--- /dev/null
+From gregkh@mini.kroah.org Mon Oct 6 17:27:26 2008
+Message-Id: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:06 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 00/71] 2.6.26-stable review
+Content-Length: 6203
+Lines: 112
+
+This is the start of the stable review cycle for the 2.6.26.6 release.
+There are 71 patches in this series, all will be posted as a response to
+this one. If anyone has any issues with these being applied, please let
+us know. If anyone is a maintainer of the proper subsystem, and
+wants to add a Signed-off-by: line to the patch, please respond with it.
+
+These patches are sent out with a number of different people on the Cc:
+line. If you wish to be a reviewer, please email stable@kernel.org to
+add your name to the list. If you want to be off the reviewer list,
+also email us.
+
+Responses should be made by Wed Oct 8, 22:00:00 UTC. Anything received
+after that time might be too late.
+
+The whole patch series can be found in one patch at:
+ kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.26.8-rc1.gz
+and the diffstat can be found below.
+
+
+thanks,
+
+the -stable release team
+
+ Makefile | 2
+ arch/s390/kernel/compat_ptrace.h | 1
+ arch/s390/kernel/ptrace.c | 28 +++++
+ arch/sparc64/kernel/of_device.c | 9 -
+ arch/sparc64/kernel/pci.c | 2
+ arch/sparc64/kernel/pci_psycho.c | 14 +-
+ arch/sparc64/kernel/prom.c | 104 +--------------------
+ arch/x86/kernel/alternative.c | 18 +--
+ arch/x86/kernel/apic_32.c | 30 +++++-
+ arch/x86/kernel/apic_64.c | 3
+ arch/x86/kernel/cpu/bugs.c | 6 +
+ arch/x86/kernel/e820_32.c | 2
+ arch/x86/kernel/e820_64.c | 2
+ arch/x86/kernel/genapic_64.c | 2
+ arch/x86/kernel/head64.c | 1
+ arch/x86/kernel/hpet.c | 19 ++-
+ arch/x86/kernel/io_delay.c | 8 +
+ arch/x86/kernel/mpparse.c | 5 +
+ arch/x86/kernel/setup.c | 1
+ arch/x86/kernel/setup_32.c | 11 +-
+ arch/x86/kernel/signal_64.c | 62 ++++++++++++
+ arch/x86/kernel/traps_64.c | 9 +
+ arch/x86/kernel/vmi_32.c | 2
+ arch/x86/kernel/vsmp_64.c | 2
+ arch/x86/kvm/svm.c | 14 ++
+ arch/x86/mach-generic/bigsmp.c | 2
+ arch/x86/mm/pageattr.c | 6 -
+ arch/x86/oprofile/nmi_int.c | 39 +++++++-
+ crypto/async_tx/async_tx.c | 3
+ drivers/accessibility/braille/braille_console.c | 13 --
+ drivers/acpi/ec.c | 2
+ drivers/acpi/processor_perflib.c | 2
+ drivers/i2c/i2c-dev.c | 4
+ drivers/mmc/card/block.c | 4
+ drivers/net/ixgbe/ixgbe_main.c | 6 +
+ drivers/net/niu.c | 56 +++++++++++
+ drivers/net/wireless/rt2x00/rt2x00.h | 4
+ drivers/net/wireless/rt2x00/rt2x00dev.c | 17 ---
+ drivers/net/wireless/rt2x00/rt2x00mac.c | 4
+ drivers/pcmcia/ds.c | 23 ++--
+ drivers/rtc/rtc-dev.c | 15 +--
+ drivers/scsi/qla2xxx/qla_isr.c | 1
+ drivers/scsi/qla2xxx/qla_os.c | 2
+ drivers/spi/pxa2xx_spi.c | 116 ++++++++++++++++++------
+ drivers/usb/core/hcd.c | 3
+ drivers/video/console/fbcon.h | 2
+ fs/buffer.c | 13 +-
+ fs/exec.c | 2
+ fs/ocfs2/stackglue.c | 7 -
+ fs/proc/array.c | 59 ------------
+ include/asm-generic/rtc.h | 12 --
+ include/asm-x86/i387.h | 56 -----------
+ include/asm-x86/mpspec.h | 1
+ include/asm-x86/pgtable_64.h | 2
+ include/linux/clockchips.h | 2
+ include/linux/mmzone.h | 12 +-
+ include/linux/rmap.h | 2
+ include/linux/sched.h | 4
+ include/linux/smb.h | 2
+ include/net/netlink.h | 2
+ kernel/cgroup.c | 5 -
+ kernel/exit.c | 18 ++-
+ kernel/sched.c | 59 ++++++++++++
+ kernel/time/clockevents.c | 3
+ kernel/time/ntp.c | 2
+ kernel/time/tick-broadcast.c | 78 ++++++++++++----
+ kernel/time/tick-common.c | 1
+ kernel/time/tick-internal.h | 2
+ kernel/time/tick-oneshot.c | 44 +++++++--
+ lib/scatterlist.c | 5 -
+ mm/filemap_xip.c | 2
+ mm/memcontrol.c | 13 ++
+ mm/mmzone.c | 2
+ mm/rmap.c | 14 +-
+ net/ipv4/udp.c | 59 ++++++------
+ net/ipv6/ip6_output.c | 64 ++++++-------
+ net/ipv6/route.c | 2
+ net/key/af_key.c | 30 +++---
+ net/sctp/associola.c | 9 +
+ net/sctp/sm_make_chunk.c | 15 +--
+ net/xfrm/xfrm_output.c | 12 +-
+ sound/core/pcm.c | 4
+ sound/core/pcm_native.c | 13 --
+ sound/core/rawmidi.c | 4
+ sound/pci/hda/patch_sigmatel.c | 2
+ sound/pci/oxygen/hifier.c | 4
+ sound/pci/oxygen/oxygen.c | 4
+ sound/ppc/awacs.c | 50 +++++++---
+ 88 files changed, 862 insertions(+), 515 deletions(-)
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:27 2008
+Message-Id: <20081007002726.955816148@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:07 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Thomas Gleixner <tglx@linutronix.de>
+Subject: [patch 01/71] x86-32: AMD c1e force timer broadcast late
+Content-Disposition: inline; filename=x86-32-amd-c1e-force-timer-broadcast-late.patch
+Content-Length: 1834
+Lines: 60
+
+2.6.26-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Chuck Ebbert <cebbert@redhat.com>
+
+This patch is not needed in 2.6.27 because it has new c1e-aware idle code.
+
+In kernel 2.6.26 the 32-bit x86 timers are started earlier than before.
+This breaks AMD c1e detection trying to force timer broadcast for the
+local apic timer. Copy the code from the 64-bit kernel to force timer
+broadcast late.
+
+Reference:
+http://bugzilla.kernel.org/show_bug.cgi?id=11427
+
+Signed-off-by: Chuck Ebbert <cebbert@redhat.com>
+Acked-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/apic_32.c | 25 ++++++++++++++++++++++++-
+ 1 file changed, 24 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/apic_32.c
++++ b/arch/x86/kernel/apic_32.c
+@@ -552,8 +552,31 @@ void __init setup_boot_APIC_clock(void)
+ setup_APIC_timer();
+ }
+
+-void __devinit setup_secondary_APIC_clock(void)
++/*
++ * AMD C1E enabled CPUs have a real nasty problem: Some BIOSes set the
++ * C1E flag only in the secondary CPU, so when we detect the wreckage
++ * we already have enabled the boot CPU local apic timer. Check, if
++ * disable_apic_timer is set and the DUMMY flag is cleared. If yes,
++ * set the DUMMY flag again and force the broadcast mode in the
++ * clockevents layer.
++ */
++static void __cpuinit check_boot_apic_timer_broadcast(void)
++{
++ if (!local_apic_timer_disabled ||
++ (lapic_clockevent.features & CLOCK_EVT_FEAT_DUMMY))
++ return;
++
++ lapic_clockevent.features |= CLOCK_EVT_FEAT_DUMMY;
++
++ local_irq_enable();
++ clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_FORCE,
++ &boot_cpu_physical_apicid);
++ local_irq_disable();
++}
++
++void __cpuinit setup_secondary_APIC_clock(void)
+ {
++ check_boot_apic_timer_broadcast();
+ setup_APIC_timer();
+ }
+
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:27 2008
+Message-Id: <20081007002727.119965432@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:08 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andi Kleen <ak@linux.intel.com>,
+ Milan Broz <mbroz@redhat.com>
+Subject: [patch 02/71] ACPI: Fix thermal shutdowns
+Content-Disposition: inline; filename=acpi-fix-thermal-shutdowns.patch
+Content-Length: 1238
+Lines: 41
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Milan Broz <mbroz@redhat.com>
+
+commit 9f497bcc695fb828da023d74ad3c966b1e58ad21 upstream
+
+ACPI: Fix thermal shutdowns
+
+Do not use unsigned int if there is test for negative number...
+
+See drivers/acpi/processor_perflib.c
+ static unsigned int ignore_ppc = -1;
+...
+ if (event == CPUFREQ_START && ignore_ppc <= 0) {
+ ignore_ppc = 0;
+...
+
+Signed-off-by: Milan Broz <mbroz@redhat.com>
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/processor_perflib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/acpi/processor_perflib.c
++++ b/drivers/acpi/processor_perflib.c
+@@ -70,7 +70,7 @@ static DEFINE_MUTEX(performance_mutex);
+ * 0 -> cpufreq low level drivers initialized -> consider _PPC values
+ * 1 -> ignore _PPC totally -> forced by user through boot param
+ */
+-static unsigned int ignore_ppc = -1;
++static int ignore_ppc = -1;
+ module_param(ignore_ppc, uint, 0644);
+ MODULE_PARM_DESC(ignore_ppc, "If the frequency of your machine gets wrongly" \
+ "limited by BIOS, this should help");
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:27 2008
+Message-Id: <20081007002727.278675197@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:09 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Sven Wegener <sven.wegener@stealer.net>,
+ Jean Delvare <khali@linux-fr.org>
+Subject: [patch 03/71] i2c-dev: Return correct error code on class_create() failure
+Content-Disposition: inline; filename=i2c-dev-return-correct-error-code-on-class_create-failure.patch
+Content-Length: 1038
+Lines: 37
+
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Sven Wegener <sven.wegener@stealer.net>
+
+In Linus' tree:
+http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commit;h=e74783ec3cb981211689bd2cfd3248f8dc48ec01
+
+We need to convert the error pointer from class_create(), else we'll return the
+successful return code from register_chrdev() on failure.
+
+Signed-off-by: Sven Wegener <sven.wegener@stealer.net>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/i2c/i2c-dev.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/i2c/i2c-dev.c
++++ b/drivers/i2c/i2c-dev.c
+@@ -581,8 +581,10 @@ static int __init i2c_dev_init(void)
+ goto out;
+
+ i2c_dev_class = class_create(THIS_MODULE, "i2c-dev");
+- if (IS_ERR(i2c_dev_class))
++ if (IS_ERR(i2c_dev_class)) {
++ res = PTR_ERR(i2c_dev_class);
+ goto out_unreg_chrdev;
++ }
+
+ res = i2c_add_driver(&i2cdev_driver);
+ if (res)
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:27 2008
+Message-Id: <20081007002727.441364659@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:10 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andy Gospodarek <andy@greyhouse.net>,
+ Jesse Brandeburg <jesse.brandeburg@intel.com>,
+ Jeff Kirsher <jeffrey.t.kirsher@intel.com>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [patch 04/71] ixgbe: initialize interrupt throttle rate
+Content-Disposition: inline; filename=ixgbe-initialize-interrupt-throttle-rate.patch
+Content-Length: 1589
+Lines: 49
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Andy Gospodarek <andy@greyhouse.net>
+
+commit 15e79f24b60c4b0bf8019423bda4e03a576b02f2 upstream
+
+This commit dropped the setting of the default interrupt throttle rate.
+
+commit 021230d40ae0e6508d6c717b6e0d6d81cd77ac25
+Author: Ayyappan Veeraiyan <ayyappan.veeraiyan@intel.com>
+Date: Mon Mar 3 15:03:45 2008 -0800
+
+ ixgbe: Introduce MSI-X queue vector code
+
+The following patch adds it back. Without this the default value of 0
+causes the performance of this card to be awful. Restoring these to the
+default values yields much better performance.
+
+This regression has been around since 2.6.25.
+
+Signed-off-by: Andy Gospodarek <andy@greyhouse.net>
+Acked-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/ixgbe/ixgbe_main.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/ixgbe/ixgbe_main.c
++++ b/drivers/net/ixgbe/ixgbe_main.c
+@@ -2258,6 +2258,12 @@ static int __devinit ixgbe_set_interrupt
+ int vector, v_budget;
+
+ /*
++ * Set the default interrupt throttle rate.
++ */
++ adapter->rx_eitr = (1000000 / IXGBE_DEFAULT_ITR_RX_USECS);
++ adapter->tx_eitr = (1000000 / IXGBE_DEFAULT_ITR_TX_USECS);
++
++ /*
+ * It's easy to be greedy for MSI-X vectors, but it really
+ * doesn't do us much good if we have a lot more vectors
+ * than CPU's. So let's be conservative and only ask for
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:27 2008
+Message-Id: <20081007002727.621056352@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:11 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Pierre Ossman <drzeus-list@drzeus.cx>
+Subject: [patch 05/71] drivers/mmc/card/block.c: fix refcount leak in mmc_block_open()
+Content-Disposition: inline; filename=drivers-mmc-card-block.c-fix-refcount-leak-in-mmc_block_open.patch
+Content-Length: 1214
+Lines: 40
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Andrew Morton <akpm@linux-foundation.org>
+
+commit 70bb08962ea9bd50797ae9f16b2493f5f7c65053 upstream
+
+mmc_block_open() increments md->usage although it returns with -EROFS when
+default mounting a MMC/SD card with write protect switch on. This
+reference counting bug prevents /dev/mmcblkX from being released on card
+removal, and situation worsen with reinsertion until the minor number
+range runs out.
+
+Reported-by: <sasin@solomon-systech.com>
+Acked-by: Pierre Ossman <drzeus-list@drzeus.cx>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mmc/card/block.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/card/block.c
++++ b/drivers/mmc/card/block.c
+@@ -103,8 +103,10 @@ static int mmc_blk_open(struct inode *in
+ check_disk_change(inode->i_bdev);
+ ret = 0;
+
+- if ((filp->f_mode & FMODE_WRITE) && md->read_only)
++ if ((filp->f_mode & FMODE_WRITE) && md->read_only) {
++ mmc_blk_put(md);
+ ret = -EROFS;
++ }
+ }
+
+ return ret;
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:27 2008
+Message-Id: <20081007002727.765416529@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:12 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Yuri Tikhonov <yur@emcraft.com>,
+ Ilya Yanok <yanok@emcraft.com>,
+ Dan Williams <dan.j.williams@intel.com>
+Subject: [patch 06/71] async_tx: fix the bug in async_tx_run_dependencies
+Content-Disposition: inline; filename=async_tx-fix-the-bug-in-async_tx_run_dependencies.patch
+Content-Length: 1195
+Lines: 38
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Yuri Tikhonov <yur@emcraft.com>
+
+commit de24125dd0a452bfd4502fc448e3534c5d2e87aa upstream
+
+Should clear the next pointer of the TX if we are sure that the
+next TX (say NXT) will be submitted to the channel too. Overwise,
+we break the chain of descriptors, because we lose the information
+about the next descriptor to run. So next time, when invoke
+async_tx_run_dependencies() with TX, it's TX->next will be NULL, and
+NXT will be never submitted.
+
+Signed-off-by: Yuri Tikhonov <yur@emcraft.com>
+Signed-off-by: Ilya Yanok <yanok@emcraft.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ crypto/async_tx/async_tx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/crypto/async_tx/async_tx.c
++++ b/crypto/async_tx/async_tx.c
+@@ -136,7 +136,8 @@ async_tx_run_dependencies(struct dma_asy
+ spin_lock_bh(&next->lock);
+ next->parent = NULL;
+ _next = next->next;
+- next->next = NULL;
++ if (_next && _next->chan == chan)
++ next->next = NULL;
+ spin_unlock_bh(&next->lock);
+
+ next->tx_submit(next);
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:28 2008
+Message-Id: <20081007002727.927772639@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:13 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mel Gorman <mel@csn.ul.ie>,
+ Andy Whitcroft <apw@shadowen.org>,
+ KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Subject: [patch 07/71] mm: mark the correct zone as full when scanning zonelists
+Content-Disposition: inline; filename=mm-mark-the-correct-zone-as-full-when-scanning-zonelists.patch
+Content-Length: 3482
+Lines: 86
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Mel Gorman <mel@csn.ul.ie>
+
+commit 5bead2a0680687b9576d57c177988e8aa082b922 upstream
+
+The iterator for_each_zone_zonelist() uses a struct zoneref *z cursor when
+scanning zonelists to keep track of where in the zonelist it is. The
+zoneref that is returned corresponds to the the next zone that is to be
+scanned, not the current one. It was intended to be treated as an opaque
+list.
+
+When the page allocator is scanning a zonelist, it marks elements in the
+zonelist corresponding to zones that are temporarily full. As the
+zonelist is being updated, it uses the cursor here;
+
+ if (NUMA_BUILD)
+ zlc_mark_zone_full(zonelist, z);
+
+This is intended to prevent rescanning in the near future but the zoneref
+cursor does not correspond to the zone that has been found to be full.
+This is an easy misunderstanding to make so this patch corrects the
+problem by changing zoneref cursor to be the current zone being scanned
+instead of the next one.
+
+Signed-off-by: Mel Gorman <mel@csn.ul.ie>
+Cc: Andy Whitcroft <apw@shadowen.org>
+Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/mmzone.h | 12 ++++++------
+ mm/mmzone.c | 2 +-
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -751,8 +751,9 @@ static inline int zonelist_node_idx(stru
+ *
+ * This function returns the next zone at or below a given zone index that is
+ * within the allowed nodemask using a cursor as the starting point for the
+- * search. The zoneref returned is a cursor that is used as the next starting
+- * point for future calls to next_zones_zonelist().
++ * search. The zoneref returned is a cursor that represents the current zone
++ * being examined. It should be advanced by one before calling
++ * next_zones_zonelist again.
+ */
+ struct zoneref *next_zones_zonelist(struct zoneref *z,
+ enum zone_type highest_zoneidx,
+@@ -768,9 +769,8 @@ struct zoneref *next_zones_zonelist(stru
+ *
+ * This function returns the first zone at or below a given zone index that is
+ * within the allowed nodemask. The zoneref returned is a cursor that can be
+- * used to iterate the zonelist with next_zones_zonelist. The cursor should
+- * not be used by the caller as it does not match the value of the zone
+- * returned.
++ * used to iterate the zonelist with next_zones_zonelist by advancing it by
++ * one before calling.
+ */
+ static inline struct zoneref *first_zones_zonelist(struct zonelist *zonelist,
+ enum zone_type highest_zoneidx,
+@@ -795,7 +795,7 @@ static inline struct zoneref *first_zone
+ #define for_each_zone_zonelist_nodemask(zone, z, zlist, highidx, nodemask) \
+ for (z = first_zones_zonelist(zlist, highidx, nodemask, &zone); \
+ zone; \
+- z = next_zones_zonelist(z, highidx, nodemask, &zone)) \
++ z = next_zones_zonelist(++z, highidx, nodemask, &zone)) \
+
+ /**
+ * for_each_zone_zonelist - helper macro to iterate over valid zones in a zonelist at or below a given zone index
+--- a/mm/mmzone.c
++++ b/mm/mmzone.c
+@@ -69,6 +69,6 @@ struct zoneref *next_zones_zonelist(stru
+ (z->zone && !zref_in_nodemask(z, nodes)))
+ z++;
+
+- *zone = zonelist_zone(z++);
++ *zone = zonelist_zone(z);
+ return z;
+ }
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:28 2008
+Message-Id: <20081007002728.080115814@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:14 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ned Forrester <nforrester@whoi.edu>,
+ Vernon Sauder <vernoninhand@gmail.com>,
+ Eric Miao <eric.y.miao@gmail.com>,
+ David Brownell <dbrownell@users.sourceforge.net>
+Subject: [patch 08/71] pxa2xx_spi: dma bugfixes
+Content-Disposition: inline; filename=pxa2xx_spi-dma-bugfixes.patch
+Content-Length: 4822
+Lines: 129
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Ned Forrester <nforrester@whoi.edu>
+
+commit 7e96445533ac3f4f7964646a202ff3620602fab4 upstream
+
+Fixes two DMA bugs in the pxa2xx_spi driver. The first bug is in all
+versions of this driver; the second was introduced in the 2.6.20 kernel,
+and prevents using the driver with chips like m25p16 flash (which can
+issue large DMA reads).
+
+ 1. Zero length transfers are permitted for use to insert timing,
+ but pxa2xx_spi.c will fail if this is requested in DMA mode.
+ Fixed by using programmed I/O (PIO) mode for such transfers.
+
+ 2. Transfers larger than 8191 are not permitted in DMA mode. A
+ test for length rejects all large transfers regardless of DMA
+ or PIO mode. Worked around by rejecting only large transfers
+ with DMA mapped buffers, and forcing all other transfers
+ larger than 8191 to use PIO mode. A rate limited warning is
+ issued for DMA transfers forced to PIO mode.
+
+This patch should apply to all kernels back to and including 2.6.20;
+it was test patched against 2.6.20. An additional patch would be
+required for older kernels, but those versions are very buggy anyway.
+
+Signed-off-by: Ned Forrester <nforrester@whoi.edu>
+Cc: Vernon Sauder <vernoninhand@gmail.com>
+Cc: Eric Miao <eric.y.miao@gmail.com>
+Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/spi/pxa2xx_spi.c | 57 +++++++++++++++++++++++++++++++++++------------
+ 1 file changed, 43 insertions(+), 14 deletions(-)
+
+--- a/drivers/spi/pxa2xx_spi.c
++++ b/drivers/spi/pxa2xx_spi.c
+@@ -48,9 +48,10 @@ MODULE_ALIAS("platform:pxa2xx-spi");
+
+ #define MAX_BUSES 3
+
+-#define DMA_INT_MASK (DCSR_ENDINTR | DCSR_STARTINTR | DCSR_BUSERR)
+-#define RESET_DMA_CHANNEL (DCSR_NODESC | DMA_INT_MASK)
+-#define IS_DMA_ALIGNED(x) (((u32)(x)&0x07)==0)
++#define DMA_INT_MASK (DCSR_ENDINTR | DCSR_STARTINTR | DCSR_BUSERR)
++#define RESET_DMA_CHANNEL (DCSR_NODESC | DMA_INT_MASK)
++#define IS_DMA_ALIGNED(x) (((x) & 0x07) == 0)
++#define MAX_DMA_LEN 8191
+
+ /*
+ * for testing SSCR1 changes that require SSP restart, basically
+@@ -850,14 +851,27 @@ static void pump_transfers(unsigned long
+ udelay(previous->delay_usecs);
+ }
+
+- /* Check transfer length */
+- if (transfer->len > 8191)
+- {
+- dev_warn(&drv_data->pdev->dev, "pump_transfers: transfer "
+- "length greater than 8191\n");
+- message->status = -EINVAL;
+- giveback(drv_data);
+- return;
++ /* Check for transfers that need multiple DMA segments */
++ if (transfer->len > MAX_DMA_LEN && chip->enable_dma) {
++
++ /* reject already-mapped transfers; PIO won't always work */
++ if (message->is_dma_mapped
++ || transfer->rx_dma || transfer->tx_dma) {
++ dev_err(&drv_data->pdev->dev,
++ "pump_transfers: mapped transfer length "
++ "of %lu is greater than %d\n",
++ transfer->len, MAX_DMA_LEN);
++ message->status = -EINVAL;
++ giveback(drv_data);
++ return;
++ }
++
++ /* warn ... we force this to PIO mode */
++ if (printk_ratelimit())
++ dev_warn(&message->spi->dev, "pump_transfers: "
++ "DMA disabled for transfer length %ld "
++ "greater than %d\n",
++ (long)drv_data->len, MAX_DMA_LEN);
+ }
+
+ /* Setup the transfer state based on the type of transfer */
+@@ -926,7 +940,7 @@ static void pump_transfers(unsigned long
+ &dma_thresh))
+ if (printk_ratelimit())
+ dev_warn(&message->spi->dev,
+- "pump_transfer: "
++ "pump_transfers: "
+ "DMA burst size reduced to "
+ "match bits_per_word\n");
+ }
+@@ -940,8 +954,23 @@ static void pump_transfers(unsigned long
+
+ message->state = RUNNING_STATE;
+
+- /* Try to map dma buffer and do a dma transfer if successful */
+- if ((drv_data->dma_mapped = map_dma_buffers(drv_data))) {
++ /* Try to map dma buffer and do a dma transfer if successful, but
++ * only if the length is non-zero and less than MAX_DMA_LEN.
++ *
++ * Zero-length non-descriptor DMA is illegal on PXA2xx; force use
++ * of PIO instead. Care is needed above because the transfer may
++ * have have been passed with buffers that are already dma mapped.
++ * A zero-length transfer in PIO mode will not try to write/read
++ * to/from the buffers
++ *
++ * REVISIT large transfers are exactly where we most want to be
++ * using DMA. If this happens much, split those transfers into
++ * multiple DMA segments rather than forcing PIO.
++ */
++ drv_data->dma_mapped = 0;
++ if (drv_data->len > 0 && drv_data->len <= MAX_DMA_LEN)
++ drv_data->dma_mapped = map_dma_buffers(drv_data);
++ if (drv_data->dma_mapped) {
+
+ /* Ensure we have the correct interrupt handler */
+ drv_data->transfer_handler = dma_transfer;
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:28 2008
+Message-Id: <20081007002728.249025830@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:15 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ned Forrester <nforrester@whoi.edu>,
+ Vernon Sauder <vernoninhand@gmail.com>,
+ Eric Miao <eric.y.miao@gmail.com>,
+ David Brownell <dbrownell@users.sourceforge.net>
+Subject: [patch 09/71] pxa2xx_spi: chipselect bugfixes
+Content-Disposition: inline; filename=pxa2xx_spi-chipselect-bugfixes.patch
+Content-Length: 5814
+Lines: 163
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Ned Forrester <nforrester@whoi.edu>
+
+commit 8423597d676615f3dd2d9ab36f59f147086b90b8 upstream
+
+Fixes several chipselect bugs in the pxa2xx_spi driver. These bugs are in
+all versions of this driver and prevent using it with chips like m25p16
+flash.
+
+ 1. The spi_transfer.cs_change flag is handled too early:
+ before spi_transfer.delay_usecs applies, thus making the
+ delay ineffective at holding chip select.
+
+ 2. spi_transfer.delay_usecs is ignored on the last transfer
+ of a message (likewise not holding chipselect long enough).
+
+ 3. If spi_transfer.cs_change is set on the last transfer, the
+ chip select is always disabled, instead of the intended
+ meaning: optionally holding chip select enabled for the
+ next message.
+
+Those first three bugs were fixed with a relocation of delays
+and chip select de-assertions.
+
+ 4. If a message has the cs_change flag set on the last transfer,
+ and had the chip select stayed enabled as requested (see 3,
+ above), it would not have been disabled if the next message is
+ for a different chip. Fixed by dropping chip select regardless
+ of cs_change at end of a message, if there is no next message
+ or if the next message is for a different chip.
+
+This patch should apply to all kernels back to and including 2.6.20;
+it was test patched against 2.6.20. An additional patch would be
+required for older kernels, but those versions are very buggy anyway.
+
+Signed-off-by: Ned Forrester <nforrester@whoi.edu>
+Cc: Vernon Sauder <vernoninhand@gmail.com>
+Cc: Eric Miao <eric.y.miao@gmail.com>
+Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/spi/pxa2xx_spi.c | 59 ++++++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 48 insertions(+), 11 deletions(-)
+
+--- a/drivers/spi/pxa2xx_spi.c
++++ b/drivers/spi/pxa2xx_spi.c
+@@ -146,7 +146,6 @@ struct driver_data {
+ size_t tx_map_len;
+ u8 n_bytes;
+ u32 dma_width;
+- int cs_change;
+ int (*write)(struct driver_data *drv_data);
+ int (*read)(struct driver_data *drv_data);
+ irqreturn_t (*transfer_handler)(struct driver_data *drv_data);
+@@ -408,8 +407,45 @@ static void giveback(struct driver_data
+ struct spi_transfer,
+ transfer_list);
+
++ /* Delay if requested before any change in chip select */
++ if (last_transfer->delay_usecs)
++ udelay(last_transfer->delay_usecs);
++
++ /* Drop chip select UNLESS cs_change is true or we are returning
++ * a message with an error, or next message is for another chip
++ */
+ if (!last_transfer->cs_change)
+ drv_data->cs_control(PXA2XX_CS_DEASSERT);
++ else {
++ struct spi_message *next_msg;
++
++ /* Holding of cs was hinted, but we need to make sure
++ * the next message is for the same chip. Don't waste
++ * time with the following tests unless this was hinted.
++ *
++ * We cannot postpone this until pump_messages, because
++ * after calling msg->complete (below) the driver that
++ * sent the current message could be unloaded, which
++ * could invalidate the cs_control() callback...
++ */
++
++ /* get a pointer to the next message, if any */
++ spin_lock_irqsave(&drv_data->lock, flags);
++ if (list_empty(&drv_data->queue))
++ next_msg = NULL;
++ else
++ next_msg = list_entry(drv_data->queue.next,
++ struct spi_message, queue);
++ spin_unlock_irqrestore(&drv_data->lock, flags);
++
++ /* see if the next and current messages point
++ * to the same chip
++ */
++ if (next_msg && next_msg->spi != msg->spi)
++ next_msg = NULL;
++ if (!next_msg || msg->state == ERROR_STATE)
++ drv_data->cs_control(PXA2XX_CS_DEASSERT);
++ }
+
+ msg->state = NULL;
+ if (msg->complete)
+@@ -492,10 +528,9 @@ static void dma_transfer_complete(struct
+ msg->actual_length += drv_data->len -
+ (drv_data->rx_end - drv_data->rx);
+
+- /* Release chip select if requested, transfer delays are
+- * handled in pump_transfers */
+- if (drv_data->cs_change)
+- drv_data->cs_control(PXA2XX_CS_DEASSERT);
++ /* Transfer delays and chip select release are
++ * handled in pump_transfers or giveback
++ */
+
+ /* Move to next transfer */
+ msg->state = next_transfer(drv_data);
+@@ -604,10 +639,9 @@ static void int_transfer_complete(struct
+ drv_data->cur_msg->actual_length += drv_data->len -
+ (drv_data->rx_end - drv_data->rx);
+
+- /* Release chip select if requested, transfer delays are
+- * handled in pump_transfers */
+- if (drv_data->cs_change)
+- drv_data->cs_control(PXA2XX_CS_DEASSERT);
++ /* Transfer delays and chip select release are
++ * handled in pump_transfers or giveback
++ */
+
+ /* Move to next transfer */
+ drv_data->cur_msg->state = next_transfer(drv_data);
+@@ -842,13 +876,17 @@ static void pump_transfers(unsigned long
+ return;
+ }
+
+- /* Delay if requested at end of transfer*/
++ /* Delay if requested at end of transfer before CS change */
+ if (message->state == RUNNING_STATE) {
+ previous = list_entry(transfer->transfer_list.prev,
+ struct spi_transfer,
+ transfer_list);
+ if (previous->delay_usecs)
+ udelay(previous->delay_usecs);
++
++ /* Drop chip select only if cs_change is requested */
++ if (previous->cs_change)
++ drv_data->cs_control(PXA2XX_CS_DEASSERT);
+ }
+
+ /* Check for transfers that need multiple DMA segments */
+@@ -893,7 +931,6 @@ static void pump_transfers(unsigned long
+ drv_data->len = transfer->len & DCMD_LENGTH;
+ drv_data->write = drv_data->tx ? chip->write : null_writer;
+ drv_data->read = drv_data->rx ? chip->read : null_reader;
+- drv_data->cs_change = transfer->cs_change;
+
+ /* Change speed and bit per word on a per transfer */
+ cr0 = chip->cr0;
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:28 2008
+Message-Id: <20081007002728.414441755@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:16 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Kirill A. Shutemov" <kirill@shutemov.name>
+Subject: [patch 10/71] smb.h: do not include linux/time.h in userspace
+Content-Disposition: inline; filename=smb.h-do-not-include-linux-time.h-in-userspace.patch
+Content-Length: 930
+Lines: 37
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Kirill A. Shutemov <kirill@shutemov.name>
+
+commit c32a162fd420fe8dfb049db941b2438061047fcc upstream
+
+linux/time.h conflicts with time.h from glibc
+
+It breaks building smbmount from samba. It's regression introduced by
+commit 76308da (" smb.h: uses struct timespec but didn't include
+linux/time.h").
+
+Signed-off-by: Kirill A. Shutemov <kirill@shutemov.name>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/smb.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/include/linux/smb.h
++++ b/include/linux/smb.h
+@@ -11,7 +11,9 @@
+
+ #include <linux/types.h>
+ #include <linux/magic.h>
++#ifdef __KERNEL__
+ #include <linux/time.h>
++#endif
+
+ enum smb_protocol {
+ SMB_PROTOCOL_NONE,
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:28 2008
+Message-Id: <20081007002728.599139531@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:17 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Geoff Levand <geoffrey.levand@am.sony.com>,
+ Alan Stern <stern@rowland.harvard.edu>,
+ Stefan Becker <Stefan.Becker@nokia.com>
+Subject: [patch 11/71] USB: fix hcd interrupt disabling
+Content-Disposition: inline; filename=usb-fix-hcd-interrupt-disabling.patch
+Content-Length: 1743
+Lines: 48
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Geoff Levand <geoffrey.levand@am.sony.com>
+
+commit 83a798207361cc26385187b2e71efa2b5d75de7f upstream
+
+Commit de85422b94ddb23c021126815ea49414047c13dc, 'USB: fix interrupt
+disabling for HCDs with shared interrupt handlers' changed usb_add_hcd()
+to strip IRQF_DISABLED from irqflags prior to calling request_irq()
+with the justification that such a removal was necessary for shared
+interrupts to work properly. Unfortunately, the change in that commit
+unconditionally removes the IRQF_DISABLED flag, causing problems on
+platforms that don't use a shared interrupt but require IRQF_DISABLED.
+This change adds a check for IRQF_SHARED prior to removing the
+IRQF_DISABLED flag.
+
+Fixes the PS3 system startup hang reported with recent Fedora and
+OpenSUSE kernels.
+
+Note that this problem is hidden when CONFIG_LOCKDEP=y (ps3_defconfig),
+as local_irq_enable_in_hardirq() is defined as a null statement for
+that config.
+
+Signed-off-by: Geoff Levand <geoffrey.levand@am.sony.com>
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Cc: Stefan Becker <Stefan.Becker@nokia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/hcd.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -1885,7 +1885,8 @@ int usb_add_hcd(struct usb_hcd *hcd,
+ * with IRQF_SHARED. As usb_hcd_irq() will always disable
+ * interrupts we can remove it here.
+ */
+- irqflags &= ~IRQF_DISABLED;
++ if (irqflags & IRQF_SHARED)
++ irqflags &= ~IRQF_DISABLED;
+
+ snprintf(hcd->irq_descr, sizeof(hcd->irq_descr), "%s:usb%d",
+ hcd->driver->description, hcd->self.busnum);
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:28 2008
+Message-Id: <20081007002728.785372905@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:18 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andrew Vasquez <andrew.vasquez@qlogic.com>,
+ James Bottomley <James.Bottomley@HansenPartnership.com>
+Subject: [patch 12/71] SCSI: qla2xxx: Defer enablement of RISC interrupts until ISP initialization completes.
+Content-Disposition: inline; filename=scsi-qla2xxx-defer-enablement-of-risc-interrupts-until-isp-initialization-completes.patch
+Content-Length: 2368
+Lines: 73
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Andrew Vasquez <andrew.vasquez@qlogic.com>
+
+commit 048feec5548c0582ee96148c61b87cccbcb5f9be upstream
+
+Josip Rodin noted
+(http://article.gmane.org/gmane.linux.ports.sparc/10152) the
+driver oopsing during registration of an rport to the
+FC-transport layer with a backtrace indicating a dereferencing of
+an shost->shost_data equal to NULL. David Miller identified a
+small window in driver logic where this could happen:
+
+ > Look at how the driver registers the IRQ handler before the host has
+ > been registered with the SCSI layer.
+ >
+ > That leads to a window of time where the shost hasn't been setup
+ > fully, yet ISRs can come in and trigger DPC thread events, such as
+ > loop resyncs, which expect the transport area to be setup.
+ >
+ > But it won't be setup, because scsi_add_host() hasn't finished yet.
+ >
+ > Note that in Josip's crash log, we don't even see the
+ >
+ > qla_printk(KERN_INFO, ha, "\n"
+ > " QLogic Fibre Channel HBA Driver: %s\n"
+ > " QLogic %s - %s\n"
+ > " ISP%04X: %s @ %s hdma%c, host#=%ld, fw=%s\n",
+ > ...
+ >
+ > message yet.
+ >
+ > Which means that the crash occurs between qla2x00_request_irqs()
+ > and printing that message.
+
+Close this window by enabling RISC interrupts after the host has
+been registered with the SCSI midlayer.
+
+Reported-by: Josip Rodin <joy@entuzijast.net>
+Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/qla2xxx/qla_isr.c | 1 -
+ drivers/scsi/qla2xxx/qla_os.c | 2 ++
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -1838,7 +1838,6 @@ clear_risc_ints:
+ WRT_REG_WORD(®->isp.hccr, HCCR_CLR_HOST_INT);
+ }
+ spin_unlock_irq(&ha->hardware_lock);
+- ha->isp_ops->enable_intrs(ha);
+
+ fail:
+ return ret;
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -1740,6 +1740,8 @@ qla2x00_probe_one(struct pci_dev *pdev,
+ if (ret)
+ goto probe_failed;
+
++ ha->isp_ops->enable_intrs(ha);
++
+ scsi_scan_host(host);
+
+ qla2x00_alloc_sysfs_attr(ha);
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:29 2008
+Message-Id: <20081007002728.957558197@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:19 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 13/71] ALSA: hda - Fix model for Dell Inspiron 1525
+Content-Disposition: inline; filename=alsa-hda-fix-model-for-dell-inspiron-1525.patch
+Content-Length: 1432
+Lines: 35
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 24918b61b55c21e09a3e07cd82e1b3a8154782dc upstream
+
+Dell Inspiron 1525 seems to have a buggy BIOS setup and screws up
+the recent codec parser, as reported by Oleksandr Natalenko:
+ http://lkml.org/lkml/2008/9/12/203
+
+This patch adds the working model, dell-3stack, statically.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -1667,8 +1667,8 @@ static struct snd_pci_quirk stac927x_cfg
+ /* Dell 3 stack systems with verb table in BIOS */
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01f3, "Dell Inspiron 1420", STAC_DELL_BIOS),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0227, "Dell Vostro 1400 ", STAC_DELL_BIOS),
+- SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x022f, "Dell ", STAC_DELL_BIOS),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x022e, "Dell ", STAC_DELL_BIOS),
++ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x022f, "Dell Inspiron 1525", STAC_DELL_3ST),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0242, "Dell ", STAC_DELL_BIOS),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0243, "Dell ", STAC_DELL_BIOS),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02ff, "Dell ", STAC_DELL_BIOS),
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:29 2008
+Message-Id: <20081007002729.116999411@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:20 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Clemens Ladisch <clemens@ladisch.de>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 14/71] ALSA: oxygen: fix distorted output on AK4396-based cards
+Content-Disposition: inline; filename=alsa-oxygen-fix-distorted-output-on-ak4396-based-cards.patch
+Content-Length: 2157
+Lines: 70
+
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Clemens Ladisch <clemens@ladisch.de>
+
+Upstream-commit-id: df91bc23dcb052ff2da71b3482bf3c5fbf4b8a53
+
+When changing the sample rate, the CMI8788's master clock output becomes
+unstable for a short time. The AK4396 needs the master clock to do SPI
+writes, so writing to an AK4396 control register directly after a sample
+rate change will garble the value. In our case, this leads to the DACs
+being misconfigured to I2S sample format, which results in a wrong
+output level and horrible distortions on samples louder than -6 dB.
+
+To fix this, we need to wait until the new master clock signal has
+become stable before doing SPI writes.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/oxygen/hifier.c | 4 ++++
+ sound/pci/oxygen/oxygen.c | 4 ++++
+ 2 files changed, 8 insertions(+)
+
+--- a/sound/pci/oxygen/hifier.c
++++ b/sound/pci/oxygen/hifier.c
+@@ -17,6 +17,7 @@
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
++#include <linux/delay.h>
+ #include <linux/pci.h>
+ #include <sound/control.h>
+ #include <sound/core.h>
+@@ -95,6 +96,9 @@ static void set_ak4396_params(struct oxy
+ else
+ value |= AK4396_DFS_QUAD;
+ data->ak4396_ctl2 = value;
++
++ msleep(1); /* wait for the new MCLK to become stable */
++
+ ak4396_write(chip, AK4396_CONTROL_1, AK4396_DIF_24_MSB);
+ ak4396_write(chip, AK4396_CONTROL_2, value);
+ ak4396_write(chip, AK4396_CONTROL_1, AK4396_DIF_24_MSB | AK4396_RSTN);
+--- a/sound/pci/oxygen/oxygen.c
++++ b/sound/pci/oxygen/oxygen.c
+@@ -28,6 +28,7 @@
+ * GPIO 1 -> DFS1 of AK5385
+ */
+
++#include <linux/delay.h>
+ #include <linux/mutex.h>
+ #include <linux/pci.h>
+ #include <sound/ac97_codec.h>
+@@ -173,6 +174,9 @@ static void set_ak4396_params(struct oxy
+ else
+ value |= AK4396_DFS_QUAD;
+ data->ak4396_ctl2 = value;
++
++ msleep(1); /* wait for the new MCLK to become stable */
++
+ for (i = 0; i < 4; ++i) {
+ ak4396_write(chip, i,
+ AK4396_CONTROL_1, AK4396_DIF_24_MSB);
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:29 2008
+Message-Id: <20081007002729.304323639@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:21 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 15/71] ALSA: fix locking in snd_pcm_open*() and snd_rawmidi_open*()
+Content-Disposition: inline; filename=alsa-fix-locking-in-snd_pcm_open-and-snd_rawmidi_open.patch
+Content-Length: 2243
+Lines: 72
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Takashi Iwai <tiwai@suse.de>
+
+Upstream-commit-id: 399ccdc1cd4e92e541d4dacbbf18c52bd693418b
+
+The PCM and rawmidi open callbacks have a lock against card->controls_list
+but it takes a wrong one, card->controls_rwsem, instead of a right one
+card->ctl_files_rwlock. This patch fixes them.
+
+This change also fixes automatically the potential deadlocks due to
+mm->mmap_sem in munmap and copy_from/to_user, reported by Sitsofe
+Wheeler:
+
+ A: snd_ctl_elem_user_tlv(): card->controls_rwsem => mm->mmap_sem
+ B: snd_pcm_open(): card->open_mutex => card->controls_rwsem
+ C: munmap: mm->mmap_sem => snd_pcm_release(): card->open_mutex
+
+The patch breaks the chain.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/pcm.c | 4 ++--
+ sound/core/rawmidi.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/sound/core/pcm.c
++++ b/sound/core/pcm.c
+@@ -781,7 +781,7 @@ int snd_pcm_attach_substream(struct snd_
+ return -ENODEV;
+
+ card = pcm->card;
+- down_read(&card->controls_rwsem);
++ read_lock(&card->ctl_files_rwlock);
+ list_for_each_entry(kctl, &card->ctl_files, list) {
+ if (kctl->pid == current->pid) {
+ prefer_subdevice = kctl->prefer_pcm_subdevice;
+@@ -789,7 +789,7 @@ int snd_pcm_attach_substream(struct snd_
+ break;
+ }
+ }
+- up_read(&card->controls_rwsem);
++ read_unlock(&card->ctl_files_rwlock);
+
+ switch (stream) {
+ case SNDRV_PCM_STREAM_PLAYBACK:
+--- a/sound/core/rawmidi.c
++++ b/sound/core/rawmidi.c
+@@ -418,7 +418,7 @@ static int snd_rawmidi_open(struct inode
+ mutex_lock(&rmidi->open_mutex);
+ while (1) {
+ subdevice = -1;
+- down_read(&card->controls_rwsem);
++ read_lock(&card->ctl_files_rwlock);
+ list_for_each_entry(kctl, &card->ctl_files, list) {
+ if (kctl->pid == current->pid) {
+ subdevice = kctl->prefer_rawmidi_subdevice;
+@@ -426,7 +426,7 @@ static int snd_rawmidi_open(struct inode
+ break;
+ }
+ }
+- up_read(&card->controls_rwsem);
++ read_unlock(&card->ctl_files_rwlock);
+ err = snd_rawmidi_kernel_open(rmidi->card, rmidi->device,
+ subdevice, fflags, rawmidi_file);
+ if (err >= 0)
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:29 2008
+Message-Id: <20081007002729.471219502@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:22 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 16/71] ALSA: remove unneeded power_mutex lock in snd_pcm_drop
+Content-Disposition: inline; filename=alsa-remove-unneeded-power_mutex-lock-in-snd_pcm_drop.patch
+Content-Length: 1519
+Lines: 51
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Takashi Iwai <tiwai@suse.de>
+
+Upstream-commit-id: 24e8fc498e9618338854bfbcf8d1d737e0bf1775
+
+The power_mutex lock in snd_pcm_drop may cause a possible deadlock
+chain, and above all, it's unneeded. Let's get rid of it.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/pcm_native.c | 13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -1545,16 +1545,10 @@ static int snd_pcm_drop(struct snd_pcm_s
+ card = substream->pcm->card;
+
+ if (runtime->status->state == SNDRV_PCM_STATE_OPEN ||
+- runtime->status->state == SNDRV_PCM_STATE_DISCONNECTED)
++ runtime->status->state == SNDRV_PCM_STATE_DISCONNECTED ||
++ runtime->status->state == SNDRV_PCM_STATE_SUSPENDED)
+ return -EBADFD;
+
+- snd_power_lock(card);
+- if (runtime->status->state == SNDRV_PCM_STATE_SUSPENDED) {
+- result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
+- if (result < 0)
+- goto _unlock;
+- }
+-
+ snd_pcm_stream_lock_irq(substream);
+ /* resume pause */
+ if (runtime->status->state == SNDRV_PCM_STATE_PAUSED)
+@@ -1563,8 +1557,7 @@ static int snd_pcm_drop(struct snd_pcm_s
+ snd_pcm_stop(substream, SNDRV_PCM_STATE_SETUP);
+ /* runtime->control->appl_ptr = runtime->status->hw_ptr; */
+ snd_pcm_stream_unlock_irq(substream);
+- _unlock:
+- snd_power_unlock(card);
++
+ return result;
+ }
+
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:29 2008
+Message-Id: <20081007002729.631887967@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:23 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Joerg Roedel <joerg.roedel@amd.com>,
+ Alexander Graf <agraf@suse.de>,
+ Avi Kivity <avi@qumranet.com>
+Subject: [patch 17/71] KVM: SVM: fix random segfaults with NPT enabled
+Content-Disposition: inline; filename=kvm-svm-fix-random-segfaults-with-npt-enabled.patch
+Content-Length: 1612
+Lines: 51
+
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+(cherry picked from commit 44874f84918e37b64bec6df1587e5fe2fdf6ab62)
+
+This patch introduces a guest TLB flush on every NPF exit in KVM. This fixes
+random segfaults and #UD exceptions in the guest seen under some workloads
+(e.g. long running compile workloads or tbench). A kernbench run with and
+without that fix showed that it has a slowdown lower than 0.5%
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Alexander Graf <agraf@suse.de>
+Signed-off-by: Avi Kivity <avi@qumranet.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/svm.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -60,6 +60,7 @@ static int npt = 1;
+ module_param(npt, int, S_IRUGO);
+
+ static void kvm_reput_irq(struct vcpu_svm *svm);
++static void svm_flush_tlb(struct kvm_vcpu *vcpu);
+
+ static inline struct vcpu_svm *to_svm(struct kvm_vcpu *vcpu)
+ {
+@@ -1017,6 +1018,15 @@ static int pf_interception(struct vcpu_s
+
+ fault_address = svm->vmcb->control.exit_info_2;
+ error_code = svm->vmcb->control.exit_info_1;
++
++ /*
++ * FIXME: Tis shouldn't be necessary here, but there is a flush
++ * missing in the MMU code. Until we find this bug, flush the
++ * complete TLB here on an NPF
++ */
++ if (npt_enabled)
++ svm_flush_tlb(&svm->vcpu);
++
+ if (event_injection)
+ kvm_mmu_unprotect_page_virt(&svm->vcpu, fault_address);
+ return kvm_mmu_page_fault(&svm->vcpu, fault_address, error_code);
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:29 2008
+Message-Id: <20081007002729.815559565@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:24 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Joerg Roedel <joerg.roedel@amd.com>,
+ Avi Kivity <avi@qumranet.com>
+Subject: [patch 18/71] KVM: SVM: fix guest global tlb flushes with NPT
+Content-Disposition: inline; filename=kvm-svm-fix-guest-global-tlb-flushes-with-npt.patch
+Content-Length: 1041
+Lines: 35
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+(cherry picked from commit e5eab0cede4b1ffaca4ad857d840127622038e55)
+
+Accesses to CR4 are intercepted even with Nested Paging enabled. But the code
+does not check if the guest wants to do a global TLB flush. So this flush gets
+lost. This patch adds the check and the flush to svm_set_cr4.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Avi Kivity <avi@qumranet.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/svm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -880,6 +880,10 @@ set:
+ static void svm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
+ {
+ unsigned long host_cr4_mce = read_cr4() & X86_CR4_MCE;
++ unsigned long old_cr4 = to_svm(vcpu)->vmcb->save.cr4;
++
++ if (npt_enabled && ((old_cr4 ^ cr4) & X86_CR4_PGE))
++ force_new_asid(vcpu);
+
+ vcpu->arch.cr4 = cr4;
+ if (!npt_enabled)
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:30 2008
+Message-Id: <20081007002729.956508764@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:25 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ mingo@elte.hu,
+ Suresh Siddha <suresh.b.siddha@intel.com>
+Subject: [patch 19/71] x86-64: Clean up save/restore_i387() usage
+Content-Disposition: inline; filename=x86-64-clean-up-save-restore-i387-usage.patch
+Content-Length: 4284
+Lines: 161
+
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit b30f3ae50cd03ef2ff433a5030fbf88dd8323528]
+
+Suresh Siddha wants to fix a possible FPU leakage in error conditions,
+but the fact that save/restore_i387() are inlines in a header file makes
+that harder to do than necessary. So start off with an obvious cleanup.
+
+This just moves the x86-64 version of save/restore_i387() out of the
+header file, and moves it to the only file that it is actually used in:
+arch/x86/kernel/signal_64.c. So exposing it in a header file was wrong
+to begin with.
+
+[ Side note: I'd like to fix up some of the games we play with the
+ 32-bit version of these functions too, but that's a separate
+ matter. The 32-bit versions are shared - under different names
+ at that! - by both the native x86-32 code and the x86-64 32-bit
+ compatibility code ]
+
+Acked-by: Suresh Siddha <suresh.b.siddha@intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+
+---
+ arch/x86/kernel/signal_64.c | 53 +++++++++++++++++++++++++++++++++++++++++++
+ include/asm-x86/i387.h | 54 --------------------------------------------
+ 2 files changed, 53 insertions(+), 54 deletions(-)
+
+--- a/arch/x86/kernel/signal_64.c
++++ b/arch/x86/kernel/signal_64.c
+@@ -53,6 +53,59 @@ sys_sigaltstack(const stack_t __user *us
+ return do_sigaltstack(uss, uoss, regs->sp);
+ }
+
++/*
++ * Signal frame handlers.
++ */
++
++static inline int save_i387(struct _fpstate __user *buf)
++{
++ struct task_struct *tsk = current;
++ int err = 0;
++
++ BUILD_BUG_ON(sizeof(struct user_i387_struct) !=
++ sizeof(tsk->thread.xstate->fxsave));
++
++ if ((unsigned long)buf % 16)
++ printk("save_i387: bad fpstate %p\n", buf);
++
++ if (!used_math())
++ return 0;
++ clear_used_math(); /* trigger finit */
++ if (task_thread_info(tsk)->status & TS_USEDFPU) {
++ err = save_i387_checking((struct i387_fxsave_struct __user *)
++ buf);
++ if (err)
++ return err;
++ task_thread_info(tsk)->status &= ~TS_USEDFPU;
++ stts();
++ } else {
++ if (__copy_to_user(buf, &tsk->thread.xstate->fxsave,
++ sizeof(struct i387_fxsave_struct)))
++ return -1;
++ }
++ return 1;
++}
++
++/*
++ * This restores directly out of user space. Exceptions are handled.
++ */
++static inline int restore_i387(struct _fpstate __user *buf)
++{
++ struct task_struct *tsk = current;
++ int err;
++
++ if (!used_math()) {
++ err = init_fpu(tsk);
++ if (err)
++ return err;
++ }
++
++ if (!(task_thread_info(current)->status & TS_USEDFPU)) {
++ clts();
++ task_thread_info(current)->status |= TS_USEDFPU;
++ }
++ return restore_fpu_checking((__force struct i387_fxsave_struct *)buf);
++}
+
+ /*
+ * Do a signal return; undo the signal stack.
+--- a/include/asm-x86/i387.h
++++ b/include/asm-x86/i387.h
+@@ -138,60 +138,6 @@ static inline void __save_init_fpu(struc
+ task_thread_info(tsk)->status &= ~TS_USEDFPU;
+ }
+
+-/*
+- * Signal frame handlers.
+- */
+-
+-static inline int save_i387(struct _fpstate __user *buf)
+-{
+- struct task_struct *tsk = current;
+- int err = 0;
+-
+- BUILD_BUG_ON(sizeof(struct user_i387_struct) !=
+- sizeof(tsk->thread.xstate->fxsave));
+-
+- if ((unsigned long)buf % 16)
+- printk("save_i387: bad fpstate %p\n", buf);
+-
+- if (!used_math())
+- return 0;
+- clear_used_math(); /* trigger finit */
+- if (task_thread_info(tsk)->status & TS_USEDFPU) {
+- err = save_i387_checking((struct i387_fxsave_struct __user *)
+- buf);
+- if (err)
+- return err;
+- task_thread_info(tsk)->status &= ~TS_USEDFPU;
+- stts();
+- } else {
+- if (__copy_to_user(buf, &tsk->thread.xstate->fxsave,
+- sizeof(struct i387_fxsave_struct)))
+- return -1;
+- }
+- return 1;
+-}
+-
+-/*
+- * This restores directly out of user space. Exceptions are handled.
+- */
+-static inline int restore_i387(struct _fpstate __user *buf)
+-{
+- struct task_struct *tsk = current;
+- int err;
+-
+- if (!used_math()) {
+- err = init_fpu(tsk);
+- if (err)
+- return err;
+- }
+-
+- if (!(task_thread_info(current)->status & TS_USEDFPU)) {
+- clts();
+- task_thread_info(current)->status |= TS_USEDFPU;
+- }
+- return restore_fpu_checking((__force struct i387_fxsave_struct *)buf);
+-}
+-
+ #else /* CONFIG_X86_32 */
+
+ extern void finit(void);
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:30 2008
+Message-Id: <20081007002730.151183226@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:26 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ mingo@elte.hu,
+ Suresh Siddha <suresh.b.siddha@intel.com>
+Subject: [patch 20/71] x64, fpu: fix possible FPU leakage in error conditions
+Content-Disposition: inline; filename=x64-fpu-fix-possible-fpu-leakage-in-error-conditions.patch
+Content-Length: 3110
+Lines: 98
+
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Suresh Siddha <suresh.b.siddha@intel.com>
+
+[Upstream commit: 6ffac1e90a17ea0aded5c581204397421eec91b6]
+
+On Thu, Jul 24, 2008 at 03:43:44PM -0700, Linus Torvalds wrote:
+> So how about this patch as a starting point? This is the RightThing(tm) to
+> do regardless, and if it then makes it easier to do some other cleanups,
+> we should do it first. What do you think?
+
+restore_fpu_checking() calls init_fpu() in error conditions.
+
+While this is wrong(as our main intention is to clear the fpu state of
+the thread), this was benign before commit 92d140e21f1 ("x86: fix taking
+DNA during 64bit sigreturn").
+
+Post commit 92d140e21f1, live FPU registers may not belong to this
+process at this error scenario.
+
+In the error condition for restore_fpu_checking() (especially during the
+64bit signal return), we are doing init_fpu(), which saves the live FPU
+register state (possibly belonging to some other process context) into
+the thread struct (through unlazy_fpu() in init_fpu()). This is wrong
+and can leak the FPU data.
+
+For the signal handler restore error condition in restore_i387(), clear
+the fpu state present in the thread struct(before ultimately sending a
+SIGSEGV for badframe).
+
+For the paranoid error condition check in math_state_restore(), send a
+SIGSEGV, if we fail to restore the state.
+
+Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/signal_64.c | 11 ++++++++++-
+ arch/x86/kernel/traps_64.c | 9 ++++++++-
+ include/asm-x86/i387.h | 2 --
+ 3 files changed, 18 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/kernel/signal_64.c
++++ b/arch/x86/kernel/signal_64.c
+@@ -104,7 +104,16 @@ static inline int restore_i387(struct _f
+ clts();
+ task_thread_info(current)->status |= TS_USEDFPU;
+ }
+- return restore_fpu_checking((__force struct i387_fxsave_struct *)buf);
++ err = restore_fpu_checking((__force struct i387_fxsave_struct *)buf);
++ if (unlikely(err)) {
++ /*
++ * Encountered an error while doing the restore from the
++ * user buffer, clear the fpu state.
++ */
++ clear_fpu(tsk);
++ clear_used_math();
++ }
++ return err;
+ }
+
+ /*
+--- a/arch/x86/kernel/traps_64.c
++++ b/arch/x86/kernel/traps_64.c
+@@ -1141,7 +1141,14 @@ asmlinkage void math_state_restore(void)
+ }
+
+ clts(); /* Allow maths ops (or we recurse) */
+- restore_fpu_checking(&me->thread.xstate->fxsave);
++ /*
++ * Paranoid restore. send a SIGSEGV if we fail to restore the state.
++ */
++ if (unlikely(restore_fpu_checking(&me->thread.xstate->fxsave))) {
++ stts();
++ force_sig(SIGSEGV, me);
++ return;
++ }
+ task_thread_info(me)->status |= TS_USEDFPU;
+ me->fpu_counter++;
+ }
+--- a/include/asm-x86/i387.h
++++ b/include/asm-x86/i387.h
+@@ -63,8 +63,6 @@ static inline int restore_fpu_checking(s
+ #else
+ : [fx] "cdaSDb" (fx), "m" (*fx), "0" (0));
+ #endif
+- if (unlikely(err))
+- init_fpu(current);
+ return err;
+ }
+
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:30 2008
+Message-Id: <20081007002730.335608201@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:27 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Zachary Amsden <zach@vmware.com>,
+ Ingo Molnar <mingo@redhat.com>,
+ Glauber de Oliveira Costa <gcosta@redhat.com>
+Subject: [patch 21/71] x86: Fix broken LDT access in VMI
+Content-Disposition: inline; filename=x86-fix-broken-ldt-access-in-vmi.patch
+Content-Length: 1366
+Lines: 40
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Zachary Amsden <zach@vmware.com>
+
+commit de59985e3a623d4d5d6207f1777398ca0606ab1c upstream
+
+After investigating a JRE failure, I found this bug was introduced a
+long time ago, and had already managed to survive another bugfix which
+occurred on the same line. The result is a total failure of the JRE due
+to LDT selectors not working properly.
+
+This one took a long time to rear up because LDT usage is not very
+common, but the bug is quite serious. It got introduced along with
+another bug, already fixed, by 75b8bb3e56ca09a467fbbe5229bc68627f7445be
+
+Signed-off-by: Zachary Amsden <zach@vmware.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Glauber de Oliveira Costa <gcosta@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/vmi_32.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/vmi_32.c
++++ b/arch/x86/kernel/vmi_32.c
+@@ -234,7 +234,7 @@ static void vmi_write_ldt_entry(struct d
+ const void *desc)
+ {
+ u32 *ldt_entry = (u32 *)desc;
+- vmi_ops.write_idt_entry(dt, entry, ldt_entry[0], ldt_entry[1]);
++ vmi_ops.write_ldt_entry(dt, entry, ldt_entry[0], ldt_entry[1]);
+ }
+
+ static void vmi_load_sp0(struct tss_struct *tss,
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:30 2008
+Message-Id: <20081007002730.490039351@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:28 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jens Axboe <jens.axboe@oracle.com>
+Subject: [patch 22/71] block: submit_bh() inadvertently discards barrier flag on a sync write
+Content-Disposition: inline; filename=block-submit_bh-inadvertently-discards-barrier-flag-on-a-sync-write.patch
+Content-Length: 1289
+Lines: 48
+
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Jens Axboe <jens.axboe@oracle.com>
+
+commit 48fd4f93a00eac844678629f2f00518e146ed30d upstream
+
+Reported by Milan Broz <mbroz@redhat.com>, commit 18ce3751 inadvertently
+made submit_bh() discard the barrier bit for a WRITE_SYNC request. Fix
+that up.
+
+Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/buffer.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -2868,14 +2868,17 @@ int submit_bh(int rw, struct buffer_head
+ BUG_ON(!buffer_mapped(bh));
+ BUG_ON(!bh->b_end_io);
+
+- if (buffer_ordered(bh) && (rw == WRITE))
+- rw = WRITE_BARRIER;
++ /*
++ * Mask in barrier bit for a write (could be either a WRITE or a
++ * WRITE_SYNC
++ */
++ if (buffer_ordered(bh) && (rw & WRITE))
++ rw |= WRITE_BARRIER;
+
+ /*
+- * Only clear out a write error when rewriting, should this
+- * include WRITE_SYNC as well?
++ * Only clear out a write error when rewriting
+ */
+- if (test_set_buffer_req(bh) && (rw == WRITE || rw == WRITE_BARRIER))
++ if (test_set_buffer_req(bh) && (rw & WRITE))
+ clear_buffer_write_io_error(bh);
+
+ /*
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:30 2008
+Message-Id: <20081007002730.721874961@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:29 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Balbir Singh <balbir@linux.vnet.ibm.com>,
+ Peter Zijlstra <a.p.zijlstra@chello.nl>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 23/71] sched: fix process time monotonicity
+Content-Disposition: inline; filename=sched-fix-process-time-monotonicity.patch
+Content-Length: 5339
+Lines: 199
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Balbir Singh <balbir@linux.vnet.ibm.com>
+
+commit 49048622eae698e5c4ae61f7e71200f265ccc529 upstream
+
+Spencer reported a problem where utime and stime were going negative despite
+the fixes in commit b27f03d4bdc145a09fb7b0c0e004b29f1ee555fa. The suspected
+reason for the problem is that signal_struct maintains it's own utime and
+stime (of exited tasks), these are not updated using the new task_utime()
+routine, hence sig->utime can go backwards and cause the same problem
+to occur (sig->utime, adds tsk->utime and not task_utime()). This patch
+fixes the problem
+
+TODO: using max(task->prev_utime, derived utime) works for now, but a more
+generic solution is to implement cputime_max() and use the cputime_gt()
+function for comparison.
+
+Reported-by: spencer@bluehost.com
+Signed-off-by: Balbir Singh <balbir@linux.vnet.ibm.com>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/proc/array.c | 59 --------------------------------------------------
+ include/linux/sched.h | 4 +++
+ kernel/exit.c | 6 ++---
+ kernel/sched.c | 59 ++++++++++++++++++++++++++++++++++++++++++++++++++
+ 4 files changed, 66 insertions(+), 62 deletions(-)
+
+--- a/fs/proc/array.c
++++ b/fs/proc/array.c
+@@ -332,65 +332,6 @@ int proc_pid_status(struct seq_file *m,
+ return 0;
+ }
+
+-/*
+- * Use precise platform statistics if available:
+- */
+-#ifdef CONFIG_VIRT_CPU_ACCOUNTING
+-static cputime_t task_utime(struct task_struct *p)
+-{
+- return p->utime;
+-}
+-
+-static cputime_t task_stime(struct task_struct *p)
+-{
+- return p->stime;
+-}
+-#else
+-static cputime_t task_utime(struct task_struct *p)
+-{
+- clock_t utime = cputime_to_clock_t(p->utime),
+- total = utime + cputime_to_clock_t(p->stime);
+- u64 temp;
+-
+- /*
+- * Use CFS's precise accounting:
+- */
+- temp = (u64)nsec_to_clock_t(p->se.sum_exec_runtime);
+-
+- if (total) {
+- temp *= utime;
+- do_div(temp, total);
+- }
+- utime = (clock_t)temp;
+-
+- p->prev_utime = max(p->prev_utime, clock_t_to_cputime(utime));
+- return p->prev_utime;
+-}
+-
+-static cputime_t task_stime(struct task_struct *p)
+-{
+- clock_t stime;
+-
+- /*
+- * Use CFS's precise accounting. (we subtract utime from
+- * the total, to make sure the total observed by userspace
+- * grows monotonically - apps rely on that):
+- */
+- stime = nsec_to_clock_t(p->se.sum_exec_runtime) -
+- cputime_to_clock_t(task_utime(p));
+-
+- if (stime >= 0)
+- p->prev_stime = max(p->prev_stime, clock_t_to_cputime(stime));
+-
+- return p->prev_stime;
+-}
+-#endif
+-
+-static cputime_t task_gtime(struct task_struct *p)
+-{
+- return p->gtime;
+-}
+-
+ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
+ struct pid *pid, struct task_struct *task, int whole)
+ {
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1477,6 +1477,10 @@ static inline void put_task_struct(struc
+ __put_task_struct(t);
+ }
+
++extern cputime_t task_utime(struct task_struct *p);
++extern cputime_t task_stime(struct task_struct *p);
++extern cputime_t task_gtime(struct task_struct *p);
++
+ /*
+ * Per process flags
+ */
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -111,9 +111,9 @@ static void __exit_signal(struct task_st
+ * We won't ever get here for the group leader, since it
+ * will have been the last reference on the signal_struct.
+ */
+- sig->utime = cputime_add(sig->utime, tsk->utime);
+- sig->stime = cputime_add(sig->stime, tsk->stime);
+- sig->gtime = cputime_add(sig->gtime, tsk->gtime);
++ sig->utime = cputime_add(sig->utime, task_utime(tsk));
++ sig->stime = cputime_add(sig->stime, task_stime(tsk));
++ sig->gtime = cputime_add(sig->gtime, task_gtime(tsk));
+ sig->min_flt += tsk->min_flt;
+ sig->maj_flt += tsk->maj_flt;
+ sig->nvcsw += tsk->nvcsw;
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -3995,6 +3995,65 @@ void account_steal_time(struct task_stru
+ }
+
+ /*
++ * Use precise platform statistics if available:
++ */
++#ifdef CONFIG_VIRT_CPU_ACCOUNTING
++cputime_t task_utime(struct task_struct *p)
++{
++ return p->utime;
++}
++
++cputime_t task_stime(struct task_struct *p)
++{
++ return p->stime;
++}
++#else
++cputime_t task_utime(struct task_struct *p)
++{
++ clock_t utime = cputime_to_clock_t(p->utime),
++ total = utime + cputime_to_clock_t(p->stime);
++ u64 temp;
++
++ /*
++ * Use CFS's precise accounting:
++ */
++ temp = (u64)nsec_to_clock_t(p->se.sum_exec_runtime);
++
++ if (total) {
++ temp *= utime;
++ do_div(temp, total);
++ }
++ utime = (clock_t)temp;
++
++ p->prev_utime = max(p->prev_utime, clock_t_to_cputime(utime));
++ return p->prev_utime;
++}
++
++cputime_t task_stime(struct task_struct *p)
++{
++ clock_t stime;
++
++ /*
++ * Use CFS's precise accounting. (we subtract utime from
++ * the total, to make sure the total observed by userspace
++ * grows monotonically - apps rely on that):
++ */
++ stime = nsec_to_clock_t(p->se.sum_exec_runtime) -
++ cputime_to_clock_t(task_utime(p));
++
++ if (stime >= 0)
++ p->prev_stime = max(p->prev_stime, clock_t_to_cputime(stime));
++
++ return p->prev_stime;
++}
++#endif
++
++inline cputime_t task_gtime(struct task_struct *p)
++{
++ return p->gtime;
++}
++
++/*
+ * This function gets called by the timer code, with HZ frequency.
+ * We call it with interrupts disabled.
+ *
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:31 2008
+Message-Id: <20081007002730.928027839@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:30 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Yinghai Lu <yhlu.kernel@gmail.com>,
+ Ingo Molnar <mingo@elte.hu>,
+ Thomas Gleixner <tglx@linutronix.de>
+Subject: [patch 24/71] APIC routing fix
+Content-Disposition: inline; filename=apic-routing-fix.patch
+Content-Length: 4485
+Lines: 153
+
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Yinghai Lu <yhlu.kernel@gmail.com>
+
+commit e0da33646826b66ef933d47ea2fb7a693fd849bf upstream
+
+x86: introduce max_physical_apicid for bigsmp switching
+
+a multi-socket test-system with 3 or 4 ioapics, when 4 dualcore cpus or
+2 quadcore cpus installed, needs to switch to bigsmp or physflat.
+
+CPU apic id is [4,11] instead of [0,7], and we need to check max apic
+id instead of cpu numbers.
+
+also add check for 32 bit when acpi is not compiled in or acpi=off.
+
+Signed-off-by: Yinghai Lu <yhlu.kernel@gmail.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/apic_32.c | 5 ++++-
+ arch/x86/kernel/apic_64.c | 3 +++
+ arch/x86/kernel/genapic_64.c | 2 +-
+ arch/x86/kernel/mpparse.c | 5 +++++
+ arch/x86/kernel/setup.c | 1 +
+ arch/x86/kernel/setup_32.c | 11 ++++++-----
+ arch/x86/mach-generic/bigsmp.c | 2 +-
+ include/asm-x86/mpspec.h | 1 +
+ 8 files changed, 22 insertions(+), 8 deletions(-)
+
+--- a/arch/x86/kernel/apic_32.c
++++ b/arch/x86/kernel/apic_32.c
+@@ -1536,6 +1536,9 @@ void __cpuinit generic_processor_info(in
+ */
+ cpu = 0;
+
++ if (apicid > max_physical_apicid)
++ max_physical_apicid = apicid;
++
+ /*
+ * Would be preferable to switch to bigsmp when CONFIG_HOTPLUG_CPU=y
+ * but we need to work other dependencies like SMP_SUSPEND etc
+@@ -1543,7 +1546,7 @@ void __cpuinit generic_processor_info(in
+ * if (CPU_HOTPLUG_ENABLED || num_processors > 8)
+ * - Ashok Raj <ashok.raj@intel.com>
+ */
+- if (num_processors > 8) {
++ if (max_physical_apicid >= 8) {
+ switch (boot_cpu_data.x86_vendor) {
+ case X86_VENDOR_INTEL:
+ if (!APIC_XAPIC(version)) {
+--- a/arch/x86/kernel/apic_64.c
++++ b/arch/x86/kernel/apic_64.c
+@@ -1090,6 +1090,9 @@ void __cpuinit generic_processor_info(in
+ */
+ cpu = 0;
+ }
++ if (apicid > max_physical_apicid)
++ max_physical_apicid = apicid;
++
+ /* are we being called early in kernel startup? */
+ if (x86_cpu_to_apicid_early_ptr) {
+ u16 *cpu_to_apicid = x86_cpu_to_apicid_early_ptr;
+--- a/arch/x86/kernel/genapic_64.c
++++ b/arch/x86/kernel/genapic_64.c
+@@ -51,7 +51,7 @@ void __init setup_apic_routing(void)
+ else
+ #endif
+
+- if (num_possible_cpus() <= 8)
++ if (max_physical_apicid < 8)
+ genapic = &apic_flat;
+ else
+ genapic = &apic_physflat;
+--- a/arch/x86/kernel/mpparse.c
++++ b/arch/x86/kernel/mpparse.c
+@@ -402,6 +402,11 @@ static int __init smp_read_mpc(struct mp
+ ++mpc_record;
+ #endif
+ }
++
++#ifdef CONFIG_X86_GENERICARCH
++ generic_bigsmp_probe();
++#endif
++
+ setup_apic_routing();
+ if (!num_processors)
+ printk(KERN_ERR "MPTABLE: no processors registered!\n");
+--- a/arch/x86/kernel/setup_32.c
++++ b/arch/x86/kernel/setup_32.c
+@@ -914,6 +914,12 @@ void __init setup_arch(char **cmdline_p)
+
+ #ifdef CONFIG_ACPI
+ acpi_boot_init();
++#endif
++
++#ifdef CONFIG_X86_LOCAL_APIC
++ if (smp_found_config)
++ get_smp_config();
++#endif
+
+ #if defined(CONFIG_SMP) && defined(CONFIG_X86_PC)
+ if (def_to_bigsmp)
+@@ -921,11 +927,6 @@ void __init setup_arch(char **cmdline_p)
+ "CONFIG_X86_PC cannot handle it.\nUse "
+ "CONFIG_X86_GENERICARCH or CONFIG_X86_BIGSMP.\n");
+ #endif
+-#endif
+-#ifdef CONFIG_X86_LOCAL_APIC
+- if (smp_found_config)
+- get_smp_config();
+-#endif
+
+ e820_register_memory();
+ e820_mark_nosave_regions();
+--- a/arch/x86/kernel/setup.c
++++ b/arch/x86/kernel/setup.c
+@@ -17,6 +17,7 @@ unsigned int num_processors;
+ unsigned disabled_cpus __cpuinitdata;
+ /* Processor that is doing the boot up */
+ unsigned int boot_cpu_physical_apicid = -1U;
++unsigned int max_physical_apicid;
+ EXPORT_SYMBOL(boot_cpu_physical_apicid);
+
+ DEFINE_PER_CPU(u16, x86_cpu_to_apicid) = BAD_APICID;
+--- a/arch/x86/mach-generic/bigsmp.c
++++ b/arch/x86/mach-generic/bigsmp.c
+@@ -48,7 +48,7 @@ static const struct dmi_system_id bigsmp
+ static int probe_bigsmp(void)
+ {
+ if (def_to_bigsmp)
+- dmi_bigsmp = 1;
++ dmi_bigsmp = 1;
+ else
+ dmi_check_system(bigsmp_dmi_table);
+ return dmi_bigsmp;
+--- a/include/asm-x86/mpspec.h
++++ b/include/asm-x86/mpspec.h
+@@ -35,6 +35,7 @@ extern DECLARE_BITMAP(mp_bus_not_pci, MA
+ extern int mp_bus_id_to_pci_bus[MAX_MP_BUSSES];
+
+ extern unsigned int boot_cpu_physical_apicid;
++extern unsigned int max_physical_apicid;
+ extern int smp_found_config;
+ extern int mpc_default_type;
+ extern unsigned long mp_lapic_addr;
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:31 2008
+Message-Id: <20081007002731.128798468@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:31 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Joel Becker <Joel.Becker@oracle.com>,
+ Joel Becker <joel.becker@oracle.com>,
+ Mark Fasheh <mfasheh@suse.com>
+Subject: [patch 25/71] ocfs2: Increment the reference count of an already-active stack.
+Content-Disposition: inline; filename=ocfs2-increment-the-reference-count-of-an-already-active-stack.patch
+Content-Length: 1015
+Lines: 43
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Joel Becker <Joel.Becker@oracle.com>
+
+commit d6817cdbd143f87f9d7c59a4c3194091190eeb84 upstream
+
+The ocfs2_stack_driver_request() function failed to increment the
+refcount of an already-active stack. It only did the increment on the
+first reference. Whoops.
+
+Signed-off-by: Joel Becker <joel.becker@oracle.com>
+Tested-by: Marcos Matsunaga <marcos.matsunaga@oracle.com>
+Signed-off-by: Mark Fasheh <mfasheh@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ocfs2/stackglue.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/fs/ocfs2/stackglue.c
++++ b/fs/ocfs2/stackglue.c
+@@ -97,13 +97,14 @@ static int ocfs2_stack_driver_request(co
+ goto out;
+ }
+
+- /* Ok, the stack is pinned */
+- p->sp_count++;
+ active_stack = p;
+-
+ rc = 0;
+
+ out:
++ /* If we found it, pin it */
++ if (!rc)
++ active_stack->sp_count++;
++
+ spin_unlock(&ocfs2_stack_lock);
+ return rc;
+ }
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:31 2008
+Message-Id: <20081007002731.346512521@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:32 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ James.Bottomley@HansenPartnership.com,
+ jens.axboe@oracle.com,
+ FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Subject: [patch 26/71] sg: disable interrupts inside sg_copy_buffer
+Content-Disposition: inline; filename=sg-disable-interrupts-inside-sg_copy_buffer.patch
+Content-Length: 1450
+Lines: 52
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+
+This is the backport of the upstream commit 50bed2e2862a8f3a4f7d683d0d27292e71ef18b9
+
+The callers of sg_copy_buffer must disable interrupts before calling
+it (since it uses kmap_atomic). Some callers use it on
+interrupt-disabled code but some need to take the trouble to disable
+interrupts just for this. No wonder they forget about it and we hit a
+bug like:
+
+http://bugzilla.kernel.org/show_bug.cgi?id=11529
+
+James said that it might be better to disable interrupts inside the
+function rather than risk the callers getting it wrong.
+
+Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ lib/scatterlist.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/lib/scatterlist.c
++++ b/lib/scatterlist.c
+@@ -312,8 +312,9 @@ static size_t sg_copy_buffer(struct scat
+ struct scatterlist *sg;
+ size_t buf_off = 0;
+ int i;
++ unsigned long flags;
+
+- WARN_ON(!irqs_disabled());
++ local_irq_save(flags);
+
+ for_each_sg(sgl, sg, nents, i) {
+ struct page *page;
+@@ -358,6 +359,8 @@ static size_t sg_copy_buffer(struct scat
+ break;
+ }
+
++ local_irq_restore(flags);
++
+ return buf_off;
+ }
+
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:31 2008
+Message-Id: <20081007002731.522405267@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:33 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Ingo Molnar <mingo@elte.hu>
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Glauber de Oliveira Costa <glommer@gmail.com>,
+ Ravikiran Thirumalai <kiran@scalex86.org>
+Subject: [patch 27/71] x86: Fix 27-rc crash on vsmp due to paravirt during module load
+Content-Disposition: inline; filename=x86-fix-27-rc-crash-on-vsmp-due-to-paravirt-during-module-load.patch
+Content-Length: 1118
+Lines: 36
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Ravikiran Thirumalai <kiran@scalex86.org>
+
+commit 05e12e1c4c09cd35ac9f4e6af1e42b0036375d72 upstream.
+
+vsmp_patch has been marked with __init ever since pvops, however,
+apply_paravirt can be called during module load causing calls to
+freed memory location.
+
+Since apply_paravirt can only be called during bootup and module load,
+mark vsmp patch with "__init_or_module"
+
+Signed-off-by: Ravikiran Thirumalai <kiran@scalex86.org>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/vsmp_64.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/vsmp_64.c
++++ b/arch/x86/kernel/vsmp_64.c
+@@ -58,7 +58,7 @@ static void vsmp_irq_enable(void)
+ native_restore_fl((flags | X86_EFLAGS_IF) & (~X86_EFLAGS_AC));
+ }
+
+-static unsigned __init vsmp_patch(u8 type, u16 clobbers, void *ibuf,
++static unsigned __init_or_module vsmp_patch(u8 type, u16 clobbers, void *ibuf,
+ unsigned long addr, unsigned len)
+ {
+ switch (type) {
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:32 2008
+Message-Id: <20081007002731.930518030@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:35 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ingo Molnar <mingo@elte.hu>,
+ Krzysztof Helt <krzysztof.h1@wp.pl>
+Subject: [patch 29/71] x86: fdiv bug detection fix
+Content-Disposition: inline; filename=x86-fdiv-bug-detection-fix.patch
+Content-Length: 1581
+Lines: 56
+
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Krzysztof Helt <krzysztof.h1@wp.pl>
+
+commit e0d22d03c06c4e2c194d7010bc1e4a972199f156 upstream
+
+The fdiv detection code writes s32 integer into
+the boot_cpu_data.fdiv_bug.
+However, the boot_cpu_data.fdiv_bug is only char (s8)
+field so the detection overwrites already set fields for
+other bugs, e.g. the f00f bug field.
+
+Use local s32 variable to receive result.
+
+This is a partial fix to Bugzilla #9928 - fixes wrong
+information about the f00f bug (tested) and probably
+for coma bug (I have no cpu to test this).
+
+Signed-off-by: Krzysztof Helt <krzysztof.h1@wp.pl>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/bugs.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -50,6 +50,8 @@ static double __initdata y = 3145727.0;
+ */
+ static void __init check_fpu(void)
+ {
++ s32 fdiv_bug;
++
+ if (!boot_cpu_data.hard_math) {
+ #ifndef CONFIG_MATH_EMULATION
+ printk(KERN_EMERG "No coprocessor found and no math emulation present.\n");
+@@ -70,8 +72,10 @@ static void __init check_fpu(void)
+ "fistpl %0\n\t"
+ "fwait\n\t"
+ "fninit"
+- : "=m" (*&boot_cpu_data.fdiv_bug)
++ : "=m" (*&fdiv_bug)
+ : "m" (*&x), "m" (*&y));
++
++ boot_cpu_data.fdiv_bug = fdiv_bug;
+ if (boot_cpu_data.fdiv_bug)
+ printk("Hmm, FPU with FDIV bug.\n");
+ }
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:32 2008
+Message-Id: <20081007002732.165140936@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:36 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ingo Molnar <mingo@elte.hu>,
+ Andi Kleen <ak@linux.intel.com>
+Subject: [patch 30/71] x86: fix oprofile + hibernation badness
+Content-Disposition: inline; filename=x86-fix-oprofile-hibernation-badness.patch
+Content-Length: 3099
+Lines: 124
+
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Andi Kleen <ak@linux.intel.com>
+
+commit 80a8c9fffa78f57d7d4351af2f15a56386805ceb upstream
+
+Vegard Nossum reported oprofile + hibernation problems:
+
+> Now some warnings:
+>
+> ------------[ cut here ]------------
+> WARNING: at /uio/arkimedes/s29/vegardno/git-working/linux-2.6/kernel/smp.c:328 s
+> mp_call_function_mask+0x194/0x1a0()
+
+The usual problem: the suspend function when interrupts are
+already disabled calls smp_call_function which is not allowed with
+interrupt off. But at this point all the other CPUs should be already
+down anyways, so it should be enough to just drop that.
+
+This patch should fix that problem at least by fixing cpu hotplug&
+suspend support.
+
+[ mingo@elte.hu: fixed 5 coding style errors. ]
+
+Backported by Chuck Ebbert
+
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+Tested-by: Vegard Nossum <vegard.nossum@gmail.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/oprofile/nmi_int.c | 39 ++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 36 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/oprofile/nmi_int.c
++++ b/arch/x86/oprofile/nmi_int.c
+@@ -15,6 +15,7 @@
+ #include <linux/slab.h>
+ #include <linux/moduleparam.h>
+ #include <linux/kdebug.h>
++#include <linux/cpu.h>
+ #include <asm/nmi.h>
+ #include <asm/msr.h>
+ #include <asm/apic.h>
+@@ -28,23 +29,48 @@ static DEFINE_PER_CPU(unsigned long, sav
+
+ static int nmi_start(void);
+ static void nmi_stop(void);
++static void nmi_cpu_start(void *dummy);
++static void nmi_cpu_stop(void *dummy);
+
+ /* 0 == registered but off, 1 == registered and on */
+ static int nmi_enabled = 0;
+
++#ifdef CONFIG_SMP
++static int oprofile_cpu_notifier(struct notifier_block *b, unsigned long action,
++ void *data)
++{
++ int cpu = (unsigned long)data;
++ switch (action) {
++ case CPU_DOWN_FAILED:
++ case CPU_ONLINE:
++ smp_call_function_single(cpu, nmi_cpu_start, NULL, 0, 0);
++ break;
++ case CPU_DOWN_PREPARE:
++ smp_call_function_single(cpu, nmi_cpu_stop, NULL, 0, 1);
++ break;
++ }
++ return NOTIFY_DONE;
++}
++
++static struct notifier_block oprofile_cpu_nb = {
++ .notifier_call = oprofile_cpu_notifier
++};
++#endif
++
+ #ifdef CONFIG_PM
+
+ static int nmi_suspend(struct sys_device *dev, pm_message_t state)
+ {
++ /* Only one CPU left, just stop that one */
+ if (nmi_enabled == 1)
+- nmi_stop();
++ nmi_cpu_stop(NULL);
+ return 0;
+ }
+
+ static int nmi_resume(struct sys_device *dev)
+ {
+ if (nmi_enabled == 1)
+- nmi_start();
++ nmi_cpu_start(NULL);
+ return 0;
+ }
+
+@@ -448,6 +474,9 @@ int __init op_nmi_init(struct oprofile_o
+ }
+
+ init_sysfs();
++#ifdef CONFIG_SMP
++ register_cpu_notifier(&oprofile_cpu_nb);
++#endif
+ using_nmi = 1;
+ ops->create_files = nmi_create_files;
+ ops->setup = nmi_setup;
+@@ -461,6 +490,10 @@ int __init op_nmi_init(struct oprofile_o
+
+ void op_nmi_exit(void)
+ {
+- if (using_nmi)
++ if (using_nmi) {
+ exit_sysfs();
++#ifdef CONFIG_SMP
++ unregister_cpu_notifier(&oprofile_cpu_nb);
++#endif
++ }
+ }
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:32 2008
+Message-Id: <20081007002732.404466045@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:37 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>,
+ Suresh Siddha <suresh.b.siddha@intel.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 31/71] x86: PAT proper tracking of set_memory_uc and friends
+Content-Disposition: inline; filename=x86-pat-proper-tracking-of-set_memory_uc-and-friends.patch
+Content-Length: 1642
+Lines: 52
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
+
+commit c15238df3b65e34fadb1021b0fb0d5aebc7c42c6 upstream
+
+Big thinko in pat memtype tracking code. reserve_memtype should be called
+with physical address and not virtual address.
+
+Signed-off-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
+Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/mm/pageattr.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/mm/pageattr.c
++++ b/arch/x86/mm/pageattr.c
+@@ -789,7 +789,7 @@ int set_memory_uc(unsigned long addr, in
+ /*
+ * for now UC MINUS. see comments in ioremap_nocache()
+ */
+- if (reserve_memtype(addr, addr + numpages * PAGE_SIZE,
++ if (reserve_memtype(__pa(addr), __pa(addr) + numpages * PAGE_SIZE,
+ _PAGE_CACHE_UC_MINUS, NULL))
+ return -EINVAL;
+
+@@ -808,7 +808,7 @@ int set_memory_wc(unsigned long addr, in
+ if (!pat_wc_enabled)
+ return set_memory_uc(addr, numpages);
+
+- if (reserve_memtype(addr, addr + numpages * PAGE_SIZE,
++ if (reserve_memtype(__pa(addr), __pa(addr) + numpages * PAGE_SIZE,
+ _PAGE_CACHE_WC, NULL))
+ return -EINVAL;
+
+@@ -824,7 +824,7 @@ int _set_memory_wb(unsigned long addr, i
+
+ int set_memory_wb(unsigned long addr, int numpages)
+ {
+- free_memtype(addr, addr + numpages * PAGE_SIZE);
++ free_memtype(__pa(addr), __pa(addr) + numpages * PAGE_SIZE);
+
+ return _set_memory_wb(addr, numpages);
+ }
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:32 2008
+Message-Id: <20081007002732.621437756@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:38 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ingo Molnar <mingo@elte.hu>,
+ Jan Beulich <jbeulich@novell.com>
+Subject: [patch 32/71] x86-64: fix overlap of modules and fixmap areas
+Content-Disposition: inline; filename=x86-64-fix-overlap-of-modules-and-fixmap-areas.patch
+Content-Length: 1476
+Lines: 44
+
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Jan Beulich <jbeulich@novell.com>
+
+commit 66d4bdf22b8652cda215e2653c8bbec7a767ed57 upstream
+
+Plus add a build time check so this doesn't go unnoticed again.
+
+Signed-off-by: Jan Beulich <jbeulich@novell.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/head64.c | 1 +
+ include/asm-x86/pgtable_64.h | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/head64.c
++++ b/arch/x86/kernel/head64.c
+@@ -135,6 +135,7 @@ void __init x86_64_start_kernel(char * r
+ BUILD_BUG_ON(!(MODULES_VADDR > __START_KERNEL));
+ BUILD_BUG_ON(!(((MODULES_END - 1) & PGDIR_MASK) ==
+ (__START_KERNEL & PGDIR_MASK)));
++ BUILD_BUG_ON(__fix_to_virt(__end_of_fixed_addresses) <= MODULES_END);
+
+ /* clear bss before set_intr_gate with early_idt_handler */
+ clear_bss();
+--- a/include/asm-x86/pgtable_64.h
++++ b/include/asm-x86/pgtable_64.h
+@@ -146,7 +146,7 @@ static inline void native_pgd_clear(pgd_
+ #define VMALLOC_END _AC(0xffffe1ffffffffff, UL)
+ #define VMEMMAP_START _AC(0xffffe20000000000, UL)
+ #define MODULES_VADDR _AC(0xffffffffa0000000, UL)
+-#define MODULES_END _AC(0xfffffffffff00000, UL)
++#define MODULES_END _AC(0xffffffffff000000, UL)
+ #define MODULES_LEN (MODULES_END - MODULES_VADDR)
+
+ #ifndef __ASSEMBLY__
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:32 2008
+Message-Id: <20081007002732.788088127@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:39 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Nick Piggin <npiggin@suse.de>,
+ Jared Hulbert <jaredeh@gmail.com>,
+ Carsten Otte <cotte@freenet.de>,
+ Hugh Dickins <hugh@veritas.com>,
+ Peter Zijlstra <a.p.zijlstra@chello.nl>
+Subject: [patch 33/71] mm: dirty page tracking race fix
+Content-Disposition: inline; filename=mm-dirty-page-tracking-race-fix.patch
+Content-Length: 4410
+Lines: 131
+
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Nick Piggin <npiggin@suse.de>
+
+commit 479db0bf408e65baa14d2a9821abfcbc0804b847 upstream
+
+There is a race with dirty page accounting where a page may not properly
+be accounted for.
+
+clear_page_dirty_for_io() calls page_mkclean; then TestClearPageDirty.
+
+page_mkclean walks the rmaps for that page, and for each one it cleans and
+write protects the pte if it was dirty. It uses page_check_address to
+find the pte. That function has a shortcut to avoid the ptl if the pte is
+not present. Unfortunately, the pte can be switched to not-present then
+back to present by other code while holding the page table lock -- this
+should not be a signal for page_mkclean to ignore that pte, because it may
+be dirty.
+
+For example, powerpc64's set_pte_at will clear a previously present pte
+before setting it to the desired value. There may also be other code in
+core mm or in arch which do similar things.
+
+The consequence of the bug is loss of data integrity due to msync, and
+loss of dirty page accounting accuracy. XIP's __xip_unmap could easily
+also be unreliable (depending on the exact XIP locking scheme), which can
+lead to data corruption.
+
+Fix this by having an option to always take ptl to check the pte in
+page_check_address.
+
+It's possible to retain this optimization for page_referenced and
+try_to_unmap.
+
+Signed-off-by: Nick Piggin <npiggin@suse.de>
+Cc: Jared Hulbert <jaredeh@gmail.com>
+Cc: Carsten Otte <cotte@freenet.de>
+Cc: Hugh Dickins <hugh@veritas.com>
+Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/rmap.h | 2 +-
+ mm/filemap_xip.c | 2 +-
+ mm/rmap.c | 14 +++++++++-----
+ 3 files changed, 11 insertions(+), 7 deletions(-)
+
+--- a/include/linux/rmap.h
++++ b/include/linux/rmap.h
+@@ -94,7 +94,7 @@ int try_to_unmap(struct page *, int igno
+ * Called from mm/filemap_xip.c to unmap empty zero page
+ */
+ pte_t *page_check_address(struct page *, struct mm_struct *,
+- unsigned long, spinlock_t **);
++ unsigned long, spinlock_t **, int);
+
+ /*
+ * Used by swapoff to help locate where page is expected in vma.
+--- a/mm/filemap_xip.c
++++ b/mm/filemap_xip.c
+@@ -184,7 +184,7 @@ __xip_unmap (struct address_space * mapp
+ address = vma->vm_start +
+ ((pgoff - vma->vm_pgoff) << PAGE_SHIFT);
+ BUG_ON(address < vma->vm_start || address >= vma->vm_end);
+- pte = page_check_address(page, mm, address, &ptl);
++ pte = page_check_address(page, mm, address, &ptl, 1);
+ if (pte) {
+ /* Nuke the page table entry. */
+ flush_cache_page(vma, address, pte_pfn(*pte));
+--- a/mm/rmap.c
++++ b/mm/rmap.c
+@@ -223,10 +223,14 @@ unsigned long page_address_in_vma(struct
+ /*
+ * Check that @page is mapped at @address into @mm.
+ *
++ * If @sync is false, page_check_address may perform a racy check to avoid
++ * the page table lock when the pte is not present (helpful when reclaiming
++ * highly shared pages).
++ *
+ * On success returns with pte mapped and locked.
+ */
+ pte_t *page_check_address(struct page *page, struct mm_struct *mm,
+- unsigned long address, spinlock_t **ptlp)
++ unsigned long address, spinlock_t **ptlp, int sync)
+ {
+ pgd_t *pgd;
+ pud_t *pud;
+@@ -248,7 +252,7 @@ pte_t *page_check_address(struct page *p
+
+ pte = pte_offset_map(pmd, address);
+ /* Make a quick check before getting the lock */
+- if (!pte_present(*pte)) {
++ if (!sync && !pte_present(*pte)) {
+ pte_unmap(pte);
+ return NULL;
+ }
+@@ -280,7 +284,7 @@ static int page_referenced_one(struct pa
+ if (address == -EFAULT)
+ goto out;
+
+- pte = page_check_address(page, mm, address, &ptl);
++ pte = page_check_address(page, mm, address, &ptl, 0);
+ if (!pte)
+ goto out;
+
+@@ -449,7 +453,7 @@ static int page_mkclean_one(struct page
+ if (address == -EFAULT)
+ goto out;
+
+- pte = page_check_address(page, mm, address, &ptl);
++ pte = page_check_address(page, mm, address, &ptl, 1);
+ if (!pte)
+ goto out;
+
+@@ -707,7 +711,7 @@ static int try_to_unmap_one(struct page
+ if (address == -EFAULT)
+ goto out;
+
+- pte = page_check_address(page, mm, address, &ptl);
++ pte = page_check_address(page, mm, address, &ptl, 0);
+ if (!pte)
+ goto out;
+
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:33 2008
+Message-Id: <20081007002733.028532722@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:40 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 34/71] rtc: fix deadlock
+Content-Disposition: inline; filename=rtc-fix-deadlock.patch
+Content-Length: 2054
+Lines: 67
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Ingo Molnar <mingo@elte.hu>
+
+commit 38c052f8cff1bd323ccfa968136a9556652ee420 upstream
+
+if get_rtc_time() is _ever_ called with IRQs off, we deadlock badly
+in it, waiting for jiffies to increment.
+
+So make the code more robust by doing an explicit mdelay(20).
+
+This solves a very hard to reproduce/debug hard lockup reported
+by Mikael Pettersson.
+
+Reported-by: Mikael Pettersson <mikpe@it.uu.se>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/asm-generic/rtc.h | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+--- a/include/asm-generic/rtc.h
++++ b/include/asm-generic/rtc.h
+@@ -15,6 +15,7 @@
+ #include <linux/mc146818rtc.h>
+ #include <linux/rtc.h>
+ #include <linux/bcd.h>
++#include <linux/delay.h>
+
+ #define RTC_PIE 0x40 /* periodic interrupt enable */
+ #define RTC_AIE 0x20 /* alarm interrupt enable */
+@@ -43,7 +44,6 @@ static inline unsigned char rtc_is_updat
+
+ static inline unsigned int get_rtc_time(struct rtc_time *time)
+ {
+- unsigned long uip_watchdog = jiffies;
+ unsigned char ctrl;
+ unsigned long flags;
+
+@@ -53,19 +53,15 @@ static inline unsigned int get_rtc_time(
+
+ /*
+ * read RTC once any update in progress is done. The update
+- * can take just over 2ms. We wait 10 to 20ms. There is no need to
++ * can take just over 2ms. We wait 20ms. There is no need to
+ * to poll-wait (up to 1s - eeccch) for the falling edge of RTC_UIP.
+ * If you need to know *exactly* when a second has started, enable
+ * periodic update complete interrupts, (via ioctl) and then
+ * immediately read /dev/rtc which will block until you get the IRQ.
+ * Once the read clears, read the RTC time (again via ioctl). Easy.
+ */
+-
+- if (rtc_is_updating() != 0)
+- while (jiffies - uip_watchdog < 2*HZ/100) {
+- barrier();
+- cpu_relax();
+- }
++ if (rtc_is_updating())
++ mdelay(20);
+
+ /*
+ * Only the values that we read from the RTC are set. We leave
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:33 2008
+Message-Id: <20081007002733.193346685@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:41 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Raz <raziebe@gmail.com>
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ the arch/x86 maintainers <x86@kernel.org>,
+ Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca>,
+ Vegard Nossum <vegard.nossum@gmail.com>,
+ carlos@strangeworlds.co.uk,
+ Pekka Paalanen <pq@iki.fi>,
+ linux-acpi@vger.kernel.org,
+ Ingo Molnar <mingo@elte.hu>,
+ Thomas Gleixner <tglx@linutronix.de>
+Subject: [patch 35/71] x86: fix SMP alternatives: use mutex instead of spinlock, text_poke is sleepable
+Content-Disposition: inline; filename=x86-fix-smp-alternatives-use-mutex-instead-of-spinlock-text_poke-is-sleepable.patch
+Content-Length: 2550
+Lines: 95
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Pekka Paalanen <pq@iki.fi>
+
+commit 2f1dafe50cc4e58a239fd81bd47f87f32042a1ee upstream
+
+text_poke is sleepable.
+The original fix by Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca>.
+
+Signed-off-by: Pekka Paalanen <pq@iki.fi>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/alternative.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/arch/x86/kernel/alternative.c
++++ b/arch/x86/kernel/alternative.c
+@@ -1,6 +1,6 @@
+ #include <linux/module.h>
+ #include <linux/sched.h>
+-#include <linux/spinlock.h>
++#include <linux/mutex.h>
+ #include <linux/list.h>
+ #include <linux/kprobes.h>
+ #include <linux/mm.h>
+@@ -279,7 +279,7 @@ struct smp_alt_module {
+ struct list_head next;
+ };
+ static LIST_HEAD(smp_alt_modules);
+-static DEFINE_SPINLOCK(smp_alt);
++static DEFINE_MUTEX(smp_alt);
+ static int smp_mode = 1; /* protected by smp_alt */
+
+ void alternatives_smp_module_add(struct module *mod, char *name,
+@@ -312,12 +312,12 @@ void alternatives_smp_module_add(struct
+ __func__, smp->locks, smp->locks_end,
+ smp->text, smp->text_end, smp->name);
+
+- spin_lock(&smp_alt);
++ mutex_lock(&smp_alt);
+ list_add_tail(&smp->next, &smp_alt_modules);
+ if (boot_cpu_has(X86_FEATURE_UP))
+ alternatives_smp_unlock(smp->locks, smp->locks_end,
+ smp->text, smp->text_end);
+- spin_unlock(&smp_alt);
++ mutex_unlock(&smp_alt);
+ }
+
+ void alternatives_smp_module_del(struct module *mod)
+@@ -327,17 +327,17 @@ void alternatives_smp_module_del(struct
+ if (smp_alt_once || noreplace_smp)
+ return;
+
+- spin_lock(&smp_alt);
++ mutex_lock(&smp_alt);
+ list_for_each_entry(item, &smp_alt_modules, next) {
+ if (mod != item->mod)
+ continue;
+ list_del(&item->next);
+- spin_unlock(&smp_alt);
++ mutex_unlock(&smp_alt);
+ DPRINTK("%s: %s\n", __func__, item->name);
+ kfree(item);
+ return;
+ }
+- spin_unlock(&smp_alt);
++ mutex_unlock(&smp_alt);
+ }
+
+ void alternatives_smp_switch(int smp)
+@@ -359,7 +359,7 @@ void alternatives_smp_switch(int smp)
+ return;
+ BUG_ON(!smp && (num_online_cpus() > 1));
+
+- spin_lock(&smp_alt);
++ mutex_lock(&smp_alt);
+
+ /*
+ * Avoid unnecessary switches because it forces JIT based VMs to
+@@ -383,7 +383,7 @@ void alternatives_smp_switch(int smp)
+ mod->text, mod->text_end);
+ }
+ smp_mode = smp;
+- spin_unlock(&smp_alt);
++ mutex_unlock(&smp_alt);
+ }
+
+ #endif
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:33 2008
+Message-Id: <20081007002733.407899862@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:42 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ epprecht@solnet.ch,
+ Zhao Yakui <yakui.zhao@intel.com>,
+ Zhang Rui <rui.zhang@intel.com>,
+ Andi Kleen <ak@linux.intel.com>
+Subject: [patch 36/71] ACPI: Avoid bogus EC timeout when EC is in Polling mode
+Content-Disposition: inline; filename=acpi-avoid-bogus-ec-timeout-when-ec-is-in-polling-mode.patch
+Content-Length: 2232
+Lines: 61
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Zhao Yakui <yakui.zhao@intel.com>
+
+commit 9d699ed92a459cb408e2577e8bbeabc8ec3989e1 upstream
+
+When EC is in Polling mode, OS will check the EC status continually by using
+the following source code:
+ clear_bit(EC_FLAGS_WAIT_GPE, &ec->flags);
+ while (time_before(jiffies, delay)) {
+ if (acpi_ec_check_status(ec, event))
+ return 0;
+ msleep(1);
+ }
+But msleep is realized by the function of schedule_timeout. At the same time
+although one process is already waken up by some events, it won't be scheduled
+immediately. So maybe there exists the following phenomena:
+ a. The current jiffies is already after the predefined jiffies.
+ But before timeout happens, OS has no chance to check the EC
+ status again.
+ b. If preemptible schedule is enabled, maybe preempt schedule will happen
+ before checking loop. When the process is resumed again, maybe
+ timeout already happens, which means that OS has no chance to check
+ the EC status.
+
+In such case maybe EC status is already what OS expects when timeout happens.
+But OS has no chance to check the EC status and regards it as AE_TIME.
+
+So it will be more appropriate that OS will try to check the EC status again
+when timeout happens. If the EC status is what we expect, it won't be regarded
+as timeout. Only when the EC status is not what we expect, it will be regarded
+as timeout, which means that EC controller can't give a response in time.
+
+http://bugzilla.kernel.org/show_bug.cgi?id=9823
+http://bugzilla.kernel.org/show_bug.cgi?id=11141
+
+Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
+Signed-off-by: Zhang Rui <rui.zhang@intel.com>
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ drivers/acpi/ec.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -196,6 +196,8 @@ static int acpi_ec_wait(struct acpi_ec *
+ return 0;
+ msleep(1);
+ }
++ if (acpi_ec_check_status(ec,event))
++ return 0;
+ }
+ pr_err(PREFIX "acpi_ec_wait timeout, status = 0x%2.2x, event = %s\n",
+ acpi_ec_read_status(ec),
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:33 2008
+Message-Id: <20081007002733.631671668@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:43 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "H. Peter Anvin" <hpa@zytor.com>
+Subject: [patch 37/71] x86: add io delay quirk for Presario F700
+Content-Disposition: inline; filename=x86-add-io-delay-quirk-for-presario-f700.patch
+Content-Length: 1108
+Lines: 50
+
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Chuck Ebbert <cebbert@redhat.com>
+
+commit e6a5652fd156a286faadbf7a4062b5354d4e346e upstream
+
+Manually adding "io_delay=0xed" fixes system lockups in ioapic
+mode on this machine.
+
+System Information
+ Manufacturer: Hewlett-Packard
+ Product Name: Presario F700 (KA695EA#ABF)
+
+Base Board Information
+ Manufacturer: Quanta
+ Product Name: 30D3
+
+Reference:
+https://bugzilla.redhat.com/show_bug.cgi?id=459546
+
+Signed-off-by: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/io_delay.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/arch/x86/kernel/io_delay.c
++++ b/arch/x86/kernel/io_delay.c
+@@ -92,6 +92,14 @@ static struct dmi_system_id __initdata i
+ DMI_MATCH(DMI_BOARD_NAME, "30BF")
+ }
+ },
++ {
++ .callback = dmi_io_delay_0xed_port,
++ .ident = "Presario F700",
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "Quanta"),
++ DMI_MATCH(DMI_BOARD_NAME, "30D3")
++ }
++ },
+ { }
+ };
+
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:34 2008
+Message-Id: <20081007002733.887811345@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:44 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ingo Molnar <mingo@elte.hu>,
+ Prarit Bhargava <prarit@redhat.com>
+Subject: [patch 38/71] x86: fix memmap=exactmap boot argument
+Content-Disposition: inline; filename=x86-fix-memmap-exactmap-boot-argument.patch
+Content-Length: 3161
+Lines: 91
+
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Prarit Bhargava <prarit@redhat.com>
+
+Backport of d6be118a97ce51ca84035270f91c2bccecbfac5f by Chuck Ebbert
+
+When using kdump modifying the e820 map is yielding strange results.
+
+For example starting with
+
+ BIOS-provided physical RAM map:
+ BIOS-e820: 0000000000000100 - 0000000000093400 (usable)
+ BIOS-e820: 0000000000093400 - 00000000000a0000 (reserved)
+ BIOS-e820: 0000000000100000 - 000000003fee0000 (usable)
+ BIOS-e820: 000000003fee0000 - 000000003fef3000 (ACPI data)
+ BIOS-e820: 000000003fef3000 - 000000003ff80000 (ACPI NVS)
+ BIOS-e820: 000000003ff80000 - 0000000040000000 (reserved)
+ BIOS-e820: 00000000e0000000 - 00000000f0000000 (reserved)
+ BIOS-e820: 00000000fec00000 - 00000000fec10000 (reserved)
+ BIOS-e820: 00000000fee00000 - 00000000fee01000 (reserved)
+ BIOS-e820: 00000000ff000000 - 0000000100000000 (reserved)
+
+and booting with args
+
+memmap=exactmap memmap=640K@0K memmap=5228K@16384K memmap=125188K@22252K memmap=76K#1047424K memmap=564K#1047500K
+
+resulted in:
+
+ user-defined physical RAM map:
+ user: 0000000000000000 - 0000000000093400 (usable)
+ user: 0000000000093400 - 00000000000a0000 (reserved)
+ user: 0000000000100000 - 000000003fee0000 (usable)
+ user: 000000003fee0000 - 000000003fef3000 (ACPI data)
+ user: 000000003fef3000 - 000000003ff80000 (ACPI NVS)
+ user: 000000003ff80000 - 0000000040000000 (reserved)
+ user: 00000000e0000000 - 00000000f0000000 (reserved)
+ user: 00000000fec00000 - 00000000fec10000 (reserved)
+ user: 00000000fee00000 - 00000000fee01000 (reserved)
+ user: 00000000ff000000 - 0000000100000000 (reserved)
+
+But should have resulted in:
+
+ user-defined physical RAM map:
+ user: 0000000000000000 - 00000000000a0000 (usable)
+ user: 0000000001000000 - 000000000151b000 (usable)
+ user: 00000000015bb000 - 0000000008ffc000 (usable)
+ user: 000000003fee0000 - 000000003ff80000 (ACPI data)
+
+This is happening because of an improper usage of strcmp() in the
+e820 parsing code. The strcmp() always returns !0 and never resets the
+value for e820.nr_map and returns an incorrect user-defined map.
+
+This patch fixes the problem.
+
+Signed-off-by: Prarit Bhargava <prarit@redhat.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/e820_32.c | 2 +-
+ arch/x86/kernel/e820_64.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/e820_32.c
++++ b/arch/x86/kernel/e820_32.c
+@@ -697,7 +697,7 @@ static int __init parse_memmap(char *arg
+ if (!arg)
+ return -EINVAL;
+
+- if (strcmp(arg, "exactmap") == 0) {
++ if (strncmp(arg, "exactmap", 8) == 0) {
+ #ifdef CONFIG_CRASH_DUMP
+ /* If we are doing a crash dump, we
+ * still need to know the real mem
+--- a/arch/x86/kernel/e820_64.c
++++ b/arch/x86/kernel/e820_64.c
+@@ -776,7 +776,7 @@ static int __init parse_memmap_opt(char
+ char *oldp;
+ unsigned long long start_at, mem_size;
+
+- if (!strcmp(p, "exactmap")) {
++ if (!strncmp(p, "exactmap", 8)) {
+ #ifdef CONFIG_CRASH_DUMP
+ /*
+ * If we are doing a crash dump, we still need to know
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:34 2008
+Message-Id: <20081007002734.070464867@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:45 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>,
+ Shaohua Li <shaohua.li@intel.com>,
+ Thomas Gleixner <tglx@linutronix.de>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 39/71] clockevents: prevent clockevent event_handler ending up handler_noop
+Content-Disposition: inline; filename=timer-fix-01.patch
+Content-Length: 3074
+Lines: 85
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
+
+commit 7c1e76897492d92b6a1c2d6892494d39ded9680c upstream
+
+There is a ordering related problem with clockevents code, due to which
+clockevents_register_device() called after tickless/highres switch
+will not work. The new clockevent ends up with clockevents_handle_noop as
+event handler, resulting in no timer activity.
+
+The problematic path seems to be
+
+* old device already has hrtimer_interrupt as the event_handler
+* new clockevent device registers with a higher rating
+* tick_check_new_device() is called
+ * clockevents_exchange_device() gets called
+ * old->event_handler is set to clockevents_handle_noop
+ * tick_setup_device() is called for the new device
+ * which sets new->event_handler using the old->event_handler which is noop.
+
+Change the ordering so that new device inherits the proper handler.
+
+This does not have any issue in normal case as most likely all the clockevent
+devices are setup before the highres switch. But, can potentially be affecting
+some corner case where HPET force detect happens after the highres switch.
+This was a problem with HPET in MSI mode code that we have been experimenting
+with.
+
+Signed-off-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
+Signed-off-by: Shaohua Li <shaohua.li@intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/clockchips.h | 2 ++
+ kernel/time/clockevents.c | 3 +--
+ kernel/time/tick-common.c | 1 +
+ 3 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/include/linux/clockchips.h
++++ b/include/linux/clockchips.h
+@@ -127,6 +127,8 @@ extern int clockevents_register_notifier
+ extern int clockevents_program_event(struct clock_event_device *dev,
+ ktime_t expires, ktime_t now);
+
++extern void clockevents_handle_noop(struct clock_event_device *dev);
++
+ #ifdef CONFIG_GENERIC_CLOCKEVENTS
+ extern void clockevents_notify(unsigned long reason, void *arg);
+ #else
+--- a/kernel/time/clockevents.c
++++ b/kernel/time/clockevents.c
+@@ -177,7 +177,7 @@ void clockevents_register_device(struct
+ /*
+ * Noop handler when we shut down an event device
+ */
+-static void clockevents_handle_noop(struct clock_event_device *dev)
++void clockevents_handle_noop(struct clock_event_device *dev)
+ {
+ }
+
+@@ -199,7 +199,6 @@ void clockevents_exchange_device(struct
+ * released list and do a notify add later.
+ */
+ if (old) {
+- old->event_handler = clockevents_handle_noop;
+ clockevents_set_mode(old, CLOCK_EVT_MODE_UNUSED);
+ list_del(&old->list);
+ list_add(&old->list, &clockevents_released);
+--- a/kernel/time/tick-common.c
++++ b/kernel/time/tick-common.c
+@@ -161,6 +161,7 @@ static void tick_setup_device(struct tic
+ } else {
+ handler = td->evtdev->event_handler;
+ next_event = td->evtdev->next_event;
++ td->evtdev->event_handler = clockevents_handle_noop;
+ }
+
+ td->evtdev = newdev;
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:34 2008
+Message-Id: <20081007002734.284570291@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:46 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Thomas Gleixner <tglx@linutronix.de>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 40/71] clockevents: prevent endless loop in periodic broadcast handler
+Content-Disposition: inline; filename=timer-fix-02.patch
+Content-Length: 1686
+Lines: 53
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit d4496b39559c6d43f83e4c08b899984f8b8089b5 upstream
+
+The reprogramming of the periodic broadcast handler was broken,
+when the first programming returned -ETIME. The clockevents code
+stores the new expiry value in the clock events device next_event field
+only when the programming time has not been elapsed yet. The loop in
+question calculates the new expiry value from the next_event value
+and therefor never increases.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/time/tick-broadcast.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/kernel/time/tick-broadcast.c
++++ b/kernel/time/tick-broadcast.c
+@@ -174,6 +174,8 @@ static void tick_do_periodic_broadcast(v
+ */
+ static void tick_handle_periodic_broadcast(struct clock_event_device *dev)
+ {
++ ktime_t next;
++
+ tick_do_periodic_broadcast();
+
+ /*
+@@ -184,10 +186,13 @@ static void tick_handle_periodic_broadca
+
+ /*
+ * Setup the next period for devices, which do not have
+- * periodic mode:
++ * periodic mode. We read dev->next_event first and add to it
++ * when the event alrady expired. clockevents_program_event()
++ * sets dev->next_event only when the event is really
++ * programmed to the device.
+ */
+- for (;;) {
+- ktime_t next = ktime_add(dev->next_event, tick_period);
++ for (next = dev->next_event; ;) {
++ next = ktime_add(next, tick_period);
+
+ if (!clockevents_program_event(dev, next, ktime_get()))
+ return;
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:34 2008
+Message-Id: <20081007002734.496917181@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:47 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Thomas Gleixner <tglx@linutronix.de>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 41/71] clockevents: enforce reprogram in oneshot setup
+Content-Disposition: inline; filename=timer-fix-03.patch
+Content-Length: 1992
+Lines: 68
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 7205656ab48da29a95d7f55e43a81db755d3cb3a upstream
+
+In tick_oneshot_setup we program the device to the given next_event,
+but we do not check the return value. We need to make sure that the
+device is programmed enforced so the interrupt handler engine starts
+working. Split out the reprogramming function from tick_program_event()
+and call it with the device, which was handed in to tick_setup_oneshot().
+Set the force argument, so the devices is firing an interrupt.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/time/tick-oneshot.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+--- a/kernel/time/tick-oneshot.c
++++ b/kernel/time/tick-oneshot.c
+@@ -23,11 +23,11 @@
+ #include "tick-internal.h"
+
+ /**
+- * tick_program_event
++ * tick_program_event internal worker function
+ */
+-int tick_program_event(ktime_t expires, int force)
++static int __tick_program_event(struct clock_event_device *dev,
++ ktime_t expires, int force)
+ {
+- struct clock_event_device *dev = __get_cpu_var(tick_cpu_device).evtdev;
+ ktime_t now = ktime_get();
+
+ while (1) {
+@@ -41,6 +41,16 @@ int tick_program_event(ktime_t expires,
+ }
+
+ /**
++ * tick_program_event
++ */
++int tick_program_event(ktime_t expires, int force)
++{
++ struct clock_event_device *dev = __get_cpu_var(tick_cpu_device).evtdev;
++
++ return __tick_program_event(dev, expires, force);
++}
++
++/**
+ * tick_resume_onshot - resume oneshot mode
+ */
+ void tick_resume_oneshot(void)
+@@ -61,7 +71,7 @@ void tick_setup_oneshot(struct clock_eve
+ {
+ newdev->event_handler = handler;
+ clockevents_set_mode(newdev, CLOCK_EVT_MODE_ONESHOT);
+- clockevents_program_event(newdev, next_event, ktime_get());
++ __tick_program_event(newdev, next_event, 1);
+ }
+
+ /**
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:34 2008
+Message-Id: <20081007002734.688545446@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:48 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Thomas Gleixner <tglx@linutronix.de>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 42/71] clockevents: prevent multiple init/shutdown
+Content-Disposition: inline; filename=timer-fix-04.patch
+Content-Length: 2423
+Lines: 75
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 9c17bcda991000351cb2373f78be7e4b1c44caa3 upstream
+
+While chasing the C1E/HPET bugreports I went through the clock events
+code inch by inch and found that the broadcast device can be initialized
+and shutdown multiple times. Multiple shutdowns are not critical, but
+useless waste of time. Multiple initializations are simply broken. Another
+CPU might have the device in use already after the first initialization and
+the second init could just render it unusable again.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/time/tick-broadcast.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+--- a/kernel/time/tick-broadcast.c
++++ b/kernel/time/tick-broadcast.c
+@@ -209,7 +209,7 @@ static void tick_do_broadcast_on_off(voi
+ struct clock_event_device *bc, *dev;
+ struct tick_device *td;
+ unsigned long flags, *reason = why;
+- int cpu;
++ int cpu, bc_stopped;
+
+ spin_lock_irqsave(&tick_broadcast_lock, flags);
+
+@@ -227,6 +227,8 @@ static void tick_do_broadcast_on_off(voi
+ if (!tick_device_is_functional(dev))
+ goto out;
+
++ bc_stopped = cpus_empty(tick_broadcast_mask);
++
+ switch (*reason) {
+ case CLOCK_EVT_NOTIFY_BROADCAST_ON:
+ case CLOCK_EVT_NOTIFY_BROADCAST_FORCE:
+@@ -248,9 +250,10 @@ static void tick_do_broadcast_on_off(voi
+ break;
+ }
+
+- if (cpus_empty(tick_broadcast_mask))
+- clockevents_set_mode(bc, CLOCK_EVT_MODE_SHUTDOWN);
+- else {
++ if (cpus_empty(tick_broadcast_mask)) {
++ if (!bc_stopped)
++ clockevents_set_mode(bc, CLOCK_EVT_MODE_SHUTDOWN);
++ } else if (bc_stopped) {
+ if (tick_broadcast_device.mode == TICKDEV_MODE_PERIODIC)
+ tick_broadcast_start_periodic(bc);
+ else
+@@ -500,9 +503,12 @@ static void tick_broadcast_clear_oneshot
+ */
+ void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
+ {
+- bc->event_handler = tick_handle_oneshot_broadcast;
+- clockevents_set_mode(bc, CLOCK_EVT_MODE_ONESHOT);
+- bc->next_event.tv64 = KTIME_MAX;
++ /* Set it up only once ! */
++ if (bc->event_handler != tick_handle_oneshot_broadcast) {
++ bc->event_handler = tick_handle_oneshot_broadcast;
++ clockevents_set_mode(bc, CLOCK_EVT_MODE_ONESHOT);
++ bc->next_event.tv64 = KTIME_MAX;
++ }
+ }
+
+ /*
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:35 2008
+Message-Id: <20081007002734.862242243@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:49 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Thomas Gleixner <tglx@linutronix.de>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 43/71] clockevents: prevent endless loop lockup
+Content-Disposition: inline; filename=timer-fix-05.patch
+Content-Length: 4249
+Lines: 130
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 1fb9b7d29d8e85ba3196eaa7ab871bf76fc98d36 upstream
+
+The C1E/HPET bug reports on AMDX2/RS690 systems where tracked down to a
+too small value of the HPET minumum delta for programming an event.
+
+The clockevents code needs to enforce an interrupt event on the clock event
+device in some cases. The enforcement code was stupid and naive, as it just
+added the minimum delta to the current time and tried to reprogram the device.
+When the minimum delta is too small, then this loops forever.
+
+Add a sanity check. Allow reprogramming to fail 3 times, then print a warning
+and double the minimum delta value to make sure, that this does not happen again.
+Use the same function for both tick-oneshot and tick-broadcast code.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/time/tick-broadcast.c | 10 +---------
+ kernel/time/tick-internal.h | 2 ++
+ kernel/time/tick-oneshot.c | 36 ++++++++++++++++++++++++++++++------
+ 3 files changed, 33 insertions(+), 15 deletions(-)
+
+--- a/kernel/time/tick-broadcast.c
++++ b/kernel/time/tick-broadcast.c
+@@ -370,16 +370,8 @@ cpumask_t *tick_get_broadcast_oneshot_ma
+ static int tick_broadcast_set_event(ktime_t expires, int force)
+ {
+ struct clock_event_device *bc = tick_broadcast_device.evtdev;
+- ktime_t now = ktime_get();
+- int res;
+
+- for(;;) {
+- res = clockevents_program_event(bc, expires, now);
+- if (!res || !force)
+- return res;
+- now = ktime_get();
+- expires = ktime_add(now, ktime_set(0, bc->min_delta_ns));
+- }
++ return tick_dev_program_event(bc, expires, force);
+ }
+
+ int tick_resume_broadcast_oneshot(struct clock_event_device *bc)
+--- a/kernel/time/tick-internal.h
++++ b/kernel/time/tick-internal.h
+@@ -17,6 +17,8 @@ extern void tick_handle_periodic(struct
+ extern void tick_setup_oneshot(struct clock_event_device *newdev,
+ void (*handler)(struct clock_event_device *),
+ ktime_t nextevt);
++extern int tick_dev_program_event(struct clock_event_device *dev,
++ ktime_t expires, int force);
+ extern int tick_program_event(ktime_t expires, int force);
+ extern void tick_oneshot_notify(void);
+ extern int tick_switch_to_oneshot(void (*handler)(struct clock_event_device *));
+--- a/kernel/time/tick-oneshot.c
++++ b/kernel/time/tick-oneshot.c
+@@ -25,18 +25,42 @@
+ /**
+ * tick_program_event internal worker function
+ */
+-static int __tick_program_event(struct clock_event_device *dev,
+- ktime_t expires, int force)
++int tick_dev_program_event(struct clock_event_device *dev, ktime_t expires,
++ int force)
+ {
+ ktime_t now = ktime_get();
++ int i;
+
+- while (1) {
++ for (i = 0;;) {
+ int ret = clockevents_program_event(dev, expires, now);
+
+ if (!ret || !force)
+ return ret;
++
++ /*
++ * We tried 2 times to program the device with the given
++ * min_delta_ns. If that's not working then we double it
++ * and emit a warning.
++ */
++ if (++i > 2) {
++ printk(KERN_WARNING "CE: __tick_program_event of %s is "
++ "stuck %llx %llx\n", dev->name ? dev->name : "?",
++ now.tv64, expires.tv64);
++ printk(KERN_WARNING
++ "CE: increasing min_delta_ns %ld to %ld nsec\n",
++ dev->min_delta_ns, dev->min_delta_ns << 1);
++ WARN_ON(1);
++
++ /* Double the min. delta and try again */
++ if (!dev->min_delta_ns)
++ dev->min_delta_ns = 5000;
++ else
++ dev->min_delta_ns <<= 1;
++ i = 0;
++ }
++
+ now = ktime_get();
+- expires = ktime_add(now, ktime_set(0, dev->min_delta_ns));
++ expires = ktime_add_ns(now, dev->min_delta_ns);
+ }
+ }
+
+@@ -47,7 +71,7 @@ int tick_program_event(ktime_t expires,
+ {
+ struct clock_event_device *dev = __get_cpu_var(tick_cpu_device).evtdev;
+
+- return __tick_program_event(dev, expires, force);
++ return tick_dev_program_event(dev, expires, force);
+ }
+
+ /**
+@@ -71,7 +95,7 @@ void tick_setup_oneshot(struct clock_eve
+ {
+ newdev->event_handler = handler;
+ clockevents_set_mode(newdev, CLOCK_EVT_MODE_ONESHOT);
+- __tick_program_event(newdev, next_event, 1);
++ tick_dev_program_event(newdev, next_event, 1);
+ }
+
+ /**
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:35 2008
+Message-Id: <20081007002735.033539643@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:50 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Thomas Gleixner <tglx@linutronix.de>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 44/71] HPET: make minimum reprogramming delta useful
+Content-Disposition: inline; filename=timer-fix-06.patch
+Content-Length: 1475
+Lines: 41
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 7cfb0435330364f90f274a26ecdc5f47f738498c upstream
+
+The minimum reprogramming delta was hardcoded in HPET ticks,
+which is stupid as it does not work with faster running HPETs.
+The C1E idle patches made this prominent on AMD/RS690 chipsets,
+where the HPET runs with 25MHz. Set it to 5us which seems to be
+a reasonable value and fixes the problems on the bug reporters
+machines. We have a further sanity check now in the clock events,
+which increases the delta when it is not sufficient.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Luiz Fernando N. Capitulino <lcapitulino@mandriva.com.br>
+Tested-by: Dmitry Nezhevenko <dion@inhex.net>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/hpet.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/hpet.c
++++ b/arch/x86/kernel/hpet.c
+@@ -223,8 +223,8 @@ static void hpet_legacy_clockevent_regis
+ /* Calculate the min / max delta */
+ hpet_clockevent.max_delta_ns = clockevent_delta2ns(0x7FFFFFFF,
+ &hpet_clockevent);
+- hpet_clockevent.min_delta_ns = clockevent_delta2ns(0x30,
+- &hpet_clockevent);
++ /* 5 usec minimum reprogramming delta. */
++ hpet_clockevent.min_delta_ns = 5000;
+
+ /*
+ * Start hpet with the boot cpu mask and make it
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:35 2008
+Message-Id: <20081007002735.232339910@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:51 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Thomas Gleixner <tglx@linutronix.de>
+Subject: [patch 45/71] clockevents: broadcast fixup possible waiters
+Content-Disposition: inline; filename=timer-fix-07.patch
+Content-Length: 2239
+Lines: 77
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 7300711e8c6824fcfbd42a126980ff50439d8dd0 upstream
+
+Until the C1E patches arrived there where no users of periodic broadcast
+before switching to oneshot mode. Now we need to trigger a possible
+waiter for a periodic broadcast when switching to oneshot mode.
+Otherwise we can starve them for ever.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/time/tick-broadcast.c | 37 ++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 36 insertions(+), 1 deletion(-)
+
+--- a/kernel/time/tick-broadcast.c
++++ b/kernel/time/tick-broadcast.c
+@@ -490,6 +490,18 @@ static void tick_broadcast_clear_oneshot
+ cpu_clear(cpu, tick_broadcast_oneshot_mask);
+ }
+
++static void tick_broadcast_init_next_event(cpumask_t *mask, ktime_t expires)
++{
++ struct tick_device *td;
++ int cpu;
++
++ for_each_cpu_mask_nr(cpu, *mask) {
++ td = &per_cpu(tick_cpu_device, cpu);
++ if (td->evtdev)
++ td->evtdev->next_event = expires;
++ }
++}
++
+ /**
+ * tick_broadcast_setup_oneshot - setup the broadcast device
+ */
+@@ -497,9 +509,32 @@ void tick_broadcast_setup_oneshot(struct
+ {
+ /* Set it up only once ! */
+ if (bc->event_handler != tick_handle_oneshot_broadcast) {
++ int was_periodic = bc->mode == CLOCK_EVT_MODE_PERIODIC;
++ int cpu = smp_processor_id();
++ cpumask_t mask;
++
+ bc->event_handler = tick_handle_oneshot_broadcast;
+ clockevents_set_mode(bc, CLOCK_EVT_MODE_ONESHOT);
+- bc->next_event.tv64 = KTIME_MAX;
++
++ /* Take the do_timer update */
++ tick_do_timer_cpu = cpu;
++
++ /*
++ * We must be careful here. There might be other CPUs
++ * waiting for periodic broadcast. We need to set the
++ * oneshot_mask bits for those and program the
++ * broadcast device to fire.
++ */
++ mask = tick_broadcast_mask;
++ cpu_clear(cpu, mask);
++ cpus_or(tick_broadcast_oneshot_mask,
++ tick_broadcast_oneshot_mask, mask);
++
++ if (was_periodic && !cpus_empty(mask)) {
++ tick_broadcast_init_next_event(&mask, tick_next_period);
++ tick_broadcast_set_event(tick_next_period, 1);
++ } else
++ bc->next_event.tv64 = KTIME_MAX;
+ }
+ }
+
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:35 2008
+Message-Id: <20081007002735.433663890@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:52 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Thomas Gleixner <tglx@linutronix.de>
+Subject: [patch 46/71] x86: HPET fix moronic 32/64bit thinko
+Content-Disposition: inline; filename=timer-fix-08.patch
+Content-Length: 1518
+Lines: 55
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit f7676254f179eac6b5244a80195ec8ae0e9d4606 upstream
+
+We use the HPET only in 32bit mode because:
+1) some HPETs are 32bit only
+2) on i386 there is no way to read/write the HPET atomic 64bit wide
+
+The HPET code unification done by the "moron of the year" did
+not take into account that unsigned long is different on 32 and
+64 bit.
+
+This thinko results in a possible endless loop in the clockevents
+code, when the return comparison fails due to the 64bit/332bit
+unawareness.
+
+unsigned long cnt = (u32) hpet_read() + delta can wrap over 32bit.
+but the final compare will fail and return -ETIME causing endless
+loops.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/hpet.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/kernel/hpet.c
++++ b/arch/x86/kernel/hpet.c
+@@ -283,15 +283,15 @@ static void hpet_legacy_set_mode(enum cl
+ }
+
+ static int hpet_legacy_next_event(unsigned long delta,
+- struct clock_event_device *evt)
++ struct clock_event_device *evt)
+ {
+- unsigned long cnt;
++ u32 cnt;
+
+ cnt = hpet_readl(HPET_COUNTER);
+- cnt += delta;
++ cnt += (u32) delta;
+ hpet_writel(cnt, HPET_T0_CMP);
+
+- return ((long)(hpet_readl(HPET_COUNTER) - cnt ) > 0) ? -ETIME : 0;
++ return (s32)((u32)hpet_readl(HPET_COUNTER) - cnt) >= 0 ? -ETIME : 0;
+ }
+
+ /*
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:35 2008
+Message-Id: <20081007002735.597988546@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:53 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Thomas Gleixner <tglx@linutronix.de>
+Subject: [patch 47/71] x86: HPET: read back compare register before reading counter
+Content-Disposition: inline; filename=timer-fix-09.patch
+Content-Length: 1185
+Lines: 39
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 72d43d9bc9210d24d09202eaf219eac09e17b339 upstream
+
+After fixing the u32 thinko I sill had occasional hickups on ATI chipsets
+with small deltas. There seems to be a delay between writing the compare
+register and the transffer to the internal register which triggers the
+interrupt. Reading back the value makes sure, that it hit the internal
+match register befor we compare against the counter value.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/hpet.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/arch/x86/kernel/hpet.c
++++ b/arch/x86/kernel/hpet.c
+@@ -291,6 +291,13 @@ static int hpet_legacy_next_event(unsign
+ cnt += (u32) delta;
+ hpet_writel(cnt, HPET_T0_CMP);
+
++ /*
++ * We need to read back the CMP register to make sure that
++ * what we wrote hit the chip before we compare it to the
++ * counter.
++ */
++ WARN_ON((u32)hpet_readl(HPET_T0_CMP) != cnt);
++
+ return (s32)((u32)hpet_readl(HPET_COUNTER) - cnt) >= 0 ? -ETIME : 0;
+ }
+
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:35 2008
+Message-Id: <20081007002735.769142213@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:54 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Maciej W. Rozycki" <macro@linux-mips.org>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 48/71] ntp: fix calculation of the next jiffie to trigger RTC sync
+Content-Disposition: inline; filename=timer-fix-10.patch
+Content-Length: 2377
+Lines: 58
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Maciej W. Rozycki <macro@linux-mips.org>
+
+commit 4ff4b9e19a80b73959ebeb28d1df40176686f0a8 upstream
+
+We have a bug in the calculation of the next jiffie to trigger the RTC
+synchronisation. The aim here is to run sync_cmos_clock() as close as
+possible to the middle of a second. Which means we want this function to
+be called less than or equal to half a jiffie away from when now.tv_nsec
+equals 5e8 (500000000).
+
+If this is not the case for a given call to the function, for this purpose
+instead of updating the RTC we calculate the offset in nanoseconds to the
+next point in time where now.tv_nsec will be equal 5e8. The calculated
+offset is then converted to jiffies as these are the unit used by the
+timer.
+
+Hovewer timespec_to_jiffies() used here uses a ceil()-type rounding mode,
+where the resulting value is rounded up. As a result the range of
+now.tv_nsec when the timer will trigger is from 5e8 to 5e8 + TICK_NSEC
+rather than the desired 5e8 - TICK_NSEC / 2 to 5e8 + TICK_NSEC / 2.
+
+As a result if for example sync_cmos_clock() happens to be called at the
+time when now.tv_nsec is between 5e8 + TICK_NSEC / 2 and 5e8 to 5e8 +
+TICK_NSEC, it will simply be rescheduled HZ jiffies later, falling in the
+same range of now.tv_nsec again. Similarly for cases offsetted by an
+integer multiple of TICK_NSEC.
+
+This change addresses the problem by subtracting TICK_NSEC / 2 from the
+nanosecond offset to the next point in time where now.tv_nsec will be
+equal 5e8, effectively shifting the following rounding in
+timespec_to_jiffies() so that it produces a rounded-to-nearest result.
+
+Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/time/ntp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/time/ntp.c
++++ b/kernel/time/ntp.c
+@@ -245,7 +245,7 @@ static void sync_cmos_clock(unsigned lon
+ if (abs(now.tv_nsec - (NSEC_PER_SEC / 2)) <= tick_nsec / 2)
+ fail = update_persistent_clock(now);
+
+- next.tv_nsec = (NSEC_PER_SEC / 2) - now.tv_nsec;
++ next.tv_nsec = (NSEC_PER_SEC / 2) - now.tv_nsec - (TICK_NSEC / 2);
+ if (next.tv_nsec <= 0)
+ next.tv_nsec += NSEC_PER_SEC;
+
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:36 2008
+Message-Id: <20081007002735.916312663@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:55 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Thomas Gleixner <tglx@linutronix.de>
+Subject: [patch 49/71] clockevents: remove WARN_ON which was used to gather information
+Content-Disposition: inline; filename=timer-fix-11.patch
+Content-Length: 1849
+Lines: 58
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 61c22c34c6f80a8e89cff5ff717627c54cc14fd4 upstream
+
+The issue of the endless reprogramming loop due to a too small
+min_delta_ns was fixed with the previous updates of the clock events
+code, but we had no information about the spread of this problem. I
+added a WARN_ON to get automated information via kerneloops.org and to
+get some direct reports, which allowed me to analyse the affected
+machines.
+
+The WARN_ON has served its purpose and would be annoying for a release
+kernel. Remove it and just keep the information about the increase of
+the min_delta_ns value.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/time/tick-oneshot.c | 18 ++++++++----------
+ 1 file changed, 8 insertions(+), 10 deletions(-)
+
+--- a/kernel/time/tick-oneshot.c
++++ b/kernel/time/tick-oneshot.c
+@@ -43,19 +43,17 @@ int tick_dev_program_event(struct clock_
+ * and emit a warning.
+ */
+ if (++i > 2) {
+- printk(KERN_WARNING "CE: __tick_program_event of %s is "
+- "stuck %llx %llx\n", dev->name ? dev->name : "?",
+- now.tv64, expires.tv64);
+- printk(KERN_WARNING
+- "CE: increasing min_delta_ns %ld to %ld nsec\n",
+- dev->min_delta_ns, dev->min_delta_ns << 1);
+- WARN_ON(1);
+-
+- /* Double the min. delta and try again */
++ /* Increase the min. delta and try again */
+ if (!dev->min_delta_ns)
+ dev->min_delta_ns = 5000;
+ else
+- dev->min_delta_ns <<= 1;
++ dev->min_delta_ns += dev->min_delta_ns >> 1;
++
++ printk(KERN_WARNING
++ "CE: %s increasing min_delta_ns to %lu nsec\n",
++ dev->name ? dev->name : "?",
++ dev->min_delta_ns << 1);
++
+ i = 0;
+ }
+
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:36 2008
+Message-Id: <20081007002736.065711539@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:56 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Cox <alan@redhat.com>,
+ Dominik Brodowski <linux@dominikbrodowski.net>
+Subject: [patch 50/71] pcmcia: Fix broken abuse of dev->driver_data
+Content-Disposition: inline; filename=pcmcia-fix-broken-abuse-of-dev-driver_data.patch
+Content-Length: 2401
+Lines: 74
+
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Alan Cox <alan@redhat.com>
+
+[ Upstream commit: cec5eb7be3a104fffd27ca967ee8e15a123050e2 ]
+
+PCMCIA abuses dev->private_data in the probe methods. Unfortunately it
+continues to abuse it after calling drv->probe() which leads to crashes and
+other nasties (such as bogus probes of multifunction devices) giving errors like
+
+pcmcia: registering new device pcmcia0.1
+kernel: 0.1: GetNextTuple: No more items
+
+Extract the passed data before calling the driver probe function that way
+we don't blow up when the driver reuses dev->private_data as its right.
+
+Signed-off-by: Alan Cox <alan@redhat.com>
+Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pcmcia/ds.c | 23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+--- a/drivers/pcmcia/ds.c
++++ b/drivers/pcmcia/ds.c
+@@ -428,6 +428,18 @@ static int pcmcia_device_probe(struct de
+ p_drv = to_pcmcia_drv(dev->driver);
+ s = p_dev->socket;
+
++ /* The PCMCIA code passes the match data in via dev->driver_data
++ * which is an ugly hack. Once the driver probe is called it may
++ * and often will overwrite the match data so we must save it first
++ *
++ * handle pseudo multifunction devices:
++ * there are at most two pseudo multifunction devices.
++ * if we're matching against the first, schedule a
++ * call which will then check whether there are two
++ * pseudo devices, and if not, add the second one.
++ */
++ did = p_dev->dev.driver_data;
++
+ ds_dbg(1, "trying to bind %s to %s\n", p_dev->dev.bus_id,
+ p_drv->drv.name);
+
+@@ -456,21 +468,14 @@ static int pcmcia_device_probe(struct de
+ goto put_module;
+ }
+
+- /* handle pseudo multifunction devices:
+- * there are at most two pseudo multifunction devices.
+- * if we're matching against the first, schedule a
+- * call which will then check whether there are two
+- * pseudo devices, and if not, add the second one.
+- */
+- did = p_dev->dev.driver_data;
+ if (did && (did->match_flags & PCMCIA_DEV_ID_MATCH_DEVICE_NO) &&
+ (p_dev->socket->device_count == 1) && (p_dev->device_no == 0))
+ pcmcia_add_device_later(p_dev->socket, 0);
+
+- put_module:
++put_module:
+ if (ret)
+ module_put(p_drv->owner);
+- put_dev:
++put_dev:
+ if (ret)
+ put_device(dev);
+ return (ret);
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:36 2008
+Message-Id: <20081007002736.220178657@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:57 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Timo Teras <timo.teras@iki.fi>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 51/71] af_key: Free dumping state on socket close
+Content-Disposition: inline; filename=0001-af_key-Free-dumping-state-on-socket-close.patch
+Content-Length: 1539
+Lines: 71
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Timo Teras <timo.teras@iki.fi>
+
+[ Upstream commit 0523820482dcb42784572ffd2296c2f08c275a2b ]
+
+Fix a xfrm_{state,policy}_walk leak if pfkey socket is closed while
+dumping is on-going.
+
+Signed-off-by: Timo Teras <timo.teras@iki.fi>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+
+---
+ net/key/af_key.c | 30 +++++++++++++++++++-----------
+ 1 file changed, 19 insertions(+), 11 deletions(-)
+
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -73,22 +73,18 @@ static int pfkey_can_dump(struct sock *s
+ return 0;
+ }
+
+-static int pfkey_do_dump(struct pfkey_sock *pfk)
++static void pfkey_terminate_dump(struct pfkey_sock *pfk)
+ {
+- int rc;
+-
+- rc = pfk->dump.dump(pfk);
+- if (rc == -ENOBUFS)
+- return 0;
+-
+- pfk->dump.done(pfk);
+- pfk->dump.dump = NULL;
+- pfk->dump.done = NULL;
+- return rc;
++ if (pfk->dump.dump) {
++ pfk->dump.done(pfk);
++ pfk->dump.dump = NULL;
++ pfk->dump.done = NULL;
++ }
+ }
+
+ static void pfkey_sock_destruct(struct sock *sk)
+ {
++ pfkey_terminate_dump(pfkey_sk(sk));
+ skb_queue_purge(&sk->sk_receive_queue);
+
+ if (!sock_flag(sk, SOCK_DEAD)) {
+@@ -310,6 +306,18 @@ static int pfkey_broadcast(struct sk_buf
+ return err;
+ }
+
++static int pfkey_do_dump(struct pfkey_sock *pfk)
++{
++ int rc;
++
++ rc = pfk->dump.dump(pfk);
++ if (rc == -ENOBUFS)
++ return 0;
++
++ pfkey_terminate_dump(pfk);
++ return rc;
++}
++
+ static inline void pfkey_hdr_dup(struct sadb_msg *new, struct sadb_msg *orig)
+ {
+ *new = *orig;
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:36 2008
+Message-Id: <20081007002736.369656384@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:58 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Arnaud Ebalard <arno@natisbad.org>,
+ Benjamin Thery <benjamin.thery@bull.net>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 52/71] XFRM,IPv6: initialize ip6_dst_blackhole_ops.kmem_cachep
+Content-Disposition: inline; filename=0002-XFRM-IPv6-initialize-ip6_dst_blackhole_ops.kmem_cac.patch
+Content-Length: 3321
+Lines: 72
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Arnaud Ebalard <arno@natisbad.org>
+
+[ Upstream commit 5dc121e9a7a8a3721cefeb07f3559f50fbedc67e ]
+
+ip6_dst_blackhole_ops.kmem_cachep is not expected to be NULL (i.e. to
+be initialized) when dst_alloc() is called from ip6_dst_blackhole().
+Otherwise, it results in the following (xfrm_larval_drop is now set to
+1 by default):
+
+[ 78.697642] Unable to handle kernel paging request for data at address 0x0000004c
+[ 78.703449] Faulting instruction address: 0xc0097f54
+[ 78.786896] Oops: Kernel access of bad area, sig: 11 [#1]
+[ 78.792791] PowerMac
+[ 78.798383] Modules linked in: btusb usbhid bluetooth b43 mac80211 cfg80211 ehci_hcd ohci_hcd sungem sungem_phy usbcore ssb
+[ 78.804263] NIP: c0097f54 LR: c0334a28 CTR: c002d430
+[ 78.809997] REGS: eef19ad0 TRAP: 0300 Not tainted (2.6.27-rc5)
+[ 78.815743] MSR: 00001032 <ME,IR,DR> CR: 22242482 XER: 20000000
+[ 78.821550] DAR: 0000004c, DSISR: 40000000
+[ 78.827278] TASK = eef0df40[3035] 'mip6d' THREAD: eef18000
+[ 78.827408] GPR00: 00001032 eef19b80 eef0df40 00000000 00008020 eef19c30 00000001 00000000
+[ 78.833249] GPR08: eee5101c c05a5c10 ef9ad500 00000000 24242422 1005787c 00000000 1004f960
+[ 78.839151] GPR16: 00000000 10024e90 10050040 48030018 0fe44150 00000000 00000000 eef19c30
+[ 78.845046] GPR24: eef19e44 00000000 eef19bf8 efb37c14 eef19bf8 00008020 00009032 c0596064
+[ 78.856671] NIP [c0097f54] kmem_cache_alloc+0x20/0x94
+[ 78.862581] LR [c0334a28] dst_alloc+0x40/0xc4
+[ 78.868451] Call Trace:
+[ 78.874252] [eef19b80] [c03c1810] ip6_dst_lookup_tail+0x1c8/0x1dc (unreliable)
+[ 78.880222] [eef19ba0] [c0334a28] dst_alloc+0x40/0xc4
+[ 78.886164] [eef19bb0] [c03cd698] ip6_dst_blackhole+0x28/0x1cc
+[ 78.892090] [eef19be0] [c03d9be8] rawv6_sendmsg+0x75c/0xc88
+[ 78.897999] [eef19cb0] [c038bca4] inet_sendmsg+0x4c/0x78
+[ 78.903907] [eef19cd0] [c03207c8] sock_sendmsg+0xac/0xe4
+[ 78.909734] [eef19db0] [c03209e4] sys_sendmsg+0x1e4/0x2a0
+[ 78.915540] [eef19f00] [c03220a8] sys_socketcall+0xfc/0x210
+[ 78.921406] [eef19f40] [c0014b3c] ret_from_syscall+0x0/0x38
+[ 78.927295] --- Exception: c01 at 0xfe2d730
+[ 78.927297] LR = 0xfe2d71c
+[ 78.939019] Instruction dump:
+[ 78.944835] 91640018 9144001c 900a0000 4bffff44 9421ffe0 7c0802a6 bf810010 7c9d2378
+[ 78.950694] 90010024 7fc000a6 57c0045e 7c000124 <83e3004c> 8383005c 2f9f0000 419e0050
+[ 78.956464] ---[ end trace 05fa1ed7972487a1 ]---
+
+As commented by Benjamin Thery, the bug was introduced by
+f2fc6a54585a1be6669613a31fbaba2ecbadcd36, while adding network
+namespaces support to ipv6 routes.
+
+Signed-off-by: Arnaud Ebalard <arno@natisbad.org>
+Acked-by: Benjamin Thery <benjamin.thery@bull.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv6/route.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -2718,6 +2718,8 @@ int __init ip6_route_init(void)
+ if (ret)
+ goto out_kmem_cache;
+
++ ip6_dst_blackhole_ops.kmem_cachep = ip6_dst_ops_template.kmem_cachep;
++
+ /* Registering of the loopback is done before this portion of code,
+ * the loopback reference in rt6_info will not be taken, do it
+ * manually for init_net */
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:36 2008
+Message-Id: <20081007002736.526908004@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:59 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Neil Horman <nhorman@tuxdriver.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 53/71] ipv6: Fix OOPS in ip6_dst_lookup_tail().
+Content-Disposition: inline; filename=0003-ipv6-Fix-OOPS-in-ip6_dst_lookup_tail.patch
+Content-Length: 3009
+Lines: 105
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Neil Horman <nhorman@tuxdriver.com>
+
+[ Upstream commit e550dfb0c2c31b6363aa463a035fc9f8dcaa3c9b ]
+
+This fixes kernel bugzilla 11469: "TUN with 1024 neighbours:
+ip6_dst_lookup_tail NULL crash"
+
+dst->neighbour is not necessarily hooked up at this point
+in the processing path, so blindly dereferencing it is
+the wrong thing to do. This NULL check exists in other
+similar paths and this case was just an oversight.
+
+Also fix the completely wrong and confusing indentation
+here while we're at it.
+
+Based upon a patch by Evgeniy Polyakov.
+
+Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv6/ip6_output.c | 64 +++++++++++++++++++++++++-------------------------
+ 1 file changed, 32 insertions(+), 32 deletions(-)
+
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -934,39 +934,39 @@ static int ip6_dst_lookup_tail(struct so
+ }
+
+ #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
+- /*
+- * Here if the dst entry we've looked up
+- * has a neighbour entry that is in the INCOMPLETE
+- * state and the src address from the flow is
+- * marked as OPTIMISTIC, we release the found
+- * dst entry and replace it instead with the
+- * dst entry of the nexthop router
+- */
+- if (!((*dst)->neighbour->nud_state & NUD_VALID)) {
+- struct inet6_ifaddr *ifp;
+- struct flowi fl_gw;
+- int redirect;
+-
+- ifp = ipv6_get_ifaddr(net, &fl->fl6_src,
+- (*dst)->dev, 1);
+-
+- redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
+- if (ifp)
+- in6_ifa_put(ifp);
+-
+- if (redirect) {
+- /*
+- * We need to get the dst entry for the
+- * default router instead
+- */
+- dst_release(*dst);
+- memcpy(&fl_gw, fl, sizeof(struct flowi));
+- memset(&fl_gw.fl6_dst, 0, sizeof(struct in6_addr));
+- *dst = ip6_route_output(net, sk, &fl_gw);
+- if ((err = (*dst)->error))
+- goto out_err_release;
+- }
++ /*
++ * Here if the dst entry we've looked up
++ * has a neighbour entry that is in the INCOMPLETE
++ * state and the src address from the flow is
++ * marked as OPTIMISTIC, we release the found
++ * dst entry and replace it instead with the
++ * dst entry of the nexthop router
++ */
++ if ((*dst)->neighbour && !((*dst)->neighbour->nud_state & NUD_VALID)) {
++ struct inet6_ifaddr *ifp;
++ struct flowi fl_gw;
++ int redirect;
++
++ ifp = ipv6_get_ifaddr(net, &fl->fl6_src,
++ (*dst)->dev, 1);
++
++ redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
++ if (ifp)
++ in6_ifa_put(ifp);
++
++ if (redirect) {
++ /*
++ * We need to get the dst entry for the
++ * default router instead
++ */
++ dst_release(*dst);
++ memcpy(&fl_gw, fl, sizeof(struct flowi));
++ memset(&fl_gw.fl6_dst, 0, sizeof(struct in6_addr));
++ *dst = ip6_route_output(net, sk, &fl_gw);
++ if ((err = (*dst)->error))
++ goto out_err_release;
+ }
++ }
+ #endif
+
+ return 0;
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:36 2008
+Message-Id: <20081007002736.687380355@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:27:00 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Santwona Behera <santwona.behera@sun.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 54/71] niu: panic on reset
+Content-Disposition: inline; filename=0004-niu-panic-on-reset.patch
+Content-Length: 2377
+Lines: 94
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Santwona Behera <santwona.behera@sun.com>
+
+[ Upstream commit cff502a38394fd33693f6233e03fca363dfa956d ]
+
+The reset_task function in the niu driver does not reset the tx and rx
+buffers properly. This leads to panic on reset. This patch is a
+modified implementation of the previously posted fix.
+
+Signed-off-by: Santwona Behera <santwona.behera@sun.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/niu.c | 56 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 56 insertions(+)
+
+--- a/drivers/net/niu.c
++++ b/drivers/net/niu.c
+@@ -5978,6 +5978,56 @@ static void niu_netif_start(struct niu *
+ niu_enable_interrupts(np, 1);
+ }
+
++static void niu_reset_buffers(struct niu *np)
++{
++ int i, j, k, err;
++
++ if (np->rx_rings) {
++ for (i = 0; i < np->num_rx_rings; i++) {
++ struct rx_ring_info *rp = &np->rx_rings[i];
++
++ for (j = 0, k = 0; j < MAX_RBR_RING_SIZE; j++) {
++ struct page *page;
++
++ page = rp->rxhash[j];
++ while (page) {
++ struct page *next =
++ (struct page *) page->mapping;
++ u64 base = page->index;
++ base = base >> RBR_DESCR_ADDR_SHIFT;
++ rp->rbr[k++] = cpu_to_le32(base);
++ page = next;
++ }
++ }
++ for (; k < MAX_RBR_RING_SIZE; k++) {
++ err = niu_rbr_add_page(np, rp, GFP_ATOMIC, k);
++ if (unlikely(err))
++ break;
++ }
++
++ rp->rbr_index = rp->rbr_table_size - 1;
++ rp->rcr_index = 0;
++ rp->rbr_pending = 0;
++ rp->rbr_refill_pending = 0;
++ }
++ }
++ if (np->tx_rings) {
++ for (i = 0; i < np->num_tx_rings; i++) {
++ struct tx_ring_info *rp = &np->tx_rings[i];
++
++ for (j = 0; j < MAX_TX_RING_SIZE; j++) {
++ if (rp->tx_buffs[j].skb)
++ (void) release_tx_packet(np, rp, j);
++ }
++
++ rp->pending = MAX_TX_RING_SIZE;
++ rp->prod = 0;
++ rp->cons = 0;
++ rp->wrap_bit = 0;
++ }
++ }
++}
++
+ static void niu_reset_task(struct work_struct *work)
+ {
+ struct niu *np = container_of(work, struct niu, reset_task);
+@@ -6000,6 +6050,12 @@ static void niu_reset_task(struct work_s
+
+ niu_stop_hw(np);
+
++ spin_unlock_irqrestore(&np->lock, flags);
++
++ niu_reset_buffers(np);
++
++ spin_lock_irqsave(&np->lock, flags);
++
+ err = niu_init_hw(np);
+ if (!err) {
+ np->timer.expires = jiffies + HZ;
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:37 2008
+Message-Id: <20081007002736.912173310@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:27:01 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Vegard Nossum <vegard.nossum@gmail.com>,
+ Thomas Graf <tgraf@suug.ch>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 55/71] netlink: fix overrun in attribute iteration
+Content-Disposition: inline; filename=0005-netlink-fix-overrun-in-attribute-iteration.patch
+Content-Length: 3110
+Lines: 93
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Vegard Nossum <vegard.nossum@gmail.com>
+
+[ Upstream commit 1045b03e07d85f3545118510a587035536030c1c ]
+
+kmemcheck reported this:
+
+ kmemcheck: Caught 16-bit read from uninitialized memory (f6c1ba30)
+ 0500110001508abf050010000500000002017300140000006f72672e66726565
+ i i i i i i i i i i i i i u u u u u u u u u u u u u u u u u u u
+ ^
+
+ Pid: 3462, comm: wpa_supplicant Not tainted (2.6.27-rc3-00054-g6397ab9-dirty #13)
+ EIP: 0060:[<c05de64a>] EFLAGS: 00010296 CPU: 0
+ EIP is at nla_parse+0x5a/0xf0
+ EAX: 00000008 EBX: fffffffd ECX: c06f16c0 EDX: 00000005
+ ESI: 00000010 EDI: f6c1ba30 EBP: f6367c6c ESP: c0a11e88
+ DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
+ CR0: 8005003b CR2: f781cc84 CR3: 3632f000 CR4: 000006d0
+ DR0: c0ead9bc DR1: 00000000 DR2: 00000000 DR3: 00000000
+ DR6: ffff4ff0 DR7: 00000400
+ [<c05d4b23>] rtnl_setlink+0x63/0x130
+ [<c05d5f75>] rtnetlink_rcv_msg+0x165/0x200
+ [<c05ddf66>] netlink_rcv_skb+0x76/0xa0
+ [<c05d5dfe>] rtnetlink_rcv+0x1e/0x30
+ [<c05dda21>] netlink_unicast+0x281/0x290
+ [<c05ddbe9>] netlink_sendmsg+0x1b9/0x2b0
+ [<c05beef2>] sock_sendmsg+0xd2/0x100
+ [<c05bf945>] sys_sendto+0xa5/0xd0
+ [<c05bf9a6>] sys_send+0x36/0x40
+ [<c05c03d6>] sys_socketcall+0x1e6/0x2c0
+ [<c020353b>] sysenter_do_call+0x12/0x3f
+ [<ffffffff>] 0xffffffff
+
+This is the line in nla_ok():
+
+ /**
+ * nla_ok - check if the netlink attribute fits into the remaining bytes
+ * @nla: netlink attribute
+ * @remaining: number of bytes remaining in attribute stream
+ */
+ static inline int nla_ok(const struct nlattr *nla, int remaining)
+ {
+ return remaining >= sizeof(*nla) &&
+ nla->nla_len >= sizeof(*nla) &&
+ nla->nla_len <= remaining;
+ }
+
+It turns out that remaining can become negative due to alignment in
+nla_next(). But GCC promotes "remaining" to unsigned in the test
+against sizeof(*nla) above. Therefore the test succeeds, and the
+nla_for_each_attr() may access memory outside the received buffer.
+
+A short example illustrating this point is here:
+
+ #include <stdio.h>
+
+ main(void)
+ {
+ printf("%d\n", -1 >= sizeof(int));
+ }
+
+...which prints "1".
+
+This patch adds a cast in front of the sizeof so that GCC will make
+a signed comparison and fix the illegal memory dereference. With the
+patch applied, there is no kmemcheck report.
+
+Signed-off-by: Vegard Nossum <vegard.nossum@gmail.com>
+Acked-by: Thomas Graf <tgraf@suug.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/net/netlink.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/net/netlink.h
++++ b/include/net/netlink.h
+@@ -702,7 +702,7 @@ static inline int nla_len(const struct n
+ */
+ static inline int nla_ok(const struct nlattr *nla, int remaining)
+ {
+- return remaining >= sizeof(*nla) &&
++ return remaining >= (int) sizeof(*nla) &&
+ nla->nla_len >= sizeof(*nla) &&
+ nla->nla_len <= remaining;
+ }
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:37 2008
+Message-Id: <20081007002737.057012459@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:27:02 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Herbert Xu <herbert@gondor.apana.org.au>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 56/71] ipsec: Fix pskb_expand_head corruption in xfrm_state_check_space
+Content-Disposition: inline; filename=0006-ipsec-Fix-pskb_expand_head-corruption-in-xfrm_state.patch
+Content-Length: 1116
+Lines: 41
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit d01dbeb6af7a0848063033f73c3d146fec7451f3 ]
+
+We're never supposed to shrink the headroom or tailroom. In fact,
+shrinking the headroom is a fatal action.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/xfrm/xfrm_output.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/net/xfrm/xfrm_output.c
++++ b/net/xfrm/xfrm_output.c
+@@ -27,10 +27,14 @@ static int xfrm_state_check_space(struct
+ - skb_headroom(skb);
+ int ntail = dst->dev->needed_tailroom - skb_tailroom(skb);
+
+- if (nhead > 0 || ntail > 0)
+- return pskb_expand_head(skb, nhead, ntail, GFP_ATOMIC);
++ if (nhead <= 0) {
++ if (ntail <= 0)
++ return 0;
++ nhead = 0;
++ } else if (ntail < 0)
++ ntail = 0;
+
+- return 0;
++ return pskb_expand_head(skb, nhead, ntail, GFP_ATOMIC);
+ }
+
+ static int xfrm_output_one(struct sk_buff *skb, int err)
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:37 2008
+Message-Id: <20081007002737.224323598@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:27:03 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Vlad Yasevich <vladislav.yasevich@hp.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 57/71] sctp: do not enable peer features if we cant do them.
+Content-Disposition: inline; filename=0007-sctp-do-not-enable-peer-features-if-we-can-t-do-the.patch
+Content-Length: 1664
+Lines: 53
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Vlad Yasevich <vladislav.yasevich@hp.com>
+
+[ Upstream commit 0ef46e285c062cbe35d60c0adbff96f530d31c86 ]
+
+Do not enable peer features like addip and auth, if they
+are administratively disabled localy. If the peer resports
+that he supports something that we don't, neither end can
+use it so enabling it is pointless. This solves a problem
+when talking to a peer that has auth and addip enabled while
+we do not. Found by Andrei Pelinescu-Onciul <andrei@iptel.org>.
+
+Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sctp/sm_make_chunk.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -1886,11 +1886,13 @@ static void sctp_process_ext_param(struc
+ /* if the peer reports AUTH, assume that he
+ * supports AUTH.
+ */
+- asoc->peer.auth_capable = 1;
++ if (sctp_auth_enable)
++ asoc->peer.auth_capable = 1;
+ break;
+ case SCTP_CID_ASCONF:
+ case SCTP_CID_ASCONF_ACK:
+- asoc->peer.asconf_capable = 1;
++ if (sctp_addip_enable)
++ asoc->peer.asconf_capable = 1;
+ break;
+ default:
+ break;
+@@ -2455,6 +2457,9 @@ static int sctp_process_param(struct sct
+ break;
+
+ case SCTP_PARAM_SET_PRIMARY:
++ if (!sctp_addip_enable)
++ goto fall_through;
++
+ addr_param = param.v + sizeof(sctp_addip_param_t);
+
+ af = sctp_get_af_specific(param_type2af(param.p->type));
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:37 2008
+Message-Id: <20081007002737.379217376@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:27:04 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Vlad Yasevich <vladislav.yasevich@hp.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 58/71] sctp: Fix oops when INIT-ACK indicates that peer doesnt support AUTH
+Content-Disposition: inline; filename=0008-sctp-Fix-oops-when-INIT-ACK-indicates-that-peer-doe.patch
+Content-Length: 2354
+Lines: 70
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Vlad Yasevich <vladislav.yasevich@hp.com>
+
+[ Upstream commit add52379dde2e5300e2d574b172e62c6cf43b3d3 ]
+
+If INIT-ACK is received with SupportedExtensions parameter which
+indicates that the peer does not support AUTH, the packet will be
+silently ignore, and sctp_process_init() do cleanup all of the
+transports in the association.
+When T1-Init timer is expires, OOPS happen while we try to choose
+a different init transport.
+
+The solution is to only clean up the non-active transports, i.e
+the ones that the peer added. However, that introduces a problem
+with sctp_connectx(), because we don't mark the proper state for
+the transports provided by the user. So, we'll simply mark
+user-provided transports as ACTIVE. That will allow INIT
+retransmissions to work properly in the sctp_connectx() context
+and prevent the crash.
+
+Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sctp/associola.c | 9 +++++----
+ net/sctp/sm_make_chunk.c | 6 ++----
+ 2 files changed, 7 insertions(+), 8 deletions(-)
+
+--- a/net/sctp/associola.c
++++ b/net/sctp/associola.c
+@@ -597,11 +597,12 @@ struct sctp_transport *sctp_assoc_add_pe
+ /* Check to see if this is a duplicate. */
+ peer = sctp_assoc_lookup_paddr(asoc, addr);
+ if (peer) {
++ /* An UNKNOWN state is only set on transports added by
++ * user in sctp_connectx() call. Such transports should be
++ * considered CONFIRMED per RFC 4960, Section 5.4.
++ */
+ if (peer->state == SCTP_UNKNOWN) {
+- if (peer_state == SCTP_ACTIVE)
+- peer->state = SCTP_ACTIVE;
+- if (peer_state == SCTP_UNCONFIRMED)
+- peer->state = SCTP_UNCONFIRMED;
++ peer->state = SCTP_ACTIVE;
+ }
+ return peer;
+ }
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -2321,12 +2321,10 @@ clean_up:
+ /* Release the transport structures. */
+ list_for_each_safe(pos, temp, &asoc->peer.transport_addr_list) {
+ transport = list_entry(pos, struct sctp_transport, transports);
+- list_del_init(pos);
+- sctp_transport_free(transport);
++ if (transport->state != SCTP_ACTIVE)
++ sctp_assoc_rm_peer(asoc, transport);
+ }
+
+- asoc->peer.transport_count = 0;
+-
+ nomem:
+ return 0;
+ }
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:37 2008
+Message-Id: <20081007002737.541343847@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:27:05 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Herbert Xu <herbert@gondor.apana.org.au>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 59/71] udp: Fix rcv socket locking
+Content-Disposition: inline; filename=0009-udp-Fix-rcv-socket-locking.patch
+Content-Length: 3429
+Lines: 131
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 93821778def10ec1e69aa3ac10adee975dad4ff3 ]
+
+The previous patch in response to the recursive locking on IPsec
+reception is broken as it tries to drop the BH socket lock while in
+user context.
+
+This patch fixes it by shrinking the section protected by the
+socket lock to sock_queue_rcv_skb only. The only reason we added
+the lock is for the accounting which happens in that function.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/udp.c | 59 +++++++++++++++++++++++++++++++--------------------------
+ 1 file changed, 33 insertions(+), 26 deletions(-)
+
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -950,6 +950,27 @@ int udp_disconnect(struct sock *sk, int
+ return 0;
+ }
+
++static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
++{
++ int is_udplite = IS_UDPLITE(sk);
++ int rc;
++
++ if ((rc = sock_queue_rcv_skb(sk, skb)) < 0) {
++ /* Note that an ENOMEM error is charged twice */
++ if (rc == -ENOMEM)
++ UDP_INC_STATS_BH(UDP_MIB_RCVBUFERRORS,
++ is_udplite);
++ goto drop;
++ }
++
++ return 0;
++
++drop:
++ UDP_INC_STATS_BH(UDP_MIB_INERRORS, is_udplite);
++ kfree_skb(skb);
++ return -1;
++}
++
+ /* returns:
+ * -1: error
+ * 0: success
+@@ -988,9 +1009,7 @@ int udp_queue_rcv_skb(struct sock * sk,
+ up->encap_rcv != NULL) {
+ int ret;
+
+- bh_unlock_sock(sk);
+ ret = (*up->encap_rcv)(sk, skb);
+- bh_lock_sock(sk);
+ if (ret <= 0) {
+ UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS,
+ is_udplite);
+@@ -1042,14 +1061,16 @@ int udp_queue_rcv_skb(struct sock * sk,
+ goto drop;
+ }
+
+- if ((rc = sock_queue_rcv_skb(sk,skb)) < 0) {
+- /* Note that an ENOMEM error is charged twice */
+- if (rc == -ENOMEM)
+- UDP_INC_STATS_BH(UDP_MIB_RCVBUFERRORS, is_udplite);
+- goto drop;
+- }
++ rc = 0;
+
+- return 0;
++ bh_lock_sock(sk);
++ if (!sock_owned_by_user(sk))
++ rc = __udp_queue_rcv_skb(sk, skb);
++ else
++ sk_add_backlog(sk, skb);
++ bh_unlock_sock(sk);
++
++ return rc;
+
+ drop:
+ UDP_INC_STATS_BH(UDP_MIB_INERRORS, is_udplite);
+@@ -1087,15 +1108,7 @@ static int __udp4_lib_mcast_deliver(stru
+ skb1 = skb_clone(skb, GFP_ATOMIC);
+
+ if (skb1) {
+- int ret = 0;
+-
+- bh_lock_sock(sk);
+- if (!sock_owned_by_user(sk))
+- ret = udp_queue_rcv_skb(sk, skb1);
+- else
+- sk_add_backlog(sk, skb1);
+- bh_unlock_sock(sk);
+-
++ int ret = udp_queue_rcv_skb(sk, skb1);
+ if (ret > 0)
+ /* we should probably re-process instead
+ * of dropping packets here. */
+@@ -1188,13 +1201,7 @@ int __udp4_lib_rcv(struct sk_buff *skb,
+ uh->dest, inet_iif(skb), udptable);
+
+ if (sk != NULL) {
+- int ret = 0;
+- bh_lock_sock(sk);
+- if (!sock_owned_by_user(sk))
+- ret = udp_queue_rcv_skb(sk, skb);
+- else
+- sk_add_backlog(sk, skb);
+- bh_unlock_sock(sk);
++ int ret = udp_queue_rcv_skb(sk, skb);
+ sock_put(sk);
+
+ /* a return value > 0 means to resubmit the input, but
+@@ -1487,7 +1494,7 @@ struct proto udp_prot = {
+ .sendmsg = udp_sendmsg,
+ .recvmsg = udp_recvmsg,
+ .sendpage = udp_sendpage,
+- .backlog_rcv = udp_queue_rcv_skb,
++ .backlog_rcv = __udp_queue_rcv_skb,
+ .hash = udp_lib_hash,
+ .unhash = udp_lib_unhash,
+ .get_port = udp_v4_get_port,
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:37 2008
+Message-Id: <20081007002737.679790214@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:27:06 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 60/71] sparc64: Fix PCI error interrupt registry on PSYCHO.
+Content-Disposition: inline; filename=0001-sparc64-Fix-PCI-error-interrupt-registry-on-PSYCHO.patch
+Content-Length: 2084
+Lines: 66
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 80a56ab626c70468be92e74cf3d288ffaed23fdb ]
+
+We need to pass IRQF_SHARED, otherwise we get things like:
+
+IRQ handler type mismatch for IRQ 33
+current handler: PSYCHO_UE
+Call Trace:
+ [000000000048394c] request_irq+0xac/0x120
+ [00000000007c5f6c] psycho_scan_bus+0x98/0x158
+ [00000000007c2bc0] pcibios_init+0xdc/0x12c
+ [0000000000426a5c] do_one_initcall+0x1c/0x160
+ [00000000007c0180] kernel_init+0x9c/0xfc
+ [0000000000427050] kernel_thread+0x30/0x60
+ [00000000006ae1d0] rest_init+0x10/0x60
+
+on e3500 and similar systems.
+
+On a single board, the UE interrupts of two Psycho nodes
+are funneled through the same interrupt, from of_debug=3
+dump:
+
+/pci@b,4000: direct translate 2ee --> 21
+ ...
+/pci@b,2000: direct translate 2ee --> 21
+
+Decimal "33" mentioned above is the hex "21" mentioned here.
+
+Thanks to Meelis Roos for dumps and testing.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc64/kernel/pci_psycho.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/sparc64/kernel/pci_psycho.c
++++ b/arch/sparc64/kernel/pci_psycho.c
+@@ -744,16 +744,16 @@ static void psycho_register_error_handle
+ * the second will just error out since we do not pass in
+ * IRQF_SHARED.
+ */
+- err = request_irq(op->irqs[1], psycho_ue_intr, 0,
++ err = request_irq(op->irqs[1], psycho_ue_intr, IRQF_SHARED,
+ "PSYCHO_UE", pbm);
+- err = request_irq(op->irqs[2], psycho_ce_intr, 0,
++ err = request_irq(op->irqs[2], psycho_ce_intr, IRQF_SHARED,
+ "PSYCHO_CE", pbm);
+
+ /* This one, however, ought not to fail. We can just warn
+ * about it since the system can still operate properly even
+ * if this fails.
+ */
+- err = request_irq(op->irqs[0], psycho_pcierr_intr, 0,
++ err = request_irq(op->irqs[0], psycho_pcierr_intr, IRQF_SHARED,
+ "PSYCHO_PCIERR", pbm);
+ if (err)
+ printk(KERN_WARNING "%s: Could not register PCIERR, "
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:37 2008
+Message-Id: <20081007002737.829720233@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:27:07 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 61/71] sparc64: Fix interrupt register calculations on Psycho and Sabre.
+Content-Disposition: inline; filename=0002-sparc64-Fix-interrupt-register-calculations-on-Psyc.patch
+Content-Length: 5124
+Lines: 164
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit ebfb2c63405f2410897674f14e41c031c9302909 ]
+
+Use the IMAP offset calculation for OBIO devices as documented in the
+programmer's manual. Which is "0x10000 + ((ino & 0x1f) << 3)"
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc64/kernel/prom.c | 104 ++-------------------------------------------
+ 1 file changed, 6 insertions(+), 98 deletions(-)
+
+--- a/arch/sparc64/kernel/prom.c
++++ b/arch/sparc64/kernel/prom.c
+@@ -156,55 +156,11 @@ static unsigned long psycho_pcislot_imap
+ return PSYCHO_IMAP_B_SLOT0 + (slot * 8);
+ }
+
+-#define PSYCHO_IMAP_SCSI 0x1000UL
+-#define PSYCHO_IMAP_ETH 0x1008UL
+-#define PSYCHO_IMAP_BPP 0x1010UL
+-#define PSYCHO_IMAP_AU_REC 0x1018UL
+-#define PSYCHO_IMAP_AU_PLAY 0x1020UL
+-#define PSYCHO_IMAP_PFAIL 0x1028UL
+-#define PSYCHO_IMAP_KMS 0x1030UL
+-#define PSYCHO_IMAP_FLPY 0x1038UL
+-#define PSYCHO_IMAP_SHW 0x1040UL
+-#define PSYCHO_IMAP_KBD 0x1048UL
+-#define PSYCHO_IMAP_MS 0x1050UL
+-#define PSYCHO_IMAP_SER 0x1058UL
+-#define PSYCHO_IMAP_TIM0 0x1060UL
+-#define PSYCHO_IMAP_TIM1 0x1068UL
+-#define PSYCHO_IMAP_UE 0x1070UL
+-#define PSYCHO_IMAP_CE 0x1078UL
+-#define PSYCHO_IMAP_A_ERR 0x1080UL
+-#define PSYCHO_IMAP_B_ERR 0x1088UL
+-#define PSYCHO_IMAP_PMGMT 0x1090UL
+-#define PSYCHO_IMAP_GFX 0x1098UL
+-#define PSYCHO_IMAP_EUPA 0x10a0UL
+-
+-static unsigned long __psycho_onboard_imap_off[] = {
+-/*0x20*/ PSYCHO_IMAP_SCSI,
+-/*0x21*/ PSYCHO_IMAP_ETH,
+-/*0x22*/ PSYCHO_IMAP_BPP,
+-/*0x23*/ PSYCHO_IMAP_AU_REC,
+-/*0x24*/ PSYCHO_IMAP_AU_PLAY,
+-/*0x25*/ PSYCHO_IMAP_PFAIL,
+-/*0x26*/ PSYCHO_IMAP_KMS,
+-/*0x27*/ PSYCHO_IMAP_FLPY,
+-/*0x28*/ PSYCHO_IMAP_SHW,
+-/*0x29*/ PSYCHO_IMAP_KBD,
+-/*0x2a*/ PSYCHO_IMAP_MS,
+-/*0x2b*/ PSYCHO_IMAP_SER,
+-/*0x2c*/ PSYCHO_IMAP_TIM0,
+-/*0x2d*/ PSYCHO_IMAP_TIM1,
+-/*0x2e*/ PSYCHO_IMAP_UE,
+-/*0x2f*/ PSYCHO_IMAP_CE,
+-/*0x30*/ PSYCHO_IMAP_A_ERR,
+-/*0x31*/ PSYCHO_IMAP_B_ERR,
+-/*0x32*/ PSYCHO_IMAP_PMGMT,
+-/*0x33*/ PSYCHO_IMAP_GFX,
+-/*0x34*/ PSYCHO_IMAP_EUPA,
+-};
++#define PSYCHO_OBIO_IMAP_BASE 0x1000UL
++
+ #define PSYCHO_ONBOARD_IRQ_BASE 0x20
+-#define PSYCHO_ONBOARD_IRQ_LAST 0x34
+ #define psycho_onboard_imap_offset(__ino) \
+- __psycho_onboard_imap_off[(__ino) - PSYCHO_ONBOARD_IRQ_BASE]
++ (PSYCHO_OBIO_IMAP_BASE + (((__ino) & 0x1f) << 3))
+
+ #define PSYCHO_ICLR_A_SLOT0 0x1400UL
+ #define PSYCHO_ICLR_SCSI 0x1800UL
+@@ -228,10 +184,6 @@ static unsigned int psycho_irq_build(str
+ imap_off = psycho_pcislot_imap_offset(ino);
+ } else {
+ /* Onboard device */
+- if (ino > PSYCHO_ONBOARD_IRQ_LAST) {
+- prom_printf("psycho_irq_build: Wacky INO [%x]\n", ino);
+- prom_halt();
+- }
+ imap_off = psycho_onboard_imap_offset(ino);
+ }
+
+@@ -318,23 +270,6 @@ static void sabre_wsync_handler(unsigned
+
+ #define SABRE_IMAP_A_SLOT0 0x0c00UL
+ #define SABRE_IMAP_B_SLOT0 0x0c20UL
+-#define SABRE_IMAP_SCSI 0x1000UL
+-#define SABRE_IMAP_ETH 0x1008UL
+-#define SABRE_IMAP_BPP 0x1010UL
+-#define SABRE_IMAP_AU_REC 0x1018UL
+-#define SABRE_IMAP_AU_PLAY 0x1020UL
+-#define SABRE_IMAP_PFAIL 0x1028UL
+-#define SABRE_IMAP_KMS 0x1030UL
+-#define SABRE_IMAP_FLPY 0x1038UL
+-#define SABRE_IMAP_SHW 0x1040UL
+-#define SABRE_IMAP_KBD 0x1048UL
+-#define SABRE_IMAP_MS 0x1050UL
+-#define SABRE_IMAP_SER 0x1058UL
+-#define SABRE_IMAP_UE 0x1070UL
+-#define SABRE_IMAP_CE 0x1078UL
+-#define SABRE_IMAP_PCIERR 0x1080UL
+-#define SABRE_IMAP_GFX 0x1098UL
+-#define SABRE_IMAP_EUPA 0x10a0UL
+ #define SABRE_ICLR_A_SLOT0 0x1400UL
+ #define SABRE_ICLR_B_SLOT0 0x1480UL
+ #define SABRE_ICLR_SCSI 0x1800UL
+@@ -364,33 +299,10 @@ static unsigned long sabre_pcislot_imap_
+ return SABRE_IMAP_B_SLOT0 + (slot * 8);
+ }
+
+-static unsigned long __sabre_onboard_imap_off[] = {
+-/*0x20*/ SABRE_IMAP_SCSI,
+-/*0x21*/ SABRE_IMAP_ETH,
+-/*0x22*/ SABRE_IMAP_BPP,
+-/*0x23*/ SABRE_IMAP_AU_REC,
+-/*0x24*/ SABRE_IMAP_AU_PLAY,
+-/*0x25*/ SABRE_IMAP_PFAIL,
+-/*0x26*/ SABRE_IMAP_KMS,
+-/*0x27*/ SABRE_IMAP_FLPY,
+-/*0x28*/ SABRE_IMAP_SHW,
+-/*0x29*/ SABRE_IMAP_KBD,
+-/*0x2a*/ SABRE_IMAP_MS,
+-/*0x2b*/ SABRE_IMAP_SER,
+-/*0x2c*/ 0 /* reserved */,
+-/*0x2d*/ 0 /* reserved */,
+-/*0x2e*/ SABRE_IMAP_UE,
+-/*0x2f*/ SABRE_IMAP_CE,
+-/*0x30*/ SABRE_IMAP_PCIERR,
+-/*0x31*/ 0 /* reserved */,
+-/*0x32*/ 0 /* reserved */,
+-/*0x33*/ SABRE_IMAP_GFX,
+-/*0x34*/ SABRE_IMAP_EUPA,
+-};
+-#define SABRE_ONBOARD_IRQ_BASE 0x20
+-#define SABRE_ONBOARD_IRQ_LAST 0x30
++#define SABRE_OBIO_IMAP_BASE 0x1000UL
++#define SABRE_ONBOARD_IRQ_BASE 0x20
+ #define sabre_onboard_imap_offset(__ino) \
+- __sabre_onboard_imap_off[(__ino) - SABRE_ONBOARD_IRQ_BASE]
++ (SABRE_OBIO_IMAP_BASE + (((__ino) & 0x1f) << 3))
+
+ #define sabre_iclr_offset(ino) \
+ ((ino & 0x20) ? (SABRE_ICLR_SCSI + (((ino) & 0x1f) << 3)) : \
+@@ -453,10 +365,6 @@ static unsigned int sabre_irq_build(stru
+ imap_off = sabre_pcislot_imap_offset(ino);
+ } else {
+ /* onboard device */
+- if (ino > SABRE_ONBOARD_IRQ_LAST) {
+- prom_printf("sabre_irq_build: Wacky INO [%x]\n", ino);
+- prom_halt();
+- }
+ imap_off = sabre_onboard_imap_offset(ino);
+ }
+
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:38 2008
+Message-Id: <20081007002737.983580779@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:27:08 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 62/71] sparc64: Fix OOPS in psycho_pcierr_intr_other().
+Content-Disposition: inline; filename=0003-sparc64-Fix-OOPS-in-psycho_pcierr_intr_other.patch
+Content-Length: 1748
+Lines: 56
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit f948cc6ab9e61a8e88d70ee9aafc690e6d26f92c ]
+
+We no longer put the top-level PCI controller device into the
+PCI layer device list. So pbm->pci_bus->self is always NULL.
+
+Therefore, use direct PCI config space accesses to get at
+the PCI controller's PCI_STATUS register.
+
+Tested by Meelis Roos.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc64/kernel/pci_psycho.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/arch/sparc64/kernel/pci_psycho.c
++++ b/arch/sparc64/kernel/pci_psycho.c
+@@ -575,7 +575,7 @@ static irqreturn_t psycho_pcierr_intr_ot
+ {
+ unsigned long csr_reg, csr, csr_error_bits;
+ irqreturn_t ret = IRQ_NONE;
+- u16 stat;
++ u16 stat, *addr;
+
+ if (is_pbm_a) {
+ csr_reg = pbm->controller_regs + PSYCHO_PCIA_CTRL;
+@@ -597,7 +597,9 @@ static irqreturn_t psycho_pcierr_intr_ot
+ printk("%s: PCI SERR signal asserted.\n", pbm->name);
+ ret = IRQ_HANDLED;
+ }
+- pci_read_config_word(pbm->pci_bus->self, PCI_STATUS, &stat);
++ addr = psycho_pci_config_mkaddr(pbm, pbm->pci_first_busno,
++ 0, PCI_STATUS);
++ pci_config_read16(addr, &stat);
+ if (stat & (PCI_STATUS_PARITY |
+ PCI_STATUS_SIG_TARGET_ABORT |
+ PCI_STATUS_REC_TARGET_ABORT |
+@@ -605,7 +607,7 @@ static irqreturn_t psycho_pcierr_intr_ot
+ PCI_STATUS_SIG_SYSTEM_ERROR)) {
+ printk("%s: PCI bus error, PCI_STATUS[%04x]\n",
+ pbm->name, stat);
+- pci_write_config_word(pbm->pci_bus->self, PCI_STATUS, 0xffff);
++ pci_config_write16(addr, 0xffff);
+ ret = IRQ_HANDLED;
+ }
+ return ret;
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:38 2008
+Message-Id: <20081007002738.156900364@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:27:09 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 63/71] sparc64: Fix disappearing PCI devices on e3500.
+Content-Disposition: inline; filename=0004-sparc64-Fix-disappearing-PCI-devices-on-e3500.patch
+Content-Length: 2266
+Lines: 70
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 7ee766d8fba9dfd93bf3eca7a8d84a25404a68dc ]
+
+Based upon a bug report by Meelis Roos.
+
+The OF device layer builds properties by matching bus types and
+applying 'range' properties as appropriate, up to the root.
+
+The match for "PCI" busses is looking at the 'device_type' property,
+and this does work %99 of the time.
+
+But on an E3500 system with a PCI QFE card, the DEC 21153 bridge
+sitting above the QFE network interface devices has a 'name' of "pci",
+but it completely lacks a 'device_type' property. So we don't match
+it as a PCI bus, and subsequently we end up with no resource values at
+all for the devices sitting under that DEC bridge.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc64/kernel/of_device.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/arch/sparc64/kernel/of_device.c
++++ b/arch/sparc64/kernel/of_device.c
+@@ -170,7 +170,7 @@ static unsigned int of_bus_default_get_f
+
+ static int of_bus_pci_match(struct device_node *np)
+ {
+- if (!strcmp(np->type, "pci") || !strcmp(np->type, "pciex")) {
++ if (!strcmp(np->name, "pci")) {
+ const char *model = of_get_property(np, "model", NULL);
+
+ if (model && !strcmp(model, "SUNW,simba"))
+@@ -201,7 +201,7 @@ static int of_bus_simba_match(struct dev
+ /* Treat PCI busses lacking ranges property just like
+ * simba.
+ */
+- if (!strcmp(np->type, "pci") || !strcmp(np->type, "pciex")) {
++ if (!strcmp(np->name, "pci")) {
+ if (!of_find_property(np, "ranges", NULL))
+ return 1;
+ }
+@@ -426,7 +426,7 @@ static int __init use_1to1_mapping(struc
+ * it lacks a ranges property, and this will include
+ * cases like Simba.
+ */
+- if (!strcmp(pp->type, "pci") || !strcmp(pp->type, "pciex"))
++ if (!strcmp(pp->name, "pci"))
+ return 0;
+
+ return 1;
+@@ -709,8 +709,7 @@ static unsigned int __init build_one_dev
+ break;
+ }
+ } else {
+- if (!strcmp(pp->type, "pci") ||
+- !strcmp(pp->type, "pciex")) {
++ if (!strcmp(pp->name, "pci")) {
+ unsigned int this_orig_irq = irq;
+
+ irq = pci_irq_swizzle(dp, pp, irq);
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:38 2008
+Message-Id: <20081007002738.298669848@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:27:10 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [patch 64/71] sparc64: Fix missing devices due to PCI bridge test in of_create_pci_dev().
+Content-Disposition: inline; filename=0005-sparc64-Fix-missing-devices-due-to-PCI-bridge-test.patch
+Content-Length: 1220
+Lines: 37
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 44b50e5a1af13c605d6c3b17a60e42eb0ee48d5f ]
+
+Just like in the arch/sparc64/kernel/of_device.c code fix commit
+071d7f4c3b411beae08d27656e958070c43b78b4 ("sparc64: Fix disappearing
+PCI devices on e3500.") we have to check the OF device node name for
+"pci" instead of relying upon the 'device_type' property being there
+on all PCI bridges.
+
+Tested by Meelis Roos, and confirmed to make the PCI QFE devices
+reappear on the E3500 system.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc64/kernel/pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/sparc64/kernel/pci.c
++++ b/arch/sparc64/kernel/pci.c
+@@ -425,7 +425,7 @@ struct pci_dev *of_create_pci_dev(struct
+ dev->current_state = 4; /* unknown power state */
+ dev->error_state = pci_channel_io_normal;
+
+- if (!strcmp(type, "pci") || !strcmp(type, "pciex")) {
++ if (!strcmp(node->name, "pci")) {
+ /* a PCI-PCI bridge */
+ dev->hdr_type = PCI_HEADER_TYPE_BRIDGE;
+ dev->rom_base_reg = PCI_ROM_ADDRESS1;
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:38 2008
+Message-Id: <20081007002738.464491272@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:27:11 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Pascal Terjan <pterjan@mandriva.com>,
+ Samuel Thibault <samuel.thibault@ens-lyon.org>,
+ Moritz Muehlenhoff <jmm@inutil.org>
+Subject: [patch 65/71] braille_console: only register notifiers when the braille console is used
+Content-Disposition: inline; filename=braille_console-only-register-notifiers-when-the-braille-console-is-used.patch
+Content-Length: 1689
+Lines: 56
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Pascal Terjan <pterjan@mandriva.com>
+
+commit c0c9209ddd96bc4f1d70a8b9958710671e076080 upstream
+
+Only register the braille driver VT and keyboard notifiers when the
+braille console is used. Avoids eating insert or backspace keys.
+
+Addresses http://bugzilla.kernel.org/show_bug.cgi?id=11242
+
+Signed-off-by: Pascal Terjan <pterjan@mandriva.com>
+Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Cc: <stable@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Moritz Muehlenhoff <jmm@inutil.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/accessibility/braille/braille_console.c | 13 ++++---------
+ 1 file changed, 4 insertions(+), 9 deletions(-)
+
+--- a/drivers/accessibility/braille/braille_console.c
++++ b/drivers/accessibility/braille/braille_console.c
+@@ -376,6 +376,8 @@ int braille_register_console(struct cons
+ console->flags |= CON_ENABLED;
+ console->index = index;
+ braille_co = console;
++ register_keyboard_notifier(&keyboard_notifier_block);
++ register_vt_notifier(&vt_notifier_block);
+ return 0;
+ }
+
+@@ -383,15 +385,8 @@ int braille_unregister_console(struct co
+ {
+ if (braille_co != console)
+ return -EINVAL;
++ unregister_keyboard_notifier(&keyboard_notifier_block);
++ unregister_vt_notifier(&vt_notifier_block);
+ braille_co = NULL;
+ return 0;
+ }
+-
+-static int __init braille_init(void)
+-{
+- register_keyboard_notifier(&keyboard_notifier_block);
+- register_vt_notifier(&vt_notifier_block);
+- return 0;
+-}
+-
+-console_initcall(braille_init);
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:38 2008
+Message-Id: <20081007002738.631459630@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:27:12 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Risto Suominen <Risto.Suominen@gmail.com>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 66/71] ALSA: snd-powermac: mixers for PowerMac G4 AGP
+Content-Disposition: inline; filename=alsa-snd-powermac-mixers-for-powermac-g4-agp.patch
+Content-Length: 3072
+Lines: 94
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Risto Suominen <Risto.Suominen@gmail.com>
+
+commit 4dbf95ba6c344186ec6d38ff514dc675da464bec upstream
+
+Add mixer controls for PowerMac G4 AGP (Screamer).
+
+This patch fixes the regression in the recent snd-powermac which
+doesn't support some G3/G4 PowerMacs:
+ http://lkml.org/lkml/2008/10/1/220
+
+Signed-off-by: Risto Suominen <Risto.Suominen@gmail.com>
+Tested-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/ppc/awacs.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+--- a/sound/ppc/awacs.c
++++ b/sound/ppc/awacs.c
+@@ -621,6 +621,13 @@ static struct snd_kcontrol_new snd_pmac_
+ AWACS_SWITCH("CD Capture Switch", 0, SHIFT_MUX_CD, 0),
+ };
+
++static struct snd_kcontrol_new snd_pmac_screamer_mixers_g4agp[] __initdata = {
++ AWACS_VOLUME("Line out Playback Volume", 2, 6, 1),
++ AWACS_VOLUME("Master Playback Volume", 5, 6, 1),
++ AWACS_SWITCH("CD Capture Switch", 0, SHIFT_MUX_CD, 0),
++ AWACS_SWITCH("Line Capture Switch", 0, SHIFT_MUX_MIC, 0),
++};
++
+ static struct snd_kcontrol_new snd_pmac_awacs_mixers_pmac7500[] __initdata = {
+ AWACS_VOLUME("Line out Playback Volume", 2, 6, 1),
+ AWACS_SWITCH("CD Capture Switch", 0, SHIFT_MUX_CD, 0),
+@@ -768,6 +775,7 @@ static void snd_pmac_awacs_resume(struct
+ #define IS_IMAC (machine_is_compatible("PowerMac2,1") \
+ || machine_is_compatible("PowerMac2,2") \
+ || machine_is_compatible("PowerMac4,1"))
++#define IS_G4AGP (machine_is_compatible("PowerMac3,1"))
+
+ static int imac;
+
+@@ -850,6 +858,7 @@ snd_pmac_awacs_init(struct snd_pmac *chi
+ {
+ int pm7500 = IS_PM7500;
+ int beige = IS_BEIGE;
++ int g4agp = IS_G4AGP;
+ int err, vol;
+
+ imac = IS_IMAC;
+@@ -939,7 +948,7 @@ snd_pmac_awacs_init(struct snd_pmac *chi
+ snd_pmac_awacs_mixers);
+ if (err < 0)
+ return err;
+- if (beige)
++ if (beige || g4agp)
+ ;
+ else if (chip->model == PMAC_SCREAMER)
+ err = build_mixers(chip, ARRAY_SIZE(snd_pmac_screamer_mixers2),
+@@ -961,13 +970,17 @@ snd_pmac_awacs_init(struct snd_pmac *chi
+ err = build_mixers(chip,
+ ARRAY_SIZE(snd_pmac_screamer_mixers_imac),
+ snd_pmac_screamer_mixers_imac);
++ else if (g4agp)
++ err = build_mixers(chip,
++ ARRAY_SIZE(snd_pmac_screamer_mixers_g4agp),
++ snd_pmac_screamer_mixers_g4agp);
+ else
+ err = build_mixers(chip,
+ ARRAY_SIZE(snd_pmac_awacs_mixers_pmac),
+ snd_pmac_awacs_mixers_pmac);
+ if (err < 0)
+ return err;
+- chip->master_sw_ctl = snd_ctl_new1((pm7500 || imac)
++ chip->master_sw_ctl = snd_ctl_new1((pm7500 || imac || g4agp)
+ ? &snd_pmac_awacs_master_sw_imac
+ : &snd_pmac_awacs_master_sw, chip);
+ err = snd_ctl_add(chip->card, chip->master_sw_ctl);
+@@ -1012,7 +1025,7 @@ snd_pmac_awacs_init(struct snd_pmac *chi
+ return err;
+ }
+
+- if (beige)
++ if (beige || g4agp)
+ err = build_mixers(chip,
+ ARRAY_SIZE(snd_pmac_screamer_mic_boost_beige),
+ snd_pmac_screamer_mic_boost_beige);
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:38 2008
+Message-Id: <20081007002738.777521700@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:27:13 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Risto Suominen <Risto.Suominen@gmail.com>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 67/71] ALSA: snd-powermac: HP detection for 1st iMac G3 SL
+Content-Disposition: inline; filename=alsa-snd-powermac-hp-detection-for-1st-imac-g3-sl.patch
+Content-Length: 3284
+Lines: 103
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Risto Suominen <Risto.Suominen@gmail.com>
+
+commit 030b655b062fe5190fc490e0091ea50307d7a86f upstream
+
+Correct headphone detection for 1st generation iMac G3 Slot-loading (Screamer).
+
+This patch fixes the regression in the recent snd-powermac which
+doesn't support some G3/G4 PowerMacs:
+ http://lkml.org/lkml/2008/10/1/220
+
+Signed-off-by: Risto Suominen <Risto.Suominen@gmail.com>
+Tested-by: Mariusz Kozlowski <m.kozlowski@tuxland.pl>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/ppc/awacs.c | 31 ++++++++++++++++++++++---------
+ 1 file changed, 22 insertions(+), 9 deletions(-)
+
+--- a/sound/ppc/awacs.c
++++ b/sound/ppc/awacs.c
+@@ -695,7 +695,10 @@ static struct snd_kcontrol_new snd_pmac_
+ static struct snd_kcontrol_new snd_pmac_awacs_speaker_sw __initdata =
+ AWACS_SWITCH("PC Speaker Playback Switch", 1, SHIFT_SPKMUTE, 1);
+
+-static struct snd_kcontrol_new snd_pmac_awacs_speaker_sw_imac __initdata =
++static struct snd_kcontrol_new snd_pmac_awacs_speaker_sw_imac1 __initdata =
++AWACS_SWITCH("PC Speaker Playback Switch", 1, SHIFT_PAROUT1, 1);
++
++static struct snd_kcontrol_new snd_pmac_awacs_speaker_sw_imac2 __initdata =
+ AWACS_SWITCH("PC Speaker Playback Switch", 1, SHIFT_PAROUT1, 0);
+
+
+@@ -772,12 +775,12 @@ static void snd_pmac_awacs_resume(struct
+
+ #define IS_PM7500 (machine_is_compatible("AAPL,7500"))
+ #define IS_BEIGE (machine_is_compatible("AAPL,Gossamer"))
+-#define IS_IMAC (machine_is_compatible("PowerMac2,1") \
+- || machine_is_compatible("PowerMac2,2") \
++#define IS_IMAC1 (machine_is_compatible("PowerMac2,1"))
++#define IS_IMAC2 (machine_is_compatible("PowerMac2,2") \
+ || machine_is_compatible("PowerMac4,1"))
+ #define IS_G4AGP (machine_is_compatible("PowerMac3,1"))
+
+-static int imac;
++static int imac1, imac2;
+
+ #ifdef PMAC_SUPPORT_AUTOMUTE
+ /*
+@@ -823,13 +826,18 @@ static void snd_pmac_awacs_update_automu
+ {
+ int reg = chip->awacs_reg[1]
+ | (MASK_HDMUTE | MASK_SPKMUTE);
+- if (imac) {
++ if (imac1) {
++ reg &= ~MASK_SPKMUTE;
++ reg |= MASK_PAROUT1;
++ } else if (imac2) {
+ reg &= ~MASK_SPKMUTE;
+ reg &= ~MASK_PAROUT1;
+ }
+ if (snd_pmac_awacs_detect_headphone(chip))
+ reg &= ~MASK_HDMUTE;
+- else if (imac)
++ else if (imac1)
++ reg &= ~MASK_PAROUT1;
++ else if (imac2)
+ reg |= MASK_PAROUT1;
+ else
+ reg &= ~MASK_SPKMUTE;
+@@ -859,9 +867,12 @@ snd_pmac_awacs_init(struct snd_pmac *chi
+ int pm7500 = IS_PM7500;
+ int beige = IS_BEIGE;
+ int g4agp = IS_G4AGP;
++ int imac;
+ int err, vol;
+
+- imac = IS_IMAC;
++ imac1 = IS_IMAC1;
++ imac2 = IS_IMAC2;
++ imac = imac1 || imac2;
+ /* looks like MASK_GAINLINE triggers something, so we set here
+ * as start-up
+ */
+@@ -1017,8 +1028,10 @@ snd_pmac_awacs_init(struct snd_pmac *chi
+ snd_pmac_awacs_speaker_vol);
+ if (err < 0)
+ return err;
+- chip->speaker_sw_ctl = snd_ctl_new1(imac
+- ? &snd_pmac_awacs_speaker_sw_imac
++ chip->speaker_sw_ctl = snd_ctl_new1(imac1
++ ? &snd_pmac_awacs_speaker_sw_imac1
++ : imac2
++ ? &snd_pmac_awacs_speaker_sw_imac2
+ : &snd_pmac_awacs_speaker_sw, chip);
+ err = snd_ctl_add(chip->card, chip->speaker_sw_ctl);
+ if (err < 0)
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:39 2008
+Message-Id: <20081007002738.930585217@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:27:14 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Harvey Harrison <harvey.harrison@gmail.com>,
+ "Antonino A. Daplas" <adaplas@pol.net>,
+ Krzysztof Helt <krzysztof.h1@poczta.fm>
+Subject: [patch 68/71] fbcon: fix monochrome color value calculation
+Content-Disposition: inline; filename=fbcon-fix-monochrome-color-value-calculation.patch
+Content-Length: 1363
+Lines: 38
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: David Winn <q-newsgroup@qypea.com>
+
+commit 08650869e0ec581f8d88cfdb563d37f5383abfe2 upstream
+
+Commit 22af89aa0c0b4012a7431114a340efd3665a7617 ("fbcon: replace mono_col
+macro with static inline") changed the order of operations for computing
+monochrome color values. This generates 0xffff000f instead of 0x0000000f
+for a 4 bit monochrome color, leading to image corruption if it is passed
+to cfb_imageblit or other similar functions. Fix it up.
+
+Cc: Harvey Harrison <harvey.harrison@gmail.com>
+Cc: "Antonino A. Daplas" <adaplas@pol.net>
+Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/console/fbcon.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/video/console/fbcon.h
++++ b/drivers/video/console/fbcon.h
+@@ -110,7 +110,7 @@ static inline int mono_col(const struct
+ __u32 max_len;
+ max_len = max(info->var.green.length, info->var.red.length);
+ max_len = max(info->var.blue.length, max_len);
+- return ~(0xfff << (max_len & 0xff));
++ return (~(0xfff << max_len)) & 0xff;
+ }
+
+ static inline int attr_col_ec(int shift, struct vc_data *vc,
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:39 2008
+Message-Id: <20081007002739.099900032@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:27:15 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Marcin Slusarz <marcin.slusarz@gmail.com>,
+ Alessandro Zummo <alessandro.zummo@towertech.it>,
+ David Brownell <dbrownell@users.sourceforge.net>
+Subject: [patch 69/71] rtc: fix kernel panic on second use of SIGIO nofitication
+Content-Disposition: inline; filename=rtc-fix-kernel-panic-on-second-use-of-sigio-nofitication.patch
+Content-Length: 5211
+Lines: 117
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Marcin Slusarz <marcin.slusarz@gmail.com>
+
+commit 2e4a75cdcb89ff53bb182dda3a6dcdc14befe007 upstream
+
+When userspace uses SIGIO notification and forgets to disable it before
+closing file descriptor, rtc->async_queue contains stale pointer to struct
+file. When user space enables again SIGIO notification in different
+process, kernel dereferences this (poisoned) pointer and crashes.
+
+So disable SIGIO notification on close.
+
+Kernel panic:
+(second run of qemu (requires echo 1024 > /sys/class/rtc/rtc0/max_user_freq))
+
+general protection fault: 0000 [1] PREEMPT
+CPU 0
+Modules linked in: af_packet snd_pcm_oss snd_mixer_oss snd_seq_oss snd_seq_midi_event snd_seq usbhid tuner tea5767 tda8290 tuner_xc2028 xc5000 tda9887 tuner_simple tuner_types mt20xx tea5761 tda9875 uhci_hcd ehci_hcd usbcore bttv snd_via82xx snd_ac97_codec ac97_bus snd_pcm snd_timer ir_common compat_ioctl32 snd_page_alloc videodev v4l1_compat snd_mpu401_uart snd_rawmidi v4l2_common videobuf_dma_sg videobuf_core snd_seq_device snd btcx_risc soundcore tveeprom i2c_viapro
+Pid: 5781, comm: qemu-system-x86 Not tainted 2.6.27-rc6 #363
+RIP: 0010:[<ffffffff8024f891>] [<ffffffff8024f891>] __lock_acquire+0x3db/0x73f
+RSP: 0000:ffffffff80674cb8 EFLAGS: 00010002
+RAX: ffff8800224c62f0 RBX: 0000000000000046 RCX: 0000000000000002
+RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8800224c62f0
+RBP: ffffffff80674d08 R08: 0000000000000002 R09: 0000000000000001
+R10: ffffffff80238941 R11: 0000000000000001 R12: 0000000000000000
+R13: 6b6b6b6b6b6b6b6b R14: ffff88003a450080 R15: 0000000000000000
+FS: 00007f98b69516f0(0000) GS:ffffffff80623200(0000) knlGS:00000000f7cc86d0
+CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+CR2: 0000000000a87000 CR3: 0000000022598000 CR4: 00000000000006e0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+Process qemu-system-x86 (pid: 5781, threadinfo ffff880028812000, task ffff88003a450080)
+Stack: ffffffff80674cf8 0000000180238440 0000000200000002 0000000000000000
+ ffff8800224c62f0 0000000000000046 0000000000000000 0000000000000002
+ 0000000000000002 0000000000000000 ffffffff80674d68 ffffffff8024fc7a
+Call Trace:
+ <IRQ> [<ffffffff8024fc7a>] lock_acquire+0x85/0xa9
+ [<ffffffff8029cb62>] ? send_sigio+0x2a/0x184
+ [<ffffffff80491d1f>] _read_lock+0x3e/0x4a
+ [<ffffffff8029cb62>] ? send_sigio+0x2a/0x184
+ [<ffffffff8029cb62>] send_sigio+0x2a/0x184
+ [<ffffffff8024fb97>] ? __lock_acquire+0x6e1/0x73f
+ [<ffffffff8029cd4d>] ? kill_fasync+0x2c/0x4e
+ [<ffffffff8029cd10>] __kill_fasync+0x54/0x65
+ [<ffffffff8029cd5b>] kill_fasync+0x3a/0x4e
+ [<ffffffff80402896>] rtc_update_irq+0x9c/0xa5
+ [<ffffffff80404640>] cmos_interrupt+0xae/0xc0
+ [<ffffffff8025d1c1>] handle_IRQ_event+0x25/0x5a
+ [<ffffffff8025e5e4>] handle_edge_irq+0xdd/0x123
+ [<ffffffff8020da34>] do_IRQ+0xe4/0x144
+ [<ffffffff8020bad6>] ret_from_intr+0x0/0xf
+ <EOI> [<ffffffff8026fdc2>] ? __alloc_pages_internal+0xe7/0x3ad
+ [<ffffffff8033fe67>] ? clear_page_c+0x7/0x10
+ [<ffffffff8026fc10>] ? get_page_from_freelist+0x385/0x450
+ [<ffffffff8026fdc2>] ? __alloc_pages_internal+0xe7/0x3ad
+ [<ffffffff80280aac>] ? anon_vma_prepare+0x2e/0xf6
+ [<ffffffff80279400>] ? handle_mm_fault+0x227/0x6a5
+ [<ffffffff80494716>] ? do_page_fault+0x494/0x83f
+ [<ffffffff8049251d>] ? error_exit+0x0/0xa9
+
+Code: cc 41 39 45 28 74 24 e8 5e 1d 0f 00 85 c0 0f 84 6a 03 00 00 83 3d 8f a9 aa 00 00 be 47 03 00 00 0f 84 6a 02 00 00 e9 53 03 00 00 <41> ff 85 38 01 00 00 45 8b be 90 06 00 00 41 83 ff 2f 76 24 e8
+RIP [<ffffffff8024f891>] __lock_acquire+0x3db/0x73f
+ RSP <ffffffff80674cb8>
+---[ end trace 431877d860448760 ]---
+Kernel panic - not syncing: Aiee, killing interrupt handler!
+
+Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
+Acked-by: Alessandro Zummo <alessandro.zummo@towertech.it>
+Acked-by: David Brownell <dbrownell@users.sourceforge.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/rtc/rtc-dev.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/drivers/rtc/rtc-dev.c
++++ b/drivers/rtc/rtc-dev.c
+@@ -401,6 +401,12 @@ static int rtc_dev_ioctl(struct inode *i
+ return err;
+ }
+
++static int rtc_dev_fasync(int fd, struct file *file, int on)
++{
++ struct rtc_device *rtc = file->private_data;
++ return fasync_helper(fd, file, on, &rtc->async_queue);
++}
++
+ static int rtc_dev_release(struct inode *inode, struct file *file)
+ {
+ struct rtc_device *rtc = file->private_data;
+@@ -411,16 +417,13 @@ static int rtc_dev_release(struct inode
+ if (rtc->ops->release)
+ rtc->ops->release(rtc->dev.parent);
+
++ if (file->f_flags & FASYNC)
++ rtc_dev_fasync(-1, file, 0);
++
+ clear_bit_unlock(RTC_DEV_BUSY, &rtc->flags);
+ return 0;
+ }
+
+-static int rtc_dev_fasync(int fd, struct file *file, int on)
+-{
+- struct rtc_device *rtc = file->private_data;
+- return fasync_helper(fd, file, on, &rtc->async_queue);
+-}
+-
+ static const struct file_operations rtc_dev_fops = {
+ .owner = THIS_MODULE,
+ .llseek = no_llseek,
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:39 2008
+Message-Id: <20081007002739.273182321@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:27:16 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jiri Slaby <jirislaby@gmail.com>,
+ Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>,
+ Paul Menage <menage@google.com>,
+ KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>,
+ Balbir Singh <balbir@linux.vnet.ibm.com>,
+ Hugh Dickins <hugh@veritas.com>
+Subject: [patch 70/71] mm owner: fix race between swapoff and exit
+Content-Disposition: inline; filename=mm-owner-fix-race-between-swapoff-and-exit.patch
+Content-Length: 5407
+Lines: 161
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Balbir Singh <balbir@linux.vnet.ibm.com>
+
+[Here's a backport of 2.6.27-rc8's 31a78f23bac0069004e69f98808b6988baccb6b6
+ to 2.6.26 or 2.6.26.5: I wouldn't trouble -stable for the (root only)
+ swapoff case which uncovered the bug, but the /proc/<pid>/<mmstats> case
+ is open to all, so I think worth plugging in the next 2.6.26-stable.
+ - Hugh]
+
+
+There's a race between mm->owner assignment and swapoff, more easily
+seen when task slab poisoning is turned on. The condition occurs when
+try_to_unuse() runs in parallel with an exiting task. A similar race
+can occur with callers of get_task_mm(), such as /proc/<pid>/<mmstats>
+or ptrace or page migration.
+
+CPU0 CPU1
+ try_to_unuse
+ looks at mm = task0->mm
+ increments mm->mm_users
+task 0 exits
+mm->owner needs to be updated, but no
+new owner is found (mm_users > 1, but
+no other task has task->mm = task0->mm)
+mm_update_next_owner() leaves
+ mmput(mm) decrements mm->mm_users
+task0 freed
+ dereferencing mm->owner fails
+
+The fix is to notify the subsystem via mm_owner_changed callback(),
+if no new owner is found, by specifying the new task as NULL.
+
+Jiri Slaby:
+mm->owner was set to NULL prior to calling cgroup_mm_owner_callbacks(), but
+must be set after that, so as not to pass NULL as old owner causing oops.
+
+Daisuke Nishimura:
+mm_update_next_owner() may set mm->owner to NULL, but mem_cgroup_from_task()
+and its callers need to take account of this situation to avoid oops.
+
+Hugh Dickins:
+Lockdep warning and hang below exec_mmap() when testing these patches.
+exit_mm() up_reads mmap_sem before calling mm_update_next_owner(),
+so exec_mmap() now needs to do the same. And with that repositioning,
+there's now no point in mm_need_new_owner() allowing for NULL mm.
+
+Reported-by: Hugh Dickins <hugh@veritas.com>
+Signed-off-by: Balbir Singh <balbir@linux.vnet.ibm.com>
+Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
+Signed-off-by: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
+Signed-off-by: Hugh Dickins <hugh@veritas.com>
+Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Cc: Paul Menage <menage@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/exec.c | 2 +-
+ kernel/cgroup.c | 5 +++--
+ kernel/exit.c | 12 ++++++++++--
+ mm/memcontrol.c | 13 +++++++++++++
+ 4 files changed, 27 insertions(+), 5 deletions(-)
+
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -740,11 +740,11 @@ static int exec_mmap(struct mm_struct *m
+ tsk->active_mm = mm;
+ activate_mm(active_mm, mm);
+ task_unlock(tsk);
+- mm_update_next_owner(old_mm);
+ arch_pick_mmap_layout(mm);
+ if (old_mm) {
+ up_read(&old_mm->mmap_sem);
+ BUG_ON(active_mm != old_mm);
++ mm_update_next_owner(old_mm);
+ mmput(old_mm);
+ return 0;
+ }
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -2761,14 +2761,15 @@ void cgroup_fork_callbacks(struct task_s
+ */
+ void cgroup_mm_owner_callbacks(struct task_struct *old, struct task_struct *new)
+ {
+- struct cgroup *oldcgrp, *newcgrp;
++ struct cgroup *oldcgrp, *newcgrp = NULL;
+
+ if (need_mm_owner_callback) {
+ int i;
+ for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
+ struct cgroup_subsys *ss = subsys[i];
+ oldcgrp = task_cgroup(old, ss->subsys_id);
+- newcgrp = task_cgroup(new, ss->subsys_id);
++ if (new)
++ newcgrp = task_cgroup(new, ss->subsys_id);
+ if (oldcgrp == newcgrp)
+ continue;
+ if (ss->mm_owner_changed)
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -577,8 +577,6 @@ mm_need_new_owner(struct mm_struct *mm,
+ * If there are other users of the mm and the owner (us) is exiting
+ * we need to find a new owner to take on the responsibility.
+ */
+- if (!mm)
+- return 0;
+ if (atomic_read(&mm->mm_users) <= 1)
+ return 0;
+ if (mm->owner != p)
+@@ -621,6 +619,16 @@ retry:
+ } while_each_thread(g, c);
+
+ read_unlock(&tasklist_lock);
++ /*
++ * We found no owner yet mm_users > 1: this implies that we are
++ * most likely racing with swapoff (try_to_unuse()) or /proc or
++ * ptrace or page migration (get_task_mm()). Mark owner as NULL,
++ * so that subsystems can understand the callback and take action.
++ */
++ down_write(&mm->mmap_sem);
++ cgroup_mm_owner_callbacks(mm->owner, NULL);
++ mm->owner = NULL;
++ up_write(&mm->mmap_sem);
+ return;
+
+ assign_new_owner:
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -250,6 +250,14 @@ static struct mem_cgroup *mem_cgroup_fro
+
+ struct mem_cgroup *mem_cgroup_from_task(struct task_struct *p)
+ {
++ /*
++ * mm_update_next_owner() may clear mm->owner to NULL
++ * if it races with swapoff, page migration, etc.
++ * So this can be called with p == NULL.
++ */
++ if (unlikely(!p))
++ return NULL;
++
+ return container_of(task_subsys_state(p, mem_cgroup_subsys_id),
+ struct mem_cgroup, css);
+ }
+@@ -574,6 +582,11 @@ retry:
+
+ rcu_read_lock();
+ mem = mem_cgroup_from_task(rcu_dereference(mm->owner));
++ if (unlikely(!mem)) {
++ rcu_read_unlock();
++ kmem_cache_free(page_cgroup_cache, pc);
++ return 0;
++ }
+ /*
+ * For every charge from the cgroup, increment reference count
+ */
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:39 2008
+Message-Id: <20081007002739.434497027@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:27:17 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jarod Wilson <jarod@redhat.com>,
+ Martin Schwidefsky <schwidefsky@de.ibm.com>,
+ Moritz Muehlenhoff <jmm@debian.org>
+Subject: [patch 71/71] S390: CVE-2008-1514: prevent ptrace padding area read/write in 31-bit mode
+Content-Disposition: inline; filename=s390-cve-2008-1514-prevent-ptrace-padding-area-read-write-in-31-bit-mode.patch
+Content-Length: 3570
+Lines: 114
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Jarod Wilson <jwilson@redhat.com>
+
+commit 3d6e48f43340343d97839eadb1ab7b6a3ea98797 upstream
+
+When running a 31-bit ptrace, on either an s390 or s390x kernel,
+reads and writes into a padding area in struct user_regs_struct32
+will result in a kernel panic.
+
+This is also known as CVE-2008-1514.
+
+Test case available here:
+http://sources.redhat.com/cgi-bin/cvsweb.cgi/~checkout~/tests/ptrace-tests/tests/user-area-padding.c?cvsroot=systemtap
+
+Steps to reproduce:
+1) wget the above
+2) gcc -o user-area-padding-31bit user-area-padding.c -Wall -ggdb2 -D_GNU_SOURCE -m31
+3) ./user-area-padding-31bit
+<panic>
+
+Test status
+-----------
+Without patch, both s390 and s390x kernels panic. With patch, the test case,
+as well as the gdb testsuite, pass without incident, padding area reads
+returning zero, writes ignored.
+
+Nb: original version returned -EINVAL on write attempts, which broke the
+gdb test and made the test case slightly unhappy, Jan Kratochvil suggested
+the change to return 0 on write attempts.
+
+Signed-off-by: Jarod Wilson <jarod@redhat.com>
+Tested-by: Jan Kratochvil <jan.kratochvil@redhat.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Cc: Moritz Muehlenhoff <jmm@debian.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/s390/kernel/compat_ptrace.h | 1 +
+ arch/s390/kernel/ptrace.c | 28 ++++++++++++++++++++++++++++
+ 2 files changed, 29 insertions(+)
+
+--- a/arch/s390/kernel/compat_ptrace.h
++++ b/arch/s390/kernel/compat_ptrace.h
+@@ -42,6 +42,7 @@ struct user_regs_struct32
+ u32 gprs[NUM_GPRS];
+ u32 acrs[NUM_ACRS];
+ u32 orig_gpr2;
++ /* nb: there's a 4-byte hole here */
+ s390_fp_regs fp_regs;
+ /*
+ * These per registers are in here so that gdb can modify them
+--- a/arch/s390/kernel/ptrace.c
++++ b/arch/s390/kernel/ptrace.c
+@@ -177,6 +177,13 @@ peek_user(struct task_struct *child, add
+ */
+ tmp = (addr_t) task_pt_regs(child)->orig_gpr2;
+
++ } else if (addr < (addr_t) &dummy->regs.fp_regs) {
++ /*
++ * prevent reads of padding hole between
++ * orig_gpr2 and fp_regs on s390.
++ */
++ tmp = 0;
++
+ } else if (addr < (addr_t) (&dummy->regs.fp_regs + 1)) {
+ /*
+ * floating point regs. are stored in the thread structure
+@@ -268,6 +275,13 @@ poke_user(struct task_struct *child, add
+ */
+ task_pt_regs(child)->orig_gpr2 = data;
+
++ } else if (addr < (addr_t) &dummy->regs.fp_regs) {
++ /*
++ * prevent writes of padding hole between
++ * orig_gpr2 and fp_regs on s390.
++ */
++ return 0;
++
+ } else if (addr < (addr_t) (&dummy->regs.fp_regs + 1)) {
+ /*
+ * floating point regs. are stored in the thread structure
+@@ -409,6 +423,13 @@ peek_user_emu31(struct task_struct *chil
+ */
+ tmp = *(__u32*)((addr_t) &task_pt_regs(child)->orig_gpr2 + 4);
+
++ } else if (addr < (addr_t) &dummy32->regs.fp_regs) {
++ /*
++ * prevent reads of padding hole between
++ * orig_gpr2 and fp_regs on s390.
++ */
++ tmp = 0;
++
+ } else if (addr < (addr_t) (&dummy32->regs.fp_regs + 1)) {
+ /*
+ * floating point regs. are stored in the thread structure
+@@ -488,6 +509,13 @@ poke_user_emu31(struct task_struct *chil
+ */
+ *(__u32*)((addr_t) &task_pt_regs(child)->orig_gpr2 + 4) = tmp;
+
++ } else if (addr < (addr_t) &dummy32->regs.fp_regs) {
++ /*
++ * prevent writess of padding hole between
++ * orig_gpr2 and fp_regs on s390.
++ */
++ return 0;
++
+ } else if (addr < (addr_t) (&dummy32->regs.fp_regs + 1)) {
+ /*
+ * floating point regs. are stored in the thread structure
+
+--
+
+From gregkh@mini.kroah.org Mon Oct 6 17:27:31 2008
+Message-Id: <20081007002731.726140797@mini.kroah.org>
+References: <20081007002606.723632097@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Mon, 06 Oct 2008 17:26:34 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ivo van Doorn <IvDoorn@gmail.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 28/71] rt2x00: Use ieee80211_hw->workqueue again
+Content-Disposition: inline; filename=rt2x00-use-ieee80211_hw-workqueue-again.patch
+Content-Length: 3890
+Lines: 116
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Ivo van Doorn <ivdoorn@gmail.com>
+
+commit 8e260c22238dd8b57aefb1f5e4bd114486a9c17d upstream
+
+Remove the rt2x00 singlethreaded workqueue and move
+the link tuner and packet filter scheduled work to
+the ieee80211_hw->workqueue again.
+The only exception is the interface scheduled work
+handler which uses the mac80211 interface iterator
+under the RTNL lock. This work needs to be handled
+on the kernel workqueue to prevent lockdep issues.
+
+Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/rt2x00/rt2x00.h | 4 +++-
+ drivers/net/wireless/rt2x00/rt2x00dev.c | 17 +++--------------
+ drivers/net/wireless/rt2x00/rt2x00mac.c | 4 ++--
+ 3 files changed, 8 insertions(+), 17 deletions(-)
+
+--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
++++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
+@@ -75,7 +75,7 @@ static void rt2x00lib_start_link_tuner(s
+
+ rt2x00lib_reset_link_tuner(rt2x00dev);
+
+- queue_delayed_work(rt2x00dev->workqueue,
++ queue_delayed_work(rt2x00dev->hw->workqueue,
+ &rt2x00dev->link.work, LINK_TUNE_INTERVAL);
+ }
+
+@@ -390,7 +390,7 @@ static void rt2x00lib_link_tuner(struct
+ * Increase tuner counter, and reschedule the next link tuner run.
+ */
+ rt2x00dev->link.count++;
+- queue_delayed_work(rt2x00dev->workqueue,
++ queue_delayed_work(rt2x00dev->hw->workqueue,
+ &rt2x00dev->link.work, LINK_TUNE_INTERVAL);
+ }
+
+@@ -488,7 +488,7 @@ void rt2x00lib_beacondone(struct rt2x00_
+ rt2x00lib_beacondone_iter,
+ rt2x00dev);
+
+- queue_work(rt2x00dev->workqueue, &rt2x00dev->intf_work);
++ schedule_work(&rt2x00dev->intf_work);
+ }
+ EXPORT_SYMBOL_GPL(rt2x00lib_beacondone);
+
+@@ -1131,10 +1131,6 @@ int rt2x00lib_probe_dev(struct rt2x00_de
+ /*
+ * Initialize configuration work.
+ */
+- rt2x00dev->workqueue = create_singlethread_workqueue("rt2x00lib");
+- if (!rt2x00dev->workqueue)
+- goto exit;
+-
+ INIT_WORK(&rt2x00dev->intf_work, rt2x00lib_intf_scheduled);
+ INIT_WORK(&rt2x00dev->filter_work, rt2x00lib_packetfilter_scheduled);
+ INIT_DELAYED_WORK(&rt2x00dev->link.work, rt2x00lib_link_tuner);
+@@ -1195,13 +1191,6 @@ void rt2x00lib_remove_dev(struct rt2x00_
+ rt2x00leds_unregister(rt2x00dev);
+
+ /*
+- * Stop all queued work. Note that most tasks will already be halted
+- * during rt2x00lib_disable_radio() and rt2x00lib_uninitialize().
+- */
+- flush_workqueue(rt2x00dev->workqueue);
+- destroy_workqueue(rt2x00dev->workqueue);
+-
+- /*
+ * Free ieee80211_hw memory.
+ */
+ rt2x00lib_remove_hw(rt2x00dev);
+--- a/drivers/net/wireless/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/rt2x00/rt2x00.h
+@@ -820,8 +820,10 @@ struct rt2x00_dev {
+
+ /*
+ * Scheduled work.
++ * NOTE: intf_work will use ieee80211_iterate_active_interfaces()
++ * which means it cannot be placed on the hw->workqueue
++ * due to RTNL locking requirements.
+ */
+- struct workqueue_struct *workqueue;
+ struct work_struct intf_work;
+ struct work_struct filter_work;
+
+--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
++++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
+@@ -428,7 +428,7 @@ void rt2x00mac_configure_filter(struct i
+ if (!test_bit(DRIVER_REQUIRE_SCHEDULED, &rt2x00dev->flags))
+ rt2x00dev->ops->lib->config_filter(rt2x00dev, *total_flags);
+ else
+- queue_work(rt2x00dev->workqueue, &rt2x00dev->filter_work);
++ queue_work(rt2x00dev->hw->workqueue, &rt2x00dev->filter_work);
+ }
+ EXPORT_SYMBOL_GPL(rt2x00mac_configure_filter);
+
+@@ -509,7 +509,7 @@ void rt2x00mac_bss_info_changed(struct i
+ memcpy(&intf->conf, bss_conf, sizeof(*bss_conf));
+ if (delayed) {
+ intf->delayed_flags |= delayed;
+- queue_work(rt2x00dev->workqueue, &rt2x00dev->intf_work);
++ schedule_work(&rt2x00dev->intf_work);
+ }
+ spin_unlock(&intf->lock);
+ }
+
+--
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
