--- /dev/null
+From a248b13b21ae00b97638b4f435c8df3075808b5d Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Thu, 26 May 2011 11:20:19 +0100
+Subject: ARM: 6941/1: cache: ensure MVA is cacheline aligned in
+ flush_kern_dcache_area
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit a248b13b21ae00b97638b4f435c8df3075808b5d upstream.
+
+The v6 and v7 implementations of flush_kern_dcache_area do not align
+the passed MVA to the size of a cacheline in the data cache. If a
+misaligned address is used, only a subset of the requested area will
+be flushed. This has been observed to cause failures in SMP boot where
+the secondary_data initialised by the primary CPU is not cacheline
+aligned, causing the secondary CPUs to read incorrect values for their
+pgd and stack pointers.
+
+This patch ensures that the base address is cacheline aligned before
+flushing the d-cache.
+
+Acked-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/mm/cache-v6.S | 1 +
+ arch/arm/mm/cache-v7.S | 2 ++
+ 2 files changed, 3 insertions(+)
+
+--- a/arch/arm/mm/cache-v6.S
++++ b/arch/arm/mm/cache-v6.S
+@@ -176,6 +176,7 @@ ENDPROC(v6_coherent_kern_range)
+ */
+ ENTRY(v6_flush_kern_dcache_area)
+ add r1, r0, r1
++ bic r0, r0, #D_CACHE_LINE_SIZE - 1
+ 1:
+ #ifdef HARVARD_CACHE
+ mcr p15, 0, r0, c7, c14, 1 @ clean & invalidate D line
+--- a/arch/arm/mm/cache-v7.S
++++ b/arch/arm/mm/cache-v7.S
+@@ -221,6 +221,8 @@ ENDPROC(v7_coherent_user_range)
+ ENTRY(v7_flush_kern_dcache_area)
+ dcache_line_size r2, r3
+ add r1, r0, r1
++ sub r3, r2, #1
++ bic r0, r0, r3
+ 1:
+ mcr p15, 0, r0, c7, c14, 1 @ clean & invalidate D line / unified line
+ add r0, r0, r2
--- /dev/null
+From e7a46b4d0839c2a3aa2e0ae0b145f293f6738498 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dcbw@redhat.com>
+Date: Fri, 27 May 2011 04:51:54 +0000
+Subject: atm: expose ATM device index in sysfs
+
+From: Dan Williams <dcbw@redhat.com>
+
+commit e7a46b4d0839c2a3aa2e0ae0b145f293f6738498 upstream.
+
+It's currently exposed only through /proc which, besides requiring
+screen-scraping, doesn't allow userspace to distinguish between two
+identical ATM adapters with different ATM indexes. The ATM device index
+is required when using PPPoATM on a system with multiple ATM adapters.
+
+Signed-off-by: Dan Williams <dcbw@redhat.com>
+Reviewed-by: Eric Dumazet <eric.dumazet@gmail.com>
+Tested-by: David Woodhouse <dwmw2@infradead.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/atm/atm_sysfs.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/net/atm/atm_sysfs.c
++++ b/net/atm/atm_sysfs.c
+@@ -59,6 +59,14 @@ static ssize_t show_atmaddress(struct de
+ return pos - buf;
+ }
+
++static ssize_t show_atmindex(struct device *cdev,
++ struct device_attribute *attr, char *buf)
++{
++ struct atm_dev *adev = to_atm_dev(cdev);
++
++ return sprintf(buf, "%d\n", adev->number);
++}
++
+ static ssize_t show_carrier(struct device *cdev,
+ struct device_attribute *attr, char *buf)
+ {
+@@ -99,6 +107,7 @@ static ssize_t show_link_rate(struct dev
+
+ static DEVICE_ATTR(address, S_IRUGO, show_address, NULL);
+ static DEVICE_ATTR(atmaddress, S_IRUGO, show_atmaddress, NULL);
++static DEVICE_ATTR(atmindex, S_IRUGO, show_atmindex, NULL);
+ static DEVICE_ATTR(carrier, S_IRUGO, show_carrier, NULL);
+ static DEVICE_ATTR(type, S_IRUGO, show_type, NULL);
+ static DEVICE_ATTR(link_rate, S_IRUGO, show_link_rate, NULL);
+@@ -106,6 +115,7 @@ static DEVICE_ATTR(link_rate, S_IRUGO, s
+ static struct device_attribute *atm_attrs[] = {
+ &dev_attr_atmaddress,
+ &dev_attr_address,
++ &dev_attr_atmindex,
+ &dev_attr_carrier,
+ &dev_attr_type,
+ &dev_attr_link_rate,
--- /dev/null
+From af46566885a373b0a526932484cd8fef8de7b598 Mon Sep 17 00:00:00 2001
+From: Namhyung Kim <namhyung@gmail.com>
+Date: Thu, 26 May 2011 21:06:50 +0200
+Subject: brd: handle on-demand devices correctly
+
+From: Namhyung Kim <namhyung@gmail.com>
+
+commit af46566885a373b0a526932484cd8fef8de7b598 upstream.
+
+When finding or allocating a ram disk device, brd_probe() did not take
+partition numbers into account so that it can result to a different
+device. Consider following example (I set CONFIG_BLK_DEV_RAM_COUNT=4
+for simplicity) :
+
+$ sudo modprobe brd max_part=15
+$ ls -l /dev/ram*
+brw-rw---- 1 root disk 1, 0 2011-05-25 15:41 /dev/ram0
+brw-rw---- 1 root disk 1, 16 2011-05-25 15:41 /dev/ram1
+brw-rw---- 1 root disk 1, 32 2011-05-25 15:41 /dev/ram2
+brw-rw---- 1 root disk 1, 48 2011-05-25 15:41 /dev/ram3
+$ sudo mknod /dev/ram4 b 1 64
+$ sudo dd if=/dev/zero of=/dev/ram4 bs=4k count=256
+256+0 records in
+256+0 records out
+1048576 bytes (1.0 MB) copied, 0.00215578 s, 486 MB/s
+namhyung@leonhard:linux$ ls -l /dev/ram*
+brw-rw---- 1 root disk 1, 0 2011-05-25 15:41 /dev/ram0
+brw-rw---- 1 root disk 1, 16 2011-05-25 15:41 /dev/ram1
+brw-rw---- 1 root disk 1, 32 2011-05-25 15:41 /dev/ram2
+brw-rw---- 1 root disk 1, 48 2011-05-25 15:41 /dev/ram3
+brw-r--r-- 1 root root 1, 64 2011-05-25 15:45 /dev/ram4
+brw-rw---- 1 root disk 1, 1024 2011-05-25 15:44 /dev/ram64
+
+After this patch, /dev/ram4 - instead of /dev/ram64 - was
+accessed correctly.
+
+In addition, 'range' passed to blk_register_region() should
+include all range of dev_t that RAMDISK_MAJOR can address.
+It does not need to be limited by partition numbers unless
+'rd_nr' param was specified.
+
+Signed-off-by: Namhyung Kim <namhyung@gmail.com>
+Cc: Laurent Vivier <Laurent.Vivier@bull.net>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/block/brd.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/block/brd.c
++++ b/drivers/block/brd.c
+@@ -552,7 +552,7 @@ static struct kobject *brd_probe(dev_t d
+ struct kobject *kobj;
+
+ mutex_lock(&brd_devices_mutex);
+- brd = brd_init_one(dev & MINORMASK);
++ brd = brd_init_one(MINOR(dev) >> part_shift);
+ kobj = brd ? get_disk(brd->brd_disk) : ERR_PTR(-ENOMEM);
+ mutex_unlock(&brd_devices_mutex);
+
+@@ -593,10 +593,10 @@ static int __init brd_init(void)
+
+ if (rd_nr) {
+ nr = rd_nr;
+- range = rd_nr;
++ range = rd_nr << part_shift;
+ } else {
+ nr = CONFIG_BLK_DEV_RAM_COUNT;
+- range = 1UL << (MINORBITS - part_shift);
++ range = 1UL << MINORBITS;
+ }
+
+ if (register_blkdev(RAMDISK_MAJOR, "ramdisk"))
+@@ -635,7 +635,7 @@ static void __exit brd_exit(void)
+ unsigned long range;
+ struct brd_device *brd, *next;
+
+- range = rd_nr ? rd_nr : 1UL << (MINORBITS - part_shift);
++ range = rd_nr ? rd_nr << part_shift : 1UL << MINORBITS;
+
+ list_for_each_entry_safe(brd, next, &brd_devices, brd_list)
+ brd_del_one(brd);
--- /dev/null
+From 315980c8688c4b06713c1a5fe9d64cdf8ab57a72 Mon Sep 17 00:00:00 2001
+From: Namhyung Kim <namhyung@gmail.com>
+Date: Thu, 26 May 2011 21:06:50 +0200
+Subject: brd: limit 'max_part' module param to DISK_MAX_PARTS
+
+From: Namhyung Kim <namhyung@gmail.com>
+
+commit 315980c8688c4b06713c1a5fe9d64cdf8ab57a72 upstream.
+
+The 'max_part' parameter controls the number of maximum partition
+a brd device can have. However if a user specifies very large
+value it would exceed the limitation of device minor number and
+can cause a kernel panic (or, at least, produce invalid device
+nodes in some cases).
+
+On my desktop system, following command kills the kernel. On qemu,
+it triggers similar oops but the kernel was alive:
+
+$ sudo modprobe brd max_part=100000
+ BUG: unable to handle kernel NULL pointer dereference at 0000000000000058
+ IP: [<ffffffff81110a9a>] sysfs_create_dir+0x2d/0xae
+ PGD 7af1067 PUD 7b19067 PMD 0
+ Oops: 0000 [#1] SMP
+ last sysfs file:
+ CPU 0
+ Modules linked in: brd(+)
+
+ Pid: 44, comm: insmod Tainted: G W 2.6.39-qemu+ #158 Bochs Bochs
+ RIP: 0010:[<ffffffff81110a9a>] [<ffffffff81110a9a>] sysfs_create_dir+0x2d/0xae
+ RSP: 0018:ffff880007b15d78 EFLAGS: 00000286
+ RAX: ffff880007b05478 RBX: ffff880007a52760 RCX: ffff880007b15dc8
+ RDX: ffff880007a4f900 RSI: ffff880007b15e48 RDI: ffff880007a52760
+ RBP: ffff880007b15da8 R08: 0000000000000002 R09: 0000000000000000
+ R10: ffff880007b15e48 R11: ffff880007b05478 R12: 0000000000000000
+ R13: ffff880007b05478 R14: 0000000000400920 R15: 0000000000000063
+ FS: 0000000002160880(0063) GS:ffff880007c00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000000000000058 CR3: 0000000007b1c000 CR4: 00000000000006b0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 0000000000000000 DR7: 0000000000000000
+ Process insmod (pid: 44, threadinfo ffff880007b14000, task ffff880007acb980)
+ Stack:
+ ffff880007b15dc8 ffff880007b05478 ffff880007b15da8 00000000fffffffe
+ ffff880007a52760 ffff880007b05478 ffff880007b15de8 ffffffff81143c0a
+ 0000000000400920 ffff880007a52760 ffff880007b05478 0000000000000000
+ Call Trace:
+ [<ffffffff81143c0a>] kobject_add_internal+0xdf/0x1a0
+ [<ffffffff81143da1>] kobject_add_varg+0x41/0x50
+ [<ffffffff81143e6b>] kobject_add+0x64/0x66
+ [<ffffffff8113bbe7>] blk_register_queue+0x5f/0xb8
+ [<ffffffff81140f72>] add_disk+0xdf/0x289
+ [<ffffffffa00040df>] brd_init+0xdf/0x1aa [brd]
+ [<ffffffffa0004000>] ? 0xffffffffa0003fff
+ [<ffffffffa0004000>] ? 0xffffffffa0003fff
+ [<ffffffff8100020a>] do_one_initcall+0x7a/0x12e
+ [<ffffffff8108516c>] sys_init_module+0x9c/0x1dc
+ [<ffffffff812ff4bb>] system_call_fastpath+0x16/0x1b
+ Code: 89 e5 41 55 41 54 53 48 89 fb 48 83 ec 18 48 85 ff 75 04 0f 0b eb fe 48 8b 47 18 49 c7 c4 70 1e 4d 81 48 85 c0 74 04 4c 8b 60 30
+ 8b 44 24 58 45 31 ed 0f b6 c4 85 c0 74 0d 48 8b 43 28 48 89
+ RIP [<ffffffff81110a9a>] sysfs_create_dir+0x2d/0xae
+ RSP <ffff880007b15d78>
+ CR2: 0000000000000058
+ ---[ end trace aebb1175ce1f6739 ]---
+
+Signed-off-by: Namhyung Kim <namhyung@gmail.com>
+Cc: Laurent Vivier <Laurent.Vivier@bull.net>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/block/brd.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/block/brd.c
++++ b/drivers/block/brd.c
+@@ -585,6 +585,9 @@ static int __init brd_init(void)
+ if (max_part > 0)
+ part_shift = fls(max_part);
+
++ if ((1UL << part_shift) > DISK_MAX_PARTS)
++ return -EINVAL;
++
+ if (rd_nr > 1UL << (MINORBITS - part_shift))
+ return -EINVAL;
+
--- /dev/null
+From 7467571f4480b273007517b26297c07154c73924 Mon Sep 17 00:00:00 2001
+From: Tero Kristo <tero.kristo@nokia.com>
+Date: Thu, 24 Feb 2011 17:19:23 +0200
+Subject: cpuidle: menu: fixed wrapping timers at 4.294 seconds
+
+From: Tero Kristo <tero.kristo@nokia.com>
+
+commit 7467571f4480b273007517b26297c07154c73924 upstream.
+
+Cpuidle menu governor is using u32 as a temporary datatype for storing
+nanosecond values which wrap around at 4.294 seconds. This causes errors
+in predicted sleep times resulting in higher than should be C state
+selection and increased power consumption. This also breaks cpuidle
+state residency statistics.
+
+Signed-off-by: Tero Kristo <tero.kristo@nokia.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/cpuidle/governors/menu.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/cpuidle/governors/menu.c
++++ b/drivers/cpuidle/governors/menu.c
+@@ -237,6 +237,7 @@ static int menu_select(struct cpuidle_de
+ unsigned int power_usage = -1;
+ int i;
+ int multiplier;
++ struct timespec t;
+
+ if (data->needs_update) {
+ menu_update(dev);
+@@ -251,8 +252,9 @@ static int menu_select(struct cpuidle_de
+ return 0;
+
+ /* determine the expected residency time, round up */
++ t = ktime_to_timespec(tick_nohz_get_sleep_length());
+ data->expected_us =
+- DIV_ROUND_UP((u32)ktime_to_ns(tick_nohz_get_sleep_length()), 1000);
++ t.tv_sec * USEC_PER_SEC + t.tv_nsec / NSEC_PER_USEC;
+
+
+ data->bucket = which_bucket(data->expected_us);
--- /dev/null
+From f4808ca99a203f20b4475601748e44b25a65bdec Mon Sep 17 00:00:00 2001
+From: Milan Broz <mbroz@redhat.com>
+Date: Sun, 29 May 2011 13:02:52 +0100
+Subject: dm table: reject devices without request fns
+
+From: Milan Broz <mbroz@redhat.com>
+
+commit f4808ca99a203f20b4475601748e44b25a65bdec upstream.
+
+This patch adds a check that a block device has a request function
+defined before it is used. Otherwise, misconfiguration can cause an oops.
+
+Because we are allowing devices with zero size e.g. an offline multipath
+device as in commit 2cd54d9bedb79a97f014e86c0da393416b264eb3
+("dm: allow offline devices") there needs to be an additional check
+to ensure devices are initialised. Some block devices, like a loop
+device without a backing file, exist but have no request function.
+
+Reproducer is trivial: dm-mirror on unbound loop device
+(no backing file on loop devices)
+
+dmsetup create x --table "0 8 mirror core 2 8 sync 2 /dev/loop0 0 /dev/loop1 0"
+
+and mirror resync will immediatelly cause OOps.
+
+BUG: unable to handle kernel NULL pointer dereference at (null)
+ ? generic_make_request+0x2bd/0x590
+ ? kmem_cache_alloc+0xad/0x190
+ submit_bio+0x53/0xe0
+ ? bio_add_page+0x3b/0x50
+ dispatch_io+0x1ca/0x210 [dm_mod]
+ ? read_callback+0x0/0xd0 [dm_mirror]
+ dm_io+0xbb/0x290 [dm_mod]
+ do_mirror+0x1e0/0x748 [dm_mirror]
+
+Signed-off-by: Milan Broz <mbroz@redhat.com>
+Reported-by: Zdenek Kabelac <zkabelac@redhat.com>
+Acked-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-table.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -361,6 +361,7 @@ static void close_dev(struct dm_dev_inte
+ static int device_area_is_invalid(struct dm_target *ti, struct dm_dev *dev,
+ sector_t start, sector_t len, void *data)
+ {
++ struct request_queue *q;
+ struct queue_limits *limits = data;
+ struct block_device *bdev = dev->bdev;
+ sector_t dev_size =
+@@ -369,6 +370,22 @@ static int device_area_is_invalid(struct
+ limits->logical_block_size >> SECTOR_SHIFT;
+ char b[BDEVNAME_SIZE];
+
++ /*
++ * Some devices exist without request functions,
++ * such as loop devices not yet bound to backing files.
++ * Forbid the use of such devices.
++ */
++ q = bdev_get_queue(bdev);
++ if (!q || !q->make_request_fn) {
++ DMWARN("%s: %s is not yet initialised: "
++ "start=%llu, len=%llu, dev_size=%llu",
++ dm_device_name(ti->table->md), bdevname(bdev, b),
++ (unsigned long long)start,
++ (unsigned long long)len,
++ (unsigned long long)dev_size);
++ return 1;
++ }
++
+ if (!dev_size)
+ return 0;
+
--- /dev/null
+From 5bfa1063a775836a84f97e4df863fc36e1f856ad Mon Sep 17 00:00:00 2001
+From: "Feng, Boqun" <boqun.feng@intel.com>
+Date: Mon, 16 May 2011 16:02:39 +0800
+Subject: drm/i915: fix user irq miss in BSD ring on g4x
+
+From: "Feng, Boqun" <boqun.feng@intel.com>
+
+commit 5bfa1063a775836a84f97e4df863fc36e1f856ad upstream.
+
+On g4x, user interrupt in BSD ring is missed.
+This is because though g4x and ironlake share the same bsd_ring,
+their interrupt control interfaces have _two_ differences.
+
+1.different irq enable/disable functions:
+On g4x are i915_enable_irq and i915_disable_irq.
+On ironlake are ironlake_enable_irq and ironlake_disable_irq.
+2.different irq flag:
+On g4x user interrupt flag in BSD ring on is I915_BSD_USER_INTERRUPT.
+On ironlake is GT_BSD_USER_INTERRUPT
+
+Old bsd_ring_get/put_irq call ring_get_irq and ring_get_irq.
+ring_get_irq and ring_put_irq only call ironlake_enable/disable_irq.
+So comes the irq miss on g4x.
+
+To fix this, as other rings' code do, conditionally call different
+functions(i915_enable/disable_irq and ironlake_enable/disable_irq)
+and use different interrupt flags in bsd_ring_get/put_irq.
+
+Signed-off-by: Feng, Boqun <boqun.feng@intel.com>
+Reviewed-by: Xiang, Haihao <haihao.xiang@intel.com>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_ringbuffer.c | 29 +++++++++++++++++++++++++++--
+ 1 file changed, 27 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -684,12 +684,37 @@ gen6_ring_put_irq(struct intel_ring_buff
+ static bool
+ bsd_ring_get_irq(struct intel_ring_buffer *ring)
+ {
+- return ring_get_irq(ring, GT_BSD_USER_INTERRUPT);
++ struct drm_device *dev = ring->dev;
++ drm_i915_private_t *dev_priv = dev->dev_private;
++
++ if (!dev->irq_enabled)
++ return false;
++
++ spin_lock(&ring->irq_lock);
++ if (ring->irq_refcount++ == 0) {
++ if (IS_G4X(dev))
++ i915_enable_irq(dev_priv, I915_BSD_USER_INTERRUPT);
++ else
++ ironlake_enable_irq(dev_priv, GT_BSD_USER_INTERRUPT);
++ }
++ spin_unlock(&ring->irq_lock);
++
++ return true;
+ }
+ static void
+ bsd_ring_put_irq(struct intel_ring_buffer *ring)
+ {
+- ring_put_irq(ring, GT_BSD_USER_INTERRUPT);
++ struct drm_device *dev = ring->dev;
++ drm_i915_private_t *dev_priv = dev->dev_private;
++
++ spin_lock(&ring->irq_lock);
++ if (--ring->irq_refcount == 0) {
++ if (IS_G4X(dev))
++ i915_disable_irq(dev_priv, I915_BSD_USER_INTERRUPT);
++ else
++ ironlake_disable_irq(dev_priv, GT_BSD_USER_INTERRUPT);
++ }
++ spin_unlock(&ring->irq_lock);
+ }
+
+ static int
--- /dev/null
+From f25a5c63bfa017498c9adecb24d649ae96ba5c68 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Thu, 19 May 2011 11:07:57 -0400
+Subject: drm/radeon/evergreen/btc/fusion: setup hdp to invalidate and
+ flush when asked
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit f25a5c63bfa017498c9adecb24d649ae96ba5c68 upstream.
+
+This needs to be explicitly set on btc. It's set by default
+on evergreen/fusion, so it fine to just unconditionally enable it for
+all chips.
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/evergreen.c | 6 +++++-
+ drivers/gpu/drm/radeon/evergreend.h | 2 ++
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -1585,7 +1585,7 @@ static void evergreen_gpu_init(struct ra
+ u32 sq_stack_resource_mgmt_2;
+ u32 sq_stack_resource_mgmt_3;
+ u32 vgt_cache_invalidation;
+- u32 hdp_host_path_cntl;
++ u32 hdp_host_path_cntl, tmp;
+ int i, j, num_shader_engines, ps_thread_count;
+
+ switch (rdev->family) {
+@@ -2145,6 +2145,10 @@ static void evergreen_gpu_init(struct ra
+ for (i = SQ_ALU_CONST_BUFFER_SIZE_HS_0; i < 0x29000; i += 4)
+ WREG32(i, 0);
+
++ tmp = RREG32(HDP_MISC_CNTL);
++ tmp |= HDP_FLUSH_INVALIDATE_CACHE;
++ WREG32(HDP_MISC_CNTL, tmp);
++
+ hdp_host_path_cntl = RREG32(HDP_HOST_PATH_CNTL);
+ WREG32(HDP_HOST_PATH_CNTL, hdp_host_path_cntl);
+
+--- a/drivers/gpu/drm/radeon/evergreend.h
++++ b/drivers/gpu/drm/radeon/evergreend.h
+@@ -64,6 +64,8 @@
+ #define GB_BACKEND_MAP 0x98FC
+ #define DMIF_ADDR_CONFIG 0xBD4
+ #define HDP_ADDR_CONFIG 0x2F48
++#define HDP_MISC_CNTL 0x2F4C
++#define HDP_FLUSH_INVALIDATE_CACHE (1 << 0)
+
+ #define CC_SYS_RB_BACKEND_DISABLE 0x3F88
+ #define GC_USER_RB_BACKEND_DISABLE 0x9B7C
--- /dev/null
+From 97bfd0acd32e9639c9136e03955d574655d5cc2b Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Thu, 19 May 2011 14:14:43 +1000
+Subject: drm/radeon/kms: add wait idle ioctl for eg->cayman
+
+From: Dave Airlie <airlied@redhat.com>
+
+commit 97bfd0acd32e9639c9136e03955d574655d5cc2b upstream.
+
+None of the latest GPUs had this hooked up, this is necessary for
+correct operation in a lot of cases, however we should test this on a few
+GPUs in these families as we've had problems in this area before.
+
+Reviewed-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_asic.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_asic.c
++++ b/drivers/gpu/drm/radeon/radeon_asic.c
+@@ -782,6 +782,7 @@ static struct radeon_asic evergreen_asic
+ .hpd_fini = &evergreen_hpd_fini,
+ .hpd_sense = &evergreen_hpd_sense,
+ .hpd_set_polarity = &evergreen_hpd_set_polarity,
++ .ioctl_wait_idle = r600_ioctl_wait_idle,
+ .gui_idle = &r600_gui_idle,
+ .pm_misc = &evergreen_pm_misc,
+ .pm_prepare = &evergreen_pm_prepare,
+@@ -828,6 +829,7 @@ static struct radeon_asic sumo_asic = {
+ .hpd_fini = &evergreen_hpd_fini,
+ .hpd_sense = &evergreen_hpd_sense,
+ .hpd_set_polarity = &evergreen_hpd_set_polarity,
++ .ioctl_wait_idle = r600_ioctl_wait_idle,
+ .gui_idle = &r600_gui_idle,
+ .pm_misc = &evergreen_pm_misc,
+ .pm_prepare = &evergreen_pm_prepare,
+@@ -874,6 +876,8 @@ static struct radeon_asic btc_asic = {
+ .hpd_fini = &evergreen_hpd_fini,
+ .hpd_sense = &evergreen_hpd_sense,
+ .hpd_set_polarity = &evergreen_hpd_set_polarity,
++ .ioctl_wait_idle = r600_ioctl_wait_idle,
++ .ioctl_wait_idle = r600_ioctl_wait_idle,
+ .gui_idle = &r600_gui_idle,
+ .pm_misc = &evergreen_pm_misc,
+ .pm_prepare = &evergreen_pm_prepare,
--- /dev/null
+From bc1f419c76a2d6450413ce4349f4e4a07be011d5 Mon Sep 17 00:00:00 2001
+From: Luca Tettamanti <kronos.it@gmail.com>
+Date: Wed, 25 May 2011 20:43:31 +0200
+Subject: i8k: Avoid lahf in 64-bit code
+
+From: Luca Tettamanti <kronos.it@gmail.com>
+
+commit bc1f419c76a2d6450413ce4349f4e4a07be011d5 upstream.
+
+i8k uses lahf to read the flag register in 64-bit code; early x86-64
+CPUs, however, lack this instruction and we get an invalid opcode
+exception at runtime.
+Use pushf to load the flag register into the stack instead.
+
+Signed-off-by: Luca Tettamanti <kronos.it@gmail.com>
+Reported-by: Jeff Rickman <jrickman@myamigos.us>
+Tested-by: Jeff Rickman <jrickman@myamigos.us>
+Tested-by: Harry G McGavran Jr <w5pny@arrl.net>
+Cc: Massimo Dal Zotto <dz@debian.org>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/i8k.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/char/i8k.c
++++ b/drivers/char/i8k.c
+@@ -139,8 +139,8 @@ static int i8k_smm(struct smm_regs *regs
+ "movl %%edi,20(%%rax)\n\t"
+ "popq %%rdx\n\t"
+ "movl %%edx,0(%%rax)\n\t"
+- "lahf\n\t"
+- "shrl $8,%%eax\n\t"
++ "pushfq\n\t"
++ "popq %%rax\n\t"
+ "andl $1,%%eax\n"
+ :"=a"(rc)
+ : "a"(regs)
--- /dev/null
+From 333c5ae9948194428fe6c5ef5c088304fc98263b Mon Sep 17 00:00:00 2001
+From: Tim Chen <tim.c.chen@linux.intel.com>
+Date: Fri, 11 Feb 2011 12:49:04 -0800
+Subject: idle governor: Avoid lock acquisition to read pm_qos before
+ entering idle
+
+From: Tim Chen <tim.c.chen@linux.intel.com>
+
+commit 333c5ae9948194428fe6c5ef5c088304fc98263b upstream.
+
+Thanks to the reviews and comments by Rafael, James, Mark and Andi.
+Here's version 2 of the patch incorporating your comments and also some
+update to my previous patch comments.
+
+I noticed that before entering idle state, the menu idle governor will
+look up the current pm_qos target value according to the list of qos
+requests received. This look up currently needs the acquisition of a
+lock to access the list of qos requests to find the qos target value,
+slowing down the entrance into idle state due to contention by multiple
+cpus to access this list. The contention is severe when there are a lot
+of cpus waking and going into idle. For example, for a simple workload
+that has 32 pair of processes ping ponging messages to each other, where
+64 cpu cores are active in test system, I see the following profile with
+37.82% of cpu cycles spent in contention of pm_qos_lock:
+
+- 37.82% swapper [kernel.kallsyms] [k]
+_raw_spin_lock_irqsave
+ - _raw_spin_lock_irqsave
+ - 95.65% pm_qos_request
+ menu_select
+ cpuidle_idle_call
+ - cpu_idle
+ 99.98% start_secondary
+
+A better approach will be to cache the updated pm_qos target value so
+reading it does not require lock acquisition as in the patch below.
+With this patch the contention for pm_qos_lock is removed and I saw a
+2.2X increase in throughput for my message passing workload.
+
+Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com>
+Acked-by: Andi Kleen <ak@linux.intel.com>
+Acked-by: James Bottomley <James.Bottomley@suse.de>
+Acked-by: mark gross <markgross@thegnar.org>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/pm_qos_params.h | 4 ++++
+ kernel/pm_qos_params.c | 37 +++++++++++++++++++++++++------------
+ 2 files changed, 29 insertions(+), 12 deletions(-)
+
+--- a/include/linux/pm_qos_params.h
++++ b/include/linux/pm_qos_params.h
+@@ -16,6 +16,10 @@
+ #define PM_QOS_NUM_CLASSES 4
+ #define PM_QOS_DEFAULT_VALUE -1
+
++#define PM_QOS_CPU_DMA_LAT_DEFAULT_VALUE (2000 * USEC_PER_SEC)
++#define PM_QOS_NETWORK_LAT_DEFAULT_VALUE (2000 * USEC_PER_SEC)
++#define PM_QOS_NETWORK_THROUGHPUT_DEFAULT_VALUE 0
++
+ struct pm_qos_request_list {
+ struct plist_node list;
+ int pm_qos_class;
+--- a/kernel/pm_qos_params.c
++++ b/kernel/pm_qos_params.c
+@@ -53,11 +53,17 @@ enum pm_qos_type {
+ PM_QOS_MIN /* return the smallest value */
+ };
+
++/*
++ * Note: The lockless read path depends on the CPU accessing
++ * target_value atomically. Atomic access is only guaranteed on all CPU
++ * types linux supports for 32 bit quantites
++ */
+ struct pm_qos_object {
+ struct plist_head requests;
+ struct blocking_notifier_head *notifiers;
+ struct miscdevice pm_qos_power_miscdev;
+ char *name;
++ s32 target_value; /* Do not change to 64 bit */
+ s32 default_value;
+ enum pm_qos_type type;
+ };
+@@ -70,7 +76,8 @@ static struct pm_qos_object cpu_dma_pm_q
+ .requests = PLIST_HEAD_INIT(cpu_dma_pm_qos.requests, pm_qos_lock),
+ .notifiers = &cpu_dma_lat_notifier,
+ .name = "cpu_dma_latency",
+- .default_value = 2000 * USEC_PER_SEC,
++ .target_value = PM_QOS_CPU_DMA_LAT_DEFAULT_VALUE,
++ .default_value = PM_QOS_CPU_DMA_LAT_DEFAULT_VALUE,
+ .type = PM_QOS_MIN,
+ };
+
+@@ -79,7 +86,8 @@ static struct pm_qos_object network_lat_
+ .requests = PLIST_HEAD_INIT(network_lat_pm_qos.requests, pm_qos_lock),
+ .notifiers = &network_lat_notifier,
+ .name = "network_latency",
+- .default_value = 2000 * USEC_PER_SEC,
++ .target_value = PM_QOS_NETWORK_LAT_DEFAULT_VALUE,
++ .default_value = PM_QOS_NETWORK_LAT_DEFAULT_VALUE,
+ .type = PM_QOS_MIN
+ };
+
+@@ -89,7 +97,8 @@ static struct pm_qos_object network_thro
+ .requests = PLIST_HEAD_INIT(network_throughput_pm_qos.requests, pm_qos_lock),
+ .notifiers = &network_throughput_notifier,
+ .name = "network_throughput",
+- .default_value = 0,
++ .target_value = PM_QOS_NETWORK_THROUGHPUT_DEFAULT_VALUE,
++ .default_value = PM_QOS_NETWORK_THROUGHPUT_DEFAULT_VALUE,
+ .type = PM_QOS_MAX,
+ };
+
+@@ -132,6 +141,16 @@ static inline int pm_qos_get_value(struc
+ }
+ }
+
++static inline s32 pm_qos_read_value(struct pm_qos_object *o)
++{
++ return o->target_value;
++}
++
++static inline void pm_qos_set_value(struct pm_qos_object *o, s32 value)
++{
++ o->target_value = value;
++}
++
+ static void update_target(struct pm_qos_object *o, struct plist_node *node,
+ int del, int value)
+ {
+@@ -156,6 +175,7 @@ static void update_target(struct pm_qos_
+ plist_add(node, &o->requests);
+ }
+ curr_value = pm_qos_get_value(o);
++ pm_qos_set_value(o, curr_value);
+ spin_unlock_irqrestore(&pm_qos_lock, flags);
+
+ if (prev_value != curr_value)
+@@ -190,18 +210,11 @@ static int find_pm_qos_object_by_minor(i
+ * pm_qos_request - returns current system wide qos expectation
+ * @pm_qos_class: identification of which qos value is requested
+ *
+- * This function returns the current target value in an atomic manner.
++ * This function returns the current target value.
+ */
+ int pm_qos_request(int pm_qos_class)
+ {
+- unsigned long flags;
+- int value;
+-
+- spin_lock_irqsave(&pm_qos_lock, flags);
+- value = pm_qos_get_value(pm_qos_array[pm_qos_class]);
+- spin_unlock_irqrestore(&pm_qos_lock, flags);
+-
+- return value;
++ return pm_qos_read_value(pm_qos_array[pm_qos_class]);
+ }
+ EXPORT_SYMBOL_GPL(pm_qos_request);
+
--- /dev/null
+From 43f67c98161c65f1b2e3af3a9ce6741850072c06 Mon Sep 17 00:00:00 2001
+From: Kevin Cernekee <cernekee@gmail.com>
+Date: Tue, 10 May 2011 15:47:16 -0700
+Subject: kbuild: Fix GNU make v3.80 compatibility
+
+From: Kevin Cernekee <cernekee@gmail.com>
+
+commit 43f67c98161c65f1b2e3af3a9ce6741850072c06 upstream.
+
+According to Documentation/Changes, the kernel should be buildable with
+GNU make 3.80+. Commit 88d7be031f9f975bb3f50a0b5ef3796a671e7edf (kbuild:
+Use a single clean rule for kernel and external modules) introduced the
+"$(or" construct, which requires make 3.81. This causes "make clean" to
+malfunction when it is used with external modules.
+
+Replace "$(or" with an equivalent "$(if" expression, to restore backward
+compatibility.
+
+Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
+Signed-off-by: Michal Marek <mmarek@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Makefile
++++ b/Makefile
+@@ -1368,7 +1368,7 @@ endif # KBUILD_EXTMOD
+ clean: $(clean-dirs)
+ $(call cmd,rmdirs)
+ $(call cmd,rmfiles)
+- @find $(or $(KBUILD_EXTMOD), .) $(RCS_FIND_IGNORE) \
++ @find $(if $(KBUILD_EXTMOD), $(KBUILD_EXTMOD), .) $(RCS_FIND_IGNORE) \
+ \( -name '*.[oas]' -o -name '*.ko' -o -name '.*.cmd' \
+ -o -name '.*.d' -o -name '.*.tmp' -o -name '*.mod.c' \
+ -o -name '*.symtypes' -o -name 'modules.order' \
--- /dev/null
+From 0ced63d1a245ac11241a5d37932e6d04d9c8040d Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Thu, 26 May 2011 14:26:35 -0400
+Subject: NFSv4: Handle expired stateids when the lease is still valid
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit 0ced63d1a245ac11241a5d37932e6d04d9c8040d upstream.
+
+Currently, if the server returns NFS4ERR_EXPIRED in reply to a READ or
+WRITE, but the RENEW test determines that the lease is still active, we
+fail to recover and end up looping forever in a READ/WRITE + RENEW death
+spiral.
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/nfs4proc.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -258,9 +258,11 @@ static int nfs4_handle_exception(const s
+ break;
+ nfs4_schedule_stateid_recovery(server, state);
+ goto wait_on_recovery;
++ case -NFS4ERR_EXPIRED:
++ if (state != NULL)
++ nfs4_schedule_stateid_recovery(server, state);
+ case -NFS4ERR_STALE_STATEID:
+ case -NFS4ERR_STALE_CLIENTID:
+- case -NFS4ERR_EXPIRED:
+ nfs4_schedule_lease_recovery(clp);
+ goto wait_on_recovery;
+ #if defined(CONFIG_NFS_V4_1)
+@@ -3504,9 +3506,11 @@ nfs4_async_handle_error(struct rpc_task
+ break;
+ nfs4_schedule_stateid_recovery(server, state);
+ goto wait_on_recovery;
++ case -NFS4ERR_EXPIRED:
++ if (state != NULL)
++ nfs4_schedule_stateid_recovery(server, state);
+ case -NFS4ERR_STALE_STATEID:
+ case -NFS4ERR_STALE_CLIENTID:
+- case -NFS4ERR_EXPIRED:
+ nfs4_schedule_lease_recovery(clp);
+ goto wait_on_recovery;
+ #if defined(CONFIG_NFS_V4_1)
+@@ -4397,6 +4401,7 @@ int nfs4_lock_delegation_recall(struct n
+ case -ESTALE:
+ goto out;
+ case -NFS4ERR_EXPIRED:
++ nfs4_schedule_stateid_recovery(server, state);
+ case -NFS4ERR_STALE_CLIENTID:
+ case -NFS4ERR_STALE_STATEID:
+ nfs4_schedule_lease_recovery(server->nfs_client);
--- /dev/null
+From 444f72fe7e7b5f4db34cee933fa3546ebb8e9122 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Thu, 26 May 2011 14:26:35 -0400
+Subject: NFSv4.1: Fix the handling of NFS4ERR_SEQ_MISORDERED errors
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit 444f72fe7e7b5f4db34cee933fa3546ebb8e9122 upstream.
+
+Currently, the call to nfs4_schedule_session_recovery() will actually just
+result in a test of the lease when what we really want is to force a
+session reset.
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/nfs4state.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -1446,7 +1446,10 @@ static int nfs4_reclaim_lease(struct nfs
+ #ifdef CONFIG_NFS_V4_1
+ void nfs4_schedule_session_recovery(struct nfs4_session *session)
+ {
+- nfs4_schedule_lease_recovery(session->clp);
++ struct nfs_client *clp = session->clp;
++
++ set_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state);
++ nfs4_schedule_lease_recovery(clp);
+ }
+
+ void nfs41_handle_recall_slot(struct nfs_client *clp)
+@@ -1528,6 +1531,7 @@ static int nfs4_reset_session(struct nfs
+ status = nfs4_recovery_handle_error(clp, status);
+ goto out;
+ }
++ clear_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state);
+ /* create_session negotiated new slot table */
+ clear_bit(NFS4CLNT_RECALL_SLOT, &clp->cl_state);
+
--- /dev/null
+From 63c4408074cbcc070ac17fc10e524800eb9bd0b0 Mon Sep 17 00:00:00 2001
+From: Hemant Pedanekar <hemantp@ti.com>
+Date: Tue, 5 Apr 2011 12:32:50 +0530
+Subject: PCI: Add quirk for setting valid class for TI816X Endpoint
+
+From: Hemant Pedanekar <hemantp@ti.com>
+
+commit 63c4408074cbcc070ac17fc10e524800eb9bd0b0 upstream.
+
+TI816X (common name for DM816x/C6A816x/AM389x family) devices configured
+to boot as PCIe Endpoint have class code = 0. This makes kernel PCI bus
+code to skip allocating BARs to these devices resulting into following
+type of error when trying to enable them:
+
+"Device 0000:01:00.0 not available because of resource collisions"
+
+The device cannot be operated because of the above issue.
+
+This patch adds a ID specific (TI VENDOR ID and 816X DEVICE ID based)
+'early' fixup quirk to replace class code with
+PCI_CLASS_MULTIMEDIA_VIDEO as class.
+
+Signed-off-by: Hemant Pedanekar <hemantp@ti.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/quirks.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2784,6 +2784,16 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_IN
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x3c28, vtd_mask_spec_errors);
+ #endif
+
++static void __devinit fixup_ti816x_class(struct pci_dev* dev)
++{
++ /* TI 816x devices do not have class code set when in PCIe boot mode */
++ if (dev->class == PCI_CLASS_NOT_DEFINED) {
++ dev_info(&dev->dev, "Setting PCI class for 816x PCIe device\n");
++ dev->class = PCI_CLASS_MULTIMEDIA_VIDEO;
++ }
++}
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_TI, 0xb800, fixup_ti816x_class);
++
+ static void pci_do_fixups(struct pci_dev *dev, struct pci_fixup *f,
+ struct pci_fixup *end)
+ {
sh-fixup-fpu.o-compile-order.patch
p54usb-add-zoom-4410-usbid.patch
ecryptfs-allow-2-scatterlist-entries-for-encrypted.patch
+ubifs-fix-a-rare-memory-leak-in-ro-to-rw-remounting-path.patch
+kbuild-fix-gnu-make-v3.80-compatibility.patch
+i8k-avoid-lahf-in-64-bit-code.patch
+cpuidle-menu-fixed-wrapping-timers-at-4.294-seconds.patch
+idle-governor-avoid-lock-acquisition-to-read-pm_qos-before.patch
+dm-table-reject-devices-without-request-fns.patch
+arm-6941-1-cache-ensure-mva-is-cacheline-aligned-in.patch
+tmpfs-fix-race-between-truncate-and-writepage.patch
+atm-expose-atm-device-index-in-sysfs.patch
+brd-limit-max_part-module-param-to-disk_max_parts.patch
+brd-handle-on-demand-devices-correctly.patch
+drm-i915-fix-user-irq-miss-in-bsd-ring-on-g4x.patch
+drm-radeon-evergreen-btc-fusion-setup-hdp-to-invalidate-and.patch
+drm-radeon-kms-add-wait-idle-ioctl-for-eg-cayman.patch
+sunrpc-deal-with-the-lack-of-a-syn_sent-sk-sk_state_change.patch
+nfsv4-handle-expired-stateids-when-the-lease-is-still-valid.patch
+nfsv4.1-fix-the-handling-of-nfs4err_seq_misordered-errors.patch
+pci-add-quirk-for-setting-valid-class-for-ti816x-endpoint.patch
+xen-mmu-fix-a-race-window-causing-leave_mm-bug.patch
--- /dev/null
+From fe19a96b10032035a35779f42ad59e35d6dd8ffd Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Fri, 18 Mar 2011 20:21:23 -0400
+Subject: SUNRPC: Deal with the lack of a SYN_SENT sk->sk_state_change
+ callback...
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit fe19a96b10032035a35779f42ad59e35d6dd8ffd upstream.
+
+The TCP connection state code depends on the state_change() callback
+being called when the SYN_SENT state is set. However the networking layer
+doesn't actually call us back in that case.
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/xprtsock.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -1344,7 +1344,6 @@ static void xs_tcp_state_change(struct s
+ case TCP_CLOSE_WAIT:
+ /* The server initiated a shutdown of the socket */
+ xprt_force_disconnect(xprt);
+- case TCP_SYN_SENT:
+ xprt->connect_cookie++;
+ case TCP_CLOSING:
+ /*
+@@ -1758,6 +1757,7 @@ static void xs_tcp_reuse_connection(stru
+ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
+ {
+ struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
++ int ret = -ENOTCONN;
+
+ if (!transport->inet) {
+ struct sock *sk = sock->sk;
+@@ -1789,12 +1789,22 @@ static int xs_tcp_finish_connecting(stru
+ }
+
+ if (!xprt_bound(xprt))
+- return -ENOTCONN;
++ goto out;
+
+ /* Tell the socket layer to start connecting... */
+ xprt->stat.connect_count++;
+ xprt->stat.connect_start = jiffies;
+- return kernel_connect(sock, xs_addr(xprt), xprt->addrlen, O_NONBLOCK);
++ ret = kernel_connect(sock, xs_addr(xprt), xprt->addrlen, O_NONBLOCK);
++ switch (ret) {
++ case 0:
++ case -EINPROGRESS:
++ /* SYN_SENT! */
++ xprt->connect_cookie++;
++ if (xprt->reestablish_timeout < XS_TCP_INIT_REEST_TO)
++ xprt->reestablish_timeout = XS_TCP_INIT_REEST_TO;
++ }
++out:
++ return ret;
+ }
+
+ /**
--- /dev/null
+From 826267cf1e6c6899eda1325a19f1b1d15c558b20 Mon Sep 17 00:00:00 2001
+From: Hugh Dickins <hughd@google.com>
+Date: Sat, 28 May 2011 13:14:09 -0700
+Subject: tmpfs: fix race between truncate and writepage
+
+From: Hugh Dickins <hughd@google.com>
+
+commit 826267cf1e6c6899eda1325a19f1b1d15c558b20 upstream.
+
+While running fsx on tmpfs with a memhog then swapoff, swapoff was hanging
+(interruptibly), repeatedly failing to locate the owner of a 0xff entry in
+the swap_map.
+
+Although shmem_writepage() does abandon when it sees incoming page index
+is beyond eof, there was still a window in which shmem_truncate_range()
+could come in between writepage's dropping lock and updating swap_map,
+find the half-completed swap_map entry, and in trying to free it,
+leave it in a state that swap_shmem_alloc() could not correct.
+
+Arguably a bug in __swap_duplicate()'s and swap_entry_free()'s handling
+of the different cases, but easiest to fix by moving swap_shmem_alloc()
+under cover of the lock.
+
+More interesting than the bug: it's been there since 2.6.33, why could
+I not see it with earlier kernels? The mmotm of two weeks ago seems to
+have some magic for generating races, this is just one of three I found.
+
+With yesterday's git I first saw this in mainline, bisected in search of
+that magic, but the easy reproducibility evaporated. Oh well, fix the bug.
+
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/shmem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -1102,8 +1102,8 @@ static int shmem_writepage(struct page *
+ remove_from_page_cache(page);
+ shmem_swp_set(info, entry, swap.val);
+ shmem_swp_unmap(entry);
+- spin_unlock(&info->lock);
+ swap_shmem_alloc(swap);
++ spin_unlock(&info->lock);
+ BUG_ON(page_mapped(page));
+ page_cache_release(page); /* pagecache ref */
+ swap_writepage(page, wbc);
--- /dev/null
+From eaeee242c531cd4b0a4a46e8b5dd7ef504380c42 Mon Sep 17 00:00:00 2001
+From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Date: Fri, 6 May 2011 17:08:56 +0300
+Subject: UBIFS: fix a rare memory leak in ro to rw remounting path
+
+From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+
+commit eaeee242c531cd4b0a4a46e8b5dd7ef504380c42 upstream.
+
+When re-mounting from R/O mode to R/W mode and the LEB count in the superblock
+is not up-to date, because for the underlying UBI volume became larger, we
+re-write the superblock. We allocate RAM for these purposes, but never free it.
+So this is a memory leak, although very rare one.
+
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ubifs/sb.c | 3 ++-
+ fs/ubifs/super.c | 1 +
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+--- a/fs/ubifs/sb.c
++++ b/fs/ubifs/sb.c
+@@ -475,7 +475,8 @@ failed:
+ * @c: UBIFS file-system description object
+ *
+ * This function returns a pointer to the superblock node or a negative error
+- * code.
++ * code. Note, the user of this function is responsible of kfree()'ing the
++ * returned superblock buffer.
+ */
+ struct ubifs_sb_node *ubifs_read_sb_node(struct ubifs_info *c)
+ {
+--- a/fs/ubifs/super.c
++++ b/fs/ubifs/super.c
+@@ -1560,6 +1560,7 @@ static int ubifs_remount_rw(struct ubifs
+ }
+ sup->leb_cnt = cpu_to_le32(c->leb_cnt);
+ err = ubifs_write_sb_node(c, sup);
++ kfree(sup);
+ if (err)
+ goto out;
+ }
--- /dev/null
+From 7899891c7d161752f29abcc9bc0a9c6c3a3af26c Mon Sep 17 00:00:00 2001
+From: "Tian, Kevin" <kevin.tian@intel.com>
+Date: Thu, 12 May 2011 10:56:08 +0800
+Subject: xen mmu: fix a race window causing leave_mm BUG()
+
+From: "Tian, Kevin" <kevin.tian@intel.com>
+
+commit 7899891c7d161752f29abcc9bc0a9c6c3a3af26c upstream.
+
+There's a race window in xen_drop_mm_ref, where remote cpu may exit
+dirty bitmap between the check on this cpu and the point where remote
+cpu handles drop request. So in drop_other_mm_ref we need check
+whether TLB state is still lazy before calling into leave_mm. This
+bug is rarely observed in earlier kernel, but exaggerated by the
+commit 831d52bc153971b70e64eccfbed2b232394f22f8
+("x86, mm: avoid possible bogus tlb entries by clearing prev mm_cpumask after switching mm")
+which clears bitmap after changing the TLB state. the call trace is as below:
+
+---------------------------------
+kernel BUG at arch/x86/mm/tlb.c:61!
+invalid opcode: 0000 [#1] SMP
+last sysfs file: /sys/devices/system/xen_memory/xen_memory0/info/current_kb
+CPU 1
+Modules linked in: 8021q garp xen_netback xen_blkback blktap blkback_pagemap nbd bridge stp llc autofs4 ipmi_devintf ipmi_si ipmi_msghandler lockd sunrpc bonding ipv6 xenfs dm_multipath video output sbs sbshc parport_pc lp parport ses enclosure snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device serio_raw bnx2 snd_pcm_oss snd_mixer_oss snd_pcm snd_timer iTCO_wdt snd soundcore snd_page_alloc i2c_i801 iTCO_vendor_support i2c_core pcs pkr pata_acpi ata_generic ata_piix shpchp mptsas mptscsih mptbase [last unloaded: freq_table]
+Pid: 25581, comm: khelper Not tainted 2.6.32.36fixxen #1 Tecal RH2285
+RIP: e030:[<ffffffff8103a3cb>] [<ffffffff8103a3cb>] leave_mm+0x15/0x46
+RSP: e02b:ffff88002805be48 EFLAGS: 00010046
+RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffff88015f8e2da0
+RDX: ffff88002805be78 RSI: 0000000000000000 RDI: 0000000000000001
+RBP: ffff88002805be48 R08: ffff88009d662000 R09: dead000000200200
+R10: dead000000100100 R11: ffffffff814472b2 R12: ffff88009bfc1880
+R13: ffff880028063020 R14: 00000000000004f6 R15: 0000000000000000
+FS: 00007f62362d66e0(0000) GS:ffff880028058000(0000) knlGS:0000000000000000
+CS: e033 DS: 0000 ES: 0000 CR0: 000000008005003b
+CR2: 0000003aabc11909 CR3: 000000009b8ca000 CR4: 0000000000002660
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 00000000000000 00
+DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+Process khelper (pid: 25581, threadinfo ffff88007691e000, task ffff88009b92db40)
+Stack:
+ ffff88002805be68 ffffffff8100e4ae 0000000000000001 ffff88009d733b88
+<0> ffff88002805be98 ffffffff81087224 ffff88002805be78 ffff88002805be78
+<0> ffff88015f808360 00000000000004f6 ffff88002805bea8 ffffffff81010108
+Call Trace:
+ <IRQ>
+ [<ffffffff8100e4ae>] drop_other_mm_ref+0x2a/0x53
+ [<ffffffff81087224>] generic_smp_call_function_single_interrupt+0xd8/0xfc
+ [<ffffffff81010108>] xen_call_function_single_interrupt+0x13/0x28
+ [<ffffffff810a936a>] handle_IRQ_event+0x66/0x120
+ [<ffffffff810aac5b>] handle_percpu_irq+0x41/0x6e
+ [<ffffffff8128c1c0>] __xen_evtchn_do_upcall+0x1ab/0x27d
+ [<ffffffff8128dd11>] xen_evtchn_do_upcall+0x33/0x46
+ [<ffffffff81013efe>] xen_do_hyper visor_callback+0x1e/0x30
+ <EOI>
+ [<ffffffff814472b2>] ? _spin_unlock_irqrestore+0x15/0x17
+ [<ffffffff8100f8cf>] ? xen_restore_fl_direct_end+0x0/0x1
+ [<ffffffff81113f71>] ? flush_old_exec+0x3ac/0x500
+ [<ffffffff81150dc5>] ? load_elf_binary+0x0/0x17ef
+ [<ffffffff81150dc5>] ? load_elf_binary+0x0/0x17ef
+ [<ffffffff8115115d>] ? load_elf_binary+0x398/0x17ef
+ [<ffffffff81042fcf>] ? need_resched+0x23/0x2d
+ [<ffffffff811f4648>] ? process_measurement+0xc0/0xd7
+ [<ffffffff81150dc5>] ? load_elf_binary+0x0/0x17ef
+ [<ffffffff81113094>] ? search_binary_handler+0xc8/0x255
+ [<ffffffff81114362>] ? do_execve+0x1c3/0x29e
+ [<ffffffff8101155d>] ? sys_execve+0x43/0x5d
+ [<ffffffff8106fc45>] ? __call_usermodehelper+0x0/0x6f
+ [<ffffffff81013e28>] ? kernel_execve+0x68/0xd0
+ [<ffffffff 8106fc45>] ? __call_usermodehelper+0x0/0x6f
+ [<ffffffff8100f8cf>] ? xen_restore_fl_direct_end+0x0/0x1
+ [<ffffffff8106fb64>] ? ____call_usermodehelper+0x113/0x11e
+ [<ffffffff81013daa>] ? child_rip+0xa/0x20
+ [<ffffffff8106fc45>] ? __call_usermodehelper+0x0/0x6f
+ [<ffffffff81012f91>] ? int_ret_from_sys_call+0x7/0x1b
+ [<ffffffff8101371d>] ? retint_restore_args+0x5/0x6
+ [<ffffffff81013da0>] ? child_rip+0x0/0x20
+Code: 41 5e 41 5f c9 c3 55 48 89 e5 0f 1f 44 00 00 e8 17 ff ff ff c9 c3 55 48 89 e5 0f 1f 44 00 00 65 8b 04 25 c8 55 01 00 ff c8 75 04 <0f> 0b eb fe 65 48 8b 34 25 c0 55 01 00 48 81 c6 b8 02 00 00 e8
+RIP [<ffffffff8103a3cb>] leave_mm+0x15/0x46
+ RSP <ffff88002805be48>
+---[ end trace ce9cee6832a9c503 ]---
+
+Tested-by: Maoxiaoyun<tinnycloud@hotmail.com>
+Signed-off-by: Kevin Tian <kevin.tian@intel.com>
+[v1: Fleshed out the git description a bit]
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/xen/mmu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/xen/mmu.c
++++ b/arch/x86/xen/mmu.c
+@@ -1138,7 +1138,7 @@ static void drop_other_mm_ref(void *info
+
+ active_mm = percpu_read(cpu_tlbstate.active_mm);
+
+- if (active_mm == mm)
++ if (active_mm == mm && percpu_read(cpu_tlbstate.state) != TLBSTATE_OK)
+ leave_mm(smp_processor_id());
+
+ /* If this cpu still has a stale cr3 reference, then make sure
projects / thirdparty / kernel / stable-queue.git / commitdiff
