--- /dev/null
+From gregkh@mini.kroah.org Wed Dec 16 19:56:43 2009
+Message-Id: <20091217035457.723063696@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:54:57 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [000/151] 2.6.32.2-stable review
+
+This is the start of the stable review cycle for the 2.6.23.2 release.
+There are 151 patches in this series, all will be posted as a response
+to this one. If anyone has any issues with these being applied, please
+let us know. If anyone is a maintainer of the proper subsystem, and
+wants to add a Signed-off-by: line to the patch, please respond with it.
+
+Responses should be made by Friday, December 19, 00:00:00 UTC.
+Anything received after that time might be too late.
+
+The whole patch series can be found in one patch at:
+ kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.32.2-rc1.gz
+and the diffstat can be found below.
+
+thanks,
+
+greg k-h
+
+------------
+
+ Documentation/Changes | 2 +
+ Documentation/kernel-parameters.txt | 2 +
+ Documentation/video4linux/gspca.txt | 1 +
+ MAINTAINERS | 4 +-
+ Makefile | 2 +-
+ arch/arm/mach-pxa/em-x270.c | 11 +-
+ arch/ia64/include/asm/io.h | 2 +
+ arch/ia64/mm/ioremap.c | 11 ++
+ arch/powerpc/kernel/vector.S | 2 +-
+ arch/s390/include/asm/kvm.h | 3 +-
+ arch/s390/kernel/head64.S | 3 +
+ arch/s390/kvm/kvm-s390.c | 25 ++-
+ arch/s390/kvm/sigp.c | 6 +-
+ arch/sparc/Makefile | 2 +
+ arch/sparc/kernel/ldc.c | 4 +-
+ arch/sparc/kernel/of_device_64.c | 14 ++-
+ arch/sparc/lib/mcount.S | 5 +-
+ arch/x86/Makefile_32.cpu | 7 +
+ arch/x86/include/asm/irq_vectors.h | 2 +-
+ arch/x86/include/asm/kvm_emulate.h | 2 +-
+ arch/x86/include/asm/mce.h | 6 +
+ arch/x86/kernel/acpi/cstate.c | 2 +-
+ arch/x86/kernel/amd_iommu.c | 8 +-
+ arch/x86/kernel/amd_iommu_init.c | 2 +-
+ arch/x86/kernel/apic/apic.c | 2 +-
+ arch/x86/kernel/cpu/intel_cacheinfo.c | 5 +-
+ arch/x86/kernel/cpu/mcheck/mce.c | 9 +-
+ arch/x86/kernel/cpu/mcheck/therm_throt.c | 29 +++-
+ arch/x86/kernel/cpu/perfctr-watchdog.c | 2 +-
+ arch/x86/kernel/pci-calgary_64.c | 12 +-
+ arch/x86/kernel/pci-dma.c | 2 +-
+ arch/x86/kernel/pci-gart_64.c | 2 +-
+ arch/x86/kernel/reboot.c | 8 +
+ arch/x86/kernel/setup.c | 3 +
+ arch/x86/kernel/tlb_uv.c | 4 +-
+ arch/x86/kvm/emulate.c | 5 +-
+ arch/x86/kvm/x86.c | 12 +-
+ arch/x86/xen/enlighten.c | 27 ++--
+ arch/x86/xen/mmu.c | 2 +-
+ arch/x86/xen/smp.c | 1 +
+ arch/x86/xen/suspend.c | 17 ++-
+ arch/x86/xen/time.c | 7 +-
+ arch/x86/xen/xen-asm_64.S | 4 +-
+ arch/x86/xen/xen-ops.h | 2 +
+ drivers/ata/pata_hpt37x.c | 32 ++--
+ drivers/ata/pata_hpt3x2n.c | 17 +-
+ drivers/base/core.c | 9 +-
+ drivers/base/power/runtime.c | 2 +-
+ drivers/firewire/ohci.c | 12 +-
+ drivers/gpu/drm/drm_irq.c | 34 +++-
+ drivers/gpu/drm/i915/i915_drv.h | 4 +
+ drivers/gpu/drm/i915/i915_gem.c | 1 +
+ drivers/gpu/drm/i915/intel_display.c | 67 +++++---
+ drivers/gpu/drm/i915/intel_dp.c | 6 +-
+ drivers/gpu/drm/i915/intel_tv.c | 11 +-
+ drivers/gpu/drm/radeon/atombios_crtc.c | 8 +-
+ drivers/gpu/drm/radeon/radeon_atombios.c | 8 +
+ drivers/gpu/drm/radeon/radeon_legacy_crtc.c | 7 +-
+ drivers/gpu/drm/radeon/rs600.c | 15 ++-
+ drivers/gpu/drm/radeon/rs690.c | 19 +-
+ drivers/ide/slc90e66.c | 3 +-
+ drivers/macintosh/therm_adt746x.c | 13 ++-
+ drivers/macintosh/windfarm_smu_controls.c | 2 +
+ drivers/md/bitmap.c | 24 ++-
+ drivers/md/bitmap.h | 2 +-
+ drivers/md/dm-crypt.c | 170 +++++++++++++------
+ drivers/md/dm-exception-store.c | 3 +-
+ drivers/md/dm-ioctl.c | 17 ++-
+ drivers/md/dm-snap.c | 12 +-
+ drivers/md/dm-uevent.c | 9 +-
+ drivers/md/md.c | 3 +-
+ drivers/md/md.h | 1 +
+ drivers/media/common/tuners/mxl5007t.c | 2 +-
+ drivers/media/video/gspca/ov519.c | 1 +
+ drivers/mtd/ubi/upd.c | 20 ++-
+ drivers/net/b44.c | 3 +-
+ drivers/net/bcm63xx_enet.c | 12 +-
+ drivers/net/wireless/ath/ath5k/eeprom.c | 3 +-
+ drivers/net/wireless/ath/ath5k/phy.c | 2 -
+ drivers/net/wireless/ath/ath9k/ath9k.h | 3 +
+ drivers/net/wireless/ath/ath9k/hw.c | 11 +-
+ drivers/net/wireless/ath/ath9k/hw.h | 1 +
+ drivers/net/wireless/ath/ath9k/mac.c | 6 +-
+ drivers/net/wireless/ath/ath9k/mac.h | 1 +
+ drivers/net/wireless/ath/ath9k/main.c | 9 +-
+ drivers/net/wireless/ath/ath9k/xmit.c | 20 ++-
+ drivers/net/wireless/b43legacy/rfkill.c | 7 +
+ drivers/net/wireless/ipw2x00/ipw2100.c | 11 ++
+ drivers/net/wireless/rtl818x/rtl8187.h | 5 +
+ drivers/net/wireless/rtl818x/rtl8187_dev.c | 12 +-
+ drivers/net/wireless/rtl818x/rtl8187_rfkill.c | 4 +-
+ drivers/pci/dmar.c | 67 ++++++--
+ drivers/pci/intel-iommu.c | 26 +++-
+ drivers/platform/x86/acerhdf.c | 63 ++++---
+ drivers/platform/x86/asus-laptop.c | 4 +-
+ drivers/platform/x86/thinkpad_acpi.c | 36 +---
+ drivers/serial/8250.c | 8 +-
+ drivers/ssb/sprom.c | 20 ++-
+ drivers/usb/class/usbtmc.c | 14 +-
+ drivers/usb/core/usb.c | 31 ++--
+ drivers/usb/musb/musb_gadget_ep0.c | 1 -
+ drivers/usb/serial/option.c | 37 ++++
+ drivers/usb/storage/transport.c | 17 ++-
+ drivers/usb/storage/unusual_devs.h | 7 +
+ drivers/usb/storage/usb.c | 18 ++-
+ drivers/video/matrox/g450_pll.c | 3 +-
+ drivers/xen/balloon.c | 38 +---
+ drivers/xen/events.c | 3 +
+ drivers/xen/manage.c | 37 +++--
+ drivers/xen/xenbus/xenbus_probe.c | 6 +-
+ fs/debugfs/inode.c | 55 ++++---
+ fs/devpts/inode.c | 16 ++-
+ fs/ext3/inode.c | 18 ++-
+ fs/hfs/catalog.c | 4 +
+ fs/hfs/dir.c | 11 ++
+ fs/hfs/super.c | 7 +-
+ fs/jbd2/journal.c | 7 +
+ fs/jffs2/gc.c | 3 +-
+ fs/nfs/write.c | 5 +-
+ include/drm/drmP.h | 1 +
+ include/drm/ttm/ttm_memory.h | 1 +
+ include/linux/hrtimer.h | 4 +-
+ include/linux/kvm.h | 8 +-
+ include/linux/perf_event.h | 2 +-
+ include/linux/usb_usual.h | 4 +-
+ include/linux/vmalloc.h | 2 +
+ include/net/tcp.h | 10 +-
+ include/trace/ftrace.h | 2 +-
+ kernel/acct.c | 3 +-
+ kernel/futex.c | 10 +-
+ kernel/perf_event.c | 6 +-
+ kernel/rcutree.c | 227 +++++++++++++++----------
+ kernel/rcutree.h | 13 +-
+ kernel/rcutree_plugin.h | 4 +-
+ kernel/sched.c | 28 +++-
+ kernel/sched_debug.c | 4 +
+ kernel/sched_fair.c | 35 ++++-
+ kernel/sysctl.c | 3 +-
+ mm/memcontrol.c | 1 +
+ mm/memory.c | 4 +-
+ mm/mincore.c | 37 ++++
+ mm/pagewalk.c | 16 ++-
+ mm/vmalloc.c | 2 +
+ net/core/dev.c | 11 ++
+ net/core/rtnetlink.c | 4 +-
+ net/ipv4/ip_output.c | 2 +-
+ net/mac80211/cfg.c | 3 +-
+ net/mac80211/ieee80211_i.h | 1 +
+ net/mac80211/mesh.h | 5 +-
+ net/mac80211/mesh_hwmp.c | 2 +-
+ net/mac80211/rx.c | 1 -
+ net/mac80211/scan.c | 32 +++-
+ net/mac80211/util.c | 2 +-
+ net/netfilter/ipvs/ip_vs_ctl.c | 4 +
+ net/sunrpc/auth_gss/auth_gss.c | 2 +-
+ sound/core/hrtimer.c | 15 ++-
+ sound/pci/hda/hda_intel.c | 5 +
+ virt/kvm/irq_comm.c | 7 +-
+ 158 files changed, 1395 insertions(+), 617 deletions(-)
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:43 2009
+Message-Id: <20091217035643.118533253@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:54:58 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Stern <stern@rowland.harvard.edu>
+Subject: [001/151] USB: usb-storage: fix bug in fill_inquiry
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit f3f6faa9edf67c1018270793e0547b0f81abb47e upstream.
+
+This patch (as1312) fixes a minor bug in usb-storage. The
+fill_inquiry() routine neglects to pre-load the inquiry data buffer
+with spaces. As a result, if the vendor name is shorter than 8
+characters or the product name is shorter than 16, the remainder will
+be filled with garbage.
+
+The patch also removes some unnecessary calls to strlen().
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/storage/usb.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+--- a/drivers/usb/storage/usb.c
++++ b/drivers/usb/storage/usb.c
+@@ -228,6 +228,7 @@ void fill_inquiry_response(struct us_dat
+ if (data_len<36) // You lose.
+ return;
+
++ memset(data+8, ' ', 28);
+ if(data[0]&0x20) { /* USB device currently not connected. Return
+ peripheral qualifier 001b ("...however, the
+ physical device is not currently connected
+@@ -237,15 +238,15 @@ void fill_inquiry_response(struct us_dat
+ device, it may return zeros or ASCII spaces
+ (20h) in those fields until the data is
+ available from the device."). */
+- memset(data+8,0,28);
+ } else {
+ u16 bcdDevice = le16_to_cpu(us->pusb_dev->descriptor.bcdDevice);
+- memcpy(data+8, us->unusual_dev->vendorName,
+- strlen(us->unusual_dev->vendorName) > 8 ? 8 :
+- strlen(us->unusual_dev->vendorName));
+- memcpy(data+16, us->unusual_dev->productName,
+- strlen(us->unusual_dev->productName) > 16 ? 16 :
+- strlen(us->unusual_dev->productName));
++ int n;
++
++ n = strlen(us->unusual_dev->vendorName);
++ memcpy(data+8, us->unusual_dev->vendorName, min(8, n));
++ n = strlen(us->unusual_dev->productName);
++ memcpy(data+16, us->unusual_dev->productName, min(16, n));
++
+ data[32] = 0x30 + ((bcdDevice>>12) & 0x0F);
+ data[33] = 0x30 + ((bcdDevice>>8) & 0x0F);
+ data[34] = 0x30 + ((bcdDevice>>4) & 0x0F);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:43 2009
+Message-Id: <20091217035643.246560980@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:54:59 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ming Zhao <zhao.ming9@zte.com.cn>
+Subject: [002/151] USB: option: add pid for ZTE
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: zhao.ming9@zte.com.cn <zhao.ming9@zte.com.cn>
+
+commit 8d87cacda7c8db5c131bfcaaa1d90bfe918c2ebc upstream.
+
+This patch adds ZTE modem devices.
+
+Signed-off-by: Ming Zhao <zhao.ming9@zte.com.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/option.c | 36 ++++++++++++++++++++++++++++++++++++
+ 1 file changed, 36 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -580,12 +580,48 @@ static struct usb_device_id option_ids[]
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0086, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0104, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0106, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0108, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0113, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0117, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0118, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0121, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0122, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0123, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0124, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0125, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0126, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0128, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0142, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0143, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0144, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0145, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0146, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0147, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0148, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0149, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0150, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0151, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0152, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0153, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0154, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0155, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0156, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0157, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0158, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0159, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0160, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0161, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0162, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0014, 0xff, 0xff, 0xff) }, /* ZTE CDMA products */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0027, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0059, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0060, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0141, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:43 2009
+Message-Id: <20091217035643.371242977@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:00 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jay Fenlason <fenlason@redhat.com>,
+ Stefan Richter <stefanr@s5r6.in-berlin.de>
+Subject: [003/151] firewire: ohci: handle receive packets with a data length of zero
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jay Fenlason <fenlason@redhat.com>
+
+commit 8c0c0cc2d9f4c523fde04bdfe41e4380dec8ee54 upstream.
+
+Queueing to receive an ISO packet with a payload length of zero
+silently does nothing in dualbuffer mode, and crashes the kernel in
+packet-per-buffer mode. Return an error in dualbuffer mode, because
+the DMA controller won't let us do what we want, and work correctly in
+packet-per-buffer mode.
+
+Signed-off-by: Jay Fenlason <fenlason@redhat.com>
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/firewire/ohci.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/firewire/ohci.c
++++ b/drivers/firewire/ohci.c
+@@ -2209,6 +2209,13 @@ static int ohci_queue_iso_receive_dualbu
+ page = payload >> PAGE_SHIFT;
+ offset = payload & ~PAGE_MASK;
+ rest = p->payload_length;
++ /*
++ * The controllers I've tested have not worked correctly when
++ * second_req_count is zero. Rather than do something we know won't
++ * work, return an error
++ */
++ if (rest == 0)
++ return -EINVAL;
+
+ /* FIXME: make packet-per-buffer/dual-buffer a context option */
+ while (rest > 0) {
+@@ -2262,7 +2269,7 @@ static int ohci_queue_iso_receive_packet
+ unsigned long payload)
+ {
+ struct iso_context *ctx = container_of(base, struct iso_context, base);
+- struct descriptor *d = NULL, *pd = NULL;
++ struct descriptor *d, *pd;
+ struct fw_iso_packet *p = packet;
+ dma_addr_t d_bus, page_bus;
+ u32 z, header_z, rest;
+@@ -2300,8 +2307,9 @@ static int ohci_queue_iso_receive_packet
+ d->data_address = cpu_to_le32(d_bus + (z * sizeof(*d)));
+
+ rest = payload_per_buffer;
++ pd = d;
+ for (j = 1; j < z; j++) {
+- pd = d + j;
++ pd++;
+ pd->control = cpu_to_le16(DESCRIPTOR_STATUS |
+ DESCRIPTOR_INPUT_MORE);
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:43 2009
+Message-Id: <20091217035643.505448694@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:01 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>,
+ laijs@cn.fujitsu.com,
+ dipankar@in.ibm.com,
+ mathieu.desnoyers@polymtl.ca,
+ josh@joshtriplett.org,
+ dvhltc@us.ibm.com,
+ niv@us.ibm.com,
+ peterz@infradead.org,
+ rostedt@goodmis.org,
+ Valdis.Kletnieks@vt.edu,
+ dhowells@redhat.com,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [004/151] rcu: Prepare for synchronization fixes: clean up for non-NO_HZ handling of ->completed counter
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+
+commit 281d150c5f8892f158747594ab49ce2823fd8b8c upstream.
+
+Impose a clear locking design on non-NO_HZ handling of the
+->completed counter. This increases the distance between the
+RCU and the CPU-hotplug mechanisms.
+
+Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Cc: laijs@cn.fujitsu.com
+Cc: dipankar@in.ibm.com
+Cc: mathieu.desnoyers@polymtl.ca
+Cc: josh@joshtriplett.org
+Cc: dvhltc@us.ibm.com
+Cc: niv@us.ibm.com
+Cc: peterz@infradead.org
+Cc: rostedt@goodmis.org
+Cc: Valdis.Kletnieks@vt.edu
+Cc: dhowells@redhat.com
+LKML-Reference: <12571987491353-git-send-email->
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/rcutree.c | 67 ++++++++++++++++++++++++-------------------------------
+ kernel/rcutree.h | 8 +++---
+ 2 files changed, 34 insertions(+), 41 deletions(-)
+
+--- a/kernel/rcutree.c
++++ b/kernel/rcutree.c
+@@ -176,9 +176,29 @@ static struct rcu_node *rcu_get_root(str
+ return &rsp->node[0];
+ }
+
++/*
++ * Record the specified "completed" value, which is later used to validate
++ * dynticks counter manipulations and CPU-offline checks. Specify
++ * "rsp->completed - 1" to unconditionally invalidate any future dynticks
++ * manipulations and CPU-offline checks. Such invalidation is useful at
++ * the beginning of a grace period.
++ */
++static void dyntick_record_completed(struct rcu_state *rsp, long comp)
++{
++ rsp->dynticks_completed = comp;
++}
++
+ #ifdef CONFIG_SMP
+
+ /*
++ * Recall the previously recorded value of the completion for dynticks.
++ */
++static long dyntick_recall_completed(struct rcu_state *rsp)
++{
++ return rsp->dynticks_completed;
++}
++
++/*
+ * If the specified CPU is offline, tell the caller that it is in
+ * a quiescent state. Otherwise, whack it with a reschedule IPI.
+ * Grace periods can end up waiting on an offline CPU when that
+@@ -335,28 +355,9 @@ void rcu_irq_exit(void)
+ set_need_resched();
+ }
+
+-/*
+- * Record the specified "completed" value, which is later used to validate
+- * dynticks counter manipulations. Specify "rsp->completed - 1" to
+- * unconditionally invalidate any future dynticks manipulations (which is
+- * useful at the beginning of a grace period).
+- */
+-static void dyntick_record_completed(struct rcu_state *rsp, long comp)
+-{
+- rsp->dynticks_completed = comp;
+-}
+-
+ #ifdef CONFIG_SMP
+
+ /*
+- * Recall the previously recorded value of the completion for dynticks.
+- */
+-static long dyntick_recall_completed(struct rcu_state *rsp)
+-{
+- return rsp->dynticks_completed;
+-}
+-
+-/*
+ * Snapshot the specified CPU's dynticks counter so that we can later
+ * credit them with an implicit quiescent state. Return 1 if this CPU
+ * is in dynticks idle mode, which is an extended quiescent state.
+@@ -419,24 +420,8 @@ static int rcu_implicit_dynticks_qs(stru
+
+ #else /* #ifdef CONFIG_NO_HZ */
+
+-static void dyntick_record_completed(struct rcu_state *rsp, long comp)
+-{
+-}
+-
+ #ifdef CONFIG_SMP
+
+-/*
+- * If there are no dynticks, then the only way that a CPU can passively
+- * be in a quiescent state is to be offline. Unlike dynticks idle, which
+- * is a point in time during the prior (already finished) grace period,
+- * an offline CPU is always in a quiescent state, and thus can be
+- * unconditionally applied. So just return the current value of completed.
+- */
+-static long dyntick_recall_completed(struct rcu_state *rsp)
+-{
+- return rsp->completed;
+-}
+-
+ static int dyntick_save_progress_counter(struct rcu_data *rdp)
+ {
+ return 0;
+@@ -1144,6 +1129,7 @@ static void force_quiescent_state(struct
+ long lastcomp;
+ struct rcu_node *rnp = rcu_get_root(rsp);
+ u8 signaled;
++ u8 forcenow;
+
+ if (!rcu_gp_in_progress(rsp))
+ return; /* No grace period in progress, nothing to force. */
+@@ -1180,16 +1166,23 @@ static void force_quiescent_state(struct
+ if (rcu_process_dyntick(rsp, lastcomp,
+ dyntick_save_progress_counter))
+ goto unlock_ret;
++ /* fall into next case. */
++
++ case RCU_SAVE_COMPLETED:
+
+ /* Update state, record completion counter. */
++ forcenow = 0;
+ spin_lock(&rnp->lock);
+ if (lastcomp == rsp->completed &&
+- rsp->signaled == RCU_SAVE_DYNTICK) {
++ rsp->signaled == signaled) {
+ rsp->signaled = RCU_FORCE_QS;
+ dyntick_record_completed(rsp, lastcomp);
++ forcenow = signaled == RCU_SAVE_COMPLETED;
+ }
+ spin_unlock(&rnp->lock);
+- break;
++ if (!forcenow)
++ break;
++ /* fall into next case. */
+
+ case RCU_FORCE_QS:
+
+--- a/kernel/rcutree.h
++++ b/kernel/rcutree.h
+@@ -204,11 +204,12 @@ struct rcu_data {
+ #define RCU_GP_IDLE 0 /* No grace period in progress. */
+ #define RCU_GP_INIT 1 /* Grace period being initialized. */
+ #define RCU_SAVE_DYNTICK 2 /* Need to scan dyntick state. */
+-#define RCU_FORCE_QS 3 /* Need to force quiescent state. */
++#define RCU_SAVE_COMPLETED 3 /* Need to save rsp->completed. */
++#define RCU_FORCE_QS 4 /* Need to force quiescent state. */
+ #ifdef CONFIG_NO_HZ
+ #define RCU_SIGNAL_INIT RCU_SAVE_DYNTICK
+ #else /* #ifdef CONFIG_NO_HZ */
+-#define RCU_SIGNAL_INIT RCU_FORCE_QS
++#define RCU_SIGNAL_INIT RCU_SAVE_COMPLETED
+ #endif /* #else #ifdef CONFIG_NO_HZ */
+
+ #define RCU_JIFFIES_TILL_FORCE_QS 3 /* for rsp->jiffies_force_qs */
+@@ -274,9 +275,8 @@ struct rcu_state {
+ unsigned long jiffies_stall; /* Time at which to check */
+ /* for CPU stalls. */
+ #endif /* #ifdef CONFIG_RCU_CPU_STALL_DETECTOR */
+-#ifdef CONFIG_NO_HZ
+ long dynticks_completed; /* Value of completed @ snap. */
+-#endif /* #ifdef CONFIG_NO_HZ */
++ /* Protected by fqslock. */
+ };
+
+ #ifdef RCU_TREE_NONCORE
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:43 2009
+Message-Id: <20091217035643.635648125@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:02 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>,
+ laijs@cn.fujitsu.com,
+ dipankar@in.ibm.com,
+ mathieu.desnoyers@polymtl.ca,
+ josh@joshtriplett.org,
+ dvhltc@us.ibm.com,
+ niv@us.ibm.com,
+ peterz@infradead.org,
+ rostedt@goodmis.org,
+ Valdis.Kletnieks@vt.edu,
+ dhowells@redhat.com,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [005/151] rcu: Fix synchronization for rcu_process_gp_end() uses of ->completed counter
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+
+commit d09b62dfa336447c52a5ec9bb88adbc479b0f3b8 upstream.
+
+Impose a clear locking design on the rcu_process_gp_end()
+function's use of the ->completed counter. This is done by
+creating a ->completed field in the rcu_node structure, which
+can safely be accessed under the protection of that structure's
+lock. Performance and scalability are maintained by using a
+form of double-checked locking, so that rcu_process_gp_end()
+only acquires the leaf rcu_node structure's ->lock if a grace
+period has recently ended.
+
+This fix reduces rcutorture failure rate by at least two orders
+of magnitude under heavy stress with force_quiescent_state()
+being invoked artificially often. Without this fix,
+unsynchronized access to the ->completed field can cause
+rcu_process_gp_end() to advance callbacks whose grace period has
+not yet expired. (Bad idea!)
+
+Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Cc: laijs@cn.fujitsu.com
+Cc: dipankar@in.ibm.com
+Cc: mathieu.desnoyers@polymtl.ca
+Cc: josh@joshtriplett.org
+Cc: dvhltc@us.ibm.com
+Cc: niv@us.ibm.com
+Cc: peterz@infradead.org
+Cc: rostedt@goodmis.org
+Cc: Valdis.Kletnieks@vt.edu
+Cc: dhowells@redhat.com
+LKML-Reference: <12571987494069-git-send-email->
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/rcutree.c | 128 ++++++++++++++++++++++++++++++++++---------------------
+ kernel/rcutree.h | 3 +
+ 2 files changed, 83 insertions(+), 48 deletions(-)
+
+--- a/kernel/rcutree.c
++++ b/kernel/rcutree.c
+@@ -568,6 +568,76 @@ check_for_new_grace_period(struct rcu_st
+ }
+
+ /*
++ * Advance this CPU's callbacks, but only if the current grace period
++ * has ended. This may be called only from the CPU to whom the rdp
++ * belongs. In addition, the corresponding leaf rcu_node structure's
++ * ->lock must be held by the caller, with irqs disabled.
++ */
++static void
++__rcu_process_gp_end(struct rcu_state *rsp, struct rcu_node *rnp, struct rcu_data *rdp)
++{
++ /* Did another grace period end? */
++ if (rdp->completed != rnp->completed) {
++
++ /* Advance callbacks. No harm if list empty. */
++ rdp->nxttail[RCU_DONE_TAIL] = rdp->nxttail[RCU_WAIT_TAIL];
++ rdp->nxttail[RCU_WAIT_TAIL] = rdp->nxttail[RCU_NEXT_READY_TAIL];
++ rdp->nxttail[RCU_NEXT_READY_TAIL] = rdp->nxttail[RCU_NEXT_TAIL];
++
++ /* Remember that we saw this grace-period completion. */
++ rdp->completed = rnp->completed;
++ }
++}
++
++/*
++ * Advance this CPU's callbacks, but only if the current grace period
++ * has ended. This may be called only from the CPU to whom the rdp
++ * belongs.
++ */
++static void
++rcu_process_gp_end(struct rcu_state *rsp, struct rcu_data *rdp)
++{
++ unsigned long flags;
++ struct rcu_node *rnp;
++
++ local_irq_save(flags);
++ rnp = rdp->mynode;
++ if (rdp->completed == ACCESS_ONCE(rnp->completed) || /* outside lock. */
++ !spin_trylock(&rnp->lock)) { /* irqs already off, retry later. */
++ local_irq_restore(flags);
++ return;
++ }
++ __rcu_process_gp_end(rsp, rnp, rdp);
++ spin_unlock_irqrestore(&rnp->lock, flags);
++}
++
++/*
++ * Do per-CPU grace-period initialization for running CPU. The caller
++ * must hold the lock of the leaf rcu_node structure corresponding to
++ * this CPU.
++ */
++static void
++rcu_start_gp_per_cpu(struct rcu_state *rsp, struct rcu_node *rnp, struct rcu_data *rdp)
++{
++ /* Prior grace period ended, so advance callbacks for current CPU. */
++ __rcu_process_gp_end(rsp, rnp, rdp);
++
++ /*
++ * Because this CPU just now started the new grace period, we know
++ * that all of its callbacks will be covered by this upcoming grace
++ * period, even the ones that were registered arbitrarily recently.
++ * Therefore, advance all outstanding callbacks to RCU_WAIT_TAIL.
++ *
++ * Other CPUs cannot be sure exactly when the grace period started.
++ * Therefore, their recently registered callbacks must pass through
++ * an additional RCU_NEXT_READY stage, so that they will be handled
++ * by the next RCU grace period.
++ */
++ rdp->nxttail[RCU_NEXT_READY_TAIL] = rdp->nxttail[RCU_NEXT_TAIL];
++ rdp->nxttail[RCU_WAIT_TAIL] = rdp->nxttail[RCU_NEXT_TAIL];
++}
++
++/*
+ * Start a new RCU grace period if warranted, re-initializing the hierarchy
+ * in preparation for detecting the next grace period. The caller must hold
+ * the root node's ->lock, which is released before return. Hard irqs must
+@@ -594,26 +664,14 @@ rcu_start_gp(struct rcu_state *rsp, unsi
+ dyntick_record_completed(rsp, rsp->completed - 1);
+ note_new_gpnum(rsp, rdp);
+
+- /*
+- * Because this CPU just now started the new grace period, we know
+- * that all of its callbacks will be covered by this upcoming grace
+- * period, even the ones that were registered arbitrarily recently.
+- * Therefore, advance all outstanding callbacks to RCU_WAIT_TAIL.
+- *
+- * Other CPUs cannot be sure exactly when the grace period started.
+- * Therefore, their recently registered callbacks must pass through
+- * an additional RCU_NEXT_READY stage, so that they will be handled
+- * by the next RCU grace period.
+- */
+- rdp->nxttail[RCU_NEXT_READY_TAIL] = rdp->nxttail[RCU_NEXT_TAIL];
+- rdp->nxttail[RCU_WAIT_TAIL] = rdp->nxttail[RCU_NEXT_TAIL];
+-
+ /* Special-case the common single-level case. */
+ if (NUM_RCU_NODES == 1) {
+ rcu_preempt_check_blocked_tasks(rnp);
+ rnp->qsmask = rnp->qsmaskinit;
+ rnp->gpnum = rsp->gpnum;
++ rnp->completed = rsp->completed;
+ rsp->signaled = RCU_SIGNAL_INIT; /* force_quiescent_state OK. */
++ rcu_start_gp_per_cpu(rsp, rnp, rdp);
+ spin_unlock_irqrestore(&rnp->lock, flags);
+ return;
+ }
+@@ -646,6 +704,9 @@ rcu_start_gp(struct rcu_state *rsp, unsi
+ rcu_preempt_check_blocked_tasks(rnp);
+ rnp->qsmask = rnp->qsmaskinit;
+ rnp->gpnum = rsp->gpnum;
++ rnp->completed = rsp->completed;
++ if (rnp == rdp->mynode)
++ rcu_start_gp_per_cpu(rsp, rnp, rdp);
+ spin_unlock(&rnp->lock); /* irqs remain disabled. */
+ }
+
+@@ -657,34 +718,6 @@ rcu_start_gp(struct rcu_state *rsp, unsi
+ }
+
+ /*
+- * Advance this CPU's callbacks, but only if the current grace period
+- * has ended. This may be called only from the CPU to whom the rdp
+- * belongs.
+- */
+-static void
+-rcu_process_gp_end(struct rcu_state *rsp, struct rcu_data *rdp)
+-{
+- long completed_snap;
+- unsigned long flags;
+-
+- local_irq_save(flags);
+- completed_snap = ACCESS_ONCE(rsp->completed); /* outside of lock. */
+-
+- /* Did another grace period end? */
+- if (rdp->completed != completed_snap) {
+-
+- /* Advance callbacks. No harm if list empty. */
+- rdp->nxttail[RCU_DONE_TAIL] = rdp->nxttail[RCU_WAIT_TAIL];
+- rdp->nxttail[RCU_WAIT_TAIL] = rdp->nxttail[RCU_NEXT_READY_TAIL];
+- rdp->nxttail[RCU_NEXT_READY_TAIL] = rdp->nxttail[RCU_NEXT_TAIL];
+-
+- /* Remember that we saw this grace-period completion. */
+- rdp->completed = completed_snap;
+- }
+- local_irq_restore(flags);
+-}
+-
+-/*
+ * Clean up after the prior grace period and let rcu_start_gp() start up
+ * the next grace period if one is needed. Note that the caller must
+ * hold rnp->lock, as required by rcu_start_gp(), which will release it.
+@@ -695,7 +728,6 @@ static void cpu_quiet_msk_finish(struct
+ WARN_ON_ONCE(!rcu_gp_in_progress(rsp));
+ rsp->completed = rsp->gpnum;
+ rsp->signaled = RCU_GP_IDLE;
+- rcu_process_gp_end(rsp, rsp->rda[smp_processor_id()]);
+ rcu_start_gp(rsp, flags); /* releases root node's rnp->lock. */
+ }
+
+@@ -1537,21 +1569,16 @@ static void __cpuinit
+ rcu_init_percpu_data(int cpu, struct rcu_state *rsp, int preemptable)
+ {
+ unsigned long flags;
+- long lastcomp;
+ unsigned long mask;
+ struct rcu_data *rdp = rsp->rda[cpu];
+ struct rcu_node *rnp = rcu_get_root(rsp);
+
+ /* Set up local state, ensuring consistent view of global state. */
+ spin_lock_irqsave(&rnp->lock, flags);
+- lastcomp = rsp->completed;
+- rdp->completed = lastcomp;
+- rdp->gpnum = lastcomp;
+ rdp->passed_quiesc = 0; /* We could be racing with new GP, */
+ rdp->qs_pending = 1; /* so set up to respond to current GP. */
+ rdp->beenonline = 1; /* We have now been online. */
+ rdp->preemptable = preemptable;
+- rdp->passed_quiesc_completed = lastcomp - 1;
+ rdp->qlen_last_fqs_check = 0;
+ rdp->n_force_qs_snap = rsp->n_force_qs;
+ rdp->blimit = blimit;
+@@ -1573,6 +1600,11 @@ rcu_init_percpu_data(int cpu, struct rcu
+ spin_lock(&rnp->lock); /* irqs already disabled. */
+ rnp->qsmaskinit |= mask;
+ mask = rnp->grpmask;
++ if (rnp == rdp->mynode) {
++ rdp->gpnum = rnp->completed; /* if GP in progress... */
++ rdp->completed = rnp->completed;
++ rdp->passed_quiesc_completed = rnp->completed - 1;
++ }
+ spin_unlock(&rnp->lock); /* irqs already disabled. */
+ rnp = rnp->parent;
+ } while (rnp != NULL && !(rnp->qsmaskinit & mask));
+--- a/kernel/rcutree.h
++++ b/kernel/rcutree.h
+@@ -84,6 +84,9 @@ struct rcu_node {
+ long gpnum; /* Current grace period for this node. */
+ /* This will either be equal to or one */
+ /* behind the root rcu_node's gpnum. */
++ long completed; /* Last grace period completed for this node. */
++ /* This will either be equal to or one */
++ /* behind the root rcu_node's gpnum. */
+ unsigned long qsmask; /* CPUs or groups that need to switch in */
+ /* order for current grace period to proceed.*/
+ /* In leaf rcu_node, each bit corresponds to */
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:43 2009
+Message-Id: <20091217035643.762235033@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:03 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>,
+ laijs@cn.fujitsu.com,
+ dipankar@in.ibm.com,
+ mathieu.desnoyers@polymtl.ca,
+ josh@joshtriplett.org,
+ dvhltc@us.ibm.com,
+ niv@us.ibm.com,
+ peterz@infradead.org,
+ rostedt@goodmis.org,
+ Valdis.Kletnieks@vt.edu,
+ dhowells@redhat.com,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [006/151] rcu: Fix note_new_gpnum() uses of ->gpnum
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+
+commit 9160306e6f5b68bb64630c9031c517ca1cf463db upstream.
+
+Impose a clear locking design on the note_new_gpnum()
+function's use of the ->gpnum counter. This is done by updating
+rdp->gpnum only from the corresponding leaf rcu_node structure's
+rnp->gpnum field, and even then only under the protection of
+that same rcu_node structure's ->lock field. Performance and
+scalability are maintained using a form of double-checked
+locking, and excessive spinning is avoided by use of the
+spin_trylock() function. The use of spin_trylock() is safe due
+to the fact that CPUs who fail to acquire this lock will try
+again later. The hierarchical nature of the rcu_node data
+structure limits contention (which could be limited further if
+need be using the RCU_FANOUT kernel parameter).
+
+Without this patch, obscure but quite possible races could
+result in a quiescent state that occurred during one grace
+period to be accounted to the following grace period, causing
+this following grace period to end prematurely. Not good!
+
+Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Cc: laijs@cn.fujitsu.com
+Cc: dipankar@in.ibm.com
+Cc: mathieu.desnoyers@polymtl.ca
+Cc: josh@joshtriplett.org
+Cc: dvhltc@us.ibm.com
+Cc: niv@us.ibm.com
+Cc: peterz@infradead.org
+Cc: rostedt@goodmis.org
+Cc: Valdis.Kletnieks@vt.edu
+Cc: dhowells@redhat.com
+LKML-Reference: <12571987492350-git-send-email->
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/rcutree.c | 34 ++++++++++++++++++++++++++++------
+ 1 file changed, 28 insertions(+), 6 deletions(-)
+
+--- a/kernel/rcutree.c
++++ b/kernel/rcutree.c
+@@ -538,13 +538,33 @@ static void check_cpu_stall(struct rcu_s
+ /*
+ * Update CPU-local rcu_data state to record the newly noticed grace period.
+ * This is used both when we started the grace period and when we notice
+- * that someone else started the grace period.
+- */
++ * that someone else started the grace period. The caller must hold the
++ * ->lock of the leaf rcu_node structure corresponding to the current CPU,
++ * and must have irqs disabled.
++ */
++static void __note_new_gpnum(struct rcu_state *rsp, struct rcu_node *rnp, struct rcu_data *rdp)
++{
++ if (rdp->gpnum != rnp->gpnum) {
++ rdp->qs_pending = 1;
++ rdp->passed_quiesc = 0;
++ rdp->gpnum = rnp->gpnum;
++ }
++}
++
+ static void note_new_gpnum(struct rcu_state *rsp, struct rcu_data *rdp)
+ {
+- rdp->qs_pending = 1;
+- rdp->passed_quiesc = 0;
+- rdp->gpnum = rsp->gpnum;
++ unsigned long flags;
++ struct rcu_node *rnp;
++
++ local_irq_save(flags);
++ rnp = rdp->mynode;
++ if (rdp->gpnum == ACCESS_ONCE(rnp->gpnum) || /* outside lock. */
++ !spin_trylock(&rnp->lock)) { /* irqs already off, retry later. */
++ local_irq_restore(flags);
++ return;
++ }
++ __note_new_gpnum(rsp, rnp, rdp);
++ spin_unlock_irqrestore(&rnp->lock, flags);
+ }
+
+ /*
+@@ -635,6 +655,9 @@ rcu_start_gp_per_cpu(struct rcu_state *r
+ */
+ rdp->nxttail[RCU_NEXT_READY_TAIL] = rdp->nxttail[RCU_NEXT_TAIL];
+ rdp->nxttail[RCU_WAIT_TAIL] = rdp->nxttail[RCU_NEXT_TAIL];
++
++ /* Set state so that this CPU will detect the next quiescent state. */
++ __note_new_gpnum(rsp, rnp, rdp);
+ }
+
+ /*
+@@ -662,7 +685,6 @@ rcu_start_gp(struct rcu_state *rsp, unsi
+ rsp->jiffies_force_qs = jiffies + RCU_JIFFIES_TILL_FORCE_QS;
+ record_gp_stall_check_time(rsp);
+ dyntick_record_completed(rsp, rsp->completed - 1);
+- note_new_gpnum(rsp, rdp);
+
+ /* Special-case the common single-level case. */
+ if (NUM_RCU_NODES == 1) {
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:44 2009
+Message-Id: <20091217035643.889583556@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:04 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>,
+ laijs@cn.fujitsu.com,
+ dipankar@in.ibm.com,
+ mathieu.desnoyers@polymtl.ca,
+ josh@joshtriplett.org,
+ dvhltc@us.ibm.com,
+ niv@us.ibm.com,
+ peterz@infradead.org,
+ rostedt@goodmis.org,
+ Valdis.Kletnieks@vt.edu,
+ dhowells@redhat.com,
+ Benjamin Gilbert <bgilbert@cs.cmu.edu>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [007/151] rcu: Remove inline from forward-referenced functions
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+
+commit dbe01350fa8ce0c11948ab7d6be71a4d901be151 upstream.
+
+Some variants of gcc are reputed to dislike forward references
+to functions declared "inline". Remove the "inline" keyword
+from such functions.
+
+Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Cc: laijs@cn.fujitsu.com
+Cc: dipankar@in.ibm.com
+Cc: mathieu.desnoyers@polymtl.ca
+Cc: josh@joshtriplett.org
+Cc: dvhltc@us.ibm.com
+Cc: niv@us.ibm.com
+Cc: peterz@infradead.org
+Cc: rostedt@goodmis.org
+Cc: Valdis.Kletnieks@vt.edu
+Cc: dhowells@redhat.com
+Cc: Benjamin Gilbert <bgilbert@cs.cmu.edu>
+LKML-Reference: <12578890422402-git-send-email->
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/rcutree.h | 2 +-
+ kernel/rcutree_plugin.h | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/kernel/rcutree.h
++++ b/kernel/rcutree.h
+@@ -301,7 +301,7 @@ DECLARE_PER_CPU(struct rcu_data, rcu_pre
+ #else /* #ifdef RCU_TREE_NONCORE */
+
+ /* Forward declarations for rcutree_plugin.h */
+-static inline void rcu_bootup_announce(void);
++static void rcu_bootup_announce(void);
+ long rcu_batches_completed(void);
+ static void rcu_preempt_note_context_switch(int cpu);
+ static int rcu_preempted_readers(struct rcu_node *rnp);
+--- a/kernel/rcutree_plugin.h
++++ b/kernel/rcutree_plugin.h
+@@ -33,7 +33,7 @@ DEFINE_PER_CPU(struct rcu_data, rcu_pree
+ /*
+ * Tell them what RCU they are running.
+ */
+-static inline void rcu_bootup_announce(void)
++static void rcu_bootup_announce(void)
+ {
+ printk(KERN_INFO
+ "Experimental preemptable hierarchical RCU implementation.\n");
+@@ -481,7 +481,7 @@ void exit_rcu(void)
+ /*
+ * Tell them what RCU they are running.
+ */
+-static inline void rcu_bootup_announce(void)
++static void rcu_bootup_announce(void)
+ {
+ printk(KERN_INFO "Hierarchical RCU implementation.\n");
+ }
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:44 2009
+Message-Id: <20091217035644.018127687@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:05 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Arjan van de Ven <arjan@linux.intel.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [008/151] perf_event: Fix invalid type in ioctl definition
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Arjan van de Ven <arjan@infradead.org>
+
+commit 4c49b12853fbb5eff4849b7b6a1e895776f027a1 upstream.
+
+u64 is invalid in userspace headers, including ioctl
+definitions; use __u64 instead
+
+Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
+LKML-Reference: <20091113214733.7cd76be9@infradead.org>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/perf_event.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/perf_event.h
++++ b/include/linux/perf_event.h
+@@ -219,7 +219,7 @@ struct perf_event_attr {
+ #define PERF_EVENT_IOC_DISABLE _IO ('$', 1)
+ #define PERF_EVENT_IOC_REFRESH _IO ('$', 2)
+ #define PERF_EVENT_IOC_RESET _IO ('$', 3)
+-#define PERF_EVENT_IOC_PERIOD _IOW('$', 4, u64)
++#define PERF_EVENT_IOC_PERIOD _IOW('$', 4, __u64)
+ #define PERF_EVENT_IOC_SET_OUTPUT _IO ('$', 5)
+
+ enum perf_event_ioc_flags {
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:44 2009
+Message-Id: <20091217035644.143280063@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:06 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>,
+ Peter Zijlstra <peterz@infradead.org>,
+ Frederic Weisbecker <fweisbec@gmail.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [009/151] perf_event: Initialize data.period in perf_swevent_hrtimer()
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
+
+commit 59d069eb5ae9b033ed1c124c92e1532c4a958991 upstream.
+
+In current code in perf_swevent_hrtimer(), data.period is not
+initialized, The result is obvious wrong:
+
+ # ./perf record -f -e cpu-clock make
+ # ./perf report
+ # Samples: 1740
+ #
+ # Overhead Command ......
+ # ........ ........ ..........................................
+ #
+ 1025422183050275328.00% sh libc-2.9.90.so ...
+ 1025422183050275328.00% perl libperl.so ...
+ 1025422168240043264.00% perl [kernel] ...
+ 1025422030011210752.00% perl [kernel] ...
+
+Signed-off-by: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
+Acked-by: Peter Zijlstra <peterz@infradead.org>
+Cc: Frederic Weisbecker <fweisbec@gmail.com>
+LKML-Reference: <4B14E220.2050107@cn.fujitsu.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/perf_event.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/kernel/perf_event.c
++++ b/kernel/perf_event.c
+@@ -3949,6 +3949,7 @@ static enum hrtimer_restart perf_swevent
+ event->pmu->read(event);
+
+ data.addr = 0;
++ data.period = event->hw.last_period;
+ regs = get_irq_regs();
+ /*
+ * In case we exclude kernel IPs or are somehow not in interrupt
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:44 2009
+Message-Id: <20091217035644.274392244@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:07 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ =?ISO-8859-15?q?Kristian=20H=C3=B8gsberg?= <krh@bitplanet.net>,
+ "David S. Miller" <davem@davemloft.net>,
+ Peter Zijlstra <a.p.zijlstra@chello.nl>,
+ Paul Mackerras <paulus@samba.org>,
+ Frederic Weisbecker <fweisbec@gmail.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [010/151] perf: Dont free perf_mmap_data until work has been done
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Kristian Høgsberg <krh@bitplanet.net>
+
+commit ec70ccd806111ba3caf596def91a8580138b12db upstream.
+
+In the CONFIG_PERF_USE_VMALLOC case, perf_mmap_data_free() only
+schedules the cleanup of the perf_mmap_data struct. In that
+case we have to wait until the work has been done before we free
+data.
+
+Signed-off-by: Kristian Høgsberg <krh@bitplanet.net>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Frederic Weisbecker <fweisbec@gmail.com>
+LKML-Reference: <1259697901-1747-1-git-send-email-krh@bitplanet.net>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/perf_event.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/perf_event.c
++++ b/kernel/perf_event.c
+@@ -2174,6 +2174,7 @@ static void perf_mmap_data_free(struct p
+ perf_mmap_free_page((unsigned long)data->user_page);
+ for (i = 0; i < data->nr_pages; i++)
+ perf_mmap_free_page((unsigned long)data->data_pages[i]);
++ kfree(data);
+ }
+
+ #else
+@@ -2214,6 +2215,7 @@ static void perf_mmap_data_free_work(str
+ perf_mmap_unmark_page(base + (i * PAGE_SIZE));
+
+ vfree(base);
++ kfree(data);
+ }
+
+ static void perf_mmap_data_free(struct perf_mmap_data *data)
+@@ -2319,7 +2321,6 @@ static void perf_mmap_data_free_rcu(stru
+
+ data = container_of(rcu_head, struct perf_mmap_data, rcu_head);
+ perf_mmap_data_free(data);
+- kfree(data);
+ }
+
+ static void perf_mmap_data_release(struct perf_event *event)
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:44 2009
+Message-Id: <20091217035644.408542787@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:08 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Rafael J. Wysocki" <rjw@sisk.pl>
+Subject: [011/151] PM / Runtime: Fix lockdep warning in __pm_runtime_set_status()
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Rafael J. Wysocki <rjw@sisk.pl>
+
+commit bab636b921017f0db6e0c2979438f50b898a9808 upstream.
+
+Lockdep complains about taking the parent lock in
+__pm_runtime_set_status(), so mark it as nested.
+
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Reported-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/base/power/runtime.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -777,7 +777,7 @@ int __pm_runtime_set_status(struct devic
+ }
+
+ if (parent) {
+- spin_lock(&parent->power.lock);
++ spin_lock_nested(&parent->power.lock, SINGLE_DEPTH_NESTING);
+
+ /*
+ * It is invalid to put an active child under a parent that is
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:44 2009
+Message-Id: <20091217035644.529151031@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:09 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mike Galbraith <efault@gmx.de>,
+ Arjan van de Ven <arjan@infradead.org>,
+ Peter Zijlstra <peterz@infradead.org>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [012/151] sched: Check for an idle shared cache in select_task_rq_fair()
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mike Galbraith <efault@gmx.de>
+
+commit a1f84a3ab8e002159498814eaa7e48c33752b04b upstream.
+
+When waking affine, check for an idle shared cache, and if
+found, wake to that CPU/sibling instead of the waker's CPU.
+
+This improves pgsql+oltp ramp up by roughly 8%. Possibly more
+for other loads, depending on overlap. The trade-off is a
+roughly 1% peak downturn if tasks are truly synchronous.
+
+Signed-off-by: Mike Galbraith <efault@gmx.de>
+Cc: Arjan van de Ven <arjan@infradead.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+LKML-Reference: <1256654138.17752.7.camel@marge.simson.net>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/sched_fair.c | 33 +++++++++++++++++++++++++++++----
+ 1 file changed, 29 insertions(+), 4 deletions(-)
+
+--- a/kernel/sched_fair.c
++++ b/kernel/sched_fair.c
+@@ -1398,11 +1398,36 @@ static int select_task_rq_fair(struct ta
+ want_sd = 0;
+ }
+
+- if (want_affine && (tmp->flags & SD_WAKE_AFFINE) &&
+- cpumask_test_cpu(prev_cpu, sched_domain_span(tmp))) {
++ if (want_affine && (tmp->flags & SD_WAKE_AFFINE)) {
++ int candidate = -1, i;
+
+- affine_sd = tmp;
+- want_affine = 0;
++ if (cpumask_test_cpu(prev_cpu, sched_domain_span(tmp)))
++ candidate = cpu;
++
++ /*
++ * Check for an idle shared cache.
++ */
++ if (tmp->flags & SD_PREFER_SIBLING) {
++ if (candidate == cpu) {
++ if (!cpu_rq(prev_cpu)->cfs.nr_running)
++ candidate = prev_cpu;
++ }
++
++ if (candidate == -1 || candidate == cpu) {
++ for_each_cpu(i, sched_domain_span(tmp)) {
++ if (!cpu_rq(i)->cfs.nr_running) {
++ candidate = i;
++ break;
++ }
++ }
++ }
++ }
++
++ if (candidate >= 0) {
++ affine_sd = tmp;
++ want_affine = 0;
++ cpu = candidate;
++ }
+ }
+
+ if (!want_sd && !want_affine)
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:44 2009
+Message-Id: <20091217035644.657581252@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:10 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mike Galbraith <efault@gmx.de>,
+ Peter Zijlstra <a.p.zijlstra@chello.nl>,
+ arjan@infradead.org,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [013/151] sched: Fix affinity logic in select_task_rq_fair()
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mike Galbraith <efault@gmx.de>
+
+commit fd210738f6601d0fb462df9a2fe5a41896ff6a8f upstream.
+
+Ingo Molnar reported:
+
+[ 26.804000] BUG: using smp_processor_id() in preemptible [00000000] code: events/1/10
+[ 26.808000] caller is vmstat_update+0x26/0x70
+[ 26.812000] Pid: 10, comm: events/1 Not tainted 2.6.32-rc5 #6887
+[ 26.816000] Call Trace:
+[ 26.820000] [<c1924a24>] ? printk+0x28/0x3c
+[ 26.824000] [<c13258a0>] debug_smp_processor_id+0xf0/0x110
+[ 26.824000] mount used greatest stack depth: 1464 bytes left
+[ 26.828000] [<c111d086>] vmstat_update+0x26/0x70
+[ 26.832000] [<c1086418>] worker_thread+0x188/0x310
+[ 26.836000] [<c10863b7>] ? worker_thread+0x127/0x310
+[ 26.840000] [<c108d310>] ? autoremove_wake_function+0x0/0x60
+[ 26.844000] [<c1086290>] ? worker_thread+0x0/0x310
+[ 26.848000] [<c108cf0c>] kthread+0x7c/0x90
+[ 26.852000] [<c108ce90>] ? kthread+0x0/0x90
+[ 26.856000] [<c100c0a7>] kernel_thread_helper+0x7/0x10
+[ 26.860000] BUG: using smp_processor_id() in preemptible [00000000] code: events/1/10
+[ 26.864000] caller is vmstat_update+0x3c/0x70
+
+Because this commit:
+
+ a1f84a3: sched: Check for an idle shared cache in select_task_rq_fair()
+
+broke ->cpus_allowed.
+
+Signed-off-by: Mike Galbraith <efault@gmx.de>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: arjan@infradead.org
+LKML-Reference: <1257415066.12867.1.camel@marge.simson.net>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/sched_fair.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/kernel/sched_fair.c
++++ b/kernel/sched_fair.c
+@@ -1415,6 +1415,8 @@ static int select_task_rq_fair(struct ta
+
+ if (candidate == -1 || candidate == cpu) {
+ for_each_cpu(i, sched_domain_span(tmp)) {
++ if (!cpumask_test_cpu(i, &p->cpus_allowed))
++ continue;
+ if (!cpu_rq(i)->cfs.nr_running) {
+ candidate = i;
+ break;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:44 2009
+Message-Id: <20091217035644.782513558@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:11 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mike Galbraith <efault@gmx.de>,
+ Peter Zijlstra <a.p.zijlstra@chello.nl>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [014/151] sched: Rate-limit newidle
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mike Galbraith <efault@gmx.de>
+
+commit 1b9508f6831e10d53256825de8904caa22d1ca2c upstream.
+
+Rate limit newidle to migration_cost. It's a win for all
+stages of sysbench oltp tests.
+
+Signed-off-by: Mike Galbraith <efault@gmx.de>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+LKML-Reference: <new-submission>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/sched.c | 22 +++++++++++++++++++++-
+ kernel/sched_debug.c | 4 ++++
+ 2 files changed, 25 insertions(+), 1 deletion(-)
+
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -591,6 +591,8 @@ struct rq {
+
+ u64 rt_avg;
+ u64 age_stamp;
++ u64 idle_stamp;
++ u64 avg_idle;
+ #endif
+
+ /* calc_load related fields */
+@@ -2384,6 +2386,17 @@ static int try_to_wake_up(struct task_st
+ if (rq != orig_rq)
+ update_rq_clock(rq);
+
++ if (rq->idle_stamp) {
++ u64 delta = rq->clock - rq->idle_stamp;
++ u64 max = 2*sysctl_sched_migration_cost;
++
++ if (delta > max)
++ rq->avg_idle = max;
++ else
++ update_avg(&rq->avg_idle, delta);
++ rq->idle_stamp = 0;
++ }
++
+ WARN_ON(p->state != TASK_WAKING);
+ cpu = task_cpu(p);
+
+@@ -4429,6 +4442,11 @@ static void idle_balance(int this_cpu, s
+ int pulled_task = 0;
+ unsigned long next_balance = jiffies + HZ;
+
++ this_rq->idle_stamp = this_rq->clock;
++
++ if (this_rq->avg_idle < sysctl_sched_migration_cost)
++ return;
++
+ for_each_domain(this_cpu, sd) {
+ unsigned long interval;
+
+@@ -4443,8 +4461,10 @@ static void idle_balance(int this_cpu, s
+ interval = msecs_to_jiffies(sd->balance_interval);
+ if (time_after(next_balance, sd->last_balance + interval))
+ next_balance = sd->last_balance + interval;
+- if (pulled_task)
++ if (pulled_task) {
++ this_rq->idle_stamp = 0;
+ break;
++ }
+ }
+ if (pulled_task || time_after(jiffies, this_rq->next_balance)) {
+ /*
+--- a/kernel/sched_debug.c
++++ b/kernel/sched_debug.c
+@@ -285,12 +285,16 @@ static void print_cpu(struct seq_file *m
+
+ #ifdef CONFIG_SCHEDSTATS
+ #define P(n) SEQ_printf(m, " .%-30s: %d\n", #n, rq->n);
++#define P64(n) SEQ_printf(m, " .%-30s: %Ld\n", #n, rq->n);
+
+ P(yld_count);
+
+ P(sched_switch);
+ P(sched_count);
+ P(sched_goidle);
++#ifdef CONFIG_SMP
++ P64(avg_idle);
++#endif
+
+ P(ttwu_count);
+ P(ttwu_local);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:45 2009
+Message-Id: <20091217035644.913059330@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:12 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mike Galbraith <efault@gmx.de>,
+ Peter Zijlstra <a.p.zijlstra@chello.nl>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [015/151] sched: Fix and clean up rate-limit newidle code
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mike Galbraith <efault@gmx.de>
+
+commit eae0c9dfb534cb3449888b9601228efa6480fdb5 upstream.
+
+Commit 1b9508f, "Rate-limit newidle" has been confirmed to fix
+the netperf UDP loopback regression reported by Alex Shi.
+
+This is a cleanup and a fix:
+
+ - moved to a more out of the way spot
+
+ - fix to ensure that balancing doesn't try to balance
+ runqueues which haven't gone online yet, which can
+ mess up CPU enumeration during boot.
+
+Reported-by: Alex Shi <alex.shi@intel.com>
+Reported-by: Zhang, Yanmin <yanmin_zhang@linux.intel.com>
+Signed-off-by: Mike Galbraith <efault@gmx.de>
+Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+LKML-Reference: <1257821402.5648.17.camel@marge.simson.net>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/sched.c | 28 +++++++++++++++-------------
+ 1 file changed, 15 insertions(+), 13 deletions(-)
+
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -2386,17 +2386,6 @@ static int try_to_wake_up(struct task_st
+ if (rq != orig_rq)
+ update_rq_clock(rq);
+
+- if (rq->idle_stamp) {
+- u64 delta = rq->clock - rq->idle_stamp;
+- u64 max = 2*sysctl_sched_migration_cost;
+-
+- if (delta > max)
+- rq->avg_idle = max;
+- else
+- update_avg(&rq->avg_idle, delta);
+- rq->idle_stamp = 0;
+- }
+-
+ WARN_ON(p->state != TASK_WAKING);
+ cpu = task_cpu(p);
+
+@@ -2453,6 +2442,17 @@ out_running:
+ #ifdef CONFIG_SMP
+ if (p->sched_class->task_wake_up)
+ p->sched_class->task_wake_up(rq, p);
++
++ if (unlikely(rq->idle_stamp)) {
++ u64 delta = rq->clock - rq->idle_stamp;
++ u64 max = 2*sysctl_sched_migration_cost;
++
++ if (delta > max)
++ rq->avg_idle = max;
++ else
++ update_avg(&rq->avg_idle, delta);
++ rq->idle_stamp = 0;
++ }
+ #endif
+ out:
+ task_rq_unlock(rq, &flags);
+@@ -4139,7 +4139,7 @@ static int load_balance(int this_cpu, st
+ unsigned long flags;
+ struct cpumask *cpus = __get_cpu_var(load_balance_tmpmask);
+
+- cpumask_setall(cpus);
++ cpumask_copy(cpus, cpu_online_mask);
+
+ /*
+ * When power savings policy is enabled for the parent domain, idle
+@@ -4302,7 +4302,7 @@ load_balance_newidle(int this_cpu, struc
+ int all_pinned = 0;
+ struct cpumask *cpus = __get_cpu_var(load_balance_tmpmask);
+
+- cpumask_setall(cpus);
++ cpumask_copy(cpus, cpu_online_mask);
+
+ /*
+ * When power savings policy is enabled for the parent domain, idle
+@@ -9542,6 +9542,8 @@ void __init sched_init(void)
+ rq->cpu = i;
+ rq->online = 0;
+ rq->migration_thread = NULL;
++ rq->idle_stamp = 0;
++ rq->avg_idle = 2*sysctl_sched_migration_cost;
+ INIT_LIST_HEAD(&rq->migration_queue);
+ rq_attach_root(rq, &def_root_domain);
+ #endif
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:45 2009
+Message-Id: <20091217035645.040589929@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:13 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Joerg Roedel <joerg.roedel@amd.com>
+Subject: [016/151] x86/amd-iommu: attach devices to pre-allocated domains early
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+commit be831297716036de5b24308447ecb69f1706a846 upstream.
+
+For some devices the ACPI table may define unity map
+requirements which must me met when the IOMMU is enabled. So
+we need to attach devices to their domains as early as
+possible so that these mappings are in place when needed.
+This patch assigns the domains right after they are
+allocated. Otherwise this can result in I/O page faults
+before a driver binds to a device and BIOS is still using
+it.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/amd_iommu.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/amd_iommu.c
++++ b/arch/x86/kernel/amd_iommu.c
+@@ -2047,10 +2047,10 @@ static void prealloc_protection_domains(
+ struct pci_dev *dev = NULL;
+ struct dma_ops_domain *dma_dom;
+ struct amd_iommu *iommu;
+- u16 devid;
++ u16 devid, __devid;
+
+ while ((dev = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, dev)) != NULL) {
+- devid = calc_devid(dev->bus->number, dev->devfn);
++ __devid = devid = calc_devid(dev->bus->number, dev->devfn);
+ if (devid > amd_iommu_last_bdf)
+ continue;
+ devid = amd_iommu_alias_table[devid];
+@@ -2065,6 +2065,10 @@ static void prealloc_protection_domains(
+ init_unity_mappings_for_device(dma_dom, devid);
+ dma_dom->target_dev = devid;
+
++ attach_device(iommu, &dma_dom->domain, devid);
++ if (__devid != devid)
++ attach_device(iommu, &dma_dom->domain, __devid);
++
+ list_add_tail(&dma_dom->list, &iommu_pd_list);
+ }
+ }
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:45 2009
+Message-Id: <20091217035645.169446528@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:14 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Joerg Roedel <joerg.roedel@amd.com>
+Subject: [017/151] x86/amd-iommu: un__init iommu_setup_msi
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+commit 9f800de38b05d84809e89f16671d636a140eede7 upstream.
+
+This function may be called on the resume path and can not
+be dropped after booting.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/amd_iommu_init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/amd_iommu_init.c
++++ b/arch/x86/kernel/amd_iommu_init.c
+@@ -925,7 +925,7 @@ static int __init init_iommu_all(struct
+ *
+ ****************************************************************************/
+
+-static int __init iommu_setup_msi(struct amd_iommu *iommu)
++static int iommu_setup_msi(struct amd_iommu *iommu)
+ {
+ int r;
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:45 2009
+Message-Id: <20091217035645.294277007@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:15 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Darrick J. Wong" <djwong@us.ibm.com>,
+ Muli Ben-Yehuda <muli@il.ibm.com>,
+ FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>,
+ Joerg Roedel <joerg.roedel@amd.com>,
+ Yinghai Lu <yhlu.kernel@gmail.com>,
+ "Jon D. Mason" <jdmason@kudzu.us>,
+ Corinna Schultz <coschult@us.ibm.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [018/151] x86, Calgary IOMMU quirk: Find nearest matching Calgary while walking up the PCI tree
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Darrick J. Wong <djwong@us.ibm.com>
+
+commit 4528752f49c1f4025473d12bc5fa9181085c3f22 upstream.
+
+On a multi-node x3950M2 system, there's a slight oddity in the
+PCI device tree for all secondary nodes:
+
+ 30:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev e1)
+ \-33:00.0 PCI bridge: IBM CalIOC2 PCI-E Root Port (rev 01)
+ \-34:00.0 RAID bus controller: LSI Logic / Symbios Logic MegaRAID SAS 1078 (rev 04)
+
+...as compared to the primary node:
+
+ 00:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev e1)
+ \-01:00.0 VGA compatible controller: ATI Technologies Inc ES1000 (rev 02)
+ 03:00.0 PCI bridge: IBM CalIOC2 PCI-E Root Port (rev 01)
+ \-04:00.0 RAID bus controller: LSI Logic / Symbios Logic MegaRAID SAS 1078 (rev 04)
+
+In both nodes, the LSI RAID controller hangs off a CalIOC2
+device, but on the secondary nodes, the BIOS hides the VGA
+device and substitutes the device tree ending with the disk
+controller.
+
+It would seem that Calgary devices don't necessarily appear at
+the top of the PCI tree, which means that the current code to
+find the Calgary IOMMU that goes with a particular device is
+buggy.
+
+Rather than walk all the way to the top of the PCI
+device tree and try to match bus number with Calgary descriptor,
+the code needs to examine each parent of the particular device;
+if it encounters a Calgary with a matching bus number, simply
+use that.
+
+Otherwise, we BUG() when the bus number of the Calgary doesn't
+match the bus number of whatever's at the top of the device tree.
+
+Extra note: This patch appears to work correctly for the x3950
+that came before the x3950 M2.
+
+Signed-off-by: Darrick J. Wong <djwong@us.ibm.com>
+Acked-by: Muli Ben-Yehuda <muli@il.ibm.com>
+Cc: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Cc: Joerg Roedel <joerg.roedel@amd.com>
+Cc: Yinghai Lu <yhlu.kernel@gmail.com>
+Cc: Jon D. Mason <jdmason@kudzu.us>
+Cc: Corinna Schultz <coschult@us.ibm.com>
+LKML-Reference: <20091202230556.GG10295@tux1.beaverton.ibm.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/pci-calgary_64.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/arch/x86/kernel/pci-calgary_64.c
++++ b/arch/x86/kernel/pci-calgary_64.c
+@@ -318,13 +318,15 @@ static inline struct iommu_table *find_i
+
+ pdev = to_pci_dev(dev);
+
++ /* search up the device tree for an iommu */
+ pbus = pdev->bus;
+-
+- /* is the device behind a bridge? Look for the root bus */
+- while (pbus->parent)
++ do {
++ tbl = pci_iommu(pbus);
++ if (tbl && tbl->it_busno == pbus->number)
++ break;
++ tbl = NULL;
+ pbus = pbus->parent;
+-
+- tbl = pci_iommu(pbus);
++ } while (pbus);
+
+ BUG_ON(tbl && (tbl->it_busno != pbus->number));
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:45 2009
+Message-Id: <20091217035645.425455678@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:16 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tejun Heo <tj@kernel.org>,
+ FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>,
+ Matteo Frigo <athena@fftw.org>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [019/151] x86: Fix iommu=nodac parameter handling
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 2ae8bb75db1f3de422eb5898f2a063c46c36dba8 upstream.
+
+iommu=nodac should forbid dac instead of enabling it. Fix it.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Acked-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Cc: Matteo Frigo <athena@fftw.org>
+LKML-Reference: <4AE5B52A.4050408@kernel.org>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/pci-dma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/pci-dma.c
++++ b/arch/x86/kernel/pci-dma.c
+@@ -214,7 +214,7 @@ static __init int iommu_setup(char *p)
+ if (!strncmp(p, "allowdac", 8))
+ forbid_dac = 0;
+ if (!strncmp(p, "nodac", 5))
+- forbid_dac = -1;
++ forbid_dac = 1;
+ if (!strncmp(p, "usedac", 6)) {
+ forbid_dac = -1;
+ return 1;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:45 2009
+Message-Id: <20091217035645.550452168@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:17 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Joe Perches <joe@perches.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [020/151] x86: GART: pci-gart_64.c: Use correct length in strncmp
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Joe Perches <joe@perches.com>
+
+commit 41855b77547fa18d90ed6a5d322983d3fdab1959 upstream.
+
+Signed-off-by: Joe Perches <joe@perches.com>
+LKML-Reference: <1257818330.12852.72.camel@Joe-Laptop.home>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/pci-gart_64.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/pci-gart_64.c
++++ b/arch/x86/kernel/pci-gart_64.c
+@@ -856,7 +856,7 @@ void __init gart_parse_options(char *p)
+ #endif
+ if (isdigit(*p) && get_option(&p, &arg))
+ iommu_size = arg;
+- if (!strncmp(p, "fullflush", 8))
++ if (!strncmp(p, "fullflush", 9))
+ iommu_fullflush = 1;
+ if (!strncmp(p, "nofullflush", 11))
+ iommu_fullflush = 0;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:45 2009
+Message-Id: <20091217035645.678326175@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:18 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Leann Ogasawara <leann.ogasawara@canonical.com>,
+ "H. Peter Anvin" <hpa@zytor.com>
+Subject: [021/151] x86: ASUS P4S800 reboot=bios quirk
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Leann Ogasawara <leann.ogasawara@canonical.com>
+
+commit 4832ddda2ec4df96ea1eed334ae2dbd65fc1f541 upstream.
+
+Bug reporter noted their system with an ASUS P4S800 motherboard would
+hang when rebooting unless reboot=b was specified. Their dmidecode
+didn't contain descriptive System Information for Manufacturer or
+Product Name, so I used their Base Board Information to create a
+reboot quirk patch. The bug reporter confirmed this patch resolves
+the reboot hang.
+
+Handle 0x0001, DMI type 1, 25 bytes
+System Information
+ Manufacturer: System Manufacturer
+ Product Name: System Name
+ Version: System Version
+ Serial Number: SYS-1234567890
+ UUID: E0BFCD8B-7948-D911-A953-E486B4EEB67F
+ Wake-up Type: Power Switch
+
+Handle 0x0002, DMI type 2, 8 bytes
+Base Board Information
+ Manufacturer: ASUSTeK Computer INC.
+ Product Name: P4S800
+ Version: REV 1.xx
+ Serial Number: xxxxxxxxxxx
+
+BugLink: http://bugs.launchpad.net/bugs/366682
+
+ASUS P4S800 will hang when rebooting unless reboot=b is specified.
+Add a quirk to reboot through the bios.
+
+Signed-off-by: Leann Ogasawara <leann.ogasawara@canonical.com>
+LKML-Reference: <1259972107.4629.275.camel@emiko>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/reboot.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -259,6 +259,14 @@ static struct dmi_system_id __initdata r
+ DMI_MATCH(DMI_PRODUCT_NAME, "SBC-FITPC2"),
+ },
+ },
++ { /* Handle problems with rebooting on ASUS P4S800 */
++ .callback = set_bios_reboot,
++ .ident = "ASUS P4S800",
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."),
++ DMI_MATCH(DMI_BOARD_NAME, "P4S800"),
++ },
++ },
+ { }
+ };
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:45 2009
+Message-Id: <20091217035645.802252912@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:19 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mikael Pettersson <mikpe@it.uu.se>,
+ Andreas Herrmann <andreas.herrmann3@amd.com>,
+ Joerg Roedel <joerg.roedel@amd.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [022/151] x86, apic: Enable lapic nmi watchdog on AMD Family 11h
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mikael Pettersson <mikpe@it.uu.se>
+
+commit 7d1849aff6687a135a8da3a75e32a00e3137a5e2 upstream.
+
+The x86 lapic nmi watchdog does not recognize AMD Family 11h,
+resulting in:
+
+ NMI watchdog: CPU not supported
+
+As far as I can see from available documentation (the BKDM),
+family 11h looks identical to family 10h as far as the PMU
+is concerned.
+
+Extending the check to accept family 11h results in:
+
+ Testing NMI watchdog ... OK.
+
+I've been running with this change on a Turion X2 Ultra ZM-82
+laptop for a couple of weeks now without problems.
+
+Signed-off-by: Mikael Pettersson <mikpe@it.uu.se>
+Cc: Andreas Herrmann <andreas.herrmann3@amd.com>
+Cc: Joerg Roedel <joerg.roedel@amd.com>
+LKML-Reference: <19223.53436.931768.278021@pilspetsen.it.uu.se>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/perfctr-watchdog.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/perfctr-watchdog.c
++++ b/arch/x86/kernel/cpu/perfctr-watchdog.c
+@@ -712,7 +712,7 @@ static void probe_nmi_watchdog(void)
+ switch (boot_cpu_data.x86_vendor) {
+ case X86_VENDOR_AMD:
+ if (boot_cpu_data.x86 != 6 && boot_cpu_data.x86 != 15 &&
+- boot_cpu_data.x86 != 16)
++ boot_cpu_data.x86 != 16 && boot_cpu_data.x86 != 17)
+ return;
+ wd_ops = &k7_wd_ops;
+ break;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:46 2009
+Message-Id: <20091217035645.929446109@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:20 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Michael Buesch <mb@bu3sch.de>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [023/151] ssb: Fix range check in sprom write
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Michael Buesch <mb@bu3sch.de>
+
+commit e33761e6f23881de9f3ee77cc2204ab2e26f3d9a upstream.
+
+The range check in the sprom image parser hex2sprom() is broken.
+One sprom word is 4 hex characters.
+This fixes the check and also adds much better sanity checks to the code.
+We better make sure the image is OK by doing some sanity checks to avoid
+bricking the device by accident.
+
+Signed-off-by: Michael Buesch <mb@bu3sch.de>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ssb/sprom.c | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+--- a/drivers/ssb/sprom.c
++++ b/drivers/ssb/sprom.c
+@@ -13,6 +13,8 @@
+
+ #include "ssb_private.h"
+
++#include <linux/ctype.h>
++
+
+ static const struct ssb_sprom *fallback_sprom;
+
+@@ -33,17 +35,27 @@ static int sprom2hex(const u16 *sprom, c
+ static int hex2sprom(u16 *sprom, const char *dump, size_t len,
+ size_t sprom_size_words)
+ {
+- char tmp[5] = { 0 };
+- int cnt = 0;
++ char c, tmp[5] = { 0 };
++ int err, cnt = 0;
+ unsigned long parsed;
+
+- if (len < sprom_size_words * 2)
++ /* Strip whitespace at the end. */
++ while (len) {
++ c = dump[len - 1];
++ if (!isspace(c) && c != '\0')
++ break;
++ len--;
++ }
++ /* Length must match exactly. */
++ if (len != sprom_size_words * 4)
+ return -EINVAL;
+
+ while (cnt < sprom_size_words) {
+ memcpy(tmp, dump, 4);
+ dump += 4;
+- parsed = simple_strtoul(tmp, NULL, 16);
++ err = strict_strtoul(tmp, 16, &parsed);
++ if (err)
++ return err;
+ sprom[cnt++] = swab16((u16)parsed);
+ }
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:46 2009
+Message-Id: <20091217035646.060484400@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:21 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Bob Copeland <me@bobcopeland.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [024/151] ath5k: allow setting txpower to 0
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Bob Copeland <me@bobcopeland.com>
+
+commit 2eb2fa67e5462a36e98172fb92c78bc405b3035f upstream.
+
+As a holdover from earlier code when we used to set
+the power limit to '0' after a reset to configure the
+default transmit power, ath5k interprets txpower=0 as
+12.5 dBm. Fix that by just passing 0 through.
+
+This fixes http://bugzilla.kernel.org/show_bug.cgi?id=14567
+
+Reported-by: Daniel Folkers <daniel.folkers@task24.nl>
+Tested-by: Daniel Folkers <daniel.folkers@task24.nl>
+Signed-off-by: Bob Copeland <me@bobcopeland.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath5k/phy.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath5k/phy.c
++++ b/drivers/net/wireless/ath/ath5k/phy.c
+@@ -2954,8 +2954,6 @@ ath5k_hw_txpower(struct ath5k_hw *ah, st
+ ATH5K_ERR(ah->ah_sc, "invalid tx power: %u\n", txpower);
+ return -EINVAL;
+ }
+- if (txpower == 0)
+- txpower = AR5K_TUNE_DEFAULT_TXPOWER;
+
+ /* Reset TX power values */
+ memset(&ah->ah_txpower, 0, sizeof(ah->ah_txpower));
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:46 2009
+Message-Id: <20091217035646.187922809@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:22 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ jirislaby@gmail.com,
+ rjw@sisk.pl,
+ me@bobcopeland.com,
+ david.quan@atheros.com,
+ "Luis R. Rodriguez" <lrodriguez@atheros.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [025/151] ath5k: enable EEPROM checksum check
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Luis R. Rodriguez <lrodriguez@atheros.com>
+
+commit 512414b0bed0d376ac4d5ec1dd6f0b1a3551febc upstream.
+
+Without this we have no gaurantee of the integrity of the
+EEPROM and are likely to encounter a lot of bogus bug reports
+due to actual issues on the EEPROM. With the EEPROM checksum
+check in place we can easily rule those issues out.
+
+If you run patch during a revert *you* have a card with a busted
+EEPROM and only older kernel will support that concoction. This
+patch is a trade off between not accepitng bogus EEPROMs and
+avoiding bogus bug reports allowing developers to focus instead
+on real concrete issues.
+
+If stable keeps bogus bug reports because of a possibly busted EEPROM
+feel free to apply this there too.
+
+Tested on an AR5414
+
+Cc: jirislaby@gmail.com
+Cc: akpm@linux-foundation.org
+Cc: rjw@sisk.pl
+Cc: me@bobcopeland.com
+Cc: david.quan@atheros.com
+Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath5k/eeprom.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath5k/eeprom.c
++++ b/drivers/net/wireless/ath/ath5k/eeprom.c
+@@ -97,6 +97,7 @@ ath5k_eeprom_init_header(struct ath5k_hw
+ struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
+ int ret;
+ u16 val;
++ u32 cksum, offset;
+
+ /*
+ * Read values from EEPROM and store them in the capability structure
+@@ -111,7 +112,6 @@ ath5k_eeprom_init_header(struct ath5k_hw
+ if (ah->ah_ee_version < AR5K_EEPROM_VERSION_3_0)
+ return 0;
+
+-#ifdef notyet
+ /*
+ * Validate the checksum of the EEPROM date. There are some
+ * devices with invalid EEPROMs.
+@@ -124,7 +124,6 @@ ath5k_eeprom_init_header(struct ath5k_hw
+ ATH5K_ERR(ah->ah_sc, "Invalid EEPROM checksum 0x%04x\n", cksum);
+ return -EIO;
+ }
+-#endif
+
+ AR5K_EEPROM_READ_HDR(AR5K_EEPROM_ANT_GAIN(ah->ah_ee_version),
+ ee_ant_gain);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:46 2009
+Message-Id: <20091217035646.312813630@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:23 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Feng Tang <feng.tang@intel.com>,
+ Heiko Carstens <heiko.carstens@de.ibm.com>,
+ Thomas Gleixner <tglx@linutronix.de>
+Subject: [026/151] hrtimer: Fix /proc/timer_list regression
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Feng Tang <feng.tang@intel.com>
+
+commit 8629ea2eaba8ca0de2e38ce1b4a825e16255976e upstream.
+
+commit 507e1231 (timer stats: Optimize by adding quick check to avoid
+function calls) introduced a regression in /proc/timer_list.
+
+/proc/timer_list shows now
+ #0: <c27d46b0>, tick_sched_timer, S:01, <(null)>, /-1
+instead of
+ #0: <c27d46b0>, tick_sched_timer, S:01, hrtimer_start, swapper/0
+
+Revert the hrtimer quick check for now. The optimization needs more
+thought, but this is neither 2.6.32-rc7 nor stable material.
+
+[ tglx: - Removed unrelated changes from the original patch
+ - Prevent unneccesary call to timer_stats_update_stats
+ - massaged the changelog ]
+
+Signed-off-by: Feng Tang <feng.tang@intel.com>
+LKML-Reference: <alpine.LFD.2.00.0911181933540.24119@localhost.localdomain>
+Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/hrtimer.h | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/include/linux/hrtimer.h
++++ b/include/linux/hrtimer.h
+@@ -446,7 +446,7 @@ extern void timer_stats_update_stats(voi
+
+ static inline void timer_stats_account_hrtimer(struct hrtimer *timer)
+ {
+- if (likely(!timer->start_site))
++ if (likely(!timer_stats_active))
+ return;
+ timer_stats_update_stats(timer, timer->start_pid, timer->start_site,
+ timer->function, timer->start_comm, 0);
+@@ -457,8 +457,6 @@ extern void __timer_stats_hrtimer_set_st
+
+ static inline void timer_stats_hrtimer_set_start_info(struct hrtimer *timer)
+ {
+- if (likely(!timer_stats_active))
+- return;
+ __timer_stats_hrtimer_set_start_info(timer, __builtin_return_address(0));
+ }
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:46 2009
+Message-Id: <20091217035646.448586018@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:24 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [027/151] ALSA: hrtimer - Fix lock-up
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit fcfdebe70759c74e2e701f69aaa7f0e5e32cf5a6 upstream.
+
+The timer stop callback can be called from snd_timer_interrupt(), which
+is called from the hrtimer callback. Since hrtimer_cancel() waits for
+the callback completion, this eventually results in a lock-up.
+
+This patch fixes the problem by just toggling a flag at stop callback
+and call hrtimer_cancel() later.
+
+Reported-and-tested-by: Wojtek Zabolotny <W.Zabolotny@elka.pw.edu.pl>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/hrtimer.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+--- a/sound/core/hrtimer.c
++++ b/sound/core/hrtimer.c
+@@ -37,14 +37,22 @@ static unsigned int resolution;
+ struct snd_hrtimer {
+ struct snd_timer *timer;
+ struct hrtimer hrt;
++ atomic_t running;
+ };
+
+ static enum hrtimer_restart snd_hrtimer_callback(struct hrtimer *hrt)
+ {
+ struct snd_hrtimer *stime = container_of(hrt, struct snd_hrtimer, hrt);
+ struct snd_timer *t = stime->timer;
++
++ if (!atomic_read(&stime->running))
++ return HRTIMER_NORESTART;
++
+ hrtimer_forward_now(hrt, ns_to_ktime(t->sticks * resolution));
+ snd_timer_interrupt(stime->timer, t->sticks);
++
++ if (!atomic_read(&stime->running))
++ return HRTIMER_NORESTART;
+ return HRTIMER_RESTART;
+ }
+
+@@ -58,6 +66,7 @@ static int snd_hrtimer_open(struct snd_t
+ hrtimer_init(&stime->hrt, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+ stime->timer = t;
+ stime->hrt.function = snd_hrtimer_callback;
++ atomic_set(&stime->running, 0);
+ t->private_data = stime;
+ return 0;
+ }
+@@ -78,16 +87,18 @@ static int snd_hrtimer_start(struct snd_
+ {
+ struct snd_hrtimer *stime = t->private_data;
+
++ atomic_set(&stime->running, 0);
++ hrtimer_cancel(&stime->hrt);
+ hrtimer_start(&stime->hrt, ns_to_ktime(t->sticks * resolution),
+ HRTIMER_MODE_REL);
++ atomic_set(&stime->running, 1);
+ return 0;
+ }
+
+ static int snd_hrtimer_stop(struct snd_timer *t)
+ {
+ struct snd_hrtimer *stime = t->private_data;
+-
+- hrtimer_cancel(&stime->hrt);
++ atomic_set(&stime->running, 0);
+ return 0;
+ }
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:46 2009
+Message-Id: <20091217035646.562099541@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:25 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jaroslav Kysela <perex@perex.cz>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [028/151] ALSA: hda - Terradici HDA controllers does not support 64-bit mode
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jaroslav Kysela <perex@perex.cz>
+
+commit 396087eaead95fcb29eb36f1e59517aeb58c545e upstream.
+
+Confirmed from vendor and tests in RedHat bugzilla #536782 .
+
+Signed-off-by: Jaroslav Kysela <perex@perex.cz>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/hda_intel.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2436,6 +2436,11 @@ static int __devinit azx_create(struct s
+ }
+ }
+
++ /* disable 64bit DMA address for Teradici */
++ /* it does not work with device 6549:1200 subsys e4a2:040b */
++ if (chip->driver_type == AZX_DRIVER_TERA)
++ gcap &= ~ICH6_GCAP_64OK;
++
+ /* allow 64bit DMA address if supported by H/W */
+ if ((gcap & ICH6_GCAP_64OK) && !pci_set_dma_mask(pci, DMA_BIT_MASK(64)))
+ pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(64));
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:46 2009
+Message-Id: <20091217035646.693037750@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:26 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Avi Kivity <avi@redhat.com>
+Subject: [029/151] KVM: x86 emulator: limit instructions to 15 bytes
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Avi Kivity <avi@redhat.com>
+
+commit eb3c79e64a70fb8f7473e30fa07e89c1ecc2c9bb upstream.
+
+While we are never normally passed an instruction that exceeds 15 bytes,
+smp games can cause us to attempt to interpret one, which will cause
+large latencies in non-preempt hosts.
+
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+--- a/arch/x86/include/asm/kvm_emulate.h
++++ b/arch/x86/include/asm/kvm_emulate.h
+@@ -129,7 +129,7 @@ struct decode_cache {
+ u8 seg_override;
+ unsigned int d;
+ unsigned long regs[NR_VCPU_REGS];
+- unsigned long eip;
++ unsigned long eip, eip_orig;
+ /* modrm */
+ u8 modrm;
+ u8 modrm_mod;
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index d226dff..7e8faea 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -622,6 +622,9 @@ static int do_insn_fetch(struct x86_emulate_ctxt *ctxt,
+ {
+ int rc = 0;
+
++ /* x86 instructions are limited to 15 bytes. */
++ if (eip + size - ctxt->decode.eip_orig > 15)
++ return X86EMUL_UNHANDLEABLE;
+ eip += ctxt->cs_base;
+ while (size--) {
+ rc = do_fetch_insn_byte(ctxt, ops, eip++, dest++);
+@@ -880,7 +883,7 @@ x86_decode_insn(struct x86_emulate_ctxt *ctxt, struct x86_emulate_ops *ops)
+ /* Shadow copy of register state. Committed on successful emulation. */
+
+ memset(c, 0, sizeof(struct decode_cache));
+- c->eip = kvm_rip_read(ctxt->vcpu);
++ c->eip = c->eip_orig = kvm_rip_read(ctxt->vcpu);
+ ctxt->cs_base = seg_base(ctxt, VCPU_SREG_CS);
+ memcpy(c->regs, ctxt->vcpu->arch.regs, sizeof c->regs);
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:46 2009
+Message-Id: <20091217035646.823076826@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:27 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Carsten Otte <cotte@de.ibm.com>,
+ Avi Kivity <avi@redhat.com>
+Subject: [030/151] KVM: s390: Fix prefix register checking in arch/s390/kvm/sigp.c
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Carsten Otte <carsteno@de.ibm.com>
+
+commit f50146bd7bdb75435638e60d4960edd9bcdf88b8 upstream.
+
+This patch corrects the checking of the new address for the prefix register.
+On s390, the prefix register is used to address the cpu's lowcore (address
+0...8k). This check is supposed to verify that the memory is readable and
+present.
+copy_from_guest is a helper function, that can be used to read from guest
+memory. It applies prefixing, adds the start address of the guest memory in
+user, and then calls copy_from_user. Previous code was obviously broken for
+two reasons:
+- prefixing should not be applied here. The current prefix register is
+ going to be updated soon, and the address we're looking for will be
+ 0..8k after we've updated the register
+- we're adding the guest origin (gmsor) twice: once in subject code
+ and once in copy_from_guest
+
+With kuli, we did not hit this problem because (a) we were lucky with
+previous prefix register content, and (b) our guest memory was mmaped
+very low into user address space.
+
+Signed-off-by: Carsten Otte <cotte@de.ibm.com>
+Reported-by: Alexander Graf <agraf@suse.de>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+--- a/arch/s390/kvm/sigp.c
++++ b/arch/s390/kvm/sigp.c
+@@ -188,9 +188,9 @@ static int __sigp_set_prefix(struct kvm_vcpu *vcpu, u16 cpu_addr, u32 address,
+
+ /* make sure that the new value is valid memory */
+ address = address & 0x7fffe000u;
+- if ((copy_from_guest(vcpu, &tmp,
+- (u64) (address + vcpu->arch.sie_block->gmsor) , 1)) ||
+- (copy_from_guest(vcpu, &tmp, (u64) (address +
++ if ((copy_from_user(&tmp, (void __user *)
++ (address + vcpu->arch.sie_block->gmsor) , 1)) ||
++ (copy_from_user(&tmp, (void __user *)(address +
+ vcpu->arch.sie_block->gmsor + PAGE_SIZE), 1))) {
+ *reg |= SIGP_STAT_INVALID_PARAMETER;
+ return 1; /* invalid parameter */
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:47 2009
+Message-Id: <20091217035646.953520979@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:28 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Carsten Otte <cotte@de.ibm.com>,
+ Avi Kivity <avi@redhat.com>
+Subject: [031/151] KVM: s390: Make psw available on all exits, not just a subset
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Carsten Otte <carsteno@de.ibm.com>
+
+commit d7b0b5eb3000c6fb902f08c619fcd673a23d8fab upstream.
+
+This patch moves s390 processor status word into the base kvm_run
+struct and keeps it up-to date on all userspace exits.
+
+The userspace ABI is broken by this, however there are no applications
+in the wild using this. A capability check is provided so users can
+verify the updated API exists.
+
+Signed-off-by: Carsten Otte <cotte@de.ibm.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/s390/include/asm/kvm.h | 3 ++-
+ arch/s390/kvm/kvm-s390.c | 25 +++++++++++++++++--------
+ include/linux/kvm.h | 8 ++++++--
+ 3 files changed, 25 insertions(+), 11 deletions(-)
+
+--- a/arch/s390/include/asm/kvm.h
++++ b/arch/s390/include/asm/kvm.h
+@@ -1,6 +1,5 @@
+ #ifndef __LINUX_KVM_S390_H
+ #define __LINUX_KVM_S390_H
+-
+ /*
+ * asm-s390/kvm.h - KVM s390 specific structures and definitions
+ *
+@@ -15,6 +14,8 @@
+ */
+ #include <linux/types.h>
+
++#define __KVM_S390
++
+ /* for KVM_GET_REGS and KVM_SET_REGS */
+ struct kvm_regs {
+ /* general purpose regs for s390 */
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -116,10 +116,16 @@ long kvm_arch_dev_ioctl(struct file *fil
+
+ int kvm_dev_ioctl_check_extension(long ext)
+ {
++ int r;
++
+ switch (ext) {
++ case KVM_CAP_S390_PSW:
++ r = 1;
++ break;
+ default:
+- return 0;
++ r = 0;
+ }
++ return r;
+ }
+
+ /* Section: vm related */
+@@ -419,8 +425,10 @@ static int kvm_arch_vcpu_ioctl_set_initi
+ vcpu_load(vcpu);
+ if (atomic_read(&vcpu->arch.sie_block->cpuflags) & CPUSTAT_RUNNING)
+ rc = -EBUSY;
+- else
+- vcpu->arch.sie_block->gpsw = psw;
++ else {
++ vcpu->run->psw_mask = psw.mask;
++ vcpu->run->psw_addr = psw.addr;
++ }
+ vcpu_put(vcpu);
+ return rc;
+ }
+@@ -508,9 +516,6 @@ rerun_vcpu:
+
+ switch (kvm_run->exit_reason) {
+ case KVM_EXIT_S390_SIEIC:
+- vcpu->arch.sie_block->gpsw.mask = kvm_run->s390_sieic.mask;
+- vcpu->arch.sie_block->gpsw.addr = kvm_run->s390_sieic.addr;
+- break;
+ case KVM_EXIT_UNKNOWN:
+ case KVM_EXIT_INTR:
+ case KVM_EXIT_S390_RESET:
+@@ -519,6 +524,9 @@ rerun_vcpu:
+ BUG();
+ }
+
++ vcpu->arch.sie_block->gpsw.mask = kvm_run->psw_mask;
++ vcpu->arch.sie_block->gpsw.addr = kvm_run->psw_addr;
++
+ might_fault();
+
+ do {
+@@ -538,8 +546,6 @@ rerun_vcpu:
+ /* intercept cannot be handled in-kernel, prepare kvm-run */
+ kvm_run->exit_reason = KVM_EXIT_S390_SIEIC;
+ kvm_run->s390_sieic.icptcode = vcpu->arch.sie_block->icptcode;
+- kvm_run->s390_sieic.mask = vcpu->arch.sie_block->gpsw.mask;
+- kvm_run->s390_sieic.addr = vcpu->arch.sie_block->gpsw.addr;
+ kvm_run->s390_sieic.ipa = vcpu->arch.sie_block->ipa;
+ kvm_run->s390_sieic.ipb = vcpu->arch.sie_block->ipb;
+ rc = 0;
+@@ -551,6 +557,9 @@ rerun_vcpu:
+ rc = 0;
+ }
+
++ kvm_run->psw_mask = vcpu->arch.sie_block->gpsw.mask;
++ kvm_run->psw_addr = vcpu->arch.sie_block->gpsw.addr;
++
+ if (vcpu->sigset_active)
+ sigprocmask(SIG_SETMASK, &sigsaved, NULL);
+
+--- a/include/linux/kvm.h
++++ b/include/linux/kvm.h
+@@ -116,6 +116,11 @@ struct kvm_run {
+ __u64 cr8;
+ __u64 apic_base;
+
++#ifdef __KVM_S390
++ /* the processor status word for s390 */
++ __u64 psw_mask; /* psw upper half */
++ __u64 psw_addr; /* psw lower half */
++#endif
+ union {
+ /* KVM_EXIT_UNKNOWN */
+ struct {
+@@ -167,8 +172,6 @@ struct kvm_run {
+ /* KVM_EXIT_S390_SIEIC */
+ struct {
+ __u8 icptcode;
+- __u64 mask; /* psw upper half */
+- __u64 addr; /* psw lower half */
+ __u16 ipa;
+ __u32 ipb;
+ } s390_sieic;
+@@ -474,6 +477,7 @@ struct kvm_irq_routing {
+ };
+
+ #endif
++#define KVM_CAP_S390_PSW 42
+
+ #ifdef KVM_CAP_MCE
+ /* x86 MCE */
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:47 2009
+Message-Id: <20091217035647.086599672@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:29 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Marcelo Tosatti <mtosatti@redhat.com>
+Subject: [032/151] KVM: fix irq_source_id size verification
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Marcelo Tosatti <mtosatti@redhat.com>
+
+commit cd5a2685de4a642fd0bd763e8c19711ef08dbe27 upstream.
+
+find_first_zero_bit works with bit numbers, not bytes.
+
+Fixes
+
+https://sourceforge.net/tracker/?func=detail&aid=2847560&group_id=180599&atid=893831
+
+Reported-by: "Xu, Jiajun" <jiajun.xu@intel.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ virt/kvm/irq_comm.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/virt/kvm/irq_comm.c
++++ b/virt/kvm/irq_comm.c
+@@ -205,10 +205,9 @@ int kvm_request_irq_source_id(struct kvm
+ int irq_source_id;
+
+ mutex_lock(&kvm->irq_lock);
+- irq_source_id = find_first_zero_bit(bitmap,
+- sizeof(kvm->arch.irq_sources_bitmap));
++ irq_source_id = find_first_zero_bit(bitmap, BITS_PER_LONG);
+
+- if (irq_source_id >= sizeof(kvm->arch.irq_sources_bitmap)) {
++ if (irq_source_id >= BITS_PER_LONG) {
+ printk(KERN_WARNING "kvm: exhaust allocatable IRQ sources!\n");
+ return -EFAULT;
+ }
+@@ -228,7 +227,7 @@ void kvm_free_irq_source_id(struct kvm *
+
+ mutex_lock(&kvm->irq_lock);
+ if (irq_source_id < 0 ||
+- irq_source_id >= sizeof(kvm->arch.irq_sources_bitmap)) {
++ irq_source_id >= BITS_PER_LONG) {
+ printk(KERN_ERR "kvm: IRQ source ID out of range!\n");
+ return;
+ }
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:47 2009
+Message-Id: <20091217035647.215895711@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:30 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Glauber Costa <glommer@redhat.com>,
+ Marcelo Tosatti <mtosatti@redhat.com>
+Subject: [033/151] KVM: x86: include pvclock MSRs in msrs_to_save
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Glauber Costa <glommer@redhat.com>
+
+commit e3267cbbbfbcbe9c18833e89b10beabb1117cb55 upstream.
+
+For a while now, we are issuing a rdmsr instruction to find out which
+msrs in our save list are really supported by the underlying machine.
+However, it fails to account for kvm-specific msrs, such as the pvclock
+ones.
+
+This patch moves then to the beginning of the list, and skip testing them.
+
+Signed-off-by: Glauber Costa <glommer@redhat.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/x86.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -484,16 +484,19 @@ static inline u32 bit(int bitno)
+ * and KVM_SET_MSRS, and KVM_GET_MSR_INDEX_LIST.
+ *
+ * This list is modified at module load time to reflect the
+- * capabilities of the host cpu.
++ * capabilities of the host cpu. This capabilities test skips MSRs that are
++ * kvm-specific. Those are put in the beginning of the list.
+ */
++
++#define KVM_SAVE_MSRS_BEGIN 2
+ static u32 msrs_to_save[] = {
++ MSR_KVM_SYSTEM_TIME, MSR_KVM_WALL_CLOCK,
+ MSR_IA32_SYSENTER_CS, MSR_IA32_SYSENTER_ESP, MSR_IA32_SYSENTER_EIP,
+ MSR_K6_STAR,
+ #ifdef CONFIG_X86_64
+ MSR_CSTAR, MSR_KERNEL_GS_BASE, MSR_SYSCALL_MASK, MSR_LSTAR,
+ #endif
+- MSR_IA32_TSC, MSR_KVM_SYSTEM_TIME, MSR_KVM_WALL_CLOCK,
+- MSR_IA32_PERF_STATUS, MSR_IA32_CR_PAT, MSR_VM_HSAVE_PA
++ MSR_IA32_TSC, MSR_IA32_PERF_STATUS, MSR_IA32_CR_PAT, MSR_VM_HSAVE_PA
+ };
+
+ static unsigned num_msrs_to_save;
+@@ -2433,7 +2436,8 @@ static void kvm_init_msr_list(void)
+ u32 dummy[2];
+ unsigned i, j;
+
+- for (i = j = 0; i < ARRAY_SIZE(msrs_to_save); i++) {
++ /* skip the first msrs in the list. KVM-specific */
++ for (i = j = KVM_SAVE_MSRS_BEGIN; i < ARRAY_SIZE(msrs_to_save); i++) {
+ if (rdmsr_safe(msrs_to_save[i], &dummy[0], &dummy[1]) < 0)
+ continue;
+ if (j < i)
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:47 2009
+Message-Id: <20091217035647.346284061@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:31 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Thomas Gleixner <tglx@linutronix.de>,
+ Ingo Molnar <mingo@elte.hu>,
+ Peter Zijlstra <peterz@infradead.org>,
+ "H. Peter Anvin" <hpa@zytor.com>,
+ Steven Rostedt <rostedt@goodmis.org>,
+ Frederic Weisbecker <fweisbec@gmail.com>,
+ Jeff Law <law@redhat.com>,
+ gcc@gcc.gnu.org,
+ David Daney <ddaney@caviumnetworks.com>,
+ Andrew Haley <aph@redhat.com>,
+ Richard Guenther <richard.guenther@gmail.com>
+Subject: [034/151] x86: Prevent GCC 4.4.x (pentium-mmx et al) function prologue wreckage
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 746357d6a526d6da9d89a2ec645b28406e959c2e upstream.
+
+When the kernel is compiled with -pg for tracing GCC 4.4.x inserts
+stack alignment of a function _before_ the mcount prologue if the
+-march=pentium-mmx is set and -mtune=generic is not set. This breaks
+the assumption of the function graph tracer which expects that the
+mcount prologue
+
+ push %ebp
+ mov %esp, %ebp
+
+is the first stack operation in a function because it needs to modify
+the function return address on the stack to trap into the tracer
+before returning to the real caller.
+
+The generated code is:
+
+ push %edi
+ lea 0x8(%esp),%edi
+ and $0xfffffff0,%esp
+ pushl -0x4(%edi)
+ push %ebp
+ mov %esp,%ebp
+
+so the tracer modifies the copy of the return address which is stored
+after the stack alignment and therefor does not trap the return which
+in turn breaks the call chain logic of the tracer and leads to a
+kernel panic.
+
+Aside of the fact that the generated code is horrible for no good
+reason other -march -mtune options generate the expected:
+
+ push %ebp
+ mov %esp,%ebp
+ and $0xfffffff0,%esp
+
+which does the same and keeps everything intact.
+
+After some experimenting we found out that this problem is restricted
+to gcc4.4.x and to the following -march settings:
+
+i586, pentium, pentium-mmx, k6, k6-2, k6-3, winchip-c6, winchip2, c3,
+geode
+
+By adding -mtune=generic the code generator produces always the
+expected code.
+
+So forcing -mtune=generic when CONFIG_FUNCTION_GRAPH_TRACER=y is not
+pretty, but at the moment the only way to prevent that the kernel
+trips over gcc-shrooms induced code madness.
+
+Most distro kernels have CONFIG_X86_GENERIC=y anyway which forces
+-mtune=generic as well so it will not impact those.
+
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+LKML-Reference: <alpine.LFD.2.00.0911200206570.24119@localhost.localdomain>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Frederic Weisbecker <fweisbec@gmail.com>,
+Cc: Jeff Law <law@redhat.com>
+Cc: gcc@gcc.gnu.org
+Cc: David Daney <ddaney@caviumnetworks.com>
+Cc: Andrew Haley <aph@redhat.com>
+Cc: Richard Guenther <richard.guenther@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/Makefile_32.cpu | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/arch/x86/Makefile_32.cpu
++++ b/arch/x86/Makefile_32.cpu
+@@ -46,6 +46,12 @@ cflags-$(CONFIG_MGEODEGX1) += -march=pen
+ # cpu entries
+ cflags-$(CONFIG_X86_GENERIC) += $(call tune,generic,$(call tune,i686))
+
++# Work around the pentium-mmx code generator madness of gcc4.4.x which
++# does stack alignment by generating horrible code _before_ the mcount
++# prologue (push %ebp, mov %esp, %ebp) which breaks the function graph
++# tracer assumptions
++cflags-$(CONFIG_FUNCTION_GRAPH_TRACER) += $(call cc-option,-mtune=generic)
++
+ # Bug fix for binutils: this option is required in order to keep
+ # binutils from generating NOPL instructions against our will.
+ ifneq ($(CONFIG_X86_P6_NOP),y)
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:47 2009
+Message-Id: <20091217035647.478189845@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:32 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Thomas Gleixner <tglx@linutronix.de>
+Subject: [035/151] x86: Use -maccumulate-outgoing-args for sane mcount prologues
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit b8b7d791a8ff01d2380089279a69afa99115fb23 upstream.
+
+commit 746357d (x86: Prevent GCC 4.4.x (pentium-mmx et al) function
+prologue wreckage) uses -mtune=generic to work around the function
+prologue problem with mcount on -march=pentium-mmx and others.
+
+Jakub pointed out that we can use -maccumulate-outgoing-args instead
+which is selected by -mtune=generic and prevents the problem without
+losing the -march specific optimizations.
+
+Pointed-out-by: Jakub Jelinek <jakub@redhat.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/Makefile_32.cpu | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/Makefile_32.cpu
++++ b/arch/x86/Makefile_32.cpu
+@@ -49,8 +49,9 @@ cflags-$(CONFIG_X86_GENERIC) += $(call
+ # Work around the pentium-mmx code generator madness of gcc4.4.x which
+ # does stack alignment by generating horrible code _before_ the mcount
+ # prologue (push %ebp, mov %esp, %ebp) which breaks the function graph
+-# tracer assumptions
+-cflags-$(CONFIG_FUNCTION_GRAPH_TRACER) += $(call cc-option,-mtune=generic)
++# tracer assumptions. For i686, generic, core2 this is set by the
++# compiler anyway
++cflags-$(CONFIG_FUNCTION_GRAPH_TRACER) += $(call cc-option,-maccumulate-outgoing-args)
+
+ # Bug fix for binutils: this option is required in order to keep
+ # binutils from generating NOPL instructions against our will.
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:47 2009
+Message-Id: <20091217035647.605378154@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:33 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Hidetoshi Seto <seto.hidetoshi@jp.fujitsu.com>,
+ Andi Kleen <andi@firstfloor.org>,
+ Huang Ying <ying.huang@intel.com>,
+ Jan Beulich <jbeulich@novell.com>,
+ "H. Peter Anvin" <hpa@zytor.com>
+Subject: [036/151] x86, mce: dont restart timer if disabled
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Hidetoshi Seto <seto.hidetoshi@jp.fujitsu.com>
+
+commit fe5ed91ddce85a0ed0e4f92c10b099873ef62167 upstream.
+
+Even it is in error path unlikely taken, add_timer_on() at
+CPU_DOWN_FAILED* needs to be skipped if mce_timer is disabled.
+
+Signed-off-by: Hidetoshi Seto <seto.hidetoshi@jp.fujitsu.com>
+Cc: Andi Kleen <andi@firstfloor.org>
+Cc: Huang Ying <ying.huang@intel.com>
+Cc: Jan Beulich <jbeulich@novell.com>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/mcheck/mce.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -1991,9 +1991,11 @@ mce_cpu_callback(struct notifier_block *
+ break;
+ case CPU_DOWN_FAILED:
+ case CPU_DOWN_FAILED_FROZEN:
+- t->expires = round_jiffies(jiffies +
++ if (!mce_ignore_ce && check_interval) {
++ t->expires = round_jiffies(jiffies +
+ __get_cpu_var(mce_next_interval));
+- add_timer_on(t, cpu);
++ add_timer_on(t, cpu);
++ }
+ smp_call_function_single(cpu, mce_reenable_cpu, &action, 1);
+ break;
+ case CPU_POST_DEAD:
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:47 2009
+Message-Id: <20091217035647.738596809@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:34 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jan Beulich <jbeulich@novell.com>,
+ Hidetoshi Seto <seto.hidetoshi@jp.fujitsu.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [037/151] x86/mce: Set up timer unconditionally
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jan Beulich <jbeulich@novell.com>
+
+commit bc09effabf0c5c6c7021e5ef9af15a23579b32a8 upstream.
+
+mce_timer must be passed to setup_timer() in all cases, no
+matter whether it is going to be actually used. Otherwise, when
+the CPU gets brought down, its call to del_timer_sync() will
+never return, as the timer won't have a base associated, and
+hence lock_timer_base() will loop infinitely.
+
+Signed-off-by: Jan Beulich <jbeulich@novell.com>
+Signed-off-by: Hidetoshi Seto <seto.hidetoshi@jp.fujitsu.com>
+LKML-Reference: <4B1DB831.2030801@jp.fujitsu.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/mcheck/mce.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -1374,13 +1374,14 @@ static void mce_init_timer(void)
+ struct timer_list *t = &__get_cpu_var(mce_timer);
+ int *n = &__get_cpu_var(mce_next_interval);
+
++ setup_timer(t, mcheck_timer, smp_processor_id());
++
+ if (mce_ignore_ce)
+ return;
+
+ *n = check_interval * HZ;
+ if (!*n)
+ return;
+- setup_timer(t, mcheck_timer, smp_processor_id());
+ t->expires = round_jiffies(jiffies + *n);
+ add_timer_on(t, smp_processor_id());
+ }
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:47 2009
+Message-Id: <20091217035647.865130289@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:35 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Cliff Wickman <cpw@sgi.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [038/151] x86: SGI UV: Fix BAU initialization
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Cliff Wickman <cpw@sgi.com>
+
+commit e38e2af1c57c3eb5211331a5b4fcaae0c4a2a918 upstream.
+
+A memory mapped register that affects the SGI UV Broadcast
+Assist Unit's interrupt handling may sometimes be unintialized.
+
+Remove the condition on its initialization, as that condition
+can be randomly satisfied by a hardware reset.
+
+Signed-off-by: Cliff Wickman <cpw@sgi.com>
+LKML-Reference: <E1NBGB9-0005nU-Dp@eag09.americas.sgi.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/tlb_uv.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/arch/x86/kernel/tlb_uv.c
++++ b/arch/x86/kernel/tlb_uv.c
+@@ -817,10 +817,8 @@ static int __init uv_init_blade(int blad
+ */
+ apicid = blade_to_first_apicid(blade);
+ pa = uv_read_global_mmr64(pnode, UVH_BAU_DATA_CONFIG);
+- if ((pa & 0xff) != UV_BAU_MESSAGE) {
+- uv_write_global_mmr64(pnode, UVH_BAU_DATA_CONFIG,
++ uv_write_global_mmr64(pnode, UVH_BAU_DATA_CONFIG,
+ ((apicid << 32) | UV_BAU_MESSAGE));
+- }
+ return 0;
+ }
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:48 2009
+Message-Id: <20091217035647.992413232@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:36 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Cliff Wickman <cpw@sgi.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [039/151] x86: Fix duplicated UV BAU interrupt vector
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Cliff Wickman <cpw@sgi.com>
+
+commit 1d865fb728bd6bbcdfbd6ec1e2b8ade3b4805641 upstream.
+
+Interrupt vector 0xec has been doubly defined in irq_vectors.h
+
+It seems arbitrary whether LOCAL_PENDING_VECTOR or
+UV_BAU_MESSAGE is the higher number. As long as they are
+unique. If they are not unique we'll hit a BUG in
+alloc_system_vector().
+
+Signed-off-by: Cliff Wickman <cpw@sgi.com>
+LKML-Reference: <E1NJ9Pe-0004P7-0Q@eag09.americas.sgi.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/irq_vectors.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/include/asm/irq_vectors.h
++++ b/arch/x86/include/asm/irq_vectors.h
+@@ -113,7 +113,7 @@
+ */
+ #define LOCAL_PENDING_VECTOR 0xec
+
+-#define UV_BAU_MESSAGE 0xec
++#define UV_BAU_MESSAGE 0xea
+
+ /*
+ * Self IPI vector for machine checks
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:48 2009
+Message-Id: <20091217035648.120982645@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:37 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dave Jones <davej@redhat.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [040/151] x86: Add new Intel CPU cache size descriptors
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Dave Jones <davej@redhat.com>
+
+commit 85160b92fbd35321104819283c91bfed2b553e3c upstream.
+
+The latest rev of Intel doc AP-485 details new cache descriptors
+that we don't yet support. 12MB, 18MB and 24MB 24-way assoc L3
+caches.
+
+Signed-off-by: Dave Jones <davej@redhat.com>
+LKML-Reference: <20091110184924.GA20337@redhat.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/intel_cacheinfo.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/x86/kernel/cpu/intel_cacheinfo.c
++++ b/arch/x86/kernel/cpu/intel_cacheinfo.c
+@@ -102,6 +102,9 @@ static const struct _cache_table __cpuin
+ { 0xe2, LVL_3, 2048 }, /* 16-way set assoc, 64 byte line size */
+ { 0xe3, LVL_3, 4096 }, /* 16-way set assoc, 64 byte line size */
+ { 0xe4, LVL_3, 8192 }, /* 16-way set assoc, 64 byte line size */
++ { 0xea, LVL_3, 12288 }, /* 24-way set assoc, 64 byte line size */
++ { 0xeb, LVL_3, 18432 }, /* 24-way set assoc, 64 byte line size */
++ { 0xec, LVL_3, 24576 }, /* 24-way set assoc, 64 byte line size */
+ { 0x00, 0, 0}
+ };
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:48 2009
+Message-Id: <20091217035648.247081156@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:38 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dave Jones <davej@redhat.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [041/151] x86: Fix typo in Intel CPU cache size descriptor
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Dave Jones <davej@redhat.com>
+
+commit e02e0e1a130b9ca37c5186d38ad4b3aaf58bb149 upstream.
+
+I double-checked the datasheet. One of the existing
+descriptors has a typo: it should be 2MB not 2038 KB.
+
+Signed-off-by: Dave Jones <davej@redhat.com>
+LKML-Reference: <20091110200120.GA27090@redhat.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/intel_cacheinfo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/intel_cacheinfo.c
++++ b/arch/x86/kernel/cpu/intel_cacheinfo.c
+@@ -94,7 +94,7 @@ static const struct _cache_table __cpuin
+ { 0xd1, LVL_3, 1024 }, /* 4-way set assoc, 64 byte line size */
+ { 0xd2, LVL_3, 2048 }, /* 4-way set assoc, 64 byte line size */
+ { 0xd6, LVL_3, 1024 }, /* 8-way set assoc, 64 byte line size */
+- { 0xd7, LVL_3, 2038 }, /* 8-way set assoc, 64 byte line size */
++ { 0xd7, LVL_3, 2048 }, /* 8-way set assoc, 64 byte line size */
+ { 0xd8, LVL_3, 4096 }, /* 12-way set assoc, 64 byte line size */
+ { 0xdc, LVL_3, 2048 }, /* 12-way set assoc, 64 byte line size */
+ { 0xdd, LVL_3, 4096 }, /* 12-way set assoc, 64 byte line size */
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:48 2009
+Message-Id: <20091217035648.371845216@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:39 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Sergei Shtylyov <sshtylyov@ru.mvista.com>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [042/151] pata_hpt{37x|3x2n}: fix timing register masks (take 2)
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+
+commit 5600c70e576199a7552e1c0fff43f3fe16f5566e upstream.
+
+These drivers inherited from the older 'hpt366' IDE driver the buggy timing
+register masks in their set_piomode() metods. As a result, too low command
+cycle active time is programmed for slow PIO modes. Quite fortunately, it's
+later "fixed up" by the set_dmamode() methods which also "helpfully" reprogram
+the command timings, usually to PIO mode 4; unfortunately, setting an UltraDMA
+mode #N also reprograms already set PIO data timings, usually to MWDMA mode #
+max(N, 2) timings...
+
+However, the drivers added some breakage of their own too: the bit that they
+set/clear to control the FIFO is sometimes wrong -- it's actually the MSB of
+the command cycle setup time; also, setting it in DMA mode is wrong as this
+bit is only for PIO actually and clearing it for PIO modes is not needed as
+no mode in any timing table has it set...
+
+Fix all this, inverting the masks while at it, like in the 'hpt366' and
+'pata_hpt366' drivers; bump the drivers' versions, accounting for recent
+patches that forgot to do it...
+
+Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/pata_hpt37x.c | 32 +++++++++++++++-----------------
+ drivers/ata/pata_hpt3x2n.c | 17 ++++++++---------
+ 2 files changed, 23 insertions(+), 26 deletions(-)
+
+--- a/drivers/ata/pata_hpt37x.c
++++ b/drivers/ata/pata_hpt37x.c
+@@ -24,7 +24,7 @@
+ #include <linux/libata.h>
+
+ #define DRV_NAME "pata_hpt37x"
+-#define DRV_VERSION "0.6.12"
++#define DRV_VERSION "0.6.14"
+
+ struct hpt_clock {
+ u8 xfer_speed;
+@@ -404,9 +404,8 @@ static void hpt370_set_piomode(struct at
+
+ pci_read_config_dword(pdev, addr1, ®);
+ mode = hpt37x_find_mode(ap, adev->pio_mode);
+- mode &= ~0x8000000; /* No FIFO in PIO */
+- mode &= ~0x30070000; /* Leave config bits alone */
+- reg &= 0x30070000; /* Strip timing bits */
++ mode &= 0xCFC3FFFF; /* Leave DMA bits alone */
++ reg &= ~0xCFC3FFFF; /* Strip timing bits */
+ pci_write_config_dword(pdev, addr1, reg | mode);
+ }
+
+@@ -423,8 +422,7 @@ static void hpt370_set_dmamode(struct at
+ {
+ struct pci_dev *pdev = to_pci_dev(ap->host->dev);
+ u32 addr1, addr2;
+- u32 reg;
+- u32 mode;
++ u32 reg, mode, mask;
+ u8 fast;
+
+ addr1 = 0x40 + 4 * (adev->devno + 2 * ap->port_no);
+@@ -436,11 +434,12 @@ static void hpt370_set_dmamode(struct at
+ fast |= 0x01;
+ pci_write_config_byte(pdev, addr2, fast);
+
++ mask = adev->dma_mode < XFER_UDMA_0 ? 0x31C001FF : 0x303C0000;
++
+ pci_read_config_dword(pdev, addr1, ®);
+ mode = hpt37x_find_mode(ap, adev->dma_mode);
+- mode |= 0x8000000; /* FIFO in MWDMA or UDMA */
+- mode &= ~0xC0000000; /* Leave config bits alone */
+- reg &= 0xC0000000; /* Strip timing bits */
++ mode &= mask;
++ reg &= ~mask;
+ pci_write_config_dword(pdev, addr1, reg | mode);
+ }
+
+@@ -508,9 +507,8 @@ static void hpt372_set_piomode(struct at
+ mode = hpt37x_find_mode(ap, adev->pio_mode);
+
+ printk("Find mode for %d reports %X\n", adev->pio_mode, mode);
+- mode &= ~0x80000000; /* No FIFO in PIO */
+- mode &= ~0x30070000; /* Leave config bits alone */
+- reg &= 0x30070000; /* Strip timing bits */
++ mode &= 0xCFC3FFFF; /* Leave DMA bits alone */
++ reg &= ~0xCFC3FFFF; /* Strip timing bits */
+ pci_write_config_dword(pdev, addr1, reg | mode);
+ }
+
+@@ -527,8 +525,7 @@ static void hpt372_set_dmamode(struct at
+ {
+ struct pci_dev *pdev = to_pci_dev(ap->host->dev);
+ u32 addr1, addr2;
+- u32 reg;
+- u32 mode;
++ u32 reg, mode, mask;
+ u8 fast;
+
+ addr1 = 0x40 + 4 * (adev->devno + 2 * ap->port_no);
+@@ -539,12 +536,13 @@ static void hpt372_set_dmamode(struct at
+ fast &= ~0x07;
+ pci_write_config_byte(pdev, addr2, fast);
+
++ mask = adev->dma_mode < XFER_UDMA_0 ? 0x31C001FF : 0x303C0000;
++
+ pci_read_config_dword(pdev, addr1, ®);
+ mode = hpt37x_find_mode(ap, adev->dma_mode);
+ printk("Find mode for DMA %d reports %X\n", adev->dma_mode, mode);
+- mode &= ~0xC0000000; /* Leave config bits alone */
+- mode |= 0x80000000; /* FIFO in MWDMA or UDMA */
+- reg &= 0xC0000000; /* Strip timing bits */
++ mode &= mask;
++ reg &= ~mask;
+ pci_write_config_dword(pdev, addr1, reg | mode);
+ }
+
+--- a/drivers/ata/pata_hpt3x2n.c
++++ b/drivers/ata/pata_hpt3x2n.c
+@@ -25,7 +25,7 @@
+ #include <linux/libata.h>
+
+ #define DRV_NAME "pata_hpt3x2n"
+-#define DRV_VERSION "0.3.4"
++#define DRV_VERSION "0.3.7"
+
+ enum {
+ HPT_PCI_FAST = (1 << 31),
+@@ -185,9 +185,8 @@ static void hpt3x2n_set_piomode(struct a
+
+ pci_read_config_dword(pdev, addr1, ®);
+ mode = hpt3x2n_find_mode(ap, adev->pio_mode);
+- mode &= ~0x8000000; /* No FIFO in PIO */
+- mode &= ~0x30070000; /* Leave config bits alone */
+- reg &= 0x30070000; /* Strip timing bits */
++ mode &= 0xCFC3FFFF; /* Leave DMA bits alone */
++ reg &= ~0xCFC3FFFF; /* Strip timing bits */
+ pci_write_config_dword(pdev, addr1, reg | mode);
+ }
+
+@@ -204,8 +203,7 @@ static void hpt3x2n_set_dmamode(struct a
+ {
+ struct pci_dev *pdev = to_pci_dev(ap->host->dev);
+ u32 addr1, addr2;
+- u32 reg;
+- u32 mode;
++ u32 reg, mode, mask;
+ u8 fast;
+
+ addr1 = 0x40 + 4 * (adev->devno + 2 * ap->port_no);
+@@ -216,11 +214,12 @@ static void hpt3x2n_set_dmamode(struct a
+ fast &= ~0x07;
+ pci_write_config_byte(pdev, addr2, fast);
+
++ mask = adev->dma_mode < XFER_UDMA_0 ? 0x31C001FF : 0x303C0000;
++
+ pci_read_config_dword(pdev, addr1, ®);
+ mode = hpt3x2n_find_mode(ap, adev->dma_mode);
+- mode |= 0x8000000; /* FIFO in MWDMA or UDMA */
+- mode &= ~0xC0000000; /* Leave config bits alone */
+- reg &= 0xC0000000; /* Strip timing bits */
++ mode &= mask;
++ reg &= ~mask;
+ pci_write_config_dword(pdev, addr1, reg | mode);
+ }
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:48 2009
+Message-Id: <20091217035648.501745098@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:40 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Hendrik Brueckner <brueckner@linux.vnet.ibm.com>,
+ Martin Schwidefsky <schwidefsky@de.ibm.com>
+Subject: [043/151] [S390] s390: clear high-order bits of registers after sam64
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
+
+commit cf87b7439ec81b9374e7772e44e9cb2eb9e57160 upstream.
+
+When the kernel is IPLed without the CLEAR option and switches
+to 64-bit, the high-order half of the registers might contain
+random values. This can cause addressing exceptions and the
+kernel enters an interrupt loop.
+
+Initialize the high-order half of the general purpose registers
+with zeros after switching to 64-bit mode.
+
+Signed-off-by: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/s390/kernel/head64.S | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/s390/kernel/head64.S
++++ b/arch/s390/kernel/head64.S
+@@ -83,6 +83,8 @@ startup_continue:
+ slr %r0,%r0 # set cpuid to zero
+ sigp %r1,%r0,0x12 # switch to esame mode
+ sam64 # switch to 64 bit mode
++ llgfr %r13,%r13 # clear high-order half of base reg
++ lmh %r0,%r15,.Lzero64-.LPG1(%r13) # clear high-order half
+ lctlg %c0,%c15,.Lctl-.LPG1(%r13) # load control registers
+ lg %r12,.Lparmaddr-.LPG1(%r13) # pointer to parameter area
+ # move IPL device to lowcore
+@@ -127,6 +129,7 @@ startup_continue:
+ .L4malign:.quad 0xffffffffffc00000
+ .Lscan2g:.quad 0x80000000 + 0x20000 - 8 # 2GB + 128K - 8
+ .Lnop: .long 0x07000700
++.Lzero64:.fill 16,4,0x0
+ #ifdef CONFIG_ZFCPDUMP
+ .Lcurrent_cpu:
+ .long 0x0
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:48 2009
+Message-Id: <20091217035648.630575367@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:41 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Roel Kluin <roel.kluin@gmail.com>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>
+Subject: [044/151] V4L/DVB: Fix test in copy_reg_bits()
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Roel Kluin <roel.kluin@gmail.com>
+
+commit c95a419a5604ec8a23cd73f61e9bb151e8cbe89b upstream.
+
+The reg_pair2[j].reg was tested twice.
+
+Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
+Acked-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/common/tuners/mxl5007t.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/common/tuners/mxl5007t.c
++++ b/drivers/media/common/tuners/mxl5007t.c
+@@ -196,7 +196,7 @@ static void copy_reg_bits(struct reg_pai
+ i = j = 0;
+
+ while (reg_pair1[i].reg || reg_pair1[i].val) {
+- while (reg_pair2[j].reg || reg_pair2[j].reg) {
++ while (reg_pair2[j].reg || reg_pair2[j].val) {
+ if (reg_pair1[i].reg != reg_pair2[j].reg) {
+ j++;
+ continue;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:48 2009
+Message-Id: <20091217035648.759753724@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:42 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alexey Dobriyan <adobriyan@gmail.com>,
+ Serge Hallyn <serue@us.ibm.com>,
+ David Howells <dhowells@redhat.com>,
+ James Morris <jmorris@namei.org>
+Subject: [045/151] bsdacct: fix uid/gid misreporting
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alexey Dobriyan <adobriyan@gmail.com>
+
+commit 4b731d50ff3df6b9141a6c12b088e8eb0109e83c upstream.
+
+commit d8e180dcd5bbbab9cd3ff2e779efcf70692ef541 "bsdacct: switch
+credentials for writing to the accounting file" introduced credential
+switching during final acct data collecting. However, uid/gid pair
+continued to be collected from current which became credentials of who
+created acct file, not who exits.
+
+Addresses http://bugzilla.kernel.org/show_bug.cgi?id=14676
+
+Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
+Reported-by: Juho K. Juopperi <jkj@kapsi.fi>
+Acked-by: Serge Hallyn <serue@us.ibm.com>
+Acked-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Michal Schmidt <mschmidt@redhat.com>
+Cc: James Morris <jmorris@namei.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/acct.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/acct.c
++++ b/kernel/acct.c
+@@ -536,7 +536,8 @@ static void do_acct_process(struct bsd_a
+ do_div(elapsed, AHZ);
+ ac.ac_btime = get_seconds() - elapsed;
+ /* we really need to bite the bullet and change layout */
+- current_uid_gid(&ac.ac_uid, &ac.ac_gid);
++ ac.ac_uid = orig_cred->uid;
++ ac.ac_gid = orig_cred->gid;
+ #if ACCT_VERSION==2
+ ac.ac_ahz = AHZ;
+ #endif
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:49 2009
+Message-Id: <20091217035648.891078920@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:43 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Sebastian Andrzej Siewior <sebastian@breakpoint.cc>,
+ Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Subject: [046/151] UBI: flush wl before clearing update marker
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
+
+commit 6afaf8a484cbbfd2ccf58a4e5396d1f280469789 upstream.
+
+ubiupdatevol -t does the following:
+- ubi_start_update()
+ - set_update_marker()
+ - for all LEBs ubi_eba_unmap_leb()
+ - clear_update_marker()
+ - ubi_wl_flush()
+
+ubi_wl_flush() physically erases all PEB, once it returns all PEBs are
+empty. clear_update_marker() has the update marker written after return.
+If there is a power cut between the last two functions then the UBI
+volume has no longer the "update" marker set and may have some valid
+LEBs while some of them may be gone.
+If that volume in question happens to be a UBIFS volume, then mount
+will fail with
+
+|UBIFS error (pid 1361): ubifs_read_node: bad node type (255 but expected 6)
+|UBIFS error (pid 1361): ubifs_read_node: bad node at LEB 0:0
+|Not a node, first 24 bytes:
+|00000000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+
+if there is at least one valid LEB and the wear-leveling worker managed
+to clear LEB 0.
+
+The patch waits for the wl worker to finish prior clearing the "update"
+marker on flash. The two new LEB which are scheduled for erasing after
+clear_update_marker() should not matter because they are only visible to
+UBI.
+
+Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mtd/ubi/upd.c | 20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+--- a/drivers/mtd/ubi/upd.c
++++ b/drivers/mtd/ubi/upd.c
+@@ -147,12 +147,14 @@ int ubi_start_update(struct ubi_device *
+ }
+
+ if (bytes == 0) {
++ err = ubi_wl_flush(ubi);
++ if (err)
++ return err;
++
+ err = clear_update_marker(ubi, vol, 0);
+ if (err)
+ return err;
+- err = ubi_wl_flush(ubi);
+- if (!err)
+- vol->updating = 0;
++ vol->updating = 0;
+ }
+
+ vol->upd_buf = vmalloc(ubi->leb_size);
+@@ -362,16 +364,16 @@ int ubi_more_update_data(struct ubi_devi
+
+ ubi_assert(vol->upd_received <= vol->upd_bytes);
+ if (vol->upd_received == vol->upd_bytes) {
++ err = ubi_wl_flush(ubi);
++ if (err)
++ return err;
+ /* The update is finished, clear the update marker */
+ err = clear_update_marker(ubi, vol, vol->upd_bytes);
+ if (err)
+ return err;
+- err = ubi_wl_flush(ubi);
+- if (err == 0) {
+- vol->updating = 0;
+- err = to_write;
+- vfree(vol->upd_buf);
+- }
++ vol->updating = 0;
++ err = to_write;
++ vfree(vol->upd_buf);
+ }
+
+ return err;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:49 2009
+Message-Id: <20091217035649.016670805@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:44 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Theodore Tso" <tytso@mit.edu>
+Subject: [047/151] jbd2: dont wipe the journal on a failed journal checksum
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+commit e6a47428de84e19fda52f21ab73fde2906c40d09 upstream.
+
+If there is a failed journal checksum, don't reset the journal. This
+allows for userspace programs to decide how to recover from this
+situation. It may be that ignoring the journal checksum failure might
+be a better way of recovering the file system. Once we add per-block
+checksums, we can definitely do better. Until then, a system
+administrator can try backing up the file system image (or taking a
+snapshot) and and trying to determine experimentally whether ignoring
+the checksum failure or aborting the journal replay results in less
+data loss.
+
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/jbd2/journal.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -1253,6 +1253,13 @@ int jbd2_journal_load(journal_t *journal
+ if (jbd2_journal_recover(journal))
+ goto recovery_error;
+
++ if (journal->j_failed_commit) {
++ printk(KERN_ERR "JBD2: journal transaction %u on %s "
++ "is corrupt.\n", journal->j_failed_commit,
++ journal->j_devname);
++ return -EIO;
++ }
++
+ /* OK, we've finished with the dynamic journal bits:
+ * reinitialise the dynamic contents of the superblock in memory
+ * and reset them on disk. */
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:49 2009
+Message-Id: <20091217035649.141399735@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:45 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Subject: [048/151] USB: xhci: Add correct email and files to MAINTAINERS entry.
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+
+commit 36d0344c254a7b333272757f858c403ea3a2d29f upstream.
+
+Add the xHCI driver files to its MAINTAINERS entry so that I'm Cc'd on
+cleanup patches. Update the email address to one I actually use for
+sending patches and responding to Linux mailing list emails.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ MAINTAINERS | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -5594,9 +5594,11 @@ S: Maintained
+ F: drivers/net/wireless/rndis_wlan.c
+
+ USB XHCI DRIVER
+-M: Sarah Sharp <sarah.a.sharp@intel.com>
++M: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+ L: linux-usb@vger.kernel.org
+ S: Supported
++F: drivers/usb/host/xhci*
++F: drivers/usb/host/pci-quirks*
+
+ USB ZC0301 DRIVER
+ M: Luca Risolia <luca.risolia@studio.unibo.it>
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:49 2009
+Message-Id: <20091217035649.269026296@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:46 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Sergei Shtylyov <sshtylyov@ru.mvista.com>,
+ Anand Gadiyar <gadiyar@ti.com>
+Subject: [049/151] USB: musb_gadget_ep0: fix unhandled endpoint 0 IRQs, again
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+
+commit 196f1b7a387546f425df2f1fad26772e3d513aea upstream.
+
+Commit a5073b52833e4df8e16c93dc4cbb7e0c558c74a2 (musb_gadget: fix
+unhandled endpoint 0 IRQs) somehow missed its key change:
+
+"The gadget EP0 code routinely ignores an interrupt at end of
+the data phase because of musb_g_ep0_giveback() resetting the
+state machine to "idle, waiting for SETUP" phase prematurely."
+
+So, the majority of the cases of unhandled IRQs is still unfixed...
+
+Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Signed-off-by: Anand Gadiyar <gadiyar@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/musb/musb_gadget_ep0.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/usb/musb/musb_gadget_ep0.c
++++ b/drivers/usb/musb/musb_gadget_ep0.c
+@@ -199,7 +199,6 @@ service_in_request(struct musb *musb, co
+ static void musb_g_ep0_giveback(struct musb *musb, struct usb_request *req)
+ {
+ musb_g_giveback(&musb->endpoints[0].ep_in, req, 0);
+- musb->ep0_state = MUSB_EP0_STAGE_SETUP;
+ }
+
+ /*
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:49 2009
+Message-Id: <20091217035649.394659875@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:47 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Zhang Le <r0bertz@gentoo.org>
+Subject: [050/151] USB: option.c: add support for D-Link DWM-162-U5
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Zhang Le <r0bertz@gentoo.org>
+
+commit 54a8e144acad6506920f385f4ef2779664f05b21 upstream.
+
+Add D-Link DWM-162-U5 device id 1e0e:ce16 into option driver. The device
+has 4 interfaces, of which 1 is handled by storage and the other 3 by
+option driver.
+
+The device appears first as CD-only 05c6:2100 device and must be switched
+to 1e0e:ce16 mode either by using "eject CD" or usb_modeswitch.
+
+The MessageContent for usb_modeswitch.conf is:
+"55534243e0c26a85000000000000061b000000020000000000000000000000"
+
+Signed-off-by: Zhang Le <r0bertz@gentoo.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/option.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -635,6 +635,7 @@ static struct usb_device_id option_ids[]
+ { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_G450) },
+ { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_HSDPA_MINICARD ) }, /* Toshiba 3G HSDPA == Novatel Expedite EU870D MiniCard */
+ { USB_DEVICE(ALINK_VENDOR_ID, 0x9000) },
++ { USB_DEVICE(ALINK_VENDOR_ID, 0xce16) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) },
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S) },
+ { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:49 2009
+Message-Id: <20091217035649.521288758@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:48 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andre Herms <andre.herms@tec-venture.de>
+Subject: [051/151] USB: usbtmc: repeat usb_bulk_msg until whole message is transfered
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Andre Herms <andre.herms@tec-venture.de>
+
+commit ec412b92dbe3ea839716853eea058d1bcc5e6ca4 upstream.
+
+usb_bulk_msg() transfers only bytes up to the maximum packet size.
+It must be repeated by the usbtmc driver until all bytes of a TMC message
+are transfered.
+
+Without this patch, ETIMEDOUT is reported when writing TMC messages
+larger than the maximum USB bulk size and the transfer remains incomplete.
+The user will notice that the device hangs and must be reset by either closing
+the application or pulling the plug.
+
+Signed-off-by: Andre Herms <andre.herms@tec-venture.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/class/usbtmc.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/class/usbtmc.c
++++ b/drivers/usb/class/usbtmc.c
+@@ -562,10 +562,16 @@ static ssize_t usbtmc_write(struct file
+ n_bytes = roundup(12 + this_part, 4);
+ memset(buffer + 12 + this_part, 0, n_bytes - (12 + this_part));
+
+- retval = usb_bulk_msg(data->usb_dev,
+- usb_sndbulkpipe(data->usb_dev,
+- data->bulk_out),
+- buffer, n_bytes, &actual, USBTMC_TIMEOUT);
++ do {
++ retval = usb_bulk_msg(data->usb_dev,
++ usb_sndbulkpipe(data->usb_dev,
++ data->bulk_out),
++ buffer, n_bytes,
++ &actual, USBTMC_TIMEOUT);
++ if (retval != 0)
++ break;
++ n_bytes -= actual;
++ } while (n_bytes);
+
+ data->bTag_last_write = data->bTag;
+ data->bTag++;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:49 2009
+Message-Id: <20091217035649.649378015@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:49 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Stern <stern@rowland.harvard.edu>
+Subject: [052/151] USB: usb-storage: add BAD_SENSE flag
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit a0bb108112a872c0b0c4b3ef4974f95fb75b155d upstream.
+
+This patch (as1311) fixes a problem in usb-storage: Some devices are
+pretty broken when it comes to reporting sense data. The information
+they send back indicates that they have more than 18 bytes of sense
+data available, but when the system asks for more than 18 they fail or
+hang. The symptom is that probing fails with multiple resets.
+
+The patch adds a new BAD_SENSE flag to indicate that usb-storage
+should never ask for more than 18 bytes of sense data. The flag can
+be set in an unusual_devs entry or via the "quirks=" module parameter,
+and it is set automatically whenever a REQUEST SENSE command for more
+than 18 bytes fails or times out.
+
+An unusual_devs entry is added for the Agfa photo frame, which uses a
+Prolific chip having this bug.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Tested-by: Daniel Kukula <daniel.kuku@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+--- a/Documentation/kernel-parameters.txt
++++ b/Documentation/kernel-parameters.txt
+@@ -2663,6 +2663,8 @@ and is between 256 and 4096 characters. It is defined in the file
+ to a common usb-storage quirk flag as follows:
+ a = SANE_SENSE (collect more than 18 bytes
+ of sense data);
++ b = BAD_SENSE (don't collect more than 18
++ bytes of sense data);
+ c = FIX_CAPACITY (decrease the reported
+ device capacity by one sector);
+ h = CAPACITY_HEURISTICS (decrease the
+diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
+index 589f6b4..cc313d1 100644
+--- a/drivers/usb/storage/transport.c
++++ b/drivers/usb/storage/transport.c
+@@ -666,10 +666,11 @@ void usb_stor_invoke_transport(struct scsi_cmnd *srb, struct us_data *us)
+ * to wait for at least one CHECK_CONDITION to determine
+ * SANE_SENSE support
+ */
+- if ((srb->cmnd[0] == ATA_16 || srb->cmnd[0] == ATA_12) &&
++ if (unlikely((srb->cmnd[0] == ATA_16 || srb->cmnd[0] == ATA_12) &&
+ result == USB_STOR_TRANSPORT_GOOD &&
+ !(us->fflags & US_FL_SANE_SENSE) &&
+- !(srb->cmnd[2] & 0x20)) {
++ !(us->fflags & US_FL_BAD_SENSE) &&
++ !(srb->cmnd[2] & 0x20))) {
+ US_DEBUGP("-- SAT supported, increasing auto-sense\n");
+ us->fflags |= US_FL_SANE_SENSE;
+ }
+@@ -718,6 +719,12 @@ Retry_Sense:
+ if (test_bit(US_FLIDX_TIMED_OUT, &us->dflags)) {
+ US_DEBUGP("-- auto-sense aborted\n");
+ srb->result = DID_ABORT << 16;
++
++ /* If SANE_SENSE caused this problem, disable it */
++ if (sense_size != US_SENSE_SIZE) {
++ us->fflags &= ~US_FL_SANE_SENSE;
++ us->fflags |= US_FL_BAD_SENSE;
++ }
+ goto Handle_Errors;
+ }
+
+@@ -727,10 +734,11 @@ Retry_Sense:
+ * (small) sense request. This fixes some USB GSM modems
+ */
+ if (temp_result == USB_STOR_TRANSPORT_FAILED &&
+- (us->fflags & US_FL_SANE_SENSE) &&
+- sense_size != US_SENSE_SIZE) {
++ sense_size != US_SENSE_SIZE) {
+ US_DEBUGP("-- auto-sense failure, retry small sense\n");
+ sense_size = US_SENSE_SIZE;
++ us->fflags &= ~US_FL_SANE_SENSE;
++ us->fflags |= US_FL_BAD_SENSE;
+ goto Retry_Sense;
+ }
+
+@@ -754,6 +762,7 @@ Retry_Sense:
+ */
+ if (srb->sense_buffer[7] > (US_SENSE_SIZE - 8) &&
+ !(us->fflags & US_FL_SANE_SENSE) &&
++ !(us->fflags & US_FL_BAD_SENSE) &&
+ (srb->sense_buffer[0] & 0x7C) == 0x70) {
+ US_DEBUGP("-- SANE_SENSE support enabled\n");
+ us->fflags |= US_FL_SANE_SENSE;
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index d4f034e..64a0a2c 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -818,6 +818,13 @@ UNUSUAL_DEV( 0x066f, 0x8000, 0x0001, 0x0001,
+ US_SC_DEVICE, US_PR_DEVICE, NULL,
+ US_FL_FIX_CAPACITY ),
+
++/* Reported by Daniel Kukula <daniel.kuku@gmail.com> */
++UNUSUAL_DEV( 0x067b, 0x1063, 0x0100, 0x0100,
++ "Prolific Technology, Inc.",
++ "Prolific Storage Gadget",
++ US_SC_DEVICE, US_PR_DEVICE, NULL,
++ US_FL_BAD_SENSE ),
++
+ /* Reported by Rogerio Brito <rbrito@ime.usp.br> */
+ UNUSUAL_DEV( 0x067b, 0x2317, 0x0001, 0x001,
+ "Prolific Technology, Inc.",
+diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
+index 1599d86..f5c0264 100644
+--- a/drivers/usb/storage/usb.c
++++ b/drivers/usb/storage/usb.c
+@@ -463,6 +463,9 @@ static void adjust_quirks(struct us_data *us)
+ case 'a':
+ f |= US_FL_SANE_SENSE;
+ break;
++ case 'b':
++ f |= US_FL_BAD_SENSE;
++ break;
+ case 'c':
+ f |= US_FL_FIX_CAPACITY;
+ break;
+diff --git a/include/linux/usb_usual.h b/include/linux/usb_usual.h
+index 3d15fb9..a4b947e 100644
+--- a/include/linux/usb_usual.h
++++ b/include/linux/usb_usual.h
+@@ -56,7 +56,9 @@
+ US_FLAG(SANE_SENSE, 0x00008000) \
+ /* Sane Sense (> 18 bytes) */ \
+ US_FLAG(CAPACITY_OK, 0x00010000) \
+- /* READ CAPACITY response is correct */
++ /* READ CAPACITY response is correct */ \
++ US_FLAG(BAD_SENSE, 0x00020000) \
++ /* Bad Sense (never more than 18 bytes) */
+
+ #define US_FLAG(name, value) US_FL_##name = value ,
+ enum { US_DO_ALL_FLAGS };
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:49 2009
+Message-Id: <20091217035649.777133501@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:50 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Russ Dill <Russ.Dill@gmail.com>
+Subject: [053/151] USB: Close usb_find_interface race v3
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Russ Dill <Russ.Dill@gmail.com>
+
+commit c2d284ee04ab6f6718de2ddcf1b43160e046c41d upstream.
+
+USB drivers that create character devices call usb_register_dev in their
+probe function. This associates the usb_interface device with that minor
+number and creates the character device and announces it to the world.
+However, the driver's probe function is called before the new
+usb_interface is added to the driver's klist_devices.
+
+This is a problem because userspace will respond to the character device
+creation announcement by opening the character device. The driver's open
+function will the call usb_find_interface to find the usb_interface
+associated with that minor number. usb_find_interface will walk the
+driver's list of devices and find the usb_interface with the matching
+minor number.
+
+Because the announcement happens before the usb_interface is added to the
+driver's klist_devices, a race condition exists. A straightforward fix
+is to walk the list of devices on usb_bus_type instead since the device
+is added to that list before the announcement occurs.
+
+bus_find_device calls get_device to bump the reference count on the found
+device. It is arguable that the reference count should be dropped by the
+caller of usb_find_interface instead of usb_find_interface, however,
+the current users of usb_find_interface do not expect this.
+
+The original version of this patch only matched against minor number
+instead of driver and minor number. This version matches against both.
+
+Signed-off-by: Russ Dill <Russ.Dill@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/usb.c | 31 ++++++++++++++++---------------
+ 1 file changed, 16 insertions(+), 15 deletions(-)
+
+--- a/drivers/usb/core/usb.c
++++ b/drivers/usb/core/usb.c
+@@ -132,7 +132,7 @@ EXPORT_SYMBOL_GPL(usb_altnum_to_altsetti
+
+ struct find_interface_arg {
+ int minor;
+- struct usb_interface *interface;
++ struct device_driver *drv;
+ };
+
+ static int __find_interface(struct device *dev, void *data)
+@@ -143,12 +143,10 @@ static int __find_interface(struct devic
+ if (!is_usb_interface(dev))
+ return 0;
+
++ if (dev->driver != arg->drv)
++ return 0;
+ intf = to_usb_interface(dev);
+- if (intf->minor != -1 && intf->minor == arg->minor) {
+- arg->interface = intf;
+- return 1;
+- }
+- return 0;
++ return intf->minor == arg->minor;
+ }
+
+ /**
+@@ -156,21 +154,24 @@ static int __find_interface(struct devic
+ * @drv: the driver whose current configuration is considered
+ * @minor: the minor number of the desired device
+ *
+- * This walks the driver device list and returns a pointer to the interface
+- * with the matching minor. Note, this only works for devices that share the
+- * USB major number.
++ * This walks the bus device list and returns a pointer to the interface
++ * with the matching minor and driver. Note, this only works for devices
++ * that share the USB major number.
+ */
+ struct usb_interface *usb_find_interface(struct usb_driver *drv, int minor)
+ {
+ struct find_interface_arg argb;
+- int retval;
++ struct device *dev;
+
+ argb.minor = minor;
+- argb.interface = NULL;
+- /* eat the error, it will be in argb.interface */
+- retval = driver_for_each_device(&drv->drvwrap.driver, NULL, &argb,
+- __find_interface);
+- return argb.interface;
++ argb.drv = &drv->drvwrap.driver;
++
++ dev = bus_find_device(&usb_bus_type, NULL, &argb, __find_interface);
++
++ /* Drop reference count from bus_find_device */
++ put_device(dev);
++
++ return dev ? to_usb_interface(dev) : NULL;
+ }
+ EXPORT_SYMBOL_GPL(usb_find_interface);
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:50 2009
+Message-Id: <20091217035649.905521468@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:51 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Igor Grinberg <grinberg@compulab.co.il>,
+ Mike Rapoport <mike@compulab.co.il>,
+ Eric Miao <eric.y.miao@gmail.com>
+Subject: [054/151] [ARM] pxa/em-x270: fix usb hub power up/reset sequence
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Igor Grinberg <grinberg@compulab.co.il>
+
+commit 1b82e4c32fba96d8805b1e2126ba5382e56fac32 upstream.
+
+Signed-off-by: Igor Grinberg <grinberg@compulab.co.il>
+Signed-off-by: Mike Rapoport <mike@compulab.co.il>
+Signed-off-by: Eric Miao <eric.y.miao@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/mach-pxa/em-x270.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/arch/arm/mach-pxa/em-x270.c
++++ b/arch/arm/mach-pxa/em-x270.c
+@@ -497,16 +497,15 @@ static int em_x270_usb_hub_init(void)
+ goto err_free_vbus_gpio;
+
+ /* USB Hub power-on and reset */
+- gpio_direction_output(usb_hub_reset, 0);
++ gpio_direction_output(usb_hub_reset, 1);
++ gpio_direction_output(GPIO9_USB_VBUS_EN, 0);
+ regulator_enable(em_x270_usb_ldo);
+- gpio_set_value(usb_hub_reset, 1);
+ gpio_set_value(usb_hub_reset, 0);
++ gpio_set_value(usb_hub_reset, 1);
+ regulator_disable(em_x270_usb_ldo);
+ regulator_enable(em_x270_usb_ldo);
+- gpio_set_value(usb_hub_reset, 1);
+-
+- /* enable VBUS */
+- gpio_direction_output(GPIO9_USB_VBUS_EN, 1);
++ gpio_set_value(usb_hub_reset, 0);
++ gpio_set_value(GPIO9_USB_VBUS_EN, 1);
+
+ return 0;
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:50 2009
+Message-Id: <20091217035650.041095298@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:52 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ WANG Cong <amwang@redhat.com>,
+ Eugene Teo <eteo@redhat.com>,
+ Roman Zippel <zippel@linux-m68k.org>,
+ Al Viro <viro@zeniv.linux.org.uk>,
+ Christoph Hellwig <hch@lst.de>,
+ Alexey Dobriyan <adobriyan@gmail.com>,
+ Dave Anderson <anderson@redhat.com>
+Subject: [055/151] hfs: fix a potential buffer overflow
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Amerigo Wang <amwang@redhat.com>
+
+commit ec81aecb29668ad71f699f4e7b96ec46691895b6 upstream.
+
+A specially-crafted Hierarchical File System (HFS) filesystem could cause
+a buffer overflow to occur in a process's kernel stack during a memcpy()
+call within the hfs_bnode_read() function (at fs/hfs/bnode.c:24). The
+attacker can provide the source buffer and length, and the destination
+buffer is a local variable of a fixed length. This local variable (passed
+as "&entry" from fs/hfs/dir.c:112 and allocated on line 60) is stored in
+the stack frame of hfs_bnode_read()'s caller, which is hfs_readdir().
+Because the hfs_readdir() function executes upon any attempt to read a
+directory on the filesystem, it gets called whenever a user attempts to
+inspect any filesystem contents.
+
+[amwang@redhat.com: modify this patch and fix coding style problems]
+Signed-off-by: WANG Cong <amwang@redhat.com>
+Cc: Eugene Teo <eteo@redhat.com>
+Cc: Roman Zippel <zippel@linux-m68k.org>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Cc: Dave Anderson <anderson@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/hfs/catalog.c | 4 ++++
+ fs/hfs/dir.c | 11 +++++++++++
+ fs/hfs/super.c | 7 ++++++-
+ 3 files changed, 21 insertions(+), 1 deletion(-)
+
+--- a/fs/hfs/catalog.c
++++ b/fs/hfs/catalog.c
+@@ -289,6 +289,10 @@ int hfs_cat_move(u32 cnid, struct inode
+ err = hfs_brec_find(&src_fd);
+ if (err)
+ goto out;
++ if (src_fd.entrylength > sizeof(entry) || src_fd.entrylength < 0) {
++ err = -EIO;
++ goto out;
++ }
+
+ hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset,
+ src_fd.entrylength);
+--- a/fs/hfs/dir.c
++++ b/fs/hfs/dir.c
+@@ -79,6 +79,11 @@ static int hfs_readdir(struct file *filp
+ filp->f_pos++;
+ /* fall through */
+ case 1:
++ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
++ err = -EIO;
++ goto out;
++ }
++
+ hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
+ if (entry.type != HFS_CDR_THD) {
+ printk(KERN_ERR "hfs: bad catalog folder thread\n");
+@@ -109,6 +114,12 @@ static int hfs_readdir(struct file *filp
+ err = -EIO;
+ goto out;
+ }
++
++ if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
++ err = -EIO;
++ goto out;
++ }
++
+ hfs_bnode_read(fd.bnode, &entry, fd.entryoffset, fd.entrylength);
+ type = entry.type;
+ len = hfs_mac2asc(sb, strbuf, &fd.key->cat.CName);
+--- a/fs/hfs/super.c
++++ b/fs/hfs/super.c
+@@ -409,8 +409,13 @@ static int hfs_fill_super(struct super_b
+ /* try to get the root inode */
+ hfs_find_init(HFS_SB(sb)->cat_tree, &fd);
+ res = hfs_cat_find_brec(sb, HFS_ROOT_CNID, &fd);
+- if (!res)
++ if (!res) {
++ if (fd.entrylength > sizeof(rec) || fd.entrylength < 0) {
++ res = -EIO;
++ goto bail;
++ }
+ hfs_bnode_read(fd.bnode, &rec, fd.entryoffset, fd.entrylength);
++ }
+ if (res) {
+ hfs_find_exit(&fd);
+ goto bail_no_root;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:50 2009
+Message-Id: <20091217035650.161652420@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:53 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Roel Kluin <roel.kluin@gmail.com>,
+ Trond Myklebust <Trond.Myklebust@netapp.com>
+Subject: [056/151] SUNRPC: IS_ERR/PTR_ERR confusion
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Roel Kluin <roel.kluin@gmail.com>
+
+commit 480e3243df156e39eea6c91057e2ae612a6bbe19 upstream.
+
+IS_ERR returns 1 or 0, PTR_ERR returns the error value.
+
+Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/auth_gss/auth_gss.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sunrpc/auth_gss/auth_gss.c
++++ b/net/sunrpc/auth_gss/auth_gss.c
+@@ -485,7 +485,7 @@ gss_refresh_upcall(struct rpc_task *task
+ dprintk("RPC: %5u gss_refresh_upcall for uid %u\n", task->tk_pid,
+ cred->cr_uid);
+ gss_msg = gss_setup_upcall(task->tk_client, gss_auth, cred);
+- if (IS_ERR(gss_msg) == -EAGAIN) {
++ if (PTR_ERR(gss_msg) == -EAGAIN) {
+ /* XXX: warning on the first, under the assumption we
+ * shouldn't normally hit this case on a refresh. */
+ warn_gssd();
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:50 2009
+Message-Id: <20091217035650.285311596@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:54 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Trond Myklebust <Trond.Myklebust@netapp.com>
+Subject: [057/151] NFS: Fix nfs_migrate_page()
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit 190f38e5cedc910940b1da9015f00458c18f97b4 upstream.
+
+The call to migrate_page() will cause the page->private field to be
+cleared.
+Also fix up the locking around the page->private transfer, so that we ensure
+that calls to nfs_page_find_request() don't end up racing.
+
+Finally, fix up a double free bug: nfs_unlock_request() already calls
+nfs_release_request() for us...
+
+Reported-by: Wu Fengguang <fengguang.wu@intel.com>
+Tested-by: Andi Kleen <andi@firstfloor.org>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/write.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -1612,15 +1612,16 @@ int nfs_migrate_page(struct address_spac
+ if (ret)
+ goto out_unlock;
+ page_cache_get(newpage);
++ spin_lock(&mapping->host->i_lock);
+ req->wb_page = newpage;
+ SetPagePrivate(newpage);
+- set_page_private(newpage, page_private(page));
++ set_page_private(newpage, (unsigned long)req);
+ ClearPagePrivate(page);
+ set_page_private(page, 0);
++ spin_unlock(&mapping->host->i_lock);
+ page_cache_release(page);
+ out_unlock:
+ nfs_clear_page_tag_locked(req);
+- nfs_release_request(req);
+ out:
+ return ret;
+ }
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:50 2009
+Message-Id: <20091217035650.415039321@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:55 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ NeilBrown <neilb@suse.de>
+Subject: [058/151] md/bitmap: protect against bitmap removal while being updated.
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: NeilBrown <neilb@suse.de>
+
+commit aa5cbd103887011b4830355f88fb055f9ad2d556 upstream.
+
+A write intent bitmap can be removed from an array while the
+array is active.
+When this happens, all IO is suspended and flushed before the
+bitmap is removed.
+However it is possible that bitmap_daemon_work is still running to
+clear old bits from the bitmap. If it is, it can dereference the
+bitmap after it has been freed.
+
+So introduce a new mutex to protect bitmap_daemon_work and get it
+before destroying a bitmap.
+
+This is suitable for any current -stable kernel.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/bitmap.c | 24 ++++++++++++++++++------
+ drivers/md/bitmap.h | 2 +-
+ drivers/md/md.c | 3 ++-
+ drivers/md/md.h | 1 +
+ 4 files changed, 22 insertions(+), 8 deletions(-)
+
+--- a/drivers/md/bitmap.c
++++ b/drivers/md/bitmap.c
+@@ -1078,23 +1078,31 @@ static bitmap_counter_t *bitmap_get_coun
+ * out to disk
+ */
+
+-void bitmap_daemon_work(struct bitmap *bitmap)
++void bitmap_daemon_work(mddev_t *mddev)
+ {
++ struct bitmap *bitmap;
+ unsigned long j;
+ unsigned long flags;
+ struct page *page = NULL, *lastpage = NULL;
+ int blocks;
+ void *paddr;
+
+- if (bitmap == NULL)
++ /* Use a mutex to guard daemon_work against
++ * bitmap_destroy.
++ */
++ mutex_lock(&mddev->bitmap_mutex);
++ bitmap = mddev->bitmap;
++ if (bitmap == NULL) {
++ mutex_unlock(&mddev->bitmap_mutex);
+ return;
++ }
+ if (time_before(jiffies, bitmap->daemon_lastrun + bitmap->daemon_sleep*HZ))
+ goto done;
+
+ bitmap->daemon_lastrun = jiffies;
+ if (bitmap->allclean) {
+ bitmap->mddev->thread->timeout = MAX_SCHEDULE_TIMEOUT;
+- return;
++ goto done;
+ }
+ bitmap->allclean = 1;
+
+@@ -1203,6 +1211,7 @@ void bitmap_daemon_work(struct bitmap *b
+ done:
+ if (bitmap->allclean == 0)
+ bitmap->mddev->thread->timeout = bitmap->daemon_sleep * HZ;
++ mutex_unlock(&mddev->bitmap_mutex);
+ }
+
+ static bitmap_counter_t *bitmap_get_counter(struct bitmap *bitmap,
+@@ -1541,9 +1550,9 @@ void bitmap_flush(mddev_t *mddev)
+ */
+ sleep = bitmap->daemon_sleep;
+ bitmap->daemon_sleep = 0;
+- bitmap_daemon_work(bitmap);
+- bitmap_daemon_work(bitmap);
+- bitmap_daemon_work(bitmap);
++ bitmap_daemon_work(mddev);
++ bitmap_daemon_work(mddev);
++ bitmap_daemon_work(mddev);
+ bitmap->daemon_sleep = sleep;
+ bitmap_update_sb(bitmap);
+ }
+@@ -1574,6 +1583,7 @@ static void bitmap_free(struct bitmap *b
+ kfree(bp);
+ kfree(bitmap);
+ }
++
+ void bitmap_destroy(mddev_t *mddev)
+ {
+ struct bitmap *bitmap = mddev->bitmap;
+@@ -1581,7 +1591,9 @@ void bitmap_destroy(mddev_t *mddev)
+ if (!bitmap) /* there was no bitmap */
+ return;
+
++ mutex_lock(&mddev->bitmap_mutex);
+ mddev->bitmap = NULL; /* disconnect from the md device */
++ mutex_unlock(&mddev->bitmap_mutex);
+ if (mddev->thread)
+ mddev->thread->timeout = MAX_SCHEDULE_TIMEOUT;
+
+--- a/drivers/md/bitmap.h
++++ b/drivers/md/bitmap.h
+@@ -282,7 +282,7 @@ void bitmap_close_sync(struct bitmap *bi
+ void bitmap_cond_end_sync(struct bitmap *bitmap, sector_t sector);
+
+ void bitmap_unplug(struct bitmap *bitmap);
+-void bitmap_daemon_work(struct bitmap *bitmap);
++void bitmap_daemon_work(mddev_t *mddev);
+ #endif
+
+ #endif
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -367,6 +367,7 @@ static mddev_t * mddev_find(dev_t unit)
+
+ mutex_init(&new->open_mutex);
+ mutex_init(&new->reconfig_mutex);
++ mutex_init(&new->bitmap_mutex);
+ INIT_LIST_HEAD(&new->disks);
+ INIT_LIST_HEAD(&new->all_mddevs);
+ init_timer(&new->safemode_timer);
+@@ -6629,7 +6630,7 @@ void md_check_recovery(mddev_t *mddev)
+
+
+ if (mddev->bitmap)
+- bitmap_daemon_work(mddev->bitmap);
++ bitmap_daemon_work(mddev);
+
+ if (mddev->ro)
+ return;
+--- a/drivers/md/md.h
++++ b/drivers/md/md.h
+@@ -289,6 +289,7 @@ struct mddev_s
+ * hot-adding a bitmap. It should
+ * eventually be settable by sysfs.
+ */
++ struct mutex bitmap_mutex;
+
+ struct list_head all_mddevs;
+ };
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:50 2009
+Message-Id: <20091217035650.540334382@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:56 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andi Kleen <ak@linux.intel.com>,
+ Andrew Morton <akpm@linuxfoundation.org>,
+ Nick Piggin <npiggin@suse.de>,
+ Darren Hart <dvhltc@us.ibm.com>,
+ Peter Zijlstra <peterz@infradead.org>,
+ Thomas Gleixner <tglx@linutronix.de>
+Subject: [059/151] futex: Take mmap_sem for get_user_pages in fault_in_user_writeable
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Andi Kleen <andi@firstfloor.org>
+
+commit 722d0172377a5697919b9f7e5beb95165b1dec4e upstream.
+
+get_user_pages() must be called with mmap_sem held.
+
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+Cc: Andrew Morton <akpm@linuxfoundation.org>
+Cc: Nick Piggin <npiggin@suse.de>
+Cc: Darren Hart <dvhltc@us.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+LKML-Reference: <20091208121942.GA21298@basil.fritz.box>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/futex.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -304,8 +304,14 @@ void put_futex_key(int fshared, union fu
+ */
+ static int fault_in_user_writeable(u32 __user *uaddr)
+ {
+- int ret = get_user_pages(current, current->mm, (unsigned long)uaddr,
+- 1, 1, 0, NULL, NULL);
++ struct mm_struct *mm = current->mm;
++ int ret;
++
++ down_read(&mm->mmap_sem);
++ ret = get_user_pages(current, mm, (unsigned long)uaddr,
++ 1, 1, 0, NULL, NULL);
++ up_read(&mm->mmap_sem);
++
+ return ret < 0 ? ret : 0;
+ }
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:50 2009
+Message-Id: <20091217035650.668559199@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:57 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
+Subject: [060/151] devpts_get_tty() should validate inode
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
+
+commit edfacdd6f81119b9005615593f2cbd94b8c7e2d8 upstream.
+
+devpts_get_tty() assumes that the inode passed in is associated with a valid
+pty. But if the only reference to the pty is via a bind-mount, the inode
+passed to devpts_get_tty() while valid, would refer to a pty that no longer
+exists.
+
+With a lot of debug effort, Grzegorz Nosek developed a small program (see
+below) to reproduce a crash on recent kernels. This crash is a regression
+introduced by the commit:
+
+ commit 527b3e4773628b30d03323a2cb5fb0d84441990f
+ Author: Sukadev Bhattiprolu <sukadev@us.ibm.com>
+ Date: Mon Oct 13 10:43:08 2008 +0100
+
+To fix, ensure that the dentry associated with the inode has not yet been
+deleted/unhashed by devpts_pty_kill().
+
+See also:
+https://lists.linux-foundation.org/pipermail/containers/2009-July/019273.html
+
+tty-bug.c:
+
+#define _GNU_SOURCE
+#include <fcntl.h>
+#include <sched.h>
+#include <stdlib.h>
+#include <sys/mount.h>
+#include <sys/signal.h>
+#include <unistd.h>
+#include <stdio.h>
+
+#include <linux/fs.h>
+
+void dummy(int sig)
+{
+}
+
+static int child(void *unused)
+{
+ int fd;
+
+ signal(SIGINT, dummy); signal(SIGHUP, dummy);
+ pause(); /* cheesy synchronisation to wait for /dev/pts/0 to appear */
+
+ mount("/dev/pts/0", "/dev/console", NULL, MS_BIND, NULL);
+ sleep(2);
+
+ fd = open("/dev/console", O_RDWR);
+ dup(0); dup(0);
+ write(1, "Hello world!\n", sizeof("Hello world!\n")-1);
+ return 0;
+}
+
+int main(void)
+{
+ pid_t pid;
+ char *stack;
+
+ stack = malloc(16384);
+ pid = clone(child, stack+16384, CLONE_NEWNS|SIGCHLD, NULL);
+
+ open("/dev/ptmx", O_RDWR|O_NOCTTY|O_NONBLOCK);
+
+ unlockpt(fd); grantpt(fd);
+
+ sleep(2);
+ kill(pid, SIGHUP);
+ sleep(1);
+ return 0; /* exit before child opens /dev/console */
+}
+
+Reported-by: Grzegorz Nosek <root@localdomain.pl>
+Signed-off-by: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
+Tested-by: Serge Hallyn <serue@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/devpts/inode.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+--- a/fs/devpts/inode.c
++++ b/fs/devpts/inode.c
+@@ -517,11 +517,23 @@ int devpts_pty_new(struct inode *ptmx_in
+
+ struct tty_struct *devpts_get_tty(struct inode *pts_inode, int number)
+ {
++ struct dentry *dentry;
++ struct tty_struct *tty;
++
+ BUG_ON(pts_inode->i_rdev == MKDEV(TTYAUX_MAJOR, PTMX_MINOR));
+
++ /* Ensure dentry has not been deleted by devpts_pty_kill() */
++ dentry = d_find_alias(pts_inode);
++ if (!dentry)
++ return NULL;
++
++ tty = NULL;
+ if (pts_inode->i_sb->s_magic == DEVPTS_SUPER_MAGIC)
+- return (struct tty_struct *)pts_inode->i_private;
+- return NULL;
++ tty = (struct tty_struct *)pts_inode->i_private;
++
++ dput(dentry);
++
++ return tty;
+ }
+
+ void devpts_pty_kill(struct tty_struct *tty)
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:50 2009
+Message-Id: <20091217035650.799599096@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:58 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca>
+Subject: [061/151] debugfs: fix create mutex racy fops and private data
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca>
+
+commit d3a3b0adad0865c12e39b712ca89efbd0a3a0dbc upstream.
+
+Setting fops and private data outside of the mutex at debugfs file
+creation introduces a race where the files can be opened with the wrong
+file operations and private data. It is easy to trigger with a process
+waiting on file creation notification.
+
+Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/debugfs/inode.c | 55 ++++++++++++++++++++++++++++++-----------------------
+ 1 file changed, 32 insertions(+), 23 deletions(-)
+
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -32,7 +32,9 @@ static struct vfsmount *debugfs_mount;
+ static int debugfs_mount_count;
+ static bool debugfs_registered;
+
+-static struct inode *debugfs_get_inode(struct super_block *sb, int mode, dev_t dev)
++static struct inode *debugfs_get_inode(struct super_block *sb, int mode, dev_t dev,
++ void *data, const struct file_operations *fops)
++
+ {
+ struct inode *inode = new_inode(sb);
+
+@@ -44,14 +46,18 @@ static struct inode *debugfs_get_inode(s
+ init_special_inode(inode, mode, dev);
+ break;
+ case S_IFREG:
+- inode->i_fop = &debugfs_file_operations;
++ inode->i_fop = fops ? fops : &debugfs_file_operations;
++ inode->i_private = data;
+ break;
+ case S_IFLNK:
+ inode->i_op = &debugfs_link_operations;
++ inode->i_fop = fops;
++ inode->i_private = data;
+ break;
+ case S_IFDIR:
+ inode->i_op = &simple_dir_inode_operations;
+- inode->i_fop = &simple_dir_operations;
++ inode->i_fop = fops ? fops : &simple_dir_operations;
++ inode->i_private = data;
+
+ /* directory inodes start off with i_nlink == 2
+ * (for "." entry) */
+@@ -64,7 +70,8 @@ static struct inode *debugfs_get_inode(s
+
+ /* SMP-safe */
+ static int debugfs_mknod(struct inode *dir, struct dentry *dentry,
+- int mode, dev_t dev)
++ int mode, dev_t dev, void *data,
++ const struct file_operations *fops)
+ {
+ struct inode *inode;
+ int error = -EPERM;
+@@ -72,7 +79,7 @@ static int debugfs_mknod(struct inode *d
+ if (dentry->d_inode)
+ return -EEXIST;
+
+- inode = debugfs_get_inode(dir->i_sb, mode, dev);
++ inode = debugfs_get_inode(dir->i_sb, mode, dev, data, fops);
+ if (inode) {
+ d_instantiate(dentry, inode);
+ dget(dentry);
+@@ -81,12 +88,13 @@ static int debugfs_mknod(struct inode *d
+ return error;
+ }
+
+-static int debugfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
++static int debugfs_mkdir(struct inode *dir, struct dentry *dentry, int mode,
++ void *data, const struct file_operations *fops)
+ {
+ int res;
+
+ mode = (mode & (S_IRWXUGO | S_ISVTX)) | S_IFDIR;
+- res = debugfs_mknod(dir, dentry, mode, 0);
++ res = debugfs_mknod(dir, dentry, mode, 0, data, fops);
+ if (!res) {
+ inc_nlink(dir);
+ fsnotify_mkdir(dir, dentry);
+@@ -94,18 +102,20 @@ static int debugfs_mkdir(struct inode *d
+ return res;
+ }
+
+-static int debugfs_link(struct inode *dir, struct dentry *dentry, int mode)
++static int debugfs_link(struct inode *dir, struct dentry *dentry, int mode,
++ void *data, const struct file_operations *fops)
+ {
+ mode = (mode & S_IALLUGO) | S_IFLNK;
+- return debugfs_mknod(dir, dentry, mode, 0);
++ return debugfs_mknod(dir, dentry, mode, 0, data, fops);
+ }
+
+-static int debugfs_create(struct inode *dir, struct dentry *dentry, int mode)
++static int debugfs_create(struct inode *dir, struct dentry *dentry, int mode,
++ void *data, const struct file_operations *fops)
+ {
+ int res;
+
+ mode = (mode & S_IALLUGO) | S_IFREG;
+- res = debugfs_mknod(dir, dentry, mode, 0);
++ res = debugfs_mknod(dir, dentry, mode, 0, data, fops);
+ if (!res)
+ fsnotify_create(dir, dentry);
+ return res;
+@@ -139,7 +149,9 @@ static struct file_system_type debug_fs_
+
+ static int debugfs_create_by_name(const char *name, mode_t mode,
+ struct dentry *parent,
+- struct dentry **dentry)
++ struct dentry **dentry,
++ void *data,
++ const struct file_operations *fops)
+ {
+ int error = 0;
+
+@@ -164,13 +176,16 @@ static int debugfs_create_by_name(const
+ if (!IS_ERR(*dentry)) {
+ switch (mode & S_IFMT) {
+ case S_IFDIR:
+- error = debugfs_mkdir(parent->d_inode, *dentry, mode);
++ error = debugfs_mkdir(parent->d_inode, *dentry, mode,
++ data, fops);
+ break;
+ case S_IFLNK:
+- error = debugfs_link(parent->d_inode, *dentry, mode);
++ error = debugfs_link(parent->d_inode, *dentry, mode,
++ data, fops);
+ break;
+ default:
+- error = debugfs_create(parent->d_inode, *dentry, mode);
++ error = debugfs_create(parent->d_inode, *dentry, mode,
++ data, fops);
+ break;
+ }
+ dput(*dentry);
+@@ -221,19 +236,13 @@ struct dentry *debugfs_create_file(const
+ if (error)
+ goto exit;
+
+- error = debugfs_create_by_name(name, mode, parent, &dentry);
++ error = debugfs_create_by_name(name, mode, parent, &dentry,
++ data, fops);
+ if (error) {
+ dentry = NULL;
+ simple_release_fs(&debugfs_mount, &debugfs_mount_count);
+ goto exit;
+ }
+-
+- if (dentry->d_inode) {
+- if (data)
+- dentry->d_inode->i_private = data;
+- if (fops)
+- dentry->d_inode->i_fop = fops;
+- }
+ exit:
+ return dentry;
+ }
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:51 2009
+Message-Id: <20091217035650.926077960@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:55:59 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Stern <stern@rowland.harvard.edu>,
+ Oliver Neukum <oliver@neukum.org>
+Subject: [062/151] Driver core: fix race in dev_driver_string
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 3589972e51fac1e02d0aaa576fa47f568cb94d40 upstream.
+
+This patch (as1310) works around a race in dev_driver_string(). If
+the device is unbound while the function is running, dev->driver might
+become NULL after we test it and before we dereference it.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Cc: Oliver Neukum <oliver@neukum.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/base/core.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -56,7 +56,14 @@ static inline int device_is_not_partitio
+ */
+ const char *dev_driver_string(const struct device *dev)
+ {
+- return dev->driver ? dev->driver->name :
++ struct device_driver *drv;
++
++ /* dev->driver can change to NULL underneath us because of unbinding,
++ * so be careful about accessing it. dev->bus and dev->class should
++ * never change once they are set, so they don't need special care.
++ */
++ drv = ACCESS_ONCE(dev->driver);
++ return drv ? drv->name :
+ (dev->bus ? dev->bus->name :
+ (dev->class ? dev->class->name : ""));
+ }
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:51 2009
+Message-Id: <20091217035651.053387583@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:00 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ian Jackson <ian.jackson@eu.citrix.com>,
+ Alan Cox <alan@linux.intel.com>
+Subject: [063/151] Serial: Do not read IIR in serial8250_start_tx when UART_BUG_TXEN
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ian Jackson <ian.jackson@eu.citrix.com>
+
+commit 68cb4f8e246bbbc649980be0628cae9265870a91 upstream.
+
+Do not read IIR in serial8250_start_tx when UART_BUG_TXEN
+
+Reading the IIR clears some oustanding interrupts so it is not safe.
+Instead, simply transmit immediately if the buffer is empty without
+regard to IIR.
+
+Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
+Reviewed-by: Markus Armbruster <armbru@redhat.com>
+Reviewed-by: Jiri Kosina <jkosina@suse.cz>
+Cc: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/serial/8250.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/drivers/serial/8250.c
++++ b/drivers/serial/8250.c
+@@ -1339,14 +1339,12 @@ static void serial8250_start_tx(struct u
+ serial_out(up, UART_IER, up->ier);
+
+ if (up->bugs & UART_BUG_TXEN) {
+- unsigned char lsr, iir;
++ unsigned char lsr;
+ lsr = serial_in(up, UART_LSR);
+ up->lsr_saved_flags |= lsr & LSR_SAVE_FLAGS;
+- iir = serial_in(up, UART_IIR) & 0x0f;
+ if ((up->port.type == PORT_RM9000) ?
+- (lsr & UART_LSR_THRE &&
+- (iir == UART_IIR_NO_INT || iir == UART_IIR_THRI)) :
+- (lsr & UART_LSR_TEMT && iir & UART_IIR_NO_INT))
++ (lsr & UART_LSR_THRE) :
++ (lsr & UART_LSR_TEMT))
+ transmit_chars(up);
+ }
+ }
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:51 2009
+Message-Id: <20091217035651.184091195@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:01 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Vasanthakumar Thiagarajan <vasanth@atheros.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [064/151] mac80211: Fix bug in computing crc over dynamic IEs in beacon
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Vasanthakumar Thiagarajan <vasanth@atheros.com>
+
+commit 1814077fd12a9cdf478c10076e9c42094e9d9250 upstream.
+
+On a 32-bit machine, BIT() macro does not give the required
+bit value if the bit is mroe than 31. In ieee802_11_parse_elems_crc(),
+BIT() is suppossed to get the bit value more than 31 (42 (id of ERP_INFO_IE),
+37 (CHANNEL_SWITCH_IE), (42), 32 (POWER_CONSTRAINT_IE), 45 (HT_CAP_IE),
+61 (HT_INFO_IE)). As we do not get the required bit value for the above
+IEs, crc over these IEs are never calculated, so any dynamic change in these
+IEs after the association is not really handled on 32-bit platforms.
+This patch fixes this issue.
+
+Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/util.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -579,7 +579,7 @@ u32 ieee802_11_parse_elems_crc(u8 *start
+ if (elen > left)
+ break;
+
+- if (calc_crc && id < 64 && (filter & BIT(id)))
++ if (calc_crc && id < 64 && (filter & (1ULL << id)))
+ crc = crc32_be(crc, pos - 2, elen + 2);
+
+ switch (id) {
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:51 2009
+Message-Id: <20091217035651.312420775@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:02 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Javier Cardona <javier@cozybit.com>,
+ Andrey Yurovsky <andrey@cozybit.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [065/151] mac80211: Fixed bug in mesh portal paths
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Javier Cardona <javier@cozybit.com>
+
+commit 5d618cb81aeea19879975cd1f9a1e707694dfd7c upstream.
+
+Paths to mesh portals were being timed out immediately after each use in
+intermediate forwarding nodes. mppath->exp_time is set to the expiration time
+so assigning it to jiffies was marking the path as expired.
+
+Signed-off-by: Javier Cardona <javier@cozybit.com>
+Signed-off-by: Andrey Yurovsky <andrey@cozybit.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/rx.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1514,7 +1514,6 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
+ mpp_path_add(mesh_hdr->eaddr2, hdr->addr4, sdata);
+ } else {
+ spin_lock_bh(&mppath->state_lock);
+- mppath->exp_time = jiffies;
+ if (compare_ether_addr(mppath->mpp, hdr->addr4) != 0)
+ memcpy(mppath->mpp, hdr->addr4, ETH_ALEN);
+ spin_unlock_bh(&mppath->state_lock);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:51 2009
+Message-Id: <20091217035651.439580867@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:03 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Javier Cardona <javier@cozybit.com>,
+ Andrey Yurovsky <andrey@cozybit.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [066/151] mac80211: Revert Use correct sign for mesh active path refresh
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Javier Cardona <javier@cozybit.com>
+
+commit 7b324d28a94dac5a451e8cba66e8d324601e5b9a upstream.
+
+The patch ("mac80211: Use correct sign for mesh active path
+refresh.") was actually a bug. Reverted it and improved the
+explanation of how mesh path refresh works.
+
+Signed-off-by: Javier Cardona <javier@cozybit.com>
+Signed-off-by: Andrey Yurovsky <andrey@cozybit.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/mesh.h | 5 +++--
+ net/mac80211/mesh_hwmp.c | 2 +-
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+--- a/net/mac80211/mesh.h
++++ b/net/mac80211/mesh.h
+@@ -186,8 +186,9 @@ struct mesh_rmc {
+ */
+ #define MESH_PREQ_MIN_INT 10
+ #define MESH_DIAM_TRAVERSAL_TIME 50
+-/* Paths will be refreshed if they are closer than PATH_REFRESH_TIME to their
+- * expiration
++/* A path will be refreshed if it is used PATH_REFRESH_TIME milliseconds before
++ * timing out. This way it will remain ACTIVE and no data frames will be
++ * unnecesarily held in the pending queue.
+ */
+ #define MESH_PATH_REFRESH_TIME 1000
+ #define MESH_MIN_DISCOVERY_TIMEOUT (2 * MESH_DIAM_TRAVERSAL_TIME)
+--- a/net/mac80211/mesh_hwmp.c
++++ b/net/mac80211/mesh_hwmp.c
+@@ -813,7 +813,7 @@ int mesh_nexthop_lookup(struct sk_buff *
+ }
+
+ if (mpath->flags & MESH_PATH_ACTIVE) {
+- if (time_after(jiffies, mpath->exp_time +
++ if (time_after(jiffies, mpath->exp_time -
+ msecs_to_jiffies(sdata->u.mesh.mshcfg.path_refresh_time))
+ && !memcmp(sdata->dev->dev_addr, hdr->addr4,
+ ETH_ALEN)
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:51 2009
+Message-Id: <20091217035651.568432019@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:04 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Johannes Berg <johannes@sipsolutions.net>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [067/151] mac80211: fix scan abort sanity checks
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Johannes Berg <johannes@sipsolutions.net>
+
+commit 6d3560d4fc9c5b9fe1a07a63926ea70512c69c32 upstream.
+
+Since sometimes mac80211 queues up a scan request
+to only act on it later, it must be allowed to
+(internally) cancel a not-yet-running scan, e.g.
+when the interface is taken down. This condition
+was missing since we always checked only the
+local->scanning variable which isn't yet set in
+that situation.
+
+Reported-by: Luis R. Rodriguez <mcgrof@gmail.com>
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/scan.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/net/mac80211/scan.c
++++ b/net/mac80211/scan.c
+@@ -264,10 +264,14 @@ void ieee80211_scan_completed(struct iee
+
+ mutex_lock(&local->scan_mtx);
+
+- if (WARN_ON(!local->scanning)) {
+- mutex_unlock(&local->scan_mtx);
+- return;
+- }
++ /*
++ * It's ok to abort a not-yet-running scan (that
++ * we have one at all will be verified by checking
++ * local->scan_req next), but not to complete it
++ * successfully.
++ */
++ if (WARN_ON(!local->scanning && !aborted))
++ aborted = true;
+
+ if (WARN_ON(!local->scan_req)) {
+ mutex_unlock(&local->scan_mtx);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:51 2009
+Message-Id: <20091217035651.697075324@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:05 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [068/151] wireless: correctly report signal value for IEEE80211_HW_SIGNAL_UNSPEC
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: John W. Linville <linville@tuxdriver.com>
+
+commit 19deffbeba930030cfaf000b920333c6ba99ad52 upstream.
+
+This part was missed in "cfg80211: implement get_wireless_stats",
+probably because sta_set_sinfo already existed and was only handling
+dBm signals.
+
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/cfg.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -338,7 +338,8 @@ static void sta_set_sinfo(struct sta_inf
+ sinfo->rx_packets = sta->rx_packets;
+ sinfo->tx_packets = sta->tx_packets;
+
+- if (sta->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
++ if ((sta->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) ||
++ (sta->local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)) {
+ sinfo->filled |= STATION_INFO_SIGNAL;
+ sinfo->signal = (s8)sta->last_signal;
+ }
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:51 2009
+Message-Id: <20091217035651.824658024@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:06 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Larry Finger <Larry.Finger@lwfinger.net>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [069/151] rtl8187: Fix wrong rfkill switch mask for some models
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 70d57139f932b9ca21026253d02af71cf53d764a upstream.
+
+There are different bits used to convey the setting of the rfkill
+switch to the driver. The current driver only supports one of these
+possibilities. These changes were derived from the latest version
+of the vendor driver.
+
+This patch fixes the regression noted in kernel Bugzilla #14743.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Reported-and-tested-by: Antti Kaijanmäki <antti@kaijanmaki.net>
+Tested-by: Hin-Tak Leung <hintak.leung@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/rtl818x/rtl8187.h | 5 +++++
+ drivers/net/wireless/rtl818x/rtl8187_dev.c | 12 ++++++++++--
+ drivers/net/wireless/rtl818x/rtl8187_rfkill.c | 4 ++--
+ 3 files changed, 17 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
++++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
+@@ -1329,6 +1329,7 @@ static int __devinit rtl8187_probe(struc
+ struct ieee80211_channel *channel;
+ const char *chip_name;
+ u16 txpwr, reg;
++ u16 product_id = le16_to_cpu(udev->descriptor.idProduct);
+ int err, i;
+
+ dev = ieee80211_alloc_hw(sizeof(*priv), &rtl8187_ops);
+@@ -1488,6 +1489,13 @@ static int __devinit rtl8187_probe(struc
+ (*channel++).hw_value = txpwr & 0xFF;
+ (*channel++).hw_value = txpwr >> 8;
+ }
++ /* Handle the differing rfkill GPIO bit in different models */
++ priv->rfkill_mask = RFKILL_MASK_8187_89_97;
++ if (product_id == 0x8197 || product_id == 0x8198) {
++ eeprom_93cx6_read(&eeprom, RTL8187_EEPROM_SELECT_GPIO, ®);
++ if (reg & 0xFF00)
++ priv->rfkill_mask = RFKILL_MASK_8198;
++ }
+
+ /*
+ * XXX: Once this driver supports anything that requires
+@@ -1516,9 +1524,9 @@ static int __devinit rtl8187_probe(struc
+ mutex_init(&priv->conf_mutex);
+ skb_queue_head_init(&priv->b_tx_status.queue);
+
+- printk(KERN_INFO "%s: hwaddr %pM, %s V%d + %s\n",
++ printk(KERN_INFO "%s: hwaddr %pM, %s V%d + %s, rfkill mask %d\n",
+ wiphy_name(dev->wiphy), dev->wiphy->perm_addr,
+- chip_name, priv->asic_rev, priv->rf->name);
++ chip_name, priv->asic_rev, priv->rf->name, priv->rfkill_mask);
+
+ #ifdef CONFIG_RTL8187_LEDS
+ eeprom_93cx6_read(&eeprom, 0x3F, ®);
+--- a/drivers/net/wireless/rtl818x/rtl8187.h
++++ b/drivers/net/wireless/rtl818x/rtl8187.h
+@@ -23,6 +23,7 @@
+ #define RTL8187_EEPROM_TXPWR_CHAN_1 0x16 /* 3 channels */
+ #define RTL8187_EEPROM_TXPWR_CHAN_6 0x1B /* 2 channels */
+ #define RTL8187_EEPROM_TXPWR_CHAN_4 0x3D /* 2 channels */
++#define RTL8187_EEPROM_SELECT_GPIO 0x3B
+
+ #define RTL8187_REQT_READ 0xC0
+ #define RTL8187_REQT_WRITE 0x40
+@@ -31,6 +32,9 @@
+
+ #define RTL8187_MAX_RX 0x9C4
+
++#define RFKILL_MASK_8187_89_97 0x2
++#define RFKILL_MASK_8198 0x4
++
+ struct rtl8187_rx_info {
+ struct urb *urb;
+ struct ieee80211_hw *dev;
+@@ -123,6 +127,7 @@ struct rtl8187_priv {
+ u8 noise;
+ u8 slot_time;
+ u8 aifsn[4];
++ u8 rfkill_mask;
+ struct {
+ __le64 buf;
+ struct sk_buff_head queue;
+--- a/drivers/net/wireless/rtl818x/rtl8187_rfkill.c
++++ b/drivers/net/wireless/rtl818x/rtl8187_rfkill.c
+@@ -25,10 +25,10 @@ static bool rtl8187_is_radio_enabled(str
+ u8 gpio;
+
+ gpio = rtl818x_ioread8(priv, &priv->map->GPIO0);
+- rtl818x_iowrite8(priv, &priv->map->GPIO0, gpio & ~0x02);
++ rtl818x_iowrite8(priv, &priv->map->GPIO0, gpio & ~priv->rfkill_mask);
+ gpio = rtl818x_ioread8(priv, &priv->map->GPIO1);
+
+- return gpio & 0x02;
++ return gpio & priv->rfkill_mask;
+ }
+
+ void rtl8187_rfkill_init(struct ieee80211_hw *hw)
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:52 2009
+Message-Id: <20091217035651.948970563@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:07 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Thomas Gleixner <tglx@linutronix.de>,
+ Cyrill Gorcunov <gorcunov@openvz.org>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [070/151] x86: Fix bogus warning in apic_noop.apic_write()
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit a946d8f11f0da9cfc714248036fcfd3a794d1e27 upstream.
+
+apic_noop is used to provide dummy apic functions. It's installed
+when the CPU has no APIC or when the APIC is disabled on the kernel
+command line.
+
+The apic_noop implementation of apic_write() warns when the CPU has
+an APIC or when the APIC is not disabled.
+
+That's bogus. The warning should only happen when the CPU has an
+APIC _AND_ the APIC is not disabled. apic_noop.apic_read() has the
+correct check.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Cyrill Gorcunov <gorcunov@openvz.org>
+LKML-Reference: <alpine.LFD.2.00.0912071255420.3089@localhost.localdomain>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/apic/apic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -246,7 +246,7 @@ static int modern_apic(void)
+ */
+ static void native_apic_write_dummy(u32 reg, u32 v)
+ {
+- WARN_ON_ONCE((cpu_has_apic || !disable_apic));
++ WARN_ON_ONCE(cpu_has_apic && !disable_apic);
+ }
+
+ static u32 native_apic_read_dummy(u32 reg)
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:52 2009
+Message-Id: <20091217035652.076973985@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:08 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>,
+ Andi Kleen <ak@linux.intel.com>,
+ Wu Fengguang <fengguang.wu@intel.com>,
+ Hugh Dickins <hugh.dickins@tiscali.co.uk>,
+ Mel Gorman <mel@csn.ul.ie>,
+ Lee Schermerhorn <lee.schermerhorn@hp.com>,
+ Andy Whitcroft <apw@canonical.com>,
+ David Rientjes <rientjes@google.com>
+Subject: [071/151] mm: hugetlb: fix hugepage memory leak in mincore()
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+
+commit 4f16fc107d9c9b8a72aa19b189a9216e90a7aaef upstream.
+
+Most callers of pmd_none_or_clear_bad() check whether the target page is
+in a hugepage or not, but mincore() and walk_page_range() do not check it.
+ So if we use mincore() on a hugepage on x86 machine, the hugepage memory
+is leaked as shown below. This patch fixes it by extending mincore()
+system call to support hugepages.
+
+Details
+=======
+My test program (leak_mincore) works as follows:
+ - creat() and mmap() a file on hugetlbfs (file size is 200MB == 100 hugepages,)
+ - read()/write() something on it,
+ - call mincore() for first ten pages and printf() the values of *vec
+ - munmap() and unlink() the file on hugetlbfs
+
+Without my patch
+----------------
+$ cat /proc/meminfo| grep "HugePage"
+HugePages_Total: 1000
+HugePages_Free: 1000
+HugePages_Rsvd: 0
+HugePages_Surp: 0
+$ ./leak_mincore
+vec[0] 0
+vec[1] 0
+vec[2] 0
+vec[3] 0
+vec[4] 0
+vec[5] 0
+vec[6] 0
+vec[7] 0
+vec[8] 0
+vec[9] 0
+$ cat /proc/meminfo |grep "HugePage"
+HugePages_Total: 1000
+HugePages_Free: 999
+HugePages_Rsvd: 0
+HugePages_Surp: 0
+$ ls /hugetlbfs/
+$
+
+Return values in *vec from mincore() are set to 0, while the hugepage
+should be in memory, and 1 hugepage is still accounted as used while
+there is no file on hugetlbfs.
+
+With my patch
+-------------
+$ cat /proc/meminfo| grep "HugePage"
+HugePages_Total: 1000
+HugePages_Free: 1000
+HugePages_Rsvd: 0
+HugePages_Surp: 0
+$ ./leak_mincore
+vec[0] 1
+vec[1] 1
+vec[2] 1
+vec[3] 1
+vec[4] 1
+vec[5] 1
+vec[6] 1
+vec[7] 1
+vec[8] 1
+vec[9] 1
+$ cat /proc/meminfo |grep "HugePage"
+HugePages_Total: 1000
+HugePages_Free: 1000
+HugePages_Rsvd: 0
+HugePages_Surp: 0
+$ ls /hugetlbfs/
+$
+
+Return value in *vec set to 1 and no memory leaks.
+
+[akpm@linux-foundation.org: cleanup]
+[akpm@linux-foundation.org: build fix]
+Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Wu Fengguang <fengguang.wu@intel.com>
+Cc: Hugh Dickins <hugh.dickins@tiscali.co.uk>
+Cc: Mel Gorman <mel@csn.ul.ie>
+Cc: Lee Schermerhorn <lee.schermerhorn@hp.com>
+Cc: Andy Whitcroft <apw@canonical.com>
+Cc: David Rientjes <rientjes@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+--- a/mm/mincore.c
++++ b/mm/mincore.c
+@@ -14,6 +14,7 @@
+ #include <linux/syscalls.h>
+ #include <linux/swap.h>
+ #include <linux/swapops.h>
++#include <linux/hugetlb.h>
+
+ #include <asm/uaccess.h>
+ #include <asm/pgtable.h>
+@@ -72,6 +73,42 @@ static long do_mincore(unsigned long addr, unsigned char *vec, unsigned long pag
+ if (!vma || addr < vma->vm_start)
+ return -ENOMEM;
+
++#ifdef CONFIG_HUGETLB_PAGE
++ if (is_vm_hugetlb_page(vma)) {
++ struct hstate *h;
++ unsigned long nr_huge;
++ unsigned char present;
++
++ i = 0;
++ nr = min(pages, (vma->vm_end - addr) >> PAGE_SHIFT);
++ h = hstate_vma(vma);
++ nr_huge = ((addr + pages * PAGE_SIZE - 1) >> huge_page_shift(h))
++ - (addr >> huge_page_shift(h)) + 1;
++ nr_huge = min(nr_huge,
++ (vma->vm_end - addr) >> huge_page_shift(h));
++ while (1) {
++ /* hugepage always in RAM for now,
++ * but generally it needs to be check */
++ ptep = huge_pte_offset(current->mm,
++ addr & huge_page_mask(h));
++ present = !!(ptep &&
++ !huge_pte_none(huge_ptep_get(ptep)));
++ while (1) {
++ vec[i++] = present;
++ addr += PAGE_SIZE;
++ /* reach buffer limit */
++ if (i == nr)
++ return nr;
++ /* check hugepage border */
++ if (!((addr & ~huge_page_mask(h))
++ >> PAGE_SHIFT))
++ break;
++ }
++ }
++ return nr;
++ }
++#endif
++
+ /*
+ * Calculate how many pages there are left in the last level of the
+ * PTE array for our address.
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:52 2009
+Message-Id: <20091217035652.216077157@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:09 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>,
+ Andi Kleen <ak@linux.intel.com>,
+ Wu Fengguang <fengguang.wu@intel.com>,
+ Hugh Dickins <hugh.dickins@tiscali.co.uk>,
+ Mel Gorman <mel@csn.ul.ie>,
+ Lee Schermerhorn <lee.schermerhorn@hp.com>,
+ Andy Whitcroft <apw@canonical.com>,
+ David Rientjes <rientjes@google.com>
+Subject: [072/151] mm: hugetlb: fix hugepage memory leak in walk_page_range()
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+
+commit d33b9f45bd24a6391bc05e2b5a13c1b5787ca9c2 upstream.
+
+Most callers of pmd_none_or_clear_bad() check whether the target page is
+in a hugepage or not, but walk_page_range() do not check it. So if we
+read /proc/pid/pagemap for the hugepage on x86 machine, the hugepage
+memory is leaked as shown below. This patch fixes it.
+
+Details
+=======
+My test program (leak_pagemap) works as follows:
+ - creat() and mmap() a file on hugetlbfs (file size is 200MB == 100 hugepages,)
+ - read()/write() something on it,
+ - call page-types with option -p (walk around the page tables),
+ - munmap() and unlink() the file on hugetlbfs
+
+Without my patches
+------------------
+$ cat /proc/meminfo |grep "HugePage"
+HugePages_Total: 1000
+HugePages_Free: 1000
+HugePages_Rsvd: 0
+HugePages_Surp: 0
+$ ./leak_pagemap
+[snip output]
+$ cat /proc/meminfo |grep "HugePage"
+HugePages_Total: 1000
+HugePages_Free: 900
+HugePages_Rsvd: 0
+HugePages_Surp: 0
+$ ls /hugetlbfs/
+$
+
+100 hugepages are accounted as used while there is no file on hugetlbfs.
+
+With my patches
+---------------
+$ cat /proc/meminfo |grep "HugePage"
+HugePages_Total: 1000
+HugePages_Free: 1000
+HugePages_Rsvd: 0
+HugePages_Surp: 0
+$ ./leak_pagemap
+[snip output]
+$ cat /proc/meminfo |grep "HugePage"
+HugePages_Total: 1000
+HugePages_Free: 1000
+HugePages_Rsvd: 0
+HugePages_Surp: 0
+$ ls /hugetlbfs
+$
+
+No memory leaks.
+
+Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Wu Fengguang <fengguang.wu@intel.com>
+Cc: Hugh Dickins <hugh.dickins@tiscali.co.uk>
+Cc: Mel Gorman <mel@csn.ul.ie>
+Cc: Lee Schermerhorn <lee.schermerhorn@hp.com>
+Cc: Andy Whitcroft <apw@canonical.com>
+Cc: David Rientjes <rientjes@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/pagewalk.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+--- a/mm/pagewalk.c
++++ b/mm/pagewalk.c
+@@ -1,6 +1,7 @@
+ #include <linux/mm.h>
+ #include <linux/highmem.h>
+ #include <linux/sched.h>
++#include <linux/hugetlb.h>
+
+ static int walk_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
+ struct mm_walk *walk)
+@@ -107,6 +108,7 @@ int walk_page_range(unsigned long addr,
+ pgd_t *pgd;
+ unsigned long next;
+ int err = 0;
++ struct vm_area_struct *vma;
+
+ if (addr >= end)
+ return err;
+@@ -117,11 +119,22 @@ int walk_page_range(unsigned long addr,
+ pgd = pgd_offset(walk->mm, addr);
+ do {
+ next = pgd_addr_end(addr, end);
++
++ /* skip hugetlb vma to avoid hugepage PMD being cleared
++ * in pmd_none_or_clear_bad(). */
++ vma = find_vma(walk->mm, addr);
++ if (vma && is_vm_hugetlb_page(vma)) {
++ if (vma->vm_end < next)
++ next = vma->vm_end;
++ continue;
++ }
++
+ if (pgd_none_or_clear_bad(pgd)) {
+ if (walk->pte_hole)
+ err = walk->pte_hole(addr, next, walk);
+ if (err)
+ break;
++ pgd++;
+ continue;
+ }
+ if (walk->pgd_entry)
+@@ -131,7 +144,8 @@ int walk_page_range(unsigned long addr,
+ err = walk_pud_range(pgd, addr, next, walk);
+ if (err)
+ break;
+- } while (pgd++, addr = next, addr != end);
++ pgd++;
++ } while (addr = next, addr != end);
+
+ return err;
+ }
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:52 2009
+Message-Id: <20091217035652.337874793@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:10 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Subject: [073/151] powerpc/windfarm: Add detection for second cpu pump
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Bolko Maass <krautilein@gmx.de>
+
+commit 529586dc39b0ec47c6290c4e7bed6ea3ffd1d8fb upstream.
+
+Windfarm SMU control is explicitly missing support for a second CPU pump in G5 PowerMacs. Such machines actually exist (specifically Quads with a second pump), so this patch adds detection for it.
+
+Signed-off by: Bolko Maass <bmaass@math.uni-bremen.de>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/macintosh/windfarm_smu_controls.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/macintosh/windfarm_smu_controls.c
++++ b/drivers/macintosh/windfarm_smu_controls.c
+@@ -202,6 +202,8 @@ static struct smu_fan_control *smu_fan_c
+ fct->ctrl.name = "cpu-front-fan-1";
+ else if (!strcmp(l, "CPU A PUMP"))
+ fct->ctrl.name = "cpu-pump-0";
++ else if (!strcmp(l, "CPU B PUMP"))
++ fct->ctrl.name = "cpu-pump-1";
+ else if (!strcmp(l, "Slots Fan") || !strcmp(l, "Slots fan") ||
+ !strcmp(l, "EXPANSION SLOTS INTAKE"))
+ fct->ctrl.name = "slots-fan";
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:52 2009
+Message-Id: <20091217035652.466792154@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:11 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Darrick J. Wong" <djwong@us.ibm.com>,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Subject: [074/151] powerpc/therm_adt746x: Record pwm invert bit at module load time]
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Darrick J. Wong <djwong@us.ibm.com>
+
+commit 1496e89ae2a0962748e55165a590fa3209c6f158 upstream.
+
+In commit 0512a9a8e277a9de2820211eef964473b714ae65, we unilaterally zero the
+"pwm invert" bit in the fan behavior configuration register. On my PowerBook
+G4, this results in the fans going to full speed at low temperature and
+shutting off at high temperature because the pwm invert bit is supposed to be
+set.
+
+Therefore, record the pwm invert bit at driver load time, and write the bit
+into the fan behavior control register. This restores correct behavior on my
+PBG4 and should work around the bit being set to the wrong value after
+suspend/resume (which is what the original patch was trying to fix). It also
+fixes a minor omission where the pwm invert bit correction is NOT performed
+when switching into automatic mode.
+
+Signed-off-by: Darrick J. Wong <djwong@us.ibm.com>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/macintosh/therm_adt746x.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/macintosh/therm_adt746x.c
++++ b/drivers/macintosh/therm_adt746x.c
+@@ -79,6 +79,7 @@ struct thermostat {
+ u8 limits[3];
+ int last_speed[2];
+ int last_var[2];
++ int pwm_inv[2];
+ };
+
+ static enum {ADT7460, ADT7467} therm_type;
+@@ -229,19 +230,23 @@ static void write_fan_speed(struct therm
+
+ if (speed >= 0) {
+ manual = read_reg(th, MANUAL_MODE[fan]);
++ manual &= ~INVERT_MASK;
+ write_reg(th, MANUAL_MODE[fan],
+- (manual|MANUAL_MASK) & (~INVERT_MASK));
++ manual | MANUAL_MASK | th->pwm_inv[fan]);
+ write_reg(th, FAN_SPD_SET[fan], speed);
+ } else {
+ /* back to automatic */
+ if(therm_type == ADT7460) {
+ manual = read_reg(th,
+ MANUAL_MODE[fan]) & (~MANUAL_MASK);
+-
++ manual &= ~INVERT_MASK;
++ manual |= th->pwm_inv[fan];
+ write_reg(th,
+ MANUAL_MODE[fan], manual|REM_CONTROL[fan]);
+ } else {
+ manual = read_reg(th, MANUAL_MODE[fan]);
++ manual &= ~INVERT_MASK;
++ manual |= th->pwm_inv[fan];
+ write_reg(th, MANUAL_MODE[fan], manual&(~AUTO_MASK));
+ }
+ }
+@@ -418,6 +423,10 @@ static int probe_thermostat(struct i2c_c
+
+ thermostat = th;
+
++ /* record invert bit status because fw can corrupt it after suspend */
++ th->pwm_inv[0] = read_reg(th, MANUAL_MODE[0]) & INVERT_MASK;
++ th->pwm_inv[1] = read_reg(th, MANUAL_MODE[1]) & INVERT_MASK;
++
+ /* be sure to really write fan speed the first time */
+ th->last_speed[0] = -2;
+ th->last_speed[1] = -2;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:52 2009
+Message-Id: <20091217035652.596312032@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:12 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Subject: [075/151] powerpc: Fix usage of 64-bit instruction in 32-bit altivec code
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+commit e090aa80321b64c3b793f3b047e31ecf1af9538d upstream.
+
+e821ea70f3b4873b50056a1e0f74befed1014c09 introduced a bug by copying
+some 64-bit originated code as-is to be used by both 32 and 64-bit
+but this code contains a 64-bit ony "cmpdi" instruction.
+
+This changes it to cmpwi, which is fine since VRSAVE can only contains
+a 32-bit value anyway.
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/kernel/vector.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/kernel/vector.S
++++ b/arch/powerpc/kernel/vector.S
+@@ -58,7 +58,7 @@ _GLOBAL(load_up_altivec)
+ * all 1's
+ */
+ mfspr r4,SPRN_VRSAVE
+- cmpdi 0,r4,0
++ cmpwi 0,r4,0
+ bne+ 1f
+ li r4,-1
+ mtspr SPRN_VRSAVE,r4
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:52 2009
+Message-Id: <20091217035652.724954569@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:13 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alex Deucher <alexdeucher@gmail.com>,
+ Dave Airlie <airlied@redhat.com>
+Subject: [076/151] drm/radeon/kms: Add quirk for HIS X1300 board
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit 4e3f9b78ff917cc5c833858fdb5d96bc262e0bf3 upstream.
+
+Board is DVI+VGA, not DVI+DVI
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_atombios.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_atombios.c
++++ b/drivers/gpu/drm/radeon/radeon_atombios.c
+@@ -135,6 +135,14 @@ static bool radeon_atom_apply_quirks(str
+ }
+ }
+
++ /* HIS X1300 is DVI+VGA, not DVI+DVI */
++ if ((dev->pdev->device == 0x7146) &&
++ (dev->pdev->subsystem_vendor == 0x17af) &&
++ (dev->pdev->subsystem_device == 0x2058)) {
++ if (supported_device == ATOM_DEVICE_DFP1_SUPPORT)
++ return false;
++ }
++
+ /* Funky macbooks */
+ if ((dev->pdev->device == 0x71C5) &&
+ (dev->pdev->subsystem_vendor == 0x106b) &&
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:52 2009
+Message-Id: <20091217035652.853830165@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:14 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alex Deucher <alexdeucher@gmail.com>,
+ Dave Airlie <airlied@redhat.com>
+Subject: [077/151] drm/radeon/kms: handle vblanks properly with dpms on
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit 500b758725314ab1b5316eb0caa5b0fa26740e6b upstream.
+
+avivo chips
+
+Copied from pre-avivo code.
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/atombios_crtc.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -241,6 +241,7 @@ void atombios_crtc_dpms(struct drm_crtc
+ {
+ struct drm_device *dev = crtc->dev;
+ struct radeon_device *rdev = dev->dev_private;
++ struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
+
+ switch (mode) {
+ case DRM_MODE_DPMS_ON:
+@@ -248,20 +249,19 @@ void atombios_crtc_dpms(struct drm_crtc
+ if (ASIC_IS_DCE3(rdev))
+ atombios_enable_crtc_memreq(crtc, 1);
+ atombios_blank_crtc(crtc, 0);
++ drm_vblank_post_modeset(dev, radeon_crtc->crtc_id);
++ radeon_crtc_load_lut(crtc);
+ break;
+ case DRM_MODE_DPMS_STANDBY:
+ case DRM_MODE_DPMS_SUSPEND:
+ case DRM_MODE_DPMS_OFF:
++ drm_vblank_pre_modeset(dev, radeon_crtc->crtc_id);
+ atombios_blank_crtc(crtc, 1);
+ if (ASIC_IS_DCE3(rdev))
+ atombios_enable_crtc_memreq(crtc, 0);
+ atombios_enable_crtc(crtc, 0);
+ break;
+ }
+-
+- if (mode != DRM_MODE_DPMS_OFF) {
+- radeon_crtc_load_lut(crtc);
+- }
+ }
+
+ static void
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:53 2009
+Message-Id: <20091217035652.985723727@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:15 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alex Deucher <alexdeucher@gmail.com>,
+ Dave Airlie <airlied@redhat.com>
+Subject: [078/151] drm/radeon/kms: fix legacy crtc2 dpms
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit 8de21525439e6b5bb8d8c81e49094d867bf82f6d upstream.
+
+noticed by Matthijs Kooijman on fdo bug 22140
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_legacy_crtc.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
++++ b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
+@@ -292,8 +292,7 @@ void radeon_crtc_dpms(struct drm_crtc *c
+ uint32_t mask;
+
+ if (radeon_crtc->crtc_id)
+- mask = (RADEON_CRTC2_EN |
+- RADEON_CRTC2_DISP_DIS |
++ mask = (RADEON_CRTC2_DISP_DIS |
+ RADEON_CRTC2_VSYNC_DIS |
+ RADEON_CRTC2_HSYNC_DIS |
+ RADEON_CRTC2_DISP_REQ_EN_B);
+@@ -305,7 +304,7 @@ void radeon_crtc_dpms(struct drm_crtc *c
+ switch (mode) {
+ case DRM_MODE_DPMS_ON:
+ if (radeon_crtc->crtc_id)
+- WREG32_P(RADEON_CRTC2_GEN_CNTL, RADEON_CRTC2_EN, ~mask);
++ WREG32_P(RADEON_CRTC2_GEN_CNTL, RADEON_CRTC2_EN, ~(RADEON_CRTC2_EN | mask));
+ else {
+ WREG32_P(RADEON_CRTC_GEN_CNTL, RADEON_CRTC_EN, ~(RADEON_CRTC_EN |
+ RADEON_CRTC_DISP_REQ_EN_B));
+@@ -319,7 +318,7 @@ void radeon_crtc_dpms(struct drm_crtc *c
+ case DRM_MODE_DPMS_OFF:
+ drm_vblank_pre_modeset(dev, radeon_crtc->crtc_id);
+ if (radeon_crtc->crtc_id)
+- WREG32_P(RADEON_CRTC2_GEN_CNTL, mask, ~mask);
++ WREG32_P(RADEON_CRTC2_GEN_CNTL, mask, ~(RADEON_CRTC2_EN | mask));
+ else {
+ WREG32_P(RADEON_CRTC_GEN_CNTL, RADEON_CRTC_DISP_REQ_EN_B, ~(RADEON_CRTC_EN |
+ RADEON_CRTC_DISP_REQ_EN_B));
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:53 2009
+Message-Id: <20091217035653.117673162@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:16 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alex Deucher <alexdeucher@gmail.com>,
+ Dave Airlie <airlied@redhat.com>
+Subject: [079/151] drm/radeon/kms: fix vram setup on rs600
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit 722f29434e72188b2d20f9b41f4b5952073ed568 upstream.
+
+also fix up rs690 mem width.
+
+should fix fdo bug 25408
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/rs600.c | 6 ++++++
+ drivers/gpu/drm/radeon/rs690.c | 10 ++--------
+ 2 files changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/rs600.c
++++ b/drivers/gpu/drm/radeon/rs600.c
+@@ -315,6 +315,12 @@ void rs600_vram_info(struct radeon_devic
+ /* FIXME: to do or is these values sane ? */
+ rdev->mc.vram_is_ddr = true;
+ rdev->mc.vram_width = 128;
++
++ rdev->mc.real_vram_size = RREG32(RADEON_CONFIG_MEMSIZE);
++ rdev->mc.mc_vram_size = rdev->mc.real_vram_size;
++
++ rdev->mc.aper_base = drm_get_resource_start(rdev->ddev, 0);
++ rdev->mc.aper_size = drm_get_resource_len(rdev->ddev, 0);
+ }
+
+ void rs600_bandwidth_update(struct radeon_device *rdev)
+--- a/drivers/gpu/drm/radeon/rs690.c
++++ b/drivers/gpu/drm/radeon/rs690.c
+@@ -131,19 +131,13 @@ void rs690_pm_info(struct radeon_device
+
+ void rs690_vram_info(struct radeon_device *rdev)
+ {
+- uint32_t tmp;
+ fixed20_12 a;
+
+ rs400_gart_adjust_size(rdev);
+ /* DDR for all card after R300 & IGP */
+ rdev->mc.vram_is_ddr = true;
+- /* FIXME: is this correct for RS690/RS740 ? */
+- tmp = RREG32(RADEON_MEM_CNTL);
+- if (tmp & R300_MEM_NUM_CHANNELS_MASK) {
+- rdev->mc.vram_width = 128;
+- } else {
+- rdev->mc.vram_width = 64;
+- }
++ rdev->mc.vram_width = 128;
++
+ rdev->mc.real_vram_size = RREG32(RADEON_CONFIG_MEMSIZE);
+ rdev->mc.mc_vram_size = rdev->mc.real_vram_size;
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:53 2009
+Message-Id: <20091217035653.247116914@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:17 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alex Deucher <alexdeucher@gmail.com>,
+ Dave Airlie <airlied@redhat.com>
+Subject: [080/151] drm/radeon/kms: rs6xx/rs740: clamp vram to aperture size
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit 0088dbdb809e8799cb8f26da5ac64b15201fa99d upstream.
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/rs600.c | 9 ++++++---
+ drivers/gpu/drm/radeon/rs690.c | 9 ++++++++-
+ 2 files changed, 14 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/rs600.c
++++ b/drivers/gpu/drm/radeon/rs600.c
+@@ -301,9 +301,7 @@ int rs600_mc_wait_for_idle(struct radeon
+
+ void rs600_gpu_init(struct radeon_device *rdev)
+ {
+- /* FIXME: HDP same place on rs600 ? */
+ r100_hdp_reset(rdev);
+- /* FIXME: is this correct ? */
+ r420_pipes_init(rdev);
+ /* Wait for mc idle */
+ if (rs600_mc_wait_for_idle(rdev))
+@@ -312,7 +310,6 @@ void rs600_gpu_init(struct radeon_device
+
+ void rs600_vram_info(struct radeon_device *rdev)
+ {
+- /* FIXME: to do or is these values sane ? */
+ rdev->mc.vram_is_ddr = true;
+ rdev->mc.vram_width = 128;
+
+@@ -321,6 +318,12 @@ void rs600_vram_info(struct radeon_devic
+
+ rdev->mc.aper_base = drm_get_resource_start(rdev->ddev, 0);
+ rdev->mc.aper_size = drm_get_resource_len(rdev->ddev, 0);
++
++ if (rdev->mc.mc_vram_size > rdev->mc.aper_size)
++ rdev->mc.mc_vram_size = rdev->mc.aper_size;
++
++ if (rdev->mc.real_vram_size > rdev->mc.aper_size)
++ rdev->mc.real_vram_size = rdev->mc.aper_size;
+ }
+
+ void rs600_bandwidth_update(struct radeon_device *rdev)
+--- a/drivers/gpu/drm/radeon/rs690.c
++++ b/drivers/gpu/drm/radeon/rs690.c
+@@ -134,7 +134,7 @@ void rs690_vram_info(struct radeon_devic
+ fixed20_12 a;
+
+ rs400_gart_adjust_size(rdev);
+- /* DDR for all card after R300 & IGP */
++
+ rdev->mc.vram_is_ddr = true;
+ rdev->mc.vram_width = 128;
+
+@@ -143,6 +143,13 @@ void rs690_vram_info(struct radeon_devic
+
+ rdev->mc.aper_base = drm_get_resource_start(rdev->ddev, 0);
+ rdev->mc.aper_size = drm_get_resource_len(rdev->ddev, 0);
++
++ if (rdev->mc.mc_vram_size > rdev->mc.aper_size)
++ rdev->mc.mc_vram_size = rdev->mc.aper_size;
++
++ if (rdev->mc.real_vram_size > rdev->mc.aper_size)
++ rdev->mc.real_vram_size = rdev->mc.aper_size;
++
+ rs690_pm_info(rdev);
+ /* FIXME: we should enforce default clock in case GPU is not in
+ * default setup
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:53 2009
+Message-Id: <20091217035653.375160006@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:18 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Martin Michlmayr <tbm@cyrius.com>,
+ Thomas Hellstrom <thellstrom@vmware.com>,
+ Dave Airlie <airlied@redhat.com>
+Subject: [081/151] drm/ttm: Fix build failure due to missing struct page
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Martin Michlmayr <tbm@cyrius.com>
+
+commit c3a73ba13bac7fd96030f39202b2d37fb19c46a6 upstream.
+
+drm/ttm fails to build on MIPS because "struct page" is not known:
+| In file included from drivers/gpu/drm/ttm/ttm_memory.c:28:
+| include/drm/ttm/ttm_memory.h:154: warning: 'struct page' declared inside parameter list
+| include/drm/ttm/ttm_memory.h:154: warning: its scope is only this definition or declaration, which is probably not what you want
+| include/drm/ttm/ttm_memory.h:156: warning: 'struct page' declared inside parameter list
+| drivers/gpu/drm/ttm/ttm_memory.c:540: error: conflicting types for 'ttm_mem_global_alloc_page'
+| include/drm/ttm/ttm_memory.h:154: error: previous declaration of 'ttm_mem_global_alloc_page' was here
+| drivers/gpu/drm/ttm/ttm_memory.c:561: error: conflicting types for 'ttm_mem_global_free_page'
+| include/drm/ttm/ttm_memory.h:156: error: previous declaration of 'ttm_mem_global_free_page' was here
+
+Signed-off-by: Martin Michlmayr <tbm@cyrius.com>
+Acked-by: Thomas Hellstrom <thellstrom@vmware.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/drm/ttm/ttm_memory.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/drm/ttm/ttm_memory.h
++++ b/include/drm/ttm/ttm_memory.h
+@@ -33,6 +33,7 @@
+ #include <linux/wait.h>
+ #include <linux/errno.h>
+ #include <linux/kobject.h>
++#include <linux/mm.h>
+
+ /**
+ * struct ttm_mem_shrink - callback to shrink TTM memory usage.
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:53 2009
+Message-Id: <20091217035653.504981807@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:19 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Chris Wilson <chris@chris-wilson.co.uk>,
+ Eric Anholt <eric@anholt.net>
+Subject: [082/151] drm/i915: Set the error code after failing to insert new offset into mm ht.
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 5618ca6abc2d6f475b258badc017a5254cf43d1b upstream.
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_gem.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -1288,6 +1288,7 @@ i915_gem_create_mmap_offset(struct drm_g
+ list->hash.key = list->file_offset_node->start;
+ if (drm_ht_insert_item(&mm->offset_hash, &list->hash)) {
+ DRM_ERROR("failed to add to map hash\n");
++ ret = -ENOMEM;
+ goto out_free_mm;
+ }
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:53 2009
+Message-Id: <20091217035653.632115849@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:20 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Zhao Yakui <yakui.zhao@intel.com>,
+ Eric Anholt <eric@anholt.net>
+Subject: [083/151] drm/i915: Add the missing clonemask for display port on Ironlake
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Zhao Yakui <yakui.zhao@intel.com>
+
+commit 652af9d74e1a3a10bb10f0d8e8f42ddac26bbc1a upstream.
+
+Add the missing clonemask for display port on Ironlake.
+
+Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
+Reviewed-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_dp.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -1254,11 +1254,11 @@ intel_dp_init(struct drm_device *dev, in
+ else
+ intel_output->type = INTEL_OUTPUT_DISPLAYPORT;
+
+- if (output_reg == DP_B)
++ if (output_reg == DP_B || output_reg == PCH_DP_B)
+ intel_output->clone_mask = (1 << INTEL_DP_B_CLONE_BIT);
+- else if (output_reg == DP_C)
++ else if (output_reg == DP_C || output_reg == PCH_DP_C)
+ intel_output->clone_mask = (1 << INTEL_DP_C_CLONE_BIT);
+- else if (output_reg == DP_D)
++ else if (output_reg == DP_D || output_reg == PCH_DP_D)
+ intel_output->clone_mask = (1 << INTEL_DP_D_CLONE_BIT);
+
+ if (IS_eDP(intel_output)) {
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:53 2009
+Message-Id: <20091217035653.760116687@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:21 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Subject: [084/151] xen/xenbus: make DEVICE_ATTR()s static
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+
+commit db05fed0ad72f264e39bcb366795f7367384ec92 upstream.
+
+They don't need to be global, and may cause linker clashes.
+
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/xen/xenbus/xenbus_probe.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/xen/xenbus/xenbus_probe.c
++++ b/drivers/xen/xenbus/xenbus_probe.c
+@@ -454,21 +454,21 @@ static ssize_t xendev_show_nodename(stru
+ {
+ return sprintf(buf, "%s\n", to_xenbus_device(dev)->nodename);
+ }
+-DEVICE_ATTR(nodename, S_IRUSR | S_IRGRP | S_IROTH, xendev_show_nodename, NULL);
++static DEVICE_ATTR(nodename, S_IRUSR | S_IRGRP | S_IROTH, xendev_show_nodename, NULL);
+
+ static ssize_t xendev_show_devtype(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+ return sprintf(buf, "%s\n", to_xenbus_device(dev)->devicetype);
+ }
+-DEVICE_ATTR(devtype, S_IRUSR | S_IRGRP | S_IROTH, xendev_show_devtype, NULL);
++static DEVICE_ATTR(devtype, S_IRUSR | S_IRGRP | S_IROTH, xendev_show_devtype, NULL);
+
+ static ssize_t xendev_show_modalias(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+ return sprintf(buf, "xen:%s\n", to_xenbus_device(dev)->devicetype);
+ }
+-DEVICE_ATTR(modalias, S_IRUSR | S_IRGRP | S_IROTH, xendev_show_modalias, NULL);
++static DEVICE_ATTR(modalias, S_IRUSR | S_IRGRP | S_IROTH, xendev_show_modalias, NULL);
+
+ int xenbus_probe_node(struct xen_bus_type *bus,
+ const char *type,
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:54 2009
+Message-Id: <20091217035653.884061164@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:22 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ian Campbell <ian.campbell@citrix.com>,
+ Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Subject: [085/151] xen: re-register runstate area earlier on resume.
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ian Campbell <Ian.Campbell@citrix.com>
+
+commit be012920ecba161ad20303a3f6d9e96c58cf97c7 upstream.
+
+This is necessary to ensure the runstate area is available to
+xen_sched_clock before any calls to printk which will require it in
+order to provide a timestamp.
+
+I chose to pull the xen_setup_runstate_info out of xen_time_init into
+the caller in order to maintain parity with calling
+xen_setup_runstate_info separately from calling xen_time_resume.
+
+Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/xen/enlighten.c | 2 ++
+ arch/x86/xen/time.c | 5 ++---
+ arch/x86/xen/xen-ops.h | 1 +
+ 3 files changed, 5 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -148,6 +148,8 @@ void xen_vcpu_restore(void)
+ HYPERVISOR_vcpu_op(VCPUOP_down, cpu, NULL))
+ BUG();
+
++ xen_setup_runstate_info(cpu);
++
+ xen_vcpu_setup(cpu);
+
+ if (other_cpu &&
+--- a/arch/x86/xen/time.c
++++ b/arch/x86/xen/time.c
+@@ -100,7 +100,7 @@ bool xen_vcpu_stolen(int vcpu)
+ return per_cpu(runstate, vcpu).state == RUNSTATE_runnable;
+ }
+
+-static void setup_runstate_info(int cpu)
++void xen_setup_runstate_info(int cpu)
+ {
+ struct vcpu_register_runstate_memory_area area;
+
+@@ -442,8 +442,6 @@ void xen_setup_timer(int cpu)
+
+ evt->cpumask = cpumask_of(cpu);
+ evt->irq = irq;
+-
+- setup_runstate_info(cpu);
+ }
+
+ void xen_teardown_timer(int cpu)
+@@ -494,6 +492,7 @@ __init void xen_time_init(void)
+
+ setup_force_cpu_cap(X86_FEATURE_TSC);
+
++ xen_setup_runstate_info(cpu);
+ xen_setup_timer(cpu);
+ xen_setup_cpu_clockevents();
+ }
+--- a/arch/x86/xen/xen-ops.h
++++ b/arch/x86/xen/xen-ops.h
+@@ -41,6 +41,7 @@ void __init xen_build_dynamic_phys_to_ma
+
+ void xen_init_irq_ops(void);
+ void xen_setup_timer(int cpu);
++void xen_setup_runstate_info(int cpu);
+ void xen_teardown_timer(int cpu);
+ cycle_t xen_clocksource_read(void);
+ void xen_setup_cpu_clockevents(void);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:54 2009
+Message-Id: <20091217035654.014917448@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:23 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Subject: [086/151] xen: restore runstate_info even if !have_vcpu_info_placement
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+
+commit 3905bb2aa7bb801b31946b37a4635ebac4009051 upstream.
+
+Even if have_vcpu_info_placement is not set, we still need to set up
+the runstate area on each resumed vcpu.
+
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/xen/enlighten.c | 25 +++++++++++--------------
+ 1 file changed, 11 insertions(+), 14 deletions(-)
+
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -138,26 +138,23 @@ static void xen_vcpu_setup(int cpu)
+ */
+ void xen_vcpu_restore(void)
+ {
+- if (have_vcpu_info_placement) {
+- int cpu;
++ int cpu;
+
+- for_each_online_cpu(cpu) {
+- bool other_cpu = (cpu != smp_processor_id());
++ for_each_online_cpu(cpu) {
++ bool other_cpu = (cpu != smp_processor_id());
+
+- if (other_cpu &&
+- HYPERVISOR_vcpu_op(VCPUOP_down, cpu, NULL))
+- BUG();
++ if (other_cpu &&
++ HYPERVISOR_vcpu_op(VCPUOP_down, cpu, NULL))
++ BUG();
+
+- xen_setup_runstate_info(cpu);
++ xen_setup_runstate_info(cpu);
+
++ if (have_vcpu_info_placement)
+ xen_vcpu_setup(cpu);
+
+- if (other_cpu &&
+- HYPERVISOR_vcpu_op(VCPUOP_up, cpu, NULL))
+- BUG();
+- }
+-
+- BUG_ON(!have_vcpu_info_placement);
++ if (other_cpu &&
++ HYPERVISOR_vcpu_op(VCPUOP_up, cpu, NULL))
++ BUG();
+ }
+ }
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:54 2009
+Message-Id: <20091217035654.138219109@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:24 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ian Campbell <ian.campbell@citrix.com>,
+ Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Subject: [087/151] xen: correctly restore pfn_to_mfn_list_list after resume
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ian Campbell <ian.campbell@citrix.com>
+
+commit fa24ba62ea2869308ffc9f0b286ac9650b4ca6cb upstream.
+
+pvops kernels >= 2.6.30 can currently only be saved and restored once. The
+second attempt to save results in:
+
+ ERROR Internal error: Frame# in pfn-to-mfn frame list is not in pseudophys
+ ERROR Internal error: entry 0: p2m_frame_list[0] is 0xf2c2c2c2, max 0x120000
+ ERROR Internal error: Failed to map/save the p2m frame list
+
+I finally narrowed it down to:
+
+ commit cdaead6b4e657f960d6d6f9f380e7dfeedc6a09b
+ Author: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+ Date: Fri Feb 27 15:34:59 2009 -0800
+
+ xen: split construction of p2m mfn tables from registration
+
+ Build the p2m_mfn_list_list early with the rest of the p2m table, but
+ register it later when the real shared_info structure is in place.
+
+ Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+
+The unforeseen side-effect of this change was to cause the mfn list list to not
+be rebuilt on resume. Prior to this change it would have been rebuilt via
+xen_post_suspend() -> xen_setup_shared_info() -> xen_setup_mfn_list_list().
+
+Fix by explicitly calling xen_build_mfn_list_list() from xen_post_suspend().
+
+Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/xen/mmu.c | 2 +-
+ arch/x86/xen/suspend.c | 2 ++
+ arch/x86/xen/xen-ops.h | 1 +
+ 3 files changed, 4 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/xen/mmu.c
++++ b/arch/x86/xen/mmu.c
+@@ -185,7 +185,7 @@ static inline unsigned p2m_index(unsigne
+ }
+
+ /* Build the parallel p2m_top_mfn structures */
+-static void __init xen_build_mfn_list_list(void)
++void xen_build_mfn_list_list(void)
+ {
+ unsigned pfn, idx;
+
+--- a/arch/x86/xen/suspend.c
++++ b/arch/x86/xen/suspend.c
+@@ -27,6 +27,8 @@ void xen_pre_suspend(void)
+
+ void xen_post_suspend(int suspend_cancelled)
+ {
++ xen_build_mfn_list_list();
++
+ xen_setup_shared_info();
+
+ if (suspend_cancelled) {
+--- a/arch/x86/xen/xen-ops.h
++++ b/arch/x86/xen/xen-ops.h
+@@ -25,6 +25,7 @@ extern struct shared_info *HYPERVISOR_sh
+
+ void xen_setup_mfn_list_list(void);
+ void xen_setup_shared_info(void);
++void xen_build_mfn_list_list(void);
+ void xen_setup_machphys_mapping(void);
+ pgd_t *xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn);
+ void xen_ident_map_ISA(void);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:54 2009
+Message-Id: <20091217035654.268686380@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:25 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ian Campbell <ian.campbell@citrix.com>,
+ Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Subject: [088/151] xen: register timer interrupt with IRQF_TIMER
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ian Campbell <ian.campbell@citrix.com>
+
+commit f350c7922faad3397c98c81a9e5658f5a1ef0214 upstream.
+
+Otherwise the timer is disabled by dpm_suspend_noirq() which in turn prevents
+correct operation of stop_machine on multi-processor systems and breaks
+suspend.
+
+Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/xen/time.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/xen/time.c
++++ b/arch/x86/xen/time.c
+@@ -434,7 +434,7 @@ void xen_setup_timer(int cpu)
+ name = "<timer kasprintf failed>";
+
+ irq = bind_virq_to_irqhandler(VIRQ_TIMER, cpu, xen_timer_interrupt,
+- IRQF_DISABLED|IRQF_PERCPU|IRQF_NOBALANCING,
++ IRQF_DISABLED|IRQF_PERCPU|IRQF_NOBALANCING|IRQF_TIMER,
+ name, NULL);
+
+ evt = &per_cpu(xen_clock_events, cpu);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:54 2009
+Message-Id: <20091217035654.398436035@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:26 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ian Campbell <ian.campbell@citrix.com>,
+ Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Subject: [089/151] xen: register runstate on secondary CPUs
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ian Campbell <ian.campbell@citrix.com>
+
+commit 028896721ac04f6fa0697f3ecac3f98761746363 upstream.
+
+The commit "xen: re-register runstate area earlier on resume" caused us
+to never try and setup the runstate area for secondary CPUs. Ensure that
+we do this...
+
+Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/xen/smp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/x86/xen/smp.c
++++ b/arch/x86/xen/smp.c
+@@ -295,6 +295,7 @@ static int __cpuinit xen_cpu_up(unsigned
+ (unsigned long)task_stack_page(idle) -
+ KERNEL_STACK_OFFSET + THREAD_SIZE;
+ #endif
++ xen_setup_runstate_info(cpu);
+ xen_setup_timer(cpu);
+ xen_init_lock_cpu(cpu);
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:54 2009
+Message-Id: <20091217035654.540949610@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:27 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Subject: [090/151] xen: dont call dpm_resume_noirq() with interrupts disabled.
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+
+commit 922cc38ab71d1360978e65207e4a4f4988987127 upstream.
+
+dpm_resume_noirq() takes a mutex, so it can't be called from a no-interrupt
+context. Don't call it from within the stop-machine function, but just
+afterwards, since we're resuming anyway, regardless of what happened.
+
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/xen/manage.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/xen/manage.c
++++ b/drivers/xen/manage.c
+@@ -43,7 +43,6 @@ static int xen_suspend(void *data)
+ if (err) {
+ printk(KERN_ERR "xen_suspend: sysdev_suspend failed: %d\n",
+ err);
+- dpm_resume_noirq(PMSG_RESUME);
+ return err;
+ }
+
+@@ -69,7 +68,6 @@ static int xen_suspend(void *data)
+ }
+
+ sysdev_resume();
+- dpm_resume_noirq(PMSG_RESUME);
+
+ return 0;
+ }
+@@ -108,6 +106,9 @@ static void do_suspend(void)
+ }
+
+ err = stop_machine(xen_suspend, &cancelled, cpumask_of(0));
++
++ dpm_resume_noirq(PMSG_RESUME);
++
+ if (err) {
+ printk(KERN_ERR "failed to start xen_suspend: %d\n", err);
+ goto out;
+@@ -119,8 +120,6 @@ static void do_suspend(void)
+ } else
+ xs_suspend_cancel();
+
+- dpm_resume_noirq(PMSG_RESUME);
+-
+ resume_devices:
+ dpm_resume_end(PMSG_RESUME);
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:54 2009
+Message-Id: <20091217035654.709032930@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:28 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Subject: [091/151] xen: register runstate info for boot CPU early
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+
+commit 499d19b82b586aef18727b9ae1437f8f37b66e91 upstream.
+
+printk timestamping uses sched_clock, which in turn relies on runstate
+info under Xen. So make sure we set it up before any printks can
+be called.
+
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/xen/enlighten.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -1181,6 +1181,8 @@ asmlinkage void __init xen_start_kernel(
+
+ xen_raw_console_write("about to get started...\n");
+
++ xen_setup_runstate_info(0);
++
+ /* Start the world */
+ #ifdef CONFIG_X86_32
+ i386_start_kernel();
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:55 2009
+Message-Id: <20091217035654.875765876@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:29 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ian Campbell <Ian.Campbell@citrix.com>,
+ Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>,
+ Thomas Gleixner <tglx@linutronix.de>
+Subject: [092/151] xen: call clock resume notifier on all CPUs
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ian Campbell <Ian.Campbell@citrix.com>
+
+commit f6eafe3665bcc374c66775d58312d1c06c55303f upstream.
+
+tick_resume() is never called on secondary processors. Presumably this
+is because they are offlined for suspend on native and so this is
+normally taken care of in the CPU onlining path. Under Xen we keep all
+CPUs online over a suspend.
+
+This patch papers over the issue for me but I will investigate a more
+generic, less hacky, way of doing to the same.
+
+tick_suspend is also only called on the boot CPU which I presume should
+be fixed too.
+
+Signed-off-by: Ian Campbell <Ian.Campbell@citrix.com>
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/xen/suspend.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/xen/suspend.c
++++ b/arch/x86/xen/suspend.c
+@@ -1,4 +1,5 @@
+ #include <linux/types.h>
++#include <linux/clockchips.h>
+
+ #include <xen/interface/xen.h>
+ #include <xen/grant_table.h>
+@@ -46,7 +47,19 @@ void xen_post_suspend(int suspend_cancel
+
+ }
+
++static void xen_vcpu_notify_restore(void *data)
++{
++ unsigned long reason = (unsigned long)data;
++
++ /* Boot processor notified via generic timekeeping_resume() */
++ if ( smp_processor_id() == 0)
++ return;
++
++ clockevents_notify(reason, NULL);
++}
++
+ void xen_arch_resume(void)
+ {
+- /* nothing */
++ smp_call_function(xen_vcpu_notify_restore,
++ (void *)CLOCK_EVT_NOTIFY_RESUME, 1);
+ }
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:55 2009
+Message-Id: <20091217035655.039523877@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:30 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ian Campbell <ian.campbell@citrix.com>,
+ Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Subject: [093/151] xen: improve error handling in do_suspend.
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ian Campbell <ian.campbell@citrix.com>
+
+commit 65f63384b391bf4d384327d8a7c6de9860290b5c upstream.
+
+The existing error handling has a few issues:
+- If freeze_processes() fails it exits with shutting_down = SHUTDOWN_SUSPEND.
+- If dpm_suspend_noirq() fails it exits without resuming xenbus.
+- If stop_machine() fails it exits without resuming xenbus or calling
+ dpm_resume_end().
+- xs_suspend()/xs_resume() and dpm_suspend_noirq()/dpm_resume_noirq() were not
+ nested in the obvious way.
+
+Fix by ensuring each failure case goto's the correct label. Treat a failure of
+stop_machine() as a cancelled suspend in order to follow the correct resume
+path.
+
+Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/xen/manage.c | 20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+--- a/drivers/xen/manage.c
++++ b/drivers/xen/manage.c
+@@ -86,32 +86,32 @@ static void do_suspend(void)
+ err = freeze_processes();
+ if (err) {
+ printk(KERN_ERR "xen suspend: freeze failed %d\n", err);
+- return;
++ goto out;
+ }
+ #endif
+
+ err = dpm_suspend_start(PMSG_SUSPEND);
+ if (err) {
+ printk(KERN_ERR "xen suspend: dpm_suspend_start %d\n", err);
+- goto out;
++ goto out_thaw;
+ }
+
+- printk(KERN_DEBUG "suspending xenstore...\n");
+- xs_suspend();
+-
+ err = dpm_suspend_noirq(PMSG_SUSPEND);
+ if (err) {
+ printk(KERN_ERR "dpm_suspend_noirq failed: %d\n", err);
+- goto resume_devices;
++ goto out_resume;
+ }
+
++ printk(KERN_DEBUG "suspending xenstore...\n");
++ xs_suspend();
++
+ err = stop_machine(xen_suspend, &cancelled, cpumask_of(0));
+
+ dpm_resume_noirq(PMSG_RESUME);
+
+ if (err) {
+ printk(KERN_ERR "failed to start xen_suspend: %d\n", err);
+- goto out;
++ cancelled = 1;
+ }
+
+ if (!cancelled) {
+@@ -120,15 +120,17 @@ static void do_suspend(void)
+ } else
+ xs_suspend_cancel();
+
+-resume_devices:
++out_resume:
+ dpm_resume_end(PMSG_RESUME);
+
+ /* Make sure timer events get retriggered on all CPUs */
+ clock_was_set();
+-out:
++
++out_thaw:
+ #ifdef CONFIG_PREEMPT
+ thaw_processes();
+ #endif
++out:
+ shutting_down = SHUTDOWN_INVALID;
+ }
+ #endif /* CONFIG_PM_SLEEP */
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:55 2009
+Message-Id: <20091217035655.194444555@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:31 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ian Campbell <ian.campbell@citrix.com>,
+ Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Subject: [094/151] xen: dont leak IRQs over suspend/resume.
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ian Campbell <ian.campbell@citrix.com>
+
+commit fed5ea87e02aaf902ff38c65b4514233db03dc09 upstream.
+
+On resume irq_info[*].evtchn is reset to 0 since event channel mappings
+are not preserved over suspend/resume. The other contents of irq_info
+is preserved to allow rebind_evtchn_irq() to function.
+
+However when a device resumes it will try to unbind from the
+previous IRQ (e.g. blkfront goes blkfront_resume() -> blkif_free() ->
+unbind_from_irqhandler() -> unbind_from_irq()). This will fail due to the
+check for VALID_EVTCHN in unbind_from_irq() and the IRQ is leaked. The
+device will then continue to resume and allocate a new IRQ, eventually
+leading to find_unbound_irq() panic()ing.
+
+Fix this by changing unbind_from_irq() to handle teardown of interrupts
+which have type!=IRQT_UNBOUND but are not currently bound to a specific
+event channel.
+
+Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/xen/events.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/xen/events.c
++++ b/drivers/xen/events.c
+@@ -474,6 +474,9 @@ static void unbind_from_irq(unsigned int
+ bind_evtchn_to_cpu(evtchn, 0);
+
+ evtchn_to_irq[evtchn] = -1;
++ }
++
++ if (irq_info[irq].type != IRQT_UNBOUND) {
+ irq_info[irq] = mk_unbound_info();
+
+ dynamic_irq_cleanup(irq);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:55 2009
+Message-Id: <20091217035655.322127547@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:32 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>,
+ Jan Beulich <jbeulich@novell.com>
+Subject: [095/151] xen: use iret for return from 64b kernel to 32b usermode
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+
+commit 6aaf5d633bb6cead81b396d861d7bae4b9a0ba7e upstream.
+
+If Xen wants to return to a 32b usermode with sysret it must use the
+right form. When using VCGF_in_syscall to trigger this, it looks at
+the code segment and does a 32b sysret if it is FLAT_USER_CS32.
+However, this is different from __USER32_CS, so it fails to return
+properly if we use the normal Linux segment.
+
+So avoid the whole mess by dropping VCGF_in_syscall and simply use
+plain iret to return to usermode.
+
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Acked-by: Jan Beulich <jbeulich@novell.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/xen/xen-asm_64.S | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/xen/xen-asm_64.S
++++ b/arch/x86/xen/xen-asm_64.S
+@@ -96,7 +96,7 @@ ENTRY(xen_sysret32)
+ pushq $__USER32_CS
+ pushq %rcx
+
+- pushq $VGCF_in_syscall
++ pushq $0
+ 1: jmp hypercall_iret
+ ENDPATCH(xen_sysret32)
+ RELOC(xen_sysret32, 1b+1)
+@@ -151,7 +151,7 @@ ENTRY(xen_syscall32_target)
+ ENTRY(xen_sysenter_target)
+ lea 16(%rsp), %rsp /* strip %rcx, %r11 */
+ mov $-ENOSYS, %rax
+- pushq $VGCF_in_syscall
++ pushq $0
+ jmp hypercall_iret
+ ENDPROC(xen_syscall32_target)
+ ENDPROC(xen_sysenter_target)
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:55 2009
+Message-Id: <20091217035655.451425681@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:33 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ian Campbell <ian.campbell@citrix.com>,
+ Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Subject: [096/151] xen: explicitly create/destroy stop_machine workqueues outside suspend/resume region.
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ian Campbell <ian.campbell@citrix.com>
+
+commit b4606f2165153833247823e8c04c5e88cb3d298b upstream.
+
+I have observed cases where the implicit stop_machine_destroy() done by
+stop_machine() hangs while destroying the workqueues, specifically in
+kthread_stop(). This seems to be because timer ticks are not restarted
+until after stop_machine() returns.
+
+Fortunately stop_machine provides a facility to pre-create/post-destroy
+the workqueues so use this to ensure that workqueues are only destroyed
+after everything is really up and running again.
+
+I only actually observed this failure with 2.6.30. It seems that newer
+kernels are somehow more robust against doing kthread_stop() without timer
+interrupts (I tried some backports of some likely looking candidates but
+did not track down the commit which added this robustness). However this
+change seems like a reasonable belt&braces thing to do.
+
+Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/xen/manage.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/xen/manage.c
++++ b/drivers/xen/manage.c
+@@ -79,6 +79,12 @@ static void do_suspend(void)
+
+ shutting_down = SHUTDOWN_SUSPEND;
+
++ err = stop_machine_create();
++ if (err) {
++ printk(KERN_ERR "xen suspend: failed to setup stop_machine %d\n", err);
++ goto out;
++ }
++
+ #ifdef CONFIG_PREEMPT
+ /* If the kernel is preemptible, we need to freeze all the processes
+ to prevent them from being in the middle of a pagetable update
+@@ -86,7 +92,7 @@ static void do_suspend(void)
+ err = freeze_processes();
+ if (err) {
+ printk(KERN_ERR "xen suspend: freeze failed %d\n", err);
+- goto out;
++ goto out_destroy_sm;
+ }
+ #endif
+
+@@ -129,7 +135,11 @@ out_resume:
+ out_thaw:
+ #ifdef CONFIG_PREEMPT
+ thaw_processes();
++
++out_destroy_sm:
+ #endif
++ stop_machine_destroy();
++
+ out:
+ shutting_down = SHUTDOWN_INVALID;
+ }
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:55 2009
+Message-Id: <20091217035655.580519111@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:34 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Gianluca Guida <gianluca.guida@citrix.com>,
+ Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Subject: [097/151] Xen balloon: fix totalram_pages counting.
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Gianluca Guida <gianluca.guida@citrix.com>
+
+commit 3d65c9488cadd2f11bd4d60c7266e639ece5d0d6 upstream.
+
+Change totalram_pages when a single page is added/removed to the
+ballooned list. This avoid totalram_pages to be set erroneously to
+max_pfn at boot.
+
+Signed-off-by: Gianluca Guida <gianluca.guida@citrix.com>
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/xen/balloon.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/xen/balloon.c
++++ b/drivers/xen/balloon.c
+@@ -136,6 +136,8 @@ static void balloon_append(struct page *
+ list_add(&page->lru, &ballooned_pages);
+ balloon_stats.balloon_low++;
+ }
++
++ totalram_pages--;
+ }
+
+ /* balloon_retrieve: rescue a page from the balloon, if it is not empty. */
+@@ -156,6 +158,8 @@ static struct page *balloon_retrieve(voi
+ else
+ balloon_stats.balloon_low--;
+
++ totalram_pages++;
++
+ return page;
+ }
+
+@@ -260,7 +264,6 @@ static int increase_reservation(unsigned
+ }
+
+ balloon_stats.current_pages += nr_pages;
+- totalram_pages = balloon_stats.current_pages;
+
+ out:
+ spin_unlock_irqrestore(&balloon_lock, flags);
+@@ -323,7 +326,6 @@ static int decrease_reservation(unsigned
+ BUG_ON(ret != nr_pages);
+
+ balloon_stats.current_pages -= nr_pages;
+- totalram_pages = balloon_stats.current_pages;
+
+ spin_unlock_irqrestore(&balloon_lock, flags);
+
+@@ -422,7 +424,6 @@ static int __init balloon_init(void)
+ pr_info("xen_balloon: Initialising balloon driver.\n");
+
+ balloon_stats.current_pages = min(xen_start_info->nr_pages, max_pfn);
+- totalram_pages = balloon_stats.current_pages;
+ balloon_stats.target_pages = balloon_stats.current_pages;
+ balloon_stats.balloon_low = 0;
+ balloon_stats.balloon_high = 0;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:55 2009
+Message-Id: <20091217035655.709164511@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:35 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ian Campbell <ian.campbell@citrix.com>
+Subject: [098/151] xen: try harder to balloon up under memory pressure.
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Ian Campbell <ian.campbell@citrix.com>
+
+commit bc2c0303226ec716854d3c208c7f84fe7aa35cd7 upstream.
+
+Currently if the balloon driver is unable to increase the guest's
+reservation it assumes the failure was due to reaching its full
+allocation, gives up on the ballooning operation and records the limit
+it reached as the "hard limit". The driver will not try again until
+the target is set again (even to the same value).
+
+However it is possible that ballooning has in fact failed due to
+memory pressure in the host and therefore it is desirable to keep
+attempting to reach the target in case memory becomes available. The
+most likely scenario is that some guests are ballooning down while
+others are ballooning up and therefore there is temporary memory
+pressure while things stabilise. You would not expect a well behaved
+toolstack to ask a domain to balloon to more than its allocation nor
+would you expect it to deliberately over-commit memory by setting
+balloon targets which exceed the total host memory.
+
+This patch drops the concept of a hard limit and causes the balloon
+driver to retry increasing the reservation on a timer in the same
+manner as when decreasing the reservation.
+
+Also if we partially succeed in increasing the reservation
+(i.e. receive less pages than we asked for) then we may as well keep
+those pages rather than returning them to Xen.
+
+Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/xen/balloon.c | 31 +++++--------------------------
+ 1 file changed, 5 insertions(+), 26 deletions(-)
+
+--- a/drivers/xen/balloon.c
++++ b/drivers/xen/balloon.c
+@@ -66,8 +66,6 @@ struct balloon_stats {
+ /* We aim for 'current allocation' == 'target allocation'. */
+ unsigned long current_pages;
+ unsigned long target_pages;
+- /* We may hit the hard limit in Xen. If we do then we remember it. */
+- unsigned long hard_limit;
+ /*
+ * Drivers may alter the memory reservation independently, but they
+ * must inform the balloon driver so we avoid hitting the hard limit.
+@@ -185,7 +183,7 @@ static void balloon_alarm(unsigned long
+
+ static unsigned long current_target(void)
+ {
+- unsigned long target = min(balloon_stats.target_pages, balloon_stats.hard_limit);
++ unsigned long target = balloon_stats.target_pages;
+
+ target = min(target,
+ balloon_stats.current_pages +
+@@ -221,23 +219,10 @@ static int increase_reservation(unsigned
+ set_xen_guest_handle(reservation.extent_start, frame_list);
+ reservation.nr_extents = nr_pages;
+ rc = HYPERVISOR_memory_op(XENMEM_populate_physmap, &reservation);
+- if (rc < nr_pages) {
+- if (rc > 0) {
+- int ret;
+-
+- /* We hit the Xen hard limit: reprobe. */
+- reservation.nr_extents = rc;
+- ret = HYPERVISOR_memory_op(XENMEM_decrease_reservation,
+- &reservation);
+- BUG_ON(ret != rc);
+- }
+- if (rc >= 0)
+- balloon_stats.hard_limit = (balloon_stats.current_pages + rc -
+- balloon_stats.driver_pages);
++ if (rc < 0)
+ goto out;
+- }
+
+- for (i = 0; i < nr_pages; i++) {
++ for (i = 0; i < rc; i++) {
+ page = balloon_retrieve();
+ BUG_ON(page == NULL);
+
+@@ -263,12 +248,12 @@ static int increase_reservation(unsigned
+ __free_page(page);
+ }
+
+- balloon_stats.current_pages += nr_pages;
++ balloon_stats.current_pages += rc;
+
+ out:
+ spin_unlock_irqrestore(&balloon_lock, flags);
+
+- return 0;
++ return rc < 0 ? rc : rc != nr_pages;
+ }
+
+ static int decrease_reservation(unsigned long nr_pages)
+@@ -369,7 +354,6 @@ static void balloon_process(struct work_
+ static void balloon_set_new_target(unsigned long target)
+ {
+ /* No need for lock. Not read-modify-write updates. */
+- balloon_stats.hard_limit = ~0UL;
+ balloon_stats.target_pages = target;
+ schedule_work(&balloon_worker);
+ }
+@@ -428,7 +412,6 @@ static int __init balloon_init(void)
+ balloon_stats.balloon_low = 0;
+ balloon_stats.balloon_high = 0;
+ balloon_stats.driver_pages = 0UL;
+- balloon_stats.hard_limit = ~0UL;
+
+ init_timer(&balloon_timer);
+ balloon_timer.data = 0;
+@@ -473,9 +456,6 @@ module_exit(balloon_exit);
+ BALLOON_SHOW(current_kb, "%lu\n", PAGES2KB(balloon_stats.current_pages));
+ BALLOON_SHOW(low_kb, "%lu\n", PAGES2KB(balloon_stats.balloon_low));
+ BALLOON_SHOW(high_kb, "%lu\n", PAGES2KB(balloon_stats.balloon_high));
+-BALLOON_SHOW(hard_limit_kb,
+- (balloon_stats.hard_limit!=~0UL) ? "%lu\n" : "???\n",
+- (balloon_stats.hard_limit!=~0UL) ? PAGES2KB(balloon_stats.hard_limit) : 0);
+ BALLOON_SHOW(driver_kb, "%lu\n", PAGES2KB(balloon_stats.driver_pages));
+
+ static ssize_t show_target_kb(struct sys_device *dev, struct sysdev_attribute *attr,
+@@ -545,7 +525,6 @@ static struct attribute *balloon_info_at
+ &attr_current_kb.attr,
+ &attr_low_kb.attr,
+ &attr_high_kb.attr,
+- &attr_hard_limit_kb.attr,
+ &attr_driver_kb.attr,
+ NULL
+ };
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:55 2009
+Message-Id: <20091217035655.840261049@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:36 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Julia Lawall <julia@diku.dk>,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [099/151] dm exception store: free tmp_store on persistent flag error
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Julia Lawall <julia@diku.dk>
+
+commit 613978f8711c7fd4d0aa856872375d2abd7c92ff upstream.
+
+Error handling code following a kmalloc should free the allocated data.
+
+Signed-off-by: Julia Lawall <julia@diku.dk>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-exception-store.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/dm-exception-store.c
++++ b/drivers/md/dm-exception-store.c
+@@ -216,7 +216,8 @@ int dm_exception_store_create(struct dm_
+ type = get_type("N");
+ else {
+ ti->error = "Persistent flag is not P or N";
+- return -EINVAL;
++ r = -EINVAL;
++ goto bad_type;
+ }
+
+ if (!type) {
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:56 2009
+Message-Id: <20091217035655.965379342@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:37 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mikulas Patocka <mpatocka@redhat.com>,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [100/151] dm snapshot: only take lock for statustype info not table
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 94e76572b5dd37b1f0f4b3742ee8a565daead932 upstream.
+
+Take snapshot lock only for STATUSTYPE_INFO, not STATUSTYPE_TABLE.
+
+Commit 4c6fff445d7aa753957856278d4d93bcad6e2c14
+(dm-snapshot-lock-snapshot-while-supplying-status.patch)
+introduced this use of the lock, but userspace applications using
+libdevmapper have been found to request STATUSTYPE_TABLE while the device
+is suspended and the lock is already held, leading to deadlock. Since
+the lock is not necessary in this case, don't try to take it.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-snap.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -1152,10 +1152,11 @@ static int snapshot_status(struct dm_tar
+ unsigned sz = 0;
+ struct dm_snapshot *snap = ti->private;
+
+- down_write(&snap->lock);
+-
+ switch (type) {
+ case STATUSTYPE_INFO:
++
++ down_write(&snap->lock);
++
+ if (!snap->valid)
+ DMEMIT("Invalid");
+ else {
+@@ -1171,6 +1172,9 @@ static int snapshot_status(struct dm_tar
+ else
+ DMEMIT("Unknown");
+ }
++
++ up_write(&snap->lock);
++
+ break;
+
+ case STATUSTYPE_TABLE:
+@@ -1185,8 +1189,6 @@ static int snapshot_status(struct dm_tar
+ break;
+ }
+
+- up_write(&snap->lock);
+-
+ return 0;
+ }
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:56 2009
+Message-Id: <20091217035656.104519949@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:38 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Milan Broz <mbroz@redhat.com>,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [101/151] dm crypt: move private iv fields to structs
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Milan Broz <mbroz@redhat.com>
+
+commit 6047359277517c4e56d8bfd6ea4966d7a3924151 upstream.
+
+Define private structures for IV so it's easy to add further attributes
+in a following patch which fixes the way key material is wiped from
+memory. Also move ESSIV destructor and remove unnecessary 'status'
+operation.
+
+There are no functional changes in this patch.
+
+Signed-off-by: Milan Broz <mbroz@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-crypt.c | 35 ++++++++++++++++++++++-------------
+ 1 file changed, 22 insertions(+), 13 deletions(-)
+
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -71,10 +71,17 @@ struct crypt_iv_operations {
+ int (*ctr)(struct crypt_config *cc, struct dm_target *ti,
+ const char *opts);
+ void (*dtr)(struct crypt_config *cc);
+- const char *(*status)(struct crypt_config *cc);
+ int (*generator)(struct crypt_config *cc, u8 *iv, sector_t sector);
+ };
+
++struct iv_essiv_private {
++ struct crypto_cipher *tfm;
++};
++
++struct iv_benbi_private {
++ int shift;
++};
++
+ /*
+ * Crypt: maps a linear range of a block device
+ * and encrypts / decrypts at the same time.
+@@ -102,8 +109,8 @@ struct crypt_config {
+ struct crypt_iv_operations *iv_gen_ops;
+ char *iv_mode;
+ union {
+- struct crypto_cipher *essiv_tfm;
+- int benbi_shift;
++ struct iv_essiv_private essiv;
++ struct iv_benbi_private benbi;
+ } iv_gen_private;
+ sector_t iv_offset;
+ unsigned int iv_size;
+@@ -169,6 +176,14 @@ static int crypt_iv_plain_gen(struct cry
+ return 0;
+ }
+
++static void crypt_iv_essiv_dtr(struct crypt_config *cc)
++{
++ struct iv_essiv_private *essiv = &cc->iv_gen_private.essiv;
++
++ crypto_free_cipher(essiv->tfm);
++ essiv->tfm = NULL;
++}
++
+ static int crypt_iv_essiv_ctr(struct crypt_config *cc, struct dm_target *ti,
+ const char *opts)
+ {
+@@ -236,21 +251,15 @@ static int crypt_iv_essiv_ctr(struct cry
+ }
+ kfree(salt);
+
+- cc->iv_gen_private.essiv_tfm = essiv_tfm;
++ cc->iv_gen_private.essiv.tfm = essiv_tfm;
+ return 0;
+ }
+
+-static void crypt_iv_essiv_dtr(struct crypt_config *cc)
+-{
+- crypto_free_cipher(cc->iv_gen_private.essiv_tfm);
+- cc->iv_gen_private.essiv_tfm = NULL;
+-}
+-
+ static int crypt_iv_essiv_gen(struct crypt_config *cc, u8 *iv, sector_t sector)
+ {
+ memset(iv, 0, cc->iv_size);
+ *(u64 *)iv = cpu_to_le64(sector);
+- crypto_cipher_encrypt_one(cc->iv_gen_private.essiv_tfm, iv, iv);
++ crypto_cipher_encrypt_one(cc->iv_gen_private.essiv.tfm, iv, iv);
+ return 0;
+ }
+
+@@ -273,7 +282,7 @@ static int crypt_iv_benbi_ctr(struct cry
+ return -EINVAL;
+ }
+
+- cc->iv_gen_private.benbi_shift = 9 - log;
++ cc->iv_gen_private.benbi.shift = 9 - log;
+
+ return 0;
+ }
+@@ -288,7 +297,7 @@ static int crypt_iv_benbi_gen(struct cry
+
+ memset(iv, 0, cc->iv_size - sizeof(u64)); /* rest is cleared below */
+
+- val = cpu_to_be64(((u64)sector << cc->iv_gen_private.benbi_shift) + 1);
++ val = cpu_to_be64(((u64)sector << cc->iv_gen_private.benbi.shift) + 1);
+ put_unaligned(val, (__be64 *)(iv + cc->iv_size - sizeof(u64)));
+
+ return 0;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:56 2009
+Message-Id: <20091217035656.222799487@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:39 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Milan Broz <mbroz@redhat.com>,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [102/151] dm crypt: restructure essiv error path
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Milan Broz <mbroz@redhat.com>
+
+commit 5861f1be00b3b70f8ab5e5a81392a6cf69666cd2 upstream.
+
+Use kzfree for salt deallocation because it is derived from the volume
+key. Use a common error path in ESSIV constructor.
+
+Required by a later patch which fixes the way key material is wiped
+from memory.
+
+Signed-off-by: Milan Broz <mbroz@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-crypt.c | 46 ++++++++++++++++++++++++++--------------------
+ 1 file changed, 26 insertions(+), 20 deletions(-)
+
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -187,15 +187,15 @@ static void crypt_iv_essiv_dtr(struct cr
+ static int crypt_iv_essiv_ctr(struct crypt_config *cc, struct dm_target *ti,
+ const char *opts)
+ {
+- struct crypto_cipher *essiv_tfm;
+- struct crypto_hash *hash_tfm;
++ struct crypto_cipher *essiv_tfm = NULL;
++ struct crypto_hash *hash_tfm = NULL;
+ struct hash_desc desc;
+ struct scatterlist sg;
+ unsigned int saltsize;
+- u8 *salt;
++ u8 *salt = NULL;
+ int err;
+
+- if (opts == NULL) {
++ if (!opts) {
+ ti->error = "Digest algorithm missing for ESSIV mode";
+ return -EINVAL;
+ }
+@@ -204,15 +204,16 @@ static int crypt_iv_essiv_ctr(struct cry
+ hash_tfm = crypto_alloc_hash(opts, 0, CRYPTO_ALG_ASYNC);
+ if (IS_ERR(hash_tfm)) {
+ ti->error = "Error initializing ESSIV hash";
+- return PTR_ERR(hash_tfm);
++ err = PTR_ERR(hash_tfm);
++ goto bad;
+ }
+
+ saltsize = crypto_hash_digestsize(hash_tfm);
+- salt = kmalloc(saltsize, GFP_KERNEL);
+- if (salt == NULL) {
++ salt = kzalloc(saltsize, GFP_KERNEL);
++ if (!salt) {
+ ti->error = "Error kmallocing salt storage in ESSIV";
+- crypto_free_hash(hash_tfm);
+- return -ENOMEM;
++ err = -ENOMEM;
++ goto bad;
+ }
+
+ sg_init_one(&sg, cc->key, cc->key_size);
+@@ -220,39 +221,44 @@ static int crypt_iv_essiv_ctr(struct cry
+ desc.flags = CRYPTO_TFM_REQ_MAY_SLEEP;
+ err = crypto_hash_digest(&desc, &sg, cc->key_size, salt);
+ crypto_free_hash(hash_tfm);
++ hash_tfm = NULL;
+
+ if (err) {
+ ti->error = "Error calculating hash in ESSIV";
+- kfree(salt);
+- return err;
++ goto bad;
+ }
+
+ /* Setup the essiv_tfm with the given salt */
+ essiv_tfm = crypto_alloc_cipher(cc->cipher, 0, CRYPTO_ALG_ASYNC);
+ if (IS_ERR(essiv_tfm)) {
+ ti->error = "Error allocating crypto tfm for ESSIV";
+- kfree(salt);
+- return PTR_ERR(essiv_tfm);
++ err = PTR_ERR(essiv_tfm);
++ goto bad;
+ }
+ if (crypto_cipher_blocksize(essiv_tfm) !=
+ crypto_ablkcipher_ivsize(cc->tfm)) {
+ ti->error = "Block size of ESSIV cipher does "
+ "not match IV size of block cipher";
+- crypto_free_cipher(essiv_tfm);
+- kfree(salt);
+- return -EINVAL;
++ err = -EINVAL;
++ goto bad;
+ }
+ err = crypto_cipher_setkey(essiv_tfm, salt, saltsize);
+ if (err) {
+ ti->error = "Failed to set key for ESSIV cipher";
+- crypto_free_cipher(essiv_tfm);
+- kfree(salt);
+- return err;
++ goto bad;
+ }
+- kfree(salt);
++ kzfree(salt);
+
+ cc->iv_gen_private.essiv.tfm = essiv_tfm;
+ return 0;
++
++bad:
++ if (essiv_tfm && !IS_ERR(essiv_tfm))
++ crypto_free_cipher(essiv_tfm);
++ if (hash_tfm && !IS_ERR(hash_tfm))
++ crypto_free_hash(hash_tfm);
++ kzfree(salt);
++ return err;
+ }
+
+ static int crypt_iv_essiv_gen(struct crypt_config *cc, u8 *iv, sector_t sector)
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:56 2009
+Message-Id: <20091217035656.350302499@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:40 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mikulas Patocka <mpatocka@redhat.com>,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [103/151] dm: avoid _hash_lock deadlock
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 6076905b5ef39e0ea58db32583c9e0036c05e47b upstream.
+
+Fix a reported deadlock if there are still unprocessed multipath events
+on a device that is being removed.
+
+_hash_lock is held during dev_remove while trying to send the
+outstanding events. Sending the events requests the _hash_lock
+again in dm_copy_name_and_uuid.
+
+This patch introduces a separate lock around regions that modify the
+link to the hash table (dm_set_mdptr) or the name or uuid so that
+dm_copy_name_and_uuid no longer needs _hash_lock.
+
+Additionally, dm_copy_name_and_uuid can only be called if md exists
+so we can drop the dm_get() and dm_put() which can lead to a BUG()
+while md is being freed.
+
+The deadlock:
+ #0 [ffff8106298dfb48] schedule at ffffffff80063035
+ #1 [ffff8106298dfc20] __down_read at ffffffff8006475d
+ #2 [ffff8106298dfc60] dm_copy_name_and_uuid at ffffffff8824f740
+ #3 [ffff8106298dfc90] dm_send_uevents at ffffffff88252685
+ #4 [ffff8106298dfcd0] event_callback at ffffffff8824c678
+ #5 [ffff8106298dfd00] dm_table_event at ffffffff8824dd01
+ #6 [ffff8106298dfd10] __hash_remove at ffffffff882507ad
+ #7 [ffff8106298dfd30] dev_remove at ffffffff88250865
+ #8 [ffff8106298dfd60] ctl_ioctl at ffffffff88250d80
+ #9 [ffff8106298dfee0] do_ioctl at ffffffff800418c4
+#10 [ffff8106298dff00] vfs_ioctl at ffffffff8002fab9
+#11 [ffff8106298dff40] sys_ioctl at ffffffff8004bdaf
+#12 [ffff8106298dff80] tracesys at ffffffff8005d28d (via system_call)
+
+Reported-by: guy keren <choo@actcom.co.il>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-ioctl.c | 17 +++++++++++++----
+ drivers/md/dm-uevent.c | 9 ++++-----
+ 2 files changed, 17 insertions(+), 9 deletions(-)
+
+--- a/drivers/md/dm-ioctl.c
++++ b/drivers/md/dm-ioctl.c
+@@ -56,6 +56,11 @@ static void dm_hash_remove_all(int keep_
+ */
+ static DECLARE_RWSEM(_hash_lock);
+
++/*
++ * Protects use of mdptr to obtain hash cell name and uuid from mapped device.
++ */
++static DEFINE_MUTEX(dm_hash_cells_mutex);
++
+ static void init_buckets(struct list_head *buckets)
+ {
+ unsigned int i;
+@@ -206,7 +211,9 @@ static int dm_hash_insert(const char *na
+ list_add(&cell->uuid_list, _uuid_buckets + hash_str(uuid));
+ }
+ dm_get(md);
++ mutex_lock(&dm_hash_cells_mutex);
+ dm_set_mdptr(md, cell);
++ mutex_unlock(&dm_hash_cells_mutex);
+ up_write(&_hash_lock);
+
+ return 0;
+@@ -224,7 +231,9 @@ static void __hash_remove(struct hash_ce
+ /* remove from the dev hash */
+ list_del(&hc->uuid_list);
+ list_del(&hc->name_list);
++ mutex_lock(&dm_hash_cells_mutex);
+ dm_set_mdptr(hc->md, NULL);
++ mutex_unlock(&dm_hash_cells_mutex);
+
+ table = dm_get_table(hc->md);
+ if (table) {
+@@ -321,7 +330,9 @@ static int dm_hash_rename(uint32_t cooki
+ */
+ list_del(&hc->name_list);
+ old_name = hc->name;
++ mutex_lock(&dm_hash_cells_mutex);
+ hc->name = new_name;
++ mutex_unlock(&dm_hash_cells_mutex);
+ list_add(&hc->name_list, _name_buckets + hash_str(new_name));
+
+ /*
+@@ -1582,8 +1593,7 @@ int dm_copy_name_and_uuid(struct mapped_
+ if (!md)
+ return -ENXIO;
+
+- dm_get(md);
+- down_read(&_hash_lock);
++ mutex_lock(&dm_hash_cells_mutex);
+ hc = dm_get_mdptr(md);
+ if (!hc || hc->md != md) {
+ r = -ENXIO;
+@@ -1596,8 +1606,7 @@ int dm_copy_name_and_uuid(struct mapped_
+ strcpy(uuid, hc->uuid ? : "");
+
+ out:
+- up_read(&_hash_lock);
+- dm_put(md);
++ mutex_unlock(&dm_hash_cells_mutex);
+
+ return r;
+ }
+--- a/drivers/md/dm-uevent.c
++++ b/drivers/md/dm-uevent.c
+@@ -139,14 +139,13 @@ void dm_send_uevents(struct list_head *e
+ list_del_init(&event->elist);
+
+ /*
+- * Need to call dm_copy_name_and_uuid from here for now.
+- * Context of previous var adds and locking used for
+- * hash_cell not compatable.
++ * When a device is being removed this copy fails and we
++ * discard these unsent events.
+ */
+ if (dm_copy_name_and_uuid(event->md, event->name,
+ event->uuid)) {
+- DMERR("%s: dm_copy_name_and_uuid() failed",
+- __func__);
++ DMINFO("%s: skipping sending uevent for lost device",
++ __func__);
+ goto uevent_free;
+ }
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:56 2009
+Message-Id: <20091217035656.480820893@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:41 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mikulas Patocka <mpatocka@redhat.com>,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [104/151] dm snapshot: cope with chunk size larger than origin
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 8e87b9b81b3c370f7e53c1ab6e1c3519ef37a644 upstream.
+
+Under some special conditions the snapshot hash_size is calculated as zero.
+This patch instead sets a minimum value of 64, the same as for the
+pending exception table.
+
+rounddown_pow_of_two(0) is an undefined operation (it expands to shift
+by -1). init_exception_table with an argument of 0 would fail with -ENOMEM.
+
+The way to trigger the problem is to create a snapshot with a chunk size
+that is larger than the origin device.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-snap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -553,6 +553,8 @@ static int init_hash_tables(struct dm_sn
+ hash_size = min(origin_dev_size, cow_dev_size) >> s->store->chunk_shift;
+ hash_size = min(hash_size, max_buckets);
+
++ if (hash_size < 64)
++ hash_size = 64;
+ hash_size = rounddown_pow_of_two(hash_size);
+ if (init_exception_table(&s->complete, hash_size,
+ DM_CHUNK_CONSECUTIVE_BITS))
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:56 2009
+Message-Id: <20091217035656.608211741@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:42 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Milan Broz <mbroz@redhat.com>,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [105/151] dm crypt: separate essiv allocation from initialisation
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Milan Broz <mbroz@redhat.com>
+
+commit b95bf2d3d5a48b095bffe2a0cd8c40453cf59557 upstream.
+
+This patch separates the construction of IV from its initialisation.
+(For ESSIV it is a hash calculation based on volume key.)
+
+Constructor code now preallocates hash tfm and salt array
+and saves it in a private IV structure.
+
+The next patch requires this to reinitialise the wiped IV
+without reallocating memory when resuming a suspended device.
+
+Signed-off-by: Milan Broz <mbroz@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-crypt.c | 69 +++++++++++++++++++++++++++++++-------------------
+ 1 file changed, 43 insertions(+), 26 deletions(-)
+
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -71,11 +71,14 @@ struct crypt_iv_operations {
+ int (*ctr)(struct crypt_config *cc, struct dm_target *ti,
+ const char *opts);
+ void (*dtr)(struct crypt_config *cc);
++ int (*init)(struct crypt_config *cc);
+ int (*generator)(struct crypt_config *cc, u8 *iv, sector_t sector);
+ };
+
+ struct iv_essiv_private {
+ struct crypto_cipher *tfm;
++ struct crypto_hash *hash_tfm;
++ u8 *salt;
+ };
+
+ struct iv_benbi_private {
+@@ -176,12 +179,38 @@ static int crypt_iv_plain_gen(struct cry
+ return 0;
+ }
+
++/* Initialise ESSIV - compute salt but no local memory allocations */
++static int crypt_iv_essiv_init(struct crypt_config *cc)
++{
++ struct iv_essiv_private *essiv = &cc->iv_gen_private.essiv;
++ struct hash_desc desc;
++ struct scatterlist sg;
++ int err;
++
++ sg_init_one(&sg, cc->key, cc->key_size);
++ desc.tfm = essiv->hash_tfm;
++ desc.flags = CRYPTO_TFM_REQ_MAY_SLEEP;
++
++ err = crypto_hash_digest(&desc, &sg, cc->key_size, essiv->salt);
++ if (err)
++ return err;
++
++ return crypto_cipher_setkey(essiv->tfm, essiv->salt,
++ crypto_hash_digestsize(essiv->hash_tfm));
++}
++
+ static void crypt_iv_essiv_dtr(struct crypt_config *cc)
+ {
+ struct iv_essiv_private *essiv = &cc->iv_gen_private.essiv;
+
+ crypto_free_cipher(essiv->tfm);
+ essiv->tfm = NULL;
++
++ crypto_free_hash(essiv->hash_tfm);
++ essiv->hash_tfm = NULL;
++
++ kzfree(essiv->salt);
++ essiv->salt = NULL;
+ }
+
+ static int crypt_iv_essiv_ctr(struct crypt_config *cc, struct dm_target *ti,
+@@ -189,9 +218,6 @@ static int crypt_iv_essiv_ctr(struct cry
+ {
+ struct crypto_cipher *essiv_tfm = NULL;
+ struct crypto_hash *hash_tfm = NULL;
+- struct hash_desc desc;
+- struct scatterlist sg;
+- unsigned int saltsize;
+ u8 *salt = NULL;
+ int err;
+
+@@ -200,7 +226,7 @@ static int crypt_iv_essiv_ctr(struct cry
+ return -EINVAL;
+ }
+
+- /* Hash the cipher key with the given hash algorithm */
++ /* Allocate hash algorithm */
+ hash_tfm = crypto_alloc_hash(opts, 0, CRYPTO_ALG_ASYNC);
+ if (IS_ERR(hash_tfm)) {
+ ti->error = "Error initializing ESSIV hash";
+@@ -208,27 +234,14 @@ static int crypt_iv_essiv_ctr(struct cry
+ goto bad;
+ }
+
+- saltsize = crypto_hash_digestsize(hash_tfm);
+- salt = kzalloc(saltsize, GFP_KERNEL);
++ salt = kzalloc(crypto_hash_digestsize(hash_tfm), GFP_KERNEL);
+ if (!salt) {
+ ti->error = "Error kmallocing salt storage in ESSIV";
+ err = -ENOMEM;
+ goto bad;
+ }
+
+- sg_init_one(&sg, cc->key, cc->key_size);
+- desc.tfm = hash_tfm;
+- desc.flags = CRYPTO_TFM_REQ_MAY_SLEEP;
+- err = crypto_hash_digest(&desc, &sg, cc->key_size, salt);
+- crypto_free_hash(hash_tfm);
+- hash_tfm = NULL;
+-
+- if (err) {
+- ti->error = "Error calculating hash in ESSIV";
+- goto bad;
+- }
+-
+- /* Setup the essiv_tfm with the given salt */
++ /* Allocate essiv_tfm */
+ essiv_tfm = crypto_alloc_cipher(cc->cipher, 0, CRYPTO_ALG_ASYNC);
+ if (IS_ERR(essiv_tfm)) {
+ ti->error = "Error allocating crypto tfm for ESSIV";
+@@ -242,14 +255,11 @@ static int crypt_iv_essiv_ctr(struct cry
+ err = -EINVAL;
+ goto bad;
+ }
+- err = crypto_cipher_setkey(essiv_tfm, salt, saltsize);
+- if (err) {
+- ti->error = "Failed to set key for ESSIV cipher";
+- goto bad;
+- }
+- kzfree(salt);
+
++ cc->iv_gen_private.essiv.salt = salt;
+ cc->iv_gen_private.essiv.tfm = essiv_tfm;
++ cc->iv_gen_private.essiv.hash_tfm = hash_tfm;
++
+ return 0;
+
+ bad:
+@@ -257,7 +267,7 @@ bad:
+ crypto_free_cipher(essiv_tfm);
+ if (hash_tfm && !IS_ERR(hash_tfm))
+ crypto_free_hash(hash_tfm);
+- kzfree(salt);
++ kfree(salt);
+ return err;
+ }
+
+@@ -323,6 +333,7 @@ static struct crypt_iv_operations crypt_
+ static struct crypt_iv_operations crypt_iv_essiv_ops = {
+ .ctr = crypt_iv_essiv_ctr,
+ .dtr = crypt_iv_essiv_dtr,
++ .init = crypt_iv_essiv_init,
+ .generator = crypt_iv_essiv_gen
+ };
+
+@@ -1054,6 +1065,12 @@ static int crypt_ctr(struct dm_target *t
+ cc->iv_gen_ops->ctr(cc, ti, ivopts) < 0)
+ goto bad_ivmode;
+
++ if (cc->iv_gen_ops && cc->iv_gen_ops->init &&
++ cc->iv_gen_ops->init(cc) < 0) {
++ ti->error = "Error initialising IV";
++ goto bad_slab_pool;
++ }
++
+ cc->iv_size = crypto_ablkcipher_ivsize(tfm);
+ if (cc->iv_size)
+ /* at least a 64 bit sector number should fit in our buffer */
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:56 2009
+Message-Id: <20091217035656.740124090@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:43 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Milan Broz <mbroz@redhat.com>,
+ Alasdair G Kergon <agk@redhat.com>
+Subject: [106/151] dm crypt: make wipe message also wipe essiv key
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Milan Broz <mbroz@redhat.com>
+
+commit 542da317668c35036e8471822a564b609d05af66 upstream.
+
+The "wipe key" message is used to wipe the volume key from memory
+temporarily, for example when suspending to RAM.
+
+But the initialisation vector in ESSIV mode is calculated from the
+hashed volume key, so the wipe message should wipe this IV key too and
+reinitialise it when the volume key is reinstated.
+
+This patch adds an IV wipe method called from a wipe message callback.
+ESSIV is then reinitialised using the init function added by the
+last patch.
+
+Signed-off-by: Milan Broz <mbroz@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-crypt.c | 34 ++++++++++++++++++++++++++++++----
+ 1 file changed, 30 insertions(+), 4 deletions(-)
+
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -1,7 +1,7 @@
+ /*
+ * Copyright (C) 2003 Christophe Saout <christophe@saout.de>
+ * Copyright (C) 2004 Clemens Fruhwirth <clemens@endorphin.org>
+- * Copyright (C) 2006-2008 Red Hat, Inc. All rights reserved.
++ * Copyright (C) 2006-2009 Red Hat, Inc. All rights reserved.
+ *
+ * This file is released under the GPL.
+ */
+@@ -72,6 +72,7 @@ struct crypt_iv_operations {
+ const char *opts);
+ void (*dtr)(struct crypt_config *cc);
+ int (*init)(struct crypt_config *cc);
++ int (*wipe)(struct crypt_config *cc);
+ int (*generator)(struct crypt_config *cc, u8 *iv, sector_t sector);
+ };
+
+@@ -199,6 +200,17 @@ static int crypt_iv_essiv_init(struct cr
+ crypto_hash_digestsize(essiv->hash_tfm));
+ }
+
++/* Wipe salt and reset key derived from volume key */
++static int crypt_iv_essiv_wipe(struct crypt_config *cc)
++{
++ struct iv_essiv_private *essiv = &cc->iv_gen_private.essiv;
++ unsigned salt_size = crypto_hash_digestsize(essiv->hash_tfm);
++
++ memset(essiv->salt, 0, salt_size);
++
++ return crypto_cipher_setkey(essiv->tfm, essiv->salt, salt_size);
++}
++
+ static void crypt_iv_essiv_dtr(struct crypt_config *cc)
+ {
+ struct iv_essiv_private *essiv = &cc->iv_gen_private.essiv;
+@@ -334,6 +346,7 @@ static struct crypt_iv_operations crypt_
+ .ctr = crypt_iv_essiv_ctr,
+ .dtr = crypt_iv_essiv_dtr,
+ .init = crypt_iv_essiv_init,
++ .wipe = crypt_iv_essiv_wipe,
+ .generator = crypt_iv_essiv_gen
+ };
+
+@@ -1310,6 +1323,7 @@ static void crypt_resume(struct dm_targe
+ static int crypt_message(struct dm_target *ti, unsigned argc, char **argv)
+ {
+ struct crypt_config *cc = ti->private;
++ int ret = -EINVAL;
+
+ if (argc < 2)
+ goto error;
+@@ -1319,10 +1333,22 @@ static int crypt_message(struct dm_targe
+ DMWARN("not suspended during key manipulation.");
+ return -EINVAL;
+ }
+- if (argc == 3 && !strnicmp(argv[1], MESG_STR("set")))
+- return crypt_set_key(cc, argv[2]);
+- if (argc == 2 && !strnicmp(argv[1], MESG_STR("wipe")))
++ if (argc == 3 && !strnicmp(argv[1], MESG_STR("set"))) {
++ ret = crypt_set_key(cc, argv[2]);
++ if (ret)
++ return ret;
++ if (cc->iv_gen_ops && cc->iv_gen_ops->init)
++ ret = cc->iv_gen_ops->init(cc);
++ return ret;
++ }
++ if (argc == 2 && !strnicmp(argv[1], MESG_STR("wipe"))) {
++ if (cc->iv_gen_ops && cc->iv_gen_ops->wipe) {
++ ret = cc->iv_gen_ops->wipe(cc);
++ if (ret)
++ return ret;
++ }
+ return crypt_wipe_key(cc);
++ }
+ }
+
+ error:
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:56 2009
+Message-Id: <20091217035656.868210204@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:44 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>,
+ Sergei Shtylyov <sshtylyov@ru.mvista.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [107/151] slc90e66: fix UDMA handling
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+
+[ Upstream commit ee31527a02b0a8e1aa4a5e4084d2db5fa34737ed ]
+
+Fix checking of the currently programmed UDMA mode.
+
+Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/ide/slc90e66.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/ide/slc90e66.c
++++ b/drivers/ide/slc90e66.c
+@@ -91,8 +91,7 @@ static void slc90e66_set_dma_mode(ide_dr
+
+ if (!(reg48 & u_flag))
+ pci_write_config_word(dev, 0x48, reg48|u_flag);
+- /* FIXME: (reg4a & a_speed) ? */
+- if ((reg4a & u_speed) != u_speed) {
++ if ((reg4a & a_speed) != u_speed) {
+ pci_write_config_word(dev, 0x4a, reg4a & ~a_speed);
+ pci_read_config_word(dev, 0x4a, ®4a);
+ pci_write_config_word(dev, 0x4a, reg4a|u_speed);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:57 2009
+Message-Id: <20091217035656.995669356@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:45 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Damian Lukowski <damian@tvk.rwth-aachen.de>,
+ =?ISO-8859-15?q?Ilpo=20J=C3=A4rvinen?= <ilpo.jarvinen@helsinki.fi>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [108/151] tcp: Stalling connections: Fix timeout calculation routine
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Damian Lukowski <damian@tvk.rwth-aachen.de>
+
+[ Upstream commit 07f29bc5bbae4e53e982ab956fed7207990a7786 ]
+
+This patch fixes a problem in the TCP connection timeout calculation.
+Currently, timeout decisions are made on the basis of the current
+tcp_time_stamp and retrans_stamp, which is usually set at the first
+retransmission.
+However, if the retransmission fails in tcp_retransmit_skb(),
+retrans_stamp is not updated and remains zero. This leads to wrong
+decisions in retransmits_timed_out() if tcp_time_stamp is larger than
+the specified timeout, which is very likely.
+In this case, the TCP connection dies after the first attempted
+(and unsuccessful) retransmission.
+
+With this patch, tcp_skb_cb->when is used instead, when retrans_stamp
+is not available.
+
+This bug has been introduced together with retransmits_timed_out() in
+2.6.32, as the number of retransmissions has been used for timeout
+decisions before. The corresponding commit was
+6fa12c85031485dff38ce550c24f10da23b0adaa (Revert Backoff [v3]:
+Calculate TCP's connection close threshold as a time value.).
+
+Thanks to Ilpo Järvinen for code suggestions and Frederic Leroy for
+testing.
+
+Reported-by: Frederic Leroy <fredo@starox.org>
+Signed-off-by: Damian Lukowski <damian@tvk.rwth-aachen.de>
+Acked-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/net/tcp.h | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1263,14 +1263,20 @@ static inline struct sk_buff *tcp_write_
+ * TCP connection after "boundary" unsucessful, exponentially backed-off
+ * retransmissions with an initial RTO of TCP_RTO_MIN.
+ */
+-static inline bool retransmits_timed_out(const struct sock *sk,
++static inline bool retransmits_timed_out(struct sock *sk,
+ unsigned int boundary)
+ {
+ unsigned int timeout, linear_backoff_thresh;
++ unsigned int start_ts;
+
+ if (!inet_csk(sk)->icsk_retransmits)
+ return false;
+
++ if (unlikely(!tcp_sk(sk)->retrans_stamp))
++ start_ts = TCP_SKB_CB(tcp_write_queue_head(sk))->when;
++ else
++ start_ts = tcp_sk(sk)->retrans_stamp;
++
+ linear_backoff_thresh = ilog2(TCP_RTO_MAX/TCP_RTO_MIN);
+
+ if (boundary <= linear_backoff_thresh)
+@@ -1279,7 +1285,7 @@ static inline bool retransmits_timed_out
+ timeout = ((2 << linear_backoff_thresh) - 1) * TCP_RTO_MIN +
+ (boundary - linear_backoff_thresh) * TCP_RTO_MAX;
+
+- return (tcp_time_stamp - tcp_sk(sk)->retrans_stamp) >= timeout;
++ return (tcp_time_stamp - start_ts) >= timeout;
+ }
+
+ static inline struct sk_buff *tcp_send_head(struct sock *sk)
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:57 2009
+Message-Id: <20091217035657.124098529@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:46 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Patrick McHardy <kaber@trash.net>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [109/151] ip_fragment: also adjust skb->truesize for packets not owned by a socket
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Patrick McHardy <kaber@trash.net>
+
+[ Upstream commit b2722b1c3a893ec6021508da15b32282ec79f4da ]
+
+When a large packet gets reassembled by ip_defrag(), the head skb
+accounts for all the fragments in skb->truesize. If this packet is
+refragmented again, skb->truesize is not re-adjusted to reflect only
+the head size since its not owned by a socket. If the head fragment
+then gets recycled and reused for another received fragment, it might
+exceed the defragmentation limits due to its large truesize value.
+
+skb_recycle_check() explicitly checks for linear skbs, so any recycled
+skb should reflect its true size in skb->truesize. Change ip_fragment()
+to also adjust the truesize value of skbs not owned by a socket.
+
+Reported-and-tested-by: Ben Menchaca <ben@bigfootnetworks.com>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/ip_output.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -501,8 +501,8 @@ int ip_fragment(struct sk_buff *skb, int
+ if (skb->sk) {
+ frag->sk = skb->sk;
+ frag->destructor = sock_wfree;
+- truesizes += frag->truesize;
+ }
++ truesizes += frag->truesize;
+ }
+
+ /* Everything is OK. Generate! */
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:57 2009
+Message-Id: <20091217035657.267598397@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:47 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Stanislav Brabec <sbrabec@suse.cz>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [110/151] b44 WOL setup: one-bit-off stack corruption kernel panic fix
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Stanislav Brabec <sbrabec@suse.cz>
+
+[ Upstream commit: e0188829cb724e7d12a2d4e343b368ff1d6e1471 ]
+
+About 50% of shutdowns of b44 Ethernet adapter ends by kernel panic
+with kernels compiled with stack-protector.
+
+Checking b44_magic_pattern() return values, one call of
+b44_magic_pattern() returns 127. It means, that set_bit(128, pmask)
+was called on line 1509. It means that bit 0 of 17th byte of pmask was
+overwritten. But pmask has only 16 bytes. Stack corruption happens.
+
+It seems that set_bit() on line 1509 always writes one bit off.
+
+The fix does not only solve the stack corruption, but also makes Wake
+On LAN working on my onboard B44 on Asus A7V-333X mainboard.
+
+It seems that this problem affects all kernel versions since commit
+725ad800 ([PATCH] b44: add wol for old nic) on 2006-06-20.
+
+Signed-off-by: Stanislav Brabec <sbrabec@suse.cz>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/b44.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/b44.c
++++ b/drivers/net/b44.c
+@@ -1505,8 +1505,7 @@ static int b44_magic_pattern(u8 *macaddr
+ for (k = 0; k< ethaddr_bytes; k++) {
+ ppattern[offset + magicsync +
+ (j * ETH_ALEN) + k] = macaddr[k];
+- len++;
+- set_bit(len, (unsigned long *) pmask);
++ set_bit(len++, (unsigned long *) pmask);
+ }
+ }
+ return len - 1;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:57 2009
+Message-Id: <20091217035657.378247813@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:48 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [111/151] sparc64: Dont specify IRQF_SHARED for LDC interrupts.
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 08a036d583409e3517e3d15b7478d029b25f2cf2 ]
+
+IRQF_SHARED and IRQF_DISABLED don't mix.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/kernel/ldc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/sparc/kernel/ldc.c
++++ b/arch/sparc/kernel/ldc.c
+@@ -1242,13 +1242,13 @@ int ldc_bind(struct ldc_channel *lp, con
+ snprintf(lp->tx_irq_name, LDC_IRQ_NAME_MAX, "%s TX", name);
+
+ err = request_irq(lp->cfg.rx_irq, ldc_rx,
+- IRQF_SAMPLE_RANDOM | IRQF_DISABLED | IRQF_SHARED,
++ IRQF_SAMPLE_RANDOM | IRQF_DISABLED,
+ lp->rx_irq_name, lp);
+ if (err)
+ return err;
+
+ err = request_irq(lp->cfg.tx_irq, ldc_tx,
+- IRQF_SAMPLE_RANDOM | IRQF_DISABLED | IRQF_SHARED,
++ IRQF_SAMPLE_RANDOM | IRQF_DISABLED,
+ lp->tx_irq_name, lp);
+ if (err) {
+ free_irq(lp->cfg.rx_irq, lp);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:57 2009
+Message-Id: <20091217035657.512017932@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:49 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [112/151] sparc64: Fix overly strict range type matching for PCI devices.
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 4230fa3b89ea1c413766bd411a8315a3d05aa6c7 ]
+
+When we are trying to see if a range property entry applies
+to a given address, we are overly strict about the type.
+
+We should only allow I/O ranges for I/O addresses, and only allow
+CONFIG space ranges for CONFIG space address.
+
+However for MEM ranges, they come in 32-bit and 64-bit flavors.
+And a lack of an exact match is OK if the range is 32-bit and
+the address is 64-bit. We can assign a 64-bit address properly
+into a 32-bit parent range just fine.
+
+So allow it.
+
+Reported-by: Patrick Finnegan <pat@computer-refuge.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/kernel/of_device_64.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/arch/sparc/kernel/of_device_64.c
++++ b/arch/sparc/kernel/of_device_64.c
+@@ -104,9 +104,19 @@ static int of_bus_pci_map(u32 *addr, con
+ int i;
+
+ /* Check address type match */
+- if ((addr[0] ^ range[0]) & 0x03000000)
+- return -EINVAL;
++ if (!((addr[0] ^ range[0]) & 0x03000000))
++ goto type_match;
++
++ /* Special exception, we can map a 64-bit address into
++ * a 32-bit range.
++ */
++ if ((addr[0] & 0x03000000) == 0x03000000 &&
++ (range[0] & 0x03000000) == 0x02000000)
++ goto type_match;
++
++ return -EINVAL;
+
++type_match:
+ if (of_out_of_range(addr + 1, range + 1, range + na + pna,
+ na - 1, ns))
+ return -EINVAL;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:57 2009
+Message-Id: <20091217035657.634557488@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:50 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [113/151] sparc64: Fix stack debugging IRQ stack regression.
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 166e553a575f09485f6d0df8a1ef3c5991f7d953 ]
+
+Commit 4f70f7a91bffdcc39f088748dc678953eb9a3fbd
+(sparc64: Implement IRQ stacks.) has two bugs.
+
+First, the softirq range check forgets to subtract STACK_BIAS
+before comparing with %sp. Next, on failure the wrong label
+is jumped to, resulting in a bogus stack being loaded.
+
+Reported-by: Igor Kovalenko <igor.v.kovalenko@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/lib/mcount.S | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/arch/sparc/lib/mcount.S
++++ b/arch/sparc/lib/mcount.S
+@@ -64,8 +64,9 @@ mcount:
+ 2: sethi %hi(softirq_stack), %g3
+ or %g3, %lo(softirq_stack), %g3
+ ldx [%g3 + %g1], %g7
++ sub %g7, STACK_BIAS, %g7
+ cmp %sp, %g7
+- bleu,pt %xcc, 2f
++ bleu,pt %xcc, 3f
+ sethi %hi(THREAD_SIZE), %g3
+ add %g7, %g3, %g7
+ cmp %sp, %g7
+@@ -75,7 +76,7 @@ mcount:
+ * again, we are already trying to output the stack overflow
+ * message.
+ */
+- sethi %hi(ovstack), %g7 ! cant move to panic stack fast enough
++3: sethi %hi(ovstack), %g7 ! cant move to panic stack fast enough
+ or %g7, %lo(ovstack), %g7
+ add %g7, OVSTACKSIZE, %g3
+ sub %g3, STACK_BIAS + 192, %g3
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:57 2009
+Message-Id: <20091217035657.762200531@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:51 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [114/151] sparc: Set UTS_MACHINE correctly.
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 7f5620a5fcd658f219e85831d3691908f1eccbde ]
+
+"ARCH" can be just about anything, so we shouldn't end up
+with UTS_MACHINE of "sparc" in a 64-bit kernel build just
+because someone set the personality using 'sparc32' or
+similar. CONFIG_SPARC64 drives the compilation and
+therefore provides the definitive value, not "ARCH".
+
+This mirrors commit 8c6531f7a99f29ba8817ffb12cc9ecf190049bd6
+(x86: correctly set UTS_MACHINE for "make ARCH=x86")
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/Makefile | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/sparc/Makefile
++++ b/arch/sparc/Makefile
+@@ -27,6 +27,7 @@ AS := $(AS) -32
+ LDFLAGS := -m elf32_sparc
+ CHECKFLAGS += -D__sparc__
+ export BITS := 32
++UTS_MACHINE := sparc
+
+ #KBUILD_CFLAGS += -g -pipe -fcall-used-g5 -fcall-used-g7
+ KBUILD_CFLAGS += -m32 -pipe -mno-fpu -fcall-used-g5 -fcall-used-g7
+@@ -46,6 +47,7 @@ CHECKFLAGS += -D__sparc__ -D__sparc
+
+ LDFLAGS := -m elf64_sparc
+ export BITS := 64
++UTS_MACHINE := sparc64
+
+ KBUILD_CFLAGS += -m64 -pipe -mno-fpu -mcpu=ultrasparc -mcmodel=medlow \
+ -ffixed-g4 -ffixed-g5 -fcall-used-g7 -Wno-sign-compare \
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:58 2009
+Message-Id: <20091217035657.891238507@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:52 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Larry Finger <Larry.Finger@lwfinger.net>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [115/151] b43legacy: avoid PPC fault during resume
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 316a4d966cae3c2dec83ebb1ee1a3515f97b30ff upstream.
+
+For PPC architecture with PHY Revision < 3, a read of the register
+B43_MMIO_HWENABLED_LO will cause a CPU fault unless b43legacy_status()
+returns a value of 2 (B43legacy_STAT_STARTED); however, one finds that
+the driver is unable to associate after resuming from hibernation unless
+this routine returns 1. To satisfy both conditions, the routine is rewritten
+to return TRUE whenever b43legacy_status() returns a value < 2.
+
+This patch fixes the second problem listed in the postings for Red Hat
+Bugzilla #538523.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/b43legacy/rfkill.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/net/wireless/b43legacy/rfkill.c
++++ b/drivers/net/wireless/b43legacy/rfkill.c
+@@ -34,6 +34,13 @@ bool b43legacy_is_hw_radio_enabled(struc
+ & B43legacy_MMIO_RADIO_HWENABLED_HI_MASK))
+ return 1;
+ } else {
++ /* To prevent CPU fault on PPC, do not read a register
++ * unless the interface is started; however, on resume
++ * for hibernation, this routine is entered early. When
++ * that happens, unconditionally return TRUE.
++ */
++ if (b43legacy_status(dev) < B43legacy_STAT_STARTED)
++ return 1;
+ if (b43legacy_read16(dev, B43legacy_MMIO_RADIO_HWENABLED_LO)
+ & B43legacy_MMIO_RADIO_HWENABLED_LO_MASK)
+ return 1;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:58 2009
+Message-Id: <20091217035658.016283887@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:53 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Johannes Berg <johannes@sipsolutions.net>,
+ Steven Rostedt <rostedt@goodmis.org>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [116/151] tracing: Fix event format export
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Johannes Berg <johannes@sipsolutions.net>
+
+commit 811cb50baf63461ce0bdb234927046131fc7fa8b upstream.
+
+For some reason the export of the event print format to userspace
+uses '#fmt' which breaks if the format string is anything but a plain
+string, for example if it is built with macros then the macro names
+are exported instead of their contents.
+
+Use
+ "\"%s\"", fmt
+instead of
+ "%s", #fmt
+to export the string and not the way it is built.
+
+For example, in net/mac80211/driver-trace.h for the trace event drv_start
+there is:
+
+ TP_printk(
+ LOCAL_PR_FMT, LOCAL_PR_ARG
+ )
+
+Which use to produce:
+
+ print fmt: LOCAL_PR_FMT, REC->wiphy_name
+
+Now produces:
+
+ print fmt: "%s", REC->wiphy_name
+
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+LKML-Reference: <20091113224009.GB23942@elte.hu>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Cc: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/trace/ftrace.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/trace/ftrace.h
++++ b/include/trace/ftrace.h
+@@ -159,7 +159,7 @@
+ #undef __get_str
+
+ #undef TP_printk
+-#define TP_printk(fmt, args...) "%s, %s\n", #fmt, __stringify(args)
++#define TP_printk(fmt, args...) "\"%s\", %s\n", fmt, __stringify(args)
+
+ #undef TP_fast_assign
+ #define TP_fast_assign(args...) args
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:58 2009
+Message-Id: <20091217035658.141592007@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:54 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ greg@kroah.com
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ linux-wireless@vger.kernel.org,
+ Sujith <Sujith.Manoharan@atheros.com>,
+ "Luis R. Rodriguez" <lrodriguez@atheros.com>
+Subject: [117/151] ath9k: Fix TX hang poll routine
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: Sujith <Sujith.Manoharan@atheros.com>
+
+This is a backport of upstream commit: 332c556633b8c5fb4e890b1783122f2315526590
+
+When TX is hung, the chip is reset. Ensure that
+the chip is awake by using the PS wrappers.
+
+
+Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
+Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/xmit.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2065,7 +2065,9 @@ static void ath_tx_complete_poll_work(st
+
+ if (needreset) {
+ DPRINTF(sc, ATH_DBG_RESET, "tx hung, resetting the chip\n");
++ ath9k_ps_wakeup(sc);
+ ath_reset(sc, false);
++ ath9k_ps_restore(sc);
+ }
+
+ ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work,
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:58 2009
+Message-Id: <20091217035658.273685245@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:55 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ greg@kroah.com
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ linux-wireless@vger.kernel.org,
+ "Luis R. Rodriguez" <lrodriguez@atheros.com>,
+ Vasanthakumar Thiagarajan <vasanth@atheros.com>,
+ Vivek Natarajan <Vivek.Natarajan@atheros.com>
+Subject: [118/151] ath9k: fix processing of TX PS null data frames
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: "Luis R. Rodriguez" <lrodriguez@atheros.com>
+
+This is a backport of upstream commit: e7824a50662f7f79b1a739f705b4d906c31cf221
+
+When mac80211 was telling us to go into Powersave we listened
+and immediately turned RX off. This meant hardware would not
+see the ACKs from the AP we're associated with and hardware
+we'd end up retransmiting the null data frame in a loop
+helplessly.
+
+Fix this by keeping track of the transmitted nullfunc frames
+and only when we are sure the AP has sent back an ACK do we
+go ahead and shut RX off.
+
+
+Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
+Signed-off-by: Vivek Natarajan <Vivek.Natarajan@atheros.com>
+Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/wireless/ath/ath9k/ath9k.h | 3 +++
+ drivers/net/wireless/ath/ath9k/mac.c | 2 ++
+ drivers/net/wireless/ath/ath9k/mac.h | 1 +
+ drivers/net/wireless/ath/ath9k/main.c | 9 ++++++++-
+ drivers/net/wireless/ath/ath9k/xmit.c | 16 ++++++++++++++++
+ 5 files changed, 30 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath9k/ath9k.h
++++ b/drivers/net/wireless/ath/ath9k/ath9k.h
+@@ -139,6 +139,7 @@ struct ath_buf {
+ dma_addr_t bf_daddr; /* physical addr of desc */
+ dma_addr_t bf_buf_addr; /* physical addr of data buffer */
+ bool bf_stale;
++ bool bf_isnullfunc;
+ u16 bf_flags;
+ struct ath_buf_state bf_state;
+ dma_addr_t bf_dmacontext;
+@@ -524,6 +525,8 @@ struct ath_led {
+ #define SC_OP_BEACON_SYNC BIT(19)
+ #define SC_OP_BTCOEX_ENABLED BIT(20)
+ #define SC_OP_BT_PRIORITY_DETECTED BIT(21)
++#define SC_OP_NULLFUNC_COMPLETED BIT(22)
++#define SC_OP_PS_ENABLED BIT(23)
+
+ struct ath_bus_ops {
+ void (*read_cachesize)(struct ath_softc *sc, int *csz);
+--- a/drivers/net/wireless/ath/ath9k/mac.c
++++ b/drivers/net/wireless/ath/ath9k/mac.c
+@@ -222,6 +222,8 @@ int ath9k_hw_txprocdesc(struct ath_hw *a
+ ds->ds_txstat.ts_status = 0;
+ ds->ds_txstat.ts_flags = 0;
+
++ if (ads->ds_txstatus1 & AR_FrmXmitOK)
++ ds->ds_txstat.ts_status |= ATH9K_TX_ACKED;
+ if (ads->ds_txstatus1 & AR_ExcessiveRetries)
+ ds->ds_txstat.ts_status |= ATH9K_TXERR_XRETRY;
+ if (ads->ds_txstatus1 & AR_Filtered)
+--- a/drivers/net/wireless/ath/ath9k/mac.h
++++ b/drivers/net/wireless/ath/ath9k/mac.h
+@@ -76,6 +76,7 @@
+ #define ATH9K_TXERR_FIFO 0x04
+ #define ATH9K_TXERR_XTXOP 0x08
+ #define ATH9K_TXERR_TIMER_EXPIRED 0x10
++#define ATH9K_TX_ACKED 0x20
+
+ #define ATH9K_TX_BA 0x01
+ #define ATH9K_TX_PWRMGMT 0x02
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -2327,6 +2327,7 @@ static int ath9k_config(struct ieee80211
+
+ if (changed & IEEE80211_CONF_CHANGE_PS) {
+ if (conf->flags & IEEE80211_CONF_PS) {
++ sc->sc_flags |= SC_OP_PS_ENABLED;
+ if (!(ah->caps.hw_caps &
+ ATH9K_HW_CAP_AUTOSLEEP)) {
+ if ((sc->imask & ATH9K_INT_TIM_TIMER) == 0) {
+@@ -2334,11 +2335,17 @@ static int ath9k_config(struct ieee80211
+ ath9k_hw_set_interrupts(sc->sc_ah,
+ sc->imask);
+ }
+- ath9k_hw_setrxabort(sc->sc_ah, 1);
+ }
+ sc->ps_enabled = true;
++ if ((sc->sc_flags & SC_OP_NULLFUNC_COMPLETED)) {
++ sc->sc_flags &= ~SC_OP_NULLFUNC_COMPLETED;
++ sc->ps_enabled = true;
++ ath9k_hw_setrxabort(sc->sc_ah, 1);
++ }
+ } else {
+ sc->ps_enabled = false;
++ sc->sc_flags &= ~(SC_OP_PS_ENABLED |
++ SC_OP_NULLFUNC_COMPLETED);
+ ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_AWAKE);
+ if (!(ah->caps.hw_caps &
+ ATH9K_HW_CAP_AUTOSLEEP)) {
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -1592,6 +1592,13 @@ static int ath_tx_setup_buffer(struct ie
+ }
+
+ bf->bf_buf_addr = bf->bf_dmacontext;
++
++ if (ieee80211_is_nullfunc(fc) && ieee80211_has_pm(fc)) {
++ bf->bf_isnullfunc = true;
++ sc->sc_flags &= ~SC_OP_NULLFUNC_COMPLETED;
++ } else
++ bf->bf_isnullfunc = false;
++
+ return 0;
+ }
+
+@@ -1989,6 +1996,15 @@ static void ath_tx_processq(struct ath_s
+ if (ds == txq->axq_gatingds)
+ txq->axq_gatingds = NULL;
+
++ if (bf->bf_isnullfunc &&
++ (ds->ds_txstat.ts_status & ATH9K_TX_ACKED)) {
++ if ((sc->sc_flags & SC_OP_PS_ENABLED)) {
++ sc->ps_enabled = true;
++ ath9k_hw_setrxabort(sc->sc_ah, 1);
++ } else
++ sc->sc_flags |= SC_OP_NULLFUNC_COMPLETED;
++ }
++
+ /*
+ * Remove ath_buf's of the same transmit unit from txq,
+ * however leave the last descriptor back as the holding
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:58 2009
+Message-Id: <20091217035658.407255478@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:56 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ greg@kroah.com
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ linux-wireless@vger.kernel.org,
+ "Luis R. Rodriguez" <lrodriguez@atheros.com>,
+ Kyungwan Nam <kyungwan.nam@atheros.com>,
+ Bennyam Malavazi <bennyam.malavazi@atheros.com>,
+ Stephen Chen <stephen.chen@atheros.com>,
+ Shan Palanisamy <shan.palanisamy@atheros.com>,
+ Paul Shaw <paul.shaw@atheros.com>,
+ Vasanthakumar Thiagarajan <vasanth@atheros.com>
+Subject: [119/151] ath9k: Fix maximum tx fifo settings for single stream devices
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: "Luis R. Rodriguez" <lrodriguez@atheros.com>
+
+This is a backport of upstream commit: f4709fdf683e1ed37b321c258b614ebe39752bf3
+
+Atheros single stream AR9285 and AR9271 have half the PCU TX FIFO
+buffer size of that of dual stream devices. Dual stream devices
+have a max PCU TX FIFO size of 8 KB while single stream devices
+have 4 KB. Single stream devices have an issue though and require
+hardware only to use half of the amount of its capable PCU TX FIFO
+size, 2 KB and this requires a change in software.
+
+Technically a change would not have been required (except for frame
+burst considerations of 128 bytes) if these devices would have been
+able to use the full 4 KB of the PCU TX FIFO size but our systems
+engineers recommend 2 KB to be used only. We enforce this through
+software by reducing the max frame triggger level to 2 KB.
+
+Fixing the max frame trigger level should then have a few benefits:
+
+ * The PER will now be adjusted as designed for underruns when the
+ max trigger level is reached. This should help alleviate the
+ bus as the rate control algorithm chooses a slower rate which
+ should ensure frames are transmitted properly under high system
+ bus load.
+
+ * The poll we use on our TX queues should now trigger and work
+ as designed for single stream devices. The hardware passes
+ data from each TX queue on the PCU TX FIFO queue respecting each
+ queue's priority. The new trigger level ensures this seeding of
+ the PCU TX FIFO queue occurs as designed which could mean avoiding
+ false resets and actually reseting hw correctly when a TX queue
+ is indeed stuck.
+
+ * Some undocumented / unsupported behaviour could have been triggered
+ when the max trigger level level was being set to 4 KB on single
+ stream devices. Its not clear what this issue was to me yet.
+
+Cc: Kyungwan Nam <kyungwan.nam@atheros.com>
+Cc: Bennyam Malavazi <bennyam.malavazi@atheros.com>
+Cc: Stephen Chen <stephen.chen@atheros.com>
+Cc: Shan Palanisamy <shan.palanisamy@atheros.com>
+Cc: Paul Shaw <paul.shaw@atheros.com>
+Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
+Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/wireless/ath/ath9k/hw.c | 11 ++++++++++-
+ drivers/net/wireless/ath/ath9k/hw.h | 1 +
+ drivers/net/wireless/ath/ath9k/mac.c | 4 ++--
+ 3 files changed, 13 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -937,6 +937,11 @@ int ath9k_hw_init(struct ath_hw *ah)
+ DPRINTF(ah->ah_sc, ATH_DBG_RESET, "serialize_regmode is %d\n",
+ ah->config.serialize_regmode);
+
++ if (AR_SREV_9285(ah) || AR_SREV_9271(ah))
++ ah->config.max_txtrig_level = MAX_TX_FIFO_THRESHOLD >> 1;
++ else
++ ah->config.max_txtrig_level = MAX_TX_FIFO_THRESHOLD;
++
+ if (!ath9k_hw_macversion_supported(ah->hw_version.macVersion)) {
+ DPRINTF(ah->ah_sc, ATH_DBG_FATAL,
+ "Mac Chip Rev 0x%02x.%x is not supported by "
+@@ -3670,7 +3675,11 @@ void ath9k_hw_fill_cap_info(struct ath_h
+ pCap->keycache_size = AR_KEYTABLE_SIZE;
+
+ pCap->hw_caps |= ATH9K_HW_CAP_FASTCC;
+- pCap->tx_triglevel_max = MAX_TX_FIFO_THRESHOLD;
++
++ if (AR_SREV_9285(ah) || AR_SREV_9271(ah))
++ pCap->tx_triglevel_max = MAX_TX_FIFO_THRESHOLD >> 1;
++ else
++ pCap->tx_triglevel_max = MAX_TX_FIFO_THRESHOLD;
+
+ if (AR_SREV_9285_10_OR_LATER(ah))
+ pCap->num_gpio_pins = AR9285_NUM_GPIO;
+--- a/drivers/net/wireless/ath/ath9k/hw.h
++++ b/drivers/net/wireless/ath/ath9k/hw.h
+@@ -218,6 +218,7 @@ struct ath9k_ops_config {
+ #define AR_SPUR_FEEQ_BOUND_HT20 10
+ int spurmode;
+ u16 spurchans[AR_EEPROM_MODAL_SPURS][2];
++ u8 max_txtrig_level;
+ };
+
+ enum ath9k_int {
+--- a/drivers/net/wireless/ath/ath9k/mac.c
++++ b/drivers/net/wireless/ath/ath9k/mac.c
+@@ -70,7 +70,7 @@ bool ath9k_hw_updatetxtriglevel(struct a
+ u32 txcfg, curLevel, newLevel;
+ enum ath9k_int omask;
+
+- if (ah->tx_trig_level >= MAX_TX_FIFO_THRESHOLD)
++ if (ah->tx_trig_level >= ah->config.max_txtrig_level)
+ return false;
+
+ omask = ath9k_hw_set_interrupts(ah, ah->mask_reg & ~ATH9K_INT_GLOBAL);
+@@ -79,7 +79,7 @@ bool ath9k_hw_updatetxtriglevel(struct a
+ curLevel = MS(txcfg, AR_FTRIG);
+ newLevel = curLevel;
+ if (bIncTrigLevel) {
+- if (curLevel < MAX_TX_FIFO_THRESHOLD)
++ if (curLevel < ah->config.max_txtrig_level)
+ newLevel++;
+ } else if (curLevel > MIN_TX_FIFO_THRESHOLD)
+ newLevel--;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:58 2009
+Message-Id: <20091217035658.537655213@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:57 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ greg@kroah.com
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ linux-wireless@vger.kernel.org,
+ Felix Fietkau <nbd@openwrt.org>,
+ "Luis R. Rodriguez" <lrodriguez@atheros.com>
+Subject: [120/151] ath9k: fix tx status reporting
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+This is a backport of upstream commit: e8c6342d989e241513baeba4b05a04b6b1f3bc8b
+
+This patch fixes a bug in ath9k's tx status check, which
+caused mac80211 to consider regularly transmitted unicast frames
+as un-acked.
+
+When checking the ts_status field for errors, it needs to be masked
+with ATH9K_TXERR_FILT, because this field also contains other fields
+like ATH9K_TX_ACKED.
+
+Without this patch, AP mode is pretty much unusable, as hostapd
+checks the ACK status for the frames that it injects.
+
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/wireless/ath/ath9k/xmit.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -2020,7 +2020,7 @@ static void ath_tx_processq(struct ath_s
+ if (bf_isaggr(bf))
+ txq->axq_aggr_depth--;
+
+- txok = (ds->ds_txstat.ts_status == 0);
++ txok = !(ds->ds_txstat.ts_status & ATH9K_TXERR_FILT);
+ txq->axq_tx_inprogress = false;
+ spin_unlock_bh(&txq->axq_lock);
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:58 2009
+Message-Id: <20091217035658.668679326@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:58 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ greg@kroah.com
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ linux-wireless@vger.kernel.org,
+ Vivek Natarajan <vnatarajan@atheros.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [121/151] mac80211: Fix dynamic power save for scanning.
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: Vivek Natarajan <vnatarajan@atheros.com>
+
+Upstream commit: 7c3f4bbedc241ddcd3abe1f419c356e625231da1
+
+Not only ps_sdata but also IEEE80211_CONF_PS is to be considered
+before restoring PS in scan_ps_disable(). For instance, when ps_sdata
+is set but CONF_PS is not set just because the dynamic timer is still
+running, a sw scan leads to setting of CONF_PS in scan_ps_disable
+instead of restarting the dynamic PS timer.
+Also for the above case, a null data frame is to be sent after
+returning to operating channel which was not happening with the
+current implementation. This patch fixes this too.
+
+
+Signed-off-by: Vivek Natarajan <vnatarajan@atheros.com>
+Reviewed-by: Kalle Valo <kalle.valo@nokia.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/mac80211/ieee80211_i.h | 1 +
+ net/mac80211/scan.c | 20 ++++++++++++++++----
+ 2 files changed, 17 insertions(+), 4 deletions(-)
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -808,6 +808,7 @@ struct ieee80211_local {
+ unsigned int wmm_acm; /* bit field of ACM bits (BIT(802.1D tag)) */
+
+ bool pspolling;
++ bool scan_ps_enabled;
+ /*
+ * PS can only be enabled when we have exactly one managed
+ * interface (and monitors) in PS, this then points there.
+--- a/net/mac80211/scan.c
++++ b/net/mac80211/scan.c
+@@ -196,7 +196,8 @@ ieee80211_scan_rx(struct ieee80211_sub_i
+ static void ieee80211_scan_ps_enable(struct ieee80211_sub_if_data *sdata)
+ {
+ struct ieee80211_local *local = sdata->local;
+- bool ps = false;
++
++ local->scan_ps_enabled = false;
+
+ /* FIXME: what to do when local->pspolling is true? */
+
+@@ -204,12 +205,13 @@ static void ieee80211_scan_ps_enable(str
+ cancel_work_sync(&local->dynamic_ps_enable_work);
+
+ if (local->hw.conf.flags & IEEE80211_CONF_PS) {
+- ps = true;
++ local->scan_ps_enabled = true;
+ local->hw.conf.flags &= ~IEEE80211_CONF_PS;
+ ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+ }
+
+- if (!ps || !(local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK))
++ if (!(local->scan_ps_enabled) ||
++ !(local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK))
+ /*
+ * If power save was enabled, no need to send a nullfunc
+ * frame because AP knows that we are sleeping. But if the
+@@ -230,7 +232,7 @@ static void ieee80211_scan_ps_disable(st
+
+ if (!local->ps_sdata)
+ ieee80211_send_nullfunc(local, sdata, 0);
+- else {
++ else if (local->scan_ps_enabled) {
+ /*
+ * In !IEEE80211_HW_PS_NULLFUNC_STACK case the hardware
+ * will send a nullfunc frame with the powersave bit set
+@@ -246,6 +248,16 @@ static void ieee80211_scan_ps_disable(st
+ */
+ local->hw.conf.flags |= IEEE80211_CONF_PS;
+ ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
++ } else if (local->hw.conf.dynamic_ps_timeout > 0) {
++ /*
++ * If IEEE80211_CONF_PS was not set and the dynamic_ps_timer
++ * had been running before leaving the operating channel,
++ * restart the timer now and send a nullfunc frame to inform
++ * the AP that we are awake.
++ */
++ ieee80211_send_nullfunc(local, sdata, 0);
++ mod_timer(&local->dynamic_ps_timer, jiffies +
++ msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
+ }
+ }
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:58 2009
+Message-Id: <20091217035658.797276396@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:56:59 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Eric Anholt <eric@anholt.net>,
+ Li Peng <peng.li@intel.com>,
+ Jesse Barnes <jbarnes@virtuousgeek.org>,
+ Stefan Bader <stefan.bader@canonical.com>
+Subject: [122/151] drm/i915: Fix sync to vblank when VGA output is turned off
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+
+From: Li Peng <peng.li@linux.intel.com>
+
+commit 778c902640530371a169ad1c03566e7c51b09874 upstream
+
+In current vblank-wait implementation, if we turn off VGA output,
+drm_wait_vblank will still wait on the disabled pipe until timeout,
+because vblank on the pipe is assumed be enabled. This would cause
+slow system response on some system such as moblin.
+
+This patch resolve the issue by adding a drm helper function
+drm_vblank_off which explicitly clear vblank_enabled[crtc], wake up
+any waiting queue and save last vblank counter before turning off
+crtc. It also slightly change drm_vblank_get to ensure that we will
+will return immediately if trying to wait on a disabled pipe.
+
+Signed-off-by: Li Peng <peng.li@intel.com>
+Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+[anholt: hand-applied for conflicts with overlay changes]
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Cc: Stefan Bader <stefan.bader@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/gpu/drm/drm_irq.c | 34 ++++++++++++++++++++++++++--------
+ drivers/gpu/drm/i915/intel_display.c | 1 +
+ include/drm/drmP.h | 1 +
+ 3 files changed, 28 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/drm_irq.c
++++ b/drivers/gpu/drm/drm_irq.c
+@@ -429,15 +429,21 @@ int drm_vblank_get(struct drm_device *de
+
+ spin_lock_irqsave(&dev->vbl_lock, irqflags);
+ /* Going from 0->1 means we have to enable interrupts again */
+- if (atomic_add_return(1, &dev->vblank_refcount[crtc]) == 1 &&
+- !dev->vblank_enabled[crtc]) {
+- ret = dev->driver->enable_vblank(dev, crtc);
+- DRM_DEBUG("enabling vblank on crtc %d, ret: %d\n", crtc, ret);
+- if (ret)
++ if (atomic_add_return(1, &dev->vblank_refcount[crtc]) == 1) {
++ if (!dev->vblank_enabled[crtc]) {
++ ret = dev->driver->enable_vblank(dev, crtc);
++ DRM_DEBUG("enabling vblank on crtc %d, ret: %d\n", crtc, ret);
++ if (ret)
++ atomic_dec(&dev->vblank_refcount[crtc]);
++ else {
++ dev->vblank_enabled[crtc] = 1;
++ drm_update_vblank_count(dev, crtc);
++ }
++ }
++ } else {
++ if (!dev->vblank_enabled[crtc]) {
+ atomic_dec(&dev->vblank_refcount[crtc]);
+- else {
+- dev->vblank_enabled[crtc] = 1;
+- drm_update_vblank_count(dev, crtc);
++ ret = -EINVAL;
+ }
+ }
+ spin_unlock_irqrestore(&dev->vbl_lock, irqflags);
+@@ -464,6 +470,18 @@ void drm_vblank_put(struct drm_device *d
+ }
+ EXPORT_SYMBOL(drm_vblank_put);
+
++void drm_vblank_off(struct drm_device *dev, int crtc)
++{
++ unsigned long irqflags;
++
++ spin_lock_irqsave(&dev->vbl_lock, irqflags);
++ DRM_WAKEUP(&dev->vbl_queue[crtc]);
++ dev->vblank_enabled[crtc] = 0;
++ dev->last_vblank[crtc] = dev->driver->get_vblank_counter(dev, crtc);
++ spin_unlock_irqrestore(&dev->vbl_lock, irqflags);
++}
++EXPORT_SYMBOL(drm_vblank_off);
++
+ /**
+ * drm_vblank_pre_modeset - account for vblanks across mode sets
+ * @dev: DRM device
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -1845,6 +1845,7 @@ static void i9xx_crtc_dpms(struct drm_cr
+ intel_update_watermarks(dev);
+ /* Give the overlay scaler a chance to disable if it's on this pipe */
+ //intel_crtc_dpms_video(crtc, FALSE); TODO
++ drm_vblank_off(dev, pipe);
+
+ if (dev_priv->cfb_plane == plane &&
+ dev_priv->display.disable_fbc)
+--- a/include/drm/drmP.h
++++ b/include/drm/drmP.h
+@@ -1295,6 +1295,7 @@ extern u32 drm_vblank_count(struct drm_d
+ extern void drm_handle_vblank(struct drm_device *dev, int crtc);
+ extern int drm_vblank_get(struct drm_device *dev, int crtc);
+ extern void drm_vblank_put(struct drm_device *dev, int crtc);
++extern void drm_vblank_off(struct drm_device *dev, int crtc);
+ extern void drm_vblank_cleanup(struct drm_device *dev);
+ /* Modesetting support */
+ extern void drm_vblank_pre_modeset(struct drm_device *dev, int crtc);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:59 2009
+Message-Id: <20091217035658.924129678@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:00 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Kirill A. Shutemov" <kirill@shutemov.name>,
+ KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Subject: [123/151] memcg: fix memory.memsw.usage_in_bytes for root cgroup
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Kirill A. Shutemov <kirill@shutemov.name>
+
+commit cd9b45b78a61e8df250e69385c74e729e5b66abf upstream.
+
+A memory cgroup has a memory.memsw.usage_in_bytes file. It shows the sum
+of the usage of pages and swapents in the cgroup. Presently the root
+cgroup's memsw.usage_in_bytes shows the wrong value - the number of
+swapents are not added.
+
+So take MEM_CGROUP_STAT_SWAPOUT into account.
+
+Signed-off-by: Kirill A. Shutemov <kirill@shutemov.name>
+Reviewed-by: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
+Acked-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/memcontrol.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -2541,6 +2541,7 @@ static u64 mem_cgroup_read(struct cgroup
+ val += idx_val;
+ mem_cgroup_get_recursive_idx_stat(mem,
+ MEM_CGROUP_STAT_SWAPOUT, &idx_val);
++ val += idx_val;
+ val <<= PAGE_SHIFT;
+ } else
+ val = res_counter_read_u64(&mem->memsw, name);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:59 2009
+Message-Id: <20091217035659.056372096@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:01 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Henrique de Moraes Holschuh <hmh@hmh.eng.br>,
+ Len Brown <len.brown@intel.com>
+Subject: [124/151] thinkpad-acpi: fix default brightness_mode for R50e/R51
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+
+commit a9f8eacca4e9e8693de9b896c1fa7aadaa9402e8 upstream.
+
+According to a report, the R50e wants EC-based brightness control,
+even if it uses an Intel GPU. The current driver default was reported
+to not work at all.
+
+This bug can be worked around by the "brightness_mode=3" module
+parameter.
+
+Change the default of the R50e and R51 2xxx models (which use the same
+EC firmware, 1V) to TPACPI_BRGHT_Q_EC, but keep TPACPI_BRGHT_Q_ASK set
+for now, as I'd like to get more reports.
+
+This fixes a regression caused by commit
+59fe4fe34d7afdf63208124f313be9056feaa2f4,
+"thinkpad-acpi: fix incorrect use of TPACPI_BRGHT_MODE_ECNVRAM"
+
+Kernel 2.6.31 also needs this fix.
+
+Reported-by: Ferenc Wagner <wferi@niif.hu>
+Tested-by: Ferenc Wagner <wferi@niif.hu>
+Signed-off-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Cc: stable@kernel.org
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/thinkpad_acpi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -6123,8 +6123,8 @@ static const struct tpacpi_quirk brightn
+
+ /* Models with Intel Extreme Graphics 2 */
+ TPACPI_Q_IBM('1', 'U', TPACPI_BRGHT_Q_NOEC),
+- TPACPI_Q_IBM('1', 'V', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_NOEC),
+- TPACPI_Q_IBM('1', 'W', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_NOEC),
++ TPACPI_Q_IBM('1', 'V', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
++ TPACPI_Q_IBM('1', 'W', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
+
+ /* Models with Intel GMA900 */
+ TPACPI_Q_IBM('7', '0', TPACPI_BRGHT_Q_NOEC), /* T43, R52 */
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:59 2009
+Message-Id: <20091217035659.186337280@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:02 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Henrique de Moraes Holschuh <hmh@hmh.eng.br>,
+ Len Brown <len.brown@intel.com>
+Subject: [125/151] thinkpad-acpi: preserve rfkill state across suspend/resume
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+
+commit 208b996b6c460285650d39b2330f8ef82c007d10 upstream.
+
+Since the rfkill rework in 2.6.31, the driver is always resuming with
+the radios disabled.
+
+Change thinkpad-acpi to ask the firmware to resume with the radios in
+the last state. This fixes the Bluetooth and WWAN rfkill switches.
+
+Note that it means we respect the firmware's oddities. Should the
+user toggle the hardware rfkill switch on and off, it might cause the
+radios to resume enabled.
+
+UWB is an unknown quantity since it has nowhere the same level of
+firmware support (no control over state storage in NVRAM, for
+example), and might need further fixing. Testers welcome.
+
+This change fixes a regression from 2.6.30.
+
+Reported-by: Jerone Young <jerone.young@canonical.com>
+Reported-by: Ian Molton <ian.molton@collabora.co.uk>
+Signed-off-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Tested-by: Ian Molton <ian.molton@collabora.co.uk>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/thinkpad_acpi.c | 32 +++++---------------------------
+ 1 file changed, 5 insertions(+), 27 deletions(-)
+
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -3866,15 +3866,6 @@ enum {
+
+ #define TPACPI_RFK_BLUETOOTH_SW_NAME "tpacpi_bluetooth_sw"
+
+-static void bluetooth_suspend(pm_message_t state)
+-{
+- /* Try to make sure radio will resume powered off */
+- if (!acpi_evalf(NULL, NULL, "\\BLTH", "vd",
+- TP_ACPI_BLTH_PWR_OFF_ON_RESUME))
+- vdbg_printk(TPACPI_DBG_RFKILL,
+- "bluetooth power down on resume request failed\n");
+-}
+-
+ static int bluetooth_get_status(void)
+ {
+ int status;
+@@ -3908,10 +3899,9 @@ static int bluetooth_set_status(enum tpa
+ #endif
+
+ /* We make sure to keep TP_ACPI_BLUETOOTH_RESUMECTRL off */
++ status = TP_ACPI_BLUETOOTH_RESUMECTRL;
+ if (state == TPACPI_RFK_RADIO_ON)
+- status = TP_ACPI_BLUETOOTH_RADIOSSW;
+- else
+- status = 0;
++ status |= TP_ACPI_BLUETOOTH_RADIOSSW;
+
+ if (!acpi_evalf(hkey_handle, NULL, "SBDC", "vd", status))
+ return -EIO;
+@@ -4050,7 +4040,6 @@ static struct ibm_struct bluetooth_drive
+ .read = bluetooth_read,
+ .write = bluetooth_write,
+ .exit = bluetooth_exit,
+- .suspend = bluetooth_suspend,
+ .shutdown = bluetooth_shutdown,
+ };
+
+@@ -4068,15 +4057,6 @@ enum {
+
+ #define TPACPI_RFK_WWAN_SW_NAME "tpacpi_wwan_sw"
+
+-static void wan_suspend(pm_message_t state)
+-{
+- /* Try to make sure radio will resume powered off */
+- if (!acpi_evalf(NULL, NULL, "\\WGSV", "qvd",
+- TP_ACPI_WGSV_PWR_OFF_ON_RESUME))
+- vdbg_printk(TPACPI_DBG_RFKILL,
+- "WWAN power down on resume request failed\n");
+-}
+-
+ static int wan_get_status(void)
+ {
+ int status;
+@@ -4109,11 +4089,10 @@ static int wan_set_status(enum tpacpi_rf
+ }
+ #endif
+
+- /* We make sure to keep TP_ACPI_WANCARD_RESUMECTRL off */
++ /* We make sure to set TP_ACPI_WANCARD_RESUMECTRL */
++ status = TP_ACPI_WANCARD_RESUMECTRL;
+ if (state == TPACPI_RFK_RADIO_ON)
+- status = TP_ACPI_WANCARD_RADIOSSW;
+- else
+- status = 0;
++ status |= TP_ACPI_WANCARD_RADIOSSW;
+
+ if (!acpi_evalf(hkey_handle, NULL, "SWAN", "vd", status))
+ return -EIO;
+@@ -4251,7 +4230,6 @@ static struct ibm_struct wan_driver_data
+ .read = wan_read,
+ .write = wan_write,
+ .exit = wan_exit,
+- .suspend = wan_suspend,
+ .shutdown = wan_shutdown,
+ };
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:59 2009
+Message-Id: <20091217035659.320476787@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:03 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ WANG Cong <amwang@redhat.com>,
+ Ingo Molnar <mingo@elte.hu>,
+ Peter Zijlstra <a.p.zijlstra@chello.nl>,
+ James Morris <jmorris@namei.org>,
+ Alexey Dobriyan <adobriyan@gmail.com>
+Subject: [126/151] sysctl_max_map_count should be non-negative
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Amerigo Wang <amwang@redhat.com>
+
+commit 70da2340fbc68e91e701762f785479ab495a0869 upstream.
+
+Jan Engelhardt reported we have this problem:
+
+setting max_map_count to a value large enough results in programs dying at
+first try. This is on 2.6.31.6:
+
+15:59 borg:/proc/sys/vm # echo $[1<<31-1] >max_map_count
+15:59 borg:/proc/sys/vm # cat max_map_count
+1073741824
+15:59 borg:/proc/sys/vm # echo $[1<<31] >max_map_count
+15:59 borg:/proc/sys/vm # cat max_map_count
+Killed
+
+This is because we have a chance to make 'max_map_count' negative. but
+it's meaningless. Make it only accept non-negative values.
+
+Reported-by: Jan Engelhardt <jengelh@medozas.de>
+Signed-off-by: WANG Cong <amwang@redhat.com>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: James Morris <jmorris@namei.org>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/sysctl.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -1605,7 +1605,8 @@ static struct ctl_table debug_table[] =
+ .data = &show_unhandled_signals,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+- .proc_handler = proc_dointvec
++ .proc_handler = proc_dointvec,
++ .extra1 = &zero,
+ },
+ #endif
+ { .ctl_name = 0 }
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:59 2009
+Message-Id: <20091217035659.451631921@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:04 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Zhu Yi <yi.zhu@intel.com>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [127/151] ipw2100: fix rebooting hang with driver loaded
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Zhu Yi <yi.zhu@intel.com>
+
+commit 52ce3e9a7db754b78cf2cbabc87013f921b25b28 upstream.
+
+Add PCI .shutdown method so that we can disable the device during
+shutdown or reboot. Without this, the reboot doesn't work well on
+some platforms.
+
+This fixes http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2124
+
+Tested-by: pablo <pablolm2005@gmail.com>
+Signed-off-by: Zhu Yi <yi.zhu@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ipw2x00/ipw2100.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/net/wireless/ipw2x00/ipw2100.c
++++ b/drivers/net/wireless/ipw2x00/ipw2100.c
+@@ -6487,6 +6487,16 @@ static int ipw2100_resume(struct pci_dev
+ }
+ #endif
+
++static void ipw2100_shutdown(struct pci_dev *pci_dev)
++{
++ struct ipw2100_priv *priv = pci_get_drvdata(pci_dev);
++
++ /* Take down the device; powers it off, etc. */
++ ipw2100_down(priv);
++
++ pci_disable_device(pci_dev);
++}
++
+ #define IPW2100_DEV_ID(x) { PCI_VENDOR_ID_INTEL, 0x1043, 0x8086, x }
+
+ static struct pci_device_id ipw2100_pci_id_table[] __devinitdata = {
+@@ -6550,6 +6560,7 @@ static struct pci_driver ipw2100_pci_dri
+ .suspend = ipw2100_suspend,
+ .resume = ipw2100_resume,
+ #endif
++ .shutdown = ipw2100_shutdown,
+ };
+
+ /**
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:59 2009
+Message-Id: <20091217035659.581597734@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:05 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Cox <alan@linux.intel.com>,
+ Petr Vandrovec <VANDROVE@vc.cvut.cz>,
+ Pekka Enberg <penberg@cs.helsinki.fi>,
+ "Paul A. Clarke" <pc@us.ibm.com>
+Subject: [128/151] matroxfb: fix problems with display stability
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Alan Cox <alan@linux.intel.com>
+
+commit 8c651311a3a08c1e4815de6933e00a760e498dae upstream.
+
+Regression caused in 2.6.23 and then despite repeated requests never fixed
+or dealt with (Petr promised to sort it in 2008 but seems to have
+forgotten).
+
+Enough is enough - remove the problem line that was added. If it upsets
+someone they've had two years to deal with it and at the very least it'll
+rattle their cage and wake them up.
+
+Addresses http://bugzilla.kernel.org/show_bug.cgi?id=9709
+
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Reported-by: Damon <account@bugzilla.kernel.org.juxtaposition.net>
+Tested-by: Ruud van Melick <rvm1974@raketnet.nl>
+Cc: Petr Vandrovec <VANDROVE@vc.cvut.cz>
+Cc: Pekka Enberg <penberg@cs.helsinki.fi>
+Cc: Paul A. Clarke <pc@us.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/matrox/g450_pll.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/video/matrox/g450_pll.c
++++ b/drivers/video/matrox/g450_pll.c
+@@ -368,7 +368,8 @@ static int __g450_setclk(struct matrox_f
+ M1064_XDVICLKCTRL_C1DVICLKEN |
+ M1064_XDVICLKCTRL_DVILOOPCTL |
+ M1064_XDVICLKCTRL_P1LOOPBWDTCTL;
+- matroxfb_DAC_out(minfo, M1064_XDVICLKCTRL, tmp);
++ /* Setting this breaks PC systems so don't do it */
++ /* matroxfb_DAC_out(minfo, M1064_XDVICLKCTRL, tmp); */
+ matroxfb_DAC_out(minfo, M1064_XPWRCTRL,
+ xpwrctrl);
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:59 2009
+Message-Id: <20091217035659.715358564@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:06 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Peter Feuerer <peter@piie.net>,
+ Borislav Petkov <petkovbb@gmail.com>,
+ Andreas Mohr <andi@lisas.de>,
+ Len Brown <len.brown@intel.com>
+Subject: [129/151] acerhdf: add new BIOS versions
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Peter Feuerer <peter@piie.net>
+
+commit 360657463679dee44f0b167ffa61f563b4fee101 upstream.
+
+Added new BIOS versions for following netbooks: Acer 1410, Gateway LT31,
+Packard Bell DOA150. As the Gateway LT31 machines have different register
+values for setting and checking the off-state, the "cmd_off" variable has
+been splitted up to "cmd_off" and "chk_off".
+
+Signed-off-by: Peter Feuerer <peter@piie.net>
+Cc: Borislav Petkov <petkovbb@gmail.com>
+Cc: Andreas Mohr <andi@lisas.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/acerhdf.c | 63 ++++++++++++++++++++++++-----------------
+ 1 file changed, 37 insertions(+), 26 deletions(-)
+
+--- a/drivers/platform/x86/acerhdf.c
++++ b/drivers/platform/x86/acerhdf.c
+@@ -52,7 +52,7 @@
+ */
+ #undef START_IN_KERNEL_MODE
+
+-#define DRV_VER "0.5.18"
++#define DRV_VER "0.5.20"
+
+ /*
+ * According to the Atom N270 datasheet,
+@@ -112,12 +112,14 @@ module_param_string(force_product, force
+ MODULE_PARM_DESC(force_product, "Force BIOS product and omit BIOS check");
+
+ /*
+- * cmd_off: to switch the fan completely off / to check if the fan is off
++ * cmd_off: to switch the fan completely off
++ * chk_off: to check if the fan is off
+ * cmd_auto: to set the BIOS in control of the fan. The BIOS regulates then
+ * the fan speed depending on the temperature
+ */
+ struct fancmd {
+ u8 cmd_off;
++ u8 chk_off;
+ u8 cmd_auto;
+ };
+
+@@ -134,32 +136,41 @@ struct bios_settings_t {
+ /* Register addresses and values for different BIOS versions */
+ static const struct bios_settings_t bios_tbl[] = {
+ /* AOA110 */
+- {"Acer", "AOA110", "v0.3109", 0x55, 0x58, {0x1f, 0x00} },
+- {"Acer", "AOA110", "v0.3114", 0x55, 0x58, {0x1f, 0x00} },
+- {"Acer", "AOA110", "v0.3301", 0x55, 0x58, {0xaf, 0x00} },
+- {"Acer", "AOA110", "v0.3304", 0x55, 0x58, {0xaf, 0x00} },
+- {"Acer", "AOA110", "v0.3305", 0x55, 0x58, {0xaf, 0x00} },
+- {"Acer", "AOA110", "v0.3307", 0x55, 0x58, {0xaf, 0x00} },
+- {"Acer", "AOA110", "v0.3308", 0x55, 0x58, {0x21, 0x00} },
+- {"Acer", "AOA110", "v0.3309", 0x55, 0x58, {0x21, 0x00} },
+- {"Acer", "AOA110", "v0.3310", 0x55, 0x58, {0x21, 0x00} },
++ {"Acer", "AOA110", "v0.3109", 0x55, 0x58, {0x1f, 0x1f, 0x00} },
++ {"Acer", "AOA110", "v0.3114", 0x55, 0x58, {0x1f, 0x1f, 0x00} },
++ {"Acer", "AOA110", "v0.3301", 0x55, 0x58, {0xaf, 0xaf, 0x00} },
++ {"Acer", "AOA110", "v0.3304", 0x55, 0x58, {0xaf, 0xaf, 0x00} },
++ {"Acer", "AOA110", "v0.3305", 0x55, 0x58, {0xaf, 0xaf, 0x00} },
++ {"Acer", "AOA110", "v0.3307", 0x55, 0x58, {0xaf, 0xaf, 0x00} },
++ {"Acer", "AOA110", "v0.3308", 0x55, 0x58, {0x21, 0x21, 0x00} },
++ {"Acer", "AOA110", "v0.3309", 0x55, 0x58, {0x21, 0x21, 0x00} },
++ {"Acer", "AOA110", "v0.3310", 0x55, 0x58, {0x21, 0x21, 0x00} },
+ /* AOA150 */
+- {"Acer", "AOA150", "v0.3114", 0x55, 0x58, {0x20, 0x00} },
+- {"Acer", "AOA150", "v0.3301", 0x55, 0x58, {0x20, 0x00} },
+- {"Acer", "AOA150", "v0.3304", 0x55, 0x58, {0x20, 0x00} },
+- {"Acer", "AOA150", "v0.3305", 0x55, 0x58, {0x20, 0x00} },
+- {"Acer", "AOA150", "v0.3307", 0x55, 0x58, {0x20, 0x00} },
+- {"Acer", "AOA150", "v0.3308", 0x55, 0x58, {0x20, 0x00} },
+- {"Acer", "AOA150", "v0.3309", 0x55, 0x58, {0x20, 0x00} },
+- {"Acer", "AOA150", "v0.3310", 0x55, 0x58, {0x20, 0x00} },
++ {"Acer", "AOA150", "v0.3114", 0x55, 0x58, {0x20, 0x20, 0x00} },
++ {"Acer", "AOA150", "v0.3301", 0x55, 0x58, {0x20, 0x20, 0x00} },
++ {"Acer", "AOA150", "v0.3304", 0x55, 0x58, {0x20, 0x20, 0x00} },
++ {"Acer", "AOA150", "v0.3305", 0x55, 0x58, {0x20, 0x20, 0x00} },
++ {"Acer", "AOA150", "v0.3307", 0x55, 0x58, {0x20, 0x20, 0x00} },
++ {"Acer", "AOA150", "v0.3308", 0x55, 0x58, {0x20, 0x20, 0x00} },
++ {"Acer", "AOA150", "v0.3309", 0x55, 0x58, {0x20, 0x20, 0x00} },
++ {"Acer", "AOA150", "v0.3310", 0x55, 0x58, {0x20, 0x20, 0x00} },
++ /* Acer 1410 */
++ {"Acer", "Aspire 1410", "v0.3120", 0x55, 0x58, {0x9e, 0x9e, 0x00} },
+ /* special BIOS / other */
+- {"Gateway", "AOA110", "v0.3103", 0x55, 0x58, {0x21, 0x00} },
+- {"Gateway", "AOA150", "v0.3103", 0x55, 0x58, {0x20, 0x00} },
+- {"Packard Bell", "DOA150", "v0.3104", 0x55, 0x58, {0x21, 0x00} },
+- {"Packard Bell", "AOA110", "v0.3105", 0x55, 0x58, {0x21, 0x00} },
+- {"Packard Bell", "AOA150", "v0.3105", 0x55, 0x58, {0x20, 0x00} },
++ {"Gateway", "AOA110", "v0.3103", 0x55, 0x58, {0x21, 0x21, 0x00} },
++ {"Gateway", "AOA150", "v0.3103", 0x55, 0x58, {0x20, 0x20, 0x00} },
++ {"Gateway ", "LT31 ", "v1.3103 ", 0x55, 0x58,
++ {0x10, 0x0f, 0x00} },
++ {"Gateway ", "LT31 ", "v1.3201 ", 0x55, 0x58,
++ {0x10, 0x0f, 0x00} },
++ {"Gateway ", "LT31 ", "v1.3302 ", 0x55, 0x58,
++ {0x10, 0x0f, 0x00} },
++ {"Packard Bell", "DOA150", "v0.3104", 0x55, 0x58, {0x21, 0x21, 0x00} },
++ {"Packard Bell", "DOA150", "v0.3105", 0x55, 0x58, {0x20, 0x20, 0x00} },
++ {"Packard Bell", "AOA110", "v0.3105", 0x55, 0x58, {0x21, 0x21, 0x00} },
++ {"Packard Bell", "AOA150", "v0.3105", 0x55, 0x58, {0x20, 0x20, 0x00} },
+ /* pewpew-terminator */
+- {"", "", "", 0, 0, {0, 0} }
++ {"", "", "", 0, 0, {0, 0, 0} }
+ };
+
+ static const struct bios_settings_t *bios_cfg __read_mostly;
+@@ -183,7 +194,7 @@ static int acerhdf_get_fanstate(int *sta
+ if (ec_read(bios_cfg->fanreg, &fan))
+ return -EINVAL;
+
+- if (fan != bios_cfg->cmd.cmd_off)
++ if (fan != bios_cfg->cmd.chk_off)
+ *state = ACERHDF_FAN_AUTO;
+ else
+ *state = ACERHDF_FAN_OFF;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:56:59 2009
+Message-Id: <20091217035659.846589056@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:07 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Thomas Renninger <trenn@suse.de>,
+ =?ISO-8859-15?q?Peter=20K=C3=BCppers?= <peter-mailbox@web.de>,
+ Michael Franzl <michaelfranzl@gmx.at>,
+ Ian Turner <vectro@vectro.org>,
+ Corentin Chary <corentincj@iksaif.net>,
+ Len Brown <len.brown@intel.com>
+Subject: [130/151] asus-laptop: change light sens default values.
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Corentin Chary <corentincj@iksaif.net>
+
+commit d951d4cc84e8b5ddb8e0ab81cf6a72cc73fdd668 upstream.
+
+The light sensor disable brightness key and
+/sys/class/backlight/ control. There was a lot of report
+from users who didn't understand why they couldn't change their
+brightness, including:
+
+https://bugs.launchpad.net/bugs/222171
+https://bugzilla.novell.com/show_bug.cgi?id=514747
+http://bugzilla.kernel.org/show_bug.cgi?id=13671
+http://bugzilla.kernel.org/show_bug.cgi?id=14432
+
+Now the light sensor is disabled, and if the user want to enable
+it, the level should be ok.
+
+The funny thing is that comments where ok, not code.
+
+Cc: stable@kernel.org
+Cc: Thomas Renninger <trenn@suse.de>
+Cc: Peter Küppers <peter-mailbox@web.de>
+Cc: Michael Franzl <michaelfranzl@gmx.at>
+Cc: Ian Turner <vectro@vectro.org>
+Signed-off-by: Corentin Chary <corentincj@iksaif.net>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/asus-laptop.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/platform/x86/asus-laptop.c
++++ b/drivers/platform/x86/asus-laptop.c
+@@ -1283,8 +1283,8 @@ static int asus_hotk_add(struct acpi_dev
+ hotk->ledd_status = 0xFFF;
+
+ /* Set initial values of light sensor and level */
+- hotk->light_switch = 1; /* Default to light sensor disabled */
+- hotk->light_level = 0; /* level 5 for sensor sensitivity */
++ hotk->light_switch = 0; /* Default to light sensor disabled */
++ hotk->light_level = 5; /* level 5 for sensor sensitivity */
+
+ if (ls_switch_handle)
+ set_light_sens_switch(hotk->light_switch);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:57:00 2009
+Message-Id: <20091217035659.980303721@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:08 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ tony.luck@intel.com,
+ linux-ia64@vger.kernel.org,
+ Jan Beulich <JBeulich@novell.com>,
+ linux-mm@kvack.org,
+ Geert Uytterhoeven <geert@linux-m68k.org>,
+ Tejun Heo <tj@kernel.org>
+Subject: [131/151] vmalloc: conditionalize build of pcpu_get_vm_areas()
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Tejun Heo <teheo@novell.com>
+
+No matching upstream commit as it was resolved differently there.
+
+
+pcpu_get_vm_areas() is used only when dynamic percpu allocator is used
+by the architecture. In 2.6.32, ia64 doesn't use dynamic percpu
+allocator and has a macro which makes pcpu_get_vm_areas() buggy via
+local/global variable aliasing and triggers compile warning.
+
+The problem is fixed in upstream and ia64 uses dynamic percpu
+allocators, so the only left issue is inclusion of unnecessary code
+and compile warning on ia64 on 2.6.32.
+
+Don't build pcpu_get_vm_areas() if legacy percpu allocator is in use.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Jan Beulich <JBeulich@novell.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/vmalloc.h | 2 ++
+ mm/vmalloc.c | 2 ++
+ 2 files changed, 4 insertions(+)
+
+--- a/include/linux/vmalloc.h
++++ b/include/linux/vmalloc.h
+@@ -115,9 +115,11 @@ extern rwlock_t vmlist_lock;
+ extern struct vm_struct *vmlist;
+ extern __init void vm_area_register_early(struct vm_struct *vm, size_t align);
+
++#ifndef CONFIG_HAVE_LEGACY_PER_CPU_AREA
+ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets,
+ const size_t *sizes, int nr_vms,
+ size_t align, gfp_t gfp_mask);
++#endif
+
+ void pcpu_free_vm_areas(struct vm_struct **vms, int nr_vms);
+
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -1993,6 +1993,7 @@ void free_vm_area(struct vm_struct *area
+ }
+ EXPORT_SYMBOL_GPL(free_vm_area);
+
++#ifndef CONFIG_HAVE_LEGACY_PER_CPU_AREA
+ static struct vmap_area *node_to_va(struct rb_node *n)
+ {
+ return n ? rb_entry(n, struct vmap_area, rb_node) : NULL;
+@@ -2257,6 +2258,7 @@ err_free:
+ kfree(vms);
+ return NULL;
+ }
++#endif
+
+ /**
+ * pcpu_free_vm_areas - free vmalloc areas for percpu allocator
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:57:00 2009
+Message-Id: <20091217035700.108658513@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:09 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Zhao Yakui <yakui.zhao@intel.com>,
+ Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>,
+ Len Brown <len.brown@intel.com>
+Subject: [132/151] ACPI: Use the ARB_DISABLE for the CPU which model id is less than 0x0f.
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Zhao Yakui <yakui.zhao@intel.com>
+
+commit 03a05ed1152944000151d57b71000de287a1eb02 upstream.
+
+Currently, ARB_DISABLE is a NOP on all of the recent Intel platforms.
+For such platforms, reduce contention on c3_lock by skipping the fake
+ARB_DISABLE.
+
+The cpu model id on one laptop is 14. If we disable ARB_DISABLE on this box,
+the box can't be booted correctly. But if we still enable ARB_DISABLE on this
+box, the box can be booted correctly.
+
+So we still use the ARB_DISABLE for the cpu which mode id is less than 0x0f.
+
+http://bugzilla.kernel.org/show_bug.cgi?id=14700
+
+Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
+Acked-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/acpi/cstate.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/acpi/cstate.c
++++ b/arch/x86/kernel/acpi/cstate.c
+@@ -48,7 +48,7 @@ void acpi_processor_power_init_bm_check(
+ * P4, Core and beyond CPUs
+ */
+ if (c->x86_vendor == X86_VENDOR_INTEL &&
+- (c->x86 > 0xf || (c->x86 == 6 && c->x86_model >= 14)))
++ (c->x86 > 0xf || (c->x86 == 6 && c->x86_model >= 0x0f)))
+ flags->bm_control = 0;
+ }
+ EXPORT_SYMBOL(acpi_processor_power_init_bm_check);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:57:00 2009
+Message-Id: <20091217035700.235380354@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:10 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ David Miller <davem@davemloft.net>
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ netdev@vger.kernel.org,
+ marcel@holtmann.org,
+ "Eric W. Biederman" <ebiederm@aristanetworks.com>
+Subject: [133/151] net: Fix userspace RTM_NEWLINK notifications.
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+commit d90a909e1f3e006a1d57fe11fd417173b6494701 upstream.
+
+I received some bug reports about userspace programs having problems
+because after RTM_NEWLINK was received they could not immeidate
+access files under /proc/sys/net/ because they had not been
+registered yet.
+
+The problem was trivailly fixed by moving the userspace
+notification from rtnetlink_event to the end of register_netdevice.
+
+Signed-off-by: Eric W. Biederman <ebiederm@aristanetworks.com>
+Cc: David Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/core/dev.c | 11 +++++++++++
+ net/core/rtnetlink.c | 4 +---
+ 2 files changed, 12 insertions(+), 3 deletions(-)
+
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4860,6 +4860,11 @@ int register_netdevice(struct net_device
+ rollback_registered(dev);
+ dev->reg_state = NETREG_UNREGISTERED;
+ }
++ /*
++ * Prevent userspace races by waiting until the network
++ * device is fully setup before sending notifications.
++ */
++ rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U);
+
+ out:
+ return ret;
+@@ -5398,6 +5403,12 @@ int dev_change_net_namespace(struct net_
+ /* Notify protocols, that a new device appeared. */
+ call_netdevice_notifiers(NETDEV_REGISTER, dev);
+
++ /*
++ * Prevent userspace races by waiting until the network
++ * device is fully setup before sending notifications.
++ */
++ rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U);
++
+ synchronize_net();
+ err = 0;
+ out:
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -1334,13 +1334,11 @@ static int rtnetlink_event(struct notifi
+ case NETDEV_UNREGISTER:
+ rtmsg_ifinfo(RTM_DELLINK, dev, ~0U);
+ break;
+- case NETDEV_REGISTER:
+- rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U);
+- break;
+ case NETDEV_UP:
+ case NETDEV_DOWN:
+ rtmsg_ifinfo(RTM_NEWLINK, dev, IFF_UP|IFF_RUNNING);
+ break;
++ case NETDEV_REGISTER:
+ case NETDEV_CHANGE:
+ case NETDEV_GOING_DOWN:
+ break;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:57:00 2009
+Message-Id: <20091217035700.373342675@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:11 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jan Kara <jack@suse.cz>
+Subject: [134/151] ext3: Fix data / filesystem corruption when write fails to copy data
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jan Kara <jack@suse.cz>
+
+commit 68eb3db08344286733adac48304d9fb7a0e53b27 upstream.
+
+When ext3_write_begin fails after allocating some blocks or
+generic_perform_write fails to copy data to write, we truncate blocks already
+instantiated beyond i_size. Although these blocks were never inside i_size, we
+have to truncate pagecache of these blocks so that corresponding buffers get
+unmapped. Otherwise subsequent __block_prepare_write (called because we are
+retrying the write) will find the buffers mapped, not call ->get_block, and
+thus the page will be backed by already freed blocks leading to filesystem and
+data corruption.
+
+Reported-by: James Y Knight <foom@fuhm.net>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ext3/inode.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+--- a/fs/ext3/inode.c
++++ b/fs/ext3/inode.c
+@@ -1151,6 +1151,16 @@ static int do_journal_get_write_access(h
+ return ext3_journal_get_write_access(handle, bh);
+ }
+
++/*
++ * Truncate blocks that were not used by write. We have to truncate the
++ * pagecache as well so that corresponding buffers get properly unmapped.
++ */
++static void ext3_truncate_failed_write(struct inode *inode)
++{
++ truncate_inode_pages(inode->i_mapping, inode->i_size);
++ ext3_truncate(inode);
++}
++
+ static int ext3_write_begin(struct file *file, struct address_space *mapping,
+ loff_t pos, unsigned len, unsigned flags,
+ struct page **pagep, void **fsdata)
+@@ -1209,7 +1219,7 @@ write_begin_failed:
+ unlock_page(page);
+ page_cache_release(page);
+ if (pos + len > inode->i_size)
+- ext3_truncate(inode);
++ ext3_truncate_failed_write(inode);
+ }
+ if (ret == -ENOSPC && ext3_should_retry_alloc(inode->i_sb, &retries))
+ goto retry;
+@@ -1304,7 +1314,7 @@ static int ext3_ordered_write_end(struct
+ page_cache_release(page);
+
+ if (pos + len > inode->i_size)
+- ext3_truncate(inode);
++ ext3_truncate_failed_write(inode);
+ return ret ? ret : copied;
+ }
+
+@@ -1330,7 +1340,7 @@ static int ext3_writeback_write_end(stru
+ page_cache_release(page);
+
+ if (pos + len > inode->i_size)
+- ext3_truncate(inode);
++ ext3_truncate_failed_write(inode);
+ return ret ? ret : copied;
+ }
+
+@@ -1383,7 +1393,7 @@ static int ext3_journalled_write_end(str
+ page_cache_release(page);
+
+ if (pos + len > inode->i_size)
+- ext3_truncate(inode);
++ ext3_truncate_failed_write(inode);
+ return ret ? ret : copied;
+ }
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:57:00 2009
+Message-Id: <20091217035700.492768373@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:12 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Rafal Milecki <zajec5@gmail.com>,
+ Jean-Francois Moine <moinejf@free.fr>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>,
+ Surbhi Palande <surbhi.palande@canonical.com>
+Subject: [135/151] V4L/DVB (13116): gspca - ov519: Webcam 041e:4067 added.
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Rafal Milecki <zajec5@gmail.com>
+
+commit 518c8df77c21b7d1690dd8b96eb0e54c4ec1c9c1 upstream.
+
+Signed-off-by: Rafal Milecki <zajec5@gmail.com>
+Signed-off-by: Jean-Francois Moine <moinejf@free.fr>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Cc: Surbhi Palande <surbhi.palande@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+--- a/Documentation/video4linux/gspca.txt
++++ b/Documentation/video4linux/gspca.txt
+@@ -37,6 +37,7 @@ ov519 041e:405f Creative Live! VISTA VF0330
+ ov519 041e:4060 Creative Live! VISTA VF0350
+ ov519 041e:4061 Creative Live! VISTA VF0400
+ ov519 041e:4064 Creative Live! VISTA VF0420
++ov519 041e:4067 Creative Live! Cam Video IM (VF0350)
+ ov519 041e:4068 Creative Live! VISTA VF0470
+ spca561 0458:7004 Genius VideoCAM Express V2
+ sunplus 0458:7006 Genius Dsc 1.3 Smart
+diff --git a/drivers/media/video/gspca/ov519.c b/drivers/media/video/gspca/ov519.c
+index a5c190e..e165578 100644
+--- a/drivers/media/video/gspca/ov519.c
++++ b/drivers/media/video/gspca/ov519.c
+@@ -3364,6 +3364,7 @@ static const __devinitdata struct usb_device_id device_table[] = {
+ {USB_DEVICE(0x041e, 0x4061), .driver_info = BRIDGE_OV519 },
+ {USB_DEVICE(0x041e, 0x4064),
+ .driver_info = BRIDGE_OV519 | BRIDGE_INVERT_LED },
++ {USB_DEVICE(0x041e, 0x4067), .driver_info = BRIDGE_OV519 },
+ {USB_DEVICE(0x041e, 0x4068),
+ .driver_info = BRIDGE_OV519 | BRIDGE_INVERT_LED },
+ {USB_DEVICE(0x045e, 0x028c), .driver_info = BRIDGE_OV519 },
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:57:00 2009
+Message-Id: <20091217035700.621604509@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:13 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Florian Fainelli <ffainelli@freebox.fr>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [136/151] bcm63xx_enet: fix compilation failure after get_stats_count removal
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Florian Fainelli <ffainelli@freebox.fr>
+
+commit a3f92eea04101d9a8e14d50f8048cc5b7bca07a8 upstream.
+
+This patch converts bcm63xx_enet to uset get_sset_count
+like the other drivers do.
+
+Signed-off-by: Florian Fainelli <ffainelli@freebox.fr>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/bcm63xx_enet.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/bcm63xx_enet.c
++++ b/drivers/net/bcm63xx_enet.c
+@@ -1248,9 +1248,15 @@ static void bcm_enet_get_drvinfo(struct
+ drvinfo->n_stats = BCM_ENET_STATS_LEN;
+ }
+
+-static int bcm_enet_get_stats_count(struct net_device *netdev)
++static int bcm_enet_get_sset_count(struct net_device *netdev,
++ int string_set)
+ {
+- return BCM_ENET_STATS_LEN;
++ switch (string_set) {
++ case ETH_SS_STATS:
++ return BCM_ENET_STATS_LEN;
++ default:
++ return -EINVAL;
++ }
+ }
+
+ static void bcm_enet_get_strings(struct net_device *netdev,
+@@ -1476,7 +1482,7 @@ static int bcm_enet_set_pauseparam(struc
+
+ static struct ethtool_ops bcm_enet_ethtool_ops = {
+ .get_strings = bcm_enet_get_strings,
+- .get_stats_count = bcm_enet_get_stats_count,
++ .get_sset_count = bcm_enet_get_sset_count,
+ .get_ethtool_stats = bcm_enet_get_ethtool_stats,
+ .get_settings = bcm_enet_get_settings,
+ .set_settings = bcm_enet_set_settings,
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:57:00 2009
+Message-Id: <20091217035700.760145113@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:14 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Greg KH <greg@kroah.com>
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Yong Wang <yong.y.wang@intel.com>,
+ Borislav Petkov <borislav.petkov@amd.com>,
+ Arjan van de Ven <arjan@infradead.org>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [137/151] x86: Under BIOS control, restore APs APIC_LVTTHMR to the BSP value
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Yong Wang <yong.y.wang@linux.intel.com>
+
+Upstream commit a2202aa29289db64ca7988b12343158b67b27f10.
+
+On platforms where bios handles the thermal monitor interrupt,
+APIC_LVTTHMR on each logical CPU is programmed to generate a SMI and OS
+can't touch it.
+
+Unfortunately AP bringup sequence using INIT-SIPI-SIPI clear all
+the LVT entries except the mask bit. Essentially this results in
+all LVT entries including the thermal monitoring interrupt set to masked
+(clearing the bios programmed value for APIC_LVTTHMR).
+
+And this leads to kernel take over the thermal monitoring interrupt
+on AP's but not on BSP (leaving the bios programmed value only on BSP).
+
+As a result of this, we have seen system hangs when the thermal
+monitoring interrupt is generated.
+
+Fix this by reading the initial value of thermal LVT entry on BSP
+and if bios has taken over the control, then program the same value
+on all AP's and leave the thermal monitoring interrupt control
+on all the logical cpu's to the bios.
+
+Signed-off-by: Yong Wang <yong.y.wang@intel.com>
+Reviewed-by: Suresh Siddha <suresh.b.siddha@intel.com>
+Cc: Borislav Petkov <borislav.petkov@amd.com>
+Cc: Arjan van de Ven <arjan@infradead.org>
+LKML-Reference: <20091110013824.GA24940@ywang-moblin2.bj.intel.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/mce.h | 6 ++++++
+ arch/x86/kernel/cpu/mcheck/therm_throt.c | 29 ++++++++++++++++++++++++++++-
+ arch/x86/kernel/setup.c | 3 +++
+ 3 files changed, 37 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/include/asm/mce.h
++++ b/arch/x86/include/asm/mce.h
+@@ -214,5 +214,11 @@ void intel_init_thermal(struct cpuinfo_x
+
+ void mce_log_therm_throt_event(__u64 status);
+
++#ifdef CONFIG_X86_THERMAL_VECTOR
++extern void mcheck_intel_therm_init(void);
++#else
++static inline void mcheck_intel_therm_init(void) { }
++#endif
++
+ #endif /* __KERNEL__ */
+ #endif /* _ASM_X86_MCE_H */
+--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c
++++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c
+@@ -49,6 +49,8 @@ static DEFINE_PER_CPU(struct thermal_sta
+
+ static atomic_t therm_throt_en = ATOMIC_INIT(0);
+
++static u32 lvtthmr_init __read_mostly;
++
+ #ifdef CONFIG_SYSFS
+ #define define_therm_throt_sysdev_one_ro(_name) \
+ static SYSDEV_ATTR(_name, 0444, therm_throt_sysdev_show_##_name, NULL)
+@@ -254,6 +256,18 @@ asmlinkage void smp_thermal_interrupt(st
+ ack_APIC_irq();
+ }
+
++void __init mcheck_intel_therm_init(void)
++{
++ /*
++ * This function is only called on boot CPU. Save the init thermal
++ * LVT value on BSP and use that value to restore APs' thermal LVT
++ * entry BIOS programmed later
++ */
++ if (cpu_has(&boot_cpu_data, X86_FEATURE_ACPI) &&
++ cpu_has(&boot_cpu_data, X86_FEATURE_ACC))
++ lvtthmr_init = apic_read(APIC_LVTTHMR);
++}
++
+ void intel_init_thermal(struct cpuinfo_x86 *c)
+ {
+ unsigned int cpu = smp_processor_id();
+@@ -270,7 +284,20 @@ void intel_init_thermal(struct cpuinfo_x
+ * since it might be delivered via SMI already:
+ */
+ rdmsr(MSR_IA32_MISC_ENABLE, l, h);
+- h = apic_read(APIC_LVTTHMR);
++
++ /*
++ * The initial value of thermal LVT entries on all APs always reads
++ * 0x10000 because APs are woken up by BSP issuing INIT-SIPI-SIPI
++ * sequence to them and LVT registers are reset to 0s except for
++ * the mask bits which are set to 1s when APs receive INIT IPI.
++ * Always restore the value that BIOS has programmed on AP based on
++ * BSP's info we saved since BIOS is always setting the same value
++ * for all threads/cores
++ */
++ apic_write(APIC_LVTTHMR, lvtthmr_init);
++
++ h = lvtthmr_init;
++
+ if ((l & MSR_IA32_MISC_ENABLE_TM1) && (h & APIC_DM_SMI)) {
+ printk(KERN_DEBUG
+ "CPU%d: Thermal monitoring handled by SMI\n", cpu);
+--- a/arch/x86/kernel/setup.c
++++ b/arch/x86/kernel/setup.c
+@@ -109,6 +109,7 @@
+ #ifdef CONFIG_X86_64
+ #include <asm/numa_64.h>
+ #endif
++#include <asm/mce.h>
+
+ /*
+ * end_pfn only includes RAM, while max_pfn_mapped includes all e820 entries.
+@@ -1031,6 +1032,8 @@ void __init setup_arch(char **cmdline_p)
+ #endif
+ #endif
+ x86_init.oem.banner();
++
++ mcheck_intel_therm_init();
+ }
+
+ #ifdef CONFIG_X86_32
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:57:01 2009
+Message-Id: <20091217035700.890391616@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:15 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Chris Wilson <chris@chris-wilson.co.uk>,
+ David Woodhouse <dwmw2@infradead.org>,
+ Zhenyu Wang <zhenyu.z.wang@intel.com>,
+ Zhenyu Wang <zhenyuw@linux.intel.com>,
+ Eric Anholt <eric@anholt.net>
+Subject: [138/151] drm/i915: Avoid NULL dereference with component_only tv_modes
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit d271817baecbccb47da0d9f28c285a0dae8a06b7 upstream.
+
+In commit d2d9f2324, the guard for a valid video mode was removed. This
+caused the regression:
+
+ kernel crash during kms graphic boot on Intel GM4500 platform
+ https://bugzilla.redhat.com/show_bug.cgi?id=540218
+
+This patches changes the logic slightly not to rely on a coupled
+variable, but to just check whether the video_modes is valid before
+dereferencing.
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: David Woodhouse <dwmw2@infradead.org>
+Cc: Zhenyu Wang <zhenyu.z.wang@intel.com>
+[ickle: Actually reference the correct bug report]
+Acked-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_tv.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_tv.c
++++ b/drivers/gpu/drm/i915/intel_tv.c
+@@ -1213,20 +1213,17 @@ intel_tv_mode_set(struct drm_encoder *en
+ tv_ctl |= TV_TRILEVEL_SYNC;
+ if (tv_mode->pal_burst)
+ tv_ctl |= TV_PAL_BURST;
++
+ scctl1 = 0;
+- /* dda1 implies valid video levels */
+- if (tv_mode->dda1_inc) {
++ if (tv_mode->dda1_inc)
+ scctl1 |= TV_SC_DDA1_EN;
+- }
+-
+ if (tv_mode->dda2_inc)
+ scctl1 |= TV_SC_DDA2_EN;
+-
+ if (tv_mode->dda3_inc)
+ scctl1 |= TV_SC_DDA3_EN;
+-
+ scctl1 |= tv_mode->sc_reset;
+- scctl1 |= video_levels->burst << TV_BURST_LEVEL_SHIFT;
++ if (video_levels)
++ scctl1 |= video_levels->burst << TV_BURST_LEVEL_SHIFT;
+ scctl1 |= tv_mode->dda1_inc << TV_SCDDA1_INC_SHIFT;
+
+ scctl2 = tv_mode->dda2_size << TV_SCDDA2_SIZE_SHIFT |
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:57:01 2009
+Message-Id: <20091217035701.039621306@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:16 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Shaohua Li <shaohua.li@intel.com>,
+ Zhenyu Wang <zhenyuw@linux.intel.com>,
+ Eric Anholt <eric@anholt.net>
+Subject: [139/151] drm/i915: PineView only has LVDS and CRT ports
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+
+commit 103a196f4224dc6872081305cf7f82ebf67aa7bd upstream.
+
+PineView only has 2 ports for LVDS and CRT. Don't enable other
+ports for it.
+
+Cc: Shaohua Li <shaohua.li@intel.com>
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_drv.h | 4 ++++
+ drivers/gpu/drm/i915/intel_display.c | 6 +++---
+ 2 files changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -957,6 +957,7 @@ extern int i915_wait_ring(struct drm_dev
+ #define IS_I85X(dev) ((dev)->pci_device == 0x3582)
+ #define IS_I855(dev) ((dev)->pci_device == 0x3582)
+ #define IS_I865G(dev) ((dev)->pci_device == 0x2572)
++#define IS_I8XX(dev) (IS_I830(dev) || IS_845G(dev) || IS_I85X(dev) || IS_I865G(dev))
+
+ #define IS_I915G(dev) ((dev)->pci_device == 0x2582 || (dev)->pci_device == 0x258a)
+ #define IS_I915GM(dev) ((dev)->pci_device == 0x2592)
+@@ -1018,9 +1019,12 @@ extern int i915_wait_ring(struct drm_dev
+ */
+ #define HAS_128_BYTE_Y_TILING(dev) (IS_I9XX(dev) && !(IS_I915G(dev) || \
+ IS_I915GM(dev)))
++#define SUPPORTS_DIGITAL_OUTPUTS(dev) (IS_I9XX(dev) && !IS_IGD(dev))
+ #define SUPPORTS_INTEGRATED_HDMI(dev) (IS_G4X(dev) || IS_IGDNG(dev))
+ #define SUPPORTS_INTEGRATED_DP(dev) (IS_G4X(dev) || IS_IGDNG(dev))
+ #define SUPPORTS_EDP(dev) (IS_IGDNG_M(dev))
++#define SUPPORTS_TV(dev) (IS_I9XX(dev) && IS_MOBILE(dev) && \
++ !IS_IGDNG(dev) && !IS_IGD(dev))
+ #define I915_HAS_HOTPLUG(dev) (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev) || IS_I965G(dev))
+ /* dsparb controlled by hw only */
+ #define DSPARB_HWCONTROL(dev) (IS_G4X(dev) || IS_IGDNG(dev))
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -4119,7 +4119,7 @@ static void intel_setup_outputs(struct d
+ if (I915_READ(PCH_DP_D) & DP_DETECTED)
+ intel_dp_init(dev, PCH_DP_D);
+
+- } else if (IS_I9XX(dev)) {
++ } else if (SUPPORTS_DIGITAL_OUTPUTS(dev)) {
+ bool found = false;
+
+ if (I915_READ(SDVOB) & SDVO_DETECTED) {
+@@ -4146,10 +4146,10 @@ static void intel_setup_outputs(struct d
+
+ if (SUPPORTS_INTEGRATED_DP(dev) && (I915_READ(DP_D) & DP_DETECTED))
+ intel_dp_init(dev, DP_D);
+- } else
++ } else if (IS_I8XX(dev))
+ intel_dvo_init(dev);
+
+- if (IS_I9XX(dev) && IS_MOBILE(dev) && !IS_IGDNG(dev))
++ if (SUPPORTS_TV(dev))
+ intel_tv_init(dev);
+
+ list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:57:01 2009
+Message-Id: <20091217035701.150467114@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:17 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Zhenyu Wang <zhenyuw@linux.intel.com>,
+ Eric Anholt <eric@anholt.net>
+Subject: [140/151] drm/i915: Fix LVDS stability issue on Ironlake
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+
+commit 1b3c7a47f993bf9ab6c4c7cc3bbf5588052b58f4 upstream.
+
+In disable sequence, all output ports on PCH have to be disabled
+before PCH transcoder, but LVDS port was left always enabled. This
+one fixes that by disable LVDS port properly during pipe disable
+process, and resolved stability issue seen on Ironlake. Also move
+panel fitting disable time just after pipe disable to align with
+the spec.
+
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_display.c | 60 +++++++++++++++++++++++------------
+ 1 file changed, 41 insertions(+), 19 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -1482,6 +1482,15 @@ static void igdng_crtc_dpms(struct drm_c
+ case DRM_MODE_DPMS_STANDBY:
+ case DRM_MODE_DPMS_SUSPEND:
+ DRM_DEBUG("crtc %d dpms on\n", pipe);
++
++ if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) {
++ temp = I915_READ(PCH_LVDS);
++ if ((temp & LVDS_PORT_EN) == 0) {
++ I915_WRITE(PCH_LVDS, temp | LVDS_PORT_EN);
++ POSTING_READ(PCH_LVDS);
++ }
++ }
++
+ if (HAS_eDP) {
+ /* enable eDP PLL */
+ igdng_enable_pll_edp(crtc);
+@@ -1666,8 +1675,6 @@ static void igdng_crtc_dpms(struct drm_c
+ case DRM_MODE_DPMS_OFF:
+ DRM_DEBUG("crtc %d dpms off\n", pipe);
+
+- i915_disable_vga(dev);
+-
+ /* Disable display plane */
+ temp = I915_READ(dspcntr_reg);
+ if ((temp & DISPLAY_PLANE_ENABLE) != 0) {
+@@ -1677,6 +1684,8 @@ static void igdng_crtc_dpms(struct drm_c
+ I915_READ(dspbase_reg);
+ }
+
++ i915_disable_vga(dev);
++
+ /* disable cpu pipe, disable after all planes disabled */
+ temp = I915_READ(pipeconf_reg);
+ if ((temp & PIPEACONF_ENABLE) != 0) {
+@@ -1697,9 +1706,15 @@ static void igdng_crtc_dpms(struct drm_c
+ } else
+ DRM_DEBUG("crtc %d is disabled\n", pipe);
+
+- if (HAS_eDP) {
+- igdng_disable_pll_edp(crtc);
++ udelay(100);
++
++ /* Disable PF */
++ temp = I915_READ(pf_ctl_reg);
++ if ((temp & PF_ENABLE) != 0) {
++ I915_WRITE(pf_ctl_reg, temp & ~PF_ENABLE);
++ I915_READ(pf_ctl_reg);
+ }
++ I915_WRITE(pf_win_size, 0);
+
+ /* disable CPU FDI tx and PCH FDI rx */
+ temp = I915_READ(fdi_tx_reg);
+@@ -1725,6 +1740,13 @@ static void igdng_crtc_dpms(struct drm_c
+
+ udelay(100);
+
++ if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) {
++ temp = I915_READ(PCH_LVDS);
++ I915_WRITE(PCH_LVDS, temp & ~LVDS_PORT_EN);
++ I915_READ(PCH_LVDS);
++ udelay(100);
++ }
++
+ /* disable PCH transcoder */
+ temp = I915_READ(transconf_reg);
+ if ((temp & TRANS_ENABLE) != 0) {
+@@ -1744,6 +1766,8 @@ static void igdng_crtc_dpms(struct drm_c
+ }
+ }
+
++ udelay(100);
++
+ /* disable PCH DPLL */
+ temp = I915_READ(pch_dpll_reg);
+ if ((temp & DPLL_VCO_ENABLE) != 0) {
+@@ -1751,14 +1775,20 @@ static void igdng_crtc_dpms(struct drm_c
+ I915_READ(pch_dpll_reg);
+ }
+
+- temp = I915_READ(fdi_rx_reg);
+- if ((temp & FDI_RX_PLL_ENABLE) != 0) {
+- temp &= ~FDI_SEL_PCDCLK;
+- temp &= ~FDI_RX_PLL_ENABLE;
+- I915_WRITE(fdi_rx_reg, temp);
+- I915_READ(fdi_rx_reg);
++ if (HAS_eDP) {
++ igdng_disable_pll_edp(crtc);
+ }
+
++ temp = I915_READ(fdi_rx_reg);
++ temp &= ~FDI_SEL_PCDCLK;
++ I915_WRITE(fdi_rx_reg, temp);
++ I915_READ(fdi_rx_reg);
++
++ temp = I915_READ(fdi_rx_reg);
++ temp &= ~FDI_RX_PLL_ENABLE;
++ I915_WRITE(fdi_rx_reg, temp);
++ I915_READ(fdi_rx_reg);
++
+ /* Disable CPU FDI TX PLL */
+ temp = I915_READ(fdi_tx_reg);
+ if ((temp & FDI_TX_PLL_ENABLE) != 0) {
+@@ -1767,16 +1797,8 @@ static void igdng_crtc_dpms(struct drm_c
+ udelay(100);
+ }
+
+- /* Disable PF */
+- temp = I915_READ(pf_ctl_reg);
+- if ((temp & PF_ENABLE) != 0) {
+- I915_WRITE(pf_ctl_reg, temp & ~PF_ENABLE);
+- I915_READ(pf_ctl_reg);
+- }
+- I915_WRITE(pf_win_size, 0);
+-
+ /* Wait for the clocks to turn off. */
+- udelay(150);
++ udelay(100);
+ break;
+ }
+ }
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:57:01 2009
+Message-Id: <20091217035701.281685524@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:18 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Hugh Dickins <hugh.dickins@tiscali.co.uk>,
+ Izik Eidus <ieidus@redhat.com>,
+ Andrea Arcangeli <aarcange@redhat.com>,
+ Nick Piggin <npiggin@suse.de>,
+ Rik van Riel <riel@redhat.com>,
+ Lee Schermerhorn <Lee.Schermerhorn@hp.com>,
+ Andi Kleen <andi@firstfloor.org>
+Subject: [141/151] mm: sigbus instead of abusing oom
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Hugh Dickins <hugh.dickins@tiscali.co.uk>
+
+commit d99be1a8ecf377c2c9b3372d36411ad6547bbd4c upstream.
+
+When do_nonlinear_fault() realizes that the page table must have been
+corrupted for it to have been called, it does print_bad_pte() and returns
+... VM_FAULT_OOM, which is hard to understand.
+
+It made some sense when I did it for 2.6.15, when do_page_fault() just
+killed the current process; but nowadays it lets the OOM killer decide who
+to kill - so page table corruption in one process would be liable to kill
+another.
+
+Change it to return VM_FAULT_SIGBUS instead: that doesn't guarantee that
+the process will be killed, but is good enough for such a rare
+abnormality, accompanied as it is by the "BUG: Bad page map" message.
+
+And recent HWPOISON work has copied that code into do_swap_page(), when it
+finds an impossible swap entry: fix that to VM_FAULT_SIGBUS too.
+
+Signed-off-by: Hugh Dickins <hugh.dickins@tiscali.co.uk>
+Cc: Izik Eidus <ieidus@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: Nick Piggin <npiggin@suse.de>
+Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Cc: Rik van Riel <riel@redhat.com>
+Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
+Cc: Andi Kleen <andi@firstfloor.org>
+Reviewed-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Reviewed-by: Wu Fengguang <fengguang.wu@intel.com>
+Reviewed-by: Minchan Kim <minchan.kim@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/memory.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -2514,7 +2514,7 @@ static int do_swap_page(struct mm_struct
+ ret = VM_FAULT_HWPOISON;
+ } else {
+ print_bad_pte(vma, address, orig_pte, NULL);
+- ret = VM_FAULT_OOM;
++ ret = VM_FAULT_SIGBUS;
+ }
+ goto out;
+ }
+@@ -2910,7 +2910,7 @@ static int do_nonlinear_fault(struct mm_
+ * Page table corrupted: show pte and kill process.
+ */
+ print_bad_pte(vma, address, orig_pte, NULL);
+- return VM_FAULT_OOM;
++ return VM_FAULT_SIGBUS;
+ }
+
+ pgoff = pte_to_pgoff(orig_pte);
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:57:01 2009
+Message-Id: <20091217035701.412090427@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:19 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Deon van der Merwe <dvdm@truteq.co.za>,
+ Julian Anastasov <ja@ssi.bg>,
+ Simon Horman <horms@verge.net.au>,
+ Patrick McHardy <kaber@trash.net>
+Subject: [142/151] ipvs: zero usvc and udest
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Simon Horman <horms@verge.net.au>
+
+commit 258c889362aa95d0ab534b38ce8c15d3009705b1 upstream.
+
+Make sure that any otherwise uninitialised fields of usvc are zero.
+
+This has been obvserved to cause a problem whereby the port of
+fwmark services may end up as a non-zero value which causes
+scheduling of a destination server to fail for persisitent services.
+
+As observed by Deon van der Merwe <dvdm@truteq.co.za>.
+This fix suggested by Julian Anastasov <ja@ssi.bg>.
+
+For good measure also zero udest.
+
+Cc: Deon van der Merwe <dvdm@truteq.co.za>
+Acked-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Simon Horman <horms@verge.net.au>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/netfilter/ipvs/ip_vs_ctl.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -2714,6 +2714,8 @@ static int ip_vs_genl_parse_service(stru
+ if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr))))
+ return -EINVAL;
+
++ memset(usvc, 0, sizeof(*usvc));
++
+ usvc->af = nla_get_u16(nla_af);
+ #ifdef CONFIG_IP_VS_IPV6
+ if (usvc->af != AF_INET && usvc->af != AF_INET6)
+@@ -2901,6 +2903,8 @@ static int ip_vs_genl_parse_dest(struct
+ if (!(nla_addr && nla_port))
+ return -EINVAL;
+
++ memset(udest, 0, sizeof(*udest));
++
+ nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr));
+ udest->port = nla_get_u16(nla_port);
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:57:01 2009
+Message-Id: <20091217035701.539163219@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:20 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ David Woodhouse <David.Woodhouse@intel.com>
+Subject: [143/151] jffs2: Fix long-standing bug with symlink garbage collection.
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: David Woodhouse <David.Woodhouse@intel.com>
+
+commit 2e16cfca6e17ae37ae21feca080a6f2eca9087dc upstream.
+
+Ever since jffs2_garbage_collect_metadata() was first half-written in
+February 2001, it's been broken on architectures where 'char' is signed.
+When garbage collecting a symlink with target length above 127, the payload
+length would end up negative, causing interesting and bad things to happen.
+
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/jffs2/gc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/jffs2/gc.c
++++ b/fs/jffs2/gc.c
+@@ -700,7 +700,8 @@ static int jffs2_garbage_collect_metadat
+ struct jffs2_raw_inode ri;
+ struct jffs2_node_frag *last_frag;
+ union jffs2_device_node dev;
+- char *mdata = NULL, mdatalen = 0;
++ char *mdata = NULL;
++ int mdatalen = 0;
+ uint32_t alloclen, ilen;
+ int ret;
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:57:01 2009
+Message-Id: <20091217035701.669572591@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:21 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Chris Wright <chrisw@sous-sol.org>,
+ David Woodhouse <David.Woodhouse@intel.com>
+Subject: [144/151] intel-iommu: Detect DMAR in hyperspace at probe time.
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Chris Wright <chrisw@sous-sol.org>
+
+commit 2c99220810c1c79322034628b993573b088ff2da upstream.
+
+Many BIOSes will lie to us about the existence of an IOMMU, and claim
+that there is one at an address which actually returns all 0xFF.
+
+We need to detect this early, so that we know we don't have a viable
+IOMMU and can set up swiotlb before it's too late.
+
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/dmar.c | 34 +++++++++++++++++++++++++++++-----
+ 1 file changed, 29 insertions(+), 5 deletions(-)
+
+--- a/drivers/pci/dmar.c
++++ b/drivers/pci/dmar.c
+@@ -601,6 +601,9 @@ int __init check_zero_address(void)
+ }
+
+ if (entry_header->type == ACPI_DMAR_TYPE_HARDWARE_UNIT) {
++ void __iomem *addr;
++ u64 cap, ecap;
++
+ drhd = (void *)entry_header;
+ if (!drhd->address) {
+ /* Promote an attitude of violence to a BIOS engineer today */
+@@ -609,17 +612,38 @@ int __init check_zero_address(void)
+ dmi_get_system_info(DMI_BIOS_VENDOR),
+ dmi_get_system_info(DMI_BIOS_VERSION),
+ dmi_get_system_info(DMI_PRODUCT_VERSION));
+-#ifdef CONFIG_DMAR
+- dmar_disabled = 1;
+-#endif
+- return 0;
++ goto failed;
++ }
++
++ addr = early_ioremap(drhd->address, VTD_PAGE_SIZE);
++ if (!addr ) {
++ printk("IOMMU: can't validate: %llx\n", drhd->address);
++ goto failed;
++ }
++ cap = dmar_readq(addr + DMAR_CAP_REG);
++ ecap = dmar_readq(addr + DMAR_ECAP_REG);
++ early_iounmap(addr, VTD_PAGE_SIZE);
++ if (cap == (uint64_t)-1 && ecap == (uint64_t)-1) {
++ /* Promote an attitude of violence to a BIOS engineer today */
++ WARN(1, "Your BIOS is broken; DMAR reported at address %llx returns all ones!\n"
++ "BIOS vendor: %s; Ver: %s; Product Version: %s\n",
++ drhd->address,
++ dmi_get_system_info(DMI_BIOS_VENDOR),
++ dmi_get_system_info(DMI_BIOS_VERSION),
++ dmi_get_system_info(DMI_PRODUCT_VERSION));
++ goto failed;
+ }
+- break;
+ }
+
+ entry_header = ((void *)entry_header + entry_header->length);
+ }
+ return 1;
++
++failed:
++#ifdef CONFIG_DMAR
++ dmar_disabled = 1;
++#endif
++ return 0;
+ }
+
+ void __init detect_intel_iommu(void)
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:57:01 2009
+Message-Id: <20091217035701.797183647@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:22 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ David Woodhouse <David.Woodhouse@intel.com>
+Subject: [145/151] intel-iommu: Apply BIOS sanity checks for interrupt remapping too.
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: David Woodhouse <David.Woodhouse@intel.com>
+
+commit 6ecbf01c7ce4c0f4c3bdfa0e64ac6258328fda6c upstream.
+
+The BIOS errors where an IOMMU is reported either at zero or a bogus
+address are causing problems even when the IOMMU is disabled -- because
+interrupt remapping uses the same hardware. Ensure that the checks get
+applied for the interrupt remapping initialisation too.
+
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/dmar.c | 33 ++++++++++++++++++++++++++-------
+ 1 file changed, 26 insertions(+), 7 deletions(-)
+
+--- a/drivers/pci/dmar.c
++++ b/drivers/pci/dmar.c
+@@ -582,6 +582,8 @@ int __init dmar_table_init(void)
+ return 0;
+ }
+
++static int bios_warned;
++
+ int __init check_zero_address(void)
+ {
+ struct acpi_table_dmar *dmar;
+@@ -612,6 +614,7 @@ int __init check_zero_address(void)
+ dmi_get_system_info(DMI_BIOS_VENDOR),
+ dmi_get_system_info(DMI_BIOS_VERSION),
+ dmi_get_system_info(DMI_PRODUCT_VERSION));
++ bios_warned = 1;
+ goto failed;
+ }
+
+@@ -631,6 +634,7 @@ int __init check_zero_address(void)
+ dmi_get_system_info(DMI_BIOS_VENDOR),
+ dmi_get_system_info(DMI_BIOS_VERSION),
+ dmi_get_system_info(DMI_PRODUCT_VERSION));
++ bios_warned = 1;
+ goto failed;
+ }
+ }
+@@ -688,6 +692,18 @@ int alloc_iommu(struct dmar_drhd_unit *d
+ int agaw = 0;
+ int msagaw = 0;
+
++ if (!drhd->reg_base_addr) {
++ if (!bios_warned) {
++ WARN(1, "Your BIOS is broken; DMAR reported at address zero!\n"
++ "BIOS vendor: %s; Ver: %s; Product Version: %s\n",
++ dmi_get_system_info(DMI_BIOS_VENDOR),
++ dmi_get_system_info(DMI_BIOS_VERSION),
++ dmi_get_system_info(DMI_PRODUCT_VERSION));
++ bios_warned = 1;
++ }
++ return -EINVAL;
++ }
++
+ iommu = kzalloc(sizeof(*iommu), GFP_KERNEL);
+ if (!iommu)
+ return -ENOMEM;
+@@ -704,13 +720,16 @@ int alloc_iommu(struct dmar_drhd_unit *d
+ iommu->ecap = dmar_readq(iommu->reg + DMAR_ECAP_REG);
+
+ if (iommu->cap == (uint64_t)-1 && iommu->ecap == (uint64_t)-1) {
+- /* Promote an attitude of violence to a BIOS engineer today */
+- WARN(1, "Your BIOS is broken; DMAR reported at address %llx returns all ones!\n"
+- "BIOS vendor: %s; Ver: %s; Product Version: %s\n",
+- drhd->reg_base_addr,
+- dmi_get_system_info(DMI_BIOS_VENDOR),
+- dmi_get_system_info(DMI_BIOS_VERSION),
+- dmi_get_system_info(DMI_PRODUCT_VERSION));
++ if (!bios_warned) {
++ /* Promote an attitude of violence to a BIOS engineer today */
++ WARN(1, "Your BIOS is broken; DMAR reported at address %llx returns all ones!\n"
++ "BIOS vendor: %s; Ver: %s; Product Version: %s\n",
++ drhd->reg_base_addr,
++ dmi_get_system_info(DMI_BIOS_VENDOR),
++ dmi_get_system_info(DMI_BIOS_VERSION),
++ dmi_get_system_info(DMI_PRODUCT_VERSION));
++ bios_warned = 1;
++ }
+ goto err_unmap;
+ }
+
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:57:02 2009
+Message-Id: <20091217035701.923132279@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:23 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ David Woodhouse <David.Woodhouse@intel.com>
+Subject: [146/151] intel-iommu: Check for an RMRR which ends before it starts.
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: David Woodhouse <David.Woodhouse@intel.com>
+
+commit 5595b528b49a702c0428c0762bab60999648254c upstream.
+
+Some HP BIOSes report an RMRR region (a region which needs a 1:1 mapping
+in the IOMMU for a given device) which has an end address lower than its
+start address. Detect that and warn, rather than triggering the
+BUG() in dma_pte_clear_range().
+
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/intel-iommu.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/pci/intel-iommu.c
++++ b/drivers/pci/intel-iommu.c
+@@ -1991,6 +1991,16 @@ static int iommu_prepare_identity_map(st
+ "IOMMU: Setting identity map for device %s [0x%Lx - 0x%Lx]\n",
+ pci_name(pdev), start, end);
+
++ if (end < start) {
++ WARN(1, "Your BIOS is broken; RMRR ends before it starts!\n"
++ "BIOS vendor: %s; Ver: %s; Product Version: %s\n",
++ dmi_get_system_info(DMI_BIOS_VENDOR),
++ dmi_get_system_info(DMI_BIOS_VERSION),
++ dmi_get_system_info(DMI_PRODUCT_VERSION));
++ ret = -EIO;
++ goto error;
++ }
++
+ if (end >> agaw_to_width(domain->agaw)) {
+ WARN(1, "Your BIOS is broken; RMRR exceeds permitted address width (%d bits)\n"
+ "BIOS vendor: %s; Ver: %s; Product Version: %s\n",
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:57:02 2009
+Message-Id: <20091217035702.052247918@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:24 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ David Woodhouse <David.Woodhouse@intel.com>
+Subject: [147/151] intel-iommu: Fix oops with intel_iommu=igfx_off
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: David Woodhouse <David.Woodhouse@intel.com>
+
+commit 44cd613c0e4cd93079ea2a93aa06649d8ca0830a upstream.
+
+The hotplug notifier will call find_domain() to see if the device in
+question has been assigned an IOMMU domain. However, this should never
+be called for devices with a "dummy" domain, such as graphics devices
+when intel_iommu=igfx_off is set and the corresponding IOMMU isn't even
+initialised. If you do that, it'll oops as it dereferences the (-1)
+pointer.
+
+The notifier function should check iommu_no_mapping() for the
+device before doing anything else.
+
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/intel-iommu.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/pci/intel-iommu.c
++++ b/drivers/pci/intel-iommu.c
+@@ -3238,6 +3238,9 @@ static int device_notifier(struct notifi
+ struct pci_dev *pdev = to_pci_dev(dev);
+ struct dmar_domain *domain;
+
++ if (iommu_no_mapping(dev))
++ return 0;
++
+ domain = find_domain(pdev);
+ if (!domain)
+ return 0;
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:57:02 2009
+Message-Id: <20091217035702.183430151@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:25 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Chris Wright <chrisw@sous-sol.org>,
+ David Woodhouse <David.Woodhouse@intel.com>
+Subject: [148/151] intel-iommu: ignore page table validation in pass through mode
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Chris Wright <chrisw@sous-sol.org>
+
+commit 1672af1164d3d50ba8908014fd34cc0b58afdc1e upstream.
+
+We are seeing a bug when booting w/ iommu=pt with current upstream
+(bisect blames 19943b0e30b05d42e494ae6fef78156ebc8c637e "intel-iommu:
+Unify hardware and software passthrough support).
+
+The issue is specific to this loop during identity map initialization
+of each device:
+
+domain_context_mapping_one(si_domain, ..., CONTEXT_TT_PASS_THROUGH)
+...
+ /* Skip top levels of page tables for
+ * iommu which has less agaw than default.
+ */
+ for (agaw = domain->agaw; agaw != iommu->agaw; agaw--) {
+ pgd = phys_to_virt(dma_pte_addr(pgd));
+ if (!dma_pte_present(pgd)) { <------ failing here
+ spin_unlock_irqrestore(&iommu->lock, flags);
+ return -ENOMEM;
+ }
+
+This box has 2 iommu's in it. The catchall iommu has MGAW == 48, and
+SAGAW == 4. The other iommu has MGAW == 39, SAGAW == 2.
+
+The device that's failing the above pgd test is the only device connected
+to the non-catchall iommu, which has a smaller address width than the
+domain default. This test is not necessary since the context is in PT
+mode and the ASR is ignored.
+
+Thanks to Don Dutile for discovering and debugging this one.
+
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/intel-iommu.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/pci/intel-iommu.c
++++ b/drivers/pci/intel-iommu.c
+@@ -1523,12 +1523,15 @@ static int domain_context_mapping_one(st
+
+ /* Skip top levels of page tables for
+ * iommu which has less agaw than default.
++ * Unnecessary for PT mode.
+ */
+- for (agaw = domain->agaw; agaw != iommu->agaw; agaw--) {
+- pgd = phys_to_virt(dma_pte_addr(pgd));
+- if (!dma_pte_present(pgd)) {
+- spin_unlock_irqrestore(&iommu->lock, flags);
+- return -ENOMEM;
++ if (translation != CONTEXT_TT_PASS_THROUGH) {
++ for (agaw = domain->agaw; agaw != iommu->agaw; agaw--) {
++ pgd = phys_to_virt(dma_pte_addr(pgd));
++ if (!dma_pte_present(pgd)) {
++ spin_unlock_irqrestore(&iommu->lock, flags);
++ return -ENOMEM;
++ }
+ }
+ }
+ }
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:57:02 2009
+Message-Id: <20091217035702.312208598@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:26 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jan Engelhardt <jengelh@medozas.de>,
+ Patrick McHardy <kaber@trash.net>
+Subject: [149/151] netfilter: xtables: document minimal required version
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Jan Engelhardt <jengelh@medozas.de>
+
+commit 7a92263705435d046d37a0990d0edfcb517f7ad3 upstream.
+
+For both .33 and .32-stable.
+
+Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/Changes | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/Documentation/Changes
++++ b/Documentation/Changes
+@@ -49,6 +49,8 @@ o oprofile 0.9
+ o udev 081 # udevinfo -V
+ o grub 0.93 # grub --version
+ o mcelog 0.6
++o iptables 1.4.1 # iptables -V
++
+
+ Kernel compilation
+ ==================
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:57:02 2009
+Message-Id: <20091217035702.439056851@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:27 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Paul Mackerras <paulus@samba.org>,
+ Peter Zijlstra <peterz@infradead.org>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [150/151] perf_event: Fix incorrect range check on cpu number
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Paul Mackerras <paulus@samba.org>
+
+commit 0f624e7e5625f4c30c836b7a5decfe2553582391 upstream.
+
+It is quite legitimate for CPUs to be numbered sparsely, meaning
+that it possible for an online CPU to have a number which is
+greater than the total count of possible CPUs.
+
+Currently find_get_context() has a sanity check on the cpu
+number where it checks it against num_possible_cpus(). This
+test can fail for a legitimate cpu number if the
+cpu_possible_mask is sparsely populated.
+
+This fixes the problem by checking the CPU number against
+nr_cpumask_bits instead, since that is the appropriate check to
+ensure that the cpu number is same to pass to cpu_isset()
+subsequently.
+
+Reported-by: Michael Neuling <mikey@neuling.org>
+Signed-off-by: Paul Mackerras <paulus@samba.org>
+Tested-by: Michael Neuling <mikey@neuling.org>
+Acked-by: Peter Zijlstra <peterz@infradead.org>
+LKML-Reference: <20091215084032.GA18661@brick.ozlabs.ibm.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/perf_event.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/perf_event.c
++++ b/kernel/perf_event.c
+@@ -1583,7 +1583,7 @@ static struct perf_event_context *find_g
+ if (perf_paranoid_cpu() && !capable(CAP_SYS_ADMIN))
+ return ERR_PTR(-EACCES);
+
+- if (cpu < 0 || cpu > num_possible_cpus())
++ if (cpu < 0 || cpu >= nr_cpumask_bits)
+ return ERR_PTR(-EINVAL);
+
+ /*
+
+
+From gregkh@mini.kroah.org Wed Dec 16 19:57:02 2009
+Message-Id: <20091217035702.569126308@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Wed, 16 Dec 2009 19:57:28 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tony Luck <tony.luck@intel.com>,
+ David Woodhouse <David.Woodhouse@intel.com>
+Subject: [151/151] implement early_io{re,un}map for ia64
+
+2.6.32-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+
+From: Luck, Tony <tony.luck@intel.com>
+
+commit cd7bcf32d42b15891620b3f1387a00178b54291a upstream.
+
+Needed for commit 2c992208 ("intel-iommu: Detect DMAR in hyperspace at
+probe time.) to build on IA64.
+
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/ia64/include/asm/io.h | 2 ++
+ arch/ia64/mm/ioremap.c | 11 +++++++++++
+ 2 files changed, 13 insertions(+)
+
+--- a/arch/ia64/include/asm/io.h
++++ b/arch/ia64/include/asm/io.h
+@@ -424,6 +424,8 @@ __writeq (unsigned long val, volatile vo
+ extern void __iomem * ioremap(unsigned long offset, unsigned long size);
+ extern void __iomem * ioremap_nocache (unsigned long offset, unsigned long size);
+ extern void iounmap (volatile void __iomem *addr);
++extern void __iomem * early_ioremap (unsigned long phys_addr, unsigned long size);
++extern void early_iounmap (volatile void __iomem *addr, unsigned long size);
+
+ /*
+ * String version of IO memory access ops:
+--- a/arch/ia64/mm/ioremap.c
++++ b/arch/ia64/mm/ioremap.c
+@@ -22,6 +22,12 @@ __ioremap (unsigned long phys_addr)
+ }
+
+ void __iomem *
++early_ioremap (unsigned long phys_addr, unsigned long size)
++{
++ return __ioremap(phys_addr);
++}
++
++void __iomem *
+ ioremap (unsigned long phys_addr, unsigned long size)
+ {
+ void __iomem *addr;
+@@ -102,6 +108,11 @@ ioremap_nocache (unsigned long phys_addr
+ EXPORT_SYMBOL(ioremap_nocache);
+
+ void
++early_iounmap (volatile void __iomem *addr, unsigned long size)
++{
++}
++
++void
+ iounmap (volatile void __iomem *addr)
+ {
+ if (REGION_NUMBER(addr) == RGN_GATE)
+
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
