--- /dev/null
+From a534dbe96e9929c7245924d8252d89048c23d569 Mon Sep 17 00:00:00 2001
+From: Richard Kennedy <richard@rsk.demon.co.uk>
+Date: Wed, 14 Apr 2010 20:54:03 +0200
+Subject: block: ensure jiffies wrap is handled correctly in blk_rq_timed_out_timer
+
+From: Richard Kennedy <richard@rsk.demon.co.uk>
+
+commit a534dbe96e9929c7245924d8252d89048c23d569 upstream.
+
+blk_rq_timed_out_timer() relied on blk_add_timer() never returning a
+timer value of zero, but commit 7838c15b8dd18e78a523513749e5b54bda07b0cb
+removed the code that bumped this value when it was zero.
+Therefore when jiffies is near wrap we could get unlucky & not set the
+timeout value correctly.
+
+This patch uses a flag to indicate that the timeout value was set and so
+handles jiffies wrap correctly, and it keeps all the logic in one
+function so should be easier to maintain in the future.
+
+Signed-off-by: Richard Kennedy <richard@rsk.demon.co.uk>
+Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ block/blk-timeout.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+--- a/block/blk-timeout.c
++++ b/block/blk-timeout.c
+@@ -109,6 +109,7 @@ void blk_rq_timed_out_timer(unsigned lon
+ struct request_queue *q = (struct request_queue *) data;
+ unsigned long flags, next = 0;
+ struct request *rq, *tmp;
++ int next_set = 0;
+
+ spin_lock_irqsave(q->queue_lock, flags);
+
+@@ -122,16 +123,13 @@ void blk_rq_timed_out_timer(unsigned lon
+ if (blk_mark_rq_complete(rq))
+ continue;
+ blk_rq_timed_out(rq);
+- } else if (!next || time_after(next, rq->deadline))
++ } else if (!next_set || time_after(next, rq->deadline)) {
+ next = rq->deadline;
++ next_set = 1;
++ }
+ }
+
+- /*
+- * next can never be 0 here with the list non-empty, since we always
+- * bump ->deadline to 1 so we can detect if the timer was ever added
+- * or not. See comment in blk_add_timer()
+- */
+- if (next)
++ if (next_set)
+ mod_timer(&q->timeout, round_jiffies_up(next));
+
+ spin_unlock_irqrestore(q->queue_lock, flags);
--- /dev/null
+From e9162ab1610531d6ea6c1833daeb2613e44275e8 Mon Sep 17 00:00:00 2001
+From: Peter Korsgaard <jacmet@sunsite.dk>
+Date: Mon, 3 May 2010 10:01:26 +0000
+Subject: dm9601: fix phy/eeprom write routine
+
+From: Peter Korsgaard <jacmet@sunsite.dk>
+
+commit e9162ab1610531d6ea6c1833daeb2613e44275e8 upstream.
+
+Use correct bit positions in DM_SHARED_CTRL register for writes.
+
+Michael Planes recently encountered a 'KY-RS9600 USB-LAN converter', which
+came with a driver CD containing a Linux driver. This driver turns out to
+be a copy of dm9601.c with symbols renamed and my copyright stripped.
+That aside, it did contain 1 functional change in dm_write_shared_word(),
+and after checking the datasheet the original value was indeed wrong
+(read versus write bits).
+
+On Michaels HW, this change bumps receive speed from ~30KB/s to ~900KB/s.
+On other devices the difference is less spectacular, but still significant
+(~30%).
+
+Reported-by: Michael Planes <michael.planes@free.fr>
+Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/usb/dm9601.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/usb/dm9601.c
++++ b/drivers/net/usb/dm9601.c
+@@ -238,7 +238,7 @@ static int dm_write_shared_word(struct u
+ goto out;
+
+ dm_write_reg(dev, DM_SHARED_ADDR, phy ? (reg | 0x40) : reg);
+- dm_write_reg(dev, DM_SHARED_CTRL, phy ? 0x1c : 0x14);
++ dm_write_reg(dev, DM_SHARED_CTRL, phy ? 0x1a : 0x12);
+
+ for (i = 0; i < DM_TIMEOUT; i++) {
+ u8 tmp;
--- /dev/null
+From 35d824b28fc5544d1eb7c1e3db15a1740df8ec4b Mon Sep 17 00:00:00 2001
+From: Borislav Petkov <borislav.petkov@amd.com>
+Date: Fri, 30 Apr 2010 15:19:02 +0200
+Subject: edac, mce: Fix wrong mask and macro usage
+
+From: Borislav Petkov <borislav.petkov@amd.com>
+
+commit 35d824b28fc5544d1eb7c1e3db15a1740df8ec4b upstream.
+
+Correct two mishaps which prevented reporting error type (CECC vs UECC)
+and extended error description.
+
+Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/edac/edac_mce_amd.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/edac/edac_mce_amd.c
++++ b/drivers/edac/edac_mce_amd.c
+@@ -295,7 +295,6 @@ wrong_ls_mce:
+ void amd_decode_nb_mce(int node_id, struct err_regs *regs, int handle_errors)
+ {
+ u32 ec = ERROR_CODE(regs->nbsl);
+- u32 xec = EXT_ERROR_CODE(regs->nbsl);
+
+ if (!handle_errors)
+ return;
+@@ -319,7 +318,7 @@ void amd_decode_nb_mce(int node_id, stru
+ pr_cont("\n");
+ }
+
+- pr_emerg("%s.\n", EXT_ERR_MSG(xec));
++ pr_emerg("%s.\n", EXT_ERR_MSG(regs->nbsl));
+
+ if (BUS_ERROR(ec) && nb_bus_decoder)
+ nb_bus_decoder(node_id, regs);
+@@ -382,7 +381,7 @@ static void amd_decode_mce(struct mce *m
+ ((m->status & MCI_STATUS_PCC) ? "yes" : "no"));
+
+ /* do the two bits[14:13] together */
+- ecc = m->status & (3ULL << 45);
++ ecc = (m->status >> 45) & 0x3;
+ if (ecc)
+ pr_cont(", %sECC Error", ((ecc == 2) ? "C" : "U"));
+
--- /dev/null
+From b1d4b390ea4bb480e65974ce522a04022608a8df Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Tue, 4 May 2010 11:09:28 +0200
+Subject: i2c: Fix probing of FSC hardware monitoring chips
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit b1d4b390ea4bb480e65974ce522a04022608a8df upstream.
+
+Some FSC hardware monitoring chips (Syleus at least) doesn't like
+quick writes we typically use to probe for I2C chips. Use a regular
+byte read instead for the address they live at (0x73). These are the
+only known chips living at this address on PC systems.
+
+For clarity, this fix should not be needed for kernels 2.6.30 and
+later, as we started instantiating the hwmon devices explicitly based
+on DMI data. Still, this fix is valuable in the following two cases:
+* Support for recent FSC chips on older kernels. The DMI-based device
+ instantiation is more difficult to backport than the device support
+ itself.
+* Case where the DMI-based device instantiation fails, whatever the
+ reason. We fall back to probing in that case, so it should work.
+
+This fixes kernel bug #15634:
+https://bugzilla.kernel.org/show_bug.cgi?id=15634
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Acked-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ drivers/i2c/i2c-core.c | 24 +++++++++++++++++-------
+ 1 file changed, 17 insertions(+), 7 deletions(-)
+
+--- a/drivers/i2c/i2c-core.c
++++ b/drivers/i2c/i2c-core.c
+@@ -1202,14 +1202,24 @@ static int i2c_detect_address(struct i2c
+
+ /* Make sure there is something at this address, unless forced */
+ if (kind < 0) {
+- if (i2c_smbus_xfer(adapter, addr, 0, 0, 0,
+- I2C_SMBUS_QUICK, NULL) < 0)
+- return 0;
++ if (addr == 0x73 && (adapter->class & I2C_CLASS_HWMON)) {
++ /* Special probe for FSC hwmon chips */
++ union i2c_smbus_data dummy;
+
+- /* prevent 24RF08 corruption */
+- if ((addr & ~0x0f) == 0x50)
+- i2c_smbus_xfer(adapter, addr, 0, 0, 0,
+- I2C_SMBUS_QUICK, NULL);
++ if (i2c_smbus_xfer(adapter, addr, 0, I2C_SMBUS_READ, 0,
++ I2C_SMBUS_BYTE_DATA, &dummy) < 0)
++ return 0;
++ } else {
++ if (i2c_smbus_xfer(adapter, addr, 0, I2C_SMBUS_WRITE, 0,
++ I2C_SMBUS_QUICK, NULL) < 0)
++ return 0;
++
++ /* Prevent 24RF08 corruption */
++ if ((addr & ~0x0f) == 0x50)
++ i2c_smbus_xfer(adapter, addr, 0,
++ I2C_SMBUS_WRITE, 0,
++ I2C_SMBUS_QUICK, NULL);
++ }
+ }
+
+ /* Finally call the custom detection function */
--- /dev/null
+From d9e80b7de91db05c1c4d2e5ebbfd70b3b3ba0e0f Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@ZenIV.linux.org.uk>
+Date: Thu, 29 Apr 2010 03:10:43 +0100
+Subject: nfs d_revalidate() is too trigger-happy with d_drop()
+
+From: Al Viro <viro@ZenIV.linux.org.uk>
+
+commit d9e80b7de91db05c1c4d2e5ebbfd70b3b3ba0e0f upstream.
+
+If dentry found stale happens to be a root of disconnected tree, we
+can't d_drop() it; its d_hash is actually part of s_anon and d_drop()
+would simply hide it from shrink_dcache_for_umount(), leading to
+all sorts of fun, including busy inodes on umount and oopsen after
+that.
+
+Bug had been there since at least 2006 (commit c636eb already has it),
+so it's definitely -stable fodder.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/dir.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/nfs/dir.c
++++ b/fs/nfs/dir.c
+@@ -837,6 +837,8 @@ out_zap_parent:
+ /* If we have submounts, don't unhash ! */
+ if (have_submounts(dentry))
+ goto out_valid;
++ if (dentry->d_flags & DCACHE_DISCONNECTED)
++ goto out_valid;
+ shrink_dcache_parent(dentry);
+ }
+ d_drop(dentry);
--- /dev/null
+From 356e76b855bdbfd8d1c5e75bcf0c6bf0dfe83496 Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Thu, 22 Apr 2010 15:35:56 -0400
+Subject: NFS: rsize and wsize settings ignored on v4 mounts
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+commit 356e76b855bdbfd8d1c5e75bcf0c6bf0dfe83496 upstream.
+
+NFSv4 mounts ignore the rsize and wsize mount options, and always use
+the default transfer size for both. This seems to be because all
+NFSv4 mounts are now cloned, and the cloning logic doesn't copy the
+rsize and wsize settings from the parent nfs_server.
+
+I tested Fedora's 2.6.32.11-99 and it seems to have this problem as
+well, so I'm guessing that .33, .32, and perhaps older kernels have
+this issue as well.
+
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/client.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/nfs/client.c
++++ b/fs/nfs/client.c
+@@ -965,6 +965,8 @@ out_error:
+ static void nfs_server_copy_userdata(struct nfs_server *target, struct nfs_server *source)
+ {
+ target->flags = source->flags;
++ target->rsize = source->rsize;
++ target->wsize = source->wsize;
+ target->acregmin = source->acregmin;
+ target->acregmax = source->acregmax;
+ target->acdirmin = source->acdirmin;
--- /dev/null
+From a42ab8e1a37257da37e0f018e707bf365ac24531 Mon Sep 17 00:00:00 2001
+From: Joel Becker <joel.becker@oracle.com>
+Date: Wed, 31 Mar 2010 18:25:44 -0700
+Subject: ocfs2: Compute metaecc for superblocks during online resize.
+
+From: Joel Becker <joel.becker@oracle.com>
+
+commit a42ab8e1a37257da37e0f018e707bf365ac24531 upstream.
+
+Online resize writes out the new superblock and its backups directly.
+The metaecc data wasn't being recomputed. Let's do that directly.
+
+Signed-off-by: Joel Becker <joel.becker@oracle.com>
+Acked-by: Mark Fasheh <mfasheh@suse.com>[
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ocfs2/buffer_head_io.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/ocfs2/buffer_head_io.c
++++ b/fs/ocfs2/buffer_head_io.c
+@@ -407,6 +407,7 @@ int ocfs2_write_super_or_backup(struct o
+ struct buffer_head *bh)
+ {
+ int ret = 0;
++ struct ocfs2_dinode *di = (struct ocfs2_dinode *)bh->b_data;
+
+ mlog_entry_void();
+
+@@ -426,6 +427,7 @@ int ocfs2_write_super_or_backup(struct o
+
+ get_bh(bh); /* for end_buffer_write_sync() */
+ bh->b_end_io = end_buffer_write_sync;
++ ocfs2_compute_meta_ecc(osb->sb, bh->b_data, &di->i_check);
+ submit_bh(WRITE, bh);
+
+ wait_on_buffer(bh);
--- /dev/null
+From 0350cb078f5035716ebdad4ad4709d02fe466a8a Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <error27@gmail.com>
+Date: Thu, 22 Apr 2010 11:39:29 +0200
+Subject: ocfs2: potential ERR_PTR dereference on error paths
+
+From: Dan Carpenter <error27@gmail.com>
+
+commit 0350cb078f5035716ebdad4ad4709d02fe466a8a upstream.
+
+If "handle" is non null at the end of the function then we assume it's a
+valid pointer and pass it to ocfs2_commit_trans();
+
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: Joel Becker <joel.becker@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ocfs2/inode.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/ocfs2/inode.c
++++ b/fs/ocfs2/inode.c
+@@ -559,6 +559,7 @@ static int ocfs2_truncate_for_delete(str
+ handle = ocfs2_start_trans(osb, OCFS2_INODE_UPDATE_CREDITS);
+ if (IS_ERR(handle)) {
+ status = PTR_ERR(handle);
++ handle = NULL;
+ mlog_errno(status);
+ goto out;
+ }
--- /dev/null
+From c21a534e2f24968cf74976a4e721ac194db30ded Mon Sep 17 00:00:00 2001
+From: Tao Ma <tao.ma@oracle.com>
+Date: Wed, 21 Apr 2010 14:05:55 +0800
+Subject: ocfs2: Update VFS inode's id info after reflink.
+
+From: Tao Ma <tao.ma@oracle.com>
+
+commit c21a534e2f24968cf74976a4e721ac194db30ded upstream.
+
+In reflink we update the id info on the disk but forgot to update
+the corresponding information in the VFS inode. Update them
+accordingly when we want to preserve the attributes.
+
+Reported-by: Jeff Liu <jeff.liu@oracle.com>
+Signed-off-by: Tao Ma <tao.ma@oracle.com>
+Signed-off-by: Joel Becker <joel.becker@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ocfs2/refcounttree.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/ocfs2/refcounttree.c
++++ b/fs/ocfs2/refcounttree.c
+@@ -3995,6 +3995,9 @@ static int ocfs2_complete_reflink(struct
+ di->i_attr = s_di->i_attr;
+
+ if (preserve) {
++ t_inode->i_uid = s_inode->i_uid;
++ t_inode->i_gid = s_inode->i_gid;
++ t_inode->i_mode = s_inode->i_mode;
+ di->i_uid = s_di->i_uid;
+ di->i_gid = s_di->i_gid;
+ di->i_mode = s_di->i_mode;
--- /dev/null
+From a36d515c7a2dfacebcf41729f6812dbc424ebcf0 Mon Sep 17 00:00:00 2001
+From: Joel Becker <joel.becker@oracle.com>
+Date: Fri, 23 Apr 2010 15:24:59 -0700
+Subject: ocfs2_dlmfs: Fix math error when reading LVB.
+
+From: Joel Becker <joel.becker@oracle.com>
+
+commit a36d515c7a2dfacebcf41729f6812dbc424ebcf0 upstream.
+
+When asked for a partial read of the LVB in a dlmfs file, we can
+accidentally calculate a negative count.
+
+Reported-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: Joel Becker <joel.becker@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ocfs2/dlm/dlmfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/ocfs2/dlm/dlmfs.c
++++ b/fs/ocfs2/dlm/dlmfs.c
+@@ -205,7 +205,7 @@ static ssize_t dlmfs_file_read(struct fi
+ if ((count + *ppos) > i_size_read(inode))
+ readlen = i_size_read(inode) - *ppos;
+ else
+- readlen = count - *ppos;
++ readlen = count;
+
+ lvb_buf = kmalloc(readlen, GFP_NOFS);
+ if (!lvb_buf)
--- /dev/null
+From 0250ececdf6813457c98719e2d33b3684881fde0 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 22 Apr 2010 19:52:16 +0200
+Subject: p54pci: fix bugs in p54p_check_tx_ring
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 0250ececdf6813457c98719e2d33b3684881fde0 upstream.
+
+Hans de Goede identified a bug in p54p_check_tx_ring:
+
+there are two ring indices. 1 => tx data and 3 => tx management.
+But the old code had a constant "1" and this resulted in spurious
+dma unmapping failures.
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=583623
+Bug-Identified-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/p54/p54pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/p54/p54pci.c
++++ b/drivers/net/wireless/p54/p54pci.c
+@@ -237,7 +237,7 @@ static void p54p_check_tx_ring(struct ie
+ u32 idx, i;
+
+ i = (*index) % ring_limit;
+- (*index) = idx = le32_to_cpu(ring_control->device_idx[1]);
++ (*index) = idx = le32_to_cpu(ring_control->device_idx[ring_index]);
+ idx %= ring_limit;
+
+ while (i != idx) {
--- /dev/null
+From 048c852051d2bd5da54a4488bc1f16b0fc74c695 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Sat, 1 May 2010 10:11:35 +0200
+Subject: perf: Fix resource leak in failure path of perf_event_open()
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 048c852051d2bd5da54a4488bc1f16b0fc74c695 upstream.
+
+perf_event_open() kfrees event after init failure which doesn't
+release all resources allocated by perf_event_alloc(). Use
+free_event() instead.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Paul Mackerras <paulus@au1.ibm.com>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+LKML-Reference: <4BDBE237.1040809@kernel.org>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/perf_event.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/perf_event.c
++++ b/kernel/perf_event.c
+@@ -4609,7 +4609,7 @@ err_fput_free_put_context:
+
+ err_free_put_context:
+ if (err < 0)
+- kfree(event);
++ free_event(event);
+
+ err_put_context:
+ if (err < 0)
--- /dev/null
+From b810e94c9d8e3fff6741b66cd5a6f099a7887871 Mon Sep 17 00:00:00 2001
+From: Mark Langsdorf <mark.langsdorf@amd.com>
+Date: Wed, 31 Mar 2010 21:56:45 +0200
+Subject: powernow-k8: Fix frequency reporting
+
+From: Mark Langsdorf <mark.langsdorf@amd.com>
+
+commit b810e94c9d8e3fff6741b66cd5a6f099a7887871 upstream.
+
+With F10, model 10, all valid frequencies are in the ACPI _PST table.
+
+Signed-off-by: Mark Langsdorf <mark.langsdorf@amd.com>
+LKML-Reference: <1270065406-1814-6-git-send-email-bp@amd64.org>
+Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
+Reviewed-by: Thomas Renninger <trenn@suse.de>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/cpufreq/powernow-k8.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
++++ b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
+@@ -929,7 +929,8 @@ static int fill_powernow_table_pstate(st
+ powernow_table[i].index = index;
+
+ /* Frequency may be rounded for these */
+- if (boot_cpu_data.x86 == 0x10 || boot_cpu_data.x86 == 0x11) {
++ if ((boot_cpu_data.x86 == 0x10 && boot_cpu_data.x86_model < 10)
++ || boot_cpu_data.x86 == 0x11) {
+ powernow_table[i].frequency =
+ freq_from_fid_did(lo & 0x3f, (lo >> 6) & 7);
+ } else
--- /dev/null
+From 5157b4aa5b7de8787b6318e61bcc285031bb9088 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Tue, 4 May 2010 20:41:56 -0700
+Subject: raid6: fix recovery performance regression
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit 5157b4aa5b7de8787b6318e61bcc285031bb9088 upstream.
+
+The raid6 recovery code should immediately drop back to the optimized
+synchronous path when a p+q dma resource is not available. Otherwise we
+run the non-optimized/multi-pass async code in sync mode.
+
+Verified with raid6test (NDISKS=255)
+
+Applies to kernels >= 2.6.32.
+
+Acked-by: NeilBrown <neilb@suse.de>
+Reported-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ crypto/async_tx/async_raid6_recov.c | 21 +++++++++++++--------
+ 1 file changed, 13 insertions(+), 8 deletions(-)
+
+--- a/crypto/async_tx/async_raid6_recov.c
++++ b/crypto/async_tx/async_raid6_recov.c
+@@ -324,6 +324,7 @@ struct dma_async_tx_descriptor *
+ async_raid6_2data_recov(int disks, size_t bytes, int faila, int failb,
+ struct page **blocks, struct async_submit_ctl *submit)
+ {
++ void *scribble = submit->scribble;
+ int non_zero_srcs, i;
+
+ BUG_ON(faila == failb);
+@@ -332,11 +333,13 @@ async_raid6_2data_recov(int disks, size_
+
+ pr_debug("%s: disks: %d len: %zu\n", __func__, disks, bytes);
+
+- /* we need to preserve the contents of 'blocks' for the async
+- * case, so punt to synchronous if a scribble buffer is not available
++ /* if a dma resource is not available or a scribble buffer is not
++ * available punt to the synchronous path. In the 'dma not
++ * available' case be sure to use the scribble buffer to
++ * preserve the content of 'blocks' as the caller intended.
+ */
+- if (!submit->scribble) {
+- void **ptrs = (void **) blocks;
++ if (!async_dma_find_channel(DMA_PQ) || !scribble) {
++ void **ptrs = scribble ? scribble : (void **) blocks;
+
+ async_tx_quiesce(&submit->depend_tx);
+ for (i = 0; i < disks; i++)
+@@ -406,11 +409,13 @@ async_raid6_datap_recov(int disks, size_
+
+ pr_debug("%s: disks: %d len: %zu\n", __func__, disks, bytes);
+
+- /* we need to preserve the contents of 'blocks' for the async
+- * case, so punt to synchronous if a scribble buffer is not available
++ /* if a dma resource is not available or a scribble buffer is not
++ * available punt to the synchronous path. In the 'dma not
++ * available' case be sure to use the scribble buffer to
++ * preserve the content of 'blocks' as the caller intended.
+ */
+- if (!scribble) {
+- void **ptrs = (void **) blocks;
++ if (!async_dma_find_channel(DMA_PQ) || !scribble) {
++ void **ptrs = scribble ? scribble : (void **) blocks;
+
+ async_tx_quiesce(&submit->depend_tx);
+ for (i = 0; i < disks; i++)
--- /dev/null
+From d9901660b53b92f0f3551c06588b8be38224b245 Mon Sep 17 00:00:00 2001
+From: Ping Cheng <pingc@wacom.com>
+Date: Mon, 22 Mar 2010 13:40:29 -0700
+Subject: serial: 8250_pnp - add Fujitsu Wacom device
+
+From: Ping Cheng <pingc@wacom.com>
+
+commit d9901660b53b92f0f3551c06588b8be38224b245 upstream.
+
+Add Fujitsu Wacom 1FGT Tablet PC device
+
+Signed-off-by: Ping Cheng <pingc@wacom.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/serial/8250_pnp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/serial/8250_pnp.c
++++ b/drivers/serial/8250_pnp.c
+@@ -348,6 +348,8 @@ static const struct pnp_device_id pnp_de
+ { "FUJ02E6", 0 },
+ /* Fujitsu Wacom 2FGT Tablet PC device */
+ { "FUJ02E7", 0 },
++ /* Fujitsu Wacom 1FGT Tablet PC device */
++ { "FUJ02E9", 0 },
+ /*
+ * LG C1 EXPRESS DUAL (C1-PB11A3) touch screen (actually a FUJ02E6 in
+ * disguise)
usb-xhci-properly-set-the-mult-field-of-the-endpoint-context.patch
usb-xhci-properly-set-endpoint-context-fields-for-periodic-eps.patch
procfs-fix-tid-fdinfo.patch
+ocfs2-update-vfs-inode-s-id-info-after-reflink.patch
+ocfs2-potential-err_ptr-dereference-on-error-paths.patch
+ocfs2-compute-metaecc-for-superblocks-during-online-resize.patch
+ocfs2_dlmfs-fix-math-error-when-reading-lvb.patch
+powernow-k8-fix-frequency-reporting.patch
+nfs-d_revalidate-is-too-trigger-happy-with-d_drop.patch
+nfs-rsize-and-wsize-settings-ignored-on-v4-mounts.patch
+staging-hv-fix-a-bug-affecting-ipv6.patch
+staging-hv-fix-up-memory-leak-on-hvcleanup.patch
+staging-hv-name-network-device-ethx-rather-than-sethx.patch
+i2c-fix-probing-of-fsc-hardware-monitoring-chips.patch
+perf-fix-resource-leak-in-failure-path-of-perf_event_open.patch
+raid6-fix-recovery-performance-regression.patch
+serial-8250_pnp-add-fujitsu-wacom-device.patch
+block-ensure-jiffies-wrap-is-handled-correctly-in-blk_rq_timed_out_timer.patch
+dm9601-fix-phy-eeprom-write-routine.patch
+p54pci-fix-bugs-in-p54p_check_tx_ring.patch
+edac-mce-fix-wrong-mask-and-macro-usage.patch
+x86-64-clear-a-64-bit-fs-gs-base-on-fork-if-selector-is-nonzero.patch
+x86-disable-large-pages-on-cpus-with-atom-erratum-aae44.patch
+x86-k8-nb-fix-boot-crash-enable-k8_northbridges-unconditionally-on-amd-systems.patch
+x86-amd-fix-stale-cpuid4_info-shared_map-data-in-shared_cpu_map-cpumasks.patch
--- /dev/null
+From 95beae90aa4afce57fb28e6f8238b78217bd7c98 Mon Sep 17 00:00:00 2001
+From: Haiyang Zhang <haiyangz@microsoft.com>
+Date: Mon, 19 Apr 2010 15:32:11 +0000
+Subject: Staging: hv: Fix a bug affecting IPv6
+
+From: Haiyang Zhang <haiyangz@microsoft.com>
+
+commit 95beae90aa4afce57fb28e6f8238b78217bd7c98 upstream.
+
+Fix a bug affecting IPv6
+Added the multicast flag for proper IPv6 function.
+
+Reported-by: Toshikazu Sakai <toshikas@microsoft.com>
+Signed-off-by: Hank Janssen <hjanssen@microsoft.com>
+Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/hv/RndisFilter.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/staging/hv/RndisFilter.c
++++ b/drivers/staging/hv/RndisFilter.c
+@@ -756,6 +756,7 @@ static int RndisFilterOpenDevice(struct
+
+ ret = RndisFilterSetPacketFilter(Device,
+ NDIS_PACKET_TYPE_BROADCAST |
++ NDIS_PACKET_TYPE_ALL_MULTICAST |
+ NDIS_PACKET_TYPE_DIRECTED);
+ if (ret == 0)
+ Device->State = RNDIS_DEV_DATAINITIALIZED;
--- /dev/null
+From fa8ad0257ea256381126ecf447694622216c600f Mon Sep 17 00:00:00 2001
+From: Cyrill Gorcunov <gorcunov@openvz.org>
+Date: Mon, 5 Apr 2010 20:56:57 +0400
+Subject: Staging: hv: Fix up memory leak on HvCleanup
+
+From: Cyrill Gorcunov <gorcunov@openvz.org>
+
+commit fa8ad0257ea256381126ecf447694622216c600f upstream.
+
+Don't assign NULL too early
+
+Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
+Cc: Hank Janssen <hjanssen@microsoft.com>
+Cc: Haiyang Zhang <haiyangz@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/hv/Hv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/hv/Hv.c
++++ b/drivers/staging/hv/Hv.c
+@@ -306,9 +306,9 @@ void HvCleanup(void)
+ DPRINT_ENTER(VMBUS);
+
+ if (gHvContext.SignalEventBuffer) {
++ kfree(gHvContext.SignalEventBuffer);
+ gHvContext.SignalEventBuffer = NULL;
+ gHvContext.SignalEventParam = NULL;
+- kfree(gHvContext.SignalEventBuffer);
+ }
+
+ if (gHvContext.GuestId == HV_LINUX_GUEST_ID) {
--- /dev/null
+From 546d9e101e7a71e6202f47a13ddcd9b8fb05a52e Mon Sep 17 00:00:00 2001
+From: Stephen Hemminger <shemminger@vyatta.com>
+Date: Thu, 11 Mar 2010 09:11:37 -0800
+Subject: Staging: hv: name network device ethX rather than sethX
+
+From: Stephen Hemminger <shemminger@vyatta.com>
+
+commit 546d9e101e7a71e6202f47a13ddcd9b8fb05a52e upstream.
+
+This patch makes the HyperV network device use the same naming scheme as
+other virtual drivers (Xen, KVM). In an ideal world, userspace tools
+would not care what the name is, but some users and applications do
+care. Vyatta CLI is one of the tools that does depend on what the name
+is.
+
+Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
+Cc: Hank Janssen <hjanssen@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/hv/netvsc_drv.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/staging/hv/netvsc_drv.c
++++ b/drivers/staging/hv/netvsc_drv.c
+@@ -413,8 +413,7 @@ static int netvsc_probe(struct device *d
+ if (!net_drv_obj->Base.OnDeviceAdd)
+ return -1;
+
+- net = alloc_netdev(sizeof(struct net_device_context), "seth%d",
+- ether_setup);
++ net = alloc_etherdev(sizeof(struct net_device_context));
+ if (!net)
+ return -1;
+
--- /dev/null
+From 7ce5a2b9bb2e92902230e3121d8c3047fab9cb47 Mon Sep 17 00:00:00 2001
+From: H. Peter Anvin <hpa@zytor.com>
+Date: Fri, 23 Apr 2010 16:17:40 -0700
+Subject: x86-64: Clear a 64-bit FS/GS base on fork if selector is nonzero
+
+From: H. Peter Anvin <hpa@zytor.com>
+
+commit 7ce5a2b9bb2e92902230e3121d8c3047fab9cb47 upstream.
+
+When we do a thread switch, we clear the outgoing FS/GS base if the
+corresponding selector is nonzero. This is taken by __switch_to() as
+an entry invariant; it does not verify that it is true on entry.
+However, copy_thread() doesn't enforce this constraint, which can
+result in inconsistent results after fork().
+
+Make copy_thread() match the behavior of __switch_to().
+
+Reported-and-tested-by: Samuel Thibault <samuel.thibault@inria.fr>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+LKML-Reference: <4BD1E061.8030605@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/process_64.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/kernel/process_64.c
++++ b/arch/x86/kernel/process_64.c
+@@ -295,11 +295,10 @@ int copy_thread(unsigned long clone_flag
+
+ set_tsk_thread_flag(p, TIF_FORK);
+
+- p->thread.fs = me->thread.fs;
+- p->thread.gs = me->thread.gs;
+-
+ savesegment(gs, p->thread.gsindex);
++ p->thread.gs = p->thread.gsindex ? 0 : me->thread.gs;
+ savesegment(fs, p->thread.fsindex);
++ p->thread.fs = p->thread.fsindex ? 0 : me->thread.fs;
+ savesegment(es, p->thread.es);
+ savesegment(ds, p->thread.ds);
+
--- /dev/null
+From ebb682f522411abbe358059a256a8672ec0bd55b Mon Sep 17 00:00:00 2001
+From: Prarit Bhargava <prarit@redhat.com>
+Date: Wed, 9 Dec 2009 13:36:45 -0500
+Subject: x86, AMD: Fix stale cpuid4_info shared_map data in shared_cpu_map cpumasks
+
+From: Prarit Bhargava <prarit@redhat.com>
+
+commit ebb682f522411abbe358059a256a8672ec0bd55b upstream.
+
+The per_cpu cpuid4_info shared_map can contain stale data when CPUs are added
+and removed.
+
+The stale data can lead to a NULL pointer derefernce panic on a remove of a
+CPU that has had siblings previously removed.
+
+This patch resolves the panic by verifying a cpu is actually online before
+adding it to the shared_cpu_map, only examining cpus that are part of
+the same lower level cache, and by updating other siblings lowest level cache
+maps when a cpu is added.
+
+Signed-off-by: Prarit Bhargava <prarit@redhat.com>
+LKML-Reference: <20091209183336.17855.98708.sendpatchset@prarit.bos.redhat.com>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/intel_cacheinfo.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/arch/x86/kernel/cpu/intel_cacheinfo.c
++++ b/arch/x86/kernel/cpu/intel_cacheinfo.c
+@@ -647,18 +647,19 @@ static void __cpuinit cache_shared_cpu_m
+ {
+ struct _cpuid4_info *this_leaf, *sibling_leaf;
+ unsigned long num_threads_sharing;
+- int index_msb, i;
++ int index_msb, i, sibling;
+ struct cpuinfo_x86 *c = &cpu_data(cpu);
+
+ if ((index == 3) && (c->x86_vendor == X86_VENDOR_AMD)) {
+- struct cpuinfo_x86 *d;
+- for_each_online_cpu(i) {
++ for_each_cpu(i, c->llc_shared_map) {
+ if (!per_cpu(cpuid4_info, i))
+ continue;
+- d = &cpu_data(i);
+ this_leaf = CPUID4_INFO_IDX(i, index);
+- cpumask_copy(to_cpumask(this_leaf->shared_cpu_map),
+- d->llc_shared_map);
++ for_each_cpu(sibling, c->llc_shared_map) {
++ if (!cpu_online(sibling))
++ continue;
++ set_bit(sibling, this_leaf->shared_cpu_map);
++ }
+ }
+ return;
+ }
--- /dev/null
+From 7a0fc404ae663776e96db43879a0fa24fec1fa3a Mon Sep 17 00:00:00 2001
+From: H. Peter Anvin <hpa@linux.intel.com>
+Date: Tue, 13 Apr 2010 14:40:54 -0700
+Subject: x86: Disable large pages on CPUs with Atom erratum AAE44
+
+From: H. Peter Anvin <hpa@linux.intel.com>
+
+commit 7a0fc404ae663776e96db43879a0fa24fec1fa3a upstream.
+
+Atom erratum AAE44/AAF40/AAG38/AAH41:
+
+"If software clears the PS (page size) bit in a present PDE (page
+directory entry), that will cause linear addresses mapped through this
+PDE to use 4-KByte pages instead of using a large page after old TLB
+entries are invalidated. Due to this erratum, if a code fetch uses
+this PDE before the TLB entry for the large page is invalidated then
+it may fetch from a different physical address than specified by
+either the old large page translation or the new 4-KByte page
+translation. This erratum may also cause speculative code fetches from
+incorrect addresses."
+
+[http://download.intel.com/design/processor/specupdt/319536.pdf]
+
+Where as commit 211b3d03c7400f48a781977a50104c9d12f4e229 seems to
+workaround errata AAH41 (mixed 4K TLBs) it reduces the window of
+opportunity for the bug to occur and does not totally remove it. This
+patch disables mixed 4K/4MB page tables totally avoiding the page
+splitting and not tripping this processor issue.
+
+This is based on an original patch by Colin King.
+
+Originally-by: Colin Ian King <colin.king@canonical.com>
+Cc: Colin Ian King <colin.king@canonical.com>
+Cc: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+LKML-Reference: <1269271251-19775-1-git-send-email-colin.king@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/intel.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+--- a/arch/x86/kernel/cpu/intel.c
++++ b/arch/x86/kernel/cpu/intel.c
+@@ -47,6 +47,27 @@ static void __cpuinit early_init_intel(s
+ (c->x86 == 0x6 && c->x86_model >= 0x0e))
+ set_cpu_cap(c, X86_FEATURE_CONSTANT_TSC);
+
++ /*
++ * Atom erratum AAE44/AAF40/AAG38/AAH41:
++ *
++ * A race condition between speculative fetches and invalidating
++ * a large page. This is worked around in microcode, but we
++ * need the microcode to have already been loaded... so if it is
++ * not, recommend a BIOS update and disable large pages.
++ */
++ if (c->x86 == 6 && c->x86_model == 0x1c && c->x86_mask <= 2) {
++ u32 ucode, junk;
++
++ wrmsr(MSR_IA32_UCODE_REV, 0, 0);
++ sync_core();
++ rdmsr(MSR_IA32_UCODE_REV, junk, ucode);
++
++ if (ucode < 0x20e) {
++ printk(KERN_WARNING "Atom PSE erratum detected, BIOS microcode update recommended\n");
++ clear_cpu_cap(c, X86_FEATURE_PSE);
++ }
++ }
++
+ #ifdef CONFIG_X86_64
+ set_cpu_cap(c, X86_FEATURE_SYSENTER32);
+ #else
--- /dev/null
+From 0e152cd7c16832bd5cadee0c2e41d9959bc9b6f9 Mon Sep 17 00:00:00 2001
+From: Borislav Petkov <bp@amd64.org>
+Date: Fri, 12 Mar 2010 15:43:03 +0100
+Subject: x86, k8 nb: Fix boot crash: enable k8_northbridges unconditionally on AMD systems
+
+From: Borislav Petkov <bp@amd64.org>
+
+commit 0e152cd7c16832bd5cadee0c2e41d9959bc9b6f9 upstream.
+
+de957628ce7c84764ff41331111036b3ae5bad0f changed setting of the
+x86_init.iommu.iommu_init function ptr only when GART IOMMU is
+found.
+
+One side effect of it is that num_k8_northbridges
+is not initialized anymore if not explicitly
+called. This resulted in uninitialized pointers in
+<arch/x86/kernel/cpu/intel_cacheinfo.c:amd_calc_l3_indices()>,
+for example, which uses the num_k8_northbridges thing through
+node_to_k8_nb_misc().
+
+Fix that through an initcall that runs right after the PCI
+subsystem and does all the scanning. Then, remove initialization
+in gart_iommu_init() which is a rootfs_initcall and we're
+running before that.
+
+What is more, since num_k8_northbridges is being used in other
+places beside GART IOMMU, include it whenever we add AMD CPU
+support. The previous dependency chain in kconfig contained
+
+K8_NB depends on AGP_AMD64|GART_IOMMU
+
+which was clearly incorrect. The more natural way in terms of
+hardware dependency should be
+
+AGP_AMD64|GART_IOMMU depends on K8_NB depends on CPU_SUP_AMD &&
+PCI. Make it so Number One!
+
+Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
+Cc: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Cc: Joerg Roedel <joerg.roedel@amd.com>
+LKML-Reference: <20100312144303.GA29262@aftab>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Tested-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/Kconfig | 4 ++--
+ arch/x86/kernel/k8.c | 14 ++++++++++++++
+ arch/x86/kernel/pci-gart_64.c | 2 +-
+ drivers/char/agp/Kconfig | 2 +-
+ 4 files changed, 18 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -622,7 +622,7 @@ config GART_IOMMU
+ bool "GART IOMMU support" if EMBEDDED
+ default y
+ select SWIOTLB
+- depends on X86_64 && PCI
++ depends on X86_64 && PCI && K8_NB
+ ---help---
+ Support for full DMA access of devices with 32bit memory access only
+ on systems with more than 3GB. This is usually needed for USB,
+@@ -2027,7 +2027,7 @@ endif # X86_32
+
+ config K8_NB
+ def_bool y
+- depends on AGP_AMD64 || (X86_64 && (GART_IOMMU || (PCI && NUMA)))
++ depends on CPU_SUP_AMD && PCI
+
+ source "drivers/pcmcia/Kconfig"
+
+--- a/arch/x86/kernel/k8.c
++++ b/arch/x86/kernel/k8.c
+@@ -121,3 +121,17 @@ void k8_flush_garts(void)
+ }
+ EXPORT_SYMBOL_GPL(k8_flush_garts);
+
++static __init int init_k8_nbs(void)
++{
++ int err = 0;
++
++ err = cache_k8_northbridges();
++
++ if (err < 0)
++ printk(KERN_NOTICE "K8 NB: Cannot enumerate AMD northbridges.\n");
++
++ return err;
++}
++
++/* This has to go after the PCI subsystem */
++fs_initcall(init_k8_nbs);
+--- a/arch/x86/kernel/pci-gart_64.c
++++ b/arch/x86/kernel/pci-gart_64.c
+@@ -720,7 +720,7 @@ void __init gart_iommu_init(void)
+ unsigned long scratch;
+ long i;
+
+- if (cache_k8_northbridges() < 0 || num_k8_northbridges == 0)
++ if (num_k8_northbridges == 0)
+ return;
+
+ #ifndef CONFIG_AGP_AMD64
+--- a/drivers/char/agp/Kconfig
++++ b/drivers/char/agp/Kconfig
+@@ -57,7 +57,7 @@ config AGP_AMD
+
+ config AGP_AMD64
+ tristate "AMD Opteron/Athlon64 on-CPU GART support" if !GART_IOMMU
+- depends on AGP && X86
++ depends on AGP && X86 && K8_NB
+ default y if GART_IOMMU
+ help
+ This option gives you AGP support for the GLX component of
projects / thirdparty / kernel / stable-queue.git / commitdiff
