--- /dev/null
+From b0a2679d27408d97ce31e5f800b44227d3388b84 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Sun, 30 Jan 2011 11:21:05 +0000
+Subject: ARM: initrd: disable initrd if passed address overlaps reserved region
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit b0a2679d27408d97ce31e5f800b44227d3388b84 upstream.
+
+Disable the initrd if the passed address already overlaps the reserved
+region. This avoids oopses on Netwinders when NeTTrom tells the kernel
+that an initrd is located at mem+4MB, but this overlaps the BSS,
+resulting in the kernels in-use BSS being freed.
+
+This should be applied to v2.6.37-stable.
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/mm/init.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/arch/arm/mm/init.c
++++ b/arch/arm/mm/init.c
+@@ -282,6 +282,12 @@ void __init arm_memblock_init(struct mem
+ memblock_reserve(__pa(_stext), _end - _stext);
+ #endif
+ #ifdef CONFIG_BLK_DEV_INITRD
++ if (phys_initrd_size &&
++ memblock_is_region_reserved(phys_initrd_start, phys_initrd_size)) {
++ pr_err("INITRD: 0x%08lx+0x%08lx overlaps in-use memory region - disabling initrd\n",
++ phys_initrd_start, phys_initrd_size);
++ phys_initrd_start = phys_initrd_size = 0;
++ }
+ if (phys_initrd_size) {
+ memblock_reserve(phys_initrd_start, phys_initrd_size);
+
--- /dev/null
+From 7f94de483f4e37e14d646ad6e85a3c82f66fb487 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Thu, 3 Feb 2011 16:27:34 +0000
+Subject: ASoC: Create an AIF1ADCDAT signal widget to match AIF2
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit 7f94de483f4e37e14d646ad6e85a3c82f66fb487 upstream.
+
+Due to the different routing for AIF1 and AIF2 we weren't using a
+single widget to represent the ADCDAT signal. For consistency add
+one.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm8994.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -2519,18 +2519,18 @@ SND_SOC_DAPM_SUPPLY("DSPINTCLK", WM8994_
+ SND_SOC_DAPM_SUPPLY("AIF1CLK", WM8994_AIF1_CLOCKING_1, 0, 0, NULL, 0),
+ SND_SOC_DAPM_SUPPLY("AIF2CLK", WM8994_AIF2_CLOCKING_1, 0, 0, NULL, 0),
+
+-SND_SOC_DAPM_AIF_OUT("AIF1ADC1L", "AIF1 Capture",
++SND_SOC_DAPM_AIF_OUT("AIF1ADC1L", NULL,
+ 0, WM8994_POWER_MANAGEMENT_4, 9, 0),
+-SND_SOC_DAPM_AIF_OUT("AIF1ADC1R", "AIF1 Capture",
++SND_SOC_DAPM_AIF_OUT("AIF1ADC1R", NULL,
+ 0, WM8994_POWER_MANAGEMENT_4, 8, 0),
+ SND_SOC_DAPM_AIF_IN("AIF1DAC1L", NULL, 0,
+ WM8994_POWER_MANAGEMENT_5, 9, 0),
+ SND_SOC_DAPM_AIF_IN("AIF1DAC1R", NULL, 0,
+ WM8994_POWER_MANAGEMENT_5, 8, 0),
+
+-SND_SOC_DAPM_AIF_OUT("AIF1ADC2L", "AIF1 Capture",
++SND_SOC_DAPM_AIF_OUT("AIF1ADC2L", NULL,
+ 0, WM8994_POWER_MANAGEMENT_4, 11, 0),
+-SND_SOC_DAPM_AIF_OUT("AIF1ADC2R", "AIF1 Capture",
++SND_SOC_DAPM_AIF_OUT("AIF1ADC2R", NULL,
+ 0, WM8994_POWER_MANAGEMENT_4, 10, 0),
+ SND_SOC_DAPM_AIF_IN("AIF1DAC2L", NULL, 0,
+ WM8994_POWER_MANAGEMENT_5, 11, 0),
+@@ -2571,6 +2571,7 @@ SND_SOC_DAPM_AIF_IN("AIF2DACR", NULL, 0,
+
+ SND_SOC_DAPM_AIF_IN("AIF1DACDAT", "AIF1 Playback", 0, SND_SOC_NOPM, 0, 0),
+ SND_SOC_DAPM_AIF_IN("AIF2DACDAT", "AIF2 Playback", 0, SND_SOC_NOPM, 0, 0),
++SND_SOC_DAPM_AIF_OUT("AIF1ADCDAT", "AIF1 Capture", 0, SND_SOC_NOPM, 0, 0),
+ SND_SOC_DAPM_AIF_OUT("AIF2ADCDAT", "AIF2 Capture", 0, SND_SOC_NOPM, 0, 0),
+
+ SND_SOC_DAPM_MUX("AIF1DAC Mux", SND_SOC_NOPM, 0, 0, &aif1dac_mux),
+@@ -2766,6 +2767,11 @@ static const struct snd_soc_dapm_route i
+ { "AIF2DAC2R Mixer", "Left Sidetone Switch", "Left Sidetone" },
+ { "AIF2DAC2R Mixer", "Right Sidetone Switch", "Right Sidetone" },
+
++ { "AIF1ADCDAT", NULL, "AIF1ADC1L" },
++ { "AIF1ADCDAT", NULL, "AIF1ADC1R" },
++ { "AIF1ADCDAT", NULL, "AIF1ADC2L" },
++ { "AIF1ADCDAT", NULL, "AIF1ADC2R" },
++
+ { "AIF2ADCDAT", NULL, "AIF2ADC Mux" },
+
+ /* AIF3 output */
--- /dev/null
+From 20a4e7fc7e213365ea3771d7bf1e10a6bab853be Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Fri, 21 Jan 2011 12:47:33 +0000
+Subject: ASoC: Handle low measured DC offsets for wm_hubs devices
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit 20a4e7fc7e213365ea3771d7bf1e10a6bab853be upstream.
+
+The DC servo codes are actually signed numbers so need to be treated as
+such.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm_hubs.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+--- a/sound/soc/codecs/wm_hubs.c
++++ b/sound/soc/codecs/wm_hubs.c
+@@ -92,6 +92,7 @@ static void wait_for_dc_servo(struct snd
+ static void calibrate_dc_servo(struct snd_soc_codec *codec)
+ {
+ struct wm_hubs_data *hubs = snd_soc_codec_get_drvdata(codec);
++ s8 offset;
+ u16 reg, reg_l, reg_r, dcs_cfg;
+
+ /* Set for 32 series updates */
+@@ -130,16 +131,14 @@ static void calibrate_dc_servo(struct sn
+ dev_dbg(codec->dev, "DCS input: %x %x\n", reg_l, reg_r);
+
+ /* HPOUT1L */
+- if (reg_l + hubs->dcs_codes > 0 &&
+- reg_l + hubs->dcs_codes < 0xff)
+- reg_l += hubs->dcs_codes;
+- dcs_cfg = reg_l << WM8993_DCS_DAC_WR_VAL_1_SHIFT;
++ offset = reg_l;
++ offset += hubs->dcs_codes;
++ dcs_cfg = (u8)offset << WM8993_DCS_DAC_WR_VAL_1_SHIFT;
+
+ /* HPOUT1R */
+- if (reg_r + hubs->dcs_codes > 0 &&
+- reg_r + hubs->dcs_codes < 0xff)
+- reg_r += hubs->dcs_codes;
+- dcs_cfg |= reg_r;
++ offset = reg_r;
++ offset += hubs->dcs_codes;
++ dcs_cfg |= (u8)offset;
+
+ dev_dbg(codec->dev, "DCS result: %x\n", dcs_cfg);
+
--- /dev/null
+From 78b3fb46753872fc79bffecc8d50355a8622b39b Mon Sep 17 00:00:00 2001
+From: Qiao Zhou <zhouqiao@marvell.com>
+Date: Wed, 19 Jan 2011 19:10:47 +0800
+Subject: ASoC: WM8994: fix wrong value in tristate function
+
+From: Qiao Zhou <zhouqiao@marvell.com>
+
+commit 78b3fb46753872fc79bffecc8d50355a8622b39b upstream.
+
+fix wrong value in wm8994_set_tristate func. when updating reg bits,
+it should use "value", not "reg".
+
+Signed-off-by: Qiao Zhou <zhouqiao@marvell.com>
+Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm8994.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -3486,7 +3486,7 @@ static int wm8994_set_tristate(struct sn
+ else
+ val = 0;
+
+- return snd_soc_update_bits(codec, reg, mask, reg);
++ return snd_soc_update_bits(codec, reg, mask, val);
+ }
+
+ #define WM8994_RATES SNDRV_PCM_RATE_8000_96000
--- /dev/null
+From 664cb7142ced8b827e92e1851d1ed2cae922f225 Mon Sep 17 00:00:00 2001
+From: Hans-Christian Egtvedt <hans-christian.egtvedt@atmel.com>
+Date: Thu, 9 Dec 2010 00:19:33 +0100
+Subject: avr32: use syscall prototypes from asm-generic instead of arch
+
+From: Hans-Christian Egtvedt <hans-christian.egtvedt@atmel.com>
+
+commit 664cb7142ced8b827e92e1851d1ed2cae922f225 upstream.
+
+This patch removes the redundant syscalls prototypes in the architecture
+specific syscalls.h header file. These were identical with the ones in
+asm-generic/syscalls.h.
+
+Signed-off-by: Hans-Christian Egtvedt <hans-christian.egtvedt@atmel.com>
+Reported-by: Peter Huewe <PeterHuewe@gmx.de>
+Reported-by: Sven Schnelle <svens@stackframe.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/avr32/include/asm/syscalls.h | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+--- a/arch/avr32/include/asm/syscalls.h
++++ b/arch/avr32/include/asm/syscalls.h
+@@ -16,18 +16,9 @@
+ #include <linux/signal.h>
+
+ /* kernel/process.c */
+-asmlinkage int sys_fork(struct pt_regs *);
+ asmlinkage int sys_clone(unsigned long, unsigned long,
+ unsigned long, unsigned long,
+ struct pt_regs *);
+-asmlinkage int sys_vfork(struct pt_regs *);
+-asmlinkage int sys_execve(const char __user *, char __user *__user *,
+- char __user *__user *, struct pt_regs *);
+-
+-/* kernel/signal.c */
+-asmlinkage int sys_sigaltstack(const stack_t __user *, stack_t __user *,
+- struct pt_regs *);
+-asmlinkage int sys_rt_sigreturn(struct pt_regs *);
+
+ /* mm/cache.c */
+ asmlinkage int sys_cacheflush(int, void __user *, size_t);
--- /dev/null
+From d8c216cfa57e8a579f41729cbb88c97835d9ac8d Mon Sep 17 00:00:00 2001
+From: Rafael J. Wysocki <rjw@sisk.pl>
+Date: Sat, 8 Jan 2011 00:29:20 +0100
+Subject: cpuidle: Make cpuidle_enable_device() call poll_idle_init()
+
+From: Rafael J. Wysocki <rjw@sisk.pl>
+
+commit d8c216cfa57e8a579f41729cbb88c97835d9ac8d upstream.
+
+The following scenario is possible with the current cpuidle code and
+the ACPI cpuidle driver:
+(1) acpi_processor_cst_has_changed() is called,
+(2) cpuidle_disable_device() is called,
+(3) cpuidle_remove_state_sysfs() is called to remove the (presumably
+ outdated) states info from sysfs,
+(3) acpi_processor_get_power_info() is called, the first entry in the
+ pr->power.states[] table is filled with zeros,
+(4) acpi_processor_setup_cpuidle() is called and it doesn't fill the
+ first entry in pr->power.states[],
+(5) cpuidle_enable_device() is called,
+(6) __cpuidle_register_device() is _not_ called, since the device has
+ already been registered,
+(7) Consequently, poll_idle_init() is _not_ called either,
+(8) cpuidle_add_state_sysfs() is called to create the sysfs attributes
+ for the new states and it uses the bogus first table entry from
+ acpi_processor_get_power_info() for creating state0.
+
+This problem is avoided if cpuidle_enable_device()
+unconditionally calls poll_idle_init().
+
+Reported-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/cpuidle/cpuidle.c | 82 +++++++++++++++++++++++-----------------------
+ 1 file changed, 41 insertions(+), 41 deletions(-)
+
+--- a/drivers/cpuidle/cpuidle.c
++++ b/drivers/cpuidle/cpuidle.c
+@@ -154,6 +154,45 @@ void cpuidle_resume_and_unlock(void)
+
+ EXPORT_SYMBOL_GPL(cpuidle_resume_and_unlock);
+
++#ifdef CONFIG_ARCH_HAS_CPU_RELAX
++static int poll_idle(struct cpuidle_device *dev, struct cpuidle_state *st)
++{
++ ktime_t t1, t2;
++ s64 diff;
++ int ret;
++
++ t1 = ktime_get();
++ local_irq_enable();
++ while (!need_resched())
++ cpu_relax();
++
++ t2 = ktime_get();
++ diff = ktime_to_us(ktime_sub(t2, t1));
++ if (diff > INT_MAX)
++ diff = INT_MAX;
++
++ ret = (int) diff;
++ return ret;
++}
++
++static void poll_idle_init(struct cpuidle_device *dev)
++{
++ struct cpuidle_state *state = &dev->states[0];
++
++ cpuidle_set_statedata(state, NULL);
++
++ snprintf(state->name, CPUIDLE_NAME_LEN, "C0");
++ snprintf(state->desc, CPUIDLE_DESC_LEN, "CPUIDLE CORE POLL IDLE");
++ state->exit_latency = 0;
++ state->target_residency = 0;
++ state->power_usage = -1;
++ state->flags = CPUIDLE_FLAG_POLL;
++ state->enter = poll_idle;
++}
++#else
++static void poll_idle_init(struct cpuidle_device *dev) {}
++#endif /* CONFIG_ARCH_HAS_CPU_RELAX */
++
+ /**
+ * cpuidle_enable_device - enables idle PM for a CPU
+ * @dev: the CPU
+@@ -178,6 +217,8 @@ int cpuidle_enable_device(struct cpuidle
+ return ret;
+ }
+
++ poll_idle_init(dev);
++
+ if ((ret = cpuidle_add_state_sysfs(dev)))
+ return ret;
+
+@@ -232,45 +273,6 @@ void cpuidle_disable_device(struct cpuid
+
+ EXPORT_SYMBOL_GPL(cpuidle_disable_device);
+
+-#ifdef CONFIG_ARCH_HAS_CPU_RELAX
+-static int poll_idle(struct cpuidle_device *dev, struct cpuidle_state *st)
+-{
+- ktime_t t1, t2;
+- s64 diff;
+- int ret;
+-
+- t1 = ktime_get();
+- local_irq_enable();
+- while (!need_resched())
+- cpu_relax();
+-
+- t2 = ktime_get();
+- diff = ktime_to_us(ktime_sub(t2, t1));
+- if (diff > INT_MAX)
+- diff = INT_MAX;
+-
+- ret = (int) diff;
+- return ret;
+-}
+-
+-static void poll_idle_init(struct cpuidle_device *dev)
+-{
+- struct cpuidle_state *state = &dev->states[0];
+-
+- cpuidle_set_statedata(state, NULL);
+-
+- snprintf(state->name, CPUIDLE_NAME_LEN, "C0");
+- snprintf(state->desc, CPUIDLE_DESC_LEN, "CPUIDLE CORE POLL IDLE");
+- state->exit_latency = 0;
+- state->target_residency = 0;
+- state->power_usage = -1;
+- state->flags = CPUIDLE_FLAG_POLL;
+- state->enter = poll_idle;
+-}
+-#else
+-static void poll_idle_init(struct cpuidle_device *dev) {}
+-#endif /* CONFIG_ARCH_HAS_CPU_RELAX */
+-
+ /**
+ * __cpuidle_register_device - internal register function called before register
+ * and enable routines
+@@ -291,8 +293,6 @@ static int __cpuidle_register_device(str
+
+ init_completion(&dev->kobj_unregister);
+
+- poll_idle_init(dev);
+-
+ /*
+ * cpuidle driver should set the dev->power_specified bit
+ * before registering the device if the driver provides
--- /dev/null
+From 96a3e79edff6f41b0f115a82f1a39d66218077a7 Mon Sep 17 00:00:00 2001
+From: Dario Lombardo <dario.lombardo@libero.it>
+Date: Fri, 21 Jan 2011 15:35:19 +0100
+Subject: drivers: update to pl2303 usb-serial to support Motorola cables
+
+From: Dario Lombardo <dario.lombardo@libero.it>
+
+commit 96a3e79edff6f41b0f115a82f1a39d66218077a7 upstream.
+
+Added 0x0307 device id to support Motorola cables to the pl2303 usb
+serial driver. This cable has a modified chip that is a pl2303, but
+declares itself as 0307. Fixed by adding the right device id to the
+supported devices list, assigning it the code labeled
+PL2303_PRODUCT_ID_MOTOROLA.
+
+Signed-off-by: Dario Lombardo <dario.lombardo@libero.it>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/pl2303.c | 1 +
+ drivers/usb/serial/pl2303.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -50,6 +50,7 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MMX) },
+ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_GPRS) },
+ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) },
++ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MOTOROLA) },
+ { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
+ { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
+ { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -21,6 +21,7 @@
+ #define PL2303_PRODUCT_ID_MMX 0x0612
+ #define PL2303_PRODUCT_ID_GPRS 0x0609
+ #define PL2303_PRODUCT_ID_HCR331 0x331a
++#define PL2303_PRODUCT_ID_MOTOROLA 0x0307
+
+ #define ATEN_VENDOR_ID 0x0557
+ #define ATEN_VENDOR_ID2 0x0547
--- /dev/null
+From 86af95039b69a90db15294eb1f9c147f1df0a8ea Mon Sep 17 00:00:00 2001
+From: Sven Neumann <s.neumann@raumfeld.com>
+Date: Fri, 12 Nov 2010 11:36:22 +0100
+Subject: ds2760_battery: Fix calculation of time_to_empty_now
+
+From: Sven Neumann <s.neumann@raumfeld.com>
+
+commit 86af95039b69a90db15294eb1f9c147f1df0a8ea upstream.
+
+A check against division by zero was modified in commit b0525b48.
+Since this change time_to_empty_now is always reported as zero
+while the battery is discharging and as a negative value while
+the battery is charging. This is because current is negative while
+the battery is discharging.
+
+Fix the check introduced by commit b0525b48 so that time_to_empty_now
+is reported correctly during discharge and as zero while charging.
+
+Signed-off-by: Sven Neumann <s.neumann@raumfeld.com>
+Acked-by: Daniel Mack <daniel@caiaq.de>
+Signed-off-by: Anton Vorontsov <cbouatmailru@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/power/ds2760_battery.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/power/ds2760_battery.c
++++ b/drivers/power/ds2760_battery.c
+@@ -212,7 +212,7 @@ static int ds2760_battery_read_status(st
+ if (di->rem_capacity > 100)
+ di->rem_capacity = 100;
+
+- if (di->current_uA >= 100L)
++ if (di->current_uA < -100L)
+ di->life_sec = -((di->accum_current_uAh - di->empty_uAh) * 36L)
+ / (di->current_uA / 100L);
+ else
--- /dev/null
+From 70a062286b9dfcbd24d2e11601aecfead5cf709a Mon Sep 17 00:00:00 2001
+From: Tim Deegan <Tim.Deegan@citrix.com>
+Date: Thu, 10 Feb 2011 08:50:41 +0000
+Subject: fix jiffy calculations in calibrate_delay_direct to handle overflow
+
+From: Tim Deegan <Tim.Deegan@citrix.com>
+
+commit 70a062286b9dfcbd24d2e11601aecfead5cf709a upstream.
+
+Fixes a hang when booting as dom0 under Xen, when jiffies can be
+quite large by the time the kernel init gets this far.
+
+Signed-off-by: Tim Deegan <Tim.Deegan@citrix.com>
+[jbeulich@novell.com: !time_after() -> time_before_eq() as suggested by Jiri Slaby]
+Signed-off-by: Jan Beulich <jbeulich@novell.com>
+Cc: Jiri Slaby <jslaby@suse.cz>
+Cc: Jeremy Fitzhardinge <jeremy@goop.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ init/calibrate.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/init/calibrate.c
++++ b/init/calibrate.c
+@@ -66,7 +66,7 @@ static unsigned long __cpuinit calibrate
+ pre_start = 0;
+ read_current_timer(&start);
+ start_jiffies = jiffies;
+- while (jiffies <= (start_jiffies + 1)) {
++ while (time_before_eq(jiffies, start_jiffies + 1)) {
+ pre_start = start;
+ read_current_timer(&start);
+ }
+@@ -74,8 +74,8 @@ static unsigned long __cpuinit calibrate
+
+ pre_end = 0;
+ end = post_start;
+- while (jiffies <=
+- (start_jiffies + 1 + DELAY_CALIBRATION_TICKS)) {
++ while (time_before_eq(jiffies, start_jiffies + 1 +
++ DELAY_CALIBRATION_TICKS)) {
+ pre_end = end;
+ read_current_timer(&end);
+ }
--- /dev/null
+From aa5bd67dcfdf9af34c7fa36ebc87d4e1f7e91873 Mon Sep 17 00:00:00 2001
+From: Kacper Kornet <kornet@camk.edu.pl>
+Date: Sat, 29 Jan 2011 00:21:04 +0100
+Subject: Fix prlimit64 for suid/sgid processes
+
+From: Kacper Kornet <kornet@camk.edu.pl>
+
+commit aa5bd67dcfdf9af34c7fa36ebc87d4e1f7e91873 upstream.
+
+Since check_prlimit_permission always fails in the case of SUID/GUID
+processes, such processes are not able to read or set their own limits.
+This commit changes this by assuming that process can always read/change
+its own limits.
+
+Signed-off-by: Kacper Kornet <kornet@camk.edu.pl>
+Acked-by: Jiri Slaby <jslaby@suse.cz>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/sys.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/sys.c
++++ b/kernel/sys.c
+@@ -1377,7 +1377,8 @@ static int check_prlimit_permission(stru
+ const struct cred *cred = current_cred(), *tcred;
+
+ tcred = __task_cred(task);
+- if ((cred->uid != tcred->euid ||
++ if (current != task &&
++ (cred->uid != tcred->euid ||
+ cred->uid != tcred->suid ||
+ cred->uid != tcred->uid ||
+ cred->gid != tcred->egid ||
--- /dev/null
+From 5219bf884b6e2b54e734ca1799b6f0014bb2b4b7 Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Fri, 14 Jan 2011 22:03:49 +0100
+Subject: i2c: Unregister dummy devices last on adapter removal
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit 5219bf884b6e2b54e734ca1799b6f0014bb2b4b7 upstream.
+
+Remove real devices first and dummy devices last. This gives device
+driver which instantiated dummy devices themselves a chance to clean
+them up before we do.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Tested-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/i2c/i2c-core.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+--- a/drivers/i2c/i2c-core.c
++++ b/drivers/i2c/i2c-core.c
+@@ -1005,6 +1005,14 @@ static int i2c_do_del_adapter(struct i2c
+ static int __unregister_client(struct device *dev, void *dummy)
+ {
+ struct i2c_client *client = i2c_verify_client(dev);
++ if (client && strcmp(client->name, "dummy"))
++ i2c_unregister_device(client);
++ return 0;
++}
++
++static int __unregister_dummy(struct device *dev, void *dummy)
++{
++ struct i2c_client *client = i2c_verify_client(dev);
+ if (client)
+ i2c_unregister_device(client);
+ return 0;
+@@ -1059,8 +1067,12 @@ int i2c_del_adapter(struct i2c_adapter *
+ mutex_unlock(&adap->userspace_clients_lock);
+
+ /* Detach any active clients. This can't fail, thus we do not
+- checking the returned value. */
++ * check the returned value. This is a two-pass process, because
++ * we can't remove the dummy devices during the first pass: they
++ * could have been instantiated by real devices wishing to clean
++ * them up properly, so we give them a chance to do that first. */
+ res = device_for_each_child(&adap->dev, NULL, __unregister_client);
++ res = device_for_each_child(&adap->dev, NULL, __unregister_dummy);
+
+ #ifdef CONFIG_I2C_COMPAT
+ class_compat_remove_link(i2c_adapter_compat_class, &adap->dev,
--- /dev/null
+From a124339ad28389093ed15eca990d39c51c5736cc Mon Sep 17 00:00:00 2001
+From: Don Skidmore <donald.c.skidmore@intel.com>
+Date: Tue, 18 Jan 2011 22:53:47 +0000
+Subject: ixgbe: fix for 82599 erratum on Header Splitting
+
+From: Don Skidmore <donald.c.skidmore@intel.com>
+
+commit a124339ad28389093ed15eca990d39c51c5736cc upstream.
+
+We have found a hardware erratum on 82599 hardware that can lead to
+unpredictable behavior when Header Splitting mode is enabled. So
+we are no longer enabling this feature on affected hardware.
+
+Please see the 82599 Specification Update for more information.
+
+Signed-off-by: Don Skidmore <donald.c.skidmore@intel.com>
+Tested-by: Stephen Ko <stephen.s.ko@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/ixgbe/ixgbe_main.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ixgbe/ixgbe_main.c
++++ b/drivers/net/ixgbe/ixgbe_main.c
+@@ -2651,9 +2651,16 @@ static void ixgbe_configure_rx(struct ix
+ int rx_buf_len;
+
+ /* Decide whether to use packet split mode or not */
++ /* On by default */
++ adapter->flags |= IXGBE_FLAG_RX_PS_ENABLED;
++
+ /* Do not use packet split if we're in SR-IOV Mode */
+- if (!adapter->num_vfs)
+- adapter->flags |= IXGBE_FLAG_RX_PS_ENABLED;
++ if (adapter->num_vfs)
++ adapter->flags &= ~IXGBE_FLAG_RX_PS_ENABLED;
++
++ /* Disable packet split due to 82599 erratum #45 */
++ if (hw->mac.type == ixgbe_mac_82599EB)
++ adapter->flags &= ~IXGBE_FLAG_RX_PS_ENABLED;
+
+ /* Set the RX buffer length according to the mode */
+ if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
--- /dev/null
+From 8ec98fe0b4ffdedce4c1caa9fb3d550f52ad1c6b Mon Sep 17 00:00:00 2001
+From: Lars-Peter Clausen <lars@metafoo.de>
+Date: Thu, 11 Nov 2010 19:00:52 +0100
+Subject: jz4740-battery: Protect against concurrent battery readings
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+commit 8ec98fe0b4ffdedce4c1caa9fb3d550f52ad1c6b upstream.
+
+We can not handle more then one ADC request at a time to the battery.
+The patch adds a mutex around the ADC read code to ensure this.
+
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Anton Vorontsov <cbouatmailru@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/power/jz4740-battery.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/power/jz4740-battery.c
++++ b/drivers/power/jz4740-battery.c
+@@ -47,6 +47,8 @@ struct jz_battery {
+
+ struct power_supply battery;
+ struct delayed_work work;
++
++ struct mutex lock;
+ };
+
+ static inline struct jz_battery *psy_to_jz_battery(struct power_supply *psy)
+@@ -68,6 +70,8 @@ static long jz_battery_read_voltage(stru
+ unsigned long val;
+ long voltage;
+
++ mutex_lock(&battery->lock);
++
+ INIT_COMPLETION(battery->read_completion);
+
+ enable_irq(battery->irq);
+@@ -91,6 +95,8 @@ static long jz_battery_read_voltage(stru
+ battery->cell->disable(battery->pdev);
+ disable_irq(battery->irq);
+
++ mutex_unlock(&battery->lock);
++
+ return voltage;
+ }
+
+@@ -291,6 +297,7 @@ static int __devinit jz_battery_probe(st
+ jz_battery->pdev = pdev;
+
+ init_completion(&jz_battery->read_completion);
++ mutex_init(&jz_battery->lock);
+
+ INIT_DELAYED_WORK(&jz_battery->work, jz_battery_work);
+
--- /dev/null
+From 01c88e2d6b7330c0cc5867fe2297e7d826e1337d Mon Sep 17 00:00:00 2001
+From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Date: Tue, 25 Jan 2011 15:07:27 -0800
+Subject: memcg: fix account leak at failure of memsw acconting
+
+From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+
+commit 01c88e2d6b7330c0cc5867fe2297e7d826e1337d upstream.
+
+Commit 4b53433468 ("memcg: clean up try_charge main loop") removes a
+cancel of charge at case: memory charge-> success. mem+swap charge->
+failure.
+
+This leaks usage of memory. Fix it.
+
+Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Reviewed-by: Johannes Weiner <hannes@cmpxchg.org>
+Acked-by: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
+Cc: Balbir Singh <balbir@in.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/memcontrol.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -1647,6 +1647,7 @@ static int __mem_cgroup_do_charge(struct
+ if (likely(!ret))
+ return CHARGE_OK;
+
++ res_counter_uncharge(&mem->res, csize);
+ mem_over_limit = mem_cgroup_from_res_counter(fail_res, memsw);
+ flags |= MEM_CGROUP_RECLAIM_NOSWAP;
+ } else
--- /dev/null
+From a34650f0f1ca589cda09c48cb62baf15e680a247 Mon Sep 17 00:00:00 2001
+From: Sonic Zhang <sonic.zhang@analog.com>
+Date: Tue, 11 Jan 2011 22:39:35 -0500
+Subject: mmc: bfin_sdh: fix alloc size for private data
+
+From: Sonic Zhang <sonic.zhang@analog.com>
+
+commit a34650f0f1ca589cda09c48cb62baf15e680a247 upstream.
+
+The bfin_sdh driver allocates the wrong size for the private data
+in the mmc_host. The first parameter of mmc_alloc_host should be
+the size of the local driver struct rather than the common mmc_host.
+
+Signed-off-by: Sonic Zhang <sonic.zhang@analog.com>
+Signed-off-by: Mike Frysinger <vapier@gentoo.org>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mmc/host/bfin_sdh.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/bfin_sdh.c
++++ b/drivers/mmc/host/bfin_sdh.c
+@@ -462,7 +462,7 @@ static int __devinit sdh_probe(struct pl
+ goto out;
+ }
+
+- mmc = mmc_alloc_host(sizeof(*mmc), &pdev->dev);
++ mmc = mmc_alloc_host(sizeof(struct sdh_host), &pdev->dev);
+ if (!mmc) {
+ ret = -ENOMEM;
+ goto out;
--- /dev/null
+From 13ad17745c2cbd437d9e24b2d97393e0be11c439 Mon Sep 17 00:00:00 2001
+From: Eric W. Biederman <ebiederm@xmission.com>
+Date: Sat, 29 Jan 2011 14:57:22 +0000
+Subject: net: Fix ip link add netns oops
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+commit 13ad17745c2cbd437d9e24b2d97393e0be11c439 upstream.
+
+Ed Swierk <eswierk@bigswitch.com> writes:
+> On 2.6.35.7
+> ip link add link eth0 netns 9999 type macvlan
+> where 9999 is a nonexistent PID triggers an oops and causes all network functions to hang:
+> [10663.821898] BUG: unable to handle kernel NULL pointer dereference at 000000000000006d
+> [10663.821917] IP: [<ffffffff8149c2fa>] __dev_alloc_name+0x9a/0x170
+> [10663.821933] PGD 1d3927067 PUD 22f5c5067 PMD 0
+> [10663.821944] Oops: 0000 [#1] SMP
+> [10663.821953] last sysfs file: /sys/devices/system/cpu/cpu0/cpufreq/scaling_cur_freq
+> [10663.821959] CPU 3
+> [10663.821963] Modules linked in: macvlan ip6table_filter ip6_tables rfcomm ipt_MASQUERADE binfmt_misc iptable_nat nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack sco ipt_REJECT bnep l2cap xt_tcpudp iptable_filter ip_tables x_tables bridge stp vboxnetadp vboxnetflt vboxdrv kvm_intel kvm parport_pc ppdev snd_hda_codec_intelhdmi snd_hda_codec_conexant arc4 iwlagn iwlcore mac80211 snd_hda_intel snd_hda_codec snd_hwdep snd_pcm snd_seq_midi snd_rawmidi i915 snd_seq_midi_event snd_seq thinkpad_acpi drm_kms_helper btusb tpm_tis nvram uvcvideo snd_timer snd_seq_device bluetooth videodev v4l1_compat v4l2_compat_ioctl32 tpm drm tpm_bios snd cfg80211 psmouse serio_raw intel_ips soundcore snd_page_alloc intel_agp i2c_algo_bit video output netconsole configfs lp parport usbhid hid e1000e sdhci_pci ahci libahci sdhci led_class
+> [10663.822155]
+> [10663.822161] Pid: 6000, comm: ip Not tainted 2.6.35-23-generic #41-Ubuntu 2901CTO/2901CTO
+> [10663.822167] RIP: 0010:[<ffffffff8149c2fa>] [<ffffffff8149c2fa>] __dev_alloc_name+0x9a/0x170
+> [10663.822177] RSP: 0018:ffff88014aebf7b8 EFLAGS: 00010286
+> [10663.822182] RAX: 00000000fffffff4 RBX: ffff8801ad900800 RCX: 0000000000000000
+> [10663.822187] RDX: ffff880000000000 RSI: 0000000000000000 RDI: ffff88014ad63000
+> [10663.822191] RBP: ffff88014aebf808 R08: 0000000000000041 R09: 0000000000000041
+> [10663.822196] R10: 0000000000000000 R11: dead000000200200 R12: ffff88014aebf818
+> [10663.822201] R13: fffffffffffffffd R14: ffff88014aebf918 R15: ffff88014ad62000
+> [10663.822207] FS: 00007f00c487f700(0000) GS:ffff880001f80000(0000) knlGS:0000000000000000
+> [10663.822212] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+> [10663.822216] CR2: 000000000000006d CR3: 0000000231f19000 CR4: 00000000000026e0
+> [10663.822221] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+> [10663.822226] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+> [10663.822231] Process ip (pid: 6000, threadinfo ffff88014aebe000, task ffff88014afb16e0)
+> [10663.822236] Stack:
+> [10663.822240] ffff88014aebf808 ffffffff814a2bb5 ffff88014aebf7e8 00000000a00ee8d6
+> [10663.822251] <0> 0000000000000000 ffffffffa00ef940 ffff8801ad900800 ffff88014aebf818
+> [10663.822265] <0> ffff88014aebf918 ffff8801ad900800 ffff88014aebf858 ffffffff8149c413
+> [10663.822281] Call Trace:
+> [10663.822290] [<ffffffff814a2bb5>] ? dev_addr_init+0x75/0xb0
+> [10663.822298] [<ffffffff8149c413>] dev_alloc_name+0x43/0x90
+> [10663.822307] [<ffffffff814a85ee>] rtnl_create_link+0xbe/0x1b0
+> [10663.822314] [<ffffffff814ab2aa>] rtnl_newlink+0x48a/0x570
+> [10663.822321] [<ffffffff814aafcc>] ? rtnl_newlink+0x1ac/0x570
+> [10663.822332] [<ffffffff81030064>] ? native_x2apic_icr_read+0x4/0x20
+> [10663.822339] [<ffffffff814a8c17>] rtnetlink_rcv_msg+0x177/0x290
+> [10663.822346] [<ffffffff814a8aa0>] ? rtnetlink_rcv_msg+0x0/0x290
+> [10663.822354] [<ffffffff814c25d9>] netlink_rcv_skb+0xa9/0xd0
+> [10663.822360] [<ffffffff814a8a85>] rtnetlink_rcv+0x25/0x40
+> [10663.822367] [<ffffffff814c223e>] netlink_unicast+0x2de/0x2f0
+> [10663.822374] [<ffffffff814c303e>] netlink_sendmsg+0x1fe/0x2e0
+> [10663.822383] [<ffffffff81488533>] sock_sendmsg+0xf3/0x120
+> [10663.822391] [<ffffffff815899fe>] ? _raw_spin_lock+0xe/0x20
+> [10663.822400] [<ffffffff81168656>] ? __d_lookup+0x136/0x150
+> [10663.822406] [<ffffffff815899fe>] ? _raw_spin_lock+0xe/0x20
+> [10663.822414] [<ffffffff812b7a0d>] ? _atomic_dec_and_lock+0x4d/0x80
+> [10663.822422] [<ffffffff8116ea90>] ? mntput_no_expire+0x30/0x110
+> [10663.822429] [<ffffffff81486ff5>] ? move_addr_to_kernel+0x65/0x70
+> [10663.822435] [<ffffffff81493308>] ? verify_iovec+0x88/0xe0
+> [10663.822442] [<ffffffff81489020>] sys_sendmsg+0x240/0x3a0
+> [10663.822450] [<ffffffff8111e2a9>] ? __do_fault+0x479/0x560
+> [10663.822457] [<ffffffff815899fe>] ? _raw_spin_lock+0xe/0x20
+> [10663.822465] [<ffffffff8116cf4a>] ? alloc_fd+0x10a/0x150
+> [10663.822473] [<ffffffff8158d76e>] ? do_page_fault+0x15e/0x350
+> [10663.822482] [<ffffffff8100a0f2>] system_call_fastpath+0x16/0x1b
+> [10663.822487] Code: 90 48 8d 78 02 be 25 00 00 00 e8 92 1d e2 ff 48 85 c0 75 cf bf 20 00 00 00 e8 c3 b1 c6 ff 49 89 c7 b8 f4 ff ff ff 4d 85 ff 74 bd <4d> 8b 75 70 49 8d 45 70 48 89 45 b8 49 83 ee 58 eb 28 48 8d 55
+> [10663.822618] RIP [<ffffffff8149c2fa>] __dev_alloc_name+0x9a/0x170
+> [10663.822627] RSP <ffff88014aebf7b8>
+> [10663.822631] CR2: 000000000000006d
+> [10663.822636] ---[ end trace 3dfd6c3ad5327ca7 ]---
+
+This bug was introduced in:
+commit 81adee47dfb608df3ad0b91d230fb3cef75f0060
+Author: Eric W. Biederman <ebiederm@aristanetworks.com>
+Date: Sun Nov 8 00:53:51 2009 -0800
+
+ net: Support specifying the network namespace upon device creation.
+
+ There is no good reason to not support userspace specifying the
+ network namespace during device creation, and it makes it easier
+ to create a network device and pass it to a child network namespace
+ with a well known name.
+
+ We have to be careful to ensure that the target network namespace
+ for the new device exists through the life of the call. To keep
+ that logic clear I have factored out the network namespace grabbing
+ logic into rtnl_link_get_net.
+
+ In addtion we need to continue to pass the source network namespace
+ to the rtnl_link_ops.newlink method so that we can find the base
+ device source network namespace.
+
+ Signed-off-by: Eric W. Biederman <ebiederm@aristanetworks.com>
+ Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
+
+Where apparently I forgot to add error handling to the path where we create
+a new network device in a new network namespace, and pass in an invalid pid.
+
+Reported-by: Ed Swierk <eswierk@bigswitch.com>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/core/rtnetlink.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -1546,6 +1546,9 @@ replay:
+ snprintf(ifname, IFNAMSIZ, "%s%%d", ops->kind);
+
+ dest_net = rtnl_link_get_net(net, tb);
++ if (IS_ERR(dest_net))
++ return PTR_ERR(dest_net);
++
+ dev = rtnl_create_link(net, dest_net, ifname, ops, tb);
+
+ if (IS_ERR(dev))
--- /dev/null
+From 3b5c5827d1f80ad8ae844a8b1183f59ddb90fe25 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@googlemail.com>
+Date: Thu, 6 Jan 2011 23:47:52 +0100
+Subject: p54: fix sequence no. accounting off-by-one error
+
+From: Christian Lamparter <chunkeey@googlemail.com>
+
+commit 3b5c5827d1f80ad8ae844a8b1183f59ddb90fe25 upstream.
+
+P54_HDR_FLAG_DATA_OUT_SEQNR is meant to tell the
+firmware that "the frame's sequence number has
+already been set by the application."
+
+Whereas IEEE80211_TX_CTL_ASSIGN_SEQ is set for
+frames which lack a valid sequence number and
+either the driver or firmware has to assign one.
+
+Yup, it's the exact opposite!
+
+Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/p54/txrx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/p54/txrx.c
++++ b/drivers/net/wireless/p54/txrx.c
+@@ -618,7 +618,7 @@ static void p54_tx_80211_header(struct p
+ else
+ *burst_possible = false;
+
+- if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ)
++ if (!(info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ))
+ *flags |= P54_HDR_FLAG_DATA_OUT_SEQNR;
+
+ if (info->flags & IEEE80211_TX_CTL_PSPOLL_RESPONSE)
--- /dev/null
+From 99a0fadf561e1f553c08f0a29f8b2578f55dd5f0 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Wed, 22 Dec 2010 10:06:36 +0100
+Subject: PCI: pci-stub: ignore zero-length id parameters
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 99a0fadf561e1f553c08f0a29f8b2578f55dd5f0 upstream.
+
+pci-stub uses strsep() to separate list of ids and generates a warning
+message when it fails to parse an id. However, not specifying the
+parameter results in ids set to an empty string. strsep() happily
+returns the empty string as the first token and thus triggers the
+warning message spuriously.
+
+Make the tokner ignore zero length ids.
+
+Reported-by: Chris Wright <chrisw@sous-sol.org>
+Reported-by: Prasad Joshi <P.G.Joshi@student.reading.ac.uk>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/pci-stub.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/pci/pci-stub.c
++++ b/drivers/pci/pci-stub.c
+@@ -54,6 +54,9 @@ static int __init pci_stub_init(void)
+ subdevice = PCI_ANY_ID, class=0, class_mask=0;
+ int fields;
+
++ if (!strlen(id))
++ continue;
++
+ fields = sscanf(id, "%x:%x:%x:%x:%x:%x",
+ &vendor, &device, &subvendor, &subdevice,
+ &class, &class_mask);
--- /dev/null
+From 01e05e9a90b8f4c3997ae0537e87720eb475e532 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Thu, 10 Feb 2011 15:01:22 -0800
+Subject: ptrace: use safer wake up on ptrace_detach()
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 01e05e9a90b8f4c3997ae0537e87720eb475e532 upstream.
+
+The wake_up_process() call in ptrace_detach() is spurious and not
+interlocked with the tracee state. IOW, the tracee could be running or
+sleeping in any place in the kernel by the time wake_up_process() is
+called. This can lead to the tracee waking up unexpectedly which can be
+dangerous.
+
+The wake_up is spurious and should be removed but for now reduce its
+toxicity by only waking up if the tracee is in TRACED or STOPPED state.
+
+This bug can possibly be used as an attack vector. I don't think it
+will take too much effort to come up with an attack which triggers oops
+somewhere. Most sleeps are wrapped in condition test loops and should
+be safe but we have quite a number of places where sleep and wakeup
+conditions are expected to be interlocked. Although the window of
+opportunity is tiny, ptrace can be used by non-privileged users and with
+some loading the window can definitely be extended and exploited.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Acked-by: Roland McGrath <roland@redhat.com>
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/ptrace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -313,7 +313,7 @@ int ptrace_detach(struct task_struct *ch
+ child->exit_code = data;
+ dead = __ptrace_detach(current, child);
+ if (!child->exit_state)
+- wake_up_process(child);
++ wake_up_state(child, TASK_TRACED | TASK_STOPPED);
+ }
+ write_unlock_irq(&tasklist_lock);
+
--- /dev/null
+From d0694e2aeb815042aa0f3e5036728b3db4446f1d Mon Sep 17 00:00:00 2001
+From: Pavel Machek <pavel@ucw.cz>
+Date: Sun, 9 Jan 2011 08:38:48 +0100
+Subject: serial: unbreak billionton CF card
+
+From: Pavel Machek <pavel@ucw.cz>
+
+commit d0694e2aeb815042aa0f3e5036728b3db4446f1d upstream.
+
+Unbreak Billionton CF bluetooth card. This actually fixes a regression
+on zaurus.
+
+Signed-off-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/serial/8250.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/serial/8250.c
++++ b/drivers/serial/8250.c
+@@ -241,7 +241,8 @@ static const struct serial8250_config ua
+ .fifo_size = 128,
+ .tx_loadsz = 128,
+ .fcr = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10,
+- .flags = UART_CAP_FIFO | UART_CAP_EFR | UART_CAP_SLEEP,
++ /* UART_CAP_EFR breaks billionon CF bluetooth card. */
++ .flags = UART_CAP_FIFO | UART_CAP_SLEEP,
+ },
+ [PORT_16654] = {
+ .name = "ST16654",
mm-fix-migration-hangs-on-anon_vma-lock.patch
ext4-fix-memory-leak-in-ext4_free_branches.patch
rapidio-fix-hang-on-rapidio-doorbell-queue-full-condition.patch
+sh-fix-up-legacy-ptea-space-attribute-mapping.patch
+pci-pci-stub-ignore-zero-length-id-parameters.patch
+virtio-remove-virtio-pci-root-device.patch
+jz4740-battery-protect-against-concurrent-battery-readings.patch
+ds2760_battery-fix-calculation-of-time_to_empty_now.patch
+avr32-use-syscall-prototypes-from-asm-generic-instead-of-arch.patch
+cpuidle-make-cpuidle_enable_device-call-poll_idle_init.patch
+p54-fix-sequence-no.-accounting-off-by-one-error.patch
+i2c-unregister-dummy-devices-last-on-adapter-removal.patch
+asoc-handle-low-measured-dc-offsets-for-wm_hubs-devices.patch
+asoc-wm8994-fix-wrong-value-in-tristate-function.patch
+asoc-create-an-aif1adcdat-signal-widget-to-match-aif2.patch
+virtio_net-add-schedule-check-to-napi_enable-call.patch
+virtio-console-wake-up-outvq-on-host-notifications.patch
+drivers-update-to-pl2303-usb-serial-to-support-motorola-cables.patch
+serial-unbreak-billionton-cf-card.patch
+ptrace-use-safer-wake-up-on-ptrace_detach.patch
+net-fix-ip-link-add-netns-oops.patch
+x86-mtrr-avoid-mtrr-reprogramming-on-bp-during-boot-on-up-platforms.patch
+fix-jiffy-calculations-in-calibrate_delay_direct-to-handle-overflow.patch
+ixgbe-fix-for-82599-erratum-on-header-splitting.patch
+fix-prlimit64-for-suid-sgid-processes.patch
+arm-initrd-disable-initrd-if-passed-address-overlaps-reserved-region.patch
+memcg-fix-account-leak-at-failure-of-memsw-acconting.patch
+mmc-bfin_sdh-fix-alloc-size-for-private-data.patch
--- /dev/null
+From efb3e34b6176d30c4fe8635fa8e1beb6280cc2cd Mon Sep 17 00:00:00 2001
+From: Paul Mundt <lethal@linux-sh.org>
+Date: Tue, 11 Jan 2011 15:02:59 +0900
+Subject: sh: Fix up legacy PTEA space attribute mapping.
+
+From: Paul Mundt <lethal@linux-sh.org>
+
+commit efb3e34b6176d30c4fe8635fa8e1beb6280cc2cd upstream.
+
+When p3_ioremap() was converted to ioremap_prot() there was some breakage
+introduced where the 29-bit segmentation logic would trap the area range
+and return an identity mapping without having allowed the area
+specification to force mapping through page tables. This wires up a PCC
+mask for pgprot verification to work out whether to short-circuit the
+identity mapping on legacy parts, restoring the previous behaviour.
+
+Reported-by: Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
+Signed-off-by: Paul Mundt <lethal@linux-sh.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sh/include/asm/io.h | 10 +++++++++-
+ arch/sh/include/asm/pgtable_32.h | 7 ++++++-
+ 2 files changed, 15 insertions(+), 2 deletions(-)
+
+--- a/arch/sh/include/asm/io.h
++++ b/arch/sh/include/asm/io.h
+@@ -322,7 +322,15 @@ __ioremap_29bit(phys_addr_t offset, unsi
+ * mapping must be done by the PMB or by using page tables.
+ */
+ if (likely(PXSEG(offset) < P3SEG && PXSEG(last_addr) < P3SEG)) {
+- if (unlikely(pgprot_val(prot) & _PAGE_CACHABLE))
++ u64 flags = pgprot_val(prot);
++
++ /*
++ * Anything using the legacy PTEA space attributes needs
++ * to be kicked down to page table mappings.
++ */
++ if (unlikely(flags & _PAGE_PCC_MASK))
++ return NULL;
++ if (unlikely(flags & _PAGE_CACHABLE))
+ return (void __iomem *)P1SEGADDR(offset);
+
+ return (void __iomem *)P2SEGADDR(offset);
+--- a/arch/sh/include/asm/pgtable_32.h
++++ b/arch/sh/include/asm/pgtable_32.h
+@@ -76,6 +76,10 @@
+ /* Wrapper for extended mode pgprot twiddling */
+ #define _PAGE_EXT(x) ((unsigned long long)(x) << 32)
+
++#ifdef CONFIG_X2TLB
++#define _PAGE_PCC_MASK 0x00000000 /* No legacy PTEA support */
++#else
++
+ /* software: moves to PTEA.TC (Timing Control) */
+ #define _PAGE_PCC_AREA5 0x00000000 /* use BSC registers for area5 */
+ #define _PAGE_PCC_AREA6 0x80000000 /* use BSC registers for area6 */
+@@ -89,7 +93,8 @@
+ #define _PAGE_PCC_ATR8 0x60000000 /* Attribute Memory space, 8 bit bus */
+ #define _PAGE_PCC_ATR16 0x60000001 /* Attribute Memory space, 6 bit bus */
+
+-#ifndef CONFIG_X2TLB
++#define _PAGE_PCC_MASK 0xe0000001
++
+ /* copy the ptea attributes */
+ static inline unsigned long copy_ptea_attributes(unsigned long x)
+ {
--- /dev/null
+From 2770c5ea501be69989a7acf54ec4cb3554c47191 Mon Sep 17 00:00:00 2001
+From: Amit Shah <amit.shah@redhat.com>
+Date: Mon, 31 Jan 2011 13:06:36 +0530
+Subject: virtio: console: Wake up outvq on host notifications
+
+From: Amit Shah <amit.shah@redhat.com>
+
+commit 2770c5ea501be69989a7acf54ec4cb3554c47191 upstream.
+
+The outvq needs to be woken up on host notifications so that buffers
+consumed by the host can be reclaimed, outvq freed, and application
+writes may proceed again.
+
+The need for this is now finally noticed when I have qemu patches ready
+to use nonblocking IO and flow control.
+
+CC: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Amit Shah <amit.shah@redhat.com>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Acked-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/virtio_console.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+--- a/drivers/char/virtio_console.c
++++ b/drivers/char/virtio_console.c
+@@ -1314,6 +1314,17 @@ static void control_work_handler(struct
+ spin_unlock(&portdev->cvq_lock);
+ }
+
++static void out_intr(struct virtqueue *vq)
++{
++ struct port *port;
++
++ port = find_port_by_vq(vq->vdev->priv, vq);
++ if (!port)
++ return;
++
++ wake_up_interruptible(&port->waitqueue);
++}
++
+ static void in_intr(struct virtqueue *vq)
+ {
+ struct port *port;
+@@ -1430,7 +1441,7 @@ static int init_vqs(struct ports_device
+ */
+ j = 0;
+ io_callbacks[j] = in_intr;
+- io_callbacks[j + 1] = NULL;
++ io_callbacks[j + 1] = out_intr;
+ io_names[j] = "input";
+ io_names[j + 1] = "output";
+ j += 2;
+@@ -1444,7 +1455,7 @@ static int init_vqs(struct ports_device
+ for (i = 1; i < nr_ports; i++) {
+ j += 2;
+ io_callbacks[j] = in_intr;
+- io_callbacks[j + 1] = NULL;
++ io_callbacks[j + 1] = out_intr;
+ io_names[j] = "input";
+ io_names[j + 1] = "output";
+ }
--- /dev/null
+From 8b3bb3ecf1934ac4a7005ad9017de1127e2fbd2f Mon Sep 17 00:00:00 2001
+From: Milton Miller <miltonm@bga.com>
+Date: Fri, 7 Jan 2011 02:55:06 -0600
+Subject: virtio: remove virtio-pci root device
+
+From: Milton Miller <miltonm@bga.com>
+
+commit 8b3bb3ecf1934ac4a7005ad9017de1127e2fbd2f upstream.
+
+We sometimes need to map between the virtio device and
+the given pci device. One such use is OS installer that
+gets the boot pci device from BIOS and needs to
+find the relevant block device. Since it can't,
+installation fails.
+
+Instead of creating a top-level devices/virtio-pci
+directory, create each device under the corresponding
+pci device node. Symlinks to all virtio-pci
+devices can be found under the pci driver link in
+bus/pci/drivers/virtio-pci/devices, and all virtio
+devices under drivers/bus/virtio/devices.
+
+Signed-off-by: Milton Miller <miltonm@bga.com>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Tested-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Gleb Natapov <gleb@redhat.com>
+Tested-by: "Daniel P. Berrange" <berrange@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/virtio/virtio_pci.c | 20 ++------------------
+ 1 file changed, 2 insertions(+), 18 deletions(-)
+
+--- a/drivers/virtio/virtio_pci.c
++++ b/drivers/virtio/virtio_pci.c
+@@ -96,11 +96,6 @@ static struct pci_device_id virtio_pci_i
+
+ MODULE_DEVICE_TABLE(pci, virtio_pci_id_table);
+
+-/* A PCI device has it's own struct device and so does a virtio device so
+- * we create a place for the virtio devices to show up in sysfs. I think it
+- * would make more sense for virtio to not insist on having it's own device. */
+-static struct device *virtio_pci_root;
+-
+ /* Convert a generic virtio device to our structure */
+ static struct virtio_pci_device *to_vp_device(struct virtio_device *vdev)
+ {
+@@ -629,7 +624,7 @@ static int __devinit virtio_pci_probe(st
+ if (vp_dev == NULL)
+ return -ENOMEM;
+
+- vp_dev->vdev.dev.parent = virtio_pci_root;
++ vp_dev->vdev.dev.parent = &pci_dev->dev;
+ vp_dev->vdev.dev.release = virtio_pci_release_dev;
+ vp_dev->vdev.config = &virtio_pci_config_ops;
+ vp_dev->pci_dev = pci_dev;
+@@ -717,17 +712,7 @@ static struct pci_driver virtio_pci_driv
+
+ static int __init virtio_pci_init(void)
+ {
+- int err;
+-
+- virtio_pci_root = root_device_register("virtio-pci");
+- if (IS_ERR(virtio_pci_root))
+- return PTR_ERR(virtio_pci_root);
+-
+- err = pci_register_driver(&virtio_pci_driver);
+- if (err)
+- root_device_unregister(virtio_pci_root);
+-
+- return err;
++ return pci_register_driver(&virtio_pci_driver);
+ }
+
+ module_init(virtio_pci_init);
+@@ -735,7 +720,6 @@ module_init(virtio_pci_init);
+ static void __exit virtio_pci_exit(void)
+ {
+ pci_unregister_driver(&virtio_pci_driver);
+- root_device_unregister(virtio_pci_root);
+ }
+
+ module_exit(virtio_pci_exit);
--- /dev/null
+From 3e9d08ec0a68f6faf718d5a7e050fe5ca0ba004f Mon Sep 17 00:00:00 2001
+From: Bruce Rogers <brogers@novell.com>
+Date: Thu, 10 Feb 2011 11:03:31 -0800
+Subject: virtio_net: Add schedule check to napi_enable call
+
+From: Bruce Rogers <brogers@novell.com>
+
+commit 3e9d08ec0a68f6faf718d5a7e050fe5ca0ba004f upstream.
+
+Under harsh testing conditions, including low memory, the guest would
+stop receiving packets. With this patch applied we no longer see any
+problems in the driver while performing these tests for extended periods
+of time.
+
+Make sure napi is scheduled subsequent to each napi_enable.
+
+Signed-off-by: Bruce Rogers <brogers@novell.com>
+Signed-off-by: Olaf Kirch <okir@suse.de>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/virtio_net.c | 27 ++++++++++++++++-----------
+ 1 file changed, 16 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -446,6 +446,20 @@ static void skb_recv_done(struct virtque
+ }
+ }
+
++static void virtnet_napi_enable(struct virtnet_info *vi)
++{
++ napi_enable(&vi->napi);
++
++ /* If all buffers were filled by other side before we napi_enabled, we
++ * won't get another interrupt, so process any outstanding packets
++ * now. virtnet_poll wants re-enable the queue, so we disable here.
++ * We synchronize against interrupts via NAPI_STATE_SCHED */
++ if (napi_schedule_prep(&vi->napi)) {
++ virtqueue_disable_cb(vi->rvq);
++ __napi_schedule(&vi->napi);
++ }
++}
++
+ static void refill_work(struct work_struct *work)
+ {
+ struct virtnet_info *vi;
+@@ -454,7 +468,7 @@ static void refill_work(struct work_stru
+ vi = container_of(work, struct virtnet_info, refill.work);
+ napi_disable(&vi->napi);
+ still_empty = !try_fill_recv(vi, GFP_KERNEL);
+- napi_enable(&vi->napi);
++ virtnet_napi_enable(vi);
+
+ /* In theory, this can happen: if we don't get any buffers in
+ * we will *never* try to fill again. */
+@@ -638,16 +652,7 @@ static int virtnet_open(struct net_devic
+ {
+ struct virtnet_info *vi = netdev_priv(dev);
+
+- napi_enable(&vi->napi);
+-
+- /* If all buffers were filled by other side before we napi_enabled, we
+- * won't get another interrupt, so process any outstanding packets
+- * now. virtnet_poll wants re-enable the queue, so we disable here.
+- * We synchronize against interrupts via NAPI_STATE_SCHED */
+- if (napi_schedule_prep(&vi->napi)) {
+- virtqueue_disable_cb(vi->rvq);
+- __napi_schedule(&vi->napi);
+- }
++ virtnet_napi_enable(vi);
+ return 0;
+ }
+
--- /dev/null
+From f7448548a9f32db38f243ccd4271617758ddfe2c Mon Sep 17 00:00:00 2001
+From: Suresh Siddha <suresh.b.siddha@intel.com>
+Date: Wed, 2 Feb 2011 17:02:55 -0800
+Subject: x86, mtrr: Avoid MTRR reprogramming on BP during boot on UP platforms
+
+From: Suresh Siddha <suresh.b.siddha@intel.com>
+
+commit f7448548a9f32db38f243ccd4271617758ddfe2c upstream.
+
+Markus Kohn ran into a hard hang regression on an acer aspire
+1310, when acpi is enabled. git bisect showed the following
+commit as the bad one that introduced the boot regression.
+
+ commit d0af9eed5aa91b6b7b5049cae69e5ea956fd85c3
+ Author: Suresh Siddha <suresh.b.siddha@intel.com>
+ Date: Wed Aug 19 18:05:36 2009 -0700
+
+ x86, pat/mtrr: Rendezvous all the cpus for MTRR/PAT init
+
+Because of the UP configuration of that platform,
+native_smp_prepare_cpus() bailed out (in smp_sanity_check())
+before doing the set_mtrr_aps_delayed_init()
+
+Further down the boot path, native_smp_cpus_done() will call the
+delayed MTRR initialization for the AP's (mtrr_aps_init()) with
+mtrr_aps_delayed_init not set. This resulted in the boot
+processor reprogramming its MTRR's to the values seen during the
+start of the OS boot. While this is not needed ideally, this
+shouldn't have caused any side-effects. This is because the
+reprogramming of MTRR's (set_mtrr_state() that gets called via
+set_mtrr()) will check if the live register contents are
+different from what is being asked to write and will do the actual
+write only if they are different.
+
+BP's mtrr state is read during the start of the OS boot and
+typically nothing would have changed when we ask to reprogram it
+on BP again because of the above scenario on an UP platform. So
+on a normal UP platform no reprogramming of BP MTRR MSR's
+happens and all is well.
+
+However, on this platform, bios seems to be modifying the fixed
+mtrr range registers between the start of OS boot and when we
+double check the live registers for reprogramming BP MTRR
+registers. And as the live registers are modified, we end up
+reprogramming the MTRR's to the state seen during the start of
+the OS boot.
+
+During ACPI initialization, something in the bios (probably smi
+handler?) don't like this fact and results in a hard lockup.
+
+We didn't see this boot hang issue on this platform before the
+commit d0af9eed5aa91b6b7b5049cae69e5ea956fd85c3, because only
+the AP's (if any) will program its MTRR's to the value that BP
+had at the start of the OS boot.
+
+Fix this issue by checking mtrr_aps_delayed_init before
+continuing further in the mtrr_aps_init(). Now, only AP's (if
+any) will program its MTRR's to the BP values during boot.
+
+Addresses https://bugzilla.novell.com/show_bug.cgi?id=623393
+
+ [ By the way, this behavior of the bios modifying MTRR's after the start
+ of the OS boot is not common and the kernel is not prepared to
+ handle this situation well. Irrespective of this issue, during
+ suspend/resume, linux kernel will try to reprogram the BP's MTRR values
+ to the values seen during the start of the OS boot. So suspend/resume might
+ be already broken on this platform for all linux kernel versions. ]
+
+Reported-and-bisected-by: Markus Kohn <jabber@gmx.org>
+Tested-by: Markus Kohn <jabber@gmx.org>
+Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
+Cc: Thomas Renninger <trenn@novell.com>
+Cc: Rafael Wysocki <rjw@novell.com>
+Cc: Venkatesh Pallipadi <venki@google.com>
+LKML-Reference: <1296694975.4418.402.camel@sbsiddha-MOBL3.sc.intel.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/mtrr/main.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/mtrr/main.c
++++ b/arch/x86/kernel/cpu/mtrr/main.c
+@@ -793,13 +793,21 @@ void set_mtrr_aps_delayed_init(void)
+ }
+
+ /*
+- * MTRR initialization for all AP's
++ * Delayed MTRR initialization for all AP's
+ */
+ void mtrr_aps_init(void)
+ {
+ if (!use_intel())
+ return;
+
++ /*
++ * Check if someone has requested the delay of AP MTRR initialization,
++ * by doing set_mtrr_aps_delayed_init(), prior to this point. If not,
++ * then we are done.
++ */
++ if (!mtrr_aps_delayed_init)
++ return;
++
+ set_mtrr(~0U, 0, 0, 0);
+ mtrr_aps_delayed_init = false;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
