mostly; +@@ -183,7 +194,7 @@ static int acerhdf_get_fanstate(int *sta + if (ec_read(bios_cfg->fanreg, &fan)) + return -EINVAL; + +- if (fan != bios_cfg->cmd.cmd_off) ++ if (fan != bios_cfg->cmd.chk_off) + *state = ACERHDF_FAN_AUTO; + else + *state = ACERHDF_FAN_OFF; + + +From gregkh@mini.kroah.org Wed Dec 16 19:56:59 2009 +Message-Id: <20091217035659.846589056@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:07 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Thomas Renninger , + =?ISO-8859-15?q?Peter=20K=C3=BCppers?= , + Michael Franzl , + Ian Turner , + Corentin Chary , + Len Brown +Subject: [130/151] asus-laptop: change light sens default values. + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Corentin Chary + +commit d951d4cc84e8b5ddb8e0ab81cf6a72cc73fdd668 upstream. + +The light sensor disable brightness key and +/sys/class/backlight/ control. There was a lot of report +from users who didn't understand why they couldn't change their +brightness, including: + +https://bugs.launchpad.net/bugs/222171 +https://bugzilla.novell.com/show_bug.cgi?id=514747 +http://bugzilla.kernel.org/show_bug.cgi?id=13671 +http://bugzilla.kernel.org/show_bug.cgi?id=14432 + +Now the light sensor is disabled, and if the user want to enable +it, the level should be ok. + +The funny thing is that comments where ok, not code. + +Cc: stable@kernel.org +Cc: Thomas Renninger +Cc: Peter Küppers +Cc: Michael Franzl +Cc: Ian Turner +Signed-off-by: Corentin Chary +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/asus-laptop.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/platform/x86/asus-laptop.c ++++ b/drivers/platform/x86/asus-laptop.c +@@ -1283,8 +1283,8 @@ static int asus_hotk_add(struct acpi_dev + hotk->ledd_status = 0xFFF; + + /* Set initial values of light sensor and level */ +- hotk->light_switch = 1; /* Default to light sensor disabled */ +- hotk->light_level = 0; /* level 5 for sensor sensitivity */ ++ hotk->light_switch = 0; /* Default to light sensor disabled */ ++ hotk->light_level = 5; /* level 5 for sensor sensitivity */ + + if (ls_switch_handle) + set_light_sens_switch(hotk->light_switch); + + +From gregkh@mini.kroah.org Wed Dec 16 19:57:00 2009 +Message-Id: <20091217035659.980303721@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:08 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + tony.luck@intel.com, + linux-ia64@vger.kernel.org, + Jan Beulich , + linux-mm@kvack.org, + Geert Uytterhoeven , + Tejun Heo +Subject: [131/151] vmalloc: conditionalize build of pcpu_get_vm_areas() + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Tejun Heo + +No matching upstream commit as it was resolved differently there. + + +pcpu_get_vm_areas() is used only when dynamic percpu allocator is used +by the architecture. In 2.6.32, ia64 doesn't use dynamic percpu +allocator and has a macro which makes pcpu_get_vm_areas() buggy via +local/global variable aliasing and triggers compile warning. + +The problem is fixed in upstream and ia64 uses dynamic percpu +allocators, so the only left issue is inclusion of unnecessary code +and compile warning on ia64 on 2.6.32. + +Don't build pcpu_get_vm_areas() if legacy percpu allocator is in use. + +Signed-off-by: Tejun Heo +Reported-by: Jan Beulich +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/vmalloc.h | 2 ++ + mm/vmalloc.c | 2 ++ + 2 files changed, 4 insertions(+) + +--- a/include/linux/vmalloc.h ++++ b/include/linux/vmalloc.h +@@ -115,9 +115,11 @@ extern rwlock_t vmlist_lock; + extern struct vm_struct *vmlist; + extern __init void vm_area_register_early(struct vm_struct *vm, size_t align); + ++#ifndef CONFIG_HAVE_LEGACY_PER_CPU_AREA + struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets, + const size_t *sizes, int nr_vms, + size_t align, gfp_t gfp_mask); ++#endif + + void pcpu_free_vm_areas(struct vm_struct **vms, int nr_vms); + +--- a/mm/vmalloc.c ++++ b/mm/vmalloc.c +@@ -1993,6 +1993,7 @@ void free_vm_area(struct vm_struct *area + } + EXPORT_SYMBOL_GPL(free_vm_area); + ++#ifndef CONFIG_HAVE_LEGACY_PER_CPU_AREA + static struct vmap_area *node_to_va(struct rb_node *n) + { + return n ? rb_entry(n, struct vmap_area, rb_node) : NULL; +@@ -2257,6 +2258,7 @@ err_free: + kfree(vms); + return NULL; + } ++#endif + + /** + * pcpu_free_vm_areas - free vmalloc areas for percpu allocator + + +From gregkh@mini.kroah.org Wed Dec 16 19:57:00 2009 +Message-Id: <20091217035700.108658513@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:09 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Zhao Yakui , + Venkatesh Pallipadi , + Len Brown +Subject: [132/151] ACPI: Use the ARB_DISABLE for the CPU which model id is less than 0x0f. + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Zhao Yakui + +commit 03a05ed1152944000151d57b71000de287a1eb02 upstream. + +Currently, ARB_DISABLE is a NOP on all of the recent Intel platforms. +For such platforms, reduce contention on c3_lock by skipping the fake +ARB_DISABLE. + +The cpu model id on one laptop is 14. If we disable ARB_DISABLE on this box, +the box can't be booted correctly. But if we still enable ARB_DISABLE on this +box, the box can be booted correctly. + +So we still use the ARB_DISABLE for the cpu which mode id is less than 0x0f. + +http://bugzilla.kernel.org/show_bug.cgi?id=14700 + +Signed-off-by: Zhao Yakui +Acked-by: Venkatesh Pallipadi +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/acpi/cstate.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/acpi/cstate.c ++++ b/arch/x86/kernel/acpi/cstate.c +@@ -48,7 +48,7 @@ void acpi_processor_power_init_bm_check( + * P4, Core and beyond CPUs + */ + if (c->x86_vendor == X86_VENDOR_INTEL && +- (c->x86 > 0xf || (c->x86 == 6 && c->x86_model >= 14))) ++ (c->x86 > 0xf || (c->x86 == 6 && c->x86_model >= 0x0f))) + flags->bm_control = 0; + } + EXPORT_SYMBOL(acpi_processor_power_init_bm_check); + + +From gregkh@mini.kroah.org Wed Dec 16 19:57:00 2009 +Message-Id: <20091217035700.235380354@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:10 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + David Miller +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + netdev@vger.kernel.org, + marcel@holtmann.org, + "Eric W. Biederman" +Subject: [133/151] net: Fix userspace RTM_NEWLINK notifications. + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +commit d90a909e1f3e006a1d57fe11fd417173b6494701 upstream. + +I received some bug reports about userspace programs having problems +because after RTM_NEWLINK was received they could not immeidate +access files under /proc/sys/net/ because they had not been +registered yet. + +The problem was trivailly fixed by moving the userspace +notification from rtnetlink_event to the end of register_netdevice. + +Signed-off-by: Eric W. Biederman +Cc: David Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/dev.c | 11 +++++++++++ + net/core/rtnetlink.c | 4 +--- + 2 files changed, 12 insertions(+), 3 deletions(-) + +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -4860,6 +4860,11 @@ int register_netdevice(struct net_device + rollback_registered(dev); + dev->reg_state = NETREG_UNREGISTERED; + } ++ /* ++ * Prevent userspace races by waiting until the network ++ * device is fully setup before sending notifications. ++ */ ++ rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U); + + out: + return ret; +@@ -5398,6 +5403,12 @@ int dev_change_net_namespace(struct net_ + /* Notify protocols, that a new device appeared. */ + call_netdevice_notifiers(NETDEV_REGISTER, dev); + ++ /* ++ * Prevent userspace races by waiting until the network ++ * device is fully setup before sending notifications. ++ */ ++ rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U); ++ + synchronize_net(); + err = 0; + out: +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -1334,13 +1334,11 @@ static int rtnetlink_event(struct notifi + case NETDEV_UNREGISTER: + rtmsg_ifinfo(RTM_DELLINK, dev, ~0U); + break; +- case NETDEV_REGISTER: +- rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U); +- break; + case NETDEV_UP: + case NETDEV_DOWN: + rtmsg_ifinfo(RTM_NEWLINK, dev, IFF_UP|IFF_RUNNING); + break; ++ case NETDEV_REGISTER: + case NETDEV_CHANGE: + case NETDEV_GOING_DOWN: + break; + + +From gregkh@mini.kroah.org Wed Dec 16 19:57:00 2009 +Message-Id: <20091217035700.373342675@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:11 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jan Kara +Subject: [134/151] ext3: Fix data / filesystem corruption when write fails to copy data + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jan Kara + +commit 68eb3db08344286733adac48304d9fb7a0e53b27 upstream. + +When ext3_write_begin fails after allocating some blocks or +generic_perform_write fails to copy data to write, we truncate blocks already +instantiated beyond i_size. Although these blocks were never inside i_size, we +have to truncate pagecache of these blocks so that corresponding buffers get +unmapped. Otherwise subsequent __block_prepare_write (called because we are +retrying the write) will find the buffers mapped, not call ->get_block, and +thus the page will be backed by already freed blocks leading to filesystem and +data corruption. + +Reported-by: James Y Knight +Signed-off-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext3/inode.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +--- a/fs/ext3/inode.c ++++ b/fs/ext3/inode.c +@@ -1151,6 +1151,16 @@ static int do_journal_get_write_access(h + return ext3_journal_get_write_access(handle, bh); + } + ++/* ++ * Truncate blocks that were not used by write. We have to truncate the ++ * pagecache as well so that corresponding buffers get properly unmapped. ++ */ ++static void ext3_truncate_failed_write(struct inode *inode) ++{ ++ truncate_inode_pages(inode->i_mapping, inode->i_size); ++ ext3_truncate(inode); ++} ++ + static int ext3_write_begin(struct file *file, struct address_space *mapping, + loff_t pos, unsigned len, unsigned flags, + struct page **pagep, void **fsdata) +@@ -1209,7 +1219,7 @@ write_begin_failed: + unlock_page(page); + page_cache_release(page); + if (pos + len > inode->i_size) +- ext3_truncate(inode); ++ ext3_truncate_failed_write(inode); + } + if (ret == -ENOSPC && ext3_should_retry_alloc(inode->i_sb, &retries)) + goto retry; +@@ -1304,7 +1314,7 @@ static int ext3_ordered_write_end(struct + page_cache_release(page); + + if (pos + len > inode->i_size) +- ext3_truncate(inode); ++ ext3_truncate_failed_write(inode); + return ret ? ret : copied; + } + +@@ -1330,7 +1340,7 @@ static int ext3_writeback_write_end(stru + page_cache_release(page); + + if (pos + len > inode->i_size) +- ext3_truncate(inode); ++ ext3_truncate_failed_write(inode); + return ret ? ret : copied; + } + +@@ -1383,7 +1393,7 @@ static int ext3_journalled_write_end(str + page_cache_release(page); + + if (pos + len > inode->i_size) +- ext3_truncate(inode); ++ ext3_truncate_failed_write(inode); + return ret ? ret : copied; + } + + + +From gregkh@mini.kroah.org Wed Dec 16 19:57:00 2009 +Message-Id: <20091217035700.492768373@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:12 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Rafal Milecki , + Jean-Francois Moine , + Mauro Carvalho Chehab , + Surbhi Palande +Subject: [135/151] V4L/DVB (13116): gspca - ov519: Webcam 041e:4067 added. + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Rafal Milecki + +commit 518c8df77c21b7d1690dd8b96eb0e54c4ec1c9c1 upstream. + +Signed-off-by: Rafal Milecki +Signed-off-by: Jean-Francois Moine +Signed-off-by: Mauro Carvalho Chehab +Cc: Surbhi Palande +Signed-off-by: Greg Kroah-Hartman + +--- a/Documentation/video4linux/gspca.txt ++++ b/Documentation/video4linux/gspca.txt +@@ -37,6 +37,7 @@ ov519 041e:405f Creative Live! VISTA VF0330 + ov519 041e:4060 Creative Live! VISTA VF0350 + ov519 041e:4061 Creative Live! VISTA VF0400 + ov519 041e:4064 Creative Live! VISTA VF0420 ++ov519 041e:4067 Creative Live! Cam Video IM (VF0350) + ov519 041e:4068 Creative Live! VISTA VF0470 + spca561 0458:7004 Genius VideoCAM Express V2 + sunplus 0458:7006 Genius Dsc 1.3 Smart +diff --git a/drivers/media/video/gspca/ov519.c b/drivers/media/video/gspca/ov519.c +index a5c190e..e165578 100644 +--- a/drivers/media/video/gspca/ov519.c ++++ b/drivers/media/video/gspca/ov519.c +@@ -3364,6 +3364,7 @@ static const __devinitdata struct usb_device_id device_table[] = { + {USB_DEVICE(0x041e, 0x4061), .driver_info = BRIDGE_OV519 }, + {USB_DEVICE(0x041e, 0x4064), + .driver_info = BRIDGE_OV519 | BRIDGE_INVERT_LED }, ++ {USB_DEVICE(0x041e, 0x4067), .driver_info = BRIDGE_OV519 }, + {USB_DEVICE(0x041e, 0x4068), + .driver_info = BRIDGE_OV519 | BRIDGE_INVERT_LED }, + {USB_DEVICE(0x045e, 0x028c), .driver_info = BRIDGE_OV519 }, + + +From gregkh@mini.kroah.org Wed Dec 16 19:57:00 2009 +Message-Id: <20091217035700.621604509@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:13 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Florian Fainelli , + "David S. Miller" +Subject: [136/151] bcm63xx_enet: fix compilation failure after get_stats_count removal + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Florian Fainelli + +commit a3f92eea04101d9a8e14d50f8048cc5b7bca07a8 upstream. + +This patch converts bcm63xx_enet to uset get_sset_count +like the other drivers do. + +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/bcm63xx_enet.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +--- a/drivers/net/bcm63xx_enet.c ++++ b/drivers/net/bcm63xx_enet.c +@@ -1248,9 +1248,15 @@ static void bcm_enet_get_drvinfo(struct + drvinfo->n_stats = BCM_ENET_STATS_LEN; + } + +-static int bcm_enet_get_stats_count(struct net_device *netdev) ++static int bcm_enet_get_sset_count(struct net_device *netdev, ++ int string_set) + { +- return BCM_ENET_STATS_LEN; ++ switch (string_set) { ++ case ETH_SS_STATS: ++ return BCM_ENET_STATS_LEN; ++ default: ++ return -EINVAL; ++ } + } + + static void bcm_enet_get_strings(struct net_device *netdev, +@@ -1476,7 +1482,7 @@ static int bcm_enet_set_pauseparam(struc + + static struct ethtool_ops bcm_enet_ethtool_ops = { + .get_strings = bcm_enet_get_strings, +- .get_stats_count = bcm_enet_get_stats_count, ++ .get_sset_count = bcm_enet_get_sset_count, + .get_ethtool_stats = bcm_enet_get_ethtool_stats, + .get_settings = bcm_enet_get_settings, + .set_settings = bcm_enet_set_settings, + + +From gregkh@mini.kroah.org Wed Dec 16 19:57:00 2009 +Message-Id: <20091217035700.760145113@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:14 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Greg KH +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Yong Wang , + Borislav Petkov , + Arjan van de Ven , + Ingo Molnar +Subject: [137/151] x86: Under BIOS control, restore APs APIC_LVTTHMR to the BSP value + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Yong Wang + +Upstream commit a2202aa29289db64ca7988b12343158b67b27f10. + +On platforms where bios handles the thermal monitor interrupt, +APIC_LVTTHMR on each logical CPU is programmed to generate a SMI and OS +can't touch it. + +Unfortunately AP bringup sequence using INIT-SIPI-SIPI clear all +the LVT entries except the mask bit. Essentially this results in +all LVT entries including the thermal monitoring interrupt set to masked +(clearing the bios programmed value for APIC_LVTTHMR). + +And this leads to kernel take over the thermal monitoring interrupt +on AP's but not on BSP (leaving the bios programmed value only on BSP). + +As a result of this, we have seen system hangs when the thermal +monitoring interrupt is generated. + +Fix this by reading the initial value of thermal LVT entry on BSP +and if bios has taken over the control, then program the same value +on all AP's and leave the thermal monitoring interrupt control +on all the logical cpu's to the bios. + +Signed-off-by: Yong Wang +Reviewed-by: Suresh Siddha +Cc: Borislav Petkov +Cc: Arjan van de Ven +LKML-Reference: <20091110013824.GA24940@ywang-moblin2.bj.intel.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/include/asm/mce.h | 6 ++++++ + arch/x86/kernel/cpu/mcheck/therm_throt.c | 29 ++++++++++++++++++++++++++++- + arch/x86/kernel/setup.c | 3 +++ + 3 files changed, 37 insertions(+), 1 deletion(-) + +--- a/arch/x86/include/asm/mce.h ++++ b/arch/x86/include/asm/mce.h +@@ -214,5 +214,11 @@ void intel_init_thermal(struct cpuinfo_x + + void mce_log_therm_throt_event(__u64 status); + ++#ifdef CONFIG_X86_THERMAL_VECTOR ++extern void mcheck_intel_therm_init(void); ++#else ++static inline void mcheck_intel_therm_init(void) { } ++#endif ++ + #endif /* __KERNEL__ */ + #endif /* _ASM_X86_MCE_H */ +--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c ++++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c +@@ -49,6 +49,8 @@ static DEFINE_PER_CPU(struct thermal_sta + + static atomic_t therm_throt_en = ATOMIC_INIT(0); + ++static u32 lvtthmr_init __read_mostly; ++ + #ifdef CONFIG_SYSFS + #define define_therm_throt_sysdev_one_ro(_name) \ + static SYSDEV_ATTR(_name, 0444, therm_throt_sysdev_show_##_name, NULL) +@@ -254,6 +256,18 @@ asmlinkage void smp_thermal_interrupt(st + ack_APIC_irq(); + } + ++void __init mcheck_intel_therm_init(void) ++{ ++ /* ++ * This function is only called on boot CPU. Save the init thermal ++ * LVT value on BSP and use that value to restore APs' thermal LVT ++ * entry BIOS programmed later ++ */ ++ if (cpu_has(&boot_cpu_data, X86_FEATURE_ACPI) && ++ cpu_has(&boot_cpu_data, X86_FEATURE_ACC)) ++ lvtthmr_init = apic_read(APIC_LVTTHMR); ++} ++ + void intel_init_thermal(struct cpuinfo_x86 *c) + { + unsigned int cpu = smp_processor_id(); +@@ -270,7 +284,20 @@ void intel_init_thermal(struct cpuinfo_x + * since it might be delivered via SMI already: + */ + rdmsr(MSR_IA32_MISC_ENABLE, l, h); +- h = apic_read(APIC_LVTTHMR); ++ ++ /* ++ * The initial value of thermal LVT entries on all APs always reads ++ * 0x10000 because APs are woken up by BSP issuing INIT-SIPI-SIPI ++ * sequence to them and LVT registers are reset to 0s except for ++ * the mask bits which are set to 1s when APs receive INIT IPI. ++ * Always restore the value that BIOS has programmed on AP based on ++ * BSP's info we saved since BIOS is always setting the same value ++ * for all threads/cores ++ */ ++ apic_write(APIC_LVTTHMR, lvtthmr_init); ++ ++ h = lvtthmr_init; ++ + if ((l & MSR_IA32_MISC_ENABLE_TM1) && (h & APIC_DM_SMI)) { + printk(KERN_DEBUG + "CPU%d: Thermal monitoring handled by SMI\n", cpu); +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -109,6 +109,7 @@ + #ifdef CONFIG_X86_64 + #include + #endif ++#include + + /* + * end_pfn only includes RAM, while max_pfn_mapped includes all e820 entries. +@@ -1031,6 +1032,8 @@ void __init setup_arch(char **cmdline_p) + #endif + #endif + x86_init.oem.banner(); ++ ++ mcheck_intel_therm_init(); + } + + #ifdef CONFIG_X86_32 + + +From gregkh@mini.kroah.org Wed Dec 16 19:57:01 2009 +Message-Id: <20091217035700.890391616@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:15 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Chris Wilson , + David Woodhouse , + Zhenyu Wang , + Zhenyu Wang , + Eric Anholt +Subject: [138/151] drm/i915: Avoid NULL dereference with component_only tv_modes + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Chris Wilson + +commit d271817baecbccb47da0d9f28c285a0dae8a06b7 upstream. + +In commit d2d9f2324, the guard for a valid video mode was removed. This +caused the regression: + + kernel crash during kms graphic boot on Intel GM4500 platform + https://bugzilla.redhat.com/show_bug.cgi?id=540218 + +This patches changes the logic slightly not to rely on a coupled +variable, but to just check whether the video_modes is valid before +dereferencing. + +Signed-off-by: Chris Wilson +Cc: David Woodhouse +Cc: Zhenyu Wang +[ickle: Actually reference the correct bug report] +Acked-by: Zhenyu Wang +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_tv.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_tv.c ++++ b/drivers/gpu/drm/i915/intel_tv.c +@@ -1213,20 +1213,17 @@ intel_tv_mode_set(struct drm_encoder *en + tv_ctl |= TV_TRILEVEL_SYNC; + if (tv_mode->pal_burst) + tv_ctl |= TV_PAL_BURST; ++ + scctl1 = 0; +- /* dda1 implies valid video levels */ +- if (tv_mode->dda1_inc) { ++ if (tv_mode->dda1_inc) + scctl1 |= TV_SC_DDA1_EN; +- } +- + if (tv_mode->dda2_inc) + scctl1 |= TV_SC_DDA2_EN; +- + if (tv_mode->dda3_inc) + scctl1 |= TV_SC_DDA3_EN; +- + scctl1 |= tv_mode->sc_reset; +- scctl1 |= video_levels->burst << TV_BURST_LEVEL_SHIFT; ++ if (video_levels) ++ scctl1 |= video_levels->burst << TV_BURST_LEVEL_SHIFT; + scctl1 |= tv_mode->dda1_inc << TV_SCDDA1_INC_SHIFT; + + scctl2 = tv_mode->dda2_size << TV_SCDDA2_SIZE_SHIFT | + + +From gregkh@mini.kroah.org Wed Dec 16 19:57:01 2009 +Message-Id: <20091217035701.039621306@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:16 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Shaohua Li , + Zhenyu Wang , + Eric Anholt +Subject: [139/151] drm/i915: PineView only has LVDS and CRT ports + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Zhenyu Wang + +commit 103a196f4224dc6872081305cf7f82ebf67aa7bd upstream. + +PineView only has 2 ports for LVDS and CRT. Don't enable other +ports for it. + +Cc: Shaohua Li +Signed-off-by: Zhenyu Wang +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_drv.h | 4 ++++ + drivers/gpu/drm/i915/intel_display.c | 6 +++--- + 2 files changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -957,6 +957,7 @@ extern int i915_wait_ring(struct drm_dev + #define IS_I85X(dev) ((dev)->pci_device == 0x3582) + #define IS_I855(dev) ((dev)->pci_device == 0x3582) + #define IS_I865G(dev) ((dev)->pci_device == 0x2572) ++#define IS_I8XX(dev) (IS_I830(dev) || IS_845G(dev) || IS_I85X(dev) || IS_I865G(dev)) + + #define IS_I915G(dev) ((dev)->pci_device == 0x2582 || (dev)->pci_device == 0x258a) + #define IS_I915GM(dev) ((dev)->pci_device == 0x2592) +@@ -1018,9 +1019,12 @@ extern int i915_wait_ring(struct drm_dev + */ + #define HAS_128_BYTE_Y_TILING(dev) (IS_I9XX(dev) && !(IS_I915G(dev) || \ + IS_I915GM(dev))) ++#define SUPPORTS_DIGITAL_OUTPUTS(dev) (IS_I9XX(dev) && !IS_IGD(dev)) + #define SUPPORTS_INTEGRATED_HDMI(dev) (IS_G4X(dev) || IS_IGDNG(dev)) + #define SUPPORTS_INTEGRATED_DP(dev) (IS_G4X(dev) || IS_IGDNG(dev)) + #define SUPPORTS_EDP(dev) (IS_IGDNG_M(dev)) ++#define SUPPORTS_TV(dev) (IS_I9XX(dev) && IS_MOBILE(dev) && \ ++ !IS_IGDNG(dev) && !IS_IGD(dev)) + #define I915_HAS_HOTPLUG(dev) (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev) || IS_I965G(dev)) + /* dsparb controlled by hw only */ + #define DSPARB_HWCONTROL(dev) (IS_G4X(dev) || IS_IGDNG(dev)) +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -4119,7 +4119,7 @@ static void intel_setup_outputs(struct d + if (I915_READ(PCH_DP_D) & DP_DETECTED) + intel_dp_init(dev, PCH_DP_D); + +- } else if (IS_I9XX(dev)) { ++ } else if (SUPPORTS_DIGITAL_OUTPUTS(dev)) { + bool found = false; + + if (I915_READ(SDVOB) & SDVO_DETECTED) { +@@ -4146,10 +4146,10 @@ static void intel_setup_outputs(struct d + + if (SUPPORTS_INTEGRATED_DP(dev) && (I915_READ(DP_D) & DP_DETECTED)) + intel_dp_init(dev, DP_D); +- } else ++ } else if (IS_I8XX(dev)) + intel_dvo_init(dev); + +- if (IS_I9XX(dev) && IS_MOBILE(dev) && !IS_IGDNG(dev)) ++ if (SUPPORTS_TV(dev)) + intel_tv_init(dev); + + list_for_each_entry(connector, &dev->mode_config.connector_list, head) { + + +From gregkh@mini.kroah.org Wed Dec 16 19:57:01 2009 +Message-Id: <20091217035701.150467114@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:17 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Zhenyu Wang , + Eric Anholt +Subject: [140/151] drm/i915: Fix LVDS stability issue on Ironlake + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Zhenyu Wang + +commit 1b3c7a47f993bf9ab6c4c7cc3bbf5588052b58f4 upstream. + +In disable sequence, all output ports on PCH have to be disabled +before PCH transcoder, but LVDS port was left always enabled. This +one fixes that by disable LVDS port properly during pipe disable +process, and resolved stability issue seen on Ironlake. Also move +panel fitting disable time just after pipe disable to align with +the spec. + +Signed-off-by: Zhenyu Wang +Signed-off-by: Eric Anholt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_display.c | 60 +++++++++++++++++++++++------------ + 1 file changed, 41 insertions(+), 19 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -1482,6 +1482,15 @@ static void igdng_crtc_dpms(struct drm_c + case DRM_MODE_DPMS_STANDBY: + case DRM_MODE_DPMS_SUSPEND: + DRM_DEBUG("crtc %d dpms on\n", pipe); ++ ++ if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) { ++ temp = I915_READ(PCH_LVDS); ++ if ((temp & LVDS_PORT_EN) == 0) { ++ I915_WRITE(PCH_LVDS, temp | LVDS_PORT_EN); ++ POSTING_READ(PCH_LVDS); ++ } ++ } ++ + if (HAS_eDP) { + /* enable eDP PLL */ + igdng_enable_pll_edp(crtc); +@@ -1666,8 +1675,6 @@ static void igdng_crtc_dpms(struct drm_c + case DRM_MODE_DPMS_OFF: + DRM_DEBUG("crtc %d dpms off\n", pipe); + +- i915_disable_vga(dev); +- + /* Disable display plane */ + temp = I915_READ(dspcntr_reg); + if ((temp & DISPLAY_PLANE_ENABLE) != 0) { +@@ -1677,6 +1684,8 @@ static void igdng_crtc_dpms(struct drm_c + I915_READ(dspbase_reg); + } + ++ i915_disable_vga(dev); ++ + /* disable cpu pipe, disable after all planes disabled */ + temp = I915_READ(pipeconf_reg); + if ((temp & PIPEACONF_ENABLE) != 0) { +@@ -1697,9 +1706,15 @@ static void igdng_crtc_dpms(struct drm_c + } else + DRM_DEBUG("crtc %d is disabled\n", pipe); + +- if (HAS_eDP) { +- igdng_disable_pll_edp(crtc); ++ udelay(100); ++ ++ /* Disable PF */ ++ temp = I915_READ(pf_ctl_reg); ++ if ((temp & PF_ENABLE) != 0) { ++ I915_WRITE(pf_ctl_reg, temp & ~PF_ENABLE); ++ I915_READ(pf_ctl_reg); + } ++ I915_WRITE(pf_win_size, 0); + + /* disable CPU FDI tx and PCH FDI rx */ + temp = I915_READ(fdi_tx_reg); +@@ -1725,6 +1740,13 @@ static void igdng_crtc_dpms(struct drm_c + + udelay(100); + ++ if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) { ++ temp = I915_READ(PCH_LVDS); ++ I915_WRITE(PCH_LVDS, temp & ~LVDS_PORT_EN); ++ I915_READ(PCH_LVDS); ++ udelay(100); ++ } ++ + /* disable PCH transcoder */ + temp = I915_READ(transconf_reg); + if ((temp & TRANS_ENABLE) != 0) { +@@ -1744,6 +1766,8 @@ static void igdng_crtc_dpms(struct drm_c + } + } + ++ udelay(100); ++ + /* disable PCH DPLL */ + temp = I915_READ(pch_dpll_reg); + if ((temp & DPLL_VCO_ENABLE) != 0) { +@@ -1751,14 +1775,20 @@ static void igdng_crtc_dpms(struct drm_c + I915_READ(pch_dpll_reg); + } + +- temp = I915_READ(fdi_rx_reg); +- if ((temp & FDI_RX_PLL_ENABLE) != 0) { +- temp &= ~FDI_SEL_PCDCLK; +- temp &= ~FDI_RX_PLL_ENABLE; +- I915_WRITE(fdi_rx_reg, temp); +- I915_READ(fdi_rx_reg); ++ if (HAS_eDP) { ++ igdng_disable_pll_edp(crtc); + } + ++ temp = I915_READ(fdi_rx_reg); ++ temp &= ~FDI_SEL_PCDCLK; ++ I915_WRITE(fdi_rx_reg, temp); ++ I915_READ(fdi_rx_reg); ++ ++ temp = I915_READ(fdi_rx_reg); ++ temp &= ~FDI_RX_PLL_ENABLE; ++ I915_WRITE(fdi_rx_reg, temp); ++ I915_READ(fdi_rx_reg); ++ + /* Disable CPU FDI TX PLL */ + temp = I915_READ(fdi_tx_reg); + if ((temp & FDI_TX_PLL_ENABLE) != 0) { +@@ -1767,16 +1797,8 @@ static void igdng_crtc_dpms(struct drm_c + udelay(100); + } + +- /* Disable PF */ +- temp = I915_READ(pf_ctl_reg); +- if ((temp & PF_ENABLE) != 0) { +- I915_WRITE(pf_ctl_reg, temp & ~PF_ENABLE); +- I915_READ(pf_ctl_reg); +- } +- I915_WRITE(pf_win_size, 0); +- + /* Wait for the clocks to turn off. */ +- udelay(150); ++ udelay(100); + break; + } + } + + +From gregkh@mini.kroah.org Wed Dec 16 19:57:01 2009 +Message-Id: <20091217035701.281685524@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:18 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Hugh Dickins , + Izik Eidus , + Andrea Arcangeli , + Nick Piggin , + Rik van Riel , + Lee Schermerhorn , + Andi Kleen +Subject: [141/151] mm: sigbus instead of abusing oom + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Hugh Dickins + +commit d99be1a8ecf377c2c9b3372d36411ad6547bbd4c upstream. + +When do_nonlinear_fault() realizes that the page table must have been +corrupted for it to have been called, it does print_bad_pte() and returns +... VM_FAULT_OOM, which is hard to understand. + +It made some sense when I did it for 2.6.15, when do_page_fault() just +killed the current process; but nowadays it lets the OOM killer decide who +to kill - so page table corruption in one process would be liable to kill +another. + +Change it to return VM_FAULT_SIGBUS instead: that doesn't guarantee that +the process will be killed, but is good enough for such a rare +abnormality, accompanied as it is by the "BUG: Bad page map" message. + +And recent HWPOISON work has copied that code into do_swap_page(), when it +finds an impossible swap entry: fix that to VM_FAULT_SIGBUS too. + +Signed-off-by: Hugh Dickins +Cc: Izik Eidus +Cc: Andrea Arcangeli +Cc: Nick Piggin +Reviewed-by: KOSAKI Motohiro +Cc: Rik van Riel +Cc: Lee Schermerhorn +Cc: Andi Kleen +Reviewed-by: KAMEZAWA Hiroyuki +Reviewed-by: Wu Fengguang +Reviewed-by: Minchan Kim +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/memory.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -2514,7 +2514,7 @@ static int do_swap_page(struct mm_struct + ret = VM_FAULT_HWPOISON; + } else { + print_bad_pte(vma, address, orig_pte, NULL); +- ret = VM_FAULT_OOM; ++ ret = VM_FAULT_SIGBUS; + } + goto out; + } +@@ -2910,7 +2910,7 @@ static int do_nonlinear_fault(struct mm_ + * Page table corrupted: show pte and kill process. + */ + print_bad_pte(vma, address, orig_pte, NULL); +- return VM_FAULT_OOM; ++ return VM_FAULT_SIGBUS; + } + + pgoff = pte_to_pgoff(orig_pte); + + +From gregkh@mini.kroah.org Wed Dec 16 19:57:01 2009 +Message-Id: <20091217035701.412090427@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:19 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Deon van der Merwe , + Julian Anastasov , + Simon Horman , + Patrick McHardy +Subject: [142/151] ipvs: zero usvc and udest + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Simon Horman + +commit 258c889362aa95d0ab534b38ce8c15d3009705b1 upstream. + +Make sure that any otherwise uninitialised fields of usvc are zero. + +This has been obvserved to cause a problem whereby the port of +fwmark services may end up as a non-zero value which causes +scheduling of a destination server to fail for persisitent services. + +As observed by Deon van der Merwe . +This fix suggested by Julian Anastasov . + +For good measure also zero udest. + +Cc: Deon van der Merwe +Acked-by: Julian Anastasov +Signed-off-by: Simon Horman +Signed-off-by: Patrick McHardy +Signed-off-by: Greg Kroah-Hartman + +--- + net/netfilter/ipvs/ip_vs_ctl.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/net/netfilter/ipvs/ip_vs_ctl.c ++++ b/net/netfilter/ipvs/ip_vs_ctl.c +@@ -2714,6 +2714,8 @@ static int ip_vs_genl_parse_service(stru + if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr)))) + return -EINVAL; + ++ memset(usvc, 0, sizeof(*usvc)); ++ + usvc->af = nla_get_u16(nla_af); + #ifdef CONFIG_IP_VS_IPV6 + if (usvc->af != AF_INET && usvc->af != AF_INET6) +@@ -2901,6 +2903,8 @@ static int ip_vs_genl_parse_dest(struct + if (!(nla_addr && nla_port)) + return -EINVAL; + ++ memset(udest, 0, sizeof(*udest)); ++ + nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr)); + udest->port = nla_get_u16(nla_port); + + + +From gregkh@mini.kroah.org Wed Dec 16 19:57:01 2009 +Message-Id: <20091217035701.539163219@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:20 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + David Woodhouse +Subject: [143/151] jffs2: Fix long-standing bug with symlink garbage collection. + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: David Woodhouse + +commit 2e16cfca6e17ae37ae21feca080a6f2eca9087dc upstream. + +Ever since jffs2_garbage_collect_metadata() was first half-written in +February 2001, it's been broken on architectures where 'char' is signed. +When garbage collecting a symlink with target length above 127, the payload +length would end up negative, causing interesting and bad things to happen. + +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + fs/jffs2/gc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/jffs2/gc.c ++++ b/fs/jffs2/gc.c +@@ -700,7 +700,8 @@ static int jffs2_garbage_collect_metadat + struct jffs2_raw_inode ri; + struct jffs2_node_frag *last_frag; + union jffs2_device_node dev; +- char *mdata = NULL, mdatalen = 0; ++ char *mdata = NULL; ++ int mdatalen = 0; + uint32_t alloclen, ilen; + int ret; + + + +From gregkh@mini.kroah.org Wed Dec 16 19:57:01 2009 +Message-Id: <20091217035701.669572591@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:21 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Chris Wright , + David Woodhouse +Subject: [144/151] intel-iommu: Detect DMAR in hyperspace at probe time. + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Chris Wright + +commit 2c99220810c1c79322034628b993573b088ff2da upstream. + +Many BIOSes will lie to us about the existence of an IOMMU, and claim +that there is one at an address which actually returns all 0xFF. + +We need to detect this early, so that we know we don't have a viable +IOMMU and can set up swiotlb before it's too late. + +Signed-off-by: Chris Wright +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/dmar.c | 34 +++++++++++++++++++++++++++++----- + 1 file changed, 29 insertions(+), 5 deletions(-) + +--- a/drivers/pci/dmar.c ++++ b/drivers/pci/dmar.c +@@ -601,6 +601,9 @@ int __init check_zero_address(void) + } + + if (entry_header->type == ACPI_DMAR_TYPE_HARDWARE_UNIT) { ++ void __iomem *addr; ++ u64 cap, ecap; ++ + drhd = (void *)entry_header; + if (!drhd->address) { + /* Promote an attitude of violence to a BIOS engineer today */ +@@ -609,17 +612,38 @@ int __init check_zero_address(void) + dmi_get_system_info(DMI_BIOS_VENDOR), + dmi_get_system_info(DMI_BIOS_VERSION), + dmi_get_system_info(DMI_PRODUCT_VERSION)); +-#ifdef CONFIG_DMAR +- dmar_disabled = 1; +-#endif +- return 0; ++ goto failed; ++ } ++ ++ addr = early_ioremap(drhd->address, VTD_PAGE_SIZE); ++ if (!addr ) { ++ printk("IOMMU: can't validate: %llx\n", drhd->address); ++ goto failed; ++ } ++ cap = dmar_readq(addr + DMAR_CAP_REG); ++ ecap = dmar_readq(addr + DMAR_ECAP_REG); ++ early_iounmap(addr, VTD_PAGE_SIZE); ++ if (cap == (uint64_t)-1 && ecap == (uint64_t)-1) { ++ /* Promote an attitude of violence to a BIOS engineer today */ ++ WARN(1, "Your BIOS is broken; DMAR reported at address %llx returns all ones!\n" ++ "BIOS vendor: %s; Ver: %s; Product Version: %s\n", ++ drhd->address, ++ dmi_get_system_info(DMI_BIOS_VENDOR), ++ dmi_get_system_info(DMI_BIOS_VERSION), ++ dmi_get_system_info(DMI_PRODUCT_VERSION)); ++ goto failed; + } +- break; + } + + entry_header = ((void *)entry_header + entry_header->length); + } + return 1; ++ ++failed: ++#ifdef CONFIG_DMAR ++ dmar_disabled = 1; ++#endif ++ return 0; + } + + void __init detect_intel_iommu(void) + + +From gregkh@mini.kroah.org Wed Dec 16 19:57:01 2009 +Message-Id: <20091217035701.797183647@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:22 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + David Woodhouse +Subject: [145/151] intel-iommu: Apply BIOS sanity checks for interrupt remapping too. + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: David Woodhouse + +commit 6ecbf01c7ce4c0f4c3bdfa0e64ac6258328fda6c upstream. + +The BIOS errors where an IOMMU is reported either at zero or a bogus +address are causing problems even when the IOMMU is disabled -- because +interrupt remapping uses the same hardware. Ensure that the checks get +applied for the interrupt remapping initialisation too. + +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/dmar.c | 33 ++++++++++++++++++++++++++------- + 1 file changed, 26 insertions(+), 7 deletions(-) + +--- a/drivers/pci/dmar.c ++++ b/drivers/pci/dmar.c +@@ -582,6 +582,8 @@ int __init dmar_table_init(void) + return 0; + } + ++static int bios_warned; ++ + int __init check_zero_address(void) + { + struct acpi_table_dmar *dmar; +@@ -612,6 +614,7 @@ int __init check_zero_address(void) + dmi_get_system_info(DMI_BIOS_VENDOR), + dmi_get_system_info(DMI_BIOS_VERSION), + dmi_get_system_info(DMI_PRODUCT_VERSION)); ++ bios_warned = 1; + goto failed; + } + +@@ -631,6 +634,7 @@ int __init check_zero_address(void) + dmi_get_system_info(DMI_BIOS_VENDOR), + dmi_get_system_info(DMI_BIOS_VERSION), + dmi_get_system_info(DMI_PRODUCT_VERSION)); ++ bios_warned = 1; + goto failed; + } + } +@@ -688,6 +692,18 @@ int alloc_iommu(struct dmar_drhd_unit *d + int agaw = 0; + int msagaw = 0; + ++ if (!drhd->reg_base_addr) { ++ if (!bios_warned) { ++ WARN(1, "Your BIOS is broken; DMAR reported at address zero!\n" ++ "BIOS vendor: %s; Ver: %s; Product Version: %s\n", ++ dmi_get_system_info(DMI_BIOS_VENDOR), ++ dmi_get_system_info(DMI_BIOS_VERSION), ++ dmi_get_system_info(DMI_PRODUCT_VERSION)); ++ bios_warned = 1; ++ } ++ return -EINVAL; ++ } ++ + iommu = kzalloc(sizeof(*iommu), GFP_KERNEL); + if (!iommu) + return -ENOMEM; +@@ -704,13 +720,16 @@ int alloc_iommu(struct dmar_drhd_unit *d + iommu->ecap = dmar_readq(iommu->reg + DMAR_ECAP_REG); + + if (iommu->cap == (uint64_t)-1 && iommu->ecap == (uint64_t)-1) { +- /* Promote an attitude of violence to a BIOS engineer today */ +- WARN(1, "Your BIOS is broken; DMAR reported at address %llx returns all ones!\n" +- "BIOS vendor: %s; Ver: %s; Product Version: %s\n", +- drhd->reg_base_addr, +- dmi_get_system_info(DMI_BIOS_VENDOR), +- dmi_get_system_info(DMI_BIOS_VERSION), +- dmi_get_system_info(DMI_PRODUCT_VERSION)); ++ if (!bios_warned) { ++ /* Promote an attitude of violence to a BIOS engineer today */ ++ WARN(1, "Your BIOS is broken; DMAR reported at address %llx returns all ones!\n" ++ "BIOS vendor: %s; Ver: %s; Product Version: %s\n", ++ drhd->reg_base_addr, ++ dmi_get_system_info(DMI_BIOS_VENDOR), ++ dmi_get_system_info(DMI_BIOS_VERSION), ++ dmi_get_system_info(DMI_PRODUCT_VERSION)); ++ bios_warned = 1; ++ } + goto err_unmap; + } + + + +From gregkh@mini.kroah.org Wed Dec 16 19:57:02 2009 +Message-Id: <20091217035701.923132279@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:23 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + David Woodhouse +Subject: [146/151] intel-iommu: Check for an RMRR which ends before it starts. + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: David Woodhouse + +commit 5595b528b49a702c0428c0762bab60999648254c upstream. + +Some HP BIOSes report an RMRR region (a region which needs a 1:1 mapping +in the IOMMU for a given device) which has an end address lower than its +start address. Detect that and warn, rather than triggering the +BUG() in dma_pte_clear_range(). + +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/intel-iommu.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/pci/intel-iommu.c ++++ b/drivers/pci/intel-iommu.c +@@ -1991,6 +1991,16 @@ static int iommu_prepare_identity_map(st + "IOMMU: Setting identity map for device %s [0x%Lx - 0x%Lx]\n", + pci_name(pdev), start, end); + ++ if (end < start) { ++ WARN(1, "Your BIOS is broken; RMRR ends before it starts!\n" ++ "BIOS vendor: %s; Ver: %s; Product Version: %s\n", ++ dmi_get_system_info(DMI_BIOS_VENDOR), ++ dmi_get_system_info(DMI_BIOS_VERSION), ++ dmi_get_system_info(DMI_PRODUCT_VERSION)); ++ ret = -EIO; ++ goto error; ++ } ++ + if (end >> agaw_to_width(domain->agaw)) { + WARN(1, "Your BIOS is broken; RMRR exceeds permitted address width (%d bits)\n" + "BIOS vendor: %s; Ver: %s; Product Version: %s\n", + + +From gregkh@mini.kroah.org Wed Dec 16 19:57:02 2009 +Message-Id: <20091217035702.052247918@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:24 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + David Woodhouse +Subject: [147/151] intel-iommu: Fix oops with intel_iommu=igfx_off + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: David Woodhouse + +commit 44cd613c0e4cd93079ea2a93aa06649d8ca0830a upstream. + +The hotplug notifier will call find_domain() to see if the device in +question has been assigned an IOMMU domain. However, this should never +be called for devices with a "dummy" domain, such as graphics devices +when intel_iommu=igfx_off is set and the corresponding IOMMU isn't even +initialised. If you do that, it'll oops as it dereferences the (-1) +pointer. + +The notifier function should check iommu_no_mapping() for the +device before doing anything else. + +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/intel-iommu.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/pci/intel-iommu.c ++++ b/drivers/pci/intel-iommu.c +@@ -3238,6 +3238,9 @@ static int device_notifier(struct notifi + struct pci_dev *pdev = to_pci_dev(dev); + struct dmar_domain *domain; + ++ if (iommu_no_mapping(dev)) ++ return 0; ++ + domain = find_domain(pdev); + if (!domain) + return 0; + + +From gregkh@mini.kroah.org Wed Dec 16 19:57:02 2009 +Message-Id: <20091217035702.183430151@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:25 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Chris Wright , + David Woodhouse +Subject: [148/151] intel-iommu: ignore page table validation in pass through mode + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Chris Wright + +commit 1672af1164d3d50ba8908014fd34cc0b58afdc1e upstream. + +We are seeing a bug when booting w/ iommu=pt with current upstream +(bisect blames 19943b0e30b05d42e494ae6fef78156ebc8c637e "intel-iommu: +Unify hardware and software passthrough support). + +The issue is specific to this loop during identity map initialization +of each device: + +domain_context_mapping_one(si_domain, ..., CONTEXT_TT_PASS_THROUGH) +... + /* Skip top levels of page tables for + * iommu which has less agaw than default. + */ + for (agaw = domain->agaw; agaw != iommu->agaw; agaw--) { + pgd = phys_to_virt(dma_pte_addr(pgd)); + if (!dma_pte_present(pgd)) { <------ failing here + spin_unlock_irqrestore(&iommu->lock, flags); + return -ENOMEM; + } + +This box has 2 iommu's in it. The catchall iommu has MGAW == 48, and +SAGAW == 4. The other iommu has MGAW == 39, SAGAW == 2. + +The device that's failing the above pgd test is the only device connected +to the non-catchall iommu, which has a smaller address width than the +domain default. This test is not necessary since the context is in PT +mode and the ASR is ignored. + +Thanks to Don Dutile for discovering and debugging this one. + +Signed-off-by: Chris Wright +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/intel-iommu.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/pci/intel-iommu.c ++++ b/drivers/pci/intel-iommu.c +@@ -1523,12 +1523,15 @@ static int domain_context_mapping_one(st + + /* Skip top levels of page tables for + * iommu which has less agaw than default. ++ * Unnecessary for PT mode. + */ +- for (agaw = domain->agaw; agaw != iommu->agaw; agaw--) { +- pgd = phys_to_virt(dma_pte_addr(pgd)); +- if (!dma_pte_present(pgd)) { +- spin_unlock_irqrestore(&iommu->lock, flags); +- return -ENOMEM; ++ if (translation != CONTEXT_TT_PASS_THROUGH) { ++ for (agaw = domain->agaw; agaw != iommu->agaw; agaw--) { ++ pgd = phys_to_virt(dma_pte_addr(pgd)); ++ if (!dma_pte_present(pgd)) { ++ spin_unlock_irqrestore(&iommu->lock, flags); ++ return -ENOMEM; ++ } + } + } + } + + +From gregkh@mini.kroah.org Wed Dec 16 19:57:02 2009 +Message-Id: <20091217035702.312208598@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:26 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jan Engelhardt , + Patrick McHardy +Subject: [149/151] netfilter: xtables: document minimal required version + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Jan Engelhardt + +commit 7a92263705435d046d37a0990d0edfcb517f7ad3 upstream. + +For both .33 and .32-stable. + +Signed-off-by: Jan Engelhardt +Signed-off-by: Patrick McHardy +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/Changes | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/Documentation/Changes ++++ b/Documentation/Changes +@@ -49,6 +49,8 @@ o oprofile 0.9 + o udev 081 # udevinfo -V + o grub 0.93 # grub --version + o mcelog 0.6 ++o iptables 1.4.1 # iptables -V ++ + + Kernel compilation + ================== + + +From gregkh@mini.kroah.org Wed Dec 16 19:57:02 2009 +Message-Id: <20091217035702.439056851@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:27 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Paul Mackerras , + Peter Zijlstra , + Ingo Molnar +Subject: [150/151] perf_event: Fix incorrect range check on cpu number + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Paul Mackerras + +commit 0f624e7e5625f4c30c836b7a5decfe2553582391 upstream. + +It is quite legitimate for CPUs to be numbered sparsely, meaning +that it possible for an online CPU to have a number which is +greater than the total count of possible CPUs. + +Currently find_get_context() has a sanity check on the cpu +number where it checks it against num_possible_cpus(). This +test can fail for a legitimate cpu number if the +cpu_possible_mask is sparsely populated. + +This fixes the problem by checking the CPU number against +nr_cpumask_bits instead, since that is the appropriate check to +ensure that the cpu number is same to pass to cpu_isset() +subsequently. + +Reported-by: Michael Neuling +Signed-off-by: Paul Mackerras +Tested-by: Michael Neuling +Acked-by: Peter Zijlstra +LKML-Reference: <20091215084032.GA18661@brick.ozlabs.ibm.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/perf_event.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/perf_event.c ++++ b/kernel/perf_event.c +@@ -1583,7 +1583,7 @@ static struct perf_event_context *find_g + if (perf_paranoid_cpu() && !capable(CAP_SYS_ADMIN)) + return ERR_PTR(-EACCES); + +- if (cpu < 0 || cpu > num_possible_cpus()) ++ if (cpu < 0 || cpu >= nr_cpumask_bits) + return ERR_PTR(-EINVAL); + + /* + + +From gregkh@mini.kroah.org Wed Dec 16 19:57:02 2009 +Message-Id: <20091217035702.569126308@mini.kroah.org> +User-Agent: quilt/0.48-1 +Date: Wed, 16 Dec 2009 19:57:28 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: stable-review@kernel.org, + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tony Luck , + David Woodhouse +Subject: [151/151] implement early_io{re,un}map for ia64 + +2.6.32-stable review patch. If anyone has any objections, please let us know. + +------------------ + +From: Luck, Tony + +commit cd7bcf32d42b15891620b3f1387a00178b54291a upstream. + +Needed for commit 2c992208 ("intel-iommu: Detect DMAR in hyperspace at +probe time.) to build on IA64. + +Signed-off-by: Tony Luck +Signed-off-by: David Woodhouse +Signed-off-by: Greg Kroah-Hartman + +--- + arch/ia64/include/asm/io.h | 2 ++ + arch/ia64/mm/ioremap.c | 11 +++++++++++ + 2 files changed, 13 insertions(+) + +--- a/arch/ia64/include/asm/io.h ++++ b/arch/ia64/include/asm/io.h +@@ -424,6 +424,8 @@ __writeq (unsigned long val, volatile vo + extern void __iomem * ioremap(unsigned long offset, unsigned long size); + extern void __iomem * ioremap_nocache (unsigned long offset, unsigned long size); + extern void iounmap (volatile void __iomem *addr); ++extern void __iomem * early_ioremap (unsigned long phys_addr, unsigned long size); ++extern void early_iounmap (volatile void __iomem *addr, unsigned long size); + + /* + * String version of IO memory access ops: +--- a/arch/ia64/mm/ioremap.c ++++ b/arch/ia64/mm/ioremap.c +@@ -22,6 +22,12 @@ __ioremap (unsigned long phys_addr) + } + + void __iomem * ++early_ioremap (unsigned long phys_addr, unsigned long size) ++{ ++ return __ioremap(phys_addr); ++} ++ ++void __iomem * + ioremap (unsigned long phys_addr, unsigned long size) + { + void __iomem *addr; +@@ -102,6 +108,11 @@ ioremap_nocache (unsigned long phys_addr + EXPORT_SYMBOL(ioremap_nocache); + + void ++early_iounmap (volatile void __iomem *addr, unsigned long size) ++{ ++} ++ ++void + iounmap (volatile void __iomem *addr) + { + if (REGION_NUMBER(addr) == RGN_GATE) + + diff --git a/queue-2.6.32/md-bitmap-protect-against-bitmap-removal-while-being-updated.patch b/review-2.6.32/md-bitmap-protect-against-bitmap-removal-while-being-updated.patch similarity index 100% rename from queue-2.6.32/md-bitmap-protect-against-bitmap-removal-while-being-updated.patch rename to review-2.6.32/md-bitmap-protect-against-bitmap-removal-while-being-updated.patch diff --git a/queue-2.6.32/memcg-fix-memory.memsw.usage_in_bytes-for-root-cgroup.patch b/review-2.6.32/memcg-fix-memory.memsw.usage_in_bytes-for-root-cgroup.patch similarity index 100% rename from queue-2.6.32/memcg-fix-memory.memsw.usage_in_bytes-for-root-cgroup.patch rename to review-2.6.32/memcg-fix-memory.memsw.usage_in_bytes-for-root-cgroup.patch diff --git a/queue-2.6.32/mm-hugetlb-fix-hugepage-memory-leak-in-mincore.patch b/review-2.6.32/mm-hugetlb-fix-hugepage-memory-leak-in-mincore.patch similarity index 100% rename from queue-2.6.32/mm-hugetlb-fix-hugepage-memory-leak-in-mincore.patch rename to review-2.6.32/mm-hugetlb-fix-hugepage-memory-leak-in-mincore.patch diff --git a/queue-2.6.32/mm-hugetlb-fix-hugepage-memory-leak-in-walk_page_range.patch b/review-2.6.32/mm-hugetlb-fix-hugepage-memory-leak-in-walk_page_range.patch similarity index 100% rename from queue-2.6.32/mm-hugetlb-fix-hugepage-memory-leak-in-walk_page_range.patch rename to review-2.6.32/mm-hugetlb-fix-hugepage-memory-leak-in-walk_page_range.patch diff --git a/queue-2.6.32/mm-sigbus-instead-of-abusing-oom.patch b/review-2.6.32/mm-sigbus-instead-of-abusing-oom.patch similarity index 100% rename from queue-2.6.32/mm-sigbus-instead-of-abusing-oom.patch rename to review-2.6.32/mm-sigbus-instead-of-abusing-oom.patch diff --git a/queue-2.6.32/net-fix-userspace-rtm_newlink-notifications.patch b/review-2.6.32/net-fix-userspace-rtm_newlink-notifications.patch similarity index 100% rename from queue-2.6.32/net-fix-userspace-rtm_newlink-notifications.patch rename to review-2.6.32/net-fix-userspace-rtm_newlink-notifications.patch diff --git a/queue-2.6.32/netfilter-xtables-document-minimal-required-version.patch b/review-2.6.32/netfilter-xtables-document-minimal-required-version.patch similarity index 100% rename from queue-2.6.32/netfilter-xtables-document-minimal-required-version.patch rename to review-2.6.32/netfilter-xtables-document-minimal-required-version.patch diff --git a/queue-2.6.32/nfs-fix-nfs_migrate_page.patch b/review-2.6.32/nfs-fix-nfs_migrate_page.patch similarity index 100% rename from queue-2.6.32/nfs-fix-nfs_migrate_page.patch rename to review-2.6.32/nfs-fix-nfs_migrate_page.patch diff --git a/queue-2.6.32/pata_hpt-37x-3x2n-fix-timing-register-masks-take-2.patch b/review-2.6.32/pata_hpt-37x-3x2n-fix-timing-register-masks-take-2.patch similarity index 100% rename from queue-2.6.32/pata_hpt-37x-3x2n-fix-timing-register-masks-take-2.patch rename to review-2.6.32/pata_hpt-37x-3x2n-fix-timing-register-masks-take-2.patch diff --git a/queue-2.6.32/perf-don-t-free-perf_mmap_data-until-work-has-been-done.patch b/review-2.6.32/perf-don-t-free-perf_mmap_data-until-work-has-been-done.patch similarity index 100% rename from queue-2.6.32/perf-don-t-free-perf_mmap_data-until-work-has-been-done.patch rename to review-2.6.32/perf-don-t-free-perf_mmap_data-until-work-has-been-done.patch diff --git a/queue-2.6.32/perf_event-fix-incorrect-range-check-on-cpu-number.patch b/review-2.6.32/perf_event-fix-incorrect-range-check-on-cpu-number.patch similarity index 100% rename from queue-2.6.32/perf_event-fix-incorrect-range-check-on-cpu-number.patch rename to review-2.6.32/perf_event-fix-incorrect-range-check-on-cpu-number.patch diff --git a/queue-2.6.32/perf_event-fix-invalid-type-in-ioctl-definition.patch b/review-2.6.32/perf_event-fix-invalid-type-in-ioctl-definition.patch similarity index 100% rename from queue-2.6.32/perf_event-fix-invalid-type-in-ioctl-definition.patch rename to review-2.6.32/perf_event-fix-invalid-type-in-ioctl-definition.patch diff --git a/queue-2.6.32/perf_event-initialize-data.period-in-perf_swevent_hrtimer.patch b/review-2.6.32/perf_event-initialize-data.period-in-perf_swevent_hrtimer.patch similarity index 100% rename from queue-2.6.32/perf_event-initialize-data.period-in-perf_swevent_hrtimer.patch rename to review-2.6.32/perf_event-initialize-data.period-in-perf_swevent_hrtimer.patch diff --git a/queue-2.6.32/pm-runtime-fix-lockdep-warning-in-__pm_runtime_set_status.patch b/review-2.6.32/pm-runtime-fix-lockdep-warning-in-__pm_runtime_set_status.patch similarity index 100% rename from queue-2.6.32/pm-runtime-fix-lockdep-warning-in-__pm_runtime_set_status.patch rename to review-2.6.32/pm-runtime-fix-lockdep-warning-in-__pm_runtime_set_status.patch diff --git a/queue-2.6.32/powerpc-fix-usage-of-64-bit-instruction-in-32-bit-altivec-code.patch b/review-2.6.32/powerpc-fix-usage-of-64-bit-instruction-in-32-bit-altivec-code.patch similarity index 100% rename from queue-2.6.32/powerpc-fix-usage-of-64-bit-instruction-in-32-bit-altivec-code.patch rename to review-2.6.32/powerpc-fix-usage-of-64-bit-instruction-in-32-bit-altivec-code.patch diff --git a/queue-2.6.32/powerpc-therm_adt746x-record-pwm-invert-bit-at-module-load-time.patch b/review-2.6.32/powerpc-therm_adt746x-record-pwm-invert-bit-at-module-load-time.patch similarity index 100% rename from queue-2.6.32/powerpc-therm_adt746x-record-pwm-invert-bit-at-module-load-time.patch rename to review-2.6.32/powerpc-therm_adt746x-record-pwm-invert-bit-at-module-load-time.patch diff --git a/queue-2.6.32/powerpc-windfarm-add-detection-for-second-cpu-pump.patch b/review-2.6.32/powerpc-windfarm-add-detection-for-second-cpu-pump.patch similarity index 100% rename from queue-2.6.32/powerpc-windfarm-add-detection-for-second-cpu-pump.patch rename to review-2.6.32/powerpc-windfarm-add-detection-for-second-cpu-pump.patch diff --git a/queue-2.6.32/pxa-em-x270-fix-usb-hub-power-up-reset-sequence.patch b/review-2.6.32/pxa-em-x270-fix-usb-hub-power-up-reset-sequence.patch similarity index 100% rename from queue-2.6.32/pxa-em-x270-fix-usb-hub-power-up-reset-sequence.patch rename to review-2.6.32/pxa-em-x270-fix-usb-hub-power-up-reset-sequence.patch diff --git a/queue-2.6.32/rcu-fix-note_new_gpnum-uses-of-gpnum.patch b/review-2.6.32/rcu-fix-note_new_gpnum-uses-of-gpnum.patch similarity index 100% rename from queue-2.6.32/rcu-fix-note_new_gpnum-uses-of-gpnum.patch rename to review-2.6.32/rcu-fix-note_new_gpnum-uses-of-gpnum.patch diff --git a/queue-2.6.32/rcu-fix-synchronization-for-rcu_process_gp_end-uses-of-completed-counter.patch b/review-2.6.32/rcu-fix-synchronization-for-rcu_process_gp_end-uses-of-completed-counter.patch similarity index 100% rename from queue-2.6.32/rcu-fix-synchronization-for-rcu_process_gp_end-uses-of-completed-counter.patch rename to review-2.6.32/rcu-fix-synchronization-for-rcu_process_gp_end-uses-of-completed-counter.patch diff --git a/queue-2.6.32/rcu-prepare-for-synchronization-fixes-clean-up-for-non-no_hz-handling-of-completed-counter.patch b/review-2.6.32/rcu-prepare-for-synchronization-fixes-clean-up-for-non-no_hz-handling-of-completed-counter.patch similarity index 100% rename from queue-2.6.32/rcu-prepare-for-synchronization-fixes-clean-up-for-non-no_hz-handling-of-completed-counter.patch rename to review-2.6.32/rcu-prepare-for-synchronization-fixes-clean-up-for-non-no_hz-handling-of-completed-counter.patch diff --git a/queue-2.6.32/rcu-remove-inline-from-forward-referenced-functions.patch b/review-2.6.32/rcu-remove-inline-from-forward-referenced-functions.patch similarity index 97% rename from queue-2.6.32/rcu-remove-inline-from-forward-referenced-functions.patch rename to review-2.6.32/rcu-remove-inline-from-forward-referenced-functions.patch index 19fadcdf7e0..7484a9d43a2 100644 --- a/queue-2.6.32/rcu-remove-inline-from-forward-referenced-functions.patch +++ b/review-2.6.32/rcu-remove-inline-from-forward-referenced-functions.patch @@ -22,7 +22,7 @@ Cc: peterz@infradead.org Cc: rostedt@goodmis.org Cc: Valdis.Kletnieks@vt.edu Cc: dhowells@redhat.com -Cc: Benjamin Gilbert LKML-Reference: <12578890422402-git-send-email-> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman diff --git a/queue-2.6.32/rtl8187-fix-wrong-rfkill-switch-mask-for-some-models.patch b/review-2.6.32/rtl8187-fix-wrong-rfkill-switch-mask-for-some-models.patch similarity index 100% rename from queue-2.6.32/rtl8187-fix-wrong-rfkill-switch-mask-for-some-models.patch rename to review-2.6.32/rtl8187-fix-wrong-rfkill-switch-mask-for-some-models.patch diff --git a/queue-2.6.32/s390-clear-high-order-bits-of-registers-after-sam64.patch b/review-2.6.32/s390-clear-high-order-bits-of-registers-after-sam64.patch similarity index 100% rename from queue-2.6.32/s390-clear-high-order-bits-of-registers-after-sam64.patch rename to review-2.6.32/s390-clear-high-order-bits-of-registers-after-sam64.patch diff --git a/queue-2.6.32/sched-check-for-an-idle-shared-cache-in-select_task_rq_fair.patch b/review-2.6.32/sched-check-for-an-idle-shared-cache-in-select_task_rq_fair.patch similarity index 100% rename from queue-2.6.32/sched-check-for-an-idle-shared-cache-in-select_task_rq_fair.patch rename to review-2.6.32/sched-check-for-an-idle-shared-cache-in-select_task_rq_fair.patch diff --git a/queue-2.6.32/sched-fix-affinity-logic-in-select_task_rq_fair.patch b/review-2.6.32/sched-fix-affinity-logic-in-select_task_rq_fair.patch similarity index 100% rename from queue-2.6.32/sched-fix-affinity-logic-in-select_task_rq_fair.patch rename to review-2.6.32/sched-fix-affinity-logic-in-select_task_rq_fair.patch diff --git a/queue-2.6.32/sched-fix-and-clean-up-rate-limit-newidle-code.patch b/review-2.6.32/sched-fix-and-clean-up-rate-limit-newidle-code.patch similarity index 91% rename from queue-2.6.32/sched-fix-and-clean-up-rate-limit-newidle-code.patch rename to review-2.6.32/sched-fix-and-clean-up-rate-limit-newidle-code.patch index e6b5456ea94..a53308f779f 100644 --- a/queue-2.6.32/sched-fix-and-clean-up-rate-limit-newidle-code.patch +++ b/review-2.6.32/sched-fix-and-clean-up-rate-limit-newidle-code.patch @@ -22,10 +22,6 @@ Reported-by: Alex Shi Reported-by: Zhang, Yanmin Signed-off-by: Mike Galbraith Acked-by: Peter Zijlstra -Cc: # .32.x: a1f84a3: sched: Check for an idle shared cache -Cc: # .32.x: 1b9508f: sched: Rate-limit newidle -Cc: # .32.x: fd21073: sched: Fix affinity logic -Cc: # .32.x LKML-Reference: <1257821402.5648.17.camel@marge.simson.net> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman diff --git a/queue-2.6.32/sched-rate-limit-newidle.patch b/review-2.6.32/sched-rate-limit-newidle.patch similarity index 100% rename from queue-2.6.32/sched-rate-limit-newidle.patch rename to review-2.6.32/sched-rate-limit-newidle.patch diff --git a/queue-2.6.32/serial-do-not-read-iir-in-serial8250_start_tx-when-uart_bug_txen.patch b/review-2.6.32/serial-do-not-read-iir-in-serial8250_start_tx-when-uart_bug_txen.patch similarity index 100% rename from queue-2.6.32/serial-do-not-read-iir-in-serial8250_start_tx-when-uart_bug_txen.patch rename to review-2.6.32/serial-do-not-read-iir-in-serial8250_start_tx-when-uart_bug_txen.patch diff --git a/queue-2.6.32/series b/review-2.6.32/series similarity index 100% rename from queue-2.6.32/series rename to review-2.6.32/series diff --git a/queue-2.6.32/slc90e66-fix-udma-handling.patch b/review-2.6.32/slc90e66-fix-udma-handling.patch similarity index 100% rename from queue-2.6.32/slc90e66-fix-udma-handling.patch rename to review-2.6.32/slc90e66-fix-udma-handling.patch diff --git a/queue-2.6.32/sparc-set-uts_machine-correctly.patch b/review-2.6.32/sparc-set-uts_machine-correctly.patch similarity index 100% rename from queue-2.6.32/sparc-set-uts_machine-correctly.patch rename to review-2.6.32/sparc-set-uts_machine-correctly.patch diff --git a/queue-2.6.32/sparc64-don-t-specify-irqf_shared-for-ldc-interrupts.patch b/review-2.6.32/sparc64-don-t-specify-irqf_shared-for-ldc-interrupts.patch similarity index 100% rename from queue-2.6.32/sparc64-don-t-specify-irqf_shared-for-ldc-interrupts.patch rename to review-2.6.32/sparc64-don-t-specify-irqf_shared-for-ldc-interrupts.patch diff --git a/queue-2.6.32/sparc64-fix-overly-strict-range-type-matching-for-pci-devices.patch b/review-2.6.32/sparc64-fix-overly-strict-range-type-matching-for-pci-devices.patch similarity index 100% rename from queue-2.6.32/sparc64-fix-overly-strict-range-type-matching-for-pci-devices.patch rename to review-2.6.32/sparc64-fix-overly-strict-range-type-matching-for-pci-devices.patch diff --git a/queue-2.6.32/sparc64-fix-stack-debugging-irq-stack-regression.patch b/review-2.6.32/sparc64-fix-stack-debugging-irq-stack-regression.patch similarity index 100% rename from queue-2.6.32/sparc64-fix-stack-debugging-irq-stack-regression.patch rename to review-2.6.32/sparc64-fix-stack-debugging-irq-stack-regression.patch diff --git a/queue-2.6.32/ssb-fix-range-check-in-sprom-write.patch b/review-2.6.32/ssb-fix-range-check-in-sprom-write.patch similarity index 100% rename from queue-2.6.32/ssb-fix-range-check-in-sprom-write.patch rename to review-2.6.32/ssb-fix-range-check-in-sprom-write.patch diff --git a/queue-2.6.32/sunrpc-is_err-ptr_err-confusion.patch b/review-2.6.32/sunrpc-is_err-ptr_err-confusion.patch similarity index 100% rename from queue-2.6.32/sunrpc-is_err-ptr_err-confusion.patch rename to review-2.6.32/sunrpc-is_err-ptr_err-confusion.patch diff --git a/queue-2.6.32/sysctl_max_map_count-should-be-non-negative.patch b/review-2.6.32/sysctl_max_map_count-should-be-non-negative.patch similarity index 100% rename from queue-2.6.32/sysctl_max_map_count-should-be-non-negative.patch rename to review-2.6.32/sysctl_max_map_count-should-be-non-negative.patch diff --git a/queue-2.6.32/tcp-stalling-connections-fix-timeout-calculation-routine.patch b/review-2.6.32/tcp-stalling-connections-fix-timeout-calculation-routine.patch similarity index 100% rename from queue-2.6.32/tcp-stalling-connections-fix-timeout-calculation-routine.patch rename to review-2.6.32/tcp-stalling-connections-fix-timeout-calculation-routine.patch diff --git a/queue-2.6.32/thinkpad-acpi-fix-default-brightness_mode-for-r50e-r51.patch b/review-2.6.32/thinkpad-acpi-fix-default-brightness_mode-for-r50e-r51.patch similarity index 100% rename from queue-2.6.32/thinkpad-acpi-fix-default-brightness_mode-for-r50e-r51.patch rename to review-2.6.32/thinkpad-acpi-fix-default-brightness_mode-for-r50e-r51.patch diff --git a/queue-2.6.32/thinkpad-acpi-preserve-rfkill-state-across-suspend-resume.patch b/review-2.6.32/thinkpad-acpi-preserve-rfkill-state-across-suspend-resume.patch similarity index 100% rename from queue-2.6.32/thinkpad-acpi-preserve-rfkill-state-across-suspend-resume.patch rename to review-2.6.32/thinkpad-acpi-preserve-rfkill-state-across-suspend-resume.patch diff --git a/queue-2.6.32/tracing-fix-event-format-export.patch b/review-2.6.32/tracing-fix-event-format-export.patch similarity index 100% rename from queue-2.6.32/tracing-fix-event-format-export.patch rename to review-2.6.32/tracing-fix-event-format-export.patch diff --git a/queue-2.6.32/ubi-flush-wl-before-clearing-update-marker.patch b/review-2.6.32/ubi-flush-wl-before-clearing-update-marker.patch similarity index 100% rename from queue-2.6.32/ubi-flush-wl-before-clearing-update-marker.patch rename to review-2.6.32/ubi-flush-wl-before-clearing-update-marker.patch diff --git a/queue-2.6.32/usb-close-usb_find_interface-race-v3.patch b/review-2.6.32/usb-close-usb_find_interface-race-v3.patch similarity index 100% rename from queue-2.6.32/usb-close-usb_find_interface-race-v3.patch rename to review-2.6.32/usb-close-usb_find_interface-race-v3.patch diff --git a/queue-2.6.32/usb-musb_gadget_ep0-fix-unhandled-endpoint-0-irqs-again.patch b/review-2.6.32/usb-musb_gadget_ep0-fix-unhandled-endpoint-0-irqs-again.patch similarity index 100% rename from queue-2.6.32/usb-musb_gadget_ep0-fix-unhandled-endpoint-0-irqs-again.patch rename to review-2.6.32/usb-musb_gadget_ep0-fix-unhandled-endpoint-0-irqs-again.patch diff --git a/queue-2.6.32/usb-option-add-pid-for-zte.patch b/review-2.6.32/usb-option-add-pid-for-zte.patch similarity index 100% rename from queue-2.6.32/usb-option-add-pid-for-zte.patch rename to review-2.6.32/usb-option-add-pid-for-zte.patch diff --git a/queue-2.6.32/usb-option.c-add-support-for-d-link-dwm-162-u5.patch b/review-2.6.32/usb-option.c-add-support-for-d-link-dwm-162-u5.patch similarity index 100% rename from queue-2.6.32/usb-option.c-add-support-for-d-link-dwm-162-u5.patch rename to review-2.6.32/usb-option.c-add-support-for-d-link-dwm-162-u5.patch diff --git a/queue-2.6.32/usb-usb-storage-add-bad_sense-flag.patch b/review-2.6.32/usb-usb-storage-add-bad_sense-flag.patch similarity index 100% rename from queue-2.6.32/usb-usb-storage-add-bad_sense-flag.patch rename to review-2.6.32/usb-usb-storage-add-bad_sense-flag.patch diff --git a/queue-2.6.32/usb-usb-storage-fix-bug-in-fill_inquiry.patch b/review-2.6.32/usb-usb-storage-fix-bug-in-fill_inquiry.patch similarity index 100% rename from queue-2.6.32/usb-usb-storage-fix-bug-in-fill_inquiry.patch rename to review-2.6.32/usb-usb-storage-fix-bug-in-fill_inquiry.patch diff --git a/queue-2.6.32/usb-usbtmc-repeat-usb_bulk_msg-until-whole-message-is-transfered.patch b/review-2.6.32/usb-usbtmc-repeat-usb_bulk_msg-until-whole-message-is-transfered.patch similarity index 100% rename from queue-2.6.32/usb-usbtmc-repeat-usb_bulk_msg-until-whole-message-is-transfered.patch rename to review-2.6.32/usb-usbtmc-repeat-usb_bulk_msg-until-whole-message-is-transfered.patch diff --git a/queue-2.6.32/usb-xhci-add-correct-email-and-files-to-maintainers-entry.patch b/review-2.6.32/usb-xhci-add-correct-email-and-files-to-maintainers-entry.patch similarity index 100% rename from queue-2.6.32/usb-xhci-add-correct-email-and-files-to-maintainers-entry.patch rename to review-2.6.32/usb-xhci-add-correct-email-and-files-to-maintainers-entry.patch diff --git a/queue-2.6.32/v4l-dvb-13116-gspca-ov519-webcam-041e-4067-added.patch b/review-2.6.32/v4l-dvb-13116-gspca-ov519-webcam-041e-4067-added.patch similarity index 100% rename from queue-2.6.32/v4l-dvb-13116-gspca-ov519-webcam-041e-4067-added.patch rename to review-2.6.32/v4l-dvb-13116-gspca-ov519-webcam-041e-4067-added.patch diff --git a/queue-2.6.32/v4l-dvb-fix-test-in-copy_reg_bits.patch b/review-2.6.32/v4l-dvb-fix-test-in-copy_reg_bits.patch similarity index 100% rename from queue-2.6.32/v4l-dvb-fix-test-in-copy_reg_bits.patch rename to review-2.6.32/v4l-dvb-fix-test-in-copy_reg_bits.patch diff --git a/queue-2.6.32/vmalloc-conditionalize-build-of-pcpu_get_vm_areas.patch b/review-2.6.32/vmalloc-conditionalize-build-of-pcpu_get_vm_areas.patch similarity index 100% rename from queue-2.6.32/vmalloc-conditionalize-build-of-pcpu_get_vm_areas.patch rename to review-2.6.32/vmalloc-conditionalize-build-of-pcpu_get_vm_areas.patch diff --git a/queue-2.6.32/wireless-correctly-report-signal-value-for-ieee80211_hw_signal_unspec.patch b/review-2.6.32/wireless-correctly-report-signal-value-for-ieee80211_hw_signal_unspec.patch similarity index 100% rename from queue-2.6.32/wireless-correctly-report-signal-value-for-ieee80211_hw_signal_unspec.patch rename to review-2.6.32/wireless-correctly-report-signal-value-for-ieee80211_hw_signal_unspec.patch diff --git a/queue-2.6.32/x86-add-new-intel-cpu-cache-size-descriptors.patch b/review-2.6.32/x86-add-new-intel-cpu-cache-size-descriptors.patch similarity index 100% rename from queue-2.6.32/x86-add-new-intel-cpu-cache-size-descriptors.patch rename to review-2.6.32/x86-add-new-intel-cpu-cache-size-descriptors.patch diff --git a/queue-2.6.32/x86-amd-iommu-attach-devices-to-pre-allocated-domains-early.patch b/review-2.6.32/x86-amd-iommu-attach-devices-to-pre-allocated-domains-early.patch similarity index 100% rename from queue-2.6.32/x86-amd-iommu-attach-devices-to-pre-allocated-domains-early.patch rename to review-2.6.32/x86-amd-iommu-attach-devices-to-pre-allocated-domains-early.patch diff --git a/queue-2.6.32/x86-amd-iommu-un__init-iommu_setup_msi.patch b/review-2.6.32/x86-amd-iommu-un__init-iommu_setup_msi.patch similarity index 100% rename from queue-2.6.32/x86-amd-iommu-un__init-iommu_setup_msi.patch rename to review-2.6.32/x86-amd-iommu-un__init-iommu_setup_msi.patch diff --git a/queue-2.6.32/x86-apic-enable-lapic-nmi-watchdog-on-amd-family-11h.patch b/review-2.6.32/x86-apic-enable-lapic-nmi-watchdog-on-amd-family-11h.patch similarity index 100% rename from queue-2.6.32/x86-apic-enable-lapic-nmi-watchdog-on-amd-family-11h.patch rename to review-2.6.32/x86-apic-enable-lapic-nmi-watchdog-on-amd-family-11h.patch diff --git a/queue-2.6.32/x86-asus-p4s800-reboot-bios-quirk.patch b/review-2.6.32/x86-asus-p4s800-reboot-bios-quirk.patch similarity index 100% rename from queue-2.6.32/x86-asus-p4s800-reboot-bios-quirk.patch rename to review-2.6.32/x86-asus-p4s800-reboot-bios-quirk.patch diff --git a/queue-2.6.32/x86-calgary-iommu-quirk-find-nearest-matching-calgary-while-walking-up-the-pci-tree.patch b/review-2.6.32/x86-calgary-iommu-quirk-find-nearest-matching-calgary-while-walking-up-the-pci-tree.patch similarity index 100% rename from queue-2.6.32/x86-calgary-iommu-quirk-find-nearest-matching-calgary-while-walking-up-the-pci-tree.patch rename to review-2.6.32/x86-calgary-iommu-quirk-find-nearest-matching-calgary-while-walking-up-the-pci-tree.patch diff --git a/queue-2.6.32/x86-fix-bogus-warning-in-apic_noop.apic_write.patch b/review-2.6.32/x86-fix-bogus-warning-in-apic_noop.apic_write.patch similarity index 100% rename from queue-2.6.32/x86-fix-bogus-warning-in-apic_noop.apic_write.patch rename to review-2.6.32/x86-fix-bogus-warning-in-apic_noop.apic_write.patch diff --git a/queue-2.6.32/x86-fix-duplicated-uv-bau-interrupt-vector.patch b/review-2.6.32/x86-fix-duplicated-uv-bau-interrupt-vector.patch similarity index 100% rename from queue-2.6.32/x86-fix-duplicated-uv-bau-interrupt-vector.patch rename to review-2.6.32/x86-fix-duplicated-uv-bau-interrupt-vector.patch diff --git a/queue-2.6.32/x86-fix-iommu-nodac-parameter-handling.patch b/review-2.6.32/x86-fix-iommu-nodac-parameter-handling.patch similarity index 100% rename from queue-2.6.32/x86-fix-iommu-nodac-parameter-handling.patch rename to review-2.6.32/x86-fix-iommu-nodac-parameter-handling.patch diff --git a/queue-2.6.32/x86-fix-typo-in-intel-cpu-cache-size-descriptor.patch b/review-2.6.32/x86-fix-typo-in-intel-cpu-cache-size-descriptor.patch similarity index 92% rename from queue-2.6.32/x86-fix-typo-in-intel-cpu-cache-size-descriptor.patch rename to review-2.6.32/x86-fix-typo-in-intel-cpu-cache-size-descriptor.patch index e8331f6bc1f..d1ba00e1996 100644 --- a/queue-2.6.32/x86-fix-typo-in-intel-cpu-cache-size-descriptor.patch +++ b/review-2.6.32/x86-fix-typo-in-intel-cpu-cache-size-descriptor.patch @@ -11,8 +11,6 @@ I double-checked the datasheet. One of the existing descriptors has a typo: it should be 2MB not 2038 KB. Signed-off-by: Dave Jones -Cc: # .3x.x: 85160b9: x86: Add new Intel CPU cache size descriptors -Cc: # .3x.x LKML-Reference: <20091110200120.GA27090@redhat.com> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman diff --git a/queue-2.6.32/x86-gart-pci-gart_64.c-use-correct-length-in-strncmp.patch b/review-2.6.32/x86-gart-pci-gart_64.c-use-correct-length-in-strncmp.patch similarity index 100% rename from queue-2.6.32/x86-gart-pci-gart_64.c-use-correct-length-in-strncmp.patch rename to review-2.6.32/x86-gart-pci-gart_64.c-use-correct-length-in-strncmp.patch diff --git a/queue-2.6.32/x86-mce-don-t-restart-timer-if-disabled.patch b/review-2.6.32/x86-mce-don-t-restart-timer-if-disabled.patch similarity index 100% rename from queue-2.6.32/x86-mce-don-t-restart-timer-if-disabled.patch rename to review-2.6.32/x86-mce-don-t-restart-timer-if-disabled.patch diff --git a/queue-2.6.32/x86-mce-set-up-timer-unconditionally.patch b/review-2.6.32/x86-mce-set-up-timer-unconditionally.patch similarity index 100% rename from queue-2.6.32/x86-mce-set-up-timer-unconditionally.patch rename to review-2.6.32/x86-mce-set-up-timer-unconditionally.patch diff --git a/queue-2.6.32/x86-prevent-gcc-4.4.x-pentium-mmx-et-al-function-prologue-wreckage.patch b/review-2.6.32/x86-prevent-gcc-4.4.x-pentium-mmx-et-al-function-prologue-wreckage.patch similarity index 100% rename from queue-2.6.32/x86-prevent-gcc-4.4.x-pentium-mmx-et-al-function-prologue-wreckage.patch rename to review-2.6.32/x86-prevent-gcc-4.4.x-pentium-mmx-et-al-function-prologue-wreckage.patch diff --git a/queue-2.6.32/x86-sgi-uv-fix-bau-initialization.patch b/review-2.6.32/x86-sgi-uv-fix-bau-initialization.patch similarity index 100% rename from queue-2.6.32/x86-sgi-uv-fix-bau-initialization.patch rename to review-2.6.32/x86-sgi-uv-fix-bau-initialization.patch diff --git a/queue-2.6.32/x86-under-bios-control-restore-ap-s-apic_lvtthmr-to-the-bsp-value.patch b/review-2.6.32/x86-under-bios-control-restore-ap-s-apic_lvtthmr-to-the-bsp-value.patch similarity index 100% rename from queue-2.6.32/x86-under-bios-control-restore-ap-s-apic_lvtthmr-to-the-bsp-value.patch rename to review-2.6.32/x86-under-bios-control-restore-ap-s-apic_lvtthmr-to-the-bsp-value.patch diff --git a/queue-2.6.32/x86-use-maccumulate-outgoing-args-for-sane-mcount-prologues.patch b/review-2.6.32/x86-use-maccumulate-outgoing-args-for-sane-mcount-prologues.patch similarity index 100% rename from queue-2.6.32/x86-use-maccumulate-outgoing-args-for-sane-mcount-prologues.patch rename to review-2.6.32/x86-use-maccumulate-outgoing-args-for-sane-mcount-prologues.patch diff --git a/queue-2.6.32/xen-balloon-fix-totalram_pages-counting.patch b/review-2.6.32/xen-balloon-fix-totalram_pages-counting.patch similarity index 100% rename from queue-2.6.32/xen-balloon-fix-totalram_pages-counting.patch rename to review-2.6.32/xen-balloon-fix-totalram_pages-counting.patch diff --git a/queue-2.6.32/xen-call-clock-resume-notifier-on-all-cpus.patch b/review-2.6.32/xen-call-clock-resume-notifier-on-all-cpus.patch similarity index 100% rename from queue-2.6.32/xen-call-clock-resume-notifier-on-all-cpus.patch rename to review-2.6.32/xen-call-clock-resume-notifier-on-all-cpus.patch diff --git a/queue-2.6.32/xen-correctly-restore-pfn_to_mfn_list_list-after-resume.patch b/review-2.6.32/xen-correctly-restore-pfn_to_mfn_list_list-after-resume.patch similarity index 100% rename from queue-2.6.32/xen-correctly-restore-pfn_to_mfn_list_list-after-resume.patch rename to review-2.6.32/xen-correctly-restore-pfn_to_mfn_list_list-after-resume.patch diff --git a/queue-2.6.32/xen-don-t-call-dpm_resume_noirq-with-interrupts-disabled.patch b/review-2.6.32/xen-don-t-call-dpm_resume_noirq-with-interrupts-disabled.patch similarity index 100% rename from queue-2.6.32/xen-don-t-call-dpm_resume_noirq-with-interrupts-disabled.patch rename to review-2.6.32/xen-don-t-call-dpm_resume_noirq-with-interrupts-disabled.patch diff --git a/queue-2.6.32/xen-don-t-leak-irqs-over-suspend-resume.patch b/review-2.6.32/xen-don-t-leak-irqs-over-suspend-resume.patch similarity index 100% rename from queue-2.6.32/xen-don-t-leak-irqs-over-suspend-resume.patch rename to review-2.6.32/xen-don-t-leak-irqs-over-suspend-resume.patch diff --git a/queue-2.6.32/xen-explicitly-create-destroy-stop_machine-workqueues-outside-suspend-resume-region.patch b/review-2.6.32/xen-explicitly-create-destroy-stop_machine-workqueues-outside-suspend-resume-region.patch similarity index 100% rename from queue-2.6.32/xen-explicitly-create-destroy-stop_machine-workqueues-outside-suspend-resume-region.patch rename to review-2.6.32/xen-explicitly-create-destroy-stop_machine-workqueues-outside-suspend-resume-region.patch diff --git a/queue-2.6.32/xen-improve-error-handling-in-do_suspend.patch b/review-2.6.32/xen-improve-error-handling-in-do_suspend.patch similarity index 100% rename from queue-2.6.32/xen-improve-error-handling-in-do_suspend.patch rename to review-2.6.32/xen-improve-error-handling-in-do_suspend.patch diff --git a/queue-2.6.32/xen-re-register-runstate-area-earlier-on-resume.patch b/review-2.6.32/xen-re-register-runstate-area-earlier-on-resume.patch similarity index 100% rename from queue-2.6.32/xen-re-register-runstate-area-earlier-on-resume.patch rename to review-2.6.32/xen-re-register-runstate-area-earlier-on-resume.patch diff --git a/queue-2.6.32/xen-register-runstate-info-for-boot-cpu-early.patch b/review-2.6.32/xen-register-runstate-info-for-boot-cpu-early.patch similarity index 100% rename from queue-2.6.32/xen-register-runstate-info-for-boot-cpu-early.patch rename to review-2.6.32/xen-register-runstate-info-for-boot-cpu-early.patch diff --git a/queue-2.6.32/xen-register-runstate-on-secondary-cpus.patch b/review-2.6.32/xen-register-runstate-on-secondary-cpus.patch similarity index 100% rename from queue-2.6.32/xen-register-runstate-on-secondary-cpus.patch rename to review-2.6.32/xen-register-runstate-on-secondary-cpus.patch diff --git a/queue-2.6.32/xen-register-timer-interrupt-with-irqf_timer.patch b/review-2.6.32/xen-register-timer-interrupt-with-irqf_timer.patch similarity index 100% rename from queue-2.6.32/xen-register-timer-interrupt-with-irqf_timer.patch rename to review-2.6.32/xen-register-timer-interrupt-with-irqf_timer.patch diff --git a/queue-2.6.32/xen-restore-runstate_info-even-if-have_vcpu_info_placement.patch b/review-2.6.32/xen-restore-runstate_info-even-if-have_vcpu_info_placement.patch similarity index 100% rename from queue-2.6.32/xen-restore-runstate_info-even-if-have_vcpu_info_placement.patch rename to review-2.6.32/xen-restore-runstate_info-even-if-have_vcpu_info_placement.patch diff --git a/queue-2.6.32/xen-try-harder-to-balloon-up-under-memory-pressure.patch b/review-2.6.32/xen-try-harder-to-balloon-up-under-memory-pressure.patch similarity index 100% rename from queue-2.6.32/xen-try-harder-to-balloon-up-under-memory-pressure.patch rename to review-2.6.32/xen-try-harder-to-balloon-up-under-memory-pressure.patch diff --git a/queue-2.6.32/xen-use-iret-for-return-from-64b-kernel-to-32b-usermode.patch b/review-2.6.32/xen-use-iret-for-return-from-64b-kernel-to-32b-usermode.patch similarity index 100% rename from queue-2.6.32/xen-use-iret-for-return-from-64b-kernel-to-32b-usermode.patch rename to review-2.6.32/xen-use-iret-for-return-from-64b-kernel-to-32b-usermode.patch diff --git a/queue-2.6.32/xen-xenbus-make-device_attr-s-static.patch b/review-2.6.32/xen-xenbus-make-device_attr-s-static.patch similarity index 100% rename from queue-2.6.32/xen-xenbus-make-device_attr-s-static.patch rename to review-2.6.32/xen-xenbus-make-device_attr-s-static.patch