--- /dev/null
+From ced69c59811f05b2f8378467cbb82ac6ed3c6a5a Mon Sep 17 00:00:00 2001
+From: Alan Jenkins <alan-jenkins@tuffmail.co.uk>
+Date: Sat, 20 Feb 2010 11:02:24 +0000
+Subject: eeepc-laptop: disable wireless hotplug for 1005PE
+
+From: Alan Jenkins <alan-jenkins@tuffmail.co.uk>
+
+commit ced69c59811f05b2f8378467cbb82ac6ed3c6a5a upstream.
+
+The wireless hotplug code is not needed on this model, and it disables
+the wired ethernet card. (Like on the 1005HA and 1201N).
+
+References: <http://lists.alioth.debian.org/pipermail/debian-eeepc-devel/2010-February/003281.html>
+
+Signed-off-by: Alan Jenkins <alan-jenkins@tuffmail.co.uk>
+Reported-by: Ansgar Burchardt <ansgar@43-1.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/eeepc-laptop.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/platform/x86/eeepc-laptop.c
++++ b/drivers/platform/x86/eeepc-laptop.c
+@@ -1277,7 +1277,8 @@ static void eeepc_dmi_check(struct eeepc
+ * hotplug code. In fact, current hotplug code seems to unplug another
+ * device...
+ */
+- if (strcmp(model, "1005HA") == 0 || strcmp(model, "1201N") == 0) {
++ if (strcmp(model, "1005HA") == 0 || strcmp(model, "1201N") == 0 ||
++ strcmp(model, "1005PE") == 0) {
+ eeepc->hotplug_disabled = true;
+ pr_info("wlan hotplug disabled\n");
+ }
--- /dev/null
+From cbaee472f274ea9a98aabe47025f6e5551acadcb Mon Sep 17 00:00:00 2001
+From: Tao Ma <tao.ma@oracle.com>
+Date: Fri, 26 Feb 2010 10:54:52 +0800
+Subject: ocfs2: Only bug out in direct io write for reflinked extent.
+
+From: Tao Ma <tao.ma@oracle.com>
+
+commit cbaee472f274ea9a98aabe47025f6e5551acadcb upstream.
+
+In ocfs2_direct_IO_get_blocks, we only need to bug out
+in case of we are going to write a recounted extent rec.
+
+What a silly bug introduced by me!
+
+Signed-off-by: Tao Ma <tao.ma@oracle.com>
+Signed-off-by: Joel Becker <joel.becker@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ocfs2/aops.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/fs/ocfs2/aops.c
++++ b/fs/ocfs2/aops.c
+@@ -577,8 +577,9 @@ static int ocfs2_direct_IO_get_blocks(st
+ goto bail;
+ }
+
+- /* We should already CoW the refcounted extent. */
+- BUG_ON(ext_flags & OCFS2_EXT_REFCOUNTED);
++ /* We should already CoW the refcounted extent in case of create. */
++ BUG_ON(create && (ext_flags & OCFS2_EXT_REFCOUNTED));
++
+ /*
+ * get_more_blocks() expects us to describe a hole by clearing
+ * the mapped bit on bh_result().
netfilter-xt_recent-fix-false-match.patch
sunxvr500-additional-pci-id-for-sunxvr500-driver.patch
mac80211-do-not-transmit-frames-on-unconfigured-4-addr-vlan-interfaces.patch
+eeepc-laptop-disable-wireless-hotplug-for-1005pe.patch
+thinkpad-acpi-fix-poll-thread-auto-start.patch
+thinkpad-acpi-r52-brightness_mode-has-been-confirmed.patch
+thinkpad-acpi-document-hkey-event-3006.patch
+thinkpad-acpi-make-driver-events-work-in-nvram-poll-mode.patch
+thinkpad-acpi-fix-bluetooth-wwan-resume.patch
+thinkpad-acpi-lock-down-video-output-state-access.patch
+ocfs2-only-bug-out-in-direct-io-write-for-reflinked-extent.patch
+x86-ia32_aout-do-not-kill-argument-mapping.patch
+x86-add-imac9-1-to-pci_reboot_dmi_table.patch
+x86-xen-disable-highmem-pte-allocation-even-when-config_highpte-y.patch
+x86-avoid-race-condition-in-pci_enable_msix.patch
+x86-fix-sci-on-ioapic-0.patch
+usb-xhci-fix-finding-extended-capabilities-registers.patch
+usb-fix-the-idproduct-value-for-usb-3.0-root-hubs.patch
+usb-fix-crash-in-uhci_scan_schedule.patch
+usb-remove-debugging-message-for-uevent-constructions.patch
+usb-move-hcd-free_dev-call-into-usb_disconnect-to-fix-oops.patch
+usb-f_mass_storage-fix-crash-on-bind-error.patch
+usb-add-new-ftdi_sio-device-ids.patch
sched-fix-sched_mv_power_savings-for-smt.patch
sched-fix-smt-scheduler-regression-in-find_busiest_queue.patch
sched-don-t-use-possibly-stale-sched_class.patch
--- /dev/null
+From bf8b29c8f7f8269e99eca8b19048ed5b34b51810 Mon Sep 17 00:00:00 2001
+From: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Date: Thu, 25 Feb 2010 21:28:56 -0300
+Subject: thinkpad-acpi: document HKEY event 3006
+
+From: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+
+commit bf8b29c8f7f8269e99eca8b19048ed5b34b51810 upstream.
+
+Event 0x3006 is used to help power management of the ODD in the
+UltraBay. The EC generates this event when the ODD eject button is
+pressed (even if the bay is powered down).
+
+Normally, Linux doesn't need this as we keep the SATA link powered
+up (which wastes power). The EC powers up the bay by itself when the
+ODD eject button is pressed, and the SATA PHY reports the hotplug.
+
+However, we could also power that SATA link down (and for that matter,
+also power down the Ultrabay) if the ODD is left idle for a while with
+no disk inside, and use event 0x3006 to know when we need that SATA link
+powered back up.
+
+For now, just stop asking for more information when event 0x3006 is
+seen, there is no point in pestering users about it anymore.
+
+Signed-off-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/thinkpad_acpi.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -3650,13 +3650,19 @@ static void hotkey_notify(struct ibm_str
+ break;
+ case 3:
+ /* 0x3000-0x3FFF: bay-related wakeups */
+- if (hkey == TP_HKEY_EV_BAYEJ_ACK) {
++ switch (hkey) {
++ case TP_HKEY_EV_BAYEJ_ACK:
+ hotkey_autosleep_ack = 1;
+ printk(TPACPI_INFO
+ "bay ejected\n");
+ hotkey_wakeup_hotunplug_complete_notify_change();
+ known_ev = true;
+- } else {
++ break;
++ case TP_HKEY_EV_OPTDRV_EJ:
++ /* FIXME: kick libata if SATA link offline */
++ known_ev = true;
++ break;
++ default:
+ known_ev = false;
+ }
+ break;
--- /dev/null
+From 08fedfc903c78e380b0baa7b57c52d367794d0a5 Mon Sep 17 00:00:00 2001
+From: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Date: Thu, 25 Feb 2010 22:22:07 -0300
+Subject: thinkpad-acpi: fix bluetooth/wwan resume
+
+From: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+
+commit 08fedfc903c78e380b0baa7b57c52d367794d0a5 upstream.
+
+Studying the DSDTs of various thinkpads, it looks like bit 3 of the
+argument to SBDC and SWAN is not "set radio to last state on resume".
+Rather, it seems to be "if this bit is set, enable radio on resume,
+otherwise disable it on resume".
+
+So, the proper way to prepare the radios for S3 suspend is: disable
+radio and clear bit 3 on the SBDC/SWAN call to to resume with radio
+disabled, and enable radio and set bit 3 on the SBDC/SWAN call to
+resume with the radio enabled.
+
+Also, for persistent devices, the rfkill core does not restore state,
+so we really need to get the firmware to do the right thing.
+
+We don't sync the radio state on suspend, instead we trust the BIOS to
+not do anything weird if we never touched the radio state since boot.
+Time will tell if that's a wise way of doing things...
+
+Signed-off-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/thinkpad_acpi.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -3878,7 +3878,7 @@ enum {
+ TP_ACPI_BLUETOOTH_HWPRESENT = 0x01, /* Bluetooth hw available */
+ TP_ACPI_BLUETOOTH_RADIOSSW = 0x02, /* Bluetooth radio enabled */
+ TP_ACPI_BLUETOOTH_RESUMECTRL = 0x04, /* Bluetooth state at resume:
+- off / last state */
++ 0 = disable, 1 = enable */
+ };
+
+ enum {
+@@ -3924,10 +3924,11 @@ static int bluetooth_set_status(enum tpa
+ }
+ #endif
+
+- /* We make sure to keep TP_ACPI_BLUETOOTH_RESUMECTRL off */
+- status = TP_ACPI_BLUETOOTH_RESUMECTRL;
+ if (state == TPACPI_RFK_RADIO_ON)
+- status |= TP_ACPI_BLUETOOTH_RADIOSSW;
++ status = TP_ACPI_BLUETOOTH_RADIOSSW
++ | TP_ACPI_BLUETOOTH_RESUMECTRL;
++ else
++ status = 0;
+
+ if (!acpi_evalf(hkey_handle, NULL, "SBDC", "vd", status))
+ return -EIO;
+@@ -4078,7 +4079,7 @@ enum {
+ TP_ACPI_WANCARD_HWPRESENT = 0x01, /* Wan hw available */
+ TP_ACPI_WANCARD_RADIOSSW = 0x02, /* Wan radio enabled */
+ TP_ACPI_WANCARD_RESUMECTRL = 0x04, /* Wan state at resume:
+- off / last state */
++ 0 = disable, 1 = enable */
+ };
+
+ #define TPACPI_RFK_WWAN_SW_NAME "tpacpi_wwan_sw"
+@@ -4115,10 +4116,11 @@ static int wan_set_status(enum tpacpi_rf
+ }
+ #endif
+
+- /* We make sure to set TP_ACPI_WANCARD_RESUMECTRL */
+- status = TP_ACPI_WANCARD_RESUMECTRL;
+ if (state == TPACPI_RFK_RADIO_ON)
+- status |= TP_ACPI_WANCARD_RADIOSSW;
++ status = TP_ACPI_WANCARD_RADIOSSW
++ | TP_ACPI_WANCARD_RESUMECTRL;
++ else
++ status = 0;
+
+ if (!acpi_evalf(hkey_handle, NULL, "SWAN", "vd", status))
+ return -EIO;
--- /dev/null
+From b589ea4c44170d3f7a845684e2d1b3b9571663af Mon Sep 17 00:00:00 2001
+From: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Date: Thu, 25 Feb 2010 21:28:58 -0300
+Subject: thinkpad-acpi: fix poll thread auto-start
+
+From: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+
+commit b589ea4c44170d3f7a845684e2d1b3b9571663af upstream.
+
+The driver was not starting the NVRAM polling thread if the input
+device was bound immediately after registration.
+
+This fixes:
+http://bugzilla.kernel.org/show_bug.cgi?id=15118
+
+Reported-by: Florian Zumbiehl <florz@florz.de>
+Signed-off-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/thinkpad_acpi.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -2607,16 +2607,11 @@ static int hotkey_inputdev_open(struct i
+ {
+ switch (tpacpi_lifecycle) {
+ case TPACPI_LIFE_INIT:
+- /*
+- * hotkey_init will call hotkey_poll_setup_safe
+- * at the appropriate moment
+- */
+- return 0;
+- case TPACPI_LIFE_EXITING:
+- return -EBUSY;
+ case TPACPI_LIFE_RUNNING:
+ hotkey_poll_setup_safe(false);
+ return 0;
++ case TPACPI_LIFE_EXITING:
++ return -EBUSY;
+ }
+
+ /* Should only happen if tpacpi_lifecycle is corrupt */
+@@ -2627,7 +2622,7 @@ static int hotkey_inputdev_open(struct i
+ static void hotkey_inputdev_close(struct input_dev *dev)
+ {
+ /* disable hotkey polling when possible */
+- if (tpacpi_lifecycle == TPACPI_LIFE_RUNNING &&
++ if (tpacpi_lifecycle != TPACPI_LIFE_EXITING &&
+ !(hotkey_source_mask & hotkey_driver_mask))
+ hotkey_poll_setup_safe(false);
+ }
+@@ -9051,6 +9046,9 @@ static int __init thinkpad_acpi_module_i
+ return ret;
+ }
+ }
++
++ tpacpi_lifecycle = TPACPI_LIFE_RUNNING;
++
+ ret = input_register_device(tpacpi_inputdev);
+ if (ret < 0) {
+ printk(TPACPI_ERR "unable to register input device\n");
+@@ -9060,7 +9058,6 @@ static int __init thinkpad_acpi_module_i
+ tp_features.input_device_registered = 1;
+ }
+
+- tpacpi_lifecycle = TPACPI_LIFE_RUNNING;
+ return 0;
+ }
+
--- /dev/null
+From b525c06cdbd8a3963f0173ccd23f9147d4c384b5 Mon Sep 17 00:00:00 2001
+From: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Date: Thu, 25 Feb 2010 22:22:22 -0300
+Subject: thinkpad-acpi: lock down video output state access
+
+From: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+
+commit b525c06cdbd8a3963f0173ccd23f9147d4c384b5 upstream.
+
+Given the right combination of ThinkPad and X.org, just reading the
+video output control state is enough to hard-crash X.org.
+
+Until the day I somehow find out a model or BIOS cut date to not
+provide this feature to ThinkPads that can do video switching through
+X RandR, change permissions so that only processes with CAP_SYS_ADMIN
+can access any sort of video output control state.
+
+This bug could be considered a local DoS I suppose, as it allows any
+non-privledged local user to cause some versions of X.org to
+hard-crash some ThinkPads.
+
+Reported-by: Jidanni <jidanni@jidanni.org>
+Signed-off-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/laptops/thinkpad-acpi.txt | 4 ++++
+ drivers/platform/x86/Kconfig | 10 ++++++++--
+ drivers/platform/x86/thinkpad_acpi.c | 15 +++++++++++++--
+ 3 files changed, 25 insertions(+), 4 deletions(-)
+
+--- a/Documentation/laptops/thinkpad-acpi.txt
++++ b/Documentation/laptops/thinkpad-acpi.txt
+@@ -650,6 +650,10 @@ LCD, CRT or DVI (if available). The foll
+ echo expand_toggle > /proc/acpi/ibm/video
+ echo video_switch > /proc/acpi/ibm/video
+
++NOTE: Access to this feature is restricted to processes owning the
++CAP_SYS_ADMIN capability for safety reasons, as it can interact badly
++enough with some versions of X.org to crash it.
++
+ Each video output device can be enabled or disabled individually.
+ Reading /proc/acpi/ibm/video shows the status of each device.
+
+--- a/drivers/platform/x86/Kconfig
++++ b/drivers/platform/x86/Kconfig
+@@ -319,9 +319,15 @@ config THINKPAD_ACPI_VIDEO
+ server running, phase of the moon, and the current mood of
+ Schroedinger's cat. If you can use X.org's RandR to control
+ your ThinkPad's video output ports instead of this feature,
+- don't think twice: do it and say N here to save some memory.
++ don't think twice: do it and say N here to save memory and avoid
++ bad interactions with X.org.
+
+- If you are not sure, say Y here.
++ NOTE: access to this feature is limited to processes with the
++ CAP_SYS_ADMIN capability, to avoid local DoS issues in platforms
++ where it interacts badly with X.org.
++
++ If you are not sure, say Y here but do try to check if you could
++ be using X.org RandR instead.
+
+ config THINKPAD_ACPI_HOTKEY_POLL
+ bool "Support NVRAM polling for hot keys"
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -286,6 +286,7 @@ struct ibm_init_struct {
+ char param[32];
+
+ int (*init) (struct ibm_init_struct *);
++ mode_t base_procfs_mode;
+ struct ibm_struct *data;
+ };
+
+@@ -4629,6 +4630,10 @@ static int video_read(struct seq_file *m
+ return 0;
+ }
+
++ /* Even reads can crash X.org, so... */
++ if (!capable(CAP_SYS_ADMIN))
++ return -EPERM;
++
+ status = video_outputsw_get();
+ if (status < 0)
+ return status;
+@@ -4662,6 +4667,10 @@ static int video_write(char *buf)
+ if (video_supported == TPACPI_VIDEO_NONE)
+ return -ENODEV;
+
++ /* Even reads can crash X.org, let alone writes... */
++ if (!capable(CAP_SYS_ADMIN))
++ return -EPERM;
++
+ enable = 0;
+ disable = 0;
+
+@@ -8506,9 +8515,10 @@ static int __init ibm_init(struct ibm_in
+ "%s installed\n", ibm->name);
+
+ if (ibm->read) {
+- mode_t mode;
++ mode_t mode = iibm->base_procfs_mode;
+
+- mode = S_IRUGO;
++ if (!mode)
++ mode = S_IRUGO;
+ if (ibm->write)
+ mode |= S_IWUSR;
+ entry = proc_create_data(ibm->name, mode, proc_dir,
+@@ -8699,6 +8709,7 @@ static struct ibm_init_struct ibms_init[
+ #ifdef CONFIG_THINKPAD_ACPI_VIDEO
+ {
+ .init = video_init,
++ .base_procfs_mode = S_IRUSR,
+ .data = &video_driver_data,
+ },
+ #endif
--- /dev/null
+From 7f0cf712a74fcc3ad21f0bde95bd32c2f2cc3888 Mon Sep 17 00:00:00 2001
+From: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Date: Thu, 25 Feb 2010 21:29:00 -0300
+Subject: thinkpad-acpi: make driver events work in NVRAM poll mode
+
+From: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+
+commit 7f0cf712a74fcc3ad21f0bde95bd32c2f2cc3888 upstream.
+
+Thadeu Lima de Souza Cascardo reports this:
+
+Brightness notification does not work until the user writes to
+hotkey_mask attribute. That's because the polling thread will only run
+if hotkey_user_mask is set and someone is reading the input device or
+if hotkey_driver_mask is set. In this second case, this condition is
+not tested after the mask is changed, because the brightness and
+volume drivers are started after the hotkey drivers.
+
+Fix tpacpi_hotkey_driver_mask_set() to call hotkey_poll_setup(), so
+that the poller kthread will be started when needed.
+
+Reported-by: Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
+Tested-by: Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
+Signed-off-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/thinkpad_acpi.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -2082,6 +2082,7 @@ static struct attribute_set *hotkey_dev_
+
+ static void tpacpi_driver_event(const unsigned int hkey_event);
+ static void hotkey_driver_event(const unsigned int scancode);
++static void hotkey_poll_setup(const bool may_warn);
+
+ /* HKEY.MHKG() return bits */
+ #define TP_HOTKEY_TABLET_MASK (1 << 3)
+@@ -2264,6 +2265,8 @@ static int tpacpi_hotkey_driver_mask_set
+
+ rc = hotkey_mask_set((hotkey_acpi_mask | hotkey_driver_mask) &
+ ~hotkey_source_mask);
++ hotkey_poll_setup(true);
++
+ mutex_unlock(&hotkey_mutex);
+
+ return rc;
+@@ -2548,7 +2551,7 @@ static void hotkey_poll_stop_sync(void)
+ }
+
+ /* call with hotkey_mutex held */
+-static void hotkey_poll_setup(bool may_warn)
++static void hotkey_poll_setup(const bool may_warn)
+ {
+ const u32 poll_driver_mask = hotkey_driver_mask & hotkey_source_mask;
+ const u32 poll_user_mask = hotkey_user_mask & hotkey_source_mask;
+@@ -2579,7 +2582,7 @@ static void hotkey_poll_setup(bool may_w
+ }
+ }
+
+-static void hotkey_poll_setup_safe(bool may_warn)
++static void hotkey_poll_setup_safe(const bool may_warn)
+ {
+ mutex_lock(&hotkey_mutex);
+ hotkey_poll_setup(may_warn);
+@@ -2597,7 +2600,11 @@ static void hotkey_poll_set_freq(unsigne
+
+ #else /* CONFIG_THINKPAD_ACPI_HOTKEY_POLL */
+
+-static void hotkey_poll_setup_safe(bool __unused)
++static void hotkey_poll_setup(const bool __unused)
++{
++}
++
++static void hotkey_poll_setup_safe(const bool __unused)
+ {
+ }
+
--- /dev/null
+From 7d1894d8d1c411d2dad95abfe0f65bacf68c4afa Mon Sep 17 00:00:00 2001
+From: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Date: Thu, 25 Feb 2010 21:28:56 -0300
+Subject: thinkpad-acpi: R52 brightness_mode has been confirmed
+
+From: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+
+commit 7d1894d8d1c411d2dad95abfe0f65bacf68c4afa upstream.
+
+We can stop pestering users for confirmation of the brightness_mode
+default for firmware TP-76.
+
+While at it, add a few missing comments in that quirk table.
+
+Reported-by: Whoopie <whoopie79@gmx.net>
+Signed-off-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/thinkpad_acpi.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -6128,13 +6128,13 @@ static const struct tpacpi_quirk brightn
+ TPACPI_Q_IBM('1', 'Y', TPACPI_BRGHT_Q_EC), /* T43/p ATI */
+
+ /* Models with ATI GPUs that can use ECNVRAM */
+- TPACPI_Q_IBM('1', 'R', TPACPI_BRGHT_Q_EC),
++ TPACPI_Q_IBM('1', 'R', TPACPI_BRGHT_Q_EC), /* R50,51 T40-42 */
+ TPACPI_Q_IBM('1', 'Q', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
+- TPACPI_Q_IBM('7', '6', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
++ TPACPI_Q_IBM('7', '6', TPACPI_BRGHT_Q_EC), /* R52 */
+ TPACPI_Q_IBM('7', '8', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
+
+ /* Models with Intel Extreme Graphics 2 */
+- TPACPI_Q_IBM('1', 'U', TPACPI_BRGHT_Q_NOEC),
++ TPACPI_Q_IBM('1', 'U', TPACPI_BRGHT_Q_NOEC), /* X40 */
+ TPACPI_Q_IBM('1', 'V', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
+ TPACPI_Q_IBM('1', 'W', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
+
--- /dev/null
+From 9714080d20f2ec4b671a06ce69367d91fa9e227e Mon Sep 17 00:00:00 2001
+From: Mitchell Solomon <mitchjs@rush2112.net>
+Date: Fri, 12 Feb 2010 13:23:18 -0500
+Subject: USB: add new ftdi_sio device ids
+
+From: Mitchell Solomon <mitchjs@rush2112.net>
+
+commit 9714080d20f2ec4b671a06ce69367d91fa9e227e upstream.
+
+PID patch for my products
+
+Signed-off-by: Mitchell Solomon <mitchjs@rush2112.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 4 ++++
+ drivers/usb/serial/ftdi_sio_ids.h | 8 ++++++++
+ 2 files changed, 12 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -737,6 +737,10 @@ static struct usb_device_id id_table_com
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(FTDI_VID, HAMEG_HO820_PID) },
+ { USB_DEVICE(FTDI_VID, HAMEG_HO870_PID) },
++ { USB_DEVICE(FTDI_VID, MJSG_GENERIC_PID) },
++ { USB_DEVICE(FTDI_VID, MJSG_SR_RADIO_PID) },
++ { USB_DEVICE(FTDI_VID, MJSG_HD_RADIO_PID) },
++ { USB_DEVICE(FTDI_VID, MJSG_XM_RADIO_PID) },
+ { }, /* Optional parameter entry */
+ { } /* Terminating entry */
+ };
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -1002,3 +1002,11 @@
+ #define EVO_8U232AM_PID 0x02FF /* Evolution robotics RCM2 (FT232AM)*/
+ #define EVO_HYBRID_PID 0x0302 /* Evolution robotics RCM4 PID (FT232BM)*/
+ #define EVO_RCM4_PID 0x0303 /* Evolution robotics RCM4 PID */
++
++/*
++ * MJS Gadgets HD Radio / XM Radio / Sirius Radio interfaces (using VID 0x0403)
++ */
++#define MJSG_GENERIC_PID 0x9378
++#define MJSG_SR_RADIO_PID 0x9379
++#define MJSG_XM_RADIO_PID 0x937A
++#define MJSG_HD_RADIO_PID 0x937C
--- /dev/null
+From 8e7e61dfbf1ec6418bf89505980b158a8d00d877 Mon Sep 17 00:00:00 2001
+From: Peter Korsgaard <jacmet@sunsite.dk>
+Date: Thu, 4 Feb 2010 17:15:25 +0100
+Subject: USB: f_mass_storage: fix crash on bind() error
+
+From: Peter Korsgaard <jacmet@sunsite.dk>
+
+commit 8e7e61dfbf1ec6418bf89505980b158a8d00d877 upstream.
+
+init_completion() hasn't been called yet and the thread isn't created
+if we end up here, so don't call complete() on thread_notifier.
+
+Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
+Acked-by: Michal Nazarewicz <m.nazarewicz@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/gadget/f_mass_storage.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/usb/gadget/f_mass_storage.c
++++ b/drivers/usb/gadget/f_mass_storage.c
+@@ -2852,7 +2852,6 @@ error_release:
+ /* Call fsg_common_release() directly, ref might be not
+ * initialised */
+ fsg_common_release(&common->ref);
+- complete(&common->thread_notifier);
+ return ERR_PTR(rc);
+ }
+
--- /dev/null
+From d23356da714595b888686d22cd19061323c09190 Mon Sep 17 00:00:00 2001
+From: Pete Zaitcev <zaitcev@redhat.com>
+Date: Fri, 8 Jan 2010 15:39:22 -0700
+Subject: USB: fix crash in uhci_scan_schedule
+
+From: Pete Zaitcev <zaitcev@redhat.com>
+
+commit d23356da714595b888686d22cd19061323c09190 upstream.
+
+When hardware is removed on a Stratus, the system may crash like this:
+
+ACPI: PCI interrupt for device 0000:7c:00.1 disabled
+Trying to free nonexistent resource <00000000a8000000-00000000afffffff>
+Trying to free nonexistent resource <00000000a4800000-00000000a480ffff>
+uhci_hcd 0000:7e:1d.0: remove, state 1
+usb usb2: USB disconnect, address 1
+usb 2-1: USB disconnect, address 2
+Unable to handle kernel paging request at 0000000000100100 RIP:
+ [<ffffffff88021950>] :uhci_hcd:uhci_scan_schedule+0xa2/0x89c
+
+ #4 [ffff81011de17e50] uhci_scan_schedule at ffffffff88021918
+ #5 [ffff81011de17ed0] uhci_irq at ffffffff88023cb8
+ #6 [ffff81011de17f10] usb_hcd_irq at ffffffff801f1c1f
+ #7 [ffff81011de17f20] handle_IRQ_event at ffffffff8001123b
+ #8 [ffff81011de17f50] __do_IRQ at ffffffff800ba749
+
+This occurs because an interrupt scans uhci->skelqh, which is
+being freed. We do the right thing: disable the interrupts in the
+device, and do not do any processing if the interrupt is shared
+with other source, but it's possible that another CPU gets
+delayed somewhere (e.g. loops) until we started freeing.
+
+The agreed-upon solution is to wait for interrupts to play out
+before proceeding. No other bareers are neceesary.
+
+A backport of this patch was tested on a 2.6.18 based kernel.
+Testing of 2.6.32-based kernels is under way, but it takes us
+forever (months) to turn this around. So I think it's a good
+patch and we should keep it.
+
+Tracked in RH bz#516851
+
+Signed-Off-By: Pete Zaitcev <zaitcev@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/uhci-hcd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/host/uhci-hcd.c
++++ b/drivers/usb/host/uhci-hcd.c
+@@ -735,6 +735,7 @@ static void uhci_stop(struct usb_hcd *hc
+ uhci_hc_died(uhci);
+ uhci_scan_schedule(uhci);
+ spin_unlock_irq(&uhci->lock);
++ synchronize_irq(hcd->irq);
+
+ del_timer_sync(&uhci->fsbr_timer);
+ release_uhci(uhci);
--- /dev/null
+From cd780694920fbf869b23c8afb0bd083e7b0448c7 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Thu, 25 Feb 2010 13:19:37 -0500
+Subject: USB: fix the idProduct value for USB-3.0 root hubs
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit cd780694920fbf869b23c8afb0bd083e7b0448c7 upstream.
+
+This patch (as1346) changes the idProduct value for USB-3.0 root hubs
+from 0x0002 (which we already use for USB-2.0 root hubs) to 0x0003.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Acked-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/hcd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -141,7 +141,7 @@ static const u8 usb3_rh_dev_descriptor[1
+ 0x09, /* __u8 bMaxPacketSize0; 2^9 = 512 Bytes */
+
+ 0x6b, 0x1d, /* __le16 idVendor; Linux Foundation */
+- 0x02, 0x00, /* __le16 idProduct; device 0x0002 */
++ 0x03, 0x00, /* __le16 idProduct; device 0x0003 */
+ KERNEL_VER, KERNEL_REL, /* __le16 bcdDevice */
+
+ 0x03, /* __u8 iManufacturer; */
--- /dev/null
+From f7410ced7f931bb1ad79d1336412cf7b7a33cb14 Mon Sep 17 00:00:00 2001
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Date: Sun, 10 Jan 2010 20:15:03 +1100
+Subject: USB: Move hcd free_dev call into usb_disconnect to fix oops
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+commit f7410ced7f931bb1ad79d1336412cf7b7a33cb14 upstream.
+
+USB: Move hcd free_dev call into usb_disconnect
+
+I found a way to oops the kernel:
+
+1. Open a USB device through devio.
+2. Remove the hcd module in the host kernel.
+3. Close the devio file descriptor.
+
+The problem is that closing the file descriptor does usb_release_dev
+as it is the last reference. usb_release_dev then tries to invoke
+the hcd free_dev function (or rather dereferencing the hcd driver
+struct). This causes an oops as the hcd driver has already been
+unloaded so the struct is gone.
+
+This patch tries to fix this by bringing the free_dev call earlier
+and into usb_disconnect. I have verified that repeating the
+above steps no longer crashes with this patch applied.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/hcd.h | 2 +-
+ drivers/usb/core/hub.c | 12 ++++++++++++
+ drivers/usb/core/usb.c | 3 ---
+ 3 files changed, 13 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/core/hcd.h
++++ b/drivers/usb/core/hcd.h
+@@ -248,7 +248,7 @@ struct hc_driver {
+ /* xHCI specific functions */
+ /* Called by usb_alloc_dev to alloc HC device structures */
+ int (*alloc_dev)(struct usb_hcd *, struct usb_device *);
+- /* Called by usb_release_dev to free HC device structures */
++ /* Called by usb_disconnect to free HC device structures */
+ void (*free_dev)(struct usb_hcd *, struct usb_device *);
+
+ /* Bandwidth computation functions */
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1554,6 +1554,15 @@ static inline void usb_stop_pm(struct us
+
+ #endif
+
++static void hub_free_dev(struct usb_device *udev)
++{
++ struct usb_hcd *hcd = bus_to_hcd(udev->bus);
++
++ /* Root hubs aren't real devices, so don't free HCD resources */
++ if (hcd->driver->free_dev && udev->parent)
++ hcd->driver->free_dev(hcd, udev);
++}
++
+ /**
+ * usb_disconnect - disconnect a device (usbcore-internal)
+ * @pdev: pointer to device being disconnected
+@@ -1624,6 +1633,8 @@ void usb_disconnect(struct usb_device **
+
+ usb_stop_pm(udev);
+
++ hub_free_dev(udev);
++
+ put_device(&udev->dev);
+ }
+
+@@ -3191,6 +3202,7 @@ loop_disable:
+ loop:
+ usb_ep0_reinit(udev);
+ release_address(udev);
++ hub_free_dev(udev);
+ usb_put_dev(udev);
+ if ((status == -ENOTCONN) || (status == -ENOTSUPP))
+ break;
+--- a/drivers/usb/core/usb.c
++++ b/drivers/usb/core/usb.c
+@@ -228,9 +228,6 @@ static void usb_release_dev(struct devic
+ hcd = bus_to_hcd(udev->bus);
+
+ usb_destroy_configuration(udev);
+- /* Root hubs aren't real devices, so don't free HCD resources */
+- if (hcd->driver->free_dev && udev->parent)
+- hcd->driver->free_dev(hcd, udev);
+ usb_put_hcd(hcd);
+ kfree(udev->product);
+ kfree(udev->manufacturer);
--- /dev/null
+From cceffe9348f93188d7811bda95924d4bd3040d0f Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Mon, 8 Feb 2010 09:45:12 -0500
+Subject: USB: remove debugging message for uevent constructions
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit cceffe9348f93188d7811bda95924d4bd3040d0f upstream.
+
+This patch (as1332) removes an unneeded and annoying debugging message
+announcing all USB uevent constructions.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/driver.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/usb/core/driver.c
++++ b/drivers/usb/core/driver.c
+@@ -691,9 +691,6 @@ static int usb_uevent(struct device *dev
+ {
+ struct usb_device *usb_dev;
+
+- /* driver is often null here; dev_dbg() would oops */
+- pr_debug("usb %s: uevent\n", dev_name(dev));
+-
+ if (is_usb_device(dev)) {
+ usb_dev = to_usb_device(dev);
+ } else if (is_usb_interface(dev)) {
+@@ -705,6 +702,7 @@ static int usb_uevent(struct device *dev
+ }
+
+ if (usb_dev->devnum < 0) {
++ /* driver is often null here; dev_dbg() would oops */
+ pr_debug("usb %s: already deleted?\n", dev_name(dev));
+ return -ENODEV;
+ }
--- /dev/null
+From 05197921ff3dad52d99fd1647974c57d9c28d40e Mon Sep 17 00:00:00 2001
+From: Edward Shao <laface.tw@gmail.com>
+Date: Thu, 11 Feb 2010 03:37:30 +0800
+Subject: USB: xhci: Fix finding extended capabilities registers
+
+From: Edward Shao <laface.tw@gmail.com>
+
+commit 05197921ff3dad52d99fd1647974c57d9c28d40e upstream.
+
+According "5.3.6 Capability Parameters (HCCPARAMS)" of xHCI rev0.96 spec,
+value of xECP register indicates a relative offset, in 32-bit words,
+from Base to the beginning of the first extended capability.
+The wrong calculation will cause BIOS handoff fail (not handoff from BIOS)
+in some platform with BIOS USB legacy sup support.
+
+Signed-off-by: Edward Shao <laface.tw@gmail.com>
+Cc: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/xhci-ext-caps.h | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/xhci-ext-caps.h
++++ b/drivers/usb/host/xhci-ext-caps.h
+@@ -101,12 +101,15 @@ static inline int xhci_find_next_cap_off
+
+ next = readl(base + ext_offset);
+
+- if (ext_offset == XHCI_HCC_PARAMS_OFFSET)
++ if (ext_offset == XHCI_HCC_PARAMS_OFFSET) {
+ /* Find the first extended capability */
+ next = XHCI_HCC_EXT_CAPS(next);
+- else
++ ext_offset = 0;
++ } else {
+ /* Find the next extended capability */
+ next = XHCI_EXT_CAPS_NEXT(next);
++ }
++
+ if (!next)
+ return 0;
+ /*
--- /dev/null
+From 0a832320f1bae6a4169bf683e201378f2437cfc1 Mon Sep 17 00:00:00 2001
+From: Justin P. Mattock <justinmattock@gmail.com>
+Date: Tue, 16 Feb 2010 15:17:29 -0800
+Subject: x86: Add iMac9,1 to pci_reboot_dmi_table
+
+From: Justin P. Mattock <justinmattock@gmail.com>
+
+commit 0a832320f1bae6a4169bf683e201378f2437cfc1 upstream.
+
+On the iMac9,1 /sbin/reboot results in a black mangled screen. Adding
+this DMI entry gets the machine to reboot cleanly as it should.
+
+Signed-off-by: Justin P. Mattock <justinmattock@gmail.com>
+LKML-Reference: <1266362249-3337-1-git-send-email-justinmattock@gmail.com>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/reboot.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -461,6 +461,14 @@ static struct dmi_system_id __initdata p
+ DMI_MATCH(DMI_PRODUCT_NAME, "Macmini3,1"),
+ },
+ },
++ { /* Handle problems with rebooting on the iMac9,1. */
++ .callback = set_pci_reboot,
++ .ident = "Apple iMac9,1",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "iMac9,1"),
++ },
++ },
+ { }
+ };
+
--- /dev/null
+From ced5b697a76d325e7a7ac7d382dbbb632c765093 Mon Sep 17 00:00:00 2001
+From: Brandon Phiilps <bphilips@suse.de>
+Date: Wed, 10 Feb 2010 01:20:06 -0800
+Subject: x86: Avoid race condition in pci_enable_msix()
+
+From: Brandon Phiilps <bphilips@suse.de>
+
+commit ced5b697a76d325e7a7ac7d382dbbb632c765093 upstream.
+
+Keep chip_data in create_irq_nr and destroy_irq.
+
+When two drivers are setting up MSI-X at the same time via
+pci_enable_msix() there is a race. See this dmesg excerpt:
+
+[ 85.170610] ixgbe 0000:02:00.1: irq 97 for MSI/MSI-X
+[ 85.170611] alloc irq_desc for 99 on node -1
+[ 85.170613] igb 0000:08:00.1: irq 98 for MSI/MSI-X
+[ 85.170614] alloc kstat_irqs on node -1
+[ 85.170616] alloc irq_2_iommu on node -1
+[ 85.170617] alloc irq_desc for 100 on node -1
+[ 85.170619] alloc kstat_irqs on node -1
+[ 85.170621] alloc irq_2_iommu on node -1
+[ 85.170625] ixgbe 0000:02:00.1: irq 99 for MSI/MSI-X
+[ 85.170626] alloc irq_desc for 101 on node -1
+[ 85.170628] igb 0000:08:00.1: irq 100 for MSI/MSI-X
+[ 85.170630] alloc kstat_irqs on node -1
+[ 85.170631] alloc irq_2_iommu on node -1
+[ 85.170635] alloc irq_desc for 102 on node -1
+[ 85.170636] alloc kstat_irqs on node -1
+[ 85.170639] alloc irq_2_iommu on node -1
+[ 85.170646] BUG: unable to handle kernel NULL pointer dereference
+at 0000000000000088
+
+As you can see igb and ixgbe are both alternating on create_irq_nr()
+via pci_enable_msix() in their probe function.
+
+ixgbe: While looping through irq_desc_ptrs[] via create_irq_nr() ixgbe
+choses irq_desc_ptrs[102] and exits the loop, drops vector_lock and
+calls dynamic_irq_init. Then it sets irq_desc_ptrs[102]->chip_data =
+NULL via dynamic_irq_init().
+
+igb: Grabs the vector_lock now and starts looping over irq_desc_ptrs[]
+via create_irq_nr(). It gets to irq_desc_ptrs[102] and does this:
+
+ cfg_new = irq_desc_ptrs[102]->chip_data;
+ if (cfg_new->vector != 0)
+ continue;
+
+This hits the NULL deref.
+
+Another possible race exists via pci_disable_msix() in a driver or in
+the number of error paths that call free_msi_irqs():
+
+destroy_irq()
+dynamic_irq_cleanup() which sets desc->chip_data = NULL
+...race window...
+desc->chip_data = cfg;
+
+Remove the save and restore code for cfg in create_irq_nr() and
+destroy_irq() and take the desc->lock when checking the irq_cfg.
+
+Reported-and-analyzed-by: Brandon Philips <bphilips@suse.de>
+Signed-off-by: Yinghai Lu <yinghai@kernel.org>
+LKML-Reference: <1265793639-15071-3-git-send-email-yinghai@kernel.org>
+Signed-off-by: Brandon Phililps <bphilips@suse.de>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/apic/io_apic.c | 18 +++-----------
+ include/linux/irq.h | 2 +
+ kernel/irq/chip.c | 52 +++++++++++++++++++++++++++++++++--------
+ 3 files changed, 50 insertions(+), 22 deletions(-)
+
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -3228,12 +3228,9 @@ unsigned int create_irq_nr(unsigned int
+ }
+ spin_unlock_irqrestore(&vector_lock, flags);
+
+- if (irq > 0) {
+- dynamic_irq_init(irq);
+- /* restore it, in case dynamic_irq_init clear it */
+- if (desc_new)
+- desc_new->chip_data = cfg_new;
+- }
++ if (irq > 0)
++ dynamic_irq_init_keep_chip_data(irq);
++
+ return irq;
+ }
+
+@@ -3256,17 +3253,12 @@ void destroy_irq(unsigned int irq)
+ {
+ unsigned long flags;
+ struct irq_cfg *cfg;
+- struct irq_desc *desc;
+
+- /* store it, in case dynamic_irq_cleanup clear it */
+- desc = irq_to_desc(irq);
+- cfg = desc->chip_data;
+- dynamic_irq_cleanup(irq);
+- /* connect back irq_cfg */
+- desc->chip_data = cfg;
++ dynamic_irq_cleanup_keep_chip_data(irq);
+
+ free_irte(irq);
+ spin_lock_irqsave(&vector_lock, flags);
++ cfg = irq_to_desc(irq)->chip_data;
+ __clear_irq_vector(irq, cfg);
+ spin_unlock_irqrestore(&vector_lock, flags);
+ }
+--- a/include/linux/irq.h
++++ b/include/linux/irq.h
+@@ -400,7 +400,9 @@ static inline int irq_has_action(unsigne
+
+ /* Dynamic irq helper functions */
+ extern void dynamic_irq_init(unsigned int irq);
++void dynamic_irq_init_keep_chip_data(unsigned int irq);
+ extern void dynamic_irq_cleanup(unsigned int irq);
++void dynamic_irq_cleanup_keep_chip_data(unsigned int irq);
+
+ /* Set/get chip/data for an IRQ: */
+ extern int set_irq_chip(unsigned int irq, struct irq_chip *chip);
+--- a/kernel/irq/chip.c
++++ b/kernel/irq/chip.c
+@@ -18,11 +18,7 @@
+
+ #include "internals.h"
+
+-/**
+- * dynamic_irq_init - initialize a dynamically allocated irq
+- * @irq: irq number to initialize
+- */
+-void dynamic_irq_init(unsigned int irq)
++static void dynamic_irq_init_x(unsigned int irq, bool keep_chip_data)
+ {
+ struct irq_desc *desc;
+ unsigned long flags;
+@@ -41,7 +37,8 @@ void dynamic_irq_init(unsigned int irq)
+ desc->depth = 1;
+ desc->msi_desc = NULL;
+ desc->handler_data = NULL;
+- desc->chip_data = NULL;
++ if (!keep_chip_data)
++ desc->chip_data = NULL;
+ desc->action = NULL;
+ desc->irq_count = 0;
+ desc->irqs_unhandled = 0;
+@@ -55,10 +52,26 @@ void dynamic_irq_init(unsigned int irq)
+ }
+
+ /**
+- * dynamic_irq_cleanup - cleanup a dynamically allocated irq
++ * dynamic_irq_init - initialize a dynamically allocated irq
+ * @irq: irq number to initialize
+ */
+-void dynamic_irq_cleanup(unsigned int irq)
++void dynamic_irq_init(unsigned int irq)
++{
++ dynamic_irq_init_x(irq, false);
++}
++
++/**
++ * dynamic_irq_init_keep_chip_data - initialize a dynamically allocated irq
++ * @irq: irq number to initialize
++ *
++ * does not set irq_to_desc(irq)->chip_data to NULL
++ */
++void dynamic_irq_init_keep_chip_data(unsigned int irq)
++{
++ dynamic_irq_init_x(irq, true);
++}
++
++static void dynamic_irq_cleanup_x(unsigned int irq, bool keep_chip_data)
+ {
+ struct irq_desc *desc = irq_to_desc(irq);
+ unsigned long flags;
+@@ -77,7 +90,8 @@ void dynamic_irq_cleanup(unsigned int ir
+ }
+ desc->msi_desc = NULL;
+ desc->handler_data = NULL;
+- desc->chip_data = NULL;
++ if (!keep_chip_data)
++ desc->chip_data = NULL;
+ desc->handle_irq = handle_bad_irq;
+ desc->chip = &no_irq_chip;
+ desc->name = NULL;
+@@ -85,6 +99,26 @@ void dynamic_irq_cleanup(unsigned int ir
+ raw_spin_unlock_irqrestore(&desc->lock, flags);
+ }
+
++/**
++ * dynamic_irq_cleanup - cleanup a dynamically allocated irq
++ * @irq: irq number to initialize
++ */
++void dynamic_irq_cleanup(unsigned int irq)
++{
++ dynamic_irq_cleanup_x(irq, false);
++}
++
++/**
++ * dynamic_irq_cleanup_keep_chip_data - cleanup a dynamically allocated irq
++ * @irq: irq number to initialize
++ *
++ * does not set irq_to_desc(irq)->chip_data to NULL
++ */
++void dynamic_irq_cleanup_keep_chip_data(unsigned int irq)
++{
++ dynamic_irq_cleanup_x(irq, true);
++}
++
+
+ /**
+ * set_irq_chip - set the irq chip for an irq
--- /dev/null
+From 18dce6ba5c8c6bd0f3ab4efa4cbdd698dab5c40a Mon Sep 17 00:00:00 2001
+From: Yinghai Lu <yinghai@kernel.org>
+Date: Wed, 10 Feb 2010 01:20:05 -0800
+Subject: x86: Fix SCI on IOAPIC != 0
+
+From: Yinghai Lu <yinghai@kernel.org>
+
+commit 18dce6ba5c8c6bd0f3ab4efa4cbdd698dab5c40a upstream.
+
+Thomas Renninger <trenn@suse.de> reported on IBM x3330
+
+booting a latest kernel on this machine results in:
+
+PCI: PCI BIOS revision 2.10 entry at 0xfd61c, last bus=1
+PCI: Using configuration type 1 for base access bio: create slab <bio-0> at 0
+ACPI: SCI (IRQ30) allocation failed
+ACPI Exception: AE_NOT_ACQUIRED, Unable to install System Control Interrupt handler (20090903/evevent-161)
+ACPI: Unable to start the ACPI Interpreter
+
+Later all kind of devices fail...
+
+and bisect it down to this commit:
+commit b9c61b70075c87a8612624736faf4a2de5b1ed30
+
+ x86/pci: update pirq_enable_irq() to setup io apic routing
+
+it turns out we need to set irq routing for the sci on ioapic1 early.
+
+-v2: make it work without sparseirq too.
+-v3: fix checkpatch.pl warning, and cc to stable
+
+Reported-by: Thomas Renninger <trenn@suse.de>
+Bisected-by: Thomas Renninger <trenn@suse.de>
+Tested-by: Thomas Renninger <trenn@suse.de>
+Signed-off-by: Yinghai Lu <yinghai@kernel.org>
+LKML-Reference: <1265793639-15071-2-git-send-email-yinghai@kernel.org>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/io_apic.h | 1
+ arch/x86/kernel/acpi/boot.c | 9 ++++++-
+ arch/x86/kernel/apic/io_apic.c | 50 +++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 59 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/include/asm/io_apic.h
++++ b/arch/x86/include/asm/io_apic.h
+@@ -160,6 +160,7 @@ extern int io_apic_get_redir_entries(int
+ struct io_apic_irq_attr;
+ extern int io_apic_set_pci_routing(struct device *dev, int irq,
+ struct io_apic_irq_attr *irq_attr);
++void setup_IO_APIC_irq_extra(u32 gsi);
+ extern int (*ioapic_renumber_irq)(int ioapic, int irq);
+ extern void ioapic_init_mappings(void);
+ extern void ioapic_insert_resources(void);
+--- a/arch/x86/kernel/acpi/boot.c
++++ b/arch/x86/kernel/acpi/boot.c
+@@ -446,6 +446,12 @@ void __init acpi_pic_sci_set_trigger(uns
+ int acpi_gsi_to_irq(u32 gsi, unsigned int *irq)
+ {
+ *irq = gsi;
++
++#ifdef CONFIG_X86_IO_APIC
++ if (acpi_irq_model == ACPI_IRQ_MODEL_IOAPIC)
++ setup_IO_APIC_irq_extra(gsi);
++#endif
++
+ return 0;
+ }
+
+@@ -473,7 +479,8 @@ int acpi_register_gsi(struct device *dev
+ plat_gsi = mp_register_gsi(dev, gsi, trigger, polarity);
+ }
+ #endif
+- acpi_gsi_to_irq(plat_gsi, &irq);
++ irq = plat_gsi;
++
+ return irq;
+ }
+
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -1539,6 +1539,56 @@ static void __init setup_IO_APIC_irqs(vo
+ }
+
+ /*
++ * for the gsit that is not in first ioapic
++ * but could not use acpi_register_gsi()
++ * like some special sci in IBM x3330
++ */
++void setup_IO_APIC_irq_extra(u32 gsi)
++{
++ int apic_id = 0, pin, idx, irq;
++ int node = cpu_to_node(boot_cpu_id);
++ struct irq_desc *desc;
++ struct irq_cfg *cfg;
++
++ /*
++ * Convert 'gsi' to 'ioapic.pin'.
++ */
++ apic_id = mp_find_ioapic(gsi);
++ if (apic_id < 0)
++ return;
++
++ pin = mp_find_ioapic_pin(apic_id, gsi);
++ idx = find_irq_entry(apic_id, pin, mp_INT);
++ if (idx == -1)
++ return;
++
++ irq = pin_2_irq(idx, apic_id, pin);
++#ifdef CONFIG_SPARSE_IRQ
++ desc = irq_to_desc(irq);
++ if (desc)
++ return;
++#endif
++ desc = irq_to_desc_alloc_node(irq, node);
++ if (!desc) {
++ printk(KERN_INFO "can not get irq_desc for %d\n", irq);
++ return;
++ }
++
++ cfg = desc->chip_data;
++ add_pin_to_irq_node(cfg, node, apic_id, pin);
++
++ if (test_bit(pin, mp_ioapic_routing[apic_id].pin_programmed)) {
++ pr_debug("Pin %d-%d already programmed\n",
++ mp_ioapics[apic_id].apicid, pin);
++ return;
++ }
++ set_bit(pin, mp_ioapic_routing[apic_id].pin_programmed);
++
++ setup_IO_APIC_irq(apic_id, pin, irq, desc,
++ irq_trigger(idx), irq_polarity(idx));
++}
++
++/*
+ * Set up the timer pin, possibly with the 8259A-master behind.
+ */
+ static void __init setup_timer_IRQ0_pin(unsigned int apic_id, unsigned int pin,
--- /dev/null
+From 318f6b228ba88a394ef560efc1bfe028ad5ae6b6 Mon Sep 17 00:00:00 2001
+From: Jiri Slaby <jslaby@suse.cz>
+Date: Wed, 10 Feb 2010 20:55:16 +0100
+Subject: x86, ia32_aout: do not kill argument mapping
+
+From: Jiri Slaby <jslaby@suse.cz>
+
+commit 318f6b228ba88a394ef560efc1bfe028ad5ae6b6 upstream.
+
+Do not set current->mm->mmap to NULL in 32-bit emulation on 64-bit
+load_aout_binary after flush_old_exec as it would destroy already
+set brpm mapping with arguments.
+
+Introduced by b6a2fea39318e43fee84fa7b0b90d68bed92d2ba
+mm: variable length argument support
+where the argument mapping in bprm was added.
+
+[ hpa: this is a regression from 2.6.22... time to kill a.out? ]
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+LKML-Reference: <1265831716-7668-1-git-send-email-jslaby@suse.cz>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ollie Wild <aaw@google.com>
+Cc: x86@kernel.org
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/ia32/ia32_aout.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/x86/ia32/ia32_aout.c
++++ b/arch/x86/ia32/ia32_aout.c
+@@ -327,7 +327,6 @@ static int load_aout_binary(struct linux
+ current->mm->free_area_cache = TASK_UNMAPPED_BASE;
+ current->mm->cached_hole_size = 0;
+
+- current->mm->mmap = NULL;
+ install_exec_creds(bprm);
+ current->flags &= ~PF_FORKNOEXEC;
+
--- /dev/null
+From 817a824b75b1475f1b067c8cee318c7b4d66fcde Mon Sep 17 00:00:00 2001
+From: Ian Campbell <ian.campbell@citrix.com>
+Date: Fri, 26 Feb 2010 17:16:00 +0000
+Subject: x86, xen: Disable highmem PTE allocation even when CONFIG_HIGHPTE=y
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ian Campbell <ian.campbell@citrix.com>
+
+commit 817a824b75b1475f1b067c8cee318c7b4d66fcde upstream.
+
+There's a path in the pagefault code where the kernel deliberately
+breaks its own locking rules by kmapping a high pte page without
+holding the pagetable lock (in at least page_check_address). This
+breaks Xen's ability to track the pinned/unpinned state of the
+page. There does not appear to be a viable workaround for this
+behaviour so simply disable HIGHPTE for all Xen guests.
+
+Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
+LKML-Reference: <1267204562-11844-1-git-send-email-ian.campbell@citrix.com>
+Cc: Jeremy Fitzhardinge <jeremy@goop.org>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: Pasi Kärkkäinen <pasik@iki.fi>
+Cc: <xen-devel@lists.xensource.com>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/xen/enlighten.c | 7 +++++++
+ arch/x86/xen/mmu.c | 11 ++++++-----
+ 2 files changed, 13 insertions(+), 5 deletions(-)
+
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -50,6 +50,7 @@
+ #include <asm/traps.h>
+ #include <asm/setup.h>
+ #include <asm/desc.h>
++#include <asm/pgalloc.h>
+ #include <asm/pgtable.h>
+ #include <asm/tlbflush.h>
+ #include <asm/reboot.h>
+@@ -1094,6 +1095,12 @@ asmlinkage void __init xen_start_kernel(
+
+ __supported_pte_mask |= _PAGE_IOMAP;
+
++ /*
++ * Prevent page tables from being allocated in highmem, even
++ * if CONFIG_HIGHPTE is enabled.
++ */
++ __userpte_alloc_gfp &= ~__GFP_HIGHMEM;
++
+ /* Work out if we support NX */
+ x86_configure_nx();
+
+--- a/arch/x86/xen/mmu.c
++++ b/arch/x86/xen/mmu.c
+@@ -1432,14 +1432,15 @@ static void *xen_kmap_atomic_pte(struct
+ {
+ pgprot_t prot = PAGE_KERNEL;
+
++ /*
++ * We disable highmem allocations for page tables so we should never
++ * see any calls to kmap_atomic_pte on a highmem page.
++ */
++ BUG_ON(PageHighMem(page));
++
+ if (PagePinned(page))
+ prot = PAGE_KERNEL_RO;
+
+- if (0 && PageHighMem(page))
+- printk("mapping highpte %lx type %d prot %s\n",
+- page_to_pfn(page), type,
+- (unsigned long)pgprot_val(prot) & _PAGE_RW ? "WRITE" : "READ");
+-
+ return kmap_atomic_prot(page, type, prot);
+ }
+ #endif
projects / thirdparty / kernel / stable-queue.git / commitdiff
