.39 patches

30 files changed, 1658 insertions, 0 deletions

diff --git a/queue-2.6.39/arm-6941-1-cache-ensure-mva-is-cacheline-aligned-in.patch b/queue-2.6.39/arm-6941-1-cache-ensure-mva-is-cacheline-aligned-in.patch
new file mode 100644
index 0000000000..769c36678f
--- /dev/null
+++ b/queue-2.6.39/arm-6941-1-cache-ensure-mva-is-cacheline-aligned-in.patch
@@ -0,0 +1,52 @@
+From a248b13b21ae00b97638b4f435c8df3075808b5d Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Thu, 26 May 2011 11:20:19 +0100
+Subject: ARM: 6941/1: cache: ensure MVA is cacheline aligned in
+ flush_kern_dcache_area
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit a248b13b21ae00b97638b4f435c8df3075808b5d upstream.
+
+The v6 and v7 implementations of flush_kern_dcache_area do not align
+the passed MVA to the size of a cacheline in the data cache. If a
+misaligned address is used, only a subset of the requested area will
+be flushed. This has been observed to cause failures in SMP boot where
+the secondary_data initialised by the primary CPU is not cacheline
+aligned, causing the secondary CPUs to read incorrect values for their
+pgd and stack pointers.
+
+This patch ensures that the base address is cacheline aligned before
+flushing the d-cache.
+
+Acked-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/mm/cache-v6.S |    1 +
+ arch/arm/mm/cache-v7.S |    2 ++
+ 2 files changed, 3 insertions(+)
+
+--- a/arch/arm/mm/cache-v6.S
++++ b/arch/arm/mm/cache-v6.S
+@@ -176,6 +176,7 @@ ENDPROC(v6_coherent_kern_range)
+  */
+ ENTRY(v6_flush_kern_dcache_area)
+ 	add	r1, r0, r1
++	bic	r0, r0, #D_CACHE_LINE_SIZE - 1
+ 1:
+ #ifdef HARVARD_CACHE
+ 	mcr	p15, 0, r0, c7, c14, 1		@ clean & invalidate D line
+--- a/arch/arm/mm/cache-v7.S
++++ b/arch/arm/mm/cache-v7.S
+@@ -221,6 +221,8 @@ ENDPROC(v7_coherent_user_range)
+ ENTRY(v7_flush_kern_dcache_area)
+ 	dcache_line_size r2, r3
+ 	add	r1, r0, r1
++	sub	r3, r2, #1
++	bic	r0, r0, r3
+ 1:
+ 	mcr	p15, 0, r0, c7, c14, 1		@ clean & invalidate D line / unified line
+ 	add	r0, r0, r2
diff --git a/queue-2.6.39/atm-expose-atm-device-index-in-sysfs.patch b/queue-2.6.39/atm-expose-atm-device-index-in-sysfs.patch
new file mode 100644
index 0000000000..9b7a69034c
--- /dev/null
+++ b/queue-2.6.39/atm-expose-atm-device-index-in-sysfs.patch
@@ -0,0 +1,57 @@
+From e7a46b4d0839c2a3aa2e0ae0b145f293f6738498 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dcbw@redhat.com>
+Date: Fri, 27 May 2011 04:51:54 +0000
+Subject: atm: expose ATM device index in sysfs
+
+From: Dan Williams <dcbw@redhat.com>
+
+commit e7a46b4d0839c2a3aa2e0ae0b145f293f6738498 upstream.
+
+It's currently exposed only through /proc which, besides requiring
+screen-scraping, doesn't allow userspace to distinguish between two
+identical ATM adapters with different ATM indexes.  The ATM device index
+is required when using PPPoATM on a system with multiple ATM adapters.
+
+Signed-off-by: Dan Williams <dcbw@redhat.com>
+Reviewed-by: Eric Dumazet <eric.dumazet@gmail.com>
+Tested-by: David Woodhouse <dwmw2@infradead.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/atm/atm_sysfs.c |   10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/net/atm/atm_sysfs.c
++++ b/net/atm/atm_sysfs.c
+@@ -59,6 +59,14 @@ static ssize_t show_atmaddress(struct de
+ 	return pos - buf;
+ }
+ 
++static ssize_t show_atmindex(struct device *cdev,
++			     struct device_attribute *attr, char *buf)
++{
++	struct atm_dev *adev = to_atm_dev(cdev);
++
++	return sprintf(buf, "%d\n", adev->number);
++}
++
+ static ssize_t show_carrier(struct device *cdev,
+ 			    struct device_attribute *attr, char *buf)
+ {
+@@ -99,6 +107,7 @@ static ssize_t show_link_rate(struct dev
+ 
+ static DEVICE_ATTR(address, S_IRUGO, show_address, NULL);
+ static DEVICE_ATTR(atmaddress, S_IRUGO, show_atmaddress, NULL);
++static DEVICE_ATTR(atmindex, S_IRUGO, show_atmindex, NULL);
+ static DEVICE_ATTR(carrier, S_IRUGO, show_carrier, NULL);
+ static DEVICE_ATTR(type, S_IRUGO, show_type, NULL);
+ static DEVICE_ATTR(link_rate, S_IRUGO, show_link_rate, NULL);
+@@ -106,6 +115,7 @@ static DEVICE_ATTR(link_rate, S_IRUGO, s
+ static struct device_attribute *atm_attrs[] = {
+ 	&dev_attr_atmaddress,
+ 	&dev_attr_address,
++	&dev_attr_atmindex,
+ 	&dev_attr_carrier,
+ 	&dev_attr_type,
+ 	&dev_attr_link_rate,
diff --git a/queue-2.6.39/brd-handle-on-demand-devices-correctly.patch b/queue-2.6.39/brd-handle-on-demand-devices-correctly.patch
new file mode 100644
index 0000000000..a2bceb6e30
--- /dev/null
+++ b/queue-2.6.39/brd-handle-on-demand-devices-correctly.patch
@@ -0,0 +1,83 @@
+From af46566885a373b0a526932484cd8fef8de7b598 Mon Sep 17 00:00:00 2001
+From: Namhyung Kim <namhyung@gmail.com>
+Date: Thu, 26 May 2011 21:06:50 +0200
+Subject: brd: handle on-demand devices correctly
+
+From: Namhyung Kim <namhyung@gmail.com>
+
+commit af46566885a373b0a526932484cd8fef8de7b598 upstream.
+
+When finding or allocating a ram disk device, brd_probe() did not take
+partition numbers into account so that it can result to a different
+device. Consider following example (I set CONFIG_BLK_DEV_RAM_COUNT=4
+for simplicity) :
+
+$ sudo modprobe brd max_part=15
+$ ls -l /dev/ram*
+brw-rw---- 1 root disk 1,  0 2011-05-25 15:41 /dev/ram0
+brw-rw---- 1 root disk 1, 16 2011-05-25 15:41 /dev/ram1
+brw-rw---- 1 root disk 1, 32 2011-05-25 15:41 /dev/ram2
+brw-rw---- 1 root disk 1, 48 2011-05-25 15:41 /dev/ram3
+$ sudo mknod /dev/ram4 b 1 64
+$ sudo dd if=/dev/zero of=/dev/ram4 bs=4k count=256
+256+0 records in
+256+0 records out
+1048576 bytes (1.0 MB) copied, 0.00215578 s, 486 MB/s
+namhyung@leonhard:linux$ ls -l /dev/ram*
+brw-rw---- 1 root disk 1,    0 2011-05-25 15:41 /dev/ram0
+brw-rw---- 1 root disk 1,   16 2011-05-25 15:41 /dev/ram1
+brw-rw---- 1 root disk 1,   32 2011-05-25 15:41 /dev/ram2
+brw-rw---- 1 root disk 1,   48 2011-05-25 15:41 /dev/ram3
+brw-r--r-- 1 root root 1,   64 2011-05-25 15:45 /dev/ram4
+brw-rw---- 1 root disk 1, 1024 2011-05-25 15:44 /dev/ram64
+
+After this patch, /dev/ram4 - instead of /dev/ram64 - was
+accessed correctly.
+
+In addition, 'range' passed to blk_register_region() should
+include all range of dev_t that RAMDISK_MAJOR can address.
+It does not need to be limited by partition numbers unless
+'rd_nr' param was specified.
+
+Signed-off-by: Namhyung Kim <namhyung@gmail.com>
+Cc: Laurent Vivier <Laurent.Vivier@bull.net>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/block/brd.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/block/brd.c
++++ b/drivers/block/brd.c
+@@ -552,7 +552,7 @@ static struct kobject *brd_probe(dev_t d
+ 	struct kobject *kobj;
+ 
+ 	mutex_lock(&brd_devices_mutex);
+-	brd = brd_init_one(dev & MINORMASK);
++	brd = brd_init_one(MINOR(dev) >> part_shift);
+ 	kobj = brd ? get_disk(brd->brd_disk) : ERR_PTR(-ENOMEM);
+ 	mutex_unlock(&brd_devices_mutex);
+ 
+@@ -593,10 +593,10 @@ static int __init brd_init(void)
+ 
+ 	if (rd_nr) {
+ 		nr = rd_nr;
+-		range = rd_nr;
++		range = rd_nr << part_shift;
+ 	} else {
+ 		nr = CONFIG_BLK_DEV_RAM_COUNT;
+-		range = 1UL << (MINORBITS - part_shift);
++		range = 1UL << MINORBITS;
+ 	}
+ 
+ 	if (register_blkdev(RAMDISK_MAJOR, "ramdisk"))
+@@ -635,7 +635,7 @@ static void __exit brd_exit(void)
+ 	unsigned long range;
+ 	struct brd_device *brd, *next;
+ 
+-	range = rd_nr ? rd_nr :  1UL << (MINORBITS - part_shift);
++	range = rd_nr ? rd_nr << part_shift : 1UL << MINORBITS;
+ 
+ 	list_for_each_entry_safe(brd, next, &brd_devices, brd_list)
+ 		brd_del_one(brd);
diff --git a/queue-2.6.39/brd-limit-max_part-module-param-to-disk_max_parts.patch b/queue-2.6.39/brd-limit-max_part-module-param-to-disk_max_parts.patch
new file mode 100644
index 0000000000..d3296441c5
--- /dev/null
+++ b/queue-2.6.39/brd-limit-max_part-module-param-to-disk_max_parts.patch
@@ -0,0 +1,85 @@
+From 315980c8688c4b06713c1a5fe9d64cdf8ab57a72 Mon Sep 17 00:00:00 2001
+From: Namhyung Kim <namhyung@gmail.com>
+Date: Thu, 26 May 2011 21:06:50 +0200
+Subject: brd: limit 'max_part' module param to DISK_MAX_PARTS
+
+From: Namhyung Kim <namhyung@gmail.com>
+
+commit 315980c8688c4b06713c1a5fe9d64cdf8ab57a72 upstream.
+
+The 'max_part' parameter controls the number of maximum partition
+a brd device can have. However if a user specifies very large
+value it would exceed the limitation of device minor number and
+can cause a kernel panic (or, at least, produce invalid device
+nodes in some cases).
+
+On my desktop system, following command kills the kernel. On qemu,
+it triggers similar oops but the kernel was alive:
+
+$ sudo modprobe brd max_part=100000
+ BUG: unable to handle kernel NULL pointer dereference at 0000000000000058
+ IP: [<ffffffff81110a9a>] sysfs_create_dir+0x2d/0xae
+ PGD 7af1067 PUD 7b19067 PMD 0
+ Oops: 0000 [#1] SMP
+ last sysfs file:
+ CPU 0
+ Modules linked in: brd(+)
+
+ Pid: 44, comm: insmod Tainted: G        W   2.6.39-qemu+ #158 Bochs Bochs
+ RIP: 0010:[<ffffffff81110a9a>]  [<ffffffff81110a9a>] sysfs_create_dir+0x2d/0xae
+ RSP: 0018:ffff880007b15d78  EFLAGS: 00000286
+ RAX: ffff880007b05478 RBX: ffff880007a52760 RCX: ffff880007b15dc8
+ RDX: ffff880007a4f900 RSI: ffff880007b15e48 RDI: ffff880007a52760
+ RBP: ffff880007b15da8 R08: 0000000000000002 R09: 0000000000000000
+ R10: ffff880007b15e48 R11: ffff880007b05478 R12: 0000000000000000
+ R13: ffff880007b05478 R14: 0000000000400920 R15: 0000000000000063
+ FS:  0000000002160880(0063) GS:ffff880007c00000(0000) knlGS:0000000000000000
+ CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000000000000058 CR3: 0000000007b1c000 CR4: 00000000000006b0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 0000000000000000 DR7: 0000000000000000
+ Process insmod (pid: 44, threadinfo ffff880007b14000, task ffff880007acb980)
+ Stack:
+  ffff880007b15dc8 ffff880007b05478 ffff880007b15da8 00000000fffffffe
+  ffff880007a52760 ffff880007b05478 ffff880007b15de8 ffffffff81143c0a
+  0000000000400920 ffff880007a52760 ffff880007b05478 0000000000000000
+ Call Trace:
+  [<ffffffff81143c0a>] kobject_add_internal+0xdf/0x1a0
+  [<ffffffff81143da1>] kobject_add_varg+0x41/0x50
+  [<ffffffff81143e6b>] kobject_add+0x64/0x66
+  [<ffffffff8113bbe7>] blk_register_queue+0x5f/0xb8
+  [<ffffffff81140f72>] add_disk+0xdf/0x289
+  [<ffffffffa00040df>] brd_init+0xdf/0x1aa [brd]
+  [<ffffffffa0004000>] ? 0xffffffffa0003fff
+  [<ffffffffa0004000>] ? 0xffffffffa0003fff
+  [<ffffffff8100020a>] do_one_initcall+0x7a/0x12e
+  [<ffffffff8108516c>] sys_init_module+0x9c/0x1dc
+  [<ffffffff812ff4bb>] system_call_fastpath+0x16/0x1b
+ Code: 89 e5 41 55 41 54 53 48 89 fb 48 83 ec 18 48 85 ff 75 04 0f 0b eb fe 48 8b 47 18 49 c7 c4 70 1e 4d 81 48 85 c0 74 04 4c 8b 60 30
+  8b 44 24 58 45 31 ed 0f b6 c4 85 c0 74 0d 48 8b 43 28 48 89
+ RIP  [<ffffffff81110a9a>] sysfs_create_dir+0x2d/0xae
+  RSP <ffff880007b15d78>
+ CR2: 0000000000000058
+ ---[ end trace aebb1175ce1f6739 ]---
+
+Signed-off-by: Namhyung Kim <namhyung@gmail.com>
+Cc: Laurent Vivier <Laurent.Vivier@bull.net>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/block/brd.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/block/brd.c
++++ b/drivers/block/brd.c
+@@ -585,6 +585,9 @@ static int __init brd_init(void)
+ 	if (max_part > 0)
+ 		part_shift = fls(max_part);
+ 
++	if ((1UL << part_shift) > DISK_MAX_PARTS)
++		return -EINVAL;
++
+ 	if (rd_nr > 1UL << (MINORBITS - part_shift))
+ 		return -EINVAL;
+ 
diff --git a/queue-2.6.39/cpuidle-menu-fixed-wrapping-timers-at-4.294-seconds.patch b/queue-2.6.39/cpuidle-menu-fixed-wrapping-timers-at-4.294-seconds.patch
new file mode 100644
index 0000000000..63dfb4dd67
--- /dev/null
+++ b/queue-2.6.39/cpuidle-menu-fixed-wrapping-timers-at-4.294-seconds.patch
@@ -0,0 +1,44 @@
+From 7467571f4480b273007517b26297c07154c73924 Mon Sep 17 00:00:00 2001
+From: Tero Kristo <tero.kristo@nokia.com>
+Date: Thu, 24 Feb 2011 17:19:23 +0200
+Subject: cpuidle: menu: fixed wrapping timers at 4.294 seconds
+
+From: Tero Kristo <tero.kristo@nokia.com>
+
+commit 7467571f4480b273007517b26297c07154c73924 upstream.
+
+Cpuidle menu governor is using u32 as a temporary datatype for storing
+nanosecond values which wrap around at 4.294 seconds. This causes errors
+in predicted sleep times resulting in higher than should be C state
+selection and increased power consumption. This also breaks cpuidle
+state residency statistics.
+
+Signed-off-by: Tero Kristo <tero.kristo@nokia.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/cpuidle/governors/menu.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/cpuidle/governors/menu.c
++++ b/drivers/cpuidle/governors/menu.c
+@@ -237,6 +237,7 @@ static int menu_select(struct cpuidle_de
+ 	unsigned int power_usage = -1;
+ 	int i;
+ 	int multiplier;
++	struct timespec t;
+ 
+ 	if (data->needs_update) {
+ 		menu_update(dev);
+@@ -251,8 +252,9 @@ static int menu_select(struct cpuidle_de
+ 		return 0;
+ 
+ 	/* determine the expected residency time, round up */
++	t = ktime_to_timespec(tick_nohz_get_sleep_length());
+ 	data->expected_us =
+-	    DIV_ROUND_UP((u32)ktime_to_ns(tick_nohz_get_sleep_length()), 1000);
++		t.tv_sec * USEC_PER_SEC + t.tv_nsec / NSEC_PER_USEC;
+ 
+ 
+ 	data->bucket = which_bucket(data->expected_us);
diff --git a/queue-2.6.39/dm-mpath-do-not-fail-paths-after-integrity-errors.patch b/queue-2.6.39/dm-mpath-do-not-fail-paths-after-integrity-errors.patch
new file mode 100644
index 0000000000..209e2e205b
--- /dev/null
+++ b/queue-2.6.39/dm-mpath-do-not-fail-paths-after-integrity-errors.patch
@@ -0,0 +1,33 @@
+From 6f13f6fba76edc7d0e7580c5deee829d59a41b2f Mon Sep 17 00:00:00 2001
+From: "Martin K. Petersen" <martin.petersen@oracle.com>
+Date: Sun, 29 May 2011 13:02:55 +0100
+Subject: dm mpath: do not fail paths after integrity errors
+
+From: "Martin K. Petersen" <martin.petersen@oracle.com>
+
+commit 6f13f6fba76edc7d0e7580c5deee829d59a41b2f upstream.
+
+Integrity errors need to be passed to the owner of the integrity
+metadata for processing. Consequently EILSEQ should be passed up the
+stack.
+
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-mpath.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -1290,7 +1290,7 @@ static int do_end_io(struct multipath *m
+ 	if (!error && !clone->errors)
+ 		return 0;	/* I/O complete */
+ 
+-	if (error == -EOPNOTSUPP || error == -EREMOTEIO)
++	if (error == -EOPNOTSUPP || error == -EREMOTEIO || error == -EILSEQ)
+ 		return error;
+ 
+ 	if (mpio->pgpath)
diff --git a/queue-2.6.39/dm-table-reject-devices-without-request-fns.patch b/queue-2.6.39/dm-table-reject-devices-without-request-fns.patch
new file mode 100644
index 0000000000..50ddeeed1d
--- /dev/null
+++ b/queue-2.6.39/dm-table-reject-devices-without-request-fns.patch
@@ -0,0 +1,78 @@
+From f4808ca99a203f20b4475601748e44b25a65bdec Mon Sep 17 00:00:00 2001
+From: Milan Broz <mbroz@redhat.com>
+Date: Sun, 29 May 2011 13:02:52 +0100
+Subject: dm table: reject devices without request fns
+
+From: Milan Broz <mbroz@redhat.com>
+
+commit f4808ca99a203f20b4475601748e44b25a65bdec upstream.
+
+This patch adds a check that a block device has a request function
+defined before it is used.  Otherwise, misconfiguration can cause an oops.
+
+Because we are allowing devices with zero size e.g. an offline multipath
+device as in commit 2cd54d9bedb79a97f014e86c0da393416b264eb3
+("dm: allow offline devices") there needs to be an additional check
+to ensure devices are initialised.  Some block devices, like a loop
+device without a backing file, exist but have no request function.
+
+Reproducer is trivial: dm-mirror on unbound loop device
+(no backing file on loop devices)
+
+dmsetup create x --table "0 8 mirror core 2 8 sync 2 /dev/loop0 0 /dev/loop1 0"
+
+and mirror resync will immediatelly cause OOps.
+
+BUG: unable to handle kernel NULL pointer dereference at   (null)
+ ? generic_make_request+0x2bd/0x590
+ ? kmem_cache_alloc+0xad/0x190
+ submit_bio+0x53/0xe0
+ ? bio_add_page+0x3b/0x50
+ dispatch_io+0x1ca/0x210 [dm_mod]
+ ? read_callback+0x0/0xd0 [dm_mirror]
+ dm_io+0xbb/0x290 [dm_mod]
+ do_mirror+0x1e0/0x748 [dm_mirror]
+
+Signed-off-by: Milan Broz <mbroz@redhat.com>
+Reported-by: Zdenek Kabelac <zkabelac@redhat.com>
+Acked-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-table.c |   17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -362,6 +362,7 @@ static void close_dev(struct dm_dev_inte
+ static int device_area_is_invalid(struct dm_target *ti, struct dm_dev *dev,
+ 				  sector_t start, sector_t len, void *data)
+ {
++	struct request_queue *q;
+ 	struct queue_limits *limits = data;
+ 	struct block_device *bdev = dev->bdev;
+ 	sector_t dev_size =
+@@ -370,6 +371,22 @@ static int device_area_is_invalid(struct
+ 		limits->logical_block_size >> SECTOR_SHIFT;
+ 	char b[BDEVNAME_SIZE];
+ 
++	/*
++	 * Some devices exist without request functions,
++	 * such as loop devices not yet bound to backing files.
++	 * Forbid the use of such devices.
++	 */
++	q = bdev_get_queue(bdev);
++	if (!q || !q->make_request_fn) {
++		DMWARN("%s: %s is not yet initialised: "
++		       "start=%llu, len=%llu, dev_size=%llu",
++		       dm_device_name(ti->table->md), bdevname(bdev, b),
++		       (unsigned long long)start,
++		       (unsigned long long)len,
++		       (unsigned long long)dev_size);
++		return 1;
++	}
++
+ 	if (!dev_size)
+ 		return 0;
+ 
diff --git a/queue-2.6.39/drm-i915-fix-user-irq-miss-in-bsd-ring-on-g4x.patch b/queue-2.6.39/drm-i915-fix-user-irq-miss-in-bsd-ring-on-g4x.patch
new file mode 100644
index 0000000000..0000adf2a5
--- /dev/null
+++ b/queue-2.6.39/drm-i915-fix-user-irq-miss-in-bsd-ring-on-g4x.patch
@@ -0,0 +1,79 @@
+From 5bfa1063a775836a84f97e4df863fc36e1f856ad Mon Sep 17 00:00:00 2001
+From: "Feng, Boqun" <boqun.feng@intel.com>
+Date: Mon, 16 May 2011 16:02:39 +0800
+Subject: drm/i915: fix user irq miss in BSD ring on g4x
+
+From: "Feng, Boqun" <boqun.feng@intel.com>
+
+commit 5bfa1063a775836a84f97e4df863fc36e1f856ad upstream.
+
+On g4x, user interrupt in BSD ring is missed.
+This is because though g4x and ironlake share the same bsd_ring,
+their interrupt control interfaces have _two_ differences.
+
+1.different irq enable/disable functions:
+On g4x are i915_enable_irq and i915_disable_irq.
+On ironlake are ironlake_enable_irq and ironlake_disable_irq.
+2.different irq flag:
+On g4x user interrupt flag in BSD ring on is I915_BSD_USER_INTERRUPT.
+On ironlake is GT_BSD_USER_INTERRUPT
+
+Old bsd_ring_get/put_irq call ring_get_irq and ring_get_irq.
+ring_get_irq and ring_put_irq only call ironlake_enable/disable_irq.
+So comes the irq miss on g4x.
+
+To fix this, as other rings' code do, conditionally call different
+functions(i915_enable/disable_irq and ironlake_enable/disable_irq)
+and use different interrupt flags in bsd_ring_get/put_irq.
+
+Signed-off-by: Feng, Boqun <boqun.feng@intel.com>
+Reviewed-by: Xiang, Haihao <haihao.xiang@intel.com>
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_ringbuffer.c |   29 +++++++++++++++++++++++++++--
+ 1 file changed, 27 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -666,12 +666,37 @@ gen6_ring_put_irq(struct intel_ring_buff
+ static bool
+ bsd_ring_get_irq(struct intel_ring_buffer *ring)
+ {
+-	return ring_get_irq(ring, GT_BSD_USER_INTERRUPT);
++	struct drm_device *dev = ring->dev;
++	drm_i915_private_t *dev_priv = dev->dev_private;
++
++	if (!dev->irq_enabled)
++		return false;
++
++	spin_lock(&ring->irq_lock);
++	if (ring->irq_refcount++ == 0) {
++		if (IS_G4X(dev))
++			i915_enable_irq(dev_priv, I915_BSD_USER_INTERRUPT);
++		else
++			ironlake_enable_irq(dev_priv, GT_BSD_USER_INTERRUPT);
++	}
++	spin_unlock(&ring->irq_lock);
++
++	return true;
+ }
+ static void
+ bsd_ring_put_irq(struct intel_ring_buffer *ring)
+ {
+-	ring_put_irq(ring, GT_BSD_USER_INTERRUPT);
++	struct drm_device *dev = ring->dev;
++	drm_i915_private_t *dev_priv = dev->dev_private;
++
++	spin_lock(&ring->irq_lock);
++	if (--ring->irq_refcount == 0) {
++		if (IS_G4X(dev))
++			i915_disable_irq(dev_priv, I915_BSD_USER_INTERRUPT);
++		else
++			ironlake_disable_irq(dev_priv, GT_BSD_USER_INTERRUPT);
++	}
++	spin_unlock(&ring->irq_lock);
+ }
+ 
+ static int
diff --git a/queue-2.6.39/drm-radeon-cayman-setup-hdp-to-invalidate-and-flush-when.patch b/queue-2.6.39/drm-radeon-cayman-setup-hdp-to-invalidate-and-flush-when.patch
new file mode 100644
index 0000000000..c91264a721
--- /dev/null
+++ b/queue-2.6.39/drm-radeon-cayman-setup-hdp-to-invalidate-and-flush-when.patch
@@ -0,0 +1,46 @@
+From 0b65f83f9d2fab47b9b6040fe75fc2cfc73032d4 Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Thu, 19 May 2011 14:14:42 +1000
+Subject: drm/radeon/cayman: setup hdp to invalidate and flush when
+ asked
+
+From: Dave Airlie <airlied@redhat.com>
+
+commit 0b65f83f9d2fab47b9b6040fe75fc2cfc73032d4 upstream.
+
+On cayman we need to set the bit to cause HDP flushes to invalidate the
+HDP cache also.
+
+Reviewed-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/ni.c  |    4 ++++
+ drivers/gpu/drm/radeon/nid.h |    2 ++
+ 2 files changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -931,6 +931,10 @@ static void cayman_gpu_init(struct radeo
+ 	WREG32(CB_PERF_CTR3_SEL_0, 0);
+ 	WREG32(CB_PERF_CTR3_SEL_1, 0);
+ 
++	tmp = RREG32(HDP_MISC_CNTL);
++	tmp |= HDP_FLUSH_INVALIDATE_CACHE;
++	WREG32(HDP_MISC_CNTL, tmp);
++
+ 	hdp_host_path_cntl = RREG32(HDP_HOST_PATH_CNTL);
+ 	WREG32(HDP_HOST_PATH_CNTL, hdp_host_path_cntl);
+ 
+--- a/drivers/gpu/drm/radeon/nid.h
++++ b/drivers/gpu/drm/radeon/nid.h
+@@ -136,6 +136,8 @@
+ #define	HDP_NONSURFACE_INFO				0x2C08
+ #define	HDP_NONSURFACE_SIZE				0x2C0C
+ #define HDP_ADDR_CONFIG  				0x2F48
++#define HDP_MISC_CNTL					0x2F4C
++#define 	HDP_FLUSH_INVALIDATE_CACHE			(1 << 0)
+ 
+ #define	CC_SYS_RB_BACKEND_DISABLE			0x3F88
+ #define	GC_USER_SYS_RB_BACKEND_DISABLE			0x3F8C
diff --git a/queue-2.6.39/drm-radeon-evergreen-btc-fusion-setup-hdp-to-invalidate-and.patch b/queue-2.6.39/drm-radeon-evergreen-btc-fusion-setup-hdp-to-invalidate-and.patch
new file mode 100644
index 0000000000..b58ff34c8e
--- /dev/null
+++ b/queue-2.6.39/drm-radeon-evergreen-btc-fusion-setup-hdp-to-invalidate-and.patch
@@ -0,0 +1,56 @@
+From f25a5c63bfa017498c9adecb24d649ae96ba5c68 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Thu, 19 May 2011 11:07:57 -0400
+Subject: drm/radeon/evergreen/btc/fusion: setup hdp to invalidate and
+ flush when asked
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit f25a5c63bfa017498c9adecb24d649ae96ba5c68 upstream.
+
+This needs to be explicitly set on btc.  It's set by default
+on evergreen/fusion, so it fine to just unconditionally enable it for
+all chips.
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/evergreen.c  |    6 +++++-
+ drivers/gpu/drm/radeon/evergreend.h |    2 ++
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -1578,7 +1578,7 @@ static void evergreen_gpu_init(struct ra
+ 	u32 sq_stack_resource_mgmt_2;
+ 	u32 sq_stack_resource_mgmt_3;
+ 	u32 vgt_cache_invalidation;
+-	u32 hdp_host_path_cntl;
++	u32 hdp_host_path_cntl, tmp;
+ 	int i, j, num_shader_engines, ps_thread_count;
+ 
+ 	switch (rdev->family) {
+@@ -2141,6 +2141,10 @@ static void evergreen_gpu_init(struct ra
+ 	for (i = SQ_ALU_CONST_BUFFER_SIZE_HS_0; i < 0x29000; i += 4)
+ 		WREG32(i, 0);
+ 
++	tmp = RREG32(HDP_MISC_CNTL);
++	tmp |= HDP_FLUSH_INVALIDATE_CACHE;
++	WREG32(HDP_MISC_CNTL, tmp);
++
+ 	hdp_host_path_cntl = RREG32(HDP_HOST_PATH_CNTL);
+ 	WREG32(HDP_HOST_PATH_CNTL, hdp_host_path_cntl);
+ 
+--- a/drivers/gpu/drm/radeon/evergreend.h
++++ b/drivers/gpu/drm/radeon/evergreend.h
+@@ -64,6 +64,8 @@
+ #define GB_BACKEND_MAP  				0x98FC
+ #define DMIF_ADDR_CONFIG  				0xBD4
+ #define HDP_ADDR_CONFIG  				0x2F48
++#define HDP_MISC_CNTL  					0x2F4C
++#define		HDP_FLUSH_INVALIDATE_CACHE      	(1 << 0)
+ 
+ #define	CC_SYS_RB_BACKEND_DISABLE			0x3F88
+ #define	GC_USER_RB_BACKEND_DISABLE			0x9B7C
diff --git a/queue-2.6.39/drm-radeon-kms-add-wait-idle-ioctl-for-eg-cayman.patch b/queue-2.6.39/drm-radeon-kms-add-wait-idle-ioctl-for-eg-cayman.patch
new file mode 100644
index 0000000000..39a19cdc46
--- /dev/null
+++ b/queue-2.6.39/drm-radeon-kms-add-wait-idle-ioctl-for-eg-cayman.patch
@@ -0,0 +1,55 @@
+From 97bfd0acd32e9639c9136e03955d574655d5cc2b Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Thu, 19 May 2011 14:14:43 +1000
+Subject: drm/radeon/kms: add wait idle ioctl for eg->cayman
+
+From: Dave Airlie <airlied@redhat.com>
+
+commit 97bfd0acd32e9639c9136e03955d574655d5cc2b upstream.
+
+None of the latest GPUs had this hooked up, this is necessary for
+correct operation in a lot of cases, however we should test this on a few
+GPUs in these families as we've had problems in this area before.
+
+Reviewed-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_asic.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_asic.c
++++ b/drivers/gpu/drm/radeon/radeon_asic.c
+@@ -782,6 +782,7 @@ static struct radeon_asic evergreen_asic
+ 	.hpd_fini = &evergreen_hpd_fini,
+ 	.hpd_sense = &evergreen_hpd_sense,
+ 	.hpd_set_polarity = &evergreen_hpd_set_polarity,
++	.ioctl_wait_idle = r600_ioctl_wait_idle,
+ 	.gui_idle = &r600_gui_idle,
+ 	.pm_misc = &evergreen_pm_misc,
+ 	.pm_prepare = &evergreen_pm_prepare,
+@@ -828,6 +829,7 @@ static struct radeon_asic sumo_asic = {
+ 	.hpd_fini = &evergreen_hpd_fini,
+ 	.hpd_sense = &evergreen_hpd_sense,
+ 	.hpd_set_polarity = &evergreen_hpd_set_polarity,
++	.ioctl_wait_idle = r600_ioctl_wait_idle,
+ 	.gui_idle = &r600_gui_idle,
+ 	.pm_misc = &evergreen_pm_misc,
+ 	.pm_prepare = &evergreen_pm_prepare,
+@@ -874,6 +876,7 @@ static struct radeon_asic btc_asic = {
+ 	.hpd_fini = &evergreen_hpd_fini,
+ 	.hpd_sense = &evergreen_hpd_sense,
+ 	.hpd_set_polarity = &evergreen_hpd_set_polarity,
++	.ioctl_wait_idle = r600_ioctl_wait_idle,
+ 	.gui_idle = &r600_gui_idle,
+ 	.pm_misc = &evergreen_pm_misc,
+ 	.pm_prepare = &evergreen_pm_prepare,
+@@ -920,6 +923,7 @@ static struct radeon_asic cayman_asic =
+ 	.hpd_fini = &evergreen_hpd_fini,
+ 	.hpd_sense = &evergreen_hpd_sense,
+ 	.hpd_set_polarity = &evergreen_hpd_set_polarity,
++	.ioctl_wait_idle = r600_ioctl_wait_idle,
+ 	.gui_idle = &r600_gui_idle,
+ 	.pm_misc = &evergreen_pm_misc,
+ 	.pm_prepare = &evergreen_pm_prepare,
diff --git a/queue-2.6.39/drm-radeon-kms-fix-incorrect-comparison-in-cayman-setup.patch b/queue-2.6.39/drm-radeon-kms-fix-incorrect-comparison-in-cayman-setup.patch
new file mode 100644
index 0000000000..1eb9d143e0
--- /dev/null
+++ b/queue-2.6.39/drm-radeon-kms-fix-incorrect-comparison-in-cayman-setup.patch
@@ -0,0 +1,32 @@
+From c289cff10a265ec4afe4396425297ff979a840b5 Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Thu, 19 May 2011 14:14:40 +1000
+Subject: drm/radeon/kms: fix incorrect comparison in cayman setup
+ code.
+
+From: Dave Airlie <airlied@redhat.com>
+
+commit c289cff10a265ec4afe4396425297ff979a840b5 upstream.
+
+This was leading to a bogus value being programmed to the backend
+routing register.
+
+Reviewed-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/ni.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -417,7 +417,7 @@ static u32 cayman_get_tile_pipe_to_backe
+ 		num_shader_engines = 1;
+ 	if (num_shader_engines > rdev->config.cayman.max_shader_engines)
+ 		num_shader_engines = rdev->config.cayman.max_shader_engines;
+-	if (num_backends_per_asic > num_shader_engines)
++	if (num_backends_per_asic < num_shader_engines)
+ 		num_backends_per_asic = num_shader_engines;
+ 	if (num_backends_per_asic > (rdev->config.cayman.max_backends_per_se * num_shader_engines))
+ 		num_backends_per_asic = rdev->config.cayman.max_backends_per_se * num_shader_engines;
diff --git a/queue-2.6.39/drm-radeon-kms-fix-tile_config-value-reported-to-userspace.patch b/queue-2.6.39/drm-radeon-kms-fix-tile_config-value-reported-to-userspace.patch
new file mode 100644
index 0000000000..45da4b9625
--- /dev/null
+++ b/queue-2.6.39/drm-radeon-kms-fix-tile_config-value-reported-to-userspace.patch
@@ -0,0 +1,32 @@
+From cde5083b051e9c66c99a8764aefbc13349e7730d Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Thu, 19 May 2011 14:14:41 +1000
+Subject: drm/radeon/kms: fix tile_config value reported to userspace
+ on cayman.
+
+From: Dave Airlie <airlied@redhat.com>
+
+commit cde5083b051e9c66c99a8764aefbc13349e7730d upstream.
+
+cayman is reporting the wrong tile config value to userspace, this
+causes piglit mipmap generation tests to fail.
+
+Reviewed-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/ni.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -829,7 +829,7 @@ static void cayman_gpu_init(struct radeo
+ 	rdev->config.cayman.tile_config |=
+ 		((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT) << 4;
+ 	rdev->config.cayman.tile_config |=
+-		(gb_addr_config & PIPE_INTERLEAVE_SIZE_MASK) >> PIPE_INTERLEAVE_SIZE_SHIFT;
++		((gb_addr_config & PIPE_INTERLEAVE_SIZE_MASK) >> PIPE_INTERLEAVE_SIZE_SHIFT) << 8;
+ 	rdev->config.cayman.tile_config |=
+ 		((gb_addr_config & ROW_SIZE_MASK) >> ROW_SIZE_SHIFT) << 12;
+ 
diff --git a/queue-2.6.39/hwmon-pmbus-initialize-sysfs-attributes.patch b/queue-2.6.39/hwmon-pmbus-initialize-sysfs-attributes.patch
new file mode 100644
index 0000000000..5d4ecaea8a
--- /dev/null
+++ b/queue-2.6.39/hwmon-pmbus-initialize-sysfs-attributes.patch
@@ -0,0 +1,32 @@
+From eec752b2b99c794766926a9bac59b0d7df5b09c2 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <guenter.roeck@ericsson.com>
+Date: Tue, 24 May 2011 12:16:40 -0700
+Subject: hwmon: (pmbus) Initialize sysfs attributes
+
+From: Guenter Roeck <guenter.roeck@ericsson.com>
+
+commit eec752b2b99c794766926a9bac59b0d7df5b09c2 upstream.
+
+Initialize sysfs attrs before device_create_file() call to suppress
+lockdep_init_map() warning:
+
+WARNING: at kernel/lockdep.c:2701 lockdep_init_map+0x12d/0x140()
+
+Reviewed-by: Robert Coulson <robert.coulson@ericsson.com>
+Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/pmbus_core.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/hwmon/pmbus_core.c
++++ b/drivers/hwmon/pmbus_core.c
+@@ -700,6 +700,7 @@ do {									\
+ 	struct sensor_device_attribute *a				\
+ 	    = &data->_type##s[data->num_##_type##s].attribute;		\
+ 	BUG_ON(data->num_attributes >= data->max_attributes);		\
++	sysfs_attr_init(&a->dev_attr.attr);				\
+ 	a->dev_attr.attr.name = _name;					\
+ 	a->dev_attr.attr.mode = _mode;					\
+ 	a->dev_attr.show = _show;					\
diff --git a/queue-2.6.39/i8k-avoid-lahf-in-64-bit-code.patch b/queue-2.6.39/i8k-avoid-lahf-in-64-bit-code.patch
new file mode 100644
index 0000000000..fe50ea4d0a
--- /dev/null
+++ b/queue-2.6.39/i8k-avoid-lahf-in-64-bit-code.patch
@@ -0,0 +1,39 @@
+From bc1f419c76a2d6450413ce4349f4e4a07be011d5 Mon Sep 17 00:00:00 2001
+From: Luca Tettamanti <kronos.it@gmail.com>
+Date: Wed, 25 May 2011 20:43:31 +0200
+Subject: i8k: Avoid lahf in 64-bit code
+
+From: Luca Tettamanti <kronos.it@gmail.com>
+
+commit bc1f419c76a2d6450413ce4349f4e4a07be011d5 upstream.
+
+i8k uses lahf to read the flag register in 64-bit code; early x86-64
+CPUs, however, lack this instruction and we get an invalid opcode
+exception at runtime.
+Use pushf to load the flag register into the stack instead.
+
+Signed-off-by: Luca Tettamanti <kronos.it@gmail.com>
+Reported-by: Jeff Rickman <jrickman@myamigos.us>
+Tested-by: Jeff Rickman <jrickman@myamigos.us>
+Tested-by: Harry G McGavran Jr <w5pny@arrl.net>
+Cc: Massimo Dal Zotto <dz@debian.org>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/i8k.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/char/i8k.c
++++ b/drivers/char/i8k.c
+@@ -139,8 +139,8 @@ static int i8k_smm(struct smm_regs *regs
+ 		"movl %%edi,20(%%rax)\n\t"
+ 		"popq %%rdx\n\t"
+ 		"movl %%edx,0(%%rax)\n\t"
+-		"lahf\n\t"
+-		"shrl $8,%%eax\n\t"
++		"pushfq\n\t"
++		"popq %%rax\n\t"
+ 		"andl $1,%%eax\n"
+ 		:"=a"(rc)
+ 		:    "a"(regs)
diff --git a/queue-2.6.39/idle-governor-avoid-lock-acquisition-to-read-pm_qos-before.patch b/queue-2.6.39/idle-governor-avoid-lock-acquisition-to-read-pm_qos-before.patch
new file mode 100644
index 0000000000..7cd6afc7e9
--- /dev/null
+++ b/queue-2.6.39/idle-governor-avoid-lock-acquisition-to-read-pm_qos-before.patch
@@ -0,0 +1,160 @@
+From 333c5ae9948194428fe6c5ef5c088304fc98263b Mon Sep 17 00:00:00 2001
+From: Tim Chen <tim.c.chen@linux.intel.com>
+Date: Fri, 11 Feb 2011 12:49:04 -0800
+Subject: idle governor: Avoid lock acquisition to read pm_qos before
+ entering idle
+
+From: Tim Chen <tim.c.chen@linux.intel.com>
+
+commit 333c5ae9948194428fe6c5ef5c088304fc98263b upstream.
+
+Thanks to the reviews and comments by Rafael, James, Mark and Andi.
+Here's version 2 of the patch incorporating your comments and also some
+update to my previous patch comments.
+
+I noticed that before entering idle state, the menu idle governor will
+look up the current pm_qos target value according to the list of qos
+requests received.  This look up currently needs the acquisition of a
+lock to access the list of qos requests to find the qos target value,
+slowing down the entrance into idle state due to contention by multiple
+cpus to access this list.  The contention is severe when there are a lot
+of cpus waking and going into idle.  For example, for a simple workload
+that has 32 pair of processes ping ponging messages to each other, where
+64 cpu cores are active in test system, I see the following profile with
+37.82% of cpu cycles spent in contention of pm_qos_lock:
+
+-     37.82%          swapper  [kernel.kallsyms]          [k]
+_raw_spin_lock_irqsave
+   - _raw_spin_lock_irqsave
+      - 95.65% pm_qos_request
+           menu_select
+           cpuidle_idle_call
+         - cpu_idle
+              99.98% start_secondary
+
+A better approach will be to cache the updated pm_qos target value so
+reading it does not require lock acquisition as in the patch below.
+With this patch the contention for pm_qos_lock is removed and I saw a
+2.2X increase in throughput for my message passing workload.
+
+Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com>
+Acked-by: Andi Kleen <ak@linux.intel.com>
+Acked-by: James Bottomley <James.Bottomley@suse.de>
+Acked-by: mark gross <markgross@thegnar.org>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/pm_qos_params.h |    4 ++++
+ kernel/pm_qos_params.c        |   37 +++++++++++++++++++++++++------------
+ 2 files changed, 29 insertions(+), 12 deletions(-)
+
+--- a/include/linux/pm_qos_params.h
++++ b/include/linux/pm_qos_params.h
+@@ -16,6 +16,10 @@
+ #define PM_QOS_NUM_CLASSES 4
+ #define PM_QOS_DEFAULT_VALUE -1
+ 
++#define PM_QOS_CPU_DMA_LAT_DEFAULT_VALUE	(2000 * USEC_PER_SEC)
++#define PM_QOS_NETWORK_LAT_DEFAULT_VALUE	(2000 * USEC_PER_SEC)
++#define PM_QOS_NETWORK_THROUGHPUT_DEFAULT_VALUE	0
++
+ struct pm_qos_request_list {
+ 	struct plist_node list;
+ 	int pm_qos_class;
+--- a/kernel/pm_qos_params.c
++++ b/kernel/pm_qos_params.c
+@@ -53,11 +53,17 @@ enum pm_qos_type {
+ 	PM_QOS_MIN		/* return the smallest value */
+ };
+ 
++/*
++ * Note: The lockless read path depends on the CPU accessing
++ * target_value atomically.  Atomic access is only guaranteed on all CPU
++ * types linux supports for 32 bit quantites
++ */
+ struct pm_qos_object {
+ 	struct plist_head requests;
+ 	struct blocking_notifier_head *notifiers;
+ 	struct miscdevice pm_qos_power_miscdev;
+ 	char *name;
++	s32 target_value;	/* Do not change to 64 bit */
+ 	s32 default_value;
+ 	enum pm_qos_type type;
+ };
+@@ -70,7 +76,8 @@ static struct pm_qos_object cpu_dma_pm_q
+ 	.requests = PLIST_HEAD_INIT(cpu_dma_pm_qos.requests, pm_qos_lock),
+ 	.notifiers = &cpu_dma_lat_notifier,
+ 	.name = "cpu_dma_latency",
+-	.default_value = 2000 * USEC_PER_SEC,
++	.target_value = PM_QOS_CPU_DMA_LAT_DEFAULT_VALUE,
++	.default_value = PM_QOS_CPU_DMA_LAT_DEFAULT_VALUE,
+ 	.type = PM_QOS_MIN,
+ };
+ 
+@@ -79,7 +86,8 @@ static struct pm_qos_object network_lat_
+ 	.requests = PLIST_HEAD_INIT(network_lat_pm_qos.requests, pm_qos_lock),
+ 	.notifiers = &network_lat_notifier,
+ 	.name = "network_latency",
+-	.default_value = 2000 * USEC_PER_SEC,
++	.target_value = PM_QOS_NETWORK_LAT_DEFAULT_VALUE,
++	.default_value = PM_QOS_NETWORK_LAT_DEFAULT_VALUE,
+ 	.type = PM_QOS_MIN
+ };
+ 
+@@ -89,7 +97,8 @@ static struct pm_qos_object network_thro
+ 	.requests = PLIST_HEAD_INIT(network_throughput_pm_qos.requests, pm_qos_lock),
+ 	.notifiers = &network_throughput_notifier,
+ 	.name = "network_throughput",
+-	.default_value = 0,
++	.target_value = PM_QOS_NETWORK_THROUGHPUT_DEFAULT_VALUE,
++	.default_value = PM_QOS_NETWORK_THROUGHPUT_DEFAULT_VALUE,
+ 	.type = PM_QOS_MAX,
+ };
+ 
+@@ -135,6 +144,16 @@ static inline int pm_qos_get_value(struc
+ 	}
+ }
+ 
++static inline s32 pm_qos_read_value(struct pm_qos_object *o)
++{
++	return o->target_value;
++}
++
++static inline void pm_qos_set_value(struct pm_qos_object *o, s32 value)
++{
++	o->target_value = value;
++}
++
+ static void update_target(struct pm_qos_object *o, struct plist_node *node,
+ 			  int del, int value)
+ {
+@@ -159,6 +178,7 @@ static void update_target(struct pm_qos_
+ 		plist_add(node, &o->requests);
+ 	}
+ 	curr_value = pm_qos_get_value(o);
++	pm_qos_set_value(o, curr_value);
+ 	spin_unlock_irqrestore(&pm_qos_lock, flags);
+ 
+ 	if (prev_value != curr_value)
+@@ -193,18 +213,11 @@ static int find_pm_qos_object_by_minor(i
+  * pm_qos_request - returns current system wide qos expectation
+  * @pm_qos_class: identification of which qos value is requested
+  *
+- * This function returns the current target value in an atomic manner.
++ * This function returns the current target value.
+  */
+ int pm_qos_request(int pm_qos_class)
+ {
+-	unsigned long flags;
+-	int value;
+-
+-	spin_lock_irqsave(&pm_qos_lock, flags);
+-	value = pm_qos_get_value(pm_qos_array[pm_qos_class]);
+-	spin_unlock_irqrestore(&pm_qos_lock, flags);
+-
+-	return value;
++	return pm_qos_read_value(pm_qos_array[pm_qos_class]);
+ }
+ EXPORT_SYMBOL_GPL(pm_qos_request);
+ 
diff --git a/queue-2.6.39/kbuild-fix-gnu-make-v3.80-compatibility.patch b/queue-2.6.39/kbuild-fix-gnu-make-v3.80-compatibility.patch
new file mode 100644
index 0000000000..de526f12ad
--- /dev/null
+++ b/queue-2.6.39/kbuild-fix-gnu-make-v3.80-compatibility.patch
@@ -0,0 +1,37 @@
+From 43f67c98161c65f1b2e3af3a9ce6741850072c06 Mon Sep 17 00:00:00 2001
+From: Kevin Cernekee <cernekee@gmail.com>
+Date: Tue, 10 May 2011 15:47:16 -0700
+Subject: kbuild: Fix GNU make v3.80 compatibility
+
+From: Kevin Cernekee <cernekee@gmail.com>
+
+commit 43f67c98161c65f1b2e3af3a9ce6741850072c06 upstream.
+
+According to Documentation/Changes, the kernel should be buildable with
+GNU make 3.80+.  Commit 88d7be031f9f975bb3f50a0b5ef3796a671e7edf (kbuild:
+Use a single clean rule for kernel and external modules) introduced the
+"$(or" construct, which requires make 3.81.  This causes "make clean" to
+malfunction when it is used with external modules.
+
+Replace "$(or" with an equivalent "$(if" expression, to restore backward
+compatibility.
+
+Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
+Signed-off-by: Michal Marek <mmarek@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Makefile |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Makefile
++++ b/Makefile
+@@ -1374,7 +1374,7 @@ endif # KBUILD_EXTMOD
+ clean: $(clean-dirs)
+ 	$(call cmd,rmdirs)
+ 	$(call cmd,rmfiles)
+-	@find $(or $(KBUILD_EXTMOD), .) $(RCS_FIND_IGNORE) \
++	@find $(if $(KBUILD_EXTMOD), $(KBUILD_EXTMOD), .) $(RCS_FIND_IGNORE) \
+ 		\( -name '*.[oas]' -o -name '*.ko' -o -name '.*.cmd' \
+ 		-o -name '.*.d' -o -name '.*.tmp' -o -name '*.mod.c' \
+ 		-o -name '*.symtypes' -o -name 'modules.order' \
diff --git a/queue-2.6.39/nfs41-correct-offset-for-layoutcommit.patch b/queue-2.6.39/nfs41-correct-offset-for-layoutcommit.patch
new file mode 100644
index 0000000000..f32db38c89
--- /dev/null
+++ b/queue-2.6.39/nfs41-correct-offset-for-layoutcommit.patch
@@ -0,0 +1,32 @@
+From 4b8ee2b82e8b0b6e17ee33feb74fcdb5c6d8dbdd Mon Sep 17 00:00:00 2001
+From: Vitaliy Gusev <gusev.vitaliy@gmail.com>
+Date: Fri, 20 May 2011 01:34:46 +0400
+Subject: nfs41: Correct offset for LAYOUTCOMMIT
+
+From: Vitaliy Gusev <gusev.vitaliy@gmail.com>
+
+commit 4b8ee2b82e8b0b6e17ee33feb74fcdb5c6d8dbdd upstream.
+
+A client sends offset to MDS as it was seen by DS. As result,
+file size after copy is only half of original file size in case
+of 2 DS.
+
+Signed-off-by: Vitaliy Gusev <gusev.vitaliy@nexenta.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/pnfs.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -1009,7 +1009,7 @@ void
+ pnfs_set_layoutcommit(struct nfs_write_data *wdata)
+ {
+ 	struct nfs_inode *nfsi = NFS_I(wdata->inode);
+-	loff_t end_pos = wdata->args.offset + wdata->res.count;
++	loff_t end_pos = wdata->mds_offset + wdata->res.count;
+ 	bool mark_as_dirty = false;
+ 
+ 	spin_lock(&nfsi->vfs_inode.i_lock);
diff --git a/queue-2.6.39/nfsv4-handle-expired-stateids-when-the-lease-is-still-valid.patch b/queue-2.6.39/nfsv4-handle-expired-stateids-when-the-lease-is-still-valid.patch
new file mode 100644
index 0000000000..b8b132d854
--- /dev/null
+++ b/queue-2.6.39/nfsv4-handle-expired-stateids-when-the-lease-is-still-valid.patch
@@ -0,0 +1,57 @@
+From 0ced63d1a245ac11241a5d37932e6d04d9c8040d Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Thu, 26 May 2011 14:26:35 -0400
+Subject: NFSv4: Handle expired stateids when the lease is still valid
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit 0ced63d1a245ac11241a5d37932e6d04d9c8040d upstream.
+
+Currently, if the server returns NFS4ERR_EXPIRED in reply to a READ or
+WRITE, but the RENEW test determines that the lease is still active, we
+fail to recover and end up looping forever in a READ/WRITE + RENEW death
+spiral.
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/nfs4proc.c |    9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -267,9 +267,11 @@ static int nfs4_handle_exception(struct
+ 				break;
+ 			nfs4_schedule_stateid_recovery(server, state);
+ 			goto wait_on_recovery;
++		case -NFS4ERR_EXPIRED:
++			if (state != NULL)
++				nfs4_schedule_stateid_recovery(server, state);
+ 		case -NFS4ERR_STALE_STATEID:
+ 		case -NFS4ERR_STALE_CLIENTID:
+-		case -NFS4ERR_EXPIRED:
+ 			nfs4_schedule_lease_recovery(clp);
+ 			goto wait_on_recovery;
+ #if defined(CONFIG_NFS_V4_1)
+@@ -3670,9 +3672,11 @@ nfs4_async_handle_error(struct rpc_task
+ 				break;
+ 			nfs4_schedule_stateid_recovery(server, state);
+ 			goto wait_on_recovery;
++		case -NFS4ERR_EXPIRED:
++			if (state != NULL)
++				nfs4_schedule_stateid_recovery(server, state);
+ 		case -NFS4ERR_STALE_STATEID:
+ 		case -NFS4ERR_STALE_CLIENTID:
+-		case -NFS4ERR_EXPIRED:
+ 			nfs4_schedule_lease_recovery(clp);
+ 			goto wait_on_recovery;
+ #if defined(CONFIG_NFS_V4_1)
+@@ -4543,6 +4547,7 @@ int nfs4_lock_delegation_recall(struct n
+ 			case -ESTALE:
+ 				goto out;
+ 			case -NFS4ERR_EXPIRED:
++				nfs4_schedule_stateid_recovery(server, state);
+ 			case -NFS4ERR_STALE_CLIENTID:
+ 			case -NFS4ERR_STALE_STATEID:
+ 				nfs4_schedule_lease_recovery(server->nfs_client);
diff --git a/queue-2.6.39/nfsv4.1-fix-the-handling-of-nfs4err_seq_misordered-errors.patch b/queue-2.6.39/nfsv4.1-fix-the-handling-of-nfs4err_seq_misordered-errors.patch
new file mode 100644
index 0000000000..86574a884d
--- /dev/null
+++ b/queue-2.6.39/nfsv4.1-fix-the-handling-of-nfs4err_seq_misordered-errors.patch
@@ -0,0 +1,42 @@
+From 444f72fe7e7b5f4db34cee933fa3546ebb8e9122 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Thu, 26 May 2011 14:26:35 -0400
+Subject: NFSv4.1: Fix the handling of NFS4ERR_SEQ_MISORDERED errors
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit 444f72fe7e7b5f4db34cee933fa3546ebb8e9122 upstream.
+
+Currently, the call to nfs4_schedule_session_recovery() will actually just
+result in a test of the lease when what we really want is to force a
+session reset.
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/nfs4state.c |    6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -1466,7 +1466,10 @@ static int nfs4_reclaim_lease(struct nfs
+ #ifdef CONFIG_NFS_V4_1
+ void nfs4_schedule_session_recovery(struct nfs4_session *session)
+ {
+-	nfs4_schedule_lease_recovery(session->clp);
++	struct nfs_client *clp = session->clp;
++
++	set_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state);
++	nfs4_schedule_lease_recovery(clp);
+ }
+ EXPORT_SYMBOL_GPL(nfs4_schedule_session_recovery);
+ 
+@@ -1549,6 +1552,7 @@ static int nfs4_reset_session(struct nfs
+ 		status = nfs4_recovery_handle_error(clp, status);
+ 		goto out;
+ 	}
++	clear_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state);
+ 	/* create_session negotiated new slot table */
+ 	clear_bit(NFS4CLNT_RECALL_SLOT, &clp->cl_state);
+ 
diff --git a/queue-2.6.39/pci-add-quirk-for-setting-valid-class-for-ti816x-endpoint.patch b/queue-2.6.39/pci-add-quirk-for-setting-valid-class-for-ti816x-endpoint.patch
new file mode 100644
index 0000000000..9da5a45952
--- /dev/null
+++ b/queue-2.6.39/pci-add-quirk-for-setting-valid-class-for-ti816x-endpoint.patch
@@ -0,0 +1,49 @@
+From 63c4408074cbcc070ac17fc10e524800eb9bd0b0 Mon Sep 17 00:00:00 2001
+From: Hemant Pedanekar <hemantp@ti.com>
+Date: Tue, 5 Apr 2011 12:32:50 +0530
+Subject: PCI: Add quirk for setting valid class for TI816X Endpoint
+
+From: Hemant Pedanekar <hemantp@ti.com>
+
+commit 63c4408074cbcc070ac17fc10e524800eb9bd0b0 upstream.
+
+TI816X (common name for DM816x/C6A816x/AM389x family) devices configured
+to boot as PCIe Endpoint have class code = 0. This makes kernel PCI bus
+code to skip allocating BARs to these devices resulting into following
+type of error when trying to enable them:
+
+"Device 0000:01:00.0 not available because of resource collisions"
+
+The device cannot be operated because of the above issue.
+
+This patch adds a ID specific (TI VENDOR ID and 816X DEVICE ID based)
+'early' fixup quirk to replace class code with
+PCI_CLASS_MULTIMEDIA_VIDEO as class.
+
+Signed-off-by: Hemant Pedanekar <hemantp@ti.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/quirks.c |   10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2784,6 +2784,16 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_IN
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x3c28, vtd_mask_spec_errors);
+ #endif
+ 
++static void __devinit fixup_ti816x_class(struct pci_dev* dev)
++{
++	/* TI 816x devices do not have class code set when in PCIe boot mode */
++	if (dev->class == PCI_CLASS_NOT_DEFINED) {
++		dev_info(&dev->dev, "Setting PCI class for 816x PCIe device\n");
++		dev->class = PCI_CLASS_MULTIMEDIA_VIDEO;
++	}
++}
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_TI, 0xb800, fixup_ti816x_class);
++
+ static void pci_do_fixups(struct pci_dev *dev, struct pci_fixup *f,
+ 			  struct pci_fixup *end)
+ {
diff --git a/queue-2.6.39/series b/queue-2.6.39/series
index f222988a83..f80ec3fd6f 100644
--- a/queue-2.6.39/series
+++ b/queue-2.6.39/series
@@ -130,3 +130,32 @@ mfd-fix-omap-usbhs-crash-when-rmmoding-ehci-or-ohci.patch
 p54usb-add-zoom-4410-usbid.patch
 ecryptfs-clear-i_nlink-in-rmdir.patch
 ecryptfs-allow-2-scatterlist-entries-for-encrypted.patch
+ubifs-fix-a-rare-memory-leak-in-ro-to-rw-remounting-path.patch
+kbuild-fix-gnu-make-v3.80-compatibility.patch
+set-cred-user_ns-in-key_replace_session_keyring.patch
+i8k-avoid-lahf-in-64-bit-code.patch
+hwmon-pmbus-initialize-sysfs-attributes.patch
+cpuidle-menu-fixed-wrapping-timers-at-4.294-seconds.patch
+idle-governor-avoid-lock-acquisition-to-read-pm_qos-before.patch
+dm-table-reject-devices-without-request-fns.patch
+dm-mpath-do-not-fail-paths-after-integrity-errors.patch
+arm-6941-1-cache-ensure-mva-is-cacheline-aligned-in.patch
+tmpfs-fix-race-between-truncate-and-writepage.patch
+atm-expose-atm-device-index-in-sysfs.patch
+brd-limit-max_part-module-param-to-disk_max_parts.patch
+brd-handle-on-demand-devices-correctly.patch
+drm-i915-fix-user-irq-miss-in-bsd-ring-on-g4x.patch
+drm-radeon-cayman-setup-hdp-to-invalidate-and-flush-when.patch
+drm-radeon-evergreen-btc-fusion-setup-hdp-to-invalidate-and.patch
+drm-radeon-kms-fix-incorrect-comparison-in-cayman-setup.patch
+drm-radeon-kms-fix-tile_config-value-reported-to-userspace.patch
+drm-radeon-kms-add-wait-idle-ioctl-for-eg-cayman.patch
+sunrpc-deal-with-the-lack-of-a-syn_sent-sk-sk_state_change.patch
+nfsv4-handle-expired-stateids-when-the-lease-is-still-valid.patch
+nfsv4.1-fix-the-handling-of-nfs4err_seq_misordered-errors.patch
+nfs41-correct-offset-for-layoutcommit.patch
+pci-add-quirk-for-setting-valid-class-for-ti816x-endpoint.patch
+xen-p2m-create-entries-in-the-p2m_mfn-trees-s-to-track-1-1.patch
+xen-setup-fix-for-incorrect-xen_extra_mem_start.patch
+xen-setup-ignore-e820_unusable-when-setting-1-1-mappings.patch
+xen-mmu-fix-a-race-window-causing-leave_mm-bug.patch
diff --git a/queue-2.6.39/set-cred-user_ns-in-key_replace_session_keyring.patch b/queue-2.6.39/set-cred-user_ns-in-key_replace_session_keyring.patch
new file mode 100644
index 0000000000..acd8fc073f
--- /dev/null
+++ b/queue-2.6.39/set-cred-user_ns-in-key_replace_session_keyring.patch
@@ -0,0 +1,38 @@
+From f7285b5d631fd6096b11c6af0058ed3a2b30ef4e Mon Sep 17 00:00:00 2001
+From: "Serge E. Hallyn" <serge@hallyn.com>
+Date: Thu, 26 May 2011 15:25:05 -0500
+Subject: Set cred->user_ns in key_replace_session_keyring
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: "Serge E. Hallyn" <serge@hallyn.com>
+
+commit f7285b5d631fd6096b11c6af0058ed3a2b30ef4e upstream.
+
+Since this cred was not created with copy_creds(), it needs to get
+initialized.  Otherwise use of syscall(__NR_keyctl, KEYCTL_SESSION_TO_PARENT);
+can lead to a NULL deref.  Thanks to Robert for finding this.
+
+But introduced by commit 47a150edc2a ("Cache user_ns in struct cred").
+
+Signed-off-by: Serge E. Hallyn <serge.hallyn@canonical.com>
+Reported-by: Robert Święcki <robert@swiecki.net>
+Cc: David Howells <dhowells@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ security/keys/process_keys.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/security/keys/process_keys.c
++++ b/security/keys/process_keys.c
+@@ -845,6 +845,7 @@ void key_replace_session_keyring(void)
+ 	new-> sgid	= old-> sgid;
+ 	new->fsgid	= old->fsgid;
+ 	new->user	= get_uid(old->user);
++	new->user_ns	= new->user->user_ns;
+ 	new->group_info	= get_group_info(old->group_info);
+ 
+ 	new->securebits	= old->securebits;
diff --git a/queue-2.6.39/sunrpc-deal-with-the-lack-of-a-syn_sent-sk-sk_state_change.patch b/queue-2.6.39/sunrpc-deal-with-the-lack-of-a-syn_sent-sk-sk_state_change.patch
new file mode 100644
index 0000000000..9b78009afe
--- /dev/null
+++ b/queue-2.6.39/sunrpc-deal-with-the-lack-of-a-syn_sent-sk-sk_state_change.patch
@@ -0,0 +1,64 @@
+From fe19a96b10032035a35779f42ad59e35d6dd8ffd Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Fri, 18 Mar 2011 20:21:23 -0400
+Subject: SUNRPC: Deal with the lack of a SYN_SENT sk->sk_state_change
+ callback...
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit fe19a96b10032035a35779f42ad59e35d6dd8ffd upstream.
+
+The TCP connection state code depends on the state_change() callback
+being called when the SYN_SENT state is set. However the networking layer
+doesn't actually call us back in that case.
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sunrpc/xprtsock.c |   16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -1344,7 +1344,6 @@ static void xs_tcp_state_change(struct s
+ 	case TCP_CLOSE_WAIT:
+ 		/* The server initiated a shutdown of the socket */
+ 		xprt_force_disconnect(xprt);
+-	case TCP_SYN_SENT:
+ 		xprt->connect_cookie++;
+ 	case TCP_CLOSING:
+ 		/*
+@@ -1758,6 +1757,7 @@ static void xs_tcp_reuse_connection(stru
+ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
+ {
+ 	struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
++	int ret = -ENOTCONN;
+ 
+ 	if (!transport->inet) {
+ 		struct sock *sk = sock->sk;
+@@ -1789,12 +1789,22 @@ static int xs_tcp_finish_connecting(stru
+ 	}
+ 
+ 	if (!xprt_bound(xprt))
+-		return -ENOTCONN;
++		goto out;
+ 
+ 	/* Tell the socket layer to start connecting... */
+ 	xprt->stat.connect_count++;
+ 	xprt->stat.connect_start = jiffies;
+-	return kernel_connect(sock, xs_addr(xprt), xprt->addrlen, O_NONBLOCK);
++	ret = kernel_connect(sock, xs_addr(xprt), xprt->addrlen, O_NONBLOCK);
++	switch (ret) {
++	case 0:
++	case -EINPROGRESS:
++		/* SYN_SENT! */
++		xprt->connect_cookie++;
++		if (xprt->reestablish_timeout < XS_TCP_INIT_REEST_TO)
++			xprt->reestablish_timeout = XS_TCP_INIT_REEST_TO;
++	}
++out:
++	return ret;
+ }
+ 
+ /**
diff --git a/queue-2.6.39/tmpfs-fix-race-between-truncate-and-writepage.patch b/queue-2.6.39/tmpfs-fix-race-between-truncate-and-writepage.patch
new file mode 100644
index 0000000000..98510ee8a9
--- /dev/null
+++ b/queue-2.6.39/tmpfs-fix-race-between-truncate-and-writepage.patch
@@ -0,0 +1,50 @@
+From 826267cf1e6c6899eda1325a19f1b1d15c558b20 Mon Sep 17 00:00:00 2001
+From: Hugh Dickins <hughd@google.com>
+Date: Sat, 28 May 2011 13:14:09 -0700
+Subject: tmpfs: fix race between truncate and writepage
+
+From: Hugh Dickins <hughd@google.com>
+
+commit 826267cf1e6c6899eda1325a19f1b1d15c558b20 upstream.
+
+While running fsx on tmpfs with a memhog then swapoff, swapoff was hanging
+(interruptibly), repeatedly failing to locate the owner of a 0xff entry in
+the swap_map.
+
+Although shmem_writepage() does abandon when it sees incoming page index
+is beyond eof, there was still a window in which shmem_truncate_range()
+could come in between writepage's dropping lock and updating swap_map,
+find the half-completed swap_map entry, and in trying to free it,
+leave it in a state that swap_shmem_alloc() could not correct.
+
+Arguably a bug in __swap_duplicate()'s and swap_entry_free()'s handling
+of the different cases, but easiest to fix by moving swap_shmem_alloc()
+under cover of the lock.
+
+More interesting than the bug: it's been there since 2.6.33, why could
+I not see it with earlier kernels?  The mmotm of two weeks ago seems to
+have some magic for generating races, this is just one of three I found.
+
+With yesterday's git I first saw this in mainline, bisected in search of
+that magic, but the easy reproducibility evaporated.  Oh well, fix the bug.
+
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/shmem.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -1101,8 +1101,8 @@ static int shmem_writepage(struct page *
+ 		delete_from_page_cache(page);
+ 		shmem_swp_set(info, entry, swap.val);
+ 		shmem_swp_unmap(entry);
+-		spin_unlock(&info->lock);
+ 		swap_shmem_alloc(swap);
++		spin_unlock(&info->lock);
+ 		BUG_ON(page_mapped(page));
+ 		swap_writepage(page, wbc);
+ 		return 0;
diff --git a/queue-2.6.39/ubifs-fix-a-rare-memory-leak-in-ro-to-rw-remounting-path.patch b/queue-2.6.39/ubifs-fix-a-rare-memory-leak-in-ro-to-rw-remounting-path.patch
new file mode 100644
index 0000000000..1eb2074701
--- /dev/null
+++ b/queue-2.6.39/ubifs-fix-a-rare-memory-leak-in-ro-to-rw-remounting-path.patch
@@ -0,0 +1,44 @@
+From eaeee242c531cd4b0a4a46e8b5dd7ef504380c42 Mon Sep 17 00:00:00 2001
+From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Date: Fri, 6 May 2011 17:08:56 +0300
+Subject: UBIFS: fix a rare memory leak in ro to rw remounting path
+
+From: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+
+commit eaeee242c531cd4b0a4a46e8b5dd7ef504380c42 upstream.
+
+When re-mounting from R/O mode to R/W mode and the LEB count in the superblock
+is not up-to date, because for the underlying UBI volume became larger, we
+re-write the superblock. We allocate RAM for these purposes, but never free it.
+So this is a memory leak, although very rare one.
+
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ubifs/sb.c    |    3 ++-
+ fs/ubifs/super.c |    1 +
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+--- a/fs/ubifs/sb.c
++++ b/fs/ubifs/sb.c
+@@ -475,7 +475,8 @@ failed:
+  * @c: UBIFS file-system description object
+  *
+  * This function returns a pointer to the superblock node or a negative error
+- * code.
++ * code. Note, the user of this function is responsible of kfree()'ing the
++ * returned superblock buffer.
+  */
+ struct ubifs_sb_node *ubifs_read_sb_node(struct ubifs_info *c)
+ {
+--- a/fs/ubifs/super.c
++++ b/fs/ubifs/super.c
+@@ -1584,6 +1584,7 @@ static int ubifs_remount_rw(struct ubifs
+ 		}
+ 		sup->leb_cnt = cpu_to_le32(c->leb_cnt);
+ 		err = ubifs_write_sb_node(c, sup);
++		kfree(sup);
+ 		if (err)
+ 			goto out;
+ 	}
diff --git a/queue-2.6.39/xen-mmu-fix-a-race-window-causing-leave_mm-bug.patch b/queue-2.6.39/xen-mmu-fix-a-race-window-causing-leave_mm-bug.patch
new file mode 100644
index 0000000000..3ea149eb5a
--- /dev/null
+++ b/queue-2.6.39/xen-mmu-fix-a-race-window-causing-leave_mm-bug.patch
@@ -0,0 +1,101 @@
+From 7899891c7d161752f29abcc9bc0a9c6c3a3af26c Mon Sep 17 00:00:00 2001
+From: "Tian, Kevin" <kevin.tian@intel.com>
+Date: Thu, 12 May 2011 10:56:08 +0800
+Subject: xen mmu: fix a race window causing leave_mm BUG()
+
+From: "Tian, Kevin" <kevin.tian@intel.com>
+
+commit 7899891c7d161752f29abcc9bc0a9c6c3a3af26c upstream.
+
+There's a race window in xen_drop_mm_ref, where remote cpu may exit
+dirty bitmap between the check on this cpu and the point where remote
+cpu handles drop request. So in drop_other_mm_ref we need check
+whether TLB state is still lazy before calling into leave_mm. This
+bug is rarely observed in earlier kernel, but exaggerated by the
+commit 831d52bc153971b70e64eccfbed2b232394f22f8
+("x86, mm: avoid possible bogus tlb entries by clearing prev mm_cpumask after switching mm")
+which clears bitmap after changing the TLB state. the call trace is as below:
+
+---------------------------------
+kernel BUG at arch/x86/mm/tlb.c:61!
+invalid opcode: 0000 [#1] SMP
+last sysfs file: /sys/devices/system/xen_memory/xen_memory0/info/current_kb
+CPU 1
+Modules linked in: 8021q garp xen_netback xen_blkback blktap blkback_pagemap nbd bridge stp llc autofs4 ipmi_devintf ipmi_si ipmi_msghandler lockd sunrpc bonding ipv6 xenfs dm_multipath video output sbs sbshc parport_pc lp parport ses enclosure snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device serio_raw bnx2 snd_pcm_oss snd_mixer_oss snd_pcm snd_timer iTCO_wdt snd soundcore snd_page_alloc i2c_i801 iTCO_vendor_support i2c_core pcs pkr pata_acpi ata_generic ata_piix shpchp mptsas mptscsih mptbase [last unloaded: freq_table]
+Pid: 25581, comm: khelper Not tainted 2.6.32.36fixxen #1 Tecal RH2285
+RIP: e030:[<ffffffff8103a3cb>]  [<ffffffff8103a3cb>] leave_mm+0x15/0x46
+RSP: e02b:ffff88002805be48  EFLAGS: 00010046
+RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffff88015f8e2da0
+RDX: ffff88002805be78 RSI: 0000000000000000 RDI: 0000000000000001
+RBP: ffff88002805be48 R08: ffff88009d662000 R09: dead000000200200
+R10: dead000000100100 R11: ffffffff814472b2 R12: ffff88009bfc1880
+R13: ffff880028063020 R14: 00000000000004f6 R15: 0000000000000000
+FS:  00007f62362d66e0(0000) GS:ffff880028058000(0000) knlGS:0000000000000000
+CS:  e033 DS: 0000 ES: 0000 CR0: 000000008005003b
+CR2: 0000003aabc11909 CR3: 000000009b8ca000 CR4: 0000000000002660
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 00000000000000 00
+DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+Process khelper (pid: 25581, threadinfo ffff88007691e000, task ffff88009b92db40)
+Stack:
+ ffff88002805be68 ffffffff8100e4ae 0000000000000001 ffff88009d733b88
+<0> ffff88002805be98 ffffffff81087224 ffff88002805be78 ffff88002805be78
+<0> ffff88015f808360 00000000000004f6 ffff88002805bea8 ffffffff81010108
+Call Trace:
+ <IRQ>
+ [<ffffffff8100e4ae>] drop_other_mm_ref+0x2a/0x53
+ [<ffffffff81087224>] generic_smp_call_function_single_interrupt+0xd8/0xfc
+ [<ffffffff81010108>] xen_call_function_single_interrupt+0x13/0x28
+ [<ffffffff810a936a>] handle_IRQ_event+0x66/0x120
+ [<ffffffff810aac5b>] handle_percpu_irq+0x41/0x6e
+ [<ffffffff8128c1c0>] __xen_evtchn_do_upcall+0x1ab/0x27d
+ [<ffffffff8128dd11>] xen_evtchn_do_upcall+0x33/0x46
+ [<ffffffff81013efe>] xen_do_hyper visor_callback+0x1e/0x30
+ <EOI>
+ [<ffffffff814472b2>] ? _spin_unlock_irqrestore+0x15/0x17
+ [<ffffffff8100f8cf>] ? xen_restore_fl_direct_end+0x0/0x1
+ [<ffffffff81113f71>] ? flush_old_exec+0x3ac/0x500
+ [<ffffffff81150dc5>] ? load_elf_binary+0x0/0x17ef
+ [<ffffffff81150dc5>] ? load_elf_binary+0x0/0x17ef
+ [<ffffffff8115115d>] ? load_elf_binary+0x398/0x17ef
+ [<ffffffff81042fcf>] ? need_resched+0x23/0x2d
+ [<ffffffff811f4648>] ? process_measurement+0xc0/0xd7
+ [<ffffffff81150dc5>] ? load_elf_binary+0x0/0x17ef
+ [<ffffffff81113094>] ? search_binary_handler+0xc8/0x255
+ [<ffffffff81114362>] ? do_execve+0x1c3/0x29e
+ [<ffffffff8101155d>] ? sys_execve+0x43/0x5d
+ [<ffffffff8106fc45>] ? __call_usermodehelper+0x0/0x6f
+ [<ffffffff81013e28>] ? kernel_execve+0x68/0xd0
+ [<ffffffff 8106fc45>] ? __call_usermodehelper+0x0/0x6f
+ [<ffffffff8100f8cf>] ? xen_restore_fl_direct_end+0x0/0x1
+ [<ffffffff8106fb64>] ? ____call_usermodehelper+0x113/0x11e
+ [<ffffffff81013daa>] ? child_rip+0xa/0x20
+ [<ffffffff8106fc45>] ? __call_usermodehelper+0x0/0x6f
+ [<ffffffff81012f91>] ? int_ret_from_sys_call+0x7/0x1b
+ [<ffffffff8101371d>] ? retint_restore_args+0x5/0x6
+ [<ffffffff81013da0>] ? child_rip+0x0/0x20
+Code: 41 5e 41 5f c9 c3 55 48 89 e5 0f 1f 44 00 00 e8 17 ff ff ff c9 c3 55 48 89 e5 0f 1f 44 00 00 65 8b 04 25 c8 55 01 00 ff c8 75 04 <0f> 0b eb fe 65 48 8b 34 25 c0 55 01 00 48 81 c6 b8 02 00 00 e8
+RIP  [<ffffffff8103a3cb>] leave_mm+0x15/0x46
+ RSP <ffff88002805be48>
+---[ end trace ce9cee6832a9c503 ]---
+
+Tested-by: Maoxiaoyun<tinnycloud@hotmail.com>
+Signed-off-by: Kevin Tian <kevin.tian@intel.com>
+[v1: Fleshed out the git description a bit]
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/xen/mmu.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/xen/mmu.c
++++ b/arch/x86/xen/mmu.c
+@@ -1187,7 +1187,7 @@ static void drop_other_mm_ref(void *info
+ 
+ 	active_mm = percpu_read(cpu_tlbstate.active_mm);
+ 
+-	if (active_mm == mm)
++	if (active_mm == mm && percpu_read(cpu_tlbstate.state) != TLBSTATE_OK)
+ 		leave_mm(smp_processor_id());
+ 
+ 	/* If this cpu still has a stale cr3 reference, then make sure
diff --git a/queue-2.6.39/xen-p2m-create-entries-in-the-p2m_mfn-trees-s-to-track-1-1.patch b/queue-2.6.39/xen-p2m-create-entries-in-the-p2m_mfn-trees-s-to-track-1-1.patch
new file mode 100644
index 0000000000..147995483e
--- /dev/null
+++ b/queue-2.6.39/xen-p2m-create-entries-in-the-p2m_mfn-trees-s-to-track-1-1.patch
@@ -0,0 +1,79 @@
+From 8c5950881c3b5e6e350e4b0438a8ccc513d90df9 Mon Sep 17 00:00:00 2001
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Date: Fri, 1 Apr 2011 15:18:48 -0400
+Subject: xen/p2m: Create entries in the P2M_MFN trees's to track 1-1
+ mappings
+
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+
+commit 8c5950881c3b5e6e350e4b0438a8ccc513d90df9 upstream.
+
+.. when applicable. We need to track in the p2m_mfn and
+p2m_mfn_p the MFNs and pointers, respectivly, for the P2M entries
+that are allocated for the identity mappings. Without this,
+a PV domain with an E820 that triggers the 1-1 mapping to kick in,
+won't be able to be restored as the P2M won't have the identity
+mappings.
+
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/xen/p2m.c |   30 ++++++++++++++++++++++++++++--
+ 1 file changed, 28 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/xen/p2m.c
++++ b/arch/x86/xen/p2m.c
+@@ -522,11 +522,20 @@ static bool __init __early_alloc_p2m(uns
+ 	/* Boundary cross-over for the edges: */
+ 	if (idx) {
+ 		unsigned long *p2m = extend_brk(PAGE_SIZE, PAGE_SIZE);
++		unsigned long *mid_mfn_p;
+ 
+ 		p2m_init(p2m);
+ 
+ 		p2m_top[topidx][mididx] = p2m;
+ 
++		/* For save/restore we need to MFN of the P2M saved */
++
++		mid_mfn_p = p2m_top_mfn_p[topidx];
++		WARN(mid_mfn_p[mididx] != virt_to_mfn(p2m_missing),
++			"P2M_TOP_P[%d][%d] != MFN of p2m_missing!\n",
++			topidx, mididx);
++		mid_mfn_p[mididx] = virt_to_mfn(p2m);
++
+ 	}
+ 	return idx != 0;
+ }
+@@ -549,12 +558,29 @@ unsigned long __init set_phys_range_iden
+ 		pfn += P2M_MID_PER_PAGE * P2M_PER_PAGE)
+ 	{
+ 		unsigned topidx = p2m_top_index(pfn);
+-		if (p2m_top[topidx] == p2m_mid_missing) {
+-			unsigned long **mid = extend_brk(PAGE_SIZE, PAGE_SIZE);
++		unsigned long *mid_mfn_p;
++		unsigned long **mid;
++
++		mid = p2m_top[topidx];
++		mid_mfn_p = p2m_top_mfn_p[topidx];
++		if (mid == p2m_mid_missing) {
++			mid = extend_brk(PAGE_SIZE, PAGE_SIZE);
+ 
+ 			p2m_mid_init(mid);
+ 
+ 			p2m_top[topidx] = mid;
++
++			BUG_ON(mid_mfn_p != p2m_mid_missing_mfn);
++		}
++		/* And the save/restore P2M tables.. */
++		if (mid_mfn_p == p2m_mid_missing_mfn) {
++			mid_mfn_p = extend_brk(PAGE_SIZE, PAGE_SIZE);
++			p2m_mid_mfn_init(mid_mfn_p);
++
++			p2m_top_mfn_p[topidx] = mid_mfn_p;
++			p2m_top_mfn[topidx] = virt_to_mfn(mid_mfn_p);
++			/* Note: we don't set mid_mfn_p[midix] here,
++		 	 * look in __early_alloc_p2m */
+ 		}
+ 	}
+ 
diff --git a/queue-2.6.39/xen-setup-fix-for-incorrect-xen_extra_mem_start.patch b/queue-2.6.39/xen-setup-fix-for-incorrect-xen_extra_mem_start.patch
new file mode 100644
index 0000000000..de4dc8ebff
--- /dev/null
+++ b/queue-2.6.39/xen-setup-fix-for-incorrect-xen_extra_mem_start.patch
@@ -0,0 +1,41 @@
+From 0f16d0dfcdb5aab97d9e368f008b070b5b3ec6d3 Mon Sep 17 00:00:00 2001
+From: Daniel Kiper <dkiper@net-space.pl>
+Date: Wed, 11 May 2011 22:34:38 +0200
+Subject: xen/setup: Fix for incorrect xen_extra_mem_start
+ initialization under 32-bit
+
+From: Daniel Kiper <dkiper@net-space.pl>
+
+commit 0f16d0dfcdb5aab97d9e368f008b070b5b3ec6d3 upstream.
+
+git commit 24bdb0b62cc82120924762ae6bc85afc8c3f2b26 (xen: do not create
+the extra e820 region at an addr lower than 4G) does not take into
+account that ifdef CONFIG_X86_32 instead of e820_end_of_low_ram_pfn()
+find_low_pfn_range() is called (both calls are from arch/x86/kernel/setup.c).
+find_low_pfn_range() behaves correctly and does not require change in
+xen_extra_mem_start initialization. Additionally, if xen_extra_mem_start
+is initialized in the same way as ifdef CONFIG_X86_64 then memory hotplug
+support for Xen balloon driver (under development) is broken.
+
+Signed-off-by: Daniel Kiper <dkiper@net-space.pl>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/xen/setup.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/x86/xen/setup.c
++++ b/arch/x86/xen/setup.c
+@@ -227,7 +227,11 @@ char * __init xen_memory_setup(void)
+ 
+ 	memcpy(map_raw, map, sizeof(map));
+ 	e820.nr_map = 0;
++#ifdef CONFIG_X86_32
++	xen_extra_mem_start = mem_end;
++#else
+ 	xen_extra_mem_start = max((1ULL << 32), mem_end);
++#endif
+ 	for (i = 0; i < memmap.nr_entries; i++) {
+ 		unsigned long long end;
+ 
diff --git a/queue-2.6.39/xen-setup-ignore-e820_unusable-when-setting-1-1-mappings.patch b/queue-2.6.39/xen-setup-ignore-e820_unusable-when-setting-1-1-mappings.patch
new file mode 100644
index 0000000000..cbc8491f49
--- /dev/null
+++ b/queue-2.6.39/xen-setup-ignore-e820_unusable-when-setting-1-1-mappings.patch
@@ -0,0 +1,32 @@
+From 15bfc094517db2ddf38ca7ed47f3a1c0ad24f7c4 Mon Sep 17 00:00:00 2001
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Date: Tue, 12 Apr 2011 07:57:15 -0400
+Subject: xen/setup: Ignore E820_UNUSABLE when setting 1-1 mappings.
+
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+
+commit 15bfc094517db2ddf38ca7ed47f3a1c0ad24f7c4 upstream.
+
+When we parse the raw E820, the Xen hypervisor can set "E820_RAM"
+to "E820_UNUSABLE" if the mem=X argument is used. As such we
+should _not_ consider the E820_UNUSABLE as an 1-1 identity
+mapping, but instead use the same case as for E820_RAM.
+
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/xen/setup.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/xen/setup.c
++++ b/arch/x86/xen/setup.c
+@@ -166,7 +166,7 @@ static unsigned long __init xen_set_iden
+ 		if (last > end)
+ 			continue;
+ 
+-		if (entry->type == E820_RAM) {
++		if ((entry->type == E820_RAM) || (entry->type == E820_UNUSABLE)) {
+ 			if (start > start_pci)
+ 				identity += set_phys_range_identity(
+ 						PFN_UP(start_pci), PFN_DOWN(start));