--- /dev/null
+From 5b89d2f9ace1970324facc68ca9b8fae19ce8096 Mon Sep 17 00:00:00 2001
+From: Borislav Petkov <borislav.petkov@amd.com>
+Date: Tue, 9 Mar 2010 20:38:48 +0100
+Subject: edac, mce: Filter out invalid values
+
+From: Borislav Petkov <borislav.petkov@amd.com>
+
+commit 5b89d2f9ace1970324facc68ca9b8fae19ce8096 upstream.
+
+Print the CPU associated with the error only when the field is valid.
+
+Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/edac/edac_mce_amd.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/edac/edac_mce_amd.c
++++ b/drivers/edac/edac_mce_amd.c
+@@ -311,9 +311,13 @@ void amd_decode_nb_mce(int node_id, stru
+ if (regs->nbsh & K8_NBSH_ERR_CPU_VAL)
+ pr_cont(", core: %u\n", (u8)(regs->nbsh & 0xf));
+ } else {
+- pr_cont(", core: %d\n", ilog2((regs->nbsh & 0xf)));
+- }
++ u8 assoc_cpus = regs->nbsh & 0xf;
++
++ if (assoc_cpus > 0)
++ pr_cont(", core: %d", fls(assoc_cpus) - 1);
+
++ pr_cont("\n");
++ }
+
+ pr_emerg("%s.\n", EXT_ERR_MSG(xec));
+
--- /dev/null
+From 8e0cc811e0f8029a7225372fb0951fab102c012f Mon Sep 17 00:00:00 2001
+From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Date: Tue, 23 Mar 2010 13:35:50 -0700
+Subject: fs/partition/msdos: fix unusable extended partition for > 512B sector
+
+From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+
+commit 8e0cc811e0f8029a7225372fb0951fab102c012f upstream.
+
+Smaller size than a minimum blocksize can't be used, after all it's
+handled like 0 size.
+
+For extended partition itself, this makes sure to use bigger size than one
+logical sector size at least.
+
+Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Cc: Daniel Taylor <Daniel.Taylor@wdc.com>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/partitions/msdos.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/fs/partitions/msdos.c
++++ b/fs/partitions/msdos.c
+@@ -492,9 +492,16 @@ int msdos_partition(struct parsed_partit
+ if (!size)
+ continue;
+ if (is_extended_partition(p)) {
+- /* prevent someone doing mkfs or mkswap on an
+- extended partition, but leave room for LILO */
+- put_partition(state, slot, start, size == 1 ? 1 : 2);
++ /*
++ * prevent someone doing mkfs or mkswap on an
++ * extended partition, but leave room for LILO
++ * FIXME: this uses one logical sector for > 512b
++ * sector, although it may not be enough/proper.
++ */
++ sector_t n = 2;
++ n = min(size, max(sector_size, n));
++ put_partition(state, slot, start, n);
++
+ printk(" <");
+ parse_extended(state, bdev, start, size);
+ printk(" >");
--- /dev/null
+From 3fbf586cf7f245392142e5407c2a56f1cff979b6 Mon Sep 17 00:00:00 2001
+From: Daniel Taylor <Daniel.Taylor@wdc.com>
+Date: Tue, 23 Mar 2010 13:35:50 -0700
+Subject: fs/partitions/msdos: add support for large disks
+
+From: Daniel Taylor <Daniel.Taylor@wdc.com>
+
+commit 3fbf586cf7f245392142e5407c2a56f1cff979b6 upstream.
+
+In order to use disks larger than 2TiB on Windows XP, it is necessary to
+use 4096-byte logical sectors in an MBR.
+
+Although the kernel storage and functions called from msdos.c used
+"sector_t" internally, msdos.c still used u32 variables, which results in
+the ability to handle XP-compatible large disks.
+
+This patch changes the internal variables to "sector_t".
+
+Daniel said: "In the near future, WD will be releasing products that need
+this patch".
+
+[hirofumi@mail.parknet.co.jp: tweaks and fix]
+Signed-off-by: Daniel Taylor <daniel.taylor@wdc.com>
+Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/partitions/msdos.c | 74 ++++++++++++++++++++++++++------------------------
+ 1 file changed, 39 insertions(+), 35 deletions(-)
+
+--- a/fs/partitions/msdos.c
++++ b/fs/partitions/msdos.c
+@@ -31,14 +31,17 @@
+ */
+ #include <asm/unaligned.h>
+
+-#define SYS_IND(p) (get_unaligned(&p->sys_ind))
+-#define NR_SECTS(p) ({ __le32 __a = get_unaligned(&p->nr_sects); \
+- le32_to_cpu(__a); \
+- })
+-
+-#define START_SECT(p) ({ __le32 __a = get_unaligned(&p->start_sect); \
+- le32_to_cpu(__a); \
+- })
++#define SYS_IND(p) get_unaligned(&p->sys_ind)
++
++static inline sector_t nr_sects(struct partition *p)
++{
++ return (sector_t)get_unaligned_le32(&p->nr_sects);
++}
++
++static inline sector_t start_sect(struct partition *p)
++{
++ return (sector_t)get_unaligned_le32(&p->start_sect);
++}
+
+ static inline int is_extended_partition(struct partition *p)
+ {
+@@ -104,13 +107,13 @@ static int aix_magic_present(unsigned ch
+
+ static void
+ parse_extended(struct parsed_partitions *state, struct block_device *bdev,
+- u32 first_sector, u32 first_size)
++ sector_t first_sector, sector_t first_size)
+ {
+ struct partition *p;
+ Sector sect;
+ unsigned char *data;
+- u32 this_sector, this_size;
+- int sector_size = bdev_logical_block_size(bdev) / 512;
++ sector_t this_sector, this_size;
++ sector_t sector_size = bdev_logical_block_size(bdev) / 512;
+ int loopct = 0; /* number of links followed
+ without finding a data partition */
+ int i;
+@@ -145,14 +148,14 @@ parse_extended(struct parsed_partitions
+ * First process the data partition(s)
+ */
+ for (i=0; i<4; i++, p++) {
+- u32 offs, size, next;
+- if (!NR_SECTS(p) || is_extended_partition(p))
++ sector_t offs, size, next;
++ if (!nr_sects(p) || is_extended_partition(p))
+ continue;
+
+ /* Check the 3rd and 4th entries -
+ these sometimes contain random garbage */
+- offs = START_SECT(p)*sector_size;
+- size = NR_SECTS(p)*sector_size;
++ offs = start_sect(p)*sector_size;
++ size = nr_sects(p)*sector_size;
+ next = this_sector + offs;
+ if (i >= 2) {
+ if (offs + size > this_size)
+@@ -179,13 +182,13 @@ parse_extended(struct parsed_partitions
+ */
+ p -= 4;
+ for (i=0; i<4; i++, p++)
+- if (NR_SECTS(p) && is_extended_partition(p))
++ if (nr_sects(p) && is_extended_partition(p))
+ break;
+ if (i == 4)
+ goto done; /* nothing left to do */
+
+- this_sector = first_sector + START_SECT(p) * sector_size;
+- this_size = NR_SECTS(p) * sector_size;
++ this_sector = first_sector + start_sect(p) * sector_size;
++ this_size = nr_sects(p) * sector_size;
+ put_dev_sector(sect);
+ }
+ done:
+@@ -197,7 +200,7 @@ done:
+
+ static void
+ parse_solaris_x86(struct parsed_partitions *state, struct block_device *bdev,
+- u32 offset, u32 size, int origin)
++ sector_t offset, sector_t size, int origin)
+ {
+ #ifdef CONFIG_SOLARIS_X86_PARTITION
+ Sector sect;
+@@ -244,7 +247,7 @@ parse_solaris_x86(struct parsed_partitio
+ */
+ static void
+ parse_bsd(struct parsed_partitions *state, struct block_device *bdev,
+- u32 offset, u32 size, int origin, char *flavour,
++ sector_t offset, sector_t size, int origin, char *flavour,
+ int max_partitions)
+ {
+ Sector sect;
+@@ -263,7 +266,7 @@ parse_bsd(struct parsed_partitions *stat
+ if (le16_to_cpu(l->d_npartitions) < max_partitions)
+ max_partitions = le16_to_cpu(l->d_npartitions);
+ for (p = l->d_partitions; p - l->d_partitions < max_partitions; p++) {
+- u32 bsd_start, bsd_size;
++ sector_t bsd_start, bsd_size;
+
+ if (state->next == state->limit)
+ break;
+@@ -290,7 +293,7 @@ parse_bsd(struct parsed_partitions *stat
+
+ static void
+ parse_freebsd(struct parsed_partitions *state, struct block_device *bdev,
+- u32 offset, u32 size, int origin)
++ sector_t offset, sector_t size, int origin)
+ {
+ #ifdef CONFIG_BSD_DISKLABEL
+ parse_bsd(state, bdev, offset, size, origin,
+@@ -300,7 +303,7 @@ parse_freebsd(struct parsed_partitions *
+
+ static void
+ parse_netbsd(struct parsed_partitions *state, struct block_device *bdev,
+- u32 offset, u32 size, int origin)
++ sector_t offset, sector_t size, int origin)
+ {
+ #ifdef CONFIG_BSD_DISKLABEL
+ parse_bsd(state, bdev, offset, size, origin,
+@@ -310,7 +313,7 @@ parse_netbsd(struct parsed_partitions *s
+
+ static void
+ parse_openbsd(struct parsed_partitions *state, struct block_device *bdev,
+- u32 offset, u32 size, int origin)
++ sector_t offset, sector_t size, int origin)
+ {
+ #ifdef CONFIG_BSD_DISKLABEL
+ parse_bsd(state, bdev, offset, size, origin,
+@@ -324,7 +327,7 @@ parse_openbsd(struct parsed_partitions *
+ */
+ static void
+ parse_unixware(struct parsed_partitions *state, struct block_device *bdev,
+- u32 offset, u32 size, int origin)
++ sector_t offset, sector_t size, int origin)
+ {
+ #ifdef CONFIG_UNIXWARE_DISKLABEL
+ Sector sect;
+@@ -348,7 +351,8 @@ parse_unixware(struct parsed_partitions
+
+ if (p->s_label != UNIXWARE_FS_UNUSED)
+ put_partition(state, state->next++,
+- START_SECT(p), NR_SECTS(p));
++ le32_to_cpu(p->start_sect),
++ le32_to_cpu(p->nr_sects));
+ p++;
+ }
+ put_dev_sector(sect);
+@@ -363,7 +367,7 @@ parse_unixware(struct parsed_partitions
+ */
+ static void
+ parse_minix(struct parsed_partitions *state, struct block_device *bdev,
+- u32 offset, u32 size, int origin)
++ sector_t offset, sector_t size, int origin)
+ {
+ #ifdef CONFIG_MINIX_SUBPARTITION
+ Sector sect;
+@@ -390,7 +394,7 @@ parse_minix(struct parsed_partitions *st
+ /* add each partition in use */
+ if (SYS_IND(p) == MINIX_PARTITION)
+ put_partition(state, state->next++,
+- START_SECT(p), NR_SECTS(p));
++ start_sect(p), nr_sects(p));
+ }
+ printk(" >\n");
+ }
+@@ -401,7 +405,7 @@ parse_minix(struct parsed_partitions *st
+ static struct {
+ unsigned char id;
+ void (*parse)(struct parsed_partitions *, struct block_device *,
+- u32, u32, int);
++ sector_t, sector_t, int);
+ } subtypes[] = {
+ {FREEBSD_PARTITION, parse_freebsd},
+ {NETBSD_PARTITION, parse_netbsd},
+@@ -415,7 +419,7 @@ static struct {
+
+ int msdos_partition(struct parsed_partitions *state, struct block_device *bdev)
+ {
+- int sector_size = bdev_logical_block_size(bdev) / 512;
++ sector_t sector_size = bdev_logical_block_size(bdev) / 512;
+ Sector sect;
+ unsigned char *data;
+ struct partition *p;
+@@ -483,8 +487,8 @@ int msdos_partition(struct parsed_partit
+
+ state->next = 5;
+ for (slot = 1 ; slot <= 4 ; slot++, p++) {
+- u32 start = START_SECT(p)*sector_size;
+- u32 size = NR_SECTS(p)*sector_size;
++ sector_t start = start_sect(p)*sector_size;
++ sector_t size = nr_sects(p)*sector_size;
+ if (!size)
+ continue;
+ if (is_extended_partition(p)) {
+@@ -513,7 +517,7 @@ int msdos_partition(struct parsed_partit
+ unsigned char id = SYS_IND(p);
+ int n;
+
+- if (!NR_SECTS(p))
++ if (!nr_sects(p))
+ continue;
+
+ for (n = 0; subtypes[n].parse && id != subtypes[n].id; n++)
+@@ -521,8 +525,8 @@ int msdos_partition(struct parsed_partit
+
+ if (!subtypes[n].parse)
+ continue;
+- subtypes[n].parse(state, bdev, START_SECT(p)*sector_size,
+- NR_SECTS(p)*sector_size, slot);
++ subtypes[n].parse(state, bdev, start_sect(p)*sector_size,
++ nr_sects(p)*sector_size, slot);
+ }
+ put_dev_sector(sect);
+ return 1;
--- /dev/null
+From 9bf35c8dddd56f7f247a27346f74f5adc18071f4 Mon Sep 17 00:00:00 2001
+From: Paulius Zaleckas <paulius.zaleckas@gmail.com>
+Date: Sun, 21 Mar 2010 21:19:02 -0700
+Subject: if_tunnel.h: add missing ams/byteorder.h include
+
+From: Paulius Zaleckas <paulius.zaleckas@gmail.com>
+
+commit 9bf35c8dddd56f7f247a27346f74f5adc18071f4 upstream.
+
+When compiling userspace application which includes
+if_tunnel.h and uses GRE_* defines you will get undefined
+reference to __cpu_to_be16.
+
+Fix this by adding missing #include <asm/byteorder.h>
+
+Signed-off-by: Paulius Zaleckas <paulius.zaleckas@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/if_tunnel.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/linux/if_tunnel.h
++++ b/include/linux/if_tunnel.h
+@@ -2,6 +2,7 @@
+ #define _IF_TUNNEL_H_
+
+ #include <linux/types.h>
++#include <asm/byteorder.h>
+
+ #ifdef __KERNEL__
+ #include <linux/ip.h>
--- /dev/null
+From c8406ea8fa1adde8dc5400127281d497bbcdb84a Mon Sep 17 00:00:00 2001
+From: Adel Gadllah <adel.gadllah@gmail.com>
+Date: Sun, 14 Mar 2010 19:16:25 +0100
+Subject: iwlwifi: Silence tfds_in_queue message
+
+From: Adel Gadllah <adel.gadllah@gmail.com>
+
+commit c8406ea8fa1adde8dc5400127281d497bbcdb84a upstream.
+
+Commit a239a8b47cc0e5e6d7416a89f340beac06d5edaa introduced a
+noisy message, that fills up the log very fast.
+
+The error seems not to be fatal (the connection is stable and
+performance is ok), so make it IWL_DEBUG_TX rather than IWL_ERR.
+
+Signed-off-by: Adel Gadllah <adel.gadllah@gmail.com>
+Acked-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-tx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
+@@ -126,7 +126,7 @@ void iwl_free_tfds_in_queue(struct iwl_p
+ if (priv->stations[sta_id].tid[tid].tfds_in_queue >= freed)
+ priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
+ else {
+- IWL_ERR(priv, "free more than tfds_in_queue (%u:%d)\n",
++ IWL_DEBUG_TX(priv, "free more than tfds_in_queue (%u:%d)\n",
+ priv->stations[sta_id].tid[tid].tfds_in_queue,
+ freed);
+ priv->stations[sta_id].tid[tid].tfds_in_queue = 0;
--- /dev/null
+From sgruszka@redhat.com Mon Mar 29 13:19:13 2010
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Fri, 19 Mar 2010 11:10:41 +0100
+Subject: iwlwifi: use dma_alloc_coherent
+To: Greg KH <greg@kroah.com>
+Cc: Reinette Chatre <reinette.chatre@intel.com>, stable@kernel.org
+Message-ID: <20100319101040.GA3953@dhcp-lab-161.englab.brq.redhat.com>
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit f36d04abe684f9e2b07c6ebe9f77ae20eb5c1e84 upstream.
+
+Change pci_alloc_consistent() to dma_alloc_coherent() so we can use
+GFP_KERNEL flag.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-3945.c | 8 +++-----
+ drivers/net/wireless/iwlwifi/iwl-core.c | 12 ++++++------
+ drivers/net/wireless/iwlwifi/iwl-helpers.h | 7 ++++---
+ drivers/net/wireless/iwlwifi/iwl-rx.c | 21 +++++++++++----------
+ drivers/net/wireless/iwlwifi/iwl-tx.c | 23 ++++++++++++-----------
+ drivers/net/wireless/iwlwifi/iwl3945-base.c | 16 ++++++++--------
+ 6 files changed, 44 insertions(+), 43 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
++++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
+@@ -2545,11 +2545,9 @@ int iwl3945_hw_set_hw_params(struct iwl_
+ memset((void *)&priv->hw_params, 0,
+ sizeof(struct iwl_hw_params));
+
+- priv->shared_virt =
+- pci_alloc_consistent(priv->pci_dev,
+- sizeof(struct iwl3945_shared),
+- &priv->shared_phys);
+-
++ priv->shared_virt = dma_alloc_coherent(&priv->pci_dev->dev,
++ sizeof(struct iwl3945_shared),
++ &priv->shared_phys, GFP_KERNEL);
+ if (!priv->shared_virt) {
+ IWL_ERR(priv, "failed to allocate pci memory\n");
+ mutex_unlock(&priv->mutex);
+--- a/drivers/net/wireless/iwlwifi/iwl-core.c
++++ b/drivers/net/wireless/iwlwifi/iwl-core.c
+@@ -1598,9 +1598,9 @@ EXPORT_SYMBOL(iwl_uninit_drv);
+ void iwl_free_isr_ict(struct iwl_priv *priv)
+ {
+ if (priv->ict_tbl_vir) {
+- pci_free_consistent(priv->pci_dev, (sizeof(u32) * ICT_COUNT) +
+- PAGE_SIZE, priv->ict_tbl_vir,
+- priv->ict_tbl_dma);
++ dma_free_coherent(&priv->pci_dev->dev,
++ (sizeof(u32) * ICT_COUNT) + PAGE_SIZE,
++ priv->ict_tbl_vir, priv->ict_tbl_dma);
+ priv->ict_tbl_vir = NULL;
+ }
+ }
+@@ -1616,9 +1616,9 @@ int iwl_alloc_isr_ict(struct iwl_priv *p
+ if (priv->cfg->use_isr_legacy)
+ return 0;
+ /* allocate shrared data table */
+- priv->ict_tbl_vir = pci_alloc_consistent(priv->pci_dev, (sizeof(u32) *
+- ICT_COUNT) + PAGE_SIZE,
+- &priv->ict_tbl_dma);
++ priv->ict_tbl_vir = dma_alloc_coherent(&priv->pci_dev->dev,
++ (sizeof(u32) * ICT_COUNT) + PAGE_SIZE,
++ &priv->ict_tbl_dma, GFP_KERNEL);
+ if (!priv->ict_tbl_vir)
+ return -ENOMEM;
+
+--- a/drivers/net/wireless/iwlwifi/iwl-helpers.h
++++ b/drivers/net/wireless/iwlwifi/iwl-helpers.h
+@@ -80,8 +80,8 @@ static inline void iwl_free_fw_desc(stru
+ struct fw_desc *desc)
+ {
+ if (desc->v_addr)
+- pci_free_consistent(pci_dev, desc->len,
+- desc->v_addr, desc->p_addr);
++ dma_free_coherent(&pci_dev->dev, desc->len,
++ desc->v_addr, desc->p_addr);
+ desc->v_addr = NULL;
+ desc->len = 0;
+ }
+@@ -89,7 +89,8 @@ static inline void iwl_free_fw_desc(stru
+ static inline int iwl_alloc_fw_desc(struct pci_dev *pci_dev,
+ struct fw_desc *desc)
+ {
+- desc->v_addr = pci_alloc_consistent(pci_dev, desc->len, &desc->p_addr);
++ desc->v_addr = dma_alloc_coherent(&pci_dev->dev, desc->len,
++ &desc->p_addr, GFP_KERNEL);
+ return (desc->v_addr != NULL) ? 0 : -ENOMEM;
+ }
+
+--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
+@@ -345,10 +345,10 @@ void iwl_rx_queue_free(struct iwl_priv *
+ }
+ }
+
+- pci_free_consistent(priv->pci_dev, 4 * RX_QUEUE_SIZE, rxq->bd,
+- rxq->dma_addr);
+- pci_free_consistent(priv->pci_dev, sizeof(struct iwl_rb_status),
+- rxq->rb_stts, rxq->rb_stts_dma);
++ dma_free_coherent(&priv->pci_dev->dev, 4 * RX_QUEUE_SIZE, rxq->bd,
++ rxq->dma_addr);
++ dma_free_coherent(&priv->pci_dev->dev, sizeof(struct iwl_rb_status),
++ rxq->rb_stts, rxq->rb_stts_dma);
+ rxq->bd = NULL;
+ rxq->rb_stts = NULL;
+ }
+@@ -357,7 +357,7 @@ EXPORT_SYMBOL(iwl_rx_queue_free);
+ int iwl_rx_queue_alloc(struct iwl_priv *priv)
+ {
+ struct iwl_rx_queue *rxq = &priv->rxq;
+- struct pci_dev *dev = priv->pci_dev;
++ struct device *dev = &priv->pci_dev->dev;
+ int i;
+
+ spin_lock_init(&rxq->lock);
+@@ -365,12 +365,13 @@ int iwl_rx_queue_alloc(struct iwl_priv *
+ INIT_LIST_HEAD(&rxq->rx_used);
+
+ /* Alloc the circular buffer of Read Buffer Descriptors (RBDs) */
+- rxq->bd = pci_alloc_consistent(dev, 4 * RX_QUEUE_SIZE, &rxq->dma_addr);
++ rxq->bd = dma_alloc_coherent(dev, 4 * RX_QUEUE_SIZE, &rxq->dma_addr,
++ GFP_KERNEL);
+ if (!rxq->bd)
+ goto err_bd;
+
+- rxq->rb_stts = pci_alloc_consistent(dev, sizeof(struct iwl_rb_status),
+- &rxq->rb_stts_dma);
++ rxq->rb_stts = dma_alloc_coherent(dev, sizeof(struct iwl_rb_status),
++ &rxq->rb_stts_dma, GFP_KERNEL);
+ if (!rxq->rb_stts)
+ goto err_rb;
+
+@@ -387,8 +388,8 @@ int iwl_rx_queue_alloc(struct iwl_priv *
+ return 0;
+
+ err_rb:
+- pci_free_consistent(priv->pci_dev, 4 * RX_QUEUE_SIZE, rxq->bd,
+- rxq->dma_addr);
++ dma_free_coherent(&priv->pci_dev->dev, 4 * RX_QUEUE_SIZE, rxq->bd,
++ rxq->dma_addr);
+ err_bd:
+ return -ENOMEM;
+ }
+--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
+@@ -60,7 +60,8 @@ static const u16 default_tid_to_tx_fifo[
+ static inline int iwl_alloc_dma_ptr(struct iwl_priv *priv,
+ struct iwl_dma_ptr *ptr, size_t size)
+ {
+- ptr->addr = pci_alloc_consistent(priv->pci_dev, size, &ptr->dma);
++ ptr->addr = dma_alloc_coherent(&priv->pci_dev->dev, size, &ptr->dma,
++ GFP_KERNEL);
+ if (!ptr->addr)
+ return -ENOMEM;
+ ptr->size = size;
+@@ -73,7 +74,7 @@ static inline void iwl_free_dma_ptr(stru
+ if (unlikely(!ptr->addr))
+ return;
+
+- pci_free_consistent(priv->pci_dev, ptr->size, ptr->addr, ptr->dma);
++ dma_free_coherent(&priv->pci_dev->dev, ptr->size, ptr->addr, ptr->dma);
+ memset(ptr, 0, sizeof(*ptr));
+ }
+
+@@ -145,7 +146,7 @@ void iwl_tx_queue_free(struct iwl_priv *
+ {
+ struct iwl_tx_queue *txq = &priv->txq[txq_id];
+ struct iwl_queue *q = &txq->q;
+- struct pci_dev *dev = priv->pci_dev;
++ struct device *dev = &priv->pci_dev->dev;
+ int i, len;
+
+ if (q->n_bd == 0)
+@@ -164,8 +165,8 @@ void iwl_tx_queue_free(struct iwl_priv *
+
+ /* De-alloc circular buffer of TFDs */
+ if (txq->q.n_bd)
+- pci_free_consistent(dev, priv->hw_params.tfd_size *
+- txq->q.n_bd, txq->tfds, txq->q.dma_addr);
++ dma_free_coherent(dev, priv->hw_params.tfd_size *
++ txq->q.n_bd, txq->tfds, txq->q.dma_addr);
+
+ /* De-alloc array of per-TFD driver data */
+ kfree(txq->txb);
+@@ -194,7 +195,7 @@ void iwl_cmd_queue_free(struct iwl_priv
+ {
+ struct iwl_tx_queue *txq = &priv->txq[IWL_CMD_QUEUE_NUM];
+ struct iwl_queue *q = &txq->q;
+- struct pci_dev *dev = priv->pci_dev;
++ struct device *dev = &priv->pci_dev->dev;
+ int i, len;
+
+ if (q->n_bd == 0)
+@@ -209,8 +210,8 @@ void iwl_cmd_queue_free(struct iwl_priv
+
+ /* De-alloc circular buffer of TFDs */
+ if (txq->q.n_bd)
+- pci_free_consistent(dev, priv->hw_params.tfd_size *
+- txq->q.n_bd, txq->tfds, txq->q.dma_addr);
++ dma_free_coherent(dev, priv->hw_params.tfd_size * txq->q.n_bd,
++ txq->tfds, txq->q.dma_addr);
+
+ /* deallocate arrays */
+ kfree(txq->cmd);
+@@ -301,7 +302,7 @@ static int iwl_queue_init(struct iwl_pri
+ static int iwl_tx_queue_alloc(struct iwl_priv *priv,
+ struct iwl_tx_queue *txq, u32 id)
+ {
+- struct pci_dev *dev = priv->pci_dev;
++ struct device *dev = &priv->pci_dev->dev;
+ size_t tfd_sz = priv->hw_params.tfd_size * TFD_QUEUE_SIZE_MAX;
+
+ /* Driver private data, only for Tx (not command) queues,
+@@ -320,8 +321,8 @@ static int iwl_tx_queue_alloc(struct iwl
+
+ /* Circular buffer of transmit frame descriptors (TFDs),
+ * shared with device */
+- txq->tfds = pci_alloc_consistent(dev, tfd_sz, &txq->q.dma_addr);
+-
++ txq->tfds = dma_alloc_coherent(dev, tfd_sz, &txq->q.dma_addr,
++ GFP_KERNEL);
+ if (!txq->tfds) {
+ IWL_ERR(priv, "pci_alloc_consistent(%zd) failed\n", tfd_sz);
+ goto error;
+--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
++++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
+@@ -356,10 +356,10 @@ static int iwl3945_send_beacon_cmd(struc
+ static void iwl3945_unset_hw_params(struct iwl_priv *priv)
+ {
+ if (priv->shared_virt)
+- pci_free_consistent(priv->pci_dev,
+- sizeof(struct iwl3945_shared),
+- priv->shared_virt,
+- priv->shared_phys);
++ dma_free_coherent(&priv->pci_dev->dev,
++ sizeof(struct iwl3945_shared),
++ priv->shared_virt,
++ priv->shared_phys);
+ }
+
+ static void iwl3945_build_tx_cmd_hwcrypto(struct iwl_priv *priv,
+@@ -1272,10 +1272,10 @@ static void iwl3945_rx_queue_free(struct
+ }
+ }
+
+- pci_free_consistent(priv->pci_dev, 4 * RX_QUEUE_SIZE, rxq->bd,
+- rxq->dma_addr);
+- pci_free_consistent(priv->pci_dev, sizeof(struct iwl_rb_status),
+- rxq->rb_stts, rxq->rb_stts_dma);
++ dma_free_coherent(&priv->pci_dev->dev, 4 * RX_QUEUE_SIZE, rxq->bd,
++ rxq->dma_addr);
++ dma_free_coherent(&priv->pci_dev->dev, sizeof(struct iwl_rb_status),
++ rxq->rb_stts, rxq->rb_stts_dma);
+ rxq->bd = NULL;
+ rxq->rb_stts = NULL;
+ }
--- /dev/null
+From 17da69b8bfbe441a33a873ad5dd7d3d85800bf2b Mon Sep 17 00:00:00 2001
+From: Guo-Fu Tseng <cooldavid@cooldavid.org>
+Date: Wed, 17 Mar 2010 00:09:29 +0000
+Subject: jme: Fix VLAN memory leak
+
+From: Guo-Fu Tseng <cooldavid@cooldavid.org>
+
+commit 17da69b8bfbe441a33a873ad5dd7d3d85800bf2b upstream.
+
+Fix memory leak while receiving 8021q tagged packet which is not
+registered by user.
+
+Signed-off-by: Guo-Fu Tseng <cooldavid@cooldavid.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/jme.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/jme.c
++++ b/drivers/net/jme.c
+@@ -946,6 +946,8 @@ jme_alloc_and_feed_skb(struct jme_adapte
+ jme->jme_vlan_rx(skb, jme->vlgrp,
+ le16_to_cpu(rxdesc->descwb.vlan));
+ NET_STAT(jme).rx_bytes += 4;
++ } else {
++ dev_kfree_skb(skb);
+ }
+ } else {
+ jme->jme_rx(skb);
--- /dev/null
+From bf5e5360fd1df1ae429ebbd81838d7d0879797d1 Mon Sep 17 00:00:00 2001
+From: Guo-Fu Tseng <cooldavid@cooldavid.org>
+Date: Wed, 17 Mar 2010 00:09:30 +0000
+Subject: jme: Protect vlgrp structure by pause RX actions.
+
+From: Guo-Fu Tseng <cooldavid@cooldavid.org>
+
+commit bf5e5360fd1df1ae429ebbd81838d7d0879797d1 upstream.
+
+Temporary stop the RX IRQ, and disable (sync) tasklet or napi.
+And restore it after finished the vlgrp pointer assignment.
+
+Signed-off-by: Guo-Fu Tseng <cooldavid@cooldavid.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/jme.c | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+--- a/drivers/net/jme.c
++++ b/drivers/net/jme.c
+@@ -2087,12 +2087,45 @@ jme_tx_timeout(struct net_device *netdev
+ jme_reset_link(jme);
+ }
+
++static inline void jme_pause_rx(struct jme_adapter *jme)
++{
++ atomic_dec(&jme->link_changing);
++
++ jme_set_rx_pcc(jme, PCC_OFF);
++ if (test_bit(JME_FLAG_POLL, &jme->flags)) {
++ JME_NAPI_DISABLE(jme);
++ } else {
++ tasklet_disable(&jme->rxclean_task);
++ tasklet_disable(&jme->rxempty_task);
++ }
++}
++
++static inline void jme_resume_rx(struct jme_adapter *jme)
++{
++ struct dynpcc_info *dpi = &(jme->dpi);
++
++ if (test_bit(JME_FLAG_POLL, &jme->flags)) {
++ JME_NAPI_ENABLE(jme);
++ } else {
++ tasklet_hi_enable(&jme->rxclean_task);
++ tasklet_hi_enable(&jme->rxempty_task);
++ }
++ dpi->cur = PCC_P1;
++ dpi->attempt = PCC_P1;
++ dpi->cnt = 0;
++ jme_set_rx_pcc(jme, PCC_P1);
++
++ atomic_inc(&jme->link_changing);
++}
++
+ static void
+ jme_vlan_rx_register(struct net_device *netdev, struct vlan_group *grp)
+ {
+ struct jme_adapter *jme = netdev_priv(netdev);
+
++ jme_pause_rx(jme);
+ jme->vlgrp = grp;
++ jme_resume_rx(jme);
+ }
+
+ static void
--- /dev/null
+From 7c9e2b1c4784c6e574f69dbd904b2822f2e04d6e Mon Sep 17 00:00:00 2001
+From: Dean Nelson <dnelson@redhat.com>
+Date: Tue, 9 Mar 2010 22:26:55 -0500
+Subject: PCI: cleanup error return for pcix get and set mmrbc functions
+
+From: Dean Nelson <dnelson@redhat.com>
+
+commit 7c9e2b1c4784c6e574f69dbd904b2822f2e04d6e upstream.
+
+pcix_get_mmrbc() returns the maximum memory read byte count (mmrbc), if
+successful, or an appropriate error value, if not.
+
+Distinguishing errors from correct values and understanding the meaning of an
+error can be somewhat confusing in that:
+
+ correct values: 512, 1024, 2048, 4096
+ errors: -EINVAL -22
+ PCIBIOS_FUNC_NOT_SUPPORTED 0x81
+ PCIBIOS_BAD_VENDOR_ID 0x83
+ PCIBIOS_DEVICE_NOT_FOUND 0x86
+ PCIBIOS_BAD_REGISTER_NUMBER 0x87
+ PCIBIOS_SET_FAILED 0x88
+ PCIBIOS_BUFFER_TOO_SMALL 0x89
+
+The PCIBIOS_ errors are returned from the PCI functions generated by the
+PCI_OP_READ() and PCI_OP_WRITE() macros.
+
+In a similar manner, pcix_set_mmrbc() also returns the PCIBIOS_ error values
+returned from pci_read_config_[word|dword]() and pci_write_config_word().
+
+Following pcix_get_max_mmrbc()'s example, the following patch simply returns
+-EINVAL for all PCIBIOS_ errors encountered by pcix_get_mmrbc(), and -EINVAL
+or -EIO for those encountered by pcix_set_mmrbc().
+
+This simplification was chosen in light of the fact that none of the current
+callers of these functions are interested in the specific type of error
+encountered. In the future, should this change, one could simply create a
+function that maps each PCIBIOS_ error to a corresponding unique errno value,
+which could be called by pcix_get_max_mmrbc(), pcix_get_mmrbc(), and
+pcix_set_mmrbc().
+
+Additionally, this patch eliminates some unnecessary variables.
+
+Signed-off-by: Dean Nelson <dnelson@redhat.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/pci.c | 36 ++++++++++++++++--------------------
+ 1 file changed, 16 insertions(+), 20 deletions(-)
+
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -2350,15 +2350,14 @@ EXPORT_SYMBOL_GPL(pci_reset_function);
+ */
+ int pcix_get_max_mmrbc(struct pci_dev *dev)
+ {
+- int err, cap;
++ int cap;
+ u32 stat;
+
+ cap = pci_find_capability(dev, PCI_CAP_ID_PCIX);
+ if (!cap)
+ return -EINVAL;
+
+- err = pci_read_config_dword(dev, cap + PCI_X_STATUS, &stat);
+- if (err)
++ if (pci_read_config_dword(dev, cap + PCI_X_STATUS, &stat))
+ return -EINVAL;
+
+ return 512 << ((stat & PCI_X_STATUS_MAX_READ) >> 21);
+@@ -2374,18 +2373,17 @@ EXPORT_SYMBOL(pcix_get_max_mmrbc);
+ */
+ int pcix_get_mmrbc(struct pci_dev *dev)
+ {
+- int ret, cap;
++ int cap;
+ u16 cmd;
+
+ cap = pci_find_capability(dev, PCI_CAP_ID_PCIX);
+ if (!cap)
+ return -EINVAL;
+
+- ret = pci_read_config_word(dev, cap + PCI_X_CMD, &cmd);
+- if (!ret)
+- ret = 512 << ((cmd & PCI_X_CMD_MAX_READ) >> 2);
++ if (pci_read_config_word(dev, cap + PCI_X_CMD, &cmd))
++ return -EINVAL;
+
+- return ret;
++ return 512 << ((cmd & PCI_X_CMD_MAX_READ) >> 2);
+ }
+ EXPORT_SYMBOL(pcix_get_mmrbc);
+
+@@ -2400,29 +2398,27 @@ EXPORT_SYMBOL(pcix_get_mmrbc);
+ */
+ int pcix_set_mmrbc(struct pci_dev *dev, int mmrbc)
+ {
+- int cap, err = -EINVAL;
++ int cap;
+ u32 stat, v, o;
+ u16 cmd;
+
+ if (mmrbc < 512 || mmrbc > 4096 || !is_power_of_2(mmrbc))
+- goto out;
++ return -EINVAL;
+
+ v = ffs(mmrbc) - 10;
+
+ cap = pci_find_capability(dev, PCI_CAP_ID_PCIX);
+ if (!cap)
+- goto out;
++ return -EINVAL;
+
+- err = pci_read_config_dword(dev, cap + PCI_X_STATUS, &stat);
+- if (err)
+- goto out;
++ if (pci_read_config_dword(dev, cap + PCI_X_STATUS, &stat))
++ return -EINVAL;
+
+ if (v > (stat & PCI_X_STATUS_MAX_READ) >> 21)
+ return -E2BIG;
+
+- err = pci_read_config_word(dev, cap + PCI_X_CMD, &cmd);
+- if (err)
+- goto out;
++ if (pci_read_config_word(dev, cap + PCI_X_CMD, &cmd))
++ return -EINVAL;
+
+ o = (cmd & PCI_X_CMD_MAX_READ) >> 2;
+ if (o != v) {
+@@ -2432,10 +2428,10 @@ int pcix_set_mmrbc(struct pci_dev *dev,
+
+ cmd &= ~PCI_X_CMD_MAX_READ;
+ cmd |= v << 2;
+- err = pci_write_config_word(dev, cap + PCI_X_CMD, cmd);
++ if (pci_write_config_word(dev, cap + PCI_X_CMD, cmd))
++ return -EIO;
+ }
+-out:
+- return err;
++ return 0;
+ }
+ EXPORT_SYMBOL(pcix_set_mmrbc);
+
--- /dev/null
+From bdc2bda7c4dd253026cc1fce45fc939304749029 Mon Sep 17 00:00:00 2001
+From: Dean Nelson <dnelson@redhat.com>
+Date: Tue, 9 Mar 2010 22:26:48 -0500
+Subject: PCI: fix access of PCI_X_CMD by pcix get and set mmrbc functions
+
+From: Dean Nelson <dnelson@redhat.com>
+
+commit bdc2bda7c4dd253026cc1fce45fc939304749029 upstream.
+
+An e1000 driver on a system with a PCI-X bus was always being returned
+a value of 135 from both pcix_get_mmrbc() and pcix_set_mmrbc(). This
+value reflects an error return of PCIBIOS_BAD_REGISTER_NUMBER from
+pci_bus_read_config_dword(,, cap + PCI_X_CMD,).
+
+This is because for a dword, the following portion of the PCI_OP_READ()
+macro:
+
+ if (PCI_##size##_BAD) return PCIBIOS_BAD_REGISTER_NUMBER;
+
+expands to:
+
+ if (pos & 3) return PCIBIOS_BAD_REGISTER_NUMBER;
+
+And is always true for 'cap + PCI_X_CMD', which is 0xe4 + 2 = 0xe6. ('cap' is
+the result of calling pci_find_capability(, PCI_CAP_ID_PCIX).)
+
+The same problem exists for pci_bus_write_config_dword(,, cap + PCI_X_CMD,).
+In both cases, instead of calling _dword(), _word() should be called.
+
+Signed-off-by: Dean Nelson <dnelson@redhat.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/pci.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -2375,13 +2375,13 @@ EXPORT_SYMBOL(pcix_get_max_mmrbc);
+ int pcix_get_mmrbc(struct pci_dev *dev)
+ {
+ int ret, cap;
+- u32 cmd;
++ u16 cmd;
+
+ cap = pci_find_capability(dev, PCI_CAP_ID_PCIX);
+ if (!cap)
+ return -EINVAL;
+
+- ret = pci_read_config_dword(dev, cap + PCI_X_CMD, &cmd);
++ ret = pci_read_config_word(dev, cap + PCI_X_CMD, &cmd);
+ if (!ret)
+ ret = 512 << ((cmd & PCI_X_CMD_MAX_READ) >> 2);
+
+@@ -2401,7 +2401,8 @@ EXPORT_SYMBOL(pcix_get_mmrbc);
+ int pcix_set_mmrbc(struct pci_dev *dev, int mmrbc)
+ {
+ int cap, err = -EINVAL;
+- u32 stat, cmd, v, o;
++ u32 stat, v, o;
++ u16 cmd;
+
+ if (mmrbc < 512 || mmrbc > 4096 || !is_power_of_2(mmrbc))
+ goto out;
+@@ -2419,7 +2420,7 @@ int pcix_set_mmrbc(struct pci_dev *dev,
+ if (v > (stat & PCI_X_STATUS_MAX_READ) >> 21)
+ return -E2BIG;
+
+- err = pci_read_config_dword(dev, cap + PCI_X_CMD, &cmd);
++ err = pci_read_config_word(dev, cap + PCI_X_CMD, &cmd);
+ if (err)
+ goto out;
+
+@@ -2431,7 +2432,7 @@ int pcix_set_mmrbc(struct pci_dev *dev,
+
+ cmd &= ~PCI_X_CMD_MAX_READ;
+ cmd |= v << 2;
+- err = pci_write_config_dword(dev, cap + PCI_X_CMD, cmd);
++ err = pci_write_config_word(dev, cap + PCI_X_CMD, cmd);
+ }
+ out:
+ return err;
--- /dev/null
+From 25daeb550b69e89aff59bc6a84218a12b5203531 Mon Sep 17 00:00:00 2001
+From: Dean Nelson <dnelson@redhat.com>
+Date: Tue, 9 Mar 2010 22:26:40 -0500
+Subject: PCI: fix return value from pcix_get_max_mmrbc()
+
+From: Dean Nelson <dnelson@redhat.com>
+
+commit 25daeb550b69e89aff59bc6a84218a12b5203531 upstream.
+
+For the PCI_X_STATUS register, pcix_get_max_mmrbc() is returning an incorrect
+value, which is based on:
+
+ (stat & PCI_X_STATUS_MAX_READ) >> 12
+
+Valid return values are 512, 1024, 2048, 4096, which correspond to a 'stat'
+(masked and right shifted by 21) of 0, 1, 2, 3, respectively.
+
+A right shift by 11 would generate the correct return value when 'stat' (masked
+and right shifted by 21) has a value of 1 or 2. But for a value of 0 or 3 it's
+not possible to generate the correct return value by only right shifting.
+
+Fix is based on pcix_get_mmrbc()'s similar dealings with the PCI_X_CMD register.
+
+Signed-off-by: Dean Nelson <dnelson@redhat.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -2361,7 +2361,7 @@ int pcix_get_max_mmrbc(struct pci_dev *d
+ if (err)
+ return -EINVAL;
+
+- return (stat & PCI_X_STATUS_MAX_READ) >> 12;
++ return 512 << ((stat & PCI_X_STATUS_MAX_READ) >> 21);
+ }
+ EXPORT_SYMBOL(pcix_get_max_mmrbc);
+
--- /dev/null
+From a5ee4eb75413c145334c30e43f1af9875dad6fd7 Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Mon, 22 Mar 2010 09:52:16 +0100
+Subject: PCI quirk: RS780/RS880: work around missing MSI initialization
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit a5ee4eb75413c145334c30e43f1af9875dad6fd7 upstream.
+
+AMD says in section 2.5.4 (GFX MSI Enable) of #43291 (AMD 780G Family
+Register Programming Requirements):
+
+ The SBIOS must enable internal graphics MSI capability in GCCFG by
+ setting the following: NBCFG.NB_CNTL.STRAP_MSI_ENABLE='1'
+
+Quite a few BIOS writers misinterpret this sentence and think that
+enabling MSI is an optional feature. However, clearing that bit just
+prevents delivery of MSI messages but does not remove the MSI PCI
+capabilities registers, and so leaves these devices unusable for any
+driver that attempts to use MSI.
+
+Setting that bit is not possible after the BIOS has locked down the
+configuration registers, so we have to manually disable MSI for the
+affected devices.
+
+This fixes the codec communication errors in the HDA driver when
+accessing the HDMI audio device, and allows us to get rid of the
+overcautious quirk in radeon_irq_kms.c.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Tested-by: Alex Deucher <alexdeucher@gamil.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/quirks.c | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2463,6 +2463,39 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AT
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x4375,
+ quirk_msi_intx_disable_bug);
+
++/*
++ * MSI does not work with the AMD RS780/RS880 internal graphics and HDMI audio
++ * devices unless the BIOS has initialized the nb_cntl.strap_msi_enable bit.
++ */
++static void __init rs780_int_gfx_disable_msi(struct pci_dev *int_gfx_bridge)
++{
++ u32 nb_cntl;
++
++ if (!int_gfx_bridge->subordinate)
++ return;
++
++ pci_bus_write_config_dword(int_gfx_bridge->bus, PCI_DEVFN(0, 0),
++ 0x60, 0);
++ pci_bus_read_config_dword(int_gfx_bridge->bus, PCI_DEVFN(0, 0),
++ 0x64, &nb_cntl);
++
++ if (!(nb_cntl & BIT(10))) {
++ dev_warn(&int_gfx_bridge->dev,
++ FW_WARN "RS780: MSI for internal graphics disabled\n");
++ int_gfx_bridge->subordinate->bus_flags |= PCI_BUS_FLAGS_NO_MSI;
++ }
++}
++
++#define PCI_DEVICE_ID_AMD_RS780_P2P_INT_GFX 0x9602
++
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD,
++ PCI_DEVICE_ID_AMD_RS780_P2P_INT_GFX,
++ rs780_int_gfx_disable_msi);
++/* wrong vendor ID on M4A785TD motherboard: */
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ASUSTEK,
++ PCI_DEVICE_ID_AMD_RS780_P2P_INT_GFX,
++ rs780_int_gfx_disable_msi);
++
+ #endif /* CONFIG_PCI_MSI */
+
+ #ifdef CONFIG_PCI_IOV
--- /dev/null
+From ben@decadent.org.uk Mon Mar 29 13:35:12 2010
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Mon, 29 Mar 2010 01:09:17 +0100
+Subject: rt2860sta: Fix argument to linux_pci_unmap_single()
+To: stable@kernel.org
+Cc: 575726@bugs.debian.org, linux-wireless <linux-wireless@vger.kernel.org>, John Halton <johnhalton@gmail.com>, Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Message-ID: <1269821357.8653.231.camel@localhost>
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+John Halton wrote in <http://bugs.debian.org/575726>:
+> Whenever wpa_supplicant is deactivated (whether by killing the process or
+> during a normal shutdown) I am getting a kerneloops that prevents the
+> computer from completing shutdown. Here is the relevant syslog output:
+
+The backtrace points to an incorrect call from RTMPFreeTxRxRingMemory()
+into linux_pci_unmap_single(). This appears to have been fixed in Linux
+2.6.33 by this change:
+
+commit ca97b8388838ee9ea4b4bad04948f8f7f8a607a3
+Author: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Date: Tue Sep 22 20:44:07 2009 +0200
+
+ Staging: rt28x0: updates from vendor's V2.1.0.0 drivers
+
+For stable-2.6.32, just fix this one function call.
+
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/rt2860/common/2860_rtmp_init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/rt2860/common/2860_rtmp_init.c
++++ b/drivers/staging/rt2860/common/2860_rtmp_init.c
+@@ -716,7 +716,7 @@ VOID RTMPFreeTxRxRingMemory(
+ {
+ if ((pAd->RxRing.Cell[index].DmaBuf.AllocVa) && (pAd->RxRing.Cell[index].pNdisPacket))
+ {
+- PCI_UNMAP_SINGLE(pObj->pci_dev, pAd->RxRing.Cell[index].DmaBuf.AllocPa, pAd->RxRing.Cell[index].DmaBuf.AllocSize, PCI_DMA_FROMDEVICE);
++ PCI_UNMAP_SINGLE(pAd, pAd->RxRing.Cell[index].DmaBuf.AllocPa, pAd->RxRing.Cell[index].DmaBuf.AllocSize, PCI_DMA_FROMDEVICE);
+ RELEASE_NDIS_PACKET(pAd, pAd->RxRing.Cell[index].pNdisPacket, NDIS_STATUS_SUCCESS);
+ }
+ }
usb-option-move-hardcoded-pid-to-a-macro-in-usb-serial-option.patch
usb-option-add-support-for-a-new-cmotech-device-to-usb-serial-option.patch
usb-r8a66597-hcd-fix-removed-from-an-attached-hub.patch
+wl1251-fix-potential-crash.patch
+jme-fix-vlan-memory-leak.patch
+jme-protect-vlgrp-structure-by-pause-rx-actions.patch
+edac-mce-filter-out-invalid-values.patch
+iwlwifi-use-dma_alloc_coherent.patch
+iwlwifi-silence-tfds_in_queue-message.patch
+sunrpc-fix-a-potential-memory-leak-in-auth_gss.patch
+sunrpc-handle-allocation-errors-from-__rpc_lookup_create.patch
+if_tunnel.h-add-missing-ams-byteorder.h-include.patch
+fs-partitions-msdos-add-support-for-large-disks.patch
+fs-partition-msdos-fix-unusable-extended-partition-for-512b-sector.patch
+pci-fix-return-value-from-pcix_get_max_mmrbc.patch
+pci-fix-access-of-pci_x_cmd-by-pcix-get-and-set-mmrbc-functions.patch
+pci-cleanup-error-return-for-pcix-get-and-set-mmrbc-functions.patch
+pci-quirk-rs780-rs880-work-around-missing-msi-initialization.patch
+rt2860sta-fix-argument-to-linux_pci_unmap_single.patch
--- /dev/null
+From cdead7cf12896c0e50a8be2e52de52c364603095 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Fri, 19 Mar 2010 15:36:22 -0400
+Subject: SUNRPC: Fix a potential memory leak in auth_gss
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit cdead7cf12896c0e50a8be2e52de52c364603095 upstream.
+
+The function alloc_enc_pages() currently fails to release the pointer
+rqstp->rq_enc_pages in the error path.
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Acked-by: J. Bruce Fields <bfields@citi.umich.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/auth_gss/auth_gss.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/net/sunrpc/auth_gss/auth_gss.c
++++ b/net/sunrpc/auth_gss/auth_gss.c
+@@ -1273,9 +1273,8 @@ alloc_enc_pages(struct rpc_rqst *rqstp)
+ rqstp->rq_release_snd_buf = priv_release_snd_buf;
+ return 0;
+ out_free:
+- for (i--; i >= 0; i--) {
+- __free_page(rqstp->rq_enc_pages[i]);
+- }
++ rqstp->rq_enc_pages_num = i;
++ priv_release_snd_buf(rqstp);
+ out:
+ return -EAGAIN;
+ }
--- /dev/null
+From f1f0abe192a72e75d7c59972e30784d043fd8d73 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <error27@gmail.com>
+Date: Sun, 21 Mar 2010 12:10:34 -0400
+Subject: sunrpc: handle allocation errors from __rpc_lookup_create()
+
+From: Dan Carpenter <error27@gmail.com>
+
+commit f1f0abe192a72e75d7c59972e30784d043fd8d73 upstream.
+
+__rpc_lookup_create() can return ERR_PTR(-ENOMEM).
+
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/rpc_pipe.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/sunrpc/rpc_pipe.c
++++ b/net/sunrpc/rpc_pipe.c
+@@ -587,6 +587,8 @@ static struct dentry *__rpc_lookup_creat
+ struct dentry *dentry;
+
+ dentry = __rpc_lookup_create(parent, name);
++ if (IS_ERR(dentry))
++ return dentry;
+ if (dentry->d_inode == NULL)
+ return dentry;
+ dput(dentry);
--- /dev/null
+From 3f60ebc9d6291863652d564bacc430629271e6a9 Mon Sep 17 00:00:00 2001
+From: Grazvydas Ignotas <notasas@gmail.com>
+Date: Thu, 11 Mar 2010 17:45:26 +0200
+Subject: wl1251: fix potential crash
+
+From: Grazvydas Ignotas <notasas@gmail.com>
+
+commit 3f60ebc9d6291863652d564bacc430629271e6a9 upstream.
+
+In case debugfs does not init for some reason (or is disabled
+on older kernels) driver does not allocate stats.fw_stats
+structure, but tries to clear it later and trips on a NULL
+pointer:
+
+Unable to handle kernel NULL pointer dereference at virtual address
+00000000
+PC is at __memzero+0x24/0x80
+Backtrace:
+[<bf0ddb88>] (wl1251_debugfs_reset+0x0/0x30 [wl1251])
+[<bf0d6a2c>] (wl1251_op_stop+0x0/0x12c [wl1251])
+[<bf0bc228>] (ieee80211_stop_device+0x0/0x74 [mac80211])
+[<bf0b0d10>] (ieee80211_stop+0x0/0x4ac [mac80211])
+[<c02deeac>] (dev_close+0x0/0xb4)
+[<c02deac0>] (dev_change_flags+0x0/0x184)
+[<c031f478>] (devinet_ioctl+0x0/0x704)
+[<c0320720>] (inet_ioctl+0x0/0x100)
+
+Add a NULL pointer check to fix this.
+
+Signed-off-by: Grazvydas Ignotas <notasas@gmail.com>
+Acked-by: Kalle Valo <kalle.valo@iki.fi>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/wl12xx/wl1251_debugfs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/wl12xx/wl1251_debugfs.c
++++ b/drivers/net/wireless/wl12xx/wl1251_debugfs.c
+@@ -443,7 +443,8 @@ out:
+
+ void wl1251_debugfs_reset(struct wl1251 *wl)
+ {
+- memset(wl->stats.fw_stats, 0, sizeof(*wl->stats.fw_stats));
++ if (wl->stats.fw_stats != NULL)
++ memset(wl->stats.fw_stats, 0, sizeof(*wl->stats.fw_stats));
+ wl->stats.retry_count = 0;
+ wl->stats.excessive_retries = 0;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
