--- /dev/null
+From 868003ca7ad17ac6c1606dc36101f10a7825b399 Mon Sep 17 00:00:00 2001
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Date: Mon, 2 Aug 2010 08:32:22 +0100
+Subject: ARM: 6280/1: imx: Fix build failure when including <mach/gpio.h> without <linux/spinlock.h>
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+commit 868003ca7ad17ac6c1606dc36101f10a7825b399 upstream.
+
+This is a follow up to
+
+ 14cb0de (arm/imx/gpio: add spinlock protection)
+
+and fixes the following build failure:
+
+ CC arch/arm/mach-imx/pcm970-baseboard.o
+ In file included from arch/arm/include/asm/gpio.h:6,
+ from include/linux/gpio.h:8,
+ from arch/arm/mach-imx/pcm970-baseboard.c:20:
+ arch/arm/plat-mxc/include/mach/gpio.h:40: error: expected specifier-qualifier-list before 'spinlock_t'
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+
+---
+ arch/arm/plat-mxc/include/mach/gpio.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/plat-mxc/include/mach/gpio.h
++++ b/arch/arm/plat-mxc/include/mach/gpio.h
+@@ -19,6 +19,7 @@
+ #ifndef __ASM_ARCH_MXC_GPIO_H__
+ #define __ASM_ARCH_MXC_GPIO_H__
+
++#include <linux/spinlock.h>
+ #include <mach/hardware.h>
+ #include <asm-generic/gpio.h>
+
--- /dev/null
+From cdf357f1e13a08a11261edacb3083746f65c1ed9 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Thu, 5 Aug 2010 11:20:51 +0100
+Subject: ARM: 6299/1: errata: TLBIASIDIS and TLBIMVAIS operations can broadcast a faulty ASID
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit cdf357f1e13a08a11261edacb3083746f65c1ed9 upstream.
+
+On versions of the Cortex-A9 prior to r2p0, performing TLB invalidations by
+ASID match can result in the incorrect ASID being broadcast to other CPUs.
+As a consequence of this, the targetted TLB entries are not invalidated
+across the system.
+
+This workaround changes the TLB flushing routines to invalidate entries
+regardless of the ASID.
+
+Tested-by: Rob Clark <rob@ti.com>
+Acked-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/Kconfig | 12 ++++++++++++
+ arch/arm/include/asm/tlbflush.h | 8 ++++++++
+ 2 files changed, 20 insertions(+)
+
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -1027,6 +1027,18 @@ config PL310_ERRATA_588369
+ is not correctly implemented in PL310 as clean lines are not
+ invalidated as a result of these operations. Note that this errata
+ uses Texas Instrument's secure monitor api.
++
++config ARM_ERRATA_720789
++ bool "ARM errata: TLBIASIDIS and TLBIMVAIS operations can broadcast a faulty ASID"
++ depends on CPU_V7 && SMP
++ help
++ This option enables the workaround for the 720789 Cortex-A9 (prior to
++ r2p0) erratum. A faulty ASID can be sent to the other CPUs for the
++ broadcasted CP15 TLB maintenance operations TLBIASIDIS and TLBIMVAIS.
++ As a consequence of this erratum, some TLB entries which should be
++ invalidated are not, resulting in an incoherency in the system page
++ tables. The workaround changes the TLB flushing routines to invalidate
++ entries regardless of the ASID.
+ endmenu
+
+ source "arch/arm/common/Kconfig"
+--- a/arch/arm/include/asm/tlbflush.h
++++ b/arch/arm/include/asm/tlbflush.h
+@@ -378,7 +378,11 @@ static inline void local_flush_tlb_mm(st
+ if (tlb_flag(TLB_V6_I_ASID))
+ asm("mcr p15, 0, %0, c8, c5, 2" : : "r" (asid) : "cc");
+ if (tlb_flag(TLB_V7_UIS_ASID))
++#ifdef CONFIG_ARM_ERRATA_720789
++ asm("mcr p15, 0, %0, c8, c3, 0" : : "r" (zero) : "cc");
++#else
+ asm("mcr p15, 0, %0, c8, c3, 2" : : "r" (asid) : "cc");
++#endif
+
+ if (tlb_flag(TLB_BTB)) {
+ /* flush the branch target cache */
+@@ -424,7 +428,11 @@ local_flush_tlb_page(struct vm_area_stru
+ if (tlb_flag(TLB_V6_I_PAGE))
+ asm("mcr p15, 0, %0, c8, c5, 1" : : "r" (uaddr) : "cc");
+ if (tlb_flag(TLB_V7_UIS_PAGE))
++#ifdef CONFIG_ARM_ERRATA_720789
++ asm("mcr p15, 0, %0, c8, c3, 3" : : "r" (uaddr & PAGE_MASK) : "cc");
++#else
+ asm("mcr p15, 0, %0, c8, c3, 1" : : "r" (uaddr) : "cc");
++#endif
+
+ if (tlb_flag(TLB_BTB)) {
+ /* flush the branch target cache */
--- /dev/null
+From aca27ba9618276dd2f777bcd5a1419589ccf1ca8 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Tue, 3 Aug 2010 13:14:33 +0200
+Subject: bio, fs: update RWA_MASK, READA and SWRITE to match the corresponding BIO_RW_* bits
+
+From: Tejun Heo <tj@kernel.org>
+
+commit aca27ba9618276dd2f777bcd5a1419589ccf1ca8 upstream.
+
+Commit a82afdf (block: use the same failfast bits for bio and request)
+moved BIO_RW_* bits around such that they match up with REQ_* bits.
+Unfortunately, fs.h hard coded RW_MASK, RWA_MASK, READ, WRITE, READA
+and SWRITE as 0, 1, 2 and 3, and expected them to match with BIO_RW_*
+bits. READ/WRITE didn't change but BIO_RW_AHEAD was moved to bit 4
+instead of bit 1, breaking RWA_MASK, READA and SWRITE.
+
+This patch updates RWA_MASK, READA and SWRITE such that they match the
+BIO_RW_* bits again. A follow up patch will update the definitions to
+directly use BIO_RW_* bits so that this kind of breakage won't happen
+again.
+
+Neil also spotted missing RWA_MASK conversion.
+
+Stable: The offending commit a82afdf was released with v2.6.32, so
+this patch should be applied to all kernels since then but it must
+_NOT_ be applied to kernels earlier than that.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-and-bisected-by: Vladislav Bolkhovitin <vst@vlnb.net>
+Root-caused-by: Neil Brown <neilb@suse.de>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/fs.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -145,11 +145,11 @@ struct inodes_stat_t {
+ *
+ */
+ #define RW_MASK 1
+-#define RWA_MASK 2
++#define RWA_MASK 16
+ #define READ 0
+ #define WRITE 1
+-#define READA 2 /* read-ahead - don't block if no resources */
+-#define SWRITE 3 /* for ll_rw_block() - wait for buffer lock */
++#define READA 16 /* readahead - don't block if no resources */
++#define SWRITE 17 /* for ll_rw_block(), wait for buffer lock */
+ #define READ_SYNC (READ | (1 << BIO_RW_SYNCIO) | (1 << BIO_RW_UNPLUG))
+ #define READ_META (READ | (1 << BIO_RW_META))
+ #define WRITE_SYNC_PLUG (WRITE | (1 << BIO_RW_SYNCIO) | (1 << BIO_RW_NOIDLE))
--- /dev/null
+From b7300b78d1a87625975a799a109a2f98d77757c8 Mon Sep 17 00:00:00 2001
+From: Chris Wright <chrisw@sous-sol.org>
+Date: Tue, 10 Aug 2010 18:02:55 -0700
+Subject: blkdev: cgroup whitelist permission fix
+
+From: Chris Wright <chrisw@sous-sol.org>
+
+commit b7300b78d1a87625975a799a109a2f98d77757c8 upstream.
+
+The cgroup device whitelist code gets confused when trying to grant
+permission to a disk partition that is not currently open. Part of
+blkdev_open() includes __blkdev_get() on the whole disk.
+
+Basically, the only ways to reliably allow a cgroup access to a partition
+on a block device when using the whitelist are to 1) also give it access
+to the whole block device or 2) make sure the partition is already open in
+a different context.
+
+The patch avoids the cgroup check for the whole disk case when opening a
+partition.
+
+Addresses https://bugzilla.redhat.com/show_bug.cgi?id=589662
+
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Acked-by: Serge E. Hallyn <serue@us.ibm.com>
+Tested-by: Serge E. Hallyn <serue@us.ibm.com>
+Reported-by: Vivek Goyal <vgoyal@redhat.com>
+Cc: Al Viro <viro@ZenIV.linux.org.uk>
+Cc: Christoph Hellwig <hch@infradead.org>
+Cc: "Daniel P. Berrange" <berrange@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/block_dev.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -1339,10 +1339,12 @@ static int __blkdev_get(struct block_dev
+ /*
+ * hooks: /n/, see "layering violations".
+ */
+- ret = devcgroup_inode_permission(bdev->bd_inode, perm);
+- if (ret != 0) {
+- bdput(bdev);
+- return ret;
++ if (!for_part) {
++ ret = devcgroup_inode_permission(bdev->bd_inode, perm);
++ if (ret != 0) {
++ bdput(bdev);
++ return ret;
++ }
+ }
+
+ lock_kernel();
--- /dev/null
+From 0a79f67445de50ca0a8dc1d34f3cc406d89c28b2 Mon Sep 17 00:00:00 2001
+From: Cyril Lacoux <clacoux@ifeelgood.org>
+Date: Wed, 14 Jul 2010 10:29:27 +0400
+Subject: Bluetooth: Added support for controller shipped with iMac i5
+
+From: Cyril Lacoux <clacoux@ifeelgood.org>
+
+commit 0a79f67445de50ca0a8dc1d34f3cc406d89c28b2 upstream.
+
+Device class is ff(vend.) instead of e0(wlcon).
+
+Output from command `usb-devices`:
+T: Bus=01 Lev=03 Prnt=03 Port=00 Cnt=01 Dev#= 6 Spd=12 MxCh= 0
+D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=05ac ProdID=8215 Rev=01.82
+S: Manufacturer=Apple Inc.
+S: Product=Bluetooth USB Host Controller
+S: SerialNumber=7C6D62936607
+C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA
+I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
+I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+I: If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=00 Driver=(none)
+
+Signed-off-by: Cyril Lacoux <clacoux@ifeelgood.org>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/bluetooth/btusb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -59,6 +59,9 @@ static struct usb_device_id btusb_table[
+ /* Generic Bluetooth USB device */
+ { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
+
++ /* Apple iMac11,1 */
++ { USB_DEVICE(0x05ac, 0x8215) },
++
+ /* AVM BlueFRITZ! USB v2.0 */
+ { USB_DEVICE(0x057c, 0x3800) },
+
--- /dev/null
+From 0b767f96164b2b27488e3daa722ff16e89d49314 Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <virtuoso@slind.org>
+Date: Thu, 3 Jun 2010 20:53:43 +1000
+Subject: crypto: testmgr - add an option to disable cryptoalgos' self-tests
+
+From: Alexander Shishkin <virtuoso@slind.org>
+
+commit 0b767f96164b2b27488e3daa722ff16e89d49314 upstream.
+
+By default, CONFIG_CRYPTO_MANAGER_TESTS will be enabled and thus
+self-tests will still run, but it is now possible to disable them
+to gain some time during bootup.
+
+Signed-off-by: Alexander Shishkin <virtuoso@slind.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ crypto/Kconfig | 8 ++++++++
+ crypto/algboss.c | 4 ++++
+ crypto/testmgr.c | 14 ++++++++++++++
+ 3 files changed, 26 insertions(+)
+
+--- a/crypto/Kconfig
++++ b/crypto/Kconfig
+@@ -96,6 +96,14 @@ config CRYPTO_MANAGER2
+ select CRYPTO_BLKCIPHER2
+ select CRYPTO_PCOMP
+
++config CRYPTO_MANAGER_TESTS
++ bool "Run algolithms' self-tests"
++ default y
++ depends on CRYPTO_MANAGER2
++ help
++ Run cryptomanager's tests for the new crypto algorithms being
++ registered.
++
+ config CRYPTO_GF128MUL
+ tristate "GF(2^128) multiplication functions (EXPERIMENTAL)"
+ depends on EXPERIMENTAL
+--- a/crypto/algboss.c
++++ b/crypto/algboss.c
+@@ -206,6 +206,7 @@ err:
+ return NOTIFY_OK;
+ }
+
++#ifdef CONFIG_CRYPTO_MANAGER_TESTS
+ static int cryptomgr_test(void *data)
+ {
+ struct crypto_test_param *param = data;
+@@ -266,6 +267,7 @@ err_put_module:
+ err:
+ return NOTIFY_OK;
+ }
++#endif /* CONFIG_CRYPTO_MANAGER_TESTS */
+
+ static int cryptomgr_notify(struct notifier_block *this, unsigned long msg,
+ void *data)
+@@ -273,8 +275,10 @@ static int cryptomgr_notify(struct notif
+ switch (msg) {
+ case CRYPTO_MSG_ALG_REQUEST:
+ return cryptomgr_schedule_probe(data);
++#ifdef CONFIG_CRYPTO_MANAGER_TESTS
+ case CRYPTO_MSG_ALG_REGISTER:
+ return cryptomgr_schedule_test(data);
++#endif
+ }
+
+ return NOTIFY_DONE;
+--- a/crypto/testmgr.c
++++ b/crypto/testmgr.c
+@@ -22,6 +22,17 @@
+ #include <crypto/rng.h>
+
+ #include "internal.h"
++
++#ifndef CONFIG_CRYPTO_MANAGER_TESTS
++
++/* a perfect nop */
++int alg_test(const char *driver, const char *alg, u32 type, u32 mask)
++{
++ return 0;
++}
++
++#else
++
+ #include "testmgr.h"
+
+ /*
+@@ -2530,4 +2541,7 @@ notest:
+ non_fips_alg:
+ return -EINVAL;
+ }
++
++#endif /* CONFIG_CRYPTO_MANAGER_TESTS */
++
+ EXPORT_SYMBOL_GPL(alg_test);
--- /dev/null
+From 6710a5760355be8f2e51682f41b0d3fc76550309 Mon Sep 17 00:00:00 2001
+From: Philipp Reisner <philipp.reisner@linbit.com>
+Date: Mon, 19 Jul 2010 15:04:57 +0200
+Subject: drbd: Disable delay probes for the upcomming release
+
+From: Philipp Reisner <philipp.reisner@linbit.com>
+
+commit 6710a5760355be8f2e51682f41b0d3fc76550309 upstream.
+
+Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
+Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/block/drbd/drbd_main.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/drivers/block/drbd/drbd_main.c
++++ b/drivers/block/drbd/drbd_main.c
+@@ -2371,11 +2371,7 @@ static int _drbd_send_zc_ee(struct drbd_
+
+ static void consider_delay_probes(struct drbd_conf *mdev)
+ {
+- if (mdev->state.conn != C_SYNC_SOURCE || mdev->agreed_pro_version < 93)
+- return;
+-
+- if (mdev->dp_volume_last + mdev->sync_conf.dp_volume * 2 < mdev->send_cnt)
+- drbd_send_delay_probes(mdev);
++ return;
+ }
+
+ static int w_delay_probes(struct drbd_conf *mdev, struct drbd_work *w, int cancel)
--- /dev/null
+From 85f4cc17a62c3ac9edeaf120cdae7261df458053 Mon Sep 17 00:00:00 2001
+From: Philipp Reisner <philipp.reisner@linbit.com>
+Date: Tue, 29 Jun 2010 17:35:34 +0200
+Subject: drbd: Initialize all members of sync_conf to their defaults [Bugz 315]
+
+From: Philipp Reisner <philipp.reisner@linbit.com>
+
+commit 85f4cc17a62c3ac9edeaf120cdae7261df458053 upstream.
+
+Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
+Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/block/drbd/drbd_main.c | 21 ++++++++++++++++++---
+ 1 file changed, 18 insertions(+), 3 deletions(-)
+
+--- a/drivers/block/drbd/drbd_main.c
++++ b/drivers/block/drbd/drbd_main.c
+@@ -2660,9 +2660,24 @@ static void drbd_unplug_fn(struct reques
+
+ static void drbd_set_defaults(struct drbd_conf *mdev)
+ {
+- mdev->sync_conf.after = DRBD_AFTER_DEF;
+- mdev->sync_conf.rate = DRBD_RATE_DEF;
+- mdev->sync_conf.al_extents = DRBD_AL_EXTENTS_DEF;
++ /* This way we get a compile error when sync_conf grows,
++ and we forgot to initialize it here */
++ mdev->sync_conf = (struct syncer_conf) {
++ /* .rate = */ DRBD_RATE_DEF,
++ /* .after = */ DRBD_AFTER_DEF,
++ /* .al_extents = */ DRBD_AL_EXTENTS_DEF,
++ /* .dp_volume = */ DRBD_DP_VOLUME_DEF,
++ /* .dp_interval = */ DRBD_DP_INTERVAL_DEF,
++ /* .throttle_th = */ DRBD_RS_THROTTLE_TH_DEF,
++ /* .hold_off_th = */ DRBD_RS_HOLD_OFF_TH_DEF,
++ /* .verify_alg = */ {}, 0,
++ /* .cpu_mask = */ {}, 0,
++ /* .csums_alg = */ {}, 0,
++ /* .use_rle = */ 0
++ };
++
++ /* Have to use that way, because the layout differs between
++ big endian and little endian */
+ mdev->state = (union drbd_state) {
+ { .role = R_SECONDARY,
+ .peer = R_UNKNOWN,
--- /dev/null
+From a4967de6cbb260ad0f6612a1d2035e119ef1578f Mon Sep 17 00:00:00 2001
+From: Adam Jackson <ajax@redhat.com>
+Date: Wed, 28 Jul 2010 07:40:32 +1000
+Subject: drm/edid: Fix the HDTV hack sync adjustment
+
+From: Adam Jackson <ajax@redhat.com>
+
+commit a4967de6cbb260ad0f6612a1d2035e119ef1578f upstream.
+
+We're adjusting horizontal timings only here, moving vsync was just a
+slavish translation of a typo in the X server.
+
+Signed-off-by: Adam Jackson <ajax@redhat.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -864,8 +864,8 @@ drm_mode_std(struct drm_connector *connector, struct edid *edid,
+ mode = drm_cvt_mode(dev, 1366, 768, vrefresh_rate, 0, 0,
+ false);
+ mode->hdisplay = 1366;
+- mode->vsync_start = mode->vsync_start - 1;
+- mode->vsync_end = mode->vsync_end - 1;
++ mode->hsync_start = mode->hsync_start - 1;
++ mode->hsync_end = mode->hsync_end - 1;
+ return mode;
+ }
+
--- /dev/null
+From 2d0bb1c1f4524befe9f0fcf0d0cd3081a451223f Mon Sep 17 00:00:00 2001
+From: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Date: Sun, 8 Aug 2010 16:02:31 +0000
+Subject: e100/e1000*/igb*/ixgb*: Add missing read memory barrier
+
+From: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+
+commit 2d0bb1c1f4524befe9f0fcf0d0cd3081a451223f upstream.
+
+Based on patches from Sonny Rao and Milton Miller...
+
+Combined the patches to fix up clean_tx_irq and clean_rx_irq.
+
+The PowerPC architecture does not require loads to independent bytes
+to be ordered without adding an explicit barrier.
+
+In ixgbe_clean_rx_irq we load the status bit then load the packet data.
+With packet split disabled if these loads go out of order we get a
+stale packet, but we will notice the bad sequence numbers and drop it.
+
+The problem occurs with packet split enabled where the TCP/IP header
+and data are in different descriptors. If the reads go out of order
+we may have data that doesn't match the TCP/IP header. Since we use
+hardware checksumming this bad data is never verified and it makes it
+all the way to the application.
+
+This bug was found during stress testing and adding this barrier has
+been shown to fix it. The bug can manifest as a data integrity issue
+(bad payload data) or as a BUG in skb_pull().
+
+This was a nasty bug to hunt down, if people agree with the fix I think
+it's a candidate for stable.
+
+Previously Submitted to e1000-devel only for ixgbe
+
+http://marc.info/?l=e1000-devel&m=126593062701537&w=3
+
+We've now seen this problem hit with other device drivers (e1000e mostly)
+So I'm resubmitting with fixes for other Intel Device Drivers with
+similar issues.
+
+CC: Milton Miller <miltonm@bga.com>
+CC: Anton Blanchard <anton@samba.org>
+CC: Sonny Rao <sonnyrao@us.ibm.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/e100.c | 2 ++
+ drivers/net/e1000/e1000_main.c | 3 +++
+ drivers/net/e1000e/netdev.c | 4 ++++
+ drivers/net/igb/igb_main.c | 2 ++
+ drivers/net/igbvf/netdev.c | 2 ++
+ drivers/net/ixgb/ixgb_main.c | 2 ++
+ drivers/net/ixgbe/ixgbe_main.c | 1 +
+ drivers/net/ixgbevf/ixgbevf_main.c | 2 ++
+ 8 files changed, 18 insertions(+)
+
+--- a/drivers/net/e100.c
++++ b/drivers/net/e100.c
+@@ -1779,6 +1779,7 @@ static int e100_tx_clean(struct nic *nic
+ for (cb = nic->cb_to_clean;
+ cb->status & cpu_to_le16(cb_complete);
+ cb = nic->cb_to_clean = cb->next) {
++ rmb(); /* read skb after status */
+ netif_printk(nic, tx_done, KERN_DEBUG, nic->netdev,
+ "cb[%d]->status = 0x%04X\n",
+ (int)(((void*)cb - (void*)nic->cbs)/sizeof(struct cb)),
+@@ -1927,6 +1928,7 @@ static int e100_rx_indicate(struct nic *
+
+ netif_printk(nic, rx_status, KERN_DEBUG, nic->netdev,
+ "status=0x%04X\n", rfd_status);
++ rmb(); /* read size after status bit */
+
+ /* If data isn't ready, nothing to indicate */
+ if (unlikely(!(rfd_status & cb_complete))) {
+--- a/drivers/net/e1000/e1000_main.c
++++ b/drivers/net/e1000/e1000_main.c
+@@ -3448,6 +3448,7 @@ static bool e1000_clean_tx_irq(struct e1
+ while ((eop_desc->upper.data & cpu_to_le32(E1000_TXD_STAT_DD)) &&
+ (count < tx_ring->count)) {
+ bool cleaned = false;
++ rmb(); /* read buffer_info after eop_desc */
+ for ( ; !cleaned; count++) {
+ tx_desc = E1000_TX_DESC(*tx_ring, i);
+ buffer_info = &tx_ring->buffer_info[i];
+@@ -3637,6 +3638,7 @@ static bool e1000_clean_jumbo_rx_irq(str
+ if (*work_done >= work_to_do)
+ break;
+ (*work_done)++;
++ rmb(); /* read descriptor and rx_buffer_info after status DD */
+
+ status = rx_desc->status;
+ skb = buffer_info->skb;
+@@ -3843,6 +3845,7 @@ static bool e1000_clean_rx_irq(struct e1
+ if (*work_done >= work_to_do)
+ break;
+ (*work_done)++;
++ rmb(); /* read descriptor and rx_buffer_info after status DD */
+
+ status = rx_desc->status;
+ skb = buffer_info->skb;
+--- a/drivers/net/e1000e/netdev.c
++++ b/drivers/net/e1000e/netdev.c
+@@ -774,6 +774,7 @@ static bool e1000_clean_rx_irq(struct e1
+ if (*work_done >= work_to_do)
+ break;
+ (*work_done)++;
++ rmb(); /* read descriptor and rx_buffer_info after status DD */
+
+ status = rx_desc->status;
+ skb = buffer_info->skb;
+@@ -984,6 +985,7 @@ static bool e1000_clean_tx_irq(struct e1
+ while ((eop_desc->upper.data & cpu_to_le32(E1000_TXD_STAT_DD)) &&
+ (count < tx_ring->count)) {
+ bool cleaned = false;
++ rmb(); /* read buffer_info after eop_desc */
+ for (; !cleaned; count++) {
+ tx_desc = E1000_TX_DESC(*tx_ring, i);
+ buffer_info = &tx_ring->buffer_info[i];
+@@ -1080,6 +1082,7 @@ static bool e1000_clean_rx_irq_ps(struct
+ break;
+ (*work_done)++;
+ skb = buffer_info->skb;
++ rmb(); /* read descriptor and rx_buffer_info after status DD */
+
+ /* in the packet split case this is header only */
+ prefetch(skb->data - NET_IP_ALIGN);
+@@ -1279,6 +1282,7 @@ static bool e1000_clean_jumbo_rx_irq(str
+ if (*work_done >= work_to_do)
+ break;
+ (*work_done)++;
++ rmb(); /* read descriptor and rx_buffer_info after status DD */
+
+ status = rx_desc->status;
+ skb = buffer_info->skb;
+--- a/drivers/net/igb/igb_main.c
++++ b/drivers/net/igb/igb_main.c
+@@ -5344,6 +5344,7 @@ static bool igb_clean_tx_irq(struct igb_
+
+ while ((eop_desc->wb.status & cpu_to_le32(E1000_TXD_STAT_DD)) &&
+ (count < tx_ring->count)) {
++ rmb(); /* read buffer_info after eop_desc status */
+ for (cleaned = false; !cleaned; count++) {
+ tx_desc = E1000_TX_DESC_ADV(*tx_ring, i);
+ buffer_info = &tx_ring->buffer_info[i];
+@@ -5549,6 +5550,7 @@ static bool igb_clean_rx_irq_adv(struct
+ if (*work_done >= budget)
+ break;
+ (*work_done)++;
++ rmb(); /* read descriptor and rx_buffer_info after status DD */
+
+ skb = buffer_info->skb;
+ prefetch(skb->data - NET_IP_ALIGN);
+--- a/drivers/net/igbvf/netdev.c
++++ b/drivers/net/igbvf/netdev.c
+@@ -248,6 +248,7 @@ static bool igbvf_clean_rx_irq(struct ig
+ if (*work_done >= work_to_do)
+ break;
+ (*work_done)++;
++ rmb(); /* read descriptor and rx_buffer_info after status DD */
+
+ buffer_info = &rx_ring->buffer_info[i];
+
+@@ -780,6 +781,7 @@ static bool igbvf_clean_tx_irq(struct ig
+
+ while ((eop_desc->wb.status & cpu_to_le32(E1000_TXD_STAT_DD)) &&
+ (count < tx_ring->count)) {
++ rmb(); /* read buffer_info after eop_desc status */
+ for (cleaned = false; !cleaned; count++) {
+ tx_desc = IGBVF_TX_DESC_ADV(*tx_ring, i);
+ buffer_info = &tx_ring->buffer_info[i];
+--- a/drivers/net/ixgb/ixgb_main.c
++++ b/drivers/net/ixgb/ixgb_main.c
+@@ -1816,6 +1816,7 @@ ixgb_clean_tx_irq(struct ixgb_adapter *a
+
+ while (eop_desc->status & IXGB_TX_DESC_STATUS_DD) {
+
++ rmb(); /* read buffer_info after eop_desc */
+ for (cleaned = false; !cleaned; ) {
+ tx_desc = IXGB_TX_DESC(*tx_ring, i);
+ buffer_info = &tx_ring->buffer_info[i];
+@@ -1976,6 +1977,7 @@ ixgb_clean_rx_irq(struct ixgb_adapter *a
+ break;
+
+ (*work_done)++;
++ rmb(); /* read descriptor and rx_buffer_info after status DD */
+ status = rx_desc->status;
+ skb = buffer_info->skb;
+ buffer_info->skb = NULL;
+--- a/drivers/net/ixgbe/ixgbe_main.c
++++ b/drivers/net/ixgbe/ixgbe_main.c
+@@ -748,6 +748,7 @@ static bool ixgbe_clean_tx_irq(struct ix
+ while ((eop_desc->wb.status & cpu_to_le32(IXGBE_TXD_STAT_DD)) &&
+ (count < tx_ring->work_limit)) {
+ bool cleaned = false;
++ rmb(); /* read buffer_info after eop_desc */
+ for ( ; !cleaned; count++) {
+ struct sk_buff *skb;
+ tx_desc = IXGBE_TX_DESC_ADV(*tx_ring, i);
+--- a/drivers/net/ixgbevf/ixgbevf_main.c
++++ b/drivers/net/ixgbevf/ixgbevf_main.c
+@@ -231,6 +231,7 @@ static bool ixgbevf_clean_tx_irq(struct
+ while ((eop_desc->wb.status & cpu_to_le32(IXGBE_TXD_STAT_DD)) &&
+ (count < tx_ring->work_limit)) {
+ bool cleaned = false;
++ rmb(); /* read buffer_info after eop_desc */
+ for ( ; !cleaned; count++) {
+ struct sk_buff *skb;
+ tx_desc = IXGBE_TX_DESC_ADV(*tx_ring, i);
+@@ -518,6 +519,7 @@ static bool ixgbevf_clean_rx_irq(struct
+ break;
+ (*work_done)++;
+
++ rmb(); /* read descriptor and rx_buffer_info after status DD */
+ if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
+ hdr_info = le16_to_cpu(ixgbevf_get_hdr_info(rx_desc));
+ len = (hdr_info & IXGBE_RXDADV_HDRBUFLEN_MASK) >>
--- /dev/null
+From c43f7b8fb03be8bcc579bfc4e6ab70eac887ab55 Mon Sep 17 00:00:00 2001
+From: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Date: Tue, 3 Nov 2009 11:45:11 -0600
+Subject: eCryptfs: Handle ioctl calls with unlocked and compat functions
+
+From: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+
+commit c43f7b8fb03be8bcc579bfc4e6ab70eac887ab55 upstream.
+
+Lower filesystems that only implemented unlocked_ioctl weren't being
+passed ioctl calls because eCryptfs only checked for
+lower_file->f_op->ioctl and returned -ENOTTY if it was NULL.
+
+eCryptfs shouldn't implement ioctl(), since it doesn't require the BKL.
+This patch introduces ecryptfs_unlocked_ioctl() and
+ecryptfs_compat_ioctl(), which passes the calls on to the lower file
+system.
+
+https://bugs.launchpad.net/ecryptfs/+bug/469664
+
+Reported-by: James Dupin <james.dupin@gmail.com>
+Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ecryptfs/file.c | 56 +++++++++++++++++++++++++++++++++--------------------
+ 1 file changed, 35 insertions(+), 21 deletions(-)
+
+--- a/fs/ecryptfs/file.c
++++ b/fs/ecryptfs/file.c
+@@ -292,12 +292,40 @@ static int ecryptfs_fasync(int fd, struc
+ return rc;
+ }
+
+-static int ecryptfs_ioctl(struct inode *inode, struct file *file,
+- unsigned int cmd, unsigned long arg);
++static long
++ecryptfs_unlocked_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
++{
++ struct file *lower_file = NULL;
++ long rc = -ENOTTY;
++
++ if (ecryptfs_file_to_private(file))
++ lower_file = ecryptfs_file_to_lower(file);
++ if (lower_file && lower_file->f_op && lower_file->f_op->unlocked_ioctl)
++ rc = lower_file->f_op->unlocked_ioctl(lower_file, cmd, arg);
++ return rc;
++}
++
++#ifdef CONFIG_COMPAT
++static long
++ecryptfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
++{
++ struct file *lower_file = NULL;
++ long rc = -ENOIOCTLCMD;
++
++ if (ecryptfs_file_to_private(file))
++ lower_file = ecryptfs_file_to_lower(file);
++ if (lower_file && lower_file->f_op && lower_file->f_op->compat_ioctl)
++ rc = lower_file->f_op->compat_ioctl(lower_file, cmd, arg);
++ return rc;
++}
++#endif
+
+ const struct file_operations ecryptfs_dir_fops = {
+ .readdir = ecryptfs_readdir,
+- .ioctl = ecryptfs_ioctl,
++ .unlocked_ioctl = ecryptfs_unlocked_ioctl,
++#ifdef CONFIG_COMPAT
++ .compat_ioctl = ecryptfs_compat_ioctl,
++#endif
+ .open = ecryptfs_open,
+ .flush = ecryptfs_flush,
+ .release = ecryptfs_release,
+@@ -313,7 +341,10 @@ const struct file_operations ecryptfs_ma
+ .write = do_sync_write,
+ .aio_write = generic_file_aio_write,
+ .readdir = ecryptfs_readdir,
+- .ioctl = ecryptfs_ioctl,
++ .unlocked_ioctl = ecryptfs_unlocked_ioctl,
++#ifdef CONFIG_COMPAT
++ .compat_ioctl = ecryptfs_compat_ioctl,
++#endif
+ .mmap = generic_file_mmap,
+ .open = ecryptfs_open,
+ .flush = ecryptfs_flush,
+@@ -322,20 +353,3 @@ const struct file_operations ecryptfs_ma
+ .fasync = ecryptfs_fasync,
+ .splice_read = generic_file_splice_read,
+ };
+-
+-static int
+-ecryptfs_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
+- unsigned long arg)
+-{
+- int rc = 0;
+- struct file *lower_file = NULL;
+-
+- if (ecryptfs_file_to_private(file))
+- lower_file = ecryptfs_file_to_lower(file);
+- if (lower_file && lower_file->f_op && lower_file->f_op->ioctl)
+- rc = lower_file->f_op->ioctl(ecryptfs_inode_to_lower(inode),
+- lower_file, cmd, arg);
+- else
+- rc = -ENOTTY;
+- return rc;
+-}
--- /dev/null
+From 31f73bee3e170b7cabb35db9e2f4bf7919b9d036 Mon Sep 17 00:00:00 2001
+From: Lino Sanfilippo <LinoSanfilippo@gmx.de>
+Date: Thu, 29 Jul 2010 13:01:36 +0200
+Subject: ecryptfs: release reference to lower mount if interpose fails
+
+From: Lino Sanfilippo <LinoSanfilippo@gmx.de>
+
+commit 31f73bee3e170b7cabb35db9e2f4bf7919b9d036 upstream.
+
+In ecryptfs_lookup_and_interpose_lower() the lower mount is not decremented
+if allocation of a dentry info struct failed. As a result the lower filesystem
+cant be unmounted any more (since it is considered busy). This patch corrects
+the reference counting.
+
+Signed-off-by: Lino Sanfilippo <LinoSanfilippo@gmx.de>
+Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ecryptfs/inode.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/fs/ecryptfs/inode.c
++++ b/fs/ecryptfs/inode.c
+@@ -264,7 +264,7 @@ int ecryptfs_lookup_and_interpose_lower(
+ printk(KERN_ERR "%s: Out of memory whilst attempting "
+ "to allocate ecryptfs_dentry_info struct\n",
+ __func__);
+- goto out_dput;
++ goto out_put;
+ }
+ ecryptfs_set_dentry_lower(ecryptfs_dentry, lower_dentry);
+ ecryptfs_set_dentry_lower_mnt(ecryptfs_dentry, lower_mnt);
+@@ -339,8 +339,9 @@ int ecryptfs_lookup_and_interpose_lower(
+ out_free_kmem:
+ kmem_cache_free(ecryptfs_header_cache_2, page_virt);
+ goto out;
+-out_dput:
++out_put:
+ dput(lower_dentry);
++ mntput(lower_mnt);
+ d_drop(ecryptfs_dentry);
+ out:
+ return rc;
--- /dev/null
+From 437f88cc031ffe7f37f3e705367f4fe1f4be8b0f Mon Sep 17 00:00:00 2001
+From: Eric Sandeen <sandeen@sandeen.net>
+Date: Sun, 1 Aug 2010 17:33:29 -0400
+Subject: ext4: fix freeze deadlock under IO
+
+From: Eric Sandeen <sandeen@sandeen.net>
+
+commit 437f88cc031ffe7f37f3e705367f4fe1f4be8b0f upstream.
+
+Commit 6b0310fbf087ad6 caused a regression resulting in deadlocks
+when freezing a filesystem which had active IO; the vfs_check_frozen
+level (SB_FREEZE_WRITE) did not let the freeze-related IO syncing
+through. Duh.
+
+Changing the test to FREEZE_TRANS should let the normal freeze
+syncing get through the fs, but still block any transactions from
+starting once the fs is completely frozen.
+
+I tested this by running fsstress in the background while periodically
+snapshotting the fs and running fsck on the result. I ran into
+occasional deadlocks, but different ones. I think this is a
+fine fix for the problem at hand, and the other deadlocky things
+will need more investigation.
+
+Reported-by: Phillip Susi <psusi@cfl.rr.com>
+Signed-off-by: Eric Sandeen <sandeen@redhat.com>
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ext4/super.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -241,7 +241,7 @@ handle_t *ext4_journal_start_sb(struct s
+ if (sb->s_flags & MS_RDONLY)
+ return ERR_PTR(-EROFS);
+
+- vfs_check_frozen(sb, SB_FREEZE_WRITE);
++ vfs_check_frozen(sb, SB_FREEZE_TRANS);
+ /* Special case here: if the journal has aborted behind our
+ * backs (eg. EIO in the commit thread), then we still need to
+ * take the FS itself readonly cleanly. */
+@@ -3491,7 +3491,7 @@ int ext4_force_commit(struct super_block
+
+ journal = EXT4_SB(sb)->s_journal;
+ if (journal) {
+- vfs_check_frozen(sb, SB_FREEZE_WRITE);
++ vfs_check_frozen(sb, SB_FREEZE_TRANS);
+ ret = ext4_journal_force_commit(journal);
+ }
+
--- /dev/null
+From 7a4dec53897ecd3367efb1e12fe8a4edc47dc0e9 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Mon, 9 Aug 2010 12:05:43 -0400
+Subject: Fix sget() race with failing mount
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit 7a4dec53897ecd3367efb1e12fe8a4edc47dc0e9 upstream.
+
+If sget() finds a matching superblock being set up, it'll
+grab an active reference to it and grab s_umount. That's
+fine - we'll wait for completion of foofs_get_sb() that way.
+However, if said foofs_get_sb() fails we'll end up holding
+the halfway-created superblock. deactivate_locked_super()
+called by foofs_get_sb() will just unlock the sucker since
+we are holding another active reference to it.
+
+What we need is a way to tell if superblock has been successfully
+set up. Unfortunately, neither ->s_root nor the check for
+MS_ACTIVE quite fit. Cheap and easy way, suitable for backport:
+new flag set by the (only) caller of ->get_sb(). If that flag
+isn't present by the time sget() grabbed s_umount on preexisting
+superblock it has found, it's seeing a stillborn and should
+just bury it with deactivate_locked_super() (and repeat the search).
+
+Longer term we want to set that flag in ->get_sb() instances (and
+check for it to distinguish between "sget() found us a live sb"
+and "sget() has allocated an sb, we need to set it up" in there,
+instead of checking ->s_root as we do now).
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/namespace.c | 2 +-
+ fs/super.c | 6 ++++++
+ include/linux/fs.h | 1 +
+ 3 files changed, 8 insertions(+), 1 deletion(-)
+
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1984,7 +1984,7 @@ long do_mount(char *dev_name, char *dir_
+ if (flags & MS_RDONLY)
+ mnt_flags |= MNT_READONLY;
+
+- flags &= ~(MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_ACTIVE |
++ flags &= ~(MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_ACTIVE | MS_BORN |
+ MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
+ MS_STRICTATIME);
+
+--- a/fs/super.c
++++ b/fs/super.c
+@@ -305,8 +305,13 @@ retry:
+ if (s) {
+ up_write(&s->s_umount);
+ destroy_super(s);
++ s = NULL;
+ }
+ down_write(&old->s_umount);
++ if (unlikely(!(old->s_flags & MS_BORN))) {
++ deactivate_locked_super(old);
++ goto retry;
++ }
+ return old;
+ }
+ }
+@@ -909,6 +914,7 @@ vfs_kern_mount(struct file_system_type *
+ goto out_free_secdata;
+ BUG_ON(!mnt->mnt_sb);
+ WARN_ON(!mnt->mnt_sb->s_bdi);
++ mnt->mnt_sb->s_flags |= MS_BORN;
+
+ error = security_sb_kern_mount(mnt->mnt_sb, flags, secdata);
+ if (error)
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -209,6 +209,7 @@ struct inodes_stat_t {
+ #define MS_KERNMOUNT (1<<22) /* this is a kern_mount call */
+ #define MS_I_VERSION (1<<23) /* Update inode I_version field */
+ #define MS_STRICTATIME (1<<24) /* Always perform atime updates */
++#define MS_BORN (1<<29)
+ #define MS_ACTIVE (1<<30)
+ #define MS_NOUSER (1<<31)
+
--- /dev/null
+From ceeab92971e8af05c1e81a4ff2c271124b55bb9b Mon Sep 17 00:00:00 2001
+From: Julia Lawall <julia@diku.dk>
+Date: Fri, 6 Aug 2010 22:58:49 +0200
+Subject: fs/ecryptfs/file.c: introduce missing free
+
+From: Julia Lawall <julia@diku.dk>
+
+commit ceeab92971e8af05c1e81a4ff2c271124b55bb9b upstream.
+
+The comments in the code indicate that file_info should be released if the
+function fails. This releasing is done at the label out_free, not out.
+
+The semantic match that finds this problem is as follows:
+(http://www.emn.fr/x-info/coccinelle/)
+
+// <smpl>
+@r exists@
+local idexpression x;
+statement S;
+expression E;
+identifier f,f1,l;
+position p1,p2;
+expression *ptr != NULL;
+@@
+
+x@p1 = kmem_cache_zalloc(...);
+...
+if (x == NULL) S
+<... when != x
+ when != if (...) { <+...x...+> }
+(
+x->f1 = E
+|
+ (x->f1 == NULL || ...)
+|
+ f(...,x->f1,...)
+)
+...>
+(
+ return <+...x...+>;
+|
+ return@p2 ...;
+)
+
+@script:python@
+p1 << r.p1;
+p2 << r.p2;
+@@
+
+print "* file: %s kmem_cache_zalloc %s" % (p1[0].file,p1[0].line)
+// </smpl>
+
+Signed-off-by: Julia Lawall <julia@diku.dk>
+Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ecryptfs/file.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/ecryptfs/file.c
++++ b/fs/ecryptfs/file.c
+@@ -199,7 +199,7 @@ static int ecryptfs_open(struct inode *i
+ "the persistent file for the dentry with name "
+ "[%s]; rc = [%d]\n", __func__,
+ ecryptfs_dentry->d_name.name, rc);
+- goto out;
++ goto out_free;
+ }
+ }
+ if ((ecryptfs_inode_to_private(inode)->lower_file->f_flags & O_RDONLY)
+@@ -207,7 +207,7 @@ static int ecryptfs_open(struct inode *i
+ rc = -EPERM;
+ printk(KERN_WARNING "%s: Lower persistent file is RO; eCryptfs "
+ "file must hence be opened RO\n", __func__);
+- goto out;
++ goto out_free;
+ }
+ ecryptfs_set_file_lower(
+ file, ecryptfs_inode_to_private(inode)->lower_file);
--- /dev/null
+From 556ab45f9a775bfa4762bacc0a4afb5b44b067bc Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Fri, 23 Jul 2010 15:47:56 -0700
+Subject: ioat2: catch and recover from broken vtd configurations v6
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit 556ab45f9a775bfa4762bacc0a4afb5b44b067bc upstream.
+
+On some platforms (MacPro3,1) the BIOS assigns the ioatdma device to the
+incorrect iommu causing faults when the driver initializes. Add a quirk
+to catch this misconfiguration and try falling back to untranslated
+operation (which works in the MacPro3,1 case).
+
+Assuming there are other platforms with misconfigured iommus teach the
+ioatdma driver to treat initialization failures as non-fatal (just fail
+the driver load and emit a warning instead of triggering a BUG_ON).
+
+This can be classified as a boot regression since 2.6.32 on affected
+platforms since the ioatdma module did not autoload prior to that
+kernel.
+
+Acked-by: David Woodhouse <David.Woodhouse@intel.com>
+Reported-by: Chris Li <lkml@chrisli.org>
+Tested-by: Chris Li <lkml@chrisli.org>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/dma/ioat/dma.h | 1 +
+ drivers/dma/ioat/dma_v2.c | 24 ++++++++++++++++++++++--
+ drivers/dma/ioat/dma_v3.c | 5 ++++-
+ drivers/pci/intel-iommu.c | 28 ++++++++++++++++++++++++++++
+ 4 files changed, 55 insertions(+), 3 deletions(-)
+
+--- a/drivers/dma/ioat/dma.h
++++ b/drivers/dma/ioat/dma.h
+@@ -97,6 +97,7 @@ struct ioat_chan_common {
+ #define IOAT_RESET_PENDING 2
+ #define IOAT_KOBJ_INIT_FAIL 3
+ #define IOAT_RESHAPE_PENDING 4
++ #define IOAT_RUN 5
+ struct timer_list timer;
+ #define COMPLETION_TIMEOUT msecs_to_jiffies(100)
+ #define IDLE_TIMEOUT msecs_to_jiffies(2000)
+--- a/drivers/dma/ioat/dma_v2.c
++++ b/drivers/dma/ioat/dma_v2.c
+@@ -287,7 +287,10 @@ void ioat2_timer_event(unsigned long dat
+ chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET);
+ dev_err(to_dev(chan), "%s: Channel halted (%x)\n",
+ __func__, chanerr);
+- BUG_ON(is_ioat_bug(chanerr));
++ if (test_bit(IOAT_RUN, &chan->state))
++ BUG_ON(is_ioat_bug(chanerr));
++ else /* we never got off the ground */
++ return;
+ }
+
+ /* if we haven't made progress and we have already
+@@ -492,6 +495,8 @@ static struct ioat_ring_ent **ioat2_allo
+ return ring;
+ }
+
++void ioat2_free_chan_resources(struct dma_chan *c);
++
+ /* ioat2_alloc_chan_resources - allocate/initialize ioat2 descriptor ring
+ * @chan: channel to be initialized
+ */
+@@ -500,6 +505,7 @@ int ioat2_alloc_chan_resources(struct dm
+ struct ioat2_dma_chan *ioat = to_ioat2_chan(c);
+ struct ioat_chan_common *chan = &ioat->base;
+ struct ioat_ring_ent **ring;
++ u64 status;
+ int order;
+
+ /* have we already been set up? */
+@@ -540,7 +546,20 @@ int ioat2_alloc_chan_resources(struct dm
+ tasklet_enable(&chan->cleanup_task);
+ ioat2_start_null_desc(ioat);
+
+- return 1 << ioat->alloc_order;
++ /* check that we got off the ground */
++ udelay(5);
++ status = ioat_chansts(chan);
++ if (is_ioat_active(status) || is_ioat_idle(status)) {
++ set_bit(IOAT_RUN, &chan->state);
++ return 1 << ioat->alloc_order;
++ } else {
++ u32 chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET);
++
++ dev_WARN(to_dev(chan),
++ "failed to start channel chanerr: %#x\n", chanerr);
++ ioat2_free_chan_resources(c);
++ return -EFAULT;
++ }
+ }
+
+ bool reshape_ring(struct ioat2_dma_chan *ioat, int order)
+@@ -778,6 +797,7 @@ void ioat2_free_chan_resources(struct dm
+ del_timer_sync(&chan->timer);
+ device->cleanup_fn((unsigned long) c);
+ device->reset_hw(chan);
++ clear_bit(IOAT_RUN, &chan->state);
+
+ spin_lock_bh(&chan->cleanup_lock);
+ spin_lock_bh(&ioat->prep_lock);
+--- a/drivers/dma/ioat/dma_v3.c
++++ b/drivers/dma/ioat/dma_v3.c
+@@ -361,7 +361,10 @@ static void ioat3_timer_event(unsigned l
+ chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET);
+ dev_err(to_dev(chan), "%s: Channel halted (%x)\n",
+ __func__, chanerr);
+- BUG_ON(is_ioat_bug(chanerr));
++ if (test_bit(IOAT_RUN, &chan->state))
++ BUG_ON(is_ioat_bug(chanerr));
++ else /* we never got off the ground */
++ return;
+ }
+
+ /* if we haven't made progress and we have already
+--- a/drivers/pci/intel-iommu.c
++++ b/drivers/pci/intel-iommu.c
+@@ -3030,6 +3030,34 @@ static void __init iommu_exit_mempool(vo
+
+ }
+
++static void quirk_ioat_snb_local_iommu(struct pci_dev *pdev)
++{
++ struct dmar_drhd_unit *drhd;
++ u32 vtbar;
++ int rc;
++
++ /* We know that this device on this chipset has its own IOMMU.
++ * If we find it under a different IOMMU, then the BIOS is lying
++ * to us. Hope that the IOMMU for this device is actually
++ * disabled, and it needs no translation...
++ */
++ rc = pci_bus_read_config_dword(pdev->bus, PCI_DEVFN(0, 0), 0xb0, &vtbar);
++ if (rc) {
++ /* "can't" happen */
++ dev_info(&pdev->dev, "failed to run vt-d quirk\n");
++ return;
++ }
++ vtbar &= 0xffff0000;
++
++ /* we know that the this iommu should be at offset 0xa000 from vtbar */
++ drhd = dmar_find_matched_drhd_unit(pdev);
++ if (WARN_TAINT_ONCE(!drhd || drhd->reg_base_addr - vtbar != 0xa000,
++ TAINT_FIRMWARE_WORKAROUND,
++ "BIOS assigned incorrect VT-d unit for Intel(R) QuickData Technology device\n"))
++ pdev->dev.archdata.iommu = DUMMY_DEVICE_DOMAIN_INFO;
++}
++DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_IOAT_SNB, quirk_ioat_snb_local_iommu);
++
+ static void __init init_no_remapping_devices(void)
+ {
+ struct dmar_drhd_unit *drhd;
--- /dev/null
+From 685fd0b4ea3f0f1d5385610b0d5b57775a8d5842 Mon Sep 17 00:00:00 2001
+From: Ian Campbell <ian.campbell@citrix.com>
+Date: Thu, 29 Jul 2010 11:16:32 +0100
+Subject: irq: Add new IRQ flag IRQF_NO_SUSPEND
+
+From: Ian Campbell <ian.campbell@citrix.com>
+
+commit 685fd0b4ea3f0f1d5385610b0d5b57775a8d5842 upstream.
+
+A small number of users of IRQF_TIMER are using it for the implied no
+suspend behaviour on interrupts which are not timer interrupts.
+
+Therefore add a new IRQF_NO_SUSPEND flag, rename IRQF_TIMER to
+__IRQF_TIMER and redefine IRQF_TIMER in terms of these new flags.
+
+Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
+Cc: Jeremy Fitzhardinge <jeremy@goop.org>
+Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Grant Likely <grant.likely@secretlab.ca>
+Cc: xen-devel@lists.xensource.com
+Cc: linux-input@vger.kernel.org
+Cc: linuxppc-dev@ozlabs.org
+Cc: devicetree-discuss@lists.ozlabs.org
+LKML-Reference: <1280398595-29708-1-git-send-email-ian.campbell@citrix.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/interrupt.h | 7 ++++++-
+ kernel/irq/manage.c | 2 +-
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+--- a/include/linux/interrupt.h
++++ b/include/linux/interrupt.h
+@@ -53,16 +53,21 @@
+ * IRQF_ONESHOT - Interrupt is not reenabled after the hardirq handler finished.
+ * Used by threaded interrupts which need to keep the
+ * irq line disabled until the threaded handler has been run.
++ * IRQF_NO_SUSPEND - Do not disable this IRQ during suspend
++ *
+ */
+ #define IRQF_DISABLED 0x00000020
+ #define IRQF_SAMPLE_RANDOM 0x00000040
+ #define IRQF_SHARED 0x00000080
+ #define IRQF_PROBE_SHARED 0x00000100
+-#define IRQF_TIMER 0x00000200
++#define __IRQF_TIMER 0x00000200
+ #define IRQF_PERCPU 0x00000400
+ #define IRQF_NOBALANCING 0x00000800
+ #define IRQF_IRQPOLL 0x00001000
+ #define IRQF_ONESHOT 0x00002000
++#define IRQF_NO_SUSPEND 0x00004000
++
++#define IRQF_TIMER (__IRQF_TIMER | IRQF_NO_SUSPEND)
+
+ /*
+ * Bits used by threaded handlers:
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -216,7 +216,7 @@ static inline int setup_affinity(unsigne
+ void __disable_irq(struct irq_desc *desc, unsigned int irq, bool suspend)
+ {
+ if (suspend) {
+- if (!desc->action || (desc->action->flags & IRQF_TIMER))
++ if (!desc->action || (desc->action->flags & IRQF_NO_SUSPEND))
+ return;
+ desc->status |= IRQ_SUSPENDED;
+ }
--- /dev/null
+From aca0fa34bdaba39bfddddba8ca70dba4782e8fe6 Mon Sep 17 00:00:00 2001
+From: Dave Kleikamp <shaggy@linux.vnet.ibm.com>
+Date: Mon, 9 Aug 2010 15:57:38 -0500
+Subject: jfs: don't allow os2 xattr namespace overlap with others
+
+From: Dave Kleikamp <shaggy@linux.vnet.ibm.com>
+
+commit aca0fa34bdaba39bfddddba8ca70dba4782e8fe6 upstream.
+
+It's currently possible to bypass xattr namespace access rules by
+prefixing valid xattr names with "os2.", since the os2 namespace stores
+extended attributes in a legacy format with no prefix.
+
+This patch adds checking to deny access to any valid namespace prefix
+following "os2.".
+
+Signed-off-by: Dave Kleikamp <shaggy@linux.vnet.ibm.com>
+Reported-by: Sergey Vlasov <vsu@altlinux.ru>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/jfs/xattr.c | 87 ++++++++++++++++++++++++---------------------------------
+ 1 file changed, 38 insertions(+), 49 deletions(-)
+
+--- a/fs/jfs/xattr.c
++++ b/fs/jfs/xattr.c
+@@ -86,46 +86,25 @@ struct ea_buffer {
+ #define EA_MALLOC 0x0008
+
+
++static int is_known_namespace(const char *name)
++{
++ if (strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN) &&
++ strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN) &&
++ strncmp(name, XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN) &&
++ strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN))
++ return false;
++
++ return true;
++}
++
+ /*
+ * These three routines are used to recognize on-disk extended attributes
+ * that are in a recognized namespace. If the attribute is not recognized,
+ * "os2." is prepended to the name
+ */
+-static inline int is_os2_xattr(struct jfs_ea *ea)
++static int is_os2_xattr(struct jfs_ea *ea)
+ {
+- /*
+- * Check for "system."
+- */
+- if ((ea->namelen >= XATTR_SYSTEM_PREFIX_LEN) &&
+- !strncmp(ea->name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
+- return false;
+- /*
+- * Check for "user."
+- */
+- if ((ea->namelen >= XATTR_USER_PREFIX_LEN) &&
+- !strncmp(ea->name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))
+- return false;
+- /*
+- * Check for "security."
+- */
+- if ((ea->namelen >= XATTR_SECURITY_PREFIX_LEN) &&
+- !strncmp(ea->name, XATTR_SECURITY_PREFIX,
+- XATTR_SECURITY_PREFIX_LEN))
+- return false;
+- /*
+- * Check for "trusted."
+- */
+- if ((ea->namelen >= XATTR_TRUSTED_PREFIX_LEN) &&
+- !strncmp(ea->name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN))
+- return false;
+- /*
+- * Add any other valid namespace prefixes here
+- */
+-
+- /*
+- * We assume it's OS/2's flat namespace
+- */
+- return true;
++ return !is_known_namespace(ea->name);
+ }
+
+ static inline int name_size(struct jfs_ea *ea)
+@@ -764,13 +743,23 @@ static int can_set_xattr(struct inode *i
+ if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
+ return can_set_system_xattr(inode, name, value, value_len);
+
++ if (!strncmp(name, XATTR_OS2_PREFIX, XATTR_OS2_PREFIX_LEN)) {
++ /*
++ * This makes sure that we aren't trying to set an
++ * attribute in a different namespace by prefixing it
++ * with "os2."
++ */
++ if (is_known_namespace(name + XATTR_OS2_PREFIX_LEN))
++ return -EOPNOTSUPP;
++ return 0;
++ }
++
+ /*
+ * Don't allow setting an attribute in an unknown namespace.
+ */
+ if (strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) &&
+ strncmp(name, XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN) &&
+- strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN) &&
+- strncmp(name, XATTR_OS2_PREFIX, XATTR_OS2_PREFIX_LEN))
++ strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))
+ return -EOPNOTSUPP;
+
+ return 0;
+@@ -952,19 +941,8 @@ ssize_t __jfs_getxattr(struct inode *ino
+ int xattr_size;
+ ssize_t size;
+ int namelen = strlen(name);
+- char *os2name = NULL;
+ char *value;
+
+- if (strncmp(name, XATTR_OS2_PREFIX, XATTR_OS2_PREFIX_LEN) == 0) {
+- os2name = kmalloc(namelen - XATTR_OS2_PREFIX_LEN + 1,
+- GFP_KERNEL);
+- if (!os2name)
+- return -ENOMEM;
+- strcpy(os2name, name + XATTR_OS2_PREFIX_LEN);
+- name = os2name;
+- namelen -= XATTR_OS2_PREFIX_LEN;
+- }
+-
+ down_read(&JFS_IP(inode)->xattr_sem);
+
+ xattr_size = ea_get(inode, &ea_buf, 0);
+@@ -1002,8 +980,6 @@ ssize_t __jfs_getxattr(struct inode *ino
+ out:
+ up_read(&JFS_IP(inode)->xattr_sem);
+
+- kfree(os2name);
+-
+ return size;
+ }
+
+@@ -1012,6 +988,19 @@ ssize_t jfs_getxattr(struct dentry *dent
+ {
+ int err;
+
++ if (strncmp(name, XATTR_OS2_PREFIX, XATTR_OS2_PREFIX_LEN) == 0) {
++ /*
++ * skip past "os2." prefix
++ */
++ name += XATTR_OS2_PREFIX_LEN;
++ /*
++ * Don't allow retrieving properly prefixed attributes
++ * by prepending them with "os2."
++ */
++ if (is_known_namespace(name))
++ return -EOPNOTSUPP;
++ }
++
+ err = __jfs_getxattr(dentry->d_inode, name, data, buf_size);
+
+ return err;
--- /dev/null
+From 4565956dc0847985c0403c9ebbf274b6a122e1e2 Mon Sep 17 00:00:00 2001
+From: James Chapman <jchapman@katalix.com>
+Date: Tue, 3 Aug 2010 00:42:17 -0700
+Subject: l2tp: fix export of header file for userspace
+
+From: James Chapman <jchapman@katalix.com>
+
+commit 4565956dc0847985c0403c9ebbf274b6a122e1e2 upstream.
+
+The header file l2tp.h should be exported to the installed include/linux/
+tree for userspace programs.
+
+This patch fixes compilation errors in L2TP userspace apps which want to
+use the new L2TP support introduced in 2.6.35.
+
+Signed-off-by: James Chapman <jchapman@katalix.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/Kbuild | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/linux/Kbuild
++++ b/include/linux/Kbuild
+@@ -276,6 +276,7 @@ ifneq ($(wildcard $(srctree)/arch/$(SRCA
+ $(srctree)/include/asm-$(SRCARCH)/kvm_para.h),)
+ unifdef-y += kvm_para.h
+ endif
++unifdef-y += l2tp.h
+ unifdef-y += llc.h
+ unifdef-y += loop.h
+ unifdef-y += lp.h
--- /dev/null
+From 81cbb0b17796d81cbd92defe113cf2a7c7a21fbb Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marek.vasut@gmail.com>
+Date: Wed, 28 Jul 2010 07:36:54 +0200
+Subject: mtd: gen_nand: fix support for multiple chips
+
+From: Marek Vasut <marek.vasut@gmail.com>
+
+commit 81cbb0b17796d81cbd92defe113cf2a7c7a21fbb upstream.
+
+This patch corrects a problem where gen_nand driver assumed there can be only
+one chip and ignored the pdata->chip.nr_chips value.
+
+Signed-off-by: Marek Vasut <marek.vasut@gmail.com>
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mtd/nand/plat_nand.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/plat_nand.c
++++ b/drivers/mtd/nand/plat_nand.c
+@@ -91,7 +91,7 @@ static int __devinit plat_nand_probe(str
+ }
+
+ /* Scan to find existance of the device */
+- if (nand_scan(&data->mtd, 1)) {
++ if (nand_scan(&data->mtd, pdata->chip.nr_chips)) {
+ err = -ENXIO;
+ goto out;
+ }
--- /dev/null
+From 6a8cfcfb0de881735df4031eb5cc99be3d0971e9 Mon Sep 17 00:00:00 2001
+From: Eric Bénard <eric@eukrea.com>
+Date: Thu, 10 Jun 2010 16:03:04 +0200
+Subject: mtd: mxc_nand: fix unbalanced enable for IRQ
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Eric Bénard <eric@eukrea.com>
+
+commit 6a8cfcfb0de881735df4031eb5cc99be3d0971e9 upstream.
+
+* preset should be done before sending the reset command
+
+* without this, I get the following error on an i.MX35 :
+[ 0.900000] ------------[ cut here ]------------
+[ 0.900000] WARNING: at kernel/irq/manage.c:290 __enable_irq+0x4c/0x88()
+[ 0.900000] Unbalanced enable for IRQ 33
+[ 0.900000] Modules linked in:
+[ 0.900000] [<c002ffb8>] (unwind_backtrace+0x0/0xf0) from [<c02f7d0c>] (dump_stack+0x18/0x1c)
+[ 0.900000] [<c02f7d0c>] (dump_stack+0x18/0x1c) from [<c0049a44>] (warn_slowpath_common+0x54/0x6c)
+[ 0.900000] [<c0049a44>] (warn_slowpath_common+0x54/0x6c) from [<c0049b00>] (warn_slowpath_fmt+0x38/0x40)
+[ 0.900000] [<c0049b00>] (warn_slowpath_fmt+0x38/0x40) from [<c008f65c>] (__enable_irq+0x4c/0x88)
+[ 0.900000] [<c008f65c>] (__enable_irq+0x4c/0x88) from [<c008fca0>] (enable_irq+0x54/0x98)
+[ 0.900000] [<c008fca0>] (enable_irq+0x54/0x98) from [<c021e618>] (wait_op_done+0x40/0x134)
+[ 0.900000] [<c021e618>] (wait_op_done+0x40/0x134) from [<c021e808>] (send_cmd+0x30/0x38)
+[ 0.900000] [<c021e808>] (send_cmd+0x30/0x38) from [<c021eb8c>] (mxc_nand_command+0x26c/0x328)
+[ 0.900000] [<c021eb8c>] (mxc_nand_command+0x26c/0x328) from [<c021aa60>] (nand_scan_ident+0x188/0x6c0)
+[ 0.900000] [<c021aa60>] (nand_scan_ident+0x188/0x6c0) from [<c001a9cc>] (mxcnd_probe+0x2b8/0x3d0)
+[ 0.900000] [<c001a9cc>] (mxcnd_probe+0x2b8/0x3d0) from [<c01f9e88>] (platform_drv_probe+0x20/0x24)
+[ 0.900000] [<c01f9e88>] (platform_drv_probe+0x20/0x24) from [<c01f8c38>] (driver_probe_device+0xb0/0x164)
+[ 0.900000] [<c01f8c38>] (driver_probe_device+0xb0/0x164) from [<c01f8d54>] (__driver_attach+0x68/0x8c)
+[ 0.900000] [<c01f8d54>] (__driver_attach+0x68/0x8c) from [<c01f8348>] (bus_for_each_dev+0x50/0x84)
+[ 0.900000] [<c01f8348>] (bus_for_each_dev+0x50/0x84) from [<c01f8a9c>] (driver_attach+0x20/0x28)
+[ 0.900000] [<c01f8a9c>] (driver_attach+0x20/0x28) from [<c01f7c00>] (bus_add_driver+0x144/0x2dc)
+[ 0.900000] [<c01f7c00>] (bus_add_driver+0x144/0x2dc) from [<c01f906c>] (driver_register+0xb0/0x13c)
+[ 0.900000] [<c01f906c>] (driver_register+0xb0/0x13c) from [<c01fa13c>] (platform_driver_register+0x4c/0x60)
+[ 0.900000] [<c01fa13c>] (platform_driver_register+0x4c/0x60) from [<c01fa170>] (platform_driver_probe+0x20/0xa0)
+[ 0.900000] [<c01fa170>] (platform_driver_probe+0x20/0xa0) from [<c001a708>] (mxc_nd_init+0x18/0x24)
+[ 0.900000] [<c001a708>] (mxc_nd_init+0x18/0x24) from [<c002938c>] (do_one_initcall+0x64/0x1bc)
+[ 0.900000] [<c002938c>] (do_one_initcall+0x64/0x1bc) from [<c00084c4>] (kernel_init+0xe8/0x1ac)
+[ 0.900000] [<c00084c4>] (kernel_init+0xe8/0x1ac) from [<c002aee8>] (kernel_thread_exit+0x0/0x8)
+[ 0.900000] ---[ end trace 8bf72ac6ba089a19 ]---
+[ 1.140000] NAND device: Manufacturer ID: 0x2c, Chip ID: 0xda (Micron NAND 256MiB 3,3V 8-bit)
+
+Signed-off-by: Eric Bénard <eric@eukrea.com>
+Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mtd/nand/mxc_nand.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/mxc_nand.c
++++ b/drivers/mtd/nand/mxc_nand.c
+@@ -604,8 +604,8 @@ static void mxc_nand_command(struct mtd_
+ /* Command pre-processing step */
+ switch (command) {
+ case NAND_CMD_RESET:
+- send_cmd(host, command, false);
+ preset(mtd);
++ send_cmd(host, command, false);
+ break;
+
+ case NAND_CMD_STATUS:
--- /dev/null
+From 38117d1495e587fbb10d6e55733139a27893cef5 Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Mon, 31 May 2010 00:28:35 -0700
+Subject: net: Fix NETDEV_NOTIFY_PEERS to not conflict with NETDEV_BONDING_DESLAVE.
+
+From: David S. Miller <davem@davemloft.net>
+
+commit 38117d1495e587fbb10d6e55733139a27893cef5 upstream.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/notifier.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/notifier.h
++++ b/include/linux/notifier.h
+@@ -210,7 +210,7 @@ static inline int notifier_to_errno(int
+ #define NETDEV_POST_INIT 0x0010
+ #define NETDEV_UNREGISTER_BATCH 0x0011
+ #define NETDEV_BONDING_DESLAVE 0x0012
+-#define NETDEV_NOTIFY_PEERS 0x0012
++#define NETDEV_NOTIFY_PEERS 0x0013
+
+ #define SYS_DOWN 0x0001 /* Notify of system down */
+ #define SYS_RESTART SYS_DOWN
--- /dev/null
+From a6cd7eb374647b572ae9e7dbfe49871e6996e8e0 Mon Sep 17 00:00:00 2001
+From: Igor Grinberg <grinberg@compulab.co.il>
+Date: Tue, 20 Jul 2010 10:58:52 +0300
+Subject: [ARM] pxa/cm-x300: fix ffuart registration
+
+From: Igor Grinberg <grinberg@compulab.co.il>
+
+commit a6cd7eb374647b572ae9e7dbfe49871e6996e8e0 upstream.
+
+ffuart is available on cm-x300 only with pxa300.
+
+Signed-off-by: Igor Grinberg <grinberg@compulab.co.il>
+Signed-off-by: Eric Miao <eric.y.miao@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/mach-pxa/cm-x300.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/mach-pxa/cm-x300.c
++++ b/arch/arm/mach-pxa/cm-x300.c
+@@ -745,9 +745,10 @@ static void __init cm_x300_init(void)
+ {
+ cm_x300_init_mfp();
+
+- pxa_set_ffuart_info(NULL);
+ pxa_set_btuart_info(NULL);
+ pxa_set_stuart_info(NULL);
++ if (cpu_is_pxa300())
++ pxa_set_ffuart_info(NULL);
+
+ cm_x300_init_da9030();
+ cm_x300_init_dm9000();
--- /dev/null
+From 396e894d289d69bacf5acd983c97cd6e21a14c08 Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Date: Fri, 9 Jul 2010 15:12:27 +0200
+Subject: sched: Revert nohz_ratelimit() for now
+
+From: Peter Zijlstra <a.p.zijlstra@chello.nl>
+
+commit 396e894d289d69bacf5acd983c97cd6e21a14c08 upstream.
+
+Norbert reported that nohz_ratelimit() causes his laptop to burn about
+4W (40%) extra. For now back out the change and see if we can adjust
+the power management code to make better decisions.
+
+Reported-by: Norbert Preining <preining@logic.at>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Acked-by: Mike Galbraith <efault@gmx.de>
+Cc: Arjan van de Ven <arjan@infradead.org>
+LKML-Reference: <new-submission>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/sched.h | 6 ------
+ kernel/sched.c | 10 ----------
+ kernel/time/tick-sched.c | 2 +-
+ 3 files changed, 1 insertion(+), 17 deletions(-)
+
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -274,17 +274,11 @@ extern cpumask_var_t nohz_cpu_mask;
+ #if defined(CONFIG_SMP) && defined(CONFIG_NO_HZ)
+ extern int select_nohz_load_balancer(int cpu);
+ extern int get_nohz_load_balancer(void);
+-extern int nohz_ratelimit(int cpu);
+ #else
+ static inline int select_nohz_load_balancer(int cpu)
+ {
+ return 0;
+ }
+-
+-static inline int nohz_ratelimit(int cpu)
+-{
+- return 0;
+-}
+ #endif
+
+ /*
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -1232,16 +1232,6 @@ void wake_up_idle_cpu(int cpu)
+ smp_send_reschedule(cpu);
+ }
+
+-int nohz_ratelimit(int cpu)
+-{
+- struct rq *rq = cpu_rq(cpu);
+- u64 diff = rq->clock - rq->nohz_stamp;
+-
+- rq->nohz_stamp = rq->clock;
+-
+- return diff < (NSEC_PER_SEC / HZ) >> 1;
+-}
+-
+ #endif /* CONFIG_NO_HZ */
+
+ static u64 sched_avg_period(void)
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -325,7 +325,7 @@ void tick_nohz_stop_sched_tick(int inidl
+ } while (read_seqretry(&xtime_lock, seq));
+
+ if (rcu_needs_cpu(cpu) || printk_needs_cpu(cpu) ||
+- arch_needs_cpu(cpu) || nohz_ratelimit(cpu)) {
++ arch_needs_cpu(cpu)) {
+ next_jiffies = last_jiffies + 1;
+ delta_jiffies = 1;
+ } else {
md-move-revalidate_disk-back-outside-open_mutex.patch
md-fix-another-deadlock-with-removing-sysfs-attributes.patch
md-raid10-fix-deadlock-with-unaligned-read-during-resync.patch
+e100-e1000-igb-ixgb-add-missing-read-memory-barrier.patch
+ioat2-catch-and-recover-from-broken-vtd-configurations-v6.patch
+fix-sget-race-with-failing-mount.patch
+blkdev-cgroup-whitelist-permission-fix.patch
+ecryptfs-handle-ioctl-calls-with-unlocked-and-compat-functions.patch
+ecryptfs-release-reference-to-lower-mount-if-interpose-fails.patch
+fs-ecryptfs-file.c-introduce-missing-free.patch
+drbd-initialize-all-members-of-sync_conf-to-their-defaults.patch
+drbd-disable-delay-probes-for-the-upcomming-release.patch
+bio-fs-update-rwa_mask-reada-and-swrite-to-match-the-corresponding-bio_rw_-bits.patch
+signalfd-fill-in-ssi_int-for-posix-timers-and-message-queues.patch
+pxa-cm-x300-fix-ffuart-registration.patch
+smsc911x-add-spinlocks-around-registers-access.patch
+arm-6299-1-errata-tlbiasidis-and-tlbimvais-operations-can-broadcast-a-faulty-asid.patch
+arm-6280-1-imx-fix-build-failure-when-including-mach-gpio.h-without-linux-spinlock.h.patch
+usb-musb-use-correct-register-widths-in-register-dumps.patch
+usb-ehci-remove-pci-assumption.patch
+usb-resizing-usbmon-binary-interface-buffer-causes-protection-faults.patch
+usb-delay-init-quirk-for-logitech-harmony-700-series-devices.patch
+usb-serial-enabling-support-for-segway-rmp-in-ftdi_sio.patch
+usb-option-huawei-ets-1220-support-added.patch
+usb-option-add-huawei-k3765-k4505-devices-to-work-properly.patch
+usb-ftdi_sio-device-id-for-navitator.patch
+usb-cp210x-add-four-new-device-ids.patch
+usb-usbtest-avoid-to-free-coherent-buffer-in-atomic-context.patch
+usb-fix-thread-unsafe-anchor-utiliy-routines.patch
+usb-serial-fix-stalled-writes.patch
+bluetooth-added-support-for-controller-shipped-with-imac-i5.patch
+sched-revert-nohz_ratelimit-for-now.patch
+mtd-mxc_nand-fix-unbalanced-enable-for-irq.patch
+mtd-gen_nand-fix-support-for-multiple-chips.patch
+l2tp-fix-export-of-header-file-for-userspace.patch
+jfs-don-t-allow-os2-xattr-namespace-overlap-with-others.patch
+net-fix-netdev_notify_peers-to-not-conflict-with-netdev_bonding_deslave.patch
+irq-add-new-irq-flag-irqf_no_suspend.patch
+xen-do-not-suspend-ipi-irqs.patch
+crypto-testmgr-add-an-option-to-disable-cryptoalgos-self-tests.patch
+ext4-fix-freeze-deadlock-under-io.patch
+drm-edid-fix-the-hdtv-hack-sync-adjustment.patch
--- /dev/null
+From a2a20c412c86e0bb46a9ab0dd31bcfe6d201b913 Mon Sep 17 00:00:00 2001
+From: Nathan Lynch <ntl@pobox.com>
+Date: Tue, 10 Aug 2010 18:03:08 -0700
+Subject: signalfd: fill in ssi_int for posix timers and message queues
+
+From: Nathan Lynch <ntl@pobox.com>
+
+commit a2a20c412c86e0bb46a9ab0dd31bcfe6d201b913 upstream.
+
+If signalfd is used to consume a signal generated by a POSIX interval
+timer or POSIX message queue, the ssi_int field does not reflect the data
+(sigevent->sigev_value) supplied to timer_create(2) or mq_notify(3). (The
+ssi_ptr field, however, is filled in.)
+
+This behavior differs from signalfd's treatment of sigqueue-generated
+signals -- see the default case in signalfd_copyinfo. It also gives
+results that differ from the case when a signal is handled conventionally
+via a sigaction-registered handler.
+
+So, set signalfd_siginfo->ssi_int in the remaining cases (__SI_TIMER,
+__SI_MESGQ) where ssi_ptr is set.
+
+akpm: a non-back-compatible change. Merge into -stable to minimise the
+number of kernels which are in the field and which miss this feature.
+
+Signed-off-by: Nathan Lynch <ntl@pobox.com>
+Acked-by: Davide Libenzi <davidel@xmailserver.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/signalfd.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/signalfd.c
++++ b/fs/signalfd.c
+@@ -88,6 +88,7 @@ static int signalfd_copyinfo(struct sign
+ err |= __put_user(kinfo->si_tid, &uinfo->ssi_tid);
+ err |= __put_user(kinfo->si_overrun, &uinfo->ssi_overrun);
+ err |= __put_user((long) kinfo->si_ptr, &uinfo->ssi_ptr);
++ err |= __put_user(kinfo->si_int, &uinfo->ssi_int);
+ break;
+ case __SI_POLL:
+ err |= __put_user(kinfo->si_band, &uinfo->ssi_band);
+@@ -111,6 +112,7 @@ static int signalfd_copyinfo(struct sign
+ err |= __put_user(kinfo->si_pid, &uinfo->ssi_pid);
+ err |= __put_user(kinfo->si_uid, &uinfo->ssi_uid);
+ err |= __put_user((long) kinfo->si_ptr, &uinfo->ssi_ptr);
++ err |= __put_user(kinfo->si_int, &uinfo->ssi_int);
+ break;
+ default:
+ /*
--- /dev/null
+From 492c5d943d6a04b124ba3a719dc746dc36b14cfb Mon Sep 17 00:00:00 2001
+From: Catalin Marinas <catalin.marinas@arm.com>
+Date: Mon, 19 Jul 2010 13:36:21 -0700
+Subject: smsc911x: Add spinlocks around registers access
+
+From: Catalin Marinas <catalin.marinas@arm.com>
+
+commit 492c5d943d6a04b124ba3a719dc746dc36b14cfb upstream.
+
+On SMP systems, the SMSC911x registers may be accessed by multiple CPUs
+and this seems to put the chip in an inconsistent state. The patch adds
+spinlocks to the smsc911x_reg_read, smsc911x_reg_write,
+smsc911x_rx_readfifo and smsc911x_tx_writefifo functions.
+
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/smsc911x.c | 92 +++++++++++++++++++++++++++----------------------
+ 1 file changed, 52 insertions(+), 40 deletions(-)
+
+--- a/drivers/net/smsc911x.c
++++ b/drivers/net/smsc911x.c
+@@ -84,8 +84,7 @@ struct smsc911x_data {
+ */
+ spinlock_t mac_lock;
+
+- /* spinlock to ensure 16-bit accesses are serialised.
+- * unused with a 32-bit bus */
++ /* spinlock to ensure register accesses are serialised */
+ spinlock_t dev_lock;
+
+ struct phy_device *phy_dev;
+@@ -118,37 +117,33 @@ struct smsc911x_data {
+ unsigned int hashlo;
+ };
+
+-/* The 16-bit access functions are significantly slower, due to the locking
+- * necessary. If your bus hardware can be configured to do this for you
+- * (in response to a single 32-bit operation from software), you should use
+- * the 32-bit access functions instead. */
+-
+-static inline u32 smsc911x_reg_read(struct smsc911x_data *pdata, u32 reg)
++static inline u32 __smsc911x_reg_read(struct smsc911x_data *pdata, u32 reg)
+ {
+ if (pdata->config.flags & SMSC911X_USE_32BIT)
+ return readl(pdata->ioaddr + reg);
+
+- if (pdata->config.flags & SMSC911X_USE_16BIT) {
+- u32 data;
+- unsigned long flags;
+-
+- /* these two 16-bit reads must be performed consecutively, so
+- * must not be interrupted by our own ISR (which would start
+- * another read operation) */
+- spin_lock_irqsave(&pdata->dev_lock, flags);
+- data = ((readw(pdata->ioaddr + reg) & 0xFFFF) |
++ if (pdata->config.flags & SMSC911X_USE_16BIT)
++ return ((readw(pdata->ioaddr + reg) & 0xFFFF) |
+ ((readw(pdata->ioaddr + reg + 2) & 0xFFFF) << 16));
+- spin_unlock_irqrestore(&pdata->dev_lock, flags);
+-
+- return data;
+- }
+
+ BUG();
+ return 0;
+ }
+
+-static inline void smsc911x_reg_write(struct smsc911x_data *pdata, u32 reg,
+- u32 val)
++static inline u32 smsc911x_reg_read(struct smsc911x_data *pdata, u32 reg)
++{
++ u32 data;
++ unsigned long flags;
++
++ spin_lock_irqsave(&pdata->dev_lock, flags);
++ data = __smsc911x_reg_read(pdata, reg);
++ spin_unlock_irqrestore(&pdata->dev_lock, flags);
++
++ return data;
++}
++
++static inline void __smsc911x_reg_write(struct smsc911x_data *pdata, u32 reg,
++ u32 val)
+ {
+ if (pdata->config.flags & SMSC911X_USE_32BIT) {
+ writel(val, pdata->ioaddr + reg);
+@@ -156,44 +151,54 @@ static inline void smsc911x_reg_write(st
+ }
+
+ if (pdata->config.flags & SMSC911X_USE_16BIT) {
+- unsigned long flags;
+-
+- /* these two 16-bit writes must be performed consecutively, so
+- * must not be interrupted by our own ISR (which would start
+- * another read operation) */
+- spin_lock_irqsave(&pdata->dev_lock, flags);
+ writew(val & 0xFFFF, pdata->ioaddr + reg);
+ writew((val >> 16) & 0xFFFF, pdata->ioaddr + reg + 2);
+- spin_unlock_irqrestore(&pdata->dev_lock, flags);
+ return;
+ }
+
+ BUG();
+ }
+
++static inline void smsc911x_reg_write(struct smsc911x_data *pdata, u32 reg,
++ u32 val)
++{
++ unsigned long flags;
++
++ spin_lock_irqsave(&pdata->dev_lock, flags);
++ __smsc911x_reg_write(pdata, reg, val);
++ spin_unlock_irqrestore(&pdata->dev_lock, flags);
++}
++
+ /* Writes a packet to the TX_DATA_FIFO */
+ static inline void
+ smsc911x_tx_writefifo(struct smsc911x_data *pdata, unsigned int *buf,
+ unsigned int wordcount)
+ {
++ unsigned long flags;
++
++ spin_lock_irqsave(&pdata->dev_lock, flags);
++
+ if (pdata->config.flags & SMSC911X_SWAP_FIFO) {
+ while (wordcount--)
+- smsc911x_reg_write(pdata, TX_DATA_FIFO, swab32(*buf++));
+- return;
++ __smsc911x_reg_write(pdata, TX_DATA_FIFO,
++ swab32(*buf++));
++ goto out;
+ }
+
+ if (pdata->config.flags & SMSC911X_USE_32BIT) {
+ writesl(pdata->ioaddr + TX_DATA_FIFO, buf, wordcount);
+- return;
++ goto out;
+ }
+
+ if (pdata->config.flags & SMSC911X_USE_16BIT) {
+ while (wordcount--)
+- smsc911x_reg_write(pdata, TX_DATA_FIFO, *buf++);
+- return;
++ __smsc911x_reg_write(pdata, TX_DATA_FIFO, *buf++);
++ goto out;
+ }
+
+ BUG();
++out:
++ spin_unlock_irqrestore(&pdata->dev_lock, flags);
+ }
+
+ /* Reads a packet out of the RX_DATA_FIFO */
+@@ -201,24 +206,31 @@ static inline void
+ smsc911x_rx_readfifo(struct smsc911x_data *pdata, unsigned int *buf,
+ unsigned int wordcount)
+ {
++ unsigned long flags;
++
++ spin_lock_irqsave(&pdata->dev_lock, flags);
++
+ if (pdata->config.flags & SMSC911X_SWAP_FIFO) {
+ while (wordcount--)
+- *buf++ = swab32(smsc911x_reg_read(pdata, RX_DATA_FIFO));
+- return;
++ *buf++ = swab32(__smsc911x_reg_read(pdata,
++ RX_DATA_FIFO));
++ goto out;
+ }
+
+ if (pdata->config.flags & SMSC911X_USE_32BIT) {
+ readsl(pdata->ioaddr + RX_DATA_FIFO, buf, wordcount);
+- return;
++ goto out;
+ }
+
+ if (pdata->config.flags & SMSC911X_USE_16BIT) {
+ while (wordcount--)
+- *buf++ = smsc911x_reg_read(pdata, RX_DATA_FIFO);
+- return;
++ *buf++ = __smsc911x_reg_read(pdata, RX_DATA_FIFO);
++ goto out;
+ }
+
+ BUG();
++out:
++ spin_unlock_irqrestore(&pdata->dev_lock, flags);
+ }
+
+ /* waits for MAC not busy, with timeout. Only called by smsc911x_mac_read
--- /dev/null
+From 356c5a4834a74c621715f7a7f16ded914eecbd3c Mon Sep 17 00:00:00 2001
+From: Alessio Igor Bogani <abogani@texware.it>
+Date: Tue, 27 Jul 2010 23:05:14 +0200
+Subject: USB: cp210x: Add four new device IDs
+
+From: Alessio Igor Bogani <abogani@texware.it>
+
+commit 356c5a4834a74c621715f7a7f16ded914eecbd3c upstream.
+
+Signed-off-by: Alessio Igor Bogani <abogani@texware.it>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/cp210x.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -126,6 +126,10 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
+ { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
+ { USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */
++ { USB_DEVICE(0x16DC, 0x0010) }, /* W-IE-NE-R Plein & Baus GmbH PL512 Power Supply */
++ { USB_DEVICE(0x16DC, 0x0011) }, /* W-IE-NE-R Plein & Baus GmbH RCM Remote Control for MARATON Power Supply */
++ { USB_DEVICE(0x16DC, 0x0012) }, /* W-IE-NE-R Plein & Baus GmbH MPOD Multi Channel Power Supply */
++ { USB_DEVICE(0x16DC, 0x0015) }, /* W-IE-NE-R Plein & Baus GmbH CML Control, Monitoring and Data Logger */
+ { } /* Terminating Entry */
+ };
+
--- /dev/null
+From 93362a875fc69881ae69299efaf19a55a1f57db0 Mon Sep 17 00:00:00 2001
+From: Phil Dibowitz <phil@ipom.com>
+Date: Thu, 22 Jul 2010 00:05:01 +0200
+Subject: USB delay init quirk for logitech Harmony 700-series devices
+
+From: Phil Dibowitz <phil@ipom.com>
+
+commit 93362a875fc69881ae69299efaf19a55a1f57db0 upstream.
+
+The Logitech Harmony 700 series needs an extra delay during
+initialization. This patch adds a USB quirk which enables such a delay
+and adds the device to the quirks list.
+
+Signed-off-by: Phil Dibowitz <phil@ipom.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/hub.c | 6 +++++-
+ drivers/usb/core/quirks.c | 3 +++
+ include/linux/usb/quirks.h | 4 ++++
+ 3 files changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -20,6 +20,7 @@
+ #include <linux/usb.h>
+ #include <linux/usbdevice_fs.h>
+ #include <linux/usb/hcd.h>
++#include <linux/usb/quirks.h>
+ #include <linux/kthread.h>
+ #include <linux/mutex.h>
+ #include <linux/freezer.h>
+@@ -1801,7 +1802,6 @@ int usb_new_device(struct usb_device *ud
+ pm_runtime_set_active(&udev->dev);
+ pm_runtime_enable(&udev->dev);
+
+- usb_detect_quirks(udev);
+ err = usb_enumerate_device(udev); /* Read descriptors */
+ if (err < 0)
+ goto fail;
+@@ -3111,6 +3111,10 @@ static void hub_port_connect_change(stru
+ if (status < 0)
+ goto loop;
+
++ usb_detect_quirks(udev);
++ if (udev->quirks & USB_QUIRK_DELAY_INIT)
++ msleep(1000);
++
+ /* consecutive bus-powered hubs aren't reliable; they can
+ * violate the voltage drop budget. if the new child has
+ * a "powered" LED, users should notice we didn't enable it
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -38,6 +38,9 @@ static const struct usb_device_id usb_qu
+ /* Creative SB Audigy 2 NX */
+ { USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* Logitech Harmony 700-series */
++ { USB_DEVICE(0x046d, 0xc122), .driver_info = USB_QUIRK_DELAY_INIT },
++
+ /* Philips PSC805 audio device */
+ { USB_DEVICE(0x0471, 0x0155), .driver_info = USB_QUIRK_RESET_RESUME },
+
+--- a/include/linux/usb/quirks.h
++++ b/include/linux/usb/quirks.h
+@@ -26,4 +26,8 @@
+ and can't handle talking to these interfaces */
+ #define USB_QUIRK_HONOR_BNUMINTERFACES 0x00000020
+
++/* device needs a pause during initialization, after we read the device
++ descriptor */
++#define USB_QUIRK_DELAY_INIT 0x00000040
++
+ #endif /* __LINUX_USB_QUIRKS_H */
--- /dev/null
+From ae68a83bdc1971cb02fefc7a686ba6d077065e71 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 14 Jul 2010 11:03:23 -0400
+Subject: USB: EHCI: remove PCI assumption
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit ae68a83bdc1971cb02fefc7a686ba6d077065e71 upstream.
+
+This patch (as1405) fixes a small bug in ehci-hcd's isochronous
+scheduler. Not all EHCI controllers are PCI, and the code shouldn't
+assume that they are. Instead, introduce a special flag for
+controllers which need to delay iso scheduling for full-speed devices
+beyond the scheduling threshold.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+CC: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+CC: David Brownell <david-b@pacbell.net>
+Acked-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/ehci-pci.c | 1 +
+ drivers/usb/host/ehci-sched.c | 10 ++++------
+ drivers/usb/host/ehci.h | 1 +
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/host/ehci-pci.c
++++ b/drivers/usb/host/ehci-pci.c
+@@ -114,6 +114,7 @@ static int ehci_pci_setup(struct usb_hcd
+ break;
+ case PCI_VENDOR_ID_INTEL:
+ ehci->need_io_watchdog = 0;
++ ehci->fs_i_thresh = 1;
+ if (pdev->device == 0x27cc) {
+ ehci->broken_periodic = 1;
+ ehci_info(ehci, "using broken periodic workaround\n");
+--- a/drivers/usb/host/ehci-sched.c
++++ b/drivers/usb/host/ehci-sched.c
+@@ -1400,7 +1400,6 @@ iso_stream_schedule (
+ int status;
+ unsigned mod = ehci->periodic_size << 3;
+ struct ehci_iso_sched *sched = urb->hcpriv;
+- struct pci_dev *pdev;
+
+ if (sched->span > (mod - SCHEDULE_SLOP)) {
+ ehci_dbg (ehci, "iso request %p too long\n", urb);
+@@ -1427,15 +1426,14 @@ iso_stream_schedule (
+ * slot in the schedule, implicitly assuming URB_ISO_ASAP.
+ */
+ if (likely (!list_empty (&stream->td_list))) {
+- pdev = to_pci_dev(ehci_to_hcd(ehci)->self.controller);
+ start = stream->next_uframe;
+
+ /* For high speed devices, allow scheduling within the
+- * isochronous scheduling threshold. For full speed devices,
+- * don't. (Work around for Intel ICH9 bug.)
++ * isochronous scheduling threshold. For full speed devices
++ * and Intel PCI-based controllers, don't (work around for
++ * Intel ICH9 bug).
+ */
+- if (!stream->highspeed &&
+- pdev->vendor == PCI_VENDOR_ID_INTEL)
++ if (!stream->highspeed && ehci->fs_i_thresh)
+ next = now + ehci->i_thresh;
+ else
+ next = now;
+--- a/drivers/usb/host/ehci.h
++++ b/drivers/usb/host/ehci.h
+@@ -130,6 +130,7 @@ struct ehci_hcd { /* one per controlle
+ unsigned has_amcc_usb23:1;
+ unsigned need_io_watchdog:1;
+ unsigned broken_periodic:1;
++ unsigned fs_i_thresh:1; /* Intel iso scheduling */
+
+ /* required for usb32 quirk */
+ #define OHCI_CTRL_HCFS (3 << 6)
--- /dev/null
+From b3e670443b7fb8a2d29831b62b44a039c283e351 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@googlemail.com>
+Date: Tue, 3 Aug 2010 02:32:28 +0200
+Subject: USB: fix thread-unsafe anchor utiliy routines
+
+From: Christian Lamparter <chunkeey@googlemail.com>
+
+commit b3e670443b7fb8a2d29831b62b44a039c283e351 upstream.
+
+This patch fixes a race condition in two utility routines
+related to the removal/unlinking of urbs from an anchor.
+
+If two threads are concurrently accessing the same anchor,
+both could end up with the same urb - thinking they are
+the exclusive owner.
+
+Alan Stern pointed out a related issue in
+usb_unlink_anchored_urbs:
+
+"The URB isn't removed from the anchor until it completes
+ (as a by-product of completion, in fact), which might not
+ be for quite some time after the unlink call returns.
+ In the meantime, the subroutine will keep trying to unlink
+ it, over and over again."
+
+Cc: Oliver Neukum <oneukum@suse.de>
+Cc: Greg Kroah-Hartman <greg@kroah.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/urb.c | 50 ++++++++++++++++++++-----------------------------
+ 1 file changed, 21 insertions(+), 29 deletions(-)
+
+--- a/drivers/usb/core/urb.c
++++ b/drivers/usb/core/urb.c
+@@ -137,6 +137,16 @@ void usb_anchor_urb(struct urb *urb, str
+ }
+ EXPORT_SYMBOL_GPL(usb_anchor_urb);
+
++/* Callers must hold anchor->lock */
++static void __usb_unanchor_urb(struct urb *urb, struct usb_anchor *anchor)
++{
++ urb->anchor = NULL;
++ list_del(&urb->anchor_list);
++ usb_put_urb(urb);
++ if (list_empty(&anchor->urb_list))
++ wake_up(&anchor->wait);
++}
++
+ /**
+ * usb_unanchor_urb - unanchors an URB
+ * @urb: pointer to the urb to anchor
+@@ -156,17 +166,14 @@ void usb_unanchor_urb(struct urb *urb)
+ return;
+
+ spin_lock_irqsave(&anchor->lock, flags);
+- if (unlikely(anchor != urb->anchor)) {
+- /* we've lost the race to another thread */
+- spin_unlock_irqrestore(&anchor->lock, flags);
+- return;
+- }
+- urb->anchor = NULL;
+- list_del(&urb->anchor_list);
++ /*
++ * At this point, we could be competing with another thread which
++ * has the same intention. To protect the urb from being unanchored
++ * twice, only the winner of the race gets the job.
++ */
++ if (likely(anchor == urb->anchor))
++ __usb_unanchor_urb(urb, anchor);
+ spin_unlock_irqrestore(&anchor->lock, flags);
+- usb_put_urb(urb);
+- if (list_empty(&anchor->urb_list))
+- wake_up(&anchor->wait);
+ }
+ EXPORT_SYMBOL_GPL(usb_unanchor_urb);
+
+@@ -749,20 +756,11 @@ EXPORT_SYMBOL_GPL(usb_unpoison_anchored_
+ void usb_unlink_anchored_urbs(struct usb_anchor *anchor)
+ {
+ struct urb *victim;
+- unsigned long flags;
+
+- spin_lock_irqsave(&anchor->lock, flags);
+- while (!list_empty(&anchor->urb_list)) {
+- victim = list_entry(anchor->urb_list.prev, struct urb,
+- anchor_list);
+- usb_get_urb(victim);
+- spin_unlock_irqrestore(&anchor->lock, flags);
+- /* this will unanchor the URB */
++ while ((victim = usb_get_from_anchor(anchor)) != NULL) {
+ usb_unlink_urb(victim);
+ usb_put_urb(victim);
+- spin_lock_irqsave(&anchor->lock, flags);
+ }
+- spin_unlock_irqrestore(&anchor->lock, flags);
+ }
+ EXPORT_SYMBOL_GPL(usb_unlink_anchored_urbs);
+
+@@ -799,12 +797,11 @@ struct urb *usb_get_from_anchor(struct u
+ victim = list_entry(anchor->urb_list.next, struct urb,
+ anchor_list);
+ usb_get_urb(victim);
+- spin_unlock_irqrestore(&anchor->lock, flags);
+- usb_unanchor_urb(victim);
++ __usb_unanchor_urb(victim, anchor);
+ } else {
+- spin_unlock_irqrestore(&anchor->lock, flags);
+ victim = NULL;
+ }
++ spin_unlock_irqrestore(&anchor->lock, flags);
+
+ return victim;
+ }
+@@ -826,12 +823,7 @@ void usb_scuttle_anchored_urbs(struct us
+ while (!list_empty(&anchor->urb_list)) {
+ victim = list_entry(anchor->urb_list.prev, struct urb,
+ anchor_list);
+- usb_get_urb(victim);
+- spin_unlock_irqrestore(&anchor->lock, flags);
+- /* this may free the URB */
+- usb_unanchor_urb(victim);
+- usb_put_urb(victim);
+- spin_lock_irqsave(&anchor->lock, flags);
++ __usb_unanchor_urb(victim, anchor);
+ }
+ spin_unlock_irqrestore(&anchor->lock, flags);
+ }
--- /dev/null
+From b6180ef7c99574c3350bbffa2a3a9d675321543d Mon Sep 17 00:00:00 2001
+From: dranch@trinnet.net <dranch@trinnet.net>
+Date: Mon, 26 Jul 2010 19:44:33 -0700
+Subject: USB: ftdi_sio: device id for Navitator
+
+From: dranch@trinnet.net <dranch@trinnet.net>
+
+commit b6180ef7c99574c3350bbffa2a3a9d675321543d upstream.
+
+This patch is to add a US Interface, Inc. "Navigator" USB device.
+Specifically, it's a HAM Radio USB sound modem that also
+incorporates three pairs of unique FTDI serial ports. The standard
+Linux FTDI serial driver will only recognize the first two serial
+ports of an unknown FDTI derived device and this patch adds in
+recognition to these specific new IDs.
+
+Signed-off-by: David A. Ranch <dranch@trinnet.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 3 +++
+ drivers/usb/serial/ftdi_sio_ids.h | 5 +++++
+ 2 files changed, 8 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -157,6 +157,9 @@ static struct usb_device_id id_table_com
+ { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_5_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_6_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_7_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_USINT_CAT_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_USINT_WKEY_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_USINT_RS232_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_ACTZWAVE_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_IRTRANS_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_IPLUS_PID) },
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -40,6 +40,11 @@
+
+ #define FTDI_NXTCAM_PID 0xABB8 /* NXTCam for Mindstorms NXT */
+
++/* US Interface Navigator (http://www.usinterface.com/) */
++#define FTDI_USINT_CAT_PID 0xb810 /* Navigator CAT and 2nd PTT lines */
++#define FTDI_USINT_WKEY_PID 0xb811 /* Navigator WKEY and FSK lines */
++#define FTDI_USINT_RS232_PID 0xb812 /* Navigator RS232 and CONFIG lines */
++
+ /* OOCDlink by Joern Kaipf <joernk@web.de>
+ * (http://www.joernonline.de/dw/doku.php?id=start&idx=projects:oocdlink) */
+ #define FTDI_OOCDLINK_PID 0xbaf8 /* Amontec JTAGkey */
--- /dev/null
+From 0936fb5e92a90476959447ad8ae5d780afbbd930 Mon Sep 17 00:00:00 2001
+From: Anand Gadiyar <gadiyar@ti.com>
+Date: Thu, 8 Jul 2010 14:02:59 +0530
+Subject: USB: musb: use correct register widths in register dumps
+
+From: Anand Gadiyar <gadiyar@ti.com>
+
+commit 0936fb5e92a90476959447ad8ae5d780afbbd930 upstream.
+
+DMA_ADDR and DMA_COUNT are 32-bit registers, not 16-bit.
+
+Marking them as 16-bit in the table causes only the lower
+16-bits to be dumped and this is misleading.
+
+Signed-off-by: Anand Gadiyar <gadiyar@ti.com>
+Acked-by: Felipe Balbi <felipe.balbi@nokia.com>
+Signed-off-by: Ajay Kumar Gupta <ajay.gupta@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/musb/musb_debugfs.c | 32 ++++++++++++++++----------------
+ 1 file changed, 16 insertions(+), 16 deletions(-)
+
+--- a/drivers/usb/musb/musb_debugfs.c
++++ b/drivers/usb/musb/musb_debugfs.c
+@@ -92,29 +92,29 @@ static const struct musb_register_map mu
+ { "LS_EOF1", 0x7E, 8 },
+ { "SOFT_RST", 0x7F, 8 },
+ { "DMA_CNTLch0", 0x204, 16 },
+- { "DMA_ADDRch0", 0x208, 16 },
+- { "DMA_COUNTch0", 0x20C, 16 },
++ { "DMA_ADDRch0", 0x208, 32 },
++ { "DMA_COUNTch0", 0x20C, 32 },
+ { "DMA_CNTLch1", 0x214, 16 },
+- { "DMA_ADDRch1", 0x218, 16 },
+- { "DMA_COUNTch1", 0x21C, 16 },
++ { "DMA_ADDRch1", 0x218, 32 },
++ { "DMA_COUNTch1", 0x21C, 32 },
+ { "DMA_CNTLch2", 0x224, 16 },
+- { "DMA_ADDRch2", 0x228, 16 },
+- { "DMA_COUNTch2", 0x22C, 16 },
++ { "DMA_ADDRch2", 0x228, 32 },
++ { "DMA_COUNTch2", 0x22C, 32 },
+ { "DMA_CNTLch3", 0x234, 16 },
+- { "DMA_ADDRch3", 0x238, 16 },
+- { "DMA_COUNTch3", 0x23C, 16 },
++ { "DMA_ADDRch3", 0x238, 32 },
++ { "DMA_COUNTch3", 0x23C, 32 },
+ { "DMA_CNTLch4", 0x244, 16 },
+- { "DMA_ADDRch4", 0x248, 16 },
+- { "DMA_COUNTch4", 0x24C, 16 },
++ { "DMA_ADDRch4", 0x248, 32 },
++ { "DMA_COUNTch4", 0x24C, 32 },
+ { "DMA_CNTLch5", 0x254, 16 },
+- { "DMA_ADDRch5", 0x258, 16 },
+- { "DMA_COUNTch5", 0x25C, 16 },
++ { "DMA_ADDRch5", 0x258, 32 },
++ { "DMA_COUNTch5", 0x25C, 32 },
+ { "DMA_CNTLch6", 0x264, 16 },
+- { "DMA_ADDRch6", 0x268, 16 },
+- { "DMA_COUNTch6", 0x26C, 16 },
++ { "DMA_ADDRch6", 0x268, 32 },
++ { "DMA_COUNTch6", 0x26C, 32 },
+ { "DMA_CNTLch7", 0x274, 16 },
+- { "DMA_ADDRch7", 0x278, 16 },
+- { "DMA_COUNTch7", 0x27C, 16 },
++ { "DMA_ADDRch7", 0x278, 32 },
++ { "DMA_COUNTch7", 0x27C, 32 },
+ { } /* Terminating Entry */
+ };
+
--- /dev/null
+From 0372a754be9aa43e19fd86c9bc04796d43b55e38 Mon Sep 17 00:00:00 2001
+From: Andrew Bird <ajb@spheresystems.co.uk>
+Date: Fri, 23 Jul 2010 16:04:41 +0100
+Subject: USB: option: add huawei k3765 k4505 devices to work properly
+
+From: Andrew Bird <ajb@spheresystems.co.uk>
+
+commit 0372a754be9aa43e19fd86c9bc04796d43b55e38 upstream.
+
+This patch adds the product IDs of Huawei's K3765 and K4505 mobile
+broadband usb modems to option.c. It also adds a quirk to the option
+probe function so that binding to the device's network interface(class
+0xff) is avoided. This is necessary to allow another driver to bind to
+that, and to avoid programs like wvdial opening a nonfunctioning tty
+during modem discovery.
+
+Signed-off-by: Andrew Bird <ajb@spheresystems.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/option.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -145,6 +145,8 @@ static void option_instat_callback(struc
+ #define HUAWEI_PRODUCT_E143D 0x143D
+ #define HUAWEI_PRODUCT_E143E 0x143E
+ #define HUAWEI_PRODUCT_E143F 0x143F
++#define HUAWEI_PRODUCT_K4505 0x1464
++#define HUAWEI_PRODUCT_K3765 0x1465
+ #define HUAWEI_PRODUCT_E14AC 0x14AC
+ #define HUAWEI_PRODUCT_ETS1220 0x1803
+
+@@ -483,6 +485,8 @@ static const struct usb_device_id option
+ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143D, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143E, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143F, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4505, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3765, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_ETS1220, 0xff, 0xff, 0xff) },
+ { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E14AC) },
+ { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_9508) },
+@@ -1019,6 +1023,13 @@ static int option_probe(struct usb_seria
+ serial->interface->cur_altsetting->desc.bInterfaceClass != 0xff)
+ return -ENODEV;
+
++ /* Don't bind network interfaces on Huawei K3765 & K4505 */
++ if (serial->dev->descriptor.idVendor == HUAWEI_VENDOR_ID &&
++ (serial->dev->descriptor.idProduct == HUAWEI_PRODUCT_K3765 ||
++ serial->dev->descriptor.idProduct == HUAWEI_PRODUCT_K4505) &&
++ serial->interface->cur_altsetting->desc.bInterfaceNumber == 1)
++ return -ENODEV;
++
+ data = serial->private = kzalloc(sizeof(struct usb_wwan_intf_private), GFP_KERNEL);
+
+ if (!data)
--- /dev/null
+From b972302b0a13aaddc9e90da2b4b52722e5d0e776 Mon Sep 17 00:00:00 2001
+From: Pavel Kazlou <p.i.kazlou@gmail.com>
+Date: Thu, 22 Jul 2010 03:22:20 +0300
+Subject: USB: option: Huawei ETS 1220 support added
+
+From: Pavel Kazlou <p.i.kazlou@gmail.com>
+
+commit b972302b0a13aaddc9e90da2b4b52722e5d0e776 upstream.
+
+The patch adds Huawei ETS 1220 product id into the list of supported
+devices in 'option' usb serial driver.
+
+Signed-off-by: Pavel Kazlou <p.i.kazlou@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -146,6 +146,7 @@ static void option_instat_callback(struc
+ #define HUAWEI_PRODUCT_E143E 0x143E
+ #define HUAWEI_PRODUCT_E143F 0x143F
+ #define HUAWEI_PRODUCT_E14AC 0x14AC
++#define HUAWEI_PRODUCT_ETS1220 0x1803
+
+ #define QUANTA_VENDOR_ID 0x0408
+ #define QUANTA_PRODUCT_Q101 0xEA02
+@@ -482,6 +483,7 @@ static const struct usb_device_id option
+ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143D, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143E, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E143F, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_ETS1220, 0xff, 0xff, 0xff) },
+ { USB_DEVICE(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E14AC) },
+ { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_9508) },
+ { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_V640) }, /* Novatel Merlin V640/XV620 */
--- /dev/null
+From 33d973ad88ceb83ed1449592b7574b5b5bb33ac6 Mon Sep 17 00:00:00 2001
+From: Steven Robertson <steven@strobe.cc>
+Date: Wed, 21 Jul 2010 16:38:44 -0400
+Subject: USB: resizing usbmon binary interface buffer causes protection faults
+
+From: Steven Robertson <steven@strobe.cc>
+
+commit 33d973ad88ceb83ed1449592b7574b5b5bb33ac6 upstream.
+
+Enlarging the buffer size via the MON_IOCT_RING_SIZE ioctl causes
+general protection faults. It appears the culprit is an incorrect
+argument to mon_free_buff: instead of passing the size of the current
+buffer being freed, the size of the new buffer is passed.
+
+Use the correct size argument to mon_free_buff when changing the size of
+the buffer.
+
+Signed-off-by: Steven Robertson <steven@strobe.cc>
+Acked-by: Pete Zaitcev <zaitcev@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/mon/mon_bin.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/mon/mon_bin.c
++++ b/drivers/usb/mon/mon_bin.c
+@@ -1009,7 +1009,7 @@ static int mon_bin_ioctl(struct file *fi
+
+ mutex_lock(&rp->fetch_lock);
+ spin_lock_irqsave(&rp->b_lock, flags);
+- mon_free_buff(rp->b_vec, size/CHUNK_SIZE);
++ mon_free_buff(rp->b_vec, rp->b_size/CHUNK_SIZE);
+ kfree(rp->b_vec);
+ rp->b_vec = vec;
+ rp->b_size = size;
--- /dev/null
+From afad19648f70c6493193e0a774bd754b7790b4a0 Mon Sep 17 00:00:00 2001
+From: John G. Rogers <jgrogers@gmail.com>
+Date: Sat, 24 Jul 2010 09:50:52 -0400
+Subject: USB: serial: enabling support for Segway RMP in ftdi_sio
+
+From: John G. Rogers <jgrogers@gmail.com>
+
+commit afad19648f70c6493193e0a774bd754b7790b4a0 upstream.
+
+I have added the ProductID=0xe729 VendorID=FTDI_VID=0x0403 which will
+enable support for the Segway Robotic Mobility Platform (RMP200) in the
+ftdi_sio kernel module. Currently, users of the Segway RMP200 must use
+a RUN+="/sbin/modprobe -q ftdi-sio product=0xe729 vendor=0x0403 in a
+udev rule to get the ftdi_sio module to handle the usb interface and
+mount it on /dev/ttyXXX. This is not a good solution because some users
+will have multiple USB to Serial converters which will use the ftdi_sio
+module.
+
+Signed-off-by: John Rogers <jgrogers@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 1 +
+ drivers/usb/serial/ftdi_sio_ids.h | 5 +++++
+ 2 files changed, 6 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -746,6 +746,7 @@ static struct usb_device_id id_table_com
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SH4_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
++ { USB_DEVICE(FTDI_VID, SEGWAY_RMP200_PID) },
+ { }, /* Optional parameter entry */
+ { } /* Terminating entry */
+ };
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -1032,3 +1032,8 @@
+ #define XVERVE_SIGNALYZER_SH2_PID 0xBCA2
+ #define XVERVE_SIGNALYZER_SH4_PID 0xBCA4
+
++/*
++ * Segway Robotic Mobility Platform USB interface (using VID 0x0403)
++ * Submitted by John G. Rogers
++ */
++#define SEGWAY_RMP200_PID 0xe729
--- /dev/null
+From b58af4066d240b18b43f202e07b9ec7461d90b17 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Wed, 4 Aug 2010 15:45:57 +0200
+Subject: USB: serial: fix stalled writes
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit b58af4066d240b18b43f202e07b9ec7461d90b17 upstream.
+
+As David VomLehn points out, it was possible to receive an interrupt
+before clearing the free-urb flag which could lead to the urb being
+incorrectly marked as busy.
+
+For the same reason, move tx_bytes accounting so that it will never be
+negative.
+
+Note that the free-flags set and clear operations do not need any
+additional locking as they are manipulated while USB_SERIAL_WRITE_BUSY
+is set.
+
+Reported-by: David VomLehn <dvomlehn@cisco.com>
+Tested-by: David VomLehn <dvomlehn@cisco.com>
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/generic.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/serial/generic.c
++++ b/drivers/usb/serial/generic.c
+@@ -208,18 +208,23 @@ retry:
+ urb->transfer_buffer_length = count;
+ usb_serial_debug_data(debug, &port->dev, __func__, count,
+ urb->transfer_buffer);
++ spin_lock_irqsave(&port->lock, flags);
++ port->tx_bytes += count;
++ spin_unlock_irqrestore(&port->lock, flags);
++
++ clear_bit(i, &port->write_urbs_free);
+ result = usb_submit_urb(urb, GFP_ATOMIC);
+ if (result) {
+ dev_err(&port->dev, "%s - error submitting urb: %d\n",
+ __func__, result);
++ set_bit(i, &port->write_urbs_free);
++ spin_lock_irqsave(&port->lock, flags);
++ port->tx_bytes -= count;
++ spin_unlock_irqrestore(&port->lock, flags);
++
+ clear_bit_unlock(USB_SERIAL_WRITE_BUSY, &port->flags);
+ return result;
+ }
+- clear_bit(i, &port->write_urbs_free);
+-
+- spin_lock_irqsave(&port->lock, flags);
+- port->tx_bytes += count;
+- spin_unlock_irqrestore(&port->lock, flags);
+
+ /* Try sending off another urb, unless in irq context (in which case
+ * there will be no free urb). */
--- /dev/null
+From e10e1bec8e6654de4591ef45ddd6a6d1e5b2591c Mon Sep 17 00:00:00 2001
+From: Ming Lei <tom.leiming@gmail.com>
+Date: Mon, 2 Aug 2010 22:09:01 +0800
+Subject: USB: usbtest: avoid to free coherent buffer in atomic context
+
+From: Ming Lei <tom.leiming@gmail.com>
+
+commit e10e1bec8e6654de4591ef45ddd6a6d1e5b2591c upstream.
+
+This patch fixes the warning below:
+[30753.755998] ------------[ cut here ]------------
+[30753.755998] WARNING: at /home/tom/git/linux-2.6/linux-2.6-next/arch/x86/include/asm/dma-mapping.h:155 hcd_buffer_free+0xb1/0xd4 [usbcore]()
+[30753.755998] Hardware name: 6475EK2
+[30753.755998] Modules linked in: uvcvideo ehci_hcd usbtest cdc_ether usbnet vfat fat usb_storage nfsd lockd nfs_acl auth_rpcgss exportfs mii tun videodev v4l1_compat v4l2_compat_ioctl32 fuse bridge stp llc sunrpc ipv6 cpufreq_ondemand acpi_cpufreq freq_table mperf kvm_intel kvm arc4 ecb ath5k usbhid mac80211 snd_hda_codec_conexant ch341 usbserial ath cfg80211 thinkpad_acpi snd_hda_intel pcspkr wmi hwmon yenta_socket iTCO_wdt iTCO_vendor_support i2c_i801 e1000e snd_hda_codec snd_hwdep snd_pcm snd_timer snd soundcore snd_page_alloc pata_acpi uhci_hcd ohci_hcd usbcore i915 drm_kms_helper drm i2c_algo_bit i2c_core video output [last unloaded: uvcvideo]
+[30753.755998] Pid: 0, comm: swapper Tainted: G W 2.6.35-rc6-gkh-wl+ #49
+[30753.755998] Call Trace:
+[30753.755998] <IRQ> [<ffffffff8104478a>] warn_slowpath_common+0x80/0x98
+[30753.755998] [<ffffffff810447b7>] warn_slowpath_null+0x15/0x17
+[30753.755998] [<ffffffffa00ce02d>] hcd_buffer_free+0xb1/0xd4 [usbcore]
+[30753.755998] [<ffffffffa00c1345>] usb_free_coherent+0x1c/0x1e [usbcore]
+[30753.755998] [<ffffffffa00b13e4>] simple_free_urb+0x23/0x2f [usbtest]
+[30753.755998] [<ffffffffa00b210b>] iso_callback+0xbb/0x10f [usbtest]
+[30753.755998] [<ffffffffa00c7390>] usb_hcd_giveback_urb+0x8c/0xc0 [usbcore]
+[30753.755998] [<ffffffffa0449b35>] ehci_urb_done+0x84/0x95 [ehci_hcd]
+[30753.755998] [<ffffffffa044b5a5>] ehci_work+0x41a/0x7dd [ehci_hcd]
+[30753.755998] [<ffffffffa044e298>] ehci_irq+0x33b/0x370 [ehci_hcd]
+[30753.755998] [<ffffffff8100fb05>] ? sched_clock+0x9/0xd
+[30753.755998] [<ffffffff8105e641>] ? sched_clock_local+0x1c/0x82
+[30753.755998] [<ffffffff8105e76a>] ? sched_clock_cpu+0xc3/0xce
+[30753.755998] [<ffffffff81067c7e>] ? trace_hardirqs_off+0xd/0xf
+[30753.755998] [<ffffffff8105e7b8>] ? cpu_clock+0x43/0x5e
+[30753.755998] [<ffffffffa00c6999>] usb_hcd_irq+0x45/0xa1 [usbcore]
+[30753.755998] [<ffffffff81092e02>] handle_IRQ_event+0x20/0xa5
+[30753.755998] [<ffffffff81094cea>] handle_fasteoi_irq+0x92/0xd2
+[30753.755998] [<ffffffff8100c0ed>] handle_irq+0x1f/0x2a
+[30753.755998] [<ffffffff8100b75d>] do_IRQ+0x57/0xbe
+[30753.755998] [<ffffffff8136a693>] ret_from_intr+0x0/0x16
+[30753.755998] <EOI> [<ffffffff81223baa>] ? acpi_idle_enter_bm+0x231/0x269
+[30753.755998] [<ffffffff81223ba3>] ? acpi_idle_enter_bm+0x22a/0x269
+[30753.755998] [<ffffffff812c4b6b>] cpuidle_idle_call+0x99/0xce
+[30753.755998] [<ffffffff81008dd5>] cpu_idle+0x61/0xaa
+[30753.755998] [<ffffffff8136374b>] start_secondary+0x1c2/0x1c6
+[30753.755998] ---[ end trace 904cfaf7ab4cb1a2 ]---
+
+Signed-off-by: Ming Lei <tom.leiming@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/misc/usbtest.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/misc/usbtest.c
++++ b/drivers/usb/misc/usbtest.c
+@@ -1378,7 +1378,6 @@ static void iso_callback (struct urb *ur
+ break;
+ }
+ }
+- simple_free_urb (urb);
+
+ ctx->pending--;
+ if (ctx->pending == 0) {
+@@ -1495,6 +1494,7 @@ test_iso_queue (struct usbtest_dev *dev,
+ }
+
+ simple_free_urb (urbs [i]);
++ urbs[i] = NULL;
+ context.pending--;
+ context.submit_error = 1;
+ break;
+@@ -1504,6 +1504,10 @@ test_iso_queue (struct usbtest_dev *dev,
+
+ wait_for_completion (&context.done);
+
++ for (i = 0; i < param->sglen; i++) {
++ if (urbs[i])
++ simple_free_urb(urbs[i]);
++ }
+ /*
+ * Isochronous transfers are expected to fail sometimes. As an
+ * arbitrary limit, we will report an error if any submissions
--- /dev/null
+From 4877c737283813bdb4bebfa3168c1585f6e3a8ca Mon Sep 17 00:00:00 2001
+From: Ian Campbell <ian.campbell@citrix.com>
+Date: Thu, 29 Jul 2010 11:16:35 +0100
+Subject: xen: Do not suspend IPI IRQs.
+
+From: Ian Campbell <ian.campbell@citrix.com>
+
+commit 4877c737283813bdb4bebfa3168c1585f6e3a8ca upstream.
+
+In general the semantics of IPIs are that they are are expected to
+continue functioning after dpm_suspend_noirq().
+
+Specifically I have seen a deadlock between the callfunc IPI and the
+stop machine used by xen's do_suspend() routine. If one CPU has already
+called dpm_suspend_noirq() then there is a window where it can be sent
+a callfunc IPI before all the other CPUs have entered stop_cpu().
+
+If this happens then the first CPU ends up spinning in stop_cpu()
+waiting for the other to rendezvous in state STOPMACHINE_PREPARE while
+the other is spinning in csd_lock_wait().
+
+Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
+Cc: Jeremy Fitzhardinge <jeremy@goop.org>
+Cc: xen-devel@lists.xensource.com
+LKML-Reference: <1280398595-29708-4-git-send-email-ian.campbell@citrix.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/xen/events.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/xen/events.c
++++ b/drivers/xen/events.c
+@@ -536,6 +536,7 @@ int bind_ipi_to_irqhandler(enum ipi_vect
+ if (irq < 0)
+ return irq;
+
++ irqflags |= IRQF_NO_SUSPEND;
+ retval = request_irq(irq, handler, irqflags, devname, dev_id);
+ if (retval != 0) {
+ unbind_from_irq(irq);
projects / thirdparty / kernel / stable-queue.git / commitdiff
