--- /dev/null
+From 98d21df431ad55281e1abf780f8d51e3391900b2 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 18 Mar 2011 07:31:53 +0100
+Subject: ALSA: aloop - Fix possible IRQ lock inversion
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 98d21df431ad55281e1abf780f8d51e3391900b2 upstream.
+
+loopback_pos_update() can be called in the timer callback, thus the lock
+held should be irq-safe. Otherwise you'll get AB/BA deadlock together
+with substream->self_group.lock.
+
+Reported-and-tested-by: Knut Petersen <Knut_Petersen@t-online.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/drivers/aloop.c | 19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+--- a/sound/drivers/aloop.c
++++ b/sound/drivers/aloop.c
+@@ -482,8 +482,9 @@ static unsigned int loopback_pos_update(
+ cable->streams[SNDRV_PCM_STREAM_CAPTURE];
+ unsigned long delta_play = 0, delta_capt = 0;
+ unsigned int running;
++ unsigned long flags;
+
+- spin_lock(&cable->lock);
++ spin_lock_irqsave(&cable->lock, flags);
+ running = cable->running ^ cable->pause;
+ if (running & (1 << SNDRV_PCM_STREAM_PLAYBACK)) {
+ delta_play = jiffies - dpcm_play->last_jiffies;
+@@ -495,10 +496,8 @@ static unsigned int loopback_pos_update(
+ dpcm_capt->last_jiffies += delta_capt;
+ }
+
+- if (delta_play == 0 && delta_capt == 0) {
+- spin_unlock(&cable->lock);
+- return running;
+- }
++ if (delta_play == 0 && delta_capt == 0)
++ goto unlock;
+
+ if (delta_play > delta_capt) {
+ loopback_bytepos_update(dpcm_play, delta_play - delta_capt,
+@@ -510,14 +509,14 @@ static unsigned int loopback_pos_update(
+ delta_capt = delta_play;
+ }
+
+- if (delta_play == 0 && delta_capt == 0) {
+- spin_unlock(&cable->lock);
+- return running;
+- }
++ if (delta_play == 0 && delta_capt == 0)
++ goto unlock;
++
+ /* note delta_capt == delta_play at this moment */
+ loopback_bytepos_update(dpcm_capt, delta_capt, BYTEPOS_UPDATE_COPY);
+ loopback_bytepos_update(dpcm_play, delta_play, BYTEPOS_UPDATE_POSONLY);
+- spin_unlock(&cable->lock);
++ unlock:
++ spin_unlock_irqrestore(&cable->lock, flags);
+ return running;
+ }
+
--- /dev/null
+From efed5f26664f93991c929d5bb343e65f900d72bc Mon Sep 17 00:00:00 2001
+From: Przemyslaw Bruski <pbruskispam@op.pl>
+Date: Sun, 13 Mar 2011 16:18:58 +0100
+Subject: ALSA: ctxfi - Clear input settings before initialization
+
+From: Przemyslaw Bruski <pbruskispam@op.pl>
+
+commit efed5f26664f93991c929d5bb343e65f900d72bc upstream.
+
+Clear input settings before initialization.
+
+Signed-off-by: Przemyslaw Bruski <pbruskispam@op.pl>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/ctxfi/ctdaio.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/ctxfi/ctdaio.c
++++ b/sound/pci/ctxfi/ctdaio.c
+@@ -176,6 +176,7 @@ static int dao_set_left_input(struct dao
+ if (!entry)
+ return -ENOMEM;
+
++ dao->ops->clear_left_input(dao);
+ /* Program master and conjugate resources */
+ input->ops->master(input);
+ daio->rscl.ops->master(&daio->rscl);
+@@ -204,6 +205,7 @@ static int dao_set_right_input(struct da
+ if (!entry)
+ return -ENOMEM;
+
++ dao->ops->clear_right_input(dao);
+ /* Program master and conjugate resources */
+ input->ops->master(input);
+ daio->rscr.ops->master(&daio->rscr);
--- /dev/null
+From 4c1847e884efddcc3ede371f7839e5e65b25c34d Mon Sep 17 00:00:00 2001
+From: Przemyslaw Bruski <pbruskispam@op.pl>
+Date: Sun, 13 Mar 2011 16:18:56 +0100
+Subject: ALSA: ctxfi - Fix incorrect SPDIF status bit mask
+
+From: Przemyslaw Bruski <pbruskispam@op.pl>
+
+commit 4c1847e884efddcc3ede371f7839e5e65b25c34d upstream.
+
+SPDIF status mask creation was incorrect.
+
+Signed-off-by: Przemyslaw Bruski <pbruskispam@op.pl>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/ctxfi/ctatc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/ctxfi/ctatc.c
++++ b/sound/pci/ctxfi/ctatc.c
+@@ -869,7 +869,7 @@ spdif_passthru_playback_setup(struct ct_
+ mutex_lock(&atc->atc_mutex);
+ dao->ops->get_spos(dao, &status);
+ if (((status >> 24) & IEC958_AES3_CON_FS) != iec958_con_fs) {
+- status &= ((~IEC958_AES3_CON_FS) << 24);
++ status &= ~(IEC958_AES3_CON_FS << 24);
+ status |= (iec958_con_fs << 24);
+ dao->ops->set_spos(dao, status);
+ dao->ops->commit_write(dao);
--- /dev/null
+From f164753a263bfd2daaf3e0273b179de7e099c57d Mon Sep 17 00:00:00 2001
+From: Przemyslaw Bruski <pbruskispam@op.pl>
+Date: Sun, 13 Mar 2011 16:18:57 +0100
+Subject: ALSA: ctxfi - Fix SPDIF status retrieval
+
+From: Przemyslaw Bruski <pbruskispam@op.pl>
+
+commit f164753a263bfd2daaf3e0273b179de7e099c57d upstream.
+
+SDPIF status retrieval always returned the default settings instead of
+the actual ones.
+
+Signed-off-by: Przemyslaw Bruski <pbruskispam@op.pl>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/ctxfi/ctmixer.c | 19 +++++--------------
+ 1 file changed, 5 insertions(+), 14 deletions(-)
+
+--- a/sound/pci/ctxfi/ctmixer.c
++++ b/sound/pci/ctxfi/ctmixer.c
+@@ -566,19 +566,6 @@ static int ct_spdif_get_mask(struct snd_
+ return 0;
+ }
+
+-static int ct_spdif_default_get(struct snd_kcontrol *kcontrol,
+- struct snd_ctl_elem_value *ucontrol)
+-{
+- unsigned int status = SNDRV_PCM_DEFAULT_CON_SPDIF;
+-
+- ucontrol->value.iec958.status[0] = (status >> 0) & 0xff;
+- ucontrol->value.iec958.status[1] = (status >> 8) & 0xff;
+- ucontrol->value.iec958.status[2] = (status >> 16) & 0xff;
+- ucontrol->value.iec958.status[3] = (status >> 24) & 0xff;
+-
+- return 0;
+-}
+-
+ static int ct_spdif_get(struct snd_kcontrol *kcontrol,
+ struct snd_ctl_elem_value *ucontrol)
+ {
+@@ -586,6 +573,10 @@ static int ct_spdif_get(struct snd_kcont
+ unsigned int status;
+
+ atc->spdif_out_get_status(atc, &status);
++
++ if (status == 0)
++ status = SNDRV_PCM_DEFAULT_CON_SPDIF;
++
+ ucontrol->value.iec958.status[0] = (status >> 0) & 0xff;
+ ucontrol->value.iec958.status[1] = (status >> 8) & 0xff;
+ ucontrol->value.iec958.status[2] = (status >> 16) & 0xff;
+@@ -629,7 +620,7 @@ static struct snd_kcontrol_new iec958_de
+ .name = SNDRV_CTL_NAME_IEC958("", PLAYBACK, DEFAULT),
+ .count = 1,
+ .info = ct_spdif_info,
+- .get = ct_spdif_default_get,
++ .get = ct_spdif_get,
+ .put = ct_spdif_put,
+ .private_value = MIXER_IEC958_DEFAULT
+ };
--- /dev/null
+From 094a42452abd5564429045e210281c6d22e67fca Mon Sep 17 00:00:00 2001
+From: Vitaliy Kulikov <Vitaliy.Kulikov@idt.com>
+Date: Wed, 9 Mar 2011 19:47:43 -0600
+Subject: ALSA: hda - fix digital mic selection in mixer on 92HD8X codecs
+
+From: Vitaliy Kulikov <Vitaliy.Kulikov@idt.com>
+
+commit 094a42452abd5564429045e210281c6d22e67fca upstream.
+
+When the mux for digital mic is different from the mux for other mics,
+the current auto-parser doesn't handle them in a right way but provides
+only one mic. This patch fixes the issue.
+
+Signed-off-by: Vitaliy Kulikov <Vitaliy.Kulikov@idt.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -749,7 +749,7 @@ static int stac92xx_mux_enum_put(struct
+ struct sigmatel_spec *spec = codec->spec;
+ unsigned int adc_idx = snd_ctl_get_ioffidx(kcontrol, &ucontrol->id);
+ const struct hda_input_mux *imux = spec->input_mux;
+- unsigned int idx, prev_idx;
++ unsigned int idx, prev_idx, didx;
+
+ idx = ucontrol->value.enumerated.item[0];
+ if (idx >= imux->num_items)
+@@ -761,7 +761,8 @@ static int stac92xx_mux_enum_put(struct
+ snd_hda_codec_write_cache(codec, spec->mux_nids[adc_idx], 0,
+ AC_VERB_SET_CONNECT_SEL,
+ imux->items[idx].index);
+- if (prev_idx >= spec->num_analog_muxes) {
++ if (prev_idx >= spec->num_analog_muxes &&
++ spec->mux_nids[adc_idx] != spec->dmux_nids[adc_idx]) {
+ imux = spec->dinput_mux;
+ /* 0 = analog */
+ snd_hda_codec_write_cache(codec,
+@@ -771,9 +772,13 @@ static int stac92xx_mux_enum_put(struct
+ }
+ } else {
+ imux = spec->dinput_mux;
++ /* first dimux item is hardcoded to select analog imux,
++ * so lets skip it
++ */
++ didx = idx - spec->num_analog_muxes + 1;
+ snd_hda_codec_write_cache(codec, spec->dmux_nids[adc_idx], 0,
+ AC_VERB_SET_CONNECT_SEL,
+- imux->items[idx - 1].index);
++ imux->items[didx].index);
+ }
+ spec->cur_mux[adc_idx] = idx;
+ return 1;
--- /dev/null
+From 584c0c4c359bdac37d94157f8d7fc513d26c8328 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 10 Mar 2011 12:51:11 +0100
+Subject: ALSA: hda - Initialize special cases for input src in init phase
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 584c0c4c359bdac37d94157f8d7fc513d26c8328 upstream.
+
+Currently some special handling for the unusual case like dual-ADCs
+or a single-input-src is done in the tree-parse time in
+set_capture_mixer(). But this setup could be overwritten by static
+init verbs.
+
+This patch moves the initialization into the init phase so that
+such input-src setup won't be lost.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -393,6 +393,7 @@ struct alc_spec {
+ /* other flags */
+ unsigned int no_analog :1; /* digital I/O only */
+ unsigned int dual_adc_switch:1; /* switch ADCs (for ALC275) */
++ unsigned int single_input_src:1;
+ int init_amp;
+ int codec_variant; /* flag for other variants */
+
+@@ -3798,6 +3799,8 @@ static struct hda_amp_list alc880_lg_loo
+ * Common callbacks
+ */
+
++static void alc_init_special_input_src(struct hda_codec *codec);
++
+ static int alc_init(struct hda_codec *codec)
+ {
+ struct alc_spec *spec = codec->spec;
+@@ -3808,6 +3811,7 @@ static int alc_init(struct hda_codec *co
+
+ for (i = 0; i < spec->num_init_verbs; i++)
+ snd_hda_sequence_write(codec, spec->init_verbs[i]);
++ alc_init_special_input_src(codec);
+
+ if (spec->init_hook)
+ spec->init_hook(codec);
+@@ -5441,6 +5445,7 @@ static void fixup_single_adc(struct hda_
+ spec->capsrc_nids += i;
+ spec->adc_nids += i;
+ spec->num_adc_nids = 1;
++ spec->single_input_src = 1;
+ }
+ }
+
+@@ -5452,6 +5457,16 @@ static void fixup_dual_adc_switch(struct
+ init_capsrc_for_pin(codec, spec->int_mic.pin);
+ }
+
++/* initialize some special cases for input sources */
++static void alc_init_special_input_src(struct hda_codec *codec)
++{
++ struct alc_spec *spec = codec->spec;
++ if (spec->dual_adc_switch)
++ fixup_dual_adc_switch(codec);
++ else if (spec->single_input_src)
++ init_capsrc_for_pin(codec, spec->autocfg.inputs[0].pin);
++}
++
+ static void set_capture_mixer(struct hda_codec *codec)
+ {
+ struct alc_spec *spec = codec->spec;
+@@ -5467,7 +5482,7 @@ static void set_capture_mixer(struct hda
+ int mux = 0;
+ int num_adcs = spec->num_adc_nids;
+ if (spec->dual_adc_switch)
+- fixup_dual_adc_switch(codec);
++ num_adcs = 1;
+ else if (spec->auto_mic)
+ fixup_automic_adc(codec);
+ else if (spec->input_mux) {
+@@ -5476,8 +5491,6 @@ static void set_capture_mixer(struct hda
+ else if (spec->input_mux->num_items == 1)
+ fixup_single_adc(codec);
+ }
+- if (spec->dual_adc_switch)
+- num_adcs = 1;
+ spec->cap_mixer = caps[mux][num_adcs - 1];
+ }
+ }
--- /dev/null
+From 0a3fabe30e1a3b2037a12b863b8c45fffce38ee9 Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Fri, 4 Mar 2011 16:54:52 +0100
+Subject: ALSA: HDA: Realtek ALC88x: Do not over-initialize speakers and hp that are primary outputs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit 0a3fabe30e1a3b2037a12b863b8c45fffce38ee9 upstream.
+
+Do not initialize again the what has already been initialized as
+multi outs, as this breaks surround speakers.
+
+Tested-by: Bartłomiej Żogała <nusch88@gmail.com>
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 37 +++++++++++++++++++++----------------
+ 1 file changed, 21 insertions(+), 16 deletions(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10736,23 +10736,28 @@ static void alc882_auto_init_hp_out(stru
+ hda_nid_t pin, dac;
+ int i;
+
+- for (i = 0; i < ARRAY_SIZE(spec->autocfg.hp_pins); i++) {
+- pin = spec->autocfg.hp_pins[i];
+- if (!pin)
+- break;
+- dac = spec->multiout.hp_nid;
+- if (!dac)
+- dac = spec->multiout.dac_nids[0]; /* to front */
+- alc882_auto_set_output_and_unmute(codec, pin, PIN_HP, dac);
++ if (spec->autocfg.line_out_type != AUTO_PIN_HP_OUT) {
++ for (i = 0; i < ARRAY_SIZE(spec->autocfg.hp_pins); i++) {
++ pin = spec->autocfg.hp_pins[i];
++ if (!pin)
++ break;
++ dac = spec->multiout.hp_nid;
++ if (!dac)
++ dac = spec->multiout.dac_nids[0]; /* to front */
++ alc882_auto_set_output_and_unmute(codec, pin, PIN_HP, dac);
++ }
+ }
+- for (i = 0; i < ARRAY_SIZE(spec->autocfg.speaker_pins); i++) {
+- pin = spec->autocfg.speaker_pins[i];
+- if (!pin)
+- break;
+- dac = spec->multiout.extra_out_nid[0];
+- if (!dac)
+- dac = spec->multiout.dac_nids[0]; /* to front */
+- alc882_auto_set_output_and_unmute(codec, pin, PIN_OUT, dac);
++
++ if (spec->autocfg.line_out_type != AUTO_PIN_SPEAKER_OUT) {
++ for (i = 0; i < ARRAY_SIZE(spec->autocfg.speaker_pins); i++) {
++ pin = spec->autocfg.speaker_pins[i];
++ if (!pin)
++ break;
++ dac = spec->multiout.extra_out_nid[0];
++ if (!dac)
++ dac = spec->multiout.dac_nids[0]; /* to front */
++ alc882_auto_set_output_and_unmute(codec, pin, PIN_OUT, dac);
++ }
+ }
+ }
+
--- /dev/null
+From 4a122c10fbfe9020df469f0f669da129c5757671 Mon Sep 17 00:00:00 2001
+From: Dan Rosenberg <drosenberg@vsecurity.com>
+Date: Thu, 17 Mar 2011 18:32:24 -0400
+Subject: ALSA: sound/pci/asihpi: check adapter index in hpi_ioctl
+
+From: Dan Rosenberg <drosenberg@vsecurity.com>
+
+commit 4a122c10fbfe9020df469f0f669da129c5757671 upstream.
+
+The user-supplied index into the adapters array needs to be checked, or
+an out-of-bounds kernel pointer could be accessed and used, leading to
+potentially exploitable memory corruption.
+
+Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/asihpi/hpioctl.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/sound/pci/asihpi/hpioctl.c
++++ b/sound/pci/asihpi/hpioctl.c
+@@ -155,6 +155,11 @@ long asihpi_hpi_ioctl(struct file *file,
+ goto out;
+ }
+
++ if (hm->h.adapter_index >= HPI_MAX_ADAPTERS) {
++ err = -EINVAL;
++ goto out;
++ }
++
+ pa = &adapters[hm->h.adapter_index];
+ hr->h.size = 0;
+ if (hm->h.object == HPI_OBJ_SUBSYSTEM) {
--- /dev/null
+From 45a5791920ae643eafc02e2eedef1a58e341b736 Mon Sep 17 00:00:00 2001
+From: Milton Miller <miltonm@bga.com>
+Date: Tue, 15 Mar 2011 13:27:16 -0600
+Subject: call_function_many: add missing ordering
+
+From: Milton Miller <miltonm@bga.com>
+
+commit 45a5791920ae643eafc02e2eedef1a58e341b736 upstream.
+
+Paul McKenney's review pointed out two problems with the barriers in the
+2.6.38 update to the smp call function many code.
+
+First, a barrier that would force the func and info members of data to
+be visible before their consumption in the interrupt handler was
+missing. This can be solved by adding a smp_wmb between setting the
+func and info members and setting setting the cpumask; this will pair
+with the existing and required smp_rmb ordering the cpumask read before
+the read of refs. This placement avoids the need a second smp_rmb in
+the interrupt handler which would be executed on each of the N cpus
+executing the call request. (I was thinking this barrier was present
+but was not).
+
+Second, the previous write to refs (establishing the zero that we the
+interrupt handler was testing from all cpus) was performed by a third
+party cpu. This would invoke transitivity which, as a recient or
+concurrent addition to memory-barriers.txt now explicitly states, would
+require a full smp_mb().
+
+However, we know the cpumask will only be set by one cpu (the data
+owner) and any preivous iteration of the mask would have cleared by the
+reading cpu. By redundantly writing refs to 0 on the owning cpu before
+the smp_wmb, the write to refs will follow the same path as the writes
+that set the cpumask, which in turn allows us to keep the barrier in the
+interrupt handler a smp_rmb instead of promoting it to a smp_mb (which
+will be be executed by N cpus for each of the possible M elements on the
+list).
+
+I moved and expanded the comment about our (ab)use of the rcu list
+primitives for the concurrent walk earlier into this function. I
+considered moving the first two paragraphs to the queue list head and
+lock, but felt it would have been too disconected from the code.
+
+Cc: Paul McKinney <paulmck@linux.vnet.ibm.com>
+Signed-off-by: Milton Miller <miltonm@bga.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/smp.c | 46 +++++++++++++++++++++++++++++++++-------------
+ 1 file changed, 33 insertions(+), 13 deletions(-)
+
+--- a/kernel/smp.c
++++ b/kernel/smp.c
+@@ -473,23 +473,42 @@ void smp_call_function_many(const struct
+
+ data = &__get_cpu_var(cfd_data);
+ csd_lock(&data->csd);
+- BUG_ON(atomic_read(&data->refs) || !cpumask_empty(data->cpumask));
+
+- data->csd.func = func;
+- data->csd.info = info;
+- cpumask_and(data->cpumask, mask, cpu_online_mask);
+- cpumask_clear_cpu(this_cpu, data->cpumask);
++ /* This BUG_ON verifies our reuse assertions and can be removed */
++ BUG_ON(atomic_read(&data->refs) || !cpumask_empty(data->cpumask));
+
+ /*
++ * The global call function queue list add and delete are protected
++ * by a lock, but the list is traversed without any lock, relying
++ * on the rcu list add and delete to allow safe concurrent traversal.
+ * We reuse the call function data without waiting for any grace
+ * period after some other cpu removes it from the global queue.
+- * This means a cpu might find our data block as it is writen.
+- * The interrupt handler waits until it sees refs filled out
+- * while its cpu mask bit is set; here we may only clear our
+- * own cpu mask bit, and must wait to set refs until we are sure
+- * previous writes are complete and we have obtained the lock to
+- * add the element to the queue.
++ * This means a cpu might find our data block as it is being
++ * filled out.
++ *
++ * We hold off the interrupt handler on the other cpu by
++ * ordering our writes to the cpu mask vs our setting of the
++ * refs counter. We assert only the cpu owning the data block
++ * will set a bit in cpumask, and each bit will only be cleared
++ * by the subject cpu. Each cpu must first find its bit is
++ * set and then check that refs is set indicating the element is
++ * ready to be processed, otherwise it must skip the entry.
++ *
++ * On the previous iteration refs was set to 0 by another cpu.
++ * To avoid the use of transitivity, set the counter to 0 here
++ * so the wmb will pair with the rmb in the interrupt handler.
+ */
++ atomic_set(&data->refs, 0); /* convert 3rd to 1st party write */
++
++ data->csd.func = func;
++ data->csd.info = info;
++
++ /* Ensure 0 refs is visible before mask. Also orders func and info */
++ smp_wmb();
++
++ /* We rely on the "and" being processed before the store */
++ cpumask_and(data->cpumask, mask, cpu_online_mask);
++ cpumask_clear_cpu(this_cpu, data->cpumask);
+
+ raw_spin_lock_irqsave(&call_function.lock, flags);
+ /*
+@@ -499,8 +518,9 @@ void smp_call_function_many(const struct
+ */
+ list_add_rcu(&data->csd.list, &call_function.queue);
+ /*
+- * We rely on the wmb() in list_add_rcu to order the writes
+- * to func, data, and cpumask before this write to refs.
++ * We rely on the wmb() in list_add_rcu to complete our writes
++ * to the cpumask before this write to refs, which indicates
++ * data is on the list and is ready to be processed.
+ */
+ atomic_set(&data->refs, cpumask_weight(data->cpumask));
+ raw_spin_unlock_irqrestore(&call_function.lock, flags);
--- /dev/null
+From e6cd1e07a185d5f9b0aa75e020df02d3c1c44940 Mon Sep 17 00:00:00 2001
+From: Milton Miller <miltonm@bga.com>
+Date: Tue, 15 Mar 2011 13:27:16 -0600
+Subject: call_function_many: fix list delete vs add race
+
+From: Milton Miller <miltonm@bga.com>
+
+commit e6cd1e07a185d5f9b0aa75e020df02d3c1c44940 upstream.
+
+Peter pointed out there was nothing preventing the list_del_rcu in
+smp_call_function_interrupt from running before the list_add_rcu in
+smp_call_function_many.
+
+Fix this by not setting refs until we have gotten the lock for the list.
+Take advantage of the wmb in list_add_rcu to save an explicit additional
+one.
+
+I tried to force this race with a udelay before the lock & list_add and
+by mixing all 64 online cpus with just 3 random cpus in the mask, but
+was unsuccessful. Still, inspection shows a valid race, and the fix is
+a extension of the existing protection window in the current code.
+
+Reported-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Milton Miller <miltonm@bga.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/smp.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+--- a/kernel/smp.c
++++ b/kernel/smp.c
+@@ -481,14 +481,15 @@ void smp_call_function_many(const struct
+ cpumask_clear_cpu(this_cpu, data->cpumask);
+
+ /*
+- * To ensure the interrupt handler gets an complete view
+- * we order the cpumask and refs writes and order the read
+- * of them in the interrupt handler. In addition we may
+- * only clear our own cpu bit from the mask.
++ * We reuse the call function data without waiting for any grace
++ * period after some other cpu removes it from the global queue.
++ * This means a cpu might find our data block as it is writen.
++ * The interrupt handler waits until it sees refs filled out
++ * while its cpu mask bit is set; here we may only clear our
++ * own cpu mask bit, and must wait to set refs until we are sure
++ * previous writes are complete and we have obtained the lock to
++ * add the element to the queue.
+ */
+- smp_wmb();
+-
+- atomic_set(&data->refs, cpumask_weight(data->cpumask));
+
+ raw_spin_lock_irqsave(&call_function.lock, flags);
+ /*
+@@ -497,6 +498,11 @@ void smp_call_function_many(const struct
+ * will not miss any other list entries:
+ */
+ list_add_rcu(&data->csd.list, &call_function.queue);
++ /*
++ * We rely on the wmb() in list_add_rcu to order the writes
++ * to func, data, and cpumask before this write to refs.
++ */
++ atomic_set(&data->refs, cpumask_weight(data->cpumask));
+ raw_spin_unlock_irqrestore(&call_function.lock, flags);
+
+ /*
--- /dev/null
+From d7433142b63d727b5a217c37b1a1468b116a9771 Mon Sep 17 00:00:00 2001
+From: Eric Sandeen <sandeen@redhat.com>
+Date: Fri, 4 Mar 2011 16:04:08 -0600
+Subject: ext3: Always set dx_node's fake_dirent explicitly.
+
+From: Eric Sandeen <sandeen@redhat.com>
+
+commit d7433142b63d727b5a217c37b1a1468b116a9771 upstream.
+
+(crossport of 1f7bebb9e911d870fa8f997ddff838e82b5715ea
+by Andreas Schlick <schlick@lavabit.com>)
+
+When ext3_dx_add_entry() has to split an index node, it has to ensure that
+name_len of dx_node's fake_dirent is also zero, because otherwise e2fsck
+won't recognise it as an intermediate htree node and consider the htree to
+be corrupted.
+
+Signed-off-by: Eric Sandeen <sandeen@redhat.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ext3/namei.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/ext3/namei.c
++++ b/fs/ext3/namei.c
+@@ -1549,8 +1549,8 @@ static int ext3_dx_add_entry(handle_t *h
+ goto cleanup;
+ node2 = (struct dx_node *)(bh2->b_data);
+ entries2 = node2->entries;
++ memset(&node2->fake, 0, sizeof(struct fake_dirent));
+ node2->fake.rec_len = ext3_rec_len_to_disk(sb->s_blocksize);
+- node2->fake.inode = 0;
+ BUFFER_TRACE(frame->bh, "get_write_access");
+ err = ext3_journal_get_write_access(handle, frame->bh);
+ if (err)
--- /dev/null
+From 270fdc0748bd3f7b625caff985f2fcf8e2185ec7 Mon Sep 17 00:00:00 2001
+From: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
+Date: Wed, 16 Mar 2011 14:13:53 -0300
+Subject: HID: add support for Ortek PKB-1700
+
+From: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
+
+commit 270fdc0748bd3f7b625caff985f2fcf8e2185ec7 upstream.
+
+As reported on http://ubuntuforums.org/showthread.php?t=1594007 the
+PKB-1700 needs same special handling as WKB-2000. This change is
+originally based on patch posted by user asmoore82 on the Ubuntu
+forums.
+
+Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hid/Kconfig | 4 ++--
+ drivers/hid/hid-core.c | 1 +
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-ortek.c | 3 ++-
+ 4 files changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/hid/Kconfig
++++ b/drivers/hid/Kconfig
+@@ -291,10 +291,10 @@ config HID_NTRIG
+ Support for N-Trig touch screen.
+
+ config HID_ORTEK
+- tristate "Ortek WKB-2000 wireless keyboard and mouse trackpad"
++ tristate "Ortek PKB-1700/WKB-2000 wireless keyboard and mouse trackpad"
+ depends on USB_HID
+ ---help---
+- Support for Ortek WKB-2000 wireless keyboard + mouse trackpad.
++ Support for Ortek PKB-1700/WKB-2000 wireless keyboard + mouse trackpad.
+
+ config HID_PANTHERLORD
+ tristate "Pantherlord/GreenAsia game controller"
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1365,6 +1365,7 @@ static const struct hid_device_id hid_bl
+ { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_16) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_17) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_18) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_PKB1700) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_WKB2000) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_PETALYNX, USB_DEVICE_ID_PETALYNX_MAXTER_REMOTE) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH) },
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -445,6 +445,7 @@
+ #define USB_DEVICE_ID_ONTRAK_ADU100 0x0064
+
+ #define USB_VENDOR_ID_ORTEK 0x05a4
++#define USB_DEVICE_ID_ORTEK_PKB1700 0x1700
+ #define USB_DEVICE_ID_ORTEK_WKB2000 0x2000
+
+ #define USB_VENDOR_ID_PANJIT 0x134c
+--- a/drivers/hid/hid-ortek.c
++++ b/drivers/hid/hid-ortek.c
+@@ -1,5 +1,5 @@
+ /*
+- * HID driver for Ortek WKB-2000 (wireless keyboard + mouse trackpad).
++ * HID driver for Ortek PKB-1700/WKB-2000 (wireless keyboard + mouse trackpad).
+ * Fixes LogicalMaximum error in USB report description, see
+ * http://bugzilla.kernel.org/show_bug.cgi?id=14787
+ *
+@@ -31,6 +31,7 @@ static __u8 *ortek_report_fixup(struct h
+ }
+
+ static const struct hid_device_id ortek_devices[] = {
++ { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_PKB1700) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_WKB2000) },
+ { }
+ };
--- /dev/null
+From 2d9ca4e9f393d81d8f37ed37505aecbf3a5e1bd6 Mon Sep 17 00:00:00 2001
+From: Henrik Rydberg <rydberg@euromail.se>
+Date: Wed, 9 Mar 2011 18:38:57 +0100
+Subject: HID: hid-magicmouse: Correct touch orientation direction
+
+From: Henrik Rydberg <rydberg@euromail.se>
+
+commit 2d9ca4e9f393d81d8f37ed37505aecbf3a5e1bd6 upstream.
+
+The magic trackpad and mouse both report touch orientation in opposite
+direction to the bcm5974 driver and what is written in
+Documents/input/multi-touch-protocol.txt. This patch reverts the
+direction, so that all in-kernel devices with this feature behave the
+same way.
+
+Since no known application has been utilizing this information yet, it
+seems appropriate also for stable.
+
+Cc: Michael Poole <mdpoole@troilus.org>
+Signed-off-by: Henrik Rydberg <rydberg@euromail.se>
+Acked-by: Chase Douglas <chase.douglas@canonical.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hid/hid-magicmouse.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/hid/hid-magicmouse.c
++++ b/drivers/hid/hid-magicmouse.c
+@@ -256,7 +256,7 @@ static void magicmouse_emit_touch(struct
+ input_report_abs(input, ABS_MT_TRACKING_ID, id);
+ input_report_abs(input, ABS_MT_TOUCH_MAJOR, touch_major << 2);
+ input_report_abs(input, ABS_MT_TOUCH_MINOR, touch_minor << 2);
+- input_report_abs(input, ABS_MT_ORIENTATION, orientation);
++ input_report_abs(input, ABS_MT_ORIENTATION, -orientation);
+ input_report_abs(input, ABS_MT_POSITION_X, x);
+ input_report_abs(input, ABS_MT_POSITION_Y, y);
+
+@@ -395,7 +395,7 @@ static void magicmouse_setup_input(struc
+ input_set_abs_params(input, ABS_MT_TRACKING_ID, 0, 15, 0, 0);
+ input_set_abs_params(input, ABS_MT_TOUCH_MAJOR, 0, 255, 4, 0);
+ input_set_abs_params(input, ABS_MT_TOUCH_MINOR, 0, 255, 4, 0);
+- input_set_abs_params(input, ABS_MT_ORIENTATION, -32, 31, 1, 0);
++ input_set_abs_params(input, ABS_MT_ORIENTATION, -31, 32, 1, 0);
+
+ /* Note: Touch Y position from the device is inverted relative
+ * to how pointer motion is reported (and relative to how USB
--- /dev/null
+From Trond.Myklebust@netapp.com Fri Mar 18 14:52:55 2011
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Thu, 17 Mar 2011 21:54:39 -0400
+Subject: NFS: Fix a decoding problem in nfs3_decode_dirent
+To: stable@kernel.org
+Cc: Trond Myklebust <Trond.Myklebust@netapp.com>
+Message-ID: <1300413279-12570-1-git-send-email-Trond.Myklebust@netapp.com>
+
+[This needs to be applied to 2.6.37 only. The bug in question was
+inadvertently fixed by a series of cleanups in 2.6.38, but the patches
+in question are too large to be backported. This patch is a minimal fix
+that serves the same purpose.]
+
+When we decode a filename followed by an 8-byte cookie, we need to
+consider the fact that the filename and cookie are 32-bit word aligned.
+Presently, we may end up copying insufficient amounts of data when
+xdr_inline_decode() needs to invoke xdr_copy_to_scratch to deal
+with a page boundary.
+
+The following patch fixes the issue by first decoding the filename, and
+then decoding the cookie.
+
+Reported-by: Neil Brown <neilb@suse.de>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Reviewed-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/nfs2xdr.c | 6 ++++--
+ fs/nfs/nfs3xdr.c | 6 ++++--
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+--- a/fs/nfs/nfs2xdr.c
++++ b/fs/nfs/nfs2xdr.c
+@@ -477,11 +477,13 @@ nfs_decode_dirent(struct xdr_stream *xdr
+ entry->ino = ntohl(*p++);
+ entry->len = ntohl(*p++);
+
+- p = xdr_inline_decode(xdr, entry->len + 4);
++ p = xdr_inline_decode(xdr, entry->len);
+ if (unlikely(!p))
+ goto out_overflow;
+ entry->name = (const char *) p;
+- p += XDR_QUADLEN(entry->len);
++ p = xdr_inline_decode(xdr, 4);
++ if (unlikely(!p))
++ goto out_overflow;
+ entry->prev_cookie = entry->cookie;
+ entry->cookie = ntohl(*p++);
+
+--- a/fs/nfs/nfs3xdr.c
++++ b/fs/nfs/nfs3xdr.c
+@@ -614,11 +614,13 @@ nfs3_decode_dirent(struct xdr_stream *xd
+ p = xdr_decode_hyper(p, &entry->ino);
+ entry->len = ntohl(*p++);
+
+- p = xdr_inline_decode(xdr, entry->len + 8);
++ p = xdr_inline_decode(xdr, entry->len);
+ if (unlikely(!p))
+ goto out_overflow;
+ entry->name = (const char *) p;
+- p += XDR_QUADLEN(entry->len);
++ p = xdr_inline_decode(xdr, 8);
++ if (unlikely(!p))
++ goto out_overflow;
+ entry->prev_cookie = entry->cookie;
+ p = xdr_decode_hyper(p, &entry->cookie);
+
--- /dev/null
+From cdb9755849fbaf2bb9c0a009ba5baa817a0f152d Mon Sep 17 00:00:00 2001
+From: Jiri Slaby <jslaby@suse.cz>
+Date: Mon, 28 Feb 2011 10:45:09 +0100
+Subject: PCI: add more checking to ICH region quirks
+
+From: Jiri Slaby <jslaby@suse.cz>
+
+commit cdb9755849fbaf2bb9c0a009ba5baa817a0f152d upstream.
+
+Per ICH4 and ICH6 specs, ACPI and GPIO regions are valid iff ACPI_EN
+and GPIO_EN bits are set to 1. Add checks for these bits into the
+quirks prior to the region creation.
+
+While at it, name the constants by macros.
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Cc: Bjorn Helgaas <bjorn.helgaas@hp.com>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Thomas Renninger <trenn@suse.de>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/quirks.c | 49 +++++++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 39 insertions(+), 10 deletions(-)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -533,6 +533,17 @@ static void __devinit quirk_piix4_acpi(s
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82371AB_3, quirk_piix4_acpi);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443MX_3, quirk_piix4_acpi);
+
++#define ICH_PMBASE 0x40
++#define ICH_ACPI_CNTL 0x44
++#define ICH4_ACPI_EN 0x10
++#define ICH6_ACPI_EN 0x80
++#define ICH4_GPIOBASE 0x58
++#define ICH4_GPIO_CNTL 0x5c
++#define ICH4_GPIO_EN 0x10
++#define ICH6_GPIOBASE 0x48
++#define ICH6_GPIO_CNTL 0x4c
++#define ICH6_GPIO_EN 0x10
++
+ /*
+ * ICH4, ICH4-M, ICH5, ICH5-M ACPI: Three IO regions pointed to by longwords at
+ * 0x40 (128 bytes of ACPI, GPIO & TCO registers)
+@@ -541,12 +552,21 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_I
+ static void __devinit quirk_ich4_lpc_acpi(struct pci_dev *dev)
+ {
+ u32 region;
++ u8 enable;
+
+- pci_read_config_dword(dev, 0x40, ®ion);
+- quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES, "ICH4 ACPI/GPIO/TCO");
+-
+- pci_read_config_dword(dev, 0x58, ®ion);
+- quirk_io_region(dev, region, 64, PCI_BRIDGE_RESOURCES+1, "ICH4 GPIO");
++ pci_read_config_byte(dev, ICH_ACPI_CNTL, &enable);
++ if (enable & ICH4_ACPI_EN) {
++ pci_read_config_dword(dev, ICH_PMBASE, ®ion);
++ quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES,
++ "ICH4 ACPI/GPIO/TCO");
++ }
++
++ pci_read_config_byte(dev, ICH4_GPIO_CNTL, &enable);
++ if (enable & ICH4_GPIO_EN) {
++ pci_read_config_dword(dev, ICH4_GPIOBASE, ®ion);
++ quirk_io_region(dev, region, 64, PCI_BRIDGE_RESOURCES + 1,
++ "ICH4 GPIO");
++ }
+ }
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801AA_0, quirk_ich4_lpc_acpi);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801AB_0, quirk_ich4_lpc_acpi);
+@@ -562,12 +582,21 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_I
+ static void __devinit ich6_lpc_acpi_gpio(struct pci_dev *dev)
+ {
+ u32 region;
++ u8 enable;
+
+- pci_read_config_dword(dev, 0x40, ®ion);
+- quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES, "ICH6 ACPI/GPIO/TCO");
+-
+- pci_read_config_dword(dev, 0x48, ®ion);
+- quirk_io_region(dev, region, 64, PCI_BRIDGE_RESOURCES+1, "ICH6 GPIO");
++ pci_read_config_byte(dev, ICH_ACPI_CNTL, &enable);
++ if (enable & ICH6_ACPI_EN) {
++ pci_read_config_dword(dev, ICH_PMBASE, ®ion);
++ quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES,
++ "ICH6 ACPI/GPIO/TCO");
++ }
++
++ pci_read_config_byte(dev, ICH6_GPIO_CNTL, &enable);
++ if (enable & ICH4_GPIO_EN) {
++ pci_read_config_dword(dev, ICH6_GPIOBASE, ®ion);
++ quirk_io_region(dev, region, 64, PCI_BRIDGE_RESOURCES + 1,
++ "ICH6 GPIO");
++ }
+ }
+
+ static void __devinit ich6_lpc_generic_decode(struct pci_dev *dev, unsigned reg, const char *name, int dynsize)
--- /dev/null
+From 87e3dc3855430bd254370afc79f2ed92250f5b7c Mon Sep 17 00:00:00 2001
+From: Jiri Slaby <jslaby@suse.cz>
+Date: Mon, 28 Feb 2011 10:45:10 +0100
+Subject: PCI: do not create quirk I/O regions below PCIBIOS_MIN_IO for ICH
+
+From: Jiri Slaby <jslaby@suse.cz>
+
+commit 87e3dc3855430bd254370afc79f2ed92250f5b7c upstream.
+
+Some broken BIOSes on ICH4 chipset report an ACPI region which is in
+conflict with legacy IDE ports when ACPI is disabled. Even though the
+regions overlap, IDE ports are working correctly (we cannot find out
+the decoding rules on chipsets).
+
+So the only problem is the reported region itself, if we don't reserve
+the region in the quirk everything works as expected.
+
+This patch avoids reserving any quirk regions below PCIBIOS_MIN_IO
+which is 0x1000. Some regions might be (and are by a fast google
+query) below this border, but the only difference is that they won't
+be reserved anymore. They should still work though the same as before.
+
+The conflicts look like (1f.0 is bridge, 1f.1 is IDE ctrl):
+pci 0000:00:1f.1: address space collision: [io 0x0170-0x0177] conflicts with 0000:00:1f.0 [io 0x0100-0x017f]
+
+At 0x0100 a 128 bytes long ACPI region is reported in the quirk for
+ICH4. ata_piix then fails to find disks because the IDE legacy ports
+are zeroed:
+ata_piix 0000:00:1f.1: device not available (can't reserve [io 0x0000-0x0007])
+
+References: https://bugzilla.novell.com/show_bug.cgi?id=558740
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Cc: Bjorn Helgaas <bjorn.helgaas@hp.com>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Thomas Renninger <trenn@suse.de>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/quirks.c | 32 ++++++++++++++++++++++++--------
+ 1 file changed, 24 insertions(+), 8 deletions(-)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -554,18 +554,30 @@ static void __devinit quirk_ich4_lpc_acp
+ u32 region;
+ u8 enable;
+
++ /*
++ * The check for PCIBIOS_MIN_IO is to ensure we won't create a conflict
++ * with low legacy (and fixed) ports. We don't know the decoding
++ * priority and can't tell whether the legacy device or the one created
++ * here is really at that address. This happens on boards with broken
++ * BIOSes.
++ */
++
+ pci_read_config_byte(dev, ICH_ACPI_CNTL, &enable);
+ if (enable & ICH4_ACPI_EN) {
+ pci_read_config_dword(dev, ICH_PMBASE, ®ion);
+- quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES,
+- "ICH4 ACPI/GPIO/TCO");
++ region &= PCI_BASE_ADDRESS_IO_MASK;
++ if (region >= PCIBIOS_MIN_IO)
++ quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES,
++ "ICH4 ACPI/GPIO/TCO");
+ }
+
+ pci_read_config_byte(dev, ICH4_GPIO_CNTL, &enable);
+ if (enable & ICH4_GPIO_EN) {
+ pci_read_config_dword(dev, ICH4_GPIOBASE, ®ion);
+- quirk_io_region(dev, region, 64, PCI_BRIDGE_RESOURCES + 1,
+- "ICH4 GPIO");
++ region &= PCI_BASE_ADDRESS_IO_MASK;
++ if (region >= PCIBIOS_MIN_IO)
++ quirk_io_region(dev, region, 64,
++ PCI_BRIDGE_RESOURCES + 1, "ICH4 GPIO");
+ }
+ }
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801AA_0, quirk_ich4_lpc_acpi);
+@@ -587,15 +599,19 @@ static void __devinit ich6_lpc_acpi_gpio
+ pci_read_config_byte(dev, ICH_ACPI_CNTL, &enable);
+ if (enable & ICH6_ACPI_EN) {
+ pci_read_config_dword(dev, ICH_PMBASE, ®ion);
+- quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES,
+- "ICH6 ACPI/GPIO/TCO");
++ region &= PCI_BASE_ADDRESS_IO_MASK;
++ if (region >= PCIBIOS_MIN_IO)
++ quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES,
++ "ICH6 ACPI/GPIO/TCO");
+ }
+
+ pci_read_config_byte(dev, ICH6_GPIO_CNTL, &enable);
+ if (enable & ICH4_GPIO_EN) {
+ pci_read_config_dword(dev, ICH6_GPIOBASE, ®ion);
+- quirk_io_region(dev, region, 64, PCI_BRIDGE_RESOURCES + 1,
+- "ICH6 GPIO");
++ region &= PCI_BASE_ADDRESS_IO_MASK;
++ if (region >= PCIBIOS_MIN_IO)
++ quirk_io_region(dev, region, 64,
++ PCI_BRIDGE_RESOURCES + 1, "ICH6 GPIO");
+ }
+ }
+
--- /dev/null
+From b99af4b002e4908d1a5cdaf424529bdf1dc69768 Mon Sep 17 00:00:00 2001
+From: Brandeburg, Jesse <jesse.brandeburg@intel.com>
+Date: Mon, 14 Feb 2011 09:05:02 -0800
+Subject: PCI: remove quirk for pre-production systems
+
+From: Brandeburg, Jesse <jesse.brandeburg@intel.com>
+
+commit b99af4b002e4908d1a5cdaf424529bdf1dc69768 upstream.
+
+Revert commit 7eb93b175d4de9438a4b0af3a94a112cb5266944
+Author: Yu Zhao <yu.zhao@intel.com>
+Date: Fri Apr 3 15:18:11 2009 +0800
+
+ PCI: SR-IOV quirk for Intel 82576 NIC
+
+ If BIOS doesn't allocate resources for the SR-IOV BARs, zero the Flash
+ BAR and program the SR-IOV BARs to use the old Flash Memory Space.
+
+ Please refer to Intel 82576 Gigabit Ethernet Controller Datasheet
+ section 7.9.2.14.2 for details.
+ http://download.intel.com/design/network/datashts/82576_Datasheet.pdf
+
+ Signed-off-by: Yu Zhao <yu.zhao@intel.com>
+ Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+
+This quirk was added before SR-IOV was in production and now all machines that
+originally had this issue alreayd have bios updates to correct the issue. The
+quirk itself is no longer needed and in fact causes bugs if run. Remove it.
+
+Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+CC: Yu Zhao <yu.zhao@intel.com>
+CC: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/quirks.c | 52 ---------------------------------------------------
+ 1 file changed, 52 deletions(-)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2618,58 +2618,6 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AT
+
+ #endif /* CONFIG_PCI_MSI */
+
+-#ifdef CONFIG_PCI_IOV
+-
+-/*
+- * For Intel 82576 SR-IOV NIC, if BIOS doesn't allocate resources for the
+- * SR-IOV BARs, zero the Flash BAR and program the SR-IOV BARs to use the
+- * old Flash Memory Space.
+- */
+-static void __devinit quirk_i82576_sriov(struct pci_dev *dev)
+-{
+- int pos, flags;
+- u32 bar, start, size;
+-
+- if (PAGE_SIZE > 0x10000)
+- return;
+-
+- flags = pci_resource_flags(dev, 0);
+- if ((flags & PCI_BASE_ADDRESS_SPACE) !=
+- PCI_BASE_ADDRESS_SPACE_MEMORY ||
+- (flags & PCI_BASE_ADDRESS_MEM_TYPE_MASK) !=
+- PCI_BASE_ADDRESS_MEM_TYPE_32)
+- return;
+-
+- pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_SRIOV);
+- if (!pos)
+- return;
+-
+- pci_read_config_dword(dev, pos + PCI_SRIOV_BAR, &bar);
+- if (bar & PCI_BASE_ADDRESS_MEM_MASK)
+- return;
+-
+- start = pci_resource_start(dev, 1);
+- size = pci_resource_len(dev, 1);
+- if (!start || size != 0x400000 || start & (size - 1))
+- return;
+-
+- pci_resource_flags(dev, 1) = 0;
+- pci_write_config_dword(dev, PCI_BASE_ADDRESS_1, 0);
+- pci_write_config_dword(dev, pos + PCI_SRIOV_BAR, start);
+- pci_write_config_dword(dev, pos + PCI_SRIOV_BAR + 12, start + size / 2);
+-
+- dev_info(&dev->dev, "use Flash Memory Space for SR-IOV BARs\n");
+-}
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x10c9, quirk_i82576_sriov);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x10e6, quirk_i82576_sriov);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x10e7, quirk_i82576_sriov);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x10e8, quirk_i82576_sriov);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x150a, quirk_i82576_sriov);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x150d, quirk_i82576_sriov);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1518, quirk_i82576_sriov);
+-
+-#endif /* CONFIG_PCI_IOV */
+-
+ /* Allow manual resource allocation for PCI hotplug bridges
+ * via pci=hpmemsize=nnM and pci=hpiosize=nnM parameters. For
+ * some PCI-PCI hotplug bridges, like PLX 6254 (former HINT HB6),
--- /dev/null
+From 0f12a4e29368a9476076515881d9ef4e5876c6e2 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <bhutchings@solarflare.com>
+Date: Thu, 13 Jan 2011 19:47:56 +0000
+Subject: PCI: sysfs: Fix failure path for addition of "vpd" attribute
+
+From: Ben Hutchings <bhutchings@solarflare.com>
+
+commit 0f12a4e29368a9476076515881d9ef4e5876c6e2 upstream.
+
+Commit 280c73d ("PCI: centralize the capabilities code in
+pci-sysfs.c") changed the initialisation of the "rom" and "vpd"
+attributes, and made the failure path for the "vpd" attribute
+incorrect. We must free the new attribute structure (attr), but
+instead we currently free dev->vpd->attr. That will normally be NULL,
+resulting in a memory leak, but it might be a stale pointer, resulting
+in a double-free.
+
+Found by inspection; compile-tested only.
+
+Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/pci-sysfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pci/pci-sysfs.c
++++ b/drivers/pci/pci-sysfs.c
+@@ -1088,7 +1088,7 @@ static int pci_create_capabilities_sysfs
+ attr->write = write_vpd_attr;
+ retval = sysfs_create_bin_file(&dev->dev.kobj, attr);
+ if (retval) {
+- kfree(dev->vpd->attr);
++ kfree(attr);
+ return retval;
+ }
+ dev->vpd->attr = attr;
--- /dev/null
+From 91b2f482e62ad0d444222253026a5cbca28c4ab9 Mon Sep 17 00:00:00 2001
+From: Frederic Weisbecker <fweisbec@gmail.com>
+Date: Mon, 7 Mar 2011 21:27:08 +0100
+Subject: perf: Fix the software events state check
+
+From: Frederic Weisbecker <fweisbec@gmail.com>
+
+commit 91b2f482e62ad0d444222253026a5cbca28c4ab9 upstream.
+
+Fix the mistakenly inverted check of events state.
+
+Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Stephane Eranian <eranian@google.com>
+LKML-Reference: <1299529629-18280-1-git-send-email-fweisbec@gmail.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/perf_event.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/perf_event.c
++++ b/kernel/perf_event.c
+@@ -4414,7 +4414,7 @@ static int perf_exclude_event(struct per
+ struct pt_regs *regs)
+ {
+ if (event->hw.state & PERF_HES_STOPPED)
+- return 0;
++ return 1;
+
+ if (regs) {
+ if (event->attr.exclude_user && user_mode(regs))
--- /dev/null
+From a0f7d0f7fc02465bb9758501f611f63381792996 Mon Sep 17 00:00:00 2001
+From: Frederic Weisbecker <fweisbec@gmail.com>
+Date: Mon, 7 Mar 2011 21:27:09 +0100
+Subject: perf: Handle stopped state with tracepoints
+
+From: Frederic Weisbecker <fweisbec@gmail.com>
+
+commit a0f7d0f7fc02465bb9758501f611f63381792996 upstream.
+
+We toggle the state from start and stop callbacks but actually
+don't check it when the event triggers. Do it so that
+these callbacks actually work.
+
+Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Stephane Eranian <eranian@google.com>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+LKML-Reference: <1299529629-18280-2-git-send-email-fweisbec@gmail.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/perf_event.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/kernel/perf_event.c
++++ b/kernel/perf_event.c
+@@ -4770,6 +4770,8 @@ static int perf_tp_event_match(struct pe
+ struct perf_sample_data *data,
+ struct pt_regs *regs)
+ {
++ if (event->hw.state & PERF_HES_STOPPED)
++ return 0;
+ /*
+ * All tracepoints are from kernel-space.
+ */
--- /dev/null
+From 0837e3242c73566fc1c0196b4ec61779c25ffc93 Mon Sep 17 00:00:00 2001
+From: Anton Blanchard <anton@samba.org>
+Date: Wed, 9 Mar 2011 14:38:42 +1100
+Subject: perf, powerpc: Handle events that raise an exception without overflowing
+
+From: Anton Blanchard <anton@samba.org>
+
+commit 0837e3242c73566fc1c0196b4ec61779c25ffc93 upstream.
+
+Events on POWER7 can roll back if a speculative event doesn't
+eventually complete. Unfortunately in some rare cases they will
+raise a performance monitor exception. We need to catch this to
+ensure we reset the PMC. In all cases the PMC will be 256 or less
+cycles from overflow.
+
+Signed-off-by: Anton Blanchard <anton@samba.org>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+LKML-Reference: <20110309143842.6c22845e@kryten>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/include/asm/reg.h | 1 +
+ arch/powerpc/kernel/perf_event.c | 24 +++++++++++++++++++++++-
+ 2 files changed, 24 insertions(+), 1 deletion(-)
+
+--- a/arch/powerpc/include/asm/reg.h
++++ b/arch/powerpc/include/asm/reg.h
+@@ -878,6 +878,7 @@
+ #define PV_970 0x0039
+ #define PV_POWER5 0x003A
+ #define PV_POWER5p 0x003B
++#define PV_POWER7 0x003F
+ #define PV_970FX 0x003C
+ #define PV_630 0x0040
+ #define PV_630p 0x0041
+--- a/arch/powerpc/kernel/perf_event.c
++++ b/arch/powerpc/kernel/perf_event.c
+@@ -1268,6 +1268,28 @@ unsigned long perf_instruction_pointer(s
+ return ip;
+ }
+
++static bool pmc_overflow(unsigned long val)
++{
++ if ((int)val < 0)
++ return true;
++
++ /*
++ * Events on POWER7 can roll back if a speculative event doesn't
++ * eventually complete. Unfortunately in some rare cases they will
++ * raise a performance monitor exception. We need to catch this to
++ * ensure we reset the PMC. In all cases the PMC will be 256 or less
++ * cycles from overflow.
++ *
++ * We only do this if the first pass fails to find any overflowing
++ * PMCs because a user might set a period of less than 256 and we
++ * don't want to mistakenly reset them.
++ */
++ if (__is_processor(PV_POWER7) && ((0x80000000 - val) <= 256))
++ return true;
++
++ return false;
++}
++
+ /*
+ * Performance monitor interrupt stuff
+ */
+@@ -1315,7 +1337,7 @@ static void perf_event_interrupt(struct
+ if (is_limited_pmc(i + 1))
+ continue;
+ val = read_pmc(i + 1);
+- if ((int)val < 0)
++ if (pmc_overflow(val))
+ write_pmc(i + 1, 0);
+ }
+ }
--- /dev/null
+From 58d406ed6a5f1ca4bc1dba5390b718c67847fa5f Mon Sep 17 00:00:00 2001
+From: Josh Hunt <johunt@akamai.com>
+Date: Tue, 15 Mar 2011 19:16:40 -0700
+Subject: perf tools: Version incorrect with some versions of grep
+
+From: Josh Hunt <johunt@akamai.com>
+
+commit 58d406ed6a5f1ca4bc1dba5390b718c67847fa5f upstream.
+
+Some versions of grep don't treat '\s' properly. When building perf on such
+systems and using a kernel tarball the perf version is unable to be determined
+from the main kernel Makefile and the user is left with a version of '..'.
+Replacing the use of '\s' with '[[:space:]]', which should work in all grep
+versions, gives a usable version number.
+
+Reported-by: Tapan Dhimant <tdhimant@akamai.com>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: Tapan Dhimant <tdhimant@akamai.com>
+Cc: linux-kernel@vger.kernel.org
+LKML-Reference: <1300241800-30281-1-git-send-email-johunt@akamai.com>
+Signed-off-by: Josh Hunt <johunt@akamai.com>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ tools/perf/util/PERF-VERSION-GEN | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/tools/perf/util/PERF-VERSION-GEN
++++ b/tools/perf/util/PERF-VERSION-GEN
+@@ -23,10 +23,10 @@ if test -d ../../.git -o -f ../../.git &
+ then
+ VN=$(echo "$VN" | sed -e 's/-/./g');
+ else
+- eval `grep '^VERSION\s*=' ../../Makefile|tr -d ' '`
+- eval `grep '^PATCHLEVEL\s*=' ../../Makefile|tr -d ' '`
+- eval `grep '^SUBLEVEL\s*=' ../../Makefile|tr -d ' '`
+- eval `grep '^EXTRAVERSION\s*=' ../../Makefile|tr -d ' '`
++ eval $(grep '^VERSION[[:space:]]*=' ../../Makefile|tr -d ' ')
++ eval $(grep '^PATCHLEVEL[[:space:]]*=' ../../Makefile|tr -d ' ')
++ eval $(grep '^SUBLEVEL[[:space:]]*=' ../../Makefile|tr -d ' ')
++ eval $(grep '^EXTRAVERSION[[:space:]]*=' ../../Makefile|tr -d ' ')
+
+ VN="${VERSION}.${PATCHLEVEL}.${SUBLEVEL}${EXTRAVERSION}"
+ fi
--- /dev/null
+From 8e26de238fd794c8ea56a5c98bf67c40cfeb051d Mon Sep 17 00:00:00 2001
+From: Stanislav Kinsbursky <skinsbursky@parallels.com>
+Date: Thu, 17 Mar 2011 18:54:23 +0300
+Subject: RPC: killing RPC tasks races fixed
+
+From: Stanislav Kinsbursky <skinsbursky@parallels.com>
+
+commit 8e26de238fd794c8ea56a5c98bf67c40cfeb051d upstream.
+
+RPC task RPC_TASK_QUEUED bit is set must be checked before trying to wake up
+task rpc_killall_tasks() because task->tk_waitqueue can not be set (equal to
+NULL).
+Also, as Trond Myklebust mentioned, such approach (instead of checking
+tk_waitqueue to NULL) allows us to "optimise away the call to
+rpc_wake_up_queued_task() altogether for those
+tasks that aren't queued".
+
+Here is an example of dereferencing of tk_waitqueue equal to NULL:
+
+CPU 0 CPU 1 CPU 2
+-------------------- --------------------- --------------------------
+nfs4_run_open_task
+rpc_run_task
+rpc_execute
+rpc_set_active
+rpc_make_runnable
+(waiting)
+ rpc_async_schedule
+ nfs4_open_prepare
+ nfs_wait_on_sequence
+ nfs_umount_begin
+ rpc_killall_tasks
+ rpc_wake_up_task
+ rpc_wake_up_queued_task
+ spin_lock(tk_waitqueue == NULL)
+ BUG()
+ rpc_sleep_on
+ spin_lock(&q->lock)
+ __rpc_sleep_on
+ task->tk_waitqueue = q
+
+Signed-off-by: Stanislav Kinsbursky <skinsbursky@openvz.org>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/clnt.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -436,7 +436,9 @@ void rpc_killall_tasks(struct rpc_clnt *
+ if (!(rovr->tk_flags & RPC_TASK_KILLED)) {
+ rovr->tk_flags |= RPC_TASK_KILLED;
+ rpc_exit(rovr, -EIO);
+- rpc_wake_up_queued_task(rovr->tk_waitqueue, rovr);
++ if (RPC_IS_QUEUED(rovr))
++ rpc_wake_up_queued_task(rovr->tk_waitqueue,
++ rovr);
+ }
+ }
+ spin_unlock(&clnt->cl_lock);
--- /dev/null
+From ed0f36bc5719b25659b637f80ceea85494b84502 Mon Sep 17 00:00:00 2001
+From: Joseph Gruher <joseph.r.gruher@intel.com>
+Date: Wed, 5 Jan 2011 16:00:21 -0500
+Subject: [SCSI] scsi_dh_alua: fix deadlock in stpg_endio
+
+From: Joseph Gruher <joseph.r.gruher@intel.com>
+
+commit ed0f36bc5719b25659b637f80ceea85494b84502 upstream.
+
+The use of blk_execute_rq_nowait() implies __blk_put_request() is needed
+in stpg_endio() rather than blk_put_request() -- blk_finish_request() is
+called with queue lock already held.
+
+Signed-off-by: Joseph Gruher <joseph.r.gruher@intel.com>
+Signed-off-by: Ilgu Hong <ilgu.hong@promise.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/device_handler/scsi_dh_alua.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/device_handler/scsi_dh_alua.c
++++ b/drivers/scsi/device_handler/scsi_dh_alua.c
+@@ -285,7 +285,8 @@ static void stpg_endio(struct request *r
+ print_alua_state(h->state));
+ }
+ done:
+- blk_put_request(req);
++ req->end_io_data = NULL;
++ __blk_put_request(req->q, req);
+ if (h->callback_fn) {
+ h->callback_fn(h->callback_data, err);
+ h->callback_fn = h->callback_data = NULL;
xhci-update-internal-dequeue-pointers-after-stalls.patch
xhci-fix-cycle-bit-calculation-during-stall-handling.patch
usb-add-support-for-superspeed-isoc-endpoints.patch
+nfs-fix-a-decoding-problem-in-nfs3_decode_dirent.patch
+alsa-hda-realtek-alc88x-do-not-over-initialize-speakers-and-hp-that-are-primary-outputs.patch
+alsa-hda-fix-digital-mic-selection-in-mixer-on-92hd8x-codecs.patch
+alsa-hda-initialize-special-cases-for-input-src-in-init-phase.patch
+hid-hid-magicmouse-correct-touch-orientation-direction.patch
+hid-add-support-for-ortek-pkb-1700.patch
+pci-remove-quirk-for-pre-production-systems.patch
+pci-add-more-checking-to-ich-region-quirks.patch
+pci-do-not-create-quirk-i-o-regions-below-pcibios_min_io-for-ich.patch
+pci-sysfs-fix-failure-path-for-addition-of-vpd-attribute.patch
+alsa-sound-pci-asihpi-check-adapter-index-in-hpi_ioctl.patch
+alsa-aloop-fix-possible-irq-lock-inversion.patch
+alsa-ctxfi-fix-incorrect-spdif-status-bit-mask.patch
+alsa-ctxfi-fix-spdif-status-retrieval.patch
+alsa-ctxfi-clear-input-settings-before-initialization.patch
+scsi_dh_alua-fix-deadlock-in-stpg_endio.patch
+sunrpc-ensure-we-always-run-the-tk_callback-before-tk_action.patch
+rpc-killing-rpc-tasks-races-fixed.patch
+perf-fix-the-software-events-state-check.patch
+perf-handle-stopped-state-with-tracepoints.patch
+perf-powerpc-handle-events-that-raise-an-exception-without-overflowing.patch
+perf-tools-version-incorrect-with-some-versions-of-grep.patch
+ext3-always-set-dx_node-s-fake_dirent-explicitly.patch
+call_function_many-fix-list-delete-vs-add-race.patch
+call_function_many-add-missing-ordering.patch
+smp_call_function_many-handle-concurrent-clearing-of-mask.patch
+x86-flush-tlb-if-pgd-entry-is-changed-in-i386-pae-mode.patch
--- /dev/null
+From 723aae25d5cdb09962901d36d526b44d4be1051c Mon Sep 17 00:00:00 2001
+From: Milton Miller <miltonm@bga.com>
+Date: Tue, 15 Mar 2011 13:27:17 -0600
+Subject: smp_call_function_many: handle concurrent clearing of mask
+
+From: Milton Miller <miltonm@bga.com>
+
+commit 723aae25d5cdb09962901d36d526b44d4be1051c upstream.
+
+Mike Galbraith reported finding a lockup ("perma-spin bug") where the
+cpumask passed to smp_call_function_many was cleared by other cpu(s)
+while a cpu was preparing its call_data block, resulting in no cpu to
+clear the last ref and unlock the block.
+
+Having cpus clear their bit asynchronously could be useful on a mask of
+cpus that might have a translation context, or cpus that need a push to
+complete an rcu window.
+
+Instead of adding a BUG_ON and requiring yet another cpumask copy, just
+detect the race and handle it.
+
+Note: arch_send_call_function_ipi_mask must still handle an empty
+cpumask because the data block is globally visible before the that arch
+callback is made. And (obviously) there are no guarantees to which cpus
+are notified if the mask is changed during the call; only cpus that were
+online and had their mask bit set during the whole call are guaranteed
+to be called.
+
+Reported-by: Mike Galbraith <efault@gmx.de>
+Reported-by: Jan Beulich <JBeulich@novell.com>
+Acked-by: Jan Beulich <jbeulich@novell.com>
+Signed-off-by: Milton Miller <miltonm@bga.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/smp.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/kernel/smp.c
++++ b/kernel/smp.c
+@@ -440,7 +440,7 @@ void smp_call_function_many(const struct
+ {
+ struct call_function_data *data;
+ unsigned long flags;
+- int cpu, next_cpu, this_cpu = smp_processor_id();
++ int refs, cpu, next_cpu, this_cpu = smp_processor_id();
+
+ /*
+ * Can deadlock when called with interrupts disabled.
+@@ -451,7 +451,7 @@ void smp_call_function_many(const struct
+ WARN_ON_ONCE(cpu_online(this_cpu) && irqs_disabled()
+ && !oops_in_progress);
+
+- /* So, what's a CPU they want? Ignoring this one. */
++ /* Try to fastpath. So, what's a CPU they want? Ignoring this one. */
+ cpu = cpumask_first_and(mask, cpu_online_mask);
+ if (cpu == this_cpu)
+ cpu = cpumask_next_and(cpu, mask, cpu_online_mask);
+@@ -509,6 +509,13 @@ void smp_call_function_many(const struct
+ /* We rely on the "and" being processed before the store */
+ cpumask_and(data->cpumask, mask, cpu_online_mask);
+ cpumask_clear_cpu(this_cpu, data->cpumask);
++ refs = cpumask_weight(data->cpumask);
++
++ /* Some callers race with other cpus changing the passed mask */
++ if (unlikely(!refs)) {
++ csd_unlock(&data->csd);
++ return;
++ }
+
+ raw_spin_lock_irqsave(&call_function.lock, flags);
+ /*
+@@ -522,7 +529,7 @@ void smp_call_function_many(const struct
+ * to the cpumask before this write to refs, which indicates
+ * data is on the list and is ready to be processed.
+ */
+- atomic_set(&data->refs, cpumask_weight(data->cpumask));
++ atomic_set(&data->refs, refs);
+ raw_spin_unlock_irqrestore(&call_function.lock, flags);
+
+ /*
--- /dev/null
+From e020c6800c9621a77223bf2c1ff68180e41e8ebf Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Tue, 15 Mar 2011 19:56:30 -0400
+Subject: SUNRPC: Ensure we always run the tk_callback before tk_action
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit e020c6800c9621a77223bf2c1ff68180e41e8ebf upstream.
+
+This fixes a race in which the task->tk_callback() puts the rpc_task
+to sleep, setting a new callback. Under certain circumstances, the current
+code may end up executing the task->tk_action before it gets round to the
+callback.
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/sched.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+--- a/net/sunrpc/sched.c
++++ b/net/sunrpc/sched.c
+@@ -623,14 +623,12 @@ static void __rpc_execute(struct rpc_tas
+ save_callback = task->tk_callback;
+ task->tk_callback = NULL;
+ save_callback(task);
+- }
+-
+- /*
+- * Perform the next FSM step.
+- * tk_action may be NULL when the task has been killed
+- * by someone else.
+- */
+- if (!RPC_IS_QUEUED(task)) {
++ } else {
++ /*
++ * Perform the next FSM step.
++ * tk_action may be NULL when the task has been killed
++ * by someone else.
++ */
+ if (task->tk_action == NULL)
+ break;
+ task->tk_action(task);
--- /dev/null
+From 4981d01eada5354d81c8929d5b2836829ba3df7b Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shaohua.li@intel.com>
+Date: Wed, 16 Mar 2011 11:37:29 +0800
+Subject: x86: Flush TLB if PGD entry is changed in i386 PAE mode
+
+From: Shaohua Li <shaohua.li@intel.com>
+
+commit 4981d01eada5354d81c8929d5b2836829ba3df7b upstream.
+
+According to intel CPU manual, every time PGD entry is changed in i386 PAE
+mode, we need do a full TLB flush. Current code follows this and there is
+comment for this too in the code.
+
+But current code misses the multi-threaded case. A changed page table
+might be used by several CPUs, every such CPU should flush TLB. Usually
+this isn't a problem, because we prepopulate all PGD entries at process
+fork. But when the process does munmap and follows new mmap, this issue
+will be triggered.
+
+When it happens, some CPUs keep doing page faults:
+
+ http://marc.info/?l=linux-kernel&m=129915020508238&w=2
+
+Reported-by: Yasunori Goto<y-goto@jp.fujitsu.com>
+Tested-by: Yasunori Goto<y-goto@jp.fujitsu.com>
+Reviewed-by: Rik van Riel <riel@redhat.com>
+Signed-off-by: Shaohua Li<shaohua.li@intel.com>
+Cc: Mallick Asit K <asit.k.mallick@intel.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: linux-mm <linux-mm@kvack.org>
+LKML-Reference: <1300246649.2337.95.camel@sli10-conroe>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/pgtable-3level.h | 11 +++--------
+ arch/x86/mm/pgtable.c | 3 +--
+ 2 files changed, 4 insertions(+), 10 deletions(-)
+
+--- a/arch/x86/include/asm/pgtable-3level.h
++++ b/arch/x86/include/asm/pgtable-3level.h
+@@ -69,8 +69,6 @@ static inline void native_pmd_clear(pmd_
+
+ static inline void pud_clear(pud_t *pudp)
+ {
+- unsigned long pgd;
+-
+ set_pud(pudp, __pud(0));
+
+ /*
+@@ -79,13 +77,10 @@ static inline void pud_clear(pud_t *pudp
+ * section 8.1: in PAE mode we explicitly have to flush the
+ * TLB via cr3 if the top-level pgd is changed...
+ *
+- * Make sure the pud entry we're updating is within the
+- * current pgd to avoid unnecessary TLB flushes.
++ * Currently all places where pud_clear() is called either have
++ * flush_tlb_mm() followed or don't need TLB flush (x86_64 code or
++ * pud_clear_bad()), so we don't need TLB flush here.
+ */
+- pgd = read_cr3();
+- if (__pa(pudp) >= pgd && __pa(pudp) <
+- (pgd + sizeof(pgd_t)*PTRS_PER_PGD))
+- write_cr3(pgd);
+ }
+
+ #ifdef CONFIG_SMP
+--- a/arch/x86/mm/pgtable.c
++++ b/arch/x86/mm/pgtable.c
+@@ -168,8 +168,7 @@ void pud_populate(struct mm_struct *mm,
+ * section 8.1: in PAE mode we explicitly have to flush the
+ * TLB via cr3 if the top-level pgd is changed...
+ */
+- if (mm == current->active_mm)
+- write_cr3(read_cr3());
++ flush_tlb_mm(mm);
+ }
+ #else /* !CONFIG_X86_PAE */
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
