--- /dev/null
+From 453d3131ec7aab82eaaa8401a50522a337092aa8 Mon Sep 17 00:00:00 2001
+From: Robert Hancock <hancockrwd@gmail.com>
+Date: Tue, 26 Jan 2010 22:33:23 -0600
+Subject: ahci: disable FPDMA auto-activate optimization on NVIDIA AHCI
+
+From: Robert Hancock <hancockrwd@gmail.com>
+
+commit 453d3131ec7aab82eaaa8401a50522a337092aa8 upstream.
+
+Mike Cui reported that his system with an NVIDIA MCP79 (aka MCP7A)
+chipset stopped working with 2.6.32. The problem appears to be that
+2.6.32 now enables the FPDMA auto-activate optimization in the ahci
+driver. The drive works fine with this enabled on an Intel AHCI so
+this appears to be a chipset bug. Since MCP79 is a fairly recent
+NVIDIA chipset and we don't have any info on whether any other NVIDIA
+chipsets have this issue, disable FPDMA AA optimization on all NVIDIA
+AHCI controllers for now.
+
+Should address http://bugzilla.kernel.org/show_bug.cgi?id=14922
+
+Signed-off-by: Robert Hancock <hancockrwd@gmail.com>
+While-we-investigate-issue-this-patch-looks-good-to-me-by:
+ Prajakta Gudadhe <pgudadhe@nvidia.com>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/ahci.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -3074,8 +3074,16 @@ static int ahci_init_one(struct pci_dev
+ ahci_save_initial_config(pdev, hpriv);
+
+ /* prepare host */
+- if (hpriv->cap & HOST_CAP_NCQ)
+- pi.flags |= ATA_FLAG_NCQ | ATA_FLAG_FPDMA_AA;
++ if (hpriv->cap & HOST_CAP_NCQ) {
++ pi.flags |= ATA_FLAG_NCQ;
++ /* Auto-activate optimization is supposed to be supported on
++ all AHCI controllers indicating NCQ support, but it seems
++ to be broken at least on some NVIDIA MCP79 chipsets.
++ Until we get info on which NVIDIA chipsets don't have this
++ issue, if any, disable AA on all NVIDIA AHCIs. */
++ if (pdev->vendor != PCI_VENDOR_ID_NVIDIA)
++ pi.flags |= ATA_FLAG_FPDMA_AA;
++ }
+
+ if (hpriv->cap & HOST_CAP_PMP)
+ pi.flags |= ATA_FLAG_PMP;
--- /dev/null
+From b857df1acc634b18db1db2a40864af985100266e Mon Sep 17 00:00:00 2001
+From: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+Date: Thu, 18 Feb 2010 18:07:18 +0100
+Subject: ARM: 5944/1: scsi: fix timer setup in fas216.c
+
+From: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+
+commit b857df1acc634b18db1db2a40864af985100266e upstream.
+
+mod_timer() takes an absolute time and not a delay as its argument.
+
+Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/arm/fas216.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/arm/fas216.c
++++ b/drivers/scsi/arm/fas216.c
+@@ -2516,7 +2516,7 @@ int fas216_eh_device_reset(struct scsi_c
+ if (info->scsi.phase == PHASE_IDLE)
+ fas216_kick(info);
+
+- mod_timer(&info->eh_timer, 30 * HZ);
++ mod_timer(&info->eh_timer, jiffies + 30 * HZ);
+ spin_unlock_irqrestore(&info->host_lock, flags);
+
+ /*
--- /dev/null
+From 3dae93ec3ee1fceec69f40ef9b97892ce62ba7a5 Mon Sep 17 00:00:00 2001
+From: Mike Frysinger <vapier@gentoo.org>
+Date: Mon, 15 Feb 2010 19:32:25 -0500
+Subject: [WATCHDOG] bfin: fix max timeout calculation
+
+From: Mike Frysinger <vapier@gentoo.org>
+
+commit 3dae93ec3ee1fceec69f40ef9b97892ce62ba7a5 upstream.
+
+Relying on overflow/wrap around isn't exact because if you wrap far
+enough, you get back to "valid" values.
+
+Reported-by: Thorsten Pohlmann <pohlmann@tetronik.com>
+Signed-off-by: Mike Frysinger <vapier@gentoo.org>
+Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/watchdog/bfin_wdt.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/drivers/watchdog/bfin_wdt.c
++++ b/drivers/watchdog/bfin_wdt.c
+@@ -1,9 +1,8 @@
+ /*
+ * Blackfin On-Chip Watchdog Driver
+- * Supports BF53[123]/BF53[467]/BF54[2489]/BF561
+ *
+ * Originally based on softdog.c
+- * Copyright 2006-2007 Analog Devices Inc.
++ * Copyright 2006-2010 Analog Devices Inc.
+ * Copyright 2006-2007 Michele d'Amico
+ * Copyright 1996 Alan Cox <alan@lxorguk.ukuu.org.uk>
+ *
+@@ -137,13 +136,15 @@ static int bfin_wdt_running(void)
+ */
+ static int bfin_wdt_set_timeout(unsigned long t)
+ {
+- u32 cnt;
++ u32 cnt, max_t, sclk;
+ unsigned long flags;
+
+- stampit();
++ sclk = get_sclk();
++ max_t = -1 / sclk;
++ cnt = t * sclk;
++ stamp("maxtimeout=%us newtimeout=%lus (cnt=%#x)", max_t, t, cnt);
+
+- cnt = t * get_sclk();
+- if (cnt < get_sclk()) {
++ if (t > max_t) {
+ printk(KERN_WARNING PFX "timeout value is too large\n");
+ return -EINVAL;
+ }
--- /dev/null
+From a17e18790a8c47113a73139d54a375dc9ccd8f08 Mon Sep 17 00:00:00 2001
+From: Michael Neuling <mikey@neuling.org>
+Date: Mon, 22 Feb 2010 12:44:24 -0800
+Subject: fs/exec.c: fix initial stack reservation
+
+From: Michael Neuling <mikey@neuling.org>
+
+commit a17e18790a8c47113a73139d54a375dc9ccd8f08 upstream.
+
+803bf5ec259941936262d10ecc84511b76a20921 ("fs/exec.c: restrict initial
+stack space expansion to rlimit") attempts to limit the initial stack to
+20*PAGE_SIZE. Unfortunately, in attempting ensure the stack is not
+reduced in size, we ended up not changing the stack at all.
+
+This size reduction check is not necessary as the expand_stack call does
+this already.
+
+This caused a regression in UML resulting in most guest processes being
+killed.
+
+Signed-off-by: Michael Neuling <mikey@neuling.org>
+Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Acked-by: WANG Cong <xiyou.wangcong@gmail.com>
+Cc: Anton Blanchard <anton@samba.org>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Cc: James Morris <jmorris@namei.org>
+Cc: Serge Hallyn <serue@us.ibm.com>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Jouni Malinen <j@w1.fi>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/exec.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -638,7 +638,6 @@ int setup_arg_pages(struct linux_binprm
+ * will align it up.
+ */
+ rlim_stack = rlimit(RLIMIT_STACK) & PAGE_MASK;
+- rlim_stack = min(rlim_stack, stack_size);
+ #ifdef CONFIG_STACK_GROWSUP
+ if (stack_size + stack_expand > rlim_stack)
+ stack_base = vma->vm_start + rlim_stack;
--- /dev/null
+From a239a8b47cc0e5e6d7416a89f340beac06d5edaa Mon Sep 17 00:00:00 2001
+From: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Date: Fri, 19 Feb 2010 15:47:32 -0800
+Subject: iwlwifi: error checking for number of tfds in queue
+
+From: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+
+commit a239a8b47cc0e5e6d7416a89f340beac06d5edaa upstream.
+
+When receive reply_tx and ready to decrement the count for number of
+tfds in queue, do error checking to prevent error condition and
+tfds_in_queue become negative number.
+
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-4965.c | 2 +-
+ drivers/net/wireless/iwlwifi/iwl-5000.c | 4 ++--
+ drivers/net/wireless/iwlwifi/iwl-core.h | 2 ++
+ drivers/net/wireless/iwlwifi/iwl-tx.c | 16 +++++++++++++++-
+ 4 files changed, 20 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
++++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
+@@ -2134,7 +2134,7 @@ static void iwl4965_rx_reply_tx(struct i
+ IWL_DEBUG_TX_REPLY(priv, "Retry scheduler reclaim scd_ssn "
+ "%d index %d\n", scd_ssn , index);
+ freed = iwl_tx_queue_reclaim(priv, txq_id, index);
+- priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
++ iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
+
+ if (priv->mac80211_registered &&
+ (iwl_queue_space(&txq->q) > txq->q.low_mark) &&
+--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
+@@ -1264,7 +1264,7 @@ static void iwl5000_rx_reply_tx(struct i
+ scd_ssn , index, txq_id, txq->swq_id);
+
+ freed = iwl_tx_queue_reclaim(priv, txq_id, index);
+- priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
++ iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
+
+ if (priv->mac80211_registered &&
+ (iwl_queue_space(&txq->q) > txq->q.low_mark) &&
+@@ -1294,7 +1294,7 @@ static void iwl5000_rx_reply_tx(struct i
+
+ freed = iwl_tx_queue_reclaim(priv, txq_id, index);
+ if (ieee80211_is_data_qos(tx_resp->frame_ctrl))
+- priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
++ iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
+
+ if (priv->mac80211_registered &&
+ (iwl_queue_space(&txq->q) > txq->q.low_mark))
+--- a/drivers/net/wireless/iwlwifi/iwl-core.h
++++ b/drivers/net/wireless/iwlwifi/iwl-core.h
+@@ -410,6 +410,8 @@ void iwl_hw_txq_ctx_free(struct iwl_priv
+ int iwl_hw_tx_queue_init(struct iwl_priv *priv,
+ struct iwl_tx_queue *txq);
+ int iwl_txq_update_write_ptr(struct iwl_priv *priv, struct iwl_tx_queue *txq);
++void iwl_free_tfds_in_queue(struct iwl_priv *priv,
++ int sta_id, int tid, int freed);
+ int iwl_tx_queue_init(struct iwl_priv *priv, struct iwl_tx_queue *txq,
+ int slots_num, u32 txq_id);
+ void iwl_tx_queue_free(struct iwl_priv *priv, int txq_id);
+--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
+@@ -119,6 +119,20 @@ int iwl_txq_update_write_ptr(struct iwl_
+ EXPORT_SYMBOL(iwl_txq_update_write_ptr);
+
+
++void iwl_free_tfds_in_queue(struct iwl_priv *priv,
++ int sta_id, int tid, int freed)
++{
++ if (priv->stations[sta_id].tid[tid].tfds_in_queue >= freed)
++ priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
++ else {
++ IWL_ERR(priv, "free more than tfds_in_queue (%u:%d)\n",
++ priv->stations[sta_id].tid[tid].tfds_in_queue,
++ freed);
++ priv->stations[sta_id].tid[tid].tfds_in_queue = 0;
++ }
++}
++EXPORT_SYMBOL(iwl_free_tfds_in_queue);
++
+ /**
+ * iwl_tx_queue_free - Deallocate DMA queue.
+ * @txq: Transmit queue to deallocate.
+@@ -1485,7 +1499,7 @@ void iwl_rx_reply_compressed_ba(struct i
+ if (txq->q.read_ptr != (ba_resp_scd_ssn & 0xff)) {
+ /* calculate mac80211 ampdu sw queue to wake */
+ int freed = iwl_tx_queue_reclaim(priv, scd_flow, index);
+- priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
++ iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
+
+ if ((iwl_queue_space(&txq->q) > txq->q.low_mark) &&
+ priv->mac80211_registered &&
--- /dev/null
+From a120e912eb51e347f36c71b60a1d13af74d30e83 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Fri, 19 Feb 2010 15:47:33 -0800
+Subject: iwlwifi: sanity check before counting number of tfds can be free
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit a120e912eb51e347f36c71b60a1d13af74d30e83 upstream.
+
+Check the frame control for ieee80211_is_data_qos() is true before
+counting the number of tfds can be free, the tfds_in_queue only
+increment when ieee80211_is_data_qos() is true before transmit; so it
+should only decrement if the type match.
+
+Remove ieee80211_is_data_qos check for frame_ctrl in tx_resp to avoid
+invalid information pass from uCode.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-5000.c | 6 ++----
+ drivers/net/wireless/iwlwifi/iwl-tx.c | 5 +++++
+ 2 files changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
+@@ -1293,16 +1293,14 @@ static void iwl5000_rx_reply_tx(struct i
+ tx_resp->failure_frame);
+
+ freed = iwl_tx_queue_reclaim(priv, txq_id, index);
+- if (ieee80211_is_data_qos(tx_resp->frame_ctrl))
+- iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
++ iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
+
+ if (priv->mac80211_registered &&
+ (iwl_queue_space(&txq->q) > txq->q.low_mark))
+ iwl_wake_queue(priv, txq_id);
+ }
+
+- if (ieee80211_is_data_qos(tx_resp->frame_ctrl))
+- iwl_txq_check_empty(priv, sta_id, tid, txq_id);
++ iwl_txq_check_empty(priv, sta_id, tid, txq_id);
+
+ if (iwl_check_bits(status, TX_ABORT_REQUIRED_MSK))
+ IWL_ERR(priv, "TODO: Implement Tx ABORT REQUIRED!!!\n");
+--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
+@@ -1071,6 +1071,7 @@ int iwl_tx_queue_reclaim(struct iwl_priv
+ struct iwl_queue *q = &txq->q;
+ struct iwl_tx_info *tx_info;
+ int nfreed = 0;
++ struct ieee80211_hdr *hdr;
+
+ if ((index >= q->n_bd) || (iwl_queue_used(q, index) == 0)) {
+ IWL_ERR(priv, "Read index for DMA queue txq id (%d), index %d, "
+@@ -1085,6 +1086,10 @@ int iwl_tx_queue_reclaim(struct iwl_priv
+
+ tx_info = &txq->txb[txq->q.read_ptr];
+ ieee80211_tx_status_irqsafe(priv->hw, tx_info->skb[0]);
++
++ hdr = (struct ieee80211_hdr *)tx_info->skb[0]->data;
++ if (hdr && ieee80211_is_data_qos(hdr->frame_control))
++ nfreed++;
+ tx_info->skb[0] = NULL;
+
+ if (priv->cfg->ops->lib->txq_inval_byte_cnt_tbl)
--- /dev/null
+From 5e2f75b8993a0d83d469388b50716dd5551f2eb4 Mon Sep 17 00:00:00 2001
+From: Dan Halperin <dhalperi@cs.washington.edu>
+Date: Thu, 18 Feb 2010 22:01:39 -0800
+Subject: iwlwifi: set HT flags after channel in rxon
+
+From: Dan Halperin <dhalperi@cs.washington.edu>
+
+commit 5e2f75b8993a0d83d469388b50716dd5551f2eb4 upstream.
+
+The HT extension channel settings require priv->staging_rxon.channel to be
+accurate. However, iwl_set_rxon_ht was being called before iwl_set_rxon_channel
+and thus HT40 could be broken unless another call to iwl_mac_config came in.
+
+This problem was recently introduced by "iwlwifi: Fix to set correct ht
+configuration"
+
+The particular setting in which I noticed this was monitor mode:
+
+ iwconfig wlan0 mode monitor
+ ifconfig wlan0 up
+ ./iw wlan0 set channel 64 HT40-
+ #./iw wlan0 set channel 64 HT40-
+ tcpdump -i wlan0 -y IEEE802_11_RADIO
+
+would only catch HT40 packets if I issued the IW command twice.
+
+From visual inspection, iwl_set_rxon_channel does not depend on
+iwl_set_rxon_ht, so simply swapping them should be safe and fixes this problem.
+
+Signed-off-by: Daniel Halperin <dhalperi@cs.washington.edu>
+Acked-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-core.c
++++ b/drivers/net/wireless/iwlwifi/iwl-core.c
+@@ -2645,8 +2645,8 @@ int iwl_mac_config(struct ieee80211_hw *
+ if ((le16_to_cpu(priv->staging_rxon.channel) != ch))
+ priv->staging_rxon.flags = 0;
+
+- iwl_set_rxon_ht(priv, ht_conf);
+ iwl_set_rxon_channel(priv, conf->channel);
++ iwl_set_rxon_ht(priv, ht_conf);
+
+ iwl_set_flags_for_band(priv, conf->channel->band);
+ spin_unlock_irqrestore(&priv->lock, flags);
--- /dev/null
+From 5a2d41961dd6815b874b5c0afec0ac96cd90eea4 Mon Sep 17 00:00:00 2001
+From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Date: Mon, 22 Feb 2010 12:44:14 -0800
+Subject: memcg: fix oom killing a child process in an other cgroup
+
+From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+
+commit 5a2d41961dd6815b874b5c0afec0ac96cd90eea4 upstream.
+
+Presently the oom-killer is memcg aware and it finds the worst process
+from processes under memcg(s) in oom. Then, it kills victim's child
+first.
+
+It may kill a child in another cgroup and may not be any help for
+recovery. And it will break the assumption users have.
+
+This patch fixes it.
+
+Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Reviewed-by: Minchan Kim <minchan.kim@gmail.com>
+Cc: Balbir Singh <balbir@linux.vnet.ibm.com>
+Reviewed-by: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
+Acked-by: David Rientjes <rientjes@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/oom_kill.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/mm/oom_kill.c
++++ b/mm/oom_kill.c
+@@ -426,6 +426,8 @@ static int oom_kill_process(struct task_
+ list_for_each_entry(c, &p->children, sibling) {
+ if (c->mm == p->mm)
+ continue;
++ if (mem && !task_in_mem_cgroup(c, mem))
++ continue;
+ if (!oom_kill_task(c))
+ return 0;
+ }
--- /dev/null
+From c36f74e67fa12202dbcb4ad92c5ac844f9d36b98 Mon Sep 17 00:00:00 2001
+From: Joshua Roys <joshua.roys@gtri.gatech.edu>
+Date: Wed, 24 Feb 2010 18:52:44 -0500
+Subject: netlabel: fix export of SELinux categories > 127
+
+From: Joshua Roys <joshua.roys@gtri.gatech.edu>
+
+commit c36f74e67fa12202dbcb4ad92c5ac844f9d36b98 upstream.
+
+This fixes corrupted CIPSO packets when SELinux categories greater than 127
+are used. The bug occured on the second (and later) loops through the
+while; the inner for loop through the ebitmap->maps array used the same
+index as the NetLabel catmap->bitmap array, even though the NetLabel bitmap
+is twice as long as the SELinux bitmap.
+
+Signed-off-by: Joshua Roys <joshua.roys@gtri.gatech.edu>
+Acked-by: Paul Moore <paul.moore@hp.com>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ security/selinux/ss/ebitmap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/security/selinux/ss/ebitmap.c
++++ b/security/selinux/ss/ebitmap.c
+@@ -128,7 +128,7 @@ int ebitmap_netlbl_export(struct ebitmap
+ cmap_idx = delta / NETLBL_CATMAP_MAPSIZE;
+ cmap_sft = delta % NETLBL_CATMAP_MAPSIZE;
+ c_iter->bitmap[cmap_idx]
+- |= e_iter->maps[cmap_idx] << cmap_sft;
++ |= e_iter->maps[i] << cmap_sft;
+ }
+ e_iter = e_iter->next;
+ }
--- /dev/null
+From ba02b242bbf8e4e1bc63d62e8ccec33b4e5ea132 Mon Sep 17 00:00:00 2001
+From: Andrew Morton <akpm@linux-foundation.org>
+Date: Tue, 2 Feb 2010 14:45:54 -0800
+Subject: PCI hotplug: check ioremap() return value in ibmphp_ebda.c
+
+From: Andrew Morton <akpm@linux-foundation.org>
+
+commit ba02b242bbf8e4e1bc63d62e8ccec33b4e5ea132 upstream.
+
+check ioremap() return value.
+
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/hotplug/ibmphp_ebda.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/pci/hotplug/ibmphp_ebda.c
++++ b/drivers/pci/hotplug/ibmphp_ebda.c
+@@ -261,6 +261,8 @@ int __init ibmphp_access_ebda (void)
+ debug ("returned ebda segment: %x\n", ebda_seg);
+
+ io_mem = ioremap(ebda_seg<<4, 1);
++ if (!io_mem)
++ return -ENOMEM;
+ ebda_sz = readb(io_mem);
+ iounmap(io_mem);
+ debug("ebda size: %d(KiB)\n", ebda_sz);
--- /dev/null
+From b0fc889c4311835ae7d02f433154bc20cad9ee11 Mon Sep 17 00:00:00 2001
+From: Chandru <chandru@in.ibm.com>
+Date: Mon, 11 Jan 2010 11:49:21 +0530
+Subject: PCI hotplug: ibmphp: read the length of ebda and map entire ebda region
+
+From: Chandru <chandru@in.ibm.com>
+
+commit b0fc889c4311835ae7d02f433154bc20cad9ee11 upstream.
+
+ibmphp driver currently maps only 1KB of ebda memory area into kernel address
+space during driver initialization. This causes kernel oops when the driver is
+modprobe'd and it accesses memory beyond 1KB within ebda segment. The first
+byte of ebda segment actually stores the length of the ebda region in
+Kilobytes. Hence make use of the length parameter and map the entire ebda
+region.
+
+Signed-off-by: Chandru Siddalingappa <chandru@linux.vnet.ibm.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/hotplug/ibmphp_ebda.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/pci/hotplug/ibmphp_ebda.c
++++ b/drivers/pci/hotplug/ibmphp_ebda.c
+@@ -245,7 +245,7 @@ static void __init print_ebda_hpc (void)
+
+ int __init ibmphp_access_ebda (void)
+ {
+- u8 format, num_ctlrs, rio_complete, hs_complete;
++ u8 format, num_ctlrs, rio_complete, hs_complete, ebda_sz;
+ u16 ebda_seg, num_entries, next_offset, offset, blk_id, sub_addr, re, rc_id, re_id, base;
+ int rc = 0;
+
+@@ -260,7 +260,14 @@ int __init ibmphp_access_ebda (void)
+ iounmap (io_mem);
+ debug ("returned ebda segment: %x\n", ebda_seg);
+
+- io_mem = ioremap(ebda_seg<<4, 1024);
++ io_mem = ioremap(ebda_seg<<4, 1);
++ ebda_sz = readb(io_mem);
++ iounmap(io_mem);
++ debug("ebda size: %d(KiB)\n", ebda_sz);
++ if (ebda_sz == 0)
++ return -ENOMEM;
++
++ io_mem = ioremap(ebda_seg<<4, (ebda_sz * 1024));
+ if (!io_mem )
+ return -ENOMEM;
+ next_offset = 0x180;
fix-lookup_follow-on-automount-symlinks.patch
+arm-5944-1-scsi-fix-timer-setup-in-fas216.c.patch
+v4l-dvb-dvb-l64781.ko-broken-with-gcc-4.5.patch
+bfin-fix-max-timeout-calculation.patch
+v4l-dvb-video-pwc-fix-regression-in-pwc_set_shutter_speed-caused-by-bad-constant-sizeof-conversion.patch
+v4l-dvb-bttv-move-i2c-ir-initialization.patch
+v4l-dvb-cxusb-select-all-required-frontend-and-tuner-modules.patch
+memcg-fix-oom-killing-a-child-process-in-an-other-cgroup.patch
+fs-exec.c-fix-initial-stack-reservation.patch
+iwlwifi-error-checking-for-number-of-tfds-in-queue.patch
+iwlwifi-set-ht-flags-after-channel-in-rxon.patch
+iwlwifi-sanity-check-before-counting-number-of-tfds-can-be-free.patch
+netlabel-fix-export-of-selinux-categories-127.patch
+ahci-disable-fpdma-auto-activate-optimization-on-nvidia-ahci.patch
+pci-hotplug-ibmphp-read-the-length-of-ebda-and-map-entire-ebda-region.patch
+pci-hotplug-check-ioremap-return-value-in-ibmphp_ebda.c.patch
--- /dev/null
+From 2434466432464110b5307757e0285dd41f15512e Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Fri, 19 Feb 2010 00:18:41 -0300
+Subject: V4L/DVB: bttv: Move I2C IR initialization
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit 2434466432464110b5307757e0285dd41f15512e upstream.
+
+Move I2C IR initialization from just after I2C bus setup to right
+before non-I2C IR initialization. This avoids the case where an I2C IR
+device is blocking audio support (at least the PV951 suffers from
+this). It is also more logical to group IR support together,
+regardless of the connectivity.
+
+This fixes bug #15184:
+http://bugzilla.kernel.org/show_bug.cgi?id=15184
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/bt8xx/bttv-driver.c | 1 +
+ drivers/media/video/bt8xx/bttv-i2c.c | 8 ++++++--
+ drivers/media/video/bt8xx/bttvp.h | 1 +
+ 3 files changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/video/bt8xx/bttv-driver.c
++++ b/drivers/media/video/bt8xx/bttv-driver.c
+@@ -4468,6 +4468,7 @@ static int __devinit bttv_probe(struct p
+ request_modules(btv);
+ }
+
++ init_bttv_i2c_ir(btv);
+ bttv_input_init(btv);
+
+ /* everything is fine */
+--- a/drivers/media/video/bt8xx/bttv-i2c.c
++++ b/drivers/media/video/bt8xx/bttv-i2c.c
+@@ -388,7 +388,12 @@ int __devinit init_bttv_i2c(struct bttv
+ if (0 == btv->i2c_rc && i2c_scan)
+ do_i2c_scan(btv->c.v4l2_dev.name, &btv->i2c_client);
+
+- /* Instantiate the IR receiver device, if present */
++ return btv->i2c_rc;
++}
++
++/* Instantiate the I2C IR receiver device, if present */
++void __devinit init_bttv_i2c_ir(struct bttv *btv)
++{
+ if (0 == btv->i2c_rc) {
+ struct i2c_board_info info;
+ /* The external IR receiver is at i2c address 0x34 (0x35 for
+@@ -408,7 +413,6 @@ int __devinit init_bttv_i2c(struct bttv
+ strlcpy(info.type, "ir_video", I2C_NAME_SIZE);
+ i2c_new_probed_device(&btv->c.i2c_adap, &info, addr_list);
+ }
+- return btv->i2c_rc;
+ }
+
+ int __devexit fini_bttv_i2c(struct bttv *btv)
+--- a/drivers/media/video/bt8xx/bttvp.h
++++ b/drivers/media/video/bt8xx/bttvp.h
+@@ -279,6 +279,7 @@ extern unsigned int bttv_debug;
+ extern unsigned int bttv_gpio;
+ extern void bttv_gpio_tracking(struct bttv *btv, char *comment);
+ extern int init_bttv_i2c(struct bttv *btv);
++extern void init_bttv_i2c_ir(struct bttv *btv);
+ extern int fini_bttv_i2c(struct bttv *btv);
+
+ #define bttv_printk if (bttv_verbose) printk
--- /dev/null
+From fc4a7f93087a48619005111895dcaa115f807399 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Wed, 10 Feb 2010 23:57:17 -0300
+Subject: V4L/DVB: cxusb: Select all required frontend and tuner modules
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+commit fc4a7f93087a48619005111895dcaa115f807399 upstream.
+
+cxusb uses the atbm8830 and lgs8gxx (not lgs8gl5) frontends and the
+max2165 tuner, so it needs to select them.
+
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/dvb/dvb-usb/Kconfig | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/dvb/dvb-usb/Kconfig
++++ b/drivers/media/dvb/dvb-usb/Kconfig
+@@ -112,11 +112,13 @@ config DVB_USB_CXUSB
+ select DVB_MT352 if !DVB_FE_CUSTOMISE
+ select DVB_ZL10353 if !DVB_FE_CUSTOMISE
+ select DVB_DIB7000P if !DVB_FE_CUSTOMISE
+- select DVB_LGS8GL5 if !DVB_FE_CUSTOMISE
+ select DVB_TUNER_DIB0070 if !DVB_FE_CUSTOMISE
++ select DVB_ATBM8830 if !DVB_FE_CUSTOMISE
++ select DVB_LGS8GXX if !DVB_FE_CUSTOMISE
+ select MEDIA_TUNER_SIMPLE if !MEDIA_TUNER_CUSTOMISE
+ select MEDIA_TUNER_XC2028 if !MEDIA_TUNER_CUSTOMISE
+ select MEDIA_TUNER_MXL5005S if !MEDIA_TUNER_CUSTOMISE
++ select MEDIA_TUNER_MAX2165 if !MEDIA_TUNER_CUSTOMISE
+ help
+ Say Y here to support the Conexant USB2.0 hybrid reference design.
+ Currently, only DVB and ATSC modes are supported, analog mode
--- /dev/null
+From c1db53b36633e6a7511dbec7c372f01a31528f0c Mon Sep 17 00:00:00 2001
+From: Richard Guenther <rguenther@suse.de>
+Date: Tue, 9 Feb 2010 20:16:03 -0300
+Subject: V4L/DVB: dvb: l64781.ko broken with gcc 4.5
+
+From: Richard Guenther <rguenther@suse.de>
+
+commit c1db53b36633e6a7511dbec7c372f01a31528f0c upstream.
+
+I'm trying to fix it on the GCC side (PR43007), but the module is
+quite stupid in using ULL constants to operate on u32 values:
+
+static int apply_frontend_param (struct dvb_frontend* fe, struct
+dvb_frontend_parameters *param)
+{
+...
+ static const u32 ppm = 8000;
+ u32 spi_bias;
+...
+
+ spi_bias *= 1000ULL;
+ spi_bias /= 1000ULL + ppm/1000;
+
+which causes current GCC 4.5 to emit calls to __udivdi3 for i?86 again.
+
+This patch fixes this issue.
+
+Signed-off-by: Richard Guenther <rguenther@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+
+---
+ drivers/media/dvb/frontends/l64781.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/dvb/frontends/l64781.c
++++ b/drivers/media/dvb/frontends/l64781.c
+@@ -192,8 +192,8 @@ static int apply_frontend_param (struct
+ spi_bias *= qam_tab[p->constellation];
+ spi_bias /= p->code_rate_HP + 1;
+ spi_bias /= (guard_tab[p->guard_interval] + 32);
+- spi_bias *= 1000ULL;
+- spi_bias /= 1000ULL + ppm/1000;
++ spi_bias *= 1000;
++ spi_bias /= 1000 + ppm/1000;
+ spi_bias *= p->code_rate_HP;
+
+ val0x04 = (p->transmission_mode << 2) | p->guard_interval;
--- /dev/null
+From 53f68607caba85db9a73846ccd289e4b7fa96295 Mon Sep 17 00:00:00 2001
+From: Martin Fuzzey <mfuzzey@gmail.com>
+Date: Thu, 11 Feb 2010 10:50:31 -0300
+Subject: V4L/DVB: Video : pwc : Fix regression in pwc_set_shutter_speed caused by bad constant => sizeof conversion.
+
+From: Martin Fuzzey <mfuzzey@gmail.com>
+
+commit 53f68607caba85db9a73846ccd289e4b7fa96295 upstream.
+
+Regression was caused by my commit 6b35ca0d3d586b8ecb8396821af21186e20afaf0
+which determined message size using sizeof rather than hardcoded constants.
+
+Unfortunately pwc_set_shutter_speed reuses a 2 byte buffer for a one byte
+message too so the sizeof was bogus in this case.
+
+All other uses of sizeof checked and are ok.
+
+Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Martin Fuzzey <mfuzzey@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/pwc/pwc-ctrl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/video/pwc/pwc-ctrl.c
++++ b/drivers/media/video/pwc/pwc-ctrl.c
+@@ -753,7 +753,7 @@ int pwc_set_shutter_speed(struct pwc_dev
+ buf[0] = 0xff; /* fixed */
+
+ ret = send_control_msg(pdev,
+- SET_LUM_CTL, SHUTTER_MODE_FORMATTER, &buf, sizeof(buf));
++ SET_LUM_CTL, SHUTTER_MODE_FORMATTER, &buf, 1);
+
+ if (!mode && ret >= 0) {
+ if (value < 0)
projects / thirdparty / kernel / stable-queue.git / commitdiff
