--- /dev/null
+From 9c4843ea576107a3c1fb94f2f758f198e9fe9e54 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Mon, 6 Jun 2011 15:40:23 -0400
+Subject: cifs: silence printk when establishing first session on
+ socket
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit 9c4843ea576107a3c1fb94f2f758f198e9fe9e54 upstream.
+
+When signing is enabled, the first session that's established on a
+socket will cause a printk like this to pop:
+
+ CIFS VFS: Unexpected SMB signature
+
+This is because the key exchange hasn't happened yet, so the signature
+field is bogus. Don't try to check the signature on the socket until the
+first session has been established. Also, eliminate the specific check
+for SMB_COM_NEGOTIATE since this check covers that case too.
+
+Cc: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/cifsencrypt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/cifs/cifsencrypt.c
++++ b/fs/cifs/cifsencrypt.c
+@@ -184,7 +184,7 @@ int cifs_verify_signature(struct smb_hdr
+ if (cifs_pdu == NULL || server == NULL)
+ return -EINVAL;
+
+- if (cifs_pdu->Command == SMB_COM_NEGOTIATE)
++ if (!server->session_estab)
+ return 0;
+
+ if (cifs_pdu->Command == SMB_COM_LOCKING_ANDX) {
--- /dev/null
+From 6a574b5b9b186e28abd3e571dfd1700c5220b510 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sat, 4 Jun 2011 15:39:21 +0200
+Subject: drm/i915: Add a no lvds quirk for the Asus EeeBox PC EB1007
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 6a574b5b9b186e28abd3e571dfd1700c5220b510 upstream.
+
+I found this while figuring out why gnome-shell would not run on my
+Asus EeeBox PC EB1007. As a standalone "pc" this device cleary does not have
+an internal panel, yet it claims it does. Add a quirk to fix this.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_lvds.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -727,6 +727,14 @@ static const struct dmi_system_id intel_
+ DMI_MATCH(DMI_PRODUCT_NAME, "U800"),
+ },
+ },
++ {
++ .callback = intel_no_lvds_dmi_callback,
++ .ident = "Asus EeeBox PC EB1007",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "EB1007"),
++ },
++ },
+
+ { } /* terminating entry */
+ };
--- /dev/null
+From 62fff811d73095bd95579d72f558f03c78f7914a Mon Sep 17 00:00:00 2001
+From: Daniel Haid <d.haid@gogi.tv>
+Date: Wed, 8 Jun 2011 20:04:45 +1000
+Subject: drm/radeon/kms: fix for radeon on systems >4GB without
+ hardware iommu
+
+From: Daniel Haid <d.haid@gogi.tv>
+
+commit 62fff811d73095bd95579d72f558f03c78f7914a upstream.
+
+On my x86_64 system with >4GB of ram and swiotlb instead of
+a hardware iommu (because I have a VIA chipset), the call
+to pci_set_dma_mask (see below) with 40bits returns an error.
+
+But it seems that the radeon driver is designed to have
+need_dma32 = true exactly if pci_set_dma_mask is called
+with 32 bits and false if it is called with 40 bits.
+
+I have read somewhere that the default are 32 bits. So if the
+call fails I suppose that need_dma32 should be set to true.
+
+And indeed the patch fixes the problem I have had before
+and which I had described here:
+http://choon.net/forum/read.php?21,106131,115940
+
+Acked-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_device.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -752,6 +752,7 @@ int radeon_device_init(struct radeon_dev
+ dma_bits = rdev->need_dma32 ? 32 : 40;
+ r = pci_set_dma_mask(rdev->pdev, DMA_BIT_MASK(dma_bits));
+ if (r) {
++ rdev->need_dma32 = true;
+ printk(KERN_WARNING "radeon: No suitable DMA available.\n");
+ }
+
--- /dev/null
+From adcfde516e10aad72d66f6fefd36e6d0e6bd7be7 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Fri, 27 May 2011 10:05:03 -0400
+Subject: drm/radeon/kms: viewport height has to be even
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit adcfde516e10aad72d66f6fefd36e6d0e6bd7be7 upstream.
+
+Otherwise, no vblank interrupts.
+Fixes:
+https://bugs.freedesktop.org/show_bug.cgi?id=37522
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/atombios_crtc.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -1011,7 +1011,7 @@ static int dce4_crtc_do_set_base(struct
+ uint64_t fb_location;
+ uint32_t fb_format, fb_pitch_pixels, tiling_flags;
+ u32 fb_swap = EVERGREEN_GRPH_ENDIAN_SWAP(EVERGREEN_GRPH_ENDIAN_NONE);
+- u32 tmp;
++ u32 tmp, viewport_w, viewport_h;
+ int r;
+
+ /* no fb bound */
+@@ -1137,8 +1137,10 @@ static int dce4_crtc_do_set_base(struct
+ y &= ~1;
+ WREG32(EVERGREEN_VIEWPORT_START + radeon_crtc->crtc_offset,
+ (x << 16) | y);
++ viewport_w = crtc->mode.hdisplay;
++ viewport_h = (crtc->mode.vdisplay + 1) & ~1;
+ WREG32(EVERGREEN_VIEWPORT_SIZE + radeon_crtc->crtc_offset,
+- (crtc->mode.hdisplay << 16) | crtc->mode.vdisplay);
++ (viewport_w << 16) | viewport_h);
+
+ /* pageflip setup */
+ /* make sure flip is at vb rather than hb */
+@@ -1179,7 +1181,7 @@ static int avivo_crtc_do_set_base(struct
+ uint64_t fb_location;
+ uint32_t fb_format, fb_pitch_pixels, tiling_flags;
+ u32 fb_swap = R600_D1GRPH_SWAP_ENDIAN_NONE;
+- u32 tmp;
++ u32 tmp, viewport_w, viewport_h;
+ int r;
+
+ /* no fb bound */
+@@ -1304,8 +1306,10 @@ static int avivo_crtc_do_set_base(struct
+ y &= ~1;
+ WREG32(AVIVO_D1MODE_VIEWPORT_START + radeon_crtc->crtc_offset,
+ (x << 16) | y);
++ viewport_w = crtc->mode.hdisplay;
++ viewport_h = (crtc->mode.vdisplay + 1) & ~1;
+ WREG32(AVIVO_D1MODE_VIEWPORT_SIZE + radeon_crtc->crtc_offset,
+- (crtc->mode.hdisplay << 16) | crtc->mode.vdisplay);
++ (viewport_w << 16) | viewport_h);
+
+ /* pageflip setup */
+ /* make sure flip is at vb rather than hb */
--- /dev/null
+From 1adffbae22332bb558c2a29de19d9aca391869f6 Mon Sep 17 00:00:00 2001
+From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Date: Tue, 31 May 2011 19:38:07 +0900
+Subject: fat: Fix corrupt inode flags when remove ATTR_SYS flag
+
+From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+
+commit 1adffbae22332bb558c2a29de19d9aca391869f6 upstream.
+
+We are clearly missing '~' in fat_ioctl_set_attributes().
+
+Reported-by: Dmitry Dmitriev <dimondmm@yandex.ru>
+Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/fat/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/fat/file.c
++++ b/fs/fat/file.c
+@@ -102,7 +102,7 @@ static int fat_ioctl_set_attributes(stru
+ if (attr & ATTR_SYS)
+ inode->i_flags |= S_IMMUTABLE;
+ else
+- inode->i_flags &= S_IMMUTABLE;
++ inode->i_flags &= ~S_IMMUTABLE;
+ }
+
+ fat_save_attrs(inode, attr);
--- /dev/null
+From e7fbad300a7a6432238f086e3c9a61538a905858 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@stericsson.com>
+Date: Tue, 31 May 2011 18:14:39 +0200
+Subject: genirq: Fix descriptor init on non-sparse IRQs
+
+From: Linus Walleij <linus.walleij@stericsson.com>
+
+commit e7fbad300a7a6432238f086e3c9a61538a905858 upstream.
+
+The genirq changes are initializing descriptors for sparse IRQs quite
+differently from how non-sparse (stacked?) IRQs are initialized, with
+the effect that on my platform all IRQs are default-disabled on sparse
+IRQs and default-enabled if non-sparse IRQs are used, crashing some
+GPIO driver.
+
+Fix this by refactoring the non-sparse IRQs to use the same descriptor
+init function as the sparse IRQs.
+
+Signed-off: Linus Walleij <linus.walleij@linaro.org>
+Link: http://lkml.kernel.org/r/1306858479-16622-1-git-send-email-linus.walleij@stericsson.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/irq/irqdesc.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/kernel/irq/irqdesc.c
++++ b/kernel/irq/irqdesc.c
+@@ -257,13 +257,11 @@ int __init early_irq_init(void)
+ count = ARRAY_SIZE(irq_desc);
+
+ for (i = 0; i < count; i++) {
+- desc[i].irq_data.irq = i;
+- desc[i].irq_data.chip = &no_irq_chip;
+ desc[i].kstat_irqs = alloc_percpu(unsigned int);
+- irq_settings_clr_and_set(desc, ~0, _IRQ_DEFAULT_INIT_FLAGS);
+- alloc_masks(desc + i, GFP_KERNEL, node);
+- desc_smp_init(desc + i, node);
++ alloc_masks(&desc[i], GFP_KERNEL, node);
++ raw_spin_lock_init(&desc[i].lock);
+ lockdep_set_class(&desc[i].lock, &irq_desc_lock_class);
++ desc_set_defaults(i, &desc[i], node);
+ }
+ return arch_early_irq_init();
+ }
--- /dev/null
+From f2513cde93f0957d5dc6c09bc24b0cccd27d8e1d Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Date: Mon, 6 Jun 2011 12:32:43 +0200
+Subject: lockdep: Fix lock_is_held() on recursion
+
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+
+commit f2513cde93f0957d5dc6c09bc24b0cccd27d8e1d upstream.
+
+The main lock_is_held() user is lockdep_assert_held(), avoid false
+assertions in lockdep_off() sections by unconditionally reporting the
+lock is taken.
+
+[ the reason this is important is a lockdep_assert_held() in ttwu()
+ which triggers a warning under lockdep_off() as in printk() which
+ can trigger another wakeup and lock up due to spinlock
+ recursion, as reported and heroically debugged by Arne Jansen ]
+
+Reported-and-tested-by: Arne Jansen <lists@die-jansens.de>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Link: http://lkml.kernel.org/r/1307398759.2497.966.camel@laptop
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/lockdep.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/lockdep.c
++++ b/kernel/lockdep.c
+@@ -3242,7 +3242,7 @@ int lock_is_held(struct lockdep_map *loc
+ int ret = 0;
+
+ if (unlikely(current->lockdep_recursion))
+- return ret;
++ return 1; /* avoid false negative lockdep_assert_held() */
+
+ raw_local_irq_save(flags);
+ check_flags(flags);
--- /dev/null
+From 8c89ddd536bbe97c1e50424778a139abbf5763c3 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Mon, 30 May 2011 15:45:47 -0300
+Subject: [media] media: Fix media device minor registration
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+commit 8c89ddd536bbe97c1e50424778a139abbf5763c3 upstream.
+
+The find_next_zero_bit() is called with the from and to arguments in the
+wrong order. This results in the function always returning 0, and all
+media devices being registered with minor 0. Furthermore, mdev->minor is
+then used before being assigned with the find_next_zero_bit() return
+value. This really makes sure we'll always use minor 0.
+
+Fix this and let the system support more than one media device.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/media-devnode.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/media-devnode.c
++++ b/drivers/media/media-devnode.c
+@@ -213,14 +213,14 @@ int __must_check media_devnode_register(
+
+ /* Part 1: Find a free minor number */
+ mutex_lock(&media_devnode_lock);
+- minor = find_next_zero_bit(media_devnode_nums, 0, MEDIA_NUM_DEVICES);
++ minor = find_next_zero_bit(media_devnode_nums, MEDIA_NUM_DEVICES, 0);
+ if (minor == MEDIA_NUM_DEVICES) {
+ mutex_unlock(&media_devnode_lock);
+ printk(KERN_ERR "could not get a free minor\n");
+ return -ENFILE;
+ }
+
+- set_bit(mdev->minor, media_devnode_nums);
++ set_bit(minor, media_devnode_nums);
+ mutex_unlock(&media_devnode_lock);
+
+ mdev->minor = minor;
nl80211-fix-check-for-valid-ssid-size-in-scan-operations.patch
block-export-blk_-get-put-_queue.patch
usbnet-cdc_ncm-add-missing-.reset_resume-hook.patch
+lockdep-fix-lock_is_held-on-recursion.patch
+drm-i915-add-a-no-lvds-quirk-for-the-asus-eeebox-pc-eb1007.patch
+drm-radeon-kms-viewport-height-has-to-be-even.patch
+drm-radeon-kms-fix-for-radeon-on-systems-4gb-without.patch
+fat-fix-corrupt-inode-flags-when-remove-attr_sys-flag.patch
+xen-off-by-one-errors-in-multicalls.c.patch
+video-fix-use-after-free-by-vga16fb-on-rmmod.patch
+genirq-fix-descriptor-init-on-non-sparse-irqs.patch
+cifs-silence-printk-when-establishing-first-session-on.patch
+media-fix-media-device-minor-registration.patch
+x86-amd-iommu-use-only-per-device-dma_ops.patch
+x86-amd-iommu-fix-3-possible-endless-loops.patch
+x86-amd-iommu-fix-boot-crash-with-hidden-pci-devices.patch
+usb-cdc-acm-adding-second-acm-channel-support-for-nokia-e7.patch
--- /dev/null
+From 4061fde2fa80f40cb27114f60500d38d0afcf350 Mon Sep 17 00:00:00 2001
+From: Toby Gray <toby.gray@realvnc.com>
+Date: Mon, 6 Jun 2011 14:52:48 +0100
+Subject: USB: cdc-acm: Adding second ACM channel support for Nokia E7
+ and C7
+
+From: Toby Gray <toby.gray@realvnc.com>
+
+commit 4061fde2fa80f40cb27114f60500d38d0afcf350 upstream.
+
+This adds the Nokia E7 and C7 to the list of devices in cdc-acm, allowing
+the secondary ACM channel on the device to be exposed. Without this patch
+the ACM driver won't claim this secondary channel as it's marked as
+having a vendor-specific protocol.
+
+Signed-off-by: Toby Gray <toby.gray@realvnc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/class/cdc-acm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1617,6 +1617,8 @@ static const struct usb_device_id acm_id
+ { NOKIA_PCSUITE_ACM_INFO(0x04ce), }, /* Nokia E90 */
+ { NOKIA_PCSUITE_ACM_INFO(0x01d4), }, /* Nokia E55 */
+ { NOKIA_PCSUITE_ACM_INFO(0x0302), }, /* Nokia N8 */
++ { NOKIA_PCSUITE_ACM_INFO(0x0335), }, /* Nokia E7 */
++ { NOKIA_PCSUITE_ACM_INFO(0x03cd), }, /* Nokia C7 */
+ { SAMSUNG_PCSUITE_ACM_INFO(0x6651), }, /* Samsung GTi8510 (INNOV8) */
+
+ /* NOTE: non-Nokia COMM/ACM/0xff is likely MSFT RNDIS... NOT a modem! */
--- /dev/null
+From a50d28de8d5085e0f34f96088a45cc156d022021 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bruno=20Pr=C3=A9mont?= <bonbons@linux-vserver.org>
+Date: Tue, 24 May 2011 19:59:17 +0000
+Subject: video: Fix use-after-free by vga16fb on rmmod
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Bruno=20Pr=C3=A9mont?= <bonbons@linux-vserver.org>
+
+commit a50d28de8d5085e0f34f96088a45cc156d022021 upstream.
+
+Since fb_info is now refcounted and thus may get freed at any time it
+gets unregistered module unloading will try to unregister framebuffer
+as stored in platform data on probe though this pointer may
+be stale.
+
+Cleanup platform data on framebuffer release.
+
+Signed-off-by: Bruno Prémont <bonbons@linux-vserver.org>
+Signed-off-by: Paul Mundt <lethal@linux-sh.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/vga16fb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/video/vga16fb.c
++++ b/drivers/video/vga16fb.c
+@@ -1265,9 +1265,11 @@ static void vga16fb_imageblit(struct fb_
+
+ static void vga16fb_destroy(struct fb_info *info)
+ {
++ struct platform_device *dev = container_of(info->device, struct platform_device, dev);
+ iounmap(info->screen_base);
+ fb_dealloc_cmap(&info->cmap);
+ /* XXX unshare VGA regions */
++ platform_set_drvdata(dev, NULL);
+ framebuffer_release(info);
+ }
+
--- /dev/null
+From 0de66d5b35ee148455e268b2782873204ffdef4b Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <joerg.roedel@amd.com>
+Date: Mon, 6 Jun 2011 16:04:02 +0200
+Subject: x86/amd-iommu: Fix 3 possible endless loops
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+commit 0de66d5b35ee148455e268b2782873204ffdef4b upstream.
+
+The driver contains several loops counting on an u16 value
+where the exit-condition is checked against variables that
+can have values up to 0xffff. In this case the loops will
+never exit. This patch fixed 3 such loops.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/amd_iommu_init.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/kernel/amd_iommu_init.c
++++ b/arch/x86/kernel/amd_iommu_init.c
+@@ -701,8 +701,8 @@ static void __init init_iommu_from_acpi(
+ {
+ u8 *p = (u8 *)h;
+ u8 *end = p, flags = 0;
+- u16 dev_i, devid = 0, devid_start = 0, devid_to = 0;
+- u32 ext_flags = 0;
++ u16 devid = 0, devid_start = 0, devid_to = 0;
++ u32 dev_i, ext_flags = 0;
+ bool alias = false;
+ struct ivhd_entry *e;
+
+@@ -857,7 +857,7 @@ static void __init init_iommu_from_acpi(
+ /* Initializes the device->iommu mapping for the driver */
+ static int __init init_iommu_devices(struct amd_iommu *iommu)
+ {
+- u16 i;
++ u32 i;
+
+ for (i = iommu->first_device; i <= iommu->last_device; ++i)
+ set_iommu_for_device(iommu, i);
+@@ -1146,7 +1146,7 @@ static int __init init_memory_definition
+ */
+ static void init_device_table(void)
+ {
+- u16 devid;
++ u32 devid;
+
+ for (devid = 0; devid <= amd_iommu_last_bdf; ++devid) {
+ set_dev_entry_bit(devid, DEV_ENTRY_VALID);
--- /dev/null
+From 26018874e3584f1658570d41d57d4c34f6a53aa0 Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <joerg.roedel@amd.com>
+Date: Mon, 6 Jun 2011 16:50:14 +0200
+Subject: x86/amd-iommu: Fix boot crash with hidden PCI devices
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+commit 26018874e3584f1658570d41d57d4c34f6a53aa0 upstream.
+
+Some PCIe cards ship with a PCI-PCIe bridge which is not
+visible as a PCI device in Linux. But the device-id of the
+bridge is present in the IOMMU tables which causes a boot
+crash in the IOMMU driver.
+This patch fixes by removing these cards from the IOMMU
+handling. This is a pure -stable fix, a real fix to handle
+this situation appriatly will follow for the next merge
+window.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/amd_iommu.c | 22 +++++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/amd_iommu.c
++++ b/arch/x86/kernel/amd_iommu.c
+@@ -154,6 +154,10 @@ static int iommu_init_device(struct devi
+ pdev = pci_get_bus_and_slot(PCI_BUS(alias), alias & 0xff);
+ if (pdev)
+ dev_data->alias = &pdev->dev;
++ else {
++ kfree(dev_data);
++ return -ENOTSUPP;
++ }
+
+ atomic_set(&dev_data->bind, 0);
+
+@@ -163,6 +167,20 @@ static int iommu_init_device(struct devi
+ return 0;
+ }
+
++static void iommu_ignore_device(struct device *dev)
++{
++ u16 devid, alias;
++
++ devid = get_device_id(dev);
++ alias = amd_iommu_alias_table[devid];
++
++ memset(&amd_iommu_dev_table[devid], 0, sizeof(struct dev_table_entry));
++ memset(&amd_iommu_dev_table[alias], 0, sizeof(struct dev_table_entry));
++
++ amd_iommu_rlookup_table[devid] = NULL;
++ amd_iommu_rlookup_table[alias] = NULL;
++}
++
+ static void iommu_uninit_device(struct device *dev)
+ {
+ kfree(dev->archdata.iommu);
+@@ -192,7 +210,9 @@ int __init amd_iommu_init_devices(void)
+ continue;
+
+ ret = iommu_init_device(&pdev->dev);
+- if (ret)
++ if (ret == -ENOTSUPP)
++ iommu_ignore_device(&pdev->dev);
++ else if (ret)
+ goto out_free;
+ }
+
--- /dev/null
+From 27c2127a15d340706c0aa84e311188a14468d841 Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <joerg.roedel@amd.com>
+Date: Mon, 30 May 2011 15:56:24 +0200
+Subject: x86/amd-iommu: Use only per-device dma_ops
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+commit 27c2127a15d340706c0aa84e311188a14468d841 upstream.
+
+Unfortunatly there are systems where the AMD IOMMU does not
+cover all devices. This breaks with the current driver as it
+initializes the global dma_ops variable. This patch limits
+the AMD IOMMU to the devices listed in the IVRS table fixing
+DMA for devices not covered by the IOMMU.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/amd_iommu.c | 26 ++++++++++++++++++++++++--
+ 1 file changed, 24 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/amd_iommu.c
++++ b/arch/x86/kernel/amd_iommu.c
+@@ -28,6 +28,7 @@
+ #include <asm/proto.h>
+ #include <asm/iommu.h>
+ #include <asm/gart.h>
++#include <asm/dma.h>
+ #include <asm/amd_iommu_proto.h>
+ #include <asm/amd_iommu_types.h>
+ #include <asm/amd_iommu.h>
+@@ -2296,6 +2297,23 @@ static struct dma_map_ops amd_iommu_dma_
+ .dma_supported = amd_iommu_dma_supported,
+ };
+
++static unsigned device_dma_ops_init(void)
++{
++ struct pci_dev *pdev = NULL;
++ unsigned unhandled = 0;
++
++ for_each_pci_dev(pdev) {
++ if (!check_device(&pdev->dev)) {
++ unhandled += 1;
++ continue;
++ }
++
++ pdev->dev.archdata.dma_ops = &amd_iommu_dma_ops;
++ }
++
++ return unhandled;
++}
++
+ /*
+ * The function which clues the AMD IOMMU driver into dma_ops.
+ */
+@@ -2308,7 +2326,7 @@ void __init amd_iommu_init_api(void)
+ int __init amd_iommu_init_dma_ops(void)
+ {
+ struct amd_iommu *iommu;
+- int ret;
++ int ret, unhandled;
+
+ /*
+ * first allocate a default protection domain for every IOMMU we
+@@ -2334,7 +2352,11 @@ int __init amd_iommu_init_dma_ops(void)
+ swiotlb = 0;
+
+ /* Make the driver finally visible to the drivers */
+- dma_ops = &amd_iommu_dma_ops;
++ unhandled = device_dma_ops_init();
++ if (unhandled && max_pfn > MAX_DMA32_PFN) {
++ /* There are unhandled devices - initialize swiotlb for them */
++ swiotlb = 1;
++ }
+
+ amd_iommu_stats_init();
+
--- /dev/null
+From f124c6ae59e193705c9ddac57684d50006d710e6 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <error27@gmail.com>
+Date: Fri, 3 Jun 2011 07:45:28 +0300
+Subject: xen: off by one errors in multicalls.c
+
+From: Dan Carpenter <error27@gmail.com>
+
+commit f124c6ae59e193705c9ddac57684d50006d710e6 upstream.
+
+b->args[] has MC_ARGS elements, so the comparison here should be
+">=" instead of ">". Otherwise we read past the end of the array
+one space.
+
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/xen/multicalls.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/arch/x86/xen/multicalls.c
++++ b/arch/x86/xen/multicalls.c
+@@ -189,10 +189,10 @@ struct multicall_space __xen_mc_entry(si
+ unsigned argidx = roundup(b->argidx, sizeof(u64));
+
+ BUG_ON(preemptible());
+- BUG_ON(b->argidx > MC_ARGS);
++ BUG_ON(b->argidx >= MC_ARGS);
+
+ if (b->mcidx == MC_BATCH ||
+- (argidx + args) > MC_ARGS) {
++ (argidx + args) >= MC_ARGS) {
+ mc_stats_flush(b->mcidx == MC_BATCH ? FL_SLOTS : FL_ARGS);
+ xen_mc_flush();
+ argidx = roundup(b->argidx, sizeof(u64));
+@@ -206,7 +206,7 @@ struct multicall_space __xen_mc_entry(si
+ ret.args = &b->args[argidx];
+ b->argidx = argidx + args;
+
+- BUG_ON(b->argidx > MC_ARGS);
++ BUG_ON(b->argidx >= MC_ARGS);
+ return ret;
+ }
+
+@@ -216,7 +216,7 @@ struct multicall_space xen_mc_extend_arg
+ struct multicall_space ret = { NULL, NULL };
+
+ BUG_ON(preemptible());
+- BUG_ON(b->argidx > MC_ARGS);
++ BUG_ON(b->argidx >= MC_ARGS);
+
+ if (b->mcidx == 0)
+ return ret;
+@@ -224,14 +224,14 @@ struct multicall_space xen_mc_extend_arg
+ if (b->entries[b->mcidx - 1].op != op)
+ return ret;
+
+- if ((b->argidx + size) > MC_ARGS)
++ if ((b->argidx + size) >= MC_ARGS)
+ return ret;
+
+ ret.mc = &b->entries[b->mcidx - 1];
+ ret.args = &b->args[b->argidx];
+ b->argidx += size;
+
+- BUG_ON(b->argidx > MC_ARGS);
++ BUG_ON(b->argidx >= MC_ARGS);
+ return ret;
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
