.32 patches

11 files changed, 654 insertions, 0 deletions

diff --git a/queue-2.6.32/atm-expose-atm-device-index-in-sysfs.patch b/queue-2.6.32/atm-expose-atm-device-index-in-sysfs.patch
new file mode 100644
index 0000000..acb92a9
--- /dev/null
+++ b/queue-2.6.32/atm-expose-atm-device-index-in-sysfs.patch
@@ -0,0 +1,57 @@
+From e7a46b4d0839c2a3aa2e0ae0b145f293f6738498 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dcbw@redhat.com>
+Date: Fri, 27 May 2011 04:51:54 +0000
+Subject: atm: expose ATM device index in sysfs
+
+From: Dan Williams <dcbw@redhat.com>
+
+commit e7a46b4d0839c2a3aa2e0ae0b145f293f6738498 upstream.
+
+It's currently exposed only through /proc which, besides requiring
+screen-scraping, doesn't allow userspace to distinguish between two
+identical ATM adapters with different ATM indexes.  The ATM device index
+is required when using PPPoATM on a system with multiple ATM adapters.
+
+Signed-off-by: Dan Williams <dcbw@redhat.com>
+Reviewed-by: Eric Dumazet <eric.dumazet@gmail.com>
+Tested-by: David Woodhouse <dwmw2@infradead.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/atm/atm_sysfs.c |   10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/net/atm/atm_sysfs.c
++++ b/net/atm/atm_sysfs.c
+@@ -57,6 +57,14 @@ static ssize_t show_atmaddress(struct de
+ 	return pos - buf;
+ }
+ 
++static ssize_t show_atmindex(struct device *cdev,
++			     struct device_attribute *attr, char *buf)
++{
++	struct atm_dev *adev = to_atm_dev(cdev);
++
++	return sprintf(buf, "%d\n", adev->number);
++}
++
+ static ssize_t show_carrier(struct device *cdev,
+ 			    struct device_attribute *attr, char *buf)
+ {
+@@ -97,6 +105,7 @@ static ssize_t show_link_rate(struct dev
+ 
+ static DEVICE_ATTR(address, S_IRUGO, show_address, NULL);
+ static DEVICE_ATTR(atmaddress, S_IRUGO, show_atmaddress, NULL);
++static DEVICE_ATTR(atmindex, S_IRUGO, show_atmindex, NULL);
+ static DEVICE_ATTR(carrier, S_IRUGO, show_carrier, NULL);
+ static DEVICE_ATTR(type, S_IRUGO, show_type, NULL);
+ static DEVICE_ATTR(link_rate, S_IRUGO, show_link_rate, NULL);
+@@ -104,6 +113,7 @@ static DEVICE_ATTR(link_rate, S_IRUGO, s
+ static struct device_attribute *atm_attrs[] = {
+ 	&dev_attr_atmaddress,
+ 	&dev_attr_address,
++	&dev_attr_atmindex,
+ 	&dev_attr_carrier,
+ 	&dev_attr_type,
+ 	&dev_attr_link_rate,
diff --git a/queue-2.6.32/brd-handle-on-demand-devices-correctly.patch b/queue-2.6.32/brd-handle-on-demand-devices-correctly.patch
new file mode 100644
index 0000000..dab84fd
--- /dev/null
+++ b/queue-2.6.32/brd-handle-on-demand-devices-correctly.patch
@@ -0,0 +1,83 @@
+From af46566885a373b0a526932484cd8fef8de7b598 Mon Sep 17 00:00:00 2001
+From: Namhyung Kim <namhyung@gmail.com>
+Date: Thu, 26 May 2011 21:06:50 +0200
+Subject: brd: handle on-demand devices correctly
+
+From: Namhyung Kim <namhyung@gmail.com>
+
+commit af46566885a373b0a526932484cd8fef8de7b598 upstream.
+
+When finding or allocating a ram disk device, brd_probe() did not take
+partition numbers into account so that it can result to a different
+device. Consider following example (I set CONFIG_BLK_DEV_RAM_COUNT=4
+for simplicity) :
+
+$ sudo modprobe brd max_part=15
+$ ls -l /dev/ram*
+brw-rw---- 1 root disk 1,  0 2011-05-25 15:41 /dev/ram0
+brw-rw---- 1 root disk 1, 16 2011-05-25 15:41 /dev/ram1
+brw-rw---- 1 root disk 1, 32 2011-05-25 15:41 /dev/ram2
+brw-rw---- 1 root disk 1, 48 2011-05-25 15:41 /dev/ram3
+$ sudo mknod /dev/ram4 b 1 64
+$ sudo dd if=/dev/zero of=/dev/ram4 bs=4k count=256
+256+0 records in
+256+0 records out
+1048576 bytes (1.0 MB) copied, 0.00215578 s, 486 MB/s
+namhyung@leonhard:linux$ ls -l /dev/ram*
+brw-rw---- 1 root disk 1,    0 2011-05-25 15:41 /dev/ram0
+brw-rw---- 1 root disk 1,   16 2011-05-25 15:41 /dev/ram1
+brw-rw---- 1 root disk 1,   32 2011-05-25 15:41 /dev/ram2
+brw-rw---- 1 root disk 1,   48 2011-05-25 15:41 /dev/ram3
+brw-r--r-- 1 root root 1,   64 2011-05-25 15:45 /dev/ram4
+brw-rw---- 1 root disk 1, 1024 2011-05-25 15:44 /dev/ram64
+
+After this patch, /dev/ram4 - instead of /dev/ram64 - was
+accessed correctly.
+
+In addition, 'range' passed to blk_register_region() should
+include all range of dev_t that RAMDISK_MAJOR can address.
+It does not need to be limited by partition numbers unless
+'rd_nr' param was specified.
+
+Signed-off-by: Namhyung Kim <namhyung@gmail.com>
+Cc: Laurent Vivier <Laurent.Vivier@bull.net>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/block/brd.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/block/brd.c
++++ b/drivers/block/brd.c
+@@ -498,7 +498,7 @@ static struct kobject *brd_probe(dev_t d
+ 	struct kobject *kobj;
+ 
+ 	mutex_lock(&brd_devices_mutex);
+-	brd = brd_init_one(dev & MINORMASK);
++	brd = brd_init_one(MINOR(dev) >> part_shift);
+ 	kobj = brd ? get_disk(brd->brd_disk) : ERR_PTR(-ENOMEM);
+ 	mutex_unlock(&brd_devices_mutex);
+ 
+@@ -539,10 +539,10 @@ static int __init brd_init(void)
+ 
+ 	if (rd_nr) {
+ 		nr = rd_nr;
+-		range = rd_nr;
++		range = rd_nr << part_shift;
+ 	} else {
+ 		nr = CONFIG_BLK_DEV_RAM_COUNT;
+-		range = 1UL << (MINORBITS - part_shift);
++		range = 1UL << MINORBITS;
+ 	}
+ 
+ 	if (register_blkdev(RAMDISK_MAJOR, "ramdisk"))
+@@ -581,7 +581,7 @@ static void __exit brd_exit(void)
+ 	unsigned long range;
+ 	struct brd_device *brd, *next;
+ 
+-	range = rd_nr ? rd_nr :  1UL << (MINORBITS - part_shift);
++	range = rd_nr ? rd_nr << part_shift : 1UL << MINORBITS;
+ 
+ 	list_for_each_entry_safe(brd, next, &brd_devices, brd_list)
+ 		brd_del_one(brd);
diff --git a/queue-2.6.32/brd-limit-max_part-module-param-to-disk_max_parts.patch b/queue-2.6.32/brd-limit-max_part-module-param-to-disk_max_parts.patch
new file mode 100644
index 0000000..cbb7c35
--- /dev/null
+++ b/queue-2.6.32/brd-limit-max_part-module-param-to-disk_max_parts.patch
@@ -0,0 +1,85 @@
+From 315980c8688c4b06713c1a5fe9d64cdf8ab57a72 Mon Sep 17 00:00:00 2001
+From: Namhyung Kim <namhyung@gmail.com>
+Date: Thu, 26 May 2011 21:06:50 +0200
+Subject: brd: limit 'max_part' module param to DISK_MAX_PARTS
+
+From: Namhyung Kim <namhyung@gmail.com>
+
+commit 315980c8688c4b06713c1a5fe9d64cdf8ab57a72 upstream.
+
+The 'max_part' parameter controls the number of maximum partition
+a brd device can have. However if a user specifies very large
+value it would exceed the limitation of device minor number and
+can cause a kernel panic (or, at least, produce invalid device
+nodes in some cases).
+
+On my desktop system, following command kills the kernel. On qemu,
+it triggers similar oops but the kernel was alive:
+
+$ sudo modprobe brd max_part=100000
+ BUG: unable to handle kernel NULL pointer dereference at 0000000000000058
+ IP: [<ffffffff81110a9a>] sysfs_create_dir+0x2d/0xae
+ PGD 7af1067 PUD 7b19067 PMD 0
+ Oops: 0000 [#1] SMP
+ last sysfs file:
+ CPU 0
+ Modules linked in: brd(+)
+
+ Pid: 44, comm: insmod Tainted: G        W   2.6.39-qemu+ #158 Bochs Bochs
+ RIP: 0010:[<ffffffff81110a9a>]  [<ffffffff81110a9a>] sysfs_create_dir+0x2d/0xae
+ RSP: 0018:ffff880007b15d78  EFLAGS: 00000286
+ RAX: ffff880007b05478 RBX: ffff880007a52760 RCX: ffff880007b15dc8
+ RDX: ffff880007a4f900 RSI: ffff880007b15e48 RDI: ffff880007a52760
+ RBP: ffff880007b15da8 R08: 0000000000000002 R09: 0000000000000000
+ R10: ffff880007b15e48 R11: ffff880007b05478 R12: 0000000000000000
+ R13: ffff880007b05478 R14: 0000000000400920 R15: 0000000000000063
+ FS:  0000000002160880(0063) GS:ffff880007c00000(0000) knlGS:0000000000000000
+ CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000000000000058 CR3: 0000000007b1c000 CR4: 00000000000006b0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 0000000000000000 DR7: 0000000000000000
+ Process insmod (pid: 44, threadinfo ffff880007b14000, task ffff880007acb980)
+ Stack:
+  ffff880007b15dc8 ffff880007b05478 ffff880007b15da8 00000000fffffffe
+  ffff880007a52760 ffff880007b05478 ffff880007b15de8 ffffffff81143c0a
+  0000000000400920 ffff880007a52760 ffff880007b05478 0000000000000000
+ Call Trace:
+  [<ffffffff81143c0a>] kobject_add_internal+0xdf/0x1a0
+  [<ffffffff81143da1>] kobject_add_varg+0x41/0x50
+  [<ffffffff81143e6b>] kobject_add+0x64/0x66
+  [<ffffffff8113bbe7>] blk_register_queue+0x5f/0xb8
+  [<ffffffff81140f72>] add_disk+0xdf/0x289
+  [<ffffffffa00040df>] brd_init+0xdf/0x1aa [brd]
+  [<ffffffffa0004000>] ? 0xffffffffa0003fff
+  [<ffffffffa0004000>] ? 0xffffffffa0003fff
+  [<ffffffff8100020a>] do_one_initcall+0x7a/0x12e
+  [<ffffffff8108516c>] sys_init_module+0x9c/0x1dc
+  [<ffffffff812ff4bb>] system_call_fastpath+0x16/0x1b
+ Code: 89 e5 41 55 41 54 53 48 89 fb 48 83 ec 18 48 85 ff 75 04 0f 0b eb fe 48 8b 47 18 49 c7 c4 70 1e 4d 81 48 85 c0 74 04 4c 8b 60 30
+  8b 44 24 58 45 31 ed 0f b6 c4 85 c0 74 0d 48 8b 43 28 48 89
+ RIP  [<ffffffff81110a9a>] sysfs_create_dir+0x2d/0xae
+  RSP <ffff880007b15d78>
+ CR2: 0000000000000058
+ ---[ end trace aebb1175ce1f6739 ]---
+
+Signed-off-by: Namhyung Kim <namhyung@gmail.com>
+Cc: Laurent Vivier <Laurent.Vivier@bull.net>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/block/brd.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/block/brd.c
++++ b/drivers/block/brd.c
+@@ -531,6 +531,9 @@ static int __init brd_init(void)
+ 	if (max_part > 0)
+ 		part_shift = fls(max_part);
+ 
++	if ((1UL << part_shift) > DISK_MAX_PARTS)
++		return -EINVAL;
++
+ 	if (rd_nr > 1UL << (MINORBITS - part_shift))
+ 		return -EINVAL;
+ 
diff --git a/queue-2.6.32/cpuidle-menu-fixed-wrapping-timers-at-4.294-seconds.patch b/queue-2.6.32/cpuidle-menu-fixed-wrapping-timers-at-4.294-seconds.patch
new file mode 100644
index 0000000..9d08d8b
--- /dev/null
+++ b/queue-2.6.32/cpuidle-menu-fixed-wrapping-timers-at-4.294-seconds.patch
@@ -0,0 +1,44 @@
+From 7467571f4480b273007517b26297c07154c73924 Mon Sep 17 00:00:00 2001
+From: Tero Kristo <tero.kristo@nokia.com>
+Date: Thu, 24 Feb 2011 17:19:23 +0200
+Subject: cpuidle: menu: fixed wrapping timers at 4.294 seconds
+
+From: Tero Kristo <tero.kristo@nokia.com>
+
+commit 7467571f4480b273007517b26297c07154c73924 upstream.
+
+Cpuidle menu governor is using u32 as a temporary datatype for storing
+nanosecond values which wrap around at 4.294 seconds. This causes errors
+in predicted sleep times resulting in higher than should be C state
+selection and increased power consumption. This also breaks cpuidle
+state residency statistics.
+
+Signed-off-by: Tero Kristo <tero.kristo@nokia.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/cpuidle/governors/menu.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/cpuidle/governors/menu.c
++++ b/drivers/cpuidle/governors/menu.c
+@@ -185,6 +185,7 @@ static int menu_select(struct cpuidle_de
+ 	int latency_req = pm_qos_requirement(PM_QOS_CPU_DMA_LATENCY);
+ 	int i;
+ 	int multiplier;
++	struct timespec t;
+ 
+ 	if (data->needs_update) {
+ 		menu_update(dev);
+@@ -199,8 +200,9 @@ static int menu_select(struct cpuidle_de
+ 		return 0;
+ 
+ 	/* determine the expected residency time, round up */
++	t = ktime_to_timespec(tick_nohz_get_sleep_length());
+ 	data->expected_us =
+-	    DIV_ROUND_UP((u32)ktime_to_ns(tick_nohz_get_sleep_length()), 1000);
++		t.tv_sec * USEC_PER_SEC + t.tv_nsec / NSEC_PER_USEC;
+ 
+ 
+ 	data->bucket = which_bucket(data->expected_us);
diff --git a/queue-2.6.32/dm-table-reject-devices-without-request-fns.patch b/queue-2.6.32/dm-table-reject-devices-without-request-fns.patch
new file mode 100644
index 0000000..ce7325a
--- /dev/null
+++ b/queue-2.6.32/dm-table-reject-devices-without-request-fns.patch
@@ -0,0 +1,78 @@
+From f4808ca99a203f20b4475601748e44b25a65bdec Mon Sep 17 00:00:00 2001
+From: Milan Broz <mbroz@redhat.com>
+Date: Sun, 29 May 2011 13:02:52 +0100
+Subject: dm table: reject devices without request fns
+
+From: Milan Broz <mbroz@redhat.com>
+
+commit f4808ca99a203f20b4475601748e44b25a65bdec upstream.
+
+This patch adds a check that a block device has a request function
+defined before it is used.  Otherwise, misconfiguration can cause an oops.
+
+Because we are allowing devices with zero size e.g. an offline multipath
+device as in commit 2cd54d9bedb79a97f014e86c0da393416b264eb3
+("dm: allow offline devices") there needs to be an additional check
+to ensure devices are initialised.  Some block devices, like a loop
+device without a backing file, exist but have no request function.
+
+Reproducer is trivial: dm-mirror on unbound loop device
+(no backing file on loop devices)
+
+dmsetup create x --table "0 8 mirror core 2 8 sync 2 /dev/loop0 0 /dev/loop1 0"
+
+and mirror resync will immediatelly cause OOps.
+
+BUG: unable to handle kernel NULL pointer dereference at   (null)
+ ? generic_make_request+0x2bd/0x590
+ ? kmem_cache_alloc+0xad/0x190
+ submit_bio+0x53/0xe0
+ ? bio_add_page+0x3b/0x50
+ dispatch_io+0x1ca/0x210 [dm_mod]
+ ? read_callback+0x0/0xd0 [dm_mirror]
+ dm_io+0xbb/0x290 [dm_mod]
+ do_mirror+0x1e0/0x748 [dm_mirror]
+
+Signed-off-by: Milan Broz <mbroz@redhat.com>
+Reported-by: Zdenek Kabelac <zkabelac@redhat.com>
+Acked-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-table.c |   17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -348,6 +348,7 @@ static void close_dev(struct dm_dev_inte
+ static int device_area_is_invalid(struct dm_target *ti, struct dm_dev *dev,
+ 				  sector_t start, sector_t len, void *data)
+ {
++	struct request_queue *q;
+ 	struct queue_limits *limits = data;
+ 	struct block_device *bdev = dev->bdev;
+ 	sector_t dev_size =
+@@ -356,6 +357,22 @@ static int device_area_is_invalid(struct
+ 		limits->logical_block_size >> SECTOR_SHIFT;
+ 	char b[BDEVNAME_SIZE];
+ 
++	/*
++	 * Some devices exist without request functions,
++	 * such as loop devices not yet bound to backing files.
++	 * Forbid the use of such devices.
++	 */
++	q = bdev_get_queue(bdev);
++	if (!q || !q->make_request_fn) {
++		DMWARN("%s: %s is not yet initialised: "
++		       "start=%llu, len=%llu, dev_size=%llu",
++		       dm_device_name(ti->table->md), bdevname(bdev, b),
++		       (unsigned long long)start,
++		       (unsigned long long)len,
++		       (unsigned long long)dev_size);
++		return 1;
++	}
++
+ 	if (!dev_size)
+ 		return 0;
+ 
diff --git a/queue-2.6.32/i8k-avoid-lahf-in-64-bit-code.patch b/queue-2.6.32/i8k-avoid-lahf-in-64-bit-code.patch
new file mode 100644
index 0000000..b2d4316
--- /dev/null
+++ b/queue-2.6.32/i8k-avoid-lahf-in-64-bit-code.patch
@@ -0,0 +1,39 @@
+From bc1f419c76a2d6450413ce4349f4e4a07be011d5 Mon Sep 17 00:00:00 2001
+From: Luca Tettamanti <kronos.it@gmail.com>
+Date: Wed, 25 May 2011 20:43:31 +0200
+Subject: i8k: Avoid lahf in 64-bit code
+
+From: Luca Tettamanti <kronos.it@gmail.com>
+
+commit bc1f419c76a2d6450413ce4349f4e4a07be011d5 upstream.
+
+i8k uses lahf to read the flag register in 64-bit code; early x86-64
+CPUs, however, lack this instruction and we get an invalid opcode
+exception at runtime.
+Use pushf to load the flag register into the stack instead.
+
+Signed-off-by: Luca Tettamanti <kronos.it@gmail.com>
+Reported-by: Jeff Rickman <jrickman@myamigos.us>
+Tested-by: Jeff Rickman <jrickman@myamigos.us>
+Tested-by: Harry G McGavran Jr <w5pny@arrl.net>
+Cc: Massimo Dal Zotto <dz@debian.org>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/i8k.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/char/i8k.c
++++ b/drivers/char/i8k.c
+@@ -138,8 +138,8 @@ static int i8k_smm(struct smm_regs *regs
+ 		"movl %%edi,20(%%rax)\n\t"
+ 		"popq %%rdx\n\t"
+ 		"movl %%edx,0(%%rax)\n\t"
+-		"lahf\n\t"
+-		"shrl $8,%%eax\n\t"
++		"pushfq\n\t"
++		"popq %%rax\n\t"
+ 		"andl $1,%%eax\n"
+ 		:"=a"(rc)
+ 		:    "a"(regs)
diff --git a/queue-2.6.32/pci-add-quirk-for-setting-valid-class-for-ti816x-endpoint.patch b/queue-2.6.32/pci-add-quirk-for-setting-valid-class-for-ti816x-endpoint.patch
new file mode 100644
index 0000000..9e85001
--- /dev/null
+++ b/queue-2.6.32/pci-add-quirk-for-setting-valid-class-for-ti816x-endpoint.patch
@@ -0,0 +1,49 @@
+From 63c4408074cbcc070ac17fc10e524800eb9bd0b0 Mon Sep 17 00:00:00 2001
+From: Hemant Pedanekar <hemantp@ti.com>
+Date: Tue, 5 Apr 2011 12:32:50 +0530
+Subject: PCI: Add quirk for setting valid class for TI816X Endpoint
+
+From: Hemant Pedanekar <hemantp@ti.com>
+
+commit 63c4408074cbcc070ac17fc10e524800eb9bd0b0 upstream.
+
+TI816X (common name for DM816x/C6A816x/AM389x family) devices configured
+to boot as PCIe Endpoint have class code = 0. This makes kernel PCI bus
+code to skip allocating BARs to these devices resulting into following
+type of error when trying to enable them:
+
+"Device 0000:01:00.0 not available because of resource collisions"
+
+The device cannot be operated because of the above issue.
+
+This patch adds a ID specific (TI VENDOR ID and 816X DEVICE ID based)
+'early' fixup quirk to replace class code with
+PCI_CLASS_MULTIMEDIA_VIDEO as class.
+
+Signed-off-by: Hemant Pedanekar <hemantp@ti.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/quirks.c |   10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2540,6 +2540,16 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AT
+ 
+ #endif /* CONFIG_PCI_MSI */
+ 
++static void __devinit fixup_ti816x_class(struct pci_dev* dev)
++{
++	/* TI 816x devices do not have class code set when in PCIe boot mode */
++	if (dev->class == PCI_CLASS_NOT_DEFINED) {
++		dev_info(&dev->dev, "Setting PCI class for 816x PCIe device\n");
++		dev->class = PCI_CLASS_MULTIMEDIA_VIDEO;
++	}
++}
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_TI, 0xb800, fixup_ti816x_class);
++
+ static void pci_do_fixups(struct pci_dev *dev, struct pci_fixup *f,
+ 			  struct pci_fixup *end)
+ {
diff --git a/queue-2.6.32/series b/queue-2.6.32/series
index e8aee6c..a72725a 100644
--- a/queue-2.6.32/series
+++ b/queue-2.6.32/series
@@ -38,3 +38,13 @@ xhci-fix-full-speed-binterval-encoding.patch
 ohci-fix-regression-caused-by-nvidia-shutdown-workaround.patch
 p54usb-add-zoom-4410-usbid.patch
 ecryptfs-allow-2-scatterlist-entries-for-encrypted.patch
+ubifs-fix-a-rare-memory-leak-in-ro-to-rw-remounting-path.patch
+i8k-avoid-lahf-in-64-bit-code.patch
+cpuidle-menu-fixed-wrapping-timers-at-4.294-seconds.patch
+dm-table-reject-devices-without-request-fns.patch
+atm-expose-atm-device-index-in-sysfs.patch
+brd-limit-max_part-module-param-to-disk_max_parts.patch
+brd-handle-on-demand-devices-correctly.patch
+sunrpc-deal-with-the-lack-of-a-syn_sent-sk-sk_state_change.patch
+pci-add-quirk-for-setting-valid-class-for-ti816x-endpoint.patch
+xen-mmu-fix-a-race-window-causing-leave_mm-bug.patch
diff --git a/queue-2.6.32/sunrpc-deal-with-the-lack-of-a-syn_sent-sk-sk_state_change.patch b/queue-2.6.32/sunrpc-deal-with-the-lack-of-a-syn_sent-sk-sk_state_change.patch
new file mode 100644
index 0000000..d8a456a
--- /dev/null
+++ b/queue-2.6.32/sunrpc-deal-with-the-lack-of-a-syn_sent-sk-sk_state_change.patch
@@ -0,0 +1,64 @@
+From fe19a96b10032035a35779f42ad59e35d6dd8ffd Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Fri, 18 Mar 2011 20:21:23 -0400
+Subject: SUNRPC: Deal with the lack of a SYN_SENT sk->sk_state_change
+ callback...
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit fe19a96b10032035a35779f42ad59e35d6dd8ffd upstream.
+
+The TCP connection state code depends on the state_change() callback
+being called when the SYN_SENT state is set. However the networking layer
+doesn't actually call us back in that case.
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/xprtsock.c |   16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -1381,7 +1381,6 @@ static void xs_tcp_state_change(struct s
+ 	case TCP_CLOSE_WAIT:
+ 		/* The server initiated a shutdown of the socket */
+ 		xprt_force_disconnect(xprt);
+-	case TCP_SYN_SENT:
+ 		xprt->connect_cookie++;
+ 	case TCP_CLOSING:
+ 		/*
+@@ -1843,6 +1842,7 @@ static void xs_tcp_reuse_connection(stru
+ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
+ {
+ 	struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
++	int ret = -ENOTCONN;
+ 
+ 	if (!transport->inet) {
+ 		struct sock *sk = sock->sk;
+@@ -1874,12 +1874,22 @@ static int xs_tcp_finish_connecting(stru
+ 	}
+ 
+ 	if (!xprt_bound(xprt))
+-		return -ENOTCONN;
++		goto out;
+ 
+ 	/* Tell the socket layer to start connecting... */
+ 	xprt->stat.connect_count++;
+ 	xprt->stat.connect_start = jiffies;
+-	return kernel_connect(sock, xs_addr(xprt), xprt->addrlen, O_NONBLOCK);
++	ret = kernel_connect(sock, xs_addr(xprt), xprt->addrlen, O_NONBLOCK);
++	switch (ret) {
++	case 0:
++	case -EINPROGRESS:
++		/* SYN_SENT! */
++		xprt->connect_cookie++;
++		if (xprt->reestablish_timeout < XS_TCP_INIT_REEST_TO)
++			xprt->reestablish_timeout = XS_TCP_INIT_REEST_TO;
++	}
++out:
++	return ret;
+ }
+ 
+ /**
diff --git a/queue-2.6.32/ubifs-fix-a-rare-memory-leak-in-ro-to-rw-remounting-path.patch b/queue-2.6.32/ubifs-fix-a-rare-memory-leak-in-ro-to-rw-remounting-path.patch
new file mode 100644
index 0000000..ecb2fd1
--- /dev/null
+++ b/queue-2.6.32/ubifs-fix-a-rare-memory-leak-in-ro-to-rw-remounting-path.patch
@@ -0,0 +1,44 @@
+From eaeee242c531cd4b0a4a46e8b5dd7ef504380c42 Mon Sep 17 00:00:00 2001
+From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Date: Fri, 6 May 2011 17:08:56 +0300
+Subject: UBIFS: fix a rare memory leak in ro to rw remounting path
+
+From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+
+commit eaeee242c531cd4b0a4a46e8b5dd7ef504380c42 upstream.
+
+When re-mounting from R/O mode to R/W mode and the LEB count in the superblock
+is not up-to date, because for the underlying UBI volume became larger, we
+re-write the superblock. We allocate RAM for these purposes, but never free it.
+So this is a memory leak, although very rare one.
+
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ubifs/sb.c    |    3 ++-
+ fs/ubifs/super.c |    1 +
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+--- a/fs/ubifs/sb.c
++++ b/fs/ubifs/sb.c
+@@ -474,7 +474,8 @@ failed:
+  * @c: UBIFS file-system description object
+  *
+  * This function returns a pointer to the superblock node or a negative error
+- * code.
++ * code. Note, the user of this function is responsible of kfree()'ing the
++ * returned superblock buffer.
+  */
+ struct ubifs_sb_node *ubifs_read_sb_node(struct ubifs_info *c)
+ {
+--- a/fs/ubifs/super.c
++++ b/fs/ubifs/super.c
+@@ -1550,6 +1550,7 @@ static int ubifs_remount_rw(struct ubifs
+ 		}
+ 		sup->leb_cnt = cpu_to_le32(c->leb_cnt);
+ 		err = ubifs_write_sb_node(c, sup);
++		kfree(sup);
+ 		if (err)
+ 			goto out;
+ 	}
diff --git a/queue-2.6.32/xen-mmu-fix-a-race-window-causing-leave_mm-bug.patch b/queue-2.6.32/xen-mmu-fix-a-race-window-causing-leave_mm-bug.patch
new file mode 100644
index 0000000..3f546e9
--- /dev/null
+++ b/queue-2.6.32/xen-mmu-fix-a-race-window-causing-leave_mm-bug.patch
@@ -0,0 +1,101 @@
+From 7899891c7d161752f29abcc9bc0a9c6c3a3af26c Mon Sep 17 00:00:00 2001
+From: "Tian, Kevin" <kevin.tian@intel.com>
+Date: Thu, 12 May 2011 10:56:08 +0800
+Subject: xen mmu: fix a race window causing leave_mm BUG()
+
+From: "Tian, Kevin" <kevin.tian@intel.com>
+
+commit 7899891c7d161752f29abcc9bc0a9c6c3a3af26c upstream.
+
+There's a race window in xen_drop_mm_ref, where remote cpu may exit
+dirty bitmap between the check on this cpu and the point where remote
+cpu handles drop request. So in drop_other_mm_ref we need check
+whether TLB state is still lazy before calling into leave_mm. This
+bug is rarely observed in earlier kernel, but exaggerated by the
+commit 831d52bc153971b70e64eccfbed2b232394f22f8
+("x86, mm: avoid possible bogus tlb entries by clearing prev mm_cpumask after switching mm")
+which clears bitmap after changing the TLB state. the call trace is as below:
+
+---------------------------------
+kernel BUG at arch/x86/mm/tlb.c:61!
+invalid opcode: 0000 [#1] SMP
+last sysfs file: /sys/devices/system/xen_memory/xen_memory0/info/current_kb
+CPU 1
+Modules linked in: 8021q garp xen_netback xen_blkback blktap blkback_pagemap nbd bridge stp llc autofs4 ipmi_devintf ipmi_si ipmi_msghandler lockd sunrpc bonding ipv6 xenfs dm_multipath video output sbs sbshc parport_pc lp parport ses enclosure snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device serio_raw bnx2 snd_pcm_oss snd_mixer_oss snd_pcm snd_timer iTCO_wdt snd soundcore snd_page_alloc i2c_i801 iTCO_vendor_support i2c_core pcs pkr pata_acpi ata_generic ata_piix shpchp mptsas mptscsih mptbase [last unloaded: freq_table]
+Pid: 25581, comm: khelper Not tainted 2.6.32.36fixxen #1 Tecal RH2285
+RIP: e030:[<ffffffff8103a3cb>]  [<ffffffff8103a3cb>] leave_mm+0x15/0x46
+RSP: e02b:ffff88002805be48  EFLAGS: 00010046
+RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffff88015f8e2da0
+RDX: ffff88002805be78 RSI: 0000000000000000 RDI: 0000000000000001
+RBP: ffff88002805be48 R08: ffff88009d662000 R09: dead000000200200
+R10: dead000000100100 R11: ffffffff814472b2 R12: ffff88009bfc1880
+R13: ffff880028063020 R14: 00000000000004f6 R15: 0000000000000000
+FS:  00007f62362d66e0(0000) GS:ffff880028058000(0000) knlGS:0000000000000000
+CS:  e033 DS: 0000 ES: 0000 CR0: 000000008005003b
+CR2: 0000003aabc11909 CR3: 000000009b8ca000 CR4: 0000000000002660
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 00000000000000 00
+DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+Process khelper (pid: 25581, threadinfo ffff88007691e000, task ffff88009b92db40)
+Stack:
+ ffff88002805be68 ffffffff8100e4ae 0000000000000001 ffff88009d733b88
+<0> ffff88002805be98 ffffffff81087224 ffff88002805be78 ffff88002805be78
+<0> ffff88015f808360 00000000000004f6 ffff88002805bea8 ffffffff81010108
+Call Trace:
+ <IRQ>
+ [<ffffffff8100e4ae>] drop_other_mm_ref+0x2a/0x53
+ [<ffffffff81087224>] generic_smp_call_function_single_interrupt+0xd8/0xfc
+ [<ffffffff81010108>] xen_call_function_single_interrupt+0x13/0x28
+ [<ffffffff810a936a>] handle_IRQ_event+0x66/0x120
+ [<ffffffff810aac5b>] handle_percpu_irq+0x41/0x6e
+ [<ffffffff8128c1c0>] __xen_evtchn_do_upcall+0x1ab/0x27d
+ [<ffffffff8128dd11>] xen_evtchn_do_upcall+0x33/0x46
+ [<ffffffff81013efe>] xen_do_hyper visor_callback+0x1e/0x30
+ <EOI>
+ [<ffffffff814472b2>] ? _spin_unlock_irqrestore+0x15/0x17
+ [<ffffffff8100f8cf>] ? xen_restore_fl_direct_end+0x0/0x1
+ [<ffffffff81113f71>] ? flush_old_exec+0x3ac/0x500
+ [<ffffffff81150dc5>] ? load_elf_binary+0x0/0x17ef
+ [<ffffffff81150dc5>] ? load_elf_binary+0x0/0x17ef
+ [<ffffffff8115115d>] ? load_elf_binary+0x398/0x17ef
+ [<ffffffff81042fcf>] ? need_resched+0x23/0x2d
+ [<ffffffff811f4648>] ? process_measurement+0xc0/0xd7
+ [<ffffffff81150dc5>] ? load_elf_binary+0x0/0x17ef
+ [<ffffffff81113094>] ? search_binary_handler+0xc8/0x255
+ [<ffffffff81114362>] ? do_execve+0x1c3/0x29e
+ [<ffffffff8101155d>] ? sys_execve+0x43/0x5d
+ [<ffffffff8106fc45>] ? __call_usermodehelper+0x0/0x6f
+ [<ffffffff81013e28>] ? kernel_execve+0x68/0xd0
+ [<ffffffff 8106fc45>] ? __call_usermodehelper+0x0/0x6f
+ [<ffffffff8100f8cf>] ? xen_restore_fl_direct_end+0x0/0x1
+ [<ffffffff8106fb64>] ? ____call_usermodehelper+0x113/0x11e
+ [<ffffffff81013daa>] ? child_rip+0xa/0x20
+ [<ffffffff8106fc45>] ? __call_usermodehelper+0x0/0x6f
+ [<ffffffff81012f91>] ? int_ret_from_sys_call+0x7/0x1b
+ [<ffffffff8101371d>] ? retint_restore_args+0x5/0x6
+ [<ffffffff81013da0>] ? child_rip+0x0/0x20
+Code: 41 5e 41 5f c9 c3 55 48 89 e5 0f 1f 44 00 00 e8 17 ff ff ff c9 c3 55 48 89 e5 0f 1f 44 00 00 65 8b 04 25 c8 55 01 00 ff c8 75 04 <0f> 0b eb fe 65 48 8b 34 25 c0 55 01 00 48 81 c6 b8 02 00 00 e8
+RIP  [<ffffffff8103a3cb>] leave_mm+0x15/0x46
+ RSP <ffff88002805be48>
+---[ end trace ce9cee6832a9c503 ]---
+
+Tested-by: Maoxiaoyun<tinnycloud@hotmail.com>
+Signed-off-by: Kevin Tian <kevin.tian@intel.com>
+[v1: Fleshed out the git description a bit]
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/xen/mmu.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/xen/mmu.c
++++ b/arch/x86/xen/mmu.c
+@@ -1141,7 +1141,7 @@ static void drop_other_mm_ref(void *info
+ 
+ 	active_mm = percpu_read(cpu_tlbstate.active_mm);
+ 
+-	if (active_mm == mm)
++	if (active_mm == mm && percpu_read(cpu_tlbstate.state) != TLBSTATE_OK)
+ 		leave_mm(smp_processor_id());
+ 
+ 	/* If this cpu still has a stale cr3 reference, then make sure