Sat Oct 10 15:04:36 UTC 2009

Author: myoung

Update of /cvs/pkgs/rpms/kernel/devel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv5055

Modified Files:
      Tag: private-myoung-dom0-branch
	.cvsignore config-generic config-powerpc-generic 
	config-x86_64-generic drm-nouveau.patch drm-vga-arb.patch 
	kernel.spec linux-2.6-intel-iommu-updates.patch 
	linux-2.6-nfsd4-proots.patch sources upstream xen.pvops.patch 
	xen.pvops.post.patch xen.pvops.pre.patch 
Added Files:
      Tag: private-myoung-dom0-branch
	drm-next-d4ac6a05.patch linux-2.6-frace-fixes.patch 
	linux-2.6-iwlwifi-reduce-noise-when-skb-allocation-fails.patch 
	linux-2.6-virtio_blk-add-support-for-cache-flush.patch 
	linux-2.6-xen-fix-is_disconnected_device-exists_disconnected_device.patch 
	linux-2.6-xen-improvement-to-wait_for_devices.patch 
	linux-2.6-xen-increase-device-connection-timeout.patch 
	linux-2.6.31-copy_from_user-bounds.patch 
	patch-2.6.31.3.bz2.sign 
Removed Files:
      Tag: private-myoung-dom0-branch
	drm-next-8ef8678c8.patch 
	linux-2.6-fix-usb-serial-autosuspend.diff 
	linux-2.6-iwlagn-modify-digital-SVR-for-1000.patch 
	linux-2.6-iwlwifi-Handle-new-firmware-file-with-ucode-build-number-in-header.patch 
	linux-2.6-iwlwifi-fix-debugfs-buffer-handling.patch 
	linux-2.6-iwlwifi-fix-unloading-driver-while-scanning.patch 
	linux-2.6-iwlwifi-remove-deprecated-6000-series-adapters.patch 
	linux-2.6-iwlwifi-traverse-linklist-to-find-the-valid-OTP-block.patch 
	linux-2.6-iwlwifi-update-1000-series-API-version-to-match-firmware.patch 
	linux-2.6-xen-check-efer-fix.patch 
	linux-2.6-xen-spinlock-enable-interrupts-only-when-blocking.patch 
	linux-2.6-xen-spinlock-stronger-barrier.patch 
	linux-2.6-xen-stack-protector-fix.patch 
	linux-2.6.31-cpufreq-powernow-k8-oops.patch 
	patch-2.6.31.1.bz2.sign 
	ppc-hates-my-family-and-swore-revenge.patch 
Log Message:
update pvops patch and try re-enabling DRM_RADEON and DRM_NOUVEAU


drm-next-d4ac6a05.patch:
 b/drivers/gpu/drm/Kconfig                         |   18 
 b/drivers/gpu/drm/Makefile                        |    8 
 b/drivers/gpu/drm/drm_bufs.c                      |    4 
 b/drivers/gpu/drm/drm_cache.c                     |   46 
 b/drivers/gpu/drm/drm_crtc.c                      |   78 
 b/drivers/gpu/drm/drm_crtc_helper.c               |  307 
 b/drivers/gpu/drm/drm_drv.c                       |    4 
 b/drivers/gpu/drm/drm_edid.c                      |  536 
 b/drivers/gpu/drm/drm_encoder_slave.c             |  116 
 b/drivers/gpu/drm/drm_fb_helper.c                 | 1014 
 b/drivers/gpu/drm/drm_gem.c                       |   11 
 b/drivers/gpu/drm/drm_mm.c                        |   21 
 b/drivers/gpu/drm/drm_modes.c                     |  434 
 b/drivers/gpu/drm/drm_proc.c                      |   17 
 b/drivers/gpu/drm/drm_sysfs.c                     |   28 
 b/drivers/gpu/drm/i915/Makefile                   |    2 
 b/drivers/gpu/drm/i915/i915_debugfs.c             |  445 
 b/drivers/gpu/drm/i915/i915_dma.c                 |  100 
 b/drivers/gpu/drm/i915/i915_drv.c                 |    9 
 b/drivers/gpu/drm/i915/i915_drv.h                 |   62 
 b/drivers/gpu/drm/i915/i915_gem.c                 |   14 
 b/drivers/gpu/drm/i915/i915_gem_tiling.c          |   65 
 b/drivers/gpu/drm/i915/i915_irq.c                 |   21 
 b/drivers/gpu/drm/i915/i915_reg.h                 |  139 
 b/drivers/gpu/drm/i915/i915_suspend.c             |    4 
 b/drivers/gpu/drm/i915/intel_bios.c               |    8 
 b/drivers/gpu/drm/i915/intel_crt.c                |   28 
 b/drivers/gpu/drm/i915/intel_display.c            |  608 
 b/drivers/gpu/drm/i915/intel_drv.h                |    9 
 b/drivers/gpu/drm/i915/intel_fb.c                 |  748 
 b/drivers/gpu/drm/i915/intel_i2c.c                |    8 
 b/drivers/gpu/drm/i915/intel_lvds.c               |   22 
 b/drivers/gpu/drm/i915/intel_sdvo.c               |  239 
 b/drivers/gpu/drm/i915/intel_tv.c                 |   30 
 b/drivers/gpu/drm/mga/mga_dma.c                   |    4 
 b/drivers/gpu/drm/mga/mga_drv.h                   |    1 
 b/drivers/gpu/drm/mga/mga_warp.c                  |  180 
 b/drivers/gpu/drm/r128/r128_cce.c                 |  116 
 b/drivers/gpu/drm/r128/r128_drv.h                 |    8 
 b/drivers/gpu/drm/r128/r128_state.c               |   36 
 b/drivers/gpu/drm/radeon/.gitignore               |    3 
 b/drivers/gpu/drm/radeon/Kconfig                  |    1 
 b/drivers/gpu/drm/radeon/Makefile                 |   43 
 b/drivers/gpu/drm/radeon/atombios.h               |   11 
 b/drivers/gpu/drm/radeon/atombios_crtc.c          |  106 
 b/drivers/gpu/drm/radeon/avivod.h                 |   60 
 b/drivers/gpu/drm/radeon/mkregtable.c             |  720 
 b/drivers/gpu/drm/radeon/r100.c                   | 1711 +
 b/drivers/gpu/drm/radeon/r100_track.h             |  183 
 b/drivers/gpu/drm/radeon/r100d.h                  |  714 
 b/drivers/gpu/drm/radeon/r200.c                   |  454 
 b/drivers/gpu/drm/radeon/r300.c                   |  979 
 b/drivers/gpu/drm/radeon/r300d.h                  |  306 
 b/drivers/gpu/drm/radeon/r420.c                   |  305 
 b/drivers/gpu/drm/radeon/r420d.h                  |  249 
 b/drivers/gpu/drm/radeon/r500_reg.h               |    3 
 b/drivers/gpu/drm/radeon/r520.c                   |  281 
 b/drivers/gpu/drm/radeon/r520d.h                  |  187 
 b/drivers/gpu/drm/radeon/r600.c                   | 1817 +
 b/drivers/gpu/drm/radeon/r600_blit.c              |  846 
 b/drivers/gpu/drm/radeon/r600_blit_kms.c          |  806 
 b/drivers/gpu/drm/radeon/r600_blit_shaders.c      | 1072 +
 b/drivers/gpu/drm/radeon/r600_blit_shaders.h      |   14 
 b/drivers/gpu/drm/radeon/r600_cp.c                |  541 
 b/drivers/gpu/drm/radeon/r600_cs.c                |  783 
 b/drivers/gpu/drm/radeon/r600d.h                  |  662 
 b/drivers/gpu/drm/radeon/radeon.h                 |  438 
 b/drivers/gpu/drm/radeon/radeon_asic.h            |  351 
 b/drivers/gpu/drm/radeon/radeon_atombios.c        |  180 
 b/drivers/gpu/drm/radeon/radeon_bios.c            |   49 
 b/drivers/gpu/drm/radeon/radeon_clocks.c          |   18 
 b/drivers/gpu/drm/radeon/radeon_combios.c         |   58 
 b/drivers/gpu/drm/radeon/radeon_connectors.c      |  545 
 b/drivers/gpu/drm/radeon/radeon_cp.c              |  151 
 b/drivers/gpu/drm/radeon/radeon_cs.c              |  104 
 b/drivers/gpu/drm/radeon/radeon_device.c          |  303 
 b/drivers/gpu/drm/radeon/radeon_display.c         |  146 
 b/drivers/gpu/drm/radeon/radeon_drv.c             |   28 
 b/drivers/gpu/drm/radeon/radeon_drv.h             |  216 
 b/drivers/gpu/drm/radeon/radeon_encoders.c        |  143 
 b/drivers/gpu/drm/radeon/radeon_family.h          |   97 
 b/drivers/gpu/drm/radeon/radeon_fb.c              |  694 
 b/drivers/gpu/drm/radeon/radeon_fence.c           |   49 
 b/drivers/gpu/drm/radeon/radeon_gart.c            |    9 
 b/drivers/gpu/drm/radeon/radeon_ioc32.c           |   15 
 b/drivers/gpu/drm/radeon/radeon_irq.c             |   18 
 b/drivers/gpu/drm/radeon/radeon_irq_kms.c         |    7 
 b/drivers/gpu/drm/radeon/radeon_kms.c             |   74 
 b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c     |   86 
 b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c |  377 
 b/drivers/gpu/drm/radeon/radeon_legacy_tv.c       |  904 
 b/drivers/gpu/drm/radeon/radeon_mode.h            |   76 
 b/drivers/gpu/drm/radeon/radeon_object.c          |   27 
 b/drivers/gpu/drm/radeon/radeon_object.h          |    1 
 b/drivers/gpu/drm/radeon/radeon_reg.h             |   80 
 b/drivers/gpu/drm/radeon/radeon_ring.c            |  143 
 b/drivers/gpu/drm/radeon/radeon_state.c           |   23 
 b/drivers/gpu/drm/radeon/radeon_ttm.c             |   95 
 b/drivers/gpu/drm/radeon/reg_srcs/r100            |  105 
 b/drivers/gpu/drm/radeon/reg_srcs/r200            |  184 
 b/drivers/gpu/drm/radeon/reg_srcs/r300            |  729 
 b/drivers/gpu/drm/radeon/reg_srcs/rn50            |   30 
 b/drivers/gpu/drm/radeon/reg_srcs/rs600           |  729 
 b/drivers/gpu/drm/radeon/reg_srcs/rv515           |  486 
 b/drivers/gpu/drm/radeon/rs100d.h                 |   40 
 b/drivers/gpu/drm/radeon/rs400.c                  |  329 
 b/drivers/gpu/drm/radeon/rs400d.h                 |  160 
 b/drivers/gpu/drm/radeon/rs600.c                  |  591 
 b/drivers/gpu/drm/radeon/rs600d.h                 |  470 
 b/drivers/gpu/drm/radeon/rs690.c                  |  358 
 b/drivers/gpu/drm/radeon/rs690d.h                 |  307 
 b/drivers/gpu/drm/radeon/rv200d.h                 |   36 
 b/drivers/gpu/drm/radeon/rv250d.h                 |  123 
 b/drivers/gpu/drm/radeon/rv350d.h                 |   52 
 b/drivers/gpu/drm/radeon/rv515.c                  |  881 
 b/drivers/gpu/drm/radeon/rv515d.h                 |  603 
 b/drivers/gpu/drm/radeon/rv770.c                  | 1034 
 b/drivers/gpu/drm/radeon/rv770d.h                 |  341 
 b/drivers/gpu/drm/ttm/ttm_bo.c                    |  295 
 b/drivers/gpu/drm/ttm/ttm_bo_util.c               |    4 
 b/drivers/gpu/drm/ttm/ttm_global.c                |    6 
 b/drivers/gpu/drm/ttm/ttm_memory.c                |  508 
 b/drivers/gpu/drm/ttm/ttm_module.c                |   58 
 b/drivers/gpu/drm/ttm/ttm_tt.c                    |  104 
 b/drivers/video/fbmem.c                           |    2 
 b/firmware/Makefile                               |   16 
 b/firmware/WHENCE                                 |  121 
 b/firmware/matrox/g200_warp.H16                   |   28 
 b/firmware/matrox/g400_warp.H16                   |   44 
 b/firmware/r128/r128_cce.bin.ihex                 |  129 
 b/firmware/radeon/R100_cp.bin.ihex                |  130 
 b/firmware/radeon/R200_cp.bin.ihex                |  130 
 b/firmware/radeon/R300_cp.bin.ihex                |  130 
 b/firmware/radeon/R420_cp.bin.ihex                |  130 
 b/firmware/radeon/R520_cp.bin.ihex                |  130 
 b/firmware/radeon/R600_me.bin.ihex                | 1345 +
 b/firmware/radeon/R600_pfp.bin.ihex               |  145 
 b/firmware/radeon/RS600_cp.bin.ihex               |  130 
 b/firmware/radeon/RS690_cp.bin.ihex               |  130 
 b/firmware/radeon/RS780_me.bin.ihex               | 1345 +
 b/firmware/radeon/RS780_pfp.bin.ihex              |  145 
 b/firmware/radeon/RV610_me.bin.ihex               | 1345 +
 b/firmware/radeon/RV610_pfp.bin.ihex              |  145 
 b/firmware/radeon/RV620_me.bin.ihex               | 1345 +
 b/firmware/radeon/RV620_pfp.bin.ihex              |  145 
 b/firmware/radeon/RV630_me.bin.ihex               | 1345 +
 b/firmware/radeon/RV630_pfp.bin.ihex              |  145 
 b/firmware/radeon/RV635_me.bin.ihex               | 1345 +
 b/firmware/radeon/RV635_pfp.bin.ihex              |  145 
 b/firmware/radeon/RV670_me.bin.ihex               | 1345 +
 b/firmware/radeon/RV670_pfp.bin.ihex              |  145 
 b/firmware/radeon/RV710_me.bin.ihex               |  341 
 b/firmware/radeon/RV710_pfp.bin.ihex              |  213 
 b/firmware/radeon/RV730_me.bin.ihex               |  341 
 b/firmware/radeon/RV730_pfp.bin.ihex              |  213 
 b/firmware/radeon/RV770_me.bin.ihex               |  341 
 b/firmware/radeon/RV770_pfp.bin.ihex              |  213 
 b/include/drm/drmP.h                              |   54 
 b/include/drm/drm_cache.h                         |   38 
 b/include/drm/drm_crtc.h                          |   28 
 b/include/drm/drm_crtc_helper.h                   |   10 
 b/include/drm/drm_encoder_slave.h                 |  162 
 b/include/drm/drm_fb_helper.h                     |  111 
 b/include/drm/drm_mm.h                            |    7 
 b/include/drm/drm_mode.h                          |   11 
 b/include/drm/drm_pciids.h                        |    4 
 b/include/drm/drm_sysfs.h                         |   12 
 b/include/drm/radeon_drm.h                        |   12 
 b/include/drm/ttm/ttm_bo_api.h                    |   13 
 b/include/drm/ttm/ttm_bo_driver.h                 |   94 
 b/include/drm/ttm/ttm_memory.h                    |   43 
 b/include/drm/ttm/ttm_module.h                    |    2 
 drivers/gpu/drm/i915/i915_gem_debugfs.c           |  396 
 drivers/gpu/drm/mga/mga_ucode.h                   |11645 ----------
 drivers/gpu/drm/radeon/r300.h                     |   36 
 drivers/gpu/drm/radeon/r600_microcode.h           |23297 ----------------------
 drivers/gpu/drm/radeon/radeon_microcode.h         | 1844 -
 drivers/gpu/drm/radeon/radeon_share.h             |   39 
 drivers/gpu/drm/radeon/rs690r.h                   |   99 
 drivers/gpu/drm/radeon/rs780.c                    |  102 
 drivers/gpu/drm/radeon/rv515r.h                   |  170 
 181 files changed, 40597 insertions(+), 43447 deletions(-)

--- NEW FILE drm-next-d4ac6a05.patch ---

diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index 39b393d..e4d971c 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -18,6 +18,14 @@ menuconfig DRM
 	  details.  You should also select and configure AGP
 	  (/dev/agpgart) support.
 
+config DRM_KMS_HELPER
+	tristate
+	depends on DRM
+	select FB
+	select FRAMEBUFFER_CONSOLE if !EMBEDDED
+	help
+	  FB and CRTC helpers for KMS drivers.
+
 config DRM_TTM
 	tristate
 	depends on DRM
@@ -36,6 +44,7 @@ config DRM_TDFX
 config DRM_R128
 	tristate "ATI Rage 128"
 	depends on DRM && PCI
+	select FW_LOADER
 	help
 	  Choose this option if you have an ATI Rage 128 graphics card.  If M
 	  is selected, the module will be called r128.  AGP support for
@@ -47,8 +56,9 @@ config DRM_RADEON
 	select FB_CFB_FILLRECT
 	select FB_CFB_COPYAREA
 	select FB_CFB_IMAGEBLIT
-	select FB
-	select FRAMEBUFFER_CONSOLE if !EMBEDDED
+	select FW_LOADER
+        select DRM_KMS_HELPER
+        select DRM_TTM
 	help
 	  Choose this option if you have an ATI Radeon graphics card.  There
 	  are both PCI and AGP versions.  You don't need to choose this to
@@ -82,11 +92,10 @@ config DRM_I830
 config DRM_I915
 	tristate "i915 driver"
 	depends on AGP_INTEL
+	select DRM_KMS_HELPER
 	select FB_CFB_FILLRECT
 	select FB_CFB_COPYAREA
 	select FB_CFB_IMAGEBLIT
-	select FB
-	select FRAMEBUFFER_CONSOLE if !EMBEDDED
 	# i915 depends on ACPI_VIDEO when ACPI is enabled
 	# but for select to work, need to select ACPI_VIDEO's dependencies, ick
 	select VIDEO_OUTPUT_CONTROL if ACPI
@@ -116,6 +125,7 @@ endchoice
 config DRM_MGA
 	tristate "Matrox g200/g400"
 	depends on DRM
+	select FW_LOADER
 	help
 	  Choose this option if you have a Matrox G200, G400 or G450 graphics
 	  card.  If M is selected, the module will be called mga.  AGP
diff --git a/drivers/gpu/drm/Makefile b/drivers/gpu/drm/Makefile
index fe23f29..3c8827a 100644
--- a/drivers/gpu/drm/Makefile
+++ b/drivers/gpu/drm/Makefile
@@ -10,11 +10,15 @@ drm-y       :=	drm_auth.o drm_bufs.o drm_cache.o \
 		drm_lock.o drm_memory.o drm_proc.o drm_stub.o drm_vm.o \
 		drm_agpsupport.o drm_scatter.o ati_pcigart.o drm_pci.o \
 		drm_sysfs.o drm_hashtab.o drm_sman.o drm_mm.o \
-		drm_crtc.o drm_crtc_helper.o drm_modes.o drm_edid.o \
-		drm_info.o drm_debugfs.o
+		drm_crtc.o drm_modes.o drm_edid.o \
+		drm_info.o drm_debugfs.o drm_encoder_slave.o
 
 drm-$(CONFIG_COMPAT) += drm_ioc32.o
 
+drm_kms_helper-y := drm_fb_helper.o drm_crtc_helper.o
+
+obj-$(CONFIG_DRM_KMS_HELPER) += drm_kms_helper.o
+
 obj-$(CONFIG_DRM)	+= drm.o
 obj-$(CONFIG_DRM_TTM)	+= ttm/
 obj-$(CONFIG_DRM_TDFX)	+= tdfx/
diff --git a/drivers/gpu/drm/drm_bufs.c b/drivers/gpu/drm/drm_bufs.c
index 6246e3f..3d09e30 100644
--- a/drivers/gpu/drm/drm_bufs.c
+++ b/drivers/gpu/drm/drm_bufs.c
@@ -310,10 +310,10 @@ static int drm_addmap_core(struct drm_device * dev, resource_size_t offset,
 			  (unsigned long long)map->offset, map->size);
 
 		break;
+	}
 	case _DRM_GEM:
-		DRM_ERROR("tried to rmmap GEM object\n");
+		DRM_ERROR("tried to addmap GEM object\n");
 		break;
-	}
 	case _DRM_SCATTER_GATHER:
 		if (!dev->sg) {
 			kfree(map);
diff --git a/drivers/gpu/drm/drm_cache.c b/drivers/gpu/drm/drm_cache.c
index 0e994a0..0e3bd5b 100644
--- a/drivers/gpu/drm/drm_cache.c
+++ b/drivers/gpu/drm/drm_cache.c
@@ -45,6 +45,23 @@ drm_clflush_page(struct page *page)
 		clflush(page_virtual + i);
 	kunmap_atomic(page_virtual, KM_USER0);
 }
+
+static void drm_cache_flush_clflush(struct page *pages[],
+				    unsigned long num_pages)
+{
+	unsigned long i;
+
+	mb();
+	for (i = 0; i < num_pages; i++)
+		drm_clflush_page(*pages++);
+	mb();
+}
+
+static void
+drm_clflush_ipi_handler(void *null)
+{
+	wbinvd();
+}
 #endif
 
 void
@@ -53,17 +70,30 @@ drm_clflush_pages(struct page *pages[], unsigned long num_pages)
 
 #if defined(CONFIG_X86)
 	if (cpu_has_clflush) {
-		unsigned long i;
-
-		mb();
-		for (i = 0; i < num_pages; ++i)
-			drm_clflush_page(*pages++);
-		mb();
-
+		drm_cache_flush_clflush(pages, num_pages);
 		return;
 	}
 
-	wbinvd();
+	if (on_each_cpu(drm_clflush_ipi_handler, NULL, 1) != 0)
+		printk(KERN_ERR "Timed out waiting for cache flush.\n");
+
+#elif defined(__powerpc__)
+	unsigned long i;
+	for (i = 0; i < num_pages; i++) {
+		struct page *page = pages[i];
+		void *page_virtual;
+
+		if (unlikely(page == NULL))
+			continue;
+
+		page_virtual = kmap_atomic(page, KM_USER0);
+		flush_dcache_range((unsigned long)page_virtual,
+				   (unsigned long)page_virtual + PAGE_SIZE);
+		kunmap_atomic(page_virtual, KM_USER0);
+	}
+#else
+	printk(KERN_ERR "Architecture has no drm_cache.c support\n");
+	WARN_ON_ONCE(1);
 #endif
 }
 EXPORT_SYMBOL(drm_clflush_pages);
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 2f631c7..5cae0b3 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -68,10 +68,10 @@ DRM_ENUM_NAME_FN(drm_get_dpms_name, drm_dpms_enum_list)
  */
 static struct drm_prop_enum_list drm_scaling_mode_enum_list[] =
 {
-	{ DRM_MODE_SCALE_NON_GPU, "Non-GPU" },
-	{ DRM_MODE_SCALE_FULLSCREEN, "Fullscreen" },
-	{ DRM_MODE_SCALE_NO_SCALE, "No scale" },
-	{ DRM_MODE_SCALE_ASPECT, "Aspect" },
+	{ DRM_MODE_SCALE_NONE, "None" },
+	{ DRM_MODE_SCALE_FULLSCREEN, "Full" },
+	{ DRM_MODE_SCALE_CENTER, "Center" },
+	{ DRM_MODE_SCALE_ASPECT, "Full aspect" },
 };
 
 static struct drm_prop_enum_list drm_dithering_mode_enum_list[] =
@@ -108,6 +108,7 @@ static struct drm_prop_enum_list drm_tv_select_enum_list[] =
 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
+	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
 };
 
 DRM_ENUM_NAME_FN(drm_get_tv_select_name, drm_tv_select_enum_list)
@@ -118,6 +119,7 @@ static struct drm_prop_enum_list drm_tv_subconnector_enum_list[] =
 	{ DRM_MODE_SUBCONNECTOR_Composite, "Composite" }, /* TV-out */
 	{ DRM_MODE_SUBCONNECTOR_SVIDEO,    "SVIDEO"    }, /* TV-out */
 	{ DRM_MODE_SUBCONNECTOR_Component, "Component" }, /* TV-out */
+	{ DRM_MODE_SUBCONNECTOR_SCART,     "SCART"     }, /* TV-out */
 };
[...91846 lines suppressed...]
+ */
+
+struct ttm_bo_global {
+
+	/**
+	 * Constant after init.
+	 */
+
+	struct kobject kobj;
+	struct ttm_mem_global *mem_glob;
+	struct page *dummy_read_page;
+	struct ttm_mem_shrink shrink;
+	size_t ttm_bo_extra_size;
+	size_t ttm_bo_size;
+	struct mutex device_list_mutex;
+	spinlock_t lru_lock;
+
+	/**
+	 * Protected by device_list_mutex.
+	 */
+	struct list_head device_list;
+
+	/**
+	 * Protected by the lru_lock.
+	 */
+	struct list_head swap_lru;
+
+	/**
+	 * Internal protection.
+	 */
+	atomic_t bo_count;
+};
+
+
+#define TTM_NUM_MEM_TYPES 8
+
+#define TTM_BO_PRIV_FLAG_MOVING  0	/* Buffer object is moving and needs
+					   idling before CPU mapping */
+#define TTM_BO_PRIV_FLAG_MAX 1
+/**
+ * struct ttm_bo_device - Buffer object driver device-specific data.
+ *
+ * @driver: Pointer to a struct ttm_bo_driver struct setup by the driver.
  * @man: An array of mem_type_managers.
  * @addr_space_mm: Range manager for the device address space.
  * lru_lock: Spinlock that protects the buffer+device lru lists and
@@ -399,32 +449,21 @@ struct ttm_bo_device {
 	/*
 	 * Constant after bo device init / atomic.
 	 */
-
-	struct ttm_mem_global *mem_glob;
+	struct list_head device_list;
+	struct ttm_bo_global *glob;
 	struct ttm_bo_driver *driver;
-	struct page *dummy_read_page;
-	struct ttm_mem_shrink shrink;
-
-	size_t ttm_bo_extra_size;
-	size_t ttm_bo_size;
-
 	rwlock_t vm_lock;
+	struct ttm_mem_type_manager man[TTM_NUM_MEM_TYPES];
 	/*
 	 * Protected by the vm lock.
 	 */
-	struct ttm_mem_type_manager man[TTM_NUM_MEM_TYPES];
 	struct rb_root addr_space_rb;
 	struct drm_mm addr_space_mm;
 
 	/*
-	 * Might want to change this to one lock per manager.
-	 */
-	spinlock_t lru_lock;
-	/*
-	 * Protected by the lru lock.
+	 * Protected by the global:lru lock.
 	 */
 	struct list_head ddestroy;
-	struct list_head swap_lru;
 
 	/*
 	 * Protected by load / firstopen / lastclose /unload sync.
@@ -640,6 +679,9 @@ extern int ttm_bo_pci_offset(struct ttm_bo_device *bdev,
 			     unsigned long *bus_offset,
 			     unsigned long *bus_size);
 
+extern void ttm_bo_global_release(struct ttm_global_reference *ref);
+extern int ttm_bo_global_init(struct ttm_global_reference *ref);
+
 extern int ttm_bo_device_release(struct ttm_bo_device *bdev);
 
 /**
@@ -657,7 +699,7 @@ extern int ttm_bo_device_release(struct ttm_bo_device *bdev);
  * !0: Failure.
  */
 extern int ttm_bo_device_init(struct ttm_bo_device *bdev,
-			      struct ttm_mem_global *mem_glob,
+			      struct ttm_bo_global *glob,
 			      struct ttm_bo_driver *driver,
 			      uint64_t file_page_offset, bool need_dma32);
 
diff --git a/include/drm/ttm/ttm_memory.h b/include/drm/ttm/ttm_memory.h
index d8b8f04..6983a7c 100644
--- a/include/drm/ttm/ttm_memory.h
+++ b/include/drm/ttm/ttm_memory.h
@@ -32,6 +32,7 @@
 #include <linux/spinlock.h>
 #include <linux/wait.h>
 #include <linux/errno.h>
+#include <linux/kobject.h>
 
 /**
  * struct ttm_mem_shrink - callback to shrink TTM memory usage.
@@ -60,34 +61,33 @@ struct ttm_mem_shrink {
  * @queue: Wait queue for processes suspended waiting for memory.
  * @lock: Lock to protect the @shrink - and the memory accounting members,
  * that is, essentially the whole structure with some exceptions.
- * @emer_memory: Lowmem memory limit available for root.
- * @max_memory: Lowmem memory limit available for non-root.
- * @swap_limit: Lowmem memory limit where the shrink workqueue kicks in.
- * @used_memory: Currently used lowmem memory.
- * @used_total_memory: Currently used total (lowmem + highmem) memory.
- * @total_memory_swap_limit: Total memory limit where the shrink workqueue
- * kicks in.
- * @max_total_memory: Total memory available to non-root processes.
- * @emer_total_memory: Total memory available to root processes.
+ * @zones: Array of pointers to accounting zones.
+ * @num_zones: Number of populated entries in the @zones array.
+ * @zone_kernel: Pointer to the kernel zone.
+ * @zone_highmem: Pointer to the highmem zone if there is one.
+ * @zone_dma32: Pointer to the dma32 zone if there is one.
  *
  * Note that this structure is not per device. It should be global for all
  * graphics devices.
  */
 
+#define TTM_MEM_MAX_ZONES 2
+struct ttm_mem_zone;
 struct ttm_mem_global {
+	struct kobject kobj;
 	struct ttm_mem_shrink *shrink;
 	struct workqueue_struct *swap_queue;
 	struct work_struct work;
 	wait_queue_head_t queue;
 	spinlock_t lock;
-	uint64_t emer_memory;
-	uint64_t max_memory;
-	uint64_t swap_limit;
-	uint64_t used_memory;
-	uint64_t used_total_memory;
-	uint64_t total_memory_swap_limit;
-	uint64_t max_total_memory;
-	uint64_t emer_total_memory;
+	struct ttm_mem_zone *zones[TTM_MEM_MAX_ZONES];
+	unsigned int num_zones;
+	struct ttm_mem_zone *zone_kernel;
+#ifdef CONFIG_HIGHMEM
+	struct ttm_mem_zone *zone_highmem;
+#else
+	struct ttm_mem_zone *zone_dma32;
+#endif
 };
 
 /**
@@ -146,8 +146,13 @@ static inline void ttm_mem_unregister_shrink(struct ttm_mem_global *glob,
 extern int ttm_mem_global_init(struct ttm_mem_global *glob);
 extern void ttm_mem_global_release(struct ttm_mem_global *glob);
 extern int ttm_mem_global_alloc(struct ttm_mem_global *glob, uint64_t memory,
-				bool no_wait, bool interruptible, bool himem);
+				bool no_wait, bool interruptible);
 extern void ttm_mem_global_free(struct ttm_mem_global *glob,
-				uint64_t amount, bool himem);
+				uint64_t amount);
+extern int ttm_mem_global_alloc_page(struct ttm_mem_global *glob,
+				     struct page *page,
+				     bool no_wait, bool interruptible);
+extern void ttm_mem_global_free_page(struct ttm_mem_global *glob,
+				     struct page *page);
 extern size_t ttm_round_pot(size_t size);
 #endif
diff --git a/include/drm/ttm/ttm_module.h b/include/drm/ttm/ttm_module.h
index d1d4338..cf416ae 100644
--- a/include/drm/ttm/ttm_module.h
+++ b/include/drm/ttm/ttm_module.h
@@ -32,6 +32,7 @@
 #define _TTM_MODULE_H_
 
 #include <linux/kernel.h>
+struct kobject;
 
 #define TTM_PFX "[TTM] "
 
@@ -54,5 +55,6 @@ extern void ttm_global_init(void);
 extern void ttm_global_release(void);
 extern int ttm_global_item_ref(struct ttm_global_reference *ref);
 extern void ttm_global_item_unref(struct ttm_global_reference *ref);
+extern struct kobject *ttm_get_kobj(void);
 
 #endif /* _TTM_MODULE_H_ */

linux-2.6-frace-fixes.patch:
 b/include/linux/ftrace.h |    2 +-
 b/kernel/trace/ftrace.c  |   11 +++--------
 kernel/trace/ftrace.c    |   12 ++++--------
 3 files changed, 8 insertions(+), 17 deletions(-)

--- NEW FILE linux-2.6-frace-fixes.patch ---
commit 3279ba37db5d65c4ab0dcdee3b211ccb85bb563f
Author: Steven Rostedt <srostedt at redhat.com>
Date:   Wed Oct 7 16:57:56 2009 -0400

    ftrace: check for failure for all conversions
    
    Due to legacy code from back when the dynamic tracer used a daemon,
    only core kernel code was checking for failures. This is no longer
    the case. We must check for failures any time we perform text modifications.
    
    Cc: stable at kernel.org
    Signed-off-by: Steven Rostedt <rostedt at goodmis.org>

diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index c701476..f136fe5 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -1074,14 +1074,9 @@ static void ftrace_replace_code(int enable)
 		failed = __ftrace_replace_code(rec, enable);
 		if (failed) {
 			rec->flags |= FTRACE_FL_FAILED;
-			if ((system_state == SYSTEM_BOOTING) ||
-			    !core_kernel_text(rec->ip)) {
-				ftrace_free_rec(rec);
-				} else {
-				ftrace_bug(failed, rec->ip);
-					/* Stop processing */
-					return;
-				}
+			ftrace_bug(failed, rec->ip);
+			/* Stop processing */
+			return;
 		}
 	} while_for_each_ftrace_rec();
 }
commit e7247a15ff3bbdab0a8b402dffa1171e5c05a8e0
Author: jolsa at redhat.com <jolsa at redhat.com>
Date:   Wed Oct 7 19:00:35 2009 +0200

    tracing: correct module boundaries for ftrace_release
    
    When the module is about the unload we release its call records.
    The ftrace_release function was given wrong values representing
    the module core boundaries, thus not releasing its call records.
    
    Plus making ftrace_release function module specific.
    
    Signed-off-by: Jiri Olsa <jolsa at redhat.com>
    LKML-Reference: <1254934835-363-3-git-send-email-jolsa at redhat.com>
    Cc: stable at kernel.org
    Signed-off-by: Steven Rostedt <rostedt at goodmis.org>

diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
index cd3d2ab..0b4f97d 100644
--- a/include/linux/ftrace.h
+++ b/include/linux/ftrace.h
@@ -241,7 +241,7 @@ extern void ftrace_enable_daemon(void);
 # define ftrace_set_filter(buf, len, reset)	do { } while (0)
 # define ftrace_disable_daemon()		do { } while (0)
 # define ftrace_enable_daemon()			do { } while (0)
-static inline void ftrace_release(void *start, unsigned long size) { }
+static inline void ftrace_release_mod(struct module *mod) {}
 static inline int register_ftrace_command(struct ftrace_func_command *cmd)
 {
 	return -EINVAL;
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 46592fe..c701476 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -2658,19 +2658,17 @@ static int ftrace_convert_nops(struct module *mod,
 }
 
 #ifdef CONFIG_MODULES
-void ftrace_release(void *start, void *end)
+void ftrace_release_mod(struct module *mod)
 {
 	struct dyn_ftrace *rec;
 	struct ftrace_page *pg;
-	unsigned long s = (unsigned long)start;
-	unsigned long e = (unsigned long)end;
 
-	if (ftrace_disabled || !start || start == end)
+	if (ftrace_disabled)
 		return;
 
 	mutex_lock(&ftrace_lock);
 	do_for_each_ftrace_rec(pg, rec) {
-		if ((rec->ip >= s) && (rec->ip < e)) {
+		if (within_module_core(rec->ip, mod)) {
 			/*
 			 * rec->ip is changed in ftrace_free_rec()
 			 * It should not between s and e if record was freed.
@@ -2702,9 +2700,7 @@ static int ftrace_module_notify(struct notifier_block *self,
 				   mod->num_ftrace_callsites);
 		break;
 	case MODULE_STATE_GOING:
-		ftrace_release(mod->ftrace_callsites,
-			       mod->ftrace_callsites +
-			       mod->num_ftrace_callsites);
+		ftrace_release_mod(mod);
 		break;
 	}
 

linux-2.6-iwlwifi-reduce-noise-when-skb-allocation-fails.patch:
 iwl-rx.c       |   10 +++++++++-
 iwl3945-base.c |    9 ++++++++-
 2 files changed, 17 insertions(+), 2 deletions(-)

--- NEW FILE linux-2.6-iwlwifi-reduce-noise-when-skb-allocation-fails.patch ---
Backport of the following upstream commit...

commit f82a924cc88a5541df1d4b9d38a0968cd077a051
Author: Reinette Chatre <reinette.chatre at intel.com>
Date:   Thu Sep 17 10:43:56 2009 -0700

    iwlwifi: reduce noise when skb allocation fails
    
    Replenishment of receive buffers is done in the tasklet handling
    received frames as well as in a workqueue. When we are in the tasklet
    we cannot sleep and thus attempt atomic skb allocations. It is generally
    not a big problem if this fails since iwl_rx_allocate is always followed
    by a call to iwl_rx_queue_restock which will queue the work to replenish
    the buffers at a time when sleeping is allowed.
    
    We thus add the __GFP_NOWARN to the skb allocation in iwl_rx_allocate to
    reduce the noise if such an allocation fails while we still have enough
    buffers. We do maintain the warning and the error message when we are low
    on buffers to communicate to the user that there is a potential problem with
    memory availability on system
    
    This addresses issue reported upstream in thread "iwlagn: order 2 page
    allocation failures" in
    http://thread.gmane.org/gmane.linux.kernel.wireless.general/39187
    
    Signed-off-by: Reinette Chatre <reinette.chatre at intel.com>
    Acked-by: Mel Gorman <mel at csn.ul.ie>
    Signed-off-by: John W. Linville <linville at tuxdriver.com>

diff -up linux-2.6.31.noarch/drivers/net/wireless/iwlwifi/iwl3945-base.c.orig linux-2.6.31.noarch/drivers/net/wireless/iwlwifi/iwl3945-base.c
--- linux-2.6.31.noarch/drivers/net/wireless/iwlwifi/iwl3945-base.c.orig	2009-10-02 15:40:48.000000000 -0400
+++ linux-2.6.31.noarch/drivers/net/wireless/iwlwifi/iwl3945-base.c	2009-10-02 15:53:01.000000000 -0400
@@ -1211,13 +1211,20 @@ static void iwl3945_rx_allocate(struct i
 		list_del(element);
 		spin_unlock_irqrestore(&rxq->lock, flags);
 
+		if (rxq->free_count > RX_LOW_WATERMARK)
+			priority |= __GFP_NOWARN;
 		/* Alloc a new receive buffer */
 		rxb->skb =
 		    alloc_skb(priv->hw_params.rx_buf_size,
 				priority);
 		if (!rxb->skb) {
 			if (net_ratelimit())
-				IWL_CRIT(priv, ": Can not allocate SKB buffers\n");
+				IWL_DEBUG_INFO(priv, "Failed to allocate SKB buffer.\n");
+			if ((rxq->free_count <= RX_LOW_WATERMARK) &&
+			    net_ratelimit())
+				IWL_CRIT(priv, "Failed to allocate SKB buffer with %s. Only %u free buffers remaining.\n",
+					 priority == GFP_ATOMIC ?  "GFP_ATOMIC" : "GFP_KERNEL",
+					 rxq->free_count);
 			/* We don't reschedule replenish work here -- we will
 			 * call the restock method and if it still needs
 			 * more buffers it will schedule replenish */
diff -up linux-2.6.31.noarch/drivers/net/wireless/iwlwifi/iwl-rx.c.orig linux-2.6.31.noarch/drivers/net/wireless/iwlwifi/iwl-rx.c
--- linux-2.6.31.noarch/drivers/net/wireless/iwlwifi/iwl-rx.c.orig	2009-09-09 18:13:59.000000000 -0400
+++ linux-2.6.31.noarch/drivers/net/wireless/iwlwifi/iwl-rx.c	2009-10-02 15:58:34.000000000 -0400
@@ -254,12 +254,20 @@ void iwl_rx_allocate(struct iwl_priv *pr
 
 		spin_unlock_irqrestore(&rxq->lock, flags);
 
+		if (rxq->free_count > RX_LOW_WATERMARK)
+			priority |= __GFP_NOWARN;
 		/* Alloc a new receive buffer */
 		rxb->skb = alloc_skb(priv->hw_params.rx_buf_size + 256,
 						priority);
 
 		if (!rxb->skb) {
-			IWL_CRIT(priv, "Can not allocate SKB buffers\n");
+			if (net_ratelimit())
+				IWL_DEBUG_INFO(priv, "Failed to allocate SKB buffer.\n");
+			if ((rxq->free_count <= RX_LOW_WATERMARK) &&
+			    net_ratelimit())
+				IWL_CRIT(priv, "Failed to allocate SKB buffer with %s. Only %u free buffers remaining.\n",
+					 priority == GFP_ATOMIC ?  "GFP_ATOMIC" : "GFP_KERNEL",
+					 rxq->free_count);
 			/* We don't reschedule replenish work here -- we will
 			 * call the restock method and if it still needs
 			 * more buffers it will schedule replenish */

linux-2.6-virtio_blk-add-support-for-cache-flush.patch:
 drivers/block/virtio_blk.c |   30 +++++++++++++++++++++++++-----
 include/linux/virtio_blk.h |   15 +++++++++++++++
 2 files changed, 40 insertions(+), 5 deletions(-)

--- NEW FILE linux-2.6-virtio_blk-add-support-for-cache-flush.patch ---
From: Christoph Hellwig <hch at lst.de>
Date: Thu, 17 Sep 2009 17:57:42 +0000 (+0200)
Subject: virtio_blk: add support for cache flush
X-Git-Tag: v2.6.32-rc1~175^2~5
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=f1b0ef0626

virtio_blk: add support for cache flush

Recent qemu has added a VIRTIO_BLK_F_FLUSH flag to advertise that the
virtual disk has a volatile write cache that needs to be flushed.  In case
we see this feature implement tell the Linux block layer about the fact
and use the new VIRTIO_BLK_T_FLUSH to flush the cache when required.  This
allows for an correct and simple implementation of write barriers.

Signed-off-by: Christoph Hellwig <hch at lst.de>
Signed-off-by: Rusty Russell <rusty at rustcorp.com.au>
---

diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 73de753..3d5fe97 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -92,15 +92,26 @@ static bool do_req(struct request_queue *q, struct virtio_blk *vblk,
 		return false;
 
 	vbr->req = req;
-	if (blk_fs_request(vbr->req)) {
+	switch (req->cmd_type) {
+	case REQ_TYPE_FS:
 		vbr->out_hdr.type = 0;
 		vbr->out_hdr.sector = blk_rq_pos(vbr->req);
 		vbr->out_hdr.ioprio = req_get_ioprio(vbr->req);
-	} else if (blk_pc_request(vbr->req)) {
+		break;
+	case REQ_TYPE_BLOCK_PC:
 		vbr->out_hdr.type = VIRTIO_BLK_T_SCSI_CMD;
 		vbr->out_hdr.sector = 0;
 		vbr->out_hdr.ioprio = req_get_ioprio(vbr->req);
-	} else {
+		break;
+	case REQ_TYPE_LINUX_BLOCK:
+		if (req->cmd[0] == REQ_LB_OP_FLUSH) {
+			vbr->out_hdr.type = VIRTIO_BLK_T_FLUSH;
+			vbr->out_hdr.sector = 0;
+			vbr->out_hdr.ioprio = req_get_ioprio(vbr->req);
+			break;
+		}
+		/*FALLTHRU*/
+	default:
 		/* We don't put anything else in the queue. */
 		BUG();
 	}
@@ -200,6 +211,12 @@ out:
 	return err;
 }
 
+static void virtblk_prepare_flush(struct request_queue *q, struct request *req)
+{
+	req->cmd_type = REQ_TYPE_LINUX_BLOCK;
+	req->cmd[0] = REQ_LB_OP_FLUSH;
+}
+
 static int virtblk_ioctl(struct block_device *bdev, fmode_t mode,
 			 unsigned cmd, unsigned long data)
 {
@@ -338,7 +355,10 @@ static int __devinit virtblk_probe(struct virtio_device *vdev)
 	index++;
 
 	/* If barriers are supported, tell block layer that queue is ordered */
-	if (virtio_has_feature(vdev, VIRTIO_BLK_F_BARRIER))
+	if (virtio_has_feature(vdev, VIRTIO_BLK_F_FLUSH))
+		blk_queue_ordered(vblk->disk->queue, QUEUE_ORDERED_DRAIN_FLUSH,
+				  virtblk_prepare_flush);
+	else if (virtio_has_feature(vdev, VIRTIO_BLK_F_BARRIER))
 		blk_queue_ordered(vblk->disk->queue, QUEUE_ORDERED_TAG, NULL);
 
 	/* If disk is read-only in the host, the guest should obey */
@@ -425,7 +445,7 @@ static struct virtio_device_id id_table[] = {
 static unsigned int features[] = {
 	VIRTIO_BLK_F_BARRIER, VIRTIO_BLK_F_SEG_MAX, VIRTIO_BLK_F_SIZE_MAX,
 	VIRTIO_BLK_F_GEOMETRY, VIRTIO_BLK_F_RO, VIRTIO_BLK_F_BLK_SIZE,
-	VIRTIO_BLK_F_SCSI, VIRTIO_BLK_F_IDENTIFY
+	VIRTIO_BLK_F_SCSI, VIRTIO_BLK_F_IDENTIFY, VIRTIO_BLK_F_FLUSH
 };
 
 /*
diff --git a/include/linux/virtio_blk.h b/include/linux/virtio_blk.h
index 25fbabf..15cb666 100644
--- a/include/linux/virtio_blk.h
+++ b/include/linux/virtio_blk.h
@@ -14,6 +14,7 @@
 #define VIRTIO_BLK_F_BLK_SIZE	6	/* Block size of disk is available*/
 #define VIRTIO_BLK_F_SCSI	7	/* Supports scsi command passthru */
 #define VIRTIO_BLK_F_IDENTIFY	8	/* ATA IDENTIFY supported */
+#define VIRTIO_BLK_F_FLUSH	9	/* Cache flush command support */
 
 #define VIRTIO_BLK_ID_BYTES	(sizeof(__u16[256]))	/* IDENTIFY DATA */
 
@@ -35,6 +36,17 @@ struct virtio_blk_config {
 	__u8 identify[VIRTIO_BLK_ID_BYTES];
 } __attribute__((packed));
 
+/*
+ * Command types
+ *
+ * Usage is a bit tricky as some bits are used as flags and some are not.
+ *
+ * Rules:
+ *   VIRTIO_BLK_T_OUT may be combined with VIRTIO_BLK_T_SCSI_CMD or
+ *   VIRTIO_BLK_T_BARRIER.  VIRTIO_BLK_T_FLUSH is a command of its own
+ *   and may not be combined with any of the other flags.
+ */
+
 /* These two define direction. */
 #define VIRTIO_BLK_T_IN		0
 #define VIRTIO_BLK_T_OUT	1
@@ -42,6 +54,9 @@ struct virtio_blk_config {
 /* This bit says it's a scsi command, not an actual read or write. */
 #define VIRTIO_BLK_T_SCSI_CMD	2
 
+/* Cache flush command */
+#define VIRTIO_BLK_T_FLUSH	4
+
 /* Barrier before this op. */
 #define VIRTIO_BLK_T_BARRIER	0x80000000
 

linux-2.6-xen-fix-is_disconnected_device-exists_disconnected_device.patch:
 xenbus_probe.c |   13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

--- NEW FILE linux-2.6-xen-fix-is_disconnected_device-exists_disconnected_device.patch ---
From: Paolo Bonzini <pbonzini at redhat.com>
Date: Wed, 8 Jul 2009 10:27:37 +0000 (+0200)
Subject: xen: fix is_disconnected_device/exists_disconnected_device
X-Git-Tag: xen-dom0-2.6.31-rc3~3^2~2
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fjeremy%2Fxen.git;a=commitdiff_plain;h=8800a1de3df00fa994f72ad0d7c1eda9b5a0b514

xen: fix is_disconnected_device/exists_disconnected_device

The logic of is_disconnected_device/exists_disconnected_device is wrong
in that they are used to test whether a device is trying to connect (i.e.
connecting).  For this reason the patch fixes them to not consider a
Closing or Closed device to be connecting.  At the same time the patch
also renames the functions according to what they really do; you could
say a closed device is "disconnected" (the old name), but not "connecting"
(the new name).

This patch is a backport of changeset 909 from the Xenbits tree.

Cc: Jeremy Fitzhardinge <jeremy.fitzhardinge at citrix.com>
Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge at citrix.com>
---

diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
index d42e25d..c543766 100644
--- a/drivers/xen/xenbus/xenbus_probe.c
+++ b/drivers/xen/xenbus/xenbus_probe.c
@@ -843,7 +843,7 @@ postcore_initcall(xenbus_probe_init);
 
 MODULE_LICENSE("GPL");
 
-static int is_disconnected_device(struct device *dev, void *data)
+static int is_device_connecting(struct device *dev, void *data)
 {
 	struct xenbus_device *xendev = to_xenbus_device(dev);
 	struct device_driver *drv = data;
@@ -861,14 +861,15 @@ static int is_disconnected_device(struct device *dev, void *data)
 		return 0;
 
 	xendrv = to_xenbus_driver(dev->driver);
-	return (xendev->state != XenbusStateConnected ||
-		(xendrv->is_ready && !xendrv->is_ready(xendev)));
+	return (xendev->state < XenbusStateConnected ||
+		(xendev->state == XenbusStateConnected &&
+		 xendrv->is_ready && !xendrv->is_ready(xendev)));
 }
 
-static int exists_disconnected_device(struct device_driver *drv)
+static int exists_connecting_device(struct device_driver *drv)
 {
 	return bus_for_each_dev(&xenbus_frontend.bus, NULL, drv,
-				is_disconnected_device);
+				is_device_connecting);
 }
 
 static int print_device_status(struct device *dev, void *data)
@@ -918,7 +919,7 @@ static void wait_for_devices(struct xenbus_driver *xendrv)
 	if (!ready_to_wait_for_devices || !xen_domain())
 		return;
 
-	while (exists_disconnected_device(drv)) {
+	while (exists_connecting_device(drv)) {
 		if (time_after(jiffies, timeout))
 			break;
 		schedule_timeout_interruptible(HZ/10);

linux-2.6-xen-improvement-to-wait_for_devices.patch:
 xenbus_probe.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

--- NEW FILE linux-2.6-xen-improvement-to-wait_for_devices.patch ---
From: Paolo Bonzini <pbonzini at redhat.com>
Date: Wed, 8 Jul 2009 10:27:38 +0000 (+0200)
Subject: xen: improvement to wait_for_devices()
X-Git-Tag: xen-dom0-2.6.31-rc3~3^2~1
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fjeremy%2Fxen.git;a=commitdiff_plain;h=ed9ef1e71122628b50b0a526607509511b0d9135

xen: improvement to wait_for_devices()

When printing a warning about a timed-out device, print the
current state of both ends of the device connection (i.e., backend as
well as frontend).  This backports half of changeset 146 from the
Xenbits tree.

Cc: Jeremy Fitzhardinge <jeremy.fitzhardinge at citrix.com>
Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
---

diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
index c543766..3a867a5 100644
--- a/drivers/xen/xenbus/xenbus_probe.c
+++ b/drivers/xen/xenbus/xenbus_probe.c
@@ -885,10 +885,13 @@ static int print_device_status(struct device *dev, void *data)
 		/* Information only: is this too noisy? */
 		printk(KERN_INFO "XENBUS: Device with no driver: %s\n",
 		       xendev->nodename);
-	} else if (xendev->state != XenbusStateConnected) {
+	} else if (xendev->state < XenbusStateConnected) {
+		enum xenbus_state rstate = XenbusStateUnknown;
+		if (xendev->otherend)
+			rstate = xenbus_read_driver_state(xendev->otherend);
 		printk(KERN_WARNING "XENBUS: Timeout connecting "
-		       "to device: %s (state %d)\n",
-		       xendev->nodename, xendev->state);
+		       "to device: %s (local state %d, remote state %d)\n",
+		       xendev->nodename, xendev->state, rstate);
 	}
 
 	return 0;

linux-2.6-xen-increase-device-connection-timeout.patch:
 xenbus_probe.c |   20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

--- NEW FILE linux-2.6-xen-increase-device-connection-timeout.patch ---
From: Paolo Bonzini <pbonzini at redhat.com>
Date: Wed, 8 Jul 2009 10:27:39 +0000 (+0200)
Subject: xen: wait up to 5 minutes for device connetion
X-Git-Tag: xen-dom0-2.6.31-rc3~3^2
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fjeremy%2Fxen.git;a=commitdiff_plain;h=11b84f69d36b518ff862a1bcd61ace7f8dac76b5;hp=ed9ef1e71122628b50b0a526607509511b0d9135

xen: wait up to 5 minutes for device connetion

Increases the device timeout from 10s to 5 minutes, giving the user a
visual indication during that time in case there are problems.  The patch
is a backport of changesets 144 and 150 in the Xenbits tree.

Cc: Jeremy Fitzhardinge <jeremy.fitzhardinge at citrix.com>
Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
---

diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
index 3a867a5..4f69159 100644
--- a/drivers/xen/xenbus/xenbus_probe.c
+++ b/drivers/xen/xenbus/xenbus_probe.c
@@ -901,7 +901,7 @@ static int print_device_status(struct device *dev, void *data)
 static int ready_to_wait_for_devices;
 
 /*
- * On a 10 second timeout, wait for all devices currently configured.  We need
+ * On a 5-minute timeout, wait for all devices currently configured.  We need
  * to do this to guarantee that the filesystems and / or network devices
  * needed for boot are available, before we can allow the boot to proceed.
  *
@@ -916,18 +916,30 @@ static int ready_to_wait_for_devices;
  */
 static void wait_for_devices(struct xenbus_driver *xendrv)
 {
-	unsigned long timeout = jiffies + 10*HZ;
+	unsigned long start = jiffies;
 	struct device_driver *drv = xendrv ? &xendrv->driver : NULL;
+	unsigned int seconds_waited = 0;
 
 	if (!ready_to_wait_for_devices || !xen_domain())
 		return;
 
 	while (exists_connecting_device(drv)) {
-		if (time_after(jiffies, timeout))
-			break;
+		if (time_after(jiffies, start + (seconds_waited+5)*HZ)) {
+			if (!seconds_waited)
+				printk(KERN_WARNING "XENBUS: Waiting for "
+				       "devices to initialise: ");
+			seconds_waited += 5;
+			printk("%us...", 300 - seconds_waited);
+			if (seconds_waited == 300)
+				break;
+		}
+
 		schedule_timeout_interruptible(HZ/10);
 	}
 
+	if (seconds_waited)
+		printk("\n");
+
 	bus_for_each_dev(&xenbus_frontend.bus, NULL, drv,
 			 print_device_status);
 }

linux-2.6.31-copy_from_user-bounds.patch:
 b/arch/x86/include/asm/uaccess_32.h               |   12 ++++-
 b/arch/x86/lib/usercopy_32.c                      |    6 ++
 b/drivers/acpi/proc.c                             |    4 -
 b/drivers/acpi/video.c                            |   20 ++++++---
 b/drivers/char/nvram.c                            |   12 ++++-
 b/fs/cifs/cifs_debug.c                            |   10 ++--
 b/include/linux/compiler-gcc4.h                   |    3 +
 b/include/linux/compiler.h                        |    9 +---
 b/kernel/capability.c                             |   11 ++---
 b/mm/migrate.c                                    |   47 ++++++++++++++++++++--
 b/net/socket.c                                    |    9 ++--
 b/net/wireless/wext.c                             |   11 ++---
 linux-2.6.31.noarch/arch/x86/kernel/cpu/mtrr/if.c |   21 ++++++---
 13 files changed, 127 insertions(+), 48 deletions(-)

--- NEW FILE linux-2.6.31-copy_from_user-bounds.patch ---
>From davej  Wed Sep 30 12:03:40 2009
Return-Path: linux-kernel-owner at vger.kernel.org
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
	gelk.kernelslacker.org
X-Spam-Level: 
X-Spam-Status: No, score=-6.1 required=5.0 tests=AWL,BAYES_00,
	RCVD_IN_DNSWL_MED,UNPARSEABLE_RELAY autolearn=ham version=3.2.5
Received: from mail.corp.redhat.com [10.5.5.52]
	by gelk.kernelslacker.org with IMAP (fetchmail-6.3.9)
	for <davej at localhost> (single-drop); Wed, 30 Sep 2009 12:03:40 -0400 (EDT)
Received: from zmta01.collab.prod.int.phx2.redhat.com (LHLO
 zmta01.collab.prod.int.phx2.redhat.com) (10.5.5.31) by
 mail04.corp.redhat.com with LMTP; Wed, 30 Sep 2009 07:05:24 -0400 (EDT)
Received: from localhost (localhost.localdomain [127.0.0.1])
	by zmta01.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id A83B191E74;
	Wed, 30 Sep 2009 07:05:24 -0400 (EDT)
Received: from zmta01.collab.prod.int.phx2.redhat.com ([127.0.0.1])
	by localhost (zmta01.collab.prod.int.phx2.redhat.com [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id C2l5G8z2ZQxe; Wed, 30 Sep 2009 07:05:24 -0400 (EDT)
Received: from int-mx01.intmail.prod.int.phx2.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11])
	by zmta01.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id 6C40F91AFB;
	Wed, 30 Sep 2009 07:05:24 -0400 (EDT)
Received: from mx1.redhat.com (ext-mx05.extmail.prod.ext.phx2.redhat.com [10.5.110.9])
	by int-mx01.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id n8UB5Hsn004857;
	Wed, 30 Sep 2009 07:05:18 -0400
Received: from vger.kernel.org (vger.kernel.org [209.132.176.167])
	by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id n8UAvsRr008879;
	Wed, 30 Sep 2009 07:05:06 -0400
Received: (majordomo at vger.kernel.org) by vger.kernel.org via listexpand
	id S1754157AbZI3LE4 (ORCPT <rfc822;mrezanin at redhat.com> + 41 others);
	Wed, 30 Sep 2009 07:04:56 -0400
Received: (majordomo at vger.kernel.org) by vger.kernel.org id S1753441AbZI3LE4
	(ORCPT <rfc822;linux-kernel-outgoing>);
	Wed, 30 Sep 2009 07:04:56 -0400
Received: from casper.infradead.org ([85.118.1.10]:46939 "EHLO
	casper.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1752896AbZI3LEz convert rfc822-to-8bit (ORCPT
	<rfc822;linux-kernel at vger.kernel.org>);
	Wed, 30 Sep 2009 07:04:55 -0400
Received: from [83.119.188.87] (helo=localhost.localdomain)
	by casper.infradead.org with esmtpsa (Exim 4.69 #1 (Red Hat Linux))
	id 1MswzQ-0005Tp-EG; Wed, 30 Sep 2009 11:04:56 +0000
Date: 	Wed, 30 Sep 2009 13:05:23 +0200
From: Arjan van de Ven <arjan at infradead.org>
To: linux-kernel at vger.kernel.org
Cc: mingo at elte.hu, tglx at tglx.de, hpa at zytor.com
Subject: [PATCH] x86: Turn the copy_from_user check into an (optional)
 compile time warning
Message-ID: <20090930130523.348ae6c4 at infradead.org>
Organization: Intel
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 8BIT
X-SRS-Rewrite: SMTP reverse-path rewritten from <arjan at infradead.org> by casper.infradead.org
	See http://www.infradead.org/rpr.html
Sender: linux-kernel-owner at vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: 	linux-kernel at vger.kernel.org
X-RedHat-Spam-Score: -4  (RCVD_IN_DNSWL_MED)
X-Scanned-By: MIMEDefang 2.67 on 10.5.11.11
X-Scanned-By: MIMEDefang 2.67 on 10.5.110.9
Status: RO
Content-Length: 3934
Lines: 111


>From 350cf3cd513e6759ae6852946532a47249f25600 Mon Sep 17 00:00:00 2001
From: Arjan van de Ven <arjan at linux.intel.com>
Date: Wed, 30 Sep 2009 12:57:46 +0200
Subject: [PATCH] x86: Turn the copy_from_user check into an (optional) compile time warning

A previous patch added the buffer size check to copy_from_user().

One of the things learned from analyzing the result of the previous patch
is that in general, gcc is really good at proving that the code contains
sufficient security checks to not need to do a runtime check. But that
for those cases where gcc could not prove this, there was a relatively
high percentage of real security issues.

This patch turns the case of "gcc cannot prove" into a compile time
warning, as long as a sufficiently new gcc is in use that supports this.
The objective is that these warnings will trigger developers checking
new cases out before a security hole enters a linux kernel release.

Signed-off-by: Arjan van de Ven <arjan at linux.intel.com>
---
 arch/x86/include/asm/uaccess_32.h |   12 +++++++++---
 arch/x86/lib/usercopy_32.c        |    6 ++++++
 include/linux/compiler-gcc4.h     |    3 +++
 include/linux/compiler.h          |    4 ++++
 4 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/arch/x86/include/asm/uaccess_32.h b/arch/x86/include/asm/uaccess_32.h
index 582d6ae..7826639 100644
--- a/arch/x86/include/asm/uaccess_32.h
+++ b/arch/x86/include/asm/uaccess_32.h
@@ -191,6 +191,13 @@ unsigned long __must_check _copy_from_user(void *to,
 					  const void __user *from,
 					  unsigned long n);
 
+
+extern void copy_from_user_overflow(void)
+#ifdef CONFIG_DEBUG_STACKOVERFLOW
+	__compiletime_warning("copy_from_user buffer size is not provably correct")
+#endif
+;
+
 static inline unsigned long __must_check copy_from_user(void *to,
 					  const void __user *from,
 					  unsigned long n)
@@ -200,10 +207,9 @@ static inline unsigned long __must_check copy_from_user(void *to,
 
 	if (likely(sz == -1 || sz >= n))
 		ret = _copy_from_user(to, from, n);
-#ifdef CONFIG_DEBUG_VM
 	else
-		WARN(1, "Buffer overflow detected!\n");
-#endif
+		copy_from_user_overflow();
+
 	return ret;
 }
 
diff --git a/arch/x86/lib/usercopy_32.c b/arch/x86/lib/usercopy_32.c
index 8498684..e218d5d 100644
--- a/arch/x86/lib/usercopy_32.c
+++ b/arch/x86/lib/usercopy_32.c
@@ -883,3 +883,9 @@ _copy_from_user(void *to, const void __user *from, unsigned long n)
 	return n;
 }
 EXPORT_SYMBOL(_copy_from_user);
+
+void copy_from_user_overflow(void)
+{
+	WARN(1, "Buffer overflow detected!\n");
+}
+EXPORT_SYMBOL(copy_from_user_overflow);
diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
index a3aef5d..f1709c1 100644
--- a/include/linux/compiler-gcc4.h
+++ b/include/linux/compiler-gcc4.h
@@ -39,3 +39,6 @@
 #endif
 
 #define __compiletime_object_size(obj) __builtin_object_size(obj, 0)
+#if __GNUC_MINOR__ >= 4
+#define __compiletime_warning(message) __attribute__((warning(message)))
+#endif
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 9c42853..241dfd8 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -189,6 +189,10 @@ extern void __chk_io_ptr(const volatile void __iomem *);
 #ifndef __compiletime_object_size
 # define __compiletime_object_size(obj) -1
 #endif
+#ifndef __compiletime_warning
+# define __compiletime_warning(message)
+#endif
+
 /*
  * Prevent the compiler from merging or refetching accesses.  The compiler
  * is also forbidden from reordering successive instances of ACCESS_ONCE(),
-- 
1.6.2.5


-- 
Arjan van de Ven 	Intel Open Source Technology Centre
For development, discussion and tips for power savings, 
visit http://www.lesswatts.org
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

>From davej  Sat Sep 26 14:57:33 2009
Return-Path: linux-kernel-owner at vger.kernel.org
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
	gelk.kernelslacker.org
X-Spam-Level: 
X-Spam-Status: No, score=-6.2 required=5.0 tests=AWL,BAYES_00,
	RCVD_IN_DNSWL_MED,UNPARSEABLE_RELAY autolearn=ham version=3.2.5
Received: from mail.corp.redhat.com [10.5.5.52]
	by gelk.kernelslacker.org with IMAP (fetchmail-6.3.9)
	for <davej at localhost> (single-drop); Sat, 26 Sep 2009 14:57:33 -0400 (EDT)
Received: from zmta02.collab.prod.int.phx2.redhat.com (LHLO
 zmta02.collab.prod.int.phx2.redhat.com) (10.5.5.32) by
 mail04.corp.redhat.com with LMTP; Sat, 26 Sep 2009 14:56:34 -0400 (EDT)
Received: from localhost (localhost.localdomain [127.0.0.1])
	by zmta02.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id 13A2C9C7CF;
	Sat, 26 Sep 2009 14:56:34 -0400 (EDT)
Received: from zmta02.collab.prod.int.phx2.redhat.com ([127.0.0.1])
	by localhost (zmta02.collab.prod.int.phx2.redhat.com [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id 4zEaK-kQ3gyD; Sat, 26 Sep 2009 14:56:33 -0400 (EDT)
Received: from int-mx03.intmail.prod.int.phx2.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.16])
	by zmta02.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id CEC9D9CE2F;
	Sat, 26 Sep 2009 14:56:33 -0400 (EDT)
Received: from mx1.redhat.com (ext-mx07.extmail.prod.ext.phx2.redhat.com [10.5.110.11])
	by int-mx03.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id n8QIuR4l002317;
	Sat, 26 Sep 2009 14:56:27 -0400
Received: from vger.kernel.org (vger.kernel.org [209.132.176.167])
	by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id n8QImrPK007277;
	Sat, 26 Sep 2009 14:56:14 -0400
Received: (majordomo at vger.kernel.org) by vger.kernel.org via listexpand
	id S1752513AbZIZSyU (ORCPT <rfc822;mrezanin at redhat.com> + 41 others);
	Sat, 26 Sep 2009 14:54:20 -0400
Received: (majordomo at vger.kernel.org) by vger.kernel.org id S1751887AbZIZSyT
	(ORCPT <rfc822;linux-kernel-outgoing>);
	Sat, 26 Sep 2009 14:54:19 -0400
Received: from casper.infradead.org ([85.118.1.10]:36387 "EHLO
	casper.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1750795AbZIZSyS (ORCPT
	<rfc822;linux-kernel at vger.kernel.org>);
	Sat, 26 Sep 2009 14:54:18 -0400
Received: from [83.119.188.87] (helo=localhost.localdomain)
	by casper.infradead.org with esmtpsa (Exim 4.69 #1 (Red Hat Linux))
	id 1MrcPU-0002Uh-8u; Sat, 26 Sep 2009 18:54:20 +0000
Date: 	Sat, 26 Sep 2009 20:49:51 +0200
From: Arjan van de Ven <arjan at infradead.org>
To: linux-kernel at vger.kernel.org
Cc: torvalds at linux-foundation.org, mingo at elte.hu
Subject: [PATCH 0/9] Series to make copy_from_user to a stack slot provable
 right
Message-ID: <20090926204951.424e567e at infradead.org>
Organization: Intel
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-SRS-Rewrite: SMTP reverse-path rewritten from <arjan at infradead.org> by casper.infradead.org
	See http://www.infradead.org/rpr.html
Sender: linux-kernel-owner at vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: 	linux-kernel at vger.kernel.org
X-RedHat-Spam-Score: -4  (RCVD_IN_DNSWL_MED)
X-Scanned-By: MIMEDefang 2.67 on 10.5.11.16
X-Scanned-By: MIMEDefang 2.67 on 10.5.110.11
Status: RO
Content-Length: 1430
Lines: 32

[PATCH 0/9] Series to make copy_from_user to a stack slot provable right

This series contains a series of patches that, when applied, make every
copy_from_user() in a make allyesconfig to a (direct) stack slot
provable-by-gcc to have a correct size.

This is useful because if we fix all of these, we can make the non-provable
case an error, as an indication of a possible security hole.

Now the series has 4 types of patches
1) changes where the original code really was missing checks
2) changes where the checks were coded so complex and games were played with
   types, that I (and the compiler) couldn't be sure if it was correct or
   not
3) changes where we're hitting a small gcc missing optimization, but where
   a simplification of the code allows gcc to prove things anyway.
   (http://gcc.gnu.org/bugzilla/show_bug.cgi?id=41477 is filed for this)
4) a case in sys_socketcall where Dave Miller and co were very smart in
   optimizing the code to the point where it's not reasonable for gcc
   to realize the result is ok.



-- 
Arjan van de Ven 	Intel Open Source Technology Centre
For development, discussion and tips for power savings, 
visit http://www.lesswatts.org
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

>From davej  Sat Sep 26 14:57:34 2009
Return-Path: linux-kernel-owner at vger.kernel.org
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
	gelk.kernelslacker.org
X-Spam-Level: 
X-Spam-Status: No, score=-6.2 required=5.0 tests=AWL,BAYES_00,
	RCVD_IN_DNSWL_MED,UNPARSEABLE_RELAY autolearn=ham version=3.2.5
Received: from mail.corp.redhat.com [10.5.5.52]
	by gelk.kernelslacker.org with IMAP (fetchmail-6.3.9)
	for <davej at localhost> (single-drop); Sat, 26 Sep 2009 14:57:34 -0400 (EDT)
Received: from zmta01.collab.prod.int.phx2.redhat.com (LHLO
 zmta01.collab.prod.int.phx2.redhat.com) (10.5.5.31) by
 mail04.corp.redhat.com with LMTP; Sat, 26 Sep 2009 14:56:39 -0400 (EDT)
Received: from localhost (localhost.localdomain [127.0.0.1])
	by zmta01.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id 54BEB92827;
	Sat, 26 Sep 2009 14:56:39 -0400 (EDT)
Received: from zmta01.collab.prod.int.phx2.redhat.com ([127.0.0.1])
	by localhost (zmta01.collab.prod.int.phx2.redhat.com [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id UtrSlSnoRSKJ; Sat, 26 Sep 2009 14:56:39 -0400 (EDT)
Received: from int-mx05.intmail.prod.int.phx2.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.18])
	by zmta01.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id 1994391AC5;
	Sat, 26 Sep 2009 14:56:39 -0400 (EDT)
Received: from mx1.redhat.com (ext-mx01.extmail.prod.ext.phx2.redhat.com [10.5.110.5])
	by int-mx05.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id n8QIuWCe012052;
	Sat, 26 Sep 2009 14:56:32 -0400
Received: from vger.kernel.org (vger.kernel.org [209.132.176.167])
	by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id n8QIiTd1002301;
	Sat, 26 Sep 2009 14:56:26 -0400
Received: (majordomo at vger.kernel.org) by vger.kernel.org via listexpand
	id S1752887AbZIZS4M (ORCPT <rfc822;mrezanin at redhat.com> + 41 others);
	Sat, 26 Sep 2009 14:56:12 -0400
Received: (majordomo at vger.kernel.org) by vger.kernel.org id S1752401AbZIZSyU
	(ORCPT <rfc822;linux-kernel-outgoing>);
	Sat, 26 Sep 2009 14:54:20 -0400
Received: from casper.infradead.org ([85.118.1.10]:36390 "EHLO
	casper.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1750867AbZIZSyT (ORCPT
	<rfc822;linux-kernel at vger.kernel.org>);
	Sat, 26 Sep 2009 14:54:19 -0400
Received: from [83.119.188.87] (helo=localhost.localdomain)
	by casper.infradead.org with esmtpsa (Exim 4.69 #1 (Red Hat Linux))
	id 1MrcPU-0002Uh-MA; Sat, 26 Sep 2009 18:54:20 +0000
Date: 	Sat, 26 Sep 2009 20:50:25 +0200
From: Arjan van de Ven <arjan at infradead.org>
To: Arjan van de Ven <arjan at infradead.org>
Cc: linux-kernel at vger.kernel.org, torvalds at linux-foundation.org, mingo at elte.hu,
        lenb at kernel.org
Subject: [PATCH 1/9] Fix bound checks for copy_from_user in the acpi /proc
 code
Message-ID: <20090926205025.3befecf6 at infradead.org>
In-Reply-To: <20090926204951.424e567e at infradead.org>
References: <20090926204951.424e567e at infradead.org>
Organization: Intel
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-SRS-Rewrite: SMTP reverse-path rewritten from <arjan at infradead.org> by casper.infradead.org
	See http://www.infradead.org/rpr.html
Sender: linux-kernel-owner at vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: 	linux-kernel at vger.kernel.org
X-RedHat-Spam-Score: -4  (RCVD_IN_DNSWL_MED)
X-Scanned-By: MIMEDefang 2.67 on 10.5.11.18
X-Scanned-By: MIMEDefang 2.67 on 10.5.110.5
Status: RO
Content-Length: 1269
Lines: 38


From: Arjan van de Ven <arjan at linux.intel.com>
Subject: [PATCH 1/9] Fix bound checks for copy_from_user in the acpi /proc code
CC: Len Brown <lenb at kernel.org>

The ACPI /proc write() code takes an unsigned length argument like any write()
function, but then assigned it to a *signed* integer called "len".
Only after this is a sanity check for len done to make it not larger than 4.

Due to the type change a len < 0 is in principle also possible; this patch
adds a check for this.

Signed-off-by: Arjan van de Ven <arjan at linux.intel.com>

diff --git a/drivers/acpi/proc.c b/drivers/acpi/proc.c
index d0d550d..f8b6f55 100644
--- a/drivers/acpi/proc.c
+++ b/drivers/acpi/proc.c
@@ -398,6 +398,8 @@ acpi_system_write_wakeup_device(struct file *file,
 
 	if (len > 4)
 		len = 4;
+	if (len < 0)
+		return -EFAULT;
 
 	if (copy_from_user(strbuf, buffer, len))
 		return -EFAULT;


-- 
Arjan van de Ven 	Intel Open Source Technology Centre
For development, discussion and tips for power savings, 
visit http://www.lesswatts.org
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

>From davej  Sat Sep 26 14:57:19 2009
Return-Path: linux-kernel-owner at vger.kernel.org
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
	gelk.kernelslacker.org
X-Spam-Level: 
X-Spam-Status: No, score=-6.2 required=5.0 tests=AWL,BAYES_00,
	RCVD_IN_DNSWL_MED,UNPARSEABLE_RELAY autolearn=ham version=3.2.5
Received: from mail.corp.redhat.com [10.5.5.52]
	by gelk.kernelslacker.org with IMAP (fetchmail-6.3.9)
	for <davej at localhost> (single-drop); Sat, 26 Sep 2009 14:57:19 -0400 (EDT)
Received: from zmta02.collab.prod.int.phx2.redhat.com (LHLO
 zmta02.collab.prod.int.phx2.redhat.com) (10.5.5.32) by
 mail04.corp.redhat.com with LMTP; Sat, 26 Sep 2009 14:55:08 -0400 (EDT)
Received: from localhost (localhost.localdomain [127.0.0.1])
	by zmta02.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id 1CF509E536;
	Sat, 26 Sep 2009 14:55:08 -0400 (EDT)
Received: from zmta02.collab.prod.int.phx2.redhat.com ([127.0.0.1])
	by localhost (zmta02.collab.prod.int.phx2.redhat.com [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id 3zTyP7cuh4ce; Sat, 26 Sep 2009 14:55:07 -0400 (EDT)
Received: from int-mx02.intmail.prod.int.phx2.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12])
	by zmta02.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id D77239DB9F;
	Sat, 26 Sep 2009 14:55:07 -0400 (EDT)
Received: from mx1.redhat.com (ext-mx07.extmail.prod.ext.phx2.redhat.com [10.5.110.11])
	by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id n8QIt1Ks015507;
	Sat, 26 Sep 2009 14:55:01 -0400
Received: from vger.kernel.org (vger.kernel.org [209.132.176.167])
	by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id n8QImrPD007277;
	Sat, 26 Sep 2009 14:54:56 -0400
Received: (majordomo at vger.kernel.org) by vger.kernel.org via listexpand
	id S1753121AbZIZSyo (ORCPT <rfc822;mrezanin at redhat.com> + 41 others);
	Sat, 26 Sep 2009 14:54:44 -0400
Received: (majordomo at vger.kernel.org) by vger.kernel.org id S1752997AbZIZSye
	(ORCPT <rfc822;linux-kernel-outgoing>);
	Sat, 26 Sep 2009 14:54:34 -0400
Received: from casper.infradead.org ([85.118.1.10]:36421 "EHLO
	casper.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1752837AbZIZSyZ (ORCPT
	<rfc822;linux-kernel at vger.kernel.org>);
	Sat, 26 Sep 2009 14:54:25 -0400
Received: from [83.119.188.87] (helo=localhost.localdomain)
	by casper.infradead.org with esmtpsa (Exim 4.69 #1 (Red Hat Linux))
	id 1MrcPV-0002Uh-2m; Sat, 26 Sep 2009 18:54:21 +0000
Date: 	Sat, 26 Sep 2009 20:50:49 +0200
From: Arjan van de Ven <arjan at infradead.org>
To: Arjan van de Ven <arjan at infradead.org>
Cc: linux-kernel at vger.kernel.org, torvalds at linux-foundation.org, mingo at elte.hu
Subject: [PATCH 2/9] Simplify bound checks in nvram for copy_from_user
Message-ID: <20090926205049.33703eea at infradead.org>
In-Reply-To: <20090926204951.424e567e at infradead.org>
References: <20090926204951.424e567e at infradead.org>
Organization: Intel
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-SRS-Rewrite: SMTP reverse-path rewritten from <arjan at infradead.org> by casper.infradead.org
	See http://www.infradead.org/rpr.html
Sender: linux-kernel-owner at vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: 	linux-kernel at vger.kernel.org
X-RedHat-Spam-Score: -4  (RCVD_IN_DNSWL_MED)
X-Scanned-By: MIMEDefang 2.67 on 10.5.11.12
X-Scanned-By: MIMEDefang 2.67 on 10.5.110.11
Status: RO
Content-Length: 1655
Lines: 52


From: Arjan van de Ven <arjan at linux.intel.com>
Subject: [PATCH 2/9] Simplify bound checks in nvram for copy_from_user

The nvram driver's write() function has an interesting bound check.
Not only does it use the always-hard-to-read ? C operator, it also
has a magic "i" in there, which comes from the file position of
the file.

On first sight the check looks sane, however the value of "i" is not 
checked at all and I as human don't know if the C type rules guarantee
that the result is always within bounds.. and neither does gcc seem to
know.

This patch simplifies the checks and guarantees that the copy will not
overflow the destination buffer.

Signed-off-by: Arjan van de Ven <arjan at linux.intel.com>


diff --git a/drivers/char/nvram.c b/drivers/char/nvram.c
index 88cee40..b2a7eaf 100644
--- a/drivers/char/nvram.c
+++ b/drivers/char/nvram.c
@@ -267,7 +267,15 @@ static ssize_t nvram_write(struct file *file, const char __user *buf,
 	unsigned char *tmp;
 	int len;
 
-	len = (NVRAM_BYTES - i) < count ? (NVRAM_BYTES - i) : count;
+	len = count;
+	if (count > NVRAM_BYTES - i)
+		len = NVRAM_BYTES - i;
+
+	if (len > NVRAM_BYTES)
+		len = NVRAM_BYTES;
+	if (len < 0)
+		return -EINVAL;
+
 	if (copy_from_user(contents, buf, len))
 		return -EFAULT;
 


-- 
Arjan van de Ven 	Intel Open Source Technology Centre
For development, discussion and tips for power savings, 
visit http://www.lesswatts.org
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

>From davej  Sat Sep 26 14:57:18 2009
Return-Path: linux-kernel-owner at vger.kernel.org
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
	gelk.kernelslacker.org
X-Spam-Level: 
X-Spam-Status: No, score=-6.2 required=5.0 tests=AWL,BAYES_00,
	RCVD_IN_DNSWL_MED,UNPARSEABLE_RELAY autolearn=ham version=3.2.5
Received: from mail.corp.redhat.com [10.5.5.52]
	by gelk.kernelslacker.org with IMAP (fetchmail-6.3.9)
	for <davej at localhost> (single-drop); Sat, 26 Sep 2009 14:57:18 -0400 (EDT)
Received: from zmta02.collab.prod.int.phx2.redhat.com (LHLO
 zmta02.collab.prod.int.phx2.redhat.com) (10.5.5.32) by
 mail04.corp.redhat.com with LMTP; Sat, 26 Sep 2009 14:55:04 -0400 (EDT)
Received: from localhost (localhost.localdomain [127.0.0.1])
	by zmta02.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id A27AB9E536;
	Sat, 26 Sep 2009 14:55:04 -0400 (EDT)
Received: from zmta02.collab.prod.int.phx2.redhat.com ([127.0.0.1])
	by localhost (zmta02.collab.prod.int.phx2.redhat.com [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id qOnejO9jCrDH; Sat, 26 Sep 2009 14:55:04 -0400 (EDT)
Received: from int-mx02.intmail.prod.int.phx2.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12])
	by zmta02.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id 675CA9DB9F;
	Sat, 26 Sep 2009 14:55:04 -0400 (EDT)
Received: from mx1.redhat.com (ext-mx01.extmail.prod.ext.phx2.redhat.com [10.5.110.5])
	by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id n8QIsw7o015502;
	Sat, 26 Sep 2009 14:54:58 -0400
Received: from vger.kernel.org (vger.kernel.org [209.132.176.167])
	by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id n8QIiTcx002301;
	Sat, 26 Sep 2009 14:54:45 -0400
Received: (majordomo at vger.kernel.org) by vger.kernel.org via listexpand
	id S1753027AbZIZSye (ORCPT <rfc822;mrezanin at redhat.com> + 41 others);
	Sat, 26 Sep 2009 14:54:34 -0400
Received: (majordomo at vger.kernel.org) by vger.kernel.org id S1752975AbZIZSyc
	(ORCPT <rfc822;linux-kernel-outgoing>);
	Sat, 26 Sep 2009 14:54:32 -0400
Received: from casper.infradead.org ([85.118.1.10]:36410 "EHLO
	casper.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1752691AbZIZSyW (ORCPT
	<rfc822;linux-kernel at vger.kernel.org>);
	Sat, 26 Sep 2009 14:54:22 -0400
Received: from [83.119.188.87] (helo=localhost.localdomain)
	by casper.infradead.org with esmtpsa (Exim 4.69 #1 (Red Hat Linux))
	id 1MrcPV-0002Uh-GY; Sat, 26 Sep 2009 18:54:21 +0000
Date: 	Sat, 26 Sep 2009 20:51:14 +0200
From: Arjan van de Ven <arjan at infradead.org>
To: Arjan van de Ven <arjan at infradead.org>
Cc: linux-kernel at vger.kernel.org, torvalds at linux-foundation.org, mingo at elte.hu,
        linux-wireless at vger.kernel.org
Subject: [PATCH 3/9] Add bound checks in wext for copy_from_user
Message-ID: <20090926205114.4ec62382 at infradead.org>
In-Reply-To: <20090926204951.424e567e at infradead.org>
References: <20090926204951.424e567e at infradead.org>
Organization: Intel
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-SRS-Rewrite: SMTP reverse-path rewritten from <arjan at infradead.org> by casper.infradead.org
	See http://www.infradead.org/rpr.html
Sender: linux-kernel-owner at vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: 	linux-kernel at vger.kernel.org
X-RedHat-Spam-Score: -4  (RCVD_IN_DNSWL_MED)
X-Scanned-By: MIMEDefang 2.67 on 10.5.11.12
X-Scanned-By: MIMEDefang 2.67 on 10.5.110.5
Status: RO
Content-Length: 1551
Lines: 47

From: Arjan van de Ven <arjan at linux.intel.com>
Subject: [PATCH 3/9] Add bound checks in wext for copy_from_user
CC: linux-wireless at vger.kernel.org

The wireless extensions have a copy_from_user to a local stack
array "essid", but both me and gcc have failed to find where
the bounds for this copy are located in the code.

This patch adds some basic sanity checks for the copy length
to make sure that we don't overflow the stack buffer.

Signed-off-by: Arjan van de Ven <arjan at linux.intel.com>


diff --git a/net/wireless/wext.c b/net/wireless/wext.c
index 5b4a0ce..34beae6 100644
--- a/net/wireless/wext.c
+++ b/net/wireless/wext.c
@@ -773,10 +773,13 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
 			essid_compat = 1;
 		else if (IW_IS_SET(cmd) && (iwp->length != 0)) {
 			char essid[IW_ESSID_MAX_SIZE + 1];
+			unsigned int len;
+			len = iwp->length * descr->token_size;
 
-			err = copy_from_user(essid, iwp->pointer,
-					     iwp->length *
-					     descr->token_size);
+			if (len > IW_ESSID_MAX_SIZE)
+				return -EFAULT;
+
+			err = copy_from_user(essid, iwp->pointer, len);
 			if (err)
 				return -EFAULT;
 



-- 
Arjan van de Ven 	Intel Open Source Technology Centre
For development, discussion and tips for power savings, 
visit http://www.lesswatts.org
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

>From davej  Sat Sep 26 14:57:15 2009
Return-Path: linux-kernel-owner at vger.kernel.org
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
	gelk.kernelslacker.org
X-Spam-Level: 
X-Spam-Status: No, score=-6.2 required=5.0 tests=AWL,BAYES_00,
	RCVD_IN_DNSWL_MED,UNPARSEABLE_RELAY autolearn=ham version=3.2.5
Received: from mail.corp.redhat.com [10.5.5.52]
	by gelk.kernelslacker.org with IMAP (fetchmail-6.3.9)
	for <davej at localhost> (single-drop); Sat, 26 Sep 2009 14:57:15 -0400 (EDT)
Received: from zmta02.collab.prod.int.phx2.redhat.com (LHLO
 zmta02.collab.prod.int.phx2.redhat.com) (10.5.5.32) by
 mail04.corp.redhat.com with LMTP; Sat, 26 Sep 2009 14:54:53 -0400 (EDT)
Received: from localhost (localhost.localdomain [127.0.0.1])
	by zmta02.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id 089D89E536;
	Sat, 26 Sep 2009 14:54:53 -0400 (EDT)
Received: from zmta02.collab.prod.int.phx2.redhat.com ([127.0.0.1])
	by localhost (zmta02.collab.prod.int.phx2.redhat.com [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id 42yBhVM1-bIT; Sat, 26 Sep 2009 14:54:52 -0400 (EDT)
Received: from int-mx03.intmail.prod.int.phx2.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.16])
	by zmta02.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id C205B9DB9F;
	Sat, 26 Sep 2009 14:54:52 -0400 (EDT)
Received: from mx1.redhat.com (ext-mx01.extmail.prod.ext.phx2.redhat.com [10.5.110.5])
	by int-mx03.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id n8QIsj7c001906;
	Sat, 26 Sep 2009 14:54:46 -0400
Received: from vger.kernel.org (vger.kernel.org [209.132.176.167])
	by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id n8QIiTcw002301;
	Sat, 26 Sep 2009 14:54:33 -0400
Received: (majordomo at vger.kernel.org) by vger.kernel.org via listexpand
	id S1752928AbZIZSy1 (ORCPT <rfc822;mrezanin at redhat.com> + 41 others);
	Sat, 26 Sep 2009 14:54:27 -0400
Received: (majordomo at vger.kernel.org) by vger.kernel.org id S1752675AbZIZSy0
	(ORCPT <rfc822;linux-kernel-outgoing>);
	Sat, 26 Sep 2009 14:54:26 -0400
Received: from casper.infradead.org ([85.118.1.10]:36396 "EHLO
	casper.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1750795AbZIZSyT (ORCPT
	<rfc822;linux-kernel at vger.kernel.org>);
	Sat, 26 Sep 2009 14:54:19 -0400
Received: from [83.119.188.87] (helo=localhost.localdomain)
	by casper.infradead.org with esmtpsa (Exim 4.69 #1 (Red Hat Linux))
	id 1MrcPW-0002Uh-1I; Sat, 26 Sep 2009 18:54:22 +0000
Date: 	Sat, 26 Sep 2009 20:51:50 +0200
From: Arjan van de Ven <arjan at infradead.org>
To: Arjan van de Ven <arjan at infradead.org>
Cc: linux-kernel at vger.kernel.org, torvalds at linux-foundation.org, mingo at elte.hu,
        hpa at zytor.com, tglx at tglx.de
Subject: [PATCH 4/9] Simplify bound checks in the MTRR code
Message-ID: <20090926205150.30797709 at infradead.org>
In-Reply-To: <20090926204951.424e567e at infradead.org>
References: <20090926204951.424e567e at infradead.org>
Organization: Intel
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-SRS-Rewrite: SMTP reverse-path rewritten from <arjan at infradead.org> by casper.infradead.org
	See http://www.infradead.org/rpr.html
Sender: linux-kernel-owner at vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: 	linux-kernel at vger.kernel.org
X-RedHat-Spam-Score: -4  (RCVD_IN_DNSWL_MED)
X-Scanned-By: MIMEDefang 2.67 on 10.5.11.16
X-Scanned-By: MIMEDefang 2.67 on 10.5.110.5
Status: RO
Content-Length: 1683
Lines: 61

From: Arjan van de Ven <arjan at linux.intel.com>
Subject: [PATCH 4/9] Simplify bound checks in the MTRR code
CC: mingo at elte.hu
CC: hpa at zytor.com
CC: tglx at tglx.de

The current bound checks for copy_from_user in the MTRR driver
are not as obvious as they could be, and gcc agrees with that.

This patch simplifies the boundary checks to the point that gcc
can now prove to itself that the copy_from_user() is never going
past its bounds.

Signed-off-by: Arjan van de Ven <arjan at linux.intel.com>

--- linux-2.6.31.noarch/arch/x86/kernel/cpu/mtrr/if.c~	2009-09-28 16:51:07.000000000 -0400
+++ linux-2.6.31.noarch/arch/x86/kernel/cpu/mtrr/if.c	2009-09-28 16:52:30.000000000 -0400
@@ -94,17 +94,26 @@ mtrr_write(struct file *file, const char
 	unsigned long long base, size;
 	char *ptr;
 	char line[LINE_SIZE];
+	int length;
 	size_t linelen;
 
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
-	if (!len)
-		return -EINVAL;
+
 	memset(line, 0, LINE_SIZE);
-	if (len > LINE_SIZE)
-		len = LINE_SIZE;
-	if (copy_from_user(line, buf, len - 1))
+
+	length = len;
+	length--;
+
+	if (length > LINE_SIZE - 1)
+		length = LINE_SIZE - 1;
+
+	if (length < 0)
+		return -EINVAL;
+
+	if (copy_from_user(line, buf, length))
 		return -EFAULT;
+
 	linelen = strlen(line);
 	ptr = line + linelen - 1;
 	if (linelen && *ptr == '\n')

-- 
Arjan van de Ven 	Intel Open Source Technology Centre
For development, discussion and tips for power savings, 
visit http://www.lesswatts.org
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

>From davej  Sat Sep 26 14:57:28 2009
Return-Path: linux-kernel-owner at vger.kernel.org
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
	gelk.kernelslacker.org
X-Spam-Level: 
X-Spam-Status: No, score=-6.2 required=5.0 tests=AWL,BAYES_00,
	RCVD_IN_DNSWL_MED,UNPARSEABLE_RELAY autolearn=ham version=3.2.5
Received: from mail.corp.redhat.com [10.5.5.52]
	by gelk.kernelslacker.org with IMAP (fetchmail-6.3.9)
	for <davej at localhost> (single-drop); Sat, 26 Sep 2009 14:57:28 -0400 (EDT)
Received: from zmta02.collab.prod.int.phx2.redhat.com (LHLO
 zmta02.collab.prod.int.phx2.redhat.com) (10.5.5.32) by
 mail04.corp.redhat.com with LMTP; Sat, 26 Sep 2009 14:56:09 -0400 (EDT)
Received: from localhost (localhost.localdomain [127.0.0.1])
	by zmta02.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id 3BB159CE2F;
	Sat, 26 Sep 2009 14:56:09 -0400 (EDT)
Received: from zmta02.collab.prod.int.phx2.redhat.com ([127.0.0.1])
	by localhost (zmta02.collab.prod.int.phx2.redhat.com [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id w5I9rbKDiOVg; Sat, 26 Sep 2009 14:56:09 -0400 (EDT)
Received: from int-mx04.intmail.prod.int.phx2.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.17])
	by zmta02.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id 00D0E9C7CF;
	Sat, 26 Sep 2009 14:56:08 -0400 (EDT)
Received: from mx1.redhat.com (ext-mx07.extmail.prod.ext.phx2.redhat.com [10.5.110.11])
	by int-mx04.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id n8QIu1VY022597;
	Sat, 26 Sep 2009 14:56:02 -0400
Received: from vger.kernel.org (vger.kernel.org [209.132.176.167])
	by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id n8QImrPI007277;
	Sat, 26 Sep 2009 14:55:55 -0400
Received: (majordomo at vger.kernel.org) by vger.kernel.org via listexpand
	id S1752826AbZIZSyY (ORCPT <rfc822;mrezanin at redhat.com> + 41 others);
	Sat, 26 Sep 2009 14:54:24 -0400
Received: (majordomo at vger.kernel.org) by vger.kernel.org id S1752675AbZIZSyW
	(ORCPT <rfc822;linux-kernel-outgoing>);
	Sat, 26 Sep 2009 14:54:22 -0400
Received: from casper.infradead.org ([85.118.1.10]:36394 "EHLO
	casper.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1751800AbZIZSyT (ORCPT
	<rfc822;linux-kernel at vger.kernel.org>);
	Sat, 26 Sep 2009 14:54:19 -0400
Received: from [83.119.188.87] (helo=localhost.localdomain)
	by casper.infradead.org with esmtpsa (Exim 4.69 #1 (Red Hat Linux))
	id 1MrcPW-0002Uh-Ga; Sat, 26 Sep 2009 18:54:22 +0000
Date: 	Sat, 26 Sep 2009 20:52:23 +0200
From: Arjan van de Ven <arjan at infradead.org>
To: Arjan van de Ven <arjan at infradead.org>
Cc: linux-kernel at vger.kernel.org, torvalds at linux-foundation.org, mingo at elte.hu,
        lenb at kernel.org
Subject: [PATCH 5/9] Add bound checks in acpi/video for copy_from_user
Message-ID: <20090926205223.61dd0844 at infradead.org>
In-Reply-To: <20090926204951.424e567e at infradead.org>
References: <20090926204951.424e567e at infradead.org>
Organization: Intel
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-SRS-Rewrite: SMTP reverse-path rewritten from <arjan at infradead.org> by casper.infradead.org
	See http://www.infradead.org/rpr.html
Sender: linux-kernel-owner at vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: 	linux-kernel at vger.kernel.org
X-RedHat-Spam-Score: -4  (RCVD_IN_DNSWL_MED)
X-Scanned-By: MIMEDefang 2.67 on 10.5.11.17
X-Scanned-By: MIMEDefang 2.67 on 10.5.110.11
Status: RO
Content-Length: 2065
Lines: 75

From: Arjan van de Ven <arjan at linux.intel.com>
Subject: [PATCH 5/9] Add bound checks in acpi/video for copy_from_user
CC: Len Brown <lenb at kernel.org>

The ACPI video driver has a few boundary checks for copy_from_user
that unfortunately confuse the GCC optimizer.

This patch simplifies these boundary checks to the point that
gcc knows they copy_from_user() is always within bounds.

Signed-off-by: Arjan van de Ven <arjan at linux.intel.com>


diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 94b1a4c..0dd2cc8 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -1218,7 +1218,9 @@ acpi_video_device_write_state(struct file *file,
 	u32 state = 0;
 
 
-	if (!dev || count + 1 > sizeof str)
+	if (!dev)
+		return -EINVAL;
+	if (count >= sizeof(str))
 		return -EINVAL;
 
 	if (copy_from_user(str, buffer, count))
@@ -1275,7 +1277,10 @@ acpi_video_device_write_brightness(struct file *file,
 	int i;
 
 
-	if (!dev || !dev->brightness || count + 1 > sizeof str)
+	if (!dev || !dev->brightness)
+		return -EINVAL;
+
+	if (count >= sizeof(str))
 		return -EINVAL;
 
 	if (copy_from_user(str, buffer, count))
@@ -1557,7 +1562,10 @@ acpi_video_bus_write_POST(struct file *file,
 	unsigned long long opt, options;
 
 
-	if (!video || count + 1 > sizeof str)
+	if (!video)
+		return -EINVAL;
+
+	if (count >= sizeof(str))
 		return -EINVAL;
 
 	status = acpi_video_bus_POST_options(video, &options);
@@ -1597,7 +1605,9 @@ acpi_video_bus_write_DOS(struct file *file,
 	unsigned long opt;
 
 
-	if (!video || count + 1 > sizeof str)
+	if (!video)
+		return -EINVAL;
+	if (count >= sizeof(str))
 		return -EINVAL;
 
 	if (copy_from_user(str, buffer, count))



-- 
Arjan van de Ven 	Intel Open Source Technology Centre
For development, discussion and tips for power savings, 
visit http://www.lesswatts.org
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

>From davej  Sat Sep 26 14:57:21 2009
Return-Path: linux-kernel-owner at vger.kernel.org
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
	gelk.kernelslacker.org
X-Spam-Level: 
X-Spam-Status: No, score=-6.2 required=5.0 tests=AWL,BAYES_00,
	RCVD_IN_DNSWL_MED,UNPARSEABLE_RELAY autolearn=ham version=3.2.5
Received: from mail.corp.redhat.com [10.5.5.52]
	by gelk.kernelslacker.org with IMAP (fetchmail-6.3.9)
	for <davej at localhost> (single-drop); Sat, 26 Sep 2009 14:57:21 -0400 (EDT)
Received: from zmta01.collab.prod.int.phx2.redhat.com (LHLO
 zmta01.collab.prod.int.phx2.redhat.com) (10.5.5.31) by
 mail04.corp.redhat.com with LMTP; Sat, 26 Sep 2009 14:55:31 -0400 (EDT)
Received: from localhost (localhost.localdomain [127.0.0.1])
	by zmta01.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id C573B92827;
	Sat, 26 Sep 2009 14:55:31 -0400 (EDT)
Received: from zmta01.collab.prod.int.phx2.redhat.com ([127.0.0.1])
	by localhost (zmta01.collab.prod.int.phx2.redhat.com [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id kOeSnU2O0+Pc; Sat, 26 Sep 2009 14:55:31 -0400 (EDT)
Received: from int-mx02.intmail.prod.int.phx2.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12])
	by zmta01.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id 8614591AC5;
	Sat, 26 Sep 2009 14:55:31 -0400 (EDT)
Received: from mx1.redhat.com (ext-mx07.extmail.prod.ext.phx2.redhat.com [10.5.110.11])
	by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id n8QItOv6015831;
	Sat, 26 Sep 2009 14:55:25 -0400
Received: from vger.kernel.org (vger.kernel.org [209.132.176.167])
	by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id n8QImrPE007277;
	Sat, 26 Sep 2009 14:55:09 -0400
Received: (majordomo at vger.kernel.org) by vger.kernel.org via listexpand
	id S1753137AbZIZSzA (ORCPT <rfc822;mrezanin at redhat.com> + 41 others);
	Sat, 26 Sep 2009 14:55:00 -0400
Received: (majordomo at vger.kernel.org) by vger.kernel.org id S1752707AbZIZSya
	(ORCPT <rfc822;linux-kernel-outgoing>);
	Sat, 26 Sep 2009 14:54:30 -0400
Received: from casper.infradead.org ([85.118.1.10]:36400 "EHLO
	casper.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1750867AbZIZSyU (ORCPT
	<rfc822;linux-kernel at vger.kernel.org>);
	Sat, 26 Sep 2009 14:54:20 -0400
Received: from [83.119.188.87] (helo=localhost.localdomain)
	by casper.infradead.org with esmtpsa (Exim 4.69 #1 (Red Hat Linux))
	id 1MrcPX-0002Uh-53; Sat, 26 Sep 2009 18:54:23 +0000
Date: 	Sat, 26 Sep 2009 20:52:55 +0200
From: Arjan van de Ven <arjan at infradead.org>
To: Arjan van de Ven <arjan at infradead.org>
Cc: linux-kernel at vger.kernel.org, torvalds at linux-foundation.org, mingo at elte.hu,
        sfrench at samba.org
Subject: [PATCH 6/9] Simplify bound checks in cifs for copy_from_user
Message-ID: <20090926205255.1d9de6c7 at infradead.org>
In-Reply-To: <20090926204951.424e567e at infradead.org>
References: <20090926204951.424e567e at infradead.org>
Organization: Intel
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-SRS-Rewrite: SMTP reverse-path rewritten from <arjan at infradead.org> by casper.infradead.org
	See http://www.infradead.org/rpr.html
Sender: linux-kernel-owner at vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: 	linux-kernel at vger.kernel.org
X-RedHat-Spam-Score: -4  (RCVD_IN_DNSWL_MED)
X-Scanned-By: MIMEDefang 2.67 on 10.5.11.12
X-Scanned-By: MIMEDefang 2.67 on 10.5.110.11
Status: RO
Content-Length: 1436
Lines: 46

From: Arjan van de Ven <arjan at linux.intel.com>
Subject: [PATCH 6/9] Simplify bound checks in cifs for copy_from_user
CC: Steve French <sfrench at samba.org>

The CIFS code unfortunately hits a missed optimization in gcc
(http://gcc.gnu.org/bugzilla/show_bug.cgi?id=41477)
where gcc can't prove to itself that count will not be larger than 11.

This patch simplifies the expression so that GCC does realize this,
giving slightly better code soon when copy_from_user() grows some checks.

Signed-off-by: Arjan van de Ven <arjan at linux.intel.com>

diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
index 42cec2a..94b86da 100644
--- a/fs/cifs/cifs_debug.c
+++ b/fs/cifs/cifs_debug.c
@@ -732,11 +732,13 @@ static ssize_t cifs_security_flags_proc_write(struct file *file,
 	char flags_string[12];
 	char c;
 
-	if ((count < 1) || (count > 11))
-		return -EINVAL;
-
 	memset(flags_string, 0, 12);
 
+	if (count < 1)
+		return -EINVAL;
+	if (count > 11)
+		return -EINVAL;
+
 	if (copy_from_user(flags_string, buffer, count))
 		return -EFAULT;
 



-- 
Arjan van de Ven 	Intel Open Source Technology Centre
For development, discussion and tips for power savings, 
visit http://www.lesswatts.org
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

>From davej  Sat Sep 26 14:57:16 2009
Return-Path: linux-kernel-owner at vger.kernel.org
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
	gelk.kernelslacker.org
X-Spam-Level: 
X-Spam-Status: No, score=-6.2 required=5.0 tests=AWL,BAYES_00,
	RCVD_IN_DNSWL_MED,UNPARSEABLE_RELAY autolearn=ham version=3.2.5
Received: from mail.corp.redhat.com [10.5.5.52]
	by gelk.kernelslacker.org with IMAP (fetchmail-6.3.9)
	for <davej at localhost> (single-drop); Sat, 26 Sep 2009 14:57:16 -0400 (EDT)
Received: from zmta03.collab.prod.int.phx2.redhat.com (LHLO
 zmta03.collab.prod.int.phx2.redhat.com) (10.5.5.33) by
 mail04.corp.redhat.com with LMTP; Sat, 26 Sep 2009 14:55:03 -0400 (EDT)
Received: from localhost (localhost.localdomain [127.0.0.1])
	by zmta03.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id 76D154E5A4;
	Sat, 26 Sep 2009 14:55:03 -0400 (EDT)
Received: from zmta03.collab.prod.int.phx2.redhat.com ([127.0.0.1])
	by localhost (zmta03.collab.prod.int.phx2.redhat.com [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id UcwzvLLoE+tE; Sat, 26 Sep 2009 14:55:03 -0400 (EDT)
Received: from int-mx01.intmail.prod.int.phx2.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11])
	by zmta03.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id 31D294E591;
	Sat, 26 Sep 2009 14:55:03 -0400 (EDT)
Received: from mx1.redhat.com (ext-mx07.extmail.prod.ext.phx2.redhat.com [10.5.110.11])
	by int-mx01.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id n8QIsuQR011097;
	Sat, 26 Sep 2009 14:54:56 -0400
Received: from vger.kernel.org (vger.kernel.org [209.132.176.167])
	by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id n8QImrPC007277;
	Sat, 26 Sep 2009 14:54:43 -0400
Received: (majordomo at vger.kernel.org) by vger.kernel.org via listexpand
	id S1752970AbZIZSyb (ORCPT <rfc822;mrezanin at redhat.com> + 41 others);
	Sat, 26 Sep 2009 14:54:31 -0400
Received: (majordomo at vger.kernel.org) by vger.kernel.org id S1752675AbZIZSy3
	(ORCPT <rfc822;linux-kernel-outgoing>);
	Sat, 26 Sep 2009 14:54:29 -0400
Received: from casper.infradead.org ([85.118.1.10]:36404 "EHLO
	casper.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1751887AbZIZSyU (ORCPT
	<rfc822;linux-kernel at vger.kernel.org>);
	Sat, 26 Sep 2009 14:54:20 -0400
Received: from [83.119.188.87] (helo=localhost.localdomain)
	by casper.infradead.org with esmtpsa (Exim 4.69 #1 (Red Hat Linux))
	id 1MrcPX-0002Uh-KU; Sat, 26 Sep 2009 18:54:23 +0000
Date: 	Sat, 26 Sep 2009 20:53:36 +0200
From: Arjan van de Ven <arjan at infradead.org>
To: Arjan van de Ven <arjan at infradead.org>
Cc: linux-kernel at vger.kernel.org, torvalds at linux-foundation.org, mingo at elte.hu,
        jmorris at nami.org
Subject: [PATCH 7/9] Simplify bound checks in capabilities for
 copy_from_user
Message-ID: <20090926205336.77bc5b21 at infradead.org>
In-Reply-To: <20090926204951.424e567e at infradead.org>
References: <20090926204951.424e567e at infradead.org>
Organization: Intel
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-SRS-Rewrite: SMTP reverse-path rewritten from <arjan at infradead.org> by casper.infradead.org
	See http://www.infradead.org/rpr.html
Sender: linux-kernel-owner at vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: 	linux-kernel at vger.kernel.org
X-RedHat-Spam-Score: -4  (RCVD_IN_DNSWL_MED)
X-Scanned-By: MIMEDefang 2.67 on 10.5.11.11
X-Scanned-By: MIMEDefang 2.67 on 10.5.110.11
Status: RO
Content-Length: 1883
Lines: 51

From: Arjan van de Ven <arjan at linux.intel.com>
Subject: [PATCH 7/9] Simplify bound checks in capabilities for copy_from_user
CC: James Morris <jmorris at namei.org>

The capabilities syscall has a copy_from_user() call where gcc currently
cannot prove to itself that the copy is always within bounds.

This patch adds a very explicity bound check to prove to gcc that 
this copy_from_user cannot overflow its destination buffer.

Signed-off-by: Arjan van de Ven <arjan at linux.intel.com>

diff --git a/kernel/capability.c b/kernel/capability.c
index 4e17041..204f11f 100644
--- a/kernel/capability.c
+++ b/kernel/capability.c
@@ -238,7 +241,7 @@ SYSCALL_DEFINE2(capget, cap_user_header_t, header, cap_user_data_t, dataptr)
 SYSCALL_DEFINE2(capset, cap_user_header_t, header, const cap_user_data_t, data)
 {
 	struct __user_cap_data_struct kdata[_KERNEL_CAPABILITY_U32S];
-	unsigned i, tocopy;
+	unsigned i, tocopy, copybytes;
 	kernel_cap_t inheritable, permitted, effective;
 	struct cred *new;
 	int ret;
@@ -255,8 +258,11 @@ SYSCALL_DEFINE2(capset, cap_user_header_t, header, const cap_user_data_t, data)
 	if (pid != 0 && pid != task_pid_vnr(current))
 		return -EPERM;
 
-	if (copy_from_user(&kdata, data,
-			   tocopy * sizeof(struct __user_cap_data_struct)))
+	copybytes = tocopy * sizeof(struct __user_cap_data_struct);
+	if (copybytes > (_KERNEL_CAPABILITY_U32S * sizeof(u32)))
+		return -EFAULT;
+
+	if (copy_from_user(&kdata, data, copybytes))
 		return -EFAULT;
 
 	for (i = 0; i < tocopy; i++) {



-- 
Arjan van de Ven 	Intel Open Source Technology Centre
For development, discussion and tips for power savings, 
visit http://www.lesswatts.org
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

>From davej  Sat Sep 26 14:57:23 2009
Return-Path: linux-kernel-owner at vger.kernel.org
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
	gelk.kernelslacker.org
X-Spam-Level: 
X-Spam-Status: No, score=-6.2 required=5.0 tests=AWL,BAYES_00,
	RCVD_IN_DNSWL_MED,UNPARSEABLE_RELAY autolearn=ham version=3.2.5
Received: from mail.corp.redhat.com [10.5.5.52]
	by gelk.kernelslacker.org with IMAP (fetchmail-6.3.9)
	for <davej at localhost> (single-drop); Sat, 26 Sep 2009 14:57:23 -0400 (EDT)
Received: from zmta01.collab.prod.int.phx2.redhat.com (LHLO
 zmta01.collab.prod.int.phx2.redhat.com) (10.5.5.31) by
 mail04.corp.redhat.com with LMTP; Sat, 26 Sep 2009 14:55:51 -0400 (EDT)
Received: from localhost (localhost.localdomain [127.0.0.1])
	by zmta01.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id 8839792827;
	Sat, 26 Sep 2009 14:55:51 -0400 (EDT)
Received: from zmta01.collab.prod.int.phx2.redhat.com ([127.0.0.1])
	by localhost (zmta01.collab.prod.int.phx2.redhat.com [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id 7Yts36SyUiSk; Sat, 26 Sep 2009 14:55:51 -0400 (EDT)
Received: from int-mx04.intmail.prod.int.phx2.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.17])
	by zmta01.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id 4C9C691AC5;
	Sat, 26 Sep 2009 14:55:51 -0400 (EDT)
Received: from mx1.redhat.com (ext-mx07.extmail.prod.ext.phx2.redhat.com [10.5.110.11])
	by int-mx04.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id n8QItiGJ022579;
	Sat, 26 Sep 2009 14:55:44 -0400
Received: from vger.kernel.org (vger.kernel.org [209.132.176.167])
	by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id n8QImrPG007277;
	Sat, 26 Sep 2009 14:55:31 -0400
Received: (majordomo at vger.kernel.org) by vger.kernel.org via listexpand
	id S1753086AbZIZSzQ (ORCPT <rfc822;mrezanin at redhat.com> + 41 others);
	Sat, 26 Sep 2009 14:55:16 -0400
Received: (majordomo at vger.kernel.org) by vger.kernel.org id S1752878AbZIZSy1
	(ORCPT <rfc822;linux-kernel-outgoing>);
	Sat, 26 Sep 2009 14:54:27 -0400
Received: from casper.infradead.org ([85.118.1.10]:36406 "EHLO
	casper.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1752669AbZIZSyV (ORCPT
	<rfc822;linux-kernel at vger.kernel.org>);
	Sat, 26 Sep 2009 14:54:21 -0400
Received: from [83.119.188.87] (helo=localhost.localdomain)
	by casper.infradead.org with esmtpsa (Exim 4.69 #1 (Red Hat Linux))
	id 1MrcPY-0002Uh-56; Sat, 26 Sep 2009 18:54:24 +0000
Date: 	Sat, 26 Sep 2009 20:54:06 +0200
From: Arjan van de Ven <arjan at infradead.org>
To: Arjan van de Ven <arjan at infradead.org>
Cc: linux-kernel at vger.kernel.org, torvalds at linux-foundation.org, mingo at elte.hu,
        akpm at linux-foundation.org
Subject: [PATCH 8/9] Add explicit bound checks in mm/migrate.c
Message-ID: <20090926205406.30d55b08 at infradead.org>
In-Reply-To: <20090926204951.424e567e at infradead.org>
References: <20090926204951.424e567e at infradead.org>
Organization: Intel
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-SRS-Rewrite: SMTP reverse-path rewritten from <arjan at infradead.org> by casper.infradead.org
	See http://www.infradead.org/rpr.html
Sender: linux-kernel-owner at vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: 	linux-kernel at vger.kernel.org
X-RedHat-Spam-Score: -4  (RCVD_IN_DNSWL_MED)
X-Scanned-By: MIMEDefang 2.67 on 10.5.11.17
X-Scanned-By: MIMEDefang 2.67 on 10.5.110.11
Status: RO
Content-Length: 1531
Lines: 47

From: Arjan van de Ven <arjan at linux.intel.com>
Subject: [PATCH 8/9] Add explicit bound checks in mm/migrate.c
CC: akpm at linux-foundation.org

The memory migration code has some curious copy_from_user bounds,
that are likely ok, but are not immediately obvious to me or to GCC.

This patch adds a simple explicit bound check; this allows GCC
and me to be more assured that the copy_from_user will never overwrite
its destination buffer.

Signed-off-by: Arjan van de Ven <arjan at linux.intel.com>


diff --git a/mm/migrate.c b/mm/migrate.c
index 1a4bf48..5b9ebc5 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -1044,11 +1044,15 @@ static int do_pages_stat(struct mm_struct *mm, unsigned long nr_pages,
 	int err;
 
 	for (i = 0; i < nr_pages; i += chunk_nr) {
+		unsigned int copy;
 		if (chunk_nr + i > nr_pages)
 			chunk_nr = nr_pages - i;
 
-		err = copy_from_user(chunk_pages, &pages[i],
-				     chunk_nr * sizeof(*chunk_pages));
+		copy = chunk_nr * sizeof(*chunk_pages);
+		if (copy > DO_PAGES_STAT_CHUNK_NR)
+			return -EFAULT;
+
+		err = copy_from_user(chunk_pages, &pages[i], copy);
 		if (err) {
 			err = -EFAULT;
 			goto out;


-- 
Arjan van de Ven 	Intel Open Source Technology Centre
For development, discussion and tips for power savings, 
visit http://www.lesswatts.org
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

>From davej  Sat Sep 26 15:24:03 2009
Return-Path: netdev-owner at vger.kernel.org
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
	gelk.kernelslacker.org
X-Spam-Level: 
X-Spam-Status: No, score=-6.2 required=5.0 tests=AWL,BAYES_00,
	RCVD_IN_DNSWL_MED,UNPARSEABLE_RELAY autolearn=ham version=3.2.5
Received: from mail.corp.redhat.com [10.5.5.52]
	by gelk.kernelslacker.org with IMAP (fetchmail-6.3.9)
	for <davej at localhost> (single-drop); Sat, 26 Sep 2009 15:24:03 -0400 (EDT)
Received: from zmta02.collab.prod.int.phx2.redhat.com (LHLO
 zmta02.collab.prod.int.phx2.redhat.com) (10.5.5.32) by
 mail04.corp.redhat.com with LMTP; Sat, 26 Sep 2009 15:23:02 -0400 (EDT)
Received: from localhost (localhost.localdomain [127.0.0.1])
	by zmta02.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id 7BD039D92F;
	Sat, 26 Sep 2009 15:23:02 -0400 (EDT)
Received: from zmta02.collab.prod.int.phx2.redhat.com ([127.0.0.1])
	by localhost (zmta02.collab.prod.int.phx2.redhat.com [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id TPGJET5LrlkZ; Sat, 26 Sep 2009 15:23:02 -0400 (EDT)
Received: from int-mx08.intmail.prod.int.phx2.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.21])
	by zmta02.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id 4D4C49D7C8;
	Sat, 26 Sep 2009 15:23:02 -0400 (EDT)
Received: from mx1.redhat.com (ext-mx08.extmail.prod.ext.phx2.redhat.com [10.5.110.12])
	by int-mx08.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id n8QJN1Th008926;
	Sat, 26 Sep 2009 15:23:01 -0400
Received: from vger.kernel.org (vger.kernel.org [209.132.176.167])
	by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id n8QIxDQS027750;
	Sat, 26 Sep 2009 15:22:49 -0400
Received: (majordomo at vger.kernel.org) by vger.kernel.org via listexpand
	id S1752510AbZIZTWm (ORCPT <rfc822;dnelson at redhat.com> + 16 others);
	Sat, 26 Sep 2009 15:22:42 -0400
Received: (majordomo at vger.kernel.org) by vger.kernel.org id S1752371AbZIZTWl
	(ORCPT <rfc822;netdev-outgoing>); Sat, 26 Sep 2009 15:22:41 -0400
Received: from casper.infradead.org ([85.118.1.10]:41083 "EHLO
	casper.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1752224AbZIZTWl (ORCPT
	<rfc822;netdev at vger.kernel.org>); Sat, 26 Sep 2009 15:22:41 -0400
Received: from [83.119.188.87] (helo=localhost.localdomain)
	by casper.infradead.org with esmtpsa (Exim 4.69 #1 (Red Hat Linux))
	id 1Mrcqx-0003Pe-Cb; Sat, 26 Sep 2009 19:22:43 +0000
Date: 	Sat, 26 Sep 2009 21:23:02 +0200
From: Arjan van de Ven <arjan at infradead.org>
To: Cyrill Gorcunov <gorcunov at gmail.com>
Cc: linux-kernel at vger.kernel.org, torvalds at linux-foundation.org, mingo at elte.hu,
        netdev at vger.kernel.org
Subject: Re: [PATCH 9/9] Add explicit bound checks in net/socket.c
Message-ID: <20090926212302.0ce64a5c at infradead.org>
In-Reply-To: <20090926190103.GB4356 at lenovo>
References: <20090926204951.424e567e at infradead.org>
	<20090926205432.24aa1023 at infradead.org>
	<20090926190103.GB4356 at lenovo>
Organization: Intel
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-SRS-Rewrite: SMTP reverse-path rewritten from <arjan at infradead.org> by casper.infradead.org
	See http://www.infradead.org/rpr.html
Sender: netdev-owner at vger.kernel.org
Precedence: bulk
List-ID: <netdev.vger.kernel.org>
X-Mailing-List: 	netdev at vger.kernel.org
X-RedHat-Spam-Score: -3.762  (AWL,RCVD_IN_DNSWL_MED)
X-Scanned-By: MIMEDefang 2.67 on 10.5.11.21
X-Scanned-By: MIMEDefang 2.67 on 10.5.110.12
Status: RO
Content-Length: 3053
Lines: 93

On Sat, 26 Sep 2009 23:01:03 +0400
Cyrill Gorcunov <gorcunov at gmail.com> wrote:

> [Arjan van de Ven - Sat, Sep 26, 2009 at 08:54:32PM +0200]
> | From: Arjan van de Ven <arjan at linux.intel.com>
> | Subject: [PATCH 9/9] Add explicit bound checks in net/socket.c
> | CC: netdev at vger.kernel.org
> | 
> | The sys_socketcall() function has a very clever system for the copy
> | size of its arguments. Unfortunately, gcc cannot deal with this in
> | terms of proving that the copy_from_user() is then always in bounds.
> | This is the last (well 9th of this series, but last in the kernel)
> such | case around.
> | 
> | With this patch, we can turn on code to make having the boundary
> provably | right for the whole kernel, and detect introduction of new
> security | accidents of this type early on.
> | 
> | Signed-off-by: Arjan van de Ven <arjan at linux.intel.com>
> | 
> | 
> | diff --git a/net/socket.c b/net/socket.c
> | index 49917a1..13a8d67 100644
> | --- a/net/socket.c
> | +++ b/net/socket.c
> | @@ -2098,12 +2098,17 @@ SYSCALL_DEFINE2(socketcall, int, call,
> unsigned long __user *, args) |  	unsigned long a[6];
> |  	unsigned long a0, a1;
> |  	int err;
> | +	unsigned int len;
> |  
> |  	if (call < 1 || call > SYS_ACCEPT4)
> |  		return -EINVAL;
> |  
> | +	len = nargs[call];
> | +	if (len > 6)
> 
> Hi Arjan, wouldn't ARRAY_SIZE suffice beter there?
> Or I miss something?
> 

goof once goof twice, make it sizeof.. that's nicer.

From: Arjan van de Ven <arjan at linux.intel.com>
Subject: [PATCH 9/9] Add explicit bound checks in net/socket.c
CC: netdev at vger.kernel.org

The sys_socketcall() function has a very clever system for the copy
size of its arguments. Unfortunately, gcc cannot deal with this in
terms of proving that the copy_from_user() is then always in bounds.
This is the last (well 9th of this series, but last in the kernel) such
case around.

With this patch, we can turn on code to make having the boundary provably
right for the whole kernel, and detect introduction of new security
accidents of this type early on.

Signed-off-by: Arjan van de Ven <arjan at linux.intel.com>


diff --git a/net/socket.c b/net/socket.c
index 49917a1..13a8d67 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2098,12 +2098,17 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
 	unsigned long a[6];
 	unsigned long a0, a1;
 	int err;
+	unsigned int len;
 
 	if (call < 1 || call > SYS_ACCEPT4)
 		return -EINVAL;
 
+	len = nargs[call];
+	if (len > sizeof(a))
+		return -EINVAL;
+
 	/* copy_from_user should be SMP safe. */
-	if (copy_from_user(a, args, nargs[call]))
+	if (copy_from_user(a, args, len))
 		return -EFAULT;
 
 	audit_socketcall(nargs[call] / sizeof(unsigned long), a);


-- 
Arjan van de Ven 	Intel Open Source Technology Centre
For development, discussion and tips for power savings, 
visit http://www.lesswatts.org
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html



--- NEW FILE patch-2.6.31.3.bz2.sign ---
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: See http://www.kernel.org/signature.html for info

iD8DBQBKzREZyGugalF9Dw4RAp87AJ444UWdtYFwlKS/pedC1/a3qTlQcQCfWDEQ
rs7o0UeFkEbJilisDOWefnM=
=Sl7M
-----END PGP SIGNATURE-----


Index: .cvsignore
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/.cvsignore,v
retrieving revision 1.1014.2.31
retrieving revision 1.1014.2.32
diff -u -p -r1.1014.2.31 -r1.1014.2.32
--- .cvsignore	24 Sep 2009 21:05:03 -0000	1.1014.2.31
+++ .cvsignore	10 Oct 2009 15:04:07 -0000	1.1014.2.32
@@ -5,4 +5,4 @@ kernel-2.6.*.config
 temp-*
 kernel-2.6.31
 linux-2.6.31.tar.bz2
-patch-2.6.31.1.bz2
+patch-2.6.31.3.bz2


Index: config-generic
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/config-generic,v
retrieving revision 1.238.6.40
retrieving revision 1.238.6.41
diff -u -p -r1.238.6.40 -r1.238.6.41
--- config-generic	26 Sep 2009 15:27:37 -0000	1.238.6.40
+++ config-generic	10 Oct 2009 15:04:07 -0000	1.238.6.41
@@ -2234,8 +2234,8 @@ CONFIG_VGA_ARB=y
 CONFIG_DRM=m
 CONFIG_DRM_TDFX=m
 CONFIG_DRM_R128=m
-# CONFIG_DRM_RADEON is not set
-# CONFIG_DRM_RADEON_KMS is not set
+CONFIG_DRM_RADEON=m
+CONFIG_DRM_RADEON_KMS=y
 CONFIG_DRM_I810=m
 CONFIG_DRM_I830=m
 CONFIG_DRM_MGA=m
@@ -2244,9 +2244,9 @@ CONFIG_DRM_SAVAGE=m
 CONFIG_DRM_I915=m
 CONFIG_DRM_I915_KMS=y
 CONFIG_DRM_VIA=m
-# CONFIG_DRM_NOUVEAU is not set
-# CONFIG_DRM_NOUVEAU_KMS is not set
-# CONFIG_DRM_NOUVEAU_BACKLIGHT is not set
+CONFIG_DRM_NOUVEAU=m
+CONFIG_DRM_NOUVEAU_KMS=y
+CONFIG_DRM_NOUVEAU_BACKLIGHT=y
 CONFIG_DRM_I2C_CH7006=m
 
 #
@@ -3727,7 +3727,7 @@ CONFIG_UNUSED_SYMBOLS=y
 CONFIG_UTRACE=y
 
 CONFIG_FTRACE=y
-CONFIG_IRQSOFF_TRACER=y
+# CONFIG_IRQSOFF_TRACER is not set
 CONFIG_SCHED_TRACER=y
 CONFIG_PROCESS_TRACER=y
 CONFIG_CONTEXT_SWITCH_TRACER=y


Index: config-powerpc-generic
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/config-powerpc-generic,v
retrieving revision 1.33.6.9
retrieving revision 1.33.6.10
diff -u -p -r1.33.6.9 -r1.33.6.10
--- config-powerpc-generic	5 Aug 2009 23:00:09 -0000	1.33.6.9
+++ config-powerpc-generic	10 Oct 2009 15:04:07 -0000	1.33.6.10
@@ -55,7 +55,7 @@ CONFIG_FB_OF=y
 CONFIG_FB_IBM_GXT4500=y
 CONFIG_FB_RADEON=y
 CONFIG_FB_MATROX=y
-CONFIG_FB_NVIDIA=y
+CONFIG_FB_NVIDIA=m
 # CONFIG_FB_VGA16 is not set
 CONFIG_FB_ATY128_BACKLIGHT=y
 CONFIG_FB_ATY_BACKLIGHT=y


Index: config-x86_64-generic
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/config-x86_64-generic,v
retrieving revision 1.68.2.16
retrieving revision 1.68.2.17
diff -u -p -r1.68.2.16 -r1.68.2.17
--- config-x86_64-generic	18 Aug 2009 19:26:45 -0000	1.68.2.16
+++ config-x86_64-generic	10 Oct 2009 15:04:08 -0000	1.68.2.17
@@ -380,3 +380,5 @@ CONFIG_PERF_COUNTERS=y
 CONFIG_EVENT_PROFILE=y
 
 # CONFIG_X86_MCE_INJECT is not set
+
+CONFIG_FUNCTION_GRAPH_TRACER=y

drm-nouveau.patch:
 drivers/gpu/drm/Kconfig                     |   45 
 drivers/gpu/drm/Makefile                    |    2 
 drivers/gpu/drm/i2c/Makefile                |    4 
 drivers/gpu/drm/i2c/ch7006_drv.c            |  531 
 drivers/gpu/drm/i2c/ch7006_mode.c           |  473 
 drivers/gpu/drm/i2c/ch7006_priv.h           |  344 
 drivers/gpu/drm/nouveau/Makefile            |   29 
 drivers/gpu/drm/nouveau/nouveau_acpi.c      |  125 
 drivers/gpu/drm/nouveau/nouveau_backlight.c |  155 
 drivers/gpu/drm/nouveau/nouveau_bios.c      | 5536 ++++++
 drivers/gpu/drm/nouveau/nouveau_bios.h      |  236 
 drivers/gpu/drm/nouveau/nouveau_bo.c        |  620 
 drivers/gpu/drm/nouveau/nouveau_calc.c      |  626 
 drivers/gpu/drm/nouveau/nouveau_channel.c   |  464 
 drivers/gpu/drm/nouveau/nouveau_connector.c |  781 
 drivers/gpu/drm/nouveau/nouveau_connector.h |   55 
 drivers/gpu/drm/nouveau/nouveau_crtc.h      |   95 
 drivers/gpu/drm/nouveau/nouveau_debugfs.c   |  157 
 drivers/gpu/drm/nouveau/nouveau_display.c   |  115 
 drivers/gpu/drm/nouveau/nouveau_dma.c       |  206 
 drivers/gpu/drm/nouveau/nouveau_dma.h       |  151 
 drivers/gpu/drm/nouveau/nouveau_drv.c       |  413 
 drivers/gpu/drm/nouveau/nouveau_drv.h       | 1282 +
 drivers/gpu/drm/nouveau/nouveau_encoder.h   |   66 
 drivers/gpu/drm/nouveau/nouveau_fb.h        |   47 
 drivers/gpu/drm/nouveau/nouveau_fbcon.c     |  381 
 drivers/gpu/drm/nouveau/nouveau_fbcon.h     |   49 
 drivers/gpu/drm/nouveau/nouveau_fence.c     |  262 
 drivers/gpu/drm/nouveau/nouveau_gem.c       |  954 +
 drivers/gpu/drm/nouveau/nouveau_hw.c        | 1078 +
 drivers/gpu/drm/nouveau/nouveau_hw.h        |  448 
 drivers/gpu/drm/nouveau/nouveau_i2c.c       |  256 
 drivers/gpu/drm/nouveau/nouveau_i2c.h       |   45 
 drivers/gpu/drm/nouveau/nouveau_ioc32.c     |   72 
 drivers/gpu/drm/nouveau/nouveau_irq.c       |  696 
 drivers/gpu/drm/nouveau/nouveau_mem.c       |  572 
 drivers/gpu/drm/nouveau/nouveau_notifier.c  |  195 
 drivers/gpu/drm/nouveau/nouveau_object.c    | 1294 +
 drivers/gpu/drm/nouveau/nouveau_reg.h       |  788 
 drivers/gpu/drm/nouveau/nouveau_sgdma.c     |  321 
 drivers/gpu/drm/nouveau/nouveau_state.c     |  872 +
 drivers/gpu/drm/nouveau/nouveau_swmthd.h    |   33 
 drivers/gpu/drm/nouveau/nouveau_ttm.c       |  131 
 drivers/gpu/drm/nouveau/nv04_crtc.c         |  995 +
 drivers/gpu/drm/nouveau/nv04_cursor.c       |   70 
 drivers/gpu/drm/nouveau/nv04_dac.c          |  529 
 drivers/gpu/drm/nouveau/nv04_dfp.c          |  621 
 drivers/gpu/drm/nouveau/nv04_display.c      |  293 
 drivers/gpu/drm/nouveau/nv04_fb.c           |   21 
 drivers/gpu/drm/nouveau/nv04_fbcon.c        |  316 
 drivers/gpu/drm/nouveau/nv04_fifo.c         |  271 
 drivers/gpu/drm/nouveau/nv04_graph.c        |  579 
 drivers/gpu/drm/nouveau/nv04_instmem.c      |  210 
 drivers/gpu/drm/nouveau/nv04_mc.c           |   20 
 drivers/gpu/drm/nouveau/nv04_timer.c        |   51 
 drivers/gpu/drm/nouveau/nv04_tv.c           |  305 
 drivers/gpu/drm/nouveau/nv10_fb.c           |   24 
 drivers/gpu/drm/nouveau/nv10_fifo.c         |  260 
 drivers/gpu/drm/nouveau/nv10_graph.c        |  891 +
 drivers/gpu/drm/nouveau/nv17_tv.c           |  689 
 drivers/gpu/drm/nouveau/nv17_tv.h           |  156 
 drivers/gpu/drm/nouveau/nv17_tv_modes.c     |  583 
 drivers/gpu/drm/nouveau/nv20_graph.c        |  778 
 drivers/gpu/drm/nouveau/nv40_fb.c           |   62 
 drivers/gpu/drm/nouveau/nv40_fifo.c         |  314 
 drivers/gpu/drm/nouveau/nv40_graph.c        | 2239 ++
 drivers/gpu/drm/nouveau/nv40_mc.c           |   38 
 drivers/gpu/drm/nouveau/nv50_crtc.c         |  784 
 drivers/gpu/drm/nouveau/nv50_cursor.c       |  151 
 drivers/gpu/drm/nouveau/nv50_dac.c          |  295 
 drivers/gpu/drm/nouveau/nv50_display.c      |  902 +
 drivers/gpu/drm/nouveau/nv50_display.h      |   46 
 drivers/gpu/drm/nouveau/nv50_evo.h          |  113 
 drivers/gpu/drm/nouveau/nv50_fbcon.c        |  273 
 drivers/gpu/drm/nouveau/nv50_fifo.c         |  493 
 drivers/gpu/drm/nouveau/nv50_graph.c        |  465 
 drivers/gpu/drm/nouveau/nv50_grctx.h        |22284 ++++++++++++++++++++++++++++
 drivers/gpu/drm/nouveau/nv50_instmem.c      |  508 
 drivers/gpu/drm/nouveau/nv50_mc.c           |   40 
 drivers/gpu/drm/nouveau/nv50_sor.c          |  250 
 drivers/gpu/drm/nouveau/nvreg.h             |  535 
 drivers/gpu/drm/ttm/ttm_bo.c                |    4 
 include/drm/Kbuild                          |    1 
 include/drm/i2c/ch7006.h                    |   86 
 include/drm/nouveau_drm.h                   |  216 
 85 files changed, 58766 insertions(+)

View full diff with command:
/usr/bin/cvs -n -f diff -kk -u -p -N -r 1.8.6.21 -r 1.8.6.22 drm-nouveau.patchIndex: drm-nouveau.patch
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/drm-nouveau.patch,v
retrieving revision 1.8.6.21
retrieving revision 1.8.6.22
diff -u -p -r1.8.6.21 -r1.8.6.22
--- drm-nouveau.patch	26 Sep 2009 15:27:46 -0000	1.8.6.21
+++ drm-nouveau.patch	10 Oct 2009 15:04:10 -0000	1.8.6.22
@@ -1766,10 +1766,10 @@ index 0000000..20564f8
 +}
 diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
 new file mode 100644
-index 0000000..09ccffd
+index 0000000..7a55199
 --- /dev/null
 +++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
-@@ -0,0 +1,5499 @@
+@@ -0,0 +1,5536 @@
 +/*
 + * Copyright 2005-2006 Erik Waling
 + * Copyright 2006 Stephane Marchesin
@@ -4230,6 +4230,27 @@ index 0000000..09ccffd
 +}
 +
 +static bool
++init_87(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
++{
++	/*
++	 * INIT_87   opcode: 0x87 ('')
++	 *
++	 * offset      (8 bit): opcode
++	 * offset + 1  (8 bit): unknown
++	 * offset + 4 (32 bit): unknown entry 0
++	 *
++	 * Unknown function.  Stubbed here as one of my cards can resume
++	 * fine without it, but we'd still want to run the remainder
++	 * of the script instead of aborting.
++	 *
++	 * Starting from offset+4 there are BIT_M+2 32-bit entries.
++	 */
++
++	NV_WARN(bios->dev, "INIT_87 stubbed!\n");
++	return true;
++}
++
++static bool
 +init_8e(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
 +{
 +	/*
@@ -4560,6 +4581,7 @@ index 0000000..09ccffd
 +	{ "INIT_INDEX_IO"                     , 0x78, 6       , 0       , 0       , init_index_io                   },
 +	{ "INIT_PLL"                          , 0x79, 7       , 0       , 0       , init_pll                        },
 +	{ "INIT_ZM_REG"                       , 0x7A, 9       , 0       , 0       , init_zm_reg                     },
++	{ "INIT_87"                           , 0x87, 2       , 0       , 0       , init_87                         },
 +	{ "INIT_8E"                           , 0x8E, 1       , 0       , 0       , init_8e                         },
 +	/* INIT_RAM_RESTRICT_ZM_REG_GROUP's mult is loaded by M table in BIT */
 +	{ "INIT_RAM_RESTRICT_ZM_REG_GROUP"    , 0x8F, 7       , 6       , 0       , init_ram_restrict_zm_reg_group  },
@@ -6059,10 +6081,14 @@ index 0000000..09ccffd
 +	if (bitentry->length < 0x5)
 +		return 0;
 +
++	/* adjust length of INIT_87 */
++	for (i = 0; itbl_entry[i].name && (itbl_entry[i].id != 0x87); i++);
++	itbl_entry[i].length += bios->data[bitentry->offset + 2] * 4;
++
 +	/* set up multiplier for INIT_RAM_RESTRICT_ZM_REG_GROUP */
-+	for (i = 0; itbl_entry[i].name && (itbl_entry[i].id != 0x8f); i++)
-+		;
++	for (; itbl_entry[i].name && (itbl_entry[i].id != 0x8f); i++);
 +	itbl_entry[i].length_multiplier = bios->data[bitentry->offset + 2] * 4;
++
 +	init_ram_restrict_zm_reg_group_blocklen = itbl_entry[i].length_multiplier;
 +
 +	bios->ram_restrict_tbl_ptr = ROM16(bios->data[bitentry->offset + 3]);
@@ -6964,6 +6990,17 @@ index 0000000..09ccffd
 +		if (dcb->entry[i].i2c_index == 0xf)
 +			continue;
 +
++		/*
++		 * Ignore the I2C index for on-chip TV-out, as there
++		 * are cards with bogus values (nv31m in bug 23212),
++		 * and it's otherwise useless.
++		 */
++		if (dcb->entry[i].type == OUTPUT_TV &&
++		    dcb->entry[i].location == DCB_LOC_ON_CHIP) {
++			dcb->entry[i].i2c_index = 0xf;
++			continue;
++		}
++
 +		dcb->entry[i].connector = dcb->entry[i].i2c_index;
 +		if (dcb->entry[i].connector > high)
 +			high = dcb->entry[i].connector;
@@ -7271,10 +7308,10 @@ index 0000000..09ccffd
 +}
 diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.h b/drivers/gpu/drm/nouveau/nouveau_bios.h
 new file mode 100644
-index 0000000..a7f02b4
+index 0000000..33f3172
 --- /dev/null
 +++ b/drivers/gpu/drm/nouveau/nouveau_bios.h
-@@ -0,0 +1,235 @@
+@@ -0,0 +1,236 @@
 +/*
 + * Copyright 2007-2008 Nouveau Project
 + *
@@ -7362,6 +7399,7 @@ index 0000000..a7f02b4
 +	OUTPUT_TMDS = 2,
 +	OUTPUT_LVDS = 3,
 +	OUTPUT_DP = 6,
++	OUTPUT_ANY = -1
 +};
 +
 +enum nouveau_or {
@@ -8770,10 +8808,10 @@ index 0000000..3f80db8
 +}
 diff --git a/drivers/gpu/drm/nouveau/nouveau_channel.c b/drivers/gpu/drm/nouveau/nouveau_channel.c
 new file mode 100644
-index 0000000..1a87041
+index 0000000..8e7a9fe
 --- /dev/null
 +++ b/drivers/gpu/drm/nouveau/nouveau_channel.c
-@@ -0,0 +1,482 @@
+@@ -0,0 +1,464 @@
 +/*
 + * Copyright 2005-2006 Stephane Marchesin
 + * All Rights Reserved.
@@ -9060,32 +9098,18 @@ index 0000000..1a87041
 +	struct drm_nouveau_private *dev_priv = dev->dev_private;
 +	struct nouveau_pgraph_engine *pgraph = &dev_priv->engine.graph;
 +	struct nouveau_fifo_engine *pfifo = &dev_priv->engine.fifo;
-+	struct nouveau_timer_engine *ptimer = &dev_priv->engine.timer;
-+	unsigned fbdev_flags = 0;
-+	uint64_t t_start;
-+	bool timeout = false;
++	unsigned long flags;
 +	int ret;
 +
 +	NV_INFO(dev, "%s: freeing fifo %d\n", __func__, chan->id);
 +
 +	nouveau_debugfs_channel_fini(chan);
 +
-+	/* Give the channel a chance to idle, wait 2s (hopefully) */
-+	t_start = ptimer->read(dev);
-+	while (!nouveau_channel_idle(chan)) {
-+		if (ptimer->read(dev) - t_start > 2000000000ULL) {
-+			NV_ERROR(dev, "Failed to idle channel %d.  "
-+				      "Prepare for strangeness..\n", chan->id);
-+			timeout = true;
-+			break;
-+		}
-+	}
-+
-+	/* Wait on a fence until channel goes idle, this ensures the engine
-+	 * has finished with the last push buffer completely before we destroy
-+	 * the channel.
-+	 */
-+	if (!timeout) {
++	/* Give outstanding push buffers a chance to complete */
++	spin_lock_irqsave(&chan->fence.lock, flags);
++	nouveau_fence_update(chan);
++	spin_unlock_irqrestore(&chan->fence.lock, flags);
++	if (chan->fence.sequence != chan->fence.sequence_ack) {
 +		struct nouveau_fence *fence = NULL;
 +
 +		ret = nouveau_fence_new(chan, &fence, true);
@@ -9094,11 +9118,8 @@ index 0000000..1a87041
 +			nouveau_fence_unref((void *)&fence);
 +		}
 +
-+		if (ret) {
-+			NV_ERROR(dev, "Failed to fence channel %d.  "
-+				      "Prepare for strangeness..\n", chan->id);
-+			timeout = true;
-+		}
++		if (ret)
++			NV_ERROR(dev, "Failed to idle channel %d.\n", chan->id);
 +	}
 +
 +	/* Ensure all outstanding fences are signaled.  They should be if the
@@ -9107,31 +9128,30 @@ index 0000000..1a87041
 +	 */
 +	nouveau_fence_fini(chan);
 +
-+	/* disable the fifo caches */
-+	if (dev_priv->fbdev_info) {
-+		fbdev_flags = dev_priv->fbdev_info->flags;
-+		dev_priv->fbdev_info->flags |= FBINFO_HWACCEL_DISABLED;
++	/* Ensure the channel is no longer active on the GPU */
++	pfifo->reassign(dev, false);
++
++	if (pgraph->channel(dev) == chan) {
++		pgraph->fifo_access(dev, false);
++		pgraph->unload_context(dev);
++		pgraph->fifo_access(dev, true);
 +	}
++	pgraph->destroy_context(chan);
 +
-+	pfifo->reassign(dev, false);
-+	pfifo->disable(dev);
++	if (pfifo->channel_id(dev) == chan->id) {
[...2348 lines suppressed...]
@@ -34197,19 +34222,30 @@ index 0000000..aca9ea6
 +	int ret, format;
 +
 +	switch (info->var.bits_per_pixel) {
++	case 8:
++		format = 0xf3;
++		break;
++	case 15:
++		format = 0xf8;
++		break;
 +	case 16:
 +		format = 0xe8;
 +		break;
-+	default:
++	case 32:
 +		switch (info->var.transp.length) {
-+		case 2:
++		case 0: /* depth 24 */
++		case 8: /* depth 32, just use 24.. */
++			format = 0xe6;
++			break;
++		case 2: /* depth 30 */
 +			format = 0xd1;
 +			break;
 +		default:
-+			format = 0xe6;
-+			break;
++			return -EINVAL;
 +		}
 +		break;
++	default:
++		return -EINVAL;
 +	}
 +
 +	ret = nouveau_gpuobj_gr_new(dev_priv->channel, 0x502d, &eng2d);
@@ -34296,10 +34332,10 @@ index 0000000..aca9ea6
 +
 diff --git a/drivers/gpu/drm/nouveau/nv50_fifo.c b/drivers/gpu/drm/nouveau/nv50_fifo.c
 new file mode 100644
-index 0000000..10ed193
+index 0000000..c2396a6
 --- /dev/null
 +++ b/drivers/gpu/drm/nouveau/nv50_fifo.c
-@@ -0,0 +1,481 @@
+@@ -0,0 +1,493 @@
 +/*
 + * Copyright (C) 2007 Ben Skeggs.
 + * All Rights Reserved.
@@ -34622,9 +34658,6 @@ index 0000000..10ed193
 +
 +	NV_DEBUG(dev, "ch%d\n", chan->id);
 +
-+	if ((nv_rd32(dev, NV03_PFIFO_CACHE1_PUSH1) & 0xffff) == chan->id)
-+		nv_wr32(dev, NV03_PFIFO_CACHE1_PUSH1, 127);
-+
 +	nouveau_gpuobj_ref_del(dev, &chan->ramfc);
 +	nouveau_gpuobj_ref_del(dev, &chan->cache);
 +
@@ -34703,21 +34736,35 @@ index 0000000..10ed193
 +
 +	dev_priv->engine.instmem.finish_access(dev);
 +
++	nv_wr32(dev, NV03_PFIFO_CACHE1_GET, 0);
++	nv_wr32(dev, NV03_PFIFO_CACHE1_PUT, 0);
 +	nv_wr32(dev, NV03_PFIFO_CACHE1_PUSH1, chan->id | (1<<16));
 +	return 0;
 +}
 +
 +int
-+nv50_fifo_save_context(struct nouveau_channel *chan)
++nv50_fifo_unload_context(struct drm_device *dev)
 +{
-+	struct drm_device *dev = chan->dev;
 +	struct drm_nouveau_private *dev_priv = dev->dev_private;
-+	struct nouveau_gpuobj *ramfc = chan->ramfc->gpuobj;
-+	struct nouveau_gpuobj *cache = chan->cache->gpuobj;
-+	int put, get, ptr;
++	struct nouveau_fifo_engine *pfifo = &dev_priv->engine.fifo;
++	struct nouveau_gpuobj *ramfc, *cache;
++	struct nouveau_channel *chan = NULL;
++	int chid, get, put, ptr;
 +
 +	NV_DEBUG(chan->dev, "ch%d\n", chan->id);
 +
++	chid = pfifo->channel_id(dev);
++	if (chid < 0 || chid >= dev_priv->engine.fifo.channels)
++		return 0;
++
++	chan = dev_priv->fifos[chid];
++	if (!chan) {
++		NV_ERROR(dev, "Inactive channel on PFIFO: %d\n", chid);
++		return -EINVAL;
++	}
++	ramfc = chan->ramfc->gpuobj;
++	cache = chan->cache->gpuobj;
++
 +	dev_priv->engine.instmem.prepare_access(dev, true);
 +
 +	nv_wo32(dev, ramfc, 0x00/4, nv_rd32(dev, 0x3330));
@@ -34767,7 +34814,6 @@ index 0000000..10ed193
 +
 +	/* guessing that all the 0x34xx regs aren't on NV50 */
 +	if (!IS_G80) {
-+
 +		nv_wo32(dev, ramfc, 0x84/4, ptr >> 1);
 +		nv_wo32(dev, ramfc, 0x88/4, nv_rd32(dev, 0x340c));
 +		nv_wo32(dev, ramfc, 0x8c/4, nv_rd32(dev, 0x3400));
@@ -34778,15 +34824,17 @@ index 0000000..10ed193
 +
 +	dev_priv->engine.instmem.finish_access(dev);
 +
++	/*XXX: probably reload ch127 (NULL) state back too */
++	nv_wr32(dev, NV03_PFIFO_CACHE1_PUSH1, 127);
 +	return 0;
 +}
 +
 diff --git a/drivers/gpu/drm/nouveau/nv50_graph.c b/drivers/gpu/drm/nouveau/nv50_graph.c
 new file mode 100644
-index 0000000..d9c3e21
+index 0000000..93a4b66
 --- /dev/null
 +++ b/drivers/gpu/drm/nouveau/nv50_graph.c
-@@ -0,0 +1,472 @@
+@@ -0,0 +1,465 @@
 +/*
 + * Copyright (C) 2007 Ben Skeggs.
 + * All Rights Reserved.
@@ -35086,20 +35134,12 @@ index 0000000..d9c3e21
 +	struct drm_device *dev = chan->dev;
 +	struct drm_nouveau_private *dev_priv = dev->dev_private;
 +	int i, hdr = IS_G80 ? 0x200 : 0x20;
-+	uint32_t inst;
 +
 +	NV_DEBUG(dev, "ch%d\n", chan->id);
 +
 +	if (!chan->ramin || !chan->ramin->gpuobj)
 +		return;
 +
-+	inst = nv_rd32(dev, NV50_PGRAPH_CTXCTL_CUR);
-+	if (inst & NV50_PGRAPH_CTXCTL_CUR_LOADED) {
-+		inst &= NV50_PGRAPH_CTXCTL_CUR_INSTANCE;
-+		if (inst == chan->ramin->instance >> 12)
-+			nv_wr32(dev, NV50_PGRAPH_CTXCTL_CUR, inst);
-+	}
-+
 +	dev_priv->engine.instmem.prepare_access(dev, true);
 +	for (i = hdr; i < hdr + 24; i += 4)
 +		nv_wo32(dev, chan->ramin->gpuobj, i/4, 0);
@@ -35125,6 +35165,7 @@ index 0000000..d9c3e21
 +	if (nouveau_wait_for_idle(dev))
 +		nv_wr32(dev, 0x40032c, inst | (1<<31));
 +	nv_wr32(dev, 0x400500, fifo);
++
 +	return 0;
 +}
 +
@@ -35153,12 +35194,18 @@ index 0000000..d9c3e21
 +}
 +
 +int
-+nv50_graph_save_context(struct nouveau_channel *chan)
++nv50_graph_unload_context(struct drm_device *dev)
 +{
-+	uint32_t inst = chan->ramin->instance >> 12;
++	uint32_t inst;
++	int ret;
 +
-+	NV_DEBUG(chan->dev, "ch%d\n", chan->id);
-+	return nv50_graph_do_save_context(chan->dev, inst);
++	inst  = nv_rd32(dev, NV50_PGRAPH_CTXCTL_CUR);
++	if (!(inst & NV50_PGRAPH_CTXCTL_CUR_LOADED))
++		return 0;
++	inst &= NV50_PGRAPH_CTXCTL_CUR_INSTANCE;
++	ret = nv50_graph_do_save_context(dev, inst);
++	nv_wr32(dev, NV50_PGRAPH_CTXCTL_CUR, inst);
++	return 0;
 +}
 +
 +void
@@ -35166,17 +35213,11 @@ index 0000000..d9c3e21
 +{
 +	uint32_t inst;
 +
-+	inst = nv_rd32(dev, NV50_PGRAPH_CTXCTL_CUR);
-+	if (inst & NV50_PGRAPH_CTXCTL_CUR_LOADED)
-+		nv50_graph_do_save_context(dev, inst);
-+	nv_wr32(dev, NV50_PGRAPH_CTXCTL_CUR,
-+				inst & NV50_PGRAPH_CTXCTL_CUR_INSTANCE);
++	nv50_graph_unload_context(dev);
 +
-+	inst = nv_rd32(dev, NV50_PGRAPH_CTXCTL_NEXT) &
-+		       NV50_PGRAPH_CTXCTL_NEXT_INSTANCE;
++	inst  = nv_rd32(dev, NV50_PGRAPH_CTXCTL_NEXT);
++	inst &= NV50_PGRAPH_CTXCTL_NEXT_INSTANCE;
 +	nv50_graph_do_load_context(dev, inst);
-+	nv_wr32(dev, NV50_PGRAPH_CTXCTL_CUR,
-+				inst | NV50_PGRAPH_CTXCTL_CUR_LOADED);
 +
 +	nv_wr32(dev, NV40_PGRAPH_INTR_EN, nv_rd32(dev,
 +		NV40_PGRAPH_INTR_EN) | NV_PGRAPH_INTR_CONTEXT_SWITCH);

drm-vga-arb.patch:
 drivers/gpu/drm/drm_irq.c              |   27 +++++++++++++++++++++++++++
 drivers/gpu/drm/i915/i915_dma.c        |   20 ++++++++++++++++++++
 drivers/gpu/drm/i915/i915_drv.h        |    1 +
 drivers/gpu/drm/i915/i915_reg.h        |    1 +
 drivers/gpu/drm/i915/intel_display.c   |   17 +++++++++++++++++
 drivers/gpu/drm/i915/intel_drv.h       |    1 +
 drivers/gpu/drm/radeon/r100.c          |   14 ++++++++++++++
 drivers/gpu/drm/radeon/r600.c          |   14 ++++++++++++++
 drivers/gpu/drm/radeon/r600d.h         |    1 +
 drivers/gpu/drm/radeon/radeon.h        |    2 ++
 drivers/gpu/drm/radeon/radeon_asic.h   |   12 ++++++++++++
 drivers/gpu/drm/radeon/radeon_device.c |   19 +++++++++++++++++++
 include/drm/drmP.h                     |    3 +++
 13 files changed, 132 insertions(+)

Index: drm-vga-arb.patch
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/drm-vga-arb.patch,v
retrieving revision 1.5.2.5
retrieving revision 1.5.2.6
diff -u -p -r1.5.2.5 -r1.5.2.6
--- drm-vga-arb.patch	26 Sep 2009 15:27:52 -0000	1.5.2.5
+++ drm-vga-arb.patch	10 Oct 2009 15:04:13 -0000	1.5.2.6
@@ -1,38 +1,6 @@
-From 28d520433b6375740990ab99d69b0d0067fd656b Mon Sep 17 00:00:00 2001
-From: Dave Airlie <airlied at redhat.com>
-Date: Mon, 21 Sep 2009 14:33:58 +1000
-Subject: [PATCH] drm/vgaarb: add VGA arbitration support to the drm and kms.
-
-VGA arb requires DRM support for non-kms drivers, to turn on/off
-irqs when disabling the mem/io regions.
-
-VGA arb requires KMS support for GPUs where we can turn off VGA
-decoding. Currently we know how to do this for intel and radeon
-kms drivers, which allows them to be removed from the arbiter.
-
-This patch comes from Fedora rawhide kernel.
-
-Signed-off-by: Dave Airlie <airlied at redhat.com>
----
- drivers/gpu/drm/drm_irq.c              |   27 +++++++++++++++++++++++++++
- drivers/gpu/drm/i915/i915_dma.c        |   20 ++++++++++++++++++++
- drivers/gpu/drm/i915/i915_drv.h        |    1 +
- drivers/gpu/drm/i915/i915_reg.h        |    1 +
- drivers/gpu/drm/i915/intel_display.c   |   17 +++++++++++++++++
- drivers/gpu/drm/i915/intel_drv.h       |    1 +
- drivers/gpu/drm/radeon/r100.c          |   14 ++++++++++++++
- drivers/gpu/drm/radeon/r600.c          |   14 ++++++++++++++
- drivers/gpu/drm/radeon/r600d.h         |    1 +
- drivers/gpu/drm/radeon/radeon.h        |    2 ++
- drivers/gpu/drm/radeon/radeon_asic.h   |   12 ++++++++++++
- drivers/gpu/drm/radeon/radeon_device.c |   21 ++++++++++++++++++++-
- include/drm/drmP.h                     |    3 +++
- 13 files changed, 133 insertions(+), 1 deletions(-)
-
-diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
-index f85aaf2..0a6f0b3 100644
---- a/drivers/gpu/drm/drm_irq.c
-+++ b/drivers/gpu/drm/drm_irq.c
+diff -up linux-2.6.31.noarch/drivers/gpu/drm/drm_irq.c.da linux-2.6.31.noarch/drivers/gpu/drm/drm_irq.c
+--- linux-2.6.31.noarch/drivers/gpu/drm/drm_irq.c.da	2009-09-10 08:13:59.000000000 +1000
++++ linux-2.6.31.noarch/drivers/gpu/drm/drm_irq.c	2009-10-08 14:21:08.000000000 +1000
 @@ -37,6 +37,7 @@
  
  #include <linux/interrupt.h>	/* For task queue support */
@@ -68,7 +36,7 @@ index f85aaf2..0a6f0b3 100644
  /**
   * Install IRQ handler.
   *
-@@ -231,6 +252,9 @@ int drm_irq_install(struct drm_device *dev)
+@@ -231,6 +252,9 @@ int drm_irq_install(struct drm_device *d
  		return ret;
  	}
  
@@ -78,7 +46,7 @@ index f85aaf2..0a6f0b3 100644
  	/* After installing handler */
  	ret = dev->driver->irq_postinstall(dev);
  	if (ret < 0) {
-@@ -279,6 +303,9 @@ int drm_irq_uninstall(struct drm_device * dev)
+@@ -279,6 +303,9 @@ int drm_irq_uninstall(struct drm_device 
  
  	DRM_DEBUG("irq=%d\n", dev->pdev->irq);
  
@@ -88,10 +56,9 @@ index f85aaf2..0a6f0b3 100644
  	dev->driver->irq_uninstall(dev);
  
  	free_irq(dev->pdev->irq, dev);
-diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
-index 9909505..5a49a18 100644
---- a/drivers/gpu/drm/i915/i915_dma.c
-+++ b/drivers/gpu/drm/i915/i915_dma.c
+diff -up linux-2.6.31.noarch/drivers/gpu/drm/i915/i915_dma.c.da linux-2.6.31.noarch/drivers/gpu/drm/i915/i915_dma.c
+--- linux-2.6.31.noarch/drivers/gpu/drm/i915/i915_dma.c.da	2009-10-08 14:20:49.000000000 +1000
++++ linux-2.6.31.noarch/drivers/gpu/drm/i915/i915_dma.c	2009-10-08 14:21:08.000000000 +1000
 @@ -33,6 +33,7 @@
  #include "intel_drv.h"
  #include "i915_drm.h"
@@ -100,7 +67,7 @@ index 9909505..5a49a18 100644
  
  /* Really want an OS-independent resettable timer.  Would like to have
   * this loop run for (eg) 3 sec, but have the timer reset every time
-@@ -1012,6 +1013,19 @@ static int i915_probe_agp(struct drm_device *dev, uint32_t *aperture_size,
+@@ -1012,6 +1013,19 @@ static int i915_probe_agp(struct drm_dev
  	return 0;
  }
  
@@ -120,7 +87,7 @@ index 9909505..5a49a18 100644
  static int i915_load_modeset_init(struct drm_device *dev,
  				  unsigned long prealloc_size,
  				  unsigned long agp_size)
-@@ -1057,6 +1071,11 @@ static int i915_load_modeset_init(struct drm_device *dev,
+@@ -1057,6 +1071,11 @@ static int i915_load_modeset_init(struct
  	if (ret)
  		DRM_INFO("failed to find VBIOS tables\n");
  
@@ -132,7 +99,7 @@ index 9909505..5a49a18 100644
  	ret = drm_irq_install(dev);
  	if (ret)
  		goto destroy_ringbuffer;
-@@ -1324,6 +1343,7 @@ int i915_driver_unload(struct drm_device *dev)
+@@ -1324,6 +1343,7 @@ int i915_driver_unload(struct drm_device
  
  	if (drm_core_check_feature(dev, DRIVER_MODESET)) {
  		drm_irq_uninstall(dev);
@@ -140,11 +107,10 @@ index 9909505..5a49a18 100644
  	}
  
  	if (dev->pdev->msi_enabled)
-diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
-index 77ed060..a0632f8 100644
---- a/drivers/gpu/drm/i915/i915_drv.h
-+++ b/drivers/gpu/drm/i915/i915_drv.h
-@@ -766,6 +766,7 @@ static inline void opregion_enable_asle(struct drm_device *dev) { return; }
+diff -up linux-2.6.31.noarch/drivers/gpu/drm/i915/i915_drv.h.da linux-2.6.31.noarch/drivers/gpu/drm/i915/i915_drv.h
+--- linux-2.6.31.noarch/drivers/gpu/drm/i915/i915_drv.h.da	2009-10-08 14:20:49.000000000 +1000
++++ linux-2.6.31.noarch/drivers/gpu/drm/i915/i915_drv.h	2009-10-08 14:21:08.000000000 +1000
+@@ -766,6 +766,7 @@ static inline void opregion_enable_asle(
  /* modesetting */
  extern void intel_modeset_init(struct drm_device *dev);
  extern void intel_modeset_cleanup(struct drm_device *dev);
@@ -152,10 +118,9 @@ index 77ed060..a0632f8 100644
  
  /**
   * Lock test for when it's just for synchronization of ring access.
-diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
-index e38cd21..3f79635 100644
---- a/drivers/gpu/drm/i915/i915_reg.h
-+++ b/drivers/gpu/drm/i915/i915_reg.h
+diff -up linux-2.6.31.noarch/drivers/gpu/drm/i915/i915_reg.h.da linux-2.6.31.noarch/drivers/gpu/drm/i915/i915_reg.h
+--- linux-2.6.31.noarch/drivers/gpu/drm/i915/i915_reg.h.da	2009-10-08 14:20:49.000000000 +1000
++++ linux-2.6.31.noarch/drivers/gpu/drm/i915/i915_reg.h	2009-10-08 14:21:08.000000000 +1000
 @@ -30,6 +30,7 @@
   * fb aperture size and the amount of pre-reserved memory.
   */
@@ -164,11 +129,10 @@ index e38cd21..3f79635 100644
  #define INTEL_GMCH_ENABLED	0x4
  #define INTEL_GMCH_MEM_MASK	0x1
  #define INTEL_GMCH_MEM_64M	0x1
-diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 155719f..0227b16 100644
---- a/drivers/gpu/drm/i915/intel_display.c
-+++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -3917,3 +3917,20 @@ struct drm_encoder *intel_best_encoder(struct drm_connector *connector)
+diff -up linux-2.6.31.noarch/drivers/gpu/drm/i915/intel_display.c.da linux-2.6.31.noarch/drivers/gpu/drm/i915/intel_display.c
+--- linux-2.6.31.noarch/drivers/gpu/drm/i915/intel_display.c.da	2009-10-08 14:20:49.000000000 +1000
++++ linux-2.6.31.noarch/drivers/gpu/drm/i915/intel_display.c	2009-10-08 14:21:08.000000000 +1000
+@@ -3928,3 +3928,20 @@ struct drm_encoder *intel_best_encoder(s
  
  	return &intel_output->enc;
  }
@@ -189,21 +153,19 @@ index 155719f..0227b16 100644
 +	pci_write_config_word(dev_priv->bridge_dev, INTEL_GMCH_CTRL, gmch_ctrl);
 +	return 0;
 +}
-diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
-index b9e47f1..3a0004f 100644
---- a/drivers/gpu/drm/i915/intel_drv.h
-+++ b/drivers/gpu/drm/i915/intel_drv.h
-@@ -178,4 +178,5 @@ extern int intel_framebuffer_create(struct drm_device *dev,
+diff -up linux-2.6.31.noarch/drivers/gpu/drm/i915/intel_drv.h.da linux-2.6.31.noarch/drivers/gpu/drm/i915/intel_drv.h
+--- linux-2.6.31.noarch/drivers/gpu/drm/i915/intel_drv.h.da	2009-10-08 14:20:49.000000000 +1000
++++ linux-2.6.31.noarch/drivers/gpu/drm/i915/intel_drv.h	2009-10-08 14:21:08.000000000 +1000
+@@ -181,4 +181,5 @@ extern int intel_framebuffer_create(stru
  				    struct drm_mode_fb_cmd *mode_cmd,
  				    struct drm_framebuffer **fb,
  				    struct drm_gem_object *obj);
 +
  #endif /* __INTEL_DRV_H__ */
-diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
-index 737970b..be51c5f 100644
---- a/drivers/gpu/drm/radeon/r100.c
-+++ b/drivers/gpu/drm/radeon/r100.c
-@@ -1955,6 +1955,20 @@ void r100_vram_init_sizes(struct radeon_device *rdev)
+diff -up linux-2.6.31.noarch/drivers/gpu/drm/radeon/r100.c.da linux-2.6.31.noarch/drivers/gpu/drm/radeon/r100.c
+--- linux-2.6.31.noarch/drivers/gpu/drm/radeon/r100.c.da	2009-10-08 14:20:49.000000000 +1000
++++ linux-2.6.31.noarch/drivers/gpu/drm/radeon/r100.c	2009-10-08 14:21:08.000000000 +1000
+@@ -1763,6 +1763,20 @@ void r100_vram_init_sizes(struct radeon_
  		rdev->mc.real_vram_size = rdev->mc.aper_size;
  }
  
@@ -224,11 +186,10 @@ index 737970b..be51c5f 100644
  void r100_vram_info(struct radeon_device *rdev)
  {
  	r100_vram_get_type(rdev);
-diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
-index 5f42fad..eab31c1 100644
---- a/drivers/gpu/drm/radeon/r600.c
-+++ b/drivers/gpu/drm/radeon/r600.c
-@@ -1499,6 +1499,20 @@ int r600_startup(struct radeon_device *rdev)
+diff -up linux-2.6.31.noarch/drivers/gpu/drm/radeon/r600.c.da linux-2.6.31.noarch/drivers/gpu/drm/radeon/r600.c
+--- linux-2.6.31.noarch/drivers/gpu/drm/radeon/r600.c.da	2009-10-08 14:20:49.000000000 +1000
++++ linux-2.6.31.noarch/drivers/gpu/drm/radeon/r600.c	2009-10-08 14:21:08.000000000 +1000
+@@ -1534,6 +1534,20 @@ int r600_startup(struct radeon_device *r
  	return 0;
  }
  
@@ -249,10 +210,9 @@ index 5f42fad..eab31c1 100644
  int r600_resume(struct radeon_device *rdev)
  {
  	int r;
-diff --git a/drivers/gpu/drm/radeon/r600d.h b/drivers/gpu/drm/radeon/r600d.h
-index 723295f..4a9028a 100644
---- a/drivers/gpu/drm/radeon/r600d.h
-+++ b/drivers/gpu/drm/radeon/r600d.h
+diff -up linux-2.6.31.noarch/drivers/gpu/drm/radeon/r600d.h.da linux-2.6.31.noarch/drivers/gpu/drm/radeon/r600d.h
+--- linux-2.6.31.noarch/drivers/gpu/drm/radeon/r600d.h.da	2009-10-08 14:20:49.000000000 +1000
++++ linux-2.6.31.noarch/drivers/gpu/drm/radeon/r600d.h	2009-10-08 14:21:08.000000000 +1000
 @@ -78,6 +78,7 @@
  #define CB_COLOR0_MASK                                  0x28100
  
@@ -261,103 +221,82 @@ index 723295f..4a9028a 100644
  #define	CP_STAT						0x8680
  #define	CP_COHER_BASE					0x85F8
  #define	CP_DEBUG					0xC1FC
-diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
-index 817af8e..c839b60 100644
---- a/drivers/gpu/drm/radeon/radeon.h
-+++ b/drivers/gpu/drm/radeon/radeon.h
-@@ -596,6 +596,7 @@ struct radeon_asic {
- 	int (*suspend)(struct radeon_device *rdev);
- 	void (*errata)(struct radeon_device *rdev);
- 	void (*vram_info)(struct radeon_device *rdev);
-+	void (*vga_set_state)(struct radeon_device *rdev, bool state);
- 	int (*gpu_reset)(struct radeon_device *rdev);
- 	int (*mc_init)(struct radeon_device *rdev);
- 	void (*mc_fini)(struct radeon_device *rdev);
-@@ -954,6 +955,7 @@ static inline void radeon_ring_write(struct radeon_device *rdev, uint32_t v)
- #define radeon_cs_parse(p) rdev->asic->cs_parse((p))
- #define radeon_errata(rdev) (rdev)->asic->errata((rdev))
- #define radeon_vram_info(rdev) (rdev)->asic->vram_info((rdev))
-+#define radeon_vga_set_state(rdev, state) (rdev)->asic->vga_set_state((rdev), (state))
- #define radeon_gpu_reset(rdev) (rdev)->asic->gpu_reset((rdev))
- #define radeon_mc_init(rdev) (rdev)->asic->mc_init((rdev))
- #define radeon_mc_fini(rdev) (rdev)->asic->mc_fini((rdev))
-diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h
-index 5f2a9e6..8968f78 100644
---- a/drivers/gpu/drm/radeon/radeon_asic.h
-+++ b/drivers/gpu/drm/radeon/radeon_asic.h
-@@ -47,6 +47,7 @@ uint32_t r100_mm_rreg(struct radeon_device *rdev, uint32_t reg);
+diff -up linux-2.6.31.noarch/drivers/gpu/drm/radeon/radeon_asic.h.da linux-2.6.31.noarch/drivers/gpu/drm/radeon/radeon_asic.h
+--- linux-2.6.31.noarch/drivers/gpu/drm/radeon/radeon_asic.h.da	2009-10-08 14:20:49.000000000 +1000
++++ linux-2.6.31.noarch/drivers/gpu/drm/radeon/radeon_asic.h	2009-10-08 14:24:29.000000000 +1000
+@@ -47,6 +47,7 @@ extern int r100_suspend(struct radeon_de
+ extern int r100_resume(struct radeon_device *rdev);
+ uint32_t r100_mm_rreg(struct radeon_device *rdev, uint32_t reg);
  void r100_mm_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v);
- void r100_errata(struct radeon_device *rdev);
- void r100_vram_info(struct radeon_device *rdev);
 +void r100_vga_set_state(struct radeon_device *rdev, bool state);
  int r100_gpu_reset(struct radeon_device *rdev);
- int r100_mc_init(struct radeon_device *rdev);
- void r100_mc_fini(struct radeon_device *rdev);
-@@ -89,6 +90,7 @@ static struct radeon_asic r100_asic = {
- 	.init = &r100_init,
- 	.errata = &r100_errata,
- 	.vram_info = &r100_vram_info,
+ u32 r100_get_vblank_counter(struct radeon_device *rdev, int crtc);
+ void r100_pci_gart_tlb_flush(struct radeon_device *rdev);
+@@ -78,6 +79,7 @@ static struct radeon_asic r100_asic = {
+ 	.fini = &r100_fini,
+ 	.suspend = &r100_suspend,
+ 	.resume = &r100_resume,
 +	.vga_set_state = &r100_vga_set_state,
  	.gpu_reset = &r100_gpu_reset,
- 	.mc_init = &r100_mc_init,
- 	.mc_fini = &r100_mc_fini,
-@@ -158,6 +160,7 @@ static struct radeon_asic r300_asic = {
- 	.init = &r300_init,
- 	.errata = &r300_errata,
- 	.vram_info = &r300_vram_info,
+ 	.gart_tlb_flush = &r100_pci_gart_tlb_flush,
+ 	.gart_set_page = &r100_pci_gart_set_page,
+@@ -130,6 +132,7 @@ static struct radeon_asic r300_asic = {
+ 	.fini = &r300_fini,
+ 	.suspend = &r300_suspend,
+ 	.resume = &r300_resume,
 +	.vga_set_state = &r100_vga_set_state,
  	.gpu_reset = &r300_gpu_reset,
- 	.mc_init = &r300_mc_init,
- 	.mc_fini = &r300_mc_fini,
-@@ -208,6 +211,7 @@ static struct radeon_asic r420_asic = {
+ 	.gart_tlb_flush = &r100_pci_gart_tlb_flush,
+ 	.gart_set_page = &r100_pci_gart_set_page,
+@@ -166,6 +169,7 @@ static struct radeon_asic r420_asic = {
+ 	.fini = &r420_fini,
+ 	.suspend = &r420_suspend,
  	.resume = &r420_resume,
- 	.errata = NULL,
- 	.vram_info = NULL,
 +	.vga_set_state = &r100_vga_set_state,
  	.gpu_reset = &r300_gpu_reset,
- 	.mc_init = NULL,
- 	.mc_fini = NULL,
-@@ -262,6 +266,7 @@ static struct radeon_asic rs400_asic = {
- 	.init = &r300_init,
- 	.errata = &rs400_errata,
- 	.vram_info = &rs400_vram_info,
+ 	.gart_tlb_flush = &rv370_pcie_gart_tlb_flush,
+ 	.gart_set_page = &rv370_pcie_gart_set_page,
+@@ -207,6 +211,7 @@ static struct radeon_asic rs400_asic = {
+ 	.fini = &rs400_fini,
+ 	.suspend = &rs400_suspend,
+ 	.resume = &rs400_resume,
 +	.vga_set_state = &r100_vga_set_state,
  	.gpu_reset = &r300_gpu_reset,
- 	.mc_init = &rs400_mc_init,
- 	.mc_fini = &rs400_mc_fini,
-@@ -323,6 +328,7 @@ static struct radeon_asic rs600_asic = {
- 	.init = &rs600_init,
- 	.errata = &rs600_errata,
- 	.vram_info = &rs600_vram_info,
+ 	.gart_tlb_flush = &rs400_gart_tlb_flush,
+ 	.gart_set_page = &rs400_gart_set_page,
+@@ -252,6 +257,7 @@ static struct radeon_asic rs600_asic = {
+ 	.fini = &rs600_fini,
+ 	.suspend = &rs600_suspend,
+ 	.resume = &rs600_resume,
 +	.vga_set_state = &r100_vga_set_state,
  	.gpu_reset = &r300_gpu_reset,
- 	.mc_init = &rs600_mc_init,
- 	.mc_fini = &rs600_mc_fini,
-@@ -372,6 +378,7 @@ static struct radeon_asic rs690_asic = {
- 	.init = &rs600_init,
- 	.errata = &rs690_errata,
- 	.vram_info = &rs690_vram_info,
+ 	.gart_tlb_flush = &rs600_gart_tlb_flush,
+ 	.gart_set_page = &rs600_gart_set_page,
+@@ -290,6 +296,7 @@ static struct radeon_asic rs690_asic = {
+ 	.fini = &rs690_fini,
+ 	.suspend = &rs690_suspend,
+ 	.resume = &rs690_resume,
 +	.vga_set_state = &r100_vga_set_state,
  	.gpu_reset = &r300_gpu_reset,
- 	.mc_init = &rs690_mc_init,
- 	.mc_fini = &rs690_mc_fini,
-@@ -428,6 +435,7 @@ static struct radeon_asic rv515_asic = {
- 	.init = &rv515_init,
- 	.errata = &rv515_errata,
- 	.vram_info = &rv515_vram_info,
+ 	.gart_tlb_flush = &rs400_gart_tlb_flush,
+ 	.gart_set_page = &rs400_gart_set_page,
+@@ -334,6 +341,7 @@ static struct radeon_asic rv515_asic = {
+ 	.fini = &rv515_fini,
+ 	.suspend = &rv515_suspend,
+ 	.resume = &rv515_resume,
 +	.vga_set_state = &r100_vga_set_state,
  	.gpu_reset = &rv515_gpu_reset,
- 	.mc_init = &rv515_mc_init,
- 	.mc_fini = &rv515_mc_fini,
-@@ -477,6 +485,7 @@ static struct radeon_asic r520_asic = {
- 	.init = &rv515_init,
- 	.errata = &r520_errata,
- 	.vram_info = &r520_vram_info,
+ 	.gart_tlb_flush = &rv370_pcie_gart_tlb_flush,
+ 	.gart_set_page = &rv370_pcie_gart_set_page,
+@@ -369,6 +377,7 @@ static struct radeon_asic r520_asic = {
+ 	.fini = &rv515_fini,
+ 	.suspend = &rv515_suspend,
+ 	.resume = &r520_resume,
 +	.vga_set_state = &r100_vga_set_state,
  	.gpu_reset = &rv515_gpu_reset,
- 	.mc_init = &r520_mc_init,
- 	.mc_fini = &r520_mc_fini,
-@@ -520,6 +529,7 @@ int r600_init(struct radeon_device *rdev);
+ 	.gart_tlb_flush = &rv370_pcie_gart_tlb_flush,
+ 	.gart_set_page = &rv370_pcie_gart_set_page,
+@@ -400,6 +409,7 @@ int r600_init(struct radeon_device *rdev
  void r600_fini(struct radeon_device *rdev);
  int r600_suspend(struct radeon_device *rdev);
  int r600_resume(struct radeon_device *rdev);
@@ -365,26 +304,25 @@ index 5f2a9e6..8968f78 100644
  int r600_wb_init(struct radeon_device *rdev);
  void r600_wb_fini(struct radeon_device *rdev);
  void r600_cp_commit(struct radeon_device *rdev);
-@@ -556,6 +566,7 @@ static struct radeon_asic r600_asic = {
+@@ -432,6 +442,7 @@ static struct radeon_asic r600_asic = {
+ 	.fini = &r600_fini,
+ 	.suspend = &r600_suspend,
  	.resume = &r600_resume,
- 	.cp_commit = &r600_cp_commit,
- 	.vram_info = NULL,
 +	.vga_set_state = &r600_vga_set_state,
+ 	.cp_commit = &r600_cp_commit,
  	.gpu_reset = &r600_gpu_reset,
- 	.mc_init = NULL,
- 	.mc_fini = NULL,
-@@ -606,6 +617,7 @@ static struct radeon_asic rv770_asic = {
+ 	.gart_tlb_flush = &r600_pcie_gart_tlb_flush,
+@@ -468,6 +479,7 @@ static struct radeon_asic rv770_asic = {
+ 	.fini = &rv770_fini,
+ 	.suspend = &rv770_suspend,
+ 	.resume = &rv770_resume,
++	.vga_set_state = &r600_vga_set_state,
  	.cp_commit = &r600_cp_commit,
- 	.vram_info = NULL,
  	.gpu_reset = &rv770_gpu_reset,
-+	.vga_set_state = &r600_vga_set_state,
- 	.mc_init = NULL,
- 	.mc_fini = NULL,
- 	.wb_init = &r600_wb_init,
-diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
-index 8a40c61..daf5db7 100644
---- a/drivers/gpu/drm/radeon/radeon_device.c
-+++ b/drivers/gpu/drm/radeon/radeon_device.c
+ 	.gart_tlb_flush = &r600_pcie_gart_tlb_flush,
+diff -up linux-2.6.31.noarch/drivers/gpu/drm/radeon/radeon_device.c.da linux-2.6.31.noarch/drivers/gpu/drm/radeon/radeon_device.c
+--- linux-2.6.31.noarch/drivers/gpu/drm/radeon/radeon_device.c.da	2009-10-08 14:20:49.000000000 +1000
++++ linux-2.6.31.noarch/drivers/gpu/drm/radeon/radeon_device.c	2009-10-08 14:25:26.000000000 +1000
 @@ -29,6 +29,7 @@
  #include <drm/drmP.h>
  #include <drm/drm_crtc_helper.h>
@@ -393,8 +331,8 @@ index 8a40c61..daf5db7 100644
  #include "radeon_reg.h"
  #include "radeon.h"
  #include "radeon_asic.h"
-@@ -480,7 +481,18 @@ void radeon_combios_fini(struct radeon_device *rdev)
- {
+@@ -374,7 +375,18 @@ int radeon_asic_init(struct radeon_devic
+ 	return 0;
  }
  
 +/* if we get transitioned to only one device, tak VGA back */
@@ -410,42 +348,51 @@ index 8a40c61..daf5db7 100644
 +		return VGA_RSRC_NORMAL_IO | VGA_RSRC_NORMAL_MEM;
 +}
  /*
-  * Radeon device.
+  * Wrapper around modesetting bits.
   */
-@@ -578,6 +590,13 @@ int radeon_device_init(struct radeon_device *rdev,
- 	if (r) {
- 		return r;
- 	}
-+
+@@ -568,6 +580,12 @@ int radeon_device_init(struct radeon_dev
+ 	DRM_INFO("register mmio base: 0x%08X\n", (uint32_t)rdev->rmmio_base);
+ 	DRM_INFO("register mmio size: %u\n", (unsigned)rdev->rmmio_size);
+ 
 +	/* if we have > 1 VGA cards, then disable the radeon VGA resources */
 +	r = vga_client_register(rdev->pdev, rdev, NULL, radeon_vga_set_decode);
 +	if (r) {
 +		return -EINVAL;
 +	}
 +
- 	if (!rdev->new_init_path) {
- 		/* Setup errata flags */
- 		radeon_errata(rdev);
-@@ -586,7 +605,6 @@ int radeon_device_init(struct radeon_device *rdev,
- 		/* Initialize surface registers */
- 		radeon_surface_init(rdev);
- 
--		/* TODO: disable VGA need to use VGA request */
- 		/* BIOS*/
- 		if (!radeon_get_bios(rdev)) {
- 			if (ASIC_IS_AVIVO(rdev))
-@@ -697,6 +715,7 @@ void radeon_device_fini(struct radeon_device *rdev)
- 		radeon_agp_fini(rdev);
- #endif
- 		radeon_irq_kms_fini(rdev);
-+		vga_client_register(rdev->pdev, NULL, NULL, NULL);
- 		radeon_fence_driver_fini(rdev);
- 		radeon_clocks_fini(rdev);
- 		radeon_object_fini(rdev);
-diff --git a/include/drm/drmP.h b/include/drm/drmP.h
-index eeefb63..c8e64bb 100644
---- a/include/drm/drmP.h
-+++ b/include/drm/drmP.h
+ 	r = radeon_init(rdev);
+ 	if (r)
+ 		return r;
+@@ -597,6 +615,7 @@ void radeon_device_fini(struct radeon_de
+ 	rdev->shutdown = true;
+ 	/* Order matter so becarefull if you rearrange anythings */
+ 	radeon_fini(rdev);
++	vga_client_register(rdev->pdev, NULL, NULL, NULL);
+ 	iounmap(rdev->rmmio);
+ 	rdev->rmmio = NULL;
+ }
+diff -up linux-2.6.31.noarch/drivers/gpu/drm/radeon/radeon.h.da linux-2.6.31.noarch/drivers/gpu/drm/radeon/radeon.h
+--- linux-2.6.31.noarch/drivers/gpu/drm/radeon/radeon.h.da	2009-10-08 14:20:49.000000000 +1000
++++ linux-2.6.31.noarch/drivers/gpu/drm/radeon/radeon.h	2009-10-08 14:22:15.000000000 +1000
+@@ -590,6 +590,7 @@ struct radeon_asic {
+ 	void (*fini)(struct radeon_device *rdev);
+ 	int (*resume)(struct radeon_device *rdev);
+ 	int (*suspend)(struct radeon_device *rdev);
++	void (*vga_set_state)(struct radeon_device *rdev, bool state);
+ 	int (*gpu_reset)(struct radeon_device *rdev);
+ 	void (*gart_tlb_flush)(struct radeon_device *rdev);
+ 	int (*gart_set_page)(struct radeon_device *rdev, int i, uint64_t addr);
+@@ -935,6 +936,7 @@ static inline void radeon_ring_write(str
+ #define radeon_fini(rdev) (rdev)->asic->fini((rdev))
+ #define radeon_resume(rdev) (rdev)->asic->resume((rdev))
+ #define radeon_suspend(rdev) (rdev)->asic->suspend((rdev))
++#define radeon_vga_set_state(rdev, state) (rdev)->asic->vga_set_state((rdev), (state))
+ #define radeon_cs_parse(p) rdev->asic->cs_parse((p))
+ #define radeon_gpu_reset(rdev) (rdev)->asic->gpu_reset((rdev))
+ #define radeon_gart_tlb_flush(rdev) (rdev)->asic->gart_tlb_flush((rdev))
+diff -up linux-2.6.31.noarch/include/drm/drmP.h.da linux-2.6.31.noarch/include/drm/drmP.h
+--- linux-2.6.31.noarch/include/drm/drmP.h.da	2009-10-08 14:20:49.000000000 +1000
++++ linux-2.6.31.noarch/include/drm/drmP.h	2009-10-08 14:21:08.000000000 +1000
 @@ -810,6 +810,9 @@ struct drm_driver {
  	int (*gem_init_object) (struct drm_gem_object *obj);
  	void (*gem_free_object) (struct drm_gem_object *obj);
@@ -456,6 +403,3 @@ index eeefb63..c8e64bb 100644
  	/* Driver private ops for this object */
  	struct vm_operations_struct *gem_vm_ops;
  
--- 
-1.6.4.2
-


Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/kernel.spec,v
retrieving revision 1.1294.2.70
retrieving revision 1.1294.2.71
diff -u -p -r1.1294.2.70 -r1.1294.2.71
--- kernel.spec	26 Sep 2009 15:27:53 -0000	1.1294.2.70
+++ kernel.spec	10 Oct 2009 15:04:13 -0000	1.1294.2.71
@@ -41,7 +41,7 @@ Summary: The Linux kernel
 %if 0%{?released_kernel}
 
 # Do we have a -stable update to apply?
-%define stable_update 1
+%define stable_update 3
 # Is it a -stable RC?
 %define stable_rc 0
 # Set rpm version accordingly
@@ -633,7 +633,6 @@ Patch260: linux-2.6-debug-nmi-timeout.pa
 Patch270: linux-2.6-debug-taint-vm.patch
 Patch280: linux-2.6-debug-spinlock-taint.patch
 Patch300: linux-2.6-driver-level-usb-autosuspend.diff
-Patch301: linux-2.6-fix-usb-serial-autosuspend.diff
 Patch302: linux-2.6-qcserial-autosuspend.diff
 Patch303: linux-2.6-bluetooth-autosuspend.diff
 Patch304: linux-2.6-usb-uvc-autosuspend.diff
@@ -653,6 +652,8 @@ Patch460: linux-2.6-serial-460800.patch
 
 Patch470: die-floppy-die.patch
 
+Patch500: linux-2.6.31-copy_from_user-bounds.patch
+
 Patch510: linux-2.6-silence-noise.patch
 Patch520: linux-2.6.30-hush-rom-warning.patch
 Patch530: linux-2.6-silence-fbcon-logo.patch
@@ -667,13 +668,7 @@ Patch611: alsa-tell-user-that-stream-to-
 Patch670: linux-2.6-ata-quirk.patch
 Patch671: linux-2.6-ahci-export-capabilities.patch
 
-Patch680: linux-2.6-iwlagn-modify-digital-SVR-for-1000.patch
-Patch681: linux-2.6-iwlwifi-update-1000-series-API-version-to-match-firmware.patch
-Patch682: linux-2.6-iwlwifi-Handle-new-firmware-file-with-ucode-build-number-in-header.patch
-Patch683: linux-2.6-iwlwifi-fix-debugfs-buffer-handling.patch
-Patch684: linux-2.6-iwlwifi-traverse-linklist-to-find-the-valid-OTP-block.patch
-Patch685: linux-2.6-iwlwifi-fix-unloading-driver-while-scanning.patch
-Patch686: linux-2.6-iwlwifi-remove-deprecated-6000-series-adapters.patch
+Patch687: linux-2.6-iwlwifi-reduce-noise-when-skb-allocation-fails.patch
 
 Patch700: linux-2.6.31-nx-data.patch
 Patch701: linux-2.6.31-modules-ro-nx.patch
@@ -682,8 +677,6 @@ Patch800: linux-2.6-crash-driver.patch
 
 Patch900: linux-2.6-pci-cacheline-sizing.patch
 
-Patch1000: linux-2.6.31-cpufreq-powernow-k8-oops.patch
-
 Patch1100: linux-2.6.31-cpuidle-faster-io.patch
 
 Patch1515: lirc-2.6.31.patch
@@ -695,14 +688,14 @@ Patch1550: linux-2.6-ksm.patch
 Patch1551: linux-2.6-ksm-kvm.patch
 Patch1552: linux-2.6-ksm-updates.patch
 Patch1553: linux-2.6-ksm-fix-munlock.patch
-Patch1578: linux-2.6-xen-stack-protector-fix.patch
 Patch1579: linux-2.6-virtio_blk-revert-QUEUE_FLAG_VIRT-addition.patch
-Patch1580: linux-2.6-xen-check-efer-fix.patch
-Patch1581: linux-2.6-xen-spinlock-enable-interrupts-only-when-blocking.patch
-Patch1582: linux-2.6-xen-spinlock-stronger-barrier.patch
+Patch1583: linux-2.6-xen-fix-is_disconnected_device-exists_disconnected_device.patch
+Patch1584: linux-2.6-xen-improvement-to-wait_for_devices.patch
+Patch1585: linux-2.6-xen-increase-device-connection-timeout.patch
+Patch1586: linux-2.6-virtio_blk-add-support-for-cache-flush.patch
 
 # nouveau + drm fixes
-Patch1812: drm-next-8ef8678c8.patch
+Patch1812: drm-next-d4ac6a05.patch
 Patch1813: drm-radeon-pm.patch
 Patch1814: drm-nouveau.patch
 Patch1818: drm-i915-resume-force-mode.patch
@@ -749,9 +742,8 @@ Patch12012: linux-2.6-rtc-show-hctosys.p
 Patch12013: linux-2.6-rfkill-all.patch
 Patch12014: linux-2.6-selinux-module-load-perms.patch
 
-Patch13000: ppc-hates-my-family-and-swore-revenge.patch
-
 # patches headed for -stable
+Patch13000: linux-2.6-frace-fixes.patch
 
 # Raid10 lockdep fix
 Patch14002: linux-2.6-raidlockdep.patch
@@ -1239,7 +1231,6 @@ ApplyPatch linux-2.6-nfs4-ver4opt.patch
 
 # USB
 ApplyPatch linux-2.6-driver-level-usb-autosuspend.diff
-ApplyPatch linux-2.6-fix-usb-serial-autosuspend.diff
 ApplyPatch linux-2.6-qcserial-autosuspend.diff
 ApplyPatch linux-2.6-bluetooth-autosuspend.diff
 ApplyPatch linux-2.6-usb-uvc-autosuspend.diff
@@ -1288,6 +1279,10 @@ ApplyPatch linux-2.6-input-kill-stupid-m
 # stop floppy.ko from autoloading during udev...
 ApplyPatch die-floppy-die.patch
 
+# make copy_from_user to a stack slot provable right
+# hosed stuff, just drop this close to beta
+#ApplyPatch linux-2.6.31-copy_from_user-bounds.patch
+
 # Get away from having to poll Toshibas
 #ApplyPatch linux-2.6-input-fix-toshiba-hotkeys.patch
 
@@ -1317,16 +1312,8 @@ ApplyPatch linux-2.6-ata-quirk.patch
 # Make it possible to identify non-hotplug SATA ports
 ApplyPatch linux-2.6-ahci-export-capabilities.patch
 
-# iwl1000 support patches
-ApplyPatch linux-2.6-iwlagn-modify-digital-SVR-for-1000.patch
-ApplyPatch linux-2.6-iwlwifi-Handle-new-firmware-file-with-ucode-build-number-in-header.patch
-ApplyPatch linux-2.6-iwlwifi-update-1000-series-API-version-to-match-firmware.patch
-ApplyPatch linux-2.6-iwlwifi-fix-debugfs-buffer-handling.patch
-ApplyPatch linux-2.6-iwlwifi-traverse-linklist-to-find-the-valid-OTP-block.patch
-ApplyPatch linux-2.6-iwlwifi-fix-unloading-driver-while-scanning.patch
-
-# remove support for deprecated iwl6000 parts
-ApplyPatch linux-2.6-iwlwifi-remove-deprecated-6000-series-adapters.patch
+# iwlagn quiet
+ApplyPatch linux-2.6-iwlwifi-reduce-noise-when-skb-allocation-fails.patch
 
 # Mark kernel data as NX
 ApplyPatch linux-2.6.31-nx-data.patch
@@ -1340,9 +1327,6 @@ ApplyPatch linux-2.6-crash-driver.patch
 # Determine cacheline sizes in a generic manner.
 ApplyPatch linux-2.6-pci-cacheline-sizing.patch
 
-# fix upstream bug #13780
-ApplyPatch linux-2.6.31-cpufreq-powernow-k8-oops.patch
-
 # cpuidle: Fix the menu governor to boost IO performance
 ApplyPatch linux-2.6.31-cpuidle-faster-io.patch
 
@@ -1361,13 +1345,11 @@ ApplyPatch linux-2.6-ksm-fix-munlock.pat
 ApplyPatch linux-2.6-ksm-kvm.patch
 
 # Assorted Virt Fixes
-#ApplyPatch linux-2.6-xen-stack-protector-fix.patch
 ApplyPatch linux-2.6-virtio_blk-revert-QUEUE_FLAG_VIRT-addition.patch
-#ApplyPatch linux-2.6-xen-check-efer-fix.patch
-
-# improve xen spinlock scalability
-#ApplyPatch linux-2.6-xen-spinlock-enable-interrupts-only-when-blocking.patch
-#ApplyPatch linux-2.6-xen-spinlock-stronger-barrier.patch
+#ApplyPatch linux-2.6-xen-fix-is_disconnected_device-exists_disconnected_device.patch
+#ApplyPatch linux-2.6-xen-improvement-to-wait_for_devices.patch
+#ApplyPatch linux-2.6-xen-increase-device-connection-timeout.patch
+ApplyPatch linux-2.6-virtio_blk-add-support-for-cache-flush.patch
 
 # Fix block I/O errors in KVM
 ApplyPatch linux-2.6-block-silently-error-unsupported-empty-barriers-too.patch
@@ -1375,7 +1357,7 @@ ApplyPatch linux-2.6-block-silently-erro
 ApplyPatch linux-2.6-e1000-ich9.patch
 
 # Nouveau DRM + drm fixes
-ApplyPatch drm-next-8ef8678c8.patch
+ApplyPatch drm-next-d4ac6a05.patch
 
 ApplyPatch drm-nouveau.patch
 # pm broken on my thinkpad t60p - airlied
@@ -1410,9 +1392,8 @@ ApplyPatch linux-2.6-rtc-show-hctosys.pa
 ApplyPatch linux-2.6-rfkill-all.patch
 ApplyPatch linux-2.6-selinux-module-load-perms.patch
 
-#ApplyPatch ppc-hates-my-family-and-swore-revenge.patch
-
 # patches headed for -stable
+ApplyPatch linux-2.6-frace-fixes.patch
 
 # Raid10 lockdep fix
 ApplyPatch linux-2.6-raidlockdep.patch
@@ -2033,9 +2014,9 @@ fi
 %endif\
 /lib/modules/%{KVERREL}%{?2:.%{2}}/modules.*\
 %if %{with_dracut}\
-%ghost /boot/initramfs-%{KVERREL}%{?2:.%{2}}.img\
+/boot/initramfs-%{KVERREL}%{?2:.%{2}}.img\
 %else\
-%ghost /boot/initrd-%{KVERREL}%{?2:.%{2}}.img\
+/boot/initrd-%{KVERREL}%{?2:.%{2}}.img\
 %endif\
 %{expand:%%files %{?2:%{2}-}devel}\
 %defattr(-,root,root)\
@@ -2076,6 +2057,87 @@ fi
 # and build.
 
 %changelog
+* Sat Oct 10 2009 Michael Young <m.a.young at durham.ac.uk>
+- update pvops patch
+- try putting DRM_RADEON and DRM_NOUVEAU back in
+
+* Fri Oct 09 2009 Dave Jones <davej at redhat.com>
+- Backport two critical ftrace fixes.
+  ftrace: check for failure for all conversions
+  tracing: correct module boundaries for ftrace_release
+
+* Fri Oct 09 2009 Jarod Wilson <jarod at redhat.com>
+- Build docs sub-package again
+
+* Thu Oct 08 2009 Kyle McMartin <kyle at redhat.com> 2.6.31.3-67
+- Linux 2.6.31.3
+- rebase drm-next trivially.
+- dropped merged upstream patches,
+ - linux-2.6-fix-usb-serial-autosuspend.diff
+ - linux-2.6-iwlagn-modify-digital-SVR-for-1000.patch
+ - linux-2.6-iwlwifi-Handle-new-firmware-file-with-ucode-build-number-in-header.patch
+ - linux-2.6-iwlwifi-fix-debugfs-buffer-handling.patch
+ - linux-2.6-iwlwifi-fix-unloading-driver-while-scanning.patch
+ - linux-2.6-iwlwifi-remove-deprecated-6000-series-adapters.patch
+ - linux-2.6-iwlwifi-traverse-linklist-to-find-the-valid-OTP-block.patch
+ - linux-2.6-iwlwifi-update-1000-series-API-version-to-match-firmware.patch
+ - linux-2.6-xen-check-efer-fix.patch
+ - linux-2.6-xen-spinlock-enable-interrupts-only-when-blocking.patch
+ - linux-2.6-xen-spinlock-stronger-barrier.patch
+ - linux-2.6-xen-stack-protector-fix.patch
+ - linux-2.6.31-cpufreq-powernow-k8-oops.patch
+
+* Thu Oct 08 2009 Ben Skeggs <bskeggs at redhat.com>
+- ppc: compile nvidiafb as a module only, nvidiafb+nouveau = bang! (rh#491308)
+
+* Thu Oct 08 2009 Ben Skeggs <bskeggs at redhat.com> 2.6.31.1-65
+- nouveau: {drm-next,context,fbcon,misc} fixes, connector forcing
+
+* Thu Oct 08 2009 Dave Airlie <airlied at redhat.com> 2.6.31.1-64
+- rebase latest drm-next, fixes many s/r and r600 problems
+
+* Wed Oct 07 2009 Dave Jones <davej at redhat.com>
+- Don't mark the initramfs file as a ghost.
+
+* Wed Oct 07 2009 Dave Jones <davej at redhat.com>
+- Enable FUNCTION_GRAPH_TRACER on x86-64.
+
+* Wed Oct 07 2009 Dave Jones <davej at redhat.com>
+- Disable CONFIG_IRQSOFF_TRACER on srostedt's recommendation.
+  (Adds unwanted overhead when not in use).
+
+* Tue Oct  6 2009 Justin M. Forbes <jforbes at redhat.com>
+- virtio_blk: add support for cache flush (#526869)
+
+* Sat Oct  3 2009 Michael Young <m.a.young at durham.ac.uk>
+- update pvops patch
+
+* Fri Oct  2 2009 John W. Linville <linville at redhat.com>
+- Backport "iwlwifi: reduce noise when skb allocation fails"
+
+* Wed Sep 30 2009 David Woodhouse <David.Woodhouse at intel.com>
+- Update IOMMU code; mostly a bunch more workarounds for broken BIOSes.
+
+* Wed Sep 30 2009 Dave Airlie <airlied at redhat.com> 2.6.31.1-56
+- revert all the arjan patches until someone tests them.
+
+* Tue Sep 29 2009 Steve Dickson <steved at redhat.com>  2.6.31.1-55
+- Updated the NFS4 pseudo root code with a fix from upstream
+
+* Tue Sep 29 2009 Dave Airlie <airlied at redhat.com> 2.6.31.1-54
+- Fix broken capabilties that stopped dbus working due to copy from user
+  fixups.
+
+* Tue Sep 29 2009 Dave Airlie <airlied at redhat.com> 2.6.31.1-53
+- drm-next-4c57edba4.patch: fix r600 dri1 memory leak and r600 bugs
+
+* Mon Sep 28 2009 Dave Jones <davej at redhat.com> 2.6.31.1-52
+- Use __builtin_object_size to validate the buffer size for copy_from_user
+  + associated fixes to various copy_from_user invocations.
+
+* Mon Sep 28 2009 Justin M. Forbes <jmforbes at redhat.com> 2.6.31.1-50
+- Increase timeout for xen frontend devices to connect.
+
 * Sat Sep 26 2009 Michael Young <m.a.young at durham.ac.uk>
 - disable DRM_RADEON  and DRM_NOUVEAU due to build problems
 

linux-2.6-intel-iommu-updates.patch:
 Documentation/Intel-IOMMU.txt  |    6 
 arch/ia64/kernel/pci-swiotlb.c |    2 
 arch/x86/kernel/pci-swiotlb.c  |    5 
 drivers/pci/dmar.c             |   37 ++-
 drivers/pci/intel-iommu.c      |  399 ++++++++++++++++++++++++-----------------
 drivers/pci/intr_remapping.c   |    8 
 drivers/pci/iova.c             |   16 -
 include/linux/intel-iommu.h    |    2 
 include/linux/iova.h           |    1 
 9 files changed, 282 insertions(+), 194 deletions(-)

Index: linux-2.6-intel-iommu-updates.patch
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/Attic/linux-2.6-intel-iommu-updates.patch,v
retrieving revision 1.1.2.2
retrieving revision 1.1.2.3
diff -u -p -r1.1.2.2 -r1.1.2.3
--- linux-2.6-intel-iommu-updates.patch	10 Aug 2009 21:22:19 -0000	1.1.2.2
+++ linux-2.6-intel-iommu-updates.patch	10 Oct 2009 15:04:14 -0000	1.1.2.3
@@ -1,3 +1,313 @@
+(Reverted the part which kills BROKEN_GFX_WA)
+(...and the HARDWARE_AFFINITY bit)
+
+commit e0fc7e0b4b5e69616f10a894ab9afff3c64be74e
+Author: David Woodhouse <David.Woodhouse at intel.com>
+Date:   Wed Sep 30 09:12:17 2009 -0700
+
+    intel-iommu: Yet another BIOS workaround: Isoch DMAR unit with no TLB space
+    
+    Asus decided to ship a BIOS which configures sound DMA to go via the
+    dedicated IOMMU unit, but assigns precisely zero TLB entries to that
+    unit. Which causes the whole thing to deadlock, including the DMA
+    traffic on the _other_ IOMMU units. Nice one.
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
+
+commit 17b6097753e926ca546189463070a7e94e7ea9fa
+Author: Roland Dreier <rdreier at cisco.com>
+Date:   Thu Sep 24 12:14:00 2009 -0700
+
+    intel-iommu: Decode (and ignore) RHSA entries
+    
+    I recently got a system where the DMAR table included a couple of RHSA
+    (remapping hardware static affinity) entries.  Rather than printing a
+    message about an "Unknown DMAR structure," it would probably be more
+    useful to dump the RHSA structure (as other DMAR structures are dumped).
+    
+    Signed-off-by: Roland Dreier <rolandd at cisco.com>
+    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
+
+commit 4de75cf9391b538bbfe7dc0a9782f1ebe8e242ad
+Author: Roland Dreier <rdreier at cisco.com>
+Date:   Thu Sep 24 01:01:29 2009 +0100
+
+    intel-iommu: Make "Unknown DMAR structure" message more informative
+    
+    We might as well print the type of the DMAR structure we don't know how
+    to handle when skipping it.  Then someone getting this message has a
+    chance of telling whether the structure is just bogus, or if there
+    really is something valid that the kernel doesn't know how to handle.
+    
+    Signed-off-by: Roland Dreier <rolandd at cisco.com>
+    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
+
+commit b09a75fc5e77b7c58d097236f89b1ff72dcdb562
+Merge: cf63ff5 b94996c
+Author: Linus Torvalds <torvalds at linux-foundation.org>
+Date:   Wed Sep 23 10:06:10 2009 -0700
+
+    Merge git://git.infradead.org/iommu-2.6
+    
+    * git://git.infradead.org/iommu-2.6: (23 commits)
+      intel-iommu: Disable PMRs after we enable translation, not before
+      intel-iommu: Kill DMAR_BROKEN_GFX_WA option.
+      intel-iommu: Fix integer wrap on 32 bit kernels
+      intel-iommu: Fix integer overflow in dma_pte_{clear_range,free_pagetable}()
+      intel-iommu: Limit DOMAIN_MAX_PFN to fit in an 'unsigned long'
+      intel-iommu: Fix kernel hang if interrupt remapping disabled in BIOS
+      intel-iommu: Disallow interrupt remapping if not all ioapics covered
+      intel-iommu: include linux/dmi.h to use dmi_ routines
+      pci/dmar: correct off-by-one error in dmar_fault()
+      intel-iommu: Cope with yet another BIOS screwup causing crashes
+      intel-iommu: iommu init error path bug fixes
+      intel-iommu: Mark functions with __init
+      USB: Work around BIOS bugs by quiescing USB controllers earlier
+      ia64: IOMMU passthrough mode shouldn't trigger swiotlb init
+      intel-iommu: make domain_add_dev_info() call domain_context_mapping()
+      intel-iommu: Unify hardware and software passthrough support
+      intel-iommu: Cope with broken HP DC7900 BIOS
+      iommu=pt is a valid early param
+      intel-iommu: double kfree()
+      intel-iommu: Kill pointless intel_unmap_single() function
+      ...
+    
+    Fixed up trivial include lines conflict in drivers/pci/intel-iommu.c
+
+commit b94996c99c8befed9cbbb8804a4625e203913318
+Author: David Woodhouse <David.Woodhouse at intel.com>
+Date:   Sat Sep 19 15:28:12 2009 -0700
+
+    intel-iommu: Disable PMRs after we enable translation, not before
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
+
+commit 0c02a20ff7695f9c54cc7c013dda326270ccdac8
+Author: David Woodhouse <David.Woodhouse at intel.com>
+Date:   Sat Sep 19 09:37:23 2009 -0700
+
+    intel-iommu: Kill DMAR_BROKEN_GFX_WA option.
+    
+    Just make it depend on BROKEN for now, in case people scream really loud
+    about it (and because we might want to keep some of this logic for an
+    upcoming BIOS workaround, so I don't just want to rip it out entirely
+    just yet). But for graphics devices, it really ought to be unnecessary.
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
+
+commit 64de5af000e99f32dd49ff5dd9a0fd7db1f60305
+Author: Benjamin LaHaise <ben.lahaise at neterion.com>
+Date:   Wed Sep 16 21:05:55 2009 -0400
+
+    intel-iommu: Fix integer wrap on 32 bit kernels
+    
+    The following 64 bit promotions are necessary to handle memory above the
+    4GiB boundary correctly.
+    
+    [dwmw2: Fix the second part not to need 64-bit arithmetic at all]
+    
+    Signed-off-by: Benjamin LaHaise <ben.lahaise at neterion.com>
+    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
+
+commit 59c36286b74ae6a8adebf6e133a83d7f2e3e6704
+Author: David Woodhouse <David.Woodhouse at intel.com>
+Date:   Sat Sep 19 07:36:28 2009 -0700
+
+    intel-iommu: Fix integer overflow in dma_pte_{clear_range,free_pagetable}()
+    
+    If end_pfn is equal to (unsigned long)-1, then the loop will never end.
+    
+    Seen on 32-bit kernel, but could have happened on 64-bit too once we get
+    hardware that supports 64-bit guest addresses.
+    
+    Change both functions to a 'do {} while' loop with the test at the end,
+    and check for the PFN having wrapper round to zero.
+    
+    Reported-by: Benjamin LaHaise <ben.lahaise at neterion.com>
+    Tested-by: Benjamin LaHaise <ben.lahaise at neterion.com>
+    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
+
+commit 2ebe31513fcbe7a781f27002f065b50ae195022f
+Author: David Woodhouse <David.Woodhouse at intel.com>
+Date:   Sat Sep 19 07:34:04 2009 -0700
+
+    intel-iommu: Limit DOMAIN_MAX_PFN to fit in an 'unsigned long'
+    
+    This means we're limited to 44-bit addresses on 32-bit kernels, and
+    makes it sane for us to use 'unsigned long' for PFNs throughout.
+    
+    Which is just as well, really, since we already do that.
+    
+    Reported-by: Benjamin LaHaise <ben.lahaise at neterion.com>
+    Tested-by: Benjamin LaHaise <ben.lahaise at neterion.com>
+    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
+
+commit 074835f0143b83845af5044af2739c52c9f53808
+Author: Youquan Song <youquan.song at intel.com>
+Date:   Wed Sep 9 12:05:39 2009 -0400
+
+    intel-iommu: Fix kernel hang if interrupt remapping disabled in BIOS
+    
+    BIOS clear DMAR table INTR_REMAP flag to disable interrupt remapping. Current
+    kernel only check interrupt remapping(IR) flag in DRHD's extended capability
+    register to decide interrupt remapping support or not. But IR flag will not
+    change when BIOS disable/enable interrupt remapping.
+    
+    When user disable interrupt remapping in BIOS or BIOS often defaultly disable
+    interrupt remapping feature when BIOS is not mature.Though BIOS disable
+    interrupt remapping but intr_remapping_supported function will always report
+    to OS support interrupt remapping if VT-d2 chipset populated. On this
+    cases, kernel will continue enable interrupt remapping and result kernel panic.
+    This bug exist on almost all platforms with interrupt remapping support.
+    
+    This patch add DMAR table INTR_REMAP flag check before enable interrupt
+    remapping.
+    
+    Signed-off-by: Youquan Song <youquan.song at intel.com>
+    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
+
+commit e936d0773df172ec8600777fdd72bbc1f75f22ad
+Author: Youquan Song <youquan.song at intel.com>
+Date:   Mon Sep 7 10:58:07 2009 -0400
+
+    intel-iommu: Disallow interrupt remapping if not all ioapics covered
+    
+    Current kernel enable interrupt remapping only when all the vt-d unit support
+    interrupt remapping. So it is reasonable we should also disallow enabling
+    intr-remapping if there any io-apics that are not listed under vt-d units.
+    Otherwise we can run into issues.
+    
+    Acked-by: Suresh Siddha <suresh.b.siddha at intel.com>
+    Signed-off-by: Youquan Song <youquan.song at intel.com>
+    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
+
+commit adb2fe0277607d50f4e9ef06e1d180051a609c25
+Author: Stephen Rothwell <sfr at canb.auug.org.au>
+Date:   Mon Aug 31 15:24:23 2009 +1000
+
+    intel-iommu: include linux/dmi.h to use dmi_ routines
+    
+    This file needs to include linux/dmi.h directly rather than relying on
+    it being pulled in from elsewhere.
+    
+    Signed-off-by: Stephen Rothwell <sfr at canb.auug.org.au>
+    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
+
+commit 8211a7b5857914058c52ae977c96463e419b37ab
+Author: Troy Heber <troy.heber at hp.com>
+Date:   Wed Aug 19 15:26:11 2009 -0600
+
+    pci/dmar: correct off-by-one error in dmar_fault()
+    
+    DMAR faults are recorded into a ring of "fault recording registers".
+    fault_index is a 0-based index into the ring. The code allows the
+    0-based fault_index to be equal to the total number of fault registers
+    available from the cap_num_fault_regs() macro, which causes access
+    beyond the last available register.
+    
+    Signed-off-by Troy Heber <troy.heber at hp.com>
+    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
+
+commit 2ff729f5445cc47d1910386c36e53fc6b1c5e47a
+Author: David Woodhouse <David.Woodhouse at intel.com>
+Date:   Wed Aug 26 14:25:41 2009 +0100
+
+    intel-iommu: Cope with yet another BIOS screwup causing crashes
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
+
+commit 94a91b5051a77d8a71d4f11a3240f0d9c51b6cf2
+Author: Donald Dutile <ddutile at redhat.com>
+Date:   Thu Aug 20 16:51:34 2009 -0400
+
+    intel-iommu: iommu init error path bug fixes
+    
+    The kcalloc() failure path in iommu_init_domains() calls
+    free_dmar_iommu(), which assumes that ->domains, ->domain_ids,
+    and ->lock have been properly initialized.
+    
+    Add checks in free_[dmar]_iommu to not use ->domains,->domain_ids
+    if not alloced. Move the lock init to prior to the kcalloc()'s,
+    so it is valid in free_context_table() when free_dmar_iommu() invokes
+    it at the end.
+    
+    Patch based on iommu-2.6,
+    commit 132032274a594ee9ffb6b9c9e2e9698149a09ea9
+    
+    Signed-off-by: Donald Dutile <ddutile at redhat.com>
+    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
+
+commit 071e13746f9ebb259987c71ea77f11e7656769a2
+Author: Matt Kraai <kraai at ftbfs.org>
+Date:   Sun Aug 23 22:30:22 2009 -0700
+
+    intel-iommu: Mark functions with __init
+    
+    Mark si_domain_init and iommu_prepare_static_identity_mapping with
+    __init, to eliminate the following warnings:
+    
+    WARNING: drivers/pci/built-in.o(.text+0xf1f4): Section mismatch in reference from the function si_domain_init() to the function .init.text:si_domain_work_fn()
+    The function si_domain_init() references
+    the function __init si_domain_work_fn().
+    This is often because si_domain_init lacks a __init
+    annotation or the annotation of si_domain_work_fn is wrong.
+    
+    WARNING: drivers/pci/built-in.o(.text+0xe340): Section mismatch in reference from the function iommu_prepare_static_identity_mapping() to the function .init.text:si_domain_init()
+    The function iommu_prepare_static_identity_mapping() references
+    the function __init si_domain_init().
+    This is often because iommu_prepare_static_identity_mapping lacks a __init
+    annotation or the annotation of si_domain_init is wrong.
+    
+    Signed-off-by: Matt Kraai <kraai at ftbfs.org>
+    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
+
+commit 132032274a594ee9ffb6b9c9e2e9698149a09ea9
+Author: David Woodhouse <dwmw2 at infradead.org>
+Date:   Mon Aug 3 12:40:27 2009 +0100
+
+    USB: Work around BIOS bugs by quiescing USB controllers earlier
+    
+    We are seeing a number of crashes in SMM, when VT-d is enabled while
+    'Legacy USB support' is enabled in various BIOSes.
+    
+    The BIOS is supposed to indicate which addresses it uses for DMA in a
+    special ACPI table ("RMRR"), so that we can punch a hole for it when we
+    set up the IOMMU.
+    
+    The problem is, as usual, that BIOS engineers are totally incompetent.
+    They write code which will crash if the DMA goes AWOL, and then they
+    either neglect to provide an RMRR table at all, or they put the wrong
+    addresses in it. And of course they don't do _any_ QA, since that would
+    take too much time away from their crack-smoking habit.
+    
+    The real fix, of course, is for consumers to refuse to buy motherboards
+    which only have closed-source firmware available. If we had _open_
+    firmware, bugs like this would be easy to fix.
+    
+    Since that's something I can only dream about, this patch implements an
+    alternative -- ensuring that the USB controllers are handed off from the
+    BIOS and quiesced _before_ the IOMMU is initialised. That would have
+    been a much better design than this RMRR nonsense in the first place, of
+    course. The bootloader has no business doing DMA after the OS has booted
+    anyway.
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
+    Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+
+commit ba6c548701ef7a93b9ea05d1506d2b62f1628333
+Author: David Woodhouse <David.Woodhouse at intel.com>
+Date:   Thu Aug 13 18:18:00 2009 +0100
+
+    ia64: IOMMU passthrough mode shouldn't trigger swiotlb init
+    
+    Since commit 19943b0e30b05d42e494ae6fef78156ebc8c637e ('intel-iommu:
+    Unify hardware and software passthrough support'), hardware passthrough
+    mode will do the same as software passthrough mode was doing -- it'll
+    still use the IOMMU normally for devices which can't address all of
+    memory. This means that we don't need to bother with swiotlb.
+    
+    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
+
 commit 5fe60f4e5871b64e687229199fafd4ef13cd0886
 Author: David Woodhouse <David.Woodhouse at intel.com>
 Date:   Sun Aug 9 10:53:41 2009 +0100
@@ -124,22 +434,36 @@ Date:   Tue Jul 7 19:43:20 2009 +0100
     cycles to 4812 cycles on my Lenovo x200s test box -- a modest 20%.
     
     Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
-diff --git a/arch/x86/kernel/pci-dma.c b/arch/x86/kernel/pci-dma.c
-index 1a041bc..ae13e34 100644
---- a/arch/x86/kernel/pci-dma.c
-+++ b/arch/x86/kernel/pci-dma.c
-@@ -212,10 +212,8 @@ static __init int iommu_setup(char *p)
- 		if (!strncmp(p, "soft", 4))
- 			swiotlb = 1;
- #endif
--		if (!strncmp(p, "pt", 2)) {
-+		if (!strncmp(p, "pt", 2))
- 			iommu_pass_through = 1;
--			return 1;
--		}
- 
- 		gart_parse_options(p);
+diff --git a/Documentation/Intel-IOMMU.txt b/Documentation/Intel-IOMMU.txt
+index 21bc416..cf9431d 100644
+--- a/Documentation/Intel-IOMMU.txt
++++ b/Documentation/Intel-IOMMU.txt
+@@ -56,11 +56,7 @@ Graphics Problems?
+ ------------------
+ If you encounter issues with graphics devices, you can try adding
+ option intel_iommu=igfx_off to turn off the integrated graphics engine.
+-
+-If it happens to be a PCI device included in the INCLUDE_ALL Engine,
+-then try enabling CONFIG_DMAR_GFX_WA to setup a 1-1 map. We hear
+-graphics drivers may be in process of using DMA api's in the near
+-future and at that time this option can be yanked out.
++If this fixes anything, please ensure you file a bug reporting the problem.
+ 
+ Some exceptions to IOVA
+ -----------------------
+diff --git a/arch/ia64/kernel/pci-swiotlb.c b/arch/ia64/kernel/pci-swiotlb.c
+index 223abb1..285aae8 100644
+--- a/arch/ia64/kernel/pci-swiotlb.c
++++ b/arch/ia64/kernel/pci-swiotlb.c
+@@ -46,7 +46,7 @@ void __init swiotlb_dma_init(void)
  
+ void __init pci_swiotlb_init(void)
+ {
+-	if (!iommu_detected || iommu_pass_through) {
++	if (!iommu_detected) {
+ #ifdef CONFIG_IA64_GENERIC
+ 		swiotlb = 1;
+ 		printk(KERN_INFO "PCI-DMA: Re-initialize machine vector.\n");
 diff --git a/arch/x86/kernel/pci-swiotlb.c b/arch/x86/kernel/pci-swiotlb.c
 index 6af96ee..1e66b18 100644
 --- a/arch/x86/kernel/pci-swiotlb.c
@@ -157,10 +481,20 @@ index 6af96ee..1e66b18 100644
  	if (swiotlb_force)
  		swiotlb = 1;
 diff --git a/drivers/pci/dmar.c b/drivers/pci/dmar.c
-index 7b287cb..380b60e 100644
+index 7b287cb..708176d 100644
 --- a/drivers/pci/dmar.c
 +++ b/drivers/pci/dmar.c
-@@ -632,20 +632,31 @@ int alloc_iommu(struct dmar_drhd_unit *drhd)
+@@ -570,9 +581,6 @@ int __init dmar_table_init(void)
+ 		printk(KERN_INFO PREFIX "No ATSR found\n");
+ #endif
+ 
+-#ifdef CONFIG_INTR_REMAP
+-	parse_ioapics_under_ir();
+-#endif
+ 	return 0;
+ }
+ 
+@@ -632,20 +640,31 @@ int alloc_iommu(struct dmar_drhd_unit *drhd)
  	iommu->cap = dmar_readq(iommu->reg + DMAR_CAP_REG);
  	iommu->ecap = dmar_readq(iommu->reg + DMAR_ECAP_REG);
  
@@ -194,7 +528,7 @@ index 7b287cb..380b60e 100644
  	}
  #endif
  	iommu->agaw = agaw;
-@@ -665,7 +676,7 @@ int alloc_iommu(struct dmar_drhd_unit *drhd)
+@@ -665,7 +684,7 @@ int alloc_iommu(struct dmar_drhd_unit *drhd)
  	}
  
  	ver = readl(iommu->reg + DMAR_VER_REG);
@@ -203,7 +537,7 @@ index 7b287cb..380b60e 100644
  		(unsigned long long)drhd->reg_base_addr,
  		DMAR_VER_MAJOR(ver), DMAR_VER_MINOR(ver),
  		(unsigned long long)iommu->cap,
-@@ -675,7 +686,10 @@ int alloc_iommu(struct dmar_drhd_unit *drhd)
+@@ -675,7 +694,10 @@ int alloc_iommu(struct dmar_drhd_unit *drhd)
  
  	drhd->iommu = iommu;
  	return 0;
@@ -215,11 +549,75 @@ index 7b287cb..380b60e 100644
  	kfree(iommu);
  	return -1;
  }
+@@ -1212,7 +1234,7 @@ irqreturn_t dmar_fault(int irq, void *dev_id)
+ 				source_id, guest_addr);
+ 
+ 		fault_index++;
+-		if (fault_index > cap_num_fault_regs(iommu->cap))
++		if (fault_index >= cap_num_fault_regs(iommu->cap))
+ 			fault_index = 0;
+ 		spin_lock_irqsave(&iommu->register_lock, flag);
+ 	}
+@@ -1305,3 +1327,13 @@ int dmar_reenable_qi(struct intel_iommu *iommu)
+ 
+ 	return 0;
+ }
++
++/*
++ * Check interrupt remapping support in DMAR table description.
++ */
++int dmar_ir_support(void)
++{
++	struct acpi_table_dmar *dmar;
++	dmar = (struct acpi_table_dmar *)dmar_tbl;
++	return dmar->flags & 0x1;
++}
 diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
-index 2314ad7..09606e9 100644
+index 2314ad7..f89ce3f 100644
 --- a/drivers/pci/intel-iommu.c
 +++ b/drivers/pci/intel-iommu.c
-@@ -251,7 +251,8 @@ static inline int first_pte_in_page(struct dma_pte *pte)
+@@ -37,6 +37,7 @@
+ #include <linux/iommu.h>
+ #include <linux/intel-iommu.h>
+ #include <linux/sysdev.h>
++#include <linux/dmi.h>
+ #include <asm/cacheflush.h>
+ #include <asm/iommu.h>
+ #include "pci.h"
+@@ -46,6 +47,7 @@
+ 
+ #define IS_GFX_DEVICE(pdev) ((pdev->class >> 16) == PCI_BASE_CLASS_DISPLAY)
+ #define IS_ISA_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_BRIDGE_ISA)
++#define IS_AZALIA(pdev) ((pdev)->vendor == 0x8086 && (pdev)->device == 0x3a3e)
+ 
+ #define IOAPIC_RANGE_START	(0xfee00000)
+ #define IOAPIC_RANGE_END	(0xfeefffff)
+@@ -55,8 +57,14 @@
+ 
+ #define MAX_AGAW_WIDTH 64
+ 
+-#define DOMAIN_MAX_ADDR(gaw) ((((u64)1) << gaw) - 1)
+-#define DOMAIN_MAX_PFN(gaw)  ((((u64)1) << (gaw-VTD_PAGE_SHIFT)) - 1)
++#define __DOMAIN_MAX_PFN(gaw)  ((((uint64_t)1) << (gaw-VTD_PAGE_SHIFT)) - 1)
++#define __DOMAIN_MAX_ADDR(gaw) ((((uint64_t)1) << gaw) - 1)
++
++/* We limit DOMAIN_MAX_PFN to fit in an unsigned long, and DOMAIN_MAX_ADDR
++   to match. That way, we can use 'unsigned long' for PFNs with impunity. */
++#define DOMAIN_MAX_PFN(gaw)	((unsigned long) min_t(uint64_t, \
++				__DOMAIN_MAX_PFN(gaw), (unsigned long)-1))
++#define DOMAIN_MAX_ADDR(gaw)	(((uint64_t)__DOMAIN_MAX_PFN(gaw)) << VTD_PAGE_SHIFT)
+ 
+ #define IOVA_PFN(addr)		((addr) >> PAGE_SHIFT)
+ #define DMA_32BIT_PFN		IOVA_PFN(DMA_BIT_MASK(32))
+@@ -86,6 +94,7 @@ static inline unsigned long virt_to_dma_pfn(void *p)
+ /* global iommu list, set NULL for ignored DMAR units */
+ static struct intel_iommu **g_iommus;
+ 
++static void __init check_tylersburg_isoch(void);
+ static int rwbf_quirk;
+ 
+ /*
+@@ -251,7 +260,8 @@ static inline int first_pte_in_page(struct dma_pte *pte)
   * 	2. It maps to each iommu if successful.
   *	3. Each iommu mapps to this domain if successful.
   */
@@ -229,7 +627,125 @@ index 2314ad7..09606e9 100644
  
  /* devices under the same p2p bridge are owned in one domain */
  #define DOMAIN_FLAG_P2P_MULTIPLE_DEVICES (1 << 0)
-@@ -1309,7 +1310,6 @@ static void iommu_detach_domain(struct dmar_domain *domain,
+@@ -727,7 +737,7 @@ static struct dma_pte *pfn_to_dma_pte(struct dmar_domain *domain,
+ 				return NULL;
+ 
+ 			domain_flush_cache(domain, tmp_page, VTD_PAGE_SIZE);
+-			pteval = (virt_to_dma_pfn(tmp_page) << VTD_PAGE_SHIFT) | DMA_PTE_READ | DMA_PTE_WRITE;
++			pteval = ((uint64_t)virt_to_dma_pfn(tmp_page) << VTD_PAGE_SHIFT) | DMA_PTE_READ | DMA_PTE_WRITE;
+ 			if (cmpxchg64(&pte->val, 0ULL, pteval)) {
+ 				/* Someone else set it while we were thinking; use theirs. */
+ 				free_pgtable_page(tmp_page);
+@@ -777,9 +787,10 @@ static void dma_pte_clear_range(struct dmar_domain *domain,
+ 
+ 	BUG_ON(addr_width < BITS_PER_LONG && start_pfn >> addr_width);
+ 	BUG_ON(addr_width < BITS_PER_LONG && last_pfn >> addr_width);
++	BUG_ON(start_pfn > last_pfn);
+ 
+ 	/* we don't need lock here; nobody else touches the iova range */
+-	while (start_pfn <= last_pfn) {
++	do {
+ 		first_pte = pte = dma_pfn_level_pte(domain, start_pfn, 1);
+ 		if (!pte) {
+ 			start_pfn = align_to_level(start_pfn + 1, 2);
+@@ -793,7 +804,8 @@ static void dma_pte_clear_range(struct dmar_domain *domain,
+ 
+ 		domain_flush_cache(domain, first_pte,
+ 				   (void *)pte - (void *)first_pte);
+-	}
++
++	} while (start_pfn && start_pfn <= last_pfn);
+ }
+ 
+ /* free page table pages. last level pte should already be cleared */
+@@ -809,6 +821,7 @@ static void dma_pte_free_pagetable(struct dmar_domain *domain,
+ 
+ 	BUG_ON(addr_width < BITS_PER_LONG && start_pfn >> addr_width);
+ 	BUG_ON(addr_width < BITS_PER_LONG && last_pfn >> addr_width);
++	BUG_ON(start_pfn > last_pfn);
+ 
+ 	/* We don't need lock here; nobody else touches the iova range */
+ 	level = 2;
+@@ -819,7 +832,7 @@ static void dma_pte_free_pagetable(struct dmar_domain *domain,
+ 		if (tmp + level_size(level) - 1 > last_pfn)
+ 			return;
+ 
+-		while (tmp + level_size(level) - 1 <= last_pfn) {
++		do {
+ 			first_pte = pte = dma_pfn_level_pte(domain, tmp, level);
+ 			if (!pte) {
+ 				tmp = align_to_level(tmp + 1, level + 1);
+@@ -838,7 +851,7 @@ static void dma_pte_free_pagetable(struct dmar_domain *domain,
+ 			domain_flush_cache(domain, first_pte,
+ 					   (void *)pte - (void *)first_pte);
+ 			
+-		}
++		} while (tmp && tmp + level_size(level) - 1 <= last_pfn);
+ 		level++;
+ 	}
+ 	/* free pgd */
+@@ -1157,6 +1170,8 @@ static int iommu_init_domains(struct intel_iommu *iommu)
+ 	pr_debug("Number of Domains supportd <%ld>\n", ndomains);
+ 	nlongs = BITS_TO_LONGS(ndomains);
+ 
++	spin_lock_init(&iommu->lock);
++
+ 	/* TBD: there might be 64K domains,
+ 	 * consider other allocation for future chip
+ 	 */
+@@ -1169,12 +1184,9 @@ static int iommu_init_domains(struct intel_iommu *iommu)
+ 			GFP_KERNEL);
+ 	if (!iommu->domains) {
+ 		printk(KERN_ERR "Allocating domain array failed\n");
+-		kfree(iommu->domain_ids);
+ 		return -ENOMEM;
+ 	}
+ 
+-	spin_lock_init(&iommu->lock);
+-
+ 	/*
+ 	 * if Caching mode is set, then invalid translations are tagged
+ 	 * with domainid 0. Hence we need to pre-allocate it.
+@@ -1194,22 +1206,24 @@ void free_dmar_iommu(struct intel_iommu *iommu)
+ 	int i;
+ 	unsigned long flags;
+ 
+-	i = find_first_bit(iommu->domain_ids, cap_ndoms(iommu->cap));
+-	for (; i < cap_ndoms(iommu->cap); ) {
+-		domain = iommu->domains[i];
+-		clear_bit(i, iommu->domain_ids);
++	if ((iommu->domains) && (iommu->domain_ids)) {
++		i = find_first_bit(iommu->domain_ids, cap_ndoms(iommu->cap));
++		for (; i < cap_ndoms(iommu->cap); ) {
++			domain = iommu->domains[i];
++			clear_bit(i, iommu->domain_ids);
++
++			spin_lock_irqsave(&domain->iommu_lock, flags);
++			if (--domain->iommu_count == 0) {
++				if (domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE)
++					vm_domain_exit(domain);
++				else
++					domain_exit(domain);
++			}
++			spin_unlock_irqrestore(&domain->iommu_lock, flags);
+ 
+-		spin_lock_irqsave(&domain->iommu_lock, flags);
+-		if (--domain->iommu_count == 0) {
+-			if (domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE)
+-				vm_domain_exit(domain);
+-			else
+-				domain_exit(domain);
++			i = find_next_bit(iommu->domain_ids,
++				cap_ndoms(iommu->cap), i+1);
+ 		}
+-		spin_unlock_irqrestore(&domain->iommu_lock, flags);
+-
+-		i = find_next_bit(iommu->domain_ids,
+-			cap_ndoms(iommu->cap), i+1);
+ 	}
+ 
+ 	if (iommu->gcmd & DMA_GCMD_TE)
+@@ -1309,7 +1323,6 @@ static void iommu_detach_domain(struct dmar_domain *domain,
  }
  
  static struct iova_domain reserved_iova_list;
@@ -237,7 +753,7 @@ index 2314ad7..09606e9 100644
  static struct lock_class_key reserved_rbtree_key;
  
  static void dmar_init_reserved_ranges(void)
-@@ -1320,8 +1320,6 @@ static void dmar_init_reserved_ranges(void)
+@@ -1320,8 +1333,6 @@ static void dmar_init_reserved_ranges(void)
  
  	init_iova_domain(&reserved_iova_list, DMA_32BIT_PFN);
  
@@ -246,7 +762,17 @@ index 2314ad7..09606e9 100644
  	lockdep_set_class(&reserved_iova_list.iova_rbtree_lock,
  		&reserved_rbtree_key);
  
-@@ -1958,14 +1956,24 @@ static int iommu_prepare_identity_map(struct pci_dev *pdev,
+@@ -1924,6 +1935,9 @@ error:
+ }
+ 
+ static int iommu_identity_mapping;
++#define IDENTMAP_ALL		1
++#define IDENTMAP_GFX		2
++#define IDENTMAP_AZALIA		4
+ 
+ static int iommu_domain_identity_map(struct dmar_domain *domain,
+ 				     unsigned long long start,
+@@ -1958,14 +1972,35 @@ static int iommu_prepare_identity_map(struct pci_dev *pdev,
  	struct dmar_domain *domain;
  	int ret;
  
@@ -271,11 +797,22 @@ index 2314ad7..09606e9 100644
 +	printk(KERN_INFO
 +	       "IOMMU: Setting identity map for device %s [0x%Lx - 0x%Lx]\n",
 +	       pci_name(pdev), start, end);
++	
++	if (end >> agaw_to_width(domain->agaw)) {
++		WARN(1, "Your BIOS is broken; RMRR exceeds permitted address width (%d bits)\n"
++		     "BIOS vendor: %s; Ver: %s; Product Version: %s\n",
++		     agaw_to_width(domain->agaw),
++		     dmi_get_system_info(DMI_BIOS_VENDOR),
++		     dmi_get_system_info(DMI_BIOS_VERSION),
++		     dmi_get_system_info(DMI_PRODUCT_VERSION));
++		ret = -EIO;
++		goto error;
++	}
 +
  	ret = iommu_domain_identity_map(domain, start, end);
  	if (ret)
  		goto error;
-@@ -2016,23 +2024,6 @@ static inline void iommu_prepare_isa(void)
+@@ -2016,23 +2051,6 @@ static inline void iommu_prepare_isa(void)
  }
  #endif /* !CONFIG_DMAR_FLPY_WA */
  
@@ -299,16 +836,16 @@ index 2314ad7..09606e9 100644
  static int md_domain_init(struct dmar_domain *domain, int guest_width);
  
  static int __init si_domain_work_fn(unsigned long start_pfn,
-@@ -2047,7 +2038,7 @@ static int __init si_domain_work_fn(unsigned long start_pfn,
+@@ -2047,7 +2065,7 @@ static int __init si_domain_work_fn(unsigned long start_pfn,
  
  }
  
 -static int si_domain_init(void)
-+static int si_domain_init(int hw)
++static int __init si_domain_init(int hw)
  {
  	struct dmar_drhd_unit *drhd;
  	struct intel_iommu *iommu;
-@@ -2074,6 +2065,9 @@ static int si_domain_init(void)
+@@ -2074,6 +2092,9 @@ static int si_domain_init(void)
  
  	si_domain->flags = DOMAIN_FLAG_STATIC_IDENTITY;
  
@@ -318,7 +855,7 @@ index 2314ad7..09606e9 100644
  	for_each_online_node(nid) {
  		work_with_active_regions(nid, si_domain_work_fn, &ret);
  		if (ret)
-@@ -2100,15 +2094,23 @@ static int identity_mapping(struct pci_dev *pdev)
+@@ -2100,15 +2121,23 @@ static int identity_mapping(struct pci_dev *pdev)
  }
  
  static int domain_add_dev_info(struct dmar_domain *domain,
@@ -343,12 +880,29 @@ index 2314ad7..09606e9 100644
  	info->segment = pci_domain_nr(pdev->bus);
  	info->bus = pdev->bus->number;
  	info->devfn = pdev->devfn;
-@@ -2165,27 +2167,25 @@ static int iommu_should_identity_map(struct pci_dev *pdev, int startup)
+@@ -2126,8 +2155,14 @@ static int domain_add_dev_info(struct dmar_domain *domain,
+ 
+ static int iommu_should_identity_map(struct pci_dev *pdev, int startup)
+ {
+-	if (iommu_identity_mapping == 2)
+-		return IS_GFX_DEVICE(pdev);
++	if ((iommu_identity_mapping & IDENTMAP_AZALIA) && IS_AZALIA(pdev))
++		return 1;
++
++	if ((iommu_identity_mapping & IDENTMAP_GFX) && IS_GFX_DEVICE(pdev))
++		return 1;
++
++	if (!(iommu_identity_mapping & IDENTMAP_ALL))
++		return 0;
+ 
+ 	/*
+ 	 * We want to start off with all devices in the 1:1 domain, and
+@@ -2165,27 +2200,25 @@ static int iommu_should_identity_map(struct pci_dev *pdev, int startup)
  	return 1;
  }
  
 -static int iommu_prepare_static_identity_mapping(void)
-+static int iommu_prepare_static_identity_mapping(int hw)
++static int __init iommu_prepare_static_identity_mapping(int hw)
  {
  	struct pci_dev *pdev = NULL;
  	int ret;
@@ -377,7 +931,7 @@ index 2314ad7..09606e9 100644
  		}
  	}
  
-@@ -2199,14 +2199,6 @@ int __init init_dmars(void)
+@@ -2199,14 +2232,6 @@ int __init init_dmars(void)
  	struct pci_dev *pdev;
  	struct intel_iommu *iommu;
  	int i, ret;
@@ -392,7 +946,7 @@ index 2314ad7..09606e9 100644
  
  	/*
  	 * for each drhd
-@@ -2234,7 +2226,6 @@ int __init init_dmars(void)
+@@ -2234,7 +2259,6 @@ int __init init_dmars(void)
  	deferred_flush = kzalloc(g_num_of_iommus *
  		sizeof(struct deferred_flush_tables), GFP_KERNEL);
  	if (!deferred_flush) {
@@ -400,7 +954,7 @@ index 2314ad7..09606e9 100644
  		ret = -ENOMEM;
  		goto error;
  	}
-@@ -2261,14 +2252,8 @@ int __init init_dmars(void)
+@@ -2261,14 +2285,8 @@ int __init init_dmars(void)
  			goto error;
  		}
  		if (!ecap_pass_through(iommu->ecap))
@@ -416,16 +970,19 @@ index 2314ad7..09606e9 100644
  
  	/*
  	 * Start from the sane iommu hardware state.
-@@ -2323,64 +2308,57 @@ int __init init_dmars(void)
+@@ -2323,64 +2341,60 @@ int __init init_dmars(void)
  		}
  	}
  
 +	if (iommu_pass_through)
-+		iommu_identity_mapping = 1;
++		iommu_identity_mapping |= IDENTMAP_ALL;
++
 +#ifdef CONFIG_DMAR_BROKEN_GFX_WA
-+	else
-+		iommu_identity_mapping = 2;
++	iommu_identity_mapping |= IDENTMAP_GFX;
 +#endif
++
++	check_tylersburg_isoch();
++
  	/*
 -	 * If pass through is set and enabled, context entries of all pci
 -	 * devices are intialized by pass through translation type.
@@ -522,7 +1079,21 @@ index 2314ad7..09606e9 100644
  	/*
  	 * for each drhd
  	 *   enable fault log
-@@ -2454,8 +2432,7 @@ static struct iova *intel_alloc_iova(struct device *dev,
+@@ -2403,11 +2417,12 @@ int __init init_dmars(void)
+ 
+ 		iommu->flush.flush_context(iommu, 0, 0, 0, DMA_CCMD_GLOBAL_INVL);
+ 		iommu->flush.flush_iotlb(iommu, 0, 0, 0, DMA_TLB_GLOBAL_FLUSH);
+-		iommu_disable_protect_mem_regions(iommu);
+ 
+ 		ret = iommu_enable_translation(iommu);
+ 		if (ret)
+ 			goto error;
++
++		iommu_disable_protect_mem_regions(iommu);
+ 	}
+ 
+ 	return 0;
+@@ -2454,8 +2469,7 @@ static struct iova *intel_alloc_iova(struct device *dev,
  	return iova;
  }
  
@@ -532,7 +1103,7 @@ index 2314ad7..09606e9 100644
  {
  	struct dmar_domain *domain;
  	int ret;
-@@ -2483,6 +2460,18 @@ get_valid_domain_for_dev(struct pci_dev *pdev)
+@@ -2483,6 +2497,18 @@ get_valid_domain_for_dev(struct pci_dev *pdev)
  	return domain;
  }
  
@@ -551,7 +1122,7 @@ index 2314ad7..09606e9 100644
  static int iommu_dummy(struct pci_dev *pdev)
  {
  	return pdev->dev.archdata.iommu == DUMMY_DEVICE_DOMAIN_INFO;
-@@ -2525,10 +2514,10 @@ static int iommu_no_mapping(struct device *dev)
+@@ -2525,10 +2551,10 @@ static int iommu_no_mapping(struct device *dev)
  		 */
  		if (iommu_should_identity_map(pdev, 0)) {
  			int ret;
@@ -566,7 +1137,20 @@ index 2314ad7..09606e9 100644
  			if (!ret) {
  				printk(KERN_INFO "64bit %s uses identity mapping\n",
  				       pci_name(pdev));
-@@ -2733,12 +2722,6 @@ static void intel_unmap_page(struct device *dev, dma_addr_t dev_addr,
+@@ -2637,10 +2663,9 @@ static void flush_unmaps(void)
+ 			unsigned long mask;
+ 			struct iova *iova = deferred_flush[i].iova[j];
+ 
+-			mask = (iova->pfn_hi - iova->pfn_lo + 1) << PAGE_SHIFT;
+-			mask = ilog2(mask >> VTD_PAGE_SHIFT);
++			mask = ilog2(mm_to_dma_pfn(iova->pfn_hi - iova->pfn_lo + 1));
+ 			iommu_flush_dev_iotlb(deferred_flush[i].domain[j],
+-					iova->pfn_lo << PAGE_SHIFT, mask);
++					(uint64_t)iova->pfn_lo << PAGE_SHIFT, mask);
+ 			__free_iova(&deferred_flush[i].domain[j]->iovad, iova);
+ 		}
+ 		deferred_flush[i].next = 0;
+@@ -2733,12 +2758,6 @@ static void intel_unmap_page(struct device *dev, dma_addr_t dev_addr,
  	}
  }
  
@@ -579,7 +1163,7 @@ index 2314ad7..09606e9 100644
  static void *intel_alloc_coherent(struct device *hwdev, size_t size,
  				  dma_addr_t *dma_handle, gfp_t flags)
  {
-@@ -2771,7 +2754,7 @@ static void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr,
+@@ -2771,7 +2790,7 @@ static void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr,
  	size = PAGE_ALIGN(size);
  	order = get_order(size);
  
@@ -588,7 +1172,7 @@ index 2314ad7..09606e9 100644
  	free_pages((unsigned long)vaddr, order);
  }
  
-@@ -2807,11 +2790,18 @@ static void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist,
+@@ -2807,11 +2826,18 @@ static void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist,
  	/* free page tables */
  	dma_pte_free_pagetable(domain, start_pfn, last_pfn);
  
@@ -612,7 +1196,17 @@ index 2314ad7..09606e9 100644
  }
  
  static int intel_nontranslate_map_sg(struct device *hddev,
-@@ -3194,7 +3184,7 @@ int __init intel_iommu_init(void)
+@@ -3055,8 +3081,8 @@ static int init_iommu_hw(void)
+ 					   DMA_CCMD_GLOBAL_INVL);
+ 		iommu->flush.flush_iotlb(iommu, 0, 0, 0,
+ 					 DMA_TLB_GLOBAL_FLUSH);
+-		iommu_disable_protect_mem_regions(iommu);
+ 		iommu_enable_translation(iommu);
++		iommu_disable_protect_mem_regions(iommu);
+ 	}
+ 
+ 	return 0;
+@@ -3194,7 +3220,7 @@ int __init intel_iommu_init(void)
  	 * Check the need for DMA-remapping initialization now.
  	 * Above initialization will also be used by Interrupt-remapping.
  	 */
@@ -621,7 +1215,7 @@ index 2314ad7..09606e9 100644
  		return -ENODEV;
  
  	iommu_init_mempool();
-@@ -3214,14 +3204,7 @@ int __init intel_iommu_init(void)
+@@ -3214,14 +3240,7 @@ int __init intel_iommu_init(void)
  
  	init_timer(&unmap_timer);
  	force_iommu = 1;
@@ -637,7 +1231,7 @@ index 2314ad7..09606e9 100644
  
  	init_iommu_sysfs();
  
-@@ -3504,7 +3487,6 @@ static int intel_iommu_attach_device(struct iommu_domain *domain,
+@@ -3504,7 +3523,6 @@ static int intel_iommu_attach_device(struct iommu_domain *domain,
  	struct intel_iommu *iommu;
  	int addr_width;
  	u64 end;
@@ -645,7 +1239,7 @@ index 2314ad7..09606e9 100644
  
  	/* normally pdev is not mapped */
  	if (unlikely(domain_context_mapped(pdev))) {
-@@ -3536,12 +3518,7 @@ static int intel_iommu_attach_device(struct iommu_domain *domain,
+@@ -3536,12 +3554,7 @@ static int intel_iommu_attach_device(struct iommu_domain *domain,
  		return -EFAULT;
  	}
  
@@ -659,6 +1253,94 @@ index 2314ad7..09606e9 100644
  }
  
  static void intel_iommu_detach_device(struct iommu_domain *domain,
+@@ -3658,3 +3671,61 @@ static void __devinit quirk_iommu_rwbf(struct pci_dev *dev)
+ }
+ 
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_rwbf);
++
++/* On Tylersburg chipsets, some BIOSes have been known to enable the
++   ISOCH DMAR unit for the Azalia sound device, but not give it any
++   TLB entries, which causes it to deadlock. Check for that.  We do
++   this in a function called from init_dmars(), instead of in a PCI
++   quirk, because we don't want to print the obnoxious "BIOS broken"
++   message if VT-d is actually disabled.
++*/
++static void __init check_tylersburg_isoch(void)
++{
++	struct pci_dev *pdev;
++	uint32_t vtisochctrl;
++
++	/* If there's no Azalia in the system anyway, forget it. */
++	pdev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x3a3e, NULL);
++	if (!pdev)
++		return;
++	pci_dev_put(pdev);
++
++	/* System Management Registers. Might be hidden, in which case
++	   we can't do the sanity check. But that's OK, because the
++	   known-broken BIOSes _don't_ actually hide it, so far. */
++	pdev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x342e, NULL);
++	if (!pdev)
++		return;
++
++	if (pci_read_config_dword(pdev, 0x188, &vtisochctrl)) {
++		pci_dev_put(pdev);
++		return;
++	}
++
++	pci_dev_put(pdev);
++
++	/* If Azalia DMA is routed to the non-isoch DMAR unit, fine. */
++	if (vtisochctrl & 1)
++		return;
++
++	/* Drop all bits other than the number of TLB entries */
++	vtisochctrl &= 0x1c;
++
++	/* If we have the recommended number of TLB entries (16), fine. */
++	if (vtisochctrl == 0x10)
++		return;
++
++	/* Zero TLB entries? You get to ride the short bus to school. */
++	if (!vtisochctrl) {
++		WARN(1, "Your BIOS is broken; DMA routed to ISOCH DMAR unit but no TLB space.\n"
++		     "BIOS vendor: %s; Ver: %s; Product Version: %s\n",
++		     dmi_get_system_info(DMI_BIOS_VENDOR),
++		     dmi_get_system_info(DMI_BIOS_VERSION),
++		     dmi_get_system_info(DMI_PRODUCT_VERSION));
++		iommu_identity_mapping |= IDENTMAP_AZALIA;
++		return;
++	}
++	
++	printk(KERN_WARNING "DMAR: Recommended TLB entries for ISOCH unit is 16; your BIOS set %d\n",
++	       vtisochctrl);
++}
+diff --git a/drivers/pci/intr_remapping.c b/drivers/pci/intr_remapping.c
+index 4f5b871..ac06514 100644
+--- a/drivers/pci/intr_remapping.c
++++ b/drivers/pci/intr_remapping.c
+@@ -611,6 +611,9 @@ int __init intr_remapping_supported(void)
+ 	if (disable_intremap)
+ 		return 0;
+ 
++	if (!dmar_ir_support())
++		return 0;
++
+ 	for_each_drhd_unit(drhd) {
+ 		struct intel_iommu *iommu = drhd->iommu;
+ 
+@@ -626,6 +629,11 @@ int __init enable_intr_remapping(int eim)
+ 	struct dmar_drhd_unit *drhd;
+ 	int setup = 0;
+ 
++	if (parse_ioapics_under_ir() != 1) {
++		printk(KERN_INFO "Not enable interrupt remapping\n");
++		return -1;
++	}
++
+ 	for_each_drhd_unit(drhd) {
+ 		struct intel_iommu *iommu = drhd->iommu;
+ 
 diff --git a/drivers/pci/iova.c b/drivers/pci/iova.c
 index 46dd440..7914951 100644
 --- a/drivers/pci/iova.c
@@ -729,6 +1411,17 @@ index 46dd440..7914951 100644
 -	spin_unlock_irqrestore(&from->iova_alloc_lock, flags);
 +	spin_unlock_irqrestore(&from->iova_rbtree_lock, flags);
  }
+diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
+index 482dc91..4f0a72a 100644
+--- a/include/linux/intel-iommu.h
++++ b/include/linux/intel-iommu.h
+@@ -360,4 +360,6 @@ extern void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 qdep,
+ 
+ extern int qi_submit_sync(struct qi_desc *desc, struct intel_iommu *iommu);
+ 
++extern int dmar_ir_support(void);
++
+ #endif
 diff --git a/include/linux/iova.h b/include/linux/iova.h
 index 228f6c9..76a0759 100644
 --- a/include/linux/iova.h

linux-2.6-nfsd4-proots.patch:
 fs/nfsd/export.c            |   12 +++++-
 fs/nfsd/nfs4xdr.c           |   83 ++++++++++++++++++++++++++++++++++++--------
 fs/nfsd/nfsfh.c             |   32 ++++++++++++++++
 fs/nfsd/vfs.c               |   77 ++++++++++++++++++++++++++++++++++++++--
 include/linux/nfsd/export.h |    3 +
 include/linux/nfsd/nfsd.h   |    2 +
 6 files changed, 189 insertions(+), 20 deletions(-)

Index: linux-2.6-nfsd4-proots.patch
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/linux-2.6-nfsd4-proots.patch,v
retrieving revision 1.1.2.3
retrieving revision 1.1.2.4
diff -u -p -r1.1.2.3 -r1.1.2.4
--- linux-2.6-nfsd4-proots.patch	10 Sep 2009 14:00:29 -0000	1.1.2.3
+++ linux-2.6-nfsd4-proots.patch	10 Oct 2009 15:04:15 -0000	1.1.2.4
@@ -1,6 +1,6 @@
-diff -up linux-2.6.30.noarch/fs/nfsd/export.c.save linux-2.6.30.noarch/fs/nfsd/export.c
---- linux-2.6.30.noarch/fs/nfsd/export.c.save	2009-09-09 15:11:54.702436000 -0400
-+++ linux-2.6.30.noarch/fs/nfsd/export.c	2009-09-09 15:12:44.520167000 -0400
+diff -up linux-2.6.31.noarch/fs/nfsd/export.c.orig linux-2.6.31.noarch/fs/nfsd/export.c
+--- linux-2.6.31.noarch/fs/nfsd/export.c.orig	2009-09-09 18:13:59.000000000 -0400
++++ linux-2.6.31.noarch/fs/nfsd/export.c	2009-09-29 11:29:40.000000000 -0400
 @@ -104,6 +104,7 @@ static int expkey_parse(struct cache_det
  	if (mesg[mlen-1] != '\n')
  		return -EINVAL;
@@ -63,9 +63,9 @@ diff -up linux-2.6.30.noarch/fs/nfsd/exp
  		seq_puts(m, "# Path Client(Flags) # IPs\n");
  		return 0;
  	}
-diff -up linux-2.6.30.noarch/fs/nfsd/nfs4xdr.c.save linux-2.6.30.noarch/fs/nfsd/nfs4xdr.c
---- linux-2.6.30.noarch/fs/nfsd/nfs4xdr.c.save	2009-09-09 15:11:54.707433000 -0400
-+++ linux-2.6.30.noarch/fs/nfsd/nfs4xdr.c	2009-09-09 15:12:36.408695000 -0400
+diff -up linux-2.6.31.noarch/fs/nfsd/nfs4xdr.c.orig linux-2.6.31.noarch/fs/nfsd/nfs4xdr.c
+--- linux-2.6.31.noarch/fs/nfsd/nfs4xdr.c.orig	2009-09-09 18:13:59.000000000 -0400
++++ linux-2.6.31.noarch/fs/nfsd/nfs4xdr.c	2009-09-29 11:29:40.000000000 -0400
 @@ -2176,28 +2176,61 @@ static inline int attributes_need_mount(
  	return 0;
  }
@@ -191,9 +191,9 @@ diff -up linux-2.6.30.noarch/fs/nfsd/nfs
  	switch (nfserr) {
  	case nfs_ok:
  		p += buflen;
-diff -up linux-2.6.30.noarch/fs/nfsd/nfsfh.c.save linux-2.6.30.noarch/fs/nfsd/nfsfh.c
---- linux-2.6.30.noarch/fs/nfsd/nfsfh.c.save	2009-09-09 15:11:54.711427000 -0400
-+++ linux-2.6.30.noarch/fs/nfsd/nfsfh.c	2009-09-09 15:12:48.357903000 -0400
+diff -up linux-2.6.31.noarch/fs/nfsd/nfsfh.c.orig linux-2.6.31.noarch/fs/nfsd/nfsfh.c
+--- linux-2.6.31.noarch/fs/nfsd/nfsfh.c.orig	2009-09-09 18:13:59.000000000 -0400
++++ linux-2.6.31.noarch/fs/nfsd/nfsfh.c	2009-09-29 11:29:40.000000000 -0400
 @@ -109,6 +109,30 @@ static __be32 nfsd_setuser_and_check_por
  	return nfserrno(nfsd_setuser(rqstp, exp));
  }
@@ -240,9 +240,9 @@ diff -up linux-2.6.30.noarch/fs/nfsd/nfs
  	}
  
  	error = nfsd_mode_check(rqstp, dentry->d_inode->i_mode, type);
-diff -up linux-2.6.30.noarch/fs/nfsd/vfs.c.save linux-2.6.30.noarch/fs/nfsd/vfs.c
---- linux-2.6.30.noarch/fs/nfsd/vfs.c.save	2009-09-09 15:11:54.715423000 -0400
-+++ linux-2.6.30.noarch/fs/nfsd/vfs.c	2009-09-09 15:12:39.978431000 -0400
+diff -up linux-2.6.31.noarch/fs/nfsd/vfs.c.orig linux-2.6.31.noarch/fs/nfsd/vfs.c
+--- linux-2.6.31.noarch/fs/nfsd/vfs.c.orig	2009-09-09 18:13:59.000000000 -0400
++++ linux-2.6.31.noarch/fs/nfsd/vfs.c	2009-09-29 11:31:06.000000000 -0400
 @@ -89,6 +89,12 @@ struct raparm_hbucket {
  #define RAPARM_HASH_MASK	(RAPARM_HASH_SIZE-1)
  static struct raparm_hbucket	raparm_hash[RAPARM_HASH_SIZE];
@@ -339,6 +339,15 @@ diff -up linux-2.6.30.noarch/fs/nfsd/vfs
  
  	/* Lookup the name, but don't follow links */
  	if (isdotent(name, len)) {
+@@ -162,7 +219,7 @@ nfsd_lookup_dentry(struct svc_rqst *rqst
+ 			dentry = dget(dparent);
+ 		else if (dparent != exp->ex_path.dentry)
+ 			dentry = dget_parent(dparent);
+-		else if (!EX_NOHIDE(exp))
++		else if (!EX_NOHIDE(exp) && !nfsd_v4client(rqstp))
+ 			dentry = dget(dparent); /* .. == . just like at / */
+ 		else {
+ 			/* checking mountpoint crossing is very different when stepping up */
 @@ -199,9 +256,21 @@ nfsd_lookup_dentry(struct svc_rqst *rqst
  		if (IS_ERR(dentry))
  			goto out_nfserr;
@@ -362,9 +371,9 @@ diff -up linux-2.6.30.noarch/fs/nfsd/vfs
  			if ((host_err = nfsd_cross_mnt(rqstp, &dentry, &exp))) {
  				dput(dentry);
  				goto out_nfserr;
-diff -up linux-2.6.30.noarch/include/linux/nfsd/export.h.save linux-2.6.30.noarch/include/linux/nfsd/export.h
---- linux-2.6.30.noarch/include/linux/nfsd/export.h.save	2009-09-09 15:11:54.719419000 -0400
-+++ linux-2.6.30.noarch/include/linux/nfsd/export.h	2009-09-09 15:12:29.064157000 -0400
+diff -up linux-2.6.31.noarch/include/linux/nfsd/export.h.orig linux-2.6.31.noarch/include/linux/nfsd/export.h
+--- linux-2.6.31.noarch/include/linux/nfsd/export.h.orig	2009-09-09 18:13:59.000000000 -0400
++++ linux-2.6.31.noarch/include/linux/nfsd/export.h	2009-09-29 11:29:40.000000000 -0400
 @@ -39,7 +39,8 @@
  #define NFSEXP_FSID		0x2000
  #define	NFSEXP_CROSSMOUNT	0x4000
@@ -375,9 +384,9 @@ diff -up linux-2.6.30.noarch/include/lin
  
  /* The flags that may vary depending on security flavor: */
  #define NFSEXP_SECINFO_FLAGS	(NFSEXP_READONLY | NFSEXP_ROOTSQUASH \
-diff -up linux-2.6.30.noarch/include/linux/nfsd/nfsd.h.save linux-2.6.30.noarch/include/linux/nfsd/nfsd.h
---- linux-2.6.30.noarch/include/linux/nfsd/nfsd.h.save	2009-09-09 15:11:54.723415000 -0400
-+++ linux-2.6.30.noarch/include/linux/nfsd/nfsd.h	2009-09-09 15:12:33.025896000 -0400
+diff -up linux-2.6.31.noarch/include/linux/nfsd/nfsd.h.orig linux-2.6.31.noarch/include/linux/nfsd/nfsd.h
+--- linux-2.6.31.noarch/include/linux/nfsd/nfsd.h.orig	2009-09-09 18:13:59.000000000 -0400
++++ linux-2.6.31.noarch/include/linux/nfsd/nfsd.h	2009-09-29 11:29:40.000000000 -0400
 @@ -76,6 +76,8 @@ int		nfsd_racache_init(int);
  void		nfsd_racache_shutdown(void);
  int		nfsd_cross_mnt(struct svc_rqst *rqstp, struct dentry **dpp,


Index: sources
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/sources,v
retrieving revision 1.976.2.32
retrieving revision 1.976.2.33
diff -u -p -r1.976.2.32 -r1.976.2.33
--- sources	24 Sep 2009 21:05:14 -0000	1.976.2.32
+++ sources	10 Oct 2009 15:04:17 -0000	1.976.2.33
@@ -1,2 +1,2 @@
 84c077a37684e4cbfa67b18154390d8a  linux-2.6.31.tar.bz2
-43977a0a264dd7d173b6ef122c62fb20  patch-2.6.31.1.bz2
+24d60ad6645211e2c08dc1c1c578b249  patch-2.6.31.3.bz2


Index: upstream
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/upstream,v
retrieving revision 1.888.2.31
retrieving revision 1.888.2.32
diff -u -p -r1.888.2.31 -r1.888.2.32
--- upstream	24 Sep 2009 21:05:14 -0000	1.888.2.31
+++ upstream	10 Oct 2009 15:04:17 -0000	1.888.2.32
@@ -1,2 +1,2 @@
 linux-2.6.31.tar.bz2
-patch-2.6.31.1.bz2
+patch-2.6.31.3.bz2

xen.pvops.patch:
 arch/x86/Kconfig                           |   14 
 arch/x86/Makefile                          |    2 
 arch/x86/include/asm/agp.h                 |   17 
 arch/x86/include/asm/e820.h                |    2 
 arch/x86/include/asm/fixmap.h              |   25 
 arch/x86/include/asm/i387.h                |    1 
 arch/x86/include/asm/io.h                  |   15 
 arch/x86/include/asm/io_apic.h             |    7 
 arch/x86/include/asm/microcode.h           |    9 
 arch/x86/include/asm/paravirt.h            |  746 -------------
 arch/x86/include/asm/paravirt_types.h      |  724 ++++++++++++
 arch/x86/include/asm/pci.h                 |    8 
 arch/x86/include/asm/pci_x86.h             |    2 
 arch/x86/include/asm/pgtable.h             |    3 
 arch/x86/include/asm/processor.h           |    4 
 arch/x86/include/asm/pvclock.h             |    6 
 arch/x86/include/asm/syscalls.h            |    8 
 arch/x86/include/asm/tlbflush.h            |    6 
 arch/x86/include/asm/vsyscall.h            |    3 
 arch/x86/include/asm/xen/hypercall.h       |   44 
 arch/x86/include/asm/xen/interface.h       |    8 
 arch/x86/include/asm/xen/interface_32.h    |    5 
 arch/x86/include/asm/xen/interface_64.h    |   13 
 arch/x86/include/asm/xen/iommu.h           |   12 
 arch/x86/include/asm/xen/page.h            |   16 
 arch/x86/include/asm/xen/pci.h             |   37 
 arch/x86/include/asm/xen/swiotlb.h         |   10 
 arch/x86/kernel/Makefile                   |    6 
 arch/x86/kernel/acpi/boot.c                |   18 
 arch/x86/kernel/acpi/processor.c           |    4 
 arch/x86/kernel/acpi/sleep.c               |    2 
 arch/x86/kernel/apic/io_apic.c             |   49 
 arch/x86/kernel/cpu/mtrr/Makefile          |    1 
 arch/x86/kernel/cpu/mtrr/amd.c             |    6 
 arch/x86/kernel/cpu/mtrr/centaur.c         |    6 
 arch/x86/kernel/cpu/mtrr/cyrix.c           |    6 
 arch/x86/kernel/cpu/mtrr/generic.c         |   10 
 arch/x86/kernel/cpu/mtrr/main.c            |   19 
 arch/x86/kernel/cpu/mtrr/mtrr.h            |   11 
 arch/x86/kernel/cpu/mtrr/xen.c             |  104 +
 arch/x86/kernel/e820.c                     |   30 
 arch/x86/kernel/hpet.c                     |    2 
 arch/x86/kernel/ioport.c                   |   40 
 arch/x86/kernel/microcode_core.c           |    5 
 arch/x86/kernel/microcode_xen.c            |  200 +++
 arch/x86/kernel/paravirt.c                 |    1 
 arch/x86/kernel/pci-dma.c                  |    6 
 arch/x86/kernel/pci-swiotlb.c              |   25 
 arch/x86/kernel/process.c                  |   27 
 arch/x86/kernel/process_32.c               |   27 
 arch/x86/kernel/process_64.c               |   33 
 arch/x86/kernel/pvclock.c                  |  180 ++-
 arch/x86/kernel/setup.c                    |    4 
 arch/x86/kernel/traps.c                    |   33 
 arch/x86/kernel/tsc.c                      |    2 
 arch/x86/mm/Makefile                       |    7 
 arch/x86/mm/init_32.c                      |   42 
 arch/x86/mm/ioremap.c                      |   72 -
 arch/x86/mm/pat.c                          |    2 
 arch/x86/mm/pgtable.c                      |   10 
 arch/x86/mm/physaddr.c                     |   70 +
 arch/x86/mm/physaddr.h                     |   10 
 arch/x86/mm/tlb.c                          |   35 
 arch/x86/pci/Makefile                      |    1 
 arch/x86/pci/common.c                      |   18 
 arch/x86/pci/i386.c                        |    3 
 arch/x86/pci/init.c                        |    6 
 arch/x86/pci/xen.c                         |   51 
 arch/x86/xen/Kconfig                       |   38 
 arch/x86/xen/Makefile                      |    5 
 arch/x86/xen/apic.c                        |   57 +
 arch/x86/xen/enlighten.c                   |   85 +
 arch/x86/xen/mmu.c                         |  460 ++++++++
 arch/x86/xen/pci-swiotlb.c                 |  997 +++++++++++++++++
 arch/x86/xen/pci.c                         |  111 +
 arch/x86/xen/setup.c                       |  108 +
 arch/x86/xen/smp.c                         |    4 
 arch/x86/xen/time.c                        |   56 
 arch/x86/xen/vga.c                         |   67 +
 arch/x86/xen/xen-ops.h                     |   27 
 block/blk-core.c                           |    2 
 drivers/acpi/acpica/hwsleep.c              |   17 
 drivers/acpi/processor_core.c              |   29 
 drivers/acpi/processor_idle.c              |   23 
 drivers/acpi/processor_perflib.c           |   10 
 drivers/acpi/sleep.c                       |   19 
 drivers/block/Kconfig                      |    1 
 drivers/char/agp/intel-agp.c               |   17 
 drivers/char/hvc_xen.c                     |   99 +
 drivers/gpu/drm/drm_drv.c                  |    2 
 drivers/gpu/drm/drm_gem.c                  |    2 
 drivers/gpu/drm/drm_scatter.c              |   67 +
 drivers/gpu/drm/ttm/ttm_bo_vm.c            |    2 
 drivers/net/Kconfig                        |    1 
 drivers/pci/Makefile                       |    2 
 drivers/pci/msi.c                          |    5 
 drivers/pci/xen-iommu.c                    |  271 ++++
 drivers/xen/Kconfig                        |   48 
 drivers/xen/Makefile                       |   21 
 drivers/xen/acpi.c                         |   23 
 drivers/xen/acpi_processor.c               |  451 ++++++++
 drivers/xen/balloon.c                      |  161 ++
 drivers/xen/biomerge.c                     |   14 
 drivers/xen/blkback/Makefile               |    3 
 drivers/xen/blkback/blkback.c              |  665 +++++++++++
 drivers/xen/blkback/common.h               |  137 ++
 drivers/xen/blkback/interface.c            |  186 +++
 drivers/xen/blkback/vbd.c                  |  118 ++
 drivers/xen/blkback/xenbus.c               |  541 +++++++++
 drivers/xen/events.c                       |  422 +++++++
 drivers/xen/evtchn.c                       |   82 +
 drivers/xen/features.c                     |    2 
 drivers/xen/gntdev.c                       |  625 +++++++++++
 drivers/xen/grant-table.c                  |  103 +
 drivers/xen/mce.c                          |  213 +++
 drivers/xen/netback/Makefile               |    3 
 drivers/xen/netback/common.h               |  223 +++
 drivers/xen/netback/interface.c            |  401 +++++++
 drivers/xen/netback/netback.c              | 1634 +++++++++++++++++++++++++++++
 drivers/xen/netback/xenbus.c               |  470 ++++++++
 drivers/xen/pci.c                          |  124 ++
 drivers/xen/xenbus/Makefile                |    5 
 drivers/xen/xenbus/xenbus_comms.c          |    1 
 drivers/xen/xenbus/xenbus_probe.c          |  380 +-----
 drivers/xen/xenbus/xenbus_probe.h          |   29 
 drivers/xen/xenbus/xenbus_probe_backend.c  |  298 +++++
 drivers/xen/xenbus/xenbus_probe_frontend.c |  292 +++++
 drivers/xen/xenfs/Makefile                 |    3 
 drivers/xen/xenfs/privcmd.c                |  403 +++++++
 drivers/xen/xenfs/super.c                  |   98 +
 drivers/xen/xenfs/xenfs.h                  |    3 
 drivers/xen/xenfs/xenstored.c              |   67 +
 include/acpi/processor.h                   |    2 
 include/asm-generic/pci.h                  |    2 
 include/drm/drmP.h                         |    2 
 include/linux/interrupt.h                  |    1 
 include/linux/page-flags.h                 |   18 
 include/linux/sched.h                      |    7 
 include/linux/swiotlb.h                    |    1 
 include/xen/Kbuild                         |    1 
 include/xen/acpi.h                         |   84 +
 include/xen/balloon.h                      |    8 
 include/xen/blkif.h                        |  122 ++
 include/xen/events.h                       |   27 
 include/xen/gntdev.h                       |  119 ++
 include/xen/grant_table.h                  |   43 
 include/xen/interface/grant_table.h        |   22 
 include/xen/interface/io/ring.h            |    3 
 include/xen/interface/memory.h             |   92 +
 include/xen/interface/physdev.h            |   51 
 include/xen/interface/platform.h           |  336 +++++
 include/xen/interface/vcpu.h               |   41 
 include/xen/interface/xen-mca.h            |  429 +++++++
 include/xen/interface/xen.h                |   44 
 include/xen/privcmd.h                      |   80 +
 include/xen/swiotlb.h                      |  102 +
 include/xen/xen-ops.h                      |   11 
 include/xen/xenbus.h                       |    2 
 kernel/irq/manage.c                        |    3 
 kernel/sched.c                             |   15 
 lib/swiotlb.c                              |    5 
 mm/page_alloc.c                            |   14 
 162 files changed, 13954 insertions(+), 1497 deletions(-)

View full diff with command:
/usr/bin/cvs -n -f diff -kk -u -p -N -r 1.1.2.44 -r 1.1.2.45 xen.pvops.patchIndex: xen.pvops.patch
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/Attic/xen.pvops.patch,v
retrieving revision 1.1.2.44
retrieving revision 1.1.2.45
diff -u -p -r1.1.2.44 -r1.1.2.45
--- xen.pvops.patch	24 Sep 2009 21:05:14 -0000	1.1.2.44
+++ xen.pvops.patch	10 Oct 2009 15:04:17 -0000	1.1.2.45
@@ -1,8 +1,39 @@
 diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index 13ffa5d..ae6617b 100644
+index 13ffa5d..a0cd847 100644
 --- a/arch/x86/Kconfig
 +++ b/arch/x86/Kconfig
-@@ -1884,6 +1884,10 @@ config PCI_OLPC
+@@ -136,7 +136,7 @@ config GENERIC_CALIBRATE_DELAY
+ 
+ config GENERIC_TIME_VSYSCALL
+ 	bool
+-	default X86_64
++	default X86_VSYSCALL
+ 
+ config ARCH_HAS_CPU_RELAX
+ 	def_bool y
+@@ -222,6 +222,10 @@ config X86_32_LAZY_GS
+ 	def_bool y
+ 	depends on X86_32 && !CC_STACKPROTECTOR
+ 
++config X86_VSYSCALL
++       def_bool y
++       depends on X86_64
++
+ config KTIME_SCALAR
+ 	def_bool X86_32
+ source "init/Kconfig"
+@@ -518,6 +522,10 @@ config PARAVIRT_CLOCK
+ 	bool
+ 	default n
+ 
++config PARAVIRT_CLOCK_VSYSCALL
++       bool
++       depends on PARAVIRT_CLOCK && X86_VSYSCALL
++
+ endif
+ 
+ config PARAVIRT_DEBUG
+@@ -1884,6 +1892,10 @@ config PCI_OLPC
  	def_bool y
  	depends on PCI && OLPC && (PCI_GOOLPC || PCI_GOANY)
  
@@ -27,21 +58,25 @@ index 1b68659..5e7db44 100644
                  stackp-$(CONFIG_CC_STACKPROTECTOR_ALL) += -fstack-protector-all
                  KBUILD_CFLAGS += $(stackp-y)
 diff --git a/arch/x86/include/asm/agp.h b/arch/x86/include/asm/agp.h
-index 9825cd6..8107b71 100644
+index 9825cd6..0717c5e 100644
 --- a/arch/x86/include/asm/agp.h
 +++ b/arch/x86/include/asm/agp.h
-@@ -3,6 +3,10 @@
+@@ -1,9 +1,14 @@
+ #ifndef _ASM_X86_AGP_H
+ #define _ASM_X86_AGP_H
  
++#include <linux/dma-mapping.h>
++
  #include <asm/pgtable.h>
  #include <asm/cacheflush.h>
-+#include <asm/dma-mapping.h>
-+
+ 
 +#include <asm/xen/hypervisor.h>
 +#include <asm/xen/page.h>
- 
++
  /*
   * Functions to keep the agpgart mappings coherent with the MMU. The
-@@ -23,13 +27,15 @@
+  * GART gives the CPU a physical alias of pages in memory. The alias
+@@ -23,13 +28,15 @@
  #define flush_agp_cache() wbinvd()
  
  /* Convert a physical address to an address suitable for the GART. */
@@ -75,6 +110,53 @@ index 7ecba4d..df06646 100644
  extern u64 early_reserve_e820(u64 startt, u64 sizet, u64 align);
  
  extern unsigned long e820_end_of_ram_pfn(void);
+diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h
+index 7b2d71d..026ee10 100644
+--- a/arch/x86/include/asm/fixmap.h
++++ b/arch/x86/include/asm/fixmap.h
+@@ -74,11 +74,16 @@ enum fixed_addresses {
+ #ifdef CONFIG_X86_32
+ 	FIX_HOLE,
+ 	FIX_VDSO,
+-#else
++#endif
++
++#ifdef CONFIG_X86_VSYSCALL
+ 	VSYSCALL_LAST_PAGE,
+ 	VSYSCALL_FIRST_PAGE = VSYSCALL_LAST_PAGE
+ 			    + ((VSYSCALL_END-VSYSCALL_START) >> PAGE_SHIFT) - 1,
+ 	VSYSCALL_HPET,
++#endif	/* CONFIG_X86_VSYSCALL */
++#ifdef CONFIG_PARAVIRT_CLOCK_VSYSCALL
++	FIX_PVCLOCK_TIME_INFO,
+ #endif
+ 	FIX_DBGP_BASE,
+ 	FIX_EARLYCON_MEM_BASE,
+@@ -178,6 +183,24 @@ static inline void __set_fixmap(enum fixed_addresses idx,
+ 
+ extern void __this_fixmap_does_not_exist(void);
+ 
++static inline bool user_fixmap(enum fixed_addresses fixmap)
++{
++	switch (fixmap) {
++#ifdef CONFIG_X86_32
++	case FIX_HOLE ... FIX_VDSO:
++#else
++	case VSYSCALL_LAST_PAGE ... VSYSCALL_HPET:
++#ifdef CONFIG_PARAVIRT_CLOCK_VSYSCALL
++	case FIX_PVCLOCK_TIME_INFO:
++#endif
++#endif
++		return true;
++
++	default:
++		return false;
++	}
++}
++
+ /*
+  * 'index to address' translation. If anyone tries to use the idx
+  * directly without translation, we catch the bug with a NULL-deference
 diff --git a/arch/x86/include/asm/i387.h b/arch/x86/include/asm/i387.h
 index 175adf5..2e75292 100644
 --- a/arch/x86/include/asm/i387.h
@@ -162,7 +244,7 @@ index ef51b50..e15fca1 100644
 +
  #endif /* _ASM_X86_MICROCODE_H */
 diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
-index 4fb37c8..e19ffe3 100644
+index 4fb37c8..e8420a2 100644
 --- a/arch/x86/include/asm/paravirt.h
 +++ b/arch/x86/include/asm/paravirt.h
 @@ -7,689 +7,11 @@
@@ -927,12 +1009,59 @@ index 4fb37c8..e19ffe3 100644
  #ifdef CONFIG_X86_32
  #define PV_SAVE_REGS "pushl %ecx; pushl %edx;"
  #define PV_RESTORE_REGS "popl %edx; popl %ecx;"
+@@ -1565,42 +863,22 @@ extern struct paravirt_patch_site __parainstructions[],
+ 
+ static inline unsigned long __raw_local_save_flags(void)
+ {
+-	unsigned long f;
+-
+-	asm volatile(paravirt_alt(PARAVIRT_CALL)
+-		     : "=a"(f)
+-		     : paravirt_type(pv_irq_ops.save_fl),
+-		       paravirt_clobber(CLBR_EAX)
+-		     : "memory", "cc");
+-	return f;
++	return PVOP_CALLEE0(unsigned long, pv_irq_ops.save_fl);
+ }
+ 
+ static inline void raw_local_irq_restore(unsigned long f)
+ {
+-	asm volatile(paravirt_alt(PARAVIRT_CALL)
+-		     : "=a"(f)
+-		     : PV_FLAGS_ARG(f),
+-		       paravirt_type(pv_irq_ops.restore_fl),
+-		       paravirt_clobber(CLBR_EAX)
+-		     : "memory", "cc");
++	PVOP_VCALLEE1(pv_irq_ops.restore_fl, f);
+ }
+ 
+ static inline void raw_local_irq_disable(void)
+ {
+-	asm volatile(paravirt_alt(PARAVIRT_CALL)
+-		     :
+-		     : paravirt_type(pv_irq_ops.irq_disable),
+-		       paravirt_clobber(CLBR_EAX)
+-		     : "memory", "eax", "cc");
++	PVOP_VCALLEE0(pv_irq_ops.irq_disable);
+ }
+ 
+ static inline void raw_local_irq_enable(void)
+ {
+-	asm volatile(paravirt_alt(PARAVIRT_CALL)
+-		     :
+-		     : paravirt_type(pv_irq_ops.irq_enable),
+-		       paravirt_clobber(CLBR_EAX)
+-		     : "memory", "eax", "cc");
++	PVOP_VCALLEE0(pv_irq_ops.irq_enable);
+ }
+ 
+ static inline unsigned long __raw_local_irq_save(void)
 diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
 new file mode 100644
-index 0000000..b9bb5e8
+index 0000000..973867d
[...2693 lines suppressed...]
++	uint64_t index;
++	/* Variable IN parameter. */
++	/* Array of grant references, of size @count. */
++	struct ioctl_gntdev_grant_ref refs[1];
++};
++
++/*
++ * Removes the grant references from the mapping table of an instance of
++ * of gntdev. N.B. munmap() must be called on the relevant virtual address(es)
++ * before this ioctl is called, or an error will result.
++ */
++#define IOCTL_GNTDEV_UNMAP_GRANT_REF \
++_IOC(_IOC_NONE, 'G', 1, sizeof(struct ioctl_gntdev_unmap_grant_ref))       
++struct ioctl_gntdev_unmap_grant_ref {
++	/* IN parameters */
++	/* The offset was returned by the corresponding map operation. */
++	uint64_t index;
++	/* The number of pages to be unmapped. */
++	uint32_t count;
++	uint32_t pad;
++};
++
++/*
++ * Returns the offset in the driver's address space that corresponds
++ * to @vaddr. This can be used to perform a munmap(), followed by an
++ * UNMAP_GRANT_REF ioctl, where no state about the offset is retained by
++ * the caller. The number of pages that were allocated at the same time as
++ * @vaddr is returned in @count.
++ *
++ * N.B. Where more than one page has been mapped into a contiguous range, the
++ *      supplied @vaddr must correspond to the start of the range; otherwise
++ *      an error will result. It is only possible to munmap() the entire
++ *      contiguously-allocated range at once, and not any subrange thereof.
++ */
++#define IOCTL_GNTDEV_GET_OFFSET_FOR_VADDR \
++_IOC(_IOC_NONE, 'G', 2, sizeof(struct ioctl_gntdev_get_offset_for_vaddr))
++struct ioctl_gntdev_get_offset_for_vaddr {
++	/* IN parameters */
++	/* The virtual address of the first mapped page in a range. */
++	uint64_t vaddr;
++	/* OUT parameters */
++	/* The offset that was used in the initial mmap() operation. */
++	uint64_t offset;
++	/* The number of pages mapped in the VM area that begins at @vaddr. */
++	uint32_t count;
++	uint32_t pad;
++};
++
++/*
++ * Sets the maximum number of grants that may mapped at once by this gntdev
++ * instance.
++ *
++ * N.B. This must be called before any other ioctl is performed on the device.
++ */
++#define IOCTL_GNTDEV_SET_MAX_GRANTS \
++_IOC(_IOC_NONE, 'G', 3, sizeof(struct ioctl_gntdev_set_max_grants))
++struct ioctl_gntdev_set_max_grants {
++	/* IN parameter */
++	/* The maximum number of grants that may be mapped at once. */
++	uint32_t count;
++};
++
++#endif /* __LINUX_PUBLIC_GNTDEV_H__ */
 diff --git a/include/xen/grant_table.h b/include/xen/grant_table.h
 index a40f1cd..b89ee8a 100644
 --- a/include/xen/grant_table.h
@@ -16168,6 +17470,20 @@ index 39da93c..8211af8 100644
   * Bitfield values for update_pin_status.flags.
   */
   /* Map the grant entry for access by I/O devices. */
+diff --git a/include/xen/interface/io/ring.h b/include/xen/interface/io/ring.h
+index e8cbf43..865dcf0 100644
+--- a/include/xen/interface/io/ring.h
++++ b/include/xen/interface/io/ring.h
+@@ -73,7 +73,8 @@ union __name##_sring_entry {						\
+ struct __name##_sring {							\
+     RING_IDX req_prod, req_event;					\
+     RING_IDX rsp_prod, rsp_event;					\
+-    uint8_t  pad[48];							\
++    uint8_t  netfront_smartpoll_active;					\
++    uint8_t  pad[47];							\
+     union __name##_sring_entry ring[1]; /* variable-length */		\
+ };									\
+ 									\
 diff --git a/include/xen/interface/memory.h b/include/xen/interface/memory.h
 index af36ead..eac3ce1 100644
 --- a/include/xen/interface/memory.h
@@ -16694,6 +18010,56 @@ index 0000000..6783fce
 +DEFINE_GUEST_HANDLE_STRUCT(xen_platform_op_t);
 +
 +#endif /* __XEN_PUBLIC_PLATFORM_H__ */
+diff --git a/include/xen/interface/vcpu.h b/include/xen/interface/vcpu.h
+index 87e6f8a..0a8edfd 100644
+--- a/include/xen/interface/vcpu.h
++++ b/include/xen/interface/vcpu.h
+@@ -170,4 +170,45 @@ struct vcpu_register_vcpu_info {
+ };
+ DEFINE_GUEST_HANDLE_STRUCT(vcpu_register_vcpu_info);
+ 
++
++/*
++ * Register a memory location to get a secondary copy of the vcpu time
++ * parameters.  The master copy still exists as part of the vcpu
++ * shared memory area, and this secondary copy is updated whenever the
++ * master copy is updated.
++ *
++ * The intent is that this copy may be mapped (RO) into userspace so
++ * that usermode can compute system time using the time info and the
++ * tsc.  Usermode will see an array of vcpu_time_info structures, one
++ * for each vcpu, and choose the right one by an existing mechanism
++ * which allows it to get the current vcpu number (such as via a
++ * segment limit).  It can then apply the normal algorithm to compute
++ * system time from the tsc.
++ *
++ * However, because usermode threads are subject to two levels of
++ * scheduling (kernel scheduling of threads to vcpus, and Xen
++ * scheduling of vcpus to pcpus), we must make sure that the thread
++ * knows it has had a race with either (or both) of these two events.
++ * To allow this, the guest kernel updates the time_info version
++ * number when the vcpu does a context switch, so that usermode will
++ * always see a version number change when the parameters need to be
++ * revalidated.  Xen makes sure that it always updates the guest's
++ * version rather than overwriting it.  (It assumes that a vcpu will
++ * always update its own version number, so there are no cross-cpu
++ * synchronization issues; the only concern is that if the guest
++ * kernel gets preempted by Xen it doesn't revert the version number
++ * to an older value.)
++ *
++ * @extra_arg == pointer to vcpu_register_time_info_memory_area structure.
++ */
++#define VCPUOP_register_vcpu_time_memory_area   13
++
++struct vcpu_register_time_memory_area {
++	union {
++		struct vcpu_time_info *v;
++		struct pvclock_vcpu_time_info *pv;
++		uint64_t p;
++	} addr;
++};
++
+ #endif /* __XEN_PUBLIC_VCPU_H__ */
 diff --git a/include/xen/interface/xen-mca.h b/include/xen/interface/xen-mca.h
 new file mode 100644
 index 0000000..f31fdab
@@ -17442,6 +18808,46 @@ index 0ec9ed8..07a11dc 100644
  			return;
  		desc->status |= IRQ_SUSPENDED;
  	}
+diff --git a/kernel/sched.c b/kernel/sched.c
+index 1b59e26..b998504 100644
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -7005,6 +7005,13 @@ out:
+ }
+ EXPORT_SYMBOL_GPL(set_cpus_allowed_ptr);
+ 
++static ATOMIC_NOTIFIER_HEAD(migration_notifications);
++
++void register_migration_notifier(struct notifier_block *n)
++{
++	atomic_notifier_chain_register(&migration_notifications, n);
++}
++
+ /*
+  * Move (not current) task off this cpu, onto dest cpu. We're doing
+  * this because either it can't run here any more (set_cpus_allowed()
+@@ -7020,6 +7027,7 @@ static int __migrate_task(struct task_struct *p, int src_cpu, int dest_cpu)
+ {
+ 	struct rq *rq_dest, *rq_src;
+ 	int ret = 0, on_rq;
++	struct migration_notifier mn;
+ 
+ 	if (unlikely(!cpu_active(dest_cpu)))
+ 		return ret;
+@@ -7044,6 +7052,13 @@ static int __migrate_task(struct task_struct *p, int src_cpu, int dest_cpu)
+ 		activate_task(rq_dest, p, 0);
+ 		check_preempt_curr(rq_dest, p, 0);
+ 	}
++
++	mn.task = p;
++	mn.from_cpu = src_cpu;
++	mn.to_cpu = dest_cpu;
++
++	atomic_notifier_call_chain(&migration_notifications, 0, &mn);
++
+ done:
+ 	ret = 1;
+ fail:
 diff --git a/lib/swiotlb.c b/lib/swiotlb.c
 index bffe6d7..cec5f62 100644
 --- a/lib/swiotlb.c
@@ -17471,7 +18877,7 @@ index bffe6d7..cec5f62 100644
  		panic("Cannot allocate SWIOTLB overflow buffer!\n");
  
 diff --git a/mm/page_alloc.c b/mm/page_alloc.c
-index a0de15f..5e84a5c 100644
+index 0b3c6cb..49ec6c9 100644
 --- a/mm/page_alloc.c
 +++ b/mm/page_alloc.c
 @@ -566,6 +566,13 @@ static void __free_pages_ok(struct page *page, unsigned int order)

xen.pvops.post.patch:
 b/arch/x86/include/asm/paravirt_types.h |    3 +++
 b/arch/x86/kernel/process_32.c          |    2 ++
 b/arch/x86/pci/common.c                 |   16 ++++++++++++++++
 b/drivers/gpu/drm/drm_gem.c             |    1 -
 drivers/pci/pci.h                       |    2 ++
 5 files changed, 23 insertions(+), 1 deletion(-)

Index: xen.pvops.post.patch
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/Attic/xen.pvops.post.patch,v
retrieving revision 1.1.2.29
retrieving revision 1.1.2.30
diff -u -p -r1.1.2.29 -r1.1.2.30
--- xen.pvops.post.patch	24 Sep 2009 21:05:21 -0000	1.1.2.29
+++ xen.pvops.post.patch	10 Oct 2009 15:04:20 -0000	1.1.2.30
@@ -68,3 +68,15 @@ index 2202b62..f371fe8 100644
  }
  
  int __init pcibios_init(void)
+diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
+index ffe8f43..230c9ff 100644
+--- a/drivers/gpu/drm/drm_gem.c
++++ b/drivers/gpu/drm/drm_gem.c
+@@ -539,7 +539,6 @@ int drm_gem_mmap(struct file *filp, struct vm_area_struct *vma)
+ 	vma->vm_flags |= VM_RESERVED | VM_IO | VM_PFNMAP | VM_DONTEXPAND;
+ 	vma->vm_ops = obj->dev->driver->gem_vm_ops;
+ 	vma->vm_private_data = map->handle;
+-	/* FIXME: use pgprot_writecombine when available */
+ 	vma->vm_page_prot = pgprot_writecombine(vm_get_page_prot(vma->vm_flags));
+ 
+ 	/* Take a ref for this mapping of the object, so that the fault

xen.pvops.pre.patch:
 b/arch/x86/include/asm/paravirt.h |    3 ---
 b/arch/x86/kernel/process_32.c    |    3 +--
 b/arch/x86/pci/common.c           |   16 ----------------
 b/drivers/gpu/drm/drm_gem.c       |    1 +
 drivers/pci/pci.h                 |    2 --
 5 files changed, 2 insertions(+), 23 deletions(-)

Index: xen.pvops.pre.patch
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/Attic/xen.pvops.pre.patch,v
retrieving revision 1.1.2.17
retrieving revision 1.1.2.18
diff -u -p -r1.1.2.17 -r1.1.2.18
--- xen.pvops.pre.patch	5 Sep 2009 19:00:27 -0000	1.1.2.17
+++ xen.pvops.pre.patch	10 Oct 2009 15:04:20 -0000	1.1.2.18
@@ -3,6 +3,7 @@ Affected patches;
 linux-2.6-defaults-pci_no_msi.patch - drivers/pci/pci.h
 linux-2.6-execshield.patch - arch/x86/include/asm/paravirt.h arch/x86/kernel/process_32.c
 linux-2.6-pci-cacheline-sizing.patch - arch/x86/pci/common.c
+drm-next-4c57edba4.patch - drivers/gpu/drm/drm_gem.c
 
 --- a/drivers/pci/pci.h	2009-04-24 20:46:50.000000000 +0100
 +++ b/drivers/pci/pci.h	2009-04-23 20:13:43.000000000 +0100
@@ -73,3 +74,15 @@ index 2202b62..f371fe8 100644
  	pcibios_resource_survey();
  
  	if (pci_bf_sort >= pci_force_bf)
+diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
+index ffe8f43..230c9ff 100644
+--- a/drivers/gpu/drm/drm_gem.c
++++ b/drivers/gpu/drm/drm_gem.c
+@@ -539,6 +539,7 @@ int drm_gem_mmap(struct file *filp, struct vm_area_struct *vma)
+ 	vma->vm_flags |= VM_RESERVED | VM_IO | VM_PFNMAP | VM_DONTEXPAND;
+ 	vma->vm_ops = obj->dev->driver->gem_vm_ops;
+ 	vma->vm_private_data = map->handle;
++	/* FIXME: use pgprot_writecombine when available */
+ 	vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
+ 
+ 	/* Take a ref for this mapping of the object, so that the fault


--- drm-next-8ef8678c8.patch DELETED ---


--- linux-2.6-fix-usb-serial-autosuspend.diff DELETED ---


--- linux-2.6-iwlagn-modify-digital-SVR-for-1000.patch DELETED ---


--- linux-2.6-iwlwifi-Handle-new-firmware-file-with-ucode-build-number-in-header.patch DELETED ---


--- linux-2.6-iwlwifi-fix-debugfs-buffer-handling.patch DELETED ---


--- linux-2.6-iwlwifi-fix-unloading-driver-while-scanning.patch DELETED ---


--- linux-2.6-iwlwifi-remove-deprecated-6000-series-adapters.patch DELETED ---


--- linux-2.6-iwlwifi-traverse-linklist-to-find-the-valid-OTP-block.patch DELETED ---


--- linux-2.6-iwlwifi-update-1000-series-API-version-to-match-firmware.patch DELETED ---


--- linux-2.6-xen-check-efer-fix.patch DELETED ---


--- linux-2.6-xen-spinlock-enable-interrupts-only-when-blocking.patch DELETED ---


--- linux-2.6-xen-spinlock-stronger-barrier.patch DELETED ---


--- linux-2.6-xen-stack-protector-fix.patch DELETED ---


--- linux-2.6.31-cpufreq-powernow-k8-oops.patch DELETED ---


--- patch-2.6.31.1.bz2.sign DELETED ---


--- ppc-hates-my-family-and-swore-revenge.patch DELETED ---


