--- /dev/null
+From d4d9959c099751158c5cf14813fe378e206339c6 Mon Sep 17 00:00:00 2001
+From: Rabin Vincent <rabin@rab.in>
+Date: Wed, 7 Apr 2010 18:10:20 +0100
+Subject: ARM: 6031/1: fix Thumb-2 decompressor
+
+From: Rabin Vincent <rabin@rab.in>
+
+commit d4d9959c099751158c5cf14813fe378e206339c6 upstream.
+
+98e12b5a6e05413 ("ARM: Fix decompressor's kernel size estimation for
+ROM=y") broke the Thumb-2 decompressor because it added an entry in the
+LC0 table but didn't adjust the offset the Thumb-2 code uses to load the
+SP from that table. Fix it.
+
+Signed-off-by: Rabin Vincent <rabin@rab.in>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/boot/compressed/head.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/compressed/head.S
++++ b/arch/arm/boot/compressed/head.S
+@@ -172,7 +172,7 @@ not_angel:
+ adr r0, LC0
+ ARM( ldmia r0, {r1, r2, r3, r4, r5, r6, r11, ip, sp})
+ THUMB( ldmia r0, {r1, r2, r3, r4, r5, r6, r11, ip} )
+- THUMB( ldr sp, [r0, #28] )
++ THUMB( ldr sp, [r0, #32] )
+ subs r0, r0, r1 @ calculate the delta offset
+
+ @ if delta is zero, we are
--- /dev/null
+From 1144601118507f8b3b676a9a392584d216d3f2cc Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Tue, 6 Apr 2010 12:05:01 -0700
+Subject: ath9k: fix double calls to ath_radio_enable
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 1144601118507f8b3b676a9a392584d216d3f2cc upstream.
+
+With the enable_radio being uninitialized, ath_radio_enable() might be
+called twice, which can leave some hardware in an undefined state.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/main.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -2721,8 +2721,7 @@ static int ath9k_config(struct ieee80211
+ all_wiphys_idle = ath9k_all_wiphys_idle(sc);
+ ath9k_set_wiphy_idle(aphy, idle);
+
+- if (!idle && all_wiphys_idle)
+- enable_radio = true;
++ enable_radio = (!idle && all_wiphys_idle);
+
+ /*
+ * After we unlock here its possible another wiphy
--- /dev/null
+From 6513a81e9325d712f1bfb9a1d7b750134e49ff18 Mon Sep 17 00:00:00 2001
+From: Suresh Jayaraman <sjayaraman@suse.de>
+Date: Wed, 31 Mar 2010 12:00:03 +0530
+Subject: cifs: Fix a kernel BUG with remote OS/2 server (try #3)
+
+From: Suresh Jayaraman <sjayaraman@suse.de>
+
+commit 6513a81e9325d712f1bfb9a1d7b750134e49ff18 upstream.
+
+While chasing a bug report involving a OS/2 server, I noticed the server sets
+pSMBr->CountHigh to a incorrect value even in case of normal writes. This
+results in 'nbytes' being computed wrongly and triggers a kernel BUG at
+mm/filemap.c.
+
+void iov_iter_advance(struct iov_iter *i, size_t bytes)
+{
+ BUG_ON(i->count < bytes); <--- BUG here
+
+Why the server is setting 'CountHigh' is not clear but only does so after
+writing 64k bytes. Though this looks like the server bug, the client side
+crash may not be acceptable.
+
+The workaround is to mask off high 16 bits if the number of bytes written as
+returned by the server is greater than the bytes requested by the client as
+suggested by Jeff Layton.
+
+Reviewed-by: Jeff Layton <jlayton@samba.org>
+Signed-off-by: Suresh Jayaraman <sjayaraman@suse.de>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/cifssmb.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/fs/cifs/cifssmb.c
++++ b/fs/cifs/cifssmb.c
+@@ -1517,6 +1517,14 @@ CIFSSMBWrite(const int xid, struct cifsT
+ *nbytes = le16_to_cpu(pSMBr->CountHigh);
+ *nbytes = (*nbytes) << 16;
+ *nbytes += le16_to_cpu(pSMBr->Count);
++
++ /*
++ * Mask off high 16 bits when bytes written as returned by the
++ * server is greater than bytes requested by the client. Some
++ * OS/2 servers are known to set incorrect CountHigh values.
++ */
++ if (*nbytes > count)
++ *nbytes &= 0xFFFF;
+ }
+
+ cifs_buf_release(pSMB);
+@@ -1605,6 +1613,14 @@ CIFSSMBWrite2(const int xid, struct cifs
+ *nbytes = le16_to_cpu(pSMBr->CountHigh);
+ *nbytes = (*nbytes) << 16;
+ *nbytes += le16_to_cpu(pSMBr->Count);
++
++ /*
++ * Mask off high 16 bits when bytes written as returned by the
++ * server is greater than bytes requested by the client. OS/2
++ * servers are known to set incorrect CountHigh values.
++ */
++ if (*nbytes > count)
++ *nbytes &= 0xFFFF;
+ }
+
+ /* cifs_small_buf_release(pSMB); */ /* Freed earlier now in SendReceive2 */
--- /dev/null
+From a24e2d7d8f512340991ef0a59cb5d08d491b8e98 Mon Sep 17 00:00:00 2001
+From: Steve French <sfrench@us.ibm.com>
+Date: Sat, 3 Apr 2010 17:20:21 +0000
+Subject: CIFS: initialize nbytes at the beginning of CIFSSMBWrite()
+
+From: Steve French <sfrench@us.ibm.com>
+
+commit a24e2d7d8f512340991ef0a59cb5d08d491b8e98 upstream.
+
+By doing this we always overwrite nbytes value that is being passed on to
+CIFSSMBWrite() and need not rely on the callers to initialize. CIFSSMBWrite2 is
+doing this already.
+
+Reviewed-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
+Reviewed-by: Jeff Layton <jlayton@samba.org>
+Signed-off-by: Suresh Jayaraman <sjayaraman@suse.de>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/cifssmb.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/cifs/cifssmb.c
++++ b/fs/cifs/cifssmb.c
+@@ -1430,6 +1430,8 @@ CIFSSMBWrite(const int xid, struct cifsT
+ __u32 bytes_sent;
+ __u16 byte_count;
+
++ *nbytes = 0;
++
+ /* cFYI(1, ("write at %lld %d bytes", offset, count));*/
+ if (tcon->ses == NULL)
+ return -ECONNABORTED;
+@@ -1512,7 +1514,6 @@ CIFSSMBWrite(const int xid, struct cifsT
+ cifs_stats_inc(&tcon->num_writes);
+ if (rc) {
+ cFYI(1, ("Send error in write = %d", rc));
+- *nbytes = 0;
+ } else {
+ *nbytes = le16_to_cpu(pSMBr->CountHigh);
+ *nbytes = (*nbytes) << 16;
--- /dev/null
+From ba1163de2f74d624e7b0e530c4104c98ede0045a Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax@redhat.com>
+Date: Tue, 6 Apr 2010 16:11:00 +0000
+Subject: drm/edid/quirks: Envision EN2028
+
+From: Adam Jackson <ajax@redhat.com>
+
+commit ba1163de2f74d624e7b0e530c4104c98ede0045a upstream.
+
+Claims 1280x1024 preferred, physically 1600x1200
+
+cf. http://bugzilla.redhat.com/530399
+
+Signed-off-by: Adam Jackson <ajax@redhat.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/drm_edid.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -85,6 +85,8 @@ static struct edid_quirk {
+
+ /* Envision Peripherals, Inc. EN-7100e */
+ { "EPI", 59264, EDID_QUIRK_135_CLOCK_TOO_HIGH },
++ /* Envision EN2028 */
++ { "EPI", 8232, EDID_QUIRK_PREFER_LARGE_60 },
+
+ /* Funai Electronics PM36B */
+ { "FCM", 13600, EDID_QUIRK_PREFER_LARGE_75 |
--- /dev/null
+From 3a89b4a9ca7ce11e3b7d5119aea917b9fc29a302 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Tue, 6 Apr 2010 12:35:26 -0400
+Subject: drm/radeon/kms/combios: verify dac_adj values are valid
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit 3a89b4a9ca7ce11e3b7d5119aea917b9fc29a302 upstream.
+
+Some vbios dac_adj tables are all zeros. Check for that
+case and use the default table if so.
+
+Should fix fdo bug 27478.
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_combios.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_combios.c
++++ b/drivers/gpu/drm/radeon/radeon_combios.c
+@@ -670,7 +670,9 @@ struct radeon_encoder_primary_dac *radeo
+ dac = RBIOS8(dac_info + 0x3) & 0xf;
+ p_dac->ps2_pdac_adj = (bg << 8) | (dac);
+ }
+- found = 1;
++ /* if the values are all zeros, use the table */
++ if (p_dac->ps2_pdac_adj)
++ found = 1;
+ }
+
+ out:
+@@ -812,7 +814,9 @@ struct radeon_encoder_tv_dac *radeon_com
+ bg = RBIOS8(dac_info + 0x10) & 0xf;
+ dac = RBIOS8(dac_info + 0x11) & 0xf;
+ tv_dac->ntsc_tvdac_adj = (bg << 16) | (dac << 20);
+- found = 1;
++ /* if the values are all zeros, use the table */
++ if (tv_dac->ps2_tvdac_adj)
++ found = 1;
+ } else if (rev > 1) {
+ bg = RBIOS8(dac_info + 0xc) & 0xf;
+ dac = (RBIOS8(dac_info + 0xc) >> 4) & 0xf;
+@@ -825,7 +829,9 @@ struct radeon_encoder_tv_dac *radeon_com
+ bg = RBIOS8(dac_info + 0xe) & 0xf;
+ dac = (RBIOS8(dac_info + 0xe) >> 4) & 0xf;
+ tv_dac->ntsc_tvdac_adj = (bg << 16) | (dac << 20);
+- found = 1;
++ /* if the values are all zeros, use the table */
++ if (tv_dac->ps2_tvdac_adj)
++ found = 1;
+ }
+ tv_dac->tv_std = radeon_combios_get_tv_info(rdev);
+ }
+@@ -842,7 +848,9 @@ struct radeon_encoder_tv_dac *radeon_com
+ (bg << 16) | (dac << 20);
+ tv_dac->pal_tvdac_adj = tv_dac->ps2_tvdac_adj;
+ tv_dac->ntsc_tvdac_adj = tv_dac->ps2_tvdac_adj;
+- found = 1;
++ /* if the values are all zeros, use the table */
++ if (tv_dac->ps2_tvdac_adj)
++ found = 1;
+ } else {
+ bg = RBIOS8(dac_info + 0x4) & 0xf;
+ dac = RBIOS8(dac_info + 0x5) & 0xf;
+@@ -850,7 +858,9 @@ struct radeon_encoder_tv_dac *radeon_com
+ (bg << 16) | (dac << 20);
+ tv_dac->pal_tvdac_adj = tv_dac->ps2_tvdac_adj;
+ tv_dac->ntsc_tvdac_adj = tv_dac->ps2_tvdac_adj;
+- found = 1;
++ /* if the values are all zeros, use the table */
++ if (tv_dac->ps2_tvdac_adj)
++ found = 1;
+ }
+ } else {
+ DRM_INFO("No TV DAC info found in BIOS\n");
--- /dev/null
+From 643acacf02679befd0f98ac3c5fecb805f1c9548 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Mon, 5 Apr 2010 23:57:52 -0400
+Subject: drm/radeon/kms: fix washed out image on legacy tv dac
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit 643acacf02679befd0f98ac3c5fecb805f1c9548 upstream.
+
+bad cast was overwriting the tvdac adj values
+Fixes fdo bug 27478
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_connectors.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -315,7 +315,7 @@ int radeon_connector_set_property(struct
+ radeon_encoder = to_radeon_encoder(encoder);
+ if (!radeon_encoder->enc_priv)
+ return 0;
+- if (rdev->is_atom_bios) {
++ if (ASIC_IS_AVIVO(rdev) || radeon_r4xx_atom) {
+ struct radeon_encoder_atom_dac *dac_int;
+ dac_int = radeon_encoder->enc_priv;
+ dac_int->tv_std = val;
--- /dev/null
+From 57b54ea6b7863ccfeb41851b5f58f9fd1b83c79e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <daenzer@vmware.com>
+Date: Fri, 2 Apr 2010 16:59:06 +0000
+Subject: drm/radeon: R300 AD only has one quad pipe.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <daenzer@vmware.com>
+
+commit 57b54ea6b7863ccfeb41851b5f58f9fd1b83c79e upstream.
+
+Gleaned from the Mesa code.
+
+Fixes https://bugs.freedesktop.org/show_bug.cgi?id=27355 .
+
+Signed-off-by: Michel Dänzer <daenzer@vmware.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/r300.c | 5 +++--
+ drivers/gpu/drm/radeon/radeon_cp.c | 10 ++++++----
+ 2 files changed, 9 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/r300.c
++++ b/drivers/gpu/drm/radeon/r300.c
+@@ -364,11 +364,12 @@ void r300_gpu_init(struct radeon_device
+
+ r100_hdp_reset(rdev);
+ /* FIXME: rv380 one pipes ? */
+- if ((rdev->family == CHIP_R300) || (rdev->family == CHIP_R350)) {
++ if ((rdev->family == CHIP_R300 && rdev->pdev->device != 0x4144) ||
++ (rdev->family == CHIP_R350)) {
+ /* r300,r350 */
+ rdev->num_gb_pipes = 2;
+ } else {
+- /* rv350,rv370,rv380 */
++ /* rv350,rv370,rv380,r300 AD */
+ rdev->num_gb_pipes = 1;
+ }
+ rdev->num_z_pipes = 1;
+--- a/drivers/gpu/drm/radeon/radeon_cp.c
++++ b/drivers/gpu/drm/radeon/radeon_cp.c
+@@ -417,8 +417,9 @@ static int radeon_do_wait_for_idle(drm_r
+ return -EBUSY;
+ }
+
+-static void radeon_init_pipes(drm_radeon_private_t *dev_priv)
++static void radeon_init_pipes(struct drm_device *dev)
+ {
++ drm_radeon_private_t *dev_priv = dev->dev_private;
+ uint32_t gb_tile_config, gb_pipe_sel = 0;
+
+ if ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RV530) {
+@@ -436,11 +437,12 @@ static void radeon_init_pipes(drm_radeon
+ dev_priv->num_gb_pipes = ((gb_pipe_sel >> 12) & 0x3) + 1;
+ } else {
+ /* R3xx */
+- if (((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_R300) ||
++ if (((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_R300 &&
++ dev->pdev->device != 0x4144) ||
+ ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_R350)) {
+ dev_priv->num_gb_pipes = 2;
+ } else {
+- /* R3Vxx */
++ /* RV3xx/R300 AD */
+ dev_priv->num_gb_pipes = 1;
+ }
+ }
+@@ -736,7 +738,7 @@ static int radeon_do_engine_reset(struct
+
+ /* setup the raster pipes */
+ if ((dev_priv->flags & RADEON_FAMILY_MASK) >= CHIP_R300)
+- radeon_init_pipes(dev_priv);
++ radeon_init_pipes(dev);
+
+ /* Reset the CP ring */
+ radeon_do_cp_reset(dev_priv);
--- /dev/null
+From ece6444c2fe80dab679beb5f0d58b091f1933b00 Mon Sep 17 00:00:00 2001
+From: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Date: Thu, 8 Apr 2010 13:17:37 -0700
+Subject: iwlwifi: need check for valid qos packet before free
+
+From: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+
+commit ece6444c2fe80dab679beb5f0d58b091f1933b00 upstream.
+
+For 4965, need to check it is valid qos frame before free, only valid
+QoS frame has the tid used to free the packets.
+
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-4965.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
++++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
+@@ -2008,7 +2008,9 @@ static void iwl4965_rx_reply_tx(struct i
+ IWL_DEBUG_TX_REPLY(priv, "Retry scheduler reclaim scd_ssn "
+ "%d index %d\n", scd_ssn , index);
+ freed = iwl_tx_queue_reclaim(priv, txq_id, index);
+- iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
++ if (qc)
++ iwl_free_tfds_in_queue(priv, sta_id,
++ tid, freed);
+
+ if (priv->mac80211_registered &&
+ (iwl_queue_space(&txq->q) > txq->q.low_mark) &&
+@@ -2034,14 +2036,17 @@ static void iwl4965_rx_reply_tx(struct i
+ tx_resp->failure_frame);
+
+ freed = iwl_tx_queue_reclaim(priv, txq_id, index);
+- iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
++ if (qc && likely(sta_id != IWL_INVALID_STATION))
++ iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
++ else if (sta_id == IWL_INVALID_STATION)
++ IWL_DEBUG_TX_REPLY(priv, "Station not known\n");
+
+ if (priv->mac80211_registered &&
+ (iwl_queue_space(&txq->q) > txq->q.low_mark))
+ iwl_wake_queue(priv, txq_id);
+ }
+-
+- iwl_txq_check_empty(priv, sta_id, tid, txq_id);
++ if (qc && likely(sta_id != IWL_INVALID_STATION))
++ iwl_txq_check_empty(priv, sta_id, tid, txq_id);
+
+ if (iwl_check_bits(status, TX_ABORT_REQUIRED_MSK))
+ IWL_ERR(priv, "TODO: Implement Tx ABORT REQUIRED!!!\n");
--- /dev/null
+From 1cb561f83793191cf86a2db3948d28f5f42df9ff Mon Sep 17 00:00:00 2001
+From: Javier Cardona <javier@cozybit.com>
+Date: Mon, 29 Mar 2010 11:00:20 -0700
+Subject: mac80211: Handle mesh action frames in ieee80211_rx_h_action
+
+From: Javier Cardona <javier@cozybit.com>
+
+commit 1cb561f83793191cf86a2db3948d28f5f42df9ff upstream.
+
+This fixes the problem introduced in commit
+8404080568613d93ad7cf0a16dfb68 which broke mesh peer link establishment.
+
+changes:
+v2 Added missing break (Johannes)
+v3 Broke original patch into two (Johannes)
+
+Signed-off-by: Javier Cardona <javier@cozybit.com>
+Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/mesh.c | 3 ---
+ net/mac80211/rx.c | 5 +++++
+ 2 files changed, 5 insertions(+), 3 deletions(-)
+
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -749,9 +749,6 @@ ieee80211_mesh_rx_mgmt(struct ieee80211_
+
+ switch (fc & IEEE80211_FCTL_STYPE) {
+ case IEEE80211_STYPE_ACTION:
+- if (skb->len < IEEE80211_MIN_ACTION_SIZE)
+- return RX_DROP_MONITOR;
+- /* fall through */
+ case IEEE80211_STYPE_PROBE_RESP:
+ case IEEE80211_STYPE_BEACON:
+ skb_queue_tail(&ifmsh->skb_queue, skb);
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2355,6 +2355,11 @@ static int prepare_for_handlers(struct i
+ /* should never get here */
+ WARN_ON(1);
+ break;
++ case MESH_PLINK_CATEGORY:
++ case MESH_PATH_SEL_CATEGORY:
++ if (ieee80211_vif_is_mesh(&sdata->vif))
++ return ieee80211_mesh_rx_mgmt(sdata, rx->skb);
++ break;
+ }
+
+ return 1;
--- /dev/null
+From 6af7eea2aee57b869f34eba0a94ef122fe90fbfd Mon Sep 17 00:00:00 2001
+From: Christian Borntraeger <borntraeger@de.ibm.com>
+Date: Fri, 9 Apr 2010 13:43:01 +0200
+Subject: [S390] s390: disable change bit override
+
+From: Christian Borntraeger <borntraeger@de.ibm.com>
+
+commit 6af7eea2aee57b869f34eba0a94ef122fe90fbfd upstream.
+
+commit 6a985c6194017de2c062916ad1cd00dee0302c40
+([S390] s390: use change recording override for kernel mapping)
+deactivated the change bit recording for the kernel mapping to
+improve the performance. This works most of the time, but there
+are cases (e.g. kernel runs in home space, futex atomic compare xcmg)
+where we modify user memory with the kernel mapping instead of the
+user mapping.
+Instead of fixing these cases, this patch just deactivates change bit
+override to avoid future problems with other kernel code that might
+use the kernel mapping for user memory.
+
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/s390/mm/vmem.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+--- a/arch/s390/mm/vmem.c
++++ b/arch/s390/mm/vmem.c
+@@ -70,12 +70,8 @@ static pte_t __ref *vmem_pte_alloc(void)
+ pte = alloc_bootmem(PTRS_PER_PTE * sizeof(pte_t));
+ if (!pte)
+ return NULL;
+- if (MACHINE_HAS_HPAGE)
+- clear_table((unsigned long *) pte, _PAGE_TYPE_EMPTY | _PAGE_CO,
+- PTRS_PER_PTE * sizeof(pte_t));
+- else
+- clear_table((unsigned long *) pte, _PAGE_TYPE_EMPTY,
+- PTRS_PER_PTE * sizeof(pte_t));
++ clear_table((unsigned long *) pte, _PAGE_TYPE_EMPTY,
++ PTRS_PER_PTE * sizeof(pte_t));
+ return pte;
+ }
+
+@@ -116,8 +112,7 @@ static int vmem_add_mem(unsigned long st
+ if (MACHINE_HAS_HPAGE && !(address & ~HPAGE_MASK) &&
+ (address + HPAGE_SIZE <= start + size) &&
+ (address >= HPAGE_SIZE)) {
+- pte_val(pte) |= _SEGMENT_ENTRY_LARGE |
+- _SEGMENT_ENTRY_CO;
++ pte_val(pte) |= _SEGMENT_ENTRY_LARGE;
+ pmd_val(*pm_dir) = pte_val(pte);
+ address += HPAGE_SIZE - PAGE_SIZE;
+ continue;
backlight-mbp_nvidia_bl-add-five-more-macbook-variants.patch
pata_via-add-via-vx900-support.patch
libata-disable-ncq-on-crucial-c300-ssd.patch
+s390-disable-change-bit-override.patch
+cifs-fix-a-kernel-bug-with-remote-os-2-server-try-3.patch
+cifs-initialize-nbytes-at-the-beginning-of-cifssmbwrite.patch
+ath9k-fix-double-calls-to-ath_radio_enable.patch
+iwlwifi-need-check-for-valid-qos-packet-before-free.patch
+mac80211-handle-mesh-action-frames-in-ieee80211_rx_h_action.patch
+arm-6031-1-fix-thumb-2-decompressor.patch
+drm-edid-quirks-envision-en2028.patch
+drm-radeon-r300-ad-only-has-one-quad-pipe.patch
+drm-radeon-kms-fix-washed-out-image-on-legacy-tv-dac.patch
+drm-radeon-kms-combios-verify-dac_adj-values-are-valid.patch
+x86-32-resume-do-a-global-tlb-flush-in-s4-resume.patch
+x86-handle-overlapping-mptables.patch
+x86-hpet-erratum-workaround-for-read-after-write-of-hpet-comparator.patch
+x86-fix-double-enable_ir_x2apic-call-on-smp-kernel-on-smp-boards.patch
--- /dev/null
+From 8ae06d223f8203c72104e5c0c4ee49a000aedb42 Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shaohua.li@intel.com>
+Date: Fri, 5 Mar 2010 08:59:32 +0800
+Subject: x86-32, resume: do a global tlb flush in S4 resume
+
+From: Shaohua Li <shaohua.li@intel.com>
+
+commit 8ae06d223f8203c72104e5c0c4ee49a000aedb42 upstream.
+
+Colin King reported a strange oops in S4 resume code path (see below). The test
+system has i5/i7 CPU. The kernel doesn't open PAE, so 4M page table is used.
+The oops always happen a virtual address 0xc03ff000, which is mapped to the
+last 4k of first 4M memory. Doing a global tlb flush fixes the issue.
+
+EIP: 0060:[<c0493a01>] EFLAGS: 00010086 CPU: 0
+EIP is at copy_loop+0xe/0x15
+EAX: 36aeb000 EBX: 00000000 ECX: 00000400 EDX: f55ad46c
+ESI: 0f800000 EDI: c03ff000 EBP: f67fbec4 ESP: f67fbea8
+DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
+...
+...
+CR2: 00000000c03ff000
+
+Tested-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Shaohua Li <shaohua.li@intel.com>
+LKML-Reference: <20100305005932.GA22675@sli10-desk.sh.intel.com>
+Acked-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/power/hibernate_asm_32.S | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+--- a/arch/x86/power/hibernate_asm_32.S
++++ b/arch/x86/power/hibernate_asm_32.S
+@@ -27,10 +27,17 @@ ENTRY(swsusp_arch_suspend)
+ ret
+
+ ENTRY(restore_image)
++ movl mmu_cr4_features, %ecx
+ movl resume_pg_dir, %eax
+ subl $__PAGE_OFFSET, %eax
+ movl %eax, %cr3
+
++ jecxz 1f # cr4 Pentium and higher, skip if zero
++ andl $~(X86_CR4_PGE), %ecx
++ movl %ecx, %cr4; # turn off PGE
++ movl %cr3, %eax; # flush TLB
++ movl %eax, %cr3
++1:
+ movl restore_pblist, %edx
+ .p2align 4,,7
+
+@@ -54,16 +61,8 @@ done:
+ movl $swapper_pg_dir, %eax
+ subl $__PAGE_OFFSET, %eax
+ movl %eax, %cr3
+- /* Flush TLB, including "global" things (vmalloc) */
+ movl mmu_cr4_features, %ecx
+ jecxz 1f # cr4 Pentium and higher, skip if zero
+- movl %ecx, %edx
+- andl $~(X86_CR4_PGE), %edx
+- movl %edx, %cr4; # turn off PGE
+-1:
+- movl %cr3, %eax; # flush TLB
+- movl %eax, %cr3
+- jecxz 1f # cr4 Pentium and higher, skip if zero
+ movl %ecx, %cr4; # turn PGE back on
+ 1:
+
--- /dev/null
+From 472a474c6630efd195d3738339fd1bdc8aa3b1aa Mon Sep 17 00:00:00 2001
+From: Suresh Siddha <suresh.b.siddha@intel.com>
+Date: Wed, 31 Mar 2010 18:04:47 -0700
+Subject: x86: Fix double enable_IR_x2apic() call on SMP kernel on !SMP boards
+
+From: Suresh Siddha <suresh.b.siddha@intel.com>
+
+commit 472a474c6630efd195d3738339fd1bdc8aa3b1aa upstream.
+
+Jan Grossmann reported kernel boot panic while booting SMP
+kernel on his system with a single core cpu. SMP kernels call
+enable_IR_x2apic() from native_smp_prepare_cpus() and on
+platforms where the kernel doesn't find SMP configuration we
+ended up again calling enable_IR_x2apic() from the
+APIC_init_uniprocessor() call in the smp_sanity_check(). Thus
+leading to kernel panic.
+
+Don't call enable_IR_x2apic() and default_setup_apic_routing()
+from APIC_init_uniprocessor() in CONFIG_SMP case.
+
+NOTE: this kind of non-idempotent and assymetric initialization
+sequence is rather fragile and unclean, we'll clean that up
+in v2.6.35. This is the minimal fix for v2.6.34.
+
+Reported-by: Jan.Grossmann@kielnet.net
+Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
+Cc: <jbarnes@virtuousgeek.org>
+Cc: <david.woodhouse@intel.com>
+Cc: <weidong.han@intel.com>
+Cc: <youquan.song@intel.com>
+Cc: <Jan.Grossmann@kielnet.net>
+LKML-Reference: <1270083887.7835.78.camel@sbs-t61.sc.intel.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/apic/apic.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -1640,8 +1640,10 @@ int __init APIC_init_uniprocessor(void)
+ }
+ #endif
+
++#ifndef CONFIG_SMP
+ enable_IR_x2apic();
+ default_setup_apic_routing();
++#endif
+
+ verify_local_APIC();
+ connect_bsp_APIC();
--- /dev/null
+From 909fc87b32b3b9e3f0b87dcc5d98319c41900c58 Mon Sep 17 00:00:00 2001
+From: Andi Kleen <andi@firstfloor.org>
+Date: Mon, 29 Mar 2010 09:41:11 +0200
+Subject: x86: Handle overlapping mptables
+
+From: Andi Kleen <andi@firstfloor.org>
+
+commit 909fc87b32b3b9e3f0b87dcc5d98319c41900c58 upstream.
+
+We found a system where the MP table MPC and MPF structures overlap.
+
+That doesn't really matter because the mptable is not used anyways with ACPI,
+but it leads to a panic in the early allocator due to the overlapping
+reservations in 2.6.33.
+
+Earlier kernels handled this without problems.
+
+Simply change these reservations to reserve_early_overlap_ok to avoid
+the panic.
+
+Reported-by: Thomas Renninger <trenn@suse.de>
+Tested-by: Thomas Renninger <trenn@suse.de>
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+LKML-Reference: <20100329074111.GA22821@basil.fritz.box>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/mpparse.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/mpparse.c
++++ b/arch/x86/kernel/mpparse.c
+@@ -664,7 +664,7 @@ static void __init smp_reserve_memory(st
+ {
+ unsigned long size = get_mpc_size(mpf->physptr);
+
+- reserve_early(mpf->physptr, mpf->physptr+size, "MP-table mpc");
++ reserve_early_overlap_ok(mpf->physptr, mpf->physptr+size, "MP-table mpc");
+ }
+
+ static int __init smp_scan_config(unsigned long base, unsigned long length)
+@@ -693,7 +693,7 @@ static int __init smp_scan_config(unsign
+ mpf, (u64)virt_to_phys(mpf));
+
+ mem = virt_to_phys(mpf);
+- reserve_early(mem, mem + sizeof(*mpf), "MP-table mpf");
++ reserve_early_overlap_ok(mem, mem + sizeof(*mpf), "MP-table mpf");
+ if (mpf->physptr)
+ smp_reserve_memory(mpf);
+
--- /dev/null
+From 8da854cb02156c90028233ae1e85ce46a1d3f82c Mon Sep 17 00:00:00 2001
+From: Pallipadi, Venkatesh <venkatesh.pallipadi@intel.com>
+Date: Thu, 25 Feb 2010 10:53:48 -0800
+Subject: x86, hpet: Erratum workaround for read after write of HPET comparator
+
+From: Pallipadi, Venkatesh <venkatesh.pallipadi@intel.com>
+
+commit 8da854cb02156c90028233ae1e85ce46a1d3f82c upstream.
+
+On Wed, Feb 24, 2010 at 03:37:04PM -0800, Justin Piszcz wrote:
+> Hello,
+>
+> Again, on the Intel DP55KG board:
+>
+> # uname -a
+> Linux host 2.6.33 #1 SMP Wed Feb 24 18:31:00 EST 2010 x86_64 GNU/Linux
+>
+> [ 1.237600] ------------[ cut here ]------------
+> [ 1.237890] WARNING: at arch/x86/kernel/hpet.c:404 hpet_next_event+0x70/0x80()
+> [ 1.238221] Hardware name:
+> [ 1.238504] hpet: compare register read back failed.
+> [ 1.238793] Modules linked in:
+> [ 1.239315] Pid: 0, comm: swapper Not tainted 2.6.33 #1
+> [ 1.239605] Call Trace:
+> [ 1.239886] <IRQ> [<ffffffff81056c13>] ? warn_slowpath_common+0x73/0xb0
+> [ 1.240409] [<ffffffff81079608>] ? tick_dev_program_event+0x38/0xc0
+> [ 1.240699] [<ffffffff81056cb0>] ? warn_slowpath_fmt+0x40/0x50
+> [ 1.240992] [<ffffffff81079608>] ? tick_dev_program_event+0x38/0xc0
+> [ 1.241281] [<ffffffff81041ad0>] ? hpet_next_event+0x70/0x80
+> [ 1.241573] [<ffffffff81079608>] ? tick_dev_program_event+0x38/0xc0
+> [ 1.241859] [<ffffffff81078e32>] ? tick_handle_oneshot_broadcast+0xe2/0x100
+> [ 1.246533] [<ffffffff8102a67a>] ? timer_interrupt+0x1a/0x30
+> [ 1.246826] [<ffffffff81085499>] ? handle_IRQ_event+0x39/0xd0
+> [ 1.247118] [<ffffffff81087368>] ? handle_edge_irq+0xb8/0x160
+> [ 1.247407] [<ffffffff81029f55>] ? handle_irq+0x15/0x20
+> [ 1.247689] [<ffffffff810294a2>] ? do_IRQ+0x62/0xe0
+> [ 1.247976] [<ffffffff8146be53>] ? ret_from_intr+0x0/0xa
+> [ 1.248262] <EOI> [<ffffffff8102f277>] ? mwait_idle+0x57/0x80
+> [ 1.248796] [<ffffffff8102645c>] ? cpu_idle+0x5c/0xb0
+> [ 1.249080] ---[ end trace db7f668fb6fef4e1 ]---
+>
+> Is this something Intel has to fix or is it a bug in the kernel?
+
+This is a chipset erratum.
+
+Thomas: You mentioned we can retain this check only for known-buggy and
+hpet debug kind of options. But here is the simple workaround patch for
+this particular erratum.
+
+Some chipsets have a erratum due to which read immediately following a
+write of HPET comparator returns old comparator value instead of most
+recently written value.
+
+Erratum 15 in
+"Intel I/O Controller Hub 9 (ICH9) Family Specification Update"
+(http://www.intel.com/assets/pdf/specupdate/316973.pdf)
+
+Workaround for the errata is to read the comparator twice if the first
+one fails.
+
+Signed-off-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
+LKML-Reference: <20100225185348.GA9674@linux-os.sc.intel.com>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Cc: Venkatesh Pallipadi <venkatesh.pallipadi@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/hpet.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/hpet.c
++++ b/arch/x86/kernel/hpet.c
+@@ -399,9 +399,15 @@ static int hpet_next_event(unsigned long
+ * then we might have a real hardware problem. We can not do
+ * much about it here, but at least alert the user/admin with
+ * a prominent warning.
++ * An erratum on some chipsets (ICH9,..), results in comparator read
++ * immediately following a write returning old value. Workaround
++ * for this is to read this value second time, when first
++ * read returns old value.
+ */
+- WARN_ONCE(hpet_readl(HPET_Tn_CMP(timer)) != cnt,
++ if (unlikely((u32)hpet_readl(HPET_Tn_CMP(timer)) != cnt)) {
++ WARN_ONCE(hpet_readl(HPET_Tn_CMP(timer)) != cnt,
+ KERN_WARNING "hpet: compare register read back failed.\n");
++ }
+
+ return (s32)(hpet_readl(HPET_COUNTER) - cnt) >= 0 ? -ETIME : 0;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
