--- /dev/null
+From 3e517f4b1de4787ecff87a73a9865a0b1aa2b10b Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Sun, 16 Jan 2011 05:16:14 +0000
+Subject: 68360serial: Plumb in rs_360_get_icount()
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+commit 3e517f4b1de4787ecff87a73a9865a0b1aa2b10b upstream.
+
+Commit 0587102cf9f427c185bfdeb2cef41e13ee0264b1 replaced a direct
+implementation of SIOCGICOUNT with an implementation of
+tty_operations::get_icount, but it did not actually set
+rs_360_ops.get_icount.
+
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/serial/68360serial.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/serial/68360serial.c
++++ b/drivers/serial/68360serial.c
+@@ -2428,6 +2428,7 @@ static const struct tty_operations rs_36
+ /* .read_proc = rs_360_read_proc, */
+ .tiocmget = rs_360_tiocmget,
+ .tiocmset = rs_360_tiocmset,
++ .get_icount = rs_360_get_icount,
+ };
+
+ static int __init rs_360_init(void)
--- /dev/null
+From b0a2679d27408d97ce31e5f800b44227d3388b84 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Sun, 30 Jan 2011 11:21:05 +0000
+Subject: ARM: initrd: disable initrd if passed address overlaps reserved region
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit b0a2679d27408d97ce31e5f800b44227d3388b84 upstream.
+
+Disable the initrd if the passed address already overlaps the reserved
+region. This avoids oopses on Netwinders when NeTTrom tells the kernel
+that an initrd is located at mem+4MB, but this overlaps the BSS,
+resulting in the kernels in-use BSS being freed.
+
+This should be applied to v2.6.37-stable.
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/mm/init.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/arch/arm/mm/init.c
++++ b/arch/arm/mm/init.c
+@@ -297,6 +297,12 @@ void __init arm_memblock_init(struct mem
+ memblock_reserve(__pa(_stext), _end - _stext);
+ #endif
+ #ifdef CONFIG_BLK_DEV_INITRD
++ if (phys_initrd_size &&
++ memblock_is_region_reserved(phys_initrd_start, phys_initrd_size)) {
++ pr_err("INITRD: 0x%08lx+0x%08lx overlaps in-use memory region - disabling initrd\n",
++ phys_initrd_start, phys_initrd_size);
++ phys_initrd_start = phys_initrd_size = 0;
++ }
+ if (phys_initrd_size) {
+ memblock_reserve(phys_initrd_start, phys_initrd_size);
+
--- /dev/null
+From a50eb1c7680973f5441ca20ac4da0af2055d0d87 Mon Sep 17 00:00:00 2001
+From: Changhwan Youn <chaos.youn@samsung.com>
+Date: Fri, 26 Nov 2010 13:21:53 +0900
+Subject: ARM: S5PV310: Set bit 22 in the PL310 (cache controller) AuxCtlr register
+
+From: Changhwan Youn <chaos.youn@samsung.com>
+
+commit a50eb1c7680973f5441ca20ac4da0af2055d0d87 upstream.
+
+This patch is applied according to the commit 1a8e41cd672f894bbd74874eac601e6cedf838fb
+(ARM: 6395/1: VExpress: Set bit 22 in the PL310 (cache controller) AuxCtlr register).
+
+Actually, S5PV310 has same cache controller(PL310).
+
+Following is from Catalin Marinas' commit.
+
+Clearing bit 22 in the PL310 Auxiliary Control register (shared
+attribute override enable) has the side effect of transforming Normal
+Shared Non-cacheable reads into Cacheable no-allocate reads.
+
+Coherent DMA buffers in Linux always have a Cacheable alias via the
+kernel linear mapping and the processor can speculatively load cache
+lines into the PL310 controller. With bit 22 cleared, Non-cacheable
+reads would unexpectedly hit such cache lines leading to buffer
+corruption.
+
+Signed-off-by: Changhwan Youn <chaos.youn@samsung.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Kukjin Kim <kgene.kim@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/mach-s5pv310/cpu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/mach-s5pv310/cpu.c
++++ b/arch/arm/mach-s5pv310/cpu.c
+@@ -168,7 +168,7 @@ static int __init s5pv310_l2x0_cache_ini
+ __raw_writel(L2X0_DYNAMIC_CLK_GATING_EN | L2X0_STNDBY_MODE_EN,
+ S5P_VA_L2CC + L2X0_POWER_CTRL);
+
+- l2x0_init(S5P_VA_L2CC, 0x7C070001, 0xC200ffff);
++ l2x0_init(S5P_VA_L2CC, 0x7C470001, 0xC200ffff);
+
+ return 0;
+ }
--- /dev/null
+From a3adfa00e8089aa72826c6ba04bcb18cfceaf0a9 Mon Sep 17 00:00:00 2001
+From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+Date: Fri, 21 Jan 2011 22:14:17 +0300
+Subject: ASoC: correct link specifications for corgi, poodle and spitz
+
+From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+
+commit a3adfa00e8089aa72826c6ba04bcb18cfceaf0a9 upstream.
+
+ASoC DAI link descriptions for Corgi, Poodle and Spitz platforms
+contained incorrect names for cpu_dai and codec, which effectievly disabled sound
+on theese platforms. Fix that errors.
+
+Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/pxa/corgi.c | 4 ++--
+ sound/soc/pxa/poodle.c | 2 +-
+ sound/soc/pxa/spitz.c | 4 ++--
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/sound/soc/pxa/corgi.c
++++ b/sound/soc/pxa/corgi.c
+@@ -305,10 +305,10 @@ static int corgi_wm8731_init(struct snd_
+ static struct snd_soc_dai_link corgi_dai = {
+ .name = "WM8731",
+ .stream_name = "WM8731",
+- .cpu_dai_name = "pxa-is2-dai",
++ .cpu_dai_name = "pxa2xx-i2s",
+ .codec_dai_name = "wm8731-hifi",
+ .platform_name = "pxa-pcm-audio",
+- .codec_name = "wm8731-codec-0.001a",
++ .codec_name = "wm8731-codec-0.001b",
+ .init = corgi_wm8731_init,
+ .ops = &corgi_ops,
+ };
+--- a/sound/soc/pxa/poodle.c
++++ b/sound/soc/pxa/poodle.c
+@@ -274,7 +274,7 @@ static struct snd_soc_dai_link poodle_da
+ .cpu_dai_name = "pxa2xx-i2s",
+ .codec_dai_name = "wm8731-hifi",
+ .platform_name = "pxa-pcm-audio",
+- .codec_name = "wm8731-codec.0-001a",
++ .codec_name = "wm8731-codec.0-001b",
+ .init = poodle_wm8731_init,
+ .ops = &poodle_ops,
+ };
+--- a/sound/soc/pxa/spitz.c
++++ b/sound/soc/pxa/spitz.c
+@@ -313,10 +313,10 @@ static int spitz_wm8750_init(struct snd_
+ static struct snd_soc_dai_link spitz_dai = {
+ .name = "wm8750",
+ .stream_name = "WM8750",
+- .cpu_dai_name = "pxa-is2",
++ .cpu_dai_name = "pxa2xx-i2s",
+ .codec_dai_name = "wm8750-hifi",
+ .platform_name = "pxa-pcm-audio",
+- .codec_name = "wm8750-codec.0-001a",
++ .codec_name = "wm8750-codec.0-001b",
+ .init = spitz_wm8750_init,
+ .ops = &spitz_ops,
+ };
--- /dev/null
+From 7f94de483f4e37e14d646ad6e85a3c82f66fb487 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Thu, 3 Feb 2011 16:27:34 +0000
+Subject: ASoC: Create an AIF1ADCDAT signal widget to match AIF2
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit 7f94de483f4e37e14d646ad6e85a3c82f66fb487 upstream.
+
+Due to the different routing for AIF1 and AIF2 we weren't using a
+single widget to represent the ADCDAT signal. For consistency add
+one.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm8994.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -2536,18 +2536,18 @@ SND_SOC_DAPM_SUPPLY("DSPINTCLK", WM8994_
+ SND_SOC_DAPM_SUPPLY("AIF1CLK", WM8994_AIF1_CLOCKING_1, 0, 0, NULL, 0),
+ SND_SOC_DAPM_SUPPLY("AIF2CLK", WM8994_AIF2_CLOCKING_1, 0, 0, NULL, 0),
+
+-SND_SOC_DAPM_AIF_OUT("AIF1ADC1L", "AIF1 Capture",
++SND_SOC_DAPM_AIF_OUT("AIF1ADC1L", NULL,
+ 0, WM8994_POWER_MANAGEMENT_4, 9, 0),
+-SND_SOC_DAPM_AIF_OUT("AIF1ADC1R", "AIF1 Capture",
++SND_SOC_DAPM_AIF_OUT("AIF1ADC1R", NULL,
+ 0, WM8994_POWER_MANAGEMENT_4, 8, 0),
+ SND_SOC_DAPM_AIF_IN("AIF1DAC1L", NULL, 0,
+ WM8994_POWER_MANAGEMENT_5, 9, 0),
+ SND_SOC_DAPM_AIF_IN("AIF1DAC1R", NULL, 0,
+ WM8994_POWER_MANAGEMENT_5, 8, 0),
+
+-SND_SOC_DAPM_AIF_OUT("AIF1ADC2L", "AIF1 Capture",
++SND_SOC_DAPM_AIF_OUT("AIF1ADC2L", NULL,
+ 0, WM8994_POWER_MANAGEMENT_4, 11, 0),
+-SND_SOC_DAPM_AIF_OUT("AIF1ADC2R", "AIF1 Capture",
++SND_SOC_DAPM_AIF_OUT("AIF1ADC2R", NULL,
+ 0, WM8994_POWER_MANAGEMENT_4, 10, 0),
+ SND_SOC_DAPM_AIF_IN("AIF1DAC2L", NULL, 0,
+ WM8994_POWER_MANAGEMENT_5, 11, 0),
+@@ -2588,6 +2588,7 @@ SND_SOC_DAPM_AIF_IN("AIF2DACR", NULL, 0,
+
+ SND_SOC_DAPM_AIF_IN("AIF1DACDAT", "AIF1 Playback", 0, SND_SOC_NOPM, 0, 0),
+ SND_SOC_DAPM_AIF_IN("AIF2DACDAT", "AIF2 Playback", 0, SND_SOC_NOPM, 0, 0),
++SND_SOC_DAPM_AIF_OUT("AIF1ADCDAT", "AIF1 Capture", 0, SND_SOC_NOPM, 0, 0),
+ SND_SOC_DAPM_AIF_OUT("AIF2ADCDAT", "AIF2 Capture", 0, SND_SOC_NOPM, 0, 0),
+
+ SND_SOC_DAPM_MUX("AIF1DAC Mux", SND_SOC_NOPM, 0, 0, &aif1dac_mux),
+@@ -2783,6 +2784,11 @@ static const struct snd_soc_dapm_route i
+ { "AIF2DAC2R Mixer", "Left Sidetone Switch", "Left Sidetone" },
+ { "AIF2DAC2R Mixer", "Right Sidetone Switch", "Right Sidetone" },
+
++ { "AIF1ADCDAT", NULL, "AIF1ADC1L" },
++ { "AIF1ADCDAT", NULL, "AIF1ADC1R" },
++ { "AIF1ADCDAT", NULL, "AIF1ADC2L" },
++ { "AIF1ADCDAT", NULL, "AIF1ADC2R" },
++
+ { "AIF2ADCDAT", NULL, "AIF2ADC Mux" },
+
+ /* AIF3 output */
--- /dev/null
+From dc5a460a1bfa44273653700e33d4e7051194cbfd Mon Sep 17 00:00:00 2001
+From: Rajashekhara, Sudhakar <sudhakar.raj@ti.com>
+Date: Fri, 21 Jan 2011 20:10:01 +0530
+Subject: ASoC: da8xx/omap-l1xx: match codec_name with i2c ids
+
+From: Rajashekhara, Sudhakar <sudhakar.raj@ti.com>
+
+commit dc5a460a1bfa44273653700e33d4e7051194cbfd upstream.
+
+The codec_name entry for da8xx evm in sound/soc/davinci/davinci-evm.c
+is not matching with the i2c ids in the board file. Without this fix the
+soundcard does not get detected on da850/omap-l138/am18x evm.
+
+Signed-off-by: Rajashekhara, Sudhakar <sudhakar.raj@ti.com>
+Tested-by: Dan Sharon <dansharon@nanometrics.ca>
+Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/davinci/davinci-evm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/davinci/davinci-evm.c
++++ b/sound/soc/davinci/davinci-evm.c
+@@ -224,7 +224,7 @@ static struct snd_soc_dai_link da8xx_evm
+ .stream_name = "AIC3X",
+ .cpu_dai_name= "davinci-mcasp.0",
+ .codec_dai_name = "tlv320aic3x-hifi",
+- .codec_name = "tlv320aic3x-codec.0-001a",
++ .codec_name = "tlv320aic3x-codec.1-0018",
+ .platform_name = "davinci-pcm-audio",
+ .init = evm_aic3x_init,
+ .ops = &evm_ops,
--- /dev/null
+From 7d8316df44053687625eef792d53b3ac62e82248 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Mon, 13 Dec 2010 17:03:27 +0000
+Subject: ASoC: Fix AC'97 registration unwind
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit 7d8316df44053687625eef792d53b3ac62e82248 upstream.
+
+soc_unregister_ac97_dai_link() takes a CODEC as an argument, not a
+rtd like the registration function, so give it what it's looking for.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
+Reported-by: Mike Frysinger <vapier.adi@gmail.com>
+Acked-by: Mike Frysinger <vapier@gentoo.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/soc-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -1623,7 +1623,7 @@ static void snd_soc_instantiate_card(str
+ if (ret < 0) {
+ printk(KERN_ERR "asoc: failed to register AC97 %s\n", card->name);
+ while (--i >= 0)
+- soc_unregister_ac97_dai_link(&card->rtd[i]);
++ soc_unregister_ac97_dai_link(card->rtd[i].codec);
+ goto probe_dai_err;
+ }
+ }
--- /dev/null
+From 20a4e7fc7e213365ea3771d7bf1e10a6bab853be Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Fri, 21 Jan 2011 12:47:33 +0000
+Subject: ASoC: Handle low measured DC offsets for wm_hubs devices
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit 20a4e7fc7e213365ea3771d7bf1e10a6bab853be upstream.
+
+The DC servo codes are actually signed numbers so need to be treated as
+such.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm_hubs.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+--- a/sound/soc/codecs/wm_hubs.c
++++ b/sound/soc/codecs/wm_hubs.c
+@@ -92,6 +92,7 @@ static void wait_for_dc_servo(struct snd
+ static void calibrate_dc_servo(struct snd_soc_codec *codec)
+ {
+ struct wm_hubs_data *hubs = snd_soc_codec_get_drvdata(codec);
++ s8 offset;
+ u16 reg, reg_l, reg_r, dcs_cfg;
+
+ /* Set for 32 series updates */
+@@ -130,16 +131,14 @@ static void calibrate_dc_servo(struct sn
+ dev_dbg(codec->dev, "DCS input: %x %x\n", reg_l, reg_r);
+
+ /* HPOUT1L */
+- if (reg_l + hubs->dcs_codes > 0 &&
+- reg_l + hubs->dcs_codes < 0xff)
+- reg_l += hubs->dcs_codes;
+- dcs_cfg = reg_l << WM8993_DCS_DAC_WR_VAL_1_SHIFT;
++ offset = reg_l;
++ offset += hubs->dcs_codes;
++ dcs_cfg = (u8)offset << WM8993_DCS_DAC_WR_VAL_1_SHIFT;
+
+ /* HPOUT1R */
+- if (reg_r + hubs->dcs_codes > 0 &&
+- reg_r + hubs->dcs_codes < 0xff)
+- reg_r += hubs->dcs_codes;
+- dcs_cfg |= reg_r;
++ offset = reg_r;
++ offset += hubs->dcs_codes;
++ dcs_cfg |= (u8)offset;
+
+ dev_dbg(codec->dev, "DCS result: %x\n", dcs_cfg);
+
--- /dev/null
+From 78b3fb46753872fc79bffecc8d50355a8622b39b Mon Sep 17 00:00:00 2001
+From: Qiao Zhou <zhouqiao@marvell.com>
+Date: Wed, 19 Jan 2011 19:10:47 +0800
+Subject: ASoC: WM8994: fix wrong value in tristate function
+
+From: Qiao Zhou <zhouqiao@marvell.com>
+
+commit 78b3fb46753872fc79bffecc8d50355a8622b39b upstream.
+
+fix wrong value in wm8994_set_tristate func. when updating reg bits,
+it should use "value", not "reg".
+
+Signed-off-by: Qiao Zhou <zhouqiao@marvell.com>
+Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm8994.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -3513,7 +3513,7 @@ static int wm8994_set_tristate(struct sn
+ else
+ val = 0;
+
+- return snd_soc_update_bits(codec, reg, mask, reg);
++ return snd_soc_update_bits(codec, reg, mask, val);
+ }
+
+ #define WM8994_RATES SNDRV_PCM_RATE_8000_96000
--- /dev/null
+From 664cb7142ced8b827e92e1851d1ed2cae922f225 Mon Sep 17 00:00:00 2001
+From: Hans-Christian Egtvedt <hans-christian.egtvedt@atmel.com>
+Date: Thu, 9 Dec 2010 00:19:33 +0100
+Subject: avr32: use syscall prototypes from asm-generic instead of arch
+
+From: Hans-Christian Egtvedt <hans-christian.egtvedt@atmel.com>
+
+commit 664cb7142ced8b827e92e1851d1ed2cae922f225 upstream.
+
+This patch removes the redundant syscalls prototypes in the architecture
+specific syscalls.h header file. These were identical with the ones in
+asm-generic/syscalls.h.
+
+Signed-off-by: Hans-Christian Egtvedt <hans-christian.egtvedt@atmel.com>
+Reported-by: Peter Huewe <PeterHuewe@gmx.de>
+Reported-by: Sven Schnelle <svens@stackframe.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/avr32/include/asm/syscalls.h | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+--- a/arch/avr32/include/asm/syscalls.h
++++ b/arch/avr32/include/asm/syscalls.h
+@@ -16,18 +16,9 @@
+ #include <linux/signal.h>
+
+ /* kernel/process.c */
+-asmlinkage int sys_fork(struct pt_regs *);
+ asmlinkage int sys_clone(unsigned long, unsigned long,
+ unsigned long, unsigned long,
+ struct pt_regs *);
+-asmlinkage int sys_vfork(struct pt_regs *);
+-asmlinkage int sys_execve(const char __user *, char __user *__user *,
+- char __user *__user *, struct pt_regs *);
+-
+-/* kernel/signal.c */
+-asmlinkage int sys_sigaltstack(const stack_t __user *, stack_t __user *,
+- struct pt_regs *);
+-asmlinkage int sys_rt_sigreturn(struct pt_regs *);
+
+ /* mm/cache.c */
+ asmlinkage int sys_cacheflush(int, void __user *, size_t);
--- /dev/null
+From 5820de5303f73d48dcc3a053c875d1f0da7eef67 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@googlemail.com>
+Date: Thu, 3 Feb 2011 22:22:55 +0100
+Subject: carl9170: fix typo in PS code
+
+From: Christian Lamparter <chunkeey@googlemail.com>
+
+commit 5820de5303f73d48dcc3a053c875d1f0da7eef67 upstream.
+
+This patch fixes a off-by-one bug which bugged
+the driver's PS-POLL capability.
+
+Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/carl9170/rx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/carl9170/rx.c
++++ b/drivers/net/wireless/ath/carl9170/rx.c
+@@ -564,7 +564,7 @@ static void carl9170_ps_beacon(struct ar
+ cam = ieee80211_check_tim(tim_ie, tim_len, ar->common.curaid);
+
+ /* 2. Maybe the AP wants to send multicast/broadcast data? */
+- cam = !!(tim_ie->bitmap_ctrl & 0x01);
++ cam |= !!(tim_ie->bitmap_ctrl & 0x01);
+
+ if (!cam) {
+ /* back to low-power land. */
--- /dev/null
+From d8c216cfa57e8a579f41729cbb88c97835d9ac8d Mon Sep 17 00:00:00 2001
+From: Rafael J. Wysocki <rjw@sisk.pl>
+Date: Sat, 8 Jan 2011 00:29:20 +0100
+Subject: cpuidle: Make cpuidle_enable_device() call poll_idle_init()
+
+From: Rafael J. Wysocki <rjw@sisk.pl>
+
+commit d8c216cfa57e8a579f41729cbb88c97835d9ac8d upstream.
+
+The following scenario is possible with the current cpuidle code and
+the ACPI cpuidle driver:
+(1) acpi_processor_cst_has_changed() is called,
+(2) cpuidle_disable_device() is called,
+(3) cpuidle_remove_state_sysfs() is called to remove the (presumably
+ outdated) states info from sysfs,
+(3) acpi_processor_get_power_info() is called, the first entry in the
+ pr->power.states[] table is filled with zeros,
+(4) acpi_processor_setup_cpuidle() is called and it doesn't fill the
+ first entry in pr->power.states[],
+(5) cpuidle_enable_device() is called,
+(6) __cpuidle_register_device() is _not_ called, since the device has
+ already been registered,
+(7) Consequently, poll_idle_init() is _not_ called either,
+(8) cpuidle_add_state_sysfs() is called to create the sysfs attributes
+ for the new states and it uses the bogus first table entry from
+ acpi_processor_get_power_info() for creating state0.
+
+This problem is avoided if cpuidle_enable_device()
+unconditionally calls poll_idle_init().
+
+Reported-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/cpuidle/cpuidle.c | 82 +++++++++++++++++++++++-----------------------
+ 1 file changed, 41 insertions(+), 41 deletions(-)
+
+--- a/drivers/cpuidle/cpuidle.c
++++ b/drivers/cpuidle/cpuidle.c
+@@ -154,6 +154,45 @@ void cpuidle_resume_and_unlock(void)
+
+ EXPORT_SYMBOL_GPL(cpuidle_resume_and_unlock);
+
++#ifdef CONFIG_ARCH_HAS_CPU_RELAX
++static int poll_idle(struct cpuidle_device *dev, struct cpuidle_state *st)
++{
++ ktime_t t1, t2;
++ s64 diff;
++ int ret;
++
++ t1 = ktime_get();
++ local_irq_enable();
++ while (!need_resched())
++ cpu_relax();
++
++ t2 = ktime_get();
++ diff = ktime_to_us(ktime_sub(t2, t1));
++ if (diff > INT_MAX)
++ diff = INT_MAX;
++
++ ret = (int) diff;
++ return ret;
++}
++
++static void poll_idle_init(struct cpuidle_device *dev)
++{
++ struct cpuidle_state *state = &dev->states[0];
++
++ cpuidle_set_statedata(state, NULL);
++
++ snprintf(state->name, CPUIDLE_NAME_LEN, "C0");
++ snprintf(state->desc, CPUIDLE_DESC_LEN, "CPUIDLE CORE POLL IDLE");
++ state->exit_latency = 0;
++ state->target_residency = 0;
++ state->power_usage = -1;
++ state->flags = CPUIDLE_FLAG_POLL;
++ state->enter = poll_idle;
++}
++#else
++static void poll_idle_init(struct cpuidle_device *dev) {}
++#endif /* CONFIG_ARCH_HAS_CPU_RELAX */
++
+ /**
+ * cpuidle_enable_device - enables idle PM for a CPU
+ * @dev: the CPU
+@@ -178,6 +217,8 @@ int cpuidle_enable_device(struct cpuidle
+ return ret;
+ }
+
++ poll_idle_init(dev);
++
+ if ((ret = cpuidle_add_state_sysfs(dev)))
+ return ret;
+
+@@ -232,45 +273,6 @@ void cpuidle_disable_device(struct cpuid
+
+ EXPORT_SYMBOL_GPL(cpuidle_disable_device);
+
+-#ifdef CONFIG_ARCH_HAS_CPU_RELAX
+-static int poll_idle(struct cpuidle_device *dev, struct cpuidle_state *st)
+-{
+- ktime_t t1, t2;
+- s64 diff;
+- int ret;
+-
+- t1 = ktime_get();
+- local_irq_enable();
+- while (!need_resched())
+- cpu_relax();
+-
+- t2 = ktime_get();
+- diff = ktime_to_us(ktime_sub(t2, t1));
+- if (diff > INT_MAX)
+- diff = INT_MAX;
+-
+- ret = (int) diff;
+- return ret;
+-}
+-
+-static void poll_idle_init(struct cpuidle_device *dev)
+-{
+- struct cpuidle_state *state = &dev->states[0];
+-
+- cpuidle_set_statedata(state, NULL);
+-
+- snprintf(state->name, CPUIDLE_NAME_LEN, "C0");
+- snprintf(state->desc, CPUIDLE_DESC_LEN, "CPUIDLE CORE POLL IDLE");
+- state->exit_latency = 0;
+- state->target_residency = 0;
+- state->power_usage = -1;
+- state->flags = CPUIDLE_FLAG_POLL;
+- state->enter = poll_idle;
+-}
+-#else
+-static void poll_idle_init(struct cpuidle_device *dev) {}
+-#endif /* CONFIG_ARCH_HAS_CPU_RELAX */
+-
+ /**
+ * __cpuidle_register_device - internal register function called before register
+ * and enable routines
+@@ -291,8 +293,6 @@ static int __cpuidle_register_device(str
+
+ init_completion(&dev->kobj_unregister);
+
+- poll_idle_init(dev);
+-
+ /*
+ * cpuidle driver should set the dev->power_specified bit
+ * before registering the device if the driver provides
--- /dev/null
+From 96a3e79edff6f41b0f115a82f1a39d66218077a7 Mon Sep 17 00:00:00 2001
+From: Dario Lombardo <dario.lombardo@libero.it>
+Date: Fri, 21 Jan 2011 15:35:19 +0100
+Subject: drivers: update to pl2303 usb-serial to support Motorola cables
+
+From: Dario Lombardo <dario.lombardo@libero.it>
+
+commit 96a3e79edff6f41b0f115a82f1a39d66218077a7 upstream.
+
+Added 0x0307 device id to support Motorola cables to the pl2303 usb
+serial driver. This cable has a modified chip that is a pl2303, but
+declares itself as 0307. Fixed by adding the right device id to the
+supported devices list, assigning it the code labeled
+PL2303_PRODUCT_ID_MOTOROLA.
+
+Signed-off-by: Dario Lombardo <dario.lombardo@libero.it>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/pl2303.c | 1 +
+ drivers/usb/serial/pl2303.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -50,6 +50,7 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MMX) },
+ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_GPRS) },
+ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) },
++ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MOTOROLA) },
+ { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
+ { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
+ { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -21,6 +21,7 @@
+ #define PL2303_PRODUCT_ID_MMX 0x0612
+ #define PL2303_PRODUCT_ID_GPRS 0x0609
+ #define PL2303_PRODUCT_ID_HCR331 0x331a
++#define PL2303_PRODUCT_ID_MOTOROLA 0x0307
+
+ #define ATEN_VENDOR_ID 0x0557
+ #define ATEN_VENDOR_ID2 0x0547
--- /dev/null
+From 86af95039b69a90db15294eb1f9c147f1df0a8ea Mon Sep 17 00:00:00 2001
+From: Sven Neumann <s.neumann@raumfeld.com>
+Date: Fri, 12 Nov 2010 11:36:22 +0100
+Subject: ds2760_battery: Fix calculation of time_to_empty_now
+
+From: Sven Neumann <s.neumann@raumfeld.com>
+
+commit 86af95039b69a90db15294eb1f9c147f1df0a8ea upstream.
+
+A check against division by zero was modified in commit b0525b48.
+Since this change time_to_empty_now is always reported as zero
+while the battery is discharging and as a negative value while
+the battery is charging. This is because current is negative while
+the battery is discharging.
+
+Fix the check introduced by commit b0525b48 so that time_to_empty_now
+is reported correctly during discharge and as zero while charging.
+
+Signed-off-by: Sven Neumann <s.neumann@raumfeld.com>
+Acked-by: Daniel Mack <daniel@caiaq.de>
+Signed-off-by: Anton Vorontsov <cbouatmailru@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/power/ds2760_battery.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/power/ds2760_battery.c
++++ b/drivers/power/ds2760_battery.c
+@@ -212,7 +212,7 @@ static int ds2760_battery_read_status(st
+ if (di->rem_capacity > 100)
+ di->rem_capacity = 100;
+
+- if (di->current_uA >= 100L)
++ if (di->current_uA < -100L)
+ di->life_sec = -((di->accum_current_uAh - di->empty_uAh) * 36L)
+ / (di->current_uA / 100L);
+ else
--- /dev/null
+From ec30f343d61391ab23705e50a525da1d55395780 Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shaohua.li@intel.com>
+Date: Mon, 24 Jan 2011 08:00:01 +0000
+Subject: fix a shutdown regression in intel_idle
+
+From: Shaohua Li <shaohua.li@intel.com>
+
+commit ec30f343d61391ab23705e50a525da1d55395780 upstream.
+
+Fix a shutdown regression caused by 2a2d31c8dc6f ("intel_idle: open
+broadcast clock event"). The clockevent framework can automatically
+shutdown broadcast timers for hotremove CPUs. And we get a shutdown
+regression when we shutdown broadcast timer for hot remove CPU, so just
+delete some code.
+
+Also fix some section mismatch.
+
+Reported-by: Ari Savolainen <ari.m.savolainen@gmail.com>
+Signed-off-by: Shaohua Li <shaohua.li@intel.com>
+Tested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/idle/intel_idle.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+--- a/drivers/idle/intel_idle.c
++++ b/drivers/idle/intel_idle.c
+@@ -258,7 +258,7 @@ static void __setup_broadcast_timer(void
+ clockevents_notify(reason, &cpu);
+ }
+
+-static int __cpuinit setup_broadcast_cpuhp_notify(struct notifier_block *n,
++static int setup_broadcast_cpuhp_notify(struct notifier_block *n,
+ unsigned long action, void *hcpu)
+ {
+ int hotcpu = (unsigned long)hcpu;
+@@ -268,15 +268,11 @@ static int __cpuinit setup_broadcast_cpu
+ smp_call_function_single(hotcpu, __setup_broadcast_timer,
+ (void *)true, 1);
+ break;
+- case CPU_DOWN_PREPARE:
+- smp_call_function_single(hotcpu, __setup_broadcast_timer,
+- (void *)false, 1);
+- break;
+ }
+ return NOTIFY_OK;
+ }
+
+-static struct notifier_block __cpuinitdata setup_broadcast_notifier = {
++static struct notifier_block setup_broadcast_notifier = {
+ .notifier_call = setup_broadcast_cpuhp_notify,
+ };
+
--- /dev/null
+From 70a062286b9dfcbd24d2e11601aecfead5cf709a Mon Sep 17 00:00:00 2001
+From: Tim Deegan <Tim.Deegan@citrix.com>
+Date: Thu, 10 Feb 2011 08:50:41 +0000
+Subject: fix jiffy calculations in calibrate_delay_direct to handle overflow
+
+From: Tim Deegan <Tim.Deegan@citrix.com>
+
+commit 70a062286b9dfcbd24d2e11601aecfead5cf709a upstream.
+
+Fixes a hang when booting as dom0 under Xen, when jiffies can be
+quite large by the time the kernel init gets this far.
+
+Signed-off-by: Tim Deegan <Tim.Deegan@citrix.com>
+[jbeulich@novell.com: !time_after() -> time_before_eq() as suggested by Jiri Slaby]
+Signed-off-by: Jan Beulich <jbeulich@novell.com>
+Cc: Jiri Slaby <jslaby@suse.cz>
+Cc: Jeremy Fitzhardinge <jeremy@goop.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ init/calibrate.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/init/calibrate.c
++++ b/init/calibrate.c
+@@ -66,7 +66,7 @@ static unsigned long __cpuinit calibrate
+ pre_start = 0;
+ read_current_timer(&start);
+ start_jiffies = jiffies;
+- while (jiffies <= (start_jiffies + 1)) {
++ while (time_before_eq(jiffies, start_jiffies + 1)) {
+ pre_start = start;
+ read_current_timer(&start);
+ }
+@@ -74,8 +74,8 @@ static unsigned long __cpuinit calibrate
+
+ pre_end = 0;
+ end = post_start;
+- while (jiffies <=
+- (start_jiffies + 1 + DELAY_CALIBRATION_TICKS)) {
++ while (time_before_eq(jiffies, start_jiffies + 1 +
++ DELAY_CALIBRATION_TICKS)) {
+ pre_end = end;
+ read_current_timer(&end);
+ }
--- /dev/null
+From aa5bd67dcfdf9af34c7fa36ebc87d4e1f7e91873 Mon Sep 17 00:00:00 2001
+From: Kacper Kornet <kornet@camk.edu.pl>
+Date: Sat, 29 Jan 2011 00:21:04 +0100
+Subject: Fix prlimit64 for suid/sgid processes
+
+From: Kacper Kornet <kornet@camk.edu.pl>
+
+commit aa5bd67dcfdf9af34c7fa36ebc87d4e1f7e91873 upstream.
+
+Since check_prlimit_permission always fails in the case of SUID/GUID
+processes, such processes are not able to read or set their own limits.
+This commit changes this by assuming that process can always read/change
+its own limits.
+
+Signed-off-by: Kacper Kornet <kornet@camk.edu.pl>
+Acked-by: Jiri Slaby <jslaby@suse.cz>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/sys.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/sys.c
++++ b/kernel/sys.c
+@@ -1377,7 +1377,8 @@ static int check_prlimit_permission(stru
+ const struct cred *cred = current_cred(), *tcred;
+
+ tcred = __task_cred(task);
+- if ((cred->uid != tcred->euid ||
++ if (current != task &&
++ (cred->uid != tcred->euid ||
+ cred->uid != tcred->suid ||
+ cred->uid != tcred->uid ||
+ cred->gid != tcred->egid ||
--- /dev/null
+From 5219bf884b6e2b54e734ca1799b6f0014bb2b4b7 Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Fri, 14 Jan 2011 22:03:49 +0100
+Subject: i2c: Unregister dummy devices last on adapter removal
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit 5219bf884b6e2b54e734ca1799b6f0014bb2b4b7 upstream.
+
+Remove real devices first and dummy devices last. This gives device
+driver which instantiated dummy devices themselves a chance to clean
+them up before we do.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Tested-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/i2c/i2c-core.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+--- a/drivers/i2c/i2c-core.c
++++ b/drivers/i2c/i2c-core.c
+@@ -1021,6 +1021,14 @@ static int i2c_do_del_adapter(struct i2c
+ static int __unregister_client(struct device *dev, void *dummy)
+ {
+ struct i2c_client *client = i2c_verify_client(dev);
++ if (client && strcmp(client->name, "dummy"))
++ i2c_unregister_device(client);
++ return 0;
++}
++
++static int __unregister_dummy(struct device *dev, void *dummy)
++{
++ struct i2c_client *client = i2c_verify_client(dev);
+ if (client)
+ i2c_unregister_device(client);
+ return 0;
+@@ -1075,8 +1083,12 @@ int i2c_del_adapter(struct i2c_adapter *
+ mutex_unlock(&adap->userspace_clients_lock);
+
+ /* Detach any active clients. This can't fail, thus we do not
+- checking the returned value. */
++ * check the returned value. This is a two-pass process, because
++ * we can't remove the dummy devices during the first pass: they
++ * could have been instantiated by real devices wishing to clean
++ * them up properly, so we give them a chance to do that first. */
+ res = device_for_each_child(&adap->dev, NULL, __unregister_client);
++ res = device_for_each_child(&adap->dev, NULL, __unregister_dummy);
+
+ #ifdef CONFIG_I2C_COMPAT
+ class_compat_remove_link(i2c_adapter_compat_class, &adap->dev,
--- /dev/null
+From e71a7fd259943a2c2e11484880c80248ad139fe5 Mon Sep 17 00:00:00 2001
+From: Roland Stigge <rst@work-microwave.de>
+Date: Thu, 13 Jan 2011 18:37:36 +0100
+Subject: iio: Fixpoint formatted output bugfix
+
+From: Roland Stigge <rst@work-microwave.de>
+
+commit e71a7fd259943a2c2e11484880c80248ad139fe5 upstream.
+
+Fix some ADC drivers' _scale interface to correct fixpoint formatted output
+
+Signed-off-by: Roland Stigge <stigge@antcom.de>
+Acked-by: Jonathan Cameron <jic23@cam.ac.uk>
+Acked-by: Michael Hennerich <Michael.Hennerich@analog.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/iio/adc/ad7476_core.c | 2 +-
+ drivers/staging/iio/adc/ad799x_core.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/iio/adc/ad7476_core.c
++++ b/drivers/staging/iio/adc/ad7476_core.c
+@@ -68,7 +68,7 @@ static ssize_t ad7476_show_scale(struct
+ /* Corresponds to Vref / 2^(bits) */
+ unsigned int scale_uv = (st->int_vref_mv * 1000) >> st->chip_info->bits;
+
+- return sprintf(buf, "%d.%d\n", scale_uv / 1000, scale_uv % 1000);
++ return sprintf(buf, "%d.%03d\n", scale_uv / 1000, scale_uv % 1000);
+ }
+ static IIO_DEVICE_ATTR(in_scale, S_IRUGO, ad7476_show_scale, NULL, 0);
+
+--- a/drivers/staging/iio/adc/ad799x_core.c
++++ b/drivers/staging/iio/adc/ad799x_core.c
+@@ -432,7 +432,7 @@ static ssize_t ad799x_show_scale(struct
+ /* Corresponds to Vref / 2^(bits) */
+ unsigned int scale_uv = (st->int_vref_mv * 1000) >> st->chip_info->bits;
+
+- return sprintf(buf, "%d.%d\n", scale_uv / 1000, scale_uv % 1000);
++ return sprintf(buf, "%d.%03d\n", scale_uv / 1000, scale_uv % 1000);
+ }
+
+ static IIO_DEVICE_ATTR(in_scale, S_IRUGO, ad799x_show_scale, NULL, 0);
--- /dev/null
+From 2a2d31c8dc6f1ebcf5eab1d93a0cb0fb4ed57c7c Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shaohua.li@intel.com>
+Date: Mon, 10 Jan 2011 09:38:12 +0800
+Subject: intel_idle: open broadcast clock event
+
+From: Shaohua Li <shaohua.li@intel.com>
+
+commit 2a2d31c8dc6f1ebcf5eab1d93a0cb0fb4ed57c7c upstream.
+
+Intel_idle driver uses CLOCK_EVT_NOTIFY_BROADCAST_ENTER
+CLOCK_EVT_NOTIFY_BROADCAST_EXIT
+for broadcast clock events. The _ENTER/_EXIT doesn't really open broadcast clock
+events, please see processor_idle.c for an example. In some situation, this will
+cause boot hang, because some CPUs enters idle but local APIC timer stalls.
+
+Reported-and-tested-by: Yan Zheng <zheng.z.yan@intel.com>
+Signed-off-by: Shaohua Li <shaohua.li@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/idle/intel_idle.c | 47 +++++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 46 insertions(+), 1 deletion(-)
+
+--- a/drivers/idle/intel_idle.c
++++ b/drivers/idle/intel_idle.c
+@@ -59,6 +59,8 @@
+ #include <linux/hrtimer.h> /* ktime_get_real() */
+ #include <trace/events/power.h>
+ #include <linux/sched.h>
++#include <linux/notifier.h>
++#include <linux/cpu.h>
+ #include <asm/mwait.h>
+
+ #define INTEL_IDLE_VERSION "0.4"
+@@ -73,6 +75,7 @@ static int max_cstate = MWAIT_MAX_NUM_CS
+
+ static unsigned int mwait_substates;
+
++#define LAPIC_TIMER_ALWAYS_RELIABLE 0xFFFFFFFF
+ /* Reliable LAPIC Timer States, bit 1 for C1 etc. */
+ static unsigned int lapic_timer_reliable_states = (1 << 1); /* Default to only C1 */
+
+@@ -244,6 +247,39 @@ static int intel_idle(struct cpuidle_dev
+ return usec_delta;
+ }
+
++static void __setup_broadcast_timer(void *arg)
++{
++ unsigned long reason = (unsigned long)arg;
++ int cpu = smp_processor_id();
++
++ reason = reason ?
++ CLOCK_EVT_NOTIFY_BROADCAST_ON : CLOCK_EVT_NOTIFY_BROADCAST_OFF;
++
++ clockevents_notify(reason, &cpu);
++}
++
++static int __cpuinit setup_broadcast_cpuhp_notify(struct notifier_block *n,
++ unsigned long action, void *hcpu)
++{
++ int hotcpu = (unsigned long)hcpu;
++
++ switch (action & 0xf) {
++ case CPU_ONLINE:
++ smp_call_function_single(hotcpu, __setup_broadcast_timer,
++ (void *)true, 1);
++ break;
++ case CPU_DOWN_PREPARE:
++ smp_call_function_single(hotcpu, __setup_broadcast_timer,
++ (void *)false, 1);
++ break;
++ }
++ return NOTIFY_OK;
++}
++
++static struct notifier_block __cpuinitdata setup_broadcast_notifier = {
++ .notifier_call = setup_broadcast_cpuhp_notify,
++};
++
+ /*
+ * intel_idle_probe()
+ */
+@@ -306,7 +342,11 @@ static int intel_idle_probe(void)
+ }
+
+ if (boot_cpu_has(X86_FEATURE_ARAT)) /* Always Reliable APIC Timer */
+- lapic_timer_reliable_states = 0xFFFFFFFF;
++ lapic_timer_reliable_states = LAPIC_TIMER_ALWAYS_RELIABLE;
++ else {
++ smp_call_function(__setup_broadcast_timer, (void *)true, 1);
++ register_cpu_notifier(&setup_broadcast_notifier);
++ }
+
+ pr_debug(PREFIX "v" INTEL_IDLE_VERSION
+ " model 0x%X\n", boot_cpu_data.x86_model);
+@@ -429,6 +469,11 @@ static void __exit intel_idle_exit(void)
+ intel_idle_cpuidle_devices_uninit();
+ cpuidle_unregister_driver(&intel_idle_driver);
+
++ if (lapic_timer_reliable_states != LAPIC_TIMER_ALWAYS_RELIABLE) {
++ smp_call_function(__setup_broadcast_timer, (void *)false, 1);
++ unregister_cpu_notifier(&setup_broadcast_notifier);
++ }
++
+ return;
+ }
+
--- /dev/null
+From a124339ad28389093ed15eca990d39c51c5736cc Mon Sep 17 00:00:00 2001
+From: Don Skidmore <donald.c.skidmore@intel.com>
+Date: Tue, 18 Jan 2011 22:53:47 +0000
+Subject: ixgbe: fix for 82599 erratum on Header Splitting
+
+From: Don Skidmore <donald.c.skidmore@intel.com>
+
+commit a124339ad28389093ed15eca990d39c51c5736cc upstream.
+
+We have found a hardware erratum on 82599 hardware that can lead to
+unpredictable behavior when Header Splitting mode is enabled. So
+we are no longer enabling this feature on affected hardware.
+
+Please see the 82599 Specification Update for more information.
+
+Signed-off-by: Don Skidmore <donald.c.skidmore@intel.com>
+Tested-by: Stephen Ko <stephen.s.ko@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/ixgbe/ixgbe_main.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ixgbe/ixgbe_main.c
++++ b/drivers/net/ixgbe/ixgbe_main.c
+@@ -2912,9 +2912,16 @@ static void ixgbe_set_rx_buffer_len(stru
+ u32 mhadd, hlreg0;
+
+ /* Decide whether to use packet split mode or not */
++ /* On by default */
++ adapter->flags |= IXGBE_FLAG_RX_PS_ENABLED;
++
+ /* Do not use packet split if we're in SR-IOV Mode */
+- if (!adapter->num_vfs)
+- adapter->flags |= IXGBE_FLAG_RX_PS_ENABLED;
++ if (adapter->num_vfs)
++ adapter->flags &= ~IXGBE_FLAG_RX_PS_ENABLED;
++
++ /* Disable packet split due to 82599 erratum #45 */
++ if (hw->mac.type == ixgbe_mac_82599EB)
++ adapter->flags &= ~IXGBE_FLAG_RX_PS_ENABLED;
+
+ /* Set the RX buffer length according to the mode */
+ if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
--- /dev/null
+From 8ec98fe0b4ffdedce4c1caa9fb3d550f52ad1c6b Mon Sep 17 00:00:00 2001
+From: Lars-Peter Clausen <lars@metafoo.de>
+Date: Thu, 11 Nov 2010 19:00:52 +0100
+Subject: jz4740-battery: Protect against concurrent battery readings
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+commit 8ec98fe0b4ffdedce4c1caa9fb3d550f52ad1c6b upstream.
+
+We can not handle more then one ADC request at a time to the battery.
+The patch adds a mutex around the ADC read code to ensure this.
+
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Anton Vorontsov <cbouatmailru@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/power/jz4740-battery.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/power/jz4740-battery.c
++++ b/drivers/power/jz4740-battery.c
+@@ -47,6 +47,8 @@ struct jz_battery {
+
+ struct power_supply battery;
+ struct delayed_work work;
++
++ struct mutex lock;
+ };
+
+ static inline struct jz_battery *psy_to_jz_battery(struct power_supply *psy)
+@@ -68,6 +70,8 @@ static long jz_battery_read_voltage(stru
+ unsigned long val;
+ long voltage;
+
++ mutex_lock(&battery->lock);
++
+ INIT_COMPLETION(battery->read_completion);
+
+ enable_irq(battery->irq);
+@@ -91,6 +95,8 @@ static long jz_battery_read_voltage(stru
+ battery->cell->disable(battery->pdev);
+ disable_irq(battery->irq);
+
++ mutex_unlock(&battery->lock);
++
+ return voltage;
+ }
+
+@@ -291,6 +297,7 @@ static int __devinit jz_battery_probe(st
+ jz_battery->pdev = pdev;
+
+ init_completion(&jz_battery->read_completion);
++ mutex_init(&jz_battery->lock);
+
+ INIT_DELAYED_WORK(&jz_battery->work, jz_battery_work);
+
--- /dev/null
+From 01c88e2d6b7330c0cc5867fe2297e7d826e1337d Mon Sep 17 00:00:00 2001
+From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Date: Tue, 25 Jan 2011 15:07:27 -0800
+Subject: memcg: fix account leak at failure of memsw acconting
+
+From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+
+commit 01c88e2d6b7330c0cc5867fe2297e7d826e1337d upstream.
+
+Commit 4b53433468 ("memcg: clean up try_charge main loop") removes a
+cancel of charge at case: memory charge-> success. mem+swap charge->
+failure.
+
+This leaks usage of memory. Fix it.
+
+Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Reviewed-by: Johannes Weiner <hannes@cmpxchg.org>
+Acked-by: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
+Cc: Balbir Singh <balbir@in.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/memcontrol.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -1842,6 +1842,7 @@ static int __mem_cgroup_do_charge(struct
+ if (likely(!ret))
+ return CHARGE_OK;
+
++ res_counter_uncharge(&mem->res, csize);
+ mem_over_limit = mem_cgroup_from_res_counter(fail_res, memsw);
+ flags |= MEM_CGROUP_RECLAIM_NOSWAP;
+ } else
--- /dev/null
+From a34650f0f1ca589cda09c48cb62baf15e680a247 Mon Sep 17 00:00:00 2001
+From: Sonic Zhang <sonic.zhang@analog.com>
+Date: Tue, 11 Jan 2011 22:39:35 -0500
+Subject: mmc: bfin_sdh: fix alloc size for private data
+
+From: Sonic Zhang <sonic.zhang@analog.com>
+
+commit a34650f0f1ca589cda09c48cb62baf15e680a247 upstream.
+
+The bfin_sdh driver allocates the wrong size for the private data
+in the mmc_host. The first parameter of mmc_alloc_host should be
+the size of the local driver struct rather than the common mmc_host.
+
+Signed-off-by: Sonic Zhang <sonic.zhang@analog.com>
+Signed-off-by: Mike Frysinger <vapier@gentoo.org>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mmc/host/bfin_sdh.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/bfin_sdh.c
++++ b/drivers/mmc/host/bfin_sdh.c
+@@ -462,7 +462,7 @@ static int __devinit sdh_probe(struct pl
+ goto out;
+ }
+
+- mmc = mmc_alloc_host(sizeof(*mmc), &pdev->dev);
++ mmc = mmc_alloc_host(sizeof(struct sdh_host), &pdev->dev);
+ if (!mmc) {
+ ret = -ENOMEM;
+ goto out;
--- /dev/null
+From 13ad17745c2cbd437d9e24b2d97393e0be11c439 Mon Sep 17 00:00:00 2001
+From: Eric W. Biederman <ebiederm@xmission.com>
+Date: Sat, 29 Jan 2011 14:57:22 +0000
+Subject: net: Fix ip link add netns oops
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+commit 13ad17745c2cbd437d9e24b2d97393e0be11c439 upstream.
+
+Ed Swierk <eswierk@bigswitch.com> writes:
+> On 2.6.35.7
+> ip link add link eth0 netns 9999 type macvlan
+> where 9999 is a nonexistent PID triggers an oops and causes all network functions to hang:
+> [10663.821898] BUG: unable to handle kernel NULL pointer dereference at 000000000000006d
+> [10663.821917] IP: [<ffffffff8149c2fa>] __dev_alloc_name+0x9a/0x170
+> [10663.821933] PGD 1d3927067 PUD 22f5c5067 PMD 0
+> [10663.821944] Oops: 0000 [#1] SMP
+> [10663.821953] last sysfs file: /sys/devices/system/cpu/cpu0/cpufreq/scaling_cur_freq
+> [10663.821959] CPU 3
+> [10663.821963] Modules linked in: macvlan ip6table_filter ip6_tables rfcomm ipt_MASQUERADE binfmt_misc iptable_nat nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack sco ipt_REJECT bnep l2cap xt_tcpudp iptable_filter ip_tables x_tables bridge stp vboxnetadp vboxnetflt vboxdrv kvm_intel kvm parport_pc ppdev snd_hda_codec_intelhdmi snd_hda_codec_conexant arc4 iwlagn iwlcore mac80211 snd_hda_intel snd_hda_codec snd_hwdep snd_pcm snd_seq_midi snd_rawmidi i915 snd_seq_midi_event snd_seq thinkpad_acpi drm_kms_helper btusb tpm_tis nvram uvcvideo snd_timer snd_seq_device bluetooth videodev v4l1_compat v4l2_compat_ioctl32 tpm drm tpm_bios snd cfg80211 psmouse serio_raw intel_ips soundcore snd_page_alloc intel_agp i2c_algo_bit video output netconsole configfs lp parport usbhid hid e1000e sdhci_pci ahci libahci sdhci led_class
+> [10663.822155]
+> [10663.822161] Pid: 6000, comm: ip Not tainted 2.6.35-23-generic #41-Ubuntu 2901CTO/2901CTO
+> [10663.822167] RIP: 0010:[<ffffffff8149c2fa>] [<ffffffff8149c2fa>] __dev_alloc_name+0x9a/0x170
+> [10663.822177] RSP: 0018:ffff88014aebf7b8 EFLAGS: 00010286
+> [10663.822182] RAX: 00000000fffffff4 RBX: ffff8801ad900800 RCX: 0000000000000000
+> [10663.822187] RDX: ffff880000000000 RSI: 0000000000000000 RDI: ffff88014ad63000
+> [10663.822191] RBP: ffff88014aebf808 R08: 0000000000000041 R09: 0000000000000041
+> [10663.822196] R10: 0000000000000000 R11: dead000000200200 R12: ffff88014aebf818
+> [10663.822201] R13: fffffffffffffffd R14: ffff88014aebf918 R15: ffff88014ad62000
+> [10663.822207] FS: 00007f00c487f700(0000) GS:ffff880001f80000(0000) knlGS:0000000000000000
+> [10663.822212] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+> [10663.822216] CR2: 000000000000006d CR3: 0000000231f19000 CR4: 00000000000026e0
+> [10663.822221] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+> [10663.822226] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+> [10663.822231] Process ip (pid: 6000, threadinfo ffff88014aebe000, task ffff88014afb16e0)
+> [10663.822236] Stack:
+> [10663.822240] ffff88014aebf808 ffffffff814a2bb5 ffff88014aebf7e8 00000000a00ee8d6
+> [10663.822251] <0> 0000000000000000 ffffffffa00ef940 ffff8801ad900800 ffff88014aebf818
+> [10663.822265] <0> ffff88014aebf918 ffff8801ad900800 ffff88014aebf858 ffffffff8149c413
+> [10663.822281] Call Trace:
+> [10663.822290] [<ffffffff814a2bb5>] ? dev_addr_init+0x75/0xb0
+> [10663.822298] [<ffffffff8149c413>] dev_alloc_name+0x43/0x90
+> [10663.822307] [<ffffffff814a85ee>] rtnl_create_link+0xbe/0x1b0
+> [10663.822314] [<ffffffff814ab2aa>] rtnl_newlink+0x48a/0x570
+> [10663.822321] [<ffffffff814aafcc>] ? rtnl_newlink+0x1ac/0x570
+> [10663.822332] [<ffffffff81030064>] ? native_x2apic_icr_read+0x4/0x20
+> [10663.822339] [<ffffffff814a8c17>] rtnetlink_rcv_msg+0x177/0x290
+> [10663.822346] [<ffffffff814a8aa0>] ? rtnetlink_rcv_msg+0x0/0x290
+> [10663.822354] [<ffffffff814c25d9>] netlink_rcv_skb+0xa9/0xd0
+> [10663.822360] [<ffffffff814a8a85>] rtnetlink_rcv+0x25/0x40
+> [10663.822367] [<ffffffff814c223e>] netlink_unicast+0x2de/0x2f0
+> [10663.822374] [<ffffffff814c303e>] netlink_sendmsg+0x1fe/0x2e0
+> [10663.822383] [<ffffffff81488533>] sock_sendmsg+0xf3/0x120
+> [10663.822391] [<ffffffff815899fe>] ? _raw_spin_lock+0xe/0x20
+> [10663.822400] [<ffffffff81168656>] ? __d_lookup+0x136/0x150
+> [10663.822406] [<ffffffff815899fe>] ? _raw_spin_lock+0xe/0x20
+> [10663.822414] [<ffffffff812b7a0d>] ? _atomic_dec_and_lock+0x4d/0x80
+> [10663.822422] [<ffffffff8116ea90>] ? mntput_no_expire+0x30/0x110
+> [10663.822429] [<ffffffff81486ff5>] ? move_addr_to_kernel+0x65/0x70
+> [10663.822435] [<ffffffff81493308>] ? verify_iovec+0x88/0xe0
+> [10663.822442] [<ffffffff81489020>] sys_sendmsg+0x240/0x3a0
+> [10663.822450] [<ffffffff8111e2a9>] ? __do_fault+0x479/0x560
+> [10663.822457] [<ffffffff815899fe>] ? _raw_spin_lock+0xe/0x20
+> [10663.822465] [<ffffffff8116cf4a>] ? alloc_fd+0x10a/0x150
+> [10663.822473] [<ffffffff8158d76e>] ? do_page_fault+0x15e/0x350
+> [10663.822482] [<ffffffff8100a0f2>] system_call_fastpath+0x16/0x1b
+> [10663.822487] Code: 90 48 8d 78 02 be 25 00 00 00 e8 92 1d e2 ff 48 85 c0 75 cf bf 20 00 00 00 e8 c3 b1 c6 ff 49 89 c7 b8 f4 ff ff ff 4d 85 ff 74 bd <4d> 8b 75 70 49 8d 45 70 48 89 45 b8 49 83 ee 58 eb 28 48 8d 55
+> [10663.822618] RIP [<ffffffff8149c2fa>] __dev_alloc_name+0x9a/0x170
+> [10663.822627] RSP <ffff88014aebf7b8>
+> [10663.822631] CR2: 000000000000006d
+> [10663.822636] ---[ end trace 3dfd6c3ad5327ca7 ]---
+
+This bug was introduced in:
+commit 81adee47dfb608df3ad0b91d230fb3cef75f0060
+Author: Eric W. Biederman <ebiederm@aristanetworks.com>
+Date: Sun Nov 8 00:53:51 2009 -0800
+
+ net: Support specifying the network namespace upon device creation.
+
+ There is no good reason to not support userspace specifying the
+ network namespace during device creation, and it makes it easier
+ to create a network device and pass it to a child network namespace
+ with a well known name.
+
+ We have to be careful to ensure that the target network namespace
+ for the new device exists through the life of the call. To keep
+ that logic clear I have factored out the network namespace grabbing
+ logic into rtnl_link_get_net.
+
+ In addtion we need to continue to pass the source network namespace
+ to the rtnl_link_ops.newlink method so that we can find the base
+ device source network namespace.
+
+ Signed-off-by: Eric W. Biederman <ebiederm@aristanetworks.com>
+ Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
+
+Where apparently I forgot to add error handling to the path where we create
+a new network device in a new network namespace, and pass in an invalid pid.
+
+Reported-by: Ed Swierk <eswierk@bigswitch.com>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/core/rtnetlink.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -1510,6 +1510,9 @@ replay:
+ snprintf(ifname, IFNAMSIZ, "%s%%d", ops->kind);
+
+ dest_net = rtnl_link_get_net(net, tb);
++ if (IS_ERR(dest_net))
++ return PTR_ERR(dest_net);
++
+ dev = rtnl_create_link(net, dest_net, ifname, ops, tb);
+
+ if (IS_ERR(dev))
--- /dev/null
+From 3b5c5827d1f80ad8ae844a8b1183f59ddb90fe25 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@googlemail.com>
+Date: Thu, 6 Jan 2011 23:47:52 +0100
+Subject: p54: fix sequence no. accounting off-by-one error
+
+From: Christian Lamparter <chunkeey@googlemail.com>
+
+commit 3b5c5827d1f80ad8ae844a8b1183f59ddb90fe25 upstream.
+
+P54_HDR_FLAG_DATA_OUT_SEQNR is meant to tell the
+firmware that "the frame's sequence number has
+already been set by the application."
+
+Whereas IEEE80211_TX_CTL_ASSIGN_SEQ is set for
+frames which lack a valid sequence number and
+either the driver or firmware has to assign one.
+
+Yup, it's the exact opposite!
+
+Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/p54/txrx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/p54/txrx.c
++++ b/drivers/net/wireless/p54/txrx.c
+@@ -618,7 +618,7 @@ static void p54_tx_80211_header(struct p
+ else
+ *burst_possible = false;
+
+- if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ)
++ if (!(info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ))
+ *flags |= P54_HDR_FLAG_DATA_OUT_SEQNR;
+
+ if (info->flags & IEEE80211_TX_CTL_PSPOLL_RESPONSE)
--- /dev/null
+From 99a0fadf561e1f553c08f0a29f8b2578f55dd5f0 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Wed, 22 Dec 2010 10:06:36 +0100
+Subject: PCI: pci-stub: ignore zero-length id parameters
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 99a0fadf561e1f553c08f0a29f8b2578f55dd5f0 upstream.
+
+pci-stub uses strsep() to separate list of ids and generates a warning
+message when it fails to parse an id. However, not specifying the
+parameter results in ids set to an empty string. strsep() happily
+returns the empty string as the first token and thus triggers the
+warning message spuriously.
+
+Make the tokner ignore zero length ids.
+
+Reported-by: Chris Wright <chrisw@sous-sol.org>
+Reported-by: Prasad Joshi <P.G.Joshi@student.reading.ac.uk>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/pci-stub.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/pci/pci-stub.c
++++ b/drivers/pci/pci-stub.c
+@@ -54,6 +54,9 @@ static int __init pci_stub_init(void)
+ subdevice = PCI_ANY_ID, class=0, class_mask=0;
+ int fields;
+
++ if (!strlen(id))
++ continue;
++
+ fields = sscanf(id, "%x:%x:%x:%x:%x:%x",
+ &vendor, &device, &subvendor, &subdevice,
+ &class, &class_mask);
--- /dev/null
+From 01e05e9a90b8f4c3997ae0537e87720eb475e532 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Thu, 10 Feb 2011 15:01:22 -0800
+Subject: ptrace: use safer wake up on ptrace_detach()
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 01e05e9a90b8f4c3997ae0537e87720eb475e532 upstream.
+
+The wake_up_process() call in ptrace_detach() is spurious and not
+interlocked with the tracee state. IOW, the tracee could be running or
+sleeping in any place in the kernel by the time wake_up_process() is
+called. This can lead to the tracee waking up unexpectedly which can be
+dangerous.
+
+The wake_up is spurious and should be removed but for now reduce its
+toxicity by only waking up if the tracee is in TRACED or STOPPED state.
+
+This bug can possibly be used as an attack vector. I don't think it
+will take too much effort to come up with an attack which triggers oops
+somewhere. Most sleeps are wrapped in condition test loops and should
+be safe but we have quite a number of places where sleep and wakeup
+conditions are expected to be interlocked. Although the window of
+opportunity is tiny, ptrace can be used by non-privileged users and with
+some loading the window can definitely be extended and exploited.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Acked-by: Roland McGrath <roland@redhat.com>
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/ptrace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -313,7 +313,7 @@ int ptrace_detach(struct task_struct *ch
+ child->exit_code = data;
+ dead = __ptrace_detach(current, child);
+ if (!child->exit_state)
+- wake_up_process(child);
++ wake_up_state(child, TASK_TRACED | TASK_STOPPED);
+ }
+ write_unlock_irq(&tasklist_lock);
+
--- /dev/null
+From d0694e2aeb815042aa0f3e5036728b3db4446f1d Mon Sep 17 00:00:00 2001
+From: Pavel Machek <pavel@ucw.cz>
+Date: Sun, 9 Jan 2011 08:38:48 +0100
+Subject: serial: unbreak billionton CF card
+
+From: Pavel Machek <pavel@ucw.cz>
+
+commit d0694e2aeb815042aa0f3e5036728b3db4446f1d upstream.
+
+Unbreak Billionton CF bluetooth card. This actually fixes a regression
+on zaurus.
+
+Signed-off-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/serial/8250.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/serial/8250.c
++++ b/drivers/serial/8250.c
+@@ -236,7 +236,8 @@ static const struct serial8250_config ua
+ .fifo_size = 128,
+ .tx_loadsz = 128,
+ .fcr = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10,
+- .flags = UART_CAP_FIFO | UART_CAP_EFR | UART_CAP_SLEEP,
++ /* UART_CAP_EFR breaks billionon CF bluetooth card. */
++ .flags = UART_CAP_FIFO | UART_CAP_SLEEP,
+ },
+ [PORT_16654] = {
+ .name = "ST16654",
net-add-pollpri-to-sock_def_readable.patch
ipv4-ip-defragmentation-must-be-ecn-aware.patch
net_sched-pfifo_head_drop-problem.patch
+sh-fix-up-legacy-ptea-space-attribute-mapping.patch
+pci-pci-stub-ignore-zero-length-id-parameters.patch
+virtio-remove-virtio-pci-root-device.patch
+jz4740-battery-protect-against-concurrent-battery-readings.patch
+ds2760_battery-fix-calculation-of-time_to_empty_now.patch
+avr32-use-syscall-prototypes-from-asm-generic-instead-of-arch.patch
+cpuidle-make-cpuidle_enable_device-call-poll_idle_init.patch
+intel_idle-open-broadcast-clock-event.patch
+fix-a-shutdown-regression-in-intel_idle.patch
+p54-fix-sequence-no.-accounting-off-by-one-error.patch
+i2c-unregister-dummy-devices-last-on-adapter-removal.patch
+asoc-da8xx-omap-l1xx-match-codec_name-with-i2c-ids.patch
+asoc-fix-ac-97-registration-unwind.patch
+asoc-correct-link-specifications-for-corgi-poodle-and-spitz.patch
+asoc-handle-low-measured-dc-offsets-for-wm_hubs-devices.patch
+asoc-wm8994-fix-wrong-value-in-tristate-function.patch
+asoc-create-an-aif1adcdat-signal-widget-to-match-aif2.patch
+virtio_net-add-schedule-check-to-napi_enable-call.patch
+virtio-console-wake-up-outvq-on-host-notifications.patch
+carl9170-fix-typo-in-ps-code.patch
+68360serial-plumb-in-rs_360_get_icount.patch
+drivers-update-to-pl2303-usb-serial-to-support-motorola-cables.patch
+serial-unbreak-billionton-cf-card.patch
+ptrace-use-safer-wake-up-on-ptrace_detach.patch
+net-fix-ip-link-add-netns-oops.patch
+x86-mtrr-avoid-mtrr-reprogramming-on-bp-during-boot-on-up-platforms.patch
+fix-jiffy-calculations-in-calibrate_delay_direct-to-handle-overflow.patch
+ixgbe-fix-for-82599-erratum-on-header-splitting.patch
+iio-fixpoint-formatted-output-bugfix.patch
+fix-prlimit64-for-suid-sgid-processes.patch
+arm-s5pv310-set-bit-22-in-the-pl310-cache-controller-auxctlr-register.patch
+arm-initrd-disable-initrd-if-passed-address-overlaps-reserved-region.patch
+memcg-fix-account-leak-at-failure-of-memsw-acconting.patch
+mmc-bfin_sdh-fix-alloc-size-for-private-data.patch
--- /dev/null
+From efb3e34b6176d30c4fe8635fa8e1beb6280cc2cd Mon Sep 17 00:00:00 2001
+From: Paul Mundt <lethal@linux-sh.org>
+Date: Tue, 11 Jan 2011 15:02:59 +0900
+Subject: sh: Fix up legacy PTEA space attribute mapping.
+
+From: Paul Mundt <lethal@linux-sh.org>
+
+commit efb3e34b6176d30c4fe8635fa8e1beb6280cc2cd upstream.
+
+When p3_ioremap() was converted to ioremap_prot() there was some breakage
+introduced where the 29-bit segmentation logic would trap the area range
+and return an identity mapping without having allowed the area
+specification to force mapping through page tables. This wires up a PCC
+mask for pgprot verification to work out whether to short-circuit the
+identity mapping on legacy parts, restoring the previous behaviour.
+
+Reported-by: Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
+Signed-off-by: Paul Mundt <lethal@linux-sh.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sh/include/asm/io.h | 10 +++++++++-
+ arch/sh/include/asm/pgtable_32.h | 7 ++++++-
+ 2 files changed, 15 insertions(+), 2 deletions(-)
+
+--- a/arch/sh/include/asm/io.h
++++ b/arch/sh/include/asm/io.h
+@@ -322,7 +322,15 @@ __ioremap_29bit(phys_addr_t offset, unsi
+ * mapping must be done by the PMB or by using page tables.
+ */
+ if (likely(PXSEG(offset) < P3SEG && PXSEG(last_addr) < P3SEG)) {
+- if (unlikely(pgprot_val(prot) & _PAGE_CACHABLE))
++ u64 flags = pgprot_val(prot);
++
++ /*
++ * Anything using the legacy PTEA space attributes needs
++ * to be kicked down to page table mappings.
++ */
++ if (unlikely(flags & _PAGE_PCC_MASK))
++ return NULL;
++ if (unlikely(flags & _PAGE_CACHABLE))
+ return (void __iomem *)P1SEGADDR(offset);
+
+ return (void __iomem *)P2SEGADDR(offset);
+--- a/arch/sh/include/asm/pgtable_32.h
++++ b/arch/sh/include/asm/pgtable_32.h
+@@ -76,6 +76,10 @@
+ /* Wrapper for extended mode pgprot twiddling */
+ #define _PAGE_EXT(x) ((unsigned long long)(x) << 32)
+
++#ifdef CONFIG_X2TLB
++#define _PAGE_PCC_MASK 0x00000000 /* No legacy PTEA support */
++#else
++
+ /* software: moves to PTEA.TC (Timing Control) */
+ #define _PAGE_PCC_AREA5 0x00000000 /* use BSC registers for area5 */
+ #define _PAGE_PCC_AREA6 0x80000000 /* use BSC registers for area6 */
+@@ -89,7 +93,8 @@
+ #define _PAGE_PCC_ATR8 0x60000000 /* Attribute Memory space, 8 bit bus */
+ #define _PAGE_PCC_ATR16 0x60000001 /* Attribute Memory space, 6 bit bus */
+
+-#ifndef CONFIG_X2TLB
++#define _PAGE_PCC_MASK 0xe0000001
++
+ /* copy the ptea attributes */
+ static inline unsigned long copy_ptea_attributes(unsigned long x)
+ {
--- /dev/null
+From 2770c5ea501be69989a7acf54ec4cb3554c47191 Mon Sep 17 00:00:00 2001
+From: Amit Shah <amit.shah@redhat.com>
+Date: Mon, 31 Jan 2011 13:06:36 +0530
+Subject: virtio: console: Wake up outvq on host notifications
+
+From: Amit Shah <amit.shah@redhat.com>
+
+commit 2770c5ea501be69989a7acf54ec4cb3554c47191 upstream.
+
+The outvq needs to be woken up on host notifications so that buffers
+consumed by the host can be reclaimed, outvq freed, and application
+writes may proceed again.
+
+The need for this is now finally noticed when I have qemu patches ready
+to use nonblocking IO and flow control.
+
+CC: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Amit Shah <amit.shah@redhat.com>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Acked-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/virtio_console.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+--- a/drivers/char/virtio_console.c
++++ b/drivers/char/virtio_console.c
+@@ -1462,6 +1462,17 @@ static void control_work_handler(struct
+ spin_unlock(&portdev->cvq_lock);
+ }
+
++static void out_intr(struct virtqueue *vq)
++{
++ struct port *port;
++
++ port = find_port_by_vq(vq->vdev->priv, vq);
++ if (!port)
++ return;
++
++ wake_up_interruptible(&port->waitqueue);
++}
++
+ static void in_intr(struct virtqueue *vq)
+ {
+ struct port *port;
+@@ -1566,7 +1577,7 @@ static int init_vqs(struct ports_device
+ */
+ j = 0;
+ io_callbacks[j] = in_intr;
+- io_callbacks[j + 1] = NULL;
++ io_callbacks[j + 1] = out_intr;
+ io_names[j] = "input";
+ io_names[j + 1] = "output";
+ j += 2;
+@@ -1580,7 +1591,7 @@ static int init_vqs(struct ports_device
+ for (i = 1; i < nr_ports; i++) {
+ j += 2;
+ io_callbacks[j] = in_intr;
+- io_callbacks[j + 1] = NULL;
++ io_callbacks[j + 1] = out_intr;
+ io_names[j] = "input";
+ io_names[j + 1] = "output";
+ }
--- /dev/null
+From 8b3bb3ecf1934ac4a7005ad9017de1127e2fbd2f Mon Sep 17 00:00:00 2001
+From: Milton Miller <miltonm@bga.com>
+Date: Fri, 7 Jan 2011 02:55:06 -0600
+Subject: virtio: remove virtio-pci root device
+
+From: Milton Miller <miltonm@bga.com>
+
+commit 8b3bb3ecf1934ac4a7005ad9017de1127e2fbd2f upstream.
+
+We sometimes need to map between the virtio device and
+the given pci device. One such use is OS installer that
+gets the boot pci device from BIOS and needs to
+find the relevant block device. Since it can't,
+installation fails.
+
+Instead of creating a top-level devices/virtio-pci
+directory, create each device under the corresponding
+pci device node. Symlinks to all virtio-pci
+devices can be found under the pci driver link in
+bus/pci/drivers/virtio-pci/devices, and all virtio
+devices under drivers/bus/virtio/devices.
+
+Signed-off-by: Milton Miller <miltonm@bga.com>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Tested-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Gleb Natapov <gleb@redhat.com>
+Tested-by: "Daniel P. Berrange" <berrange@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/virtio/virtio_pci.c | 20 ++------------------
+ 1 file changed, 2 insertions(+), 18 deletions(-)
+
+--- a/drivers/virtio/virtio_pci.c
++++ b/drivers/virtio/virtio_pci.c
+@@ -96,11 +96,6 @@ static struct pci_device_id virtio_pci_i
+
+ MODULE_DEVICE_TABLE(pci, virtio_pci_id_table);
+
+-/* A PCI device has it's own struct device and so does a virtio device so
+- * we create a place for the virtio devices to show up in sysfs. I think it
+- * would make more sense for virtio to not insist on having it's own device. */
+-static struct device *virtio_pci_root;
+-
+ /* Convert a generic virtio device to our structure */
+ static struct virtio_pci_device *to_vp_device(struct virtio_device *vdev)
+ {
+@@ -629,7 +624,7 @@ static int __devinit virtio_pci_probe(st
+ if (vp_dev == NULL)
+ return -ENOMEM;
+
+- vp_dev->vdev.dev.parent = virtio_pci_root;
++ vp_dev->vdev.dev.parent = &pci_dev->dev;
+ vp_dev->vdev.dev.release = virtio_pci_release_dev;
+ vp_dev->vdev.config = &virtio_pci_config_ops;
+ vp_dev->pci_dev = pci_dev;
+@@ -717,17 +712,7 @@ static struct pci_driver virtio_pci_driv
+
+ static int __init virtio_pci_init(void)
+ {
+- int err;
+-
+- virtio_pci_root = root_device_register("virtio-pci");
+- if (IS_ERR(virtio_pci_root))
+- return PTR_ERR(virtio_pci_root);
+-
+- err = pci_register_driver(&virtio_pci_driver);
+- if (err)
+- root_device_unregister(virtio_pci_root);
+-
+- return err;
++ return pci_register_driver(&virtio_pci_driver);
+ }
+
+ module_init(virtio_pci_init);
+@@ -735,7 +720,6 @@ module_init(virtio_pci_init);
+ static void __exit virtio_pci_exit(void)
+ {
+ pci_unregister_driver(&virtio_pci_driver);
+- root_device_unregister(virtio_pci_root);
+ }
+
+ module_exit(virtio_pci_exit);
--- /dev/null
+From 3e9d08ec0a68f6faf718d5a7e050fe5ca0ba004f Mon Sep 17 00:00:00 2001
+From: Bruce Rogers <brogers@novell.com>
+Date: Thu, 10 Feb 2011 11:03:31 -0800
+Subject: virtio_net: Add schedule check to napi_enable call
+
+From: Bruce Rogers <brogers@novell.com>
+
+commit 3e9d08ec0a68f6faf718d5a7e050fe5ca0ba004f upstream.
+
+Under harsh testing conditions, including low memory, the guest would
+stop receiving packets. With this patch applied we no longer see any
+problems in the driver while performing these tests for extended periods
+of time.
+
+Make sure napi is scheduled subsequent to each napi_enable.
+
+Signed-off-by: Bruce Rogers <brogers@novell.com>
+Signed-off-by: Olaf Kirch <okir@suse.de>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/virtio_net.c | 27 ++++++++++++++++-----------
+ 1 file changed, 16 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -446,6 +446,20 @@ static void skb_recv_done(struct virtque
+ }
+ }
+
++static void virtnet_napi_enable(struct virtnet_info *vi)
++{
++ napi_enable(&vi->napi);
++
++ /* If all buffers were filled by other side before we napi_enabled, we
++ * won't get another interrupt, so process any outstanding packets
++ * now. virtnet_poll wants re-enable the queue, so we disable here.
++ * We synchronize against interrupts via NAPI_STATE_SCHED */
++ if (napi_schedule_prep(&vi->napi)) {
++ virtqueue_disable_cb(vi->rvq);
++ __napi_schedule(&vi->napi);
++ }
++}
++
+ static void refill_work(struct work_struct *work)
+ {
+ struct virtnet_info *vi;
+@@ -454,7 +468,7 @@ static void refill_work(struct work_stru
+ vi = container_of(work, struct virtnet_info, refill.work);
+ napi_disable(&vi->napi);
+ still_empty = !try_fill_recv(vi, GFP_KERNEL);
+- napi_enable(&vi->napi);
++ virtnet_napi_enable(vi);
+
+ /* In theory, this can happen: if we don't get any buffers in
+ * we will *never* try to fill again. */
+@@ -638,16 +652,7 @@ static int virtnet_open(struct net_devic
+ {
+ struct virtnet_info *vi = netdev_priv(dev);
+
+- napi_enable(&vi->napi);
+-
+- /* If all buffers were filled by other side before we napi_enabled, we
+- * won't get another interrupt, so process any outstanding packets
+- * now. virtnet_poll wants re-enable the queue, so we disable here.
+- * We synchronize against interrupts via NAPI_STATE_SCHED */
+- if (napi_schedule_prep(&vi->napi)) {
+- virtqueue_disable_cb(vi->rvq);
+- __napi_schedule(&vi->napi);
+- }
++ virtnet_napi_enable(vi);
+ return 0;
+ }
+
--- /dev/null
+From f7448548a9f32db38f243ccd4271617758ddfe2c Mon Sep 17 00:00:00 2001
+From: Suresh Siddha <suresh.b.siddha@intel.com>
+Date: Wed, 2 Feb 2011 17:02:55 -0800
+Subject: x86, mtrr: Avoid MTRR reprogramming on BP during boot on UP platforms
+
+From: Suresh Siddha <suresh.b.siddha@intel.com>
+
+commit f7448548a9f32db38f243ccd4271617758ddfe2c upstream.
+
+Markus Kohn ran into a hard hang regression on an acer aspire
+1310, when acpi is enabled. git bisect showed the following
+commit as the bad one that introduced the boot regression.
+
+ commit d0af9eed5aa91b6b7b5049cae69e5ea956fd85c3
+ Author: Suresh Siddha <suresh.b.siddha@intel.com>
+ Date: Wed Aug 19 18:05:36 2009 -0700
+
+ x86, pat/mtrr: Rendezvous all the cpus for MTRR/PAT init
+
+Because of the UP configuration of that platform,
+native_smp_prepare_cpus() bailed out (in smp_sanity_check())
+before doing the set_mtrr_aps_delayed_init()
+
+Further down the boot path, native_smp_cpus_done() will call the
+delayed MTRR initialization for the AP's (mtrr_aps_init()) with
+mtrr_aps_delayed_init not set. This resulted in the boot
+processor reprogramming its MTRR's to the values seen during the
+start of the OS boot. While this is not needed ideally, this
+shouldn't have caused any side-effects. This is because the
+reprogramming of MTRR's (set_mtrr_state() that gets called via
+set_mtrr()) will check if the live register contents are
+different from what is being asked to write and will do the actual
+write only if they are different.
+
+BP's mtrr state is read during the start of the OS boot and
+typically nothing would have changed when we ask to reprogram it
+on BP again because of the above scenario on an UP platform. So
+on a normal UP platform no reprogramming of BP MTRR MSR's
+happens and all is well.
+
+However, on this platform, bios seems to be modifying the fixed
+mtrr range registers between the start of OS boot and when we
+double check the live registers for reprogramming BP MTRR
+registers. And as the live registers are modified, we end up
+reprogramming the MTRR's to the state seen during the start of
+the OS boot.
+
+During ACPI initialization, something in the bios (probably smi
+handler?) don't like this fact and results in a hard lockup.
+
+We didn't see this boot hang issue on this platform before the
+commit d0af9eed5aa91b6b7b5049cae69e5ea956fd85c3, because only
+the AP's (if any) will program its MTRR's to the value that BP
+had at the start of the OS boot.
+
+Fix this issue by checking mtrr_aps_delayed_init before
+continuing further in the mtrr_aps_init(). Now, only AP's (if
+any) will program its MTRR's to the BP values during boot.
+
+Addresses https://bugzilla.novell.com/show_bug.cgi?id=623393
+
+ [ By the way, this behavior of the bios modifying MTRR's after the start
+ of the OS boot is not common and the kernel is not prepared to
+ handle this situation well. Irrespective of this issue, during
+ suspend/resume, linux kernel will try to reprogram the BP's MTRR values
+ to the values seen during the start of the OS boot. So suspend/resume might
+ be already broken on this platform for all linux kernel versions. ]
+
+Reported-and-bisected-by: Markus Kohn <jabber@gmx.org>
+Tested-by: Markus Kohn <jabber@gmx.org>
+Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
+Cc: Thomas Renninger <trenn@novell.com>
+Cc: Rafael Wysocki <rjw@novell.com>
+Cc: Venkatesh Pallipadi <venki@google.com>
+LKML-Reference: <1296694975.4418.402.camel@sbsiddha-MOBL3.sc.intel.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/cpu/mtrr/main.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/mtrr/main.c
++++ b/arch/x86/kernel/cpu/mtrr/main.c
+@@ -793,13 +793,21 @@ void set_mtrr_aps_delayed_init(void)
+ }
+
+ /*
+- * MTRR initialization for all AP's
++ * Delayed MTRR initialization for all AP's
+ */
+ void mtrr_aps_init(void)
+ {
+ if (!use_intel())
+ return;
+
++ /*
++ * Check if someone has requested the delay of AP MTRR initialization,
++ * by doing set_mtrr_aps_delayed_init(), prior to this point. If not,
++ * then we are done.
++ */
++ if (!mtrr_aps_delayed_init)
++ return;
++
+ set_mtrr(~0U, 0, 0, 0);
+ mtrr_aps_delayed_init = false;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
