--- /dev/null
+From 14d34f166c57e77e3d7f9bc8b43d349186d922c1 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 21 Oct 2010 09:03:25 +0200
+Subject: ALSA: hda - Add some workarounds for Creative IBG
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 14d34f166c57e77e3d7f9bc8b43d349186d922c1 upstream.
+
+Creative HD-audio controller chips require some workarounds:
+ - Additional delay before RIRB response
+ - Set the initial RIRB counter to 0xc0
+
+The latter seems to be done in general in Windows driver, so we may
+use this value later for all types if it's confirmed to work better.
+
+Reported-by: Wai Yew CHAY <wychay@ctl.creative.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/hda_intel.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -458,6 +458,7 @@ enum {
+ AZX_DRIVER_ULI,
+ AZX_DRIVER_NVIDIA,
+ AZX_DRIVER_TERA,
++ AZX_DRIVER_CTX,
+ AZX_DRIVER_GENERIC,
+ AZX_NUM_DRIVERS, /* keep this as last entry */
+ };
+@@ -473,6 +474,7 @@ static char *driver_short_names[] __devi
+ [AZX_DRIVER_ULI] = "HDA ULI M5461",
+ [AZX_DRIVER_NVIDIA] = "HDA NVidia",
+ [AZX_DRIVER_TERA] = "HDA Teradici",
++ [AZX_DRIVER_CTX] = "HDA Creative",
+ [AZX_DRIVER_GENERIC] = "HD-Audio Generic",
+ };
+
+@@ -563,7 +565,10 @@ static void azx_init_cmd_io(struct azx *
+ /* reset the rirb hw write pointer */
+ azx_writew(chip, RIRBWP, ICH6_RIRBWP_RST);
+ /* set N=1, get RIRB response interrupt for new entry */
+- azx_writew(chip, RINTCNT, 1);
++ if (chip->driver_type == AZX_DRIVER_CTX)
++ azx_writew(chip, RINTCNT, 0xc0);
++ else
++ azx_writew(chip, RINTCNT, 1);
+ /* enable rirb dma and response irq */
+ azx_writeb(chip, RIRBCTL, ICH6_RBCTL_DMA_EN | ICH6_RBCTL_IRQ_EN);
+ spin_unlock_irq(&chip->reg_lock);
+@@ -1136,8 +1141,11 @@ static irqreturn_t azx_interrupt(int irq
+ /* clear rirb int */
+ status = azx_readb(chip, RIRBSTS);
+ if (status & RIRB_INT_MASK) {
+- if (status & RIRB_INT_RESPONSE)
++ if (status & RIRB_INT_RESPONSE) {
++ if (chip->driver_type == AZX_DRIVER_CTX)
++ udelay(80);
+ azx_update_rirb(chip);
++ }
+ azx_writeb(chip, RIRBSTS, RIRB_INT_MASK);
+ }
+
+@@ -2799,10 +2807,10 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids)
+ { PCI_DEVICE(PCI_VENDOR_ID_CREATIVE, PCI_ANY_ID),
+ .class = PCI_CLASS_MULTIMEDIA_HD_AUDIO << 8,
+ .class_mask = 0xffffff,
+- .driver_data = AZX_DRIVER_GENERIC },
++ .driver_data = AZX_DRIVER_CTX },
+ #else
+ /* this entry seems still valid -- i.e. without emu20kx chip */
+- { PCI_DEVICE(0x1102, 0x0009), .driver_data = AZX_DRIVER_GENERIC },
++ { PCI_DEVICE(0x1102, 0x0009), .driver_data = AZX_DRIVER_CTX },
+ #endif
+ /* AMD/ATI Generic, PCI class code and Vendor ID for HD Audio */
+ { PCI_DEVICE(PCI_VENDOR_ID_ATI, PCI_ANY_ID),
--- /dev/null
+From 62b7e5e09bcb854ff05e6ee1aa161f8283dc36ee Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 22 Oct 2010 17:15:47 +0200
+Subject: ALSA: hda - Add workarounds for CT-IBG controllers
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 62b7e5e09bcb854ff05e6ee1aa161f8283dc36ee upstream.
+
+Creative IBG controllers require the playback stream-tags to be started
+from 1, instead of capture+1. Otherwise the stream stalls.
+
+Reported-by: Wai Yew CHAY <wychay@ctl.creative.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/hda_codec.c | 5 ++++-
+ sound/pci/hda/hda_intel.c | 9 +++++++--
+ 2 files changed, 11 insertions(+), 3 deletions(-)
+
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -1216,6 +1216,7 @@ void snd_hda_codec_setup_stream(struct h
+ struct hda_codec *c;
+ struct hda_cvt_setup *p;
+ unsigned int oldval, newval;
++ int type;
+ int i;
+
+ if (!nid)
+@@ -1254,10 +1255,12 @@ void snd_hda_codec_setup_stream(struct h
+ p->dirty = 0;
+
+ /* make other inactive cvts with the same stream-tag dirty */
++ type = get_wcaps_type(get_wcaps(codec, nid));
+ list_for_each_entry(c, &codec->bus->codec_list, list) {
+ for (i = 0; i < c->cvt_setups.used; i++) {
+ p = snd_array_elem(&c->cvt_setups, i);
+- if (!p->active && p->stream_tag == stream_tag)
++ if (!p->active && p->stream_tag == stream_tag &&
++ get_wcaps_type(get_wcaps(codec, p->nid)) == type)
+ p->dirty = 1;
+ }
+ }
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -1647,7 +1647,7 @@ static int azx_pcm_prepare(struct snd_pc
+ struct azx_dev *azx_dev = get_azx_dev(substream);
+ struct hda_pcm_stream *hinfo = apcm->hinfo[substream->stream];
+ struct snd_pcm_runtime *runtime = substream->runtime;
+- unsigned int bufsize, period_bytes, format_val;
++ unsigned int bufsize, period_bytes, format_val, stream_tag;
+ int err;
+
+ azx_stream_reset(chip, azx_dev);
+@@ -1689,7 +1689,12 @@ static int azx_pcm_prepare(struct snd_pc
+ else
+ azx_dev->fifo_size = 0;
+
+- return snd_hda_codec_prepare(apcm->codec, hinfo, azx_dev->stream_tag,
++ stream_tag = azx_dev->stream_tag;
++ /* CA-IBG chips need the playback stream starting from 1 */
++ if (chip->driver_type == AZX_DRIVER_CTX &&
++ stream_tag > chip->capture_streams)
++ stream_tag -= chip->capture_streams;
++ return snd_hda_codec_prepare(apcm->codec, hinfo, stream_tag,
+ azx_dev->format_val, substream);
+ }
+
--- /dev/null
+From 0e7adbe263f89ea2ef15b5af5e80a812b2a85025 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 25 Oct 2010 10:37:11 +0200
+Subject: ALSA: hda - Disable sticky PCM stream assignment for AD codecs
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 0e7adbe263f89ea2ef15b5af5e80a812b2a85025 upstream.
+
+The sticky PCM stream assignment introduced in 2.6.36 kernel seems
+causing problems on AD codecs. At some time later, the streaming no
+longer works by unknown reason. A simple workaround is to disable
+sticky-assignment for these codecs.
+
+Tested-by: Vasily Khoruzhick <anarsoul@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/hda_codec.c | 3 +++
+ sound/pci/hda/hda_codec.h | 1 +
+ sound/pci/hda/patch_analog.c | 7 +++++++
+ 3 files changed, 11 insertions(+)
+
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -1281,6 +1281,9 @@ void __snd_hda_codec_cleanup_stream(stru
+ if (!nid)
+ return;
+
++ if (codec->no_sticky_stream)
++ do_now = 1;
++
+ snd_printdd("hda_codec_cleanup_stream: NID=0x%x\n", nid);
+ p = get_hda_cvt_setup(codec, nid);
+ if (p) {
+--- a/sound/pci/hda/hda_codec.h
++++ b/sound/pci/hda/hda_codec.h
+@@ -850,6 +850,7 @@ struct hda_codec {
+ unsigned int pin_amp_workaround:1; /* pin out-amp takes index
+ * (e.g. Conexant codecs)
+ */
++ unsigned int no_sticky_stream:1; /* no sticky-PCM stream assignment */
+ unsigned int pins_shutup:1; /* pins are shut up */
+ unsigned int no_trigger_sense:1; /* don't trigger at pin-sensing */
+ #ifdef CONFIG_SND_HDA_POWER_SAVE
+--- a/sound/pci/hda/patch_analog.c
++++ b/sound/pci/hda/patch_analog.c
+@@ -1276,6 +1276,7 @@ static int patch_ad1986a(struct hda_code
+ spec->multiout.no_share_stream = 1;
+
+ codec->no_trigger_sense = 1;
++ codec->no_sticky_stream = 1;
+
+ return 0;
+ }
+@@ -1463,6 +1464,7 @@ static int patch_ad1983(struct hda_codec
+ codec->patch_ops = ad198x_patch_ops;
+
+ codec->no_trigger_sense = 1;
++ codec->no_sticky_stream = 1;
+
+ return 0;
+ }
+@@ -1917,6 +1919,7 @@ static int patch_ad1981(struct hda_codec
+ }
+
+ codec->no_trigger_sense = 1;
++ codec->no_sticky_stream = 1;
+
+ return 0;
+ }
+@@ -3235,6 +3238,7 @@ static int patch_ad1988(struct hda_codec
+ spec->vmaster_nid = 0x04;
+
+ codec->no_trigger_sense = 1;
++ codec->no_sticky_stream = 1;
+
+ return 0;
+ }
+@@ -3449,6 +3453,7 @@ static int patch_ad1884(struct hda_codec
+ codec->patch_ops = ad198x_patch_ops;
+
+ codec->no_trigger_sense = 1;
++ codec->no_sticky_stream = 1;
+
+ return 0;
+ }
+@@ -4422,6 +4427,7 @@ static int patch_ad1884a(struct hda_code
+ }
+
+ codec->no_trigger_sense = 1;
++ codec->no_sticky_stream = 1;
+
+ return 0;
+ }
+@@ -4761,6 +4767,7 @@ static int patch_ad1882(struct hda_codec
+ }
+
+ codec->no_trigger_sense = 1;
++ codec->no_sticky_stream = 1;
+
+ return 0;
+ }
--- /dev/null
+From flameeyes@gmail.com Mon Nov 22 16:18:17 2010
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Mon, 25 Oct 2010 23:52:04 +0200
+Subject: ALSA: HDA: Enable internal mic on Dell E6410 and Dell E6510
+To: stable@kernel.org
+Cc: Takashi Iwai <tiwai@suse.de>, David Henningsson <david.henningsson@canonical.com>
+Message-ID: <1288043524-31436-2-git-send-email-flameeyes@gmail.com>
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+[Not upstream as .37 fixes this differently in a much more complete way
+that is not able to be backported easily.]
+
+(Ported on top of 2.6.36)
+
+BugLink: http://launchpad.net/bugs/628961
+BugLink: http://launchpad.net/bugs/605047
+
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Diego Elio Pettenò <flameeyes@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -93,6 +93,7 @@ enum {
+ STAC_92HD83XXX_REF,
+ STAC_92HD83XXX_PWR_REF,
+ STAC_DELL_S14,
++ STAC_DELL_E6410,
+ STAC_92HD83XXX_HP,
+ STAC_HP_DV7_4000,
+ STAC_92HD83XXX_MODELS
+@@ -1633,6 +1634,13 @@ static unsigned int dell_s14_pin_configs
+ 0x40f000f0, 0x40f000f0,
+ };
+
++/* Deliberately turn off 0x0f (Dock Mic) to make it choose Int Mic instead */
++static unsigned int dell_e6410_pin_configs[10] = {
++ 0x04a11020, 0x0421101f, 0x400000f0, 0x90170110,
++ 0x23011050, 0x40f000f0, 0x400000f0, 0x90a60130,
++ 0x40f000f0, 0x40f000f0,
++};
++
+ static unsigned int hp_dv7_4000_pin_configs[10] = {
+ 0x03a12050, 0x0321201f, 0x40f000f0, 0x90170110,
+ 0x40f000f0, 0x40f000f0, 0x90170110, 0xd5a30140,
+@@ -1643,6 +1651,7 @@ static unsigned int *stac92hd83xxx_brd_t
+ [STAC_92HD83XXX_REF] = ref92hd83xxx_pin_configs,
+ [STAC_92HD83XXX_PWR_REF] = ref92hd83xxx_pin_configs,
+ [STAC_DELL_S14] = dell_s14_pin_configs,
++ [STAC_DELL_E6410] = dell_e6410_pin_configs,
+ [STAC_HP_DV7_4000] = hp_dv7_4000_pin_configs,
+ };
+
+@@ -1651,6 +1660,7 @@ static const char *stac92hd83xxx_models[
+ [STAC_92HD83XXX_REF] = "ref",
+ [STAC_92HD83XXX_PWR_REF] = "mic-ref",
+ [STAC_DELL_S14] = "dell-s14",
++ [STAC_DELL_E6410] = "dell-e6410",
+ [STAC_92HD83XXX_HP] = "hp",
+ [STAC_HP_DV7_4000] = "hp-dv7-4000",
+ };
+@@ -1663,6 +1673,10 @@ static struct snd_pci_quirk stac92hd83xx
+ "DFI LanParty", STAC_92HD83XXX_REF),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02ba,
+ "unknown Dell", STAC_DELL_S14),
++ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x040a,
++ "Dell E6410", STAC_DELL_E6410),
++ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x040b,
++ "Dell E6510", STAC_DELL_E6410),
+ SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_HP, 0xff00, 0x3600,
+ "HP", STAC_92HD83XXX_HP),
+ {} /* terminator */
--- /dev/null
+From 24b55c69b66eb2a122842820ec14ab215fc8572f Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 21 Oct 2010 08:55:13 +0200
+Subject: ALSA: hda - Fix wrong SPDIF NID assignment for CA0110
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 24b55c69b66eb2a122842820ec14ab215fc8572f upstream.
+
+The dig_out_nid field must take a digital-converter widget, but the current
+ca0110 parser passed the pin wrongly instead.
+
+Reported-by: Wai Yew CHAY <wychay@ctl.creative.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_ca0110.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_ca0110.c
++++ b/sound/pci/hda/patch_ca0110.c
+@@ -489,7 +489,7 @@ static void parse_digital(struct hda_cod
+ if (cfg->dig_outs &&
+ snd_hda_get_connections(codec, cfg->dig_out_pins[0],
+ &spec->dig_out, 1) == 1)
+- spec->multiout.dig_out_nid = cfg->dig_out_pins[0];
++ spec->multiout.dig_out_nid = spec->dig_out;
+ }
+
+ static int ca0110_parse_auto_config(struct hda_codec *codec)
--- /dev/null
+From 838c364ff05c143fd1810e8ad1469935d6c23a7a Mon Sep 17 00:00:00 2001
+From: Jaroslav Kysela <perex@perex.cz>
+Date: Fri, 8 Oct 2010 10:48:50 +0200
+Subject: ALSA: OSS mixer emulation - fix locking
+
+From: Jaroslav Kysela <perex@perex.cz>
+
+commit 838c364ff05c143fd1810e8ad1469935d6c23a7a upstream.
+
+Fix mutex release and cleanup some locking code.
+
+Signed-off-by: Jaroslav Kysela <perex@perex.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/oss/mixer_oss.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/sound/core/oss/mixer_oss.c
++++ b/sound/core/oss/mixer_oss.c
+@@ -618,8 +618,10 @@ static void snd_mixer_oss_put_volume1_vo
+ if (numid == ID_UNKNOWN)
+ return;
+ down_read(&card->controls_rwsem);
+- if ((kctl = snd_ctl_find_numid(card, numid)) == NULL)
++ if ((kctl = snd_ctl_find_numid(card, numid)) == NULL) {
++ up_read(&card->controls_rwsem);
+ return;
++ }
+ uinfo = kzalloc(sizeof(*uinfo), GFP_KERNEL);
+ uctl = kzalloc(sizeof(*uctl), GFP_KERNEL);
+ if (uinfo == NULL || uctl == NULL)
+@@ -658,7 +660,7 @@ static void snd_mixer_oss_put_volume1_sw
+ return;
+ down_read(&card->controls_rwsem);
+ if ((kctl = snd_ctl_find_numid(card, numid)) == NULL) {
+- up_read(&fmixer->card->controls_rwsem);
++ up_read(&card->controls_rwsem);
+ return;
+ }
+ uinfo = kzalloc(sizeof(*uinfo), GFP_KERNEL);
+@@ -797,7 +799,7 @@ static int snd_mixer_oss_get_recsrc2(str
+ uctl = kzalloc(sizeof(*uctl), GFP_KERNEL);
+ if (uinfo == NULL || uctl == NULL) {
+ err = -ENOMEM;
+- goto __unlock;
++ goto __free_only;
+ }
+ down_read(&card->controls_rwsem);
+ kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0);
+@@ -826,6 +828,7 @@ static int snd_mixer_oss_get_recsrc2(str
+ err = 0;
+ __unlock:
+ up_read(&card->controls_rwsem);
++ __free_only:
+ kfree(uctl);
+ kfree(uinfo);
+ return err;
+@@ -847,7 +850,7 @@ static int snd_mixer_oss_put_recsrc2(str
+ uctl = kzalloc(sizeof(*uctl), GFP_KERNEL);
+ if (uinfo == NULL || uctl == NULL) {
+ err = -ENOMEM;
+- goto __unlock;
++ goto __free_only;
+ }
+ down_read(&card->controls_rwsem);
+ kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0);
+@@ -880,6 +883,7 @@ static int snd_mixer_oss_put_recsrc2(str
+ err = 0;
+ __unlock:
+ up_read(&card->controls_rwsem);
++ __free_only:
+ kfree(uctl);
+ kfree(uinfo);
+ return err;
--- /dev/null
+From b843e4ec01991a386a9e0e9030703524446e03da Mon Sep 17 00:00:00 2001
+From: Thomas Backlund <tmb@mandriva.org>
+Date: Thu, 21 Oct 2010 13:19:10 +0300
+Subject: microblaze: Fix build with make 3.82
+
+From: Thomas Backlund <tmb@mandriva.org>
+
+commit b843e4ec01991a386a9e0e9030703524446e03da upstream.
+
+When running make headers_install_all on x86_64 and make 3.82 I hit this:
+
+arch/microblaze/Makefile:80: *** mixed implicit and normal rules. Stop.
+make: *** [headers_install_all] Error 2
+
+So split the rules to satisfy make 3.82.
+
+Signed-off-by: Thomas Backlund <tmb@mandriva.org>
+Signed-off-by: Michal Simek <monstr@monstr.eu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/microblaze/Makefile | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/arch/microblaze/Makefile
++++ b/arch/microblaze/Makefile
+@@ -72,12 +72,16 @@ export MMU DTB
+
+ all: linux.bin
+
+-BOOT_TARGETS = linux.bin linux.bin.gz simpleImage.%
++# With make 3.82 we cannot mix normal and wildcard targets
++BOOT_TARGETS1 = linux.bin linux.bin.gz
++BOOT_TARGETS2 = simpleImage.%
+
+ archclean:
+ $(Q)$(MAKE) $(clean)=$(boot)
+
+-$(BOOT_TARGETS): vmlinux
++$(BOOT_TARGETS1): vmlinux
++ $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
++$(BOOT_TARGETS2): vmlinux
+ $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
+
+ define archhelp
--- /dev/null
+From 1c2c25c78740b2796c7c06640784cb6732fa4907 Mon Sep 17 00:00:00 2001
+From: Michael Neuling <mikey@neuling.org>
+Date: Wed, 17 Nov 2010 16:32:59 +0000
+Subject: powerpc: Fix call to subpage_protection()
+
+From: Michael Neuling <mikey@neuling.org>
+
+commit 1c2c25c78740b2796c7c06640784cb6732fa4907 upstream.
+
+In:
+ powerpc/mm: Fix pgtable cache cleanup with CONFIG_PPC_SUBPAGE_PROT
+ commit d28513bc7f675d28b479db666d572e078ecf182d
+ Author: David Gibson <david@gibson.dropbear.id.au>
+
+subpage_protection() was changed to to take an mm rather a pgdir but it
+didn't change calling site in hashpage_preload(). The change wasn't
+noticed at compile time since hashpage_preload() used a void* as the
+parameter to subpage_protection().
+
+This is obviously wrong and can trigger the following crash when
+CONFIG_SLAB, CONFIG_DEBUG_SLAB, CONFIG_PPC_64K_PAGES
+CONFIG_PPC_SUBPAGE_PROT are enabled.
+
+Freeing unused kernel memory: 704k freed
+Unable to handle kernel paging request for data at address 0x6b6b6b6b6b6c49b7
+Faulting instruction address: 0xc0000000000410f4
+cpu 0x2: Vector: 300 (Data Access) at [c00000004233f590]
+ pc: c0000000000410f4: .hash_preload+0x258/0x338
+ lr: c000000000041054: .hash_preload+0x1b8/0x338
+ sp: c00000004233f810
+ msr: 8000000000009032
+ dar: 6b6b6b6b6b6c49b7
+ dsisr: 40000000
+ current = 0xc00000007e2c0070
+ paca = 0xc000000007fe0500
+ pid = 1, comm = init
+enter ? for help
+[c00000004233f810] c000000000041020 .hash_preload+0x184/0x338 (unreliable)
+[c00000004233f8f0] c00000000003ed98 .update_mmu_cache+0xb0/0xd0
+[c00000004233f990] c000000000157754 .__do_fault+0x48c/0x5dc
+[c00000004233faa0] c000000000158fd0 .handle_mm_fault+0x508/0xa8c
+[c00000004233fb90] c0000000006acdd4 .do_page_fault+0x428/0x6ac
+[c00000004233fe30] c000000000005260 handle_page_fault+0x20/0x74
+
+Reported-by: Jim Keniston <jkenisto@linux.vnet.ibm.com>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Michael Neuling <mikey@neuling.org>
+cc: David Gibson <david@gibson.dropbear.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
+index 83f534d..5e95844 100644
+--- a/arch/powerpc/mm/hash_utils_64.c
++++ b/arch/powerpc/mm/hash_utils_64.c
+@@ -1123,7 +1123,7 @@ void hash_preload(struct mm_struct *mm, unsigned long ea,
+ else
+ #endif /* CONFIG_PPC_HAS_HASH_64K */
+ rc = __hash_page_4K(ea, access, vsid, ptep, trap, local, ssize,
+- subpage_protection(pgdir, ea));
++ subpage_protection(mm, ea));
+
+ /* Dump some info in case of hash insertion failure, they should
+ * never happen so it is really useful to know if/when they do
i2c-pca-platform-change-device-name-of-request_irq.patch
viafb-fix-i2c_transfer-error-handling.patch
drm-radeon-kms-register-an-i2c-adapter-name-for-the-dp-aux-bus.patch
+alsa-hda-disable-sticky-pcm-stream-assignment-for-ad-codecs.patch
+alsa-hda-add-workarounds-for-ct-ibg-controllers.patch
+alsa-hda-fix-wrong-spdif-nid-assignment-for-ca0110.patch
+alsa-hda-add-some-workarounds-for-creative-ibg.patch
+alsa-oss-mixer-emulation-fix-locking.patch
+alsa-hda-enable-internal-mic-on-dell-e6410-and-dell-e6510.patch
+powerpc-fix-call-to-subpage_protection.patch
+sunrpc-after-calling-xprt_release-we-must-restart-from-call_reserve.patch
+microblaze-fix-build-with-make-3.82.patch
--- /dev/null
+From 118df3d17f11733b294ea2cd988d56ee376ef9fd Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Sun, 24 Oct 2010 17:17:31 -0400
+Subject: SUNRPC: After calling xprt_release(), we must restart from call_reserve
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit 118df3d17f11733b294ea2cd988d56ee376ef9fd upstream.
+
+Rob Leslie reports seeing the following Oops after his Kerberos session
+expired.
+
+BUG: unable to handle kernel NULL pointer dereference at 00000058
+IP: [<e186ed94>] rpcauth_refreshcred+0x11/0x12c [sunrpc]
+*pde = 00000000
+Oops: 0000 [#1]
+last sysfs file: /sys/devices/platform/pc87360.26144/temp3_input
+Modules linked in: autofs4 authenc esp4 xfrm4_mode_transport ipt_LOG ipt_REJECT xt_limit xt_state ipt_REDIRECT xt_owner xt_HL xt_hl xt_tcpudp xt_mark cls_u32 cls_tcindex sch_sfq sch_htb sch_dsmark geodewdt deflate ctr twofish_generic twofish_i586 twofish_common camellia serpent blowfish cast5 cbc xcbc rmd160 sha512_generic sha1_generic hmac crypto_null af_key rpcsec_gss_krb5 nfsd exportfs nfs lockd fscache nfs_acl auth_rpcgss sunrpc ip_gre sit tunnel4 dummy ext3 jbd nf_nat_irc nf_conntrack_irc nf_nat_ftp nf_conntrack_ftp iptable_mangle iptable_nat nf_nat nf_conntrack_ipv4 nf_conntrack nf_defrag_ipv4 iptable_filter ip_tables x_tables pc8736x_gpio nsc_gpio pc87360 hwmon_vid loop aes_i586 aes_generic sha256_generic dm_crypt cs5535_gpio serio_raw cs5535_mfgpt hifn_795x des_generic geode_rng rng_core led_class ext4 mbcache jbd2 crc16 dm_mirror dm_region_hash dm_log dm_snapshot dm_mod sd_mod crc_t10dif ide_pci_generic cs5536 amd74xx ide_core pata_cs5536 ata_generic libata usb_storage via_rhine mii scsi_mod btrfs zlib_deflate crc32c libcrc32c [last unloaded: scsi_wait_scan]
+
+Pid: 12875, comm: sudo Not tainted 2.6.36-net5501 #1 /
+EIP: 0060:[<e186ed94>] EFLAGS: 00010292 CPU: 0
+EIP is at rpcauth_refreshcred+0x11/0x12c [sunrpc]
+EAX: 00000000 EBX: defb13a0 ECX: 00000006 EDX: e18683b8
+ESI: defb13a0 EDI: 00000000 EBP: 00000000 ESP: de571d58
+ DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
+Process sudo (pid: 12875, ti=de570000 task=decd1430 task.ti=de570000)
+Stack:
+ e186e008 00000000 defb13a0 0000000d deda6000 e1868f22 e196f12b defb13a0
+<0> defb13d8 00000000 00000000 e186e0aa 00000000 defb13a0 de571dac 00000000
+<0> e186956c de571e34 debea5c0 de571dc8 e186967a 00000000 debea5c0 de571e34
+Call Trace:
+ [<e186e008>] ? rpc_wake_up_next+0x114/0x11b [sunrpc]
+ [<e1868f22>] ? call_decode+0x24a/0x5af [sunrpc]
+ [<e196f12b>] ? nfs4_xdr_dec_access+0x0/0xa2 [nfs]
+ [<e186e0aa>] ? __rpc_execute+0x62/0x17b [sunrpc]
+ [<e186956c>] ? rpc_run_task+0x91/0x97 [sunrpc]
+ [<e186967a>] ? rpc_call_sync+0x40/0x5b [sunrpc]
+ [<e1969ca2>] ? nfs4_proc_access+0x10a/0x176 [nfs]
+ [<e19572fa>] ? nfs_do_access+0x2b1/0x2c0 [nfs]
+ [<e186ed61>] ? rpcauth_lookupcred+0x62/0x84 [sunrpc]
+ [<e19573b6>] ? nfs_permission+0xad/0x13b [nfs]
+ [<c0177824>] ? exec_permission+0x15/0x4b
+ [<c0177fbd>] ? link_path_walk+0x4f/0x456
+ [<c017867d>] ? path_walk+0x4c/0xa8
+ [<c0179678>] ? do_path_lookup+0x1f/0x68
+ [<c017a3fb>] ? user_path_at+0x37/0x5f
+ [<c016359c>] ? handle_mm_fault+0x229/0x55b
+ [<c0170a2d>] ? sys_faccessat+0x93/0x146
+ [<c0170aef>] ? sys_access+0xf/0x13
+ [<c02cf615>] ? syscall_call+0x7/0xb
+Code: 0f 94 c2 84 d2 74 09 8b 44 24 0c e8 6a e9 8b de 83 c4 14 89 d8 5b 5e 5f 5d c3 55 57 56 53 83 ec 1c fc 89 c6 8b 40 10 89 44 24 04 <8b> 58 58 85 db 0f 85 d4 00 00 00 0f b7 46 70 8b 56 20 89 c5 83
+EIP: [<e186ed94>] rpcauth_refreshcred+0x11/0x12c [sunrpc] SS:ESP 0068:de571d58
+CR2: 0000000000000058
+
+This appears to be caused by the function rpc_verify_header() first
+calling xprt_release(), then doing a call_refresh. If we release the
+transport slot, we should _always_ jump back to call_reserve before
+calling anything else.
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/clnt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -1675,7 +1675,7 @@ rpc_verify_header(struct rpc_task *task)
+ rpcauth_invalcred(task);
+ /* Ensure we obtain a new XID! */
+ xprt_release(task);
+- task->tk_action = call_refresh;
++ task->tk_action = call_reserve;
+ goto out_retry;
+ case RPC_AUTH_BADCRED:
+ case RPC_AUTH_BADVERF:
projects / thirdparty / kernel / stable-queue.git / commitdiff
