From: Greg Kroah-Hartman Date: Mon, 6 Dec 2010 22:51:47 +0000 (-0800) Subject: .36 patches X-Git-Tag: v2.6.27.57~30 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d9b1f36d3d8d9fea401d3ca66ce3d488142a86e4;p=thirdparty%2Fkernel%2Fstable-queue.git .36 patches --- diff --git a/queue-2.6.36/acpi-battery-support-percentage-battery-remaining-capacity.patch b/queue-2.6.36/acpi-battery-support-percentage-battery-remaining-capacity.patch new file mode 100644 index 00000000000..24f847736ef --- /dev/null +++ b/queue-2.6.36/acpi-battery-support-percentage-battery-remaining-capacity.patch @@ -0,0 +1,106 @@ +From 557d58687dcdee6bc00c1a8f1fd4e0eac8fefce9 Mon Sep 17 00:00:00 2001 +From: Zhang Rui +Date: Fri, 22 Oct 2010 10:02:06 +0800 +Subject: ACPI battery: support percentage battery remaining capacity + +From: Zhang Rui + +commit 557d58687dcdee6bc00c1a8f1fd4e0eac8fefce9 upstream. + +According to the ACPI spec, some kinds of primary battery can +report percentage battery remaining capacity directly to OS. + +In this case, it reports the LastFullChargedCapacity == 100, +BatteryPresentRate = 0xFFFFFFFF, and BatteryRemaingCapacity a +percentage value, which actually means RemainingBatteryPercentage. + +Now we found some battery follows this rule even if it's a rechargeable. +https://bugzilla.kernel.org/show_bug.cgi?id=15979 + +Handle these batteries correctly in ACPI battery driver +so that they won't break userspace. + +Signed-off-by: Zhang Rui +Tested-by: Sitsofe Wheeler +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/battery.c | 38 +++++++++++++++++++++++++++++++++++++- + 1 file changed, 37 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/battery.c ++++ b/drivers/acpi/battery.c +@@ -98,6 +98,7 @@ enum { + * due to bad math. + */ + ACPI_BATTERY_QUIRK_SIGNED16_CURRENT, ++ ACPI_BATTERY_QUIRK_PERCENTAGE_CAPACITY, + }; + + struct acpi_battery { +@@ -412,6 +413,8 @@ static int acpi_battery_get_info(struct + result = extract_package(battery, buffer.pointer, + info_offsets, ARRAY_SIZE(info_offsets)); + kfree(buffer.pointer); ++ if (test_bit(ACPI_BATTERY_QUIRK_PERCENTAGE_CAPACITY, &battery->flags)) ++ battery->full_charge_capacity = battery->design_capacity; + return result; + } + +@@ -448,6 +451,10 @@ static int acpi_battery_get_state(struct + battery->rate_now != -1) + battery->rate_now = abs((s16)battery->rate_now); + ++ if (test_bit(ACPI_BATTERY_QUIRK_PERCENTAGE_CAPACITY, &battery->flags) ++ && battery->capacity_now >= 0 && battery->capacity_now <= 100) ++ battery->capacity_now = (battery->capacity_now * ++ battery->full_charge_capacity) / 100; + return result; + } + +@@ -561,6 +568,33 @@ static void acpi_battery_quirks(struct a + } + } + ++/* ++ * According to the ACPI spec, some kinds of primary batteries can ++ * report percentage battery remaining capacity directly to OS. ++ * In this case, it reports the Last Full Charged Capacity == 100 ++ * and BatteryPresentRate == 0xFFFFFFFF. ++ * ++ * Now we found some battery reports percentage remaining capacity ++ * even if it's rechargeable. ++ * https://bugzilla.kernel.org/show_bug.cgi?id=15979 ++ * ++ * Handle this correctly so that they won't break userspace. ++ */ ++static void acpi_battery_quirks2(struct acpi_battery *battery) ++{ ++ if (test_bit(ACPI_BATTERY_QUIRK_PERCENTAGE_CAPACITY, &battery->flags)) ++ return ; ++ ++ if (battery->full_charge_capacity == 100 && ++ battery->rate_now == ACPI_BATTERY_VALUE_UNKNOWN && ++ battery->capacity_now >=0 && battery->capacity_now <= 100) { ++ set_bit(ACPI_BATTERY_QUIRK_PERCENTAGE_CAPACITY, &battery->flags); ++ battery->full_charge_capacity = battery->design_capacity; ++ battery->capacity_now = (battery->capacity_now * ++ battery->full_charge_capacity) / 100; ++ } ++} ++ + static int acpi_battery_update(struct acpi_battery *battery) + { + int result, old_present = acpi_battery_present(battery); +@@ -586,7 +620,9 @@ static int acpi_battery_update(struct ac + if (!battery->bat.dev) + sysfs_add_battery(battery); + #endif +- return acpi_battery_get_state(battery); ++ result = acpi_battery_get_state(battery); ++ acpi_battery_quirks2(battery); ++ return result; + } + + /* -------------------------------------------------------------------------- diff --git a/queue-2.6.36/acpi-cpufreq-fix-a-memleak-when-unloading-driver.patch b/queue-2.6.36/acpi-cpufreq-fix-a-memleak-when-unloading-driver.patch new file mode 100644 index 00000000000..32afe58d2f4 --- /dev/null +++ b/queue-2.6.36/acpi-cpufreq-fix-a-memleak-when-unloading-driver.patch @@ -0,0 +1,53 @@ +From dab5fff14df2cd16eb1ad4c02e83915e1063fece Mon Sep 17 00:00:00 2001 +From: Zhang Rui +Date: Tue, 12 Oct 2010 09:09:37 +0800 +Subject: acpi-cpufreq: fix a memleak when unloading driver + +From: Zhang Rui + +commit dab5fff14df2cd16eb1ad4c02e83915e1063fece upstream. + +We didn't free per_cpu(acfreq_data, cpu)->freq_table +when acpi_freq driver is unloaded. + +Resulting in the following messages in /sys/kernel/debug/kmemleak: + +unreferenced object 0xf6450e80 (size 64): + comm "modprobe", pid 1066, jiffies 4294677317 (age 19290.453s) + hex dump (first 32 bytes): + 00 00 00 00 e8 a2 24 00 01 00 00 00 00 9f 24 00 ......$.......$. + 02 00 00 00 00 6a 18 00 03 00 00 00 00 35 0c 00 .....j.......5.. + backtrace: + [] kmemleak_alloc+0x27/0x50 + [] __kmalloc+0xcf/0x110 + [] acpi_cpufreq_cpu_init+0x1ee/0x4e4 [acpi_cpufreq] + [] cpufreq_add_dev+0x142/0x3a0 + [] sysdev_driver_register+0x97/0x110 + [] cpufreq_register_driver+0x86/0x140 + [] 0xf9dad080 + [] do_one_initcall+0x30/0x160 + [] sys_init_module+0x99/0x1e0 + [] sysenter_do_call+0x12/0x26 + [] 0xffffffff + +https://bugzilla.kernel.org/show_bug.cgi?id=15807#c21 + +Tested-by: Toralf Forster +Signed-off-by: Zhang Rui +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c ++++ b/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c +@@ -701,6 +701,7 @@ static int acpi_cpufreq_cpu_exit(struct + per_cpu(acfreq_data, policy->cpu) = NULL; + acpi_processor_unregister_performance(data->acpi_data, + policy->cpu); ++ kfree(data->freq_table); + kfree(data); + } + diff --git a/queue-2.6.36/acpi-debugfs-custom_method-open-to-non-root.patch b/queue-2.6.36/acpi-debugfs-custom_method-open-to-non-root.patch new file mode 100644 index 00000000000..99a039cecd0 --- /dev/null +++ b/queue-2.6.36/acpi-debugfs-custom_method-open-to-non-root.patch @@ -0,0 +1,35 @@ +From ed3aada1bf34c5a9e98af167f125f8a740fc726a Mon Sep 17 00:00:00 2001 +From: Dave Jones +Date: Sat, 13 Nov 2010 00:58:54 -0500 +Subject: ACPI: debugfs custom_method open to non-root + +From: Dave Jones + +commit ed3aada1bf34c5a9e98af167f125f8a740fc726a upstream. + +Currently we have: + + --w--w--w-. 1 root root 0 2010-11-11 14:56 /sys/kernel/debug/acpi/custom_method + +which is just crazy. Change this to --w-------. + +Signed-off-by: Dave Jones +Signed-off-by: Len Brown +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/debugfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/acpi/debugfs.c ++++ b/drivers/acpi/debugfs.c +@@ -79,7 +79,7 @@ int __init acpi_debugfs_init(void) + if (!acpi_dir) + goto err; + +- cm_dentry = debugfs_create_file("custom_method", S_IWUGO, ++ cm_dentry = debugfs_create_file("custom_method", S_IWUSR, + acpi_dir, NULL, &cm_fops); + if (!cm_dentry) + goto err; diff --git a/queue-2.6.36/acpi-install-acpi-table-handler-before-any-dynamic-tables-being-loaded.patch b/queue-2.6.36/acpi-install-acpi-table-handler-before-any-dynamic-tables-being-loaded.patch new file mode 100644 index 00000000000..e8ae03f5242 --- /dev/null +++ b/queue-2.6.36/acpi-install-acpi-table-handler-before-any-dynamic-tables-being-loaded.patch @@ -0,0 +1,60 @@ +From b1d248d96c71665c79befb81207f38f894c7c082 Mon Sep 17 00:00:00 2001 +From: Zhang Rui +Date: Tue, 26 Oct 2010 10:06:54 +0800 +Subject: ACPI: install ACPI table handler before any dynamic tables being loaded + +From: Zhang Rui + +commit b1d248d96c71665c79befb81207f38f894c7c082 upstream. + +ACPI table sysfs I/F is broken by commit + +78f1699659963fff97975df44db6d5dbe7218e55 +Author: Alex Chiang +Date: Sun Dec 20 12:19:09 2009 -0700 + ACPI: processor: call _PDC early + +because dynamic SSDT tables may be loaded in _PDC, +before installing the ACPI table handler. +As a result, the sysfs I/F of these dynamic tables are +located at /sys/firmware/acpi/tables instead of +/sys/firmware/acpi/tables/dynamic, which is not true. + +Invoke acpi_sysfs_init() before acpi_early_processor_set_pdc(), +so that the table handler is installed before any dynamic tables loaded. + +https://bugzilla.kernel.org/show_bug.cgi?id=21142 + +CC: Dennis Jansen +CC: Alex Chiang +Signed-off-by: Zhang Rui +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/bus.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/bus.c ++++ b/drivers/acpi/bus.c +@@ -935,6 +935,12 @@ static int __init acpi_bus_init(void) + goto error1; + } + ++ /* ++ * _PDC control method may load dynamic SSDT tables, ++ * and we need to install the table handler before that. ++ */ ++ acpi_sysfs_init(); ++ + acpi_early_processor_set_pdc(); + + /* +@@ -1026,7 +1032,6 @@ static int __init acpi_init(void) + acpi_scan_init(); + acpi_ec_init(); + acpi_power_init(); +- acpi_sysfs_init(); + acpi_debugfs_init(); + acpi_sleep_proc_init(); + acpi_wakeup_device_init(); diff --git a/queue-2.6.36/arm-6464-2-fix-spinlock-recursion-in-adjust_pte.patch b/queue-2.6.36/arm-6464-2-fix-spinlock-recursion-in-adjust_pte.patch new file mode 100644 index 00000000000..65007208545 --- /dev/null +++ b/queue-2.6.36/arm-6464-2-fix-spinlock-recursion-in-adjust_pte.patch @@ -0,0 +1,90 @@ +From 4e54d93d3c9846ba1c2644ad06463dafa690d1b7 Mon Sep 17 00:00:00 2001 +From: Mika Westerberg +Date: Thu, 28 Oct 2010 11:45:22 +0100 +Subject: ARM: 6464/2: fix spinlock recursion in adjust_pte() + +From: Mika Westerberg + +commit 4e54d93d3c9846ba1c2644ad06463dafa690d1b7 upstream. + +When running following code in a machine which has VIVT caches and +USE_SPLIT_PTLOCKS is not defined: + + fd = open("/etc/passwd", O_RDONLY); + addr = mmap(NULL, 4096, PROT_READ, MAP_SHARED, fd, 0); + addr2 = mmap(NULL, 4096, PROT_READ, MAP_SHARED, fd, 0); + + v = *((int *)addr); + +we will hang in spinlock recursion in the page fault handler: + + BUG: spinlock recursion on CPU#0, mmap_test/717 + lock: c5e295d8, .magic: dead4ead, .owner: mmap_test/717, + .owner_cpu: 0 + [] (unwind_backtrace+0x0/0xec) + [] (do_raw_spin_lock+0x40/0x140) + [] (update_mmu_cache+0x208/0x250) + [] (__do_fault+0x320/0x3ec) + [] (handle_mm_fault+0x2f0/0x6d8) + [] (do_page_fault+0xdc/0x1cc) + [] (do_DataAbort+0x34/0x94) + +This comes from the fact that when USE_SPLIT_PTLOCKS is not defined, +the only lock protecting the page tables is mm->page_table_lock +which is already locked before update_mmu_cache() is called. + +Signed-off-by: Mika Westerberg +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mm/fault-armv.c | 28 ++++++++++++++++++++++++++-- + 1 file changed, 26 insertions(+), 2 deletions(-) + +--- a/arch/arm/mm/fault-armv.c ++++ b/arch/arm/mm/fault-armv.c +@@ -65,6 +65,30 @@ static int do_adjust_pte(struct vm_area_ + return ret; + } + ++#if USE_SPLIT_PTLOCKS ++/* ++ * If we are using split PTE locks, then we need to take the page ++ * lock here. Otherwise we are using shared mm->page_table_lock ++ * which is already locked, thus cannot take it. ++ */ ++static inline void do_pte_lock(spinlock_t *ptl) ++{ ++ /* ++ * Use nested version here to indicate that we are already ++ * holding one similar spinlock. ++ */ ++ spin_lock_nested(ptl, SINGLE_DEPTH_NESTING); ++} ++ ++static inline void do_pte_unlock(spinlock_t *ptl) ++{ ++ spin_unlock(ptl); ++} ++#else /* !USE_SPLIT_PTLOCKS */ ++static inline void do_pte_lock(spinlock_t *ptl) {} ++static inline void do_pte_unlock(spinlock_t *ptl) {} ++#endif /* USE_SPLIT_PTLOCKS */ ++ + static int adjust_pte(struct vm_area_struct *vma, unsigned long address, + unsigned long pfn) + { +@@ -89,11 +113,11 @@ static int adjust_pte(struct vm_area_str + */ + ptl = pte_lockptr(vma->vm_mm, pmd); + pte = pte_offset_map_nested(pmd, address); +- spin_lock(ptl); ++ do_pte_lock(ptl); + + ret = do_adjust_pte(vma, address, pfn, pte); + +- spin_unlock(ptl); ++ do_pte_unlock(ptl); + pte_unmap_nested(pte); + + return ret; diff --git a/queue-2.6.36/arm-6482-2-fix-find_next_zero_bit-and-related-assembly.patch b/queue-2.6.36/arm-6482-2-fix-find_next_zero_bit-and-related-assembly.patch new file mode 100644 index 00000000000..887bdb49e46 --- /dev/null +++ b/queue-2.6.36/arm-6482-2-fix-find_next_zero_bit-and-related-assembly.patch @@ -0,0 +1,49 @@ +From 0e91ec0c06d2cd15071a6021c94840a50e6671aa Mon Sep 17 00:00:00 2001 +From: James Jones +Date: Wed, 24 Nov 2010 00:21:37 +0100 +Subject: ARM: 6482/2: Fix find_next_zero_bit and related assembly + +From: James Jones + +commit 0e91ec0c06d2cd15071a6021c94840a50e6671aa upstream. + +The find_next_bit, find_first_bit, find_next_zero_bit +and find_first_zero_bit functions were not properly +clamping to the maxbit argument at the bit level. They +were instead only checking maxbit at the byte level. +To fix this, add a compare and a conditional move +instruction to the end of the common bit-within-the- +byte code used by all the functions and be sure not to +clobber the maxbit argument before it is used. + +Reviewed-by: Nicolas Pitre +Tested-by: Stephen Warren +Signed-off-by: James Jones +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/lib/findbit.S | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/arch/arm/lib/findbit.S ++++ b/arch/arm/lib/findbit.S +@@ -174,8 +174,8 @@ ENDPROC(_find_next_bit_be) + */ + .L_found: + #if __LINUX_ARM_ARCH__ >= 5 +- rsb r1, r3, #0 +- and r3, r3, r1 ++ rsb r0, r3, #0 ++ and r3, r3, r0 + clz r3, r3 + rsb r3, r3, #31 + add r0, r2, r3 +@@ -190,5 +190,7 @@ ENDPROC(_find_next_bit_be) + addeq r2, r2, #1 + mov r0, r2 + #endif ++ cmp r1, r0 @ Clamp to maxbit ++ movlo r0, r1 + mov pc, lr + diff --git a/queue-2.6.36/arm-6489-1-thumb2-fix-incorrect-optimisation-in-usracc.patch b/queue-2.6.36/arm-6489-1-thumb2-fix-incorrect-optimisation-in-usracc.patch new file mode 100644 index 00000000000..4910b18b2fc --- /dev/null +++ b/queue-2.6.36/arm-6489-1-thumb2-fix-incorrect-optimisation-in-usracc.patch @@ -0,0 +1,40 @@ +From 1142b71d85894dcff1466dd6c871ea3c89e0352c Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Fri, 19 Nov 2010 13:18:31 +0100 +Subject: ARM: 6489/1: thumb2: fix incorrect optimisation in usracc + +From: Will Deacon + +commit 1142b71d85894dcff1466dd6c871ea3c89e0352c upstream. + +Commit 8b592783 added a Thumb-2 variant of usracc which, when it is +called with \rept=2, calls usraccoff once with an offset of 0 and +secondly with a hard-coded offset of 4 in order to avoid incrementing +the pointer again. If \inc != 4 then we will store the data to the wrong +offset from \ptr. Luckily, the only caller that passes \rept=2 to this +function is __clear_user so we haven't been actively corrupting user data. + +This patch fixes usracc to pass \inc instead of #4 to usraccoff +when it is called a second time. + +Reported-by: Tony Thompson +Acked-by: Catalin Marinas +Signed-off-by: Will Deacon +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/include/asm/assembler.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/include/asm/assembler.h ++++ b/arch/arm/include/asm/assembler.h +@@ -215,7 +215,7 @@ + @ Slightly optimised to avoid incrementing the pointer twice + usraccoff \instr, \reg, \ptr, \inc, 0, \cond, \abort + .if \rept == 2 +- usraccoff \instr, \reg, \ptr, \inc, 4, \cond, \abort ++ usraccoff \instr, \reg, \ptr, \inc, \inc, \cond, \abort + .endif + + add\cond \ptr, #\rept * \inc diff --git a/queue-2.6.36/ath9k-fix-timeout-on-stopping-rx-dma.patch b/queue-2.6.36/ath9k-fix-timeout-on-stopping-rx-dma.patch new file mode 100644 index 00000000000..6c067ea9988 --- /dev/null +++ b/queue-2.6.36/ath9k-fix-timeout-on-stopping-rx-dma.patch @@ -0,0 +1,34 @@ +From d47844a014fada1a788719f6426bc7044f2a0fd8 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Sat, 20 Nov 2010 03:08:47 +0100 +Subject: ath9k: fix timeout on stopping rx dma + +From: Felix Fietkau + +commit d47844a014fada1a788719f6426bc7044f2a0fd8 upstream. + +It seems that using ath9k_hw_stoppcurecv to stop rx dma is not enough. +When it's time to stop DMA, the PCU is still busy, so the rx enable +bit never clears. +Using ath9k_hw_abortpcurecv helps with getting rx stopped much faster, +with this change, I cannot reproduce the rx stop related WARN_ON anymore. + +Signed-off-by: Felix Fietkau +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/recv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath9k/recv.c ++++ b/drivers/net/wireless/ath/ath9k/recv.c +@@ -508,7 +508,7 @@ bool ath_stoprecv(struct ath_softc *sc) + bool stopped; + + spin_lock_bh(&sc->rx.rxbuflock); +- ath9k_hw_stoppcurecv(ah); ++ ath9k_hw_abortpcurecv(ah); + ath9k_hw_setrxfilter(ah, 0); + stopped = ath9k_hw_stopdmarecv(ah); + diff --git a/queue-2.6.36/backlight-grab-ops_lock-before-testing-bd-ops.patch b/queue-2.6.36/backlight-grab-ops_lock-before-testing-bd-ops.patch new file mode 100644 index 00000000000..27f8a5963c1 --- /dev/null +++ b/queue-2.6.36/backlight-grab-ops_lock-before-testing-bd-ops.patch @@ -0,0 +1,63 @@ +From d1d73578e053b981c3611e5a211534290d24a5eb Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= +Date: Wed, 24 Nov 2010 12:57:14 -0800 +Subject: backlight: grab ops_lock before testing bd->ops +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= + +commit d1d73578e053b981c3611e5a211534290d24a5eb upstream. + +According to the comment describing ops_lock in the definition of struct +backlight_device and when comparing with other functions in backlight.c +the mutex must be hold when checking ops to be non-NULL. + +Fixes a problem added by c835ee7f4154992e6 ("backlight: Add suspend/resume +support to the backlight core") in Jan 2009. + +Signed-off-by: Uwe Kleine-König +Acked-by: Richard Purdie +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/backlight/backlight.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/video/backlight/backlight.c ++++ b/drivers/video/backlight/backlight.c +@@ -197,12 +197,12 @@ static int backlight_suspend(struct devi + { + struct backlight_device *bd = to_backlight_device(dev); + +- if (bd->ops->options & BL_CORE_SUSPENDRESUME) { +- mutex_lock(&bd->ops_lock); ++ mutex_lock(&bd->ops_lock); ++ if (bd->ops && bd->ops->options & BL_CORE_SUSPENDRESUME) { + bd->props.state |= BL_CORE_SUSPENDED; + backlight_update_status(bd); +- mutex_unlock(&bd->ops_lock); + } ++ mutex_unlock(&bd->ops_lock); + + return 0; + } +@@ -211,12 +211,12 @@ static int backlight_resume(struct devic + { + struct backlight_device *bd = to_backlight_device(dev); + +- if (bd->ops->options & BL_CORE_SUSPENDRESUME) { +- mutex_lock(&bd->ops_lock); ++ mutex_lock(&bd->ops_lock); ++ if (bd->ops && bd->ops->options & BL_CORE_SUSPENDRESUME) { + bd->props.state &= ~BL_CORE_SUSPENDED; + backlight_update_status(bd); +- mutex_unlock(&bd->ops_lock); + } ++ mutex_unlock(&bd->ops_lock); + + return 0; + } diff --git a/queue-2.6.36/cifs-fix-another-memleak-in-cifs_root_iget.patch b/queue-2.6.36/cifs-fix-another-memleak-in-cifs_root_iget.patch new file mode 100644 index 00000000000..a232e3f8d02 --- /dev/null +++ b/queue-2.6.36/cifs-fix-another-memleak-in-cifs_root_iget.patch @@ -0,0 +1,56 @@ +From a7851ce73b9fdef53f251420e6883cf4f3766534 Mon Sep 17 00:00:00 2001 +From: Oskar Schirmer +Date: Wed, 10 Nov 2010 21:06:13 +0000 +Subject: cifs: fix another memleak, in cifs_root_iget + +From: Oskar Schirmer + +commit a7851ce73b9fdef53f251420e6883cf4f3766534 upstream. + +cifs_root_iget allocates full_path through +cifs_build_path_to_root, but fails to kfree it upon +cifs_get_inode_info* failure. + +Make all failure exit paths traverse clean up +handling at the end of the function. + +Signed-off-by: Oskar Schirmer +Reviewed-by: Jesper Juhl +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/inode.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -835,8 +835,10 @@ struct inode *cifs_root_iget(struct supe + rc = cifs_get_inode_info(&inode, full_path, NULL, sb, + xid, NULL); + +- if (!inode) +- return ERR_PTR(rc); ++ if (!inode) { ++ inode = ERR_PTR(rc); ++ goto out; ++ } + + #ifdef CONFIG_CIFS_FSCACHE + /* populate tcon->resource_id */ +@@ -852,13 +854,11 @@ struct inode *cifs_root_iget(struct supe + inode->i_uid = cifs_sb->mnt_uid; + inode->i_gid = cifs_sb->mnt_gid; + } else if (rc) { +- kfree(full_path); +- _FreeXid(xid); + iget_failed(inode); +- return ERR_PTR(rc); ++ inode = ERR_PTR(rc); + } + +- ++out: + kfree(full_path); + /* can not call macro FreeXid here since in a void func + * TODO: This is no longer true diff --git a/queue-2.6.36/cifs-fix-parsing-of-hostname-in-dfs-referrals.patch b/queue-2.6.36/cifs-fix-parsing-of-hostname-in-dfs-referrals.patch new file mode 100644 index 00000000000..6d17ec33906 --- /dev/null +++ b/queue-2.6.36/cifs-fix-parsing-of-hostname-in-dfs-referrals.patch @@ -0,0 +1,40 @@ +From ba03864872691c0bb580a7fb47388da337ef4aa2 Mon Sep 17 00:00:00 2001 +From: Jeff Layton +Date: Tue, 30 Nov 2010 15:14:48 -0500 +Subject: cifs: fix parsing of hostname in dfs referrals + +From: Jeff Layton + +commit ba03864872691c0bb580a7fb47388da337ef4aa2 upstream. + +The DFS referral parsing code does a memchr() call to find the '\\' +delimiter that separates the hostname in the referral UNC from the +sharename. It then uses that value to set the length of the hostname via +pointer subtraction. Instead of subtracting the start of the hostname +however, it subtracts the start of the UNC, which causes the code to +pass in a hostname length that is 2 bytes too long. + +Regression introduced in commit 1a4240f4. + +Reported-and-Tested-by: Robbert Kouprie +Signed-off-by: Jeff Layton +Cc: Wang Lei +Cc: David Howells +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/dns_resolve.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/cifs/dns_resolve.c ++++ b/fs/cifs/dns_resolve.c +@@ -66,7 +66,7 @@ dns_resolve_server_name_to_ip(const char + /* Search for server name delimiter */ + sep = memchr(hostname, '\\', len); + if (sep) +- len = sep - unc; ++ len = sep - hostname; + else + cFYI(1, "%s: probably server name is whole unc: %s", + __func__, unc); diff --git a/queue-2.6.36/cs5535-gpio-apply-cs5536-errata-workaround-for-gpios.patch b/queue-2.6.36/cs5535-gpio-apply-cs5536-errata-workaround-for-gpios.patch new file mode 100644 index 00000000000..d8c929b44ef --- /dev/null +++ b/queue-2.6.36/cs5535-gpio-apply-cs5536-errata-workaround-for-gpios.patch @@ -0,0 +1,72 @@ +From 853ff88324a248a9f5da6e110850223db353ec07 Mon Sep 17 00:00:00 2001 +From: Andres Salomon +Date: Thu, 2 Dec 2010 14:31:17 -0800 +Subject: cs5535-gpio: apply CS5536 errata workaround for GPIOs + +From: Andres Salomon + +commit 853ff88324a248a9f5da6e110850223db353ec07 upstream. + +The AMD Geode CS5536 Companion Device Silicon Revision B1 Specification +Update mentions the follow as issue #36: + + "Atomic write transactions to the atomic GPIO High Bank Feature Bit + registers should only affect the bits selected [...]" + + "after Suspend, an atomic write transaction [...] will clear all + non-selected bits of the accessed register." + +In other words, writing to the high bank for a single GPIO bit will +clear every other GPIO bit (but only sometimes after a suspend). + +The workaround described is obvious and simple; do a read-modify-write. +This patch does that, and documents why we're doing it. + +Signed-off-by: Andres Salomon +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpio/cs5535-gpio.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +--- a/drivers/gpio/cs5535-gpio.c ++++ b/drivers/gpio/cs5535-gpio.c +@@ -56,6 +56,18 @@ static struct cs5535_gpio_chip { + * registers, see include/linux/cs5535.h. + */ + ++static void errata_outl(u32 val, unsigned long addr) ++{ ++ /* ++ * According to the CS5536 errata (#36), after suspend ++ * a write to the high bank GPIO register will clear all ++ * non-selected bits; the recommended workaround is a ++ * read-modify-write operation. ++ */ ++ val |= inl(addr); ++ outl(val, addr); ++} ++ + static void __cs5535_gpio_set(struct cs5535_gpio_chip *chip, unsigned offset, + unsigned int reg) + { +@@ -64,7 +76,7 @@ static void __cs5535_gpio_set(struct cs5 + outl(1 << offset, chip->base + reg); + else + /* high bank register */ +- outl(1 << (offset - 16), chip->base + 0x80 + reg); ++ errata_outl(1 << (offset - 16), chip->base + 0x80 + reg); + } + + void cs5535_gpio_set(unsigned offset, unsigned int reg) +@@ -86,7 +98,7 @@ static void __cs5535_gpio_clear(struct c + outl(1 << (offset + 16), chip->base + reg); + else + /* high bank register */ +- outl(1 << offset, chip->base + 0x80 + reg); ++ errata_outl(1 << offset, chip->base + 0x80 + reg); + } + + void cs5535_gpio_clear(unsigned offset, unsigned int reg) diff --git a/queue-2.6.36/decnet-don-t-leak-uninitialized-stack-byte.patch b/queue-2.6.36/decnet-don-t-leak-uninitialized-stack-byte.patch new file mode 100644 index 00000000000..9187ded1d5a --- /dev/null +++ b/queue-2.6.36/decnet-don-t-leak-uninitialized-stack-byte.patch @@ -0,0 +1,30 @@ +From 3c6f27bf33052ea6ba9d82369fb460726fb779c0 Mon Sep 17 00:00:00 2001 +From: Dan Rosenberg +Date: Tue, 23 Nov 2010 11:02:13 +0000 +Subject: DECnet: don't leak uninitialized stack byte + +From: Dan Rosenberg + +commit 3c6f27bf33052ea6ba9d82369fb460726fb779c0 upstream. + +A single uninitialized padding byte is leaked to userspace. + +Signed-off-by: Dan Rosenberg +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/decnet/af_decnet.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/decnet/af_decnet.c ++++ b/net/decnet/af_decnet.c +@@ -1556,6 +1556,8 @@ static int __dn_getsockopt(struct socket + if (r_len > sizeof(struct linkinfo_dn)) + r_len = sizeof(struct linkinfo_dn); + ++ memset(&link, 0, sizeof(link)); ++ + switch(sock->state) { + case SS_CONNECTING: + link.idn_linkstate = LL_CONNECTING; diff --git a/queue-2.6.36/do_exit-make-sure-that-we-run-with-get_fs-user_ds.patch b/queue-2.6.36/do_exit-make-sure-that-we-run-with-get_fs-user_ds.patch new file mode 100644 index 00000000000..a01046c1b94 --- /dev/null +++ b/queue-2.6.36/do_exit-make-sure-that-we-run-with-get_fs-user_ds.patch @@ -0,0 +1,55 @@ +From 33dd94ae1ccbfb7bf0fb6c692bc3d1c4269e6177 Mon Sep 17 00:00:00 2001 +From: Nelson Elhage +Date: Thu, 2 Dec 2010 14:31:21 -0800 +Subject: do_exit(): make sure that we run with get_fs() == USER_DS + +From: Nelson Elhage + +commit 33dd94ae1ccbfb7bf0fb6c692bc3d1c4269e6177 upstream. + +If a user manages to trigger an oops with fs set to KERNEL_DS, fs is not +otherwise reset before do_exit(). do_exit may later (via mm_release in +fork.c) do a put_user to a user-controlled address, potentially allowing +a user to leverage an oops into a controlled write into kernel memory. + +This is only triggerable in the presence of another bug, but this +potentially turns a lot of DoS bugs into privilege escalations, so it's +worth fixing. I have proof-of-concept code which uses this bug along +with CVE-2010-3849 to write a zero to an arbitrary kernel address, so +I've tested that this is not theoretical. + +A more logical place to put this fix might be when we know an oops has +occurred, before we call do_exit(), but that would involve changing +every architecture, in multiple places. + +Let's just stick it in do_exit instead. + +[akpm@linux-foundation.org: update code comment] +Signed-off-by: Nelson Elhage +Cc: KOSAKI Motohiro +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/exit.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/kernel/exit.c ++++ b/kernel/exit.c +@@ -903,6 +903,15 @@ NORET_TYPE void do_exit(long code) + if (unlikely(!tsk->pid)) + panic("Attempted to kill the idle task!"); + ++ /* ++ * If do_exit is called because this processes oopsed, it's possible ++ * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before ++ * continuing. Amongst other possible reasons, this is to prevent ++ * mm_release()->clear_child_tid() from writing to a user-controlled ++ * kernel address. ++ */ ++ set_fs(USER_DS); ++ + tracehook_report_exit(&code); + + validate_creds_for_do_exit(tsk); diff --git a/queue-2.6.36/e1000-fix-screaming-irq.patch b/queue-2.6.36/e1000-fix-screaming-irq.patch new file mode 100644 index 00000000000..6ea542b6298 --- /dev/null +++ b/queue-2.6.36/e1000-fix-screaming-irq.patch @@ -0,0 +1,63 @@ +From ab08853fab2093e5c6f5de56827a4c93dce4b055 Mon Sep 17 00:00:00 2001 +From: Anupam Chanda +Date: Sun, 21 Nov 2010 09:54:21 -0800 +Subject: e1000: fix screaming IRQ + +From: Anupam Chanda + +commit ab08853fab2093e5c6f5de56827a4c93dce4b055 upstream. + +VMWare reports that the e1000 driver has a bug when bringing down the +interface, such that interrupts are not disabled in the hardware but the +driver stops reporting that it consumed the interrupt. + +The fix is to set the driver's "down" flag later in the routine, +after all the timers and such have exited, preventing the interrupt +handler from being called and exiting early without handling the +interrupt. + +CC: Anupam Chanda +Signed-off-by: Jesse Brandeburg +Signed-off-by: Jeff Kirsher +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/e1000/e1000_main.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/net/e1000/e1000_main.c ++++ b/drivers/net/e1000/e1000_main.c +@@ -31,7 +31,7 @@ + + char e1000_driver_name[] = "e1000"; + static char e1000_driver_string[] = "Intel(R) PRO/1000 Network Driver"; +-#define DRV_VERSION "7.3.21-k6-NAPI" ++#define DRV_VERSION "7.3.21-k8-NAPI" + const char e1000_driver_version[] = DRV_VERSION; + static const char e1000_copyright[] = "Copyright (c) 1999-2006 Intel Corporation."; + +@@ -483,9 +483,6 @@ void e1000_down(struct e1000_adapter *ad + struct net_device *netdev = adapter->netdev; + u32 rctl, tctl; + +- /* signal that we're down so the interrupt handler does not +- * reschedule our watchdog timer */ +- set_bit(__E1000_DOWN, &adapter->flags); + + /* disable receives in the hardware */ + rctl = er32(RCTL); +@@ -506,6 +503,13 @@ void e1000_down(struct e1000_adapter *ad + + e1000_irq_disable(adapter); + ++ /* ++ * Setting DOWN must be after irq_disable to prevent ++ * a screaming interrupt. Setting DOWN also prevents ++ * timers and tasks from rescheduling. ++ */ ++ set_bit(__E1000_DOWN, &adapter->flags); ++ + del_timer_sync(&adapter->tx_fifo_stall_timer); + del_timer_sync(&adapter->watchdog_timer); + del_timer_sync(&adapter->phy_info_timer); diff --git a/queue-2.6.36/fuse-fix-attributes-after-open-o_trunc.patch b/queue-2.6.36/fuse-fix-attributes-after-open-o_trunc.patch new file mode 100644 index 00000000000..3e882a4da17 --- /dev/null +++ b/queue-2.6.36/fuse-fix-attributes-after-open-o_trunc.patch @@ -0,0 +1,57 @@ +From a0822c55779d9319939eac69f00bb729ea9d23da Mon Sep 17 00:00:00 2001 +From: Ken Sumrall +Date: Wed, 24 Nov 2010 12:57:00 -0800 +Subject: fuse: fix attributes after open(O_TRUNC) + +From: Ken Sumrall + +commit a0822c55779d9319939eac69f00bb729ea9d23da upstream. + +The attribute cache for a file was not being cleared when a file is opened +with O_TRUNC. + +If the filesystem's open operation truncates the file ("atomic_o_trunc" +feature flag is set) then the kernel should invalidate the cached st_mtime +and st_ctime attributes. + +Also i_size should be explicitly be set to zero as it is used sometimes +without refreshing the cache. + +Signed-off-by: Ken Sumrall +Cc: Anfei +Cc: "Anand V. Avati" +Signed-off-by: Miklos Szeredi +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fuse/file.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -134,6 +134,7 @@ EXPORT_SYMBOL_GPL(fuse_do_open); + void fuse_finish_open(struct inode *inode, struct file *file) + { + struct fuse_file *ff = file->private_data; ++ struct fuse_conn *fc = get_fuse_conn(inode); + + if (ff->open_flags & FOPEN_DIRECT_IO) + file->f_op = &fuse_direct_io_file_operations; +@@ -141,6 +142,15 @@ void fuse_finish_open(struct inode *inod + invalidate_inode_pages2(inode->i_mapping); + if (ff->open_flags & FOPEN_NONSEEKABLE) + nonseekable_open(inode, file); ++ if (fc->atomic_o_trunc && (file->f_flags & O_TRUNC)) { ++ struct fuse_inode *fi = get_fuse_inode(inode); ++ ++ spin_lock(&fc->lock); ++ fi->attr_version = ++fc->attr_version; ++ i_size_write(inode, 0); ++ spin_unlock(&fc->lock); ++ fuse_invalidate_attr(inode); ++ } + } + + int fuse_open_common(struct inode *inode, struct file *file, bool isdir) diff --git a/queue-2.6.36/leds-fix-bug-with-reading-nas-ss4200-dmi-code.patch b/queue-2.6.36/leds-fix-bug-with-reading-nas-ss4200-dmi-code.patch new file mode 100644 index 00000000000..73958730e8a --- /dev/null +++ b/queue-2.6.36/leds-fix-bug-with-reading-nas-ss4200-dmi-code.patch @@ -0,0 +1,75 @@ +From 50d431e8a15701b599c98afe2b464eb33c952477 Mon Sep 17 00:00:00 2001 +From: Steven Rostedt +Date: Wed, 24 Nov 2010 12:56:52 -0800 +Subject: leds: fix bug with reading NAS SS4200 dmi code + +From: Steven Rostedt + +commit 50d431e8a15701b599c98afe2b464eb33c952477 upstream. + +While running randconfg with ktest.pl I stumbled upon this bug: + + BUG: unable to handle kernel NULL pointer dereference at 0000000000000003 + IP: [] strstr+0x39/0x86 + PGD 0 + Oops: 0000 [#1] SMP + last sysfs file: + CPU 0 + Modules linked in: + + Pid: 1, comm: swapper Not tainted 2.6.37-rc1-test+ #6 DG965MQ/ + RIP: 0010:[] [] strstr+0x39/0x86 + RSP: 0018:ffff8800797cbd80 EFLAGS: 00010213 + RAX: 0000000000000000 RBX: 0000000000000003 RCX: ffffffffffffffff + RDX: 0000000000000000 RSI: ffffffff82eb7ac9 RDI: 0000000000000003 + RBP: ffff8800797cbda0 R08: ffff880000000003 R09: 0000000000030725 + R10: ffff88007d294c00 R11: 0000000000014c00 R12: 0000000000000020 + R13: ffffffff82eb7ac9 R14: ffffffffffffffff R15: ffffffff82eb7b08 + FS: 0000000000000000(0000) GS:ffff88007d200000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b + CR2: 0000000000000003 CR3: 0000000002a1d000 CR4: 00000000000006f0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 + Process swapper (pid: 1, threadinfo ffff8800797ca000, task ffff8800797d0000) + Stack: + 00000000000000ba ffffffff82eb7ac9 ffffffff82eb7ab8 00000000000000ba + ffff8800797cbdf0 ffffffff81e2050f ffff8800797cbdc0 00000000815f913b + ffff8800797cbe00 ffffffff82eb7ab8 0000000000000000 0000000000000000 + Call Trace: + [] dmi_matches+0x117/0x154 + [] dmi_check_system+0x3d/0x8d + [] ? nas_gpio_init+0x0/0x2c8 + [] nas_gpio_init+0x24/0x2c8 + [] ? wm8350_led_init+0x0/0x20 + [] ? nas_gpio_init+0x0/0x2c8 + [] do_one_initcall+0xab/0x1b2 + [] kernel_init+0x248/0x331 + [] kernel_thread_helper+0x4/0x10 + [] ? kernel_init+0x0/0x331 + +Found that the nas_led_whitelist dmi_system_id structure array had no +NULL end delimiter, causing the dmi_check_system() loop to read an +undefined entry. + +Signed-off-by: Steven Rostedt +Acked-by: Dave Hansen +Acked-by: Richard Purdie +Acked-by: Arjan van de Ven +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/leds/leds-ss4200.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/leds/leds-ss4200.c ++++ b/drivers/leds/leds-ss4200.c +@@ -102,6 +102,7 @@ static struct dmi_system_id __initdata n + DMI_MATCH(DMI_PRODUCT_VERSION, "1.00.00") + } + }, ++ {} + }; + + /* diff --git a/queue-2.6.36/memcg-avoid-deadlock-between-move-charge-and-try_charge.patch b/queue-2.6.36/memcg-avoid-deadlock-between-move-charge-and-try_charge.patch new file mode 100644 index 00000000000..a11ac6432b3 --- /dev/null +++ b/queue-2.6.36/memcg-avoid-deadlock-between-move-charge-and-try_charge.patch @@ -0,0 +1,188 @@ +From b1dd693e5b9348bd68a80e679e03cf9c0973b01b Mon Sep 17 00:00:00 2001 +From: Daisuke Nishimura +Date: Wed, 24 Nov 2010 12:57:06 -0800 +Subject: memcg: avoid deadlock between move charge and try_charge() + +From: Daisuke Nishimura + +commit b1dd693e5b9348bd68a80e679e03cf9c0973b01b upstream. + +__mem_cgroup_try_charge() can be called under down_write(&mmap_sem)(e.g. +mlock does it). This means it can cause deadlock if it races with move charge: + +Ex.1) + move charge | try charge + --------------------------------------+------------------------------ + mem_cgroup_can_attach() | down_write(&mmap_sem) + mc.moving_task = current | .. + mem_cgroup_precharge_mc() | __mem_cgroup_try_charge() + mem_cgroup_count_precharge() | prepare_to_wait() + down_read(&mmap_sem) | if (mc.moving_task) + -> cannot aquire the lock | -> true + | schedule() + +Ex.2) + move charge | try charge + --------------------------------------+------------------------------ + mem_cgroup_can_attach() | + mc.moving_task = current | + mem_cgroup_precharge_mc() | + mem_cgroup_count_precharge() | + down_read(&mmap_sem) | + .. | + up_read(&mmap_sem) | + | down_write(&mmap_sem) + mem_cgroup_move_task() | .. + mem_cgroup_move_charge() | __mem_cgroup_try_charge() + down_read(&mmap_sem) | prepare_to_wait() + -> cannot aquire the lock | if (mc.moving_task) + | -> true + | schedule() + +To avoid this deadlock, we do all the move charge works (both can_attach() and +attach()) under one mmap_sem section. +And after this patch, we set/clear mc.moving_task outside mc.lock, because we +use the lock only to check mc.from/to. + +Signed-off-by: Daisuke Nishimura +Cc: Balbir Singh +Acked-by: KAMEZAWA Hiroyuki +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/memcontrol.c | 43 ++++++++++++++++++++++++++----------------- + 1 file changed, 26 insertions(+), 17 deletions(-) + +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -269,13 +269,14 @@ enum move_type { + + /* "mc" and its members are protected by cgroup_mutex */ + static struct move_charge_struct { +- spinlock_t lock; /* for from, to, moving_task */ ++ spinlock_t lock; /* for from, to */ + struct mem_cgroup *from; + struct mem_cgroup *to; + unsigned long precharge; + unsigned long moved_charge; + unsigned long moved_swap; + struct task_struct *moving_task; /* a task moving charges */ ++ struct mm_struct *mm; + wait_queue_head_t waitq; /* a waitq for other context */ + } mc = { + .lock = __SPIN_LOCK_UNLOCKED(mc.lock), +@@ -4445,7 +4446,7 @@ static unsigned long mem_cgroup_count_pr + unsigned long precharge; + struct vm_area_struct *vma; + +- down_read(&mm->mmap_sem); ++ /* We've already held the mmap_sem */ + for (vma = mm->mmap; vma; vma = vma->vm_next) { + struct mm_walk mem_cgroup_count_precharge_walk = { + .pmd_entry = mem_cgroup_count_precharge_pte_range, +@@ -4457,7 +4458,6 @@ static unsigned long mem_cgroup_count_pr + walk_page_range(vma->vm_start, vma->vm_end, + &mem_cgroup_count_precharge_walk); + } +- up_read(&mm->mmap_sem); + + precharge = mc.precharge; + mc.precharge = 0; +@@ -4508,11 +4508,16 @@ static void mem_cgroup_clear_mc(void) + + mc.moved_swap = 0; + } ++ if (mc.mm) { ++ up_read(&mc.mm->mmap_sem); ++ mmput(mc.mm); ++ } + spin_lock(&mc.lock); + mc.from = NULL; + mc.to = NULL; +- mc.moving_task = NULL; + spin_unlock(&mc.lock); ++ mc.moving_task = NULL; ++ mc.mm = NULL; + memcg_oom_recover(from); + memcg_oom_recover(to); + wake_up_all(&mc.waitq); +@@ -4537,26 +4542,37 @@ static int mem_cgroup_can_attach(struct + return 0; + /* We move charges only when we move a owner of the mm */ + if (mm->owner == p) { ++ /* ++ * We do all the move charge works under one mmap_sem to ++ * avoid deadlock with down_write(&mmap_sem) ++ * -> try_charge() -> if (mc.moving_task) -> sleep. ++ */ ++ down_read(&mm->mmap_sem); ++ + VM_BUG_ON(mc.from); + VM_BUG_ON(mc.to); + VM_BUG_ON(mc.precharge); + VM_BUG_ON(mc.moved_charge); + VM_BUG_ON(mc.moved_swap); + VM_BUG_ON(mc.moving_task); ++ VM_BUG_ON(mc.mm); ++ + spin_lock(&mc.lock); + mc.from = from; + mc.to = mem; + mc.precharge = 0; + mc.moved_charge = 0; + mc.moved_swap = 0; +- mc.moving_task = current; + spin_unlock(&mc.lock); ++ mc.moving_task = current; ++ mc.mm = mm; + + ret = mem_cgroup_precharge_mc(mm); + if (ret) + mem_cgroup_clear_mc(); +- } +- mmput(mm); ++ /* We call up_read() and mmput() in clear_mc(). */ ++ } else ++ mmput(mm); + } + return ret; + } +@@ -4644,7 +4660,7 @@ static void mem_cgroup_move_charge(struc + struct vm_area_struct *vma; + + lru_add_drain_all(); +- down_read(&mm->mmap_sem); ++ /* We've already held the mmap_sem */ + for (vma = mm->mmap; vma; vma = vma->vm_next) { + int ret; + struct mm_walk mem_cgroup_move_charge_walk = { +@@ -4663,7 +4679,6 @@ static void mem_cgroup_move_charge(struc + */ + break; + } +- up_read(&mm->mmap_sem); + } + + static void mem_cgroup_move_task(struct cgroup_subsys *ss, +@@ -4672,17 +4687,11 @@ static void mem_cgroup_move_task(struct + struct task_struct *p, + bool threadgroup) + { +- struct mm_struct *mm; +- +- if (!mc.to) ++ if (!mc.mm) + /* no need to move charge */ + return; + +- mm = get_task_mm(p); +- if (mm) { +- mem_cgroup_move_charge(mm); +- mmput(mm); +- } ++ mem_cgroup_move_charge(mc.mm); + mem_cgroup_clear_mc(); + } + #else /* !CONFIG_MMU */ diff --git a/queue-2.6.36/mm-hugetlb.c-avoid-double-unlock_page-in-hugetlb_fault.patch b/queue-2.6.36/mm-hugetlb.c-avoid-double-unlock_page-in-hugetlb_fault.patch new file mode 100644 index 00000000000..c7e0f4d67e5 --- /dev/null +++ b/queue-2.6.36/mm-hugetlb.c-avoid-double-unlock_page-in-hugetlb_fault.patch @@ -0,0 +1,38 @@ +From 1f64d69c7ad2e48e697493e45590679f7a69b7b2 Mon Sep 17 00:00:00 2001 +From: Dean Nelson +Date: Thu, 2 Dec 2010 14:31:12 -0800 +Subject: mm/hugetlb.c: avoid double unlock_page() in hugetlb_fault() + +From: Dean Nelson + +commit 1f64d69c7ad2e48e697493e45590679f7a69b7b2 upstream. + +Have hugetlb_fault() call unlock_page(page) only if it had previously +called lock_page(page). + +Setting CONFIG_DEBUG_VM=y and then running the libhugetlbfs test suite, +resulted in the tripping of VM_BUG_ON(!PageLocked(page)) in +unlock_page() having been called by hugetlb_fault() when page == +pagecache_page. This patch remedied the problem. + +Signed-off-by: Dean Nelson +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/hugetlb.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -2668,7 +2668,8 @@ out_page_table_lock: + unlock_page(pagecache_page); + put_page(pagecache_page); + } +- unlock_page(page); ++ if (page != pagecache_page) ++ unlock_page(page); + + out_mutex: + mutex_unlock(&hugetlb_instantiation_mutex); diff --git a/queue-2.6.36/mmc-fix-rmmod-race-for-hosts-using-card-detection-polling.patch b/queue-2.6.36/mmc-fix-rmmod-race-for-hosts-using-card-detection-polling.patch new file mode 100644 index 00000000000..a341e6907a7 --- /dev/null +++ b/queue-2.6.36/mmc-fix-rmmod-race-for-hosts-using-card-detection-polling.patch @@ -0,0 +1,33 @@ +From d9bcbf343ec63e1104b5276195888ee06b4d086f Mon Sep 17 00:00:00 2001 +From: Guennadi Liakhovetski +Date: Thu, 11 Nov 2010 17:32:25 +0100 +Subject: mmc: fix rmmod race for hosts using card-detection polling + +From: Guennadi Liakhovetski + +commit d9bcbf343ec63e1104b5276195888ee06b4d086f upstream. + +MMC hosts that poll for card detection by defining the MMC_CAP_NEEDS_POLL +flag have a race on rmmod, where the delayed work is cancelled without +waiting for completed polling. To prevent this a _sync version of the work +cancellation has to be used. + +Signed-off-by: Guennadi Liakhovetski +Signed-off-by: Chris Ball +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/core/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mmc/core/core.c ++++ b/drivers/mmc/core/core.c +@@ -1514,7 +1514,7 @@ void mmc_stop_host(struct mmc_host *host + + if (host->caps & MMC_CAP_DISABLE) + cancel_delayed_work(&host->disable); +- cancel_delayed_work(&host->detect); ++ cancel_delayed_work_sync(&host->detect); + mmc_flush_scheduled_work(); + + /* clear pm flags now and let card drivers set them as needed */ diff --git a/queue-2.6.36/nommu-yield-cpu-while-disposing-vm.patch b/queue-2.6.36/nommu-yield-cpu-while-disposing-vm.patch new file mode 100644 index 00000000000..c4466e9159c --- /dev/null +++ b/queue-2.6.36/nommu-yield-cpu-while-disposing-vm.patch @@ -0,0 +1,36 @@ +From 04c3496152394d17e3bc2316f9731ee3e8a026bc Mon Sep 17 00:00:00 2001 +From: Steven J. Magnani +Date: Wed, 24 Nov 2010 12:56:54 -0800 +Subject: nommu: yield CPU while disposing VM + +From: Steven J. Magnani + +commit 04c3496152394d17e3bc2316f9731ee3e8a026bc upstream. + +Depending on processor speed, page size, and the amount of memory a +process is allowed to amass, cleanup of a large VM may freeze the system +for many seconds. This can result in a watchdog timeout. + +Make sure other tasks receive some service when cleaning up large VMs. + +Signed-off-by: Steven J. Magnani +Cc: Greg Ungerer +Reviewed-by: KOSAKI Motohiro +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/nommu.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/mm/nommu.c ++++ b/mm/nommu.c +@@ -1668,6 +1668,7 @@ void exit_mmap(struct mm_struct *mm) + mm->mmap = vma->vm_next; + delete_vma_from_mm(vma); + delete_vma(mm, vma); ++ cond_resched(); + } + + kleave(""); diff --git a/queue-2.6.36/perf_events-fix-perf_counter_mmap-hook-in-mprotect.patch b/queue-2.6.36/perf_events-fix-perf_counter_mmap-hook-in-mprotect.patch new file mode 100644 index 00000000000..1c5e0e0cf37 --- /dev/null +++ b/queue-2.6.36/perf_events-fix-perf_counter_mmap-hook-in-mprotect.patch @@ -0,0 +1,49 @@ +From 63bfd7384b119409685a17d5c58f0b56e5dc03da Mon Sep 17 00:00:00 2001 +From: Pekka Enberg +Date: Mon, 8 Nov 2010 21:29:07 +0200 +Subject: perf_events: Fix perf_counter_mmap() hook in mprotect() + +From: Pekka Enberg + +commit 63bfd7384b119409685a17d5c58f0b56e5dc03da upstream. + +As pointed out by Linus, commit dab5855 ("perf_counter: Add mmap event hooks to +mprotect()") is fundamentally wrong as mprotect_fixup() can free 'vma' due to +merging. Fix the problem by moving perf_event_mmap() hook to +mprotect_fixup(). + +Note: there's another successful return path from mprotect_fixup() if old +flags equal to new flags. We don't, however, need to call +perf_event_mmap() there because 'perf' already knows the VMA is +executable. + +Reported-by: Dave Jones +Analyzed-by: Linus Torvalds +Cc: Ingo Molnar +Reviewed-by: Peter Zijlstra +Signed-off-by: Pekka Enberg +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/mprotect.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/mprotect.c ++++ b/mm/mprotect.c +@@ -211,6 +211,7 @@ success: + mmu_notifier_invalidate_range_end(mm, start, end); + vm_stat_account(mm, oldflags, vma->vm_file, -nrpages); + vm_stat_account(mm, newflags, vma->vm_file, nrpages); ++ perf_event_mmap(vma); + return 0; + + fail: +@@ -299,7 +300,6 @@ SYSCALL_DEFINE3(mprotect, unsigned long, + error = mprotect_fixup(vma, &prev, nstart, tmp, newflags); + if (error) + goto out; +- perf_event_mmap(vma); + nstart = tmp; + + if (nstart < prev->vm_end) diff --git a/queue-2.6.36/pm-pm-qos-fix-reversed-min-and-max.patch b/queue-2.6.36/pm-pm-qos-fix-reversed-min-and-max.patch new file mode 100644 index 00000000000..9921d3a1c4a --- /dev/null +++ b/queue-2.6.36/pm-pm-qos-fix-reversed-min-and-max.patch @@ -0,0 +1,36 @@ +From 00fafcda1773245a5292f953321ec3f0668c8c28 Mon Sep 17 00:00:00 2001 +From: Colin Cross +Date: Mon, 15 Nov 2010 22:45:22 +0100 +Subject: PM / PM QoS: Fix reversed min and max + +From: Colin Cross + +commit 00fafcda1773245a5292f953321ec3f0668c8c28 upstream. + +pm_qos_get_value had min and max reversed, causing all pm_qos +requests to have no effect. + +Signed-off-by: Colin Cross +Acked-by: mark +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/pm_qos_params.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/kernel/pm_qos_params.c ++++ b/kernel/pm_qos_params.c +@@ -120,10 +120,10 @@ static inline int pm_qos_get_value(struc + + switch (o->type) { + case PM_QOS_MIN: +- return plist_last(&o->requests)->prio; ++ return plist_first(&o->requests)->prio; + + case PM_QOS_MAX: +- return plist_first(&o->requests)->prio; ++ return plist_last(&o->requests)->prio; + + default: + /* runtime check for not using enum */ diff --git a/queue-2.6.36/pnpacpi-cope-with-invalid-device-ids.patch b/queue-2.6.36/pnpacpi-cope-with-invalid-device-ids.patch new file mode 100644 index 00000000000..2d2ca4ab055 --- /dev/null +++ b/queue-2.6.36/pnpacpi-cope-with-invalid-device-ids.patch @@ -0,0 +1,91 @@ +From 420a0f66378c84b00b0e603e4d38210102dbe367 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Sat, 18 Sep 2010 10:11:09 -0700 +Subject: PNPACPI: cope with invalid device IDs + +From: Dmitry Torokhov + +commit 420a0f66378c84b00b0e603e4d38210102dbe367 upstream. + +If primary ID (HID) is invalid try locating first valid ID on compatible +ID list before giving up. + +This helps, for example, to recognize i8042 AUX port on Sony Vaio VPCZ1 +which uses SNYSYN0003 as HID. Without the patch users are forced to +boot with i8042.nopnp to make use of their touchpads. + +Tested-by: Jan-Hendrik Zab +Signed-off-by: Dmitry Torokhov +Signed-off-by: Len Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pnp/pnpacpi/core.c | 29 ++++++++++++++++++++++++----- + 1 file changed, 24 insertions(+), 5 deletions(-) + +--- a/drivers/pnp/pnpacpi/core.c ++++ b/drivers/pnp/pnpacpi/core.c +@@ -28,7 +28,7 @@ + #include "../base.h" + #include "pnpacpi.h" + +-static int num = 0; ++static int num; + + /* We need only to blacklist devices that have already an acpi driver that + * can't use pnp layer. We don't need to blacklist device that are directly +@@ -180,11 +180,24 @@ struct pnp_protocol pnpacpi_protocol = { + }; + EXPORT_SYMBOL(pnpacpi_protocol); + ++static char *pnpacpi_get_id(struct acpi_device *device) ++{ ++ struct acpi_hardware_id *id; ++ ++ list_for_each_entry(id, &device->pnp.ids, list) { ++ if (ispnpidacpi(id->id)) ++ return id->id; ++ } ++ ++ return NULL; ++} ++ + static int __init pnpacpi_add_device(struct acpi_device *device) + { + acpi_handle temp = NULL; + acpi_status status; + struct pnp_dev *dev; ++ char *pnpid; + struct acpi_hardware_id *id; + + /* +@@ -192,11 +205,17 @@ static int __init pnpacpi_add_device(str + * driver should not be loaded. + */ + status = acpi_get_handle(device->handle, "_CRS", &temp); +- if (ACPI_FAILURE(status) || !ispnpidacpi(acpi_device_hid(device)) || +- is_exclusive_device(device) || (!device->status.present)) ++ if (ACPI_FAILURE(status)) ++ return 0; ++ ++ pnpid = pnpacpi_get_id(device); ++ if (!pnpid) ++ return 0; ++ ++ if (is_exclusive_device(device) || !device->status.present) + return 0; + +- dev = pnp_alloc_dev(&pnpacpi_protocol, num, acpi_device_hid(device)); ++ dev = pnp_alloc_dev(&pnpacpi_protocol, num, pnpid); + if (!dev) + return -ENOMEM; + +@@ -227,7 +246,7 @@ static int __init pnpacpi_add_device(str + pnpacpi_parse_resource_option_data(dev); + + list_for_each_entry(id, &device->pnp.ids, list) { +- if (!strcmp(id->id, acpi_device_hid(device))) ++ if (!strcmp(id->id, pnpid)) + continue; + if (!ispnpidacpi(id->id)) + continue; diff --git a/queue-2.6.36/saa7134-fix-autodetect-for-behold-a7-and-h7-tv-cards.patch b/queue-2.6.36/saa7134-fix-autodetect-for-behold-a7-and-h7-tv-cards.patch new file mode 100644 index 00000000000..04c711a5077 --- /dev/null +++ b/queue-2.6.36/saa7134-fix-autodetect-for-behold-a7-and-h7-tv-cards.patch @@ -0,0 +1,61 @@ +From 35bbe587d0959712b69540077c9e0fd27d3e6baf Mon Sep 17 00:00:00 2001 +From: Dmitri Belimov +Date: Tue, 26 Oct 2010 00:31:40 -0300 +Subject: [media] saa7134: Fix autodetect for Behold A7 and H7 TV cards + +From: Dmitri Belimov + +commit 35bbe587d0959712b69540077c9e0fd27d3e6baf upstream. + +The entries for those cards are after the generic entries, +so they don't work, in practice. Moving them to happen before the +generic entres fix the issue. + +Signed-off-by: Beholder Intl. Ltd. Dmitry Belimov +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/saa7134/saa7134-cards.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +--- a/drivers/media/video/saa7134/saa7134-cards.c ++++ b/drivers/media/video/saa7134/saa7134-cards.c +@@ -6661,6 +6661,18 @@ struct pci_device_id saa7134_pci_tbl[] = + .subdevice = 0x2804, + .driver_data = SAA7134_BOARD_TECHNOTREND_BUDGET_T3000, + }, { ++ .vendor = PCI_VENDOR_ID_PHILIPS, ++ .device = PCI_DEVICE_ID_PHILIPS_SAA7133, ++ .subvendor = 0x5ace, /* Beholder Intl. Ltd. */ ++ .subdevice = 0x7190, ++ .driver_data = SAA7134_BOARD_BEHOLD_H7, ++ }, { ++ .vendor = PCI_VENDOR_ID_PHILIPS, ++ .device = PCI_DEVICE_ID_PHILIPS_SAA7133, ++ .subvendor = 0x5ace, /* Beholder Intl. Ltd. */ ++ .subdevice = 0x7090, ++ .driver_data = SAA7134_BOARD_BEHOLD_A7, ++ }, { + /* --- boards without eeprom + subsystem ID --- */ + .vendor = PCI_VENDOR_ID_PHILIPS, + .device = PCI_DEVICE_ID_PHILIPS_SAA7134, +@@ -6698,18 +6710,6 @@ struct pci_device_id saa7134_pci_tbl[] = + .subvendor = PCI_ANY_ID, + .subdevice = PCI_ANY_ID, + .driver_data = SAA7134_BOARD_UNKNOWN, +- }, { +- .vendor = PCI_VENDOR_ID_PHILIPS, +- .device = PCI_DEVICE_ID_PHILIPS_SAA7133, +- .subvendor = 0x5ace, /* Beholder Intl. Ltd. */ +- .subdevice = 0x7190, +- .driver_data = SAA7134_BOARD_BEHOLD_H7, +- }, { +- .vendor = PCI_VENDOR_ID_PHILIPS, +- .device = PCI_DEVICE_ID_PHILIPS_SAA7133, +- .subvendor = 0x5ace, /* Beholder Intl. Ltd. */ +- .subdevice = 0x7090, +- .driver_data = SAA7134_BOARD_BEHOLD_A7, + },{ + /* --- end of list --- */ + } diff --git a/queue-2.6.36/serial-mfd-adjust-the-baud-rate-setting.patch b/queue-2.6.36/serial-mfd-adjust-the-baud-rate-setting.patch new file mode 100644 index 00000000000..b1baebefcfc --- /dev/null +++ b/queue-2.6.36/serial-mfd-adjust-the-baud-rate-setting.patch @@ -0,0 +1,66 @@ +From a5880a9e5bb40fbae55de60051d69a29091053c3 Mon Sep 17 00:00:00 2001 +From: Feng Tang +Date: Fri, 19 Nov 2010 11:01:48 +0800 +Subject: serial: mfd: adjust the baud rate setting + +From: Feng Tang + +commit a5880a9e5bb40fbae55de60051d69a29091053c3 upstream. + +Previous baud rate setting code only has been tested with 3.5M/9600/ +115200/230400/460800 bps, and recently we got a 3M bps device to test, +which needs to modify current MUL register setting, and with this +patch 2.5M/2M/1.5M/1M/0.5M should also work as they just use a MUL +value scale down from 3M's. + +Also got some reference register setting from silicon guys for +different baud rates, which tries to keep the pre-scalar register value +to 16. + +Signed-off-by: Feng Tang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/serial/mfd.c | 18 ++++++++---------- + 1 file changed, 8 insertions(+), 10 deletions(-) + +--- a/drivers/serial/mfd.c ++++ b/drivers/serial/mfd.c +@@ -892,8 +892,7 @@ serial_hsu_set_termios(struct uart_port + unsigned char cval, fcr = 0; + unsigned long flags; + unsigned int baud, quot; +- u32 mul = 0x3600; +- u32 ps = 0x10; ++ u32 ps, mul; + + switch (termios->c_cflag & CSIZE) { + case CS5: +@@ -937,20 +936,19 @@ serial_hsu_set_termios(struct uart_port + ps = 0xC; + quot = 1; + break; +- case 2500000: +- mul = 0x2710; +- ps = 0x10; +- quot = 1; +- break; + case 18432000: + mul = 0x2400; + ps = 0x10; + quot = 1; + break; ++ case 3000000: ++ case 2500000: ++ case 2000000: + case 1500000: +- mul = 0x1D4C; +- ps = 0xc; +- quot = 1; ++ case 1000000: ++ case 500000: ++ /* mul/ps/quot = 0x9C4/0x10/0x1 will make a 500000 bps */ ++ mul = baud / 500000 * 0x9C4; + break; + default: + ; diff --git a/queue-2.6.36/series b/queue-2.6.36/series index 92fad4b8e64..65a9f9d254f 100644 --- a/queue-2.6.36/series +++ b/queue-2.6.36/series @@ -209,3 +209,39 @@ usb-ehci-fix-debugfs-lpm-permissions.patch usb-ehci-fix-obscure-race-in-ehci_endpoint_disable.patch usb-ehci-disable-lpm-and-ppcd-for-nvidia-mcp89-chips.patch usb-storage-sierra_ms-fix-sysfs-file-attribute.patch +usb-atm-ueagle-atm-fix-up-some-permissions-on-the-sysfs-files.patch +usb-misc-cypress_cy7c63-fix-up-some-sysfs-attribute-permissions.patch +usb-misc-usbled-fix-up-some-sysfs-attribute-permissions.patch +usb-misc-trancevibrator-fix-up-a-sysfs-attribute-permission.patch +usb-misc-usbsevseg-fix-up-some-sysfs-attribute-permissions.patch +usb-ftdi_sio-add-id-for-rt-systems-usb-29b-radio-cable.patch +usb-serial-ftdi_sio-vardaan-usb-rs422-485-converter-pid-added.patch +usb-fix-autosuspend-bug-in-usb-serial.patch +e1000-fix-screaming-irq.patch +acpi-install-acpi-table-handler-before-any-dynamic-tables-being-loaded.patch +acpi-battery-support-percentage-battery-remaining-capacity.patch +acpi-cpufreq-fix-a-memleak-when-unloading-driver.patch +acpi-debugfs-custom_method-open-to-non-root.patch +pnpacpi-cope-with-invalid-device-ids.patch +saa7134-fix-autodetect-for-behold-a7-and-h7-tv-cards.patch +fuse-fix-attributes-after-open-o_trunc.patch +cs5535-gpio-apply-cs5536-errata-workaround-for-gpios.patch +do_exit-make-sure-that-we-run-with-get_fs-user_ds.patch +mm-hugetlb.c-avoid-double-unlock_page-in-hugetlb_fault.patch +cifs-fix-another-memleak-in-cifs_root_iget.patch +cifs-fix-parsing-of-hostname-in-dfs-referrals.patch +ath9k-fix-timeout-on-stopping-rx-dma.patch +uml-disable-winch-irq-before-freeing-handler-data.patch +backlight-grab-ops_lock-before-testing-bd-ops.patch +nommu-yield-cpu-while-disposing-vm.patch +pm-pm-qos-fix-reversed-min-and-max.patch +x86-ignore-trap-bits-on-single-step-exceptions.patch +mmc-fix-rmmod-race-for-hosts-using-card-detection-polling.patch +decnet-don-t-leak-uninitialized-stack-byte.patch +perf_events-fix-perf_counter_mmap-hook-in-mprotect.patch +arm-6464-2-fix-spinlock-recursion-in-adjust_pte.patch +arm-6489-1-thumb2-fix-incorrect-optimisation-in-usracc.patch +arm-6482-2-fix-find_next_zero_bit-and-related-assembly.patch +leds-fix-bug-with-reading-nas-ss4200-dmi-code.patch +serial-mfd-adjust-the-baud-rate-setting.patch +memcg-avoid-deadlock-between-move-charge-and-try_charge.patch diff --git a/queue-2.6.36/uml-disable-winch-irq-before-freeing-handler-data.patch b/queue-2.6.36/uml-disable-winch-irq-before-freeing-handler-data.patch new file mode 100644 index 00000000000..3e544b567ab --- /dev/null +++ b/queue-2.6.36/uml-disable-winch-irq-before-freeing-handler-data.patch @@ -0,0 +1,66 @@ +From 69e83dad5207f8f03c9699e57e1febb114383cb8 Mon Sep 17 00:00:00 2001 +From: Will Newton +Date: Wed, 24 Nov 2010 12:56:55 -0800 +Subject: uml: disable winch irq before freeing handler data + +From: Will Newton + +commit 69e83dad5207f8f03c9699e57e1febb114383cb8 upstream. + +Disable the winch irq early to make sure we don't take an interrupt part +way through the freeing of the handler data, resulting in a crash on +shutdown: + + winch_interrupt : read failed, errno = 9 + fd 13 is losing SIGWINCH support + ------------[ cut here ]------------ + WARNING: at lib/list_debug.c:48 list_del+0xc6/0x100() + list_del corruption, next is LIST_POISON1 (00100100) + 082578c8: [<081fd77f>] dump_stack+0x22/0x24 + 082578e0: [<0807a18a>] warn_slowpath_common+0x5a/0x80 + 08257908: [<0807a23e>] warn_slowpath_fmt+0x2e/0x30 + 08257920: [<08172196>] list_del+0xc6/0x100 + 08257940: [<08060244>] free_winch+0x14/0x80 + 08257958: [<080606fb>] winch_interrupt+0xdb/0xe0 + 08257978: [<080a65b5>] handle_IRQ_event+0x35/0xe0 + 08257998: [<080a8717>] handle_edge_irq+0xb7/0x170 + 082579bc: [<08059bc4>] do_IRQ+0x34/0x50 + 082579d4: [<08059e1b>] sigio_handler+0x5b/0x80 + 082579ec: [<0806a374>] sig_handler_common+0x44/0xb0 + 08257a68: [<0806a538>] sig_handler+0x38/0x50 + 08257a78: [<0806a77c>] handle_signal+0x5c/0xa0 + 08257a9c: [<0806be28>] hard_handler+0x18/0x20 + 08257aac: [<00c14400>] 0xc14400 + +Signed-off-by: Will Newton +Acked-by: WANG Cong +Cc: Jeff Dike +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/um/drivers/line.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/arch/um/drivers/line.c ++++ b/arch/um/drivers/line.c +@@ -727,6 +727,9 @@ struct winch { + + static void free_winch(struct winch *winch, int free_irq_ok) + { ++ if (free_irq_ok) ++ free_irq(WINCH_IRQ, winch); ++ + list_del(&winch->list); + + if (winch->pid != -1) +@@ -735,8 +738,6 @@ static void free_winch(struct winch *win + os_close_file(winch->fd); + if (winch->stack != 0) + free_stack(winch->stack, 0); +- if (free_irq_ok) +- free_irq(WINCH_IRQ, winch); + kfree(winch); + } + diff --git a/queue-2.6.36/usb-atm-ueagle-atm-fix-up-some-permissions-on-the-sysfs-files.patch b/queue-2.6.36/usb-atm-ueagle-atm-fix-up-some-permissions-on-the-sysfs-files.patch new file mode 100644 index 00000000000..941090b6cc2 --- /dev/null +++ b/queue-2.6.36/usb-atm-ueagle-atm-fix-up-some-permissions-on-the-sysfs-files.patch @@ -0,0 +1,52 @@ +From e502ac5e1eca99d7dc3f12b2a6780ccbca674858 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Mon, 15 Nov 2010 11:11:45 -0800 +Subject: USB: atm: ueagle-atm: fix up some permissions on the sysfs files + +From: Greg Kroah-Hartman + +commit e502ac5e1eca99d7dc3f12b2a6780ccbca674858 upstream. + +Some of the sysfs files had the incorrect permissions. Some didn't make +sense at all (writable for a file that you could not write to?) + +Reported-by: Linus Torvalds +Cc: Matthieu Castet +Cc: Stanislaw Gruszka +Cc: Damien Bergamini +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/atm/ueagle-atm.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/usb/atm/ueagle-atm.c ++++ b/drivers/usb/atm/ueagle-atm.c +@@ -2301,7 +2301,7 @@ out: + return ret; + } + +-static DEVICE_ATTR(stat_status, S_IWUGO | S_IRUGO, read_status, reboot); ++static DEVICE_ATTR(stat_status, S_IWUSR | S_IRUGO, read_status, reboot); + + static ssize_t read_human_status(struct device *dev, + struct device_attribute *attr, char *buf) +@@ -2364,8 +2364,7 @@ out: + return ret; + } + +-static DEVICE_ATTR(stat_human_status, S_IWUGO | S_IRUGO, +- read_human_status, NULL); ++static DEVICE_ATTR(stat_human_status, S_IRUGO, read_human_status, NULL); + + static ssize_t read_delin(struct device *dev, struct device_attribute *attr, + char *buf) +@@ -2397,7 +2396,7 @@ out: + return ret; + } + +-static DEVICE_ATTR(stat_delin, S_IWUGO | S_IRUGO, read_delin, NULL); ++static DEVICE_ATTR(stat_delin, S_IRUGO, read_delin, NULL); + + #define UEA_ATTR(name, reset) \ + \ diff --git a/queue-2.6.36/usb-fix-autosuspend-bug-in-usb-serial.patch b/queue-2.6.36/usb-fix-autosuspend-bug-in-usb-serial.patch new file mode 100644 index 00000000000..be9a54b9c61 --- /dev/null +++ b/queue-2.6.36/usb-fix-autosuspend-bug-in-usb-serial.patch @@ -0,0 +1,45 @@ +From abf03184a31a3286fc0ab30f838ddee8ba9f9b7b Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Mon, 29 Nov 2010 10:17:22 -0500 +Subject: USB: fix autosuspend bug in usb-serial + +From: Alan Stern + +commit abf03184a31a3286fc0ab30f838ddee8ba9f9b7b upstream. + +This patch (as1437) fixes a bug in the usb-serial autosuspend +handling. Since the usb-serial core now has autosuspend support, it +must set the .supports_autosuspend member in every serial driver it +registers. Otherwise the usb_autopm_get_interface() call won't work. + +This fixes Bugzilla #23012. + +Signed-off-by: Alan Stern +Reported-by: Kevin Smith +Reported-and-tested-by: Simon Gerber +Reported-and-tested-by: Matteo Croce +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/usb-serial.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/serial/usb-serial.c ++++ b/drivers/usb/serial/usb-serial.c +@@ -52,6 +52,7 @@ static struct usb_driver usb_serial_driv + .suspend = usb_serial_suspend, + .resume = usb_serial_resume, + .no_dynamic_id = 1, ++ .supports_autosuspend = 1, + }; + + /* There is no MODULE_DEVICE_TABLE for usbserial.c. Instead +@@ -1331,6 +1332,8 @@ int usb_serial_register(struct usb_seria + return -ENODEV; + + fixup_generic(driver); ++ if (driver->usb_driver) ++ driver->usb_driver->supports_autosuspend = 1; + + if (!driver->description) + driver->description = driver->driver.name; diff --git a/queue-2.6.36/usb-ftdi_sio-add-id-for-rt-systems-usb-29b-radio-cable.patch b/queue-2.6.36/usb-ftdi_sio-add-id-for-rt-systems-usb-29b-radio-cable.patch new file mode 100644 index 00000000000..6a298bf5e7f --- /dev/null +++ b/queue-2.6.36/usb-ftdi_sio-add-id-for-rt-systems-usb-29b-radio-cable.patch @@ -0,0 +1,39 @@ +From 28942bb6a9dd4e2ed793675e515cfb8297ed355b Mon Sep 17 00:00:00 2001 +From: Michael Stuermer +Date: Thu, 18 Nov 2010 00:45:43 +0100 +Subject: USB: ftdi_sio: Add ID for RT Systems USB-29B radio cable + +From: Michael Stuermer + +commit 28942bb6a9dd4e2ed793675e515cfb8297ed355b upstream. + +Another variant of the RT Systems programming cable for ham radios. + +Signed-off-by: Michael Stuermer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 1 + + drivers/usb/serial/ftdi_sio_ids.h | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -696,6 +696,7 @@ static struct usb_device_id id_table_com + .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk }, + { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) }, + { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_SERIAL_VX7_PID) }, ++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_CT29B_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_MAXSTREAM_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_PHI_FISCO_PID) }, + { USB_DEVICE(TML_VID, TML_USB_SERIAL_PID) }, +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -721,6 +721,7 @@ + */ + #define RTSYSTEMS_VID 0x2100 /* Vendor ID */ + #define RTSYSTEMS_SERIAL_VX7_PID 0x9e52 /* Serial converter for VX-7 Radios using FT232RL */ ++#define RTSYSTEMS_CT29B_PID 0x9e54 /* CT29B Radio Cable */ + + /* + * Bayer Ascensia Contour blood glucose meter USB-converter cable. diff --git a/queue-2.6.36/usb-misc-cypress_cy7c63-fix-up-some-sysfs-attribute-permissions.patch b/queue-2.6.36/usb-misc-cypress_cy7c63-fix-up-some-sysfs-attribute-permissions.patch new file mode 100644 index 00000000000..a911a2f8ef6 --- /dev/null +++ b/queue-2.6.36/usb-misc-cypress_cy7c63-fix-up-some-sysfs-attribute-permissions.patch @@ -0,0 +1,35 @@ +From c990600d340641150f7270470a64bd99a5c0b225 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Mon, 15 Nov 2010 11:32:38 -0800 +Subject: USB: misc: cypress_cy7c63: fix up some sysfs attribute permissions + +From: Greg Kroah-Hartman + +commit c990600d340641150f7270470a64bd99a5c0b225 upstream. + +They should not be writable by any user. + +Reported-by: Linus Torvalds +Cc: Oliver Bock +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/cypress_cy7c63.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/usb/misc/cypress_cy7c63.c ++++ b/drivers/usb/misc/cypress_cy7c63.c +@@ -196,11 +196,9 @@ static ssize_t get_port1_handler(struct + return read_port(dev, attr, buf, 1, CYPRESS_READ_PORT_ID1); + } + +-static DEVICE_ATTR(port0, S_IWUGO | S_IRUGO, +- get_port0_handler, set_port0_handler); ++static DEVICE_ATTR(port0, S_IRUGO | S_IWUSR, get_port0_handler, set_port0_handler); + +-static DEVICE_ATTR(port1, S_IWUGO | S_IRUGO, +- get_port1_handler, set_port1_handler); ++static DEVICE_ATTR(port1, S_IRUGO | S_IWUSR, get_port1_handler, set_port1_handler); + + + static int cypress_probe(struct usb_interface *interface, diff --git a/queue-2.6.36/usb-misc-trancevibrator-fix-up-a-sysfs-attribute-permission.patch b/queue-2.6.36/usb-misc-trancevibrator-fix-up-a-sysfs-attribute-permission.patch new file mode 100644 index 00000000000..c3d0cf57854 --- /dev/null +++ b/queue-2.6.36/usb-misc-trancevibrator-fix-up-a-sysfs-attribute-permission.patch @@ -0,0 +1,30 @@ +From d489a4b3926bad571d404ca6508f6744b9602776 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Mon, 15 Nov 2010 11:34:26 -0800 +Subject: USB: misc: trancevibrator: fix up a sysfs attribute permission + +From: Greg Kroah-Hartman + +commit d489a4b3926bad571d404ca6508f6744b9602776 upstream. + +It should not be writable by any user. + +Reported-by: Linus Torvalds +Cc: Sam Hocevar +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/trancevibrator.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/misc/trancevibrator.c ++++ b/drivers/usb/misc/trancevibrator.c +@@ -86,7 +86,7 @@ static ssize_t set_speed(struct device * + return count; + } + +-static DEVICE_ATTR(speed, S_IWUGO | S_IRUGO, show_speed, set_speed); ++static DEVICE_ATTR(speed, S_IRUGO | S_IWUSR, show_speed, set_speed); + + static int tv_probe(struct usb_interface *interface, + const struct usb_device_id *id) diff --git a/queue-2.6.36/usb-misc-usbled-fix-up-some-sysfs-attribute-permissions.patch b/queue-2.6.36/usb-misc-usbled-fix-up-some-sysfs-attribute-permissions.patch new file mode 100644 index 00000000000..71be6253b1a --- /dev/null +++ b/queue-2.6.36/usb-misc-usbled-fix-up-some-sysfs-attribute-permissions.patch @@ -0,0 +1,29 @@ +From 48f115470e68d443436b76b22dad63ffbffd6b97 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Mon, 15 Nov 2010 11:35:49 -0800 +Subject: USB: misc: usbled: fix up some sysfs attribute permissions + +From: Greg Kroah-Hartman + +commit 48f115470e68d443436b76b22dad63ffbffd6b97 upstream. + +They should not be writable by any user. + +Reported-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/usbled.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/misc/usbled.c ++++ b/drivers/usb/misc/usbled.c +@@ -94,7 +94,7 @@ static ssize_t set_##value(struct device + change_color(led); \ + return count; \ + } \ +-static DEVICE_ATTR(value, S_IWUGO | S_IRUGO, show_##value, set_##value); ++static DEVICE_ATTR(value, S_IRUGO | S_IWUSR, show_##value, set_##value); + show_set(blue); + show_set(red); + show_set(green); diff --git a/queue-2.6.36/usb-misc-usbsevseg-fix-up-some-sysfs-attribute-permissions.patch b/queue-2.6.36/usb-misc-usbsevseg-fix-up-some-sysfs-attribute-permissions.patch new file mode 100644 index 00000000000..23bf142bca2 --- /dev/null +++ b/queue-2.6.36/usb-misc-usbsevseg-fix-up-some-sysfs-attribute-permissions.patch @@ -0,0 +1,59 @@ +From e24d7ace4e822debcb78386bf279c9aba4d7fbd1 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Mon, 15 Nov 2010 11:36:44 -0800 +Subject: USB: misc: usbsevseg: fix up some sysfs attribute permissions + +From: Greg Kroah-Hartman + +commit e24d7ace4e822debcb78386bf279c9aba4d7fbd1 upstream. + +They should not be writable by any user. + +Reported-by: Linus Torvalds +Cc: Harrison Metzger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/usbsevseg.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +--- a/drivers/usb/misc/usbsevseg.c ++++ b/drivers/usb/misc/usbsevseg.c +@@ -192,7 +192,7 @@ static ssize_t set_attr_##name(struct de + \ + return count; \ + } \ +-static DEVICE_ATTR(name, S_IWUGO | S_IRUGO, show_attr_##name, set_attr_##name); ++static DEVICE_ATTR(name, S_IRUGO | S_IWUSR, show_attr_##name, set_attr_##name); + + static ssize_t show_attr_text(struct device *dev, + struct device_attribute *attr, char *buf) +@@ -223,7 +223,7 @@ static ssize_t set_attr_text(struct devi + return count; + } + +-static DEVICE_ATTR(text, S_IWUGO | S_IRUGO, show_attr_text, set_attr_text); ++static DEVICE_ATTR(text, S_IRUGO | S_IWUSR, show_attr_text, set_attr_text); + + static ssize_t show_attr_decimals(struct device *dev, + struct device_attribute *attr, char *buf) +@@ -272,8 +272,7 @@ static ssize_t set_attr_decimals(struct + return count; + } + +-static DEVICE_ATTR(decimals, S_IWUGO | S_IRUGO, +- show_attr_decimals, set_attr_decimals); ++static DEVICE_ATTR(decimals, S_IRUGO | S_IWUSR, show_attr_decimals, set_attr_decimals); + + static ssize_t show_attr_textmode(struct device *dev, + struct device_attribute *attr, char *buf) +@@ -319,8 +318,7 @@ static ssize_t set_attr_textmode(struct + return -EINVAL; + } + +-static DEVICE_ATTR(textmode, S_IWUGO | S_IRUGO, +- show_attr_textmode, set_attr_textmode); ++static DEVICE_ATTR(textmode, S_IRUGO | S_IWUSR, show_attr_textmode, set_attr_textmode); + + + MYDEV_ATTR_SIMPLE_UNSIGNED(powered, update_display_powered); diff --git a/queue-2.6.36/usb-serial-ftdi_sio-vardaan-usb-rs422-485-converter-pid-added.patch b/queue-2.6.36/usb-serial-ftdi_sio-vardaan-usb-rs422-485-converter-pid-added.patch new file mode 100644 index 00000000000..2e93bf7213c --- /dev/null +++ b/queue-2.6.36/usb-serial-ftdi_sio-vardaan-usb-rs422-485-converter-pid-added.patch @@ -0,0 +1,45 @@ +From 6fdbad8021151a9e93af8159a6232c8f26415c09 Mon Sep 17 00:00:00 2001 +From: Jacques Viviers +Date: Wed, 24 Nov 2010 11:56:38 +0200 +Subject: USB: serial: ftdi_sio: Vardaan USB RS422/485 converter PID added + +From: Jacques Viviers + +commit 6fdbad8021151a9e93af8159a6232c8f26415c09 upstream. + +Add the PID for the Vardaan Enterprises VEUSB422R3 USB to RS422/485 +converter. It uses the same chip as the FTDI_8U232AM_PID 0x6001. + +This should also work with the stable branches for: +2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36 + +Signed-off-by: Jacques Viviers +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 1 + + drivers/usb/serial/ftdi_sio_ids.h | 3 +++ + 2 files changed, 4 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -201,6 +201,7 @@ static struct usb_device_id id_table_com + { USB_DEVICE(FTDI_VID, FTDI_MTXORB_5_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_MTXORB_6_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_R2000KU_TRUE_RNG) }, ++ { USB_DEVICE(FTDI_VID, FTDI_VARDAAN_PID) }, + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0100_PID) }, + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0101_PID) }, + { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_0102_PID) }, +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -114,6 +114,9 @@ + /* Lenz LI-USB Computer Interface. */ + #define FTDI_LENZ_LIUSB_PID 0xD780 + ++/* Vardaan Enterprises Serial Interface VEUSB422R3 */ ++#define FTDI_VARDAAN_PID 0xF070 ++ + /* + * Xsens Technologies BV products (http://www.xsens.com). + */ diff --git a/queue-2.6.36/x86-ignore-trap-bits-on-single-step-exceptions.patch b/queue-2.6.36/x86-ignore-trap-bits-on-single-step-exceptions.patch new file mode 100644 index 00000000000..9de0b0ff5ce --- /dev/null +++ b/queue-2.6.36/x86-ignore-trap-bits-on-single-step-exceptions.patch @@ -0,0 +1,49 @@ +From 6c0aca288e726405b01dacb12cac556454d34b2a Mon Sep 17 00:00:00 2001 +From: Frederic Weisbecker +Date: Thu, 11 Nov 2010 21:18:43 +0100 +Subject: x86: Ignore trap bits on single step exceptions + +From: Frederic Weisbecker + +commit 6c0aca288e726405b01dacb12cac556454d34b2a upstream. + +When a single step exception fires, the trap bits, used to +signal hardware breakpoints, are in a random state. + +These trap bits might be set if another exception will follow, +like a breakpoint in the next instruction, or a watchpoint in the +previous one. Or there can be any junk there. + +So if we handle these trap bits during the single step exception, +we are going to handle an exception twice, or we are going to +handle junk. + +Just ignore them in this case. + +This fixes https://bugzilla.kernel.org/show_bug.cgi?id=21332 + +Reported-by: Michael Stefaniuc +Signed-off-by: Frederic Weisbecker +Cc: Rafael J. Wysocki +Cc: Maciej Rutecki +Cc: Alexandre Julliard +Cc: Jason Wessel +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/hw_breakpoint.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/arch/x86/kernel/hw_breakpoint.c ++++ b/arch/x86/kernel/hw_breakpoint.c +@@ -433,6 +433,10 @@ static int __kprobes hw_breakpoint_handl + dr6_p = (unsigned long *)ERR_PTR(args->err); + dr6 = *dr6_p; + ++ /* If it's a single step, TRAP bits are random */ ++ if (dr6 & DR_STEP) ++ return NOTIFY_DONE; ++ + /* Do an early return if no trap bits are set in DR6 */ + if ((dr6 & DR_TRAP_BITS) == 0) + return NOTIFY_DONE;