--- /dev/null
+From tiwai@suse.de Tue Sep 30 14:40:02 2008
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 30 Sep 2008 11:52:57 +0200
+Subject: ALSA: fix locking in snd_pcm_open*() and snd_rawmidi_open*()
+To: stable@kernel.org
+Message-ID: <s5hej32hsee.wl%tiwai@suse.de>
+
+From: Takashi Iwai <tiwai@suse.de>
+
+Upstream-commit-id: 399ccdc1cd4e92e541d4dacbbf18c52bd693418b
+
+The PCM and rawmidi open callbacks have a lock against card->controls_list
+but it takes a wrong one, card->controls_rwsem, instead of a right one
+card->ctl_files_rwlock. This patch fixes them.
+
+This change also fixes automatically the potential deadlocks due to
+mm->mmap_sem in munmap and copy_from/to_user, reported by Sitsofe
+Wheeler:
+
+ A: snd_ctl_elem_user_tlv(): card->controls_rwsem => mm->mmap_sem
+ B: snd_pcm_open(): card->open_mutex => card->controls_rwsem
+ C: munmap: mm->mmap_sem => snd_pcm_release(): card->open_mutex
+
+The patch breaks the chain.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/pcm.c | 4 ++--
+ sound/core/rawmidi.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/sound/core/pcm.c
++++ b/sound/core/pcm.c
+@@ -781,7 +781,7 @@ int snd_pcm_attach_substream(struct snd_
+ return -ENODEV;
+
+ card = pcm->card;
+- down_read(&card->controls_rwsem);
++ read_lock(&card->ctl_files_rwlock);
+ list_for_each_entry(kctl, &card->ctl_files, list) {
+ if (kctl->pid == current->pid) {
+ prefer_subdevice = kctl->prefer_pcm_subdevice;
+@@ -789,7 +789,7 @@ int snd_pcm_attach_substream(struct snd_
+ break;
+ }
+ }
+- up_read(&card->controls_rwsem);
++ read_unlock(&card->ctl_files_rwlock);
+
+ switch (stream) {
+ case SNDRV_PCM_STREAM_PLAYBACK:
+--- a/sound/core/rawmidi.c
++++ b/sound/core/rawmidi.c
+@@ -418,7 +418,7 @@ static int snd_rawmidi_open(struct inode
+ mutex_lock(&rmidi->open_mutex);
+ while (1) {
+ subdevice = -1;
+- down_read(&card->controls_rwsem);
++ read_lock(&card->ctl_files_rwlock);
+ list_for_each_entry(kctl, &card->ctl_files, list) {
+ if (kctl->pid == current->pid) {
+ subdevice = kctl->prefer_rawmidi_subdevice;
+@@ -426,7 +426,7 @@ static int snd_rawmidi_open(struct inode
+ break;
+ }
+ }
+- up_read(&card->controls_rwsem);
++ read_unlock(&card->ctl_files_rwlock);
+ err = snd_rawmidi_kernel_open(rmidi->card, rmidi->device,
+ subdevice, fflags, rawmidi_file);
+ if (err >= 0)
--- /dev/null
+From jejb@kernel.org Tue Sep 30 14:38:32 2008
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 30 Sep 2008 18:15:10 GMT
+Subject: ALSA: hda - Fix model for Dell Inspiron 1525
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200809301815.m8UIFA86018882@hera.kernel.org>
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 24918b61b55c21e09a3e07cd82e1b3a8154782dc upstream
+
+Dell Inspiron 1525 seems to have a buggy BIOS setup and screws up
+the recent codec parser, as reported by Oleksandr Natalenko:
+ http://lkml.org/lkml/2008/9/12/203
+
+This patch adds the working model, dell-3stack, statically.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -1667,8 +1667,8 @@ static struct snd_pci_quirk stac927x_cfg
+ /* Dell 3 stack systems with verb table in BIOS */
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01f3, "Dell Inspiron 1420", STAC_DELL_BIOS),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0227, "Dell Vostro 1400 ", STAC_DELL_BIOS),
+- SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x022f, "Dell ", STAC_DELL_BIOS),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x022e, "Dell ", STAC_DELL_BIOS),
++ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x022f, "Dell Inspiron 1525", STAC_DELL_3ST),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0242, "Dell ", STAC_DELL_BIOS),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0243, "Dell ", STAC_DELL_BIOS),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02ff, "Dell ", STAC_DELL_BIOS),
--- /dev/null
+From tiwai@suse.de Tue Sep 30 14:39:40 2008
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Tue, 30 Sep 2008 11:50:35 +0200
+Subject: ALSA: oxygen: fix distorted output on AK4396-based cards
+To: stable@kernel.org
+Message-ID: <s5hfxnihsic.wl%tiwai@suse.de>
+
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+Upstream-commit-id: df91bc23dcb052ff2da71b3482bf3c5fbf4b8a53
+
+When changing the sample rate, the CMI8788's master clock output becomes
+unstable for a short time. The AK4396 needs the master clock to do SPI
+writes, so writing to an AK4396 control register directly after a sample
+rate change will garble the value. In our case, this leads to the DACs
+being misconfigured to I2S sample format, which results in a wrong
+output level and horrible distortions on samples louder than -6 dB.
+
+To fix this, we need to wait until the new master clock signal has
+become stable before doing SPI writes.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/oxygen/hifier.c | 4 ++++
+ sound/pci/oxygen/oxygen.c | 4 ++++
+ 2 files changed, 8 insertions(+)
+
+--- a/sound/pci/oxygen/hifier.c
++++ b/sound/pci/oxygen/hifier.c
+@@ -17,6 +17,7 @@
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
++#include <linux/delay.h>
+ #include <linux/pci.h>
+ #include <sound/control.h>
+ #include <sound/core.h>
+@@ -95,6 +96,9 @@ static void set_ak4396_params(struct oxy
+ else
+ value |= AK4396_DFS_QUAD;
+ data->ak4396_ctl2 = value;
++
++ msleep(1); /* wait for the new MCLK to become stable */
++
+ ak4396_write(chip, AK4396_CONTROL_1, AK4396_DIF_24_MSB);
+ ak4396_write(chip, AK4396_CONTROL_2, value);
+ ak4396_write(chip, AK4396_CONTROL_1, AK4396_DIF_24_MSB | AK4396_RSTN);
+--- a/sound/pci/oxygen/oxygen.c
++++ b/sound/pci/oxygen/oxygen.c
+@@ -28,6 +28,7 @@
+ * GPIO 1 -> DFS1 of AK5385
+ */
+
++#include <linux/delay.h>
+ #include <linux/mutex.h>
+ #include <linux/pci.h>
+ #include <sound/ac97_codec.h>
+@@ -173,6 +174,9 @@ static void set_ak4396_params(struct oxy
+ else
+ value |= AK4396_DFS_QUAD;
+ data->ak4396_ctl2 = value;
++
++ msleep(1); /* wait for the new MCLK to become stable */
++
+ for (i = 0; i < 4; ++i) {
+ ak4396_write(chip, i,
+ AK4396_CONTROL_1, AK4396_DIF_24_MSB);
--- /dev/null
+From tiwai@suse.de Tue Sep 30 14:40:33 2008
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 30 Sep 2008 11:54:12 +0200
+Subject: ALSA: remove unneeded power_mutex lock in snd_pcm_drop
+To: stable@kernel.org
+Message-ID: <s5hd4imhscb.wl%tiwai@suse.de>
+
+From: Takashi Iwai <tiwai@suse.de>
+
+Upstream-commit-id: 24e8fc498e9618338854bfbcf8d1d737e0bf1775
+
+The power_mutex lock in snd_pcm_drop may cause a possible deadlock
+chain, and above all, it's unneeded. Let's get rid of it.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/pcm_native.c | 13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -1545,16 +1545,10 @@ static int snd_pcm_drop(struct snd_pcm_s
+ card = substream->pcm->card;
+
+ if (runtime->status->state == SNDRV_PCM_STATE_OPEN ||
+- runtime->status->state == SNDRV_PCM_STATE_DISCONNECTED)
++ runtime->status->state == SNDRV_PCM_STATE_DISCONNECTED ||
++ runtime->status->state == SNDRV_PCM_STATE_SUSPENDED)
+ return -EBADFD;
+
+- snd_power_lock(card);
+- if (runtime->status->state == SNDRV_PCM_STATE_SUSPENDED) {
+- result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
+- if (result < 0)
+- goto _unlock;
+- }
+-
+ snd_pcm_stream_lock_irq(substream);
+ /* resume pause */
+ if (runtime->status->state == SNDRV_PCM_STATE_PAUSED)
+@@ -1563,8 +1557,7 @@ static int snd_pcm_drop(struct snd_pcm_s
+ snd_pcm_stop(substream, SNDRV_PCM_STATE_SETUP);
+ /* runtime->control->appl_ptr = runtime->status->hw_ptr; */
+ snd_pcm_stream_unlock_irq(substream);
+- _unlock:
+- snd_power_unlock(card);
++
+ return result;
+ }
+
--- /dev/null
+From jejb@kernel.org Tue Sep 30 14:31:32 2008
+From: Yuri Tikhonov <yur@emcraft.com>
+Date: Sat, 6 Sep 2008 01:10:06 GMT
+Subject: async_tx: fix the bug in async_tx_run_dependencies
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200809060110.m861A6v1026010@hera.kernel.org>
+
+From: Yuri Tikhonov <yur@emcraft.com>
+
+commit de24125dd0a452bfd4502fc448e3534c5d2e87aa upstream
+
+Should clear the next pointer of the TX if we are sure that the
+next TX (say NXT) will be submitted to the channel too. Overwise,
+we break the chain of descriptors, because we lose the information
+about the next descriptor to run. So next time, when invoke
+async_tx_run_dependencies() with TX, it's TX->next will be NULL, and
+NXT will be never submitted.
+
+Signed-off-by: Yuri Tikhonov <yur@emcraft.com>
+Signed-off-by: Ilya Yanok <yanok@emcraft.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ crypto/async_tx/async_tx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/crypto/async_tx/async_tx.c
++++ b/crypto/async_tx/async_tx.c
+@@ -136,7 +136,8 @@ async_tx_run_dependencies(struct dma_asy
+ spin_lock_bh(&next->lock);
+ next->parent = NULL;
+ _next = next->next;
+- next->next = NULL;
++ if (_next && _next->chan == chan)
++ next->next = NULL;
+ spin_unlock_bh(&next->lock);
+
+ next->tx_submit(next);
--- /dev/null
+From jejb@kernel.org Tue Sep 30 14:30:45 2008
+From: Andrew Morton <akpm@linux-foundation.org>
+Date: Sat, 6 Sep 2008 01:10:03 GMT
+Subject: drivers/mmc/card/block.c: fix refcount leak in mmc_block_open()
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200809060110.m861A3C0025941@hera.kernel.org>
+
+From: Andrew Morton <akpm@linux-foundation.org>
+
+commit 70bb08962ea9bd50797ae9f16b2493f5f7c65053 upstream
+
+mmc_block_open() increments md->usage although it returns with -EROFS when
+default mounting a MMC/SD card with write protect switch on. This
+reference counting bug prevents /dev/mmcblkX from being released on card
+removal, and situation worsen with reinsertion until the minor number
+range runs out.
+
+Reported-by: <sasin@solomon-systech.com>
+Acked-by: Pierre Ossman <drzeus-list@drzeus.cx>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mmc/card/block.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/card/block.c
++++ b/drivers/mmc/card/block.c
+@@ -103,8 +103,10 @@ static int mmc_blk_open(struct inode *in
+ check_disk_change(inode->i_bdev);
+ ret = 0;
+
+- if ((filp->f_mode & FMODE_WRITE) && md->read_only)
++ if ((filp->f_mode & FMODE_WRITE) && md->read_only) {
++ mmc_blk_put(md);
+ ret = -EROFS;
++ }
+ }
+
+ return ret;
--- /dev/null
+From jejb@kernel.org Tue Sep 30 14:29:23 2008
+From: Andy Gospodarek <andy@greyhouse.net>
+Date: Thu, 4 Sep 2008 01:05:06 GMT
+Subject: ixgbe: initialize interrupt throttle rate
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200809040105.m84156cO017526@hera.kernel.org>
+
+From: Andy Gospodarek <andy@greyhouse.net>
+
+commit 15e79f24b60c4b0bf8019423bda4e03a576b02f2 upstream
+
+This commit dropped the setting of the default interrupt throttle rate.
+
+commit 021230d40ae0e6508d6c717b6e0d6d81cd77ac25
+Author: Ayyappan Veeraiyan <ayyappan.veeraiyan@intel.com>
+Date: Mon Mar 3 15:03:45 2008 -0800
+
+ ixgbe: Introduce MSI-X queue vector code
+
+The following patch adds it back. Without this the default value of 0
+causes the performance of this card to be awful. Restoring these to the
+default values yields much better performance.
+
+This regression has been around since 2.6.25.
+
+Signed-off-by: Andy Gospodarek <andy@greyhouse.net>
+Acked-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/ixgbe/ixgbe_main.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/ixgbe/ixgbe_main.c
++++ b/drivers/net/ixgbe/ixgbe_main.c
+@@ -2258,6 +2258,12 @@ static int __devinit ixgbe_set_interrupt
+ int vector, v_budget;
+
+ /*
++ * Set the default interrupt throttle rate.
++ */
++ adapter->rx_eitr = (1000000 / IXGBE_DEFAULT_ITR_RX_USECS);
++ adapter->tx_eitr = (1000000 / IXGBE_DEFAULT_ITR_TX_USECS);
++
++ /*
+ * It's easy to be greedy for MSI-X vectors, but it really
+ * doesn't do us much good if we have a lot more vectors
+ * than CPU's. So let's be conservative and only ask for
--- /dev/null
+From avi@qumranet.com Tue Sep 30 14:41:25 2008
+From: Joerg Roedel <joerg.roedel@amd.com>
+Date: Sat, 13 Sep 2008 08:38:42 +0300
+Subject: KVM: SVM: fix guest global tlb flushes with NPT
+To: stable@kernel.org
+Cc: Joerg Roedel <joerg.roedel@amd.com>
+Message-ID: <1221284322-11623-3-git-send-email-avi@qumranet.com>
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+(cherry picked from commit e5eab0cede4b1ffaca4ad857d840127622038e55)
+
+Accesses to CR4 are intercepted even with Nested Paging enabled. But the code
+does not check if the guest wants to do a global TLB flush. So this flush gets
+lost. This patch adds the check and the flush to svm_set_cr4.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Avi Kivity <avi@qumranet.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/svm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -880,6 +880,10 @@ set:
+ static void svm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
+ {
+ unsigned long host_cr4_mce = read_cr4() & X86_CR4_MCE;
++ unsigned long old_cr4 = to_svm(vcpu)->vmcb->save.cr4;
++
++ if (npt_enabled && ((old_cr4 ^ cr4) & X86_CR4_PGE))
++ force_new_asid(vcpu);
+
+ vcpu->arch.cr4 = cr4;
+ if (!npt_enabled)
--- /dev/null
+From avi@qumranet.com Tue Sep 30 14:40:59 2008
+From: Joerg Roedel <joerg.roedel@amd.com>
+Date: Sat, 13 Sep 2008 08:38:41 +0300
+Subject: KVM: SVM: fix random segfaults with NPT enabled
+To: stable@kernel.org
+Cc: Joerg Roedel <joerg.roedel@amd.com>
+Message-ID: <1221284322-11623-2-git-send-email-avi@qumranet.com>
+
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+(cherry picked from commit 44874f84918e37b64bec6df1587e5fe2fdf6ab62)
+
+This patch introduces a guest TLB flush on every NPF exit in KVM. This fixes
+random segfaults and #UD exceptions in the guest seen under some workloads
+(e.g. long running compile workloads or tbench). A kernbench run with and
+without that fix showed that it has a slowdown lower than 0.5%
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Alexander Graf <agraf@suse.de>
+Signed-off-by: Avi Kivity <avi@qumranet.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/svm.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -60,6 +60,7 @@ static int npt = 1;
+ module_param(npt, int, S_IRUGO);
+
+ static void kvm_reput_irq(struct vcpu_svm *svm);
++static void svm_flush_tlb(struct kvm_vcpu *vcpu);
+
+ static inline struct vcpu_svm *to_svm(struct kvm_vcpu *vcpu)
+ {
+@@ -1017,6 +1018,15 @@ static int pf_interception(struct vcpu_s
+
+ fault_address = svm->vmcb->control.exit_info_2;
+ error_code = svm->vmcb->control.exit_info_1;
++
++ /*
++ * FIXME: Tis shouldn't be necessary here, but there is a flush
++ * missing in the MMU code. Until we find this bug, flush the
++ * complete TLB here on an NPF
++ */
++ if (npt_enabled)
++ svm_flush_tlb(&svm->vcpu);
++
+ if (event_injection)
+ kvm_mmu_unprotect_page_virt(&svm->vcpu, fault_address);
+ return kvm_mmu_page_fault(&svm->vcpu, fault_address, error_code);
--- /dev/null
+From jejb@kernel.org Tue Sep 30 14:33:33 2008
+From: Mel Gorman <mel@csn.ul.ie>
+Date: Sat, 13 Sep 2008 22:05:39 GMT
+Subject: mm: mark the correct zone as full when scanning zonelists
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200809132205.m8DM5dlJ029578@hera.kernel.org>
+
+From: Mel Gorman <mel@csn.ul.ie>
+
+commit 5bead2a0680687b9576d57c177988e8aa082b922 upstream
+
+The iterator for_each_zone_zonelist() uses a struct zoneref *z cursor when
+scanning zonelists to keep track of where in the zonelist it is. The
+zoneref that is returned corresponds to the the next zone that is to be
+scanned, not the current one. It was intended to be treated as an opaque
+list.
+
+When the page allocator is scanning a zonelist, it marks elements in the
+zonelist corresponding to zones that are temporarily full. As the
+zonelist is being updated, it uses the cursor here;
+
+ if (NUMA_BUILD)
+ zlc_mark_zone_full(zonelist, z);
+
+This is intended to prevent rescanning in the near future but the zoneref
+cursor does not correspond to the zone that has been found to be full.
+This is an easy misunderstanding to make so this patch corrects the
+problem by changing zoneref cursor to be the current zone being scanned
+instead of the next one.
+
+Signed-off-by: Mel Gorman <mel@csn.ul.ie>
+Cc: Andy Whitcroft <apw@shadowen.org>
+Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/mmzone.h | 12 ++++++------
+ mm/mmzone.c | 2 +-
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -751,8 +751,9 @@ static inline int zonelist_node_idx(stru
+ *
+ * This function returns the next zone at or below a given zone index that is
+ * within the allowed nodemask using a cursor as the starting point for the
+- * search. The zoneref returned is a cursor that is used as the next starting
+- * point for future calls to next_zones_zonelist().
++ * search. The zoneref returned is a cursor that represents the current zone
++ * being examined. It should be advanced by one before calling
++ * next_zones_zonelist again.
+ */
+ struct zoneref *next_zones_zonelist(struct zoneref *z,
+ enum zone_type highest_zoneidx,
+@@ -768,9 +769,8 @@ struct zoneref *next_zones_zonelist(stru
+ *
+ * This function returns the first zone at or below a given zone index that is
+ * within the allowed nodemask. The zoneref returned is a cursor that can be
+- * used to iterate the zonelist with next_zones_zonelist. The cursor should
+- * not be used by the caller as it does not match the value of the zone
+- * returned.
++ * used to iterate the zonelist with next_zones_zonelist by advancing it by
++ * one before calling.
+ */
+ static inline struct zoneref *first_zones_zonelist(struct zonelist *zonelist,
+ enum zone_type highest_zoneidx,
+@@ -795,7 +795,7 @@ static inline struct zoneref *first_zone
+ #define for_each_zone_zonelist_nodemask(zone, z, zlist, highidx, nodemask) \
+ for (z = first_zones_zonelist(zlist, highidx, nodemask, &zone); \
+ zone; \
+- z = next_zones_zonelist(z, highidx, nodemask, &zone)) \
++ z = next_zones_zonelist(++z, highidx, nodemask, &zone)) \
+
+ /**
+ * for_each_zone_zonelist - helper macro to iterate over valid zones in a zonelist at or below a given zone index
+--- a/mm/mmzone.c
++++ b/mm/mmzone.c
+@@ -69,6 +69,6 @@ struct zoneref *next_zones_zonelist(stru
+ (z->zone && !zref_in_nodemask(z, nodes)))
+ z++;
+
+- *zone = zonelist_zone(z++);
++ *zone = zonelist_zone(z);
+ return z;
+ }
--- /dev/null
+From jejb@kernel.org Tue Sep 30 14:35:17 2008
+From: Ned Forrester <nforrester@whoi.edu>
+Date: Sat, 13 Sep 2008 22:05:54 GMT
+Subject: pxa2xx_spi: chipselect bugfixes
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200809132205.m8DM5rSW029657@hera.kernel.org>
+
+From: Ned Forrester <nforrester@whoi.edu>
+
+commit 8423597d676615f3dd2d9ab36f59f147086b90b8 upstream
+
+Fixes several chipselect bugs in the pxa2xx_spi driver. These bugs are in
+all versions of this driver and prevent using it with chips like m25p16
+flash.
+
+ 1. The spi_transfer.cs_change flag is handled too early:
+ before spi_transfer.delay_usecs applies, thus making the
+ delay ineffective at holding chip select.
+
+ 2. spi_transfer.delay_usecs is ignored on the last transfer
+ of a message (likewise not holding chipselect long enough).
+
+ 3. If spi_transfer.cs_change is set on the last transfer, the
+ chip select is always disabled, instead of the intended
+ meaning: optionally holding chip select enabled for the
+ next message.
+
+Those first three bugs were fixed with a relocation of delays
+and chip select de-assertions.
+
+ 4. If a message has the cs_change flag set on the last transfer,
+ and had the chip select stayed enabled as requested (see 3,
+ above), it would not have been disabled if the next message is
+ for a different chip. Fixed by dropping chip select regardless
+ of cs_change at end of a message, if there is no next message
+ or if the next message is for a different chip.
+
+This patch should apply to all kernels back to and including 2.6.20;
+it was test patched against 2.6.20. An additional patch would be
+required for older kernels, but those versions are very buggy anyway.
+
+Signed-off-by: Ned Forrester <nforrester@whoi.edu>
+Cc: Vernon Sauder <vernoninhand@gmail.com>
+Cc: Eric Miao <eric.y.miao@gmail.com>
+Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/spi/pxa2xx_spi.c | 59 ++++++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 48 insertions(+), 11 deletions(-)
+
+--- a/drivers/spi/pxa2xx_spi.c
++++ b/drivers/spi/pxa2xx_spi.c
+@@ -146,7 +146,6 @@ struct driver_data {
+ size_t tx_map_len;
+ u8 n_bytes;
+ u32 dma_width;
+- int cs_change;
+ int (*write)(struct driver_data *drv_data);
+ int (*read)(struct driver_data *drv_data);
+ irqreturn_t (*transfer_handler)(struct driver_data *drv_data);
+@@ -408,8 +407,45 @@ static void giveback(struct driver_data
+ struct spi_transfer,
+ transfer_list);
+
++ /* Delay if requested before any change in chip select */
++ if (last_transfer->delay_usecs)
++ udelay(last_transfer->delay_usecs);
++
++ /* Drop chip select UNLESS cs_change is true or we are returning
++ * a message with an error, or next message is for another chip
++ */
+ if (!last_transfer->cs_change)
+ drv_data->cs_control(PXA2XX_CS_DEASSERT);
++ else {
++ struct spi_message *next_msg;
++
++ /* Holding of cs was hinted, but we need to make sure
++ * the next message is for the same chip. Don't waste
++ * time with the following tests unless this was hinted.
++ *
++ * We cannot postpone this until pump_messages, because
++ * after calling msg->complete (below) the driver that
++ * sent the current message could be unloaded, which
++ * could invalidate the cs_control() callback...
++ */
++
++ /* get a pointer to the next message, if any */
++ spin_lock_irqsave(&drv_data->lock, flags);
++ if (list_empty(&drv_data->queue))
++ next_msg = NULL;
++ else
++ next_msg = list_entry(drv_data->queue.next,
++ struct spi_message, queue);
++ spin_unlock_irqrestore(&drv_data->lock, flags);
++
++ /* see if the next and current messages point
++ * to the same chip
++ */
++ if (next_msg && next_msg->spi != msg->spi)
++ next_msg = NULL;
++ if (!next_msg || msg->state == ERROR_STATE)
++ drv_data->cs_control(PXA2XX_CS_DEASSERT);
++ }
+
+ msg->state = NULL;
+ if (msg->complete)
+@@ -492,10 +528,9 @@ static void dma_transfer_complete(struct
+ msg->actual_length += drv_data->len -
+ (drv_data->rx_end - drv_data->rx);
+
+- /* Release chip select if requested, transfer delays are
+- * handled in pump_transfers */
+- if (drv_data->cs_change)
+- drv_data->cs_control(PXA2XX_CS_DEASSERT);
++ /* Transfer delays and chip select release are
++ * handled in pump_transfers or giveback
++ */
+
+ /* Move to next transfer */
+ msg->state = next_transfer(drv_data);
+@@ -604,10 +639,9 @@ static void int_transfer_complete(struct
+ drv_data->cur_msg->actual_length += drv_data->len -
+ (drv_data->rx_end - drv_data->rx);
+
+- /* Release chip select if requested, transfer delays are
+- * handled in pump_transfers */
+- if (drv_data->cs_change)
+- drv_data->cs_control(PXA2XX_CS_DEASSERT);
++ /* Transfer delays and chip select release are
++ * handled in pump_transfers or giveback
++ */
+
+ /* Move to next transfer */
+ drv_data->cur_msg->state = next_transfer(drv_data);
+@@ -842,13 +876,17 @@ static void pump_transfers(unsigned long
+ return;
+ }
+
+- /* Delay if requested at end of transfer*/
++ /* Delay if requested at end of transfer before CS change */
+ if (message->state == RUNNING_STATE) {
+ previous = list_entry(transfer->transfer_list.prev,
+ struct spi_transfer,
+ transfer_list);
+ if (previous->delay_usecs)
+ udelay(previous->delay_usecs);
++
++ /* Drop chip select only if cs_change is requested */
++ if (previous->cs_change)
++ drv_data->cs_control(PXA2XX_CS_DEASSERT);
+ }
+
+ /* Check for transfers that need multiple DMA segments */
+@@ -893,7 +931,6 @@ static void pump_transfers(unsigned long
+ drv_data->len = transfer->len & DCMD_LENGTH;
+ drv_data->write = drv_data->tx ? chip->write : null_writer;
+ drv_data->read = drv_data->rx ? chip->read : null_reader;
+- drv_data->cs_change = transfer->cs_change;
+
+ /* Change speed and bit per word on a per transfer */
+ cr0 = chip->cr0;
--- /dev/null
+From jejb@kernel.org Tue Sep 30 14:34:36 2008
+From: Ned Forrester <nforrester@whoi.edu>
+Date: Sat, 13 Sep 2008 22:05:47 GMT
+Subject: pxa2xx_spi: dma bugfixes
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200809132205.m8DM5lh6029615@hera.kernel.org>
+
+From: Ned Forrester <nforrester@whoi.edu>
+
+commit 7e96445533ac3f4f7964646a202ff3620602fab4 upstream
+
+Fixes two DMA bugs in the pxa2xx_spi driver. The first bug is in all
+versions of this driver; the second was introduced in the 2.6.20 kernel,
+and prevents using the driver with chips like m25p16 flash (which can
+issue large DMA reads).
+
+ 1. Zero length transfers are permitted for use to insert timing,
+ but pxa2xx_spi.c will fail if this is requested in DMA mode.
+ Fixed by using programmed I/O (PIO) mode for such transfers.
+
+ 2. Transfers larger than 8191 are not permitted in DMA mode. A
+ test for length rejects all large transfers regardless of DMA
+ or PIO mode. Worked around by rejecting only large transfers
+ with DMA mapped buffers, and forcing all other transfers
+ larger than 8191 to use PIO mode. A rate limited warning is
+ issued for DMA transfers forced to PIO mode.
+
+This patch should apply to all kernels back to and including 2.6.20;
+it was test patched against 2.6.20. An additional patch would be
+required for older kernels, but those versions are very buggy anyway.
+
+Signed-off-by: Ned Forrester <nforrester@whoi.edu>
+Cc: Vernon Sauder <vernoninhand@gmail.com>
+Cc: Eric Miao <eric.y.miao@gmail.com>
+Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/spi/pxa2xx_spi.c | 57 +++++++++++++++++++++++++++++++++++------------
+ 1 file changed, 43 insertions(+), 14 deletions(-)
+
+--- a/drivers/spi/pxa2xx_spi.c
++++ b/drivers/spi/pxa2xx_spi.c
+@@ -48,9 +48,10 @@ MODULE_ALIAS("platform:pxa2xx-spi");
+
+ #define MAX_BUSES 3
+
+-#define DMA_INT_MASK (DCSR_ENDINTR | DCSR_STARTINTR | DCSR_BUSERR)
+-#define RESET_DMA_CHANNEL (DCSR_NODESC | DMA_INT_MASK)
+-#define IS_DMA_ALIGNED(x) (((u32)(x)&0x07)==0)
++#define DMA_INT_MASK (DCSR_ENDINTR | DCSR_STARTINTR | DCSR_BUSERR)
++#define RESET_DMA_CHANNEL (DCSR_NODESC | DMA_INT_MASK)
++#define IS_DMA_ALIGNED(x) (((x) & 0x07) == 0)
++#define MAX_DMA_LEN 8191
+
+ /*
+ * for testing SSCR1 changes that require SSP restart, basically
+@@ -850,14 +851,27 @@ static void pump_transfers(unsigned long
+ udelay(previous->delay_usecs);
+ }
+
+- /* Check transfer length */
+- if (transfer->len > 8191)
+- {
+- dev_warn(&drv_data->pdev->dev, "pump_transfers: transfer "
+- "length greater than 8191\n");
+- message->status = -EINVAL;
+- giveback(drv_data);
+- return;
++ /* Check for transfers that need multiple DMA segments */
++ if (transfer->len > MAX_DMA_LEN && chip->enable_dma) {
++
++ /* reject already-mapped transfers; PIO won't always work */
++ if (message->is_dma_mapped
++ || transfer->rx_dma || transfer->tx_dma) {
++ dev_err(&drv_data->pdev->dev,
++ "pump_transfers: mapped transfer length "
++ "of %lu is greater than %d\n",
++ transfer->len, MAX_DMA_LEN);
++ message->status = -EINVAL;
++ giveback(drv_data);
++ return;
++ }
++
++ /* warn ... we force this to PIO mode */
++ if (printk_ratelimit())
++ dev_warn(&message->spi->dev, "pump_transfers: "
++ "DMA disabled for transfer length %ld "
++ "greater than %d\n",
++ (long)drv_data->len, MAX_DMA_LEN);
+ }
+
+ /* Setup the transfer state based on the type of transfer */
+@@ -926,7 +940,7 @@ static void pump_transfers(unsigned long
+ &dma_thresh))
+ if (printk_ratelimit())
+ dev_warn(&message->spi->dev,
+- "pump_transfer: "
++ "pump_transfers: "
+ "DMA burst size reduced to "
+ "match bits_per_word\n");
+ }
+@@ -940,8 +954,23 @@ static void pump_transfers(unsigned long
+
+ message->state = RUNNING_STATE;
+
+- /* Try to map dma buffer and do a dma transfer if successful */
+- if ((drv_data->dma_mapped = map_dma_buffers(drv_data))) {
++ /* Try to map dma buffer and do a dma transfer if successful, but
++ * only if the length is non-zero and less than MAX_DMA_LEN.
++ *
++ * Zero-length non-descriptor DMA is illegal on PXA2xx; force use
++ * of PIO instead. Care is needed above because the transfer may
++ * have have been passed with buffers that are already dma mapped.
++ * A zero-length transfer in PIO mode will not try to write/read
++ * to/from the buffers
++ *
++ * REVISIT large transfers are exactly where we most want to be
++ * using DMA. If this happens much, split those transfers into
++ * multiple DMA segments rather than forcing PIO.
++ */
++ drv_data->dma_mapped = 0;
++ if (drv_data->len > 0 && drv_data->len <= MAX_DMA_LEN)
++ drv_data->dma_mapped = map_dma_buffers(drv_data);
++ if (drv_data->dma_mapped) {
+
+ /* Ensure we have the correct interrupt handler */
+ drv_data->transfer_handler = dma_transfer;
--- /dev/null
+From jejb@kernel.org Tue Sep 30 14:37:56 2008
+From: Andrew Vasquez <andrew.vasquez@qlogic.com>
+Date: Mon, 29 Sep 2008 15:15:04 GMT
+Subject: SCSI: qla2xxx: Defer enablement of RISC interrupts until ISP initialization completes.
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200809291515.m8TFF4OM025874@hera.kernel.org>
+
+From: Andrew Vasquez <andrew.vasquez@qlogic.com>
+
+commit 048feec5548c0582ee96148c61b87cccbcb5f9be upstream
+
+Josip Rodin noted
+(http://article.gmane.org/gmane.linux.ports.sparc/10152) the
+driver oopsing during registration of an rport to the
+FC-transport layer with a backtrace indicating a dereferencing of
+an shost->shost_data equal to NULL. David Miller identified a
+small window in driver logic where this could happen:
+
+ > Look at how the driver registers the IRQ handler before the host has
+ > been registered with the SCSI layer.
+ >
+ > That leads to a window of time where the shost hasn't been setup
+ > fully, yet ISRs can come in and trigger DPC thread events, such as
+ > loop resyncs, which expect the transport area to be setup.
+ >
+ > But it won't be setup, because scsi_add_host() hasn't finished yet.
+ >
+ > Note that in Josip's crash log, we don't even see the
+ >
+ > qla_printk(KERN_INFO, ha, "\n"
+ > " QLogic Fibre Channel HBA Driver: %s\n"
+ > " QLogic %s - %s\n"
+ > " ISP%04X: %s @ %s hdma%c, host#=%ld, fw=%s\n",
+ > ...
+ >
+ > message yet.
+ >
+ > Which means that the crash occurs between qla2x00_request_irqs()
+ > and printing that message.
+
+Close this window by enabling RISC interrupts after the host has
+been registered with the SCSI midlayer.
+
+Reported-by: Josip Rodin <joy@entuzijast.net>
+Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/qla2xxx/qla_isr.c | 1 -
+ drivers/scsi/qla2xxx/qla_os.c | 2 ++
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -1838,7 +1838,6 @@ clear_risc_ints:
+ WRT_REG_WORD(®->isp.hccr, HCCR_CLR_HOST_INT);
+ }
+ spin_unlock_irq(&ha->hardware_lock);
+- ha->isp_ops->enable_intrs(ha);
+
+ fail:
+ return ret;
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -1740,6 +1740,8 @@ qla2x00_probe_one(struct pci_dev *pdev,
+ if (ret)
+ goto probe_failed;
+
++ ha->isp_ops->enable_intrs(ha);
++
+ scsi_scan_host(host);
+
+ qla2x00_alloc_sysfs_attr(ha);
--- /dev/null
+ixgbe-initialize-interrupt-throttle-rate.patch
+drivers-mmc-card-block.c-fix-refcount-leak-in-mmc_block_open.patch
+async_tx-fix-the-bug-in-async_tx_run_dependencies.patch
+mm-mark-the-correct-zone-as-full-when-scanning-zonelists.patch
+pxa2xx_spi-dma-bugfixes.patch
+pxa2xx_spi-chipselect-bugfixes.patch
+smb.h-do-not-include-linux-time.h-in-userspace.patch
+usb-fix-hcd-interrupt-disabling.patch
+scsi-qla2xxx-defer-enablement-of-risc-interrupts-until-isp-initialization-completes.patch
+alsa-hda-fix-model-for-dell-inspiron-1525.patch
+alsa-oxygen-fix-distorted-output-on-ak4396-based-cards.patch
+alsa-fix-locking-in-snd_pcm_open-and-snd_rawmidi_open.patch
+alsa-remove-unneeded-power_mutex-lock-in-snd_pcm_drop.patch
+kvm-svm-fix-random-segfaults-with-npt-enabled.patch
+kvm-svm-fix-guest-global-tlb-flushes-with-npt.patch
--- /dev/null
+From jejb@kernel.org Tue Sep 30 14:36:15 2008
+From: Kirill A. Shutemov <kirill@shutemov.name>
+Date: Tue, 23 Sep 2008 17:25:04 GMT
+Subject: smb.h: do not include linux/time.h in userspace
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200809231725.m8NHP4kL022086@hera.kernel.org>
+
+From: Kirill A. Shutemov <kirill@shutemov.name>
+
+commit c32a162fd420fe8dfb049db941b2438061047fcc upstream
+
+linux/time.h conflicts with time.h from glibc
+
+It breaks building smbmount from samba. It's regression introduced by
+commit 76308da (" smb.h: uses struct timespec but didn't include
+linux/time.h").
+
+Signed-off-by: Kirill A. Shutemov <kirill@shutemov.name>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/smb.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/include/linux/smb.h
++++ b/include/linux/smb.h
+@@ -11,7 +11,9 @@
+
+ #include <linux/types.h>
+ #include <linux/magic.h>
++#ifdef __KERNEL__
+ #include <linux/time.h>
++#endif
+
+ enum smb_protocol {
+ SMB_PROTOCOL_NONE,
--- /dev/null
+From jejb@kernel.org Tue Sep 30 14:36:59 2008
+From: Geoff Levand <geoffrey.levand@am.sony.com>
+Date: Tue, 23 Sep 2008 22:05:34 GMT
+Subject: USB: fix hcd interrupt disabling
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200809232205.m8NM5Y25006025@hera.kernel.org>
+
+From: Geoff Levand <geoffrey.levand@am.sony.com>
+
+commit 83a798207361cc26385187b2e71efa2b5d75de7f upstream
+
+Commit de85422b94ddb23c021126815ea49414047c13dc, 'USB: fix interrupt
+disabling for HCDs with shared interrupt handlers' changed usb_add_hcd()
+to strip IRQF_DISABLED from irqflags prior to calling request_irq()
+with the justification that such a removal was necessary for shared
+interrupts to work properly. Unfortunately, the change in that commit
+unconditionally removes the IRQF_DISABLED flag, causing problems on
+platforms that don't use a shared interrupt but require IRQF_DISABLED.
+This change adds a check for IRQF_SHARED prior to removing the
+IRQF_DISABLED flag.
+
+Fixes the PS3 system startup hang reported with recent Fedora and
+OpenSUSE kernels.
+
+Note that this problem is hidden when CONFIG_LOCKDEP=y (ps3_defconfig),
+as local_irq_enable_in_hardirq() is defined as a null statement for
+that config.
+
+Signed-off-by: Geoff Levand <geoffrey.levand@am.sony.com>
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Cc: Stefan Becker <Stefan.Becker@nokia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/hcd.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -1885,7 +1885,8 @@ int usb_add_hcd(struct usb_hcd *hcd,
+ * with IRQF_SHARED. As usb_hcd_irq() will always disable
+ * interrupts we can remove it here.
+ */
+- irqflags &= ~IRQF_DISABLED;
++ if (irqflags & IRQF_SHARED)
++ irqflags &= ~IRQF_DISABLED;
+
+ snprintf(hcd->irq_descr, sizeof(hcd->irq_descr), "%s:usb%d",
+ hcd->driver->description, hcd->self.busnum);
projects / thirdparty / kernel / stable-queue.git / commitdiff
