--- /dev/null
+From e096c8e6d5ed965f346d94befbbec2275dde3621 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 3 Aug 2010 17:20:35 +0200
+Subject: ALSA: hda - Add PC-beep whitelist for an Intel board
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit e096c8e6d5ed965f346d94befbbec2275dde3621 upstream.
+
+An Intel board needs a white-list entry to enable PC-beep.
+Otherwise the driver misdetects (due to bogus BIOS info) and ignores
+the PC-beep on 2.6.35.
+
+Reported-and-tested-by: Leandro Lucarella <luca@llucax.com.ar>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5183,6 +5183,7 @@ static void fillup_priv_adc_nids(struct
+
+ static struct snd_pci_quirk beep_white_list[] = {
+ SND_PCI_QUIRK(0x1043, 0x829f, "ASUS", 1),
++ SND_PCI_QUIRK(0x8086, 0xd613, "Intel", 1),
+ {}
+ };
+
--- /dev/null
+From ee78bb95b7bea08b7774a02073ea2bb45611a9e1 Mon Sep 17 00:00:00 2001
+From: Jiri Slaby <jslaby@suse.cz>
+Date: Thu, 29 Jul 2010 11:09:47 +0200
+Subject: Char: nozomi, fix tty->count counting
+
+From: Jiri Slaby <jslaby@suse.cz>
+
+commit ee78bb95b7bea08b7774a02073ea2bb45611a9e1 upstream.
+
+Currently ntty_install omits to increment tty count and we get the
+following warnings:
+Warning: dev (noz2) tty->count(0) != #fd's(1) in tty_open
+
+So to fix that, add one tty->count++ there.
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Cc: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/nozomi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/char/nozomi.c
++++ b/drivers/char/nozomi.c
+@@ -1611,6 +1611,7 @@ static int ntty_install(struct tty_drive
+ ret = tty_init_termios(tty);
+ if (ret == 0) {
+ tty_driver_kref_get(driver);
++ tty->count++;
+ driver->ttys[tty->index] = tty;
+ }
+ return ret;
--- /dev/null
+From bf9c1fca9ae9a79ed209e7ab2c10b3862f3f6f72 Mon Sep 17 00:00:00 2001
+From: Jiri Slaby <jslaby@suse.cz>
+Date: Thu, 29 Jul 2010 11:46:32 +0200
+Subject: Char: nozomi, set tty->driver_data appropriately
+
+From: Jiri Slaby <jslaby@suse.cz>
+
+commit bf9c1fca9ae9a79ed209e7ab2c10b3862f3f6f72 upstream.
+
+Sorry, one more fix, this one depends on the other, so this is rather 2/2.
+--
+
+tty->driver_data is used all over the code, but never set. This
+results in oopses like:
+BUG: unable to handle kernel NULL pointer dereference at 0000000000000130
+IP: [<ffffffff814a0040>] mutex_lock+0x10/0x40
+...
+Pid: 2157, comm: modem-manager Not tainted 2.6.34.1-0.1-desktop #1 2768DR7/2768DR7
+RIP: 0010:[<ffffffff814a0040>] [<ffffffff814a0040>] mutex_lock+0x10/0x40
+RSP: 0018:ffff88007b16fa50 EFLAGS: 00010286
+RAX: 0000000000000000 RBX: 0000000000000130 RCX: 0000000000000003
+RDX: 0000000000000003 RSI: 0000000000000286 RDI: 0000000000000130
+RBP: 0000000000001000 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000130
+R13: 0000000000000001 R14: 0000000000000000 R15: ffff88007b16feb4
+...
+Call Trace:
+ [<ffffffffa077690d>] ntty_write_room+0x4d/0x90 [nozomi]
+...
+
+Set tty->driver_data to the computed port in .install to not recompute it in
+every place where needed. Switch .open to use driver_data too.
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Cc: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/nozomi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/char/nozomi.c
++++ b/drivers/char/nozomi.c
+@@ -1612,6 +1612,7 @@ static int ntty_install(struct tty_drive
+ if (ret == 0) {
+ tty_driver_kref_get(driver);
+ tty->count++;
++ tty->driver_data = port;
+ driver->ttys[tty->index] = tty;
+ }
+ return ret;
+@@ -1640,7 +1641,7 @@ static int ntty_activate(struct tty_port
+
+ static int ntty_open(struct tty_struct *tty, struct file *filp)
+ {
+- struct port *port = get_port_by_tty(tty);
++ struct port *port = tty->driver_data;
+ return tty_port_open(&port->port, tty, filp);
+ }
+
--- /dev/null
+From fa260c00c1aa5c657793a7221e40d2400df5afd8 Mon Sep 17 00:00:00 2001
+From: Peter Huewe <peterhuewe@gmx.de>
+Date: Mon, 9 Aug 2010 17:18:23 -0700
+Subject: drivers/video/w100fb.c: ignore void return value / fix build failure
+
+From: Peter Huewe <peterhuewe@gmx.de>
+
+commit fa260c00c1aa5c657793a7221e40d2400df5afd8 upstream.
+
+Fix a build failure "error: void value not ignored as it ought to be"
+by removing an assignment of a void return value. The functionality of
+the code is not changed.
+
+Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
+Acked-by: Henrik Kretzschmar <henne@nachtwindheim.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/w100fb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/video/w100fb.c
++++ b/drivers/video/w100fb.c
+@@ -858,9 +858,9 @@ unsigned long w100fb_gpio_read(int port)
+ void w100fb_gpio_write(int port, unsigned long value)
+ {
+ if (port==W100_GPIO_PORT_A)
+- value = writel(value, remapped_regs + mmGPIO_DATA);
++ writel(value, remapped_regs + mmGPIO_DATA);
+ else
+- value = writel(value, remapped_regs + mmGPIO_DATA2);
++ writel(value, remapped_regs + mmGPIO_DATA2);
+ }
+ EXPORT_SYMBOL(w100fb_gpio_read);
+ EXPORT_SYMBOL(w100fb_gpio_write);
--- /dev/null
+From 110712828365ccafcc61a7f4db44c31ed4cf8793 Mon Sep 17 00:00:00 2001
+From: Borislav Petkov <bp@alien8.de>
+Date: Mon, 5 Jul 2010 21:23:52 -0700
+Subject: ide-cd: Do not access completed requests in the irq handler
+
+From: Borislav Petkov <bp@alien8.de>
+
+commit 110712828365ccafcc61a7f4db44c31ed4cf8793 upstream.
+
+ide_cd_error_cmd() can complete an erroneous request with leftover
+buffers. Signal this with its return value so that the request is not
+accessed after its completion in the irq handler and we oops.
+
+Signed-off-by: Borislav Petkov <bp@alien8.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ide/ide-cd.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/ide/ide-cd.c
++++ b/drivers/ide/ide-cd.c
+@@ -506,15 +506,22 @@ int ide_cd_queue_pc(ide_drive_t *drive,
+ return (flags & REQ_FAILED) ? -EIO : 0;
+ }
+
+-static void ide_cd_error_cmd(ide_drive_t *drive, struct ide_cmd *cmd)
++/*
++ * returns true if rq has been completed
++ */
++static bool ide_cd_error_cmd(ide_drive_t *drive, struct ide_cmd *cmd)
+ {
+ unsigned int nr_bytes = cmd->nbytes - cmd->nleft;
+
+ if (cmd->tf_flags & IDE_TFLAG_WRITE)
+ nr_bytes -= cmd->last_xfer_len;
+
+- if (nr_bytes > 0)
++ if (nr_bytes > 0) {
+ ide_complete_rq(drive, 0, nr_bytes);
++ return true;
++ }
++
++ return false;
+ }
+
+ static ide_startstop_t cdrom_newpc_intr(ide_drive_t *drive)
+@@ -679,7 +686,8 @@ out_end:
+ }
+
+ if (uptodate == 0 && rq->bio)
+- ide_cd_error_cmd(drive, cmd);
++ if (ide_cd_error_cmd(drive, cmd))
++ return ide_stopped;
+
+ /* make sure it's fully ended */
+ if (blk_fs_request(rq) == 0) {
--- /dev/null
+From d9e1b6c45059ccfff647a120769ae86da78dfdc4 Mon Sep 17 00:00:00 2001
+From: Yinghai Lu <yinghai@kernel.org>
+Date: Mon, 9 Aug 2010 17:18:22 -0700
+Subject: ipmi: fix ACPI detection with regspacing
+
+From: Yinghai Lu <yinghai@kernel.org>
+
+commit d9e1b6c45059ccfff647a120769ae86da78dfdc4 upstream.
+
+After the commit that changed ipmi_si detecting sequence from SMBIOS/ACPI
+to ACPI/SMBIOS,
+
+| commit 754d453185275951d39792865927ec494fa1ebd8
+| Author: Matthew Garrett <mjg@redhat.com>
+| Date: Wed May 26 14:43:47 2010 -0700
+|
+| ipmi: change device discovery order
+|
+| The ipmi spec provides an ordering for si discovery. Change the driver to
+| match, with the exception of preferring smbios to SPMI as HPs (at least)
+| contain accurate information in the former but not the latter.
+
+ipmi_si can not be initialized.
+
+[ 138.799739] calling init_ipmi_devintf+0x0/0x109 @ 1
+[ 138.805050] ipmi device interface
+[ 138.818131] initcall init_ipmi_devintf+0x0/0x109 returned 0 after 12797 usecs
+[ 138.822998] calling init_ipmi_si+0x0/0xa90 @ 1
+[ 138.840276] IPMI System Interface driver.
+[ 138.846137] ipmi_si: probing via ACPI
+[ 138.849225] ipmi_si 00:09: [io 0x0ca2] regsize 1 spacing 1 irq 0
+[ 138.864438] ipmi_si: Adding ACPI-specified kcs state machine
+[ 138.870893] ipmi_si: probing via SMBIOS
+[ 138.880945] ipmi_si: Adding SMBIOS-specified kcs state machineipmi_si: duplicate interface
+[ 138.896511] ipmi_si: probing via SPMI
+[ 138.899861] ipmi_si: Adding SPMI-specified kcs state machineipmi_si: duplicate interface
+[ 138.917095] ipmi_si: Trying ACPI-specified kcs state machine at i/o address 0xca2, slave address 0x0, irq 0
+[ 138.928658] ipmi_si: Interface detection failed
+[ 138.953411] initcall init_ipmi_si+0x0/0xa90 returned 0 after 110847 usecs
+
+in smbios has
+DMI/SMBIOS
+Handle 0x00C5, DMI type 38, 18 bytes
+IPMI Device Information
+ Interface Type: KCS (Keyboard Control Style)
+ Specification Version: 2.0
+ I2C Slave Address: 0x00
+ NV Storage Device: Not Present
+ Base Address: 0x0000000000000CA2 (I/O)
+ Register Spacing: 32-bit Boundaries
+in DSDT has
+ Device (BMC)
+ {
+
+ Name (_HID, EisaId ("IPI0001"))
+ Method (_STA, 0, NotSerialized)
+ {
+ If (LEqual (OSN, Zero))
+ {
+ Return (Zero)
+ }
+
+ Return (0x0F)
+ }
+
+ Name (_STR, Unicode ("IPMI_KCS"))
+ Name (_UID, Zero)
+ Name (_CRS, ResourceTemplate ()
+ {
+ IO (Decode16,
+ 0x0CA2, // Range Minimum
+ 0x0CA2, // Range Maximum
+ 0x00, // Alignment
+ 0x01, // Length
+ )
+ IO (Decode16,
+ 0x0CA6, // Range Minimum
+ 0x0CA6, // Range Maximum
+ 0x00, // Alignment
+ 0x01, // Length
+ )
+ })
+ Method (_IFT, 0, NotSerialized)
+ {
+ Return (One)
+ }
+
+ Method (_SRV, 0, NotSerialized)
+ {
+ Return (0x0200)
+ }
+ }
+
+so the reg spacing should be 4 instead of 1.
+
+Try to calculate regspacing for this kind of system.
+
+Observed on a Sun Fire X4800. Other OSes work and pass certification.
+
+Signed-off-by: Yinghai Lu <yinghai@kernel.org>
+Cc: Bjorn Helgaas <bjorn.helgaas@hp.com>
+Acked-by: Matthew Garrett <mjg@redhat.com>
+Cc: Len Brown <len.brown@intel.com>
+Cc: Myron Stowe <myron.stowe@hp.com>
+Cc: Corey Minyard <minyard@acm.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/ipmi/ipmi_si_intf.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/char/ipmi/ipmi_si_intf.c
++++ b/drivers/char/ipmi/ipmi_si_intf.c
+@@ -2176,6 +2176,14 @@ static int __devinit ipmi_pnp_probe(stru
+ info->io.addr_data = res->start;
+
+ info->io.regspacing = DEFAULT_REGSPACING;
++ res = pnp_get_resource(dev,
++ (info->io.addr_type == IPMI_IO_ADDR_SPACE) ?
++ IORESOURCE_IO : IORESOURCE_MEM,
++ 1);
++ if (res) {
++ if (res->start > info->io.addr_data)
++ info->io.regspacing = res->start - info->io.addr_data;
++ }
+ info->io.regsize = DEFAULT_REGSPACING;
+ info->io.regshift = 0;
+
--- /dev/null
+From e95b743536937a72e1560c85696b425c5d1a1c18 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Fri, 6 Aug 2010 16:00:48 +0200
+Subject: iwlwifi: fix TX tracer
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit e95b743536937a72e1560c85696b425c5d1a1c18 upstream.
+
+The TX tracing code copies with the wrong length,
+which will typically copy too little data. Fix
+this by using the correct length variable.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-devtrace.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-devtrace.h
++++ b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
+@@ -193,7 +193,7 @@ TRACE_EVENT(iwlwifi_dev_tx,
+ __entry->framelen = buf0_len + buf1_len;
+ memcpy(__get_dynamic_array(tfd), tfd, tfdlen);
+ memcpy(__get_dynamic_array(buf0), buf0, buf0_len);
+- memcpy(__get_dynamic_array(buf1), buf1, buf0_len);
++ memcpy(__get_dynamic_array(buf1), buf1, buf1_len);
+ ),
+ TP_printk("[%p] TX %.2x (%zu bytes)",
+ __entry->priv,
--- /dev/null
+From bb4f1e9d0e2ef93de8e36ca0f5f26625fcd70b7d Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Sun, 8 Aug 2010 21:18:03 +1000
+Subject: md: fix another deadlock with removing sysfs attributes.
+
+From: NeilBrown <neilb@suse.de>
+
+commit bb4f1e9d0e2ef93de8e36ca0f5f26625fcd70b7d upstream.
+
+Move the deletion of sysfs attributes from reconfig_mutex to
+open_mutex didn't really help as a process can try to take
+open_mutex while holding reconfig_mutex, so the same deadlock can
+happen, just requiring one more process to be involved in the chain.
+
+I looks like I cannot easily use locking to wait for the sysfs
+deletion to complete, so don't.
+
+The only things that we cannot do while the deletions are still
+pending is other things which can change the sysfs namespace: run,
+takeover, stop. Each of these can fail with -EBUSY.
+So set a flag while doing a sysfs deletion, and fail run, takeover,
+stop if that flag is set.
+
+This is suitable for 2.6.35.x
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/md.c | 31 +++++++++++++++++--------------
+ drivers/md/md.h | 4 ++++
+ 2 files changed, 21 insertions(+), 14 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -532,13 +532,17 @@ static void mddev_unlock(mddev_t * mddev
+ * an access to the files will try to take reconfig_mutex
+ * while holding the file unremovable, which leads to
+ * a deadlock.
+- * So hold open_mutex instead - we are allowed to take
+- * it while holding reconfig_mutex, and md_run can
+- * use it to wait for the remove to complete.
++ * So hold set sysfs_active while the remove in happeing,
++ * and anything else which might set ->to_remove or my
++ * otherwise change the sysfs namespace will fail with
++ * -EBUSY if sysfs_active is still set.
++ * We set sysfs_active under reconfig_mutex and elsewhere
++ * test it under the same mutex to ensure its correct value
++ * is seen.
+ */
+ struct attribute_group *to_remove = mddev->to_remove;
+ mddev->to_remove = NULL;
+- mutex_lock(&mddev->open_mutex);
++ mddev->sysfs_active = 1;
+ mutex_unlock(&mddev->reconfig_mutex);
+
+ if (to_remove != &md_redundancy_group)
+@@ -550,7 +554,7 @@ static void mddev_unlock(mddev_t * mddev
+ sysfs_put(mddev->sysfs_action);
+ mddev->sysfs_action = NULL;
+ }
+- mutex_unlock(&mddev->open_mutex);
++ mddev->sysfs_active = 0;
+ } else
+ mutex_unlock(&mddev->reconfig_mutex);
+
+@@ -2960,7 +2964,9 @@ level_store(mddev_t *mddev, const char *
+ * - new personality will access other array.
+ */
+
+- if (mddev->sync_thread || mddev->reshape_position != MaxSector)
++ if (mddev->sync_thread ||
++ mddev->reshape_position != MaxSector ||
++ mddev->sysfs_active)
+ return -EBUSY;
+
+ if (!mddev->pers->quiesce) {
+@@ -4344,13 +4350,9 @@ static int md_run(mddev_t *mddev)
+
+ if (mddev->pers)
+ return -EBUSY;
+-
+- /* These two calls synchronise us with the
+- * sysfs_remove_group calls in mddev_unlock,
+- * so they must have completed.
+- */
+- mutex_lock(&mddev->open_mutex);
+- mutex_unlock(&mddev->open_mutex);
++ /* Cannot run until previous stop completes properly */
++ if (mddev->sysfs_active)
++ return -EBUSY;
+
+ /*
+ * Analyze all RAID superblock(s)
+@@ -4716,7 +4718,8 @@ static int do_md_stop(mddev_t * mddev, i
+ mdk_rdev_t *rdev;
+
+ mutex_lock(&mddev->open_mutex);
+- if (atomic_read(&mddev->openers) > is_open) {
++ if (atomic_read(&mddev->openers) > is_open ||
++ mddev->sysfs_active) {
+ printk("md: %s still in use.\n",mdname(mddev));
+ err = -EBUSY;
+ } else if (mddev->pers) {
+--- a/drivers/md/md.h
++++ b/drivers/md/md.h
+@@ -125,6 +125,10 @@ struct mddev_s
+ int suspended;
+ atomic_t active_io;
+ int ro;
++ int sysfs_active; /* set when sysfs deletes
++ * are happening, so run/
++ * takeover/stop are not safe
++ */
+
+ struct gendisk *gendisk;
+
--- /dev/null
+From 147e0b6a639ac581ca3bf627bedc3f4a6d3eca66 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Fri, 6 Aug 2010 18:01:59 -0700
+Subject: md: move revalidate_disk() back outside open_mutex
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit 147e0b6a639ac581ca3bf627bedc3f4a6d3eca66 upstream.
+
+Commit b821eaa5 "md: remove ->changed and related code" moved
+revalidate_disk() under open_mutex, and lockdep noticed.
+
+[ INFO: possible circular locking dependency detected ]
+2.6.32-mdadm-locking #1
+-------------------------------------------------------
+mdadm/3640 is trying to acquire lock:
+ (&bdev->bd_mutex){+.+.+.}, at: [<ffffffff811acecb>] revalidate_disk+0x5b/0x90
+
+but task is already holding lock:
+ (&mddev->open_mutex){+.+...}, at: [<ffffffffa055e07a>] do_md_stop+0x4a/0x4d0 [md_mod]
+
+which lock already depends on the new lock.
+
+It is suitable for 2.6.35.x
+
+Reported-by: Przemyslaw Czarnowski <przemyslaw.hawrylewicz.czarnowski@intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/md.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -4711,7 +4711,7 @@ out:
+ */
+ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
+ {
+- int err = 0;
++ int err = 0, revalidate = 0;
+ struct gendisk *disk = mddev->gendisk;
+ mdk_rdev_t *rdev;
+
+@@ -4740,7 +4740,7 @@ static int do_md_stop(mddev_t * mddev, i
+ }
+
+ set_capacity(disk, 0);
+- revalidate_disk(disk);
++ revalidate = 1;
+
+ if (mddev->ro)
+ mddev->ro = 0;
+@@ -4748,6 +4748,8 @@ static int do_md_stop(mddev_t * mddev, i
+ err = 0;
+ }
+ mutex_unlock(&mddev->open_mutex);
++ if (revalidate)
++ revalidate_disk(disk);
+ if (err)
+ return err;
+ /*
--- /dev/null
+From 51e9ac77035a3dfcb6fc0a88a0d80b6f99b5edb1 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Sat, 7 Aug 2010 21:17:00 +1000
+Subject: md/raid10: fix deadlock with unaligned read during resync
+
+From: NeilBrown <neilb@suse.de>
+
+commit 51e9ac77035a3dfcb6fc0a88a0d80b6f99b5edb1 upstream.
+
+If the 'bio_split' path in raid10-read is used while
+resync/recovery is happening it is possible to deadlock.
+Fix this be elevating ->nr_waiting for the duration of both
+parts of the split request.
+
+This fixes a bug that has been present since 2.6.22
+but has only started manifesting recently for unknown reasons.
+It is suitable for and -stable since then.
+
+Reported-by: Justin Bronder <jsbronder@gentoo.org>
+Tested-by: Justin Bronder <jsbronder@gentoo.org>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/raid10.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -825,11 +825,29 @@ static int make_request(mddev_t *mddev,
+ */
+ bp = bio_split(bio,
+ chunk_sects - (bio->bi_sector & (chunk_sects - 1)) );
++
++ /* Each of these 'make_request' calls will call 'wait_barrier'.
++ * If the first succeeds but the second blocks due to the resync
++ * thread raising the barrier, we will deadlock because the
++ * IO to the underlying device will be queued in generic_make_request
++ * and will never complete, so will never reduce nr_pending.
++ * So increment nr_waiting here so no new raise_barriers will
++ * succeed, and so the second wait_barrier cannot block.
++ */
++ spin_lock_irq(&conf->resync_lock);
++ conf->nr_waiting++;
++ spin_unlock_irq(&conf->resync_lock);
++
+ if (make_request(mddev, &bp->bio1))
+ generic_make_request(&bp->bio1);
+ if (make_request(mddev, &bp->bio2))
+ generic_make_request(&bp->bio2);
+
++ spin_lock_irq(&conf->resync_lock);
++ conf->nr_waiting--;
++ wake_up(&conf->wait_barrier);
++ spin_unlock_irq(&conf->resync_lock);
++
+ bio_pair_release(bp);
+ return 0;
+ bad_map:
--- /dev/null
+From 966cca029f739716fbcc8068b8c6dfe381f86fc3 Mon Sep 17 00:00:00 2001
+From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Date: Mon, 9 Aug 2010 17:20:09 -0700
+Subject: mm: fix corruption of hibernation caused by reusing swap during image saving
+
+From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+
+commit 966cca029f739716fbcc8068b8c6dfe381f86fc3 upstream.
+
+Since 2.6.31, swap_map[]'s refcounting was changed to show that a used
+swap entry is just for swap-cache, can be reused. Then, while scanning
+free entry in swap_map[], a swap entry may be able to be reclaimed and
+reused. It was caused by commit c9e444103b5e7a5 ("mm: reuse unused swap
+entry if necessary").
+
+But this caused deta corruption at resume. The scenario is
+
+- Assume a clean-swap cache, but mapped.
+
+- at hibernation_snapshot[], clean-swap-cache is saved as
+ clean-swap-cache and swap_map[] is marked as SWAP_HAS_CACHE.
+
+- then, save_image() is called. And reuse SWAP_HAS_CACHE entry to save
+ image, and break the contents.
+
+After resume:
+
+- the memory reclaim runs and finds clean-not-referenced-swap-cache and
+ discards it because it's marked as clean. But here, the contents on
+ disk and swap-cache is inconsistent.
+
+Hance memory is corrupted.
+
+This patch avoids the bug by not reclaiming swap-entry during hibernation.
+This is a quick fix for backporting.
+
+Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Cc: Rafael J. Wysocki <rjw@sisk.pl>
+Reported-by: Ondreg Zary <linux@rainbow-software.org>
+Tested-by: Ondreg Zary <linux@rainbow-software.org>
+Tested-by: Andrea Gelmini <andrea.gelmini@gmail.com>
+Acked-by: Hugh Dickins <hughd@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/swapfile.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/mm/swapfile.c
++++ b/mm/swapfile.c
+@@ -318,8 +318,10 @@ checks:
+ if (offset > si->highest_bit)
+ scan_base = offset = si->lowest_bit;
+
+- /* reuse swap entry of cache-only swap if not busy. */
+- if (vm_swap_full() && si->swap_map[offset] == SWAP_HAS_CACHE) {
++ /* reuse swap entry of cache-only swap if not hibernation. */
++ if (vm_swap_full()
++ && usage == SWAP_HAS_CACHE
++ && si->swap_map[offset] == SWAP_HAS_CACHE) {
+ int swap_was_freed;
+ spin_unlock(&swap_lock);
+ swap_was_freed = __try_to_reclaim_swap(si, offset);
--- /dev/null
+From 549e15611b4ac1de51ef0e0a79c2704f50a638a2 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Sun, 23 May 2010 10:22:55 +0200
+Subject: PCI: disable MSI on VIA K8M800
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 549e15611b4ac1de51ef0e0a79c2704f50a638a2 upstream.
+
+MSI delivery from on-board ahci controller doesn't work on K8M800. At
+this point, it's unclear whether the culprit is with the ahci
+controller or the host bridge. Given the track record and considering
+the rather minimal impact of MSI, disabling it seems reasonable.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Rainer Hurtado Navarro <publio.escipion.el.africano@gmail.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2115,6 +2115,7 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AT
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_VT3336, quirk_disable_all_msi);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_VT3351, quirk_disable_all_msi);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_VT3364, quirk_disable_all_msi);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8380_0, quirk_disable_all_msi);
+
+ /* Disable MSI on chipsets that are known to not support it */
+ static void __devinit quirk_disable_msi(struct pci_dev *dev)
--- /dev/null
+From 3d2a531804d16cd8df6dbbb0429c6f143e756049 Mon Sep 17 00:00:00 2001
+From: Rafael J. Wysocki <rjw@sisk.pl>
+Date: Fri, 23 Jul 2010 22:19:55 +0200
+Subject: PCI: Do not run NVidia quirks related to MSI with MSI disabled
+
+From: Rafael J. Wysocki <rjw@sisk.pl>
+
+commit 3d2a531804d16cd8df6dbbb0429c6f143e756049 upstream.
+
+There is no reason to run NVidia-specific quirks related to HT MSI
+mappings with MSI disabled via pci=nomsi, so make
+__nv_msi_ht_cap_quirk() return immediately in that case.
+
+This allows at least one machine to boot 100% of the time with
+pci=nomsi (it still doesn't boot reliably without that).
+
+Addresses https://bugzilla.kernel.org/show_bug.cgi?id=16443 .
+
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/quirks.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2390,6 +2390,9 @@ static void __devinit __nv_msi_ht_cap_qu
+ int pos;
+ int found;
+
++ if (!pci_msi_enabled())
++ return;
++
+ /* check if there is HT MSI cap or enabled on this device */
+ found = ht_check_msi_mapping(dev);
+
--- /dev/null
+From 8f1d2d2be73a98c21e68fe2a26f633892d4abdd1 Mon Sep 17 00:00:00 2001
+From: John W. Linville <linville@tuxdriver.com>
+Date: Thu, 5 Aug 2010 13:46:27 -0400
+Subject: rtl8180: avoid potential NULL deref in rtl8180_beacon_work
+
+From: John W. Linville <linville@tuxdriver.com>
+
+commit 8f1d2d2be73a98c21e68fe2a26f633892d4abdd1 upstream.
+
+ieee80211_beacon_get can return NULL...
+
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/rtl818x/rtl8180_dev.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/rtl818x/rtl8180_dev.c
++++ b/drivers/net/wireless/rtl818x/rtl8180_dev.c
+@@ -688,6 +688,8 @@ void rtl8180_beacon_work(struct work_str
+
+ /* grab a fresh beacon */
+ skb = ieee80211_beacon_get(dev, vif);
++ if (!skb)
++ goto resched;
+
+ /*
+ * update beacon timestamp w/ TSF value
--- /dev/null
+From e847003f00d5eca3e3b3a6a1199f82b51293faf6 Mon Sep 17 00:00:00 2001
+From: Lytochkin Boris <lytboris@gmail.com>
+Date: Mon, 26 Jul 2010 10:02:26 +0400
+Subject: serial: add support for OX16PCI958 card
+
+From: Lytochkin Boris <lytboris@gmail.com>
+
+commit e847003f00d5eca3e3b3a6a1199f82b51293faf6 upstream.
+
+Signed-off-by: Lytochkin Boris <lytboris@gmail.com>
+Tested-by: Lytochkin Boris <lytboris@gmail.com>
+Signed-off-by: Alexander Beregalov <a.beregalov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/serial/8250_pci.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/drivers/serial/8250_pci.c
++++ b/drivers/serial/8250_pci.c
+@@ -994,6 +994,7 @@ static int skip_tx_en_setup(struct seria
+ #define PCI_DEVICE_ID_TITAN_800E 0xA014
+ #define PCI_DEVICE_ID_TITAN_200EI 0xA016
+ #define PCI_DEVICE_ID_TITAN_200EISI 0xA017
++#define PCI_DEVICE_ID_OXSEMI_16PCI958 0x9538
+
+ /* Unknown vendors/cards - this should not be in linux/pci_ids.h */
+ #define PCI_SUBDEVICE_ID_UNKNOWN_0x1584 0x1584
+@@ -1542,6 +1543,8 @@ enum pci_board_num_t {
+ pbn_b2_4_921600,
+ pbn_b2_8_921600,
+
++ pbn_b2_8_1152000,
++
+ pbn_b2_bt_1_115200,
+ pbn_b2_bt_2_115200,
+ pbn_b2_bt_4_115200,
+@@ -1960,6 +1963,13 @@ static struct pciserial_board pci_boards
+ .uart_offset = 8,
+ },
+
++ [pbn_b2_8_1152000] = {
++ .flags = FL_BASE2,
++ .num_ports = 8,
++ .base_baud = 1152000,
++ .uart_offset = 8,
++ },
++
+ [pbn_b2_bt_1_115200] = {
+ .flags = FL_BASE2|FL_BASE_BARS,
+ .num_ports = 1,
+@@ -2875,6 +2885,9 @@ static struct pci_device_id serial_pci_t
+ { PCI_VENDOR_ID_OXSEMI, PCI_DEVICE_ID_OXSEMI_16PCI952,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ pbn_b0_bt_2_921600 },
++ { PCI_VENDOR_ID_OXSEMI, PCI_DEVICE_ID_OXSEMI_16PCI958,
++ PCI_ANY_ID , PCI_ANY_ID, 0, 0,
++ pbn_b2_8_1152000 },
+
+ /*
+ * Oxford Semiconductor Inc. Tornado PCI express device range.
x86-pci-use-host-bridge-_crs-info-on-asrock-alivesata2-glan.patch
pcmcia-avoid-buffer-overflow-in-pcmcia_setup_isa_irq.patch
x86-add-memory-modify-constraints-to-xchg-and-cmpxchg.patch
+staging-rt2870-add-usb-id-for-belkin-f6d4050-v2.patch
+staging-line6-needs-to-select-snd_pcm.patch
+staging-panel-prevent-double-calling-of-parport_release-fix-oops.patch
+staging-hv-fix-kconfig-dependency-of-hv_blkvsc.patch
+serial-add-support-for-ox16pci958-card.patch
+pci-do-not-run-nvidia-quirks-related-to-msi-with-msi-disabled.patch
+pci-disable-msi-on-via-k8m800.patch
+solos-pci-fix-race-condition-in-tasklet-rx-handling.patch
+x86-mtrr-use-stop-machine-context-to-rendezvous-all-the-cpu-s.patch
+alsa-hda-add-pc-beep-whitelist-for-an-intel-board.patch
+char-nozomi-fix-tty-count-counting.patch
+char-nozomi-set-tty-driver_data-appropriately.patch
+mm-fix-corruption-of-hibernation-caused-by-reusing-swap-during-image-saving.patch
+drivers-video-w100fb.c-ignore-void-return-value-fix-build-failure.patch
+iwlwifi-fix-tx-tracer.patch
+rtl8180-avoid-potential-null-deref-in-rtl8180_beacon_work.patch
+ipmi-fix-acpi-detection-with-regspacing.patch
+ide-cd-do-not-access-completed-requests-in-the-irq-handler.patch
+md-move-revalidate_disk-back-outside-open_mutex.patch
+md-fix-another-deadlock-with-removing-sysfs-attributes.patch
+md-raid10-fix-deadlock-with-unaligned-read-during-resync.patch
--- /dev/null
+From 1f6ea6e511e5ec730d8e88651da1b7b6e8fd1333 Mon Sep 17 00:00:00 2001
+From: David Woodhouse <David.Woodhouse@intel.com>
+Date: Sat, 7 Aug 2010 23:02:59 -0700
+Subject: solos-pci: Fix race condition in tasklet RX handling
+
+From: David Woodhouse <David.Woodhouse@intel.com>
+
+commit 1f6ea6e511e5ec730d8e88651da1b7b6e8fd1333 upstream.
+
+We were seeing faults in the solos-pci receive tasklet when packets
+arrived for a VCC which was currently being closed:
+
+[18842.727906] EIP: [<e082f490>] br2684_push+0x19/0x234 [br2684] SS:ESP 0068:dfb89d14
+
+[18845.090712] [<c13ecff3>] ? do_page_fault+0x0/0x2e1
+[18845.120042] [<e082f490>] ? br2684_push+0x19/0x234 [br2684]
+[18845.153530] [<e084fa13>] solos_bh+0x28b/0x7c8 [solos_pci]
+[18845.186488] [<e084f711>] ? solos_irq+0x2d/0x51 [solos_pci]
+[18845.219960] [<c100387b>] ? handle_irq+0x3b/0x48
+[18845.247732] [<c10265cb>] ? irq_exit+0x34/0x57
+[18845.274437] [<c1025720>] tasklet_action+0x42/0x69
+[18845.303247] [<c102643f>] __do_softirq+0x8e/0x129
+[18845.331540] [<c10264ff>] do_softirq+0x25/0x2a
+[18845.358274] [<c102664c>] _local_bh_enable_ip+0x5e/0x6a
+[18845.389677] [<c102666d>] local_bh_enable+0xb/0xe
+[18845.417944] [<e08490a8>] ppp_unregister_channel+0x32/0xbb [ppp_generic]
+[18845.458193] [<e08731ad>] pppox_unbind_sock+0x18/0x1f [pppox]
+
+This patch uses an RCU-inspired approach to fix it. In the RX tasklet's
+find_vcc() function we first refuse to use a VCC which already has the
+ATM_VF_READY bit cleared. And in the VCC close function, we synchronise
+with the tasklet to ensure that it can't still be using the VCC before
+we continue and allow the VCC to be destroyed.
+
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Tested-by: Nathan Williams <nathan@traverse.com.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/atm/solos-pci.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/atm/solos-pci.c
++++ b/drivers/atm/solos-pci.c
+@@ -781,7 +781,8 @@ static struct atm_vcc *find_vcc(struct a
+ sk_for_each(s, node, head) {
+ vcc = atm_sk(s);
+ if (vcc->dev == dev && vcc->vci == vci &&
+- vcc->vpi == vpi && vcc->qos.rxtp.traffic_class != ATM_NONE)
++ vcc->vpi == vpi && vcc->qos.rxtp.traffic_class != ATM_NONE &&
++ test_bit(ATM_VF_READY, &vcc->flags))
+ goto out;
+ }
+ vcc = NULL;
+@@ -907,6 +908,10 @@ static void pclose(struct atm_vcc *vcc)
+ clear_bit(ATM_VF_ADDR, &vcc->flags);
+ clear_bit(ATM_VF_READY, &vcc->flags);
+
++ /* Hold up vcc_destroy_socket() (our caller) until solos_bh() in the
++ tasklet has finished processing any incoming packets (and, more to
++ the point, using the vcc pointer). */
++ tasklet_unlock_wait(&card->tlet);
+ return;
+ }
+
--- /dev/null
+From 54d2379c20d814ced657cbc2c4ead8d1f8389fa2 Mon Sep 17 00:00:00 2001
+From: Haiyang Zhang <haiyangz@microsoft.com>
+Date: Fri, 23 Jul 2010 21:24:42 +0000
+Subject: staging: hv: Fix Kconfig dependency of hv_blkvsc
+
+From: Haiyang Zhang <haiyangz@microsoft.com>
+
+commit 54d2379c20d814ced657cbc2c4ead8d1f8389fa2 upstream.
+
+LBDAF is not available nor necessary on 64BIT kernel. This patch
+fixed the dependency for hv_blkvsc module on 64BIT kernel.
+Thanks vrataj2 [vrataj2@comcast.net] for reporting this problem.
+
+Reported-by: vrataj2 <vrataj2@comcast.net>
+Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
+Signed-off-by: Hank Janssen <hjanssen@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/hv/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/hv/Kconfig
++++ b/drivers/staging/hv/Kconfig
+@@ -17,7 +17,7 @@ config HYPERV_STORAGE
+
+ config HYPERV_BLOCK
+ tristate "Microsoft Hyper-V virtual block driver"
+- depends on BLOCK && SCSI && LBDAF
++ depends on BLOCK && SCSI && (LBDAF || 64BIT)
+ default HYPERV
+ help
+ Select this option to enable the Hyper-V virtual block driver.
--- /dev/null
+From e928c077e5cdcd72ee762125b37232aec1ff49f3 Mon Sep 17 00:00:00 2001
+From: Randy Dunlap <randy.dunlap@oracle.com>
+Date: Tue, 27 Jul 2010 12:21:19 -0700
+Subject: Staging: line6: needs to select SND_PCM
+
+From: Randy Dunlap <randy.dunlap@oracle.com>
+
+commit e928c077e5cdcd72ee762125b37232aec1ff49f3 upstream.
+
+line6 uses snd_pcm*() functions, so it should select SND_PCM.
+
+ERROR: "snd_pcm_period_elapsed" [drivers/staging/line6/line6usb.ko] undefined!
+ERROR: "snd_pcm_set_ops" [drivers/staging/line6/line6usb.ko] undefined!
+ERROR: "snd_pcm_lib_free_pages" [drivers/staging/line6/line6usb.ko] undefined!
+ERROR: "snd_pcm_lib_ioctl" [drivers/staging/line6/line6usb.ko] undefined!
+ERROR: "snd_pcm_lib_malloc_pages" [drivers/staging/line6/line6usb.ko] undefined!
+ERROR: "snd_pcm_hw_constraint_ratdens" [drivers/staging/line6/line6usb.ko] undefined!
+ERROR: "snd_pcm_format_physical_width" [drivers/staging/line6/line6usb.ko] undefined!
+ERROR: "snd_pcm_lib_preallocate_pages_for_all" [drivers/staging/line6/line6usb.ko] undefined!
+ERROR: "snd_pcm_new" [drivers/staging/line6/line6usb.ko] undefined!
+
+Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
+Cc: Markus Grabner <grabner@icg.tugraz.at>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/line6/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/staging/line6/Kconfig
++++ b/drivers/staging/line6/Kconfig
+@@ -2,6 +2,7 @@ config LINE6_USB
+ tristate "Line6 USB support"
+ depends on USB && SND
+ select SND_RAWMIDI
++ select SND_PCM
+ help
+ This is a driver for the guitar amp, cab, and effects modeller
+ PODxt Pro by Line6 (and similar devices), supporting the
--- /dev/null
+From 060132ae42cce3f9d2fd34d9a17b98362b44b9f9 Mon Sep 17 00:00:00 2001
+From: Peter Huewe <peterhuewe@gmx.de>
+Date: Wed, 7 Jul 2010 04:52:16 +0200
+Subject: Staging: panel: Prevent double-calling of parport_release - fix oops.
+
+From: Peter Huewe <peterhuewe@gmx.de>
+
+commit 060132ae42cce3f9d2fd34d9a17b98362b44b9f9 upstream.
+
+This patch prevents the code from calling parport_release and
+parport_unregister_device twice with the same arguments - and thus fixes an oops.
+
+Rationale:
+After the first call the parport is already released and the
+handle isn't valid anymore and calling parport_release and
+parport_unregister_device twice isn't a good idea.
+
+Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
+Acked-by: Willy Tarreau <w@1wt.eu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/panel/panel.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/staging/panel/panel.c
++++ b/drivers/staging/panel/panel.c
+@@ -2179,6 +2179,7 @@ int panel_init(void)
+ if (pprt) {
+ parport_release(pprt);
+ parport_unregister_device(pprt);
++ pprt = NULL;
+ }
+ parport_unregister_driver(&panel_driver);
+ printk(KERN_ERR "Panel driver version " PANEL_VERSION
+@@ -2228,6 +2229,7 @@ static void __exit panel_cleanup_module(
+ /* TODO: free all input signals */
+ parport_release(pprt);
+ parport_unregister_device(pprt);
++ pprt = NULL;
+ }
+ parport_unregister_driver(&panel_driver);
+ }
--- /dev/null
+From 5d92fe3387d086fc2f10426fbdb6b86d6cce5a47 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sun, 25 Jul 2010 16:14:53 -0500
+Subject: staging: rt2870: Add USB ID for Belkin F6D4050 v2
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 5d92fe3387d086fc2f10426fbdb6b86d6cce5a47 upstream.
+
+Device missing from current tables.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Tested-by: Rod Huffaker <rod.huffaker@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/rt2860/usb_main_dev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/staging/rt2860/usb_main_dev.c
++++ b/drivers/staging/rt2860/usb_main_dev.c
+@@ -64,6 +64,7 @@ struct usb_device_id rtusb_usb_id[] = {
+ {USB_DEVICE(0x14B2, 0x3C07)}, /* AL */
+ {USB_DEVICE(0x050D, 0x8053)}, /* Belkin */
+ {USB_DEVICE(0x050D, 0x825B)}, /* Belkin */
++ {USB_DEVICE(0x050D, 0x935B)}, /* Belkin F6D4050 v2 */
+ {USB_DEVICE(0x14B2, 0x3C23)}, /* Airlink */
+ {USB_DEVICE(0x14B2, 0x3C27)}, /* Airlink */
+ {USB_DEVICE(0x07AA, 0x002F)}, /* Corega */
--- /dev/null
+From 68f202e4e87cfab4439568bf397fcc5c7cf8d729 Mon Sep 17 00:00:00 2001
+From: Suresh Siddha <suresh.b.siddha@intel.com>
+Date: Fri, 30 Jul 2010 11:46:42 -0700
+Subject: x86, mtrr: Use stop machine context to rendezvous all the cpu's
+
+From: Suresh Siddha <suresh.b.siddha@intel.com>
+
+commit 68f202e4e87cfab4439568bf397fcc5c7cf8d729 upstream.
+
+Use the stop machine context rather than IPI's to rendezvous all the cpus for
+MTRR initialization that happens during cpu bringup or for MTRR modifications
+during runtime.
+
+This avoids deadlock scenario (reported by Prarit) like:
+
+cpu A holds a read_lock (tasklist_lock for example) with irqs enabled
+cpu B waits for the same lock with irqs disabled using write_lock_irq
+cpu C doing set_mtrr() (during AP bringup for example), which will try to
+rendezvous all the cpus using IPI's
+
+This will result in C and A come to the rendezvous point and waiting
+for B. B is stuck forever waiting for the lock and thus not
+reaching the rendezvous point.
+
+Using stop cpu (run in the process context of per cpu based keventd) to do
+this rendezvous, avoids this deadlock scenario.
+
+Also make sure all the cpu's are in the rendezvous handler before we proceed
+with the local_irq_save() on each cpu. This lock step disabling irqs on all
+the cpus will avoid other deadlock scenarios (for example involving
+with the blocking smp_call_function's etc).
+
+ [ This problem is very old. Marking -stable only for 2.6.35 as the
+ stop_one_cpu_nowait() API is present only in 2.6.35. Any older
+ kernel interested in this fix need to do some more work in backporting
+ this patch. ]
+
+Reported-by: Prarit Bhargava <prarit@redhat.com>
+Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
+LKML-Reference: <1280515602.2682.10.camel@sbsiddha-MOBL3.sc.intel.com>
+Acked-by: Prarit Bhargava <prarit@redhat.com>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/mtrr/main.c | 56 ++++++++++++++++++++++++++++++----------
+ arch/x86/kernel/smpboot.c | 7 +++++
+ 2 files changed, 50 insertions(+), 13 deletions(-)
+
+--- a/arch/x86/kernel/cpu/mtrr/main.c
++++ b/arch/x86/kernel/cpu/mtrr/main.c
+@@ -35,6 +35,7 @@
+
+ #include <linux/types.h> /* FIXME: kvm_para.h needs this */
+
++#include <linux/stop_machine.h>
+ #include <linux/kvm_para.h>
+ #include <linux/uaccess.h>
+ #include <linux/module.h>
+@@ -143,22 +144,28 @@ struct set_mtrr_data {
+ mtrr_type smp_type;
+ };
+
++static DEFINE_PER_CPU(struct cpu_stop_work, mtrr_work);
++
+ /**
+- * ipi_handler - Synchronisation handler. Executed by "other" CPUs.
++ * mtrr_work_handler - Synchronisation handler. Executed by "other" CPUs.
+ * @info: pointer to mtrr configuration data
+ *
+ * Returns nothing.
+ */
+-static void ipi_handler(void *info)
++static int mtrr_work_handler(void *info)
+ {
+ #ifdef CONFIG_SMP
+ struct set_mtrr_data *data = info;
+ unsigned long flags;
+
++ atomic_dec(&data->count);
++ while (!atomic_read(&data->gate))
++ cpu_relax();
++
+ local_irq_save(flags);
+
+ atomic_dec(&data->count);
+- while (!atomic_read(&data->gate))
++ while (atomic_read(&data->gate))
+ cpu_relax();
+
+ /* The master has cleared me to execute */
+@@ -173,12 +180,13 @@ static void ipi_handler(void *info)
+ }
+
+ atomic_dec(&data->count);
+- while (atomic_read(&data->gate))
++ while (!atomic_read(&data->gate))
+ cpu_relax();
+
+ atomic_dec(&data->count);
+ local_irq_restore(flags);
+ #endif
++ return 0;
+ }
+
+ static inline int types_compatible(mtrr_type type1, mtrr_type type2)
+@@ -198,7 +206,7 @@ static inline int types_compatible(mtrr_
+ *
+ * This is kinda tricky, but fortunately, Intel spelled it out for us cleanly:
+ *
+- * 1. Send IPI to do the following:
++ * 1. Queue work to do the following on all processors:
+ * 2. Disable Interrupts
+ * 3. Wait for all procs to do so
+ * 4. Enter no-fill cache mode
+@@ -215,14 +223,17 @@ static inline int types_compatible(mtrr_
+ * 15. Enable interrupts.
+ *
+ * What does that mean for us? Well, first we set data.count to the number
+- * of CPUs. As each CPU disables interrupts, it'll decrement it once. We wait
+- * until it hits 0 and proceed. We set the data.gate flag and reset data.count.
+- * Meanwhile, they are waiting for that flag to be set. Once it's set, each
++ * of CPUs. As each CPU announces that it started the rendezvous handler by
++ * decrementing the count, We reset data.count and set the data.gate flag
++ * allowing all the cpu's to proceed with the work. As each cpu disables
++ * interrupts, it'll decrement data.count once. We wait until it hits 0 and
++ * proceed. We clear the data.gate flag and reset data.count. Meanwhile, they
++ * are waiting for that flag to be cleared. Once it's cleared, each
+ * CPU goes through the transition of updating MTRRs.
+ * The CPU vendors may each do it differently,
+ * so we call mtrr_if->set() callback and let them take care of it.
+ * When they're done, they again decrement data->count and wait for data.gate
+- * to be reset.
++ * to be set.
+ * When we finish, we wait for data.count to hit 0 and toggle the data.gate flag
+ * Everyone then enables interrupts and we all continue on.
+ *
+@@ -234,6 +245,9 @@ set_mtrr(unsigned int reg, unsigned long
+ {
+ struct set_mtrr_data data;
+ unsigned long flags;
++ int cpu;
++
++ preempt_disable();
+
+ data.smp_reg = reg;
+ data.smp_base = base;
+@@ -246,10 +260,15 @@ set_mtrr(unsigned int reg, unsigned long
+ atomic_set(&data.gate, 0);
+
+ /* Start the ball rolling on other CPUs */
+- if (smp_call_function(ipi_handler, &data, 0) != 0)
+- panic("mtrr: timed out waiting for other CPUs\n");
++ for_each_online_cpu(cpu) {
++ struct cpu_stop_work *work = &per_cpu(mtrr_work, cpu);
++
++ if (cpu == smp_processor_id())
++ continue;
++
++ stop_one_cpu_nowait(cpu, mtrr_work_handler, &data, work);
++ }
+
+- local_irq_save(flags);
+
+ while (atomic_read(&data.count))
+ cpu_relax();
+@@ -259,6 +278,16 @@ set_mtrr(unsigned int reg, unsigned long
+ smp_wmb();
+ atomic_set(&data.gate, 1);
+
++ local_irq_save(flags);
++
++ while (atomic_read(&data.count))
++ cpu_relax();
++
++ /* Ok, reset count and toggle gate */
++ atomic_set(&data.count, num_booting_cpus() - 1);
++ smp_wmb();
++ atomic_set(&data.gate, 0);
++
+ /* Do our MTRR business */
+
+ /*
+@@ -279,7 +308,7 @@ set_mtrr(unsigned int reg, unsigned long
+
+ atomic_set(&data.count, num_booting_cpus() - 1);
+ smp_wmb();
+- atomic_set(&data.gate, 0);
++ atomic_set(&data.gate, 1);
+
+ /*
+ * Wait here for everyone to have seen the gate change
+@@ -289,6 +318,7 @@ set_mtrr(unsigned int reg, unsigned long
+ cpu_relax();
+
+ local_irq_restore(flags);
++ preempt_enable();
+ }
+
+ /**
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -816,6 +816,13 @@ do_rest:
+ if (cpumask_test_cpu(cpu, cpu_callin_mask))
+ break; /* It has booted */
+ udelay(100);
++ /*
++ * Allow other tasks to run while we wait for the
++ * AP to come online. This also gives a chance
++ * for the MTRR work(triggered by the AP coming online)
++ * to be completed in the stop machine context.
++ */
++ schedule();
+ }
+
+ if (cpumask_test_cpu(cpu, cpu_callin_mask))
projects / thirdparty / kernel / stable-queue.git / commitdiff
