--- /dev/null
+From b688ae989a7c56026c9a0d9857f07812daab4be3 Mon Sep 17 00:00:00 2001
+From: Kumar Gala <galak@kernel.crashing.org>
+Date: Tue, 21 Oct 2008 22:19:00 -0700
+Subject: math-emu: Fix signalling of underflow and inexact while packing result.
+
+
+From: Kumar Gala <galak@kernel.crashing.org>
+
+[ Upstream commit 930cc144a043ff95e56b6888fa51c618b33f89e7 ]
+
+I'm trying to move the powerpc math-emu code to use the include/math-emu bits.
+
+In doing so I've been using TestFloat to see how good or bad we are
+doing. For the most part the current math-emu code that PPC uses has
+a number of issues that the code in include/math-emu seems to solve
+(plus bugs we've had for ever that no one every realized).
+
+Anyways, I've come across a case that we are flagging underflow and
+inexact because we think we have a denormalized result from a double
+precision divide:
+
+000.FFFFFFFFFFFFF / 3FE.FFFFFFFFFFFFE
+ soft: 001.0000000000000 ..... syst: 001.0000000000000 ...ux
+
+What it looks like is the results out of FP_DIV_D are:
+
+D:
+sign: 0
+mantissa: 01000000 00000000
+exp: -1023 (0)
+
+The problem seems like we aren't normalizing the result and bumping the exp.
+
+Now that I'm digging into this a bit I'm thinking my issue has to do with
+the fix DaveM put in place from back in Aug 2007 (commit
+405849610fd96b4f34cd1875c4c033228fea6c0f):
+
+[MATH-EMU]: Fix underflow exception reporting.
+
+ 2) we ended up rounding back up to normal (this is the case where
+ we set the exponent to 1 and set the fraction to zero), this
+ should set inexact too
+...
+
+ Another example, "0x0.0000000000001p-1022 / 16.0", should signal both
+ inexact and underflow. The cpu implementations and ieee1754
+ literature is very clear about this. This is case #2 above.
+
+Here is the distilled glibc test case from Jakub Jelinek which prompted that
+commit:
+
+--------------------
+#include <float.h>
+#include <fenv.h>
+#include <stdio.h>
+
+volatile double d = DBL_MIN;
+volatile double e = 0x0.0000000000001p-1022;
+volatile double f = 16.0;
+int
+main (void)
+{
+ printf ("%x\n", fetestexcept (FE_UNDERFLOW));
+ d /= f;
+ printf ("%x\n", fetestexcept (FE_UNDERFLOW));
+ e /= f;
+ printf ("%x\n", fetestexcept (FE_UNDERFLOW));
+ return 0;
+}
+--------------------
+
+It looks like the case I have we are exact before rounding, but think it
+looks like the rounding case since it appears as if "overflow is set".
+
+000.FFFFFFFFFFFFF / 3FE.FFFFFFFFFFFFE = 001.0000000000000
+
+I think the following adds the check for my case and still works for the
+issue your commit was trying to resolve.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/math-emu/op-common.h | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+--- a/include/math-emu/op-common.h
++++ b/include/math-emu/op-common.h
+@@ -139,18 +139,27 @@ do { \
+ if (X##_e <= _FP_WFRACBITS_##fs) \
+ { \
+ _FP_FRAC_SRS_##wc(X, X##_e, _FP_WFRACBITS_##fs); \
+- _FP_ROUND(wc, X); \
+ if (_FP_FRAC_HIGH_##fs(X) \
+ & (_FP_OVERFLOW_##fs >> 1)) \
+ { \
+ X##_e = 1; \
+ _FP_FRAC_SET_##wc(X, _FP_ZEROFRAC_##wc); \
+- FP_SET_EXCEPTION(FP_EX_INEXACT); \
+ } \
+ else \
+ { \
+- X##_e = 0; \
+- _FP_FRAC_SRL_##wc(X, _FP_WORKBITS); \
++ _FP_ROUND(wc, X); \
++ if (_FP_FRAC_HIGH_##fs(X) \
++ & (_FP_OVERFLOW_##fs >> 1)) \
++ { \
++ X##_e = 1; \
++ _FP_FRAC_SET_##wc(X, _FP_ZEROFRAC_##wc); \
++ FP_SET_EXCEPTION(FP_EX_INEXACT); \
++ } \
++ else \
++ { \
++ X##_e = 0; \
++ _FP_FRAC_SRL_##wc(X, _FP_WORKBITS); \
++ } \
+ } \
+ if ((FP_CUR_EXCEPTIONS & FP_EX_INEXACT) || \
+ (FP_TRAPPING_EXCEPTIONS & FP_EX_UNDERFLOW)) \
--- /dev/null
+From 94066dd498c816f9238cfe16023187806cbe7fd6 Mon Sep 17 00:00:00 2001
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Date: Tue, 7 Oct 2008 15:50:03 -0700
+Subject: net: Fix netdev_run_todo dead-lock
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 58ec3b4db9eb5a28e3aec5f407a54e28f7039c19 ]
+
+Benjamin Thery tracked down a bug that explains many instances
+of the error
+
+unregister_netdevice: waiting for %s to become free. Usage count = %d
+
+It turns out that netdev_run_todo can dead-lock with itself if
+a second instance of it is run in a thread that will then free
+a reference to the device waited on by the first instance.
+
+The problem is really quite silly. We were trying to create
+parallelism where none was required. As netdev_run_todo always
+follows a RTNL section, and that todo tasks can only be added
+with the RTNL held, by definition you should only need to wait
+for the very ones that you've added and be done with it.
+
+There is no need for a second mutex or spinlock.
+
+This is exactly what the following patch does.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/core/dev.c | 27 ++++++---------------------
+ net/core/rtnetlink.c | 2 +-
+ 2 files changed, 7 insertions(+), 22 deletions(-)
+
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -3624,14 +3624,11 @@ static int dev_new_index(struct net *net
+ }
+
+ /* Delayed registration/unregisteration */
+-static DEFINE_SPINLOCK(net_todo_list_lock);
+ static LIST_HEAD(net_todo_list);
+
+ static void net_set_todo(struct net_device *dev)
+ {
+- spin_lock(&net_todo_list_lock);
+ list_add_tail(&dev->todo_list, &net_todo_list);
+- spin_unlock(&net_todo_list_lock);
+ }
+
+ static void rollback_registered(struct net_device *dev)
+@@ -3941,33 +3938,24 @@ static void netdev_wait_allrefs(struct n
+ * free_netdev(y1);
+ * free_netdev(y2);
+ *
+- * We are invoked by rtnl_unlock() after it drops the semaphore.
++ * We are invoked by rtnl_unlock().
+ * This allows us to deal with problems:
+ * 1) We can delete sysfs objects which invoke hotplug
+ * without deadlocking with linkwatch via keventd.
+ * 2) Since we run with the RTNL semaphore not held, we can sleep
+ * safely in order to wait for the netdev refcnt to drop to zero.
++ *
++ * We must not return until all unregister events added during
++ * the interval the lock was held have been completed.
+ */
+-static DEFINE_MUTEX(net_todo_run_mutex);
+ void netdev_run_todo(void)
+ {
+ struct list_head list;
+
+- /* Need to guard against multiple cpu's getting out of order. */
+- mutex_lock(&net_todo_run_mutex);
+-
+- /* Not safe to do outside the semaphore. We must not return
+- * until all unregister events invoked by the local processor
+- * have been completed (either by this todo run, or one on
+- * another cpu).
+- */
+- if (list_empty(&net_todo_list))
+- goto out;
+-
+ /* Snapshot list, allow later requests */
+- spin_lock(&net_todo_list_lock);
+ list_replace_init(&net_todo_list, &list);
+- spin_unlock(&net_todo_list_lock);
++
++ __rtnl_unlock();
+
+ while (!list_empty(&list)) {
+ struct net_device *dev
+@@ -3997,9 +3985,6 @@ void netdev_run_todo(void)
+ /* Free network device */
+ kobject_put(&dev->dev.kobj);
+ }
+-
+-out:
+- mutex_unlock(&net_todo_run_mutex);
+ }
+
+ static struct net_device_stats *internal_stats(struct net_device *dev)
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -73,7 +73,7 @@ void __rtnl_unlock(void)
+
+ void rtnl_unlock(void)
+ {
+- mutex_unlock(&rtnl_mutex);
++ /* This fellow will unlock it for us. */
+ netdev_run_todo();
+ }
+
--- /dev/null
+From 777585fb5258442731e8a346114934a797eada29 Mon Sep 17 00:00:00 2001
+From: Andrea Shepard <andrea@persephoneslair.org>
+Date: Sun, 19 Oct 2008 23:33:03 -0700
+Subject: sparc64: Fix race in arch/sparc64/kernel/trampoline.S
+
+From: Andrea Shepard <andrea@persephoneslair.org>
+
+[ Upstream commit e0037df3852b4b60edbe01f70f4968e4a9fdb272 ]
+
+Make arch/sparc64/kernel/trampoline.S in 2.6.27.1 lock prom_entry_lock
+when calling the PROM. This prevents a race condition that I observed
+causing a hang on startup on a 12-CPU E4500.
+
+I am not subscribed to this list, so please CC me on replies.
+
+Signed-off-by: Andrea Shepard <andrea@persephoneslair.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc64/kernel/trampoline.S | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+--- a/arch/sparc64/kernel/trampoline.S
++++ b/arch/sparc64/kernel/trampoline.S
+@@ -328,6 +328,12 @@ after_lock_tlb:
+
+ wrpr %g0, 0, %wstate
+
++ sethi %hi(prom_entry_lock), %g2
++1: ldstub [%g2 + %lo(prom_entry_lock)], %g1
++ membar #StoreLoad | #StoreStore
++ brnz,pn %g1, 1b
++ nop
++
+ /* As a hack, put &init_thread_union into %g6.
+ * prom_world() loads from here to restore the %asi
+ * register.
+@@ -337,7 +343,7 @@ after_lock_tlb:
+
+ sethi %hi(is_sun4v), %o0
+ lduw [%o0 + %lo(is_sun4v)], %o0
+- brz,pt %o0, 1f
++ brz,pt %o0, 2f
+ nop
+
+ TRAP_LOAD_TRAP_BLOCK(%g2, %g3)
+@@ -369,10 +375,10 @@ after_lock_tlb:
+ call %o1
+ add %sp, (2047 + 128), %o0
+
+- ba,pt %xcc, 2f
++ ba,pt %xcc, 3f
+ nop
+
+-1: sethi %hi(sparc64_ttable_tl0), %o0
++2: sethi %hi(sparc64_ttable_tl0), %o0
+ set prom_set_trap_table_name, %g2
+ stx %g2, [%sp + 2047 + 128 + 0x00]
+ mov 1, %g2
+@@ -386,7 +392,11 @@ after_lock_tlb:
+ call %o1
+ add %sp, (2047 + 128), %o0
+
+-2: ldx [%l0], %g6
++3: sethi %hi(prom_entry_lock), %g2
++ stb %g0, [%g2 + %lo(prom_entry_lock)]
++ membar #StoreStore | #StoreLoad
++
++ ldx [%l0], %g6
+ ldx [%g6 + TI_TASK], %g4
+
+ mov 1, %g5
--- /dev/null
+From 2a7b6981a2b4f773048128fd1c7948f1e0a7258d Mon Sep 17 00:00:00 2001
+From: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
+Date: Wed, 8 Oct 2008 14:36:33 -0700
+Subject: tcpv6: fix option space offsets with md5
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
+
+[ Upstream commit 53b125779fb0b29e5b316bf3dc7d199e6dcea567 ]
+
+More breakage :-), part of timestamps just were previously
+overwritten.
+
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv6/tcp_ipv6.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1147,7 +1147,7 @@ static void tcp_v6_send_ack(struct tcp_t
+ *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
+ (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
+ *topt++ = htonl(tcp_time_stamp);
+- *topt = htonl(ts);
++ *topt++ = htonl(ts);
+ }
+
+ #ifdef CONFIG_TCP_MD5SIG
--- /dev/null
+From lenb@kernel.org Tue Nov 4 13:59:20 2008
+From: Guillem Jover <guillem.jover@nokia.com>
+Date: Tue, 28 Oct 2008 01:34:27 -0400 (EDT)
+Subject: ACPI: Always report a sync event after a lid state change
+To: stable@kernel.org
+Cc: linux-acpi@vger.kernel.org
+Message-ID: <alpine.LFD.2.00.0810280131390.24123@localhost.localdomain>
+
+From: Guillem Jover <guillem.jover@nokia.com>
+
+upstream commit df316e939100e789b3c5d4d102619ccf5834bd00
+
+Currently not always an EV_SYN event is reported to userland
+after the EV_SW SW_LID event has been sent. This is easy to verify
+by using “input-events” from input-utils and just closing and opening
+the lid.
+
+Signed-off-by: Guillem Jover <guillem.jover@nokia.com>
+Acked-by: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/button.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/acpi/button.c
++++ b/drivers/acpi/button.c
+@@ -262,6 +262,7 @@ static int acpi_lid_send_state(struct ac
+ return -ENODEV;
+ /* input layer checks if event is redundant */
+ input_report_switch(button->input, SW_LID, !state);
++ input_sync(button->input);
+ return 0;
+ }
+
+@@ -285,8 +286,8 @@ static void acpi_button_notify(acpi_hand
+ input_report_key(input, keycode, 1);
+ input_sync(input);
+ input_report_key(input, keycode, 0);
++ input_sync(input);
+ }
+- input_sync(input);
+
+ acpi_bus_generate_proc_event(button->device, event,
+ ++button->pushed);
--- /dev/null
+From lenb@kernel.org Fri Nov 7 14:08:55 2008
+From: Shaohua Li <shaohua.li@intel.com>
+Date: Thu, 06 Nov 2008 14:18:55 -0500 (EST)
+Subject: ACPI: dock: avoid check _STA method
+To: stable@kernel.org
+Cc: linux-acpi@vger.kernel.org, Linux Kernel Mailing List <linux-kernel@vger.kernel.org>, Shaohua Li <shaohua.li@intel.com>
+Message-ID: <alpine.LFD.2.00.0811061417380.3106@localhost.localdomain>
+
+From: Shaohua Li <shaohua.li@intel.com>
+
+commit 8b59560a3baf2e7c24e0fb92ea5d09eca92805db upstream.
+
+ACPI: dock: avoid check _STA method
+
+In some BIOSes, every _STA method call will send a notification again,
+this cause freeze. And in some BIOSes, it appears _STA should be called
+after _DCK. This tries to avoid calls _STA, and still keep the device
+present check.
+
+http://bugzilla.kernel.org/show_bug.cgi?id=10431
+
+Signed-off-by: Shaohua Li <shaohua.li@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/dock.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/acpi/dock.c
++++ b/drivers/acpi/dock.c
+@@ -599,14 +599,17 @@ static int handle_eject_request(struct d
+ static void dock_notify(acpi_handle handle, u32 event, void *data)
+ {
+ struct dock_station *ds = data;
++ struct acpi_device *tmp;
+
+ switch (event) {
+ case ACPI_NOTIFY_BUS_CHECK:
+- if (!dock_in_progress(ds) && dock_present(ds)) {
++ if (!dock_in_progress(ds) && acpi_bus_get_device(ds->handle,
++ &tmp)) {
+ begin_dock(ds);
+ dock(ds);
+ if (!dock_present(ds)) {
+ printk(KERN_ERR PREFIX "Unable to dock!\n");
++ complete_dock(ds);
+ break;
+ }
+ atomic_notifier_call_chain(&dock_notifier_list,
--- /dev/null
+From lenb@kernel.org Fri Nov 7 14:08:06 2008
+From: Julia Jomantaite <julia.jomantaite@gmail.com>
+Date: Mon, 27 Oct 2008 23:45:56 -0400 (EDT)
+Subject: ACPI: video: fix brightness allocation
+To: stable@kernel.org
+Cc: Arjan van de Ven <arjan@infradead.org>
+Message-ID: <alpine.LFD.2.00.0810272338450.21631@localhost.localdomain>
+
+
+From: Julia Jomantaite <julia.jomantaite@gmail.com>
+
+upstream commit 469778c1740fcf3113498b6fdf4559bdec25c58f
+
+Thanks to Arjan for spotting this
+http://www.kerneloops.org/search.php?search=acpi_video_switch_brightness
+and suggesting it for .stable
+
+
+Fix use of uninitialized device->brightness.
+
+Signed-off-by: Julia Jomantaite <julia.jomantaite@gmail.com>
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+Acked-by: Zhang Rui <rui.zhang@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/video.c | 123 ++++++++++++++++++++++++++++++---------------------
+ 1 file changed, 73 insertions(+), 50 deletions(-)
+
+--- a/drivers/acpi/video.c
++++ b/drivers/acpi/video.c
+@@ -631,6 +631,76 @@ acpi_video_bus_DOS(struct acpi_video_bus
+ * device : video output device (LCD, CRT, ..)
+ *
+ * Return Value:
++ * Maximum brightness level
++ *
++ * Allocate and initialize device->brightness.
++ */
++
++static int
++acpi_video_init_brightness(struct acpi_video_device *device)
++{
++ union acpi_object *obj = NULL;
++ int i, max_level = 0, count = 0;
++ union acpi_object *o;
++ struct acpi_video_device_brightness *br = NULL;
++
++ if (!ACPI_SUCCESS(acpi_video_device_lcd_query_levels(device, &obj))) {
++ ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Could not query available "
++ "LCD brightness level\n"));
++ goto out;
++ }
++
++ if (obj->package.count < 2)
++ goto out;
++
++ br = kzalloc(sizeof(*br), GFP_KERNEL);
++ if (!br) {
++ printk(KERN_ERR "can't allocate memory\n");
++ goto out;
++ }
++
++ br->levels = kmalloc(obj->package.count * sizeof *(br->levels),
++ GFP_KERNEL);
++ if (!br->levels)
++ goto out_free;
++
++ for (i = 0; i < obj->package.count; i++) {
++ o = (union acpi_object *)&obj->package.elements[i];
++ if (o->type != ACPI_TYPE_INTEGER) {
++ printk(KERN_ERR PREFIX "Invalid data\n");
++ continue;
++ }
++ br->levels[count] = (u32) o->integer.value;
++
++ if (br->levels[count] > max_level)
++ max_level = br->levels[count];
++ count++;
++ }
++
++ if (count < 2)
++ goto out_free_levels;
++
++ br->count = count;
++ device->brightness = br;
++ ACPI_DEBUG_PRINT((ACPI_DB_INFO, "found %d brightness levels\n", count));
++ kfree(obj);
++ return max_level;
++
++out_free_levels:
++ kfree(br->levels);
++out_free:
++ kfree(br);
++out:
++ device->brightness = NULL;
++ kfree(obj);
++ return 0;
++}
++
++/*
++ * Arg:
++ * device : video output device (LCD, CRT, ..)
++ *
++ * Return Value:
+ * None
+ *
+ * Find out all required AML methods defined under the output
+@@ -640,10 +710,7 @@ acpi_video_bus_DOS(struct acpi_video_bus
+ static void acpi_video_device_find_cap(struct acpi_video_device *device)
+ {
+ acpi_handle h_dummy1;
+- int i;
+ u32 max_level = 0;
+- union acpi_object *obj = NULL;
+- struct acpi_video_device_brightness *br = NULL;
+
+
+ memset(&device->cap, 0, sizeof(device->cap));
+@@ -672,53 +739,7 @@ static void acpi_video_device_find_cap(s
+ device->cap._DSS = 1;
+ }
+
+- if (ACPI_SUCCESS(acpi_video_device_lcd_query_levels(device, &obj))) {
+-
+- if (obj->package.count >= 2) {
+- int count = 0;
+- union acpi_object *o;
+-
+- br = kzalloc(sizeof(*br), GFP_KERNEL);
+- if (!br) {
+- printk(KERN_ERR "can't allocate memory\n");
+- } else {
+- br->levels = kmalloc(obj->package.count *
+- sizeof *(br->levels), GFP_KERNEL);
+- if (!br->levels)
+- goto out;
+-
+- for (i = 0; i < obj->package.count; i++) {
+- o = (union acpi_object *)&obj->package.
+- elements[i];
+- if (o->type != ACPI_TYPE_INTEGER) {
+- printk(KERN_ERR PREFIX "Invalid data\n");
+- continue;
+- }
+- br->levels[count] = (u32) o->integer.value;
+-
+- if (br->levels[count] > max_level)
+- max_level = br->levels[count];
+- count++;
+- }
+- out:
+- if (count < 2) {
+- kfree(br->levels);
+- kfree(br);
+- } else {
+- br->count = count;
+- device->brightness = br;
+- ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+- "found %d brightness levels\n",
+- count));
+- }
+- }
+- }
+-
+- } else {
+- ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Could not query available LCD brightness level\n"));
+- }
+-
+- kfree(obj);
++ max_level = acpi_video_init_brightness(device);
+
+ if (device->cap._BCL && device->cap._BCM && max_level > 0) {
+ int result;
+@@ -1705,6 +1726,8 @@ static void
+ acpi_video_switch_brightness(struct acpi_video_device *device, int event)
+ {
+ unsigned long level_current, level_next;
++ if (!device->brightness)
++ return;
+ acpi_video_device_lcd_get_level_current(device, &level_current);
+ level_next = acpi_video_get_next_level(device, level_current, event);
+ acpi_video_device_lcd_set_level(device, level_next);
--- /dev/null
+From d8009882e9f5e1a76986c741f071edd2ad760c97 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Sun, 7 Sep 2008 12:51:13 +0200
+Subject: ALSA: use correct lock in snd_ctl_dev_disconnect()
+Message-ID: <20081031164425.GA10625@puku.stupidest.org>
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit d8009882e9f5e1a76986c741f071edd2ad760c97 upstream
+
+The lock used in snd_ctl_dev_disconnect() should be card->ctl_files_rwlock
+for protection of card->ctl_files entries, instead of card->controls_rwsem.
+
+Reported-by: Vegard Nossum <vegard.nossum@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Jaroslav Kysela <perex@perex.cz>
+Cc: Chris Wedgwood <cw@f00f.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/core/control.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/core/control.c
++++ b/sound/core/control.c
+@@ -1426,12 +1426,12 @@ static int snd_ctl_dev_disconnect(struct
+ cardnum = card->number;
+ snd_assert(cardnum >= 0 && cardnum < SNDRV_CARDS, return -ENXIO);
+
+- down_read(&card->controls_rwsem);
++ read_lock(&card->ctl_files_rwlock);
+ list_for_each_entry(ctl, &card->ctl_files, list) {
+ wake_up(&ctl->change_sleep);
+ kill_fasync(&ctl->fasync, SIGIO, POLL_ERR);
+ }
+- up_read(&card->controls_rwsem);
++ read_unlock(&card->ctl_files_rwlock);
+
+ if ((err = snd_unregister_device(SNDRV_DEVICE_TYPE_CONTROL,
+ card, -1)) < 0)
--- /dev/null
+From mkrufky@linuxtv.org Fri Nov 7 14:01:33 2008
+From: Steven Toth <stoth@linuxtv.org>
+Date: Sun, 02 Nov 2008 23:04:33 -0500
+Subject: DVB: s5h1411: bugfix: Setting serial or parallel mode could destroy bits
+To: stable@kernel.org
+Cc: v4l-dvb maintainer list <v4l-dvb-maintainer@linuxtv.org>, Steven Toth <stoth@linuxtv.org>, Mauro Carvalho Chehab <mchehab@redhat.com>
+Message-ID: <490E7851.4070206@linuxtv.org>
+
+
+From: Steven Toth <stoth@linuxtv.org>
+
+commit 1af46b450fa49c57d73764d66f267335ccd807e2 upstream.
+
+DVB: s5h1411: bugfix: Setting serial or parallel mode could destroy bits
+
+Adding a serialmode function to read/and/or/write the register for safety.
+
+Signed-off-by: Steven Toth <stoth@linuxtv.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/dvb/frontends/s5h1411.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/dvb/frontends/s5h1411.c
++++ b/drivers/media/dvb/frontends/s5h1411.c
+@@ -472,6 +472,20 @@ static int s5h1411_set_spectralinversion
+ return s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0x24, val);
+ }
+
++static int s5h1411_set_serialmode(struct dvb_frontend *fe, int serial)
++{
++ struct s5h1411_state *state = fe->demodulator_priv;
++ u16 val;
++
++ dprintk("%s(%d)\n", __func__, serial);
++ val = s5h1411_readreg(state, S5H1411_I2C_TOP_ADDR, 0xbd) & ~0x100;
++
++ if (serial == 1)
++ val |= 0x100;
++
++ return s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xbd, val);
++}
++
+ static int s5h1411_enable_modulation(struct dvb_frontend *fe,
+ fe_modulation_t m)
+ {
+@@ -612,10 +626,10 @@ static int s5h1411_init(struct dvb_front
+
+ if (state->config->output_mode == S5H1411_SERIAL_OUTPUT)
+ /* Serial */
+- s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xbd, 0x1101);
++ s5h1411_set_serialmode(fe, 1);
+ else
+ /* Parallel */
+- s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xbd, 0x1001);
++ s5h1411_set_serialmode(fe, 0);
+
+ s5h1411_set_spectralinversion(fe, state->config->inversion);
+ s5h1411_set_if_freq(fe, state->config->vsb_if);
--- /dev/null
+From mkrufky@linuxtv.org Fri Nov 7 14:02:09 2008
+From: Devin Heitmueller <devin.heitmueller@gmail.com>
+Date: Sun, 02 Nov 2008 23:04:36 -0500
+Subject: DVB: s5h1411: Perform s5h1411 soft reset after tuning
+To: stable@kernel.org
+Cc: v4l-dvb maintainer list <v4l-dvb-maintainer@linuxtv.org>, Steven Toth <stoth@linuxtv.org>, Devin Heitmueller <devin.heitmueller@gmail.com>, Mauro Carvalho Chehab <mchehab@redhat.com>
+Message-ID: <490E7854.9040901@linuxtv.org>
+
+
+From: Devin Heitmueller <devin.heitmueller@gmail.com>
+
+commit f0d041e50bc6c8a677922d72b010f80af9b23b18 upstream.
+
+DVB: s5h1411: Perform s5h1411 soft reset after tuning
+
+If you instruct the tuner to change frequencies, it can take up to 2500ms to
+get a demod lock. By performing a soft reset after the tuning call (which
+is consistent with how the Pinnacle 801e Windows driver behaves), you get
+a demod lock inside of 300ms
+
+Signed-off-by: Devin Heitmueller <devin.heitmueller@gmail.com>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Acked-by: Steven Toth <stoth@linuxtv.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/dvb/frontends/s5h1411.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/dvb/frontends/s5h1411.c
++++ b/drivers/media/dvb/frontends/s5h1411.c
+@@ -588,9 +588,6 @@ static int s5h1411_set_frontend(struct d
+
+ s5h1411_enable_modulation(fe, p->u.vsb.modulation);
+
+- /* Allow the demod to settle */
+- msleep(100);
+-
+ if (fe->ops.tuner_ops.set_params) {
+ if (fe->ops.i2c_gate_ctrl)
+ fe->ops.i2c_gate_ctrl(fe, 1);
+@@ -601,6 +598,10 @@ static int s5h1411_set_frontend(struct d
+ fe->ops.i2c_gate_ctrl(fe, 0);
+ }
+
++ /* Issue a reset to the demod so it knows to resync against the
++ newly tuned frequency */
++ s5h1411_softreset(fe);
++
+ return 0;
+ }
+
--- /dev/null
+From mkrufky@linuxtv.org Fri Nov 7 14:02:47 2008
+From: Devin Heitmueller <devin.heitmueller@gmail.com>
+Date: Sun, 02 Nov 2008 23:04:38 -0500
+Subject: DVB: s5h1411: Power down s5h1411 when not in use
+To: stable@kernel.org
+Cc: v4l-dvb maintainer list <v4l-dvb-maintainer@linuxtv.org>, Steven Toth <stoth@linuxtv.org>, Devin Heitmueller <devin.heitmueller@gmail.com>, Mauro Carvalho Chehab <mchehab@redhat.com>
+Message-ID: <490E7856.80808@linuxtv.org>
+
+
+From: Devin Heitmueller <devin.heitmueller@gmail.com>
+
+commit 11fc9a4a440112b5afc1a99d86ba92d70205a688 upstream.
+
+DVB: s5h1411: Power down s5h1411 when not in use
+
+Power down the s5h1411 demodulator when not in use
+(on the Pinnacle 801e, this brings idle power from
+123ma down to 84ma).
+
+Signed-off-by: Devin Heitmueller <devin.heitmueller@gmail.com>
+Acked-by: Steven Toth <stoth@linuxtv.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/dvb/frontends/s5h1411.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/dvb/frontends/s5h1411.c
++++ b/drivers/media/dvb/frontends/s5h1411.c
+@@ -549,7 +549,7 @@ static int s5h1411_set_gpio(struct dvb_f
+ return s5h1411_writereg(state, S5H1411_I2C_TOP_ADDR, 0xe0, val);
+ }
+
+-static int s5h1411_sleep(struct dvb_frontend *fe, int enable)
++static int s5h1411_set_powerstate(struct dvb_frontend *fe, int enable)
+ {
+ struct s5h1411_state *state = fe->demodulator_priv;
+
+@@ -565,6 +565,11 @@ static int s5h1411_sleep(struct dvb_fron
+ return 0;
+ }
+
++static int s5h1411_sleep(struct dvb_frontend *fe)
++{
++ return s5h1411_set_powerstate(fe, 1);
++}
++
+ static int s5h1411_register_reset(struct dvb_frontend *fe)
+ {
+ struct s5h1411_state *state = fe->demodulator_priv;
+@@ -614,7 +619,7 @@ static int s5h1411_init(struct dvb_front
+
+ dprintk("%s()\n", __func__);
+
+- s5h1411_sleep(fe, 0);
++ s5h1411_set_powerstate(fe, 0);
+ s5h1411_register_reset(fe);
+
+ for (i = 0; i < ARRAY_SIZE(init_tab); i++)
+@@ -878,6 +883,7 @@ static struct dvb_frontend_ops s5h1411_o
+ },
+
+ .init = s5h1411_init,
++ .sleep = s5h1411_sleep,
+ .i2c_gate_ctrl = s5h1411_i2c_gate_ctrl,
+ .set_frontend = s5h1411_set_frontend,
+ .get_frontend = s5h1411_get_frontend,
--- /dev/null
+From 3318a386e4ca68c76e0294363d29bdc46fcad670 Mon Sep 17 00:00:00 2001
+From: Serge Hallyn <serue@us.ibm.com>
+Date: Thu, 30 Oct 2008 11:52:23 -0500
+Subject: file caps: always start with clear bprm->caps_*
+
+From: Serge Hallyn <serue@us.ibm.com>
+
+commit 3318a386e4ca68c76e0294363d29bdc46fcad670 upstream
+
+While Linux doesn't honor setuid on scripts. However, it mistakenly
+behaves differently for file capabilities.
+
+This patch fixes that behavior by making sure that get_file_caps()
+begins with empty bprm->caps_*. That way when a script is loaded,
+its bprm->caps_* may be filled when binfmt_misc calls prepare_binprm(),
+but they will be cleared again when binfmt_elf calls prepare_binprm()
+next to read the interpreter's file capabilities.
+
+Signed-off-by: Serge Hallyn <serue@us.ibm.com>
+Acked-by: David Howells <dhowells@redhat.com>
+Acked-by: Andrew G. Morgan <morgan@kernel.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ security/commoncap.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -247,10 +247,10 @@ static int get_file_caps(struct linux_bi
+ struct vfs_cap_data vcaps;
+ struct inode *inode;
+
+- if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID) {
+- bprm_clear_caps(bprm);
++ bprm_clear_caps(bprm);
++
++ if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
+ return 0;
+- }
+
+ dentry = dget(bprm->file->f_dentry);
+ inode = dentry->d_inode;
--- /dev/null
+From jejb@kernel.org Tue Nov 4 11:44:30 2008
+From: Johannes Berg <johannes@sipsolutions.net>
+Date: Sun, 2 Nov 2008 19:30:21 GMT
+Subject: libertas: fix buffer overrun
+To: jejb@kernel.org, stable@kernel.org
+Message-ID: <200811021930.mA2JULX5009457@hera.kernel.org>
+
+From: Johannes Berg <johannes@sipsolutions.net>
+
+commit 48735d8d8bd701b1e0cd3d49c21e5e385ddcb077 upstream
+
+If somebody sends an invalid beacon/probe response, that can trash the
+whole BSS descriptor. The descriptor is, luckily, large enough so that
+it cannot scribble past the end of it; it's well above 400 bytes long.
+
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/libertas/scan.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/libertas/scan.c
++++ b/drivers/net/wireless/libertas/scan.c
+@@ -598,8 +598,8 @@ static int lbs_process_bss(struct bss_de
+
+ switch (elem->id) {
+ case MFIE_TYPE_SSID:
+- bss->ssid_len = elem->len;
+- memcpy(bss->ssid, elem->data, elem->len);
++ bss->ssid_len = min_t(int, 32, elem->len);
++ memcpy(bss->ssid, elem->data, bss->ssid_len);
+ lbs_deb_scan("got SSID IE: '%s', len %u\n",
+ escape_essid(bss->ssid, bss->ssid_len),
+ bss->ssid_len);
--- /dev/null
+From f8d570a4745835f2238a33b537218a1bb03fc671 Mon Sep 17 00:00:00 2001
+From: David Miller <davem@davemloft.net>
+Date: Thu, 6 Nov 2008 00:37:40 -0800
+Subject: net: Fix recursive descent in __scm_destroy().
+
+From: David Miller <davem@davemloft.net>
+
+commit f8d570a4745835f2238a33b537218a1bb03fc671 and
+3b53fbf4314594fa04544b02b2fc6e607912da18 upstream (because once wasn't
+good enough...)
+
+__scm_destroy() walks the list of file descriptors in the scm_fp_list
+pointed to by the scm_cookie argument.
+
+Those, in turn, can close sockets and invoke __scm_destroy() again.
+
+There is nothing which limits how deeply this can occur.
+
+The idea for how to fix this is from Linus. Basically, we do all of
+the fput()s at the top level by collecting all of the scm_fp_list
+objects hit by an fput(). Inside of the initial __scm_destroy() we
+keep running the list until it is empty.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/sched.h | 4 +++-
+ include/net/scm.h | 5 +++--
+ net/core/scm.c | 24 +++++++++++++++++++++---
+ 3 files changed, 27 insertions(+), 6 deletions(-)
+
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1288,7 +1288,9 @@ struct task_struct {
+ atomic_t fs_excl; /* holding fs exclusive resources */
+ struct rcu_head rcu;
+
+- /*
++ struct list_head *scm_work_list;
++
++/*
+ * cache last used pipe for splice
+ */
+ struct pipe_inode_info *splice_pipe;
+--- a/include/net/scm.h
++++ b/include/net/scm.h
+@@ -14,8 +14,9 @@
+
+ struct scm_fp_list
+ {
+- int count;
+- struct file *fp[SCM_MAX_FD];
++ struct list_head list;
++ int count;
++ struct file *fp[SCM_MAX_FD];
+ };
+
+ struct scm_cookie
+--- a/net/core/scm.c
++++ b/net/core/scm.c
+@@ -75,6 +75,7 @@ static int scm_fp_copy(struct cmsghdr *c
+ if (!fpl)
+ return -ENOMEM;
+ *fplp = fpl;
++ INIT_LIST_HEAD(&fpl->list);
+ fpl->count = 0;
+ }
+ fpp = &fpl->fp[fpl->count];
+@@ -106,9 +107,25 @@ void __scm_destroy(struct scm_cookie *sc
+
+ if (fpl) {
+ scm->fp = NULL;
+- for (i=fpl->count-1; i>=0; i--)
+- fput(fpl->fp[i]);
+- kfree(fpl);
++ if (current->scm_work_list) {
++ list_add_tail(&fpl->list, current->scm_work_list);
++ } else {
++ LIST_HEAD(work_list);
++
++ current->scm_work_list = &work_list;
++
++ list_add(&fpl->list, &work_list);
++ while (!list_empty(&work_list)) {
++ fpl = list_first_entry(&work_list, struct scm_fp_list, list);
++
++ list_del(&fpl->list);
++ for (i=fpl->count-1; i>=0; i--)
++ fput(fpl->fp[i]);
++ kfree(fpl);
++ }
++
++ current->scm_work_list = NULL;
++ }
+ }
+ }
+
+@@ -284,6 +301,7 @@ struct scm_fp_list *scm_fp_dup(struct sc
+
+ new_fpl = kmalloc(sizeof(*fpl), GFP_KERNEL);
+ if (new_fpl) {
++ INIT_LIST_HEAD(&new_fpl->list);
+ for (i=fpl->count-1; i>=0; i--)
+ get_file(fpl->fp[i]);
+ memcpy(new_fpl, fpl, sizeof(*fpl));
--- /dev/null
+From khali@linux-fr.org Fri Nov 7 14:03:30 2008
+From: Lennart Sorensen <lsorense@csclub.uwaterloo.ca>
+Date: Fri, 31 Oct 2008 17:05:59 +0100
+Subject: scx200_i2c: Add missing class parameter
+To: stable@kernel.org
+Cc: Lennart Sorensen <lsorense@csclub.uwaterloo.ca>
+Message-ID: <20081031170559.0e5a1d18@hyperion.delvare>
+
+
+From: Lennart Sorensen <lsorense@csclub.uwaterloo.ca>
+
+commit 4a029abee0f1d69cb0445657d6fa5a38597bd17d upstream
+
+The scx200_i2c driver is missing the .class parameter, which means no
+i2c drivers are willing to probe for devices on the bus and attach to
+them.
+
+Signed-off-by: Len Sorensen <lsorense@csclub.uwaterloo.ca>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/i2c/busses/scx200_i2c.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/i2c/busses/scx200_i2c.c
++++ b/drivers/i2c/busses/scx200_i2c.c
+@@ -81,6 +81,7 @@ static struct i2c_algo_bit_data scx200_i
+
+ static struct i2c_adapter scx200_i2c_ops = {
+ .owner = THIS_MODULE,
++ .class = I2C_CLASS_HWMON,
+ .id = I2C_HW_B_SCX200,
+ .algo_data = &scx200_i2c_data,
+ .name = "NatSemi SCx200 I2C",
ext-avoid-printk-floods-in-the-face-of-directory-corruption.patch
edac-cell-fix-incorrect-edac_mode.patch
scsi-qla2xxx-skip-fdmi-registration-on-isp21xx-22xx-parts.patch
+net-fix-recursive-descent-in-__scm_destroy.patch
+libertas-fix-buffer-overrun.patch
+file-caps-always-start-with-clear-bprm-caps_.patch
+alsa-use-correct-lock-in-snd_ctl_dev_disconnect.patch
+acpi-always-report-a-sync-event-after-a-lid-state-change.patch
+v4l-pvrusb2-keep-mpeg-ptss-from-drifting-away.patch
+dvb-s5h1411-bugfix-setting-serial-or-parallel-mode-could-destroy-bits.patch
+dvb-s5h1411-perform-s5h1411-soft-reset-after-tuning.patch
+dvb-s5h1411-power-down-s5h1411-when-not-in-use.patch
+scx200_i2c-add-missing-class-parameter.patch
+0001-net-Fix-netdev_run_todo-dead-lock.patch
+0002-tcpv6-fix-option-space-offsets-with-md5.patch
+0001-math-emu-Fix-signalling-of-underflow-and-inexact-wh.patch
+0002-sparc64-Fix-race-in-arch-sparc64-kernel-trampoline.patch
+acpi-video-fix-brightness-allocation.patch
+acpi-dock-avoid-check-_sta-method.patch
--- /dev/null
+From mkrufky@linuxtv.org Fri Nov 7 14:00:24 2008
+From: Boris Dores <babal@via.ecp.fr>
+Date: Sun, 02 Nov 2008 23:04:30 -0500
+Subject: V4L: pvrusb2: Keep MPEG PTSs from drifting away
+To: stable@kernel.org
+Cc: Boris Dores <babal@via.ecp.fr>, v4l-dvb maintainer list <v4l-dvb-maintainer@linuxtv.org>, Mike Isely <isely@pobox.com>, Mauro Carvalho Chehab <mchehab@redhat.com>
+Message-ID: <490E784E.1030000@linuxtv.org>
+
+
+From: Boris Dores <babal@via.ecp.fr>
+
+commit 3f93d1adca658201c64251c43a147cc79d468c3f upstream.
+
+V4L: pvrusb2: Keep MPEG PTSs from drifting away
+
+This change was empirically figured out by Boris Dores after
+empirically comparing against behavior in the Windows driver.
+
+Signed-off-by: Mike Isely <isely@pobox.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/pvrusb2/pvrusb2-encoder.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/media/video/pvrusb2/pvrusb2-encoder.c
++++ b/drivers/media/video/pvrusb2/pvrusb2-encoder.c
+@@ -403,6 +403,10 @@ static int pvr2_encoder_prep_config(stru
+ ret |= pvr2_encoder_vcmd(hdw, CX2341X_ENC_MISC,4, 0,3,0,0);
+ ret |= pvr2_encoder_vcmd(hdw, CX2341X_ENC_MISC,4,15,0,0,0);
+
++ /* prevent the PTSs from slowly drifting away in the generated
++ MPEG stream */
++ ret |= pvr2_encoder_vcmd(hdw, CX2341X_ENC_MISC, 2, 4, 1);
++
+ return ret;
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
