--- /dev/null
+From f944915187f53810130eb1c56985e27e3cbe4a6d Mon Sep 17 00:00:00 2001
+From: Peter Feuerer <peter@piie.net>
+Date: Fri, 18 Sep 2009 12:41:07 -0700
+Subject: acerhdf: additional BIOS versions
+
+From: Peter Feuerer <peter@piie.net>
+
+commit f944915187f53810130eb1c56985e27e3cbe4a6d upstream.
+
+Added BIOS versions:
+Acer: AOA110-v0.3307, AOA150-v0.3301, AOA150-v0.3307
+Packard Bell: AOA150-v0.3105
+
+Signed-off-by: Peter Feuerer <peter@piie.net>
+Cc: Andreas Mohr <andi@lisas.de>
+Cc: Borislav Petkov <petkovbb@googlemail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/acerhdf.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/platform/x86/acerhdf.c
++++ b/drivers/platform/x86/acerhdf.c
+@@ -139,13 +139,16 @@ static const struct bios_settings_t bios
+ {"Acer", "AOA110", "v0.3301", 0x55, 0x58, {0xaf, 0x00} },
+ {"Acer", "AOA110", "v0.3304", 0x55, 0x58, {0xaf, 0x00} },
+ {"Acer", "AOA110", "v0.3305", 0x55, 0x58, {0xaf, 0x00} },
++ {"Acer", "AOA110", "v0.3307", 0x55, 0x58, {0xaf, 0x00} },
+ {"Acer", "AOA110", "v0.3308", 0x55, 0x58, {0x21, 0x00} },
+ {"Acer", "AOA110", "v0.3309", 0x55, 0x58, {0x21, 0x00} },
+ {"Acer", "AOA110", "v0.3310", 0x55, 0x58, {0x21, 0x00} },
+ /* AOA150 */
+ {"Acer", "AOA150", "v0.3114", 0x55, 0x58, {0x20, 0x00} },
++ {"Acer", "AOA150", "v0.3301", 0x55, 0x58, {0x20, 0x00} },
+ {"Acer", "AOA150", "v0.3304", 0x55, 0x58, {0x20, 0x00} },
+ {"Acer", "AOA150", "v0.3305", 0x55, 0x58, {0x20, 0x00} },
++ {"Acer", "AOA150", "v0.3307", 0x55, 0x58, {0x20, 0x00} },
+ {"Acer", "AOA150", "v0.3308", 0x55, 0x58, {0x20, 0x00} },
+ {"Acer", "AOA150", "v0.3309", 0x55, 0x58, {0x20, 0x00} },
+ {"Acer", "AOA150", "v0.3310", 0x55, 0x58, {0x20, 0x00} },
+@@ -154,6 +157,7 @@ static const struct bios_settings_t bios
+ {"Gateway", "AOA150", "v0.3103", 0x55, 0x58, {0x20, 0x00} },
+ {"Packard Bell", "DOA150", "v0.3104", 0x55, 0x58, {0x21, 0x00} },
+ {"Packard Bell", "AOA110", "v0.3105", 0x55, 0x58, {0x21, 0x00} },
++ {"Packard Bell", "AOA150", "v0.3105", 0x55, 0x58, {0x20, 0x00} },
+ /* pewpew-terminator */
+ {"", "", "", 0, 0, {0, 0} }
+ };
--- /dev/null
+From ded0cdfc6a7673916b0878c32fa8ba566b4f8cdb Mon Sep 17 00:00:00 2001
+From: Peter Feuerer <peter@piie.net>
+Date: Thu, 6 Aug 2009 15:57:52 -0700
+Subject: acerhdf: fix fan control for AOA150 model
+
+From: Peter Feuerer <peter@piie.net>
+
+commit ded0cdfc6a7673916b0878c32fa8ba566b4f8cdb upstream.
+
+- Apply Borislav Petkov's patch (convert the fancmd[] array to a real
+ struct thus disambiguating command handling and making code more
+ readable.)
+
+- Add BIOS product to BIOS table as AOA110 and AOA150 have different
+ register values
+
+- Add force_product parameter to allow forcing different product
+
+- fix linker warning caused by "acerhdf_drv" not being named
+ "acerhdf_driver"
+
+Signed-off-by: Peter Feuerer <peter@piie.net>
+Cc: Andreas Mohr <andi@lisas.de>
+Acked-by: Borislav Petkov <petkovbb@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Cc: Adrian von Bidder <avbidder@fortytwo.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/acerhdf.c | 97 +++++++++++++++++++++++++++--------------
+ 1 file changed, 66 insertions(+), 31 deletions(-)
+
+--- a/drivers/platform/x86/acerhdf.c
++++ b/drivers/platform/x86/acerhdf.c
+@@ -52,7 +52,7 @@
+ */
+ #undef START_IN_KERNEL_MODE
+
+-#define DRV_VER "0.5.13"
++#define DRV_VER "0.5.16"
+
+ /*
+ * According to the Atom N270 datasheet,
+@@ -90,6 +90,7 @@ static unsigned int fanoff = 58;
+ static unsigned int verbose;
+ static unsigned int fanstate = ACERHDF_FAN_AUTO;
+ static char force_bios[16];
++static char force_product[16];
+ static unsigned int prev_interval;
+ struct thermal_zone_device *thz_dev;
+ struct thermal_cooling_device *cl_dev;
+@@ -107,34 +108,58 @@ module_param(verbose, uint, 0600);
+ MODULE_PARM_DESC(verbose, "Enable verbose dmesg output");
+ module_param_string(force_bios, force_bios, 16, 0);
+ MODULE_PARM_DESC(force_bios, "Force BIOS version and omit BIOS check");
++module_param_string(force_product, force_product, 16, 0);
++MODULE_PARM_DESC(force_product, "Force BIOS product and omit BIOS check");
++
++/*
++ * cmd_off: to switch the fan completely off / to check if the fan is off
++ * cmd_auto: to set the BIOS in control of the fan. The BIOS regulates then
++ * the fan speed depending on the temperature
++ */
++struct fancmd {
++ u8 cmd_off;
++ u8 cmd_auto;
++};
+
+ /* BIOS settings */
+ struct bios_settings_t {
+ const char *vendor;
++ const char *product;
+ const char *version;
+ unsigned char fanreg;
+ unsigned char tempreg;
+- unsigned char fancmd[2]; /* fan off and auto commands */
++ struct fancmd cmd;
+ };
+
+ /* Register addresses and values for different BIOS versions */
+ static const struct bios_settings_t bios_tbl[] = {
+- {"Acer", "v0.3109", 0x55, 0x58, {0x1f, 0x00} },
+- {"Acer", "v0.3114", 0x55, 0x58, {0x1f, 0x00} },
+- {"Acer", "v0.3301", 0x55, 0x58, {0xaf, 0x00} },
+- {"Acer", "v0.3304", 0x55, 0x58, {0xaf, 0x00} },
+- {"Acer", "v0.3305", 0x55, 0x58, {0xaf, 0x00} },
+- {"Acer", "v0.3308", 0x55, 0x58, {0x21, 0x00} },
+- {"Acer", "v0.3309", 0x55, 0x58, {0x21, 0x00} },
+- {"Acer", "v0.3310", 0x55, 0x58, {0x21, 0x00} },
+- {"Gateway", "v0.3103", 0x55, 0x58, {0x21, 0x00} },
+- {"Packard Bell", "v0.3105", 0x55, 0x58, {0x21, 0x00} },
+- {"", "", 0, 0, {0, 0} }
++ /* AOA110 */
++ {"Acer", "AOA110", "v0.3109", 0x55, 0x58, {0x1f, 0x00} },
++ {"Acer", "AOA110", "v0.3114", 0x55, 0x58, {0x1f, 0x00} },
++ {"Acer", "AOA110", "v0.3301", 0x55, 0x58, {0xaf, 0x00} },
++ {"Acer", "AOA110", "v0.3304", 0x55, 0x58, {0xaf, 0x00} },
++ {"Acer", "AOA110", "v0.3305", 0x55, 0x58, {0xaf, 0x00} },
++ {"Acer", "AOA110", "v0.3308", 0x55, 0x58, {0x21, 0x00} },
++ {"Acer", "AOA110", "v0.3309", 0x55, 0x58, {0x21, 0x00} },
++ {"Acer", "AOA110", "v0.3310", 0x55, 0x58, {0x21, 0x00} },
++ /* AOA150 */
++ {"Acer", "AOA150", "v0.3114", 0x55, 0x58, {0x20, 0x00} },
++ {"Acer", "AOA150", "v0.3304", 0x55, 0x58, {0x20, 0x00} },
++ {"Acer", "AOA150", "v0.3305", 0x55, 0x58, {0x20, 0x00} },
++ {"Acer", "AOA150", "v0.3308", 0x55, 0x58, {0x20, 0x00} },
++ {"Acer", "AOA150", "v0.3309", 0x55, 0x58, {0x20, 0x00} },
++ {"Acer", "AOA150", "v0.3310", 0x55, 0x58, {0x20, 0x00} },
++ /* special BIOS / other */
++ {"Gateway", "AOA110", "v0.3103", 0x55, 0x58, {0x21, 0x00} },
++ {"Gateway", "AOA150", "v0.3103", 0x55, 0x58, {0x20, 0x00} },
++ {"Packard Bell", "DOA150", "v0.3104", 0x55, 0x58, {0x21, 0x00} },
++ {"Packard Bell", "AOA110", "v0.3105", 0x55, 0x58, {0x21, 0x00} },
++ /* pewpew-terminator */
++ {"", "", "", 0, 0, {0, 0} }
+ };
+
+ static const struct bios_settings_t *bios_cfg __read_mostly;
+
+-
+ static int acerhdf_get_temp(int *temp)
+ {
+ u8 read_temp;
+@@ -150,13 +175,14 @@ static int acerhdf_get_temp(int *temp)
+ static int acerhdf_get_fanstate(int *state)
+ {
+ u8 fan;
+- bool tmp;
+
+ if (ec_read(bios_cfg->fanreg, &fan))
+ return -EINVAL;
+
+- tmp = (fan == bios_cfg->fancmd[ACERHDF_FAN_OFF]);
+- *state = tmp ? ACERHDF_FAN_OFF : ACERHDF_FAN_AUTO;
++ if (fan != bios_cfg->cmd.cmd_off)
++ *state = ACERHDF_FAN_AUTO;
++ else
++ *state = ACERHDF_FAN_OFF;
+
+ return 0;
+ }
+@@ -175,7 +201,8 @@ static void acerhdf_change_fanstate(int
+ state = ACERHDF_FAN_AUTO;
+ }
+
+- cmd = bios_cfg->fancmd[state];
++ cmd = (state == ACERHDF_FAN_OFF) ? bios_cfg->cmd.cmd_off
++ : bios_cfg->cmd.cmd_auto;
+ fanstate = state;
+
+ ec_write(bios_cfg->fanreg, cmd);
+@@ -437,7 +464,7 @@ static int acerhdf_remove(struct platfor
+ return 0;
+ }
+
+-struct platform_driver acerhdf_drv = {
++static struct platform_driver acerhdf_driver = {
+ .driver = {
+ .name = "acerhdf",
+ .owner = THIS_MODULE,
+@@ -454,32 +481,40 @@ static int acerhdf_check_hardware(void)
+ {
+ char const *vendor, *version, *product;
+ int i;
++ unsigned long prod_len = 0;
+
+ /* get BIOS data */
+ vendor = dmi_get_system_info(DMI_SYS_VENDOR);
+ version = dmi_get_system_info(DMI_BIOS_VERSION);
+ product = dmi_get_system_info(DMI_PRODUCT_NAME);
+
++
+ pr_info("Acer Aspire One Fan driver, v.%s\n", DRV_VER);
+
+- if (!force_bios[0]) {
+- if (strncmp(product, "AO", 2)) {
+- pr_err("no Aspire One hardware found\n");
+- return -EINVAL;
+- }
+- } else {
+- pr_info("forcing BIOS version: %s\n", version);
++ if (force_bios[0]) {
+ version = force_bios;
++ pr_info("forcing BIOS version: %s\n", version);
+ kernelmode = 0;
+ }
+
++ if (force_product[0]) {
++ product = force_product;
++ pr_info("forcing BIOS product: %s\n", product);
++ kernelmode = 0;
++ }
++
++ prod_len = strlen(product);
++
+ if (verbose)
+ pr_info("BIOS info: %s %s, product: %s\n",
+ vendor, version, product);
+
+ /* search BIOS version and vendor in BIOS settings table */
+ for (i = 0; bios_tbl[i].version[0]; i++) {
+- if (!strcmp(bios_tbl[i].vendor, vendor) &&
++ if (strlen(bios_tbl[i].product) >= prod_len &&
++ !strncmp(bios_tbl[i].product, product,
++ strlen(bios_tbl[i].product)) &&
++ !strcmp(bios_tbl[i].vendor, vendor) &&
+ !strcmp(bios_tbl[i].version, version)) {
+ bios_cfg = &bios_tbl[i];
+ break;
+@@ -487,8 +522,8 @@ static int acerhdf_check_hardware(void)
+ }
+
+ if (!bios_cfg) {
+- pr_err("unknown (unsupported) BIOS version %s/%s, "
+- "please report, aborting!\n", vendor, version);
++ pr_err("unknown (unsupported) BIOS version %s/%s/%s, "
++ "please report, aborting!\n", vendor, product, version);
+ return -EINVAL;
+ }
+
+@@ -509,7 +544,7 @@ static int acerhdf_register_platform(voi
+ {
+ int err = 0;
+
+- err = platform_driver_register(&acerhdf_drv);
++ err = platform_driver_register(&acerhdf_driver);
+ if (err)
+ return err;
+
+@@ -525,7 +560,7 @@ static void acerhdf_unregister_platform(
+ return;
+
+ platform_device_del(acerhdf_dev);
+- platform_driver_unregister(&acerhdf_drv);
++ platform_driver_unregister(&acerhdf_driver);
+ }
+
+ static int acerhdf_register_thermal(void)
--- /dev/null
+From 7005291706341a11c094f39a756a01c9e649e5f9 Mon Sep 17 00:00:00 2001
+From: Peter Feuerer <peter@piie.net>
+Date: Tue, 17 Nov 2009 14:07:21 -0800
+Subject: acerhdf: return temperature in milidegree instead of degree
+
+From: Peter Feuerer <peter@piie.net>
+
+commit 7005291706341a11c094f39a756a01c9e649e5f9 upstream.
+
+Return temperature in milidegree instead of degree, as sysfs-api requires
+the temperature in milidegree.
+
+Signed-off-by: Peter Feuerer <peter@piie.net>
+Tested-by: Borislav Petkov <petkovbb@gmail.com>
+Cc: Andreas Mohr <andi@lisas.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/platform/x86/acerhdf.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/platform/x86/acerhdf.c
++++ b/drivers/platform/x86/acerhdf.c
+@@ -61,7 +61,7 @@
+ * measured by the on-die thermal monitor are within 0 <= Tj <= 90. So,
+ * assume 89°C is critical temperature.
+ */
+-#define ACERHDF_TEMP_CRIT 89
++#define ACERHDF_TEMP_CRIT 89000
+ #define ACERHDF_FAN_OFF 0
+ #define ACERHDF_FAN_AUTO 1
+
+@@ -69,7 +69,7 @@
+ * No matter what value the user puts into the fanon variable, turn on the fan
+ * at 80 degree Celsius to prevent hardware damage
+ */
+-#define ACERHDF_MAX_FANON 80
++#define ACERHDF_MAX_FANON 80000
+
+ /*
+ * Maximum interval between two temperature checks is 15 seconds, as the die
+@@ -85,8 +85,8 @@ static int kernelmode;
+ #endif
+
+ static unsigned int interval = 10;
+-static unsigned int fanon = 63;
+-static unsigned int fanoff = 58;
++static unsigned int fanon = 63000;
++static unsigned int fanoff = 58000;
+ static unsigned int verbose;
+ static unsigned int fanstate = ACERHDF_FAN_AUTO;
+ static char force_bios[16];
+@@ -171,7 +171,7 @@ static int acerhdf_get_temp(int *temp)
+ if (ec_read(bios_cfg->tempreg, &read_temp))
+ return -EINVAL;
+
+- *temp = read_temp;
++ *temp = read_temp * 1000;
+
+ return 0;
+ }
--- /dev/null
+From 9cf1e35cb025eaa52dde37df38e2750b6adb1620 Mon Sep 17 00:00:00 2001
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+Date: Tue, 10 Nov 2009 03:10:22 +0000
+Subject: agp/intel: new host bridge support
+
+From: Zhenyu Wang <zhenyuw@linux.intel.com>
+
+commit 9cf1e35cb025eaa52dde37df38e2750b6adb1620 upstream.
+
+Add new CPU host bridge id, needed for support Ironlake graphics
+device with it. No change for graphics device itself, so no need to
+update drm/i915.
+
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/agp/intel-agp.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/char/agp/intel-agp.c
++++ b/drivers/char/agp/intel-agp.c
+@@ -52,6 +52,7 @@
+ #define PCI_DEVICE_ID_INTEL_IGDNG_D_IG 0x0042
+ #define PCI_DEVICE_ID_INTEL_IGDNG_M_HB 0x0044
+ #define PCI_DEVICE_ID_INTEL_IGDNG_MA_HB 0x0062
++#define PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB 0x006a
+ #define PCI_DEVICE_ID_INTEL_IGDNG_M_IG 0x0046
+
+ /* cover 915 and 945 variants */
+@@ -86,7 +87,8 @@
+ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_B43_HB || \
+ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_D_HB || \
+ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_M_HB || \
+- agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_MA_HB)
++ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_MA_HB || \
++ agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB)
+
+ extern int agp_memory_reserved;
+
+@@ -1239,6 +1241,7 @@ static void intel_i965_get_gtt_range(int
+ case PCI_DEVICE_ID_INTEL_IGDNG_D_HB:
+ case PCI_DEVICE_ID_INTEL_IGDNG_M_HB:
+ case PCI_DEVICE_ID_INTEL_IGDNG_MA_HB:
++ case PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB:
+ *gtt_offset = *gtt_size = MB(2);
+ break;
+ default:
+@@ -2222,6 +2225,8 @@ static const struct intel_driver_descrip
+ "IGDNG/M", NULL, &intel_i965_driver },
+ { PCI_DEVICE_ID_INTEL_IGDNG_MA_HB, PCI_DEVICE_ID_INTEL_IGDNG_M_IG, 0,
+ "IGDNG/MA", NULL, &intel_i965_driver },
++ { PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB, PCI_DEVICE_ID_INTEL_IGDNG_M_IG, 0,
++ "IGDNG/MC2", NULL, &intel_i965_driver },
+ { 0, 0, 0, NULL, NULL, NULL }
+ };
+
+@@ -2418,6 +2423,7 @@ static struct pci_device_id agp_intel_pc
+ ID(PCI_DEVICE_ID_INTEL_IGDNG_D_HB),
+ ID(PCI_DEVICE_ID_INTEL_IGDNG_M_HB),
+ ID(PCI_DEVICE_ID_INTEL_IGDNG_MA_HB),
++ ID(PCI_DEVICE_ID_INTEL_IGDNG_MC2_HB),
+ { }
+ };
+
--- /dev/null
+From d1cb0bdac180a4afdd3c001acb2618d2a62d9abe Mon Sep 17 00:00:00 2001
+From: Nick Kossifidis <mick@madwifi-project.org>
+Date: Mon, 10 Aug 2009 03:27:59 +0300
+Subject: ath5k: Linear PCDAC code fixes
+
+From: Nick Kossifidis <mick@madwifi-project.org>
+
+commit d1cb0bdac180a4afdd3c001acb2618d2a62d9abe upstream.
+
+* Set correct xpd curve indices for high/low gain curves during
+ rfbuffer setup on RF5112B with both calibration curves available.
+
+ * Don't return zero min power when we have the same pcdac value
+ twice because it breaks interpolation. Instead return the right
+ x barrier as we do when we have equal power levels for 2 different
+ pcdac values.
+
+Signed-off-by: Nick Kossifidis <mickflemm@gmail.com>
+Acked-by: Bob Copeland <me@bobcopeland.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Cc: Dan Williams <dcbw@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath5k/phy.c | 24 +++++++++++++++++-------
+ 1 file changed, 17 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath5k/phy.c
++++ b/drivers/net/wireless/ath/ath5k/phy.c
+@@ -740,13 +740,22 @@ int ath5k_hw_rfregs_init(struct ath5k_hw
+ AR5K_RF_XPD_GAIN, true);
+
+ } else {
+- /* TODO: Set high and low gain bits */
+- ath5k_hw_rfb_op(ah, rf_regs,
+- ee->ee_x_gain[ee_mode],
++ u8 *pdg_curve_to_idx = ee->ee_pdc_to_idx[ee_mode];
++ if (ee->ee_pd_gains[ee_mode] > 1) {
++ ath5k_hw_rfb_op(ah, rf_regs,
++ pdg_curve_to_idx[0],
+ AR5K_RF_PD_GAIN_LO, true);
+- ath5k_hw_rfb_op(ah, rf_regs,
+- ee->ee_x_gain[ee_mode],
++ ath5k_hw_rfb_op(ah, rf_regs,
++ pdg_curve_to_idx[1],
+ AR5K_RF_PD_GAIN_HI, true);
++ } else {
++ ath5k_hw_rfb_op(ah, rf_regs,
++ pdg_curve_to_idx[0],
++ AR5K_RF_PD_GAIN_LO, true);
++ ath5k_hw_rfb_op(ah, rf_regs,
++ pdg_curve_to_idx[0],
++ AR5K_RF_PD_GAIN_HI, true);
++ }
+
+ /* Lower synth voltage on Rev 2 */
+ ath5k_hw_rfb_op(ah, rf_regs, 2,
+@@ -1897,8 +1906,9 @@ ath5k_get_linear_pcdac_min(const u8 *ste
+ s16 min_pwrL, min_pwrR;
+ s16 pwr_i;
+
+- if (WARN_ON(stepL[0] == stepL[1] || stepR[0] == stepR[1]))
+- return 0;
++ /* Some vendors write the same pcdac value twice !!! */
++ if (stepL[0] == stepL[1] || stepR[0] == stepR[1])
++ return max(pwrL[0], pwrR[0]);
+
+ if (pwrL[0] == pwrL[1])
+ min_pwrL = pwrL[0];
--- /dev/null
+From 9a3f45116f5e08819136cd512fd7f6450ac22aa8 Mon Sep 17 00:00:00 2001
+From: Michael Buesch <mb@bu3sch.de>
+Date: Wed, 28 Oct 2009 22:08:13 +0100
+Subject: b43: Fix DMA TX bounce buffer copying
+
+From: Michael Buesch <mb@bu3sch.de>
+
+commit 9a3f45116f5e08819136cd512fd7f6450ac22aa8 upstream.
+
+b43 allocates a bouncebuffer, if the supplied TX skb is in an invalid
+memory range for DMA.
+However, this is broken in that it fails to copy over some metadata to the
+new skb.
+
+This patch fixes three problems:
+* Failure to adjust the ieee80211_tx_info pointer to the new buffer.
+ This results in a kmemcheck warning.
+* Failure to copy the skb cb, which contains ieee80211_tx_info, to the new skb.
+ This results in breakage of various TX-status postprocessing (Rate control).
+* Failure to transfer the queue mapping.
+ This results in the wrong queue being stopped on saturation and can result in queue overflow.
+
+Signed-off-by: Michael Buesch <mb@bu3sch.de>
+Tested-by: Christian Casteyde <casteyde.christian@free.fr>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/b43/dma.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/b43/dma.c
++++ b/drivers/net/wireless/b43/dma.c
+@@ -1158,8 +1158,9 @@ struct b43_dmaring *parse_cookie(struct
+ }
+
+ static int dma_tx_fragment(struct b43_dmaring *ring,
+- struct sk_buff *skb)
++ struct sk_buff **in_skb)
+ {
++ struct sk_buff *skb = *in_skb;
+ const struct b43_dma_ops *ops = ring->ops;
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ u8 *header;
+@@ -1225,8 +1226,14 @@ static int dma_tx_fragment(struct b43_dm
+ }
+
+ memcpy(skb_put(bounce_skb, skb->len), skb->data, skb->len);
++ memcpy(bounce_skb->cb, skb->cb, sizeof(skb->cb));
++ bounce_skb->dev = skb->dev;
++ skb_set_queue_mapping(bounce_skb, skb_get_queue_mapping(skb));
++ info = IEEE80211_SKB_CB(bounce_skb);
++
+ dev_kfree_skb_any(skb);
+ skb = bounce_skb;
++ *in_skb = bounce_skb;
+ meta->skb = skb;
+ meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1);
+ if (b43_dma_mapping_error(ring, meta->dmaaddr, skb->len, 1)) {
+@@ -1359,7 +1366,11 @@ int b43_dma_tx(struct b43_wldev *dev, st
+ * static, so we don't need to store it per frame. */
+ ring->queue_prio = skb_get_queue_mapping(skb);
+
+- err = dma_tx_fragment(ring, skb);
++ /* dma_tx_fragment might reallocate the skb, so invalidate pointers pointing
++ * into the skb data or cb now. */
++ hdr = NULL;
++ info = NULL;
++ err = dma_tx_fragment(ring, &skb);
+ if (unlikely(err == -ENOKEY)) {
+ /* Drop this packet, as we don't have the encryption key
+ * anymore and must not transmit it unencrypted. */
--- /dev/null
+From 960cc0f4fef607baabc2232fbd7cce5368a9dcfd Mon Sep 17 00:00:00 2001
+From: Neil Brown <neilb@suse.de>
+Date: Mon, 26 Oct 2009 08:59:17 +0100
+Subject: block: use after free bug in __blkdev_get
+
+From: Neil Brown <neilb@suse.de>
+
+commit 960cc0f4fef607baabc2232fbd7cce5368a9dcfd upstream.
+
+commit 0762b8bde9729f10f8e6249809660ff2ec3ad735
+(from 14 months ago) introduced a use-after-free bug which has just
+recently started manifesting in my md testing.
+I tried git bisect to find out what caused the bug to start
+manifesting, and it could have been the recent change to
+blk_unregister_queue (48c0d4d4c04) but the results were inconclusive.
+
+This patch certainly fixes my symptoms and looks correct as the two
+calls are now in the same order as elsewhere in that function.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Acked-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/block_dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -1243,8 +1243,8 @@ static int __blkdev_get(struct block_dev
+ bd_set_size(bdev, (loff_t)bdev->bd_part->nr_sects << 9);
+ }
+ } else {
+- put_disk(disk);
+ module_put(disk->fops->owner);
++ put_disk(disk);
+ disk = NULL;
+ if (bdev->bd_contains == bdev) {
+ if (bdev->bd_disk->fops->open) {
--- /dev/null
+From e8edb3cbd7dd8acf6c748a02d06ec1d82c4124ea Mon Sep 17 00:00:00 2001
+From: Chuck Ebbert <cebbert@redhat.com>
+Date: Tue, 3 Nov 2009 10:32:03 -0500
+Subject: crypto: padlock-aes - Use the correct mask when checking whether copying is required
+
+From: Chuck Ebbert <cebbert@redhat.com>
+
+commit e8edb3cbd7dd8acf6c748a02d06ec1d82c4124ea upstream.
+
+Masking with PAGE_SIZE is just wrong...
+
+Signed-off-by: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/crypto/padlock-aes.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/crypto/padlock-aes.c
++++ b/drivers/crypto/padlock-aes.c
+@@ -236,7 +236,7 @@ static inline void ecb_crypt(const u8 *i
+ /* Padlock in ECB mode fetches at least ecb_fetch_bytes of data.
+ * We could avoid some copying here but it's probably not worth it.
+ */
+- if (unlikely(((unsigned long)in & PAGE_SIZE) + ecb_fetch_bytes > PAGE_SIZE)) {
++ if (unlikely(((unsigned long)in & ~PAGE_MASK) + ecb_fetch_bytes > PAGE_SIZE)) {
+ ecb_crypt_copy(in, out, key, cword, count);
+ return;
+ }
+@@ -248,7 +248,7 @@ static inline u8 *cbc_crypt(const u8 *in
+ u8 *iv, struct cword *cword, int count)
+ {
+ /* Padlock in CBC mode fetches at least cbc_fetch_bytes of data. */
+- if (unlikely(((unsigned long)in & PAGE_SIZE) + cbc_fetch_bytes > PAGE_SIZE))
++ if (unlikely(((unsigned long)in & ~PAGE_MASK) + cbc_fetch_bytes > PAGE_SIZE))
+ return cbc_crypt_copy(in, out, key, iv, cword, count);
+
+ return rep_xcrypt_cbc(in, out, key, iv, cword, count);
--- /dev/null
+From clemens@ladisch.de Sat Dec 5 12:11:25 2009
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Wed, 02 Dec 2009 08:16:55 +0100
+Subject: drm/fb: fix FBIOGET/PUT_VSCREENINFO pixel clock handling
+To: Greg KH <greg@kroah.com>
+Cc: Dave Airlie <airlied@redhat.com>, stable@kernel.org, Paulius Zaleckas <paulius.zaleckas@gmail.com>
+Message-ID: <4B161467.9050909@ladisch.de>
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit 5349ef3127c77075ff70b2014f17ae0fbcaaf199 upstream
+
+When the framebuffer driver does not publish detailed timing information
+for the current video mode, the correct value for the pixclock field is
+zero, not -1.
+
+Since pixclock is actually unsigned, the value -1 would be interpreted
+as 4294967295 picoseconds (i.e., about 4 milliseconds) by
+register_framebuffer() and userspace programs.
+
+This patch allows X.org's fbdev driver to work.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Tested-by: Paulius Zaleckas <paulius.zaleckas@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_fb.c | 8 ++++----
+ drivers/gpu/drm/radeon/radeon_fb.c | 6 +++---
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_fb.c
++++ b/drivers/gpu/drm/i915/intel_fb.c
+@@ -114,7 +114,7 @@ static int intelfb_check_var(struct fb_v
+ struct drm_framebuffer *fb = &intel_fb->base;
+ int depth;
+
+- if (var->pixclock == -1 || !var->pixclock)
++ if (var->pixclock != 0)
+ return -EINVAL;
+
+ /* Need to resize the fb object !!! */
+@@ -205,7 +205,7 @@ static int intelfb_set_par(struct fb_inf
+
+ DRM_DEBUG("%d %d\n", var->xres, var->pixclock);
+
+- if (var->pixclock != -1) {
++ if (var->pixclock != 0) {
+
+ DRM_ERROR("PIXEL CLOCK SET\n");
+ return -EINVAL;
+@@ -692,7 +692,7 @@ static int intelfb_multi_fb_probe_crtc(s
+ par->crtc_count = 1;
+
+ if (new_fb) {
+- info->var.pixclock = -1;
++ info->var.pixclock = 0;
+ if (register_framebuffer(info) < 0)
+ return -EINVAL;
+ } else
+@@ -846,7 +846,7 @@ static int intelfb_single_fb_probe(struc
+ par->crtc_count = crtc_count;
+
+ if (new_fb) {
+- info->var.pixclock = -1;
++ info->var.pixclock = 0;
+ if (register_framebuffer(info) < 0)
+ return -EINVAL;
+ } else
+--- a/drivers/gpu/drm/radeon/radeon_fb.c
++++ b/drivers/gpu/drm/radeon/radeon_fb.c
+@@ -120,7 +120,7 @@ static int radeonfb_check_var(struct fb_
+ struct drm_framebuffer *fb = &rfb->base;
+ int depth;
+
+- if (var->pixclock == -1 || !var->pixclock) {
++ if (var->pixclock != 0) {
+ return -EINVAL;
+ }
+ /* Need to resize the fb object !!! */
+@@ -234,7 +234,7 @@ static int radeonfb_set_par(struct fb_in
+ int ret;
+ int i;
+
+- if (var->pixclock != -1) {
++ if (var->pixclock != 0) {
+ DRM_ERROR("PIXEL CLCOK SET\n");
+ return -EINVAL;
+ }
+@@ -828,7 +828,7 @@ static int radeonfb_single_fb_probe(stru
+ rfbdev->crtc_count = crtc_count;
+
+ if (new_fb) {
+- info->var.pixclock = -1;
++ info->var.pixclock = 0;
+ if (register_framebuffer(info) < 0)
+ return -EINVAL;
+ } else {
--- /dev/null
+From dcfcb256cc23c4436691b0fe677275306699d6a1 Mon Sep 17 00:00:00 2001
+From: Antti Kaijanmäki <antti.kaijanmaki@nomovok.com>
+Date: Mon, 23 Nov 2009 10:54:47 -0800
+Subject: hso: fix soft-lockup
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Antti Kaijanmäki <antti.kaijanmaki@nomovok.com>
+
+commit dcfcb256cc23c4436691b0fe677275306699d6a1 upstream.
+
+Fix soft-lockup in hso.c which is triggered on SMP machine when
+modem is removed while file descriptor(s) under /dev are still open:
+
+ old version called kref_put() too early which resulted in destroying
+ hso_serial and hso_device objects which were still used later on.
+
+Signed-off-by: Antti Kaijanmäki <antti.kaijanmaki@nomovok.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+
+---
+ drivers/net/usb/hso.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/usb/hso.c
++++ b/drivers/net/usb/hso.c
+@@ -1362,7 +1362,7 @@ static void hso_serial_close(struct tty_
+ /* reset the rts and dtr */
+ /* do the actual close */
+ serial->open_count--;
+- kref_put(&serial->parent->ref, hso_serial_ref_free);
++
+ if (serial->open_count <= 0) {
+ serial->open_count = 0;
+ spin_lock_irq(&serial->serial_lock);
+@@ -1382,6 +1382,8 @@ static void hso_serial_close(struct tty_
+ usb_autopm_put_interface(serial->parent->interface);
+
+ mutex_unlock(&serial->parent->mutex);
++
++ kref_put(&serial->parent->ref, hso_serial_ref_free);
+ }
+
+ /* close the requested serial port */
--- /dev/null
+From 56e35eeebed2dcb4e1a17ad119e039cf095854ac Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Mon, 16 Nov 2009 12:45:40 +0100
+Subject: hwmon: (adt7475) Cache limits for 60 seconds
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit 56e35eeebed2dcb4e1a17ad119e039cf095854ac upstream.
+
+The comment says that limits are cached for 60 seconds but the code
+actually caches them for only 2 seconds. Align the code on the
+comment, as 60 seconds makes more sense.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Acked-by: Hans de Goede <hdegoede@redhat.com>
+Cc: Jordan Crouse <jordan@cosmicpenguin.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/adt7475.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/adt7475.c
++++ b/drivers/hwmon/adt7475.c
+@@ -1151,7 +1151,7 @@ static struct adt7475_data *adt7475_upda
+ }
+
+ /* Limits and settings, should never change update every 60 seconds */
+- if (time_after(jiffies, data->limits_updated + HZ * 2) ||
++ if (time_after(jiffies, data->limits_updated + HZ * 60) ||
+ !data->valid) {
+ data->config5 = adt7475_read(REG_CONFIG5);
+
--- /dev/null
+From cf312e077662ec3a07529551ab6e885828ccfb1d Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Mon, 16 Nov 2009 12:45:39 +0100
+Subject: hwmon: (adt7475) Fix temperature fault flags
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit cf312e077662ec3a07529551ab6e885828ccfb1d upstream.
+
+The logic of temperature fault flags is wrong, it shows faults when
+there are none and vice versa. Fix it.
+
+I can't believe this has been broken since the driver was added, 8
+months ago, basically breaking temp1 and temp3, and nobody ever
+complained.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Acked-by: Hans de Goede <hdegoede@redhat.com>
+Cc: Jordan Crouse <jordan@cosmicpenguin.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/adt7475.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/hwmon/adt7475.c
++++ b/drivers/hwmon/adt7475.c
+@@ -350,8 +350,7 @@ static ssize_t show_temp(struct device *
+
+ case FAULT:
+ /* Note - only for remote1 and remote2 */
+- out = data->alarms & (sattr->index ? 0x8000 : 0x4000);
+- out = out ? 0 : 1;
++ out = !!(data->alarms & (sattr->index ? 0x8000 : 0x4000));
+ break;
+
+ default:
--- /dev/null
+From bbd2d9c9198c6efd449e9d395b3eaf2d03aa3bba Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Thu, 26 Nov 2009 09:22:33 +0100
+Subject: i2c: Fix userspace_device list corruption
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit bbd2d9c9198c6efd449e9d395b3eaf2d03aa3bba upstream.
+
+Fix userspace_device list corruption. The corruption was caused by
+clients not being removed when adapters with such clients were
+themselves removed. Something like the following would trigger it
+(assuming i2c-stub gets adapter number 3):
+
+# modprobe i2c-stub chip_addr=0x50
+# echo 24c08 0x50 > /sys/bus/i2c/devices/i2c-3/new_device
+# rmmod i2c-stub
+# modprobe i2c-stub chip_addr=0x50
+# echo 24c08 0x50 > /sys/bus/i2c/devices/i2c-3/new_device
+
+For the records, the stack trace in the kernel logs look like this:
+
+kernel: WARNING: at lib/list_debug.c:30 __list_add+0x8b/0x90()
+kernel: Hardware name: (...)
+kernel: list_add corruption. prev->next should be next (c137fc84), but was (null). (prev=f57111b8).
+kernel: Modules linked in: (...)
+kernel: Pid: 4669, comm: bash Not tainted 2.6.32-rc8 #259
+kernel: Call Trace:
+kernel: [<c111eb8b>] ? __list_add+0x8b/0x90
+kernel: [<c111eb8b>] ? __list_add+0x8b/0x90
+kernel: [<c103265c>] warn_slowpath_common+0x6c/0xc0
+kernel: [<c111eb8b>] ? __list_add+0x8b/0x90
+kernel: [<c10326f6>] warn_slowpath_fmt+0x26/0x30
+kernel: [<c111eb8b>] __list_add+0x8b/0x90
+kernel: [<c11ba165>] i2c_sysfs_new_device+0x1c5/0x250
+kernel: [<c10861be>] ? might_fault+0x2e/0x80
+kernel: [<c11b9fa0>] ? i2c_sysfs_new_device+0x0/0x250
+kernel: [<c118c625>] dev_attr_store+0x25/0x30
+kernel: [<c10e305c>] sysfs_write_file+0x9c/0xf0
+kernel: [<c109d35c>] vfs_write+0x9c/0x160
+kernel: [<c10e2fc0>] ? sysfs_write_file+0x0/0xf0
+kernel: [<c109d4dd>] sys_write+0x3d/0x70
+kernel: [<c1002ed8>] sysenter_do_call+0x12/0x36
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/i2c/i2c-core.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/i2c/i2c-core.c
++++ b/drivers/i2c/i2c-core.c
+@@ -718,6 +718,7 @@ int i2c_del_adapter(struct i2c_adapter *
+ {
+ int res = 0;
+ struct i2c_adapter *found;
++ struct i2c_client *client, *next;
+
+ /* First make sure that this adapter was ever added */
+ mutex_lock(&core_lock);
+@@ -737,6 +738,16 @@ int i2c_del_adapter(struct i2c_adapter *
+ if (res)
+ return res;
+
++ /* Remove devices instantiated from sysfs */
++ list_for_each_entry_safe(client, next, &userspace_devices, detected) {
++ if (client->adapter == adap) {
++ dev_dbg(&adap->dev, "Removing %s at 0x%x\n",
++ client->name, client->addr);
++ list_del(&client->detected);
++ i2c_unregister_device(client);
++ }
++ }
++
+ /* Detach any active clients. This can't fail, thus we do not
+ checking the returned value. */
+ res = device_for_each_child(&adap->dev, NULL, __unregister_client);
--- /dev/null
+From 46a965462a1c568a7cd7dc338de4a0afa5ce61c5 Mon Sep 17 00:00:00 2001
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Date: Wed, 25 Nov 2009 22:28:20 -0800
+Subject: Input: keyboard - fix braille keyboard keysym generation
+
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+
+commit 46a965462a1c568a7cd7dc338de4a0afa5ce61c5 upstream.
+
+Keysyms stored in key_map[] are not simply K() values, but U(K()) values,
+as can be seen in the KDSKBENT ioctl handler. The kernel-generated
+braille keysyms thus need a U() call too.
+
+Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/keyboard.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/char/keyboard.c
++++ b/drivers/char/keyboard.c
+@@ -1249,7 +1249,7 @@ static void kbd_keycode(unsigned int key
+
+ if (keycode >= NR_KEYS)
+ if (keycode >= KEY_BRL_DOT1 && keycode <= KEY_BRL_DOT8)
+- keysym = K(KT_BRL, keycode - KEY_BRL_DOT1 + 1);
++ keysym = U(K(KT_BRL, keycode - KEY_BRL_DOT1 + 1));
+ else
+ return;
+ else
--- /dev/null
+From 286e633ef0ff5bb63c07b4516665da8004966fec Mon Sep 17 00:00:00 2001
+From: Roel Kluin <roel.kluin@gmail.com>
+Date: Wed, 4 Nov 2009 08:31:59 -0800
+Subject: isdn: hfc_usb: Fix read buffer overflow
+
+From: Roel Kluin <roel.kluin@gmail.com>
+
+commit 286e633ef0ff5bb63c07b4516665da8004966fec upstream.
+
+Check whether index is within bounds before testing the element.
+
+Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
+Cc: Karsten Keil <isdn@linux-pingi.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/isdn/hisax/hfc_usb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/isdn/hisax/hfc_usb.c
++++ b/drivers/isdn/hisax/hfc_usb.c
+@@ -817,8 +817,8 @@ collect_rx_frame(usb_fifo * fifo, __u8 *
+ }
+ /* we have a complete hdlc packet */
+ if (finish) {
+- if ((!fifo->skbuff->data[fifo->skbuff->len - 1])
+- && (fifo->skbuff->len > 3)) {
++ if (fifo->skbuff->len > 3 &&
++ !fifo->skbuff->data[fifo->skbuff->len - 1]) {
+
+ if (fifon == HFCUSB_D_RX) {
+ DBG(HFCUSB_DBG_DCHANNEL,
--- /dev/null
+From f9dd09c7f7199685601d75882447a6598be8a3e0 Mon Sep 17 00:00:00 2001
+From: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+Date: Fri, 6 Nov 2009 00:43:42 -0800
+Subject: netfilter: nf_nat: fix NAT issue in 2.6.30.4+
+
+From: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+
+commit f9dd09c7f7199685601d75882447a6598be8a3e0 upstream.
+
+Vitezslav Samel discovered that since 2.6.30.4+ active FTP can not work
+over NAT. The "cause" of the problem was a fix of unacknowledged data
+detection with NAT (commit a3a9f79e361e864f0e9d75ebe2a0cb43d17c4272).
+However, actually, that fix uncovered a long standing bug in TCP conntrack:
+when NAT was enabled, we simply updated the max of the right edge of
+the segments we have seen (td_end), by the offset NAT produced with
+changing IP/port in the data. However, we did not update the other parameter
+(td_maxend) which is affected by the NAT offset. Thus that could drift
+away from the correct value and thus resulted breaking active FTP.
+
+The patch below fixes the issue by *not* updating the conntrack parameters
+from NAT, but instead taking into account the NAT offsets in conntrack in a
+consistent way. (Updating from NAT would be more harder and expensive because
+it'd need to re-calculate parameters we already calculated in conntrack.)
+
+Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/net/netfilter/nf_conntrack.h | 8 +---
+ include/net/netfilter/nf_nat_helper.h | 4 ++
+ net/ipv4/netfilter/nf_nat_core.c | 3 +
+ net/ipv4/netfilter/nf_nat_helper.c | 34 +++++++++++------
+ net/netfilter/nf_conntrack_core.c | 8 ++++
+ net/netfilter/nf_conntrack_proto_tcp.c | 64 +++++++++++++--------------------
+ 6 files changed, 67 insertions(+), 54 deletions(-)
+
+--- a/include/net/netfilter/nf_conntrack.h
++++ b/include/net/netfilter/nf_conntrack.h
+@@ -255,11 +255,9 @@ static inline bool nf_ct_kill(struct nf_
+ }
+
+ /* These are for NAT. Icky. */
+-/* Update TCP window tracking data when NAT mangles the packet */
+-extern void nf_conntrack_tcp_update(const struct sk_buff *skb,
+- unsigned int dataoff,
+- struct nf_conn *ct, int dir,
+- s16 offset);
++extern s16 (*nf_ct_nat_offset)(const struct nf_conn *ct,
++ enum ip_conntrack_dir dir,
++ u32 seq);
+
+ /* Fake conntrack entry for untracked connections */
+ extern struct nf_conn nf_conntrack_untracked;
+--- a/include/net/netfilter/nf_nat_helper.h
++++ b/include/net/netfilter/nf_nat_helper.h
+@@ -32,4 +32,8 @@ extern int (*nf_nat_seq_adjust_hook)(str
+ * to port ct->master->saved_proto. */
+ extern void nf_nat_follow_master(struct nf_conn *ct,
+ struct nf_conntrack_expect *this);
++
++extern s16 nf_nat_get_offset(const struct nf_conn *ct,
++ enum ip_conntrack_dir dir,
++ u32 seq);
+ #endif
+--- a/net/ipv4/netfilter/nf_nat_core.c
++++ b/net/ipv4/netfilter/nf_nat_core.c
+@@ -750,6 +750,8 @@ static int __init nf_nat_init(void)
+ BUG_ON(nfnetlink_parse_nat_setup_hook != NULL);
+ rcu_assign_pointer(nfnetlink_parse_nat_setup_hook,
+ nfnetlink_parse_nat_setup);
++ BUG_ON(nf_ct_nat_offset != NULL);
++ rcu_assign_pointer(nf_ct_nat_offset, nf_nat_get_offset);
+ return 0;
+
+ cleanup_extend:
+@@ -764,6 +766,7 @@ static void __exit nf_nat_cleanup(void)
+ nf_ct_extend_unregister(&nat_extend);
+ rcu_assign_pointer(nf_nat_seq_adjust_hook, NULL);
+ rcu_assign_pointer(nfnetlink_parse_nat_setup_hook, NULL);
++ rcu_assign_pointer(nf_ct_nat_offset, NULL);
+ synchronize_net();
+ }
+
+--- a/net/ipv4/netfilter/nf_nat_helper.c
++++ b/net/ipv4/netfilter/nf_nat_helper.c
+@@ -73,6 +73,28 @@ adjust_tcp_sequence(u32 seq,
+ DUMP_OFFSET(this_way);
+ }
+
++/* Get the offset value, for conntrack */
++s16 nf_nat_get_offset(const struct nf_conn *ct,
++ enum ip_conntrack_dir dir,
++ u32 seq)
++{
++ struct nf_conn_nat *nat = nfct_nat(ct);
++ struct nf_nat_seq *this_way;
++ s16 offset;
++
++ if (!nat)
++ return 0;
++
++ this_way = &nat->seq[dir];
++ spin_lock_bh(&nf_nat_seqofs_lock);
++ offset = after(seq, this_way->correction_pos)
++ ? this_way->offset_after : this_way->offset_before;
++ spin_unlock_bh(&nf_nat_seqofs_lock);
++
++ return offset;
++}
++EXPORT_SYMBOL_GPL(nf_nat_get_offset);
++
+ /* Frobs data inside this packet, which is linear. */
+ static void mangle_contents(struct sk_buff *skb,
+ unsigned int dataoff,
+@@ -189,11 +211,6 @@ nf_nat_mangle_tcp_packet(struct sk_buff
+ adjust_tcp_sequence(ntohl(tcph->seq),
+ (int)rep_len - (int)match_len,
+ ct, ctinfo);
+- /* Tell TCP window tracking about seq change */
+- nf_conntrack_tcp_update(skb, ip_hdrlen(skb),
+- ct, CTINFO2DIR(ctinfo),
+- (int)rep_len - (int)match_len);
+-
+ nf_conntrack_event_cache(IPCT_NATSEQADJ, ct);
+ }
+ return 1;
+@@ -415,12 +432,7 @@ nf_nat_seq_adjust(struct sk_buff *skb,
+ tcph->seq = newseq;
+ tcph->ack_seq = newack;
+
+- if (!nf_nat_sack_adjust(skb, tcph, ct, ctinfo))
+- return 0;
+-
+- nf_conntrack_tcp_update(skb, ip_hdrlen(skb), ct, dir, seqoff);
+-
+- return 1;
++ return nf_nat_sack_adjust(skb, tcph, ct, ctinfo);
+ }
+
+ /* Setup NAT on this expected conntrack so it follows master. */
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -1350,6 +1350,11 @@ err_stat:
+ return ret;
+ }
+
++s16 (*nf_ct_nat_offset)(const struct nf_conn *ct,
++ enum ip_conntrack_dir dir,
++ u32 seq);
++EXPORT_SYMBOL_GPL(nf_ct_nat_offset);
++
+ int nf_conntrack_init(struct net *net)
+ {
+ int ret;
+@@ -1367,6 +1372,9 @@ int nf_conntrack_init(struct net *net)
+ /* For use by REJECT target */
+ rcu_assign_pointer(ip_ct_attach, nf_conntrack_attach);
+ rcu_assign_pointer(nf_ct_destroy, destroy_conntrack);
++
++ /* Howto get NAT offsets */
++ rcu_assign_pointer(nf_ct_nat_offset, NULL);
+ }
+ return 0;
+
+--- a/net/netfilter/nf_conntrack_proto_tcp.c
++++ b/net/netfilter/nf_conntrack_proto_tcp.c
+@@ -492,6 +492,21 @@ static void tcp_sack(const struct sk_buf
+ }
+ }
+
++#ifdef CONFIG_NF_NAT_NEEDED
++static inline s16 nat_offset(const struct nf_conn *ct,
++ enum ip_conntrack_dir dir,
++ u32 seq)
++{
++ typeof(nf_ct_nat_offset) get_offset = rcu_dereference(nf_ct_nat_offset);
++
++ return get_offset != NULL ? get_offset(ct, dir, seq) : 0;
++}
++#define NAT_OFFSET(pf, ct, dir, seq) \
++ (pf == NFPROTO_IPV4 ? nat_offset(ct, dir, seq) : 0)
++#else
++#define NAT_OFFSET(pf, ct, dir, seq) 0
++#endif
++
+ static bool tcp_in_window(const struct nf_conn *ct,
+ struct ip_ct_tcp *state,
+ enum ip_conntrack_dir dir,
+@@ -506,6 +521,7 @@ static bool tcp_in_window(const struct n
+ struct ip_ct_tcp_state *receiver = &state->seen[!dir];
+ const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
+ __u32 seq, ack, sack, end, win, swin;
++ s16 receiver_offset;
+ bool res;
+
+ /*
+@@ -519,11 +535,16 @@ static bool tcp_in_window(const struct n
+ if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)
+ tcp_sack(skb, dataoff, tcph, &sack);
+
++ /* Take into account NAT sequence number mangling */
++ receiver_offset = NAT_OFFSET(pf, ct, !dir, ack - 1);
++ ack -= receiver_offset;
++ sack -= receiver_offset;
++
+ pr_debug("tcp_in_window: START\n");
+ pr_debug("tcp_in_window: ");
+ nf_ct_dump_tuple(tuple);
+- pr_debug("seq=%u ack=%u sack=%u win=%u end=%u\n",
+- seq, ack, sack, win, end);
++ pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n",
++ seq, ack, receiver_offset, sack, receiver_offset, win, end);
+ pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
+ "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
+ sender->td_end, sender->td_maxend, sender->td_maxwin,
+@@ -613,8 +634,8 @@ static bool tcp_in_window(const struct n
+
+ pr_debug("tcp_in_window: ");
+ nf_ct_dump_tuple(tuple);
+- pr_debug("seq=%u ack=%u sack =%u win=%u end=%u\n",
+- seq, ack, sack, win, end);
++ pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n",
++ seq, ack, receiver_offset, sack, receiver_offset, win, end);
+ pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
+ "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
+ sender->td_end, sender->td_maxend, sender->td_maxwin,
+@@ -700,7 +721,7 @@ static bool tcp_in_window(const struct n
+ before(seq, sender->td_maxend + 1) ?
+ after(end, sender->td_end - receiver->td_maxwin - 1) ?
+ before(sack, receiver->td_end + 1) ?
+- after(ack, receiver->td_end - MAXACKWINDOW(sender)) ? "BUG"
++ after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1) ? "BUG"
+ : "ACK is under the lower bound (possible overly delayed ACK)"
+ : "ACK is over the upper bound (ACKed data not seen yet)"
+ : "SEQ is under the lower bound (already ACKed data retransmitted)"
+@@ -715,39 +736,6 @@ static bool tcp_in_window(const struct n
+ return res;
+ }
+
+-#ifdef CONFIG_NF_NAT_NEEDED
+-/* Update sender->td_end after NAT successfully mangled the packet */
+-/* Caller must linearize skb at tcp header. */
+-void nf_conntrack_tcp_update(const struct sk_buff *skb,
+- unsigned int dataoff,
+- struct nf_conn *ct, int dir,
+- s16 offset)
+-{
+- const struct tcphdr *tcph = (const void *)skb->data + dataoff;
+- const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[dir];
+- const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[!dir];
+- __u32 end;
+-
+- end = segment_seq_plus_len(ntohl(tcph->seq), skb->len, dataoff, tcph);
+-
+- spin_lock_bh(&ct->lock);
+- /*
+- * We have to worry for the ack in the reply packet only...
+- */
+- if (ct->proto.tcp.seen[dir].td_end + offset == end)
+- ct->proto.tcp.seen[dir].td_end = end;
+- ct->proto.tcp.last_end = end;
+- spin_unlock_bh(&ct->lock);
+- pr_debug("tcp_update: sender end=%u maxend=%u maxwin=%u scale=%i "
+- "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
+- sender->td_end, sender->td_maxend, sender->td_maxwin,
+- sender->td_scale,
+- receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
+- receiver->td_scale);
+-}
+-EXPORT_SYMBOL_GPL(nf_conntrack_tcp_update);
+-#endif
+-
+ #define TH_FIN 0x01
+ #define TH_SYN 0x02
+ #define TH_RST 0x04
--- /dev/null
+From 539054a8fa5141c9a4e9ac6a86d249e3f2bdef45 Mon Sep 17 00:00:00 2001
+From: Jan Engelhardt <jengelh@medozas.de>
+Date: Fri, 6 Nov 2009 18:08:32 -0800
+Subject: netfilter: xt_connlimit: fix regression caused by zero family value
+
+From: Jan Engelhardt <jengelh@medozas.de>
+
+commit 539054a8fa5141c9a4e9ac6a86d249e3f2bdef45 upstream.
+
+Commit v2.6.28-rc1~717^2~109^2~2 was slightly incomplete; not all
+instances of par->match->family were changed to par->family.
+
+References: http://bugzilla.netfilter.org/show_bug.cgi?id=610
+Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/netfilter/xt_connlimit.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+--- a/net/netfilter/xt_connlimit.c
++++ b/net/netfilter/xt_connlimit.c
+@@ -103,7 +103,7 @@ static int count_them(struct xt_connlimi
+ const struct nf_conntrack_tuple *tuple,
+ const union nf_inet_addr *addr,
+ const union nf_inet_addr *mask,
+- const struct xt_match *match)
++ u_int8_t family)
+ {
+ const struct nf_conntrack_tuple_hash *found;
+ struct xt_connlimit_conn *conn;
+@@ -113,8 +113,7 @@ static int count_them(struct xt_connlimi
+ bool addit = true;
+ int matches = 0;
+
+-
+- if (match->family == NFPROTO_IPV6)
++ if (family == NFPROTO_IPV6)
+ hash = &data->iphash[connlimit_iphash6(addr, mask)];
+ else
+ hash = &data->iphash[connlimit_iphash(addr->ip & mask->ip)];
+@@ -157,8 +156,7 @@ static int count_them(struct xt_connlimi
+ continue;
+ }
+
+- if (same_source_net(addr, mask, &conn->tuple.src.u3,
+- match->family))
++ if (same_source_net(addr, mask, &conn->tuple.src.u3, family))
+ /* same source network -> be counted! */
+ ++matches;
+ nf_ct_put(found_ct);
+@@ -207,7 +205,7 @@ connlimit_mt(const struct sk_buff *skb,
+
+ spin_lock_bh(&info->data->lock);
+ connections = count_them(info->data, tuple_ptr, &addr,
+- &info->mask, par->match);
++ &info->mask, par->family);
+ spin_unlock_bh(&info->data->lock);
+
+ if (connections < 0) {
--- /dev/null
+From 30fc24b5cbc55f9e6c686e2710cc812419bddc0c Mon Sep 17 00:00:00 2001
+From: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
+Date: Wed, 7 Oct 2009 09:28:56 -0700
+Subject: PCI: Prevent AER driver from being loaded on non-root port PCIE devices
+
+From: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
+
+commit 30fc24b5cbc55f9e6c686e2710cc812419bddc0c upstream.
+
+A bug was seen on boards using a PLX 8518 switch device which advertises
+AER on each of it's transparent bridges. The AER driver was loaded for
+each bridge and this driver tried to access the AER source ID register
+whenever an interrupt occured on the shared PCI INTX lines. The source
+ID register does not exist on non root port PCIE device's which
+advertise AER and trying to access this register causes a unsupported
+request error on the bridge. Thus, when the next interrupt occurs,
+another error is found and the non existent source ID register is
+accessed again, and so it goes on.
+
+The result is a spammed dmesg with unsupported request PCI express
+errors on the bridge device that the AER driver is loaded against.
+
+Reported-by: Malcolm Crossley <malcolm.crossley2@gefanuc.com>
+Signed-off-by: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
+Tested-by: Malcolm Crossley <malcolm.crossley2@gefanuc.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Cc: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/pcie/aer/aerdrv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pci/pcie/aer/aerdrv.c
++++ b/drivers/pci/pcie/aer/aerdrv.c
+@@ -52,7 +52,7 @@ static struct pci_error_handlers aer_err
+
+ static struct pcie_port_service_driver aerdriver = {
+ .name = "aer",
+- .port_type = PCIE_ANY_PORT,
++ .port_type = PCIE_RC_PORT,
+ .service = PCIE_PORT_SERVICE_AER,
+
+ .probe = aer_probe,
--- /dev/null
+From 03541f8b69c058162e4cf9675ec9181e6a204d55 Mon Sep 17 00:00:00 2001
+From: Paul Mackerras <paulus@samba.org>
+Date: Wed, 14 Oct 2009 16:58:03 +1100
+Subject: perf_event: Adjust frequency and unthrottle for non-group-leader events
+
+From: Paul Mackerras <paulus@samba.org>
+
+commit 03541f8b69c058162e4cf9675ec9181e6a204d55 upstream.
+
+The loop in perf_ctx_adjust_freq checks the frequency of sampling
+event counters, and adjusts the event interval and unthrottles the
+event if required, and resets the interrupt count for the event.
+However, at present it only looks at group leaders.
+
+This means that a sampling event that is not a group leader will
+eventually get throttled, once its interrupt count reaches
+sysctl_perf_event_sample_rate/HZ --- and that is guaranteed to
+happen, if the event is active for long enough, since the interrupt
+count never gets reset. Once it is throttled it never gets
+unthrottled, so it basically just stops working at that point.
+
+This fixes it by making perf_ctx_adjust_freq use ctx->event_list
+rather than ctx->group_list. The existing spin_lock/spin_unlock
+around the loop makes it unnecessary to put rcu_read_lock/
+rcu_read_unlock around the list_for_each_entry_rcu().
+
+Reported-by: Mark W. Krentel <krentel@cs.rice.edu>
+Signed-off-by: Paul Mackerras <paulus@samba.org>
+Cc: Corey Ashford <cjashfor@linux.vnet.ibm.com>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+LKML-Reference: <19157.26731.855609.165622@cargo.ozlabs.ibm.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/perf_counter.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/perf_counter.c
++++ b/kernel/perf_counter.c
+@@ -1363,7 +1363,7 @@ static void perf_ctx_adjust_freq(struct
+ u64 interrupts, freq;
+
+ spin_lock(&ctx->lock);
+- list_for_each_entry(counter, &ctx->counter_list, list_entry) {
++ list_for_each_entry_rcu(counter, &ctx->counter_list, event_entry) {
+ if (counter->state != PERF_COUNTER_STATE_ACTIVE)
+ continue;
+
param-don-t-complain-about-unused-module-parameters.patch
modules-don-t-export-section-names-of-empty-sections-via-sysfs.patch
md-revert-incorrect-fix-for-read-error-handling-in-raid1.patch
+perf_event-adjust-frequency-and-unthrottle-for-non-group-leader-events.patch
+hso-fix-soft-lockup.patch
+block-use-after-free-bug-in-__blkdev_get.patch
+hwmon-adt7475-fix-temperature-fault-flags.patch
+hwmon-adt7475-cache-limits-for-60-seconds.patch
+agp-intel-new-host-bridge-support.patch
+netfilter-nf_nat-fix-nat-issue-in-2.6.30.4.patch
+netfilter-xt_connlimit-fix-regression-caused-by-zero-family-value.patch
+b43-fix-dma-tx-bounce-buffer-copying.patch
+crypto-padlock-aes-use-the-correct-mask-when-checking-whether-copying-is-required.patch
+sky2-set-carrier-off-in-probe.patch
+ath5k-linear-pcdac-code-fixes.patch
+i2c-fix-userspace_device-list-corruption.patch
+acerhdf-fix-fan-control-for-aoa150-model.patch
+drm-fb-fix-fbioget-put_vscreeninfo-pixel-clock-handling.patch
+tty-of_serial-add-missing-ns16550a-id.patch
+v4l-dvb-13255-gspca-m5602-s5k4aa-add-vflip-quirk-for-the-bruneinit-laptop.patch
+v4l-dvb-13256-gspca-m5602-s5k4aa-add-another-msi-gx700-vflip-quirk.patch
+v4l-dvb-13257-gspca-m5602-s5k4aa-add-vflip-for-fujitsu-amilo-xi-2528.patch
+pci-prevent-aer-driver-from-being-loaded-on-non-root-port-pcie-devices.patch
+acerhdf-additional-bios-versions.patch
+acerhdf-return-temperature-in-milidegree-instead-of-degree.patch
+input-keyboard-fix-braille-keyboard-keysym-generation.patch
+isdn-hfc_usb-fix-read-buffer-overflow.patch
--- /dev/null
+From 33cb7d33a1c36e07839d08a4d1a33bf6a0f70bba Mon Sep 17 00:00:00 2001
+From: Brandon Philips <bphilips@suse.de>
+Date: Thu, 29 Oct 2009 13:58:07 +0000
+Subject: sky2: set carrier off in probe
+
+From: Brandon Philips <bphilips@suse.de>
+
+commit 33cb7d33a1c36e07839d08a4d1a33bf6a0f70bba upstream.
+
+Before bringing up a sky2 interface up ethtool reports
+"Link detected: yes". Do as ixgbe does and netif_carrier_off() on
+probe().
+
+Signed-off-by: Brandon Philips <bphilips@suse.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/sky2.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/sky2.c
++++ b/drivers/net/sky2.c
+@@ -4528,6 +4528,8 @@ static int __devinit sky2_probe(struct p
+ goto err_out_free_netdev;
+ }
+
++ netif_carrier_off(dev);
++
+ netif_napi_add(dev, &hw->napi, sky2_poll, NAPI_WEIGHT);
+
+ err = request_irq(pdev->irq, sky2_intr,
--- /dev/null
+From 16173c7c2d79da7eb89b41acfdebd74b130f4339 Mon Sep 17 00:00:00 2001
+From: Michal Simek <monstr@monstr.eu>
+Date: Tue, 24 Nov 2009 10:22:41 +0000
+Subject: tty/of_serial: add missing ns16550a id
+
+From: Michal Simek <monstr@monstr.eu>
+
+commit 16173c7c2d79da7eb89b41acfdebd74b130f4339 upstream.
+
+Many boards have a bug-free ns16550 compatible serial port, which we should
+register as PORT_16550A. This introduces a new value "ns16550a" for the
+compatible property of of_serial to let a firmware choose that model instead
+of using the crippled PORT_16550 mode.
+
+Reported-by: Alon Ziv <alonz@nolaviz.org>
+Signed-off-by: Michal Simek <monstr@monstr.eu>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/serial/of_serial.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/serial/of_serial.c
++++ b/drivers/serial/of_serial.c
+@@ -161,6 +161,7 @@ static int of_platform_serial_remove(str
+ static struct of_device_id __devinitdata of_platform_serial_table[] = {
+ { .type = "serial", .compatible = "ns8250", .data = (void *)PORT_8250, },
+ { .type = "serial", .compatible = "ns16450", .data = (void *)PORT_16450, },
++ { .type = "serial", .compatible = "ns16550a", .data = (void *)PORT_16550A, },
+ { .type = "serial", .compatible = "ns16550", .data = (void *)PORT_16550, },
+ { .type = "serial", .compatible = "ns16750", .data = (void *)PORT_16750, },
+ { .type = "serial", .compatible = "ns16850", .data = (void *)PORT_16850, },
--- /dev/null
+From b6ef8836c1ff5199abd40cfba162052bc7e8af00 Mon Sep 17 00:00:00 2001
+From: Erik Andrén <erik.andren@gmail.com>
+Date: Sun, 27 Sep 2009 10:11:43 -0300
+Subject: V4L/DVB (13255): gspca - m5602-s5k4aa: Add vflip quirk for the Bruneinit laptop
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Erik Andrén <erik.andren@gmail.com>
+
+commit b6ef8836c1ff5199abd40cfba162052bc7e8af00 upstream.
+
+Adds a vflip quirk for the Bruneinit laptop. Thanks to Jörg for the report
+
+Signed-off-by: Erik Andrén <erik.andren@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/gspca/m5602/m5602_s5k4aa.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
++++ b/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
+@@ -35,6 +35,13 @@ static
+ const
+ struct dmi_system_id s5k4aa_vflip_dmi_table[] = {
+ {
++ .ident = "BRUNEINIT",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "BRUNENIT"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "BRUNENIT"),
++ DMI_MATCH(DMI_BOARD_VERSION, "00030D0000000001")
++ }
++ }, {
+ .ident = "Fujitsu-Siemens Amilo Xa 2528",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
--- /dev/null
+From 2339a1887dab469bb4bae56aa7eca3a5e05ecde7 Mon Sep 17 00:00:00 2001
+From: Erik Andrén <erik.andren@gmail.com>
+Date: Sun, 27 Sep 2009 10:20:21 -0300
+Subject: V4L/DVB (13256): gspca - m5602-s5k4aa: Add another MSI GX700 vflip quirk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Erik Andrén <erik.andren@gmail.com>
+
+commit 2339a1887dab469bb4bae56aa7eca3a5e05ecde7 upstream.
+
+Adds another vflip quirk for the MSI GX700.
+Thanks to John Katzmaier for reporting.
+
+Signed-off-by: Erik Andrén <erik.andren@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/gspca/m5602/m5602_s5k4aa.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
++++ b/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
+@@ -58,6 +58,13 @@ static
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Micro-Star International"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "GX700"),
++ DMI_MATCH(DMI_BIOS_DATE, "12/02/2008")
++ }
++ }, {
++ .ident = "MSI GX700",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Micro-Star International"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "GX700"),
+ DMI_MATCH(DMI_BIOS_DATE, "07/26/2007")
+ }
+ }, {
--- /dev/null
+From 81191f694cb507c49d3c7aa6238dcc0a83ad4001 Mon Sep 17 00:00:00 2001
+From: Erik Andrén <erik.andren@gmail.com>
+Date: Sat, 3 Oct 2009 10:01:41 -0300
+Subject: V4L/DVB (13257): gspca - m5602-s5k4aa: Add vflip for Fujitsu Amilo Xi 2528
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Erik Andrén <erik.andren@gmail.com>
+
+commit 81191f694cb507c49d3c7aa6238dcc0a83ad4001 upstream.
+
+Adds a vflip quirk for the Fujitsu Amilo Xi 2528. Thanks to Evgeny for the report.
+
+Signed-off-by: Erik Andrén <erik.andren@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+
+diff --git a/drivers/media/video/gspca/m5602/m5602_s5k4aa.c b/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
+index ef4ae68..a27afeb 100644
+--- a/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
++++ b/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
+@@ -48,6 +48,12 @@ static
+ DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xa 2528")
+ }
+ }, {
++ .ident = "Fujitsu-Siemens Amilo Xi 2528",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xi 2528")
++ }
++ }, {
+ .ident = "Fujitsu-Siemens Amilo Xi 2550",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
projects / thirdparty / kernel / stable-queue.git / commitdiff
