--- /dev/null
+From gregkh@mini.kroah.org Wed Sep 16 15:29:00 2009
+Message-Id: <20090916222900.766305892@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:28:20 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Stephen Kitt <steve@sk2.org>,
+ Dmitry Torokhov <dtor@mail.ru>
+Subject: [patch 01/24] Input: joydev - decouple axis and button map ioctls from input constants
+References: <20090916222819.244332644@mini.kroah.org>
+Content-Disposition: inline; filename=input-joydev-decouple-axis-and-button-map-ioctls-from-input-constants.patch
+Content-Length: 3628
+Lines: 121
+
+From: Stephen Kitt <steve@sk2.org>
+
+commit ec8b4b7085605e801a7740a2c3c33256aebe249c upstream.
+
+The KEY_MAX change in 2.6.28 changed the values of the JSIOCSBTNMAP and
+JSIOCGBTNMAP constants; software compiled with the old values no longer
+works with kernels following 2.6.28, because the ioctl switch statement
+no longer matches the values given by the software. This patch handles
+these ioctls independently of the length of data specified, and applies the
+same treatment to JSIOCSAXMAP and JSIOCGAXMAP which currently depend on
+ABS_MAX.
+
+Signed-off-by: Stephen Kitt <steve@sk2.org>
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/input/joydev.c | 66 ++++++++++++++++++++++++++++++-------------------
+ 1 file changed, 41 insertions(+), 25 deletions(-)
+
+--- a/drivers/input/joydev.c
++++ b/drivers/input/joydev.c
+@@ -457,8 +457,11 @@ static int joydev_ioctl_common(struct jo
+ unsigned int cmd, void __user *argp)
+ {
+ struct input_dev *dev = joydev->handle.dev;
++ size_t len;
+ int i, j;
++ const char *name;
+
++ /* Process fixed-sized commands. */
+ switch (cmd) {
+
+ case JS_SET_CAL:
+@@ -500,9 +503,22 @@ static int joydev_ioctl_common(struct jo
+ return copy_to_user(argp, joydev->corr,
+ sizeof(joydev->corr[0]) * joydev->nabs) ? -EFAULT : 0;
+
+- case JSIOCSAXMAP:
+- if (copy_from_user(joydev->abspam, argp,
+- sizeof(__u8) * (ABS_MAX + 1)))
++ }
++
++ /*
++ * Process variable-sized commands (the axis and button map commands
++ * are considered variable-sized to decouple them from the values of
++ * ABS_MAX and KEY_MAX).
++ */
++ switch (cmd & ~IOCSIZE_MASK) {
++
++ case (JSIOCSAXMAP & ~IOCSIZE_MASK):
++ len = min_t(size_t, _IOC_SIZE(cmd), sizeof(joydev->abspam));
++ /*
++ * FIXME: we should not copy into our axis map before
++ * validating the data.
++ */
++ if (copy_from_user(joydev->abspam, argp, len))
+ return -EFAULT;
+
+ for (i = 0; i < joydev->nabs; i++) {
+@@ -512,13 +528,17 @@ static int joydev_ioctl_common(struct jo
+ }
+ return 0;
+
+- case JSIOCGAXMAP:
+- return copy_to_user(argp, joydev->abspam,
+- sizeof(__u8) * (ABS_MAX + 1)) ? -EFAULT : 0;
+-
+- case JSIOCSBTNMAP:
+- if (copy_from_user(joydev->keypam, argp,
+- sizeof(__u16) * (KEY_MAX - BTN_MISC + 1)))
++ case (JSIOCGAXMAP & ~IOCSIZE_MASK):
++ len = min_t(size_t, _IOC_SIZE(cmd), sizeof(joydev->abspam));
++ return copy_to_user(argp, joydev->abspam, len) ? -EFAULT : 0;
++
++ case (JSIOCSBTNMAP & ~IOCSIZE_MASK):
++ len = min_t(size_t, _IOC_SIZE(cmd), sizeof(joydev->keypam));
++ /*
++ * FIXME: we should not copy into our keymap before
++ * validating the data.
++ */
++ if (copy_from_user(joydev->keypam, argp, len))
+ return -EFAULT;
+
+ for (i = 0; i < joydev->nkey; i++) {
+@@ -530,23 +550,19 @@ static int joydev_ioctl_common(struct jo
+
+ return 0;
+
+- case JSIOCGBTNMAP:
+- return copy_to_user(argp, joydev->keypam,
+- sizeof(__u16) * (KEY_MAX - BTN_MISC + 1)) ? -EFAULT : 0;
++ case (JSIOCGBTNMAP & ~IOCSIZE_MASK):
++ len = min_t(size_t, _IOC_SIZE(cmd), sizeof(joydev->keypam));
++ return copy_to_user(argp, joydev->keypam, len) ? -EFAULT : 0;
++
++ case JSIOCGNAME(0):
++ name = dev->name;
++ if (!name)
++ return 0;
+
+- default:
+- if ((cmd & ~IOCSIZE_MASK) == JSIOCGNAME(0)) {
+- int len;
+- if (!dev->name)
+- return 0;
+- len = strlen(dev->name) + 1;
+- if (len > _IOC_SIZE(cmd))
+- len = _IOC_SIZE(cmd);
+- if (copy_to_user(argp, dev->name, len))
+- return -EFAULT;
+- return len;
+- }
++ len = min_t(size_t, _IOC_SIZE(cmd), strlen(name) + 1);
++ return copy_to_user(argp, name, len) ? -EFAULT : len;
+ }
++
+ return -EINVAL;
+ }
+
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:29:01 2009
+Message-Id: <20090916222900.956520721@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:28:21 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Michal Schmidt <mschmidt@redhat.com>,
+ Douglas Gilbert <dgilbert@interlog.com>,
+ James Bottomley <James.Bottomley@suse.de>
+Subject: [patch 02/24] [SCSI] sg: fix oops in the error path in sg_build_indirect()
+References: <20090916222819.244332644@mini.kroah.org>
+Content-Disposition: inline; filename=sg-fix-oops-in-the-error-path-in-sg_build_indirect.patch
+Content-Length: 798
+Lines: 29
+
+From: Michal Schmidt <mschmidt@redhat.com>
+
+commit e71044ee2efa4792e21d243b03d49006db66aec9 upstream.
+
+When the allocation fails in sg_build_indirect(), an oops happens in
+the error path. It's caused by an obvious typo.
+
+Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
+Reported-by: Bob Tracy <rct@gherkin.frus.com>
+Acked-by: Douglas Gilbert <dgilbert@interlog.com>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/sg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -1811,7 +1811,7 @@ retry:
+ return 0;
+ out:
+ for (i = 0; i < k; i++)
+- __free_pages(schp->pages[k], order);
++ __free_pages(schp->pages[i], order);
+
+ if (--order >= 0)
+ goto retry;
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:29:01 2009
+Message-Id: <20090916222901.073774303@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:28:22 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Stern <stern@rowland.harvard.edu>,
+ Zhenyu Wang <zhenyuw@linux.intel.com>,
+ Dave Airlie <airlied@linux.ie>
+Subject: [patch 03/24] agp/intel: remove restore in resume
+References: <20090916222819.244332644@mini.kroah.org>
+Content-Disposition: inline; filename=agp-intel-remove-restore-in-resume.patch
+Content-Length: 1296
+Lines: 39
+
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+
+commit 121264827656f5f06328b17983c796af17dc5949 upstream.
+
+As early pci resume has already restored config for host
+bridge and graphics device, don't need to restore it again,
+This removes an original order hack for graphics device restore.
+
+This fixed the resume hang issue found by Alan Stern on 845G,
+caused by extra config restore on graphics device.
+
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Dave Airlie <airlied@linux.ie>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/agp/intel-agp.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+--- a/drivers/char/agp/intel-agp.c
++++ b/drivers/char/agp/intel-agp.c
+@@ -2299,15 +2299,6 @@ static int agp_intel_resume(struct pci_d
+ struct agp_bridge_data *bridge = pci_get_drvdata(pdev);
+ int ret_val;
+
+- pci_restore_state(pdev);
+-
+- /* We should restore our graphics device's config space,
+- * as host bridge (00:00) resumes before graphics device (02:00),
+- * then our access to its pci space can work right.
+- */
+- if (intel_private.pcidev)
+- pci_restore_state(intel_private.pcidev);
+-
+ if (bridge->driver == &intel_generic_driver)
+ intel_configure();
+ else if (bridge->driver == &intel_850_driver)
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:29:01 2009
+Message-Id: <20090916222901.250338017@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:28:23 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Bob Copeland <me@bobcopeland.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 04/24] ath5k: write PCU registers on initial reset
+References: <20090916222819.244332644@mini.kroah.org>
+Content-Disposition: inline; filename=ath5k-write-pcu-registers-on-initial-reset.patch
+Content-Length: 1085
+Lines: 31
+
+From: Bob Copeland <me@bobcopeland.com>
+
+commit 3355443ad7601991affa5992b0d53870335af765 upstream.
+
+"Ath5k: unify resets"
+introduced a regression into 2.6.28 where the PCU registers are never
+initialized, due to ath5k_reset() always passing true for change_channel.
+We subsequently program a lot of these registers but several may start
+in an unknown state.
+
+Reported-by: Forrest Zhang <forrest@hifulltech.com>
+Signed-off-by: Bob Copeland <me@bobcopeland.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath5k/base.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath5k/base.c
++++ b/drivers/net/wireless/ath5k/base.c
+@@ -2623,7 +2623,7 @@ ath5k_reset(struct ath5k_softc *sc, stru
+ sc->curchan = chan;
+ sc->curband = &sc->sbands[chan->band];
+ }
+- ret = ath5k_hw_reset(ah, sc->opmode, sc->curchan, true);
++ ret = ath5k_hw_reset(ah, sc->opmode, sc->curchan, chan != NULL);
+ if (ret) {
+ ATH5K_ERR(sc, "can't reset hardware (%d)\n", ret);
+ goto err;
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:29:01 2009
+Message-Id: <20090916222901.411537914@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:28:24 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Roland McGrath <roland@redhat.com>,
+ James Morris <jmorris@namei.org>
+Subject: [patch 05/24] binfmt_elf: fix PT_INTERP bss handling
+References: <20090916222819.244332644@mini.kroah.org>
+Content-Disposition: inline; filename=binfmt_elf-fix-pt_interp-bss-handling.patch
+Content-Length: 2694
+Lines: 83
+
+From: Roland McGrath <roland@redhat.com>
+
+commit 9f0ab4a3f0fdb1ff404d150618ace2fa069bb2e1 upstream.
+
+In fs/binfmt_elf.c, load_elf_interp() calls padzero() for .bss even if
+the PT_LOAD has no PROT_WRITE and no .bss. This generates EFAULT.
+
+Here is a small test case. (Yes, there are other, useful PT_INTERP
+which have only .text and no .data/.bss.)
+
+ ----- ptinterp.S
+ _start: .globl _start
+ nop
+ int3
+ -----
+ $ gcc -m32 -nostartfiles -nostdlib -o ptinterp ptinterp.S
+ $ gcc -m32 -Wl,--dynamic-linker=ptinterp -o hello hello.c
+ $ ./hello
+ Segmentation fault # during execve() itself
+
+ After applying the patch:
+ $ ./hello
+ Trace trap # user-mode execution after execve() finishes
+
+If the ELF headers are actually self-inconsistent, then dying is fine.
+But having no PROT_WRITE segment is perfectly normal and correct if
+there is no segment with p_memsz > p_filesz (i.e. bss). John Reiser
+suggested checking for PROT_WRITE in the bss logic. I think it makes
+most sense to simply apply the bss logic only when there is bss.
+
+This patch looks less trivial than it is due to some reindentation.
+It just moves the "if (last_bss > elf_bss) {" test up to include the
+partial-page bss logic as well as the more-pages bss logic.
+
+Reported-by: John Reiser <jreiser@bitwagon.com>
+Signed-off-by: Roland McGrath <roland@redhat.com>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/binfmt_elf.c | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -501,22 +501,22 @@ static unsigned long load_elf_interp(str
+ }
+ }
+
+- /*
+- * Now fill out the bss section. First pad the last page up
+- * to the page boundary, and then perform a mmap to make sure
+- * that there are zero-mapped pages up to and including the
+- * last bss page.
+- */
+- if (padzero(elf_bss)) {
+- error = -EFAULT;
+- goto out_close;
+- }
++ if (last_bss > elf_bss) {
++ /*
++ * Now fill out the bss section. First pad the last page up
++ * to the page boundary, and then perform a mmap to make sure
++ * that there are zero-mapped pages up to and including the
++ * last bss page.
++ */
++ if (padzero(elf_bss)) {
++ error = -EFAULT;
++ goto out_close;
++ }
+
+- /* What we have mapped so far */
+- elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1);
++ /* What we have mapped so far */
++ elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1);
+
+- /* Map the last of the bss segment */
+- if (last_bss > elf_bss) {
++ /* Map the last of the bss segment */
+ down_write(¤t->mm->mmap_sem);
+ error = do_brk(elf_bss, last_bss - elf_bss);
+ up_write(¤t->mm->mmap_sem);
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:29:01 2009
+Message-Id: <20090916222901.570305710@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:28:25 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Bob Copeland <me@bobcopeland.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 06/24] cfg80211: fix looping soft lockup in find_ie()
+References: <20090916222819.244332644@mini.kroah.org>
+Content-Disposition: inline; filename=cfg80211-fix-looping-soft-lockup-in-find_ie.patch
+Content-Length: 4471
+Lines: 79
+
+From: Bob Copeland <me@bobcopeland.com>
+
+commit fcc6cb0c13555e78c2d47257b6d1b5e59b0c419a upstream.
+
+The find_ie() function uses a size_t for the len parameter, and
+directly uses len as a loop variable. If any received packets
+are malformed, it is possible for the decrease of len to overflow,
+and since the result is unsigned, the loop will not terminate.
+Change it to a signed int so the loop conditional works for
+negative values.
+
+This fixes the following soft lockup:
+
+[38573.102007] BUG: soft lockup - CPU#0 stuck for 61s! [phy0:2230]
+[38573.102007] Modules linked in: aes_i586 aes_generic fuse af_packet ipt_REJECT xt_tcpudp nf_conntrack_ipv4 nf_defrag_ipv4 xt_state iptable_filter ip_tables x_tables acpi_cpufreq binfmt_misc dm_mirror dm_region_hash dm_log dm_multipath dm_mod kvm_intel kvm uinput i915 arc4 ecb drm snd_hda_codec_idt ath5k snd_hda_intel hid_apple mac80211 usbhid appletouch snd_hda_codec snd_pcm ath cfg80211 snd_timer i2c_algo_bit ohci1394 video snd processor ieee1394 rfkill ehci_hcd sg sky2 backlight snd_page_alloc uhci_hcd joydev output ac thermal button battery sr_mod applesmc cdrom input_polldev evdev unix [last unloaded: scsi_wait_scan]
+[38573.102007] irq event stamp: 2547724535
+[38573.102007] hardirqs last enabled at (2547724534): [<c1002ffc>] restore_all_notrace+0x0/0x18
+[38573.102007] hardirqs last disabled at (2547724535): [<c10038f4>] apic_timer_interrupt+0x28/0x34
+[38573.102007] softirqs last enabled at (92950144): [<c103ab48>] __do_softirq+0x108/0x210
+[38573.102007] softirqs last disabled at (92950274): [<c1348e74>] _spin_lock_bh+0x14/0x80
+[38573.102007]
+[38573.102007] Pid: 2230, comm: phy0 Tainted: G W (2.6.31-rc7-wl #8) MacBook1,1
+[38573.102007] EIP: 0060:[<f8ea2d50>] EFLAGS: 00010292 CPU: 0
+[38573.102007] EIP is at cmp_ies+0x30/0x180 [cfg80211]
+[38573.102007] EAX: 00000082 EBX: 00000000 ECX: ffffffc1 EDX: d8efd014
+[38573.102007] ESI: ffffff7c EDI: 0000004d EBP: eee2dc50 ESP: eee2dc3c
+[38573.102007] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
+[38573.102007] CR0: 8005003b CR2: d8efd014 CR3: 01694000 CR4: 000026d0
+[38573.102007] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
+[38573.102007] DR6: ffff0ff0 DR7: 00000400
+[38573.102007] Call Trace:
+[38573.102007] [<f8ea2f8d>] cmp_bss+0xed/0x100 [cfg80211]
+[38573.102007] [<f8ea33e4>] cfg80211_bss_update+0x84/0x410 [cfg80211]
+[38573.102007] [<f8ea3884>] cfg80211_inform_bss_frame+0x114/0x180 [cfg80211]
+[38573.102007] [<f97255ff>] ieee80211_bss_info_update+0x4f/0x180 [mac80211]
+[38573.102007] [<f972b118>] ieee80211_rx_bss_info+0x88/0xf0 [mac80211]
+[38573.102007] [<f9739297>] ? ieee802_11_parse_elems+0x27/0x30 [mac80211]
+[38573.102007] [<f972b224>] ieee80211_rx_mgmt_probe_resp+0xa4/0x1c0 [mac80211]
+[38573.102007] [<f972bc59>] ieee80211_sta_rx_queued_mgmt+0x919/0xc50 [mac80211]
+[38573.102007] [<c1009707>] ? sched_clock+0x27/0xa0
+[38573.102007] [<c1009707>] ? sched_clock+0x27/0xa0
+[38573.102007] [<c105ffd0>] ? mark_held_locks+0x60/0x80
+[38573.102007] [<c1348be5>] ? _spin_unlock_irqrestore+0x55/0x70
+[38573.102007] [<c134baa5>] ? sub_preempt_count+0x85/0xc0
+[38573.102007] [<c1348bce>] ? _spin_unlock_irqrestore+0x3e/0x70
+[38573.102007] [<c12c1c0f>] ? skb_dequeue+0x4f/0x70
+[38573.102007] [<f972c021>] ieee80211_sta_work+0x91/0xb80 [mac80211]
+[38573.102007] [<c1009707>] ? sched_clock+0x27/0xa0
+[38573.102007] [<c134baa5>] ? sub_preempt_count+0x85/0xc0
+[38573.102007] [<c10479af>] worker_thread+0x18f/0x320
+[38573.102007] [<c104794e>] ? worker_thread+0x12e/0x320
+[38573.102007] [<c1348be5>] ? _spin_unlock_irqrestore+0x55/0x70
+[38573.102007] [<f972bf90>] ? ieee80211_sta_work+0x0/0xb80 [mac80211]
+[38573.102007] [<c104cbb0>] ? autoremove_wake_function+0x0/0x50
+[38573.102007] [<c1047820>] ? worker_thread+0x0/0x320
+[38573.102007] [<c104c854>] kthread+0x84/0x90
+[38573.102007] [<c104c7d0>] ? kthread+0x0/0x90
+[38573.102007] [<c1003ab7>] kernel_thread_helper+0x7/0x10
+
+Signed-off-by: Bob Copeland <me@bobcopeland.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/wireless/scan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -97,7 +97,7 @@ void cfg80211_bss_expire(struct cfg80211
+ dev->bss_generation++;
+ }
+
+-static u8 *find_ie(u8 num, u8 *ies, size_t len)
++static u8 *find_ie(u8 num, u8 *ies, int len)
+ {
+ while (len > 2 && ies[0] != num) {
+ len -= ies[1] + 2;
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:29:01 2009
+Message-Id: <20090916222901.703180069@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:28:26 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Hugh Dickins <hugh.dickins@tiscali.co.uk>
+Subject: [patch 07/24] fix undefined reference to user_shm_unlock
+References: <20090916222819.244332644@mini.kroah.org>
+Content-Disposition: inline; filename=fix-undefined-reference-to-user_shm_unlock.patch
+Content-Length: 1113
+Lines: 33
+
+From: Hugh Dickins <hugh.dickins@tiscali.co.uk>
+
+commit 2195d2818c37bdf263865f1e9effccdd9fc5f9d4 upstream.
+
+My 353d5c30c666580347515da609dd74a2b8e9b828 "mm: fix hugetlb bug due to
+user_shm_unlock call" broke the CONFIG_SYSVIPC !CONFIG_MMU build of both
+2.6.31 and 2.6.30.6: "undefined reference to `user_shm_unlock'".
+
+gcc didn't understand my comment! so couldn't figure out to optimize
+away user_shm_unlock() from the error path in the hugetlb-less case, as
+it does elsewhere. Help it to do so, in a language it understands.
+
+Reported-by: Mike Frysinger <vapier@gentoo.org>
+Signed-off-by: Hugh Dickins <hugh.dickins@tiscali.co.uk>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ ipc/shm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/ipc/shm.c
++++ b/ipc/shm.c
+@@ -411,7 +411,7 @@ static int newseg(struct ipc_namespace *
+ return error;
+
+ no_id:
+- if (shp->mlock_user) /* shmflg & SHM_HUGETLB case */
++ if (is_file_hugepages(file) && shp->mlock_user)
+ user_shm_unlock(size, shp->mlock_user);
+ fput(file);
+ no_file:
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:29:01 2009
+Message-Id: <20090916222901.862708454@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:28:27 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Geoff Levand <geoffrey.levand@am.sony.com>,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Subject: [patch 08/24] powerpc/ps3: Workaround for flash memory I/O error
+References: <20090916222819.244332644@mini.kroah.org>
+Content-Disposition: inline; filename=powerpc-ps3-workaround-for-flash-memory-i-o-error.patch
+Content-Length: 3401
+Lines: 122
+
+From: Geoff Levand <geoffrey.levand@am.sony.com>
+
+commit bc00351edd5c1b84d48c3fdca740fedfce4ae6ce upstream.
+
+A workaround for flash memory I/O errors when the PS3 internal
+hard disk has not been formatted for OtherOS use.
+
+This error condition mainly effects 'Live CD' users who have not
+formatted the PS3's internal hard disk for OtherOS.
+
+Fixes errors similar to these when using the ps3-flash-util
+or ps3-boot-game-os programs:
+
+ ps3flash read failed 0x2050000
+ os_area_header_read: read error: os_area_header: Input/output error
+ main:627: os_area_read_hp error.
+ ERROR: can't change boot flag
+
+Signed-off-by: Geoff Levand <geoffrey.levand@am.sony.com>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ps3/ps3stor_lib.c | 65 +++++++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 62 insertions(+), 3 deletions(-)
+
+--- a/drivers/ps3/ps3stor_lib.c
++++ b/drivers/ps3/ps3stor_lib.c
+@@ -23,6 +23,65 @@
+ #include <asm/lv1call.h>
+ #include <asm/ps3stor.h>
+
++/*
++ * A workaround for flash memory I/O errors when the internal hard disk
++ * has not been formatted for OtherOS use. Delay disk close until flash
++ * memory is closed.
++ */
++
++static struct ps3_flash_workaround {
++ int flash_open;
++ int disk_open;
++ struct ps3_system_bus_device *disk_sbd;
++} ps3_flash_workaround;
++
++static int ps3stor_open_hv_device(struct ps3_system_bus_device *sbd)
++{
++ int error = ps3_open_hv_device(sbd);
++
++ if (error)
++ return error;
++
++ if (sbd->match_id == PS3_MATCH_ID_STOR_FLASH)
++ ps3_flash_workaround.flash_open = 1;
++
++ if (sbd->match_id == PS3_MATCH_ID_STOR_DISK)
++ ps3_flash_workaround.disk_open = 1;
++
++ return 0;
++}
++
++static int ps3stor_close_hv_device(struct ps3_system_bus_device *sbd)
++{
++ int error;
++
++ if (sbd->match_id == PS3_MATCH_ID_STOR_DISK
++ && ps3_flash_workaround.disk_open
++ && ps3_flash_workaround.flash_open) {
++ ps3_flash_workaround.disk_sbd = sbd;
++ return 0;
++ }
++
++ error = ps3_close_hv_device(sbd);
++
++ if (error)
++ return error;
++
++ if (sbd->match_id == PS3_MATCH_ID_STOR_DISK)
++ ps3_flash_workaround.disk_open = 0;
++
++ if (sbd->match_id == PS3_MATCH_ID_STOR_FLASH) {
++ ps3_flash_workaround.flash_open = 0;
++
++ if (ps3_flash_workaround.disk_sbd) {
++ ps3_close_hv_device(ps3_flash_workaround.disk_sbd);
++ ps3_flash_workaround.disk_open = 0;
++ ps3_flash_workaround.disk_sbd = NULL;
++ }
++ }
++
++ return 0;
++}
+
+ static int ps3stor_probe_access(struct ps3_storage_device *dev)
+ {
+@@ -90,7 +149,7 @@ int ps3stor_setup(struct ps3_storage_dev
+ int error, res, alignment;
+ enum ps3_dma_page_size page_size;
+
+- error = ps3_open_hv_device(&dev->sbd);
++ error = ps3stor_open_hv_device(&dev->sbd);
+ if (error) {
+ dev_err(&dev->sbd.core,
+ "%s:%u: ps3_open_hv_device failed %d\n", __func__,
+@@ -166,7 +225,7 @@ fail_free_irq:
+ fail_sb_event_receive_port_destroy:
+ ps3_sb_event_receive_port_destroy(&dev->sbd, dev->irq);
+ fail_close_device:
+- ps3_close_hv_device(&dev->sbd);
++ ps3stor_close_hv_device(&dev->sbd);
+ fail:
+ return error;
+ }
+@@ -193,7 +252,7 @@ void ps3stor_teardown(struct ps3_storage
+ "%s:%u: destroy event receive port failed %d\n",
+ __func__, __LINE__, error);
+
+- error = ps3_close_hv_device(&dev->sbd);
++ error = ps3stor_close_hv_device(&dev->sbd);
+ if (error)
+ dev_err(&dev->sbd.core,
+ "%s:%u: ps3_close_hv_device failed %d\n", __func__,
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:29:02 2009
+Message-Id: <20090916222902.000624166@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:28:28 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jason Gunthorpe <jgunthorpe@obsidianresearch.com>,
+ Rajiv Andrade <srajiv@linux.vnet.ibm.com>,
+ James Morris <jmorris@namei.org>
+Subject: [patch 09/24] TPM: Fixup boot probe timeout for tpm_tis driver
+References: <20090916222819.244332644@mini.kroah.org>
+Content-Disposition: inline; filename=tpm-fixup-boot-probe-timeout-for-tpm_tis-driver.patch
+Content-Length: 1887
+Lines: 51
+
+From: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+
+commit ec57935837a78f9661125b08a5d08b697568e040 upstream.
+
+When probing the device in tpm_tis_init the call request_locality
+uses timeout_a, which wasn't being initalized until after
+request_locality. This results in request_locality falsely timing
+out if the chip is still starting. Move the initialization to before
+request_locality.
+
+This probably only matters for embedded cases (ie mine), a BIOS likely
+gets the TPM into a state where this code path isn't necessary.
+
+Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+Acked-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/tpm/tpm_tis.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/char/tpm/tpm_tis.c
++++ b/drivers/char/tpm/tpm_tis.c
+@@ -450,6 +450,12 @@ static int tpm_tis_init(struct device *d
+ goto out_err;
+ }
+
++ /* Default timeouts */
++ chip->vendor.timeout_a = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
++ chip->vendor.timeout_b = msecs_to_jiffies(TIS_LONG_TIMEOUT);
++ chip->vendor.timeout_c = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
++ chip->vendor.timeout_d = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
++
+ if (request_locality(chip, 0) != 0) {
+ rc = -ENODEV;
+ goto out_err;
+@@ -457,12 +463,6 @@ static int tpm_tis_init(struct device *d
+
+ vendor = ioread32(chip->vendor.iobase + TPM_DID_VID(0));
+
+- /* Default timeouts */
+- chip->vendor.timeout_a = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+- chip->vendor.timeout_b = msecs_to_jiffies(TIS_LONG_TIMEOUT);
+- chip->vendor.timeout_c = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+- chip->vendor.timeout_d = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+-
+ dev_info(dev,
+ "1.2 TPM (device-id 0x%X, rev-id %d)\n",
+ vendor >> 16, ioread8(chip->vendor.iobase + TPM_RID(0)));
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:29:02 2009
+Message-Id: <20090916222902.178026313@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:28:29 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jan Kara <jack@suse.cz>
+Subject: [patch 10/24] udf: Use device size when drive reported bogus number of written blocks
+References: <20090916222819.244332644@mini.kroah.org>
+Content-Disposition: inline; filename=udf-use-device-size-when-drive-reported-bogus-number-of-written-blocks.patch
+Content-Length: 955
+Lines: 32
+
+From: Jan Kara <jack@suse.cz>
+
+commit 24a5d59f3477bcff4c069ff4d0ca9a3e037d0235 upstream.
+
+Some drives report 0 as the number of written blocks when there are some blocks
+recorded. Use device size in such case so that we can automagically mount such
+media.
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/udf/lowlevel.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/fs/udf/lowlevel.c
++++ b/fs/udf/lowlevel.c
+@@ -56,7 +56,12 @@ unsigned long udf_get_last_block(struct
+ struct block_device *bdev = sb->s_bdev;
+ unsigned long lblock = 0;
+
+- if (ioctl_by_bdev(bdev, CDROM_LAST_WRITTEN, (unsigned long) &lblock))
++ /*
++ * ioctl failed or returned obviously bogus value?
++ * Try using the device size...
++ */
++ if (ioctl_by_bdev(bdev, CDROM_LAST_WRITTEN, (unsigned long) &lblock) ||
++ lblock == 0)
+ lblock = bdev->bd_inode->i_size >> sb->s_blocksize_bits;
+
+ if (lblock)
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:29:02 2009
+Message-Id: <20090916222902.328239195@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:28:30 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Sophie Hamilton <kernel@theblob.org>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 11/24] ALSA: cs46xx - Fix minimum period size
+References: <20090916222819.244332644@mini.kroah.org>
+Content-Disposition: inline; filename=alsa-cs46xx-fix-minimum-period-size.patch
+Content-Length: 820
+Lines: 28
+
+From: Sophie Hamilton <kernel@theblob.org>
+
+commit 6148b130eb84edc76e4fa88da1877b27be6c2f06 upstream.
+
+Fix minimum period size for cs46xx cards. This fixes a problem in the
+case where neither a period size nor a buffer size is passed to ALSA;
+this is the case in Audacious, OpenAL, and others.
+
+Signed-off-by: Sophie Hamilton <kernel@theblob.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/cs46xx/cs46xx_lib.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/cs46xx/cs46xx_lib.h
++++ b/sound/pci/cs46xx/cs46xx_lib.h
+@@ -35,7 +35,7 @@
+
+
+ #ifdef CONFIG_SND_CS46XX_NEW_DSP
+-#define CS46XX_MIN_PERIOD_SIZE 1
++#define CS46XX_MIN_PERIOD_SIZE 64
+ #define CS46XX_MAX_PERIOD_SIZE 1024*1024
+ #else
+ #define CS46XX_MIN_PERIOD_SIZE 2048
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:29:02 2009
+Message-Id: <20090916222902.497530826@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:28:31 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Nicolas Pitre <nico@marvell.com>,
+ Russell King <rmk+kernel@arm.linux.org.uk>
+Subject: [patch 12/24] ARM: 5691/1: fix cache aliasing issues between kmap() and kmap_atomic() with highmem
+References: <20090916222819.244332644@mini.kroah.org>
+Content-Disposition: inline; filename=arm-5691-1-fix-cache-aliasing-issues-between-kmap-and-kmap_atomic-with-highmem.patch
+Content-Length: 1928
+Lines: 59
+
+From: Nicolas Pitre <nico@cam.org>
+
+commit 7929eb9cf643ae416e5081b2a6fa558d37b9854c upstream.
+
+Let's suppose a highmem page is kmap'd with kmap(). A pkmap entry is
+used, the page mapped to it, and the virtual cache is dirtied. Then
+kunmap() is used which does virtually nothing except for decrementing a
+usage count.
+
+Then, let's suppose the _same_ page gets mapped using kmap_atomic().
+It is therefore mapped onto a fixmap entry instead, which has a
+different virtual address unaware of the dirty cache data for that page
+sitting in the pkmap mapping.
+
+Fortunately it is easy to know if a pkmap mapping still exists for that
+page and use it directly with kmap_atomic(), thanks to kmap_high_get().
+
+And actual testing with a printk in the added code path shows that this
+condition is actually met *extremely* frequently. Seems that we've been
+quite lucky that things have worked so well with highmem so far.
+
+Signed-off-by: Nicolas Pitre <nico@marvell.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/mm/highmem.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/arch/arm/mm/highmem.c
++++ b/arch/arm/mm/highmem.c
+@@ -40,11 +40,16 @@ void *kmap_atomic(struct page *page, enu
+ {
+ unsigned int idx;
+ unsigned long vaddr;
++ void *kmap;
+
+ pagefault_disable();
+ if (!PageHighMem(page))
+ return page_address(page);
+
++ kmap = kmap_high_get(page);
++ if (kmap)
++ return kmap;
++
+ idx = type + KM_TYPE_NR * smp_processor_id();
+ vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
+ #ifdef CONFIG_DEBUG_HIGHMEM
+@@ -80,6 +85,9 @@ void kunmap_atomic(void *kvaddr, enum km
+ #else
+ (void) idx; /* to kill a warning */
+ #endif
++ } else if (vaddr >= PKMAP_ADDR(0) && vaddr < PKMAP_ADDR(LAST_PKMAP)) {
++ /* this address was obtained through kmap_high_get() */
++ kunmap_high(pte_page(pkmap_page_table[PKMAP_NR(vaddr)]));
+ }
+ pagefault_enable();
+ }
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:29:02 2009
+Message-Id: <20090916222902.670048692@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:28:32 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mark Brown <broonie@opensource.wolfsonmicro.com>
+Subject: [patch 13/24] ASoC: Fix WM835x Out4 capture enumeration
+References: <20090916222819.244332644@mini.kroah.org>
+Content-Disposition: inline; filename=asoc-fix-wm835x-out4-capture-enumeration.patch
+Content-Length: 803
+Lines: 26
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit 87831cb660954356d68cebdb1406f3be09e784e9 upstream.
+
+It's the 8th enum of a zero indexed array. This is why I don't let
+new drivers use these arrays of enums...
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm8350.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wm8350.c
++++ b/sound/soc/codecs/wm8350.c
+@@ -613,7 +613,7 @@ SOC_DAPM_SINGLE("Switch", WM8350_BEEP_VO
+
+ /* Out4 Capture Mux */
+ static const struct snd_kcontrol_new wm8350_out4_capture_controls =
+-SOC_DAPM_ENUM("Route", wm8350_enum[8]);
++SOC_DAPM_ENUM("Route", wm8350_enum[7]);
+
+ static const struct snd_soc_dapm_widget wm8350_dapm_widgets[] = {
+
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:29:02 2009
+Message-Id: <20090916222902.799848712@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:28:33 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Roland Dreier <rolandd@cisco.com>
+Subject: [patch 14/24] mlx4_core: Allocate and map sufficient ICM memory for EQ context
+References: <20090916222819.244332644@mini.kroah.org>
+Content-Disposition: inline; filename=mlx4_core-allocate-and-map-sufficient-icm-memory-for-eq-context.patch
+Content-Length: 5008
+Lines: 144
+
+From: Roland Dreier <rolandd@cisco.com>
+
+commit fa0681d2129732027355d6b7083dd8932b9b799d upstream.
+
+The current implementation allocates a single host page for EQ context
+memory, which was OK when we only allocated a few EQs. However, since
+we now allocate an EQ for each CPU core, this patch removes the
+hard-coded limit (which we exceed with 4 KB pages and 128 byte EQ
+context entries with 32 CPUs) and uses the same ICM table code as all
+other context tables, which ends up simplifying the code quite a bit
+while fixing the problem.
+
+This problem was actually hit in practice on a dual-socket Nehalem box
+with 16 real hardware threads and sufficiently odd ACPI tables that it
+shows on boot
+
+ SMP: Allowing 32 CPUs, 16 hotplug CPUs
+
+so num_possible_cpus() ends up 32, and mlx4 ends up creating 33 MSI-X
+interrupts and 33 EQs. This mlx4 bug means that mlx4 can't even
+initialize at all on this quite mainstream system.
+
+Reported-by: Eli Cohen <eli@mellanox.co.il>
+Tested-by: Christoph Lameter <cl@linux-foundation.org>
+Signed-off-by: Roland Dreier <rolandd@cisco.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/mlx4/eq.c | 42 ------------------------------------------
+ drivers/net/mlx4/main.c | 9 ++++++---
+ drivers/net/mlx4/mlx4.h | 7 +------
+ 3 files changed, 7 insertions(+), 51 deletions(-)
+
+--- a/drivers/net/mlx4/eq.c
++++ b/drivers/net/mlx4/eq.c
+@@ -524,48 +524,6 @@ static void mlx4_unmap_clr_int(struct ml
+ iounmap(priv->clr_base);
+ }
+
+-int mlx4_map_eq_icm(struct mlx4_dev *dev, u64 icm_virt)
+-{
+- struct mlx4_priv *priv = mlx4_priv(dev);
+- int ret;
+-
+- /*
+- * We assume that mapping one page is enough for the whole EQ
+- * context table. This is fine with all current HCAs, because
+- * we only use 32 EQs and each EQ uses 64 bytes of context
+- * memory, or 1 KB total.
+- */
+- priv->eq_table.icm_virt = icm_virt;
+- priv->eq_table.icm_page = alloc_page(GFP_HIGHUSER);
+- if (!priv->eq_table.icm_page)
+- return -ENOMEM;
+- priv->eq_table.icm_dma = pci_map_page(dev->pdev, priv->eq_table.icm_page, 0,
+- PAGE_SIZE, PCI_DMA_BIDIRECTIONAL);
+- if (pci_dma_mapping_error(dev->pdev, priv->eq_table.icm_dma)) {
+- __free_page(priv->eq_table.icm_page);
+- return -ENOMEM;
+- }
+-
+- ret = mlx4_MAP_ICM_page(dev, priv->eq_table.icm_dma, icm_virt);
+- if (ret) {
+- pci_unmap_page(dev->pdev, priv->eq_table.icm_dma, PAGE_SIZE,
+- PCI_DMA_BIDIRECTIONAL);
+- __free_page(priv->eq_table.icm_page);
+- }
+-
+- return ret;
+-}
+-
+-void mlx4_unmap_eq_icm(struct mlx4_dev *dev)
+-{
+- struct mlx4_priv *priv = mlx4_priv(dev);
+-
+- mlx4_UNMAP_ICM(dev, priv->eq_table.icm_virt, 1);
+- pci_unmap_page(dev->pdev, priv->eq_table.icm_dma, PAGE_SIZE,
+- PCI_DMA_BIDIRECTIONAL);
+- __free_page(priv->eq_table.icm_page);
+-}
+-
+ int mlx4_alloc_eq_table(struct mlx4_dev *dev)
+ {
+ struct mlx4_priv *priv = mlx4_priv(dev);
+--- a/drivers/net/mlx4/main.c
++++ b/drivers/net/mlx4/main.c
+@@ -520,7 +520,10 @@ static int mlx4_init_icm(struct mlx4_dev
+ goto err_unmap_aux;
+ }
+
+- err = mlx4_map_eq_icm(dev, init_hca->eqc_base);
++ err = mlx4_init_icm_table(dev, &priv->eq_table.table,
++ init_hca->eqc_base, dev_cap->eqc_entry_sz,
++ dev->caps.num_eqs, dev->caps.num_eqs,
++ 0, 0);
+ if (err) {
+ mlx4_err(dev, "Failed to map EQ context memory, aborting.\n");
+ goto err_unmap_cmpt;
+@@ -663,7 +666,7 @@ err_unmap_mtt:
+ mlx4_cleanup_icm_table(dev, &priv->mr_table.mtt_table);
+
+ err_unmap_eq:
+- mlx4_unmap_eq_icm(dev);
++ mlx4_cleanup_icm_table(dev, &priv->eq_table.table);
+
+ err_unmap_cmpt:
+ mlx4_cleanup_icm_table(dev, &priv->eq_table.cmpt_table);
+@@ -693,11 +696,11 @@ static void mlx4_free_icms(struct mlx4_d
+ mlx4_cleanup_icm_table(dev, &priv->qp_table.qp_table);
+ mlx4_cleanup_icm_table(dev, &priv->mr_table.dmpt_table);
+ mlx4_cleanup_icm_table(dev, &priv->mr_table.mtt_table);
++ mlx4_cleanup_icm_table(dev, &priv->eq_table.table);
+ mlx4_cleanup_icm_table(dev, &priv->eq_table.cmpt_table);
+ mlx4_cleanup_icm_table(dev, &priv->cq_table.cmpt_table);
+ mlx4_cleanup_icm_table(dev, &priv->srq_table.cmpt_table);
+ mlx4_cleanup_icm_table(dev, &priv->qp_table.cmpt_table);
+- mlx4_unmap_eq_icm(dev);
+
+ mlx4_UNMAP_ICM_AUX(dev);
+ mlx4_free_icm(dev, priv->fw.aux_icm, 0);
+--- a/drivers/net/mlx4/mlx4.h
++++ b/drivers/net/mlx4/mlx4.h
+@@ -205,9 +205,7 @@ struct mlx4_eq_table {
+ void __iomem **uar_map;
+ u32 clr_mask;
+ struct mlx4_eq *eq;
+- u64 icm_virt;
+- struct page *icm_page;
+- dma_addr_t icm_dma;
++ struct mlx4_icm_table table;
+ struct mlx4_icm_table cmpt_table;
+ int have_irq;
+ u8 inta_pin;
+@@ -373,9 +371,6 @@ u64 mlx4_make_profile(struct mlx4_dev *d
+ struct mlx4_dev_cap *dev_cap,
+ struct mlx4_init_hca_param *init_hca);
+
+-int mlx4_map_eq_icm(struct mlx4_dev *dev, u64 icm_virt);
+-void mlx4_unmap_eq_icm(struct mlx4_dev *dev);
+-
+ int mlx4_cmd_init(struct mlx4_dev *dev);
+ void mlx4_cmd_cleanup(struct mlx4_dev *dev);
+ void mlx4_cmd_event(struct mlx4_dev *dev, u16 token, u8 status, u64 out_param);
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:29:03 2009
+Message-Id: <20090916222902.964796499@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:28:34 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tejun Heo <tj@kernel.org>,
+ Peer Chen <pchen@nvidia.com>,
+ Tj <linux@tjworld.net>,
+ Greg KH <greg@kroah.com>,
+ Jesse Barnes <jbarnes@virtuousgeek.org>
+Subject: [patch 15/24] PCI: apply nv_msi_ht_cap_quirk on resume too
+References: <20090916222819.244332644@mini.kroah.org>
+Content-Disposition: inline; filename=pci-apply-nv_msi_ht_cap_quirk-on-resume-too.patch
+Content-Length: 1261
+Lines: 35
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 6dab62ee5a3bf4f71b8320c09db2e6022a19f40e upstream.
+
+http://bugzilla.kernel.org/show_bug.cgi?id=12542 reports that with the
+quirk not applied on resume, msi stops working after resuming and mcp78s
+ahci fails due to IRQ mis-delivery. Apply it on resume too.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Cc: Peer Chen <pchen@nvidia.com>
+Cc: Tj <linux@tjworld.net>
+Reported-by: Nicolas Derive <kalon33@ubuntu.com>
+Cc: Greg KH <greg@kroah.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/quirks.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2353,8 +2353,10 @@ static void __devinit nv_msi_ht_cap_quir
+ }
+
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, nv_msi_ht_cap_quirk_leaf);
++DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, nv_msi_ht_cap_quirk_leaf);
+
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AL, PCI_ANY_ID, nv_msi_ht_cap_quirk_all);
++DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_AL, PCI_ANY_ID, nv_msi_ht_cap_quirk_all);
+
+ static void __devinit quirk_msi_intx_disable_bug(struct pci_dev *dev)
+ {
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:29:03 2009
+Message-Id: <20090916222903.134440464@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:28:35 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Clemens Ladisch <clemens@ladisch.de>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [patch 16/24] sound: oxygen: work around MCE when changing volume
+References: <20090916222819.244332644@mini.kroah.org>
+Content-Disposition: inline; filename=sound-oxygen-work-around-mce-when-changing-volume.patch
+Content-Length: 1498
+Lines: 45
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit f1bc07af9a9edc5c1d4bdd971f7099316ed2e405 upstream.
+
+When the volume is changed continuously (e.g., when the user drags a
+volume slider with the mouse), the driver does lots of I2C writes.
+Apparently, the sound chip can get confused when we poll the I2C status
+register too much, and fails to complete a read from it. On the PCI-E
+models, the PCI-E/PCI bridge gets upset by this and generates a machine
+check exception.
+
+To avoid this, this patch replaces the polling with an unconditional
+wait that is guaranteed to be long enough.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Tested-by: Johann Messner <johann.messner at jku.at>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/oxygen/oxygen_io.c | 11 +----------
+ 1 file changed, 1 insertion(+), 10 deletions(-)
+
+--- a/sound/pci/oxygen/oxygen_io.c
++++ b/sound/pci/oxygen/oxygen_io.c
+@@ -215,17 +215,8 @@ EXPORT_SYMBOL(oxygen_write_spi);
+
+ void oxygen_write_i2c(struct oxygen *chip, u8 device, u8 map, u8 data)
+ {
+- unsigned long timeout;
+-
+ /* should not need more than about 300 us */
+- timeout = jiffies + msecs_to_jiffies(1);
+- do {
+- if (!(oxygen_read16(chip, OXYGEN_2WIRE_BUS_STATUS)
+- & OXYGEN_2WIRE_BUSY))
+- break;
+- udelay(1);
+- cond_resched();
+- } while (time_after_eq(timeout, jiffies));
++ msleep(1);
+
+ oxygen_write8(chip, OXYGEN_2WIRE_MAP, map);
+ oxygen_write8(chip, OXYGEN_2WIRE_DATA, data);
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:29:03 2009
+Message-Id: <20090916222903.412688481@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:28:36 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Roel Kluin <roel.kluin@gmail.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 17/24] x86: Fix x86_model test in es7000_apic_is_cluster()
+References: <20090916222819.244332644@mini.kroah.org>
+Content-Disposition: inline; filename=x86-fix-x86_model-test-in-es7000_apic_is_cluster.patch
+Content-Length: 831
+Lines: 28
+
+From: Roel Kluin <roel.kluin@gmail.com>
+
+commit 005155b1f626d2b2d7932e4afdf4fead168c6888 upstream.
+
+For the x86_model to be greater than 6 or less than 12 is
+logically always true.
+
+Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/apic/es7000_32.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/apic/es7000_32.c
++++ b/arch/x86/kernel/apic/es7000_32.c
+@@ -167,7 +167,7 @@ static int es7000_apic_is_cluster(void)
+ {
+ /* MPENTIUMIII */
+ if (boot_cpu_data.x86 == 6 &&
+- (boot_cpu_data.x86_model >= 7 || boot_cpu_data.x86_model <= 11))
++ (boot_cpu_data.x86_model >= 7 && boot_cpu_data.x86_model <= 11))
+ return 1;
+
+ return 0;
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:29:03 2009
+Message-Id: <20090916222903.695585319@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:28:37 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 18/24] x86/i386: Make sure stack-protector segment base is cache aligned
+References: <20090916222819.244332644@mini.kroah.org>
+Content-Disposition: inline; filename=x86-i386-make-sure-stack-protector-segment-base-is-cache-aligned.patch
+Content-Length: 3976
+Lines: 108
+
+From: Jeremy Fitzhardinge <jeremy@goop.org>
+
+commit 1ea0d14e480c245683927eecc03a70faf06e80c8 upstream.
+
+The Intel Optimization Reference Guide says:
+
+ In Intel Atom microarchitecture, the address generation unit
+ assumes that the segment base will be 0 by default. Non-zero
+ segment base will cause load and store operations to experience
+ a delay.
+ - If the segment base isn't aligned to a cache line
+ boundary, the max throughput of memory operations is
+ reduced to one [e]very 9 cycles.
+ [...]
+ Assembly/Compiler Coding Rule 15. (H impact, ML generality)
+ For Intel Atom processors, use segments with base set to 0
+ whenever possible; avoid non-zero segment base address that is
+ not aligned to cache line boundary at all cost.
+
+We can't avoid having a non-zero base for the stack-protector
+segment, but we can make it cache-aligned.
+
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+LKML-Reference: <4AA01893.6000507@goop.org>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/processor.h | 12 +++++++++++-
+ arch/x86/include/asm/stackprotector.h | 4 ++--
+ arch/x86/include/asm/system.h | 2 +-
+ arch/x86/kernel/cpu/common.c | 2 +-
+ arch/x86/kernel/head_32.S | 1 -
+ 5 files changed, 15 insertions(+), 6 deletions(-)
+
+--- a/arch/x86/include/asm/processor.h
++++ b/arch/x86/include/asm/processor.h
+@@ -402,7 +402,17 @@ extern unsigned long kernel_eflags;
+ extern asmlinkage void ignore_sysret(void);
+ #else /* X86_64 */
+ #ifdef CONFIG_CC_STACKPROTECTOR
+-DECLARE_PER_CPU(unsigned long, stack_canary);
++/*
++ * Make sure stack canary segment base is cached-aligned:
++ * "For Intel Atom processors, avoid non zero segment base address
++ * that is not aligned to cache line boundary at all cost."
++ * (Optim Ref Manual Assembly/Compiler Coding Rule 15.)
++ */
++struct stack_canary {
++ char __pad[20]; /* canary at %gs:20 */
++ unsigned long canary;
++};
++DECLARE_PER_CPU(struct stack_canary, stack_canary) ____cacheline_aligned;
+ #endif
+ #endif /* X86_64 */
+
+--- a/arch/x86/include/asm/stackprotector.h
++++ b/arch/x86/include/asm/stackprotector.h
+@@ -78,14 +78,14 @@ static __always_inline void boot_init_st
+ #ifdef CONFIG_X86_64
+ percpu_write(irq_stack_union.stack_canary, canary);
+ #else
+- percpu_write(stack_canary, canary);
++ percpu_write(stack_canary.canary, canary);
+ #endif
+ }
+
+ static inline void setup_stack_canary_segment(int cpu)
+ {
+ #ifdef CONFIG_X86_32
+- unsigned long canary = (unsigned long)&per_cpu(stack_canary, cpu) - 20;
++ unsigned long canary = (unsigned long)&per_cpu(stack_canary, cpu);
+ struct desc_struct *gdt_table = get_cpu_gdt_table(cpu);
+ struct desc_struct desc;
+
+--- a/arch/x86/include/asm/system.h
++++ b/arch/x86/include/asm/system.h
+@@ -31,7 +31,7 @@ void __switch_to_xtra(struct task_struct
+ "movl %P[task_canary](%[next]), %%ebx\n\t" \
+ "movl %%ebx, "__percpu_arg([stack_canary])"\n\t"
+ #define __switch_canary_oparam \
+- , [stack_canary] "=m" (per_cpu_var(stack_canary))
++ , [stack_canary] "=m" (per_cpu_var(stack_canary.canary))
+ #define __switch_canary_iparam \
+ , [task_canary] "i" (offsetof(struct task_struct, stack_canary))
+ #else /* CC_STACKPROTECTOR */
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -1033,7 +1033,7 @@ DEFINE_PER_CPU(struct orig_ist, orig_ist
+ #else /* CONFIG_X86_64 */
+
+ #ifdef CONFIG_CC_STACKPROTECTOR
+-DEFINE_PER_CPU(unsigned long, stack_canary);
++DEFINE_PER_CPU(struct stack_canary, stack_canary) ____cacheline_aligned;
+ #endif
+
+ /* Make sure %fs and %gs are initialized properly in idle threads */
+--- a/arch/x86/kernel/head_32.S
++++ b/arch/x86/kernel/head_32.S
+@@ -442,7 +442,6 @@ is386: movl $2,%ecx # set MP
+ jne 1f
+ movl $per_cpu__gdt_page,%eax
+ movl $per_cpu__stack_canary,%ecx
+- subl $20, %ecx
+ movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
+ shrl $16, %ecx
+ movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:29:04 2009
+Message-Id: <20090916222903.948477177@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:28:38 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jack Steiner <steiner@sgi.com>,
+ Suresh Siddha <suresh.b.siddha@intel.com>,
+ "H. Peter Anvin" <hpa@zytor.com>
+Subject: [patch 19/24] x86, pat: Fix cacheflush address in change_page_attr_set_clr()
+References: <20090916222819.244332644@mini.kroah.org>
+Content-Disposition: inline; filename=x86-pat-fix-cacheflush-address-in-change_page_attr_set_clr.patch
+Content-Length: 1544
+Lines: 53
+
+From: Jack Steiner <steiner@sgi.com>
+
+commit fa526d0d641b5365676a1fb821ce359e217c9b85 upstream.
+
+Fix address passed to cpa_flush_range() when changing page
+attributes from WB to UC. The address (*addr) is
+modified by __change_page_attr_set_clr(). The result is that
+the pages being flushed start at the _end_ of the changed range
+instead of the beginning.
+
+This should be considered for 2.6.30-stable and 2.6.31-stable.
+
+Signed-off-by: Jack Steiner <steiner@sgi.com>
+Acked-by: Suresh Siddha <suresh.b.siddha@intel.com>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/mm/pageattr.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/mm/pageattr.c
++++ b/arch/x86/mm/pageattr.c
+@@ -807,6 +807,7 @@ static int change_page_attr_set_clr(unsi
+ {
+ struct cpa_data cpa;
+ int ret, cache, checkalias;
++ unsigned long baddr = 0;
+
+ /*
+ * Check, if we are requested to change a not supported
+@@ -838,6 +839,11 @@ static int change_page_attr_set_clr(unsi
+ */
+ WARN_ON_ONCE(1);
+ }
++ /*
++ * Save address for cache flush. *addr is modified in the call
++ * to __change_page_attr_set_clr() below.
++ */
++ baddr = *addr;
+ }
+
+ /* Must avoid aliasing mappings in the highmem code */
+@@ -892,7 +898,7 @@ static int change_page_attr_set_clr(unsi
+ cpa_flush_array(addr, numpages, cache,
+ cpa.flags, pages);
+ } else
+- cpa_flush_range(*addr, numpages, cache);
++ cpa_flush_range(baddr, numpages, cache);
+ } else
+ cpa_flush_all(cache);
+
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:29:04 2009
+Message-Id: <20090916222904.181440643@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:28:39 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Larry Finger <Larry.Finger@lwfinger.net>,
+ linux-media <linux-media@vger.kernel.org>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>,
+ Douglas Schilling Landgraf <dougsland@redhat.com>,
+ Franklin Meng <fmeng2002@yahoo.com>,
+ Michael Krufky <mkrufky@linuxtv.org>
+Subject: [patch 20/24] V4L: em28xx: set up tda9887_conf in em28xx_card_setup()
+References: <20090916222819.244332644@mini.kroah.org>
+Content-Disposition: inline; filename=v4l-em28xx-set-up-tda9887_conf-in-em28xx_card_setup.patch
+Content-Length: 1116
+Lines: 32
+
+From: Franklin Meng <fmeng2002@yahoo.com>
+
+V4L: em28xx: set up tda9887_conf in em28xx_card_setup()
+
+(cherry picked from commit ae3340cbf59ea362c2016eea762456cc0969fd9e)
+
+Added tda9887_conf set up into em28xx_card_setup()
+
+Signed-off-by: Franklin Meng <fmeng2002@yahoo.com>
+Signed-off-by: Douglas Schilling Landgraf <dougsland@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/em28xx/em28xx-cards.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/media/video/em28xx/em28xx-cards.c
++++ b/drivers/media/video/em28xx/em28xx-cards.c
+@@ -1886,6 +1886,9 @@ void em28xx_card_setup(struct em28xx *de
+ if (em28xx_boards[dev->model].tuner_addr)
+ dev->tuner_addr = em28xx_boards[dev->model].tuner_addr;
+
++ if (em28xx_boards[dev->model].tda9887_conf)
++ dev->tda9887_conf = em28xx_boards[dev->model].tda9887_conf;
++
+ /* request some modules */
+ switch (dev->model) {
+ case EM2820_BOARD_HAUPPAUGE_WINTV_USB_2:
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:29:04 2009
+Message-Id: <20090916222904.399551476@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:28:40 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Christoph Hellwig <hch@lst.de>,
+ Rusty Russell <rusty@rustcorp.com.au>,
+ Chuck Ebbert <cebbert@redhat.com>
+Subject: [patch 21/24] virtio_blk: dont bounce highmem requests
+References: <20090916222819.244332644@mini.kroah.org>
+Content-Disposition: inline; filename=virtio_blk-don-t-bounce-highmem-requests.patch
+Content-Length: 1209
+Lines: 36
+
+From: Christoph Hellwig <hch@lst.de>
+
+commit 4eff3cae9c9809720c636e64bc72f212258e0bd5 upstream
+
+virtio_blk: don't bounce highmem requests
+
+By default a block driver bounces highmem requests, but virtio-blk is
+perfectly fine with any request that fit into it's 64 bit addressing scheme,
+mapped in the kernel virtual space or not.
+
+Besides improving performance on highmem systems this also makes the
+reproducible oops in __bounce_end_io go away (but hiding the real cause).
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+
+---
+ drivers/block/virtio_blk.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -308,6 +308,9 @@ static int virtblk_probe(struct virtio_d
+ else
+ blk_queue_max_segment_size(vblk->disk->queue, -1U);
+
++ /* No need to bounce any requests */
++ blk_queue_bounce_limit(vblk->disk->queue, BLK_BOUNCE_ANY);
++
+ /* Host can optionally specify the block size of the device */
+ err = virtio_config_val(vdev, VIRTIO_BLK_F_BLK_SIZE,
+ offsetof(struct virtio_blk_config, blk_size),
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:29:04 2009
+Message-Id: <20090916222904.562048865@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:28:41 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tejun Heo <tj@kernel.org>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [patch 22/24] libata: fix off-by-one error in ata_tf_read_block()
+References: <20090916222819.244332644@mini.kroah.org>
+Content-Disposition: inline; filename=libata-fix-off-by-one-error-in-ata_tf_read_block.patch
+Content-Length: 1081
+Lines: 34
+
+From: Tejun Heo <htejun@gmail.com>
+
+commit ac8672ea922bde59acf50eaa1eaa1640a6395fd2 upstream.
+
+ata_tf_read_block() has off-by-one error when converting CHS address
+to LBA. The bug isn't very visible because ata_tf_read_block() is
+used only when generating sense data for a failed RW command and CHS
+addressing isn't used too often these days.
+
+This problem was spotted by Atsushi Nemoto.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -709,7 +709,13 @@ u64 ata_tf_read_block(struct ata_taskfile *tf, struct ata_device *dev)
+ head = tf->device & 0xf;
+ sect = tf->lbal;
+
+- block = (cyl * dev->heads + head) * dev->sectors + sect;
++ if (!sect) {
++ ata_dev_printk(dev, KERN_WARNING, "device reported "
++ "invalid CHS sector 0\n");
++ sect = 1; /* oh well */
++ }
++
++ block = (cyl * dev->heads + head) * dev->sectors + sect - 1;
+ }
+
+ return block;
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:29:04 2009
+Message-Id: <20090916222904.712761455@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:28:42 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jean Delvare <khali@linux-fr.org>,
+ Jesse Barnes <jbarnes@virtuousgeek.org>
+Subject: [patch 23/24] PCI: Unhide the SMBus on the Compaq Evo D510 USDT
+References: <20090916222819.244332644@mini.kroah.org>
+Content-Disposition: inline; filename=pci-unhide-the-smbus-on-the-compaq-evo-d510-usdt.patch
+Content-Length: 979
+Lines: 25
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit 6b5096e4d4496e185cd1ada5d1b8e1d941c805ed upstream.
+
+One more form factor for Compaq Evo D510, which needs the same quirk
+as the other form factors. Apparently there's no hardware monitoring
+chip on that one, but SPD EEPROMs, so it's still worth unhiding the
+SMBus.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Tested-by: Nuzhna Pomoshch <nuzhna_pomoshch@yahoo.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -1201,6 +1201,7 @@ static void __init asus_hides_smbus_hostbridge(struct pci_dev *dev)
+ switch(dev->subsystem_device) {
+ case 0x00b8: /* Compaq Evo D510 CMT */
+ case 0x00b9: /* Compaq Evo D510 SFF */
++ case 0x00ba: /* Compaq Evo D510 USDT */
+ /* Motherboard doesn't have Host bridge
+ * subvendor/subdevice IDs and on-board VGA
+ * controller is disabled if an AGP card is
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:29:05 2009
+Message-Id: <20090916222904.882120418@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:28:43 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Brian King <brking@linux.vnet.ibm.com>,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Subject: [patch 24/24] powerpc/pseries: Fix to handle slb resize across migration
+References: <20090916222819.244332644@mini.kroah.org>
+Content-Disposition: inline; filename=powerpc-pseries-fix-to-handle-slb-resize-across-migration.patch
+Content-Length: 4802
+Lines: 160
+
+From: Brian King <brking@linux.vnet.ibm.com>
+
+commit 46db2f86a3b2a94e0b33e0b4548fb7b7b6bdff66 upstream.
+
+The SLB can change sizes across a live migration, which was not
+being handled, resulting in possible machine crashes during
+migration if migrating to a machine which has a smaller max SLB
+size than the source machine. Fix this by first reducing the
+SLB size to the minimum possible value, which is 32, prior to
+migration. Then during the device tree update which occurs after
+migration, we make the call to ensure the SLB gets updated. Also
+add the slb_size to the lparcfg output so that the migration
+tools can check to make sure the kernel has this capability
+before allowing migration in scenarios where the SLB size will change.
+
+BenH: Fixed #include <asm/mmu-hash64.h> -> <asm/mmu.h> to avoid
+ breaking ppc32 build
+
+Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/include/asm/mmu-hash64.h | 2 ++
+ arch/powerpc/kernel/lparcfg.c | 3 +++
+ arch/powerpc/kernel/rtas.c | 7 ++++++-
+ arch/powerpc/mm/slb.c | 16 ++++++++++++----
+ arch/powerpc/platforms/pseries/reconfig.c | 9 ++++++++-
+ 5 files changed, 31 insertions(+), 6 deletions(-)
+
+--- a/arch/powerpc/include/asm/mmu-hash64.h
++++ b/arch/powerpc/include/asm/mmu-hash64.h
+@@ -41,6 +41,7 @@ extern char initial_stab[];
+
+ #define SLB_NUM_BOLTED 3
+ #define SLB_CACHE_ENTRIES 8
++#define SLB_MIN_SIZE 32
+
+ /* Bits in the SLB ESID word */
+ #define SLB_ESID_V ASM_CONST(0x0000000008000000) /* valid */
+@@ -296,6 +297,7 @@ extern void slb_flush_and_rebolt(void);
+ extern void stab_initialize(unsigned long stab);
+
+ extern void slb_vmalloc_update(void);
++extern void slb_set_size(u16 size);
+ #endif /* __ASSEMBLY__ */
+
+ /*
+--- a/arch/powerpc/kernel/lparcfg.c
++++ b/arch/powerpc/kernel/lparcfg.c
+@@ -35,6 +35,7 @@
+ #include <asm/prom.h>
+ #include <asm/vdso_datapage.h>
+ #include <asm/vio.h>
++#include <asm/mmu.h>
+
+ #define MODULE_VERS "1.8"
+ #define MODULE_NAME "lparcfg"
+@@ -501,6 +502,8 @@ static int pseries_lparcfg_data(struct s
+
+ seq_printf(m, "shared_processor_mode=%d\n", lppaca[0].shared_proc);
+
++ seq_printf(m, "slb_size=%d\n", mmu_slb_size);
++
+ return 0;
+ }
+
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -38,6 +38,7 @@
+ #include <asm/syscalls.h>
+ #include <asm/smp.h>
+ #include <asm/atomic.h>
++#include <asm/mmu.h>
+
+ struct rtas_t rtas = {
+ .lock = SPIN_LOCK_UNLOCKED
+@@ -692,6 +693,7 @@ static void rtas_percpu_suspend_me(void
+ {
+ long rc = H_SUCCESS;
+ unsigned long msr_save;
++ u16 slb_size = mmu_slb_size;
+ int cpu;
+ struct rtas_suspend_me_data *data =
+ (struct rtas_suspend_me_data *)info;
+@@ -714,13 +716,16 @@ static void rtas_percpu_suspend_me(void
+ /* All other cpus are in H_JOIN, this cpu does
+ * the suspend.
+ */
++ slb_set_size(SLB_MIN_SIZE);
+ printk(KERN_DEBUG "calling ibm,suspend-me on cpu %i\n",
+ smp_processor_id());
+ data->error = rtas_call(data->token, 0, 1, NULL);
+
+- if (data->error)
++ if (data->error) {
+ printk(KERN_DEBUG "ibm,suspend-me returned %d\n",
+ data->error);
++ slb_set_size(slb_size);
++ }
+ } else {
+ printk(KERN_ERR "H_JOIN on cpu %i failed with rc = %ld\n",
+ smp_processor_id(), rc);
+--- a/arch/powerpc/mm/slb.c
++++ b/arch/powerpc/mm/slb.c
+@@ -247,14 +247,22 @@ void switch_slb(struct task_struct *tsk,
+ static inline void patch_slb_encoding(unsigned int *insn_addr,
+ unsigned int immed)
+ {
+- /* Assume the instruction had a "0" immediate value, just
+- * "or" in the new value
+- */
+- *insn_addr |= immed;
++ *insn_addr = (*insn_addr & 0xffff0000) | immed;
+ flush_icache_range((unsigned long)insn_addr, 4+
+ (unsigned long)insn_addr);
+ }
+
++void slb_set_size(u16 size)
++{
++ extern unsigned int *slb_compare_rr_to_size;
++
++ if (mmu_slb_size == size)
++ return;
++
++ mmu_slb_size = size;
++ patch_slb_encoding(slb_compare_rr_to_size, mmu_slb_size);
++}
++
+ void slb_initialize(void)
+ {
+ unsigned long linear_llp, vmalloc_llp, io_llp;
+--- a/arch/powerpc/platforms/pseries/reconfig.c
++++ b/arch/powerpc/platforms/pseries/reconfig.c
+@@ -20,6 +20,7 @@
+ #include <asm/machdep.h>
+ #include <asm/uaccess.h>
+ #include <asm/pSeries_reconfig.h>
++#include <asm/mmu.h>
+
+
+
+@@ -439,9 +440,15 @@ static int do_update_property(char *buf,
+ if (!newprop)
+ return -ENOMEM;
+
++ if (!strcmp(name, "slb-size") || !strcmp(name, "ibm,slb-size"))
++ slb_set_size(*(int *)value);
++
+ oldprop = of_find_property(np, name,NULL);
+- if (!oldprop)
++ if (!oldprop) {
++ if (strlen(name))
++ return prom_add_property(np, newprop);
+ return -ENODEV;
++ }
+
+ rc = prom_update_property(np, newprop, oldprop);
+ if (rc)
+
+
+From gregkh@mini.kroah.org Wed Sep 16 15:29:00 2009
+Message-Id: <20090916222819.244332644@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Sep 2009 15:28:19 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 00/24] 2.6.30.8-stable review
+Content-Length: 882
+Lines: 22
+
+This is the start of the stable review cycle for the 2.6.30.8 release.
+There are 24 patches in this series, all will be posted as a response to
+this one. If anyone has any issues with these being applied, please let
+us know. If anyone is a maintainer of the proper subsystem, and wants
+to add a Signed-off-by: line to the patch, please respond with it.
+
+These patches are sent out with a number of different people on the Cc:
+line. If you wish to be a reviewer, please email stable@kernel.org to
+add your name to the list. If you want to be off the reviewer list,
+also email us.
+
+Responses should be made by Friday, September 18, 22:00:00 UTC.
+Anything received after that time might be too late.
+
+The whole patch series can be found in one patch at:
+ kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.30.8-rc1.gz
+and the diffstat can be found below.
+
+
+thanks,
+
+greg k-h
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
