--- /dev/null
+From jejb@kernel.org Tue Sep 2 17:12:30 2008
+From: Pavel Emelyanov <xemul@openvz.org>
+Date: Wed, 20 Aug 2008 22:50:13 GMT
+Subject: binfmt_misc: fix false -ENOEXEC when coupled with other binary handlers
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200808202250.m7KMoDYW016271@hera.kernel.org>
+
+From: Pavel Emelyanov <xemul@openvz.org>
+
+commit ff9bc512f198eb47204f55b24c6fe3d36ed89592 upstream
+
+Date: Wed, 20 Aug 2008 14:09:10 -0700
+Subject: binfmt_misc: fix false -ENOEXEC when coupled with other binary handlers
+
+In case the binfmt_misc binary handler is registered *before* the e.g.
+script one (when for example being compiled as a module) the following
+situation may occur:
+
+1. user launches a script, whose interpreter is a misc binary;
+2. the load_misc_binary sets the misc_bang and returns -ENOEVEC,
+ since the binary is a script;
+3. the load_script_binary loads one and calls for search_binary_hander
+ to run the interpreter;
+4. the load_misc_binary is called again, but refuses to load the
+ binary due to misc_bang bit set.
+
+The fix is to move the misc_bang setting lower - prior to the actual
+call to the search_binary_handler.
+
+Caused by the commit 3a2e7f47 (binfmt_misc.c: avoid potential kernel
+stack overflow)
+
+Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
+Reported-by: Kirill A. Shutemov <kirill@shutemov.name>
+Tested-by: Kirill A. Shutemov <kirill@shutemov.name>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/binfmt_misc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/binfmt_misc.c
++++ b/fs/binfmt_misc.c
+@@ -119,8 +119,6 @@ static int load_misc_binary(struct linux
+ if (bprm->misc_bang)
+ goto _ret;
+
+- bprm->misc_bang = 1;
+-
+ /* to keep locking time low, we copy the interpreter string */
+ read_lock(&entries_lock);
+ fmt = check_file(bprm);
+@@ -198,6 +196,8 @@ static int load_misc_binary(struct linux
+ if (retval < 0)
+ goto _error;
+
++ bprm->misc_bang = 1;
++
+ retval = search_binary_handler (bprm, regs);
+ if (retval < 0)
+ goto _error;
--- /dev/null
+From jejb@kernel.org Tue Sep 2 17:06:27 2008
+From: Al Viro <viro@ZenIV.linux.org.uk>
+Date: Wed, 20 Aug 2008 22:50:04 GMT
+Subject: cramfs: fix named-pipe handling
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200808202250.m7KMo468016214@hera.kernel.org>
+
+
+commit 82d63fc9e30687c055b97928942b8893ea65b0bb upstream
+
+From: Al Viro <viro@ZenIV.linux.org.uk>
+
+After commit a97c9bf33f4612e2aed6f000f6b1d268b6814f3c (fix cramfs
+making duplicate entries in inode cache) in kernel 2.6.14, named-pipe
+on cramfs does not work properly.
+
+It seems the commit make all named-pipe on cramfs share their inode
+(and named-pipe buffer).
+
+Make ..._test() refuse to merge inodes with ->i_ino == 1, take inode setup
+back to get_cramfs_inode() and make ->drop_inode() evict ones with ->i_ino
+== 1 immediately.
+
+Reported-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cramfs/inode.c | 84 ++++++++++++++++++++++++------------------------------
+ 1 file changed, 38 insertions(+), 46 deletions(-)
+
+--- a/fs/cramfs/inode.c
++++ b/fs/cramfs/inode.c
+@@ -43,58 +43,13 @@ static DEFINE_MUTEX(read_mutex);
+ static int cramfs_iget5_test(struct inode *inode, void *opaque)
+ {
+ struct cramfs_inode *cramfs_inode = opaque;
+-
+- if (inode->i_ino != CRAMINO(cramfs_inode))
+- return 0; /* does not match */
+-
+- if (inode->i_ino != 1)
+- return 1;
+-
+- /* all empty directories, char, block, pipe, and sock, share inode #1 */
+-
+- if ((inode->i_mode != cramfs_inode->mode) ||
+- (inode->i_gid != cramfs_inode->gid) ||
+- (inode->i_uid != cramfs_inode->uid))
+- return 0; /* does not match */
+-
+- if ((S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode)) &&
+- (inode->i_rdev != old_decode_dev(cramfs_inode->size)))
+- return 0; /* does not match */
+-
+- return 1; /* matches */
++ return inode->i_ino == CRAMINO(cramfs_inode) && inode->i_ino != 1;
+ }
+
+ static int cramfs_iget5_set(struct inode *inode, void *opaque)
+ {
+- static struct timespec zerotime;
+ struct cramfs_inode *cramfs_inode = opaque;
+- inode->i_mode = cramfs_inode->mode;
+- inode->i_uid = cramfs_inode->uid;
+- inode->i_size = cramfs_inode->size;
+- inode->i_blocks = (cramfs_inode->size - 1) / 512 + 1;
+- inode->i_gid = cramfs_inode->gid;
+- /* Struct copy intentional */
+- inode->i_mtime = inode->i_atime = inode->i_ctime = zerotime;
+ inode->i_ino = CRAMINO(cramfs_inode);
+- /* inode->i_nlink is left 1 - arguably wrong for directories,
+- but it's the best we can do without reading the directory
+- contents. 1 yields the right result in GNU find, even
+- without -noleaf option. */
+- if (S_ISREG(inode->i_mode)) {
+- inode->i_fop = &generic_ro_fops;
+- inode->i_data.a_ops = &cramfs_aops;
+- } else if (S_ISDIR(inode->i_mode)) {
+- inode->i_op = &cramfs_dir_inode_operations;
+- inode->i_fop = &cramfs_directory_operations;
+- } else if (S_ISLNK(inode->i_mode)) {
+- inode->i_op = &page_symlink_inode_operations;
+- inode->i_data.a_ops = &cramfs_aops;
+- } else {
+- inode->i_size = 0;
+- inode->i_blocks = 0;
+- init_special_inode(inode, inode->i_mode,
+- old_decode_dev(cramfs_inode->size));
+- }
+ return 0;
+ }
+
+@@ -104,12 +59,48 @@ static struct inode *get_cramfs_inode(st
+ struct inode *inode = iget5_locked(sb, CRAMINO(cramfs_inode),
+ cramfs_iget5_test, cramfs_iget5_set,
+ cramfs_inode);
++ static struct timespec zerotime;
++
+ if (inode && (inode->i_state & I_NEW)) {
++ inode->i_mode = cramfs_inode->mode;
++ inode->i_uid = cramfs_inode->uid;
++ inode->i_size = cramfs_inode->size;
++ inode->i_blocks = (cramfs_inode->size - 1) / 512 + 1;
++ inode->i_gid = cramfs_inode->gid;
++ /* Struct copy intentional */
++ inode->i_mtime = inode->i_atime = inode->i_ctime = zerotime;
++ /* inode->i_nlink is left 1 - arguably wrong for directories,
++ but it's the best we can do without reading the directory
++ contents. 1 yields the right result in GNU find, even
++ without -noleaf option. */
++ if (S_ISREG(inode->i_mode)) {
++ inode->i_fop = &generic_ro_fops;
++ inode->i_data.a_ops = &cramfs_aops;
++ } else if (S_ISDIR(inode->i_mode)) {
++ inode->i_op = &cramfs_dir_inode_operations;
++ inode->i_fop = &cramfs_directory_operations;
++ } else if (S_ISLNK(inode->i_mode)) {
++ inode->i_op = &page_symlink_inode_operations;
++ inode->i_data.a_ops = &cramfs_aops;
++ } else {
++ inode->i_size = 0;
++ inode->i_blocks = 0;
++ init_special_inode(inode, inode->i_mode,
++ old_decode_dev(cramfs_inode->size));
++ }
+ unlock_new_inode(inode);
+ }
+ return inode;
+ }
+
++static void cramfs_drop_inode(struct inode *inode)
++{
++ if (inode->i_ino == 1)
++ generic_delete_inode(inode);
++ else
++ generic_drop_inode(inode);
++}
++
+ /*
+ * We have our own block cache: don't fill up the buffer cache
+ * with the rom-image, because the way the filesystem is set
+@@ -534,6 +525,7 @@ static const struct super_operations cra
+ .put_super = cramfs_put_super,
+ .remount_fs = cramfs_remount,
+ .statfs = cramfs_statfs,
++ .drop_inode = cramfs_drop_inode,
+ };
+
+ static int cramfs_get_sb(struct file_system_type *fs_type,
--- /dev/null
+From jejb@kernel.org Tue Sep 2 17:08:36 2008
+From: Matthew Garrett <mjg59@srcf.ucam.org>
+Date: Wed, 20 Aug 2008 22:50:16 GMT
+Subject: eeepc-laptop: fix use after free
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200808202250.m7KMoGN6016295@hera.kernel.org>
+
+From: Matthew Garrett <mjg59@srcf.ucam.org>
+
+commit f14413184b1de4dcbd5ec3e7c129c3ce2079f543 upstream
+
+Date: Wed, 20 Aug 2008 14:08:57 -0700
+Subject: eeepc-laptop: fix use after free
+
+eeepc-laptop uses the hwmon struct after unregistering the device, causing
+an oops on module unload. Flip the ordering to fix.
+
+Signed-off-by: Matthew Garrett <mjg@redhat.com>
+Cc: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Cc: Corentin Chary <corentincj@iksaif.net>
+Cc: Karol Kozimor <sziwan@users.sourceforge.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/misc/eeepc-laptop.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/misc/eeepc-laptop.c
++++ b/drivers/misc/eeepc-laptop.c
+@@ -553,9 +553,9 @@ static void eeepc_hwmon_exit(void)
+ hwmon = eeepc_hwmon_device;
+ if (!hwmon)
+ return ;
+- hwmon_device_unregister(hwmon);
+ sysfs_remove_group(&hwmon->kobj,
+ &hwmon_attribute_group);
++ hwmon_device_unregister(hwmon);
+ eeepc_hwmon_device = NULL;
+ }
+
--- /dev/null
+From jejb@kernel.org Tue Sep 2 17:09:21 2008
+From: Ian Campbell <ijc@hellion.org.uk>
+Date: Wed, 20 Aug 2008 22:50:11 GMT
+Subject: fbdefio: add set_page_dirty handler to deferred IO FB
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200808202250.m7KMoAHT016246@hera.kernel.org>
+
+From: Ian Campbell <ijc@hellion.org.uk>
+
+commit d847471d063663b9f36927d265c66a270c0cfaab upstream
+
+Fixes kernel BUG at lib/radix-tree.c:473.
+
+Previously the handler was incidentally provided by tmpfs but this was
+removed with:
+
+ commit 14fcc23fdc78e9d32372553ccf21758a9bd56fa1
+ Author: Hugh Dickins <hugh@veritas.com>
+ Date: Mon Jul 28 15:46:19 2008 -0700
+
+ tmpfs: fix kernel BUG in shmem_delete_inode
+
+relying on this behaviour was incorrect in any case and the BUG also
+appeared when the device node was on an ext3 filesystem.
+
+v2: override a_ops at open() time rather than mmap() time to minimise
+races per AKPM's concerns.
+
+Signed-off-by: Ian Campbell <ijc@hellion.org.uk>
+Cc: Jaya Kumar <jayakumar.lkml@gmail.com>
+Cc: Nick Piggin <npiggin@suse.de>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: Hugh Dickins <hugh@veritas.com>
+Cc: Johannes Weiner <hannes@saeurebad.de>
+Cc: Jeremy Fitzhardinge <jeremy@goop.org>
+Cc: Kel Modderman <kel@otaku42.de>
+Cc: Markus Armbruster <armbru@redhat.com>
+Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/fb_defio.c | 19 +++++++++++++++++++
+ drivers/video/fbmem.c | 4 ++++
+ include/linux/fb.h | 3 +++
+ 3 files changed, 26 insertions(+)
+
+--- a/drivers/video/fb_defio.c
++++ b/drivers/video/fb_defio.c
+@@ -114,6 +114,17 @@ static struct vm_operations_struct fb_de
+ .page_mkwrite = fb_deferred_io_mkwrite,
+ };
+
++static int fb_deferred_io_set_page_dirty(struct page *page)
++{
++ if (!PageDirty(page))
++ SetPageDirty(page);
++ return 0;
++}
++
++static const struct address_space_operations fb_deferred_io_aops = {
++ .set_page_dirty = fb_deferred_io_set_page_dirty,
++};
++
+ static int fb_deferred_io_mmap(struct fb_info *info, struct vm_area_struct *vma)
+ {
+ vma->vm_ops = &fb_deferred_io_vm_ops;
+@@ -163,6 +174,14 @@ void fb_deferred_io_init(struct fb_info
+ }
+ EXPORT_SYMBOL_GPL(fb_deferred_io_init);
+
++void fb_deferred_io_open(struct fb_info *info,
++ struct inode *inode,
++ struct file *file)
++{
++ file->f_mapping->a_ops = &fb_deferred_io_aops;
++}
++EXPORT_SYMBOL_GPL(fb_deferred_io_open);
++
+ void fb_deferred_io_cleanup(struct fb_info *info)
+ {
+ void *screen_base = (void __force *) info->screen_base;
+--- a/drivers/video/fbmem.c
++++ b/drivers/video/fbmem.c
+@@ -1340,6 +1340,10 @@ fb_open(struct inode *inode, struct file
+ if (res)
+ module_put(info->fbops->owner);
+ }
++#ifdef CONFIG_FB_DEFERRED_IO
++ if (info->fbdefio)
++ fb_deferred_io_open(info, inode, file);
++#endif
+ return res;
+ }
+
+--- a/include/linux/fb.h
++++ b/include/linux/fb.h
+@@ -973,6 +973,9 @@ static inline void __fb_pad_aligned_buff
+
+ /* drivers/video/fb_defio.c */
+ extern void fb_deferred_io_init(struct fb_info *info);
++extern void fb_deferred_io_open(struct fb_info *info,
++ struct inode *inode,
++ struct file *file);
+ extern void fb_deferred_io_cleanup(struct fb_info *info);
+ extern int fb_deferred_io_fsync(struct file *file, struct dentry *dentry,
+ int datasync);
--- /dev/null
+From jejb@kernel.org Tue Sep 2 17:07:15 2008
+From: Greg Kroah-Hartman <gregkh@suse.de>
+From: James Bottomley <jejb@kernel.org>
+Date: Mon, 25 Aug 2008 20:05:06 GMT
+Subject: PCI: fix reference leak in pci_get_dev_by_id()
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200808252005.m7PK56en010112@hera.kernel.org>
+
+From: Greg Kroah-Hartman <gregkh@suse.de>
+
+commit ebca4f1bce1eb7b91a63c515db66316db9391221 upstream
+
+Alex Chiang and Matthew Wilcox pointed out that pci_get_dev_by_id() does
+not properly decrement the reference on the from pointer if it is
+present, like the documentation for the function states it will.
+
+It fixes a pretty bad leak in the hotplug core (we were leaking an
+entire struct pci_dev for each function of each offlined card, the first
+time around; subsequent onlines/offlines were ok).
+
+Cc: Matthew Wilcox <matthew@wil.cx>
+Tested-by: Alex Chiang <achiang@hp.com>
+Acked-by: Alex Chiang <achiang@hp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+
+---
+ drivers/pci/search.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/pci/search.c
++++ b/drivers/pci/search.c
+@@ -280,6 +280,8 @@ static struct pci_dev *pci_get_dev_by_id
+ match_pci_dev_by_id);
+ if (dev)
+ pdev = to_pci_dev(dev);
++ if (from)
++ pci_dev_put(from);
+ return pdev;
+ }
+
--- /dev/null
+cramfs-fix-named-pipe-handling.patch
+pci-fix-reference-leak-in-pci_get_dev_by_id.patch
+eeepc-laptop-fix-use-after-free.patch
+fbdefio-add-set_page_dirty-handler-to-deferred-io-fb.patch
+binfmt_misc-fix-false-enoexec-when-coupled-with-other-binary-handlers.patch
+usb-cdc-acm-don-t-unlock-acm-mutex-on-error-path.patch
+x86-work-around-mtrr-mask-setting.patch
+x86-fix-kernel-won-t-boot-on-a-cyrix-mediagxm.patch
--- /dev/null
+From jejb@kernel.org Tue Sep 2 17:13:12 2008
+From: Alexey Dobriyan <adobriyan@gmail.com>
+Date: Fri, 22 Aug 2008 17:40:10 GMT
+Subject: USB: cdc-acm: don't unlock acm->mutex on error path
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200808221740.m7MHeAea013780@hera.kernel.org>
+
+From: Alexey Dobriyan <adobriyan@gmail.com>
+
+commit 74573ee7096a4ffc2f098108d21c85801b9c7434 upstream
+
+On Wed, Jul 23, 2008 at 03:52:36PM +0300, Andrei Popa wrote:
+> I installed gnokii-0.6.22-r2 and gave the command "gnokii --identify"
+> and the kernel oopsed:
+>
+> BUG: unable to handle kernel NULL pointer dereference at 00000458
+> IP: [<c0444b52>] mutex_unlock+0x0/0xb
+> [<c03830ae>] acm_tty_open+0x4c/0x214
+
+Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
+Tested-by: Andrei Popa <andrei.popa@i-neo.ro>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/class/cdc-acm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -525,8 +525,8 @@ static int acm_tty_open(struct tty_struc
+ tasklet_schedule(&acm->urb_task);
+
+ done:
+-err_out:
+ mutex_unlock(&acm->mutex);
++err_out:
+ mutex_unlock(&open_mutex);
+ return rv;
+
--- /dev/null
+From jejb@kernel.org Tue Sep 2 17:18:02 2008
+From: Samuel Sieb <samuel@sieb.net>
+Date: Fri, 22 Aug 2008 17:40:12 GMT
+Subject: x86: fix "kernel won't boot on a Cyrix MediaGXm (Geode)"
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200808221740.m7MHeCXF013842@hera.kernel.org>
+
+From: Samuel Sieb <samuel@sieb.net>
+
+commit c6744955d0ec0cb485c28c51eeb7185e260f6172 upstream
+
+Cyrix MediaGXm/Cx5530 Unicorn Revision 1.19.3B has stopped
+booting starting at v2.6.22.
+
+The reason is this commit:
+
+> commit f25f64ed5bd3c2932493681bdfdb483ea707da0a
+> Author: Juergen Beisert <juergen@kreuzholzen.de>
+> Date: Sun Jul 22 11:12:38 2007 +0200
+>
+> x86: Replace NSC/Cyrix specific chipset access macros by inlined functions.
+
+this commit activated a macro which was dormant before due to (buggy)
+macro side-effects.
+
+I've looked through various datasheets and found that the GXm and GXLV
+Geode processors don't have an incrementor.
+
+Remove the incrementor setup entirely. As the incrementor value
+differs according to clock speed and we would hope that the BIOS
+configures it correctly, it is probably the right solution.
+
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/cyrix.c | 18 ------------------
+ 1 file changed, 18 deletions(-)
+
+--- a/arch/x86/kernel/cpu/cyrix.c
++++ b/arch/x86/kernel/cpu/cyrix.c
+@@ -134,23 +134,6 @@ static void __cpuinit set_cx86_memwb(voi
+ setCx86(CX86_CCR2, getCx86(CX86_CCR2) | 0x14);
+ }
+
+-static void __cpuinit set_cx86_inc(void)
+-{
+- unsigned char ccr3;
+-
+- printk(KERN_INFO "Enable Incrementor on Cyrix/NSC processor.\n");
+-
+- ccr3 = getCx86(CX86_CCR3);
+- setCx86(CX86_CCR3, (ccr3 & 0x0f) | 0x10); /* enable MAPEN */
+- /* PCR1 -- Performance Control */
+- /* Incrementor on, whatever that is */
+- setCx86(CX86_PCR1, getCx86(CX86_PCR1) | 0x02);
+- /* PCR0 -- Performance Control */
+- /* Incrementor Margin 10 */
+- setCx86(CX86_PCR0, getCx86(CX86_PCR0) | 0x04);
+- setCx86(CX86_CCR3, ccr3); /* disable MAPEN */
+-}
+-
+ /*
+ * Configure later MediaGX and/or Geode processor.
+ */
+@@ -174,7 +157,6 @@ static void __cpuinit geode_configure(vo
+
+ set_cx86_memwb();
+ set_cx86_reorder();
+- set_cx86_inc();
+
+ local_irq_restore(flags);
+ }
--- /dev/null
+From jejb@kernel.org Tue Sep 2 17:14:12 2008
+From: Yinghai Lu <yhlu.kernel@gmail.com>
+Date: Fri, 22 Aug 2008 17:40:05 GMT
+Subject: x86: work around MTRR mask setting
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200808221740.m7MHe5ud013727@hera.kernel.org>
+
+From: Yinghai Lu <yhlu.kernel@gmail.com>
+
+commit 38cc1c3df77c1bb739a4766788eb9fa49f16ffdf upstream
+
+Joshua Hoblitt reported that only 3 GB of his 16 GB of RAM is
+usable. Booting with mtrr_show showed us the BIOS-initialized
+MTRR settings - which are all wrong.
+
+So the root cause is that the BIOS has not set the mask correctly:
+
+> [ 0.429971] MSR00000200: 00000000d0000000
+> [ 0.433305] MSR00000201: 0000000ff0000800
+> should be ==> [ 0.433305] MSR00000201: 0000003ff0000800
+>
+> [ 0.436638] MSR00000202: 00000000e0000000
+> [ 0.439971] MSR00000203: 0000000fe0000800
+> should be ==> [ 0.439971] MSR00000203: 0000003fe0000800
+>
+> [ 0.443304] MSR00000204: 0000000000000006
+> [ 0.446637] MSR00000205: 0000000c00000800
+> should be ==> [ 0.446637] MSR00000205: 0000003c00000800
+>
+> [ 0.449970] MSR00000206: 0000000400000006
+> [ 0.453303] MSR00000207: 0000000fe0000800
+> should be ==> [ 0.453303] MSR00000207: 0000003fe0000800
+>
+> [ 0.456636] MSR00000208: 0000000420000006
+> [ 0.459970] MSR00000209: 0000000ff0000800
+> should be ==> [ 0.459970] MSR00000209: 0000003ff0000800
+
+So detect this borkage and add the prefix 111.
+
+Signed-off-by: Yinghai Lu <yhlu.kernel@gmail.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/mtrr/generic.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/cpu/mtrr/generic.c
++++ b/arch/x86/kernel/cpu/mtrr/generic.c
+@@ -365,6 +365,7 @@ static void generic_get_mtrr(unsigned in
+ unsigned long *size, mtrr_type *type)
+ {
+ unsigned int mask_lo, mask_hi, base_lo, base_hi;
++ unsigned int tmp, hi;
+
+ rdmsr(MTRRphysMask_MSR(reg), mask_lo, mask_hi);
+ if ((mask_lo & 0x800) == 0) {
+@@ -378,8 +379,18 @@ static void generic_get_mtrr(unsigned in
+ rdmsr(MTRRphysBase_MSR(reg), base_lo, base_hi);
+
+ /* Work out the shifted address mask. */
+- mask_lo = size_or_mask | mask_hi << (32 - PAGE_SHIFT)
+- | mask_lo >> PAGE_SHIFT;
++ tmp = mask_hi << (32 - PAGE_SHIFT) | mask_lo >> PAGE_SHIFT;
++ mask_lo = size_or_mask | tmp;
++ /* Expand tmp with high bits to all 1s*/
++ hi = fls(tmp);
++ if (hi > 0) {
++ tmp |= ~((1<<(hi - 1)) - 1);
++
++ if (tmp != mask_lo) {
++ WARN_ON("mtrr: your BIOS has set up an incorrect mask, fixing it up.\n");
++ mask_lo = tmp;
++ }
++ }
+
+ /* This works correctly if size is a power of two, i.e. a
+ contiguous range. */
projects / thirdparty / kernel / stable-queue.git / commitdiff
