--- /dev/null
+From d2859fd49200f1f3efd8acdb54b6d51d3ab82302 Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Mon, 23 May 2011 08:26:16 +0200
+Subject: ALSA: HDA: Add quirk for Lenovo U350
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit d2859fd49200f1f3efd8acdb54b6d51d3ab82302 upstream.
+
+Add model=asus quirk for Lenovo Ideapad U350 to make internal mic
+work correctly.
+
+BugLink: http://bugs.launchpad.net/bugs/751681
+Reported-by: Kent Baxley <kent.baxley@canonical.com>
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_conexant.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -3036,6 +3036,7 @@ static struct snd_pci_quirk cxt5066_cfg_
+ SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo Thinkpad", CXT5066_THINKPAD),
+ SND_PCI_QUIRK(0x17aa, 0x21da, "Lenovo X220", CXT5066_THINKPAD),
+ SND_PCI_QUIRK(0x17aa, 0x21db, "Lenovo X220-tablet", CXT5066_THINKPAD),
++ SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo U350", CXT5066_ASUS),
+ SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo G560", CXT5066_ASUS),
+ SND_PCI_QUIRK_VENDOR(0x17aa, "Lenovo", CXT5066_IDEAPAD), /* Fallback for Lenovos without dock mic */
+ {}
--- /dev/null
+From 5a2d227fdc7a02ed1b4cebba391d8fb9ad57caaf Mon Sep 17 00:00:00 2001
+From: Adrian Wilkins <adrian.wilkins@nhs.net>
+Date: Thu, 19 May 2011 21:52:38 +0100
+Subject: ALSA: hda - Fix input-src parse in patch_analog.c
+
+From: Adrian Wilkins <adrian.wilkins@nhs.net>
+
+commit 5a2d227fdc7a02ed1b4cebba391d8fb9ad57caaf upstream.
+
+Compare pin type enum to the pin type and not the array index.
+Fixes bug#0005368.
+
+Signed-off-by: Adrian Wilkins <adrian.wilkins@nhs.net>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_analog.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_analog.c
++++ b/sound/pci/hda/patch_analog.c
+@@ -3070,6 +3070,7 @@ static void ad1988_auto_init_analog_inpu
+
+ for (i = 0; i < cfg->num_inputs; i++) {
+ hda_nid_t nid = cfg->inputs[i].pin;
++ int type = cfg->inputs[i].type;
+ switch (nid) {
+ case 0x15: /* port-C */
+ snd_hda_codec_write(codec, 0x33, 0, AC_VERB_SET_CONNECT_SEL, 0x0);
+@@ -3079,7 +3080,7 @@ static void ad1988_auto_init_analog_inpu
+ break;
+ }
+ snd_hda_codec_write(codec, nid, 0, AC_VERB_SET_PIN_WIDGET_CONTROL,
+- i == AUTO_PIN_MIC ? PIN_VREF80 : PIN_IN);
++ type == AUTO_PIN_MIC ? PIN_VREF80 : PIN_IN);
+ if (nid != AD1988_PIN_CD_NID)
+ snd_hda_codec_write(codec, nid, 0, AC_VERB_SET_AMP_GAIN_MUTE,
+ AMP_OUT_MUTE);
--- /dev/null
+From 50e3bbf9898840eead86f90a43b3625a2b2f4112 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 20 May 2011 16:29:09 +0200
+Subject: ALSA: hda - Use LPIB for ATI/AMD chipsets as default
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 50e3bbf9898840eead86f90a43b3625a2b2f4112 upstream.
+
+ATI and AMD chipsets seem not providing the proper position-buffer
+information, and it also doesn't provide FIFO register required by
+VIACOMBO fix. It's better to use LPIB for these.
+
+Reported-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/hda_intel.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2349,9 +2349,16 @@ static int __devinit check_position_fix(
+ /* Check VIA/ATI HD Audio Controller exist */
+ switch (chip->driver_type) {
+ case AZX_DRIVER_VIA:
+- case AZX_DRIVER_ATI:
+ /* Use link position directly, avoid any transfer problem. */
+ return POS_FIX_VIACOMBO;
++ case AZX_DRIVER_ATI:
++ /* ATI chipsets don't work well with position-buffer */
++ return POS_FIX_LPIB;
++ case AZX_DRIVER_GENERIC:
++ /* AMD chipsets also don't work with position-buffer */
++ if (chip->pci->vendor == PCI_VENDOR_ID_AMD)
++ return POS_FIX_LPIB;
++ break;
+ }
+
+ return POS_FIX_AUTO;
--- /dev/null
+From e033ebfb399227e01686260ac271029011bc6b47 Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Mon, 16 May 2011 12:09:29 +0200
+Subject: ALSA: HDA: Use one dmic only for Dell Studio 1558
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit e033ebfb399227e01686260ac271029011bc6b47 upstream.
+
+There are no signs of a dmic at node 0x0b, so the user is left with
+an additional internal mic which does not exist. This commit removes
+that non-existing mic.
+
+BugLink: http://bugs.launchpad.net/bugs/731706
+Reported-by: James Page <james.page@canonical.com>
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -1600,7 +1600,7 @@ static struct snd_pci_quirk stac92hd73xx
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02fe,
+ "Dell Studio XPS 1645", STAC_DELL_M6_BOTH),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0413,
+- "Dell Studio 1558", STAC_DELL_M6_BOTH),
++ "Dell Studio 1558", STAC_DELL_M6_DMIC),
+ {} /* terminator */
+ };
+
--- /dev/null
+From fb5af53d421d80725172427e9076f6e889603df6 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Sun, 15 May 2011 12:18:38 -0700
+Subject: ASoC: Add some missing volume update bit sets for wm_hubs
+ devices
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit fb5af53d421d80725172427e9076f6e889603df6 upstream.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Acked-by: Liam Girdwood <lrg@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm_hubs.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/codecs/wm_hubs.c
++++ b/sound/soc/codecs/wm_hubs.c
+@@ -836,17 +836,21 @@ int wm_hubs_add_analogue_controls(struct
+ snd_soc_update_bits(codec, WM8993_RIGHT_LINE_INPUT_3_4_VOLUME,
+ WM8993_IN2_VU, WM8993_IN2_VU);
+
++ snd_soc_update_bits(codec, WM8993_SPEAKER_VOLUME_LEFT,
++ WM8993_SPKOUT_VU, WM8993_SPKOUT_VU);
+ snd_soc_update_bits(codec, WM8993_SPEAKER_VOLUME_RIGHT,
+ WM8993_SPKOUT_VU, WM8993_SPKOUT_VU);
+
+ snd_soc_update_bits(codec, WM8993_LEFT_OUTPUT_VOLUME,
+- WM8993_HPOUT1L_ZC, WM8993_HPOUT1L_ZC);
++ WM8993_HPOUT1_VU | WM8993_HPOUT1L_ZC,
++ WM8993_HPOUT1_VU | WM8993_HPOUT1L_ZC);
+ snd_soc_update_bits(codec, WM8993_RIGHT_OUTPUT_VOLUME,
+ WM8993_HPOUT1_VU | WM8993_HPOUT1R_ZC,
+ WM8993_HPOUT1_VU | WM8993_HPOUT1R_ZC);
+
+ snd_soc_update_bits(codec, WM8993_LEFT_OPGA_VOLUME,
+- WM8993_MIXOUTL_ZC, WM8993_MIXOUTL_ZC);
++ WM8993_MIXOUTL_ZC | WM8993_MIXOUT_VU,
++ WM8993_MIXOUTL_ZC | WM8993_MIXOUT_VU);
+ snd_soc_update_bits(codec, WM8993_RIGHT_OPGA_VOLUME,
+ WM8993_MIXOUTR_ZC | WM8993_MIXOUT_VU,
+ WM8993_MIXOUTR_ZC | WM8993_MIXOUT_VU);
--- /dev/null
+From d0b48af6c2b887354d0893e598d92911ce52620e Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Sat, 14 May 2011 17:21:28 -0700
+Subject: ASoC: Ensure output PGA is enabled for line outputs in
+ wm_hubs
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit d0b48af6c2b887354d0893e598d92911ce52620e upstream.
+
+Also fix a left/right typo while we're at it.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Acked-by: Liam Girdwood <lrg@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm_hubs.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/sound/soc/codecs/wm_hubs.c
++++ b/sound/soc/codecs/wm_hubs.c
+@@ -787,17 +787,17 @@ static const struct snd_soc_dapm_route a
+ static const struct snd_soc_dapm_route lineout1_diff_routes[] = {
+ { "LINEOUT1 Mixer", "IN1L Switch", "IN1L PGA" },
+ { "LINEOUT1 Mixer", "IN1R Switch", "IN1R PGA" },
+- { "LINEOUT1 Mixer", "Output Switch", "Left Output Mixer" },
++ { "LINEOUT1 Mixer", "Output Switch", "Left Output PGA" },
+
+ { "LINEOUT1N Driver", NULL, "LINEOUT1 Mixer" },
+ { "LINEOUT1P Driver", NULL, "LINEOUT1 Mixer" },
+ };
+
+ static const struct snd_soc_dapm_route lineout1_se_routes[] = {
+- { "LINEOUT1N Mixer", "Left Output Switch", "Left Output Mixer" },
+- { "LINEOUT1N Mixer", "Right Output Switch", "Left Output Mixer" },
++ { "LINEOUT1N Mixer", "Left Output Switch", "Left Output PGA" },
++ { "LINEOUT1N Mixer", "Right Output Switch", "Right Output PGA" },
+
+- { "LINEOUT1P Mixer", "Left Output Switch", "Left Output Mixer" },
++ { "LINEOUT1P Mixer", "Left Output Switch", "Left Output PGA" },
+
+ { "LINEOUT1N Driver", NULL, "LINEOUT1N Mixer" },
+ { "LINEOUT1P Driver", NULL, "LINEOUT1P Mixer" },
+@@ -806,17 +806,17 @@ static const struct snd_soc_dapm_route l
+ static const struct snd_soc_dapm_route lineout2_diff_routes[] = {
+ { "LINEOUT2 Mixer", "IN2L Switch", "IN2L PGA" },
+ { "LINEOUT2 Mixer", "IN2R Switch", "IN2R PGA" },
+- { "LINEOUT2 Mixer", "Output Switch", "Right Output Mixer" },
++ { "LINEOUT2 Mixer", "Output Switch", "Right Output PGA" },
+
+ { "LINEOUT2N Driver", NULL, "LINEOUT2 Mixer" },
+ { "LINEOUT2P Driver", NULL, "LINEOUT2 Mixer" },
+ };
+
+ static const struct snd_soc_dapm_route lineout2_se_routes[] = {
+- { "LINEOUT2N Mixer", "Left Output Switch", "Left Output Mixer" },
+- { "LINEOUT2N Mixer", "Right Output Switch", "Left Output Mixer" },
++ { "LINEOUT2N Mixer", "Left Output Switch", "Left Output PGA" },
++ { "LINEOUT2N Mixer", "Right Output Switch", "Right Output PGA" },
+
+- { "LINEOUT2P Mixer", "Right Output Switch", "Right Output Mixer" },
++ { "LINEOUT2P Mixer", "Right Output Switch", "Right Output PGA" },
+
+ { "LINEOUT2N Driver", NULL, "LINEOUT2N Mixer" },
+ { "LINEOUT2P Driver", NULL, "LINEOUT2P Mixer" },
--- /dev/null
+From 477a66948ef8683f182682cc68e8520baf8a5b43 Mon Sep 17 00:00:00 2001
+From: Daniel Mack <zonque@gmail.com>
+Date: Tue, 24 May 2011 14:10:32 +0200
+Subject: ASoC: fix raumfeld platform
+
+From: Daniel Mack <zonque@gmail.com>
+
+commit 477a66948ef8683f182682cc68e8520baf8a5b43 upstream.
+
+Commit f0fba2ad (ASoC: multi-component - ASoC Multi-Component Support)
+broke support for Raumfeld platforms as it didn't take into account the
+different hardware features on individual devices.
+
+In particular, Raumfeld speakers have no S/PDIF output, so the members
+of the snd_soc_card struct must be set dynamically.
+
+Signed-off-by: Daniel Mack <zonque@gmail.com>
+Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/pxa/raumfeld.c | 94 +++++++++++++++++++++++++++++------------------
+ 1 file changed, 59 insertions(+), 35 deletions(-)
+
+--- a/sound/soc/pxa/raumfeld.c
++++ b/sound/soc/pxa/raumfeld.c
+@@ -151,13 +151,13 @@ static struct snd_soc_ops raumfeld_cs427
+ .hw_params = raumfeld_cs4270_hw_params,
+ };
+
+-static int raumfeld_line_suspend(struct snd_soc_card *card)
++static int raumfeld_analog_suspend(struct snd_soc_card *card)
+ {
+ raumfeld_enable_audio(false);
+ return 0;
+ }
+
+-static int raumfeld_line_resume(struct snd_soc_card *card)
++static int raumfeld_analog_resume(struct snd_soc_card *card)
+ {
+ raumfeld_enable_audio(true);
+ return 0;
+@@ -225,32 +225,53 @@ static struct snd_soc_ops raumfeld_ak410
+ .hw_params = raumfeld_ak4104_hw_params,
+ };
+
+-static struct snd_soc_dai_link raumfeld_dai[] = {
++#define DAI_LINK_CS4270 \
++{ \
++ .name = "CS4270", \
++ .stream_name = "CS4270", \
++ .cpu_dai_name = "pxa-ssp-dai.0", \
++ .platform_name = "pxa-pcm-audio", \
++ .codec_dai_name = "cs4270-hifi", \
++ .codec_name = "cs4270-codec.0-0048", \
++ .ops = &raumfeld_cs4270_ops, \
++}
++
++#define DAI_LINK_AK4104 \
++{ \
++ .name = "ak4104", \
++ .stream_name = "Playback", \
++ .cpu_dai_name = "pxa-ssp-dai.1", \
++ .codec_dai_name = "ak4104-hifi", \
++ .platform_name = "pxa-pcm-audio", \
++ .ops = &raumfeld_ak4104_ops, \
++ .codec_name = "spi0.0", \
++}
++
++static struct snd_soc_dai_link snd_soc_raumfeld_connector_dai[] =
++{
++ DAI_LINK_CS4270,
++ DAI_LINK_AK4104,
++};
++
++static struct snd_soc_dai_link snd_soc_raumfeld_speaker_dai[] =
+ {
+- .name = "ak4104",
+- .stream_name = "Playback",
+- .cpu_dai_name = "pxa-ssp-dai.1",
+- .codec_dai_name = "ak4104-hifi",
+- .platform_name = "pxa-pcm-audio",
+- .ops = &raumfeld_ak4104_ops,
+- .codec_name = "ak4104-codec.0",
+-},
+-{
+- .name = "CS4270",
+- .stream_name = "CS4270",
+- .cpu_dai_name = "pxa-ssp-dai.0",
+- .platform_name = "pxa-pcm-audio",
+- .codec_dai_name = "cs4270-hifi",
+- .codec_name = "cs4270-codec.0-0048",
+- .ops = &raumfeld_cs4270_ops,
+-},};
+-
+-static struct snd_soc_card snd_soc_raumfeld = {
+- .name = "Raumfeld",
+- .dai_link = raumfeld_dai,
+- .suspend_post = raumfeld_line_suspend,
+- .resume_pre = raumfeld_line_resume,
+- .num_links = ARRAY_SIZE(raumfeld_dai),
++ DAI_LINK_CS4270,
++};
++
++static struct snd_soc_card snd_soc_raumfeld_connector = {
++ .name = "Raumfeld Connector",
++ .dai_link = snd_soc_raumfeld_connector_dai,
++ .num_links = ARRAY_SIZE(snd_soc_raumfeld_connector_dai),
++ .suspend_post = raumfeld_analog_suspend,
++ .resume_pre = raumfeld_analog_resume,
++};
++
++static struct snd_soc_card snd_soc_raumfeld_speaker = {
++ .name = "Raumfeld Speaker",
++ .dai_link = snd_soc_raumfeld_speaker_dai,
++ .num_links = ARRAY_SIZE(snd_soc_raumfeld_speaker_dai),
++ .suspend_post = raumfeld_analog_suspend,
++ .resume_pre = raumfeld_analog_resume,
+ };
+
+ static struct platform_device *raumfeld_audio_device;
+@@ -271,22 +292,25 @@ static int __init raumfeld_audio_init(vo
+
+ set_max9485_clk(MAX9485_MCLK_FREQ_122880);
+
+- /* Register LINE and SPDIF */
++ /* Register analog device */
+ raumfeld_audio_device = platform_device_alloc("soc-audio", 0);
+ if (!raumfeld_audio_device)
+ return -ENOMEM;
+
+- platform_set_drvdata(raumfeld_audio_device,
+- &snd_soc_raumfeld);
+- ret = platform_device_add(raumfeld_audio_device);
+-
+- /* no S/PDIF on Speakers */
+ if (machine_is_raumfeld_speaker())
++ platform_set_drvdata(raumfeld_audio_device,
++ &snd_soc_raumfeld_speaker);
++
++ if (machine_is_raumfeld_connector())
++ platform_set_drvdata(raumfeld_audio_device,
++ &snd_soc_raumfeld_connector);
++
++ ret = platform_device_add(raumfeld_audio_device);
++ if (ret < 0)
+ return ret;
+
+ raumfeld_enable_audio(true);
+-
+- return ret;
++ return 0;
+ }
+
+ static void __exit raumfeld_audio_exit(void)
--- /dev/null
+From 7287c63e986fe1a51a89f4bb1327320274a7a741 Mon Sep 17 00:00:00 2001
+From: Eddie Wai <eddie.wai@broadcom.com>
+Date: Mon, 16 May 2011 11:13:18 -0700
+Subject: [SCSI] bnx2i: Fixed packet error created when the sq_size is
+ set to 16
+
+From: Eddie Wai <eddie.wai@broadcom.com>
+
+commit 7287c63e986fe1a51a89f4bb1327320274a7a741 upstream.
+
+The number of chip's internal command cell, which is use to generate
+SCSI cmd packets to the target, was not initialized correctly by
+the driver when the sq_size is changed from the default 128.
+This, in turn, will create a problem where the chip's transmit pipe
+will erroneously reuse an old command cell that is no longer valid.
+The fix is to correctly initialize the chip's command cell upon setup.
+
+Signed-off-by: Eddie Wai <eddie.wai@broadcom.com>
+Reviewed-by: Mike Christie <michaelc@cs.wisc.edu>
+Signed-off-by: James Bottomley <jbottomley@parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/bnx2i/bnx2i_hwi.c | 1 +
+ drivers/scsi/bnx2i/bnx2i_iscsi.c | 3 +++
+ 2 files changed, 4 insertions(+)
+
+--- a/drivers/scsi/bnx2i/bnx2i_hwi.c
++++ b/drivers/scsi/bnx2i/bnx2i_hwi.c
+@@ -1274,6 +1274,7 @@ int bnx2i_send_fw_iscsi_init_msg(struct
+ iscsi_init.dummy_buffer_addr_hi =
+ (u32) ((u64) hba->dummy_buf_dma >> 32);
+
++ hba->num_ccell = hba->max_sqes >> 1;
+ hba->ctx_ccell_tasks =
+ ((hba->num_ccell & 0xFFFF) | (hba->max_sqes << 16));
+ iscsi_init.num_ccells_per_conn = hba->num_ccell;
+--- a/drivers/scsi/bnx2i/bnx2i_iscsi.c
++++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c
+@@ -1208,6 +1208,9 @@ static int bnx2i_task_xmit(struct iscsi_
+ struct bnx2i_cmd *cmd = task->dd_data;
+ struct iscsi_cmd *hdr = (struct iscsi_cmd *) task->hdr;
+
++ if (bnx2i_conn->ep->num_active_cmds + 1 > hba->max_sqes)
++ return -ENOMEM;
++
+ /*
+ * If there is no scsi_cmnd this must be a mgmt task
+ */
--- /dev/null
+From d5307a078bb0288945c900c6f4a2fd77ba6d0817 Mon Sep 17 00:00:00 2001
+From: Eddie Wai <eddie.wai@broadcom.com>
+Date: Mon, 16 May 2011 11:13:19 -0700
+Subject: [SCSI] bnx2i: Updated the connection shutdown/cleanup
+ timeout
+
+From: Eddie Wai <eddie.wai@broadcom.com>
+
+commit d5307a078bb0288945c900c6f4a2fd77ba6d0817 upstream.
+
+Modified the 10s wait time for inflight offload connections to
+advance to the next state to 2s based on test result.
+Modified the 20s shutdown timeout to 30s based on test result.
+
+Signed-off-by: Eddie Wai <eddie.wai@broadcom.com>
+Reviewed-by: Mike Christie <michaelc@cs.wisc.edu>
+Signed-off-by: James Bottomley <jbottomley@parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/bnx2i/bnx2i_init.c | 2 +-
+ drivers/scsi/bnx2i/bnx2i_iscsi.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/bnx2i/bnx2i_init.c
++++ b/drivers/scsi/bnx2i/bnx2i_init.c
+@@ -244,7 +244,7 @@ void bnx2i_stop(void *handle)
+ wait_event_interruptible_timeout(hba->eh_wait,
+ (list_empty(&hba->ep_ofld_list) &&
+ list_empty(&hba->ep_destroy_list)),
+- 10 * HZ);
++ 2 * HZ);
+ /* Wait for all endpoints to be torn down, Chip will be reset once
+ * control returns to network driver. So it is required to cleanup and
+ * release all connection resources before returning from this routine.
+--- a/drivers/scsi/bnx2i/bnx2i_iscsi.c
++++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c
+@@ -858,7 +858,7 @@ struct bnx2i_hba *bnx2i_alloc_hba(struct
+ mutex_init(&hba->net_dev_lock);
+ init_waitqueue_head(&hba->eh_wait);
+ if (test_bit(BNX2I_NX2_DEV_57710, &hba->cnic_dev_type)) {
+- hba->hba_shutdown_tmo = 20 * HZ;
++ hba->hba_shutdown_tmo = 30 * HZ;
+ hba->conn_teardown_tmo = 20 * HZ;
+ hba->conn_ctx_destroy_tmo = 6 * HZ;
+ } else { /* 5706/5708/5709 */
--- /dev/null
+From cae13fe4cc3f24820ffb990c09110626837e85d4 Mon Sep 17 00:00:00 2001
+From: Timo Warns <Warns@pre-sense.de>
+Date: Thu, 19 May 2011 09:24:17 +0200
+Subject: Fix for buffer overflow in ldm_frag_add not sufficient
+
+From: Timo Warns <Warns@pre-sense.de>
+
+commit cae13fe4cc3f24820ffb990c09110626837e85d4 upstream.
+
+As Ben Hutchings discovered [1], the patch for CVE-2011-1017 (buffer
+overflow in ldm_frag_add) is not sufficient. The original patch in
+commit c340b1d64000 ("fs/partitions/ldm.c: fix oops caused by corrupted
+partition table") does not consider that, for subsequent fragments,
+previously allocated memory is used.
+
+[1] http://lkml.org/lkml/2011/5/6/407
+
+Reported-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Timo Warns <warns@pre-sense.de>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/partitions/ldm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/fs/partitions/ldm.c
++++ b/fs/partitions/ldm.c
+@@ -1335,6 +1335,11 @@ static bool ldm_frag_add (const u8 *data
+
+ list_add_tail (&f->list, frags);
+ found:
++ if (rec >= f->num) {
++ ldm_error("REC value (%d) exceeds NUM value (%d)", rec, f->num);
++ return false;
++ }
++
+ if (f->map & (1 << rec)) {
+ ldm_error ("Duplicate VBLK, part %d.", rec);
+ f->map &= 0x7F; /* Mark the group as broken */
--- /dev/null
+From fad4dab5e44e10acf6b0235e469cb8e773b58e31 Mon Sep 17 00:00:00 2001
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Date: Wed, 18 May 2011 17:06:05 +0200
+Subject: [SCSI] Fix Ultrastor asm snippet
+
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+
+commit fad4dab5e44e10acf6b0235e469cb8e773b58e31 upstream.
+
+Commit 1292500b replaced
+
+"=m" (*field) : "1" (*field)
+
+with
+
+"=m" (*field) :
+
+with comment "The following patch fixes it by using the '+' operator on
+the (*field) operand, marking it as read-write to gcc."
+'+' was actually forgotten. This really puts it.
+
+Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Signed-off-by: James Bottomley <jbottomley@parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/ultrastor.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/ultrastor.c
++++ b/drivers/scsi/ultrastor.c
+@@ -307,7 +307,7 @@ static inline int find_and_clear_bit_16(
+ "0: bsfw %1,%w0\n\t"
+ "btr %0,%1\n\t"
+ "jnc 0b"
+- : "=&r" (rv), "=m" (*field) :);
++ : "=&r" (rv), "+m" (*field) :);
+
+ return rv;
+ }
--- /dev/null
+From 23746a66d7d9e73402c68ef00d708796b97ebd72 Mon Sep 17 00:00:00 2001
+From: Jiri Kosina <jkosina@suse.cz>
+Date: Thu, 19 May 2011 17:58:07 +0200
+Subject: HID: magicmouse: ignore 'ivalid report id' while switching
+ modes
+
+From: Jiri Kosina <jkosina@suse.cz>
+
+commit 23746a66d7d9e73402c68ef00d708796b97ebd72 upstream.
+
+The device reponds with 'invalid report id' when feature report switching it
+into multitouch mode is sent to it.
+
+This has been silently ignored before 0825411ade ("HID: bt: Wait for ACK
+on Sent Reports"), but since this commit, it propagates -EIO from the _raw
+callback .
+
+So let the driver ignore -EIO as response to 0xd7,0x01 report, as that's
+how the device reacts in normal mode.
+
+Sad, but following reality.
+
+This fixes https://bugzilla.kernel.org/show_bug.cgi?id=35022
+
+Tested-by: Chase Douglas <chase.douglas@canonical.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hid/hid-magicmouse.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/hid/hid-magicmouse.c
++++ b/drivers/hid/hid-magicmouse.c
+@@ -501,9 +501,17 @@ static int magicmouse_probe(struct hid_d
+ }
+ report->size = 6;
+
++ /*
++ * The device reponds with 'invalid report id' when feature
++ * report switching it into multitouch mode is sent to it.
++ *
++ * This results in -EIO from the _raw low-level transport callback,
++ * but there seems to be no other way of switching the mode.
++ * Thus the super-ugly hacky success check below.
++ */
+ ret = hdev->hid_output_raw_report(hdev, feature, sizeof(feature),
+ HID_FEATURE_REPORT);
+- if (ret != sizeof(feature)) {
++ if (ret != -EIO) {
+ hid_err(hdev, "unable to request touch data (%d)\n", ret);
+ goto err_stop_hw;
+ }
--- /dev/null
+From 65a1a0ace554d61ea5a90377a54df1505275c1b1 Mon Sep 17 00:00:00 2001
+From: Kenneth Waters <kwaters@chromium.org>
+Date: Mon, 25 Apr 2011 12:29:54 -0600
+Subject: i2c: tegra: Enable new slave mode.
+
+From: Kenneth Waters <kwaters@chromium.org>
+
+commit 65a1a0ace554d61ea5a90377a54df1505275c1b1 upstream.
+
+For Tegra i2c controller to function properly new slave mode must be
+enabled.
+
+swarren notes:
+
+In particular, I found this was needed when working on enabling the
+Tegra audio driver on the Seaboard board. There are two different PCB
+layouts for this board; a "clamshell" version, which works just fine
+without this change, and the original non-clamshell version, which needs
+this change in order for I2C to operate correctly. Without it, I2C
+probing fails for some devices, e.g. with:
+
+wm8903 0-001a: Device with ID register 0 is not a WM8903
+wm8903 0-001a: asoc: failed to probe CODEC wm8903.0-001a: -19
+asoc: failed to instantiate card tegra-wm8903: -19
+ALSA device list:
+ No soundcards found.
+
+Signed-off-by: Rakesh Iyer <riyer@nvidia.com>
+Signed-off-by: Stephen Warren <swarren@nvidia.com>
+Signed-off-by: Ben Dooks <ben-linux@fluff.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/i2c/busses/i2c-tegra.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-tegra.c
++++ b/drivers/i2c/busses/i2c-tegra.c
+@@ -330,6 +330,11 @@ static int tegra_i2c_init(struct tegra_i
+ i2c_writel(i2c_dev, 0, I2C_INT_MASK);
+ clk_set_rate(i2c_dev->clk, i2c_dev->bus_clk_rate * 8);
+
++ if (!i2c_dev->is_dvc) {
++ u32 sl_cfg = i2c_readl(i2c_dev, I2C_SL_CNFG);
++ i2c_writel(i2c_dev, sl_cfg | I2C_SL_CNFG_NEWSL, I2C_SL_CNFG);
++ }
++
+ val = 7 << I2C_FIFO_CONTROL_TX_TRIG_SHIFT |
+ 0 << I2C_FIFO_CONTROL_RX_TRIG_SHIFT;
+ i2c_writel(i2c_dev, val, I2C_FIFO_CONTROL);
--- /dev/null
+From 3116c86033079a1d4d4e84c40028f96b614843b8 Mon Sep 17 00:00:00 2001
+From: Vikram Narayanan <vikram186@gmail.com>
+Date: Tue, 24 May 2011 20:58:48 +0200
+Subject: i2c/writing-clients: Fix foo_driver.id_table
+
+From: Vikram Narayanan <vikram186@gmail.com>
+
+commit 3116c86033079a1d4d4e84c40028f96b614843b8 upstream.
+
+The i2c_device_id structure variable's name is not used in the
+i2c_driver structure.
+
+Signed-off-by: Vikram Narayanan <vikram186@gmail.com>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/i2c/writing-clients | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Documentation/i2c/writing-clients
++++ b/Documentation/i2c/writing-clients
+@@ -38,7 +38,7 @@ static struct i2c_driver foo_driver = {
+ .name = "foo",
+ },
+
+- .id_table = foo_ids,
++ .id_table = foo_idtable,
+ .probe = foo_probe,
+ .remove = foo_remove,
+ /* if device autodetection is needed: */
--- /dev/null
+From a1c15c59feee36267c43142a41152fbf7402afb6 Mon Sep 17 00:00:00 2001
+From: Namhyung Kim <namhyung@gmail.com>
+Date: Tue, 24 May 2011 16:48:55 +0200
+Subject: loop: handle on-demand devices correctly
+
+From: Namhyung Kim <namhyung@gmail.com>
+
+commit a1c15c59feee36267c43142a41152fbf7402afb6 upstream.
+
+When finding or allocating a loop device, loop_probe() did not take
+partition numbers into account so that it can result to a different
+device. Consider following example:
+
+$ sudo modprobe loop max_part=15
+$ ls -l /dev/loop*
+brw-rw---- 1 root disk 7, 0 2011-05-24 22:16 /dev/loop0
+brw-rw---- 1 root disk 7, 16 2011-05-24 22:16 /dev/loop1
+brw-rw---- 1 root disk 7, 32 2011-05-24 22:16 /dev/loop2
+brw-rw---- 1 root disk 7, 48 2011-05-24 22:16 /dev/loop3
+brw-rw---- 1 root disk 7, 64 2011-05-24 22:16 /dev/loop4
+brw-rw---- 1 root disk 7, 80 2011-05-24 22:16 /dev/loop5
+brw-rw---- 1 root disk 7, 96 2011-05-24 22:16 /dev/loop6
+brw-rw---- 1 root disk 7, 112 2011-05-24 22:16 /dev/loop7
+$ sudo mknod /dev/loop8 b 7 128
+$ sudo losetup /dev/loop8 ~/temp/disk-with-3-parts.img
+$ sudo losetup -a
+/dev/loop128: [0805]:278201 (/home/namhyung/temp/disk-with-3-parts.img)
+$ ls -l /dev/loop*
+brw-rw---- 1 root disk 7, 0 2011-05-24 22:16 /dev/loop0
+brw-rw---- 1 root disk 7, 16 2011-05-24 22:16 /dev/loop1
+brw-rw---- 1 root disk 7, 2048 2011-05-24 22:18 /dev/loop128
+brw-rw---- 1 root disk 7, 2049 2011-05-24 22:18 /dev/loop128p1
+brw-rw---- 1 root disk 7, 2050 2011-05-24 22:18 /dev/loop128p2
+brw-rw---- 1 root disk 7, 2051 2011-05-24 22:18 /dev/loop128p3
+brw-rw---- 1 root disk 7, 32 2011-05-24 22:16 /dev/loop2
+brw-rw---- 1 root disk 7, 48 2011-05-24 22:16 /dev/loop3
+brw-rw---- 1 root disk 7, 64 2011-05-24 22:16 /dev/loop4
+brw-rw---- 1 root disk 7, 80 2011-05-24 22:16 /dev/loop5
+brw-rw---- 1 root disk 7, 96 2011-05-24 22:16 /dev/loop6
+brw-rw---- 1 root disk 7, 112 2011-05-24 22:16 /dev/loop7
+brw-r--r-- 1 root root 7, 128 2011-05-24 22:17 /dev/loop8
+
+After this patch, /dev/loop8 - instead of /dev/loop128 - was
+accessed correctly.
+
+In addition, 'range' passed to blk_register_region() should
+include all range of dev_t that LOOP_MAJOR can address. It does
+not need to be limited by partition numbers unless 'max_loop'
+param was specified.
+
+Signed-off-by: Namhyung Kim <namhyung@gmail.com>
+Cc: Laurent Vivier <Laurent.Vivier@bull.net>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/block/loop.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -1658,7 +1658,7 @@ static struct kobject *loop_probe(dev_t
+ struct kobject *kobj;
+
+ mutex_lock(&loop_devices_mutex);
+- lo = loop_init_one(dev & MINORMASK);
++ lo = loop_init_one(MINOR(dev) >> part_shift);
+ kobj = lo ? get_disk(lo->lo_disk) : ERR_PTR(-ENOMEM);
+ mutex_unlock(&loop_devices_mutex);
+
+@@ -1699,10 +1699,10 @@ static int __init loop_init(void)
+
+ if (max_loop) {
+ nr = max_loop;
+- range = max_loop;
++ range = max_loop << part_shift;
+ } else {
+ nr = 8;
+- range = 1UL << (MINORBITS - part_shift);
++ range = 1UL << MINORBITS;
+ }
+
+ if (register_blkdev(LOOP_MAJOR, "loop"))
+@@ -1741,7 +1741,7 @@ static void __exit loop_exit(void)
+ unsigned long range;
+ struct loop_device *lo, *next;
+
+- range = max_loop ? max_loop : 1UL << (MINORBITS - part_shift);
++ range = max_loop ? max_loop << part_shift : 1UL << MINORBITS;
+
+ list_for_each_entry_safe(lo, next, &loop_devices, lo_list)
+ loop_del_one(lo);
--- /dev/null
+From 78f4bb367fd147a0e7e3998ba6e47109999d8814 Mon Sep 17 00:00:00 2001
+From: Namhyung Kim <namhyung@gmail.com>
+Date: Tue, 24 May 2011 16:48:54 +0200
+Subject: loop: limit 'max_part' module param to DISK_MAX_PARTS
+
+From: Namhyung Kim <namhyung@gmail.com>
+
+commit 78f4bb367fd147a0e7e3998ba6e47109999d8814 upstream.
+
+The 'max_part' parameter controls the number of maximum partition
+a loop block device can have. However if a user specifies very
+large value it would exceed the limitation of device minor number
+and can cause a kernel panic (or, at least, produce invalid
+device nodes in some cases).
+
+On my desktop system, following command kills the kernel. On qemu,
+it triggers similar oops but the kernel was alive:
+
+$ sudo modprobe loop max_part0000
+ ------------[ cut here ]------------
+ kernel BUG at /media/Linux_Data/project/linux/fs/sysfs/group.c:65!
+ invalid opcode: 0000 [#1] SMP
+ last sysfs file:
+ CPU 0
+ Modules linked in: loop(+)
+
+ Pid: 43, comm: insmod Tainted: G W 2.6.39-qemu+ #155 Bochs Bochs
+ RIP: 0010:[<ffffffff8113ce61>] [<ffffffff8113ce61>] internal_create_group=
++0x2a/0x170
+ RSP: 0018:ffff880007b3fde8 EFLAGS: 00000246
+ RAX: 00000000ffffffef RBX: ffff880007b3d878 RCX: 00000000000007b4
+ RDX: ffffffff8152da50 RSI: 0000000000000000 RDI: ffff880007b3d878
+ RBP: ffff880007b3fe38 R08: ffff880007b3fde8 R09: 0000000000000000
+ R10: ffff88000783b4a8 R11: ffff880007b3d878 R12: ffffffff8152da50
+ R13: ffff880007b3d868 R14: 0000000000000000 R15: ffff880007b3d800
+ FS: 0000000002137880(0063) GS:ffff880007c00000(0000) knlGS:00000000000000=
+00
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000000000422680 CR3: 0000000007b50000 CR4: 00000000000006b0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 0000000000000000 DR7: 0000000000000000
+ Process insmod (pid: 43, threadinfo ffff880007b3e000, task ffff880007afb9c=
+0)
+ Stack:
+ ffff880007b3fe58 ffffffff811e66dd ffff880007b3fe58 ffffffff811e570b
+ 0000000000000010 ffff880007b3d800 ffff880007a7b390 ffff880007b3d868
+ 0000000000400920 ffff880007b3d800 ffff880007b3fe48 ffffffff8113cfc8
+ Call Trace:
+ [<ffffffff811e66dd>] ? device_add+0x4bc/0x5af
+ [<ffffffff811e570b>] ? dev_set_name+0x3c/0x3e
+ [<ffffffff8113cfc8>] sysfs_create_group+0xe/0x12
+ [<ffffffff810b420e>] blk_trace_init_sysfs+0x14/0x16
+ [<ffffffff8116a090>] blk_register_queue+0x47/0xf7
+ [<ffffffff8116f527>] add_disk+0xdf/0x290
+ [<ffffffffa00060eb>] loop_init+0xeb/0x1b8 [loop]
+ [<ffffffffa0006000>] ? 0xffffffffa0005fff
+ [<ffffffff8100020a>] do_one_initcall+0x7a/0x12e
+ [<ffffffff81096804>] sys_init_module+0x9c/0x1e0
+ [<ffffffff813329bb>] system_call_fastpath+0x16/0x1b
+ Code: c3 55 48 89 e5 41 57 41 56 41 89 f6 41 55 41 54 49 89 d4 53 48 89 fb=
+ 48 83 ec 28 48 85 ff 74 0b 85 f6 75 0b 48 83 7f 30 00 75 14 <0f> 0b eb fe =
+48 83 7f 30 00 b9 ea ff ff ff 0f 84 18 01 00 00 49
+ RIP [<ffffffff8113ce61>] internal_create_group+0x2a/0x170
+ RSP <ffff880007b3fde8>
+ ---[ end trace a123eb592043acad ]---
+
+Signed-off-by: Namhyung Kim <namhyung@gmail.com>
+Cc: Laurent Vivier <Laurent.Vivier@bull.net>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/block/loop.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -1691,6 +1691,9 @@ static int __init loop_init(void)
+ if (max_part > 0)
+ part_shift = fls(max_part);
+
++ if ((1UL << part_shift) > DISK_MAX_PARTS)
++ return -EINVAL;
++
+ if (max_loop > 1UL << (MINORBITS - part_shift))
+ return -EINVAL;
+
--- /dev/null
+From 8258c53208d7a9b7207e7d4dae36d2ea384cb278 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Wed, 11 May 2011 14:26:30 +1000
+Subject: md/bitmap: fix saving of events_cleared and other state.
+
+From: NeilBrown <neilb@suse.de>
+
+commit 8258c53208d7a9b7207e7d4dae36d2ea384cb278 upstream.
+
+If a bitmap is found to be 'stale' the events_cleared value
+is set to match 'events'.
+However if the array is degraded this does not get stored on disk.
+This can subsequently lead to incorrect behaviour.
+
+So change bitmap_update_sb to always update events_cleared in the
+superblock from the known events_cleared.
+For neatness also set ->state from ->flags.
+This requires updating ->state whenever we update ->flags, which makes
+sense anyway.
+
+This is suitable for any active -stable release.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/bitmap.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/md/bitmap.c
++++ b/drivers/md/bitmap.c
+@@ -493,11 +493,11 @@ void bitmap_update_sb(struct bitmap *bit
+ spin_unlock_irqrestore(&bitmap->lock, flags);
+ sb = kmap_atomic(bitmap->sb_page, KM_USER0);
+ sb->events = cpu_to_le64(bitmap->mddev->events);
+- if (bitmap->mddev->events < bitmap->events_cleared) {
++ if (bitmap->mddev->events < bitmap->events_cleared)
+ /* rocking back to read-only */
+ bitmap->events_cleared = bitmap->mddev->events;
+- sb->events_cleared = cpu_to_le64(bitmap->events_cleared);
+- }
++ sb->events_cleared = cpu_to_le64(bitmap->events_cleared);
++ sb->state = cpu_to_le32(bitmap->flags);
+ /* Just in case these have been changed via sysfs: */
+ sb->daemon_sleep = cpu_to_le32(bitmap->mddev->bitmap_info.daemon_sleep/HZ);
+ sb->write_behind = cpu_to_le32(bitmap->mddev->bitmap_info.max_write_behind);
+@@ -618,7 +618,7 @@ success:
+ if (le32_to_cpu(sb->version) == BITMAP_MAJOR_HOSTENDIAN)
+ bitmap->flags |= BITMAP_HOSTENDIAN;
+ bitmap->events_cleared = le64_to_cpu(sb->events_cleared);
+- if (sb->state & cpu_to_le32(BITMAP_STALE))
++ if (bitmap->flags & BITMAP_STALE)
+ bitmap->events_cleared = bitmap->mddev->events;
+ err = 0;
+ out:
+@@ -652,9 +652,11 @@ static int bitmap_mask_state(struct bitm
+ switch (op) {
+ case MASK_SET:
+ sb->state |= cpu_to_le32(bits);
++ bitmap->flags |= bits;
+ break;
+ case MASK_UNSET:
+ sb->state &= cpu_to_le32(~bits);
++ bitmap->flags &= ~bits;
+ break;
+ default:
+ BUG();
--- /dev/null
+From b0140891a8cea36469f58d23859e599b1122bd37 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Tue, 10 May 2011 17:49:01 +1000
+Subject: md: Fix race when creating a new md device.
+
+From: NeilBrown <neilb@suse.de>
+
+commit b0140891a8cea36469f58d23859e599b1122bd37 upstream.
+
+There is a race when creating an md device by opening /dev/mdXX.
+
+If two processes do this at much the same time they will follow the
+call path
+ __blkdev_get -> get_gendisk -> kobj_lookup
+
+The first will call
+ -> md_probe -> md_alloc -> add_disk -> blk_register_region
+
+and the race happens when the second gets to kobj_lookup after
+add_disk has called blk_register_region but before it returns to
+md_alloc.
+
+In the case the second will not call md_probe (as the probe is already
+done) but will get a handle on the gendisk, return to __blkdev_get
+which will then call md_open (via the ->open) pointer.
+
+As mddev->gendisk hasn't been set yet, md_open will think something is
+wrong an return with ERESTARTSYS.
+
+This can loop endlessly while the first thread makes no progress
+through add_disk. Nothing is blocking it, but due to scheduler
+behaviour it doesn't get a turn.
+So this is essentially a live-lock.
+
+We fix this by simply moving the assignment to mddev->gendisk before
+the call the add_disk() so md_open doesn't get confused.
+Also move blk_queue_flush earlier because add_disk should be as late
+as possible.
+
+To make sure that md_open doesn't complete until md_alloc has done all
+that is needed, we take mddev->open_mutex during the last part of
+md_alloc. md_open will wait for this.
+
+This can cause a lock-up on boot so Cc:ing for stable.
+For 2.6.36 and earlier a different patch will be needed as the
+'blk_queue_flush' call isn't there.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Reported-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
+Tested-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/md.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -4347,13 +4347,19 @@ static int md_alloc(dev_t dev, char *nam
+ disk->fops = &md_fops;
+ disk->private_data = mddev;
+ disk->queue = mddev->queue;
++ blk_queue_flush(mddev->queue, REQ_FLUSH | REQ_FUA);
+ /* Allow extended partitions. This makes the
+ * 'mdp' device redundant, but we can't really
+ * remove it now.
+ */
+ disk->flags |= GENHD_FL_EXT_DEVT;
+- add_disk(disk);
+ mddev->gendisk = disk;
++ /* As soon as we call add_disk(), another thread could get
++ * through to md_open, so make sure it doesn't get too far
++ */
++ mutex_lock(&mddev->open_mutex);
++ add_disk(disk);
++
+ error = kobject_init_and_add(&mddev->kobj, &md_ktype,
+ &disk_to_dev(disk)->kobj, "%s", "md");
+ if (error) {
+@@ -4367,8 +4373,7 @@ static int md_alloc(dev_t dev, char *nam
+ if (mddev->kobj.sd &&
+ sysfs_create_group(&mddev->kobj, &md_bitmap_group))
+ printk(KERN_DEBUG "pointless warning\n");
+-
+- blk_queue_flush(mddev->queue, REQ_FLUSH | REQ_FUA);
++ mutex_unlock(&mddev->open_mutex);
+ abort:
+ mutex_unlock(&disks_mutex);
+ if (!error && mddev->kobj.sd) {
--- /dev/null
+From cfa54a0fcfc1017c6f122b6f21aaba36daa07f71 Mon Sep 17 00:00:00 2001
+From: Andrew Barry <abarry@cray.com>
+Date: Tue, 24 May 2011 17:12:52 -0700
+Subject: mm/page_alloc.c: prevent unending loop in
+ __alloc_pages_slowpath()
+
+From: Andrew Barry <abarry@cray.com>
+
+commit cfa54a0fcfc1017c6f122b6f21aaba36daa07f71 upstream.
+
+I believe I found a problem in __alloc_pages_slowpath, which allows a
+process to get stuck endlessly looping, even when lots of memory is
+available.
+
+Running an I/O and memory intensive stress-test I see a 0-order page
+allocation with __GFP_IO and __GFP_WAIT, running on a system with very
+little free memory. Right about the same time that the stress-test gets
+killed by the OOM-killer, the utility trying to allocate memory gets stuck
+in __alloc_pages_slowpath even though most of the systems memory was freed
+by the oom-kill of the stress-test.
+
+The utility ends up looping from the rebalance label down through the
+wait_iff_congested continiously. Because order=0,
+__alloc_pages_direct_compact skips the call to get_page_from_freelist.
+Because all of the reclaimable memory on the system has already been
+reclaimed, __alloc_pages_direct_reclaim skips the call to
+get_page_from_freelist. Since there is no __GFP_FS flag, the block with
+__alloc_pages_may_oom is skipped. The loop hits the wait_iff_congested,
+then jumps back to rebalance without ever trying to
+get_page_from_freelist. This loop repeats infinitely.
+
+The test case is pretty pathological. Running a mix of I/O stress-tests
+that do a lot of fork() and consume all of the system memory, I can pretty
+reliably hit this on 600 nodes, in about 12 hours. 32GB/node.
+
+Signed-off-by: Andrew Barry <abarry@cray.com>
+Signed-off-by: Minchan Kim <minchan.kim@gmail.com>
+Reviewed-by: Rik van Riel<riel@redhat.com>
+Acked-by: Mel Gorman <mgorman@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/page_alloc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -2064,6 +2064,7 @@ restart:
+ first_zones_zonelist(zonelist, high_zoneidx, NULL,
+ &preferred_zone);
+
++rebalance:
+ /* This is the last chance, in general, before the goto nopage. */
+ page = get_page_from_freelist(gfp_mask, nodemask, order, zonelist,
+ high_zoneidx, alloc_flags & ~ALLOC_NO_WATERMARKS,
+@@ -2071,7 +2072,6 @@ restart:
+ if (page)
+ goto got_pg;
+
+-rebalance:
+ /* Allocate without watermarks if the context allows */
+ if (alloc_flags & ALLOC_NO_WATERMARKS) {
+ page = __alloc_pages_high_priority(gfp_mask, order,
--- /dev/null
+From afc7e326a3f5bafc41324d7926c324414e343ee5 Mon Sep 17 00:00:00 2001
+From: Johannes Weiner <hannes@cmpxchg.org>
+Date: Tue, 24 May 2011 17:11:09 -0700
+Subject: mm: vmscan: correct use of pgdat_balanced in
+ sleeping_prematurely
+
+From: Johannes Weiner <hannes@cmpxchg.org>
+
+commit afc7e326a3f5bafc41324d7926c324414e343ee5 upstream.
+
+There are a few reports of people experiencing hangs when copying large
+amounts of data with kswapd using a large amount of CPU which appear to be
+due to recent reclaim changes. SLUB using high orders is the trigger but
+not the root cause as SLUB has been using high orders for a while. The
+root cause was bugs introduced into reclaim which are addressed by the
+following two patches.
+
+Patch 1 corrects logic introduced by commit 1741c877 ("mm: kswapd:
+ keep kswapd awake for high-order allocations until a percentage of
+ the node is balanced") to allow kswapd to go to sleep when
+ balanced for high orders.
+
+Patch 2 notes that it is possible for kswapd to miss every
+ cond_resched() and updates shrink_slab() so it'll at least reach
+ that scheduling point.
+
+Chris Wood reports that these two patches in isolation are sufficient to
+prevent the system hanging. AFAIK, they should also resolve similar hangs
+experienced by James Bottomley.
+
+This patch:
+
+Johannes Weiner poined out that the logic in commit 1741c877 ("mm: kswapd:
+keep kswapd awake for high-order allocations until a percentage of the
+node is balanced") is backwards. Instead of allowing kswapd to go to
+sleep when balancing for high order allocations, it keeps it kswapd
+running uselessly.
+
+Signed-off-by: Mel Gorman <mgorman@suse.de>
+Reviewed-by: Rik van Riel <riel@redhat.com>
+Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
+Reviewed-by: Wu Fengguang <fengguang.wu@intel.com>
+Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
+Tested-by: Colin King <colin.king@canonical.com>
+Cc: Raghavendra D Prabhu <raghu.prabhu13@gmail.com>
+Cc: Jan Kara <jack@suse.cz>
+Cc: Chris Mason <chris.mason@oracle.com>
+Cc: Christoph Lameter <cl@linux.com>
+Cc: Pekka Enberg <penberg@kernel.org>
+Cc: Rik van Riel <riel@redhat.com>
+Reviewed-by: Minchan Kim <minchan.kim@gmail.com>
+Reviewed-by: Wu Fengguang <fengguang.wu@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/vmscan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -2286,7 +2286,7 @@ static bool sleeping_prematurely(pg_data
+ * must be balanced
+ */
+ if (order)
+- return pgdat_balanced(pgdat, balanced, classzone_idx);
++ return !pgdat_balanced(pgdat, balanced, classzone_idx);
+ else
+ return !all_zones_ok;
+ }
--- /dev/null
+From f06590bd718ed950c98828e30ef93204028f3210 Mon Sep 17 00:00:00 2001
+From: Minchan Kim <minchan.kim@gmail.com>
+Date: Tue, 24 May 2011 17:11:11 -0700
+Subject: mm: vmscan: correctly check if reclaimer should schedule
+ during shrink_slab
+
+From: Minchan Kim <minchan.kim@gmail.com>
+
+commit f06590bd718ed950c98828e30ef93204028f3210 upstream.
+
+It has been reported on some laptops that kswapd is consuming large
+amounts of CPU and not being scheduled when SLUB is enabled during large
+amounts of file copying. It is expected that this is due to kswapd
+missing every cond_resched() point because;
+
+shrink_page_list() calls cond_resched() if inactive pages were isolated
+ which in turn may not happen if all_unreclaimable is set in
+ shrink_zones(). If for whatver reason, all_unreclaimable is
+ set on all zones, we can miss calling cond_resched().
+
+balance_pgdat() only calls cond_resched if the zones are not
+ balanced. For a high-order allocation that is balanced, it
+ checks order-0 again. During that window, order-0 might have
+ become unbalanced so it loops again for order-0 and returns
+ that it was reclaiming for order-0 to kswapd(). It can then
+ find that a caller has rewoken kswapd for a high-order and
+ re-enters balance_pgdat() without ever calling cond_resched().
+
+shrink_slab only calls cond_resched() if we are reclaiming slab
+ pages. If there are a large number of direct reclaimers, the
+ shrinker_rwsem can be contended and prevent kswapd calling
+ cond_resched().
+
+This patch modifies the shrink_slab() case. If the semaphore is
+contended, the caller will still check cond_resched(). After each
+successful call into a shrinker, the check for cond_resched() remains in
+case one shrinker is particularly slow.
+
+[mgorman@suse.de: preserve call to cond_resched after each call into shrinker]
+Signed-off-by: Mel Gorman <mgorman@suse.de>
+Signed-off-by: Minchan Kim <minchan.kim@gmail.com>
+Cc: Rik van Riel <riel@redhat.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Wu Fengguang <fengguang.wu@intel.com>
+Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
+Tested-by: Colin King <colin.king@canonical.com>
+Cc: Raghavendra D Prabhu <raghu.prabhu13@gmail.com>
+Cc: Jan Kara <jack@suse.cz>
+Cc: Chris Mason <chris.mason@oracle.com>
+Cc: Christoph Lameter <cl@linux.com>
+Cc: Pekka Enberg <penberg@kernel.org>
+Cc: Rik van Riel <riel@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/vmscan.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -230,8 +230,11 @@ unsigned long shrink_slab(unsigned long
+ if (scanned == 0)
+ scanned = SWAP_CLUSTER_MAX;
+
+- if (!down_read_trylock(&shrinker_rwsem))
+- return 1; /* Assume we'll be able to shrink next time */
++ if (!down_read_trylock(&shrinker_rwsem)) {
++ /* Assume we'll be able to shrink next time */
++ ret = 1;
++ goto out;
++ }
+
+ list_for_each_entry(shrinker, &shrinker_list, list) {
+ unsigned long long delta;
+@@ -282,6 +285,8 @@ unsigned long shrink_slab(unsigned long
+ shrinker->nr += total_scan;
+ }
+ up_read(&shrinker_rwsem);
++out:
++ cond_resched();
+ return ret;
+ }
+
--- /dev/null
+From 3ace8e052be5293ebb3e00f819effccc64108a38 Mon Sep 17 00:00:00 2001
+From: "Kashyap, Desai" <kashyap.desai@lsi.com>
+Date: Wed, 4 May 2011 16:35:58 +0530
+Subject: [SCSI] mpt2sas: move even handling of
+ MPT2SAS_TURN_ON_FAULT_LED into process context
+
+From: "Kashyap, Desai" <kashyap.desai@lsi.com>
+
+commit 3ace8e052be5293ebb3e00f819effccc64108a38 upstream.
+
+Driver was a sending a SEP request during interrupt context which
+required to go to sleep.
+
+The fix is to rearrange the code so a fake event
+MPT2SAS_TURN_ON_FAULT_LED is fired from interrupt context, then later
+during the kernel worker threads processing, the SEP request is issued
+to firmware.
+
+Signed-off-by: Kashyap Desai <kashyap.desai@lsi.com>
+Signed-off-by: James Bottomley <jbottomley@parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/mpt2sas/mpt2sas_scsih.c | 94 +++++++++++++++++++++++++----------
+ 1 file changed, 68 insertions(+), 26 deletions(-)
+
+--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+@@ -113,6 +113,7 @@ struct sense_info {
+ };
+
+
++#define MPT2SAS_TURN_ON_FAULT_LED (0xFFFC)
+ #define MPT2SAS_RESCAN_AFTER_HOST_RESET (0xFFFF)
+
+ /**
+@@ -121,6 +122,7 @@ struct sense_info {
+ * @work: work object (ioc->fault_reset_work_q)
+ * @cancel_pending_work: flag set during reset handling
+ * @ioc: per adapter object
++ * @device_handle: device handle
+ * @VF_ID: virtual function id
+ * @VP_ID: virtual port id
+ * @ignore: flag meaning this event has been marked to ignore
+@@ -134,6 +136,7 @@ struct fw_event_work {
+ u8 cancel_pending_work;
+ struct delayed_work delayed_work;
+ struct MPT2SAS_ADAPTER *ioc;
++ u16 device_handle;
+ u8 VF_ID;
+ u8 VP_ID;
+ u8 ignore;
+@@ -3708,17 +3711,75 @@ _scsih_scsi_ioc_info(struct MPT2SAS_ADAP
+ #endif
+
+ /**
+- * _scsih_smart_predicted_fault - illuminate Fault LED
++ * _scsih_turn_on_fault_led - illuminate Fault LED
+ * @ioc: per adapter object
+ * @handle: device handle
++ * Context: process
+ *
+ * Return nothing.
+ */
+ static void
+-_scsih_smart_predicted_fault(struct MPT2SAS_ADAPTER *ioc, u16 handle)
++_scsih_turn_on_fault_led(struct MPT2SAS_ADAPTER *ioc, u16 handle)
+ {
+ Mpi2SepReply_t mpi_reply;
+ Mpi2SepRequest_t mpi_request;
++
++ memset(&mpi_request, 0, sizeof(Mpi2SepRequest_t));
++ mpi_request.Function = MPI2_FUNCTION_SCSI_ENCLOSURE_PROCESSOR;
++ mpi_request.Action = MPI2_SEP_REQ_ACTION_WRITE_STATUS;
++ mpi_request.SlotStatus =
++ cpu_to_le32(MPI2_SEP_REQ_SLOTSTATUS_PREDICTED_FAULT);
++ mpi_request.DevHandle = cpu_to_le16(handle);
++ mpi_request.Flags = MPI2_SEP_REQ_FLAGS_DEVHANDLE_ADDRESS;
++ if ((mpt2sas_base_scsi_enclosure_processor(ioc, &mpi_reply,
++ &mpi_request)) != 0) {
++ printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n", ioc->name,
++ __FILE__, __LINE__, __func__);
++ return;
++ }
++
++ if (mpi_reply.IOCStatus || mpi_reply.IOCLogInfo) {
++ dewtprintk(ioc, printk(MPT2SAS_INFO_FMT "enclosure_processor: "
++ "ioc_status (0x%04x), loginfo(0x%08x)\n", ioc->name,
++ le16_to_cpu(mpi_reply.IOCStatus),
++ le32_to_cpu(mpi_reply.IOCLogInfo)));
++ return;
++ }
++}
++
++/**
++ * _scsih_send_event_to_turn_on_fault_led - fire delayed event
++ * @ioc: per adapter object
++ * @handle: device handle
++ * Context: interrupt.
++ *
++ * Return nothing.
++ */
++static void
++_scsih_send_event_to_turn_on_fault_led(struct MPT2SAS_ADAPTER *ioc, u16 handle)
++{
++ struct fw_event_work *fw_event;
++
++ fw_event = kzalloc(sizeof(struct fw_event_work), GFP_ATOMIC);
++ if (!fw_event)
++ return;
++ fw_event->event = MPT2SAS_TURN_ON_FAULT_LED;
++ fw_event->device_handle = handle;
++ fw_event->ioc = ioc;
++ _scsih_fw_event_add(ioc, fw_event);
++}
++
++/**
++ * _scsih_smart_predicted_fault - process smart errors
++ * @ioc: per adapter object
++ * @handle: device handle
++ * Context: interrupt.
++ *
++ * Return nothing.
++ */
++static void
++_scsih_smart_predicted_fault(struct MPT2SAS_ADAPTER *ioc, u16 handle)
++{
+ struct scsi_target *starget;
+ struct MPT2SAS_TARGET *sas_target_priv_data;
+ Mpi2EventNotificationReply_t *event_reply;
+@@ -3745,30 +3806,8 @@ _scsih_smart_predicted_fault(struct MPT2
+ starget_printk(KERN_WARNING, starget, "predicted fault\n");
+ spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
+
+- if (ioc->pdev->subsystem_vendor == PCI_VENDOR_ID_IBM) {
+- memset(&mpi_request, 0, sizeof(Mpi2SepRequest_t));
+- mpi_request.Function = MPI2_FUNCTION_SCSI_ENCLOSURE_PROCESSOR;
+- mpi_request.Action = MPI2_SEP_REQ_ACTION_WRITE_STATUS;
+- mpi_request.SlotStatus =
+- cpu_to_le32(MPI2_SEP_REQ_SLOTSTATUS_PREDICTED_FAULT);
+- mpi_request.DevHandle = cpu_to_le16(handle);
+- mpi_request.Flags = MPI2_SEP_REQ_FLAGS_DEVHANDLE_ADDRESS;
+- if ((mpt2sas_base_scsi_enclosure_processor(ioc, &mpi_reply,
+- &mpi_request)) != 0) {
+- printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
+- ioc->name, __FILE__, __LINE__, __func__);
+- return;
+- }
+-
+- if (mpi_reply.IOCStatus || mpi_reply.IOCLogInfo) {
+- dewtprintk(ioc, printk(MPT2SAS_INFO_FMT
+- "enclosure_processor: ioc_status (0x%04x), "
+- "loginfo(0x%08x)\n", ioc->name,
+- le16_to_cpu(mpi_reply.IOCStatus),
+- le32_to_cpu(mpi_reply.IOCLogInfo)));
+- return;
+- }
+- }
++ if (ioc->pdev->subsystem_vendor == PCI_VENDOR_ID_IBM)
++ _scsih_send_event_to_turn_on_fault_led(ioc, handle);
+
+ /* insert into event log */
+ sz = offsetof(Mpi2EventNotificationReply_t, EventData) +
+@@ -6330,6 +6369,9 @@ _firmware_event_work(struct work_struct
+ }
+
+ switch (fw_event->event) {
++ case MPT2SAS_TURN_ON_FAULT_LED:
++ _scsih_turn_on_fault_led(ioc, fw_event->device_handle);
++ break;
+ case MPI2_EVENT_SAS_TOPOLOGY_CHANGE_LIST:
+ _scsih_sas_topology_change_event(ioc, fw_event);
+ break;
--- /dev/null
+From 3d2606f42984613d324ad3047cf503bcddc3880a Mon Sep 17 00:00:00 2001
+From: Robert Richter <robert.richter@amd.com>
+Date: Fri, 20 May 2011 09:46:54 +0200
+Subject: oprofile, x86: Enable preemption during pci device setup in
+ IBS init
+
+From: Robert Richter <robert.richter@amd.com>
+
+commit 3d2606f42984613d324ad3047cf503bcddc3880a upstream.
+
+IBS initialization is a mix of per-core register access and per-node
+pci device setup. Register access should be pinned to the cpu, but pci
+setup must run with preemption enabled.
+
+This patch better separates the code into non-/preemptible sections
+and fixes sleeping with preemption disabled. See bug message below.
+
+Fixes also freeing the eilvt entry by introducing put_eilvt().
+
+BUG: sleeping function called from invalid context at mm/slub.c:824
+in_atomic(): 1, irqs_disabled(): 0, pid: 32357, name: modprobe
+INFO: lockdep is turned off.
+Pid: 32357, comm: modprobe Not tainted 2.6.39-rc7+ #14
+Call Trace:
+ [<ffffffff8104bdc8>] __might_sleep+0x112/0x117
+ [<ffffffff81129693>] kmem_cache_alloc_trace+0x4b/0xe7
+ [<ffffffff81278f14>] kzalloc.constprop.0+0x29/0x2b
+ [<ffffffff81278f4c>] pci_get_subsys+0x36/0x78
+ [<ffffffff81022689>] ? setup_APIC_eilvt+0xfb/0x139
+ [<ffffffff81278fa4>] pci_get_device+0x16/0x18
+ [<ffffffffa06c8b5d>] op_amd_init+0xd3/0x211 [oprofile]
+ [<ffffffffa064d000>] ? 0xffffffffa064cfff
+ [<ffffffffa064d298>] op_nmi_init+0x21e/0x26a [oprofile]
+ [<ffffffffa064d062>] oprofile_arch_init+0xe/0x26 [oprofile]
+ [<ffffffffa064d010>] oprofile_init+0x10/0x42 [oprofile]
+ [<ffffffff81002099>] do_one_initcall+0x7f/0x13a
+ [<ffffffff81096524>] sys_init_module+0x132/0x281
+ [<ffffffff814cc682>] system_call_fastpath+0x16/0x1b
+
+Reported-by: Dave Jones <davej@redhat.com>
+Signed-off-by: Robert Richter <robert.richter@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/oprofile/op_model_amd.c | 95 ++++++++++++++++++++++-----------------
+ 1 file changed, 54 insertions(+), 41 deletions(-)
+
+--- a/arch/x86/oprofile/op_model_amd.c
++++ b/arch/x86/oprofile/op_model_amd.c
+@@ -316,16 +316,23 @@ static void op_amd_stop_ibs(void)
+ wrmsrl(MSR_AMD64_IBSOPCTL, 0);
+ }
+
+-static inline int eilvt_is_available(int offset)
++static inline int get_eilvt(int offset)
+ {
+- /* check if we may assign a vector */
+ return !setup_APIC_eilvt(offset, 0, APIC_EILVT_MSG_NMI, 1);
+ }
+
++static inline int put_eilvt(int offset)
++{
++ return !setup_APIC_eilvt(offset, 0, 0, 1);
++}
++
+ static inline int ibs_eilvt_valid(void)
+ {
+ int offset;
+ u64 val;
++ int valid = 0;
++
++ preempt_disable();
+
+ rdmsrl(MSR_AMD64_IBSCTL, val);
+ offset = val & IBSCTL_LVT_OFFSET_MASK;
+@@ -333,16 +340,20 @@ static inline int ibs_eilvt_valid(void)
+ if (!(val & IBSCTL_LVT_OFFSET_VALID)) {
+ pr_err(FW_BUG "cpu %d, invalid IBS interrupt offset %d (MSR%08X=0x%016llx)\n",
+ smp_processor_id(), offset, MSR_AMD64_IBSCTL, val);
+- return 0;
++ goto out;
+ }
+
+- if (!eilvt_is_available(offset)) {
++ if (!get_eilvt(offset)) {
+ pr_err(FW_BUG "cpu %d, IBS interrupt offset %d not available (MSR%08X=0x%016llx)\n",
+ smp_processor_id(), offset, MSR_AMD64_IBSCTL, val);
+- return 0;
++ goto out;
+ }
+
+- return 1;
++ valid = 1;
++out:
++ preempt_enable();
++
++ return valid;
+ }
+
+ static inline int get_ibs_offset(void)
+@@ -600,67 +611,69 @@ static int setup_ibs_ctl(int ibs_eilvt_o
+
+ static int force_ibs_eilvt_setup(void)
+ {
+- int i;
++ int offset;
+ int ret;
+
+- /* find the next free available EILVT entry */
+- for (i = 1; i < 4; i++) {
+- if (!eilvt_is_available(i))
+- continue;
+- ret = setup_ibs_ctl(i);
+- if (ret)
+- return ret;
+- pr_err(FW_BUG "using offset %d for IBS interrupts\n", i);
+- return 0;
++ /*
++ * find the next free available EILVT entry, skip offset 0,
++ * pin search to this cpu
++ */
++ preempt_disable();
++ for (offset = 1; offset < APIC_EILVT_NR_MAX; offset++) {
++ if (get_eilvt(offset))
++ break;
+ }
++ preempt_enable();
+
+- printk(KERN_DEBUG "No EILVT entry available\n");
+-
+- return -EBUSY;
+-}
+-
+-static int __init_ibs_nmi(void)
+-{
+- int ret;
+-
+- if (ibs_eilvt_valid())
+- return 0;
++ if (offset == APIC_EILVT_NR_MAX) {
++ printk(KERN_DEBUG "No EILVT entry available\n");
++ return -EBUSY;
++ }
+
+- ret = force_ibs_eilvt_setup();
++ ret = setup_ibs_ctl(offset);
+ if (ret)
+- return ret;
++ goto out;
+
+- if (!ibs_eilvt_valid())
+- return -EFAULT;
++ if (!ibs_eilvt_valid()) {
++ ret = -EFAULT;
++ goto out;
++ }
+
++ pr_err(FW_BUG "using offset %d for IBS interrupts\n", offset);
+ pr_err(FW_BUG "workaround enabled for IBS LVT offset\n");
+
+ return 0;
++out:
++ preempt_disable();
++ put_eilvt(offset);
++ preempt_enable();
++ return ret;
+ }
+
+ /*
+ * check and reserve APIC extended interrupt LVT offset for IBS if
+ * available
+- *
+- * init_ibs() preforms implicitly cpu-local operations, so pin this
+- * thread to its current CPU
+ */
+
+ static void init_ibs(void)
+ {
+- preempt_disable();
+-
+ ibs_caps = get_ibs_caps();
++
+ if (!ibs_caps)
++ return;
++
++ if (ibs_eilvt_valid())
+ goto out;
+
+- if (__init_ibs_nmi() < 0)
+- ibs_caps = 0;
+- else
+- printk(KERN_INFO "oprofile: AMD IBS detected (0x%08x)\n", ibs_caps);
++ if (!force_ibs_eilvt_setup())
++ goto out;
++
++ /* Failed to setup ibs */
++ ibs_caps = 0;
++ return;
+
+ out:
+- preempt_enable();
++ printk(KERN_INFO "oprofile: AMD IBS detected (0x%08x)\n", ibs_caps);
+ }
+
+ static int (*create_arch_files)(struct super_block *sb, struct dentry *root);
--- /dev/null
+From ba9f207c9f82115aba4ce04b22e0081af0ae300f Mon Sep 17 00:00:00 2001
+From: Frederic Weisbecker <fweisbec@gmail.com>
+Date: Fri, 20 May 2011 02:09:54 +0200
+Subject: rcu: Fix unpaired rcu_irq_enter() from locking selftests
+
+From: Frederic Weisbecker <fweisbec@gmail.com>
+
+commit ba9f207c9f82115aba4ce04b22e0081af0ae300f upstream.
+
+HARDIRQ_ENTER() maps to irq_enter() which calls rcu_irq_enter().
+But HARDIRQ_EXIT() maps to __irq_exit() which doesn't call
+rcu_irq_exit().
+
+So for every locking selftest that simulates hardirq disabled,
+we create an imbalance in the rcu extended quiescent state
+internal state.
+
+As a result, after the first missing rcu_irq_exit(), subsequent
+irqs won't exit dyntick-idle mode after leaving the interrupt
+handler. This means that RCU won't see the affected CPU as being
+in an extended quiescent state, resulting in long grace-period
+delays (as in grace periods extending for hours).
+
+To fix this, just use __irq_enter() to simulate the hardirq
+context. This is sufficient for the locking selftests as we
+don't need to exit any extended quiescent state or perform
+any check that irqs normally do when they wake up from idle.
+
+As a side effect, this patch makes it possible to restore
+"rcu: Decrease memory-barrier usage based on semi-formal proof",
+which eventually helped finding this bug.
+
+Reported-and-tested-by: Yinghai Lu <yinghai@kernel.org>
+Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
+Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ lib/locking-selftest.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/lib/locking-selftest.c
++++ b/lib/locking-selftest.c
+@@ -144,7 +144,7 @@ static void init_shared_classes(void)
+
+ #define HARDIRQ_ENTER() \
+ local_irq_disable(); \
+- irq_enter(); \
++ __irq_enter(); \
+ WARN_ON(!in_irq());
+
+ #define HARDIRQ_EXIT() \
--- /dev/null
+From 5db1256a5131d3b133946fa02ac9770a784e6eb2 Mon Sep 17 00:00:00 2001
+From: Milton Miller <miltonm@bga.com>
+Date: Thu, 12 May 2011 04:13:54 -0500
+Subject: seqlock: Don't smp_rmb in seqlock reader spin loop
+
+From: Milton Miller <miltonm@bga.com>
+
+commit 5db1256a5131d3b133946fa02ac9770a784e6eb2 upstream.
+
+Move the smp_rmb after cpu_relax loop in read_seqlock and add
+ACCESS_ONCE to make sure the test and return are consistent.
+
+A multi-threaded core in the lab didn't like the update
+from 2.6.35 to 2.6.36, to the point it would hang during
+boot when multiple threads were active. Bisection showed
+af5ab277ded04bd9bc6b048c5a2f0e7d70ef0867 (clockevents:
+Remove the per cpu tick skew) as the culprit and it is
+supported with stack traces showing xtime_lock waits including
+tick_do_update_jiffies64 and/or update_vsyscall.
+
+Experimentation showed the combination of cpu_relax and smp_rmb
+was significantly slowing the progress of other threads sharing
+the core, and this patch is effective in avoiding the hang.
+
+A theory is the rmb is affecting the whole core while the
+cpu_relax is causing a resource rebalance flush, together they
+cause an interfernce cadance that is unbroken when the seqlock
+reader has interrupts disabled.
+
+At first I was confused why the refactor in
+3c22cd5709e8143444a6d08682a87f4c57902df3 (kernel: optimise
+seqlock) didn't affect this patch application, but after some
+study that affected seqcount not seqlock. The new seqcount was
+not factored back into the seqlock. I defer that the future.
+
+While the removal of the timer interrupt offset created
+contention for the xtime lock while a cpu does the
+additonal work to update the system clock, the seqlock
+implementation with the tight rmb spin loop goes back much
+further, and is just waiting for the right trigger.
+
+Signed-off-by: Milton Miller <miltonm@bga.com>
+Cc: <linuxppc-dev@lists.ozlabs.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Andi Kleen <andi@firstfloor.org>
+Cc: Nick Piggin <npiggin@kernel.dk>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Anton Blanchard <anton@samba.org>
+Cc: Paul McKenney <paulmck@linux.vnet.ibm.com>
+Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
+Link: http://lkml.kernel.org/r/%3Cseqlock-rmb%40mdm.bga.com%3E
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/seqlock.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/linux/seqlock.h
++++ b/include/linux/seqlock.h
+@@ -88,12 +88,12 @@ static __always_inline unsigned read_seq
+ unsigned ret;
+
+ repeat:
+- ret = sl->sequence;
+- smp_rmb();
++ ret = ACCESS_ONCE(sl->sequence);
+ if (unlikely(ret & 1)) {
+ cpu_relax();
+ goto repeat;
+ }
++ smp_rmb();
+
+ return ret;
+ }
sch_sfq-avoid-giving-spurious-net_xmit_cn-signals.patch
net-fix-__dst_destroy_metrics_generic.patch
dst-catch-uninitialized-metrics.patch
+mpt2sas-move-even-handling-of.patch
+bnx2i-fixed-packet-error-created-when-the-sq_size-is.patch
+bnx2i-updated-the-connection-shutdown-cleanup.patch
+fix-ultrastor-asm-snippet.patch
+target-fix-multi-task-task_sg-chaining-logic-bug.patch
+target-fix-interrupt-context-bug-with-stats_lock-and.patch
+target-fix-bug-with-task_sg-chained.patch
+target-fix-task-task_execute_queue-1-clear-bug.patch
+um-use-rwsem_generic_spinlock-on-x86.patch
+x86-ioapic-fix-potential-resume-deadlock.patch
+x86-amd-do-not-enable-arat-feature-on-amd-processors-below.patch
+x86-amd-use-_safe-msr-access-for-garttlbwlk-disable-code.patch
+x86-efi-retain-boot-service-code-until-after-switching-to.patch
+x86-cpufeature-update-cpu-feature-rdrnd-to-rdrand.patch
+oprofile-x86-enable-preemption-during-pci-device-setup-in.patch
+rcu-fix-unpaired-rcu_irq_enter-from-locking-selftests.patch
+when-mandatory-encryption-on-share-fail-mount.patch
+staging-usbip-fix-wrong-endian-conversion.patch
+staging-r8712u-fix-driver-to-support-ad-hoc-mode.patch
+staging-brcm80211-bugfix-for-div-by-zero-in.patch
+fix-for-buffer-overflow-in-ldm_frag_add-not-sufficient.patch
+seqlock-don-t-smp_rmb-in-seqlock-reader-spin-loop.patch
+md-fix-race-when-creating-a-new-md-device.patch
+md-bitmap-fix-saving-of-events_cleared-and-other-state.patch
+mm-vmscan-correct-use-of-pgdat_balanced-in.patch
+mm-vmscan-correctly-check-if-reclaimer-should-schedule.patch
+slub-make-config_debug_page_alloc-work-with-new-fastpath.patch
+alsa-hda-use-one-dmic-only-for-dell-studio-1558.patch
+alsa-hda-add-quirk-for-lenovo-u350.patch
+alsa-hda-fix-input-src-parse-in-patch_analog.c.patch
+alsa-hda-use-lpib-for-ati-amd-chipsets-as-default.patch
+asoc-ensure-output-pga-is-enabled-for-line-outputs-in.patch
+asoc-add-some-missing-volume-update-bit-sets-for-wm_hubs.patch
+asoc-fix-raumfeld-platform.patch
+hid-magicmouse-ignore-ivalid-report-id-while-switching.patch
+mm-page_alloc.c-prevent-unending-loop-in.patch
+loop-limit-max_part-module-param-to-disk_max_parts.patch
+loop-handle-on-demand-devices-correctly.patch
+i2c-tegra-enable-new-slave-mode.patch
+i2c-writing-clients-fix-foo_driver.id_table.patch
--- /dev/null
+From 1393d9a1857471f816d0be1ccc1d6433a86050f6 Mon Sep 17 00:00:00 2001
+From: Christoph Lameter <cl@linux.com>
+Date: Mon, 16 May 2011 15:26:08 -0500
+Subject: slub: Make CONFIG_DEBUG_PAGE_ALLOC work with new fastpath
+
+From: Christoph Lameter <cl@linux.com>
+
+commit 1393d9a1857471f816d0be1ccc1d6433a86050f6 upstream.
+
+Fastpath can do a speculative access to a page that CONFIG_DEBUG_PAGE_ALLOC may have
+marked as invalid to retrieve the pointer to the next free object.
+
+Use probe_kernel_read in that case in order not to cause a page fault.
+
+Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: Christoph Lameter <cl@linux.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: Pekka Enberg <penberg@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/slub.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -261,6 +261,18 @@ static inline void *get_freepointer(stru
+ return *(void **)(object + s->offset);
+ }
+
++static inline void *get_freepointer_safe(struct kmem_cache *s, void *object)
++{
++ void *p;
++
++#ifdef CONFIG_DEBUG_PAGEALLOC
++ probe_kernel_read(&p, (void **)(object + s->offset), sizeof(p));
++#else
++ p = get_freepointer(s, object);
++#endif
++ return p;
++}
++
+ static inline void set_freepointer(struct kmem_cache *s, void *object, void *fp)
+ {
+ *(void **)(object + s->offset) = fp;
+@@ -1943,7 +1955,7 @@ redo:
+ if (unlikely(!irqsafe_cpu_cmpxchg_double(
+ s->cpu_slab->freelist, s->cpu_slab->tid,
+ object, tid,
+- get_freepointer(s, object), next_tid(tid)))) {
++ get_freepointer_safe(s, object), next_tid(tid)))) {
+
+ note_cmpxchg_failure("slab_alloc", s, tid);
+ goto redo;
--- /dev/null
+From e9c661e08c2a6015c1b7cba1cecefa27a089df71 Mon Sep 17 00:00:00 2001
+From: Roland Vossen <rvossen@broadcom.com>
+Date: Tue, 12 Apr 2011 14:34:41 +0200
+Subject: staging: brcm80211: bugfix for div by zero in
+ minstrel_ht_tx_status
+
+From: Roland Vossen <rvossen@broadcom.com>
+
+commit e9c661e08c2a6015c1b7cba1cecefa27a089df71 upstream.
+
+Caused by brcmsmac.ko suppling a 0 value to Mac80211. Mac80211 subsequently
+divides by this number. Bug only occurred on AMPDU traffic. This is a fix
+for https://bugzilla.kernel.org/show_bug.cgi?id=32032, titled
+'Divide error in minstrel_ht_tx_status followed by hang', reported by
+Wouter Cloetens.
+
+Signed-off-by: Roland Vossen <rvossen@broadcom.com>
+Reviewed-by: Arend van Spriel <arend@broadcom.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/brcm80211/brcmsmac/wlc_ampdu.c | 13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+--- a/drivers/staging/brcm80211/brcmsmac/wlc_ampdu.c
++++ b/drivers/staging/brcm80211/brcmsmac/wlc_ampdu.c
+@@ -1123,21 +1123,12 @@ wlc_ampdu_dotxstatus_complete(struct amp
+ ini->txretry[index] = 0;
+
+ /* ampdu_ack_len: number of acked aggregated frames */
+- /* ampdu_ack_map: block ack bit map for the aggregation */
+ /* ampdu_len: number of aggregated frames */
+ rate_status(wlc, tx_info, txs, mcs);
+ tx_info->flags |= IEEE80211_TX_STAT_ACK;
+ tx_info->flags |= IEEE80211_TX_STAT_AMPDU;
+-
+- /* XXX TODO: Make these accurate. */
+ tx_info->status.ampdu_ack_len =
+- (txs->
+- status & TX_STATUS_FRM_RTX_MASK) >>
+- TX_STATUS_FRM_RTX_SHIFT;
+- tx_info->status.ampdu_len =
+- (txs->
+- status & TX_STATUS_FRM_RTX_MASK) >>
+- TX_STATUS_FRM_RTX_SHIFT;
++ tx_info->status.ampdu_len = 1;
+
+ skb_pull(p, D11_PHY_HDR_LEN);
+ skb_pull(p, D11_TXH_LEN);
+@@ -1163,6 +1154,8 @@ wlc_ampdu_dotxstatus_complete(struct amp
+ /* Retry timeout */
+ ini->tx_in_transit--;
+ ieee80211_tx_info_clear_status(tx_info);
++ tx_info->status.ampdu_ack_len = 0;
++ tx_info->status.ampdu_len = 1;
+ tx_info->flags |=
+ IEEE80211_TX_STAT_AMPDU_NO_BACK;
+ skb_pull(p, D11_PHY_HDR_LEN);
--- /dev/null
+From 62819fd9481021db7f87d5f61f2e2fd2be1dfcfa Mon Sep 17 00:00:00 2001
+From: Jeff Chua <jeff.chua.linux@gmail.com>
+Date: Wed, 27 Apr 2011 11:25:14 -0500
+Subject: staging: r8712u: Fix driver to support ad-hoc mode
+
+From: Jeff Chua <jeff.chua.linux@gmail.com>
+
+commit 62819fd9481021db7f87d5f61f2e2fd2be1dfcfa upstream.
+
+Driver r8712u is unable to handle ad-hoc mode. The issue is that when
+the driver first starts, there will not be an SSID for association.
+The fix is to always call the "select and join from scan" routine when
+in ad-hoc mode.
+
+Note: Ad-hoc mode worked intermittently before. If the driver had
+previously been associated, then things were OK.
+
+Signed-off-by: Jeff Chua <jeff.chua.linux@gmail.com>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/rtl8712/rtl871x_ioctl_set.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/rtl8712/rtl871x_ioctl_set.c
++++ b/drivers/staging/rtl8712/rtl871x_ioctl_set.c
+@@ -68,7 +68,10 @@ static u8 do_join(struct _adapter *padap
+ pmlmepriv->fw_state |= _FW_UNDER_LINKING;
+ pmlmepriv->pscanned = plist;
+ pmlmepriv->to_join = true;
+- if (_queue_empty(queue) == true) {
++
++ /* adhoc mode will start with an empty queue, but skip checking */
++ if (!check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) &&
++ _queue_empty(queue)) {
+ if (pmlmepriv->fw_state & _FW_UNDER_LINKING)
+ pmlmepriv->fw_state ^= _FW_UNDER_LINKING;
+ /* when set_ssid/set_bssid for do_join(), but scanning queue
--- /dev/null
+From cacd18a8476ce145ca5dcd46dc5b75585fd1289c Mon Sep 17 00:00:00 2001
+From: David Chang <dchang@novell.com>
+Date: Thu, 12 May 2011 18:31:11 +0800
+Subject: staging: usbip: fix wrong endian conversion
+
+From: David Chang <dchang@novell.com>
+
+commit cacd18a8476ce145ca5dcd46dc5b75585fd1289c upstream.
+
+Fix number_of_packets wrong endian conversion in function
+correct_endian_ret_submit()
+
+Signed-off-by: David Chang <dchang@novell.com>
+Acked-by: Arjan Mels <arjan.mels@gmx.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/usbip/usbip_common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/usbip/usbip_common.c
++++ b/drivers/staging/usbip/usbip_common.c
+@@ -604,7 +604,7 @@ static void correct_endian_ret_submit(st
+ be32_to_cpus(&pdu->status);
+ be32_to_cpus(&pdu->actual_length);
+ be32_to_cpus(&pdu->start_frame);
+- cpu_to_be32s(&pdu->number_of_packets);
++ be32_to_cpus(&pdu->number_of_packets);
+ be32_to_cpus(&pdu->error_count);
+ }
+ }
--- /dev/null
+From f436677262a5b524ac87675014c6d4e8ee153029 Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Thu, 19 May 2011 20:19:11 -0700
+Subject: [SCSI] target: Fix bug with task_sg chained
+ transport_free_dev_tasks release
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit f436677262a5b524ac87675014c6d4e8ee153029 upstream.
+
+This patch addresses a bug in the target core release path for HW
+operation where transport_free_dev_tasks() was incorrectly being called
+from transport_lun_remove_cmd() while releasing a se_cmd reference and
+calling struct target_core_fabric_ops->queue_data_in().
+
+This would result in a OOPs with HW target mode when the release of
+se_task->task_sg[] would happen before pci_unmap_sg() can be called in
+HW target mode fabric module code. This patch addresses the issue by
+moving transport_free_dev_tasks() from transport_lun_remove_cmd() into
+transport_generic_free_cmd(), and adding TRANSPORT_FREE_CMD_INTR and
+transport_generic_free_cmd_intr() to allow se_cmd descriptor release
+to happen fromfrom within transport_processing_thread() process context
+when release of se_cmd is not possible from HW interrupt context.
+
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: James Bottomley <jbottomley@parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/target/target_core_transport.c | 13 ++++++++++++-
+ include/target/target_core_base.h | 1 +
+ include/target/target_core_transport.h | 1 +
+ 3 files changed, 14 insertions(+), 1 deletion(-)
+
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -762,7 +762,6 @@ static void transport_lun_remove_cmd(str
+ transport_all_task_dev_remove_state(cmd);
+ spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
+
+- transport_free_dev_tasks(cmd);
+
+ check_lun:
+ spin_lock_irqsave(&lun->lun_cmd_lock, flags);
+@@ -2058,6 +2057,13 @@ int transport_generic_handle_tmr(
+ }
+ EXPORT_SYMBOL(transport_generic_handle_tmr);
+
++void transport_generic_free_cmd_intr(
++ struct se_cmd *cmd)
++{
++ transport_add_cmd_to_queue(cmd, TRANSPORT_FREE_CMD_INTR);
++}
++EXPORT_SYMBOL(transport_generic_free_cmd_intr);
++
+ static int transport_stop_tasks_for_cmd(struct se_cmd *cmd)
+ {
+ struct se_task *task, *task_tmp;
+@@ -5301,6 +5307,8 @@ void transport_generic_free_cmd(
+ if (wait_for_tasks && cmd->transport_wait_for_tasks)
+ cmd->transport_wait_for_tasks(cmd, 0, 0);
+
++ transport_free_dev_tasks(cmd);
++
+ transport_generic_remove(cmd, release_to_pool,
+ session_reinstatement);
+ }
+@@ -6136,6 +6144,9 @@ get_cmd:
+ case TRANSPORT_REMOVE:
+ transport_generic_remove(cmd, 1, 0);
+ break;
++ case TRANSPORT_FREE_CMD_INTR:
++ transport_generic_free_cmd(cmd, 0, 1, 0);
++ break;
+ case TRANSPORT_PROCESS_TMR:
+ transport_generic_do_tmr(cmd);
+ break;
+--- a/include/target/target_core_base.h
++++ b/include/target/target_core_base.h
+@@ -98,6 +98,7 @@ enum transport_state_table {
+ TRANSPORT_REMOVE = 14,
+ TRANSPORT_FREE = 15,
+ TRANSPORT_NEW_CMD_MAP = 16,
++ TRANSPORT_FREE_CMD_INTR = 17,
+ };
+
+ /* Used for struct se_cmd->se_cmd_flags */
+--- a/include/target/target_core_transport.h
++++ b/include/target/target_core_transport.h
+@@ -172,6 +172,7 @@ extern int transport_generic_handle_cdb_
+ extern int transport_generic_handle_data(struct se_cmd *);
+ extern void transport_new_cmd_failure(struct se_cmd *);
+ extern int transport_generic_handle_tmr(struct se_cmd *);
++extern void transport_generic_free_cmd_intr(struct se_cmd *);
+ extern void __transport_stop_task_timer(struct se_task *, unsigned long *);
+ extern unsigned char transport_asciihex_to_binaryhex(unsigned char val[2]);
+ extern int transport_generic_map_mem_to_cmd(struct se_cmd *cmd, struct scatterlist *, u32,
--- /dev/null
+From 53ab6709b4d35b1924240854d794482fd7d33d4a Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Thu, 19 May 2011 20:19:10 -0700
+Subject: [SCSI] target: Fix interrupt context bug with stats_lock and
+ core_tmr_alloc_req
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit 53ab6709b4d35b1924240854d794482fd7d33d4a upstream.
+
+This patch fixes two bugs wrt to the interrupt context usage of target
+core with HW target mode drivers. It first converts the usage of struct
+se_device->stats_lock in transport_get_lun_for_cmd() and core_tmr_lun_reset()
+to properly use spin_lock_irq() to address an BUG with CONFIG_LOCKDEP_SUPPORT=y
+enabled.
+
+This patch also adds a 'in_interrupt()' check to allow GFP_ATOMIC usage from
+core_tmr_alloc_req() to fix a 'sleeping in interrupt context' BUG with HW
+target fabrics that require this logic to function.
+
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: James Bottomley <jbottomley@parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/target/target_core_device.c | 4 ++--
+ drivers/target/target_core_tmr.c | 7 ++++---
+ 2 files changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/target/target_core_device.c
++++ b/drivers/target/target_core_device.c
+@@ -150,13 +150,13 @@ out:
+
+ {
+ struct se_device *dev = se_lun->lun_se_dev;
+- spin_lock(&dev->stats_lock);
++ spin_lock_irq(&dev->stats_lock);
+ dev->num_cmds++;
+ if (se_cmd->data_direction == DMA_TO_DEVICE)
+ dev->write_bytes += se_cmd->data_length;
+ else if (se_cmd->data_direction == DMA_FROM_DEVICE)
+ dev->read_bytes += se_cmd->data_length;
+- spin_unlock(&dev->stats_lock);
++ spin_unlock_irq(&dev->stats_lock);
+ }
+
+ /*
+--- a/drivers/target/target_core_tmr.c
++++ b/drivers/target/target_core_tmr.c
+@@ -55,7 +55,8 @@ struct se_tmr_req *core_tmr_alloc_req(
+ {
+ struct se_tmr_req *tmr;
+
+- tmr = kmem_cache_zalloc(se_tmr_req_cache, GFP_KERNEL);
++ tmr = kmem_cache_zalloc(se_tmr_req_cache, (in_interrupt()) ?
++ GFP_ATOMIC : GFP_KERNEL);
+ if (!(tmr)) {
+ printk(KERN_ERR "Unable to allocate struct se_tmr_req\n");
+ return ERR_PTR(-ENOMEM);
+@@ -398,9 +399,9 @@ int core_tmr_lun_reset(
+ printk(KERN_INFO "LUN_RESET: SCSI-2 Released reservation\n");
+ }
+
+- spin_lock(&dev->stats_lock);
++ spin_lock_irq(&dev->stats_lock);
+ dev->num_resets++;
+- spin_unlock(&dev->stats_lock);
++ spin_unlock_irq(&dev->stats_lock);
+
+ DEBUG_LR("LUN_RESET: %s for [%s] Complete\n",
+ (preempt_and_abort_list) ? "Preempt" : "TMR",
--- /dev/null
+From 97868c8905a1537153d406c4a3aa39a503a5c299 Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Thu, 19 May 2011 20:19:09 -0700
+Subject: [SCSI] target: Fix multi task->task_sg[] chaining logic bug
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit 97868c8905a1537153d406c4a3aa39a503a5c299 upstream.
+
+This patch fixes a bug in transport_do_task_sg_chain() used by HW target
+mode modules with sg_chain() to provide a single sg_next() walkable memory
+layout for use with pci_map_sg() and friends. This patch addresses an
+issue with mapping multiple small block max_sector tasks across multiple
+struct se_task->task_sg[] mappings for HW target mode operation.
+
+This was causing OOPs with (cmd->t_task->t_tasks_no > 1) I/O traffic for
+HW target drivers using transport_do_task_sg_chain(), and has been tested
+so far with tcm_fc(openfcoe), tcm_qla2xxx, and ib_srpt fabrics with
+t_tasks_no > 1 IBLOCK backends using a smaller max_sectors to trigger the
+original issue.
+
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Acked-by: Kiran Patil <kiran.patil@intel.com>
+Signed-off-by: James Bottomley <jbottomley@parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/target/target_core_transport.c | 26 +++++++++++++++-----------
+ 1 file changed, 15 insertions(+), 11 deletions(-)
+
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -4776,18 +4776,20 @@ void transport_do_task_sg_chain(struct s
+ sg_end_cur->page_link &= ~0x02;
+
+ sg_chain(sg_head, task_sg_num, sg_head_cur);
+- sg_count += (task->task_sg_num + 1);
+- } else
+ sg_count += task->task_sg_num;
++ task_sg_num = (task->task_sg_num + 1);
++ } else {
++ sg_chain(sg_head, task_sg_num, sg_head_cur);
++ sg_count += task->task_sg_num;
++ task_sg_num = task->task_sg_num;
++ }
+
+ sg_head = sg_head_cur;
+ sg_link = sg_link_cur;
+- task_sg_num = task->task_sg_num;
+ continue;
+ }
+ sg_head = sg_first = &task->task_sg[0];
+ sg_link = &task->task_sg[task->task_sg_num];
+- task_sg_num = task->task_sg_num;
+ /*
+ * Check for single task..
+ */
+@@ -4798,9 +4800,12 @@ void transport_do_task_sg_chain(struct s
+ */
+ sg_end = &task->task_sg[task->task_sg_num - 1];
+ sg_end->page_link &= ~0x02;
+- sg_count += (task->task_sg_num + 1);
+- } else
+ sg_count += task->task_sg_num;
++ task_sg_num = (task->task_sg_num + 1);
++ } else {
++ sg_count += task->task_sg_num;
++ task_sg_num = task->task_sg_num;
++ }
+ }
+ /*
+ * Setup the starting pointer and total t_tasks_sg_linked_no including
+@@ -4809,21 +4814,20 @@ void transport_do_task_sg_chain(struct s
+ T_TASK(cmd)->t_tasks_sg_chained = sg_first;
+ T_TASK(cmd)->t_tasks_sg_chained_no = sg_count;
+
+- DEBUG_CMD_M("Setup T_TASK(cmd)->t_tasks_sg_chained: %p and"
+- " t_tasks_sg_chained_no: %u\n", T_TASK(cmd)->t_tasks_sg_chained,
++ DEBUG_CMD_M("Setup cmd: %p T_TASK(cmd)->t_tasks_sg_chained: %p and"
++ " t_tasks_sg_chained_no: %u\n", cmd, T_TASK(cmd)->t_tasks_sg_chained,
+ T_TASK(cmd)->t_tasks_sg_chained_no);
+
+ for_each_sg(T_TASK(cmd)->t_tasks_sg_chained, sg,
+ T_TASK(cmd)->t_tasks_sg_chained_no, i) {
+
+- DEBUG_CMD_M("SG: %p page: %p length: %d offset: %d\n",
+- sg, sg_page(sg), sg->length, sg->offset);
++ DEBUG_CMD_M("SG[%d]: %p page: %p length: %d offset: %d, magic: 0x%08x\n",
++ i, sg, sg_page(sg), sg->length, sg->offset, sg->sg_magic);
+ if (sg_is_chain(sg))
+ DEBUG_CMD_M("SG: %p sg_is_chain=1\n", sg);
+ if (sg_is_last(sg))
+ DEBUG_CMD_M("SG: %p sg_is_last=1\n", sg);
+ }
+-
+ }
+ EXPORT_SYMBOL(transport_do_task_sg_chain);
+
--- /dev/null
+From af57c3ac9947990da2608561b71f4799eb7795c6 Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Thu, 19 May 2011 20:19:12 -0700
+Subject: [SCSI] target: Fix task->task_execute_queue=1 clear bug +
+ LUN_RESET OOPs
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit af57c3ac9947990da2608561b71f4799eb7795c6 upstream.
+
+This patch fixes a bug where task->task_execute_queue=1 was not being
+cleared once se_task had been removed from se_device->execute_task_list,
+resulting in an OOPs in core_tmr_lun_reset() for the task->task_active=0
+case where transport_remove_task_from_execute_queue() was incorrectly
+being called.
+
+This patch fixes two cases in transport_get_task_from_execute_queue()
+and transport_remove_task_from_execute_queue() to properly clear
+task->task_execute_queue=0 once list_del(&task->t_execute_list) has
+been called.
+
+It also adds an explict check in transport_remove_task_from_execute_queue()
+to dump_stack + return if called with task->task_execute_queue=0.
+
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: James Bottomley <jbottomley@parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/target/target_core_transport.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -1194,6 +1194,7 @@ transport_get_task_from_execute_queue(st
+ break;
+
+ list_del(&task->t_execute_list);
++ atomic_set(&task->task_execute_queue, 0);
+ atomic_dec(&dev->execute_tasks);
+
+ return task;
+@@ -1209,8 +1210,14 @@ void transport_remove_task_from_execute_
+ {
+ unsigned long flags;
+
++ if (atomic_read(&task->task_execute_queue) == 0) {
++ dump_stack();
++ return;
++ }
++
+ spin_lock_irqsave(&dev->execute_task_lock, flags);
+ list_del(&task->t_execute_list);
++ atomic_set(&task->task_execute_queue, 0);
+ atomic_dec(&dev->execute_tasks);
+ spin_unlock_irqrestore(&dev->execute_task_lock, flags);
+ }
--- /dev/null
+From 3a3679078aed2c451ebc32836bbd3b8219a65e01 Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Mon, 23 May 2011 22:51:33 +0200
+Subject: um: Use RWSEM_GENERIC_SPINLOCK on x86
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Richard Weinberger <richard@nod.at>
+
+commit 3a3679078aed2c451ebc32836bbd3b8219a65e01 upstream.
+
+Commit d12337 (rwsem: Remove redundant asmregparm annotation)
+broke rwsem on UML.
+
+As we cannot compile UML with -mregparm=3 and keeping asmregparm only
+for UML is inadequate the easiest solution is using RWSEM_GENERIC_SPINLOCK.
+
+Thanks to Thomas Gleixner for the idea.
+
+Reported-by: Toralf Förster <toralf.foerster@gmx.de>
+Tested-by: Toralf Förster <toralf.foerster@gmx.de>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Cc: user-mode-linux-devel@lists.sourceforge.net
+Link: http://lkml.kernel.org/r/%3C1306183893-26655-1-git-send-email-richard%40nod.at%3E
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/um/Kconfig.x86 | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/um/Kconfig.x86
++++ b/arch/um/Kconfig.x86
+@@ -29,10 +29,10 @@ config X86_64
+ def_bool 64BIT
+
+ config RWSEM_XCHGADD_ALGORITHM
+- def_bool X86_XADD
++ def_bool X86_XADD && 64BIT
+
+ config RWSEM_GENERIC_SPINLOCK
+- def_bool !X86_XADD
++ def_bool !RWSEM_XCHGADD_ALGORITHM
+
+ config 3_LEVEL_PGTABLES
+ bool "Three-level pagetables (EXPERIMENTAL)" if !64BIT
--- /dev/null
+From 6848b7334b24b47aa3d0e70342ff839ffa95d5fa Mon Sep 17 00:00:00 2001
+From: Steve French <sfrench@us.ibm.com>
+Date: Thu, 26 May 2011 18:38:54 +0000
+Subject: [CIFS] When mandatory encryption on share, fail mount
+
+From: Steve French <sfrench@us.ibm.com>
+
+commit 6848b7334b24b47aa3d0e70342ff839ffa95d5fa upstream.
+
+ When mandatory encryption is configured in samba server on a
+ share (smb.conf parameter "smb encrypt = mandatory") the
+ server will hang up the tcp session when we try to send
+ the first frame after the tree connect if it is not a
+ QueryFSUnixInfo, this causes cifs mount to hang (it must
+ be killed with ctl-c). Move the QueryFSUnixInfo call
+ earlier in the mount sequence, and check whether the SetFSUnixInfo
+ fails due to mandatory encryption so we can return a sensible
+ error (EACCES) on mount.
+
+ In a future patch (for 2.6.40) we will support mandatory
+ encryption.
+
+Reviewed-by: Pavel Shilovsky <piastry@etersoft.ru>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/connect.c | 31 ++++++++++++++++++++++---------
+ 1 file changed, 22 insertions(+), 9 deletions(-)
+
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -2447,7 +2447,7 @@ void reset_cifs_unix_caps(int xid, struc
+
+ if (!CIFSSMBQFSUnixInfo(xid, tcon)) {
+ __u64 cap = le64_to_cpu(tcon->fsUnixInfo.Capability);
+-
++ cFYI(1, "unix caps which server supports %lld", cap);
+ /* check for reconnect case in which we do not
+ want to change the mount behavior if we can avoid it */
+ if (vol_info == NULL) {
+@@ -2465,6 +2465,9 @@ void reset_cifs_unix_caps(int xid, struc
+ }
+ }
+
++ if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)
++ cERROR(1, "per-share encryption not supported yet");
++
+ cap &= CIFS_UNIX_CAP_MASK;
+ if (vol_info && vol_info->no_psx_acl)
+ cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
+@@ -2513,6 +2516,10 @@ void reset_cifs_unix_caps(int xid, struc
+ cFYI(1, "very large read cap");
+ if (cap & CIFS_UNIX_LARGE_WRITE_CAP)
+ cFYI(1, "very large write cap");
++ if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_CAP)
++ cFYI(1, "transport encryption cap");
++ if (cap & CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)
++ cFYI(1, "mandatory transport encryption cap");
+ #endif /* CIFS_DEBUG2 */
+ if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
+ if (vol_info == NULL) {
+@@ -2831,20 +2838,26 @@ try_mount_again:
+ goto remote_path_check;
+ }
+
+- /* do not care if following two calls succeed - informational */
+- if (!tcon->ipc) {
+- CIFSSMBQFSDeviceInfo(xid, tcon);
+- CIFSSMBQFSAttributeInfo(xid, tcon);
+- }
+-
+ /* tell server which Unix caps we support */
+- if (tcon->ses->capabilities & CAP_UNIX)
++ if (tcon->ses->capabilities & CAP_UNIX) {
+ /* reset of caps checks mount to see if unix extensions
+ disabled for just this mount */
+ reset_cifs_unix_caps(xid, tcon, sb, volume_info);
+- else
++ if ((tcon->ses->server->tcpStatus == CifsNeedReconnect) &&
++ (le64_to_cpu(tcon->fsUnixInfo.Capability) &
++ CIFS_UNIX_TRANSPORT_ENCRYPTION_MANDATORY_CAP)) {
++ rc = -EACCES;
++ goto mount_fail_check;
++ }
++ } else
+ tcon->unix_ext = 0; /* server does not support them */
+
++ /* do not care if following two calls succeed - informational */
++ if (!tcon->ipc) {
++ CIFSSMBQFSDeviceInfo(xid, tcon);
++ CIFSSMBQFSAttributeInfo(xid, tcon);
++ }
++
+ /* convert forward to back slashes in prepath here if needed */
+ if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) == 0)
+ convert_delimiter(cifs_sb->prepath, CIFS_DIR_SEP(cifs_sb));
--- /dev/null
+From e9cdd343a5e42c43bcda01e609fa23089e026470 Mon Sep 17 00:00:00 2001
+From: Boris Ostrovsky <ostr@amd64.org>
+Date: Thu, 26 May 2011 11:19:52 -0400
+Subject: x86, amd: Do not enable ARAT feature on AMD processors below
+ family 0x12
+
+From: Boris Ostrovsky <ostr@amd64.org>
+
+commit e9cdd343a5e42c43bcda01e609fa23089e026470 upstream.
+
+Commit b87cf80af3ba4b4c008b4face3c68d604e1715c6 added support for
+ARAT (Always Running APIC timer) on AMD processors that are not
+affected by erratum 400. This erratum is present on certain processor
+families and prevents APIC timer from waking up the CPU when it
+is in a deep C state, including C1E state.
+
+Determining whether a processor is affected by this erratum may
+have some corner cases and handling these cases is somewhat
+complicated. In the interest of simplicity we won't claim ARAT
+support on processor families below 0x12 and will go back to
+broadcasting timer when going idle.
+
+Signed-off-by: Boris Ostrovsky <ostr@amd64.org>
+Link: http://lkml.kernel.org/r/1306423192-19774-1-git-send-email-ostr@amd64.org
+Tested-by: Boris Petkov <borislav.petkov@amd.com>
+Cc: Hans Rosenfeld <Hans.Rosenfeld@amd.com>
+Cc: Andreas Herrmann <Andreas.Herrmann3@amd.com>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/amd.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -612,8 +612,11 @@ static void __cpuinit init_amd(struct cp
+ }
+ #endif
+
+- /* As a rule processors have APIC timer running in deep C states */
+- if (c->x86 > 0xf && !cpu_has_amd_erratum(amd_erratum_400))
++ /*
++ * Family 0x12 and above processors have APIC timer
++ * running in deep C states.
++ */
++ if (c->x86 > 0x11)
+ set_cpu_cap(c, X86_FEATURE_ARAT);
+
+ /*
--- /dev/null
+From d47cc0db8fd6011de2248df505fc34990b7451bf Mon Sep 17 00:00:00 2001
+From: "Roedel, Joerg" <Joerg.Roedel@amd.com>
+Date: Thu, 19 May 2011 11:13:39 +0200
+Subject: x86, amd: Use _safe() msr access for GartTlbWlk disable code
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: "Roedel, Joerg" <Joerg.Roedel@amd.com>
+
+commit d47cc0db8fd6011de2248df505fc34990b7451bf upstream.
+
+The workaround for Bugzilla:
+
+ https://bugzilla.kernel.org/show_bug.cgi?id=33012
+
+introduced a read and a write to the MC4 mask msr.
+
+Unfortunatly this MSR is not emulated by the KVM hypervisor
+so that the kernel will get a #GP and crashes when applying
+this workaround when running inside KVM.
+
+This issue was reported as:
+
+ https://bugzilla.kernel.org/show_bug.cgi?id=35132
+
+and is fixed with this patch. The change just let the kernel
+ignore any #GP it gets while accessing this MSR by using the
+_safe msr access methods.
+
+Reported-by: Török Edwin <edwintorok@gmail.com>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Cc: Rafael J. Wysocki <rjw@sisk.pl>
+Cc: Maciej Rutecki <maciej.rutecki@gmail.com>
+Cc: Avi Kivity <avi@redhat.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/amd.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -632,10 +632,13 @@ static void __cpuinit init_amd(struct cp
+ * Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=33012
+ */
+ u64 mask;
++ int err;
+
+- rdmsrl(MSR_AMD64_MCx_MASK(4), mask);
+- mask |= (1 << 10);
+- wrmsrl(MSR_AMD64_MCx_MASK(4), mask);
++ err = rdmsrl_safe(MSR_AMD64_MCx_MASK(4), &mask);
++ if (err == 0) {
++ mask |= (1 << 10);
++ checking_wrmsrl(MSR_AMD64_MCx_MASK(4), mask);
++ }
+ }
+ }
+
--- /dev/null
+From 7ccafc5f75c87853f3c49845d5a884f2376e03ce Mon Sep 17 00:00:00 2001
+From: Kees Cook <kees.cook@canonical.com>
+Date: Tue, 24 May 2011 16:29:26 -0700
+Subject: x86, cpufeature: Update CPU feature RDRND to RDRAND
+
+From: Kees Cook <kees.cook@canonical.com>
+
+commit 7ccafc5f75c87853f3c49845d5a884f2376e03ce upstream.
+
+The Intel manual changed the name of the CPUID bit to match the
+instruction name. We should follow suit for sanity's sake. (See Intel SDM
+Volume 2, Table 3-20 "Feature Information Returned in the ECX Register".)
+
+[ hpa: we can only do this at this time because there are currently no CPUs
+ with this feature on the market, hence this is pre-hardware enabling.
+ However, Cc:'ing stable so that stable can present a consistent ABI. ]
+
+Signed-off-by: Kees Cook <kees.cook@canonical.com>
+Link: http://lkml.kernel.org/r/20110524232926.GA27728@outflux.net
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Cc: Fenghua Yu <fenghua.yu@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/cpufeature.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/include/asm/cpufeature.h
++++ b/arch/x86/include/asm/cpufeature.h
+@@ -125,7 +125,7 @@
+ #define X86_FEATURE_OSXSAVE (4*32+27) /* "" XSAVE enabled in the OS */
+ #define X86_FEATURE_AVX (4*32+28) /* Advanced Vector Extensions */
+ #define X86_FEATURE_F16C (4*32+29) /* 16-bit fp conversions */
+-#define X86_FEATURE_RDRND (4*32+30) /* The RDRAND instruction */
++#define X86_FEATURE_RDRAND (4*32+30) /* The RDRAND instruction */
+ #define X86_FEATURE_HYPERVISOR (4*32+31) /* Running on a hypervisor */
+
+ /* VIA/Cyrix/Centaur-defined CPU features, CPUID level 0xC0000001, word 5 */
--- /dev/null
+From 916f676f8dc016103f983c7ec54c18ecdbb6e349 Mon Sep 17 00:00:00 2001
+From: Matthew Garrett <mjg@redhat.com>
+Date: Wed, 25 May 2011 09:53:13 -0400
+Subject: x86, efi: Retain boot service code until after switching to
+ virtual mode
+
+From: Matthew Garrett <mjg@redhat.com>
+
+commit 916f676f8dc016103f983c7ec54c18ecdbb6e349 upstream.
+
+UEFI stands for "Unified Extensible Firmware Interface", where "Firmware"
+is an ancient African word meaning "Why do something right when you can
+do it so wrong that children will weep and brave adults will cower before
+you", and "UEI" is Celtic for "We missed DOS so we burned it into your
+ROMs". The UEFI specification provides for runtime services (ie, another
+way for the operating system to be forced to depend on the firmware) and
+we rely on these for certain trivial tasks such as setting up the
+bootloader. But some hardware fails to work if we attempt to use these
+runtime services from physical mode, and so we have to switch into virtual
+mode. So far so dreadful.
+
+The specification makes it clear that the operating system is free to do
+whatever it wants with boot services code after ExitBootServices() has been
+called. SetVirtualAddressMap() can't be called until ExitBootServices() has
+been. So, obviously, a whole bunch of EFI implementations call into boot
+services code when we do that. Since we've been charmingly naive and
+trusted that the specification may be somehow relevant to the real world,
+we've already stuffed a picture of a penguin or something in that address
+space. And just to make things more entertaining, we've also marked it
+non-executable.
+
+This patch allocates the boot services regions during EFI init and makes
+sure that they're executable. Then, after SetVirtualAddressMap(), it
+discards them and everyone lives happily ever after. Except for the ones
+who have to work on EFI, who live sad lives haunted by the knowledge that
+someone's eventually going to write yet another firmware specification.
+
+[ hpa: adding this to urgent with a stable tag since it fixes currently-broken
+ hardware. However, I do not know what the dependencies are and so I do
+ not know which -stable versions this may be a candidate for. ]
+
+Signed-off-by: Matthew Garrett <mjg@redhat.com>
+Link: http://lkml.kernel.org/r/1306331593-28715-1-git-send-email-mjg@redhat.com
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Cc: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/setup.c | 7 ++++++
+ arch/x86/platform/efi/efi.c | 45 ++++++++++++++++++++++++++++++++++++++++-
+ arch/x86/platform/efi/efi_64.c | 5 ++--
+ include/linux/efi.h | 1
+ 4 files changed, 55 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/kernel/setup.c
++++ b/arch/x86/kernel/setup.c
+@@ -912,6 +912,13 @@ void __init setup_arch(char **cmdline_p)
+ memblock.current_limit = get_max_mapped();
+ memblock_x86_fill();
+
++ /*
++ * The EFI specification says that boot service code won't be called
++ * after ExitBootServices(). This is, in fact, a lie.
++ */
++ if (efi_enabled)
++ efi_reserve_boot_services();
++
+ /* preallocate 4k for mptable mpc */
+ early_reserve_e820_mpc_new();
+
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -315,6 +315,40 @@ static void __init print_efi_memmap(void
+ }
+ #endif /* EFI_DEBUG */
+
++void __init efi_reserve_boot_services(void)
++{
++ void *p;
++
++ for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
++ efi_memory_desc_t *md = p;
++ unsigned long long start = md->phys_addr;
++ unsigned long long size = md->num_pages << EFI_PAGE_SHIFT;
++
++ if (md->type != EFI_BOOT_SERVICES_CODE &&
++ md->type != EFI_BOOT_SERVICES_DATA)
++ continue;
++
++ memblock_x86_reserve_range(start, start + size, "EFI Boot");
++ }
++}
++
++static void __init efi_free_boot_services(void)
++{
++ void *p;
++
++ for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
++ efi_memory_desc_t *md = p;
++ unsigned long long start = md->phys_addr;
++ unsigned long long size = md->num_pages << EFI_PAGE_SHIFT;
++
++ if (md->type != EFI_BOOT_SERVICES_CODE &&
++ md->type != EFI_BOOT_SERVICES_DATA)
++ continue;
++
++ free_bootmem_late(start, size);
++ }
++}
++
+ void __init efi_init(void)
+ {
+ efi_config_table_t *config_tables;
+@@ -507,7 +541,9 @@ void __init efi_enter_virtual_mode(void)
+ efi.systab = NULL;
+ for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
+ md = p;
+- if (!(md->attribute & EFI_MEMORY_RUNTIME))
++ if (!(md->attribute & EFI_MEMORY_RUNTIME) &&
++ md->type != EFI_BOOT_SERVICES_CODE &&
++ md->type != EFI_BOOT_SERVICES_DATA)
+ continue;
+
+ size = md->num_pages << EFI_PAGE_SHIFT;
+@@ -558,6 +594,13 @@ void __init efi_enter_virtual_mode(void)
+ }
+
+ /*
++ * Thankfully, it does seem that no runtime services other than
++ * SetVirtualAddressMap() will touch boot services code, so we can
++ * get rid of it all at this point
++ */
++ efi_free_boot_services();
++
++ /*
+ * Now that EFI is in virtual mode, update the function
+ * pointers in the runtime service table to the new virtual addresses.
+ *
+--- a/arch/x86/platform/efi/efi_64.c
++++ b/arch/x86/platform/efi/efi_64.c
+@@ -64,10 +64,11 @@ static void __init early_runtime_code_ma
+ if (!(__supported_pte_mask & _PAGE_NX))
+ return;
+
+- /* Make EFI runtime service code area executable */
++ /* Make EFI service code area executable */
+ for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
+ md = p;
+- if (md->type == EFI_RUNTIME_SERVICES_CODE) {
++ if (md->type == EFI_RUNTIME_SERVICES_CODE ||
++ md->type == EFI_BOOT_SERVICES_CODE)
+ unsigned long end;
+ end = md->phys_addr + (md->num_pages << EFI_PAGE_SHIFT);
+ early_mapping_set_exec(md->phys_addr, end, executable);
+--- a/include/linux/efi.h
++++ b/include/linux/efi.h
+@@ -299,6 +299,7 @@ extern void efi_initialize_iomem_resourc
+ struct resource *data_resource, struct resource *bss_resource);
+ extern unsigned long efi_get_time(void);
+ extern int efi_set_rtc_mmss(unsigned long nowtime);
++extern void efi_reserve_boot_services(void);
+ extern struct efi_memory_map memmap;
+
+ /**
--- /dev/null
+From b64ce24daffb634b5b3133a2e411bd4de50654e8 Mon Sep 17 00:00:00 2001
+From: Daniel J Blueman <daniel.blueman@gmail.com>
+Date: Wed, 18 May 2011 16:31:31 -0700
+Subject: x86, ioapic: Fix potential resume deadlock
+
+From: Daniel J Blueman <daniel.blueman@gmail.com>
+
+commit b64ce24daffb634b5b3133a2e411bd4de50654e8 upstream.
+
+Fix a potential deadlock when resuming; here the calling
+function has disabled interrupts, so we cannot sleep.
+
+Change the memory allocation flag from GFP_KERNEL to GFP_ATOMIC.
+
+TODO: We can do away with this memory allocation during resume
+ by reusing the ioapic suspend/resume code that uses boot time
+ allocated buffers, but we want to keep this -stable patch
+ simple.
+
+Signed-off-by: Daniel J Blueman <daniel.blueman@gmail.com>
+Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
+Link: http://lkml.kernel.org/r/20110518233157.385970138@sbsiddha-MOBL3.sc.intel.com
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/apic/io_apic.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -621,14 +621,14 @@ struct IO_APIC_route_entry **alloc_ioapi
+ struct IO_APIC_route_entry **ioapic_entries;
+
+ ioapic_entries = kzalloc(sizeof(*ioapic_entries) * nr_ioapics,
+- GFP_KERNEL);
++ GFP_ATOMIC);
+ if (!ioapic_entries)
+ return 0;
+
+ for (apic = 0; apic < nr_ioapics; apic++) {
+ ioapic_entries[apic] =
+ kzalloc(sizeof(struct IO_APIC_route_entry) *
+- nr_ioapic_registers[apic], GFP_KERNEL);
++ nr_ioapic_registers[apic], GFP_ATOMIC);
+ if (!ioapic_entries[apic])
+ goto nomem;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
