--- /dev/null
+From 3dde04b0152634d42994b34b86bbf3c70fbc6b19 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Thu, 14 Oct 2010 16:30:41 +0100
+Subject: agp/intel: Also add B43.1 to list of supported devices
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 3dde04b0152634d42994b34b86bbf3c70fbc6b19 upstream.
+
+This was a missing piece from 41a5142 that dropped recognition of the
+AGP module for the second B43 variant.
+
+Reported-by: Stefan Bader <stefan.bader@canonical.com>
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/agp/intel-agp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/char/agp/intel-agp.c
++++ b/drivers/char/agp/intel-agp.c
+@@ -1049,6 +1049,7 @@ static struct pci_device_id agp_intel_pc
+ ID(PCI_DEVICE_ID_INTEL_G45_HB),
+ ID(PCI_DEVICE_ID_INTEL_G41_HB),
+ ID(PCI_DEVICE_ID_INTEL_B43_HB),
++ ID(PCI_DEVICE_ID_INTEL_B43_1_HB),
+ ID(PCI_DEVICE_ID_INTEL_IRONLAKE_D_HB),
+ ID(PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB),
+ ID(PCI_DEVICE_ID_INTEL_IRONLAKE_MA_HB),
--- /dev/null
+From ac70eb1305d5a81efd1e32327d7e79be15a63a5a Mon Sep 17 00:00:00 2001
+From: Daniel T Chen <crimsun@ubuntu.com>
+Date: Sat, 27 Nov 2010 13:58:04 -0500
+Subject: ALSA: hda: Use BIOS auto-parsing instead of existing model quirk for MEDION MD2
+
+From: Daniel T Chen <crimsun@ubuntu.com>
+
+commit ac70eb1305d5a81efd1e32327d7e79be15a63a5a upstream.
+
+BugLink: https://launchpad.net/bugs/682199
+
+A 2.6.35 (Ubuntu Maverick) user, burningphantom1, reported a regression
+in audio: playback was inaudible through both speakers and headphones.
+In commit 272a527c04 of sound-2.6.git, a new model was added with this
+machine's PCI SSID. Fortunately, it is now sufficient to use the auto
+model for BIOS auto-parsing instead of the existing quirk.
+
+Playback, capture, and jack sense were verified working for both
+2.6.35 and the alsa-driver snapshot from 2010-11-27 when model=auto is
+used.
+
+Reported-and-tested-by: burningphantom1
+Signed-off-by: Daniel T Chen <crimsun@ubuntu.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9664,7 +9664,6 @@ static struct snd_pci_quirk alc882_cfg_t
+ SND_PCI_QUIRK(0x17aa, 0x3bfc, "Lenovo NB0763", ALC883_LENOVO_NB0763),
+ SND_PCI_QUIRK(0x17aa, 0x3bfd, "Lenovo NB0763", ALC883_LENOVO_NB0763),
+ SND_PCI_QUIRK(0x17aa, 0x101d, "Lenovo Sky", ALC888_LENOVO_SKY),
+- SND_PCI_QUIRK(0x17c0, 0x4071, "MEDION MD2", ALC883_MEDION_MD2),
+ SND_PCI_QUIRK(0x17c0, 0x4085, "MEDION MD96630", ALC888_LENOVO_MS7195_DIG),
+ SND_PCI_QUIRK(0x17f2, 0x5000, "Albatron KI690-AM2", ALC883_6ST_DIG),
+ SND_PCI_QUIRK(0x1991, 0x5625, "Haier W66", ALC883_HAIER_W66),
--- /dev/null
+From 9f2a0fac625bcef9c579bcf0b0c904ab1a56e7c4 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Thu, 28 Oct 2010 10:43:26 -0500
+Subject: b43: Fix warning at drivers/mmc/core/core.c:237 in mmc_wait_for_cmd
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 9f2a0fac625bcef9c579bcf0b0c904ab1a56e7c4 upstream.
+
+On module removal, the sdio version of b43 generates the following warning:
+
+[ 851.560519] ------------[ cut here ]------------
+[ 851.560531] WARNING: at drivers/mmc/core/core.c:237 mmc_wait_for_cmd+0x88/0x90()
+[ 851.560534] Hardware name: 20552PG
+[ 851.560536] Modules linked in: b43(-) ssb mmc_block binfmt_misc rfcomm sco bnep ppdev l2cap ipt_MASQUERADE iptable_nat nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack ipt_REJECT xt_tcpudp iptable_filter ip_tables x_tables bridge stp kvm_intel kvm arc4 iwlagn snd_hda_codec_conexant snd_hda_intel snd_hda_codec iwlcore snd_hwdep snd_pcm thinkpad_acpi mac80211 snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq r852 joydev snd_timer sm_common pcmcia nand snd_seq_device cfg80211 sdhci_pci btusb psmouse tpm_tis yenta_socket nand_ids lp snd pcmcia_rsrc nand_ecc bluetooth sdhci tpm pcmcia_core parport mtd snd_page_alloc serio_raw tpm_bios soundcore nvram led_class sha256_generic aes_i586 aes_generic dm_crypt i915 drm_kms_helper drm ahci intel_agp i2c_algo_bit intel_gtt e1000e libahci video agpgart output
+[ 851.560620] Pid: 2504, comm: rmmod Not tainted 2.6.36-titan0+ #1
+[ 851.560622] Call Trace:
+[ 851.560631] [<c014a102>] warn_slowpath_common+0x72/0xa0
+[ 851.560636] [<c04d94c8>] ? mmc_wait_for_cmd+0x88/0x90
+[ 851.560641] [<c04d94c8>] ? mmc_wait_for_cmd+0x88/0x90
+[ 851.560645] [<c014a152>] warn_slowpath_null+0x22/0x30
+[ 851.560649] [<c04d94c8>] mmc_wait_for_cmd+0x88/0x90
+[ 851.560655] [<c0401585>] ? device_release+0x25/0x80
+[ 851.560660] [<c04df210>] mmc_io_rw_direct_host+0xa0/0x150
+[ 851.560665] [<c04df370>] mmc_io_rw_direct+0x30/0x40
+[ 851.560669] [<c04e06e7>] sdio_disable_func+0x37/0xa0
+[ 851.560683] [<f8dfcb80>] b43_sdio_remove+0x30/0x50 [b43]
+[ 851.560687] [<c04df8cc>] sdio_bus_remove+0x1c/0x60
+[ 851.560692] [<c016d39f>] ? blocking_notifier_call_chain+0x1f/0x30
+[ 851.560697] [<c0404991>] __device_release_driver+0x51/0xb0
+[ 851.560701] [<c0404a7f>] driver_detach+0x8f/0xa0
+[ 851.560705] [<c0403c83>] bus_remove_driver+0x63/0xa0
+[ 851.560709] [<c0405039>] driver_unregister+0x49/0x80
+[ 851.560713] [<c0405039>] ? driver_unregister+0x49/0x80
+[ 851.560718] [<c04dfad7>] sdio_unregister_driver+0x17/0x20
+[ 851.560727] [<f8dfcb42>] b43_sdio_exit+0x12/0x20 [b43]
+[ 851.560734] [<f8dfe76f>] b43_exit+0x17/0x3c [b43]
+[ 851.560740] [<c017fb8d>] sys_delete_module+0x13d/0x200
+[ 851.560747] [<c01fd7d2>] ? do_munmap+0x212/0x300
+[ 851.560752] [<c010311f>] sysenter_do_call+0x12/0x28
+[ 851.560757] ---[ end trace 31e14488072d2f7d ]---
+[ 851.560759] ------------[ cut here ]------------
+
+The warning is caused by b43 not claiming the device before calling
+sdio_disable_func().
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Reported-by: Arnd Hannemann <arnd@arndnet.de>
+Tested-by: Arnd Hannemann <arnd@arndnet.de>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/b43/sdio.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/b43/sdio.c
++++ b/drivers/net/wireless/b43/sdio.c
+@@ -175,7 +175,9 @@ static void b43_sdio_remove(struct sdio_
+ struct b43_sdio *sdio = sdio_get_drvdata(func);
+
+ ssb_bus_unregister(&sdio->ssb);
++ sdio_claim_host(func);
+ sdio_disable_func(func);
++ sdio_release_host(func);
+ kfree(sdio);
+ sdio_set_drvdata(func, NULL);
+ }
--- /dev/null
+From 1e0ad2881d50becaeea70ec696a80afeadf944d2 Mon Sep 17 00:00:00 2001
+From: Graham Gower <graham.gower@gmail.com>
+Date: Wed, 27 Oct 2010 15:33:00 -0700
+Subject: drivers/char/vt_ioctl.c: fix VT_OPENQRY error value
+
+From: Graham Gower <graham.gower@gmail.com>
+
+commit 1e0ad2881d50becaeea70ec696a80afeadf944d2 upstream.
+
+When all VT's are in use, VT_OPENQRY casts -1 to unsigned char before
+returning it to userspace as an int. VT255 is not the next available
+console.
+
+Signed-off-by: Graham Gower <graham.gower@gmail.com>
+Cc: Greg KH <greg@kroah.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/vt_ioctl.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/char/vt_ioctl.c
++++ b/drivers/char/vt_ioctl.c
+@@ -503,6 +503,7 @@ int vt_ioctl(struct tty_struct *tty, str
+ struct kbd_struct * kbd;
+ unsigned int console;
+ unsigned char ucval;
++ unsigned int uival;
+ void __user *up = (void __user *)arg;
+ int i, perm;
+ int ret = 0;
+@@ -657,7 +658,7 @@ int vt_ioctl(struct tty_struct *tty, str
+ break;
+
+ case KDGETMODE:
+- ucval = vc->vc_mode;
++ uival = vc->vc_mode;
+ goto setint;
+
+ case KDMAPDISP:
+@@ -695,7 +696,7 @@ int vt_ioctl(struct tty_struct *tty, str
+ break;
+
+ case KDGKBMODE:
+- ucval = ((kbd->kbdmode == VC_RAW) ? K_RAW :
++ uival = ((kbd->kbdmode == VC_RAW) ? K_RAW :
+ (kbd->kbdmode == VC_MEDIUMRAW) ? K_MEDIUMRAW :
+ (kbd->kbdmode == VC_UNICODE) ? K_UNICODE :
+ K_XLATE);
+@@ -717,9 +718,9 @@ int vt_ioctl(struct tty_struct *tty, str
+ break;
+
+ case KDGKBMETA:
+- ucval = (vc_kbd_mode(kbd, VC_META) ? K_ESCPREFIX : K_METABIT);
++ uival = (vc_kbd_mode(kbd, VC_META) ? K_ESCPREFIX : K_METABIT);
+ setint:
+- ret = put_user(ucval, (int __user *)arg);
++ ret = put_user(uival, (int __user *)arg);
+ break;
+
+ case KDGETKEYCODE:
+@@ -949,7 +950,7 @@ int vt_ioctl(struct tty_struct *tty, str
+ for (i = 0; i < MAX_NR_CONSOLES; ++i)
+ if (! VT_IS_IN_USE(i))
+ break;
+- ucval = i < MAX_NR_CONSOLES ? (i+1) : -1;
++ uival = i < MAX_NR_CONSOLES ? (i+1) : -1;
+ goto setint;
+
+ /*
--- /dev/null
+From 1f9fa5216eacf4fdf9d3e4ab57feb8b642f0e78b Mon Sep 17 00:00:00 2001
+From: Michael Hennerich <michael.hennerich@analog.com>
+Date: Tue, 26 Oct 2010 14:21:16 -0700
+Subject: drivers/misc/ad525x_dpot.c: fix typo in spi write16 and write24 transfer counts
+
+From: Michael Hennerich <michael.hennerich@analog.com>
+
+commit 1f9fa5216eacf4fdf9d3e4ab57feb8b642f0e78b upstream.
+
+This is a bug fix. Some SPI connected devices using 16/24 bit accesses,
+previously failed, now work.
+
+This typo slipped in after testing, during some restructuring.
+
+Signed-off-by: Michael Hennerich <michael.hennerich@analog.com>
+Cc: Mike Frysinger <vapier@gentoo.org>
+Cc: Chris Verges <chrisv@cyberswitching.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/misc/ad525x_dpot-spi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/misc/ad525x_dpot-spi.c
++++ b/drivers/misc/ad525x_dpot-spi.c
+@@ -53,13 +53,13 @@ static int write8(void *client, u8 val)
+ static int write16(void *client, u8 reg, u8 val)
+ {
+ u8 data[2] = {reg, val};
+- return spi_write(client, data, 1);
++ return spi_write(client, data, 2);
+ }
+
+ static int write24(void *client, u8 reg, u16 val)
+ {
+ u8 data[3] = {reg, val >> 8, val};
+- return spi_write(client, data, 1);
++ return spi_write(client, data, 3);
+ }
+
+ static int read8(void *client)
--- /dev/null
+From 48b512e6857139393cdfce26348c362b87537018 Mon Sep 17 00:00:00 2001
+From: Roberto Sassu <roberto.sassu@polito.it>
+Date: Tue, 5 Oct 2010 18:53:45 +0200
+Subject: ecryptfs: call vfs_setxattr() in ecryptfs_setxattr()
+
+From: Roberto Sassu <roberto.sassu@polito.it>
+
+commit 48b512e6857139393cdfce26348c362b87537018 upstream.
+
+Ecryptfs is a stackable filesystem which relies on lower filesystems the
+ability of setting/getting extended attributes.
+
+If there is a security module enabled on the system it updates the
+'security' field of inodes according to the owned extended attribute set
+with the function vfs_setxattr(). When this function is performed on a
+ecryptfs filesystem the 'security' field is not updated for the lower
+filesystem since the call security_inode_post_setxattr() is missing for
+the lower inode.
+Further, the call security_inode_setxattr() is missing for the lower inode,
+leading to policy violations in the security module because specific
+checks for this hook are not performed (i. e. filesystem
+'associate' permission on SELinux is not checked for the lower filesystem).
+
+This patch replaces the call of the setxattr() method of the lower inode
+in the function ecryptfs_setxattr() with vfs_setxattr().
+
+Signed-off-by: Roberto Sassu <roberto.sassu@polito.it>
+Cc: Dustin Kirkland <kirkland@canonical.com>
+Acked-by: James Morris <jmorris@namei.org>
+Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ecryptfs/inode.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/fs/ecryptfs/inode.c
++++ b/fs/ecryptfs/inode.c
+@@ -32,6 +32,7 @@
+ #include <linux/crypto.h>
+ #include <linux/fs_stack.h>
+ #include <linux/slab.h>
++#include <linux/xattr.h>
+ #include <asm/unaligned.h>
+ #include "ecryptfs_kernel.h"
+
+@@ -1112,10 +1113,8 @@ ecryptfs_setxattr(struct dentry *dentry,
+ rc = -EOPNOTSUPP;
+ goto out;
+ }
+- mutex_lock(&lower_dentry->d_inode->i_mutex);
+- rc = lower_dentry->d_inode->i_op->setxattr(lower_dentry, name, value,
+- size, flags);
+- mutex_unlock(&lower_dentry->d_inode->i_mutex);
++
++ rc = vfs_setxattr(lower_dentry, name, value, size, flags);
+ out:
+ return rc;
+ }
--- /dev/null
+From 2e21b3f124eceb6ab5a07c8a061adce14ac94e14 Mon Sep 17 00:00:00 2001
+From: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Date: Thu, 23 Sep 2010 02:35:04 -0500
+Subject: eCryptfs: Clear LOOKUP_OPEN flag when creating lower file
+
+From: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+
+commit 2e21b3f124eceb6ab5a07c8a061adce14ac94e14 upstream.
+
+eCryptfs was passing the LOOKUP_OPEN flag through to the lower file
+system, even though ecryptfs_create() doesn't support the flag. A valid
+filp for the lower filesystem could be returned in the nameidata if the
+lower file system's create() function supported LOOKUP_OPEN, possibly
+resulting in unencrypted writes to the lower file.
+
+However, this is only a potential problem in filesystems (FUSE, NFS,
+CIFS, CEPH, 9p) that eCryptfs isn't known to support today.
+
+https://bugs.launchpad.net/ecryptfs/+bug/641703
+
+Reported-by: Kevin Buhr
+Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ecryptfs/inode.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/fs/ecryptfs/inode.c
++++ b/fs/ecryptfs/inode.c
+@@ -70,15 +70,19 @@ ecryptfs_create_underlying_file(struct i
+ struct vfsmount *lower_mnt = ecryptfs_dentry_to_lower_mnt(dentry);
+ struct dentry *dentry_save;
+ struct vfsmount *vfsmount_save;
++ unsigned int flags_save;
+ int rc;
+
+ dentry_save = nd->path.dentry;
+ vfsmount_save = nd->path.mnt;
++ flags_save = nd->flags;
+ nd->path.dentry = lower_dentry;
+ nd->path.mnt = lower_mnt;
++ nd->flags &= ~LOOKUP_OPEN;
+ rc = vfs_create(lower_dir_inode, lower_dentry, mode, nd);
+ nd->path.dentry = dentry_save;
+ nd->path.mnt = vfsmount_save;
++ nd->flags = flags_save;
+ return rc;
+ }
+
--- /dev/null
+From 1b627d5771312c92404b66f0a0b16f66036dd2e1 Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Tue, 26 Oct 2010 14:21:18 -0700
+Subject: hostfs: fix UML crash: remove f_spare from hostfs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Richard Weinberger <richard@nod.at>
+
+commit 1b627d5771312c92404b66f0a0b16f66036dd2e1 upstream.
+
+365b1818 ("add f_flags to struct statfs(64)") resized f_spare within
+struct statfs which caused a UML crash. There is no need to copy f_spare.
+
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Reported-by: Toralf Förster <toralf.foerster@gmx.de>
+Tested-by: Toralf Förster <toralf.foerster@gmx.de>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Jeff Dike <jdike@addtoit.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/hostfs/hostfs.h | 3 +--
+ fs/hostfs/hostfs_kern.c | 2 +-
+ fs/hostfs/hostfs_user.c | 9 ++-------
+ 3 files changed, 4 insertions(+), 10 deletions(-)
+
+--- a/fs/hostfs/hostfs.h
++++ b/fs/hostfs/hostfs.h
+@@ -96,7 +96,6 @@ extern int rename_file(char *from, char
+ extern int do_statfs(char *root, long *bsize_out, long long *blocks_out,
+ long long *bfree_out, long long *bavail_out,
+ long long *files_out, long long *ffree_out,
+- void *fsid_out, int fsid_size, long *namelen_out,
+- long *spare_out);
++ void *fsid_out, int fsid_size, long *namelen_out);
+
+ #endif
+--- a/fs/hostfs/hostfs_kern.c
++++ b/fs/hostfs/hostfs_kern.c
+@@ -217,7 +217,7 @@ int hostfs_statfs(struct dentry *dentry,
+ err = do_statfs(dentry->d_sb->s_fs_info,
+ &sf->f_bsize, &f_blocks, &f_bfree, &f_bavail, &f_files,
+ &f_ffree, &sf->f_fsid, sizeof(sf->f_fsid),
+- &sf->f_namelen, sf->f_spare);
++ &sf->f_namelen);
+ if (err)
+ return err;
+ sf->f_blocks = f_blocks;
+--- a/fs/hostfs/hostfs_user.c
++++ b/fs/hostfs/hostfs_user.c
+@@ -364,8 +364,7 @@ int rename_file(char *from, char *to)
+ int do_statfs(char *root, long *bsize_out, long long *blocks_out,
+ long long *bfree_out, long long *bavail_out,
+ long long *files_out, long long *ffree_out,
+- void *fsid_out, int fsid_size, long *namelen_out,
+- long *spare_out)
++ void *fsid_out, int fsid_size, long *namelen_out)
+ {
+ struct statfs64 buf;
+ int err;
+@@ -384,10 +383,6 @@ int do_statfs(char *root, long *bsize_ou
+ sizeof(buf.f_fsid) > fsid_size ? fsid_size :
+ sizeof(buf.f_fsid));
+ *namelen_out = buf.f_namelen;
+- spare_out[0] = buf.f_spare[0];
+- spare_out[1] = buf.f_spare[1];
+- spare_out[2] = buf.f_spare[2];
+- spare_out[3] = buf.f_spare[3];
+- spare_out[4] = buf.f_spare[4];
++
+ return 0;
+ }
--- /dev/null
+From 96e9694df446d1154ec2f4fdba8908588b9cba38 Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Tue, 26 Oct 2010 14:22:13 -0700
+Subject: hpet: fix unwanted interrupt due to stale irq status bit
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit 96e9694df446d1154ec2f4fdba8908588b9cba38 upstream.
+
+Jaswinder Singh Rajput wrote:
+> By executing Documentation/timers/hpet_example.c
+>
+> for polling, I requested for 3 iterations but it seems iteration work
+> for only 2 as first expired time is always very small.
+>
+> # ./hpet_example poll /dev/hpet 10 3
+> -hpet: executing poll
+> hpet_poll: info.hi_flags 0x0
+> hpet_poll: expired time = 0x13
+> hpet_poll: revents = 0x1
+> hpet_poll: data 0x1
+> hpet_poll: expired time = 0x1868c
+> hpet_poll: revents = 0x1
+> hpet_poll: data 0x1
+> hpet_poll: expired time = 0x18645
+> hpet_poll: revents = 0x1
+> hpet_poll: data 0x1
+
+Clearing the HPET interrupt enable bit disables interrupt generation
+but does not disable the timer, so the interrupt status bit will still
+be set when the timer elapses. If another interrupt arrives before
+the timer has been correctly programmed (due to some other device on
+the same interrupt line, or CONFIG_DEBUG_SHIRQ), this results in an
+extra unwanted interrupt event because the status bit is likely to be
+set from comparator matches that happened before the device was opened.
+
+Therefore, we have to ensure that the interrupt status bit is and
+stays cleared until we actually program the timer.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Reported-by: Jaswinder Singh Rajput <jaswinderlinux@gmail.com>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: john stultz <johnstul@us.ibm.com>
+Cc: Bob Picco <bpicco@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/hpet.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+--- a/drivers/char/hpet.c
++++ b/drivers/char/hpet.c
+@@ -479,6 +479,21 @@ static int hpet_ioctl_ieon(struct hpet_d
+ if (irq) {
+ unsigned long irq_flags;
+
++ if (devp->hd_flags & HPET_SHARED_IRQ) {
++ /*
++ * To prevent the interrupt handler from seeing an
++ * unwanted interrupt status bit, program the timer
++ * so that it will not fire in the near future ...
++ */
++ writel(readl(&timer->hpet_config) & ~Tn_TYPE_CNF_MASK,
++ &timer->hpet_config);
++ write_counter(read_counter(&hpet->hpet_mc),
++ &timer->hpet_compare);
++ /* ... and clear any left-over status. */
++ isr = 1 << (devp - devp->hd_hpets->hp_dev);
++ writel(isr, &hpet->hpet_isr);
++ }
++
+ sprintf(devp->hd_name, "hpet%d", (int)(devp - hpetp->hp_dev));
+ irq_flags = devp->hd_flags & HPET_SHARED_IRQ
+ ? IRQF_SHARED : IRQF_DISABLED;
--- /dev/null
+From a56d5318716d120e040294bb258901ba89fb9c90 Mon Sep 17 00:00:00 2001
+From: Jiri Slaby <jslaby@suse.cz>
+Date: Tue, 26 Oct 2010 14:22:11 -0700
+Subject: hpet: unmap unused I/O space
+
+From: Jiri Slaby <jslaby@suse.cz>
+
+commit a56d5318716d120e040294bb258901ba89fb9c90 upstream.
+
+When the initialization code in hpet finds a memory resource and does not
+find an IRQ, it does not unmap the memory resource previously mapped.
+
+There are buggy BIOSes which report resources exactly like this and what
+is worse the memory region bases point to normal RAM. This normally would
+not matter since the space is not touched. But when PAT is turned on,
+ioremap causes the page to be uncached and sets this bit in page->flags.
+
+Then when the page is about to be used by the allocator, it is reported
+as:
+
+BUG: Bad page state in process md5sum pfn:3ed00
+page:ffffea0000dbd800 count:0 mapcount:0 mapping:(null) index:0x0
+page flags: 0x20000001000000(uncached)
+Pid: 7956, comm: md5sum Not tainted 2.6.34-12-desktop #1
+Call Trace:
+ [<ffffffff810df851>] bad_page+0xb1/0x100
+ [<ffffffff810dfa45>] prep_new_page+0x1a5/0x1c0
+ [<ffffffff810dfe01>] get_page_from_freelist+0x3a1/0x640
+ [<ffffffff810e01af>] __alloc_pages_nodemask+0x10f/0x6b0
+...
+
+In this particular case:
+
+1) HPET returns 3ed00000 as memory region base, but it is not in
+reserved ranges reported by the BIOS (excerpt):
+ BIOS-e820: 0000000000100000 - 00000000af6cf000 (usable)
+ BIOS-e820: 00000000af6cf000 - 00000000afdcf000 (reserved)
+
+2) there is no IRQ resource reported by HPET method. On the other
+hand, the Intel HPET specs (1.0a) says (3.2.5.1):
+_CRS (
+ // Report 1K of memory consumed by this Timer Block
+ memory range consumed
+ // Optional: only used if BIOS allocates Interrupts [1]
+ IRQs consumed
+)
+
+[1] For case where Timer Block is configured to consume IRQ0/IRQ8 AND
+Legacy 8254/Legacy RTC hardware still exists, the device objects
+associated with 8254 & RTC devices should not report IRQ0/IRQ8 as
+"consumed resources".
+
+So in theory we should check whether if it is the case and use those
+interrupts instead.
+
+Anyway the address reported by the BIOS here is bogus, so non-presence
+of IRQ doesn't mean the "optional" part in point 2).
+
+Since I got no reply previously, fix this by simply unmapping the space
+when IRQ is not found and memory region was mapped previously. It would
+be probably more safe to walk the resources again and unmap appropriately
+depending on type. But as we now use only ioremap for both 2 memory
+resource types, it is not necessarily needed right now.
+
+Addresses https://bugzilla.novell.com/show_bug.cgi?id=629908
+
+Reported-by: Olaf Hering <olaf@aepfle.de>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Acked-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/hpet.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/char/hpet.c
++++ b/drivers/char/hpet.c
+@@ -985,6 +985,8 @@ static int hpet_acpi_add(struct acpi_dev
+ return -ENODEV;
+
+ if (!data.hd_address || !data.hd_nirqs) {
++ if (data.hd_address)
++ iounmap(data.hd_address);
+ printk("%s: no address or irqs in _CRS\n", __func__);
+ return -ENODEV;
+ }
--- /dev/null
+From fa7a5797e57d2ed71f9a6fb44f0ae42c2d7b74b7 Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Thu, 28 Oct 2010 20:31:50 +0200
+Subject: hwmon: (lm85) Fix ADT7468 frequency table
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit fa7a5797e57d2ed71f9a6fb44f0ae42c2d7b74b7 upstream.
+
+The ADT7468 uses the same frequency table as the ADT7463.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Cc: Darrick J. Wong <djwong@us.ibm.com>
+Acked-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/lm85.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/hwmon/lm85.c
++++ b/drivers/hwmon/lm85.c
+@@ -1259,6 +1259,7 @@ static int lm85_probe(struct i2c_client
+ switch (data->type) {
+ case adm1027:
+ case adt7463:
++ case adt7468:
+ case emc6d100:
+ case emc6d102:
+ data->freq_map = adm1027_freq_map;
--- /dev/null
+From e5e408fc94595aab897f613b6f4e2f5b36870a6f Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Sat, 28 Aug 2010 11:04:32 +0200
+Subject: intel-gtt: fix gtt_total_entries detection
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+commit e5e408fc94595aab897f613b6f4e2f5b36870a6f upstream.
+
+In commit f1befe71 Chris Wilson added some code to clear the full gtt
+on g33/pineview instead of just the mappable part. The code looks like
+it was copy-pasted from agp/intel-gtt.c, at least an identical piece
+of code is still there (in intel_i830_init_gtt_entries). This lead to
+a regression in 2.6.35 which was supposedly fixed in commit e7b96f28
+
+Now this commit makes absolutely no sense to me. It seems to be
+slightly confused about chipset generations - it references docs for
+4th gen but the regression concerns 3rd gen g33. Luckily the the g33
+gmch docs are available with the GMCH Graphics Control pci config
+register definitions. The other (bigger problem) is that the new
+check in there uses the i830 stolen mem bits (.5M, 1M or 8M of stolen
+mem). They are different since the i855GM.
+
+The most likely case is that it hits the 512M fallback, which was
+probably the right thing for the boxes this was tested on.
+
+So the original approach by Chris Wilson seems to be wrong and the
+current code is definitely wrong. There is a third approach by Jesse
+Barnes from his RFC patch "Who wants a bigger GTT mapping range?"
+where he simply shoves g33 in the same clause like later chipset
+generations.
+
+I've asked him and Jesse confirmed that this should work. So implement
+it.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=16891$
+Tested-by: Anisse Astier <anisse@astier.eu>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
+index 56bcf27..3b84d84 100644
+--- a/drivers/char/agp/intel-gtt.c
++++ b/drivers/char/agp/intel-gtt.c
+@@ -699,71 +699,43 @@ static unsigned int intel_gtt_stolen_entries(void)
+ static unsigned int intel_gtt_total_entries(void)
+ {
+ int size;
+- u16 gmch_ctrl;
+
+- if (IS_I965) {
++ if (IS_G33 || IS_I965 || IS_G4X) {
+ u32 pgetbl_ctl;
+ pgetbl_ctl = readl(intel_private.registers+I810_PGETBL_CTL);
+
+- /* The 965 has a field telling us the size of the GTT,
+- * which may be larger than what is necessary to map the
+- * aperture.
+- */
+ switch (pgetbl_ctl & I965_PGETBL_SIZE_MASK) {
+ case I965_PGETBL_SIZE_128KB:
+- size = 128;
++ size = KB(128);
+ break;
+ case I965_PGETBL_SIZE_256KB:
+- size = 256;
++ size = KB(256);
+ break;
+ case I965_PGETBL_SIZE_512KB:
+- size = 512;
++ size = KB(512);
+ break;
+ case I965_PGETBL_SIZE_1MB:
+- size = 1024;
++ size = KB(1024);
+ break;
+ case I965_PGETBL_SIZE_2MB:
+- size = 2048;
++ size = KB(2048);
+ break;
+ case I965_PGETBL_SIZE_1_5MB:
+- size = 1024 + 512;
++ size = KB(1024 + 512);
+ break;
+ default:
+ dev_info(&intel_private.pcidev->dev,
+ "unknown page table size, assuming 512KB\n");
+- size = 512;
+- }
+- size += 4; /* add in BIOS popup space */
+- } else if (IS_G33 && !IS_PINEVIEW) {
+- /* G33's GTT size defined in gmch_ctrl */
+- switch (gmch_ctrl & G33_PGETBL_SIZE_MASK) {
+- case G33_PGETBL_SIZE_1M:
+- size = 1024;
+- break;
+- case G33_PGETBL_SIZE_2M:
+- size = 2048;
+- break;
+- default:
+- dev_info(&intel_private.bridge_dev->dev,
+- "unknown page table size 0x%x, assuming 512KB\n",
+- (gmch_ctrl & G33_PGETBL_SIZE_MASK));
+- size = 512;
++ size = KB(512);
+ }
+- size += 4;
+- } else if (IS_G4X || IS_PINEVIEW) {
+- /* On 4 series hardware, GTT stolen is separate from graphics
+- * stolen, ignore it in stolen gtt entries counting. However,
+- * 4KB of the stolen memory doesn't get mapped to the GTT.
+- */
+- size = 4;
++
++ return size/4;
+ } else {
+ /* On previous hardware, the GTT size was just what was
+ * required to map the aperture.
+ */
+- size = agp_bridge->driver->fetch_size() + 4;
++ return intel_private.base.gtt_mappable_entries;
+ }
+-
+- return size/KB(4);
+ }
+ #endif
+
--- /dev/null
+From 03145beb455cf5c20a761e8451e30b8a74ba58d9 Mon Sep 17 00:00:00 2001
+From: Dan Rosenberg <drosenberg@vsecurity.com>
+Date: Wed, 27 Oct 2010 15:34:17 -0700
+Subject: ipc: initialize structure memory to zero for compat functions
+
+From: Dan Rosenberg <drosenberg@vsecurity.com>
+
+commit 03145beb455cf5c20a761e8451e30b8a74ba58d9 upstream.
+
+This takes care of leaking uninitialized kernel stack memory to
+userspace from non-zeroed fields in structs in compat ipc functions.
+
+Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
+Cc: Manfred Spraul <manfred@colorfullife.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ ipc/compat.c | 6 ++++++
+ ipc/compat_mq.c | 5 +++++
+ 2 files changed, 11 insertions(+)
+
+--- a/ipc/compat.c
++++ b/ipc/compat.c
+@@ -241,6 +241,8 @@ long compat_sys_semctl(int first, int se
+ struct semid64_ds __user *up64;
+ int version = compat_ipc_parse_version(&third);
+
++ memset(&s64, 0, sizeof(s64));
++
+ if (!uptr)
+ return -EINVAL;
+ if (get_user(pad, (u32 __user *) uptr))
+@@ -421,6 +423,8 @@ long compat_sys_msgctl(int first, int se
+ int version = compat_ipc_parse_version(&second);
+ void __user *p;
+
++ memset(&m64, 0, sizeof(m64));
++
+ switch (second & (~IPC_64)) {
+ case IPC_INFO:
+ case IPC_RMID:
+@@ -594,6 +598,8 @@ long compat_sys_shmctl(int first, int se
+ int err, err2;
+ int version = compat_ipc_parse_version(&second);
+
++ memset(&s64, 0, sizeof(s64));
++
+ switch (second & (~IPC_64)) {
+ case IPC_RMID:
+ case SHM_LOCK:
+--- a/ipc/compat_mq.c
++++ b/ipc/compat_mq.c
+@@ -53,6 +53,9 @@ asmlinkage long compat_sys_mq_open(const
+ void __user *p = NULL;
+ if (u_attr && oflag & O_CREAT) {
+ struct mq_attr attr;
++
++ memset(&attr, 0, sizeof(attr));
++
+ p = compat_alloc_user_space(sizeof(attr));
+ if (get_compat_mq_attr(&attr, u_attr) ||
+ copy_to_user(p, &attr, sizeof(attr)))
+@@ -127,6 +130,8 @@ asmlinkage long compat_sys_mq_getsetattr
+ struct mq_attr __user *p = compat_alloc_user_space(2 * sizeof(*p));
+ long ret;
+
++ memset(&mqstat, 0, sizeof(mqstat));
++
+ if (u_mqstat) {
+ if (get_compat_mq_attr(&mqstat, u_mqstat) ||
+ copy_to_user(p, &mqstat, sizeof(mqstat)))
--- /dev/null
+From 3af54c9bd9e6f14f896aac1bb0e8405ae0bc7a44 Mon Sep 17 00:00:00 2001
+From: Vasiliy Kulikov <segooon@gmail.com>
+Date: Sat, 30 Oct 2010 18:22:49 +0400
+Subject: ipc: shm: fix information leak to userland
+
+From: Vasiliy Kulikov <segooon@gmail.com>
+
+commit 3af54c9bd9e6f14f896aac1bb0e8405ae0bc7a44 upstream.
+
+The shmid_ds structure is copied to userland with shm_unused{,2,3}
+fields unitialized. It leads to leaking of contents of kernel stack
+memory.
+
+Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
+Acked-by: Al Viro <viro@ZenIV.linux.org.uk>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ ipc/shm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/ipc/shm.c
++++ b/ipc/shm.c
+@@ -473,6 +473,7 @@ static inline unsigned long copy_shmid_t
+ {
+ struct shmid_ds out;
+
++ memset(&out, 0, sizeof(out));
+ ipc64_perm_to_ipc_perm(&in->shm_perm, &out.shm_perm);
+ out.shm_segsz = in->shm_segsz;
+ out.shm_atime = in->shm_atime;
--- /dev/null
+From de5e2ddf9bb3ce7b643223b9b0718062254f302f Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Tue, 26 Oct 2010 14:21:17 -0700
+Subject: ipmi: proper spinlock initialization
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+commit de5e2ddf9bb3ce7b643223b9b0718062254f302f upstream.
+
+Unloading ipmi module can trigger following error. (if
+CONFIG_DEBUG_SPINLOCK=y)
+
+[ 9633.779590] BUG: spinlock bad magic on CPU#1, rmmod/7170
+[ 9633.779606] lock: f41f5414, .magic: 00000000, .owner:
+<none>/-1, .owner_cpu: 0
+[ 9633.779626] Pid: 7170, comm: rmmod Not tainted
+2.6.36-rc7-11474-gb71eb1e-dirty #328
+[ 9633.779644] Call Trace:
+[ 9633.779657] [<c13921cc>] ? printk+0x18/0x1c
+[ 9633.779672] [<c11a1f33>] spin_bug+0xa3/0xf0
+[ 9633.779685] [<c11a1ffd>] do_raw_spin_lock+0x7d/0x160
+[ 9633.779702] [<c1131537>] ? release_sysfs_dirent+0x47/0xb0
+[ 9633.779718] [<c1131b78>] ? sysfs_addrm_finish+0xa8/0xd0
+[ 9633.779734] [<c1394bac>] _raw_spin_lock_irqsave+0xc/0x20
+[ 9633.779752] [<f99d93da>] cleanup_one_si+0x6a/0x200 [ipmi_si]
+[ 9633.779768] [<c11305b2>] ? sysfs_hash_and_remove+0x72/0x80
+[ 9633.779786] [<f99dcf26>] ipmi_pnp_remove+0xd/0xf [ipmi_si]
+[ 9633.779802] [<c11f622b>] pnp_device_remove+0x1b/0x40
+
+Fix this by initializing spinlocks in a smi_info_alloc() helper function,
+right after memory allocation and clearing.
+
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Acked-by: David Miller <davem@davemloft.net>
+Cc: Yinghai Lu <yinghai@kernel.org>
+Acked-by: Corey Minyard <cminyard@mvista.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/ipmi/ipmi_si_intf.c | 30 +++++++++++++++++++-----------
+ 1 file changed, 19 insertions(+), 11 deletions(-)
+
+--- a/drivers/char/ipmi/ipmi_si_intf.c
++++ b/drivers/char/ipmi/ipmi_si_intf.c
+@@ -1665,6 +1665,17 @@ static int check_hotmod_int_op(const cha
+ return 0;
+ }
+
++static struct smi_info *smi_info_alloc(void)
++{
++ struct smi_info *info = kzalloc(sizeof(*info), GFP_KERNEL);
++
++ if (info) {
++ spin_lock_init(&info->si_lock);
++ spin_lock_init(&info->msg_lock);
++ }
++ return info;
++}
++
+ static int hotmod_handler(const char *val, struct kernel_param *kp)
+ {
+ char *str = kstrdup(val, GFP_KERNEL);
+@@ -1779,7 +1790,7 @@ static int hotmod_handler(const char *va
+ }
+
+ if (op == HM_ADD) {
+- info = kzalloc(sizeof(*info), GFP_KERNEL);
++ info = smi_info_alloc();
+ if (!info) {
+ rv = -ENOMEM;
+ goto out;
+@@ -1844,7 +1855,7 @@ static __devinit void hardcode_find_bmc(
+ if (!ports[i] && !addrs[i])
+ continue;
+
+- info = kzalloc(sizeof(*info), GFP_KERNEL);
++ info = smi_info_alloc();
+ if (!info)
+ return;
+
+@@ -2028,7 +2039,7 @@ static __devinit int try_init_spmi(struc
+ return -ENODEV;
+ }
+
+- info = kzalloc(sizeof(*info), GFP_KERNEL);
++ info = smi_info_alloc();
+ if (!info) {
+ printk(KERN_ERR PFX "Could not allocate SI data (3)\n");
+ return -ENOMEM;
+@@ -2138,7 +2149,7 @@ static int __devinit ipmi_pnp_probe(stru
+ if (!acpi_dev)
+ return -ENODEV;
+
+- info = kzalloc(sizeof(*info), GFP_KERNEL);
++ info = smi_info_alloc();
+ if (!info)
+ return -ENOMEM;
+
+@@ -2319,7 +2330,7 @@ static __devinit void try_init_dmi(struc
+ {
+ struct smi_info *info;
+
+- info = kzalloc(sizeof(*info), GFP_KERNEL);
++ info = smi_info_alloc();
+ if (!info) {
+ printk(KERN_ERR PFX "Could not allocate SI data\n");
+ return;
+@@ -2426,7 +2437,7 @@ static int __devinit ipmi_pci_probe(stru
+ int class_type = pdev->class & PCI_ERMC_CLASSCODE_TYPE_MASK;
+ struct smi_info *info;
+
+- info = kzalloc(sizeof(*info), GFP_KERNEL);
++ info = smi_info_alloc();
+ if (!info)
+ return -ENOMEM;
+
+@@ -2567,7 +2578,7 @@ static int __devinit ipmi_of_probe(struc
+ return -EINVAL;
+ }
+
+- info = kzalloc(sizeof(*info), GFP_KERNEL);
++ info = smi_info_alloc();
+
+ if (!info) {
+ dev_err(&dev->dev,
+@@ -3014,7 +3025,7 @@ static __devinit void default_find_bmc(v
+ if (check_legacy_ioport(ipmi_defaults[i].port))
+ continue;
+ #endif
+- info = kzalloc(sizeof(*info), GFP_KERNEL);
++ info = smi_info_alloc();
+ if (!info)
+ return;
+
+@@ -3139,9 +3150,6 @@ static int try_smi_init(struct smi_info
+ goto out_err;
+ }
+
+- spin_lock_init(&(new_smi->si_lock));
+- spin_lock_init(&(new_smi->msg_lock));
+-
+ /* Do low-level detection first. */
+ if (new_smi->handlers->detect(new_smi->si_sm)) {
+ if (new_smi->addr_source)
--- /dev/null
+From 52c5171214ff3327961d0ce0db7e8d2ce55004fd Mon Sep 17 00:00:00 2001
+From: Andrew Morton <akpm@linux-foundation.org>
+Date: Tue, 26 Oct 2010 14:21:19 -0700
+Subject: kfifo: disable __kfifo_must_check_helper()
+
+From: Andrew Morton <akpm@linux-foundation.org>
+
+commit 52c5171214ff3327961d0ce0db7e8d2ce55004fd upstream.
+
+This helper is wrong: it coerces signed values into unsigned ones, so code
+such as
+
+ if (kfifo_alloc(...) < 0) {
+ error
+ }
+
+will fail to detect the error.
+
+So let's disable __kfifo_must_check_helper() for 2.6.36.
+
+Cc: Randy Dunlap <randy.dunlap@oracle.com>
+Cc: Stefani Seibold <stefani@seibold.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/kfifo.h | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+--- a/include/linux/kfifo.h
++++ b/include/linux/kfifo.h
+@@ -171,11 +171,8 @@ struct kfifo_rec_ptr_2 __STRUCT_KFIFO_PT
+ }
+
+
+-static inline unsigned int __must_check
+-__kfifo_must_check_helper(unsigned int val)
+-{
+- return val;
+-}
++/* __kfifo_must_check_helper() is temporarily disabled because it was faulty */
++#define __kfifo_must_check_helper(x) (x)
+
+ /**
+ * kfifo_initialized - Check if the fifo is initialized
--- /dev/null
+From d97a41dc9c44f5829b7af7aa69fda10fd82b6b4e Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Thu, 28 Oct 2010 17:30:20 +1100
+Subject: md: Fix regression with raid1 arrays without persistent metadata.
+
+From: NeilBrown <neilb@suse.de>
+
+commit d97a41dc9c44f5829b7af7aa69fda10fd82b6b4e upstream.
+
+A RAID1 which has no persistent metadata, whether internal or
+external, will hang on the first write.
+This is caused by commit 070dc6dd7103b6b3f7e4d46e754354a5c15f366e
+In that case, MD_CHANGE_PENDING never gets cleared.
+
+So during md_update_sb, is neither persistent or external,
+clear MD_CHANGE_PENDING.
+
+This is suitable for 2.6.36-stable.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/md.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -2172,6 +2172,8 @@ repeat:
+ if (!mddev->persistent) {
+ clear_bit(MD_CHANGE_CLEAN, &mddev->flags);
+ clear_bit(MD_CHANGE_DEVS, &mddev->flags);
++ if (!mddev->external)
++ clear_bit(MD_CHANGE_PENDING, &mddev->flags);
+ wake_up(&mddev->sb_wait);
+ return;
+ }
--- /dev/null
+From c26a44ed1e552aaa1d4ceb71842002d235fe98d7 Mon Sep 17 00:00:00 2001
+From: Justin Maggard <jmaggard10@gmail.com>
+Date: Wed, 24 Nov 2010 16:36:17 +1100
+Subject: md: fix return value of rdev_size_change()
+
+From: Justin Maggard <jmaggard10@gmail.com>
+
+commit c26a44ed1e552aaa1d4ceb71842002d235fe98d7 upstream.
+
+When trying to grow an array by enlarging component devices,
+rdev_size_store() expects the return value of rdev_size_change() to be
+in sectors, but the actual value is returned in KBs.
+
+This functionality was broken by commit
+ dd8ac336c13fd8afdb082ebacb1cddd5cf727889
+so this patch is suitable for any kernel since 2.6.30.
+
+Signed-off-by: Justin Maggard <jmaggard10@gmail.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/md.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -1329,7 +1329,7 @@ super_90_rdev_size_change(mdk_rdev_t *rd
+ md_super_write(rdev->mddev, rdev, rdev->sb_start, rdev->sb_size,
+ rdev->sb_page);
+ md_super_wait(rdev->mddev);
+- return num_sectors / 2; /* kB for sysfs */
++ return num_sectors;
+ }
+
+
+@@ -1697,7 +1697,7 @@ super_1_rdev_size_change(mdk_rdev_t *rde
+ md_super_write(rdev->mddev, rdev, rdev->sb_start, rdev->sb_size,
+ rdev->sb_page);
+ md_super_wait(rdev->mddev);
+- return num_sectors / 2; /* kB for sysfs */
++ return num_sectors;
+ }
+
+ static struct super_type super_types[] = {
--- /dev/null
+From 8f9e0ee38f75d4740daa9e42c8af628d33d19a02 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Wed, 24 Nov 2010 16:39:46 +1100
+Subject: md/raid1: really fix recovery looping when single good device fails.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: NeilBrown <neilb@suse.de>
+
+commit 8f9e0ee38f75d4740daa9e42c8af628d33d19a02 upstream.
+
+Commit 4044ba58dd15cb01797c4fd034f39ef4a75f7cc3 supposedly fixed a
+problem where if a raid1 with just one good device gets a read-error
+during recovery, the recovery would abort and immediately restart in
+an infinite loop.
+
+However it depended on raid1_remove_disk removing the spare device
+from the array. But that does not happen in this case. So add a test
+so that in the 'recovery_disabled' case, the device will be removed.
+
+This suitable for any kernel since 2.6.29 which is when
+recovery_disabled was introduced.
+
+Reported-by: Sebastian Färber <faerber@gmail.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/raid1.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -1210,6 +1210,7 @@ static int raid1_remove_disk(mddev_t *md
+ * is not possible.
+ */
+ if (!test_bit(Faulty, &rdev->flags) &&
++ !mddev->recovery_disabled &&
+ mddev->degraded < conf->raid_disks) {
+ err = -EBUSY;
+ goto abort;
--- /dev/null
+From 572438f9b52236bd8938b1647cc15e027d27ef55 Mon Sep 17 00:00:00 2001
+From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Date: Tue, 26 Oct 2010 14:22:08 -0700
+Subject: mm: fix is_mem_section_removable() page_order BUG_ON check
+
+From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+
+commit 572438f9b52236bd8938b1647cc15e027d27ef55 upstream.
+
+page_order() is called by memory hotplug's user interface to check the
+section is removable or not. (is_mem_section_removable())
+
+It calls page_order() withoug holding zone->lock.
+So, even if the caller does
+
+ if (PageBuddy(page))
+ ret = page_order(page) ...
+The caller may hit BUG_ON().
+
+For fixing this, there are 2 choices.
+ 1. add zone->lock.
+ 2. remove BUG_ON().
+
+is_mem_section_removable() is used for some "advice" and doesn't need to
+be 100% accurate. This is_removable() can be called via user program..
+We don't want to take this important lock for long by user's request. So,
+this patch removes BUG_ON().
+
+Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Acked-by: Wu Fengguang <fengguang.wu@intel.com>
+Acked-by: Michal Hocko <mhocko@suse.cz>
+Acked-by: Mel Gorman <mel@csn.ul.ie>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/internal.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/internal.h
++++ b/mm/internal.h
+@@ -62,7 +62,7 @@ extern bool is_free_buddy_page(struct pa
+ */
+ static inline unsigned long page_order(struct page *page)
+ {
+- VM_BUG_ON(!PageBuddy(page));
++ /* PageBuddy() must be checked by the caller */
+ return page_private(page);
+ }
+
--- /dev/null
+From f8f72ad5396987e05a42cf7eff826fb2a15ff148 Mon Sep 17 00:00:00 2001
+From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Date: Tue, 26 Oct 2010 14:21:10 -0700
+Subject: mm: fix return value of scan_lru_pages in memory unplug
+
+From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+
+commit f8f72ad5396987e05a42cf7eff826fb2a15ff148 upstream.
+
+scan_lru_pages returns pfn. So, it's type should be "unsigned long"
+not "int".
+
+Note: I guess this has been work until now because memory hotplug tester's
+ machine has not very big memory....
+ physical address < 32bit << PAGE_SHIFT.
+
+Reported-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/memory_hotplug.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -659,7 +659,7 @@ static int test_pages_in_a_zone(unsigned
+ * Scanning pfn is much easier than scanning lru list.
+ * Scan pfn from start to end and Find LRU page.
+ */
+-int scan_lru_pages(unsigned long start, unsigned long end)
++unsigned long scan_lru_pages(unsigned long start, unsigned long end)
+ {
+ unsigned long pfn;
+ struct page *page;
--- /dev/null
+From 44e2aa937e698ea95dd86b2a4fabd734ef2c76db Mon Sep 17 00:00:00 2001
+From: Dean Nelson <dnelson@redhat.com>
+Date: Tue, 26 Oct 2010 14:22:08 -0700
+Subject: mm/hugetlb.c: add missing spin_lock() to hugetlb_cow()
+
+From: Dean Nelson <dnelson@redhat.com>
+
+commit 44e2aa937e698ea95dd86b2a4fabd734ef2c76db upstream.
+
+Add missing spin_lock() of the page_table_lock before an error return in
+hugetlb_cow(). Callers of hugtelb_cow() expect it to be held upon return.
+
+Signed-off-by: Dean Nelson <dnelson@redhat.com>
+Cc: Mel Gorman <mel@csn.ul.ie>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/hugetlb.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2380,8 +2380,11 @@ retry_avoidcopy:
+ * When the original hugepage is shared one, it does not have
+ * anon_vma prepared.
+ */
+- if (unlikely(anon_vma_prepare(vma)))
++ if (unlikely(anon_vma_prepare(vma))) {
++ /* Caller expects lock to be held */
++ spin_lock(&mm->page_table_lock);
+ return VM_FAULT_OOM;
++ }
+
+ copy_huge_page(new_page, old_page, address, vma);
+ __SetPageUptodate(new_page);
--- /dev/null
+From b7f50cfa3630b6e079929ffccfd442d65064ee1f Mon Sep 17 00:00:00 2001
+From: Mel Gorman <mel@csn.ul.ie>
+Date: Tue, 26 Oct 2010 14:21:11 -0700
+Subject: mm, page-allocator: do not check the state of a non-existant buddy during free
+
+From: Mel Gorman <mel@csn.ul.ie>
+
+commit b7f50cfa3630b6e079929ffccfd442d65064ee1f upstream.
+
+There is a bug in commit 6dda9d55 ("page allocator: reduce fragmentation
+in buddy allocator by adding buddies that are merging to the tail of the
+free lists") that means a buddy at order MAX_ORDER is checked for merging.
+ A page of this order never exists so at times, an effectively random
+piece of memory is being checked.
+
+Alan Curry has reported that this is causing memory corruption in
+userspace data on a PPC32 platform (http://lkml.org/lkml/2010/10/9/32).
+It is not clear why this is happening. It could be a cache coherency
+problem where pages mapped in both user and kernel space are getting
+different cache lines due to the bad read from kernel space
+(http://lkml.org/lkml/2010/10/13/179). It could also be that there are
+some special registers being io-remapped at the end of the memmap array
+and that a read has special meaning on them. Compiler bugs have been
+ruled out because the assembly before and after the patch looks relatively
+harmless.
+
+This patch fixes the problem by ensuring we are not reading a possibly
+invalid location of memory. It's not clear why the read causes corruption
+but one way or the other it is a buggy read.
+
+Signed-off-by: Mel Gorman <mel@csn.ul.ie>
+Cc: Corrado Zoccolo <czoccolo@gmail.com>
+Reported-by: Alan Curry <pacman@kosh.dhis.org>
+Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Cc: Christoph Lameter <cl@linux-foundation.org>
+Cc: Rik van Riel <riel@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/page_alloc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -530,7 +530,7 @@ static inline void __free_one_page(struc
+ * so it's less likely to be used soon and more likely to be merged
+ * as a higher order page
+ */
+- if ((order < MAX_ORDER-1) && pfn_valid_within(page_to_pfn(buddy))) {
++ if ((order < MAX_ORDER-2) && pfn_valid_within(page_to_pfn(buddy))) {
+ struct page *higher_page, *higher_buddy;
+ combined_idx = __find_combined_index(page_idx, order);
+ higher_page = page + combined_idx - page_idx;
--- /dev/null
+From 66c68bcc489fadd4f5e8839e966e3a366e50d1d5 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <bhutchings@solarflare.com>
+Date: Fri, 22 Oct 2010 04:38:26 +0000
+Subject: net: NETIF_F_HW_CSUM does not imply FCoE CRC offload
+
+From: Ben Hutchings <bhutchings@solarflare.com>
+
+commit 66c68bcc489fadd4f5e8839e966e3a366e50d1d5 upstream.
+
+NETIF_F_HW_CSUM indicates the ability to update an TCP/IP-style 16-bit
+checksum with the checksum of an arbitrary part of the packet data,
+whereas the FCoE CRC is something entirely different.
+
+Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/core/dev.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -1648,10 +1648,10 @@ EXPORT_SYMBOL(netif_device_attach);
+
+ static bool can_checksum_protocol(unsigned long features, __be16 protocol)
+ {
+- return ((features & NETIF_F_GEN_CSUM) ||
+- ((features & NETIF_F_IP_CSUM) &&
++ return ((features & NETIF_F_NO_CSUM) ||
++ ((features & NETIF_F_V4_CSUM) &&
+ protocol == htons(ETH_P_IP)) ||
+- ((features & NETIF_F_IPV6_CSUM) &&
++ ((features & NETIF_F_V6_CSUM) &&
+ protocol == htons(ETH_P_IPV6)) ||
+ ((features & NETIF_F_FCOE_CRC) &&
+ protocol == htons(ETH_P_FCOE)));
--- /dev/null
+From 800416f799e0723635ac2d720ad4449917a1481c Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Wed, 27 Oct 2010 19:33:43 +0200
+Subject: numa: fix slab_node(MPOL_BIND)
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+commit 800416f799e0723635ac2d720ad4449917a1481c upstream.
+
+When a node contains only HighMem memory, slab_node(MPOL_BIND)
+dereferences a NULL pointer.
+
+[ This code seems to go back all the way to commit 19770b32609b: "mm:
+ filter based on a nodemask as well as a gfp_mask". Which was back in
+ April 2008, and it got merged into 2.6.26. - Linus ]
+
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: Mel Gorman <mel@csn.ul.ie>
+Cc: Christoph Lameter <cl@linux.com>
+Cc: Lee Schermerhorn <lee.schermerhorn@hp.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/mempolicy.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -1588,7 +1588,7 @@ unsigned slab_node(struct mempolicy *pol
+ (void)first_zones_zonelist(zonelist, highest_zoneidx,
+ &policy->v.nodes,
+ &zone);
+- return zone->node;
++ return zone ? zone->node : numa_node_id();
+ }
+
+ default:
--- /dev/null
+From 7cfbb29466633e6ecdc14f76a693c8478c2b22af Mon Sep 17 00:00:00 2001
+From: Richard A. Smith <richard@laptop.org>
+Date: Sat, 25 Sep 2010 19:19:26 +0100
+Subject: olpc_battery: Fix endian neutral breakage for s16 values
+
+From: Richard A. Smith <richard@laptop.org>
+
+commit 7cfbb29466633e6ecdc14f76a693c8478c2b22af upstream.
+
+When the driver was updated to be endian neutral (8e9c7716c)
+the signed part of the s16 values was lost. This is because be16_to_cpu()
+returns an unsigned value. This patch casts the values back to a s16
+number prior to the the implicit cast up to an int.
+
+Signed-off-by: Richard A. Smith <richard@laptop.org>
+Signed-off-by: Daniel Drake <dsd@laptop.org>
+Signed-off-by: Anton Vorontsov <cbouatmailru@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/power/olpc_battery.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/power/olpc_battery.c
++++ b/drivers/power/olpc_battery.c
+@@ -271,14 +271,14 @@ static int olpc_bat_get_property(struct
+ if (ret)
+ return ret;
+
+- val->intval = (int)be16_to_cpu(ec_word) * 9760L / 32;
++ val->intval = (s16)be16_to_cpu(ec_word) * 9760L / 32;
+ break;
+ case POWER_SUPPLY_PROP_CURRENT_AVG:
+ ret = olpc_ec_cmd(EC_BAT_CURRENT, NULL, 0, (void *)&ec_word, 2);
+ if (ret)
+ return ret;
+
+- val->intval = (int)be16_to_cpu(ec_word) * 15625L / 120;
++ val->intval = (s16)be16_to_cpu(ec_word) * 15625L / 120;
+ break;
+ case POWER_SUPPLY_PROP_CAPACITY:
+ ret = olpc_ec_cmd(EC_BAT_SOC, NULL, 0, &ec_byte, 1);
+@@ -299,7 +299,7 @@ static int olpc_bat_get_property(struct
+ if (ret)
+ return ret;
+
+- val->intval = (int)be16_to_cpu(ec_word) * 100 / 256;
++ val->intval = (s16)be16_to_cpu(ec_word) * 100 / 256;
+ break;
+ case POWER_SUPPLY_PROP_TEMP_AMBIENT:
+ ret = olpc_ec_cmd(EC_AMB_TEMP, NULL, 0, (void *)&ec_word, 2);
+@@ -313,7 +313,7 @@ static int olpc_bat_get_property(struct
+ if (ret)
+ return ret;
+
+- val->intval = (int)be16_to_cpu(ec_word) * 6250 / 15;
++ val->intval = (s16)be16_to_cpu(ec_word) * 6250 / 15;
+ break;
+ case POWER_SUPPLY_PROP_SERIAL_NUMBER:
+ ret = olpc_ec_cmd(EC_BAT_SERIAL, NULL, 0, (void *)&ser_buf, 8);
--- /dev/null
+From 4ac3dbec800d93485a5c84e37af676278eea657c Mon Sep 17 00:00:00 2001
+From: Santosh Shilimkar <santosh.shilimkar@ti.com>
+Date: Wed, 27 Oct 2010 11:17:15 -0400
+Subject: oprofile: Fix the hang while taking the cpu offline
+
+From: Santosh Shilimkar <santosh.shilimkar@ti.com>
+
+commit 4ac3dbec800d93485a5c84e37af676278eea657c upstream.
+
+The kernel build with CONFIG_OPROFILE and CPU_HOTPLUG enabled.
+The oprofile is initialised using system timer in absence of hardware
+counters supports. Oprofile isn't started from userland.
+
+In this setup while doing a CPU offline the kernel hangs in infinite
+for loop inside lock_hrtimer_base() function
+
+This happens because as part of oprofile_cpu_notify(, it tries to
+stop an hrtimer which was never started. These per-cpu hrtimers
+are started when the oprfile is started.
+ echo 1 > /dev/oprofile/enable
+
+This problem also existwhen the cpu is booted with maxcpus parameter
+set. When bringing the remaining cpus online the timers are started
+even if oprofile is not yet enabled.
+
+This patch fix this issue by adding a state variable so that
+these hrtimer start/stop is only attempted when oprofile is
+started
+
+For stable kernels v2.6.35.y and v2.6.36.y.
+
+Reported-by: Jan Sebastien <s-jan@ti.com>
+Tested-by: sricharan <r.sricharan@ti.com>
+Signed-off-by: Santosh Shilimkar <santosh.shilimkar@ti.com>
+Signed-off-by: Robert Richter <robert.richter@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/oprofile/timer_int.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/drivers/oprofile/timer_int.c
++++ b/drivers/oprofile/timer_int.c
+@@ -21,6 +21,7 @@
+ #include "oprof.h"
+
+ static DEFINE_PER_CPU(struct hrtimer, oprofile_hrtimer);
++static int ctr_running;
+
+ static enum hrtimer_restart oprofile_hrtimer_notify(struct hrtimer *hrtimer)
+ {
+@@ -33,6 +34,9 @@ static void __oprofile_hrtimer_start(voi
+ {
+ struct hrtimer *hrtimer = &__get_cpu_var(oprofile_hrtimer);
+
++ if (!ctr_running)
++ return;
++
+ hrtimer_init(hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+ hrtimer->function = oprofile_hrtimer_notify;
+
+@@ -42,7 +46,10 @@ static void __oprofile_hrtimer_start(voi
+
+ static int oprofile_hrtimer_start(void)
+ {
++ get_online_cpus();
++ ctr_running = 1;
+ on_each_cpu(__oprofile_hrtimer_start, NULL, 1);
++ put_online_cpus();
+ return 0;
+ }
+
+@@ -50,6 +57,9 @@ static void __oprofile_hrtimer_stop(int
+ {
+ struct hrtimer *hrtimer = &per_cpu(oprofile_hrtimer, cpu);
+
++ if (!ctr_running)
++ return;
++
+ hrtimer_cancel(hrtimer);
+ }
+
+@@ -57,8 +67,11 @@ static void oprofile_hrtimer_stop(void)
+ {
+ int cpu;
+
++ get_online_cpus();
+ for_each_online_cpu(cpu)
+ __oprofile_hrtimer_stop(cpu);
++ ctr_running = 0;
++ put_online_cpus();
+ }
+
+ static int __cpuinit oprofile_cpu_notify(struct notifier_block *self,
--- /dev/null
+From 3d7851b3cdd43a734e5cc4c643fd886ab28ad4d5 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Fri, 15 Oct 2010 09:51:08 -0400
+Subject: oprofile: Remove deprecated use of flush_scheduled_work()
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 3d7851b3cdd43a734e5cc4c643fd886ab28ad4d5 upstream.
+
+flush_scheduled_work() is deprecated and scheduled to be removed.
+sync_stop() currently cancels cpu_buffer works inside buffer_mutex and
+flushes the system workqueue outside. Instead, split end_cpu_work()
+into two parts - stopping further work enqueues and flushing works -
+and do the former inside buffer_mutex and latter outside.
+
+For stable kernels v2.6.35.y and v2.6.36.y.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Robert Richter <robert.richter@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/oprofile/buffer_sync.c | 2 +-
+ drivers/oprofile/cpu_buffer.c | 10 +++++++---
+ drivers/oprofile/cpu_buffer.h | 1 +
+ 3 files changed, 9 insertions(+), 4 deletions(-)
+
+--- a/drivers/oprofile/buffer_sync.c
++++ b/drivers/oprofile/buffer_sync.c
+@@ -190,7 +190,7 @@ void sync_stop(void)
+ profile_event_unregister(PROFILE_TASK_EXIT, &task_exit_nb);
+ task_handoff_unregister(&task_free_nb);
+ mutex_unlock(&buffer_mutex);
+- flush_scheduled_work();
++ flush_cpu_work();
+
+ /* make sure we don't leak task structs */
+ process_task_mortuary();
+--- a/drivers/oprofile/cpu_buffer.c
++++ b/drivers/oprofile/cpu_buffer.c
+@@ -111,14 +111,18 @@ void start_cpu_work(void)
+
+ void end_cpu_work(void)
+ {
+- int i;
+-
+ work_enabled = 0;
++}
++
++void flush_cpu_work(void)
++{
++ int i;
+
+ for_each_online_cpu(i) {
+ struct oprofile_cpu_buffer *b = &per_cpu(op_cpu_buffer, i);
+
+- cancel_delayed_work(&b->work);
++ /* these works are per-cpu, no need for flush_sync */
++ flush_delayed_work(&b->work);
+ }
+ }
+
+--- a/drivers/oprofile/cpu_buffer.h
++++ b/drivers/oprofile/cpu_buffer.h
+@@ -25,6 +25,7 @@ void free_cpu_buffers(void);
+
+ void start_cpu_work(void);
+ void end_cpu_work(void);
++void flush_cpu_work(void);
+
+ /* CPU buffer is composed of such entries (which are
+ * also used for context switch notes)
--- /dev/null
+From 8474b591faf3bb0a1e08a60d21d6baac498f15e4 Mon Sep 17 00:00:00 2001
+From: Masanori ITOH <itoumsn@nttdata.co.jp>
+Date: Tue, 26 Oct 2010 14:21:20 -0700
+Subject: percpu: fix list_head init bug in __percpu_counter_init()
+
+From: Masanori ITOH <itoumsn@nttdata.co.jp>
+
+commit 8474b591faf3bb0a1e08a60d21d6baac498f15e4 upstream.
+
+WARNING: at lib/list_debug.c:26 __list_add+0x3f/0x81()
+Hardware name: Express5800/B120a [N8400-085]
+list_add corruption. next->prev should be prev (ffffffff81a7ea00), but was dead000000200200. (next=ffff88080b872d58).
+Modules linked in: aoe ipt_MASQUERADE iptable_nat nf_nat autofs4 sunrpc bridge 8021q garp stp llc ipv6 cpufreq_ondemand acpi_cpufreq freq_table dm_round_robin dm_multipath kvm_intel kvm uinput lpfc scsi_transport_fc igb ioatdma scsi_tgt i2c_i801 i2c_core dca iTCO_wdt iTCO_vendor_support pcspkr shpchp megaraid_sas [last unloaded: aoe]
+Pid: 54, comm: events/3 Tainted: G W 2.6.34-vanilla1 #1
+Call Trace:
+[<ffffffff8104bd77>] warn_slowpath_common+0x7c/0x94
+[<ffffffff8104bde6>] warn_slowpath_fmt+0x41/0x43
+[<ffffffff8120fd2e>] __list_add+0x3f/0x81
+[<ffffffff81212a12>] __percpu_counter_init+0x59/0x6b
+[<ffffffff810d8499>] bdi_init+0x118/0x17e
+[<ffffffff811f2c50>] blk_alloc_queue_node+0x79/0x143
+[<ffffffff811f2d2b>] blk_alloc_queue+0x11/0x13
+[<ffffffffa02a931d>] aoeblk_gdalloc+0x8e/0x1c9 [aoe]
+[<ffffffffa02aa655>] aoecmd_sleepwork+0x25/0xa8 [aoe]
+[<ffffffff8106186c>] worker_thread+0x1a9/0x237
+[<ffffffffa02aa630>] ? aoecmd_sleepwork+0x0/0xa8 [aoe]
+[<ffffffff81065827>] ? autoremove_wake_function+0x0/0x39
+[<ffffffff810616c3>] ? worker_thread+0x0/0x237
+[<ffffffff810653ad>] kthread+0x7f/0x87
+[<ffffffff8100aa24>] kernel_thread_helper+0x4/0x10
+[<ffffffff8106532e>] ? kthread+0x0/0x87
+[<ffffffff8100aa20>] ? kernel_thread_helper+0x0/0x10
+
+It's because there is no initialization code for a list_head contained in
+the struct backing_dev_info under CONFIG_HOTPLUG_CPU, and the bug comes up
+when block device drivers calling blk_alloc_queue() are used. In case of
+me, I got them by using aoe.
+
+Signed-off-by: Masanori Itoh <itoumsn@nttdata.co.jp>
+Cc: Tejun Heo <tj@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ lib/percpu_counter.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/lib/percpu_counter.c
++++ b/lib/percpu_counter.c
+@@ -76,6 +76,7 @@ int __percpu_counter_init(struct percpu_
+ if (!fbc->counters)
+ return -ENOMEM;
+ #ifdef CONFIG_HOTPLUG_CPU
++ INIT_LIST_HEAD(&fbc->list);
+ mutex_lock(&percpu_counters_lock);
+ list_add(&fbc->list, &percpu_counters);
+ mutex_unlock(&percpu_counters_lock);
--- /dev/null
+From b1353e4f40f6179ab26a3bb1b2e1fe29ffe534f5 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Fri, 19 Nov 2010 15:29:19 +0100
+Subject: sata_via: apply magic FIFO fix to vt6420 too
+
+From: Tejun Heo <tj@kernel.org>
+
+commit b1353e4f40f6179ab26a3bb1b2e1fe29ffe534f5 upstream.
+
+vt6420 has the same FIFO overflow problem as vt6421 when combined with
+certain devices. This patch applies the magic fix to vt6420 too.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Martin Qvist <q@maq.dk>
+Reported-by: Peter Zijlstra <peterz@infradead.org>
+Cc: Joseph Chan <JosephChan@via.com.tw>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/sata_via.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/ata/sata_via.c
++++ b/drivers/ata/sata_via.c
+@@ -538,7 +538,7 @@ static int vt8251_prepare_host(struct pc
+ return 0;
+ }
+
+-static void svia_configure(struct pci_dev *pdev)
++static void svia_configure(struct pci_dev *pdev, int board_id)
+ {
+ u8 tmp8;
+
+@@ -577,7 +577,7 @@ static void svia_configure(struct pci_de
+ }
+
+ /*
+- * vt6421 has problems talking to some drives. The following
++ * vt6420/1 has problems talking to some drives. The following
+ * is the fix from Joseph Chan <JosephChan@via.com.tw>.
+ *
+ * When host issues HOLD, device may send up to 20DW of data
+@@ -596,8 +596,9 @@ static void svia_configure(struct pci_de
+ *
+ * https://bugzilla.kernel.org/show_bug.cgi?id=15173
+ * http://article.gmane.org/gmane.linux.ide/46352
++ * http://thread.gmane.org/gmane.linux.kernel/1062139
+ */
+- if (pdev->device == 0x3249) {
++ if (board_id == vt6420 || board_id == vt6421) {
+ pci_read_config_byte(pdev, 0x52, &tmp8);
+ tmp8 |= 1 << 2;
+ pci_write_config_byte(pdev, 0x52, tmp8);
+@@ -652,7 +653,7 @@ static int svia_init_one(struct pci_dev
+ if (rc)
+ return rc;
+
+- svia_configure(pdev);
++ svia_configure(pdev, board_id);
+
+ pci_set_master(pdev);
+ return ata_host_activate(host, pdev->irq, ata_bmdma_interrupt,
staging-asus_oled-fix-up-my-fixup-for-some-sysfs-attribute-permissions.patch
alsa-hda-use-hp-laptop-quirk-to-enable-headphones-automute-for-asus-a52j.patch
staging-line6-fix-up-some-sysfs-attribute-permissions.patch
+kfifo-disable-__kfifo_must_check_helper.patch
+hpet-fix-unwanted-interrupt-due-to-stale-irq-status-bit.patch
+hpet-unmap-unused-i-o-space.patch
+olpc_battery-fix-endian-neutral-breakage-for-s16-values.patch
+percpu-fix-list_head-init-bug-in-__percpu_counter_init.patch
+hostfs-fix-uml-crash-remove-f_spare-from-hostfs.patch
+ipmi-proper-spinlock-initialization.patch
+um-remove-page_size-alignment-in-linker-script-causing-kernel-segfault.patch
+um-fix-global-timer-issue-when-using-config_no_hz.patch
+numa-fix-slab_node-mpol_bind.patch
+hwmon-lm85-fix-adt7468-frequency-table.patch
+oprofile-remove-deprecated-use-of-flush_scheduled_work.patch
+oprofile-fix-the-hang-while-taking-the-cpu-offline.patch
+mm-fix-return-value-of-scan_lru_pages-in-memory-unplug.patch
+mm-page-allocator-do-not-check-the-state-of-a-non-existant-buddy-during-free.patch
+mm-fix-is_mem_section_removable-page_order-bug_on-check.patch
+mm-hugetlb.c-add-missing-spin_lock-to-hugetlb_cow.patch
+agp-intel-also-add-b43.1-to-list-of-supported-devices.patch
+b43-fix-warning-at-drivers-mmc-core-core.c-237-in-mmc_wait_for_cmd.patch
+wireless-b43-fix-error-path-in-sdio.patch
+ssb-b43-pci-bridge-add-new-vendor-for-bcm4318.patch
+drivers-misc-ad525x_dpot.c-fix-typo-in-spi-write16-and-write24-transfer-counts.patch
+sgi-xpc-xpc-fails-to-discover-partitions-with-all-nasids-above-128.patch
+xen-ensure-that-all-event-channels-start-off-bound-to-vcpu-0.patch
+xen-don-t-bother-to-stop-other-cpus-on-shutdown-reboot.patch
+ipc-initialize-structure-memory-to-zero-for-compat-functions.patch
+ipc-shm-fix-information-leak-to-userland.patch
+net-netif_f_hw_csum-does-not-imply-fcoe-crc-offload.patch
+drivers-char-vt_ioctl.c-fix-vt_openqry-error-value.patch
+viafb-use-proper-register-for-colour-when-doing-fill-ops.patch
+sata_via-apply-magic-fifo-fix-to-vt6420-too.patch
+ecryptfs-clear-lookup_open-flag-when-creating-lower-file.patch
+ecryptfs-call-vfs_setxattr-in-ecryptfs_setxattr.patch
+md-fix-regression-with-raid1-arrays-without-persistent-metadata.patch
+md-raid1-really-fix-recovery-looping-when-single-good-device-fails.patch
+md-fix-return-value-of-rdev_size_change.patch
+alsa-hda-use-bios-auto-parsing-instead-of-existing-model-quirk-for-medion-md2.patch
+intel-gtt-fix-gtt_total_entries-detection.patch
+sgi-xp-incoming-xpc-channel-messages-can-come-in-after-the-channel-s-partition-structures-have-been-torn-down.patch
--- /dev/null
+From 09358972bff5ce99de496bbba97c85d417b3c054 Mon Sep 17 00:00:00 2001
+From: Robin Holt <holt@sgi.com>
+Date: Tue, 26 Oct 2010 14:21:15 -0700
+Subject: sgi-xp: incoming XPC channel messages can come in after the channel's partition structures have been torn down
+
+From: Robin Holt <holt@sgi.com>
+
+commit 09358972bff5ce99de496bbba97c85d417b3c054 upstream.
+
+Under some workloads, some channel messages have been observed being
+delayed on the sending side past the point where the receiving side has
+been able to tear down its partition structures.
+
+This condition is already detected in xpc_handle_activate_IRQ_uv(), but
+that information is not given to xpc_handle_activate_mq_msg_uv(). As a
+result, xpc_handle_activate_mq_msg_uv() assumes the structures still exist
+and references them, causing a NULL-pointer deref.
+
+Signed-off-by: Robin Holt <holt@sgi.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+diff --git a/drivers/misc/sgi-xp/xpc_uv.c b/drivers/misc/sgi-xp/xpc_uv.c
+index 1f59ee2..17bbacb 100644
+--- a/drivers/misc/sgi-xp/xpc_uv.c
++++ b/drivers/misc/sgi-xp/xpc_uv.c
+@@ -417,6 +417,7 @@ xpc_process_activate_IRQ_rcvd_uv(void)
+ static void
+ xpc_handle_activate_mq_msg_uv(struct xpc_partition *part,
+ struct xpc_activate_mq_msghdr_uv *msg_hdr,
++ int part_setup,
+ int *wakeup_hb_checker)
+ {
+ unsigned long irq_flags;
+@@ -481,6 +482,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc_partition *part,
+ case XPC_ACTIVATE_MQ_MSG_CHCTL_CLOSEREQUEST_UV: {
+ struct xpc_activate_mq_msg_chctl_closerequest_uv *msg;
+
++ if (!part_setup)
++ break;
++
+ msg = container_of(msg_hdr, struct
+ xpc_activate_mq_msg_chctl_closerequest_uv,
+ hdr);
+@@ -497,6 +501,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc_partition *part,
+ case XPC_ACTIVATE_MQ_MSG_CHCTL_CLOSEREPLY_UV: {
+ struct xpc_activate_mq_msg_chctl_closereply_uv *msg;
+
++ if (!part_setup)
++ break;
++
+ msg = container_of(msg_hdr, struct
+ xpc_activate_mq_msg_chctl_closereply_uv,
+ hdr);
+@@ -511,6 +518,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc_partition *part,
+ case XPC_ACTIVATE_MQ_MSG_CHCTL_OPENREQUEST_UV: {
+ struct xpc_activate_mq_msg_chctl_openrequest_uv *msg;
+
++ if (!part_setup)
++ break;
++
+ msg = container_of(msg_hdr, struct
+ xpc_activate_mq_msg_chctl_openrequest_uv,
+ hdr);
+@@ -528,6 +538,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc_partition *part,
+ case XPC_ACTIVATE_MQ_MSG_CHCTL_OPENREPLY_UV: {
+ struct xpc_activate_mq_msg_chctl_openreply_uv *msg;
+
++ if (!part_setup)
++ break;
++
+ msg = container_of(msg_hdr, struct
+ xpc_activate_mq_msg_chctl_openreply_uv, hdr);
+ args = &part->remote_openclose_args[msg->ch_number];
+@@ -545,6 +558,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc_partition *part,
+ case XPC_ACTIVATE_MQ_MSG_CHCTL_OPENCOMPLETE_UV: {
+ struct xpc_activate_mq_msg_chctl_opencomplete_uv *msg;
+
++ if (!part_setup)
++ break;
++
+ msg = container_of(msg_hdr, struct
+ xpc_activate_mq_msg_chctl_opencomplete_uv, hdr);
+ spin_lock_irqsave(&part->chctl_lock, irq_flags);
+@@ -621,6 +637,7 @@ xpc_handle_activate_IRQ_uv(int irq, void *dev_id)
+
+ part_referenced = xpc_part_ref(part);
+ xpc_handle_activate_mq_msg_uv(part, msg_hdr,
++ part_referenced,
+ &wakeup_hb_checker);
+ if (part_referenced)
+ xpc_part_deref(part);
--- /dev/null
+From c22c7aeff69796f46ae0fcec141538e28f50b24e Mon Sep 17 00:00:00 2001
+From: Robin@sgi.com <Robin@sgi.com>
+Date: Wed, 24 Nov 2010 12:56:59 -0800
+Subject: sgi-xpc: XPC fails to discover partitions with all nasids above 128
+
+From: Robin@sgi.com <Robin@sgi.com>
+
+commit c22c7aeff69796f46ae0fcec141538e28f50b24e upstream.
+
+UV hardware defines 256 memory protection regions versus the baseline 64
+with increasing size for the SN2 ia64. This was overlooked when XPC was
+modified to accomodate both UV and SN2.
+
+Without this patch, a user could reconfigure their existing system and
+suddenly disable cross-partition communications with no indication of what
+has gone wrong. It also prevents larger configurations from using
+cross-partition communication.
+
+Signed-off-by: Robin Holt <holt@sgi.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/misc/sgi-xp/xpc_partition.c | 25 +++++++++++++++----------
+ 1 file changed, 15 insertions(+), 10 deletions(-)
+
+--- a/drivers/misc/sgi-xp/xpc_partition.c
++++ b/drivers/misc/sgi-xp/xpc_partition.c
+@@ -439,18 +439,23 @@ xpc_discovery(void)
+ * nodes that can comprise an access protection grouping. The access
+ * protection is in regards to memory, IOI and IPI.
+ */
+- max_regions = 64;
+ region_size = xp_region_size;
+
+- switch (region_size) {
+- case 128:
+- max_regions *= 2;
+- case 64:
+- max_regions *= 2;
+- case 32:
+- max_regions *= 2;
+- region_size = 16;
+- DBUG_ON(!is_shub2());
++ if (is_uv())
++ max_regions = 256;
++ else {
++ max_regions = 64;
++
++ switch (region_size) {
++ case 128:
++ max_regions *= 2;
++ case 64:
++ max_regions *= 2;
++ case 32:
++ max_regions *= 2;
++ region_size = 16;
++ DBUG_ON(!is_shub2());
++ }
+ }
+
+ for (region = 0; region < max_regions; region++) {
--- /dev/null
+From 1d8638d4038eb8709edc80e37a0bbb77253d86e9 Mon Sep 17 00:00:00 2001
+From: Daniel Klaffenbach <danielklaffenbach@gmail.com>
+Date: Fri, 19 Nov 2010 21:25:21 -0600
+Subject: ssb: b43-pci-bridge: Add new vendor for BCM4318
+
+From: Daniel Klaffenbach <danielklaffenbach@gmail.com>
+
+commit 1d8638d4038eb8709edc80e37a0bbb77253d86e9 upstream.
+
+Add new vendor for Broadcom 4318.
+
+Signed-off-by: Daniel Klaffenbach <danielklaffenbach@gmail.com>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ssb/b43_pci_bridge.c | 1 +
+ include/linux/pci_ids.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/ssb/b43_pci_bridge.c
++++ b/drivers/ssb/b43_pci_bridge.c
+@@ -24,6 +24,7 @@ static const struct pci_device_id b43_pc
+ { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4312) },
+ { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4315) },
+ { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4318) },
++ { PCI_DEVICE(PCI_VENDOR_ID_BCM_GVC, 0x4318) },
+ { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4319) },
+ { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4320) },
+ { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4321) },
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -2041,6 +2041,7 @@
+ #define PCI_DEVICE_ID_AFAVLAB_P030 0x2182
+ #define PCI_SUBDEVICE_ID_AFAVLAB_P061 0x2150
+
++#define PCI_VENDOR_ID_BCM_GVC 0x14a4
+ #define PCI_VENDOR_ID_BROADCOM 0x14e4
+ #define PCI_DEVICE_ID_TIGON3_5752 0x1600
+ #define PCI_DEVICE_ID_TIGON3_5752M 0x1601
--- /dev/null
+From 482db6df1746c4fa7d64a2441d4cb2610249c679 Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Tue, 26 Oct 2010 14:21:13 -0700
+Subject: um: fix global timer issue when using CONFIG_NO_HZ
+
+From: Richard Weinberger <richard@nod.at>
+
+commit 482db6df1746c4fa7d64a2441d4cb2610249c679 upstream.
+
+This fixes a issue which was introduced by fe2cc53e ("uml: track and make
+up lost ticks").
+
+timeval_to_ns() returns long long and not int. Due to that UML's timer
+did not work properlt and caused timer freezes.
+
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Acked-by: Pekka Enberg <penberg@kernel.org>
+Cc: Jeff Dike <jdike@addtoit.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/um/os-Linux/time.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/um/os-Linux/time.c
++++ b/arch/um/os-Linux/time.c
+@@ -60,7 +60,7 @@ static inline long long timeval_to_ns(co
+ long long disable_timer(void)
+ {
+ struct itimerval time = ((struct itimerval) { { 0, 0 }, { 0, 0 } });
+- int remain, max = UM_NSEC_PER_SEC / UM_HZ;
++ long long remain, max = UM_NSEC_PER_SEC / UM_HZ;
+
+ if (setitimer(ITIMER_VIRTUAL, &time, &time) < 0)
+ printk(UM_KERN_ERR "disable_timer - setitimer failed, "
--- /dev/null
+From 6915e04f8847bea16d0890f559694ad8eedd026c Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Tue, 26 Oct 2010 14:21:16 -0700
+Subject: um: remove PAGE_SIZE alignment in linker script causing kernel segfault.
+
+From: Richard Weinberger <richard@nod.at>
+
+commit 6915e04f8847bea16d0890f559694ad8eedd026c upstream.
+
+The linker script cleanup that I did in commit 5d150a97f93 ("um: Clean up
+linker script using standard macros.") (2.6.32) accidentally introduced an
+ALIGN(PAGE_SIZE) when converting to use INIT_TEXT_SECTION; Richard
+Weinberger reported that this causes the kernel to segfault with
+CONFIG_STATIC_LINK=y.
+
+I'm not certain why this extra alignment is a problem, but it seems likely
+it is because previously
+
+__init_begin = _stext = _text = _sinittext
+
+and with the extra ALIGN(PAGE_SIZE), _sinittext becomes different from the
+rest. So there is likely a bug here where something is assuming that
+_sinittext is the same as one of those other symbols. But reverting the
+accidental change fixes the regression, so it seems worth committing that
+now.
+
+Signed-off-by: Tim Abbott <tabbott@ksplice.com>
+Reported-by: Richard Weinberger <richard@nod.at>
+Cc: Jeff Dike <jdike@addtoit.com>
+Tested by: Antoine Martin <antoine@nagafix.co.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/um/kernel/uml.lds.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/um/kernel/uml.lds.S
++++ b/arch/um/kernel/uml.lds.S
+@@ -22,7 +22,7 @@ SECTIONS
+ _text = .;
+ _stext = .;
+ __init_begin = .;
+- INIT_TEXT_SECTION(PAGE_SIZE)
++ INIT_TEXT_SECTION(0)
+ . = ALIGN(PAGE_SIZE);
+
+ .text :
--- /dev/null
+From efd4f6398dc92b5bf392670df862f42a19f34cf2 Mon Sep 17 00:00:00 2001
+From: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
+Date: Wed, 22 Sep 2010 02:33:52 +0000
+Subject: viafb: use proper register for colour when doing fill ops
+
+From: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
+
+commit efd4f6398dc92b5bf392670df862f42a19f34cf2 upstream.
+
+The colour was written to a wrong register for fillrect operations.
+This sometimes caused empty console space (for example after 'clear')
+to have a different colour than desired. Fix this by writing to the
+correct register.
+Many thanks to Daniel Drake and Jon Nettleton for pointing out this
+issue and pointing me in the right direction for the fix.
+
+Fixes http://dev.laptop.org/ticket/9323
+
+Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
+Cc: Joseph Chan <JosephChan@via.com.tw>
+Cc: Daniel Drake <dsd@laptop.org>
+Cc: Jon Nettleton <jon.nettleton@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/via/accel.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/video/via/accel.c
++++ b/drivers/video/via/accel.c
+@@ -283,11 +283,12 @@ static int hw_bitblt_2(void __iomem *eng
+ writel(tmp, engine + 0x1C);
+ }
+
+- if (op != VIA_BITBLT_COLOR)
++ if (op == VIA_BITBLT_FILL) {
++ writel(fg_color, engine + 0x58);
++ } else if (op == VIA_BITBLT_MONO) {
+ writel(fg_color, engine + 0x4C);
+-
+- if (op == VIA_BITBLT_MONO)
+ writel(bg_color, engine + 0x50);
++ }
+
+ if (op == VIA_BITBLT_FILL)
+ ge_cmd |= fill_rop << 24 | 0x00002000 | 0x00000001;
--- /dev/null
+From e476a5a41ad67d0e2b4a652820c49a3923eb936b Mon Sep 17 00:00:00 2001
+From: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+Date: Tue, 23 Nov 2010 17:10:24 +0100
+Subject: wireless: b43: fix error path in SDIO
+
+From: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+
+commit e476a5a41ad67d0e2b4a652820c49a3923eb936b upstream.
+
+Fix unbalanced call to sdio_release_host() on the error path.
+
+Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/b43/sdio.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/b43/sdio.c
++++ b/drivers/net/wireless/b43/sdio.c
+@@ -163,6 +163,7 @@ static int b43_sdio_probe(struct sdio_fu
+ err_free_ssb:
+ kfree(sdio);
+ err_disable_func:
++ sdio_claim_host(func);
+ sdio_disable_func(func);
+ err_release_host:
+ sdio_release_host(func);
--- /dev/null
+From 31e323cca9d5c8afd372976c35a5d46192f540d1 Mon Sep 17 00:00:00 2001
+From: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Date: Mon, 29 Nov 2010 14:16:53 -0800
+Subject: xen: don't bother to stop other cpus on shutdown/reboot
+
+From: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+
+commit 31e323cca9d5c8afd372976c35a5d46192f540d1 upstream.
+
+Xen will shoot all the VCPUs when we do a shutdown hypercall, so there's
+no need to do it manually.
+
+In any case it will fail because all the IPI irqs have been pulled
+down by this point, so the cross-CPU calls will simply hang forever.
+
+Until change 76fac077db6b34e2c6383a7b4f3f4f7b7d06d8ce the function calls
+were not synchronously waited for, so this wasn't apparent. However after
+that change the calls became synchronous leading to a hang on shutdown
+on multi-VCPU guests.
+
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Cc: Alok Kataria <akataria@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/xen/enlighten.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -1017,10 +1017,6 @@ static void xen_reboot(int reason)
+ {
+ struct sched_shutdown r = { .reason = reason };
+
+-#ifdef CONFIG_SMP
+- stop_other_cpus();
+-#endif
+-
+ if (HYPERVISOR_sched_op(SCHEDOP_shutdown, &r))
+ BUG();
+ }
--- /dev/null
+From b0097adeec27e30223c989561ab0f7aa60d1fe93 Mon Sep 17 00:00:00 2001
+From: Ian Campbell <ian.campbell@citrix.com>
+Date: Fri, 8 Oct 2010 16:59:12 +0100
+Subject: xen: ensure that all event channels start off bound to VCPU 0
+
+From: Ian Campbell <ian.campbell@citrix.com>
+
+commit b0097adeec27e30223c989561ab0f7aa60d1fe93 upstream.
+
+All event channels startbound to VCPU 0 so ensure that cpu_evtchn_mask
+is initialised to reflect this. Otherwise there is a race after registering an
+event channel but before the affinity is explicitly set where the event channel
+can be delivered. If this happens then the event channel remains pending in the
+L1 (evtchn_pending) array but is cleared in L2 (evtchn_pending_sel), this means
+the event channel cannot be reraised until another event channel happens to
+trigger the same L2 entry on that VCPU.
+
+sizeof(cpu_evtchn_mask(0))==sizeof(unsigned long*) which is not correct, and
+causes only the first 32 or 64 event channels (depending on architecture) to be
+initially bound to VCPU0. Use sizeof(struct cpu_evtchn_s) instead.
+
+Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
+Cc: Jeremy Fitzhardinge <jeremy@goop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/xen/events.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/xen/events.c
++++ b/drivers/xen/events.c
+@@ -261,7 +261,7 @@ static void init_evtchn_cpu_bindings(voi
+ }
+ #endif
+
+- memset(cpu_evtchn_mask(0), ~0, sizeof(cpu_evtchn_mask(0)));
++ memset(cpu_evtchn_mask(0), ~0, sizeof(struct cpu_evtchn_s));
+ }
+
+ static inline void clear_evtchn(int port)
projects / thirdparty / kernel / stable-queue.git / commitdiff
