--- /dev/null
+From 396087eaead95fcb29eb36f1e59517aeb58c545e Mon Sep 17 00:00:00 2001
+From: Jaroslav Kysela <perex@perex.cz>
+Date: Wed, 9 Dec 2009 10:44:47 +0100
+Subject: ALSA: hda - Terradici HDA controllers does not support 64-bit mode
+
+From: Jaroslav Kysela <perex@perex.cz>
+
+commit 396087eaead95fcb29eb36f1e59517aeb58c545e upstream.
+
+Confirmed from vendor and tests in RedHat bugzilla #536782 .
+
+Signed-off-by: Jaroslav Kysela <perex@perex.cz>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/hda_intel.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2392,6 +2392,11 @@ static int __devinit azx_create(struct s
+ }
+ }
+
++ /* disable 64bit DMA address for Teradici */
++ /* it does not work with device 6549:1200 subsys e4a2:040b */
++ if (chip->driver_type == AZX_DRIVER_TERA)
++ gcap &= ~ICH6_GCAP_64OK;
++
+ /* allow 64bit DMA address if supported by H/W */
+ if ((gcap & ICH6_GCAP_64OK) && !pci_set_dma_mask(pci, DMA_BIT_MASK(64)))
+ pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(64));
--- /dev/null
+From fcfdebe70759c74e2e701f69aaa7f0e5e32cf5a6 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 11 Dec 2009 12:51:05 +0100
+Subject: ALSA: hrtimer - Fix lock-up
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit fcfdebe70759c74e2e701f69aaa7f0e5e32cf5a6 upstream.
+
+The timer stop callback can be called from snd_timer_interrupt(), which
+is called from the hrtimer callback. Since hrtimer_cancel() waits for
+the callback completion, this eventually results in a lock-up.
+
+This patch fixes the problem by just toggling a flag at stop callback
+and call hrtimer_cancel() later.
+
+Reported-and-tested-by: Wojtek Zabolotny <W.Zabolotny@elka.pw.edu.pl>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/hrtimer.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+--- a/sound/core/hrtimer.c
++++ b/sound/core/hrtimer.c
+@@ -37,14 +37,22 @@ static unsigned int resolution;
+ struct snd_hrtimer {
+ struct snd_timer *timer;
+ struct hrtimer hrt;
++ atomic_t running;
+ };
+
+ static enum hrtimer_restart snd_hrtimer_callback(struct hrtimer *hrt)
+ {
+ struct snd_hrtimer *stime = container_of(hrt, struct snd_hrtimer, hrt);
+ struct snd_timer *t = stime->timer;
++
++ if (!atomic_read(&stime->running))
++ return HRTIMER_NORESTART;
++
+ hrtimer_forward_now(hrt, ns_to_ktime(t->sticks * resolution));
+ snd_timer_interrupt(stime->timer, t->sticks);
++
++ if (!atomic_read(&stime->running))
++ return HRTIMER_NORESTART;
+ return HRTIMER_RESTART;
+ }
+
+@@ -58,6 +66,7 @@ static int snd_hrtimer_open(struct snd_t
+ hrtimer_init(&stime->hrt, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+ stime->timer = t;
+ stime->hrt.function = snd_hrtimer_callback;
++ atomic_set(&stime->running, 0);
+ t->private_data = stime;
+ return 0;
+ }
+@@ -78,16 +87,18 @@ static int snd_hrtimer_start(struct snd_
+ {
+ struct snd_hrtimer *stime = t->private_data;
+
++ atomic_set(&stime->running, 0);
++ hrtimer_cancel(&stime->hrt);
+ hrtimer_start(&stime->hrt, ns_to_ktime(t->sticks * resolution),
+ HRTIMER_MODE_REL);
++ atomic_set(&stime->running, 1);
+ return 0;
+ }
+
+ static int snd_hrtimer_stop(struct snd_timer *t)
+ {
+ struct snd_hrtimer *stime = t->private_data;
+-
+- hrtimer_cancel(&stime->hrt);
++ atomic_set(&stime->running, 0);
+ return 0;
+ }
+
--- /dev/null
+From 2eb2fa67e5462a36e98172fb92c78bc405b3035f Mon Sep 17 00:00:00 2001
+From: Bob Copeland <me@bobcopeland.com>
+Date: Mon, 16 Nov 2009 08:30:29 -0500
+Subject: ath5k: allow setting txpower to 0
+
+From: Bob Copeland <me@bobcopeland.com>
+
+commit 2eb2fa67e5462a36e98172fb92c78bc405b3035f upstream.
+
+As a holdover from earlier code when we used to set
+the power limit to '0' after a reset to configure the
+default transmit power, ath5k interprets txpower=0 as
+12.5 dBm. Fix that by just passing 0 through.
+
+This fixes http://bugzilla.kernel.org/show_bug.cgi?id=14567
+
+Reported-by: Daniel Folkers <daniel.folkers@task24.nl>
+Tested-by: Daniel Folkers <daniel.folkers@task24.nl>
+Signed-off-by: Bob Copeland <me@bobcopeland.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath5k/phy.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath5k/phy.c
++++ b/drivers/net/wireless/ath/ath5k/phy.c
+@@ -2931,8 +2931,6 @@ ath5k_hw_txpower(struct ath5k_hw *ah, st
+ ATH5K_ERR(ah->ah_sc, "invalid tx power: %u\n", txpower);
+ return -EINVAL;
+ }
+- if (txpower == 0)
+- txpower = AR5K_TUNE_DEFAULT_TXPOWER;
+
+ /* Reset TX power values */
+ memset(&ah->ah_txpower, 0, sizeof(ah->ah_txpower));
--- /dev/null
+From 512414b0bed0d376ac4d5ec1dd6f0b1a3551febc Mon Sep 17 00:00:00 2001
+From: Luis R. Rodriguez <lrodriguez@atheros.com>
+Date: Wed, 25 Nov 2009 17:23:26 -0500
+Subject: ath5k: enable EEPROM checksum check
+
+From: Luis R. Rodriguez <lrodriguez@atheros.com>
+
+commit 512414b0bed0d376ac4d5ec1dd6f0b1a3551febc upstream.
+
+Without this we have no gaurantee of the integrity of the
+EEPROM and are likely to encounter a lot of bogus bug reports
+due to actual issues on the EEPROM. With the EEPROM checksum
+check in place we can easily rule those issues out.
+
+If you run patch during a revert *you* have a card with a busted
+EEPROM and only older kernel will support that concoction. This
+patch is a trade off between not accepitng bogus EEPROMs and
+avoiding bogus bug reports allowing developers to focus instead
+on real concrete issues.
+
+If stable keeps bogus bug reports because of a possibly busted EEPROM
+feel free to apply this there too.
+
+Tested on an AR5414
+
+Cc: jirislaby@gmail.com
+Cc: akpm@linux-foundation.org
+Cc: rjw@sisk.pl
+Cc: me@bobcopeland.com
+Cc: david.quan@atheros.com
+Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath5k/eeprom.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath5k/eeprom.c
++++ b/drivers/net/wireless/ath/ath5k/eeprom.c
+@@ -97,6 +97,7 @@ ath5k_eeprom_init_header(struct ath5k_hw
+ struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
+ int ret;
+ u16 val;
++ u32 cksum, offset;
+
+ /*
+ * Read values from EEPROM and store them in the capability structure
+@@ -111,7 +112,6 @@ ath5k_eeprom_init_header(struct ath5k_hw
+ if (ah->ah_ee_version < AR5K_EEPROM_VERSION_3_0)
+ return 0;
+
+-#ifdef notyet
+ /*
+ * Validate the checksum of the EEPROM date. There are some
+ * devices with invalid EEPROMs.
+@@ -124,7 +124,6 @@ ath5k_eeprom_init_header(struct ath5k_hw
+ ATH5K_ERR(ah->ah_sc, "Invalid EEPROM checksum 0x%04x\n", cksum);
+ return -EIO;
+ }
+-#endif
+
+ AR5K_EEPROM_READ_HDR(AR5K_EEPROM_ANT_GAIN(ah->ah_ee_version),
+ ee_ant_gain);
--- /dev/null
+From 4b731d50ff3df6b9141a6c12b088e8eb0109e83c Mon Sep 17 00:00:00 2001
+From: Alexey Dobriyan <adobriyan@gmail.com>
+Date: Mon, 14 Dec 2009 17:57:34 -0800
+Subject: bsdacct: fix uid/gid misreporting
+
+From: Alexey Dobriyan <adobriyan@gmail.com>
+
+commit 4b731d50ff3df6b9141a6c12b088e8eb0109e83c upstream.
+
+commit d8e180dcd5bbbab9cd3ff2e779efcf70692ef541 "bsdacct: switch
+credentials for writing to the accounting file" introduced credential
+switching during final acct data collecting. However, uid/gid pair
+continued to be collected from current which became credentials of who
+created acct file, not who exits.
+
+Addresses http://bugzilla.kernel.org/show_bug.cgi?id=14676
+
+Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
+Reported-by: Juho K. Juopperi <jkj@kapsi.fi>
+Acked-by: Serge Hallyn <serue@us.ibm.com>
+Acked-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Michal Schmidt <mschmidt@redhat.com>
+Cc: James Morris <jmorris@namei.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/acct.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/acct.c
++++ b/kernel/acct.c
+@@ -536,7 +536,8 @@ static void do_acct_process(struct bsd_a
+ do_div(elapsed, AHZ);
+ ac.ac_btime = get_seconds() - elapsed;
+ /* we really need to bite the bullet and change layout */
+- current_uid_gid(&ac.ac_uid, &ac.ac_gid);
++ ac.ac_uid = orig_cred->uid;
++ ac.ac_gid = orig_cred->gid;
+ #if ACCT_VERSION==2
+ ac.ac_ahz = AHZ;
+ #endif
--- /dev/null
+From d3a3b0adad0865c12e39b712ca89efbd0a3a0dbc Mon Sep 17 00:00:00 2001
+From: Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca>
+Date: Tue, 17 Nov 2009 14:40:26 -0800
+Subject: debugfs: fix create mutex racy fops and private data
+
+From: Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca>
+
+commit d3a3b0adad0865c12e39b712ca89efbd0a3a0dbc upstream.
+
+Setting fops and private data outside of the mutex at debugfs file
+creation introduces a race where the files can be opened with the wrong
+file operations and private data. It is easy to trigger with a process
+waiting on file creation notification.
+
+Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/debugfs/inode.c | 55 ++++++++++++++++++++++++++++++-----------------------
+ 1 file changed, 32 insertions(+), 23 deletions(-)
+
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -32,7 +32,9 @@ static struct vfsmount *debugfs_mount;
+ static int debugfs_mount_count;
+ static bool debugfs_registered;
+
+-static struct inode *debugfs_get_inode(struct super_block *sb, int mode, dev_t dev)
++static struct inode *debugfs_get_inode(struct super_block *sb, int mode, dev_t dev,
++ void *data, const struct file_operations *fops)
++
+ {
+ struct inode *inode = new_inode(sb);
+
+@@ -44,14 +46,18 @@ static struct inode *debugfs_get_inode(s
+ init_special_inode(inode, mode, dev);
+ break;
+ case S_IFREG:
+- inode->i_fop = &debugfs_file_operations;
++ inode->i_fop = fops ? fops : &debugfs_file_operations;
++ inode->i_private = data;
+ break;
+ case S_IFLNK:
+ inode->i_op = &debugfs_link_operations;
++ inode->i_fop = fops;
++ inode->i_private = data;
+ break;
+ case S_IFDIR:
+ inode->i_op = &simple_dir_inode_operations;
+- inode->i_fop = &simple_dir_operations;
++ inode->i_fop = fops ? fops : &simple_dir_operations;
++ inode->i_private = data;
+
+ /* directory inodes start off with i_nlink == 2
+ * (for "." entry) */
+@@ -64,7 +70,8 @@ static struct inode *debugfs_get_inode(s
+
+ /* SMP-safe */
+ static int debugfs_mknod(struct inode *dir, struct dentry *dentry,
+- int mode, dev_t dev)
++ int mode, dev_t dev, void *data,
++ const struct file_operations *fops)
+ {
+ struct inode *inode;
+ int error = -EPERM;
+@@ -72,7 +79,7 @@ static int debugfs_mknod(struct inode *d
+ if (dentry->d_inode)
+ return -EEXIST;
+
+- inode = debugfs_get_inode(dir->i_sb, mode, dev);
++ inode = debugfs_get_inode(dir->i_sb, mode, dev, data, fops);
+ if (inode) {
+ d_instantiate(dentry, inode);
+ dget(dentry);
+@@ -81,12 +88,13 @@ static int debugfs_mknod(struct inode *d
+ return error;
+ }
+
+-static int debugfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
++static int debugfs_mkdir(struct inode *dir, struct dentry *dentry, int mode,
++ void *data, const struct file_operations *fops)
+ {
+ int res;
+
+ mode = (mode & (S_IRWXUGO | S_ISVTX)) | S_IFDIR;
+- res = debugfs_mknod(dir, dentry, mode, 0);
++ res = debugfs_mknod(dir, dentry, mode, 0, data, fops);
+ if (!res) {
+ inc_nlink(dir);
+ fsnotify_mkdir(dir, dentry);
+@@ -94,18 +102,20 @@ static int debugfs_mkdir(struct inode *d
+ return res;
+ }
+
+-static int debugfs_link(struct inode *dir, struct dentry *dentry, int mode)
++static int debugfs_link(struct inode *dir, struct dentry *dentry, int mode,
++ void *data, const struct file_operations *fops)
+ {
+ mode = (mode & S_IALLUGO) | S_IFLNK;
+- return debugfs_mknod(dir, dentry, mode, 0);
++ return debugfs_mknod(dir, dentry, mode, 0, data, fops);
+ }
+
+-static int debugfs_create(struct inode *dir, struct dentry *dentry, int mode)
++static int debugfs_create(struct inode *dir, struct dentry *dentry, int mode,
++ void *data, const struct file_operations *fops)
+ {
+ int res;
+
+ mode = (mode & S_IALLUGO) | S_IFREG;
+- res = debugfs_mknod(dir, dentry, mode, 0);
++ res = debugfs_mknod(dir, dentry, mode, 0, data, fops);
+ if (!res)
+ fsnotify_create(dir, dentry);
+ return res;
+@@ -139,7 +149,9 @@ static struct file_system_type debug_fs_
+
+ static int debugfs_create_by_name(const char *name, mode_t mode,
+ struct dentry *parent,
+- struct dentry **dentry)
++ struct dentry **dentry,
++ void *data,
++ const struct file_operations *fops)
+ {
+ int error = 0;
+
+@@ -164,13 +176,16 @@ static int debugfs_create_by_name(const
+ if (!IS_ERR(*dentry)) {
+ switch (mode & S_IFMT) {
+ case S_IFDIR:
+- error = debugfs_mkdir(parent->d_inode, *dentry, mode);
++ error = debugfs_mkdir(parent->d_inode, *dentry, mode,
++ data, fops);
+ break;
+ case S_IFLNK:
+- error = debugfs_link(parent->d_inode, *dentry, mode);
++ error = debugfs_link(parent->d_inode, *dentry, mode,
++ data, fops);
+ break;
+ default:
+- error = debugfs_create(parent->d_inode, *dentry, mode);
++ error = debugfs_create(parent->d_inode, *dentry, mode,
++ data, fops);
+ break;
+ }
+ dput(*dentry);
+@@ -221,19 +236,13 @@ struct dentry *debugfs_create_file(const
+ if (error)
+ goto exit;
+
+- error = debugfs_create_by_name(name, mode, parent, &dentry);
++ error = debugfs_create_by_name(name, mode, parent, &dentry,
++ data, fops);
+ if (error) {
+ dentry = NULL;
+ simple_release_fs(&debugfs_mount, &debugfs_mount_count);
+ goto exit;
+ }
+-
+- if (dentry->d_inode) {
+- if (data)
+- dentry->d_inode->i_private = data;
+- if (fops)
+- dentry->d_inode->i_fop = fops;
+- }
+ exit:
+ return dentry;
+ }
--- /dev/null
+From edfacdd6f81119b9005615593f2cbd94b8c7e2d8 Mon Sep 17 00:00:00 2001
+From: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
+Date: Tue, 17 Nov 2009 18:35:43 -0800
+Subject: devpts_get_tty() should validate inode
+
+From: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
+
+commit edfacdd6f81119b9005615593f2cbd94b8c7e2d8 upstream.
+
+devpts_get_tty() assumes that the inode passed in is associated with a valid
+pty. But if the only reference to the pty is via a bind-mount, the inode
+passed to devpts_get_tty() while valid, would refer to a pty that no longer
+exists.
+
+With a lot of debug effort, Grzegorz Nosek developed a small program (see
+below) to reproduce a crash on recent kernels. This crash is a regression
+introduced by the commit:
+
+ commit 527b3e4773628b30d03323a2cb5fb0d84441990f
+ Author: Sukadev Bhattiprolu <sukadev@us.ibm.com>
+ Date: Mon Oct 13 10:43:08 2008 +0100
+
+To fix, ensure that the dentry associated with the inode has not yet been
+deleted/unhashed by devpts_pty_kill().
+
+See also:
+https://lists.linux-foundation.org/pipermail/containers/2009-July/019273.html
+
+tty-bug.c:
+
+#define _GNU_SOURCE
+#include <fcntl.h>
+#include <sched.h>
+#include <stdlib.h>
+#include <sys/mount.h>
+#include <sys/signal.h>
+#include <unistd.h>
+#include <stdio.h>
+
+#include <linux/fs.h>
+
+void dummy(int sig)
+{
+}
+
+static int child(void *unused)
+{
+ int fd;
+
+ signal(SIGINT, dummy); signal(SIGHUP, dummy);
+ pause(); /* cheesy synchronisation to wait for /dev/pts/0 to appear */
+
+ mount("/dev/pts/0", "/dev/console", NULL, MS_BIND, NULL);
+ sleep(2);
+
+ fd = open("/dev/console", O_RDWR);
+ dup(0); dup(0);
+ write(1, "Hello world!\n", sizeof("Hello world!\n")-1);
+ return 0;
+}
+
+int main(void)
+{
+ pid_t pid;
+ char *stack;
+
+ stack = malloc(16384);
+ pid = clone(child, stack+16384, CLONE_NEWNS|SIGCHLD, NULL);
+
+ open("/dev/ptmx", O_RDWR|O_NOCTTY|O_NONBLOCK);
+
+ unlockpt(fd); grantpt(fd);
+
+ sleep(2);
+ kill(pid, SIGHUP);
+ sleep(1);
+ return 0; /* exit before child opens /dev/console */
+}
+
+Reported-by: Grzegorz Nosek <root@localdomain.pl>
+Signed-off-by: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
+Tested-by: Serge Hallyn <serue@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/devpts/inode.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+--- a/fs/devpts/inode.c
++++ b/fs/devpts/inode.c
+@@ -518,11 +518,23 @@ int devpts_pty_new(struct inode *ptmx_in
+
+ struct tty_struct *devpts_get_tty(struct inode *pts_inode, int number)
+ {
++ struct dentry *dentry;
++ struct tty_struct *tty;
++
+ BUG_ON(pts_inode->i_rdev == MKDEV(TTYAUX_MAJOR, PTMX_MINOR));
+
++ /* Ensure dentry has not been deleted by devpts_pty_kill() */
++ dentry = d_find_alias(pts_inode);
++ if (!dentry)
++ return NULL;
++
++ tty = NULL;
+ if (pts_inode->i_sb->s_magic == DEVPTS_SUPER_MAGIC)
+- return (struct tty_struct *)pts_inode->i_private;
+- return NULL;
++ tty = (struct tty_struct *)pts_inode->i_private;
++
++ dput(dentry);
++
++ return tty;
+ }
+
+ void devpts_pty_kill(struct tty_struct *tty)
--- /dev/null
+From 722d0172377a5697919b9f7e5beb95165b1dec4e Mon Sep 17 00:00:00 2001
+From: Andi Kleen <andi@firstfloor.org>
+Date: Tue, 8 Dec 2009 13:19:42 +0100
+Subject: futex: Take mmap_sem for get_user_pages in fault_in_user_writeable
+
+From: Andi Kleen <andi@firstfloor.org>
+
+commit 722d0172377a5697919b9f7e5beb95165b1dec4e upstream.
+
+get_user_pages() must be called with mmap_sem held.
+
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+Cc: Andrew Morton <akpm@linuxfoundation.org>
+Cc: Nick Piggin <npiggin@suse.de>
+Cc: Darren Hart <dvhltc@us.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+LKML-Reference: <20091208121942.GA21298@basil.fritz.box>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/futex.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -303,8 +303,14 @@ void put_futex_key(int fshared, union fu
+ */
+ static int fault_in_user_writeable(u32 __user *uaddr)
+ {
+- int ret = get_user_pages(current, current->mm, (unsigned long)uaddr,
+- 1, 1, 0, NULL, NULL);
++ struct mm_struct *mm = current->mm;
++ int ret;
++
++ down_read(&mm->mmap_sem);
++ ret = get_user_pages(current, mm, (unsigned long)uaddr,
++ 1, 1, 0, NULL, NULL);
++ up_read(&mm->mmap_sem);
++
+ return ret < 0 ? ret : 0;
+ }
+
--- /dev/null
+From ec81aecb29668ad71f699f4e7b96ec46691895b6 Mon Sep 17 00:00:00 2001
+From: Amerigo Wang <amwang@redhat.com>
+Date: Mon, 14 Dec 2009 17:57:37 -0800
+Subject: hfs: fix a potential buffer overflow
+
+From: Amerigo Wang <amwang@redhat.com>
+
+commit ec81aecb29668ad71f699f4e7b96ec46691895b6 upstream.
+
+A specially-crafted Hierarchical File System (HFS) filesystem could cause
+a buffer overflow to occur in a process's kernel stack during a memcpy()
+call within the hfs_bnode_read() function (at fs/hfs/bnode.c:24). The
+attacker can provide the source buffer and length, and the destination
+buffer is a local variable of a fixed length. This local variable (passed
+as "&entry" from fs/hfs/dir.c:112 and allocated on line 60) is stored in
+the stack frame of hfs_bnode_read()'s caller, which is hfs_readdir().
+Because the hfs_readdir() function executes upon any attempt to read a
+directory on the filesystem, it gets called whenever a user attempts to
+inspect any filesystem contents.
+
+[amwang@redhat.com: modify this patch and fix coding style problems]
+Signed-off-by: WANG Cong <amwang@redhat.com>
+Cc: Eugene Teo <eteo@redhat.com>
+Cc: Roman Zippel <zippel@linux-m68k.org>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Cc: Dave Anderson <anderson@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/hfs/catalog.c | 4 ++++
+ fs/hfs/dir.c | 11 +++++++++++
+ fs/hfs/super.c | 7 ++++++-
+ 3 files changed, 21 insertions(+), 1 deletion(-)
+
+--- a/fs/hfs/catalog.c
++++ b/fs/hfs/catalog.c
+@@ -289,6 +289,10 @@ int hfs_cat_move(u32 cnid, struct inode
+ err = hfs_brec_find(&src_fd);
+ if (err)
+ goto out;
++ if (src_fd.entrylength > sizeof(entry) || src_fd.entrylength < 0) {
++ err = -EIO;
++ goto out;
++ }
+
+ hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset,
+ src_fd.entrylength);
+--- a/fs/hfs/dir.c
++++ b/fs/hfs/dir.c
+@@ -79,6 +79,11 @@ static int hfs_readdir(struct file *filp
+ filp->f_pos++;
+ /* fall through */
+ case 1:
++ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
++ err = -EIO;
++ goto out;
++ }
++
+ hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
+ if (entry.type != HFS_CDR_THD) {
+ printk(KERN_ERR "hfs: bad catalog folder thread\n");
+@@ -109,6 +114,12 @@ static int hfs_readdir(struct file *filp
+ err = -EIO;
+ goto out;
+ }
++
++ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
++ err = -EIO;
++ goto out;
++ }
++
+ hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
+ type = entry.type;
+ len = hfs_mac2asc(sb, strbuf, &fd.key->cat.CName);
+--- a/fs/hfs/super.c
++++ b/fs/hfs/super.c
+@@ -409,8 +409,13 @@ static int hfs_fill_super(struct super_b
+ /* try to get the root inode */
+ hfs_find_init(HFS_SB(sb)->cat_tree, &fd);
+ res = hfs_cat_find_brec(sb, HFS_ROOT_CNID, &fd);
+- if (!res)
++ if (!res) {
++ if (fd.entrylength > sizeof(rec) || fd.entrylength < 0) {
++ res = -EIO;
++ goto bail;
++ }
+ hfs_bnode_read(fd.bnode, &rec, fd.entryoffset, fd.entrylength);
++ }
+ if (res) {
+ hfs_find_exit(&fd);
+ goto bail_no_root;
--- /dev/null
+From 8629ea2eaba8ca0de2e38ce1b4a825e16255976e Mon Sep 17 00:00:00 2001
+From: Feng Tang <feng.tang@intel.com>
+Date: Thu, 3 Sep 2009 16:32:53 +0800
+Subject: hrtimer: Fix /proc/timer_list regression
+
+From: Feng Tang <feng.tang@intel.com>
+
+commit 8629ea2eaba8ca0de2e38ce1b4a825e16255976e upstream.
+
+commit 507e1231 (timer stats: Optimize by adding quick check to avoid
+function calls) introduced a regression in /proc/timer_list.
+
+/proc/timer_list shows now
+ #0: <c27d46b0>, tick_sched_timer, S:01, <(null)>, /-1
+instead of
+ #0: <c27d46b0>, tick_sched_timer, S:01, hrtimer_start, swapper/0
+
+Revert the hrtimer quick check for now. The optimization needs more
+thought, but this is neither 2.6.32-rc7 nor stable material.
+
+[ tglx: - Removed unrelated changes from the original patch
+ - Prevent unneccesary call to timer_stats_update_stats
+ - massaged the changelog ]
+
+Signed-off-by: Feng Tang <feng.tang@intel.com>
+LKML-Reference: <alpine.LFD.2.00.0911181933540.24119@localhost.localdomain>
+Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/hrtimer.h | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/include/linux/hrtimer.h
++++ b/include/linux/hrtimer.h
+@@ -448,7 +448,7 @@ extern void timer_stats_update_stats(voi
+
+ static inline void timer_stats_account_hrtimer(struct hrtimer *timer)
+ {
+- if (likely(!timer->start_site))
++ if (likely(!timer_stats_active))
+ return;
+ timer_stats_update_stats(timer, timer->start_pid, timer->start_site,
+ timer->function, timer->start_comm, 0);
+@@ -459,8 +459,6 @@ extern void __timer_stats_hrtimer_set_st
+
+ static inline void timer_stats_hrtimer_set_start_info(struct hrtimer *timer)
+ {
+- if (likely(!timer_stats_active))
+- return;
+ __timer_stats_hrtimer_set_start_info(timer, __builtin_return_address(0));
+ }
+
--- /dev/null
+From e6a47428de84e19fda52f21ab73fde2906c40d09 Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Sun, 15 Nov 2009 15:31:37 -0500
+Subject: jbd2: don't wipe the journal on a failed journal checksum
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+commit e6a47428de84e19fda52f21ab73fde2906c40d09 upstream.
+
+If there is a failed journal checksum, don't reset the journal. This
+allows for userspace programs to decide how to recover from this
+situation. It may be that ignoring the journal checksum failure might
+be a better way of recovering the file system. Once we add per-block
+checksums, we can definitely do better. Until then, a system
+administrator can try backing up the file system image (or taking a
+snapshot) and and trying to determine experimentally whether ignoring
+the checksum failure or aborting the journal replay results in less
+data loss.
+
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/jbd2/journal.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -1421,6 +1421,13 @@ int jbd2_journal_load(journal_t *journal
+ if (jbd2_journal_recover(journal))
+ goto recovery_error;
+
++ if (journal->j_failed_commit) {
++ printk(KERN_ERR "JBD2: journal transaction %u on %s "
++ "is corrupt.\n", journal->j_failed_commit,
++ journal->j_devname);
++ return -EIO;
++ }
++
+ /* OK, we've finished with the dynamic journal bits:
+ * reinitialise the dynamic contents of the superblock in memory
+ * and reset them on disk. */
--- /dev/null
+From d7b0b5eb3000c6fb902f08c619fcd673a23d8fab Mon Sep 17 00:00:00 2001
+From: Carsten Otte <carsteno@de.ibm.com>
+Date: Thu, 19 Nov 2009 14:21:16 +0100
+Subject: KVM: s390: Make psw available on all exits, not just a subset
+
+From: Carsten Otte <carsteno@de.ibm.com>
+
+commit d7b0b5eb3000c6fb902f08c619fcd673a23d8fab upstream.
+
+This patch moves s390 processor status word into the base kvm_run
+struct and keeps it up-to date on all userspace exits.
+
+The userspace ABI is broken by this, however there are no applications
+in the wild using this. A capability check is provided so users can
+verify the updated API exists.
+
+Signed-off-by: Carsten Otte <cotte@de.ibm.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/s390/include/asm/kvm.h | 3 ++-
+ arch/s390/kvm/kvm-s390.c | 25 +++++++++++++++++--------
+ include/linux/kvm.h | 8 ++++++--
+ 3 files changed, 25 insertions(+), 11 deletions(-)
+
+--- a/arch/s390/include/asm/kvm.h
++++ b/arch/s390/include/asm/kvm.h
+@@ -1,6 +1,5 @@
+ #ifndef __LINUX_KVM_S390_H
+ #define __LINUX_KVM_S390_H
+-
+ /*
+ * asm-s390/kvm.h - KVM s390 specific structures and definitions
+ *
+@@ -24,6 +23,8 @@ struct kvm_ioapic_state {
+ /* no IOAPIC for s390 */
+ };
+
++#define __KVM_S390
++
+ /* for KVM_GET_REGS and KVM_SET_REGS */
+ struct kvm_regs {
+ /* general purpose regs for s390 */
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -115,10 +115,16 @@ long kvm_arch_dev_ioctl(struct file *fil
+
+ int kvm_dev_ioctl_check_extension(long ext)
+ {
++ int r;
++
+ switch (ext) {
++ case KVM_CAP_S390_PSW:
++ r = 1;
++ break;
+ default:
+- return 0;
++ r = 0;
+ }
++ return r;
+ }
+
+ /* Section: vm related */
+@@ -422,8 +428,10 @@ static int kvm_arch_vcpu_ioctl_set_initi
+ vcpu_load(vcpu);
+ if (atomic_read(&vcpu->arch.sie_block->cpuflags) & CPUSTAT_RUNNING)
+ rc = -EBUSY;
+- else
+- vcpu->arch.sie_block->gpsw = psw;
++ else {
++ vcpu->run->psw_mask = psw.mask;
++ vcpu->run->psw_addr = psw.addr;
++ }
+ vcpu_put(vcpu);
+ return rc;
+ }
+@@ -505,9 +513,6 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v
+
+ switch (kvm_run->exit_reason) {
+ case KVM_EXIT_S390_SIEIC:
+- vcpu->arch.sie_block->gpsw.mask = kvm_run->s390_sieic.mask;
+- vcpu->arch.sie_block->gpsw.addr = kvm_run->s390_sieic.addr;
+- break;
+ case KVM_EXIT_UNKNOWN:
+ case KVM_EXIT_S390_RESET:
+ break;
+@@ -515,6 +520,9 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v
+ BUG();
+ }
+
++ vcpu->arch.sie_block->gpsw.mask = kvm_run->psw_mask;
++ vcpu->arch.sie_block->gpsw.addr = kvm_run->psw_addr;
++
+ might_fault();
+
+ do {
+@@ -529,8 +537,6 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v
+ /* intercept cannot be handled in-kernel, prepare kvm-run */
+ kvm_run->exit_reason = KVM_EXIT_S390_SIEIC;
+ kvm_run->s390_sieic.icptcode = vcpu->arch.sie_block->icptcode;
+- kvm_run->s390_sieic.mask = vcpu->arch.sie_block->gpsw.mask;
+- kvm_run->s390_sieic.addr = vcpu->arch.sie_block->gpsw.addr;
+ kvm_run->s390_sieic.ipa = vcpu->arch.sie_block->ipa;
+ kvm_run->s390_sieic.ipb = vcpu->arch.sie_block->ipb;
+ rc = 0;
+@@ -542,6 +548,9 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v
+ rc = 0;
+ }
+
++ kvm_run->psw_mask = vcpu->arch.sie_block->gpsw.mask;
++ kvm_run->psw_addr = vcpu->arch.sie_block->gpsw.addr;
++
+ if (vcpu->sigset_active)
+ sigprocmask(SIG_SETMASK, &sigsaved, NULL);
+
+--- a/include/linux/kvm.h
++++ b/include/linux/kvm.h
+@@ -104,6 +104,11 @@ struct kvm_run {
+ __u64 cr8;
+ __u64 apic_base;
+
++#ifdef __KVM_S390
++ /* the processor status word for s390 */
++ __u64 psw_mask; /* psw upper half */
++ __u64 psw_addr; /* psw lower half */
++#endif
+ union {
+ /* KVM_EXIT_UNKNOWN */
+ struct {
+@@ -155,8 +160,6 @@ struct kvm_run {
+ /* KVM_EXIT_S390_SIEIC */
+ struct {
+ __u8 icptcode;
+- __u64 mask; /* psw upper half */
+- __u64 addr; /* psw lower half */
+ __u16 ipa;
+ __u32 ipb;
+ } s390_sieic;
+@@ -453,6 +456,7 @@ struct kvm_irq_routing {
+ };
+
+ #endif
++#define KVM_CAP_S390_PSW 42
+
+ /*
+ * ioctls for VM fds
--- /dev/null
+From aa5cbd103887011b4830355f88fb055f9ad2d556 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Mon, 14 Dec 2009 12:49:46 +1100
+Subject: md/bitmap: protect against bitmap removal while being updated.
+
+From: NeilBrown <neilb@suse.de>
+
+commit aa5cbd103887011b4830355f88fb055f9ad2d556 upstream.
+
+A write intent bitmap can be removed from an array while the
+array is active.
+When this happens, all IO is suspended and flushed before the
+bitmap is removed.
+However it is possible that bitmap_daemon_work is still running to
+clear old bits from the bitmap. If it is, it can dereference the
+bitmap after it has been freed.
+
+So introduce a new mutex to protect bitmap_daemon_work and get it
+before destroying a bitmap.
+
+This is suitable for any current -stable kernel.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/bitmap.c | 24 ++++++++++++++++++------
+ drivers/md/bitmap.h | 2 +-
+ drivers/md/md.c | 3 ++-
+ drivers/md/md.h | 1 +
+ 4 files changed, 22 insertions(+), 8 deletions(-)
+
+--- a/drivers/md/bitmap.c
++++ b/drivers/md/bitmap.c
+@@ -1077,23 +1077,31 @@ static bitmap_counter_t *bitmap_get_coun
+ * out to disk
+ */
+
+-void bitmap_daemon_work(struct bitmap *bitmap)
++void bitmap_daemon_work(mddev_t *mddev)
+ {
++ struct bitmap *bitmap;
+ unsigned long j;
+ unsigned long flags;
+ struct page *page = NULL, *lastpage = NULL;
+ int blocks;
+ void *paddr;
+
+- if (bitmap == NULL)
++ /* Use a mutex to guard daemon_work against
++ * bitmap_destroy.
++ */
++ mutex_lock(&mddev->bitmap_mutex);
++ bitmap = mddev->bitmap;
++ if (bitmap == NULL) {
++ mutex_unlock(&mddev->bitmap_mutex);
+ return;
++ }
+ if (time_before(jiffies, bitmap->daemon_lastrun + bitmap->daemon_sleep*HZ))
+ goto done;
+
+ bitmap->daemon_lastrun = jiffies;
+ if (bitmap->allclean) {
+ bitmap->mddev->thread->timeout = MAX_SCHEDULE_TIMEOUT;
+- return;
++ goto done;
+ }
+ bitmap->allclean = 1;
+
+@@ -1202,6 +1210,7 @@ void bitmap_daemon_work(struct bitmap *b
+ done:
+ if (bitmap->allclean == 0)
+ bitmap->mddev->thread->timeout = bitmap->daemon_sleep * HZ;
++ mutex_unlock(&mddev->bitmap_mutex);
+ }
+
+ static bitmap_counter_t *bitmap_get_counter(struct bitmap *bitmap,
+@@ -1538,9 +1547,9 @@ void bitmap_flush(mddev_t *mddev)
+ */
+ sleep = bitmap->daemon_sleep;
+ bitmap->daemon_sleep = 0;
+- bitmap_daemon_work(bitmap);
+- bitmap_daemon_work(bitmap);
+- bitmap_daemon_work(bitmap);
++ bitmap_daemon_work(mddev);
++ bitmap_daemon_work(mddev);
++ bitmap_daemon_work(mddev);
+ bitmap->daemon_sleep = sleep;
+ bitmap_update_sb(bitmap);
+ }
+@@ -1571,6 +1580,7 @@ static void bitmap_free(struct bitmap *b
+ kfree(bp);
+ kfree(bitmap);
+ }
++
+ void bitmap_destroy(mddev_t *mddev)
+ {
+ struct bitmap *bitmap = mddev->bitmap;
+@@ -1578,7 +1588,9 @@ void bitmap_destroy(mddev_t *mddev)
+ if (!bitmap) /* there was no bitmap */
+ return;
+
++ mutex_lock(&mddev->bitmap_mutex);
+ mddev->bitmap = NULL; /* disconnect from the md device */
++ mutex_unlock(&mddev->bitmap_mutex);
+ if (mddev->thread)
+ mddev->thread->timeout = MAX_SCHEDULE_TIMEOUT;
+
+--- a/drivers/md/bitmap.h
++++ b/drivers/md/bitmap.h
+@@ -282,7 +282,7 @@ void bitmap_close_sync(struct bitmap *bi
+ void bitmap_cond_end_sync(struct bitmap *bitmap, sector_t sector);
+
+ void bitmap_unplug(struct bitmap *bitmap);
+-void bitmap_daemon_work(struct bitmap *bitmap);
++void bitmap_daemon_work(mddev_t *mddev);
+ #endif
+
+ #endif
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -361,6 +361,7 @@ static mddev_t * mddev_find(dev_t unit)
+
+ mutex_init(&new->open_mutex);
+ mutex_init(&new->reconfig_mutex);
++ mutex_init(&new->bitmap_mutex);
+ INIT_LIST_HEAD(&new->disks);
+ INIT_LIST_HEAD(&new->all_mddevs);
+ init_timer(&new->safemode_timer);
+@@ -6595,7 +6596,7 @@ void md_check_recovery(mddev_t *mddev)
+
+
+ if (mddev->bitmap)
+- bitmap_daemon_work(mddev->bitmap);
++ bitmap_daemon_work(mddev);
+
+ if (mddev->ro)
+ return;
+--- a/drivers/md/md.h
++++ b/drivers/md/md.h
+@@ -289,6 +289,7 @@ struct mddev_s
+ * hot-adding a bitmap. It should
+ * eventually be settable by sysfs.
+ */
++ struct mutex bitmap_mutex;
+
+ struct list_head all_mddevs;
+ };
--- /dev/null
+From 5600c70e576199a7552e1c0fff43f3fe16f5566e Mon Sep 17 00:00:00 2001
+From: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Date: Fri, 27 Nov 2009 22:29:02 +0400
+Subject: pata_hpt{37x|3x2n}: fix timing register masks (take 2)
+
+From: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+
+commit 5600c70e576199a7552e1c0fff43f3fe16f5566e upstream.
+
+These drivers inherited from the older 'hpt366' IDE driver the buggy timing
+register masks in their set_piomode() metods. As a result, too low command
+cycle active time is programmed for slow PIO modes. Quite fortunately, it's
+later "fixed up" by the set_dmamode() methods which also "helpfully" reprogram
+the command timings, usually to PIO mode 4; unfortunately, setting an UltraDMA
+mode #N also reprograms already set PIO data timings, usually to MWDMA mode #
+max(N, 2) timings...
+
+However, the drivers added some breakage of their own too: the bit that they
+set/clear to control the FIFO is sometimes wrong -- it's actually the MSB of
+the command cycle setup time; also, setting it in DMA mode is wrong as this
+bit is only for PIO actually and clearing it for PIO modes is not needed as
+no mode in any timing table has it set...
+
+Fix all this, inverting the masks while at it, like in the 'hpt366' and
+'pata_hpt366' drivers; bump the drivers' versions, accounting for recent
+patches that forgot to do it...
+
+Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/pata_hpt37x.c | 32 +++++++++++++++-----------------
+ drivers/ata/pata_hpt3x2n.c | 17 ++++++++---------
+ 2 files changed, 23 insertions(+), 26 deletions(-)
+
+--- a/drivers/ata/pata_hpt37x.c
++++ b/drivers/ata/pata_hpt37x.c
+@@ -24,7 +24,7 @@
+ #include <linux/libata.h>
+
+ #define DRV_NAME "pata_hpt37x"
+-#define DRV_VERSION "0.6.12"
++#define DRV_VERSION "0.6.14"
+
+ struct hpt_clock {
+ u8 xfer_speed;
+@@ -404,9 +404,8 @@ static void hpt370_set_piomode(struct at
+
+ pci_read_config_dword(pdev, addr1, ®);
+ mode = hpt37x_find_mode(ap, adev->pio_mode);
+- mode &= ~0x8000000; /* No FIFO in PIO */
+- mode &= ~0x30070000; /* Leave config bits alone */
+- reg &= 0x30070000; /* Strip timing bits */
++ mode &= 0xCFC3FFFF; /* Leave DMA bits alone */
++ reg &= ~0xCFC3FFFF; /* Strip timing bits */
+ pci_write_config_dword(pdev, addr1, reg | mode);
+ }
+
+@@ -423,8 +422,7 @@ static void hpt370_set_dmamode(struct at
+ {
+ struct pci_dev *pdev = to_pci_dev(ap->host->dev);
+ u32 addr1, addr2;
+- u32 reg;
+- u32 mode;
++ u32 reg, mode, mask;
+ u8 fast;
+
+ addr1 = 0x40 + 4 * (adev->devno + 2 * ap->port_no);
+@@ -436,11 +434,12 @@ static void hpt370_set_dmamode(struct at
+ fast |= 0x01;
+ pci_write_config_byte(pdev, addr2, fast);
+
++ mask = adev->dma_mode < XFER_UDMA_0 ? 0x31C001FF : 0x303C0000;
++
+ pci_read_config_dword(pdev, addr1, ®);
+ mode = hpt37x_find_mode(ap, adev->dma_mode);
+- mode |= 0x8000000; /* FIFO in MWDMA or UDMA */
+- mode &= ~0xC0000000; /* Leave config bits alone */
+- reg &= 0xC0000000; /* Strip timing bits */
++ mode &= mask;
++ reg &= ~mask;
+ pci_write_config_dword(pdev, addr1, reg | mode);
+ }
+
+@@ -508,9 +507,8 @@ static void hpt372_set_piomode(struct at
+ mode = hpt37x_find_mode(ap, adev->pio_mode);
+
+ printk("Find mode for %d reports %X\n", adev->pio_mode, mode);
+- mode &= ~0x80000000; /* No FIFO in PIO */
+- mode &= ~0x30070000; /* Leave config bits alone */
+- reg &= 0x30070000; /* Strip timing bits */
++ mode &= 0xCFC3FFFF; /* Leave DMA bits alone */
++ reg &= ~0xCFC3FFFF; /* Strip timing bits */
+ pci_write_config_dword(pdev, addr1, reg | mode);
+ }
+
+@@ -527,8 +525,7 @@ static void hpt372_set_dmamode(struct at
+ {
+ struct pci_dev *pdev = to_pci_dev(ap->host->dev);
+ u32 addr1, addr2;
+- u32 reg;
+- u32 mode;
++ u32 reg, mode, mask;
+ u8 fast;
+
+ addr1 = 0x40 + 4 * (adev->devno + 2 * ap->port_no);
+@@ -539,12 +536,13 @@ static void hpt372_set_dmamode(struct at
+ fast &= ~0x07;
+ pci_write_config_byte(pdev, addr2, fast);
+
++ mask = adev->dma_mode < XFER_UDMA_0 ? 0x31C001FF : 0x303C0000;
++
+ pci_read_config_dword(pdev, addr1, ®);
+ mode = hpt37x_find_mode(ap, adev->dma_mode);
+ printk("Find mode for DMA %d reports %X\n", adev->dma_mode, mode);
+- mode &= ~0xC0000000; /* Leave config bits alone */
+- mode |= 0x80000000; /* FIFO in MWDMA or UDMA */
+- reg &= 0xC0000000; /* Strip timing bits */
++ mode &= mask;
++ reg &= ~mask;
+ pci_write_config_dword(pdev, addr1, reg | mode);
+ }
+
+--- a/drivers/ata/pata_hpt3x2n.c
++++ b/drivers/ata/pata_hpt3x2n.c
+@@ -25,7 +25,7 @@
+ #include <linux/libata.h>
+
+ #define DRV_NAME "pata_hpt3x2n"
+-#define DRV_VERSION "0.3.4"
++#define DRV_VERSION "0.3.7"
+
+ enum {
+ HPT_PCI_FAST = (1 << 31),
+@@ -185,9 +185,8 @@ static void hpt3x2n_set_piomode(struct a
+
+ pci_read_config_dword(pdev, addr1, ®);
+ mode = hpt3x2n_find_mode(ap, adev->pio_mode);
+- mode &= ~0x8000000; /* No FIFO in PIO */
+- mode &= ~0x30070000; /* Leave config bits alone */
+- reg &= 0x30070000; /* Strip timing bits */
++ mode &= 0xCFC3FFFF; /* Leave DMA bits alone */
++ reg &= ~0xCFC3FFFF; /* Strip timing bits */
+ pci_write_config_dword(pdev, addr1, reg | mode);
+ }
+
+@@ -204,8 +203,7 @@ static void hpt3x2n_set_dmamode(struct a
+ {
+ struct pci_dev *pdev = to_pci_dev(ap->host->dev);
+ u32 addr1, addr2;
+- u32 reg;
+- u32 mode;
++ u32 reg, mode, mask;
+ u8 fast;
+
+ addr1 = 0x40 + 4 * (adev->devno + 2 * ap->port_no);
+@@ -216,11 +214,12 @@ static void hpt3x2n_set_dmamode(struct a
+ fast &= ~0x07;
+ pci_write_config_byte(pdev, addr2, fast);
+
++ mask = adev->dma_mode < XFER_UDMA_0 ? 0x31C001FF : 0x303C0000;
++
+ pci_read_config_dword(pdev, addr1, ®);
+ mode = hpt3x2n_find_mode(ap, adev->dma_mode);
+- mode |= 0x8000000; /* FIFO in MWDMA or UDMA */
+- mode &= ~0xC0000000; /* Leave config bits alone */
+- reg &= 0xC0000000; /* Strip timing bits */
++ mode &= mask;
++ reg &= ~mask;
+ pci_write_config_dword(pdev, addr1, reg | mode);
+ }
+
--- /dev/null
+From 1b82e4c32fba96d8805b1e2126ba5382e56fac32 Mon Sep 17 00:00:00 2001
+From: Igor Grinberg <grinberg@compulab.co.il>
+Date: Sun, 6 Dec 2009 15:45:43 +0200
+Subject: [ARM] pxa/em-x270: fix usb hub power up/reset sequence
+
+From: Igor Grinberg <grinberg@compulab.co.il>
+
+commit 1b82e4c32fba96d8805b1e2126ba5382e56fac32 upstream.
+
+Signed-off-by: Igor Grinberg <grinberg@compulab.co.il>
+Signed-off-by: Mike Rapoport <mike@compulab.co.il>
+Signed-off-by: Eric Miao <eric.y.miao@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/mach-pxa/em-x270.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/arch/arm/mach-pxa/em-x270.c
++++ b/arch/arm/mach-pxa/em-x270.c
+@@ -497,16 +497,15 @@ static int em_x270_usb_hub_init(void)
+ goto err_free_vbus_gpio;
+
+ /* USB Hub power-on and reset */
+- gpio_direction_output(usb_hub_reset, 0);
++ gpio_direction_output(usb_hub_reset, 1);
++ gpio_direction_output(GPIO9_USB_VBUS_EN, 0);
+ regulator_enable(em_x270_usb_ldo);
+- gpio_set_value(usb_hub_reset, 1);
+ gpio_set_value(usb_hub_reset, 0);
++ gpio_set_value(usb_hub_reset, 1);
+ regulator_disable(em_x270_usb_ldo);
+ regulator_enable(em_x270_usb_ldo);
+- gpio_set_value(usb_hub_reset, 1);
+-
+- /* enable VBUS */
+- gpio_direction_output(GPIO9_USB_VBUS_EN, 1);
++ gpio_set_value(usb_hub_reset, 0);
++ gpio_set_value(GPIO9_USB_VBUS_EN, 1);
+
+ return 0;
+
usb-option-add-pid-for-zte.patch
usb-usb-storage-fix-bug-in-fill_inquiry.patch
firewire-ohci-handle-receive-packets-with-a-data-length-of-zero.patch
+alsa-hda-terradici-hda-controllers-does-not-support-64-bit-mode.patch
+alsa-hrtimer-fix-lock-up.patch
+ath5k-allow-setting-txpower-to-0.patch
+ath5k-enable-eeprom-checksum-check.patch
+bsdacct-fix-uid-gid-misreporting.patch
+debugfs-fix-create-mutex-racy-fops-and-private-data.patch
+devpts_get_tty-should-validate-inode.patch
+futex-take-mmap_sem-for-get_user_pages-in-fault_in_user_writeable.patch
+hfs-fix-a-potential-buffer-overflow.patch
+hrtimer-fix-proc-timer_list-regression.patch
+jbd2-don-t-wipe-the-journal-on-a-failed-journal-checksum.patch
+kvm-s390-make-psw-available-on-all-exits-not-just-a-subset.patch
+md-bitmap-protect-against-bitmap-removal-while-being-updated.patch
+pata_hpt-37x-3x2n-fix-timing-register-masks-take-2.patch
+pxa-em-x270-fix-usb-hub-power-up-reset-sequence.patch
+ssb-fix-range-check-in-sprom-write.patch
+sunrpc-is_err-ptr_err-confusion.patch
+usb-close-usb_find_interface-race-v3.patch
+usb-musb_gadget_ep0-fix-unhandled-endpoint-0-irqs-again.patch
+usb-option.c-add-support-for-d-link-dwm-162-u5.patch
+usb-usb-storage-add-bad_sense-flag.patch
+usb-usbtmc-repeat-usb_bulk_msg-until-whole-message-is-transfered.patch
+v4l-dvb-fix-test-in-copy_reg_bits.patch
+x86-add-new-intel-cpu-cache-size-descriptors.patch
+x86-amd-iommu-attach-devices-to-pre-allocated-domains-early.patch
+x86-amd-iommu-un__init-iommu_setup_msi.patch
+x86-apic-enable-lapic-nmi-watchdog-on-amd-family-11h.patch
+x86-asus-p4s800-reboot-bios-quirk.patch
+x86-calgary-iommu-quirk-find-nearest-matching-calgary-while-walking-up-the-pci-tree.patch
+x86-fix-iommu-nodac-parameter-handling.patch
+x86-fix-typo-in-intel-cpu-cache-size-descriptor.patch
+x86-gart-pci-gart_64.c-use-correct-length-in-strncmp.patch
--- /dev/null
+From e33761e6f23881de9f3ee77cc2204ab2e26f3d9a Mon Sep 17 00:00:00 2001
+From: Michael Buesch <mb@bu3sch.de>
+Date: Mon, 23 Nov 2009 20:58:06 +0100
+Subject: ssb: Fix range check in sprom write
+
+From: Michael Buesch <mb@bu3sch.de>
+
+commit e33761e6f23881de9f3ee77cc2204ab2e26f3d9a upstream.
+
+The range check in the sprom image parser hex2sprom() is broken.
+One sprom word is 4 hex characters.
+This fixes the check and also adds much better sanity checks to the code.
+We better make sure the image is OK by doing some sanity checks to avoid
+bricking the device by accident.
+
+Signed-off-by: Michael Buesch <mb@bu3sch.de>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ssb/sprom.c | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+--- a/drivers/ssb/sprom.c
++++ b/drivers/ssb/sprom.c
+@@ -13,6 +13,8 @@
+
+ #include "ssb_private.h"
+
++#include <linux/ctype.h>
++
+
+ static const struct ssb_sprom *fallback_sprom;
+
+@@ -33,17 +35,27 @@ static int sprom2hex(const u16 *sprom, c
+ static int hex2sprom(u16 *sprom, const char *dump, size_t len,
+ size_t sprom_size_words)
+ {
+- char tmp[5] = { 0 };
+- int cnt = 0;
++ char c, tmp[5] = { 0 };
++ int err, cnt = 0;
+ unsigned long parsed;
+
+- if (len < sprom_size_words * 2)
++ /* Strip whitespace at the end. */
++ while (len) {
++ c = dump[len - 1];
++ if (!isspace(c) && c != '\0')
++ break;
++ len--;
++ }
++ /* Length must match exactly. */
++ if (len != sprom_size_words * 4)
+ return -EINVAL;
+
+ while (cnt < sprom_size_words) {
+ memcpy(tmp, dump, 4);
+ dump += 4;
+- parsed = simple_strtoul(tmp, NULL, 16);
++ err = strict_strtoul(tmp, 16, &parsed);
++ if (err)
++ return err;
+ sprom[cnt++] = swab16((u16)parsed);
+ }
+
--- /dev/null
+From 480e3243df156e39eea6c91057e2ae612a6bbe19 Mon Sep 17 00:00:00 2001
+From: Roel Kluin <roel.kluin@gmail.com>
+Date: Tue, 8 Dec 2009 13:13:03 -0500
+Subject: SUNRPC: IS_ERR/PTR_ERR confusion
+
+From: Roel Kluin <roel.kluin@gmail.com>
+
+commit 480e3243df156e39eea6c91057e2ae612a6bbe19 upstream.
+
+IS_ERR returns 1 or 0, PTR_ERR returns the error value.
+
+Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/auth_gss/auth_gss.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sunrpc/auth_gss/auth_gss.c
++++ b/net/sunrpc/auth_gss/auth_gss.c
+@@ -485,7 +485,7 @@ gss_refresh_upcall(struct rpc_task *task
+ dprintk("RPC: %5u gss_refresh_upcall for uid %u\n", task->tk_pid,
+ cred->cr_uid);
+ gss_msg = gss_setup_upcall(task->tk_client, gss_auth, cred);
+- if (IS_ERR(gss_msg) == -EAGAIN) {
++ if (PTR_ERR(gss_msg) == -EAGAIN) {
+ /* XXX: warning on the first, under the assumption we
+ * shouldn't normally hit this case on a refresh. */
+ warn_gssd();
--- /dev/null
+From c2d284ee04ab6f6718de2ddcf1b43160e046c41d Mon Sep 17 00:00:00 2001
+From: Russ Dill <Russ.Dill@gmail.com>
+Date: Mon, 14 Dec 2009 21:45:35 -0700
+Subject: USB: Close usb_find_interface race v3
+
+From: Russ Dill <Russ.Dill@gmail.com>
+
+commit c2d284ee04ab6f6718de2ddcf1b43160e046c41d upstream.
+
+USB drivers that create character devices call usb_register_dev in their
+probe function. This associates the usb_interface device with that minor
+number and creates the character device and announces it to the world.
+However, the driver's probe function is called before the new
+usb_interface is added to the driver's klist_devices.
+
+This is a problem because userspace will respond to the character device
+creation announcement by opening the character device. The driver's open
+function will the call usb_find_interface to find the usb_interface
+associated with that minor number. usb_find_interface will walk the
+driver's list of devices and find the usb_interface with the matching
+minor number.
+
+Because the announcement happens before the usb_interface is added to the
+driver's klist_devices, a race condition exists. A straightforward fix
+is to walk the list of devices on usb_bus_type instead since the device
+is added to that list before the announcement occurs.
+
+bus_find_device calls get_device to bump the reference count on the found
+device. It is arguable that the reference count should be dropped by the
+caller of usb_find_interface instead of usb_find_interface, however,
+the current users of usb_find_interface do not expect this.
+
+The original version of this patch only matched against minor number
+instead of driver and minor number. This version matches against both.
+
+Signed-off-by: Russ Dill <Russ.Dill@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/usb.c | 31 ++++++++++++++++---------------
+ 1 file changed, 16 insertions(+), 15 deletions(-)
+
+--- a/drivers/usb/core/usb.c
++++ b/drivers/usb/core/usb.c
+@@ -132,7 +132,7 @@ EXPORT_SYMBOL_GPL(usb_altnum_to_altsetti
+
+ struct find_interface_arg {
+ int minor;
+- struct usb_interface *interface;
++ struct device_driver *drv;
+ };
+
+ static int __find_interface(struct device *dev, void *data)
+@@ -143,12 +143,10 @@ static int __find_interface(struct devic
+ if (!is_usb_interface(dev))
+ return 0;
+
++ if (dev->driver != arg->drv)
++ return 0;
+ intf = to_usb_interface(dev);
+- if (intf->minor != -1 && intf->minor == arg->minor) {
+- arg->interface = intf;
+- return 1;
+- }
+- return 0;
++ return intf->minor == arg->minor;
+ }
+
+ /**
+@@ -156,21 +154,24 @@ static int __find_interface(struct devic
+ * @drv: the driver whose current configuration is considered
+ * @minor: the minor number of the desired device
+ *
+- * This walks the driver device list and returns a pointer to the interface
+- * with the matching minor. Note, this only works for devices that share the
+- * USB major number.
++ * This walks the bus device list and returns a pointer to the interface
++ * with the matching minor and driver. Note, this only works for devices
++ * that share the USB major number.
+ */
+ struct usb_interface *usb_find_interface(struct usb_driver *drv, int minor)
+ {
+ struct find_interface_arg argb;
+- int retval;
++ struct device *dev;
+
+ argb.minor = minor;
+- argb.interface = NULL;
+- /* eat the error, it will be in argb.interface */
+- retval = driver_for_each_device(&drv->drvwrap.driver, NULL, &argb,
+- __find_interface);
+- return argb.interface;
++ argb.drv = &drv->drvwrap.driver;
++
++ dev = bus_find_device(&usb_bus_type, NULL, &argb, __find_interface);
++
++ /* Drop reference count from bus_find_device */
++ put_device(dev);
++
++ return dev ? to_usb_interface(dev) : NULL;
+ }
+ EXPORT_SYMBOL_GPL(usb_find_interface);
+
--- /dev/null
+From 196f1b7a387546f425df2f1fad26772e3d513aea Mon Sep 17 00:00:00 2001
+From: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Date: Mon, 16 Nov 2009 16:24:05 +0530
+Subject: USB: musb_gadget_ep0: fix unhandled endpoint 0 IRQs, again
+
+From: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+
+commit 196f1b7a387546f425df2f1fad26772e3d513aea upstream.
+
+Commit a5073b52833e4df8e16c93dc4cbb7e0c558c74a2 (musb_gadget: fix
+unhandled endpoint 0 IRQs) somehow missed its key change:
+
+"The gadget EP0 code routinely ignores an interrupt at end of
+the data phase because of musb_g_ep0_giveback() resetting the
+state machine to "idle, waiting for SETUP" phase prematurely."
+
+So, the majority of the cases of unhandled IRQs is still unfixed...
+
+Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Signed-off-by: Anand Gadiyar <gadiyar@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/musb/musb_gadget_ep0.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/usb/musb/musb_gadget_ep0.c
++++ b/drivers/usb/musb/musb_gadget_ep0.c
+@@ -199,7 +199,6 @@ service_in_request(struct musb *musb, co
+ static void musb_g_ep0_giveback(struct musb *musb, struct usb_request *req)
+ {
+ musb_g_giveback(&musb->endpoints[0].ep_in, req, 0);
+- musb->ep0_state = MUSB_EP0_STAGE_SETUP;
+ }
+
+ /*
--- /dev/null
+From 54a8e144acad6506920f385f4ef2779664f05b21 Mon Sep 17 00:00:00 2001
+From: Zhang Le <r0bertz@gentoo.org>
+Date: Tue, 17 Nov 2009 14:53:42 -0800
+Subject: USB: option.c: add support for D-Link DWM-162-U5
+
+From: Zhang Le <r0bertz@gentoo.org>
+
+commit 54a8e144acad6506920f385f4ef2779664f05b21 upstream.
+
+Add D-Link DWM-162-U5 device id 1e0e:ce16 into option driver. The device
+has 4 interfaces, of which 1 is handled by storage and the other 3 by
+option driver.
+
+The device appears first as CD-only 05c6:2100 device and must be switched
+to 1e0e:ce16 mode either by using "eject CD" or usb_modeswitch.
+
+The MessageContent for usb_modeswitch.conf is:
+"55534243e0c26a85000000000000061b000000020000000000000000000000"
+
+Signed-off-by: Zhang Le <r0bertz@gentoo.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/option.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -632,6 +632,7 @@ static struct usb_device_id option_ids[]
+ { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_G450) },
+ { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_HSDPA_MINICARD ) }, /* Toshiba 3G HSDPA == Novatel Expedite EU870D MiniCard */
+ { USB_DEVICE(ALINK_VENDOR_ID, 0x9000) },
++ { USB_DEVICE(ALINK_VENDOR_ID, 0xce16) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) },
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S) },
+ { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
--- /dev/null
+From a0bb108112a872c0b0c4b3ef4974f95fb75b155d Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Mon, 7 Dec 2009 16:39:16 -0500
+Subject: USB: usb-storage: add BAD_SENSE flag
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit a0bb108112a872c0b0c4b3ef4974f95fb75b155d upstream.
+
+This patch (as1311) fixes a problem in usb-storage: Some devices are
+pretty broken when it comes to reporting sense data. The information
+they send back indicates that they have more than 18 bytes of sense
+data available, but when the system asks for more than 18 they fail or
+hang. The symptom is that probing fails with multiple resets.
+
+The patch adds a new BAD_SENSE flag to indicate that usb-storage
+should never ask for more than 18 bytes of sense data. The flag can
+be set in an unusual_devs entry or via the "quirks=" module parameter,
+and it is set automatically whenever a REQUEST SENSE command for more
+than 18 bytes fails or times out.
+
+An unusual_devs entry is added for the Agfa photo frame, which uses a
+Prolific chip having this bug.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Tested-by: Daniel Kukula <daniel.kuku@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/kernel-parameters.txt | 2 ++
+ drivers/usb/storage/transport.c | 17 +++++++++++++----
+ drivers/usb/storage/unusual_devs.h | 7 +++++++
+ drivers/usb/storage/usb.c | 3 +++
+ include/linux/usb_usual.h | 4 +++-
+ 5 files changed, 28 insertions(+), 5 deletions(-)
+
+--- a/Documentation/kernel-parameters.txt
++++ b/Documentation/kernel-parameters.txt
+@@ -2561,6 +2561,8 @@ and is between 256 and 4096 characters.
+ to a common usb-storage quirk flag as follows:
+ a = SANE_SENSE (collect more than 18 bytes
+ of sense data);
++ b = BAD_SENSE (don't collect more than 18
++ bytes of sense data);
+ c = FIX_CAPACITY (decrease the reported
+ device capacity by one sector);
+ h = CAPACITY_HEURISTICS (decrease the
+--- a/drivers/usb/storage/transport.c
++++ b/drivers/usb/storage/transport.c
+@@ -666,10 +666,11 @@ void usb_stor_invoke_transport(struct sc
+ * to wait for at least one CHECK_CONDITION to determine
+ * SANE_SENSE support
+ */
+- if ((srb->cmnd[0] == ATA_16 || srb->cmnd[0] == ATA_12) &&
++ if (unlikely((srb->cmnd[0] == ATA_16 || srb->cmnd[0] == ATA_12) &&
+ result == USB_STOR_TRANSPORT_GOOD &&
+ !(us->fflags & US_FL_SANE_SENSE) &&
+- !(srb->cmnd[2] & 0x20)) {
++ !(us->fflags & US_FL_BAD_SENSE) &&
++ !(srb->cmnd[2] & 0x20))) {
+ US_DEBUGP("-- SAT supported, increasing auto-sense\n");
+ us->fflags |= US_FL_SANE_SENSE;
+ }
+@@ -718,6 +719,12 @@ Retry_Sense:
+ if (test_bit(US_FLIDX_TIMED_OUT, &us->dflags)) {
+ US_DEBUGP("-- auto-sense aborted\n");
+ srb->result = DID_ABORT << 16;
++
++ /* If SANE_SENSE caused this problem, disable it */
++ if (sense_size != US_SENSE_SIZE) {
++ us->fflags &= ~US_FL_SANE_SENSE;
++ us->fflags |= US_FL_BAD_SENSE;
++ }
+ goto Handle_Errors;
+ }
+
+@@ -727,10 +734,11 @@ Retry_Sense:
+ * (small) sense request. This fixes some USB GSM modems
+ */
+ if (temp_result == USB_STOR_TRANSPORT_FAILED &&
+- (us->fflags & US_FL_SANE_SENSE) &&
+- sense_size != US_SENSE_SIZE) {
++ sense_size != US_SENSE_SIZE) {
+ US_DEBUGP("-- auto-sense failure, retry small sense\n");
+ sense_size = US_SENSE_SIZE;
++ us->fflags &= ~US_FL_SANE_SENSE;
++ us->fflags |= US_FL_BAD_SENSE;
+ goto Retry_Sense;
+ }
+
+@@ -754,6 +762,7 @@ Retry_Sense:
+ */
+ if (srb->sense_buffer[7] > (US_SENSE_SIZE - 8) &&
+ !(us->fflags & US_FL_SANE_SENSE) &&
++ !(us->fflags & US_FL_BAD_SENSE) &&
+ (srb->sense_buffer[0] & 0x7C) == 0x70) {
+ US_DEBUGP("-- SANE_SENSE support enabled\n");
+ us->fflags |= US_FL_SANE_SENSE;
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -838,6 +838,13 @@ UNUSUAL_DEV( 0x066f, 0x8000, 0x0001, 0x0
+ US_SC_DEVICE, US_PR_DEVICE, NULL,
+ US_FL_FIX_CAPACITY ),
+
++/* Reported by Daniel Kukula <daniel.kuku@gmail.com> */
++UNUSUAL_DEV( 0x067b, 0x1063, 0x0100, 0x0100,
++ "Prolific Technology, Inc.",
++ "Prolific Storage Gadget",
++ US_SC_DEVICE, US_PR_DEVICE, NULL,
++ US_FL_BAD_SENSE ),
++
+ /* Reported by Rogerio Brito <rbrito@ime.usp.br> */
+ UNUSUAL_DEV( 0x067b, 0x2317, 0x0001, 0x001,
+ "Prolific Technology, Inc.",
+--- a/drivers/usb/storage/usb.c
++++ b/drivers/usb/storage/usb.c
+@@ -460,6 +460,9 @@ static void adjust_quirks(struct us_data
+ case 'a':
+ f |= US_FL_SANE_SENSE;
+ break;
++ case 'b':
++ f |= US_FL_BAD_SENSE;
++ break;
+ case 'c':
+ f |= US_FL_FIX_CAPACITY;
+ break;
+--- a/include/linux/usb_usual.h
++++ b/include/linux/usb_usual.h
+@@ -56,7 +56,9 @@
+ US_FLAG(SANE_SENSE, 0x00008000) \
+ /* Sane Sense (> 18 bytes) */ \
+ US_FLAG(CAPACITY_OK, 0x00010000) \
+- /* READ CAPACITY response is correct */
++ /* READ CAPACITY response is correct */ \
++ US_FLAG(BAD_SENSE, 0x00020000) \
++ /* Bad Sense (never more than 18 bytes) */
+
+ #define US_FLAG(name, value) US_FL_##name = value ,
+ enum { US_DO_ALL_FLAGS };
--- /dev/null
+From ec412b92dbe3ea839716853eea058d1bcc5e6ca4 Mon Sep 17 00:00:00 2001
+From: Andre Herms <andre.herms@tec-venture.de>
+Date: Thu, 19 Nov 2009 18:14:49 +0100
+Subject: USB: usbtmc: repeat usb_bulk_msg until whole message is transfered
+
+From: Andre Herms <andre.herms@tec-venture.de>
+
+commit ec412b92dbe3ea839716853eea058d1bcc5e6ca4 upstream.
+
+usb_bulk_msg() transfers only bytes up to the maximum packet size.
+It must be repeated by the usbtmc driver until all bytes of a TMC message
+are transfered.
+
+Without this patch, ETIMEDOUT is reported when writing TMC messages
+larger than the maximum USB bulk size and the transfer remains incomplete.
+The user will notice that the device hangs and must be reset by either closing
+the application or pulling the plug.
+
+Signed-off-by: Andre Herms <andre.herms@tec-venture.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/class/usbtmc.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/class/usbtmc.c
++++ b/drivers/usb/class/usbtmc.c
+@@ -545,10 +545,16 @@ static ssize_t usbtmc_write(struct file
+ n_bytes = roundup(12 + this_part, 4);
+ memset(buffer + 12 + this_part, 0, n_bytes - (12 + this_part));
+
+- retval = usb_bulk_msg(data->usb_dev,
+- usb_sndbulkpipe(data->usb_dev,
+- data->bulk_out),
+- buffer, n_bytes, &actual, USBTMC_TIMEOUT);
++ do {
++ retval = usb_bulk_msg(data->usb_dev,
++ usb_sndbulkpipe(data->usb_dev,
++ data->bulk_out),
++ buffer, n_bytes,
++ &actual, USBTMC_TIMEOUT);
++ if (retval != 0)
++ break;
++ n_bytes -= actual;
++ } while (n_bytes);
+
+ data->bTag_last_write = data->bTag;
+ data->bTag++;
--- /dev/null
+From c95a419a5604ec8a23cd73f61e9bb151e8cbe89b Mon Sep 17 00:00:00 2001
+From: Roel Kluin <roel.kluin@gmail.com>
+Date: Fri, 20 Nov 2009 15:34:13 -0300
+Subject: V4L/DVB: Fix test in copy_reg_bits()
+
+From: Roel Kluin <roel.kluin@gmail.com>
+
+commit c95a419a5604ec8a23cd73f61e9bb151e8cbe89b upstream.
+
+The reg_pair2[j].reg was tested twice.
+
+Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
+Acked-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/common/tuners/mxl5007t.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/common/tuners/mxl5007t.c
++++ b/drivers/media/common/tuners/mxl5007t.c
+@@ -196,7 +196,7 @@ static void copy_reg_bits(struct reg_pai
+ i = j = 0;
+
+ while (reg_pair1[i].reg || reg_pair1[i].val) {
+- while (reg_pair2[j].reg || reg_pair2[j].reg) {
++ while (reg_pair2[j].reg || reg_pair2[j].val) {
+ if (reg_pair1[i].reg != reg_pair2[j].reg) {
+ j++;
+ continue;
--- /dev/null
+From 85160b92fbd35321104819283c91bfed2b553e3c Mon Sep 17 00:00:00 2001
+From: Dave Jones <davej@redhat.com>
+Date: Tue, 10 Nov 2009 13:49:24 -0500
+Subject: x86: Add new Intel CPU cache size descriptors
+
+From: Dave Jones <davej@redhat.com>
+
+commit 85160b92fbd35321104819283c91bfed2b553e3c upstream.
+
+The latest rev of Intel doc AP-485 details new cache descriptors
+that we don't yet support. 12MB, 18MB and 24MB 24-way assoc L3
+caches.
+
+Signed-off-by: Dave Jones <davej@redhat.com>
+LKML-Reference: <20091110184924.GA20337@redhat.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/intel_cacheinfo.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/x86/kernel/cpu/intel_cacheinfo.c
++++ b/arch/x86/kernel/cpu/intel_cacheinfo.c
+@@ -101,6 +101,9 @@ static const struct _cache_table __cpuin
+ { 0xe2, LVL_3, 2048 }, /* 16-way set assoc, 64 byte line size */
+ { 0xe3, LVL_3, 4096 }, /* 16-way set assoc, 64 byte line size */
+ { 0xe4, LVL_3, 8192 }, /* 16-way set assoc, 64 byte line size */
++ { 0xea, LVL_3, 12288 }, /* 24-way set assoc, 64 byte line size */
++ { 0xeb, LVL_3, 18432 }, /* 24-way set assoc, 64 byte line size */
++ { 0xec, LVL_3, 24576 }, /* 24-way set assoc, 64 byte line size */
+ { 0x00, 0, 0}
+ };
+
--- /dev/null
+From be831297716036de5b24308447ecb69f1706a846 Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <joerg.roedel@amd.com>
+Date: Mon, 23 Nov 2009 12:50:00 +0100
+Subject: x86/amd-iommu: attach devices to pre-allocated domains early
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+commit be831297716036de5b24308447ecb69f1706a846 upstream.
+
+For some devices the ACPI table may define unity map
+requirements which must me met when the IOMMU is enabled. So
+we need to attach devices to their domains as early as
+possible so that these mappings are in place when needed.
+This patch assigns the domains right after they are
+allocated. Otherwise this can result in I/O page faults
+before a driver binds to a device and BIOS is still using
+it.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/amd_iommu.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/amd_iommu.c
++++ b/arch/x86/kernel/amd_iommu.c
+@@ -1873,10 +1873,10 @@ static void prealloc_protection_domains(
+ struct pci_dev *dev = NULL;
+ struct dma_ops_domain *dma_dom;
+ struct amd_iommu *iommu;
+- u16 devid;
++ u16 devid, __devid;
+
+ while ((dev = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, dev)) != NULL) {
+- devid = calc_devid(dev->bus->number, dev->devfn);
++ __devid = devid = calc_devid(dev->bus->number, dev->devfn);
+ if (devid > amd_iommu_last_bdf)
+ continue;
+ devid = amd_iommu_alias_table[devid];
+@@ -1891,6 +1891,10 @@ static void prealloc_protection_domains(
+ init_unity_mappings_for_device(dma_dom, devid);
+ dma_dom->target_dev = devid;
+
++ attach_device(iommu, &dma_dom->domain, devid);
++ if (__devid != devid)
++ attach_device(iommu, &dma_dom->domain, __devid);
++
+ list_add_tail(&dma_dom->list, &iommu_pd_list);
+ }
+ }
--- /dev/null
+From 9f800de38b05d84809e89f16671d636a140eede7 Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <joerg.roedel@amd.com>
+Date: Mon, 23 Nov 2009 12:45:25 +0100
+Subject: x86/amd-iommu: un__init iommu_setup_msi
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+commit 9f800de38b05d84809e89f16671d636a140eede7 upstream.
+
+This function may be called on the resume path and can not
+be dropped after booting.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/amd_iommu_init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/amd_iommu_init.c
++++ b/arch/x86/kernel/amd_iommu_init.c
+@@ -915,7 +915,7 @@ static int __init init_iommu_all(struct
+ *
+ ****************************************************************************/
+
+-static int __init iommu_setup_msi(struct amd_iommu *iommu)
++static int iommu_setup_msi(struct amd_iommu *iommu)
+ {
+ int r;
+
--- /dev/null
+From 7d1849aff6687a135a8da3a75e32a00e3137a5e2 Mon Sep 17 00:00:00 2001
+From: Mikael Pettersson <mikpe@it.uu.se>
+Date: Thu, 3 Dec 2009 15:52:44 +0100
+Subject: x86, apic: Enable lapic nmi watchdog on AMD Family 11h
+
+From: Mikael Pettersson <mikpe@it.uu.se>
+
+commit 7d1849aff6687a135a8da3a75e32a00e3137a5e2 upstream.
+
+The x86 lapic nmi watchdog does not recognize AMD Family 11h,
+resulting in:
+
+ NMI watchdog: CPU not supported
+
+As far as I can see from available documentation (the BKDM),
+family 11h looks identical to family 10h as far as the PMU
+is concerned.
+
+Extending the check to accept family 11h results in:
+
+ Testing NMI watchdog ... OK.
+
+I've been running with this change on a Turion X2 Ultra ZM-82
+laptop for a couple of weeks now without problems.
+
+Signed-off-by: Mikael Pettersson <mikpe@it.uu.se>
+Cc: Andreas Herrmann <andreas.herrmann3@amd.com>
+Cc: Joerg Roedel <joerg.roedel@amd.com>
+LKML-Reference: <19223.53436.931768.278021@pilspetsen.it.uu.se>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/perfctr-watchdog.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/perfctr-watchdog.c
++++ b/arch/x86/kernel/cpu/perfctr-watchdog.c
+@@ -711,7 +711,7 @@ static void probe_nmi_watchdog(void)
+ switch (boot_cpu_data.x86_vendor) {
+ case X86_VENDOR_AMD:
+ if (boot_cpu_data.x86 != 6 && boot_cpu_data.x86 != 15 &&
+- boot_cpu_data.x86 != 16)
++ boot_cpu_data.x86 != 16 && boot_cpu_data.x86 != 17)
+ return;
+ wd_ops = &k7_wd_ops;
+ break;
--- /dev/null
+From 4832ddda2ec4df96ea1eed334ae2dbd65fc1f541 Mon Sep 17 00:00:00 2001
+From: Leann Ogasawara <leann.ogasawara@canonical.com>
+Date: Fri, 4 Dec 2009 15:42:22 -0800
+Subject: x86: ASUS P4S800 reboot=bios quirk
+
+From: Leann Ogasawara <leann.ogasawara@canonical.com>
+
+commit 4832ddda2ec4df96ea1eed334ae2dbd65fc1f541 upstream.
+
+Bug reporter noted their system with an ASUS P4S800 motherboard would
+hang when rebooting unless reboot=b was specified. Their dmidecode
+didn't contain descriptive System Information for Manufacturer or
+Product Name, so I used their Base Board Information to create a
+reboot quirk patch. The bug reporter confirmed this patch resolves
+the reboot hang.
+
+Handle 0x0001, DMI type 1, 25 bytes
+System Information
+ Manufacturer: System Manufacturer
+ Product Name: System Name
+ Version: System Version
+ Serial Number: SYS-1234567890
+ UUID: E0BFCD8B-7948-D911-A953-E486B4EEB67F
+ Wake-up Type: Power Switch
+
+Handle 0x0002, DMI type 2, 8 bytes
+Base Board Information
+ Manufacturer: ASUSTeK Computer INC.
+ Product Name: P4S800
+ Version: REV 1.xx
+ Serial Number: xxxxxxxxxxx
+
+BugLink: http://bugs.launchpad.net/bugs/366682
+
+ASUS P4S800 will hang when rebooting unless reboot=b is specified.
+Add a quirk to reboot through the bios.
+
+Signed-off-by: Leann Ogasawara <leann.ogasawara@canonical.com>
+LKML-Reference: <1259972107.4629.275.camel@emiko>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/reboot.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -257,6 +257,14 @@ static struct dmi_system_id __initdata r
+ DMI_MATCH(DMI_PRODUCT_NAME, "SBC-FITPC2"),
+ },
+ },
++ { /* Handle problems with rebooting on ASUS P4S800 */
++ .callback = set_bios_reboot,
++ .ident = "ASUS P4S800",
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."),
++ DMI_MATCH(DMI_BOARD_NAME, "P4S800"),
++ },
++ },
+ { }
+ };
+
--- /dev/null
+From 4528752f49c1f4025473d12bc5fa9181085c3f22 Mon Sep 17 00:00:00 2001
+From: Darrick J. Wong <djwong@us.ibm.com>
+Date: Wed, 2 Dec 2009 15:05:56 -0800
+Subject: x86, Calgary IOMMU quirk: Find nearest matching Calgary while walking up the PCI tree
+
+From: Darrick J. Wong <djwong@us.ibm.com>
+
+commit 4528752f49c1f4025473d12bc5fa9181085c3f22 upstream.
+
+On a multi-node x3950M2 system, there's a slight oddity in the
+PCI device tree for all secondary nodes:
+
+ 30:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev e1)
+ \-33:00.0 PCI bridge: IBM CalIOC2 PCI-E Root Port (rev 01)
+ \-34:00.0 RAID bus controller: LSI Logic / Symbios Logic MegaRAID SAS 1078 (rev 04)
+
+...as compared to the primary node:
+
+ 00:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev e1)
+ \-01:00.0 VGA compatible controller: ATI Technologies Inc ES1000 (rev 02)
+ 03:00.0 PCI bridge: IBM CalIOC2 PCI-E Root Port (rev 01)
+ \-04:00.0 RAID bus controller: LSI Logic / Symbios Logic MegaRAID SAS 1078 (rev 04)
+
+In both nodes, the LSI RAID controller hangs off a CalIOC2
+device, but on the secondary nodes, the BIOS hides the VGA
+device and substitutes the device tree ending with the disk
+controller.
+
+It would seem that Calgary devices don't necessarily appear at
+the top of the PCI tree, which means that the current code to
+find the Calgary IOMMU that goes with a particular device is
+buggy.
+
+Rather than walk all the way to the top of the PCI
+device tree and try to match bus number with Calgary descriptor,
+the code needs to examine each parent of the particular device;
+if it encounters a Calgary with a matching bus number, simply
+use that.
+
+Otherwise, we BUG() when the bus number of the Calgary doesn't
+match the bus number of whatever's at the top of the device tree.
+
+Extra note: This patch appears to work correctly for the x3950
+that came before the x3950 M2.
+
+Signed-off-by: Darrick J. Wong <djwong@us.ibm.com>
+Acked-by: Muli Ben-Yehuda <muli@il.ibm.com>
+Cc: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Cc: Joerg Roedel <joerg.roedel@amd.com>
+Cc: Yinghai Lu <yhlu.kernel@gmail.com>
+Cc: Jon D. Mason <jdmason@kudzu.us>
+Cc: Corinna Schultz <coschult@us.ibm.com>
+LKML-Reference: <20091202230556.GG10295@tux1.beaverton.ibm.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/pci-calgary_64.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/arch/x86/kernel/pci-calgary_64.c
++++ b/arch/x86/kernel/pci-calgary_64.c
+@@ -318,13 +318,15 @@ static inline struct iommu_table *find_i
+
+ pdev = to_pci_dev(dev);
+
++ /* search up the device tree for an iommu */
+ pbus = pdev->bus;
+-
+- /* is the device behind a bridge? Look for the root bus */
+- while (pbus->parent)
++ do {
++ tbl = pci_iommu(pbus);
++ if (tbl && tbl->it_busno == pbus->number)
++ break;
++ tbl = NULL;
+ pbus = pbus->parent;
+-
+- tbl = pci_iommu(pbus);
++ } while (pbus);
+
+ BUG_ON(tbl && (tbl->it_busno != pbus->number));
+
--- /dev/null
+From 2ae8bb75db1f3de422eb5898f2a063c46c36dba8 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Mon, 26 Oct 2009 15:41:46 +0100
+Subject: x86: Fix iommu=nodac parameter handling
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 2ae8bb75db1f3de422eb5898f2a063c46c36dba8 upstream.
+
+iommu=nodac should forbid dac instead of enabling it. Fix it.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Acked-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Cc: Matteo Frigo <athena@fftw.org>
+LKML-Reference: <4AE5B52A.4050408@kernel.org>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/pci-dma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/pci-dma.c
++++ b/arch/x86/kernel/pci-dma.c
+@@ -203,7 +203,7 @@ static __init int iommu_setup(char *p)
+ if (!strncmp(p, "allowdac", 8))
+ forbid_dac = 0;
+ if (!strncmp(p, "nodac", 5))
+- forbid_dac = -1;
++ forbid_dac = 1;
+ if (!strncmp(p, "usedac", 6)) {
+ forbid_dac = -1;
+ return 1;
--- /dev/null
+From e02e0e1a130b9ca37c5186d38ad4b3aaf58bb149 Mon Sep 17 00:00:00 2001
+From: Dave Jones <davej@redhat.com>
+Date: Tue, 10 Nov 2009 15:01:20 -0500
+Subject: x86: Fix typo in Intel CPU cache size descriptor
+
+From: Dave Jones <davej@redhat.com>
+
+commit e02e0e1a130b9ca37c5186d38ad4b3aaf58bb149 upstream.
+
+I double-checked the datasheet. One of the existing
+descriptors has a typo: it should be 2MB not 2038 KB.
+
+Signed-off-by: Dave Jones <davej@redhat.com>
+Cc: <stable@kernel.org> # .3x.x: 85160b9: x86: Add new Intel CPU cache size descriptors
+Cc: <stable@kernel.org> # .3x.x
+LKML-Reference: <20091110200120.GA27090@redhat.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/intel_cacheinfo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/intel_cacheinfo.c
++++ b/arch/x86/kernel/cpu/intel_cacheinfo.c
+@@ -93,7 +93,7 @@ static const struct _cache_table __cpuin
+ { 0xd1, LVL_3, 1024 }, /* 4-way set assoc, 64 byte line size */
+ { 0xd2, LVL_3, 2048 }, /* 4-way set assoc, 64 byte line size */
+ { 0xd6, LVL_3, 1024 }, /* 8-way set assoc, 64 byte line size */
+- { 0xd7, LVL_3, 2038 }, /* 8-way set assoc, 64 byte line size */
++ { 0xd7, LVL_3, 2048 }, /* 8-way set assoc, 64 byte line size */
+ { 0xd8, LVL_3, 4096 }, /* 12-way set assoc, 64 byte line size */
+ { 0xdc, LVL_3, 2048 }, /* 12-way set assoc, 64 byte line size */
+ { 0xdd, LVL_3, 4096 }, /* 12-way set assoc, 64 byte line size */
--- /dev/null
+From 41855b77547fa18d90ed6a5d322983d3fdab1959 Mon Sep 17 00:00:00 2001
+From: Joe Perches <joe@perches.com>
+Date: Mon, 9 Nov 2009 17:58:50 -0800
+Subject: x86: GART: pci-gart_64.c: Use correct length in strncmp
+
+From: Joe Perches <joe@perches.com>
+
+commit 41855b77547fa18d90ed6a5d322983d3fdab1959 upstream.
+
+Signed-off-by: Joe Perches <joe@perches.com>
+LKML-Reference: <1257818330.12852.72.camel@Joe-Laptop.home>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/pci-gart_64.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/pci-gart_64.c
++++ b/arch/x86/kernel/pci-gart_64.c
+@@ -856,7 +856,7 @@ void __init gart_parse_options(char *p)
+ #endif
+ if (isdigit(*p) && get_option(&p, &arg))
+ iommu_size = arg;
+- if (!strncmp(p, "fullflush", 8))
++ if (!strncmp(p, "fullflush", 9))
+ iommu_fullflush = 1;
+ if (!strncmp(p, "nofullflush", 11))
+ iommu_fullflush = 0;
projects / thirdparty / kernel / stable-queue.git / commitdiff
