--- /dev/null
+From d2859fd49200f1f3efd8acdb54b6d51d3ab82302 Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Mon, 23 May 2011 08:26:16 +0200
+Subject: ALSA: HDA: Add quirk for Lenovo U350
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit d2859fd49200f1f3efd8acdb54b6d51d3ab82302 upstream.
+
+Add model=asus quirk for Lenovo Ideapad U350 to make internal mic
+work correctly.
+
+BugLink: http://bugs.launchpad.net/bugs/751681
+Reported-by: Kent Baxley <kent.baxley@canonical.com>
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_conexant.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -3132,6 +3132,7 @@ static struct snd_pci_quirk cxt5066_cfg_
+ SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo Thinkpad", CXT5066_THINKPAD),
+ SND_PCI_QUIRK(0x17aa, 0x21da, "Lenovo X220", CXT5066_THINKPAD),
+ SND_PCI_QUIRK(0x17aa, 0x21db, "Lenovo X220-tablet", CXT5066_THINKPAD),
++ SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo U350", CXT5066_ASUS),
+ SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo G560", CXT5066_ASUS),
+ SND_PCI_QUIRK_VENDOR(0x17aa, "Lenovo", CXT5066_IDEAPAD), /* Fallback for Lenovos without dock mic */
+ {}
--- /dev/null
+From 5a2d227fdc7a02ed1b4cebba391d8fb9ad57caaf Mon Sep 17 00:00:00 2001
+From: Adrian Wilkins <adrian.wilkins@nhs.net>
+Date: Thu, 19 May 2011 21:52:38 +0100
+Subject: ALSA: hda - Fix input-src parse in patch_analog.c
+
+From: Adrian Wilkins <adrian.wilkins@nhs.net>
+
+commit 5a2d227fdc7a02ed1b4cebba391d8fb9ad57caaf upstream.
+
+Compare pin type enum to the pin type and not the array index.
+Fixes bug#0005368.
+
+Signed-off-by: Adrian Wilkins <adrian.wilkins@nhs.net>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_analog.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_analog.c
++++ b/sound/pci/hda/patch_analog.c
+@@ -3167,6 +3167,7 @@ static void ad1988_auto_init_analog_inpu
+
+ for (i = 0; i < cfg->num_inputs; i++) {
+ hda_nid_t nid = cfg->inputs[i].pin;
++ int type = cfg->inputs[i].type;
+ switch (nid) {
+ case 0x15: /* port-C */
+ snd_hda_codec_write(codec, 0x33, 0, AC_VERB_SET_CONNECT_SEL, 0x0);
+@@ -3176,7 +3177,7 @@ static void ad1988_auto_init_analog_inpu
+ break;
+ }
+ snd_hda_codec_write(codec, nid, 0, AC_VERB_SET_PIN_WIDGET_CONTROL,
+- i == AUTO_PIN_MIC ? PIN_VREF80 : PIN_IN);
++ type == AUTO_PIN_MIC ? PIN_VREF80 : PIN_IN);
+ if (nid != AD1988_PIN_CD_NID)
+ snd_hda_codec_write(codec, nid, 0, AC_VERB_SET_AMP_GAIN_MUTE,
+ AMP_OUT_MUTE);
--- /dev/null
+From 50e3bbf9898840eead86f90a43b3625a2b2f4112 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 20 May 2011 16:29:09 +0200
+Subject: ALSA: hda - Use LPIB for ATI/AMD chipsets as default
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 50e3bbf9898840eead86f90a43b3625a2b2f4112 upstream.
+
+ATI and AMD chipsets seem not providing the proper position-buffer
+information, and it also doesn't provide FIFO register required by
+VIACOMBO fix. It's better to use LPIB for these.
+
+Reported-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/hda_intel.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2346,9 +2346,16 @@ static int __devinit check_position_fix(
+ /* Check VIA/ATI HD Audio Controller exist */
+ switch (chip->driver_type) {
+ case AZX_DRIVER_VIA:
+- case AZX_DRIVER_ATI:
+ /* Use link position directly, avoid any transfer problem. */
+ return POS_FIX_VIACOMBO;
++ case AZX_DRIVER_ATI:
++ /* ATI chipsets don't work well with position-buffer */
++ return POS_FIX_LPIB;
++ case AZX_DRIVER_GENERIC:
++ /* AMD chipsets also don't work with position-buffer */
++ if (chip->pci->vendor == PCI_VENDOR_ID_AMD)
++ return POS_FIX_LPIB;
++ break;
+ }
+
+ return POS_FIX_AUTO;
--- /dev/null
+From e033ebfb399227e01686260ac271029011bc6b47 Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Mon, 16 May 2011 12:09:29 +0200
+Subject: ALSA: HDA: Use one dmic only for Dell Studio 1558
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit e033ebfb399227e01686260ac271029011bc6b47 upstream.
+
+There are no signs of a dmic at node 0x0b, so the user is left with
+an additional internal mic which does not exist. This commit removes
+that non-existing mic.
+
+BugLink: http://bugs.launchpad.net/bugs/731706
+Reported-by: James Page <james.page@canonical.com>
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -1634,7 +1634,7 @@ static struct snd_pci_quirk stac92hd73xx
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02fe,
+ "Dell Studio XPS 1645", STAC_DELL_M6_BOTH),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0413,
+- "Dell Studio 1558", STAC_DELL_M6_BOTH),
++ "Dell Studio 1558", STAC_DELL_M6_DMIC),
+ {} /* terminator */
+ };
+
--- /dev/null
+From fb5af53d421d80725172427e9076f6e889603df6 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Sun, 15 May 2011 12:18:38 -0700
+Subject: ASoC: Add some missing volume update bit sets for wm_hubs
+ devices
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit fb5af53d421d80725172427e9076f6e889603df6 upstream.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Acked-by: Liam Girdwood <lrg@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm_hubs.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/codecs/wm_hubs.c
++++ b/sound/soc/codecs/wm_hubs.c
+@@ -835,17 +835,21 @@ int wm_hubs_add_analogue_controls(struct
+ snd_soc_update_bits(codec, WM8993_RIGHT_LINE_INPUT_3_4_VOLUME,
+ WM8993_IN2_VU, WM8993_IN2_VU);
+
++ snd_soc_update_bits(codec, WM8993_SPEAKER_VOLUME_LEFT,
++ WM8993_SPKOUT_VU, WM8993_SPKOUT_VU);
+ snd_soc_update_bits(codec, WM8993_SPEAKER_VOLUME_RIGHT,
+ WM8993_SPKOUT_VU, WM8993_SPKOUT_VU);
+
+ snd_soc_update_bits(codec, WM8993_LEFT_OUTPUT_VOLUME,
+- WM8993_HPOUT1L_ZC, WM8993_HPOUT1L_ZC);
++ WM8993_HPOUT1_VU | WM8993_HPOUT1L_ZC,
++ WM8993_HPOUT1_VU | WM8993_HPOUT1L_ZC);
+ snd_soc_update_bits(codec, WM8993_RIGHT_OUTPUT_VOLUME,
+ WM8993_HPOUT1_VU | WM8993_HPOUT1R_ZC,
+ WM8993_HPOUT1_VU | WM8993_HPOUT1R_ZC);
+
+ snd_soc_update_bits(codec, WM8993_LEFT_OPGA_VOLUME,
+- WM8993_MIXOUTL_ZC, WM8993_MIXOUTL_ZC);
++ WM8993_MIXOUTL_ZC | WM8993_MIXOUT_VU,
++ WM8993_MIXOUTL_ZC | WM8993_MIXOUT_VU);
+ snd_soc_update_bits(codec, WM8993_RIGHT_OPGA_VOLUME,
+ WM8993_MIXOUTR_ZC | WM8993_MIXOUT_VU,
+ WM8993_MIXOUTR_ZC | WM8993_MIXOUT_VU);
--- /dev/null
+From d0b48af6c2b887354d0893e598d92911ce52620e Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Sat, 14 May 2011 17:21:28 -0700
+Subject: ASoC: Ensure output PGA is enabled for line outputs in
+ wm_hubs
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit d0b48af6c2b887354d0893e598d92911ce52620e upstream.
+
+Also fix a left/right typo while we're at it.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Acked-by: Liam Girdwood <lrg@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm_hubs.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/sound/soc/codecs/wm_hubs.c
++++ b/sound/soc/codecs/wm_hubs.c
+@@ -786,17 +786,17 @@ static const struct snd_soc_dapm_route a
+ static const struct snd_soc_dapm_route lineout1_diff_routes[] = {
+ { "LINEOUT1 Mixer", "IN1L Switch", "IN1L PGA" },
+ { "LINEOUT1 Mixer", "IN1R Switch", "IN1R PGA" },
+- { "LINEOUT1 Mixer", "Output Switch", "Left Output Mixer" },
++ { "LINEOUT1 Mixer", "Output Switch", "Left Output PGA" },
+
+ { "LINEOUT1N Driver", NULL, "LINEOUT1 Mixer" },
+ { "LINEOUT1P Driver", NULL, "LINEOUT1 Mixer" },
+ };
+
+ static const struct snd_soc_dapm_route lineout1_se_routes[] = {
+- { "LINEOUT1N Mixer", "Left Output Switch", "Left Output Mixer" },
+- { "LINEOUT1N Mixer", "Right Output Switch", "Left Output Mixer" },
++ { "LINEOUT1N Mixer", "Left Output Switch", "Left Output PGA" },
++ { "LINEOUT1N Mixer", "Right Output Switch", "Right Output PGA" },
+
+- { "LINEOUT1P Mixer", "Left Output Switch", "Left Output Mixer" },
++ { "LINEOUT1P Mixer", "Left Output Switch", "Left Output PGA" },
+
+ { "LINEOUT1N Driver", NULL, "LINEOUT1N Mixer" },
+ { "LINEOUT1P Driver", NULL, "LINEOUT1P Mixer" },
+@@ -805,17 +805,17 @@ static const struct snd_soc_dapm_route l
+ static const struct snd_soc_dapm_route lineout2_diff_routes[] = {
+ { "LINEOUT2 Mixer", "IN2L Switch", "IN2L PGA" },
+ { "LINEOUT2 Mixer", "IN2R Switch", "IN2R PGA" },
+- { "LINEOUT2 Mixer", "Output Switch", "Right Output Mixer" },
++ { "LINEOUT2 Mixer", "Output Switch", "Right Output PGA" },
+
+ { "LINEOUT2N Driver", NULL, "LINEOUT2 Mixer" },
+ { "LINEOUT2P Driver", NULL, "LINEOUT2 Mixer" },
+ };
+
+ static const struct snd_soc_dapm_route lineout2_se_routes[] = {
+- { "LINEOUT2N Mixer", "Left Output Switch", "Left Output Mixer" },
+- { "LINEOUT2N Mixer", "Right Output Switch", "Left Output Mixer" },
++ { "LINEOUT2N Mixer", "Left Output Switch", "Left Output PGA" },
++ { "LINEOUT2N Mixer", "Right Output Switch", "Right Output PGA" },
+
+- { "LINEOUT2P Mixer", "Right Output Switch", "Right Output Mixer" },
++ { "LINEOUT2P Mixer", "Right Output Switch", "Right Output PGA" },
+
+ { "LINEOUT2N Driver", NULL, "LINEOUT2N Mixer" },
+ { "LINEOUT2P Driver", NULL, "LINEOUT2P Mixer" },
--- /dev/null
+From 7287c63e986fe1a51a89f4bb1327320274a7a741 Mon Sep 17 00:00:00 2001
+From: Eddie Wai <eddie.wai@broadcom.com>
+Date: Mon, 16 May 2011 11:13:18 -0700
+Subject: [SCSI] bnx2i: Fixed packet error created when the sq_size is
+ set to 16
+
+From: Eddie Wai <eddie.wai@broadcom.com>
+
+commit 7287c63e986fe1a51a89f4bb1327320274a7a741 upstream.
+
+The number of chip's internal command cell, which is use to generate
+SCSI cmd packets to the target, was not initialized correctly by
+the driver when the sq_size is changed from the default 128.
+This, in turn, will create a problem where the chip's transmit pipe
+will erroneously reuse an old command cell that is no longer valid.
+The fix is to correctly initialize the chip's command cell upon setup.
+
+Signed-off-by: Eddie Wai <eddie.wai@broadcom.com>
+Reviewed-by: Mike Christie <michaelc@cs.wisc.edu>
+Signed-off-by: James Bottomley <jbottomley@parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/bnx2i/bnx2i_hwi.c | 1 +
+ drivers/scsi/bnx2i/bnx2i_iscsi.c | 3 +++
+ 2 files changed, 4 insertions(+)
+
+--- a/drivers/scsi/bnx2i/bnx2i_hwi.c
++++ b/drivers/scsi/bnx2i/bnx2i_hwi.c
+@@ -1221,6 +1221,7 @@ int bnx2i_send_fw_iscsi_init_msg(struct
+ iscsi_init.dummy_buffer_addr_hi =
+ (u32) ((u64) hba->dummy_buf_dma >> 32);
+
++ hba->num_ccell = hba->max_sqes >> 1;
+ hba->ctx_ccell_tasks =
+ ((hba->num_ccell & 0xFFFF) | (hba->max_sqes << 16));
+ iscsi_init.num_ccells_per_conn = hba->num_ccell;
+--- a/drivers/scsi/bnx2i/bnx2i_iscsi.c
++++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c
+@@ -1205,6 +1205,9 @@ static int bnx2i_task_xmit(struct iscsi_
+ struct bnx2i_cmd *cmd = task->dd_data;
+ struct iscsi_cmd *hdr = (struct iscsi_cmd *) task->hdr;
+
++ if (bnx2i_conn->ep->num_active_cmds + 1 > hba->max_sqes)
++ return -ENOMEM;
++
+ /*
+ * If there is no scsi_cmnd this must be a mgmt task
+ */
--- /dev/null
+From d5307a078bb0288945c900c6f4a2fd77ba6d0817 Mon Sep 17 00:00:00 2001
+From: Eddie Wai <eddie.wai@broadcom.com>
+Date: Mon, 16 May 2011 11:13:19 -0700
+Subject: [SCSI] bnx2i: Updated the connection shutdown/cleanup
+ timeout
+
+From: Eddie Wai <eddie.wai@broadcom.com>
+
+commit d5307a078bb0288945c900c6f4a2fd77ba6d0817 upstream.
+
+Modified the 10s wait time for inflight offload connections to
+advance to the next state to 2s based on test result.
+Modified the 20s shutdown timeout to 30s based on test result.
+
+Signed-off-by: Eddie Wai <eddie.wai@broadcom.com>
+Reviewed-by: Mike Christie <michaelc@cs.wisc.edu>
+Signed-off-by: James Bottomley <jbottomley@parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/bnx2i/bnx2i_init.c | 2 +-
+ drivers/scsi/bnx2i/bnx2i_iscsi.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/bnx2i/bnx2i_init.c
++++ b/drivers/scsi/bnx2i/bnx2i_init.c
+@@ -227,7 +227,7 @@ void bnx2i_stop(void *handle)
+ wait_event_interruptible_timeout(hba->eh_wait,
+ (list_empty(&hba->ep_ofld_list) &&
+ list_empty(&hba->ep_destroy_list)),
+- 10 * HZ);
++ 2 * HZ);
+ /* Wait for all endpoints to be torn down, Chip will be reset once
+ * control returns to network driver. So it is required to cleanup and
+ * release all connection resources before returning from this routine.
+--- a/drivers/scsi/bnx2i/bnx2i_iscsi.c
++++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c
+@@ -858,7 +858,7 @@ struct bnx2i_hba *bnx2i_alloc_hba(struct
+ mutex_init(&hba->net_dev_lock);
+ init_waitqueue_head(&hba->eh_wait);
+ if (test_bit(BNX2I_NX2_DEV_57710, &hba->cnic_dev_type)) {
+- hba->hba_shutdown_tmo = 20 * HZ;
++ hba->hba_shutdown_tmo = 30 * HZ;
+ hba->conn_teardown_tmo = 20 * HZ;
+ hba->conn_ctx_destroy_tmo = 6 * HZ;
+ } else { /* 5706/5708/5709 */
--- /dev/null
+From cae13fe4cc3f24820ffb990c09110626837e85d4 Mon Sep 17 00:00:00 2001
+From: Timo Warns <Warns@pre-sense.de>
+Date: Thu, 19 May 2011 09:24:17 +0200
+Subject: Fix for buffer overflow in ldm_frag_add not sufficient
+
+From: Timo Warns <Warns@pre-sense.de>
+
+commit cae13fe4cc3f24820ffb990c09110626837e85d4 upstream.
+
+As Ben Hutchings discovered [1], the patch for CVE-2011-1017 (buffer
+overflow in ldm_frag_add) is not sufficient. The original patch in
+commit c340b1d64000 ("fs/partitions/ldm.c: fix oops caused by corrupted
+partition table") does not consider that, for subsequent fragments,
+previously allocated memory is used.
+
+[1] http://lkml.org/lkml/2011/5/6/407
+
+Reported-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Timo Warns <warns@pre-sense.de>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/partitions/ldm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/fs/partitions/ldm.c
++++ b/fs/partitions/ldm.c
+@@ -1335,6 +1335,11 @@ static bool ldm_frag_add (const u8 *data
+
+ list_add_tail (&f->list, frags);
+ found:
++ if (rec >= f->num) {
++ ldm_error("REC value (%d) exceeds NUM value (%d)", rec, f->num);
++ return false;
++ }
++
+ if (f->map & (1 << rec)) {
+ ldm_error ("Duplicate VBLK, part %d.", rec);
+ f->map &= 0x7F; /* Mark the group as broken */
--- /dev/null
+From fad4dab5e44e10acf6b0235e469cb8e773b58e31 Mon Sep 17 00:00:00 2001
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Date: Wed, 18 May 2011 17:06:05 +0200
+Subject: [SCSI] Fix Ultrastor asm snippet
+
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+
+commit fad4dab5e44e10acf6b0235e469cb8e773b58e31 upstream.
+
+Commit 1292500b replaced
+
+"=m" (*field) : "1" (*field)
+
+with
+
+"=m" (*field) :
+
+with comment "The following patch fixes it by using the '+' operator on
+the (*field) operand, marking it as read-write to gcc."
+'+' was actually forgotten. This really puts it.
+
+Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Signed-off-by: James Bottomley <jbottomley@parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/ultrastor.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/ultrastor.c
++++ b/drivers/scsi/ultrastor.c
+@@ -306,7 +306,7 @@ static inline int find_and_clear_bit_16(
+ "0: bsfw %1,%w0\n\t"
+ "btr %0,%1\n\t"
+ "jnc 0b"
+- : "=&r" (rv), "=m" (*field) :);
++ : "=&r" (rv), "+m" (*field) :);
+
+ return rv;
+ }
--- /dev/null
+From 23746a66d7d9e73402c68ef00d708796b97ebd72 Mon Sep 17 00:00:00 2001
+From: Jiri Kosina <jkosina@suse.cz>
+Date: Thu, 19 May 2011 17:58:07 +0200
+Subject: HID: magicmouse: ignore 'ivalid report id' while switching
+ modes
+
+From: Jiri Kosina <jkosina@suse.cz>
+
+commit 23746a66d7d9e73402c68ef00d708796b97ebd72 upstream.
+
+The device reponds with 'invalid report id' when feature report switching it
+into multitouch mode is sent to it.
+
+This has been silently ignored before 0825411ade ("HID: bt: Wait for ACK
+on Sent Reports"), but since this commit, it propagates -EIO from the _raw
+callback .
+
+So let the driver ignore -EIO as response to 0xd7,0x01 report, as that's
+how the device reacts in normal mode.
+
+Sad, but following reality.
+
+This fixes https://bugzilla.kernel.org/show_bug.cgi?id=35022
+
+Tested-by: Chase Douglas <chase.douglas@canonical.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hid/hid-magicmouse.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/hid/hid-magicmouse.c
++++ b/drivers/hid/hid-magicmouse.c
+@@ -501,9 +501,17 @@ static int magicmouse_probe(struct hid_d
+ }
+ report->size = 6;
+
++ /*
++ * The device reponds with 'invalid report id' when feature
++ * report switching it into multitouch mode is sent to it.
++ *
++ * This results in -EIO from the _raw low-level transport callback,
++ * but there seems to be no other way of switching the mode.
++ * Thus the super-ugly hacky success check below.
++ */
+ ret = hdev->hid_output_raw_report(hdev, feature, sizeof(feature),
+ HID_FEATURE_REPORT);
+- if (ret != sizeof(feature)) {
++ if (ret != -EIO) {
+ hid_err(hdev, "unable to request touch data (%d)\n", ret);
+ goto err_stop_hw;
+ }
--- /dev/null
+From 3116c86033079a1d4d4e84c40028f96b614843b8 Mon Sep 17 00:00:00 2001
+From: Vikram Narayanan <vikram186@gmail.com>
+Date: Tue, 24 May 2011 20:58:48 +0200
+Subject: i2c/writing-clients: Fix foo_driver.id_table
+
+From: Vikram Narayanan <vikram186@gmail.com>
+
+commit 3116c86033079a1d4d4e84c40028f96b614843b8 upstream.
+
+The i2c_device_id structure variable's name is not used in the
+i2c_driver structure.
+
+Signed-off-by: Vikram Narayanan <vikram186@gmail.com>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/i2c/writing-clients | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Documentation/i2c/writing-clients
++++ b/Documentation/i2c/writing-clients
+@@ -38,7 +38,7 @@ static struct i2c_driver foo_driver = {
+ .name = "foo",
+ },
+
+- .id_table = foo_ids,
++ .id_table = foo_idtable,
+ .probe = foo_probe,
+ .remove = foo_remove,
+ /* if device autodetection is needed: */
--- /dev/null
+From a3424216e4935221fdaa5ca3c26e024f11297164 Mon Sep 17 00:00:00 2001
+From: Jesse Barnes <jbarnes@virtuousgeek.org>
+Date: Mon, 28 Mar 2011 06:36:30 -0400
+Subject: ips: use interruptible waits in ips-monitor
+
+From: Jesse Barnes <jbarnes@virtuousgeek.org>
+
+commit a3424216e4935221fdaa5ca3c26e024f11297164 upstream.
+
+This is what I intended to do since:
+ 1) the driver handles variable waits just fine, and
+ 2) interruptible waits aren't reported as load in the load avg.
+
+Reported-and-tested-by: Andreas Hartmann <andihartmann@freenet.de>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Matthew Garrett <mjg@redhat.com>
+Cc: Leann Ogasawara <leann.ogasawara@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/intel_ips.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/platform/x86/intel_ips.c
++++ b/drivers/platform/x86/intel_ips.c
+@@ -1111,7 +1111,7 @@ static int ips_monitor(void *data)
+ last_msecs = jiffies_to_msecs(jiffies);
+ expire = jiffies + msecs_to_jiffies(IPS_SAMPLE_PERIOD);
+
+- __set_current_state(TASK_UNINTERRUPTIBLE);
++ __set_current_state(TASK_INTERRUPTIBLE);
+ mod_timer(&timer, expire);
+ schedule();
+
--- /dev/null
+From a1c15c59feee36267c43142a41152fbf7402afb6 Mon Sep 17 00:00:00 2001
+From: Namhyung Kim <namhyung@gmail.com>
+Date: Tue, 24 May 2011 16:48:55 +0200
+Subject: loop: handle on-demand devices correctly
+
+From: Namhyung Kim <namhyung@gmail.com>
+
+commit a1c15c59feee36267c43142a41152fbf7402afb6 upstream.
+
+When finding or allocating a loop device, loop_probe() did not take
+partition numbers into account so that it can result to a different
+device. Consider following example:
+
+$ sudo modprobe loop max_part=15
+$ ls -l /dev/loop*
+brw-rw---- 1 root disk 7, 0 2011-05-24 22:16 /dev/loop0
+brw-rw---- 1 root disk 7, 16 2011-05-24 22:16 /dev/loop1
+brw-rw---- 1 root disk 7, 32 2011-05-24 22:16 /dev/loop2
+brw-rw---- 1 root disk 7, 48 2011-05-24 22:16 /dev/loop3
+brw-rw---- 1 root disk 7, 64 2011-05-24 22:16 /dev/loop4
+brw-rw---- 1 root disk 7, 80 2011-05-24 22:16 /dev/loop5
+brw-rw---- 1 root disk 7, 96 2011-05-24 22:16 /dev/loop6
+brw-rw---- 1 root disk 7, 112 2011-05-24 22:16 /dev/loop7
+$ sudo mknod /dev/loop8 b 7 128
+$ sudo losetup /dev/loop8 ~/temp/disk-with-3-parts.img
+$ sudo losetup -a
+/dev/loop128: [0805]:278201 (/home/namhyung/temp/disk-with-3-parts.img)
+$ ls -l /dev/loop*
+brw-rw---- 1 root disk 7, 0 2011-05-24 22:16 /dev/loop0
+brw-rw---- 1 root disk 7, 16 2011-05-24 22:16 /dev/loop1
+brw-rw---- 1 root disk 7, 2048 2011-05-24 22:18 /dev/loop128
+brw-rw---- 1 root disk 7, 2049 2011-05-24 22:18 /dev/loop128p1
+brw-rw---- 1 root disk 7, 2050 2011-05-24 22:18 /dev/loop128p2
+brw-rw---- 1 root disk 7, 2051 2011-05-24 22:18 /dev/loop128p3
+brw-rw---- 1 root disk 7, 32 2011-05-24 22:16 /dev/loop2
+brw-rw---- 1 root disk 7, 48 2011-05-24 22:16 /dev/loop3
+brw-rw---- 1 root disk 7, 64 2011-05-24 22:16 /dev/loop4
+brw-rw---- 1 root disk 7, 80 2011-05-24 22:16 /dev/loop5
+brw-rw---- 1 root disk 7, 96 2011-05-24 22:16 /dev/loop6
+brw-rw---- 1 root disk 7, 112 2011-05-24 22:16 /dev/loop7
+brw-r--r-- 1 root root 7, 128 2011-05-24 22:17 /dev/loop8
+
+After this patch, /dev/loop8 - instead of /dev/loop128 - was
+accessed correctly.
+
+In addition, 'range' passed to blk_register_region() should
+include all range of dev_t that LOOP_MAJOR can address. It does
+not need to be limited by partition numbers unless 'max_loop'
+param was specified.
+
+Signed-off-by: Namhyung Kim <namhyung@gmail.com>
+Cc: Laurent Vivier <Laurent.Vivier@bull.net>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/block/loop.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -1674,7 +1674,7 @@ static struct kobject *loop_probe(dev_t
+ struct kobject *kobj;
+
+ mutex_lock(&loop_devices_mutex);
+- lo = loop_init_one(dev & MINORMASK);
++ lo = loop_init_one(MINOR(dev) >> part_shift);
+ kobj = lo ? get_disk(lo->lo_disk) : ERR_PTR(-ENOMEM);
+ mutex_unlock(&loop_devices_mutex);
+
+@@ -1715,10 +1715,10 @@ static int __init loop_init(void)
+
+ if (max_loop) {
+ nr = max_loop;
+- range = max_loop;
++ range = max_loop << part_shift;
+ } else {
+ nr = 8;
+- range = 1UL << (MINORBITS - part_shift);
++ range = 1UL << MINORBITS;
+ }
+
+ if (register_blkdev(LOOP_MAJOR, "loop"))
+@@ -1757,7 +1757,7 @@ static void __exit loop_exit(void)
+ unsigned long range;
+ struct loop_device *lo, *next;
+
+- range = max_loop ? max_loop : 1UL << (MINORBITS - part_shift);
++ range = max_loop ? max_loop << part_shift : 1UL << MINORBITS;
+
+ list_for_each_entry_safe(lo, next, &loop_devices, lo_list)
+ loop_del_one(lo);
--- /dev/null
+From 78f4bb367fd147a0e7e3998ba6e47109999d8814 Mon Sep 17 00:00:00 2001
+From: Namhyung Kim <namhyung@gmail.com>
+Date: Tue, 24 May 2011 16:48:54 +0200
+Subject: loop: limit 'max_part' module param to DISK_MAX_PARTS
+
+From: Namhyung Kim <namhyung@gmail.com>
+
+commit 78f4bb367fd147a0e7e3998ba6e47109999d8814 upstream.
+
+The 'max_part' parameter controls the number of maximum partition
+a loop block device can have. However if a user specifies very
+large value it would exceed the limitation of device minor number
+and can cause a kernel panic (or, at least, produce invalid
+device nodes in some cases).
+
+On my desktop system, following command kills the kernel. On qemu,
+it triggers similar oops but the kernel was alive:
+
+$ sudo modprobe loop max_part0000
+ ------------[ cut here ]------------
+ kernel BUG at /media/Linux_Data/project/linux/fs/sysfs/group.c:65!
+ invalid opcode: 0000 [#1] SMP
+ last sysfs file:
+ CPU 0
+ Modules linked in: loop(+)
+
+ Pid: 43, comm: insmod Tainted: G W 2.6.39-qemu+ #155 Bochs Bochs
+ RIP: 0010:[<ffffffff8113ce61>] [<ffffffff8113ce61>] internal_create_group=
++0x2a/0x170
+ RSP: 0018:ffff880007b3fde8 EFLAGS: 00000246
+ RAX: 00000000ffffffef RBX: ffff880007b3d878 RCX: 00000000000007b4
+ RDX: ffffffff8152da50 RSI: 0000000000000000 RDI: ffff880007b3d878
+ RBP: ffff880007b3fe38 R08: ffff880007b3fde8 R09: 0000000000000000
+ R10: ffff88000783b4a8 R11: ffff880007b3d878 R12: ffffffff8152da50
+ R13: ffff880007b3d868 R14: 0000000000000000 R15: ffff880007b3d800
+ FS: 0000000002137880(0063) GS:ffff880007c00000(0000) knlGS:00000000000000=
+00
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000000000422680 CR3: 0000000007b50000 CR4: 00000000000006b0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 0000000000000000 DR7: 0000000000000000
+ Process insmod (pid: 43, threadinfo ffff880007b3e000, task ffff880007afb9c=
+0)
+ Stack:
+ ffff880007b3fe58 ffffffff811e66dd ffff880007b3fe58 ffffffff811e570b
+ 0000000000000010 ffff880007b3d800 ffff880007a7b390 ffff880007b3d868
+ 0000000000400920 ffff880007b3d800 ffff880007b3fe48 ffffffff8113cfc8
+ Call Trace:
+ [<ffffffff811e66dd>] ? device_add+0x4bc/0x5af
+ [<ffffffff811e570b>] ? dev_set_name+0x3c/0x3e
+ [<ffffffff8113cfc8>] sysfs_create_group+0xe/0x12
+ [<ffffffff810b420e>] blk_trace_init_sysfs+0x14/0x16
+ [<ffffffff8116a090>] blk_register_queue+0x47/0xf7
+ [<ffffffff8116f527>] add_disk+0xdf/0x290
+ [<ffffffffa00060eb>] loop_init+0xeb/0x1b8 [loop]
+ [<ffffffffa0006000>] ? 0xffffffffa0005fff
+ [<ffffffff8100020a>] do_one_initcall+0x7a/0x12e
+ [<ffffffff81096804>] sys_init_module+0x9c/0x1e0
+ [<ffffffff813329bb>] system_call_fastpath+0x16/0x1b
+ Code: c3 55 48 89 e5 41 57 41 56 41 89 f6 41 55 41 54 49 89 d4 53 48 89 fb=
+ 48 83 ec 28 48 85 ff 74 0b 85 f6 75 0b 48 83 7f 30 00 75 14 <0f> 0b eb fe =
+48 83 7f 30 00 b9 ea ff ff ff 0f 84 18 01 00 00 49
+ RIP [<ffffffff8113ce61>] internal_create_group+0x2a/0x170
+ RSP <ffff880007b3fde8>
+ ---[ end trace a123eb592043acad ]---
+
+Signed-off-by: Namhyung Kim <namhyung@gmail.com>
+Cc: Laurent Vivier <Laurent.Vivier@bull.net>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/block/loop.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -1707,6 +1707,9 @@ static int __init loop_init(void)
+ if (max_part > 0)
+ part_shift = fls(max_part);
+
++ if ((1UL << part_shift) > DISK_MAX_PARTS)
++ return -EINVAL;
++
+ if (max_loop > 1UL << (MINORBITS - part_shift))
+ return -EINVAL;
+
--- /dev/null
+From 8258c53208d7a9b7207e7d4dae36d2ea384cb278 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Wed, 11 May 2011 14:26:30 +1000
+Subject: md/bitmap: fix saving of events_cleared and other state.
+
+From: NeilBrown <neilb@suse.de>
+
+commit 8258c53208d7a9b7207e7d4dae36d2ea384cb278 upstream.
+
+If a bitmap is found to be 'stale' the events_cleared value
+is set to match 'events'.
+However if the array is degraded this does not get stored on disk.
+This can subsequently lead to incorrect behaviour.
+
+So change bitmap_update_sb to always update events_cleared in the
+superblock from the known events_cleared.
+For neatness also set ->state from ->flags.
+This requires updating ->state whenever we update ->flags, which makes
+sense anyway.
+
+This is suitable for any active -stable release.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/bitmap.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/md/bitmap.c
++++ b/drivers/md/bitmap.c
+@@ -493,11 +493,11 @@ void bitmap_update_sb(struct bitmap *bit
+ spin_unlock_irqrestore(&bitmap->lock, flags);
+ sb = kmap_atomic(bitmap->sb_page, KM_USER0);
+ sb->events = cpu_to_le64(bitmap->mddev->events);
+- if (bitmap->mddev->events < bitmap->events_cleared) {
++ if (bitmap->mddev->events < bitmap->events_cleared)
+ /* rocking back to read-only */
+ bitmap->events_cleared = bitmap->mddev->events;
+- sb->events_cleared = cpu_to_le64(bitmap->events_cleared);
+- }
++ sb->events_cleared = cpu_to_le64(bitmap->events_cleared);
++ sb->state = cpu_to_le32(bitmap->flags);
+ /* Just in case these have been changed via sysfs: */
+ sb->daemon_sleep = cpu_to_le32(bitmap->mddev->bitmap_info.daemon_sleep/HZ);
+ sb->write_behind = cpu_to_le32(bitmap->mddev->bitmap_info.max_write_behind);
+@@ -618,7 +618,7 @@ success:
+ if (le32_to_cpu(sb->version) == BITMAP_MAJOR_HOSTENDIAN)
+ bitmap->flags |= BITMAP_HOSTENDIAN;
+ bitmap->events_cleared = le64_to_cpu(sb->events_cleared);
+- if (sb->state & cpu_to_le32(BITMAP_STALE))
++ if (bitmap->flags & BITMAP_STALE)
+ bitmap->events_cleared = bitmap->mddev->events;
+ err = 0;
+ out:
+@@ -652,9 +652,11 @@ static int bitmap_mask_state(struct bitm
+ switch (op) {
+ case MASK_SET:
+ sb->state |= cpu_to_le32(bits);
++ bitmap->flags |= bits;
+ break;
+ case MASK_UNSET:
+ sb->state &= cpu_to_le32(~bits);
++ bitmap->flags &= ~bits;
+ break;
+ default:
+ BUG();
--- /dev/null
+From b0140891a8cea36469f58d23859e599b1122bd37 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Tue, 10 May 2011 17:49:01 +1000
+Subject: md: Fix race when creating a new md device.
+
+From: NeilBrown <neilb@suse.de>
+
+commit b0140891a8cea36469f58d23859e599b1122bd37 upstream.
+
+There is a race when creating an md device by opening /dev/mdXX.
+
+If two processes do this at much the same time they will follow the
+call path
+ __blkdev_get -> get_gendisk -> kobj_lookup
+
+The first will call
+ -> md_probe -> md_alloc -> add_disk -> blk_register_region
+
+and the race happens when the second gets to kobj_lookup after
+add_disk has called blk_register_region but before it returns to
+md_alloc.
+
+In the case the second will not call md_probe (as the probe is already
+done) but will get a handle on the gendisk, return to __blkdev_get
+which will then call md_open (via the ->open) pointer.
+
+As mddev->gendisk hasn't been set yet, md_open will think something is
+wrong an return with ERESTARTSYS.
+
+This can loop endlessly while the first thread makes no progress
+through add_disk. Nothing is blocking it, but due to scheduler
+behaviour it doesn't get a turn.
+So this is essentially a live-lock.
+
+We fix this by simply moving the assignment to mddev->gendisk before
+the call the add_disk() so md_open doesn't get confused.
+Also move blk_queue_flush earlier because add_disk should be as late
+as possible.
+
+To make sure that md_open doesn't complete until md_alloc has done all
+that is needed, we take mddev->open_mutex during the last part of
+md_alloc. md_open will wait for this.
+
+This can cause a lock-up on boot so Cc:ing for stable.
+For 2.6.36 and earlier a different patch will be needed as the
+'blk_queue_flush' call isn't there.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Reported-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
+Tested-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/md.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -4335,13 +4335,19 @@ static int md_alloc(dev_t dev, char *nam
+ disk->fops = &md_fops;
+ disk->private_data = mddev;
+ disk->queue = mddev->queue;
++ blk_queue_flush(mddev->queue, REQ_FLUSH | REQ_FUA);
+ /* Allow extended partitions. This makes the
+ * 'mdp' device redundant, but we can't really
+ * remove it now.
+ */
+ disk->flags |= GENHD_FL_EXT_DEVT;
+- add_disk(disk);
+ mddev->gendisk = disk;
++ /* As soon as we call add_disk(), another thread could get
++ * through to md_open, so make sure it doesn't get too far
++ */
++ mutex_lock(&mddev->open_mutex);
++ add_disk(disk);
++
+ error = kobject_init_and_add(&mddev->kobj, &md_ktype,
+ &disk_to_dev(disk)->kobj, "%s", "md");
+ if (error) {
+@@ -4355,8 +4361,7 @@ static int md_alloc(dev_t dev, char *nam
+ if (mddev->kobj.sd &&
+ sysfs_create_group(&mddev->kobj, &md_bitmap_group))
+ printk(KERN_DEBUG "pointless warning\n");
+-
+- blk_queue_flush(mddev->queue, REQ_FLUSH | REQ_FUA);
++ mutex_unlock(&mddev->open_mutex);
+ abort:
+ mutex_unlock(&disks_mutex);
+ if (!error && mddev->kobj.sd) {
--- /dev/null
+From cfa54a0fcfc1017c6f122b6f21aaba36daa07f71 Mon Sep 17 00:00:00 2001
+From: Andrew Barry <abarry@cray.com>
+Date: Tue, 24 May 2011 17:12:52 -0700
+Subject: mm/page_alloc.c: prevent unending loop in
+ __alloc_pages_slowpath()
+
+From: Andrew Barry <abarry@cray.com>
+
+commit cfa54a0fcfc1017c6f122b6f21aaba36daa07f71 upstream.
+
+I believe I found a problem in __alloc_pages_slowpath, which allows a
+process to get stuck endlessly looping, even when lots of memory is
+available.
+
+Running an I/O and memory intensive stress-test I see a 0-order page
+allocation with __GFP_IO and __GFP_WAIT, running on a system with very
+little free memory. Right about the same time that the stress-test gets
+killed by the OOM-killer, the utility trying to allocate memory gets stuck
+in __alloc_pages_slowpath even though most of the systems memory was freed
+by the oom-kill of the stress-test.
+
+The utility ends up looping from the rebalance label down through the
+wait_iff_congested continiously. Because order=0,
+__alloc_pages_direct_compact skips the call to get_page_from_freelist.
+Because all of the reclaimable memory on the system has already been
+reclaimed, __alloc_pages_direct_reclaim skips the call to
+get_page_from_freelist. Since there is no __GFP_FS flag, the block with
+__alloc_pages_may_oom is skipped. The loop hits the wait_iff_congested,
+then jumps back to rebalance without ever trying to
+get_page_from_freelist. This loop repeats infinitely.
+
+The test case is pretty pathological. Running a mix of I/O stress-tests
+that do a lot of fork() and consume all of the system memory, I can pretty
+reliably hit this on 600 nodes, in about 12 hours. 32GB/node.
+
+Signed-off-by: Andrew Barry <abarry@cray.com>
+Signed-off-by: Minchan Kim <minchan.kim@gmail.com>
+Reviewed-by: Rik van Riel<riel@redhat.com>
+Acked-by: Mel Gorman <mgorman@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/page_alloc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -2044,6 +2044,7 @@ restart:
+ first_zones_zonelist(zonelist, high_zoneidx, NULL,
+ &preferred_zone);
+
++rebalance:
+ /* This is the last chance, in general, before the goto nopage. */
+ page = get_page_from_freelist(gfp_mask, nodemask, order, zonelist,
+ high_zoneidx, alloc_flags & ~ALLOC_NO_WATERMARKS,
+@@ -2051,7 +2052,6 @@ restart:
+ if (page)
+ goto got_pg;
+
+-rebalance:
+ /* Allocate without watermarks if the context allows */
+ if (alloc_flags & ALLOC_NO_WATERMARKS) {
+ page = __alloc_pages_high_priority(gfp_mask, order,
--- /dev/null
+From afc7e326a3f5bafc41324d7926c324414e343ee5 Mon Sep 17 00:00:00 2001
+From: Johannes Weiner <hannes@cmpxchg.org>
+Date: Tue, 24 May 2011 17:11:09 -0700
+Subject: mm: vmscan: correct use of pgdat_balanced in
+ sleeping_prematurely
+
+From: Johannes Weiner <hannes@cmpxchg.org>
+
+commit afc7e326a3f5bafc41324d7926c324414e343ee5 upstream.
+
+There are a few reports of people experiencing hangs when copying large
+amounts of data with kswapd using a large amount of CPU which appear to be
+due to recent reclaim changes. SLUB using high orders is the trigger but
+not the root cause as SLUB has been using high orders for a while. The
+root cause was bugs introduced into reclaim which are addressed by the
+following two patches.
+
+Patch 1 corrects logic introduced by commit 1741c877 ("mm: kswapd:
+ keep kswapd awake for high-order allocations until a percentage of
+ the node is balanced") to allow kswapd to go to sleep when
+ balanced for high orders.
+
+Patch 2 notes that it is possible for kswapd to miss every
+ cond_resched() and updates shrink_slab() so it'll at least reach
+ that scheduling point.
+
+Chris Wood reports that these two patches in isolation are sufficient to
+prevent the system hanging. AFAIK, they should also resolve similar hangs
+experienced by James Bottomley.
+
+This patch:
+
+Johannes Weiner poined out that the logic in commit 1741c877 ("mm: kswapd:
+keep kswapd awake for high-order allocations until a percentage of the
+node is balanced") is backwards. Instead of allowing kswapd to go to
+sleep when balancing for high order allocations, it keeps it kswapd
+running uselessly.
+
+Signed-off-by: Mel Gorman <mgorman@suse.de>
+Reviewed-by: Rik van Riel <riel@redhat.com>
+Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
+Reviewed-by: Wu Fengguang <fengguang.wu@intel.com>
+Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
+Tested-by: Colin King <colin.king@canonical.com>
+Cc: Raghavendra D Prabhu <raghu.prabhu13@gmail.com>
+Cc: Jan Kara <jack@suse.cz>
+Cc: Chris Mason <chris.mason@oracle.com>
+Cc: Christoph Lameter <cl@linux.com>
+Cc: Pekka Enberg <penberg@kernel.org>
+Cc: Rik van Riel <riel@redhat.com>
+Reviewed-by: Minchan Kim <minchan.kim@gmail.com>
+Reviewed-by: Wu Fengguang <fengguang.wu@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/vmscan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -2286,7 +2286,7 @@ static bool sleeping_prematurely(pg_data
+ * must be balanced
+ */
+ if (order)
+- return pgdat_balanced(pgdat, balanced, classzone_idx);
++ return !pgdat_balanced(pgdat, balanced, classzone_idx);
+ else
+ return !all_zones_ok;
+ }
--- /dev/null
+From f06590bd718ed950c98828e30ef93204028f3210 Mon Sep 17 00:00:00 2001
+From: Minchan Kim <minchan.kim@gmail.com>
+Date: Tue, 24 May 2011 17:11:11 -0700
+Subject: mm: vmscan: correctly check if reclaimer should schedule
+ during shrink_slab
+
+From: Minchan Kim <minchan.kim@gmail.com>
+
+commit f06590bd718ed950c98828e30ef93204028f3210 upstream.
+
+It has been reported on some laptops that kswapd is consuming large
+amounts of CPU and not being scheduled when SLUB is enabled during large
+amounts of file copying. It is expected that this is due to kswapd
+missing every cond_resched() point because;
+
+shrink_page_list() calls cond_resched() if inactive pages were isolated
+ which in turn may not happen if all_unreclaimable is set in
+ shrink_zones(). If for whatver reason, all_unreclaimable is
+ set on all zones, we can miss calling cond_resched().
+
+balance_pgdat() only calls cond_resched if the zones are not
+ balanced. For a high-order allocation that is balanced, it
+ checks order-0 again. During that window, order-0 might have
+ become unbalanced so it loops again for order-0 and returns
+ that it was reclaiming for order-0 to kswapd(). It can then
+ find that a caller has rewoken kswapd for a high-order and
+ re-enters balance_pgdat() without ever calling cond_resched().
+
+shrink_slab only calls cond_resched() if we are reclaiming slab
+ pages. If there are a large number of direct reclaimers, the
+ shrinker_rwsem can be contended and prevent kswapd calling
+ cond_resched().
+
+This patch modifies the shrink_slab() case. If the semaphore is
+contended, the caller will still check cond_resched(). After each
+successful call into a shrinker, the check for cond_resched() remains in
+case one shrinker is particularly slow.
+
+[mgorman@suse.de: preserve call to cond_resched after each call into shrinker]
+Signed-off-by: Mel Gorman <mgorman@suse.de>
+Signed-off-by: Minchan Kim <minchan.kim@gmail.com>
+Cc: Rik van Riel <riel@redhat.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Wu Fengguang <fengguang.wu@intel.com>
+Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
+Tested-by: Colin King <colin.king@canonical.com>
+Cc: Raghavendra D Prabhu <raghu.prabhu13@gmail.com>
+Cc: Jan Kara <jack@suse.cz>
+Cc: Chris Mason <chris.mason@oracle.com>
+Cc: Christoph Lameter <cl@linux.com>
+Cc: Pekka Enberg <penberg@kernel.org>
+Cc: Rik van Riel <riel@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/vmscan.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -230,8 +230,11 @@ unsigned long shrink_slab(unsigned long
+ if (scanned == 0)
+ scanned = SWAP_CLUSTER_MAX;
+
+- if (!down_read_trylock(&shrinker_rwsem))
+- return 1; /* Assume we'll be able to shrink next time */
++ if (!down_read_trylock(&shrinker_rwsem)) {
++ /* Assume we'll be able to shrink next time */
++ ret = 1;
++ goto out;
++ }
+
+ list_for_each_entry(shrinker, &shrinker_list, list) {
+ unsigned long long delta;
+@@ -282,6 +285,8 @@ unsigned long shrink_slab(unsigned long
+ shrinker->nr += total_scan;
+ }
+ up_read(&shrinker_rwsem);
++out:
++ cond_resched();
+ return ret;
+ }
+
--- /dev/null
+From 3ace8e052be5293ebb3e00f819effccc64108a38 Mon Sep 17 00:00:00 2001
+From: "Kashyap, Desai" <kashyap.desai@lsi.com>
+Date: Wed, 4 May 2011 16:35:58 +0530
+Subject: [SCSI] mpt2sas: move even handling of
+ MPT2SAS_TURN_ON_FAULT_LED into process context
+
+From: "Kashyap, Desai" <kashyap.desai@lsi.com>
+
+commit 3ace8e052be5293ebb3e00f819effccc64108a38 upstream.
+
+Driver was a sending a SEP request during interrupt context which
+required to go to sleep.
+
+The fix is to rearrange the code so a fake event
+MPT2SAS_TURN_ON_FAULT_LED is fired from interrupt context, then later
+during the kernel worker threads processing, the SEP request is issued
+to firmware.
+
+Signed-off-by: Kashyap Desai <kashyap.desai@lsi.com>
+Signed-off-by: James Bottomley <jbottomley@parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/mpt2sas/mpt2sas_scsih.c | 94 +++++++++++++++++++++++++----------
+ 1 file changed, 68 insertions(+), 26 deletions(-)
+
+--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+@@ -113,6 +113,7 @@ struct sense_info {
+ };
+
+
++#define MPT2SAS_TURN_ON_FAULT_LED (0xFFFC)
+ #define MPT2SAS_RESCAN_AFTER_HOST_RESET (0xFFFF)
+
+ /**
+@@ -121,6 +122,7 @@ struct sense_info {
+ * @work: work object (ioc->fault_reset_work_q)
+ * @cancel_pending_work: flag set during reset handling
+ * @ioc: per adapter object
++ * @device_handle: device handle
+ * @VF_ID: virtual function id
+ * @VP_ID: virtual port id
+ * @ignore: flag meaning this event has been marked to ignore
+@@ -134,6 +136,7 @@ struct fw_event_work {
+ u8 cancel_pending_work;
+ struct delayed_work delayed_work;
+ struct MPT2SAS_ADAPTER *ioc;
++ u16 device_handle;
+ u8 VF_ID;
+ u8 VP_ID;
+ u8 ignore;
+@@ -3708,17 +3711,75 @@ _scsih_scsi_ioc_info(struct MPT2SAS_ADAP
+ #endif
+
+ /**
+- * _scsih_smart_predicted_fault - illuminate Fault LED
++ * _scsih_turn_on_fault_led - illuminate Fault LED
+ * @ioc: per adapter object
+ * @handle: device handle
++ * Context: process
+ *
+ * Return nothing.
+ */
+ static void
+-_scsih_smart_predicted_fault(struct MPT2SAS_ADAPTER *ioc, u16 handle)
++_scsih_turn_on_fault_led(struct MPT2SAS_ADAPTER *ioc, u16 handle)
+ {
+ Mpi2SepReply_t mpi_reply;
+ Mpi2SepRequest_t mpi_request;
++
++ memset(&mpi_request, 0, sizeof(Mpi2SepRequest_t));
++ mpi_request.Function = MPI2_FUNCTION_SCSI_ENCLOSURE_PROCESSOR;
++ mpi_request.Action = MPI2_SEP_REQ_ACTION_WRITE_STATUS;
++ mpi_request.SlotStatus =
++ cpu_to_le32(MPI2_SEP_REQ_SLOTSTATUS_PREDICTED_FAULT);
++ mpi_request.DevHandle = cpu_to_le16(handle);
++ mpi_request.Flags = MPI2_SEP_REQ_FLAGS_DEVHANDLE_ADDRESS;
++ if ((mpt2sas_base_scsi_enclosure_processor(ioc, &mpi_reply,
++ &mpi_request)) != 0) {
++ printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n", ioc->name,
++ __FILE__, __LINE__, __func__);
++ return;
++ }
++
++ if (mpi_reply.IOCStatus || mpi_reply.IOCLogInfo) {
++ dewtprintk(ioc, printk(MPT2SAS_INFO_FMT "enclosure_processor: "
++ "ioc_status (0x%04x), loginfo(0x%08x)\n", ioc->name,
++ le16_to_cpu(mpi_reply.IOCStatus),
++ le32_to_cpu(mpi_reply.IOCLogInfo)));
++ return;
++ }
++}
++
++/**
++ * _scsih_send_event_to_turn_on_fault_led - fire delayed event
++ * @ioc: per adapter object
++ * @handle: device handle
++ * Context: interrupt.
++ *
++ * Return nothing.
++ */
++static void
++_scsih_send_event_to_turn_on_fault_led(struct MPT2SAS_ADAPTER *ioc, u16 handle)
++{
++ struct fw_event_work *fw_event;
++
++ fw_event = kzalloc(sizeof(struct fw_event_work), GFP_ATOMIC);
++ if (!fw_event)
++ return;
++ fw_event->event = MPT2SAS_TURN_ON_FAULT_LED;
++ fw_event->device_handle = handle;
++ fw_event->ioc = ioc;
++ _scsih_fw_event_add(ioc, fw_event);
++}
++
++/**
++ * _scsih_smart_predicted_fault - process smart errors
++ * @ioc: per adapter object
++ * @handle: device handle
++ * Context: interrupt.
++ *
++ * Return nothing.
++ */
++static void
++_scsih_smart_predicted_fault(struct MPT2SAS_ADAPTER *ioc, u16 handle)
++{
+ struct scsi_target *starget;
+ struct MPT2SAS_TARGET *sas_target_priv_data;
+ Mpi2EventNotificationReply_t *event_reply;
+@@ -3745,30 +3806,8 @@ _scsih_smart_predicted_fault(struct MPT2
+ starget_printk(KERN_WARNING, starget, "predicted fault\n");
+ spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
+
+- if (ioc->pdev->subsystem_vendor == PCI_VENDOR_ID_IBM) {
+- memset(&mpi_request, 0, sizeof(Mpi2SepRequest_t));
+- mpi_request.Function = MPI2_FUNCTION_SCSI_ENCLOSURE_PROCESSOR;
+- mpi_request.Action = MPI2_SEP_REQ_ACTION_WRITE_STATUS;
+- mpi_request.SlotStatus =
+- cpu_to_le32(MPI2_SEP_REQ_SLOTSTATUS_PREDICTED_FAULT);
+- mpi_request.DevHandle = cpu_to_le16(handle);
+- mpi_request.Flags = MPI2_SEP_REQ_FLAGS_DEVHANDLE_ADDRESS;
+- if ((mpt2sas_base_scsi_enclosure_processor(ioc, &mpi_reply,
+- &mpi_request)) != 0) {
+- printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
+- ioc->name, __FILE__, __LINE__, __func__);
+- return;
+- }
+-
+- if (mpi_reply.IOCStatus || mpi_reply.IOCLogInfo) {
+- dewtprintk(ioc, printk(MPT2SAS_INFO_FMT
+- "enclosure_processor: ioc_status (0x%04x), "
+- "loginfo(0x%08x)\n", ioc->name,
+- le16_to_cpu(mpi_reply.IOCStatus),
+- le32_to_cpu(mpi_reply.IOCLogInfo)));
+- return;
+- }
+- }
++ if (ioc->pdev->subsystem_vendor == PCI_VENDOR_ID_IBM)
++ _scsih_send_event_to_turn_on_fault_led(ioc, handle);
+
+ /* insert into event log */
+ sz = offsetof(Mpi2EventNotificationReply_t, EventData) +
+@@ -6330,6 +6369,9 @@ _firmware_event_work(struct work_struct
+ }
+
+ switch (fw_event->event) {
++ case MPT2SAS_TURN_ON_FAULT_LED:
++ _scsih_turn_on_fault_led(ioc, fw_event->device_handle);
++ break;
+ case MPI2_EVENT_SAS_TOPOLOGY_CHANGE_LIST:
+ _scsih_sas_topology_change_event(ioc, fw_event);
+ break;
--- /dev/null
+From 3d2606f42984613d324ad3047cf503bcddc3880a Mon Sep 17 00:00:00 2001
+From: Robert Richter <robert.richter@amd.com>
+Date: Fri, 20 May 2011 09:46:54 +0200
+Subject: oprofile, x86: Enable preemption during pci device setup in
+ IBS init
+
+From: Robert Richter <robert.richter@amd.com>
+
+commit 3d2606f42984613d324ad3047cf503bcddc3880a upstream.
+
+IBS initialization is a mix of per-core register access and per-node
+pci device setup. Register access should be pinned to the cpu, but pci
+setup must run with preemption enabled.
+
+This patch better separates the code into non-/preemptible sections
+and fixes sleeping with preemption disabled. See bug message below.
+
+Fixes also freeing the eilvt entry by introducing put_eilvt().
+
+BUG: sleeping function called from invalid context at mm/slub.c:824
+in_atomic(): 1, irqs_disabled(): 0, pid: 32357, name: modprobe
+INFO: lockdep is turned off.
+Pid: 32357, comm: modprobe Not tainted 2.6.39-rc7+ #14
+Call Trace:
+ [<ffffffff8104bdc8>] __might_sleep+0x112/0x117
+ [<ffffffff81129693>] kmem_cache_alloc_trace+0x4b/0xe7
+ [<ffffffff81278f14>] kzalloc.constprop.0+0x29/0x2b
+ [<ffffffff81278f4c>] pci_get_subsys+0x36/0x78
+ [<ffffffff81022689>] ? setup_APIC_eilvt+0xfb/0x139
+ [<ffffffff81278fa4>] pci_get_device+0x16/0x18
+ [<ffffffffa06c8b5d>] op_amd_init+0xd3/0x211 [oprofile]
+ [<ffffffffa064d000>] ? 0xffffffffa064cfff
+ [<ffffffffa064d298>] op_nmi_init+0x21e/0x26a [oprofile]
+ [<ffffffffa064d062>] oprofile_arch_init+0xe/0x26 [oprofile]
+ [<ffffffffa064d010>] oprofile_init+0x10/0x42 [oprofile]
+ [<ffffffff81002099>] do_one_initcall+0x7f/0x13a
+ [<ffffffff81096524>] sys_init_module+0x132/0x281
+ [<ffffffff814cc682>] system_call_fastpath+0x16/0x1b
+
+Reported-by: Dave Jones <davej@redhat.com>
+Signed-off-by: Robert Richter <robert.richter@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/oprofile/op_model_amd.c | 95 ++++++++++++++++++++++-----------------
+ 1 file changed, 54 insertions(+), 41 deletions(-)
+
+--- a/arch/x86/oprofile/op_model_amd.c
++++ b/arch/x86/oprofile/op_model_amd.c
+@@ -316,16 +316,23 @@ static void op_amd_stop_ibs(void)
+ wrmsrl(MSR_AMD64_IBSOPCTL, 0);
+ }
+
+-static inline int eilvt_is_available(int offset)
++static inline int get_eilvt(int offset)
+ {
+- /* check if we may assign a vector */
+ return !setup_APIC_eilvt(offset, 0, APIC_EILVT_MSG_NMI, 1);
+ }
+
++static inline int put_eilvt(int offset)
++{
++ return !setup_APIC_eilvt(offset, 0, 0, 1);
++}
++
+ static inline int ibs_eilvt_valid(void)
+ {
+ int offset;
+ u64 val;
++ int valid = 0;
++
++ preempt_disable();
+
+ rdmsrl(MSR_AMD64_IBSCTL, val);
+ offset = val & IBSCTL_LVT_OFFSET_MASK;
+@@ -333,16 +340,20 @@ static inline int ibs_eilvt_valid(void)
+ if (!(val & IBSCTL_LVT_OFFSET_VALID)) {
+ pr_err(FW_BUG "cpu %d, invalid IBS interrupt offset %d (MSR%08X=0x%016llx)\n",
+ smp_processor_id(), offset, MSR_AMD64_IBSCTL, val);
+- return 0;
++ goto out;
+ }
+
+- if (!eilvt_is_available(offset)) {
++ if (!get_eilvt(offset)) {
+ pr_err(FW_BUG "cpu %d, IBS interrupt offset %d not available (MSR%08X=0x%016llx)\n",
+ smp_processor_id(), offset, MSR_AMD64_IBSCTL, val);
+- return 0;
++ goto out;
+ }
+
+- return 1;
++ valid = 1;
++out:
++ preempt_enable();
++
++ return valid;
+ }
+
+ static inline int get_ibs_offset(void)
+@@ -600,67 +611,69 @@ static int setup_ibs_ctl(int ibs_eilvt_o
+
+ static int force_ibs_eilvt_setup(void)
+ {
+- int i;
++ int offset;
+ int ret;
+
+- /* find the next free available EILVT entry */
+- for (i = 1; i < 4; i++) {
+- if (!eilvt_is_available(i))
+- continue;
+- ret = setup_ibs_ctl(i);
+- if (ret)
+- return ret;
+- pr_err(FW_BUG "using offset %d for IBS interrupts\n", i);
+- return 0;
++ /*
++ * find the next free available EILVT entry, skip offset 0,
++ * pin search to this cpu
++ */
++ preempt_disable();
++ for (offset = 1; offset < APIC_EILVT_NR_MAX; offset++) {
++ if (get_eilvt(offset))
++ break;
+ }
++ preempt_enable();
+
+- printk(KERN_DEBUG "No EILVT entry available\n");
+-
+- return -EBUSY;
+-}
+-
+-static int __init_ibs_nmi(void)
+-{
+- int ret;
+-
+- if (ibs_eilvt_valid())
+- return 0;
++ if (offset == APIC_EILVT_NR_MAX) {
++ printk(KERN_DEBUG "No EILVT entry available\n");
++ return -EBUSY;
++ }
+
+- ret = force_ibs_eilvt_setup();
++ ret = setup_ibs_ctl(offset);
+ if (ret)
+- return ret;
++ goto out;
+
+- if (!ibs_eilvt_valid())
+- return -EFAULT;
++ if (!ibs_eilvt_valid()) {
++ ret = -EFAULT;
++ goto out;
++ }
+
++ pr_err(FW_BUG "using offset %d for IBS interrupts\n", offset);
+ pr_err(FW_BUG "workaround enabled for IBS LVT offset\n");
+
+ return 0;
++out:
++ preempt_disable();
++ put_eilvt(offset);
++ preempt_enable();
++ return ret;
+ }
+
+ /*
+ * check and reserve APIC extended interrupt LVT offset for IBS if
+ * available
+- *
+- * init_ibs() preforms implicitly cpu-local operations, so pin this
+- * thread to its current CPU
+ */
+
+ static void init_ibs(void)
+ {
+- preempt_disable();
+-
+ ibs_caps = get_ibs_caps();
++
+ if (!ibs_caps)
++ return;
++
++ if (ibs_eilvt_valid())
+ goto out;
+
+- if (__init_ibs_nmi() < 0)
+- ibs_caps = 0;
+- else
+- printk(KERN_INFO "oprofile: AMD IBS detected (0x%08x)\n", ibs_caps);
++ if (!force_ibs_eilvt_setup())
++ goto out;
++
++ /* Failed to setup ibs */
++ ibs_caps = 0;
++ return;
+
+ out:
+- preempt_enable();
++ printk(KERN_INFO "oprofile: AMD IBS detected (0x%08x)\n", ibs_caps);
+ }
+
+ static int (*create_arch_files)(struct super_block *sb, struct dentry *root);
--- /dev/null
+From ba9f207c9f82115aba4ce04b22e0081af0ae300f Mon Sep 17 00:00:00 2001
+From: Frederic Weisbecker <fweisbec@gmail.com>
+Date: Fri, 20 May 2011 02:09:54 +0200
+Subject: rcu: Fix unpaired rcu_irq_enter() from locking selftests
+
+From: Frederic Weisbecker <fweisbec@gmail.com>
+
+commit ba9f207c9f82115aba4ce04b22e0081af0ae300f upstream.
+
+HARDIRQ_ENTER() maps to irq_enter() which calls rcu_irq_enter().
+But HARDIRQ_EXIT() maps to __irq_exit() which doesn't call
+rcu_irq_exit().
+
+So for every locking selftest that simulates hardirq disabled,
+we create an imbalance in the rcu extended quiescent state
+internal state.
+
+As a result, after the first missing rcu_irq_exit(), subsequent
+irqs won't exit dyntick-idle mode after leaving the interrupt
+handler. This means that RCU won't see the affected CPU as being
+in an extended quiescent state, resulting in long grace-period
+delays (as in grace periods extending for hours).
+
+To fix this, just use __irq_enter() to simulate the hardirq
+context. This is sufficient for the locking selftests as we
+don't need to exit any extended quiescent state or perform
+any check that irqs normally do when they wake up from idle.
+
+As a side effect, this patch makes it possible to restore
+"rcu: Decrease memory-barrier usage based on semi-formal proof",
+which eventually helped finding this bug.
+
+Reported-and-tested-by: Yinghai Lu <yinghai@kernel.org>
+Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
+Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ lib/locking-selftest.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/lib/locking-selftest.c
++++ b/lib/locking-selftest.c
+@@ -144,7 +144,7 @@ static void init_shared_classes(void)
+
+ #define HARDIRQ_ENTER() \
+ local_irq_disable(); \
+- irq_enter(); \
++ __irq_enter(); \
+ WARN_ON(!in_irq());
+
+ #define HARDIRQ_EXIT() \
--- /dev/null
+From 5db1256a5131d3b133946fa02ac9770a784e6eb2 Mon Sep 17 00:00:00 2001
+From: Milton Miller <miltonm@bga.com>
+Date: Thu, 12 May 2011 04:13:54 -0500
+Subject: seqlock: Don't smp_rmb in seqlock reader spin loop
+
+From: Milton Miller <miltonm@bga.com>
+
+commit 5db1256a5131d3b133946fa02ac9770a784e6eb2 upstream.
+
+Move the smp_rmb after cpu_relax loop in read_seqlock and add
+ACCESS_ONCE to make sure the test and return are consistent.
+
+A multi-threaded core in the lab didn't like the update
+from 2.6.35 to 2.6.36, to the point it would hang during
+boot when multiple threads were active. Bisection showed
+af5ab277ded04bd9bc6b048c5a2f0e7d70ef0867 (clockevents:
+Remove the per cpu tick skew) as the culprit and it is
+supported with stack traces showing xtime_lock waits including
+tick_do_update_jiffies64 and/or update_vsyscall.
+
+Experimentation showed the combination of cpu_relax and smp_rmb
+was significantly slowing the progress of other threads sharing
+the core, and this patch is effective in avoiding the hang.
+
+A theory is the rmb is affecting the whole core while the
+cpu_relax is causing a resource rebalance flush, together they
+cause an interfernce cadance that is unbroken when the seqlock
+reader has interrupts disabled.
+
+At first I was confused why the refactor in
+3c22cd5709e8143444a6d08682a87f4c57902df3 (kernel: optimise
+seqlock) didn't affect this patch application, but after some
+study that affected seqcount not seqlock. The new seqcount was
+not factored back into the seqlock. I defer that the future.
+
+While the removal of the timer interrupt offset created
+contention for the xtime lock while a cpu does the
+additonal work to update the system clock, the seqlock
+implementation with the tight rmb spin loop goes back much
+further, and is just waiting for the right trigger.
+
+Signed-off-by: Milton Miller <miltonm@bga.com>
+Cc: <linuxppc-dev@lists.ozlabs.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Andi Kleen <andi@firstfloor.org>
+Cc: Nick Piggin <npiggin@kernel.dk>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Anton Blanchard <anton@samba.org>
+Cc: Paul McKenney <paulmck@linux.vnet.ibm.com>
+Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
+Link: http://lkml.kernel.org/r/%3Cseqlock-rmb%40mdm.bga.com%3E
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/seqlock.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/linux/seqlock.h
++++ b/include/linux/seqlock.h
+@@ -88,12 +88,12 @@ static __always_inline unsigned read_seq
+ unsigned ret;
+
+ repeat:
+- ret = sl->sequence;
+- smp_rmb();
++ ret = ACCESS_ONCE(sl->sequence);
+ if (unlikely(ret & 1)) {
+ cpu_relax();
+ goto repeat;
+ }
++ smp_rmb();
+
+ return ret;
+ }
sctp-fix-memory-leak-of-the-asconf-queue-when-free-asoc.patch
sch_sfq-fix-peek-implementation.patch
bonding-prevent-deadlock-on-slave-store-with-alb-mode-v3.patch
+mpt2sas-move-even-handling-of.patch
+bnx2i-fixed-packet-error-created-when-the-sq_size-is.patch
+bnx2i-updated-the-connection-shutdown-cleanup.patch
+fix-ultrastor-asm-snippet.patch
+target-fix-multi-task-task_sg-chaining-logic-bug.patch
+target-fix-interrupt-context-bug-with-stats_lock-and.patch
+target-fix-bug-with-task_sg-chained.patch
+target-fix-task-task_execute_queue-1-clear-bug.patch
+x86-ioapic-fix-potential-resume-deadlock.patch
+x86-amd-do-not-enable-arat-feature-on-amd-processors-below.patch
+x86-amd-use-_safe-msr-access-for-garttlbwlk-disable-code.patch
+x86-cpufeature-update-cpu-feature-rdrnd-to-rdrand.patch
+oprofile-x86-enable-preemption-during-pci-device-setup-in.patch
+rcu-fix-unpaired-rcu_irq_enter-from-locking-selftests.patch
+when-mandatory-encryption-on-share-fail-mount.patch
+staging-usbip-fix-wrong-endian-conversion.patch
+staging-r8712u-fix-driver-to-support-ad-hoc-mode.patch
+fix-for-buffer-overflow-in-ldm_frag_add-not-sufficient.patch
+seqlock-don-t-smp_rmb-in-seqlock-reader-spin-loop.patch
+md-fix-race-when-creating-a-new-md-device.patch
+md-bitmap-fix-saving-of-events_cleared-and-other-state.patch
+mm-vmscan-correct-use-of-pgdat_balanced-in.patch
+mm-vmscan-correctly-check-if-reclaimer-should-schedule.patch
+ips-use-interruptible-waits-in-ips-monitor.patch
+alsa-hda-use-one-dmic-only-for-dell-studio-1558.patch
+alsa-hda-add-quirk-for-lenovo-u350.patch
+alsa-hda-fix-input-src-parse-in-patch_analog.c.patch
+alsa-hda-use-lpib-for-ati-amd-chipsets-as-default.patch
+asoc-ensure-output-pga-is-enabled-for-line-outputs-in.patch
+asoc-add-some-missing-volume-update-bit-sets-for-wm_hubs.patch
+hid-magicmouse-ignore-ivalid-report-id-while-switching.patch
+mm-page_alloc.c-prevent-unending-loop-in.patch
+loop-limit-max_part-module-param-to-disk_max_parts.patch
+loop-handle-on-demand-devices-correctly.patch
+i2c-writing-clients-fix-foo_driver.id_table.patch
--- /dev/null
+From 62819fd9481021db7f87d5f61f2e2fd2be1dfcfa Mon Sep 17 00:00:00 2001
+From: Jeff Chua <jeff.chua.linux@gmail.com>
+Date: Wed, 27 Apr 2011 11:25:14 -0500
+Subject: staging: r8712u: Fix driver to support ad-hoc mode
+
+From: Jeff Chua <jeff.chua.linux@gmail.com>
+
+commit 62819fd9481021db7f87d5f61f2e2fd2be1dfcfa upstream.
+
+Driver r8712u is unable to handle ad-hoc mode. The issue is that when
+the driver first starts, there will not be an SSID for association.
+The fix is to always call the "select and join from scan" routine when
+in ad-hoc mode.
+
+Note: Ad-hoc mode worked intermittently before. If the driver had
+previously been associated, then things were OK.
+
+Signed-off-by: Jeff Chua <jeff.chua.linux@gmail.com>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/rtl8712/rtl871x_ioctl_set.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/rtl8712/rtl871x_ioctl_set.c
++++ b/drivers/staging/rtl8712/rtl871x_ioctl_set.c
+@@ -68,7 +68,10 @@ static u8 do_join(struct _adapter *padap
+ pmlmepriv->fw_state |= _FW_UNDER_LINKING;
+ pmlmepriv->pscanned = plist;
+ pmlmepriv->to_join = true;
+- if (_queue_empty(queue) == true) {
++
++ /* adhoc mode will start with an empty queue, but skip checking */
++ if (!check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) &&
++ _queue_empty(queue)) {
+ if (pmlmepriv->fw_state & _FW_UNDER_LINKING)
+ pmlmepriv->fw_state ^= _FW_UNDER_LINKING;
+ /* when set_ssid/set_bssid for do_join(), but scanning queue
--- /dev/null
+From cacd18a8476ce145ca5dcd46dc5b75585fd1289c Mon Sep 17 00:00:00 2001
+From: David Chang <dchang@novell.com>
+Date: Thu, 12 May 2011 18:31:11 +0800
+Subject: staging: usbip: fix wrong endian conversion
+
+From: David Chang <dchang@novell.com>
+
+commit cacd18a8476ce145ca5dcd46dc5b75585fd1289c upstream.
+
+Fix number_of_packets wrong endian conversion in function
+correct_endian_ret_submit()
+
+Signed-off-by: David Chang <dchang@novell.com>
+Acked-by: Arjan Mels <arjan.mels@gmx.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/usbip/usbip_common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/usbip/usbip_common.c
++++ b/drivers/staging/usbip/usbip_common.c
+@@ -709,7 +709,7 @@ static void correct_endian_ret_submit(st
+ be32_to_cpus(&pdu->status);
+ be32_to_cpus(&pdu->actual_length);
+ be32_to_cpus(&pdu->start_frame);
+- cpu_to_be32s(&pdu->number_of_packets);
++ be32_to_cpus(&pdu->number_of_packets);
+ be32_to_cpus(&pdu->error_count);
+ }
+ }
--- /dev/null
+From f436677262a5b524ac87675014c6d4e8ee153029 Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Thu, 19 May 2011 20:19:11 -0700
+Subject: [SCSI] target: Fix bug with task_sg chained
+ transport_free_dev_tasks release
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit f436677262a5b524ac87675014c6d4e8ee153029 upstream.
+
+This patch addresses a bug in the target core release path for HW
+operation where transport_free_dev_tasks() was incorrectly being called
+from transport_lun_remove_cmd() while releasing a se_cmd reference and
+calling struct target_core_fabric_ops->queue_data_in().
+
+This would result in a OOPs with HW target mode when the release of
+se_task->task_sg[] would happen before pci_unmap_sg() can be called in
+HW target mode fabric module code. This patch addresses the issue by
+moving transport_free_dev_tasks() from transport_lun_remove_cmd() into
+transport_generic_free_cmd(), and adding TRANSPORT_FREE_CMD_INTR and
+transport_generic_free_cmd_intr() to allow se_cmd descriptor release
+to happen fromfrom within transport_processing_thread() process context
+when release of se_cmd is not possible from HW interrupt context.
+
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: James Bottomley <jbottomley@parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/target/target_core_transport.c | 13 ++++++++++++-
+ include/target/target_core_base.h | 1 +
+ include/target/target_core_transport.h | 1 +
+ 3 files changed, 14 insertions(+), 1 deletion(-)
+
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -765,7 +765,6 @@ static void transport_lun_remove_cmd(str
+ transport_all_task_dev_remove_state(cmd);
+ spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
+
+- transport_free_dev_tasks(cmd);
+
+ check_lun:
+ spin_lock_irqsave(&lun->lun_cmd_lock, flags);
+@@ -2062,6 +2061,13 @@ int transport_generic_handle_tmr(
+ }
+ EXPORT_SYMBOL(transport_generic_handle_tmr);
+
++void transport_generic_free_cmd_intr(
++ struct se_cmd *cmd)
++{
++ transport_add_cmd_to_queue(cmd, TRANSPORT_FREE_CMD_INTR);
++}
++EXPORT_SYMBOL(transport_generic_free_cmd_intr);
++
+ static int transport_stop_tasks_for_cmd(struct se_cmd *cmd)
+ {
+ struct se_task *task, *task_tmp;
+@@ -5302,6 +5308,8 @@ void transport_generic_free_cmd(
+ if (wait_for_tasks && cmd->transport_wait_for_tasks)
+ cmd->transport_wait_for_tasks(cmd, 0, 0);
+
++ transport_free_dev_tasks(cmd);
++
+ transport_generic_remove(cmd, release_to_pool,
+ session_reinstatement);
+ }
+@@ -6142,6 +6150,9 @@ get_cmd:
+ case TRANSPORT_REMOVE:
+ transport_generic_remove(cmd, 1, 0);
+ break;
++ case TRANSPORT_FREE_CMD_INTR:
++ transport_generic_free_cmd(cmd, 0, 1, 0);
++ break;
+ case TRANSPORT_PROCESS_TMR:
+ transport_generic_do_tmr(cmd);
+ break;
+--- a/include/target/target_core_base.h
++++ b/include/target/target_core_base.h
+@@ -98,6 +98,7 @@ enum transport_state_table {
+ TRANSPORT_REMOVE = 14,
+ TRANSPORT_FREE = 15,
+ TRANSPORT_NEW_CMD_MAP = 16,
++ TRANSPORT_FREE_CMD_INTR = 17,
+ };
+
+ /* Used for struct se_cmd->se_cmd_flags */
+--- a/include/target/target_core_transport.h
++++ b/include/target/target_core_transport.h
+@@ -170,6 +170,7 @@ extern int transport_generic_handle_cdb_
+ extern int transport_generic_handle_data(struct se_cmd *);
+ extern void transport_new_cmd_failure(struct se_cmd *);
+ extern int transport_generic_handle_tmr(struct se_cmd *);
++extern void transport_generic_free_cmd_intr(struct se_cmd *);
+ extern void __transport_stop_task_timer(struct se_task *, unsigned long *);
+ extern unsigned char transport_asciihex_to_binaryhex(unsigned char val[2]);
+ extern int transport_generic_map_mem_to_cmd(struct se_cmd *cmd, struct scatterlist *, u32,
--- /dev/null
+From 53ab6709b4d35b1924240854d794482fd7d33d4a Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Thu, 19 May 2011 20:19:10 -0700
+Subject: [SCSI] target: Fix interrupt context bug with stats_lock and
+ core_tmr_alloc_req
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit 53ab6709b4d35b1924240854d794482fd7d33d4a upstream.
+
+This patch fixes two bugs wrt to the interrupt context usage of target
+core with HW target mode drivers. It first converts the usage of struct
+se_device->stats_lock in transport_get_lun_for_cmd() and core_tmr_lun_reset()
+to properly use spin_lock_irq() to address an BUG with CONFIG_LOCKDEP_SUPPORT=y
+enabled.
+
+This patch also adds a 'in_interrupt()' check to allow GFP_ATOMIC usage from
+core_tmr_alloc_req() to fix a 'sleeping in interrupt context' BUG with HW
+target fabrics that require this logic to function.
+
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: James Bottomley <jbottomley@parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/target/target_core_device.c | 4 ++--
+ drivers/target/target_core_tmr.c | 7 ++++---
+ 2 files changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/target/target_core_device.c
++++ b/drivers/target/target_core_device.c
+@@ -151,13 +151,13 @@ out:
+
+ {
+ struct se_device *dev = se_lun->lun_se_dev;
+- spin_lock(&dev->stats_lock);
++ spin_lock_irq(&dev->stats_lock);
+ dev->num_cmds++;
+ if (se_cmd->data_direction == DMA_TO_DEVICE)
+ dev->write_bytes += se_cmd->data_length;
+ else if (se_cmd->data_direction == DMA_FROM_DEVICE)
+ dev->read_bytes += se_cmd->data_length;
+- spin_unlock(&dev->stats_lock);
++ spin_unlock_irq(&dev->stats_lock);
+ }
+
+ /*
+--- a/drivers/target/target_core_tmr.c
++++ b/drivers/target/target_core_tmr.c
+@@ -55,7 +55,8 @@ struct se_tmr_req *core_tmr_alloc_req(
+ {
+ struct se_tmr_req *tmr;
+
+- tmr = kmem_cache_zalloc(se_tmr_req_cache, GFP_KERNEL);
++ tmr = kmem_cache_zalloc(se_tmr_req_cache, (in_interrupt()) ?
++ GFP_ATOMIC : GFP_KERNEL);
+ if (!(tmr)) {
+ printk(KERN_ERR "Unable to allocate struct se_tmr_req\n");
+ return ERR_PTR(-ENOMEM);
+@@ -398,9 +399,9 @@ int core_tmr_lun_reset(
+ printk(KERN_INFO "LUN_RESET: SCSI-2 Released reservation\n");
+ }
+
+- spin_lock(&dev->stats_lock);
++ spin_lock_irq(&dev->stats_lock);
+ dev->num_resets++;
+- spin_unlock(&dev->stats_lock);
++ spin_unlock_irq(&dev->stats_lock);
+
+ DEBUG_LR("LUN_RESET: %s for [%s] Complete\n",
+ (preempt_and_abort_list) ? "Preempt" : "TMR",
--- /dev/null
+From 97868c8905a1537153d406c4a3aa39a503a5c299 Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Thu, 19 May 2011 20:19:09 -0700
+Subject: [SCSI] target: Fix multi task->task_sg[] chaining logic bug
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit 97868c8905a1537153d406c4a3aa39a503a5c299 upstream.
+
+This patch fixes a bug in transport_do_task_sg_chain() used by HW target
+mode modules with sg_chain() to provide a single sg_next() walkable memory
+layout for use with pci_map_sg() and friends. This patch addresses an
+issue with mapping multiple small block max_sector tasks across multiple
+struct se_task->task_sg[] mappings for HW target mode operation.
+
+This was causing OOPs with (cmd->t_task->t_tasks_no > 1) I/O traffic for
+HW target drivers using transport_do_task_sg_chain(), and has been tested
+so far with tcm_fc(openfcoe), tcm_qla2xxx, and ib_srpt fabrics with
+t_tasks_no > 1 IBLOCK backends using a smaller max_sectors to trigger the
+original issue.
+
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Acked-by: Kiran Patil <kiran.patil@intel.com>
+Signed-off-by: James Bottomley <jbottomley@parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/target/target_core_transport.c | 26 +++++++++++++++-----------
+ 1 file changed, 15 insertions(+), 11 deletions(-)
+
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -4777,18 +4777,20 @@ void transport_do_task_sg_chain(struct s
+ sg_end_cur->page_link &= ~0x02;
+
+ sg_chain(sg_head, task_sg_num, sg_head_cur);
+- sg_count += (task->task_sg_num + 1);
+- } else
+ sg_count += task->task_sg_num;
++ task_sg_num = (task->task_sg_num + 1);
++ } else {
++ sg_chain(sg_head, task_sg_num, sg_head_cur);
++ sg_count += task->task_sg_num;
++ task_sg_num = task->task_sg_num;
++ }
+
+ sg_head = sg_head_cur;
+ sg_link = sg_link_cur;
+- task_sg_num = task->task_sg_num;
+ continue;
+ }
+ sg_head = sg_first = &task->task_sg[0];
+ sg_link = &task->task_sg[task->task_sg_num];
+- task_sg_num = task->task_sg_num;
+ /*
+ * Check for single task..
+ */
+@@ -4799,9 +4801,12 @@ void transport_do_task_sg_chain(struct s
+ */
+ sg_end = &task->task_sg[task->task_sg_num - 1];
+ sg_end->page_link &= ~0x02;
+- sg_count += (task->task_sg_num + 1);
+- } else
+ sg_count += task->task_sg_num;
++ task_sg_num = (task->task_sg_num + 1);
++ } else {
++ sg_count += task->task_sg_num;
++ task_sg_num = task->task_sg_num;
++ }
+ }
+ /*
+ * Setup the starting pointer and total t_tasks_sg_linked_no including
+@@ -4810,21 +4815,20 @@ void transport_do_task_sg_chain(struct s
+ T_TASK(cmd)->t_tasks_sg_chained = sg_first;
+ T_TASK(cmd)->t_tasks_sg_chained_no = sg_count;
+
+- DEBUG_CMD_M("Setup T_TASK(cmd)->t_tasks_sg_chained: %p and"
+- " t_tasks_sg_chained_no: %u\n", T_TASK(cmd)->t_tasks_sg_chained,
++ DEBUG_CMD_M("Setup cmd: %p T_TASK(cmd)->t_tasks_sg_chained: %p and"
++ " t_tasks_sg_chained_no: %u\n", cmd, T_TASK(cmd)->t_tasks_sg_chained,
+ T_TASK(cmd)->t_tasks_sg_chained_no);
+
+ for_each_sg(T_TASK(cmd)->t_tasks_sg_chained, sg,
+ T_TASK(cmd)->t_tasks_sg_chained_no, i) {
+
+- DEBUG_CMD_M("SG: %p page: %p length: %d offset: %d\n",
+- sg, sg_page(sg), sg->length, sg->offset);
++ DEBUG_CMD_M("SG[%d]: %p page: %p length: %d offset: %d, magic: 0x%08x\n",
++ i, sg, sg_page(sg), sg->length, sg->offset, sg->sg_magic);
+ if (sg_is_chain(sg))
+ DEBUG_CMD_M("SG: %p sg_is_chain=1\n", sg);
+ if (sg_is_last(sg))
+ DEBUG_CMD_M("SG: %p sg_is_last=1\n", sg);
+ }
+-
+ }
+ EXPORT_SYMBOL(transport_do_task_sg_chain);
+
--- /dev/null
+From af57c3ac9947990da2608561b71f4799eb7795c6 Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Thu, 19 May 2011 20:19:12 -0700
+Subject: [SCSI] target: Fix task->task_execute_queue=1 clear bug +
+ LUN_RESET OOPs
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit af57c3ac9947990da2608561b71f4799eb7795c6 upstream.
+
+This patch fixes a bug where task->task_execute_queue=1 was not being
+cleared once se_task had been removed from se_device->execute_task_list,
+resulting in an OOPs in core_tmr_lun_reset() for the task->task_active=0
+case where transport_remove_task_from_execute_queue() was incorrectly
+being called.
+
+This patch fixes two cases in transport_get_task_from_execute_queue()
+and transport_remove_task_from_execute_queue() to properly clear
+task->task_execute_queue=0 once list_del(&task->t_execute_list) has
+been called.
+
+It also adds an explict check in transport_remove_task_from_execute_queue()
+to dump_stack + return if called with task->task_execute_queue=0.
+
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: James Bottomley <jbottomley@parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/target/target_core_transport.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -1197,6 +1197,7 @@ transport_get_task_from_execute_queue(st
+ break;
+
+ list_del(&task->t_execute_list);
++ atomic_set(&task->task_execute_queue, 0);
+ atomic_dec(&dev->execute_tasks);
+
+ return task;
+@@ -1212,8 +1213,14 @@ void transport_remove_task_from_execute_
+ {
+ unsigned long flags;
+
++ if (atomic_read(&task->task_execute_queue) == 0) {
++ dump_stack();
++ return;
++ }
++
+ spin_lock_irqsave(&dev->execute_task_lock, flags);
+ list_del(&task->t_execute_list);
++ atomic_set(&task->task_execute_queue, 0);
+ atomic_dec(&dev->execute_tasks);
+ spin_unlock_irqrestore(&dev->execute_task_lock, flags);
+ }
--- /dev/null
+From 6848b7334b24b47aa3d0e70342ff839ffa95d5fa Mon Sep 17 00:00:00 2001
+From: Steve French <sfrench@us.ibm.com>
+Date: Thu, 26 May 2011 18:38:54 +0000
+Subject: [CIFS] When mandatory encryption on share, fail mount
+
+From: Steve French <sfrench@us.ibm.com>
+
+commit 6848b7334b24b47aa3d0e70342ff839ffa95d5fa upstream.
+
+ When mandatory encryption is configured in samba server on a
+ share (smb.conf parameter "smb encrypt = mandatory") the
+ server will hang up the tcp session when we try to send
+ the first frame after the tree connect if it is not a
+ QueryFSUnixInfo, this causes cifs mount to hang (it must
+ be killed with ctl-c). Move the QueryFSUnixInfo call
+ earlier in the mount sequence, and check whether the SetFSUnixInfo
+ fails due to mandatory encryption so we can return a sensible
+ error (EACCES) on mount.
+
+ In a future patch (for 2.6.40) we will support mandatory
+ encryption.
+
+Reviewed-by: Pavel Shilovsky <piastry@etersoft.ru>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/connect.c | 31 ++++++++++++++++++++++---------
+ 1 file changed, 22 insertions(+), 9 deletions(-)
+
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -2431,7 +2431,7 @@ void reset_cifs_unix_caps(int xid, struc
+
+ if (!CIFSSMBQFSUnixInfo(xid, tcon)) {
+ __u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
+-
++ cFYI(1, "unix caps which server supports %lld", cap);
+ /* check for reconnect case in which we do not
+ want to change the mount behavior if we can avoid it */
+ if (vol_info == NULL) {
+@@ -2449,6 +2449,9 @@ void reset_cifs_unix_caps(int xid, struc
+ }
+ }
+
++ if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)
++ cERROR(1, "per-share encryption not supported yet");
++
+ cap &= CIFS_UNIX_CAP_MASK;
+ if (vol_info && vol_info->no_psx_acl)
+ cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
+@@ -2497,6 +2500,10 @@ void reset_cifs_unix_caps(int xid, struc
+ cFYI(1, "very large read cap");
+ if (cap & CIFS_UNIX_LARGE_WRITE_CAP)
+ cFYI(1, "very large write cap");
++ if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP)
++ cFYI(1, "transport encryption cap");
++ if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)
++ cFYI(1, "mandatory transport encryption cap");
+ #endif /* CIFS_DEBUG2 */
+ if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
+ if (vol_info == NULL) {
+@@ -2815,20 +2822,26 @@ try_mount_again:
+ goto remote_path_check;
+ }
+
+- /* do not care if following two calls succeed - informational */
+- if (!tcon->ipc) {
+- CIFSSMBQFSDeviceInfo(xid, tcon);
+- CIFSSMBQFSAttributeInfo(xid, tcon);
+- }
+-
+ /* tell server which Unix caps we support */
+- if (tcon->ses->capabilities & CAP_UNIX)
++ if (tcon->ses->capabilities & CAP_UNIX) {
+ /* reset of caps checks mount to see if unix extensions
+ disabled for just this mount */
+ reset_cifs_unix_caps(xid, tcon, sb, volume_info);
+- else
++ if ((tcon->ses->server->tcpStatus == CifsNeedReconnect) &&
++ (le64_to_cpu(tcon->fsUnixInfo.Capability) &
++ CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)) {
++ rc = -EACCES;
++ goto mount_fail_check;
++ }
++ } else
+ tcon->unix_ext = 0; /* server does not support them */
+
++ /* do not care if following two calls succeed - informational */
++ if (!tcon->ipc) {
++ CIFSSMBQFSDeviceInfo(xid, tcon);
++ CIFSSMBQFSAttributeInfo(xid, tcon);
++ }
++
+ /* convert forward to back slashes in prepath here if needed */
+ if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) == 0)
+ convert_delimiter(cifs_sb->prepath, CIFS_DIR_SEP(cifs_sb));
--- /dev/null
+From e9cdd343a5e42c43bcda01e609fa23089e026470 Mon Sep 17 00:00:00 2001
+From: Boris Ostrovsky <ostr@amd64.org>
+Date: Thu, 26 May 2011 11:19:52 -0400
+Subject: x86, amd: Do not enable ARAT feature on AMD processors below
+ family 0x12
+
+From: Boris Ostrovsky <ostr@amd64.org>
+
+commit e9cdd343a5e42c43bcda01e609fa23089e026470 upstream.
+
+Commit b87cf80af3ba4b4c008b4face3c68d604e1715c6 added support for
+ARAT (Always Running APIC timer) on AMD processors that are not
+affected by erratum 400. This erratum is present on certain processor
+families and prevents APIC timer from waking up the CPU when it
+is in a deep C state, including C1E state.
+
+Determining whether a processor is affected by this erratum may
+have some corner cases and handling these cases is somewhat
+complicated. In the interest of simplicity we won't claim ARAT
+support on processor families below 0x12 and will go back to
+broadcasting timer when going idle.
+
+Signed-off-by: Boris Ostrovsky <ostr@amd64.org>
+Link: http://lkml.kernel.org/r/1306423192-19774-1-git-send-email-ostr@amd64.org
+Tested-by: Boris Petkov <borislav.petkov@amd.com>
+Cc: Hans Rosenfeld <Hans.Rosenfeld@amd.com>
+Cc: Andreas Herrmann <Andreas.Herrmann3@amd.com>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/amd.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -595,8 +595,11 @@ static void __cpuinit init_amd(struct cp
+ }
+ #endif
+
+- /* As a rule processors have APIC timer running in deep C states */
+- if (c->x86 > 0xf && !cpu_has_amd_erratum(amd_erratum_400))
++ /*
++ * Family 0x12 and above processors have APIC timer
++ * running in deep C states.
++ */
++ if (c->x86 > 0x11)
+ set_cpu_cap(c, X86_FEATURE_ARAT);
+
+ /*
--- /dev/null
+From d47cc0db8fd6011de2248df505fc34990b7451bf Mon Sep 17 00:00:00 2001
+From: "Roedel, Joerg" <Joerg.Roedel@amd.com>
+Date: Thu, 19 May 2011 11:13:39 +0200
+Subject: x86, amd: Use _safe() msr access for GartTlbWlk disable code
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: "Roedel, Joerg" <Joerg.Roedel@amd.com>
+
+commit d47cc0db8fd6011de2248df505fc34990b7451bf upstream.
+
+The workaround for Bugzilla:
+
+ https://bugzilla.kernel.org/show_bug.cgi?id=33012
+
+introduced a read and a write to the MC4 mask msr.
+
+Unfortunatly this MSR is not emulated by the KVM hypervisor
+so that the kernel will get a #GP and crashes when applying
+this workaround when running inside KVM.
+
+This issue was reported as:
+
+ https://bugzilla.kernel.org/show_bug.cgi?id=35132
+
+and is fixed with this patch. The change just let the kernel
+ignore any #GP it gets while accessing this MSR by using the
+_safe msr access methods.
+
+Reported-by: Török Edwin <edwintorok@gmail.com>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Cc: Rafael J. Wysocki <rjw@sisk.pl>
+Cc: Maciej Rutecki <maciej.rutecki@gmail.com>
+Cc: Avi Kivity <avi@redhat.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/amd.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -615,10 +615,13 @@ static void __cpuinit init_amd(struct cp
+ * Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=33012
+ */
+ u64 mask;
++ int err;
+
+- rdmsrl(MSR_AMD64_MCx_MASK(4), mask);
+- mask |= (1 << 10);
+- wrmsrl(MSR_AMD64_MCx_MASK(4), mask);
++ err = rdmsrl_safe(MSR_AMD64_MCx_MASK(4), &mask);
++ if (err == 0) {
++ mask |= (1 << 10);
++ checking_wrmsrl(MSR_AMD64_MCx_MASK(4), mask);
++ }
+ }
+ }
+
--- /dev/null
+From 7ccafc5f75c87853f3c49845d5a884f2376e03ce Mon Sep 17 00:00:00 2001
+From: Kees Cook <kees.cook@canonical.com>
+Date: Tue, 24 May 2011 16:29:26 -0700
+Subject: x86, cpufeature: Update CPU feature RDRND to RDRAND
+
+From: Kees Cook <kees.cook@canonical.com>
+
+commit 7ccafc5f75c87853f3c49845d5a884f2376e03ce upstream.
+
+The Intel manual changed the name of the CPUID bit to match the
+instruction name. We should follow suit for sanity's sake. (See Intel SDM
+Volume 2, Table 3-20 "Feature Information Returned in the ECX Register".)
+
+[ hpa: we can only do this at this time because there are currently no CPUs
+ with this feature on the market, hence this is pre-hardware enabling.
+ However, Cc:'ing stable so that stable can present a consistent ABI. ]
+
+Signed-off-by: Kees Cook <kees.cook@canonical.com>
+Link: http://lkml.kernel.org/r/20110524232926.GA27728@outflux.net
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Cc: Fenghua Yu <fenghua.yu@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/cpufeature.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/include/asm/cpufeature.h
++++ b/arch/x86/include/asm/cpufeature.h
+@@ -125,7 +125,7 @@
+ #define X86_FEATURE_OSXSAVE (4*32+27) /* "" XSAVE enabled in the OS */
+ #define X86_FEATURE_AVX (4*32+28) /* Advanced Vector Extensions */
+ #define X86_FEATURE_F16C (4*32+29) /* 16-bit fp conversions */
+-#define X86_FEATURE_RDRND (4*32+30) /* The RDRAND instruction */
++#define X86_FEATURE_RDRAND (4*32+30) /* The RDRAND instruction */
+ #define X86_FEATURE_HYPERVISOR (4*32+31) /* Running on a hypervisor */
+
+ /* VIA/Cyrix/Centaur-defined CPU features, CPUID level 0xC0000001, word 5 */
--- /dev/null
+From b64ce24daffb634b5b3133a2e411bd4de50654e8 Mon Sep 17 00:00:00 2001
+From: Daniel J Blueman <daniel.blueman@gmail.com>
+Date: Wed, 18 May 2011 16:31:31 -0700
+Subject: x86, ioapic: Fix potential resume deadlock
+
+From: Daniel J Blueman <daniel.blueman@gmail.com>
+
+commit b64ce24daffb634b5b3133a2e411bd4de50654e8 upstream.
+
+Fix a potential deadlock when resuming; here the calling
+function has disabled interrupts, so we cannot sleep.
+
+Change the memory allocation flag from GFP_KERNEL to GFP_ATOMIC.
+
+TODO: We can do away with this memory allocation during resume
+ by reusing the ioapic suspend/resume code that uses boot time
+ allocated buffers, but we want to keep this -stable patch
+ simple.
+
+Signed-off-by: Daniel J Blueman <daniel.blueman@gmail.com>
+Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
+Link: http://lkml.kernel.org/r/20110518233157.385970138@sbsiddha-MOBL3.sc.intel.com
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/apic/io_apic.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -615,14 +615,14 @@ struct IO_APIC_route_entry **alloc_ioapi
+ struct IO_APIC_route_entry **ioapic_entries;
+
+ ioapic_entries = kzalloc(sizeof(*ioapic_entries) * nr_ioapics,
+- GFP_KERNEL);
++ GFP_ATOMIC);
+ if (!ioapic_entries)
+ return 0;
+
+ for (apic = 0; apic < nr_ioapics; apic++) {
+ ioapic_entries[apic] =
+ kzalloc(sizeof(struct IO_APIC_route_entry) *
+- nr_ioapic_registers[apic], GFP_KERNEL);
++ nr_ioapic_registers[apic], GFP_ATOMIC);
+ if (!ioapic_entries[apic])
+ goto nomem;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
