.39 patches

13 files changed, 615 insertions, 0 deletions

diff --git a/queue-2.6.39/arch-tile-allocate-pci-irqs-later-in-boot.patch b/queue-2.6.39/arch-tile-allocate-pci-irqs-later-in-boot.patch
new file mode 100644
index 0000000000..abc0c9b3cc
--- /dev/null
+++ b/queue-2.6.39/arch-tile-allocate-pci-irqs-later-in-boot.patch
@@ -0,0 +1,46 @@
+From f4de51de2edcd26ec77bfc71b1f00b1de5a5dc20 Mon Sep 17 00:00:00 2001
+From: Chris Metcalf <cmetcalf@tilera.com>
+Date: Tue, 17 May 2011 15:25:21 -0400
+Subject: arch/tile: allocate PCI IRQs later in boot
+
+From: Chris Metcalf <cmetcalf@tilera.com>
+
+commit f4de51de2edcd26ec77bfc71b1f00b1de5a5dc20 upstream.
+
+This change became required due to some recent reworking in the
+platform-independent IRQ code.  It is required for 2.6.38 and later.
+
+Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/tile/kernel/pci.c |   11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/arch/tile/kernel/pci.c
++++ b/arch/tile/kernel/pci.c
+@@ -179,12 +179,6 @@ int __init tile_pci_init(void)
+ 
+ 		controller = &controllers[num_controllers];
+ 
+-		if (tile_init_irqs(i, controller)) {
+-			pr_err("PCI: Could not initialize "
+-			       "IRQs, aborting.\n");
+-			goto err_cont;
+-		}
+-
+ 		controller->index = num_controllers;
+ 		controller->hv_cfg_fd[0] = hv_cfg_fd0;
+ 		controller->hv_cfg_fd[1] = hv_cfg_fd1;
+@@ -300,6 +294,11 @@ static int __init pcibios_init(void)
+ 		struct pci_controller *controller = &controllers[i];
+ 		struct pci_bus *bus;
+ 
++		if (tile_init_irqs(i, controller)) {
++			pr_err("PCI: Could not initialize IRQS\n");
++			continue;
++		}
++
+ 		pr_info("PCI: initializing controller #%d\n", i);
+ 
+ 		/*
diff --git a/queue-2.6.39/intel-iommu-add-domain-check-in-domain_remove_one_dev_info.patch b/queue-2.6.39/intel-iommu-add-domain-check-in-domain_remove_one_dev_info.patch
new file mode 100644
index 0000000000..ec494f6260
--- /dev/null
+++ b/queue-2.6.39/intel-iommu-add-domain-check-in-domain_remove_one_dev_info.patch
@@ -0,0 +1,37 @@
+From 8519dc4401ddf8a5399f979870bbeeadbc111186 Mon Sep 17 00:00:00 2001
+From: Mike Habeck <habeck@sgi.com>
+Date: Sat, 28 May 2011 13:15:07 -0500
+Subject: intel-iommu: Add domain check in domain_remove_one_dev_info
+
+From: Mike Habeck <habeck@sgi.com>
+
+commit 8519dc4401ddf8a5399f979870bbeeadbc111186 upstream.
+
+The comment in domain_remove_one_dev_info() states "No need to compare
+PCI domain; it has to be the same". But for the si_domain that isn't
+going to be true, as it consists of all the PCI devices that are
+identity mapped thus multiple PCI domains can be in si_domain.  The
+code needs to validate the PCI domain too.
+
+Signed-off-by: Mike Habeck <habeck@sgi.com>
+Signed-off-by: Mike Travis <travis@sgi.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/intel-iommu.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/pci/intel-iommu.c
++++ b/drivers/pci/intel-iommu.c
+@@ -3398,8 +3398,8 @@ static void domain_remove_one_dev_info(s
+ 	spin_lock_irqsave(&device_domain_lock, flags);
+ 	list_for_each_safe(entry, tmp, &domain->devices) {
+ 		info = list_entry(entry, struct device_domain_info, link);
+-		/* No need to compare PCI domain; it has to be the same */
+-		if (info->bus == pdev->bus->number &&
++		if (info->segment == pci_domain_nr(pdev->bus) &&
++		    info->bus == pdev->bus->number &&
+ 		    info->devfn == pdev->devfn) {
+ 			list_del(&info->link);
+ 			list_del(&info->global);
diff --git a/queue-2.6.39/intel-iommu-check-for-identity-mapping-candidate-using.patch b/queue-2.6.39/intel-iommu-check-for-identity-mapping-candidate-using.patch
new file mode 100644
index 0000000000..50da533189
--- /dev/null
+++ b/queue-2.6.39/intel-iommu-check-for-identity-mapping-candidate-using.patch
@@ -0,0 +1,53 @@
+From 8fcc5372fbac085199d84a880503ed67aba3fe49 Mon Sep 17 00:00:00 2001
+From: Chris Wright <chrisw@sous-sol.org>
+Date: Sat, 28 May 2011 13:15:02 -0500
+Subject: intel-iommu: Check for identity mapping candidate using
+ system dma mask
+
+From: Chris Wright <chrisw@sous-sol.org>
+
+commit 8fcc5372fbac085199d84a880503ed67aba3fe49 upstream.
+
+The identity mapping code appears to make the assumption that if the
+devices dma_mask is greater than 32bits the device can use identity
+mapping.  But that is not true: take the case where we have a 40bit
+device in a 44bit architecture. The device can potentially receive a
+physical address that it will truncate and cause incorrect addresses
+to be used.
+
+Instead check to see if the device's dma_mask is large enough
+to address the system's dma_mask.
+
+Signed-off-by: Mike Travis <travis@sgi.com>
+Reviewed-by: Mike Habeck <habeck@sgi.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/intel-iommu.c |   15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+--- a/drivers/pci/intel-iommu.c
++++ b/drivers/pci/intel-iommu.c
+@@ -2190,8 +2190,19 @@ static int iommu_should_identity_map(str
+ 	 * Assume that they will -- if they turn out not to be, then we can 
+ 	 * take them out of the 1:1 domain later.
+ 	 */
+-	if (!startup)
+-		return pdev->dma_mask > DMA_BIT_MASK(32);
++	if (!startup) {
++		/*
++		 * If the device's dma_mask is less than the system's memory
++		 * size then this is not a candidate for identity mapping.
++		 */
++		u64 dma_mask = pdev->dma_mask;
++
++		if (pdev->dev.coherent_dma_mask &&
++		    pdev->dev.coherent_dma_mask < dma_mask)
++			dma_mask = pdev->dev.coherent_dma_mask;
++
++		return dma_mask >= dma_get_required_mask(&pdev->dev);
++	}
+ 
+ 	return 1;
+ }
diff --git a/queue-2.6.39/intel-iommu-dont-cache-iova-above-32bit.patch b/queue-2.6.39/intel-iommu-dont-cache-iova-above-32bit.patch
new file mode 100644
index 0000000000..4a2691e637
--- /dev/null
+++ b/queue-2.6.39/intel-iommu-dont-cache-iova-above-32bit.patch
@@ -0,0 +1,60 @@
+From 1c9fc3d11b84fbd0c4f4aa7855702c2a1f098ebb Mon Sep 17 00:00:00 2001
+From: Chris Wright <chrisw@sous-sol.org>
+Date: Sat, 28 May 2011 13:15:04 -0500
+Subject: intel-iommu: Dont cache iova above 32bit
+
+From: Chris Wright <chrisw@sous-sol.org>
+
+commit 1c9fc3d11b84fbd0c4f4aa7855702c2a1f098ebb upstream.
+
+Mike Travis and Mike Habeck reported an issue where iova allocation
+would return a range that was larger than a device's dma mask.
+
+https://lkml.org/lkml/2011/3/29/423
+
+The dmar initialization code will reserve all PCI MMIO regions and copy
+those reservations into a domain specific iova tree.  It is possible for
+one of those regions to be above the dma mask of a device.  It is typical
+to allocate iovas with a 32bit mask (despite device's dma mask possibly
+being larger) and cache the result until it exhausts the lower 32bit
+address space.  Freeing the iova range that is >= the last iova in the
+lower 32bit range when there is still an iova above the 32bit range will
+corrupt the cached iova by pointing it to a region that is above 32bit.
+If that region is also larger than the device's dma mask, a subsequent
+allocation will return an unusable iova and cause dma failure.
+
+Simply don't cache an iova that is above the 32bit caching boundary.
+
+Reported-by: Mike Travis <travis@sgi.com>
+Reported-by: Mike Habeck <habeck@sgi.com>
+Acked-by: Mike Travis <travis@sgi.com>
+Tested-by: Mike Habeck <habeck@sgi.com>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/iova.c |   12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/pci/iova.c
++++ b/drivers/pci/iova.c
+@@ -63,8 +63,16 @@ __cached_rbnode_delete_update(struct iov
+ 	curr = iovad->cached32_node;
+ 	cached_iova = container_of(curr, struct iova, node);
+ 
+-	if (free->pfn_lo >= cached_iova->pfn_lo)
+-		iovad->cached32_node = rb_next(&free->node);
++	if (free->pfn_lo >= cached_iova->pfn_lo) {
++		struct rb_node *node = rb_next(&free->node);
++		struct iova *iova = container_of(node, struct iova, node);
++
++		/* only cache if it's below 32bit pfn */
++		if (node && iova->pfn_lo < iovad->dma_32bit_pfn)
++			iovad->cached32_node = node;
++		else
++			iovad->cached32_node = NULL;
++	}
+ }
+ 
+ /* Computes the padding size required, to make the
diff --git a/queue-2.6.39/intel-iommu-flush-unmaps-at-domain_exit.patch b/queue-2.6.39/intel-iommu-flush-unmaps-at-domain_exit.patch
new file mode 100644
index 0000000000..d08772a29a
--- /dev/null
+++ b/queue-2.6.39/intel-iommu-flush-unmaps-at-domain_exit.patch
@@ -0,0 +1,36 @@
+From 7b668357810ecb5fdda4418689d50f5d95aea6a8 Mon Sep 17 00:00:00 2001
+From: Alex Williamson <alex.williamson@redhat.com>
+Date: Tue, 24 May 2011 12:02:41 +0100
+Subject: intel-iommu: Flush unmaps at domain_exit
+
+From: Alex Williamson <alex.williamson@redhat.com>
+
+commit 7b668357810ecb5fdda4418689d50f5d95aea6a8 upstream.
+
+We typically batch unmaps to be lazily flushed out at
+regular intervals.  When we destroy a domain, we need
+to force a flush of these lazy unmaps to be sure none
+reference the domain we're about to free.
+
+Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=35062
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/intel-iommu.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/pci/intel-iommu.c
++++ b/drivers/pci/intel-iommu.c
+@@ -1416,6 +1416,10 @@ static void domain_exit(struct dmar_doma
+ 	if (!domain)
+ 		return;
+ 
++	/* Flush any lazy unmaps that may reference this domain */
++	if (!intel_iommu_strict)
++		flush_unmaps_timeout(0);
++
+ 	domain_remove_dev_info(domain);
+ 	/* destroy iovas */
+ 	put_iova_domain(&domain->iovad);
diff --git a/queue-2.6.39/intel-iommu-only-unlink-device-domains-from-iommu.patch b/queue-2.6.39/intel-iommu-only-unlink-device-domains-from-iommu.patch
new file mode 100644
index 0000000000..839c56496a
--- /dev/null
+++ b/queue-2.6.39/intel-iommu-only-unlink-device-domains-from-iommu.patch
@@ -0,0 +1,48 @@
+From 9b4554b21ed07e8556405510638171f0c787742a Mon Sep 17 00:00:00 2001
+From: Alex Williamson <alex.williamson@redhat.com>
+Date: Tue, 24 May 2011 12:19:04 -0400
+Subject: intel-iommu: Only unlink device domains from iommu
+
+From: Alex Williamson <alex.williamson@redhat.com>
+
+commit 9b4554b21ed07e8556405510638171f0c787742a upstream.
+
+Commit a97590e5 added unlinking domains from iommus to reciprocate the
+iommu from domains unlinking that was already done.  We actually want
+to only do this for device domains and never for the static
+identity map domain or VM domains.  The SI domain is special and
+never freed, while VM domain->id lives in their own special address
+space, separate from iommu->domain_ids.
+
+In the current code, a VM can get domain->id zero, then mark that
+domain unused when unbound from pci-stub.  This leads to DMAR
+write faults when the device is re-bound to the host driver.
+
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/intel-iommu.c |   11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/pci/intel-iommu.c
++++ b/drivers/pci/intel-iommu.c
+@@ -3422,10 +3422,13 @@ static void domain_remove_one_dev_info(s
+ 		domain_update_iommu_cap(domain);
+ 		spin_unlock_irqrestore(&domain->iommu_lock, tmp_flags);
+ 
+-		spin_lock_irqsave(&iommu->lock, tmp_flags);
+-		clear_bit(domain->id, iommu->domain_ids);
+-		iommu->domains[domain->id] = NULL;
+-		spin_unlock_irqrestore(&iommu->lock, tmp_flags);
++		if (!(domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE) &&
++		    !(domain->flags & DOMAIN_FLAG_STATIC_IDENTITY)) {
++			spin_lock_irqsave(&iommu->lock, tmp_flags);
++			clear_bit(domain->id, iommu->domain_ids);
++			iommu->domains[domain->id] = NULL;
++			spin_unlock_irqrestore(&iommu->lock, tmp_flags);
++		}
+ 	}
+ 
+ 	spin_unlock_irqrestore(&device_domain_lock, flags);
diff --git a/queue-2.6.39/intel-iommu-remove-host-bridge-devices-from-identity.patch b/queue-2.6.39/intel-iommu-remove-host-bridge-devices-from-identity.patch
new file mode 100644
index 0000000000..66cef4a526
--- /dev/null
+++ b/queue-2.6.39/intel-iommu-remove-host-bridge-devices-from-identity.patch
@@ -0,0 +1,44 @@
+From 825507d6d059f1cbe2503e0e5a3926225b983aec Mon Sep 17 00:00:00 2001
+From: Mike Travis <travis@sgi.com>
+Date: Sat, 28 May 2011 13:15:06 -0500
+Subject: intel-iommu: Remove Host Bridge devices from identity
+ mapping
+
+From: Mike Travis <travis@sgi.com>
+
+commit 825507d6d059f1cbe2503e0e5a3926225b983aec upstream.
+
+When using the 1:1 (identity) PCI DMA remapping, PCI Host Bridge devices
+that do not use the IOMMU causes a kernel panic.  Fix that by not
+inserting those devices into the si_domain.
+
+Signed-off-by: Mike Travis <travis@sgi.com>
+Reviewed-by: Mike Habeck <habeck@sgi.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/intel-iommu.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/pci/intel-iommu.c
++++ b/drivers/pci/intel-iommu.c
+@@ -46,6 +46,8 @@
+ #define ROOT_SIZE		VTD_PAGE_SIZE
+ #define CONTEXT_SIZE		VTD_PAGE_SIZE
+ 
++#define IS_BRIDGE_HOST_DEVICE(pdev) \
++			    ((pdev->class >> 8) == PCI_CLASS_BRIDGE_HOST)
+ #define IS_GFX_DEVICE(pdev) ((pdev->class >> 16) == PCI_BASE_CLASS_DISPLAY)
+ #define IS_ISA_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_BRIDGE_ISA)
+ #define IS_AZALIA(pdev) ((pdev)->vendor == 0x8086 && (pdev)->device == 0x3a3e)
+@@ -2217,6 +2219,9 @@ static int __init iommu_prepare_static_i
+ 		return -EFAULT;
+ 
+ 	for_each_pci_dev(pdev) {
++		/* Skip Host/PCI Bridge devices */
++		if (IS_BRIDGE_HOST_DEVICE(pdev))
++			continue;
+ 		if (iommu_should_identity_map(pdev, 1)) {
+ 			printk(KERN_INFO "IOMMU: %s identity mapping for device %s\n",
+ 			       hw ? "hardware" : "software", pci_name(pdev));
diff --git a/queue-2.6.39/intel-iommu-speed-up-processing-of-the-identity_mapping.patch b/queue-2.6.39/intel-iommu-speed-up-processing-of-the-identity_mapping.patch
new file mode 100644
index 0000000000..9a2fd550e8
--- /dev/null
+++ b/queue-2.6.39/intel-iommu-speed-up-processing-of-the-identity_mapping.patch
@@ -0,0 +1,43 @@
+From cb452a4040bb051d92e85d6e7eb60c11734c1781 Mon Sep 17 00:00:00 2001
+From: Mike Travis <travis@sgi.com>
+Date: Sat, 28 May 2011 13:15:03 -0500
+Subject: intel-iommu: Speed up processing of the identity_mapping
+ function
+
+From: Mike Travis <travis@sgi.com>
+
+commit cb452a4040bb051d92e85d6e7eb60c11734c1781 upstream.
+
+When there are a large count of PCI devices, and the pass through
+option for iommu is set, much time is spent in the identity_mapping
+function hunting though the iommu domains to check if a specific
+device is "identity mapped".
+
+Speed up the function by checking the cached info to see if
+it's mapped to the static identity domain.
+
+Signed-off-by: Mike Travis <travis@sgi.com>
+Reviewed-by: Mike Habeck <habeck@sgi.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/intel-iommu.c |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/pci/intel-iommu.c
++++ b/drivers/pci/intel-iommu.c
+@@ -2109,10 +2109,10 @@ static int identity_mapping(struct pci_d
+ 	if (likely(!iommu_identity_mapping))
+ 		return 0;
+ 
++	info = pdev->dev.archdata.iommu;
++	if (info && info != DUMMY_DEVICE_DOMAIN_INFO)
++		return (info->domain == si_domain);
+ 
+-	list_for_each_entry(info, &si_domain->devices, link)
+-		if (info->dev == pdev)
+-			return 1;
+ 	return 0;
+ }
+ 
diff --git a/queue-2.6.39/intel-iommu-use-coherent-dma-mask-when-requested.patch b/queue-2.6.39/intel-iommu-use-coherent-dma-mask-when-requested.patch
new file mode 100644
index 0000000000..01b43db749
--- /dev/null
+++ b/queue-2.6.39/intel-iommu-use-coherent-dma-mask-when-requested.patch
@@ -0,0 +1,35 @@
+From c681d0ba1252954208220ad32248a3e8e2fc98e4 Mon Sep 17 00:00:00 2001
+From: Mike Travis <travis@sgi.com>
+Date: Sat, 28 May 2011 13:15:05 -0500
+Subject: intel-iommu: Use coherent DMA mask when requested
+
+From: Mike Travis <travis@sgi.com>
+
+commit c681d0ba1252954208220ad32248a3e8e2fc98e4 upstream.
+
+The __intel_map_single function is not honoring the passed in DMA mask.
+This results in not using the coherent DMA mask when called from
+intel_alloc_coherent().
+
+Signed-off-by: Mike Travis <travis@sgi.com>
+Acked-by: Chris Wright <chrisw@sous-sol.org>
+Reviewed-by: Mike Habeck <habeck@sgi.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/intel-iommu.c |    3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/pci/intel-iommu.c
++++ b/drivers/pci/intel-iommu.c
+@@ -2606,8 +2606,7 @@ static dma_addr_t __intel_map_single(str
+ 	iommu = domain_get_iommu(domain);
+ 	size = aligned_nrpages(paddr, size);
+ 
+-	iova = intel_alloc_iova(hwdev, domain, dma_to_mm_pfn(size),
+-				pdev->dma_mask);
++	iova = intel_alloc_iova(hwdev, domain, dma_to_mm_pfn(size), dma_mask);
+ 	if (!iova)
+ 		goto error;
+ 
diff --git a/queue-2.6.39/lguest-fix-timer-interrupt-setup.patch b/queue-2.6.39/lguest-fix-timer-interrupt-setup.patch
new file mode 100644
index 0000000000..4fea9a1f0d
--- /dev/null
+++ b/queue-2.6.39/lguest-fix-timer-interrupt-setup.patch
@@ -0,0 +1,32 @@
+From 15517f7c213442e4d8a098cf0732b237f764c576 Mon Sep 17 00:00:00 2001
+From: Rusty Russell <rusty@rustcorp.com.au>
+Date: Mon, 30 May 2011 11:14:08 -0600
+Subject: lguest: fix timer interrupt setup
+
+From: Rusty Russell <rusty@rustcorp.com.au>
+
+commit 15517f7c213442e4d8a098cf0732b237f764c576 upstream.
+
+Without an IRQ chip set, we now get a WARN_ON and no timer interrupt.  This
+prevents booting.
+
+Fortunately, the fix is a one-liner: set up the timer IRQ like everything
+else.
+
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/lguest/boot.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/x86/lguest/boot.c
++++ b/arch/x86/lguest/boot.c
+@@ -995,6 +995,7 @@ static void lguest_time_irq(unsigned int
+ static void lguest_time_init(void)
+ {
+ 	/* Set up the timer interrupt (0) to go to our simple timer routine */
++	lguest_setup_irq(0);
+ 	irq_set_handler(0, lguest_time_irq);
+ 
+ 	clocksource_register(&lguest_clock);
diff --git a/queue-2.6.39/powerpc-4xx-fix-regression-in-smp-on-476.patch b/queue-2.6.39/powerpc-4xx-fix-regression-in-smp-on-476.patch
new file mode 100644
index 0000000000..f3b56cab5f
--- /dev/null
+++ b/queue-2.6.39/powerpc-4xx-fix-regression-in-smp-on-476.patch
@@ -0,0 +1,46 @@
+From c560bbceaf6b06e52f1ef20131b76a3fdc0a2c19 Mon Sep 17 00:00:00 2001
+From: kerstin jonsson <kerstin.jonsson@ericsson.com>
+Date: Tue, 17 May 2011 23:57:11 +0000
+Subject: powerpc/4xx: Fix regression in SMP on 476
+
+From: kerstin jonsson <kerstin.jonsson@ericsson.com>
+
+commit c560bbceaf6b06e52f1ef20131b76a3fdc0a2c19 upstream.
+
+commit c56e58537d504706954a06570b4034c04e5b7500 breaks SMP support in PPC_47x chip.
+ secondary_ti must be set to current thread info before callin kick_cpu or else
+ start_secondary_47x will jump into void when trying to return to c-code.
+ In the current setup secondary_ti is initialized before the CPU idle task is started
+ and only the boot core will start. I am not sure this is the correct solution, but it
+ makes SMP possible in my chip.
+ Note! The HOTPLUG support probably need some fixing to, There is no trampoline code
+ available in head_44x.S - start_secondary_resume?
+
+Signed-off-by: Kerstin Jonsson <kerstin.jonsson@ericsson.com>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/kernel/smp.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/powerpc/kernel/smp.c
++++ b/arch/powerpc/kernel/smp.c
+@@ -410,8 +410,6 @@ int __cpuinit __cpu_up(unsigned int cpu)
+ {
+ 	int rc, c;
+ 
+-	secondary_ti = current_set[cpu];
+-
+ 	if (smp_ops == NULL ||
+ 	    (smp_ops->cpu_bootable && !smp_ops->cpu_bootable(cpu)))
+ 		return -EINVAL;
+@@ -421,6 +419,8 @@ int __cpuinit __cpu_up(unsigned int cpu)
+ 	if (rc)
+ 		return rc;
+ 
++	secondary_ti = current_set[cpu];
++
+ 	/* Make sure callin-map entry is 0 (can be leftover a CPU
+ 	 * hotplug
+ 	 */
diff --git a/queue-2.6.39/rtlwifi-rtl8192c-common-rtl8192ce-fix-for-ht40-regression.patch b/queue-2.6.39/rtlwifi-rtl8192c-common-rtl8192ce-fix-for-ht40-regression.patch
new file mode 100644
index 0000000000..8a5ef567bb
--- /dev/null
+++ b/queue-2.6.39/rtlwifi-rtl8192c-common-rtl8192ce-fix-for-ht40-regression.patch
@@ -0,0 +1,123 @@
+From 099fb8ab1e57e5d609ac686cc0ab6d1835a79155 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sat, 14 May 2011 10:15:17 -0500
+Subject: rtlwifi: rtl8192c-common: rtl8192ce: Fix for HT40 regression
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 099fb8ab1e57e5d609ac686cc0ab6d1835a79155 upstream.
+
+The changes that were made to rtl8192ce when rtl8192cu was added broke
+HT40. The errors included a typo in rtlwifi, a missing routine in
+rtl8192ce and a missing callback of that routine in rtl8192c-common.
+
+This patch fixes the regression reported in Bug #35082.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/rtlwifi/ps.c            |    2 
+ drivers/net/wireless/rtlwifi/rtl8192ce/phy.c |   69 +++++++++++++++++++++++++++
+ drivers/net/wireless/rtlwifi/rtl8192ce/phy.h |    1 
+ 3 files changed, 71 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/rtlwifi/ps.c
++++ b/drivers/net/wireless/rtlwifi/ps.c
+@@ -205,7 +205,7 @@ static void _rtl_ps_inactive_ps(struct i
+ 	rtl_ps_set_rf_state(hw, ppsc->inactive_pwrstate,
+ 			    RF_CHANGE_BY_IPS, false);
+ 
+-	if (ppsc->inactive_pwrstate == ERFOFF &&
++	if (ppsc->inactive_pwrstate == ERFON &&
+ 	    rtlhal->interface == INTF_PCI) {
+ 		if (ppsc->reg_rfps_level & RT_RF_OFF_LEVL_ASPM) {
+ 			rtlpriv->intf_ops->enable_aspm(hw);
+--- a/drivers/net/wireless/rtlwifi/rtl8192ce/phy.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ce/phy.c
+@@ -432,6 +432,75 @@ void rtl92ce_phy_set_bw_mode_callback(st
+ 	RT_TRACE(rtlpriv, COMP_SCAN, DBG_TRACE, ("<==\n"));
+ }
+ 
++void rtl92ce_phy_set_bw_mode_callback(struct ieee80211_hw *hw)
++{
++	struct rtl_priv *rtlpriv = rtl_priv(hw);
++	struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
++	struct rtl_phy *rtlphy = &(rtlpriv->phy);
++	struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
++	u8 reg_bw_opmode;
++	u8 reg_prsr_rsc;
++
++	RT_TRACE(rtlpriv, COMP_SCAN, DBG_TRACE,
++		 ("Switch to %s bandwidth\n",
++		  rtlphy->current_chan_bw == HT_CHANNEL_WIDTH_20 ?
++		  "20MHz" : "40MHz"))
++
++	if (is_hal_stop(rtlhal)) {
++		rtlphy->set_bwmode_inprogress = false;
++		return;
++	}
++
++	reg_bw_opmode = rtl_read_byte(rtlpriv, REG_BWOPMODE);
++	reg_prsr_rsc = rtl_read_byte(rtlpriv, REG_RRSR + 2);
++
++	switch (rtlphy->current_chan_bw) {
++	case HT_CHANNEL_WIDTH_20:
++		reg_bw_opmode |= BW_OPMODE_20MHZ;
++		rtl_write_byte(rtlpriv, REG_BWOPMODE, reg_bw_opmode);
++		break;
++	case HT_CHANNEL_WIDTH_20_40:
++		reg_bw_opmode &= ~BW_OPMODE_20MHZ;
++		rtl_write_byte(rtlpriv, REG_BWOPMODE, reg_bw_opmode);
++		reg_prsr_rsc =
++		    (reg_prsr_rsc & 0x90) | (mac->cur_40_prime_sc << 5);
++		rtl_write_byte(rtlpriv, REG_RRSR + 2, reg_prsr_rsc);
++		break;
++	default:
++		RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
++			 ("unknown bandwidth: %#X\n", rtlphy->current_chan_bw));
++		break;
++	}
++
++	switch (rtlphy->current_chan_bw) {
++	case HT_CHANNEL_WIDTH_20:
++		rtl_set_bbreg(hw, RFPGA0_RFMOD, BRFMOD, 0x0);
++		rtl_set_bbreg(hw, RFPGA1_RFMOD, BRFMOD, 0x0);
++		rtl_set_bbreg(hw, RFPGA0_ANALOGPARAMETER2, BIT(10), 1);
++		break;
++	case HT_CHANNEL_WIDTH_20_40:
++		rtl_set_bbreg(hw, RFPGA0_RFMOD, BRFMOD, 0x1);
++		rtl_set_bbreg(hw, RFPGA1_RFMOD, BRFMOD, 0x1);
++
++		rtl_set_bbreg(hw, RCCK0_SYSTEM, BCCK_SIDEBAND,
++			      (mac->cur_40_prime_sc >> 1));
++		rtl_set_bbreg(hw, ROFDM1_LSTF, 0xC00, mac->cur_40_prime_sc);
++		rtl_set_bbreg(hw, RFPGA0_ANALOGPARAMETER2, BIT(10), 0);
++
++		rtl_set_bbreg(hw, 0x818, (BIT(26) | BIT(27)),
++			      (mac->cur_40_prime_sc ==
++			       HAL_PRIME_CHNL_OFFSET_LOWER) ? 2 : 1);
++		break;
++	default:
++		RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
++			 ("unknown bandwidth: %#X\n", rtlphy->current_chan_bw));
++		break;
++	}
++	rtl92ce_phy_rf6052_set_bandwidth(hw, rtlphy->current_chan_bw);
++	rtlphy->set_bwmode_inprogress = false;
++	RT_TRACE(rtlpriv, COMP_SCAN, DBG_TRACE, ("<==\n"));
++}
++
+ void _rtl92ce_phy_lc_calibrate(struct ieee80211_hw *hw, bool is2t)
+ {
+ 	u8 tmpreg;
+--- a/drivers/net/wireless/rtlwifi/rtl8192ce/phy.h
++++ b/drivers/net/wireless/rtlwifi/rtl8192ce/phy.h
+@@ -250,5 +250,6 @@ bool _rtl92ce_phy_config_mac_with_header
+ void _rtl92c_phy_init_bb_rf_register_definition(struct ieee80211_hw *hw);
+ bool _rtl92c_phy_bb8192c_config_parafile(struct ieee80211_hw *hw);
+ void _rtl92c_phy_set_rf_sleep(struct ieee80211_hw *hw);
++void rtl92ce_phy_set_bw_mode_callback(struct ieee80211_hw *hw);
+ 
+ #endif
diff --git a/queue-2.6.39/series b/queue-2.6.39/series
new file mode 100644
index 0000000000..ffe62ad8a4
--- /dev/null
+++ b/queue-2.6.39/series
@@ -0,0 +1,12 @@
+lguest-fix-timer-interrupt-setup.patch
+intel-iommu-flush-unmaps-at-domain_exit.patch
+intel-iommu-only-unlink-device-domains-from-iommu.patch
+intel-iommu-check-for-identity-mapping-candidate-using.patch
+intel-iommu-speed-up-processing-of-the-identity_mapping.patch
+intel-iommu-dont-cache-iova-above-32bit.patch
+intel-iommu-use-coherent-dma-mask-when-requested.patch
+intel-iommu-remove-host-bridge-devices-from-identity.patch
+intel-iommu-add-domain-check-in-domain_remove_one_dev_info.patch
+powerpc-4xx-fix-regression-in-smp-on-476.patch
+rtlwifi-rtl8192c-common-rtl8192ce-fix-for-ht40-regression.patch
+arch-tile-allocate-pci-irqs-later-in-boot.patch