--- /dev/null
+From c6353b4520788e34098bbf61c73fb9618ca7fdd6 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Thu, 17 Jun 2010 11:42:22 +0200
+Subject: ahci,ata_generic: let ata_generic handle new MBP w/ MCP89
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tejun Heo <tj@kernel.org>
+
+commit c6353b4520788e34098bbf61c73fb9618ca7fdd6 upstream.
+
+For yet unknown reason, MCP89 on MBP 7,1 doesn't work w/ ahci under
+linux but the controller doesn't require explicit mode setting and
+works fine with ata_generic. Make ahci ignore the controller on MBP
+7,1 and let ata_generic take it for now.
+
+Reported in bko#15923.
+
+ https://bugzilla.kernel.org/show_bug.cgi?id=15923
+
+NVIDIA is investigating why ahci mode doesn't work.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Cc: Peer Chen <pchen@nvidia.com>
+Reported-by: Anders Østhus <grapz666@gmail.com>
+Reported-by: Andreas Graf <andreas_graf@csgraf.de>
+Reported-by: Benoit Gschwind <gschwind@gnu-log.net>
+Reported-by: Damien Cassou <damien.cassou@gmail.com>
+Reported-by: tixetsal@juno.com
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/ahci.c | 10 ++++++++++
+ drivers/ata/ata_generic.c | 6 ++++++
+ include/linux/pci_ids.h | 1 +
+ 3 files changed, 17 insertions(+)
+
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -3249,6 +3249,16 @@ static int ahci_init_one(struct pci_dev
+ if (pdev->vendor == PCI_VENDOR_ID_MARVELL && !marvell_enable)
+ return -ENODEV;
+
++ /*
++ * For some reason, MCP89 on MacBook 7,1 doesn't work with
++ * ahci, use ata_generic instead.
++ */
++ if (pdev->vendor == PCI_VENDOR_ID_NVIDIA &&
++ pdev->device == PCI_DEVICE_ID_NVIDIA_NFORCE_MCP89_SATA &&
++ pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE &&
++ pdev->subsystem_device == 0xcb89)
++ return -ENODEV;
++
+ /* Promise's PDC42819 is a SAS/SATA controller that has an AHCI mode.
+ * At the moment, we can only use the AHCI mode. Let the users know
+ * that for SAS drives they're out of luck.
+--- a/drivers/ata/ata_generic.c
++++ b/drivers/ata/ata_generic.c
+@@ -168,6 +168,12 @@ static struct pci_device_id ata_generic[
+ { PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C561), },
+ { PCI_DEVICE(PCI_VENDOR_ID_OPTI, PCI_DEVICE_ID_OPTI_82C558), },
+ { PCI_DEVICE(PCI_VENDOR_ID_CENATEK,PCI_DEVICE_ID_CENATEK_IDE), },
++ /*
++ * For some reason, MCP89 on MacBook 7,1 doesn't work with
++ * ahci, use ata_generic instead.
++ */
++ { PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP89_SATA,
++ PCI_VENDOR_ID_APPLE, 0xcb89, },
+ #if !defined(CONFIG_PATA_TOSHIBA) && !defined(CONFIG_PATA_TOSHIBA_MODULE)
+ { PCI_DEVICE(PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO_1), },
+ { PCI_DEVICE(PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO_2), },
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -1261,6 +1261,7 @@
+ #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP77_IDE 0x0759
+ #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP73_SMBUS 0x07D8
+ #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP79_SMBUS 0x0AA2
++#define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP89_SATA 0x0D85
+
+ #define PCI_VENDOR_ID_IMS 0x10e0
+ #define PCI_DEVICE_ID_IMS_TT128 0x9128
--- /dev/null
+From 2503a5ecd86c002506001eba432c524ea009fe7f Mon Sep 17 00:00:00 2001
+From: Catalin Marinas <catalin.marinas@arm.com>
+Date: Thu, 1 Jul 2010 13:21:47 +0100
+Subject: ARM: 6201/1: RealView: Do not use outer_sync() on ARM11MPCore boards with L220
+
+From: Catalin Marinas <catalin.marinas@arm.com>
+
+commit 2503a5ecd86c002506001eba432c524ea009fe7f upstream.
+
+RealView boards with certain revisions of the L220 cache controller (ARM11*
+processors only) may have issues (hardware deadlock) with the recent changes to
+the mb() barrier implementation (DSB followed by an L2 cache sync). The patch
+redefines the RealView ARM11MPCore mandatory barriers without the outer_sync()
+call.
+
+Tested-by: Linus Walleij <linus.walleij@stericsson.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/mach-realview/Kconfig | 2 ++
+ arch/arm/mach-realview/include/mach/barriers.h | 8 ++++++++
+ 2 files changed, 10 insertions(+)
+
+--- a/arch/arm/mach-realview/Kconfig
++++ b/arch/arm/mach-realview/Kconfig
+@@ -18,6 +18,7 @@ config REALVIEW_EB_ARM11MP
+ bool "Support ARM11MPCore tile"
+ depends on MACH_REALVIEW_EB
+ select CPU_V6
++ select ARCH_HAS_BARRIERS if SMP
+ help
+ Enable support for the ARM11MPCore tile on the Realview platform.
+
+@@ -35,6 +36,7 @@ config MACH_REALVIEW_PB11MP
+ select CPU_V6
+ select ARM_GIC
+ select HAVE_PATA_PLATFORM
++ select ARCH_HAS_BARRIERS if SMP
+ help
+ Include support for the ARM(R) RealView MPCore Platform Baseboard.
+ PB11MPCore is a platform with an on-board ARM11MPCore and has
+--- /dev/null
++++ b/arch/arm/mach-realview/include/mach/barriers.h
+@@ -0,0 +1,8 @@
++/*
++ * Barriers redefined for RealView ARM11MPCore platforms with L220 cache
++ * controller to work around hardware errata causing the outer_sync()
++ * operation to deadlock the system.
++ */
++#define mb() dsb()
++#define rmb() dmb()
++#define wmb() mb()
--- /dev/null
+From 068de8d1be48a04b92fd97f76bb7e113b7be82a8 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Thu, 8 Jul 2010 10:58:06 +0100
+Subject: ARM: 6211/1: atomic ops: fix register constraints for atomic64_add_unless
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit 068de8d1be48a04b92fd97f76bb7e113b7be82a8 upstream.
+
+The atomic64_add_unless function compares an atomic variable with
+a given value and, if they are not equal, adds another given value
+to the atomic variable. The function returns zero if the addition
+did not occur and non-zero otherwise.
+
+On ARM, the return value is initialised to 1 in C code. Inline assembly
+code then performs the atomic64_add_unless operation, setting the
+return value to 0 iff the addition does not occur. This means that
+when the addition *does* occur, the value of ret must be preserved
+across the inline assembly and therefore requires a "+r" constraint
+rather than the current one of "=&r".
+
+Thanks to Nicolas Pitre for helping to spot this.
+
+Reviewed-by: Nicolas Pitre <nicolas.pitre@linaro.org>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/include/asm/atomic.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/include/asm/atomic.h
++++ b/arch/arm/include/asm/atomic.h
+@@ -440,7 +440,7 @@ static inline int atomic64_add_unless(at
+ " teq %2, #0\n"
+ " bne 1b\n"
+ "2:"
+- : "=&r" (val), "=&r" (ret), "=&r" (tmp)
++ : "=&r" (val), "+r" (ret), "=&r" (tmp)
+ : "r" (&v->counter), "r" (u), "r" (a)
+ : "cc");
+
--- /dev/null
+From 398aa66827155ef52bab58bebd24597d90968929 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Thu, 8 Jul 2010 10:59:16 +0100
+Subject: ARM: 6212/1: atomic ops: add memory constraints to inline asm
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit 398aa66827155ef52bab58bebd24597d90968929 upstream.
+
+Currently, the 32-bit and 64-bit atomic operations on ARM do not
+include memory constraints in the inline assembly blocks. In the
+case of barrier-less operations [for example, atomic_add], this
+means that the compiler may constant fold values which have actually
+been modified by a call to an atomic operation.
+
+This issue can be observed in the atomic64_test routine in
+<kernel root>/lib/atomic64_test.c:
+
+00000000 <test_atomic64>:
+ 0: e1a0c00d mov ip, sp
+ 4: e92dd830 push {r4, r5, fp, ip, lr, pc}
+ 8: e24cb004 sub fp, ip, #4
+ c: e24dd008 sub sp, sp, #8
+ 10: e24b3014 sub r3, fp, #20
+ 14: e30d000d movw r0, #53261 ; 0xd00d
+ 18: e3011337 movw r1, #4919 ; 0x1337
+ 1c: e34c0001 movt r0, #49153 ; 0xc001
+ 20: e34a1aa3 movt r1, #43683 ; 0xaaa3
+ 24: e16300f8 strd r0, [r3, #-8]!
+ 28: e30c0afe movw r0, #51966 ; 0xcafe
+ 2c: e30b1eef movw r1, #48879 ; 0xbeef
+ 30: e34d0eaf movt r0, #57007 ; 0xdeaf
+ 34: e34d1ead movt r1, #57005 ; 0xdead
+ 38: e1b34f9f ldrexd r4, [r3]
+ 3c: e1a34f90 strexd r4, r0, [r3]
+ 40: e3340000 teq r4, #0
+ 44: 1afffffb bne 38 <test_atomic64+0x38>
+ 48: e59f0004 ldr r0, [pc, #4] ; 54 <test_atomic64+0x54>
+ 4c: e3a0101e mov r1, #30
+ 50: ebfffffe bl 0 <__bug>
+ 54: 00000000 .word 0x00000000
+
+The atomic64_set (0x38-0x44) writes to the atomic64_t, but the
+compiler doesn't see this, assumes the test condition is always
+false and generates an unconditional branch to __bug. The rest of the
+test is optimised away.
+
+This patch adds suitable memory constraints to the atomic operations on ARM
+to ensure that the compiler is informed of the correct data hazards. We have
+to use the "Qo" constraints to avoid hitting the GCC anomaly described at
+http://gcc.gnu.org/bugzilla/show_bug.cgi?id=44492 , where the compiler
+makes assumptions about the writeback in the addressing mode used by the
+inline assembly. These constraints forbid the use of auto{inc,dec} addressing
+modes, so it doesn't matter if we don't use the operand exactly once.
+
+Reviewed-by: Nicolas Pitre <nicolas.pitre@linaro.org>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/include/asm/atomic.h | 132 +++++++++++++++++++++---------------------
+ 1 file changed, 66 insertions(+), 66 deletions(-)
+
+--- a/arch/arm/include/asm/atomic.h
++++ b/arch/arm/include/asm/atomic.h
+@@ -40,12 +40,12 @@ static inline void atomic_add(int i, ato
+ int result;
+
+ __asm__ __volatile__("@ atomic_add\n"
+-"1: ldrex %0, [%2]\n"
+-" add %0, %0, %3\n"
+-" strex %1, %0, [%2]\n"
++"1: ldrex %0, [%3]\n"
++" add %0, %0, %4\n"
++" strex %1, %0, [%3]\n"
+ " teq %1, #0\n"
+ " bne 1b"
+- : "=&r" (result), "=&r" (tmp)
++ : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
+ : "r" (&v->counter), "Ir" (i)
+ : "cc");
+ }
+@@ -58,12 +58,12 @@ static inline int atomic_add_return(int
+ smp_mb();
+
+ __asm__ __volatile__("@ atomic_add_return\n"
+-"1: ldrex %0, [%2]\n"
+-" add %0, %0, %3\n"
+-" strex %1, %0, [%2]\n"
++"1: ldrex %0, [%3]\n"
++" add %0, %0, %4\n"
++" strex %1, %0, [%3]\n"
+ " teq %1, #0\n"
+ " bne 1b"
+- : "=&r" (result), "=&r" (tmp)
++ : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
+ : "r" (&v->counter), "Ir" (i)
+ : "cc");
+
+@@ -78,12 +78,12 @@ static inline void atomic_sub(int i, ato
+ int result;
+
+ __asm__ __volatile__("@ atomic_sub\n"
+-"1: ldrex %0, [%2]\n"
+-" sub %0, %0, %3\n"
+-" strex %1, %0, [%2]\n"
++"1: ldrex %0, [%3]\n"
++" sub %0, %0, %4\n"
++" strex %1, %0, [%3]\n"
+ " teq %1, #0\n"
+ " bne 1b"
+- : "=&r" (result), "=&r" (tmp)
++ : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
+ : "r" (&v->counter), "Ir" (i)
+ : "cc");
+ }
+@@ -96,12 +96,12 @@ static inline int atomic_sub_return(int
+ smp_mb();
+
+ __asm__ __volatile__("@ atomic_sub_return\n"
+-"1: ldrex %0, [%2]\n"
+-" sub %0, %0, %3\n"
+-" strex %1, %0, [%2]\n"
++"1: ldrex %0, [%3]\n"
++" sub %0, %0, %4\n"
++" strex %1, %0, [%3]\n"
+ " teq %1, #0\n"
+ " bne 1b"
+- : "=&r" (result), "=&r" (tmp)
++ : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
+ : "r" (&v->counter), "Ir" (i)
+ : "cc");
+
+@@ -118,11 +118,11 @@ static inline int atomic_cmpxchg(atomic_
+
+ do {
+ __asm__ __volatile__("@ atomic_cmpxchg\n"
+- "ldrex %1, [%2]\n"
++ "ldrex %1, [%3]\n"
+ "mov %0, #0\n"
+- "teq %1, %3\n"
+- "strexeq %0, %4, [%2]\n"
+- : "=&r" (res), "=&r" (oldval)
++ "teq %1, %4\n"
++ "strexeq %0, %5, [%3]\n"
++ : "=&r" (res), "=&r" (oldval), "+Qo" (ptr->counter)
+ : "r" (&ptr->counter), "Ir" (old), "r" (new)
+ : "cc");
+ } while (res);
+@@ -137,12 +137,12 @@ static inline void atomic_clear_mask(uns
+ unsigned long tmp, tmp2;
+
+ __asm__ __volatile__("@ atomic_clear_mask\n"
+-"1: ldrex %0, [%2]\n"
+-" bic %0, %0, %3\n"
+-" strex %1, %0, [%2]\n"
++"1: ldrex %0, [%3]\n"
++" bic %0, %0, %4\n"
++" strex %1, %0, [%3]\n"
+ " teq %1, #0\n"
+ " bne 1b"
+- : "=&r" (tmp), "=&r" (tmp2)
++ : "=&r" (tmp), "=&r" (tmp2), "+Qo" (*addr)
+ : "r" (addr), "Ir" (mask)
+ : "cc");
+ }
+@@ -249,7 +249,7 @@ static inline u64 atomic64_read(atomic64
+ __asm__ __volatile__("@ atomic64_read\n"
+ " ldrexd %0, %H0, [%1]"
+ : "=&r" (result)
+- : "r" (&v->counter)
++ : "r" (&v->counter), "Qo" (v->counter)
+ );
+
+ return result;
+@@ -260,11 +260,11 @@ static inline void atomic64_set(atomic64
+ u64 tmp;
+
+ __asm__ __volatile__("@ atomic64_set\n"
+-"1: ldrexd %0, %H0, [%1]\n"
+-" strexd %0, %2, %H2, [%1]\n"
++"1: ldrexd %0, %H0, [%2]\n"
++" strexd %0, %3, %H3, [%2]\n"
+ " teq %0, #0\n"
+ " bne 1b"
+- : "=&r" (tmp)
++ : "=&r" (tmp), "=Qo" (v->counter)
+ : "r" (&v->counter), "r" (i)
+ : "cc");
+ }
+@@ -275,13 +275,13 @@ static inline void atomic64_add(u64 i, a
+ unsigned long tmp;
+
+ __asm__ __volatile__("@ atomic64_add\n"
+-"1: ldrexd %0, %H0, [%2]\n"
+-" adds %0, %0, %3\n"
+-" adc %H0, %H0, %H3\n"
+-" strexd %1, %0, %H0, [%2]\n"
++"1: ldrexd %0, %H0, [%3]\n"
++" adds %0, %0, %4\n"
++" adc %H0, %H0, %H4\n"
++" strexd %1, %0, %H0, [%3]\n"
+ " teq %1, #0\n"
+ " bne 1b"
+- : "=&r" (result), "=&r" (tmp)
++ : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
+ : "r" (&v->counter), "r" (i)
+ : "cc");
+ }
+@@ -294,13 +294,13 @@ static inline u64 atomic64_add_return(u6
+ smp_mb();
+
+ __asm__ __volatile__("@ atomic64_add_return\n"
+-"1: ldrexd %0, %H0, [%2]\n"
+-" adds %0, %0, %3\n"
+-" adc %H0, %H0, %H3\n"
+-" strexd %1, %0, %H0, [%2]\n"
++"1: ldrexd %0, %H0, [%3]\n"
++" adds %0, %0, %4\n"
++" adc %H0, %H0, %H4\n"
++" strexd %1, %0, %H0, [%3]\n"
+ " teq %1, #0\n"
+ " bne 1b"
+- : "=&r" (result), "=&r" (tmp)
++ : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
+ : "r" (&v->counter), "r" (i)
+ : "cc");
+
+@@ -315,13 +315,13 @@ static inline void atomic64_sub(u64 i, a
+ unsigned long tmp;
+
+ __asm__ __volatile__("@ atomic64_sub\n"
+-"1: ldrexd %0, %H0, [%2]\n"
+-" subs %0, %0, %3\n"
+-" sbc %H0, %H0, %H3\n"
+-" strexd %1, %0, %H0, [%2]\n"
++"1: ldrexd %0, %H0, [%3]\n"
++" subs %0, %0, %4\n"
++" sbc %H0, %H0, %H4\n"
++" strexd %1, %0, %H0, [%3]\n"
+ " teq %1, #0\n"
+ " bne 1b"
+- : "=&r" (result), "=&r" (tmp)
++ : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
+ : "r" (&v->counter), "r" (i)
+ : "cc");
+ }
+@@ -334,13 +334,13 @@ static inline u64 atomic64_sub_return(u6
+ smp_mb();
+
+ __asm__ __volatile__("@ atomic64_sub_return\n"
+-"1: ldrexd %0, %H0, [%2]\n"
+-" subs %0, %0, %3\n"
+-" sbc %H0, %H0, %H3\n"
+-" strexd %1, %0, %H0, [%2]\n"
++"1: ldrexd %0, %H0, [%3]\n"
++" subs %0, %0, %4\n"
++" sbc %H0, %H0, %H4\n"
++" strexd %1, %0, %H0, [%3]\n"
+ " teq %1, #0\n"
+ " bne 1b"
+- : "=&r" (result), "=&r" (tmp)
++ : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
+ : "r" (&v->counter), "r" (i)
+ : "cc");
+
+@@ -358,12 +358,12 @@ static inline u64 atomic64_cmpxchg(atomi
+
+ do {
+ __asm__ __volatile__("@ atomic64_cmpxchg\n"
+- "ldrexd %1, %H1, [%2]\n"
++ "ldrexd %1, %H1, [%3]\n"
+ "mov %0, #0\n"
+- "teq %1, %3\n"
+- "teqeq %H1, %H3\n"
+- "strexdeq %0, %4, %H4, [%2]"
+- : "=&r" (res), "=&r" (oldval)
++ "teq %1, %4\n"
++ "teqeq %H1, %H4\n"
++ "strexdeq %0, %5, %H5, [%3]"
++ : "=&r" (res), "=&r" (oldval), "+Qo" (ptr->counter)
+ : "r" (&ptr->counter), "r" (old), "r" (new)
+ : "cc");
+ } while (res);
+@@ -381,11 +381,11 @@ static inline u64 atomic64_xchg(atomic64
+ smp_mb();
+
+ __asm__ __volatile__("@ atomic64_xchg\n"
+-"1: ldrexd %0, %H0, [%2]\n"
+-" strexd %1, %3, %H3, [%2]\n"
++"1: ldrexd %0, %H0, [%3]\n"
++" strexd %1, %4, %H4, [%3]\n"
+ " teq %1, #0\n"
+ " bne 1b"
+- : "=&r" (result), "=&r" (tmp)
++ : "=&r" (result), "=&r" (tmp), "+Qo" (ptr->counter)
+ : "r" (&ptr->counter), "r" (new)
+ : "cc");
+
+@@ -402,16 +402,16 @@ static inline u64 atomic64_dec_if_positi
+ smp_mb();
+
+ __asm__ __volatile__("@ atomic64_dec_if_positive\n"
+-"1: ldrexd %0, %H0, [%2]\n"
++"1: ldrexd %0, %H0, [%3]\n"
+ " subs %0, %0, #1\n"
+ " sbc %H0, %H0, #0\n"
+ " teq %H0, #0\n"
+ " bmi 2f\n"
+-" strexd %1, %0, %H0, [%2]\n"
++" strexd %1, %0, %H0, [%3]\n"
+ " teq %1, #0\n"
+ " bne 1b\n"
+ "2:"
+- : "=&r" (result), "=&r" (tmp)
++ : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
+ : "r" (&v->counter)
+ : "cc");
+
+@@ -429,18 +429,18 @@ static inline int atomic64_add_unless(at
+ smp_mb();
+
+ __asm__ __volatile__("@ atomic64_add_unless\n"
+-"1: ldrexd %0, %H0, [%3]\n"
+-" teq %0, %4\n"
+-" teqeq %H0, %H4\n"
++"1: ldrexd %0, %H0, [%4]\n"
++" teq %0, %5\n"
++" teqeq %H0, %H5\n"
+ " moveq %1, #0\n"
+ " beq 2f\n"
+-" adds %0, %0, %5\n"
+-" adc %H0, %H0, %H5\n"
+-" strexd %2, %0, %H0, [%3]\n"
++" adds %0, %0, %6\n"
++" adc %H0, %H0, %H6\n"
++" strexd %2, %0, %H0, [%4]\n"
+ " teq %2, #0\n"
+ " bne 1b\n"
+ "2:"
+- : "=&r" (val), "+r" (ret), "=&r" (tmp)
++ : "=&r" (val), "+r" (ret), "=&r" (tmp), "+Qo" (v->counter)
+ : "r" (&v->counter), "r" (u), "r" (a)
+ : "cc");
+
--- /dev/null
+From 0ebe25f90cd99bb1bcf622ec8a841421d48380d6 Mon Sep 17 00:00:00 2001
+From: Nicolas Pitre <nico@fluxnic.net>
+Date: Wed, 14 Jul 2010 05:21:22 +0100
+Subject: ARM: 6226/1: fix kprobe bug in ldr instruction emulation
+
+From: Nicolas Pitre <nico@fluxnic.net>
+
+commit 0ebe25f90cd99bb1bcf622ec8a841421d48380d6 upstream.
+
+From: Bin Yang <bin.yang@marvell.com>
+
+Signed-off-by: Bin Yang <bin.yang@marvell.com>
+Signed-off-by: Nicolas Pitre <nicolas.pitre@linaro.org>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/kernel/kprobes-decode.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/kernel/kprobes-decode.c
++++ b/arch/arm/kernel/kprobes-decode.c
+@@ -583,13 +583,14 @@ static void __kprobes emulate_ldr(struct
+ {
+ insn_llret_3arg_fn_t *i_fn = (insn_llret_3arg_fn_t *)&p->ainsn.insn[0];
+ kprobe_opcode_t insn = p->opcode;
++ long ppc = (long)p->addr + 8;
+ union reg_pair fnr;
+ int rd = (insn >> 12) & 0xf;
+ int rn = (insn >> 16) & 0xf;
+ int rm = insn & 0xf;
+ long rdv;
+- long rnv = regs->uregs[rn];
+- long rmv = regs->uregs[rm]; /* rm/rmv may be invalid, don't care. */
++ long rnv = (rn == 15) ? ppc : regs->uregs[rn];
++ long rmv = (rm == 15) ? ppc : regs->uregs[rm];
+ long cpsr = regs->ARM_cpsr;
+
+ fnr.dr = insnslot_llret_3arg_rflags(rnv, 0, rmv, cpsr, i_fn);
--- /dev/null
+From 3c0709396df0869786f83e4b2d2d687c70ee886d Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Sat, 17 Jul 2010 14:20:17 +0100
+Subject: ASoC: Remove duplicate AUX definition from WM8776
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit 3c0709396df0869786f83e4b2d2d687c70ee886d upstream.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm8776.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/sound/soc/codecs/wm8776.c
++++ b/sound/soc/codecs/wm8776.c
+@@ -94,7 +94,6 @@ SOC_DAPM_SINGLE("Bypass Switch", WM8776_
+
+ static const struct snd_soc_dapm_widget wm8776_dapm_widgets[] = {
+ SND_SOC_DAPM_INPUT("AUX"),
+-SND_SOC_DAPM_INPUT("AUX"),
+
+ SND_SOC_DAPM_INPUT("AIN1"),
+ SND_SOC_DAPM_INPUT("AIN2"),
--- /dev/null
+From 1529c69adce1e95f7ae72f0441590c226bbac7fc Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Tue, 22 Jun 2010 12:27:26 +0200
+Subject: ata_generic: implement ATA_GEN_* flags and force enable DMA on MBP 7,1
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 1529c69adce1e95f7ae72f0441590c226bbac7fc upstream.
+
+IDE mode of MCP89 on MBP 7,1 doesn't set DMA enable bits in the BMDMA
+status register. Make the following changes to work around the problem.
+
+* Instead of using hard coded 1 in id->driver_data as class code
+ match, use ATA_GEN_CLASS_MATCH and carry the matched id in
+ host->private_data.
+
+* Instead of matching PCI_VENDOR_ID_CENATEK, use ATA_GEN_FORCE_DMA
+ flag in id instead.
+
+* Add ATA_GEN_FORCE_DMA to the id entry of MBP 7,1.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Cc: Peer Chen <pchen@nvidia.com>
+Reported-by: Anders Østhus <grapz666@gmail.com>
+Reported-by: Andreas Graf <andreas_graf@csgraf.de>
+Reported-by: Benoit Gschwind <gschwind@gnu-log.net>
+Reported-by: Damien Cassou <damien.cassou@gmail.com>
+Reported-by: tixetsal@juno.com
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/ata_generic.c | 26 +++++++++++++++++++-------
+ 1 file changed, 19 insertions(+), 7 deletions(-)
+
+--- a/drivers/ata/ata_generic.c
++++ b/drivers/ata/ata_generic.c
+@@ -32,6 +32,11 @@
+ * A generic parallel ATA driver using libata
+ */
+
++enum {
++ ATA_GEN_CLASS_MATCH = (1 << 0),
++ ATA_GEN_FORCE_DMA = (1 << 1),
++};
++
+ /**
+ * generic_set_mode - mode setting
+ * @link: link to set up
+@@ -46,13 +51,17 @@
+ static int generic_set_mode(struct ata_link *link, struct ata_device **unused)
+ {
+ struct ata_port *ap = link->ap;
++ const struct pci_device_id *id = ap->host->private_data;
+ int dma_enabled = 0;
+ struct ata_device *dev;
+ struct pci_dev *pdev = to_pci_dev(ap->host->dev);
+
+- /* Bits 5 and 6 indicate if DMA is active on master/slave */
+- if (ap->ioaddr.bmdma_addr)
++ if (id->driver_data & ATA_GEN_FORCE_DMA) {
++ dma_enabled = 0xff;
++ } else if (ap->ioaddr.bmdma_addr) {
++ /* Bits 5 and 6 indicate if DMA is active on master/slave */
+ dma_enabled = ioread8(ap->ioaddr.bmdma_addr + ATA_DMA_STATUS);
++ }
+
+ if (pdev->vendor == PCI_VENDOR_ID_CENATEK)
+ dma_enabled = 0xFF;
+@@ -126,7 +135,7 @@ static int ata_generic_init_one(struct p
+ const struct ata_port_info *ppi[] = { &info, NULL };
+
+ /* Don't use the generic entry unless instructed to do so */
+- if (id->driver_data == 1 && all_generic_ide == 0)
++ if ((id->driver_data & ATA_GEN_CLASS_MATCH) && all_generic_ide == 0)
+ return -ENODEV;
+
+ /* Devices that need care */
+@@ -155,7 +164,7 @@ static int ata_generic_init_one(struct p
+ return rc;
+ pcim_pin_device(dev);
+ }
+- return ata_pci_sff_init_one(dev, ppi, &generic_sht, NULL, 0);
++ return ata_pci_sff_init_one(dev, ppi, &generic_sht, (void *)id, 0);
+ }
+
+ static struct pci_device_id ata_generic[] = {
+@@ -167,13 +176,15 @@ static struct pci_device_id ata_generic[
+ { PCI_DEVICE(PCI_VENDOR_ID_HINT, PCI_DEVICE_ID_HINT_VXPROII_IDE), },
+ { PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C561), },
+ { PCI_DEVICE(PCI_VENDOR_ID_OPTI, PCI_DEVICE_ID_OPTI_82C558), },
+- { PCI_DEVICE(PCI_VENDOR_ID_CENATEK,PCI_DEVICE_ID_CENATEK_IDE), },
++ { PCI_DEVICE(PCI_VENDOR_ID_CENATEK,PCI_DEVICE_ID_CENATEK_IDE),
++ .driver_data = ATA_GEN_FORCE_DMA },
+ /*
+ * For some reason, MCP89 on MacBook 7,1 doesn't work with
+ * ahci, use ata_generic instead.
+ */
+ { PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP89_SATA,
+- PCI_VENDOR_ID_APPLE, 0xcb89, },
++ PCI_VENDOR_ID_APPLE, 0xcb89,
++ .driver_data = ATA_GEN_FORCE_DMA },
+ #if !defined(CONFIG_PATA_TOSHIBA) && !defined(CONFIG_PATA_TOSHIBA_MODULE)
+ { PCI_DEVICE(PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO_1), },
+ { PCI_DEVICE(PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO_2), },
+@@ -181,7 +192,8 @@ static struct pci_device_id ata_generic[
+ { PCI_DEVICE(PCI_VENDOR_ID_TOSHIBA,PCI_DEVICE_ID_TOSHIBA_PICCOLO_5), },
+ #endif
+ /* Must come last. If you add entries adjust this table appropriately */
+- { PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_STORAGE_IDE << 8, 0xFFFFFF00UL, 1},
++ { PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_IDE << 8, 0xFFFFFF00UL),
++ .driver_data = ATA_GEN_CLASS_MATCH },
+ { 0, },
+ };
+
--- /dev/null
+From 9c695203a7ddbe49dba5f22f4c941d24f47475df Mon Sep 17 00:00:00 2001
+From: Mikael Pettersson <mikpe@it.uu.se>
+Date: Tue, 29 Jun 2010 15:05:25 -0700
+Subject: compiler-gcc.h: gcc-4.5 needs noclone and noinline on __naked functions
+
+From: Mikael Pettersson <mikpe@it.uu.se>
+
+commit 9c695203a7ddbe49dba5f22f4c941d24f47475df upstream.
+
+A __naked function is defined in C but with a body completely implemented
+by asm(), including any prologue and epilogue. These asm() bodies expect
+standard calling conventions for parameter passing. Older GCCs implement
+that correctly, but 4.[56] currently do not, see GCC PR44290. In the
+Linux kernel this breaks ARM, causing most arch/arm/mm/copypage-*.c
+modules to get miscompiled, resulting in kernel crashes during bootup.
+
+Part of the kernel fix is to augment the __naked function attribute to
+also imply noinline and noclone. This patch implements that, and has been
+verified to fix boot failures with gcc-4.5 compiled 2.6.34 and 2.6.35-rc1
+kernels. The patch is a no-op with older GCCs.
+
+Signed-off-by: Mikael Pettersson <mikpe@it.uu.se>
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+Cc: Russell King <rmk@arm.linux.org.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/compiler-gcc.h | 10 +++++++++-
+ include/linux/compiler-gcc4.h | 4 ++++
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
+--- a/include/linux/compiler-gcc.h
++++ b/include/linux/compiler-gcc.h
+@@ -58,8 +58,12 @@
+ * naked functions because then mcount is called without stack and frame pointer
+ * being set up and there is no chance to restore the lr register to the value
+ * before mcount was called.
++ *
++ * The asm() bodies of naked functions often depend on standard calling conventions,
++ * therefore they must be noinline and noclone. GCC 4.[56] currently fail to enforce
++ * this, so we must do so ourselves. See GCC PR44290.
+ */
+-#define __naked __attribute__((naked)) notrace
++#define __naked __attribute__((naked)) noinline __noclone notrace
+
+ #define __noreturn __attribute__((noreturn))
+
+@@ -85,3 +89,7 @@
+ #define _gcc_header(x) __gcc_header(linux/compiler-gcc##x.h)
+ #define gcc_header(x) _gcc_header(x)
+ #include gcc_header(__GNUC__)
++
++#if !defined(__noclone)
++#define __noclone /* not needed */
++#endif
+--- a/include/linux/compiler-gcc4.h
++++ b/include/linux/compiler-gcc4.h
+@@ -48,6 +48,10 @@
+ * unreleased. Really, we need to have autoconf for the kernel.
+ */
+ #define unreachable() __builtin_unreachable()
++
++/* Mark a function definition as prohibited from being cloned. */
++#define __noclone __attribute__((__noclone__))
++
+ #endif
+
+ #endif
--- /dev/null
+From 1cd8521e7d77def75fdb1cb35ecd135385e4be4f Mon Sep 17 00:00:00 2001
+From: Anton Vorontsov <avorontsov@mvista.com>
+Date: Tue, 20 Jul 2010 13:24:27 -0700
+Subject: edac: mpc85xx: fix MPC85xx dependency
+
+From: Anton Vorontsov <avorontsov@mvista.com>
+
+commit 1cd8521e7d77def75fdb1cb35ecd135385e4be4f upstream.
+
+Since commit 5753c082f66eca5be81f6bda85c1718c5eea6ada ("powerpc/85xx:
+Kconfig cleanup"), there is no MPC85xx Kconfig symbol anymore, so the
+driver became non-selectable.
+
+This patch fixes the issue by switching to PPC_85xx symbol.
+
+Signed-off-by: Anton Vorontsov <avorontsov@mvista.com>
+Cc: Doug Thompson <dougthompson@xmission.com>
+Cc: Peter Tyser <ptyser@xes-inc.com>
+Cc: Dave Jiang <djiang@mvista.com>
+Cc: Kumar Gala <galak@kernel.crashing.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/edac/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/edac/Kconfig
++++ b/drivers/edac/Kconfig
+@@ -196,7 +196,7 @@ config EDAC_I5100
+
+ config EDAC_MPC85XX
+ tristate "Freescale MPC83xx / MPC85xx"
+- depends on EDAC_MM_EDAC && FSL_SOC && (PPC_83xx || MPC85xx)
++ depends on EDAC_MM_EDAC && FSL_SOC && (PPC_83xx || PPC_85xx)
+ help
+ Support for error detection and correction on the Freescale
+ MPC8349, MPC8560, MPC8540, MPC8548
--- /dev/null
+From db048b69037e7fa6a7d9e95a1271a50dc08ae233 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <bhutchings@solarflare.com>
+Date: Mon, 28 Jun 2010 08:44:07 +0000
+Subject: ethtool: Fix potential kernel buffer overflow in ETHTOOL_GRXCLSRLALL
+
+From: Ben Hutchings <bhutchings@solarflare.com>
+
+commit db048b69037e7fa6a7d9e95a1271a50dc08ae233 upstream.
+
+On a 32-bit machine, info.rule_cnt >= 0x40000000 leads to integer
+overflow and the buffer may be smaller than needed. Since
+ETHTOOL_GRXCLSRLALL is unprivileged, this can presumably be used for at
+least denial of service.
+
+Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/core/ethtool.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/core/ethtool.c
++++ b/net/core/ethtool.c
+@@ -328,8 +328,9 @@ static noinline_for_stack int ethtool_ge
+
+ if (info.cmd == ETHTOOL_GRXCLSRLALL) {
+ if (info.rule_cnt > 0) {
+- rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
+- GFP_USER);
++ if (info.rule_cnt <= KMALLOC_MAX_SIZE / sizeof(u32))
++ rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
++ GFP_USER);
+ if (!rule_buf)
+ return -ENOMEM;
+ }
--- /dev/null
+From 7b5d3312fbfbb21d2fc7de94e0db66cfdf8b0055 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Tue, 20 Jul 2010 20:25:35 -0700
+Subject: Input: gamecon - reference correct input device in NES mode
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit 7b5d3312fbfbb21d2fc7de94e0db66cfdf8b0055 upstream.
+
+We moved input devices from 'struct gc' to individial pads (struct
+gc-pad), but gc_nes_process_packet() was still trying to use old
+ones and crashing.
+
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/input/joystick/gamecon.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/input/joystick/gamecon.c
++++ b/drivers/input/joystick/gamecon.c
+@@ -89,7 +89,6 @@ struct gc_pad {
+ struct gc {
+ struct pardevice *pd;
+ struct gc_pad pads[GC_MAX_DEVICES];
+- struct input_dev *dev[GC_MAX_DEVICES];
+ struct timer_list timer;
+ int pad_count[GC_MAX];
+ int used;
+@@ -387,7 +386,7 @@ static void gc_nes_process_packet(struct
+ for (i = 0; i < GC_MAX_DEVICES; i++) {
+
+ pad = &gc->pads[i];
+- dev = gc->dev[i];
++ dev = pad->dev;
+ s = gc_status_bit[i];
+
+ switch (pad->type) {
--- /dev/null
+From c25f7b763cc35a249232ce612a36a811b0e263f9 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Tue, 20 Jul 2010 20:25:35 -0700
+Subject: Input: gamecon - reference correct pad in gc_psx_command()
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit c25f7b763cc35a249232ce612a36a811b0e263f9 upstream.
+
+Otherwise we won't see any events from the gamepad.
+Addresses https://bugzilla.kernel.org/show_bug.cgi?id=16408
+
+Reported-and-tested-by: Eugene Yudin <eugene.yudin@gmail.com>
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/input/joystick/gamecon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/input/joystick/gamecon.c
++++ b/drivers/input/joystick/gamecon.c
+@@ -578,7 +578,7 @@ static void gc_psx_command(struct gc *gc
+ read = parport_read_status(port) ^ 0x80;
+
+ for (j = 0; j < GC_MAX_DEVICES; j++) {
+- struct gc_pad *pad = &gc->pads[i];
++ struct gc_pad *pad = &gc->pads[j];
+
+ if (pad->type == GC_PSX || pad->type == GC_DDR)
+ data[j] |= (read & gc_status_bit[j]) ? (1 << i) : 0;
--- /dev/null
+From 3e1bbc8d5018a05c0793c8a32b777a1396eb4414 Mon Sep 17 00:00:00 2001
+From: Kamal Mostafa <kamal@canonical.com>
+Date: Mon, 19 Jul 2010 11:00:52 -0700
+Subject: Input: i8042 - add Gigabyte Spring Peak to dmi_noloop_table
+
+From: Kamal Mostafa <kamal@canonical.com>
+
+commit 3e1bbc8d5018a05c0793c8a32b777a1396eb4414 upstream.
+
+Gigabyte "Spring Peak" notebook indicates wrong chassis-type, tripping up
+i8042 and breaking the touchpad. Add this model to i8042_dmi_noloop_table[]
+to resolve.
+
+BugLink: https://bugs.launchpad.net/bugs/580664
+
+Signed-off-by: Kamal Mostafa <kamal@canonical.com>
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/input/serio/i8042-x86ia64io.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -166,6 +166,13 @@ static const struct dmi_system_id __init
+ },
+ },
+ {
++ /* Gigabyte Spring Peak - defines wrong chassis type */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Spring Peak"),
++ },
++ },
++ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv9700"),
--- /dev/null
+From 3fea60261e73dbf4a51130d40cafcc8465b0f2c3 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Tue, 20 Jul 2010 20:25:35 -0700
+Subject: Input: twl40300-keypad - fix handling of "all ground" rows
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit 3fea60261e73dbf4a51130d40cafcc8465b0f2c3 upstream.
+
+The Nokia RX51 board code (arch/arm/mach-omap2/board-rx51-peripherals.c)
+defines a key map for the matrix keypad keyboard. The hardware seems to
+use all of the 8 rows and 8 columns of the keypad, although not all
+possible locations are used.
+
+The TWL4030 supports keypads with at most 8 rows and 8 columns. Most keys
+are defined with a row and column number between 0 and 7, except
+
+ KEY(0xff, 2, KEY_F9),
+ KEY(0xff, 4, KEY_F10),
+ KEY(0xff, 5, KEY_F11),
+
+which represent keycodes that should be emitted when entire row is
+connected to the ground. since the driver handles this case as if we
+had an extra column in the key matrix. Unfortunately we do not allocate
+enough space and end up owerwriting some random memory.
+
+Reported-and-tested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/mach-omap2/board-rx51-peripherals.c | 17 ++++++++++++++---
+ drivers/input/keyboard/twl4030_keypad.c | 17 +++++++++++------
+ 2 files changed, 25 insertions(+), 9 deletions(-)
+
+--- a/arch/arm/mach-omap2/board-rx51-peripherals.c
++++ b/arch/arm/mach-omap2/board-rx51-peripherals.c
+@@ -147,6 +147,10 @@ static void __init rx51_add_gpio_keys(vo
+ #endif /* CONFIG_KEYBOARD_GPIO || CONFIG_KEYBOARD_GPIO_MODULE */
+
+ static int board_keymap[] = {
++ /*
++ * Note that KEY(x, 8, KEY_XXX) entries represent "entrire row
++ * connected to the ground" matrix state.
++ */
+ KEY(0, 0, KEY_Q),
+ KEY(0, 1, KEY_O),
+ KEY(0, 2, KEY_P),
+@@ -154,6 +158,7 @@ static int board_keymap[] = {
+ KEY(0, 4, KEY_BACKSPACE),
+ KEY(0, 6, KEY_A),
+ KEY(0, 7, KEY_S),
++
+ KEY(1, 0, KEY_W),
+ KEY(1, 1, KEY_D),
+ KEY(1, 2, KEY_F),
+@@ -162,6 +167,7 @@ static int board_keymap[] = {
+ KEY(1, 5, KEY_J),
+ KEY(1, 6, KEY_K),
+ KEY(1, 7, KEY_L),
++
+ KEY(2, 0, KEY_E),
+ KEY(2, 1, KEY_DOT),
+ KEY(2, 2, KEY_UP),
+@@ -169,6 +175,8 @@ static int board_keymap[] = {
+ KEY(2, 5, KEY_Z),
+ KEY(2, 6, KEY_X),
+ KEY(2, 7, KEY_C),
++ KEY(2, 8, KEY_F9),
++
+ KEY(3, 0, KEY_R),
+ KEY(3, 1, KEY_V),
+ KEY(3, 2, KEY_B),
+@@ -177,20 +185,23 @@ static int board_keymap[] = {
+ KEY(3, 5, KEY_SPACE),
+ KEY(3, 6, KEY_SPACE),
+ KEY(3, 7, KEY_LEFT),
++
+ KEY(4, 0, KEY_T),
+ KEY(4, 1, KEY_DOWN),
+ KEY(4, 2, KEY_RIGHT),
+ KEY(4, 4, KEY_LEFTCTRL),
+ KEY(4, 5, KEY_RIGHTALT),
+ KEY(4, 6, KEY_LEFTSHIFT),
++ KEY(4, 8, KEY_10),
++
+ KEY(5, 0, KEY_Y),
++ KEY(5, 8, KEY_11),
++
+ KEY(6, 0, KEY_U),
++
+ KEY(7, 0, KEY_I),
+ KEY(7, 1, KEY_F7),
+ KEY(7, 2, KEY_F8),
+- KEY(0xff, 2, KEY_F9),
+- KEY(0xff, 4, KEY_F10),
+- KEY(0xff, 5, KEY_F11),
+ };
+
+ static struct matrix_keymap_data board_map_data = {
+--- a/drivers/input/keyboard/twl4030_keypad.c
++++ b/drivers/input/keyboard/twl4030_keypad.c
+@@ -51,8 +51,12 @@
+ */
+ #define TWL4030_MAX_ROWS 8 /* TWL4030 hard limit */
+ #define TWL4030_MAX_COLS 8
+-#define TWL4030_ROW_SHIFT 3
+-#define TWL4030_KEYMAP_SIZE (TWL4030_MAX_ROWS * TWL4030_MAX_COLS)
++/*
++ * Note that we add space for an extra column so that we can handle
++ * row lines connected to the gnd (see twl4030_col_xlate()).
++ */
++#define TWL4030_ROW_SHIFT 4
++#define TWL4030_KEYMAP_SIZE (TWL4030_MAX_ROWS << TWL4030_ROW_SHIFT)
+
+ struct twl4030_keypad {
+ unsigned short keymap[TWL4030_KEYMAP_SIZE];
+@@ -182,7 +186,7 @@ static int twl4030_read_kp_matrix_state(
+ return ret;
+ }
+
+-static int twl4030_is_in_ghost_state(struct twl4030_keypad *kp, u16 *key_state)
++static bool twl4030_is_in_ghost_state(struct twl4030_keypad *kp, u16 *key_state)
+ {
+ int i;
+ u16 check = 0;
+@@ -191,12 +195,12 @@ static int twl4030_is_in_ghost_state(str
+ u16 col = key_state[i];
+
+ if ((col & check) && hweight16(col) > 1)
+- return 1;
++ return true;
+
+ check |= col;
+ }
+
+- return 0;
++ return false;
+ }
+
+ static void twl4030_kp_scan(struct twl4030_keypad *kp, bool release_all)
+@@ -225,7 +229,8 @@ static void twl4030_kp_scan(struct twl40
+ if (!changed)
+ continue;
+
+- for (col = 0; col < kp->n_cols; col++) {
++ /* Extra column handles "all gnd" rows */
++ for (col = 0; col < kp->n_cols + 1; col++) {
+ int code;
+
+ if (!(changed & (1 << col)))
--- /dev/null
+From 7a52b34b07122ff5f45258d47f260f8a525518f0 Mon Sep 17 00:00:00 2001
+From: Or Gerlitz <ogerlitz@voltaire.com>
+Date: Sun, 6 Jun 2010 04:59:16 +0000
+Subject: IPoIB: Fix world-writable child interface control sysfs attributes
+
+From: Or Gerlitz <ogerlitz@voltaire.com>
+
+commit 7a52b34b07122ff5f45258d47f260f8a525518f0 upstream.
+
+Sumeet Lahorani <sumeet.lahorani@oracle.com> reported that the IPoIB
+child entries are world-writable; however we don't want ordinary users
+to be able to create and destroy child interfaces, so fix them to be
+writable only by root.
+
+Signed-off-by: Or Gerlitz <ogerlitz@voltaire.com>
+Signed-off-by: Roland Dreier <rolandd@cisco.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/infiniband/ulp/ipoib/ipoib_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -1163,7 +1163,7 @@ static ssize_t create_child(struct devic
+
+ return ret ? ret : count;
+ }
+-static DEVICE_ATTR(create_child, S_IWUGO, NULL, create_child);
++static DEVICE_ATTR(create_child, S_IWUSR, NULL, create_child);
+
+ static ssize_t delete_child(struct device *dev,
+ struct device_attribute *attr,
+@@ -1183,7 +1183,7 @@ static ssize_t delete_child(struct devic
+ return ret ? ret : count;
+
+ }
+-static DEVICE_ATTR(delete_child, S_IWUGO, NULL, delete_child);
++static DEVICE_ATTR(delete_child, S_IWUSR, NULL, delete_child);
+
+ int ipoib_add_pkey_attr(struct net_device *dev)
+ {
--- /dev/null
+From 9078370c0d2cfe4a905aa34f398bbb0d65921a2b Mon Sep 17 00:00:00 2001
+From: Catalin Marinas <catalin.marinas@arm.com>
+Date: Mon, 19 Jul 2010 11:54:15 +0100
+Subject: kmemleak: Add support for NO_BOOTMEM configurations
+
+From: Catalin Marinas <catalin.marinas@arm.com>
+
+commit 9078370c0d2cfe4a905aa34f398bbb0d65921a2b upstream.
+
+With commits 08677214 and 59be5a8e, alloc_bootmem()/free_bootmem() and
+friends use the early_res functions for memory management when
+NO_BOOTMEM is enabled. This patch adds the kmemleak calls in the
+corresponding code paths for bootmem allocations.
+
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Acked-by: Pekka Enberg <penberg@cs.helsinki.fi>
+Acked-by: Yinghai Lu <yinghai@kernel.org>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/early_res.c | 6 ++++++
+ mm/page_alloc.c | 5 +++++
+ 2 files changed, 11 insertions(+)
+
+--- a/kernel/early_res.c
++++ b/kernel/early_res.c
+@@ -7,6 +7,8 @@
+ #include <linux/bootmem.h>
+ #include <linux/mm.h>
+ #include <linux/early_res.h>
++#include <linux/slab.h>
++#include <linux/kmemleak.h>
+
+ /*
+ * Early reserved memory areas.
+@@ -319,6 +321,8 @@ void __init free_early(u64 start, u64 en
+ struct early_res *r;
+ int i;
+
++ kmemleak_free_part(__va(start), end - start);
++
+ i = find_overlapped_early(start, end);
+ r = &early_res[i];
+ if (i >= max_early_res || r->end != end || r->start != start)
+@@ -333,6 +337,8 @@ void __init free_early_partial(u64 start
+ struct early_res *r;
+ int i;
+
++ kmemleak_free_part(__va(start), end - start);
++
+ if (start == end)
+ return;
+
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -3440,6 +3440,11 @@ void * __init __alloc_memory_core_early(
+ ptr = phys_to_virt(addr);
+ memset(ptr, 0, size);
+ reserve_early_without_check(addr, addr + size, "BOOTMEM");
++ /*
++ * The min_count is set to 0 so that bootmem allocated blocks
++ * are never reported as leaks.
++ */
++ kmemleak_alloc(ptr, size, 0, 0);
+ return ptr;
+ }
+
--- /dev/null
+From 56825c88ff438f4dbb51a44591cc29e707fe783a Mon Sep 17 00:00:00 2001
+From: Anton Vorontsov <avorontsov@mvista.com>
+Date: Thu, 8 Jul 2010 21:16:10 +0400
+Subject: powerpc/cpm: Reintroduce global spi_pram struct (fixes build issue)
+
+From: Anton Vorontsov <avorontsov@mvista.com>
+
+commit 56825c88ff438f4dbb51a44591cc29e707fe783a upstream.
+
+spi_t was removed in commit 644b2a680ccc51a9ec4d6beb12e9d47d2dee98e2
+("powerpc/cpm: Remove SPI defines and spi structs"), the commit assumed
+that spi_t isn't used anywhere outside of the spi_mpc8xxx driver. But
+it appears that the struct is needed for micropatch code. So, let's
+reintroduce the struct.
+
+Fixes the following build issue:
+
+ CC arch/powerpc/sysdev/micropatch.o
+ micropatch.c: In function 'cpm_load_patch':
+ micropatch.c:629: error: expected '=', ',', ';', 'asm' or '__attribute__' before '*' token
+ micropatch.c:629: error: 'spp' undeclared (first use in this function)
+ micropatch.c:629: error: (Each undeclared identifier is reported only once
+ micropatch.c:629: error: for each function it appears in.)
+
+Reported-by: LEROY Christophe <christophe.leroy@c-s.fr>
+Reported-by: Tony Breeds <tony@bakeyournoodle.com>
+Signed-off-by: Anton Vorontsov <avorontsov@mvista.com>
+Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/include/asm/cpm.h | 24 ++++++++++++++++++++++++
+ arch/powerpc/sysdev/micropatch.c | 7 ++++---
+ drivers/spi/spi_mpc8xxx.c | 22 ----------------------
+ 3 files changed, 28 insertions(+), 25 deletions(-)
+
+--- a/arch/powerpc/include/asm/cpm.h
++++ b/arch/powerpc/include/asm/cpm.h
+@@ -7,6 +7,30 @@
+ #include <linux/of.h>
+
+ /*
++ * SPI Parameter RAM common to QE and CPM.
++ */
++struct spi_pram {
++ __be16 rbase; /* Rx Buffer descriptor base address */
++ __be16 tbase; /* Tx Buffer descriptor base address */
++ u8 rfcr; /* Rx function code */
++ u8 tfcr; /* Tx function code */
++ __be16 mrblr; /* Max receive buffer length */
++ __be32 rstate; /* Internal */
++ __be32 rdp; /* Internal */
++ __be16 rbptr; /* Internal */
++ __be16 rbc; /* Internal */
++ __be32 rxtmp; /* Internal */
++ __be32 tstate; /* Internal */
++ __be32 tdp; /* Internal */
++ __be16 tbptr; /* Internal */
++ __be16 tbc; /* Internal */
++ __be32 txtmp; /* Internal */
++ __be32 res; /* Tx temp. */
++ __be16 rpbase; /* Relocation pointer (CPM1 only) */
++ __be16 res1; /* Reserved */
++};
++
++/*
+ * USB Controller pram common to QE and CPM.
+ */
+ struct usb_ctlr {
+--- a/arch/powerpc/sysdev/micropatch.c
++++ b/arch/powerpc/sysdev/micropatch.c
+@@ -16,6 +16,7 @@
+ #include <asm/page.h>
+ #include <asm/pgtable.h>
+ #include <asm/8xx_immap.h>
++#include <asm/cpm.h>
+ #include <asm/cpm1.h>
+
+ /*
+@@ -626,7 +627,7 @@ cpm_load_patch(cpm8xx_t *cp)
+ volatile uint *dp; /* Dual-ported RAM. */
+ volatile cpm8xx_t *commproc;
+ volatile iic_t *iip;
+- volatile spi_t *spp;
++ volatile struct spi_pram *spp;
+ volatile smc_uart_t *smp;
+ int i;
+
+@@ -668,8 +669,8 @@ cpm_load_patch(cpm8xx_t *cp)
+ /* Put SPI above the IIC, also 32-byte aligned.
+ */
+ i = (RPBASE + sizeof(iic_t) + 31) & ~31;
+- spp = (spi_t *)&commproc->cp_dparam[PROFF_SPI];
+- spp->spi_rpbase = i;
++ spp = (struct spi_pram *)&commproc->cp_dparam[PROFF_SPI];
++ spp->rpbase = i;
+
+ # if defined(CONFIG_I2C_SPI_UCODE_PATCH)
+ commproc->cp_cpmcr1 = 0x802a;
+--- a/drivers/spi/spi_mpc8xxx.c
++++ b/drivers/spi/spi_mpc8xxx.c
+@@ -66,28 +66,6 @@ struct mpc8xxx_spi_reg {
+ __be32 receive;
+ };
+
+-/* SPI Parameter RAM */
+-struct spi_pram {
+- __be16 rbase; /* Rx Buffer descriptor base address */
+- __be16 tbase; /* Tx Buffer descriptor base address */
+- u8 rfcr; /* Rx function code */
+- u8 tfcr; /* Tx function code */
+- __be16 mrblr; /* Max receive buffer length */
+- __be32 rstate; /* Internal */
+- __be32 rdp; /* Internal */
+- __be16 rbptr; /* Internal */
+- __be16 rbc; /* Internal */
+- __be32 rxtmp; /* Internal */
+- __be32 tstate; /* Internal */
+- __be32 tdp; /* Internal */
+- __be16 tbptr; /* Internal */
+- __be16 tbc; /* Internal */
+- __be32 txtmp; /* Internal */
+- __be32 res; /* Tx temp. */
+- __be16 rpbase; /* Relocation pointer (CPM1 only) */
+- __be16 res1; /* Reserved */
+-};
+-
+ /* SPI Controller mode register definitions */
+ #define SPMODE_LOOP (1 << 30)
+ #define SPMODE_CI_INACTIVEHIGH (1 << 29)
--- /dev/null
+From 2069a6ae19a34d96cc9cb284eb645b165138e03f Mon Sep 17 00:00:00 2001
+From: Anton Vorontsov <avorontsov@mvista.com>
+Date: Thu, 8 Jul 2010 21:16:14 +0400
+Subject: powerpc/cpm1: Fix build with various CONFIG_*_UCODE_PATCH combinations
+
+From: Anton Vorontsov <avorontsov@mvista.com>
+
+commit 2069a6ae19a34d96cc9cb284eb645b165138e03f upstream.
+
+Warnings are treated as errors for arch/powerpc code, so build fails
+with CONFIG_I2C_SPI_UCODE_PATCH=y:
+
+ CC arch/powerpc/sysdev/micropatch.o
+ cc1: warnings being treated as errors
+ arch/powerpc/sysdev/micropatch.c: In function 'cpm_load_patch':
+ arch/powerpc/sysdev/micropatch.c:630: warning: unused variable 'smp'
+ make[1]: *** [arch/powerpc/sysdev/micropatch.o] Error 1
+
+And with CONFIG_USB_SOF_UCODE_PATCH=y:
+
+ CC arch/powerpc/sysdev/micropatch.o
+ cc1: warnings being treated as errors
+ arch/powerpc/sysdev/micropatch.c: In function 'cpm_load_patch':
+ arch/powerpc/sysdev/micropatch.c:629: warning: unused variable 'spp'
+ arch/powerpc/sysdev/micropatch.c:628: warning: unused variable 'iip'
+ make[1]: *** [arch/powerpc/sysdev/micropatch.o] Error 1
+
+This patch fixes these issues by introducing proper #ifdefs.
+
+Signed-off-by: Anton Vorontsov <avorontsov@mvista.com>
+Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/sysdev/micropatch.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/arch/powerpc/sysdev/micropatch.c
++++ b/arch/powerpc/sysdev/micropatch.c
+@@ -626,9 +626,14 @@ cpm_load_patch(cpm8xx_t *cp)
+ {
+ volatile uint *dp; /* Dual-ported RAM. */
+ volatile cpm8xx_t *commproc;
++#if defined(CONFIG_I2C_SPI_UCODE_PATCH) || \
++ defined(CONFIG_I2C_SPI_SMC1_UCODE_PATCH)
+ volatile iic_t *iip;
+ volatile struct spi_pram *spp;
++#ifdef CONFIG_I2C_SPI_SMC1_UCODE_PATCH
+ volatile smc_uart_t *smp;
++#endif
++#endif
+ int i;
+
+ commproc = cp;
--- /dev/null
+From 3cd8519248e9e17d982c6fab0f1a89bca6feb49a Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes@sipsolutions.net>
+Date: Wed, 16 Jun 2010 00:09:35 +0000
+Subject: powerpc: Fix logic error in fixup_irqs
+
+From: Johannes Berg <johannes@sipsolutions.net>
+
+commit 3cd8519248e9e17d982c6fab0f1a89bca6feb49a upstream.
+
+When SPARSE_IRQ is set, irq_to_desc() can
+return NULL. While the code here has a
+check for NULL, it's not really correct.
+Fix it by separating the check for it.
+
+This fixes CPU hot unplug for me.
+
+Reported-by: Alastair Bridgewater <alastair.bridgewater@gmail.com>
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/kernel/irq.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/arch/powerpc/kernel/irq.c
++++ b/arch/powerpc/kernel/irq.c
+@@ -294,7 +294,10 @@ void fixup_irqs(cpumask_t map)
+ cpumask_t mask;
+
+ desc = irq_to_desc(irq);
+- if (desc && desc->status & IRQ_PER_CPU)
++ if (!desc)
++ continue;
++
++ if (desc->status & IRQ_PER_CPU)
+ continue;
+
+ cpumask_and(&mask, desc->affinity, &map);
--- /dev/null
+From 96fc3a45ea073136566f3c2676cad52f8b39a7df Mon Sep 17 00:00:00 2001
+From: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
+Date: Tue, 29 Jun 2010 15:05:34 -0700
+Subject: rtc: fix ds1388 time corruption
+
+From: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
+
+commit 96fc3a45ea073136566f3c2676cad52f8b39a7df upstream.
+
+The ds1307 driver misreads the ds1388 registers when checking for 12 or 24
+hour mode. Instead of checking the hour register it reads the minute
+register. Therefore the driver thinks minutes >= 40 has the 12HR bit set
+and resets the minute register by zeroing the high bits. This results in
+minutes are reset to 0-9, jumping back in time 40 or 50 minutes. The time
+jump is also written back to the RTC.
+
+Signed-off-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
+Cc: Wan ZongShun <mcuos.com@gmail.com>
+Cc: Alessandro Zummo <a.zummo@towertech.it>
+Cc: Paul Gortmaker <p_gortmaker@yahoo.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/rtc/rtc-ds1307.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/rtc/rtc-ds1307.c
++++ b/drivers/rtc/rtc-ds1307.c
+@@ -775,7 +775,7 @@ static int __devinit ds1307_probe(struct
+
+ read_rtc:
+ /* read RTC registers */
+- tmp = ds1307->read_block_data(ds1307->client, 0, 8, buf);
++ tmp = ds1307->read_block_data(ds1307->client, ds1307->offset, 8, buf);
+ if (tmp != 8) {
+ pr_debug("read error %d\n", tmp);
+ err = -EIO;
+@@ -860,7 +860,7 @@ read_rtc:
+ if (ds1307->regs[DS1307_REG_HOUR] & DS1307_BIT_PM)
+ tmp += 12;
+ i2c_smbus_write_byte_data(client,
+- DS1307_REG_HOUR,
++ ds1307->offset + DS1307_REG_HOUR,
+ bin2bcd(tmp));
+ }
+
--- /dev/null
+From 9d51a6b2487724e8713cd2794cf09ffeee5f6932 Mon Sep 17 00:00:00 2001
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Tue, 20 Jul 2010 13:24:33 -0700
+Subject: sdhci-s3c: add missing remove function
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+commit 9d51a6b2487724e8713cd2794cf09ffeee5f6932 upstream.
+
+System will crash sooner or later once the memory with the code of the
+s3c-sdhci.ko module is reused for something else. I really have no idea
+how the lack of remove function went unnoticed into the mainline code.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mmc/host/sdhci-s3c.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+--- a/drivers/mmc/host/sdhci-s3c.c
++++ b/drivers/mmc/host/sdhci-s3c.c
+@@ -373,6 +373,26 @@ static int __devinit sdhci_s3c_probe(str
+
+ static int __devexit sdhci_s3c_remove(struct platform_device *pdev)
+ {
++ struct sdhci_host *host = platform_get_drvdata(pdev);
++ struct sdhci_s3c *sc = sdhci_priv(host);
++ int ptr;
++
++ sdhci_remove_host(host, 1);
++
++ for (ptr = 0; ptr < 3; ptr++) {
++ clk_disable(sc->clk_bus[ptr]);
++ clk_put(sc->clk_bus[ptr]);
++ }
++ clk_disable(sc->clk_io);
++ clk_put(sc->clk_io);
++
++ iounmap(host->ioaddr);
++ release_resource(sc->ioarea);
++ kfree(sc->ioarea);
++
++ sdhci_free_host(host);
++ platform_set_drvdata(pdev, NULL);
++
+ return 0;
+ }
+
sysvfs-fix-null-deref.-when-allocating-new-inode.patch
serial-cpm_uart-implement-the-cpm_uart_early_write-function-for-console-poll.patch
um-os-linux-mem.c-needs-sys-stat.h.patch
+compiler-gcc.h-gcc-4.5-needs-noclone-and-noinline-on-__naked-functions.patch
+rtc-fix-ds1388-time-corruption.patch
+ahci-ata_generic-let-ata_generic-handle-new-mbp-w-mcp89.patch
+ata_generic-implement-ata_gen_-flags-and-force-enable-dma-on-mbp-7-1.patch
+ethtool-fix-potential-kernel-buffer-overflow-in-ethtool_grxclsrlall.patch
+powerpc-fix-logic-error-in-fixup_irqs.patch
+powerpc-cpm-reintroduce-global-spi_pram-struct-fixes-build-issue.patch
+powerpc-cpm1-fix-build-with-various-config_-_ucode_patch-combinations.patch
+kmemleak-add-support-for-no_bootmem-configurations.patch
+sdhci-s3c-add-missing-remove-function.patch
+virtio_net-fix-oom-handling-on-tx.patch
+virtio-fix-oops-on-oom.patch
+edac-mpc85xx-fix-mpc85xx-dependency.patch
+asoc-remove-duplicate-aux-definition-from-wm8776.patch
+x86-nobootmem-make-alloc_bootmem_node-fall-back-to-other-node-when-32bit-numa-is-used.patch
+input-gamecon-reference-correct-input-device-in-nes-mode.patch
+input-gamecon-reference-correct-pad-in-gc_psx_command.patch
+x86-fix-x2apic-preenabled-system-with-kexec.patch
+ipoib-fix-world-writable-child-interface-control-sysfs-attributes.patch
+input-i8042-add-gigabyte-spring-peak-to-dmi_noloop_table.patch
+input-twl40300-keypad-fix-handling-of-all-ground-rows.patch
+arm-6201-1-realview-do-not-use-outer_sync-on-arm11mpcore-boards-with-l220.patch
+arm-6211-1-atomic-ops-fix-register-constraints-for-atomic64_add_unless.patch
+arm-6212-1-atomic-ops-add-memory-constraints-to-inline-asm.patch
+arm-6226-1-fix-kprobe-bug-in-ldr-instruction-emulation.patch
+x86-do-not-try-to-disable-hpet-if-it-hasn-t-been-initialized-before.patch
+x86-pci-mrst-add-extra-sanity-check-in-walking-the-pci-extended-cap-chain.patch
+x86-kprobes-fix-swapped-segment-registers-in-kretprobe.patch
+x86-i8259-only-register-sysdev-if-we-have-a-real-8259-pic.patch
--- /dev/null
+From 1fe9b6fef11771461e69ecd1bc8935a1c7c90cb5 Mon Sep 17 00:00:00 2001
+From: Michael S. Tsirkin <mst@redhat.com>
+Date: Mon, 26 Jul 2010 16:55:30 +0930
+Subject: virtio: fix oops on OOM
+
+From: Michael S. Tsirkin <mst@redhat.com>
+
+commit 1fe9b6fef11771461e69ecd1bc8935a1c7c90cb5 upstream.
+
+virtio ring was changed to return an error code on OOM,
+but one caller was missed and still checks for vq->vring.num.
+The fix is just to check for <0 error code.
+
+Long term it might make sense to change goto add_head to
+just return an error on oom instead, but let's apply
+a minimal fix for 2.6.35.
+
+Reported-by: Chris Mason <chris.mason@oracle.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Tested-by: Chris Mason <chris.mason@oracle.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/virtio/virtio_ring.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -162,7 +162,8 @@ static int vring_add_buf(struct virtqueu
+ void *data)
+ {
+ struct vring_virtqueue *vq = to_vvq(_vq);
+- unsigned int i, avail, head, uninitialized_var(prev);
++ unsigned int i, avail, uninitialized_var(prev);
++ int head;
+
+ START_USE(vq);
+
+@@ -172,7 +173,7 @@ static int vring_add_buf(struct virtqueu
+ * buffers, then go indirect. FIXME: tune this threshold */
+ if (vq->indirect && (out + in) > 1 && vq->num_free) {
+ head = vring_add_indirect(vq, sg, out, in);
+- if (head != vq->vring.num)
++ if (likely(head >= 0))
+ goto add_head;
+ }
+
--- /dev/null
+From 58eba97d0774c69b1cf3e5a8ac74419409d1abbf Mon Sep 17 00:00:00 2001
+From: Rusty Russell <rusty@rustcorp.com.au>
+Date: Fri, 2 Jul 2010 16:34:01 +0000
+Subject: virtio_net: fix oom handling on tx
+
+From: Rusty Russell <rusty@rustcorp.com.au>
+
+commit 58eba97d0774c69b1cf3e5a8ac74419409d1abbf upstream.
+
+virtio net will never try to overflow the TX ring, so the only reason
+add_buf may fail is out of memory. Thus, we can not stop the
+device until some request completes - there's no guarantee anything
+at all is outstanding.
+
+Make the error message clearer as well: error here does not
+indicate queue full.
+
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> (...and avoid TX_BUSY)
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ drivers/net/virtio_net.c | 21 +++++++++++++--------
+ 1 file changed, 13 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -566,7 +566,6 @@ static netdev_tx_t start_xmit(struct sk_
+ struct virtnet_info *vi = netdev_priv(dev);
+ int capacity;
+
+-again:
+ /* Free up any pending old buffers before queueing new ones. */
+ free_old_xmit_skbs(vi);
+
+@@ -575,14 +574,20 @@ again:
+
+ /* This can happen with OOM and indirect buffers. */
+ if (unlikely(capacity < 0)) {
+- netif_stop_queue(dev);
+- dev_warn(&dev->dev, "Unexpected full queue\n");
+- if (unlikely(!vi->svq->vq_ops->enable_cb(vi->svq))) {
+- vi->svq->vq_ops->disable_cb(vi->svq);
+- netif_start_queue(dev);
+- goto again;
++ if (net_ratelimit()) {
++ if (likely(capacity == -ENOMEM)) {
++ dev_warn(&dev->dev,
++ "TX queue failure: out of memory\n");
++ } else {
++ dev->stats.tx_fifo_errors++;
++ dev_warn(&dev->dev,
++ "Unexpected TX queue failure: %d\n",
++ capacity);
++ }
+ }
+- return NETDEV_TX_BUSY;
++ dev->stats.tx_dropped++;
++ kfree_skb(skb);
++ return NETDEV_TX_OK;
+ }
+ vi->svq->vq_ops->kick(vi->svq);
+
--- /dev/null
+From ff4878089e1eaeac79d57878ad4ea32910fb4037 Mon Sep 17 00:00:00 2001
+From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
+Date: Wed, 21 Jul 2010 18:32:37 +0100
+Subject: x86: Do not try to disable hpet if it hasn't been initialized before
+
+From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
+
+commit ff4878089e1eaeac79d57878ad4ea32910fb4037 upstream.
+
+hpet_disable is called unconditionally on machine reboot if hpet support
+is compiled in the kernel.
+hpet_disable only checks if the machine is hpet capable but doesn't make
+sure that hpet has been initialized.
+
+[ tglx: Made it a one liner and removed the redundant hpet_address check ]
+
+Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
+Acked-by: Venkatesh Pallipadi <venki@google.com>
+LKML-Reference: <alpine.DEB.2.00.1007211726240.22235@kaball-desktop>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/hpet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/hpet.c
++++ b/arch/x86/kernel/hpet.c
+@@ -959,7 +959,7 @@ fs_initcall(hpet_late_init);
+
+ void hpet_disable(void)
+ {
+- if (is_hpet_capable()) {
++ if (is_hpet_capable() && hpet_virt_address) {
+ unsigned int cfg = hpet_readl(HPET_CFG);
+
+ if (hpet_legacy_int_enabled) {
--- /dev/null
+From fd19dce7ac07973f700b0f13fb7f94b951414a4c Mon Sep 17 00:00:00 2001
+From: Yinghai Lu <yinghai@kernel.org>
+Date: Thu, 15 Jul 2010 00:00:59 -0700
+Subject: x86: Fix x2apic preenabled system with kexec
+
+From: Yinghai Lu <yinghai@kernel.org>
+
+commit fd19dce7ac07973f700b0f13fb7f94b951414a4c upstream.
+
+Found one x2apic system kexec loop test failed
+when CONFIG_NMI_WATCHDOG=y (old) or CONFIG_LOCKUP_DETECTOR=y (current tip)
+
+first kernel can kexec second kernel, but second kernel can not kexec third one.
+
+it can be duplicated on another system with BIOS preenabled x2apic.
+First kernel can not kexec second kernel.
+
+It turns out, when kernel boot with pre-enabled x2apic, it will not execute
+disable_local_APIC on shutdown path.
+
+when init_apic_mappings() is called in setup_arch, it will skip setting of
+apic_phys when x2apic_mode is set. ( x2apic_mode is much early check_x2apic())
+Then later, disable_local_APIC() will bail out early because !apic_phys.
+
+So check !x2apic_mode in x2apic_mode in disable_local_APIC with !apic_phys.
+
+another solution could be updating init_apic_mappings() to set apic_phys even
+for preenabled x2apic system. Actually even for x2apic system, that lapic
+address is mapped already in early stage.
+
+BTW: is there any x2apic preenabled system with apicid of boot cpu > 255?
+
+Signed-off-by: Yinghai Lu <yinghai@kernel.org>
+LKML-Reference: <4C3EB22B.3000701@kernel.org>
+Acked-by: Suresh Siddha <suresh.b.siddha@intel.com>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/apic/apic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -920,7 +920,7 @@ void disable_local_APIC(void)
+ unsigned int value;
+
+ /* APIC hasn't been mapped yet */
+- if (!apic_phys)
++ if (!x2apic_mode && !apic_phys)
+ return;
+
+ clear_local_APIC();
--- /dev/null
+From 087b255a2b43f417af83cb44e0bb02507f36b7fe Mon Sep 17 00:00:00 2001
+From: Adam Lackorzynski <adam@os.inf.tu-dresden.de>
+Date: Tue, 20 Jul 2010 15:18:19 -0700
+Subject: x86, i8259: Only register sysdev if we have a real 8259 PIC
+
+From: Adam Lackorzynski <adam@os.inf.tu-dresden.de>
+
+commit 087b255a2b43f417af83cb44e0bb02507f36b7fe upstream.
+
+My platform makes use of the null_legacy_pic choice and oopses when doing
+a shutdown as the shutdown code goes through all the registered sysdevs
+and calls their shutdown method which in my case poke on a non-existing
+i8259. Imho the i8259 specific sysdev should only be registered if the
+i8259 is actually there.
+
+Do not register the sysdev function when the null_legacy_pic is used so
+that the i8259 resume, suspend and shutdown functions are not called.
+
+Signed-off-by: Adam Lackorzynski <adam@os.inf.tu-dresden.de>
+LKML-Reference: <201007202218.o6KMIJ3m020955@imap1.linux-foundation.org>
+Cc: Jacob Pan <jacob.jun.pan@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/i8259.c | 25 +++++++++++++++----------
+ 1 file changed, 15 insertions(+), 10 deletions(-)
+
+--- a/arch/x86/kernel/i8259.c
++++ b/arch/x86/kernel/i8259.c
+@@ -276,16 +276,6 @@ static struct sys_device device_i8259A =
+ .cls = &i8259_sysdev_class,
+ };
+
+-static int __init i8259A_init_sysfs(void)
+-{
+- int error = sysdev_class_register(&i8259_sysdev_class);
+- if (!error)
+- error = sysdev_register(&device_i8259A);
+- return error;
+-}
+-
+-device_initcall(i8259A_init_sysfs);
+-
+ static void mask_8259A(void)
+ {
+ unsigned long flags;
+@@ -407,3 +397,18 @@ struct legacy_pic default_legacy_pic = {
+ };
+
+ struct legacy_pic *legacy_pic = &default_legacy_pic;
++
++static int __init i8259A_init_sysfs(void)
++{
++ int error;
++
++ if (legacy_pic != &default_legacy_pic)
++ return 0;
++
++ error = sysdev_class_register(&i8259_sysdev_class);
++ if (!error)
++ error = sysdev_register(&device_i8259A);
++ return error;
++}
++
++device_initcall(i8259A_init_sysfs);
--- /dev/null
+From a197479848a2f1a2a5c07cffa6c31ab5e8c82797 Mon Sep 17 00:00:00 2001
+From: Roland McGrath <roland@redhat.com>
+Date: Fri, 16 Jul 2010 18:17:12 -0700
+Subject: x86: kprobes: fix swapped segment registers in kretprobe
+
+From: Roland McGrath <roland@redhat.com>
+
+commit a197479848a2f1a2a5c07cffa6c31ab5e8c82797 upstream.
+
+In commit f007ea26, the order of the %es and %ds segment registers
+got accidentally swapped, so synthesized 'struct pt_regs' frames
+have the two values inverted. It's almost sure that these values
+never matter, and that they also never differ. But wrong is wrong.
+
+Signed-off-by: Roland McGrath <roland@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/kprobes.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/kprobes.c
++++ b/arch/x86/kernel/kprobes.c
+@@ -632,8 +632,8 @@ static int __kprobes kprobe_handler(stru
+ /* Skip cs, ip, orig_ax and gs. */ \
+ " subl $16, %esp\n" \
+ " pushl %fs\n" \
+- " pushl %ds\n" \
+ " pushl %es\n" \
++ " pushl %ds\n" \
+ " pushl %eax\n" \
+ " pushl %ebp\n" \
+ " pushl %edi\n" \
--- /dev/null
+From b8ab9f82025adea77864115da73e70026fa4f540 Mon Sep 17 00:00:00 2001
+From: Yinghai Lu <yinghai@kernel.org>
+Date: Tue, 20 Jul 2010 13:24:31 -0700
+Subject: x86,nobootmem: make alloc_bootmem_node fall back to other node when 32bit numa is used
+
+From: Yinghai Lu <yinghai@kernel.org>
+
+commit b8ab9f82025adea77864115da73e70026fa4f540 upstream.
+
+Borislav Petkov reported his 32bit numa system has problem:
+
+[ 0.000000] Reserving total of 4c00 pages for numa KVA remap
+[ 0.000000] kva_start_pfn ~ 32800 max_low_pfn ~ 375fe
+[ 0.000000] max_pfn = 238000
+[ 0.000000] 8202MB HIGHMEM available.
+[ 0.000000] 885MB LOWMEM available.
+[ 0.000000] mapped low ram: 0 - 375fe000
+[ 0.000000] low ram: 0 - 375fe000
+[ 0.000000] alloc (nid=8 100000 - 7ee00000) (1000000 - ffffffff) 1000 1000 => 34e7000
+[ 0.000000] alloc (nid=8 100000 - 7ee00000) (1000000 - ffffffff) 200 40 => 34c9d80
+[ 0.000000] alloc (nid=0 100000 - 7ee00000) (1000000 - ffffffffffffffff) 180 40 => 34e6140
+[ 0.000000] alloc (nid=1 80000000 - c7e60000) (1000000 - ffffffffffffffff) 240 40 => 80000000
+[ 0.000000] BUG: unable to handle kernel paging request at 40000000
+[ 0.000000] IP: [<c2c8cff1>] __alloc_memory_core_early+0x147/0x1d6
+[ 0.000000] *pdpt = 0000000000000000 *pde = f000ff53f000ff00
+...
+[ 0.000000] Call Trace:
+[ 0.000000] [<c2c8b4f8>] ? __alloc_bootmem_node+0x216/0x22f
+[ 0.000000] [<c2c90c9b>] ? sparse_early_usemaps_alloc_node+0x5a/0x10b
+[ 0.000000] [<c2c9149e>] ? sparse_init+0x1dc/0x499
+[ 0.000000] [<c2c79118>] ? paging_init+0x168/0x1df
+[ 0.000000] [<c2c780ff>] ? native_pagetable_setup_start+0xef/0x1bb
+
+looks like it allocates too much high address for bootmem.
+
+Try to cut limit with get_max_mapped()
+
+Reported-by: Borislav Petkov <borislav.petkov@amd.com>
+Tested-by: Conny Seidel <conny.seidel@amd.com>
+Signed-off-by: Yinghai Lu <yinghai@kernel.org>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Lee Schermerhorn <lee.schermerhorn@hp.com>
+Cc: Mel Gorman <mel@csn.ul.ie>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/bootmem.c | 24 ++++++++++++++++++++----
+ mm/page_alloc.c | 3 +++
+ 2 files changed, 23 insertions(+), 4 deletions(-)
+
+--- a/mm/bootmem.c
++++ b/mm/bootmem.c
+@@ -833,15 +833,24 @@ static void * __init ___alloc_bootmem_no
+ void * __init __alloc_bootmem_node(pg_data_t *pgdat, unsigned long size,
+ unsigned long align, unsigned long goal)
+ {
++ void *ptr;
++
+ if (WARN_ON_ONCE(slab_is_available()))
+ return kzalloc_node(size, GFP_NOWAIT, pgdat->node_id);
+
+ #ifdef CONFIG_NO_BOOTMEM
+- return __alloc_memory_core_early(pgdat->node_id, size, align,
++ ptr = __alloc_memory_core_early(pgdat->node_id, size, align,
++ goal, -1ULL);
++ if (ptr)
++ return ptr;
++
++ ptr = __alloc_memory_core_early(MAX_NUMNODES, size, align,
+ goal, -1ULL);
+ #else
+- return ___alloc_bootmem_node(pgdat->bdata, size, align, goal, 0);
++ ptr = ___alloc_bootmem_node(pgdat->bdata, size, align, goal, 0);
+ #endif
++
++ return ptr;
+ }
+
+ void * __init __alloc_bootmem_node_high(pg_data_t *pgdat, unsigned long size,
+@@ -977,14 +986,21 @@ void * __init __alloc_bootmem_low(unsign
+ void * __init __alloc_bootmem_low_node(pg_data_t *pgdat, unsigned long size,
+ unsigned long align, unsigned long goal)
+ {
++ void *ptr;
++
+ if (WARN_ON_ONCE(slab_is_available()))
+ return kzalloc_node(size, GFP_NOWAIT, pgdat->node_id);
+
+ #ifdef CONFIG_NO_BOOTMEM
+- return __alloc_memory_core_early(pgdat->node_id, size, align,
++ ptr = __alloc_memory_core_early(pgdat->node_id, size, align,
++ goal, ARCH_LOW_ADDRESS_LIMIT);
++ if (ptr)
++ return ptr;
++ ptr = __alloc_memory_core_early(MAX_NUMNODES, size, align,
+ goal, ARCH_LOW_ADDRESS_LIMIT);
+ #else
+- return ___alloc_bootmem_node(pgdat->bdata, size, align,
++ ptr = ___alloc_bootmem_node(pgdat->bdata, size, align,
+ goal, ARCH_LOW_ADDRESS_LIMIT);
+ #endif
++ return ptr;
+ }
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -3415,6 +3415,9 @@ void * __init __alloc_memory_core_early(
+ int i;
+ void *ptr;
+
++ if (limit > get_max_mapped())
++ limit = get_max_mapped();
++
+ /* need to go over early_node_map to find out good range for node */
+ for_each_active_range_index_in_nid(i, nid) {
+ u64 addr;
--- /dev/null
+From f82c3d71d6fd2e6a3e3416f09099e29087e39abf Mon Sep 17 00:00:00 2001
+From: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Date: Fri, 16 Jul 2010 11:58:26 -0700
+Subject: x86, pci, mrst: Add extra sanity check in walking the PCI extended cap chain
+
+From: Jacob Pan <jacob.jun.pan@linux.intel.com>
+
+commit f82c3d71d6fd2e6a3e3416f09099e29087e39abf upstream.
+
+The fixed bar capability structure is searched in PCI extended
+configuration space. We need to make sure there is a valid capability
+ID to begin with otherwise, the search code may stuck in a infinite
+loop which results in boot hang. This patch adds additional check for
+cap ID 0, which is also invalid, and indicates end of chain.
+
+End of chain is supposed to have all fields zero, but that doesn't
+seem to always be the case in the field.
+
+Suggested-by: "H. Peter Anvin" <hpa@zytor.com>
+Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+LKML-Reference: <1279306706-27087-1-git-send-email-jacob.jun.pan@linux.intel.com>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/pci/mrst.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/pci/mrst.c
++++ b/arch/x86/pci/mrst.c
+@@ -66,8 +66,9 @@ static int fixed_bar_cap(struct pci_bus
+ devfn, pos, 4, &pcie_cap))
+ return 0;
+
+- if (pcie_cap == 0xffffffff)
+- return 0;
++ if (PCI_EXT_CAP_ID(pcie_cap) == 0x0000 ||
++ PCI_EXT_CAP_ID(pcie_cap) == 0xffff)
++ break;
+
+ if (PCI_EXT_CAP_ID(pcie_cap) == PCI_EXT_CAP_ID_VNDR) {
+ raw_pci_ext_ops->read(pci_domain_nr(bus), bus->number,
+@@ -76,7 +77,7 @@ static int fixed_bar_cap(struct pci_bus
+ return pos;
+ }
+
+- pos = pcie_cap >> 20;
++ pos = PCI_EXT_CAP_NEXT(pcie_cap);
+ }
+
+ return 0;
projects / thirdparty / kernel / stable-queue.git / commitdiff
