--- /dev/null
+From linux@linux.site Fri Oct 16 10:11:47 2009
+Message-Id: <20091016171146.787259060@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:09:54 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Hannes Reinecke <hare@suse.de>,
+ James Bottomley <James.Bottomley@suse.de>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [01/46] SCSI: Retry ADD_TO_MLQUEUE return value for EH commands
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=scsi-retry-add_to_mlqueue-return-value-for-eh-commands.patch
+Content-Length: 936
+Lines: 34
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Hannes Reinecke <hare@suse.de>
+
+commit 6e883b0e42739aa560133cfaf41be1138c51a500 upstream.
+
+A target reset when I/O is ongoing might result
+an eventual device offline, as scsi_eh_completed_normally()
+might return ADD_TO_MLQUEUE in addition to the
+advertised SUCCESS, FAILED, and NEEDS_RETRY.
+
+Which is unfortunate as scsi_send_eh_cmnd() will
+therefore map ADD_TO_MLQUEUE to FAILED instead of
+the more appropriate NEEDS_RETRY.
+
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/scsi_error.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -721,6 +721,9 @@ static int scsi_send_eh_cmnd(struct scsi
+ case NEEDS_RETRY:
+ case FAILED:
+ break;
++ case ADD_TO_MLQUEUE:
++ rtn = NEEDS_RETRY;
++ break;
+ default:
+ rtn = FAILED;
+ break;
+
+
+From linux@linux.site Fri Oct 16 10:11:47 2009
+Message-Id: <20091016171147.260975796@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:09:55 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Martin K. Petersen" <martin.petersen@oracle.com>,
+ James Bottomley <James.Bottomley@suse.de>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [02/46] SCSI: Fix protection scsi_data_buffer leak
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=scsi-fix-protection-scsi_data_buffer-leak.patch
+Content-Length: 1256
+Lines: 47
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Martin K. Petersen <martin.petersen@oracle.com>
+
+commit b4c2554d40ceac130a8d062eaa8838ed22158c45 upstream.
+
+We would leak a scsi_data_buffer if the free_list command was of the
+protected variety.
+
+Reported-by: Boaz Harrosh <bharrosh@panasas.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/scsi.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/scsi.c
++++ b/drivers/scsi/scsi.c
+@@ -241,10 +241,7 @@ scsi_host_alloc_command(struct Scsi_Host
+ */
+ struct scsi_cmnd *__scsi_get_command(struct Scsi_Host *shost, gfp_t gfp_mask)
+ {
+- struct scsi_cmnd *cmd;
+- unsigned char *buf;
+-
+- cmd = scsi_host_alloc_command(shost, gfp_mask);
++ struct scsi_cmnd *cmd = scsi_host_alloc_command(shost, gfp_mask);
+
+ if (unlikely(!cmd)) {
+ unsigned long flags;
+@@ -258,9 +255,15 @@ struct scsi_cmnd *__scsi_get_command(str
+ spin_unlock_irqrestore(&shost->free_list_lock, flags);
+
+ if (cmd) {
++ void *buf, *prot;
++
+ buf = cmd->sense_buffer;
++ prot = cmd->prot_sdb;
++
+ memset(cmd, 0, sizeof(*cmd));
++
+ cmd->sense_buffer = buf;
++ cmd->prot_sdb = prot;
+ }
+ }
+
+
+
+From linux@linux.site Fri Oct 16 10:11:48 2009
+Message-Id: <20091016171147.825732900@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:09:56 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>,
+ Christof Schmitt <christof.schmitt@de.ibm.com>,
+ Douglas Gilbert <dgilbert@interlog.com>,
+ James Bottomley <James.Bottomley@suse.de>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [03/46] SCSI: sg: Free data buffers after calling blk_rq_unmap_user
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=scsi-sg-free-data-buffers-after-calling-blk_rq_unmap_user.patch
+Content-Length: 1658
+Lines: 59
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Christof Schmitt <christof.schmitt@de.ibm.com>
+
+commit e27168f8c337b12b8aa8d59c3123c79d2f83603d upstream.
+
+Running sg_luns on s390x with CONFIG_DEBUG_PAGEALLOC enabled fails
+with EFAULT from the SG_IO ioctl. The EFAULT is the result from
+copy_to_user failing in this call chain:
+
+sg_ioctl
+sg_new_read
+sg_finish_rem_req
+blk_rq_unmap_user
+__blk_rq_unmap_user
+bio_uncopy_user
+__bio_copy_iov
+copy_to_user
+
+The sg driver calls sg_remove_scat to free the memory pages before
+calling blk_rq_unmap_user that tries to copy the data back to
+userspace. Change the order to first call blk_rq_unmap_user before
+freeing the pages in sg_remove_scat.
+
+Acked-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Signed-off-by: Christof Schmitt <christof.schmitt@de.ibm.com>
+Acked-by: Douglas Gilbert <dgilbert@interlog.com>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/sg.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -1708,11 +1708,6 @@ static int sg_finish_rem_req(Sg_request
+ Sg_scatter_hold *req_schp = &srp->data;
+
+ SCSI_LOG_TIMEOUT(4, printk("sg_finish_rem_req: res_used=%d\n", (int) srp->res_used));
+- if (srp->res_used)
+- sg_unlink_reserve(sfp, srp);
+- else
+- sg_remove_scat(req_schp);
+-
+ if (srp->rq) {
+ if (srp->bio)
+ ret = blk_rq_unmap_user(srp->bio);
+@@ -1720,6 +1715,11 @@ static int sg_finish_rem_req(Sg_request
+ blk_put_request(srp->rq);
+ }
+
++ if (srp->res_used)
++ sg_unlink_reserve(sfp, srp);
++ else
++ sg_remove_scat(req_schp);
++
+ sg_remove_request(sfp, srp);
+
+ return ret;
+
+
+From linux@linux.site Fri Oct 16 10:11:48 2009
+Message-Id: <20091016171148.314370239@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:09:57 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dennis OBrien <dennis.obrien@eqware.net>,
+ Eric Miao <eric.y.miao@gmail.com>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [04/46] ARM: pxa: workaround errata #37 by not using half turbo switching
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=arm-pxa-workaround-errata-37-by-not-using-half-turbo-switching.patch
+Content-Length: 1196
+Lines: 27
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Dennis O'Brien <dennis.obrien@eqware.net>
+
+commit 4367216a099b4df3fa2c4f2b086cda1a1e9afc4e upstream.
+
+PXA27x Errata #37 implies system will hang when switching into or out of
+half turbo (HT bit in CLKCFG) mode, workaround this by not using it.
+
+Signed-off-by: Dennis O'Brien <dennis.obrien@eqware.net>
+Signed-off-by: Eric Miao <eric.y.miao@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/mach-pxa/cpufreq-pxa2xx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/mach-pxa/cpufreq-pxa2xx.c
++++ b/arch/arm/mach-pxa/cpufreq-pxa2xx.c
+@@ -155,7 +155,7 @@ MODULE_PARM_DESC(pxa255_turbo_table, "Se
+
+ static pxa_freqs_t pxa27x_freqs[] = {
+ {104000, 104000, PXA27x_CCCR(1, 8, 2), 0, CCLKCFG2(1, 0, 1), 900000, 1705000 },
+- {156000, 104000, PXA27x_CCCR(1, 8, 6), 0, CCLKCFG2(1, 1, 1), 1000000, 1705000 },
++ {156000, 104000, PXA27x_CCCR(1, 8, 3), 0, CCLKCFG2(1, 0, 1), 1000000, 1705000 },
+ {208000, 208000, PXA27x_CCCR(0, 16, 2), 1, CCLKCFG2(0, 0, 1), 1180000, 1705000 },
+ {312000, 208000, PXA27x_CCCR(1, 16, 3), 1, CCLKCFG2(1, 0, 1), 1250000, 1705000 },
+ {416000, 208000, PXA27x_CCCR(1, 16, 4), 1, CCLKCFG2(1, 0, 1), 1350000, 1705000 },
+
+
+From linux@linux.site Fri Oct 16 10:11:49 2009
+Message-Id: <20091016171148.889563227@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:09:58 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Li Zefan <lizf@cn.fujitsu.com>,
+ Steven Rostedt <rostedt@goodmis.org>,
+ Frederic Weisbecker <fweisbec@gmail.com>,
+ Tom Zanussi <tzanussi@gmail.com>,
+ Ingo Molnar <mingo@elte.hu>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [05/46] tracing/filters: Fix memory leak when setting a filter
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=tracing-filters-fix-memory-leak-when-setting-a-filter.patch
+Content-Length: 966
+Lines: 33
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Li Zefan <lizf@cn.fujitsu.com>
+
+commit 8ad807318fcd62aba0e18c7c7fbfcc1af3fcdbab upstream.
+
+Every time we set a filter, we leak memory allocated by
+postfix_append_operand() and postfix_append_op().
+
+Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Frederic Weisbecker <fweisbec@gmail.com>
+Cc: Tom Zanussi <tzanussi@gmail.com>
+LKML-Reference: <4AD3D7D9.4070400@cn.fujitsu.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/trace/trace_events_filter.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -844,8 +844,9 @@ static void postfix_clear(struct filter_
+
+ while (!list_empty(&ps->postfix)) {
+ elt = list_first_entry(&ps->postfix, struct postfix_elt, list);
+- kfree(elt->operand);
+ list_del(&elt->list);
++ kfree(elt->operand);
++ kfree(elt);
+ }
+ }
+
+
+
+From linux@linux.site Fri Oct 16 10:11:49 2009
+Message-Id: <20091016171149.406810626@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:09:59 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>,
+ Xen-devel <xen-devel@lists.xensource.com>,
+ Ingo Molnar <mingo@elte.hu>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [06/46] x86/paravirt: Use normal calling sequences for irq enable/disable
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=x86-paravirt-use-normal-calling-sequences-for-irq-enable-disable.patch
+Content-Length: 3730
+Lines: 111
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jeremy Fitzhardinge <jeremy@goop.org>
+
+commit 71999d9862e667f1fd14f8fbfa0cce6d855bad3f upstream.
+
+Bastian Blank reported a boot crash with stackprotector enabled,
+and debugged it back to edx register corruption.
+
+For historical reasons irq enable/disable/save/restore had special
+calling sequences to make them more efficient. With the more
+recent introduction of higher-level and more general optimisations
+this is no longer necessary so we can just use the normal PVOP_
+macros.
+
+This fixes some residual bugs in the old implementations which left
+edx liable to inadvertent clobbering. Also, fix some bugs in
+__PVOP_VCALLEESAVE which were revealed by actual use.
+
+Reported-by: Bastian Blank <bastian@waldi.eu.org>
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Cc: Xen-devel <xen-devel@lists.xensource.com>
+LKML-Reference: <4AD3BC9B.7040501@goop.org>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/paravirt.h | 38 ++++++++++----------------------------
+ 1 file changed, 10 insertions(+), 28 deletions(-)
+
+--- a/arch/x86/include/asm/paravirt.h
++++ b/arch/x86/include/asm/paravirt.h
+@@ -528,10 +528,11 @@ int paravirt_disable_iospace(void);
+ #define EXTRA_CLOBBERS
+ #define VEXTRA_CLOBBERS
+ #else /* CONFIG_X86_64 */
++/* [re]ax isn't an arg, but the return val */
+ #define PVOP_VCALL_ARGS \
+ unsigned long __edi = __edi, __esi = __esi, \
+- __edx = __edx, __ecx = __ecx
+-#define PVOP_CALL_ARGS PVOP_VCALL_ARGS, __eax
++ __edx = __edx, __ecx = __ecx, __eax = __eax
++#define PVOP_CALL_ARGS PVOP_VCALL_ARGS
+
+ #define PVOP_CALL_ARG1(x) "D" ((unsigned long)(x))
+ #define PVOP_CALL_ARG2(x) "S" ((unsigned long)(x))
+@@ -543,6 +544,7 @@ int paravirt_disable_iospace(void);
+ "=c" (__ecx)
+ #define PVOP_CALL_CLOBBERS PVOP_VCALL_CLOBBERS, "=a" (__eax)
+
++/* void functions are still allowed [re]ax for scratch */
+ #define PVOP_VCALLEE_CLOBBERS "=a" (__eax)
+ #define PVOP_CALLEE_CLOBBERS PVOP_VCALLEE_CLOBBERS
+
+@@ -617,8 +619,8 @@ int paravirt_disable_iospace(void);
+ VEXTRA_CLOBBERS, \
+ pre, post, ##__VA_ARGS__)
+
+-#define __PVOP_VCALLEESAVE(rettype, op, pre, post, ...) \
+- ____PVOP_CALL(rettype, op.func, CLBR_RET_REG, \
++#define __PVOP_VCALLEESAVE(op, pre, post, ...) \
++ ____PVOP_VCALL(op.func, CLBR_RET_REG, \
+ PVOP_VCALLEE_CLOBBERS, , \
+ pre, post, ##__VA_ARGS__)
+
+@@ -1565,42 +1567,22 @@ extern struct paravirt_patch_site __para
+
+ static inline unsigned long __raw_local_save_flags(void)
+ {
+- unsigned long f;
+-
+- asm volatile(paravirt_alt(PARAVIRT_CALL)
+- : "=a"(f)
+- : paravirt_type(pv_irq_ops.save_fl),
+- paravirt_clobber(CLBR_EAX)
+- : "memory", "cc");
+- return f;
++ return PVOP_CALLEE0(unsigned long, pv_irq_ops.save_fl);
+ }
+
+ static inline void raw_local_irq_restore(unsigned long f)
+ {
+- asm volatile(paravirt_alt(PARAVIRT_CALL)
+- : "=a"(f)
+- : PV_FLAGS_ARG(f),
+- paravirt_type(pv_irq_ops.restore_fl),
+- paravirt_clobber(CLBR_EAX)
+- : "memory", "cc");
++ PVOP_VCALLEE1(pv_irq_ops.restore_fl, f);
+ }
+
+ static inline void raw_local_irq_disable(void)
+ {
+- asm volatile(paravirt_alt(PARAVIRT_CALL)
+- :
+- : paravirt_type(pv_irq_ops.irq_disable),
+- paravirt_clobber(CLBR_EAX)
+- : "memory", "eax", "cc");
++ PVOP_VCALLEE0(pv_irq_ops.irq_disable);
+ }
+
+ static inline void raw_local_irq_enable(void)
+ {
+- asm volatile(paravirt_alt(PARAVIRT_CALL)
+- :
+- : paravirt_type(pv_irq_ops.irq_enable),
+- paravirt_clobber(CLBR_EAX)
+- : "memory", "eax", "cc");
++ PVOP_VCALLEE0(pv_irq_ops.irq_enable);
+ }
+
+ static inline unsigned long __raw_local_irq_save(void)
+
+
+From linux@linux.site Fri Oct 16 10:11:50 2009
+Message-Id: <20091016171149.936555143@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:00 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Johan Hovold <jhovold@gmail.com>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [07/46] USB: ftdi_sio: remove tty->low_latency
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=usb-ftdi_sio-remove-tty-low_latency.patch
+Content-Length: 1075
+Lines: 36
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Johan Hovold <jhovold@gmail.com>
+
+commit 0cbd81a9f6bac734ac3266687bf027af1e395270 upstream.
+
+Fixes tty_flip_buffer_push being called from hard interrupt context with
+low_latency set.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1235,7 +1235,6 @@ static int set_serial_info(struct tty_st
+ (new_serial.flags & ASYNC_FLAGS));
+ priv->custom_divisor = new_serial.custom_divisor;
+
+- tty->low_latency = (priv->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
+ write_latency_timer(port);
+
+ check_and_exit:
+@@ -1706,9 +1705,6 @@ static int ftdi_open(struct tty_struct *
+ priv->rx_bytes = 0;
+ spin_unlock_irqrestore(&priv->rx_lock, flags);
+
+- if (tty)
+- tty->low_latency = (priv->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
+-
+ write_latency_timer(port);
+
+ /* No error checking for this (will get errors later anyway) */
+
+
+From linux@linux.site Fri Oct 16 10:11:50 2009
+Message-Id: <20091016171150.453227667@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:01 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Johan Hovold <jhovold@gmail.com>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [08/46] USB: ftdi_sio: remove unused rx_byte counter
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=usb-ftdi_sio-remove-unused-rx_byte-counter.patch
+Content-Length: 1767
+Lines: 59
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Johan Hovold <jhovold@gmail.com>
+
+commit 63b0061246b54b849da8f189ae048e8110d8ce7d upstream.
+
+Remove unused rx_byte counter which is never exposed as noted by Alan
+Cox.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 13 -------------
+ 1 file changed, 13 deletions(-)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -81,7 +81,6 @@ struct ftdi_private {
+ struct delayed_work rx_work;
+ struct usb_serial_port *port;
+ int rx_processed;
+- unsigned long rx_bytes;
+
+ __u16 interface; /* FT2232C, FT2232H or FT4232H port interface
+ (0 for FT232/245) */
+@@ -1701,9 +1700,6 @@ static int ftdi_open(struct tty_struct *
+ spin_lock_irqsave(&priv->tx_lock, flags);
+ priv->tx_bytes = 0;
+ spin_unlock_irqrestore(&priv->tx_lock, flags);
+- spin_lock_irqsave(&priv->rx_lock, flags);
+- priv->rx_bytes = 0;
+- spin_unlock_irqrestore(&priv->rx_lock, flags);
+
+ write_latency_timer(port);
+
+@@ -2016,8 +2012,6 @@ static void ftdi_read_bulk_callback(stru
+ struct usb_serial_port *port = urb->context;
+ struct tty_struct *tty;
+ struct ftdi_private *priv;
+- unsigned long countread;
+- unsigned long flags;
+ int status = urb->status;
+
+ if (urb->number_of_packets > 0) {
+@@ -2056,13 +2050,6 @@ static void ftdi_read_bulk_callback(stru
+ goto out;
+ }
+
+- /* count data bytes, but not status bytes */
+- countread = urb->actual_length;
+- countread -= 2 * DIV_ROUND_UP(countread, priv->max_packet_size);
+- spin_lock_irqsave(&priv->rx_lock, flags);
+- priv->rx_bytes += countread;
+- spin_unlock_irqrestore(&priv->rx_lock, flags);
+-
+ ftdi_process_read(&priv->rx_work.work);
+ out:
+ tty_kref_put(tty);
+
+
+From linux@linux.site Fri Oct 16 10:11:51 2009
+Message-Id: <20091016171150.956658137@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:02 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Johan Hovold <jhovold@gmail.com>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [09/46] USB: ftdi_sio: clean up read completion handler
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=usb-ftdi_sio-clean-up-read-completion-handler.patch
+Content-Length: 2205
+Lines: 76
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Johan Hovold <jhovold@gmail.com>
+
+commit e63e278b4d2d867893962d3c7cd13a3a24ceb3f1 upstream.
+
+Remove superfluous error checks in completion handler:
+
+ - No need to check private data and urb pointers as we check urb-status
+ before dereferencing priv (which is not freed until urb has been killed
+ on close).
+ - No need to check tty as it is checked again when processing.
+ - No need to check urb->number_of_packets on bulk urb.
+
+Note that both private data and tty are checked again before processing
+(possibly from work queue which also is cancelled on close).
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 28 +---------------------------
+ 1 file changed, 1 insertion(+), 27 deletions(-)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -2010,39 +2010,14 @@ static int ftdi_chars_in_buffer(struct t
+ static void ftdi_read_bulk_callback(struct urb *urb)
+ {
+ struct usb_serial_port *port = urb->context;
+- struct tty_struct *tty;
+ struct ftdi_private *priv;
+ int status = urb->status;
+
+- if (urb->number_of_packets > 0) {
+- dev_err(&port->dev, "%s transfer_buffer_length %d "
+- "actual_length %d number of packets %d\n", __func__,
+- urb->transfer_buffer_length,
+- urb->actual_length, urb->number_of_packets);
+- dev_err(&port->dev, "%s transfer_flags %x\n", __func__,
+- urb->transfer_flags);
+- }
+-
+ dbg("%s - port %d", __func__, port->number);
+
+ if (port->port.count <= 0)
+ return;
+
+- tty = tty_port_tty_get(&port->port);
+- if (!tty) {
+- dbg("%s - bad tty pointer - exiting", __func__);
+- return;
+- }
+-
+- priv = usb_get_serial_port_data(port);
+- if (!priv) {
+- dbg("%s - bad port private data pointer - exiting", __func__);
+- goto out;
+- }
+-
+- if (urb != port->read_urb)
+- dev_err(&port->dev, "%s - Not my urb!\n", __func__);
+-
+ if (status) {
+ /* This will happen at close every time so it is a dbg not an
+ err */
+@@ -2050,9 +2025,8 @@ static void ftdi_read_bulk_callback(stru
+ goto out;
+ }
+
++ priv = usb_get_serial_port_data(port);
+ ftdi_process_read(&priv->rx_work.work);
+-out:
+- tty_kref_put(tty);
+ } /* ftdi_read_bulk_callback */
+
+
+
+
+From linux@linux.site Fri Oct 16 10:11:52 2009
+Message-Id: <20091016171151.547264022@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:03 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Johan Hovold <jhovold@gmail.com>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [10/46] USB: ftdi_sio: re-implement read processing
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=usb-ftdi_sio-re-implement-read-processing.patch
+Content-Length: 16103
+Lines: 517
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Johan Hovold <jhovold@gmail.com>
+
+commit cc01f17d5cb8ac604108515735aeca72e17944c1 upstream.
+
+- Re-structure read processing.
+ - Kill obsolete work queue and always push to tty in completion handler.
+ - Use tty_insert_flip_string instead of per character push when
+ possible.
+ - Fix stalled-read regression in 2.6.31 by using urb status to
+ determine when port is closed rather than port count.
+ - Fix race with open/close by checking ASYNCB_INITIALIZED in
+ unthrottle.
+ - Kill private rx_flag and lock and use throttle flags in
+ usb_serial_port instead.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 383 ++++++++++++++----------------------------
+ 1 file changed, 131 insertions(+), 252 deletions(-)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -76,12 +76,7 @@ struct ftdi_private {
+ unsigned long last_dtr_rts; /* saved modem control outputs */
+ wait_queue_head_t delta_msr_wait; /* Used for TIOCMIWAIT */
+ char prev_status, diff_status; /* Used for TIOCMIWAIT */
+- __u8 rx_flags; /* receive state flags (throttling) */
+- spinlock_t rx_lock; /* spinlock for receive state */
+- struct delayed_work rx_work;
+ struct usb_serial_port *port;
+- int rx_processed;
+-
+ __u16 interface; /* FT2232C, FT2232H or FT4232H port interface
+ (0 for FT232/245) */
+
+@@ -736,10 +731,6 @@ static const char *ftdi_chip_name[] = {
+ /* Constants for read urb and write urb */
+ #define BUFSZ 512
+
+-/* rx_flags */
+-#define THROTTLED 0x01
+-#define ACTUALLY_THROTTLED 0x02
+-
+ /* Used for TIOCMIWAIT */
+ #define FTDI_STATUS_B0_MASK (FTDI_RS0_CTS | FTDI_RS0_DSR | FTDI_RS0_RI | FTDI_RS0_RLSD)
+ #define FTDI_STATUS_B1_MASK (FTDI_RS_BI)
+@@ -763,7 +754,7 @@ static int ftdi_write_room(struct tty_s
+ static int ftdi_chars_in_buffer(struct tty_struct *tty);
+ static void ftdi_write_bulk_callback(struct urb *urb);
+ static void ftdi_read_bulk_callback(struct urb *urb);
+-static void ftdi_process_read(struct work_struct *work);
++static void ftdi_process_read(struct usb_serial_port *port);
+ static void ftdi_set_termios(struct tty_struct *tty,
+ struct usb_serial_port *port, struct ktermios *old);
+ static int ftdi_tiocmget(struct tty_struct *tty, struct file *file);
+@@ -1526,7 +1517,6 @@ static int ftdi_sio_port_probe(struct us
+ }
+
+ kref_init(&priv->kref);
+- spin_lock_init(&priv->rx_lock);
+ spin_lock_init(&priv->tx_lock);
+ init_waitqueue_head(&priv->delta_msr_wait);
+ /* This will push the characters through immediately rather
+@@ -1548,7 +1538,6 @@ static int ftdi_sio_port_probe(struct us
+ port->read_urb->transfer_buffer_length = BUFSZ;
+ }
+
+- INIT_DELAYED_WORK(&priv->rx_work, ftdi_process_read);
+ priv->port = port;
+
+ /* Free port's existing write urb and transfer buffer. */
+@@ -1685,6 +1674,26 @@ static int ftdi_sio_port_remove(struct u
+ return 0;
+ }
+
++static int ftdi_submit_read_urb(struct usb_serial_port *port, gfp_t mem_flags)
++{
++ struct urb *urb = port->read_urb;
++ struct usb_serial *serial = port->serial;
++ int result;
++
++ usb_fill_bulk_urb(urb, serial->dev,
++ usb_rcvbulkpipe(serial->dev,
++ port->bulk_in_endpointAddress),
++ urb->transfer_buffer,
++ urb->transfer_buffer_length,
++ ftdi_read_bulk_callback, port);
++ result = usb_submit_urb(urb, mem_flags);
++ if (result)
++ dev_err(&port->dev,
++ "%s - failed submitting read urb, error %d\n",
++ __func__, result);
++ return result;
++}
++
+ static int ftdi_open(struct tty_struct *tty,
+ struct usb_serial_port *port, struct file *filp)
+ { /* ftdi_open */
+@@ -1719,23 +1728,14 @@ static int ftdi_open(struct tty_struct *
+ ftdi_set_termios(tty, port, tty->termios);
+
+ /* Not throttled */
+- spin_lock_irqsave(&priv->rx_lock, flags);
+- priv->rx_flags &= ~(THROTTLED | ACTUALLY_THROTTLED);
+- spin_unlock_irqrestore(&priv->rx_lock, flags);
++ spin_lock_irqsave(&port->lock, flags);
++ port->throttled = 0;
++ port->throttle_req = 0;
++ spin_unlock_irqrestore(&port->lock, flags);
+
+ /* Start reading from the device */
+- priv->rx_processed = 0;
+- usb_fill_bulk_urb(port->read_urb, dev,
+- usb_rcvbulkpipe(dev, port->bulk_in_endpointAddress),
+- port->read_urb->transfer_buffer,
+- port->read_urb->transfer_buffer_length,
+- ftdi_read_bulk_callback, port);
+- result = usb_submit_urb(port->read_urb, GFP_KERNEL);
+- if (result)
+- dev_err(&port->dev,
+- "%s - failed submitting read urb, error %d\n",
+- __func__, result);
+- else
++ result = ftdi_submit_read_urb(port, GFP_KERNEL);
++ if (!result)
+ kref_get(&priv->kref);
+
+ return result;
+@@ -1781,10 +1781,6 @@ static void ftdi_close(struct usb_serial
+
+ dbg("%s", __func__);
+
+-
+- /* cancel any scheduled reading */
+- cancel_delayed_work_sync(&priv->rx_work);
+-
+ /* shutdown our bulk read */
+ usb_kill_urb(port->read_urb);
+ kref_put(&priv->kref, ftdi_sio_priv_release);
+@@ -2007,236 +2003,121 @@ static int ftdi_chars_in_buffer(struct t
+ return buffered;
+ }
+
+-static void ftdi_read_bulk_callback(struct urb *urb)
++static int ftdi_process_packet(struct tty_struct *tty,
++ struct usb_serial_port *port, struct ftdi_private *priv,
++ char *packet, int len)
+ {
+- struct usb_serial_port *port = urb->context;
+- struct ftdi_private *priv;
+- int status = urb->status;
+-
+- dbg("%s - port %d", __func__, port->number);
+-
+- if (port->port.count <= 0)
+- return;
+-
+- if (status) {
+- /* This will happen at close every time so it is a dbg not an
+- err */
+- dbg("(this is ok on close) nonzero read bulk status received: %d", status);
+- goto out;
+- }
+-
+- priv = usb_get_serial_port_data(port);
+- ftdi_process_read(&priv->rx_work.work);
+-} /* ftdi_read_bulk_callback */
+-
+-
+-static void ftdi_process_read(struct work_struct *work)
+-{ /* ftdi_process_read */
+- struct ftdi_private *priv =
+- container_of(work, struct ftdi_private, rx_work.work);
+- struct usb_serial_port *port = priv->port;
+- struct urb *urb;
+- struct tty_struct *tty;
+- char error_flag;
+- unsigned char *data;
+-
+ int i;
+- int result;
+- int need_flip;
+- int packet_offset;
+- unsigned long flags;
++ char status;
++ char flag;
++ char *ch;
+
+ dbg("%s - port %d", __func__, port->number);
+
+- if (port->port.count <= 0)
+- return;
+-
+- tty = tty_port_tty_get(&port->port);
+- if (!tty) {
+- dbg("%s - bad tty pointer - exiting", __func__);
+- return;
++ if (len < 2) {
++ dbg("malformed packet");
++ return 0;
+ }
+
+- priv = usb_get_serial_port_data(port);
+- if (!priv) {
+- dbg("%s - bad port private data pointer - exiting", __func__);
+- goto out;
++ /* Compare new line status to the old one, signal if different/
++ N.B. packet may be processed more than once, but differences
++ are only processed once. */
++ status = packet[0] & FTDI_STATUS_B0_MASK;
++ if (status != priv->prev_status) {
++ priv->diff_status |= status ^ priv->prev_status;
++ wake_up_interruptible(&priv->delta_msr_wait);
++ priv->prev_status = status;
+ }
+
+- urb = port->read_urb;
+- if (!urb) {
+- dbg("%s - bad read_urb pointer - exiting", __func__);
+- goto out;
++ /*
++ * Although the device uses a bitmask and hence can have multiple
++ * errors on a packet - the order here sets the priority the error is
++ * returned to the tty layer.
++ */
++ flag = TTY_NORMAL;
++ if (packet[1] & FTDI_RS_OE) {
++ flag = TTY_OVERRUN;
++ dbg("OVERRRUN error");
+ }
+-
+- data = urb->transfer_buffer;
+-
+- if (priv->rx_processed) {
+- dbg("%s - already processed: %d bytes, %d remain", __func__,
+- priv->rx_processed,
+- urb->actual_length - priv->rx_processed);
+- } else {
+- /* The first two bytes of every read packet are status */
+- if (urb->actual_length > 2)
+- usb_serial_debug_data(debug, &port->dev, __func__,
+- urb->actual_length, data);
+- else
+- dbg("Status only: %03oo %03oo", data[0], data[1]);
++ if (packet[1] & FTDI_RS_BI) {
++ flag = TTY_BREAK;
++ dbg("BREAK received");
++ usb_serial_handle_break(port);
++ }
++ if (packet[1] & FTDI_RS_PE) {
++ flag = TTY_PARITY;
++ dbg("PARITY error");
++ }
++ if (packet[1] & FTDI_RS_FE) {
++ flag = TTY_FRAME;
++ dbg("FRAMING error");
+ }
+
++ len -= 2;
++ if (!len)
++ return 0; /* status only */
++ ch = packet + 2;
+
+- /* TO DO -- check for hung up line and handle appropriately: */
+- /* send hangup */
+- /* See acm.c - you do a tty_hangup - eg tty_hangup(tty) */
+- /* if CD is dropped and the line is not CLOCAL then we should hangup */
+-
+- need_flip = 0;
+- for (packet_offset = priv->rx_processed;
+- packet_offset < urb->actual_length; packet_offset += priv->max_packet_size) {
+- int length;
+-
+- /* Compare new line status to the old one, signal if different/
+- N.B. packet may be processed more than once, but differences
+- are only processed once. */
+- char new_status = data[packet_offset + 0] &
+- FTDI_STATUS_B0_MASK;
+- if (new_status != priv->prev_status) {
+- priv->diff_status |=
+- new_status ^ priv->prev_status;
+- wake_up_interruptible(&priv->delta_msr_wait);
+- priv->prev_status = new_status;
+- }
+-
+- length = min_t(u32, priv->max_packet_size, urb->actual_length-packet_offset)-2;
+- if (length < 0) {
+- dev_err(&port->dev, "%s - bad packet length: %d\n",
+- __func__, length+2);
+- length = 0;
++ if (!(port->console && port->sysrq) && flag == TTY_NORMAL)
++ tty_insert_flip_string(tty, ch, len);
++ else {
++ for (i = 0; i < len; i++, ch++) {
++ if (!usb_serial_handle_sysrq_char(tty, port, *ch))
++ tty_insert_flip_char(tty, *ch, flag);
+ }
++ }
++ return len;
++}
+
+- if (priv->rx_flags & THROTTLED) {
+- dbg("%s - throttled", __func__);
+- break;
+- }
+- if (tty_buffer_request_room(tty, length) < length) {
+- /* break out & wait for throttling/unthrottling to
+- happen */
+- dbg("%s - receive room low", __func__);
+- break;
+- }
++static void ftdi_process_read(struct usb_serial_port *port)
++{
++ struct urb *urb = port->read_urb;
++ struct tty_struct *tty;
++ struct ftdi_private *priv = usb_get_serial_port_data(port);
++ char *data = (char *)urb->transfer_buffer;
++ int i;
++ int len;
++ int count = 0;
+
+- /* Handle errors and break */
+- error_flag = TTY_NORMAL;
+- /* Although the device uses a bitmask and hence can have
+- multiple errors on a packet - the order here sets the
+- priority the error is returned to the tty layer */
+-
+- if (data[packet_offset+1] & FTDI_RS_OE) {
+- error_flag = TTY_OVERRUN;
+- dbg("OVERRRUN error");
+- }
+- if (data[packet_offset+1] & FTDI_RS_BI) {
+- error_flag = TTY_BREAK;
+- dbg("BREAK received");
+- usb_serial_handle_break(port);
+- }
+- if (data[packet_offset+1] & FTDI_RS_PE) {
+- error_flag = TTY_PARITY;
+- dbg("PARITY error");
+- }
+- if (data[packet_offset+1] & FTDI_RS_FE) {
+- error_flag = TTY_FRAME;
+- dbg("FRAMING error");
+- }
+- if (length > 0) {
+- for (i = 2; i < length+2; i++) {
+- /* Note that the error flag is duplicated for
+- every character received since we don't know
+- which character it applied to */
+- if (!usb_serial_handle_sysrq_char(tty, port,
+- data[packet_offset + i]))
+- tty_insert_flip_char(tty,
+- data[packet_offset + i],
+- error_flag);
+- }
+- need_flip = 1;
+- }
++ tty = tty_port_tty_get(&port->port);
++ if (!tty)
++ return;
+
+-#ifdef NOT_CORRECT_BUT_KEEPING_IT_FOR_NOW
+- /* if a parity error is detected you get status packets forever
+- until a character is sent without a parity error.
+- This doesn't work well since the application receives a
+- never ending stream of bad data - even though new data
+- hasn't been sent. Therefore I (bill) have taken this out.
+- However - this might make sense for framing errors and so on
+- so I am leaving the code in for now.
+- */
+- else {
+- if (error_flag != TTY_NORMAL) {
+- dbg("error_flag is not normal");
+- /* In this case it is just status - if that is
+- an error send a bad character */
+- if (tty->flip.count >= TTY_FLIPBUF_SIZE)
+- tty_flip_buffer_push(tty);
+- tty_insert_flip_char(tty, 0xff, error_flag);
+- need_flip = 1;
+- }
+- }
+-#endif
+- } /* "for(packet_offset=0..." */
++ for (i = 0; i < urb->actual_length; i += priv->max_packet_size) {
++ len = min_t(int, urb->actual_length - i, priv->max_packet_size);
++ count += ftdi_process_packet(tty, port, priv, &data[i], len);
++ }
+
+- /* Low latency */
+- if (need_flip)
++ if (count)
+ tty_flip_buffer_push(tty);
++ tty_kref_put(tty);
++}
+
+- if (packet_offset < urb->actual_length) {
+- /* not completely processed - record progress */
+- priv->rx_processed = packet_offset;
+- dbg("%s - incomplete, %d bytes processed, %d remain",
+- __func__, packet_offset,
+- urb->actual_length - packet_offset);
+- /* check if we were throttled while processing */
+- spin_lock_irqsave(&priv->rx_lock, flags);
+- if (priv->rx_flags & THROTTLED) {
+- priv->rx_flags |= ACTUALLY_THROTTLED;
+- spin_unlock_irqrestore(&priv->rx_lock, flags);
+- dbg("%s - deferring remainder until unthrottled",
+- __func__);
+- goto out;
+- }
+- spin_unlock_irqrestore(&priv->rx_lock, flags);
+- /* if the port is closed stop trying to read */
+- if (port->port.count > 0)
+- /* delay processing of remainder */
+- schedule_delayed_work(&priv->rx_work, 1);
+- else
+- dbg("%s - port is closed", __func__);
+- goto out;
+- }
+-
+- /* urb is completely processed */
+- priv->rx_processed = 0;
++static void ftdi_read_bulk_callback(struct urb *urb)
++{
++ struct usb_serial_port *port = urb->context;
++ unsigned long flags;
+
+- /* if the port is closed stop trying to read */
+- if (port->port.count > 0) {
+- /* Continue trying to always read */
+- usb_fill_bulk_urb(port->read_urb, port->serial->dev,
+- usb_rcvbulkpipe(port->serial->dev,
+- port->bulk_in_endpointAddress),
+- port->read_urb->transfer_buffer,
+- port->read_urb->transfer_buffer_length,
+- ftdi_read_bulk_callback, port);
++ dbg("%s - port %d", __func__, port->number);
+
+- result = usb_submit_urb(port->read_urb, GFP_ATOMIC);
+- if (result)
+- dev_err(&port->dev,
+- "%s - failed resubmitting read urb, error %d\n",
+- __func__, result);
++ if (urb->status) {
++ dbg("%s - nonzero read bulk status received: %d",
++ __func__, urb->status);
++ return;
+ }
+-out:
+- tty_kref_put(tty);
+-} /* ftdi_process_read */
+
++ usb_serial_debug_data(debug, &port->dev, __func__,
++ urb->actual_length, urb->transfer_buffer);
++ ftdi_process_read(port);
++
++ spin_lock_irqsave(&port->lock, flags);
++ port->throttled = port->throttle_req;
++ if (!port->throttled) {
++ spin_unlock_irqrestore(&port->lock, flags);
++ ftdi_submit_read_urb(port, GFP_ATOMIC);
++ } else
++ spin_unlock_irqrestore(&port->lock, flags);
++}
+
+ static void ftdi_break_ctl(struct tty_struct *tty, int break_state)
+ {
+@@ -2568,33 +2449,31 @@ static int ftdi_ioctl(struct tty_struct
+ static void ftdi_throttle(struct tty_struct *tty)
+ {
+ struct usb_serial_port *port = tty->driver_data;
+- struct ftdi_private *priv = usb_get_serial_port_data(port);
+ unsigned long flags;
+
+ dbg("%s - port %d", __func__, port->number);
+
+- spin_lock_irqsave(&priv->rx_lock, flags);
+- priv->rx_flags |= THROTTLED;
+- spin_unlock_irqrestore(&priv->rx_lock, flags);
++ spin_lock_irqsave(&port->lock, flags);
++ port->throttle_req = 1;
++ spin_unlock_irqrestore(&port->lock, flags);
+ }
+
+-
+-static void ftdi_unthrottle(struct tty_struct *tty)
++void ftdi_unthrottle(struct tty_struct *tty)
+ {
+ struct usb_serial_port *port = tty->driver_data;
+- struct ftdi_private *priv = usb_get_serial_port_data(port);
+- int actually_throttled;
++ int was_throttled;
+ unsigned long flags;
+
+ dbg("%s - port %d", __func__, port->number);
+
+- spin_lock_irqsave(&priv->rx_lock, flags);
+- actually_throttled = priv->rx_flags & ACTUALLY_THROTTLED;
+- priv->rx_flags &= ~(THROTTLED | ACTUALLY_THROTTLED);
+- spin_unlock_irqrestore(&priv->rx_lock, flags);
+-
+- if (actually_throttled)
+- schedule_delayed_work(&priv->rx_work, 0);
++ spin_lock_irqsave(&port->lock, flags);
++ was_throttled = port->throttled;
++ port->throttled = port->throttle_req = 0;
++ spin_unlock_irqrestore(&port->lock, flags);
++
++ /* Resubmit urb if throttled and open. */
++ if (was_throttled && test_bit(ASYNCB_INITIALIZED, &port->port.flags))
++ ftdi_submit_read_urb(port, GFP_KERNEL);
+ }
+
+ static int __init ftdi_init(void)
+
+
+From linux@linux.site Fri Oct 16 10:11:52 2009
+Message-Id: <20091016171152.052543321@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:04 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Johan Hovold <jhovold@gmail.com>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [11/46] USB: pl2303: fix error characters not being reported to ldisc
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=usb-pl2303-fix-error-characters-not-being-reported-to-ldisc.patch
+Content-Length: 1139
+Lines: 37
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Johan Hovold <jhovold@gmail.com>
+
+commit 9388e2e71a51fab0aa2309bbb45e8a23d89a95a9 upstream.
+
+Fix regression introduced by commit
+d4fc4a7bfc2dee626f4fec1e209e58eaa4312de6 (tty: Fix the PL2303 private
+methods for sysrq).
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/pl2303.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -995,13 +995,15 @@ static void pl2303_push_data(struct tty_
+ /* overrun is special, not associated with a char */
+ if (line_status & UART_OVERRUN_ERROR)
+ tty_insert_flip_char(tty, 0, TTY_OVERRUN);
+- if (port->console && port->sysrq) {
++
++ if (tty_flag == TTY_NORMAL && !(port->console && port->sysrq))
++ tty_insert_flip_string(tty, data, urb->actual_length);
++ else {
+ int i;
+ for (i = 0; i < urb->actual_length; ++i)
+ if (!usb_serial_handle_sysrq_char(tty, port, data[i]))
+ tty_insert_flip_char(tty, data[i], tty_flag);
+- } else
+- tty_insert_flip_string(tty, data, urb->actual_length);
++ }
+ tty_flip_buffer_push(tty);
+ }
+
+
+
+From linux@linux.site Fri Oct 16 10:11:53 2009
+Message-Id: <20091016171152.630610726@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:05 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Johan Hovold <jhovold@gmail.com>,
+ Oliver Neukum <oliver@neukum.org>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [12/46] USB: digi_acceleport: Fix broken unthrottle.
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=usb-digi_acceleport-fix-broken-unthrottle.patch
+Content-Length: 1047
+Lines: 39
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Johan Hovold <jhovold@gmail.com>
+
+commit ba6b702f85a61561d329c4c11d3ed95604924f9a upstream.
+
+This patch fixes a regression introduced in
+39892da44b21b5362eb848ca424d73a25ccc488f.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Acked-by: Oliver Neukum <oliver@neukum.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/digi_acceleport.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/serial/digi_acceleport.c
++++ b/drivers/usb/serial/digi_acceleport.c
+@@ -899,16 +899,16 @@ static void digi_rx_unthrottle(struct tt
+
+ spin_lock_irqsave(&priv->dp_port_lock, flags);
+
+- /* turn throttle off */
+- priv->dp_throttled = 0;
+- priv->dp_throttle_restart = 0;
+-
+ /* restart read chain */
+ if (priv->dp_throttle_restart) {
+ port->read_urb->dev = port->serial->dev;
+ ret = usb_submit_urb(port->read_urb, GFP_ATOMIC);
+ }
+
++ /* turn throttle off */
++ priv->dp_throttled = 0;
++ priv->dp_throttle_restart = 0;
++
+ spin_unlock_irqrestore(&priv->dp_port_lock, flags);
+
+ if (ret)
+
+
+From linux@linux.site Fri Oct 16 10:11:53 2009
+Message-Id: <20091016171153.150585044@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:06 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Stern <stern@rowland.harvard.edu>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [13/46] USB: serial: dont call release without attach
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=usb-serial-don-t-call-release-without-attach.patch
+Content-Length: 1978
+Lines: 61
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit a4720c650b68a5fe7faed2edeb0ad12645f7ae63 upstream.
+
+This patch (as1295) fixes a recently-added bug in the USB serial core.
+If certain kinds of errors occur during probing, the core may call a
+serial driver's release method without previously calling the attach
+method. This causes some drivers (io_ti in particular) to perform an
+invalid memory access.
+
+The patch adds a new flag to keep track of whether or not attach has
+been called.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Tested-by: Jean-Denis Girard <jd.girard@sysnux.pf>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/usb-serial.c | 6 +++++-
+ include/linux/usb/serial.h | 1 +
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -155,7 +155,8 @@ static void destroy_serial(struct kref *
+ if (serial->minor != SERIAL_TTY_NO_MINOR)
+ return_serial(serial);
+
+- serial->type->release(serial);
++ if (serial->attached)
++ serial->type->release(serial);
+
+ /* Now that nothing is using the ports, they can be freed */
+ for (i = 0; i < serial->num_port_pointers; ++i) {
+@@ -1060,12 +1061,15 @@ int usb_serial_probe(struct usb_interfac
+ module_put(type->driver.owner);
+ if (retval < 0)
+ goto probe_error;
++ serial->attached = 1;
+ if (retval > 0) {
+ /* quietly accept this device, but don't bind to a
+ serial port as it's about to disappear */
+ serial->num_ports = 0;
+ goto exit;
+ }
++ } else {
++ serial->attached = 1;
+ }
+
+ if (get_free_serial(serial, num_ports, &minor) == NULL) {
+--- a/include/linux/usb/serial.h
++++ b/include/linux/usb/serial.h
+@@ -148,6 +148,7 @@ struct usb_serial {
+ struct usb_interface *interface;
+ unsigned char disconnected:1;
+ unsigned char suspending:1;
++ unsigned char attached:1;
+ unsigned char minor;
+ unsigned char num_ports;
+ unsigned char num_port_pointers;
+
+
+From linux@linux.site Fri Oct 16 10:11:54 2009
+Message-Id: <20091016171153.640382260@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:07 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Peter Magdina <peter@magdina.sk>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [14/46] USB: option: Toshiba G450 device id
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=usb-option-toshiba-g450-device-id.patch
+Content-Length: 1186
+Lines: 30
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Peter Magdina <peter@magdina.sk>
+
+commit 75f47214f90e996eb184eb6e6b0e8b817999c8f7 upstream.
+
+Signed-off-by: Peter Magdina <peter@magdina.sk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -319,6 +319,7 @@ static int option_resume(struct usb_ser
+ /* TOSHIBA PRODUCTS */
+ #define TOSHIBA_VENDOR_ID 0x0930
+ #define TOSHIBA_PRODUCT_HSDPA_MINICARD 0x1302
++#define TOSHIBA_PRODUCT_G450 0x0d45
+
+ #define ALINK_VENDOR_ID 0x1e0e
+ #define ALINK_PRODUCT_3GU 0x9200
+@@ -582,6 +583,7 @@ static struct usb_device_id option_ids[]
+ { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H21_4523) },
+ { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H20_4515) },
+ { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H20_4519) },
++ { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_G450) },
+ { USB_DEVICE(TOSHIBA_VENDOR_ID, TOSHIBA_PRODUCT_HSDPA_MINICARD ) }, /* Toshiba 3G HSDPA == Novatel Expedite EU870D MiniCard */
+ { USB_DEVICE(ALINK_VENDOR_ID, 0x9000) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) },
+
+
+From linux@linux.site Fri Oct 16 10:11:54 2009
+Message-Id: <20091016171154.161866512@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:08 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Stern <stern@rowland.harvard.edu>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [15/46] USB: ipaq: fix oops when device is plugged in
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=usb-ipaq-fix-oops-when-device-is-plugged-in.patch
+Content-Length: 1279
+Lines: 37
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 06bad89da686f6323e95cf925105e8cf88d87caf upstream.
+
+This patch (as1293) fixes a problem with the ipaq serial driver. It
+tries to bind to all the interfaces, even those that don't have enough
+endpoints. The symptom is an invalid memory reference and oops when
+the device is plugged in.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Tested-by: Matthias Geissert <geissert@mathematik.tu-darmstadt.de>
+Tested-by: Tilman Schmidt <tilman@imap.cc>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ipaq.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/usb/serial/ipaq.c
++++ b/drivers/usb/serial/ipaq.c
+@@ -971,6 +971,15 @@ static int ipaq_calc_num_ports(struct us
+ static int ipaq_startup(struct usb_serial *serial)
+ {
+ dbg("%s", __func__);
++
++ /* Some of the devices in ipaq_id_table[] are composite, and we
++ * shouldn't bind to all the interfaces. This test will rule out
++ * some obviously invalid possibilities.
++ */
++ if (serial->num_bulk_in < serial->num_ports ||
++ serial->num_bulk_out < serial->num_ports)
++ return -ENODEV;
++
+ if (serial->dev->actconfig->desc.bConfigurationValue != 1) {
+ /*
+ * FIXME: HP iPaq rx3715, possibly others, have 1 config that
+
+
+From linux@linux.site Fri Oct 16 10:11:55 2009
+Message-Id: <20091016171154.742172179@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:09 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ =?ISO-8859-15?q?=C3=89ric=20Piel?= <eric.piel@tremplin-utc.net>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [16/46] USB: cp210x: Add support for the DW700 UART
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=usb-cp210x-add-support-for-the-dw700-uart.patch
+Content-Length: 894
+Lines: 26
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Éric Piel <eric.piel@tremplin-utc.net>
+
+commit 6f88139eb9eae8003683689f93402264a73fb754 upstream.
+
+In the Dell inspiron mini 10, the GPS is connected via a cp2102. This patch
+adds detection of this USB device. (I haven't managed to use the GPS under
+Linux yet, though)
+
+Signed-off-by: Éric Piel <eric.piel@tremplin-utc.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/cp210x.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -114,6 +114,7 @@ static struct usb_device_id id_table []
+ { USB_DEVICE(0x166A, 0x0303) }, /* Clipsal 5500PCU C-Bus USB interface */
+ { USB_DEVICE(0x16D6, 0x0001) }, /* Jablotron serial interface */
+ { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
++ { USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */
+ { } /* Terminating Entry */
+ };
+
+
+
+From linux@linux.site Fri Oct 16 10:11:55 2009
+Message-Id: <20091016171155.269801577@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:10 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Joris van Rantwijk <jorispubl@xs4all.nl>,
+ Johan Hovold <jhovold@gmail.com>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [17/46] USB: Fix throttling in generic usbserial driver
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=usb-fix-throttling-in-generic-usbserial-driver.patch
+Content-Length: 909
+Lines: 29
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Joris van Rantwijk <jorispubl@xs4all.nl>
+
+commit 63a9609513007537a0b23ac511fd73f9bd609ea0 upstream.
+
+The generic usbserial driver in Linux 2.6.31 halts its receiving
+channel in response to throttle requests from the line discipline.
+Unfortunately it drops the contents of the first URB received after
+throttling takes effect. This patch corrects that problem.
+
+Signed-off-by: Joris van Rantwijk <jorispubl@xs4all.nl>
+Acked-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/generic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/generic.c
++++ b/drivers/usb/serial/generic.c
+@@ -530,7 +530,7 @@ void usb_serial_generic_unthrottle(struc
+
+ if (was_throttled) {
+ /* Resume reading from device */
+- usb_serial_generic_resubmit_read_urb(port, GFP_KERNEL);
++ flush_and_resubmit_read_urb(port);
+ }
+ }
+
+
+
+From linux@linux.site Fri Oct 16 10:11:56 2009
+Message-Id: <20091016171155.847930984@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:11 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Stern <stern@rowland.harvard.edu>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [18/46] USB: storage: When a device returns no sense data, call it a Hardware Error
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=usb-storage-when-a-device-returns-no-sense-data-call-it-a-hardware-error.patch
+Content-Length: 2655
+Lines: 71
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit f1a0743bc0e7a30c032b1eb78f6a2b0f805b4597 upstream.
+
+This patch (as1294) fixes a problem that has plagued users for several
+kernel releases. Some USB mass-storage devices don't return any sense
+data when they encounter certain kinds of errors. The SCSI layer
+interprets this to mean that the operation should be retried, and the
+same thing happens -- over and over again with no limit. In some
+circumstances (such as when a bus reset occurs) that is the right
+thing to do, but not here.
+
+The patch checks for this condition (a transport failure with no sense
+data) and changes the result code to DID_ERROR and the sense code to
+Hardware Error. This does get only a limited number of retries, and
+so the command will fail relatively quickly instead of getting stuck
+in an infinite loop.
+
+This fixes a large part of Bugzilla #14118.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Tested-by: Mantas Mikulenas <grawity@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/storage/transport.c | 29 ++++++++++++++++++++++-------
+ 1 file changed, 22 insertions(+), 7 deletions(-)
+
+--- a/drivers/usb/storage/transport.c
++++ b/drivers/usb/storage/transport.c
+@@ -768,17 +768,32 @@ void usb_stor_invoke_transport(struct sc
+ /* set the result so the higher layers expect this data */
+ srb->result = SAM_STAT_CHECK_CONDITION;
+
+- /* If things are really okay, then let's show that. Zero
+- * out the sense buffer so the higher layers won't realize
+- * we did an unsolicited auto-sense. */
+- if (result == USB_STOR_TRANSPORT_GOOD &&
+- /* Filemark 0, ignore EOM, ILI 0, no sense */
++ /* We often get empty sense data. This could indicate that
++ * everything worked or that there was an unspecified
++ * problem. We have to decide which.
++ */
++ if ( /* Filemark 0, ignore EOM, ILI 0, no sense */
+ (srb->sense_buffer[2] & 0xaf) == 0 &&
+ /* No ASC or ASCQ */
+ srb->sense_buffer[12] == 0 &&
+ srb->sense_buffer[13] == 0) {
+- srb->result = SAM_STAT_GOOD;
+- srb->sense_buffer[0] = 0x0;
++
++ /* If things are really okay, then let's show that.
++ * Zero out the sense buffer so the higher layers
++ * won't realize we did an unsolicited auto-sense.
++ */
++ if (result == USB_STOR_TRANSPORT_GOOD) {
++ srb->result = SAM_STAT_GOOD;
++ srb->sense_buffer[0] = 0x0;
++
++ /* If there was a problem, report an unspecified
++ * hardware error to prevent the higher layers from
++ * entering an infinite retry loop.
++ */
++ } else {
++ srb->result = DID_ERROR << 16;
++ srb->sense_buffer[2] = HARDWARE_ERROR;
++ }
+ }
+ }
+
+
+
+From linux@linux.site Fri Oct 16 10:11:56 2009
+Message-Id: <20091016171156.344026469@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:12 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Albin Tonnerre <albin.tonnerre@free-electrons.com>,
+ Mikael Starvik <starvik@axis.com>,
+ Jesper Nilsson <jesper.nilsson@axis.com>,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>,
+ Paul Mackerras <paulus@samba.org>,
+ "David S. Miller" <davem@davemloft.net>,
+ Jeff Dike <jdike@addtoit.com>,
+ Chris Zankel <chris@zankel.net>,
+ Sam Ravnborg <sam@ravnborg.org>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [19/46] arm, cris, mips, sparc, powerpc, um, xtensa: fix build with bash 4.0
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=arm-cris-mips-sparc-powerpc-um-xtensa-fix-build-with-bash-4.0.patch
+Content-Length: 10048
+Lines: 312
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Sam Ravnborg <sam@ravnborg.org>
+
+commit 51b563fc93c8cb5bff1d67a0a71c374e4a4ea049 upstream.
+
+Albin Tonnerre <albin.tonnerre@free-electrons.com> reported:
+
+ Bash 4 filters out variables which contain a dot in them.
+ This happends to be the case of CPPFLAGS_vmlinux.lds.
+ This is rather unfortunate, as it now causes
+ build failures when using SHELL=/bin/bash to compile,
+ or when bash happens to be used by make (eg when it's /bin/sh)
+
+Remove the common definition of CPPFLAGS_vmlinux.lds by
+pushing relevant stuff to either Makefile.build or the
+arch specific kernel/Makefile where we build the linker script.
+
+This is also nice cleanup as we move the information out where
+it is used.
+
+Notes for the different architectures touched:
+
+arm - we use an already exported symbol
+cris - we use a config symbol aleady available
+ [Not build tested]
+mips - the jiffies complexity has moved to vmlinux.lds.S where we need it.
+ Added a few variables to CPPFLAGS - they are only used by
+ the linker script.
+ [Not build tested]
+powerpc - removed assignment that is not needed
+ [not build tested]
+sparc - simplified it using $(BITS)
+um - introduced a few new exported variables to deal with this
+xtensa - added options to CPP invocation
+ [not build tested]
+
+Cc: Albin Tonnerre <albin.tonnerre@free-electrons.com>
+Cc: Russell King <linux@arm.linux.org.uk>
+Cc: Mikael Starvik <starvik@axis.com>
+Cc: Jesper Nilsson <jesper.nilsson@axis.com>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Jeff Dike <jdike@addtoit.com>
+Cc: Chris Zankel <chris@zankel.net>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Makefile | 5 -----
+ arch/arm/Makefile | 2 +-
+ arch/arm/kernel/Makefile | 3 ++-
+ arch/cris/Makefile | 2 --
+ arch/cris/kernel/Makefile | 1 +
+ arch/mips/Makefile | 27 +++------------------------
+ arch/mips/kernel/vmlinux.lds.S | 13 +++++++++++--
+ arch/powerpc/Makefile | 2 --
+ arch/sparc/Makefile | 4 ----
+ arch/sparc/kernel/Makefile | 6 +++++-
+ arch/um/Makefile | 9 ++++-----
+ arch/um/kernel/Makefile | 3 +++
+ arch/um/kernel/vmlinux.lds.S | 3 +++
+ arch/xtensa/kernel/Makefile | 3 ++-
+ scripts/Makefile.build | 3 ++-
+ 15 files changed, 37 insertions(+), 49 deletions(-)
+
+--- a/arch/arm/kernel/Makefile
++++ b/arch/arm/kernel/Makefile
+@@ -2,7 +2,8 @@
+ # Makefile for the linux kernel.
+ #
+
+-AFLAGS_head.o := -DTEXT_OFFSET=$(TEXT_OFFSET)
++CPPFLAGS_vmlinux.lds := -DTEXT_OFFSET=$(TEXT_OFFSET)
++AFLAGS_head.o := -DTEXT_OFFSET=$(TEXT_OFFSET)
+
+ ifdef CONFIG_DYNAMIC_FTRACE
+ CFLAGS_REMOVE_ftrace.o = -pg
+--- a/arch/arm/Makefile
++++ b/arch/arm/Makefile
+@@ -14,7 +14,7 @@ LDFLAGS_vmlinux :=-p --no-undefined -X
+ ifeq ($(CONFIG_CPU_ENDIAN_BE8),y)
+ LDFLAGS_vmlinux += --be8
+ endif
+-CPPFLAGS_vmlinux.lds = -DTEXT_OFFSET=$(TEXT_OFFSET)
++
+ OBJCOPYFLAGS :=-O binary -R .note -R .note.gnu.build-id -R .comment -S
+ GZFLAGS :=-9
+ #KBUILD_CFLAGS +=-pipe
+--- a/arch/cris/kernel/Makefile
++++ b/arch/cris/kernel/Makefile
+@@ -3,6 +3,7 @@
+ # Makefile for the linux kernel.
+ #
+
++CPPFLAGS_vmlinux.lds := -DDRAM_VIRTUAL_BASE=0x$(CONFIG_ETRAX_DRAM_VIRTUAL_BASE)
+ extra-y := vmlinux.lds
+
+ obj-y := process.o traps.o irq.o ptrace.o setup.o time.o sys_cris.o
+--- a/arch/cris/Makefile
++++ b/arch/cris/Makefile
+@@ -42,8 +42,6 @@ LD = $(CROSS_COMPILE)ld -mcrislinux
+
+ OBJCOPYFLAGS := -O binary -R .note -R .comment -S
+
+-CPPFLAGS_vmlinux.lds = -DDRAM_VIRTUAL_BASE=0x$(CONFIG_ETRAX_DRAM_VIRTUAL_BASE)
+-
+ KBUILD_AFLAGS += -mlinux -march=$(arch-y) $(inc)
+ KBUILD_CFLAGS += -mlinux -march=$(arch-y) -pipe $(inc)
+ KBUILD_CPPFLAGS += $(inc)
+--- a/arch/mips/kernel/vmlinux.lds.S
++++ b/arch/mips/kernel/vmlinux.lds.S
+@@ -9,7 +9,16 @@ PHDRS {
+ text PT_LOAD FLAGS(7); /* RWX */
+ note PT_NOTE FLAGS(4); /* R__ */
+ }
+-jiffies = JIFFIES;
++
++ifdef CONFIG_32BIT
++ ifdef CONFIG_CPU_LITTLE_ENDIAN
++ jiffies = jiffies_64;
++ else
++ jiffies = jiffies_64 + 4;
++ endif
++else
++ jiffies = jiffies_64;
++endif
+
+ SECTIONS
+ {
+@@ -28,7 +37,7 @@ SECTIONS
+ /* . = 0xa800000000300000; */
+ . = 0xffffffff80300000;
+ #endif
+- . = LOADADDR;
++ . = VMLINUX_LOAD_ADDRESS;
+ /* read-only */
+ _text = .; /* Text and read-only data */
+ .text : {
+--- a/arch/mips/Makefile
++++ b/arch/mips/Makefile
+@@ -615,16 +615,6 @@ endif
+ cflags-y += -I$(srctree)/arch/mips/include/asm/mach-generic
+ drivers-$(CONFIG_PCI) += arch/mips/pci/
+
+-ifdef CONFIG_32BIT
+-ifdef CONFIG_CPU_LITTLE_ENDIAN
+-JIFFIES = jiffies_64
+-else
+-JIFFIES = jiffies_64 + 4
+-endif
+-else
+-JIFFIES = jiffies_64
+-endif
+-
+ #
+ # Automatically detect the build format. By default we choose
+ # the elf format according to the load address.
+@@ -648,8 +638,9 @@ ifdef CONFIG_64BIT
+ endif
+
+ KBUILD_AFLAGS += $(cflags-y)
+-KBUILD_CFLAGS += $(cflags-y) \
+- -D"VMLINUX_LOAD_ADDRESS=$(load-y)"
++KBUILD_CFLAGS += $(cflags-y)
++KBUILD_CPPFLAGS += -D"VMLINUX_LOAD_ADDRESS=$(load-y)"
++KBUILD_CPPFLAGS += -D"DATAOFFSET=$(if $(dataoffset-y),$(dataoffset-y),0)"
+
+ LDFLAGS += -m $(ld-emul)
+
+@@ -664,18 +655,6 @@ endif
+
+ OBJCOPYFLAGS += --remove-section=.reginfo
+
+-#
+-# Choosing incompatible machines durings configuration will result in
+-# error messages during linking. Select a default linkscript if
+-# none has been choosen above.
+-#
+-
+-CPPFLAGS_vmlinux.lds := \
+- $(KBUILD_CFLAGS) \
+- -D"LOADADDR=$(load-y)" \
+- -D"JIFFIES=$(JIFFIES)" \
+- -D"DATAOFFSET=$(if $(dataoffset-y),$(dataoffset-y),0)"
+-
+ head-y := arch/mips/kernel/head.o arch/mips/kernel/init_task.o
+
+ libs-y += arch/mips/lib/
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -158,8 +158,6 @@ drivers-$(CONFIG_OPROFILE) += arch/power
+ # Default to zImage, override when needed
+ all: zImage
+
+-CPPFLAGS_vmlinux.lds := -Upowerpc
+-
+ BOOT_TARGETS = zImage zImage.initrd uImage zImage% dtbImage% treeImage.% cuImage.% simpleImage.%
+
+ PHONY += $(BOOT_TARGETS)
+--- a/arch/sparc/kernel/Makefile
++++ b/arch/sparc/kernel/Makefile
+@@ -7,7 +7,11 @@ ccflags-y := -Werror
+
+ extra-y := head_$(BITS).o
+ extra-y += init_task.o
+-extra-y += vmlinux.lds
++
++# Undefine sparc when processing vmlinux.lds - it is used
++# And teach CPP we are doing $(BITS) builds (for this case)
++CPPFLAGS_vmlinux.lds := -Usparc -m$(BITS)
++extra-y += vmlinux.lds
+
+ obj-$(CONFIG_SPARC32) += entry.o wof.o wuf.o
+ obj-$(CONFIG_SPARC32) += etrap_32.o
+--- a/arch/sparc/Makefile
++++ b/arch/sparc/Makefile
+@@ -31,7 +31,6 @@ export BITS := 32
+ #KBUILD_CFLAGS += -g -pipe -fcall-used-g5 -fcall-used-g7
+ KBUILD_CFLAGS += -m32 -pipe -mno-fpu -fcall-used-g5 -fcall-used-g7
+ KBUILD_AFLAGS += -m32
+-CPPFLAGS_vmlinux.lds += -m32
+
+ #LDFLAGS_vmlinux = -N -Ttext 0xf0004000
+ # Since 2.5.40, the first stage is left not btfix-ed.
+@@ -49,9 +48,6 @@ else
+
+ CHECKFLAGS += -D__sparc__ -D__sparc_v9__ -D__arch64__ -m64
+
+-# Undefine sparc when processing vmlinux.lds - it is used
+-# And teach CPP we are doing 64 bit builds (for this case)
+-CPPFLAGS_vmlinux.lds += -m64 -Usparc
+ LDFLAGS := -m elf64_sparc
+ export BITS := 64
+
+--- a/arch/um/kernel/Makefile
++++ b/arch/um/kernel/Makefile
+@@ -3,6 +3,9 @@
+ # Licensed under the GPL
+ #
+
++CPPFLAGS_vmlinux.lds := -U$(SUBARCH) -DSTART=$(LDS_START) \
++ -DELF_ARCH=$(LDS_ELF_ARCH) \
++ -DELF_FORMAT=$(LDS_ELF_FORMAT)
+ extra-y := vmlinux.lds
+ clean-files :=
+
+--- a/arch/um/kernel/vmlinux.lds.S
++++ b/arch/um/kernel/vmlinux.lds.S
+@@ -1,3 +1,6 @@
++
++KERNEL_STACK_SIZE = 4096 * (1 << CONFIG_KERNEL_STACK_ORDER);
++
+ #ifdef CONFIG_LD_SCRIPT_STATIC
+ #include "uml.lds.S"
+ #else
+--- a/arch/um/Makefile
++++ b/arch/um/Makefile
+@@ -96,11 +96,10 @@ CFLAGS_NO_HARDENING := $(call cc-option,
+ $(call cc-option, -fno-stack-protector,) \
+ $(call cc-option, -fno-stack-protector-all,)
+
+-CONFIG_KERNEL_STACK_ORDER ?= 2
+-STACK_SIZE := $(shell echo $$[ 4096 * (1 << $(CONFIG_KERNEL_STACK_ORDER)) ] )
+-
+-CPPFLAGS_vmlinux.lds = -U$(SUBARCH) -DSTART=$(START) -DELF_ARCH=$(ELF_ARCH) \
+- -DELF_FORMAT="$(ELF_FORMAT)" -DKERNEL_STACK_SIZE=$(STACK_SIZE)
++# Options used by linker script
++export LDS_START := $(START)
++export LDS_ELF_ARCH := $(ELF_ARCH)
++export LDS_ELF_FORMAT := $(ELF_FORMAT)
+
+ # The wrappers will select whether using "malloc" or the kernel allocator.
+ LINK_WRAPS = -Wl,--wrap,malloc -Wl,--wrap,free -Wl,--wrap,calloc
+--- a/arch/xtensa/kernel/Makefile
++++ b/arch/xtensa/kernel/Makefile
+@@ -27,7 +27,8 @@ sed-y = -e 's/(\(\.[a-z]*it\|\.ref\|\)\.
+ -e 's/(\(\.text\.[a-z]*\))/(\1.literal \1)/g'
+
+ quiet_cmd__cpp_lds_S = LDS $@
+- cmd__cpp_lds_S = $(CPP) $(cpp_flags) -D__ASSEMBLY__ $< | sed $(sed-y) >$@
++ cmd__cpp_lds_S = $(CPP) $(cpp_flags) -P -C -Uxtensa -D__ASSEMBLY__ $< \
++ | sed $(sed-y) >$@
+
+ $(obj)/vmlinux.lds: $(src)/vmlinux.lds.S FORCE
+ $(call if_changed_dep,_cpp_lds_S)
+--- a/Makefile
++++ b/Makefile
+@@ -980,11 +980,6 @@ prepare0: archprepare FORCE
+ # All the preparing..
+ prepare: prepare0
+
+-# Leave this as default for preprocessing vmlinux.lds.S, which is now
+-# done in arch/$(ARCH)/kernel/Makefile
+-
+-export CPPFLAGS_vmlinux.lds += -P -C -U$(ARCH)
+-
+ # The asm symlink changes when $(ARCH) changes.
+ # Detect this and ask user to run make mrproper
+ # If asm is a stale symlink (point to dir that does not exist) remove it
+--- a/scripts/Makefile.build
++++ b/scripts/Makefile.build
+@@ -269,7 +269,8 @@ targets += $(extra-y) $(MAKECMDGOALS) $(
+ # Linker scripts preprocessor (.lds.S -> .lds)
+ # ---------------------------------------------------------------------------
+ quiet_cmd_cpp_lds_S = LDS $@
+- cmd_cpp_lds_S = $(CPP) $(cpp_flags) -D__ASSEMBLY__ -o $@ $<
++ cmd_cpp_lds_S = $(CPP) $(cpp_flags) -P -C -U$(ARCH) \
++ -D__ASSEMBLY__ -o $@ $<
+
+ $(obj)/%.lds: $(src)/%.lds.S FORCE
+ $(call if_changed_dep,cpp_lds_S)
+
+
+From linux@linux.site Fri Oct 16 10:11:57 2009
+Message-Id: <20091016171156.879737124@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:13 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ David Woodhouse <David.Woodhouse@intel.com>,
+ Arto Jantunen <viiru@debian.org>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [20/46] intel-iommu: Cope with broken HP DC7900 BIOS
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=intel-iommu-cope-with-broken-hp-dc7900-bios.patch
+Content-Length: 2302
+Lines: 76
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: David Woodhouse <David.Woodhouse@intel.com>
+
+commit 0815565adfe3f4c369110c57d8ffe83caefeed68 upstream.
+
+Yet another reason why trusting this stuff to the BIOS was a bad idea.
+The HP DC7900 BIOS reports an iommu at an address which just returns all
+ones, when VT-d is disabled in the BIOS.
+
+Fix up the missing iounmap in the error paths while we're at it.
+
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Cc: Arto Jantunen <viiru@debian.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/dmar.c | 22 ++++++++++++++++++----
+ 1 file changed, 18 insertions(+), 4 deletions(-)
+
+--- a/drivers/pci/dmar.c
++++ b/drivers/pci/dmar.c
+@@ -632,20 +632,31 @@ int alloc_iommu(struct dmar_drhd_unit *d
+ iommu->cap = dmar_readq(iommu->reg + DMAR_CAP_REG);
+ iommu->ecap = dmar_readq(iommu->reg + DMAR_ECAP_REG);
+
++ if (iommu->cap == (uint64_t)-1 && iommu->ecap == (uint64_t)-1) {
++ /* Promote an attitude of violence to a BIOS engineer today */
++ WARN(1, "Your BIOS is broken; DMAR reported at address %llx returns all ones!\n"
++ "BIOS vendor: %s; Ver: %s; Product Version: %s\n",
++ drhd->reg_base_addr,
++ dmi_get_system_info(DMI_BIOS_VENDOR),
++ dmi_get_system_info(DMI_BIOS_VERSION),
++ dmi_get_system_info(DMI_PRODUCT_VERSION));
++ goto err_unmap;
++ }
++
+ #ifdef CONFIG_DMAR
+ agaw = iommu_calculate_agaw(iommu);
+ if (agaw < 0) {
+ printk(KERN_ERR
+ "Cannot get a valid agaw for iommu (seq_id = %d)\n",
+ iommu->seq_id);
+- goto error;
++ goto err_unmap;
+ }
+ msagaw = iommu_calculate_max_sagaw(iommu);
+ if (msagaw < 0) {
+ printk(KERN_ERR
+ "Cannot get a valid max agaw for iommu (seq_id = %d)\n",
+ iommu->seq_id);
+- goto error;
++ goto err_unmap;
+ }
+ #endif
+ iommu->agaw = agaw;
+@@ -665,7 +676,7 @@ int alloc_iommu(struct dmar_drhd_unit *d
+ }
+
+ ver = readl(iommu->reg + DMAR_VER_REG);
+- pr_debug("IOMMU %llx: ver %d:%d cap %llx ecap %llx\n",
++ pr_info("IOMMU %llx: ver %d:%d cap %llx ecap %llx\n",
+ (unsigned long long)drhd->reg_base_addr,
+ DMAR_VER_MAJOR(ver), DMAR_VER_MINOR(ver),
+ (unsigned long long)iommu->cap,
+@@ -675,7 +686,10 @@ int alloc_iommu(struct dmar_drhd_unit *d
+
+ drhd->iommu = iommu;
+ return 0;
+-error:
++
++ err_unmap:
++ iounmap(iommu->reg);
++ error:
+ kfree(iommu);
+ return -1;
+ }
+
+
+From linux@linux.site Fri Oct 16 10:11:57 2009
+Message-Id: <20091016171157.469811828@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:14 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Darren Hart <dvhltc@us.ibm.com>,
+ Peter Zijlstra <peterz@infradead.org>,
+ Eric Dumazet <eric.dumazet@gmail.com>,
+ John Kacur <jkacur@redhat.com>,
+ Dinakar Guniguntala <dino@in.ibm.com>,
+ John Stultz <johnstul@us.ibm.com>,
+ Thomas Gleixner <tglx@linutronix.de>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [21/46] futex: Detect mismatched requeue targets
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=futex-detect-mismatched-requeue-targets.patch
+Content-Length: 3322
+Lines: 105
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Darren Hart <dvhltc@us.ibm.com>
+
+commit 84bc4af59081ee974dd80210e694ab59ebe51ce8 upstream.
+
+There is currently no check to ensure that userspace uses the same
+futex requeue target (uaddr2) in futex_requeue() that the waiter used
+in futex_wait_requeue_pi(). A mismatch here could very unexpected
+results as the waiter assumes it either wakes on uaddr1 or uaddr2. We
+could detect this on wakeup in the waiter, but the cleanup is more
+intense after the improper requeue has occured.
+
+This patch stores the waiter's expected requeue target in a new
+requeue_pi_key pointer in the futex_q which futex_requeue() checks
+prior to attempting to do a proxy lock acquistion or a requeue when
+requeue_pi=1. If they don't match, return -EINVAL from futex_requeue,
+aborting the requeue of any remaining waiters.
+
+Signed-off-by: Darren Hart <dvhltc@us.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: John Kacur <jkacur@redhat.com>
+Cc: Dinakar Guniguntala <dino@in.ibm.com>
+Cc: John Stultz <johnstul@us.ibm.com>
+LKML-Reference: <20090814003650.14634.63916.stgit@Aeon>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/futex.c | 24 ++++++++++++++++++++----
+ 1 file changed, 20 insertions(+), 4 deletions(-)
+
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -115,6 +115,9 @@ struct futex_q {
+ /* rt_waiter storage for requeue_pi: */
+ struct rt_mutex_waiter *rt_waiter;
+
++ /* The expected requeue pi target futex key: */
++ union futex_key *requeue_pi_key;
++
+ /* Bitset for the optional bitmasked wakeup */
+ u32 bitset;
+ };
+@@ -1089,6 +1092,10 @@ static int futex_proxy_trylock_atomic(u3
+ if (!top_waiter)
+ return 0;
+
++ /* Ensure we requeue to the expected futex. */
++ if (!match_futex(top_waiter->requeue_pi_key, key2))
++ return -EINVAL;
++
+ /*
+ * Try to take the lock for top_waiter. Set the FUTEX_WAITERS bit in
+ * the contended case or if set_waiters is 1. The pi_state is returned
+@@ -1276,6 +1283,12 @@ retry_private:
+ continue;
+ }
+
++ /* Ensure we requeue to the expected futex for requeue_pi. */
++ if (requeue_pi && !match_futex(this->requeue_pi_key, &key2)) {
++ ret = -EINVAL;
++ break;
++ }
++
+ /*
+ * Requeue nr_requeue waiters and possibly one more in the case
+ * of requeue_pi if we couldn't acquire the lock atomically.
+@@ -1751,6 +1764,7 @@ static int futex_wait(u32 __user *uaddr,
+ q.pi_state = NULL;
+ q.bitset = bitset;
+ q.rt_waiter = NULL;
++ q.requeue_pi_key = NULL;
+
+ if (abs_time) {
+ to = &timeout;
+@@ -1858,6 +1872,7 @@ static int futex_lock_pi(u32 __user *uad
+
+ q.pi_state = NULL;
+ q.rt_waiter = NULL;
++ q.requeue_pi_key = NULL;
+ retry:
+ q.key = FUTEX_KEY_INIT;
+ ret = get_futex_key(uaddr, fshared, &q.key, VERIFY_WRITE);
+@@ -2168,15 +2183,16 @@ static int futex_wait_requeue_pi(u32 __u
+ debug_rt_mutex_init_waiter(&rt_waiter);
+ rt_waiter.task = NULL;
+
+- q.pi_state = NULL;
+- q.bitset = bitset;
+- q.rt_waiter = &rt_waiter;
+-
+ key2 = FUTEX_KEY_INIT;
+ ret = get_futex_key(uaddr2, fshared, &key2, VERIFY_WRITE);
+ if (unlikely(ret != 0))
+ goto out;
+
++ q.pi_state = NULL;
++ q.bitset = bitset;
++ q.rt_waiter = &rt_waiter;
++ q.requeue_pi_key = &key2;
++
+ /* Prepare to wait on uaddr. */
+ ret = futex_wait_setup(uaddr, val, fshared, &q, &hb);
+ if (ret)
+
+
+From linux@linux.site Fri Oct 16 10:11:58 2009
+Message-Id: <20091016171158.014986323@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:15 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Darren Hart <dvhltc@us.ibm.com>,
+ Peter Zijlstra <peterz@infradead.org>,
+ Steven Rostedt <rostedt@goodmis.org>,
+ Eric Dumazet <eric.dumazet@gmail.com>,
+ Dinakar Guniguntala <dino@in.ibm.com>,
+ John Stultz <johnstul@us.ibm.com>,
+ Ingo Molnar <mingo@elte.hu>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [22/46] futex: Fix wakeup race by setting TASK_INTERRUPTIBLE before queue_me()
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=futex-fix-wakeup-race-by-setting-task_interruptible-before-queue_me.patch
+Content-Length: 2724
+Lines: 73
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Darren Hart <dvhltc@us.ibm.com>
+
+commit 0729e196147692d84d4c099fcff056eba2ed61d8 upstream.
+
+PI futexes do not use the same plist_node_empty() test for wakeup.
+It was possible for the waiter (in futex_wait_requeue_pi()) to set
+TASK_INTERRUPTIBLE after the waker assigned the rtmutex to the
+waiter. The waiter would then note the plist was not empty and call
+schedule(). The task would not be found by any subsequeuent futex
+wakeups, resulting in a userspace hang.
+
+By moving the setting of TASK_INTERRUPTIBLE to before the call to
+queue_me(), the race with the waker is eliminated. Since we no
+longer call get_user() from within queue_me(), there is no need to
+delay the setting of TASK_INTERRUPTIBLE until after the call to
+queue_me().
+
+The FUTEX_LOCK_PI operation is not affected as futex_lock_pi()
+relies entirely on the rtmutex code to handle schedule() and
+wakeup. The requeue PI code is affected because the waiter starts
+as a non-PI waiter and is woken on a PI futex.
+
+Remove the crusty old comment about holding spinlocks() across
+get_user() as we no longer do that. Correct the locking statement
+with a description of why the test is performed.
+
+Signed-off-by: Darren Hart <dvhltc@us.ibm.com>
+Acked-by: Peter Zijlstra <peterz@infradead.org>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: Dinakar Guniguntala <dino@in.ibm.com>
+Cc: John Stultz <johnstul@us.ibm.com>
+LKML-Reference: <20090922053038.8717.97838.stgit@Aeon>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/futex.c | 15 +++------------
+ 1 file changed, 3 insertions(+), 12 deletions(-)
+
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -1638,17 +1638,8 @@ out:
+ static void futex_wait_queue_me(struct futex_hash_bucket *hb, struct futex_q *q,
+ struct hrtimer_sleeper *timeout)
+ {
+- queue_me(q, hb);
+-
+- /*
+- * There might have been scheduling since the queue_me(), as we
+- * cannot hold a spinlock across the get_user() in case it
+- * faults, and we cannot just set TASK_INTERRUPTIBLE state when
+- * queueing ourselves into the futex hash. This code thus has to
+- * rely on the futex_wake() code removing us from hash when it
+- * wakes us up.
+- */
+ set_current_state(TASK_INTERRUPTIBLE);
++ queue_me(q, hb);
+
+ /* Arm the timer */
+ if (timeout) {
+@@ -1658,8 +1649,8 @@ static void futex_wait_queue_me(struct f
+ }
+
+ /*
+- * !plist_node_empty() is safe here without any lock.
+- * q.lock_ptr != 0 is not safe, because of ordering against wakeup.
++ * If we have been removed from the hash list, then another task
++ * has tried to wake us, and we can skip the call to schedule().
+ */
+ if (likely(!plist_node_empty(&q->list))) {
+ /*
+
+
+From linux@linux.site Fri Oct 16 10:11:59 2009
+Message-Id: <20091016171158.549828423@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:16 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jason Gunthorpe <jgunthorpe@obsidianresearch.com>,
+ Debora Velarde <debora@linux.vnet.ibm.com>,
+ Rajiv Andrade <srajiv@linux.vnet.ibm.com>,
+ Marcel Selhorst <m.selhorst@sirrix.com>,
+ James Morris <jmorris@namei.org>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [23/46] tpm-fixup-pcrs-sysfs-file-update
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=tpm-fixup-pcrs-sysfs-file-update.patch
+Content-Length: 1468
+Lines: 41
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+
+commit 0afd9056f1b43c9fcbfdf933b263d72023d382fe upstream.
+
+Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+Cc: Debora Velarde <debora@linux.vnet.ibm.com>
+Cc: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
+Cc: Marcel Selhorst <m.selhorst@sirrix.com>
+Cc: James Morris <jmorris@namei.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/tpm/tpm.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/char/tpm/tpm.c
++++ b/drivers/char/tpm/tpm.c
+@@ -742,7 +742,7 @@ EXPORT_SYMBOL_GPL(tpm_pcr_read);
+ * the module usage count.
+ */
+ #define TPM_ORD_PCR_EXTEND cpu_to_be32(20)
+-#define EXTEND_PCR_SIZE 34
++#define EXTEND_PCR_RESULT_SIZE 34
+ static struct tpm_input_header pcrextend_header = {
+ .tag = TPM_TAG_RQU_COMMAND,
+ .length = cpu_to_be32(34),
+@@ -760,10 +760,9 @@ int tpm_pcr_extend(u32 chip_num, int pcr
+ return -ENODEV;
+
+ cmd.header.in = pcrextend_header;
+- BUILD_BUG_ON(be32_to_cpu(cmd.header.in.length) > EXTEND_PCR_SIZE);
+ cmd.params.pcrextend_in.pcr_idx = cpu_to_be32(pcr_idx);
+ memcpy(cmd.params.pcrextend_in.hash, hash, TPM_DIGEST_SIZE);
+- rc = transmit_cmd(chip, &cmd, cmd.header.in.length,
++ rc = transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE,
+ "attempting extend a PCR value");
+
+ module_put(chip->dev->driver->owner);
+
+
+From linux@linux.site Fri Oct 16 10:11:59 2009
+Message-Id: <20091016171159.107320961@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:17 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jason Gunthorpe <jgunthorpe@obsidianresearch.com>,
+ Debora Velarde <debora@linux.vnet.ibm.com>,
+ Marcel Selhorst <m.selhorst@sirrix.com>,
+ James Morris <jmorris@namei.org>,
+ Rajiv Andrade <srajiv@linux.vnet.ibm.com>,
+ Mimi Zohar <zohar@us.ibm.com>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [24/46] TPM: fix pcrread
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=tpm-fix-pcrread.patch
+Content-Length: 1286
+Lines: 39
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
+
+commit 15d031c394e7bef9da4ec764e6b0330d701a0126 upstream.
+
+The previously sent patch:
+
+http://marc.info/?l=tpmdd-devel&m=125208945007834&w=2
+
+Had its first hunk cropped when merged, submitting only this first hunk
+again.
+
+Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+Cc: Debora Velarde <debora@linux.vnet.ibm.com>
+Cc: Marcel Selhorst <m.selhorst@sirrix.com>
+Cc: James Morris <jmorris@namei.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
+Acked-by: Mimi Zohar <zohar@us.ibm.com>
+Tested-by: Mimi Zohar <zohar@us.ibm.com>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/tpm/tpm.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/char/tpm/tpm.c
++++ b/drivers/char/tpm/tpm.c
+@@ -696,8 +696,7 @@ int __tpm_pcr_read(struct tpm_chip *chip
+
+ cmd.header.in = pcrread_header;
+ cmd.params.pcrread_in.pcr_idx = cpu_to_be32(pcr_idx);
+- BUILD_BUG_ON(cmd.header.in.length > READ_PCR_RESULT_SIZE);
+- rc = transmit_cmd(chip, &cmd, cmd.header.in.length,
++ rc = transmit_cmd(chip, &cmd, READ_PCR_RESULT_SIZE,
+ "attempting to read a pcr value");
+
+ if (rc == 0)
+
+
+From linux@linux.site Fri Oct 16 10:12:00 2009
+Message-Id: <20091016171159.669531487@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:18 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Marcel Holtmann <marcel@holtmann.org>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [25/46] Bluetooth: Disconnect HIDRAW devices on disconnect
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=bluetooth-disconnect-hidraw-devices-on-disconnect.patch
+Content-Length: 1123
+Lines: 38
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Marcel Holtmann <marcel@holtmann.org>
+
+commit 364f63519d94442ed373ac7da79033c8282df46a upstream.
+
+Currently the HID subsystem will create HIDRAW devices for the transport
+driver, but it will not disconnect them. Until the HID subsytem gets
+fixed, ensure that HIDRAW and HIDDEV devices are disconnected when the
+Bluetooth HID device gets removed.
+
+Based on a patch from Brian Rogers <brian@xyzw.org>
+
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/bluetooth/hidp/core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/bluetooth/hidp/core.c
++++ b/net/bluetooth/hidp/core.c
+@@ -40,6 +40,7 @@
+
+ #include <linux/input.h>
+ #include <linux/hid.h>
++#include <linux/hidraw.h>
+
+ #include <net/bluetooth/bluetooth.h>
+ #include <net/bluetooth/hci_core.h>
+@@ -573,6 +574,8 @@ static int hidp_session(void *arg)
+ if (session->hid) {
+ if (session->hid->claimed & HID_CLAIMED_INPUT)
+ hidinput_disconnect(session->hid);
++ if (session->hid->claimed & HID_CLAIMED_HIDRAW)
++ hidraw_disconnect(session->hid);
+ hid_destroy_device(session->hid);
+ }
+
+
+
+From linux@linux.site Fri Oct 16 10:12:00 2009
+Message-Id: <20091016171200.183091048@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:19 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Marcel Holtmann <marcel@holtmann.org>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [26/46] Bluetooth: Add extra device reference counting for connections
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=bluetooth-add-extra-device-reference-counting-for-connections.patch
+Content-Length: 3196
+Lines: 108
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Marcel Holtmann <marcel@holtmann.org>
+
+commit 9eba32b86d17ef87131fa0bce43c614904ab5781 upstream.
+
+The device model itself has no real usable reference counting at the
+moment and this causes problems if parents are deleted before their
+children. The device model itself handles the memory details of this
+correctly, but the uevent order is not consistent. This causes various
+problems for systems like HAL or even X.
+
+So until device_put() does a proper cleanup, the device for Bluetooth
+connection will be protected with an extra reference counting to ensure
+the correct order of uevents when connections are terminated.
+
+This is not an automatic feature. Higher Bluetooth layers like HIDP or
+BNEP should grab this new reference to ensure that their uevents are
+send before the ones from the parent device.
+
+Based on a report by Brian Rogers <brian@xyzw.org>
+
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/net/bluetooth/hci_core.h | 4 ++++
+ net/bluetooth/hci_conn.c | 17 ++++++++++++++++-
+ net/bluetooth/hci_event.c | 2 ++
+ 3 files changed, 22 insertions(+), 1 deletion(-)
+
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -187,6 +187,7 @@ struct hci_conn {
+ struct work_struct work_del;
+
+ struct device dev;
++ atomic_t devref;
+
+ struct hci_dev *hdev;
+ void *l2cap_data;
+@@ -339,6 +340,9 @@ int hci_conn_switch_role(struct hci_conn
+ void hci_conn_enter_active_mode(struct hci_conn *conn);
+ void hci_conn_enter_sniff_mode(struct hci_conn *conn);
+
++void hci_conn_hold_device(struct hci_conn *conn);
++void hci_conn_put_device(struct hci_conn *conn);
++
+ static inline void hci_conn_hold(struct hci_conn *conn)
+ {
+ atomic_inc(&conn->refcnt);
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -246,6 +246,8 @@ struct hci_conn *hci_conn_add(struct hci
+ if (hdev->notify)
+ hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
+
++ atomic_set(&conn->devref, 0);
++
+ hci_conn_init_sysfs(conn);
+
+ tasklet_enable(&hdev->tx_task);
+@@ -288,7 +290,7 @@ int hci_conn_del(struct hci_conn *conn)
+
+ skb_queue_purge(&conn->data_q);
+
+- hci_conn_del_sysfs(conn);
++ hci_conn_put_device(conn);
+
+ hci_dev_put(hdev);
+
+@@ -583,6 +585,19 @@ void hci_conn_check_pending(struct hci_d
+ hci_dev_unlock(hdev);
+ }
+
++void hci_conn_hold_device(struct hci_conn *conn)
++{
++ atomic_inc(&conn->devref);
++}
++EXPORT_SYMBOL(hci_conn_hold_device);
++
++void hci_conn_put_device(struct hci_conn *conn)
++{
++ if (atomic_dec_and_test(&conn->devref))
++ hci_conn_del_sysfs(conn);
++}
++EXPORT_SYMBOL(hci_conn_put_device);
++
+ int hci_get_conn_list(void __user *arg)
+ {
+ struct hci_conn_list_req req, *cl;
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -887,6 +887,7 @@ static inline void hci_conn_complete_evt
+ } else
+ conn->state = BT_CONNECTED;
+
++ hci_conn_hold_device(conn);
+ hci_conn_add_sysfs(conn);
+
+ if (test_bit(HCI_AUTH, &hdev->flags))
+@@ -1693,6 +1694,7 @@ static inline void hci_sync_conn_complet
+ conn->handle = __le16_to_cpu(ev->handle);
+ conn->state = BT_CONNECTED;
+
++ hci_conn_hold_device(conn);
+ hci_conn_add_sysfs(conn);
+ break;
+
+
+
+From linux@linux.site Fri Oct 16 10:12:01 2009
+Message-Id: <20091016171200.819992787@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:20 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Marcel Holtmann <marcel@holtmann.org>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [27/46] Bluetooth: Let HIDP grab the device reference for connections
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=bluetooth-let-hidp-grab-the-device-reference-for-connections.patch
+Content-Length: 4345
+Lines: 185
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Marcel Holtmann <marcel@holtmann.org>
+
+commit edad63886993d18ab800c49f6587a93432ef8b35 upstream.
+
+The core exports the hci_conn_hold_device() and hci_conn_put_device()
+functions for device reference of connections. Use this to ensure that
+the uevents from the parent are send after the child ones.
+
+Based on a report by Brian Rogers <brian@xyzw.org>
+
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/bluetooth/hidp/core.c | 62 ++++++++++++++++++++++++++++++----------------
+ net/bluetooth/hidp/hidp.h | 2 +
+ 2 files changed, 43 insertions(+), 21 deletions(-)
+
+--- a/net/bluetooth/hidp/core.c
++++ b/net/bluetooth/hidp/core.c
+@@ -93,10 +93,14 @@ static void __hidp_link_session(struct h
+ {
+ __module_get(THIS_MODULE);
+ list_add(&session->list, &hidp_session_list);
++
++ hci_conn_hold_device(session->conn);
+ }
+
+ static void __hidp_unlink_session(struct hidp_session *session)
+ {
++ hci_conn_put_device(session->conn);
++
+ list_del(&session->list);
+ module_put(THIS_MODULE);
+ }
+@@ -576,7 +580,9 @@ static int hidp_session(void *arg)
+ hidinput_disconnect(session->hid);
+ if (session->hid->claimed & HID_CLAIMED_HIDRAW)
+ hidraw_disconnect(session->hid);
++
+ hid_destroy_device(session->hid);
++ session->hid = NULL;
+ }
+
+ /* Wakeup user-space polling for socket errors */
+@@ -604,25 +610,27 @@ static struct device *hidp_get_device(st
+ {
+ bdaddr_t *src = &bt_sk(session->ctrl_sock->sk)->src;
+ bdaddr_t *dst = &bt_sk(session->ctrl_sock->sk)->dst;
++ struct device *device = NULL;
+ struct hci_dev *hdev;
+- struct hci_conn *conn;
+
+ hdev = hci_get_route(dst, src);
+ if (!hdev)
+ return NULL;
+
+- conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
++ session->conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
++ if (session->conn)
++ device = &session->conn->dev;
+
+ hci_dev_put(hdev);
+
+- return conn ? &conn->dev : NULL;
++ return device;
+ }
+
+ static int hidp_setup_input(struct hidp_session *session,
+ struct hidp_connadd_req *req)
+ {
+ struct input_dev *input;
+- int i;
++ int err, i;
+
+ input = input_allocate_device();
+ if (!input)
+@@ -669,7 +677,13 @@ static int hidp_setup_input(struct hidp_
+
+ input->event = hidp_input_event;
+
+- return input_register_device(input);
++ err = input_register_device(input);
++ if (err < 0) {
++ hci_conn_put_device(session->conn);
++ return err;
++ }
++
++ return 0;
+ }
+
+ static int hidp_open(struct hid_device *hid)
+@@ -751,13 +765,11 @@ static int hidp_setup_hid(struct hidp_se
+ {
+ struct hid_device *hid;
+ bdaddr_t src, dst;
+- int ret;
++ int err;
+
+ hid = hid_allocate_device();
+- if (IS_ERR(hid)) {
+- ret = PTR_ERR(session->hid);
+- goto err;
+- }
++ if (IS_ERR(hid))
++ return PTR_ERR(session->hid);
+
+ session->hid = hid;
+ session->req = req;
+@@ -779,16 +791,17 @@ static int hidp_setup_hid(struct hidp_se
+ hid->dev.parent = hidp_get_device(session);
+ hid->ll_driver = &hidp_hid_driver;
+
+- ret = hid_add_device(hid);
+- if (ret)
+- goto err_hid;
++ err = hid_add_device(hid);
++ if (err < 0)
++ goto failed;
+
+ return 0;
+-err_hid:
++
++failed:
+ hid_destroy_device(hid);
+ session->hid = NULL;
+-err:
+- return ret;
++
++ return err;
+ }
+
+ int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock, struct socket *intr_sock)
+@@ -838,13 +851,13 @@ int hidp_add_connection(struct hidp_conn
+ if (req->rd_size > 0) {
+ err = hidp_setup_hid(session, req);
+ if (err && err != -ENODEV)
+- goto err_skb;
++ goto purge;
+ }
+
+ if (!session->hid) {
+ err = hidp_setup_input(session, req);
+ if (err < 0)
+- goto err_skb;
++ goto purge;
+ }
+
+ __hidp_link_session(session);
+@@ -872,13 +885,20 @@ unlink:
+
+ __hidp_unlink_session(session);
+
+- if (session->input)
++ if (session->input) {
+ input_unregister_device(session->input);
+- if (session->hid)
++ session->input = NULL;
++ }
++
++ if (session->hid) {
+ hid_destroy_device(session->hid);
+-err_skb:
++ session->hid = NULL;
++ }
++
++purge:
+ skb_queue_purge(&session->ctrl_transmit);
+ skb_queue_purge(&session->intr_transmit);
++
+ failed:
+ up_write(&hidp_session_sem);
+
+--- a/net/bluetooth/hidp/hidp.h
++++ b/net/bluetooth/hidp/hidp.h
+@@ -126,6 +126,8 @@ int hidp_get_conninfo(struct hidp_connin
+ struct hidp_session {
+ struct list_head list;
+
++ struct hci_conn *conn;
++
+ struct socket *ctrl_sock;
+ struct socket *intr_sock;
+
+
+
+From linux@linux.site Fri Oct 16 10:12:01 2009
+Message-Id: <20091016171201.376625219@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:21 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Greg KH <greg@kroah.com>
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ serue@us.ibm.com,
+ Philipp Reisner <philipp.reisner@linbit.com>,
+ Lars Ellenberg <lars.ellenberg@linbit.com>,
+ Evgeniy Polyakov <zbr@ioremap.net>,
+ "David S. Miller" <davem@davemloft.net>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [28/46] connector: Keep the skb in cn_callback_data
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=connector-keep-the-skb-in-cn_callback_data.patch
+Content-Length: 3066
+Lines: 96
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Philipp Reisner <philipp.reisner@linbit.com>
+
+(cherry picked from commit 5491c43845dae6c68cb4edbcf2e2dde9a32a863d)
+
+Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
+Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
+Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/connector/cn_queue.c | 3 ++-
+ drivers/connector/connector.c | 11 +++++------
+ include/linux/connector.h | 6 +++---
+ 3 files changed, 10 insertions(+), 10 deletions(-)
+
+--- a/drivers/connector/cn_queue.c
++++ b/drivers/connector/cn_queue.c
+@@ -78,8 +78,9 @@ void cn_queue_wrapper(struct work_struct
+ struct cn_callback_entry *cbq =
+ container_of(work, struct cn_callback_entry, work);
+ struct cn_callback_data *d = &cbq->data;
++ struct cn_msg *msg = NLMSG_DATA(nlmsg_hdr(d->skb));
+
+- d->callback(d->callback_priv);
++ d->callback(msg);
+
+ d->destruct_data(d->ddata);
+ d->ddata = NULL;
+--- a/drivers/connector/connector.c
++++ b/drivers/connector/connector.c
+@@ -129,10 +129,11 @@ EXPORT_SYMBOL_GPL(cn_netlink_send);
+ /*
+ * Callback helper - queues work and setup destructor for given data.
+ */
+-static int cn_call_callback(struct cn_msg *msg, void (*destruct_data)(void *), void *data)
++static int cn_call_callback(struct sk_buff *skb, void (*destruct_data)(void *), void *data)
+ {
+ struct cn_callback_entry *__cbq, *__new_cbq;
+ struct cn_dev *dev = &cdev;
++ struct cn_msg *msg = NLMSG_DATA(nlmsg_hdr(skb));
+ int err = -ENODEV;
+
+ spin_lock_bh(&dev->cbdev->queue_lock);
+@@ -140,7 +141,7 @@ static int cn_call_callback(struct cn_ms
+ if (cn_cb_equal(&__cbq->id.id, &msg->id)) {
+ if (likely(!work_pending(&__cbq->work) &&
+ __cbq->data.ddata == NULL)) {
+- __cbq->data.callback_priv = msg;
++ __cbq->data.skb = skb;
+
+ __cbq->data.ddata = data;
+ __cbq->data.destruct_data = destruct_data;
+@@ -156,7 +157,7 @@ static int cn_call_callback(struct cn_ms
+ __new_cbq = kzalloc(sizeof(struct cn_callback_entry), GFP_ATOMIC);
+ if (__new_cbq) {
+ d = &__new_cbq->data;
+- d->callback_priv = msg;
++ d->skb = skb;
+ d->callback = __cbq->data.callback;
+ d->ddata = data;
+ d->destruct_data = destruct_data;
+@@ -191,7 +192,6 @@ static int cn_call_callback(struct cn_ms
+ */
+ static void cn_rx_skb(struct sk_buff *__skb)
+ {
+- struct cn_msg *msg;
+ struct nlmsghdr *nlh;
+ int err;
+ struct sk_buff *skb;
+@@ -208,8 +208,7 @@ static void cn_rx_skb(struct sk_buff *__
+ return;
+ }
+
+- msg = NLMSG_DATA(nlh);
+- err = cn_call_callback(msg, (void (*)(void *))kfree_skb, skb);
++ err = cn_call_callback(skb, (void (*)(void *))kfree_skb, skb);
+ if (err < 0)
+ kfree_skb(skb);
+ }
+--- a/include/linux/connector.h
++++ b/include/linux/connector.h
+@@ -134,9 +134,9 @@ struct cn_callback_id {
+ struct cn_callback_data {
+ void (*destruct_data) (void *);
+ void *ddata;
+-
+- void *callback_priv;
+- void (*callback) (void *);
++
++ struct sk_buff *skb;
++ void (*callback) (struct cn_msg *);
+
+ void *free;
+ };
+
+
+From linux@linux.site Fri Oct 16 10:12:02 2009
+Message-Id: <20091016171201.890635877@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:22 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Greg KH <greg@kroah.com>
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ serue@us.ibm.com,
+ Philipp Reisner <philipp.reisner@linbit.com>,
+ Lars Ellenberg <lars.ellenberg@linbit.com>,
+ Evgeniy Polyakov <zbr@ioremap.net>,
+ "David S. Miller" <davem@davemloft.net>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [29/46] connector: Provide the senders credentials to the callback
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=connector-provide-the-sender-s-credentials-to-the-callback.patch
+Content-Length: 8482
+Lines: 230
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Philipp Reisner <philipp.reisner@linbit.com>
+
+commit 7069331dbe7155f23966f5944109f909fea0c7e4 upstream
+
+Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
+Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
+Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/connector/cn_test.c | 4 +---
+ Documentation/connector/connector.txt | 8 ++++----
+ drivers/connector/cn_proc.c | 3 +--
+ drivers/connector/cn_queue.c | 10 +++++++---
+ drivers/connector/connector.c | 6 +++---
+ drivers/md/dm-log-userspace-transfer.c | 3 +--
+ drivers/staging/dst/dcore.c | 3 +--
+ drivers/staging/pohmelfs/config.c | 3 +--
+ drivers/video/uvesafb.c | 3 +--
+ drivers/w1/w1_netlink.c | 3 +--
+ include/linux/connector.h | 6 +++---
+ 11 files changed, 24 insertions(+), 28 deletions(-)
+
+--- a/Documentation/connector/cn_test.c
++++ b/Documentation/connector/cn_test.c
+@@ -32,10 +32,8 @@ static char cn_test_name[] = "cn_test";
+ static struct sock *nls;
+ static struct timer_list cn_test_timer;
+
+-void cn_test_callback(void *data)
++static void cn_test_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
+ {
+- struct cn_msg *msg = (struct cn_msg *)data;
+-
+ printk("%s: %lu: idx=%x, val=%x, seq=%u, ack=%u, len=%d: %s.\n",
+ __func__, jiffies, msg->id.idx, msg->id.val,
+ msg->seq, msg->ack, msg->len, (char *)msg->data);
+--- a/Documentation/connector/connector.txt
++++ b/Documentation/connector/connector.txt
+@@ -23,7 +23,7 @@ handling... Connector allows any kernel
+ based networking for inter-process communication in a significantly
+ easier way:
+
+-int cn_add_callback(struct cb_id *id, char *name, void (*callback) (void *));
++int cn_add_callback(struct cb_id *id, char *name, void (*callback) (struct cn_msg *, struct netlink_skb_parms *));
+ void cn_netlink_send(struct cn_msg *msg, u32 __group, int gfp_mask);
+
+ struct cb_id
+@@ -53,15 +53,15 @@ struct cn_msg
+ Connector interfaces.
+ /*****************************************/
+
+-int cn_add_callback(struct cb_id *id, char *name, void (*callback) (void *));
++int cn_add_callback(struct cb_id *id, char *name, void (*callback) (struct cn_msg *, struct netlink_skb_parms *));
+
+ Registers new callback with connector core.
+
+ struct cb_id *id - unique connector's user identifier.
+ It must be registered in connector.h for legal in-kernel users.
+ char *name - connector's callback symbolic name.
+-void (*callback) (void *) - connector's callback.
+- Argument must be dereferenced to struct cn_msg *.
++void (*callback) (struct cn..) - connector's callback.
++ cn_msg and the sender's credentials
+
+ void cn_del_callback(struct cb_id *id);
+
+--- a/drivers/connector/cn_proc.c
++++ b/drivers/connector/cn_proc.c
+@@ -202,9 +202,8 @@ static void cn_proc_ack(int err, int rcv
+ * cn_proc_mcast_ctl
+ * @data: message sent from userspace via the connector
+ */
+-static void cn_proc_mcast_ctl(void *data)
++static void cn_proc_mcast_ctl(struct cn_msg *msg, struct netlink_skb_parms *nsp)
+ {
+- struct cn_msg *msg = data;
+ enum proc_cn_mcast_op *mc_op = NULL;
+ int err = 0;
+
+--- a/drivers/connector/cn_queue.c
++++ b/drivers/connector/cn_queue.c
+@@ -79,8 +79,9 @@ void cn_queue_wrapper(struct work_struct
+ container_of(work, struct cn_callback_entry, work);
+ struct cn_callback_data *d = &cbq->data;
+ struct cn_msg *msg = NLMSG_DATA(nlmsg_hdr(d->skb));
++ struct netlink_skb_parms *nsp = &NETLINK_CB(d->skb);
+
+- d->callback(msg);
++ d->callback(msg, nsp);
+
+ d->destruct_data(d->ddata);
+ d->ddata = NULL;
+@@ -88,7 +89,9 @@ void cn_queue_wrapper(struct work_struct
+ kfree(d->free);
+ }
+
+-static struct cn_callback_entry *cn_queue_alloc_callback_entry(char *name, struct cb_id *id, void (*callback)(void *))
++static struct cn_callback_entry *
++cn_queue_alloc_callback_entry(char *name, struct cb_id *id,
++ void (*callback)(struct cn_msg *, struct netlink_skb_parms *))
+ {
+ struct cn_callback_entry *cbq;
+
+@@ -121,7 +124,8 @@ int cn_cb_equal(struct cb_id *i1, struct
+ return ((i1->idx == i2->idx) && (i1->val == i2->val));
+ }
+
+-int cn_queue_add_callback(struct cn_queue_dev *dev, char *name, struct cb_id *id, void (*callback)(void *))
++int cn_queue_add_callback(struct cn_queue_dev *dev, char *name, struct cb_id *id,
++ void (*callback)(struct cn_msg *, struct netlink_skb_parms *))
+ {
+ struct cn_callback_entry *cbq, *__cbq;
+ int found = 0;
+--- a/drivers/connector/connector.c
++++ b/drivers/connector/connector.c
+@@ -268,7 +268,8 @@ static void cn_notify(struct cb_id *id,
+ *
+ * May sleep.
+ */
+-int cn_add_callback(struct cb_id *id, char *name, void (*callback)(void *))
++int cn_add_callback(struct cb_id *id, char *name,
++ void (*callback)(struct cn_msg *, struct netlink_skb_parms *))
+ {
+ int err;
+ struct cn_dev *dev = &cdev;
+@@ -350,9 +351,8 @@ static int cn_ctl_msg_equals(struct cn_c
+ *
+ * Used for notification of a request's processing.
+ */
+-static void cn_callback(void *data)
++static void cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
+ {
+- struct cn_msg *msg = data;
+ struct cn_ctl_msg *ctl;
+ struct cn_ctl_entry *ent;
+ u32 size;
+--- a/drivers/md/dm-log-userspace-transfer.c
++++ b/drivers/md/dm-log-userspace-transfer.c
+@@ -129,9 +129,8 @@ static int fill_pkg(struct cn_msg *msg,
+ * This is the connector callback that delivers data
+ * that was sent from userspace.
+ */
+-static void cn_ulog_callback(void *data)
++static void cn_ulog_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
+ {
+- struct cn_msg *msg = (struct cn_msg *)data;
+ struct dm_ulog_request *tfr = (struct dm_ulog_request *)(msg + 1);
+
+ spin_lock(&receiving_list_lock);
+--- a/drivers/staging/dst/dcore.c
++++ b/drivers/staging/dst/dcore.c
+@@ -846,10 +846,9 @@ static dst_command_func dst_commands[] =
+ /*
+ * Configuration parser.
+ */
+-static void cn_dst_callback(void *data)
++static void cn_dst_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
+ {
+ struct dst_ctl *ctl;
+- struct cn_msg *msg = data;
+ int err;
+ struct dst_ctl_ack ack;
+ struct dst_node *n = NULL, *tmp;
+--- a/drivers/staging/pohmelfs/config.c
++++ b/drivers/staging/pohmelfs/config.c
+@@ -446,9 +446,8 @@ out_unlock:
+ return err;
+ }
+
+-static void pohmelfs_cn_callback(void *data)
++static void pohmelfs_cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
+ {
+- struct cn_msg *msg = data;
+ int err;
+
+ switch (msg->flags) {
+--- a/drivers/video/uvesafb.c
++++ b/drivers/video/uvesafb.c
+@@ -67,9 +67,8 @@ static DEFINE_MUTEX(uvfb_lock);
+ * find the kernel part of the task struct, copy the registers and
+ * the buffer contents and then complete the task.
+ */
+-static void uvesafb_cn_callback(void *data)
++static void uvesafb_cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
+ {
+- struct cn_msg *msg = data;
+ struct uvesafb_task *utask;
+ struct uvesafb_ktask *task;
+
+--- a/drivers/w1/w1_netlink.c
++++ b/drivers/w1/w1_netlink.c
+@@ -306,9 +306,8 @@ static int w1_netlink_send_error(struct
+ return error;
+ }
+
+-static void w1_cn_callback(void *data)
++static void w1_cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
+ {
+- struct cn_msg *msg = data;
+ struct w1_netlink_msg *m = (struct w1_netlink_msg *)(msg + 1);
+ struct w1_netlink_cmd *cmd;
+ struct w1_slave *sl;
+--- a/include/linux/connector.h
++++ b/include/linux/connector.h
+@@ -136,7 +136,7 @@ struct cn_callback_data {
+ void *ddata;
+
+ struct sk_buff *skb;
+- void (*callback) (struct cn_msg *);
++ void (*callback) (struct cn_msg *, struct netlink_skb_parms *);
+
+ void *free;
+ };
+@@ -167,11 +167,11 @@ struct cn_dev {
+ struct cn_queue_dev *cbdev;
+ };
+
+-int cn_add_callback(struct cb_id *, char *, void (*callback) (void *));
++int cn_add_callback(struct cb_id *, char *, void (*callback) (struct cn_msg *, struct netlink_skb_parms *));
+ void cn_del_callback(struct cb_id *);
+ int cn_netlink_send(struct cn_msg *, u32, gfp_t);
+
+-int cn_queue_add_callback(struct cn_queue_dev *dev, char *name, struct cb_id *id, void (*callback)(void *));
++int cn_queue_add_callback(struct cn_queue_dev *dev, char *name, struct cb_id *id, void (*callback)(struct cn_msg *, struct netlink_skb_parms *));
+ void cn_queue_del_callback(struct cn_queue_dev *dev, struct cb_id *id);
+
+ int queue_cn_work(struct cn_callback_entry *cbq, struct work_struct *work);
+
+
+From linux@linux.site Fri Oct 16 10:12:02 2009
+Message-Id: <20091016171202.389782069@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:23 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Greg KH <greg@kroah.com>
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ serue@us.ibm.com,
+ Philipp Reisner <philipp.reisner@linbit.com>,
+ Lars Ellenberg <lars.ellenberg@linbit.com>,
+ Evgeniy Polyakov <zbr@ioremap.net>,
+ "David S. Miller" <davem@davemloft.net>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [30/46] connector: Removed the destruct_data callback since it is always kfree_skb()
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=connector-removed-the-destruct_data-callback-since-it-is-always-kfree_skb.patch
+Content-Length: 2483
+Lines: 83
+
+(cherry picked from commit f4b5129f5e838942f759c2637967441cf4a98c20)
+
+Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
+Acked-by: Lars Ellenberg <lars.ellenberg@linbit.com>
+Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/connector/cn_queue.c | 4 ++--
+ drivers/connector/connector.c | 11 +++--------
+ include/linux/connector.h | 3 ---
+ 3 files changed, 5 insertions(+), 13 deletions(-)
+
+--- a/drivers/connector/cn_queue.c
++++ b/drivers/connector/cn_queue.c
+@@ -83,8 +83,8 @@ void cn_queue_wrapper(struct work_struct
+
+ d->callback(msg, nsp);
+
+- d->destruct_data(d->ddata);
+- d->ddata = NULL;
++ kfree_skb(d->skb);
++ d->skb = NULL;
+
+ kfree(d->free);
+ }
+--- a/drivers/connector/connector.c
++++ b/drivers/connector/connector.c
+@@ -129,7 +129,7 @@ EXPORT_SYMBOL_GPL(cn_netlink_send);
+ /*
+ * Callback helper - queues work and setup destructor for given data.
+ */
+-static int cn_call_callback(struct sk_buff *skb, void (*destruct_data)(void *), void *data)
++static int cn_call_callback(struct sk_buff *skb)
+ {
+ struct cn_callback_entry *__cbq, *__new_cbq;
+ struct cn_dev *dev = &cdev;
+@@ -140,12 +140,9 @@ static int cn_call_callback(struct sk_bu
+ list_for_each_entry(__cbq, &dev->cbdev->queue_list, callback_entry) {
+ if (cn_cb_equal(&__cbq->id.id, &msg->id)) {
+ if (likely(!work_pending(&__cbq->work) &&
+- __cbq->data.ddata == NULL)) {
++ __cbq->data.skb == NULL)) {
+ __cbq->data.skb = skb;
+
+- __cbq->data.ddata = data;
+- __cbq->data.destruct_data = destruct_data;
+-
+ if (queue_cn_work(__cbq, &__cbq->work))
+ err = 0;
+ else
+@@ -159,8 +156,6 @@ static int cn_call_callback(struct sk_bu
+ d = &__new_cbq->data;
+ d->skb = skb;
+ d->callback = __cbq->data.callback;
+- d->ddata = data;
+- d->destruct_data = destruct_data;
+ d->free = __new_cbq;
+
+ __new_cbq->pdev = __cbq->pdev;
+@@ -208,7 +203,7 @@ static void cn_rx_skb(struct sk_buff *__
+ return;
+ }
+
+- err = cn_call_callback(skb, (void (*)(void *))kfree_skb, skb);
++ err = cn_call_callback(skb);
+ if (err < 0)
+ kfree_skb(skb);
+ }
+--- a/include/linux/connector.h
++++ b/include/linux/connector.h
+@@ -132,9 +132,6 @@ struct cn_callback_id {
+ };
+
+ struct cn_callback_data {
+- void (*destruct_data) (void *);
+- void *ddata;
+-
+ struct sk_buff *skb;
+ void (*callback) (struct cn_msg *, struct netlink_skb_parms *);
+
+
+
+From linux@linux.site Fri Oct 16 10:12:03 2009
+Message-Id: <20091016171202.927189279@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:24 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Greg KH <greg@kroah.com>
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ serue@us.ibm.com,
+ Philipp Reisner <philipp.reisner@linbit.com>,
+ "David S. Miller" <davem@davemloft.net>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [31/46] dm/connector: Only process connector packages from privileged processes
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=dm-connector-only-process-connector-packages-from-privileged-processes.patch
+Content-Length: 743
+Lines: 25
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Philipp Reisner <philipp.reisner@linbit.com>
+
+(cherry picked from commit 93136335f9ad7a98b92eacda1b43dccbf063cd07)
+
+Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-log-userspace-transfer.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/md/dm-log-userspace-transfer.c
++++ b/drivers/md/dm-log-userspace-transfer.c
+@@ -133,6 +133,9 @@ static void cn_ulog_callback(struct cn_m
+ {
+ struct dm_ulog_request *tfr = (struct dm_ulog_request *)(msg + 1);
+
++ if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN))
++ return;
++
+ spin_lock(&receiving_list_lock);
+ if (msg->len == 0)
+ fill_pkg(msg, NULL);
+
+
+From linux@linux.site Fri Oct 16 10:12:03 2009
+Message-Id: <20091016171203.401776193@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:25 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Greg KH <greg@kroah.com>
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ serue@us.ibm.com,
+ Philipp Reisner <philipp.reisner@linbit.com>,
+ "David S. Miller" <davem@davemloft.net>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [32/46] dst/connector: Disallow unpliviged users to configure dst
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=dst-connector-disallow-unpliviged-users-to-configure-dst.patch
+Content-Length: 717
+Lines: 27
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Philipp Reisner <philipp.reisner@linbit.com>
+
+(cherry picked from commit dbbb3431228784612848a1ec6061c78b4b708b5c)
+
+Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/dst/dcore.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/staging/dst/dcore.c
++++ b/drivers/staging/dst/dcore.c
+@@ -854,6 +854,11 @@ static void cn_dst_callback(struct cn_ms
+ struct dst_node *n = NULL, *tmp;
+ unsigned int hash;
+
++ if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN)) {
++ err = -EPERM;
++ goto out;
++ }
++
+ if (msg->len < sizeof(struct dst_ctl)) {
+ err = -EBADMSG;
+ goto out;
+
+
+From linux@linux.site Fri Oct 16 10:12:04 2009
+Message-Id: <20091016171203.984772794@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:26 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Greg KH <greg@kroah.com>
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ serue@us.ibm.com,
+ Philipp Reisner <philipp.reisner@linbit.com>,
+ "David S. Miller" <davem@davemloft.net>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [33/46] pohmelfs/connector: Disallow unpliviged users to configure pohmelfs
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=pohmelfs-connector-disallow-unpliviged-users-to-configure-pohmelfs.patch
+Content-Length: 670
+Lines: 25
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Philipp Reisner <philipp.reisner@linbit.com>
+
+(cherry picked from commit 0179065b13b354cc0b940e7a632a65ec0448beff)
+
+Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/pohmelfs/config.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/staging/pohmelfs/config.c
++++ b/drivers/staging/pohmelfs/config.c
+@@ -450,6 +450,9 @@ static void pohmelfs_cn_callback(struct
+ {
+ int err;
+
++ if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN))
++ return;
++
+ switch (msg->flags) {
+ case POHMELFS_FLAGS_ADD:
+ case POHMELFS_FLAGS_DEL:
+
+
+From linux@linux.site Fri Oct 16 10:12:04 2009
+Message-Id: <20091016171204.475577693@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:27 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Greg KH <greg@kroah.com>
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ serue@us.ibm.com,
+ Philipp Reisner <philipp.reisner@linbit.com>,
+ "David S. Miller" <davem@davemloft.net>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [34/46] uvesafb/connector: Disallow unpliviged users to send netlink packets
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=uvesafb-connector-disallow-unpliviged-users-to-send-netlink-packets.patch
+Content-Length: 654
+Lines: 25
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Philipp Reisner <philipp.reisner@linbit.com>
+
+(cherry picked from commit 30efa3f76813b17445bc5a2e443ae9731518566b)
+
+Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/uvesafb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/video/uvesafb.c
++++ b/drivers/video/uvesafb.c
+@@ -72,6 +72,9 @@ static void uvesafb_cn_callback(struct c
+ struct uvesafb_task *utask;
+ struct uvesafb_ktask *task;
+
++ if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN))
++ return;
++
+ if (msg->seq >= UVESAFB_TASKS_MAX)
+ return;
+
+
+
+From linux@linux.site Fri Oct 16 10:12:05 2009
+Message-Id: <20091016171204.994775310@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:28 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alexander Duyck <alexander.h.duyck@intel.com>,
+ Jeff Kirsher <jeffrey.t.kirsher@intel.com>,
+ "David S. Miller" <davem@davemloft.net>,
+ Tim Gardner <tim.gardner@canonical.com>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [35/46] e1000e: swap max hw supported frame size between 82574 and 82583
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=e1000e-swap-max-hw-supported-frame-size-between-82574-and-82583.patch
+Content-Length: 1394
+Lines: 37
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Alexander Duyck <alexander.h.duyck@intel.com>
+
+commit a825e00c98a2ee37eb2a0ad93b352e79d2bc1593 upstream.
+
+There appears to have been a mixup in the max supported jumbo frame size
+between 82574 and 82583 which ended up disabling jumbo frames on the 82574
+as a result. This patch swaps the two so that this issue is resolved.
+
+This patch fixes http://bugzilla.kernel.org/show_bug.cgi?id=14261
+
+Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Tim Gardner <tim.gardner@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+--- a/drivers/net/e1000e/82571.c
++++ b/drivers/net/e1000e/82571.c
+@@ -1803,7 +1803,7 @@ struct e1000_info e1000_82574_info = {
+ | FLAG_HAS_AMT
+ | FLAG_HAS_CTRLEXT_ON_LOAD,
+ .pba = 20,
+- .max_hw_frame_size = ETH_FRAME_LEN + ETH_FCS_LEN,
++ .max_hw_frame_size = DEFAULT_JUMBO,
+ .get_variants = e1000_get_variants_82571,
+ .mac_ops = &e82571_mac_ops,
+ .phy_ops = &e82_phy_ops_bm,
+@@ -1820,7 +1820,7 @@ struct e1000_info e1000_82583_info = {
+ | FLAG_HAS_AMT
+ | FLAG_HAS_CTRLEXT_ON_LOAD,
+ .pba = 20,
+- .max_hw_frame_size = DEFAULT_JUMBO,
++ .max_hw_frame_size = ETH_FRAME_LEN + ETH_FCS_LEN,
+ .get_variants = e1000_get_variants_82571,
+ .mac_ops = &e82571_mac_ops,
+ .phy_ops = &e82_phy_ops_bm,
+
+
+From linux@linux.site Fri Oct 16 10:12:06 2009
+Message-Id: <20091016171205.629484075@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:29 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jean Delvare <khali@linux-fr.org>,
+ Riku Voipio <riku.voipio@iki.fi>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [36/46] MAINTAINERS: Fix Riku Voipios address
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=maintainers-fix-riku-voipio-s-address.patch
+Content-Length: 608
+Lines: 24
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jean Delvare <khali@linux-fr.org>
+
+commit 05576a1e38e2d06dece32974c5218528d3fbc6e2 upstream.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Acked-by: Riku Voipio <riku.voipio@iki.fi>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ MAINTAINERS | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -1992,7 +1992,7 @@ S: Maintained
+ F: fs/*
+
+ FINTEK F75375S HARDWARE MONITOR AND FAN CONTROLLER DRIVER
+-M: Riku Voipio <riku.vipio@iki.fi>
++M: Riku Voipio <riku.voipio@iki.fi>
+ L: lm-sensors@lm-sensors.org
+ S: Maintained
+ F: drivers/hwmon/f75375s.c
+
+
+From linux@linux.site Fri Oct 16 10:12:06 2009
+Message-Id: <20091016171206.189773932@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:30 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jean Delvare <khali@linux-fr.org>,
+ Colin Leroy <colin@colino.net>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [37/46] macintosh: Dont assume i2c device probing always succeeds
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=macintosh-don-t-assume-i2c-device-probing-always-succeeds.patch
+Content-Length: 4165
+Lines: 123
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jean Delvare <khali@linux-fr.org>
+
+commit 6f6b35e133fe4313277b30fc1a7ea313875ea6c9 upstream.
+
+If i2c device probing fails, then there is no driver to dereference
+after calling i2c_new_device(). Stop assuming that probing will always
+succeed, to avoid NULL pointer dereferences. We have an easier access
+to the driver anyway.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Tested-by: Tim Shepard <shep@alum.mit.edu>
+Cc: Colin Leroy <colin@colino.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/macintosh/therm_adt746x.c | 4 +++-
+ drivers/macintosh/therm_pm72.c | 4 +++-
+ drivers/macintosh/windfarm_lm75_sensor.c | 4 +++-
+ drivers/macintosh/windfarm_max6690_sensor.c | 4 +++-
+ drivers/macintosh/windfarm_smu_sat.c | 4 +++-
+ 5 files changed, 15 insertions(+), 5 deletions(-)
+
+--- a/drivers/macintosh/therm_adt746x.c
++++ b/drivers/macintosh/therm_adt746x.c
+@@ -124,6 +124,8 @@ read_reg(struct thermostat* th, int reg)
+ return data;
+ }
+
++static struct i2c_driver thermostat_driver;
++
+ static int
+ attach_thermostat(struct i2c_adapter *adapter)
+ {
+@@ -148,7 +150,7 @@ attach_thermostat(struct i2c_adapter *ad
+ * Let i2c-core delete that device on driver removal.
+ * This is safe because i2c-core holds the core_lock mutex for us.
+ */
+- list_add_tail(&client->detected, &client->driver->clients);
++ list_add_tail(&client->detected, &thermostat_driver.clients);
+ return 0;
+ }
+
+--- a/drivers/macintosh/therm_pm72.c
++++ b/drivers/macintosh/therm_pm72.c
+@@ -286,6 +286,8 @@ struct fcu_fan_table fcu_fans[] = {
+ },
+ };
+
++static struct i2c_driver therm_pm72_driver;
++
+ /*
+ * Utility function to create an i2c_client structure and
+ * attach it to one of u3 adapters
+@@ -318,7 +320,7 @@ static struct i2c_client *attach_i2c_chi
+ * Let i2c-core delete that device on driver removal.
+ * This is safe because i2c-core holds the core_lock mutex for us.
+ */
+- list_add_tail(&clt->detected, &clt->driver->clients);
++ list_add_tail(&clt->detected, &therm_pm72_driver.clients);
+ return clt;
+ }
+
+--- a/drivers/macintosh/windfarm_lm75_sensor.c
++++ b/drivers/macintosh/windfarm_lm75_sensor.c
+@@ -115,6 +115,8 @@ static int wf_lm75_probe(struct i2c_clie
+ return rc;
+ }
+
++static struct i2c_driver wf_lm75_driver;
++
+ static struct i2c_client *wf_lm75_create(struct i2c_adapter *adapter,
+ u8 addr, int ds1775,
+ const char *loc)
+@@ -157,7 +159,7 @@ static struct i2c_client *wf_lm75_create
+ * Let i2c-core delete that device on driver removal.
+ * This is safe because i2c-core holds the core_lock mutex for us.
+ */
+- list_add_tail(&client->detected, &client->driver->clients);
++ list_add_tail(&client->detected, &wf_lm75_driver.clients);
+ return client;
+ fail:
+ return NULL;
+--- a/drivers/macintosh/windfarm_max6690_sensor.c
++++ b/drivers/macintosh/windfarm_max6690_sensor.c
+@@ -88,6 +88,8 @@ static int wf_max6690_probe(struct i2c_c
+ return rc;
+ }
+
++static struct i2c_driver wf_max6690_driver;
++
+ static struct i2c_client *wf_max6690_create(struct i2c_adapter *adapter,
+ u8 addr, const char *loc)
+ {
+@@ -119,7 +121,7 @@ static struct i2c_client *wf_max6690_cre
+ * Let i2c-core delete that device on driver removal.
+ * This is safe because i2c-core holds the core_lock mutex for us.
+ */
+- list_add_tail(&client->detected, &client->driver->clients);
++ list_add_tail(&client->detected, &wf_max6690_driver.clients);
+ return client;
+
+ fail:
+--- a/drivers/macintosh/windfarm_smu_sat.c
++++ b/drivers/macintosh/windfarm_smu_sat.c
+@@ -194,6 +194,8 @@ static struct wf_sensor_ops wf_sat_ops =
+ .owner = THIS_MODULE,
+ };
+
++static struct i2c_driver wf_sat_driver;
++
+ static void wf_sat_create(struct i2c_adapter *adapter, struct device_node *dev)
+ {
+ struct i2c_board_info info;
+@@ -222,7 +224,7 @@ static void wf_sat_create(struct i2c_ada
+ * Let i2c-core delete that device on driver removal.
+ * This is safe because i2c-core holds the core_lock mutex for us.
+ */
+- list_add_tail(&client->detected, &client->driver->clients);
++ list_add_tail(&client->detected, &wf_sat_driver.clients);
+ }
+
+ static int wf_sat_probe(struct i2c_client *client,
+
+
+From linux@linux.site Fri Oct 16 10:12:07 2009
+Message-Id: <20091016171206.776466941@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:31 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jean Delvare <khali@linux-fr.org>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [38/46] i2c: Hide probe errors caused by ACPI resource conflicts
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=i2c-hide-probe-errors-caused-by-acpi-resource-conflicts.patch
+Content-Length: 3921
+Lines: 118
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jean Delvare <khali@linux-fr.org>
+
+commit 18669eabde2ff5fc446e72e043f0539059763438 upstream.
+
+When an ACPI resource conflict is detected, error messages are already
+printed by ACPI. There's no point in causing the driver core to print
+more error messages, so return one of the error codes for which no
+message is printed.
+
+This fixes bug #14293:
+http://bugzilla.kernel.org/show_bug.cgi?id=14293
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/i2c/busses/i2c-amd756.c | 2 +-
+ drivers/i2c/busses/i2c-amd8111.c | 4 +++-
+ drivers/i2c/busses/i2c-i801.c | 4 +++-
+ drivers/i2c/busses/i2c-isch.c | 2 +-
+ drivers/i2c/busses/i2c-piix4.c | 4 ++--
+ drivers/i2c/busses/i2c-sis96x.c | 2 +-
+ drivers/i2c/busses/i2c-viapro.c | 2 +-
+ 7 files changed, 12 insertions(+), 8 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-amd756.c
++++ b/drivers/i2c/busses/i2c-amd756.c
+@@ -364,7 +364,7 @@ static int __devinit amd756_probe(struct
+ error = acpi_check_region(amd756_ioport, SMB_IOSIZE,
+ amd756_driver.name);
+ if (error)
+- return error;
++ return -ENODEV;
+
+ if (!request_region(amd756_ioport, SMB_IOSIZE, amd756_driver.name)) {
+ dev_err(&pdev->dev, "SMB region 0x%x already in use!\n",
+--- a/drivers/i2c/busses/i2c-amd8111.c
++++ b/drivers/i2c/busses/i2c-amd8111.c
+@@ -376,8 +376,10 @@ static int __devinit amd8111_probe(struc
+ smbus->size = pci_resource_len(dev, 0);
+
+ error = acpi_check_resource_conflict(&dev->resource[0]);
+- if (error)
++ if (error) {
++ error = -ENODEV;
+ goto out_kfree;
++ }
+
+ if (!request_region(smbus->base, smbus->size, amd8111_driver.name)) {
+ error = -EBUSY;
+--- a/drivers/i2c/busses/i2c-i801.c
++++ b/drivers/i2c/busses/i2c-i801.c
+@@ -732,8 +732,10 @@ static int __devinit i801_probe(struct p
+ }
+
+ err = acpi_check_resource_conflict(&dev->resource[SMBBAR]);
+- if (err)
++ if (err) {
++ err = -ENODEV;
+ goto exit;
++ }
+
+ err = pci_request_region(dev, SMBBAR, i801_driver.name);
+ if (err) {
+--- a/drivers/i2c/busses/i2c-isch.c
++++ b/drivers/i2c/busses/i2c-isch.c
+@@ -281,7 +281,7 @@ static int __devinit sch_probe(struct pc
+ return -ENODEV;
+ }
+ if (acpi_check_region(sch_smba, SMBIOSIZE, sch_driver.name))
+- return -EBUSY;
++ return -ENODEV;
+ if (!request_region(sch_smba, SMBIOSIZE, sch_driver.name)) {
+ dev_err(&dev->dev, "SMBus region 0x%x already in use!\n",
+ sch_smba);
+--- a/drivers/i2c/busses/i2c-piix4.c
++++ b/drivers/i2c/busses/i2c-piix4.c
+@@ -168,7 +168,7 @@ static int __devinit piix4_setup(struct
+ }
+
+ if (acpi_check_region(piix4_smba, SMBIOSIZE, piix4_driver.name))
+- return -EBUSY;
++ return -ENODEV;
+
+ if (!request_region(piix4_smba, SMBIOSIZE, piix4_driver.name)) {
+ dev_err(&PIIX4_dev->dev, "SMBus region 0x%x already in use!\n",
+@@ -259,7 +259,7 @@ static int __devinit piix4_setup_sb800(s
+
+ piix4_smba = ((smba_en_hi << 8) | smba_en_lo) & 0xffe0;
+ if (acpi_check_region(piix4_smba, SMBIOSIZE, piix4_driver.name))
+- return -EBUSY;
++ return -ENODEV;
+
+ if (!request_region(piix4_smba, SMBIOSIZE, piix4_driver.name)) {
+ dev_err(&PIIX4_dev->dev, "SMBus region 0x%x already in use!\n",
+--- a/drivers/i2c/busses/i2c-sis96x.c
++++ b/drivers/i2c/busses/i2c-sis96x.c
+@@ -280,7 +280,7 @@ static int __devinit sis96x_probe(struct
+
+ retval = acpi_check_resource_conflict(&dev->resource[SIS96x_BAR]);
+ if (retval)
+- return retval;
++ return -ENODEV;
+
+ /* Everything is happy, let's grab the memory and set things up. */
+ if (!request_region(sis96x_smbus_base, SMB_IOSIZE,
+--- a/drivers/i2c/busses/i2c-viapro.c
++++ b/drivers/i2c/busses/i2c-viapro.c
+@@ -365,7 +365,7 @@ static int __devinit vt596_probe(struct
+ found:
+ error = acpi_check_region(vt596_smba, 8, vt596_driver.name);
+ if (error)
+- return error;
++ return -ENODEV;
+
+ if (!request_region(vt596_smba, 8, vt596_driver.name)) {
+ dev_err(&pdev->dev, "SMBus region 0x%x already in use!\n",
+
+
+From linux@linux.site Fri Oct 16 10:12:07 2009
+Message-Id: <20091016171207.294878903@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:32 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jean Delvare <khali@linux-fr.org>,
+ Johannes Berg <johannes@sipsolutions.net>,
+ Takashi Iwai <tiwai@suse.de>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [39/46] ALSA: Dont assume i2c device probing always succeeds
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=alsa-don-t-assume-i2c-device-probing-always-succeeds.patch
+Content-Length: 1891
+Lines: 56
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 18c4078489fe064cc0ed08be3381cf2f26657f5f upstream.
+
+The client->driver pointer can be NULL when i2c-device probing fails
+in i2c_new_device(). This patch adds the NULL checks for client->driver
+and return the error instead of blind assumption of driver availability.
+
+Reported-by: Tim Shepard <shep@alum.mit.edu>
+Cc: Jean Delvare <khali@linux-fr.org>
+Cc: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+--- a/sound/aoa/codecs/tas.c
++++ b/sound/aoa/codecs/tas.c
+@@ -897,6 +897,15 @@ static int tas_create(struct i2c_adapter *adapter,
+ client = i2c_new_device(adapter, &info);
+ if (!client)
+ return -ENODEV;
++ /*
++ * We know the driver is already loaded, so the device should be
++ * already bound. If not it means binding failed, and then there
++ * is no point in keeping the device instantiated.
++ */
++ if (!client->driver) {
++ i2c_unregister_device(client);
++ return -ENODEV;
++ }
+
+ /*
+ * Let i2c-core delete that device on driver removal.
+diff --git a/sound/ppc/keywest.c b/sound/ppc/keywest.c
+index 835fa19..bb6819a 100644
+--- a/sound/ppc/keywest.c
++++ b/sound/ppc/keywest.c
+@@ -59,6 +59,18 @@ static int keywest_attach_adapter(struct i2c_adapter *adapter)
+ strlcpy(info.type, "keywest", I2C_NAME_SIZE);
+ info.addr = keywest_ctx->addr;
+ keywest_ctx->client = i2c_new_device(adapter, &info);
++ if (!keywest_ctx->client)
++ return -ENODEV;
++ /*
++ * We know the driver is already loaded, so the device should be
++ * already bound. If not it means binding failed, and then there
++ * is no point in keeping the device instantiated.
++ */
++ if (!keywest_ctx->client->driver) {
++ i2c_unregister_device(keywest_ctx->client);
++ keywest_ctx->client = NULL;
++ return -ENODEV;
++ }
+
+ /*
+ * Let i2c-core delete that device on driver removal.
+
+
+From linux@linux.site Fri Oct 16 10:12:08 2009
+Message-Id: <20091016171207.830595302@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:33 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Michal Schmidt <mschmidt@redhat.com>,
+ David Howells <dhowells@redhat.com>,
+ Serge Hallyn <serue@us.ibm.com>,
+ James Morris <jmorris@namei.org>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [40/46] bsdacct: switch credentials for writing to the accounting file
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=bsdacct-switch-credentials-for-writing-to-the-accounting-file.patch
+Content-Length: 1895
+Lines: 59
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Michal Schmidt <mschmidt@redhat.com>
+
+commit d8e180dcd5bbbab9cd3ff2e779efcf70692ef541 upstream.
+
+When process accounting is enabled, every exiting process writes a log to
+the account file. In addition, every once in a while one of the exiting
+processes checks whether there's enough free space for the log.
+
+SELinux policy may or may not allow the exiting process to stat the fs.
+So unsuspecting processes start generating AVC denials just because
+someone enabled process accounting.
+
+For these filesystem operations, the exiting process's credentials should
+be temporarily switched to that of the process which enabled accounting,
+because it's really that process which wanted to have the accounting
+information logged.
+
+Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
+Acked-by: David Howells <dhowells@redhat.com>
+Acked-by: Serge Hallyn <serue@us.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/acct.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/kernel/acct.c
++++ b/kernel/acct.c
+@@ -491,13 +491,17 @@ static void do_acct_process(struct bsd_a
+ u64 run_time;
+ struct timespec uptime;
+ struct tty_struct *tty;
++ const struct cred *orig_cred;
++
++ /* Perform file operations on behalf of whoever enabled accounting */
++ orig_cred = override_creds(file->f_cred);
+
+ /*
+ * First check to see if there is enough free_space to continue
+ * the process accounting system.
+ */
+ if (!check_free_space(acct, file))
+- return;
++ goto out;
+
+ /*
+ * Fill the accounting struct with the needed info as recorded
+@@ -578,6 +582,8 @@ static void do_acct_process(struct bsd_a
+ sizeof(acct_t), &file->f_pos);
+ current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
+ set_fs(fs);
++out:
++ revert_creds(orig_cred);
+ }
+
+ /**
+
+
+From linux@linux.site Fri Oct 16 10:12:08 2009
+Message-Id: <20091016171208.369491083@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:34 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ NeilBrown <neilb@suse.de>,
+ Dan Williams <dan.j.williams@intel.com>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [41/46] sysfs: Allow sysfs_notify_dirent to be called from interrupt context.
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=sysfs-allow-sysfs_notify_dirent-to-be-called-from-interrupt-context.patch
+Content-Length: 2786
+Lines: 93
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Neil Brown <neilb@suse.de>
+
+commit 83db93f4de2d9ae441a491d1dc61c2204f0195de upstream.
+
+sysfs_notify_dirent is a simple atomic operation that can be used to
+alert user-space that new data can be read from a sysfs attribute.
+
+Unfortunately it cannot currently be called from non-process context
+because of its use of spin_lock which is sometimes taken with
+interrupts enabled.
+
+So change all lockers of sysfs_open_dirent_lock to disable interrupts,
+thus making sysfs_notify_dirent safe to be called from non-process
+context (as drivers/md does in md_safemode_timeout).
+
+sysfs_get_open_dirent is (documented as being) only called from
+process context, so it uses spin_lock_irq. Other places
+use spin_lock_irqsave.
+
+The usage for sysfs_notify_dirent in md_safemode_timeout was
+introduced in 2.6.28, so this patch is suitable for that and more
+recent kernels.
+
+Reported-by: Joel Andres Granados <jgranado@redhat.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/sysfs/file.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/fs/sysfs/file.c
++++ b/fs/sysfs/file.c
+@@ -268,7 +268,7 @@ static int sysfs_get_open_dirent(struct
+ struct sysfs_open_dirent *od, *new_od = NULL;
+
+ retry:
+- spin_lock(&sysfs_open_dirent_lock);
++ spin_lock_irq(&sysfs_open_dirent_lock);
+
+ if (!sd->s_attr.open && new_od) {
+ sd->s_attr.open = new_od;
+@@ -281,7 +281,7 @@ static int sysfs_get_open_dirent(struct
+ list_add_tail(&buffer->list, &od->buffers);
+ }
+
+- spin_unlock(&sysfs_open_dirent_lock);
++ spin_unlock_irq(&sysfs_open_dirent_lock);
+
+ if (od) {
+ kfree(new_od);
+@@ -315,8 +315,9 @@ static void sysfs_put_open_dirent(struct
+ struct sysfs_buffer *buffer)
+ {
+ struct sysfs_open_dirent *od = sd->s_attr.open;
++ unsigned long flags;
+
+- spin_lock(&sysfs_open_dirent_lock);
++ spin_lock_irqsave(&sysfs_open_dirent_lock, flags);
+
+ list_del(&buffer->list);
+ if (atomic_dec_and_test(&od->refcnt))
+@@ -324,7 +325,7 @@ static void sysfs_put_open_dirent(struct
+ else
+ od = NULL;
+
+- spin_unlock(&sysfs_open_dirent_lock);
++ spin_unlock_irqrestore(&sysfs_open_dirent_lock, flags);
+
+ kfree(od);
+ }
+@@ -456,8 +457,9 @@ static unsigned int sysfs_poll(struct fi
+ void sysfs_notify_dirent(struct sysfs_dirent *sd)
+ {
+ struct sysfs_open_dirent *od;
++ unsigned long flags;
+
+- spin_lock(&sysfs_open_dirent_lock);
++ spin_lock_irqsave(&sysfs_open_dirent_lock, flags);
+
+ od = sd->s_attr.open;
+ if (od) {
+@@ -465,7 +467,7 @@ void sysfs_notify_dirent(struct sysfs_di
+ wake_up_interruptible(&od->poll);
+ }
+
+- spin_unlock(&sysfs_open_dirent_lock);
++ spin_unlock_irqrestore(&sysfs_open_dirent_lock, flags);
+ }
+ EXPORT_SYMBOL_GPL(sysfs_notify_dirent);
+
+
+
+From linux@linux.site Fri Oct 16 10:12:09 2009
+Message-Id: <20091016171208.894637208@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:35 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [42/46] Staging: rt2860sta: prevent a panic when disabling when associated
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=staging-rt2860sta-prevent-a-panic-when-disabling-when-associated.patch
+Content-Length: 1003
+Lines: 30
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Darren Salt <linux@youmustbejoking.demon.co.uk>
+
+commit 0af49167b1e5ba154e90d2c454bf4624ee47df80 upstream.
+
+This fixes a panic which is triggered when the hardware "disappears" from
+beneath the driver, i.e. when wireless is toggled off via Fn-F2 on various
+EeePC models.
+
+Ref. bug report http://bugzilla.kernel.org/show_bug.cgi?id=13390
+ panic http://bugzilla.kernel.org/attachment.cgi?id=21928
+
+Signed-off-by: Darren Salt <linux@youmustbejoking.demon.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/rt2860/common/cmm_data_2860.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/staging/rt2860/common/cmm_data_2860.c
++++ b/drivers/staging/rt2860/common/cmm_data_2860.c
+@@ -363,6 +363,8 @@ int RtmpPCIMgmtKickOut(
+ ULONG SwIdx = pAd->MgmtRing.TxCpuIdx;
+
+ pTxD = (PTXD_STRUC) pAd->MgmtRing.Cell[SwIdx].AllocVa;
++ if (!pTxD)
++ return 0;
+
+ pAd->MgmtRing.Cell[SwIdx].pNdisPacket = pPacket;
+ pAd->MgmtRing.Cell[SwIdx].pNextNdisPacket = NULL;
+
+
+From linux@linux.site Fri Oct 16 10:12:09 2009
+Message-Id: <20091016171209.422018881@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:36 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Benjamin Herrenschmidt <benh@kernel.crashing.org>,
+ Alan Stern <stern@rowland.harvard.edu>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [43/46] usb-storage: Workaround devices with bogus sense size
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=usb-storage-workaround-devices-with-bogus-sense-size.patch
+Content-Length: 2070
+Lines: 60
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+commit b8430e1b82b7e514d76a88eb70a7d8831d50df1e upstream.
+
+usb-storage: Workaround devices with bogus sense size
+
+Some devices, such as Huawei E169, advertise more than the standard
+amount of sense data, causing us to set US_FL_SANE_SENSE, assuming
+they support it. However, they subsequently fail the request sense
+with that size.
+
+This works around it generically. When a sense request fails due to
+a device returning an error, US_FL_SANE_SENSE was set, and that sense
+request used a larger sense size, we retry with a smaller size before
+giving up.
+
+Based on an original patch by Ben Efros <ben@pc-doctor.com>
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/storage/transport.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/storage/transport.c
++++ b/drivers/usb/storage/transport.c
+@@ -696,7 +696,7 @@ void usb_stor_invoke_transport(struct sc
+ /* device supports and needs bigger sense buffer */
+ if (us->fflags & US_FL_SANE_SENSE)
+ sense_size = ~0;
+-
++Retry_Sense:
+ US_DEBUGP("Issuing auto-REQUEST_SENSE\n");
+
+ scsi_eh_prep_cmnd(srb, &ses, NULL, 0, sense_size);
+@@ -720,6 +720,21 @@ void usb_stor_invoke_transport(struct sc
+ srb->result = DID_ABORT << 16;
+ goto Handle_Errors;
+ }
++
++ /* Some devices claim to support larger sense but fail when
++ * trying to request it. When a transport failure happens
++ * using US_FS_SANE_SENSE, we always retry with a standard
++ * (small) sense request. This fixes some USB GSM modems
++ */
++ if (temp_result == USB_STOR_TRANSPORT_FAILED &&
++ (us->fflags & US_FL_SANE_SENSE) &&
++ sense_size != US_SENSE_SIZE) {
++ US_DEBUGP("-- auto-sense failure, retry small sense\n");
++ sense_size = US_SENSE_SIZE;
++ goto Retry_Sense;
++ }
++
++ /* Other failures */
+ if (temp_result != USB_STOR_TRANSPORT_GOOD) {
+ US_DEBUGP("-- auto-sense failure\n");
+
+
+
+From linux@linux.site Fri Oct 16 10:12:10 2009
+Message-Id: <20091016171209.947222482@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:37 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jay Sternberg <jay.e.sternberg@intel.com>,
+ Reinette Chatre <reinette.chatre@intel.com>,
+ "John W. Linville" <linville@tuxdriver.com>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [44/46] iwlwifi: incorrect method used for finding valid OTP blocks
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=iwlwifi-incorrect-method-used-for-finding-valid-otp-blocks.patch
+Content-Length: 2752
+Lines: 81
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jay Sternberg <jay.e.sternberg@intel.com>
+
+commit 2facba769d7f9e563cf706de709074a2d20f1bba upstream.
+
+The address stored in the next link address is a word address but when
+reading the OTP blocks, a byte address is used. Also if the blocks are
+full and the last link pointer is not zero, then none of the blocks are
+valid so return an error.
+
+The algorithm is simply valid blocks have a next address and that
+address's contents is zero.
+
+Using the wrong address for the next link address gets arbitrary data,
+obviously. In cases seen, the first block is considered valid when it is not.
+
+If the block has in fact been invalidated there may be old data or
+there may be no data, bad data, or partial data, there is no way of
+telling. Without this patch it is possible that a device with valid OTP data
+is unable to work.
+
+Signed-off-by: Jay Sternberg <jay.e.sternberg@intel.com>
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-eeprom.c | 23 +++++++++++------------
+ 1 file changed, 11 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.c
++++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
+@@ -335,7 +335,6 @@ static int iwl_find_otp_image(struct iwl
+ u16 *validblockaddr)
+ {
+ u16 next_link_addr = 0, link_value = 0, valid_addr;
+- int ret = 0;
+ int usedblocks = 0;
+
+ /* set addressing mode to absolute to traverse the link list */
+@@ -355,29 +354,29 @@ static int iwl_find_otp_image(struct iwl
+ * check for more block on the link list
+ */
+ valid_addr = next_link_addr;
+- next_link_addr = link_value;
++ next_link_addr = link_value * sizeof(u16);
+ IWL_DEBUG_INFO(priv, "OTP blocks %d addr 0x%x\n",
+ usedblocks, next_link_addr);
+ if (iwl_read_otp_word(priv, next_link_addr, &link_value))
+ return -EINVAL;
+ if (!link_value) {
+ /*
+- * reach the end of link list,
++ * reach the end of link list, return success and
+ * set address point to the starting address
+ * of the image
+ */
+- goto done;
++ *validblockaddr = valid_addr;
++ /* skip first 2 bytes (link list pointer) */
++ *validblockaddr += 2;
++ return 0;
+ }
+ /* more in the link list, continue */
+ usedblocks++;
+- } while (usedblocks < priv->cfg->max_ll_items);
+- /* OTP full, use last block */
+- IWL_DEBUG_INFO(priv, "OTP is full, use last block\n");
+-done:
+- *validblockaddr = valid_addr;
+- /* skip first 2 bytes (link list pointer) */
+- *validblockaddr += 2;
+- return ret;
++ } while (usedblocks <= priv->cfg->max_ll_items);
++
++ /* OTP has no valid blocks */
++ IWL_DEBUG_INFO(priv, "OTP has no valid blocks\n");
++ return -EINVAL;
+ }
+
+ /**
+
+
+From linux@linux.site Fri Oct 16 10:12:10 2009
+Message-Id: <20091016171210.469831545@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:38 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Johannes Berg <johannes@sipsolutions.net>,
+ "John W. Linville" <linville@tuxdriver.com>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [45/46] mac80211: fix vlan and optimise RX
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=mac80211-fix-vlan-and-optimise-rx.patch
+Content-Length: 2668
+Lines: 83
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Johannes Berg <johannes@sipsolutions.net>
+
+commit fbc44bf7177dfd61381da55405550b693943a432 upstream.
+
+When receiving data frames, we can send them only to
+the interface they belong to based on transmitting
+station (this doesn't work for probe requests). Also,
+don't try to handle other frames for AP_VLAN at all
+since those interface should only receive data.
+
+Additionally, the transmit side must check that the
+station we're sending a frame to is actually on the
+interface we're transmitting on, and not transmit
+packets to functions that live on other interfaces,
+so validate that as well.
+
+Another bug fix is needed in sta_info.c where in the
+VLAN case when adding/removing stations we overwrite
+the sdata variable we still need.
+
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/rx.c | 10 ++++++++--
+ net/mac80211/sta_info.c | 2 ++
+ net/mac80211/tx.c | 3 ++-
+ 3 files changed, 12 insertions(+), 3 deletions(-)
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2155,11 +2155,17 @@ static void __ieee80211_rx_handle_packet
+
+ skb = rx.skb;
+
+- list_for_each_entry_rcu(sdata, &local->interfaces, list) {
++ if (rx.sdata && ieee80211_is_data(hdr->frame_control)) {
++ rx.flags |= IEEE80211_RX_RA_MATCH;
++ prepares = prepare_for_handlers(rx.sdata, &rx, hdr);
++ if (prepares)
++ prev = rx.sdata;
++ } else list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+ if (!netif_running(sdata->dev))
+ continue;
+
+- if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
++ if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
++ sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+ continue;
+
+ rx.flags |= IEEE80211_RX_RA_MATCH;
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -360,6 +360,7 @@ int sta_info_insert(struct sta_info *sta
+ u.ap);
+
+ drv_sta_notify(local, &sdata->vif, STA_NOTIFY_ADD, &sta->sta);
++ sdata = sta->sdata;
+ }
+
+ #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+@@ -494,6 +495,7 @@ static void __sta_info_unlink(struct sta
+
+ drv_sta_notify(local, &sdata->vif, STA_NOTIFY_REMOVE,
+ &(*sta)->sta);
++ sdata = (*sta)->sdata;
+ }
+
+ if (ieee80211_vif_is_mesh(&sdata->vif)) {
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1736,7 +1736,8 @@ int ieee80211_subif_start_xmit(struct sk
+ if (!is_multicast_ether_addr(hdr.addr1)) {
+ rcu_read_lock();
+ sta = sta_info_get(local, hdr.addr1);
+- if (sta)
++ /* XXX: in the future, use sdata to look up the sta */
++ if (sta && sta->sdata == sdata)
+ sta_flags = get_sta_flags(sta);
+ rcu_read_unlock();
+ }
+
+
+From linux@linux.site Fri Oct 16 10:12:11 2009
+Message-Id: <20091016171210.987917756@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:10:39 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Paul Fulghum <paulkf@microgate.com>,
+ Greg Kroah-Hartman <gregkh@suse.de>
+Subject: [46/46] tty: Make flush_to_ldisc() locking more robust
+References: <20091016170953.128828149@linux.site>
+Content-Disposition: inline; filename=tty-make-flush_to_ldisc-locking-more-robust.patch
+Content-Length: 4245
+Lines: 117
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit c8e33141911bf8fe87dc6c92793b9a59b2be0130 upstream.
+
+The locking logic in this function is extremely subtle, and it broke
+when we started doing potentially concurrent 'flush_to_ldisc()' calls in
+commit e043e42bdb66885b3ac10d27a01ccb9972e2b0a3 ("pty: avoid forcing
+'low_latency' tty flag").
+
+The code in flush_to_ldisc() used to set 'tty->buf.head' to NULL, with
+the intention that this would then cause any other concurrent calls to
+not do anything (locking note: we have to drop the buf.lock over the
+call to ->receive_buf that can block, which is why we can have
+concurrency here at all in the first place).
+
+It also used to set the TTY_FLUSHING bit, which would then cause any
+concurrent 'tty_buffer_flush()' to not free all the tty buffers and
+clear 'tty->buf.tail'. And with 'buf.head' being NULL, and 'buf.tail'
+being non-NULL, new data would never touch 'buf.head'.
+
+Does that sound a bit too subtle? It was. If another concurrent call to
+'flush_to_ldisc()' were to come in, the NULL buf.head would indeed cause
+it to not process the buffer list, but it would still clear TTY_FLUSHING
+afterwards, making the buffer protection against 'tty_buffer_flush()' no
+longer work.
+
+So this clears it all up. We depend purely on TTY_FLUSHING for handling
+re-entrancy, and stop playing games with the buffer list entirely. In
+fact, the buffer list handling is now robust enough that we could
+probably stop doing the whole "protect against 'tty_buffer_flush()'"
+thing entirely.
+
+However, Alan also points out that we would probably be better off
+simplifying the locking even further, and just take the tty ldisc_mutex
+around all the buffer flushing calls. That seems like a good idea, but
+in the meantime this is a conceptually minimal fix (with the patch
+itself being bigger than required just to clean the code up and make it
+readable).
+
+This fixes keyboard trouble under X:
+
+ http://bugzilla.kernel.org/show_bug.cgi?id=14388
+
+Reported-and-tested-by: Frédéric Meunier <fredlwm@gmail.com>
+Reported-and-tested-by: Boyan <btanastasov@yahoo.co.uk>
+Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
+Cc: Paul Fulghum <paulkf@microgate.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/tty_buffer.c | 29 +++++++++++++----------------
+ 1 file changed, 13 insertions(+), 16 deletions(-)
+
+--- a/drivers/char/tty_buffer.c
++++ b/drivers/char/tty_buffer.c
+@@ -402,28 +402,26 @@ static void flush_to_ldisc(struct work_s
+ container_of(work, struct tty_struct, buf.work.work);
+ unsigned long flags;
+ struct tty_ldisc *disc;
+- struct tty_buffer *tbuf, *head;
+- char *char_buf;
+- unsigned char *flag_buf;
+
+ disc = tty_ldisc_ref(tty);
+ if (disc == NULL) /* !TTY_LDISC */
+ return;
+
+ spin_lock_irqsave(&tty->buf.lock, flags);
+- /* So we know a flush is running */
+- set_bit(TTY_FLUSHING, &tty->flags);
+- head = tty->buf.head;
+- if (head != NULL) {
+- tty->buf.head = NULL;
+- for (;;) {
+- int count = head->commit - head->read;
++
++ if (!test_and_set_bit(TTY_FLUSHING, &tty->flags)) {
++ struct tty_buffer *head;
++ while ((head = tty->buf.head) != NULL) {
++ int count;
++ char *char_buf;
++ unsigned char *flag_buf;
++
++ count = head->commit - head->read;
+ if (!count) {
+ if (head->next == NULL)
+ break;
+- tbuf = head;
+- head = head->next;
+- tty_buffer_free(tty, tbuf);
++ tty->buf.head = head->next;
++ tty_buffer_free(tty, head);
+ continue;
+ }
+ /* Ldisc or user is trying to flush the buffers
+@@ -445,9 +443,9 @@ static void flush_to_ldisc(struct work_s
+ flag_buf, count);
+ spin_lock_irqsave(&tty->buf.lock, flags);
+ }
+- /* Restore the queue head */
+- tty->buf.head = head;
++ clear_bit(TTY_FLUSHING, &tty->flags);
+ }
++
+ /* We may have a deferred request to flush the input buffer,
+ if so pull the chain under the lock and empty the queue */
+ if (test_bit(TTY_FLUSHPENDING, &tty->flags)) {
+@@ -455,7 +453,6 @@ static void flush_to_ldisc(struct work_s
+ clear_bit(TTY_FLUSHPENDING, &tty->flags);
+ wake_up(&tty->read_wait);
+ }
+- clear_bit(TTY_FLUSHING, &tty->flags);
+ spin_unlock_irqrestore(&tty->buf.lock, flags);
+
+ tty_ldisc_deref(disc);
+
+
+From linux@linux.site Fri Oct 16 10:11:46 2009
+Message-Id: <20091016170953.128828149@linux.site>
+User-Agent: quilt/0.47-14.9
+Date: Fri, 16 Oct 2009 10:09:53 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [00/46] 2.6.31.5-stable review
+Content-Length: 4951
+Lines: 95
+
+This is the start of the stable review cycle for the 2.6.31.5 release.
+There are 46 patches in this series, all will be posted as a response to
+this one. If anyone has any issues with these being applied, please let
+us know. If anyone is a maintainer of the proper subsystem, and wants
+to add a Signed-off-by: line to the patch, please respond with it.
+
+Responses should be made by Sunday, October 18, 18:00:00 UTC.
+Anything received after that time might be too late.
+
+The whole patch series can be found in one patch at:
+ kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.31.5-rc1.gz
+and the diffstat can be found below.
+
+
+thanks,
+
+greg k-h
+
+----------
+
+ Documentation/connector/cn_test.c | 4 +-
+ Documentation/connector/connector.txt | 8 +-
+ MAINTAINERS | 2 +-
+ Makefile | 7 +-
+ arch/arm/Makefile | 2 +-
+ arch/arm/kernel/Makefile | 3 +-
+ arch/arm/mach-pxa/cpufreq-pxa2xx.c | 2 +-
+ arch/cris/Makefile | 2 -
+ arch/cris/kernel/Makefile | 1 +
+ arch/mips/Makefile | 27 +--
+ arch/mips/kernel/vmlinux.lds.S | 13 +-
+ arch/powerpc/Makefile | 2 -
+ arch/sparc/Makefile | 4 -
+ arch/sparc/kernel/Makefile | 6 +-
+ arch/um/Makefile | 9 +-
+ arch/um/kernel/Makefile | 3 +
+ arch/um/kernel/vmlinux.lds.S | 3 +
+ arch/x86/include/asm/paravirt.h | 38 +--
+ arch/xtensa/kernel/Makefile | 3 +-
+ drivers/char/tpm/tpm.c | 8 +-
+ drivers/char/tty_buffer.c | 29 +-
+ drivers/connector/cn_proc.c | 3 +-
+ drivers/connector/cn_queue.c | 15 +-
+ drivers/connector/connector.c | 24 +-
+ drivers/i2c/busses/i2c-amd756.c | 2 +-
+ drivers/i2c/busses/i2c-amd8111.c | 4 +-
+ drivers/i2c/busses/i2c-i801.c | 4 +-
+ drivers/i2c/busses/i2c-isch.c | 2 +-
+ drivers/i2c/busses/i2c-piix4.c | 4 +-
+ drivers/i2c/busses/i2c-sis96x.c | 2 +-
+ drivers/i2c/busses/i2c-viapro.c | 2 +-
+ drivers/macintosh/therm_adt746x.c | 4 +-
+ drivers/macintosh/therm_pm72.c | 4 +-
+ drivers/macintosh/windfarm_lm75_sensor.c | 4 +-
+ drivers/macintosh/windfarm_max6690_sensor.c | 4 +-
+ drivers/macintosh/windfarm_smu_sat.c | 4 +-
+ drivers/md/dm-log-userspace-transfer.c | 6 +-
+ drivers/net/e1000e/82571.c | 4 +-
+ drivers/net/wireless/iwlwifi/iwl-eeprom.c | 23 +-
+ drivers/pci/dmar.c | 22 +-
+ drivers/scsi/scsi.c | 11 +-
+ drivers/scsi/scsi_error.c | 3 +
+ drivers/scsi/sg.c | 10 +-
+ drivers/staging/dst/dcore.c | 8 +-
+ drivers/staging/pohmelfs/config.c | 6 +-
+ drivers/staging/rt2860/common/cmm_data_2860.c | 2 +
+ drivers/usb/serial/cp210x.c | 1 +
+ drivers/usb/serial/digi_acceleport.c | 8 +-
+ drivers/usb/serial/ftdi_sio.c | 422 ++++++++-----------------
+ drivers/usb/serial/generic.c | 2 +-
+ drivers/usb/serial/ipaq.c | 9 +
+ drivers/usb/serial/option.c | 2 +
+ drivers/usb/serial/pl2303.c | 8 +-
+ drivers/usb/serial/usb-serial.c | 6 +-
+ drivers/usb/storage/transport.c | 46 +++-
+ drivers/video/uvesafb.c | 6 +-
+ drivers/w1/w1_netlink.c | 3 +-
+ fs/sysfs/file.c | 14 +-
+ include/linux/connector.h | 11 +-
+ include/linux/usb/serial.h | 1 +
+ include/net/bluetooth/hci_core.h | 4 +
+ kernel/acct.c | 8 +-
+ kernel/futex.c | 39 ++-
+ kernel/trace/trace_events_filter.c | 3 +-
+ net/bluetooth/hci_conn.c | 17 +-
+ net/bluetooth/hci_event.c | 2 +
+ net/bluetooth/hidp/core.c | 65 +++--
+ net/bluetooth/hidp/hidp.h | 2 +
+ net/mac80211/rx.c | 10 +-
+ net/mac80211/sta_info.c | 2 +
+ net/mac80211/tx.c | 3 +-
+ scripts/Makefile.build | 3 +-
+ sound/aoa/codecs/tas.c | 9 +
+ sound/ppc/keywest.c | 12 +
+ 74 files changed, 525 insertions(+), 546 deletions(-)
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
