--- /dev/null
+From 07bedca29b0973f36a6b6db36936deed367164ed Mon Sep 17 00:00:00 2001
+From: Alex Chiang <achiang@canonical.com>
+Date: Tue, 20 Apr 2010 08:03:14 -0600
+Subject: ACPI: DMI init_set_sci_en_on_resume for multiple Lenovo ThinkPads
+
+From: Alex Chiang <achiang@canonical.com>
+
+commit 07bedca29b0973f36a6b6db36936deed367164ed upstream.
+
+Multiple Lenovo ThinkPad models with Intel Core i5/i7 CPUs can
+successfully suspend/resume once, and then hang on the second s/r
+cycle.
+
+We got confirmation that this was due to a BIOS defect. The BIOS
+did not properly set SCI_EN coming out of S3. The BIOS guys
+hinted that The Other Leading OS ignores the fact that hardware
+owns the bit and sets it manually.
+
+In any case, an existing DMI table exists for machines where this
+defect is a known problem. Lenovo promise to fix their BIOS, but
+for folks who either won't or can't upgrade their BIOS, allow
+Linux to workaround the issue.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=15407
+https://bugs.launchpad.net/ubuntu/+source/linux/+bug/532374
+
+Confirmed by numerous testers in the launchpad bug that using
+acpi_sleep=sci_force_enable fixes the issue. We add the machines
+to acpisleep_dmi_table[] to automatically enable this workaround.
+
+Cc: Colin King <colin.king@canonical.com>
+Signed-off-by: Alex Chiang <achiang@canonical.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/sleep.c | 120 +++++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 120 insertions(+)
+
+--- a/drivers/acpi/sleep.c
++++ b/drivers/acpi/sleep.c
+@@ -450,6 +450,126 @@ static struct dmi_system_id __initdata a
+ },
+ },
+ {
++ .callback = init_set_sci_en_on_resume,
++ .ident = "Lenovo ThinkPad T410",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T410"),
++ },
++ },
++ {
++ .callback = init_set_sci_en_on_resume,
++ .ident = "Lenovo ThinkPad T510",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T510"),
++ },
++ },
++ {
++ .callback = init_set_sci_en_on_resume,
++ .ident = "Lenovo ThinkPad W510",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W510"),
++ },
++ },
++ {
++ .callback = init_set_sci_en_on_resume,
++ .ident = "Lenovo ThinkPad X201",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
++ },
++ },
++ {
++ .callback = init_set_sci_en_on_resume,
++ .ident = "Lenovo ThinkPad X201",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201s"),
++ },
++ },
++ {
++ .callback = init_set_sci_en_on_resume,
++ .ident = "Lenovo ThinkPad T410",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T410"),
++ },
++ },
++ {
++ .callback = init_set_sci_en_on_resume,
++ .ident = "Lenovo ThinkPad T510",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T510"),
++ },
++ },
++ {
++ .callback = init_set_sci_en_on_resume,
++ .ident = "Lenovo ThinkPad W510",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W510"),
++ },
++ },
++ {
++ .callback = init_set_sci_en_on_resume,
++ .ident = "Lenovo ThinkPad X201",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
++ },
++ },
++ {
++ .callback = init_set_sci_en_on_resume,
++ .ident = "Lenovo ThinkPad X201",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201s"),
++ },
++ },
++ {
++ .callback = init_set_sci_en_on_resume,
++ .ident = "Lenovo ThinkPad T410",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T410"),
++ },
++ },
++ {
++ .callback = init_set_sci_en_on_resume,
++ .ident = "Lenovo ThinkPad T510",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T510"),
++ },
++ },
++ {
++ .callback = init_set_sci_en_on_resume,
++ .ident = "Lenovo ThinkPad W510",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W510"),
++ },
++ },
++ {
++ .callback = init_set_sci_en_on_resume,
++ .ident = "Lenovo ThinkPad X201",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
++ },
++ },
++ {
++ .callback = init_set_sci_en_on_resume,
++ .ident = "Lenovo ThinkPad X201",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201s"),
++ },
++ },
++ {
+ .callback = init_old_suspend_ordering,
+ .ident = "Panasonic CF51-2L",
+ .matches = {
--- /dev/null
+From ea5bc73f4f56449b2d450068d492bcd17a675d7a Mon Sep 17 00:00:00 2001
+From: Kamal Mostafa <kamal@canonical.com>
+Date: Tue, 27 Apr 2010 14:02:40 -0700
+Subject: ACPI: sleep: init_set_sci_en_on_resume for Dell Studio 155x
+
+From: Kamal Mostafa <kamal@canonical.com>
+
+commit ea5bc73f4f56449b2d450068d492bcd17a675d7a upstream.
+
+Add Dell Studio models (1558, 1557, 1555) to the 'set_sci_en_on_resume'
+list to fix hang on resume.
+
+BugLink: http://bugs.launchpad.net/bugs/553498
+
+Signed-off-by: Kamal Mostafa <kamal@canonical.com>
+Acked-by: Alex Chiang <achiang@canonical.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/sleep.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+--- a/drivers/acpi/sleep.c
++++ b/drivers/acpi/sleep.c
+@@ -578,6 +578,30 @@ static struct dmi_system_id __initdata a
+ DMI_MATCH(DMI_BOARD_NAME, "CF51-2L"),
+ },
+ },
++ {
++ .callback = init_set_sci_en_on_resume,
++ .ident = "Dell Studio 1558",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Studio 1558"),
++ },
++ },
++ {
++ .callback = init_set_sci_en_on_resume,
++ .ident = "Dell Studio 1557",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Studio 1557"),
++ },
++ },
++ {
++ .callback = init_set_sci_en_on_resume,
++ .ident = "Dell Studio 1555",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Studio 1555"),
++ },
++ },
+ {},
+ };
+ #endif /* CONFIG_SUSPEND */
--- /dev/null
+From 1c6fe0364fa7bf28248488753ee0afb6b759cd04 Mon Sep 17 00:00:00 2001
+From: Arjan van de Ven <arjan@linux.intel.com>
+Date: Sat, 8 May 2010 15:47:37 -0700
+Subject: cpuidle: Fix incorrect optimization
+
+From: Arjan van de Ven <arjan@linux.intel.com>
+
+commit 1c6fe0364fa7bf28248488753ee0afb6b759cd04 upstream.
+
+commit 672917dcc78 ("cpuidle: menu governor: reduce latency on exit")
+added an optimization, where the analysis on the past idle period moved
+from the end of idle, to the beginning of the new idle.
+
+Unfortunately, this optimization had a bug where it zeroed one key
+variable for new use, that is needed for the analysis. The fix is
+simple, zero the variable after doing the work from the previous idle.
+
+During the audit of the code that found this issue, another issue was
+also found; the ->measured_us data structure member is never set, a
+local variable is always used instead.
+
+Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Corrado Zoccolo <czoccolo@gmail.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/cpuidle/governors/menu.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/drivers/cpuidle/governors/menu.c
++++ b/drivers/cpuidle/governors/menu.c
+@@ -101,7 +101,6 @@ struct menu_device {
+
+ unsigned int expected_us;
+ u64 predicted_us;
+- unsigned int measured_us;
+ unsigned int exit_us;
+ unsigned int bucket;
+ u64 correction_factor[BUCKETS];
+@@ -187,14 +186,14 @@ static int menu_select(struct cpuidle_de
+ int i;
+ int multiplier;
+
+- data->last_state_idx = 0;
+- data->exit_us = 0;
+-
+ if (data->needs_update) {
+ menu_update(dev);
+ data->needs_update = 0;
+ }
+
++ data->last_state_idx = 0;
++ data->exit_us = 0;
++
+ /* Special case when user has set very strict latency requirement */
+ if (unlikely(latency_req == 0))
+ return 0;
+@@ -294,7 +293,7 @@ static void menu_update(struct cpuidle_d
+ new_factor = data->correction_factor[data->bucket]
+ * (DECAY - 1) / DECAY;
+
+- if (data->expected_us > 0 && data->measured_us < MAX_INTERESTING)
++ if (data->expected_us > 0 && measured_us < MAX_INTERESTING)
+ new_factor += RESOLUTION * measured_us / data->expected_us;
+ else
+ /*
--- /dev/null
+From c213e1407be6b04b144794399a91472e0ef92aec Mon Sep 17 00:00:00 2001
+From: Hannes Reinecke <hare@suse.de>
+Date: Tue, 4 May 2010 16:49:21 +0200
+Subject: [SCSI] Enable retries for SYNCRONIZE_CACHE commands to fix I/O error
+
+From: Hannes Reinecke <hare@suse.de>
+
+commit c213e1407be6b04b144794399a91472e0ef92aec upstream.
+
+Some arrays are giving I/O errors with ext3 filesystems when
+SYNCHRONIZE_CACHE gets a UNIT_ATTENTION. What is happening is that
+these commands have no retries, so the UNIT_ATTENTION causes the
+barrier to fail. We should be enable retries here to clear any
+transient error and allow the barrier to succeed.
+
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/sd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -971,6 +971,7 @@ static void sd_prepare_flush(struct requ
+ {
+ rq->cmd_type = REQ_TYPE_BLOCK_PC;
+ rq->timeout = SD_TIMEOUT;
++ rq->retries = SD_MAX_RETRIES;
+ rq->cmd[0] = SYNCHRONIZE_CACHE;
+ rq->cmd_len = 10;
+ }
--- /dev/null
+From 87aa63000c484bfb9909989316f615240dfee018 Mon Sep 17 00:00:00 2001
+From: Gabriele A. Trombetti <g.trombetti.lkrnl1213@logicschema.com>
+Date: Wed, 28 Apr 2010 11:51:17 +1000
+Subject: md/raid6: Fix raid-6 read-error correction in degraded state
+
+From: Gabriele A. Trombetti <g.trombetti.lkrnl1213@logicschema.com>
+
+commit 87aa63000c484bfb9909989316f615240dfee018 upstream.
+
+Fix: Raid-6 was not trying to correct a read-error when in
+singly-degraded state and was instead dropping one more device, going to
+doubly-degraded state. This patch fixes this behaviour.
+
+Tested-by: Janos Haar <janos.haar@netcenter.hu>
+Signed-off-by: Gabriele A. Trombetti <g.trombetti.lkrnl1213@logicschema.com>
+Reported-by: Janos Haar <janos.haar@netcenter.hu>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/raid5.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -1526,7 +1526,7 @@ static void raid5_end_read_request(struc
+
+ clear_bit(R5_UPTODATE, &sh->dev[i].flags);
+ atomic_inc(&rdev->read_errors);
+- if (conf->mddev->degraded)
++ if (conf->mddev->degraded >= conf->max_degraded)
+ printk_rl(KERN_WARNING
+ "raid5:%s: read error not correctable "
+ "(sector %llu on %s).\n",
--- /dev/null
+From 1176568de7e066c0be9e46c37503b9fd4730edcf Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Fri, 7 May 2010 19:44:26 +1000
+Subject: md: restore ability of spare drives to spin down.
+
+From: NeilBrown <neilb@suse.de>
+
+commit 1176568de7e066c0be9e46c37503b9fd4730edcf upstream.
+
+Some time ago we stopped the clean/active metadata updates
+from being written to a 'spare' device in most cases so that
+it could spin down and say spun down. Device failure/removal
+etc are still recorded on spares.
+
+However commit 51d5668cb2e3fd1827a55 broke this 50% of the time,
+depending on whether the event count is even or odd.
+The change log entry said:
+
+ This means that the alignment between 'odd/even' and
+ 'clean/dirty' might take a little longer to attain,
+
+how ever the code makes no attempt to create that alignment, so it
+could take arbitrarily long.
+
+So when we find that clean/dirty is not aligned with odd/even,
+force a second metadata-update immediately. There are already cases
+where a second metadata-update is needed immediately (e.g. when a
+device fails during the metadata update). We just piggy-back on that.
+
+Reported-by: Joe Bryant <tenminjoe@yahoo.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/md.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -2011,12 +2011,18 @@ repeat:
+ if (!mddev->in_sync || mddev->recovery_cp != MaxSector) { /* not clean */
+ /* .. if the array isn't clean, an 'even' event must also go
+ * to spares. */
+- if ((mddev->events&1)==0)
++ if ((mddev->events&1)==0) {
+ nospares = 0;
++ sync_req = 2; /* force a second update to get the
++ * even/odd in sync */
++ }
+ } else {
+ /* otherwise an 'odd' event must go to spares */
+- if ((mddev->events&1))
++ if ((mddev->events&1)) {
+ nospares = 0;
++ sync_req = 2; /* force a second update to get the
++ * even/odd in sync */
++ }
+ }
+ }
+
--- /dev/null
+From ralf@linux-mips.org Mon May 10 11:09:27 2010
+From: Ralf Baechle <ralf@linux-mips.org>
+Date: Fri, 23 Apr 2010 02:56:38 +0100
+Subject: MIPS: Sibyte: Apply M3 workaround only on affected chip types and versions.
+To: Greg KH <greg@kroah.com>, stable@kernel.org
+Cc: Ralf Baechle <ralf@linux-mips.org>, Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
+Message-ID: <1271987800-26851-1-git-send-email-ralf@linux-mips.org>
+
+(cherry picked from commit e65c7f33d75e977350ca350573d93c517ec02776)
+
+Previously it was unconditionally used on all Sibyte family SOCs. The
+M3 bug has to be handled in the TLB exception handler which is extremly
+performance sensitive, so this modification is expected to deliver around
+2-3% performance improvment. This is important as required changes to the
+M3 workaround will make it more costly.
+
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/mips/include/asm/mach-sibyte/war.h | 6 +++++-
+ arch/mips/sibyte/sb1250/setup.c | 15 +++++++++++++++
+ 2 files changed, 20 insertions(+), 1 deletion(-)
+
+--- a/arch/mips/include/asm/mach-sibyte/war.h
++++ b/arch/mips/include/asm/mach-sibyte/war.h
+@@ -16,7 +16,11 @@
+ #if defined(CONFIG_SB1_PASS_1_WORKAROUNDS) || \
+ defined(CONFIG_SB1_PASS_2_WORKAROUNDS)
+
+-#define BCM1250_M3_WAR 1
++#ifndef __ASSEMBLY__
++extern int sb1250_m3_workaround_needed(void);
++#endif
++
++#define BCM1250_M3_WAR sb1250_m3_workaround_needed()
+ #define SIBYTE_1956_WAR 1
+
+ #else
+--- a/arch/mips/sibyte/sb1250/setup.c
++++ b/arch/mips/sibyte/sb1250/setup.c
+@@ -87,6 +87,21 @@ static int __init setup_bcm1250(void)
+ return ret;
+ }
+
++int sb1250_m3_workaround_needed(void)
++{
++ switch (soc_type) {
++ case K_SYS_SOC_TYPE_BCM1250:
++ case K_SYS_SOC_TYPE_BCM1250_ALT:
++ case K_SYS_SOC_TYPE_BCM1250_ALT2:
++ case K_SYS_SOC_TYPE_BCM1125:
++ case K_SYS_SOC_TYPE_BCM1125H:
++ return soc_pass < K_SYS_REVISION_BCM1250_C0;
++
++ default:
++ return 0;
++ }
++}
++
+ static int __init setup_bcm112x(void)
+ {
+ int ret = 0;
--- /dev/null
+From ralf@linux-mips.org Mon May 10 11:09:57 2010
+From: Ralf Baechle <ralf@linux-mips.org>
+Date: Fri, 23 Apr 2010 02:56:39 +0100
+Subject: MIPS: uasm: Add OR instruction.
+To: Greg KH <greg@kroah.com>, stable@kernel.org
+Cc: Ralf Baechle <ralf@linux-mips.org>, Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
+Message-ID: <1271987800-26851-2-git-send-email-ralf@linux-mips.org>
+
+(cherry picked from commit 9c6befe8c744fa2f03cab36dead503c77950c3b8)
+
+This is needed for the fix of the M3 workaround.
+
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+--- a/arch/mips/include/asm/uasm.h
++++ b/arch/mips/include/asm/uasm.h
+@@ -84,6 +84,7 @@ Ip_u2s3u1(_lw);
+ Ip_u1u2u3(_mfc0);
+ Ip_u1u2u3(_mtc0);
+ Ip_u2u1u3(_ori);
++Ip_u3u1u2(_or);
+ Ip_u2s3u1(_pref);
+ Ip_0(_rfe);
+ Ip_u2s3u1(_sc);
+diff --git a/arch/mips/mm/uasm.c b/arch/mips/mm/uasm.c
+index e3ca0f7..29bbd10 100644
+--- a/arch/mips/mm/uasm.c
++++ b/arch/mips/mm/uasm.c
+@@ -61,7 +61,7 @@ enum opcode {
+ insn_dmtc0, insn_dsll, insn_dsll32, insn_dsra, insn_dsrl,
+ insn_dsrl32, insn_drotr, insn_dsubu, insn_eret, insn_j, insn_jal,
+ insn_jr, insn_ld, insn_ll, insn_lld, insn_lui, insn_lw, insn_mfc0,
+- insn_mtc0, insn_ori, insn_pref, insn_rfe, insn_sc, insn_scd,
++ insn_mtc0, insn_or, insn_ori, insn_pref, insn_rfe, insn_sc, insn_scd,
+ insn_sd, insn_sll, insn_sra, insn_srl, insn_subu, insn_sw,
+ insn_tlbp, insn_tlbwi, insn_tlbwr, insn_xor, insn_xori, insn_dins
+ };
+@@ -116,6 +116,7 @@ static struct insn insn_table[] __cpuinitdata = {
+ { insn_lw, M(lw_op, 0, 0, 0, 0, 0), RS | RT | SIMM },
+ { insn_mfc0, M(cop0_op, mfc_op, 0, 0, 0, 0), RT | RD | SET},
+ { insn_mtc0, M(cop0_op, mtc_op, 0, 0, 0, 0), RT | RD | SET},
++ { insn_or, M(spec_op, 0, 0, 0, 0, or_op), RS | RT | RD },
+ { insn_ori, M(ori_op, 0, 0, 0, 0, 0), RS | RT | UIMM },
+ { insn_pref, M(pref_op, 0, 0, 0, 0, 0), RS | RT | SIMM },
+ { insn_rfe, M(cop0_op, cop_op, 0, 0, 0, rfe_op), 0 },
+@@ -370,6 +371,7 @@ I_u2s3u1(_lw)
+ I_u1u2u3(_mfc0)
+ I_u1u2u3(_mtc0)
+ I_u2u1u3(_ori)
++I_u3u1u2(_or)
+ I_u2s3u1(_pref)
+ I_0(_rfe)
+ I_u2s3u1(_sc)
+--
+1.6.6.1
+
--- /dev/null
+From 18262714ca0fb65c290b8ea1807b2b02bb52d0e3 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <error27@gmail.com>
+Date: Tue, 27 Apr 2010 14:01:07 -0700
+Subject: power_meter: acpi_device_class "power_meter_resource" too long
+
+From: Dan Carpenter <error27@gmail.com>
+
+commit 18262714ca0fb65c290b8ea1807b2b02bb52d0e3 upstream.
+
+acpi_device_class can only be 19 characters and a NULL terminator.
+
+The current code has a buffer overflow in acpi_power_meter_add():
+ strcpy(acpi_device_class(device), ACPI_POWER_METER_CLASS);
+
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Cc: Len Brown <lenb@kernel.org>
+Cc: "Darrick J. Wong" <djwong@us.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/power_meter.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/acpi/power_meter.c
++++ b/drivers/acpi/power_meter.c
+@@ -34,7 +34,7 @@
+ #define ACPI_POWER_METER_NAME "power_meter"
+ ACPI_MODULE_NAME(ACPI_POWER_METER_NAME);
+ #define ACPI_POWER_METER_DEVICE_NAME "Power Meter"
+-#define ACPI_POWER_METER_CLASS "power_meter_resource"
++#define ACPI_POWER_METER_CLASS "pwr_meter_resource"
+
+ #define NUM_SENSORS 17
+
--- /dev/null
+From ccb8d8d070b8f25f0163da5c9ceacf63a5169540 Mon Sep 17 00:00:00 2001
+From: Jakob Viketoft <jakob.viketoft@bitsim.com>
+Date: Wed, 5 May 2010 18:25:27 +0800
+Subject: [ARM] pxa/colibri: fix missing #include <mach/mfp.h> in colibri.h
+
+From: Jakob Viketoft <jakob.viketoft@bitsim.com>
+
+commit ccb8d8d070b8f25f0163da5c9ceacf63a5169540 upstream.
+
+The use of mfp_cfg_t causes build errors without including <mach/mfp.h>.
+
+CC: Daniel Mack <daniel@caiaq.de>
+Signed-off-by: Jakob Viketoft <jakob.viketoft@bitsim.com>
+Signed-off-by: Eric Miao <eric.y.miao@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/mach-pxa/include/mach/colibri.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/mach-pxa/include/mach/colibri.h
++++ b/arch/arm/mach-pxa/include/mach/colibri.h
+@@ -2,6 +2,7 @@
+ #define _COLIBRI_H_
+
+ #include <net/ax88796.h>
++#include <mach/mfp.h>
+
+ /*
+ * common settings for all modules
--- /dev/null
+From 70b25f890ce9f0520c64075ce9225a5b020a513e Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Thu, 15 Apr 2010 09:00:08 +0900
+Subject: SCSI: fix locking around blk_abort_request()
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 70b25f890ce9f0520c64075ce9225a5b020a513e upstream.
+
+blk_abort_request() expects queue lock to be held by the caller.
+Grab it before calling the function.
+
+Lack of this synchronization led to infinite loop on corrupt
+q->timeout_list.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/libsas/sas_ata.c | 4 ++++
+ drivers/scsi/libsas/sas_scsi_host.c | 4 ++++
+ 2 files changed, 8 insertions(+)
+
+--- a/drivers/scsi/libsas/sas_ata.c
++++ b/drivers/scsi/libsas/sas_ata.c
+@@ -394,11 +394,15 @@ int sas_ata_init_host_and_port(struct do
+ void sas_ata_task_abort(struct sas_task *task)
+ {
+ struct ata_queued_cmd *qc = task->uldd_task;
++ struct request_queue *q = qc->scsicmd->device->request_queue;
+ struct completion *waiting;
++ unsigned long flags;
+
+ /* Bounce SCSI-initiated commands to the SCSI EH */
+ if (qc->scsicmd) {
++ spin_lock_irqsave(q->queue_lock, flags);
+ blk_abort_request(qc->scsicmd->request);
++ spin_unlock_irqrestore(q->queue_lock, flags);
+ scsi_schedule_eh(qc->scsicmd->device->host);
+ return;
+ }
+--- a/drivers/scsi/libsas/sas_scsi_host.c
++++ b/drivers/scsi/libsas/sas_scsi_host.c
+@@ -1025,6 +1025,8 @@ int __sas_task_abort(struct sas_task *ta
+ void sas_task_abort(struct sas_task *task)
+ {
+ struct scsi_cmnd *sc = task->uldd_task;
++ struct request_queue *q = sc->device->request_queue;
++ unsigned long flags;
+
+ /* Escape for libsas internal commands */
+ if (!sc) {
+@@ -1039,7 +1041,9 @@ void sas_task_abort(struct sas_task *tas
+ return;
+ }
+
++ spin_lock_irqsave(q->queue_lock, flags);
+ blk_abort_request(sc->request);
++ spin_unlock_irqrestore(q->queue_lock, flags);
+ scsi_schedule_eh(sc->device->host);
+ }
+
--- /dev/null
+From 96b1f96dcab87756c0a1e7ba76bc5dc2add82b88 Mon Sep 17 00:00:00 2001
+From: Mike Christie <michaelc@cs.wisc.edu>
+Date: Sat, 24 Apr 2010 16:21:19 -0500
+Subject: SCSI: libiscsi: regression: fix header digest errors
+
+From: Mike Christie <michaelc@cs.wisc.edu>
+
+commit 96b1f96dcab87756c0a1e7ba76bc5dc2add82b88 upstream.
+
+This fixes a regression introduced with this commit:
+
+commit d3305f3407fa3e9452079ec6cc8379067456e4aa
+Author: Mike Christie <michaelc@cs.wisc.edu>
+Date: Thu Aug 20 15:10:58 2009 -0500
+
+ [SCSI] libiscsi: don't increment cmdsn if cmd is not sent
+
+in 2.6.32.
+
+When I moved the hdr->cmdsn after init_task, I added
+a bug when header digests are used. The problem is
+that the LLD may calculate the header digest in init_task,
+so if we then set the cmdsn after the init_task call we
+change what the digest will be calculated by the target.
+
+Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/libiscsi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -384,12 +384,12 @@ static int iscsi_prep_scsi_cmd_pdu(struc
+
+ WARN_ON(hdrlength >= 256);
+ hdr->hlength = hdrlength & 0xFF;
++ hdr->cmdsn = task->cmdsn = cpu_to_be32(session->cmdsn);
+
+ if (session->tt->init_task && session->tt->init_task(task))
+ return -EIO;
+
+ task->state = ISCSI_TASK_RUNNING;
+- hdr->cmdsn = task->cmdsn = cpu_to_be32(session->cmdsn);
+ session->cmdsn++;
+
+ conn->scsicmd_pdus_cnt++;
--- /dev/null
+From 77a4229719e511a0d38d9c355317ae1469adeb54 Mon Sep 17 00:00:00 2001
+From: James Bottomley <James.Bottomley@suse.de>
+Date: Tue, 4 May 2010 16:51:40 -0400
+Subject: SCSI: Retry commands with UNIT_ATTENTION sense codes to fix ext3/ext4 I/O error
+
+From: James Bottomley <James.Bottomley@suse.de>
+
+commit 77a4229719e511a0d38d9c355317ae1469adeb54 upstream.
+
+There's nastyness in the way we currently handle barriers (and
+discards): They're effectively filesystem commands, but they get
+processed as BLOCK_PC commands. Unfortunately BLOCK_PC commands are
+taken by SCSI to be SG_IO commands and the issuer expects to see and
+handle any returned errors, however trivial. This leads to a huge
+problem, because the block layer doesn't expect this to happen and any
+trivially retryable error on a barrier causes an immediate I/O error
+to the filesystem.
+
+The only real way to hack around this is to take the usual class of
+offending errors (unit attentions) and make them all retryable in the
+case of a REQ_HARDBARRIER. A correct fix would involve a rework of
+the entire block and SCSI submit system, and so is out of scope for a
+quick fix.
+
+Cc: Hannes Reinecke <hare@suse.de>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/scsi_error.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -301,7 +301,20 @@ static int scsi_check_sense(struct scsi_
+ if (scmd->device->allow_restart &&
+ (sshdr.asc == 0x04) && (sshdr.ascq == 0x02))
+ return FAILED;
+- return SUCCESS;
++
++ if (blk_barrier_rq(scmd->request))
++ /*
++ * barrier requests should always retry on UA
++ * otherwise block will get a spurious error
++ */
++ return NEEDS_RETRY;
++ else
++ /*
++ * for normal (non barrier) commands, pass the
++ * UA upwards for a determination in the
++ * completion functions
++ */
++ return SUCCESS;
+
+ /* these three are not supported */
+ case COPY_ABORTED:
--- /dev/null
+From 5447ed6c968e7270b656afa273c2b79d15d82edd Mon Sep 17 00:00:00 2001
+From: Douglas Gilbert <dgilbert@interlog.com>
+Date: Sun, 25 Apr 2010 12:30:23 +0200
+Subject: [SCSI] scsi_debug: virtual_gb ignores sector_size
+
+From: Douglas Gilbert <dgilbert@interlog.com>
+
+commit 5447ed6c968e7270b656afa273c2b79d15d82edd upstream.
+
+In the scsi_debug driver, the virtual_gb option ignores the
+sector_size, implicitly assuming that is 512 bytes. So if
+'virtual_gb=1 sector_size=4096' the result is an 8 GB (virtual) disk.
+
+Signed-off-by: Douglas Gilbert <dgilbert@interlog.com>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/scsi_debug.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/scsi_debug.c
++++ b/drivers/scsi/scsi_debug.c
+@@ -914,7 +914,8 @@ static int resp_start_stop(struct scsi_c
+ static sector_t get_sdebug_capacity(void)
+ {
+ if (scsi_debug_virtual_gb > 0)
+- return 2048 * 1024 * (sector_t)scsi_debug_virtual_gb;
++ return (sector_t)scsi_debug_virtual_gb *
++ (1073741824 / scsi_debug_sector_size);
+ else
+ return sdebug_store_sectors;
+ }
--- /dev/null
+From b338cc8207eae46640a8d534738fda7b5e48511d Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <error27@gmail.com>
+Date: Thu, 22 Apr 2010 12:05:35 +0200
+Subject: security: testing the wrong variable in create_by_name()
+
+From: Dan Carpenter <error27@gmail.com>
+
+commit b338cc8207eae46640a8d534738fda7b5e48511d upstream.
+
+There is a typo here. We should be testing "*dentry" instead of
+"dentry". If "*dentry" is an ERR_PTR, it gets dereferenced in either
+mkdir() or create() which would cause an OOPs.
+
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ security/inode.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/security/inode.c
++++ b/security/inode.c
+@@ -168,13 +168,13 @@ static int create_by_name(const char *na
+
+ mutex_lock(&parent->d_inode->i_mutex);
+ *dentry = lookup_one_len(name, parent, strlen(name));
+- if (!IS_ERR(dentry)) {
++ if (!IS_ERR(*dentry)) {
+ if ((mode & S_IFMT) == S_IFDIR)
+ error = mkdir(parent->d_inode, *dentry, mode);
+ else
+ error = create(parent->d_inode, *dentry, mode);
+ } else
+- error = PTR_ERR(dentry);
++ error = PTR_ERR(*dentry);
+ mutex_unlock(&parent->d_inode->i_mutex);
+
+ return error;
qla2xxx-properly-handle-underrun-completion-statuses.patch
bnx2-fix-lost-msi-x-problem-on-5709-nics.patch
tracing-fix-ftrace_event_call-alignment-for-use-with-gcc-4.5.patch
+security-testing-the-wrong-variable-in-create_by_name.patch
+md-restore-ability-of-spare-drives-to-spin-down.patch
+virtio-initialize-earlier.patch
+md-raid6-fix-raid-6-read-error-correction-in-degraded-state.patch
+v4l-dvb-budget-oops-bug-unable-to-handle-kernel-null-pointer-dereference.patch
+acpi-dmi-init_set_sci_en_on_resume-for-multiple-lenovo-thinkpads.patch
+power_meter-acpi_device_class-power_meter_resource-too-long.patch
+acpi-sleep-init_set_sci_en_on_resume-for-dell-studio-155x.patch
+cpuidle-fix-incorrect-optimization.patch
+pxa-colibri-fix-missing-include-mach-mfp.h-in-colibri.h.patch
+scsi-fix-locking-around-blk_abort_request.patch
+scsi-libiscsi-regression-fix-header-digest-errors.patch
+scsi_debug-virtual_gb-ignores-sector_size.patch
+enable-retries-for-syncronize_cache-commands-to-fix-i-o-error.patch
+scsi-retry-commands-with-unit_attention-sense-codes-to-fix-ext3-ext4-i-o-error.patch
+mips-sibyte-apply-m3-workaround-only-on-affected-chip-types-and-versions.patch
+mips-uasm-add-or-instruction.patch
--- /dev/null
+From 6f550dc08369ee0bc6402963c377e65f0f2e3b71 Mon Sep 17 00:00:00 2001
+From: Bjørn Mork <bjorn@mork.no>
+Date: Wed, 24 Mar 2010 07:57:57 -0300
+Subject: V4L/DVB: budget: Oops: "BUG: unable to handle kernel NULL pointer dereference"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bjørn Mork <bjorn@mork.no>
+
+commit 6f550dc08369ee0bc6402963c377e65f0f2e3b71 upstream.
+
+Never call dvb_frontend_detach if we failed to attach a frontend. This fixes
+the following oops, which will be triggered by a missing stv090x module:
+
+[ 8.172997] DVB: registering new adapter (TT-Budget S2-1600 PCI)
+[ 8.209018] adapter has MAC addr = 00:d0:5c:cc:a7:29
+[ 8.328665] Intel ICH 0000:00:1f.5: PCI INT B -> GSI 17 (level, low) -> IRQ 17
+[ 8.328753] Intel ICH 0000:00:1f.5: setting latency timer to 64
+[ 8.562047] DVB: Unable to find symbol stv090x_attach()
+[ 8.562117] BUG: unable to handle kernel NULL pointer dereference at 000000ac
+[ 8.562239] IP: [<e08b04a3>] dvb_frontend_detach+0x4/0x67 [dvb_core]
+
+Ref http://bugs.debian.org/575207
+
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/dvb/ttpci/budget.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/media/dvb/ttpci/budget.c
++++ b/drivers/media/dvb/ttpci/budget.c
+@@ -643,9 +643,6 @@ static void frontend_init(struct budget
+ &budget->i2c_adap,
+ &tt1600_isl6423_config);
+
+- } else {
+- dvb_frontend_detach(budget->dvb_frontend);
+- budget->dvb_frontend = NULL;
+ }
+ }
+ break;
--- /dev/null
+From e2dbe06c271f3bb2a495627980aad3d1d8ccef2a Mon Sep 17 00:00:00 2001
+From: Stijn Tintel <stijn@linux-ipv6.be>
+Date: Fri, 7 May 2010 14:28:34 +0930
+Subject: virtio: initialize earlier
+
+From: Stijn Tintel <stijn@linux-ipv6.be>
+
+commit e2dbe06c271f3bb2a495627980aad3d1d8ccef2a upstream.
+
+Move initialization of the virtio framework before the initialization of
+mtd, so that block2mtd can be used on virtio-based block devices.
+
+Addresses https://bugzilla.kernel.org/show_bug.cgi?id=15644
+
+Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/Makefile
++++ b/drivers/Makefile
+@@ -17,6 +17,7 @@ obj-$(CONFIG_SFI) += sfi/
+ obj-$(CONFIG_PNP) += pnp/
+ obj-$(CONFIG_ARM_AMBA) += amba/
+
++obj-$(CONFIG_VIRTIO) += virtio/
+ obj-$(CONFIG_XEN) += xen/
+
+ # regulators early, since some subsystems rely on them to initialize
+@@ -106,7 +107,6 @@ obj-$(CONFIG_HID) += hid/
+ obj-$(CONFIG_PPC_PS3) += ps3/
+ obj-$(CONFIG_OF) += of/
+ obj-$(CONFIG_SSB) += ssb/
+-obj-$(CONFIG_VIRTIO) += virtio/
+ obj-$(CONFIG_VLYNQ) += vlynq/
+ obj-$(CONFIG_STAGING) += staging/
+ obj-y += platform/
projects / thirdparty / kernel / stable-queue.git / commitdiff
