--- /dev/null
+From 945a13acd01a0ff6e430e2aa85a269852bfd3e9d Mon Sep 17 00:00:00 2001
+From: Jarek Poplawski <jarkao2@gmail.com>
+Date: Sun, 10 Jan 2010 22:04:19 +0000
+Subject: af_packet: Don't use skb after dev_queue_xmit()
+
+From: Jarek Poplawski <jarkao2@gmail.com>
+
+[ Upstream commit eb70df13ee52dbc0f2c0ffd8ed34a8cd27440baf ]
+
+tpacket_snd() can change and kfree an skb after dev_queue_xmit(),
+which is illegal.
+
+With debugging by: Stephen Hemminger <shemminger@vyatta.com>
+
+Reported-by: Michael Breuer <mbreuer@majjas.com>
+With help from: David S. Miller <davem@davemloft.net>
+Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
+Tested-by: Michael Breuer<mbreuer@majjas.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/packet/af_packet.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1028,8 +1028,20 @@ static int tpacket_snd(struct packet_soc
+
+ status = TP_STATUS_SEND_REQUEST;
+ err = dev_queue_xmit(skb);
+- if (unlikely(err > 0 && (err = net_xmit_errno(err)) != 0))
+- goto out_xmit;
++ if (unlikely(err > 0)) {
++ err = net_xmit_errno(err);
++ if (err && __packet_get_status(po, ph) ==
++ TP_STATUS_AVAILABLE) {
++ /* skb was destructed already */
++ skb = NULL;
++ goto out_status;
++ }
++ /*
++ * skb was dropped but not destructed yet;
++ * let's treat it like congestion or err < 0
++ */
++ err = 0;
++ }
+ packet_increment_head(&po->tx_ring);
+ len_sum += tp_len;
+ } while (likely((ph != NULL) || ((!(msg->msg_flags & MSG_DONTWAIT))
+@@ -1039,9 +1051,6 @@ static int tpacket_snd(struct packet_soc
+ err = len_sum;
+ goto out_put;
+
+-out_xmit:
+- skb->destructor = sock_wfree;
+- atomic_dec(&po->tx_ring.pending);
+ out_status:
+ __packet_set_status(po, ph, status);
+ kfree_skb(skb);
--- /dev/null
+From fb530cc1a61ed6c5a2b44f27e648e9212c66f3ed Mon Sep 17 00:00:00 2001
+From: Jarek Poplawski <jarkao2@gmail.com>
+Date: Sat, 16 Jan 2010 01:04:04 -0800
+Subject: ax25: netrom: rose: Fix timer oopses
+
+From: Jarek Poplawski <jarkao2@gmail.com>
+
+[ Upstream commit d00c362f1b0ff54161e0a42b4554ac621a9ef92d ]
+
+Wrong ax25_cb refcounting in ax25_send_frame() and by its callers can
+cause timer oopses (first reported with 2.6.29.6 kernel).
+
+Fixes: http://bugzilla.kernel.org/show_bug.cgi?id=14905
+
+Reported-by: Bernard Pidoux <bpidoux@free.fr>
+Tested-by: Bernard Pidoux <bpidoux@free.fr>
+Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/net/netrom.h | 2 ++
+ net/ax25/ax25_out.c | 6 ++++++
+ net/netrom/nr_route.c | 11 ++++++-----
+ net/rose/rose_link.c | 8 ++++++++
+ net/rose/rose_route.c | 5 +++++
+ 5 files changed, 27 insertions(+), 5 deletions(-)
+
+--- a/include/net/netrom.h
++++ b/include/net/netrom.h
+@@ -132,6 +132,8 @@ static __inline__ void nr_node_put(struc
+ static __inline__ void nr_neigh_put(struct nr_neigh *nr_neigh)
+ {
+ if (atomic_dec_and_test(&nr_neigh->refcount)) {
++ if (nr_neigh->ax25)
++ ax25_cb_put(nr_neigh->ax25);
+ kfree(nr_neigh->digipeat);
+ kfree(nr_neigh);
+ }
+--- a/net/ax25/ax25_out.c
++++ b/net/ax25/ax25_out.c
+@@ -92,6 +92,12 @@ ax25_cb *ax25_send_frame(struct sk_buff
+ #endif
+ }
+
++ /*
++ * There is one ref for the state machine; a caller needs
++ * one more to put it back, just like with the existing one.
++ */
++ ax25_cb_hold(ax25);
++
+ ax25_cb_add(ax25);
+
+ ax25->state = AX25_STATE_1;
+--- a/net/netrom/nr_route.c
++++ b/net/netrom/nr_route.c
+@@ -842,12 +842,13 @@ int nr_route_frame(struct sk_buff *skb,
+ dptr = skb_push(skb, 1);
+ *dptr = AX25_P_NETROM;
+
+- ax25s = ax25_send_frame(skb, 256, (ax25_address *)dev->dev_addr, &nr_neigh->callsign, nr_neigh->digipeat, nr_neigh->dev);
+- if (nr_neigh->ax25 && ax25s) {
+- /* We were already holding this ax25_cb */
++ ax25s = nr_neigh->ax25;
++ nr_neigh->ax25 = ax25_send_frame(skb, 256,
++ (ax25_address *)dev->dev_addr,
++ &nr_neigh->callsign,
++ nr_neigh->digipeat, nr_neigh->dev);
++ if (ax25s)
+ ax25_cb_put(ax25s);
+- }
+- nr_neigh->ax25 = ax25s;
+
+ dev_put(dev);
+ ret = (nr_neigh->ax25 != NULL);
+--- a/net/rose/rose_link.c
++++ b/net/rose/rose_link.c
+@@ -101,13 +101,17 @@ static void rose_t0timer_expiry(unsigned
+ static int rose_send_frame(struct sk_buff *skb, struct rose_neigh *neigh)
+ {
+ ax25_address *rose_call;
++ ax25_cb *ax25s;
+
+ if (ax25cmp(&rose_callsign, &null_ax25_address) == 0)
+ rose_call = (ax25_address *)neigh->dev->dev_addr;
+ else
+ rose_call = &rose_callsign;
+
++ ax25s = neigh->ax25;
+ neigh->ax25 = ax25_send_frame(skb, 260, rose_call, &neigh->callsign, neigh->digipeat, neigh->dev);
++ if (ax25s)
++ ax25_cb_put(ax25s);
+
+ return (neigh->ax25 != NULL);
+ }
+@@ -120,13 +124,17 @@ static int rose_send_frame(struct sk_buf
+ static int rose_link_up(struct rose_neigh *neigh)
+ {
+ ax25_address *rose_call;
++ ax25_cb *ax25s;
+
+ if (ax25cmp(&rose_callsign, &null_ax25_address) == 0)
+ rose_call = (ax25_address *)neigh->dev->dev_addr;
+ else
+ rose_call = &rose_callsign;
+
++ ax25s = neigh->ax25;
+ neigh->ax25 = ax25_find_cb(rose_call, &neigh->callsign, neigh->digipeat, neigh->dev);
++ if (ax25s)
++ ax25_cb_put(ax25s);
+
+ return (neigh->ax25 != NULL);
+ }
+--- a/net/rose/rose_route.c
++++ b/net/rose/rose_route.c
+@@ -234,6 +234,8 @@ static void rose_remove_neigh(struct ros
+
+ if ((s = rose_neigh_list) == rose_neigh) {
+ rose_neigh_list = rose_neigh->next;
++ if (rose_neigh->ax25)
++ ax25_cb_put(rose_neigh->ax25);
+ kfree(rose_neigh->digipeat);
+ kfree(rose_neigh);
+ return;
+@@ -242,6 +244,8 @@ static void rose_remove_neigh(struct ros
+ while (s != NULL && s->next != NULL) {
+ if (s->next == rose_neigh) {
+ s->next = rose_neigh->next;
++ if (rose_neigh->ax25)
++ ax25_cb_put(rose_neigh->ax25);
+ kfree(rose_neigh->digipeat);
+ kfree(rose_neigh);
+ return;
+@@ -810,6 +814,7 @@ void rose_link_failed(ax25_cb *ax25, int
+
+ if (rose_neigh != NULL) {
+ rose_neigh->ax25 = NULL;
++ ax25_cb_put(ax25);
+
+ rose_del_route_by_neigh(rose_neigh);
+ rose_kill_by_neigh(rose_neigh);
--- /dev/null
+From aaro.koskinen@iki.fi Mon Feb 1 13:24:31 2010
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+Date: Mon, 1 Feb 2010 18:24:58 +0200
+Subject: clocksource: fix compilation if no GENERIC_TIME
+To: stable@kernel.org, gregkh@suse.de, tglx@linutronix.de, linux-kernel@vger.kernel.org
+Message-ID: <1265041498-2434-1-git-send-email-aaro.koskinen@iki.fi>
+
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+
+commit a362c638bdf052bf424bce7645d39b101090f6ba upstream
+
+Commit a9238ce3bb0fda6e760780b702c6cbd3793087d3 broke compilation on
+platforms that do not implement GENERIC_TIME (e.g. iop32x):
+
+ kernel/time/clocksource.c: In function 'clocksource_register':
+ kernel/time/clocksource.c:556: error: implicit declaration of function 'clocksource_max_deferment'
+
+Provide the implementation of clocksource_max_deferment() also for
+such platforms.
+
+Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/time/clocksource.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/kernel/time/clocksource.c
++++ b/kernel/time/clocksource.c
+@@ -413,8 +413,6 @@ void clocksource_touch_watchdog(void)
+ clocksource_resume_watchdog();
+ }
+
+-#ifdef CONFIG_GENERIC_TIME
+-
+ /**
+ * clocksource_max_deferment - Returns max time the clocksource can be deferred
+ * @cs: Pointer to clocksource
+@@ -456,6 +454,8 @@ static u64 clocksource_max_deferment(str
+ return max_nsecs - (max_nsecs >> 5);
+ }
+
++#ifdef CONFIG_GENERIC_TIME
++
+ /**
+ * clocksource_select - Select the best clocksource available
+ *
--- /dev/null
+From 0813ef21a1a15a3c8b6b98c8ff3ef119f5e242ac Mon Sep 17 00:00:00 2001
+From: Jamal Hadi Salim <hadi@cyberus.ca>
+Date: Fri, 25 Dec 2009 17:30:22 -0800
+Subject: net: restore ip source validation
+
+From: Jamal Hadi Salim <hadi@cyberus.ca>
+
+[ Upstream commit 28f6aeea3f12d37bd258b2c0d5ba891bff4ec479 ]
+
+when using policy routing and the skb mark:
+there are cases where a back path validation requires us
+to use a different routing table for src ip validation than
+the one used for mapping ingress dst ip.
+One such a case is transparent proxying where we pretend to be
+the destination system and therefore the local table
+is used for incoming packets but possibly a main table would
+be used on outbound.
+Make the default behavior to allow the above and if users
+need to turn on the symmetry via sysctl src_valid_mark
+
+Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/inetdevice.h | 1 +
+ include/linux/sysctl.h | 1 +
+ net/ipv4/devinet.c | 1 +
+ net/ipv4/fib_frontend.c | 2 ++
+ 4 files changed, 5 insertions(+)
+
+--- a/include/linux/inetdevice.h
++++ b/include/linux/inetdevice.h
+@@ -83,6 +83,7 @@ static inline void ipv4_devconf_setall(s
+ #define IN_DEV_FORWARD(in_dev) IN_DEV_CONF_GET((in_dev), FORWARDING)
+ #define IN_DEV_MFORWARD(in_dev) IN_DEV_ANDCONF((in_dev), MC_FORWARDING)
+ #define IN_DEV_RPFILTER(in_dev) IN_DEV_MAXCONF((in_dev), RP_FILTER)
++#define IN_DEV_SRC_VMARK(in_dev) IN_DEV_ORCONF((in_dev), SRC_VMARK)
+ #define IN_DEV_SOURCE_ROUTE(in_dev) IN_DEV_ANDCONF((in_dev), \
+ ACCEPT_SOURCE_ROUTE)
+ #define IN_DEV_BOOTP_RELAY(in_dev) IN_DEV_ANDCONF((in_dev), BOOTP_RELAY)
+--- a/include/linux/sysctl.h
++++ b/include/linux/sysctl.h
+@@ -490,6 +490,7 @@ enum
+ NET_IPV4_CONF_PROMOTE_SECONDARIES=20,
+ NET_IPV4_CONF_ARP_ACCEPT=21,
+ NET_IPV4_CONF_ARP_NOTIFY=22,
++ NET_IPV4_CONF_SRC_VMARK=24,
+ __NET_IPV4_CONF_MAX
+ };
+
+--- a/net/ipv4/devinet.c
++++ b/net/ipv4/devinet.c
+@@ -1450,6 +1450,7 @@ static struct devinet_sysctl_table {
+ DEVINET_SYSCTL_RW_ENTRY(SEND_REDIRECTS, "send_redirects"),
+ DEVINET_SYSCTL_RW_ENTRY(ACCEPT_SOURCE_ROUTE,
+ "accept_source_route"),
++ DEVINET_SYSCTL_RW_ENTRY(SRC_VMARK, "src_valid_mark"),
+ DEVINET_SYSCTL_RW_ENTRY(PROXY_ARP, "proxy_arp"),
+ DEVINET_SYSCTL_RW_ENTRY(MEDIUM_ID, "medium_id"),
+ DEVINET_SYSCTL_RW_ENTRY(BOOTP_RELAY, "bootp_relay"),
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -251,6 +251,8 @@ int fib_validate_source(__be32 src, __be
+ if (in_dev) {
+ no_addr = in_dev->ifa_list == NULL;
+ rpf = IN_DEV_RPFILTER(in_dev);
++ if (mark && !IN_DEV_SRC_VMARK(in_dev))
++ fl.mark = 0;
+ }
+ rcu_read_unlock();
+
--- /dev/null
+From a2fad9bf26a1d44a8d31a5c4528108a2b9f468ab Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Mon, 4 Jan 2010 15:30:54 +0000
+Subject: regulator: Specify REGULATOR_CHANGE_STATUS for WM835x LED constraints
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit a2fad9bf26a1d44a8d31a5c4528108a2b9f468ab upstream.
+
+The WM8350 LED driver needs to be able to enable and disable the
+regulators it is using. Previously the core wasn't properly enforcing
+status change constraints so the driver was able to function but this
+has always been intended to be required.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Liam Girdwood <lrg@slimlogic.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/regulator/wm8350-regulator.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/regulator/wm8350-regulator.c
++++ b/drivers/regulator/wm8350-regulator.c
+@@ -1504,7 +1504,8 @@ int wm8350_register_led(struct wm8350 *w
+ led->isink_init.consumer_supplies = &led->isink_consumer;
+ led->isink_init.constraints.min_uA = 0;
+ led->isink_init.constraints.max_uA = pdata->max_uA;
+- led->isink_init.constraints.valid_ops_mask = REGULATOR_CHANGE_CURRENT;
++ led->isink_init.constraints.valid_ops_mask
++ = REGULATOR_CHANGE_CURRENT | REGULATOR_CHANGE_STATUS;
+ led->isink_init.constraints.valid_modes_mask = REGULATOR_MODE_NORMAL;
+ ret = wm8350_register_regulator(wm8350, isink, &led->isink_init);
+ if (ret != 0) {
+@@ -1517,6 +1518,7 @@ int wm8350_register_led(struct wm8350 *w
+ led->dcdc_init.num_consumer_supplies = 1;
+ led->dcdc_init.consumer_supplies = &led->dcdc_consumer;
+ led->dcdc_init.constraints.valid_modes_mask = REGULATOR_MODE_NORMAL;
++ led->dcdc_init.constraints.valid_ops_mask = REGULATOR_CHANGE_STATUS;
+ ret = wm8350_register_regulator(wm8350, dcdc, &led->dcdc_init);
+ if (ret != 0) {
+ platform_device_put(pdev);
--- /dev/null
+From 17740d89785aeb4143770923d67c293849414710 Mon Sep 17 00:00:00 2001
+From: Jiri Slaby <jirislaby@gmail.com>
+Date: Fri, 28 Aug 2009 10:47:16 +0200
+Subject: SECURITY: selinux, fix update_rlimit_cpu parameter
+
+From: Jiri Slaby <jirislaby@gmail.com>
+
+commit 17740d89785aeb4143770923d67c293849414710 upstream.
+
+Don't pass current RLIMIT_RTTIME to update_rlimit_cpu() in
+selinux_bprm_committing_creds, since update_rlimit_cpu expects
+RLIMIT_CPU limit.
+
+Use proper rlim[RLIMIT_CPU].rlim_cur instead to fix that.
+
+Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
+Acked-by: James Morris <jmorris@namei.org>
+Cc: Stephen Smalley <sds@tycho.nsa.gov>
+Cc: Eric Paris <eparis@parisplace.org>
+Cc: David Howells <dhowells@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ security/selinux/hooks.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -2366,7 +2366,7 @@ static void selinux_bprm_committing_cred
+ initrlim = init_task.signal->rlim + i;
+ rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
+ }
+- update_rlimit_cpu(rlim->rlim_cur);
++ update_rlimit_cpu(current->signal->rlim[RLIMIT_CPU].rlim_cur);
+ }
+ }
+
iwlwifi-set-default-aggregation-frame-count-limit-to-31.patch
drm-i915-only-enable-hotplug-for-detected-outputs.patch
firewire-core-add_descriptor-size-check.patch
+security-selinux-fix-update_rlimit_cpu-parameter.patch
+regulator-specify-regulator_change_status-for-wm835x-led-constraints.patch
+x86-add-dell-optiplex-760-reboot-quirk.patch
+x86-add-quirk-for-intel-dg45fc-board-to-avoid-low-memory-corruption.patch
+x86-amd-iommu-fix-possible-integer-overflow.patch
+clocksource-fix-compilation-if-no-generic_time.patch
+tcp-update-the-netstamp_needed-counter-when-cloning-sockets.patch
+sky2-fix-oops-in-sky2_xmit_frame-after-tx-timeout.patch
+net-restore-ip-source-validation.patch
+af_packet-don-t-use-skb-after-dev_queue_xmit.patch
+ax25-netrom-rose-fix-timer-oopses.patch
--- /dev/null
+From 91463eeb2c2c709e7ccc614dc5c7e39bc5ba24e1 Mon Sep 17 00:00:00 2001
+From: Jarek Poplawski <jarkao2@gmail.com>
+Date: Mon, 4 Jan 2010 08:48:41 +0000
+Subject: sky2: Fix oops in sky2_xmit_frame() after TX timeout
+
+From: Jarek Poplawski <jarkao2@gmail.com>
+
+[ Upstream commit 9db2f1bec36805e57a003f7bb90e003815d96de8 ]
+
+During TX timeout procedure dev could be awoken too early, e.g. by
+sky2_complete_tx() called from sky2_down(). Then sky2_xmit_frame()
+can run while buffers are freed causing an oops. This patch fixes it
+by adding netif_device_present() test in sky2_tx_complete().
+
+Fixes: http://bugzilla.kernel.org/show_bug.cgi?id=14925
+
+With debugging by: Mike McCormack <mikem@ring3k.org>
+
+Reported-by: Berck E. Nash <flyboy@gmail.com>
+Tested-by: Berck E. Nash <flyboy@gmail.com>
+Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/sky2.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/sky2.c
++++ b/drivers/net/sky2.c
+@@ -1806,7 +1806,8 @@ static void sky2_tx_complete(struct sky2
+ sky2->tx_cons = idx;
+ smp_mb();
+
+- if (tx_avail(sky2) > MAX_SKB_TX_LE + 4)
++ /* Wake unless it's detached, and called e.g. from sky2_down() */
++ if (tx_avail(sky2) > MAX_SKB_TX_LE + 4 && netif_device_present(dev))
+ netif_wake_queue(dev);
+ }
+
--- /dev/null
+From fa4609a4e5fb0c9d380f4744be66fa7a9fdde1d4 Mon Sep 17 00:00:00 2001
+From: Octavian Purdila <opurdila@ixiacom.com>
+Date: Fri, 8 Jan 2010 00:00:09 -0800
+Subject: tcp: update the netstamp_needed counter when cloning sockets
+
+From: Octavian Purdila <opurdila@ixiacom.com>
+
+[ Upstream commit 704da560c0a0120d8869187f511491a00951a1d3 ]
+
+This fixes a netstamp_needed accounting issue when the listen socket
+has SO_TIMESTAMP set:
+
+ s = socket(AF_INET, SOCK_STREAM, 0);
+ setsockopt(s, SOL_SOCKET, SO_TIMESTAMP, 1); -> netstamp_needed = 1
+ bind(s, ...);
+ listen(s, ...);
+ s2 = accept(s, ...); -> netstamp_needed = 1
+ close(s2); -> netstamp_needed = 0
+ close(s); -> netstamp_needed = -1
+
+Signed-off-by: Octavian Purdila <opurdila@ixiacom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/core/sock.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -1181,6 +1181,10 @@ struct sock *sk_clone(const struct sock
+
+ if (newsk->sk_prot->sockets_allocated)
+ percpu_counter_inc(newsk->sk_prot->sockets_allocated);
++
++ if (sock_flag(newsk, SOCK_TIMESTAMP) ||
++ sock_flag(newsk, SOCK_TIMESTAMPING_RX_SOFTWARE))
++ net_enable_timestamp();
+ }
+ out:
+ return newsk;
--- /dev/null
+From 35ea63d70f827a26c150993b4b940925bb02b03f Mon Sep 17 00:00:00 2001
+From: Leann Ogasawara <leann.ogasawara@canonical.com>
+Date: Wed, 27 Jan 2010 15:29:18 -0800
+Subject: x86: Add Dell OptiPlex 760 reboot quirk
+
+From: Leann Ogasawara <leann.ogasawara@canonical.com>
+
+commit 35ea63d70f827a26c150993b4b940925bb02b03f upstream.
+
+Dell OptiPlex 760 hangs on reboot unless reboot=bios is used. Add quirk
+to reboot through the BIOS.
+
+BugLink: https://bugs.launchpad.net/bugs/488319
+
+Signed-off-by: Leann Ogasawara <leann.ogasawara@canonical.com>
+LKML-Reference: <1264634958.27335.1091.camel@emiko>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/reboot.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -203,6 +203,15 @@ static struct dmi_system_id __initdata r
+ DMI_MATCH(DMI_BOARD_NAME, "0T656F"),
+ },
+ },
++ { /* Handle problems with rebooting on Dell OptiPlex 760 with 0G919G*/
++ .callback = set_bios_reboot,
++ .ident = "Dell OptiPlex 760",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 760"),
++ DMI_MATCH(DMI_BOARD_NAME, "0G919G"),
++ },
++ },
+ { /* Handle problems with rebooting on Dell 2400's */
+ .callback = set_bios_reboot,
+ .ident = "Dell PowerEdge 2400",
--- /dev/null
+From 7c099ce1575126395f186ecf58b51a60d5c3be7d Mon Sep 17 00:00:00 2001
+From: David Härdeman <david@hardeman.nu>
+Date: Thu, 28 Jan 2010 21:02:54 +0100
+Subject: x86: Add quirk for Intel DG45FC board to avoid low memory corruption
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David Härdeman <david@hardeman.nu>
+
+commit 7c099ce1575126395f186ecf58b51a60d5c3be7d upstream.
+
+Commit 6aa542a694dc9ea4344a8a590d2628c33d1b9431 added a quirk for the
+Intel DG45ID board due to low memory corruption. The Intel DG45FC
+shares the same BIOS (and the same bug) as noted in:
+
+ http://bugzilla.kernel.org/show_bug.cgi?id=13736
+
+Signed-off-by: David Härdeman <david@hardeman.nu>
+LKML-Reference: <20100128200254.GA9134@hardeman.nu>
+Cc: Alexey Fisher <bug-track@fisher-privat.net>
+Cc: ykzhao <yakui.zhao@intel.com>
+Cc: Tony Bones <aabonesml@gmail.com>
+Cc: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/setup.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/kernel/setup.c
++++ b/arch/x86/kernel/setup.c
+@@ -667,19 +667,27 @@ static struct dmi_system_id __initdata b
+ DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix/MSC"),
+ },
+ },
+- {
+ /*
+- * AMI BIOS with low memory corruption was found on Intel DG45ID board.
+- * It hase different DMI_BIOS_VENDOR = "Intel Corp.", for now we will
++ * AMI BIOS with low memory corruption was found on Intel DG45ID and
++ * DG45FC boards.
++ * It has a different DMI_BIOS_VENDOR = "Intel Corp.", for now we will
+ * match only DMI_BOARD_NAME and see if there is more bad products
+ * with this vendor.
+ */
++ {
+ .callback = dmi_low_memory_corruption,
+ .ident = "AMI BIOS",
+ .matches = {
+ DMI_MATCH(DMI_BOARD_NAME, "DG45ID"),
+ },
+ },
++ {
++ .callback = dmi_low_memory_corruption,
++ .ident = "AMI BIOS",
++ .matches = {
++ DMI_MATCH(DMI_BOARD_NAME, "DG45FC"),
++ },
++ },
+ #endif
+ {}
+ };
--- /dev/null
+From d91afd15b041f27d34859c79afa9e172018a86f4 Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <joerg.roedel@amd.com>
+Date: Fri, 22 Jan 2010 16:40:20 +0100
+Subject: x86/amd-iommu: Fix possible integer overflow
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+commit d91afd15b041f27d34859c79afa9e172018a86f4 upstream.
+
+The variable i in this function could be increased to over
+2**32 which would result in an integer overflow when using
+int. Fix it by changing i to unsigned long.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/amd_iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/amd_iommu.c
++++ b/arch/x86/kernel/amd_iommu.c
+@@ -540,7 +540,7 @@ static void flush_all_devices_for_iommu(
+ static void flush_devices_by_domain(struct protection_domain *domain)
+ {
+ struct amd_iommu *iommu;
+- int i;
++ unsigned long i;
+
+ for (i = 0; i <= amd_iommu_last_bdf; ++i) {
+ if ((domain == NULL && amd_iommu_pd_table[i] == NULL) ||
projects / thirdparty / kernel / stable-queue.git / commitdiff
