--- /dev/null
+From 7e24bc1ce669b2876ffa475ea1147f2bb9ffdc52 Mon Sep 17 00:00:00 2001
+From: Alex Chiang <achiang@hp.com>
+Date: Tue, 4 Aug 2009 14:44:17 -0600
+Subject: ACPI: pci_slot.ko wants a 64-bit _SUN
+
+From: Alex Chiang <achiang@hp.com>
+
+commit 7e24bc1ce669b2876ffa475ea1147f2bb9ffdc52 upstream.
+
+Similar to commit b6adc195 (PCI hotplug: acpiphp wants a 64-bit
+_SUN), pci_slot.ko reads and creates sysfs directories based on
+the _SUN method.
+
+Certain HP platforms return 64 bits in _SUN. This change to
+pci_slot.ko allows us to see the correct sysfs directories.
+
+Reported-by: Chad Smith <chad.smith@hp.com>
+Signed-off-by: Alex Chiang <achiang@hp.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/pci_slot.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/acpi/pci_slot.c
++++ b/drivers/acpi/pci_slot.c
+@@ -57,7 +57,7 @@ ACPI_MODULE_NAME("pci_slot");
+ MY_NAME , ## arg); \
+ } while (0)
+
+-#define SLOT_NAME_SIZE 20 /* Inspired by #define in acpiphp.h */
++#define SLOT_NAME_SIZE 21 /* Inspired by #define in acpiphp.h */
+
+ struct acpi_pci_slot {
+ acpi_handle root_handle; /* handle of the root bridge */
+@@ -149,7 +149,7 @@ register_slot(acpi_handle handle, u32 lv
+ return AE_OK;
+ }
+
+- snprintf(name, sizeof(name), "%u", (u32)sun);
++ snprintf(name, sizeof(name), "%llu", sun);
+ pci_slot = pci_create_slot(pci_bus, device, name, NULL);
+ if (IS_ERR(pci_slot)) {
+ err("pci_create_slot returned %ld\n", PTR_ERR(pci_slot));
--- /dev/null
+From e517a5e97080bbe52857bd0d7df9b66602d53c4d Mon Sep 17 00:00:00 2001
+From: Eric Anholt <eric@anholt.net>
+Date: Thu, 10 Sep 2009 17:48:48 -0700
+Subject: agp/intel: Fix the pre-9xx chipset flush.
+
+From: Eric Anholt <eric@anholt.net>
+
+commit e517a5e97080bbe52857bd0d7df9b66602d53c4d upstream.
+
+Ever since we enabled GEM, the pre-9xx chipsets (particularly 865) have had
+serious stability issues. Back in May a wbinvd was added to the DRM to
+work around much of the problem. Some failure remained -- easily visible
+by dragging a window around on an X -retro desktop, or by looking at bugzilla.
+
+The chipset flush was on the right track -- hitting the right amount of
+memory, and it appears to be the only way to flush on these chipsets, but the
+flush page was mapped uncached. As a result, the writes trying to clear the
+writeback cache ended up bypassing the cache, and not flushing anything! The
+wbinvd would flush out other writeback data and often cause the data we wanted
+to get flushed, but not always. By removing the setting of the page to UC
+and instead just clflushing the data we write to try to flush it, we get the
+desired behavior with no wbinvd.
+
+This exports clflush_cache_range(), which was laying around and happened to
+basically match the code I was otherwise going to copy from the DRM.
+
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Brice Goglin <Brice.Goglin@ens-lyon.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/mm/pageattr.c | 1 +
+ drivers/char/agp/intel-agp.c | 30 +++++++++++++++++++++++-------
+ drivers/gpu/drm/i915/i915_gem.c | 10 ----------
+ 3 files changed, 24 insertions(+), 17 deletions(-)
+
+--- a/arch/x86/mm/pageattr.c
++++ b/arch/x86/mm/pageattr.c
+@@ -143,6 +143,7 @@ void clflush_cache_range(void *vaddr, un
+
+ mb();
+ }
++EXPORT_SYMBOL_GPL(clflush_cache_range);
+
+ static void __cpa_flush_all(void *arg)
+ {
+--- a/drivers/char/agp/intel-agp.c
++++ b/drivers/char/agp/intel-agp.c
+@@ -679,23 +679,39 @@ static void intel_i830_setup_flush(void)
+ if (!intel_private.i8xx_page)
+ return;
+
+- /* make page uncached */
+- map_page_into_agp(intel_private.i8xx_page);
+-
+ intel_private.i8xx_flush_page = kmap(intel_private.i8xx_page);
+ if (!intel_private.i8xx_flush_page)
+ intel_i830_fini_flush();
+ }
+
++static void
++do_wbinvd(void *null)
++{
++ wbinvd();
++}
++
++/* The chipset_flush interface needs to get data that has already been
++ * flushed out of the CPU all the way out to main memory, because the GPU
++ * doesn't snoop those buffers.
++ *
++ * The 8xx series doesn't have the same lovely interface for flushing the
++ * chipset write buffers that the later chips do. According to the 865
++ * specs, it's 64 octwords, or 1KB. So, to get those previous things in
++ * that buffer out, we just fill 1KB and clflush it out, on the assumption
++ * that it'll push whatever was in there out. It appears to work.
++ */
+ static void intel_i830_chipset_flush(struct agp_bridge_data *bridge)
+ {
+ unsigned int *pg = intel_private.i8xx_flush_page;
+- int i;
+
+- for (i = 0; i < 256; i += 2)
+- *(pg + i) = i;
++ memset(pg, 0, 1024);
+
+- wmb();
++ if (cpu_has_clflush) {
++ clflush_cache_range(pg, 1024);
++ } else {
++ if (on_each_cpu(do_wbinvd, NULL, 1) != 0)
++ printk(KERN_ERR "Timed out waiting for cache flush.\n");
++ }
+ }
+
+ /* The intel i830 automatically initializes the agp aperture during POST.
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -2505,16 +2505,6 @@ i915_gem_clflush_object(struct drm_gem_o
+ if (obj_priv->pages == NULL)
+ return;
+
+- /* XXX: The 865 in particular appears to be weird in how it handles
+- * cache flushing. We haven't figured it out, but the
+- * clflush+agp_chipset_flush doesn't appear to successfully get the
+- * data visible to the PGU, while wbinvd + agp_chipset_flush does.
+- */
+- if (IS_I865G(obj->dev)) {
+- wbinvd();
+- return;
+- }
+-
+ drm_clflush_pages(obj_priv->pages, obj->size / PAGE_SIZE);
+ }
+
--- /dev/null
+From d68721eb339e9237c11c1fea5f73f86211d14918 Mon Sep 17 00:00:00 2001
+From: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
+Date: Wed, 23 Sep 2009 15:57:42 -0700
+Subject: alpha: AGP update (fixes compile failure)
+
+From: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
+
+commit d68721eb339e9237c11c1fea5f73f86211d14918 upstream.
+
+This brings Alpha AGP platforms in sync with the change to struct
+agp_memory (unsigned long *memory => struct page **pages).
+
+Only compile tested (I don't have titan/marvel hardware), but this change
+looks pretty straightforward, so hopefully it's ok.
+
+Signed-off-by: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
+Cc: Richard Henderson <rth@twiddle.net>
+Cc: Dave Airlie <airlied@linux.ie>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/alpha/kernel/core_marvel.c | 2 +-
+ arch/alpha/kernel/core_titan.c | 2 +-
+ arch/alpha/kernel/pci_impl.h | 2 +-
+ arch/alpha/kernel/pci_iommu.c | 4 ++--
+ 4 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/alpha/kernel/core_marvel.c
++++ b/arch/alpha/kernel/core_marvel.c
+@@ -1016,7 +1016,7 @@ marvel_agp_bind_memory(alpha_agp_info *a
+ {
+ struct marvel_agp_aperture *aper = agp->aperture.sysdata;
+ return iommu_bind(aper->arena, aper->pg_start + pg_start,
+- mem->page_count, mem->memory);
++ mem->page_count, mem->pages);
+ }
+
+ static int
+--- a/arch/alpha/kernel/core_titan.c
++++ b/arch/alpha/kernel/core_titan.c
+@@ -680,7 +680,7 @@ titan_agp_bind_memory(alpha_agp_info *ag
+ {
+ struct titan_agp_aperture *aper = agp->aperture.sysdata;
+ return iommu_bind(aper->arena, aper->pg_start + pg_start,
+- mem->page_count, mem->memory);
++ mem->page_count, mem->pages);
+ }
+
+ static int
+--- a/arch/alpha/kernel/pci_impl.h
++++ b/arch/alpha/kernel/pci_impl.h
+@@ -198,7 +198,7 @@ extern unsigned long size_for_memory(uns
+
+ extern int iommu_reserve(struct pci_iommu_arena *, long, long);
+ extern int iommu_release(struct pci_iommu_arena *, long, long);
+-extern int iommu_bind(struct pci_iommu_arena *, long, long, unsigned long *);
++extern int iommu_bind(struct pci_iommu_arena *, long, long, struct page **);
+ extern int iommu_unbind(struct pci_iommu_arena *, long, long);
+
+
+--- a/arch/alpha/kernel/pci_iommu.c
++++ b/arch/alpha/kernel/pci_iommu.c
+@@ -880,7 +880,7 @@ iommu_release(struct pci_iommu_arena *ar
+
+ int
+ iommu_bind(struct pci_iommu_arena *arena, long pg_start, long pg_count,
+- unsigned long *physaddrs)
++ struct page **pages)
+ {
+ unsigned long flags;
+ unsigned long *ptes;
+@@ -900,7 +900,7 @@ iommu_bind(struct pci_iommu_arena *arena
+ }
+
+ for(i = 0, j = pg_start; i < pg_count; i++, j++)
+- ptes[j] = mk_iommu_pte(physaddrs[i]);
++ ptes[j] = mk_iommu_pte(page_to_phys(pages[i]));
+
+ spin_unlock_irqrestore(&arena->lock, flags);
+
--- /dev/null
+From fe9f6342c86292aee1941447f22dc5470735e5a1 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@googlemail.com>
+Date: Thu, 17 Sep 2009 13:46:53 +0200
+Subject: ar9170usb: add usbid for TP-Link TL-WN821N v2
+
+From: Christian Lamparter <chunkeey@googlemail.com>
+
+commit fe9f6342c86292aee1941447f22dc5470735e5a1 upstream.
+
+This patch adds the usbid for TP-Link TL-WN821N v2.
+
+Reported-by: Fabian Lenz <lenz_fabian@yahoo.de>
+Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ar9170/usb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/ath/ar9170/usb.c
++++ b/drivers/net/wireless/ath/ar9170/usb.c
+@@ -64,6 +64,8 @@ static struct usb_device_id ar9170_usb_i
+ { USB_DEVICE(0x0cf3, 0x9170) },
+ /* Atheros TG121N */
+ { USB_DEVICE(0x0cf3, 0x1001) },
++ /* TP-Link TL-WN821N v2 */
++ { USB_DEVICE(0x0cf3, 0x1002) },
+ /* Cace Airpcap NX */
+ { USB_DEVICE(0xcace, 0x0300) },
+ /* D-Link DWA 160A */
--- /dev/null
+From 481a8199142c050b72bff8a1956a49fd0a75bbe0 Mon Sep 17 00:00:00 2001
+From: Oliver Hartkopp <oliver@hartkopp.net>
+Date: Tue, 15 Sep 2009 01:31:34 -0700
+Subject: can: fix NOHZ local_softirq_pending 08 warning
+
+From: Oliver Hartkopp <oliver@hartkopp.net>
+
+commit 481a8199142c050b72bff8a1956a49fd0a75bbe0 upstream.
+
+When using nanosleep() in an userspace application we get a ratelimit warning
+
+NOHZ: local_softirq_pending 08
+
+for 10 times.
+
+The echo of CAN frames is done from process context and softirq context only.
+Therefore the usage of netif_rx() was wrong (for years).
+
+This patch replaces netif_rx() with netif_rx_ni() which has to be used from
+process/softirq context. It also adds a missing comment that can_send() must
+no be used from hardirq context.
+
+Signed-off-by: Oliver Hartkopp <oliver@hartkopp.net>
+Signed-off-by: Urs Thuermann <urs@isnogud.escape.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/can/vcan.c | 2 +-
+ net/can/af_can.c | 4 +++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/can/vcan.c
++++ b/drivers/net/can/vcan.c
+@@ -80,7 +80,7 @@ static void vcan_rx(struct sk_buff *skb,
+ skb->dev = dev;
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
+
+- netif_rx(skb);
++ netif_rx_ni(skb);
+ }
+
+ static int vcan_tx(struct sk_buff *skb, struct net_device *dev)
+--- a/net/can/af_can.c
++++ b/net/can/af_can.c
+@@ -199,6 +199,8 @@ static int can_create(struct net *net, s
+ * @skb: pointer to socket buffer with CAN frame in data section
+ * @loop: loopback for listeners on local CAN sockets (recommended default!)
+ *
++ * Due to the loopback this routine must not be called from hardirq context.
++ *
+ * Return:
+ * 0 on success
+ * -ENETDOWN when the selected interface is down
+@@ -278,7 +280,7 @@ int can_send(struct sk_buff *skb, int lo
+ }
+
+ if (newskb)
+- netif_rx(newskb);
++ netif_rx_ni(newskb);
+
+ /* update statistics */
+ can_stats.tx_frames++;
--- /dev/null
+From 9b80fee149a875a6292b2556ab2c64dc7ab7d6f5 Mon Sep 17 00:00:00 2001
+From: Alan Cox <alan@linux.intel.com>
+Date: Sat, 19 Sep 2009 13:13:23 -0700
+Subject: cdc_acm: Fix to use modern speed interfaces
+
+From: Alan Cox <alan@linux.intel.com>
+
+commit 9b80fee149a875a6292b2556ab2c64dc7ab7d6f5 upstream.
+
+This changed in 2006 so its about time the ACM driver caught up
+
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/class/cdc-acm.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -860,10 +860,7 @@ static void acm_tty_set_termios(struct t
+ if (!ACM_READY(acm))
+ return;
+
+- /* FIXME: Needs to support the tty_baud interface */
+- /* FIXME: Broken on sparc */
+- newline.dwDTERate = cpu_to_le32p(acm_tty_speed +
+- (termios->c_cflag & CBAUD & ~CBAUDEX) + (termios->c_cflag & CBAUDEX ? 15 : 0));
++ newline.dwDTERate = cpu_to_le32(tty_get_baud_rate(tty));
+ newline.bCharFormat = termios->c_cflag & CSTOPB ? 2 : 0;
+ newline.bParityType = termios->c_cflag & PARENB ?
+ (termios->c_cflag & PARODD ? 1 : 2) +
--- /dev/null
+From 00d3803b656a5f0935518d746f6bb27d5181d29d Mon Sep 17 00:00:00 2001
+From: Andrew Morton <akpm@linux-foundation.org>
+Date: Mon, 21 Sep 2009 17:01:07 -0700
+Subject: drivers/mfd/ab3100-core.c: fix powerpc build error
+
+From: Andrew Morton <akpm@linux-foundation.org>
+
+commit 00d3803b656a5f0935518d746f6bb27d5181d29d upstream.
+
+drivers/mfd/ab3100-core.c:647: error: ab3100_init_settings causes a section type conflict
+
+Cc: Anton Vorontsov <avorontsov@ru.mvista.com>
+Cc: Samuel Ortiz <sameo@linux.intel.com>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mfd/ab3100-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mfd/ab3100-core.c
++++ b/drivers/mfd/ab3100-core.c
+@@ -643,7 +643,7 @@ struct ab3100_init_setting {
+ u8 setting;
+ };
+
+-static const struct ab3100_init_setting __initdata
++static const struct ab3100_init_setting __initconst
+ ab3100_init_settings[] = {
+ {
+ .abreg = AB3100_MCA,
--- /dev/null
+From 4960aaca14010b9ff92e5726dd178cbd6805d412 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Mon, 14 Sep 2009 16:50:25 +0100
+Subject: drm/i915: Add buffer to inactive list immediately during fault
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 4960aaca14010b9ff92e5726dd178cbd6805d412 upstream.
+
+If we failed to set the domain, the buffer was no longer being tracked
+on any list.
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_gem.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -1155,14 +1155,13 @@ int i915_gem_fault(struct vm_area_struct
+ mutex_unlock(&dev->struct_mutex);
+ return VM_FAULT_SIGBUS;
+ }
++ list_add_tail(&obj_priv->list, &dev_priv->mm.inactive_list);
+
+ ret = i915_gem_object_set_to_gtt_domain(obj, write);
+ if (ret) {
+ mutex_unlock(&dev->struct_mutex);
+ return VM_FAULT_SIGBUS;
+ }
+-
+- list_add_tail(&obj_priv->list, &dev_priv->mm.inactive_list);
+ }
+
+ /* Need a new fence register? */
--- /dev/null
+From cd0b9fb400ba775737bdc3874c4cbee4047e66d8 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Tue, 15 Sep 2009 23:23:18 +0100
+Subject: drm/i915: Check that the relocation points to within the target
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit cd0b9fb400ba775737bdc3874c4cbee4047e66d8 upstream.
+
+Eric noted a potential concern with the low bits not being strictly used
+as part of the absolute offset (instead part of the command stream to the
+GPU), but in practice that should not be an issue.
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Tested-by: Andy Whitcroft <apw@canonical.com>
+Cc: Eric Anholt <eric@anholt.net>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_gem.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -3006,6 +3006,16 @@ i915_gem_object_pin_and_relocate(struct
+ return -EINVAL;
+ }
+
++ if (reloc->delta >= target_obj->size) {
++ DRM_ERROR("Relocation beyond target object bounds: "
++ "obj %p target %d delta %d size %d.\n",
++ obj, reloc->target_handle,
++ (int) reloc->delta, (int) target_obj->size);
++ drm_gem_object_unreference(target_obj);
++ i915_gem_object_unpin(obj);
++ return -EINVAL;
++ }
++
+ if (reloc->write_domain & I915_GEM_DOMAIN_CPU ||
+ reloc->read_domains & I915_GEM_DOMAIN_CPU) {
+ DRM_ERROR("reloc with read/write CPU domains: "
--- /dev/null
+From 8dd81a381e8886129c0923f1fe22ff5ca36ae8da Mon Sep 17 00:00:00 2001
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+Date: Sat, 19 Sep 2009 14:54:09 +0800
+Subject: drm/i915: Fix LVDS panel fitting on Arrandale
+
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+
+commit 8dd81a381e8886129c0923f1fe22ff5ca36ae8da upstream.
+
+Arrandale has new window based method for panel fitting.
+This one enables full screen aspect scaling on LVDS. It fixes
+standard mode display failure on LVDS for Arrandale.
+
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_reg.h | 2 ++
+ drivers/gpu/drm/i915/intel_display.c | 14 ++++++++++++++
+ drivers/gpu/drm/i915/intel_lvds.c | 11 ++++++++---
+ 3 files changed, 24 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -1867,6 +1867,8 @@
+ #define PF_ENABLE (1<<31)
+ #define PFA_WIN_SZ 0x68074
+ #define PFB_WIN_SZ 0x68874
++#define PFA_WIN_POS 0x68070
++#define PFB_WIN_POS 0x68870
+
+ /* legacy palette */
+ #define LGC_PALETTE_A 0x4a000
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -1154,6 +1154,7 @@ static void igdng_crtc_dpms(struct drm_c
+ int transconf_reg = (pipe == 0) ? TRANSACONF : TRANSBCONF;
+ int pf_ctl_reg = (pipe == 0) ? PFA_CTL_1 : PFB_CTL_1;
+ int pf_win_size = (pipe == 0) ? PFA_WIN_SZ : PFB_WIN_SZ;
++ int pf_win_pos = (pipe == 0) ? PFA_WIN_POS : PFB_WIN_POS;
+ int cpu_htot_reg = (pipe == 0) ? HTOTAL_A : HTOTAL_B;
+ int cpu_hblank_reg = (pipe == 0) ? HBLANK_A : HBLANK_B;
+ int cpu_hsync_reg = (pipe == 0) ? HSYNC_A : HSYNC_B;
+@@ -1205,6 +1206,19 @@ static void igdng_crtc_dpms(struct drm_c
+ }
+ }
+
++ /* Enable panel fitting for LVDS */
++ if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) {
++ temp = I915_READ(pf_ctl_reg);
++ I915_WRITE(pf_ctl_reg, temp | PF_ENABLE);
++
++ /* currently full aspect */
++ I915_WRITE(pf_win_pos, 0);
++
++ I915_WRITE(pf_win_size,
++ (dev_priv->panel_fixed_mode->hdisplay << 16) |
++ (dev_priv->panel_fixed_mode->vdisplay));
++ }
++
+ /* Enable CPU pipe */
+ temp = I915_READ(pipeconf_reg);
+ if ((temp & PIPEACONF_ENABLE) == 0) {
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -305,6 +305,10 @@ static bool intel_lvds_mode_fixup(struct
+ goto out;
+ }
+
++ /* full screen scale for now */
++ if (IS_IGDNG(dev))
++ goto out;
++
+ /* 965+ wants fuzzy fitting */
+ if (IS_I965G(dev))
+ pfit_control |= (intel_crtc->pipe << PFIT_PIPE_SHIFT) |
+@@ -332,8 +336,10 @@ static bool intel_lvds_mode_fixup(struct
+ * to register description and PRM.
+ * Change the value here to see the borders for debugging
+ */
+- I915_WRITE(BCLRPAT_A, 0);
+- I915_WRITE(BCLRPAT_B, 0);
++ if (!IS_IGDNG(dev)) {
++ I915_WRITE(BCLRPAT_A, 0);
++ I915_WRITE(BCLRPAT_B, 0);
++ }
+
+ switch (lvds_priv->fitting_mode) {
+ case DRM_MODE_SCALE_NO_SCALE:
+@@ -582,7 +588,6 @@ static void intel_lvds_mode_set(struct d
+ * settings.
+ */
+
+- /* No panel fitting yet, fixme */
+ if (IS_IGDNG(dev))
+ return;
+
--- /dev/null
+From 339e5a4c78041cd7b473ddf0a81eb06a131127bb Mon Sep 17 00:00:00 2001
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+Date: Sat, 19 Sep 2009 14:54:07 +0800
+Subject: drm/i915: Fix SSC frequence for IGDNG
+
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+
+commit 339e5a4c78041cd7b473ddf0a81eb06a131127bb upstream.
+
+IGDNG LVDS SSC uses 120Mhz freq. This fixes one
+1600x900 LVDS panel black issue on IGDNG with SSC enabled.
+
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_bios.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/i915/intel_bios.c
++++ b/drivers/gpu/drm/i915/intel_bios.c
+@@ -217,6 +217,9 @@ parse_general_features(struct drm_i915_p
+ if (IS_I85X(dev_priv->dev))
+ dev_priv->lvds_ssc_freq =
+ general->ssc_freq ? 66 : 48;
++ else if (IS_IGDNG(dev_priv->dev))
++ dev_priv->lvds_ssc_freq =
++ general->ssc_freq ? 100 : 120;
+ else
+ dev_priv->lvds_ssc_freq =
+ general->ssc_freq ? 100 : 96;
--- /dev/null
+From 553bd149bb2de7848b2b84642876f27202421368 Mon Sep 17 00:00:00 2001
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+Date: Wed, 2 Sep 2009 10:57:52 +0800
+Subject: drm/i915: fix tiling on IGDNG
+
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+
+commit 553bd149bb2de7848b2b84642876f27202421368 upstream.
+
+It seems that on IGDNG the same swizzling setup always applys.
+And front buffer tiling needs to set address swizzle in display
+arb control too.
+
+Fix plane tricle feed setting in v1 which should be disable bit,
+and always setup address swizzle to let hardware care for buffer
+tiling in all cases.
+
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_gem_tiling.c | 15 +++++++--------
+ drivers/gpu/drm/i915/i915_reg.h | 4 ++++
+ drivers/gpu/drm/i915/intel_display.c | 10 ++++++++++
+ 3 files changed, 21 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
++++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
+@@ -234,7 +234,13 @@ i915_gem_detect_bit_6_swizzle(struct drm
+ uint32_t swizzle_y = I915_BIT_6_SWIZZLE_UNKNOWN;
+ bool need_disable;
+
+- if (!IS_I9XX(dev)) {
++ if (IS_IGDNG(dev)) {
++ /* On IGDNG whatever DRAM config, GPU always do
++ * same swizzling setup.
++ */
++ swizzle_x = I915_BIT_6_SWIZZLE_9_10;
++ swizzle_y = I915_BIT_6_SWIZZLE_9;
++ } else if (!IS_I9XX(dev)) {
+ /* As far as we know, the 865 doesn't have these bit 6
+ * swizzling issues.
+ */
+@@ -317,13 +323,6 @@ i915_gem_detect_bit_6_swizzle(struct drm
+ }
+ }
+
+- /* FIXME: check with memory config on IGDNG */
+- if (IS_IGDNG(dev)) {
+- DRM_ERROR("disable tiling on IGDNG...\n");
+- swizzle_x = I915_BIT_6_SWIZZLE_UNKNOWN;
+- swizzle_y = I915_BIT_6_SWIZZLE_UNKNOWN;
+- }
+-
+ dev_priv->mm.bit_6_swizzle_x = swizzle_x;
+ dev_priv->mm.bit_6_swizzle_y = swizzle_y;
+ }
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -1733,6 +1733,7 @@
+ #define DISPPLANE_NO_LINE_DOUBLE 0
+ #define DISPPLANE_STEREO_POLARITY_FIRST 0
+ #define DISPPLANE_STEREO_POLARITY_SECOND (1<<18)
++#define DISPPLANE_TRICKLE_FEED_DISABLE (1<<14) /* IGDNG */
+ #define DISPPLANE_TILED (1<<10)
+ #define DSPAADDR 0x70184
+ #define DSPASTRIDE 0x70188
+@@ -1915,6 +1916,9 @@
+ #define GTIIR 0x44018
+ #define GTIER 0x4401c
+
++#define DISP_ARB_CTL 0x45000
++#define DISP_TILE_SURFACE_SWIZZLING (1<<13)
++
+ /* PCH */
+
+ /* south display engine interrupt */
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -1008,6 +1008,10 @@ intel_pipe_set_base(struct drm_crtc *crt
+ dspcntr &= ~DISPPLANE_TILED;
+ }
+
++ if (IS_IGDNG(dev))
++ /* must disable */
++ dspcntr |= DISPPLANE_TRICKLE_FEED_DISABLE;
++
+ I915_WRITE(dspcntr_reg, dspcntr);
+
+ Start = obj_priv->gtt_offset;
+@@ -2637,6 +2641,12 @@ static int intel_crtc_mode_set(struct dr
+
+ intel_wait_for_vblank(dev);
+
++ if (IS_IGDNG(dev)) {
++ /* enable address swizzle for tiling buffer */
++ temp = I915_READ(DISP_ARB_CTL);
++ I915_WRITE(DISP_ARB_CTL, temp | DISP_TILE_SURFACE_SWIZZLING);
++ }
++
+ I915_WRITE(dspcntr_reg, dspcntr);
+
+ /* Flush the plane changes */
--- /dev/null
+From b09aea7fb38f328c02e9f9b79617cabed02455e4 Mon Sep 17 00:00:00 2001
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+Date: Sat, 19 Sep 2009 14:54:06 +0800
+Subject: drm/i915: Fix typo for wrong LVDS clock setting on IGDNG
+
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+
+commit b09aea7fb38f328c02e9f9b79617cabed02455e4 upstream.
+
+New register for PCH LVDS on IGDNG should be used.
+This is a copy-n-paste typo. This fixes possible dual
+channel LVDS panel failure on IGDNG.
+
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_display.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -818,7 +818,7 @@ intel_igdng_find_best_PLL(const intel_li
+ refclk, best_clock);
+
+ if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) {
+- if ((I915_READ(LVDS) & LVDS_CLKB_POWER_MASK) ==
++ if ((I915_READ(PCH_LVDS) & LVDS_CLKB_POWER_MASK) ==
+ LVDS_CLKB_POWER_UP)
+ clock.p2 = limit->p2.p2_fast;
+ else
--- /dev/null
+From 7e61615857c6fb3afbcb43f5c4e97511a923f5a8 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Thu, 10 Sep 2009 08:53:04 +0100
+Subject: drm/i915: Only destroy a constructed mmap offset
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 7e61615857c6fb3afbcb43f5c4e97511a923f5a8 upstream.
+
+drm_ht_remove_item() does not handle removing an absent item and the hlist
+in particular is incorrectly initialised. The easy remedy is simply skip
+calling i915_gem_free_mmap_offset() unless we have actually created the
+offset and associated ht entry.
+
+This also fixes the mishandling of a partially constructed offset which
+leaves pointers initialized after freeing them along the
+i915_gem_create_mmap_offset() error paths.
+
+In particular this should fix the oops found here:
+https://bugs.launchpad.net/ubuntu/+source/xserver-xorg-video-intel/+bug/415357/comments/8
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+
+---
+ drivers/gpu/drm/i915/i915_gem.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -3837,7 +3837,8 @@ void i915_gem_free_object(struct drm_gem
+
+ i915_gem_object_unbind(obj);
+
+- i915_gem_free_mmap_offset(obj);
++ if (obj_priv->mmap_offset)
++ i915_gem_free_mmap_offset(obj);
+
+ kfree(obj_priv->page_cpu_valid);
+ kfree(obj_priv->bit_17);
--- /dev/null
+From d660467c3ff2a0b7413e1b7a51452b34ffb49e5f Mon Sep 17 00:00:00 2001
+From: Jesse Barnes <jbarnes@virtuousgeek.org>
+Date: Fri, 11 Sep 2009 12:25:56 -0700
+Subject: drm/i915: prevent FIFO calculation overflows on 32 bits with high dotclocks
+
+From: Jesse Barnes <jbarnes@virtuousgeek.org>
+
+commit d660467c3ff2a0b7413e1b7a51452b34ffb49e5f upstream.
+
+A very high dotclock (e.g. 229500kHz as reported by Anton) can cause
+the entries_required variable to overflow, potentially leading to a
+FIFO watermark value that's too low to support the given mode. Split
+the division across the calculation to avoid this.
+
+Reported-by: Anton Khirnov <wyskas@gmail.com>
+Tested-by: Anton Khirnov <wyskas@gmail.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_display.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -1858,7 +1858,14 @@ static unsigned long intel_calculate_wm(
+ {
+ long entries_required, wm_size;
+
+- entries_required = (clock_in_khz * pixel_size * latency_ns) / 1000000;
++ /*
++ * Note: we need to make sure we don't overflow for various clock &
++ * latency values.
++ * clocks go from a few thousand to several hundred thousand.
++ * latency is usually a few thousand
++ */
++ entries_required = ((clock_in_khz / 1000) * pixel_size * latency_ns) /
++ 1000;
+ entries_required /= wm->cacheline_size;
+
+ DRM_DEBUG("FIFO entries required for mode: %d\n", entries_required);
--- /dev/null
+From 730915d65f9e763de9dc26c5f1b8abaae775b243 Mon Sep 17 00:00:00 2001
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+Date: Sat, 19 Sep 2009 14:54:08 +0800
+Subject: drm/i915: Remove DAC disable in CRT force detect on IGDNG
+
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+
+commit 730915d65f9e763de9dc26c5f1b8abaae775b243 upstream.
+
+This is not required on newer stepping hardware to get
+reliable force detect status. Removing this fixes screen
+blank flicker in CRT detect on IGDNG.
+
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_crt.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_crt.c
++++ b/drivers/gpu/drm/i915/intel_crt.c
+@@ -151,13 +151,10 @@ static bool intel_igdng_crt_detect_hotpl
+ {
+ struct drm_device *dev = connector->dev;
+ struct drm_i915_private *dev_priv = dev->dev_private;
+- u32 adpa, temp;
++ u32 adpa;
+ bool ret;
+
+- temp = adpa = I915_READ(PCH_ADPA);
+-
+- adpa &= ~ADPA_DAC_ENABLE;
+- I915_WRITE(PCH_ADPA, adpa);
++ adpa = I915_READ(PCH_ADPA);
+
+ adpa &= ~ADPA_CRT_HOTPLUG_MASK;
+
+@@ -184,8 +181,6 @@ static bool intel_igdng_crt_detect_hotpl
+ else
+ ret = false;
+
+- /* restore origin register */
+- I915_WRITE(PCH_ADPA, temp);
+ return ret;
+ }
+
--- /dev/null
+From b7e53aba2f0e6abf23e3f07b38b241145c33a005 Mon Sep 17 00:00:00 2001
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+Date: Mon, 14 Sep 2009 10:47:07 +0800
+Subject: drm/i915: remove restore in resume
+
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+
+commit b7e53aba2f0e6abf23e3f07b38b241145c33a005 upstream.
+
+Don't need extra config restore like for intel_agp, which
+might cause resume hang issue found by Alan on 845G.
+
+Cc: Stable Team <stable@kernel.org>
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_drv.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -94,8 +94,6 @@ static int i915_resume(struct drm_device
+ struct drm_i915_private *dev_priv = dev->dev_private;
+ int ret = 0;
+
+- pci_set_power_state(dev->pdev, PCI_D0);
+- pci_restore_state(dev->pdev);
+ if (pci_enable_device(dev->pdev))
+ return -1;
+ pci_set_master(dev->pdev);
--- /dev/null
+From 57cdaf90f5f607eb029356074fefb66c9b1c0659 Mon Sep 17 00:00:00 2001
+From: Keith Packard <keithp@keithp.com>
+Date: Fri, 4 Sep 2009 13:07:54 +0800
+Subject: drm/I915: Use the CRT DDC to get the EDID for DVI-connector on Mac
+
+From: Keith Packard <keithp@keithp.com>
+
+commit 57cdaf90f5f607eb029356074fefb66c9b1c0659 upstream.
+
+mac Mini's have a single DDC line on the DVI connector, shared between the
+analog link and the digital link. So, if DDC isn't detected on GPIOE (the
+usual SDVO DDC link), try GPIOA (the usual VGA DDC link) when there isn't a
+VGA monitor connected.
+
+Signed-off-by: Keith Packard <keithp@keithp.com>
+Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_sdvo.c | 96 +++++++++++++++++++++++++++++---------
+ 1 file changed, 74 insertions(+), 22 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_sdvo.c
++++ b/drivers/gpu/drm/i915/intel_sdvo.c
+@@ -114,6 +114,9 @@ struct intel_sdvo_priv {
+ /* DDC bus used by this SDVO output */
+ uint8_t ddc_bus;
+
++ /* Mac mini hack -- use the same DDC as the analog connector */
++ struct i2c_adapter *analog_ddc_bus;
++
+ int save_sdvo_mult;
+ u16 save_active_outputs;
+ struct intel_sdvo_dtd save_input_dtd_1, save_input_dtd_2;
+@@ -1478,6 +1481,36 @@ intel_sdvo_multifunc_encoder(struct inte
+ return (caps > 1);
+ }
+
++static struct drm_connector *
++intel_find_analog_connector(struct drm_device *dev)
++{
++ struct drm_connector *connector;
++ struct intel_output *intel_output;
++
++ list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
++ intel_output = to_intel_output(connector);
++ if (intel_output->type == INTEL_OUTPUT_ANALOG)
++ return connector;
++ }
++ return NULL;
++}
++
++static int
++intel_analog_is_connected(struct drm_device *dev)
++{
++ struct drm_connector *analog_connector;
++ analog_connector = intel_find_analog_connector(dev);
++
++ if (!analog_connector)
++ return false;
++
++ if (analog_connector->funcs->detect(analog_connector) ==
++ connector_status_disconnected)
++ return false;
++
++ return true;
++}
++
+ enum drm_connector_status
+ intel_sdvo_hdmi_sink_detect(struct drm_connector *connector, u16 response)
+ {
+@@ -1488,6 +1521,15 @@ intel_sdvo_hdmi_sink_detect(struct drm_c
+
+ edid = drm_get_edid(&intel_output->base,
+ intel_output->ddc_bus);
++
++ /* when there is no edid and no monitor is connected with VGA
++ * port, try to use the CRT ddc to read the EDID for DVI-connector
++ */
++ if (edid == NULL &&
++ sdvo_priv->analog_ddc_bus &&
++ !intel_analog_is_connected(intel_output->base.dev))
++ edid = drm_get_edid(&intel_output->base,
++ sdvo_priv->analog_ddc_bus);
+ if (edid != NULL) {
+ /* Don't report the output as connected if it's a DVI-I
+ * connector with a non-digital EDID coming out.
+@@ -1540,31 +1582,32 @@ static enum drm_connector_status intel_s
+ static void intel_sdvo_get_ddc_modes(struct drm_connector *connector)
+ {
+ struct intel_output *intel_output = to_intel_output(connector);
++ struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
++ int num_modes;
+
+ /* set the bus switch and get the modes */
+- intel_ddc_get_modes(intel_output);
++ num_modes = intel_ddc_get_modes(intel_output);
+
+-#if 0
+- struct drm_device *dev = encoder->dev;
+- struct drm_i915_private *dev_priv = dev->dev_private;
+- /* Mac mini hack. On this device, I get DDC through the analog, which
+- * load-detects as disconnected. I fail to DDC through the SDVO DDC,
+- * but it does load-detect as connected. So, just steal the DDC bits
+- * from analog when we fail at finding it the right way.
++ /*
++ * Mac mini hack. On this device, the DVI-I connector shares one DDC
++ * link between analog and digital outputs. So, if the regular SDVO
++ * DDC fails, check to see if the analog output is disconnected, in
++ * which case we'll look there for the digital DDC data.
+ */
+- crt = xf86_config->output[0];
+- intel_output = crt->driver_private;
+- if (intel_output->type == I830_OUTPUT_ANALOG &&
+- crt->funcs->detect(crt) == XF86OutputStatusDisconnected) {
+- I830I2CInit(pScrn, &intel_output->pDDCBus, GPIOA, "CRTDDC_A");
+- edid_mon = xf86OutputGetEDID(crt, intel_output->pDDCBus);
+- xf86DestroyI2CBusRec(intel_output->pDDCBus, true, true);
+- }
+- if (edid_mon) {
+- xf86OutputSetEDID(output, edid_mon);
+- modes = xf86OutputGetEDIDModes(output);
++ if (num_modes == 0 &&
++ sdvo_priv->analog_ddc_bus &&
++ !intel_analog_is_connected(intel_output->base.dev)) {
++ struct i2c_adapter *digital_ddc_bus;
++
++ /* Switch to the analog ddc bus and try that
++ */
++ digital_ddc_bus = intel_output->ddc_bus;
++ intel_output->ddc_bus = sdvo_priv->analog_ddc_bus;
++
++ (void) intel_ddc_get_modes(intel_output);
++
++ intel_output->ddc_bus = digital_ddc_bus;
+ }
+-#endif
+ }
+
+ /**
+@@ -1748,6 +1791,8 @@ static void intel_sdvo_destroy(struct dr
+ intel_i2c_destroy(intel_output->i2c_bus);
+ if (intel_output->ddc_bus)
+ intel_i2c_destroy(intel_output->ddc_bus);
++ if (sdvo_priv->analog_ddc_bus)
++ intel_i2c_destroy(sdvo_priv->analog_ddc_bus);
+
+ if (sdvo_priv->sdvo_lvds_fixed_mode != NULL)
+ drm_mode_destroy(connector->dev,
+@@ -2074,10 +2119,15 @@ bool intel_sdvo_init(struct drm_device *
+ }
+
+ /* setup the DDC bus. */
+- if (output_device == SDVOB)
++ if (output_device == SDVOB) {
+ intel_output->ddc_bus = intel_i2c_create(dev, GPIOE, "SDVOB DDC BUS");
+- else
++ sdvo_priv->analog_ddc_bus = intel_i2c_create(dev, GPIOA,
++ "SDVOB/VGA DDC BUS");
++ } else {
+ intel_output->ddc_bus = intel_i2c_create(dev, GPIOE, "SDVOC DDC BUS");
++ sdvo_priv->analog_ddc_bus = intel_i2c_create(dev, GPIOA,
++ "SDVOC/VGA DDC BUS");
++ }
+
+ if (intel_output->ddc_bus == NULL)
+ goto err_i2c;
+@@ -2143,6 +2193,8 @@ bool intel_sdvo_init(struct drm_device *
+ return true;
+
+ err_i2c:
++ if (sdvo_priv->analog_ddc_bus != NULL)
++ intel_i2c_destroy(sdvo_priv->analog_ddc_bus);
+ if (intel_output->ddc_bus != NULL)
+ intel_i2c_destroy(intel_output->ddc_bus);
+ if (intel_output->i2c_bus != NULL)
--- /dev/null
+From ac22ba23b659e34a5961aec8c945608e471b0d5b Mon Sep 17 00:00:00 2001
+From: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Date: Wed, 12 Aug 2009 01:06:54 -0500
+Subject: eCryptfs: Check for O_RDONLY lower inodes when opening lower files
+
+From: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+
+commit ac22ba23b659e34a5961aec8c945608e471b0d5b upstream.
+
+If the lower inode is read-only, don't attempt to open the lower file
+read/write and don't hand off the open request to the privileged
+eCryptfs kthread for opening it read/write. Instead, only try an
+unprivileged, read-only open of the file and give up if that fails.
+This patch fixes an oops when eCryptfs is mounted on top of a read-only
+mount.
+
+Acked-by: Serge Hallyn <serue@us.ibm.com>
+Cc: Eric Sandeen <esandeen@redhat.com>
+Cc: Dave Kleikamp <shaggy@linux.vnet.ibm.com>
+Cc: ecryptfs-devel@lists.launchpad.net
+Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ecryptfs/kthread.c | 24 ++++++++----------------
+ fs/ecryptfs/main.c | 3 +--
+ 2 files changed, 9 insertions(+), 18 deletions(-)
+
+--- a/fs/ecryptfs/kthread.c
++++ b/fs/ecryptfs/kthread.c
+@@ -136,6 +136,7 @@ int ecryptfs_privileged_open(struct file
+ const struct cred *cred)
+ {
+ struct ecryptfs_open_req *req;
++ int flags = O_LARGEFILE;
+ int rc = 0;
+
+ /* Corresponding dput() and mntput() are done when the
+@@ -143,10 +144,14 @@ int ecryptfs_privileged_open(struct file
+ * destroyed. */
+ dget(lower_dentry);
+ mntget(lower_mnt);
+- (*lower_file) = dentry_open(lower_dentry, lower_mnt,
+- (O_RDWR | O_LARGEFILE), cred);
++ flags |= IS_RDONLY(lower_dentry->d_inode) ? O_RDONLY : O_RDWR;
++ (*lower_file) = dentry_open(lower_dentry, lower_mnt, flags, cred);
+ if (!IS_ERR(*lower_file))
+ goto out;
++ if (flags & O_RDONLY) {
++ rc = PTR_ERR((*lower_file));
++ goto out;
++ }
+ req = kmem_cache_alloc(ecryptfs_open_req_cache, GFP_KERNEL);
+ if (!req) {
+ rc = -ENOMEM;
+@@ -180,21 +185,8 @@ int ecryptfs_privileged_open(struct file
+ __func__);
+ goto out_unlock;
+ }
+- if (IS_ERR(*req->lower_file)) {
++ if (IS_ERR(*req->lower_file))
+ rc = PTR_ERR(*req->lower_file);
+- dget(lower_dentry);
+- mntget(lower_mnt);
+- (*lower_file) = dentry_open(lower_dentry, lower_mnt,
+- (O_RDONLY | O_LARGEFILE), cred);
+- if (IS_ERR(*lower_file)) {
+- rc = PTR_ERR(*req->lower_file);
+- (*lower_file) = NULL;
+- printk(KERN_WARNING "%s: Error attempting privileged "
+- "open of lower file with either RW or RO "
+- "perms; rc = [%d]. Giving up.\n",
+- __func__, rc);
+- }
+- }
+ out_unlock:
+ mutex_unlock(&req->mux);
+ out_free:
+--- a/fs/ecryptfs/main.c
++++ b/fs/ecryptfs/main.c
+@@ -129,11 +129,10 @@ int ecryptfs_init_persistent_file(struct
+ lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry);
+ rc = ecryptfs_privileged_open(&inode_info->lower_file,
+ lower_dentry, lower_mnt, cred);
+- if (rc || IS_ERR(inode_info->lower_file)) {
++ if (rc) {
+ printk(KERN_ERR "Error opening lower persistent file "
+ "for lower_dentry [0x%p] and lower_mnt [0x%p]; "
+ "rc = [%d]\n", lower_dentry, lower_mnt, rc);
+- rc = PTR_ERR(inode_info->lower_file);
+ inode_info->lower_file = NULL;
+ }
+ }
--- /dev/null
+From df6ad33ba1b9846bd5f0e2b9016c30c20bc2d948 Mon Sep 17 00:00:00 2001
+From: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Date: Fri, 21 Aug 2009 04:27:46 -0500
+Subject: eCryptfs: Filename encryption only supports password auth tokens
+
+From: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+
+commit df6ad33ba1b9846bd5f0e2b9016c30c20bc2d948 upstream.
+
+Returns -ENOTSUPP when attempting to use filename encryption with
+something other than a password authentication token, such as a private
+token from openssl. Using filename encryption with a userspace eCryptfs
+key module is a future goal. Until then, this patch handles the
+situation a little better than simply using a BUG_ON().
+
+Acked-by: Serge Hallyn <serue@us.ibm.com>
+Cc: ecryptfs-devel@lists.launchpad.net
+Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ecryptfs/crypto.c | 4 ++--
+ fs/ecryptfs/keystore.c | 14 ++++++++++++--
+ 2 files changed, 14 insertions(+), 4 deletions(-)
+
+--- a/fs/ecryptfs/crypto.c
++++ b/fs/ecryptfs/crypto.c
+@@ -1703,7 +1703,7 @@ ecryptfs_encrypt_filename(struct ecryptf
+ } else {
+ printk(KERN_ERR "%s: No support for requested filename "
+ "encryption method in this release\n", __func__);
+- rc = -ENOTSUPP;
++ rc = -EOPNOTSUPP;
+ goto out;
+ }
+ out:
+@@ -2167,7 +2167,7 @@ int ecryptfs_encrypt_and_encode_filename
+ (*encoded_name)[(*encoded_name_size)] = '\0';
+ (*encoded_name_size)++;
+ } else {
+- rc = -ENOTSUPP;
++ rc = -EOPNOTSUPP;
+ }
+ if (rc) {
+ printk(KERN_ERR "%s: Error attempting to encode "
+--- a/fs/ecryptfs/keystore.c
++++ b/fs/ecryptfs/keystore.c
+@@ -612,7 +612,12 @@ ecryptfs_write_tag_70_packet(char *dest,
+ }
+ /* TODO: Support other key modules than passphrase for
+ * filename encryption */
+- BUG_ON(s->auth_tok->token_type != ECRYPTFS_PASSWORD);
++ if (s->auth_tok->token_type != ECRYPTFS_PASSWORD) {
++ rc = -EOPNOTSUPP;
++ printk(KERN_INFO "%s: Filename encryption only supports "
++ "password tokens\n", __func__);
++ goto out_free_unlock;
++ }
+ sg_init_one(
+ &s->hash_sg,
+ (u8 *)s->auth_tok->token.password.session_key_encryption_key,
+@@ -910,7 +915,12 @@ ecryptfs_parse_tag_70_packet(char **file
+ }
+ /* TODO: Support other key modules than passphrase for
+ * filename encryption */
+- BUG_ON(s->auth_tok->token_type != ECRYPTFS_PASSWORD);
++ if (s->auth_tok->token_type != ECRYPTFS_PASSWORD) {
++ rc = -EOPNOTSUPP;
++ printk(KERN_INFO "%s: Filename encryption only supports "
++ "password tokens\n", __func__);
++ goto out_free_unlock;
++ }
+ rc = crypto_blkcipher_setkey(
+ s->desc.tfm,
+ s->auth_tok->token.password.session_key_encryption_key,
--- /dev/null
+From b0105eaefa7cce8f4a941d0fc6354b250d30e745 Mon Sep 17 00:00:00 2001
+From: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Date: Tue, 11 Aug 2009 00:36:32 -0500
+Subject: eCryptfs: Handle unrecognized tag 3 cipher codes
+
+From: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+
+commit b0105eaefa7cce8f4a941d0fc6354b250d30e745 upstream.
+
+Returns an error when an unrecognized cipher code is present in a tag 3
+packet or an ecryptfs_crypt_stat cannot be initialized. Also sets an
+crypt_stat->tfm error pointer to NULL to ensure that it will not be
+incorrectly freed in ecryptfs_destroy_crypt_stat().
+
+Acked-by: Serge Hallyn <serue@us.ibm.com>
+Cc: ecryptfs-devel@lists.launchpad.net
+Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ecryptfs/crypto.c | 1 +
+ fs/ecryptfs/keystore.c | 10 +++++++---
+ 2 files changed, 8 insertions(+), 3 deletions(-)
+
+--- a/fs/ecryptfs/crypto.c
++++ b/fs/ecryptfs/crypto.c
+@@ -797,6 +797,7 @@ int ecryptfs_init_crypt_ctx(struct ecryp
+ kfree(full_alg_name);
+ if (IS_ERR(crypt_stat->tfm)) {
+ rc = PTR_ERR(crypt_stat->tfm);
++ crypt_stat->tfm = NULL;
+ ecryptfs_printk(KERN_ERR, "cryptfs: init_crypt_ctx(): "
+ "Error initializing cipher [%s]\n",
+ crypt_stat->cipher);
+--- a/fs/ecryptfs/keystore.c
++++ b/fs/ecryptfs/keystore.c
+@@ -1316,8 +1316,10 @@ parse_tag_3_packet(struct ecryptfs_crypt
+ rc = -EINVAL;
+ goto out_free;
+ }
+- ecryptfs_cipher_code_to_string(crypt_stat->cipher,
+- (u16)data[(*packet_size)]);
++ rc = ecryptfs_cipher_code_to_string(crypt_stat->cipher,
++ (u16)data[(*packet_size)]);
++ if (rc)
++ goto out_free;
+ /* A little extra work to differentiate among the AES key
+ * sizes; see RFC2440 */
+ switch(data[(*packet_size)++]) {
+@@ -1328,7 +1330,9 @@ parse_tag_3_packet(struct ecryptfs_crypt
+ crypt_stat->key_size =
+ (*new_auth_tok)->session_key.encrypted_key_size;
+ }
+- ecryptfs_init_crypt_ctx(crypt_stat);
++ rc = ecryptfs_init_crypt_ctx(crypt_stat);
++ if (rc)
++ goto out_free;
+ if (unlikely(data[(*packet_size)++] != 0x03)) {
+ printk(KERN_WARNING "Only S2K ID 3 is currently supported\n");
+ rc = -ENOSYS;
--- /dev/null
+From 9c2d2056647790c5034d722bd24e9d913ebca73c Mon Sep 17 00:00:00 2001
+From: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Date: Tue, 22 Sep 2009 12:52:17 -0500
+Subject: eCryptfs: Prevent lower dentry from going negative during unlink
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+
+commit 9c2d2056647790c5034d722bd24e9d913ebca73c upstream.
+
+When calling vfs_unlink() on the lower dentry, d_delete() turns the
+dentry into a negative dentry when the d_count is 1. This eventually
+caused a NULL pointer deref when a read() or write() was done and the
+negative dentry's d_inode was dereferenced in
+ecryptfs_read_update_atime() or ecryptfs_getxattr().
+
+Placing mutt's tmpdir in an eCryptfs mount is what initially triggered
+the oops and I was able to reproduce it with the following sequence:
+
+open("/tmp/upper/foo", O_RDWR|O_CREAT|O_EXCL|O_NOFOLLOW, 0600) = 3
+link("/tmp/upper/foo", "/tmp/upper/bar") = 0
+unlink("/tmp/upper/foo") = 0
+open("/tmp/upper/bar", O_RDWR|O_CREAT|O_NOFOLLOW, 0600) = 4
+unlink("/tmp/upper/bar") = 0
+write(4, "eCryptfs test\n"..., 14 <unfinished ...>
++++ killed by SIGKILL +++
+
+https://bugs.launchpad.net/ecryptfs/+bug/387073
+
+Reported-by: Loïc Minier <loic.minier@canonical.com>
+Cc: Serge Hallyn <serue@us.ibm.com>
+Cc: Dave Kleikamp <shaggy@linux.vnet.ibm.com>
+Cc: ecryptfs-devel@lists.launchpad.net
+Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ecryptfs/inode.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/ecryptfs/inode.c
++++ b/fs/ecryptfs/inode.c
+@@ -476,6 +476,7 @@ static int ecryptfs_unlink(struct inode
+ struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir);
+ struct dentry *lower_dir_dentry;
+
++ dget(lower_dentry);
+ lower_dir_dentry = lock_parent(lower_dentry);
+ rc = vfs_unlink(lower_dir_inode, lower_dentry);
+ if (rc) {
+@@ -489,6 +490,7 @@ static int ecryptfs_unlink(struct inode
+ d_drop(dentry);
+ out_unlock:
+ unlock_dir(lower_dir_dentry);
++ dput(lower_dentry);
+ return rc;
+ }
+
--- /dev/null
+From 3891959846709a19f76628e33478cd85edb0e79f Mon Sep 17 00:00:00 2001
+From: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Date: Wed, 26 Aug 2009 01:54:56 -0500
+Subject: eCryptfs: Validate global auth tok keys
+
+From: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+
+commit 3891959846709a19f76628e33478cd85edb0e79f upstream.
+
+When searching through the global authentication tokens for a given key
+signature, verify that a matching key has not been revoked and has not
+expired. This allows the `keyctl revoke` command to be properly used on
+keys in use by eCryptfs.
+
+Acked-by: Serge Hallyn <serue@us.ibm.com>
+Cc: ecryptfs-devel@lists.launchpad.net
+Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ecryptfs/keystore.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/fs/ecryptfs/keystore.c
++++ b/fs/ecryptfs/keystore.c
+@@ -416,7 +416,9 @@ ecryptfs_find_global_auth_tok_for_sig(
+ &mount_crypt_stat->global_auth_tok_list,
+ mount_crypt_stat_list) {
+ if (memcmp(walker->sig, sig, ECRYPTFS_SIG_SIZE_HEX) == 0) {
+- (*global_auth_tok) = walker;
++ rc = key_validate(walker->global_auth_tok_key);
++ if (!rc)
++ (*global_auth_tok) = walker;
+ goto out;
+ }
+ }
--- /dev/null
+From 2ddce3fd0acbdc1be684fb5f919ae3d2e9518aac Mon Sep 17 00:00:00 2001
+From: Ian Armstrong <ian@iarmst.demon.co.uk>
+Date: Tue, 22 Sep 2009 16:47:52 -0700
+Subject: fbcon: only unbind from console if successfully registered
+
+From: Ian Armstrong <ian@iarmst.demon.co.uk>
+
+commit 2ddce3fd0acbdc1be684fb5f919ae3d2e9518aac upstream.
+
+Attempting to unload a framebuffer module calls unregister_framebuffer()
+which in turn gets fbcon to release it. If fbcon has no framebuffers
+linked to a console, it will also unbind itself from the console driver.
+However, if fbcon never registered itself as a console driver, the unbind
+will fail causing the framebuffer device entry to persist. In most cases
+this failure will result in an oops when attempting to access the now
+non-existent device.
+
+This patch ensures that the fbcon unbind request will succeed even if a
+bind was never done. It tracks if a successful bind ever occurred & will
+only attempt to unbind if needed. If there never was a bind, it simply
+returns with no error.
+
+Signed-off-by: Ian Armstrong <ian@iarmst.demon.co.uk>
+Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/console/fbcon.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/video/console/fbcon.c
++++ b/drivers/video/console/fbcon.c
+@@ -114,6 +114,7 @@ static int last_fb_vc = MAX_NR_CONSOLES
+ static int fbcon_is_default = 1;
+ static int fbcon_has_exited;
+ static int primary_device = -1;
++static int fbcon_has_console_bind;
+
+ #ifdef CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY
+ static int map_override;
+@@ -544,6 +545,8 @@ static int fbcon_takeover(int show_logo)
+ con2fb_map[i] = -1;
+ }
+ info_idx = -1;
++ } else {
++ fbcon_has_console_bind = 1;
+ }
+
+ return err;
+@@ -2923,6 +2926,10 @@ static int fbcon_unbind(void)
+
+ ret = unbind_con_driver(&fb_con, first_fb_vc, last_fb_vc,
+ fbcon_is_default);
++
++ if (!ret)
++ fbcon_has_console_bind = 0;
++
+ return ret;
+ }
+ #else
+@@ -2936,6 +2943,9 @@ static int fbcon_fb_unbind(int idx)
+ {
+ int i, new_idx = -1, ret = 0;
+
++ if (!fbcon_has_console_bind)
++ return 0;
++
+ for (i = first_fb_vc; i <= last_fb_vc; i++) {
+ if (con2fb_map[i] != idx &&
+ con2fb_map[i] != -1) {
--- /dev/null
+From 580be0837a7a59b207c3d5c661d044d8dd0a6a30 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Mon, 21 Sep 2009 17:01:06 -0700
+Subject: fs: make sure data stored into inode is properly seen before unlocking new inode
+
+From: Jan Kara <jack@suse.cz>
+
+commit 580be0837a7a59b207c3d5c661d044d8dd0a6a30 upstream.
+
+In theory it could happen that on one CPU we initialize a new inode but
+clearing of I_NEW | I_LOCK gets reordered before some of the
+initialization. Thus on another CPU we return not fully uptodate inode
+from iget_locked().
+
+This seems to fix a corruption issue on ext3 mounted over NFS.
+
+[akpm@linux-foundation.org: add some commentary]
+Signed-off-by: Jan Kara <jack@suse.cz>
+Cc: Christoph Hellwig <hch@infradead.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+--- a/fs/inode.c
++++ b/fs/inode.c
+@@ -695,13 +695,15 @@ void unlock_new_inode(struct inode *inode)
+ }
+ #endif
+ /*
+- * This is special! We do not need the spinlock
+- * when clearing I_LOCK, because we're guaranteed
+- * that nobody else tries to do anything about the
+- * state of the inode when it is locked, as we
+- * just created it (so there can be no old holders
+- * that haven't tested I_LOCK).
++ * This is special! We do not need the spinlock when clearing I_LOCK,
++ * because we're guaranteed that nobody else tries to do anything about
++ * the state of the inode when it is locked, as we just created it (so
++ * there can be no old holders that haven't tested I_LOCK).
++ * However we must emit the memory barrier so that other CPUs reliably
++ * see the clearing of I_LOCK after the other inode initialisation has
++ * completed.
+ */
++ smp_mb();
+ WARN_ON((inode->i_state & (I_LOCK|I_NEW)) != (I_LOCK|I_NEW));
+ inode->i_state &= ~(I_LOCK|I_NEW);
+ wake_up_inode(inode);
--- /dev/null
+From a9ece53c4089ef23d4002d34c4c7148d94622a40 Mon Sep 17 00:00:00 2001
+From: Paul Mundt <lethal@linux-sh.org>
+Date: Tue, 22 Sep 2009 16:44:12 -0700
+Subject: kallsyms: fix segfault in prefix_underscores_count()
+
+From: Paul Mundt <lethal@linux-sh.org>
+
+commit a9ece53c4089ef23d4002d34c4c7148d94622a40 upstream.
+
+Commit b478b782e110fdb4135caa3062b6d687e989d994 "kallsyms, tracing: output
+more proper symbol name" introduces a "bugfix" that introduces a segfault
+in kallsyms in my configurations.
+
+The cause is the introduction of prefix_underscores_count() which attempts
+to count underscores, even in symbols that do not have them. As a result,
+it just uselessly runs past the end of the buffer until it crashes:
+
+ CC init/version.o
+ LD init/built-in.o
+ LD .tmp_vmlinux1
+ KSYM .tmp_kallsyms1.S
+/bin/sh: line 1: 16934 Done sh-linux-gnu-nm -n .tmp_vmlinux1
+ 16935 Segmentation fault | scripts/kallsyms > .tmp_kallsyms1.S
+make: *** [.tmp_kallsyms1.S] Error 139
+
+This simplifies the logic and just does a straightforward count.
+
+Signed-off-by: Paul Mundt <lethal@linux-sh.org>
+Reviewed-by: Li Zefan <lizf@cn.fujitsu.com>
+Cc: Lai Jiangshan <laijs@cn.fujitsu.com>
+Cc: Sam Ravnborg <sam@ravnborg.org>
+Cc: Paulo Marques <pmarques@grupopie.com>
+Cc: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ scripts/kallsyms.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/scripts/kallsyms.c
++++ b/scripts/kallsyms.c
+@@ -585,7 +585,7 @@ static int prefix_underscores_count(cons
+ {
+ const char *tail = str;
+
+- while (*tail != '_')
++ while (*tail == '_')
+ tail++;
+
+ return tail - str;
--- /dev/null
+From 051b982bcc620695de629d29c333c95b66e9b95e Mon Sep 17 00:00:00 2001
+From: Kevin Cernekee <cernekee@gmail.com>
+Date: Sat, 19 Sep 2009 11:18:21 +0000
+Subject: kaweth: Fix memory leak in kaweth_control()
+
+From: Kevin Cernekee <cernekee@gmail.com>
+
+commit 051b982bcc620695de629d29c333c95b66e9b95e upstream.
+
+kaweth_control() never frees the buffer that it allocates for the USB
+control message. Test case:
+
+while :; do ifconfig eth2 down ; ifconfig eth2 up ; done
+
+This is a tiny buffer so it is a slow leak. If you want to speed up the
+process, you can change the allocation size to e.g. 16384 bytes, and it
+will consume several megabytes within a few minutes.
+
+Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
+Acked-by: Oliver Neukum <oliver@neukum.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/usb/kaweth.c | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/usb/kaweth.c
++++ b/drivers/net/usb/kaweth.c
+@@ -263,6 +263,7 @@ static int kaweth_control(struct kaweth_
+ int timeout)
+ {
+ struct usb_ctrlrequest *dr;
++ int retval;
+
+ dbg("kaweth_control()");
+
+@@ -278,18 +279,21 @@ static int kaweth_control(struct kaweth_
+ return -ENOMEM;
+ }
+
+- dr->bRequestType= requesttype;
++ dr->bRequestType = requesttype;
+ dr->bRequest = request;
+ dr->wValue = cpu_to_le16(value);
+ dr->wIndex = cpu_to_le16(index);
+ dr->wLength = cpu_to_le16(size);
+
+- return kaweth_internal_control_msg(kaweth->dev,
+- pipe,
+- dr,
+- data,
+- size,
+- timeout);
++ retval = kaweth_internal_control_msg(kaweth->dev,
++ pipe,
++ dr,
++ data,
++ size,
++ timeout);
++
++ kfree(dr);
++ return retval;
+ }
+
+ /****************************************************************
--- /dev/null
+From c47efe5548abbf53c2f66e06dcb46183b11d6b22 Mon Sep 17 00:00:00 2001
+From: Jory A. Pratt <anarchy@gentoo.org>
+Date: Fri, 18 Sep 2009 12:49:31 -0700
+Subject: kbuild: fix cc1 options check to ensure we do not use -fPIC when compiling
+
+From: Jory A. Pratt <anarchy@gentoo.org>
+
+commit c47efe5548abbf53c2f66e06dcb46183b11d6b22 upstream.
+
+The arch/*/boot/Makefile use cc-options to check for GCC command options
+and cc-options use the hardened specs when checking for GCC command
+options. When -fPIE is pass to cc1 it can't use -ffreestanding or
+-fno-toplevel-reorder. Then it fail to build stuff with -ffreestanding
+and -fno-toplevel-reorder.
+
+Thanks to Fredric Johansson for finding the main problem behind a failed
+build using a hardened toolchain.
+
+Signed-off-by: Magnus Granberg <zorry@ume.nu>
+Signed-off-by: Jory A. Pratt <anarchy@gentoo.org>
+Cc: Fredric Johansson <johansson_fredric@hotmail.com>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ scripts/Kbuild.include | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/scripts/Kbuild.include
++++ b/scripts/Kbuild.include
+@@ -105,12 +105,12 @@ as-instr = $(call try-run,\
+ # Usage: cflags-y += $(call cc-option,-march=winchip-c6,-march=i586)
+
+ cc-option = $(call try-run,\
+- $(CC) $(KBUILD_CFLAGS) $(1) -c -xc /dev/null -o "$$TMP",$(1),$(2))
++ $(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) $(1) -c -xc /dev/null -o "$$TMP",$(1),$(2))
+
+ # cc-option-yn
+ # Usage: flag := $(call cc-option-yn,-march=winchip-c6)
+ cc-option-yn = $(call try-run,\
+- $(CC) $(KBUILD_CFLAGS) $(1) -c -xc /dev/null -o "$$TMP",y,n)
++ $(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) $(1) -c -xc /dev/null -o "$$TMP",y,n)
+
+ # cc-option-align
+ # Prefix align with either -falign or -malign
--- /dev/null
+From d08ebeddfb3293fa4bdfca9c610daf1e8ec8b233 Mon Sep 17 00:00:00 2001
+From: Wolfgang Muees <wolfgang.mues@auerswald.de>
+Date: Tue, 22 Sep 2009 16:45:26 -0700
+Subject: mmc_spi: fail gracefully if host or card do not support the switch command
+
+From: Wolfgang Muees <wolfgang.mues@auerswald.de>
+
+commit d08ebeddfb3293fa4bdfca9c610daf1e8ec8b233 upstream.
+
+Some time ago, I have send a patch to the mmc_spi subsystem changing the
+error codes. This was after a discussion with Pierre about using EINVAL
+only for non-recoverable errors. This patch was accepted as
+
+http://git.kernel.org/linus/fdd858db7113ca64132de390188d7ca00701013d
+
+Unfortunately, several weeks later, I realized that this patch has opened
+a little can of worms because there are SD cards on the market which
+
+a) claim that they support the switch command
+AND
+b) refuse to execute this command if operating in SPI mode.
+
+So, such a card would get unusuable in an embedded linux system in SPI
+mode, because the init sequence terminates with an error.
+
+This patch adds the missing error codes to the caller of the switch
+command and restores the old behaviour to fail gracefully if these
+commands can not execute.
+
+Signed-off-by: Wolfgang Muees <wolfgang.mues@auerswald.de>
+Cc: <linux-mmc@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mmc/core/mmc.c | 10 +++++-----
+ drivers/mmc/core/sd.c | 10 +++++-----
+ 2 files changed, 10 insertions(+), 10 deletions(-)
+
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -180,11 +180,11 @@ static int mmc_read_ext_csd(struct mmc_c
+
+ err = mmc_send_ext_csd(card, ext_csd);
+ if (err) {
+- /*
+- * We all hosts that cannot perform the command
+- * to fail more gracefully
+- */
+- if (err != -EINVAL)
++ /* If the host or the card can't do the switch,
++ * fail more gracefully. */
++ if ((err != -EINVAL)
++ && (err != -ENOSYS)
++ && (err != -EFAULT))
+ goto out;
+
+ /*
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -210,11 +210,11 @@ static int mmc_read_switch(struct mmc_ca
+
+ err = mmc_sd_switch(card, 0, 0, 1, status);
+ if (err) {
+- /*
+- * We all hosts that cannot perform the command
+- * to fail more gracefully
+- */
+- if (err != -EINVAL)
++ /* If the host or the card can't do the switch,
++ * fail more gracefully. */
++ if ((err != -EINVAL)
++ && (err != -ENOSYS)
++ && (err != -EFAULT))
+ goto out;
+
+ printk(KERN_WARNING "%s: problem reading switch "
--- /dev/null
+From 23af51ecfb04ff65bae51bd8e2270f4449abc789 Mon Sep 17 00:00:00 2001
+From: Massimo Cirillo <maxcir@gmail.com>
+Date: Thu, 3 Sep 2009 16:34:39 +0200
+Subject: mtd: cfi_cmdset_0002: add 0xFF intolerance for M29W128G
+
+From: Massimo Cirillo <maxcir@gmail.com>
+
+commit 23af51ecfb04ff65bae51bd8e2270f4449abc789 upstream.
+
+The M29W128G Numonyx flash devices are intolerant to any 0xFF command:
+in the Cfi_util.c the function cfi_qry_mode_off() (that resets the device
+after the autoselect mode) must have a 0xF0 command after the 0xFF command.
+This fix solves also the cause of the fixup_M29W128G_write_buffer() fix,
+that can be removed now.
+The following patch applies to 2.6.30 kernel.
+
+Signed-off-by: Massimo Cirillo <maxcir@gmail.com>
+Acked-by: Alexey Korolev <akorolev@infradead.org>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mtd/chips/cfi_cmdset_0002.c | 11 -----------
+ drivers/mtd/chips/cfi_util.c | 4 ++++
+ 2 files changed, 4 insertions(+), 11 deletions(-)
+
+--- a/drivers/mtd/chips/cfi_cmdset_0002.c
++++ b/drivers/mtd/chips/cfi_cmdset_0002.c
+@@ -282,16 +282,6 @@ static void fixup_s29gl032n_sectors(stru
+ }
+ }
+
+-static void fixup_M29W128G_write_buffer(struct mtd_info *mtd, void *param)
+-{
+- struct map_info *map = mtd->priv;
+- struct cfi_private *cfi = map->fldrv_priv;
+- if (cfi->cfiq->BufWriteTimeoutTyp) {
+- pr_warning("Don't use write buffer on ST flash M29W128G\n");
+- cfi->cfiq->BufWriteTimeoutTyp = 0;
+- }
+-}
+-
+ static struct cfi_fixup cfi_fixup_table[] = {
+ { CFI_MFR_ATMEL, CFI_ID_ANY, fixup_convert_atmel_pri, NULL },
+ #ifdef AMD_BOOTLOC_BUG
+@@ -308,7 +298,6 @@ static struct cfi_fixup cfi_fixup_table[
+ { CFI_MFR_AMD, 0x1301, fixup_s29gl064n_sectors, NULL, },
+ { CFI_MFR_AMD, 0x1a00, fixup_s29gl032n_sectors, NULL, },
+ { CFI_MFR_AMD, 0x1a01, fixup_s29gl032n_sectors, NULL, },
+- { CFI_MFR_ST, 0x227E, fixup_M29W128G_write_buffer, NULL, },
+ #if !FORCE_WORD_WRITE
+ { CFI_MFR_ANY, CFI_ID_ANY, fixup_use_write_buffers, NULL, },
+ #endif
+--- a/drivers/mtd/chips/cfi_util.c
++++ b/drivers/mtd/chips/cfi_util.c
+@@ -81,6 +81,10 @@ void __xipram cfi_qry_mode_off(uint32_t
+ {
+ cfi_send_gen_cmd(0xF0, 0, base, map, cfi, cfi->device_type, NULL);
+ cfi_send_gen_cmd(0xFF, 0, base, map, cfi, cfi->device_type, NULL);
++ /* M29W128G flashes require an additional reset command
++ when exit qry mode */
++ if ((cfi->mfr == CFI_MFR_ST) && (cfi->id == 0x227E || cfi->id == 0x7E))
++ cfi_send_gen_cmd(0xF0, 0, base, map, cfi, cfi->device_type, NULL);
+ }
+ EXPORT_SYMBOL_GPL(cfi_qry_mode_off);
+
--- /dev/null
+From 76c23c32e3b3ad48e07e07897075ab19ae1ef117 Mon Sep 17 00:00:00 2001
+From: Feng Kan <fkan@amcc.com>
+Date: Tue, 25 Aug 2009 11:27:20 -0700
+Subject: mtd: nand: fix ECC Correction bug for SMC ordering for NDFC driver
+
+From: Feng Kan <fkan@amcc.com>
+
+commit 76c23c32e3b3ad48e07e07897075ab19ae1ef117 upstream.
+
+Fix ECC Correction bug where the byte offset location were double
+fliped causing correction routine to toggle the wrong byte location
+in the ECC segment. The ndfc_calculate_ecc routine change the order
+of getting the ECC code.
+ /* The NDFC uses Smart Media (SMC) bytes order */
+ ecc_code[0] = p[2];
+ ecc_code[1] = p[1];
+ ecc_code[2] = p[3];
+But in the Correction algorithm when calculating the byte offset
+location, the b1 is used as the upper part of the address. Which
+again reverse the order making the final byte offset address
+location incorrect.
+ byte_addr = (addressbits[b1] << 4) + addressbits[b0];
+The order is change to read it in straight and let the correction
+function to revert it to SMC order.
+
+Signed-off-by: Feng Kan <fkan@amcc.com>
+Acked-by: Victor Gallardo <vgallardo@amcc.com>
+Acked-by: Prodyut Hazarika <phazarika@amcc.com>
+Acked-by: Stefan Roese <sr@denx.de>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mtd/nand/ndfc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/mtd/nand/ndfc.c
++++ b/drivers/mtd/nand/ndfc.c
+@@ -102,8 +102,8 @@ static int ndfc_calculate_ecc(struct mtd
+ wmb();
+ ecc = in_be32(ndfc->ndfcbase + NDFC_ECC);
+ /* The NDFC uses Smart Media (SMC) bytes order */
+- ecc_code[0] = p[2];
+- ecc_code[1] = p[1];
++ ecc_code[0] = p[1];
++ ecc_code[1] = p[2];
+ ecc_code[2] = p[3];
+
+ return 0;
--- /dev/null
+From ebd5a74db74ee2db833d43ea35108a4be9cab42f Mon Sep 17 00:00:00 2001
+From: Benjamin Krill <ben@codiert.org>
+Date: Tue, 25 Aug 2009 15:52:41 +0200
+Subject: mtd: ofpart: Check availability of reg property instead of name property
+
+From: Benjamin Krill <ben@codiert.org>
+
+commit ebd5a74db74ee2db833d43ea35108a4be9cab42f upstream.
+
+The previous implementation breaks the dts binding "mtd-physmap.txt". This
+implementation fixes the issue by checking the availability of the reg
+property instead of the name property.
+
+Signed-off-by: Benjamin Krill <ben@codiert.org>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mtd/ofpart.c | 21 ++++++++++-----------
+ 1 file changed, 10 insertions(+), 11 deletions(-)
+
+--- a/drivers/mtd/ofpart.c
++++ b/drivers/mtd/ofpart.c
+@@ -46,21 +46,12 @@ int __devinit of_mtd_parse_partitions(st
+ const u32 *reg;
+ int len;
+
+- /* check if this is a partition node */
+- partname = of_get_property(pp, "name", &len);
+- if (strcmp(partname, "partition") != 0) {
++ reg = of_get_property(pp, "reg", &len);
++ if (!reg) {
+ nr_parts--;
+ continue;
+ }
+
+- reg = of_get_property(pp, "reg", &len);
+- if (!reg || (len != 2 * sizeof(u32))) {
+- of_node_put(pp);
+- dev_err(dev, "Invalid 'reg' on %s\n", node->full_name);
+- kfree(*pparts);
+- *pparts = NULL;
+- return -EINVAL;
+- }
+ (*pparts)[i].offset = reg[0];
+ (*pparts)[i].size = reg[1];
+
+@@ -75,6 +66,14 @@ int __devinit of_mtd_parse_partitions(st
+ i++;
+ }
+
++ if (!i) {
++ of_node_put(pp);
++ dev_err(dev, "No valid partition found on %s\n", node->full_name);
++ kfree(*pparts);
++ *pparts = NULL;
++ return -EINVAL;
++ }
++
+ return nr_parts;
+ }
+ EXPORT_SYMBOL(of_mtd_parse_partitions);
--- /dev/null
+From 886e3b7fe6054230c89ae078a09565ed183ecc73 Mon Sep 17 00:00:00 2001
+From: J. Bruce Fields <bfields@citi.umich.edu>
+Date: Tue, 15 Sep 2009 12:22:42 -0400
+Subject: nfsd4: fix null dereference creating nfsv4 callback client
+
+From: J. Bruce Fields <bfields@citi.umich.edu>
+
+commit 886e3b7fe6054230c89ae078a09565ed183ecc73 upstream.
+
+On setting up the callback to the client, we attempt to use the same
+authentication flavor the client did. We find an rpc cred to use by
+calling rpcauth_lookup_credcache(), which assumes that the given
+authentication flavor has a credentials cache. However, this is not
+required to be true--in particular, auth_null does not use one.
+Instead, we should call the auth's lookup_cred() method.
+
+Without this, a client attempting to mount using nfsv4 and auth_null
+triggers a null dereference.
+
+Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/nfs4callback.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/nfsd/nfs4callback.c
++++ b/fs/nfsd/nfs4callback.c
+@@ -444,6 +444,7 @@ static struct rpc_cred *lookup_cb_cred(s
+ struct auth_cred acred = {
+ .machine_cred = 1
+ };
++ struct rpc_auth *auth = cb->cb_client->cl_auth;
+
+ /*
+ * Note in the gss case this doesn't actually have to wait for a
+@@ -451,8 +452,7 @@ static struct rpc_cred *lookup_cb_cred(s
+ * non-uptodate cred which the rpc state machine will fill in with
+ * a refresh_upcall later.
+ */
+- return rpcauth_lookup_credcache(cb->cb_client->cl_auth, &acred,
+- RPCAUTH_LOOKUP_NEW);
++ return auth->au_ops->lookup_cred(auth, &acred, RPCAUTH_LOOKUP_NEW);
+ }
+
+ void do_probe_callback(struct nfs4_client *clp)
--- /dev/null
+From 1f28fcd925b2b3157411bbd08f0024b55b70d8dd Mon Sep 17 00:00:00 2001
+From: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Date: Mon, 28 Sep 2009 01:46:11 +0900
+Subject: nilfs2: fix missing zero-fill initialization of btree node cache
+
+From: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+
+commit 1f28fcd925b2b3157411bbd08f0024b55b70d8dd upstream.
+
+This will fix file system corruption which infrequently happens after
+mount. The problem was reported from users with the title "[NILFS
+users] Fail to mount NILFS." (Message-ID:
+<200908211918.34720.yuri@itinteg.net>), and so forth. I've also
+experienced the corruption multiple times on kernel 2.6.30 and 2.6.31.
+
+The problem turned out to be caused due to discordance between
+mapping->nrpages of a btree node cache and the actual number of pages
+hung on the cache; if the mapping->nrpages becomes zero even as it has
+pages, truncate_inode_pages() returns without doing anything. Usually
+this is harmless except it may cause page leak, but garbage collection
+fairly infrequently sees a stale page remained in the btree node cache
+of DAT (i.e. disk address translation file of nilfs), and induces the
+corruption.
+
+I identified a missing initialization in btree node caches was the
+root cause. This corrects the bug.
+
+I've tested this for kernel 2.6.30 and 2.6.31.
+
+Reported-by: Yuri Chislov <yuri@itinteg.net>
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nilfs2/btnode.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/nilfs2/btnode.c
++++ b/fs/nilfs2/btnode.c
+@@ -36,6 +36,7 @@
+
+ void nilfs_btnode_cache_init_once(struct address_space *btnc)
+ {
++ memset(btnc, 0, sizeof(*btnc));
+ INIT_RADIX_TREE(&btnc->page_tree, GFP_ATOMIC);
+ spin_lock_init(&btnc->tree_lock);
+ INIT_LIST_HEAD(&btnc->private_list);
--- /dev/null
+From f7f71173ea69d4dabf166533beffa9294090b7ef Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@googlemail.com>
+Date: Mon, 14 Sep 2009 23:08:43 +0200
+Subject: p54usb: add Zcomax XG-705A usbid
+
+From: Christian Lamparter <chunkeey@googlemail.com>
+
+commit f7f71173ea69d4dabf166533beffa9294090b7ef upstream.
+
+This patch adds a new usbid for Zcomax XG-705A to the device table.
+
+Reported-by: Jari Jaakola <jari.jaakola@gmail.com>
+Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/p54/p54usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/p54/p54usb.c
++++ b/drivers/net/wireless/p54/p54usb.c
+@@ -66,6 +66,7 @@ static struct usb_device_id p54u_table[]
+ {USB_DEVICE(0x0bf8, 0x1009)}, /* FUJITSU E-5400 USB D1700*/
+ {USB_DEVICE(0x0cde, 0x0006)}, /* Medion MD40900 */
+ {USB_DEVICE(0x0cde, 0x0008)}, /* Sagem XG703A */
++ {USB_DEVICE(0x0cde, 0x0015)}, /* Zcomax XG-705A */
+ {USB_DEVICE(0x0d8e, 0x3762)}, /* DLink DWL-G120 Cohiba */
+ {USB_DEVICE(0x124a, 0x4025)}, /* IOGear GWU513 (GW3887IK chip) */
+ {USB_DEVICE(0x1260, 0xee22)}, /* SMC 2862W-G version 2 */
--- /dev/null
+From 90950a2504b66d626a73f55ca949a2e79ff4b7c4 Mon Sep 17 00:00:00 2001
+From: Robert Hancock <hancockrwd@gmail.com>
+Date: Sat, 12 Sep 2009 23:54:47 -0600
+Subject: pata_amd: do not filter out valid modes in nv_mode_filter
+
+From: Robert Hancock <hancockrwd@gmail.com>
+
+commit 90950a2504b66d626a73f55ca949a2e79ff4b7c4 upstream.
+
+On a Compaq Presario V3000 laptop (NVIDIA MCP51 chipset), pata_amd selects
+PIO0 mode for the PATA DVD-RAM drive instead of MWDMA2 which it supports:
+
+ata4.00: ATAPI: HL-DT-ST DVDRAM GSA-4084N, KQ09, max MWDMA2
+ata4: nv_mode_filter: 0x39f&0x7001->0x1, BIOS=0x0 (0x0) ACPI=0x7001 (60:600:0x11)
+ata4.00: configured for PIO0
+
+For some reason, the BIOS-set UDMA configuration returns 0 and the ACPI _GTM
+reports that UDMA2 and PIO0 are enabled. This causes nv_mode_filter to end up
+allowing only PIO0 and UDMA0-2. Since the drive doesn't support UDMA we end up
+using PIO0.
+
+Since the controllers should always support PIO4, MWDMA2 and UDMA2 regardless
+of what cable type is used, let's make sure we don't filter out these modes
+regardless of what wacky settings the BIOS is using.
+
+Signed-off-by: Robert Hancock <hancockrwd@gmail.com>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/pata_amd.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/ata/pata_amd.c
++++ b/drivers/ata/pata_amd.c
+@@ -307,6 +307,9 @@ static unsigned long nv_mode_filter(stru
+ limit |= ATA_MASK_PIO;
+ if (!(limit & (ATA_MASK_MWDMA | ATA_MASK_UDMA)))
+ limit |= ATA_MASK_MWDMA | ATA_MASK_UDMA;
++ /* PIO4, MWDMA2, UDMA2 should always be supported regardless of
++ cable detection result */
++ limit |= ata_pack_xfermask(ATA_PIO4, ATA_MWDMA2, ATA_UDMA2);
+
+ ata_port_printk(ap, KERN_DEBUG, "nv_mode_filter: 0x%lx&0x%lx->0x%lx, "
+ "BIOS=0x%lx (0x%x) ACPI=0x%lx%s\n",
--- /dev/null
+From a255a9981a8566a1efabec983b7811e937e662d2 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Thu, 24 Sep 2009 15:05:59 +0200
+Subject: perf tools: Fix buffer allocation
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+commit a255a9981a8566a1efabec983b7811e937e662d2 upstream.
+
+"perf top" cores dump on my dev machine, if run from a directory
+where vmlinux is present:
+
+ *** glibc detected *** malloc(): memory corruption: 0x085670d0 ***
+
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+LKML-Reference: <4ABB6EB7.7000002@gmail.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ tools/perf/util/module.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/perf/util/module.c
++++ b/tools/perf/util/module.c
+@@ -422,7 +422,7 @@ static int mod_dso__load_module_paths(st
+ len += strlen(uts.release);
+ len += strlen("/modules.dep");
+
+- path = calloc(1, len);
++ path = calloc(1, len + 1);
+ if (path == NULL)
+ goto out_failure;
+
--- /dev/null
+From cdf8073d6b2c6c5a3cd6ce0e6c1297157f7f99ba Mon Sep 17 00:00:00 2001
+From: Ian Schram <ischram@telenet.be>
+Date: Fri, 18 Sep 2009 21:26:26 +0200
+Subject: perf_counter: Fix perf_copy_attr() pointer arithmetic
+
+From: Ian Schram <ischram@telenet.be>
+
+commit cdf8073d6b2c6c5a3cd6ce0e6c1297157f7f99ba upstream.
+
+There is still some weird code in per_copy_attr(). Which supposedly
+checks that all bytes trailing a struct are zero.
+
+It doesn't seem to get pointer arithmetic right. Since it
+increments an iterating pointer by sizeof(unsigned long) rather
+than 1.
+
+Signed-off-by: Ian Schram <ischram@telenet.be>
+[ v2: clean up the messy PTR_ALIGN logic as well. ]
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: Mike Galbraith <efault@gmx.de>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Frederic Weisbecker <fweisbec@gmail.com>
+LKML-Reference: <4AB3DEE2.3030600@telenet.be>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/perf_counter.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+--- a/kernel/perf_counter.c
++++ b/kernel/perf_counter.c
+@@ -4143,8 +4143,8 @@ done:
+ static int perf_copy_attr(struct perf_counter_attr __user *uattr,
+ struct perf_counter_attr *attr)
+ {
+- int ret;
+ u32 size;
++ int ret;
+
+ if (!access_ok(VERIFY_WRITE, uattr, PERF_ATTR_SIZE_VER0))
+ return -EFAULT;
+@@ -4169,19 +4169,19 @@ static int perf_copy_attr(struct perf_co
+
+ /*
+ * If we're handed a bigger struct than we know of,
+- * ensure all the unknown bits are 0.
++ * ensure all the unknown bits are 0 - i.e. new
++ * user-space does not rely on any kernel feature
++ * extensions we dont know about yet.
+ */
+ if (size > sizeof(*attr)) {
+- unsigned long val;
+- unsigned long __user *addr;
+- unsigned long __user *end;
+-
+- addr = PTR_ALIGN((void __user *)uattr + sizeof(*attr),
+- sizeof(unsigned long));
+- end = PTR_ALIGN((void __user *)uattr + size,
+- sizeof(unsigned long));
++ unsigned char __user *addr;
++ unsigned char __user *end;
++ unsigned char val;
++
++ addr = (void __user *)uattr + sizeof(*attr);
++ end = (void __user *)uattr + size;
+
+- for (; addr < end; addr += sizeof(unsigned long)) {
++ for (; addr < end; addr++) {
+ ret = get_user(val, addr);
+ if (ret)
+ return ret;
--- /dev/null
+From 827b4649d4626bf97b203b4bcd69476bb9b4e760 Mon Sep 17 00:00:00 2001
+From: Rafael J. Wysocki <rjw@sisk.pl>
+Date: Tue, 29 Sep 2009 00:10:41 +0200
+Subject: PM / PCMCIA: Drop second argument of pcmcia_socket_dev_suspend()
+
+From: Rafael J. Wysocki <rjw@sisk.pl>
+
+commit 827b4649d4626bf97b203b4bcd69476bb9b4e760 upstream.
+
+pcmcia_socket_dev_suspend() doesn't use its second argument, so it
+may be dropped safely.
+
+This change is necessary for the subsequent yenta suspend/resume fix.
+
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pcmcia/at91_cf.c | 2 +-
+ drivers/pcmcia/au1000_generic.c | 2 +-
+ drivers/pcmcia/bfin_cf_pcmcia.c | 2 +-
+ drivers/pcmcia/cs.c | 2 +-
+ drivers/pcmcia/i82092.c | 2 +-
+ drivers/pcmcia/i82365.c | 2 +-
+ drivers/pcmcia/m32r_cfc.c | 2 +-
+ drivers/pcmcia/m32r_pcc.c | 2 +-
+ drivers/pcmcia/m8xx_pcmcia.c | 2 +-
+ drivers/pcmcia/omap_cf.c | 2 +-
+ drivers/pcmcia/pd6729.c | 2 +-
+ drivers/pcmcia/pxa2xx_base.c | 2 +-
+ drivers/pcmcia/sa1100_generic.c | 2 +-
+ drivers/pcmcia/sa1111_generic.c | 2 +-
+ drivers/pcmcia/tcic.c | 2 +-
+ drivers/pcmcia/vrc4171_card.c | 2 +-
+ drivers/pcmcia/yenta_socket.c | 2 +-
+ include/pcmcia/ss.h | 2 +-
+ 18 files changed, 18 insertions(+), 18 deletions(-)
+
+--- a/drivers/pcmcia/at91_cf.c
++++ b/drivers/pcmcia/at91_cf.c
+@@ -363,7 +363,7 @@ static int at91_cf_suspend(struct platfo
+ struct at91_cf_socket *cf = platform_get_drvdata(pdev);
+ struct at91_cf_data *board = cf->board;
+
+- pcmcia_socket_dev_suspend(&pdev->dev, mesg);
++ pcmcia_socket_dev_suspend(&pdev->dev);
+ if (device_may_wakeup(&pdev->dev)) {
+ enable_irq_wake(board->det_pin);
+ if (board->irq_pin)
+--- a/drivers/pcmcia/au1000_generic.c
++++ b/drivers/pcmcia/au1000_generic.c
+@@ -515,7 +515,7 @@ static int au1x00_drv_pcmcia_probe(struc
+ static int au1x00_drv_pcmcia_suspend(struct platform_device *dev,
+ pm_message_t state)
+ {
+- return pcmcia_socket_dev_suspend(&dev->dev, state);
++ return pcmcia_socket_dev_suspend(&dev->dev);
+ }
+
+ static int au1x00_drv_pcmcia_resume(struct platform_device *dev)
+--- a/drivers/pcmcia/bfin_cf_pcmcia.c
++++ b/drivers/pcmcia/bfin_cf_pcmcia.c
+@@ -302,7 +302,7 @@ static int __devexit bfin_cf_remove(stru
+
+ static int bfin_cf_suspend(struct platform_device *pdev, pm_message_t mesg)
+ {
+- return pcmcia_socket_dev_suspend(&pdev->dev, mesg);
++ return pcmcia_socket_dev_suspend(&pdev->dev);
+ }
+
+ static int bfin_cf_resume(struct platform_device *pdev)
+--- a/drivers/pcmcia/cs.c
++++ b/drivers/pcmcia/cs.c
+@@ -101,7 +101,7 @@ EXPORT_SYMBOL(pcmcia_socket_list_rwsem);
+ static int socket_resume(struct pcmcia_socket *skt);
+ static int socket_suspend(struct pcmcia_socket *skt);
+
+-int pcmcia_socket_dev_suspend(struct device *dev, pm_message_t state)
++int pcmcia_socket_dev_suspend(struct device *dev)
+ {
+ struct pcmcia_socket *socket;
+
+--- a/drivers/pcmcia/i82092.c
++++ b/drivers/pcmcia/i82092.c
+@@ -42,7 +42,7 @@ MODULE_DEVICE_TABLE(pci, i82092aa_pci_id
+ #ifdef CONFIG_PM
+ static int i82092aa_socket_suspend (struct pci_dev *dev, pm_message_t state)
+ {
+- return pcmcia_socket_dev_suspend(&dev->dev, state);
++ return pcmcia_socket_dev_suspend(&dev->dev);
+ }
+
+ static int i82092aa_socket_resume (struct pci_dev *dev)
+--- a/drivers/pcmcia/i82365.c
++++ b/drivers/pcmcia/i82365.c
+@@ -1241,7 +1241,7 @@ static int pcic_init(struct pcmcia_socke
+ static int i82365_drv_pcmcia_suspend(struct platform_device *dev,
+ pm_message_t state)
+ {
+- return pcmcia_socket_dev_suspend(&dev->dev, state);
++ return pcmcia_socket_dev_suspend(&dev->dev);
+ }
+
+ static int i82365_drv_pcmcia_resume(struct platform_device *dev)
+--- a/drivers/pcmcia/m32r_cfc.c
++++ b/drivers/pcmcia/m32r_cfc.c
+@@ -699,7 +699,7 @@ static struct pccard_operations pcc_oper
+ static int cfc_drv_pcmcia_suspend(struct platform_device *dev,
+ pm_message_t state)
+ {
+- return pcmcia_socket_dev_suspend(&dev->dev, state);
++ return pcmcia_socket_dev_suspend(&dev->dev);
+ }
+
+ static int cfc_drv_pcmcia_resume(struct platform_device *dev)
+--- a/drivers/pcmcia/m32r_pcc.c
++++ b/drivers/pcmcia/m32r_pcc.c
+@@ -675,7 +675,7 @@ static struct pccard_operations pcc_oper
+ static int pcc_drv_pcmcia_suspend(struct platform_device *dev,
+ pm_message_t state)
+ {
+- return pcmcia_socket_dev_suspend(&dev->dev, state);
++ return pcmcia_socket_dev_suspend(&dev->dev);
+ }
+
+ static int pcc_drv_pcmcia_resume(struct platform_device *dev)
+--- a/drivers/pcmcia/m8xx_pcmcia.c
++++ b/drivers/pcmcia/m8xx_pcmcia.c
+@@ -1296,7 +1296,7 @@ static int m8xx_remove(struct of_device
+ #ifdef CONFIG_PM
+ static int m8xx_suspend(struct platform_device *pdev, pm_message_t state)
+ {
+- return pcmcia_socket_dev_suspend(&pdev->dev, state);
++ return pcmcia_socket_dev_suspend(&pdev->dev);
+ }
+
+ static int m8xx_resume(struct platform_device *pdev)
+--- a/drivers/pcmcia/omap_cf.c
++++ b/drivers/pcmcia/omap_cf.c
+@@ -334,7 +334,7 @@ static int __exit omap_cf_remove(struct
+
+ static int omap_cf_suspend(struct platform_device *pdev, pm_message_t mesg)
+ {
+- return pcmcia_socket_dev_suspend(&pdev->dev, mesg);
++ return pcmcia_socket_dev_suspend(&pdev->dev);
+ }
+
+ static int omap_cf_resume(struct platform_device *pdev)
+--- a/drivers/pcmcia/pd6729.c
++++ b/drivers/pcmcia/pd6729.c
+@@ -758,7 +758,7 @@ static void __devexit pd6729_pci_remove(
+ #ifdef CONFIG_PM
+ static int pd6729_socket_suspend(struct pci_dev *dev, pm_message_t state)
+ {
+- return pcmcia_socket_dev_suspend(&dev->dev, state);
++ return pcmcia_socket_dev_suspend(&dev->dev);
+ }
+
+ static int pd6729_socket_resume(struct pci_dev *dev)
+--- a/drivers/pcmcia/pxa2xx_base.c
++++ b/drivers/pcmcia/pxa2xx_base.c
+@@ -302,7 +302,7 @@ static int pxa2xx_drv_pcmcia_remove(stru
+
+ static int pxa2xx_drv_pcmcia_suspend(struct platform_device *dev, pm_message_t state)
+ {
+- return pcmcia_socket_dev_suspend(&dev->dev, state);
++ return pcmcia_socket_dev_suspend(&dev->dev);
+ }
+
+ static int pxa2xx_drv_pcmcia_resume(struct platform_device *dev)
+--- a/drivers/pcmcia/sa1100_generic.c
++++ b/drivers/pcmcia/sa1100_generic.c
+@@ -89,7 +89,7 @@ static int sa11x0_drv_pcmcia_remove(stru
+ static int sa11x0_drv_pcmcia_suspend(struct platform_device *dev,
+ pm_message_t state)
+ {
+- return pcmcia_socket_dev_suspend(&dev->dev, state);
++ return pcmcia_socket_dev_suspend(&dev->dev);
+ }
+
+ static int sa11x0_drv_pcmcia_resume(struct platform_device *dev)
+--- a/drivers/pcmcia/sa1111_generic.c
++++ b/drivers/pcmcia/sa1111_generic.c
+@@ -159,7 +159,7 @@ static int __devexit pcmcia_remove(struc
+
+ static int pcmcia_suspend(struct sa1111_dev *dev, pm_message_t state)
+ {
+- return pcmcia_socket_dev_suspend(&dev->dev, state);
++ return pcmcia_socket_dev_suspend(&dev->dev);
+ }
+
+ static int pcmcia_resume(struct sa1111_dev *dev)
+--- a/drivers/pcmcia/tcic.c
++++ b/drivers/pcmcia/tcic.c
+@@ -366,7 +366,7 @@ static int __init get_tcic_id(void)
+ static int tcic_drv_pcmcia_suspend(struct platform_device *dev,
+ pm_message_t state)
+ {
+- return pcmcia_socket_dev_suspend(&dev->dev, state);
++ return pcmcia_socket_dev_suspend(&dev->dev);
+ }
+
+ static int tcic_drv_pcmcia_resume(struct platform_device *dev)
+--- a/drivers/pcmcia/vrc4171_card.c
++++ b/drivers/pcmcia/vrc4171_card.c
+@@ -707,7 +707,7 @@ __setup("vrc4171_card=", vrc4171_card_se
+ static int vrc4171_card_suspend(struct platform_device *dev,
+ pm_message_t state)
+ {
+- return pcmcia_socket_dev_suspend(&dev->dev, state);
++ return pcmcia_socket_dev_suspend(&dev->dev);
+ }
+
+ static int vrc4171_card_resume(struct platform_device *dev)
+--- a/drivers/pcmcia/yenta_socket.c
++++ b/drivers/pcmcia/yenta_socket.c
+@@ -1230,7 +1230,7 @@ static int yenta_dev_suspend (struct pci
+ struct yenta_socket *socket = pci_get_drvdata(dev);
+ int ret;
+
+- ret = pcmcia_socket_dev_suspend(&dev->dev, state);
++ ret = pcmcia_socket_dev_suspend(&dev->dev);
+
+ if (socket) {
+ if (socket->type && socket->type->save_state)
+--- a/include/pcmcia/ss.h
++++ b/include/pcmcia/ss.h
+@@ -279,7 +279,7 @@ extern struct pccard_resource_ops pccard
+ extern struct pccard_resource_ops pccard_nonstatic_ops;
+
+ /* socket drivers are expected to use these callbacks in their .drv struct */
+-extern int pcmcia_socket_dev_suspend(struct device *dev, pm_message_t state);
++extern int pcmcia_socket_dev_suspend(struct device *dev);
+ extern int pcmcia_socket_dev_resume(struct device *dev);
+
+ /* socket drivers use this callback in their IRQ handler */
--- /dev/null
+From 0c570cdeb8fdfcb354a3e9cd81bfc6a09c19de0c Mon Sep 17 00:00:00 2001
+From: Rafael J. Wysocki <rjw@sisk.pl>
+Date: Tue, 29 Sep 2009 00:11:03 +0200
+Subject: PM / yenta: Fix cardbus suspend/resume regression
+
+From: Rafael J. Wysocki <rjw@sisk.pl>
+
+commit 0c570cdeb8fdfcb354a3e9cd81bfc6a09c19de0c upstream.
+
+Since 2.6.29 the PCI PM core have been restoring the standard
+configuration registers of PCI devices in the early phase of
+resume. In particular, PCI devices without drivers have been handled
+this way since commit 355a72d75b3b4f4877db4c9070c798238028ecb5
+(PCI: Rework default handling of suspend and resume). Unfortunately,
+this leads to post-resume problems with CardBus devices which cannot
+be accessed in the early phase of resume, because the sockets they
+are on have not been woken up yet at that point.
+
+To solve this problem, move the yenta socket resume to the early
+phase of resume and, analogously, move the suspend of it to the late
+phase of suspend. Additionally, remove some unnecessary PCI code
+from the yenta socket's resume routine.
+
+Fixes http://bugzilla.kernel.org/show_bug.cgi?id=13092, which is a
+post-2.6.28 regression.
+
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Reported-by: Florian <fs-kernelbugzilla@spline.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pcmcia/yenta_socket.c | 92 ++++++++++++++++++++++--------------------
+ 1 file changed, 50 insertions(+), 42 deletions(-)
+
+--- a/drivers/pcmcia/yenta_socket.c
++++ b/drivers/pcmcia/yenta_socket.c
+@@ -1225,60 +1225,71 @@ static int __devinit yenta_probe (struct
+ }
+
+ #ifdef CONFIG_PM
+-static int yenta_dev_suspend (struct pci_dev *dev, pm_message_t state)
++static int yenta_dev_suspend_noirq(struct device *dev)
+ {
+- struct yenta_socket *socket = pci_get_drvdata(dev);
++ struct pci_dev *pdev = to_pci_dev(dev);
++ struct yenta_socket *socket = pci_get_drvdata(pdev);
+ int ret;
+
+- ret = pcmcia_socket_dev_suspend(&dev->dev);
++ ret = pcmcia_socket_dev_suspend(dev);
+
+- if (socket) {
+- if (socket->type && socket->type->save_state)
+- socket->type->save_state(socket);
+-
+- /* FIXME: pci_save_state needs to have a better interface */
+- pci_save_state(dev);
+- pci_read_config_dword(dev, 16*4, &socket->saved_state[0]);
+- pci_read_config_dword(dev, 17*4, &socket->saved_state[1]);
+- pci_disable_device(dev);
+-
+- /*
+- * Some laptops (IBM T22) do not like us putting the Cardbus
+- * bridge into D3. At a guess, some other laptop will
+- * probably require this, so leave it commented out for now.
+- */
+- /* pci_set_power_state(dev, 3); */
+- }
++ if (!socket)
++ return ret;
++
++ if (socket->type && socket->type->save_state)
++ socket->type->save_state(socket);
++
++ pci_save_state(pdev);
++ pci_read_config_dword(pdev, 16*4, &socket->saved_state[0]);
++ pci_read_config_dword(pdev, 17*4, &socket->saved_state[1]);
++ pci_disable_device(pdev);
++
++ /*
++ * Some laptops (IBM T22) do not like us putting the Cardbus
++ * bridge into D3. At a guess, some other laptop will
++ * probably require this, so leave it commented out for now.
++ */
++ /* pci_set_power_state(dev, 3); */
+
+ return ret;
+ }
+
+-
+-static int yenta_dev_resume (struct pci_dev *dev)
++static int yenta_dev_resume_noirq(struct device *dev)
+ {
+- struct yenta_socket *socket = pci_get_drvdata(dev);
++ struct pci_dev *pdev = to_pci_dev(dev);
++ struct yenta_socket *socket = pci_get_drvdata(pdev);
++ int ret;
+
+- if (socket) {
+- int rc;
++ if (!socket)
++ return 0;
+
+- pci_set_power_state(dev, 0);
+- /* FIXME: pci_restore_state needs to have a better interface */
+- pci_restore_state(dev);
+- pci_write_config_dword(dev, 16*4, socket->saved_state[0]);
+- pci_write_config_dword(dev, 17*4, socket->saved_state[1]);
++ pci_write_config_dword(pdev, 16*4, socket->saved_state[0]);
++ pci_write_config_dword(pdev, 17*4, socket->saved_state[1]);
+
+- rc = pci_enable_device(dev);
+- if (rc)
+- return rc;
++ ret = pci_enable_device(pdev);
++ if (ret)
++ return ret;
+
+- pci_set_master(dev);
++ pci_set_master(pdev);
+
+- if (socket->type && socket->type->restore_state)
+- socket->type->restore_state(socket);
+- }
++ if (socket->type && socket->type->restore_state)
++ socket->type->restore_state(socket);
+
+- return pcmcia_socket_dev_resume(&dev->dev);
++ return pcmcia_socket_dev_resume(dev);
+ }
++
++static struct dev_pm_ops yenta_pm_ops = {
++ .suspend_noirq = yenta_dev_suspend_noirq,
++ .resume_noirq = yenta_dev_resume_noirq,
++ .freeze_noirq = yenta_dev_suspend_noirq,
++ .thaw_noirq = yenta_dev_resume_noirq,
++ .poweroff_noirq = yenta_dev_suspend_noirq,
++ .restore_noirq = yenta_dev_resume_noirq,
++};
++
++#define YENTA_PM_OPS (¥ta_pm_ops)
++#else
++#define YENTA_PM_OPS NULL
+ #endif
+
+ #define CB_ID(vend,dev,type) \
+@@ -1376,10 +1387,7 @@ static struct pci_driver yenta_cardbus_d
+ .id_table = yenta_table,
+ .probe = yenta_probe,
+ .remove = __devexit_p(yenta_close),
+-#ifdef CONFIG_PM
+- .suspend = yenta_dev_suspend,
+- .resume = yenta_dev_resume,
+-#endif
++ .driver.pm = YENTA_PM_OPS,
+ };
+
+
--- /dev/null
+From 20d1752f3d6bd32beb90949559e0d14a0b234445 Mon Sep 17 00:00:00 2001
+From: Chuck Ebbert <cebbert@redhat.com>
+Date: Tue, 15 Sep 2009 01:53:21 -0400
+Subject: [CIFS] Re-enable Lanman security
+
+From: Chuck Ebbert <cebbert@redhat.com>
+
+commit 20d1752f3d6bd32beb90949559e0d14a0b234445 upstream.
+
+commit ac68392460ffefed13020967bae04edc4d3add06 ("[CIFS] Allow raw
+ntlmssp code to be enabled with sec=ntlmssp") added a new bit to the
+allowed security flags mask but seems to have inadvertently removed
+Lanman security from the allowed flags. Add it back.
+
+Signed-off-by: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/cifsglob.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -572,9 +572,9 @@ require use of the stronger protocol */
+ #define CIFSSEC_MUST_LANMAN 0x10010
+ #define CIFSSEC_MUST_PLNTXT 0x20020
+ #ifdef CONFIG_CIFS_UPCALL
+-#define CIFSSEC_MASK 0xAF0AF /* allows weak security but also krb5 */
++#define CIFSSEC_MASK 0xBF0BF /* allows weak security but also krb5 */
+ #else
+-#define CIFSSEC_MASK 0xA70A7 /* current flags supported if weak */
++#define CIFSSEC_MASK 0xB70B7 /* current flags supported if weak */
+ #endif /* UPCALL */
+ #else /* do not allow weak pw hash */
+ #ifdef CONFIG_CIFS_UPCALL
--- /dev/null
+From 0271edd4b1b16f255162029359bb69c1ee4d9c3b Mon Sep 17 00:00:00 2001
+From: Mike Frysinger <vapier@gentoo.org>
+Date: Thu, 6 Aug 2009 15:20:05 -0700
+Subject: serial: bfin_5xx: fix building as module when early printk is enabled
+
+From: Mike Frysinger <vapier@gentoo.org>
+
+commit 0271edd4b1b16f255162029359bb69c1ee4d9c3b upstream.
+
+Since early printk only makes sense/works when the serial driver is built
+into the kernel, disable the option for this driver when it is going to be
+built as a module. Otherwise we get build failures due to the ifdef
+handling.
+
+Signed-off-by: Mike Frysinger <vapier@gentoo.org>
+Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/serial/bfin_5xx.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/serial/bfin_5xx.c
++++ b/drivers/serial/bfin_5xx.c
+@@ -42,6 +42,10 @@
+ # undef CONFIG_EARLY_PRINTK
+ #endif
+
++#ifdef CONFIG_SERIAL_BFIN_MODULE
++# undef CONFIG_EARLY_PRINTK
++#endif
++
+ /* UART name and device definitions */
+ #define BFIN_SERIAL_NAME "ttyBF"
+ #define BFIN_SERIAL_MAJOR 204
--- /dev/null
+pata_amd-do-not-filter-out-valid-modes-in-nv_mode_filter.patch
+p54usb-add-zcomax-xg-705a-usbid.patch
+x86-increase-min_gap-to-include-randomized-stack.patch
+serial-bfin_5xx-fix-building-as-module-when-early-printk-is-enabled.patch
+usb-option.c-add-support-for-zte-ac2726-evdo-modem.patch
+usb-option-telit-uc864g-support.patch
+video-s3c_fb.c-fix-build-with-config_hotplug-n.patch
+kbuild-fix-cc1-options-check-to-ensure-we-do-not-use-fpic-when-compiling.patch
+drivers-mfd-ab3100-core.c-fix-powerpc-build-error.patch
+thinkpad-acpi-don-t-ask-about-brightness_mode-for-fw.-1v-and-1r.patch
+acpi-pci_slot.ko-wants-a-64-bit-_sun.patch
+fbcon-only-unbind-from-console-if-successfully-registered.patch
+kallsyms-fix-segfault-in-prefix_underscores_count.patch
+sisfb-change-sis_ddc_port-type-to-sisioaddress.patch
+mmc_spi-fail-gracefully-if-host-or-card-do-not-support-the-switch-command.patch
+alpha-agp-update.patch
+fs-make-sure-data-stored-into-inode-is-properly-seen-before-unlocking-new-inode.patch
+ecryptfs-handle-unrecognized-tag-3-cipher-codes.patch
+ecryptfs-check-for-o_rdonly-lower-inodes-when-opening-lower-files.patch
+ecryptfs-filename-encryption-only-supports-password-auth-tokens.patch
+ecryptfs-validate-global-auth-tok-keys.patch
+ecryptfs-prevent-lower-dentry-from-going-negative-during-unlink.patch
+re-enable-lanman-security.patch
+xen-make-fstack-protector-work-under-xen.patch
+xen-only-enable-interrupts-while-actually-blocking-for-spinlock.patch
+xen-use-stronger-barrier-after-unlocking-lock.patch
+xen-check-efer-for-nx-before-setting-up-gdt-mapping.patch
+perf_counter-fix-perf_copy_attr-pointer-arithmetic.patch
+perf-tools-fix-buffer-allocation.patch
+tty-serial-pcmcia-add-id-for-advantech-card.patch
+pm-pcmcia-drop-second-argument-of-pcmcia_socket_dev_suspend.patch
+pm-yenta-fix-cardbus-suspend-resume-regression.patch
+sony-laptop-check-for-rfkill-hard-block-at-load-time.patch
+nilfs2-fix-missing-zero-fill-initialization-of-btree-node-cache.patch
+ar9170usb-add-usbid-for-tp-link-tl-wn821n-v2.patch
+mtd-nand-fix-ecc-correction-bug-for-smc-ordering-for-ndfc-driver.patch
+mtd-ofpart-check-availability-of-reg-property-instead-of-name-property.patch
+mtd-cfi_cmdset_0002-add-0xff-intolerance-for-m29w128g.patch
+usb-serial-ftdi_sio-new-hardware-support-hameg-power-supply.patch
+usb-add-pids-for-ftdi-based-opendcc-hardware.patch
+usb-serial-ftdi-handle-gnice-jtag-adaptors.patch
+usb-cdc-wdm-driver-doesn-t-support-non-blocking-reads.patch
+usb-fix-cdc-acm-regression-in-open.patch
+cdc_acm-fix-to-use-modern-speed-interfaces.patch
+tty-remove-dtr-rts-use-from-the-driver-open-methods.patch
+tty-gigaset-really-fix-chars_in_buffer.patch
+kaweth-fix-memory-leak-in-kaweth_control.patch
+x86-sgi-uv-fix-ipi-macros.patch
+usb-serial-pl2303-new-hardware-support-sanwa-multimeter.patch
+usb-storage-fix-a-resume-path-gfp_noio-must-be-used.patch
+usb-usb-storage-fails-to-attach-to-huawei-datacard-cdrom-device.patch
+usb-usbtmc-sanity-checks-for-dev_dep_msg_in-urbs.patch
+usb-sl811-hcd-fix-device-disconnect.patch
+drm-i915-remove-restore-in-resume.patch
+drm-i915-only-destroy-a-constructed-mmap-offset.patch
+drm-i915-prevent-fifo-calculation-overflows-on-32-bits-with-high-dotclocks.patch
+drm-i915-add-buffer-to-inactive-list-immediately-during-fault.patch
+drm-i915-check-that-the-relocation-points-to-within-the-target.patch
+drm-i915-fix-typo-for-wrong-lvds-clock-setting-on-igdng.patch
+drm-i915-fix-ssc-frequence-for-igdng.patch
+drm-i915-remove-dac-disable-in-crt-force-detect-on-igdng.patch
+drm-i915-fix-lvds-panel-fitting-on-arrandale.patch
+drm-i915-use-the-crt-ddc-to-get-the-edid-for-dvi-connector-on-mac.patch
+drm-i915-fix-tiling-on-igdng.patch
+agp-intel-fix-the-pre-9xx-chipset-flush.patch
+nfsd4-fix-null-dereference-creating-nfsv4-callback-client.patch
+can-fix-nohz-local_softirq_pending-08-warning.patch
--- /dev/null
+From 532f649f148bf70e6a5816d95fe55e6a065e8754 Mon Sep 17 00:00:00 2001
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+Date: Tue, 22 Sep 2009 16:47:58 -0700
+Subject: sisfb: change SiS_DDC_Port type to SISIOADDRESS
+
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+
+commit 532f649f148bf70e6a5816d95fe55e6a065e8754 upstream.
+
+The patch enables the driver to be used on platforms such as ARM where an
+I/O address is a 32-bit memory address.
+
+The patch avoids the following kernel oops:
+
+debian:~# modprobe sisfb
+[ 73.070000] sisfb: Video ROM found
+[ 73.080000] sisfb: Video RAM at 0x80000000, mapped to 0xe0a00000, size 1024k
+[ 73.090000] sisfb: MMIO at 0x84080000, mapped to 0xe0b80000, size 256k
+[ 73.090000] sisfb: Memory heap starting at 800K, size 32K
+[ 73.360000] Unable to handle kernel paging request at virtual address 6e000844
+[ 73.380000] pgd = df230000
+[ 73.380000] [6e000844] *pgd=00000000
+[ 73.380000] Internal error: Oops: 8f5 [#1]
+[ 73.380000] Modules linked in: sisfb(+) fb cfbcopyarea cfbimgblt cfbfillrect
+[ 73.380000] CPU: 0 Not tainted (2.6.31-iop32x #1)
+[ 73.380000] PC is at SiS_SetRegANDOR+0x10/0x38 [sisfb]
+[ 73.380000] LR is at SiS_SetSCLKHigh+0x38/0x94 [sisfb]
+[ 73.380000] pc : [<bf01dc00>] lr : [<bf0238f8>] psr: 60000013
+[ 73.380000] sp : df38fd00 ip : 6e000000 fp : 00000002
+[ 73.380000] r10: 00000108 r9 : 00000000 r8 : 00000108
+[ 73.380000] r7 : df064258 r6 : 00000110 r5 : 6e000844 r4 : 0000010a
+[ 73.380000] r3 : 00000001 r2 : 0000000e r1 : 00000011 r0 : 00000844
+[ 73.380000] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
+[ 73.380000] Control: 0000397f Table: bf230000 DAC: 00000015
+[ 73.380000] Process modprobe (pid: 1849, stack limit = 0xdf38e270)
+[ 73.380000] Stack: (0xdf38fd00 to 0xdf390000)
+[ 73.380000] fd00: 0000010a 00000108 df064258 df064258 df064258 00000000 00000000 bf02c4e0
+[ 73.380000] fd20: 00000114 bf02c50c 00000013 00000114 0000010a df064258 00000000 bf02c980
+[ 73.380000] fd40: 00009c66 00000004 00000001 df064250 a0010000 a6a2a0a0 df064250 00000003
+[ 73.380000] fd60: df064250 00000000 df064258 0000fffd 00000000 00000000 00000000 bf033948
+[ 73.380000] fd80: 00000000 00000000 00000000 bf019e2c 00000000 df064a70 bf03b470 00010000
+[ 73.380000] fda0: 00000000 df064250 00000000 df831c00 00000012 bf039f70 00000000 c00abed8
+[ 73.380000] fdc0: 000008a6 000008a4 df0649b0 df064878 df064258 df064000 00000000 00000000
+[ 73.380000] fde0: 00000001 00008000 00000001 00030000 df81c930 bf049f88 df831c00 00000000
+[ 73.380000] fe00: bf049f58 df3952a0 c0447708 bf049f88 bf049fe0 c0191980 df831c00 c0191b10
+[ 73.380000] fe20: df831c58 bf049f58 df831c00 bf04aca8 df3952a0 df831c58 df831c58 bf049f88
+[ 73.380000] fe40: c01ba1b4 c01ba0a0 df831c58 df831c8c bf049f88 c01ba1b4 df3952a0 00000000
+[ 73.380000] fe60: c03e265c c01ba240 00000000 df38fe78 bf049f88 c01b990c df812938 df81b8d0
+[ 73.380000] fe80: df3952a0 df807780 00000000 00000060 bf049f88 c01b9224 bf0429c8 00000000
+[ 73.380000] fea0: bf049f58 00000000 bf049f88 00000000 00000000 bf04aea8 00000000 c01ba4e4
+[ 73.380000] fec0: e09861a0 bf049f58 00000000 bf049f88 00000000 c0191f20 00000000 00000000
+[ 73.380000] fee0: c03f7bac bf04d418 0000fff2 0000fff1 bf04ad08 0002f260 0002f260 e0986038
+[ 73.380000] ff00: e0986150 e098568b df143340 e0990280 00000036 c03d8b00 fffffffd 00000000
+[ 73.380000] ff20: bf04acfc 00000000 fffffffc 0003cf4b 00018098 c03f7bac 00000000 bf04d000
+[ 73.380000] ff40: df38e000 00000000 bedc0984 c00272a4 ffffffff c005bc88 00000000 00000000
+[ 73.380000] ff60: 0003cf4b 0003cf4b 00018098 bf04acfc 00000000 c0027fe8 df38e000 00000000
+[ 73.380000] ff80: bedc0984 c006882c 00001000 00000003 00000000 00009064 00000000 00008edc
+[ 73.380000] ffa0: 00000080 c0027e20 00009064 00000000 4014e000 0003cf4b 00018098 0003cf4b
+[ 73.380000] ffc0: 00009064 00000000 00008edc 00000080 00000000 00000000 40025000 bedc0984
+[ 73.380000] ffe0: 00000000 bedc08fc 0000b6b0 400e8f34 60000010 4014e000 00000000 00000000
+[ 73.380000] [<bf01dc00>] (SiS_SetRegANDOR+0x10/0x38 [sisfb]) from [<df064258>] (0xdf064258)
+[ 73.380000] Code: e92d0030 e20110ff e280546e e3a0c46e (e5c51000)
+[ 73.680000] ---[ end trace 62a93e01df37a5f2 ]---
+
+Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Cc: Thomas Winischhofer <thomas@winischhofer.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/sis/vstruct.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/video/sis/vstruct.h
++++ b/drivers/video/sis/vstruct.h
+@@ -342,7 +342,7 @@ struct SiS_Private
+ unsigned short SiS_RY4COE;
+ unsigned short SiS_LCDHDES;
+ unsigned short SiS_LCDVDES;
+- unsigned short SiS_DDC_Port;
++ SISIOADDRESS SiS_DDC_Port;
+ unsigned short SiS_DDC_Index;
+ unsigned short SiS_DDC_Data;
+ unsigned short SiS_DDC_NData;
--- /dev/null
+From 50fab0760a6c07cded229357a1351c325a575770 Mon Sep 17 00:00:00 2001
+From: Alan Jenkins <alan-jenkins@tuffmail.co.uk>
+Date: Thu, 24 Sep 2009 20:15:24 +0100
+Subject: sony-laptop: check for rfkill hard block at load time
+
+From: Alan Jenkins <alan-jenkins@tuffmail.co.uk>
+
+commit 50fab0760a6c07cded229357a1351c325a575770 upstream.
+
+"I recently (on a flight) I found out that when I boot with the hard-switch
+activated, so turning off all wireless activity on my laptop, the state
+is not correctly announced in /dev/rfkill (reading it with rfkill command,
+or my own gnome applet)...
+
+After turning off and on again the hard-switch the events were right."
+
+We can fix this by querying the firmware at load time and calling
+rfkill_set_hw_state().
+
+Signed-off-by: Alan Jenkins <alan-jenkins@tuffmail.co.uk>
+Tested-by: Norbert Preining <preining@logic.at>
+Acked-by: Johannes Berg <johannes@sipsolutions.net>
+Acked-by: Mattia Dongili <malattia@linux.it>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/sony-laptop.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/platform/x86/sony-laptop.c
++++ b/drivers/platform/x86/sony-laptop.c
+@@ -1081,6 +1081,8 @@ static int sony_nc_setup_rfkill(struct a
+ struct rfkill *rfk;
+ enum rfkill_type type;
+ const char *name;
++ int result;
++ bool hwblock;
+
+ switch (nc_type) {
+ case SONY_WIFI:
+@@ -1108,6 +1110,10 @@ static int sony_nc_setup_rfkill(struct a
+ if (!rfk)
+ return -ENOMEM;
+
++ sony_call_snc_handle(0x124, 0x200, &result);
++ hwblock = !(result & 0x1);
++ rfkill_set_hw_state(rfk, hwblock);
++
+ err = rfkill_register(rfk);
+ if (err) {
+ rfkill_destroy(rfk);
--- /dev/null
+From 6da25bf51689a5cc60370d30275dbb9e6852e0cb Mon Sep 17 00:00:00 2001
+From: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Date: Sat, 12 Sep 2009 15:22:11 -0300
+Subject: thinkpad-acpi: don't ask about brightness_mode for fw. 1V and 1R
+
+From: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+
+commit 6da25bf51689a5cc60370d30275dbb9e6852e0cb upstream.
+
+X40 (firmware 1V) and T41 (firmware 1R) have been confirmed to work
+well with the new defaults, so we can stop pestering people to confirm
+that fact.
+
+For now, whitelist just these two firmware types. It is best to have
+at least one more firmware type confirmed for Radeon 9xxx and Intel
+GMA-2 ThinkPads before removing the confirmation requests entirely.
+
+Reported-by: Robert de Rooy <robert.de.rooy@gmail.com>
+Signed-off-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/thinkpad_acpi.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -5655,16 +5655,16 @@ static const struct tpacpi_quirk brightn
+ /* Models with ATI GPUs known to require ECNVRAM mode */
+ TPACPI_Q_IBM('1', 'Y', TPACPI_BRGHT_Q_EC), /* T43/p ATI */
+
+- /* Models with ATI GPUs (waiting confirmation) */
+- TPACPI_Q_IBM('1', 'R', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
++ /* Models with ATI GPUs that can use ECNVRAM */
++ TPACPI_Q_IBM('1', 'R', TPACPI_BRGHT_Q_EC),
+ TPACPI_Q_IBM('1', 'Q', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
+ TPACPI_Q_IBM('7', '6', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
+ TPACPI_Q_IBM('7', '8', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_EC),
+
+- /* Models with Intel Extreme Graphics 2 (waiting confirmation) */
++ /* Models with Intel Extreme Graphics 2 */
++ TPACPI_Q_IBM('1', 'U', TPACPI_BRGHT_Q_NOEC),
+ TPACPI_Q_IBM('1', 'V', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_NOEC),
+ TPACPI_Q_IBM('1', 'W', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_NOEC),
+- TPACPI_Q_IBM('1', 'U', TPACPI_BRGHT_Q_ASK|TPACPI_BRGHT_Q_NOEC),
+
+ /* Models with Intel GMA900 */
+ TPACPI_Q_IBM('7', '0', TPACPI_BRGHT_Q_NOEC), /* T43, R52 */
--- /dev/null
+From a4304f2d5a3823deea894026ec95e43b33912357 Mon Sep 17 00:00:00 2001
+From: Tilman Schmidt <tilman@imap.cc>
+Date: Thu, 6 Aug 2009 20:33:33 -0700
+Subject: tty: gigaset: really fix chars_in_buffer
+
+From: Tilman Schmidt <tilman@imap.cc>
+
+commit a4304f2d5a3823deea894026ec95e43b33912357 upstream.
+
+The tty_operation chars_in_buffer() is not allowed to return a negative
+value to signal an error. Corrects the problem flagged by commit
+23198fda7182969b619613a555f8645fdc3dc334, "tty: fix chars_in_buffers".
+
+Signed-off-by: Tilman Schmidt <tilman@imap.cc>
+Cc: "David S. Miller" <davem@davemloft.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/isdn/gigaset/interface.c | 19 +++++++------------
+ 1 file changed, 7 insertions(+), 12 deletions(-)
+
+--- a/drivers/isdn/gigaset/interface.c
++++ b/drivers/isdn/gigaset/interface.c
+@@ -408,33 +408,28 @@ static int if_write_room(struct tty_stru
+ return retval;
+ }
+
+-/* FIXME: This function does not have error returns */
+-
+ static int if_chars_in_buffer(struct tty_struct *tty)
+ {
+ struct cardstate *cs;
+- int retval = -ENODEV;
++ int retval = 0;
+
+ cs = (struct cardstate *) tty->driver_data;
+ if (!cs) {
+ pr_err("%s: no cardstate\n", __func__);
+- return -ENODEV;
++ return 0;
+ }
+
+ gig_dbg(DEBUG_IF, "%u: %s()", cs->minor_index, __func__);
+
+- if (mutex_lock_interruptible(&cs->mutex))
+- return -ERESTARTSYS; // FIXME -EINTR?
++ mutex_lock(&cs->mutex);
+
+- if (!cs->connected) {
++ if (!cs->connected)
+ gig_dbg(DEBUG_IF, "not connected");
+- retval = -ENODEV;
+- } else if (!cs->open_count)
++ else if (!cs->open_count)
+ dev_warn(cs->dev, "%s: device not opened\n", __func__);
+- else if (cs->mstate != MS_LOCKED) {
++ else if (cs->mstate != MS_LOCKED)
+ dev_warn(cs->dev, "can't write to unlocked device\n");
+- retval = -EBUSY;
+- } else
++ else
+ retval = cs->ops->chars_in_buffer(cs);
+
+ mutex_unlock(&cs->mutex);
--- /dev/null
+From 9a68e39d4a701fb3be03cae9b462408664ebd205 Mon Sep 17 00:00:00 2001
+From: Alan Cox <alan@linux.intel.com>
+Date: Sat, 19 Sep 2009 13:13:24 -0700
+Subject: tty: remove dtr/rts use from the driver open methods
+
+From: Alan Cox <alan@linux.intel.com>
+
+commit 9a68e39d4a701fb3be03cae9b462408664ebd205 upstream.
+
+These are handled by the tty_port core code which will raise and lower the
+carrier correctly in tty_wait_until_ready
+
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/cp210x.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -399,12 +399,6 @@ static int cp210x_open(struct tty_struct
+
+ /* Configure the termios structure */
+ cp210x_get_termios(tty, port);
+-
+- /* Set the DTR and RTS pins low */
+- cp210x_tiocmset_port(tty ? (struct usb_serial_port *) tty->driver_data
+- : port,
+- NULL, TIOCM_DTR | TIOCM_RTS, 0);
+-
+ return 0;
+ }
+
--- /dev/null
+From 7a4b23104bd2624d16681158a9b338c502c103a0 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <w.sang@pengutronix.de>
+Date: Sat, 1 Aug 2009 15:28:35 +0200
+Subject: tty: serial/pcmcia: add ID for Advantech card
+
+From: Wolfram Sang <w.sang@pengutronix.de>
+
+commit 7a4b23104bd2624d16681158a9b338c502c103a0 upstream.
+
+Add ID as reported in:
+
+http://lists.infradead.org/pipermail/linux-pcmcia/2009-May/006127.html
+
+Reported-by: Kenneth Moorman <KMoorman@transy.edu>
+Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/serial/serial_cs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/serial/serial_cs.c
++++ b/drivers/serial/serial_cs.c
+@@ -884,6 +884,7 @@ static struct pcmcia_device_id serial_id
+ PCMCIA_DEVICE_CIS_MANF_CARD(0x0192, 0xa555, "SW_555_SER.cis"), /* Sierra Aircard 555 CDMA 1xrtt Modem -- pre update */
+ PCMCIA_DEVICE_CIS_MANF_CARD(0x013f, 0xa555, "SW_555_SER.cis"), /* Sierra Aircard 555 CDMA 1xrtt Modem -- post update */
+ PCMCIA_DEVICE_CIS_PROD_ID12("MultiTech", "PCMCIA 56K DataFax", 0x842047ee, 0xc2efcf03, "MT5634ZLX.cis"),
++ PCMCIA_DEVICE_CIS_PROD_ID12("ADVANTECH", "COMpad-32/85B-2", 0x96913a85, 0x27ab5437, "COMpad2.cis"),
+ PCMCIA_DEVICE_CIS_PROD_ID12("ADVANTECH", "COMpad-32/85B-4", 0x96913a85, 0xcec8f102, "COMpad4.cis"),
+ PCMCIA_DEVICE_CIS_PROD_ID123("ADVANTECH", "COMpad-32/85", "1.0", 0x96913a85, 0x8fbe92ae, 0x0877b627, "COMpad2.cis"),
+ PCMCIA_DEVICE_CIS_PROD_ID2("RS-COM 2P", 0xad20b156, "RS-COM-2P.cis"),
--- /dev/null
+From ec3815c3e14dc68d49428e6505ae99e86e5dd067 Mon Sep 17 00:00:00 2001
+From: mail@rainerkeller.de <mail@rainerkeller.de>
+Date: Thu, 3 Sep 2009 11:55:17 +0200
+Subject: USB: add PIDs for FTDI based OpenDCC hardware
+
+From: mail@rainerkeller.de <mail@rainerkeller.de>
+
+commit ec3815c3e14dc68d49428e6505ae99e86e5dd067 upstream.
+
+Some devices from the OpenDCC project are missing in the list
+of the FTDI PIDs. These PIDs are listed at
+http://www.opendcc.de/elektronik/usb/opendcc_usb.html
+(Sorry for the german only page.)
+This patch adds the three missing devices.
+
+Signed-off-by: Rainer Keller <mail@rainerkeller.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 3 +++
+ drivers/usb/serial/ftdi_sio.h | 3 +++
+ 2 files changed, 6 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -176,6 +176,9 @@ static struct usb_device_id id_table_com
+ { USB_DEVICE(FTDI_VID, FTDI_MICRO_CHAMELEON_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_RELAIS_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_SNIFFER_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_THROTTLE_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GATEWAY_PID) },
+ { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_IOBOARD_PID) },
+ { USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_MINI_IOBOARD_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_SPROG_II) },
+--- a/drivers/usb/serial/ftdi_sio.h
++++ b/drivers/usb/serial/ftdi_sio.h
+@@ -81,6 +81,9 @@
+
+ /* OpenDCC (www.opendcc.de) product id */
+ #define FTDI_OPENDCC_PID 0xBFD8
++#define FTDI_OPENDCC_SNIFFER_PID 0xBFD9
++#define FTDI_OPENDCC_THROTTLE_PID 0xBFDA
++#define FTDI_OPENDCC_GATEWAY_PID 0xBFDB
+
+ /* Sprog II (Andrew Crosland's SprogII DCC interface) */
+ #define FTDI_SPROG_II 0xF0C8
--- /dev/null
+From 7f1dc313d01f5f0f84c06051343a3b8623932d3c Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oliver@neukum.org>
+Date: Wed, 9 Sep 2009 10:12:48 +0200
+Subject: USB: CDC WDM driver doesn't support non-blocking reads
+
+From: Oliver Neukum <oliver@neukum.org>
+
+commit 7f1dc313d01f5f0f84c06051343a3b8623932d3c upstream.
+
+support for O_NONBLOCK in read and write path
+by simply not waiting for data in read or availability
+of the write urb in write but returning -EAGAIN
+
+Signed-off-by: Oliver Neukum <oliver@neukum.org>
+Tested-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/class/cdc-wdm.c | 30 ++++++++++++++++++++++++------
+ 1 file changed, 24 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -313,8 +313,13 @@ static ssize_t wdm_write
+ r = usb_autopm_get_interface(desc->intf);
+ if (r < 0)
+ goto outnp;
+- r = wait_event_interruptible(desc->wait, !test_bit(WDM_IN_USE,
+- &desc->flags));
++
++ if (!file->f_flags && O_NONBLOCK)
++ r = wait_event_interruptible(desc->wait, !test_bit(WDM_IN_USE,
++ &desc->flags));
++ else
++ if (test_bit(WDM_IN_USE, &desc->flags))
++ r = -EAGAIN;
+ if (r < 0)
+ goto out;
+
+@@ -377,7 +382,7 @@ outnl:
+ static ssize_t wdm_read
+ (struct file *file, char __user *buffer, size_t count, loff_t *ppos)
+ {
+- int rv, cntr;
++ int rv, cntr = 0;
+ int i = 0;
+ struct wdm_device *desc = file->private_data;
+
+@@ -389,10 +394,23 @@ static ssize_t wdm_read
+ if (desc->length == 0) {
+ desc->read = 0;
+ retry:
++ if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
++ rv = -ENODEV;
++ goto err;
++ }
+ i++;
+- rv = wait_event_interruptible(desc->wait,
+- test_bit(WDM_READ, &desc->flags));
++ if (file->f_flags & O_NONBLOCK) {
++ if (!test_bit(WDM_READ, &desc->flags)) {
++ rv = cntr ? cntr : -EAGAIN;
++ goto err;
++ }
++ rv = 0;
++ } else {
++ rv = wait_event_interruptible(desc->wait,
++ test_bit(WDM_READ, &desc->flags));
++ }
+
++ /* may have happened while we slept */
+ if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
+ rv = -ENODEV;
+ goto err;
+@@ -448,7 +466,7 @@ retry:
+
+ err:
+ mutex_unlock(&desc->rlock);
+- if (rv < 0)
++ if (rv < 0 && rv != -EAGAIN)
+ dev_err(&desc->intf->dev, "wdm_read: exit error\n");
+ return rv;
+ }
--- /dev/null
+From 7af25b4b34a2439020d78da765a3bed0ff73f25c Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oliver@neukum.org>
+Date: Tue, 8 Sep 2009 23:51:28 +0200
+Subject: USB: fix cdc-acm regression in open
+
+From: Oliver Neukum <oliver@neukum.org>
+
+commit 7af25b4b34a2439020d78da765a3bed0ff73f25c upstream.
+
+cdc-acm needs to set a flag during open to tell the
+tty layer that the device is initialized
+
+Signed-off-by: Oliver Neukum <oliver@neukum.org>
+Cc: Marcel Holtmann <marcel@holtmann.org>
+Cc: Paul Martin <pm@debian.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/class/cdc-acm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -59,6 +59,7 @@
+ #include <linux/init.h>
+ #include <linux/slab.h>
+ #include <linux/tty.h>
++#include <linux/serial.h>
+ #include <linux/tty_driver.h>
+ #include <linux/tty_flip.h>
+ #include <linux/module.h>
+@@ -609,6 +610,7 @@ static int acm_tty_open(struct tty_struc
+ acm->throttle = 0;
+
+ tasklet_schedule(&acm->urb_task);
++ set_bit(ASYNCB_INITIALIZED, &acm->port.flags);
+ rv = tty_port_block_til_ready(&acm->port, tty, filp);
+ done:
+ mutex_unlock(&acm->mutex);
--- /dev/null
+From ce60c48871d2b3a15ab3fa2450e783bebb4ae407 Mon Sep 17 00:00:00 2001
+From: Manuel Lauss <manuel.lauss@googlemail.com>
+Date: Tue, 1 Sep 2009 09:04:35 +0200
+Subject: USB: option: TELIT UC864G support
+
+From: Manuel Lauss <manuel.lauss@googlemail.com>
+
+commit ce60c48871d2b3a15ab3fa2450e783bebb4ae407 upstream.
+
+Add ID for Telit UC-864G GPS/UMTS/WCDMA modem and GPS receiver
+to the option driver.
+
+Signed-off-by: Manuel Lauss <manuel.lauss@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -292,6 +292,7 @@ static int option_resume(struct usb_ser
+
+ #define TELIT_VENDOR_ID 0x1bc7
+ #define TELIT_PRODUCT_UC864E 0x1003
++#define TELIT_PRODUCT_UC864G 0x1004
+
+ /* ZTE PRODUCTS */
+ #define ZTE_VENDOR_ID 0x19d2
+@@ -504,6 +505,7 @@ static struct usb_device_id option_ids[]
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
+ { USB_DEVICE(MAXON_VENDOR_ID, 0x6280) }, /* BP3-USB & BP3-EXT HSDPA */
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864E) },
++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864G) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0003, 0xff, 0xff, 0xff) },
--- /dev/null
+From a67d8e6c1e49dc919c9d5480583fad8a46fc00aa Mon Sep 17 00:00:00 2001
+From: Huzaifa Sidhpurwala <sidhpurwala.huzaifa@gmail.com>
+Date: Tue, 1 Sep 2009 10:07:41 +0530
+Subject: USB: option.c Add support for ZTE AC2726 EVDO modem
+
+From: Huzaifa Sidhpurwala <sidhpurwala.huzaifa@gmail.com>
+
+commit a67d8e6c1e49dc919c9d5480583fad8a46fc00aa upstream.
+
+A few days ago i got the latest ZTE EVDO modem shown at:
+http://img.alibaba.com/photo/240150115/ZTE_AC2726_EVDO_USB_Data_Modem.jpg
+
+It seems that the latest kernel does not have support for it.
+I wrote a small patch for the options.c module to add the relevant usb
+ids to it.
+
+From: Huzaifa Sidhpurwala <sidhpurwala.huzaifa@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -299,6 +299,7 @@ static int option_resume(struct usb_serial *serial);
+ #define ZTE_PRODUCT_MF626 0x0031
+ #define ZTE_PRODUCT_CDMA_TECH 0xfffe
+ #define ZTE_PRODUCT_AC8710 0xfff1
++#define ZTE_PRODUCT_AC2726 0xfff5
+
+ #define BENQ_VENDOR_ID 0x04a5
+ #define BENQ_PRODUCT_H10 0x4068
+@@ -571,6 +572,7 @@ static struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
+ { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
+ { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
+ { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H21_4512) },
--- /dev/null
+From 11eaf170363d264ff587f300e41c927ba5a33967 Mon Sep 17 00:00:00 2001
+From: Michael Hennerich <michael.hennerich@analog.com>
+Date: Mon, 14 Sep 2009 10:39:53 -0400
+Subject: USB: serial: ftdi: handle gnICE+ JTAG adaptors
+
+From: Michael Hennerich <michael.hennerich@analog.com>
+
+commit 11eaf170363d264ff587f300e41c927ba5a33967 upstream.
+
+Detect the UART on interface1 and blacklist interface0 (as that is the
+JTAG port).
+
+Signed-off-by: Michael Hennerich <michael.hennerich@analog.com>
+Signed-off-by: Mike Frysinger <vapier@gentoo.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 2 ++
+ drivers/usb/serial/ftdi_sio.h | 1 +
+ 2 files changed, 3 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -697,6 +697,8 @@ static struct usb_device_id id_table_com
+ { USB_DEVICE(DE_VID, WHT_PID) },
+ { USB_DEVICE(ADI_VID, ADI_GNICE_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
++ { USB_DEVICE(ADI_VID, ADI_GNICEPLUS_PID),
++ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) },
+ { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+--- a/drivers/usb/serial/ftdi_sio.h
++++ b/drivers/usb/serial/ftdi_sio.h
+@@ -933,6 +933,7 @@
+ */
+ #define ADI_VID 0x0456
+ #define ADI_GNICE_PID 0xF000
++#define ADI_GNICEPLUS_PID 0xF001
+
+ /*
+ * JETI SPECTROMETER SPECBOS 1201
--- /dev/null
+From e7d7fcc09ebde1ea1773521ecab5a3f0ad6bef6e Mon Sep 17 00:00:00 2001
+From: Pawel Ludwikow <pludwiko@rab.ict.pwr.wroc.pl>
+Date: Thu, 27 Aug 2009 14:15:50 +0200
+Subject: USB: serial: ftdi_sio: new hardware support - hameg power supply
+
+From: Pawel Ludwikow <pludwiko@rab.ict.pwr.wroc.pl>
+
+commit e7d7fcc09ebde1ea1773521ecab5a3f0ad6bef6e upstream.
+
+I'd like to present my small patch enabling to use Hameg HM8143 programmable
+power supply with linux.
+
+Signed-off-by: Pawel Ludwikow <pludwiko@rab.ict.pwr.wroc.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 2 ++
+ drivers/usb/serial/ftdi_sio.h | 6 ++++++
+ 2 files changed, 8 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -702,6 +702,8 @@ static struct usb_device_id id_table_com
+ { USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
+ { USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
++ { USB_DEVICE(FTDI_VID, HAMEG_HO820_PID) },
++ { USB_DEVICE(FTDI_VID, HAMEG_HO870_PID) },
+ { }, /* Optional parameter entry */
+ { } /* Terminating entry */
+ };
+--- a/drivers/usb/serial/ftdi_sio.h
++++ b/drivers/usb/serial/ftdi_sio.h
+@@ -968,6 +968,12 @@
+ #define MARVELL_OPENRD_PID 0x9e90
+
+ /*
++ * Hameg HO820 and HO870 interface (using VID 0x0403)
++ */
++#define HAMEG_HO820_PID 0xed74
++#define HAMEG_HO870_PID 0xed71
++
++/*
+ * BmRequestType: 1100 0000b
+ * bRequest: FTDI_E2_READ
+ * wValue: 0
--- /dev/null
+From 35904e6b5106fda51b04c8b8080c04466865415f Mon Sep 17 00:00:00 2001
+From: Pawel Ludwikow <pludwiko@rab.ict.pwr.wroc.pl>
+Date: Thu, 27 Aug 2009 14:15:50 +0200
+Subject: USB: serial: pl2303: new hardware support - sanwa multimeter
+
+From: Pawel Ludwikow <pludwiko@rab.ict.pwr.wroc.pl>
+
+commit 35904e6b5106fda51b04c8b8080c04466865415f upstream.
+
+I'd like to present my small patch enabling to use Sanwa PC5000
+mulitimeter with linux.
+
+Signed-off-by: Pawel Ludwikow <pludwiko@rab.ict.pwr.wroc.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/pl2303.c | 1 +
+ drivers/usb/serial/pl2303.h | 4 ++++
+ 2 files changed, 5 insertions(+)
+
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -96,6 +96,7 @@ static struct usb_device_id id_table []
+ { USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) },
+ { USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) },
+ { USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) },
++ { USB_DEVICE(SANWA_VENDOR_ID, SANWA_PRODUCT_ID) },
+ { } /* Terminating entry */
+ };
+
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -130,3 +130,7 @@
+ /* Sony, USB data cable for CMD-Jxx mobile phones */
+ #define SONY_VENDOR_ID 0x054c
+ #define SONY_QN3USB_PRODUCT_ID 0x0437
++
++/* Sanwa KB-USB2 multimeter cable (ID: 11ad:0001) */
++#define SANWA_VENDOR_ID 0x11ad
++#define SANWA_PRODUCT_ID 0x0001
--- /dev/null
+From eb661bc88252e5c6dc69df732e77e42981dd4d8b Mon Sep 17 00:00:00 2001
+From: Hennerich, Michael <Michael.Hennerich@analog.com>
+Date: Wed, 2 Sep 2009 09:26:21 +0100
+Subject: USB: sl811-hcd: Fix device disconnect:
+
+From: Hennerich, Michael <Michael.Hennerich@analog.com>
+
+commit eb661bc88252e5c6dc69df732e77e42981dd4d8b upstream.
+
+SL811 Device detected after removal used to be working in linux-2.6.22
+but then broke somewhere between 2.6.22 and 2.6.28. Current
+hub_port_connect_change() in drivers/usb/core/hub.c won't call
+usb_disconnect() in case the SL811 driver sets portstatus
+USB_PORT_FEAT_CONNECTION upon removal.
+AFAIK the SL811 has only a combined Device Insert/Remove
+detection bit, therefore use a count to distinguish insert or remove.
+
+
+Signed-Off-By: Michael Hennerich <hennerich@blackfin.uclinux.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/sl811-hcd.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/sl811-hcd.c
++++ b/drivers/usb/host/sl811-hcd.c
+@@ -719,8 +719,12 @@ retry:
+ /* port status seems weird until after reset, so
+ * force the reset and make khubd clean up later.
+ */
+- sl811->port1 |= (1 << USB_PORT_FEAT_C_CONNECTION)
+- | (1 << USB_PORT_FEAT_CONNECTION);
++ if (sl811->stat_insrmv & 1)
++ sl811->port1 |= 1 << USB_PORT_FEAT_CONNECTION;
++ else
++ sl811->port1 &= ~(1 << USB_PORT_FEAT_CONNECTION);
++
++ sl811->port1 |= 1 << USB_PORT_FEAT_C_CONNECTION;
+
+ } else if (irqstat & SL11H_INTMASK_RD) {
+ if (sl811->port1 & (1 << USB_PORT_FEAT_SUSPEND)) {
--- /dev/null
+From e5dc8ae121592239c2a2521d383bcb789849b2a3 Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oliver@neukum.org>
+Date: Wed, 26 Aug 2009 19:56:12 +0200
+Subject: USB: storage: fix a resume path GFP_NOIO must be used
+
+From: Oliver Neukum <oliver@neukum.org>
+
+commit e5dc8ae121592239c2a2521d383bcb789849b2a3 upstream.
+
+In the resume path of a block driver GFP_NOIO must be used to
+avoid a possible deadlock. The onetouch subdriver of storage violates
+the requirement.
+
+Signed-off-by: Oliver Neukum <oliver@neukum.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/storage/onetouch.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/storage/onetouch.c
++++ b/drivers/usb/storage/onetouch.c
+@@ -163,7 +163,7 @@ static void usb_onetouch_pm_hook(struct
+ usb_kill_urb(onetouch->irq);
+ break;
+ case US_RESUME:
+- if (usb_submit_urb(onetouch->irq, GFP_KERNEL) != 0)
++ if (usb_submit_urb(onetouch->irq, GFP_NOIO) != 0)
+ dev_err(&onetouch->irq->dev->dev,
+ "usb_submit_urb failed\n");
+ break;
--- /dev/null
+From d0defb855c8504c49b92bdc0203689ce9b4cf7ba Mon Sep 17 00:00:00 2001
+From: fangxiaozhi <huananhu@huawei.com>
+Date: Fri, 7 Aug 2009 12:30:35 +0800
+Subject: USB: usb-storage fails to attach to Huawei Datacard cdrom device
+
+From: fangxiaozhi <huananhu@huawei.com>
+
+commit d0defb855c8504c49b92bdc0203689ce9b4cf7ba upstream.
+
+In this patch, we always make the return value of function
+usb_stor_huawei_e220_init to be zero. Then it will not prevent usb-storage
+driver from attaching to the CDROM device of Huawei Datacard.
+
+Signed-off-by: fangxiaozhi <huananhu@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/storage/initializers.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/storage/initializers.c
++++ b/drivers/usb/storage/initializers.c
+@@ -102,5 +102,5 @@ int usb_stor_huawei_e220_init(struct us_
+ USB_TYPE_STANDARD | USB_RECIP_DEVICE,
+ 0x01, 0x0, NULL, 0x0, 1000);
+ US_DEBUGP("Huawei mode set result is %d\n", result);
+- return (result ? 0 : -ENODEV);
++ return 0;
+ }
--- /dev/null
+From 665d7662d15441b4b3e54131a9418a1a198d0d31 Mon Sep 17 00:00:00 2001
+From: Guus Sliepen <guus@sliepen.org>
+Date: Wed, 22 Jul 2009 17:39:42 +0200
+Subject: USB: usbtmc: sanity checks for DEV_DEP_MSG_IN urbs
+
+From: Guus Sliepen <guus@sliepen.org>
+
+commit 665d7662d15441b4b3e54131a9418a1a198d0d31 upstream.
+
+According to the specifications, an instrument should not return more data in a
+DEV_DEP_MSG_IN urb than requested. However, some instruments can send more
+than requested. This could cause the kernel to write the extra data past the
+end of the buffer provided by read().
+
+Fix this by checking that the value of the TranserSize field is not larger than
+the urb itself and not larger than the size of the userspace buffer. Also
+correctly decrement the remaining size of the buffer when userspace read()s
+more than USBTMC_SIZE_IOBUFFER.
+
+Signed-off-by: Guus Sliepen <guus@sliepen.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/class/usbtmc.c | 22 ++++++++++++++++++----
+ 1 file changed, 18 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/class/usbtmc.c
++++ b/drivers/usb/class/usbtmc.c
+@@ -367,13 +367,13 @@ static ssize_t usbtmc_read(struct file *
+ {
+ struct usbtmc_device_data *data;
+ struct device *dev;
+- unsigned long int n_characters;
++ u32 n_characters;
+ u8 *buffer;
+ int actual;
+- int done;
+- int remaining;
++ size_t done;
++ size_t remaining;
+ int retval;
+- int this_part;
++ size_t this_part;
+
+ /* Get pointer to private data structure */
+ data = filp->private_data;
+@@ -455,6 +455,18 @@ static ssize_t usbtmc_read(struct file *
+ (buffer[6] << 16) +
+ (buffer[7] << 24);
+
++ /* Ensure the instrument doesn't lie about it */
++ if(n_characters > actual - 12) {
++ dev_err(dev, "Device lies about message size: %zu > %zu\n", n_characters, actual - 12);
++ n_characters = actual - 12;
++ }
++
++ /* Ensure the instrument doesn't send more back than requested */
++ if(n_characters > this_part) {
++ dev_err(dev, "Device returns more than requested: %zu > %zu\n", done + n_characters, done + this_part);
++ n_characters = this_part;
++ }
++
+ /* Copy buffer to user space */
+ if (copy_to_user(buf + done, &buffer[12], n_characters)) {
+ /* There must have been an addressing problem */
+@@ -465,6 +477,8 @@ static ssize_t usbtmc_read(struct file *
+ done += n_characters;
+ if (n_characters < USBTMC_SIZE_IOBUFFER)
+ remaining = 0;
++ else
++ remaining -= n_characters;
+ }
+
+ /* Update file position value */
--- /dev/null
+From 3163eaba34943967aebb1eefa0d4bdc4e5dc197c Mon Sep 17 00:00:00 2001
+From: Peter Korsgaard <jacmet@sunsite.dk>
+Date: Tue, 22 Sep 2009 16:47:55 -0700
+Subject: video: s3c_fb.c: fix build with CONFIG_HOTPLUG=n
+
+From: Peter Korsgaard <jacmet@sunsite.dk>
+
+commit 3163eaba34943967aebb1eefa0d4bdc4e5dc197c upstream.
+
+Fixes `s3c_fb_remove' referenced in section `.data' of
+drivers/built-in.o: defined in discarded section `.devexit.text' of
+drivers/built-in.o
+
+With CONFIG_HOTPLUG=n, functions marked with __devexit gets removed,
+so make sure we use __devexit_p when referencing pointers to them.
+
+Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
+Acked-by: Ben Dooks <ben-linux@fluff.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/s3c-fb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/video/s3c-fb.c
++++ b/drivers/video/s3c-fb.c
+@@ -1036,7 +1036,7 @@ static int s3c_fb_resume(struct platform
+
+ static struct platform_driver s3c_fb_driver = {
+ .probe = s3c_fb_probe,
+- .remove = s3c_fb_remove,
++ .remove = __devexit_p(s3c_fb_remove),
+ .suspend = s3c_fb_suspend,
+ .resume = s3c_fb_resume,
+ .driver = {
--- /dev/null
+From 80938332d8cf652f6b16e0788cf0ca136befe0b5 Mon Sep 17 00:00:00 2001
+From: Michal Hocko <mhocko@suse.cz>
+Date: Tue, 8 Sep 2009 11:01:55 +0200
+Subject: x86: Increase MIN_GAP to include randomized stack
+
+From: Michal Hocko <mhocko@suse.cz>
+
+commit 80938332d8cf652f6b16e0788cf0ca136befe0b5 upstream.
+
+Currently we are not including randomized stack size when calculating
+mmap_base address in arch_pick_mmap_layout for topdown case. This might
+cause that mmap_base starts in the stack reserved area because stack is
+randomized by 1GB for 64b (8MB for 32b) and the minimum gap is 128MB.
+
+If the stack really grows down to mmap_base then we can get silent mmap
+region overwrite by the stack values.
+
+Let's include maximum stack randomization size into MIN_GAP which is
+used as the low bound for the gap in mmap.
+
+Signed-off-by: Michal Hocko <mhocko@suse.cz>
+LKML-Reference: <1252400515-6866-1-git-send-email-mhocko@suse.cz>
+Acked-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/elf.h | 2 ++
+ arch/x86/mm/mmap.c | 17 +++++++++++++++--
+ 2 files changed, 17 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/include/asm/elf.h
++++ b/arch/x86/include/asm/elf.h
+@@ -299,6 +299,8 @@ do { \
+
+ #ifdef CONFIG_X86_32
+
++#define STACK_RND_MASK (0x7ff)
++
+ #define VDSO_HIGH_BASE (__fix_to_virt(FIX_VDSO))
+
+ #define ARCH_DLINFO ARCH_DLINFO_IA32(vdso_enabled)
+--- a/arch/x86/mm/mmap.c
++++ b/arch/x86/mm/mmap.c
+@@ -29,13 +29,26 @@
+ #include <linux/random.h>
+ #include <linux/limits.h>
+ #include <linux/sched.h>
++#include <asm/elf.h>
++
++static unsigned int stack_maxrandom_size(void)
++{
++ unsigned int max = 0;
++ if ((current->flags & PF_RANDOMIZE) &&
++ !(current->personality & ADDR_NO_RANDOMIZE)) {
++ max = ((-1U) & STACK_RND_MASK) << PAGE_SHIFT;
++ }
++
++ return max;
++}
++
+
+ /*
+ * Top of mmap area (just below the process stack).
+ *
+- * Leave an at least ~128 MB hole.
++ * Leave an at least ~128 MB hole with possible stack randomization.
+ */
+-#define MIN_GAP (128*1024*1024)
++#define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
+ #define MAX_GAP (TASK_SIZE/6*5)
+
+ /*
--- /dev/null
+From d2374aecda3f6c9b0d13287027132a37311da300 Mon Sep 17 00:00:00 2001
+From: Jack Steiner <steiner@sgi.com>
+Date: Wed, 9 Sep 2009 10:41:05 -0500
+Subject: x86: SGI UV: Fix IPI macros
+
+From: Jack Steiner <steiner@sgi.com>
+
+commit d2374aecda3f6c9b0d13287027132a37311da300 upstream.
+
+The UV BIOS has changed the way interrupt remapping is being done.
+This affects the id used for sending IPIs. The upper id bits no
+longer need to be masked off.
+
+Signed-off-by: Jack Steiner <steiner@sgi.com>
+LKML-Reference: <20090909154104.GA25083@sgi.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/uv/uv_hub.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/include/asm/uv/uv_hub.h
++++ b/arch/x86/include/asm/uv/uv_hub.h
+@@ -422,7 +422,7 @@ static inline void uv_hub_send_ipi(int p
+ unsigned long val;
+
+ val = (1UL << UVH_IPI_INT_SEND_SHFT) |
+- ((apicid & 0x3f) << UVH_IPI_INT_APIC_ID_SHFT) |
++ ((apicid) << UVH_IPI_INT_APIC_ID_SHFT) |
+ (vector << UVH_IPI_INT_VECTOR_SHFT);
+ uv_write_global_mmr64(pnode, UVH_IPI_INT, val);
+ }
--- /dev/null
+From b75fe4e5b869f8dbebd36df64a7fcda0c5b318ed Mon Sep 17 00:00:00 2001
+From: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Date: Mon, 21 Sep 2009 13:34:06 -0700
+Subject: xen: check EFER for NX before setting up GDT mapping
+
+From: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+
+commit b75fe4e5b869f8dbebd36df64a7fcda0c5b318ed upstream.
+
+x86-64 assumes NX is available by default, so we need to
+explicitly check for it before using NX. Some first-generation
+Intel x86-64 processors didn't support NX, and even recent systems
+allow it to be disabled in BIOS.
+
+[ Impact: prevent Xen crash on NX-less 64-bit machines ]
+
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/mm/Makefile | 1 +
+ arch/x86/xen/enlighten.c | 10 +++++-----
+ 2 files changed, 6 insertions(+), 5 deletions(-)
+
+--- a/arch/x86/mm/Makefile
++++ b/arch/x86/mm/Makefile
+@@ -4,6 +4,7 @@ obj-y := init.o init_$(BITS).o fault.o
+ # Make sure __phys_addr has no stackprotector
+ nostackp := $(call cc-option, -fno-stack-protector)
+ CFLAGS_ioremap.o := $(nostackp)
++CFLAGS_init.o := $(nostackp)
+
+ obj-$(CONFIG_SMP) += tlb.o
+
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -1083,6 +1083,11 @@ asmlinkage void __init xen_start_kernel(
+
+ __supported_pte_mask |= _PAGE_IOMAP;
+
++#ifdef CONFIG_X86_64
++ /* Work out if we support NX */
++ check_efer();
++#endif
++
+ xen_setup_features();
+
+ /* Get mfn list */
+@@ -1123,11 +1128,6 @@ asmlinkage void __init xen_start_kernel(
+
+ pgd = (pgd_t *)xen_start_info->pt_base;
+
+-#ifdef CONFIG_X86_64
+- /* Work out if we support NX */
+- check_efer();
+-#endif
+-
+ /* Don't do the full vcpu_info placement stuff until we have a
+ possible map and a non-dummy shared_info. */
+ per_cpu(xen_vcpu, 0) = &HYPERVISOR_shared_info->vcpu_info[0];
--- /dev/null
+From 577eebeae34d340685d8985dfdb7dfe337c511e8 Mon Sep 17 00:00:00 2001
+From: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Date: Thu, 27 Aug 2009 12:46:35 -0700
+Subject: xen: make -fstack-protector work under Xen
+
+From: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+
+commit 577eebeae34d340685d8985dfdb7dfe337c511e8 upstream.
+
+-fstack-protector uses a special per-cpu "stack canary" value.
+gcc generates special code in each function to test the canary to make
+sure that the function's stack hasn't been overrun.
+
+On x86-64, this is simply an offset of %gs, which is the usual per-cpu
+base segment register, so setting it up simply requires loading %gs's
+base as normal.
+
+On i386, the stack protector segment is %gs (rather than the usual kernel
+percpu %fs segment register). This requires setting up the full kernel
+GDT and then loading %gs accordingly. We also need to make sure %gs is
+initialized when bringing up secondary cpus too.
+
+To keep things consistent, we do the full GDT/segment register setup on
+both architectures.
+
+Because we need to avoid -fstack-protected code before setting up the GDT
+and because there's no way to disable it on a per-function basis, several
+files need to have stack-protector inhibited.
+
+[ Impact: allow Xen booting with stack-protector enabled ]
+
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/mm/Makefile | 4 +
+ arch/x86/xen/Makefile | 2
+ arch/x86/xen/enlighten.c | 131 ++++++++++++++++++++++++++++++++++++++++-------
+ arch/x86/xen/smp.c | 1
+ drivers/xen/Makefile | 3 +
+ 5 files changed, 122 insertions(+), 19 deletions(-)
+
+--- a/arch/x86/mm/Makefile
++++ b/arch/x86/mm/Makefile
+@@ -1,6 +1,10 @@
+ obj-y := init.o init_$(BITS).o fault.o ioremap.o extable.o pageattr.o mmap.o \
+ pat.o pgtable.o gup.o
+
++# Make sure __phys_addr has no stackprotector
++nostackp := $(call cc-option, -fno-stack-protector)
++CFLAGS_ioremap.o := $(nostackp)
++
+ obj-$(CONFIG_SMP) += tlb.o
+
+ obj-$(CONFIG_X86_32) += pgtable_32.o iomap_32.o
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -51,6 +51,7 @@
+ #include <asm/pgtable.h>
+ #include <asm/tlbflush.h>
+ #include <asm/reboot.h>
++#include <asm/stackprotector.h>
+
+ #include "xen-ops.h"
+ #include "mmu.h"
+@@ -330,18 +331,28 @@ static void xen_load_gdt(const struct de
+ unsigned long frames[pages];
+ int f;
+
+- /* A GDT can be up to 64k in size, which corresponds to 8192
+- 8-byte entries, or 16 4k pages.. */
++ /*
++ * A GDT can be up to 64k in size, which corresponds to 8192
++ * 8-byte entries, or 16 4k pages..
++ */
+
+ BUG_ON(size > 65536);
+ BUG_ON(va & ~PAGE_MASK);
+
+ for (f = 0; va < dtr->address + size; va += PAGE_SIZE, f++) {
+ int level;
+- pte_t *ptep = lookup_address(va, &level);
++ pte_t *ptep;
+ unsigned long pfn, mfn;
+ void *virt;
+
++ /*
++ * The GDT is per-cpu and is in the percpu data area.
++ * That can be virtually mapped, so we need to do a
++ * page-walk to get the underlying MFN for the
++ * hypercall. The page can also be in the kernel's
++ * linear range, so we need to RO that mapping too.
++ */
++ ptep = lookup_address(va, &level);
+ BUG_ON(ptep == NULL);
+
+ pfn = pte_pfn(*ptep);
+@@ -358,6 +369,44 @@ static void xen_load_gdt(const struct de
+ BUG();
+ }
+
++/*
++ * load_gdt for early boot, when the gdt is only mapped once
++ */
++static __init void xen_load_gdt_boot(const struct desc_ptr *dtr)
++{
++ unsigned long va = dtr->address;
++ unsigned int size = dtr->size + 1;
++ unsigned pages = (size + PAGE_SIZE - 1) / PAGE_SIZE;
++ unsigned long frames[pages];
++ int f;
++
++ /*
++ * A GDT can be up to 64k in size, which corresponds to 8192
++ * 8-byte entries, or 16 4k pages..
++ */
++
++ BUG_ON(size > 65536);
++ BUG_ON(va & ~PAGE_MASK);
++
++ for (f = 0; va < dtr->address + size; va += PAGE_SIZE, f++) {
++ pte_t pte;
++ unsigned long pfn, mfn;
++
++ pfn = virt_to_pfn(va);
++ mfn = pfn_to_mfn(pfn);
++
++ pte = pfn_pte(pfn, PAGE_KERNEL_RO);
++
++ if (HYPERVISOR_update_va_mapping((unsigned long)va, pte, 0))
++ BUG();
++
++ frames[f] = mfn;
++ }
++
++ if (HYPERVISOR_set_gdt(frames, size / sizeof(struct desc_struct)))
++ BUG();
++}
++
+ static void load_TLS_descriptor(struct thread_struct *t,
+ unsigned int cpu, unsigned int i)
+ {
+@@ -581,6 +630,29 @@ static void xen_write_gdt_entry(struct d
+ preempt_enable();
+ }
+
++/*
++ * Version of write_gdt_entry for use at early boot-time needed to
++ * update an entry as simply as possible.
++ */
++static __init void xen_write_gdt_entry_boot(struct desc_struct *dt, int entry,
++ const void *desc, int type)
++{
++ switch (type) {
++ case DESC_LDT:
++ case DESC_TSS:
++ /* ignore */
++ break;
++
++ default: {
++ xmaddr_t maddr = virt_to_machine(&dt[entry]);
++
++ if (HYPERVISOR_update_descriptor(maddr.maddr, *(u64 *)desc))
++ dt[entry] = *(struct desc_struct *)desc;
++ }
++
++ }
++}
++
+ static void xen_load_sp0(struct tss_struct *tss,
+ struct thread_struct *thread)
+ {
+@@ -965,6 +1037,23 @@ static const struct machine_ops __initda
+ .emergency_restart = xen_emergency_restart,
+ };
+
++/*
++ * Set up the GDT and segment registers for -fstack-protector. Until
++ * we do this, we have to be careful not to call any stack-protected
++ * function, which is most of the kernel.
++ */
++static void __init xen_setup_stackprotector(void)
++{
++ pv_cpu_ops.write_gdt_entry = xen_write_gdt_entry_boot;
++ pv_cpu_ops.load_gdt = xen_load_gdt_boot;
++
++ setup_stack_canary_segment(0);
++ switch_to_new_gdt(0);
++
++ pv_cpu_ops.write_gdt_entry = xen_write_gdt_entry;
++ pv_cpu_ops.load_gdt = xen_load_gdt;
++}
++
+ /* First C function to be called on Xen boot */
+ asmlinkage void __init xen_start_kernel(void)
+ {
+@@ -983,13 +1072,28 @@ asmlinkage void __init xen_start_kernel(
+ pv_apic_ops = xen_apic_ops;
+ pv_mmu_ops = xen_mmu_ops;
+
+-#ifdef CONFIG_X86_64
+ /*
+- * Setup percpu state. We only need to do this for 64-bit
+- * because 32-bit already has %fs set properly.
++ * Set up some pagetable state before starting to set any ptes.
+ */
+- load_percpu_segment(0);
+-#endif
++
++ /* Prevent unwanted bits from being set in PTEs. */
++ __supported_pte_mask &= ~_PAGE_GLOBAL;
++ if (!xen_initial_domain())
++ __supported_pte_mask &= ~(_PAGE_PWT | _PAGE_PCD);
++
++ __supported_pte_mask |= _PAGE_IOMAP;
++
++ xen_setup_features();
++
++ /* Get mfn list */
++ if (!xen_feature(XENFEAT_auto_translated_physmap))
++ xen_build_dynamic_phys_to_machine();
++
++ /*
++ * Set up kernel GDT and segment registers, mainly so that
++ * -fstack-protector code can be executed.
++ */
++ xen_setup_stackprotector();
+
+ xen_init_irq_ops();
+ xen_init_cpuid_mask();
+@@ -1001,8 +1105,6 @@ asmlinkage void __init xen_start_kernel(
+ set_xen_basic_apic_ops();
+ #endif
+
+- xen_setup_features();
+-
+ if (xen_feature(XENFEAT_mmu_pt_update_preserve_ad)) {
+ pv_mmu_ops.ptep_modify_prot_start = xen_ptep_modify_prot_start;
+ pv_mmu_ops.ptep_modify_prot_commit = xen_ptep_modify_prot_commit;
+@@ -1019,17 +1121,8 @@ asmlinkage void __init xen_start_kernel(
+
+ xen_smp_init();
+
+- /* Get mfn list */
+- if (!xen_feature(XENFEAT_auto_translated_physmap))
+- xen_build_dynamic_phys_to_machine();
+-
+ pgd = (pgd_t *)xen_start_info->pt_base;
+
+- /* Prevent unwanted bits from being set in PTEs. */
+- __supported_pte_mask &= ~_PAGE_GLOBAL;
+- if (!xen_initial_domain())
+- __supported_pte_mask &= ~(_PAGE_PWT | _PAGE_PCD);
+-
+ #ifdef CONFIG_X86_64
+ /* Work out if we support NX */
+ check_efer();
+--- a/arch/x86/xen/Makefile
++++ b/arch/x86/xen/Makefile
+@@ -8,6 +8,7 @@ endif
+ # Make sure early boot has no stackprotector
+ nostackp := $(call cc-option, -fno-stack-protector)
+ CFLAGS_enlighten.o := $(nostackp)
++CFLAGS_mmu.o := $(nostackp)
+
+ obj-y := enlighten.o setup.o multicalls.o mmu.o irq.o \
+ time.o xen-asm.o xen-asm_$(BITS).o \
+@@ -16,3 +17,4 @@ obj-y := enlighten.o setup.o multicalls
+ obj-$(CONFIG_SMP) += smp.o
+ obj-$(CONFIG_PARAVIRT_SPINLOCKS)+= spinlock.o
+ obj-$(CONFIG_XEN_DEBUG_FS) += debugfs.o
++
+--- a/arch/x86/xen/smp.c
++++ b/arch/x86/xen/smp.c
+@@ -236,6 +236,7 @@ cpu_initialize_context(unsigned int cpu,
+ ctxt->user_regs.ss = __KERNEL_DS;
+ #ifdef CONFIG_X86_32
+ ctxt->user_regs.fs = __KERNEL_PERCPU;
++ ctxt->user_regs.gs = __KERNEL_STACK_CANARY;
+ #else
+ ctxt->gs_base_kernel = per_cpu_offset(cpu);
+ #endif
+--- a/drivers/xen/Makefile
++++ b/drivers/xen/Makefile
+@@ -1,6 +1,9 @@
+ obj-y += grant-table.o features.o events.o manage.o
+ obj-y += xenbus/
+
++nostackp := $(call cc-option, -fno-stack-protector)
++CFLAGS_features.o := $(nostackp)
++
+ obj-$(CONFIG_HOTPLUG_CPU) += cpu_hotplug.o
+ obj-$(CONFIG_XEN_XENCOMM) += xencomm.o
+ obj-$(CONFIG_XEN_BALLOON) += balloon.o
--- /dev/null
+From 4d576b57b50a92801e6493e76e5243d6cff193d2 Mon Sep 17 00:00:00 2001
+From: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Date: Wed, 9 Sep 2009 12:33:51 -0700
+Subject: xen: only enable interrupts while actually blocking for spinlock
+
+From: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+
+commit 4d576b57b50a92801e6493e76e5243d6cff193d2 upstream.
+
+Where possible we enable interrupts while waiting for a spinlock to
+become free, in order to reduce big latency spikes in interrupt handling.
+
+However, at present if we manage to pick up the spinlock just before
+blocking, we'll end up holding the lock with interrupts enabled for a
+while. This will cause a deadlock if we recieve an interrupt in that
+window, and the interrupt handler tries to take the lock too.
+
+Solve this by shrinking the interrupt-enabled region to just around the
+blocking call.
+
+[ Impact: avoid race/deadlock when using Xen PV spinlocks ]
+
+Reported-by: "Yang, Xiaowei" <xiaowei.yang@intel.com>
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/xen/spinlock.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+--- a/arch/x86/xen/spinlock.c
++++ b/arch/x86/xen/spinlock.c
+@@ -187,7 +187,6 @@ static noinline int xen_spin_lock_slow(s
+ struct xen_spinlock *prev;
+ int irq = __get_cpu_var(lock_kicker_irq);
+ int ret;
+- unsigned long flags;
+ u64 start;
+
+ /* If kicker interrupts not initialized yet, just spin */
+@@ -199,16 +198,12 @@ static noinline int xen_spin_lock_slow(s
+ /* announce we're spinning */
+ prev = spinning_lock(xl);
+
+- flags = __raw_local_save_flags();
+- if (irq_enable) {
+- ADD_STATS(taken_slow_irqenable, 1);
+- raw_local_irq_enable();
+- }
+-
+ ADD_STATS(taken_slow, 1);
+ ADD_STATS(taken_slow_nested, prev != NULL);
+
+ do {
++ unsigned long flags;
++
+ /* clear pending */
+ xen_clear_irq_pending(irq);
+
+@@ -228,6 +223,12 @@ static noinline int xen_spin_lock_slow(s
+ goto out;
+ }
+
++ flags = __raw_local_save_flags();
++ if (irq_enable) {
++ ADD_STATS(taken_slow_irqenable, 1);
++ raw_local_irq_enable();
++ }
++
+ /*
+ * Block until irq becomes pending. If we're
+ * interrupted at this point (after the trylock but
+@@ -238,13 +239,15 @@ static noinline int xen_spin_lock_slow(s
+ * pending.
+ */
+ xen_poll_irq(irq);
++
++ raw_local_irq_restore(flags);
++
+ ADD_STATS(taken_slow_spurious, !xen_test_irq_pending(irq));
+ } while (!xen_test_irq_pending(irq)); /* check for spurious wakeups */
+
+ kstat_incr_irqs_this_cpu(irq, irq_to_desc(irq));
+
+ out:
+- raw_local_irq_restore(flags);
+ unspinning_lock(xl, prev);
+ spin_time_accum_blocked(start);
+
--- /dev/null
+From 2496afbf1e50c70f80992656bcb730c8583ddac3 Mon Sep 17 00:00:00 2001
+From: Yang Xiaowei <xiaowei.yang@intel.com>
+Date: Wed, 9 Sep 2009 12:44:52 -0700
+Subject: xen: use stronger barrier after unlocking lock
+
+From: Yang Xiaowei <xiaowei.yang@intel.com>
+
+commit 2496afbf1e50c70f80992656bcb730c8583ddac3 upstream.
+
+We need to have a stronger barrier between releasing the lock and
+checking for any waiting spinners. A compiler barrier is not sufficient
+because the CPU's ordering rules do not prevent the read xl->spinners
+from happening before the unlock assignment, as they are different
+memory locations.
+
+We need to have an explicit barrier to enforce the write-read ordering
+to different memory locations.
+
+Because of it, I can't bring up > 4 HVM guests on one SMP machine.
+
+[ Code and commit comments expanded -J ]
+
+[ Impact: avoid deadlock when using Xen PV spinlocks ]
+
+Signed-off-by: Yang Xiaowei <xiaowei.yang@intel.com>
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/xen/spinlock.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/xen/spinlock.c
++++ b/arch/x86/xen/spinlock.c
+@@ -326,8 +326,13 @@ static void xen_spin_unlock(struct raw_s
+ smp_wmb(); /* make sure no writes get moved after unlock */
+ xl->lock = 0; /* release lock */
+
+- /* make sure unlock happens before kick */
+- barrier();
++ /*
++ * Make sure unlock happens before checking for waiting
++ * spinners. We need a strong barrier to enforce the
++ * write-read ordering to different memory locations, as the
++ * CPU makes no implied guarantees about their ordering.
++ */
++ mb();
+
+ if (unlikely(xl->spinners))
+ xen_spin_unlock_slow(xl);
projects / thirdparty / kernel / stable-queue.git / commitdiff
