2.6.40.8-2.fc15

18 files changed, 837 insertions, 861 deletions

diff --git a/freed-ora/current/f15/be2net-move-to-new-vlan-model.patch b/freed-ora/current/f15/be2net-move-to-new-vlan-model.patch
new file mode 100644
index 000000000..781297144
--- /dev/null
+++ b/freed-ora/current/f15/be2net-move-to-new-vlan-model.patch
@@ -0,0 +1,107 @@
+From 1447378e3da1b56bb5c7fb1b1bc9b85e061447e7 Mon Sep 17 00:00:00 2001
+From: Ajit Khaparde <ajit.khaparde@emulex.com>
+Date: Tue, 12 Jul 2011 22:10:01 -0700
+Subject: [PATCH 1/3] be2net: move to new vlan model
+
+Signed-off-by: Ajit Khaparde <ajit.khaparde@emulex.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/benet/be.h      |    1 -
+ drivers/net/benet/be_main.c |   34 +++++++++-------------------------
+ 2 files changed, 9 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/net/benet/be.h b/drivers/net/benet/be.h
+index a7db870..5112000 100644
+--- a/drivers/net/benet/be.h
++++ b/drivers/net/benet/be.h
+@@ -332,7 +332,6 @@ struct be_adapter {
+ 	u8 eq_next_idx;
+ 	struct be_drv_stats drv_stats;
+ 
+-	struct vlan_group *vlan_grp;
+ 	u16 vlans_added;
+ 	u16 max_vlans;	/* Number of vlans supported */
+ 	u8 vlan_tag[VLAN_N_VID];
+diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
+index a485f7f..146e420 100644
+--- a/drivers/net/benet/be_main.c
++++ b/drivers/net/benet/be_main.c
+@@ -648,7 +648,7 @@ static void wrb_fill_hdr(struct be_adapter *adapter, struct be_eth_hdr_wrb *hdr,
+ 			AMAP_SET_BITS(struct amap_eth_hdr_wrb, udpcs, hdr, 1);
+ 	}
+ 
+-	if (adapter->vlan_grp && vlan_tx_tag_present(skb)) {
++	if (vlan_tx_tag_present(skb)) {
+ 		AMAP_SET_BITS(struct amap_eth_hdr_wrb, vlan, hdr, 1);
+ 		vlan_tag = vlan_tx_tag_get(skb);
+ 		vlan_prio = (vlan_tag & VLAN_PRIO_MASK) >> VLAN_PRIO_SHIFT;
+@@ -842,13 +842,6 @@ static int be_vid_config(struct be_adapter *adapter, bool vf, u32 vf_num)
+ 	return status;
+ }
+ 
+-static void be_vlan_register(struct net_device *netdev, struct vlan_group *grp)
+-{
+-	struct be_adapter *adapter = netdev_priv(netdev);
+-
+-	adapter->vlan_grp = grp;
+-}
+-
+ static void be_vlan_add_vid(struct net_device *netdev, u16 vid)
+ {
+ 	struct be_adapter *adapter = netdev_priv(netdev);
+@@ -867,7 +860,6 @@ static void be_vlan_rem_vid(struct net_device *netdev, u16 vid)
+ 	struct be_adapter *adapter = netdev_priv(netdev);
+ 
+ 	adapter->vlans_added--;
+-	vlan_group_set_device(adapter->vlan_grp, vid, NULL);
+ 
+ 	if (!be_physfn(adapter))
+ 		return;
+@@ -1196,16 +1188,10 @@ static void be_rx_compl_process(struct be_adapter *adapter,
+ 		skb->rxhash = rxcp->rss_hash;
+ 
+ 
+-	if (unlikely(rxcp->vlanf)) {
+-		if (!adapter->vlan_grp || adapter->vlans_added == 0) {
+-			kfree_skb(skb);
+-			return;
+-		}
+-		vlan_hwaccel_receive_skb(skb, adapter->vlan_grp,
+-					rxcp->vlan_tag);
+-	} else {
+-		netif_receive_skb(skb);
+-	}
++	if (unlikely(rxcp->vlanf))
++		__vlan_hwaccel_put_tag(skb, rxcp->vlan_tag);
++
++	netif_receive_skb(skb);
+ }
+ 
+ /* Process the RX completion indicated by rxcp when GRO is enabled */
+@@ -1259,11 +1245,10 @@ static void be_rx_compl_process_gro(struct be_adapter *adapter,
+ 	if (adapter->netdev->features & NETIF_F_RXHASH)
+ 		skb->rxhash = rxcp->rss_hash;
+ 
+-	if (likely(!rxcp->vlanf))
+-		napi_gro_frags(&eq_obj->napi);
+-	else
+-		vlan_gro_frags(&eq_obj->napi, adapter->vlan_grp,
+-				rxcp->vlan_tag);
++	if (unlikely(rxcp->vlanf))
++		__vlan_hwaccel_put_tag(skb, rxcp->vlan_tag);
++
++	napi_gro_frags(&eq_obj->napi);
+ }
+ 
+ static void be_parse_rx_compl_v1(struct be_adapter *adapter,
+@@ -2901,7 +2886,6 @@ static struct net_device_ops be_netdev_ops = {
+ 	.ndo_set_mac_address	= be_mac_addr_set,
+ 	.ndo_change_mtu		= be_change_mtu,
+ 	.ndo_validate_addr	= eth_validate_addr,
+-	.ndo_vlan_rx_register	= be_vlan_register,
+ 	.ndo_vlan_rx_add_vid	= be_vlan_add_vid,
+ 	.ndo_vlan_rx_kill_vid	= be_vlan_rem_vid,
+ 	.ndo_set_vf_mac		= be_set_vf_mac,
+-- 
+1.7.6.4
+
diff --git a/freed-ora/current/f15/be2net-non-member-vlan-pkts-not-received-in-promisco.patch b/freed-ora/current/f15/be2net-non-member-vlan-pkts-not-received-in-promisco.patch
new file mode 100644
index 000000000..866473efd
--- /dev/null
+++ b/freed-ora/current/f15/be2net-non-member-vlan-pkts-not-received-in-promisco.patch
@@ -0,0 +1,63 @@
+From c0e64ef4899df4cedc872871e54e2c069d29e519 Mon Sep 17 00:00:00 2001
+From: Sathya Perla <sathya.perla@emulex.com>
+Date: Tue, 2 Aug 2011 19:57:43 +0000
+Subject: [PATCH] be2net: non-member vlan pkts not received in promiscous mode
+
+While configuring promiscous mode, explicitly set the
+VLAN_PROMISCOUS bit to make this happen. When switching off
+promiscous mode, re-program the vids.
+
+Signed-off-by: Xavier Selvin <xavier.selvin@emulex.com>
+Signed-off-by: Sathya Perla <sathya.perla@emulex.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/benet/be_cmds.c |    6 ++++--
+ drivers/net/benet/be_main.c |    7 +++++++
+ 2 files changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/benet/be_cmds.c b/drivers/net/benet/be_cmds.c
+index 1c25dbd..73fd949 100644
+--- a/drivers/net/benet/be_cmds.c
++++ b/drivers/net/benet/be_cmds.c
+@@ -1586,9 +1586,11 @@ int be_cmd_promiscuous_config(struct be_adapter *adapter, bool en)
+ 			OPCODE_COMMON_NTWK_RX_FILTER, sizeof(*req));
+ 
+ 	req->if_id = cpu_to_le32(adapter->if_handle);
+-	req->if_flags_mask = cpu_to_le32(BE_IF_FLAGS_PROMISCUOUS);
++	req->if_flags_mask = cpu_to_le32(BE_IF_FLAGS_PROMISCUOUS
++				| BE_IF_FLAGS_VLAN_PROMISCUOUS);
+ 	if (en)
+-		req->if_flags = cpu_to_le32(BE_IF_FLAGS_PROMISCUOUS);
++		req->if_flags = cpu_to_le32(BE_IF_FLAGS_PROMISCUOUS
++				| BE_IF_FLAGS_VLAN_PROMISCUOUS);
+ 
+ 	sge->pa_hi = cpu_to_le32(upper_32_bits(promiscous_cmd.dma));
+ 	sge->pa_lo = cpu_to_le32(promiscous_cmd.dma & 0xFFFFFFFF);
+diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
+index 3b2c5e6..32a5b11 100644
+--- a/drivers/net/benet/be_main.c
++++ b/drivers/net/benet/be_main.c
+@@ -728,6 +728,10 @@ static int be_vid_config(struct be_adapter *adapter, bool vf, u32 vf_num)
+ 		status = be_cmd_vlan_config(adapter, if_handle, vtag, 1, 1, 0);
+ 	}
+ 
++	/* No need to further configure vids if in promiscuous mode */
++	if (adapter->promiscuous)
++		return 0;
++
+ 	if (adapter->vlans_added <= adapter->max_vlans)  {
+ 		/* Construct VLAN Table to give to HW */
+ 		for (i = 0; i < VLAN_N_VID; i++) {
+@@ -787,6 +791,9 @@ static void be_set_multicast_list(struct net_device *netdev)
+ 	if (adapter->promiscuous) {
+ 		adapter->promiscuous = false;
+ 		be_cmd_promiscuous_config(adapter, false);
++
++		if (adapter->vlans_added)
++			be_vid_config(adapter, false, 0);
+ 	}
+ 
+ 	/* Enable multicast promisc if num configured exceeds what we support */
+-- 
+1.7.6.4
+
diff --git a/freed-ora/current/f15/benet-remove-bogus-unlikely-on-vlan-check.patch b/freed-ora/current/f15/benet-remove-bogus-unlikely-on-vlan-check.patch
new file mode 100644
index 000000000..08c00817e
--- /dev/null
+++ b/freed-ora/current/f15/benet-remove-bogus-unlikely-on-vlan-check.patch
@@ -0,0 +1,39 @@
+From 82f15998fafe683add83f7a11b2e25f919b3cd2d Mon Sep 17 00:00:00 2001
+From: Jiri Pirko <jpirko@redhat.com>
+Date: Tue, 25 Oct 2011 13:47:16 -0400
+Subject: [PATCH] benet: remove bogus "unlikely" on vlan check
+
+Use of unlikely in this place is wrong. Remove it.
+
+Signed-off-by: Jiri Pirko <jpirko@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Backported-by: Josh Boyer <jwboyer@redhat.com>
+---
+ drivers/net/benet/be_main.c |    4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
+index c411bb1..6df0c7e 100644
+--- a/drivers/net/benet/be_main.c
++++ b/drivers/net/benet/be_main.c
+@@ -1192,7 +1192,7 @@ static void be_rx_compl_process(struct be_adapter *adapter,
+ 		skb->rxhash = rxcp->rss_hash;
+ 
+ 
+-	if (unlikely(rxcp->vlanf))
++	if (rxcp->vlanf)
+ 		__vlan_hwaccel_put_tag(skb, rxcp->vlan_tag);
+ 
+ 	netif_receive_skb(skb);
+@@ -1249,7 +1249,7 @@ static void be_rx_compl_process_gro(struct be_adapter *adapter,
+ 	if (adapter->netdev->features & NETIF_F_RXHASH)
+ 		skb->rxhash = rxcp->rss_hash;
+ 
+-	if (unlikely(rxcp->vlanf))
++	if (rxcp->vlanf)
+ 		__vlan_hwaccel_put_tag(skb, rxcp->vlan_tag);
+ 
+ 	napi_gro_frags(&eq_obj->napi);
+-- 
+1.7.6.4
+
diff --git a/freed-ora/current/f15/cifs-fix-ERR_PTR-dereference-in-cifs_get_root.patch b/freed-ora/current/f15/cifs-fix-ERR_PTR-dereference-in-cifs_get_root.patch
deleted file mode 100644
index f15a0e952..000000000
--- a/freed-ora/current/f15/cifs-fix-ERR_PTR-dereference-in-cifs_get_root.patch
+++ /dev/null
@@ -1,120 +0,0 @@
-Return-Path: kernel-bounces@lists.fedoraproject.org
-Received: from zmta02.collab.prod.int.phx2.redhat.com (LHLO
- zmta02.collab.prod.int.phx2.redhat.com) (10.5.5.32) by
- mail02.corp.redhat.com with LMTP; Thu, 25 Aug 2011 10:45:29 -0400 (EDT)
-Received: from localhost (localhost.localdomain [127.0.0.1])
-	by zmta02.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id D94C212A429;
-	Thu, 25 Aug 2011 10:40:08 -0400 (EDT)
-X-Quarantine-ID: <C-k2lztK9Aht>
-Received: from zmta02.collab.prod.int.phx2.redhat.com ([127.0.0.1])
-	by localhost (zmta02.collab.prod.int.phx2.redhat.com [127.0.0.1]) (amavisd-new, port 10024)
-	with ESMTP id C-k2lztK9Aht; Thu, 25 Aug 2011 10:40:08 -0400 (EDT)
-Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22])
-	by zmta02.collab.prod.int.phx2.redhat.com (Postfix) with ESMTP id 99EEE12A424;
-	Thu, 25 Aug 2011 10:40:08 -0400 (EDT)
-Received: from mx1.redhat.com (ext-mx12.extmail.prod.ext.phx2.redhat.com [10.5.110.17])
-	by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id p7PEe7jY023291;
-	Thu, 25 Aug 2011 10:40:08 -0400
-Received: from bastion.fedoraproject.org (bastion02.phx2.fedoraproject.org [10.5.126.11])
-	by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id p7PEe54S022197;
-	Thu, 25 Aug 2011 10:40:05 -0400
-Received: from lists.fedoraproject.org (collab1.vpn.fedoraproject.org [192.168.1.21])
-	by bastion02.phx2.fedoraproject.org (Postfix) with ESMTP id E3F1D1108EB;
-	Thu, 25 Aug 2011 14:40:04 +0000 (UTC)
-Received: from collab1.fedoraproject.org (localhost.localdomain [127.0.0.1])
-	by lists.fedoraproject.org (Postfix) with ESMTP id 52AA23267A7;
-	Thu, 25 Aug 2011 14:40:04 +0000 (UTC)
-X-Original-To: kernel@lists.fedoraproject.org
-Delivered-To: kernel@lists.fedoraproject.org
-Received: from smtp-mm02.fedoraproject.org (smtp-mm02.fedoraproject.org
-	[66.35.62.164])
-	by lists.fedoraproject.org (Postfix) with ESMTP id 8FD8232679C
-	for <kernel@lists.fedoraproject.org>;
-	Thu, 25 Aug 2011 14:40:01 +0000 (UTC)
-Received: from mail-gx0-f173.google.com (mail-gx0-f173.google.com
-	[209.85.161.173])
-	by smtp-mm02.fedoraproject.org (Postfix) with ESMTP id 42F73E721F
-	for <kernel@lists.fedoraproject.org>;
-	Thu, 25 Aug 2011 14:40:01 +0000 (UTC)
-Received: by gxk26 with SMTP id 26so2067938gxk.32
-	for <kernel@lists.fedoraproject.org>;
-	Thu, 25 Aug 2011 07:40:00 -0700 (PDT)
-Received: by 10.91.21.4 with SMTP id y4mr6531700agi.115.1314283200592;
-	Thu, 25 Aug 2011 07:40:00 -0700 (PDT)
-Received: from salusa.poochiereds.net (cpe-075-177-182-191.nc.res.rr.com
-	[75.177.182.191])
-	by mx.google.com with ESMTPS id l13sm579931anj.16.2011.08.25.07.39.59
-	(version=SSLv3 cipher=OTHER); Thu, 25 Aug 2011 07:40:00 -0700 (PDT)
-From: Jeff Layton <jlayton@redhat.com>
-To: kernel@lists.fedoraproject.org
-Subject: [PATCH 2/2] CIFS: Fix ERR_PTR dereference in cifs_get_root
-Date: Thu, 25 Aug 2011 10:39:54 -0400
-Message-Id: <1314283194-26086-3-git-send-email-jlayton@redhat.com>
-In-Reply-To: <1314283194-26086-1-git-send-email-jlayton@redhat.com>
-References: <1314283194-26086-1-git-send-email-jlayton@redhat.com>
-X-BeenThere: kernel@lists.fedoraproject.org
-X-Mailman-Version: 2.1.9
-Precedence: list
-List-Id: "Fedora kernel development." <kernel.lists.fedoraproject.org>
-List-Unsubscribe: <https://admin.fedoraproject.org/mailman/listinfo/kernel>,
-	<mailto:kernel-request@lists.fedoraproject.org?subject=unsubscribe>
-List-Archive: <http://lists.fedoraproject.org/pipermail/kernel>
-List-Post: <mailto:kernel@lists.fedoraproject.org>
-List-Help: <mailto:kernel-request@lists.fedoraproject.org?subject=help>
-List-Subscribe: <https://admin.fedoraproject.org/mailman/listinfo/kernel>,
-	<mailto:kernel-request@lists.fedoraproject.org?subject=subscribe>
-MIME-Version: 1.0
-Content-Type: text/plain; charset="us-ascii"
-Content-Transfer-Encoding: 7bit
-Sender: kernel-bounces@lists.fedoraproject.org
-Errors-To: kernel-bounces@lists.fedoraproject.org
-X-RedHat-Spam-Score: -0.502  (RP_MATCHES_RCVD)
-X-Scanned-By: MIMEDefang 2.68 on 10.5.11.22
-X-Scanned-By: MIMEDefang 2.68 on 10.5.110.17
-
-From: Pavel Shilovsky <piastryyy@gmail.com>
-
-move it to the beginning of the loop.
-
-Cc: <stable@kernel.org>
-Signed-off-by: Pavel Shilovsky <piastryyy@gmail.com>
-Reviewed-by: Jeff Layton <jlayton@redhat.com>
----
- fs/cifs/cifsfs.c |   10 ++++++----
- 1 files changed, 6 insertions(+), 4 deletions(-)
-
-diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
-index fc7e57b..53e7d72 100644
---- a/fs/cifs/cifsfs.c
-+++ b/fs/cifs/cifsfs.c
-@@ -566,6 +566,12 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
- 		struct inode *dir = dentry->d_inode;
- 		struct dentry *child;
- 
-+		if (!dir) {
-+			dput(dentry);
-+			dentry = ERR_PTR(-ENOENT);
-+			break;
-+		}
-+
- 		/* skip separators */
- 		while (*s == sep)
- 			s++;
-@@ -581,10 +587,6 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
- 		mutex_unlock(&dir->i_mutex);
- 		dput(dentry);
- 		dentry = child;
--		if (!dentry->d_inode) {
--			dput(dentry);
--			dentry = ERR_PTR(-ENOENT);
--		}
- 	} while (!IS_ERR(dentry));
- 	_FreeXid(xid);
- 	kfree(full_path);
--- 
-1.7.6
-
-_______________________________________________
-kernel mailing list
-kernel@lists.fedoraproject.org
-https://admin.fedoraproject.org/mailman/listinfo/kernel
diff --git a/freed-ora/current/f15/cputimer-Cure-lock-inversion.patch b/freed-ora/current/f15/cputimer-Cure-lock-inversion.patch
deleted file mode 100644
index 23759ad8b..000000000
--- a/freed-ora/current/f15/cputimer-Cure-lock-inversion.patch
+++ /dev/null
@@ -1,148 +0,0 @@
-Path: news.gmane.org!not-for-mail
-From: Peter Zijlstra <a.p.zijlstra@chello.nl>
-Newsgroups: gmane.linux.kernel
-Subject: Re: Linux 3.1-rc9
-Date: Tue, 18 Oct 2011 11:05:13 +0200
-Lines: 84
-Approved: news@gmane.org
-Message-ID: <1318928713.21167.4.camel@twins>
-References: <CA+55aFxPNszU5UHFrDDYnshLEMupaviFwhgEsgmPkqpmuWNZ8A@mail.gmail.com>
-	  <20111007070842.GA27555@hostway.ca> <20111007174848.GA11011@hostway.ca>
-	  <1318010515.398.8.camel@twins> <20111008005035.GC22843@hostway.ca>
-	  <1318060551.8395.0.camel@twins> <20111012213555.GC24461@hostway.ca>
-	  <20111013232521.GA5654@hostway.ca>
-	  <CA+55aFxxfsFMgqA7kYKukvkCX6Z9HrKOtP-22w5Mc21iQj4c=Q@mail.gmail.com>
-	  <1318847658.6594.40.camel@twins>
-	  <CA+55aFxaGKEyhXdHXNxvPrPQ-SGSpbXdfoeXrxfjPx3VXsgvtg@mail.gmail.com>
-	  <1318874090.4172.84.camel@twins>
-	  <CA+55aFwCBy=4YK6amE=H-BYu9-boj4Po2Zkgf4V261mCx0DC4A@mail.gmail.com>
-	 <1318879396.4172.92.camel@twins> <alpine.LFD.2.02.1110172237030.3240@ionos>
-	 <alpine.LFD.2.02.1110181037120.3240@ionos>
-NNTP-Posting-Host: lo.gmane.org
-Mime-Version: 1.0
-Content-Type: text/plain; charset="UTF-8"
-Content-Transfer-Encoding: 8BIT
-X-Trace: dough.gmane.org 1318928749 2484 80.91.229.12 (18 Oct 2011 09:05:49 GMT)
-X-Complaints-To: usenet@dough.gmane.org
-NNTP-Posting-Date: Tue, 18 Oct 2011 09:05:49 +0000 (UTC)
-Cc: Linus Torvalds <torvalds@linux-foundation.org>,
-	Simon Kirby <sim@hostway.ca>,
-	Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
-	Dave Jones <davej@redhat.com>,
-	Martin Schwidefsky <schwidefsky@de.ibm.com>,
-	Ingo Molnar <mingo@elte.hu>
-To: Thomas Gleixner <tglx@linutronix.de>
-Original-X-From: linux-kernel-owner@vger.kernel.org Tue Oct 18 11:05:43 2011
-Return-path: <linux-kernel-owner@vger.kernel.org>
-Envelope-to: glk-linux-kernel-3@lo.gmane.org
-Original-Received: from vger.kernel.org ([209.132.180.67])
-	by lo.gmane.org with esmtp (Exim 4.69)
-	(envelope-from <linux-kernel-owner@vger.kernel.org>)
-	id 1RG5cB-0003K9-2n
-	for glk-linux-kernel-3@lo.gmane.org; Tue, 18 Oct 2011 11:05:39 +0200
-Original-Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
-	id S1757183Ab1JRJFc (ORCPT <rfc822;glk-linux-kernel-3@m.gmane.org>);
-	Tue, 18 Oct 2011 05:05:32 -0400
-Original-Received: from casper.infradead.org ([85.118.1.10]:40399 "EHLO
-	casper.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
-	with ESMTP id S1753880Ab1JRJFa convert rfc822-to-8bit (ORCPT
-	<rfc822;linux-kernel@vger.kernel.org>);
-	Tue, 18 Oct 2011 05:05:30 -0400
-Original-Received: from j77219.upc-j.chello.nl ([24.132.77.219] helo=twins)
-	by casper.infradead.org with esmtpsa (Exim 4.76 #1 (Red Hat Linux))
-	id 1RG5bu-0008Qu-O5; Tue, 18 Oct 2011 09:05:22 +0000
-Original-Received: by twins (Postfix, from userid 1000)
-	id 69952813C82C; Tue, 18 Oct 2011 11:05:13 +0200 (CEST)
-In-Reply-To: <alpine.LFD.2.02.1110181037120.3240@ionos>
-X-Mailer: Evolution 3.0.3- 
-Original-Sender: linux-kernel-owner@vger.kernel.org
-Precedence: bulk
-List-ID: <linux-kernel.vger.kernel.org>
-X-Mailing-List: linux-kernel@vger.kernel.org
-Xref: news.gmane.org gmane.linux.kernel:1204676
-Archived-At: <http://permalink.gmane.org/gmane.linux.kernel/1204676>
-
-On Tue, 2011-10-18 at 10:39 +0200, Thomas Gleixner wrote:
-> On Mon, 17 Oct 2011, Thomas Gleixner wrote:
-> > That said, I really need some sleep before I can make a final
-> > judgement on that horror. The call paths are such an intermingled mess
-> > that it's not funny anymore. I do that tomorrow morning first thing.
-> 
-> The patch is safe and the exit race just existed in my confused tired
-> brain. Peter, can you please provide a changelog. That wants a cc
-> stable as well, because that deadlock causing commit hit 3.0.7 :( 
-
----
-Subject: cputimer: Cure lock inversion
-From: Peter Zijlstra <a.p.zijlstra@chello.nl>
-Date: Mon Oct 17 11:50:30 CEST 2011
-
-There's a lock inversion between the cputimer->lock and rq->lock; notably
-the two callchains involved are:
-
- update_rlimit_cpu()
-   sighand->siglock
-   set_process_cpu_timer()
-     cpu_timer_sample_group()
-       thread_group_cputimer()
-         cputimer->lock
-         thread_group_cputime()
-           task_sched_runtime()
-             ->pi_lock
-             rq->lock
-
- scheduler_tick()
-   rq->lock
-   task_tick_fair()
-     update_curr()
-       account_group_exec()
-         cputimer->lock
-
-Where the first one is enabling a CLOCK_PROCESS_CPUTIME_ID timer, and
-the second one is keeping up-to-date.
-
-This problem was introduced by e8abccb7193 ("posix-cpu-timers: Cure
-SMP accounting oddities").
-
-Cure the problem by removing the cputimer->lock and rq->lock nesting,
-this leaves concurrent enablers doing duplicate work, but the time
-wasted should be on the same order otherwise wasted spinning on the
-lock and the greater-than assignment filter should ensure we preserve
-monotonicity.
-
-Reported-by: Dave Jones <davej@redhat.com>
-Reported-by: Simon Kirby <sim@hostway.ca>
-Cc: stable@kernel.org
-Cc: Thomas Gleixner <tglx@linutronix.de>
-Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
----
- kernel/posix-cpu-timers.c |    7 ++++---
- 1 file changed, 4 insertions(+), 3 deletions(-)
-Index: linux-2.6/kernel/posix-cpu-timers.c
-===================================================================
---- linux-2.6.orig/kernel/posix-cpu-timers.c
-+++ linux-2.6/kernel/posix-cpu-timers.c
-@@ -274,9 +274,7 @@ void thread_group_cputimer(struct task_s
- 	struct task_cputime sum;
- 	unsigned long flags;
- 
--	spin_lock_irqsave(&cputimer->lock, flags);
- 	if (!cputimer->running) {
--		cputimer->running = 1;
- 		/*
- 		 * The POSIX timer interface allows for absolute time expiry
- 		 * values through the TIMER_ABSTIME flag, therefore we have
-@@ -284,8 +282,11 @@ void thread_group_cputimer(struct task_s
- 		 * it.
- 		 */
- 		thread_group_cputime(tsk, &sum);
-+		spin_lock_irqsave(&cputimer->lock, flags);
-+		cputimer->running = 1;
- 		update_gt_cputime(&cputimer->cputime, &sum);
--	}
-+	} else
-+		spin_lock_irqsave(&cputimer->lock, flags);
- 	*times = cputimer->cputime;
- 	spin_unlock_irqrestore(&cputimer->lock, flags);
- }
-
diff --git a/freed-ora/current/f15/drm-ttm-nouveau-oops-fix.patch b/freed-ora/current/f15/drm-ttm-nouveau-oops-fix.patch
deleted file mode 100644
index e65259e50..000000000
--- a/freed-ora/current/f15/drm-ttm-nouveau-oops-fix.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
-index 2e618b5..9095b5b 100644
---- a/drivers/gpu/drm/ttm/ttm_bo.c
-+++ b/drivers/gpu/drm/ttm/ttm_bo.c
-@@ -390,10 +390,12 @@ static int ttm_bo_handle_move_mem(struct ttm_buffer_object *bo,
- 	 * Create and bind a ttm if required.
- 	 */
- 
--	if (!(new_man->flags & TTM_MEMTYPE_FLAG_FIXED) && (bo->ttm == NULL)) {
--		ret = ttm_bo_add_ttm(bo, false);
--		if (ret)
--			goto out_err;
-+	if (!(new_man->flags & TTM_MEMTYPE_FLAG_FIXED)) {
-+		if (bo->ttm == NULL) {
-+			ret = ttm_bo_add_ttm(bo, false);
-+			if (ret)
-+				goto out_err;
-+		}
- 
- 		ret = ttm_tt_set_placement_caching(bo->ttm, mem->placement);
- 		if (ret)
-diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
-index 77dbf40..ae3c6f5 100644
---- a/drivers/gpu/drm/ttm/ttm_bo_util.c
-+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
-@@ -635,13 +635,13 @@ int ttm_bo_move_accel_cleanup(struct ttm_buffer_object *bo,
- 		if (ret)
- 			return ret;
- 
--		ttm_bo_free_old_node(bo);
- 		if ((man->flags & TTM_MEMTYPE_FLAG_FIXED) &&
- 		    (bo->ttm != NULL)) {
- 			ttm_tt_unbind(bo->ttm);
- 			ttm_tt_destroy(bo->ttm);
- 			bo->ttm = NULL;
- 		}
-+		ttm_bo_free_old_node(bo);
- 	} else {
- 		/**
- 		 * This should help pipeline ordinary buffer moves.
diff --git a/freed-ora/current/f15/epoll-limit-paths.patch b/freed-ora/current/f15/epoll-limit-paths.patch
new file mode 100644
index 000000000..440db27b9
--- /dev/null
+++ b/freed-ora/current/f15/epoll-limit-paths.patch
@@ -0,0 +1,465 @@
+From 6a4ca79652219cf22da800d990e5b46feaea1ad9 Mon Sep 17 00:00:00 2001
+From: Jason Baron <jbaron@redhat.com>
+Date: Mon, 24 Oct 2011 14:59:02 +1100
+Subject: [PATCH] epoll: limit paths
+
+epoll: limit paths
+
+The current epoll code can be tickled to run basically indefinitely in
+both loop detection path check (on ep_insert()), and in the wakeup paths.
+The programs that tickle this behavior set up deeply linked networks of
+epoll file descriptors that cause the epoll algorithms to traverse them
+indefinitely.  A couple of these sample programs have been previously
+posted in this thread: https://lkml.org/lkml/2011/2/25/297.
+
+To fix the loop detection path check algorithms, I simply keep track of
+the epoll nodes that have been already visited.  Thus, the loop detection
+becomes proportional to the number of epoll file descriptor and links.
+This dramatically decreases the run-time of the loop check algorithm.  In
+one diabolical case I tried it reduced the run-time from 15 mintues (all
+in kernel time) to .3 seconds.
+
+Fixing the wakeup paths could be done at wakeup time in a similar manner
+by keeping track of nodes that have already been visited, but the
+complexity is harder, since there can be multiple wakeups on different
+cpus...Thus, I've opted to limit the number of possible wakeup paths when
+the paths are created.
+
+This is accomplished, by noting that the end file descriptor points that
+are found during the loop detection pass (from the newly added link), are
+actually the sources for wakeup events.  I keep a list of these file
+descriptors and limit the number and length of these paths that emanate
+from these 'source file descriptors'.  In the current implemetation I
+allow 1000 paths of length 1, 500 of length 2, 100 of length 3, 50 of
+length 4 and 10 of length 5.  Note that it is sufficient to check the
+'source file descriptors' reachable from the newly added link, since no
+other 'source file descriptors' will have newly added links.  This allows
+us to check only the wakeup paths that may have gotten too long, and not
+re-check all possible wakeup paths on the system.
+
+In terms of the path limit selection, I think its first worth noting that
+the most common case for epoll, is probably the model where you have 1
+epoll file descriptor that is monitoring n number of 'source file
+descriptors'.  In this case, each 'source file descriptor' has a 1 path of
+length 1.  Thus, I believe that the limits I'm proposing are quite
+reasonable and in fact may be too generous.  Thus, I'm hoping that the
+proposed limits will not prevent any workloads that currently work to
+fail.
+
+In terms of locking, I have extended the use of the 'epmutex' to all
+epoll_ctl add and remove operations.  Currently its only used in a subset
+of the add paths.  I need to hold the epmutex, so that we can correctly
+traverse a coherent graph, to check the number of paths.  I believe that
+this additional locking is probably ok, since its in the setup/teardown
+paths, and doesn't affect the running paths, but it certainly is going to
+add some extra overhead.  Also, worth noting is that the epmuex was
+recently added to the ep_ctl add operations in the initial path loop
+detection code using the argument that it was not on a critical path.
+
+Another thing to note here, is the length of epoll chains that is allowed.
+Currently, eventpoll.c defines:
+
+/* Maximum number of nesting allowed inside epoll sets */
+#define EP_MAX_NESTS 4
+
+This basically means that I am limited to a graph depth of 5 (EP_MAX_NESTS
++ 1).  However, this limit is currently only enforced during the loop
+check detection code, and only when the epoll file descriptors are added
+in a certain order.  Thus, this limit is currently easily bypassed.  The
+newly added check for wakeup paths, stricly limits the wakeup paths to a
+length of 5, regardless of the order in which ep's are linked together.
+Thus, a side-effect of the new code is a more consistent enforcement of
+the graph depth.
+
+Thus far, I've tested this, using the sample programs previously
+mentioned, which now either return quickly or return -EINVAL.  I've also
+testing using the piptest.c epoll tester, which showed no difference in
+performance.  I've also created a number of different epoll networks and
+tested that they behave as expectded.
+
+I believe this solves the original diabolical test cases, while still
+preserving the sane epoll nesting.
+
+Signed-off-by: Jason Baron <jbaron@redhat.com>
+Cc: Nelson Elhage <nelhage@ksplice.com>
+Cc: Davide Libenzi <davidel@xmailserver.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ fs/eventpoll.c            |  226 ++++++++++++++++++++++++++++++++++++++++-----
+ include/linux/eventpoll.h |    1 +
+ include/linux/fs.h        |    1 +
+ 3 files changed, 203 insertions(+), 25 deletions(-)
+
+diff --git a/fs/eventpoll.c b/fs/eventpoll.c
+index 4a53743..414ac74 100644
+--- a/fs/eventpoll.c
++++ b/fs/eventpoll.c
+@@ -197,6 +197,12 @@ struct eventpoll {
+ 
+ 	/* The user that created the eventpoll descriptor */
+ 	struct user_struct *user;
++
++	struct file *file;
++
++	/* used to optimize loop detection check */
++	int visited;
++	struct list_head visitedllink;
+ };
+ 
+ /* Wait structure used by the poll hooks */
+@@ -255,6 +261,12 @@ static struct kmem_cache *epi_cache __read_mostly;
+ /* Slab cache used to allocate "struct eppoll_entry" */
+ static struct kmem_cache *pwq_cache __read_mostly;
+ 
++/* Visited nodes during ep_loop_check(), so we can unset them when we finish */
++LIST_HEAD(visited_list);
++
++/* Files with newly added links, which need a limit on emanating paths */
++LIST_HEAD(tfile_check_list);
++
+ #ifdef CONFIG_SYSCTL
+ 
+ #include <linux/sysctl.h>
+@@ -276,6 +288,12 @@ ctl_table epoll_table[] = {
+ };
+ #endif /* CONFIG_SYSCTL */
+ 
++static const struct file_operations eventpoll_fops;
++
++static inline int is_file_epoll(struct file *f)
++{
++	return f->f_op == &eventpoll_fops;
++}
+ 
+ /* Setup the structure that is used as key for the RB tree */
+ static inline void ep_set_ffd(struct epoll_filefd *ffd,
+@@ -711,12 +729,6 @@ static const struct file_operations eventpoll_fops = {
+ 	.llseek		= noop_llseek,
+ };
+ 
+-/* Fast test to see if the file is an evenpoll file */
+-static inline int is_file_epoll(struct file *f)
+-{
+-	return f->f_op == &eventpoll_fops;
+-}
+-
+ /*
+  * This is called from eventpoll_release() to unlink files from the eventpoll
+  * interface. We need to have this facility to cleanup correctly files that are
+@@ -926,6 +938,96 @@ static void ep_rbtree_insert(struct eventpoll *ep, struct epitem *epi)
+ 	rb_insert_color(&epi->rbn, &ep->rbr);
+ }
+ 
++
++
++#define PATH_ARR_SIZE 5
++/* These are the number paths of length 1 to 5, that we are allowing to emanate
++ * from a single file of interest. For example, we allow 1000 paths of length
++ * 1, to emanate from each file of interest. This essentially represents the
++ * potential wakeup paths, which need to be limited in order to avoid massive
++ * uncontrolled wakeup storms. The common use case should be a single ep which
++ * is connected to n file sources. In this case each file source has 1 path
++ * of length 1. Thus, the numbers below should be more than sufficient.
++ */
++int path_limits[PATH_ARR_SIZE] = { 1000, 500, 100, 50, 10 };
++int path_count[PATH_ARR_SIZE];
++
++static int path_count_inc(int nests)
++{
++	if (++path_count[nests] > path_limits[nests])
++		return -1;
++	return 0;
++}
++
++static void path_count_init(void)
++{
++	int i;
++
++	for (i = 0; i < PATH_ARR_SIZE; i++)
++		path_count[i] = 0;
++}
++
++static int reverse_path_check_proc(void *priv, void *cookie, int call_nests)
++{
++	int error = 0;
++	struct file *file = priv;
++	struct file *child_file;
++	struct epitem *epi;
++
++	list_for_each_entry(epi, &file->f_ep_links, fllink) {
++		child_file = epi->ep->file;
++		if (is_file_epoll(child_file)) {
++			if (list_empty(&child_file->f_ep_links)) {
++				if (path_count_inc(call_nests)) {
++					error = -1;
++					break;
++				}
++			} else {
++				error = ep_call_nested(&poll_loop_ncalls,
++							EP_MAX_NESTS,
++							reverse_path_check_proc,
++							child_file, child_file,
++							current);
++			}
++			if (error != 0)
++				break;
++		} else {
++			printk(KERN_ERR "reverse_path_check_proc: "
++				"file is not an ep!\n");
++		}
++	}
++	return error;
++}
++
++/**
++ * reverse_path_check - The tfile_check_list is list of file *, which have
++ *                      links that are proposed to be newly added. We need to
++ *                      make sure that those added links don't add too many
++ *                      paths such that we will spend all our time waking up
++ *                      eventpoll objects.
++ *
++ * Returns: Returns zero if the proposed links don't create too many paths,
++ *	    -1 otherwise.
++ */
++static int reverse_path_check(void)
++{
++	int length = 0;
++	int error = 0;
++	struct file *current_file;
++
++	/* let's call this for all tfiles */
++	list_for_each_entry(current_file, &tfile_check_list, f_tfile_llink) {
++		length++;
++		path_count_init();
++		error = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
++					reverse_path_check_proc, current_file,
++					current_file, current);
++		if (error)
++			break;
++	}
++	return error;
++}
++
+ /*
+  * Must be called with "mtx" held.
+  */
+@@ -987,6 +1089,11 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
+ 	 */
+ 	ep_rbtree_insert(ep, epi);
+ 
++	/* now check if we've created too many backpaths */
++	error = -EINVAL;
++	if (reverse_path_check())
++		goto error_remove_epi;
++
+ 	/* We have to drop the new item inside our item list to keep track of it */
+ 	spin_lock_irqsave(&ep->lock, flags);
+ 
+@@ -1011,6 +1118,14 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
+ 
+ 	return 0;
+ 
++error_remove_epi:
++	spin_lock(&tfile->f_lock);
++	if (ep_is_linked(&epi->fllink))
++		list_del_init(&epi->fllink);
++	spin_unlock(&tfile->f_lock);
++
++	rb_erase(&epi->rbn, &ep->rbr);
++
+ error_unregister:
+ 	ep_unregister_pollwait(ep, epi);
+ 
+@@ -1275,18 +1390,35 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
+ 	int error = 0;
+ 	struct file *file = priv;
+ 	struct eventpoll *ep = file->private_data;
++	struct eventpoll *ep_tovisit;
+ 	struct rb_node *rbp;
+ 	struct epitem *epi;
+ 
+ 	mutex_lock_nested(&ep->mtx, call_nests + 1);
++	ep->visited = 1;
++	list_add(&ep->visitedllink, &visited_list);
+ 	for (rbp = rb_first(&ep->rbr); rbp; rbp = rb_next(rbp)) {
+ 		epi = rb_entry(rbp, struct epitem, rbn);
+ 		if (unlikely(is_file_epoll(epi->ffd.file))) {
++			ep_tovisit = epi->ffd.file->private_data;
++			if (ep_tovisit->visited)
++				continue;
+ 			error = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
+-					       ep_loop_check_proc, epi->ffd.file,
+-					       epi->ffd.file->private_data, current);
++					ep_loop_check_proc, epi->ffd.file,
++					ep_tovisit, current);
+ 			if (error != 0)
+ 				break;
++		} else {
++			/* if we've reached a file that is not associated with
++			 * an ep, then then we need to check if the newly added
++			 * links are going to add too many wakeup paths. We do
++			 * this by adding it to the tfile_check_list, if it's
++			 * not already there, and calling reverse_path_check()
++			 * during ep_insert()
++			 */
++			if (list_empty(&epi->ffd.file->f_tfile_llink))
++				list_add(&epi->ffd.file->f_tfile_llink,
++					 &tfile_check_list);
+ 		}
+ 	}
+ 	mutex_unlock(&ep->mtx);
+@@ -1307,8 +1439,30 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
+  */
+ static int ep_loop_check(struct eventpoll *ep, struct file *file)
+ {
+-	return ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
++	int ret;
++	struct eventpoll *ep_cur, *ep_next;
++
++	ret = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
+ 			      ep_loop_check_proc, file, ep, current);
++	/* clear visited list */
++	list_for_each_entry_safe(ep_cur, ep_next, &visited_list, visitedllink) {
++		ep_cur->visited = 0;
++		list_del(&ep_cur->visitedllink);
++	}
++	return ret;
++}
++
++static void clear_tfile_check_list(void)
++{
++	struct file *file;
++
++	/* first clear the tfile_check_list */
++	while (!list_empty(&tfile_check_list)) {
++		file = list_first_entry(&tfile_check_list, struct file,
++					f_tfile_llink);
++		list_del_init(&file->f_tfile_llink);
++	}
++	INIT_LIST_HEAD(&tfile_check_list);
+ }
+ 
+ /*
+@@ -1316,8 +1470,9 @@ static int ep_loop_check(struct eventpoll *ep, struct file *file)
+  */
+ SYSCALL_DEFINE1(epoll_create1, int, flags)
+ {
+-	int error;
++	int error, fd;
+ 	struct eventpoll *ep = NULL;
++	struct file *file;
+ 
+ 	/* Check the EPOLL_* constant for consistency.  */
+ 	BUILD_BUG_ON(EPOLL_CLOEXEC != O_CLOEXEC);
+@@ -1334,11 +1489,25 @@ SYSCALL_DEFINE1(epoll_create1, int, flags)
+ 	 * Creates all the items needed to setup an eventpoll file. That is,
+ 	 * a file structure and a free file descriptor.
+ 	 */
+-	error = anon_inode_getfd("[eventpoll]", &eventpoll_fops, ep,
++	fd = get_unused_fd_flags(O_RDWR | (flags & O_CLOEXEC));
++	if (fd < 0) {
++		error = fd;
++		goto out_free_ep;
++	}
++	file = anon_inode_getfile("[eventpoll]", &eventpoll_fops, ep,
+ 				 O_RDWR | (flags & O_CLOEXEC));
+-	if (error < 0)
+-		ep_free(ep);
+-
++	if (IS_ERR(file)) {
++		error = PTR_ERR(file);
++		goto out_free_fd;
++	}
++	fd_install(fd, file);
++	ep->file = file;
++	return fd;
++
++out_free_fd:
++	put_unused_fd(fd);
++out_free_ep:
++	ep_free(ep);
+ 	return error;
+ }
+ 
+@@ -1404,21 +1573,27 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
+ 	/*
+ 	 * When we insert an epoll file descriptor, inside another epoll file
+ 	 * descriptor, there is the change of creating closed loops, which are
+-	 * better be handled here, than in more critical paths.
++	 * better be handled here, than in more critical paths. While we are
++	 * checking for loops we also determine the list of files reachable
++	 * and hang them on the tfile_check_list, so we can check that we
++	 * haven't created too many possible wakeup paths.
+ 	 *
+-	 * We hold epmutex across the loop check and the insert in this case, in
+-	 * order to prevent two separate inserts from racing and each doing the
+-	 * insert "at the same time" such that ep_loop_check passes on both
+-	 * before either one does the insert, thereby creating a cycle.
++	 * We need to hold the epmutex across both ep_insert and ep_remove
++	 * b/c we want to make sure we are looking at a coherent view of
++	 * epoll network.
+ 	 */
+-	if (unlikely(is_file_epoll(tfile) && op == EPOLL_CTL_ADD)) {
++	if (op == EPOLL_CTL_ADD || op == EPOLL_CTL_DEL) {
+ 		mutex_lock(&epmutex);
+ 		did_lock_epmutex = 1;
+-		error = -ELOOP;
+-		if (ep_loop_check(ep, tfile) != 0)
+-			goto error_tgt_fput;
+ 	}
+-
++	if (op == EPOLL_CTL_ADD) {
++		if (is_file_epoll(tfile)) {
++			error = -ELOOP;
++			if (ep_loop_check(ep, tfile) != 0)
++				goto error_tgt_fput;
++		} else
++			list_add(&tfile->f_tfile_llink, &tfile_check_list);
++	}
+ 
+ 	mutex_lock_nested(&ep->mtx, 0);
+ 
+@@ -1437,6 +1612,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
+ 			error = ep_insert(ep, &epds, tfile, fd);
+ 		} else
+ 			error = -EEXIST;
++		clear_tfile_check_list();
+ 		break;
+ 	case EPOLL_CTL_DEL:
+ 		if (epi)
+@@ -1455,7 +1631,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
+ 	mutex_unlock(&ep->mtx);
+ 
+ error_tgt_fput:
+-	if (unlikely(did_lock_epmutex))
++	if (did_lock_epmutex)
+ 		mutex_unlock(&epmutex);
+ 
+ 	fput(tfile);
+diff --git a/include/linux/eventpoll.h b/include/linux/eventpoll.h
+index f362733..657ab55 100644
+--- a/include/linux/eventpoll.h
++++ b/include/linux/eventpoll.h
+@@ -61,6 +61,7 @@ struct file;
+ static inline void eventpoll_init_file(struct file *file)
+ {
+ 	INIT_LIST_HEAD(&file->f_ep_links);
++	INIT_LIST_HEAD(&file->f_tfile_llink);
+ }
+ 
+ 
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 277f497..93778e0 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -985,6 +985,7 @@ struct file {
+ #ifdef CONFIG_EPOLL
+ 	/* Used by fs/eventpoll.c to link all the hooks to this file */
+ 	struct list_head	f_ep_links;
++	struct list_head	f_tfile_llink;
+ #endif /* #ifdef CONFIG_EPOLL */
+ 	struct address_space	*f_mapping;
+ #ifdef CONFIG_DEBUG_WRITECOUNT
+-- 
+1.7.6.4
+
diff --git a/freed-ora/current/f15/fuse-fix-memory-leak.patch b/freed-ora/current/f15/fuse-fix-memory-leak.patch
deleted file mode 100644
index c52069bee..000000000
--- a/freed-ora/current/f15/fuse-fix-memory-leak.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From 4078129ec09990936702ab5274e05d139d7f7dcd Mon Sep 17 00:00:00 2001
-From: Miklos Szeredi <mszeredi@suse.cz>
-Date: Mon, 12 Sep 2011 09:38:03 +0200
-Subject: [PATCH] fuse: fix memory leak
-
-kmemleak is reporting that 32 bytes are being leaked by FUSE:
-
-  unreferenced object 0xe373b270 (size 32):
-  comm "fusermount", pid 1207, jiffies 4294707026 (age 2675.187s)
-  hex dump (first 32 bytes):
-    01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00  ................
-    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
-  backtrace:
-    [<b05517d7>] kmemleak_alloc+0x27/0x50
-    [<b0196435>] kmem_cache_alloc+0xc5/0x180
-    [<b02455be>] fuse_alloc_forget+0x1e/0x20
-    [<b0245670>] fuse_alloc_inode+0xb0/0xd0
-    [<b01b1a8c>] alloc_inode+0x1c/0x80
-    [<b01b290f>] iget5_locked+0x8f/0x1a0
-    [<b0246022>] fuse_iget+0x72/0x1a0
-    [<b02461da>] fuse_get_root_inode+0x8a/0x90
-    [<b02465cf>] fuse_fill_super+0x3ef/0x590
-    [<b019e56f>] mount_nodev+0x3f/0x90
-    [<b0244e95>] fuse_mount+0x15/0x20
-    [<b019d1bc>] mount_fs+0x1c/0xc0
-    [<b01b5811>] vfs_kern_mount+0x41/0x90
-    [<b01b5af9>] do_kern_mount+0x39/0xd0
-    [<b01b7585>] do_mount+0x2e5/0x660
-    [<b01b7966>] sys_mount+0x66/0xa0
-
-This leak report is consistent and happens once per boot on
-3.1.0-rc5-dirty.
-
-This happens if a FORGET request is queued after the fuse device was
-released.
-
-Reported-by: Sitsofe Wheeler <sitsofe@yahoo.com>
-Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
-Tested-by: Sitsofe Wheeler <sitsofe@yahoo.com>
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
----
- fs/fuse/dev.c |   12 ++++++++----
- 1 files changed, 8 insertions(+), 4 deletions(-)
-
-diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
-index 168a80f..5cb8614 100644
---- a/fs/fuse/dev.c
-+++ b/fs/fuse/dev.c
-@@ -258,10 +258,14 @@ void fuse_queue_forget(struct fuse_conn *fc, struct fuse_forget_link *forget,
- 	forget->forget_one.nlookup = nlookup;
- 
- 	spin_lock(&fc->lock);
--	fc->forget_list_tail->next = forget;
--	fc->forget_list_tail = forget;
--	wake_up(&fc->waitq);
--	kill_fasync(&fc->fasync, SIGIO, POLL_IN);
-+	if (fc->connected) {
-+		fc->forget_list_tail->next = forget;
-+		fc->forget_list_tail = forget;
-+		wake_up(&fc->waitq);
-+		kill_fasync(&fc->fasync, SIGIO, POLL_IN);
-+	} else {
-+		kfree(forget);
-+	}
- 	spin_unlock(&fc->lock);
- }
- 
--- 
-1.7.6.4
-
diff --git a/freed-ora/current/f15/hfsplus-ensure-bio-requests-are-not-smaller-than-the.patch b/freed-ora/current/f15/hfsplus-ensure-bio-requests-are-not-smaller-than-the.patch
deleted file mode 100644
index c81bf91d1..000000000
--- a/freed-ora/current/f15/hfsplus-ensure-bio-requests-are-not-smaller-than-the.patch
+++ /dev/null
@@ -1,315 +0,0 @@
-From 6596528e391ad978a6a120142cba97a1d7324cb6 Mon Sep 17 00:00:00 2001
-From: Seth Forshee <seth.forshee@canonical.com>
-Date: Mon, 18 Jul 2011 08:06:23 -0700
-Subject: [PATCH] hfsplus: ensure bio requests are not smaller than the
- hardware sectors
-
-Currently all bio requests are 512 bytes, which may fail for media
-whose physical sector size is larger than this. Ensure these
-requests are not smaller than the block device logical block size.
-
-BugLink: http://bugs.launchpad.net/bugs/734883
-Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
-Signed-off-by: Christoph Hellwig <hch@lst.de>
----
- fs/hfsplus/hfsplus_fs.h |   16 ++++++++-
- fs/hfsplus/part_tbl.c   |   32 ++++++++++--------
- fs/hfsplus/super.c      |   12 +++---
- fs/hfsplus/wrapper.c    |   83 +++++++++++++++++++++++++++++++++++-----------
- 4 files changed, 101 insertions(+), 42 deletions(-)
-
-diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h
-index 0bebf74..81dfd1e 100644
---- a/fs/hfsplus/hfsplus_fs.h
-+++ b/fs/hfsplus/hfsplus_fs.h
-@@ -13,6 +13,7 @@
- #include <linux/fs.h>
- #include <linux/mutex.h>
- #include <linux/buffer_head.h>
-+#include <linux/blkdev.h>
- #include "hfsplus_raw.h"
- 
- #define DBG_BNODE_REFS	0x00000001
-@@ -110,7 +111,9 @@ struct hfsplus_vh;
- struct hfs_btree;
- 
- struct hfsplus_sb_info {
-+	void *s_vhdr_buf;
- 	struct hfsplus_vh *s_vhdr;
-+	void *s_backup_vhdr_buf;
- 	struct hfsplus_vh *s_backup_vhdr;
- 	struct hfs_btree *ext_tree;
- 	struct hfs_btree *cat_tree;
-@@ -258,6 +261,15 @@ struct hfsplus_readdir_data {
- 	struct hfsplus_cat_key key;
- };
- 
-+/*
-+ * Find minimum acceptible I/O size for an hfsplus sb.
-+ */
-+static inline unsigned short hfsplus_min_io_size(struct super_block *sb)
-+{
-+	return max_t(unsigned short, bdev_logical_block_size(sb->s_bdev),
-+		     HFSPLUS_SECTOR_SIZE);
-+}
-+
- #define hfs_btree_open hfsplus_btree_open
- #define hfs_btree_close hfsplus_btree_close
- #define hfs_btree_write hfsplus_btree_write
-@@ -436,8 +448,8 @@ int hfsplus_compare_dentry(const struct dentry *parent,
- /* wrapper.c */
- int hfsplus_read_wrapper(struct super_block *);
- int hfs_part_find(struct super_block *, sector_t *, sector_t *);
--int hfsplus_submit_bio(struct block_device *bdev, sector_t sector,
--		void *data, int rw);
-+int hfsplus_submit_bio(struct super_block *sb, sector_t sector,
-+		void *buf, void **data, int rw);
- 
- /* time macros */
- #define __hfsp_mt2ut(t)		(be32_to_cpu(t) - 2082844800U)
-diff --git a/fs/hfsplus/part_tbl.c b/fs/hfsplus/part_tbl.c
-index 40ad88c..eb355d8 100644
---- a/fs/hfsplus/part_tbl.c
-+++ b/fs/hfsplus/part_tbl.c
-@@ -88,11 +88,12 @@ static int hfs_parse_old_pmap(struct super_block *sb, struct old_pmap *pm,
- 	return -ENOENT;
- }
- 
--static int hfs_parse_new_pmap(struct super_block *sb, struct new_pmap *pm,
--		sector_t *part_start, sector_t *part_size)
-+static int hfs_parse_new_pmap(struct super_block *sb, void *buf,
-+		struct new_pmap *pm, sector_t *part_start, sector_t *part_size)
- {
- 	struct hfsplus_sb_info *sbi = HFSPLUS_SB(sb);
- 	int size = be32_to_cpu(pm->pmMapBlkCnt);
-+	int buf_size = hfsplus_min_io_size(sb);
- 	int res;
- 	int i = 0;
- 
-@@ -107,11 +108,14 @@ static int hfs_parse_new_pmap(struct super_block *sb, struct new_pmap *pm,
- 		if (++i >= size)
- 			return -ENOENT;
- 
--		res = hfsplus_submit_bio(sb->s_bdev,
--					 *part_start + HFS_PMAP_BLK + i,
--					 pm, READ);
--		if (res)
--			return res;
-+		pm = (struct new_pmap *)((u8 *)pm + HFSPLUS_SECTOR_SIZE);
-+		if ((u8 *)pm - (u8 *)buf >= buf_size) {
-+			res = hfsplus_submit_bio(sb,
-+						 *part_start + HFS_PMAP_BLK + i,
-+						 buf, (void **)&pm, READ);
-+			if (res)
-+				return res;
-+		}
- 	} while (pm->pmSig == cpu_to_be16(HFS_NEW_PMAP_MAGIC));
- 
- 	return -ENOENT;
-@@ -124,15 +128,15 @@ static int hfs_parse_new_pmap(struct super_block *sb, struct new_pmap *pm,
- int hfs_part_find(struct super_block *sb,
- 		sector_t *part_start, sector_t *part_size)
- {
--	void *data;
-+	void *buf, *data;
- 	int res;
- 
--	data = kmalloc(HFSPLUS_SECTOR_SIZE, GFP_KERNEL);
--	if (!data)
-+	buf = kmalloc(hfsplus_min_io_size(sb), GFP_KERNEL);
-+	if (!buf)
- 		return -ENOMEM;
- 
--	res = hfsplus_submit_bio(sb->s_bdev, *part_start + HFS_PMAP_BLK,
--				 data, READ);
-+	res = hfsplus_submit_bio(sb, *part_start + HFS_PMAP_BLK,
-+				 buf, &data, READ);
- 	if (res)
- 		goto out;
- 
-@@ -141,13 +145,13 @@ int hfs_part_find(struct super_block *sb,
- 		res = hfs_parse_old_pmap(sb, data, part_start, part_size);
- 		break;
- 	case HFS_NEW_PMAP_MAGIC:
--		res = hfs_parse_new_pmap(sb, data, part_start, part_size);
-+		res = hfs_parse_new_pmap(sb, buf, data, part_start, part_size);
- 		break;
- 	default:
- 		res = -ENOENT;
- 		break;
- 	}
- out:
--	kfree(data);
-+	kfree(buf);
- 	return res;
- }
-diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
-index 84f56e1..c106ca2 100644
---- a/fs/hfsplus/super.c
-+++ b/fs/hfsplus/super.c
-@@ -203,17 +203,17 @@ int hfsplus_sync_fs(struct super_block *sb, int wait)
- 		write_backup = 1;
- 	}
- 
--	error2 = hfsplus_submit_bio(sb->s_bdev,
-+	error2 = hfsplus_submit_bio(sb,
- 				   sbi->part_start + HFSPLUS_VOLHEAD_SECTOR,
--				   sbi->s_vhdr, WRITE_SYNC);
-+				   sbi->s_vhdr_buf, NULL, WRITE_SYNC);
- 	if (!error)
- 		error = error2;
- 	if (!write_backup)
- 		goto out;
- 
--	error2 = hfsplus_submit_bio(sb->s_bdev,
-+	error2 = hfsplus_submit_bio(sb,
- 				  sbi->part_start + sbi->sect_count - 2,
--				  sbi->s_backup_vhdr, WRITE_SYNC);
-+				  sbi->s_backup_vhdr_buf, NULL, WRITE_SYNC);
- 	if (!error)
- 		error2 = error;
- out:
-@@ -257,8 +257,8 @@ static void hfsplus_put_super(struct super_block *sb)
- 	hfs_btree_close(sbi->ext_tree);
- 	iput(sbi->alloc_file);
- 	iput(sbi->hidden_dir);
--	kfree(sbi->s_vhdr);
--	kfree(sbi->s_backup_vhdr);
-+	kfree(sbi->s_vhdr_buf);
-+	kfree(sbi->s_backup_vhdr_buf);
- 	unload_nls(sbi->nls);
- 	kfree(sb->s_fs_info);
- 	sb->s_fs_info = NULL;
-diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c
-index 2f933e8..10e515a 100644
---- a/fs/hfsplus/wrapper.c
-+++ b/fs/hfsplus/wrapper.c
-@@ -31,25 +31,67 @@ static void hfsplus_end_io_sync(struct bio *bio, int err)
- 	complete(bio->bi_private);
- }
- 
--int hfsplus_submit_bio(struct block_device *bdev, sector_t sector,
--		void *data, int rw)
-+/*
-+ * hfsplus_submit_bio - Perfrom block I/O
-+ * @sb: super block of volume for I/O
-+ * @sector: block to read or write, for blocks of HFSPLUS_SECTOR_SIZE bytes
-+ * @buf: buffer for I/O
-+ * @data: output pointer for location of requested data
-+ * @rw: direction of I/O
-+ *
-+ * The unit of I/O is hfsplus_min_io_size(sb), which may be bigger than
-+ * HFSPLUS_SECTOR_SIZE, and @buf must be sized accordingly. On reads
-+ * @data will return a pointer to the start of the requested sector,
-+ * which may not be the same location as @buf.
-+ *
-+ * If @sector is not aligned to the bdev logical block size it will
-+ * be rounded down. For writes this means that @buf should contain data
-+ * that starts at the rounded-down address. As long as the data was
-+ * read using hfsplus_submit_bio() and the same buffer is used things
-+ * will work correctly.
-+ */
-+int hfsplus_submit_bio(struct super_block *sb, sector_t sector,
-+		void *buf, void **data, int rw)
- {
- 	DECLARE_COMPLETION_ONSTACK(wait);
- 	struct bio *bio;
- 	int ret = 0;
-+	unsigned int io_size;
-+	loff_t start;
-+	int offset;
-+
-+	/*
-+	 * Align sector to hardware sector size and find offset. We
-+	 * assume that io_size is a power of two, which _should_
-+	 * be true.
-+	 */
-+	io_size = hfsplus_min_io_size(sb);
-+	start = (loff_t)sector << HFSPLUS_SECTOR_SHIFT;
-+	offset = start & (io_size - 1);
-+	sector &= ~((io_size >> HFSPLUS_SECTOR_SHIFT) - 1);
- 
- 	bio = bio_alloc(GFP_NOIO, 1);
- 	bio->bi_sector = sector;
--	bio->bi_bdev = bdev;
-+	bio->bi_bdev = sb->s_bdev;
- 	bio->bi_end_io = hfsplus_end_io_sync;
- 	bio->bi_private = &wait;
- 
--	/*
--	 * We always submit one sector at a time, so bio_add_page must not fail.
--	 */
--	if (bio_add_page(bio, virt_to_page(data), HFSPLUS_SECTOR_SIZE,
--			 offset_in_page(data)) != HFSPLUS_SECTOR_SIZE)
--		BUG();
-+	if (!(rw & WRITE) && data)
-+		*data = (u8 *)buf + offset;
-+
-+	while (io_size > 0) {
-+		unsigned int page_offset = offset_in_page(buf);
-+		unsigned int len = min_t(unsigned int, PAGE_SIZE - page_offset,
-+					 io_size);
-+
-+		ret = bio_add_page(bio, virt_to_page(buf), len, page_offset);
-+		if (ret != len) {
-+			ret = -EIO;
-+			goto out;
-+		}
-+		io_size -= len;
-+		buf = (u8 *)buf + len;
-+	}
- 
- 	submit_bio(rw, bio);
- 	wait_for_completion(&wait);
-@@ -57,8 +99,9 @@ int hfsplus_submit_bio(struct block_device *bdev, sector_t sector,
- 	if (!bio_flagged(bio, BIO_UPTODATE))
- 		ret = -EIO;
- 
-+out:
- 	bio_put(bio);
--	return ret;
-+	return ret < 0 ? ret : 0;
- }
- 
- static int hfsplus_read_mdb(void *bufptr, struct hfsplus_wd *wd)
-@@ -143,17 +186,17 @@ int hfsplus_read_wrapper(struct super_block *sb)
- 		goto out;
- 
- 	error = -ENOMEM;
--	sbi->s_vhdr = kmalloc(HFSPLUS_SECTOR_SIZE, GFP_KERNEL);
--	if (!sbi->s_vhdr)
-+	sbi->s_vhdr_buf = kmalloc(hfsplus_min_io_size(sb), GFP_KERNEL);
-+	if (!sbi->s_vhdr_buf)
- 		goto out;
--	sbi->s_backup_vhdr = kmalloc(HFSPLUS_SECTOR_SIZE, GFP_KERNEL);
--	if (!sbi->s_backup_vhdr)
-+	sbi->s_backup_vhdr_buf = kmalloc(hfsplus_min_io_size(sb), GFP_KERNEL);
-+	if (!sbi->s_backup_vhdr_buf)
- 		goto out_free_vhdr;
- 
- reread:
--	error = hfsplus_submit_bio(sb->s_bdev,
--				   part_start + HFSPLUS_VOLHEAD_SECTOR,
--				   sbi->s_vhdr, READ);
-+	error = hfsplus_submit_bio(sb, part_start + HFSPLUS_VOLHEAD_SECTOR,
-+				   sbi->s_vhdr_buf, (void **)&sbi->s_vhdr,
-+				   READ);
- 	if (error)
- 		goto out_free_backup_vhdr;
- 
-@@ -183,9 +226,9 @@ reread:
- 		goto reread;
- 	}
- 
--	error = hfsplus_submit_bio(sb->s_bdev,
--				   part_start + part_size - 2,
--				   sbi->s_backup_vhdr, READ);
-+	error = hfsplus_submit_bio(sb, part_start + part_size - 2,
-+				   sbi->s_backup_vhdr_buf,
-+				   (void **)&sbi->s_backup_vhdr, READ);
- 	if (error)
- 		goto out_free_backup_vhdr;
- 
--- 
-1.7.6
-
diff --git a/freed-ora/current/f15/hid-magicmouse-ignore-ivalid-report-id-while-switching-modes-v2.patch b/freed-ora/current/f15/hid-magicmouse-ignore-ivalid-report-id-while-switching-modes-v2.patch
deleted file mode 100644
index cf87d2ad3..000000000
--- a/freed-ora/current/f15/hid-magicmouse-ignore-ivalid-report-id-while-switching-modes-v2.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From 35d851df23b093ee027f827fed2213ae5e88fc7a Mon Sep 17 00:00:00 2001
-From: Jiri Kosina <jkosina@suse.cz>
-Date: Thu, 25 Aug 2011 14:21:37 +0200
-Subject: [PATCH] HID: magicmouse: ignore 'ivalid report id' while switching
- modes, v2
-
-This is basically a more generic respin of 23746a6 ("HID: magicmouse: ignore
-'ivalid report id' while switching modes") which got reverted later by
-c3a492.
-
-It turns out that on some configurations, this is actually still the case
-and we are not able to detect in runtime.
-
-The device reponds with 'invalid report id' when feature report switching it
-into multitouch mode is sent to it.
-
-This has been silently ignored before 0825411ade ("HID: bt: Wait for ACK
-on Sent Reports"), but since this commit, it propagates -EIO from the _raw
-callback .
-
-So let the driver ignore -EIO as response to 0xd7,0x01 report, as that's
-how the device reacts in normal mode.
-
-Sad, but following reality.
-
-This fixes https://bugzilla.kernel.org/show_bug.cgi?id=35022
-
-Reported-by: Chase Douglas <chase.douglas@canonical.com>
-Reported-by: Jaikumar Ganesh <jaikumarg@android.com>
-Tested-by: Chase Douglas <chase.douglas@canonical.com>
-Tested-by: Jaikumar Ganesh <jaikumarg@android.com>
-Signed-off-by: Jiri Kosina <jkosina@suse.cz>
----
- drivers/hid/hid-magicmouse.c |   10 +++++++++-
- 1 files changed, 9 insertions(+), 1 deletions(-)
-
-diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
-index b5bdab3..f0fbd7b 100644
---- a/drivers/hid/hid-magicmouse.c
-+++ b/drivers/hid/hid-magicmouse.c
-@@ -537,9 +537,17 @@ static int magicmouse_probe(struct hid_device *hdev,
- 	}
- 	report->size = 6;
- 
-+	/*
-+	 * Some devices repond with 'invalid report id' when feature
-+	 * report switching it into multitouch mode is sent to it.
-+	 *
-+	 * This results in -EIO from the _raw low-level transport callback,
-+	 * but there seems to be no other way of switching the mode.
-+	 * Thus the super-ugly hacky success check below.
-+	 */
- 	ret = hdev->hid_output_raw_report(hdev, feature, sizeof(feature),
- 			HID_FEATURE_REPORT);
--	if (ret != sizeof(feature)) {
-+	if (ret != -EIO && ret != sizeof(feature)) {
- 		hid_err(hdev, "unable to request touch data (%d)\n", ret);
- 		goto err_stop_hw;
- 	}
--- 
-1.7.5.4
-
diff --git a/freed-ora/current/f15/kernel.spec b/freed-ora/current/f15/kernel.spec
index b89a40362..899a6e26a 100644
--- a/freed-ora/current/f15/kernel.spec
+++ b/freed-ora/current/f15/kernel.spec
@@ -42,7 +42,7 @@ Summary: The Linux kernel
 # When changing real_sublevel below, reset this by hand to 1
 # (or to 0 and then use rpmdev-bumpspec).
 #
-%global baserelease 3
+%global baserelease 2
 %global fedora_build %{baserelease}
 
 # real_sublevel is the 3.x kernel version we're starting with
@@ -65,7 +65,7 @@ Summary: The Linux kernel
 #define libres .
 
 # Do we have a -stable update to apply?
-%define stable_update 7
+%define stable_update 8
 # Is it a -stable RC?
 %define stable_rc 0
 # Set rpm version accordingly
@@ -638,7 +638,6 @@ Patch1500: fix_xen_guest_on_old_EC2.patch
 
 # nouveau + drm fixes
 Patch1810: drm-nouveau-updates.patch
-Patch1811: drm-ttm-nouveau-oops-fix.patch
 # intel drm is all merged upstream
 Patch1824: drm-intel-next.patch
 # make sure the lvds comes back on lid open
@@ -679,7 +678,6 @@ Patch12016: disable-i8042-check-on-apple-mac.patch
 Patch12023: ums-realtek-driver-uses-stack-memory-for-DMA.patch
 Patch12024: usb-add-quirk-for-logitech-webcams.patch
 Patch12025: crypto-register-cryptd-first.patch
-Patch12026: cputimer-Cure-lock-inversion.patch
 Patch12027: x86-efi-Calling-__pa-with-an-ioremap-address-is-invalid.patch
 Patch12028: x86-p4-make-watchdog-and-perf-work-together.patch
 
@@ -690,7 +688,7 @@ Patch12204: linux-2.6-enable-more-pci-autosuspend.patch
 Patch12303: dmar-disable-when-ricoh-multifunction.patch
 
 Patch13001: epoll-fix-spurious-lockdep-warnings.patch
-Patch13002: hfsplus-ensure-bio-requests-are-not-smaller-than-the.patch
+Patch13002: epoll-limit-paths.patch
 
 Patch13010: iwlagn-check-for-priv--txq-in-iwlagn_wait_tx_queue_empty.patch
 
@@ -711,18 +709,9 @@ Patch21003: TEGRA-2.6.40.2-enable-USB-ports.patch
 # rhbz#719607
 Patch21004: vfs-fix-automount-for-negative-autofs-dentries.patch
 
-# rhbz#727927 rhbz#731278 rhbz#732934
-Patch21005: cifs-fix-ERR_PTR-dereference-in-cifs_get_root.patch
-
-# rhbz #735437
-Patch21007: ucvideo-fix-crash-when-linking-entities.patch
-
 # rhbz #740645
 Patch21011: md-dont-delay-reboot-by-1-second-if-no-MD-devices.patch
 
-# rhbz #714381
-Patch21012: hid-magicmouse-ignore-ivalid-report-id-while-switching-modes-v2.patch
-
 # rhbz #496975
 Patch21013: Platform-fix-samsung-laptop-DMI-identification-for-N.patch
 
@@ -736,13 +725,21 @@ Patch21017: binfmt_elf-fix-PIE-execution-with-random-disabled.patch
 #rhbz #722509
 Patch21018: mmc-Always-check-for-lower-base-frequency-quirk-for-.patch
 
-#rhbz #745241
-Patch21019: fuse-fix-memory-leak.patch
-
 #rhbz #735946
 Patch21020: 0001-mm-vmscan-Limit-direct-reclaim-for-higher-order-allo.patch
 Patch21021: 0002-mm-Abort-reclaim-compaction-if-compaction-can-procee.patch
 
+#rhbz 737108
+Patch21030: platform-fix-samsung-brightness-min-max-calculations.patch
+
+#rhbz 748691
+Patch21040: be2net-move-to-new-vlan-model.patch
+Patch21041: be2net-non-member-vlan-pkts-not-received-in-promisco.patch
+Patch21042: benet-remove-bogus-unlikely-on-vlan-check.patch
+
+#rhbz 749166
+Patch21050: xfs-Fix-possible-memory-corruption-in-xfs_readlink.patch
+
 %endif
 
 BuildRoot: %{_tmppath}/kernel-%{KVERREL}-root
@@ -1190,6 +1187,7 @@ ApplyPatch linux-2.6-32bit-mmap-exec-randomization.patch
 # ext4
 
 # xfs
+ApplyPatch xfs-Fix-possible-memory-corruption-in-xfs_readlink.patch
 
 # btrfs
 
@@ -1267,7 +1265,6 @@ ApplyPatch linux-2.6-e1000-ich9-montevina.patch
 ApplyPatch fix_xen_guest_on_old_EC2.patch
 
 # DRM core
-ApplyPatch drm-ttm-nouveau-oops-fix.patch
 
 # Nouveau DRM
 ApplyOptionalPatch drm-nouveau-updates.patch
@@ -1307,7 +1304,6 @@ ApplyPatch add-appleir-usb-driver.patch
 ApplyPatch ums-realtek-driver-uses-stack-memory-for-DMA.patch
 ApplyPatch usb-add-quirk-for-logitech-webcams.patch
 ApplyPatch crypto-register-cryptd-first.patch
-ApplyPatch cputimer-Cure-lock-inversion.patch
 ApplyPatch x86-efi-Calling-__pa-with-an-ioremap-address-is-invalid.patch
 ApplyPatch x86-p4-make-watchdog-and-perf-work-together.patch
 
@@ -1315,8 +1311,7 @@ ApplyPatch x86-p4-make-watchdog-and-perf-work-together.patch
 ApplyPatch dmar-disable-when-ricoh-multifunction.patch
 
 ApplyPatch epoll-fix-spurious-lockdep-warnings.patch
-
-ApplyPatch hfsplus-ensure-bio-requests-are-not-smaller-than-the.patch
+ApplyPatch epoll-limit-paths.patch
 
 ApplyPatch iwlagn-check-for-priv--txq-in-iwlagn_wait_tx_queue_empty.patch
 
@@ -1325,19 +1320,9 @@ ApplyPatch utrace.patch
 # rhbz#719607
 ApplyPatch vfs-fix-automount-for-negative-autofs-dentries.patch
 
-# rhbz#727927 rhbz#731278 rhbz#732934
-# cifs-possible-memory-corruption-on-mount.patch is already queued for 3.0.4
-ApplyPatch cifs-fix-ERR_PTR-dereference-in-cifs_get_root.patch
-
-#rhbz 735437
-ApplyPatch ucvideo-fix-crash-when-linking-entities.patch
-
 #rhbz 740645
 ApplyPatch md-dont-delay-reboot-by-1-second-if-no-MD-devices.patch
 
-# rhbz #714381
-ApplyPatch hid-magicmouse-ignore-ivalid-report-id-while-switching-modes-v2.patch
-
 # rhbz #496675
 ApplyPatch Platform-fix-samsung-laptop-DMI-identification-for-N.patch
 
@@ -1351,13 +1336,18 @@ ApplyPatch binfmt_elf-fix-PIE-execution-with-random-disabled.patch
 #rhbz #722509
 ApplyPatch mmc-Always-check-for-lower-base-frequency-quirk-for-.patch
 
-#rhbz #745241
-ApplyPatch fuse-fix-memory-leak.patch
-
 #rhbz #735946
 ApplyPatch 0001-mm-vmscan-Limit-direct-reclaim-for-higher-order-allo.patch
 ApplyPatch 0002-mm-Abort-reclaim-compaction-if-compaction-can-procee.patch
 
+#rhbz 737108
+ApplyPatch platform-fix-samsung-brightness-min-max-calculations.patch
+
+#rhbz 748691
+ApplyPatch be2net-move-to-new-vlan-model.patch
+ApplyPatch be2net-non-member-vlan-pkts-not-received-in-promisco.patch
+ApplyPatch benet-remove-bogus-unlikely-on-vlan-check.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -1978,6 +1968,22 @@ fi
 # and build.
 
 %changelog
+* Wed Oct 26 2011 Josh Boyer <jwboyer@redhat.com> 2.6.40.8-2
+- CVE-2011-4077: xfs: potential buffer overflow in xfs_readlink() (rhbz 749166)
+
+* Tue Oct 25 2011 Josh Boyer <jwboyer@redhat.com>
+- CVE-2011-3347: be2net: promiscuous mode and non-member VLAN packets DoS (rhbz 748691)
+- CVE-2011-1083: excessive in kernel CPU consumption when creating large nested epoll structures (rhbz 748668)
+
+* Tue Oct 25 2011 Josh Boyer <jwboyer@redhat.com>
+- Linux 3.0.8 stable release
+
+* Mon Oct 24 2011 Chuck Ebbert <cebbert@redhat.com>
+- Add patch from LKML to fix Samsung notebook brightness flicker (rhbz 737108)
+
+* Mon Oct 24 2011 Dave Jones <davej@redhat.com>
+- Print modules list from bad_page()
+
 * Mon Oct 24 2011 Josh Boyer <jwboyer@redhat.com> 2.6.40.7-3
 - Backport 3 fixed from linux-next to fix dib0700 playback (rhbz 733827)
 
diff --git a/freed-ora/current/f15/linux-2.6-debug-taint-vm.patch b/freed-ora/current/f15/linux-2.6-debug-taint-vm.patch
index ee367d45a..672509db2 100644
--- a/freed-ora/current/f15/linux-2.6-debug-taint-vm.patch
+++ b/freed-ora/current/f15/linux-2.6-debug-taint-vm.patch
@@ -1,31 +1,20 @@
-From b04c57d9dc889462951312be2ac81ff6c702e954 Mon Sep 17 00:00:00 2001
-From: Kyle McMartin <kyle@phobos.i.jkkm.org>
-Date: Wed, 8 Jul 2009 13:05:09 -0400
-Subject: [PATCH 3/6] fedora: linux-2.6-debug-taint-vm.patch
-
----
- kernel/panic.c  |    4 +++-
- mm/slab.c       |    8 ++++----
- mm/slub.c       |    2 +-
- 4 files changed, 11 insertions(+), 8 deletions(-)
-
-diff --git a/kernel/panic.c b/kernel/panic.c
-index 984b3ec..6d1c3be 100644
---- a/kernel/panic.c
-+++ b/kernel/panic.c
-@@ -199,6 +199,7 @@ const char *print_tainted(void)
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 4e8985a..70d0853 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -318,6 +318,7 @@ static void bad_page(struct page *page)
+ 		current->comm, page_to_pfn(page));
+ 	dump_page(page);
  
- 	return buf;
- }
-+EXPORT_SYMBOL(print_tainted);
- 
- int test_taint(unsigned flag)
- {
++	print_modules();
+ 	dump_stack();
+ out:
+ 	/* Leave bad fields for debug, except PageBuddy could make trouble */
 diff --git a/mm/slab.c b/mm/slab.c
-index e74a16e..7bc287e 100644
+index d96e223..6f8905b 100644
 --- a/mm/slab.c
 +++ b/mm/slab.c
-@@ -1803,8 +1803,8 @@ static void check_poison_obj(struct kmem_cache *cachep, void *objp)
+@@ -1886,8 +1886,8 @@ static void check_poison_obj(struct kmem_cache *cachep, void *objp)
  			/* Print header */
  			if (lines == 0) {
  				printk(KERN_ERR
@@ -36,7 +25,7 @@ index e74a16e..7bc287e 100644
  				print_objinfo(cachep, objp, 0);
  			}
  			/* Hexdump the affected line */
-@@ -2902,8 +2902,8 @@ static void check_slabp(struct kmem_cache *cachep, struct slab *slabp)
+@@ -2985,8 +2985,8 @@ static void check_slabp(struct kmem_cache *cachep, struct slab *slabp)
  	if (entries != cachep->num - slabp->inuse) {
  bad:
  		printk(KERN_ERR "slab: Internal list corruption detected in "
@@ -48,10 +37,10 @@ index e74a16e..7bc287e 100644
  		     i < sizeof(*slabp) + cachep->num * sizeof(kmem_bufctl_t);
  		     i++) {
 diff --git a/mm/slub.c b/mm/slub.c
-index 819f056..8eff0f4 100644
+index 35f351f..e7ccb39 100644
 --- a/mm/slub.c
 +++ b/mm/slub.c
-@@ -433,7 +433,7 @@ static void slab_bug(struct kmem_cache *s, char *fmt, ...)
+@@ -472,7 +472,7 @@ static void slab_bug(struct kmem_cache *s, char *fmt, ...)
  	va_end(args);
  	printk(KERN_ERR "========================================"
  			"=====================================\n");
@@ -60,6 +49,3 @@ index 819f056..8eff0f4 100644
  	printk(KERN_ERR "----------------------------------------"
  			"-------------------------------------\n\n");
  }
--- 
-1.6.2.5
-
diff --git a/freed-ora/current/f15/patch-libre-3.0.7.bz2.sign b/freed-ora/current/f15/patch-libre-3.0.7.bz2.sign
deleted file mode 100644
index 82af23180..000000000
--- a/freed-ora/current/f15/patch-libre-3.0.7.bz2.sign
+++ /dev/null
@@ -1,7 +0,0 @@
------BEGIN PGP SIGNATURE-----
-Version: GnuPG v2.0.17 (GNU/Linux)
-
-iEYEABECAAYFAk6cfw0ACgkQvLfPh359R6eQQgCfRLUGHDAmUn60+ql2mBXA2LJP
-LDMAn2toF2zJXzvpPmr0qs5dvCFlEsv2
-=Y6O+
------END PGP SIGNATURE-----
diff --git a/freed-ora/current/f15/patch-libre-3.0.8.bz2.sign b/freed-ora/current/f15/patch-libre-3.0.8.bz2.sign
new file mode 100644
index 000000000..591107a5d
--- /dev/null
+++ b/freed-ora/current/f15/patch-libre-3.0.8.bz2.sign
@@ -0,0 +1,7 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.17 (GNU/Linux)
+
+iEYEABECAAYFAk6nYCUACgkQvLfPh359R6cIRACgpiDm4CBrSVSNAqvIGEhaZx2o
+NLAAoIEttwPjLpSB1Vri0Nie+TKTwxDg
+=F7EA
+-----END PGP SIGNATURE-----
diff --git a/freed-ora/current/f15/platform-fix-samsung-brightness-min-max-calculations.patch b/freed-ora/current/f15/platform-fix-samsung-brightness-min-max-calculations.patch
new file mode 100644
index 000000000..6a2c3b8cc
--- /dev/null
+++ b/freed-ora/current/f15/platform-fix-samsung-brightness-min-max-calculations.patch
@@ -0,0 +1,56 @@
+From: Jason Stubbs <jasonbstubbs@gmail.com>
+Subject: [PATCH] platform: fix samsung brightness min/max calculations
+
+For one of the SABI configs, the valid brightness levels are 1 through 8 with
+0 being reserved for the BIOS. To make the range 0-based, the driver is meant
+to offset values to/from userspace by 1 giving valid levels of 0 through 7.
+
+Currently, the driver is reporting a max brightness of 8 and doing the offset
+the wrong way such that setting a brightness of 8 will set as 7 in hardware
+while setting a brightness of 0 will attempt (and fail) to set as -1 in
+hardware.
+
+This patch fixes these calculations as well as a potential miscalculation due
+to an assumption of min_brightness being either 0 or 1.
+
+Signed-off-by: Jason Stubbs <jasonbstubbs@gmail.com>
+Signed-off-by: Chuck Ebbert <cebbert@redhat.com>
+
+---
+Originally posted here, context fixed to apply to 3.0/3.1:
+[ https://lkml.org/lkml/2011/5/11/548 ]
+
+diff a/drivers/platform/x86/samsung-laptop.c b/drivers/platform/x86/samsung-laptop.c
+--- a/drivers/platform/x86/samsung-laptop.c
++++ b/drivers/platform/x86/samsung-laptop.c
+@@ -370,15 +370,17 @@ static u8 read_brightness(void)
+ 				  &sretval);
+ 	if (!retval) {
+ 		user_brightness = sretval.retval[0];
+-		if (user_brightness != 0)
++		if (user_brightness > sabi_config->min_brightness)
+ 			user_brightness -= sabi_config->min_brightness;
++		else
++			user_brightness = 0;
+ 	}
+ 	return user_brightness;
+ }
+ 
+ static void set_brightness(u8 user_brightness)
+ {
+-	u8 user_level = user_brightness - sabi_config->min_brightness;
++	u8 user_level = user_brightness + sabi_config->min_brightness;
+ 
+ 	sabi_set_command(sabi_config->commands.set_brightness, user_level);
+ }
+@@ -802,7 +804,8 @@ static int __init samsung_init(void)
+ 	/* create a backlight device to talk to this one */
+ 	memset(&props, 0, sizeof(struct backlight_properties));
+ 	props.type = BACKLIGHT_PLATFORM;
+-	props.max_brightness = sabi_config->max_brightness;
++	props.max_brightness = sabi_config->max_brightness -
++				sabi_config->min_brightness;
+ 	backlight_device = backlight_device_register("samsung", &sdev->dev,
+ 						     NULL, &backlight_ops,
+ 						     &props);
+_
diff --git a/freed-ora/current/f15/sources b/freed-ora/current/f15/sources
index 156e60b03..c8cb40c70 100644
--- a/freed-ora/current/f15/sources
+++ b/freed-ora/current/f15/sources
@@ -1,2 +1,2 @@
 0bb0fee9a7170014074941d1b089d73b  linux-3.0-libre.tar.bz2
-921caf55697235521e7809786f5d8eb7  patch-libre-3.0.7.bz2
+f47e04e7aa8fe03a5a90eb45ef3c85a6  patch-libre-3.0.8.bz2
diff --git a/freed-ora/current/f15/ucvideo-fix-crash-when-linking-entities.patch b/freed-ora/current/f15/ucvideo-fix-crash-when-linking-entities.patch
deleted file mode 100644
index 69f86d64c..000000000
--- a/freed-ora/current/f15/ucvideo-fix-crash-when-linking-entities.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-The uvc_mc_register_entity() function wrongfully selects the
-media_entity associated with a UVC entity when creating links. This
-results in access to uninitialized media_entity structures and can hit a
-BUG_ON statement in media_entity_create_link(). Fix it.
-
-Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
----
- drivers/media/video/uvc/uvc_entity.c |    2 +-
- 1 files changed, 1 insertions(+), 1 deletions(-)
-
-This patch should fix a v3.0 regression that results in a kernel crash as
-reported in http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=637740 and
-https://bugzilla.redhat.com/show_bug.cgi?id=735437.
-
-Test results will be welcome.
-
-diff --git a/drivers/media/video/uvc/uvc_entity.c b/drivers/media/video/uvc/uvc_entity.c
-index 48fea37..29e2399 100644
---- a/drivers/media/video/uvc/uvc_entity.c
-+++ b/drivers/media/video/uvc/uvc_entity.c
-@@ -49,7 +49,7 @@ static int uvc_mc_register_entity(struct uvc_video_chain *chain,
- 		if (remote == NULL)
- 			return -EINVAL;
- 
--		source = (UVC_ENTITY_TYPE(remote) != UVC_TT_STREAMING)
-+		source = (UVC_ENTITY_TYPE(remote) == UVC_TT_STREAMING)
- 		       ? (remote->vdev ? &remote->vdev->entity : NULL)
- 		       : &remote->subdev.entity;
- 		if (source == NULL)
--- 
-Regards,
-
-Laurent Pinchart
-
diff --git a/freed-ora/current/f15/xfs-Fix-possible-memory-corruption-in-xfs_readlink.patch b/freed-ora/current/f15/xfs-Fix-possible-memory-corruption-in-xfs_readlink.patch
new file mode 100644
index 000000000..319f80dc5
--- /dev/null
+++ b/freed-ora/current/f15/xfs-Fix-possible-memory-corruption-in-xfs_readlink.patch
@@ -0,0 +1,43 @@
+From cbee73333a2d05c274240dff5de1b4bb74bfb497 Mon Sep 17 00:00:00 2001
+From: Carlos Maiolino <cmaiolino@redhat.com>
+Date: Tue, 18 Oct 2011 02:18:58 -0200
+Subject: [PATCH] Fix possible memory corruption in xfs_readlink
+
+Fixes a possible memory corruption when the link is larger than
+MAXPATHLEN and XFS_DEBUG is not enabled. This also remove the
+S_ISLNK assert, since the inode mode is checked previously in
+xfs_readlink_by_handle() and via VFS.
+
+Signed-off-by: Carlos Maiolino <cmaiolino@redhat.com>
+---
+ fs/xfs/xfs_vnodeops.c |   10 +++++++---
+ 1 files changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
+index 6197207..111870b 100644
+--- a/fs/xfs/xfs_vnodeops.c
++++ b/fs/xfs/xfs_vnodeops.c
+@@ -545,13 +545,17 @@ xfs_readlink(
+ 
+ 	xfs_ilock(ip, XFS_ILOCK_SHARED);
+ 
+-	ASSERT((ip->i_d.di_mode & S_IFMT) == S_IFLNK);
+-	ASSERT(ip->i_d.di_size <= MAXPATHLEN);
+-
+ 	pathlen = ip->i_d.di_size;
+ 	if (!pathlen)
+ 		goto out;
+ 
++	if (pathlen > MAXPATHLEN) {
++		xfs_alert(mp, "%s: inode (%llu) symlink length (%d) too long",
++			 __func__, (unsigned long long)ip->i_ino, pathlen);
++		ASSERT(0);
++		return XFS_ERROR(EFSCORRUPTED);
++	}
++
+ 	if (ip->i_df.if_flags & XFS_IFINLINE) {
+ 		memcpy(link, ip->i_df.if_u1.if_data, pathlen);
+ 		link[pathlen] = '\0';
+-- 
+1.7.6.4
+