--- /dev/null
+From 208a261aaebd90a719c916b5858bbf95d698b20b Mon Sep 17 00:00:00 2001
+From: Luis R. Rodriguez <lrodriguez@atheros.com>
+Date: Thu, 11 Mar 2010 10:58:35 -0800
+Subject: ath9k: add support for 802.11n bonded out AR2427
+
+From: Luis R. Rodriguez <lrodriguez@atheros.com>
+
+This is a backport of of upstream commit:
+
+5ffaf8a361b4c9025963959a744f21d8173c7669
+
+Some single chip family devices are sold in the market with
+802.11n bonded out, these have no hardware capability for
+02.11n but ath9k can still support them. These are called
+AR2427.
+
+Reported-by: Rolf Leggewie <bugzilla.kernel.org@rolf.leggewie.biz>
+Tested-by: Bernhard Reiter <ockham@raz.or.at>
+Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/hw.c | 7 ++++++-
+ drivers/net/wireless/ath/ath9k/hw.h | 1 +
+ drivers/net/wireless/ath/ath9k/main.c | 4 +++-
+ drivers/net/wireless/ath/ath9k/pci.c | 1 +
+ 4 files changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -380,7 +380,6 @@ static void ath9k_hw_init_config(struct
+ ah->config.pcie_clock_req = 0;
+ ah->config.pcie_waen = 0;
+ ah->config.analog_shiftreg = 1;
+- ah->config.ht_enable = 1;
+ ah->config.ofdm_trig_low = 200;
+ ah->config.ofdm_trig_high = 500;
+ ah->config.cck_trig_high = 200;
+@@ -392,6 +391,11 @@ static void ath9k_hw_init_config(struct
+ ah->config.spurchans[i][1] = AR_NO_SPUR;
+ }
+
++ if (ah->hw_version.devid != AR2427_DEVID_PCIE)
++ ah->config.ht_enable = 1;
++ else
++ ah->config.ht_enable = 0;
++
+ ah->config.intr_mitigation = true;
+
+ /*
+@@ -590,6 +594,7 @@ static bool ath9k_hw_devid_supported(u16
+ case AR5416_DEVID_AR9287_PCI:
+ case AR5416_DEVID_AR9287_PCIE:
+ case AR9271_USB:
++ case AR2427_DEVID_PCIE:
+ return true;
+ default:
+ break;
+--- a/drivers/net/wireless/ath/ath9k/hw.h
++++ b/drivers/net/wireless/ath/ath9k/hw.h
+@@ -40,6 +40,7 @@
+ #define AR9280_DEVID_PCI 0x0029
+ #define AR9280_DEVID_PCIE 0x002a
+ #define AR9285_DEVID_PCIE 0x002b
++#define AR2427_DEVID_PCIE 0x002c
+
+ #define AR5416_AR9100_DEVID 0x000b
+
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1854,11 +1854,13 @@ void ath_set_hw_capab(struct ath_softc *
+ hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
+ IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
+ IEEE80211_HW_SIGNAL_DBM |
+- IEEE80211_HW_AMPDU_AGGREGATION |
+ IEEE80211_HW_SUPPORTS_PS |
+ IEEE80211_HW_PS_NULLFUNC_STACK |
+ IEEE80211_HW_SPECTRUM_MGMT;
+
++ if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT)
++ hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
++
+ if (AR_SREV_9160_10_OR_LATER(sc->sc_ah) || modparam_nohwcrypt)
+ hw->flags |= IEEE80211_HW_MFP_CAPABLE;
+
+--- a/drivers/net/wireless/ath/ath9k/pci.c
++++ b/drivers/net/wireless/ath/ath9k/pci.c
+@@ -25,6 +25,7 @@ static struct pci_device_id ath_pci_id_t
+ { PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI */
+ { PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */
+ { PCI_VDEVICE(ATHEROS, 0x002B) }, /* PCI-E */
++ { PCI_VDEVICE(ATHEROS, 0x002C) }, /* PCI-E 802.11n bonded out */
+ { PCI_VDEVICE(ATHEROS, 0x002D) }, /* PCI */
+ { PCI_VDEVICE(ATHEROS, 0x002E) }, /* PCI-E */
+ { 0 }
--- /dev/null
+From a9f042cbe5284f34ccff15f3084477e11b39b17b Mon Sep 17 00:00:00 2001
+From: Ming Lei <tom.leiming@gmail.com>
+Date: Sun, 28 Feb 2010 00:56:24 +0800
+Subject: ath9k: fix lockdep warning when unloading module
+
+From: Ming Lei <tom.leiming@gmail.com>
+
+commit a9f042cbe5284f34ccff15f3084477e11b39b17b upstream.
+
+Since txq->axq_lock may be hold in softirq context, it must be
+acquired with spin_lock_bh() instead of spin_lock() if softieq is
+enabled.
+
+The patch fixes the lockdep warning below when unloading ath9k modules.
+
+=================================
+[ INFO: inconsistent lock state ]
+2.6.33-wl #12
+---------------------------------
+inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage.
+rmmod/3642 [HC0[0]:SC0[0]:HE1:SE1] takes:
+ (&(&txq->axq_lock)->rlock){+.?...}, at: [<ffffffffa03568c3>] ath_tx_node_cleanup+0x62/0x180 [ath9k]
+{IN-SOFTIRQ-W} state was registered at:
+ [<ffffffff8107577d>] __lock_acquire+0x2f6/0xd35
+ [<ffffffff81076289>] lock_acquire+0xcd/0xf1
+ [<ffffffff813a7486>] _raw_spin_lock_bh+0x3b/0x6e
+ [<ffffffffa0356b49>] spin_lock_bh+0xe/0x10 [ath9k]
+ [<ffffffffa0358ec7>] ath_tx_tasklet+0xcd/0x391 [ath9k]
+ [<ffffffffa0354f5f>] ath9k_tasklet+0x70/0xc8 [ath9k]
+ [<ffffffff8104e601>] tasklet_action+0x8c/0xf4
+ [<ffffffff8104f459>] __do_softirq+0xf8/0x1cd
+ [<ffffffff8100ab1c>] call_softirq+0x1c/0x30
+ [<ffffffff8100c2cf>] do_softirq+0x4b/0xa3
+ [<ffffffff8104f045>] irq_exit+0x4a/0x8c
+ [<ffffffff813acccc>] do_IRQ+0xac/0xc3
+ [<ffffffff813a7d53>] ret_from_intr+0x0/0x16
+ [<ffffffff81302d52>] cpuidle_idle_call+0x9e/0xf8
+ [<ffffffff81008be7>] cpu_idle+0x62/0x9d
+ [<ffffffff81391c1a>] rest_init+0x7e/0x80
+ [<ffffffff818bbd38>] start_kernel+0x3e8/0x3f3
+ [<ffffffff818bb2bc>] x86_64_start_reservations+0xa7/0xab
+ [<ffffffff818bb3b8>] x86_64_start_kernel+0xf8/0x107
+irq event stamp: 42037
+hardirqs last enabled at (42037): [<ffffffff813a7b21>] _raw_spin_unlock_irqrestore+0x47/0x56
+hardirqs last disabled at (42036): [<ffffffff813a72f4>] _raw_spin_lock_irqsave+0x2b/0x88
+softirqs last enabled at (42000): [<ffffffffa0353ea6>] spin_unlock_bh+0xe/0x10 [ath9k]
+softirqs last disabled at (41998): [<ffffffff813a7463>] _raw_spin_lock_bh+0x18/0x6e
+
+other info that might help us debug this:
+4 locks held by rmmod/3642:
+ #0: (rtnl_mutex){+.+.+.}, at: [<ffffffff8132c10d>] rtnl_lock+0x17/0x19
+ #1: (&wdev->mtx){+.+.+.}, at: [<ffffffffa01e53f2>] cfg80211_netdev_notifier_call+0x28d/0x46d [cfg80211]
+ #2: (&ifmgd->mtx){+.+.+.}, at: [<ffffffffa0260834>] ieee80211_mgd_deauth+0x3f/0x17e [mac80211]
+ #3: (&local->sta_mtx){+.+.+.}, at: [<ffffffffa025a381>] sta_info_destroy_addr+0x2b/0x5e [mac80211]
+
+stack backtrace:
+Pid: 3642, comm: rmmod Not tainted 2.6.33-wl #12
+Call Trace:
+ [<ffffffff81074469>] valid_state+0x178/0x18b
+ [<ffffffff81014f94>] ? save_stack_trace+0x2f/0x4c
+ [<ffffffff81074e08>] ? check_usage_backwards+0x0/0x88
+ [<ffffffff8107458f>] mark_lock+0x113/0x230
+ [<ffffffff810757f1>] __lock_acquire+0x36a/0xd35
+ [<ffffffff8101018d>] ? native_sched_clock+0x2d/0x5f
+ [<ffffffffa03568c3>] ? ath_tx_node_cleanup+0x62/0x180 [ath9k]
+ [<ffffffff81076289>] lock_acquire+0xcd/0xf1
+ [<ffffffffa03568c3>] ? ath_tx_node_cleanup+0x62/0x180 [ath9k]
+ [<ffffffff810732eb>] ? trace_hardirqs_off+0xd/0xf
+ [<ffffffff813a7193>] _raw_spin_lock+0x36/0x69
+ [<ffffffffa03568c3>] ? ath_tx_node_cleanup+0x62/0x180 [ath9k]
+ [<ffffffffa03568c3>] ath_tx_node_cleanup+0x62/0x180 [ath9k]
+ [<ffffffff810749ed>] ? trace_hardirqs_on+0xd/0xf
+ [<ffffffffa0353950>] ath9k_sta_remove+0x22/0x26 [ath9k]
+ [<ffffffffa025a08f>] __sta_info_destroy+0x1ad/0x38c [mac80211]
+ [<ffffffffa025a394>] sta_info_destroy_addr+0x3e/0x5e [mac80211]
+ [<ffffffffa02605d6>] ieee80211_set_disassoc+0x175/0x180 [mac80211]
+ [<ffffffffa026084d>] ieee80211_mgd_deauth+0x58/0x17e [mac80211]
+ [<ffffffff813a60c1>] ? __mutex_lock_common+0x37f/0x3a4
+ [<ffffffffa01e53f2>] ? cfg80211_netdev_notifier_call+0x28d/0x46d [cfg80211]
+ [<ffffffffa026786e>] ieee80211_deauth+0x1e/0x20 [mac80211]
+ [<ffffffffa01f47f9>] __cfg80211_mlme_deauth+0x130/0x13f [cfg80211]
+ [<ffffffffa01e53f2>] ? cfg80211_netdev_notifier_call+0x28d/0x46d [cfg80211]
+ [<ffffffff810732eb>] ? trace_hardirqs_off+0xd/0xf
+ [<ffffffffa01f7eee>] __cfg80211_disconnect+0x111/0x189 [cfg80211]
+ [<ffffffffa01e5433>] cfg80211_netdev_notifier_call+0x2ce/0x46d [cfg80211]
+ [<ffffffff813aa9ea>] notifier_call_chain+0x37/0x63
+ [<ffffffff81068c98>] raw_notifier_call_chain+0x14/0x16
+ [<ffffffff81322e97>] call_netdevice_notifiers+0x1b/0x1d
+ [<ffffffff8132386d>] dev_close+0x6a/0xa6
+ [<ffffffff8132395f>] rollback_registered_many+0xb6/0x2f4
+ [<ffffffff81323bb8>] unregister_netdevice_many+0x1b/0x66
+ [<ffffffffa026494f>] ieee80211_remove_interfaces+0xc5/0xd0 [mac80211]
+ [<ffffffffa02580a2>] ieee80211_unregister_hw+0x47/0xe8 [mac80211]
+ [<ffffffffa035290e>] ath9k_deinit_device+0x7a/0x9b [ath9k]
+ [<ffffffffa035bc26>] ath_pci_remove+0x38/0x76 [ath9k]
+ [<ffffffff8120940a>] pci_device_remove+0x2d/0x51
+ [<ffffffff8129d797>] __device_release_driver+0x7b/0xd1
+ [<ffffffff8129d885>] driver_detach+0x98/0xbe
+ [<ffffffff8129ca7a>] bus_remove_driver+0x94/0xb7
+ [<ffffffff8129ddd6>] driver_unregister+0x6c/0x74
+ [<ffffffff812096d2>] pci_unregister_driver+0x46/0xad
+ [<ffffffffa035bae1>] ath_pci_exit+0x15/0x17 [ath9k]
+ [<ffffffffa035e1a2>] ath9k_exit+0xe/0x2f [ath9k]
+ [<ffffffff8108050a>] sys_delete_module+0x1c7/0x236
+ [<ffffffff813a7df5>] ? retint_swapgs+0x13/0x1b
+ [<ffffffff810749b5>] ? trace_hardirqs_on_caller+0x119/0x144
+ [<ffffffff8109b9f6>] ? audit_syscall_entry+0x11e/0x14a
+ [<ffffffff81009bb2>] system_call_fastpath+0x16/0x1b
+wlan1: deauthenticating from 00:23:cd:e1:f9:b2 by local choice (reason=3)
+PM: Removing info for No Bus:wlan1
+cfg80211: Calling CRDA to update world regulatory domain
+PM: Removing info for No Bus:rfkill2
+PM: Removing info for No Bus:phy1
+ath9k 0000:16:00.0: PCI INT A disabled
+
+Signed-off-by: Ming Lei <tom.leiming@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/xmit.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2264,7 +2264,7 @@ void ath_tx_node_cleanup(struct ath_soft
+ if (ATH_TXQ_SETUP(sc, i)) {
+ txq = &sc->tx.txq[i];
+
+- spin_lock(&txq->axq_lock);
++ spin_lock_bh(&txq->axq_lock);
+
+ list_for_each_entry_safe(ac,
+ ac_tmp, &txq->axq_acq, list) {
+@@ -2285,7 +2285,7 @@ void ath_tx_node_cleanup(struct ath_soft
+ }
+ }
+
+- spin_unlock(&txq->axq_lock);
++ spin_unlock_bh(&txq->axq_lock);
+ }
+ }
+ }
--- /dev/null
+From Larry.Finger@lwfinger.net Thu Mar 18 17:21:44 2010
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Wed, 10 Mar 2010 22:10:32 -0600
+Subject: b43: Workaround circular locking in hw-tkip key update callback
+To: Greg Kroah-Hartman <gregkh@suse.de>
+Cc: Michael Buesch <mb@bu3sch.de>
+Message-ID: <4b986d38.aOKVIPS3U9/aYsOP%Larry.Finger@lwfinger.net>
+
+From: Michael Buesch <mb@bu3sch.de>
+
+commit 96869a39399269a776a94812e9fff3d38b47d838 upstream
+
+The TKIP key update callback is called from the RX path, where the driver
+mutex is already locked. This results in a circular locking bug.
+Avoid this by removing the lock.
+
+Johannes noted that there is a separate bug: The callback still breaks on SDIO
+hardware, because SDIO hardware access needs to sleep, but we are not allowed
+to sleep in the callback due to mac80211's RCU locking.
+
+Signed-off-by: Michael Buesch <mb@bu3sch.de>
+Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
+Reported-by: kecsa@kutfo.hit.bme.hu
+Cc: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/b43/main.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -852,19 +852,19 @@ static void b43_op_update_tkip_key(struc
+ if (B43_WARN_ON(!modparam_hwtkip))
+ return;
+
+- mutex_lock(&wl->mutex);
+-
++ /* This is only called from the RX path through mac80211, where
++ * our mutex is already locked. */
++ B43_WARN_ON(!mutex_is_locked(&wl->mutex));
+ dev = wl->current_dev;
+- if (!dev || b43_status(dev) < B43_STAT_INITIALIZED)
+- goto out_unlock;
++ B43_WARN_ON(!dev || b43_status(dev) < B43_STAT_INITIALIZED);
+
+ keymac_write(dev, index, NULL); /* First zero out mac to avoid race */
+
+ rx_tkip_phase1_write(dev, index, iv32, phase1key);
++ /* only pairwise TKIP keys are supported right now */
++ if (WARN_ON(!sta))
++ return;
+ keymac_write(dev, index, addr);
+-
+-out_unlock:
+- mutex_unlock(&wl->mutex);
+ }
+
+ static void do_key_write(struct b43_wldev *dev,
--- /dev/null
+From e9dcd1613f0ac0b3573b7d813a2c5672cd8302eb Mon Sep 17 00:00:00 2001
+From: Barry Song <barry.song@analog.com>
+Date: Mon, 8 Mar 2010 12:13:57 -0800
+Subject: can: fix bfin_can build error after alloc_candev() change
+
+From: Barry Song <barry.song@analog.com>
+
+commit e9dcd1613f0ac0b3573b7d813a2c5672cd8302eb upstream.
+
+Looks like commit a6e4bc530403 didn't include updates to drivers so the
+Blackfin CAN driver fails to build now.
+
+Signed-off-by: Barry Song <barry.song@analog.com>
+Signed-off-by: Mike Frysinger <vapier@gentoo.org>
+Acked-by: Wolfgang Grandegger <wg@grandegger.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/can/bfin_can.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/can/bfin_can.c
++++ b/drivers/net/can/bfin_can.c
+@@ -26,6 +26,7 @@
+
+ #define DRV_NAME "bfin_can"
+ #define BFIN_CAN_TIMEOUT 100
++#define TX_ECHO_SKB_MAX 1
+
+ /*
+ * transmit and receive channels
+@@ -590,7 +591,7 @@ struct net_device *alloc_bfin_candev(voi
+ struct net_device *dev;
+ struct bfin_can_priv *priv;
+
+- dev = alloc_candev(sizeof(*priv));
++ dev = alloc_candev(sizeof(*priv), TX_ECHO_SKB_MAX);
+ if (!dev)
+ return NULL;
+
--- /dev/null
+From 76595f79d76fbe6267a51b3a866a028d150f06d4 Mon Sep 17 00:00:00 2001
+From: Neil Horman <nhorman@tuxdriver.com>
+Date: Fri, 5 Mar 2010 13:44:16 -0800
+Subject: coredump: suppress uid comparison test if core output files are pipes
+
+From: Neil Horman <nhorman@tuxdriver.com>
+
+commit 76595f79d76fbe6267a51b3a866a028d150f06d4 upstream.
+
+Modify uid check in do_coredump so as to not apply it in the case of
+pipes.
+
+This just got noticed in testing. The end of do_coredump validates the
+uid of the inode for the created file against the uid of the crashing
+process to ensure that no one can pre-create a core file with different
+ownership and grab the information contained in the core when they
+shouldn' tbe able to. This causes failures when using pipes for a core
+dumps if the crashing process is not root, which is the uid of the pipe
+when it is created.
+
+The fix is simple. Since the check for matching uid's isn't relevant for
+pipes (a process can't create a pipe that the uermodehelper code will open
+anyway), we can just just skip it in the event ispipe is non-zero
+
+Reverts a pipe-affecting change which was accidentally made in
+
+: commit c46f739dd39db3b07ab5deb4e3ec81e1c04a91af
+: Author: Ingo Molnar <mingo@elte.hu>
+: AuthorDate: Wed Nov 28 13:59:18 2007 +0100
+: Commit: Linus Torvalds <torvalds@woody.linux-foundation.org>
+: CommitDate: Wed Nov 28 10:58:01 2007 -0800
+:
+: vfs: coredumping fix
+
+Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
+Cc: Andi Kleen <andi@firstfloor.org>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: maximilian attems <max@stro.at>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/exec.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1923,8 +1923,9 @@ void do_coredump(long signr, int exit_co
+ /*
+ * Dont allow local users get cute and trick others to coredump
+ * into their pre-created files:
++ * Note, this is not relevant for pipes
+ */
+- if (inode->i_uid != current_fsuid())
++ if (!ispipe && (inode->i_uid != current_fsuid()))
+ goto close_fail;
+ if (!cprm.file->f_op)
+ goto close_fail;
--- /dev/null
+From f36d04abe684f9e2b07c6ebe9f77ae20eb5c1e84 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Wed, 10 Feb 2010 05:07:45 -0800
+Subject: iwlwifi: use dma_alloc_coherent
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit f36d04abe684f9e2b07c6ebe9f77ae20eb5c1e84 upstream.
+
+Change pci_alloc_consistent() to dma_alloc_coherent() so we can use
+GFP_KERNEL flag.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-3945.c | 8 +++-----
+ drivers/net/wireless/iwlwifi/iwl-core.c | 12 ++++++------
+ drivers/net/wireless/iwlwifi/iwl-helpers.h | 7 ++++---
+ drivers/net/wireless/iwlwifi/iwl-rx.c | 21 +++++++++++----------
+ drivers/net/wireless/iwlwifi/iwl-tx.c | 23 ++++++++++++-----------
+ drivers/net/wireless/iwlwifi/iwl3945-base.c | 16 ++++++++--------
+ 6 files changed, 44 insertions(+), 43 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
++++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
+@@ -2474,11 +2474,9 @@ int iwl3945_hw_set_hw_params(struct iwl_
+ memset((void *)&priv->hw_params, 0,
+ sizeof(struct iwl_hw_params));
+
+- priv->shared_virt =
+- pci_alloc_consistent(priv->pci_dev,
+- sizeof(struct iwl3945_shared),
+- &priv->shared_phys);
+-
++ priv->shared_virt = dma_alloc_coherent(&priv->pci_dev->dev,
++ sizeof(struct iwl3945_shared),
++ &priv->shared_phys, GFP_KERNEL);
+ if (!priv->shared_virt) {
+ IWL_ERR(priv, "failed to allocate pci memory\n");
+ mutex_unlock(&priv->mutex);
+--- a/drivers/net/wireless/iwlwifi/iwl-core.c
++++ b/drivers/net/wireless/iwlwifi/iwl-core.c
+@@ -1658,9 +1658,9 @@ EXPORT_SYMBOL(iwl_set_tx_power);
+ void iwl_free_isr_ict(struct iwl_priv *priv)
+ {
+ if (priv->ict_tbl_vir) {
+- pci_free_consistent(priv->pci_dev, (sizeof(u32) * ICT_COUNT) +
+- PAGE_SIZE, priv->ict_tbl_vir,
+- priv->ict_tbl_dma);
++ dma_free_coherent(&priv->pci_dev->dev,
++ (sizeof(u32) * ICT_COUNT) + PAGE_SIZE,
++ priv->ict_tbl_vir, priv->ict_tbl_dma);
+ priv->ict_tbl_vir = NULL;
+ }
+ }
+@@ -1676,9 +1676,9 @@ int iwl_alloc_isr_ict(struct iwl_priv *p
+ if (priv->cfg->use_isr_legacy)
+ return 0;
+ /* allocate shrared data table */
+- priv->ict_tbl_vir = pci_alloc_consistent(priv->pci_dev, (sizeof(u32) *
+- ICT_COUNT) + PAGE_SIZE,
+- &priv->ict_tbl_dma);
++ priv->ict_tbl_vir = dma_alloc_coherent(&priv->pci_dev->dev,
++ (sizeof(u32) * ICT_COUNT) + PAGE_SIZE,
++ &priv->ict_tbl_dma, GFP_KERNEL);
+ if (!priv->ict_tbl_vir)
+ return -ENOMEM;
+
+--- a/drivers/net/wireless/iwlwifi/iwl-helpers.h
++++ b/drivers/net/wireless/iwlwifi/iwl-helpers.h
+@@ -80,8 +80,8 @@ static inline void iwl_free_fw_desc(stru
+ struct fw_desc *desc)
+ {
+ if (desc->v_addr)
+- pci_free_consistent(pci_dev, desc->len,
+- desc->v_addr, desc->p_addr);
++ dma_free_coherent(&pci_dev->dev, desc->len,
++ desc->v_addr, desc->p_addr);
+ desc->v_addr = NULL;
+ desc->len = 0;
+ }
+@@ -89,7 +89,8 @@ static inline void iwl_free_fw_desc(stru
+ static inline int iwl_alloc_fw_desc(struct pci_dev *pci_dev,
+ struct fw_desc *desc)
+ {
+- desc->v_addr = pci_alloc_consistent(pci_dev, desc->len, &desc->p_addr);
++ desc->v_addr = dma_alloc_coherent(&pci_dev->dev, desc->len,
++ &desc->p_addr, GFP_KERNEL);
+ return (desc->v_addr != NULL) ? 0 : -ENOMEM;
+ }
+
+--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
+@@ -350,10 +350,10 @@ void iwl_rx_queue_free(struct iwl_priv *
+ }
+ }
+
+- pci_free_consistent(priv->pci_dev, 4 * RX_QUEUE_SIZE, rxq->bd,
+- rxq->dma_addr);
+- pci_free_consistent(priv->pci_dev, sizeof(struct iwl_rb_status),
+- rxq->rb_stts, rxq->rb_stts_dma);
++ dma_free_coherent(&priv->pci_dev->dev, 4 * RX_QUEUE_SIZE, rxq->bd,
++ rxq->dma_addr);
++ dma_free_coherent(&priv->pci_dev->dev, sizeof(struct iwl_rb_status),
++ rxq->rb_stts, rxq->rb_stts_dma);
+ rxq->bd = NULL;
+ rxq->rb_stts = NULL;
+ }
+@@ -362,7 +362,7 @@ EXPORT_SYMBOL(iwl_rx_queue_free);
+ int iwl_rx_queue_alloc(struct iwl_priv *priv)
+ {
+ struct iwl_rx_queue *rxq = &priv->rxq;
+- struct pci_dev *dev = priv->pci_dev;
++ struct device *dev = &priv->pci_dev->dev;
+ int i;
+
+ spin_lock_init(&rxq->lock);
+@@ -370,12 +370,13 @@ int iwl_rx_queue_alloc(struct iwl_priv *
+ INIT_LIST_HEAD(&rxq->rx_used);
+
+ /* Alloc the circular buffer of Read Buffer Descriptors (RBDs) */
+- rxq->bd = pci_alloc_consistent(dev, 4 * RX_QUEUE_SIZE, &rxq->dma_addr);
++ rxq->bd = dma_alloc_coherent(dev, 4 * RX_QUEUE_SIZE, &rxq->dma_addr,
++ GFP_KERNEL);
+ if (!rxq->bd)
+ goto err_bd;
+
+- rxq->rb_stts = pci_alloc_consistent(dev, sizeof(struct iwl_rb_status),
+- &rxq->rb_stts_dma);
++ rxq->rb_stts = dma_alloc_coherent(dev, sizeof(struct iwl_rb_status),
++ &rxq->rb_stts_dma, GFP_KERNEL);
+ if (!rxq->rb_stts)
+ goto err_rb;
+
+@@ -392,8 +393,8 @@ int iwl_rx_queue_alloc(struct iwl_priv *
+ return 0;
+
+ err_rb:
+- pci_free_consistent(priv->pci_dev, 4 * RX_QUEUE_SIZE, rxq->bd,
+- rxq->dma_addr);
++ dma_free_coherent(&priv->pci_dev->dev, 4 * RX_QUEUE_SIZE, rxq->bd,
++ rxq->dma_addr);
+ err_bd:
+ return -ENOMEM;
+ }
+--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
+@@ -60,7 +60,8 @@ static const u16 default_tid_to_tx_fifo[
+ static inline int iwl_alloc_dma_ptr(struct iwl_priv *priv,
+ struct iwl_dma_ptr *ptr, size_t size)
+ {
+- ptr->addr = pci_alloc_consistent(priv->pci_dev, size, &ptr->dma);
++ ptr->addr = dma_alloc_coherent(&priv->pci_dev->dev, size, &ptr->dma,
++ GFP_KERNEL);
+ if (!ptr->addr)
+ return -ENOMEM;
+ ptr->size = size;
+@@ -73,7 +74,7 @@ static inline void iwl_free_dma_ptr(stru
+ if (unlikely(!ptr->addr))
+ return;
+
+- pci_free_consistent(priv->pci_dev, ptr->size, ptr->addr, ptr->dma);
++ dma_free_coherent(&priv->pci_dev->dev, ptr->size, ptr->addr, ptr->dma);
+ memset(ptr, 0, sizeof(*ptr));
+ }
+
+@@ -146,7 +147,7 @@ void iwl_tx_queue_free(struct iwl_priv *
+ {
+ struct iwl_tx_queue *txq = &priv->txq[txq_id];
+ struct iwl_queue *q = &txq->q;
+- struct pci_dev *dev = priv->pci_dev;
++ struct device *dev = &priv->pci_dev->dev;
+ int i;
+
+ if (q->n_bd == 0)
+@@ -163,8 +164,8 @@ void iwl_tx_queue_free(struct iwl_priv *
+
+ /* De-alloc circular buffer of TFDs */
+ if (txq->q.n_bd)
+- pci_free_consistent(dev, priv->hw_params.tfd_size *
+- txq->q.n_bd, txq->tfds, txq->q.dma_addr);
++ dma_free_coherent(dev, priv->hw_params.tfd_size *
++ txq->q.n_bd, txq->tfds, txq->q.dma_addr);
+
+ /* De-alloc array of per-TFD driver data */
+ kfree(txq->txb);
+@@ -193,7 +194,7 @@ void iwl_cmd_queue_free(struct iwl_priv
+ {
+ struct iwl_tx_queue *txq = &priv->txq[IWL_CMD_QUEUE_NUM];
+ struct iwl_queue *q = &txq->q;
+- struct pci_dev *dev = priv->pci_dev;
++ struct device *dev = &priv->pci_dev->dev;
+ int i;
+
+ if (q->n_bd == 0)
+@@ -205,8 +206,8 @@ void iwl_cmd_queue_free(struct iwl_priv
+
+ /* De-alloc circular buffer of TFDs */
+ if (txq->q.n_bd)
+- pci_free_consistent(dev, priv->hw_params.tfd_size *
+- txq->q.n_bd, txq->tfds, txq->q.dma_addr);
++ dma_free_coherent(dev, priv->hw_params.tfd_size * txq->q.n_bd,
++ txq->tfds, txq->q.dma_addr);
+
+ /* deallocate arrays */
+ kfree(txq->cmd);
+@@ -297,7 +298,7 @@ static int iwl_queue_init(struct iwl_pri
+ static int iwl_tx_queue_alloc(struct iwl_priv *priv,
+ struct iwl_tx_queue *txq, u32 id)
+ {
+- struct pci_dev *dev = priv->pci_dev;
++ struct device *dev = &priv->pci_dev->dev;
+ size_t tfd_sz = priv->hw_params.tfd_size * TFD_QUEUE_SIZE_MAX;
+
+ /* Driver private data, only for Tx (not command) queues,
+@@ -316,8 +317,8 @@ static int iwl_tx_queue_alloc(struct iwl
+
+ /* Circular buffer of transmit frame descriptors (TFDs),
+ * shared with device */
+- txq->tfds = pci_alloc_consistent(dev, tfd_sz, &txq->q.dma_addr);
+-
++ txq->tfds = dma_alloc_coherent(dev, tfd_sz, &txq->q.dma_addr,
++ GFP_KERNEL);
+ if (!txq->tfds) {
+ IWL_ERR(priv, "pci_alloc_consistent(%zd) failed\n", tfd_sz);
+ goto error;
+--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
++++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
+@@ -352,10 +352,10 @@ static int iwl3945_send_beacon_cmd(struc
+ static void iwl3945_unset_hw_params(struct iwl_priv *priv)
+ {
+ if (priv->shared_virt)
+- pci_free_consistent(priv->pci_dev,
+- sizeof(struct iwl3945_shared),
+- priv->shared_virt,
+- priv->shared_phys);
++ dma_free_coherent(&priv->pci_dev->dev,
++ sizeof(struct iwl3945_shared),
++ priv->shared_virt,
++ priv->shared_phys);
+ }
+
+ static void iwl3945_build_tx_cmd_hwcrypto(struct iwl_priv *priv,
+@@ -1253,10 +1253,10 @@ static void iwl3945_rx_queue_free(struct
+ }
+ }
+
+- pci_free_consistent(priv->pci_dev, 4 * RX_QUEUE_SIZE, rxq->bd,
+- rxq->dma_addr);
+- pci_free_consistent(priv->pci_dev, sizeof(struct iwl_rb_status),
+- rxq->rb_stts, rxq->rb_stts_dma);
++ dma_free_coherent(&priv->pci_dev->dev, 4 * RX_QUEUE_SIZE, rxq->bd,
++ rxq->dma_addr);
++ dma_free_coherent(&priv->pci_dev->dev, sizeof(struct iwl_rb_status),
++ rxq->rb_stts, rxq->rb_stts_dma);
+ rxq->bd = NULL;
+ rxq->rb_stts = NULL;
+ }
--- /dev/null
+From jan.kiszka@web.de Thu Mar 18 16:23:30 2010
+From: Jan Kiszka <jan.kiszka@web.de>
+Date: Sat, 13 Mar 2010 11:33:47 +0100
+Subject: KVM: x86: Add KVM_CAP_X86_ROBUST_SINGLESTEP
+To: Greg KH <greg@kroah.com>
+Cc: Avi Kivity <avi@redhat.com>, "stable@kernel.org" <stable@kernel.org>
+Message-ID: <4B9B6A0B.5070604@web.de>
+
+From: Jan Kiszka <jan.kiszka@siemens.com>
+
+Commit d2be1651b736002e0c76d7095d6c0ba77b4a897c upstream.
+
+This marks the guest single-step API improvement of 94fe45da and
+91586a3b with a capability flag to allow reliable detection by user
+space.
+
+Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/x86.c | 1 +
+ include/linux/kvm.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1351,6 +1351,7 @@ int kvm_dev_ioctl_check_extension(long e
+ case KVM_CAP_XEN_HVM:
+ case KVM_CAP_ADJUST_CLOCK:
+ case KVM_CAP_VCPU_EVENTS:
++ case KVM_CAP_X86_ROBUST_SINGLESTEP:
+ r = 1;
+ break;
+ case KVM_CAP_COALESCED_MMIO:
+--- a/include/linux/kvm.h
++++ b/include/linux/kvm.h
+@@ -497,6 +497,7 @@ struct kvm_ioeventfd {
+ #endif
+ #define KVM_CAP_S390_PSW 42
+ #define KVM_CAP_PPC_SEGSTATE 43
++#define KVM_CAP_X86_ROBUST_SINGLESTEP 51
+
+ #ifdef KVM_CAP_IRQ_ROUTING
+
--- /dev/null
+From 4294a8eedb17bbc45e1e7447c2a4d05332943248 Mon Sep 17 00:00:00 2001
+From: André Goddard Rosa <andre.goddard@gmail.com>
+Date: Tue, 23 Feb 2010 04:04:28 -0300
+Subject: mqueue: fix mq_open() file descriptor leak on user-space processes
+
+From: André Goddard Rosa <andre.goddard@gmail.com>
+
+commit 4294a8eedb17bbc45e1e7447c2a4d05332943248 upstream.
+
+We leak fd on lookup_one_len() failure
+
+Signed-off-by: André Goddard Rosa <andre.goddard@gmail.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ ipc/mqueue.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/ipc/mqueue.c
++++ b/ipc/mqueue.c
+@@ -705,7 +705,7 @@ SYSCALL_DEFINE4(mq_open, const char __us
+ dentry = lookup_one_len(name, ipc_ns->mq_mnt->mnt_root, strlen(name));
+ if (IS_ERR(dentry)) {
+ error = PTR_ERR(dentry);
+- goto out_err;
++ goto out_putfd;
+ }
+ mntget(ipc_ns->mq_mnt);
+
+@@ -742,7 +742,6 @@ out:
+ mntput(ipc_ns->mq_mnt);
+ out_putfd:
+ put_unused_fd(fd);
+-out_err:
+ fd = error;
+ out_upsem:
+ mutex_unlock(&ipc_ns->mq_mnt->mnt_root->d_inode->i_mutex);
--- /dev/null
+From 7a0deb6bcda98c2a764cb87f1441eef920fd3663 Mon Sep 17 00:00:00 2001
+From: Alexander Duyck <alexander.h.duyck@intel.com>
+Date: Fri, 19 Feb 2010 17:57:46 +0000
+Subject: pci: add support for 82576NS serdes to existing SR-IOV quirk
+
+From: Alexander Duyck <alexander.h.duyck@intel.com>
+
+commit 7a0deb6bcda98c2a764cb87f1441eef920fd3663 upstream.
+
+This patch adds support for the 82576NS Serdes adapter to the existing pci
+quirk for 82576 parts.
+
+Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2534,6 +2534,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_I
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x10e8, quirk_i82576_sriov);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x150a, quirk_i82576_sriov);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x150d, quirk_i82576_sriov);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1518, quirk_i82576_sriov);
+
+ #endif /* CONFIG_PCI_IOV */
+
--- /dev/null
+From 40796b0bec5cb947dc6ff9f134f013a1f14c931f Mon Sep 17 00:00:00 2001
+From: Arnaldo Carvalho de Melo <acme@infradead.org>
+Date: Thu, 25 Feb 2010 12:57:40 -0300
+Subject: perf annotate: Defer allocating sym_priv->hist array
+
+From: Arnaldo Carvalho de Melo <acme@infradead.org>
+
+commit 628ada0cb03666dd463f7c25947eaccdf440c309 upstream
+
+Because symbol->end is not fixed up at symbol_filter time, only
+after all symbols for a DSO are loaded, and that, for asm
+symbols, may be bogus, causing segfaults when hits happen in
+these symbols.
+
+Backported-from: 628ada0
+Reported-by: David Miller <davem@davemloft.net>
+Reported-by: Anton Blanchard <anton@samba.org>
+Acked-by: David Miller <davem@davemloft.net>
+Cc: Frédéric Weisbecker <fweisbec@gmail.com>
+Cc: Mike Galbraith <efault@gmx.de>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: Paul Mackerras <paulus@samba.org>
+LKML-Reference: <20100225155740.GB8553@ghostprotocols.net>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ tools/perf/builtin-annotate.c | 65 +++++++++++++++++++++---------------------
+ tools/perf/util/symbol.c | 2 -
+ tools/perf/util/symbol.h | 2 +
+ 3 files changed, 36 insertions(+), 33 deletions(-)
+
+--- a/tools/perf/builtin-annotate.c
++++ b/tools/perf/builtin-annotate.c
+@@ -53,32 +53,20 @@ struct sym_priv {
+
+ static const char *sym_hist_filter;
+
+-static int symbol_filter(struct map *map __used, struct symbol *sym)
++static int sym__alloc_hist(struct symbol *self)
+ {
+- if (sym_hist_filter == NULL ||
+- strcmp(sym->name, sym_hist_filter) == 0) {
+- struct sym_priv *priv = symbol__priv(sym);
+- const int size = (sizeof(*priv->hist) +
+- (sym->end - sym->start) * sizeof(u64));
+-
+- priv->hist = malloc(size);
+- if (priv->hist)
+- memset(priv->hist, 0, size);
+- return 0;
+- }
+- /*
+- * FIXME: We should really filter it out, as we don't want to go thru symbols
+- * we're not interested, and if a DSO ends up with no symbols, delete it too,
+- * but right now the kernel loading routines in symbol.c bail out if no symbols
+- * are found, fix it later.
+- */
+- return 0;
++ struct sym_priv *priv = symbol__priv(self);
++ const int size = (sizeof(*priv->hist) +
++ (self->end - self->start) * sizeof(u64));
++
++ priv->hist = zalloc(size);
++ return priv->hist == NULL ? -1 : 0;
+ }
+
+ /*
+ * collect histogram counts
+ */
+-static void hist_hit(struct hist_entry *he, u64 ip)
++static int annotate__hist_hit(struct hist_entry *he, u64 ip)
+ {
+ unsigned int sym_size, offset;
+ struct symbol *sym = he->sym;
+@@ -88,11 +76,11 @@ static void hist_hit(struct hist_entry *
+ he->count++;
+
+ if (!sym || !he->map)
+- return;
++ return 0;
+
+ priv = symbol__priv(sym);
+- if (!priv->hist)
+- return;
++ if (priv->hist == NULL && sym__alloc_hist(sym) < 0)
++ return -ENOMEM;
+
+ sym_size = sym->end - sym->start;
+ offset = ip - sym->start;
+@@ -102,7 +90,7 @@ static void hist_hit(struct hist_entry *
+ he->map->unmap_ip(he->map, ip));
+
+ if (offset >= sym_size)
+- return;
++ return 0;
+
+ h = priv->hist;
+ h->sum++;
+@@ -114,18 +102,31 @@ static void hist_hit(struct hist_entry *
+ he->sym->name,
+ (void *)(unsigned long)ip, ip - he->sym->start,
+ h->ip[offset]);
++ return 0;
+ }
+
+ static int perf_session__add_hist_entry(struct perf_session *self,
+ struct addr_location *al, u64 count)
+ {
+- bool hit;
+- struct hist_entry *he = __perf_session__add_hist_entry(self, al, NULL,
+- count, &hit);
+- if (he == NULL)
+- return -ENOMEM;
+- hist_hit(he, al->addr);
+- return 0;
++ bool hit;
++ struct hist_entry *he;
++
++ if (sym_hist_filter != NULL &&
++ (al->sym == NULL || strcmp(sym_hist_filter, al->sym->name) != 0)) {
++ /* We're only interested in a symbol named sym_hist_filter */
++ if (al->sym != NULL) {
++ rb_erase(&al->sym->rb_node,
++ &al->map->dso->symbols[al->map->type]);
++ symbol__delete(al->sym);
++ }
++ return 0;
++ }
++
++ he = __perf_session__add_hist_entry(self, al, NULL, count, &hit);
++ if (he == NULL)
++ return -ENOMEM;
++
++ return annotate__hist_hit(he, al->addr);
+ }
+
+ static int process_sample_event(event_t *event, struct perf_session *session)
+@@ -135,7 +136,7 @@ static int process_sample_event(event_t
+ dump_printf("(IP, %d): %d: %p\n", event->header.misc,
+ event->ip.pid, (void *)(long)event->ip.ip);
+
+- if (event__preprocess_sample(event, session, &al, symbol_filter) < 0) {
++ if (event__preprocess_sample(event, session, &al, NULL) < 0) {
+ fprintf(stderr, "problem processing %d event, skipping it.\n",
+ event->header.type);
+ return -1;
+--- a/tools/perf/util/symbol.c
++++ b/tools/perf/util/symbol.c
+@@ -149,7 +149,7 @@ static struct symbol *symbol__new(u64 st
+ return self;
+ }
+
+-static void symbol__delete(struct symbol *self)
++void symbol__delete(struct symbol *self)
+ {
+ free(((void *)self) - symbol_conf.priv_size);
+ }
+--- a/tools/perf/util/symbol.h
++++ b/tools/perf/util/symbol.h
+@@ -49,6 +49,8 @@ struct symbol {
+ char name[0];
+ };
+
++void symbol__delete(struct symbol *self);
++
+ struct strlist;
+
+ struct symbol_conf {
--- /dev/null
+From peterz@infradead.org Thu Mar 18 17:22:59 2010
+From: Suresh Siddha <suresh.b.siddha@intel.com>
+Date: Thu, 11 Mar 2010 09:45:44 +0100
+Subject: sched: Fix SCHED_MC regression caused by change in sched cpu_power
+To: Greg KH <greg@kroah.com>
+Cc: Ma Ling <ling.ma@intel.com>, Zhang@kroah.com, Yanmin <yanmin_zhang@linux.intel.com>, Suresh Siddha <suresh.b.siddha@intel.com>, Ingo Molnar <mingo@elte.hu>, stable@kernel.org
+Message-ID: <1268297144.5279.940.camel@twins>
+
+From: Suresh Siddha <suresh.b.siddha@intel.com>
+
+commit dd5feea14a7de4edbd9f36db1a2db785de91b88d upstream
+
+On platforms like dual socket quad-core platform, the scheduler load
+balancer is not detecting the load imbalances in certain scenarios. This
+is leading to scenarios like where one socket is completely busy (with
+all the 4 cores running with 4 tasks) and leaving another socket
+completely idle. This causes performance issues as those 4 tasks share
+the memory controller, last-level cache bandwidth etc. Also we won't be
+taking advantage of turbo-mode as much as we would like, etc.
+
+Some of the comparisons in the scheduler load balancing code are
+comparing the "weighted cpu load that is scaled wrt sched_group's
+cpu_power" with the "weighted average load per task that is not scaled
+wrt sched_group's cpu_power". While this has probably been broken for a
+longer time (for multi socket numa nodes etc), the problem got aggrevated
+via this recent change:
+
+|
+| commit f93e65c186ab3c05ce2068733ca10e34fd00125e
+| Author: Peter Zijlstra <a.p.zijlstra@chello.nl>
+| Date: Tue Sep 1 10:34:32 2009 +0200
+|
+| sched: Restore __cpu_power to a straight sum of power
+|
+
+Also with this change, the sched group cpu power alone no longer reflects
+the group capacity that is needed to implement MC, MT performance
+(default) and power-savings (user-selectable) policies.
+
+We need to use the computed group capacity (sgs.group_capacity, that is
+computed using the SD_PREFER_SIBLING logic in update_sd_lb_stats()) to
+find out if the group with the max load is above its capacity and how
+much load to move etc.
+
+Reported-by: Ma Ling <ling.ma@intel.com>
+Initial-Analysis-by: Zhang, Yanmin <yanmin_zhang@linux.intel.com>
+Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
+[ -v2: build fix ]
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+LKML-Reference: <1266970432.11588.22.camel@sbs-t61.sc.intel.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+
+---
+ kernel/sched.c | 76 ++++++++++++++++++++++++++++++++-------------------------
+ 1 file changed, 43 insertions(+), 33 deletions(-)
+
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -3423,6 +3423,7 @@ struct sd_lb_stats {
+ unsigned long max_load;
+ unsigned long busiest_load_per_task;
+ unsigned long busiest_nr_running;
++ unsigned long busiest_group_capacity;
+
+ int group_imb; /* Is there imbalance in this sd */
+ #if defined(CONFIG_SCHED_MC) || defined(CONFIG_SCHED_SMT)
+@@ -3742,8 +3743,7 @@ static inline void update_sg_lb_stats(st
+ unsigned long load, max_cpu_load, min_cpu_load;
+ int i;
+ unsigned int balance_cpu = -1, first_idle_cpu = 0;
+- unsigned long sum_avg_load_per_task;
+- unsigned long avg_load_per_task;
++ unsigned long avg_load_per_task = 0;
+
+ if (local_group) {
+ balance_cpu = group_first_cpu(group);
+@@ -3752,7 +3752,6 @@ static inline void update_sg_lb_stats(st
+ }
+
+ /* Tally up the load of all CPUs in the group */
+- sum_avg_load_per_task = avg_load_per_task = 0;
+ max_cpu_load = 0;
+ min_cpu_load = ~0UL;
+
+@@ -3782,7 +3781,6 @@ static inline void update_sg_lb_stats(st
+ sgs->sum_nr_running += rq->nr_running;
+ sgs->sum_weighted_load += weighted_cpuload(i);
+
+- sum_avg_load_per_task += cpu_avg_load_per_task(i);
+ }
+
+ /*
+@@ -3800,7 +3798,6 @@ static inline void update_sg_lb_stats(st
+ /* Adjust by relative CPU power of the group */
+ sgs->avg_load = (sgs->group_load * SCHED_LOAD_SCALE) / group->cpu_power;
+
+-
+ /*
+ * Consider the group unbalanced when the imbalance is larger
+ * than the average weight of two tasks.
+@@ -3810,8 +3807,8 @@ static inline void update_sg_lb_stats(st
+ * normalized nr_running number somewhere that negates
+ * the hierarchy?
+ */
+- avg_load_per_task = (sum_avg_load_per_task * SCHED_LOAD_SCALE) /
+- group->cpu_power;
++ if (sgs->sum_nr_running)
++ avg_load_per_task = sgs->sum_weighted_load / sgs->sum_nr_running;
+
+ if ((max_cpu_load - min_cpu_load) > 2*avg_load_per_task)
+ sgs->group_imb = 1;
+@@ -3880,6 +3877,7 @@ static inline void update_sd_lb_stats(st
+ sds->max_load = sgs.avg_load;
+ sds->busiest = group;
+ sds->busiest_nr_running = sgs.sum_nr_running;
++ sds->busiest_group_capacity = sgs.group_capacity;
+ sds->busiest_load_per_task = sgs.sum_weighted_load;
+ sds->group_imb = sgs.group_imb;
+ }
+@@ -3902,6 +3900,7 @@ static inline void fix_small_imbalance(s
+ {
+ unsigned long tmp, pwr_now = 0, pwr_move = 0;
+ unsigned int imbn = 2;
++ unsigned long scaled_busy_load_per_task;
+
+ if (sds->this_nr_running) {
+ sds->this_load_per_task /= sds->this_nr_running;
+@@ -3912,8 +3911,12 @@ static inline void fix_small_imbalance(s
+ sds->this_load_per_task =
+ cpu_avg_load_per_task(this_cpu);
+
+- if (sds->max_load - sds->this_load + sds->busiest_load_per_task >=
+- sds->busiest_load_per_task * imbn) {
++ scaled_busy_load_per_task = sds->busiest_load_per_task
++ * SCHED_LOAD_SCALE;
++ scaled_busy_load_per_task /= sds->busiest->cpu_power;
++
++ if (sds->max_load - sds->this_load + scaled_busy_load_per_task >=
++ (scaled_busy_load_per_task * imbn)) {
+ *imbalance = sds->busiest_load_per_task;
+ return;
+ }
+@@ -3964,7 +3967,14 @@ static inline void fix_small_imbalance(s
+ static inline void calculate_imbalance(struct sd_lb_stats *sds, int this_cpu,
+ unsigned long *imbalance)
+ {
+- unsigned long max_pull;
++ unsigned long max_pull, load_above_capacity = ~0UL;
++
++ sds->busiest_load_per_task /= sds->busiest_nr_running;
++ if (sds->group_imb) {
++ sds->busiest_load_per_task =
++ min(sds->busiest_load_per_task, sds->avg_load);
++ }
++
+ /*
+ * In the presence of smp nice balancing, certain scenarios can have
+ * max load less than avg load(as we skip the groups at or below
+@@ -3975,9 +3985,29 @@ static inline void calculate_imbalance(s
+ return fix_small_imbalance(sds, this_cpu, imbalance);
+ }
+
+- /* Don't want to pull so many tasks that a group would go idle */
+- max_pull = min(sds->max_load - sds->avg_load,
+- sds->max_load - sds->busiest_load_per_task);
++ if (!sds->group_imb) {
++ /*
++ * Don't want to pull so many tasks that a group would go idle.
++ */
++ load_above_capacity = (sds->busiest_nr_running -
++ sds->busiest_group_capacity);
++
++ load_above_capacity *= (SCHED_LOAD_SCALE * SCHED_LOAD_SCALE);
++
++ load_above_capacity /= sds->busiest->cpu_power;
++ }
++
++ /*
++ * We're trying to get all the cpus to the average_load, so we don't
++ * want to push ourselves above the average load, nor do we wish to
++ * reduce the max loaded cpu below the average load. At the same time,
++ * we also don't want to reduce the group load below the group capacity
++ * (so that we can implement power-savings policies etc). Thus we look
++ * for the minimum possible imbalance.
++ * Be careful of negative numbers as they'll appear as very large values
++ * with unsigned longs.
++ */
++ max_pull = min(sds->max_load - sds->avg_load, load_above_capacity);
+
+ /* How much load to actually move to equalise the imbalance */
+ *imbalance = min(max_pull * sds->busiest->cpu_power,
+@@ -4045,7 +4075,6 @@ find_busiest_group(struct sched_domain *
+ * 4) This group is more busy than the avg busieness at this
+ * sched_domain.
+ * 5) The imbalance is within the specified limit.
+- * 6) Any rebalance would lead to ping-pong
+ */
+ if (balance && !(*balance))
+ goto ret;
+@@ -4064,25 +4093,6 @@ find_busiest_group(struct sched_domain *
+ if (100 * sds.max_load <= sd->imbalance_pct * sds.this_load)
+ goto out_balanced;
+
+- sds.busiest_load_per_task /= sds.busiest_nr_running;
+- if (sds.group_imb)
+- sds.busiest_load_per_task =
+- min(sds.busiest_load_per_task, sds.avg_load);
+-
+- /*
+- * We're trying to get all the cpus to the average_load, so we don't
+- * want to push ourselves above the average load, nor do we wish to
+- * reduce the max loaded cpu below the average load, as either of these
+- * actions would just result in more rebalancing later, and ping-pong
+- * tasks around. Thus we look for the minimum possible imbalance.
+- * Negative imbalances (*we* are more loaded than anyone else) will
+- * be counted as no imbalance for these purposes -- we can't fix that
+- * by pulling tasks to us. Be careful of negative numbers as they'll
+- * appear as very large values with unsigned longs.
+- */
+- if (sds.max_load <= sds.busiest_load_per_task)
+- goto out_balanced;
+-
+ /* Looks like there is an imbalance. Compute it */
+ calculate_imbalance(&sds, this_cpu, imbalance);
+ return sds.busiest;
tracing-use-same-local-variable-when-resetting-the-ring-buffer.patch
tracing-disable-buffer-switching-when-starting-or-stopping-trace.patch
tracing-do-not-record-user-stack-trace-from-nmi-context.patch
+coredump-suppress-uid-comparison-test-if-core-output-files-are-pipes.patch
+v4l-dvb-13961-em28xx-dvb-fix-memleak-in-dvb_fini.patch
+kvm-x86-add-kvm_cap_x86_robust_singlestep.patch
+pci-add-support-for-82576ns-serdes-to-existing-sr-iov-quirk.patch
+sparc64-make-prom-entry-spinlock-nmi-safe.patch
+sh-fix-zimage-boot-using-fixed-pmb.patch
+ath9k-fix-lockdep-warning-when-unloading-module.patch
+ath9k-add-support-for-802.11n-bonded-out-ar2427.patch
+mqueue-fix-mq_open-file-descriptor-leak-on-user-space-processes.patch
+virtio-fix-out-of-range-array-access.patch
+iwlwifi-use-dma_alloc_coherent.patch
+can-fix-bfin_can-build-error-after-alloc_candev-change.patch
+perf-annotate-defer-allocating-sym_priv-hist-array.patch
+b43-workaround-circular-locking-in-hw-tkip-key-update-callback.patch
+sched-fix-sched_mc-regression-caused-by-change-in-sched-cpu_power.patch
--- /dev/null
+From 319c2cc761505ee54a9536c5d0b9c2ee3fb33866 Mon Sep 17 00:00:00 2001
+From: Nobuhiro Iwamatsu <iwamatsu.nobuhiro@renesas.com>
+Date: Mon, 15 Feb 2010 08:37:50 +0000
+Subject: sh: Fix zImage boot using fixed PMB.
+
+From: Nobuhiro Iwamatsu <iwamatsu.nobuhiro@renesas.com>
+
+commit 319c2cc761505ee54a9536c5d0b9c2ee3fb33866 upstream.
+
+Signed-off-by: Nobuhiro Iwamatsu <iwamatsu.nobuhiro@renesas.com>
+Signed-off-by: Yoshihiro Shimoda <shimoda.yoshihiro@renesas.com>
+Signed-off-by: Paul Mundt <lethal@linux-sh.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sh/boot/compressed/misc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/sh/boot/compressed/misc.c
++++ b/arch/sh/boot/compressed/misc.c
+@@ -132,7 +132,7 @@ void decompress_kernel(void)
+ output_addr = (CONFIG_MEMORY_START + 0x2000);
+ #else
+ output_addr = __pa((unsigned long)&_text+PAGE_SIZE);
+-#ifdef CONFIG_29BIT
++#if defined(CONFIG_29BIT) || defined(CONFIG_PMB_LEGACY)
+ output_addr |= P2SEG;
+ #endif
+ #endif
--- /dev/null
+From 8a8187c8fbbd78bd2a2b4b1ad05838d95a4ed91a Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Wed, 3 Mar 2010 09:06:03 -0800
+Subject: sparc64: Make prom entry spinlock NMI safe.
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 8a4fd1e4922413cfdfa6c51a59efb720d904a5eb ]
+
+If we do something like try to print to the OF console from an NMI
+while we're already in OpenFirmware, we'll deadlock on the spinlock.
+
+Use a raw spinlock and disable NMIs when we take it.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc/prom/p1275.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/arch/sparc/prom/p1275.c
++++ b/arch/sparc/prom/p1275.c
+@@ -32,10 +32,9 @@ extern void prom_cif_interface(void);
+ extern void prom_cif_callback(void);
+
+ /*
+- * This provides SMP safety on the p1275buf. prom_callback() drops this lock
+- * to allow recursuve acquisition.
++ * This provides SMP safety on the p1275buf.
+ */
+-DEFINE_SPINLOCK(prom_entry_lock);
++DEFINE_RAW_SPINLOCK(prom_entry_lock);
+
+ long p1275_cmd(const char *service, long fmt, ...)
+ {
+@@ -47,7 +46,9 @@ long p1275_cmd(const char *service, long
+
+ p = p1275buf.prom_buffer;
+
+- spin_lock_irqsave(&prom_entry_lock, flags);
++ raw_local_save_flags(flags);
++ raw_local_irq_restore(PIL_NMI);
++ raw_spin_lock(&prom_entry_lock);
+
+ p1275buf.prom_args[0] = (unsigned long)p; /* service */
+ strcpy (p, service);
+@@ -139,7 +140,8 @@ long p1275_cmd(const char *service, long
+ va_end(list);
+ x = p1275buf.prom_args [nargs + 3];
+
+- spin_unlock_irqrestore(&prom_entry_lock, flags);
++ raw_spin_unlock(&prom_entry_lock);
++ raw_local_irq_restore(flags);
+
+ return x;
+ }
--- /dev/null
+From 19f48cb105b7fa18d0dcab435919a3a29b7a7c4c Mon Sep 17 00:00:00 2001
+From: Francesco Lavra <francescolavra@interfree.it>
+Date: Thu, 31 Dec 2009 08:47:11 -0300
+Subject: V4L/DVB (13961): em28xx-dvb: fix memleak in dvb_fini()
+
+From: Francesco Lavra <francescolavra@interfree.it>
+
+commit 19f48cb105b7fa18d0dcab435919a3a29b7a7c4c upstream.
+
+this patch fixes a memory leak which occurs when an em28xx card with DVB
+extension is unplugged or its DVB extension driver is unloaded. In
+dvb_fini(), dev->dvb must be freed before being set to NULL, as is done
+in dvb_init() in case of error.
+Note that this bug is also present in the latest stable kernel release.
+
+Signed-off-by: Francesco Lavra <francescolavra@interfree.it>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/em28xx/em28xx-dvb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/video/em28xx/em28xx-dvb.c
++++ b/drivers/media/video/em28xx/em28xx-dvb.c
+@@ -606,6 +606,7 @@ static int dvb_fini(struct em28xx *dev)
+
+ if (dev->dvb) {
+ unregister_dvb(dev->dvb);
++ kfree(dev->dvb);
+ dev->dvb = NULL;
+ }
+
--- /dev/null
+From 3119815912a220bdac943dfbdfee640414c0c611 Mon Sep 17 00:00:00 2001
+From: Michael S. Tsirkin <mst@redhat.com>
+Date: Thu, 25 Feb 2010 19:08:55 +0200
+Subject: virtio: fix out of range array access
+
+From: Michael S. Tsirkin <mst@redhat.com>
+
+commit 3119815912a220bdac943dfbdfee640414c0c611 upstream.
+
+I have observed the following error on virtio-net module unload:
+
+------------[ cut here ]------------
+WARNING: at kernel/irq/manage.c:858 __free_irq+0xa0/0x14c()
+Hardware name: Bochs
+Trying to free already-free IRQ 0
+Modules linked in: virtio_net(-) virtio_blk virtio_pci virtio_ring
+virtio af_packet e1000 shpchp aacraid uhci_hcd ohci_hcd ehci_hcd [last
+unloaded: scsi_wait_scan]
+Pid: 1957, comm: rmmod Not tainted 2.6.33-rc8-vhost #24
+Call Trace:
+ [<ffffffff8103e195>] warn_slowpath_common+0x7c/0x94
+ [<ffffffff8103e204>] warn_slowpath_fmt+0x41/0x43
+ [<ffffffff810a7a36>] ? __free_pages+0x5a/0x70
+ [<ffffffff8107cc00>] __free_irq+0xa0/0x14c
+ [<ffffffff8107cceb>] free_irq+0x3f/0x65
+ [<ffffffffa0081424>] vp_del_vqs+0x81/0xb1 [virtio_pci]
+ [<ffffffffa0091d29>] virtnet_remove+0xda/0x10b [virtio_net]
+ [<ffffffffa0075200>] virtio_dev_remove+0x22/0x4a [virtio]
+ [<ffffffff812709ee>] __device_release_driver+0x66/0xac
+ [<ffffffff81270ab7>] driver_detach+0x83/0xa9
+ [<ffffffff8126fc66>] bus_remove_driver+0x91/0xb4
+ [<ffffffff81270fcf>] driver_unregister+0x6c/0x74
+ [<ffffffffa0075418>] unregister_virtio_driver+0xe/0x10 [virtio]
+ [<ffffffffa0091c4d>] fini+0x15/0x17 [virtio_net]
+ [<ffffffff8106997b>] sys_delete_module+0x1c3/0x230
+ [<ffffffff81007465>] ? old_ich_force_enable_hpet+0x117/0x164
+ [<ffffffff813bb720>] ? do_page_fault+0x29c/0x2cc
+ [<ffffffff81028e58>] sysenter_dispatch+0x7/0x27
+---[ end trace 15e88e4c576cc62b ]---
+
+The bug is in virtio-pci: we use msix_vector as array index to get irq
+entry, but some vqs do not have a dedicated vector so this causes an out
+of bounds access. By chance, we seem to often get 0 value, which
+results in this error.
+
+Fix by verifying that vector is legal before using it as index.
+
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Anthony Liguori <aliguori@us.ibm.com>
+Acked-by: Shirley Ma <xma@us.ibm.com>
+Acked-by: Amit Shah <amit.shah@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/virtio/virtio_pci.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/virtio/virtio_pci.c
++++ b/drivers/virtio/virtio_pci.c
+@@ -473,7 +473,8 @@ static void vp_del_vqs(struct virtio_dev
+
+ list_for_each_entry_safe(vq, n, &vdev->vqs, list) {
+ info = vq->priv;
+- if (vp_dev->per_vq_vectors)
++ if (vp_dev->per_vq_vectors &&
++ info->msix_vector != VIRTIO_MSI_NO_VECTOR)
+ free_irq(vp_dev->msix_entries[info->msix_vector].vector,
+ vq);
+ vp_del_vq(vq);
projects / thirdparty / kernel / stable-queue.git / commitdiff
