.39 patches

15 files changed, 707 insertions, 0 deletions

diff --git a/queue-2.6.39/cifs-silence-printk-when-establishing-first-session-on.patch b/queue-2.6.39/cifs-silence-printk-when-establishing-first-session-on.patch
new file mode 100644
index 0000000000..0ded79aca4
--- /dev/null
+++ b/queue-2.6.39/cifs-silence-printk-when-establishing-first-session-on.patch
@@ -0,0 +1,40 @@
+From 9c4843ea576107a3c1fb94f2f758f198e9fe9e54 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Mon, 6 Jun 2011 15:40:23 -0400
+Subject: cifs: silence printk when establishing first session on
+ socket
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit 9c4843ea576107a3c1fb94f2f758f198e9fe9e54 upstream.
+
+When signing is enabled, the first session that's established on a
+socket will cause a printk like this to pop:
+
+    CIFS VFS: Unexpected SMB signature
+
+This is because the key exchange hasn't happened yet, so the signature
+field is bogus. Don't try to check the signature on the socket until the
+first session has been established. Also, eliminate the specific check
+for SMB_COM_NEGOTIATE since this check covers that case too.
+
+Cc: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/cifsencrypt.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/cifs/cifsencrypt.c
++++ b/fs/cifs/cifsencrypt.c
+@@ -184,7 +184,7 @@ int cifs_verify_signature(struct smb_hdr
+ 	if (cifs_pdu == NULL || server == NULL)
+ 		return -EINVAL;
+ 
+-	if (cifs_pdu->Command == SMB_COM_NEGOTIATE)
++	if (!server->session_estab)
+ 		return 0;
+ 
+ 	if (cifs_pdu->Command == SMB_COM_LOCKING_ANDX) {
diff --git a/queue-2.6.39/drm-i915-add-a-no-lvds-quirk-for-the-asus-eeebox-pc-eb1007.patch b/queue-2.6.39/drm-i915-add-a-no-lvds-quirk-for-the-asus-eeebox-pc-eb1007.patch
new file mode 100644
index 0000000000..b9f9b4bf6a
--- /dev/null
+++ b/queue-2.6.39/drm-i915-add-a-no-lvds-quirk-for-the-asus-eeebox-pc-eb1007.patch
@@ -0,0 +1,39 @@
+From 6a574b5b9b186e28abd3e571dfd1700c5220b510 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sat, 4 Jun 2011 15:39:21 +0200
+Subject: drm/i915: Add a no lvds quirk for the Asus EeeBox PC EB1007
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 6a574b5b9b186e28abd3e571dfd1700c5220b510 upstream.
+
+I found this while figuring out why gnome-shell would not run on my
+Asus EeeBox PC EB1007. As a standalone "pc" this device cleary does not have
+an internal panel, yet it claims it does. Add a quirk to fix this.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_lvds.c |    8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -727,6 +727,14 @@ static const struct dmi_system_id intel_
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "U800"),
+ 		},
+ 	},
++	{
++		.callback = intel_no_lvds_dmi_callback,
++		.ident = "Asus EeeBox PC EB1007",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer INC."),
++			DMI_MATCH(DMI_PRODUCT_NAME, "EB1007"),
++		},
++	},
+ 
+ 	{ }	/* terminating entry */
+ };
diff --git a/queue-2.6.39/drm-radeon-kms-fix-for-radeon-on-systems-4gb-without.patch b/queue-2.6.39/drm-radeon-kms-fix-for-radeon-on-systems-4gb-without.patch
new file mode 100644
index 0000000000..1b9692d7fe
--- /dev/null
+++ b/queue-2.6.39/drm-radeon-kms-fix-for-radeon-on-systems-4gb-without.patch
@@ -0,0 +1,43 @@
+From 62fff811d73095bd95579d72f558f03c78f7914a Mon Sep 17 00:00:00 2001
+From: Daniel Haid <d.haid@gogi.tv>
+Date: Wed, 8 Jun 2011 20:04:45 +1000
+Subject: drm/radeon/kms: fix for radeon on systems >4GB without
+ hardware iommu
+
+From: Daniel Haid <d.haid@gogi.tv>
+
+commit 62fff811d73095bd95579d72f558f03c78f7914a upstream.
+
+On my x86_64 system with >4GB of ram and swiotlb instead of
+a hardware iommu (because I have a VIA chipset), the call
+to pci_set_dma_mask (see below) with 40bits returns an error.
+
+But it seems that the radeon driver is designed to have
+need_dma32 = true exactly if pci_set_dma_mask is called
+with 32 bits and false if it is called with 40 bits.
+
+I have read somewhere that the default are 32 bits. So if the
+call fails I suppose that need_dma32 should be set to true.
+
+And indeed the patch fixes the problem I have had before
+and which I had described here:
+http://choon.net/forum/read.php?21,106131,115940
+
+Acked-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_device.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -752,6 +752,7 @@ int radeon_device_init(struct radeon_dev
+ 	dma_bits = rdev->need_dma32 ? 32 : 40;
+ 	r = pci_set_dma_mask(rdev->pdev, DMA_BIT_MASK(dma_bits));
+ 	if (r) {
++		rdev->need_dma32 = true;
+ 		printk(KERN_WARNING "radeon: No suitable DMA available.\n");
+ 	}
+ 
diff --git a/queue-2.6.39/drm-radeon-kms-viewport-height-has-to-be-even.patch b/queue-2.6.39/drm-radeon-kms-viewport-height-has-to-be-even.patch
new file mode 100644
index 0000000000..73d5ada9cd
--- /dev/null
+++ b/queue-2.6.39/drm-radeon-kms-viewport-height-has-to-be-even.patch
@@ -0,0 +1,65 @@
+From adcfde516e10aad72d66f6fefd36e6d0e6bd7be7 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Fri, 27 May 2011 10:05:03 -0400
+Subject: drm/radeon/kms: viewport height has to be even
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit adcfde516e10aad72d66f6fefd36e6d0e6bd7be7 upstream.
+
+Otherwise, no vblank interrupts.
+Fixes:
+https://bugs.freedesktop.org/show_bug.cgi?id=37522
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/atombios_crtc.c |   12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -1011,7 +1011,7 @@ static int dce4_crtc_do_set_base(struct
+ 	uint64_t fb_location;
+ 	uint32_t fb_format, fb_pitch_pixels, tiling_flags;
+ 	u32 fb_swap = EVERGREEN_GRPH_ENDIAN_SWAP(EVERGREEN_GRPH_ENDIAN_NONE);
+-	u32 tmp;
++	u32 tmp, viewport_w, viewport_h;
+ 	int r;
+ 
+ 	/* no fb bound */
+@@ -1137,8 +1137,10 @@ static int dce4_crtc_do_set_base(struct
+ 	y &= ~1;
+ 	WREG32(EVERGREEN_VIEWPORT_START + radeon_crtc->crtc_offset,
+ 	       (x << 16) | y);
++	viewport_w = crtc->mode.hdisplay;
++	viewport_h = (crtc->mode.vdisplay + 1) & ~1;
+ 	WREG32(EVERGREEN_VIEWPORT_SIZE + radeon_crtc->crtc_offset,
+-	       (crtc->mode.hdisplay << 16) | crtc->mode.vdisplay);
++	       (viewport_w << 16) | viewport_h);
+ 
+ 	/* pageflip setup */
+ 	/* make sure flip is at vb rather than hb */
+@@ -1179,7 +1181,7 @@ static int avivo_crtc_do_set_base(struct
+ 	uint64_t fb_location;
+ 	uint32_t fb_format, fb_pitch_pixels, tiling_flags;
+ 	u32 fb_swap = R600_D1GRPH_SWAP_ENDIAN_NONE;
+-	u32 tmp;
++	u32 tmp, viewport_w, viewport_h;
+ 	int r;
+ 
+ 	/* no fb bound */
+@@ -1304,8 +1306,10 @@ static int avivo_crtc_do_set_base(struct
+ 	y &= ~1;
+ 	WREG32(AVIVO_D1MODE_VIEWPORT_START + radeon_crtc->crtc_offset,
+ 	       (x << 16) | y);
++	viewport_w = crtc->mode.hdisplay;
++	viewport_h = (crtc->mode.vdisplay + 1) & ~1;
+ 	WREG32(AVIVO_D1MODE_VIEWPORT_SIZE + radeon_crtc->crtc_offset,
+-	       (crtc->mode.hdisplay << 16) | crtc->mode.vdisplay);
++	       (viewport_w << 16) | viewport_h);
+ 
+ 	/* pageflip setup */
+ 	/* make sure flip is at vb rather than hb */
diff --git a/queue-2.6.39/fat-fix-corrupt-inode-flags-when-remove-attr_sys-flag.patch b/queue-2.6.39/fat-fix-corrupt-inode-flags-when-remove-attr_sys-flag.patch
new file mode 100644
index 0000000000..b52e4b0c2d
--- /dev/null
+++ b/queue-2.6.39/fat-fix-corrupt-inode-flags-when-remove-attr_sys-flag.patch
@@ -0,0 +1,30 @@
+From 1adffbae22332bb558c2a29de19d9aca391869f6 Mon Sep 17 00:00:00 2001
+From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Date: Tue, 31 May 2011 19:38:07 +0900
+Subject: fat: Fix corrupt inode flags when remove ATTR_SYS flag
+
+From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+
+commit 1adffbae22332bb558c2a29de19d9aca391869f6 upstream.
+
+We are clearly missing '~' in fat_ioctl_set_attributes().
+
+Reported-by: Dmitry Dmitriev <dimondmm@yandex.ru>
+Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/fat/file.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/fat/file.c
++++ b/fs/fat/file.c
+@@ -102,7 +102,7 @@ static int fat_ioctl_set_attributes(stru
+ 		if (attr & ATTR_SYS)
+ 			inode->i_flags |= S_IMMUTABLE;
+ 		else
+-			inode->i_flags &= S_IMMUTABLE;
++			inode->i_flags &= ~S_IMMUTABLE;
+ 	}
+ 
+ 	fat_save_attrs(inode, attr);
diff --git a/queue-2.6.39/genirq-fix-descriptor-init-on-non-sparse-irqs.patch b/queue-2.6.39/genirq-fix-descriptor-init-on-non-sparse-irqs.patch
new file mode 100644
index 0000000000..bea6d78c04
--- /dev/null
+++ b/queue-2.6.39/genirq-fix-descriptor-init-on-non-sparse-irqs.patch
@@ -0,0 +1,46 @@
+From e7fbad300a7a6432238f086e3c9a61538a905858 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@stericsson.com>
+Date: Tue, 31 May 2011 18:14:39 +0200
+Subject: genirq: Fix descriptor init on non-sparse IRQs
+
+From: Linus Walleij <linus.walleij@stericsson.com>
+
+commit e7fbad300a7a6432238f086e3c9a61538a905858 upstream.
+
+The genirq changes are initializing descriptors for sparse IRQs quite
+differently from how non-sparse (stacked?) IRQs are initialized, with
+the effect that on my platform all IRQs are default-disabled on sparse
+IRQs and default-enabled if non-sparse IRQs are used, crashing some
+GPIO driver.
+
+Fix this by refactoring the non-sparse IRQs to use the same descriptor
+init function as the sparse IRQs.
+
+Signed-off: Linus Walleij <linus.walleij@linaro.org>
+Link: http://lkml.kernel.org/r/1306858479-16622-1-git-send-email-linus.walleij@stericsson.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/irq/irqdesc.c |    8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/kernel/irq/irqdesc.c
++++ b/kernel/irq/irqdesc.c
+@@ -257,13 +257,11 @@ int __init early_irq_init(void)
+ 	count = ARRAY_SIZE(irq_desc);
+ 
+ 	for (i = 0; i < count; i++) {
+-		desc[i].irq_data.irq = i;
+-		desc[i].irq_data.chip = &no_irq_chip;
+ 		desc[i].kstat_irqs = alloc_percpu(unsigned int);
+-		irq_settings_clr_and_set(desc, ~0, _IRQ_DEFAULT_INIT_FLAGS);
+-		alloc_masks(desc + i, GFP_KERNEL, node);
+-		desc_smp_init(desc + i, node);
++		alloc_masks(&desc[i], GFP_KERNEL, node);
++		raw_spin_lock_init(&desc[i].lock);
+ 		lockdep_set_class(&desc[i].lock, &irq_desc_lock_class);
++		desc_set_defaults(i, &desc[i], node);
+ 	}
+ 	return arch_early_irq_init();
+ }
diff --git a/queue-2.6.39/lockdep-fix-lock_is_held-on-recursion.patch b/queue-2.6.39/lockdep-fix-lock_is_held-on-recursion.patch
new file mode 100644
index 0000000000..61c01468b5
--- /dev/null
+++ b/queue-2.6.39/lockdep-fix-lock_is_held-on-recursion.patch
@@ -0,0 +1,40 @@
+From f2513cde93f0957d5dc6c09bc24b0cccd27d8e1d Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Date: Mon, 6 Jun 2011 12:32:43 +0200
+Subject: lockdep: Fix lock_is_held() on recursion
+
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+
+commit f2513cde93f0957d5dc6c09bc24b0cccd27d8e1d upstream.
+
+The main lock_is_held() user is lockdep_assert_held(), avoid false
+assertions in lockdep_off() sections by unconditionally reporting the
+lock is taken.
+
+[ the reason this is important is a lockdep_assert_held() in ttwu()
+  which triggers a warning under lockdep_off() as in printk() which
+  can trigger another wakeup and lock up due to spinlock
+  recursion, as reported and heroically debugged by Arne Jansen ]
+
+Reported-and-tested-by: Arne Jansen <lists@die-jansens.de>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Link: http://lkml.kernel.org/r/1307398759.2497.966.camel@laptop
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/lockdep.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/lockdep.c
++++ b/kernel/lockdep.c
+@@ -3242,7 +3242,7 @@ int lock_is_held(struct lockdep_map *loc
+ 	int ret = 0;
+ 
+ 	if (unlikely(current->lockdep_recursion))
+-		return ret;
++		return 1; /* avoid false negative lockdep_assert_held() */
+ 
+ 	raw_local_irq_save(flags);
+ 	check_flags(flags);
diff --git a/queue-2.6.39/media-fix-media-device-minor-registration.patch b/queue-2.6.39/media-fix-media-device-minor-registration.patch
new file mode 100644
index 0000000000..bc3b345670
--- /dev/null
+++ b/queue-2.6.39/media-fix-media-device-minor-registration.patch
@@ -0,0 +1,44 @@
+From 8c89ddd536bbe97c1e50424778a139abbf5763c3 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Mon, 30 May 2011 15:45:47 -0300
+Subject: [media] media: Fix media device minor registration
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+commit 8c89ddd536bbe97c1e50424778a139abbf5763c3 upstream.
+
+The find_next_zero_bit() is called with the from and to arguments in the
+wrong order. This results in the function always returning 0, and all
+media devices being registered with minor 0. Furthermore, mdev->minor is
+then used before being assigned with the find_next_zero_bit() return
+value. This really makes sure we'll always use minor 0.
+
+Fix this and let the system support more than one media device.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/media-devnode.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/media-devnode.c
++++ b/drivers/media/media-devnode.c
+@@ -213,14 +213,14 @@ int __must_check media_devnode_register(
+ 
+ 	/* Part 1: Find a free minor number */
+ 	mutex_lock(&media_devnode_lock);
+-	minor = find_next_zero_bit(media_devnode_nums, 0, MEDIA_NUM_DEVICES);
++	minor = find_next_zero_bit(media_devnode_nums, MEDIA_NUM_DEVICES, 0);
+ 	if (minor == MEDIA_NUM_DEVICES) {
+ 		mutex_unlock(&media_devnode_lock);
+ 		printk(KERN_ERR "could not get a free minor\n");
+ 		return -ENFILE;
+ 	}
+ 
+-	set_bit(mdev->minor, media_devnode_nums);
++	set_bit(minor, media_devnode_nums);
+ 	mutex_unlock(&media_devnode_lock);
+ 
+ 	mdev->minor = minor;
diff --git a/queue-2.6.39/series b/queue-2.6.39/series
index 8f487eefd9..0270a3ff14 100644
--- a/queue-2.6.39/series
+++ b/queue-2.6.39/series
@@ -32,3 +32,17 @@ asus-wmi-remove-__init-from-asus_wmi_platform_init.patch
 nl80211-fix-check-for-valid-ssid-size-in-scan-operations.patch
 block-export-blk_-get-put-_queue.patch
 usbnet-cdc_ncm-add-missing-.reset_resume-hook.patch
+lockdep-fix-lock_is_held-on-recursion.patch
+drm-i915-add-a-no-lvds-quirk-for-the-asus-eeebox-pc-eb1007.patch
+drm-radeon-kms-viewport-height-has-to-be-even.patch
+drm-radeon-kms-fix-for-radeon-on-systems-4gb-without.patch
+fat-fix-corrupt-inode-flags-when-remove-attr_sys-flag.patch
+xen-off-by-one-errors-in-multicalls.c.patch
+video-fix-use-after-free-by-vga16fb-on-rmmod.patch
+genirq-fix-descriptor-init-on-non-sparse-irqs.patch
+cifs-silence-printk-when-establishing-first-session-on.patch
+media-fix-media-device-minor-registration.patch
+x86-amd-iommu-use-only-per-device-dma_ops.patch
+x86-amd-iommu-fix-3-possible-endless-loops.patch
+x86-amd-iommu-fix-boot-crash-with-hidden-pci-devices.patch
+usb-cdc-acm-adding-second-acm-channel-support-for-nokia-e7.patch
diff --git a/queue-2.6.39/usb-cdc-acm-adding-second-acm-channel-support-for-nokia-e7.patch b/queue-2.6.39/usb-cdc-acm-adding-second-acm-channel-support-for-nokia-e7.patch
new file mode 100644
index 0000000000..b5e33dc9ba
--- /dev/null
+++ b/queue-2.6.39/usb-cdc-acm-adding-second-acm-channel-support-for-nokia-e7.patch
@@ -0,0 +1,33 @@
+From 4061fde2fa80f40cb27114f60500d38d0afcf350 Mon Sep 17 00:00:00 2001
+From: Toby Gray <toby.gray@realvnc.com>
+Date: Mon, 6 Jun 2011 14:52:48 +0100
+Subject: USB: cdc-acm: Adding second ACM channel support for Nokia E7
+ and C7
+
+From: Toby Gray <toby.gray@realvnc.com>
+
+commit 4061fde2fa80f40cb27114f60500d38d0afcf350 upstream.
+
+This adds the Nokia E7 and C7 to the list of devices in cdc-acm, allowing
+the secondary ACM channel on the device to be exposed. Without this patch
+the ACM driver won't claim this secondary channel as it's marked as
+having a vendor-specific protocol.
+
+Signed-off-by: Toby Gray <toby.gray@realvnc.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/class/cdc-acm.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1617,6 +1617,8 @@ static const struct usb_device_id acm_id
+ 	{ NOKIA_PCSUITE_ACM_INFO(0x04ce), }, /* Nokia E90 */
+ 	{ NOKIA_PCSUITE_ACM_INFO(0x01d4), }, /* Nokia E55 */
+ 	{ NOKIA_PCSUITE_ACM_INFO(0x0302), }, /* Nokia N8 */
++	{ NOKIA_PCSUITE_ACM_INFO(0x0335), }, /* Nokia E7 */
++	{ NOKIA_PCSUITE_ACM_INFO(0x03cd), }, /* Nokia C7 */
+ 	{ SAMSUNG_PCSUITE_ACM_INFO(0x6651), }, /* Samsung GTi8510 (INNOV8) */
+ 
+ 	/* NOTE: non-Nokia COMM/ACM/0xff is likely MSFT RNDIS... NOT a modem! */
diff --git a/queue-2.6.39/video-fix-use-after-free-by-vga16fb-on-rmmod.patch b/queue-2.6.39/video-fix-use-after-free-by-vga16fb-on-rmmod.patch
new file mode 100644
index 0000000000..763c82a64c
--- /dev/null
+++ b/queue-2.6.39/video-fix-use-after-free-by-vga16fb-on-rmmod.patch
@@ -0,0 +1,41 @@
+From a50d28de8d5085e0f34f96088a45cc156d022021 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bruno=20Pr=C3=A9mont?= <bonbons@linux-vserver.org>
+Date: Tue, 24 May 2011 19:59:17 +0000
+Subject: video: Fix use-after-free by vga16fb on rmmod
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Bruno=20Pr=C3=A9mont?= <bonbons@linux-vserver.org>
+
+commit a50d28de8d5085e0f34f96088a45cc156d022021 upstream.
+
+Since fb_info is now refcounted and thus may get freed at any time it
+gets unregistered module unloading will try to unregister framebuffer
+as stored in platform data on probe though this pointer may
+be stale.
+
+Cleanup platform data on framebuffer release.
+
+Signed-off-by: Bruno Prémont <bonbons@linux-vserver.org>
+Signed-off-by: Paul Mundt <lethal@linux-sh.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/vga16fb.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/video/vga16fb.c
++++ b/drivers/video/vga16fb.c
+@@ -1265,9 +1265,11 @@ static void vga16fb_imageblit(struct fb_
+ 
+ static void vga16fb_destroy(struct fb_info *info)
+ {
++	struct platform_device *dev = container_of(info->device, struct platform_device, dev);
+ 	iounmap(info->screen_base);
+ 	fb_dealloc_cmap(&info->cmap);
+ 	/* XXX unshare VGA regions */
++	platform_set_drvdata(dev, NULL);
+ 	framebuffer_release(info);
+ }
+ 
diff --git a/queue-2.6.39/x86-amd-iommu-fix-3-possible-endless-loops.patch b/queue-2.6.39/x86-amd-iommu-fix-3-possible-endless-loops.patch
new file mode 100644
index 0000000000..2b759a6987
--- /dev/null
+++ b/queue-2.6.39/x86-amd-iommu-fix-3-possible-endless-loops.patch
@@ -0,0 +1,52 @@
+From 0de66d5b35ee148455e268b2782873204ffdef4b Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <joerg.roedel@amd.com>
+Date: Mon, 6 Jun 2011 16:04:02 +0200
+Subject: x86/amd-iommu: Fix 3 possible endless loops
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+commit 0de66d5b35ee148455e268b2782873204ffdef4b upstream.
+
+The driver contains several loops counting on an u16 value
+where the exit-condition is checked against variables that
+can have values up to 0xffff. In this case the loops will
+never exit. This patch fixed 3 such loops.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/amd_iommu_init.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/kernel/amd_iommu_init.c
++++ b/arch/x86/kernel/amd_iommu_init.c
+@@ -701,8 +701,8 @@ static void __init init_iommu_from_acpi(
+ {
+ 	u8 *p = (u8 *)h;
+ 	u8 *end = p, flags = 0;
+-	u16 dev_i, devid = 0, devid_start = 0, devid_to = 0;
+-	u32 ext_flags = 0;
++	u16 devid = 0, devid_start = 0, devid_to = 0;
++	u32 dev_i, ext_flags = 0;
+ 	bool alias = false;
+ 	struct ivhd_entry *e;
+ 
+@@ -857,7 +857,7 @@ static void __init init_iommu_from_acpi(
+ /* Initializes the device->iommu mapping for the driver */
+ static int __init init_iommu_devices(struct amd_iommu *iommu)
+ {
+-	u16 i;
++	u32 i;
+ 
+ 	for (i = iommu->first_device; i <= iommu->last_device; ++i)
+ 		set_iommu_for_device(iommu, i);
+@@ -1146,7 +1146,7 @@ static int __init init_memory_definition
+  */
+ static void init_device_table(void)
+ {
+-	u16 devid;
++	u32 devid;
+ 
+ 	for (devid = 0; devid <= amd_iommu_last_bdf; ++devid) {
+ 		set_dev_entry_bit(devid, DEV_ENTRY_VALID);
diff --git a/queue-2.6.39/x86-amd-iommu-fix-boot-crash-with-hidden-pci-devices.patch b/queue-2.6.39/x86-amd-iommu-fix-boot-crash-with-hidden-pci-devices.patch
new file mode 100644
index 0000000000..39348244ac
--- /dev/null
+++ b/queue-2.6.39/x86-amd-iommu-fix-boot-crash-with-hidden-pci-devices.patch
@@ -0,0 +1,70 @@
+From 26018874e3584f1658570d41d57d4c34f6a53aa0 Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <joerg.roedel@amd.com>
+Date: Mon, 6 Jun 2011 16:50:14 +0200
+Subject: x86/amd-iommu: Fix boot crash with hidden PCI devices
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+commit 26018874e3584f1658570d41d57d4c34f6a53aa0 upstream.
+
+Some PCIe cards ship with a PCI-PCIe bridge which is not
+visible as a PCI device in Linux. But the device-id of the
+bridge is present in the IOMMU tables which causes a boot
+crash in the IOMMU driver.
+This patch fixes by removing these cards from the IOMMU
+handling. This is a pure -stable fix, a real fix to handle
+this situation appriatly will follow for the next merge
+window.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/amd_iommu.c |   22 +++++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/amd_iommu.c
++++ b/arch/x86/kernel/amd_iommu.c
+@@ -154,6 +154,10 @@ static int iommu_init_device(struct devi
+ 	pdev = pci_get_bus_and_slot(PCI_BUS(alias), alias & 0xff);
+ 	if (pdev)
+ 		dev_data->alias = &pdev->dev;
++	else {
++		kfree(dev_data);
++		return -ENOTSUPP;
++	}
+ 
+ 	atomic_set(&dev_data->bind, 0);
+ 
+@@ -163,6 +167,20 @@ static int iommu_init_device(struct devi
+ 	return 0;
+ }
+ 
++static void iommu_ignore_device(struct device *dev)
++{
++	u16 devid, alias;
++
++	devid = get_device_id(dev);
++	alias = amd_iommu_alias_table[devid];
++
++	memset(&amd_iommu_dev_table[devid], 0, sizeof(struct dev_table_entry));
++	memset(&amd_iommu_dev_table[alias], 0, sizeof(struct dev_table_entry));
++
++	amd_iommu_rlookup_table[devid] = NULL;
++	amd_iommu_rlookup_table[alias] = NULL;
++}
++
+ static void iommu_uninit_device(struct device *dev)
+ {
+ 	kfree(dev->archdata.iommu);
+@@ -192,7 +210,9 @@ int __init amd_iommu_init_devices(void)
+ 			continue;
+ 
+ 		ret = iommu_init_device(&pdev->dev);
+-		if (ret)
++		if (ret == -ENOTSUPP)
++			iommu_ignore_device(&pdev->dev);
++		else if (ret)
+ 			goto out_free;
+ 	}
+ 
diff --git a/queue-2.6.39/x86-amd-iommu-use-only-per-device-dma_ops.patch b/queue-2.6.39/x86-amd-iommu-use-only-per-device-dma_ops.patch
new file mode 100644
index 0000000000..6d4e8e9f64
--- /dev/null
+++ b/queue-2.6.39/x86-amd-iommu-use-only-per-device-dma_ops.patch
@@ -0,0 +1,78 @@
+From 27c2127a15d340706c0aa84e311188a14468d841 Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <joerg.roedel@amd.com>
+Date: Mon, 30 May 2011 15:56:24 +0200
+Subject: x86/amd-iommu: Use only per-device dma_ops
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+commit 27c2127a15d340706c0aa84e311188a14468d841 upstream.
+
+Unfortunatly there are systems where the AMD IOMMU does not
+cover all devices. This breaks with the current driver as it
+initializes the global dma_ops variable. This patch limits
+the AMD IOMMU to the devices listed in the IVRS table fixing
+DMA for devices not covered by the IOMMU.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/amd_iommu.c |   26 ++++++++++++++++++++++++--
+ 1 file changed, 24 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/amd_iommu.c
++++ b/arch/x86/kernel/amd_iommu.c
+@@ -28,6 +28,7 @@
+ #include <asm/proto.h>
+ #include <asm/iommu.h>
+ #include <asm/gart.h>
++#include <asm/dma.h>
+ #include <asm/amd_iommu_proto.h>
+ #include <asm/amd_iommu_types.h>
+ #include <asm/amd_iommu.h>
+@@ -2296,6 +2297,23 @@ static struct dma_map_ops amd_iommu_dma_
+ 	.dma_supported = amd_iommu_dma_supported,
+ };
+ 
++static unsigned device_dma_ops_init(void)
++{
++	struct pci_dev *pdev = NULL;
++	unsigned unhandled = 0;
++
++	for_each_pci_dev(pdev) {
++		if (!check_device(&pdev->dev)) {
++			unhandled += 1;
++			continue;
++		}
++
++		pdev->dev.archdata.dma_ops = &amd_iommu_dma_ops;
++	}
++
++	return unhandled;
++}
++
+ /*
+  * The function which clues the AMD IOMMU driver into dma_ops.
+  */
+@@ -2308,7 +2326,7 @@ void __init amd_iommu_init_api(void)
+ int __init amd_iommu_init_dma_ops(void)
+ {
+ 	struct amd_iommu *iommu;
+-	int ret;
++	int ret, unhandled;
+ 
+ 	/*
+ 	 * first allocate a default protection domain for every IOMMU we
+@@ -2334,7 +2352,11 @@ int __init amd_iommu_init_dma_ops(void)
+ 	swiotlb = 0;
+ 
+ 	/* Make the driver finally visible to the drivers */
+-	dma_ops = &amd_iommu_dma_ops;
++	unhandled = device_dma_ops_init();
++	if (unhandled && max_pfn > MAX_DMA32_PFN) {
++		/* There are unhandled devices - initialize swiotlb for them */
++		swiotlb = 1;
++	}
+ 
+ 	amd_iommu_stats_init();
+ 
diff --git a/queue-2.6.39/xen-off-by-one-errors-in-multicalls.c.patch b/queue-2.6.39/xen-off-by-one-errors-in-multicalls.c.patch
new file mode 100644
index 0000000000..947982b674
--- /dev/null
+++ b/queue-2.6.39/xen-off-by-one-errors-in-multicalls.c.patch
@@ -0,0 +1,72 @@
+From f124c6ae59e193705c9ddac57684d50006d710e6 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <error27@gmail.com>
+Date: Fri, 3 Jun 2011 07:45:28 +0300
+Subject: xen: off by one errors in multicalls.c
+
+From: Dan Carpenter <error27@gmail.com>
+
+commit f124c6ae59e193705c9ddac57684d50006d710e6 upstream.
+
+b->args[] has MC_ARGS elements, so the comparison here should be
+">=" instead of ">".  Otherwise we read past the end of the array
+one space.
+
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/xen/multicalls.c |   12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/arch/x86/xen/multicalls.c
++++ b/arch/x86/xen/multicalls.c
+@@ -189,10 +189,10 @@ struct multicall_space __xen_mc_entry(si
+ 	unsigned argidx = roundup(b->argidx, sizeof(u64));
+ 
+ 	BUG_ON(preemptible());
+-	BUG_ON(b->argidx > MC_ARGS);
++	BUG_ON(b->argidx >= MC_ARGS);
+ 
+ 	if (b->mcidx == MC_BATCH ||
+-	    (argidx + args) > MC_ARGS) {
++	    (argidx + args) >= MC_ARGS) {
+ 		mc_stats_flush(b->mcidx == MC_BATCH ? FL_SLOTS : FL_ARGS);
+ 		xen_mc_flush();
+ 		argidx = roundup(b->argidx, sizeof(u64));
+@@ -206,7 +206,7 @@ struct multicall_space __xen_mc_entry(si
+ 	ret.args = &b->args[argidx];
+ 	b->argidx = argidx + args;
+ 
+-	BUG_ON(b->argidx > MC_ARGS);
++	BUG_ON(b->argidx >= MC_ARGS);
+ 	return ret;
+ }
+ 
+@@ -216,7 +216,7 @@ struct multicall_space xen_mc_extend_arg
+ 	struct multicall_space ret = { NULL, NULL };
+ 
+ 	BUG_ON(preemptible());
+-	BUG_ON(b->argidx > MC_ARGS);
++	BUG_ON(b->argidx >= MC_ARGS);
+ 
+ 	if (b->mcidx == 0)
+ 		return ret;
+@@ -224,14 +224,14 @@ struct multicall_space xen_mc_extend_arg
+ 	if (b->entries[b->mcidx - 1].op != op)
+ 		return ret;
+ 
+-	if ((b->argidx + size) > MC_ARGS)
++	if ((b->argidx + size) >= MC_ARGS)
+ 		return ret;
+ 
+ 	ret.mc = &b->entries[b->mcidx - 1];
+ 	ret.args = &b->args[b->argidx];
+ 	b->argidx += size;
+ 
+-	BUG_ON(b->argidx > MC_ARGS);
++	BUG_ON(b->argidx >= MC_ARGS);
+ 	return ret;
+ }
+