--- /dev/null
+From b0cf4dfb7cd21556efd9a6a67edcba0840b4d98d Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Wed, 7 Apr 2010 20:55:47 -0700
+Subject: 3c503: Fix IRQ probing
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+commit b0cf4dfb7cd21556efd9a6a67edcba0840b4d98d upstream.
+
+The driver attempts to select an IRQ for the NIC automatically by
+testing which of the supported IRQs are available and then probing
+each available IRQ with probe_irq_{on,off}(). There are obvious race
+conditions here, besides which:
+1. The test for availability is done by passing a NULL handler, which
+ now always returns -EINVAL, thus the device cannot be opened:
+ <http://bugs.debian.org/566522>
+2. probe_irq_off() will report only the first ISA IRQ handled,
+ potentially leading to a false negative.
+
+There was another bug that meant it ignored all error codes from
+request_irq() except -EBUSY, so it would 'succeed' despite this
+(possibly causing conflicts with other ISA devices). This was fixed
+by ab08999d6029bb2c79c16be5405d63d2bedbdfea 'WARNING: some
+request_irq() failures ignored in el2_open()', which exposed bug 1.
+
+This patch:
+1. Replaces the use of probe_irq_{on,off}() with a real interrupt handler
+2. Adds a delay before checking the interrupt-seen flag
+3. Disables interrupts on all failure paths
+4. Distinguishes error codes from the second request_irq() call,
+ consistently with the first
+
+Compile-tested only.
+
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/3c503.c | 42 ++++++++++++++++++++++++++++++------------
+ 1 file changed, 30 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/3c503.c
++++ b/drivers/net/3c503.c
+@@ -380,6 +380,12 @@ out:
+ return retval;
+ }
+
++static irqreturn_t el2_probe_interrupt(int irq, void *seen)
++{
++ *(bool *)seen = true;
++ return IRQ_HANDLED;
++}
++
+ static int
+ el2_open(struct net_device *dev)
+ {
+@@ -391,23 +397,35 @@ el2_open(struct net_device *dev)
+
+ outb(EGACFR_NORM, E33G_GACFR); /* Enable RAM and interrupts. */
+ do {
+- retval = request_irq(*irqp, NULL, 0, "bogus", dev);
+- if (retval >= 0) {
++ bool seen;
++
++ retval = request_irq(*irqp, el2_probe_interrupt, 0,
++ dev->name, &seen);
++ if (retval == -EBUSY)
++ continue;
++ if (retval < 0)
++ goto err_disable;
++
+ /* Twinkle the interrupt, and check if it's seen. */
+- unsigned long cookie = probe_irq_on();
++ seen = false;
++ smp_wmb();
+ outb_p(0x04 << ((*irqp == 9) ? 2 : *irqp), E33G_IDCFR);
+ outb_p(0x00, E33G_IDCFR);
+- if (*irqp == probe_irq_off(cookie) && /* It's a good IRQ line! */
+- ((retval = request_irq(dev->irq = *irqp,
+- eip_interrupt, 0,
+- dev->name, dev)) == 0))
+- break;
+- } else {
+- if (retval != -EBUSY)
+- return retval;
+- }
++ msleep(1);
++ free_irq(*irqp, el2_probe_interrupt);
++ if (!seen)
++ continue;
++
++ retval = request_irq(dev->irq = *irqp, eip_interrupt, 0,
++ dev->name, dev);
++ if (retval == -EBUSY)
++ continue;
++ if (retval < 0)
++ goto err_disable;
+ } while (*++irqp);
++
+ if (*irqp == 0) {
++ err_disable:
+ outb(EGACFR_IRQOFF, E33G_GACFR); /* disable interrupts. */
+ return -EAGAIN;
+ }
--- /dev/null
+From b721e68bdc5b39c51bf6a1469f8d3663fbe03243 Mon Sep 17 00:00:00 2001
+From: Giuliano Pochini <pochini@shiny.it>
+Date: Wed, 17 Feb 2010 00:57:44 +0100
+Subject: ALSA: Echoaudio, fix Guru Meditation #00000005.48454C50
+
+From: Giuliano Pochini <pochini@shiny.it>
+
+commit b721e68bdc5b39c51bf6a1469f8d3663fbe03243 upstream.
+
+This patch fixes a division by zero error in the irq handler.
+
+There is a small window between the hw_params() callback and when
+runtime->frame_bits is set by ALSA middle layer. When another substream is
+already running, if an interrupt is delivered during that window the irq
+handler calls pcm_pointer() which does a division by zero. The patch below
+makes the irq handler skip substreams that are initialized but not started
+yet. Cc to Clemens Ladisch because he proposed an alternate fix.
+
+For more information, please read the original thread in the linux-kernel
+mailing list: http://lkml.org/lkml/2010/2/2/187
+
+Signed-off-by: Giuliano Pochini <pochini@shiny.it>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/echoaudio/echoaudio.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/echoaudio/echoaudio.c
++++ b/sound/pci/echoaudio/echoaudio.c
+@@ -1821,7 +1821,9 @@ static irqreturn_t snd_echo_interrupt(in
+ /* The hardware doesn't tell us which substream caused the irq,
+ thus we have to check all running substreams. */
+ for (ss = 0; ss < DSP_MAXPIPES; ss++) {
+- if ((substream = chip->substream[ss])) {
++ substream = chip->substream[ss];
++ if (substream && ((struct audiopipe *)substream->runtime->
++ private_data)->state == PIPE_STATE_STARTED) {
+ period = pcm_pointer(substream) /
+ substream->runtime->period_size;
+ if (period != chip->last_period[ss]) {
--- /dev/null
+From b6855772f4a22c4fbdd4fcaceff5c8a527035123 Mon Sep 17 00:00:00 2001
+From: Bob Copeland <me@bobcopeland.com>
+Date: Fri, 18 Jun 2010 13:15:23 -0400
+Subject: ath5k: initialize ah->ah_current_channel
+
+From: Bob Copeland <me@bobcopeland.com>
+
+commit b6855772f4a22c4fbdd4fcaceff5c8a527035123 upstream.
+
+ath5k assumes ah_current_channel is always a valid pointer in
+several places, but a newly created interface may not have a
+channel. To avoid null pointer dereferences, set it up to point
+to the first available channel until later reconfigured.
+
+This fixes the following oops:
+$ rmmod ath5k
+$ insmod ath5k
+$ iw phy0 set distance 11000
+
+BUG: unable to handle kernel NULL pointer dereference at 00000006
+IP: [<d0a1ff24>] ath5k_hw_set_coverage_class+0x74/0x1b0 [ath5k]
+*pde = 00000000
+Oops: 0000 [#1]
+last sysfs file: /sys/devices/pci0000:00/0000:00:0e.0/ieee80211/phy0/index
+Modules linked in: usbhid option usb_storage usbserial usblp evdev lm90
+scx200_acb i2c_algo_bit i2c_dev i2c_core via_rhine ohci_hcd ne2k_pci
+8390 leds_alix2 xt_IMQ imq nf_nat_tftp nf_conntrack_tftp nf_nat_irc nf_cc
+
+Pid: 1597, comm: iw Not tainted (2.6.32.14 #8)
+EIP: 0060:[<d0a1ff24>] EFLAGS: 00010296 CPU: 0
+EIP is at ath5k_hw_set_coverage_class+0x74/0x1b0 [ath5k]
+EAX: 000000c2 EBX: 00000000 ECX: ffffffff EDX: c12d2080
+ESI: 00000019 EDI: cf8c0000 EBP: d0a30edc ESP: cfa09bf4
+ DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068
+Process iw (pid: 1597, ti=cfa09000 task=cf88a000 task.ti=cfa09000)
+Stack:
+ d0a34f35 d0a353f8 d0a30edc 000000fe cf8c0000 00000000 1900063d cfa8c9e0
+<0> cfa8c9e8 cfa8c0c0 cfa8c000 d0a27f0c 199d84b4 cfa8c200 00000010 d09bfdc7
+<0> 00000000 00000000 ffffffff d08e0d28 cf9263c0 00000001 cfa09cc4 00000000
+Call Trace:
+ [<d0a27f0c>] ? ath5k_hw_attach+0xc8c/0x3c10 [ath5k]
+ [<d09bfdc7>] ? __ieee80211_request_smps+0x1347/0x1580 [mac80211]
+ [<d08e0d28>] ? nl80211_send_scan_start+0x7b8/0x4520 [cfg80211]
+ [<c10f5db9>] ? nla_parse+0x59/0xc0
+ [<c11ca8d9>] ? genl_rcv_msg+0x169/0x1a0
+ [<c11ca770>] ? genl_rcv_msg+0x0/0x1a0
+ [<c11c7e68>] ? netlink_rcv_skb+0x38/0x90
+ [<c11c9649>] ? genl_rcv+0x19/0x30
+ [<c11c7c03>] ? netlink_unicast+0x1b3/0x220
+ [<c11c893e>] ? netlink_sendmsg+0x26e/0x290
+ [<c11a409e>] ? sock_sendmsg+0xbe/0xf0
+ [<c1032780>] ? autoremove_wake_function+0x0/0x50
+ [<c104d846>] ? __alloc_pages_nodemask+0x106/0x530
+ [<c1074933>] ? do_lookup+0x53/0x1b0
+ [<c10766f9>] ? __link_path_walk+0x9b9/0x9e0
+ [<c11acab0>] ? verify_iovec+0x50/0x90
+ [<c11a42b1>] ? sys_sendmsg+0x1e1/0x270
+ [<c1048e50>] ? find_get_page+0x10/0x50
+ [<c104a96f>] ? filemap_fault+0x5f/0x370
+ [<c1059159>] ? __do_fault+0x319/0x370
+ [<c11a55b4>] ? sys_socketcall+0x244/0x290
+ [<c101962c>] ? do_page_fault+0x1ec/0x270
+ [<c1019440>] ? do_page_fault+0x0/0x270
+ [<c1002ae5>] ? syscall_call+0x7/0xb
+Code: 00 b8 fe 00 00 00 b9 f8 53 a3 d0 89 5c 24 14 89 7c 24 10 89 44 24
+0c 89 6c 24 08 89 4c 24 04 c7 04 24 35 4f a3 d0 e8 7c 30 60 f0 <0f> b7
+43 06 ba 06 00 00 00 a8 10 75 0e 83 e0 20 83 f8 01 19 d2
+EIP: [<d0a1ff24>] ath5k_hw_set_coverage_class+0x74/0x1b0 [ath5k] SS:ESP
+0068:cfa09bf4
+CR2: 0000000000000006
+---[ end trace 54f73d6b10ceb87b ]---
+
+Reported-by: Steve Brown <sbrown@cortland.com>
+Signed-off-by: Bob Copeland <me@bobcopeland.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath5k/attach.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/ath/ath5k/attach.c
++++ b/drivers/net/wireless/ath/ath5k/attach.c
+@@ -123,6 +123,7 @@ int ath5k_hw_attach(struct ath5k_softc *
+ ah->ah_cw_min = AR5K_TUNE_CWMIN;
+ ah->ah_limit_tx_retries = AR5K_INIT_TX_RETRY;
+ ah->ah_software_retry = false;
++ ah->ah_current_channel = &sc->channels[0];
+
+ /*
+ * Find the mac version
--- /dev/null
+From 9441cad99b4b09d6b627351c2d282833868c116c Mon Sep 17 00:00:00 2001
+From: Hiroshi Shimamoto <h-shimamoto@ct.jp.nec.com>
+Date: Mon, 19 Apr 2010 15:32:20 +0000
+Subject: cxgb3: fix linkup issue
+
+From: Hiroshi Shimamoto <h-shimamoto@ct.jp.nec.com>
+
+commit 9441cad99b4b09d6b627351c2d282833868c116c upstream.
+
+I encountered an issue that not to link up on cxgb3 fabric.
+I bisected and found that this regression was introduced by
+0f07c4ee8c800923ae7918c231532a9256233eed.
+
+Correct to pass phy_addr to cphy_init() at t3_xaui_direct_phy_prep().
+
+Signed-off-by: Hiroshi Shimamoto <h-shimamoto@ct.jp.nec.com>
+Acked-by: Divy Le Ray <divy@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/cxgb3/ael1002.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/cxgb3/ael1002.c
++++ b/drivers/net/cxgb3/ael1002.c
+@@ -934,7 +934,7 @@ static struct cphy_ops xaui_direct_ops =
+ int t3_xaui_direct_phy_prep(struct cphy *phy, struct adapter *adapter,
+ int phy_addr, const struct mdio_ops *mdio_ops)
+ {
+- cphy_init(phy, adapter, MDIO_PRTAD_NONE, &xaui_direct_ops, mdio_ops,
++ cphy_init(phy, adapter, phy_addr, &xaui_direct_ops, mdio_ops,
+ SUPPORTED_10000baseT_Full | SUPPORTED_AUI | SUPPORTED_TP,
+ "10GBASE-CX4");
+ return 0;
--- /dev/null
+From a6f80fb7b5986fda663d94079d3bba0937a6b6ff Mon Sep 17 00:00:00 2001
+From: Andre Osterhues <aosterhues@escrypt.com>
+Date: Tue, 13 Jul 2010 15:59:17 -0500
+Subject: ecryptfs: Bugfix for error related to ecryptfs_hash_buckets
+
+From: Andre Osterhues <aosterhues@escrypt.com>
+
+commit a6f80fb7b5986fda663d94079d3bba0937a6b6ff upstream.
+
+The function ecryptfs_uid_hash wrongly assumes that the
+second parameter to hash_long() is the number of hash
+buckets instead of the number of hash bits.
+This patch fixes that and renames the variable
+ecryptfs_hash_buckets to ecryptfs_hash_bits to make it
+clearer.
+
+Fixes: CVE-2010-2492
+
+Signed-off-by: Andre Osterhues <aosterhues@escrypt.com>
+Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/ecryptfs/messaging.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+--- a/fs/ecryptfs/messaging.c
++++ b/fs/ecryptfs/messaging.c
+@@ -30,9 +30,9 @@ static struct mutex ecryptfs_msg_ctx_lis
+
+ static struct hlist_head *ecryptfs_daemon_hash;
+ struct mutex ecryptfs_daemon_hash_mux;
+-static int ecryptfs_hash_buckets;
++static int ecryptfs_hash_bits;
+ #define ecryptfs_uid_hash(uid) \
+- hash_long((unsigned long)uid, ecryptfs_hash_buckets)
++ hash_long((unsigned long)uid, ecryptfs_hash_bits)
+
+ static u32 ecryptfs_msg_counter;
+ static struct ecryptfs_msg_ctx *ecryptfs_msg_ctx_arr;
+@@ -485,18 +485,19 @@ int ecryptfs_init_messaging(void)
+ }
+ mutex_init(&ecryptfs_daemon_hash_mux);
+ mutex_lock(&ecryptfs_daemon_hash_mux);
+- ecryptfs_hash_buckets = 1;
+- while (ecryptfs_number_of_users >> ecryptfs_hash_buckets)
+- ecryptfs_hash_buckets++;
++ ecryptfs_hash_bits = 1;
++ while (ecryptfs_number_of_users >> ecryptfs_hash_bits)
++ ecryptfs_hash_bits++;
+ ecryptfs_daemon_hash = kmalloc((sizeof(struct hlist_head)
+- * ecryptfs_hash_buckets), GFP_KERNEL);
++ * (1 << ecryptfs_hash_bits)),
++ GFP_KERNEL);
+ if (!ecryptfs_daemon_hash) {
+ rc = -ENOMEM;
+ printk(KERN_ERR "%s: Failed to allocate memory\n", __func__);
+ mutex_unlock(&ecryptfs_daemon_hash_mux);
+ goto out;
+ }
+- for (i = 0; i < ecryptfs_hash_buckets; i++)
++ for (i = 0; i < (1 << ecryptfs_hash_bits); i++)
+ INIT_HLIST_HEAD(&ecryptfs_daemon_hash[i]);
+ mutex_unlock(&ecryptfs_daemon_hash_mux);
+ ecryptfs_msg_ctx_arr = kmalloc((sizeof(struct ecryptfs_msg_ctx)
+@@ -553,7 +554,7 @@ void ecryptfs_release_messaging(void)
+ int i;
+
+ mutex_lock(&ecryptfs_daemon_hash_mux);
+- for (i = 0; i < ecryptfs_hash_buckets; i++) {
++ for (i = 0; i < (1 << ecryptfs_hash_bits); i++) {
+ int rc;
+
+ hlist_for_each_entry(daemon, elem,
--- /dev/null
+From b70f4e85bfc4d7000036355b714a92d5c574f1be Mon Sep 17 00:00:00 2001
+From: Tony Luck <tony.luck@intel.com>
+Date: Wed, 30 Jun 2010 10:46:16 -0700
+Subject: [IA64] Fix spinaphore down_spin()
+
+From: Tony Luck <tony.luck@intel.com>
+
+commit b70f4e85bfc4d7000036355b714a92d5c574f1be upstream.
+
+Typo in down_spin() meant it only read the low 32 bits of the
+"serve" value, instead of the full 64 bits. This results in the
+system hanging when the values in ticket/serve get larger than
+32-bits. A big enough system running the right test can hit this
+in a just a few hours.
+
+Broken since 883a3acf5b0d4782ac35981227a0d094e8b44850
+ [IA64] Re-implement spinaphores using ticket lock concepts
+
+Reported via IRC by Bjorn Helgaas
+
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/ia64/mm/tlb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/ia64/mm/tlb.c
++++ b/arch/ia64/mm/tlb.c
+@@ -120,7 +120,7 @@ static inline void down_spin(struct spin
+ ia64_invala();
+
+ for (;;) {
+- asm volatile ("ld4.c.nc %0=[%1]" : "=r"(serve) : "r"(&ss->serve) : "memory");
++ asm volatile ("ld8.c.nc %0=[%1]" : "=r"(serve) : "r"(&ss->serve) : "memory");
+ if (time_before(t, serve))
+ return;
+ cpu_relax();
--- /dev/null
+From 5c659322a904a7cc0265e7b183372b9bdebec6db Mon Sep 17 00:00:00 2001
+From: Ayaz Abdulla <aabdulla@nvidia.com>
+Date: Tue, 13 Apr 2010 18:49:51 -0700
+Subject: forcedeth: fix tx limit2 flag check
+
+From: Ayaz Abdulla <aabdulla@nvidia.com>
+
+commit 5c659322a904a7cc0265e7b183372b9bdebec6db upstream.
+
+This is a fix for bug 572201 @ bugs.debian.org
+
+This patch fixes the TX_LIMIT feature flag. The previous logic check
+for TX_LIMIT2 also took into account a device that only had TX_LIMIT
+set.
+
+Reported-by: Stephen Mulcahu <stephen.mulcahy@deri.org>
+Reported-by: Ben Huchings <ben@decadent.org.uk>
+Signed-off-by: Ayaz Abdulla <aabdulla@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/forcedeth.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/forcedeth.c
++++ b/drivers/net/forcedeth.c
+@@ -5900,7 +5900,7 @@ static int __devinit nv_probe(struct pci
+ /* Limit the number of tx's outstanding for hw bug */
+ if (id->driver_data & DEV_NEED_TX_LIMIT) {
+ np->tx_limit = 1;
+- if ((id->driver_data & DEV_NEED_TX_LIMIT2) &&
++ if (((id->driver_data & DEV_NEED_TX_LIMIT2) == DEV_NEED_TX_LIMIT2) &&
+ pci_dev->revision >= 0xA2)
+ np->tx_limit = 0;
+ }
--- /dev/null
+From 2e65a2075cc740b485ab203430bdf3459d5551b6 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Mon, 26 Jul 2010 01:12:37 -0700
+Subject: Input: RX51 keymap - fix recent compile breakage
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit 2e65a2075cc740b485ab203430bdf3459d5551b6 upstream.
+
+Commit 3fea60261e73 ("Input: twl40300-keypad - fix handling of "all
+ground" rows") broke compilation as I managed to use non-existent
+keycodes.
+
+Reported-by: Arjan van de Ven <arjan@infradead.org>
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/mach-omap2/board-rx51-peripherals.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/mach-omap2/board-rx51-peripherals.c
++++ b/arch/arm/mach-omap2/board-rx51-peripherals.c
+@@ -192,10 +192,10 @@ static int board_keymap[] = {
+ KEY(4, 4, KEY_LEFTCTRL),
+ KEY(4, 5, KEY_RIGHTALT),
+ KEY(4, 6, KEY_LEFTSHIFT),
+- KEY(4, 8, KEY_10),
++ KEY(4, 8, KEY_F10),
+
+ KEY(5, 0, KEY_Y),
+- KEY(5, 8, KEY_11),
++ KEY(5, 8, KEY_F11),
+
+ KEY(6, 0, KEY_U),
+
--- /dev/null
+From b561e8274f75831ee87e4ea378cbb1f9f050a51a Mon Sep 17 00:00:00 2001
+From: Shanyu Zhao <shanyu.zhao@intel.com>
+Date: Tue, 1 Jun 2010 17:13:58 -0700
+Subject: iwlagn: verify flow id in compressed BA packet
+
+From: Shanyu Zhao <shanyu.zhao@intel.com>
+
+commit b561e8274f75831ee87e4ea378cbb1f9f050a51a upstream.
+
+The flow id (scd_flow) in a compressed BA packet should match the txq_id
+of the queue from which the aggregated packets were sent. However, in
+some hardware like the 1000 series, sometimes the flow id is 0 for the
+txq_id (10 to 19). This can cause the annoying message:
+[ 2213.306191] iwlagn 0000:01:00.0: Received BA when not expected
+[ 2213.310178] iwlagn 0000:01:00.0: Read index for DMA queue txq id (0),
+index 5, is out of range [0-256] 7 7.
+
+And even worse, if agg->wait_for_ba is true when the bad BA is arriving,
+this can cause system hang due to NULL pointer dereference because the
+code is operating in a wrong tx queue!
+
+Signed-off-by: Shanyu Zhao <shanyu.zhao@intel.com>
+Signed-off-by: Pradeep Kulkarni <pradeepx.kulkarni@intel.com>
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/iwlwifi/iwl-tx.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
+@@ -1553,6 +1553,11 @@ void iwl_rx_reply_compressed_ba(struct i
+ sta_id = ba_resp->sta_id;
+ tid = ba_resp->tid;
+ agg = &priv->stations[sta_id].tid[tid].agg;
++ if (unlikely(agg->txq_id != scd_flow)) {
++ IWL_ERR(priv, "BA scd_flow %d does not match txq_id %d\n",
++ scd_flow, agg->txq_id);
++ return;
++ }
+
+ /* Find index just before block-ack window */
+ index = iwl_queue_dec_wrap(ba_resp_scd_ssn & 0xff, txq->q.n_bd);
--- /dev/null
+From 1c938663d58b5b2965976a6f54cc51b5d6f691aa Mon Sep 17 00:00:00 2001
+From: Krzysztof Halasa <khc@pm.waw.pl>
+Date: Fri, 11 Jun 2010 01:08:20 +0200
+Subject: kbuild: Fix modpost segfault
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Krzysztof Halasa <khc@pm.waw.pl>
+
+commit 1c938663d58b5b2965976a6f54cc51b5d6f691aa upstream.
+
+Alan <alan@clueserver.org> writes:
+
+> program: /home/alan/GitTrees/linux-2.6-mid-ref/scripts/mod/modpost -o
+> Module.symvers -S vmlinux.o
+>
+> Program received signal SIGSEGV, Segmentation fault.
+
+It just hit me.
+It's the offset calculation in reloc_location() which overflows:
+ return (void *)elf->hdr + sechdrs[section].sh_offset +
+ (r->r_offset - sechdrs[section].sh_addr);
+
+E.g. for the first rodata r entry:
+r->r_offset < sechdrs[section].sh_addr
+and the expression in the parenthesis produces 0xFFFFFFE0 or something
+equally wise.
+
+Reported-by: Alan <alan@clueserver.org>
+Signed-off-by: Krzysztof Hałasa <khc@pm.waw.pl>
+Tested-by: Alan <alan@clueserver.org>
+Signed-off-by: Michal Marek <mmarek@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ scripts/mod/modpost.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -1318,7 +1318,7 @@ static unsigned int *reloc_location(stru
+ int section = sechdr->sh_info;
+
+ return (void *)elf->hdr + sechdrs[section].sh_offset +
+- (r->r_offset - sechdrs[section].sh_addr);
++ r->r_offset - sechdrs[section].sh_addr;
+ }
+
+ static int addend_386_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
--- /dev/null
+From 76f273640134f3eb8257179cd5b3bc6ba5fe4a96 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Wed, 28 Apr 2010 17:03:15 +0200
+Subject: mac80211: fix supported rates IE if AP doesn't give us it's rates
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit 76f273640134f3eb8257179cd5b3bc6ba5fe4a96 upstream.
+
+If AP do not provide us supported rates before assiociation, send
+all rates we are supporting instead of empty information element.
+
+v1 -> v2: Add comment.
+
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/mlme.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -270,12 +270,6 @@ static void ieee80211_send_assoc(struct
+ if (wk->bss->wmm_used)
+ wmm = 1;
+
+- /* get all rates supported by the device and the AP as
+- * some APs don't like getting a superset of their rates
+- * in the association request (e.g. D-Link DAP 1353 in
+- * b-only mode) */
+- rates_len = ieee80211_compatible_rates(wk->bss, sband, &rates);
+-
+ if ((wk->bss->cbss.capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
+ (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
+ capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
+@@ -310,6 +304,17 @@ static void ieee80211_send_assoc(struct
+ *pos++ = wk->ssid_len;
+ memcpy(pos, wk->ssid, wk->ssid_len);
+
++ if (wk->bss->supp_rates_len) {
++ /* get all rates supported by the device and the AP as
++ * some APs don't like getting a superset of their rates
++ * in the association request (e.g. D-Link DAP 1353 in
++ * b-only mode) */
++ rates_len = ieee80211_compatible_rates(wk->bss, sband, &rates);
++ } else {
++ rates = ~0;
++ rates_len = sband->n_bitrates;
++ }
++
+ /* add all rates which were marked to be used above */
+ supp_rates_len = rates_len;
+ if (supp_rates_len > 8)
--- /dev/null
+From 95e8f634d7a3ea5af40ec3fa42c8a152fd3a0624 Mon Sep 17 00:00:00 2001
+From: Shane McDonald <mcdonald.shane@gmail.com>
+Date: Thu, 6 May 2010 23:26:57 -0600
+Subject: MIPS FPU emulator: allow Cause bits of FCSR to be writeable by ctc1
+
+From: Shane McDonald <mcdonald.shane@gmail.com>
+
+commit 95e8f634d7a3ea5af40ec3fa42c8a152fd3a0624 upstream.
+
+ In the FPU emulator code of the MIPS, the Cause bits of the FCSR register
+ are not currently writeable by the ctc1 instruction. In odd corner cases,
+ this can cause problems. For example, a case existed where a divide-by-zero
+ exception was generated by the FPU, and the signal handler attempted to
+ restore the FPU registers to their state before the exception occurred. In
+ this particular setup, writing the old value to the FCSR register would
+ cause another divide-by-zero exception to occur immediately. The solution
+ is to change the ctc1 instruction emulator code to allow the Cause bits of
+ the FCSR register to be writeable. This is the behaviour of the hardware
+ that the code is emulating.
+
+ This problem was found by Shane McDonald, but the credit for the fix goes
+ to Kevin Kissell. In Kevin's words:
+
+ I submit that the bug is indeed in that ctc_op: case of the emulator. The
+ Cause bits (17:12) are supposed to be writable by that instruction, but the
+ CTC1 emulation won't let them be updated by the instruction. I think that
+ actually if you just completely removed lines 387-388 [...] things would
+ work a good deal better. At least, it would be a more accurate emulation of
+ the architecturally defined FPU. If I wanted to be really, really pedantic
+ (which I sometimes do), I'd also protect the reserved bits that aren't
+ necessarily writable.
+
+Signed-off-by: Shane McDonald <mcdonald.shane@gmail.com>
+To: anemo@mba.ocn.ne.jp
+To: kevink@paralogos.com
+To: sshtylyov@mvista.com
+Patchwork: http://patchwork.linux-mips.org/patch/1205/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Cc: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+
+---
+ arch/mips/include/asm/mipsregs.h | 9 ++++++++-
+ arch/mips/math-emu/cp1emu.c | 15 +++++++++++----
+ 2 files changed, 19 insertions(+), 5 deletions(-)
+
+--- a/arch/mips/include/asm/mipsregs.h
++++ b/arch/mips/include/asm/mipsregs.h
+@@ -135,6 +135,12 @@
+ #define FPU_CSR_COND7 0x80000000 /* $fcc7 */
+
+ /*
++ * Bits 18 - 20 of the FPU Status Register will be read as 0,
++ * and should be written as zero.
++ */
++#define FPU_CSR_RSVD 0x001c0000
++
++/*
+ * X the exception cause indicator
+ * E the exception enable
+ * S the sticky/flag bit
+@@ -161,7 +167,8 @@
+ #define FPU_CSR_UDF_S 0x00000008
+ #define FPU_CSR_INE_S 0x00000004
+
+-/* rounding mode */
++/* Bits 0 and 1 of FPU Status Register specify the rounding mode */
++#define FPU_CSR_RM 0x00000003
+ #define FPU_CSR_RN 0x0 /* nearest */
+ #define FPU_CSR_RZ 0x1 /* towards zero */
+ #define FPU_CSR_RU 0x2 /* towards +Infinity */
+--- a/arch/mips/math-emu/cp1emu.c
++++ b/arch/mips/math-emu/cp1emu.c
+@@ -78,6 +78,9 @@ DEFINE_PER_CPU(struct mips_fpu_emulator_
+ #define FPCREG_RID 0 /* $0 = revision id */
+ #define FPCREG_CSR 31 /* $31 = csr */
+
++/* Determine rounding mode from the RM bits of the FCSR */
++#define modeindex(v) ((v) & FPU_CSR_RM)
++
+ /* Convert Mips rounding mode (0..3) to IEEE library modes. */
+ static const unsigned char ieee_rm[4] = {
+ [FPU_CSR_RN] = IEEE754_RN,
+@@ -384,10 +387,14 @@ static int cop1Emulate(struct pt_regs *x
+ (void *) (xcp->cp0_epc),
+ MIPSInst_RT(ir), value);
+ #endif
+- value &= (FPU_CSR_FLUSH | FPU_CSR_ALL_E | FPU_CSR_ALL_S | 0x03);
+- ctx->fcr31 &= ~(FPU_CSR_FLUSH | FPU_CSR_ALL_E | FPU_CSR_ALL_S | 0x03);
+- /* convert to ieee library modes */
+- ctx->fcr31 |= (value & ~0x3) | ieee_rm[value & 0x3];
++
++ /*
++ * Don't write reserved bits,
++ * and convert to ieee library modes
++ */
++ ctx->fcr31 = (value &
++ ~(FPU_CSR_RSVD | FPU_CSR_RM)) |
++ ieee_rm[modeindex(value)];
+ }
+ if ((ctx->fcr31 >> 5) & ctx->fcr31 & FPU_CSR_ALL_E) {
+ return SIGFPE;
dm9000-fix-bug-spinlock-recursion.patch
firmware_class-fix-memory-leak-free-allocated-pages.patch
revert-remove-rwsem-lock-from-cpufreq_gov_stop-call-second-call-site.patch
+alsa-echoaudio-fix-guru-meditation-00000005.48454c50.patch
+v4l-dvb-dvb-core-fix-ule-decapsulation-bug.patch
+v4l-dvb-fusionhdtv-use-quick-reads-for-i2c-ir-device-probing.patch
+forcedeth-fix-tx-limit2-flag-check.patch
+staging-rtl8192su-add-support-for-belkin-f5d8053-v6.patch
+mips-fpu-emulator-allow-cause-bits-of-fcsr-to-be-writeable-by-ctc1.patch
+v4l-dvb-budget-select-correct-frontends.patch
+3c503-fix-irq-probing.patch
+cxgb3-fix-linkup-issue.patch
+mac80211-fix-supported-rates-ie-if-ap-doesn-t-give-us-it-s-rates.patch
+v4l-dvb-uvcvideo-add-support-for-unbranded-arkmicro-18ec-3290-webcams.patch
+v4l-dvb-uvcvideo-add-support-for-packard-bell-easynote-mx52-integrated-webcam.patch
+v4l-dvb-uvcvideo-add-support-for-v4l2_pix_fmt_y16.patch
+iwlagn-verify-flow-id-in-compressed-ba-packet.patch
+kbuild-fix-modpost-segfault.patch
+fix-spinaphore-down_spin.patch
+ecryptfs-bugfix-for-error-related-to-ecryptfs_hash_buckets.patch
+ath5k-initialize-ah-ah_current_channel.patch
+input-rx51-keymap-fix-recent-compile-breakage.patch
+v4l-dvb-13830-uvcvideo-add-another-yuyv-format-guid-for-isight-cameras.patch
--- /dev/null
+From d615da093eb0f691a73a754589e2a4a24a6f1ca7 Mon Sep 17 00:00:00 2001
+From: Richard Airlie <richard@backtrace.co.uk>
+Date: Mon, 5 Apr 2010 22:22:46 +0100
+Subject: staging: rtl8192su: add Support for Belkin F5D8053 v6
+
+From: Richard Airlie <richard@backtrace.co.uk>
+
+commit d615da093eb0f691a73a754589e2a4a24a6f1ca7 upstream.
+
+Please find attached a patch which adds the device ID for the Belkin
+F5D8053 v6 to the rtl8192su driver. I've tested this in 2.6.34-rc3
+(Ubuntu 9.10 amd64) and the network adapter is working flawlessly.
+
+Signed-off-by: Richard Airlie <richard@backtrace.co.uk>
+Cc: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/rtl8192su/r8192U_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/staging/rtl8192su/r8192U_core.c
++++ b/drivers/staging/rtl8192su/r8192U_core.c
+@@ -118,6 +118,7 @@ static struct usb_device_id rtl8192_usb_
+ {USB_DEVICE(0x07aa, 0x0043)},
+ /* Belkin */
+ {USB_DEVICE(0x050d, 0x805E)},
++ {USB_DEVICE(0x050d, 0x815F)}, /* Belkin F5D8053 v6 */
+ /* Sitecom */
+ {USB_DEVICE(0x0df6, 0x0031)},
+ {USB_DEVICE(0x0df6, 0x004b)}, /* WL-349 */
--- /dev/null
+From 68f194e027ecfbbc8d5515bc40787e542eed59e9 Mon Sep 17 00:00:00 2001
+From: Daniel Ritz <daniel.ritz@gmx.ch>
+Date: Sat, 12 Dec 2009 14:57:17 -0300
+Subject: V4L/DVB (13830): uvcvideo: add another YUYV format GUID for iSight cameras
+
+From: Daniel Ritz <daniel.ritz@gmx.ch>
+
+commit 68f194e027ecfbbc8d5515bc40787e542eed59e9 upstream.
+
+For some unknown reason, on a MacBookPro5,3 the iSight sometimes report
+a different video format GUID. This patch add the other (wrong) GUID to
+the format table, making the iSight work always w/o other problems.
+
+What it should report: 32595559-0000-0010-8000-00aa00389b71
+What it often reports: 32595559-0000-0010-8000-000000389b71
+
+Signed-off-by: Daniel Ritz <daniel.ritz@gmx.ch>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Cc: Leann Ogasawara <leann.ogasawara@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/uvc/uvc_driver.c | 5 +++++
+ drivers/media/video/uvc/uvcvideo.h | 3 +++
+ 2 files changed, 8 insertions(+)
+
+--- a/drivers/media/video/uvc/uvc_driver.c
++++ b/drivers/media/video/uvc/uvc_driver.c
+@@ -59,6 +59,11 @@ static struct uvc_format_desc uvc_fmts[]
+ .fcc = V4L2_PIX_FMT_YUYV,
+ },
+ {
++ .name = "YUV 4:2:2 (YUYV)",
++ .guid = UVC_GUID_FORMAT_YUY2_ISIGHT,
++ .fcc = V4L2_PIX_FMT_YUYV,
++ },
++ {
+ .name = "YUV 4:2:0 (NV12)",
+ .guid = UVC_GUID_FORMAT_NV12,
+ .fcc = V4L2_PIX_FMT_NV12,
+--- a/drivers/media/video/uvc/uvcvideo.h
++++ b/drivers/media/video/uvc/uvcvideo.h
+@@ -113,6 +113,9 @@ struct uvc_xu_control {
+ #define UVC_GUID_FORMAT_YUY2 \
+ { 'Y', 'U', 'Y', '2', 0x00, 0x00, 0x10, 0x00, \
+ 0x80, 0x00, 0x00, 0xaa, 0x00, 0x38, 0x9b, 0x71}
++#define UVC_GUID_FORMAT_YUY2_ISIGHT \
++ { 'Y', 'U', 'Y', '2', 0x00, 0x00, 0x10, 0x00, \
++ 0x80, 0x00, 0x00, 0x00, 0x00, 0x38, 0x9b, 0x71}
+ #define UVC_GUID_FORMAT_NV12 \
+ { 'N', 'V', '1', '2', 0x00, 0x00, 0x10, 0x00, \
+ 0x80, 0x00, 0x00, 0xaa, 0x00, 0x38, 0x9b, 0x71}
--- /dev/null
+From d46b36e7f927772bb72524dc9f1e384e3cb4a975 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Sat, 15 May 2010 13:45:37 -0300
+Subject: V4L/DVB: budget: Select correct frontends
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+commit d46b36e7f927772bb72524dc9f1e384e3cb4a975 upstream.
+
+Update the Kconfig selections to match the code.
+
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/dvb/ttpci/Kconfig | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/dvb/ttpci/Kconfig
++++ b/drivers/media/dvb/ttpci/Kconfig
+@@ -68,13 +68,14 @@ config DVB_BUDGET
+ select DVB_VES1820 if !DVB_FE_CUSTOMISE
+ select DVB_L64781 if !DVB_FE_CUSTOMISE
+ select DVB_TDA8083 if !DVB_FE_CUSTOMISE
+- select DVB_TDA10021 if !DVB_FE_CUSTOMISE
+- select DVB_TDA10023 if !DVB_FE_CUSTOMISE
+ select DVB_S5H1420 if !DVB_FE_CUSTOMISE
+ select DVB_TDA10086 if !DVB_FE_CUSTOMISE
+ select DVB_TDA826X if !DVB_FE_CUSTOMISE
+ select DVB_LNBP21 if !DVB_FE_CUSTOMISE
+ select DVB_TDA1004X if !DVB_FE_CUSTOMISE
++ select DVB_ISL6423 if !DVB_FE_CUSTOMISE
++ select DVB_STV090x if !DVB_FE_CUSTOMISE
++ select DVB_STV6110x if !DVB_FE_CUSTOMISE
+ help
+ Support for simple SAA7146 based DVB cards (so called Budget-
+ or Nova-PCI cards) without onboard MPEG2 decoder, and without
--- /dev/null
+From 5c331fc8c19e181bffab46e9d18e1637cdc47170 Mon Sep 17 00:00:00 2001
+From: Ang Way Chuang <wcang79@gmail.com>
+Date: Thu, 27 May 2010 02:02:09 -0300
+Subject: V4L/DVB: dvb-core: Fix ULE decapsulation bug
+
+From: Ang Way Chuang <wcang79@gmail.com>
+
+commit 5c331fc8c19e181bffab46e9d18e1637cdc47170 upstream.
+
+Fix ULE decapsulation bug when less than 4 bytes of ULE SNDU is packed
+into the remaining bytes of a MPEG2-TS frame
+
+ULE (Unidirectional Lightweight Encapsulation RFC 4326) decapsulation
+code has a bug that incorrectly treats ULE SNDU packed into the
+remaining 2 or 3 bytes of a MPEG2-TS frame as having invalid pointer
+field on the subsequent MPEG2-TS frame.
+
+Signed-off-by: Ang Way Chuang <wcang@nav6.org>
+Acked-by: Jarod Wilson <jarod@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/dvb/dvb-core/dvb_net.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/dvb/dvb-core/dvb_net.c
++++ b/drivers/media/dvb/dvb-core/dvb_net.c
+@@ -350,6 +350,7 @@ static void dvb_net_ule( struct net_devi
+ const u8 *ts, *ts_end, *from_where = NULL;
+ u8 ts_remain = 0, how_much = 0, new_ts = 1;
+ struct ethhdr *ethh = NULL;
++ bool error = false;
+
+ #ifdef ULE_DEBUG
+ /* The code inside ULE_DEBUG keeps a history of the last 100 TS cells processed. */
+@@ -459,10 +460,16 @@ static void dvb_net_ule( struct net_devi
+
+ /* Drop partly decoded SNDU, reset state, resync on PUSI. */
+ if (priv->ule_skb) {
+- dev_kfree_skb( priv->ule_skb );
++ error = true;
++ dev_kfree_skb(priv->ule_skb);
++ }
++
++ if (error || priv->ule_sndu_remain) {
+ dev->stats.rx_errors++;
+ dev->stats.rx_frame_errors++;
++ error = false;
+ }
++
+ reset_ule(priv);
+ priv->need_pusi = 1;
+ continue;
+@@ -534,6 +541,7 @@ static void dvb_net_ule( struct net_devi
+ from_where += 2;
+ }
+
++ priv->ule_sndu_remain = priv->ule_sndu_len + 2;
+ /*
+ * State of current TS:
+ * ts_remain (remaining bytes in the current TS cell)
+@@ -543,6 +551,7 @@ static void dvb_net_ule( struct net_devi
+ */
+ switch (ts_remain) {
+ case 1:
++ priv->ule_sndu_remain--;
+ priv->ule_sndu_type = from_where[0] << 8;
+ priv->ule_sndu_type_1 = 1; /* first byte of ule_type is set. */
+ ts_remain -= 1; from_where += 1;
+@@ -556,6 +565,7 @@ static void dvb_net_ule( struct net_devi
+ default: /* complete ULE header is present in current TS. */
+ /* Extract ULE type field. */
+ if (priv->ule_sndu_type_1) {
++ priv->ule_sndu_type_1 = 0;
+ priv->ule_sndu_type |= from_where[0];
+ from_where += 1; /* points to payload start. */
+ ts_remain -= 1;
--- /dev/null
+From 806b07c29b711aaf90c81d2a19711607769f8246 Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Wed, 26 May 2010 10:05:11 -0300
+Subject: V4L/DVB: FusionHDTV: Use quick reads for I2C IR device probing
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit 806b07c29b711aaf90c81d2a19711607769f8246 upstream.
+
+IR support on FusionHDTV cards is broken since kernel 2.6.31. One side
+effect of the switch to the standard binding model for IR I2C devices
+was to let i2c-core do the probing instead of the ir-kbd-i2c driver.
+There is a slight difference between the two probe methods: i2c-core
+uses 0-byte writes, while the ir-kbd-i2c was using 0-byte reads. As
+some IR I2C devices only support reads, the new probe method fails to
+detect them.
+
+For now, revert to letting the driver do the probe, using 0-byte
+reads. In the future, i2c-core will be extended to let callers of
+i2c_new_probed_device() provide a custom probing function.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Tested-by: "Timothy D. Lenz" <tlenz@vorgon.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/cx23885/cx23885-i2c.c | 12 +++++++++++-
+ drivers/media/video/cx88/cx88-i2c.c | 16 +++++++++++++++-
+ 2 files changed, 26 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/video/cx23885/cx23885-i2c.c
++++ b/drivers/media/video/cx23885/cx23885-i2c.c
+@@ -365,7 +365,17 @@ int cx23885_i2c_register(struct cx23885_
+
+ memset(&info, 0, sizeof(struct i2c_board_info));
+ strlcpy(info.type, "ir_video", I2C_NAME_SIZE);
+- i2c_new_probed_device(&bus->i2c_adap, &info, addr_list);
++ /*
++ * We can't call i2c_new_probed_device() because it uses
++ * quick writes for probing and the IR receiver device only
++ * replies to reads.
++ */
++ if (i2c_smbus_xfer(&bus->i2c_adap, addr_list[0], 0,
++ I2C_SMBUS_READ, 0, I2C_SMBUS_QUICK,
++ NULL) >= 0) {
++ info.addr = addr_list[0];
++ i2c_new_device(&bus->i2c_adap, &info);
++ }
+ }
+
+ return bus->i2c_rc;
+--- a/drivers/media/video/cx88/cx88-i2c.c
++++ b/drivers/media/video/cx88/cx88-i2c.c
+@@ -188,10 +188,24 @@ int cx88_i2c_init(struct cx88_core *core
+ 0x18, 0x6b, 0x71,
+ I2C_CLIENT_END
+ };
++ const unsigned short *addrp;
+
+ memset(&info, 0, sizeof(struct i2c_board_info));
+ strlcpy(info.type, "ir_video", I2C_NAME_SIZE);
+- i2c_new_probed_device(&core->i2c_adap, &info, addr_list);
++ /*
++ * We can't call i2c_new_probed_device() because it uses
++ * quick writes for probing and at least some R receiver
++ * devices only reply to reads.
++ */
++ for (addrp = addr_list; *addrp != I2C_CLIENT_END; addrp++) {
++ if (i2c_smbus_xfer(&core->i2c_adap, *addrp, 0,
++ I2C_SMBUS_READ, 0,
++ I2C_SMBUS_QUICK, NULL) >= 0) {
++ info.addr = *addrp;
++ i2c_new_device(&core->i2c_adap, &info);
++ break;
++ }
++ }
+ }
+ return core->i2c_rc;
+ }
--- /dev/null
+From f129b03ba272c86c42ad476684caa0d6109cb383 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Sat, 13 Mar 2010 18:12:15 -0300
+Subject: V4L/DVB: uvcvideo: Add support for Packard Bell EasyNote MX52 integrated webcam
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+commit f129b03ba272c86c42ad476684caa0d6109cb383 upstream.
+
+The camera requires the STREAM_NO_FID quirk. Add a corresponding entry
+in the device IDs list.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/uvc/uvc_driver.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/media/video/uvc/uvc_driver.c
++++ b/drivers/media/video/uvc/uvc_driver.c
+@@ -2059,6 +2059,15 @@ static struct usb_device_id uvc_ids[] =
+ .bInterfaceSubClass = 1,
+ .bInterfaceProtocol = 0,
+ .driver_info = UVC_QUIRK_STREAM_NO_FID },
++ /* Syntek (Packard Bell EasyNote MX52 */
++ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE
++ | USB_DEVICE_ID_MATCH_INT_INFO,
++ .idVendor = 0x174f,
++ .idProduct = 0x8a12,
++ .bInterfaceClass = USB_CLASS_VIDEO,
++ .bInterfaceSubClass = 1,
++ .bInterfaceProtocol = 0,
++ .driver_info = UVC_QUIRK_STREAM_NO_FID },
+ /* Syntek (Asus F9SG) */
+ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE
+ | USB_DEVICE_ID_MATCH_INT_INFO,
--- /dev/null
+From 1e4d05bc95a0fe2972c5c91ed45466587d07cd2c Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Thu, 4 Mar 2010 07:51:25 -0300
+Subject: V4L/DVB: uvcvideo: Add support for unbranded Arkmicro 18ec:3290 webcams
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+commit 1e4d05bc95a0fe2972c5c91ed45466587d07cd2c upstream.
+
+The camera requires the PROBE_DEF quirk. Add a corresponding entry in
+the device IDs list.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/uvc/uvc_driver.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/media/video/uvc/uvc_driver.c
++++ b/drivers/media/video/uvc/uvc_driver.c
+@@ -2123,6 +2123,15 @@ static struct usb_device_id uvc_ids[] =
+ .bInterfaceSubClass = 1,
+ .bInterfaceProtocol = 0,
+ .driver_info = UVC_QUIRK_PROBE_MINMAX },
++ /* Arkmicro unbranded */
++ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE
++ | USB_DEVICE_ID_MATCH_INT_INFO,
++ .idVendor = 0x18ec,
++ .idProduct = 0x3290,
++ .bInterfaceClass = USB_CLASS_VIDEO,
++ .bInterfaceSubClass = 1,
++ .bInterfaceProtocol = 0,
++ .driver_info = UVC_QUIRK_PROBE_DEF },
+ /* Bodelin ProScopeHR */
+ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE
+ | USB_DEVICE_ID_MATCH_DEV_HI
--- /dev/null
+From 61421206833a4085d9bdf35b2b84cd9a67dfdfac Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Mon, 12 Apr 2010 10:41:22 -0300
+Subject: V4L/DVB: uvcvideo: Add support for V4L2_PIX_FMT_Y16
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+commit 61421206833a4085d9bdf35b2b84cd9a67dfdfac upstream.
+
+The Miricle 307K (17dc:0202) camera reports a 16-bit greyscale format,
+support it in the driver.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/uvc/uvc_driver.c | 7 ++++++-
+ drivers/media/video/uvc/uvcvideo.h | 4 +++-
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/video/uvc/uvc_driver.c
++++ b/drivers/media/video/uvc/uvc_driver.c
+@@ -84,11 +84,16 @@ static struct uvc_format_desc uvc_fmts[]
+ .fcc = V4L2_PIX_FMT_UYVY,
+ },
+ {
+- .name = "Greyscale",
++ .name = "Greyscale (8-bit)",
+ .guid = UVC_GUID_FORMAT_Y800,
+ .fcc = V4L2_PIX_FMT_GREY,
+ },
+ {
++ .name = "Greyscale (16-bit)",
++ .guid = UVC_GUID_FORMAT_Y16,
++ .fcc = V4L2_PIX_FMT_Y16,
++ },
++ {
+ .name = "RGB Bayer",
+ .guid = UVC_GUID_FORMAT_BY8,
+ .fcc = V4L2_PIX_FMT_SBGGR8,
+--- a/drivers/media/video/uvc/uvcvideo.h
++++ b/drivers/media/video/uvc/uvcvideo.h
+@@ -128,11 +128,13 @@ struct uvc_xu_control {
+ #define UVC_GUID_FORMAT_Y800 \
+ { 'Y', '8', '0', '0', 0x00, 0x00, 0x10, 0x00, \
+ 0x80, 0x00, 0x00, 0xaa, 0x00, 0x38, 0x9b, 0x71}
++#define UVC_GUID_FORMAT_Y16 \
++ { 'Y', '1', '6', ' ', 0x00, 0x00, 0x10, 0x00, \
++ 0x80, 0x00, 0x00, 0xaa, 0x00, 0x38, 0x9b, 0x71}
+ #define UVC_GUID_FORMAT_BY8 \
+ { 'B', 'Y', '8', ' ', 0x00, 0x00, 0x10, 0x00, \
+ 0x80, 0x00, 0x00, 0xaa, 0x00, 0x38, 0x9b, 0x71}
+
+-
+ /* ------------------------------------------------------------------------
+ * Driver specific constants.
+ */
+ * then it's very likely the result of an icebp/int01 trap.
+ * User wants a sigtrap for that.
+ */
-+ if (!dr6 && user_mode(regs))
++ if (!(dr6 & ~0xffff0ff0) && user_mode(regs))
+ user_icebp = 1;
+
/* Catch kmemcheck conditions first of all! */
projects / thirdparty / kernel / stable-queue.git / commitdiff
