--- /dev/null
+From gregkh@mini.kroah.org Sun Dec 6 16:06:40 2009
+Message-Id: <20091207000640.857498164@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 15:59:37 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Subject: [001/119] nilfs2: fix kernel oops in error case of nilfs_ioctl_move_blocks
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=nilfs2-fix-kernel-oops-in-error-case-of-nilfs_ioctl_move_blocks.patch
+Content-Length: 2957
+Lines: 86
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+
+commit 5399dd1fc8f5e812db931225ef5f67d89f3b1a56 upstream.
+
+This fixes a kernel oops reported by Markus Trippelsdorf in the email
+titled "[NILFS users] kernel Oops while running nilfs_cleanerd".
+
+The oops was caused by a bug of error path in
+nilfs_ioctl_move_blocks() function, which was inlined in
+nilfs_ioctl_clean_segments().
+
+nilfs_ioctl_move_blocks checks duplication of blocks which will be
+moved in garbage collection. But, the check should have be done
+within nilfs_ioctl_move_inode_block() to prevent list corruption among
+buffers storing the target blocks.
+
+To fix the kernel oops, this moves forward the duplication check
+before the list insertion.
+
+I also tested this for stable trees [2.6.30, 2.6.31].
+
+Reported-by: Markus Trippelsdorf <markus@trippelsdorf.de>
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nilfs2/ioctl.c | 30 +++++++++++++-----------------
+ 1 file changed, 13 insertions(+), 17 deletions(-)
+
+--- a/fs/nilfs2/ioctl.c
++++ b/fs/nilfs2/ioctl.c
+@@ -297,7 +297,18 @@ static int nilfs_ioctl_move_inode_block(
+ (unsigned long long)vdesc->vd_vblocknr);
+ return ret;
+ }
+- bh->b_private = vdesc;
++ if (unlikely(!list_empty(&bh->b_assoc_buffers))) {
++ printk(KERN_CRIT "%s: conflicting %s buffer: ino=%llu, "
++ "cno=%llu, offset=%llu, blocknr=%llu, vblocknr=%llu\n",
++ __func__, vdesc->vd_flags ? "node" : "data",
++ (unsigned long long)vdesc->vd_ino,
++ (unsigned long long)vdesc->vd_cno,
++ (unsigned long long)vdesc->vd_offset,
++ (unsigned long long)vdesc->vd_blocknr,
++ (unsigned long long)vdesc->vd_vblocknr);
++ brelse(bh);
++ return -EEXIST;
++ }
+ list_add_tail(&bh->b_assoc_buffers, buffers);
+ return 0;
+ }
+@@ -335,24 +346,10 @@ static int nilfs_ioctl_move_blocks(struc
+ list_for_each_entry_safe(bh, n, &buffers, b_assoc_buffers) {
+ ret = nilfs_gccache_wait_and_mark_dirty(bh);
+ if (unlikely(ret < 0)) {
+- if (ret == -EEXIST) {
+- vdesc = bh->b_private;
+- printk(KERN_CRIT
+- "%s: conflicting %s buffer: "
+- "ino=%llu, cno=%llu, offset=%llu, "
+- "blocknr=%llu, vblocknr=%llu\n",
+- __func__,
+- vdesc->vd_flags ? "node" : "data",
+- (unsigned long long)vdesc->vd_ino,
+- (unsigned long long)vdesc->vd_cno,
+- (unsigned long long)vdesc->vd_offset,
+- (unsigned long long)vdesc->vd_blocknr,
+- (unsigned long long)vdesc->vd_vblocknr);
+- }
++ WARN_ON(ret == -EEXIST);
+ goto failed;
+ }
+ list_del_init(&bh->b_assoc_buffers);
+- bh->b_private = NULL;
+ brelse(bh);
+ }
+ return nmembs;
+@@ -360,7 +357,6 @@ static int nilfs_ioctl_move_blocks(struc
+ failed:
+ list_for_each_entry_safe(bh, n, &buffers, b_assoc_buffers) {
+ list_del_init(&bh->b_assoc_buffers);
+- bh->b_private = NULL;
+ brelse(bh);
+ }
+ return ret;
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:41 2009
+Message-Id: <20091207000640.985999630@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 15:59:38 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jeff Layton <jlayton@redhat.com>,
+ Steve French <sfrench@us.ibm.com>
+Subject: [002/119] cifs: dont use CIFSGetSrvInodeNumber in is_path_accessible
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=cifs-don-t-use-cifsgetsrvinodenumber-in-is_path_accessible.patch
+Content-Length: 1368
+Lines: 42
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jeff Layton <jlayton@redhat.com>
+
+commit f475f6775465283494346663f201ad04810d2e8a upstream.
+
+Because it's lighter weight, CIFS tries to use CIFSGetSrvInodeNumber to
+verify the accessibility of the root inode and then falls back to doing a
+full QPathInfo if that fails with -EOPNOTSUPP. I have at least a report
+of a server that returns NT_STATUS_INTERNAL_ERROR rather than something
+that translates to EOPNOTSUPP.
+
+Rather than trying to be clever with that call, just have
+is_path_accessible do a normal QPathInfo. That call is widely
+supported and it shouldn't increase the overhead significantly.
+
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/connect.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -2200,16 +2200,8 @@ is_path_accessible(int xid, struct cifsT
+ struct cifs_sb_info *cifs_sb, const char *full_path)
+ {
+ int rc;
+- __u64 inode_num;
+ FILE_ALL_INFO *pfile_info;
+
+- rc = CIFSGetSrvInodeNumber(xid, tcon, full_path, &inode_num,
+- cifs_sb->local_nls,
+- cifs_sb->mnt_cifs_flags &
+- CIFS_MOUNT_MAP_SPECIAL_CHR);
+- if (rc != -EOPNOTSUPP)
+- return rc;
+-
+ pfile_info = kmalloc(sizeof(FILE_ALL_INFO), GFP_KERNEL);
+ if (pfile_info == NULL)
+ return -ENOMEM;
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:41 2009
+Message-Id: <20091207000641.115073729@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 15:59:39 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jeff Layton <jlayton@redhat.com>,
+ Steve French <sfrench@us.ibm.com>
+Subject: [003/119] cifs: clean up handling when server doesnt consistently support inode numbers
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=cifs-clean-up-handling-when-server-doesn-t-consistently-support-inode-numbers.patch
+Content-Length: 3335
+Lines: 92
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jeff Layton <jlayton@redhat.com>
+
+commit ec06aedd44541129840ed52e6165afa3796a27bf upstream.
+
+It's possible that a server will return a valid FileID when we query the
+FILE_INTERNAL_INFO for the root inode, but then zeroed out inode numbers
+when we do a FindFile with an infolevel of
+SMB_FIND_FILE_ID_FULL_DIR_INFO.
+
+In this situation turn off querying for server inode numbers, generate a
+warning for the user and just generate an inode number using iunique.
+Once we generate any inode number with iunique we can no longer use any
+server inode numbers or we risk collisions, so ensure that we don't do
+that in cifs_get_inode_info either.
+
+Reported-by: Timothy Normand Miller <theosib@gmail.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/cifsproto.h | 1 +
+ fs/cifs/inode.c | 7 ++-----
+ fs/cifs/misc.c | 14 ++++++++++++++
+ fs/cifs/readdir.c | 7 ++++---
+ 4 files changed, 21 insertions(+), 8 deletions(-)
+
+--- a/fs/cifs/cifsproto.h
++++ b/fs/cifs/cifsproto.h
+@@ -389,4 +389,5 @@ extern int CIFSSMBSetPosixACL(const int
+ const struct nls_table *nls_codepage, int remap_special_chars);
+ extern int CIFSGetExtAttr(const int xid, struct cifsTconInfo *tcon,
+ const int netfid, __u64 *pExtAttrBits, __u64 *pMask);
++extern void cifs_autodisable_serverino(struct cifs_sb_info *cifs_sb);
+ #endif /* _CIFSPROTO_H */
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -512,13 +512,10 @@ int cifs_get_inode_info(struct inode **p
+ cifs_sb->local_nls,
+ cifs_sb->mnt_cifs_flags &
+ CIFS_MOUNT_MAP_SPECIAL_CHR);
+- if (rc1) {
++ if (rc1 || !fattr.cf_uniqueid) {
+ cFYI(1, ("GetSrvInodeNum rc %d", rc1));
+ fattr.cf_uniqueid = iunique(sb, ROOT_I);
+- /* disable serverino if call not supported */
+- if (rc1 == -EINVAL)
+- cifs_sb->mnt_cifs_flags &=
+- ~CIFS_MOUNT_SERVER_INUM;
++ cifs_autodisable_serverino(cifs_sb);
+ }
+ } else {
+ fattr.cf_uniqueid = iunique(sb, ROOT_I);
+--- a/fs/cifs/misc.c
++++ b/fs/cifs/misc.c
+@@ -705,3 +705,17 @@ cifsConvertToUCS(__le16 *target, const c
+ ctoUCS_out:
+ return i;
+ }
++
++void
++cifs_autodisable_serverino(struct cifs_sb_info *cifs_sb)
++{
++ if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM) {
++ cifs_sb->mnt_cifs_flags &= CIFS_MOUNT_SERVER_INUM;
++ cERROR(1, ("Autodisabling the use of server inode numbers on "
++ "%s. This server doesn't seem to support them "
++ "properly. Hardlinks will not be recognized on this "
++ "mount. Consider mounting with the \"noserverino\" "
++ "option to silence this message.",
++ cifs_sb->tcon->treeName));
++ }
++}
+--- a/fs/cifs/readdir.c
++++ b/fs/cifs/readdir.c
+@@ -727,11 +727,12 @@ static int cifs_filldir(char *pfindEntry
+ cifs_dir_info_to_fattr(&fattr, (FILE_DIRECTORY_INFO *)
+ pfindEntry, cifs_sb);
+
+- /* FIXME: make _to_fattr functions fill this out */
+- if (pCifsF->srch_inf.info_level == SMB_FIND_FILE_ID_FULL_DIR_INFO)
++ if (inum && (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM)) {
+ fattr.cf_uniqueid = inum;
+- else
++ } else {
+ fattr.cf_uniqueid = iunique(sb, ROOT_I);
++ cifs_autodisable_serverino(cifs_sb);
++ }
+
+ ino = cifs_uniqueid_to_ino_t(fattr.cf_uniqueid);
+ tmp_dentry = cifs_readdir_lookup(file->f_dentry, &qstring, &fattr);
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:41 2009
+Message-Id: <20091207000641.261029358@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 15:59:40 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Suresh Jayaraman <sjayaraman@suse.de>,
+ Jeff Layton <jlayton@redhat.com>,
+ Steve French <sfrench@us.ibm.com>
+Subject: [004/119] cifs: clear server inode number flag while autodisabling
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=cifs-clear-server-inode-number-flag-while-autodisabling.patch
+Content-Length: 1093
+Lines: 30
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Suresh Jayaraman <sjayaraman@suse.de>
+
+commit f534dc994397560343be4a3223b9bbaa8e739e1f upstream.
+
+Fix the commit ec06aedd44 that intended to turn off querying for server inode
+numbers when server doesn't consistently support inode numbers. Presumably
+the commit didn't actually clear the CIFS_MOUNT_SERVER_INUM flag, perhaps a
+typo.
+
+Signed-off-by: Suresh Jayaraman <sjayaraman@suse.de>
+Acked-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/misc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/cifs/misc.c
++++ b/fs/cifs/misc.c
+@@ -710,7 +710,7 @@ void
+ cifs_autodisable_serverino(struct cifs_sb_info *cifs_sb)
+ {
+ if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM) {
+- cifs_sb->mnt_cifs_flags &= CIFS_MOUNT_SERVER_INUM;
++ cifs_sb->mnt_cifs_flags &= ~CIFS_MOUNT_SERVER_INUM;
+ cERROR(1, ("Autodisabling the use of server inode numbers on "
+ "%s. This server doesn't seem to support them "
+ "properly. Hardlinks will not be recognized on this "
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:41 2009
+Message-Id: <20091207000641.394756970@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 15:59:41 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Shirish Pargaonkar <shirishp@us.ibm.com>,
+ Jeff Layton <jlayton@redhat.com>,
+ Steve French <sfrench@us.ibm.com>
+Subject: [005/119] CIFS: fix oops in cifs_lookup during net boot
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=cifs-fix-oops-in-cifs_lookup-during-net-boot.patch
+Content-Length: 1464
+Lines: 43
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Steve French <sfrench@us.ibm.com>
+
+commit 8e6c0332d5032aef2d3bc8f41771f999112c8c66 upstream.
+
+Fixes bugzilla.kernel.org bug number 14641
+
+Lookup called during network boot (network root filesystem
+for diskless workstation) has case where nd is null in
+lookup. This patch fixes that in cifs_lookup.
+
+(Shirish noted that 2.6.30 and 2.6.31 stable need the same check)
+
+Signed-off-by: Shirish Pargaonkar <shirishp@us.ibm.com>
+Acked-by: Jeff Layton <jlayton@redhat.com>
+Tested-by: Vladimir Stavrinov <vs@inist.ru>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/dir.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/cifs/dir.c
++++ b/fs/cifs/dir.c
+@@ -648,7 +648,7 @@ cifs_lookup(struct inode *parent_dir_ino
+ * O_EXCL: optimize away the lookup, but don't hash the dentry. Let
+ * the VFS handle the create.
+ */
+- if (nd->flags & LOOKUP_EXCL) {
++ if (nd && (nd->flags & LOOKUP_EXCL)) {
+ d_instantiate(direntry, NULL);
+ return 0;
+ }
+@@ -680,7 +680,7 @@ cifs_lookup(struct inode *parent_dir_ino
+ * reduction in network traffic in the other paths.
+ */
+ if (pTcon->unix_ext) {
+- if (!(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY)) &&
++ if (nd && !(nd->flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY)) &&
+ (nd->flags & LOOKUP_OPEN) && !pTcon->broken_posix_open &&
+ (nd->intent.open.flags & O_CREAT)) {
+ rc = cifs_posix_open(full_path, &newInode,
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:41 2009
+Message-Id: <20091207000641.522137060@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 15:59:42 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jeff Layton <jlayton@redhat.com>,
+ Steve French <sfrench@us.ibm.com>
+Subject: [006/119] CIFS: Duplicate data on appending to some Samba servers
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=cifs-duplicate-data-on-appending-to-some-samba-servers.patch
+Content-Length: 1989
+Lines: 48
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Steve French <sfrench@us.ibm.com>
+
+commit cea62343956c24452700c06cf028b72414c58a74 upstream.
+
+SMB writes are sent with a starting offset and length. When the server
+supports the newer SMB trans2 posix open (rather than using the SMB
+NTCreateX) a file can be opened with SMB_O_APPEND flag, and for that
+case Samba server assumes that the offset sent in SMBWriteX is unneeded
+since the write should go to the end of the file - which can cause
+problems if the write was cached (since the beginning part of a
+page could be written twice by the client mm). Jeff suggested that
+masking the flag on posix open on the client is easiest for the time
+being. Note that recent Samba server also had an unrelated problem with
+SMB NTCreateX and append (see samba bugzilla bug number 6898) which
+should not affect current Linux clients (unless cifs Unix Extensions
+are disabled).
+
+The cifs client did not send the O_APPEND flag on posix open
+before 2.6.29 so the fix is unneeded on early kernels.
+
+In the future, for the non-cached case (O_DIRECT, and forcedirectio mounts)
+it would be possible and useful to send O_APPEND on posix open (for Windows
+case: FILE_APPEND_DATA but not FILE_WRITE_DATA on SMB NTCreateX) but for
+cached writes although the vfs sets the offset to end of file it
+may fragment a write across pages - so we can't send O_APPEND on
+open (could result in sending part of a page twice).
+
+Reviewed-by: Shirish Pargaonkar <shirishp@us.ibm.com>
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/dir.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/fs/cifs/dir.c
++++ b/fs/cifs/dir.c
+@@ -212,8 +212,6 @@ int cifs_posix_open(char *full_path, str
+ posix_flags |= SMB_O_EXCL;
+ if (oflags & O_TRUNC)
+ posix_flags |= SMB_O_TRUNC;
+- if (oflags & O_APPEND)
+- posix_flags |= SMB_O_APPEND;
+ if (oflags & O_SYNC)
+ posix_flags |= SMB_O_SYNC;
+ if (oflags & O_DIRECTORY)
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:41 2009
+Message-Id: <20091207000641.648428957@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 15:59:43 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dave Jones <davej@redhat.com>,
+ James Bottomley <James.Bottomley@suse.de>
+Subject: [007/119] [SCSI] gdth: Prevent negative offsets in ioctl CVE-2009-3080
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=gdth-prevent-negative-offsets-in-ioctl-cve-2009-3080.patch
+Content-Length: 769
+Lines: 27
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Dave Jones <davej@redhat.com>
+
+commit 690e744869f3262855b83b4fb59199cf142765b0 upstream.
+
+A negative offset could be used to index before the event buffer and
+lead to a security breach.
+
+Signed-off-by: Dave Jones <davej@redhat.com>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/gdth.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/gdth.c
++++ b/drivers/scsi/gdth.c
+@@ -2900,7 +2900,7 @@ static int gdth_read_event(gdth_ha_str *
+ eindex = handle;
+ estr->event_source = 0;
+
+- if (eindex >= MAX_EVENTS) {
++ if (eindex < 0 || eindex >= MAX_EVENTS) {
+ spin_unlock_irqrestore(&ha->smp_lock, flags);
+ return eindex;
+ }
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:41 2009
+Message-Id: <20091207000641.813085557@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 15:59:44 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Larry Finger <Larry.Finger@lwfinger.net>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [008/119] rtl8187: Fix kernel oops when device is removed when LEDS enabled
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=rtl8187-fix-kernel-oops-when-device-is-removed-when-leds-enabled.patch
+Content-Length: 1940
+Lines: 48
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 37b12dd2b07b4d7dc222a5f7f88b25cec532b2aa upstream.
+
+As reported by Rick Farina (sidhayn@gmail.com), removing the RTL8187
+USB stick, or unloading the driver rtl8187 using rmmod will cause a
+kernel oops. There are at least two forms of the failure, (1) BUG:
+Scheduling while atomic, and (2) a fatal kernel page fault. This
+problem is reported in Bugzilla #14539.
+
+This problem does not occur for kernel 2.6.31, but does for 2.6.32-rc2,
+thus it is technically a regression; however, bisection did not locate
+any faulty patch. The fix was found by comparing the faulty code in
+rtl8187 with p54usb. My interpretation is that the handling of work
+queues in mac80211 changed enough to the LEDs to be unregistered
+before tasks on the work queues are cancelled. Previously, these
+actions could be done in either order.
+
+(Herton Ronaldo Krzesinski <herton@mandriva.com.br> reports that the
+code is the same in 2.6.31, so this may be a candidate for 2.6.31.x.
+-- JWL)
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Reported-by: Rick Farina <sidhayn@gmail.com>
+Tested-by: Rick Farina <sidhayn@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/rtl818x/rtl8187_leds.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/rtl818x/rtl8187_leds.c
++++ b/drivers/net/wireless/rtl818x/rtl8187_leds.c
+@@ -210,10 +210,10 @@ void rtl8187_leds_exit(struct ieee80211_
+
+ /* turn the LED off before exiting */
+ queue_delayed_work(dev->workqueue, &priv->led_off, 0);
+- cancel_delayed_work_sync(&priv->led_off);
+- cancel_delayed_work_sync(&priv->led_on);
+ rtl8187_unregister_led(&priv->led_rx);
+ rtl8187_unregister_led(&priv->led_tx);
++ cancel_delayed_work_sync(&priv->led_off);
++ cancel_delayed_work_sync(&priv->led_on);
+ }
+ #endif /* def CONFIG_RTL8187_LED */
+
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:42 2009
+Message-Id: <20091207000641.956467260@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 15:59:45 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ NeilBrown <neilb@suse.de>
+Subject: [009/119] md: dont clear endpoint for resync when resync is interrupted.
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=md-don-t-clear-endpoint-for-resync-when-resync-is-interrupted.patch
+Content-Length: 1363
+Lines: 40
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: NeilBrown <neilb@suse.de>
+
+commit 24395a85d8efe6eee477ea35c73d045a8dd7a3a1 upstream.
+
+If a 'sync_max' has been set (via sysfs), it is wrong to clear it
+until a resync (or reshape or recovery ...) actually reached that
+point.
+So if a resync is interrupted (e.g. by device failure),
+leave 'resync_max' unchanged.
+
+This is particularly important for 'reshape' operations that do not
+change the size of the array. For such operations mdadm needs to
+monitor the reshape taking rolling backups of the section being
+reshaped. If resync_max gets cleared, the reshape can get ahead of
+mdadm and then the backups that mdadm creates are useless.
+
+This is suitable for 2.6.31.y stable kernels.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/md.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -6495,8 +6495,9 @@ void md_do_sync(mddev_t *mddev)
+ skip:
+ mddev->curr_resync = 0;
+ mddev->curr_resync_completed = 0;
+- mddev->resync_min = 0;
+- mddev->resync_max = MaxSector;
++ if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery))
++ /* We completed so max setting can be forgotten. */
++ mddev->resync_max = MaxSector;
+ sysfs_notify(&mddev->kobj, NULL, "sync_completed");
+ wake_up(&resync_wait);
+ set_bit(MD_RECOVERY_DONE, &mddev->recovery);
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:42 2009
+Message-Id: <20091207000642.118166452@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 15:59:46 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ NeilBrown <neilb@suse.de>
+Subject: [010/119] md/raid5: make sure curr_sync_completes is uptodate when reshape starts
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=md-raid5-make-sure-curr_sync_completes-is-uptodate-when-reshape-starts.patch
+Content-Length: 998
+Lines: 32
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: NeilBrown <neilb@suse.de>
+
+commit 8dee7211467a56b7eb4e4359efb0aa4a72e1b6f3 upstream.
+
+This value is visible through sysfs and is used by mdadm
+when it manages a reshape (backing up data that is about to be
+rearranged). So it is important that it is always correct.
+Current it does not get updated properly when a reshape
+starts which can cause problems when assembling an array
+that is in the middle of being reshaped.
+
+This is suitable for 2.6.31.y stable kernels.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/raid5.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -3790,6 +3790,8 @@ static sector_t reshape_request(mddev_t
+ sector_nr = conf->reshape_progress;
+ sector_div(sector_nr, new_data_disks);
+ if (sector_nr) {
++ mddev->curr_resync_completed = sector_nr;
++ sysfs_notify(&mddev->kobj, NULL, "sync_completed");
+ *skipped = 1;
+ return sector_nr;
+ }
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:42 2009
+Message-Id: <20091207000642.287972660@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 15:59:47 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ NeilBrown <neilb@suse.de>
+Subject: [011/119] md/raid1/raid10: add a cond_resched
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=md-raid1-raid10-add-a-cond_resched.patch
+Content-Length: 1019
+Lines: 39
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: NeilBrown <neilb@suse.de>
+
+commit 1d9d52416c0445019ccc1f0fddb9a227456eb61b upstream.
+
+During 'check' of a raid1 or raid10 it is possible for the management
+thread to spend a lot of time running 'memcmp' on blocks from
+different devices, so make sure the thread has a chance to schedule.
+raid5d already has a cond_resched (in process_stripe).
+
+Reported-By: Lee Howard <faxguy@howardsilvan.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/raid1.c | 1 +
+ drivers/md/raid10.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1630,6 +1630,7 @@ static void raid10d(mddev_t *mddev)
+ generic_make_request(bio);
+ }
+ }
++ cond_resched();
+ }
+ if (unplug)
+ unplug_slaves(mddev);
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -1676,6 +1676,7 @@ static void raid1d(mddev_t *mddev)
+ generic_make_request(bio);
+ }
+ }
++ cond_resched();
+ }
+ if (unplug)
+ unplug_slaves(mddev);
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:42 2009
+Message-Id: <20091207000642.408714542@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 15:59:48 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Julian Anastasov <ja@ssi.bg>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [012/119] ALSA: usb-audio: fix combine_word problem
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=alsa-usb-audio-fix-combine_word-problem.patch
+Content-Length: 1318
+Lines: 39
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Julian Anastasov <ja@ssi.bg>
+
+commit f495088210c8b9e20791d995a8210170c68d2deb upstream.
+
+Fix combine_word problem where first octet is not
+read properly. The only affected place seems to be the
+INPUT_TERMINAL type. Before now, sound controls can be created
+with the output terminal's name which is a fallback mechanism
+used only for unknown input terminal types. For example,
+Line can wrongly appear as Speaker. After the change it
+should appear as Line.
+
+ The side effect of this change can be that users
+can expect the wrong control name in their scripts or
+programs while now we return the correct one.
+
+ Probably, these defines should use get_unaligned_le16 and
+friends.
+
+Signed-off-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/usbaudio.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/usb/usbaudio.h
++++ b/sound/usb/usbaudio.h
+@@ -210,7 +210,7 @@ struct snd_usb_midi_endpoint_info {
+ /*
+ */
+
+-#define combine_word(s) ((*s) | ((unsigned int)(s)[1] << 8))
++#define combine_word(s) ((*(s)) | ((unsigned int)(s)[1] << 8))
+ #define combine_triple(s) (combine_word(s) | ((unsigned int)(s)[2] << 16))
+ #define combine_quad(s) (combine_triple(s) | ((unsigned int)(s)[3] << 24))
+
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:42 2009
+Message-Id: <20091207000642.574512439@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 15:59:49 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Daniel J Blueman <daniel.blueman@gmail.com>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [013/119] ALSA: hda - Dell Studio 1557 hd-audio quirk
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=alsa-hda-dell-studio-1557-hd-audio-quirk.patch
+Content-Length: 829
+Lines: 27
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Daniel J Blueman <daniel.blueman@gmail.com>
+
+commit 8ef5837a47f73faee18fa7ce2f9a9eb7675be8de upstream.
+
+Add the Dell Studio 15 (model 1557, Core i7) laptop to the hd-audio
+quirk list, enabling audio.
+
+Signed-off-by: Daniel J Blueman <daniel.blueman@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -1817,6 +1817,8 @@ static struct snd_pci_quirk stac92hd73xx
+ "Dell Studio 17", STAC_DELL_M6_DMIC),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02be,
+ "Dell Studio 1555", STAC_DELL_M6_DMIC),
++ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x02bd,
++ "Dell Studio 1557", STAC_DELL_M6_DMIC),
+ {} /* terminator */
+ };
+
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:42 2009
+Message-Id: <20091207000642.700325357@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 15:59:50 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Russell King <rmk+kernel@arm.linux.org.uk>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [014/119] ALSA: AACI: fix AC97 multiple-open bug
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=alsa-aaci-fix-ac97-multiple-open-bug.patch
+Content-Length: 661
+Lines: 26
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit 4acd57c3de62374fe5bb52e5cd24538190f4eab2 upstream.
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/arm/aaci.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/sound/arm/aaci.c
++++ b/sound/arm/aaci.c
+@@ -504,6 +504,10 @@ static int aaci_pcm_hw_params(struct snd
+ int err;
+
+ aaci_pcm_hw_free(substream);
++ if (aacirun->pcm_open) {
++ snd_ac97_pcm_close(aacirun->pcm);
++ aacirun->pcm_open = 0;
++ }
+
+ err = devdma_hw_alloc(NULL, substream,
+ params_buffer_bytes(params));
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:42 2009
+Message-Id: <20091207000642.829552733@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 15:59:51 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Russell King <rmk+kernel@arm.linux.org.uk>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [015/119] ALSA: AACI: fix recording bug
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=alsa-aaci-fix-recording-bug.patch
+Content-Length: 794
+Lines: 28
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit 8ee763b9c82c6ca0a59a7271ce4fa29d7baf5c09 upstream.
+
+pcm->r[1].slots is the double rate slot information, not the
+capture information. For capture, 'pcm' will already be the
+capture ac97 pcm structure.
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/arm/aaci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/arm/aaci.c
++++ b/sound/arm/aaci.c
+@@ -521,7 +521,7 @@ static int aaci_pcm_hw_params(struct snd
+ else
+ err = snd_ac97_pcm_open(aacirun->pcm, params_rate(params),
+ params_channels(params),
+- aacirun->pcm->r[1].slots);
++ aacirun->pcm->r[0].slots);
+
+ if (err)
+ goto out;
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:43 2009
+Message-Id: <20091207000642.997875875@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 15:59:52 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ David Woodhouse <David.Woodhouse@intel.com>
+Subject: [016/119] jffs2: Fix memory corruption in jffs2_read_inode_range()
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=jffs2-fix-memory-corruption-in-jffs2_read_inode_range.patch
+Content-Length: 3423
+Lines: 80
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: David Woodhouse <dwmw2@infradead.org>
+
+commit 199bc9ff5ca5e4b3bcaff8927b2983c65f34c263 upstream.
+
+In 2.6.23 kernel, commit a32ea1e1f925399e0d81ca3f7394a44a6dafa12c
+("Fix read/truncate race") fixed a race in the generic code, and as a
+side effect, now do_generic_file_read() can ask us to readpage() past
+the i_size. This seems to be correctly handled by the block routines
+(e.g. block_read_full_page() fills the page with zeroes in case if
+somebody is trying to read past the last inode's block).
+
+JFFS2 doesn't handle this; it assumes that it won't be asked to read
+pages which don't exist -- and thus that there will be at least _one_
+valid 'frag' on the page it's being asked to read. It will fill any
+holes with the following memset:
+
+ memset(buf, 0, min(end, frag->ofs + frag->size) - offset);
+
+When the 'closest smaller match' returned by jffs2_lookup_node_frag() is
+actually on a previous page and ends before 'offset', that results in:
+
+ memset(buf, 0, <huge unsigned negative>);
+
+Hopefully, in most cases the corruption is fatal, and quickly causing
+random oopses, like this:
+
+ root@10.0.0.4:~/ltp-fs-20090531# ./testcases/kernel/fs/ftest/ftest01
+ Unable to handle kernel paging request for data at address 0x00000008
+ Faulting instruction address: 0xc01cd980
+ Oops: Kernel access of bad area, sig: 11 [#1]
+ [...]
+ NIP [c01cd980] rb_insert_color+0x38/0x184
+ LR [c0043978] enqueue_hrtimer+0x88/0xc4
+ Call Trace:
+ [c6c63b60] [c004f9a8] tick_sched_timer+0xa0/0xe4 (unreliable)
+ [c6c63b80] [c0043978] enqueue_hrtimer+0x88/0xc4
+ [c6c63b90] [c0043a48] __run_hrtimer+0x94/0xbc
+ [c6c63bb0] [c0044628] hrtimer_interrupt+0x140/0x2b8
+ [c6c63c10] [c000f8e8] timer_interrupt+0x13c/0x254
+ [c6c63c30] [c001352c] ret_from_except+0x0/0x14
+ --- Exception: 901 at memset+0x38/0x5c
+ LR = jffs2_read_inode_range+0x144/0x17c
+ [c6c63cf0] [00000000] (null) (unreliable)
+
+This patch fixes the issue, plus fixes all LTP tests on NAND/UBI with
+JFFS2 filesystem that were failing since 2.6.23 (seems like the bug
+above also broke the truncation).
+
+Reported-By: Anton Vorontsov <avorontsov@ru.mvista.com>
+Tested-By: Anton Vorontsov <avorontsov@ru.mvista.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/jffs2/read.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/fs/jffs2/read.c
++++ b/fs/jffs2/read.c
+@@ -164,12 +164,15 @@ int jffs2_read_inode_range(struct jffs2_
+
+ /* XXX FIXME: Where a single physical node actually shows up in two
+ frags, we read it twice. Don't do that. */
+- /* Now we're pointing at the first frag which overlaps our page */
++ /* Now we're pointing at the first frag which overlaps our page
++ * (or perhaps is before it, if we've been asked to read off the
++ * end of the file). */
+ while(offset < end) {
+ D2(printk(KERN_DEBUG "jffs2_read_inode_range: offset %d, end %d\n", offset, end));
+- if (unlikely(!frag || frag->ofs > offset)) {
++ if (unlikely(!frag || frag->ofs > offset ||
++ frag->ofs + frag->size <= offset)) {
+ uint32_t holesize = end - offset;
+- if (frag) {
++ if (frag && frag->ofs > offset) {
+ D1(printk(KERN_NOTICE "Eep. Hole in ino #%u fraglist. frag->ofs = 0x%08x, offset = 0x%08x\n", f->inocache->ino, frag->ofs, offset));
+ holesize = min(holesize, frag->ofs - offset);
+ }
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:43 2009
+Message-Id: <20091207000643.124751996@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 15:59:53 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Clemens Ladisch <clemens@ladisch.de>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [017/119] sound: rawmidi: disable active-sensing-on-close by default
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=sound-rawmidi-disable-active-sensing-on-close-by-default.patch
+Content-Length: 1365
+Lines: 39
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit 2d4b842014dc76a81abced47ef27177eedb9deba upstream.
+
+Sending an Active Sensing message when closing a port can interfere with
+the following data if the port is reopened and a note-on is sent before
+the device's timeout has elapsed. Therefore, it is better to disable
+this setting by default.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/rawmidi.c | 2 +-
+ sound/core/seq/seq_midi.c | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/core/rawmidi.c
++++ b/sound/core/rawmidi.c
+@@ -274,7 +274,7 @@ static int open_substream(struct snd_raw
+ return err;
+ substream->opened = 1;
+ if (substream->use_count++ == 0)
+- substream->active_sensing = 1;
++ substream->active_sensing = 0;
+ if (mode & SNDRV_RAWMIDI_LFLG_APPEND)
+ substream->append = 1;
+ rmidi->streams[substream->stream].substream_opened++;
+--- a/sound/core/seq/seq_midi.c
++++ b/sound/core/seq/seq_midi.c
+@@ -236,6 +236,7 @@ static int midisynth_use(void *private_d
+ memset(¶ms, 0, sizeof(params));
+ params.avail_min = 1;
+ params.buffer_size = output_buffer_size;
++ params.no_active_sensing = 1;
+ if ((err = snd_rawmidi_output_params(msynth->output_rfile.output, ¶ms)) < 0) {
+ snd_rawmidi_kernel_release(&msynth->output_rfile);
+ return err;
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:43 2009
+Message-Id: <20091207000643.291159866@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 15:59:54 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Clemens Ladisch <clemens@ladisch.de>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [018/119] sound: rawmidi: fix checking of O_APPEND when opening MIDI device
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=sound-rawmidi-fix-checking-of-o_append-when-opening-midi-device.patch
+Content-Length: 1100
+Lines: 32
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit 16fb109644b5644e42ececeff644514de6f4bd03 upstream.
+
+Commit 9a1b64caac82aa02cb74587ffc798e6f42c6170a in 2.6.30 dropped the
+check that a substream must already have been opened with O_APPEND to be
+able to open it a second time.
+
+This would make it possible for a substream to be switched to append
+mode, which would mean that non-atomic writes would fail unexpectedly.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/rawmidi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/core/rawmidi.c
++++ b/sound/core/rawmidi.c
+@@ -248,7 +248,8 @@ static int assign_substream(struct snd_r
+ list_for_each_entry(substream, &s->substreams, list) {
+ if (substream->opened) {
+ if (stream == SNDRV_RAWMIDI_STREAM_INPUT ||
+- !(mode & SNDRV_RAWMIDI_LFLG_APPEND))
++ !(mode & SNDRV_RAWMIDI_LFLG_APPEND) ||
++ !substream->append)
+ continue;
+ }
+ if (subdevice < 0 || subdevice == substream->number) {
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:43 2009
+Message-Id: <20091207000643.451880574@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 15:59:55 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Clemens Ladisch <clemens@ladisch.de>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [019/119] sound: rawmidi: fix double init when opening MIDI device with O_APPEND
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=sound-rawmidi-fix-double-init-when-opening-midi-device-with-o_append.patch
+Content-Length: 1543
+Lines: 53
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit 8579d2d7779d7ff41ea2a0183015e0e5038f1043 upstream.
+
+Commit 9a1b64caac82aa02cb74587ffc798e6f42c6170a in 2.6.30 moved the
+substream initialization code to where it would be executed every time
+the substream is opened.
+
+This had the consequence that any further opening would drop and leak
+the data in the existing buffer, and that the device driver's open
+callback would be called multiple times, unexpectedly.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/rawmidi.c | 22 ++++++++++++----------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+--- a/sound/core/rawmidi.c
++++ b/sound/core/rawmidi.c
+@@ -267,17 +267,19 @@ static int open_substream(struct snd_raw
+ {
+ int err;
+
+- err = snd_rawmidi_runtime_create(substream);
+- if (err < 0)
+- return err;
+- err = substream->ops->open(substream);
+- if (err < 0)
+- return err;
+- substream->opened = 1;
+- if (substream->use_count++ == 0)
++ if (substream->use_count == 0) {
++ err = snd_rawmidi_runtime_create(substream);
++ if (err < 0)
++ return err;
++ err = substream->ops->open(substream);
++ if (err < 0)
++ return err;
++ substream->opened = 1;
+ substream->active_sensing = 0;
+- if (mode & SNDRV_RAWMIDI_LFLG_APPEND)
+- substream->append = 1;
++ if (mode & SNDRV_RAWMIDI_LFLG_APPEND)
++ substream->append = 1;
++ }
++ substream->use_count++;
+ rmidi->streams[substream->stream].substream_opened++;
+ return 0;
+ }
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:43 2009
+Message-Id: <20091207000643.589531946@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 15:59:56 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Clemens Ladisch <clemens@ladisch.de>,
+ Takashi Iwai <tiwai@suse.de>
+Subject: [020/119] sound: rawmidi: fix MIDI device O_APPEND error handling
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=sound-rawmidi-fix-midi-device-o_append-error-handling.patch
+Content-Length: 2356
+Lines: 84
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit b7fe750fcceda4fa6bef399b0e2812562728ea82 upstream.
+
+Commit 9a1b64caac82aa02cb74587ffc798e6f42c6170a in 2.6.30 broke the
+error handling code in rawmidi_open_priv().
+
+If only the output substream of a RawMIDI device has been opened and
+if this device is then opened with O_RDWR | O_APPEND and if the
+initialization of the input substream fails (either because of low
+memory or because the device driver's open callback fails), then the
+runtime structure of the already open output substream will be freed
+and all following writes through the first handle will cause
+snd_rawmidi_write() to use the NULL runtime pointer.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/rawmidi.c | 19 +++++++------------
+ 1 file changed, 7 insertions(+), 12 deletions(-)
+
+--- a/sound/core/rawmidi.c
++++ b/sound/core/rawmidi.c
+@@ -272,8 +272,10 @@ static int open_substream(struct snd_raw
+ if (err < 0)
+ return err;
+ err = substream->ops->open(substream);
+- if (err < 0)
++ if (err < 0) {
++ snd_rawmidi_runtime_free(substream);
+ return err;
++ }
+ substream->opened = 1;
+ substream->active_sensing = 0;
+ if (mode & SNDRV_RAWMIDI_LFLG_APPEND)
+@@ -300,27 +302,27 @@ static int rawmidi_open_priv(struct snd_
+ SNDRV_RAWMIDI_STREAM_INPUT,
+ mode, &sinput);
+ if (err < 0)
+- goto __error;
++ return err;
+ }
+ if (mode & SNDRV_RAWMIDI_LFLG_OUTPUT) {
+ err = assign_substream(rmidi, subdevice,
+ SNDRV_RAWMIDI_STREAM_OUTPUT,
+ mode, &soutput);
+ if (err < 0)
+- goto __error;
++ return err;
+ }
+
+ if (sinput) {
+ err = open_substream(rmidi, sinput, mode);
+ if (err < 0)
+- goto __error;
++ return err;
+ }
+ if (soutput) {
+ err = open_substream(rmidi, soutput, mode);
+ if (err < 0) {
+ if (sinput)
+ close_substream(rmidi, sinput, 0);
+- goto __error;
++ return err;
+ }
+ }
+
+@@ -328,13 +330,6 @@ static int rawmidi_open_priv(struct snd_
+ rfile->input = sinput;
+ rfile->output = soutput;
+ return 0;
+-
+- __error:
+- if (sinput && sinput->runtime)
+- snd_rawmidi_runtime_free(sinput);
+- if (soutput && soutput->runtime)
+- snd_rawmidi_runtime_free(soutput);
+- return err;
+ }
+
+ /* called from sound/core/seq/seq_midi.c */
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:43 2009
+Message-Id: <20091207000643.761211232@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 15:59:57 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Soeren Sandmann Pedersen <sandmann@redhat.com>,
+ a.p.zijlstra@chello.nl,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [021/119] highmem: Fix race in debug_kmap_atomic() which could cause warn_count to underflow
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=highmem-fix-race-in-debug_kmap_atomic-which-could-cause-warn_count-to-underflow.patch
+Content-Length: 1111
+Lines: 38
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Soeren Sandmann <sandmann@daimi.au.dk>
+
+commit 5ebd4c22897dce65845807a9bd3a31cc4e142b53 upstream.
+
+debug_kmap_atomic() tries to prevent ever printing more than 10
+warnings, but it does so by testing whether an unsigned integer
+is equal to 0. However, if the warning is caused by a nested
+IRQ, then this counter may underflow and the stream of warnings
+will never end.
+
+Fix that by using a signed integer instead.
+
+Signed-off-by: Soeren Sandmann Pedersen <sandmann@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: a.p.zijlstra@chello.nl
+LKML-Reference: <ye8zl7b8ktj.fsf@camel23.daimi.au.dk>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/highmem.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/mm/highmem.c
++++ b/mm/highmem.c
+@@ -426,9 +426,9 @@ void __init page_address_init(void)
+
+ void debug_kmap_atomic(enum km_type type)
+ {
+- static unsigned warn_count = 10;
++ static int warn_count = 10;
+
+- if (unlikely(warn_count == 0))
++ if (unlikely(warn_count < 0))
+ return;
+
+ if (unlikely(in_interrupt())) {
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:44 2009
+Message-Id: <20091207000643.892734717@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 15:59:58 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Soeren Sandmann Pedersen <sandmann@redhat.com>,
+ a.p.zijlstra@chello.nl,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [022/119] highmem: Fix debug_kmap_atomic() to also handle KM_IRQ_PTE, KM_NMI, and KM_NMI_PTE
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=highmem-fix-debug_kmap_atomic-to-also-handle-km_irq_pte-km_nmi-and-km_nmi_pte.patch
+Content-Length: 1536
+Lines: 52
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Soeren Sandmann <sandmann@daimi.au.dk>
+
+commit d4515646699b6ad7b1a98ceb871296b957f3ef47 upstream.
+
+Previously calling debug_kmap_atomic() with these types would
+cause spurious warnings.
+
+(triggered by SysProf using perf events)
+
+Signed-off-by: Soeren Sandmann Pedersen <sandmann@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: a.p.zijlstra@chello.nl
+LKML-Reference: <ye8vdhz8krw.fsf@camel23.daimi.au.dk>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/highmem.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/mm/highmem.c
++++ b/mm/highmem.c
+@@ -432,10 +432,15 @@ void debug_kmap_atomic(enum km_type type
+ return;
+
+ if (unlikely(in_interrupt())) {
+- if (in_irq()) {
++ if (in_nmi()) {
++ if (type != KM_NMI && type != KM_NMI_PTE) {
++ WARN_ON(1);
++ warn_count--;
++ }
++ } else if (in_irq()) {
+ if (type != KM_IRQ0 && type != KM_IRQ1 &&
+ type != KM_BIO_SRC_IRQ && type != KM_BIO_DST_IRQ &&
+- type != KM_BOUNCE_READ) {
++ type != KM_BOUNCE_READ && type != KM_IRQ_PTE) {
+ WARN_ON(1);
+ warn_count--;
+ }
+@@ -452,7 +457,9 @@ void debug_kmap_atomic(enum km_type type
+ }
+
+ if (type == KM_IRQ0 || type == KM_IRQ1 || type == KM_BOUNCE_READ ||
+- type == KM_BIO_SRC_IRQ || type == KM_BIO_DST_IRQ) {
++ type == KM_BIO_SRC_IRQ || type == KM_BIO_DST_IRQ ||
++ type == KM_IRQ_PTE || type == KM_NMI ||
++ type == KM_NMI_PTE ) {
+ if (!irqs_disabled()) {
+ WARN_ON(1);
+ warn_count--;
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:44 2009
+Message-Id: <20091207000644.059666416@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 15:59:59 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mike Isely <isely@pobox.com>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>
+Subject: [023/119] V4L/DVB (13169): bttv: Fix potential out-of-order field processing
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=v4l-dvb-13169-bttv-fix-potential-out-of-order-field-processing.patch
+Content-Length: 5994
+Lines: 121
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Mike Isely <isely@pobox.com>
+
+commit 66349b4e7ab3825dbfc167a5f0309792a587adb7 upstream.
+
+There is a subtle interaction in the bttv driver which can result in
+fields being repeatedly processed out of order. This is a problem
+specifically when running in V4L2_FIELD_ALTERNATE mode (probably the
+most common case).
+
+1. The determination of which fields are associated with which buffers
+happens in videobuf, before the bttv driver gets a chance to queue the
+corresponding DMA. Thus by the point when the DMA is queued for a
+given buffer, the algorithm has to do the queuing based on the
+buffer's already assigned field type - not based on which field is
+"next" in the video stream.
+
+2. The driver normally tries to queue both the top and bottom fields
+at the same time (see bttv_irq_next_video()). It tries to sort out
+top vs bottom by looking at the field type for the next 2 available
+buffers and assigning them appropriately.
+
+3. However the bttv driver *always* actually processes the top field
+first. There's even an interrupt set aside for specifically
+recognizing when the top field has been processed so that it can be
+marked done even while the bottom field is still being DMAed.
+
+Given all of the above, if one gets into a situation where
+bttv_irq_next_video() gets entered when the first available buffer has
+been pre-associated as a bottom field, then the function is going to
+process the buffers out of order. That first available buffer will be
+put into the bottom field slot and the buffer after that will be put
+into the top field slot. Problem is, since the top field is always
+processed first by the driver, then that second buffer (the one after
+the first available buffer) will be the first one to be finished.
+Because of the strict fifo handling of all video buffers, then that
+top field won't be seen by the app until after the bottom field is
+also processed. Worse still, the app will get back the
+chronologically later bottom field first, *before* the top field is
+received. The buffer's timestamps will even be backwards.
+
+While not fatal to most TV apps, this behavior can subtlely degrade
+userspace deinterlacing (probably will cause jitter). That's probably
+why it has gone unnoticed. But it will also cause serious problems if
+the app in question discards all but the latest received buffer (a
+latency minimizing tactic) - causing one field to only ever be
+displayed since the other is now always late. Unfortunately once you
+get into this state, you're stuck this way - because having consumed
+two buffers, now the next time around the "first" available buffer
+will again be a bottom field and the same thing happens.
+
+How can we get into this state? In a perfect world, where there's
+always a few free buffers queued to the driver, it should be
+impossible. However if something disrupts streaming, e.g. if the
+userspace app can't queue free buffers fast enough for a moment due
+perhaps to a CPU scheduling glitch, then the driver can get
+momentarily starved and some number of fields will be dropped. That's
+OK. But if an odd number of fields get dropped, then that "first"
+available buffer might be the bottom field and now we're stuck...
+
+This patch fixes that problem by deliberately only setting up a single
+field for one frame if we don't get a top field as the first available
+buffer. By purposely skipping the other field, then we only handle a
+single buffer thus bringing things back into proper sync (i.e. top
+field first) for the next frame. To do this we just drop the few
+lines in bttv_irq_next_video() that attempt to set up the second
+buffer when that second buffer isn't for the bottom field.
+
+This is definitely a problem in when in V4L2_FIELD_ALTERNATE mode. In
+the other modes this change either has no effect or doesn't harm
+things any further anyway.
+
+Signed-off-by: Mike Isely <isely@pobox.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/bt8xx/bttv-driver.c | 31 +++++++++++++++++++++++++++----
+ 1 file changed, 27 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/video/bt8xx/bttv-driver.c
++++ b/drivers/media/video/bt8xx/bttv-driver.c
+@@ -3798,11 +3798,34 @@ bttv_irq_next_video(struct bttv *btv, st
+ if (!V4L2_FIELD_HAS_BOTH(item->vb.field) &&
+ (item->vb.queue.next != &btv->capture)) {
+ item = list_entry(item->vb.queue.next, struct bttv_buffer, vb.queue);
++ /* Mike Isely <isely@pobox.com> - Only check
++ * and set up the bottom field in the logic
++ * below. Don't ever do the top field. This
++ * of course means that if we set up the
++ * bottom field in the above code that we'll
++ * actually skip a field. But that's OK.
++ * Having processed only a single buffer this
++ * time, then the next time around the first
++ * available buffer should be for a top field.
++ * That will then cause us here to set up a
++ * top then a bottom field in the normal way.
++ * The alternative to this understanding is
++ * that we set up the second available buffer
++ * as a top field, but that's out of order
++ * since this driver always processes the top
++ * field first - the effect will be the two
++ * buffers being returned in the wrong order,
++ * with the second buffer also being delayed
++ * by one field time (owing to the fifo nature
++ * of videobuf). Worse still, we'll be stuck
++ * doing fields out of order now every time
++ * until something else causes a field to be
++ * dropped. By effectively forcing a field to
++ * drop this way then we always get back into
++ * sync within a single frame time. (Out of
++ * order fields can screw up deinterlacing
++ * algorithms.) */
+ if (!V4L2_FIELD_HAS_BOTH(item->vb.field)) {
+- if (NULL == set->top &&
+- V4L2_FIELD_TOP == item->vb.field) {
+- set->top = item;
+- }
+ if (NULL == set->bottom &&
+ V4L2_FIELD_BOTTOM == item->vb.field) {
+ set->bottom = item;
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:44 2009
+Message-Id: <20091207000644.223985205@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:00 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mike Isely <isely@pobox.com>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>
+Subject: [024/119] V4L/DVB (13170): bttv: Fix reversed polarity error when switching video standard
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=v4l-dvb-13170-bttv-fix-reversed-polarity-error-when-switching-video-standard.patch
+Content-Length: 2873
+Lines: 61
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Mike Isely <isely@pobox.com>
+
+commit 2de26c0a4a218a351bb1970eeaddf2905b47ff13 upstream.
+
+The bttv driver function which handles switching of the video standard
+(set_tvnorm() in bttv-driver.c) includes a check which can optionally
+also reset the cropping configuration to a default value. It is
+"optional" based on a comparison of the cropcap parameters of the
+previous vs the newly requested video standard. The comparison is
+being done with a memcmp(), a function which only returns a true value
+if the comparison actually fails.
+
+This if-statement appears to have been written to assume wrong
+memcmp() semantics. That is, it was re-initializing the cropping
+configuration only if the new video standard did NOT have different
+cropcap values. That doesn't make any sense. One definitely should
+reset things if the cropcap parameters are different - if there's any
+comparison to made at all.
+
+The effect of this problem was that a transition from, say, PAL to
+NTSC would leave in place old cropping setup that made sense for the
+PAL geometry but not for NTSC. If the application doesn't care about
+cropping it also won't try to reset the cropping configuration,
+resulting in an improperly cropped video frame. In the case I was
+testing this actually caused black video frames to be displayed.
+
+Another interesting effect of this bug is that if one does something
+which does NOT change the video standard and this function is run,
+then the cropping setup gets reset anyway - again because of the
+backwards comparison. It turns out that just running anything which
+merely opens and closes the video device node (e.g. v4l-info) will
+cause this to happen. One can argue that simply opening the device
+node and not doing anything to it should not mess with any of its
+state - but because of this behavior, any TV app which does such
+things (e.g. xawtv) probably therefore doesn't see the problem.
+
+The solution is to fix the sense of the if-statement. It's easy to
+see how this mistake could have been made given how memcmp() works.
+The patch is therefore removal of a single "!" character from the
+if-statement in set_tvnorm in bttv-driver.c.
+
+Signed-off-by: Mike Isely <isely@pobox.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/bt8xx/bttv-driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/video/bt8xx/bttv-driver.c
++++ b/drivers/media/video/bt8xx/bttv-driver.c
+@@ -1299,7 +1299,7 @@ set_tvnorm(struct bttv *btv, unsigned in
+
+ tvnorm = &bttv_tvnorms[norm];
+
+- if (!memcmp(&bttv_tvnorms[btv->tvnorm].cropcap, &tvnorm->cropcap,
++ if (memcmp(&bttv_tvnorms[btv->tvnorm].cropcap, &tvnorm->cropcap,
+ sizeof (tvnorm->cropcap))) {
+ bttv_crop_reset(&btv->crop[0], norm);
+ btv->crop[1] = btv->crop[0]; /* current = default */
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:44 2009
+Message-Id: <20091207000644.374616073@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:01 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Seth Barry <seth@cyberseth.com>,
+ Michael Krufky <mkrufky@kernellabs.com>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>
+Subject: [025/119] V4L/DVB (13109): tda18271: fix signedness issue in tda18271_rf_tracking_filters_init
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=v4l-dvb-13109-tda18271-fix-signedness-issue-in-tda18271_rf_tracking_filters_init.patch
+Content-Length: 2897
+Lines: 61
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Seth Barry <seth@cyberseth.com>
+
+commit a57c1dcb93e43357ed3f666e5a2b5d5071dd3930 upstream.
+
+While having tda18271 module set with debug=17 (cal & info prints) and
+cal=0 (delay calibration process until first use) - I discovered that
+during the calibration process, if the frequency test for 69750000
+returned a bcal of 0 (see tda18721-fe.c in tda18271_powerscan func) that
+the tuner wouldn't be able to pickup any of the frequencies in the range
+(all the other frequencies bands returned bcal=1). I spent some time
+going over the code and the NXP's tda18271 spec (ver.4 of it i think) and
+adding a lot of debug prints and walking/stepping through the calibration
+process. I found that when the powerscan fails to find a frequency, the
+rf calibration is not run and the default value is supposed to be used in
+its place (pulled from the RF_CAL_map table) - but something was getting
+goofed up there.
+
+Now, my c coding skills are very rusty, but i think root of the problem is
+a signedness issue with the math operation for calculating the rf_a1 and
+rf_a2 values in tda18271_rf_tracking_filters_init func, which results in
+values like 20648 for rf_a1 (when it should probably have a value like 0,
+or so slightly negative that it should be zero - this bad value for rf_a1
+would in turn makes the approx calc within
+tda18271c2_rf_tracking_filters_correction go out of whack). The simplest
+solution i found was to explicitly convert the signedness of the
+denominator to avoid the implicit conversion. The values placed into the
+u32 rf_freq array should never exceed about 900mhz, so i think the s32 max
+value shouldn't be an issue in this case.
+
+I've tested it out a little, and even when i get a bcal=0 with the
+modified code, the default calibration value gets used, rf_a1 is zero, and
+the tuner seems to lock on the stream and mythtv seems to play it fine.
+
+Signed-off-by: Seth Barry <seth@cyberseth.com>
+Signed-off-by: Michael Krufky <mkrufky@kernellabs.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/common/tuners/tda18271-fe.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/common/tuners/tda18271-fe.c
++++ b/drivers/media/common/tuners/tda18271-fe.c
+@@ -595,13 +595,13 @@ static int tda18271_rf_tracking_filters_
+ case RF2:
+ map[i].rf_a1 = (prog_cal[RF2] - prog_tab[RF2] -
+ prog_cal[RF1] + prog_tab[RF1]) /
+- ((rf_freq[RF2] - rf_freq[RF1]) / 1000);
++ (s32)((rf_freq[RF2] - rf_freq[RF1]) / 1000);
+ map[i].rf2 = rf_freq[RF2] / 1000;
+ break;
+ case RF3:
+ map[i].rf_a2 = (prog_cal[RF3] - prog_tab[RF3] -
+ prog_cal[RF2] + prog_tab[RF2]) /
+- ((rf_freq[RF3] - rf_freq[RF2]) / 1000);
++ (s32)((rf_freq[RF3] - rf_freq[RF2]) / 1000);
+ map[i].rf_b2 = prog_cal[RF2] - prog_tab[RF2];
+ map[i].rf3 = rf_freq[RF3] / 1000;
+ break;
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:44 2009
+Message-Id: <20091207000644.555026790@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:02 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Henk Vergonet <Henk.Vergonet@gmail.com>,
+ Michael Krufky <mkrufky@kernellabs.com>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>
+Subject: [026/119] V4L/DVB (13107): tda18271: fix overflow in FM radio frequency calculation
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=v4l-dvb-13107-tda18271-fix-overflow-in-fm-radio-frequency-calculation.patch
+Content-Length: 1300
+Lines: 38
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Michael Krufky <mkrufky@kernellabs.com>
+
+commit 4d8317876d5f53ef792e90f89d8f162d7bca5c81 upstream.
+
+Multiplication by 62500 causes an overflow in the 32 bit freq variable,
+which is later divided by 1000 when using FM radio.
+
+This patch prevents the overflow by scaling the frequency value correctly
+upfront. Thanks to Henk Vergonet for spotting the problem and providing
+a preliminary patch, which this changeset was based upon.
+
+Cc: Henk Vergonet <Henk.Vergonet@gmail.com>
+Signed-off-by: Michael Krufky <mkrufky@kernellabs.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/common/tuners/tda18271-fe.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/common/tuners/tda18271-fe.c
++++ b/drivers/media/common/tuners/tda18271-fe.c
+@@ -963,12 +963,12 @@ static int tda18271_set_analog_params(st
+ struct tda18271_std_map_item *map;
+ char *mode;
+ int ret;
+- u32 freq = params->frequency * 62500;
++ u32 freq = params->frequency * 125 *
++ ((params->mode == V4L2_TUNER_RADIO) ? 1 : 1000) / 2;
+
+ priv->mode = TDA18271_ANALOG;
+
+ if (params->mode == V4L2_TUNER_RADIO) {
+- freq = freq / 1000;
+ map = &std_map->fm_radio;
+ mode = "fm";
+ } else if (params->std & V4L2_STD_MN) {
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:44 2009
+Message-Id: <20091207000644.688098245@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:03 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Devin Heitmueller <dheitmueller@kernellabs.com>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>
+Subject: [027/119] V4L/DVB (13190): em28xx: fix panic that can occur when starting audio streaming
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=v4l-dvb-13190-em28xx-fix-panic-that-can-occur-when-starting-audio-streaming.patch
+Content-Length: 1170
+Lines: 34
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Devin Heitmueller <dheitmueller@kernellabs.com>
+
+commit 96fbf771d86a90ff006bc62ca4d4de6474b3de31 upstream.
+
+Because the counters were not reset when starting up streaming, they would
+be reused from the previous run. This can result in cases such that when the
+second instance of streaming starts up, the "cnt" variable in
+em28xx_audio_isocirq() can end up being negative, resulting in attempting to
+write to memory before the start of runtime->dma_area (as well as having a
+negative number of bytes to copy).
+
+Signed-off-by: Devin Heitmueller <dheitmueller@kernellabs.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/em28xx/em28xx-audio.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/media/video/em28xx/em28xx-audio.c
++++ b/drivers/media/video/em28xx/em28xx-audio.c
+@@ -383,6 +383,11 @@ static int snd_em28xx_hw_capture_free(st
+
+ static int snd_em28xx_prepare(struct snd_pcm_substream *substream)
+ {
++ struct em28xx *dev = snd_pcm_substream_chip(substream);
++
++ dev->adev.hwptr_done_capture = 0;
++ dev->adev.capture_transfer_done = 0;
++
+ return 0;
+ }
+
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:44 2009
+Message-Id: <20091207000644.842360924@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:04 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Martin Samek <martin@marsark.sytes.net>,
+ Devin Heitmueller <dheitmueller@kernellabs.com>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>
+Subject: [028/119] V4L/DVB (13079): dib0700: fixed xc2028 firmware loading kernel oops
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=v4l-dvb-13079-dib0700-fixed-xc2028-firmware-loading-kernel-oops.patch
+Content-Length: 1410
+Lines: 36
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Martin Samek <martin@marsark.sytes.net>
+
+commit 7646b9de26c54cf4bc9c446d7ada9f91ece31e0a upstream.
+
+Fixing kernel oops when driver attemps to load xc2028 firmware.
+
+Note by djh: the patch contribute by Martin is a port of a fix I made during
+the PCTV 340e development. It's a temporary workaround that fixes a regression
+(an OOPS condition) and the real fix should be in the code that manages the
+i2c master on the dib7000p. But this fix does address the immmediate
+regression and should be merged upstream until we do a cleaner fix.
+
+Signed-off-by: Martin Samek <martin@marsark.sytes.net>
+Signed-off-by: Devin Heitmueller <dheitmueller@kernellabs.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/dvb/frontends/dib7000p.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/media/dvb/frontends/dib7000p.c
++++ b/drivers/media/dvb/frontends/dib7000p.c
+@@ -1344,6 +1344,11 @@ struct dvb_frontend * dib7000p_attach(st
+ if (dib7000p_identify(st) != 0)
+ goto error;
+
++ /* FIXME: make sure the dev.parent field is initialized, or else
++ request_firmware() will hit an OOPS (this should be moved somewhere
++ more common) */
++ st->i2c_master.gated_tuner_i2c_adap.dev.parent = i2c_adap->dev.parent;
++
+ dibx000_init_i2c_master(&st->i2c_master, DIB7000P, st->i2c_adap, st->i2c_addr);
+
+ dib7000p_demod_reset(st);
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:45 2009
+Message-Id: <20091207000644.975903460@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:05 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mike Isely <isely@pobox.com>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>
+Subject: [029/119] V4L/DVB (13230): s2255drv: Dont conditionalize video buffer completion on waiting processes
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=v4l-dvb-13230-s2255drv-don-t-conditionalize-video-buffer-completion-on-waiting-processes.patch
+Content-Length: 1820
+Lines: 44
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Mike Isely <isely@pobox.com>
+
+commit 1f95725755ab67f3198df3b5bf7517f926f310ca upstream.
+
+The s2255 driver had logic which aborted processing of a video frame
+if there was no process waiting on the video buffer in question. That
+simply doesn't work when the application is doing things in an
+asynchronous manner. If the application went to the trouble to queue
+the buffer in the first place, then the driver should always attempt
+to complete it - even if the application at that moment has its
+attention turned elsewhere. Applications which always blocked waiting
+for I/O on the capture device would not have been affected by this.
+Applications which *mostly* blocked waiting for I/O on the capture
+device probably only would have been somewhat affected (frame lossage,
+at a rate which goes up as the application blocks less). Applications
+which never blocked on the capture device (e.g. polling only) however
+would never have been able to receive any video frames, since in that
+case this "is anyone waiting on this?" check on the buffer never would
+have evalutated true. This patch just deletes that harmful check
+against the buffer's wait queue.
+
+Signed-off-by: Mike Isely <isely@pobox.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/s2255drv.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/drivers/media/video/s2255drv.c
++++ b/drivers/media/video/s2255drv.c
+@@ -598,11 +598,6 @@ static int s2255_got_frame(struct s2255_
+ buf = list_entry(dma_q->active.next,
+ struct s2255_buffer, vb.queue);
+
+- if (!waitqueue_active(&buf->vb.done)) {
+- /* no one active */
+- rc = -1;
+- goto unlock;
+- }
+ list_del(&buf->vb.queue);
+ do_gettimeofday(&buf->vb.ts);
+ dprintk(100, "[%p/%d] wakeup\n", buf, buf->vb.i);
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:45 2009
+Message-Id: <20091207000645.124173920@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:06 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Thomas Gleixner <tglx@linutronix.de>,
+ Dhaval Giani <dhaval@linux.vnet.ibm.com>,
+ "Paul E. McKenney" <paulmck@us.ibm.com>,
+ Kay Sievers <kay.sievers@vrfy.org>
+Subject: [030/119] uids: Prevent tear down race
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=uids-prevent-tear-down-race.patch
+Content-Length: 2443
+Lines: 66
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit b00bc0b237055b4c45816325ee14f0bd83e6f590 upstream.
+
+Ingo triggered the following warning:
+
+WARNING: at lib/debugobjects.c:255 debug_print_object+0x42/0x50()
+Hardware name: System Product Name
+ODEBUG: init active object type: timer_list
+Modules linked in:
+Pid: 2619, comm: dmesg Tainted: G W 2.6.32-rc5-tip+ #5298
+Call Trace:
+ [<81035443>] warn_slowpath_common+0x6a/0x81
+ [<8120e483>] ? debug_print_object+0x42/0x50
+ [<81035498>] warn_slowpath_fmt+0x29/0x2c
+ [<8120e483>] debug_print_object+0x42/0x50
+ [<8120ec2a>] __debug_object_init+0x279/0x2d7
+ [<8120ecb3>] debug_object_init+0x13/0x18
+ [<810409d2>] init_timer_key+0x17/0x6f
+ [<81041526>] free_uid+0x50/0x6c
+ [<8104ed2d>] put_cred_rcu+0x61/0x72
+ [<81067fac>] rcu_do_batch+0x70/0x121
+
+debugobjects warns about an enqueued timer being initialized. If
+CONFIG_USER_SCHED=y the user management code uses delayed work to
+remove the user from the hash table and tear down the sysfs objects.
+
+free_uid is called from RCU and initializes/schedules delayed work if
+the usage count of the user_struct is 0. The init/schedule happens
+outside of the uidhash_lock protected region which allows a concurrent
+caller of find_user() to reference the about to be destroyed
+user_struct w/o preventing the work from being scheduled. If the next
+free_uid call happens before the work timer expired then the active
+timer is initialized and the work scheduled again.
+
+The race was introduced in commit 5cb350ba (sched: group scheduling,
+sysfs tunables) and made more prominent by commit 3959214f (sched:
+delayed cleanup of user_struct)
+
+Move the init/schedule_delayed_work inside of the uidhash_lock
+protected region to prevent the race.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Dhaval Giani <dhaval@linux.vnet.ibm.com>
+Cc: Paul E. McKenney <paulmck@us.ibm.com>
+Cc: Kay Sievers <kay.sievers@vrfy.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/user.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/user.c
++++ b/kernel/user.c
+@@ -330,9 +330,9 @@ done:
+ */
+ static void free_user(struct user_struct *up, unsigned long flags)
+ {
+- spin_unlock_irqrestore(&uidhash_lock, flags);
+ INIT_DELAYED_WORK(&up->work, cleanup_user_struct);
+ schedule_delayed_work(&up->work, msecs_to_jiffies(1000));
++ spin_unlock_irqrestore(&uidhash_lock, flags);
+ }
+
+ #else /* CONFIG_USER_SCHED && CONFIG_SYSFS */
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:45 2009
+Message-Id: <20091207000645.293589784@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:07 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Rodolfo Giometti <giometti@linux.it>
+Subject: [031/119] pps: events reporting fix up
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=pps-events-reporting-fix-up.patch
+Content-Length: 2582
+Lines: 79
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Rodolfo Giometti <giometti@linux.it>
+
+commit 276b282e904f690dc930f9bc946110651f297669 upstream.
+
+PPS events must be recorded according to PPS's mode settings.
+
+If a process asks for (i.e.) capture-assert events only, when the PPS
+client calls the pps_event() function to save the current PPS event, we
+should verify the event type and then discard unwanted ones.
+
+Also, without this patch userland processes waiting for a specific PPS
+event (assert or clear but not both) may be awakened at wrong time.
+
+Signed-off-by: Rodolfo Giometti <giometti@linux.it>
+Tested-by: William S. Brasher <billb958@door.net>
+Tested-by: Reg Clemens <clemens@dwf.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pps/kapi.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+--- a/drivers/pps/kapi.c
++++ b/drivers/pps/kapi.c
+@@ -271,6 +271,7 @@ void pps_event(int source, struct pps_kt
+ {
+ struct pps_device *pps;
+ unsigned long flags;
++ int captured = 0;
+
+ if ((event & (PPS_CAPTUREASSERT | PPS_CAPTURECLEAR)) == 0) {
+ printk(KERN_ERR "pps: unknown event (%x) for source %d\n",
+@@ -293,7 +294,8 @@ void pps_event(int source, struct pps_kt
+
+ /* Check the event */
+ pps->current_mode = pps->params.mode;
+- if (event & PPS_CAPTUREASSERT) {
++ if ((event & PPS_CAPTUREASSERT) &
++ (pps->params.mode & PPS_CAPTUREASSERT)) {
+ /* We have to add an offset? */
+ if (pps->params.mode & PPS_OFFSETASSERT)
+ pps_add_offset(ts, &pps->params.assert_off_tu);
+@@ -303,8 +305,11 @@ void pps_event(int source, struct pps_kt
+ pps->assert_sequence++;
+ pr_debug("capture assert seq #%u for source %d\n",
+ pps->assert_sequence, source);
++
++ captured = ~0;
+ }
+- if (event & PPS_CAPTURECLEAR) {
++ if ((event & PPS_CAPTURECLEAR) &
++ (pps->params.mode & PPS_CAPTURECLEAR)) {
+ /* We have to add an offset? */
+ if (pps->params.mode & PPS_OFFSETCLEAR)
+ pps_add_offset(ts, &pps->params.clear_off_tu);
+@@ -314,12 +319,17 @@ void pps_event(int source, struct pps_kt
+ pps->clear_sequence++;
+ pr_debug("capture clear seq #%u for source %d\n",
+ pps->clear_sequence, source);
++
++ captured = ~0;
+ }
+
+- pps->go = ~0;
+- wake_up_interruptible(&pps->queue);
++ /* Wake up iif captured somthing */
++ if (captured) {
++ pps->go = ~0;
++ wake_up_interruptible(&pps->queue);
+
+- kill_fasync(&pps->async_queue, SIGIO, POLL_IN);
++ kill_fasync(&pps->async_queue, SIGIO, POLL_IN);
++ }
+
+ spin_unlock_irqrestore(&pps->lock, flags);
+
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:45 2009
+Message-Id: <20091207000645.465147414@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:08 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Rodolfo Giometti <giometti@linux.it>
+Subject: [032/119] pps: locking scheme fix up for PPS_GETPARAMS
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=pps-locking-scheme-fix-up-for-pps_getparams.patch
+Content-Length: 1091
+Lines: 38
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Rodolfo Giometti <giometti@linux.it>
+
+commit cbf83cc5a29dba480cf1ba1c5e3417a0d4a31410 upstream.
+
+Userland programs may read/write PPS parameters at same time and these
+operations may corrupt PPS data.
+
+Signed-off-by: Rodolfo Giometti <giometti@linux.it>
+Tested-by: Reg Clemens <clemens@dwf.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pps/pps.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/pps/pps.c
++++ b/drivers/pps/pps.c
+@@ -71,9 +71,14 @@ static long pps_cdev_ioctl(struct file *
+ case PPS_GETPARAMS:
+ pr_debug("PPS_GETPARAMS: source %d\n", pps->id);
+
+- /* Return current parameters */
+- err = copy_to_user(uarg, &pps->params,
+- sizeof(struct pps_kparams));
++ spin_lock_irq(&pps->lock);
++
++ /* Get the current parameters */
++ params = pps->params;
++
++ spin_unlock_irq(&pps->lock);
++
++ err = copy_to_user(uarg, ¶ms, sizeof(struct pps_kparams));
+ if (err)
+ return -EFAULT;
+
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:45 2009
+Message-Id: <20091207000645.634727566@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:09 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alessandro Zummo <a.zummo@towertech.it>,
+ Paul Gortmaker <p_gortmaker@yahoo.com>,
+ Raphael Assenat <raph@8d.com>
+Subject: [033/119] rtc: v3020: fix v3020_mmio_read_bit()
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=rtc-v3020-fix-v3020_mmio_read_bit.patch
+Content-Length: 1345
+Lines: 38
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Scott Valentine <svalentine@concentris-systems.com>
+
+commit bcb3a1676b87effbdeffe8da5c44f63433d158d9 upstream.
+
+v3020_mmio_read_bit() always returns 0 when left_shift > 7.
+
+v3020_mmio_read_bit()'s return type is (unsigned char). The code returns
+a value masked by (1 << left_shift) that is casted to the return type. If
+left_shift is larger than 7, the cast will always result in a 0 return
+value. The problem was discovered with left_shift = 16, and the included
+patch corrects the problem.
+
+The bug was introduced in the last (Apr 3 2009) commit of the file, kernel
+versions 2.6.30 and later.
+
+Cc: Alessandro Zummo <a.zummo@towertech.it>
+Cc: Paul Gortmaker <p_gortmaker@yahoo.com>
+Cc: Raphael Assenat <raph@8d.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/rtc/rtc-v3020.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/rtc/rtc-v3020.c
++++ b/drivers/rtc/rtc-v3020.c
+@@ -96,7 +96,7 @@ static void v3020_mmio_write_bit(struct
+
+ static unsigned char v3020_mmio_read_bit(struct v3020 *chip)
+ {
+- return readl(chip->ioaddress) & (1 << chip->leftshift);
++ return !!(readl(chip->ioaddress) & (1 << chip->leftshift));
+ }
+
+ static struct v3020_chip_ops v3020_mmio_ops = {
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:45 2009
+Message-Id: <20091207000645.840002105@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:10 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Heiko Carstens <heiko.carstens@de.ibm.com>,
+ Ankit Jain <me@ankitjain.org>,
+ Christoph Hellwig <hch@lst.de>,
+ Al Viro <viro@zeniv.linux.org.uk>,
+ Arnd Bergmann <arndbergmann@googlemail.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [034/119] fs: add missing compat_ptr handling for FS_IOC_RESVSP ioctl
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=fs-add-missing-compat_ptr-handling-for-fs_ioc_resvsp-ioctl.patch
+Content-Length: 1667
+Lines: 46
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+
+commit 7779d7bed950a7fb1af4f540c2f82a6b81b65901 upstream.
+
+For FS_IOC_RESVSP and FS_IOC_RESVSP64 compat_sys_ioctl() uses its
+arg argument as a pointer to userspace. However it is missing a
+a call to compat_ptr() which will do a proper pointer conversion.
+
+This was introduced with 3e63cbb1 "fs: Add new pre-allocation ioctls
+to vfs for compatibility with legacy xfs ioctls".
+
+Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Cc: Ankit Jain <me@ankitjain.org>
+Acked-by: Christoph Hellwig <hch@lst.de>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Acked-by: Arnd Bergmann <arndbergmann@googlemail.com>
+Acked-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/compat_ioctl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/compat_ioctl.c
++++ b/fs/compat_ioctl.c
+@@ -1800,7 +1800,7 @@ struct space_resv_32 {
+ /* just account for different alignment */
+ static int compat_ioctl_preallocate(struct file *file, unsigned long arg)
+ {
+- struct space_resv_32 __user *p32 = (void __user *)arg;
++ struct space_resv_32 __user *p32 = compat_ptr(arg);
+ struct space_resv __user *p = compat_alloc_user_space(sizeof(*p));
+
+ if (copy_in_user(&p->l_type, &p32->l_type, sizeof(s16)) ||
+@@ -2802,7 +2802,7 @@ asmlinkage long compat_sys_ioctl(unsigne
+ #else
+ case FS_IOC_RESVSP:
+ case FS_IOC_RESVSP64:
+- error = ioctl_preallocate(filp, (void __user *)arg);
++ error = ioctl_preallocate(filp, compat_ptr(arg));
+ goto out_fput;
+ #endif
+
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:46 2009
+Message-Id: <20091207000646.002713921@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:11 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Balbir Singh <balbir@in.ibm.com>,
+ KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Subject: [035/119] memcg: fix wrong pointer initialization at page migration when memcg is disabled.
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=memcg-fix-wrong-pointer-initialization-at-page-migration-when-memcg-is-disabled.patch
+Content-Length: 1301
+Lines: 40
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+
+commit e00e431612c3a6e437a01f2129fd3843da0c982a upstream.
+
+Lee Schermerhorn reported that he saw bad pointer dereference in
+mem_cgroup_end_migration() when he disabled memcg by boot option.
+
+memcg's page migration logic works as
+
+ mem_cgroup_prepare_migration(page, &ptr);
+ do page migration
+ mem_cgroup_end_migration(page, ptr);
+
+Now, ptr is not initialized in prepare_migration when memcg is disabled
+by boot option. This causes panic in end_migration. This patch fixes it.
+
+Reported-by: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
+Cc: Balbir Singh <balbir@in.ibm.com>
+Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Reviewed-by: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/migrate.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -597,7 +597,7 @@ static int unmap_and_move(new_page_t get
+ struct page *newpage = get_new_page(page, private, &result);
+ int rcu_locked = 0;
+ int charge = 0;
+- struct mem_cgroup *mem;
++ struct mem_cgroup *mem = NULL;
+
+ if (!newpage)
+ return -ENOMEM;
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:46 2009
+Message-Id: <20091207000646.180789285@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:12 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Sukadev Bhattiprolu <sukadev@us.ibm.com>,
+ "Eric W. Biederman" <ebiederm@xmission.com>,
+ Jan Kara <jack@ucw.cz>,
+ Andrea Arcangeli <andrea@cpushare.com>,
+ Serge Hallyn <serue@us.ibm.com>
+Subject: [036/119] pidns: fix a leak in /proc dentries and inodes with pid namespaces.
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=pidns-fix-a-leak-in-proc-dentries-and-inodes-with-pid-namespaces.patch
+Content-Length: 2251
+Lines: 58
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
+
+commit 29f12ca32122db98481150be09d35bd72b68045e upstream.
+
+Daniel Lezcano reported a leak in 'struct pid' and 'struct pid_namespace'
+that is discussed in:
+
+ http://lkml.org/lkml/2009/10/2/159.
+
+To summarize the thread, when container-init is terminated, it sets the
+PF_EXITING flag, zaps other processes in the container and waits to reap
+them. As a part of reaping, the container-init should flush any /proc
+dentries associated with the processes. But because the container-init is
+itself exiting and the following PF_EXITING check, the dentries are not
+flushed, resulting in leak in /proc inodes and dentries.
+
+This fix reverts the commit 7766755a2f249e7e0 ("Fix /proc dcache deadlock
+in do_exit") which introduced the check for PF_EXITING. At the time of
+the commit, shrink_dcache_parent() flushed dentries from other filesystems
+also and could have caused a deadlock which the commit fixed. But as
+pointed out by Eric Biederman, after commit 0feae5c47aabdde59,
+shrink_dcache_parent() no longer affects other filesystems. So reverting
+the commit is now safe.
+
+As pointed out by Jan Kara, the leak is not as critical since the
+unclaimed space will be reclaimed under memory pressure or by:
+
+ echo 3 > /proc/sys/vm/drop_caches
+
+But since this check is no longer required, its best to remove it.
+
+Signed-off-by: Sukadev Bhattiprolu <sukadev@us.ibm.com>
+Reported-by: Daniel Lezcano <dlezcano@fr.ibm.com>
+Acked-by: Eric W. Biederman <ebiederm@xmission.com>
+Acked-by: Jan Kara <jack@ucw.cz>
+Cc: Andrea Arcangeli <andrea@cpushare.com>
+Cc: Serge Hallyn <serue@us.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/proc/base.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -2580,8 +2580,7 @@ static void proc_flush_task_mnt(struct v
+ name.len = snprintf(buf, sizeof(buf), "%d", pid);
+ dentry = d_hash_and_lookup(mnt->mnt_root, &name);
+ if (dentry) {
+- if (!(current->flags & PF_EXITING))
+- shrink_dcache_parent(dentry);
++ shrink_dcache_parent(dentry);
+ d_drop(dentry);
+ dput(dentry);
+ }
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:46 2009
+Message-Id: <20091207000646.342613889@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:13 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mel Gorman <mel@csn.ul.ie>,
+ David Rientjes <rientjes@google.com>
+Subject: [037/119] page allocator: Do not allow interrupts to use ALLOC_HARDER
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=page-allocator-do-not-allow-interrupts-to-use-alloc_harder.patch
+Content-Length: 1461
+Lines: 40
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Mel Gorman <mel@csn.ul.ie>
+
+commit 9d0ed60fe9cd1fbf57f755cd27a23ae9114d7210 upstream.
+
+Commit 341ce06f69abfafa31b9468410a13dbd60e2b237 ("page allocator:
+calculate the alloc_flags for allocation only once") altered watermark
+logic slightly by allowing rt_tasks that are handling an interrupt to set
+ALLOC_HARDER. This patch brings the watermark logic more in line with
+2.6.30.
+
+This change results in a reduction of the number high-order GFP_ATOMIC
+allocation failures reported. See
+http://www.gossamer-threads.com/lists/linux/kernel/1144153
+
+[rientjes@google.com: Spotted the problem]
+Signed-off-by: Mel Gorman <mel@csn.ul.ie>
+Reviewed-by: Pekka Enberg <penberg@cs.helsinki.fi>
+Reviewed-by: Rik van Riel <riel@redhat.com>
+Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Cc: David Rientjes <rientjes@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/page_alloc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -1715,7 +1715,7 @@ gfp_to_alloc_flags(gfp_t gfp_mask)
+ * See also cpuset_zone_allowed() comment in kernel/cpuset.c.
+ */
+ alloc_flags &= ~ALLOC_CPUSET;
+- } else if (unlikely(rt_task(p)))
++ } else if (unlikely(rt_task(p)) && !in_interrupt())
+ alloc_flags |= ALLOC_HARDER;
+
+ if (likely(!(gfp_mask & __GFP_NOMEMALLOC))) {
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:46 2009
+Message-Id: <20091207000646.474598476@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:14 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mel Gorman <mel@csn.ul.ie>
+Subject: [038/119] page allocator: always wake kswapd when restarting an allocation attempt after direct reclaim failed
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=page-allocator-always-wake-kswapd-when-restarting-an-allocation-attempt-after-direct-reclaim-failed.patch
+Content-Length: 1883
+Lines: 49
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Mel Gorman <mel@csn.ul.ie>
+
+commit cc4a6851466039a8a688c843962a05689059ff3b upstream.
+
+If a direct reclaim makes no forward progress, it considers whether it
+should go OOM or not. Whether OOM is triggered or not, it may retry the
+allocation afterwards. In times past, this would always wake kswapd as
+well but currently, kswapd is not woken up after direct reclaim fails.
+For order-0 allocations, this makes little difference but if there is a
+heavy mix of higher-order allocations that direct reclaim is failing for,
+it might mean that kswapd is not rewoken for higher orders as much as it
+did previously.
+
+This patch wakes up kswapd when an allocation is being retried after a
+direct reclaim failure. It would be expected that kswapd is already
+awake, but this has the effect of telling kswapd to reclaim at the higher
+order as well.
+
+Signed-off-by: Mel Gorman <mel@csn.ul.ie>
+Reviewed-by: Christoph Lameter <cl@linux-foundation.org>
+Reviewed-by: Pekka Enberg <penberg@cs.helsinki.fi>
+Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/page_alloc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -1763,6 +1763,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, u
+ if (NUMA_BUILD && (gfp_mask & GFP_THISNODE) == GFP_THISNODE)
+ goto nopage;
+
++restart:
+ wake_all_kswapd(order, zonelist, high_zoneidx);
+
+ /*
+@@ -1772,7 +1773,6 @@ __alloc_pages_slowpath(gfp_t gfp_mask, u
+ */
+ alloc_flags = gfp_to_alloc_flags(gfp_mask);
+
+-restart:
+ /* This is the last chance, in general, before the goto nopage. */
+ page = get_page_from_freelist(gfp_mask, nodemask, order, zonelist,
+ high_zoneidx, alloc_flags & ~ALLOC_NO_WATERMARKS,
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:46 2009
+Message-Id: <20091207000646.604074717@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:15 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Cox <alan@linux.intel.com>
+Subject: [039/119] tty_port: If we are opened non blocking we still need to raise the carrier
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=tty_port-if-we-are-opened-non-blocking-we-still-need-to-raise-the-carrier.patch
+Content-Length: 1243
+Lines: 38
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Alan Cox <alan@linux.intel.com>
+
+commit 4175f3e31cc7157669aa66d46dc79de6ae0126ce upstream.
+
+Original discussion:
+http://thread.gmane.org/gmane.linux.usb.general/23217/focus=23248
+or
+http://marc.info/?l=linux-usb&m=125553790714133&w=2
+
+The tty_port code inherited a bug common to various drivers it was based
+upon. If the tty is opened O_NONBLOCK we do not wait for the carrier to be
+raised but we must still raise our modem lines if appropriate.
+
+(There is a second question here about whether we should do so if CLOCAL is
+ set but that can wait)
+
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Reported-by: Karl Hiramoto <karl@hiramoto.org>
+Tested-by: Karl Hiramoto <karl@hiramoto.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/tty_port.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/char/tty_port.c
++++ b/drivers/char/tty_port.c
+@@ -219,6 +219,9 @@ int tty_port_block_til_ready(struct tty_
+ the port has just hung up or is in another error state */
+ if ((filp->f_flags & O_NONBLOCK) ||
+ (tty->flags & (1 << TTY_IO_ERROR))) {
++ /* Indicate we are open */
++ if (tty->termios->c_cflag & CBAUD)
++ tty_port_raise_dtr_rts(port);
+ port->flags |= ASYNC_NORMAL_ACTIVE;
+ return 0;
+ }
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:46 2009
+Message-Id: <20091207000646.768823232@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:16 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Cox <alan@linux.intel.com>
+Subject: [040/119] tty: cp210x: Fix carrier handling
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=tty-cp210x-fix-carrier-handling.patch
+Content-Length: 2566
+Lines: 80
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Alan Cox <alan@linux.intel.com>
+
+commit d94c7bd4c1361cab58a21d530078c5673863dcc2 upstream.
+
+Original discussion:
+http://thread.gmane.org/gmane.linux.usb.general/23217/focus=23248
+or
+http://marc.info/?l=linux-usb&m=125553790714133&w=2
+
+9a68e39d4a701fb3be03cae9b462408664ebd205 broke carrier handling so that a
+cp210x setup which needed the carrier lines set up (non CLOCAL) which did
+not make a call which set the termios bits left the lines down even if
+CLOCAL was not asserted.
+
+Fix this not by reverting but by adding the proper dtr_rts and
+carrier_raised methods. This both sets the modem lines properly and also
+implements the correct blocking semantics for the port as required by
+POSIX.
+
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Reported-by: Karl Hiramoto <karl@hiramoto.org>
+Tested-by: Karl Hiramoto <karl@hiramoto.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/cp210x.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -51,6 +51,8 @@ static int cp210x_tiocmset_port(struct u
+ static void cp210x_break_ctl(struct tty_struct *, int);
+ static int cp210x_startup(struct usb_serial *);
+ static void cp210x_disconnect(struct usb_serial *);
++static void cp210x_dtr_rts(struct usb_serial_port *p, int on);
++static int cp210x_carrier_raised(struct usb_serial_port *p);
+
+ static int debug;
+
+@@ -144,6 +146,8 @@ static struct usb_serial_driver cp210x_d
+ .tiocmset = cp210x_tiocmset,
+ .attach = cp210x_startup,
+ .disconnect = cp210x_disconnect,
++ .dtr_rts = cp210x_dtr_rts,
++ .carrier_raised = cp210x_carrier_raised
+ };
+
+ /* Config request types */
+@@ -748,6 +752,14 @@ static int cp210x_tiocmset_port(struct u
+ return cp210x_set_config(port, CP210X_SET_MHS, &control, 2);
+ }
+
++static void cp210x_dtr_rts(struct usb_serial_port *p, int on)
++{
++ if (on)
++ cp210x_tiocmset_port(p, NULL, TIOCM_DTR|TIOCM_RTS, 0);
++ else
++ cp210x_tiocmset_port(p, NULL, 0, TIOCM_DTR|TIOCM_RTS);
++}
++
+ static int cp210x_tiocmget (struct tty_struct *tty, struct file *file)
+ {
+ struct usb_serial_port *port = tty->driver_data;
+@@ -770,6 +782,15 @@ static int cp210x_tiocmget (struct tty_s
+ return result;
+ }
+
++static int cp210x_carrier_raised(struct usb_serial_port *p)
++{
++ unsigned int control;
++ cp210x_get_config(p, CP210X_GET_MDMSTS, &control, 1);
++ if (control & CONTROL_DCD)
++ return 1;
++ return 0;
++}
++
+ static void cp210x_break_ctl (struct tty_struct *tty, int break_state)
+ {
+ struct usb_serial_port *port = tty->driver_data;
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:47 2009
+Message-Id: <20091207000646.961519997@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:17 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Libin Yang <libin.yang@amd.com>,
+ David Brownell <dbrownell@users.sourceforge.net>,
+ Alan Stern <stern@rowland.harvard.edu>
+Subject: [041/119] USB: ohci: quirk AMD prefetch for USB 1.1 ISO transfer
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=usb-ohci-quirk-amd-prefetch-for-usb-1.1-iso-transfer.patch
+Content-Length: 4442
+Lines: 145
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Libin Yang <libin.yang@amd.com>
+
+commit a1f17a872bc7b1cb7efdd5486a2963e88a536e61 upstream.
+
+The following patch in the driver is required to avoid USB 1.1 device
+failures that may occur due to requests from USB OHCI controllers may
+be overwritten if the latency for any pending request by the USB
+controller is very long (in the range of milliseconds).
+
+Signed-off-by: Libin Yang <libin.yang@amd.com>
+Cc: David Brownell <dbrownell@users.sourceforge.net>
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/ohci-hcd.c | 5 +++++
+ drivers/usb/host/ohci-pci.c | 20 ++++++++++++++++++++
+ drivers/usb/host/ohci-q.c | 18 ++++++++++++------
+ drivers/usb/host/ohci.h | 9 +++++++++
+ 4 files changed, 46 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/host/ohci.h
++++ b/drivers/usb/host/ohci.h
+@@ -402,6 +402,7 @@ struct ohci_hcd {
+ #define OHCI_QUIRK_FRAME_NO 0x80 /* no big endian frame_no shift */
+ #define OHCI_QUIRK_HUB_POWER 0x100 /* distrust firmware power/oc setup */
+ #define OHCI_QUIRK_AMD_ISO 0x200 /* ISO transfers*/
++#define OHCI_QUIRK_AMD_PREFETCH 0x400 /* pre-fetch for ISO transfer */
+ // there are also chip quirks/bugs in init logic
+
+ struct work_struct nec_work; /* Worker for NEC quirk */
+@@ -433,6 +434,10 @@ static inline int quirk_amdiso(struct oh
+ {
+ return ohci->flags & OHCI_QUIRK_AMD_ISO;
+ }
++static inline int quirk_amdprefetch(struct ohci_hcd *ohci)
++{
++ return ohci->flags & OHCI_QUIRK_AMD_PREFETCH;
++}
+ #else
+ static inline int quirk_nec(struct ohci_hcd *ohci)
+ {
+@@ -446,6 +451,10 @@ static inline int quirk_amdiso(struct oh
+ {
+ return 0;
+ }
++static inline int quirk_amdprefetch(struct ohci_hcd *ohci)
++{
++ return 0;
++}
+ #endif
+
+ /* convert between an hcd pointer and the corresponding ohci_hcd */
+--- a/drivers/usb/host/ohci-hcd.c
++++ b/drivers/usb/host/ohci-hcd.c
+@@ -88,6 +88,7 @@ static int ohci_restart (struct ohci_hcd
+ #ifdef CONFIG_PCI
+ static void quirk_amd_pll(int state);
+ static void amd_iso_dev_put(void);
++static void sb800_prefetch(struct ohci_hcd *ohci, int on);
+ #else
+ static inline void quirk_amd_pll(int state)
+ {
+@@ -97,6 +98,10 @@ static inline void amd_iso_dev_put(void)
+ {
+ return;
+ }
++static inline void sb800_prefetch(struct ohci_hcd *ohci, int on)
++{
++ return;
++}
+ #endif
+
+
+--- a/drivers/usb/host/ohci-pci.c
++++ b/drivers/usb/host/ohci-pci.c
+@@ -177,6 +177,13 @@ static int ohci_quirk_amd700(struct usb_
+ return 0;
+
+ pci_read_config_byte(amd_smbus_dev, PCI_REVISION_ID, &rev);
++
++ /* SB800 needs pre-fetch fix */
++ if ((rev >= 0x40) && (rev <= 0x4f)) {
++ ohci->flags |= OHCI_QUIRK_AMD_PREFETCH;
++ ohci_dbg(ohci, "enabled AMD prefetch quirk\n");
++ }
++
+ if ((rev > 0x3b) || (rev < 0x30)) {
+ pci_dev_put(amd_smbus_dev);
+ amd_smbus_dev = NULL;
+@@ -262,6 +269,19 @@ static void amd_iso_dev_put(void)
+
+ }
+
++static void sb800_prefetch(struct ohci_hcd *ohci, int on)
++{
++ struct pci_dev *pdev;
++ u16 misc;
++
++ pdev = to_pci_dev(ohci_to_hcd(ohci)->self.controller);
++ pci_read_config_word(pdev, 0x50, &misc);
++ if (on == 0)
++ pci_write_config_word(pdev, 0x50, misc & 0xfcff);
++ else
++ pci_write_config_word(pdev, 0x50, misc | 0x0300);
++}
++
+ /* List of quirks for OHCI */
+ static const struct pci_device_id ohci_pci_quirks[] = {
+ {
+--- a/drivers/usb/host/ohci-q.c
++++ b/drivers/usb/host/ohci-q.c
+@@ -49,9 +49,12 @@ __acquires(ohci->lock)
+ switch (usb_pipetype (urb->pipe)) {
+ case PIPE_ISOCHRONOUS:
+ ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs--;
+- if (ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs == 0
+- && quirk_amdiso(ohci))
+- quirk_amd_pll(1);
++ if (ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs == 0) {
++ if (quirk_amdiso(ohci))
++ quirk_amd_pll(1);
++ if (quirk_amdprefetch(ohci))
++ sb800_prefetch(ohci, 0);
++ }
+ break;
+ case PIPE_INTERRUPT:
+ ohci_to_hcd(ohci)->self.bandwidth_int_reqs--;
+@@ -680,9 +683,12 @@ static void td_submit_urb (
+ data + urb->iso_frame_desc [cnt].offset,
+ urb->iso_frame_desc [cnt].length, urb, cnt);
+ }
+- if (ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs == 0
+- && quirk_amdiso(ohci))
+- quirk_amd_pll(0);
++ if (ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs == 0) {
++ if (quirk_amdiso(ohci))
++ quirk_amd_pll(0);
++ if (quirk_amdprefetch(ohci))
++ sb800_prefetch(ohci, 1);
++ }
+ periodic = ohci_to_hcd(ohci)->self.bandwidth_isoc_reqs++ == 0
+ && ohci_to_hcd(ohci)->self.bandwidth_int_reqs == 0;
+ break;
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:47 2009
+Message-Id: <20091207000647.094897781@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:18 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Stern <stern@rowland.harvard.edu>,
+ Pete Zaitcev <zaitcev@redhat.com>
+Subject: [042/119] USB: usbmon: fix bug in mon_buff_area_shrink
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=usb-usbmon-fix-bug-in-mon_buff_area_shrink.patch
+Content-Length: 2366
+Lines: 65
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit fca94748c5136ff390eadc443871b82f1f77dcd6 upstream.
+
+This patch (as1299b) fixes a bug in an error-handling path of usbmon's
+binary interface. The storage area for URB data is divided into
+fixed-size blocks. If an URB's data can't be copied, the area
+reserved for it should be decreased to the size of the truncated
+information (rounded up to a block boundary). Rounding up the amount
+to be removed and subtracting it from the reserved size is definitely
+the wrong thing to do.
+
+Also, when the data for an isochronous URB can't be copied, we can
+still copy the isoc packet descriptors. In fact the current code does
+copy the descriptors, but then sets the capture length to 0 so they
+remain inaccessible. The capture length should be reduced to the
+length of the descriptors, not set to 0.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Acked-by: Pete Zaitcev <zaitcev@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/mon/mon_bin.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/mon/mon_bin.c
++++ b/drivers/usb/mon/mon_bin.c
+@@ -350,12 +350,12 @@ static unsigned int mon_buff_area_alloc_
+
+ /*
+ * Return a few (kilo-)bytes to the head of the buffer.
+- * This is used if a DMA fetch fails.
++ * This is used if a data fetch fails.
+ */
+ static void mon_buff_area_shrink(struct mon_reader_bin *rp, unsigned int size)
+ {
+
+- size = (size + PKT_ALIGN-1) & ~(PKT_ALIGN-1);
++ /* size &= ~(PKT_ALIGN-1); -- we're called with aligned size */
+ rp->b_cnt -= size;
+ if (rp->b_in < size)
+ rp->b_in += rp->b_size;
+@@ -442,6 +442,7 @@ static void mon_bin_event(struct mon_rea
+ unsigned int urb_length;
+ unsigned int offset;
+ unsigned int length;
++ unsigned int delta;
+ unsigned int ndesc, lendesc;
+ unsigned char dir;
+ struct mon_bin_hdr *ep;
+@@ -546,8 +547,10 @@ static void mon_bin_event(struct mon_rea
+ if (length != 0) {
+ ep->flag_data = mon_bin_get_data(rp, offset, urb, length);
+ if (ep->flag_data != 0) { /* Yes, it's 0x00, not '0' */
+- ep->len_cap = 0;
+- mon_buff_area_shrink(rp, length);
++ delta = (ep->len_cap + PKT_ALIGN-1) & ~(PKT_ALIGN-1);
++ ep->len_cap -= length;
++ delta -= (ep->len_cap + PKT_ALIGN-1) & ~(PKT_ALIGN-1);
++ mon_buff_area_shrink(rp, delta);
+ }
+ } else {
+ ep->flag_data = data_tag;
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:47 2009
+Message-Id: <20091207000647.288211308@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:19 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Zhang Le <r0bertz@gentoo.org>
+Subject: [043/119] USB: option.c: add support for D-Link DWM-162-U5
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=usb-option.c-add-support-for-d-link-dwm-162-u5.patch
+Content-Length: 1534
+Lines: 40
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Zhang Le <r0bertz@gentoo.org>
+
+commit ff854ce0b17161a86b5ae444c6cb0aa221720fab upstream.
+
+Add D-Link DWM-162-U5 device id 1e0e:ce16 into option driver. The device
+has 4 interfaces, of which 1 is handled by storage and the other 3 by
+option driver.
+
+The device appears first as CD-only 05c6:2100 device and must be
+switched to 1e0e:ce16 mode either by using "eject CD" or usb_modeswitch.
+
+The MessageContent for usb_modeswitch.conf is:
+"55534243e0c26a85000000000000061b000000020000000000000000000000"
+
+Signed-off-by: Zhang Le <r0bertz@gentoo.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -309,6 +309,7 @@ static int option_resume(struct usb_ser
+
+ #define DLINK_VENDOR_ID 0x1186
+ #define DLINK_PRODUCT_DWM_652 0x3e04
++#define DLINK_PRODUCT_DWM_652_U5 0xce16
+
+ #define QISDA_VENDOR_ID 0x1da5
+ #define QISDA_PRODUCT_H21_4512 0x4512
+@@ -587,6 +588,7 @@ static struct usb_device_id option_ids[]
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
+ { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
+ { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
++ { USB_DEVICE(ALINK_VENDOR_ID, DLINK_PRODUCT_DWM_652_U5) }, /* Yes, ALINK_VENDOR_ID */
+ { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H21_4512) },
+ { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H21_4523) },
+ { USB_DEVICE(QISDA_VENDOR_ID, QISDA_PRODUCT_H20_4515) },
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:47 2009
+Message-Id: <20091207000647.524185088@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:20 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Henry Gebhardt <gebhardt@astro.uni-tuebingen.de>,
+ Oliver Neukum <oliver@neukum.org>
+Subject: [044/119] USB: cdc_acm: Fix race condition when opening tty
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=usb-cdc_acm-fix-race-condition-when-opening-tty.patch
+Content-Length: 870
+Lines: 29
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Henry Gebhardt <gebhardt@astro.uni-tuebingen.de>
+
+commit 18a77b5d237a67d2c621a46f5271a3b51da1b380 upstream.
+
+If acm_rx_tasklet() gets called before tty_port_block_til_ready()
+returns, then bulk IN urbs may not be sent. This fixes it.
+
+Signed-off-by: Henry Gebhardt <gebhardt@astro.uni-tuebingen.de>
+Acked-by: Oliver Neukum <oliver@neukum.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/class/cdc-acm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -609,9 +609,9 @@ static int acm_tty_open(struct tty_struc
+
+ acm->throttle = 0;
+
+- tasklet_schedule(&acm->urb_task);
+ set_bit(ASYNCB_INITIALIZED, &acm->port.flags);
+ rv = tty_port_block_til_ready(&acm->port, tty, filp);
++ tasklet_schedule(&acm->urb_task);
+ done:
+ mutex_unlock(&acm->mutex);
+ err_out:
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:48 2009
+Message-Id: <20091207000648.061330734@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:21 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Subject: [045/119] USB: xhci: Fix bug memory free after failed initialization.
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=usb-xhci-fix-bug-memory-free-after-failed-initialization.patch
+Content-Length: 1214
+Lines: 33
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+
+commit d94c05e33d9212ee67b8d4998f984cc71df8168b upstream.
+
+If the xHCI driver fails during the memory initialization, xhci->ir_set
+may not be a valid pointer. Check that it points to valid DMA'able memory
+before writing to that address during the memory freeing process.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/xhci-mem.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -756,9 +756,11 @@ void xhci_mem_cleanup(struct xhci_hcd *x
+ int i;
+
+ /* Free the Event Ring Segment Table and the actual Event Ring */
+- xhci_writel(xhci, 0, &xhci->ir_set->erst_size);
+- xhci_write_64(xhci, 0, &xhci->ir_set->erst_base);
+- xhci_write_64(xhci, 0, &xhci->ir_set->erst_dequeue);
++ if (xhci->ir_set) {
++ xhci_writel(xhci, 0, &xhci->ir_set->erst_size);
++ xhci_write_64(xhci, 0, &xhci->ir_set->erst_base);
++ xhci_write_64(xhci, 0, &xhci->ir_set->erst_dequeue);
++ }
+ size = sizeof(struct xhci_erst_entry)*(xhci->erst.num_entries);
+ if (xhci->erst.entries)
+ pci_free_consistent(pdev, size,
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:48 2009
+Message-Id: <20091207000648.343901902@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:22 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Subject: [046/119] USB: xhci: Fix TRB physical to virtual address translation.
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=usb-xhci-fix-trb-physical-to-virtual-address-translation.patch
+Content-Length: 2003
+Lines: 59
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+
+commit 2fa88daa6f299bfb83672c3b525d786ad03b4735 upstream.
+
+The trb_in_td() function in the xHCI driver is supposed to translate a
+physical transfer buffer request (TRB) into a virtual pointer to the ring
+segment that TRB is in.
+
+Unfortunately, a mistake in this function may cause endless loops as the
+driver searches through the linked list of ring segments over and over
+again. Fix a couple bugs that may lead to loops or bad output:
+
+1. Bail out if we get a NULL pointer when translating the segment's
+private structure and the starting DMA address of the segment chunk. If
+this happens, we've been handed a starting TRB pointer from a different
+ring.
+
+2. Make sure the function works when there's multiple segments in the
+ring. In the while loop to search through the ring segments, use the
+current segment variable (cur_seg), rather than the starting segment
+variable (start_seg) that is passed in.
+
+3. Stop searching the ring if we've run through all the segments in the
+ring.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/xhci-ring.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -822,9 +822,11 @@ static struct xhci_segment *trb_in_td(
+ cur_seg = start_seg;
+
+ do {
++ if (start_dma == 0)
++ return 0;
+ /* We may get an event for a Link TRB in the middle of a TD */
+ end_seg_dma = xhci_trb_virt_to_dma(cur_seg,
+- &start_seg->trbs[TRBS_PER_SEGMENT - 1]);
++ &cur_seg->trbs[TRBS_PER_SEGMENT - 1]);
+ /* If the end TRB isn't in this segment, this is set to 0 */
+ end_trb_dma = xhci_trb_virt_to_dma(cur_seg, end_trb);
+
+@@ -851,8 +853,9 @@ static struct xhci_segment *trb_in_td(
+ }
+ cur_seg = cur_seg->next;
+ start_dma = xhci_trb_virt_to_dma(cur_seg, &cur_seg->trbs[0]);
+- } while (1);
++ } while (cur_seg != start_seg);
+
++ return 0;
+ }
+
+ /*
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:48 2009
+Message-Id: <20091207000648.580930573@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:23 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Sarah Sharp <sarah.a.sharp@linux.intel.com>,
+ John Youn <John.Youn@synopsys.com>
+Subject: [047/119] USB: xhci: Fix scratchpad deallocation.
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=usb-xhci-fix-scratchpad-deallocation.patch
+Content-Length: 966
+Lines: 31
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+
+commit 5294bea40666db5c5d6c336b8e4e55d69fa576ca upstream.
+
+The scratchpad_free() function uses xhci->page_size to free some memory
+with pci_free_consistent(). However, the page_size is set to zero before
+the call, causing kernel oopses on driver unload. Call scratchpad_free()
+before setting xhci->page_size to zero.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Acked-by: John Youn <John.Youn@synopsys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/xhci-mem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -797,9 +797,9 @@ void xhci_mem_cleanup(struct xhci_hcd *x
+ xhci->dcbaa, xhci->dcbaa->dma);
+ xhci->dcbaa = NULL;
+
++ scratchpad_free(xhci);
+ xhci->page_size = 0;
+ xhci->page_shift = 0;
+- scratchpad_free(xhci);
+ }
+
+ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:48 2009
+Message-Id: <20091207000648.772808584@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:24 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Reinette Chatre <reinette.chatre@intel.com>,
+ wey-yi.w.guy@intel.com,
+ linville@tuxdriver.com
+Subject: [048/119] iwlwifi: Use RTS/CTS as the preferred protection mechanism for 6000 series
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=iwlwifi-use-rts-cts-as-the-preferred-protection-mechanism-for-6000-series.patch
+Content-Length: 5155
+Lines: 141
+
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+
+commit 73871f7181a1406c67e93c8c83f5edb26057a2a6 upstream
+
+When 802.11g was introduced, we had RTS/CTS and CTS-to-Self protection
+mechanisms. In an HT Beacon, HT stations use the "Operating Mode" field
+in the HT Information Element to determine whether or not to use
+protection.
+
+The Operating Mode field has 4 possible settings: 0-3:
+Mode 0: If all stations in the BSS are 20/40 MHz HT capable, or if the
+BSS is 20/40 MHz capable, or if all stations in the BSS are 20 MHz HT
+stations in a 20 MHz BSS
+Mode 1: used if there are non-HT stations or APs using the primary or
+secondary channels
+Mode 2: if only HT stations are associated in the BSS and at least one
+20 MHz HT station is associated.
+Mode 3: used if one or more non-HT stations are associated in the BSS.
+
+When in operating modes 1 or 3, and the Use_Protection field is 1 in the
+Beacon's ERP IE, all HT transmissions must be protected using RTS/CTS or
+CTS-to-Self.
+
+By default, CTS-to-self is the preferred protection mechanism for less
+overhead and higher throughput; but using the full RTS/CTS will better
+protect the inner exchange from interference, especially in
+highly-congested environment.
+
+For 6000 series WIFI NIC, RTS/CTS protection mechanism is the
+recommended choice for HT traffic based on the HW design.
+
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-6000.c | 4 ++++
+ drivers/net/wireless/iwlwifi/iwl-agn-rs.c | 9 +++++++++
+ drivers/net/wireless/iwlwifi/iwl-agn.c | 10 +++++++---
+ drivers/net/wireless/iwlwifi/iwl-core.h | 2 ++
+ 4 files changed, 22 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
+@@ -109,6 +109,7 @@ struct iwl_cfg iwl6000_2agn_cfg = {
+ .need_pll_cfg = false,
+ .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+ .shadow_ram_support = true,
++ .use_rts_for_ht = true, /* use rts/cts protection */
+ };
+
+ struct iwl_cfg iwl6050_2agn_cfg = {
+@@ -127,6 +128,7 @@ struct iwl_cfg iwl6050_2agn_cfg = {
+ .need_pll_cfg = false,
+ .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+ .shadow_ram_support = true,
++ .use_rts_for_ht = true, /* use rts/cts protection */
+ };
+
+ struct iwl_cfg iwl6000_3agn_cfg = {
+@@ -145,6 +147,7 @@ struct iwl_cfg iwl6000_3agn_cfg = {
+ .need_pll_cfg = false,
+ .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+ .shadow_ram_support = true,
++ .use_rts_for_ht = true, /* use rts/cts protection */
+ };
+
+ struct iwl_cfg iwl6050_3agn_cfg = {
+@@ -163,6 +166,7 @@ struct iwl_cfg iwl6050_3agn_cfg = {
+ .need_pll_cfg = false,
+ .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
+ .shadow_ram_support = true,
++ .use_rts_for_ht = true, /* use rts/cts protection */
+ };
+
+ MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_MAX));
+--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
+@@ -115,9 +115,6 @@ int iwl_commit_rxon(struct iwl_priv *pri
+
+ /* always get timestamp with Rx frame */
+ priv->staging_rxon.flags |= RXON_FLG_TSF2HOST_MSK;
+- /* allow CTS-to-self if possible. this is relevant only for
+- * 5000, but will not damage 4965 */
+- priv->staging_rxon.flags |= RXON_FLG_SELF_CTS_EN;
+
+ ret = iwl_check_rxon_cmd(priv);
+ if (ret) {
+@@ -217,6 +214,13 @@ int iwl_commit_rxon(struct iwl_priv *pri
+ "Could not send WEP static key.\n");
+ }
+
++ /*
++ * allow CTS-to-self if possible for new association.
++ * this is relevant only for 5000 series and up,
++ * but will not damage 4965
++ */
++ priv->staging_rxon.flags |= RXON_FLG_SELF_CTS_EN;
++
+ /* Apply the new configuration
+ * RXON assoc doesn't clear the station table in uCode,
+ */
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+@@ -415,6 +415,15 @@ static void rs_tl_turn_on_agg(struct iwl
+ else if (tid == IWL_AGG_ALL_TID)
+ for (tid = 0; tid < TID_MAX_LOAD_COUNT; tid++)
+ rs_tl_turn_on_agg_for_tid(priv, lq_data, tid, sta);
++ if (priv->cfg->use_rts_for_ht) {
++ /*
++ * switch to RTS/CTS if it is the prefer protection method
++ * for HT traffic
++ */
++ IWL_DEBUG_HT(priv, "use RTS/CTS protection for HT\n");
++ priv->staging_rxon.flags &= ~RXON_FLG_SELF_CTS_EN;
++ iwlcore_commit_rxon(priv);
++ }
+ }
+
+ static inline int get_num_of_ant_from_rate(u32 rate_n_flags)
+--- a/drivers/net/wireless/iwlwifi/iwl-core.h
++++ b/drivers/net/wireless/iwlwifi/iwl-core.h
+@@ -209,6 +209,7 @@ struct iwl_mod_params {
+ * @ucode_api_min: Lowest version of uCode API supported by driver.
+ * @max_ll_items: max number of OTP blocks
+ * @shadow_ram_support: shadow support for OTP memory
++ * @use_rts_for_ht: use rts/cts protection for HT traffic
+ *
+ * We enable the driver to be backward compatible wrt API version. The
+ * driver specifies which APIs it supports (with @ucode_api_max being the
+@@ -247,6 +248,7 @@ struct iwl_cfg {
+ bool use_isr_legacy;
+ const u16 max_ll_items;
+ const bool shadow_ram_support;
++ bool use_rts_for_ht;
+ };
+
+ /***************************
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:49 2009
+Message-Id: <20091207000648.921171433@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:25 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Reinette Chatre <reinette.chatre@intel.com>,
+ wey-yi.w.guy@intel.com,
+ linville@tuxdriver.com
+Subject: [049/119] iwlwifi: Fix issue on file transfer stalled in HT mode
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=iwlwifi-fix-issue-on-file-transfer-stalled-in-ht-mode.patch
+Content-Length: 895
+Lines: 30
+
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+
+commit d01032e4fd33110f9f3a085a36cb819c1dfc5827 upstream
+
+Turn on RTS/CTS for HT to prevent uCode TX fifo underrun
+
+This is fix for
+http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2103
+
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Tested-by: Jiajia Zheng <jiajia.zheng@intel.com>
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-1000.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
+@@ -71,5 +71,6 @@ struct iwl_cfg iwl1000_bgn_cfg = {
+ .need_pll_cfg = true,
+ .max_ll_items = OTP_MAX_LL_ITEMS_1000,
+ .shadow_ram_support = false,
++ .use_rts_for_ht = true, /* use rts/cts protection */
+ };
+
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:49 2009
+Message-Id: <20091207000649.092477223@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:26 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mimi Zohar <zohar@us.ibm.com>,
+ James Morris <jmorris@namei.org>
+Subject: [050/119] ima: replace GFP_KERNEL with GFP_NOFS
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=ima-replace-gfp_kernel-with-gfp_nofs.patch
+Content-Length: 2925
+Lines: 76
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Mimi Zohar <zohar@linux.vnet.ibm.com>
+
+commit c09c59e6a070d6af05f238f255aea268185273ef upstream.
+
+While running fsstress tests on the NFSv4 mounted ext3 and ext4
+filesystem, the following call trace was generated on the nfs
+server machine.
+
+Replace GFP_KERNEL with GFP_NOFS in ima_iint_insert() to avoid a
+potential deadlock.
+
+ =================================
+ [ INFO: inconsistent lock state ]
+ 2.6.31-31.el6.x86_64 #1
+ ---------------------------------
+ inconsistent {RECLAIM_FS-ON-W} -> {IN-RECLAIM_FS-W} usage.
+ kswapd2/75 [HC0[0]:SC0[0]:HE1:SE1] takes:
+ (jbd2_handle){+.+.?.}, at: [<ffffffff811edd5e>] jbd2_journal_start+0xfe/0x13f
+ {RECLAIM_FS-ON-W} state was registered at:
+ [<ffffffff81091e40>] mark_held_locks+0x65/0x99
+ [<ffffffff81091f31>] lockdep_trace_alloc+0xbd/0xf5
+ [<ffffffff81126fdd>] kmem_cache_alloc+0x40/0x185
+ [<ffffffff812344d7>] ima_iint_insert+0x3d/0xf1
+ [<ffffffff812345b0>] ima_inode_alloc+0x25/0x44
+ [<ffffffff811484ac>] inode_init_always+0xec/0x271
+ [<ffffffff81148682>] alloc_inode+0x51/0xa1
+ [<ffffffff81148700>] new_inode+0x2e/0x94
+ [<ffffffff811b2f08>] ext4_new_inode+0xb8/0xdc9
+ [<ffffffff811be611>] ext4_create+0xcf/0x175
+ [<ffffffff8113e2cd>] vfs_create+0x82/0xb8
+ [<ffffffff8113f337>] do_filp_open+0x32c/0x9ee
+ [<ffffffff811309b9>] do_sys_open+0x6c/0x12c
+ [<ffffffff81130adc>] sys_open+0x2e/0x44
+ [<ffffffff81011e42>] system_call_fastpath+0x16/0x1b
+ [<ffffffffffffffff>] 0xffffffffffffffff
+ irq event stamp: 90371
+ hardirqs last enabled at (90371): [<ffffffff8112708d>]
+ kmem_cache_alloc+0xf0/0x185
+ hardirqs last disabled at (90370): [<ffffffff81127026>]
+ kmem_cache_alloc+0x89/0x185
+ softirqs last enabled at (89492): [<ffffffff81068ecf>]
+ __do_softirq+0x1bf/0x1eb
+ softirqs last disabled at (89477): [<ffffffff8101312c>] call_softirq+0x1c/0x30
+
+ other info that might help us debug this:
+ 2 locks held by kswapd2/75:
+ #0: (shrinker_rwsem){++++..}, at: [<ffffffff810f98ba>] shrink_slab+0x44/0x177
+ #1: (&type->s_umount_key#25){++++..}, at: [<ffffffff811450ba>]
+
+Reported-by: Muni P. Beerakam <mbeeraka@in.ibm.com>
+Reported-by: Amit K. Arora <amitarora@in.ibm.com>
+Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ security/integrity/ima/ima_iint.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/security/integrity/ima/ima_iint.c
++++ b/security/integrity/ima/ima_iint.c
+@@ -58,11 +58,11 @@ struct ima_iint_cache *ima_iint_insert(s
+
+ if (!ima_initialized)
+ return iint;
+- iint = kmem_cache_alloc(iint_cache, GFP_KERNEL);
++ iint = kmem_cache_alloc(iint_cache, GFP_NOFS);
+ if (!iint)
+ return iint;
+
+- rc = radix_tree_preload(GFP_KERNEL);
++ rc = radix_tree_preload(GFP_NOFS);
+ if (rc < 0)
+ goto out;
+
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:49 2009
+Message-Id: <20091207000649.274041422@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:27 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Trond Myklebust <Trond.Myklebust@netapp.com>
+Subject: [051/119] NFSv4: Fix a cache validation bug which causes getcwd() to return ENOENT
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=nfsv4-fix-a-cache-validation-bug-which-causes-getcwd-to-return-enoent.patch
+Content-Length: 1342
+Lines: 36
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+
+commit 96d25e532234bec1a1989e6e1baf702d43a78b0d upstream.
+
+Changeset a65318bf3afc93ce49227e849d213799b072c5fd (NFSv4: Simplify some
+cache consistency post-op GETATTRs) incorrectly changed the getattr
+bitmap for readdir().
+This causes the readdir() function to fail to return a
+fileid/inode number, which again exposed a bug in the NFS readdir code that
+causes spurious ENOENT errors to appear in applications (see
+http://bugzilla.kernel.org/show_bug.cgi?id=14541).
+
+The immediate band aid is to revert the incorrect bitmap change, but more
+long term, we should change the NFS readdir code to cope with the
+fact that NFSv4 servers are not required to support fileids/inode numbers.
+
+Reported-by: Daniel J Blueman <daniel.blueman@gmail.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/nfs4proc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -2740,7 +2740,7 @@ static int _nfs4_proc_readdir(struct den
+ .pages = &page,
+ .pgbase = 0,
+ .count = count,
+- .bitmask = NFS_SERVER(dentry->d_inode)->cache_consistency_bitmask,
++ .bitmask = NFS_SERVER(dentry->d_inode)->attr_bitmask,
+ };
+ struct nfs4_readdir_res res;
+ struct rpc_message msg = {
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:49 2009
+Message-Id: <20091207000649.452381615@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:28 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Csaba Henk <csaba@gluster.com>,
+ Miklos Szeredi <mszeredi@suse.cz>,
+ Harshavardhana <harsha@gluster.com>
+Subject: [052/119] fuse: reject O_DIRECT flag also in fuse_create
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=fuse-reject-o_direct-flag-also-in-fuse_create.patch
+Content-Length: 1088
+Lines: 39
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Csaba Henk <csaba@gluster.com>
+
+commit 1b7323965a8c6eee9dc4e345a7ae4bff1dc93149 upstream.
+
+The comment in fuse_open about O_DIRECT:
+
+ "VFS checks this, but only _after_ ->open()"
+
+also holds for fuse_create, however, the same kind of check was missing there.
+
+As an impact of this bug, open(newfile, O_RDWR|O_CREAT|O_DIRECT) fails, but a
+stub newfile will remain if the fuse server handled the implied FUSE_CREATE
+request appropriately.
+
+Other impact: in the above situation ima_file_free() will complain to open/free
+imbalance if CONFIG_IMA is set.
+
+Signed-off-by: Csaba Henk <csaba@gluster.com>
+Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
+Cc: Harshavardhana <harsha@gluster.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/fuse/dir.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -385,6 +385,9 @@ static int fuse_create_open(struct inode
+ if (fc->no_create)
+ return -ENOSYS;
+
++ if (flags & O_DIRECT)
++ return -EINVAL;
++
+ forget_req = fuse_get_req(fc);
+ if (IS_ERR(forget_req))
+ return PTR_ERR(forget_req);
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:49 2009
+Message-Id: <20091207000649.602354316@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:29 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Liam Girdwood <lrg@slimlogic.co.uk>,
+ Mark Brown <broonie@opensource.wolfsonmicro.com>
+Subject: [053/119] ASoC: Fix suspend with active audio streams
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=asoc-fix-suspend-with-active-audio-streams.patch
+Content-Length: 1334
+Lines: 46
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit 50b6bce59d154b5db137907a5c0ed45a4e7a3829 upstream.
+
+When we get a stream suspend event force the power down since otherwise
+the stream would remain marked as active. In future we'll probably want
+to make this stream-specific and add an interface to make the power down
+of other widgets optional in order to support leaving bypass paths
+active while suspending the processor.
+
+Reported-by: Joonyoung Shim <jy0922.shim@samsung.com>
+Tested-by: Joonyoung Shim <jy0922.shim@samsung.com>
+Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/soc-dapm.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -774,9 +774,19 @@ static int dapm_power_widgets(struct snd
+ if (!w->power_check)
+ continue;
+
+- power = w->power_check(w);
+- if (power)
+- sys_power = 1;
++ /* If we're suspending then pull down all the
++ * power. */
++ switch (event) {
++ case SND_SOC_DAPM_STREAM_SUSPEND:
++ power = 0;
++ break;
++
++ default:
++ power = w->power_check(w);
++ if (power)
++ sys_power = 1;
++ break;
++ }
+
+ if (w->power == power)
+ continue;
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:49 2009
+Message-Id: <20091207000649.746924502@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:30 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Anuj Aggarwal <anuj.aggarwal@ti.com>,
+ Liam Girdwood <lrg@slimlogic.co.uk>,
+ Mark Brown <broonie@opensource.wolfsonmicro.com>
+Subject: [054/119] ASoC: AIC23: Fixing infinite loop in resume path
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=asoc-aic23-fixing-infinite-loop-in-resume-path.patch
+Content-Length: 1057
+Lines: 33
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Anuj Aggarwal <anuj.aggarwal@ti.com>
+
+commit e9ff5eb2ae018fe2298c68746c873bf828c6b10e upstream.
+
+This patch fixes two issues:
+a) Infinite loop in resume function
+b) Writes to non-existing registers in resume function
+
+Signed-off-by: Anuj Aggarwal <anuj.aggarwal@ti.com>
+Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/tlv320aic23.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/sound/soc/codecs/tlv320aic23.c
++++ b/sound/soc/codecs/tlv320aic23.c
+@@ -625,11 +625,10 @@ static int tlv320aic23_resume(struct pla
+ {
+ struct snd_soc_device *socdev = platform_get_drvdata(pdev);
+ struct snd_soc_codec *codec = socdev->card->codec;
+- int i;
+ u16 reg;
+
+ /* Sync reg_cache with the hardware */
+- for (reg = 0; reg < ARRAY_SIZE(tlv320aic23_reg); i++) {
++ for (reg = 0; reg < TLV320AIC23_RESET; reg++) {
+ u16 val = tlv320aic23_read_reg_cache(codec, reg);
+ tlv320aic23_write(codec, reg, val);
+ }
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:50 2009
+Message-Id: <20091207000649.895216946@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:31 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Lennert Buytenhek <buytenh@marvell.com>,
+ Johannes Berg <johannes@sipsolutions.net>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [055/119] mac80211: fix two remote exploits
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=mac80211-fix-two-remote-exploits.patch
+Content-Length: 1832
+Lines: 60
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Johannes Berg <johannes@sipsolutions.net>
+
+commit 4253119acf412fd686ef4bd8749b5a4d70ea3a51 upstream.
+
+Lennert Buytenhek noticed a remotely triggerable problem
+in mac80211, which is due to some code shuffling I did
+that ended up changing the order in which things were
+done -- this was in
+
+ commit d75636ef9c1af224f1097941879d5a8db7cd04e5
+ Author: Johannes Berg <johannes@sipsolutions.net>
+ Date: Tue Feb 10 21:25:53 2009 +0100
+
+ mac80211: RX aggregation: clean up stop session
+
+The problem is that the BUG_ON moved before the various
+checks, and as such can be triggered.
+
+As the comment indicates, the BUG_ON can be removed since
+the ampdu_action callback must already exist when the
+state is OPERATIONAL.
+
+A similar code path leads to a WARN_ON in
+ieee80211_stop_tx_ba_session, which can also be removed.
+
+Cc: Lennert Buytenhek <buytenh@marvell.com>
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/agg-rx.c | 4 ----
+ net/mac80211/agg-tx.c | 2 +-
+ 2 files changed, 1 insertion(+), 5 deletions(-)
+
+--- a/net/mac80211/agg-rx.c
++++ b/net/mac80211/agg-rx.c
+@@ -85,10 +85,6 @@ void ieee80211_sta_stop_rx_ba_session(st
+ struct ieee80211_local *local = sdata->local;
+ struct sta_info *sta;
+
+- /* stop HW Rx aggregation. ampdu_action existence
+- * already verified in session init so we add the BUG_ON */
+- BUG_ON(!local->ops->ampdu_action);
+-
+ rcu_read_lock();
+
+ sta = sta_info_get(local, ra);
+--- a/net/mac80211/agg-tx.c
++++ b/net/mac80211/agg-tx.c
+@@ -546,7 +546,7 @@ int ieee80211_stop_tx_ba_session(struct
+ struct sta_info *sta;
+ int ret = 0;
+
+- if (WARN_ON(!local->ops->ampdu_action))
++ if (!local->ops->ampdu_action)
+ return -EINVAL;
+
+ if (tid >= STA_TID_NUM)
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:50 2009
+Message-Id: <20091207000650.041769656@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:32 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Johannes Berg <johannes@sipsolutions.net>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [056/119] mac80211: fix spurious delBA handling
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=mac80211-fix-spurious-delba-handling.patch
+Content-Length: 6505
+Lines: 174
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Johannes Berg <johannes@sipsolutions.net>
+
+commit 827d42c9ac91ddd728e4f4a31fefb906ef2ceff7 upstream.
+
+Lennert Buytenhek noticed that delBA handling in mac80211
+was broken and has remotely triggerable problems, some of
+which are due to some code shuffling I did that ended up
+changing the order in which things were done -- this was
+
+ commit d75636ef9c1af224f1097941879d5a8db7cd04e5
+ Author: Johannes Berg <johannes@sipsolutions.net>
+ Date: Tue Feb 10 21:25:53 2009 +0100
+
+ mac80211: RX aggregation: clean up stop session
+
+and other parts were already present in the original
+
+ commit d92684e66091c0f0101819619b315b4bb8b5bcc5
+ Author: Ron Rindjunsky <ron.rindjunsky@intel.com>
+ Date: Mon Jan 28 14:07:22 2008 +0200
+
+ mac80211: A-MPDU Tx add delBA from recipient support
+
+The first problem is that I moved a BUG_ON before various
+checks -- thereby making it possible to hit. As the comment
+indicates, the BUG_ON can be removed since the ampdu_action
+callback must already exist when the state is != IDLE.
+
+The second problem isn't easily exploitable but there's a
+race condition due to unconditionally setting the state to
+OPERATIONAL when a delBA frame is received, even when no
+aggregation session was ever initiated. All the drivers
+accept stopping the session even then, but that opens a
+race window where crashes could happen before the driver
+accepts it. Right now, a WARN_ON may happen with non-HT
+drivers, while the race opens only for HT drivers.
+
+For this case, there are two things necessary to fix it:
+ 1) don't process spurious delBA frames, and be more careful
+ about the session state; don't drop the lock
+
+ 2) HT drivers need to be prepared to handle a session stop
+ even before the session was really started -- this is
+ true for all drivers (that support aggregation) but
+ iwlwifi which can be fixed easily. The other HT drivers
+ (ath9k and ar9170) are behaving properly already.
+
+Reported-by: Lennert Buytenhek <buytenh@marvell.com>
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-tx.c | 10 +++++++++-
+ include/net/mac80211.h | 6 ++++++
+ net/mac80211/agg-tx.c | 15 +++++++--------
+ net/mac80211/ht.c | 8 +++-----
+ net/mac80211/ieee80211_i.h | 2 ++
+ 5 files changed, 27 insertions(+), 14 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
+@@ -1233,8 +1233,16 @@ int iwl_tx_agg_stop(struct iwl_priv *pri
+ return -ENXIO;
+ }
+
++ if (priv->stations[sta_id].tid[tid].agg.state ==
++ IWL_EMPTYING_HW_QUEUE_ADDBA) {
++ IWL_DEBUG_HT(priv, "AGG stop before setup done\n");
++ ieee80211_stop_tx_ba_cb_irqsafe(priv->hw, ra, tid);
++ priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF;
++ return 0;
++ }
++
+ if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_ON)
+- IWL_WARN(priv, "Stopping AGG while state not IWL_AGG_ON\n");
++ IWL_WARN(priv, "Stopping AGG while state not ON or starting\n");
+
+ tid_data = &priv->stations[sta_id].tid[tid];
+ ssn = (tid_data->seq_number & IEEE80211_SCTL_SEQ) >> 4;
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1244,6 +1244,12 @@ enum ieee80211_filter_flags {
+ *
+ * These flags are used with the ampdu_action() callback in
+ * &struct ieee80211_ops to indicate which action is needed.
++ *
++ * Note that drivers MUST be able to deal with a TX aggregation
++ * session being stopped even before they OK'ed starting it by
++ * calling ieee80211_start_tx_ba_cb(_irqsafe), because the peer
++ * might receive the addBA frame and send a delBA right away!
++ *
+ * @IEEE80211_AMPDU_RX_START: start Rx aggregation
+ * @IEEE80211_AMPDU_RX_STOP: stop Rx aggregation
+ * @IEEE80211_AMPDU_TX_START: start Tx aggregation
+--- a/net/mac80211/agg-tx.c
++++ b/net/mac80211/agg-tx.c
+@@ -123,13 +123,18 @@ void ieee80211_send_bar(struct ieee80211
+ ieee80211_tx_skb(sdata, skb, 0);
+ }
+
+-static int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
+- enum ieee80211_back_parties initiator)
++int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
++ enum ieee80211_back_parties initiator)
+ {
+ struct ieee80211_local *local = sta->local;
+ int ret;
+ u8 *state;
+
++#ifdef CONFIG_MAC80211_HT_DEBUG
++ printk(KERN_DEBUG "Tx BA session stop requested for %pM tid %u\n",
++ sta->sta.addr, tid);
++#endif /* CONFIG_MAC80211_HT_DEBUG */
++
+ state = &sta->ampdu_mlme.tid_state_tx[tid];
+
+ if (*state == HT_AGG_STATE_OPERATIONAL)
+@@ -143,7 +148,6 @@ static int ___ieee80211_stop_tx_ba_sessi
+
+ /* HW shall not deny going back to legacy */
+ if (WARN_ON(ret)) {
+- *state = HT_AGG_STATE_OPERATIONAL;
+ /*
+ * We may have pending packets get stuck in this case...
+ * Not bothering with a workaround for now.
+@@ -526,11 +530,6 @@ int __ieee80211_stop_tx_ba_session(struc
+ goto unlock;
+ }
+
+-#ifdef CONFIG_MAC80211_HT_DEBUG
+- printk(KERN_DEBUG "Tx BA session stop requested for %pM tid %u\n",
+- sta->sta.addr, tid);
+-#endif /* CONFIG_MAC80211_HT_DEBUG */
+-
+ ret = ___ieee80211_stop_tx_ba_session(sta, tid, initiator);
+
+ unlock:
+--- a/net/mac80211/ht.c
++++ b/net/mac80211/ht.c
+@@ -141,7 +141,6 @@ void ieee80211_process_delba(struct ieee
+ struct sta_info *sta,
+ struct ieee80211_mgmt *mgmt, size_t len)
+ {
+- struct ieee80211_local *local = sdata->local;
+ u16 tid, params;
+ u16 initiator;
+
+@@ -161,10 +160,9 @@ void ieee80211_process_delba(struct ieee
+ WLAN_BACK_INITIATOR, 0);
+ else { /* WLAN_BACK_RECIPIENT */
+ spin_lock_bh(&sta->lock);
+- sta->ampdu_mlme.tid_state_tx[tid] =
+- HT_AGG_STATE_OPERATIONAL;
++ if (sta->ampdu_mlme.tid_state_tx[tid] & HT_ADDBA_REQUESTED_MSK)
++ ___ieee80211_stop_tx_ba_session(sta, tid,
++ WLAN_BACK_RECIPIENT);
+ spin_unlock_bh(&sta->lock);
+- ieee80211_stop_tx_ba_session(&local->hw, sta->sta.addr, tid,
+- WLAN_BACK_RECIPIENT);
+ }
+ }
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1057,6 +1057,8 @@ void ieee80211_process_addba_request(str
+
+ int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
+ enum ieee80211_back_parties initiator);
++int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
++ enum ieee80211_back_parties initiator);
+
+ /* Spectrum management */
+ void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:50 2009
+Message-Id: <20091207000650.209768037@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:33 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Larry Finger <Larry.Finger@lwfinger.net>,
+ "John W. Linville" <linville@tuxdriver.com>,
+ Michael Buesch <mb@bu3sch.de>
+Subject: [057/119] b43: Work around mac80211 race condition
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=b43-work-around-mac80211-race-condition.patch
+Content-Length: 2398
+Lines: 59
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 18c6951091eca7645005a71b556106cc99a6f4b1 upstream.
+
+As shown in http://thread.gmane.org/gmane.linux.kernel.wireless.general/36497,
+mac80211 has a bug that allows a call to the TX routine after the queues have
+been stopped. This situation will only occur under extreme stress. Although
+b43 does not crash when this condition occurs, it does generate a WARN_ON and
+also logs a queue overrun message. This patch recognizes b43 is not at fault
+and logs a message only when the most verbose debugging mode is enabled. In
+the unlikely event that the queue is not stopped when the DMA queue becomes
+full, then a warning is issued.
+
+During testing of this patch with one output stream running repeated tcpperf
+writes and a second running a flood ping, this routine was entered with
+the DMA ring stopped about once per hour. The condition where the DMA queue is
+full but the ring has not been stopped has never been seen by me.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Cc: Michael Buesch <mb@bu3sch.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/b43/dma.c | 21 +++++++++++++++------
+ 1 file changed, 15 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/b43/dma.c
++++ b/drivers/net/wireless/b43/dma.c
+@@ -1334,13 +1334,22 @@ int b43_dma_tx(struct b43_wldev *dev, st
+ spin_lock_irqsave(&ring->lock, flags);
+
+ B43_WARN_ON(!ring->tx);
+- /* Check if the queue was stopped in mac80211,
+- * but we got called nevertheless.
+- * That would be a mac80211 bug. */
+- B43_WARN_ON(ring->stopped);
+
+- if (unlikely(free_slots(ring) < TX_SLOTS_PER_FRAME)) {
+- b43warn(dev->wl, "DMA queue overflow\n");
++ if (unlikely(ring->stopped)) {
++ /* We get here only because of a bug in mac80211.
++ * Because of a race, one packet may be queued after
++ * the queue is stopped, thus we got called when we shouldn't.
++ * For now, just refuse the transmit. */
++ if (b43_debug(dev, B43_DBG_DMAVERBOSE))
++ b43err(dev->wl, "Packet after queue stopped\n");
++ err = -ENOSPC;
++ goto out_unlock;
++ }
++
++ if (unlikely(WARN_ON(free_slots(ring) < TX_SLOTS_PER_FRAME))) {
++ /* If we get here, we have a real error with the queue
++ * full, but queues not stopped. */
++ b43err(dev->wl, "DMA queue overflow\n");
+ err = -ENOSPC;
+ goto out_unlock;
+ }
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:50 2009
+Message-Id: <20091207000650.383217514@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:34 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Johannes Berg <johannes@sipsolutions.net>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [058/119] rfkill: fix miscdev ops
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=rfkill-fix-miscdev-ops.patch
+Content-Length: 819
+Lines: 28
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Johannes Berg <johannes@sipsolutions.net>
+
+commit 45ba564d765d6165330e9bb14a197bdd348c114d upstream.
+
+The /dev/rfkill ops don't refer to the module,
+so it is possible to unload the module while
+file descriptors are open. Fix this oversight.
+
+Reported-by: Maxim Levitsky <maximlevitsky@gmail.com>
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/rfkill/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/rfkill/core.c
++++ b/net/rfkill/core.c
+@@ -1180,6 +1180,7 @@ static long rfkill_fop_ioctl(struct file
+ #endif
+
+ static const struct file_operations rfkill_fops = {
++ .owner = THIS_MODULE,
+ .open = rfkill_fop_open,
+ .read = rfkill_fop_read,
+ .write = rfkill_fop_write,
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:50 2009
+Message-Id: <20091207000650.636746886@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:35 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Roel Kluin <roel.kluin@gmail.com>,
+ Henrique de Moraes Holschuh <hmh@hmh.eng.br>,
+ Len Brown <len.brown@intel.com>
+Subject: [059/119] thinkpad-acpi: fix sign of ERESTARTSYS return
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=thinkpad-acpi-fix-sign-of-erestartsys-return.patch
+Content-Length: 898
+Lines: 28
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Roel Kluin <roel.kluin@gmail.com>
+
+commit 80a8d1228e90349b4514e8c925c061fa5cbcea75 upstream.
+
+The returned error should be negative
+
+Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
+Acked-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/thinkpad_acpi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -5863,7 +5863,7 @@ static int brightness_write(char *buf)
+ * Doing it this way makes the syscall restartable in case of EINTR
+ */
+ rc = brightness_set(level);
+- return (rc == -EINTR)? ERESTARTSYS : rc;
++ return (rc == -EINTR)? -ERESTARTSYS : rc;
+ }
+
+ static struct ibm_struct brightness_driver_data = {
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:50 2009
+Message-Id: <20091207000650.809125417@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:36 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Harald Welte <HaraldWelte@viatech.com>,
+ Dave Jones <davej@redhat.com>
+Subject: [060/119] [CPUFREQ] Enable ACPI PDC handshake for VIA/Centaur CPUs
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=enable-acpi-pdc-handshake-for-via-centaur-cpus.patch
+Content-Length: 1447
+Lines: 40
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Harald Welte <HaraldWelte@viatech.com>
+
+commit d77b81974521c82fa6fda38dfff1b491dcc62a32 upstream.
+
+In commit 0de51088e6a82bc8413d3ca9e28bbca2788b5b53, we introduced the
+use of acpi-cpufreq on VIA/Centaur CPU's by removing a vendor check for
+VENDOR_INTEL. However, as it turns out, at least the Nano CPU's also
+need the PDC (processor driver capabilities) handshake in order to
+activate the methods required for acpi-cpufreq.
+
+Since arch_acpi_processor_init_pdc() contains another vendor check for
+Intel, the PDC is not initialized on VIA CPU's. The resulting behavior
+of a current mainline kernel on such systems is: acpi-cpufreq
+loads and it indicates CPU frequency changes. However, the CPU stays at
+a single frequency
+
+This trivial patch ensures that init_intel_pdc() is called on Intel and
+VIA/Centaur CPU's alike.
+
+Signed-off-by: Harald Welte <HaraldWelte@viatech.com>
+Signed-off-by: Dave Jones <davej@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/acpi/processor.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/acpi/processor.c
++++ b/arch/x86/kernel/acpi/processor.c
+@@ -79,7 +79,8 @@ void arch_acpi_processor_init_pdc(struct
+ struct cpuinfo_x86 *c = &cpu_data(pr->id);
+
+ pr->pdc = NULL;
+- if (c->x86_vendor == X86_VENDOR_INTEL)
++ if (c->x86_vendor == X86_VENDOR_INTEL ||
++ c->x86_vendor == X86_VENDOR_CENTAUR)
+ init_intel_pdc(pr, c);
+
+ return;
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:51 2009
+Message-Id: <20091207000650.986021785@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:37 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Robert Lowery <rglowery@exemail.com.au>,
+ Devin Heitmueller <dheitmueller@kernellabs.com>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>
+Subject: [061/119] V4L/DVB (13436): cxusb: Fix hang on DViCO FusionHDTV DVB-T Dual Digital 4 (rev 1)
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=v4l-dvb-13436-cxusb-fix-hang-on-dvico-fusionhdtv-dvb-t-dual-digital-4-rev-1.patch
+Content-Length: 1389
+Lines: 46
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Robert Lowery <rglowery@exemail.com.au>
+
+commit 0bc3518019f917a370935055f07698a4e9b3ea20 upstream.
+
+Address yet another regression introduced by the introduction of the zl10353
+disable_i2c_gate field.
+
+djh - I unmangled the patch which apparently got screwed up in the user's
+email client.
+
+Signed-off-by: Robert Lowery <rglowery@exemail.com.au>
+Signed-off-by: Devin Heitmueller <dheitmueller@kernellabs.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/dvb/dvb-usb/cxusb.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/dvb/dvb-usb/cxusb.c
++++ b/drivers/media/dvb/dvb-usb/cxusb.c
+@@ -663,6 +663,14 @@ static struct zl10353_config cxusb_zl103
+ .parallel_ts = 1,
+ };
+
++static struct zl10353_config cxusb_zl10353_xc3028_config_no_i2c_gate = {
++ .demod_address = 0x0f,
++ .if2 = 45600,
++ .no_tuner = 1,
++ .parallel_ts = 1,
++ .disable_i2c_gate_ctrl = 1,
++};
++
+ static struct mt352_config cxusb_mt352_xc3028_config = {
+ .demod_address = 0x0f,
+ .if2 = 4560,
+@@ -894,7 +902,7 @@ static int cxusb_dualdig4_frontend_attac
+ cxusb_bluebird_gpio_pulse(adap->dev, 0x02, 1);
+
+ if ((adap->fe = dvb_attach(zl10353_attach,
+- &cxusb_zl10353_xc3028_config,
++ &cxusb_zl10353_xc3028_config_no_i2c_gate,
+ &adap->dev->i2c_adap)) == NULL)
+ return -EIO;
+
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:51 2009
+Message-Id: <20091207000651.220378113@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:38 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Hans Verkuil <hverkuil@xs4all.nl>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>
+Subject: [062/119] V4L/DVB (13321): radio-gemtek-pci: fix double mutex_lock
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=v4l-dvb-13321-radio-gemtek-pci-fix-double-mutex_lock.patch
+Content-Length: 885
+Lines: 31
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+commit 3addbb8075c00e2a2408c192bd1002dead26b2aa upstream.
+
+Double mutexlock found by the Linux Driver Verification project and
+reported by Alexander Strakh.
+
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/radio/radio-gemtek-pci.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/media/radio/radio-gemtek-pci.c
++++ b/drivers/media/radio/radio-gemtek-pci.c
+@@ -181,12 +181,10 @@ static void gemtek_pci_mute(struct gemte
+
+ static void gemtek_pci_unmute(struct gemtek_pci *card)
+ {
+- mutex_lock(&card->lock);
+ if (card->mute) {
+ gemtek_pci_setfrequency(card, card->current_frequency);
+ card->mute = false;
+ }
+- mutex_unlock(&card->lock);
+ }
+
+ static int gemtek_pci_getsignal(struct gemtek_pci *card)
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:51 2009
+Message-Id: <20091207000651.381307775@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:39 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Hans Verkuil <hverkuil@xs4all.nl>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>,
+ Michael Krufky <mkrufky@linuxtv.org>
+Subject: [063/119] V4L/DVB (12948): v4l1-compat: fix VIDIOC_G_STD handling
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=v4l-dvb-12948-v4l1-compat-fix-vidioc_g_std-handling.patch
+Content-Length: 1642
+Lines: 49
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+commit 707ca1e30f087f9a6d144693dafc4b67880678c2 upstream.
+
+The VIDIOC_G_STD ioctl may not be present in the case of radio receivers.
+In that case G_STD will return an error. The v4l1-compat layer should not
+attempt to propagate that error to the caller, instead it should be
+ignored.
+
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/v4l1-compat.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+--- a/drivers/media/video/v4l1-compat.c
++++ b/drivers/media/video/v4l1-compat.c
+@@ -565,10 +565,9 @@ static noinline long v4l1_compat_get_inp
+ break;
+ }
+ chan->norm = 0;
+- err = drv(file, VIDIOC_G_STD, &sid);
+- if (err < 0)
+- dprintk("VIDIOCGCHAN / VIDIOC_G_STD: %ld\n", err);
+- if (err == 0) {
++ /* Note: G_STD might not be present for radio receivers,
++ * so we should ignore any errors. */
++ if (drv(file, VIDIOC_G_STD, &sid) == 0) {
+ if (sid & V4L2_STD_PAL)
+ chan->norm = VIDEO_MODE_PAL;
+ if (sid & V4L2_STD_NTSC)
+@@ -777,10 +776,9 @@ static noinline long v4l1_compat_get_tun
+ tun->flags |= VIDEO_TUNER_SECAM;
+ }
+
+- err = drv(file, VIDIOC_G_STD, &sid);
+- if (err < 0)
+- dprintk("VIDIOCGTUNER / VIDIOC_G_STD: %ld\n", err);
+- if (err == 0) {
++ /* Note: G_STD might not be present for radio receivers,
++ * so we should ignore any errors. */
++ if (drv(file, VIDIOC_G_STD, &sid) == 0) {
+ if (sid & V4L2_STD_PAL)
+ tun->mode = VIDEO_MODE_PAL;
+ if (sid & V4L2_STD_NTSC)
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:51 2009
+Message-Id: <20091207000651.565883198@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:40 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jean-Francois Moine <moinejf@free.fr>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>,
+ Michael Krufky <mkrufky@linuxtv.org>
+Subject: [064/119] V4L/DVB (12280): gspca - sonixj: Remove auto gain/wb/expo for the ov7660 sensor.
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=v4l-dvb-12280-gspca-sonixj-remove-auto-gain-wb-expo-for-the-ov7660-sensor.patch
+Content-Length: 2000
+Lines: 55
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jean-Francois Moine <moinejf@free.fr>
+
+commit d8f400efc1ef7b344e07590fb6b77431bc358ba0 upstream.
+
+Signed-off-by: Jean-Francois Moine <moinejf@free.fr>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/gspca/sonixj.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/video/gspca/sonixj.c
++++ b/drivers/media/video/gspca/sonixj.c
+@@ -727,13 +727,13 @@ static const u8 ov7660_sensor_init[][8]
+ {0xa1, 0x21, 0x12, 0x05, 0x00, 0x00, 0x00, 0x10},
+ /* Outformat = rawRGB */
+ {0xa1, 0x21, 0x13, 0xb8, 0x00, 0x00, 0x00, 0x10}, /* init COM8 */
+- {0xd1, 0x21, 0x00, 0x01, 0x74, 0x74, 0x00, 0x10},
++ {0xd1, 0x21, 0x00, 0x01, 0x74, 0x92, 0x00, 0x10},
+ /* GAIN BLUE RED VREF */
+ {0xd1, 0x21, 0x04, 0x00, 0x7d, 0x62, 0x00, 0x10},
+ /* COM 1 BAVE GEAVE AECHH */
+ {0xb1, 0x21, 0x08, 0x83, 0x01, 0x00, 0x00, 0x10}, /* RAVE COM2 */
+ {0xd1, 0x21, 0x0c, 0x00, 0x08, 0x04, 0x4f, 0x10}, /* COM 3 4 5 6 */
+- {0xd1, 0x21, 0x10, 0x7f, 0x40, 0x05, 0xff, 0x10},
++ {0xd1, 0x21, 0x10, 0x7f, 0x40, 0x05, 0xf8, 0x10},
+ /* AECH CLKRC COM7 COM8 */
+ {0xc1, 0x21, 0x14, 0x2c, 0x00, 0x02, 0x00, 0x10}, /* COM9 COM10 */
+ {0xd1, 0x21, 0x17, 0x10, 0x60, 0x02, 0x7b, 0x10},
+@@ -1637,16 +1637,19 @@ static void setfreq(struct gspca_dev *gs
+ if (gspca_dev->ctrl_dis & (1 << FREQ_IDX))
+ return;
+ if (sd->sensor == SENSOR_OV7660) {
++ u8 com8;
++
++ com8 = 0xf8; /* no auto gain/wb/expo */
+ switch (sd->freq) {
+ case 0: /* Banding filter disabled */
+- i2c_w1(gspca_dev, 0x13, 0xdf);
++ i2c_w1(gspca_dev, 0x13, com8 & 0xdf);
+ break;
+ case 1: /* 50 hz */
+- i2c_w1(gspca_dev, 0x13, 0xff);
++ i2c_w1(gspca_dev, 0x13, com8);
+ i2c_w1(gspca_dev, 0x3b, 0x0a);
+ break;
+ case 2: /* 60 hz */
+- i2c_w1(gspca_dev, 0x13, 0xff);
++ i2c_w1(gspca_dev, 0x13, com8);
+ i2c_w1(gspca_dev, 0x3b, 0x02);
+ break;
+ }
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:51 2009
+Message-Id: <20091207000651.695885127@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:41 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Denis Loginov <dinvlad@gmail.com>,
+ Jean-Francois Moine <moinejf@free.fr>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>,
+ Michael Krufky <mkrufky@linuxtv.org>
+Subject: [065/119] V4L/DVB (12356): gspca - sonixj: Webcam 0c45:6148 added
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=v4l-dvb-12356-gspca-sonixj-webcam-0c45-6148-added.patch
+Content-Length: 2661
+Lines: 57
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Denis Loginov <dinvlad@gmail.com>
+
+commit 6baefab531b22288be3b4ddef5671ea6469b09f8 upstream.
+
+Signed-off-by: Denis Loginov <dinvlad@gmail.com>
+Signed-off-by: Jean-Francois Moine <moinejf@free.fr>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/video4linux/gspca.txt | 1 +
+ drivers/media/video/gspca/sonixj.c | 8 ++++++--
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+--- a/Documentation/video4linux/gspca.txt
++++ b/Documentation/video4linux/gspca.txt
+@@ -284,6 +284,7 @@ sonixj 0c45:613a Microdia Sonix PC Came
+ sonixj 0c45:613b Surfer SN-206
+ sonixj 0c45:613c Sonix Pccam168
+ sonixj 0c45:6143 Sonix Pccam168
++sonixj 0c45:6148 Digitus DA-70811/ZSMC USB PC Camera ZS211/Microdia
+ sn9c20x 0c45:6240 PC Camera (SN9C201 + MT9M001)
+ sn9c20x 0c45:6242 PC Camera (SN9C201 + MT9M111)
+ sn9c20x 0c45:6248 PC Camera (SN9C201 + OV9655)
+--- a/drivers/media/video/gspca/sonixj.c
++++ b/drivers/media/video/gspca/sonixj.c
+@@ -2339,7 +2339,8 @@ static const __devinitdata struct usb_de
+ {USB_DEVICE(0x0c45, 0x60fe), BSI(SN9C105, OV7630, 0x21)},
+ #endif
+ {USB_DEVICE(0x0c45, 0x6100), BSI(SN9C120, MI0360, 0x5d)}, /*sn9c128*/
+-/* {USB_DEVICE(0x0c45, 0x6108), BSI(SN9C120, OM6801, 0x??)}, */
++/* {USB_DEVICE(0x0c45, 0x6102), BSI(SN9C120, PO2030N, ??)}, */
++/* {USB_DEVICE(0x0c45, 0x6108), BSI(SN9C120, OM6802, 0x21)}, */
+ {USB_DEVICE(0x0c45, 0x610a), BSI(SN9C120, OV7648, 0x21)}, /*sn9c128*/
+ {USB_DEVICE(0x0c45, 0x610b), BSI(SN9C120, OV7660, 0x21)}, /*sn9c128*/
+ {USB_DEVICE(0x0c45, 0x610c), BSI(SN9C120, HV7131R, 0x11)}, /*sn9c128*/
+@@ -2355,6 +2356,7 @@ static const __devinitdata struct usb_de
+ #if !defined CONFIG_USB_SN9C102 && !defined CONFIG_USB_SN9C102_MODULE
+ {USB_DEVICE(0x0c45, 0x6130), BSI(SN9C120, MI0360, 0x5d)},
+ #endif
++/* {USB_DEVICE(0x0c45, 0x6132), BSI(SN9C120, OV7670, 0x21)}, */
+ {USB_DEVICE(0x0c45, 0x6138), BSI(SN9C120, MO4000, 0x21)},
+ {USB_DEVICE(0x0c45, 0x613a), BSI(SN9C120, OV7648, 0x21)},
+ #if !defined CONFIG_USB_SN9C102 && !defined CONFIG_USB_SN9C102_MODULE
+@@ -2362,7 +2364,9 @@ static const __devinitdata struct usb_de
+ #endif
+ {USB_DEVICE(0x0c45, 0x613c), BSI(SN9C120, HV7131R, 0x11)},
+ {USB_DEVICE(0x0c45, 0x613e), BSI(SN9C120, OV7630, 0x21)},
+- {USB_DEVICE(0x0c45, 0x6143), BSI(SN9C120, SP80708, 0x18)},
++/* {USB_DEVICE(0x0c45, 0x6142), BSI(SN9C120, PO2030N, ??)}, *sn9c120b*/
++ {USB_DEVICE(0x0c45, 0x6143), BSI(SN9C120, SP80708, 0x18)}, /*sn9c120b*/
++ {USB_DEVICE(0x0c45, 0x6148), BSI(SN9C120, OM6802, 0x21)}, /*sn9c120b*/
+ {}
+ };
+ MODULE_DEVICE_TABLE(usb, device_table);
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:52 2009
+Message-Id: <20091207000651.918145140@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:42 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jean-Francois Moine <moinejf@free.fr>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>,
+ Michael Krufky <mkrufky@linuxtv.org>
+Subject: [066/119] V4L/DVB (12501): gspca - sonixj: Do the ov7660 sensor work again.
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=v4l-dvb-12501-gspca-sonixj-do-the-ov7660-sensor-work-again.patch
+Content-Length: 3665
+Lines: 95
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jean-Francois Moine <moinejf@free.fr>
+
+commit 47f7f6fb7949b6546baf4b6f26bf0ca075d12759 upstream.
+
+- bad sensor power
+- bad edge gain/threshold
+- set back the auto gain
+- light frequency filter inverted
+
+Signed-off-by: Jean-Francois Moine <moinejf@free.fr>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/gspca/sonixj.c | 23 +++++++----------------
+ 1 file changed, 7 insertions(+), 16 deletions(-)
+
+--- a/drivers/media/video/gspca/sonixj.c
++++ b/drivers/media/video/gspca/sonixj.c
+@@ -733,7 +733,7 @@ static const u8 ov7660_sensor_init[][8]
+ /* COM 1 BAVE GEAVE AECHH */
+ {0xb1, 0x21, 0x08, 0x83, 0x01, 0x00, 0x00, 0x10}, /* RAVE COM2 */
+ {0xd1, 0x21, 0x0c, 0x00, 0x08, 0x04, 0x4f, 0x10}, /* COM 3 4 5 6 */
+- {0xd1, 0x21, 0x10, 0x7f, 0x40, 0x05, 0xf8, 0x10},
++ {0xd1, 0x21, 0x10, 0x7f, 0x40, 0x05, 0xff, 0x10},
+ /* AECH CLKRC COM7 COM8 */
+ {0xc1, 0x21, 0x14, 0x2c, 0x00, 0x02, 0x00, 0x10}, /* COM9 COM10 */
+ {0xd1, 0x21, 0x17, 0x10, 0x60, 0x02, 0x7b, 0x10},
+@@ -783,7 +783,7 @@ static const u8 ov7660_sensor_init[][8]
+ {0xc1, 0x21, 0x88, 0xaf, 0xc7, 0xdf, 0x00, 0x10}, /* gamma curve */
+ {0xc1, 0x21, 0x8b, 0x99, 0x99, 0xcf, 0x00, 0x10}, /* reserved */
+ {0xb1, 0x21, 0x92, 0x00, 0x00, 0x00, 0x00, 0x10}, /* DM_LNL/H */
+- {0xb1, 0x21, 0xa1, 0x00, 0x00, 0x00, 0x00, 0x10},
++ {0xa1, 0x21, 0xa1, 0x00, 0x00, 0x00, 0x00, 0x10},
+ /****** (some exchanges in the win trace) ******/
+ {0xa1, 0x21, 0x1e, 0x01, 0x00, 0x00, 0x00, 0x10}, /* MVFP */
+ /* bits[3..0]reserved */
+@@ -1145,11 +1145,6 @@ static int configure_gpio(struct gspca_d
+ reg_w1(gspca_dev, 0x01, 0x42);
+ break;
+ case SENSOR_OV7660:
+- reg_w1(gspca_dev, 0x01, 0x61);
+- reg_w1(gspca_dev, 0x17, 0x20);
+- reg_w1(gspca_dev, 0x01, 0x60);
+- reg_w1(gspca_dev, 0x01, 0x40);
+- break;
+ case SENSOR_SP80708:
+ reg_w1(gspca_dev, 0x01, 0x63);
+ reg_w1(gspca_dev, 0x17, 0x20);
+@@ -1624,6 +1619,8 @@ static void setvflip(struct sd *sd)
+
+ static void setinfrared(struct sd *sd)
+ {
++ if (sd->gspca_dev.ctrl_dis & (1 << INFRARED_IDX))
++ return;
+ /*fixme: different sequence for StarCam Clip and StarCam 370i */
+ /* Clip */
+ i2c_w1(&sd->gspca_dev, 0x02, /* gpio */
+@@ -1639,10 +1636,10 @@ static void setfreq(struct gspca_dev *gs
+ if (sd->sensor == SENSOR_OV7660) {
+ u8 com8;
+
+- com8 = 0xf8; /* no auto gain/wb/expo */
++ com8 = 0xdf; /* auto gain/wb/expo */
+ switch (sd->freq) {
+ case 0: /* Banding filter disabled */
+- i2c_w1(gspca_dev, 0x13, com8 & 0xdf);
++ i2c_w1(gspca_dev, 0x13, com8 | 0x20);
+ break;
+ case 1: /* 50 hz */
+ i2c_w1(gspca_dev, 0x13, com8);
+@@ -1799,12 +1796,6 @@ static int sd_start(struct gspca_dev *gs
+ reg_w1(gspca_dev, 0x99, 0x60);
+ break;
+ case SENSOR_OV7660:
+- reg_w1(gspca_dev, 0x9a, 0x05);
+- if (sd->bridge == BRIDGE_SN9C105)
+- reg_w1(gspca_dev, 0x99, 0xff);
+- else
+- reg_w1(gspca_dev, 0x99, 0x5b);
+- break;
+ case SENSOR_SP80708:
+ reg_w1(gspca_dev, 0x9a, 0x05);
+ reg_w1(gspca_dev, 0x99, 0x59);
+@@ -2328,7 +2319,7 @@ static const __devinitdata struct usb_de
+ {USB_DEVICE(0x0c45, 0x607c), BSI(SN9C102P, HV7131R, 0x11)},
+ /* {USB_DEVICE(0x0c45, 0x607e), BSI(SN9C102P, OV7630, 0x??)}, */
+ {USB_DEVICE(0x0c45, 0x60c0), BSI(SN9C105, MI0360, 0x5d)},
+-/* {USB_DEVICE(0x0c45, 0x60c8), BSI(SN9C105, OM6801, 0x??)}, */
++/* {USB_DEVICE(0x0c45, 0x60c8), BSI(SN9C105, OM6802, 0x??)}, */
+ /* {USB_DEVICE(0x0c45, 0x60cc), BSI(SN9C105, HV7131GP, 0x??)}, */
+ {USB_DEVICE(0x0c45, 0x60ec), BSI(SN9C105, MO4000, 0x21)},
+ /* {USB_DEVICE(0x0c45, 0x60ef), BSI(SN9C105, ICM105C, 0x??)}, */
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:52 2009
+Message-Id: <20091207000652.162070217@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:43 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jean-Francois Moine <moinejf@free.fr>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>,
+ Michael Krufky <mkrufky@linuxtv.org>
+Subject: [067/119] V4L/DVB (12691): gspca - sonixj: Dont use mdelay().
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=v4l-dvb-12691-gspca-sonixj-don-t-use-mdelay.patch
+Content-Length: 769
+Lines: 25
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jean-Francois Moine <moinejf@free.fr>
+
+commit 1f78a976ce18bc98e8b509cee04c5b3756098614 upstream.
+
+Signed-off-by: Jean-Francois Moine <moinejf@free.fr>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/gspca/sonixj.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/video/gspca/sonixj.c
++++ b/drivers/media/video/gspca/sonixj.c
+@@ -1150,7 +1150,7 @@ static int configure_gpio(struct gspca_d
+ reg_w1(gspca_dev, 0x17, 0x20);
+ reg_w1(gspca_dev, 0x01, 0x62);
+ reg_w1(gspca_dev, 0x01, 0x42);
+- mdelay(100);
++ msleep(100);
+ reg_w1(gspca_dev, 0x02, 0x62);
+ break;
+ /* case SENSOR_HV7131R: */
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:52 2009
+Message-Id: <20091207000652.343904207@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:44 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jean-Francois Moine <moinejf@free.fr>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>,
+ Michael Krufky <mkrufky@linuxtv.org>
+Subject: [068/119] V4L/DVB (12696): gspca - sonixj / sn9c102: Two drivers for 0c45:60fc and 0c45:613e.
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=v4l-dvb-12696-gspca-sonixj-sn9c102-two-drivers-for-0c45-60fc-and-0c45-613e.patch
+Content-Length: 1679
+Lines: 41
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jean-Francois Moine <moinejf@free.fr>
+
+commit f077b0a64856c5b3bf346ae9fba8631c1fb210cf upstream.
+
+Let 0c45:60fc in sn9c102 and 0c45:613e in gspca-sonixj (sensor not supported).
+
+Signed-off-by: Jean-Francois Moine <moinejf@free.fr>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/gspca/sonixj.c | 2 +-
+ drivers/media/video/sn9c102/sn9c102_devtable.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/video/gspca/sonixj.c
++++ b/drivers/media/video/gspca/sonixj.c
+@@ -2325,8 +2325,8 @@ static const __devinitdata struct usb_de
+ /* {USB_DEVICE(0x0c45, 0x60ef), BSI(SN9C105, ICM105C, 0x??)}, */
+ /* {USB_DEVICE(0x0c45, 0x60fa), BSI(SN9C105, OV7648, 0x??)}, */
+ {USB_DEVICE(0x0c45, 0x60fb), BSI(SN9C105, OV7660, 0x21)},
+- {USB_DEVICE(0x0c45, 0x60fc), BSI(SN9C105, HV7131R, 0x11)},
+ #if !defined CONFIG_USB_SN9C102 && !defined CONFIG_USB_SN9C102_MODULE
++ {USB_DEVICE(0x0c45, 0x60fc), BSI(SN9C105, HV7131R, 0x11)},
+ {USB_DEVICE(0x0c45, 0x60fe), BSI(SN9C105, OV7630, 0x21)},
+ #endif
+ {USB_DEVICE(0x0c45, 0x6100), BSI(SN9C120, MI0360, 0x5d)}, /*sn9c128*/
+--- a/drivers/media/video/sn9c102/sn9c102_devtable.h
++++ b/drivers/media/video/sn9c102/sn9c102_devtable.h
+@@ -123,8 +123,8 @@ static const struct usb_device_id sn9c10
+ { SN9C102_USB_DEVICE(0x0c45, 0x613b, BRIDGE_SN9C120), },
+ #if !defined CONFIG_USB_GSPCA && !defined CONFIG_USB_GSPCA_MODULE
+ { SN9C102_USB_DEVICE(0x0c45, 0x613c, BRIDGE_SN9C120), },
+-#endif
+ { SN9C102_USB_DEVICE(0x0c45, 0x613e, BRIDGE_SN9C120), },
++#endif
+ { }
+ };
+
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:52 2009
+Message-Id: <20091207000652.482876972@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:45 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Chris Wilson <chris@chris-wilson.co.uk>,
+ Eric Anholt <eric@anholt.net>
+Subject: [069/119] drm/i915: Select CONFIG_SHMEM
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=drm-i915-select-config_shmem.patch
+Content-Length: 999
+Lines: 34
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit ca9ab10033d190c1ede85fdf456307bdfdabf079 upstream.
+
+The driver requires shmfs as the backing filesystem to handle the buffer
+objects, so ensure it is selected if the user chooses to build our
+driver.
+
+Fixes: Bug 14662 - Dell E5500 kernel panic with KMS
+http://bugzilla.kernel.org/show_bug.cgi?id=14662
+
+The revealing nature of the panic is the NULL function pointer
+dereference in read_cache_page_async().
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Reported-and-tested-by: Mateusz Kaduk <mateusz.kaduk@gmail.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/Kconfig
++++ b/drivers/gpu/drm/Kconfig
+@@ -82,6 +82,7 @@ config DRM_I830
+ config DRM_I915
+ tristate "i915 driver"
+ depends on AGP_INTEL
++ select SHMEM
+ select FB_CFB_FILLRECT
+ select FB_CFB_COPYAREA
+ select FB_CFB_IMAGEBLIT
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:52 2009
+Message-Id: <20091207000652.647886780@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:46 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jesse Barnes <jbarnes@virtuousgeek.org>,
+ Dave Airlie <airlied@redhat.com>
+Subject: [070/119] drm: work around EDIDs with bad htotal/vtotal values
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=drm-work-around-edids-with-bad-htotal-vtotal-values.patch
+Content-Length: 942
+Lines: 33
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jesse Barnes <jbarnes@virtuousgeek.org>
+
+commit 7064fef56369c9e2c6e35ff6d6b4b63d42a859ce upstream.
+
+We did this on the userspace side, but we need a similar fix for the
+kernel.
+
+Fixes LP #460664.
+
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/drm_edid.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -333,6 +333,12 @@ static struct drm_display_mode *drm_mode
+ mode->vsync_end = mode->vsync_start + vsync_pulse_width;
+ mode->vtotal = mode->vdisplay + vblank;
+
++ /* Some EDIDs have bogus h/vtotal values */
++ if (mode->hsync_end > mode->htotal)
++ mode->htotal = mode->hsync_end + 1;
++ if (mode->vsync_end > mode->vtotal)
++ mode->vtotal = mode->vsync_end + 1;
++
+ drm_mode_set_name(mode);
+
+ if (pt->misc & DRM_EDID_PT_INTERLACED)
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:53 2009
+Message-Id: <20091207000652.847365541@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:47 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Nanhai Zou <nanhai.zou@intel.com>,
+ Zhenyu Wang <zhenyuw@linux.intel.com>,
+ Eric Anholt <eric@anholt.net>
+Subject: [071/119] drm/i915: Fix IRQ stall issue on Ironlake
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=drm-i915-fix-irq-stall-issue-on-ironlake.patch
+Content-Length: 1307
+Lines: 47
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Nanhai Zou <nanhai.zou@intel.com>
+
+commit 2d109a845dd3074885db726892c629ab73dd0ed8 upstream.
+
+The master irq control in DE must be disabled before irq handling,
+and enable after the process. This fixes the irq stall issue on
+Ironlake.
+
+Signed-off-by: Nanhai Zou <nanhai.zou@intel.com>
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_irq.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -253,10 +253,15 @@ irqreturn_t igdng_irq_handler(struct drm
+ {
+ drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+ int ret = IRQ_NONE;
+- u32 de_iir, gt_iir;
++ u32 de_iir, gt_iir, de_ier;
+ u32 new_de_iir, new_gt_iir;
+ struct drm_i915_master_private *master_priv;
+
++ /* disable master interrupt before clearing iir */
++ de_ier = I915_READ(DEIER);
++ I915_WRITE(DEIER, de_ier & ~DE_MASTER_IRQ_CONTROL);
++ (void)I915_READ(DEIER);
++
+ de_iir = I915_READ(DEIIR);
+ gt_iir = I915_READ(GTIIR);
+
+@@ -287,6 +292,9 @@ irqreturn_t igdng_irq_handler(struct drm
+ gt_iir = new_gt_iir;
+ }
+
++ I915_WRITE(DEIER, de_ier);
++ (void)I915_READ(DEIER);
++
+ return ret;
+ }
+
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:53 2009
+Message-Id: <20091207000653.140690475@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:48 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Eric Dumazet <eric.dumazet@gmail.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [072/119] udp: Fix udp_poll() and ioctl()
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=udp-fix-udp_poll-and-ioctl.patch
+Content-Length: 3458
+Lines: 129
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit 85584672012ee0c3b7b8e033a1ecf7c11878e45f ]
+
+udp_poll() can in some circumstances drop frames with incorrect checksums.
+
+Problem is we now have to lock the socket while dropping frames, or risk
+sk_forward corruption.
+
+This bug is present since commit 95766fff6b9a78d1
+([UDP]: Add memory accounting.)
+
+While we are at it, we can correct ioctl(SIOCINQ) to also drop bad frames.
+
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/udp.c | 74 +++++++++++++++++++++++++++++++++------------------------
+ 1 file changed, 43 insertions(+), 31 deletions(-)
+
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -831,6 +831,42 @@ out:
+ return ret;
+ }
+
++
++/**
++ * first_packet_length - return length of first packet in receive queue
++ * @sk: socket
++ *
++ * Drops all bad checksum frames, until a valid one is found.
++ * Returns the length of found skb, or 0 if none is found.
++ */
++static unsigned int first_packet_length(struct sock *sk)
++{
++ struct sk_buff_head list_kill, *rcvq = &sk->sk_receive_queue;
++ struct sk_buff *skb;
++ unsigned int res;
++
++ __skb_queue_head_init(&list_kill);
++
++ spin_lock_bh(&rcvq->lock);
++ while ((skb = skb_peek(rcvq)) != NULL &&
++ udp_lib_checksum_complete(skb)) {
++ UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
++ IS_UDPLITE(sk));
++ __skb_unlink(skb, rcvq);
++ __skb_queue_tail(&list_kill, skb);
++ }
++ res = skb ? skb->len : 0;
++ spin_unlock_bh(&rcvq->lock);
++
++ if (!skb_queue_empty(&list_kill)) {
++ lock_sock(sk);
++ __skb_queue_purge(&list_kill);
++ sk_mem_reclaim_partial(sk);
++ release_sock(sk);
++ }
++ return res;
++}
++
+ /*
+ * IOCTL requests applicable to the UDP protocol
+ */
+@@ -847,21 +883,16 @@ int udp_ioctl(struct sock *sk, int cmd,
+
+ case SIOCINQ:
+ {
+- struct sk_buff *skb;
+- unsigned long amount;
++ unsigned int amount = first_packet_length(sk);
+
+- amount = 0;
+- spin_lock_bh(&sk->sk_receive_queue.lock);
+- skb = skb_peek(&sk->sk_receive_queue);
+- if (skb != NULL) {
++ if (amount)
+ /*
+ * We will only return the amount
+ * of this packet since that is all
+ * that will be read.
+ */
+- amount = skb->len - sizeof(struct udphdr);
+- }
+- spin_unlock_bh(&sk->sk_receive_queue.lock);
++ amount -= sizeof(struct udphdr);
++
+ return put_user(amount, (int __user *)arg);
+ }
+
+@@ -1525,32 +1556,13 @@ unsigned int udp_poll(struct file *file,
+ {
+ unsigned int mask = datagram_poll(file, sock, wait);
+ struct sock *sk = sock->sk;
+- int is_lite = IS_UDPLITE(sk);
+
+ /* Check for false positives due to checksum errors */
+- if ( (mask & POLLRDNORM) &&
+- !(file->f_flags & O_NONBLOCK) &&
+- !(sk->sk_shutdown & RCV_SHUTDOWN)){
+- struct sk_buff_head *rcvq = &sk->sk_receive_queue;
+- struct sk_buff *skb;
+-
+- spin_lock_bh(&rcvq->lock);
+- while ((skb = skb_peek(rcvq)) != NULL &&
+- udp_lib_checksum_complete(skb)) {
+- UDP_INC_STATS_BH(sock_net(sk),
+- UDP_MIB_INERRORS, is_lite);
+- __skb_unlink(skb, rcvq);
+- kfree_skb(skb);
+- }
+- spin_unlock_bh(&rcvq->lock);
+-
+- /* nothing to see, move along */
+- if (skb == NULL)
+- mask &= ~(POLLIN | POLLRDNORM);
+- }
++ if ((mask & POLLRDNORM) && !(file->f_flags & O_NONBLOCK) &&
++ !(sk->sk_shutdown & RCV_SHUTDOWN) && !first_packet_length(sk))
++ mask &= ~(POLLIN | POLLRDNORM);
+
+ return mask;
+-
+ }
+
+ struct proto udp_prot = {
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:53 2009
+Message-Id: <20091207000653.339579495@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:49 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ben Hutchings <ben@decadent.org.uk>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [073/119] acenic: Pass up error code from ace_load_firmware()
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=acenic-pass-up-error-code-from-ace_load_firmware.patch
+Content-Length: 851
+Lines: 28
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Ben Hutchings <ben@decadent.org.uk>
+
+[ Upstream commit 6c60e0c30c80fcd53e61701b7865a85283f8a341 ]
+
+If ace_load_firmware() fails, ace_init() cleans up but still returns
+0, leading to an oops as seen in <http://bugs.debian.org/521383>.
+It should pass the error code up.
+
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/acenic.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/acenic.c
++++ b/drivers/net/acenic.c
+@@ -1209,7 +1209,8 @@ static int __devinit ace_init(struct net
+ memset(ap->info, 0, sizeof(struct ace_info));
+ memset(ap->skb, 0, sizeof(struct ace_skb));
+
+- if (ace_load_firmware(dev))
++ ecode = ace_load_firmware(dev);
++ if (ecode)
+ goto init_error;
+
+ ap->fw_running = 0;
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:53 2009
+Message-Id: <20091207000653.567571821@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:50 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jamal Hadi Salim <hadi@cyberus.ca>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [074/119] pkt_sched: pedit use proper struct
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=pkt_sched-pedit-use-proper-struct.patch
+Content-Length: 887
+Lines: 30
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jamal Hadi Salim <hadi@cyberus.ca>
+
+[ Upstream commit 53f7e35f8b7fc2f5620a863ac613bcf3080cb6ba ]
+
+This probably deserves to go into -stable.
+
+Pedit will reject a policy that is large because it
+uses the wrong structure in the policy validation.
+This fixes it.
+
+Signed-off-by: Jamal Hadi Salim <hadi@cyberus.ca>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/sched/act_pedit.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sched/act_pedit.c
++++ b/net/sched/act_pedit.c
+@@ -34,7 +34,7 @@ static struct tcf_hashinfo pedit_hash_in
+ };
+
+ static const struct nla_policy pedit_policy[TCA_PEDIT_MAX + 1] = {
+- [TCA_PEDIT_PARMS] = { .len = sizeof(struct tcf_pedit) },
++ [TCA_PEDIT_PARMS] = { .len = sizeof(struct tc_pedit) },
+ };
+
+ static int tcf_pedit_init(struct nlattr *nla, struct nlattr *est,
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:53 2009
+Message-Id: <20091207000653.772759765@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:51 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Eric Dumazet <eric.dumazet@gmail.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [075/119] net: fix sk_forward_alloc corruption
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=net-fix-sk_forward_alloc-corruption.patch
+Content-Length: 3817
+Lines: 126
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit: 9d410c796067686b1e032d54ce475b7055537138 ]
+
+On UDP sockets, we must call skb_free_datagram() with socket locked,
+or risk sk_forward_alloc corruption. This requirement is not respected
+in SUNRPC.
+
+Add a convenient helper, skb_free_datagram_locked() and use it in SUNRPC
+
+Reported-by: Francis Moreau <francis.moro@gmail.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ include/linux/skbuff.h | 2 ++
+ net/core/datagram.c | 10 +++++++++-
+ net/ipv4/udp.c | 4 +---
+ net/ipv6/udp.c | 4 +---
+ net/sunrpc/svcsock.c | 10 +++++-----
+ 5 files changed, 18 insertions(+), 12 deletions(-)
+
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -1761,6 +1761,8 @@ extern int skb_copy_datagram_cons
+ int to_offset,
+ int size);
+ extern void skb_free_datagram(struct sock *sk, struct sk_buff *skb);
++extern void skb_free_datagram_locked(struct sock *sk,
++ struct sk_buff *skb);
+ extern int skb_kill_datagram(struct sock *sk, struct sk_buff *skb,
+ unsigned int flags);
+ extern __wsum skb_checksum(const struct sk_buff *skb, int offset,
+--- a/net/core/datagram.c
++++ b/net/core/datagram.c
+@@ -223,6 +223,15 @@ void skb_free_datagram(struct sock *sk,
+ consume_skb(skb);
+ sk_mem_reclaim_partial(sk);
+ }
++EXPORT_SYMBOL(skb_free_datagram);
++
++void skb_free_datagram_locked(struct sock *sk, struct sk_buff *skb)
++{
++ lock_sock(sk);
++ skb_free_datagram(sk, skb);
++ release_sock(sk);
++}
++EXPORT_SYMBOL(skb_free_datagram_locked);
+
+ /**
+ * skb_kill_datagram - Free a datagram skbuff forcibly
+@@ -749,5 +758,4 @@ unsigned int datagram_poll(struct file *
+ EXPORT_SYMBOL(datagram_poll);
+ EXPORT_SYMBOL(skb_copy_and_csum_datagram_iovec);
+ EXPORT_SYMBOL(skb_copy_datagram_iovec);
+-EXPORT_SYMBOL(skb_free_datagram);
+ EXPORT_SYMBOL(skb_recv_datagram);
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -987,9 +987,7 @@ try_again:
+ err = ulen;
+
+ out_free:
+- lock_sock(sk);
+- skb_free_datagram(sk, skb);
+- release_sock(sk);
++ skb_free_datagram_locked(sk, skb);
+ out:
+ return err;
+
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -288,9 +288,7 @@ try_again:
+ err = ulen;
+
+ out_free:
+- lock_sock(sk);
+- skb_free_datagram(sk, skb);
+- release_sock(sk);
++ skb_free_datagram_locked(sk, skb);
+ out:
+ return err;
+
+--- a/net/sunrpc/svcsock.c
++++ b/net/sunrpc/svcsock.c
+@@ -110,7 +110,7 @@ static void svc_release_skb(struct svc_r
+ rqstp->rq_xprt_ctxt = NULL;
+
+ dprintk("svc: service %p, releasing skb %p\n", rqstp, skb);
+- skb_free_datagram(svsk->sk_sk, skb);
++ skb_free_datagram_locked(svsk->sk_sk, skb);
+ }
+ }
+
+@@ -537,7 +537,7 @@ static int svc_udp_recvfrom(struct svc_r
+ printk("rpcsvc: received unknown control message:"
+ "%d/%d\n",
+ cmh->cmsg_level, cmh->cmsg_type);
+- skb_free_datagram(svsk->sk_sk, skb);
++ skb_free_datagram_locked(svsk->sk_sk, skb);
+ return 0;
+ }
+ svc_udp_get_dest_address(rqstp, cmh);
+@@ -548,18 +548,18 @@ static int svc_udp_recvfrom(struct svc_r
+ if (csum_partial_copy_to_xdr(&rqstp->rq_arg, skb)) {
+ local_bh_enable();
+ /* checksum error */
+- skb_free_datagram(svsk->sk_sk, skb);
++ skb_free_datagram_locked(svsk->sk_sk, skb);
+ return 0;
+ }
+ local_bh_enable();
+- skb_free_datagram(svsk->sk_sk, skb);
++ skb_free_datagram_locked(svsk->sk_sk, skb);
+ } else {
+ /* we can use it in-place */
+ rqstp->rq_arg.head[0].iov_base = skb->data +
+ sizeof(struct udphdr);
+ rqstp->rq_arg.head[0].iov_len = len;
+ if (skb_checksum_complete(skb)) {
+- skb_free_datagram(svsk->sk_sk, skb);
++ skb_free_datagram_locked(svsk->sk_sk, skb);
+ return 0;
+ }
+ rqstp->rq_xprt_ctxt = skb;
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:54 2009
+Message-Id: <20091207000654.000557851@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:52 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jasper Spaans <spaans@fox-it.com>,
+ Eric Dumazet <eric.dumazet@gmail.com>,
+ Jay Vosburgh <fubar@us.ibm.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [076/119] bonding: Modify hash transmit policies to use the packets source MAC address
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=bonding-modify-hash-transmit-policies-to-use-the-packet-s-source-mac-address.patch
+Content-Length: 1650
+Lines: 52
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jasper Spaans <spaans@fox-it.com>
+
+[ Upstream commit d3da68310a2cf934c2ea8a99a519d8b1ccca4c56 ]
+
+Modify bonding hash transmit policies to use the psource MAC address of
+the packet instead of the MAC address configured for the bonding device.
+
+The old sitation conflicts with the documentation.
+
+Signed-off-by: Jasper Spaans <spaans@fox-it.com>
+Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/bonding/bond_main.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -3707,10 +3707,10 @@ static int bond_xmit_hash_policy_l23(str
+
+ if (skb->protocol == htons(ETH_P_IP)) {
+ return ((ntohl(iph->saddr ^ iph->daddr) & 0xffff) ^
+- (data->h_dest[5] ^ bond_dev->dev_addr[5])) % count;
++ (data->h_dest[5] ^ data->h_source[5])) % count;
+ }
+
+- return (data->h_dest[5] ^ bond_dev->dev_addr[5]) % count;
++ return (data->h_dest[5] ^ data->h_source[5]) % count;
+ }
+
+ /*
+@@ -3737,7 +3737,7 @@ static int bond_xmit_hash_policy_l34(str
+
+ }
+
+- return (data->h_dest[5] ^ bond_dev->dev_addr[5]) % count;
++ return (data->h_dest[5] ^ data->h_source[5]) % count;
+ }
+
+ /*
+@@ -3748,7 +3748,7 @@ static int bond_xmit_hash_policy_l2(stru
+ {
+ struct ethhdr *data = (struct ethhdr *)skb->data;
+
+- return (data->h_dest[5] ^ bond_dev->dev_addr[5]) % count;
++ return (data->h_dest[5] ^ data->h_source[5]) % count;
+ }
+
+ /*-------------------------- Device entry points ----------------------------*/
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:54 2009
+Message-Id: <20091207000654.200910138@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:53 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ben Hutchings <bhutchings@solarflare.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [077/119] sfc: Set ip_summed correctly for page buffers passed to GRO
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=sfc-set-ip_summed-correctly-for-page-buffers-passed-to-gro.patch
+Content-Length: 1705
+Lines: 56
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Ben Hutchings <bhutchings@solarflare.com>
+
+[ Upstream commit 345056af41feeda506a8993474b9cbb2c66bc9fb ]
+
+Page buffers containing packets with an incorrect checksum or using a
+protocol not handled by hardware checksum offload were previously not
+passed to LRO. The conversion to GRO changed this, but did not set
+the ip_summed value accordingly.
+
+Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/sfc/rx.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/sfc/rx.c
++++ b/drivers/net/sfc/rx.c
+@@ -444,7 +444,8 @@ static void efx_rx_packet__check_len(str
+ * the appropriate LRO method
+ */
+ static void efx_rx_packet_lro(struct efx_channel *channel,
+- struct efx_rx_buffer *rx_buf)
++ struct efx_rx_buffer *rx_buf,
++ bool checksummed)
+ {
+ struct napi_struct *napi = &channel->napi_str;
+
+@@ -466,7 +467,8 @@ static void efx_rx_packet_lro(struct efx
+ skb->len = rx_buf->len;
+ skb->data_len = rx_buf->len;
+ skb->truesize += rx_buf->len;
+- skb->ip_summed = CHECKSUM_UNNECESSARY;
++ skb->ip_summed =
++ checksummed ? CHECKSUM_UNNECESSARY : CHECKSUM_NONE;
+
+ napi_gro_frags(napi);
+
+@@ -475,6 +477,7 @@ out:
+ rx_buf->page = NULL;
+ } else {
+ EFX_BUG_ON_PARANOID(!rx_buf->skb);
++ EFX_BUG_ON_PARANOID(!checksummed);
+
+ napi_gro_receive(napi, rx_buf->skb);
+ rx_buf->skb = NULL;
+@@ -570,7 +573,7 @@ void __efx_rx_packet(struct efx_channel
+ }
+
+ if (likely(checksummed || rx_buf->page)) {
+- efx_rx_packet_lro(channel, rx_buf);
++ efx_rx_packet_lro(channel, rx_buf, checksummed);
+ goto done;
+ }
+
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:54 2009
+Message-Id: <20091207000654.364893397@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:54 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Roel Kluin <roel.kluin@gmail.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [078/119] sparc64: replace parentheses in pmul()
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=sparc64-replace-parentheses-in-pmul.patch
+Content-Length: 853
+Lines: 26
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Roel Kluin <roel.kluin@gmail.com>
+
+[ Upstream commit 88b938e63e68fd35e603421f722be0f35dde1016 ]
+
+`>>' has a higher precedence than `?' so src2 evaluated to
+either 16 or 0 dependent on the bits set in rs2.
+
+Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/kernel/visemul.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/sparc/kernel/visemul.c
++++ b/arch/sparc/kernel/visemul.c
+@@ -617,7 +617,7 @@ static void pmul(struct pt_regs *regs, u
+ rs2 = fps_regval(f, RS2(insn));
+
+ rd_val = 0;
+- src2 = (rs2 >> (opf == FMUL8x16AU_OPF) ? 16 : 0);
++ src2 = rs2 >> (opf == FMUL8x16AU_OPF ? 16 : 0);
+ for (byte = 0; byte < 4; byte++) {
+ u16 src1 = (rs1 >> (byte * 8)) & 0x00ff;
+ u32 prod = src1 * src2;
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:54 2009
+Message-Id: <20091207000654.584900701@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:55 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [079/119] sparc: Move of_set_property_mutex acquisition outside of devtree_lock grab.
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=sparc-move-of_set_property_mutex-acquisition-outside-of-devtree_lock-grab.patch
+Content-Length: 1156
+Lines: 43
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 1c9d80ddc60f8ac26344ec3db9830e5f8016c16d ]
+
+Otherwise we try to sleep with preemption disabled, etc.
+
+Noticed by Thomas Gleixner.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/sparc/kernel/prom_common.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/sparc/kernel/prom_common.c
++++ b/arch/sparc/kernel/prom_common.c
+@@ -76,6 +76,7 @@ int of_set_property(struct device_node *
+
+ err = -ENODEV;
+
++ mutex_lock(&of_set_property_mutex);
+ write_lock(&devtree_lock);
+ prevp = &dp->properties;
+ while (*prevp) {
+@@ -85,9 +86,7 @@ int of_set_property(struct device_node *
+ void *old_val = prop->value;
+ int ret;
+
+- mutex_lock(&of_set_property_mutex);
+ ret = prom_setprop(dp->node, name, val, len);
+- mutex_unlock(&of_set_property_mutex);
+
+ err = -EINVAL;
+ if (ret >= 0) {
+@@ -106,6 +105,7 @@ int of_set_property(struct device_node *
+ prevp = &(*prevp)->next;
+ }
+ write_unlock(&devtree_lock);
++ mutex_unlock(&of_set_property_mutex);
+
+ /* XXX Upate procfs if necessary... */
+
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:54 2009
+Message-Id: <20091207000654.821385285@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:56 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Rusty Russell <rusty@rustcorp.com.au>,
+ Peter Zijlstra <peterz@infradead.org>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [080/119] sched: Fix boot crash by zalloc()ing most of the cpu masks
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=sched-fix-boot-crash-by-zalloc-ing-most-of-the-cpu-masks.patch
+Content-Length: 1333
+Lines: 41
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Rusty Russell <rusty@rustcorp.com.au>
+
+commit 49557e620339cb134127b5bfbcfecc06b77d0232 upstream.
+
+I got a boot crash when forcing cpumasks offstack on 32 bit,
+because find_new_ilb() returned 3 on my UP system (nohz.cpu_mask
+wasn't zeroed).
+
+AFAICT the others need to be zeroed too: only
+nohz.ilb_grp_nohz_mask is initialized before use.
+
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Cc: Peter Zijlstra <peterz@infradead.org>
+LKML-Reference: <200911022037.21282.rusty@rustcorp.com.au>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/sched.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -9383,13 +9383,13 @@ void __init sched_init(void)
+ current->sched_class = &fair_sched_class;
+
+ /* Allocate the nohz_cpu_mask if CONFIG_CPUMASK_OFFSTACK */
+- alloc_cpumask_var(&nohz_cpu_mask, GFP_NOWAIT);
++ zalloc_cpumask_var(&nohz_cpu_mask, GFP_NOWAIT);
+ #ifdef CONFIG_SMP
+ #ifdef CONFIG_NO_HZ
+- alloc_cpumask_var(&nohz.cpu_mask, GFP_NOWAIT);
++ zalloc_cpumask_var(&nohz.cpu_mask, GFP_NOWAIT);
+ alloc_cpumask_var(&nohz.ilb_grp_nohz_mask, GFP_NOWAIT);
+ #endif
+- alloc_cpumask_var(&cpu_isolated_map, GFP_NOWAIT);
++ zalloc_cpumask_var(&cpu_isolated_map, GFP_NOWAIT);
+ #endif /* SMP */
+
+ perf_counter_init();
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:55 2009
+Message-Id: <20091207000655.004715013@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:57 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Michael Krufky <mkrufky@kernellabs.com>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>
+Subject: [081/119] V4L/DVB (13202): smsusb: add autodetection support for three additional Hauppauge USB IDs
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=v4l-dvb-13202-smsusb-add-autodetection-support-for-three-additional-hauppauge-usb-ids.patch
+Content-Length: 949
+Lines: 33
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Michael Krufky <mkrufky@kernellabs.com>
+
+commit 78c948ab0cc44f9c8ae397d7d9d217bb498bfa2f upstream.
+
+Add support for three new Hauppauge Device USB IDs:
+
+2040:b900
+2040:b910
+2040:c000
+
+Signed-off-by: Michael Krufky <mkrufky@kernellabs.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+
+---
+ drivers/media/dvb/siano/smsusb.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/media/dvb/siano/smsusb.c
++++ b/drivers/media/dvb/siano/smsusb.c
+@@ -529,6 +529,12 @@ struct usb_device_id smsusb_id_table[] =
+ .driver_info = SMS1XXX_BOARD_SIANO_NICE },
+ { USB_DEVICE(0x187f, 0x0301),
+ .driver_info = SMS1XXX_BOARD_SIANO_VENICE },
++ { USB_DEVICE(0x2040, 0xb900),
++ .driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
++ { USB_DEVICE(0x2040, 0xb910),
++ .driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
++ { USB_DEVICE(0x2040, 0xc000),
++ .driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
+ { } /* Terminating entry */
+ };
+
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:55 2009
+Message-Id: <20091207000655.196912423@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:58 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Michael Krufky <mkrufky@kernellabs.com>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>
+Subject: [082/119] V4L/DVB (13313): saa7134: add support for FORCE_TS_VALID mode for mpeg ts input
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=v4l-dvb-13313-saa7134-add-support-for-force_ts_valid-mode-for-mpeg-ts-input.patch
+Content-Length: 1899
+Lines: 49
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Michael Krufky <mkrufky@kernellabs.com>
+
+commit 4007a672abd88091e3cced158ec491d41c0c454c upstream.
+
+When FORCE_TS_VALID mode is enabled, the saa713x will accept MPEG TS input
+without requiring TS_VALID set high. This is required for some new boards
+to function properly, due to the hardware design implementation.
+
+The configuration is toggled within the board setup configuration. Boards
+that do not have this bit set will function as before with no change.
+
+Signed-off-by: Michael Krufky <mkrufky@kernellabs.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/saa7134/saa7134-ts.c | 6 ++++--
+ drivers/media/video/saa7134/saa7134.h | 1 +
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/video/saa7134/saa7134.h
++++ b/drivers/media/video/saa7134/saa7134.h
+@@ -355,6 +355,7 @@ struct saa7134_board {
+ enum saa7134_mpeg_type mpeg;
+ enum saa7134_mpeg_ts_type ts_type;
+ unsigned int vid_port_opts;
++ unsigned int ts_force_val:1;
+ };
+
+ #define card_has_radio(dev) (NULL != saa7134_boards[dev->board].radio.name)
+--- a/drivers/media/video/saa7134/saa7134-ts.c
++++ b/drivers/media/video/saa7134/saa7134-ts.c
+@@ -262,11 +262,13 @@ int saa7134_ts_start(struct saa7134_dev
+ switch (saa7134_boards[dev->board].ts_type) {
+ case SAA7134_MPEG_TS_PARALLEL:
+ saa_writeb(SAA7134_TS_SERIAL0, 0x40);
+- saa_writeb(SAA7134_TS_PARALLEL, 0xec);
++ saa_writeb(SAA7134_TS_PARALLEL, 0xec |
++ (saa7134_boards[dev->board].ts_force_val << 4));
+ break;
+ case SAA7134_MPEG_TS_SERIAL:
+ saa_writeb(SAA7134_TS_SERIAL0, 0xd8);
+- saa_writeb(SAA7134_TS_PARALLEL, 0x6c);
++ saa_writeb(SAA7134_TS_PARALLEL, 0x6c |
++ (saa7134_boards[dev->board].ts_force_val << 4));
+ saa_writeb(SAA7134_TS_PARALLEL_SERIAL, 0xbc);
+ saa_writeb(SAA7134_TS_SERIAL1, 0x02);
+ break;
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:55 2009
+Message-Id: <20091207000655.489018116@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:00:59 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Michael Krufky <mkrufky@kernellabs.com>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>
+Subject: [083/119] V4L/DVB (13314): saa7134: set ts_force_val for the Hauppauge WinTV HVR-1150
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=v4l-dvb-13314-saa7134-set-ts_force_val-for-the-hauppauge-wintv-hvr-1150.patch
+Content-Length: 999
+Lines: 28
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Michael Krufky <mkrufky@kernellabs.com>
+
+commit 22370ef5035f206283505409c9a64a595c5c7320 upstream.
+
+The Hauppauge WinTV HVR-1150 retail boards require the FORCE_TS_VALID bit
+to be set in order to function properly. This change will work on the early
+revisions on the board as well, but the final revision will not function
+without this change.
+
+Signed-off-by: Michael Krufky <mkrufky@kernellabs.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/saa7134/saa7134-cards.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/video/saa7134/saa7134-cards.c
++++ b/drivers/media/video/saa7134/saa7134-cards.c
+@@ -3373,6 +3373,7 @@ struct saa7134_board saa7134_boards[] =
+ .tuner_config = 3,
+ .mpeg = SAA7134_MPEG_DVB,
+ .ts_type = SAA7134_MPEG_TS_SERIAL,
++ .ts_force_val = 1,
+ .gpiomask = 0x0800100, /* GPIO 21 is an INPUT */
+ .inputs = {{
+ .name = name_tv,
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:55 2009
+Message-Id: <20091207000655.644896526@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:00 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ David Ford <david@blue-labs.org>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [084/119] ipv4: additional update of dev_net(dev) to struct *net in ip_fragment.c, NULL ptr OOPS
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=ipv4-additional-update-of-dev_net-dev-to-struct-net-in-ip_fragment.c-null-ptr-oops.patch
+Content-Length: 1196
+Lines: 36
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: David Ford <david@blue-labs.org>
+
+commit bbf31bf18d34caa87dd01f08bf713635593697f2 upstream.
+
+ipv4 ip_frag_reasm(), fully replace 'dev_net(dev)' with 'net', defined
+previously patched into 2.6.29.
+
+Between 2.6.28.10 and 2.6.29, net/ipv4/ip_fragment.c was patched,
+changing from dev_net(dev) to container_of(...). Unfortunately the goto
+section (out_fail) on oversized packets inside ip_frag_reasm() didn't
+get touched up as well. Oversized IP packets cause a NULL pointer
+dereference and immediate hang.
+
+I discovered this running openvasd and my previous email on this is
+titled: NULL pointer dereference at 2.6.32-rc8:net/ipv4/ip_fragment.c:566
+
+Signed-off-by: David Ford <david@blue-labs.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/ip_fragment.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/ip_fragment.c
++++ b/net/ipv4/ip_fragment.c
+@@ -563,7 +563,7 @@ out_oversize:
+ printk(KERN_INFO "Oversized IP packet from %pI4.\n",
+ &qp->saddr);
+ out_fail:
+- IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_REASMFAILS);
++ IP_INC_STATS_BH(net, IPSTATS_MIB_REASMFAILS);
+ return err;
+ }
+
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:56 2009
+Message-Id: <20091207000655.925379789@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:01 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Rusty Russell <rusty@rustcorp.com.au>,
+ Dominik Brodowski <linux@brodo.de>,
+ Dave Jones <davej@redhat.com>
+Subject: [085/119] [CPUFREQ] speedstep-ich: fix error caused by 394122ab144dae4b276d74644a2f11c44a60ac5c
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=speedstep-ich-fix-error-caused-by-394122ab144dae4b276d74644a2f11c44a60ac5c.patch
+Content-Length: 1892
+Lines: 63
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Rusty Russell <rusty@rustcorp.com.au>
+
+commit 8dca15e40889e5d5e9655b03ba79c26200f760ce upstream.
+
+"[CPUFREQ] cpumask: avoid playing with cpus_allowed in speedstep-ich.c"
+changed the code to mistakenly pass the current cpu as the "processor"
+argument of speedstep_get_frequency(), whereas it should be the type of
+the processor.
+
+Addresses http://bugzilla.kernel.org/show_bug.cgi?id=14340
+
+Based on a patch by Dave Mueller.
+
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Acked-by: Dominik Brodowski <linux@brodo.de>
+Reported-by: Dave Mueller <dave.mueller@gmx.ch>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Dave Jones <davej@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/cpufreq/speedstep-ich.c | 19 +++++++------------
+ 1 file changed, 7 insertions(+), 12 deletions(-)
+
+--- a/arch/x86/kernel/cpu/cpufreq/speedstep-ich.c
++++ b/arch/x86/kernel/cpu/cpufreq/speedstep-ich.c
+@@ -232,28 +232,23 @@ static unsigned int speedstep_detect_chi
+ return 0;
+ }
+
+-struct get_freq_data {
+- unsigned int speed;
+- unsigned int processor;
+-};
+-
+-static void get_freq_data(void *_data)
++static void get_freq_data(void *_speed)
+ {
+- struct get_freq_data *data = _data;
++ unsigned int *speed = _speed;
+
+- data->speed = speedstep_get_frequency(data->processor);
++ *speed = speedstep_get_frequency(speedstep_processor);
+ }
+
+ static unsigned int speedstep_get(unsigned int cpu)
+ {
+- struct get_freq_data data = { .processor = cpu };
++ unsigned int speed;
+
+ /* You're supposed to ensure CPU is online. */
+- if (smp_call_function_single(cpu, get_freq_data, &data, 1) != 0)
++ if (smp_call_function_single(cpu, get_freq_data, &speed, 1) != 0)
+ BUG();
+
+- dprintk("detected %u kHz as current frequency\n", data.speed);
+- return data.speed;
++ dprintk("detected %u kHz as current frequency\n", speed);
++ return speed;
+ }
+
+ /**
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:56 2009
+Message-Id: <20091207000656.155029308@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:02 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Stern <stern@rowland.harvard.edu>,
+ David Brownell <david-b@pacbell.net>
+Subject: [086/119] USB: EHCI: dont send Clear-TT-Buffer following a STALL
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=usb-ehci-don-t-send-clear-tt-buffer-following-a-stall.patch
+Content-Length: 2587
+Lines: 67
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit c2f6595fbdb408d3d6850cfae590c8fa93e27399 upstream.
+
+This patch (as1304) fixes a regression in ehci-hcd. Evidently some
+hubs don't handle Clear-TT-Buffer requests correctly, so we should
+avoid sending them when they don't appear to be absolutely necessary.
+The reported symptom is that output on a downstream audio device cuts
+out because the hub stops relaying isochronous packets.
+
+The patch prevents Clear-TT-Buffer requests from being sent following
+a STALL handshake. In theory a STALL indicates either that the
+downstream device sent a STALL or that no matching TT buffer could be
+found. In either case, the transfer is completed and the TT buffer
+does not remain busy, so it doesn't need to be cleared.
+
+Also, the patch fixes a minor flaw in the code that actually sends the
+Clear-TT-Buffer requests. Although the pipe direction isn't really
+used for control transfers, it should be a Send rather than a Receive.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Javier Kohen <jkohen@users.sourceforge.net>
+CC: David Brownell <david-b@pacbell.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/hub.c | 2 +-
+ drivers/usb/host/ehci-q.c | 16 ++++++++++++++--
+ 2 files changed, 15 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -439,7 +439,7 @@ resubmit:
+ static inline int
+ hub_clear_tt_buffer (struct usb_device *hdev, u16 devinfo, u16 tt)
+ {
+- return usb_control_msg(hdev, usb_rcvctrlpipe(hdev, 0),
++ return usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
+ HUB_CLEAR_TT_BUFFER, USB_RT_PORT, devinfo,
+ tt, NULL, 0, 1000);
+ }
+--- a/drivers/usb/host/ehci-q.c
++++ b/drivers/usb/host/ehci-q.c
+@@ -475,8 +475,20 @@ halt:
+ * we must clear the TT buffer (11.17.5).
+ */
+ if (unlikely(last_status != -EINPROGRESS &&
+- last_status != -EREMOTEIO))
+- ehci_clear_tt_buffer(ehci, qh, urb, token);
++ last_status != -EREMOTEIO)) {
++ /* The TT's in some hubs malfunction when they
++ * receive this request following a STALL (they
++ * stop sending isochronous packets). Since a
++ * STALL can't leave the TT buffer in a busy
++ * state (if you believe Figures 11-48 - 11-51
++ * in the USB 2.0 spec), we won't clear the TT
++ * buffer in this case. Strictly speaking this
++ * is a violation of the spec.
++ */
++ if (last_status != -EPIPE)
++ ehci_clear_tt_buffer(ehci, qh, urb,
++ token);
++ }
+ }
+
+ /* if we're removing something not at the queue head,
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:56 2009
+Message-Id: <20091207000656.289038717@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:03 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Subject: [087/119] USB: musb_gadget: fix STALL handling
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=usb-musb_gadget-fix-stall-handling.patch
+Content-Length: 6608
+Lines: 219
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+
+commit cea83241b3a84499c4f9b12f8288f787e7aa6383 upstream.
+
+The driver incorrectly cancels the mass-storage device CSW request
+(which leads to device reset) due to giving back URB at the head of
+endpoint's queue after sending each STALL handshake; stop doing that
+and start checking for the queue being non-empty before stalling an
+endpoint and disallowing stall in such case in musb_gadget_set_halt()
+like the other gadget drivers do.
+
+Moreover, the driver starts Rx request despite of the endpoint being
+halted -- fix this by moving the SendStall bit check from musb_g_rx()
+to rxstate(). And we also sometimes get into rxstate() with DMA still
+active after clearing an endpoint's halt (not clear why), so bail out
+in this case, similarly to what txstate() does...
+
+While at it, also do the following changes :
+
+- in musb_gadget_set_halt(), remove pointless Tx FIFO flushing (the
+ driver does not allow stalling with non-empty Tx FIFO anyway);
+
+- in rxstate(), stop pointlessly zeroing the 'csr' variable;
+
+- in musb_gadget_set_halt(), move the 'done' label to a more proper
+ place;
+
+- in musb_g_rx(), eliminate the 'done' label completely...
+
+Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/musb/musb_gadget.c | 79 +++++++++++++++++------------------------
+ 1 file changed, 34 insertions(+), 45 deletions(-)
+
+--- a/drivers/usb/musb/musb_gadget.c
++++ b/drivers/usb/musb/musb_gadget.c
+@@ -4,6 +4,7 @@
+ * Copyright 2005 Mentor Graphics Corporation
+ * Copyright (C) 2005-2006 by Texas Instruments
+ * Copyright (C) 2006-2007 Nokia Corporation
++ * Copyright (C) 2009 MontaVista Software, Inc. <source@mvista.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+@@ -436,14 +437,6 @@ void musb_g_tx(struct musb *musb, u8 epn
+ csr |= MUSB_TXCSR_P_WZC_BITS;
+ csr &= ~MUSB_TXCSR_P_SENTSTALL;
+ musb_writew(epio, MUSB_TXCSR, csr);
+- if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
+- dma->status = MUSB_DMA_STATUS_CORE_ABORT;
+- musb->dma_controller->channel_abort(dma);
+- }
+-
+- if (request)
+- musb_g_giveback(musb_ep, request, -EPIPE);
+-
+ break;
+ }
+
+@@ -582,15 +575,25 @@ void musb_g_tx(struct musb *musb, u8 epn
+ */
+ static void rxstate(struct musb *musb, struct musb_request *req)
+ {
+- u16 csr = 0;
+ const u8 epnum = req->epnum;
+ struct usb_request *request = &req->request;
+ struct musb_ep *musb_ep = &musb->endpoints[epnum].ep_out;
+ void __iomem *epio = musb->endpoints[epnum].regs;
+ unsigned fifo_count = 0;
+ u16 len = musb_ep->packet_sz;
++ u16 csr = musb_readw(epio, MUSB_RXCSR);
+
+- csr = musb_readw(epio, MUSB_RXCSR);
++ /* We shouldn't get here while DMA is active, but we do... */
++ if (dma_channel_status(musb_ep->dma) == MUSB_DMA_STATUS_BUSY) {
++ DBG(4, "DMA pending...\n");
++ return;
++ }
++
++ if (csr & MUSB_RXCSR_P_SENDSTALL) {
++ DBG(5, "%s stalling, RXCSR %04x\n",
++ musb_ep->end_point.name, csr);
++ return;
++ }
+
+ if (is_cppi_enabled() && musb_ep->dma) {
+ struct dma_controller *c = musb->dma_controller;
+@@ -761,19 +764,10 @@ void musb_g_rx(struct musb *musb, u8 epn
+ csr, dma ? " (dma)" : "", request);
+
+ if (csr & MUSB_RXCSR_P_SENTSTALL) {
+- if (dma_channel_status(dma) == MUSB_DMA_STATUS_BUSY) {
+- dma->status = MUSB_DMA_STATUS_CORE_ABORT;
+- (void) musb->dma_controller->channel_abort(dma);
+- request->actual += musb_ep->dma->actual_len;
+- }
+-
+ csr |= MUSB_RXCSR_P_WZC_BITS;
+ csr &= ~MUSB_RXCSR_P_SENTSTALL;
+ musb_writew(epio, MUSB_RXCSR, csr);
+-
+- if (request)
+- musb_g_giveback(musb_ep, request, -EPIPE);
+- goto done;
++ return;
+ }
+
+ if (csr & MUSB_RXCSR_P_OVERRUN) {
+@@ -795,7 +789,7 @@ void musb_g_rx(struct musb *musb, u8 epn
+ DBG((csr & MUSB_RXCSR_DMAENAB) ? 4 : 1,
+ "%s busy, csr %04x\n",
+ musb_ep->end_point.name, csr);
+- goto done;
++ return;
+ }
+
+ if (dma && (csr & MUSB_RXCSR_DMAENAB)) {
+@@ -826,22 +820,15 @@ void musb_g_rx(struct musb *musb, u8 epn
+ if ((request->actual < request->length)
+ && (musb_ep->dma->actual_len
+ == musb_ep->packet_sz))
+- goto done;
++ return;
+ #endif
+ musb_g_giveback(musb_ep, request, 0);
+
+ request = next_request(musb_ep);
+ if (!request)
+- goto done;
+-
+- /* don't start more i/o till the stall clears */
+- musb_ep_select(mbase, epnum);
+- csr = musb_readw(epio, MUSB_RXCSR);
+- if (csr & MUSB_RXCSR_P_SENDSTALL)
+- goto done;
++ return;
+ }
+
+-
+ /* analyze request if the ep is hot */
+ if (request)
+ rxstate(musb, to_musb_request(request));
+@@ -849,8 +836,6 @@ void musb_g_rx(struct musb *musb, u8 epn
+ DBG(3, "packet waiting for %s%s request\n",
+ musb_ep->desc ? "" : "inactive ",
+ musb_ep->end_point.name);
+-
+-done:
+ return;
+ }
+
+@@ -1244,7 +1229,7 @@ int musb_gadget_set_halt(struct usb_ep *
+ void __iomem *mbase;
+ unsigned long flags;
+ u16 csr;
+- struct musb_request *request = NULL;
++ struct musb_request *request;
+ int status = 0;
+
+ if (!ep)
+@@ -1260,24 +1245,29 @@ int musb_gadget_set_halt(struct usb_ep *
+
+ musb_ep_select(mbase, epnum);
+
+- /* cannot portably stall with non-empty FIFO */
+ request = to_musb_request(next_request(musb_ep));
+- if (value && musb_ep->is_in) {
+- csr = musb_readw(epio, MUSB_TXCSR);
+- if (csr & MUSB_TXCSR_FIFONOTEMPTY) {
+- DBG(3, "%s fifo busy, cannot halt\n", ep->name);
+- spin_unlock_irqrestore(&musb->lock, flags);
+- return -EAGAIN;
++ if (value) {
++ if (request) {
++ DBG(3, "request in progress, cannot halt %s\n",
++ ep->name);
++ status = -EAGAIN;
++ goto done;
++ }
++ /* Cannot portably stall with non-empty FIFO */
++ if (musb_ep->is_in) {
++ csr = musb_readw(epio, MUSB_TXCSR);
++ if (csr & MUSB_TXCSR_FIFONOTEMPTY) {
++ DBG(3, "FIFO busy, cannot halt %s\n", ep->name);
++ status = -EAGAIN;
++ goto done;
++ }
+ }
+-
+ }
+
+ /* set/clear the stall and toggle bits */
+ DBG(2, "%s: %s stall\n", ep->name, value ? "set" : "clear");
+ if (musb_ep->is_in) {
+ csr = musb_readw(epio, MUSB_TXCSR);
+- if (csr & MUSB_TXCSR_FIFONOTEMPTY)
+- csr |= MUSB_TXCSR_FLUSHFIFO;
+ csr |= MUSB_TXCSR_P_WZC_BITS
+ | MUSB_TXCSR_CLRDATATOG;
+ if (value)
+@@ -1300,14 +1290,13 @@ int musb_gadget_set_halt(struct usb_ep *
+ musb_writew(epio, MUSB_RXCSR, csr);
+ }
+
+-done:
+-
+ /* maybe start the first request in the queue */
+ if (!musb_ep->busy && !value && request) {
+ DBG(3, "restarting the request\n");
+ musb_ep_restart(musb, request);
+ }
+
++done:
+ spin_unlock_irqrestore(&musb->lock, flags);
+ return status;
+ }
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:56 2009
+Message-Id: <20091207000656.432492565@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:04 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Thomas Dahlmann <dahlmann.thomas@arcor.de>,
+ Robert Richter <robert.richter@amd.com>,
+ David Brownell <david-b@pacbell.net>
+Subject: [088/119] usb: amd5536udc: fixed shared interrupt bug and warning oops
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=usb-amd5536udc-fixed-shared-interrupt-bug-and-warning-oops.patch
+Content-Length: 3424
+Lines: 118
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Thomas Dahlmann <dahlmann.thomas@arcor.de>
+
+commit c5deb832d7a3f9618b09e6eeaa91a1a845c90c65 upstream.
+
+- fixed shared interrupt bug reported by Vadim Lobanov
+ - fixed possible warning oops on driver unload when connected
+ - prevent interrupt flood in PIO mode ("modprobe amd5536udc use_dma=0")
+ when using gadget ether
+
+Signed-off-by: Thomas Dahlmann <dahlmann.thomas@arcor.de>
+Cc: Robert Richter <robert.richter@amd.com>
+Cc: David Brownell <david-b@pacbell.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/gadget/amd5536udc.c | 49 ++++++++++++++++++++++++----------------
+ 1 file changed, 30 insertions(+), 19 deletions(-)
+
+--- a/drivers/usb/gadget/amd5536udc.c
++++ b/drivers/usb/gadget/amd5536udc.c
+@@ -1213,7 +1213,12 @@ udc_queue(struct usb_ep *usbep, struct u
+ tmp &= AMD_UNMASK_BIT(ep->num);
+ writel(tmp, &dev->regs->ep_irqmsk);
+ }
+- }
++ } else if (ep->in) {
++ /* enable ep irq */
++ tmp = readl(&dev->regs->ep_irqmsk);
++ tmp &= AMD_UNMASK_BIT(ep->num);
++ writel(tmp, &dev->regs->ep_irqmsk);
++ }
+
+ } else if (ep->dma) {
+
+@@ -2005,18 +2010,17 @@ __acquires(dev->lock)
+ {
+ int tmp;
+
+- /* empty queues and init hardware */
+- udc_basic_init(dev);
+- for (tmp = 0; tmp < UDC_EP_NUM; tmp++) {
+- empty_req_queue(&dev->ep[tmp]);
+- }
+-
+ if (dev->gadget.speed != USB_SPEED_UNKNOWN) {
+ spin_unlock(&dev->lock);
+ driver->disconnect(&dev->gadget);
+ spin_lock(&dev->lock);
+ }
+- /* init */
++
++ /* empty queues and init hardware */
++ udc_basic_init(dev);
++ for (tmp = 0; tmp < UDC_EP_NUM; tmp++)
++ empty_req_queue(&dev->ep[tmp]);
++
+ udc_setup_endpoints(dev);
+ }
+
+@@ -2478,6 +2482,13 @@ static irqreturn_t udc_data_in_isr(struc
+ }
+ }
+
++ } else if (!use_dma && ep->in) {
++ /* disable interrupt */
++ tmp = readl(
++ &dev->regs->ep_irqmsk);
++ tmp |= AMD_BIT(ep->num);
++ writel(tmp,
++ &dev->regs->ep_irqmsk);
+ }
+ }
+ /* clear status bits */
+@@ -3285,6 +3296,17 @@ static int udc_pci_probe(
+ goto finished;
+ }
+
++ spin_lock_init(&dev->lock);
++ /* udc csr registers base */
++ dev->csr = dev->virt_addr + UDC_CSR_ADDR;
++ /* dev registers base */
++ dev->regs = dev->virt_addr + UDC_DEVCFG_ADDR;
++ /* ep registers base */
++ dev->ep_regs = dev->virt_addr + UDC_EPREGS_ADDR;
++ /* fifo's base */
++ dev->rxfifo = (u32 __iomem *)(dev->virt_addr + UDC_RXFIFO_ADDR);
++ dev->txfifo = (u32 __iomem *)(dev->virt_addr + UDC_TXFIFO_ADDR);
++
+ if (request_irq(pdev->irq, udc_irq, IRQF_SHARED, name, dev) != 0) {
+ dev_dbg(&dev->pdev->dev, "request_irq(%d) fail\n", pdev->irq);
+ kfree(dev);
+@@ -3337,7 +3359,6 @@ static int udc_probe(struct udc *dev)
+ udc_pollstall_timer.data = 0;
+
+ /* device struct setup */
+- spin_lock_init(&dev->lock);
+ dev->gadget.ops = &udc_ops;
+
+ dev_set_name(&dev->gadget.dev, "gadget");
+@@ -3346,16 +3367,6 @@ static int udc_probe(struct udc *dev)
+ dev->gadget.name = name;
+ dev->gadget.is_dualspeed = 1;
+
+- /* udc csr registers base */
+- dev->csr = dev->virt_addr + UDC_CSR_ADDR;
+- /* dev registers base */
+- dev->regs = dev->virt_addr + UDC_DEVCFG_ADDR;
+- /* ep registers base */
+- dev->ep_regs = dev->virt_addr + UDC_EPREGS_ADDR;
+- /* fifo's base */
+- dev->rxfifo = (u32 __iomem *)(dev->virt_addr + UDC_RXFIFO_ADDR);
+- dev->txfifo = (u32 __iomem *)(dev->virt_addr + UDC_TXFIFO_ADDR);
+-
+ /* init registers, interrupts, ... */
+ startup_registers(dev);
+
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:56 2009
+Message-Id: <20091207000656.597883985@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:05 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ "Eric W. Biederman" <ebiederm@aristanetworks.com>
+Subject: [089/119] USB: ftdi_sio: Keep going when write errors are encountered.
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=usb-ftdi_sio-keep-going-when-write-errors-are-encountered.patch
+Content-Length: 1305
+Lines: 41
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+commit 0de6ab8b91f2e1e8e7fc66a8b5c5e8ca82ea16b7 upstream.
+
+The use of urb->actual_length to update tx_outstanding_bytes
+implicitly assumes that the number of bytes actually written is the
+same as the number of bytes we tried to write. On error that
+assumption is violated so just use transfer_buffer_length the number
+of bytes we intended to write to the device.
+
+If an error occurs we need to fall through and call
+usb_serial_port_softint to wake up processes waiting in
+tty_wait_until_sent.
+
+Signed-off-by: Eric W. Biederman <ebiederm@aristanetworks.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1939,7 +1939,7 @@ static void ftdi_write_bulk_callback(str
+ return;
+ }
+ /* account for transferred data */
+- countback = urb->actual_length;
++ countback = urb->transfer_buffer_length;
+ data_offset = priv->write_offset;
+ if (data_offset > 0) {
+ /* Subtract the control bytes */
+@@ -1952,7 +1952,6 @@ static void ftdi_write_bulk_callback(str
+
+ if (status) {
+ dbg("nonzero write bulk status received: %d", status);
+- return;
+ }
+
+ usb_serial_port_softint(port);
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:56 2009
+Message-Id: <20091207000656.725986786@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:06 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Oliver Neukum <oliver@neukum.org>
+Subject: [090/119] USB: work around for EHCI with quirky periodic schedules
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=usb-work-around-for-ehci-with-quirky-periodic-schedules.patch
+Content-Length: 3016
+Lines: 98
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Oliver Neukum <oliver@neukum.org>
+
+commit ee4ecb8ac63a5792bec448037d4b82ec4144f94b upstream.
+
+a quirky chipset needs periodic schedules to run for a minimum
+time before they can be disabled again. This enforces the requirement
+with a time stamp and a calculated delay
+
+Signed-off-by: Oliver Neukum <oliver@neukum.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/ehci-hcd.c | 2 ++
+ drivers/usb/host/ehci-pci.c | 6 ++++++
+ drivers/usb/host/ehci-sched.c | 12 ++++++++++++
+ drivers/usb/host/ehci.h | 2 ++
+ 4 files changed, 22 insertions(+)
+
+--- a/drivers/usb/host/ehci.h
++++ b/drivers/usb/host/ehci.h
+@@ -118,6 +118,7 @@ struct ehci_hcd { /* one per controlle
+ unsigned stamp;
+ unsigned random_frame;
+ unsigned long next_statechange;
++ ktime_t last_periodic_enable;
+ u32 command;
+
+ /* SILICON QUIRKS */
+@@ -126,6 +127,7 @@ struct ehci_hcd { /* one per controlle
+ unsigned big_endian_mmio:1;
+ unsigned big_endian_desc:1;
+ unsigned has_amcc_usb23:1;
++ unsigned broken_periodic:1;
+
+ /* required for usb32 quirk */
+ #define OHCI_CTRL_HCFS (3 << 6)
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -28,6 +28,7 @@
+ #include <linux/errno.h>
+ #include <linux/init.h>
+ #include <linux/timer.h>
++#include <linux/ktime.h>
+ #include <linux/list.h>
+ #include <linux/interrupt.h>
+ #include <linux/reboot.h>
+@@ -655,6 +656,7 @@ static int ehci_run (struct usb_hcd *hcd
+ ehci_readl(ehci, &ehci->regs->command); /* unblock posted writes */
+ msleep(5);
+ up_write(&ehci_cf_port_reset_rwsem);
++ ehci->last_periodic_enable = ktime_get_real();
+
+ temp = HC_VERSION(ehci_readl(ehci, &ehci->caps->hc_capbase));
+ ehci_info (ehci,
+--- a/drivers/usb/host/ehci-pci.c
++++ b/drivers/usb/host/ehci-pci.c
+@@ -72,6 +72,12 @@ static int ehci_pci_setup(struct usb_hcd
+ int retval;
+
+ switch (pdev->vendor) {
++ case PCI_VENDOR_ID_INTEL:
++ if (pdev->device == 0x27cc) {
++ ehci->broken_periodic = 1;
++ ehci_info(ehci, "using broken periodic workaround\n");
++ }
++ break;
+ case PCI_VENDOR_ID_TOSHIBA_2:
+ /* celleb's companion chip */
+ if (pdev->device == 0x01b5) {
+--- a/drivers/usb/host/ehci-sched.c
++++ b/drivers/usb/host/ehci-sched.c
+@@ -456,6 +456,8 @@ static int enable_periodic (struct ehci_
+ /* make sure ehci_work scans these */
+ ehci->next_uframe = ehci_readl(ehci, &ehci->regs->frame_index)
+ % (ehci->periodic_size << 3);
++ if (unlikely(ehci->broken_periodic))
++ ehci->last_periodic_enable = ktime_get_real();
+ return 0;
+ }
+
+@@ -467,6 +469,16 @@ static int disable_periodic (struct ehci
+ if (--ehci->periodic_sched)
+ return 0;
+
++ if (unlikely(ehci->broken_periodic)) {
++ /* delay experimentally determined */
++ ktime_t safe = ktime_add_us(ehci->last_periodic_enable, 1000);
++ ktime_t now = ktime_get_real();
++ s64 delay = ktime_us_delta(safe, now);
++
++ if (unlikely(delay > 0))
++ udelay(delay);
++ }
++
+ /* did setting PSE not take effect yet?
+ * takes effect only at frame boundaries...
+ */
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:57 2009
+Message-Id: <20091207000656.889070773@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:07 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Cox <alan@linux.intel.com>
+Subject: [091/119] tty_port: handle the nonblocking open of a dead port corner case
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=tty_port-handle-the-nonblocking-open-of-a-dead-port-corner-case.patch
+Content-Length: 992
+Lines: 31
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Alan Cox <alan@linux.intel.com>
+
+commit 8627b96dd80dca440d91fbb1ec733be25912d0dd upstream.
+
+Some drivers allow O_NDELAY of a dead port (eg for setserial to work). In that
+situation we must not try to raise the carrier.
+
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/tty_port.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/char/tty_port.c
++++ b/drivers/char/tty_port.c
+@@ -217,8 +217,11 @@ int tty_port_block_til_ready(struct tty_
+
+ /* if non-blocking mode is set we can pass directly to open unless
+ the port has just hung up or is in another error state */
+- if ((filp->f_flags & O_NONBLOCK) ||
+- (tty->flags & (1 << TTY_IO_ERROR))) {
++ if (tty->flags & (1 << TTY_IO_ERROR)) {
++ port->flags |= ASYNC_NORMAL_ACTIVE;
++ return 0;
++ }
++ if (filp->f_flags & O_NONBLOCK) {
+ /* Indicate we are open */
+ if (tty->termios->c_cflag & CBAUD)
+ tty_port_raise_dtr_rts(port);
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:57 2009
+Message-Id: <20091207000657.032254620@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:08 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Daniel Mack <daniel@caiaq.de>,
+ Pierre Ossman <pierre@ossman.eu>,
+ linux-mmc@vger.kernel.org,
+ linux-arm-kernel@lists.infradead.org,
+ Eric Miao <eric.y.miao@gmail.com>
+Subject: [092/119] [ARM] pxamci: call mmc_remove_host() before freeing resources
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=pxamci-call-mmc_remove_host-before-freeing-resources.patch
+Content-Length: 5102
+Lines: 89
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Daniel Mack <daniel@caiaq.de>
+
+commit 5d6b1edf8ccc4b7e4e77dff3fc80882833d6186e upstream.
+
+mmc_remove_host() will cause the mmc core to switch off the bus power by
+eventually calling pxamci_set_ios(). This function uses the regulator or
+the GPIO which have been freed already.
+
+This causes the following Oops on module unload.
+
+[ 49.519649] Unable to handle kernel paging request at virtual address 30303a70
+[ 49.526878] pgd = c7084000
+[ 49.529563] [30303a70] *pgd=00000000
+[ 49.533136] Internal error: Oops: 5 [#1]
+[ 49.537025] last sysfs file: /sys/devices/platform/pxa27x-ohci/usb1/1-1/1-1:1.0/host0/target0:0:0/0:0:0:0/scsi_level
+[ 49.547471] Modules linked in: pxamci(-) eeti_ts
+[ 49.552061] CPU: 0 Not tainted (2.6.32-rc8 #322)
+[ 49.557001] PC is at regulator_is_enabled+0x3c/0xbc
+[ 49.561846] LR is at regulator_is_enabled+0x30/0xbc
+[ 49.566691] pc : [<c01a2448>] lr : [<c01a243c>] psr: 60000013
+[ 49.566702] sp : c7083e70 ip : 30303a30 fp : 00000000
+[ 49.578093] r10: c705e200 r9 : c7082000 r8 : c705e2e0
+[ 49.583280] r7 : c7061340 r6 : c7061340 r5 : c7083e70 r4 : 00000000
+[ 49.589759] r3 : c04dc434 r2 : c04dc434 r1 : c03eecea r0 : 00000047
+[ 49.596241] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
+[ 49.603329] Control: 0000397f Table: a7084018 DAC: 00000015
+[ 49.609031] Process rmmod (pid: 1101, stack limit = 0xc7082278)
+[ 49.614908] Stack: (0xc7083e70 to 0xc7084000)
+[ 49.619238] 3e60: c7082000 c703c4f8 c705ea00 c04f4074
+[ 49.627366] 3e80: 00000000 c705e3a0 ffffffff c0247ddc c70361a0 00000000 c705e3a0 ffffffff
+[ 49.635499] 3ea0: c705e200 bf006400 c78c4f00 c705e200 c705e3a0 ffffffff c705e200 ffffffff
+[ 49.643633] 3ec0: c04d8ac8 c02476d0 ffffffff c0247c60 c705e200 c0248678 c705e200 c0249064
+[ 49.651765] 3ee0: ffffffff bf006204 c04d8ad0 c04d8ad0 c04d8ac8 bf007490 00000880 c00440c4
+[ 49.659898] 3f00: 0000b748 c01c5708 bf007490 c01c44c8 c04d8ac8 c04d8afc bf007490 c01c4570
+[ 49.668031] 3f20: bf007490 bf00750c c04f4258 c01c37a4 00000000 bf00750c c7083f44 c007b014
+[ 49.676162] 3f40: 4000d000 6d617870 08006963 00000001 00000000 c7085000 00000001 00000000
+[ 49.684287] 3f60: 4000d000 c7083f8c 00000001 bea01a54 00005401 c7ab1400 c00440c4 00082000
+[ 49.692420] 3f80: bf00750c 00000880 c7083f8c 00000000 4000cfa8 00000000 00000880 bea01cc8
+[ 49.700552] 3fa0: 00000081 c0043f40 00000000 00000880 bea01cc8 00000880 00000006 00000000
+[ 49.708677] 3fc0: 00000000 00000880 bea01cc8 00000081 00000097 0000cca4 0000b748 00000000
+[ 49.716802] 3fe0: 4001a4f0 bea01cc0 00018bf4 4001a4fc 20000010 bea01cc8 a063e021 a063e421
+[ 49.724958] [<c01a2448>] (regulator_is_enabled+0x3c/0xbc) from [<c0247ddc>] (mmc_regulator_set_ocr+0x14/0xd8)
+[ 49.734836] [<c0247ddc>] (mmc_regulator_set_ocr+0x14/0xd8) from [<bf006400>] (pxamci_set_ios+0xd8/0x17c [pxamci])
+[ 49.745044] [<bf006400>] (pxamci_set_ios+0xd8/0x17c [pxamci]) from [<c02476d0>] (mmc_power_off+0x50/0x58)
+[ 49.754555] [<c02476d0>] (mmc_power_off+0x50/0x58) from [<c0247c60>] (mmc_detach_bus+0x68/0xc4)
+[ 49.763207] [<c0247c60>] (mmc_detach_bus+0x68/0xc4) from [<c0248678>] (mmc_stop_host+0xd4/0x1bc)
+[ 49.771944] [<c0248678>] (mmc_stop_host+0xd4/0x1bc) from [<c0249064>] (mmc_remove_host+0xc/0x20)
+[ 49.780681] [<c0249064>] (mmc_remove_host+0xc/0x20) from [<bf006204>] (pxamci_remove+0xc8/0x174 [pxamci])
+[ 49.790211] [<bf006204>] (pxamci_remove+0xc8/0x174 [pxamci]) from [<c01c5708>] (platform_drv_remove+0x1c/0x24)
+[ 49.800164] [<c01c5708>] (platform_drv_remove+0x1c/0x24) from [<c01c44c8>] (__device_release_driver+0x7c/0xc4)
+[ 49.810110] [<c01c44c8>] (__device_release_driver+0x7c/0xc4) from [<c01c4570>] (driver_detach+0x60/0x8c)
+[ 49.819535] [<c01c4570>] (driver_detach+0x60/0x8c) from [<c01c37a4>] (bus_remove_driver+0x90/0xcc)
+[ 49.828452] [<c01c37a4>] (bus_remove_driver+0x90/0xcc) from [<c007b014>] (sys_delete_module+0x1d8/0x254)
+[ 49.837891] [<c007b014>] (sys_delete_module+0x1d8/0x254) from [<c0043f40>] (ret_fast_syscall+0x0/0x28)
+[ 49.847145] Code: eb06c53a e596c030 e1a0500d e59f106c (e59c0040)
+[ 49.853566] ---[ end trace b5fa66a00cea142f ]---
+
+Signed-off-by: Daniel Mack <daniel@caiaq.de>
+Reported-by: Sven Neumann <s.neumann@raumfeld.com>
+Cc: Pierre Ossman <pierre@ossman.eu>
+Cc: linux-mmc@vger.kernel.org
+Cc: linux-arm-kernel@lists.infradead.org
+Signed-off-by: Eric Miao <eric.y.miao@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mmc/host/pxamci.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/mmc/host/pxamci.c
++++ b/drivers/mmc/host/pxamci.c
+@@ -694,14 +694,14 @@ static int pxamci_remove(struct platform
+ if (mmc) {
+ struct pxamci_host *host = mmc_priv(mmc);
+
++ mmc_remove_host(mmc);
++
+ if (host->vcc)
+ regulator_put(host->vcc);
+
+ if (host->pdata && host->pdata->exit)
+ host->pdata->exit(&pdev->dev, mmc);
+
+- mmc_remove_host(mmc);
+-
+ pxamci_stop_clock(host);
+ writel(TXFIFO_WR_REQ|RXFIFO_RD_REQ|CLK_IS_OFF|STOP_CMD|
+ END_CMD_RES|PRG_DONE|DATA_TRAN_DONE,
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:57 2009
+Message-Id: <20091207000657.204461287@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:09 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Rusty Russell <rusty@rustcorp.com.au>
+Subject: [093/119] param: dont complain about unused module parameters.
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=param-don-t-complain-about-unused-module-parameters.patch
+Content-Length: 1378
+Lines: 47
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Rusty Russell <rusty@rustcorp.com.au>
+
+commit f066a4f6df68f03b565dfe867dde54dfeb26576e upstream.
+
+Jon confirms that recent modprobe will look in /proc/cmdline, so these
+cmdline options can still be used.
+
+See http://bugzilla.kernel.org/show_bug.cgi?id=14164
+
+Reported-by: Adam Williamson <awilliam@redhat.com>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ init/main.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+--- a/init/main.c
++++ b/init/main.c
+@@ -250,7 +250,7 @@ early_param("loglevel", loglevel);
+
+ /*
+ * Unknown boot options get handed to init, unless they look like
+- * failed parameters
++ * unused parameters (modprobe will find them in /proc/cmdline).
+ */
+ static int __init unknown_bootoption(char *param, char *val)
+ {
+@@ -271,14 +271,9 @@ static int __init unknown_bootoption(cha
+ if (obsolete_checksetup(param))
+ return 0;
+
+- /*
+- * Preemptive maintenance for "why didn't my misspelled command
+- * line work?"
+- */
+- if (strchr(param, '.') && (!val || strchr(param, '.') < val)) {
+- printk(KERN_ERR "Unknown boot option `%s': ignoring\n", param);
++ /* Unused module parameter. */
++ if (strchr(param, '.') && (!val || strchr(param, '.') < val))
+ return 0;
+- }
+
+ if (panic_later)
+ return 0;
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:57 2009
+Message-Id: <20091207000657.341233965@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:10 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Helge Deller <deller@gmx.de>,
+ rusty@rustcorp.com.au,
+ James.Bottomley@HansenPartnership.com,
+ roland@redhat.com,
+ dave@hiauly1.hia.nrc.ca
+Subject: [094/119] modules: dont export section names of empty sections via sysfs
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=modules-don-t-export-section-names-of-empty-sections-via-sysfs.patch
+Content-Length: 2616
+Lines: 70
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Helge Deller <deller@gmx.de>
+
+commit 35dead4235e2b67da7275b4122fed37099c2f462 upstream.
+
+On the parisc architecture we face for each and every loaded kernel module
+this kernel "badness warning":
+ sysfs: cannot create duplicate filename '/module/ac97_bus/sections/.text'
+ Badness at fs/sysfs/dir.c:487
+
+Reason for that is, that on parisc all kernel modules do have multiple
+.text sections due to the usage of the -ffunction-sections compiler flag
+which is needed to reach all jump targets on this platform.
+
+An objdump on such a kernel module gives:
+Sections:
+Idx Name Size VMA LMA File off Algn
+ 0 .note.gnu.build-id 00000024 00000000 00000000 00000034 2**2
+ CONTENTS, ALLOC, LOAD, READONLY, DATA
+ 1 .text 00000000 00000000 00000000 00000058 2**0
+ CONTENTS, ALLOC, LOAD, READONLY, CODE
+ 2 .text.ac97_bus_match 0000001c 00000000 00000000 00000058 2**2
+ CONTENTS, ALLOC, LOAD, READONLY, CODE
+ 3 .text 00000000 00000000 00000000 000000d4 2**0
+ CONTENTS, ALLOC, LOAD, READONLY, CODE
+...
+Since the .text sections are empty (size of 0 bytes) and won't be
+loaded by the kernel module loader anyway, I don't see a reason
+why such sections need to be listed under
+/sys/module/<module_name>/sections/<section_name> either.
+
+The attached patch does solve this issue by not exporting section
+names which are empty.
+
+This fixes bugzilla http://bugzilla.kernel.org/show_bug.cgi?id=14703
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+CC: rusty@rustcorp.com.au
+CC: akpm@linux-foundation.org
+CC: James.Bottomley@HansenPartnership.com
+CC: roland@redhat.com
+CC: dave@hiauly1.hia.nrc.ca
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/module.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -1179,7 +1179,8 @@ static void add_sect_attrs(struct module
+
+ /* Count loaded sections and allocate structures */
+ for (i = 0; i < nsect; i++)
+- if (sechdrs[i].sh_flags & SHF_ALLOC)
++ if (sechdrs[i].sh_flags & SHF_ALLOC
++ && sechdrs[i].sh_size)
+ nloaded++;
+ size[0] = ALIGN(sizeof(*sect_attrs)
+ + nloaded * sizeof(sect_attrs->attrs[0]),
+@@ -1199,6 +1200,8 @@ static void add_sect_attrs(struct module
+ for (i = 0; i < nsect; i++) {
+ if (! (sechdrs[i].sh_flags & SHF_ALLOC))
+ continue;
++ if (!sechdrs[i].sh_size)
++ continue;
+ sattr->address = sechdrs[i].sh_addr;
+ sattr->name = kstrdup(secstrings + sechdrs[i].sh_name,
+ GFP_KERNEL);
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:57 2009
+Message-Id: <20091207000657.501477590@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:11 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ NeilBrown <neilb@suse.de>
+Subject: [095/119] md: revert incorrect fix for read error handling in raid1.
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=md-revert-incorrect-fix-for-read-error-handling-in-raid1.patch
+Content-Length: 1638
+Lines: 46
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: NeilBrown <neilb@suse.de>
+
+commit d0e260782c3702a009645c3caa02e381dab8798b upstream.
+
+commit 4706b349f was a forward port of a fix that was needed
+for SLES10. But in fact it is not needed in mainline because
+the earlier commit dd00a99e7a fixes the same problem in a
+better way.
+Further, this commit introduces a bug in the way it interacts with
+the automatic read-error-correction. If, after a read error is
+successfully corrected, the same disk is chosen to re-read - the
+re-read won't be attempted but an error will be returned instead.
+
+After reverting that commit, there is the possibility that a
+read error on a read-only array (where read errors cannot
+be corrected as that requires a write) will repeatedly read the same
+device and continue to get an error.
+So in the "Array is readonly" case, fail the drive immediately on
+a read error.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/raid1.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -1643,11 +1643,12 @@ static void raid1d(mddev_t *mddev)
+ r1_bio->sector,
+ r1_bio->sectors);
+ unfreeze_array(conf);
+- }
++ } else
++ md_error(mddev,
++ conf->mirrors[r1_bio->read_disk].rdev);
+
+ bio = r1_bio->bios[r1_bio->read_disk];
+- if ((disk=read_balance(conf, r1_bio)) == -1 ||
+- disk == r1_bio->read_disk) {
++ if ((disk=read_balance(conf, r1_bio)) == -1) {
+ printk(KERN_ALERT "raid1: %s: unrecoverable I/O"
+ " read error for block %llu\n",
+ bdevname(bio->bi_bdev,b),
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:57 2009
+Message-Id: <20091207000657.658227549@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:12 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Paul Mackerras <paulus@samba.org>,
+ Corey Ashford <cjashfor@linux.vnet.ibm.com>,
+ Peter Zijlstra <a.p.zijlstra@chello.nl>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [096/119] perf_event: Adjust frequency and unthrottle for non-group-leader events
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=perf_event-adjust-frequency-and-unthrottle-for-non-group-leader-events.patch
+Content-Length: 1785
+Lines: 45
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Paul Mackerras <paulus@samba.org>
+
+commit 03541f8b69c058162e4cf9675ec9181e6a204d55 upstream.
+
+The loop in perf_ctx_adjust_freq checks the frequency of sampling
+event counters, and adjusts the event interval and unthrottles the
+event if required, and resets the interrupt count for the event.
+However, at present it only looks at group leaders.
+
+This means that a sampling event that is not a group leader will
+eventually get throttled, once its interrupt count reaches
+sysctl_perf_event_sample_rate/HZ --- and that is guaranteed to
+happen, if the event is active for long enough, since the interrupt
+count never gets reset. Once it is throttled it never gets
+unthrottled, so it basically just stops working at that point.
+
+This fixes it by making perf_ctx_adjust_freq use ctx->event_list
+rather than ctx->group_list. The existing spin_lock/spin_unlock
+around the loop makes it unnecessary to put rcu_read_lock/
+rcu_read_unlock around the list_for_each_entry_rcu().
+
+Reported-by: Mark W. Krentel <krentel@cs.rice.edu>
+Signed-off-by: Paul Mackerras <paulus@samba.org>
+Cc: Corey Ashford <cjashfor@linux.vnet.ibm.com>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+LKML-Reference: <19157.26731.855609.165622@cargo.ozlabs.ibm.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/perf_counter.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/perf_counter.c
++++ b/kernel/perf_counter.c
+@@ -1363,7 +1363,7 @@ static void perf_ctx_adjust_freq(struct
+ u64 interrupts, freq;
+
+ spin_lock(&ctx->lock);
+- list_for_each_entry(counter, &ctx->counter_list, list_entry) {
++ list_for_each_entry_rcu(counter, &ctx->counter_list, event_entry) {
+ if (counter->state != PERF_COUNTER_STATE_ACTIVE)
+ continue;
+
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:57 2009
+Message-Id: <20091207000657.814193868@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:13 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ =?ISO-8859-15?q?Antti=20Kaijanm=C3=A4ki?= <antti.kaijanmaki@nomovok.com>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [097/119] hso: fix soft-lockup
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=hso-fix-soft-lockup.patch
+Content-Length: 1273
+Lines: 39
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Antti Kaijanmäki <antti.kaijanmaki@nomovok.com>
+
+commit dcfcb256cc23c4436691b0fe677275306699d6a1 upstream.
+
+Fix soft-lockup in hso.c which is triggered on SMP machine when
+modem is removed while file descriptor(s) under /dev are still open:
+
+ old version called kref_put() too early which resulted in destroying
+ hso_serial and hso_device objects which were still used later on.
+
+Signed-off-by: Antti Kaijanmäki <antti.kaijanmaki@nomovok.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+
+---
+ drivers/net/usb/hso.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/usb/hso.c
++++ b/drivers/net/usb/hso.c
+@@ -1362,7 +1362,7 @@ static void hso_serial_close(struct tty_
+ /* reset the rts and dtr */
+ /* do the actual close */
+ serial->open_count--;
+- kref_put(&serial->parent->ref, hso_serial_ref_free);
++
+ if (serial->open_count <= 0) {
+ serial->open_count = 0;
+ spin_lock_irq(&serial->serial_lock);
+@@ -1382,6 +1382,8 @@ static void hso_serial_close(struct tty_
+ usb_autopm_put_interface(serial->parent->interface);
+
+ mutex_unlock(&serial->parent->mutex);
++
++ kref_put(&serial->parent->ref, hso_serial_ref_free);
+ }
+
+ /* close the requested serial port */
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:58 2009
+Message-Id: <20091207000657.982743086@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:14 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ NeilBrown <neilb@suse.de>,
+ Tejun Heo <tj@kernel.org>,
+ Jens Axboe <jens.axboe@oracle.com>
+Subject: [098/119] block: use after free bug in __blkdev_get
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=block-use-after-free-bug-in-__blkdev_get.patch
+Content-Length: 1177
+Lines: 36
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Neil Brown <neilb@suse.de>
+
+commit 960cc0f4fef607baabc2232fbd7cce5368a9dcfd upstream.
+
+commit 0762b8bde9729f10f8e6249809660ff2ec3ad735
+(from 14 months ago) introduced a use-after-free bug which has just
+recently started manifesting in my md testing.
+I tried git bisect to find out what caused the bug to start
+manifesting, and it could have been the recent change to
+blk_unregister_queue (48c0d4d4c04) but the results were inconclusive.
+
+This patch certainly fixes my symptoms and looks correct as the two
+calls are now in the same order as elsewhere in that function.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Acked-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/block_dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -1243,8 +1243,8 @@ static int __blkdev_get(struct block_dev
+ bd_set_size(bdev, (loff_t)bdev->bd_part->nr_sects << 9);
+ }
+ } else {
+- put_disk(disk);
+ module_put(disk->fops->owner);
++ put_disk(disk);
+ disk = NULL;
+ if (bdev->bd_contains == bdev) {
+ if (bdev->bd_disk->fops->open) {
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:58 2009
+Message-Id: <20091207000658.114369182@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:15 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jean Delvare <khali@linux-fr.org>,
+ Hans de Goede <hdegoede@redhat.com>,
+ Jordan Crouse <jordan@cosmicpenguin.net>
+Subject: [099/119] hwmon: (adt7475) Fix temperature fault flags
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=hwmon-adt7475-fix-temperature-fault-flags.patch
+Content-Length: 981
+Lines: 33
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jean Delvare <khali@linux-fr.org>
+
+commit cf312e077662ec3a07529551ab6e885828ccfb1d upstream.
+
+The logic of temperature fault flags is wrong, it shows faults when
+there are none and vice versa. Fix it.
+
+I can't believe this has been broken since the driver was added, 8
+months ago, basically breaking temp1 and temp3, and nobody ever
+complained.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Acked-by: Hans de Goede <hdegoede@redhat.com>
+Cc: Jordan Crouse <jordan@cosmicpenguin.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/adt7475.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/hwmon/adt7475.c
++++ b/drivers/hwmon/adt7475.c
+@@ -350,8 +350,7 @@ static ssize_t show_temp(struct device *
+
+ case FAULT:
+ /* Note - only for remote1 and remote2 */
+- out = data->alarms & (sattr->index ? 0x8000 : 0x4000);
+- out = out ? 0 : 1;
++ out = !!(data->alarms & (sattr->index ? 0x8000 : 0x4000));
+ break;
+
+ default:
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:58 2009
+Message-Id: <20091207000658.315298898@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:16 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jean Delvare <khali@linux-fr.org>,
+ Hans de Goede <hdegoede@redhat.com>,
+ Jordan Crouse <jordan@cosmicpenguin.net>
+Subject: [100/119] hwmon: (adt7475) Cache limits for 60 seconds
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=hwmon-adt7475-cache-limits-for-60-seconds.patch
+Content-Length: 946
+Lines: 29
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jean Delvare <khali@linux-fr.org>
+
+commit 56e35eeebed2dcb4e1a17ad119e039cf095854ac upstream.
+
+The comment says that limits are cached for 60 seconds but the code
+actually caches them for only 2 seconds. Align the code on the
+comment, as 60 seconds makes more sense.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Acked-by: Hans de Goede <hdegoede@redhat.com>
+Cc: Jordan Crouse <jordan@cosmicpenguin.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/adt7475.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/adt7475.c
++++ b/drivers/hwmon/adt7475.c
+@@ -1151,7 +1151,7 @@ static struct adt7475_data *adt7475_upda
+ }
+
+ /* Limits and settings, should never change update every 60 seconds */
+- if (time_after(jiffies, data->limits_updated + HZ * 2) ||
++ if (time_after(jiffies, data->limits_updated + HZ * 60) ||
+ !data->valid) {
+ data->config5 = adt7475_read(REG_CONFIG5);
+
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:58 2009
+Message-Id: <20091207000658.451137393@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:17 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Zhenyu Wang <zhenyuw@linux.intel.com>,
+ Eric Anholt <eric@anholt.net>
+Subject: [101/119] agp/intel: new host bridge support
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=agp-intel-new-host-bridge-support.patch
+Content-Length: 2222
+Lines: 62
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+
+commit 9cf1e35cb025eaa52dde37df38e2750b6adb1620 upstream.
+
+Add new CPU host bridge id, needed for support Ironlake graphics
+device with it. No change for graphics device itself, so no need to
+update drm/i915.
+
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/agp/intel-agp.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/char/agp/intel-agp.c
++++ b/drivers/char/agp/intel-agp.c
+@@ -52,6 +52,7 @@
+ #define PCI_DEVICE_ID_INTEL_IGDNG_D_IG 0x0042
+ #define PCI_DEVICE_ID_INTEL_IGDNG_M_HB 0x0044
+ #define PCI_DEVICE_ID_INTEL_IGDNG_MA_HB 0x0062
++#define PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB 0x006a
+ #define PCI_DEVICE_ID_INTEL_IGDNG_M_IG 0x0046
+
+ /* cover 915 and 945 variants */
+@@ -86,7 +87,8 @@
+ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_B43_HB || \
+ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_D_HB || \
+ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_M_HB || \
+- agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_MA_HB)
++ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_MA_HB || \
++ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB)
+
+ extern int agp_memory_reserved;
+
+@@ -1239,6 +1241,7 @@ static void intel_i965_get_gtt_range(int
+ case PCI_DEVICE_ID_INTEL_IGDNG_D_HB:
+ case PCI_DEVICE_ID_INTEL_IGDNG_M_HB:
+ case PCI_DEVICE_ID_INTEL_IGDNG_MA_HB:
++ case PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB:
+ *gtt_offset = *gtt_size = MB(2);
+ break;
+ default:
+@@ -2222,6 +2225,8 @@ static const struct intel_driver_descrip
+ "IGDNG/M", NULL, &intel_i965_driver },
+ { PCI_DEVICE_ID_INTEL_IGDNG_MA_HB, PCI_DEVICE_ID_INTEL_IGDNG_M_IG, 0,
+ "IGDNG/MA", NULL, &intel_i965_driver },
++ { PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB, PCI_DEVICE_ID_INTEL_IGDNG_M_IG, 0,
++ "IGDNG/MC2", NULL, &intel_i965_driver },
+ { 0, 0, 0, NULL, NULL, NULL }
+ };
+
+@@ -2418,6 +2423,7 @@ static struct pci_device_id agp_intel_pc
+ ID(PCI_DEVICE_ID_INTEL_IGDNG_D_HB),
+ ID(PCI_DEVICE_ID_INTEL_IGDNG_M_HB),
+ ID(PCI_DEVICE_ID_INTEL_IGDNG_MA_HB),
++ ID(PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB),
+ { }
+ };
+
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:58 2009
+Message-Id: <20091207000658.623685450@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:18 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>,
+ Patrick McHardy <kaber@trash.net>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [102/119] netfilter: nf_nat: fix NAT issue in 2.6.30.4+
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=netfilter-nf_nat-fix-nat-issue-in-2.6.30.4.patch
+Content-Length: 9810
+Lines: 273
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+
+commit f9dd09c7f7199685601d75882447a6598be8a3e0 upstream.
+
+Vitezslav Samel discovered that since 2.6.30.4+ active FTP can not work
+over NAT. The "cause" of the problem was a fix of unacknowledged data
+detection with NAT (commit a3a9f79e361e864f0e9d75ebe2a0cb43d17c4272).
+However, actually, that fix uncovered a long standing bug in TCP conntrack:
+when NAT was enabled, we simply updated the max of the right edge of
+the segments we have seen (td_end), by the offset NAT produced with
+changing IP/port in the data. However, we did not update the other parameter
+(td_maxend) which is affected by the NAT offset. Thus that could drift
+away from the correct value and thus resulted breaking active FTP.
+
+The patch below fixes the issue by *not* updating the conntrack parameters
+from NAT, but instead taking into account the NAT offsets in conntrack in a
+consistent way. (Updating from NAT would be more harder and expensive because
+it'd need to re-calculate parameters we already calculated in conntrack.)
+
+Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/net/netfilter/nf_conntrack.h | 8 +---
+ include/net/netfilter/nf_nat_helper.h | 4 ++
+ net/ipv4/netfilter/nf_nat_core.c | 3 +
+ net/ipv4/netfilter/nf_nat_helper.c | 34 +++++++++++------
+ net/netfilter/nf_conntrack_core.c | 8 ++++
+ net/netfilter/nf_conntrack_proto_tcp.c | 64 +++++++++++++--------------------
+ 6 files changed, 67 insertions(+), 54 deletions(-)
+
+--- a/include/net/netfilter/nf_conntrack.h
++++ b/include/net/netfilter/nf_conntrack.h
+@@ -255,11 +255,9 @@ static inline bool nf_ct_kill(struct nf_
+ }
+
+ /* These are for NAT. Icky. */
+-/* Update TCP window tracking data when NAT mangles the packet */
+-extern void nf_conntrack_tcp_update(const struct sk_buff *skb,
+- unsigned int dataoff,
+- struct nf_conn *ct, int dir,
+- s16 offset);
++extern s16 (*nf_ct_nat_offset)(const struct nf_conn *ct,
++ enum ip_conntrack_dir dir,
++ u32 seq);
+
+ /* Fake conntrack entry for untracked connections */
+ extern struct nf_conn nf_conntrack_untracked;
+--- a/include/net/netfilter/nf_nat_helper.h
++++ b/include/net/netfilter/nf_nat_helper.h
+@@ -32,4 +32,8 @@ extern int (*nf_nat_seq_adjust_hook)(str
+ * to port ct->master->saved_proto. */
+ extern void nf_nat_follow_master(struct nf_conn *ct,
+ struct nf_conntrack_expect *this);
++
++extern s16 nf_nat_get_offset(const struct nf_conn *ct,
++ enum ip_conntrack_dir dir,
++ u32 seq);
+ #endif
+--- a/net/ipv4/netfilter/nf_nat_core.c
++++ b/net/ipv4/netfilter/nf_nat_core.c
+@@ -750,6 +750,8 @@ static int __init nf_nat_init(void)
+ BUG_ON(nfnetlink_parse_nat_setup_hook != NULL);
+ rcu_assign_pointer(nfnetlink_parse_nat_setup_hook,
+ nfnetlink_parse_nat_setup);
++ BUG_ON(nf_ct_nat_offset != NULL);
++ rcu_assign_pointer(nf_ct_nat_offset, nf_nat_get_offset);
+ return 0;
+
+ cleanup_extend:
+@@ -764,6 +766,7 @@ static void __exit nf_nat_cleanup(void)
+ nf_ct_extend_unregister(&nat_extend);
+ rcu_assign_pointer(nf_nat_seq_adjust_hook, NULL);
+ rcu_assign_pointer(nfnetlink_parse_nat_setup_hook, NULL);
++ rcu_assign_pointer(nf_ct_nat_offset, NULL);
+ synchronize_net();
+ }
+
+--- a/net/ipv4/netfilter/nf_nat_helper.c
++++ b/net/ipv4/netfilter/nf_nat_helper.c
+@@ -73,6 +73,28 @@ adjust_tcp_sequence(u32 seq,
+ DUMP_OFFSET(this_way);
+ }
+
++/* Get the offset value, for conntrack */
++s16 nf_nat_get_offset(const struct nf_conn *ct,
++ enum ip_conntrack_dir dir,
++ u32 seq)
++{
++ struct nf_conn_nat *nat = nfct_nat(ct);
++ struct nf_nat_seq *this_way;
++ s16 offset;
++
++ if (!nat)
++ return 0;
++
++ this_way = &nat->seq[dir];
++ spin_lock_bh(&nf_nat_seqofs_lock);
++ offset = after(seq, this_way->correction_pos)
++ ? this_way->offset_after : this_way->offset_before;
++ spin_unlock_bh(&nf_nat_seqofs_lock);
++
++ return offset;
++}
++EXPORT_SYMBOL_GPL(nf_nat_get_offset);
++
+ /* Frobs data inside this packet, which is linear. */
+ static void mangle_contents(struct sk_buff *skb,
+ unsigned int dataoff,
+@@ -189,11 +211,6 @@ nf_nat_mangle_tcp_packet(struct sk_buff
+ adjust_tcp_sequence(ntohl(tcph->seq),
+ (int)rep_len - (int)match_len,
+ ct, ctinfo);
+- /* Tell TCP window tracking about seq change */
+- nf_conntrack_tcp_update(skb, ip_hdrlen(skb),
+- ct, CTINFO2DIR(ctinfo),
+- (int)rep_len - (int)match_len);
+-
+ nf_conntrack_event_cache(IPCT_NATSEQADJ, ct);
+ }
+ return 1;
+@@ -415,12 +432,7 @@ nf_nat_seq_adjust(struct sk_buff *skb,
+ tcph->seq = newseq;
+ tcph->ack_seq = newack;
+
+- if (!nf_nat_sack_adjust(skb, tcph, ct, ctinfo))
+- return 0;
+-
+- nf_conntrack_tcp_update(skb, ip_hdrlen(skb), ct, dir, seqoff);
+-
+- return 1;
++ return nf_nat_sack_adjust(skb, tcph, ct, ctinfo);
+ }
+
+ /* Setup NAT on this expected conntrack so it follows master. */
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -1350,6 +1350,11 @@ err_stat:
+ return ret;
+ }
+
++s16 (*nf_ct_nat_offset)(const struct nf_conn *ct,
++ enum ip_conntrack_dir dir,
++ u32 seq);
++EXPORT_SYMBOL_GPL(nf_ct_nat_offset);
++
+ int nf_conntrack_init(struct net *net)
+ {
+ int ret;
+@@ -1367,6 +1372,9 @@ int nf_conntrack_init(struct net *net)
+ /* For use by REJECT target */
+ rcu_assign_pointer(ip_ct_attach, nf_conntrack_attach);
+ rcu_assign_pointer(nf_ct_destroy, destroy_conntrack);
++
++ /* Howto get NAT offsets */
++ rcu_assign_pointer(nf_ct_nat_offset, NULL);
+ }
+ return 0;
+
+--- a/net/netfilter/nf_conntrack_proto_tcp.c
++++ b/net/netfilter/nf_conntrack_proto_tcp.c
+@@ -492,6 +492,21 @@ static void tcp_sack(const struct sk_buf
+ }
+ }
+
++#ifdef CONFIG_NF_NAT_NEEDED
++static inline s16 nat_offset(const struct nf_conn *ct,
++ enum ip_conntrack_dir dir,
++ u32 seq)
++{
++ typeof(nf_ct_nat_offset) get_offset = rcu_dereference(nf_ct_nat_offset);
++
++ return get_offset != NULL ? get_offset(ct, dir, seq) : 0;
++}
++#define NAT_OFFSET(pf, ct, dir, seq) \
++ (pf == NFPROTO_IPV4 ? nat_offset(ct, dir, seq) : 0)
++#else
++#define NAT_OFFSET(pf, ct, dir, seq) 0
++#endif
++
+ static bool tcp_in_window(const struct nf_conn *ct,
+ struct ip_ct_tcp *state,
+ enum ip_conntrack_dir dir,
+@@ -506,6 +521,7 @@ static bool tcp_in_window(const struct n
+ struct ip_ct_tcp_state *receiver = &state->seen[!dir];
+ const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
+ __u32 seq, ack, sack, end, win, swin;
++ s16 receiver_offset;
+ bool res;
+
+ /*
+@@ -519,11 +535,16 @@ static bool tcp_in_window(const struct n
+ if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)
+ tcp_sack(skb, dataoff, tcph, &sack);
+
++ /* Take into account NAT sequence number mangling */
++ receiver_offset = NAT_OFFSET(pf, ct, !dir, ack - 1);
++ ack -= receiver_offset;
++ sack -= receiver_offset;
++
+ pr_debug("tcp_in_window: START\n");
+ pr_debug("tcp_in_window: ");
+ nf_ct_dump_tuple(tuple);
+- pr_debug("seq=%u ack=%u sack=%u win=%u end=%u\n",
+- seq, ack, sack, win, end);
++ pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n",
++ seq, ack, receiver_offset, sack, receiver_offset, win, end);
+ pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
+ "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
+ sender->td_end, sender->td_maxend, sender->td_maxwin,
+@@ -613,8 +634,8 @@ static bool tcp_in_window(const struct n
+
+ pr_debug("tcp_in_window: ");
+ nf_ct_dump_tuple(tuple);
+- pr_debug("seq=%u ack=%u sack =%u win=%u end=%u\n",
+- seq, ack, sack, win, end);
++ pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n",
++ seq, ack, receiver_offset, sack, receiver_offset, win, end);
+ pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
+ "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
+ sender->td_end, sender->td_maxend, sender->td_maxwin,
+@@ -700,7 +721,7 @@ static bool tcp_in_window(const struct n
+ before(seq, sender->td_maxend + 1) ?
+ after(end, sender->td_end - receiver->td_maxwin - 1) ?
+ before(sack, receiver->td_end + 1) ?
+- after(ack, receiver->td_end - MAXACKWINDOW(sender)) ? "BUG"
++ after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1) ? "BUG"
+ : "ACK is under the lower bound (possible overly delayed ACK)"
+ : "ACK is over the upper bound (ACKed data not seen yet)"
+ : "SEQ is under the lower bound (already ACKed data retransmitted)"
+@@ -715,39 +736,6 @@ static bool tcp_in_window(const struct n
+ return res;
+ }
+
+-#ifdef CONFIG_NF_NAT_NEEDED
+-/* Update sender->td_end after NAT successfully mangled the packet */
+-/* Caller must linearize skb at tcp header. */
+-void nf_conntrack_tcp_update(const struct sk_buff *skb,
+- unsigned int dataoff,
+- struct nf_conn *ct, int dir,
+- s16 offset)
+-{
+- const struct tcphdr *tcph = (const void *)skb->data + dataoff;
+- const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[dir];
+- const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[!dir];
+- __u32 end;
+-
+- end = segment_seq_plus_len(ntohl(tcph->seq), skb->len, dataoff, tcph);
+-
+- spin_lock_bh(&ct->lock);
+- /*
+- * We have to worry for the ack in the reply packet only...
+- */
+- if (ct->proto.tcp.seen[dir].td_end + offset == end)
+- ct->proto.tcp.seen[dir].td_end = end;
+- ct->proto.tcp.last_end = end;
+- spin_unlock_bh(&ct->lock);
+- pr_debug("tcp_update: sender end=%u maxend=%u maxwin=%u scale=%i "
+- "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
+- sender->td_end, sender->td_maxend, sender->td_maxwin,
+- sender->td_scale,
+- receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
+- receiver->td_scale);
+-}
+-EXPORT_SYMBOL_GPL(nf_conntrack_tcp_update);
+-#endif
+-
+ #define TH_FIN 0x01
+ #define TH_SYN 0x02
+ #define TH_RST 0x04
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:58 2009
+Message-Id: <20091207000658.781274324@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:19 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jan Engelhardt <jengelh@medozas.de>,
+ Patrick McHardy <kaber@trash.net>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [103/119] netfilter: xt_connlimit: fix regression caused by zero family value
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=netfilter-xt_connlimit-fix-regression-caused-by-zero-family-value.patch
+Content-Length: 1946
+Lines: 58
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jan Engelhardt <jengelh@medozas.de>
+
+commit 539054a8fa5141c9a4e9ac6a86d249e3f2bdef45 upstream.
+
+Commit v2.6.28-rc1~717^2~109^2~2 was slightly incomplete; not all
+instances of par->match->family were changed to par->family.
+
+References: http://bugzilla.netfilter.org/show_bug.cgi?id=610
+Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/netfilter/xt_connlimit.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+--- a/net/netfilter/xt_connlimit.c
++++ b/net/netfilter/xt_connlimit.c
+@@ -103,7 +103,7 @@ static int count_them(struct xt_connlimi
+ const struct nf_conntrack_tuple *tuple,
+ const union nf_inet_addr *addr,
+ const union nf_inet_addr *mask,
+- const struct xt_match *match)
++ u_int8_t family)
+ {
+ const struct nf_conntrack_tuple_hash *found;
+ struct xt_connlimit_conn *conn;
+@@ -113,8 +113,7 @@ static int count_them(struct xt_connlimi
+ bool addit = true;
+ int matches = 0;
+
+-
+- if (match->family == NFPROTO_IPV6)
++ if (family == NFPROTO_IPV6)
+ hash = &data->iphash[connlimit_iphash6(addr, mask)];
+ else
+ hash = &data->iphash[connlimit_iphash(addr->ip & mask->ip)];
+@@ -157,8 +156,7 @@ static int count_them(struct xt_connlimi
+ continue;
+ }
+
+- if (same_source_net(addr, mask, &conn->tuple.src.u3,
+- match->family))
++ if (same_source_net(addr, mask, &conn->tuple.src.u3, family))
+ /* same source network -> be counted! */
+ ++matches;
+ nf_ct_put(found_ct);
+@@ -207,7 +205,7 @@ connlimit_mt(const struct sk_buff *skb,
+
+ spin_lock_bh(&info->data->lock);
+ connections = count_them(info->data, tuple_ptr, &addr,
+- &info->mask, par->match);
++ &info->mask, par->family);
+ spin_unlock_bh(&info->data->lock);
+
+ if (connections < 0) {
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:59 2009
+Message-Id: <20091207000658.952588555@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:20 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Michael Buesch <mb@bu3sch.de>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [104/119] b43: Fix DMA TX bounce buffer copying
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=b43-fix-dma-tx-bounce-buffer-copying.patch
+Content-Length: 2532
+Lines: 68
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Michael Buesch <mb@bu3sch.de>
+
+commit 9a3f45116f5e08819136cd512fd7f6450ac22aa8 upstream.
+
+b43 allocates a bouncebuffer, if the supplied TX skb is in an invalid
+memory range for DMA.
+However, this is broken in that it fails to copy over some metadata to the
+new skb.
+
+This patch fixes three problems:
+* Failure to adjust the ieee80211_tx_info pointer to the new buffer.
+ This results in a kmemcheck warning.
+* Failure to copy the skb cb, which contains ieee80211_tx_info, to the new skb.
+ This results in breakage of various TX-status postprocessing (Rate control).
+* Failure to transfer the queue mapping.
+ This results in the wrong queue being stopped on saturation and can result in queue overflow.
+
+Signed-off-by: Michael Buesch <mb@bu3sch.de>
+Tested-by: Christian Casteyde <casteyde.christian@free.fr>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/b43/dma.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/b43/dma.c
++++ b/drivers/net/wireless/b43/dma.c
+@@ -1158,8 +1158,9 @@ struct b43_dmaring *parse_cookie(struct
+ }
+
+ static int dma_tx_fragment(struct b43_dmaring *ring,
+- struct sk_buff *skb)
++ struct sk_buff **in_skb)
+ {
++ struct sk_buff *skb = *in_skb;
+ const struct b43_dma_ops *ops = ring->ops;
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ u8 *header;
+@@ -1225,8 +1226,14 @@ static int dma_tx_fragment(struct b43_dm
+ }
+
+ memcpy(skb_put(bounce_skb, skb->len), skb->data, skb->len);
++ memcpy(bounce_skb->cb, skb->cb, sizeof(skb->cb));
++ bounce_skb->dev = skb->dev;
++ skb_set_queue_mapping(bounce_skb, skb_get_queue_mapping(skb));
++ info = IEEE80211_SKB_CB(bounce_skb);
++
+ dev_kfree_skb_any(skb);
+ skb = bounce_skb;
++ *in_skb = bounce_skb;
+ meta->skb = skb;
+ meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1);
+ if (b43_dma_mapping_error(ring, meta->dmaaddr, skb->len, 1)) {
+@@ -1359,7 +1366,11 @@ int b43_dma_tx(struct b43_wldev *dev, st
+ * static, so we don't need to store it per frame. */
+ ring->queue_prio = skb_get_queue_mapping(skb);
+
+- err = dma_tx_fragment(ring, skb);
++ /* dma_tx_fragment might reallocate the skb, so invalidate pointers pointing
++ * into the skb data or cb now. */
++ hdr = NULL;
++ info = NULL;
++ err = dma_tx_fragment(ring, &skb);
+ if (unlikely(err == -ENOKEY)) {
+ /* Drop this packet, as we don't have the encryption key
+ * anymore and must not transmit it unencrypted. */
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:59 2009
+Message-Id: <20091207000659.115840319@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:21 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Herbert Xu <herbert@gondor.apana.org.au>
+Subject: [105/119] crypto: padlock-aes - Use the correct mask when checking whether copying is required
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=crypto-padlock-aes-use-the-correct-mask-when-checking-whether-copying-is-required.patch
+Content-Length: 1352
+Lines: 35
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Chuck Ebbert <cebbert@redhat.com>
+
+commit e8edb3cbd7dd8acf6c748a02d06ec1d82c4124ea upstream.
+
+Masking with PAGE_SIZE is just wrong...
+
+Signed-off-by: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/crypto/padlock-aes.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/crypto/padlock-aes.c
++++ b/drivers/crypto/padlock-aes.c
+@@ -236,7 +236,7 @@ static inline void ecb_crypt(const u8 *i
+ /* Padlock in ECB mode fetches at least ecb_fetch_bytes of data.
+ * We could avoid some copying here but it's probably not worth it.
+ */
+- if (unlikely(((unsigned long)in & PAGE_SIZE) + ecb_fetch_bytes > PAGE_SIZE)) {
++ if (unlikely(((unsigned long)in & ~PAGE_MASK) + ecb_fetch_bytes > PAGE_SIZE)) {
+ ecb_crypt_copy(in, out, key, cword, count);
+ return;
+ }
+@@ -248,7 +248,7 @@ static inline u8 *cbc_crypt(const u8 *in
+ u8 *iv, struct cword *cword, int count)
+ {
+ /* Padlock in CBC mode fetches at least cbc_fetch_bytes of data. */
+- if (unlikely(((unsigned long)in & PAGE_SIZE) + cbc_fetch_bytes > PAGE_SIZE))
++ if (unlikely(((unsigned long)in & ~PAGE_MASK) + cbc_fetch_bytes > PAGE_SIZE))
+ return cbc_crypt_copy(in, out, key, iv, cword, count);
+
+ return rep_xcrypt_cbc(in, out, key, iv, cword, count);
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:59 2009
+Message-Id: <20091207000659.288315232@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:22 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Brandon Philips <bphilips@suse.de>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [106/119] sky2: set carrier off in probe
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=sky2-set-carrier-off-in-probe.patch
+Content-Length: 734
+Lines: 28
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Brandon Philips <bphilips@suse.de>
+
+commit 33cb7d33a1c36e07839d08a4d1a33bf6a0f70bba upstream.
+
+Before bringing up a sky2 interface up ethtool reports
+"Link detected: yes". Do as ixgbe does and netif_carrier_off() on
+probe().
+
+Signed-off-by: Brandon Philips <bphilips@suse.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/sky2.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/sky2.c
++++ b/drivers/net/sky2.c
+@@ -4528,6 +4528,8 @@ static int __devinit sky2_probe(struct p
+ goto err_out_free_netdev;
+ }
+
++ netif_carrier_off(dev);
++
+ netif_napi_add(dev, &hw->napi, sky2_poll, NAPI_WEIGHT);
+
+ err = request_irq(pdev->irq, sky2_intr,
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:59 2009
+Message-Id: <20091207000659.497334186@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:23 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Nick Kossifidis <mickflemm@gmail.com>,
+ Bob Copeland <me@bobcopeland.com>,
+ "John W. Linville" <linville@tuxdriver.com>,
+ Dan Williams <dcbw@redhat.com>
+Subject: [107/119] ath5k: Linear PCDAC code fixes
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=ath5k-linear-pcdac-code-fixes.patch
+Content-Length: 2143
+Lines: 65
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Nick Kossifidis <mick@madwifi-project.org>
+
+commit d1cb0bdac180a4afdd3c001acb2618d2a62d9abe upstream.
+
+* Set correct xpd curve indices for high/low gain curves during
+ rfbuffer setup on RF5112B with both calibration curves available.
+
+ * Don't return zero min power when we have the same pcdac value
+ twice because it breaks interpolation. Instead return the right
+ x barrier as we do when we have equal power levels for 2 different
+ pcdac values.
+
+Signed-off-by: Nick Kossifidis <mickflemm@gmail.com>
+Acked-by: Bob Copeland <me@bobcopeland.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Cc: Dan Williams <dcbw@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath5k/phy.c | 24 +++++++++++++++++-------
+ 1 file changed, 17 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath5k/phy.c
++++ b/drivers/net/wireless/ath/ath5k/phy.c
+@@ -740,13 +740,22 @@ int ath5k_hw_rfregs_init(struct ath5k_hw
+ AR5K_RF_XPD_GAIN, true);
+
+ } else {
+- /* TODO: Set high and low gain bits */
+- ath5k_hw_rfb_op(ah, rf_regs,
+- ee->ee_x_gain[ee_mode],
++ u8 *pdg_curve_to_idx = ee->ee_pdc_to_idx[ee_mode];
++ if (ee->ee_pd_gains[ee_mode] > 1) {
++ ath5k_hw_rfb_op(ah, rf_regs,
++ pdg_curve_to_idx[0],
+ AR5K_RF_PD_GAIN_LO, true);
+- ath5k_hw_rfb_op(ah, rf_regs,
+- ee->ee_x_gain[ee_mode],
++ ath5k_hw_rfb_op(ah, rf_regs,
++ pdg_curve_to_idx[1],
+ AR5K_RF_PD_GAIN_HI, true);
++ } else {
++ ath5k_hw_rfb_op(ah, rf_regs,
++ pdg_curve_to_idx[0],
++ AR5K_RF_PD_GAIN_LO, true);
++ ath5k_hw_rfb_op(ah, rf_regs,
++ pdg_curve_to_idx[0],
++ AR5K_RF_PD_GAIN_HI, true);
++ }
+
+ /* Lower synth voltage on Rev 2 */
+ ath5k_hw_rfb_op(ah, rf_regs, 2,
+@@ -1897,8 +1906,9 @@ ath5k_get_linear_pcdac_min(const u8 *ste
+ s16 min_pwrL, min_pwrR;
+ s16 pwr_i;
+
+- if (WARN_ON(stepL[0] == stepL[1] || stepR[0] == stepR[1]))
+- return 0;
++ /* Some vendors write the same pcdac value twice !!! */
++ if (stepL[0] == stepL[1] || stepR[0] == stepR[1])
++ return max(pwrL[0], pwrR[0]);
+
+ if (pwrL[0] == pwrL[1])
+ min_pwrL = pwrL[0];
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:59 2009
+Message-Id: <20091207000659.654409257@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:24 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jean Delvare <khali@linux-fr.org>
+Subject: [108/119] i2c: Fix userspace_device list corruption
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=i2c-fix-userspace_device-list-corruption.patch
+Content-Length: 2682
+Lines: 74
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jean Delvare <khali@linux-fr.org>
+
+commit bbd2d9c9198c6efd449e9d395b3eaf2d03aa3bba upstream.
+
+Fix userspace_device list corruption. The corruption was caused by
+clients not being removed when adapters with such clients were
+themselves removed. Something like the following would trigger it
+(assuming i2c-stub gets adapter number 3):
+
+# modprobe i2c-stub chip_addr=0x50
+# echo 24c08 0x50 > /sys/bus/i2c/devices/i2c-3/new_device
+# rmmod i2c-stub
+# modprobe i2c-stub chip_addr=0x50
+# echo 24c08 0x50 > /sys/bus/i2c/devices/i2c-3/new_device
+
+For the records, the stack trace in the kernel logs look like this:
+
+kernel: WARNING: at lib/list_debug.c:30 __list_add+0x8b/0x90()
+kernel: Hardware name: (...)
+kernel: list_add corruption. prev->next should be next (c137fc84), but was (null). (prev=f57111b8).
+kernel: Modules linked in: (...)
+kernel: Pid: 4669, comm: bash Not tainted 2.6.32-rc8 #259
+kernel: Call Trace:
+kernel: [<c111eb8b>] ? __list_add+0x8b/0x90
+kernel: [<c111eb8b>] ? __list_add+0x8b/0x90
+kernel: [<c103265c>] warn_slowpath_common+0x6c/0xc0
+kernel: [<c111eb8b>] ? __list_add+0x8b/0x90
+kernel: [<c10326f6>] warn_slowpath_fmt+0x26/0x30
+kernel: [<c111eb8b>] __list_add+0x8b/0x90
+kernel: [<c11ba165>] i2c_sysfs_new_device+0x1c5/0x250
+kernel: [<c10861be>] ? might_fault+0x2e/0x80
+kernel: [<c11b9fa0>] ? i2c_sysfs_new_device+0x0/0x250
+kernel: [<c118c625>] dev_attr_store+0x25/0x30
+kernel: [<c10e305c>] sysfs_write_file+0x9c/0xf0
+kernel: [<c109d35c>] vfs_write+0x9c/0x160
+kernel: [<c10e2fc0>] ? sysfs_write_file+0x0/0xf0
+kernel: [<c109d4dd>] sys_write+0x3d/0x70
+kernel: [<c1002ed8>] sysenter_do_call+0x12/0x36
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/i2c/i2c-core.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/i2c/i2c-core.c
++++ b/drivers/i2c/i2c-core.c
+@@ -718,6 +718,7 @@ int i2c_del_adapter(struct i2c_adapter *
+ {
+ int res = 0;
+ struct i2c_adapter *found;
++ struct i2c_client *client, *next;
+
+ /* First make sure that this adapter was ever added */
+ mutex_lock(&core_lock);
+@@ -737,6 +738,16 @@ int i2c_del_adapter(struct i2c_adapter *
+ if (res)
+ return res;
+
++ /* Remove devices instantiated from sysfs */
++ list_for_each_entry_safe(client, next, &userspace_devices, detected) {
++ if (client->adapter == adap) {
++ dev_dbg(&adap->dev, "Removing %s at 0x%x\n",
++ client->name, client->addr);
++ list_del(&client->detected);
++ i2c_unregister_device(client);
++ }
++ }
++
+ /* Detach any active clients. This can't fail, thus we do not
+ checking the returned value. */
+ res = device_for_each_child(&adap->dev, NULL, __unregister_client);
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:59 2009
+Message-Id: <20091207000659.782998635@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:25 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Peter Feuerer <peter@piie.net>,
+ Andreas Mohr <andi@lisas.de>,
+ Borislav Petkov <petkovbb@gmail.com>,
+ Len Brown <len.brown@intel.com>,
+ Adrian von Bidder <avbidder@fortytwo.ch>
+Subject: [109/119] acerhdf: fix fan control for AOA150 model
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=acerhdf-fix-fan-control-for-aoa150-model.patch
+Content-Length: 7471
+Lines: 235
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Peter Feuerer <peter@piie.net>
+
+commit ded0cdfc6a7673916b0878c32fa8ba566b4f8cdb upstream.
+
+- Apply Borislav Petkov's patch (convert the fancmd[] array to a real
+ struct thus disambiguating command handling and making code more
+ readable.)
+
+- Add BIOS product to BIOS table as AOA110 and AOA150 have different
+ register values
+
+- Add force_product parameter to allow forcing different product
+
+- fix linker warning caused by "acerhdf_drv" not being named
+ "acerhdf_driver"
+
+Signed-off-by: Peter Feuerer <peter@piie.net>
+Cc: Andreas Mohr <andi@lisas.de>
+Acked-by: Borislav Petkov <petkovbb@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Cc: Adrian von Bidder <avbidder@fortytwo.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/acerhdf.c | 97 +++++++++++++++++++++++++++--------------
+ 1 file changed, 66 insertions(+), 31 deletions(-)
+
+--- a/drivers/platform/x86/acerhdf.c
++++ b/drivers/platform/x86/acerhdf.c
+@@ -52,7 +52,7 @@
+ */
+ #undef START_IN_KERNEL_MODE
+
+-#define DRV_VER "0.5.13"
++#define DRV_VER "0.5.16"
+
+ /*
+ * According to the Atom N270 datasheet,
+@@ -90,6 +90,7 @@ static unsigned int fanoff = 58;
+ static unsigned int verbose;
+ static unsigned int fanstate = ACERHDF_FAN_AUTO;
+ static char force_bios[16];
++static char force_product[16];
+ static unsigned int prev_interval;
+ struct thermal_zone_device *thz_dev;
+ struct thermal_cooling_device *cl_dev;
+@@ -107,34 +108,58 @@ module_param(verbose, uint, 0600);
+ MODULE_PARM_DESC(verbose, "Enable verbose dmesg output");
+ module_param_string(force_bios, force_bios, 16, 0);
+ MODULE_PARM_DESC(force_bios, "Force BIOS version and omit BIOS check");
++module_param_string(force_product, force_product, 16, 0);
++MODULE_PARM_DESC(force_product, "Force BIOS product and omit BIOS check");
++
++/*
++ * cmd_off: to switch the fan completely off / to check if the fan is off
++ * cmd_auto: to set the BIOS in control of the fan. The BIOS regulates then
++ * the fan speed depending on the temperature
++ */
++struct fancmd {
++ u8 cmd_off;
++ u8 cmd_auto;
++};
+
+ /* BIOS settings */
+ struct bios_settings_t {
+ const char *vendor;
++ const char *product;
+ const char *version;
+ unsigned char fanreg;
+ unsigned char tempreg;
+- unsigned char fancmd[2]; /* fan off and auto commands */
++ struct fancmd cmd;
+ };
+
+ /* Register addresses and values for different BIOS versions */
+ static const struct bios_settings_t bios_tbl[] = {
+- {"Acer", "v0.3109", 0x55, 0x58, {0x1f, 0x00} },
+- {"Acer", "v0.3114", 0x55, 0x58, {0x1f, 0x00} },
+- {"Acer", "v0.3301", 0x55, 0x58, {0xaf, 0x00} },
+- {"Acer", "v0.3304", 0x55, 0x58, {0xaf, 0x00} },
+- {"Acer", "v0.3305", 0x55, 0x58, {0xaf, 0x00} },
+- {"Acer", "v0.3308", 0x55, 0x58, {0x21, 0x00} },
+- {"Acer", "v0.3309", 0x55, 0x58, {0x21, 0x00} },
+- {"Acer", "v0.3310", 0x55, 0x58, {0x21, 0x00} },
+- {"Gateway", "v0.3103", 0x55, 0x58, {0x21, 0x00} },
+- {"Packard Bell", "v0.3105", 0x55, 0x58, {0x21, 0x00} },
+- {"", "", 0, 0, {0, 0} }
++ /* AOA110 */
++ {"Acer", "AOA110", "v0.3109", 0x55, 0x58, {0x1f, 0x00} },
++ {"Acer", "AOA110", "v0.3114", 0x55, 0x58, {0x1f, 0x00} },
++ {"Acer", "AOA110", "v0.3301", 0x55, 0x58, {0xaf, 0x00} },
++ {"Acer", "AOA110", "v0.3304", 0x55, 0x58, {0xaf, 0x00} },
++ {"Acer", "AOA110", "v0.3305", 0x55, 0x58, {0xaf, 0x00} },
++ {"Acer", "AOA110", "v0.3308", 0x55, 0x58, {0x21, 0x00} },
++ {"Acer", "AOA110", "v0.3309", 0x55, 0x58, {0x21, 0x00} },
++ {"Acer", "AOA110", "v0.3310", 0x55, 0x58, {0x21, 0x00} },
++ /* AOA150 */
++ {"Acer", "AOA150", "v0.3114", 0x55, 0x58, {0x20, 0x00} },
++ {"Acer", "AOA150", "v0.3304", 0x55, 0x58, {0x20, 0x00} },
++ {"Acer", "AOA150", "v0.3305", 0x55, 0x58, {0x20, 0x00} },
++ {"Acer", "AOA150", "v0.3308", 0x55, 0x58, {0x20, 0x00} },
++ {"Acer", "AOA150", "v0.3309", 0x55, 0x58, {0x20, 0x00} },
++ {"Acer", "AOA150", "v0.3310", 0x55, 0x58, {0x20, 0x00} },
++ /* special BIOS / other */
++ {"Gateway", "AOA110", "v0.3103", 0x55, 0x58, {0x21, 0x00} },
++ {"Gateway", "AOA150", "v0.3103", 0x55, 0x58, {0x20, 0x00} },
++ {"Packard Bell", "DOA150", "v0.3104", 0x55, 0x58, {0x21, 0x00} },
++ {"Packard Bell", "AOA110", "v0.3105", 0x55, 0x58, {0x21, 0x00} },
++ /* pewpew-terminator */
++ {"", "", "", 0, 0, {0, 0} }
+ };
+
+ static const struct bios_settings_t *bios_cfg __read_mostly;
+
+-
+ static int acerhdf_get_temp(int *temp)
+ {
+ u8 read_temp;
+@@ -150,13 +175,14 @@ static int acerhdf_get_temp(int *temp)
+ static int acerhdf_get_fanstate(int *state)
+ {
+ u8 fan;
+- bool tmp;
+
+ if (ec_read(bios_cfg->fanreg, &fan))
+ return -EINVAL;
+
+- tmp = (fan == bios_cfg->fancmd[ACERHDF_FAN_OFF]);
+- *state = tmp ? ACERHDF_FAN_OFF : ACERHDF_FAN_AUTO;
++ if (fan != bios_cfg->cmd.cmd_off)
++ *state = ACERHDF_FAN_AUTO;
++ else
++ *state = ACERHDF_FAN_OFF;
+
+ return 0;
+ }
+@@ -175,7 +201,8 @@ static void acerhdf_change_fanstate(int
+ state = ACERHDF_FAN_AUTO;
+ }
+
+- cmd = bios_cfg->fancmd[state];
++ cmd = (state == ACERHDF_FAN_OFF) ? bios_cfg->cmd.cmd_off
++ : bios_cfg->cmd.cmd_auto;
+ fanstate = state;
+
+ ec_write(bios_cfg->fanreg, cmd);
+@@ -437,7 +464,7 @@ static int acerhdf_remove(struct platfor
+ return 0;
+ }
+
+-struct platform_driver acerhdf_drv = {
++static struct platform_driver acerhdf_driver = {
+ .driver = {
+ .name = "acerhdf",
+ .owner = THIS_MODULE,
+@@ -454,32 +481,40 @@ static int acerhdf_check_hardware(void)
+ {
+ char const *vendor, *version, *product;
+ int i;
++ unsigned long prod_len = 0;
+
+ /* get BIOS data */
+ vendor = dmi_get_system_info(DMI_SYS_VENDOR);
+ version = dmi_get_system_info(DMI_BIOS_VERSION);
+ product = dmi_get_system_info(DMI_PRODUCT_NAME);
+
++
+ pr_info("Acer Aspire One Fan driver, v.%s\n", DRV_VER);
+
+- if (!force_bios[0]) {
+- if (strncmp(product, "AO", 2)) {
+- pr_err("no Aspire One hardware found\n");
+- return -EINVAL;
+- }
+- } else {
+- pr_info("forcing BIOS version: %s\n", version);
++ if (force_bios[0]) {
+ version = force_bios;
++ pr_info("forcing BIOS version: %s\n", version);
+ kernelmode = 0;
+ }
+
++ if (force_product[0]) {
++ product = force_product;
++ pr_info("forcing BIOS product: %s\n", product);
++ kernelmode = 0;
++ }
++
++ prod_len = strlen(product);
++
+ if (verbose)
+ pr_info("BIOS info: %s %s, product: %s\n",
+ vendor, version, product);
+
+ /* search BIOS version and vendor in BIOS settings table */
+ for (i = 0; bios_tbl[i].version[0]; i++) {
+- if (!strcmp(bios_tbl[i].vendor, vendor) &&
++ if (strlen(bios_tbl[i].product) >= prod_len &&
++ !strncmp(bios_tbl[i].product, product,
++ strlen(bios_tbl[i].product)) &&
++ !strcmp(bios_tbl[i].vendor, vendor) &&
+ !strcmp(bios_tbl[i].version, version)) {
+ bios_cfg = &bios_tbl[i];
+ break;
+@@ -487,8 +522,8 @@ static int acerhdf_check_hardware(void)
+ }
+
+ if (!bios_cfg) {
+- pr_err("unknown (unsupported) BIOS version %s/%s, "
+- "please report, aborting!\n", vendor, version);
++ pr_err("unknown (unsupported) BIOS version %s/%s/%s, "
++ "please report, aborting!\n", vendor, product, version);
+ return -EINVAL;
+ }
+
+@@ -509,7 +544,7 @@ static int acerhdf_register_platform(voi
+ {
+ int err = 0;
+
+- err = platform_driver_register(&acerhdf_drv);
++ err = platform_driver_register(&acerhdf_driver);
+ if (err)
+ return err;
+
+@@ -525,7 +560,7 @@ static void acerhdf_unregister_platform(
+ return;
+
+ platform_device_del(acerhdf_dev);
+- platform_driver_unregister(&acerhdf_drv);
++ platform_driver_unregister(&acerhdf_driver);
+ }
+
+ static int acerhdf_register_thermal(void)
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:07:00 2009
+Message-Id: <20091207000659.932750419@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:26 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Greg KH <greg@kroah.com>
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dave Airlie <airlied@redhat.com>,
+ Paulius Zaleckas <paulius.zaleckas@gmail.com>,
+ Clemens Ladisch <clemens@ladisch.de>
+Subject: [110/119] drm/fb: fix FBIOGET/PUT_VSCREENINFO pixel clock handling
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=drm-fb-fix-fbioget-put_vscreeninfo-pixel-clock-handling.patch
+Content-Length: 2652
+Lines: 92
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit 5349ef3127c77075ff70b2014f17ae0fbcaaf199 upstream
+
+When the framebuffer driver does not publish detailed timing information
+for the current video mode, the correct value for the pixclock field is
+zero, not -1.
+
+Since pixclock is actually unsigned, the value -1 would be interpreted
+as 4294967295 picoseconds (i.e., about 4 milliseconds) by
+register_framebuffer() and userspace programs.
+
+This patch allows X.org's fbdev driver to work.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Tested-by: Paulius Zaleckas <paulius.zaleckas@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_fb.c | 8 ++++----
+ drivers/gpu/drm/radeon/radeon_fb.c | 6 +++---
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_fb.c
++++ b/drivers/gpu/drm/i915/intel_fb.c
+@@ -114,7 +114,7 @@ static int intelfb_check_var(struct fb_v
+ struct drm_framebuffer *fb = &intel_fb->base;
+ int depth;
+
+- if (var->pixclock == -1 || !var->pixclock)
++ if (var->pixclock != 0)
+ return -EINVAL;
+
+ /* Need to resize the fb object !!! */
+@@ -205,7 +205,7 @@ static int intelfb_set_par(struct fb_inf
+
+ DRM_DEBUG("%d %d\n", var->xres, var->pixclock);
+
+- if (var->pixclock != -1) {
++ if (var->pixclock != 0) {
+
+ DRM_ERROR("PIXEL CLOCK SET\n");
+ return -EINVAL;
+@@ -692,7 +692,7 @@ static int intelfb_multi_fb_probe_crtc(s
+ par->crtc_count = 1;
+
+ if (new_fb) {
+- info->var.pixclock = -1;
++ info->var.pixclock = 0;
+ if (register_framebuffer(info) < 0)
+ return -EINVAL;
+ } else
+@@ -846,7 +846,7 @@ static int intelfb_single_fb_probe(struc
+ par->crtc_count = crtc_count;
+
+ if (new_fb) {
+- info->var.pixclock = -1;
++ info->var.pixclock = 0;
+ if (register_framebuffer(info) < 0)
+ return -EINVAL;
+ } else
+--- a/drivers/gpu/drm/radeon/radeon_fb.c
++++ b/drivers/gpu/drm/radeon/radeon_fb.c
+@@ -120,7 +120,7 @@ static int radeonfb_check_var(struct fb_
+ struct drm_framebuffer *fb = &rfb->base;
+ int depth;
+
+- if (var->pixclock == -1 || !var->pixclock) {
++ if (var->pixclock != 0) {
+ return -EINVAL;
+ }
+ /* Need to resize the fb object !!! */
+@@ -234,7 +234,7 @@ static int radeonfb_set_par(struct fb_in
+ int ret;
+ int i;
+
+- if (var->pixclock != -1) {
++ if (var->pixclock != 0) {
+ DRM_ERROR("PIXEL CLCOK SET\n");
+ return -EINVAL;
+ }
+@@ -828,7 +828,7 @@ static int radeonfb_single_fb_probe(stru
+ rfbdev->crtc_count = crtc_count;
+
+ if (new_fb) {
+- info->var.pixclock = -1;
++ info->var.pixclock = 0;
+ if (register_framebuffer(info) < 0)
+ return -EINVAL;
+ } else {
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:07:00 2009
+Message-Id: <20091207000700.065141484@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:27 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Michal Simek <monstr@monstr.eu>,
+ Arnd Bergmann <arnd@arndb.de>
+Subject: [111/119] tty/of_serial: add missing ns16550a id
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=tty-of_serial-add-missing-ns16550a-id.patch
+Content-Length: 1298
+Lines: 29
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Michal Simek <monstr@monstr.eu>
+
+commit 16173c7c2d79da7eb89b41acfdebd74b130f4339 upstream.
+
+Many boards have a bug-free ns16550 compatible serial port, which we should
+register as PORT_16550A. This introduces a new value "ns16550a" for the
+compatible property of of_serial to let a firmware choose that model instead
+of using the crippled PORT_16550 mode.
+
+Reported-by: Alon Ziv <alonz@nolaviz.org>
+Signed-off-by: Michal Simek <monstr@monstr.eu>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/serial/of_serial.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/serial/of_serial.c
++++ b/drivers/serial/of_serial.c
+@@ -161,6 +161,7 @@ static int of_platform_serial_remove(str
+ static struct of_device_id __devinitdata of_platform_serial_table[] = {
+ { .type = "serial", .compatible = "ns8250", .data = (void *)PORT_8250, },
+ { .type = "serial", .compatible = "ns16450", .data = (void *)PORT_16450, },
++ { .type = "serial", .compatible = "ns16550a", .data = (void *)PORT_16550A, },
+ { .type = "serial", .compatible = "ns16550", .data = (void *)PORT_16550, },
+ { .type = "serial", .compatible = "ns16750", .data = (void *)PORT_16750, },
+ { .type = "serial", .compatible = "ns16850", .data = (void *)PORT_16850, },
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:07:00 2009
+Message-Id: <20091207000700.226177942@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:28 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ =?ISO-8859-15?q?Erik=20Andr=C3=A9n?= <erik.andren@gmail.com>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>
+Subject: [112/119] V4L/DVB (13255): gspca - m5602-s5k4aa: Add vflip quirk for the Bruneinit laptop
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=v4l-dvb-13255-gspca-m5602-s5k4aa-add-vflip-quirk-for-the-bruneinit-laptop.patch
+Content-Length: 948
+Lines: 31
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Erik Andrén <erik.andren@gmail.com>
+
+commit b6ef8836c1ff5199abd40cfba162052bc7e8af00 upstream.
+
+Adds a vflip quirk for the Bruneinit laptop. Thanks to Jörg for the report
+
+Signed-off-by: Erik Andrén <erik.andren@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/gspca/m5602/m5602_s5k4aa.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
++++ b/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
+@@ -35,6 +35,13 @@ static
+ const
+ struct dmi_system_id s5k4aa_vflip_dmi_table[] = {
+ {
++ .ident = "BRUNEINIT",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "BRUNENIT"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "BRUNENIT"),
++ DMI_MATCH(DMI_BOARD_VERSION, "00030D0000000001")
++ }
++ }, {
+ .ident = "Fujitsu-Siemens Amilo Xa 2528",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:07:00 2009
+Message-Id: <20091207000700.391172996@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:29 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ =?ISO-8859-15?q?Erik=20Andr=C3=A9n?= <erik.andren@gmail.com>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>
+Subject: [113/119] V4L/DVB (13256): gspca - m5602-s5k4aa: Add another MSI GX700 vflip quirk
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=v4l-dvb-13256-gspca-m5602-s5k4aa-add-another-msi-gx700-vflip-quirk.patch
+Content-Length: 953
+Lines: 32
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Erik Andrén <erik.andren@gmail.com>
+
+commit 2339a1887dab469bb4bae56aa7eca3a5e05ecde7 upstream.
+
+Adds another vflip quirk for the MSI GX700.
+Thanks to John Katzmaier for reporting.
+
+Signed-off-by: Erik Andrén <erik.andren@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/gspca/m5602/m5602_s5k4aa.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
++++ b/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
+@@ -58,6 +58,13 @@ static
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Micro-Star International"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "GX700"),
++ DMI_MATCH(DMI_BIOS_DATE, "12/02/2008")
++ }
++ }, {
++ .ident = "MSI GX700",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Micro-Star International"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "GX700"),
+ DMI_MATCH(DMI_BIOS_DATE, "07/26/2007")
+ }
+ }, {
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:07:00 2009
+Message-Id: <20091207000700.567771288@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:30 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ =?ISO-8859-15?q?Erik=20Andr=C3=A9n?= <erik.andren@gmail.com>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>
+Subject: [114/119] V4L/DVB (13257): gspca - m5602-s5k4aa: Add vflip for Fujitsu Amilo Xi 2528
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=v4l-dvb-13257-gspca-m5602-s5k4aa-add-vflip-for-fujitsu-amilo-xi-2528.patch
+Content-Length: 914
+Lines: 27
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Erik Andrén <erik.andren@gmail.com>
+
+commit 81191f694cb507c49d3c7aa6238dcc0a83ad4001 upstream.
+
+Adds a vflip quirk for the Fujitsu Amilo Xi 2528. Thanks to Evgeny for the report.
+
+Signed-off-by: Erik Andrén <erik.andren@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+
+diff --git a/drivers/media/video/gspca/m5602/m5602_s5k4aa.c b/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
+index ef4ae68..a27afeb 100644
+--- a/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
++++ b/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
+@@ -48,6 +48,12 @@ static
+ DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xa 2528")
+ }
+ }, {
++ .ident = "Fujitsu-Siemens Amilo Xi 2528",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xi 2528")
++ }
++ }, {
+ .ident = "Fujitsu-Siemens Amilo Xi 2550",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:07:00 2009
+Message-Id: <20091207000700.711075465@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:31 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>,
+ Jesse Barnes <jbarnes@virtuousgeek.org>,
+ Jean Delvare <khali@linux-fr.org>
+Subject: [115/119] PCI: Prevent AER driver from being loaded on non-root port PCIE devices
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=pci-prevent-aer-driver-from-being-loaded-on-non-root-port-pcie-devices.patch
+Content-Length: 1590
+Lines: 40
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
+
+commit 30fc24b5cbc55f9e6c686e2710cc812419bddc0c upstream.
+
+A bug was seen on boards using a PLX 8518 switch device which advertises
+AER on each of it's transparent bridges. The AER driver was loaded for
+each bridge and this driver tried to access the AER source ID register
+whenever an interrupt occured on the shared PCI INTX lines. The source
+ID register does not exist on non root port PCIE device's which
+advertise AER and trying to access this register causes a unsupported
+request error on the bridge. Thus, when the next interrupt occurs,
+another error is found and the non existent source ID register is
+accessed again, and so it goes on.
+
+The result is a spammed dmesg with unsupported request PCI express
+errors on the bridge device that the AER driver is loaded against.
+
+Reported-by: Malcolm Crossley <malcolm.crossley2@gefanuc.com>
+Signed-off-by: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
+Tested-by: Malcolm Crossley <malcolm.crossley2@gefanuc.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Cc: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/pcie/aer/aerdrv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pci/pcie/aer/aerdrv.c
++++ b/drivers/pci/pcie/aer/aerdrv.c
+@@ -52,7 +52,7 @@ static struct pci_error_handlers aer_err
+
+ static struct pcie_port_service_driver aerdriver = {
+ .name = "aer",
+- .port_type = PCIE_ANY_PORT,
++ .port_type = PCIE_RC_PORT,
+ .service = PCIE_PORT_SERVICE_AER,
+
+ .probe = aer_probe,
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:07:01 2009
+Message-Id: <20091207000700.872612815@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:32 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Peter Feuerer <peter@piie.net>,
+ Andreas Mohr <andi@lisas.de>,
+ Borislav Petkov <petkovbb@googlemail.com>,
+ Len Brown <len.brown@intel.com>
+Subject: [116/119] acerhdf: additional BIOS versions
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=acerhdf-additional-bios-versions.patch
+Content-Length: 2005
+Lines: 47
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Peter Feuerer <peter@piie.net>
+
+commit f944915187f53810130eb1c56985e27e3cbe4a6d upstream.
+
+Added BIOS versions:
+Acer: AOA110-v0.3307, AOA150-v0.3301, AOA150-v0.3307
+Packard Bell: AOA150-v0.3105
+
+Signed-off-by: Peter Feuerer <peter@piie.net>
+Cc: Andreas Mohr <andi@lisas.de>
+Cc: Borislav Petkov <petkovbb@googlemail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/acerhdf.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/platform/x86/acerhdf.c
++++ b/drivers/platform/x86/acerhdf.c
+@@ -139,13 +139,16 @@ static const struct bios_settings_t bios
+ {"Acer", "AOA110", "v0.3301", 0x55, 0x58, {0xaf, 0x00} },
+ {"Acer", "AOA110", "v0.3304", 0x55, 0x58, {0xaf, 0x00} },
+ {"Acer", "AOA110", "v0.3305", 0x55, 0x58, {0xaf, 0x00} },
++ {"Acer", "AOA110", "v0.3307", 0x55, 0x58, {0xaf, 0x00} },
+ {"Acer", "AOA110", "v0.3308", 0x55, 0x58, {0x21, 0x00} },
+ {"Acer", "AOA110", "v0.3309", 0x55, 0x58, {0x21, 0x00} },
+ {"Acer", "AOA110", "v0.3310", 0x55, 0x58, {0x21, 0x00} },
+ /* AOA150 */
+ {"Acer", "AOA150", "v0.3114", 0x55, 0x58, {0x20, 0x00} },
++ {"Acer", "AOA150", "v0.3301", 0x55, 0x58, {0x20, 0x00} },
+ {"Acer", "AOA150", "v0.3304", 0x55, 0x58, {0x20, 0x00} },
+ {"Acer", "AOA150", "v0.3305", 0x55, 0x58, {0x20, 0x00} },
++ {"Acer", "AOA150", "v0.3307", 0x55, 0x58, {0x20, 0x00} },
+ {"Acer", "AOA150", "v0.3308", 0x55, 0x58, {0x20, 0x00} },
+ {"Acer", "AOA150", "v0.3309", 0x55, 0x58, {0x20, 0x00} },
+ {"Acer", "AOA150", "v0.3310", 0x55, 0x58, {0x20, 0x00} },
+@@ -154,6 +157,7 @@ static const struct bios_settings_t bios
+ {"Gateway", "AOA150", "v0.3103", 0x55, 0x58, {0x20, 0x00} },
+ {"Packard Bell", "DOA150", "v0.3104", 0x55, 0x58, {0x21, 0x00} },
+ {"Packard Bell", "AOA110", "v0.3105", 0x55, 0x58, {0x21, 0x00} },
++ {"Packard Bell", "AOA150", "v0.3105", 0x55, 0x58, {0x20, 0x00} },
+ /* pewpew-terminator */
+ {"", "", "", 0, 0, {0, 0} }
+ };
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:07:01 2009
+Message-Id: <20091207000701.040805568@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:33 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Peter Feuerer <peter@piie.net>,
+ Andreas Mohr <andi@lisas.de>,
+ Len Brown <len.brown@intel.com>
+Subject: [117/119] acerhdf: return temperature in milidegree instead of degree
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=acerhdf-return-temperature-in-milidegree-instead-of-degree.patch
+Content-Length: 1753
+Lines: 59
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Peter Feuerer <peter@piie.net>
+
+commit 7005291706341a11c094f39a756a01c9e649e5f9 upstream.
+
+Return temperature in milidegree instead of degree, as sysfs-api requires
+the temperature in milidegree.
+
+Signed-off-by: Peter Feuerer <peter@piie.net>
+Tested-by: Borislav Petkov <petkovbb@gmail.com>
+Cc: Andreas Mohr <andi@lisas.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/acerhdf.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/platform/x86/acerhdf.c
++++ b/drivers/platform/x86/acerhdf.c
+@@ -61,7 +61,7 @@
+ * measured by the on-die thermal monitor are within 0 <= Tj <= 90. So,
+ * assume 89°C is critical temperature.
+ */
+-#define ACERHDF_TEMP_CRIT 89
++#define ACERHDF_TEMP_CRIT 89000
+ #define ACERHDF_FAN_OFF 0
+ #define ACERHDF_FAN_AUTO 1
+
+@@ -69,7 +69,7 @@
+ * No matter what value the user puts into the fanon variable, turn on the fan
+ * at 80 degree Celsius to prevent hardware damage
+ */
+-#define ACERHDF_MAX_FANON 80
++#define ACERHDF_MAX_FANON 80000
+
+ /*
+ * Maximum interval between two temperature checks is 15 seconds, as the die
+@@ -85,8 +85,8 @@ static int kernelmode;
+ #endif
+
+ static unsigned int interval = 10;
+-static unsigned int fanon = 63;
+-static unsigned int fanoff = 58;
++static unsigned int fanon = 63000;
++static unsigned int fanoff = 58000;
+ static unsigned int verbose;
+ static unsigned int fanstate = ACERHDF_FAN_AUTO;
+ static char force_bios[16];
+@@ -171,7 +171,7 @@ static int acerhdf_get_temp(int *temp)
+ if (ec_read(bios_cfg->tempreg, &read_temp))
+ return -EINVAL;
+
+- *temp = read_temp;
++ *temp = read_temp * 1000;
+
+ return 0;
+ }
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:07:01 2009
+Message-Id: <20091207000701.205637134@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:34 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Samuel Thibault <samuel.thibault@ens-lyon.org>,
+ Dmitry Torokhov <dtor@mail.ru>
+Subject: [118/119] Input: keyboard - fix braille keyboard keysym generation
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=input-keyboard-fix-braille-keyboard-keysym-generation.patch
+Content-Length: 947
+Lines: 29
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+
+commit 46a965462a1c568a7cd7dc338de4a0afa5ce61c5 upstream.
+
+Keysyms stored in key_map[] are not simply K() values, but U(K()) values,
+as can be seen in the KDSKBENT ioctl handler. The kernel-generated
+braille keysyms thus need a U() call too.
+
+Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/keyboard.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/char/keyboard.c
++++ b/drivers/char/keyboard.c
+@@ -1249,7 +1249,7 @@ static void kbd_keycode(unsigned int key
+
+ if (keycode >= NR_KEYS)
+ if (keycode >= KEY_BRL_DOT1 && keycode <= KEY_BRL_DOT8)
+- keysym = K(KT_BRL, keycode - KEY_BRL_DOT1 + 1);
++ keysym = U(K(KT_BRL, keycode - KEY_BRL_DOT1 + 1));
+ else
+ return;
+ else
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:07:01 2009
+Message-Id: <20091207000701.379636613@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 16:01:35 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Roel Kluin <roel.kluin@gmail.com>,
+ Karsten Keil <isdn@linux-pingi.de>,
+ "David S. Miller" <davem@davemloft.net>
+Subject: [119/119] isdn: hfc_usb: Fix read buffer overflow
+References: <20091206235936.208334321@mini.kroah.org>
+Content-Disposition: inline; filename=isdn-hfc_usb-fix-read-buffer-overflow.patch
+Content-Length: 939
+Lines: 30
+
+2.6.31-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Roel Kluin <roel.kluin@gmail.com>
+
+commit 286e633ef0ff5bb63c07b4516665da8004966fec upstream.
+
+Check whether index is within bounds before testing the element.
+
+Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
+Cc: Karsten Keil <isdn@linux-pingi.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/isdn/hisax/hfc_usb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/isdn/hisax/hfc_usb.c
++++ b/drivers/isdn/hisax/hfc_usb.c
+@@ -817,8 +817,8 @@ collect_rx_frame(usb_fifo * fifo, __u8 *
+ }
+ /* we have a complete hdlc packet */
+ if (finish) {
+- if ((!fifo->skbuff->data[fifo->skbuff->len - 1])
+- && (fifo->skbuff->len > 3)) {
++ if (fifo->skbuff->len > 3 &&
++ !fifo->skbuff->data[fifo->skbuff->len - 1]) {
+
+ if (fifon == HFCUSB_D_RX) {
+ DBG(HFCUSB_DBG_DCHANNEL,
+
+
+From gregkh@mini.kroah.org Sun Dec 6 16:06:40 2009
+Message-Id: <20091206235936.208334321@mini.kroah.org>
+User-Agent: quilt/0.48-1
+Date: Sun, 06 Dec 2009 15:59:36 -0800
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: stable-review@kernel.org,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [000/119] 2.6.31.7-stable review
+Content-Length: 8257
+Lines: 146
+
+This is the start of the stable review cycle for the 2.6.31.7 release.
+There are @num@ patches in this series, all will be posted as a response
+to this one. If anyone has any issues with these being applied, please
+let us know. If anyone is a maintainer of the proper subsystem, and
+wants to add a Signed-off-by: line to the patch, please respond with it.
+
+Responses should be made by Tuesday Dec 8, 20:00:00 UTC. Anything
+received after that time might be too late.
+
+The whole patch series can be found in one patch at:
+ kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.31.7-rc1.gz
+and the diffstat can be found below.
+
+thanks,
+
+greg k-h
+
+ Documentation/video4linux/gspca.txt | 1 +
+ Makefile | 2 +-
+ arch/sparc/kernel/prom_common.c | 4 +-
+ arch/sparc/kernel/visemul.c | 2 +-
+ arch/x86/kernel/acpi/processor.c | 3 +-
+ arch/x86/kernel/cpu/cpufreq/speedstep-ich.c | 19 ++---
+ drivers/char/agp/intel-agp.c | 8 ++-
+ drivers/char/keyboard.c | 2 +-
+ drivers/char/tty_port.c | 10 ++-
+ drivers/crypto/padlock-aes.c | 4 +-
+ drivers/gpu/drm/Kconfig | 1 +
+ drivers/gpu/drm/drm_edid.c | 6 ++
+ drivers/gpu/drm/i915/i915_irq.c | 10 ++-
+ drivers/gpu/drm/i915/intel_fb.c | 8 +-
+ drivers/gpu/drm/radeon/radeon_fb.c | 6 +-
+ drivers/hwmon/adt7475.c | 5 +-
+ drivers/i2c/i2c-core.c | 11 +++
+ drivers/isdn/hisax/hfc_usb.c | 4 +-
+ drivers/md/md.c | 5 +-
+ drivers/md/raid1.c | 8 +-
+ drivers/md/raid10.c | 1 +
+ drivers/md/raid5.c | 2 +
+ drivers/media/common/tuners/tda18271-fe.c | 8 +-
+ drivers/media/dvb/dvb-usb/cxusb.c | 10 ++-
+ drivers/media/dvb/frontends/dib7000p.c | 5 +
+ drivers/media/dvb/siano/smsusb.c | 6 ++
+ drivers/media/radio/radio-gemtek-pci.c | 2 -
+ drivers/media/video/bt8xx/bttv-driver.c | 33 ++++++-
+ drivers/media/video/em28xx/em28xx-audio.c | 5 +
+ drivers/media/video/gspca/m5602/m5602_s5k4aa.c | 20 ++++
+ drivers/media/video/gspca/sonixj.c | 40 ++++-----
+ drivers/media/video/s2255drv.c | 5 -
+ drivers/media/video/saa7134/saa7134-cards.c | 1 +
+ drivers/media/video/saa7134/saa7134-ts.c | 6 +-
+ drivers/media/video/saa7134/saa7134.h | 1 +
+ drivers/media/video/sn9c102/sn9c102_devtable.h | 2 +-
+ drivers/media/video/v4l1-compat.c | 14 ++--
+ drivers/mmc/host/pxamci.c | 4 +-
+ drivers/net/acenic.c | 3 +-
+ drivers/net/bonding/bond_main.c | 8 +-
+ drivers/net/sfc/rx.c | 9 ++-
+ drivers/net/sky2.c | 2 +
+ drivers/net/usb/hso.c | 4 +-
+ drivers/net/wireless/ath/ath5k/phy.c | 24 ++++--
+ drivers/net/wireless/b43/dma.c | 36 ++++++--
+ drivers/net/wireless/iwlwifi/iwl-1000.c | 1 +
+ drivers/net/wireless/iwlwifi/iwl-6000.c | 4 +
+ drivers/net/wireless/iwlwifi/iwl-agn-rs.c | 9 ++
+ drivers/net/wireless/iwlwifi/iwl-agn.c | 10 ++-
+ drivers/net/wireless/iwlwifi/iwl-core.h | 2 +
+ drivers/net/wireless/iwlwifi/iwl-tx.c | 10 ++-
+ drivers/net/wireless/rtl818x/rtl8187_leds.c | 4 +-
+ drivers/pci/pcie/aer/aerdrv.c | 2 +-
+ drivers/platform/x86/acerhdf.c | 111 ++++++++++++++++--------
+ drivers/platform/x86/thinkpad_acpi.c | 2 +-
+ drivers/pps/kapi.c | 20 +++-
+ drivers/pps/pps.c | 11 ++-
+ drivers/rtc/rtc-v3020.c | 2 +-
+ drivers/scsi/gdth.c | 2 +-
+ drivers/serial/of_serial.c | 1 +
+ drivers/usb/class/cdc-acm.c | 2 +-
+ drivers/usb/core/hub.c | 2 +-
+ drivers/usb/gadget/amd5536udc.c | 49 +++++++----
+ drivers/usb/host/ehci-hcd.c | 2 +
+ drivers/usb/host/ehci-pci.c | 6 ++
+ drivers/usb/host/ehci-q.c | 16 +++-
+ drivers/usb/host/ehci-sched.c | 12 +++
+ drivers/usb/host/ehci.h | 2 +
+ drivers/usb/host/ohci-hcd.c | 5 +
+ drivers/usb/host/ohci-pci.c | 20 ++++
+ drivers/usb/host/ohci-q.c | 18 +++--
+ drivers/usb/host/ohci.h | 9 ++
+ drivers/usb/host/xhci-mem.c | 10 ++-
+ drivers/usb/host/xhci-ring.c | 7 +-
+ drivers/usb/mon/mon_bin.c | 11 ++-
+ drivers/usb/musb/musb_gadget.c | 79 +++++++----------
+ drivers/usb/serial/cp210x.c | 21 +++++
+ drivers/usb/serial/ftdi_sio.c | 3 +-
+ drivers/usb/serial/option.c | 2 +
+ fs/block_dev.c | 2 +-
+ fs/cifs/cifsproto.h | 1 +
+ fs/cifs/connect.c | 8 --
+ fs/cifs/dir.c | 6 +-
+ fs/cifs/inode.c | 7 +-
+ fs/cifs/misc.c | 14 +++
+ fs/cifs/readdir.c | 7 +-
+ fs/compat_ioctl.c | 4 +-
+ fs/fuse/dir.c | 3 +
+ fs/jffs2/read.c | 9 ++-
+ fs/nfs/nfs4proc.c | 2 +-
+ fs/nilfs2/ioctl.c | 30 +++----
+ fs/proc/base.c | 3 +-
+ include/linux/skbuff.h | 2 +
+ include/net/mac80211.h | 6 ++
+ include/net/netfilter/nf_conntrack.h | 8 +-
+ include/net/netfilter/nf_nat_helper.h | 4 +
+ init/main.c | 11 +--
+ kernel/module.c | 5 +-
+ kernel/perf_counter.c | 2 +-
+ kernel/sched.c | 6 +-
+ kernel/user.c | 2 +-
+ mm/highmem.c | 17 +++-
+ mm/migrate.c | 2 +-
+ mm/page_alloc.c | 4 +-
+ net/core/datagram.c | 10 ++-
+ net/ipv4/ip_fragment.c | 2 +-
+ net/ipv4/netfilter/nf_nat_core.c | 3 +
+ net/ipv4/netfilter/nf_nat_helper.c | 34 +++++---
+ net/ipv4/udp.c | 78 +++++++++-------
+ net/ipv6/udp.c | 4 +-
+ net/mac80211/agg-rx.c | 4 -
+ net/mac80211/agg-tx.c | 17 ++--
+ net/mac80211/ht.c | 8 +-
+ net/mac80211/ieee80211_i.h | 2 +
+ net/netfilter/nf_conntrack_core.c | 8 ++
+ net/netfilter/nf_conntrack_proto_tcp.c | 64 ++++++--------
+ net/netfilter/xt_connlimit.c | 10 +--
+ net/rfkill/core.c | 1 +
+ net/sched/act_pedit.c | 2 +-
+ net/sunrpc/svcsock.c | 10 +-
+ security/integrity/ima/ima_iint.c | 4 +-
+ sound/arm/aaci.c | 6 +-
+ sound/core/rawmidi.c | 44 +++++-----
+ sound/core/seq/seq_midi.c | 1 +
+ sound/pci/hda/patch_sigmatel.c | 2 +
+ sound/soc/codecs/tlv320aic23.c | 3 +-
+ sound/soc/soc-dapm.c | 16 +++-
+ sound/usb/usbaudio.h | 2 +-
+ 128 files changed, 858 insertions(+), 479 deletions(-)
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
