--- /dev/null
+From 100cf87788c0e9104f6fb1b0ff5f72f73fbbbea3 Mon Sep 17 00:00:00 2001
+From: Len Brown <len.brown@intel.com>
+Date: Tue, 28 Sep 2010 22:57:02 -0400
+Subject: ACPI: invoke DSDT corruption workaround on all Toshiba Satellite
+
+From: Len Brown <len.brown@intel.com>
+
+commit 100cf87788c0e9104f6fb1b0ff5f72f73fbbbea3 upstream.
+
+Our list of Toshiba Satellite models that require this workaround
+is growing -- so invoke the workaround for the entire product line.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=14679
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/bus.c | 14 +++-----------
+ 1 file changed, 3 insertions(+), 11 deletions(-)
+
+--- a/drivers/acpi/bus.c
++++ b/drivers/acpi/bus.c
+@@ -80,23 +80,15 @@ static int set_copy_dsdt(const struct dm
+
+ static struct dmi_system_id dsdt_dmi_table[] __initdata = {
+ /*
+- * Insyde BIOS on some TOSHIBA machines corrupt the DSDT.
++ * Invoke DSDT corruption work-around on all Toshiba Satellite.
+ * https://bugzilla.kernel.org/show_bug.cgi?id=14679
+ */
+ {
+ .callback = set_copy_dsdt,
+- .ident = "TOSHIBA Satellite A505",
++ .ident = "TOSHIBA Satellite",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Satellite A505"),
+- },
+- },
+- {
+- .callback = set_copy_dsdt,
+- .ident = "TOSHIBA Satellite L505D",
+- .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+- DMI_MATCH(DMI_PRODUCT_NAME, "Satellite L505D"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Satellite"),
+ },
+ },
+ {}
--- /dev/null
+From fad16e7a7f67eef8d33f8ad58850db89382b09ce Mon Sep 17 00:00:00 2001
+From: Tejun Heo <htejun@gmail.com>
+Date: Tue, 21 Sep 2010 09:25:48 +0200
+Subject: ahci: fix module refcount breakage introduced by libahci split
+
+From: Tejun Heo <htejun@gmail.com>
+
+commit fad16e7a7f67eef8d33f8ad58850db89382b09ce upstream.
+
+libata depends on scsi_host_template for module reference counting and
+sht's should be owned by each low level driver. During libahci split,
+the sht was left with libahci.ko leaving the actual low level drivers
+not reference counted. This made ahci and ahci_platform always
+unloadable even while they're being actively used.
+
+Fix it by defining AHCI_SHT() macro in ahci.h and defining a sht for
+each low level ahci driver.
+
+stable: only applicable to 2.6.35.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Pedro Francisco <pedrogfrancisco@gmail.com>
+Tested-by: Michael Tokarev <mjt@tls.msk.ru>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/ahci.c | 4 ++++
+ drivers/ata/ahci.h | 12 +++++++++++-
+ drivers/ata/ahci_platform.c | 6 +++++-
+ drivers/ata/libahci.c | 16 ++++------------
+ 4 files changed, 24 insertions(+), 14 deletions(-)
+
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -89,6 +89,10 @@ static int ahci_pci_device_suspend(struc
+ static int ahci_pci_device_resume(struct pci_dev *pdev);
+ #endif
+
++static struct scsi_host_template ahci_sht = {
++ AHCI_SHT("ahci"),
++};
++
+ static struct ata_port_operations ahci_vt8251_ops = {
+ .inherits = &ahci_ops,
+ .hardreset = ahci_vt8251_hardreset,
+--- a/drivers/ata/ahci.h
++++ b/drivers/ata/ahci.h
+@@ -297,7 +297,17 @@ struct ahci_host_priv {
+
+ extern int ahci_ignore_sss;
+
+-extern struct scsi_host_template ahci_sht;
++extern struct device_attribute *ahci_shost_attrs[];
++extern struct device_attribute *ahci_sdev_attrs[];
++
++#define AHCI_SHT(drv_name) \
++ ATA_NCQ_SHT(drv_name), \
++ .can_queue = AHCI_MAX_CMDS - 1, \
++ .sg_tablesize = AHCI_MAX_SG, \
++ .dma_boundary = AHCI_DMA_BOUNDARY, \
++ .shost_attrs = ahci_shost_attrs, \
++ .sdev_attrs = ahci_sdev_attrs
++
+ extern struct ata_port_operations ahci_ops;
+
+ void ahci_save_initial_config(struct device *dev,
+--- a/drivers/ata/ahci_platform.c
++++ b/drivers/ata/ahci_platform.c
+@@ -23,6 +23,10 @@
+ #include <linux/ahci_platform.h>
+ #include "ahci.h"
+
++static struct scsi_host_template ahci_platform_sht = {
++ AHCI_SHT("ahci_platform"),
++};
++
+ static int __init ahci_probe(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+@@ -140,7 +144,7 @@ static int __init ahci_probe(struct plat
+ ahci_print_info(host, "platform");
+
+ rc = ata_host_activate(host, irq, ahci_interrupt, IRQF_SHARED,
+- &ahci_sht);
++ &ahci_platform_sht);
+ if (rc)
+ goto err0;
+
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -121,7 +121,7 @@ static DEVICE_ATTR(ahci_port_cmd, S_IRUG
+ static DEVICE_ATTR(em_buffer, S_IWUSR | S_IRUGO,
+ ahci_read_em_buffer, ahci_store_em_buffer);
+
+-static struct device_attribute *ahci_shost_attrs[] = {
++struct device_attribute *ahci_shost_attrs[] = {
+ &dev_attr_link_power_management_policy,
+ &dev_attr_em_message_type,
+ &dev_attr_em_message,
+@@ -132,22 +132,14 @@ static struct device_attribute *ahci_sho
+ &dev_attr_em_buffer,
+ NULL
+ };
++EXPORT_SYMBOL_GPL(ahci_shost_attrs);
+
+-static struct device_attribute *ahci_sdev_attrs[] = {
++struct device_attribute *ahci_sdev_attrs[] = {
+ &dev_attr_sw_activity,
+ &dev_attr_unload_heads,
+ NULL
+ };
+-
+-struct scsi_host_template ahci_sht = {
+- ATA_NCQ_SHT("ahci"),
+- .can_queue = AHCI_MAX_CMDS - 1,
+- .sg_tablesize = AHCI_MAX_SG,
+- .dma_boundary = AHCI_DMA_BOUNDARY,
+- .shost_attrs = ahci_shost_attrs,
+- .sdev_attrs = ahci_sdev_attrs,
+-};
+-EXPORT_SYMBOL_GPL(ahci_sht);
++EXPORT_SYMBOL_GPL(ahci_sdev_attrs);
+
+ struct ata_port_operations ahci_ops = {
+ .inherits = &sata_pmp_port_ops,
--- /dev/null
+From 0f9f1ee9d1412d45a22bfd69dfd4d4324b506e9e Mon Sep 17 00:00:00 2001
+From: Luke Yelavich <luke.yelavich@canonical.com>
+Date: Tue, 21 Sep 2010 17:05:46 +1000
+Subject: ALSA: hda - Add Dell Latitude E6400 model quirk
+
+From: Luke Yelavich <luke.yelavich@canonical.com>
+
+commit 0f9f1ee9d1412d45a22bfd69dfd4d4324b506e9e upstream.
+
+BugLink: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/643891
+
+Set the Dell Latitude E6400 (1028:0233) SSID to use AD1984_DELL_DESKTOP
+
+Signed-off-by: Luke Yelavich <luke.yelavich@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_analog.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_analog.c
++++ b/sound/pci/hda/patch_analog.c
+@@ -3641,6 +3641,7 @@ static struct snd_pci_quirk ad1984_cfg_t
+ /* Lenovo Thinkpad T61/X61 */
+ SND_PCI_QUIRK_VENDOR(0x17aa, "Lenovo Thinkpad", AD1984_THINKPAD),
+ SND_PCI_QUIRK(0x1028, 0x0214, "Dell T3400", AD1984_DELL_DESKTOP),
++ SND_PCI_QUIRK(0x1028, 0x0233, "Dell Latitude E6400", AD1984_DELL_DESKTOP),
+ {}
+ };
+
--- /dev/null
+From 0873a5ae747847ee55a63db409dff3476e45bcd9 Mon Sep 17 00:00:00 2001
+From: Erik J. Staab <ejs@insightbb.com>
+Date: Wed, 22 Sep 2010 11:07:41 +0200
+Subject: ALSA: oxygen: fix analog capture on Claro halo cards
+
+From: Erik J. Staab <ejs@insightbb.com>
+
+commit 0873a5ae747847ee55a63db409dff3476e45bcd9 upstream.
+
+On the HT-Omega Claro halo card, the ADC data must be captured from the
+second I2S input. Using the default first input, which isn't connected
+to anything, would result in silence.
+
+Signed-off-by: Erik J. Staab <ejs@insightbb.com>
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/oxygen/oxygen.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/sound/pci/oxygen/oxygen.c
++++ b/sound/pci/oxygen/oxygen.c
+@@ -543,6 +543,10 @@ static int __devinit get_oxygen_model(st
+ chip->model.suspend = claro_suspend;
+ chip->model.resume = claro_resume;
+ chip->model.set_adc_params = set_ak5385_params;
++ chip->model.device_config = PLAYBACK_0_TO_I2S |
++ PLAYBACK_1_TO_SPDIF |
++ CAPTURE_0_FROM_I2S_2 |
++ CAPTURE_1_FROM_SPDIF;
+ break;
+ }
+ if (id->driver_data == MODEL_MERIDIAN ||
--- /dev/null
+From 5591bf07225523600450edd9e6ad258bb877b779 Mon Sep 17 00:00:00 2001
+From: Dan Rosenberg <drosenberg@vsecurity.com>
+Date: Tue, 28 Sep 2010 14:18:20 -0400
+Subject: ALSA: prevent heap corruption in snd_ctl_new()
+
+From: Dan Rosenberg <drosenberg@vsecurity.com>
+
+commit 5591bf07225523600450edd9e6ad258bb877b779 upstream.
+
+The snd_ctl_new() function in sound/core/control.c allocates space for a
+snd_kcontrol struct by performing arithmetic operations on a
+user-provided size without checking for integer overflow. If a user
+provides a large enough size, an overflow will occur, the allocated
+chunk will be too small, and a second user-influenced value will be
+written repeatedly past the bounds of this chunk. This code is
+reachable by unprivileged users who have permission to open
+a /dev/snd/controlC* device (on many distros, this is group "audio") via
+the SNDRV_CTL_IOCTL_ELEM_ADD and SNDRV_CTL_IOCTL_ELEM_REPLACE ioctls.
+
+Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/control.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/sound/core/control.c
++++ b/sound/core/control.c
+@@ -31,6 +31,7 @@
+
+ /* max number of user-defined controls */
+ #define MAX_USER_CONTROLS 32
++#define MAX_CONTROL_COUNT 1028
+
+ struct snd_kctl_ioctl {
+ struct list_head list; /* list of all ioctls */
+@@ -195,6 +196,10 @@ static struct snd_kcontrol *snd_ctl_new(
+
+ if (snd_BUG_ON(!control || !control->count))
+ return NULL;
++
++ if (control->count > MAX_CONTROL_COUNT)
++ return NULL;
++
+ kctl = kzalloc(sizeof(*kctl) + sizeof(struct snd_kcontrol_volatile) * control->count, GFP_KERNEL);
+ if (kctl == NULL) {
+ snd_printk(KERN_ERR "Cannot allocate control instance\n");
--- /dev/null
+From aa73aec6c385e2c797ac25cc7ccf0318031de7c8 Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Fri, 15 Oct 2010 12:06:18 +0200
+Subject: ALSA: rawmidi: fix oops (use after free) when unloading a driver module
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit aa73aec6c385e2c797ac25cc7ccf0318031de7c8 upstream.
+
+When a driver module is unloaded and the last still open file is a raw
+MIDI device, the card and its devices will be actually freed in the
+snd_card_file_remove() call when that file is closed. Afterwards, rmidi
+and rmidi->card point into freed memory, so the module pointer is likely
+to be garbage.
+(This was introduced by commit 9a1b64caac82aa02cb74587ffc798e6f42c6170a.)
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Reported-by: Krzysztof Foltman <wdev@foltman.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/rawmidi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/sound/core/rawmidi.c
++++ b/sound/core/rawmidi.c
+@@ -535,13 +535,15 @@ static int snd_rawmidi_release(struct in
+ {
+ struct snd_rawmidi_file *rfile;
+ struct snd_rawmidi *rmidi;
++ struct module *module;
+
+ rfile = file->private_data;
+ rmidi = rfile->rmidi;
+ rawmidi_release_priv(rfile);
+ kfree(rfile);
++ module = rmidi->card->module;
+ snd_card_file_remove(rmidi->card, file);
+- module_put(rmidi->card->module);
++ module_put(module);
+ return 0;
+ }
+
--- /dev/null
+From e68d3b316ab7b02a074edc4f770e6a746390cb7d Mon Sep 17 00:00:00 2001
+From: Dan Rosenberg <drosenberg@vsecurity.com>
+Date: Sat, 25 Sep 2010 11:07:27 -0400
+Subject: ALSA: sound/pci/rme9652: prevent reading uninitialized stack memory
+
+From: Dan Rosenberg <drosenberg@vsecurity.com>
+
+commit e68d3b316ab7b02a074edc4f770e6a746390cb7d upstream.
+
+The SNDRV_HDSP_IOCTL_GET_CONFIG_INFO and
+SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctls in hdspm.c and hdsp.c allow
+unprivileged users to read uninitialized kernel stack memory, because
+several fields of the hdsp{m}_config_info structs declared on the stack
+are not altered or zeroed before being copied back to the user. This
+patch takes care of it.
+
+Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/rme9652/hdsp.c | 1 +
+ sound/pci/rme9652/hdspm.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/sound/pci/rme9652/hdsp.c
++++ b/sound/pci/rme9652/hdsp.c
+@@ -4609,6 +4609,7 @@ static int snd_hdsp_hwdep_ioctl(struct s
+ if (err < 0)
+ return err;
+
++ memset(&info, 0, sizeof(info));
+ spin_lock_irqsave(&hdsp->lock, flags);
+ info.pref_sync_ref = (unsigned char)hdsp_pref_sync_ref(hdsp);
+ info.wordclock_sync_check = (unsigned char)hdsp_wc_sync_check(hdsp);
+--- a/sound/pci/rme9652/hdspm.c
++++ b/sound/pci/rme9652/hdspm.c
+@@ -4127,6 +4127,7 @@ static int snd_hdspm_hwdep_ioctl(struct
+
+ case SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO:
+
++ memset(&info, 0, sizeof(info));
+ spin_lock_irq(&hdspm->lock);
+ info.pref_sync_ref = hdspm_pref_sync_ref(hdspm);
+ info.wordclock_sync_check = hdspm_wc_sync_check(hdspm);
--- /dev/null
+From 1a8e41cd672f894bbd74874eac601e6cedf838fb Mon Sep 17 00:00:00 2001
+From: Catalin Marinas <catalin.marinas@arm.com>
+Date: Thu, 16 Sep 2010 17:57:17 +0100
+Subject: ARM: 6395/1: VExpress: Set bit 22 in the PL310 (cache controller) AuxCtlr register
+
+From: Catalin Marinas <catalin.marinas@arm.com>
+
+commit 1a8e41cd672f894bbd74874eac601e6cedf838fb upstream.
+
+Clearing bit 22 in the PL310 Auxiliary Control register (shared
+attribute override enable) has the side effect of transforming Normal
+Shared Non-cacheable reads into Cacheable no-allocate reads.
+
+Coherent DMA buffers in Linux always have a Cacheable alias via the
+kernel linear mapping and the processor can speculatively load cache
+lines into the PL310 controller. With bit 22 cleared, Non-cacheable
+reads would unexpectedly hit such cache lines leading to buffer
+corruption.
+
+Cc: Nicolas Pitre <nicolas.pitre@linaro.org>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/mach-vexpress/ct-ca9x4.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/mach-vexpress/ct-ca9x4.c
++++ b/arch/arm/mach-vexpress/ct-ca9x4.c
+@@ -225,7 +225,7 @@ static void ct_ca9x4_init(void)
+ int i;
+
+ #ifdef CONFIG_CACHE_L2X0
+- l2x0_init(MMIO_P2V(CT_CA9X4_L2CC), 0x00000000, 0xfe0fffff);
++ l2x0_init(MMIO_P2V(CT_CA9X4_L2CC), 0x00400000, 0xfe0fffff);
+ #endif
+
+ clkdev_add_table(lookups, ARRAY_SIZE(lookups));
--- /dev/null
+From 79e27dc0677b969e2d53b76fa0fa58467cce946a Mon Sep 17 00:00:00 2001
+From: Peter Korsgaard <jacmet@sunsite.dk>
+Date: Sat, 18 Sep 2010 19:55:10 +0100
+Subject: ARM: 6400/1: at91: fix arch_gettimeoffset fallout
+
+From: Peter Korsgaard <jacmet@sunsite.dk>
+
+commit 79e27dc0677b969e2d53b76fa0fa58467cce946a upstream.
+
+5cfc8ee0bb51 (ARM: convert arm to arch_gettimeoffset()) marked all of
+at91 AND at91x40 as needing ARCH_USES_GETTIMEOFFSET, and hence no high
+res timer support / accurate clock_gettime() - But only at91x40 needs it.
+
+Signed-off-by: Peter Korsgaard <peter.korsgaard@barco.com>
+Acked-by: John Stultz <johnstul@us.ibm.com>
+Acked-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -273,7 +273,6 @@ config ARCH_AT91
+ bool "Atmel AT91"
+ select ARCH_REQUIRE_GPIOLIB
+ select HAVE_CLK
+- select ARCH_USES_GETTIMEOFFSET
+ help
+ This enables support for systems based on the Atmel AT91RM9200,
+ AT91SAM9 and AT91CAP9 processors.
--- /dev/null
+From 6a2a11dbea5db417d200d38dda53c30a2e5603e0 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Thu, 14 Oct 2010 17:14:57 -0400
+Subject: drm/radeon/kms: avivo cursor workaround applies to evergreen as well
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit 6a2a11dbea5db417d200d38dda53c30a2e5603e0 upstream.
+
+Fixes cursor corruption in certain cases.
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_cursor.c | 28 ++++++++++++----------------
+ 1 file changed, 12 insertions(+), 16 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_cursor.c
++++ b/drivers/gpu/drm/radeon/radeon_cursor.c
+@@ -203,6 +203,7 @@ int radeon_crtc_cursor_move(struct drm_c
+ struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
+ struct radeon_device *rdev = crtc->dev->dev_private;
+ int xorigin = 0, yorigin = 0;
++ int w = radeon_crtc->cursor_width;
+
+ if (x < 0)
+ xorigin = -x + 1;
+@@ -213,22 +214,7 @@ int radeon_crtc_cursor_move(struct drm_c
+ if (yorigin >= CURSOR_HEIGHT)
+ yorigin = CURSOR_HEIGHT - 1;
+
+- radeon_lock_cursor(crtc, true);
+- if (ASIC_IS_DCE4(rdev)) {
+- /* cursors are offset into the total surface */
+- x += crtc->x;
+- y += crtc->y;
+- DRM_DEBUG("x %d y %d c->x %d c->y %d\n", x, y, crtc->x, crtc->y);
+-
+- /* XXX: check if evergreen has the same issues as avivo chips */
+- WREG32(EVERGREEN_CUR_POSITION + radeon_crtc->crtc_offset,
+- ((xorigin ? 0 : x) << 16) |
+- (yorigin ? 0 : y));
+- WREG32(EVERGREEN_CUR_HOT_SPOT + radeon_crtc->crtc_offset, (xorigin << 16) | yorigin);
+- WREG32(EVERGREEN_CUR_SIZE + radeon_crtc->crtc_offset,
+- ((radeon_crtc->cursor_width - 1) << 16) | (radeon_crtc->cursor_height - 1));
+- } else if (ASIC_IS_AVIVO(rdev)) {
+- int w = radeon_crtc->cursor_width;
++ if (ASIC_IS_AVIVO(rdev)) {
+ int i = 0;
+ struct drm_crtc *crtc_p;
+
+@@ -260,7 +246,17 @@ int radeon_crtc_cursor_move(struct drm_c
+ if (w <= 0)
+ w = 1;
+ }
++ }
+
++ radeon_lock_cursor(crtc, true);
++ if (ASIC_IS_DCE4(rdev)) {
++ WREG32(EVERGREEN_CUR_POSITION + radeon_crtc->crtc_offset,
++ ((xorigin ? 0 : x) << 16) |
++ (yorigin ? 0 : y));
++ WREG32(EVERGREEN_CUR_HOT_SPOT + radeon_crtc->crtc_offset, (xorigin << 16) | yorigin);
++ WREG32(EVERGREEN_CUR_SIZE + radeon_crtc->crtc_offset,
++ ((w - 1) << 16) | (radeon_crtc->cursor_height - 1));
++ } else if (ASIC_IS_AVIVO(rdev)) {
+ WREG32(AVIVO_D1CUR_POSITION + radeon_crtc->crtc_offset,
+ ((xorigin ? 0 : x) << 16) |
+ (yorigin ? 0 : y));
--- /dev/null
+From d31dba58480c3cdd458f449261d72ecd15287792 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Mon, 11 Oct 2010 12:41:32 -0400
+Subject: drm/radeon/kms: fix bad cast/shift in evergreen.c
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit d31dba58480c3cdd458f449261d72ecd15287792 upstream.
+
+Missing parens.
+
+fixes:
+https://bugs.freedesktop.org/show_bug.cgi?id=30718
+
+Reported-by: Dave Gilbert <freedesktop@treblig.org>
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Reviewed-by: Matt Turner <mattst88@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/evergreen.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -1120,7 +1120,7 @@ static void evergreen_gpu_init(struct ra
+
+ WREG32(RCU_IND_INDEX, 0x203);
+ efuse_straps_3 = RREG32(RCU_IND_DATA);
+- efuse_box_bit_127_124 = (u8)(efuse_straps_3 & 0xF0000000) >> 28;
++ efuse_box_bit_127_124 = (u8)((efuse_straps_3 & 0xF0000000) >> 28);
+
+ switch(efuse_box_bit_127_124) {
+ case 0x0:
--- /dev/null
+From d20d5ffab92f00188f360c44c791a5ffb988247c Mon Sep 17 00:00:00 2001
+From: Antonio Ospite <ospite@studenti.unina.it>
+Date: Tue, 5 Oct 2010 17:20:16 +0200
+Subject: HID: hidraw, fix a NULL pointer dereference in hidraw_ioctl
+
+From: Antonio Ospite <ospite@studenti.unina.it>
+
+commit d20d5ffab92f00188f360c44c791a5ffb988247c upstream.
+
+BUG: unable to handle kernel NULL pointer dereference at 0000000000000028
+IP: [<ffffffffa02c66b4>] hidraw_ioctl+0xfc/0x32c [hid]
+[...]
+
+This is reproducible by disconnecting the device while userspace does
+ioctl in a loop and doesn't check return values in order to exit the
+loop.
+
+Signed-off-by: Antonio Ospite <ospite@studenti.unina.it>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hid/hidraw.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/hid/hidraw.c
++++ b/drivers/hid/hidraw.c
+@@ -246,6 +246,10 @@ static long hidraw_ioctl(struct file *fi
+
+ mutex_lock(&minors_lock);
+ dev = hidraw_table[minor];
++ if (!dev) {
++ ret = -ENODEV;
++ goto out;
++ }
+
+ switch (cmd) {
+ case HIDIOCGRDESCSIZE:
+@@ -319,6 +323,7 @@ static long hidraw_ioctl(struct file *fi
+
+ ret = -ENOTTY;
+ }
++out:
+ mutex_unlock(&minors_lock);
+ return ret;
+ }
--- /dev/null
+From e42dee9a99a3ecd32b5c027e8f7411fb5bc11eb6 Mon Sep 17 00:00:00 2001
+From: Antonio Ospite <ospite@studenti.unina.it>
+Date: Tue, 5 Oct 2010 17:20:17 +0200
+Subject: HID: hidraw, fix a NULL pointer dereference in hidraw_write
+
+From: Antonio Ospite <ospite@studenti.unina.it>
+
+commit e42dee9a99a3ecd32b5c027e8f7411fb5bc11eb6 upstream.
+
+BUG: unable to handle kernel NULL pointer dereference at 0000000000000028
+IP: [<ffffffffa0f0a625>] hidraw_write+0x3b/0x116 [hid]
+[...]
+
+This is reproducible by disconnecting the device while userspace writes
+to dev node in a loop and doesn't check return values in order to exit
+the loop.
+
+Signed-off-by: Antonio Ospite <ospite@studenti.unina.it>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hid/hidraw.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/hid/hidraw.c
++++ b/drivers/hid/hidraw.c
+@@ -111,6 +111,12 @@ static ssize_t hidraw_write(struct file
+ int ret = 0;
+
+ mutex_lock(&minors_lock);
++
++ if (!hidraw_table[minor]) {
++ ret = -ENODEV;
++ goto out;
++ }
++
+ dev = hidraw_table[minor]->hid;
+
+ if (!dev->hid_output_raw_report) {
--- /dev/null
+From f7c77a3dc4683659b6f0d1b6cbc82b6253d095e0 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 23 Sep 2010 10:01:11 -0700
+Subject: hwmon: (lis3) Fix Oops with NULL platform data
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit f7c77a3dc4683659b6f0d1b6cbc82b6253d095e0 upstream.
+
+The recent addition of threaded irq handler causes a NULL dereference
+when used with hp_accel driver, which has NULL pdata.
+
+Acked-by: Samu Onkalo <samu.p.onkalo@nokia.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/lis3lv02d.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/hwmon/lis3lv02d.c
++++ b/drivers/hwmon/lis3lv02d.c
+@@ -277,7 +277,7 @@ static irqreturn_t lis302dl_interrupt(in
+ wake_up_interruptible(&lis3_dev.misc_wait);
+ kill_fasync(&lis3_dev.async_queue, SIGIO, POLL_IN);
+ out:
+- if (lis3_dev.whoami == WAI_8B && lis3_dev.idev &&
++ if (lis3_dev.pdata && lis3_dev.whoami == WAI_8B && lis3_dev.idev &&
+ lis3_dev.idev->input->users)
+ return IRQ_WAKE_THREAD;
+ return IRQ_HANDLED;
+@@ -718,7 +718,7 @@ int lis3lv02d_init_device(struct lis3lv0
+ * io-apic is not configurable (and generates a warning) but I keep it
+ * in case of support for other hardware.
+ */
+- if (dev->whoami == WAI_8B)
++ if (dev->pdata && dev->whoami == WAI_8B)
+ thread_fn = lis302dl_interrupt_thread1_8b;
+ else
+ thread_fn = NULL;
--- /dev/null
+From f015ac3edd84ad72f88e08a4d83c56c360aae404 Mon Sep 17 00:00:00 2001
+From: Don Mullis <don.mullis@gmail.com>
+Date: Thu, 30 Sep 2010 15:15:32 -0700
+Subject: lib/list_sort: do not pass bad pointers to cmp callback
+
+From: Don Mullis <don.mullis@gmail.com>
+
+commit f015ac3edd84ad72f88e08a4d83c56c360aae404 upstream.
+
+If the original list is a POT in length, the first callback from line 73
+will pass a==b both pointing to the original list_head. This is dangerous
+because the 'list_sort()' user can use 'container_of()' and accesses the
+"containing" object, which does not necessary exist for the list head. So
+the user can access RAM which does not belong to him. If this is a write
+access, we can end up with memory corruption.
+
+Signed-off-by: Don Mullis <don.mullis@gmail.com>
+Tested-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ lib/list_sort.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/lib/list_sort.c
++++ b/lib/list_sort.c
+@@ -70,7 +70,7 @@ static void merge_and_restore_back_links
+ * element comparison is needed, so the client's cmp()
+ * routine can invoke cond_resched() periodically.
+ */
+- (*cmp)(priv, tail, tail);
++ (*cmp)(priv, tail->next, tail->next);
+
+ tail->next->prev = tail;
+ tail = tail->next;
--- /dev/null
+From 5336377d6225959624146629ce3fc88ee8ecda3d Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Tue, 5 Oct 2010 11:29:27 -0700
+Subject: modules: Fix module_bug_list list corruption race
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit 5336377d6225959624146629ce3fc88ee8ecda3d upstream.
+
+With all the recent module loading cleanups, we've minimized the code
+that sits under module_mutex, fixing various deadlocks and making it
+possible to do most of the module loading in parallel.
+
+However, that whole conversion totally missed the rather obscure code
+that adds a new module to the list for BUG() handling. That code was
+doubly obscure because (a) the code itself lives in lib/bugs.c (for
+dubious reasons) and (b) it gets called from the architecture-specific
+"module_finalize()" rather than from generic code.
+
+Calling it from arch-specific code makes no sense what-so-ever to begin
+with, and is now actively wrong since that code isn't protected by the
+module loading lock any more.
+
+So this commit moves the "module_bug_{finalize,cleanup}()" calls away
+from the arch-specific code, and into the generic code - and in the
+process protects it with the module_mutex so that the list operations
+are now safe.
+
+Future fixups:
+ - move the module list handling code into kernel/module.c where it
+ belongs.
+ - get rid of 'module_bug_list' and just use the regular list of modules
+ (called 'modules' - imagine that) that we already create and maintain
+ for other reasons.
+
+Reported-and-tested-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Rusty Russell <rusty@rustcorp.com.au>
+Cc: Adrian Bunk <bunk@kernel.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/avr32/kernel/module.c | 3 +--
+ arch/h8300/kernel/module.c | 3 +--
+ arch/mn10300/kernel/module.c | 3 +--
+ arch/parisc/kernel/module.c | 3 +--
+ arch/powerpc/kernel/module.c | 5 -----
+ arch/s390/kernel/module.c | 3 +--
+ arch/sh/kernel/module.c | 2 --
+ arch/x86/kernel/module.c | 3 +--
+ include/linux/module.h | 5 ++---
+ kernel/module.c | 4 ++++
+ lib/bug.c | 6 ++----
+ 11 files changed, 14 insertions(+), 26 deletions(-)
+
+--- a/arch/avr32/kernel/module.c
++++ b/arch/avr32/kernel/module.c
+@@ -314,10 +314,9 @@ int module_finalize(const Elf_Ehdr *hdr,
+ vfree(module->arch.syminfo);
+ module->arch.syminfo = NULL;
+
+- return module_bug_finalize(hdr, sechdrs, module);
++ return 0;
+ }
+
+ void module_arch_cleanup(struct module *module)
+ {
+- module_bug_cleanup(module);
+ }
+--- a/arch/h8300/kernel/module.c
++++ b/arch/h8300/kernel/module.c
+@@ -112,10 +112,9 @@ int module_finalize(const Elf_Ehdr *hdr,
+ const Elf_Shdr *sechdrs,
+ struct module *me)
+ {
+- return module_bug_finalize(hdr, sechdrs, me);
++ return 0;
+ }
+
+ void module_arch_cleanup(struct module *mod)
+ {
+- module_bug_cleanup(mod);
+ }
+--- a/arch/mn10300/kernel/module.c
++++ b/arch/mn10300/kernel/module.c
+@@ -206,7 +206,7 @@ int module_finalize(const Elf_Ehdr *hdr,
+ const Elf_Shdr *sechdrs,
+ struct module *me)
+ {
+- return module_bug_finalize(hdr, sechdrs, me);
++ return 0;
+ }
+
+ /*
+@@ -214,5 +214,4 @@ int module_finalize(const Elf_Ehdr *hdr,
+ */
+ void module_arch_cleanup(struct module *mod)
+ {
+- module_bug_cleanup(mod);
+ }
+--- a/arch/parisc/kernel/module.c
++++ b/arch/parisc/kernel/module.c
+@@ -941,11 +941,10 @@ int module_finalize(const Elf_Ehdr *hdr,
+ nsyms = newptr - (Elf_Sym *)symhdr->sh_addr;
+ DEBUGP("NEW num_symtab %lu\n", nsyms);
+ symhdr->sh_size = nsyms * sizeof(Elf_Sym);
+- return module_bug_finalize(hdr, sechdrs, me);
++ return 0;
+ }
+
+ void module_arch_cleanup(struct module *mod)
+ {
+ deregister_unwind_table(mod);
+- module_bug_cleanup(mod);
+ }
+--- a/arch/powerpc/kernel/module.c
++++ b/arch/powerpc/kernel/module.c
+@@ -65,10 +65,6 @@ int module_finalize(const Elf_Ehdr *hdr,
+ const Elf_Shdr *sect;
+ int err;
+
+- err = module_bug_finalize(hdr, sechdrs, me);
+- if (err)
+- return err;
+-
+ /* Apply feature fixups */
+ sect = find_section(hdr, sechdrs, "__ftr_fixup");
+ if (sect != NULL)
+@@ -101,5 +97,4 @@ int module_finalize(const Elf_Ehdr *hdr,
+
+ void module_arch_cleanup(struct module *mod)
+ {
+- module_bug_cleanup(mod);
+ }
+--- a/arch/s390/kernel/module.c
++++ b/arch/s390/kernel/module.c
+@@ -407,10 +407,9 @@ int module_finalize(const Elf_Ehdr *hdr,
+ {
+ vfree(me->arch.syminfo);
+ me->arch.syminfo = NULL;
+- return module_bug_finalize(hdr, sechdrs, me);
++ return 0;
+ }
+
+ void module_arch_cleanup(struct module *mod)
+ {
+- module_bug_cleanup(mod);
+ }
+--- a/arch/sh/kernel/module.c
++++ b/arch/sh/kernel/module.c
+@@ -149,13 +149,11 @@ int module_finalize(const Elf_Ehdr *hdr,
+ int ret = 0;
+
+ ret |= module_dwarf_finalize(hdr, sechdrs, me);
+- ret |= module_bug_finalize(hdr, sechdrs, me);
+
+ return ret;
+ }
+
+ void module_arch_cleanup(struct module *mod)
+ {
+- module_bug_cleanup(mod);
+ module_dwarf_cleanup(mod);
+ }
+--- a/arch/x86/kernel/module.c
++++ b/arch/x86/kernel/module.c
+@@ -239,11 +239,10 @@ int module_finalize(const Elf_Ehdr *hdr,
+ apply_paravirt(pseg, pseg + para->sh_size);
+ }
+
+- return module_bug_finalize(hdr, sechdrs, me);
++ return 0;
+ }
+
+ void module_arch_cleanup(struct module *mod)
+ {
+ alternatives_smp_module_del(mod);
+- module_bug_cleanup(mod);
+ }
+--- a/include/linux/module.h
++++ b/include/linux/module.h
+@@ -686,17 +686,16 @@ extern int module_sysfs_initialized;
+
+
+ #ifdef CONFIG_GENERIC_BUG
+-int module_bug_finalize(const Elf_Ehdr *, const Elf_Shdr *,
++void module_bug_finalize(const Elf_Ehdr *, const Elf_Shdr *,
+ struct module *);
+ void module_bug_cleanup(struct module *);
+
+ #else /* !CONFIG_GENERIC_BUG */
+
+-static inline int module_bug_finalize(const Elf_Ehdr *hdr,
++static inline void module_bug_finalize(const Elf_Ehdr *hdr,
+ const Elf_Shdr *sechdrs,
+ struct module *mod)
+ {
+- return 0;
+ }
+ static inline void module_bug_cleanup(struct module *mod) {}
+ #endif /* CONFIG_GENERIC_BUG */
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -1533,6 +1533,7 @@ static int __unlink_module(void *_mod)
+ {
+ struct module *mod = _mod;
+ list_del(&mod->list);
++ module_bug_cleanup(mod);
+ return 0;
+ }
+
+@@ -2538,6 +2539,7 @@ static noinline struct module *load_modu
+ if (err < 0)
+ goto ddebug;
+
++ module_bug_finalize(info.hdr, info.sechdrs, mod);
+ list_add_rcu(&mod->list, &modules);
+ mutex_unlock(&module_mutex);
+
+@@ -2564,6 +2566,8 @@ static noinline struct module *load_modu
+ mutex_lock(&module_mutex);
+ /* Unlink carefully: kallsyms could be walking list. */
+ list_del_rcu(&mod->list);
++ module_bug_cleanup(mod);
++
+ ddebug:
+ dynamic_debug_remove(debug);
+ unlock:
+--- a/lib/bug.c
++++ b/lib/bug.c
+@@ -72,8 +72,8 @@ static const struct bug_entry *module_fi
+ return NULL;
+ }
+
+-int module_bug_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
+- struct module *mod)
++void module_bug_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
++ struct module *mod)
+ {
+ char *secstrings;
+ unsigned int i;
+@@ -97,8 +97,6 @@ int module_bug_finalize(const Elf_Ehdr *
+ * could potentially lead to deadlock and thus be counter-productive.
+ */
+ list_add(&mod->bug_list, &module_bug_list);
+-
+- return 0;
+ }
+
+ void module_bug_cleanup(struct module *mod)
--- /dev/null
+From bb7ab785ad05a97a2c9ffb3a06547ed39f3133e8 Mon Sep 17 00:00:00 2001
+From: Jiri Olsa <jolsa@redhat.com>
+Date: Tue, 21 Sep 2010 03:26:35 -0400
+Subject: oprofile: Add Support for Intel CPU Family 6 / Model 29
+
+From: Jiri Olsa <jolsa@redhat.com>
+
+commit bb7ab785ad05a97a2c9ffb3a06547ed39f3133e8 upstream.
+
+This patch adds CPU type detection for dunnington processor (Family 6
+/ Model 29) to be identified as core 2 family cpu type (wikipedia
+source).
+
+I tested oprofile on Intel(R) Xeon(R) CPU E7440 reporting itself as
+model 29, and it runs without an issue.
+
+Spec:
+
+ http://www.intel.com/Assets/en_US/PDF/specupdate/320336.pdf
+
+Signed-off-by: Jiri Olsa <jolsa@redhat.com>
+Acked-by: Andi Kleen <ak@linux.intel.com>
+Signed-off-by: Robert Richter <robert.richter@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/oprofile/nmi_int.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/x86/oprofile/nmi_int.c
++++ b/arch/x86/oprofile/nmi_int.c
+@@ -674,6 +674,7 @@ static int __init ppro_init(char **cpu_t
+ case 0x0f:
+ case 0x16:
+ case 0x17:
++ case 0x1d:
+ *cpu_type = "i386/core_2";
+ break;
+ case 0x1a:
--- /dev/null
+From 98d943b02f6f1b57787ff1aa6f34d019a407e3ee Mon Sep 17 00:00:00 2001
+From: Robert Richter <robert.richter@amd.com>
+Date: Wed, 29 Sep 2010 16:52:25 +0200
+Subject: oprofile, ARM: Release resources on failure
+
+From: Robert Richter <robert.richter@amd.com>
+
+commit 98d943b02f6f1b57787ff1aa6f34d019a407e3ee upstream.
+
+This patch fixes a resource leak on failure, where the
+oprofilefs and some counters may not released properly.
+
+Signed-off-by: Robert Richter <robert.richter@amd.com>
+Acked-by: Will Deacon <will.deacon@arm.com>
+Cc: linux-arm-kernel@lists.infradead.org
+LKML-Reference: <20100929145225.GJ13563@erda.amd.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/oprofile/common.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/oprofile/common.c
++++ b/arch/arm/oprofile/common.c
+@@ -102,6 +102,7 @@ static int op_create_counter(int cpu, in
+ if (IS_ERR(pevent)) {
+ ret = PTR_ERR(pevent);
+ } else if (pevent->state != PERF_EVENT_STATE_ACTIVE) {
++ perf_event_release_kernel(pevent);
+ pr_warning("oprofile: failed to enable event %d "
+ "on CPU %d\n", event, cpu);
+ ret = -EBUSY;
+@@ -365,6 +366,7 @@ int __init oprofile_arch_init(struct opr
+ ret = init_driverfs();
+ if (ret) {
+ kfree(counter_config);
++ counter_config = NULL;
+ return ret;
+ }
+
+@@ -402,7 +404,6 @@ void oprofile_arch_exit(void)
+ struct perf_event *event;
+
+ if (*perf_events) {
+- exit_driverfs();
+ for_each_possible_cpu(cpu) {
+ for (id = 0; id < perf_num_counters; ++id) {
+ event = perf_events[cpu][id];
+@@ -413,8 +414,10 @@ void oprofile_arch_exit(void)
+ }
+ }
+
+- if (counter_config)
++ if (counter_config) {
+ kfree(counter_config);
++ exit_driverfs();
++ }
+ }
+ #else
+ int __init oprofile_arch_init(struct oprofile_operations *ops)
--- /dev/null
+From bec658ff31453a5726b1c188674d587a5d40c482 Mon Sep 17 00:00:00 2001
+From: Steve Wise <swise@opengridcomputing.com>
+Date: Sat, 18 Sep 2010 19:38:21 -0500
+Subject: RDMA/cxgb3: Turn off RX coalescing for iWARP connections
+
+From: Steve Wise <swise@opengridcomputing.com>
+
+commit bec658ff31453a5726b1c188674d587a5d40c482 upstream.
+
+The HW by default has RX coalescing on. For iWARP connections, this
+causes a 100ms delay in connection establishement due to the ingress
+MPA Start message being stalled in HW. So explicitly turn RX
+coalescing off when setting up iWARP connections.
+
+This was causing very bad performance for NP64 gather operations using
+Open MPI, due to the way it sets up connections on larger jobs.
+
+Signed-off-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Roland Dreier <rolandd@cisco.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/infiniband/hw/cxgb3/iwch_cm.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c
++++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
+@@ -463,7 +463,8 @@ static int send_connect(struct iwch_ep *
+ V_MSS_IDX(mtu_idx) |
+ V_L2T_IDX(ep->l2t->idx) | V_TX_CHANNEL(ep->l2t->smt_idx);
+ opt0l = V_TOS((ep->tos >> 2) & M_TOS) | V_RCV_BUFSIZ(rcv_win>>10);
+- opt2 = V_FLAVORS_VALID(1) | V_CONG_CONTROL_FLAVOR(cong_flavor);
++ opt2 = F_RX_COALESCE_VALID | V_RX_COALESCE(0) | V_FLAVORS_VALID(1) |
++ V_CONG_CONTROL_FLAVOR(cong_flavor);
+ skb->priority = CPL_PRIORITY_SETUP;
+ set_arp_failure_handler(skb, act_open_req_arp_failure);
+
+@@ -1280,7 +1281,8 @@ static void accept_cr(struct iwch_ep *ep
+ V_MSS_IDX(mtu_idx) |
+ V_L2T_IDX(ep->l2t->idx) | V_TX_CHANNEL(ep->l2t->smt_idx);
+ opt0l = V_TOS((ep->tos >> 2) & M_TOS) | V_RCV_BUFSIZ(rcv_win>>10);
+- opt2 = V_FLAVORS_VALID(1) | V_CONG_CONTROL_FLAVOR(cong_flavor);
++ opt2 = F_RX_COALESCE_VALID | V_RX_COALESCE(0) | V_FLAVORS_VALID(1) |
++ V_CONG_CONTROL_FLAVOR(cong_flavor);
+
+ rpl = cplhdr(skb);
+ rpl->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD));
--- /dev/null
+From 0026e00523a85b90a92a93ddf6660939ecef3e54 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 21 Sep 2010 15:01:53 -0400
+Subject: USB: fix bug in initialization of interface minor numbers
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 0026e00523a85b90a92a93ddf6660939ecef3e54 upstream.
+
+Recent changes in the usbhid layer exposed a bug in usbcore. If
+CONFIG_USB_DYNAMIC_MINORS is enabled then an interface may be assigned
+a minor number of 0. However interfaces that aren't registered as USB
+class devices also have their minor number set to 0, during
+initialization. As a result usb_find_interface() may return the
+wrong interface, leading to a crash.
+
+This patch (as1418) fixes the problem by initializing every
+interface's minor number to -1. It also cleans up the
+usb_register_dev() function, which besides being somewhat awkwardly
+written, does not unwind completely on all its error paths.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Tested-by: Philip J. Turmel <philip@turmel.org>
+Tested-by: Gabriel Craciunescu <nix.or.die@googlemail.com>
+Tested-by: Alex Riesen <raa.lkml@gmail.com>
+Tested-by: Matthias Bayer <jackdachef@gmail.com>
+CC: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/file.c | 35 ++++++++++++++++-------------------
+ drivers/usb/core/message.c | 1 +
+ 2 files changed, 17 insertions(+), 19 deletions(-)
+
+--- a/drivers/usb/core/file.c
++++ b/drivers/usb/core/file.c
+@@ -159,9 +159,9 @@ void usb_major_cleanup(void)
+ int usb_register_dev(struct usb_interface *intf,
+ struct usb_class_driver *class_driver)
+ {
+- int retval = -EINVAL;
++ int retval;
+ int minor_base = class_driver->minor_base;
+- int minor = 0;
++ int minor;
+ char name[20];
+ char *temp;
+
+@@ -173,12 +173,17 @@ int usb_register_dev(struct usb_interfac
+ */
+ minor_base = 0;
+ #endif
+- intf->minor = -1;
+-
+- dbg ("looking for a minor, starting at %d", minor_base);
+
+ if (class_driver->fops == NULL)
+- goto exit;
++ return -EINVAL;
++ if (intf->minor >= 0)
++ return -EADDRINUSE;
++
++ retval = init_usb_class();
++ if (retval)
++ return retval;
++
++ dev_dbg(&intf->dev, "looking for a minor, starting at %d", minor_base);
+
+ down_write(&minor_rwsem);
+ for (minor = minor_base; minor < MAX_USB_MINORS; ++minor) {
+@@ -186,20 +191,12 @@ int usb_register_dev(struct usb_interfac
+ continue;
+
+ usb_minors[minor] = class_driver->fops;
+-
+- retval = 0;
++ intf->minor = minor;
+ break;
+ }
+ up_write(&minor_rwsem);
+-
+- if (retval)
+- goto exit;
+-
+- retval = init_usb_class();
+- if (retval)
+- goto exit;
+-
+- intf->minor = minor;
++ if (intf->minor < 0)
++ return -EXFULL;
+
+ /* create a usb class device for this usb interface */
+ snprintf(name, sizeof(name), class_driver->name, minor - minor_base);
+@@ -213,11 +210,11 @@ int usb_register_dev(struct usb_interfac
+ "%s", temp);
+ if (IS_ERR(intf->usb_dev)) {
+ down_write(&minor_rwsem);
+- usb_minors[intf->minor] = NULL;
++ usb_minors[minor] = NULL;
++ intf->minor = -1;
+ up_write(&minor_rwsem);
+ retval = PTR_ERR(intf->usb_dev);
+ }
+-exit:
+ return retval;
+ }
+ EXPORT_SYMBOL_GPL(usb_register_dev);
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -1802,6 +1802,7 @@ free_interfaces:
+ intf->dev.groups = usb_interface_groups;
+ intf->dev.dma_mask = dev->dev.dma_mask;
+ INIT_WORK(&intf->reset_ws, __usb_queue_reset_device);
++ intf->minor = -1;
+ device_initialize(&intf->dev);
+ dev_set_name(&intf->dev, "%d-%s:%d.%d",
+ dev->bus->busnum, dev->devpath,
--- /dev/null
+From bd2e74d657fc7d514881cc2117e323790b257914 Mon Sep 17 00:00:00 2001
+From: Ming Lei <tom.leiming@gmail.com>
+Date: Mon, 20 Sep 2010 10:32:01 +0300
+Subject: usb: musb: gadget: fix kernel panic if using out ep with FIFO_TXRX style
+
+From: Ming Lei <tom.leiming@gmail.com>
+
+commit bd2e74d657fc7d514881cc2117e323790b257914 upstream.
+
+For shared fifo hw endpoint(with FIFO_TXRX style), only ep_in
+field of musb_hw_ep is intialized in musb_g_init_endpoints, and
+ep_out is not initialized, but musb_g_rx and rxstate may access
+ep_out field of musb_hw_ep by the method below:
+
+ musb_ep = &musb->endpoints[epnum].ep_out
+
+which can cause the kernel panic[1] below, this patch fixes the issue
+by getting 'musb_ep' from '&musb->endpoints[epnum].ep_in' for shared fifo
+endpoint.
+
+[1], kernel panic
+[root@OMAP3EVM /]# musb_interrupt 1583: ** IRQ peripheral usb0008 tx0000 rx4000
+musb_stage0_irq 460: <== Power=f0, DevCtl=99, int_usb=0x8
+musb_g_rx 772: <== (null), rxcsr 4007 ffffffe8
+musb_g_rx 786: iso overrun on ffffffe8
+Unable to handle kernel NULL pointer dereference at virtual address 00000008
+pgd = c0004000
+[00000008] *pgd=00000000
+Internal error: Oops: 17 [#1] PREEMPT
+last sysfs file: /sys/devices/platform/musb_hdrc/usb1/usb_device/usbdev1.1/dev
+Modules linked in: g_zero
+CPU: 0 Tainted: G W (2.6.35-rc6-gkh-wl+ #92)
+PC is at musb_g_rx+0xfc/0x2ec
+LR is at vprintk+0x3f4/0x458
+pc : [<c02c07a4>] lr : [<c006ccb0>] psr: 20000193
+sp : c760bd78 ip : c03c9d70 fp : c760bdbc
+r10: 00000000 r9 : fa0ab1e0 r8 : 0000000e
+r7 : c7e80158 r6 : ffffffe8 r5 : 00000001 r4 : 00004003
+r3 : 00010003 r2 : c760bcd8 r1 : c03cd030 r0 : 0000002e
+Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel
+Control: 10c5387d Table: 8778c019 DAC: 00000017
+Process kmemleak (pid: 421, stack limit = 0xc760a2e8)
+Stack: (0xc760bd78 to 0xc760c000)
+bd60: ffffffe8 c04b1b58
+bd80: ffffffe8 c7c01ac0 00000000 c7e80d24 c0084238 00000001 00000001 c7e80158
+bda0: 0000000e 00000008 00000099 000000f0 c760be04 c760bdc0 c02bcd68 c02c06b4
+bdc0: 00000099 00000008 00004000 c760bdd8 c03cc4f8 00000000 00000002 c7e80158
+bde0: c7d2e300 60000193 c760a000 0000005c 00000000 00000000 c760be24 c760be08
+be00: c02bcecc c02bc1ac c7d2e300 c7d2e300 0000005c c760a000 c760be54 c760be28
+be20: c00ad698 c02bce6c 00000000 c7d2e300 c067c258 0000005c c067c294 00000001
+be40: c760a000 00000000 c760be74 c760be58 c00af984 c00ad5fc 0000005c 00000000
+be60: 00000000 00000002 c760be8c c760be78 c0039080 c00af8d0 ffffffff fa200000
+be80: c760beec c760be90 c0039b6c c003900c 00000001 00000000 c7d1e240 00000000
+bea0: 00000000 c068bae8 00000000 60000013 00000001 00000000 00000000 c760beec
+bec0: c0064ecc c760bed8 c00ff7d0 c003a0a8 60000013 ffffffff 00000000 c068bae8
+bee0: c760bf24 c760bef0 c00ff7d0 c0064ec4 00000001 00000000 c00ff700 00000000
+bf00: c0087f00 00000000 60000013 c0d76a70 c0e23795 00000001 c760bf4c c760bf28
+bf20: c00ffdd8 c00ff70c c068bb08 c068bae8 60000013 c0100938 c068bb30 00000000
+bf40: c760bf84 c760bf50 c010014c c00ffd84 00000001 00000000 c010000c 00012c00
+bf60: c7c33f04 00012c00 c7c33f04 00000000 c0100938 00000000 c760bf9c c760bf88
+bf80: c01009a8 c0100018 c760bfa8 c7c33f04 c760bff4 c760bfa0 c0088000 c0100944
+bfa0: c760bf98 00000000 00000000 00000001 dead4ead ffffffff ffffffff c08ba2bc
+bfc0: 00000000 c049e7fa 00000000 c0087f70 c760bfd0 c760bfd0 c7c33f04 c0087f70
+bfe0: c006f5e8 00000013 00000000 c760bff8 c006f5e8 c0087f7c 7f0004ff df2000ff
+Backtrace:
+[<c02c06a8>] (musb_g_rx+0x0/0x2ec) from [<c02bcd68>] (musb_interrupt+0xbc8/0xcc0)
+[<c02bc1a0>] (musb_interrupt+0x0/0xcc0) from [<c02bcecc>] (generic_interrupt+0x6c/0x84)
+[<c02bce60>] (generic_interrupt+0x0/0x84) from [<c00ad698>] (handle_IRQ_event+0xa8/0x1ec)
+ r7:c760a000 r6:0000005c r5:c7d2e300 r4:c7d2e300
+[<c00ad5f0>] (handle_IRQ_event+0x0/0x1ec) from [<c00af984>] (handle_level_irq+0xc0/0x13c)
+[<c00af8c4>] (handle_level_irq+0x0/0x13c) from [<c0039080>] (asm_do_IRQ+0x80/0xa0)
+ r7:00000002 r6:00000000 r5:00000000 r4:0000005c
+[<c0039000>] (asm_do_IRQ+0x0/0xa0) from [<c0039b6c>] (__irq_svc+0x4c/0xb4)
+Exception stack(0xc760be90 to 0xc760bed8)
+be80: 00000001 00000000 c7d1e240 00000000
+bea0: 00000000 c068bae8 00000000 60000013 00000001 00000000 00000000 c760beec
+bec0: c0064ecc c760bed8 c00ff7d0 c003a0a8 60000013 ffffffff
+ r5:fa200000 r4:ffffffff
+[<c0064eb8>] (sub_preempt_count+0x0/0x100) from [<c00ff7d0>] (find_and_get_object+0xd0/0x110)
+ r5:c068bae8 r4:00000000
+[<c00ff700>] (find_and_get_object+0x0/0x110) from [<c00ffdd8>] (scan_block+0x60/0x104)
+ r8:00000001 r7:c0e23795 r6:c0d76a70 r5:60000013 r4:00000000
+[<c00ffd78>] (scan_block+0x0/0x104) from [<c010014c>] (kmemleak_scan+0x140/0x484)
+[<c010000c>] (kmemleak_scan+0x0/0x484) from [<c01009a8>] (kmemleak_scan_thread+0x70/0xcc)
+ r8:00000000 r7:c0100938 r6:00000000 r5:c7c33f04 r4:00012c00
+[<c0100938>] (kmemleak_scan_thread+0x0/0xcc) from [<c0088000>] (kthread+0x90/0x98)
+ r5:c7c33f04 r4:c760bfa8
+[<c0087f70>] (kthread+0x0/0x98) from [<c006f5e8>] (do_exit+0x0/0x684)
+ r7:00000013 r6:c006f5e8 r5:c0087f70 r4:c7c33f04
+Code: e3002312 e58d6000 e2833e16 eb0422d5 (e5963020)
+---[ end trace f3d5e96f75c297b7 ]---
+
+Signed-off-by: Ming Lei <tom.leiming@gmail.com>
+Reviewed-by: Sergei Shtylyov <sshtylyov@mvista.com>
+Cc: David Brownell <dbrownell@users.sourceforge.net>
+Cc: Anand Gadiyar <gadiyar@ti.com>
+Cc: Mike Frysinger <vapier@gentoo.org>
+Cc: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/musb/musb_gadget.c | 20 +++++++++++++++++---
+ 1 file changed, 17 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/musb/musb_gadget.c
++++ b/drivers/usb/musb/musb_gadget.c
+@@ -568,11 +568,19 @@ static void rxstate(struct musb *musb, s
+ {
+ const u8 epnum = req->epnum;
+ struct usb_request *request = &req->request;
+- struct musb_ep *musb_ep = &musb->endpoints[epnum].ep_out;
++ struct musb_ep *musb_ep;
+ void __iomem *epio = musb->endpoints[epnum].regs;
+ unsigned fifo_count = 0;
+- u16 len = musb_ep->packet_sz;
++ u16 len;
+ u16 csr = musb_readw(epio, MUSB_RXCSR);
++ struct musb_hw_ep *hw_ep = &musb->endpoints[epnum];
++
++ if (hw_ep->is_shared_fifo)
++ musb_ep = &hw_ep->ep_in;
++ else
++ musb_ep = &hw_ep->ep_out;
++
++ len = musb_ep->packet_sz;
+
+ /* We shouldn't get here while DMA is active, but we do... */
+ if (dma_channel_status(musb_ep->dma) == MUSB_DMA_STATUS_BUSY) {
+@@ -740,9 +748,15 @@ void musb_g_rx(struct musb *musb, u8 epn
+ u16 csr;
+ struct usb_request *request;
+ void __iomem *mbase = musb->mregs;
+- struct musb_ep *musb_ep = &musb->endpoints[epnum].ep_out;
++ struct musb_ep *musb_ep;
+ void __iomem *epio = musb->endpoints[epnum].regs;
+ struct dma_channel *dma;
++ struct musb_hw_ep *hw_ep = &musb->endpoints[epnum];
++
++ if (hw_ep->is_shared_fifo)
++ musb_ep = &hw_ep->ep_in;
++ else
++ musb_ep = &hw_ep->ep_out;
+
+ musb_ep_select(mbase, epnum);
+
--- /dev/null
+From a666e3e6098a9f56310e4ec2705f1dad124a34b5 Mon Sep 17 00:00:00 2001
+From: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Date: Sat, 11 Sep 2010 13:23:12 -0500
+Subject: usb: musb: gadget: restart request on clearing endpoint halt
+
+From: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+
+commit a666e3e6098a9f56310e4ec2705f1dad124a34b5 upstream.
+
+Commit 46034dca515bc4ddca0399ae58106d1f5f0d809f (USB: musb_gadget_ep0: stop
+abusing musb_gadget_set_halt()) forgot to restart a queued request after
+clearing the endpoint halt feature. This results in a couple of USB resets
+while enumerating the file-backed storage gadget due to CSW packet not being
+sent for the MODE SENSE(10) command.
+
+Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/musb/musb_gadget.c | 2 +-
+ drivers/usb/musb/musb_gadget.h | 2 ++
+ drivers/usb/musb/musb_gadget_ep0.c | 9 +++++++++
+ 3 files changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/musb/musb_gadget.c
++++ b/drivers/usb/musb/musb_gadget.c
+@@ -1095,7 +1095,7 @@ struct free_record {
+ /*
+ * Context: controller locked, IRQs blocked.
+ */
+-static void musb_ep_restart(struct musb *musb, struct musb_request *req)
++void musb_ep_restart(struct musb *musb, struct musb_request *req)
+ {
+ DBG(3, "<== %s request %p len %u on hw_ep%d\n",
+ req->tx ? "TX/IN" : "RX/OUT",
+--- a/drivers/usb/musb/musb_gadget.h
++++ b/drivers/usb/musb/musb_gadget.h
+@@ -105,4 +105,6 @@ extern void musb_gadget_cleanup(struct m
+
+ extern void musb_g_giveback(struct musb_ep *, struct usb_request *, int);
+
++extern void musb_ep_restart(struct musb *, struct musb_request *);
++
+ #endif /* __MUSB_GADGET_H */
+--- a/drivers/usb/musb/musb_gadget_ep0.c
++++ b/drivers/usb/musb/musb_gadget_ep0.c
+@@ -261,6 +261,7 @@ __acquires(musb->lock)
+ ctrlrequest->wIndex & 0x0f;
+ struct musb_ep *musb_ep;
+ struct musb_hw_ep *ep;
++ struct musb_request *request;
+ void __iomem *regs;
+ int is_in;
+ u16 csr;
+@@ -302,6 +303,14 @@ __acquires(musb->lock)
+ musb_writew(regs, MUSB_RXCSR, csr);
+ }
+
++ /* Maybe start the first request in the queue */
++ request = to_musb_request(
++ next_request(musb_ep));
++ if (!musb_ep->busy && request) {
++ DBG(3, "restarting the request\n");
++ musb_ep_restart(musb, request);
++ }
++
+ /* select ep0 again */
+ musb_ep_select(mbase, 0);
+ } break;
--- /dev/null
+From 882787ff8fdeb0be790547ee9b22b281095e95da Mon Sep 17 00:00:00 2001
+From: Jason Wang <jason77.wang@gmail.com>
+Date: Fri, 3 Sep 2010 06:57:19 -0300
+Subject: V4L/DVB: gspca - main: Fix a crash of some webcams on ARM arch
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jason Wang <jason77.wang@gmail.com>
+
+commit 882787ff8fdeb0be790547ee9b22b281095e95da upstream.
+
+When plugging some webcams on ARM, the system crashes.
+This is because we alloc buffer for an urb through usb_buffer_alloc,
+the alloced buffer is already in DMA coherent region, so we should
+set the flag of this urb to URB_NO_TRANSFER_DMA_MAP, otherwise when
+we submit this urb, the hcd core will handle this address as an
+non-DMA address and call dma_map_single/sg to map it. On arm
+architecture, dma_map_single a DMA coherent address will be catched
+by a BUG_ON().
+
+Signed-off-by: Jason Wang <jason77.wang@gmail.com>
+Signed-off-by: Jean-François Moine <moinejf@free.fr>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/gspca/gspca.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/video/gspca/gspca.c
++++ b/drivers/media/video/gspca/gspca.c
+@@ -223,6 +223,7 @@ static int alloc_and_submit_int_urb(stru
+ usb_rcvintpipe(dev, ep->bEndpointAddress),
+ buffer, buffer_len,
+ int_irq, (void *)gspca_dev, interval);
++ urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+ gspca_dev->int_urb = urb;
+ ret = usb_submit_urb(urb, GFP_KERNEL);
+ if (ret < 0) {
--- /dev/null
+From 04d174e99a6eca2f62b56c10ae1d7d0499d83e9d Mon Sep 17 00:00:00 2001
+From: Jean-François Moine <moinejf@free.fr>
+Date: Mon, 13 Sep 2010 05:22:37 -0300
+Subject: V4L/DVB: gspca - sn9c20x: Bad transfer size of Bayer images
+
+From: Jean-François Moine <moinejf@free.fr>
+
+commit 04d174e99a6eca2f62b56c10ae1d7d0499d83e9d upstream.
+
+As the end of frame marker does not contain any pixel, it must not be
+transferred.
+
+Reported-by: Ivo Jager <ivo.jager@siliconfields.net>
+Signed-off-by: Jean-François Moine <moinejf@free.fr>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/gspca/sn9c20x.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/media/video/gspca/sn9c20x.c
++++ b/drivers/media/video/gspca/sn9c20x.c
+@@ -2368,8 +2368,7 @@ static void sd_pkt_scan(struct gspca_dev
+ (data[33] << 10);
+ avg_lum >>= 9;
+ atomic_set(&sd->avg_lum, avg_lum);
+- gspca_frame_add(gspca_dev, LAST_PACKET,
+- data, len);
++ gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0);
+ return;
+ }
+ if (gspca_dev->last_packet_type == LAST_PACKET) {
--- /dev/null
+From d900329e20f4476db6461752accebcf7935a8055 Mon Sep 17 00:00:00 2001
+From: H. Peter Anvin <hpa@linux.intel.com>
+Date: Tue, 28 Sep 2010 15:35:01 -0700
+Subject: x86, cpu: After uncapping CPUID, re-run CPU feature detection
+
+From: H. Peter Anvin <hpa@linux.intel.com>
+
+commit d900329e20f4476db6461752accebcf7935a8055 upstream.
+
+After uncapping the CPUID level, we need to also re-run the CPU
+feature detection code.
+
+This resolves kernel bugzilla 16322.
+
+Reported-by: boris64 <bugzilla.kernel.org@boris64.net>
+LKML-Reference: <tip-@git.kernel.org>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/common.c | 2 +-
+ arch/x86/kernel/cpu/cpu.h | 1 +
+ arch/x86/kernel/cpu/intel.c | 1 +
+ 3 files changed, 3 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -537,7 +537,7 @@ void __cpuinit cpu_detect(struct cpuinfo
+ }
+ }
+
+-static void __cpuinit get_cpu_cap(struct cpuinfo_x86 *c)
++void __cpuinit get_cpu_cap(struct cpuinfo_x86 *c)
+ {
+ u32 tfms, xlvl;
+ u32 ebx;
+--- a/arch/x86/kernel/cpu/cpu.h
++++ b/arch/x86/kernel/cpu/cpu.h
+@@ -33,5 +33,6 @@ extern const struct cpu_dev *const __x86
+ *const __x86_cpu_dev_end[];
+
+ extern void cpu_detect_cache_sizes(struct cpuinfo_x86 *c);
++extern void get_cpu_cap(struct cpuinfo_x86 *c);
+
+ #endif
+--- a/arch/x86/kernel/cpu/intel.c
++++ b/arch/x86/kernel/cpu/intel.c
+@@ -39,6 +39,7 @@ static void __cpuinit early_init_intel(s
+ misc_enable &= ~MSR_IA32_MISC_ENABLE_LIMIT_CPUID;
+ wrmsrl(MSR_IA32_MISC_ENABLE, misc_enable);
+ c->cpuid_level = cpuid_eax(0);
++ get_cpu_cap(c);
+ }
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
