--- /dev/null
+From 2aa15890f3c191326678f1bd68af61ec6b8753ec Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi@suse.cz>
+Date: Wed, 23 Feb 2011 13:49:47 +0100
+Subject: mm: prevent concurrent unmap_mapping_range() on the same inode
+
+From: Miklos Szeredi <mszeredi@suse.cz>
+
+commit 2aa15890f3c191326678f1bd68af61ec6b8753ec upstream.
+
+Michael Leun reported that running parallel opens on a fuse filesystem
+can trigger a "kernel BUG at mm/truncate.c:475"
+
+Gurudas Pai reported the same bug on NFS.
+
+The reason is, unmap_mapping_range() is not prepared for more than
+one concurrent invocation per inode. For example:
+
+ thread1: going through a big range, stops in the middle of a vma and
+ stores the restart address in vm_truncate_count.
+
+ thread2: comes in with a small (e.g. single page) unmap request on
+ the same vma, somewhere before restart_address, finds that the
+ vma was already unmapped up to the restart address and happily
+ returns without doing anything.
+
+Another scenario would be two big unmap requests, both having to
+restart the unmapping and each one setting vm_truncate_count to its
+own value. This could go on forever without any of them being able to
+finish.
+
+Truncate and hole punching already serialize with i_mutex. Other
+callers of unmap_mapping_range() do not, and it's difficult to get
+i_mutex protection for all callers. In particular ->d_revalidate(),
+which calls invalidate_inode_pages2_range() in fuse, may be called
+with or without i_mutex.
+
+This patch adds a new mutex to 'struct address_space' to prevent
+running multiple concurrent unmap_mapping_range() on the same mapping.
+
+[ We'll hopefully get rid of all this with the upcoming mm
+ preemptibility series by Peter Zijlstra, the "mm: Remove i_mmap_mutex
+ lockbreak" patch in particular. But that is for 2.6.39 ]
+
+Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
+Reported-by: Michael Leun <lkml20101129@newton.leun.net>
+Reported-by: Gurudas Pai <gurudas.pai@oracle.com>
+Tested-by: Gurudas Pai <gurudas.pai@oracle.com>
+Acked-by: Hugh Dickins <hughd@google.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/gfs2/main.c | 9 +--------
+ fs/inode.c | 22 +++++++++++++++-------
+ fs/nilfs2/btnode.c | 5 -----
+ fs/nilfs2/btnode.h | 1 -
+ fs/nilfs2/mdt.c | 4 ++--
+ fs/nilfs2/page.h | 1 -
+ fs/nilfs2/super.c | 2 +-
+ include/linux/fs.h | 2 ++
+ mm/memory.c | 2 ++
+ 9 files changed, 23 insertions(+), 25 deletions(-)
+
+--- a/fs/gfs2/main.c
++++ b/fs/gfs2/main.c
+@@ -59,14 +59,7 @@ static void gfs2_init_gl_aspace_once(voi
+ struct address_space *mapping = (struct address_space *)(gl + 1);
+
+ gfs2_init_glock_once(gl);
+- memset(mapping, 0, sizeof(*mapping));
+- INIT_RADIX_TREE(&mapping->page_tree, GFP_ATOMIC);
+- spin_lock_init(&mapping->tree_lock);
+- spin_lock_init(&mapping->i_mmap_lock);
+- INIT_LIST_HEAD(&mapping->private_list);
+- spin_lock_init(&mapping->private_lock);
+- INIT_RAW_PRIO_TREE_ROOT(&mapping->i_mmap);
+- INIT_LIST_HEAD(&mapping->i_mmap_nonlinear);
++ address_space_init_once(mapping);
+ }
+
+ /**
+--- a/fs/inode.c
++++ b/fs/inode.c
+@@ -280,6 +280,20 @@ static void destroy_inode(struct inode *
+ kmem_cache_free(inode_cachep, (inode));
+ }
+
++void address_space_init_once(struct address_space *mapping)
++{
++ memset(mapping, 0, sizeof(*mapping));
++ INIT_RADIX_TREE(&mapping->page_tree, GFP_ATOMIC);
++ spin_lock_init(&mapping->tree_lock);
++ spin_lock_init(&mapping->i_mmap_lock);
++ INIT_LIST_HEAD(&mapping->private_list);
++ spin_lock_init(&mapping->private_lock);
++ INIT_RAW_PRIO_TREE_ROOT(&mapping->i_mmap);
++ INIT_LIST_HEAD(&mapping->i_mmap_nonlinear);
++ mutex_init(&mapping->unmap_mutex);
++}
++EXPORT_SYMBOL(address_space_init_once);
++
+ /*
+ * These are initializations that only need to be done
+ * once, because the fields are idempotent across use
+@@ -293,13 +307,7 @@ void inode_init_once(struct inode *inode
+ INIT_LIST_HEAD(&inode->i_devices);
+ INIT_LIST_HEAD(&inode->i_wb_list);
+ INIT_LIST_HEAD(&inode->i_lru);
+- INIT_RADIX_TREE(&inode->i_data.page_tree, GFP_ATOMIC);
+- spin_lock_init(&inode->i_data.tree_lock);
+- spin_lock_init(&inode->i_data.i_mmap_lock);
+- INIT_LIST_HEAD(&inode->i_data.private_list);
+- spin_lock_init(&inode->i_data.private_lock);
+- INIT_RAW_PRIO_TREE_ROOT(&inode->i_data.i_mmap);
+- INIT_LIST_HEAD(&inode->i_data.i_mmap_nonlinear);
++ address_space_init_once(&inode->i_data);
+ i_size_ordered_init(inode);
+ #ifdef CONFIG_FSNOTIFY
+ INIT_HLIST_HEAD(&inode->i_fsnotify_marks);
+--- a/fs/nilfs2/btnode.c
++++ b/fs/nilfs2/btnode.c
+@@ -35,11 +35,6 @@
+ #include "btnode.h"
+
+
+-void nilfs_btnode_cache_init_once(struct address_space *btnc)
+-{
+- nilfs_mapping_init_once(btnc);
+-}
+-
+ static const struct address_space_operations def_btnode_aops = {
+ .sync_page = block_sync_page,
+ };
+--- a/fs/nilfs2/btnode.h
++++ b/fs/nilfs2/btnode.h
+@@ -37,7 +37,6 @@ struct nilfs_btnode_chkey_ctxt {
+ struct buffer_head *newbh;
+ };
+
+-void nilfs_btnode_cache_init_once(struct address_space *);
+ void nilfs_btnode_cache_init(struct address_space *, struct backing_dev_info *);
+ void nilfs_btnode_cache_clear(struct address_space *);
+ struct buffer_head *nilfs_btnode_create_block(struct address_space *btnc,
+--- a/fs/nilfs2/mdt.c
++++ b/fs/nilfs2/mdt.c
+@@ -460,9 +460,9 @@ int nilfs_mdt_setup_shadow_map(struct in
+ struct backing_dev_info *bdi = inode->i_sb->s_bdi;
+
+ INIT_LIST_HEAD(&shadow->frozen_buffers);
+- nilfs_mapping_init_once(&shadow->frozen_data);
++ address_space_init_once(&shadow->frozen_data);
+ nilfs_mapping_init(&shadow->frozen_data, bdi, &shadow_map_aops);
+- nilfs_mapping_init_once(&shadow->frozen_btnodes);
++ address_space_init_once(&shadow->frozen_btnodes);
+ nilfs_mapping_init(&shadow->frozen_btnodes, bdi, &shadow_map_aops);
+ mi->mi_shadow = shadow;
+ return 0;
+--- a/fs/nilfs2/page.h
++++ b/fs/nilfs2/page.h
+@@ -61,7 +61,6 @@ void nilfs_free_private_page(struct page
+ int nilfs_copy_dirty_pages(struct address_space *, struct address_space *);
+ void nilfs_copy_back_pages(struct address_space *, struct address_space *);
+ void nilfs_clear_dirty_pages(struct address_space *);
+-void nilfs_mapping_init_once(struct address_space *mapping);
+ void nilfs_mapping_init(struct address_space *mapping,
+ struct backing_dev_info *bdi,
+ const struct address_space_operations *aops);
+--- a/fs/nilfs2/super.c
++++ b/fs/nilfs2/super.c
+@@ -1263,7 +1263,7 @@ static void nilfs_inode_init_once(void *
+ #ifdef CONFIG_NILFS_XATTR
+ init_rwsem(&ii->xattr_sem);
+ #endif
+- nilfs_btnode_cache_init_once(&ii->i_btnode_cache);
++ address_space_init_once(&ii->i_btnode_cache);
+ ii->i_bmap = &ii->i_bmap_data;
+ inode_init_once(&ii->vfs_inode);
+ }
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -646,6 +646,7 @@ struct address_space {
+ spinlock_t private_lock; /* for use by the address_space */
+ struct list_head private_list; /* ditto */
+ struct address_space *assoc_mapping; /* ditto */
++ struct mutex unmap_mutex; /* to protect unmapping */
+ } __attribute__((aligned(sizeof(long))));
+ /*
+ * On most architectures that alignment is already the case; but
+@@ -2203,6 +2204,7 @@ extern loff_t vfs_llseek(struct file *fi
+
+ extern int inode_init_always(struct super_block *, struct inode *);
+ extern void inode_init_once(struct inode *);
++extern void address_space_init_once(struct address_space *mapping);
+ extern void ihold(struct inode * inode);
+ extern void iput(struct inode *);
+ extern struct inode * igrab(struct inode *);
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -2572,6 +2572,7 @@ void unmap_mapping_range(struct address_
+ details.last_index = ULONG_MAX;
+ details.i_mmap_lock = &mapping->i_mmap_lock;
+
++ mutex_lock(&mapping->unmap_mutex);
+ spin_lock(&mapping->i_mmap_lock);
+
+ /* Protect against endless unmapping loops */
+@@ -2588,6 +2589,7 @@ void unmap_mapping_range(struct address_
+ if (unlikely(!list_empty(&mapping->i_mmap_nonlinear)))
+ unmap_mapping_range_list(&mapping->i_mmap_nonlinear, &details);
+ spin_unlock(&mapping->i_mmap_lock);
++ mutex_unlock(&mapping->unmap_mutex);
+ }
+ EXPORT_SYMBOL(unmap_mapping_range);
+
--- /dev/null
+From 0bf719dfdecc5552155cbec78e49fa06e531e35c Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@googlemail.com>
+Date: Fri, 11 Feb 2011 01:48:42 +0100
+Subject: p54pci: update receive dma buffers before and after processing
+
+From: Christian Lamparter <chunkeey@googlemail.com>
+
+commit 0bf719dfdecc5552155cbec78e49fa06e531e35c upstream.
+
+Documentation/DMA-API-HOWTO.txt states:
+
+"DMA transfers need to be synced properly in order for
+the cpu and device to see the most uptodate and correct
+copy of the DMA buffer."
+
+Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/p54/p54pci.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/p54/p54pci.c
++++ b/drivers/net/wireless/p54/p54pci.c
+@@ -199,6 +199,7 @@ static void p54p_check_rx_ring(struct ie
+ while (i != idx) {
+ u16 len;
+ struct sk_buff *skb;
++ dma_addr_t dma_addr;
+ desc = &ring[i];
+ len = le16_to_cpu(desc->len);
+ skb = rx_buf[i];
+@@ -216,17 +217,20 @@ static void p54p_check_rx_ring(struct ie
+
+ len = priv->common.rx_mtu;
+ }
++ dma_addr = le32_to_cpu(desc->host_addr);
++ pci_dma_sync_single_for_cpu(priv->pdev, dma_addr,
++ priv->common.rx_mtu + 32, PCI_DMA_FROMDEVICE);
+ skb_put(skb, len);
+
+ if (p54_rx(dev, skb)) {
+- pci_unmap_single(priv->pdev,
+- le32_to_cpu(desc->host_addr),
+- priv->common.rx_mtu + 32,
+- PCI_DMA_FROMDEVICE);
++ pci_unmap_single(priv->pdev, dma_addr,
++ priv->common.rx_mtu + 32, PCI_DMA_FROMDEVICE);
+ rx_buf[i] = NULL;
+- desc->host_addr = 0;
++ desc->host_addr = cpu_to_le32(0);
+ } else {
+ skb_trim(skb, 0);
++ pci_dma_sync_single_for_device(priv->pdev, dma_addr,
++ priv->common.rx_mtu + 32, PCI_DMA_FROMDEVICE);
+ desc->len = cpu_to_le16(priv->common.rx_mtu + 32);
+ }
+
--- /dev/null
+From 78794b2cdeac37ac1fd950fc9c4454b56d88ac03 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Wed, 23 Feb 2011 19:42:03 -0800
+Subject: Revert "Bluetooth: Enable USB autosuspend by default on btusb"
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit 78794b2cdeac37ac1fd950fc9c4454b56d88ac03 upstream.
+
+This reverts commit 556ea928f78a390fe16ae584e6433dff304d3014.
+
+Jeff Chua reports that it can cause some bluetooth devices (he mentions
+an Bluetooth Intermec scanner) to just stop responding after a while
+with messages like
+
+ [ 4533.361959] btusb 8-1:1.0: no reset_resume for driver btusb?
+ [ 4533.361964] btusb 8-1:1.1: no reset_resume for driver btusb?
+
+from the kernel. See also
+
+ https://bugzilla.kernel.org/show_bug.cgi?id=26182
+
+for other reports.
+
+Reported-by: Jeff Chua <jeff.chua.linux@gmail.com>
+Reported-by: Andrew Meakovski <meako@bigmir.net>
+Reported-by: Jim Faulkner <jfaulkne@ccs.neu.edu>
+Acked-by: Greg KH <gregkh@suse.de>
+Acked-by: Matthew Garrett <mjg@redhat.com>
+Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/bluetooth/btusb.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -1038,8 +1038,6 @@ static int btusb_probe(struct usb_interf
+
+ usb_set_intfdata(intf, data);
+
+- usb_enable_autosuspend(interface_to_usbdev(intf));
+-
+ return 0;
+ }
+
--- /dev/null
+From bd6a60afeb4c9ada3ff27f1d13db1a2b5c11d8c0 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Mon, 21 Feb 2011 01:11:59 -0500
+Subject: Revert "drm/radeon/kms: switch back to min->max pll post divider iteration"
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit bd6a60afeb4c9ada3ff27f1d13db1a2b5c11d8c0 upstream.
+
+This reverts commit a6f9761743bf35b052180f4a8bdae4d2cc0465f6.
+
+Remove this commit as it is no longer necessary. The relevant bugs
+were fixed properly in:
+drm/radeon/kms: hopefully fix pll issues for real (v3)
+5b40ddf888398ce4cccbf3b9d0a18d90149ed7ff
+drm/radeon/kms: add missing frac fb div flag for dce4+
+9f4283f49f0a96a64c5a45fe56f0f8c942885eef
+
+This commit also broke certain ~5 Mhz modes on old arcade monitors,
+so reverting this commit fixes:
+https://bugzilla.kernel.org/show_bug.cgi?id=29502
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_display.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -639,7 +639,7 @@ void radeon_compute_pll_legacy(struct ra
+ max_fractional_feed_div = pll->max_frac_feedback_div;
+ }
+
+- for (post_div = min_post_div; post_div <= max_post_div; ++post_div) {
++ for (post_div = max_post_div; post_div >= min_post_div; --post_div) {
+ uint32_t ref_div;
+
+ if ((pll->flags & RADEON_PLL_NO_ODD_POST_DIV) && (post_div & 1))
--- /dev/null
+From e1dc5157c574e7249dc1cd072fde2e48b3011533 Mon Sep 17 00:00:00 2001
+From: Jon Thomas <jthomas@redhat.com>
+Date: Wed, 16 Feb 2011 11:02:34 -0500
+Subject: sierra: add new ID for Airprime/Sierra USB IP modem
+
+From: Jon Thomas <jthomas@redhat.com>
+
+commit e1dc5157c574e7249dc1cd072fde2e48b3011533 upstream.
+
+I picked up a new Sierra usb 308 (At&t Shockwave) on 2/2011 and the vendor code
+is 0x0f3d
+
+Looking up vendor and product id's I see:
+
+0f3d Airprime, Incorporated
+ 0112 CDMA 1xEVDO PC Card, PC 5220
+
+Sierra and Airprime are somehow related and I'm guessing the At&t usb 308 might
+be have some common hardware with the AirPrime SL809x.
+
+Signed-off-by: Jon Thomas <jthomas@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/sierra.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/serial/sierra.c
++++ b/drivers/usb/serial/sierra.c
+@@ -301,6 +301,9 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(0x1199, 0x68A3), /* Sierra Wireless Direct IP modems */
+ .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+ },
++ { USB_DEVICE(0x0f3d, 0x68A3), /* Airprime/Sierra Wireless Direct IP modems */
++ .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
++ },
+ { USB_DEVICE(0x413C, 0x08133) }, /* Dell Computer Corp. Wireless 5720 VZW Mobile Broadband (EVDO Rev-A) Minicard GPS Port */
+
+ { }
--- /dev/null
+From arend@broadcom.com Thu Feb 24 17:23:22 2011
+From: "Arend van Spriel" <arend@broadcom.com>
+Date: Thu, 24 Feb 2011 21:42:19 +0100
+Subject: staging: brcm80211: bugfix for softmac crash on multi cpu configurations
+To: gregkh@suse.de
+Cc: rvossen@broadcom.com, stable@kernel.org
+Message-ID: <1298580139-3695-2-git-send-email-arend@broadcom.com>
+
+
+From: Roland Vossen <rvossen@broadcom.com>
+
+commit 6a3be6e6e7feb4cb35275475d6a863b748d59cc3 upstream
+
+Solved a locking issue that resulted in driver crashes with the 43224 and 43225
+chips. The problem has been reported on several fora. Root cause was two fold:
+hardware was being manipulated by two unsynchronized threads, and a scan
+operation could interfere with an ongoing dynamic calibration process. Fix was
+to invoke a lock on wl_ops_config() operation and to set internal flags when a
+scan operation is started and stopped.
+
+Please add this to the staging-linus branch.
+
+Reviewed-by: Arend van Spriel <arend@broadcom.com>
+Signed-off-by: Roland Vossen <rvossen@broadcom.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/staging/brcm80211/sys/wl_mac80211.c | 14 ++++++++++----
+ drivers/staging/brcm80211/sys/wlc_mac80211.c | 13 +++++++++++++
+ drivers/staging/brcm80211/sys/wlc_pub.h | 2 ++
+ 3 files changed, 25 insertions(+), 4 deletions(-)
+
+--- a/drivers/staging/brcm80211/sys/wl_mac80211.c
++++ b/drivers/staging/brcm80211/sys/wl_mac80211.c
+@@ -353,9 +353,7 @@ ieee_set_channel(struct ieee80211_hw *hw
+ switch (type) {
+ case NL80211_CHAN_HT20:
+ case NL80211_CHAN_NO_HT:
+- WL_LOCK(wl);
+ err = wlc_set(wl->wlc, WLC_SET_CHANNEL, chan->hw_value);
+- WL_UNLOCK(wl);
+ break;
+ case NL80211_CHAN_HT40MINUS:
+ case NL80211_CHAN_HT40PLUS:
+@@ -376,6 +374,7 @@ static int wl_ops_config(struct ieee8021
+ int err = 0;
+ int new_int;
+
++ WL_LOCK(wl);
+ if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL) {
+ WL_NONE(("%s: Setting listen interval to %d\n",
+ __func__, conf->listen_interval));
+@@ -431,6 +430,7 @@ static int wl_ops_config(struct ieee8021
+ }
+
+ config_out:
++ WL_UNLOCK(wl);
+ return err;
+ }
+
+@@ -559,14 +559,20 @@ wl_ops_set_tim(struct ieee80211_hw *hw,
+
+ static void wl_ops_sw_scan_start(struct ieee80211_hw *hw)
+ {
++ struct wl_info *wl = hw->priv;
+ WL_NONE(("Scan Start\n"));
+- return;
++ WL_LOCK(wl);
++ wlc_scan_start(wl->wlc);
++ WL_UNLOCK(wl);
+ }
+
+ static void wl_ops_sw_scan_complete(struct ieee80211_hw *hw)
+ {
++ struct wl_info *wl = hw->priv;
+ WL_NONE(("Scan Complete\n"));
+- return;
++ WL_LOCK(wl);
++ wlc_scan_stop(wl->wlc);
++ WL_UNLOCK(wl);
+ }
+
+ static void wl_ops_set_tsf(struct ieee80211_hw *hw, u64 tsf)
+--- a/drivers/staging/brcm80211/sys/wlc_mac80211.c
++++ b/drivers/staging/brcm80211/sys/wlc_mac80211.c
+@@ -8672,3 +8672,16 @@ static void wlc_txq_free(wlc_info_t *wlc
+
+ kfree(qi);
+ }
++
++/*
++ * Flag 'scan in progress' to withold dynamic phy calibration
++ */
++void wlc_scan_start(struct wlc_info *wlc)
++{
++ wlc_phy_hold_upd(wlc->band->pi, PHY_HOLD_FOR_SCAN, true);
++}
++
++void wlc_scan_stop(struct wlc_info *wlc)
++{
++ wlc_phy_hold_upd(wlc->band->pi, PHY_HOLD_FOR_SCAN, false);
++}
+--- a/drivers/staging/brcm80211/sys/wlc_pub.h
++++ b/drivers/staging/brcm80211/sys/wlc_pub.h
+@@ -568,6 +568,8 @@ extern void wlc_enable_mac(struct wlc_in
+ extern u16 wlc_rate_shm_offset(struct wlc_info *wlc, u8 rate);
+ extern u32 wlc_get_rspec_history(struct wlc_bsscfg *cfg);
+ extern u32 wlc_get_current_highest_rate(struct wlc_bsscfg *cfg);
++extern void wlc_scan_start(struct wlc_info *wlc);
++extern void wlc_scan_stop(struct wlc_info *wlc);
+
+ static inline int wlc_iovar_getuint(struct wlc_info *wlc, const char *name,
+ uint *arg)
--- /dev/null
+From arend@broadcom.com Thu Feb 24 17:22:54 2011
+From: "Arend van Spriel" <arend@broadcom.com>
+Date: Thu, 24 Feb 2011 21:42:18 +0100
+Subject: staging: brcm80211: remove assert to avoid panic since 2.6.37 kernel
+To: gregkh@suse.de
+Cc: rvossen@broadcom.com, stable@kernel.org
+Message-ID: <1298580139-3695-1-git-send-email-arend@broadcom.com>
+
+From: Arend van Spriel <arend@broadcom.com>
+
+commit d062d44a8386c82c06e483f0c0d1124ba3cab2c8 upstream
+
+The driver assumed it would receive skb packets from MAC80211 which
+are not cloned. To guard this assumption an assert was placed in
+the transmit routine. As of kernel 2.6.37 it turns out MAC80211 does
+pass skb packets that are cloned. The assert is also not needed as
+it does not lead to a failure state in our driver when the packet is
+cloned. Therefore the assert can safely be removed.
+
+> commit f8a0a781488ec7288d1049e5d2022850aa98f7b6
+> Author: Felix Fietkau <nbd@openwrt.org>
+> Date: Sat Dec 18 19:30:50 2010 +0100
+>
+> mac80211: fix potentially redundant skb data copying
+>
+> When an skb is shared, it needs to be duplicated, along with its data
+> If the skb does not have enough headroom, using skb_copy might cause t
+> buffer to be copied twice (once by skb_copy and once by pskb_expand_he
+> Fix this by using skb_clone initially and letting ieee80211_skb_resize
+> out the rest.
+>
+> Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+> Signed-off-by: John W. Linville <linville@tuxdriver.com>
+>
+
+Acked-by: Brett Rudley <brudley@broadcom.com>
+Signed-off-by: Arend van Spriel <arend@broadcom.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/brcm80211/sys/wlc_mac80211.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/staging/brcm80211/sys/wlc_mac80211.c
++++ b/drivers/staging/brcm80211/sys/wlc_mac80211.c
+@@ -5336,7 +5336,6 @@ wlc_sendpkt_mac80211(wlc_info_t *wlc, vo
+ fifo = prio2fifo[prio];
+
+ ASSERT((uint) PKTHEADROOM(sdu) >= TXOFF);
+- ASSERT(!PKTSHARED(sdu));
+ ASSERT(!PKTNEXT(sdu));
+ ASSERT(!PKTLINK(sdu));
+ ASSERT(fifo < NFIFO);
--- /dev/null
+From 91035f0b7d89291af728b6f3e370c3be58fcbe1b Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Fri, 18 Feb 2011 22:35:56 +0000
+Subject: tcp: fix inet_twsk_deschedule()
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+commit 91035f0b7d89291af728b6f3e370c3be58fcbe1b upstream.
+
+Eric W. Biederman reported a lockdep splat in inet_twsk_deschedule()
+
+This is caused by inet_twsk_purge(), run from process context,
+and commit 575f4cd5a5b6394577 (net: Use rcu lookups in inet_twsk_purge.)
+removed the BH disabling that was necessary.
+
+Add the BH disabling but fine grained, right before calling
+inet_twsk_deschedule(), instead of whole function.
+
+With help from Linus Torvalds and Eric W. Biederman
+
+Reported-by: Eric W. Biederman <ebiederm@xmission.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+CC: Daniel Lezcano <daniel.lezcano@free.fr>
+CC: Pavel Emelyanov <xemul@openvz.org>
+CC: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/inet_timewait_sock.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/ipv4/inet_timewait_sock.c
++++ b/net/ipv4/inet_timewait_sock.c
+@@ -505,7 +505,9 @@ restart:
+ }
+
+ rcu_read_unlock();
++ local_bh_disable();
+ inet_twsk_deschedule(tw, twdr);
++ local_bh_enable();
+ inet_twsk_put(tw);
+ goto restart_rcu;
+ }
--- /dev/null
+From 72a012ce0a02c6c616676a24b40ff81d1aaeafda Mon Sep 17 00:00:00 2001
+From: Maciej Szmigiero <mhej@o2.pl>
+Date: Sat, 5 Feb 2011 21:52:00 +0100
+Subject: USB: Add quirk for Samsung Android phone modem
+
+From: Maciej Szmigiero <mhej@o2.pl>
+
+commit 72a012ce0a02c6c616676a24b40ff81d1aaeafda upstream.
+
+My Galaxy Spica needs this quirk when in modem mode, otherwise
+it causes endless USB bus resets and is unusable in this mode.
+
+Unfortunately Samsung decided to reuse ID of its old CDMA phone SGH-I500
+for the modem part.
+That's why in addition to this patch the visor driver must be prevented
+from binding to SPH-I500 ID, so ACM driver can do that.
+
+Signed-off-by: Maciej Szmigiero <mhej@o2.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -48,6 +48,10 @@ static const struct usb_device_id usb_qu
+ { USB_DEVICE(0x04b4, 0x0526), .driver_info =
+ USB_QUIRK_CONFIG_INTF_STRINGS },
+
++ /* Samsung Android phone modem - ID conflict with SPH-I500 */
++ { USB_DEVICE(0x04e8, 0x6601), .driver_info =
++ USB_QUIRK_CONFIG_INTF_STRINGS },
++
+ /* Roland SC-8820 */
+ { USB_DEVICE(0x0582, 0x0007), .driver_info = USB_QUIRK_RESET_RESUME },
+
--- /dev/null
+From 3c18e30f87ac5466bddbb05cf955605efd7db025 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Thu, 17 Feb 2011 10:26:38 -0500
+Subject: USB: add quirks entry for Keytouch QWERTY Panel
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 3c18e30f87ac5466bddbb05cf955605efd7db025 upstream.
+
+This patch (as1448) adds a quirks entry for the Keytouch QWERTY Panel
+firmware, used in the IEC 60945 keyboard. This device crashes during
+enumeration when the computer asks for its configuration string
+descriptor.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Tested-by: kholis <nur.kholis.majid@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -68,6 +68,10 @@ static const struct usb_device_id usb_qu
+ /* M-Systems Flash Disk Pioneers */
+ { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* Keytouch QWERTY Panel keyboard */
++ { USB_DEVICE(0x0926, 0x3333), .driver_info =
++ USB_QUIRK_CONFIG_INTF_STRINGS },
++
+ /* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */
+ { USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF },
+
--- /dev/null
+From acb52cb1613e1d3c8a8c650717cc51965c60d7d4 Mon Sep 17 00:00:00 2001
+From: Maciej Szmigiero <mhej@o2.pl>
+Date: Mon, 7 Feb 2011 12:42:36 +0100
+Subject: USB: Add Samsung SGH-I500/Android modem ID switch to visor driver
+
+From: Maciej Szmigiero <mhej@o2.pl>
+
+commit acb52cb1613e1d3c8a8c650717cc51965c60d7d4 upstream.
+
+[USB]Add Samsung SGH-I500/Android modem ID switch to visor driver
+
+Samsung decided to reuse USB ID of its old CDMA phone SGH-I500 for the
+modem part of some of their Android phones. At least Galaxy Spica
+is affected.
+
+This modem needs ACM driver and does not work with visor driver which
+binds the conflicting ID for SGH-I500.
+Because SGH-I500 is pretty an old hardware its best to add switch to
+visor
+driver in cause somebody still wants to use that phone with Linux.
+
+Note that this is needed only when using the Android phone as modem,
+not in USB storage or ADB mode.
+
+Signed-off-by: Maciej Szmigiero <mhej@o2.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/visor.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/usb/serial/visor.c
++++ b/drivers/usb/serial/visor.c
+@@ -27,6 +27,7 @@
+ #include <linux/uaccess.h>
+ #include <linux/usb.h>
+ #include <linux/usb/serial.h>
++#include <linux/usb/cdc.h>
+ #include "visor.h"
+
+ /*
+@@ -479,6 +480,17 @@ static int visor_probe(struct usb_serial
+
+ dbg("%s", __func__);
+
++ /*
++ * some Samsung Android phones in modem mode have the same ID
++ * as SPH-I500, but they are ACM devices, so dont bind to them
++ */
++ if (id->idVendor == SAMSUNG_VENDOR_ID &&
++ id->idProduct == SAMSUNG_SPH_I500_ID &&
++ serial->dev->descriptor.bDeviceClass == USB_CLASS_COMM &&
++ serial->dev->descriptor.bDeviceSubClass ==
++ USB_CDC_SUBCLASS_ACM)
++ return -ENODEV;
++
+ if (serial->dev->actconfig->desc.bConfigurationValue != 1) {
+ dev_err(&serial->dev->dev, "active config #%d != 1 ??\n",
+ serial->dev->actconfig->desc.bConfigurationValue);
--- /dev/null
+From b193b412e62b134adf69af286c7e7f8e99259350 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Fri, 11 Feb 2011 16:57:08 +0100
+Subject: usb: musb: omap2430: fix kernel panic on reboot
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit b193b412e62b134adf69af286c7e7f8e99259350 upstream.
+
+Cancel idle timer in musb_platform_exit.
+
+The idle timer could trigger after clock had been disabled leading to
+kernel panic when MUSB_DEVCTL is accessed in musb_do_idle on 2.6.37.
+
+The fault below is no longer triggered on 2.6.38-rc4 (clock is disabled
+later, and only if compiled as a module, and the offending memory access
+has moved) but the timer should be cancelled nonetheless.
+
+Rebooting... musb_hdrc musb_hdrc: remove, state 4
+usb usb1: USB disconnect, address 1
+musb_hdrc musb_hdrc: USB bus 1 deregistered
+Unhandled fault: external abort on non-linefetch (0x1028) at 0xfa0ab060
+Internal error: : 1028 [#1] PREEMPT
+last sysfs file: /sys/kernel/uevent_seqnum
+Modules linked in:
+CPU: 0 Not tainted (2.6.37+ #6)
+PC is at musb_do_idle+0x24/0x138
+LR is at musb_do_idle+0x18/0x138
+pc : [<c02377d8>] lr : [<c02377cc>] psr: 80000193
+sp : cf2bdd80 ip : cf2bdd80 fp : c048a20c
+r10: c048a60c r9 : c048a40c r8 : cf85e110
+r7 : cf2bc000 r6 : 40000113 r5 : c0489800 r4 : cf85e110
+r3 : 00000004 r2 : 00000006 r1 : fa0ab000 r0 : cf8a7000
+Flags: Nzcv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user
+Control: 10c5387d Table: 8faac019 DAC: 00000015
+Process reboot (pid: 769, stack limit = 0xcf2bc2f0)
+Stack: (0xcf2bdd80 to 0xcf2be000)
+dd80: 00000103 c0489800 c02377b4 c005fa34 00000555 c0071a8c c04a3858 cf2bdda8
+dda0: 00000555 c048a00c cf2bdda8 cf2bdda8 1838beb0 00000103 00000004 cf2bc000
+ddc0: 00000001 00000001 c04896c8 0000000a 00000000 c005ac14 00000001 c003f32c
+dde0: 00000000 00000025 00000000 cf2bc000 00000002 00000001 cf2bc000 00000000
+de00: 00000001 c005ad08 cf2bc000 c002e07c c03ec039 ffffffff fa200000 c0033608
+de20: 00000001 00000000 cf852c14 cf81f200 c045b714 c045b708 cf2bc000 c04a37e8
+de40: c0033c04 cf2bc000 00000000 00000001 cf2bde68 cf2bde68 c01c3abc c004f7d8
+de60: 60000013 ffffffff c0033c04 00000000 01234567 fee1dead 00000000 c006627c
+de80: 00000001 c00662c8 28121969 c00663ec cfa38c40 cf9f6a00 cf2bded0 cf9f6a0c
+dea0: 00000000 cf92f000 00008914 c02cd284 c04a55c8 c028b398 c00715c0 becf24a8
+dec0: 30687465 00000000 00000000 00000000 00000002 1301a8c0 00000000 00000000
+dee0: 00000002 1301a8c0 00000000 00000000 c0450494 cf527920 00011f10 cf2bdf08
+df00: 00011f10 cf2bdf10 00011f10 cf2bdf18 c00f0b44 c004f7e8 cf2bdf18 cf2bdf18
+df20: 00011f10 cf2bdf30 00011f10 cf2bdf38 cf401300 cf486100 00000008 c00d2b28
+df40: 00011f10 cf401300 00200200 c00d3388 00011f10 cfb63a88 cfb63a80 c00c2f08
+df60: 00000000 00000000 cfb63a80 00000000 cf0a3480 00000006 c0033c04 cfb63a80
+df80: 00000000 c00c0104 00000003 cf0a3480 cfb63a80 00000000 00000001 00000004
+dfa0: 00000058 c0033a80 00000000 00000001 fee1dead 28121969 01234567 00000000
+dfc0: 00000000 00000001 00000004 00000058 00000001 00000001 00000000 00000001
+dfe0: 4024d200 becf2cb0 00009210 4024d218 60000010 fee1dead 00000000 00000000
+[<c02377d8>] (musb_do_idle+0x24/0x138) from [<c005fa34>] (run_timer_softirq+0x1a8/0x26)
+[<c005fa34>] (run_timer_softirq+0x1a8/0x26c) from [<c005ac14>] (__do_softirq+0x88/0x13)
+[<c005ac14>] (__do_softirq+0x88/0x138) from [<c005ad08>] (irq_exit+0x44/0x98)
+[<c005ad08>] (irq_exit+0x44/0x98) from [<c002e07c>] (asm_do_IRQ+0x7c/0xa0)
+[<c002e07c>] (asm_do_IRQ+0x7c/0xa0) from [<c0033608>] (__irq_svc+0x48/0xa8)
+Exception stack(0xcf2bde20 to 0xcf2bde68)
+de20: 00000001 00000000 cf852c14 cf81f200 c045b714 c045b708 cf2bc000 c04a37e8
+de40: c0033c04 cf2bc000 00000000 00000001 cf2bde68 cf2bde68 c01c3abc c004f7d8
+de60: 60000013 ffffffff
+[<c0033608>] (__irq_svc+0x48/0xa8) from [<c004f7d8>] (sub_preempt_count+0x0/0xb8)
+Code: ebf86030 e5940098 e594108c e5902010 (e5d13060)
+---[ end trace 3689c0d808f9bf7c ]---
+Kernel panic - not syncing: Fatal exception in interrupt
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/musb/omap2430.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/musb/omap2430.c
++++ b/drivers/usb/musb/omap2430.c
+@@ -317,6 +317,7 @@ static int musb_platform_resume(struct m
+
+ int musb_platform_exit(struct musb *musb)
+ {
++ del_timer_sync(&musb_idle_timer);
+
+ musb_platform_suspend(musb);
+
--- /dev/null
+From 38237fd2be9421c104f84cc35665097bdce89013 Mon Sep 17 00:00:00 2001
+From: Jiri Slaby <jslaby@suse.cz>
+Date: Tue, 15 Feb 2011 15:55:07 +0100
+Subject: USB: serial/usb_wwan, fix tty NULL dereference
+
+From: Jiri Slaby <jslaby@suse.cz>
+
+commit 38237fd2be9421c104f84cc35665097bdce89013 upstream.
+
+tty_port_tty_get may return without any problems NULL. Handle this
+case and do not oops in usb_wwan_indat_callback by dereferencing it.
+
+The oops:
+Unable to handle kernel paging request for data at address 0x000000d8
+Faulting instruction address: 0xc0175b3c
+Oops: Kernel access of bad area, sig: 11 [#1]
+PowerPC 40x Platform
+last sysfs file:
+/sys/devices/pci0000:00/0000:00:00.0/0000:01:00.0/0000:02:09.2/usb1/idVendor
+Modules linked in:
+NIP: c0175b3c LR: c0175e7c CTR: c0215c90
+REGS: c77f7d50 TRAP: 0300 Not tainted (2.6.37-rc5)
+MSR: 00021030 <ME,CE,IR,DR> CR: 88482028 XER: 2000005f
+DEAR: 000000d8, ESR: 00000000
+TASK = c7141b90[1149] 'wvdial' THREAD: c2750000
+GPR00: 00021030 c77f7e00 c7141b90 00000000 0000000e 00000000 0000000e c0410680
+GPR08: c683db00 00000000 00000001 c03c81f8 88482028 10073ef4 ffffffb9 ffffff94
+GPR16: 00000000 fde036c0 00200200 00100100 00000001 ffffff8d c34fabcc 00000000
+GPR24: c71120d4 00000000 00000000 0000000e 00021030 00000000 00000000 0000000e
+NIP [c0175b3c] tty_buffer_request_room+0x2c/0x194
+LR [c0175e7c] tty_insert_flip_string_fixed_flag+0x3c/0xb0
+Call Trace:
+[c77f7e00] [00000003] 0x3 (unreliable)
+[c77f7e30] [c0175e7c] tty_insert_flip_string_fixed_flag+0x3c/0xb0
+[c77f7e60] [c0215df4] usb_wwan_indat_callback+0x164/0x170
+...
+
+References: https://bugzilla.kernel.org/show_bug.cgi?id=24582
+Cc: Amit Shah <amitshah@gmx.net>
+Cc: baoyb <baoyb@avit.org.cn>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/usb_wwan.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/serial/usb_wwan.c
++++ b/drivers/usb/serial/usb_wwan.c
+@@ -216,12 +216,15 @@ static void usb_wwan_indat_callback(stru
+ __func__, status, endpoint);
+ } else {
+ tty = tty_port_tty_get(&port->port);
+- if (urb->actual_length) {
+- tty_insert_flip_string(tty, data, urb->actual_length);
+- tty_flip_buffer_push(tty);
+- } else
+- dbg("%s: empty read urb received", __func__);
+- tty_kref_put(tty);
++ if (tty) {
++ if (urb->actual_length) {
++ tty_insert_flip_string(tty, data,
++ urb->actual_length);
++ tty_flip_buffer_push(tty);
++ } else
++ dbg("%s: empty read urb received", __func__);
++ tty_kref_put(tty);
++ }
+
+ /* Resubmit urb so we continue receiving */
+ if (status != -ESHUTDOWN) {
projects / thirdparty / kernel / stable-queue.git / commitdiff
