--- /dev/null
+From a06f916b7a9b57447ceb875eb0a89f1a66b31bca Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Thu, 20 Oct 2011 22:04:18 +0100
+Subject: ARM: smp: fix clipping of number of CPUs
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit a06f916b7a9b57447ceb875eb0a89f1a66b31bca upstream.
+
+Rather than clipping the number of CPUs using the compile-time NR_CPUS
+constant, use the runtime nr_cpu_ids value instead. This allows the
+nr_cpus command line option to work as expected.
+
+Reported-by: Mark Salter <msalter@redhat.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/mach-exynos4/platsmp.c | 10 ++++------
+ arch/arm/mach-msm/platsmp.c | 6 ++++++
+ arch/arm/mach-omap2/omap-smp.c | 10 ++++------
+ arch/arm/mach-realview/platsmp.c | 10 ++++------
+ arch/arm/mach-shmobile/platsmp.c | 6 ++++++
+ arch/arm/mach-tegra/platsmp.c | 8 ++++----
+ arch/arm/mach-ux500/platsmp.c | 10 ++++------
+ arch/arm/mach-vexpress/ct-ca9x4.c | 6 ++++++
+ 8 files changed, 38 insertions(+), 28 deletions(-)
+
+--- a/arch/arm/mach-exynos4/platsmp.c
++++ b/arch/arm/mach-exynos4/platsmp.c
+@@ -193,12 +193,10 @@ void __init smp_init_cpus(void)
+ ncores = scu_base ? scu_get_core_count(scu_base) : 1;
+
+ /* sanity check */
+- if (ncores > NR_CPUS) {
+- printk(KERN_WARNING
+- "EXYNOS4: no. of cores (%d) greater than configured "
+- "maximum of %d - clipping\n",
+- ncores, NR_CPUS);
+- ncores = NR_CPUS;
++ if (ncores > nr_cpu_ids) {
++ pr_warn("SMP: %u cores greater than maximum (%u), clipping\n",
++ ncores, nr_cpu_ids);
++ ncores = nr_cpu_ids;
+ }
+
+ for (i = 0; i < ncores; i++)
+--- a/arch/arm/mach-msm/platsmp.c
++++ b/arch/arm/mach-msm/platsmp.c
+@@ -156,6 +156,12 @@ void __init smp_init_cpus(void)
+ {
+ unsigned int i, ncores = get_core_count();
+
++ if (ncores > nr_cpu_ids) {
++ pr_warn("SMP: %u cores greater than maximum (%u), clipping\n",
++ ncores, nr_cpu_ids);
++ ncores = nr_cpu_ids;
++ }
++
+ for (i = 0; i < ncores; i++)
+ set_cpu_possible(i, true);
+
+--- a/arch/arm/mach-omap2/omap-smp.c
++++ b/arch/arm/mach-omap2/omap-smp.c
+@@ -109,12 +109,10 @@ void __init smp_init_cpus(void)
+ ncores = scu_get_core_count(scu_base);
+
+ /* sanity check */
+- if (ncores > NR_CPUS) {
+- printk(KERN_WARNING
+- "OMAP4: no. of cores (%d) greater than configured "
+- "maximum of %d - clipping\n",
+- ncores, NR_CPUS);
+- ncores = NR_CPUS;
++ if (ncores > nr_cpu_ids) {
++ pr_warn("SMP: %u cores greater than maximum (%u), clipping\n",
++ ncores, nr_cpu_ids);
++ ncores = nr_cpu_ids;
+ }
+
+ for (i = 0; i < ncores; i++)
+--- a/arch/arm/mach-realview/platsmp.c
++++ b/arch/arm/mach-realview/platsmp.c
+@@ -52,12 +52,10 @@ void __init smp_init_cpus(void)
+ ncores = scu_base ? scu_get_core_count(scu_base) : 1;
+
+ /* sanity check */
+- if (ncores > NR_CPUS) {
+- printk(KERN_WARNING
+- "Realview: no. of cores (%d) greater than configured "
+- "maximum of %d - clipping\n",
+- ncores, NR_CPUS);
+- ncores = NR_CPUS;
++ if (ncores > nr_cpu_ids) {
++ pr_warn("SMP: %u cores greater than maximum (%u), clipping\n",
++ ncores, nr_cpu_ids);
++ ncores = nr_cpu_ids;
+ }
+
+ for (i = 0; i < ncores; i++)
+--- a/arch/arm/mach-shmobile/platsmp.c
++++ b/arch/arm/mach-shmobile/platsmp.c
+@@ -56,6 +56,12 @@ void __init smp_init_cpus(void)
+ unsigned int ncores = shmobile_smp_get_core_count();
+ unsigned int i;
+
++ if (ncores > nr_cpu_ids) {
++ pr_warn("SMP: %u cores greater than maximum (%u), clipping\n",
++ ncores, nr_cpu_ids);
++ ncores = nr_cpu_ids;
++ }
++
+ for (i = 0; i < ncores; i++)
+ set_cpu_possible(i, true);
+
+--- a/arch/arm/mach-tegra/platsmp.c
++++ b/arch/arm/mach-tegra/platsmp.c
+@@ -114,10 +114,10 @@ void __init smp_init_cpus(void)
+ {
+ unsigned int i, ncores = scu_get_core_count(scu_base);
+
+- if (ncores > NR_CPUS) {
+- printk(KERN_ERR "Tegra: no. of cores (%u) greater than configured (%u), clipping\n",
+- ncores, NR_CPUS);
+- ncores = NR_CPUS;
++ if (ncores > nr_cpu_ids) {
++ pr_warn("SMP: %u cores greater than maximum (%u), clipping\n",
++ ncores, nr_cpu_ids);
++ ncores = nr_cpu_ids;
+ }
+
+ for (i = 0; i < ncores; i++)
+--- a/arch/arm/mach-ux500/platsmp.c
++++ b/arch/arm/mach-ux500/platsmp.c
+@@ -156,12 +156,10 @@ void __init smp_init_cpus(void)
+ ncores = scu_base ? scu_get_core_count(scu_base) : 1;
+
+ /* sanity check */
+- if (ncores > NR_CPUS) {
+- printk(KERN_WARNING
+- "U8500: no. of cores (%d) greater than configured "
+- "maximum of %d - clipping\n",
+- ncores, NR_CPUS);
+- ncores = NR_CPUS;
++ if (ncores > nr_cpu_ids) {
++ pr_warn("SMP: %u cores greater than maximum (%u), clipping\n",
++ ncores, nr_cpu_ids);
++ ncores = nr_cpu_ids;
+ }
+
+ for (i = 0; i < ncores; i++)
+--- a/arch/arm/mach-vexpress/ct-ca9x4.c
++++ b/arch/arm/mach-vexpress/ct-ca9x4.c
+@@ -221,6 +221,12 @@ static void ct_ca9x4_init_cpu_map(void)
+ {
+ int i, ncores = scu_get_core_count(MMIO_P2V(A9_MPCORE_SCU));
+
++ if (ncores > nr_cpu_ids) {
++ pr_warn("SMP: %u cores greater than maximum (%u), clipping\n",
++ ncores, nr_cpu_ids);
++ ncores = nr_cpu_ids;
++ }
++
+ for (i = 0; i < ncores; ++i)
+ set_cpu_possible(i, true);
+
--- /dev/null
+From 08613e4626c06ca408fc55071f6aedee36986a87 Mon Sep 17 00:00:00 2001
+From: David Woodhouse <dwmw2@infradead.org>
+Date: Mon, 24 Oct 2011 21:25:21 +0000
+Subject: caif: Fix BUG() with network namespaces
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David Woodhouse <dwmw2@infradead.org>
+
+commit 08613e4626c06ca408fc55071f6aedee36986a87 upstream.
+
+The caif code will register its own pernet_operations, and then register
+a netdevice_notifier. Each time the netdevice_notifier is triggered,
+it'll do some stuff... including a lookup of its own pernet stuff with
+net_generic().
+
+If the net_generic() call ever returns NULL, the caif code will BUG().
+That doesn't seem *so* unreasonable, I suppose — it does seem like it
+should never happen.
+
+However, it *does* happen. When we clone a network namespace,
+setup_net() runs through all the pernet_operations one at a time. It
+gets to loopback before it gets to caif. And loopback_net_init()
+registers a netdevice... while caif hasn't been initialised. So the caif
+netdevice notifier triggers, and immediately goes BUG().
+
+We could imagine a complex and overengineered solution to this generic
+class of problems, but this patch takes the simple approach. It just
+makes caif_device_notify() *not* go looking for its pernet data
+structures if the device it's being notified about isn't a caif device
+in the first place.
+
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Acked-by: Sjur Brændeland <sjur.brandeland@stericsson.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/caif/caif_dev.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/caif/caif_dev.c
++++ b/net/caif/caif_dev.c
+@@ -212,8 +212,7 @@ static int caif_device_notify(struct not
+ enum cfcnfg_phy_preference pref;
+ enum cfcnfg_phy_type phy_type;
+ struct cfcnfg *cfg;
+- struct caif_device_entry_list *caifdevs =
+- caif_device_list(dev_net(dev));
++ struct caif_device_entry_list *caifdevs;
+
+ if (dev->type != ARPHRD_CAIF)
+ return 0;
+@@ -222,6 +221,8 @@ static int caif_device_notify(struct not
+ if (cfg == NULL)
+ return 0;
+
++ caifdevs = caif_device_list(dev_net(dev));
++
+ switch (what) {
+ case NETDEV_REGISTER:
+ caifd = caif_device_alloc(dev);
--- /dev/null
+From 364b936fc38dec7653c690d710e10657af235a36 Mon Sep 17 00:00:00 2001
+From: Sergei Kolzun <x0r@dv-life.ru>
+Date: Thu, 4 Aug 2011 00:25:56 -0700
+Subject: HID: ACRUX - fix enabling force feedback support
+
+From: Sergei Kolzun <x0r@dv-life.ru>
+
+commit 364b936fc38dec7653c690d710e10657af235a36 upstream.
+
+The config option needs to be a 'bool' and not a tristate, otheriwse
+force feedback support never makes it into the module.
+
+Signed-off-by: Sergei Kolzun <x0r@dv-life.ru>
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hid/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hid/Kconfig
++++ b/drivers/hid/Kconfig
+@@ -69,7 +69,7 @@ config HID_ACRUX
+ Say Y here if you want to enable support for ACRUX game controllers.
+
+ config HID_ACRUX_FF
+- tristate "ACRUX force feedback support"
++ bool "ACRUX force feedback support"
+ depends on HID_ACRUX
+ select INPUT_FF_MEMLESS
+ ---help---
--- /dev/null
+From 37252db6aa576c34fd794a5a54fb32d7a8b3a07a Mon Sep 17 00:00:00 2001
+From: Jiri Kosina <jkosina@suse.cz>
+Date: Wed, 26 Oct 2011 13:10:39 +1030
+Subject: kmod: prevent kmod_loop_msg overflow in __request_module()
+
+From: Jiri Kosina <jkosina@suse.cz>
+
+commit 37252db6aa576c34fd794a5a54fb32d7a8b3a07a upstream.
+
+Due to post-increment in condition of kmod_loop_msg in __request_module(),
+the system log can be spammed by much more than 5 instances of the 'runaway
+loop' message if the number of events triggering it makes the kmod_loop_msg
+to overflow.
+
+Fix that by making sure we never increment it past the threshold.
+
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/kmod.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/kernel/kmod.c
++++ b/kernel/kmod.c
+@@ -114,10 +114,12 @@ int __request_module(bool wait, const ch
+ atomic_inc(&kmod_concurrent);
+ if (atomic_read(&kmod_concurrent) > max_modprobes) {
+ /* We may be blaming an innocent here, but unlikely */
+- if (kmod_loop_msg++ < 5)
++ if (kmod_loop_msg < 5) {
+ printk(KERN_ERR
+ "request_module: runaway loop modprobe %s\n",
+ module_name);
++ kmod_loop_msg++;
++ }
+ atomic_dec(&kmod_concurrent);
+ return -ENOMEM;
+ }
--- /dev/null
+From ebf4127cd677e9781b450e44dfaaa1cc595efcaa Mon Sep 17 00:00:00 2001
+From: Milan Broz <mbroz@redhat.com>
+Date: Mon, 22 Aug 2011 15:51:34 +0200
+Subject: kobj_uevent: Ignore if some listeners cannot handle message
+
+From: Milan Broz <mbroz@redhat.com>
+
+commit ebf4127cd677e9781b450e44dfaaa1cc595efcaa upstream.
+
+kobject_uevent() uses a multicast socket and should ignore
+if one of listeners cannot handle messages or nobody is
+listening at all.
+
+Easily reproducible when a process in system is cloned
+with CLONE_NEWNET flag.
+
+(See also http://article.gmane.org/gmane.linux.kernel.device-mapper.dm-crypt/5256)
+
+Signed-off-by: Milan Broz <mbroz@redhat.com>
+Acked-by: Kay Sievers <kay.sievers@vrfy.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ lib/kobject_uevent.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/lib/kobject_uevent.c
++++ b/lib/kobject_uevent.c
+@@ -282,7 +282,7 @@ int kobject_uevent_env(struct kobject *k
+ kobj_bcast_filter,
+ kobj);
+ /* ENOBUFS should be handled in userspace */
+- if (retval == -ENOBUFS)
++ if (retval == -ENOBUFS || retval == -ESRCH)
+ retval = 0;
+ } else
+ retval = -ENOMEM;
--- /dev/null
+From 3236c3e1adc0c7ec83eaff1de2d06746b7c5bb28 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@redhat.com>
+Date: Tue, 11 Oct 2011 09:49:21 -0400
+Subject: nfs: don't redirty inode when ncommit == 0 in
+ nfs_commit_unstable_pages
+
+From: Jeff Layton <jlayton@redhat.com>
+
+commit 3236c3e1adc0c7ec83eaff1de2d06746b7c5bb28 upstream.
+
+commit 420e3646 allowed the kernel to reduce the number of unnecessary
+commit calls by skipping the commit when there are a large number of
+outstanding pages.
+
+However, the current test in nfs_commit_unstable_pages does not handle
+the edge condition properly. When ncommit == 0, then that means that the
+kernel doesn't need to do anything more for the inode. The current test
+though in the WB_SYNC_NONE case will return true, and the inode will end
+up being marked dirty. Once that happens the inode will never be clean
+until there's a WB_SYNC_ALL flush.
+
+Fix this by immediately returning from nfs_commit_unstable_pages when
+ncommit == 0.
+
+Mike noticed this problem initially in RHEL5 (2.6.18-based kernel) which
+has a backported version of 420e3646. The inode cache there was growing
+very large. The inode cache was unable to be shrunk since the inodes
+were all marked dirty. Calling sync() would essentially "fix" the
+problem -- the WB_SYNC_ALL flush would result in the inodes all being
+marked clean.
+
+What I'm not clear on is how big a problem this is in mainline kernels
+as the writeback code there is very different. Either way, it seems
+incorrect to re-mark the inode dirty in this case.
+
+Reported-by: Mike McLean <mikem@redhat.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/write.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -1577,6 +1577,10 @@ static int nfs_commit_unstable_pages(str
+ int flags = FLUSH_SYNC;
+ int ret = 0;
+
++ /* no commits means nothing needs to be done */
++ if (!nfsi->ncommit)
++ return ret;
++
+ if (wbc->sync_mode == WB_SYNC_NONE) {
+ /* Don't commit yet if this is a non-blocking flush and there
+ * are a lot of outstanding writes for this mapping.
--- /dev/null
+From a7ea19926ffba86f373f6050a106cd162dbb9a78 Mon Sep 17 00:00:00 2001
+From: David Herrmann <dh.herrmann@googlemail.com>
+Date: Tue, 20 Sep 2011 09:16:12 -0700
+Subject: Platform: Fix error path in samsung-laptop init
+
+From: David Herrmann <dh.herrmann@googlemail.com>
+
+commit a7ea19926ffba86f373f6050a106cd162dbb9a78 upstream.
+
+samsung_init() should not return success if not all devices are initialized.
+Otherwise, samsung_exit() will dereference sdev NULL pointers and others.
+
+Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Matthew Garrett <mjg@redhat.com>
+
+---
+ drivers/platform/x86/samsung-laptop.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/platform/x86/samsung-laptop.c
++++ b/drivers/platform/x86/samsung-laptop.c
+@@ -799,7 +799,7 @@ static int __init samsung_init(void)
+ sabi_iface = ioremap_nocache(ifaceP, 16);
+ if (!sabi_iface) {
+ pr_err("Can't remap %x\n", ifaceP);
+- goto exit;
++ goto error_no_signature;
+ }
+ if (debug) {
+ printk(KERN_DEBUG "ifaceP = 0x%08x\n", ifaceP);
+@@ -851,7 +851,6 @@ static int __init samsung_init(void)
+ if (retval)
+ goto error_file_create;
+
+-exit:
+ return 0;
+
+ error_file_create:
--- /dev/null
+From f87d02996f05ec1789ceecce9ec839f629b7aa80 Mon Sep 17 00:00:00 2001
+From: Stefan Beller <stefanbeller@googlemail.com>
+Date: Tue, 20 Sep 2011 09:16:08 -0700
+Subject: platform: samsung_laptop: add dmi information for Samsung
+ R700 laptops
+
+From: Stefan Beller <stefanbeller@googlemail.com>
+
+commit f87d02996f05ec1789ceecce9ec839f629b7aa80 upstream.
+
+My DMI model is this:
+>dmesg |grep DMI
+[ 0.000000] DMI present.
+[ 0.000000] DMI: SAMSUNG ELECTRONICS CO., LTD. SR700/SR700, BIOS
+04SR 02/20/2008
+
+adding dmi information of Samsung R700 laptops
+This adds the dmi information of Samsungs R700 laptops.
+
+Signed-off-by: Stefan Beller <stefanbeller@googlemail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Matthew Garrett <mjg@redhat.com>
+
+---
+ drivers/platform/x86/samsung-laptop.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/platform/x86/samsung-laptop.c
++++ b/drivers/platform/x86/samsung-laptop.c
+@@ -641,6 +641,15 @@ static struct dmi_system_id __initdata s
+ .callback = dmi_check_cb,
+ },
+ {
++ .ident = "R700",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "SR700"),
++ DMI_MATCH(DMI_BOARD_NAME, "SR700"),
++ },
++ .callback = dmi_check_cb,
++ },
++ {
+ .ident = "R530/R730",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
--- /dev/null
+From 7500eeb08a179e61a4219288c21407d63d1e9c64 Mon Sep 17 00:00:00 2001
+From: Tommaso Massimi <tmassimi@gmail.com>
+Date: Tue, 20 Sep 2011 09:16:09 -0700
+Subject: Platform: samsung_laptop: add support for X520 machines.
+
+From: Tommaso Massimi <tmassimi@gmail.com>
+
+commit 7500eeb08a179e61a4219288c21407d63d1e9c64 upstream.
+
+my samsung laptop would be very happy if you add
+these lines to the file drivers/platform/x86/samsung-laptop.c
+
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Matthew Garrett <mjg@redhat.com>
+
+---
+ drivers/platform/x86/samsung-laptop.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/platform/x86/samsung-laptop.c
++++ b/drivers/platform/x86/samsung-laptop.c
+@@ -695,6 +695,15 @@ static struct dmi_system_id __initdata s
+ },
+ .callback = dmi_check_cb,
+ },
++ {
++ .ident = "X520",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "X520"),
++ DMI_MATCH(DMI_BOARD_NAME, "X520"),
++ },
++ .callback = dmi_check_cb,
++ },
+ { },
+ };
+ MODULE_DEVICE_TABLE(dmi, samsung_dmi_table);
--- /dev/null
+From bee460be8c691c544e84ed678280ace6153104c6 Mon Sep 17 00:00:00 2001
+From: Jason Stubbs <jasonbstubbs@gmail.com>
+Date: Tue, 20 Sep 2011 09:16:11 -0700
+Subject: platform: samsung_laptop: fix samsung brightness min/max
+ calculations
+
+From: Jason Stubbs <jasonbstubbs@gmail.com>
+
+commit bee460be8c691c544e84ed678280ace6153104c6 upstream.
+
+The min_brightness value of the sabi_config is incorrectly used in brightness
+calculations. For the config where min_brightness = 1 and max_brightness = 8,
+the user visible range should be 0 to 7 with hardware being set in the range
+of 1 to 8. What is actually happening is that the user visible range is 0 to
+8 with hardware being set in the range of -1 to 7.
+
+This patch fixes the above issue as well as a miscalculation that would occur
+in the case of min_brightness > 1.
+
+Signed-off-by: Jason Stubbs <jasonbstubbs@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Matthew Garrett <mjg@redhat.com>
+
+---
+ drivers/platform/x86/samsung-laptop.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/platform/x86/samsung-laptop.c
++++ b/drivers/platform/x86/samsung-laptop.c
+@@ -370,15 +370,17 @@ static u8 read_brightness(void)
+ &sretval);
+ if (!retval) {
+ user_brightness = sretval.retval[0];
+- if (user_brightness != 0)
++ if (user_brightness > sabi_config->min_brightness)
+ user_brightness -= sabi_config->min_brightness;
++ else
++ user_brightness = 0;
+ }
+ return user_brightness;
+ }
+
+ static void set_brightness(u8 user_brightness)
+ {
+- u8 user_level = user_brightness - sabi_config->min_brightness;
++ u8 user_level = user_brightness + sabi_config->min_brightness;
+
+ sabi_set_command(sabi_config->commands.set_brightness, user_level);
+ }
+@@ -829,7 +831,8 @@ static int __init samsung_init(void)
+ /* create a backlight device to talk to this one */
+ memset(&props, 0, sizeof(struct backlight_properties));
+ props.type = BACKLIGHT_PLATFORM;
+- props.max_brightness = sabi_config->max_brightness;
++ props.max_brightness = sabi_config->max_brightness -
++ sabi_config->min_brightness;
+ backlight_device = backlight_device_register("samsung", &sdev->dev,
+ NULL, &backlight_ops,
+ &props);
--- /dev/null
+From 093ed561648d43263c009ea88abab21a31cd4f1d Mon Sep 17 00:00:00 2001
+From: Smelov Andrey <xor29a@bk.ru>
+Date: Tue, 20 Sep 2011 09:16:10 -0700
+Subject: Platform: samsung_laptop: samsung backlight for R528/R728
+
+From: Smelov Andrey <xor29a@bk.ru>
+
+commit 093ed561648d43263c009ea88abab21a31cd4f1d upstream.
+
+patch works for me, but I need to add "acpi_backlight=vendor" to kernel
+params
+
+Signed-off-by: Smelov Andrey <xor29a@bk.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Matthew Garrett <mjg@redhat.com>
+
+---
+ drivers/platform/x86/samsung-laptop.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/platform/x86/samsung-laptop.c
++++ b/drivers/platform/x86/samsung-laptop.c
+@@ -704,6 +704,15 @@ static struct dmi_system_id __initdata s
+ },
+ .callback = dmi_check_cb,
+ },
++ {
++ .ident = "R528/R728",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "R528/R728"),
++ DMI_MATCH(DMI_BOARD_NAME, "R528/R728"),
++ },
++ .callback = dmi_check_cb,
++ },
+ { },
+ };
+ MODULE_DEVICE_TABLE(dmi, samsung_dmi_table);
--- /dev/null
+From 1b0ae068779874f54b55aac3a2a992bcf3f2c3c4 Mon Sep 17 00:00:00 2001
+From: Peng Tao <bergwolf@gmail.com>
+Date: Thu, 22 Sep 2011 21:50:12 -0400
+Subject: pnfs: make _set_lo_fail generic
+
+From: Peng Tao <bergwolf@gmail.com>
+
+commit 1b0ae068779874f54b55aac3a2a992bcf3f2c3c4 upstream.
+
+file layout and block layout both use it to set mark layout io failure
+bit. So make it generic.
+
+Signed-off-by: Peng Tao <peng_tao@emc.com>
+Signed-off-by: Jim Rees <rees@umich.edu>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/blocklayout/blocklayout.c | 17 +++--------------
+ fs/nfs/nfs4filelayout.c | 19 +++----------------
+ fs/nfs/pnfs.c | 12 ++++++++++++
+ fs/nfs/pnfs.h | 1 +
+ 4 files changed, 19 insertions(+), 30 deletions(-)
+
+--- a/fs/nfs/blocklayout/blocklayout.c
++++ b/fs/nfs/blocklayout/blocklayout.c
+@@ -176,17 +176,6 @@ retry:
+ return bio;
+ }
+
+-static void bl_set_lo_fail(struct pnfs_layout_segment *lseg)
+-{
+- if (lseg->pls_range.iomode == IOMODE_RW) {
+- dprintk("%s Setting layout IOMODE_RW fail bit\n", __func__);
+- set_bit(lo_fail_bit(IOMODE_RW), &lseg->pls_layout->plh_flags);
+- } else {
+- dprintk("%s Setting layout IOMODE_READ fail bit\n", __func__);
+- set_bit(lo_fail_bit(IOMODE_READ), &lseg->pls_layout->plh_flags);
+- }
+-}
+-
+ /* This is basically copied from mpage_end_io_read */
+ static void bl_end_io_read(struct bio *bio, int err)
+ {
+@@ -206,7 +195,7 @@ static void bl_end_io_read(struct bio *b
+ if (!uptodate) {
+ if (!rdata->pnfs_error)
+ rdata->pnfs_error = -EIO;
+- bl_set_lo_fail(rdata->lseg);
++ pnfs_set_lo_fail(rdata->lseg);
+ }
+ bio_put(bio);
+ put_parallel(par);
+@@ -370,7 +359,7 @@ static void bl_end_io_write_zero(struct
+ if (!uptodate) {
+ if (!wdata->pnfs_error)
+ wdata->pnfs_error = -EIO;
+- bl_set_lo_fail(wdata->lseg);
++ pnfs_set_lo_fail(wdata->lseg);
+ }
+ bio_put(bio);
+ put_parallel(par);
+@@ -386,7 +375,7 @@ static void bl_end_io_write(struct bio *
+ if (!uptodate) {
+ if (!wdata->pnfs_error)
+ wdata->pnfs_error = -EIO;
+- bl_set_lo_fail(wdata->lseg);
++ pnfs_set_lo_fail(wdata->lseg);
+ }
+ bio_put(bio);
+ put_parallel(par);
+--- a/fs/nfs/nfs4filelayout.c
++++ b/fs/nfs/nfs4filelayout.c
+@@ -77,19 +77,6 @@ filelayout_get_dserver_offset(struct pnf
+ BUG();
+ }
+
+-/* For data server errors we don't recover from */
+-static void
+-filelayout_set_lo_fail(struct pnfs_layout_segment *lseg)
+-{
+- if (lseg->pls_range.iomode == IOMODE_RW) {
+- dprintk("%s Setting layout IOMODE_RW fail bit\n", __func__);
+- set_bit(lo_fail_bit(IOMODE_RW), &lseg->pls_layout->plh_flags);
+- } else {
+- dprintk("%s Setting layout IOMODE_READ fail bit\n", __func__);
+- set_bit(lo_fail_bit(IOMODE_READ), &lseg->pls_layout->plh_flags);
+- }
+-}
+-
+ static int filelayout_async_handle_error(struct rpc_task *task,
+ struct nfs4_state *state,
+ struct nfs_client *clp,
+@@ -145,7 +132,7 @@ static int filelayout_read_done_cb(struc
+ dprintk("%s calling restart ds_clp %p ds_clp->cl_session %p\n",
+ __func__, data->ds_clp, data->ds_clp->cl_session);
+ if (reset) {
+- filelayout_set_lo_fail(data->lseg);
++ pnfs_set_lo_fail(data->lseg);
+ nfs4_reset_read(task, data);
+ clp = NFS_SERVER(data->inode)->nfs_client;
+ }
+@@ -221,7 +208,7 @@ static int filelayout_write_done_cb(stru
+ dprintk("%s calling restart ds_clp %p ds_clp->cl_session %p\n",
+ __func__, data->ds_clp, data->ds_clp->cl_session);
+ if (reset) {
+- filelayout_set_lo_fail(data->lseg);
++ pnfs_set_lo_fail(data->lseg);
+ nfs4_reset_write(task, data);
+ clp = NFS_SERVER(data->inode)->nfs_client;
+ } else
+@@ -256,7 +243,7 @@ static int filelayout_commit_done_cb(str
+ __func__, data->ds_clp, data->ds_clp->cl_session);
+ if (reset) {
+ prepare_to_resend_writes(data);
+- filelayout_set_lo_fail(data->lseg);
++ pnfs_set_lo_fail(data->lseg);
+ } else
+ nfs_restart_rpc(task, data->ds_clp);
+ return -EAGAIN;
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -1381,6 +1381,18 @@ static void pnfs_list_write_lseg(struct
+ }
+ }
+
++void pnfs_set_lo_fail(struct pnfs_layout_segment *lseg)
++{
++ if (lseg->pls_range.iomode == IOMODE_RW) {
++ dprintk("%s Setting layout IOMODE_RW fail bit\n", __func__);
++ set_bit(lo_fail_bit(IOMODE_RW), &lseg->pls_layout->plh_flags);
++ } else {
++ dprintk("%s Setting layout IOMODE_READ fail bit\n", __func__);
++ set_bit(lo_fail_bit(IOMODE_READ), &lseg->pls_layout->plh_flags);
++ }
++}
++EXPORT_SYMBOL_GPL(pnfs_set_lo_fail);
++
+ void
+ pnfs_set_layoutcommit(struct nfs_write_data *wdata)
+ {
+--- a/fs/nfs/pnfs.h
++++ b/fs/nfs/pnfs.h
+@@ -178,6 +178,7 @@ int pnfs_generic_pg_readpages(struct nfs
+ void pnfs_generic_pg_init_write(struct nfs_pageio_descriptor *, struct nfs_page *);
+ int pnfs_generic_pg_writepages(struct nfs_pageio_descriptor *desc);
+ bool pnfs_generic_pg_test(struct nfs_pageio_descriptor *pgio, struct nfs_page *prev, struct nfs_page *req);
++void pnfs_set_lo_fail(struct pnfs_layout_segment *lseg);
+ int pnfs_layout_process(struct nfs4_layoutget *lgp);
+ void pnfs_free_lseg_list(struct list_head *tmp_list);
+ void pnfs_destroy_layout(struct nfs_inode *);
--- /dev/null
+From 9b7eecdcfeb943f130d86bbc249fde4994b6fe30 Mon Sep 17 00:00:00 2001
+From: Peng Tao <bergwolf@gmail.com>
+Date: Thu, 22 Sep 2011 21:50:15 -0400
+Subject: pnfs: recoalesce when ld read pagelist fails
+
+From: Peng Tao <bergwolf@gmail.com>
+
+commit 9b7eecdcfeb943f130d86bbc249fde4994b6fe30 upstream.
+
+For pnfs pagelist read failure, we need to pg_recoalesce and resend IO to
+mds.
+
+Signed-off-by: Peng Tao <peng_tao@emc.com>
+Signed-off-by: Jim Rees <rees@umich.edu>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/pnfs.c | 20 +++++++-------------
+ fs/nfs/pnfs.h | 2 +-
+ fs/nfs/read.c | 12 +++++++++++-
+ 3 files changed, 19 insertions(+), 15 deletions(-)
+
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -1262,23 +1262,17 @@ EXPORT_SYMBOL_GPL(pnfs_generic_pg_writep
+ /*
+ * Called by non rpc-based layout drivers
+ */
+-int
+-pnfs_ld_read_done(struct nfs_read_data *data)
++void pnfs_ld_read_done(struct nfs_read_data *data)
+ {
+- int status;
+-
+- if (!data->pnfs_error) {
++ if (likely(!data->pnfs_error)) {
+ __nfs4_read_done_cb(data);
+ data->mds_ops->rpc_call_done(&data->task, data);
+- data->mds_ops->rpc_release(data);
+- return 0;
++ } else {
++ put_lseg(data->lseg);
++ data->lseg = NULL;
++ dprintk("pnfs write error = %d\n", data->pnfs_error);
+ }
+-
+- dprintk("%s: pnfs_error=%d, retry via MDS\n", __func__,
+- data->pnfs_error);
+- status = nfs_initiate_read(data, NFS_CLIENT(data->inode),
+- data->mds_ops);
+- return status ? : -EAGAIN;
++ data->mds_ops->rpc_release(data);
+ }
+ EXPORT_SYMBOL_GPL(pnfs_ld_read_done);
+
+--- a/fs/nfs/pnfs.h
++++ b/fs/nfs/pnfs.h
+@@ -202,7 +202,7 @@ void pnfs_cleanup_layoutcommit(struct nf
+ int pnfs_layoutcommit_inode(struct inode *inode, bool sync);
+ int _pnfs_return_layout(struct inode *);
+ void pnfs_ld_write_done(struct nfs_write_data *);
+-int pnfs_ld_read_done(struct nfs_read_data *);
++void pnfs_ld_read_done(struct nfs_read_data *);
+ struct pnfs_layout_segment *pnfs_update_layout(struct inode *ino,
+ struct nfs_open_context *ctx,
+ loff_t pos,
+--- a/fs/nfs/read.c
++++ b/fs/nfs/read.c
+@@ -541,13 +541,23 @@ static void nfs_readpage_result_full(str
+ static void nfs_readpage_release_full(void *calldata)
+ {
+ struct nfs_read_data *data = calldata;
++ struct nfs_pageio_descriptor pgio;
+
++ if (data->pnfs_error) {
++ nfs_pageio_init_read_mds(&pgio, data->inode);
++ pgio.pg_recoalesce = 1;
++ }
+ while (!list_empty(&data->pages)) {
+ struct nfs_page *req = nfs_list_entry(data->pages.next);
+
+ nfs_list_remove_request(req);
+- nfs_readpage_release(req);
++ if (!data->pnfs_error)
++ nfs_readpage_release(req);
++ else
++ nfs_pageio_add_request(&pgio, req);
+ }
++ if (data->pnfs_error)
++ nfs_pageio_complete(&pgio);
+ nfs_readdata_release(calldata);
+ }
+
--- /dev/null
+From 8ce160c5ef06cc89c2b6b26bfa5ef7a5ce2c93e0 Mon Sep 17 00:00:00 2001
+From: Peng Tao <bergwolf@gmail.com>
+Date: Thu, 22 Sep 2011 21:50:14 -0400
+Subject: pnfs: recoalesce when ld write pagelist fails
+
+From: Peng Tao <bergwolf@gmail.com>
+
+commit 8ce160c5ef06cc89c2b6b26bfa5ef7a5ce2c93e0 upstream.
+
+For pnfs pagelist write failure, we need to pg_recoalesce and resend IO to
+mds.
+
+Signed-off-by: Peng Tao <peng_tao@emc.com>
+Signed-off-by: Jim Rees <rees@umich.edu>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/pnfs.c | 20 +++++++-------------
+ fs/nfs/pnfs.h | 2 +-
+ fs/nfs/write.c | 25 ++++++++++++++++++++++++-
+ 3 files changed, 32 insertions(+), 15 deletions(-)
+
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -1168,23 +1168,17 @@ EXPORT_SYMBOL_GPL(pnfs_generic_pg_test);
+ /*
+ * Called by non rpc-based layout drivers
+ */
+-int
+-pnfs_ld_write_done(struct nfs_write_data *data)
++void pnfs_ld_write_done(struct nfs_write_data *data)
+ {
+- int status;
+-
+- if (!data->pnfs_error) {
++ if (likely(!data->pnfs_error)) {
+ pnfs_set_layoutcommit(data);
+ data->mds_ops->rpc_call_done(&data->task, data);
+- data->mds_ops->rpc_release(data);
+- return 0;
++ } else {
++ put_lseg(data->lseg);
++ data->lseg = NULL;
++ dprintk("pnfs write error = %d\n", data->pnfs_error);
+ }
+-
+- dprintk("%s: pnfs_error=%d, retry via MDS\n", __func__,
+- data->pnfs_error);
+- status = nfs_initiate_write(data, NFS_CLIENT(data->inode),
+- data->mds_ops, NFS_FILE_SYNC);
+- return status ? : -EAGAIN;
++ data->mds_ops->rpc_release(data);
+ }
+ EXPORT_SYMBOL_GPL(pnfs_ld_write_done);
+
+--- a/fs/nfs/pnfs.h
++++ b/fs/nfs/pnfs.h
+@@ -201,7 +201,7 @@ void pnfs_set_layoutcommit(struct nfs_wr
+ void pnfs_cleanup_layoutcommit(struct nfs4_layoutcommit_data *data);
+ int pnfs_layoutcommit_inode(struct inode *inode, bool sync);
+ int _pnfs_return_layout(struct inode *);
+-int pnfs_ld_write_done(struct nfs_write_data *);
++void pnfs_ld_write_done(struct nfs_write_data *);
+ int pnfs_ld_read_done(struct nfs_read_data *);
+ struct pnfs_layout_segment *pnfs_update_layout(struct inode *ino,
+ struct nfs_open_context *ctx,
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -1165,7 +1165,13 @@ static void nfs_writeback_done_full(stru
+ static void nfs_writeback_release_full(void *calldata)
+ {
+ struct nfs_write_data *data = calldata;
+- int status = data->task.tk_status;
++ int ret, status = data->task.tk_status;
++ struct nfs_pageio_descriptor pgio;
++
++ if (data->pnfs_error) {
++ nfs_pageio_init_write_mds(&pgio, data->inode, FLUSH_STABLE);
++ pgio.pg_recoalesce = 1;
++ }
+
+ /* Update attributes as result of writeback. */
+ while (!list_empty(&data->pages)) {
+@@ -1181,6 +1187,11 @@ static void nfs_writeback_release_full(v
+ req->wb_bytes,
+ (long long)req_offset(req));
+
++ if (data->pnfs_error) {
++ dprintk(", pnfs error = %d\n", data->pnfs_error);
++ goto next;
++ }
++
+ if (status < 0) {
+ nfs_set_pageerror(page);
+ nfs_context_set_write_error(req->wb_context, status);
+@@ -1200,7 +1211,19 @@ remove_request:
+ next:
+ nfs_clear_page_tag_locked(req);
+ nfs_end_page_writeback(page);
++ if (data->pnfs_error) {
++ lock_page(page);
++ nfs_pageio_cond_complete(&pgio, page->index);
++ ret = nfs_page_async_flush(&pgio, page, 0);
++ if (ret) {
++ nfs_set_pageerror(page);
++ dprintk("rewrite to MDS error = %d\n", ret);
++ }
++ unlock_page(page);
++ }
+ }
++ if (data->pnfs_error)
++ nfs_pageio_complete(&pgio);
+ nfs_writedata_release(calldata);
+ }
+
--- /dev/null
+From 760383f1ee4d14b0e0bdf0cddee648d9b8633429 Mon Sep 17 00:00:00 2001
+From: Peng Tao <bergwolf@gmail.com>
+Date: Thu, 22 Sep 2011 21:50:11 -0400
+Subject: pnfsblock: add missing rpc_put_mount and path_put
+
+From: Peng Tao <bergwolf@gmail.com>
+
+commit 760383f1ee4d14b0e0bdf0cddee648d9b8633429 upstream.
+
+Reviewed-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Peng Tao <peng_tao@emc.com>
+Signed-off-by: Jim Rees <rees@umich.edu>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/blocklayout/blocklayout.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/fs/nfs/blocklayout/blocklayout.c
++++ b/fs/nfs/blocklayout/blocklayout.c
+@@ -993,17 +993,20 @@ static int __init nfs4blocklayout_init(v
+ mnt,
+ NFS_PIPE_DIRNAME, 0, &path);
+ if (ret)
+- goto out_remove;
++ goto out_putrpc;
+
+ bl_device_pipe = rpc_mkpipe(path.dentry, "blocklayout", NULL,
+ &bl_upcall_ops, 0);
++ path_put(&path);
+ if (IS_ERR(bl_device_pipe)) {
+ ret = PTR_ERR(bl_device_pipe);
+- goto out_remove;
++ goto out_putrpc;
+ }
+ out:
+ return ret;
+
++out_putrpc:
++ rpc_put_mount();
+ out_remove:
+ pnfs_unregister_layoutdriver(&blocklayout_type);
+ return ret;
+@@ -1016,6 +1019,7 @@ static void __exit nfs4blocklayout_exit(
+
+ pnfs_unregister_layoutdriver(&blocklayout_type);
+ rpc_unlink(bl_device_pipe);
++ rpc_put_mount();
+ }
+
+ MODULE_ALIAS("nfs-layouttype4-3");
--- /dev/null
+From e6d05a757c314ad88d0649d3835a8a1daa964236 Mon Sep 17 00:00:00 2001
+From: Peng Tao <bergwolf@gmail.com>
+Date: Thu, 22 Sep 2011 21:50:16 -0400
+Subject: pnfsblock: fix NULL pointer dereference
+
+From: Peng Tao <bergwolf@gmail.com>
+
+commit e6d05a757c314ad88d0649d3835a8a1daa964236 upstream.
+
+bl_add_page_to_bio returns error pointer. bio should be reset to
+NULL in failure cases as the out path always calls bl_submit_bio.
+
+Signed-off-by: Peng Tao <peng_tao@emc.com>
+Signed-off-by: Jim Rees <rees@umich.edu>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/blocklayout/blocklayout.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/nfs/blocklayout/blocklayout.c
++++ b/fs/nfs/blocklayout/blocklayout.c
+@@ -292,6 +292,7 @@ bl_read_pagelist(struct nfs_read_data *r
+ bl_end_io_read, par);
+ if (IS_ERR(bio)) {
+ rdata->pnfs_error = PTR_ERR(bio);
++ bio = NULL;
+ goto out;
+ }
+ }
+@@ -581,6 +582,7 @@ fill_invalid_ext:
+ bl_end_io_write_zero, par);
+ if (IS_ERR(bio)) {
+ wdata->pnfs_error = PTR_ERR(bio);
++ bio = NULL;
+ goto out;
+ }
+ /* FIXME: This should be done in bi_end_io */
+@@ -629,6 +631,7 @@ next_page:
+ bl_end_io_write, par);
+ if (IS_ERR(bio)) {
+ wdata->pnfs_error = PTR_ERR(bio);
++ bio = NULL;
+ goto out;
+ }
+ isect += PAGE_CACHE_SECTORS;
--- /dev/null
+From 516f2e24faa7548a61d9ba790958528469c2e284 Mon Sep 17 00:00:00 2001
+From: Jim Rees <rees@umich.edu>
+Date: Thu, 22 Sep 2011 21:50:08 -0400
+Subject: pnfsblock: fix return code confusion
+
+From: Jim Rees <rees@umich.edu>
+
+commit 516f2e24faa7548a61d9ba790958528469c2e284 upstream.
+
+Always return PTR_ERR, not NULL, from nfs4_blk_get_deviceinfo and
+nfs4_blk_decode_device.
+
+Check for IS_ERR, not NULL, in bl_set_layoutdriver when calling
+nfs4_blk_get_deviceinfo.
+
+Signed-off-by: Jim Rees <rees@umich.edu>
+Signed-off-by: Benny Halevy <bhalevy@tonian.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/blocklayout/blocklayout.c | 20 ++++++++++++--------
+ fs/nfs/blocklayout/blocklayoutdev.c | 13 ++++++++-----
+ 2 files changed, 20 insertions(+), 13 deletions(-)
+
+--- a/fs/nfs/blocklayout/blocklayout.c
++++ b/fs/nfs/blocklayout/blocklayout.c
+@@ -805,7 +805,7 @@ nfs4_blk_get_deviceinfo(struct nfs_serve
+ struct nfs4_deviceid *d_id)
+ {
+ struct pnfs_device *dev;
+- struct pnfs_block_dev *rv = NULL;
++ struct pnfs_block_dev *rv;
+ u32 max_resp_sz;
+ int max_pages;
+ struct page **pages = NULL;
+@@ -823,18 +823,20 @@ nfs4_blk_get_deviceinfo(struct nfs_serve
+ dev = kmalloc(sizeof(*dev), GFP_NOFS);
+ if (!dev) {
+ dprintk("%s kmalloc failed\n", __func__);
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+ }
+
+ pages = kzalloc(max_pages * sizeof(struct page *), GFP_NOFS);
+ if (pages == NULL) {
+ kfree(dev);
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+ }
+ for (i = 0; i < max_pages; i++) {
+ pages[i] = alloc_page(GFP_NOFS);
+- if (!pages[i])
++ if (!pages[i]) {
++ rv = ERR_PTR(-ENOMEM);
+ goto out_free;
++ }
+ }
+
+ memcpy(&dev->dev_id, d_id, sizeof(*d_id));
+@@ -847,8 +849,10 @@ nfs4_blk_get_deviceinfo(struct nfs_serve
+ dprintk("%s: dev_id: %s\n", __func__, dev->dev_id.data);
+ rc = nfs4_proc_getdeviceinfo(server, dev);
+ dprintk("%s getdevice info returns %d\n", __func__, rc);
+- if (rc)
++ if (rc) {
++ rv = ERR_PTR(rc);
+ goto out_free;
++ }
+
+ rv = nfs4_blk_decode_device(server, dev);
+ out_free:
+@@ -866,7 +870,7 @@ bl_set_layoutdriver(struct nfs_server *s
+ struct pnfs_devicelist *dlist = NULL;
+ struct pnfs_block_dev *bdev;
+ LIST_HEAD(block_disklist);
+- int status = 0, i;
++ int status, i;
+
+ dprintk("%s enter\n", __func__);
+
+@@ -898,8 +902,8 @@ bl_set_layoutdriver(struct nfs_server *s
+ for (i = 0; i < dlist->num_devs; i++) {
+ bdev = nfs4_blk_get_deviceinfo(server, fh,
+ &dlist->dev_id[i]);
+- if (!bdev) {
+- status = -ENODEV;
++ if (IS_ERR(bdev)) {
++ status = PTR_ERR(bdev);
+ goto out_error;
+ }
+ spin_lock(&b_mt_id->bm_lock);
+--- a/fs/nfs/blocklayout/blocklayoutdev.c
++++ b/fs/nfs/blocklayout/blocklayoutdev.c
+@@ -131,7 +131,7 @@ struct pnfs_block_dev *
+ nfs4_blk_decode_device(struct nfs_server *server,
+ struct pnfs_device *dev)
+ {
+- struct pnfs_block_dev *rv = NULL;
++ struct pnfs_block_dev *rv;
+ struct block_device *bd = NULL;
+ struct rpc_pipe_msg msg;
+ struct bl_msg_hdr bl_msg = {
+@@ -141,7 +141,7 @@ nfs4_blk_decode_device(struct nfs_server
+ uint8_t *dataptr;
+ DECLARE_WAITQUEUE(wq, current);
+ struct bl_dev_msg *reply = &bl_mount_reply;
+- int offset, len, i;
++ int offset, len, i, rc;
+
+ dprintk("%s CREATING PIPEFS MESSAGE\n", __func__);
+ dprintk("%s: deviceid: %s, mincount: %d\n", __func__, dev->dev_id.data,
+@@ -168,8 +168,10 @@ nfs4_blk_decode_device(struct nfs_server
+
+ dprintk("%s CALLING USERSPACE DAEMON\n", __func__);
+ add_wait_queue(&bl_wq, &wq);
+- if (rpc_queue_upcall(bl_device_pipe->d_inode, &msg) < 0) {
++ rc = rpc_queue_upcall(bl_device_pipe->d_inode, &msg);
++ if (rc < 0) {
+ remove_wait_queue(&bl_wq, &wq);
++ rv = ERR_PTR(rc);
+ goto out;
+ }
+
+@@ -187,8 +189,9 @@ nfs4_blk_decode_device(struct nfs_server
+
+ bd = nfs4_blkdev_get(MKDEV(reply->major, reply->minor));
+ if (IS_ERR(bd)) {
+- dprintk("%s failed to open device : %ld\n",
+- __func__, PTR_ERR(bd));
++ rc = PTR_ERR(bd);
++ dprintk("%s failed to open device : %d\n", __func__, rc);
++ rv = ERR_PTR(rc);
+ goto out;
+ }
+
--- /dev/null
+From fdc17abbc4b6094b34ee8ff5d91eaba8637594a2 Mon Sep 17 00:00:00 2001
+From: Jim Rees <rees@umich.edu>
+Date: Thu, 22 Sep 2011 21:50:09 -0400
+Subject: pnfsblock: fix size of upcall message
+
+From: Jim Rees <rees@umich.edu>
+
+commit fdc17abbc4b6094b34ee8ff5d91eaba8637594a2 upstream.
+
+Make the status field explicitly 32 bits. "...it's unlikely that the kernel
+and userspace would differ on the size of an int here, but it might be a
+good idea to go ahead and make that explicitly 32 bits in case we end up
+dealing with more exotic arches at some point in the future."
+
+Suggested-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Jim Rees <rees@umich.edu>
+Signed-off-by: Benny Halevy <bhalevy@tonian.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/blocklayout/blocklayout.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/nfs/blocklayout/blocklayout.h
++++ b/fs/nfs/blocklayout/blocklayout.h
+@@ -150,7 +150,7 @@ BLK_LSEG2EXT(struct pnfs_layout_segment
+ }
+
+ struct bl_dev_msg {
+- int status;
++ int32_t status;
+ uint32_t major, minor;
+ };
+
--- /dev/null
+From 7542274519b3ba87555410c66e8356ac1e3bc9b3 Mon Sep 17 00:00:00 2001
+From: Peng Tao <bergwolf@gmail.com>
+Date: Thu, 22 Sep 2011 21:50:17 -0400
+Subject: pnfsblock: fix writeback deadlock
+
+From: Peng Tao <bergwolf@gmail.com>
+
+commit 7542274519b3ba87555410c66e8356ac1e3bc9b3 upstream.
+
+We should check if the sector is already initialized before
+trying to grab the page from page cache. Otherwise when two
+pages of the same block are written back by two threads each
+calling from writepage_locked, it can cause deadlock like bellow.
+
+ [ 1080.972099] INFO: task kswapd0:25 blocked for more than 120 seconds.
+ [ 1080.972377] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+ [ 1080.972812] kswapd0 D ffff88000c4926c0 0 25 2 0x00000000
+ [ 1080.972816] ffff88000df276b0 0000000000000046 ffff88000df27640 ffffffff81013ba7
+ [ 1080.972821] ffff88000c492310 ffff88000df27fd8 ffff88000df27fd8 00000000001d3440
+ [ 1080.972824] ffff88000c378000 ffff88000c492310 ffff8800175d3d40 ffff880017fc75a8
+ [ 1080.972828] Call Trace:
+ [ 1080.972860] [<ffffffff81013ba7>] ? read_tsc+0x9/0x19
+ [ 1080.972877] [<ffffffff810e0b23>] ? lock_page+0x2b/0x2b
+ [ 1080.972899] [<ffffffff81475a1d>] io_schedule+0x63/0x7e
+ [ 1080.972902] [<ffffffff810e0b31>] sleep_on_page+0xe/0x12
+ [ 1080.972905] [<ffffffff81475fe8>] __wait_on_bit_lock+0x46/0x8f
+ [ 1080.972916] [<ffffffff810822d7>] ? lock_release_holdtime.part.7+0x6b/0x72
+ [ 1080.972919] [<ffffffff810e0af6>] __lock_page+0x66/0x68
+ [ 1080.972928] [<ffffffff81072705>] ? autoremove_wake_function+0x3d/0x3d
+ [ 1080.972932] [<ffffffff810e0b1f>] lock_page+0x27/0x2b
+ [ 1080.972934] [<ffffffff810e0bcf>] find_lock_page+0x34/0x57
+ [ 1080.972937] [<ffffffff810e1738>] find_or_create_page+0x34/0x8a
+ [ 1080.972947] [<ffffffffa034245b>] bl_write_pagelist+0x205/0x6da [blocklayoutdriver]
+ [ 1080.972951] [<ffffffffa034145d>] ? bl_free_lseg+0x38/0x38 [blocklayoutdriver]
+ [ 1080.972995] [<ffffffffa02e27b9>] ? nfs_write_rpcsetup+0x118/0x123 [nfs]
+ [ 1080.973033] [<ffffffffa030246b>] pnfs_generic_pg_writepages+0x10b/0x1f4 [nfs]
+ [ 1080.973089] [<ffffffffa02deaae>] nfs_pageio_doio+0x1a/0x43 [nfs]
+ [ 1080.973098] [<ffffffffa02df035>] nfs_pageio_complete+0x16/0x2d [nfs]
+ [ 1080.973108] [<ffffffffa02e2d8f>] nfs_writepage_locked+0xa0/0xbf [nfs]
+ [ 1080.973119] [<ffffffffa02e36a1>] nfs_writepage+0x16/0x2b [nfs]
+ [ 1080.973122] [<ffffffff810e8762>] ? clear_page_dirty_for_io+0x87/0x9a
+ [ 1080.973133] [<ffffffff810efc5b>] shrink_page_list+0x39b/0x6c8
+ [ 1080.973139] [<ffffffff810f03bb>] shrink_inactive_list+0x22c/0x39e
+ [ 1080.973144] [<ffffffff810822d7>] ? lock_release_holdtime.part.7+0x6b/0x72
+ [ 1080.973148] [<ffffffff810f0c33>] shrink_zone+0x445/0x588
+ [ 1080.973152] [<ffffffff810f1a11>] balance_pgdat+0x2c2/0x56b
+ [ 1080.973170] [<ffffffff81254208>] ? __bitmap_weight+0x34/0x80
+ [ 1080.973175] [<ffffffff810f1f78>] kswapd+0x2be/0x2fa
+ [ 1080.973179] [<ffffffff810726c8>] ? __init_waitqueue_head+0x4b/0x4b
+ [ 1080.973183] [<ffffffff810f1cba>] ? balance_pgdat+0x56b/0x56b
+ [ 1080.973187] [<ffffffff81071f69>] kthread+0xa8/0xb0
+ [ 1080.973200] [<ffffffff814806b4>] kernel_thread_helper+0x4/0x10
+ [ 1080.973205] [<ffffffff81071ec1>] ? __init_kthread_worker+0x5a/0x5a
+ [ 1080.973210] [<ffffffff814806b0>] ? gs_change+0x13/0x13
+ [ 1080.973213] no locks held by kswapd0/25.
+
+Signed-off-by: Peng Tao <peng_tao@emc.com>
+Signed-off-by: Jim Rees <rees@umich.edu>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/blocklayout/blocklayout.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/fs/nfs/blocklayout/blocklayout.c
++++ b/fs/nfs/blocklayout/blocklayout.c
+@@ -533,6 +533,11 @@ bl_write_pagelist(struct nfs_write_data
+ fill_invalid_ext:
+ dprintk("%s need to zero %d pages\n", __func__, npg_zero);
+ for (;npg_zero > 0; npg_zero--) {
++ if (bl_is_sector_init(be->be_inval, isect)) {
++ dprintk("isect %llu already init\n",
++ (unsigned long long)isect);
++ goto next_page;
++ }
+ /* page ref released in bl_end_io_write_zero */
+ index = isect >> PAGE_CACHE_SECTOR_SHIFT;
+ dprintk("%s zero %dth page: index %lu isect %llu\n",
+@@ -552,8 +557,7 @@ fill_invalid_ext:
+ * PageUptodate: It was read before
+ * sector_initialized: already written out
+ */
+- if (PageDirty(page) || PageWriteback(page) ||
+- bl_is_sector_init(be->be_inval, isect)) {
++ if (PageDirty(page) || PageWriteback(page)) {
+ print_page(page);
+ unlock_page(page);
+ page_cache_release(page);
--- /dev/null
+From 273d23574f9dacd9c63c80e7d63639a669aad441 Mon Sep 17 00:00:00 2001
+From: Jerry Huang <r66093@freescale.com>
+Date: Tue, 18 Oct 2011 13:09:48 +0800
+Subject: QE/FHCI: fixed the CONTROL bug
+
+From: Jerry Huang <r66093@freescale.com>
+
+commit 273d23574f9dacd9c63c80e7d63639a669aad441 upstream.
+
+For USB CONTROL transaction, when the data length is zero,
+the IN package is needed to finish this transaction in status stage.
+
+Signed-off-by: Jerry Huang <r66093@freescale.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/fhci-sched.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/host/fhci-sched.c
++++ b/drivers/usb/host/fhci-sched.c
+@@ -1,7 +1,7 @@
+ /*
+ * Freescale QUICC Engine USB Host Controller Driver
+ *
+- * Copyright (c) Freescale Semicondutor, Inc. 2006.
++ * Copyright (c) Freescale Semicondutor, Inc. 2006, 2011.
+ * Shlomi Gridish <gridish@freescale.com>
+ * Jerry Huang <Chang-Ming.Huang@freescale.com>
+ * Copyright (c) Logic Product Development, Inc. 2007
+@@ -810,9 +810,11 @@ void fhci_queue_urb(struct fhci_hcd *fhc
+ ed->dev_addr = usb_pipedevice(urb->pipe);
+ ed->max_pkt_size = usb_maxpacket(urb->dev, urb->pipe,
+ usb_pipeout(urb->pipe));
++ /* setup stage */
+ td = fhci_td_fill(fhci, urb, urb_priv, ed, cnt++, FHCI_TA_SETUP,
+ USB_TD_TOGGLE_DATA0, urb->setup_packet, 8, 0, 0, true);
+
++ /* data stage */
+ if (data_len > 0) {
+ td = fhci_td_fill(fhci, urb, urb_priv, ed, cnt++,
+ usb_pipeout(urb->pipe) ? FHCI_TA_OUT :
+@@ -820,9 +822,18 @@ void fhci_queue_urb(struct fhci_hcd *fhc
+ USB_TD_TOGGLE_DATA1, data, data_len, 0, 0,
+ true);
+ }
+- td = fhci_td_fill(fhci, urb, urb_priv, ed, cnt++,
+- usb_pipeout(urb->pipe) ? FHCI_TA_IN : FHCI_TA_OUT,
+- USB_TD_TOGGLE_DATA1, data, 0, 0, 0, true);
++
++ /* status stage */
++ if (data_len > 0)
++ td = fhci_td_fill(fhci, urb, urb_priv, ed, cnt++,
++ (usb_pipeout(urb->pipe) ? FHCI_TA_IN :
++ FHCI_TA_OUT),
++ USB_TD_TOGGLE_DATA1, data, 0, 0, 0, true);
++ else
++ td = fhci_td_fill(fhci, urb, urb_priv, ed, cnt++,
++ FHCI_TA_IN,
++ USB_TD_TOGGLE_DATA1, data, 0, 0, 0, true);
++
+ urb_state = US_CTRL_SETUP;
+ break;
+ case FHCI_TF_ISO:
--- /dev/null
+From 59b7c05fffba030e5d9e72324691e2f99aa69b79 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Mon, 17 Oct 2011 18:22:55 -0700
+Subject: Revert "NFS: Ensure that writeback_single_inode() calls write_inode() when syncing"
+
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit 59b7c05fffba030e5d9e72324691e2f99aa69b79 upstream.
+
+This reverts commit b80c3cb628f0ebc241b02e38dd028969fb8026a2.
+
+The reverted commit was rendered obsolete by a VFS fix: commit
+5547e8aac6f71505d621a612de2fca0dd988b439 (writeback: Update dirty flags in
+two steps). We now no longer need to worry about writeback_single_inode()
+missing our marking the inode for COMMIT in 'do_writepages()' call.
+
+Reverting this patch, fixes a performance regression in which the inode
+would continuously get queued to the dirty list, causing the writeback
+code to unnecessarily try to send a COMMIT.
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust>
+Tested-by: Simon Kirby <sim@hostway.ca>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/write.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -428,7 +428,6 @@ static void
+ nfs_mark_request_dirty(struct nfs_page *req)
+ {
+ __set_page_dirty_nobuffers(req->wb_page);
+- __mark_inode_dirty(req->wb_page->mapping->host, I_DIRTY_DATASYNC);
+ }
+
+ #if defined(CONFIG_NFS_V3) || defined(CONFIG_NFS_V4)
+@@ -762,6 +761,8 @@ int nfs_updatepage(struct file *file, st
+ status = nfs_writepage_setup(ctx, page, offset, count);
+ if (status < 0)
+ nfs_set_pageerror(page);
++ else
++ __set_page_dirty_nobuffers(page);
+
+ dprintk("NFS: nfs_updatepage returns %d (isize %lld)\n",
+ status, (long long)i_size_read(inode));
ath9k_hw-fix-number-of-gpio-pins-for-ar9287-9300.patch
ath9k-disable-unnecessary-phy-error-reporting.patch
usb-add-quirk-for-logitech-c300-web-cam.patch
+hid-acrux-fix-enabling-force-feedback-support.patch
+qe-fhci-fixed-the-control-bug.patch
+arm-smp-fix-clipping-of-number-of-cpus.patch
+update-email-address-for-stable-patch-submission.patch
+xen-pcifront-update-warning-comment-to-use-e820_host.patch
+xen-swiotlb-fix-wrong-panic.patch
+ums_realtek-do-not-use-stack-memory-for-dma.patch
+kobj_uevent-ignore-if-some-listeners-cannot-handle-message.patch
+caif-fix-bug-with-network-namespaces.patch
+platform-samsung_laptop-add-dmi-information-for-samsung.patch
+platform-samsung_laptop-add-support-for-x520-machines.patch
+platform-samsung_laptop-samsung-backlight-for-r528-r728.patch
+platform-samsung_laptop-fix-samsung-brightness-min-max.patch
+platform-fix-error-path-in-samsung-laptop-init.patch
+pnfsblock-fix-return-code-confusion.patch
+pnfsblock-fix-size-of-upcall-message.patch
+pnfsblock-add-missing-rpc_put_mount-and-path_put.patch
+pnfs-make-_set_lo_fail-generic.patch
+pnfs-recoalesce-when-ld-write-pagelist-fails.patch
+pnfs-recoalesce-when-ld-read-pagelist-fails.patch
+pnfsblock-fix-null-pointer-dereference.patch
+pnfsblock-fix-writeback-deadlock.patch
+kmod-prevent-kmod_loop_msg-overflow-in-__request_module.patch
+revert-nfs-ensure-that-writeback_single_inode-calls-write_inode-when-syncing.patch
+sunrpc-nfs-make-rpc-pipe-upcall-generic.patch
+nfs-don-t-redirty-inode-when-ncommit-0-in.patch
--- /dev/null
+From c1225158a8dad9e9d5eee8a17dbbd9c7cda05ab9 Mon Sep 17 00:00:00 2001
+From: Peng Tao <bergwolf@gmail.com>
+Date: Thu, 22 Sep 2011 21:50:10 -0400
+Subject: SUNRPC/NFS: make rpc pipe upcall generic
+
+From: Peng Tao <bergwolf@gmail.com>
+
+commit c1225158a8dad9e9d5eee8a17dbbd9c7cda05ab9 upstream.
+
+The same function is used by idmap, gss and blocklayout code. Make it
+generic.
+
+Signed-off-by: Peng Tao <peng_tao@emc.com>
+Signed-off-by: Jim Rees <rees@umich.edu>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/blocklayout/blocklayout.c | 2 +-
+ fs/nfs/blocklayout/blocklayout.h | 2 --
+ fs/nfs/blocklayout/blocklayoutdev.c | 22 ----------------------
+ fs/nfs/idmap.c | 25 +------------------------
+ include/linux/sunrpc/rpc_pipe_fs.h | 2 ++
+ net/sunrpc/auth_gss/auth_gss.c | 24 ++----------------------
+ net/sunrpc/rpc_pipe.c | 20 ++++++++++++++++++++
+ 7 files changed, 26 insertions(+), 71 deletions(-)
+
+--- a/fs/nfs/blocklayout/blocklayout.c
++++ b/fs/nfs/blocklayout/blocklayout.c
+@@ -960,7 +960,7 @@ static struct pnfs_layoutdriver_type blo
+ };
+
+ static const struct rpc_pipe_ops bl_upcall_ops = {
+- .upcall = bl_pipe_upcall,
++ .upcall = rpc_pipe_generic_upcall,
+ .downcall = bl_pipe_downcall,
+ .destroy_msg = bl_pipe_destroy_msg,
+ };
+--- a/fs/nfs/blocklayout/blocklayout.h
++++ b/fs/nfs/blocklayout/blocklayout.h
+@@ -169,8 +169,6 @@ extern wait_queue_head_t bl_wq;
+ #define BL_DEVICE_REQUEST_ERR 0x2 /* User level process fails */
+
+ /* blocklayoutdev.c */
+-ssize_t bl_pipe_upcall(struct file *, struct rpc_pipe_msg *,
+- char __user *, size_t);
+ ssize_t bl_pipe_downcall(struct file *, const char __user *, size_t);
+ void bl_pipe_destroy_msg(struct rpc_pipe_msg *);
+ struct block_device *nfs4_blkdev_get(dev_t dev);
+--- a/fs/nfs/blocklayout/blocklayoutdev.c
++++ b/fs/nfs/blocklayout/blocklayoutdev.c
+@@ -79,28 +79,6 @@ int nfs4_blkdev_put(struct block_device
+ return blkdev_put(bdev, FMODE_READ);
+ }
+
+-/*
+- * Shouldn't there be a rpc_generic_upcall() to do this for us?
+- */
+-ssize_t bl_pipe_upcall(struct file *filp, struct rpc_pipe_msg *msg,
+- char __user *dst, size_t buflen)
+-{
+- char *data = (char *)msg->data + msg->copied;
+- size_t mlen = min(msg->len - msg->copied, buflen);
+- unsigned long left;
+-
+- left = copy_to_user(dst, data, mlen);
+- if (left == mlen) {
+- msg->errno = -EFAULT;
+- return -EFAULT;
+- }
+-
+- mlen -= left;
+- msg->copied += mlen;
+- msg->errno = 0;
+- return mlen;
+-}
+-
+ static struct bl_dev_msg bl_mount_reply;
+
+ ssize_t bl_pipe_downcall(struct file *filp, const char __user *src,
+--- a/fs/nfs/idmap.c
++++ b/fs/nfs/idmap.c
+@@ -336,8 +336,6 @@ struct idmap {
+ struct idmap_hashtable idmap_group_hash;
+ };
+
+-static ssize_t idmap_pipe_upcall(struct file *, struct rpc_pipe_msg *,
+- char __user *, size_t);
+ static ssize_t idmap_pipe_downcall(struct file *, const char __user *,
+ size_t);
+ static void idmap_pipe_destroy_msg(struct rpc_pipe_msg *);
+@@ -345,7 +343,7 @@ static void idmap_pipe_destroy_msg(struc
+ static unsigned int fnvhash32(const void *, size_t);
+
+ static const struct rpc_pipe_ops idmap_upcall_ops = {
+- .upcall = idmap_pipe_upcall,
++ .upcall = rpc_pipe_generic_upcall,
+ .downcall = idmap_pipe_downcall,
+ .destroy_msg = idmap_pipe_destroy_msg,
+ };
+@@ -595,27 +593,6 @@ nfs_idmap_name(struct idmap *idmap, stru
+ return ret;
+ }
+
+-/* RPC pipefs upcall/downcall routines */
+-static ssize_t
+-idmap_pipe_upcall(struct file *filp, struct rpc_pipe_msg *msg,
+- char __user *dst, size_t buflen)
+-{
+- char *data = (char *)msg->data + msg->copied;
+- size_t mlen = min(msg->len, buflen);
+- unsigned long left;
+-
+- left = copy_to_user(dst, data, mlen);
+- if (left == mlen) {
+- msg->errno = -EFAULT;
+- return -EFAULT;
+- }
+-
+- mlen -= left;
+- msg->copied += mlen;
+- msg->errno = 0;
+- return mlen;
+-}
+-
+ static ssize_t
+ idmap_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
+ {
+--- a/include/linux/sunrpc/rpc_pipe_fs.h
++++ b/include/linux/sunrpc/rpc_pipe_fs.h
+@@ -44,6 +44,8 @@ RPC_I(struct inode *inode)
+ return container_of(inode, struct rpc_inode, vfs_inode);
+ }
+
++extern ssize_t rpc_pipe_generic_upcall(struct file *, struct rpc_pipe_msg *,
++ char __user *, size_t);
+ extern int rpc_queue_upcall(struct inode *, struct rpc_pipe_msg *);
+
+ struct rpc_clnt;
+--- a/net/sunrpc/auth_gss/auth_gss.c
++++ b/net/sunrpc/auth_gss/auth_gss.c
+@@ -603,26 +603,6 @@ out:
+ return err;
+ }
+
+-static ssize_t
+-gss_pipe_upcall(struct file *filp, struct rpc_pipe_msg *msg,
+- char __user *dst, size_t buflen)
+-{
+- char *data = (char *)msg->data + msg->copied;
+- size_t mlen = min(msg->len, buflen);
+- unsigned long left;
+-
+- left = copy_to_user(dst, data, mlen);
+- if (left == mlen) {
+- msg->errno = -EFAULT;
+- return -EFAULT;
+- }
+-
+- mlen -= left;
+- msg->copied += mlen;
+- msg->errno = 0;
+- return mlen;
+-}
+-
+ #define MSG_BUF_MAXSIZE 1024
+
+ static ssize_t
+@@ -1590,7 +1570,7 @@ static const struct rpc_credops gss_null
+ };
+
+ static const struct rpc_pipe_ops gss_upcall_ops_v0 = {
+- .upcall = gss_pipe_upcall,
++ .upcall = rpc_pipe_generic_upcall,
+ .downcall = gss_pipe_downcall,
+ .destroy_msg = gss_pipe_destroy_msg,
+ .open_pipe = gss_pipe_open_v0,
+@@ -1598,7 +1578,7 @@ static const struct rpc_pipe_ops gss_upc
+ };
+
+ static const struct rpc_pipe_ops gss_upcall_ops_v1 = {
+- .upcall = gss_pipe_upcall,
++ .upcall = rpc_pipe_generic_upcall,
+ .downcall = gss_pipe_downcall,
+ .destroy_msg = gss_pipe_destroy_msg,
+ .open_pipe = gss_pipe_open_v1,
+--- a/net/sunrpc/rpc_pipe.c
++++ b/net/sunrpc/rpc_pipe.c
+@@ -77,6 +77,26 @@ rpc_timeout_upcall_queue(struct work_str
+ rpc_purge_list(rpci, &free_list, destroy_msg, -ETIMEDOUT);
+ }
+
++ssize_t rpc_pipe_generic_upcall(struct file *filp, struct rpc_pipe_msg *msg,
++ char __user *dst, size_t buflen)
++{
++ char *data = (char *)msg->data + msg->copied;
++ size_t mlen = min(msg->len - msg->copied, buflen);
++ unsigned long left;
++
++ left = copy_to_user(dst, data, mlen);
++ if (left == mlen) {
++ msg->errno = -EFAULT;
++ return -EFAULT;
++ }
++
++ mlen -= left;
++ msg->copied += mlen;
++ msg->errno = 0;
++ return mlen;
++}
++EXPORT_SYMBOL_GPL(rpc_pipe_generic_upcall);
++
+ /**
+ * rpc_queue_upcall - queue an upcall message to userspace
+ * @inode: inode of upcall pipe on which to queue given message
--- /dev/null
+From 065e60964e293227e4feb0c1f7e27e609316ed9a Mon Sep 17 00:00:00 2001
+From: Adam Cozzette <acozzette@cs.hmc.edu>
+Date: Wed, 24 Aug 2011 12:22:37 -0600
+Subject: ums_realtek: do not use stack memory for DMA
+
+From: Adam Cozzette <acozzette@cs.hmc.edu>
+
+commit 065e60964e293227e4feb0c1f7e27e609316ed9a upstream.
+
+This patch changes rts51x_read_mem, rts51x_write_mem, and rts51x_read_status to
+allocate temporary buffers with kmalloc. This way stack addresses are not used
+for DMA when these functions call rts51x_bulk_transport.
+
+Signed-off-by: Adam Cozzette <acozzette@cs.hmc.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/storage/realtek_cr.c | 35 ++++++++++++++++++++++++++++++-----
+ 1 file changed, 30 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/storage/realtek_cr.c
++++ b/drivers/usb/storage/realtek_cr.c
+@@ -320,6 +320,11 @@ static int rts51x_read_mem(struct us_dat
+ {
+ int retval;
+ u8 cmnd[12] = { 0 };
++ u8 *buf;
++
++ buf = kmalloc(len, GFP_NOIO);
++ if (buf == NULL)
++ return USB_STOR_TRANSPORT_ERROR;
+
+ US_DEBUGP("%s, addr = 0x%x, len = %d\n", __func__, addr, len);
+
+@@ -331,10 +336,14 @@ static int rts51x_read_mem(struct us_dat
+ cmnd[5] = (u8) len;
+
+ retval = rts51x_bulk_transport(us, 0, cmnd, 12,
+- data, len, DMA_FROM_DEVICE, NULL);
+- if (retval != USB_STOR_TRANSPORT_GOOD)
++ buf, len, DMA_FROM_DEVICE, NULL);
++ if (retval != USB_STOR_TRANSPORT_GOOD) {
++ kfree(buf);
+ return -EIO;
++ }
+
++ memcpy(data, buf, len);
++ kfree(buf);
+ return 0;
+ }
+
+@@ -342,6 +351,12 @@ static int rts51x_write_mem(struct us_da
+ {
+ int retval;
+ u8 cmnd[12] = { 0 };
++ u8 *buf;
++
++ buf = kmalloc(len, GFP_NOIO);
++ if (buf == NULL)
++ return USB_STOR_TRANSPORT_ERROR;
++ memcpy(buf, data, len);
+
+ US_DEBUGP("%s, addr = 0x%x, len = %d\n", __func__, addr, len);
+
+@@ -353,7 +368,8 @@ static int rts51x_write_mem(struct us_da
+ cmnd[5] = (u8) len;
+
+ retval = rts51x_bulk_transport(us, 0, cmnd, 12,
+- data, len, DMA_TO_DEVICE, NULL);
++ buf, len, DMA_TO_DEVICE, NULL);
++ kfree(buf);
+ if (retval != USB_STOR_TRANSPORT_GOOD)
+ return -EIO;
+
+@@ -365,6 +381,11 @@ static int rts51x_read_status(struct us_
+ {
+ int retval;
+ u8 cmnd[12] = { 0 };
++ u8 *buf;
++
++ buf = kmalloc(len, GFP_NOIO);
++ if (buf == NULL)
++ return USB_STOR_TRANSPORT_ERROR;
+
+ US_DEBUGP("%s, lun = %d\n", __func__, lun);
+
+@@ -372,10 +393,14 @@ static int rts51x_read_status(struct us_
+ cmnd[1] = 0x09;
+
+ retval = rts51x_bulk_transport(us, lun, cmnd, 12,
+- status, len, DMA_FROM_DEVICE, actlen);
+- if (retval != USB_STOR_TRANSPORT_GOOD)
++ buf, len, DMA_FROM_DEVICE, actlen);
++ if (retval != USB_STOR_TRANSPORT_GOOD) {
++ kfree(buf);
+ return -EIO;
++ }
+
++ memcpy(status, buf, len);
++ kfree(buf);
+ return 0;
+ }
+
--- /dev/null
+From 5fa224295f0e0358c8bc0e5390702338df889def Mon Sep 17 00:00:00 2001
+From: Josh Boyer <jwboyer@redhat.com>
+Date: Mon, 17 Oct 2011 21:16:39 -0400
+Subject: Update email address for stable patch submission
+
+From: Josh Boyer <jwboyer@redhat.com>
+
+commit 5fa224295f0e0358c8bc0e5390702338df889def upstream.
+
+The stable@kernel.org email address has been replaced with the
+stable@vger.kernel.org mailing list. Change the stable kernel rules to
+reference the new list instead of the semi-defunct email alias.
+
+Signed-off-by: Josh Boyer <jwboyer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/stable_kernel_rules.txt | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/Documentation/stable_kernel_rules.txt
++++ b/Documentation/stable_kernel_rules.txt
+@@ -24,10 +24,10 @@ Rules on what kind of patches are accept
+ Procedure for submitting patches to the -stable tree:
+
+ - Send the patch, after verifying that it follows the above rules, to
+- stable@kernel.org. You must note the upstream commit ID in the changelog
+- of your submission.
++ stable@vger.kernel.org. You must note the upstream commit ID in the
++ changelog of your submission.
+ - To have the patch automatically included in the stable tree, add the tag
+- Cc: stable@kernel.org
++ Cc: stable@vger.kernel.org
+ in the sign-off area. Once the patch is merged it will be applied to
+ the stable tree without anything else needing to be done by the author
+ or subsystem maintainer.
+@@ -35,10 +35,10 @@ Procedure for submitting patches to the
+ cherry-picked than this can be specified in the following format in
+ the sign-off area:
+
+- Cc: <stable@kernel.org> # .32.x: a1f84a3: sched: Check for idle
+- Cc: <stable@kernel.org> # .32.x: 1b9508f: sched: Rate-limit newidle
+- Cc: <stable@kernel.org> # .32.x: fd21073: sched: Fix affinity logic
+- Cc: <stable@kernel.org> # .32.x
++ Cc: <stable@vger.kernel.org> # .32.x: a1f84a3: sched: Check for idle
++ Cc: <stable@vger.kernel.org> # .32.x: 1b9508f: sched: Rate-limit newidle
++ Cc: <stable@vger.kernel.org> # .32.x: fd21073: sched: Fix affinity logic
++ Cc: <stable@vger.kernel.org> # .32.x
+ Signed-off-by: Ingo Molnar <mingo@elte.hu>
+
+ The tag sequence has the meaning of:
--- /dev/null
+From 917e3e65c35459d52f0d0b890aa5df0cad07a051 Mon Sep 17 00:00:00 2001
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Date: Fri, 22 Jul 2011 12:18:43 -0400
+Subject: xen-pcifront: Update warning comment to use 'e820_host'
+ option.
+
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+
+commit 917e3e65c35459d52f0d0b890aa5df0cad07a051 upstream.
+
+With Xen changeset 23428 "libxl: Add 'e820_host' option to config file"
+the E820 as seen from the host can now be passed into the guest.
+This means that a PV guest can now:
+ - Use the correct PCI I/O gap. Before these patches, Linux guest would
+ boot up and would tell:
+ [ 0.000000] Allocating PCI resources starting at 40000000 (gap: 40000000:c0000000)
+ while in actuality the PCI I/O gap should have been:
+ [ 0.000000] Allocating PCI resources starting at b0000000 (gap: b0000000:4c000000)
+
+ - The PV domain with PCI devices was limited to 3GB. It now can be booted
+ with 4GB, 8GB, or whatever number you want. The PCI devices will now _not_ conflict
+ with System RAM. Meaning the drivers can load.
+
+CC: Jesse Barnes <jbarnes@virtuousgeek.org>
+CC: linux-pci@vger.kernel.org
+[v2: Made the string less broken up. Suggested by Joe Perches]
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/xen-pcifront.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/pci/xen-pcifront.c
++++ b/drivers/pci/xen-pcifront.c
+@@ -400,9 +400,8 @@ static int pcifront_claim_resource(struc
+ dev_info(&pdev->xdev->dev, "claiming resource %s/%d\n",
+ pci_name(dev), i);
+ if (pci_claim_resource(dev, i)) {
+- dev_err(&pdev->xdev->dev, "Could not claim "
+- "resource %s/%d! Device offline. Try "
+- "giving less than 4GB to domain.\n",
++ dev_err(&pdev->xdev->dev, "Could not claim resource %s/%d! "
++ "Device offline. Try using e820_host=1 in the guest config.\n",
+ pci_name(dev), i);
+ }
+ }
--- /dev/null
+From ab2a47bd242d6cdcf6b2b64797f271c6f0a6d338 Mon Sep 17 00:00:00 2001
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Date: Fri, 22 Jul 2011 12:51:48 -0400
+Subject: xen-swiotlb: Fix wrong panic.
+
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+
+commit ab2a47bd242d6cdcf6b2b64797f271c6f0a6d338 upstream.
+
+Propagate the baremetal git commit "swiotlb: fix wrong panic"
+(fba99fa38b023224680308a482e12a0eca87e4e1) in the Xen-SWIOTLB version.
+wherein swiotlb's map_page wrongly calls panic() when it can't find
+a buffer fit for device's dma mask. It should return an error instead.
+
+Devices with an odd dma mask (i.e. under 4G) like b44 network card hit
+this bug (the system crashes):
+
+http://marc.info/?l=linux-kernel&m=129648943830106&w=2
+
+If xen-swiotlb returns an error, b44 driver can use the own bouncing
+mechanism.
+
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/xen/swiotlb-xen.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/xen/swiotlb-xen.c
++++ b/drivers/xen/swiotlb-xen.c
+@@ -278,9 +278,10 @@ dma_addr_t xen_swiotlb_map_page(struct d
+ /*
+ * Ensure that the address returned is DMA'ble
+ */
+- if (!dma_capable(dev, dev_addr, size))
+- panic("map_single: bounce buffer is not DMA'ble");
+-
++ if (!dma_capable(dev, dev_addr, size)) {
++ swiotlb_tbl_unmap_single(dev, map, size, dir);
++ dev_addr = 0;
++ }
+ return dev_addr;
+ }
+ EXPORT_SYMBOL_GPL(xen_swiotlb_map_page);
projects / thirdparty / kernel / stable-queue.git / commitdiff
