--- /dev/null
+From 2c27392dc4d4f5ee8a3967a520b8f6cac0418031 Mon Sep 17 00:00:00 2001
+From: Sujith Manoharan <Sujith.Manoharan@atheros.com>
+Date: Sun, 27 Feb 2011 09:23:52 +0530
+Subject: ath9k_htc: Fix an endian issue
+
+From: Sujith Manoharan <Sujith.Manoharan@atheros.com>
+
+commit 2c27392dc4d4f5ee8a3967a520b8f6cac0418031 upstream.
+
+The stream length/tag fields have to be in little endian
+format. Fixing this makes the driver work on big-endian
+platforms.
+
+Tested-by: raghunathan.kailasanathan@wipro.com
+Signed-off-by: Sujith Manoharan <Sujith.Manoharan@atheros.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/hif_usb.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
+@@ -210,8 +210,9 @@ static int __hif_usb_tx(struct hif_devic
+ struct tx_buf *tx_buf = NULL;
+ struct sk_buff *nskb = NULL;
+ int ret = 0, i;
+- u16 *hdr, tx_skb_cnt = 0;
++ u16 tx_skb_cnt = 0;
+ u8 *buf;
++ __le16 *hdr;
+
+ if (hif_dev->tx.tx_skb_cnt == 0)
+ return 0;
+@@ -236,9 +237,9 @@ static int __hif_usb_tx(struct hif_devic
+
+ buf = tx_buf->buf;
+ buf += tx_buf->offset;
+- hdr = (u16 *)buf;
+- *hdr++ = nskb->len;
+- *hdr++ = ATH_USB_TX_STREAM_MODE_TAG;
++ hdr = (__le16 *)buf;
++ *hdr++ = cpu_to_le16(nskb->len);
++ *hdr++ = cpu_to_le16(ATH_USB_TX_STREAM_MODE_TAG);
+ buf += 4;
+ memcpy(buf, nskb->data, nskb->len);
+ tx_buf->len = nskb->len + 4;
--- /dev/null
+From 450adcbe518ab3a3953d8475309525d22de77cba Mon Sep 17 00:00:00 2001
+From: Vivek Goyal <vgoyal@redhat.com>
+Date: Tue, 1 Mar 2011 13:40:54 -0500
+Subject: blk-throttle: Do not use kblockd workqueue for throtl work
+
+From: Vivek Goyal <vgoyal@redhat.com>
+
+commit 450adcbe518ab3a3953d8475309525d22de77cba upstream.
+
+o Dominik Klein reported a system hang issue while doing some blkio
+ throttling testing.
+
+ https://lkml.org/lkml/2011/2/24/173
+
+o Some tracing revealed that CFQ was not dispatching any more jobs as
+ queue unplug was not happening. And queue unplug was not happening
+ because unplug work was not being called as there was one throttling
+ work on same cpu which as not finished yet. And throttling work had not
+ finished as it was tyring to dispatch a bio to CFQ but all the request
+ descriptors were consume to it was put to sleep.
+
+o So basically it is a cyclic dependecny between CFQ unplug work and
+ throtl dispatch work. Tejun suggested that use separate workqueue for
+ such cases.
+
+o This patch uses a separate workqueue for throttle related work and
+ does not rely on kblockd workqueue anymore.
+
+Reported-by: Dominik Klein <dk@in-telegence.net>
+Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ block/blk-core.c | 7 -------
+ block/blk-throttle.c | 29 ++++++++++++++++++-----------
+ include/linux/blkdev.h | 3 ---
+ 3 files changed, 18 insertions(+), 21 deletions(-)
+
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -2610,13 +2610,6 @@ int kblockd_schedule_work(struct request
+ }
+ EXPORT_SYMBOL(kblockd_schedule_work);
+
+-int kblockd_schedule_delayed_work(struct request_queue *q,
+- struct delayed_work *dwork, unsigned long delay)
+-{
+- return queue_delayed_work(kblockd_workqueue, dwork, delay);
+-}
+-EXPORT_SYMBOL(kblockd_schedule_delayed_work);
+-
+ int __init blk_dev_init(void)
+ {
+ BUILD_BUG_ON(__REQ_NR_BITS > 8 *
+--- a/block/blk-throttle.c
++++ b/block/blk-throttle.c
+@@ -20,6 +20,11 @@ static int throtl_quantum = 32;
+ /* Throttling is performed over 100ms slice and after that slice is renewed */
+ static unsigned long throtl_slice = HZ/10; /* 100 ms */
+
++/* A workqueue to queue throttle related work */
++static struct workqueue_struct *kthrotld_workqueue;
++static void throtl_schedule_delayed_work(struct throtl_data *td,
++ unsigned long delay);
++
+ struct throtl_rb_root {
+ struct rb_root rb;
+ struct rb_node *left;
+@@ -337,10 +342,9 @@ static void throtl_schedule_next_dispatc
+ update_min_dispatch_time(st);
+
+ if (time_before_eq(st->min_disptime, jiffies))
+- throtl_schedule_delayed_work(td->queue, 0);
++ throtl_schedule_delayed_work(td, 0);
+ else
+- throtl_schedule_delayed_work(td->queue,
+- (st->min_disptime - jiffies));
++ throtl_schedule_delayed_work(td, (st->min_disptime - jiffies));
+ }
+
+ static inline void
+@@ -807,10 +811,10 @@ void blk_throtl_work(struct work_struct
+ }
+
+ /* Call with queue lock held */
+-void throtl_schedule_delayed_work(struct request_queue *q, unsigned long delay)
++static void
++throtl_schedule_delayed_work(struct throtl_data *td, unsigned long delay)
+ {
+
+- struct throtl_data *td = q->td;
+ struct delayed_work *dwork = &td->throtl_work;
+
+ if (total_nr_queued(td) > 0) {
+@@ -819,12 +823,11 @@ void throtl_schedule_delayed_work(struct
+ * Cancel that and schedule a new one.
+ */
+ __cancel_delayed_work(dwork);
+- kblockd_schedule_delayed_work(q, dwork, delay);
++ queue_delayed_work(kthrotld_workqueue, dwork, delay);
+ throtl_log(td, "schedule work. delay=%lu jiffies=%lu",
+ delay, jiffies);
+ }
+ }
+-EXPORT_SYMBOL(throtl_schedule_delayed_work);
+
+ static void
+ throtl_destroy_tg(struct throtl_data *td, struct throtl_grp *tg)
+@@ -912,7 +915,7 @@ static void throtl_update_blkio_group_re
+ smp_mb__after_atomic_inc();
+
+ /* Schedule a work now to process the limit change */
+- throtl_schedule_delayed_work(td->queue, 0);
++ throtl_schedule_delayed_work(td, 0);
+ }
+
+ static void throtl_update_blkio_group_write_bps(void *key,
+@@ -926,7 +929,7 @@ static void throtl_update_blkio_group_wr
+ smp_mb__before_atomic_inc();
+ atomic_inc(&td->limits_changed);
+ smp_mb__after_atomic_inc();
+- throtl_schedule_delayed_work(td->queue, 0);
++ throtl_schedule_delayed_work(td, 0);
+ }
+
+ static void throtl_update_blkio_group_read_iops(void *key,
+@@ -940,7 +943,7 @@ static void throtl_update_blkio_group_re
+ smp_mb__before_atomic_inc();
+ atomic_inc(&td->limits_changed);
+ smp_mb__after_atomic_inc();
+- throtl_schedule_delayed_work(td->queue, 0);
++ throtl_schedule_delayed_work(td, 0);
+ }
+
+ static void throtl_update_blkio_group_write_iops(void *key,
+@@ -954,7 +957,7 @@ static void throtl_update_blkio_group_wr
+ smp_mb__before_atomic_inc();
+ atomic_inc(&td->limits_changed);
+ smp_mb__after_atomic_inc();
+- throtl_schedule_delayed_work(td->queue, 0);
++ throtl_schedule_delayed_work(td, 0);
+ }
+
+ void throtl_shutdown_timer_wq(struct request_queue *q)
+@@ -1127,6 +1130,10 @@ void blk_throtl_exit(struct request_queu
+
+ static int __init throtl_init(void)
+ {
++ kthrotld_workqueue = alloc_workqueue("kthrotld", WQ_MEM_RECLAIM, 0);
++ if (!kthrotld_workqueue)
++ panic("Failed to create kthrotld\n");
++
+ blkio_policy_register(&blkio_policy_throtl);
+ return 0;
+ }
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -1089,7 +1089,6 @@ static inline void put_dev_sector(Sector
+
+ struct work_struct;
+ int kblockd_schedule_work(struct request_queue *q, struct work_struct *work);
+-int kblockd_schedule_delayed_work(struct request_queue *q, struct delayed_work *dwork, unsigned long delay);
+
+ #ifdef CONFIG_BLK_CGROUP
+ /*
+@@ -1137,7 +1136,6 @@ static inline uint64_t rq_io_start_time_
+ extern int blk_throtl_init(struct request_queue *q);
+ extern void blk_throtl_exit(struct request_queue *q);
+ extern int blk_throtl_bio(struct request_queue *q, struct bio **bio);
+-extern void throtl_schedule_delayed_work(struct request_queue *q, unsigned long delay);
+ extern void throtl_shutdown_timer_wq(struct request_queue *q);
+ #else /* CONFIG_BLK_DEV_THROTTLING */
+ static inline int blk_throtl_bio(struct request_queue *q, struct bio **bio)
+@@ -1147,7 +1145,6 @@ static inline int blk_throtl_bio(struct
+
+ static inline int blk_throtl_init(struct request_queue *q) { return 0; }
+ static inline int blk_throtl_exit(struct request_queue *q) { return 0; }
+-static inline void throtl_schedule_delayed_work(struct request_queue *q, unsigned long delay) {}
+ static inline void throtl_shutdown_timer_wq(struct request_queue *q) {}
+ #endif /* CONFIG_BLK_DEV_THROTTLING */
+
--- /dev/null
+From 1654e7411a1ad4999fe7890ef51d2a2bbb1fcf76 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Wed, 2 Mar 2011 08:48:05 -0500
+Subject: block: add @force_kblockd to __blk_run_queue()
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 1654e7411a1ad4999fe7890ef51d2a2bbb1fcf76 upstream.
+
+__blk_run_queue() automatically either calls q->request_fn() directly
+or schedules kblockd depending on whether the function is recursed.
+blk-flush implementation needs to be able to explicitly choose
+kblockd. Add @force_kblockd.
+
+All the current users are converted to specify %false for the
+parameter and this patch doesn't introduce any behavior change.
+
+stable: This is prerequisite for fixing ide oops caused by the new
+ blk-flush implementation.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Cc: Jan Beulich <JBeulich@novell.com>
+Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ block/blk-core.c | 11 ++++++-----
+ block/blk-flush.c | 2 +-
+ block/cfq-iosched.c | 6 +++---
+ block/elevator.c | 4 ++--
+ drivers/scsi/scsi_lib.c | 2 +-
+ drivers/scsi/scsi_transport_fc.c | 2 +-
+ include/linux/blkdev.h | 2 +-
+ 7 files changed, 15 insertions(+), 14 deletions(-)
+
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -352,7 +352,7 @@ void blk_start_queue(struct request_queu
+ WARN_ON(!irqs_disabled());
+
+ queue_flag_clear(QUEUE_FLAG_STOPPED, q);
+- __blk_run_queue(q);
++ __blk_run_queue(q, false);
+ }
+ EXPORT_SYMBOL(blk_start_queue);
+
+@@ -403,13 +403,14 @@ EXPORT_SYMBOL(blk_sync_queue);
+ /**
+ * __blk_run_queue - run a single device queue
+ * @q: The queue to run
++ * @force_kblockd: Don't run @q->request_fn directly. Use kblockd.
+ *
+ * Description:
+ * See @blk_run_queue. This variant must be called with the queue lock
+ * held and interrupts disabled.
+ *
+ */
+-void __blk_run_queue(struct request_queue *q)
++void __blk_run_queue(struct request_queue *q, bool force_kblockd)
+ {
+ blk_remove_plug(q);
+
+@@ -423,7 +424,7 @@ void __blk_run_queue(struct request_queu
+ * Only recurse once to avoid overrunning the stack, let the unplug
+ * handling reinvoke the handler shortly if we already got there.
+ */
+- if (!queue_flag_test_and_set(QUEUE_FLAG_REENTER, q)) {
++ if (!force_kblockd && !queue_flag_test_and_set(QUEUE_FLAG_REENTER, q)) {
+ q->request_fn(q);
+ queue_flag_clear(QUEUE_FLAG_REENTER, q);
+ } else {
+@@ -446,7 +447,7 @@ void blk_run_queue(struct request_queue
+ unsigned long flags;
+
+ spin_lock_irqsave(q->queue_lock, flags);
+- __blk_run_queue(q);
++ __blk_run_queue(q, false);
+ spin_unlock_irqrestore(q->queue_lock, flags);
+ }
+ EXPORT_SYMBOL(blk_run_queue);
+@@ -1053,7 +1054,7 @@ void blk_insert_request(struct request_q
+
+ drive_stat_acct(rq, 1);
+ __elv_add_request(q, rq, where, 0);
+- __blk_run_queue(q);
++ __blk_run_queue(q, false);
+ spin_unlock_irqrestore(q->queue_lock, flags);
+ }
+ EXPORT_SYMBOL(blk_insert_request);
+--- a/block/blk-flush.c
++++ b/block/blk-flush.c
+@@ -69,7 +69,7 @@ static void blk_flush_complete_seq_end_i
+ * queue. Kick the queue in those cases.
+ */
+ if (was_empty && next_rq)
+- __blk_run_queue(q);
++ __blk_run_queue(q, false);
+ }
+
+ static void pre_flush_end_io(struct request *rq, int error)
+--- a/block/cfq-iosched.c
++++ b/block/cfq-iosched.c
+@@ -3335,7 +3335,7 @@ cfq_rq_enqueued(struct cfq_data *cfqd, s
+ cfqd->busy_queues > 1) {
+ cfq_del_timer(cfqd, cfqq);
+ cfq_clear_cfqq_wait_request(cfqq);
+- __blk_run_queue(cfqd->queue);
++ __blk_run_queue(cfqd->queue, false);
+ } else {
+ cfq_blkiocg_update_idle_time_stats(
+ &cfqq->cfqg->blkg);
+@@ -3350,7 +3350,7 @@ cfq_rq_enqueued(struct cfq_data *cfqd, s
+ * this new queue is RT and the current one is BE
+ */
+ cfq_preempt_queue(cfqd, cfqq);
+- __blk_run_queue(cfqd->queue);
++ __blk_run_queue(cfqd->queue, false);
+ }
+ }
+
+@@ -3711,7 +3711,7 @@ static void cfq_kick_queue(struct work_s
+ struct request_queue *q = cfqd->queue;
+
+ spin_lock_irq(q->queue_lock);
+- __blk_run_queue(cfqd->queue);
++ __blk_run_queue(cfqd->queue, false);
+ spin_unlock_irq(q->queue_lock);
+ }
+
+--- a/block/elevator.c
++++ b/block/elevator.c
+@@ -602,7 +602,7 @@ void elv_quiesce_start(struct request_qu
+ */
+ elv_drain_elevator(q);
+ while (q->rq.elvpriv) {
+- __blk_run_queue(q);
++ __blk_run_queue(q, false);
+ spin_unlock_irq(q->queue_lock);
+ msleep(10);
+ spin_lock_irq(q->queue_lock);
+@@ -651,7 +651,7 @@ void elv_insert(struct request_queue *q,
+ * with anything. There's no point in delaying queue
+ * processing.
+ */
+- __blk_run_queue(q);
++ __blk_run_queue(q, false);
+ break;
+
+ case ELEVATOR_INSERT_SORT:
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -443,7 +443,7 @@ static void scsi_run_queue(struct reques
+ &sdev->request_queue->queue_flags);
+ if (flagset)
+ queue_flag_set(QUEUE_FLAG_REENTER, sdev->request_queue);
+- __blk_run_queue(sdev->request_queue);
++ __blk_run_queue(sdev->request_queue, false);
+ if (flagset)
+ queue_flag_clear(QUEUE_FLAG_REENTER, sdev->request_queue);
+ spin_unlock(sdev->request_queue->queue_lock);
+--- a/drivers/scsi/scsi_transport_fc.c
++++ b/drivers/scsi/scsi_transport_fc.c
+@@ -3829,7 +3829,7 @@ fc_bsg_goose_queue(struct fc_rport *rpor
+ !test_bit(QUEUE_FLAG_REENTER, &rport->rqst_q->queue_flags);
+ if (flagset)
+ queue_flag_set(QUEUE_FLAG_REENTER, rport->rqst_q);
+- __blk_run_queue(rport->rqst_q);
++ __blk_run_queue(rport->rqst_q, false);
+ if (flagset)
+ queue_flag_clear(QUEUE_FLAG_REENTER, rport->rqst_q);
+ spin_unlock_irqrestore(rport->rqst_q->queue_lock, flags);
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -700,7 +700,7 @@ extern void blk_start_queue(struct reque
+ extern void blk_stop_queue(struct request_queue *q);
+ extern void blk_sync_queue(struct request_queue *q);
+ extern void __blk_stop_queue(struct request_queue *q);
+-extern void __blk_run_queue(struct request_queue *);
++extern void __blk_run_queue(struct request_queue *q, bool force_kblockd);
+ extern void blk_run_queue(struct request_queue *);
+ extern int blk_rq_map_user(struct request_queue *, struct request *,
+ struct rq_map_data *, void __user *, unsigned long,
--- /dev/null
+From 255bb490c8c27eed484d538efe6ef6a7473bd3f6 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Wed, 2 Mar 2011 08:48:06 -0500
+Subject: block: blk-flush shouldn't call directly into q->request_fn() __blk_run_queue()
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 255bb490c8c27eed484d538efe6ef6a7473bd3f6 upstream.
+
+blk-flush decomposes a flush into sequence of multiple requests. On
+completion of a request, the next one is queued; however, block layer
+must not implicitly call into q->request_fn() directly from completion
+path. This makes the queue behave unexpectedly when seen from the
+drivers and violates the assumption that q->request_fn() is called
+with process context + queue_lock.
+
+This patch makes blk-flush the following two changes to make sure
+q->request_fn() is not called directly from request completion path.
+
+- blk_flush_complete_seq_end_io() now asks __blk_run_queue() to always
+ use kblockd instead of calling directly into q->request_fn().
+
+- queue_next_fseq() uses ELEVATOR_INSERT_REQUEUE instead of
+ ELEVATOR_INSERT_FRONT so that elv_insert() doesn't try to unplug the
+ request queue directly.
+
+Reported by Jan in the following threads.
+
+ http://thread.gmane.org/gmane.linux.ide/48778
+ http://thread.gmane.org/gmane.linux.ide/48786
+
+stable: applicable to v2.6.37.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Jan Beulich <JBeulich@novell.com>
+Cc: "David S. Miller" <davem@davemloft.net>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ block/blk-flush.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/block/blk-flush.c
++++ b/block/blk-flush.c
+@@ -66,10 +66,12 @@ static void blk_flush_complete_seq_end_i
+
+ /*
+ * Moving a request silently to empty queue_head may stall the
+- * queue. Kick the queue in those cases.
++ * queue. Kick the queue in those cases. This function is called
++ * from request completion path and calling directly into
++ * request_fn may confuse the driver. Always use kblockd.
+ */
+ if (was_empty && next_rq)
+- __blk_run_queue(q, false);
++ __blk_run_queue(q, true);
+ }
+
+ static void pre_flush_end_io(struct request *rq, int error)
+@@ -130,7 +132,7 @@ static struct request *queue_next_fseq(s
+ BUG();
+ }
+
+- elv_insert(q, rq, ELEVATOR_INSERT_FRONT);
++ elv_insert(q, rq, ELEVATOR_INSERT_REQUEUE);
+ return rq;
+ }
+
--- /dev/null
+From fd51469fb68b987032e46297e0a4fe9020063c20 Mon Sep 17 00:00:00 2001
+From: Petr Uzel <petr.uzel@suse.cz>
+Date: Thu, 3 Mar 2011 11:48:50 -0500
+Subject: block: kill loop_mutex
+
+From: Petr Uzel <petr.uzel@suse.cz>
+
+commit fd51469fb68b987032e46297e0a4fe9020063c20 upstream.
+
+Following steps lead to deadlock in kernel:
+
+dd if=/dev/zero of=img bs=512 count=1000
+losetup -f img
+mkfs.ext2 /dev/loop0
+mount -t ext2 -o loop /dev/loop0 mnt
+umount mnt/
+
+Stacktrace:
+[<c102ec04>] irq_exit+0x36/0x59
+[<c101502c>] smp_apic_timer_interrupt+0x6b/0x75
+[<c127f639>] apic_timer_interrupt+0x31/0x38
+[<c101df88>] mutex_spin_on_owner+0x54/0x5b
+[<fe2250e9>] lo_release+0x12/0x67 [loop]
+[<c10c4eae>] __blkdev_put+0x7c/0x10c
+[<c10a4da5>] fput+0xd5/0x1aa
+[<fe2250cf>] loop_clr_fd+0x1a9/0x1b1 [loop]
+[<fe225110>] lo_release+0x39/0x67 [loop]
+[<c10c4eae>] __blkdev_put+0x7c/0x10c
+[<c10a59d9>] deactivate_locked_super+0x17/0x36
+[<c10b6f37>] sys_umount+0x27e/0x2a5
+[<c10b6f69>] sys_oldumount+0xb/0xe
+[<c1002897>] sysenter_do_call+0x12/0x26
+[<ffffffff>] 0xffffffff
+
+Regression since 2a48fc0ab24241755dc9, which introduced the private
+loop_mutex as part of the BKL removal process.
+
+As per [1], the mutex can be safely removed.
+
+[1] http://www.gossamer-threads.com/lists/linux/kernel/1341930
+
+Addresses: https://bugzilla.novell.com/show_bug.cgi?id=669394
+Addresses: https://bugzilla.kernel.org/show_bug.cgi?id=29172
+
+Signed-off-by: Petr Uzel <petr.uzel@suse.cz>
+Reviewed-by: Nikanth Karthikesan <knikanth@suse.de>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/block/loop.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -78,7 +78,6 @@
+
+ #include <asm/uaccess.h>
+
+-static DEFINE_MUTEX(loop_mutex);
+ static LIST_HEAD(loop_devices);
+ static DEFINE_MUTEX(loop_devices_mutex);
+
+@@ -1505,11 +1504,9 @@ static int lo_open(struct block_device *
+ {
+ struct loop_device *lo = bdev->bd_disk->private_data;
+
+- mutex_lock(&loop_mutex);
+ mutex_lock(&lo->lo_ctl_mutex);
+ lo->lo_refcnt++;
+ mutex_unlock(&lo->lo_ctl_mutex);
+- mutex_unlock(&loop_mutex);
+
+ return 0;
+ }
+@@ -1519,7 +1516,6 @@ static int lo_release(struct gendisk *di
+ struct loop_device *lo = disk->private_data;
+ int err;
+
+- mutex_lock(&loop_mutex);
+ mutex_lock(&lo->lo_ctl_mutex);
+
+ if (--lo->lo_refcnt)
+@@ -1544,7 +1540,6 @@ static int lo_release(struct gendisk *di
+ out:
+ mutex_unlock(&lo->lo_ctl_mutex);
+ out_unlocked:
+- mutex_unlock(&loop_mutex);
+ return 0;
+ }
+
--- /dev/null
+From c86664e5a285af1afa06416e450e7c4af04daa7c Mon Sep 17 00:00:00 2001
+From: Jan Puk <janpuk@volny.cz>
+Date: Tue, 22 Feb 2011 14:49:43 +0100
+Subject: carl9170: add Airlive X.USB a/b/g/n USBID
+
+From: Jan Puk <janpuk@volny.cz>
+
+commit c86664e5a285af1afa06416e450e7c4af04daa7c upstream.
+
+"AirLive X.USB now works perfectly under a Linux
+environment!"
+
+Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ath/carl9170/usb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/ath/carl9170/usb.c
++++ b/drivers/net/wireless/ath/carl9170/usb.c
+@@ -118,6 +118,8 @@ static struct usb_device_id carl9170_usb
+ { USB_DEVICE(0x057c, 0x8402) },
+ /* Qwest/Actiontec 802AIN Wireless N USB Network Adapter */
+ { USB_DEVICE(0x1668, 0x1200) },
++ /* Airlive X.USB a/b/g/n */
++ { USB_DEVICE(0x1b75, 0x9170) },
+
+ /* terminate */
+ {}
--- /dev/null
+From 720dc34bbbe9493c7bd48b2243058b4e447a929d Mon Sep 17 00:00:00 2001
+From: Gerrit Renker <gerrit@erg.abdn.ac.uk>
+Date: Tue, 1 Mar 2011 23:02:07 -0800
+Subject: dccp: fix oops on Reset after close
+
+From: Gerrit Renker <gerrit@erg.abdn.ac.uk>
+
+commit 720dc34bbbe9493c7bd48b2243058b4e447a929d upstream.
+
+This fixes a bug in the order of dccp_rcv_state_process() that still permitted
+reception even after closing the socket. A Reset after close thus causes a NULL
+pointer dereference by not preventing operations on an already torn-down socket.
+
+ dccp_v4_do_rcv()
+ |
+ | state other than OPEN
+ v
+ dccp_rcv_state_process()
+ |
+ | DCCP_PKT_RESET
+ v
+ dccp_rcv_reset()
+ |
+ v
+ dccp_time_wait()
+
+ WARNING: at net/ipv4/inet_timewait_sock.c:141 __inet_twsk_hashdance+0x48/0x128()
+ Modules linked in: arc4 ecb carl9170 rt2870sta(C) mac80211 r8712u(C) crc_ccitt ah
+ [<c0038850>] (unwind_backtrace+0x0/0xec) from [<c0055364>] (warn_slowpath_common)
+ [<c0055364>] (warn_slowpath_common+0x4c/0x64) from [<c0055398>] (warn_slowpath_n)
+ [<c0055398>] (warn_slowpath_null+0x1c/0x24) from [<c02b72d0>] (__inet_twsk_hashd)
+ [<c02b72d0>] (__inet_twsk_hashdance+0x48/0x128) from [<c031caa0>] (dccp_time_wai)
+ [<c031caa0>] (dccp_time_wait+0x40/0xc8) from [<c031c15c>] (dccp_rcv_state_proces)
+ [<c031c15c>] (dccp_rcv_state_process+0x120/0x538) from [<c032609c>] (dccp_v4_do_)
+ [<c032609c>] (dccp_v4_do_rcv+0x11c/0x14c) from [<c0286594>] (release_sock+0xac/0)
+ [<c0286594>] (release_sock+0xac/0x110) from [<c031fd34>] (dccp_close+0x28c/0x380)
+ [<c031fd34>] (dccp_close+0x28c/0x380) from [<c02d9a78>] (inet_release+0x64/0x70)
+
+The fix is by testing the socket state first. Receiving a packet in Closed state
+now also produces the required "No connection" Reset reply of RFC 4340, 8.3.1.
+
+Reported-and-tested-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/dccp/input.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/net/dccp/input.c
++++ b/net/dccp/input.c
+@@ -621,6 +621,9 @@ int dccp_rcv_state_process(struct sock *
+ /* Caller (dccp_v4_do_rcv) will send Reset */
+ dcb->dccpd_reset_code = DCCP_RESET_CODE_NO_CONNECTION;
+ return 1;
++ } else if (sk->sk_state == DCCP_CLOSED) {
++ dcb->dccpd_reset_code = DCCP_RESET_CODE_NO_CONNECTION;
++ return 1;
+ }
+
+ if (sk->sk_state != DCCP_REQUESTING && sk->sk_state != DCCP_RESPOND) {
+@@ -683,10 +686,6 @@ int dccp_rcv_state_process(struct sock *
+ }
+
+ switch (sk->sk_state) {
+- case DCCP_CLOSED:
+- dcb->dccpd_reset_code = DCCP_RESET_CODE_NO_CONNECTION;
+- return 1;
+-
+ case DCCP_REQUESTING:
+ queued = dccp_rcv_request_sent_state_process(sk, skb, dh, len);
+ if (queued >= 0)
--- /dev/null
+From 1362fa078dae16776cd439791c6605b224ea6171 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Thu, 3 Mar 2011 11:28:58 +0000
+Subject: DNS: Fix a NULL pointer deref when trying to read an error key [CVE-2011-1076]
+
+From: David Howells <dhowells@redhat.com>
+
+commit 1362fa078dae16776cd439791c6605b224ea6171 upstream.
+
+When a DNS resolver key is instantiated with an error indication, attempts to
+read that key will result in an oops because user_read() is expecting there to
+be a payload - and there isn't one [CVE-2011-1076].
+
+Give the DNS resolver key its own read handler that returns the error cached in
+key->type_data.x[0] as an error rather than crashing.
+
+Also make the kenter() at the beginning of dns_resolver_instantiate() limit the
+amount of data it prints, since the data is not necessarily NUL-terminated.
+
+The buggy code was added in:
+
+ commit 4a2d789267e00b5a1175ecd2ddefcc78b83fbf09
+ Author: Wang Lei <wang840925@gmail.com>
+ Date: Wed Aug 11 09:37:58 2010 +0100
+ Subject: DNS: If the DNS server returns an error, allow that to be cached [ver #2]
+
+This can trivially be reproduced by any user with the following program
+compiled with -lkeyutils:
+
+ #include <stdlib.h>
+ #include <keyutils.h>
+ #include <err.h>
+ static char payload[] = "#dnserror=6";
+ int main()
+ {
+ key_serial_t key;
+ key = add_key("dns_resolver", "a", payload, sizeof(payload),
+ KEY_SPEC_SESSION_KEYRING);
+ if (key == -1)
+ err(1, "add_key");
+ if (keyctl_read(key, NULL, 0) == -1)
+ err(1, "read_key");
+ return 0;
+ }
+
+What should happen is that keyctl_read() reports error 6 (ENXIO) to the user:
+
+ dns-break: read_key: No such device or address
+
+but instead the kernel oopses.
+
+This cannot be reproduced with the 'keyutils add' or 'keyutils padd' commands
+as both of those cut the data down below the NUL termination that must be
+included in the data. Without this dns_resolver_instantiate() will return
+-EINVAL and the key will not be instantiated such that it can be read.
+
+The oops looks like:
+
+BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
+IP: [<ffffffff811b99f7>] user_read+0x4f/0x8f
+PGD 3bdf8067 PUD 385b9067 PMD 0
+Oops: 0000 [#1] SMP
+last sysfs file: /sys/devices/pci0000:00/0000:00:19.0/irq
+CPU 0
+Modules linked in:
+
+Pid: 2150, comm: dns-break Not tainted 2.6.38-rc7-cachefs+ #468 /DG965RY
+RIP: 0010:[<ffffffff811b99f7>] [<ffffffff811b99f7>] user_read+0x4f/0x8f
+RSP: 0018:ffff88003bf47f08 EFLAGS: 00010246
+RAX: 0000000000000001 RBX: ffff88003b5ea378 RCX: ffffffff81972368
+RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88003b5ea378
+RBP: ffff88003bf47f28 R08: ffff88003be56620 R09: 0000000000000000
+R10: 0000000000000395 R11: 0000000000000002 R12: 0000000000000000
+R13: 0000000000000000 R14: 0000000000000000 R15: ffffffffffffffa1
+FS: 00007feab5751700(0000) GS:ffff88003e000000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000000000000010 CR3: 000000003de40000 CR4: 00000000000006f0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+Process dns-break (pid: 2150, threadinfo ffff88003bf46000, task ffff88003be56090)
+Stack:
+ ffff88003b5ea378 ffff88003b5ea3a0 0000000000000000 0000000000000000
+ ffff88003bf47f68 ffffffff811b708e ffff88003c442bc8 0000000000000000
+ 00000000004005a0 00007fffba368060 0000000000000000 0000000000000000
+Call Trace:
+ [<ffffffff811b708e>] keyctl_read_key+0xac/0xcf
+ [<ffffffff811b7c07>] sys_keyctl+0x75/0xb6
+ [<ffffffff81001f7b>] system_call_fastpath+0x16/0x1b
+Code: 75 1f 48 83 7b 28 00 75 18 c6 05 58 2b fb 00 01 be bb 00 00 00 48 c7 c7 76 1c 75 81 e8 13 c2 e9 ff 4c 8b b3 e0 00 00 00 4d 85 ed <41> 0f b7 5e 10 74 2d 4d 85 e4 74 28 e8 98 79 ee ff 49 39 dd 48
+RIP [<ffffffff811b99f7>] user_read+0x4f/0x8f
+ RSP <ffff88003bf47f08>
+CR2: 0000000000000010
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+Acked-by: Jeff Layton <jlayton@redhat.com>
+cc: Wang Lei <wang840925@gmail.com>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/networking/dns_resolver.txt | 9 ++++++++-
+ net/dns_resolver/dns_key.c | 20 +++++++++++++++++---
+ 2 files changed, 25 insertions(+), 4 deletions(-)
+
+--- a/Documentation/networking/dns_resolver.txt
++++ b/Documentation/networking/dns_resolver.txt
+@@ -61,7 +61,6 @@ before the more general line given above
+ create dns_resolver foo:* * /usr/sbin/dns.foo %k
+
+
+-
+ =====
+ USAGE
+ =====
+@@ -104,6 +103,14 @@ implemented in the module can be called
+ returned also.
+
+
++===============================
++READING DNS KEYS FROM USERSPACE
++===============================
++
++Keys of dns_resolver type can be read from userspace using keyctl_read() or
++"keyctl read/print/pipe".
++
++
+ =========
+ MECHANISM
+ =========
+--- a/net/dns_resolver/dns_key.c
++++ b/net/dns_resolver/dns_key.c
+@@ -67,8 +67,9 @@ dns_resolver_instantiate(struct key *key
+ size_t result_len = 0;
+ const char *data = _data, *end, *opt;
+
+- kenter("%%%d,%s,'%s',%zu",
+- key->serial, key->description, data, datalen);
++ kenter("%%%d,%s,'%*.*s',%zu",
++ key->serial, key->description,
++ (int)datalen, (int)datalen, data, datalen);
+
+ if (datalen <= 1 || !data || data[datalen - 1] != '\0')
+ return -EINVAL;
+@@ -217,6 +218,19 @@ static void dns_resolver_describe(const
+ seq_printf(m, ": %u", key->datalen);
+ }
+
++/*
++ * read the DNS data
++ * - the key's semaphore is read-locked
++ */
++static long dns_resolver_read(const struct key *key,
++ char __user *buffer, size_t buflen)
++{
++ if (key->type_data.x[0])
++ return key->type_data.x[0];
++
++ return user_read(key, buffer, buflen);
++}
++
+ struct key_type key_type_dns_resolver = {
+ .name = "dns_resolver",
+ .instantiate = dns_resolver_instantiate,
+@@ -224,7 +238,7 @@ struct key_type key_type_dns_resolver =
+ .revoke = user_revoke,
+ .destroy = user_destroy,
+ .describe = dns_resolver_describe,
+- .read = user_read,
++ .read = dns_resolver_read,
+ };
+
+ static int __init init_dns_resolver(void)
--- /dev/null
+From jan@gondor.com Thu Mar 3 16:46:58 2011
+From: Jan Niehusmann <jan@gondor.com>
+Date: Fri, 4 Mar 2011 00:28:02 +0100
+Subject: drm/i915: fix memory corruption with GM965 and >4GB RAM
+To: stable@kernel.org
+Cc: daniel.vetter@ffwll.ch, chris@chris-wilson.co.uk
+Message-ID: <20110303232801.GA7173@x61s.reliablesolutions.de>
+Content-Disposition: inline
+
+From: Jan Niehusmann <jan@gondor.com>
+
+commit 6927faf30920b8c03dfa007e732642a1f1f20089 upstream.
+
+On a Thinkpad x61s, I noticed some memory corruption when
+plugging/unplugging the external VGA connection. The symptoms are that
+4 bytes at the beginning of a page get overwritten by zeroes.
+The address of the corruption varies when rebooting the machine, but
+stays constant while it's running (so it's possible to repeatedly write
+some data and then corrupt it again by plugging the cable).
+
+Further investigation revealed that the corrupted address is
+(dev_priv->status_page_dmah->busaddr & 0xffffffff), ie. the beginning of
+the hardware status page of the i965 graphics card, cut to 32 bits.
+
+So it seems that for some memory access, the hardware uses only 32 bit
+addressing. If the hardware status page is located >4GB, this
+corrupts unrelated memory.
+
+Signed-off-by: Jan Niehusmann <jan@gondor.com>
+Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/i915_dma.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/gpu/drm/i915/i915_dma.c
++++ b/drivers/gpu/drm/i915/i915_dma.c
+@@ -1943,6 +1943,17 @@ int i915_driver_load(struct drm_device *
+ if (IS_GEN2(dev))
+ dma_set_coherent_mask(&dev->pdev->dev, DMA_BIT_MASK(30));
+
++ /* 965GM sometimes incorrectly writes to hardware status page (HWS)
++ * using 32bit addressing, overwriting memory if HWS is located
++ * above 4GB.
++ *
++ * The documentation also mentions an issue with undefined
++ * behaviour if any general state is accessed within a page above 4GB,
++ * which also needs to be handled carefully.
++ */
++ if (IS_BROADWATER(dev) || IS_CRESTLINE(dev))
++ dma_set_coherent_mask(&dev->pdev->dev, DMA_BIT_MASK(32));
++
+ dev_priv->regs = ioremap(base, size);
+ if (!dev_priv->regs) {
+ DRM_ERROR("failed to map registers\n");
--- /dev/null
+From 664dc878ed6f0476b875547547a49e06f7a4e73b Mon Sep 17 00:00:00 2001
+From: Bruce Allan <bruce.w.allan@intel.com>
+Date: Wed, 24 Nov 2010 06:01:46 +0000
+Subject: e1000e: 82579 PHY incorrectly identified during init
+
+From: Bruce Allan <bruce.w.allan@intel.com>
+
+commit 664dc878ed6f0476b875547547a49e06f7a4e73b upstream.
+
+During init, reading the 2 PHY ID registers back-to-back in the default
+fast mode could return invalid data (all F's) and in slow mode could
+return data to the second read the data from the first read. To resolve
+the issue in fast mode, set to slow mode before any PHY accesses; to
+resolve the issue in slow mode, put in a delay for every 82579 PHY access.
+Since this PHY is currently only paired with the pch2lan MAC and the PHY
+type is not known before the first PHY access which can fail this way,
+check for this based on MAC-type.
+
+Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
+Tested-by: Jeff Pieper <jeffrey.e.pieper@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Acked-by: Brandon Philips <bphilips@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ drivers/net/e1000e/ich8lan.c | 16 +++++++++++-----
+ drivers/net/e1000e/phy.c | 14 ++++++++++++++
+ 2 files changed, 25 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/e1000e/ich8lan.c
++++ b/drivers/net/e1000e/ich8lan.c
+@@ -338,12 +338,17 @@ static s32 e1000_init_phy_params_pchlan(
+ }
+
+ phy->id = e1000_phy_unknown;
+- ret_val = e1000e_get_phy_id(hw);
+- if (ret_val)
+- goto out;
+- if ((phy->id == 0) || (phy->id == PHY_REVISION_MASK)) {
++ switch (hw->mac.type) {
++ default:
++ ret_val = e1000e_get_phy_id(hw);
++ if (ret_val)
++ goto out;
++ if ((phy->id != 0) && (phy->id != PHY_REVISION_MASK))
++ break;
++ /* fall-through */
++ case e1000_pch2lan:
+ /*
+- * In case the PHY needs to be in mdio slow mode (eg. 82577),
++ * In case the PHY needs to be in mdio slow mode,
+ * set slow mode and try to get the PHY id again.
+ */
+ ret_val = e1000_set_mdio_slow_mode_hv(hw);
+@@ -352,6 +357,7 @@ static s32 e1000_init_phy_params_pchlan(
+ ret_val = e1000e_get_phy_id(hw);
+ if (ret_val)
+ goto out;
++ break;
+ }
+ phy->type = e1000e_get_phy_type_from_id(phy->id);
+
+--- a/drivers/net/e1000e/phy.c
++++ b/drivers/net/e1000e/phy.c
+@@ -226,6 +226,13 @@ s32 e1000e_read_phy_reg_mdic(struct e100
+ }
+ *data = (u16) mdic;
+
++ /*
++ * Allow some time after each MDIC transaction to avoid
++ * reading duplicate data in the next MDIC transaction.
++ */
++ if (hw->mac.type == e1000_pch2lan)
++ udelay(100);
++
+ return 0;
+ }
+
+@@ -279,6 +286,13 @@ s32 e1000e_write_phy_reg_mdic(struct e10
+ return -E1000_ERR_PHY;
+ }
+
++ /*
++ * Allow some time after each MDIC transaction to avoid
++ * reading duplicate data in the next MDIC transaction.
++ */
++ if (hw->mac.type == e1000_pch2lan)
++ udelay(100);
++
+ return 0;
+ }
+
--- /dev/null
+From 4def99bbfd46e05c5e03b5b282cb4ee30e27ff19 Mon Sep 17 00:00:00 2001
+From: Bruce Allan <bruce.w.allan@intel.com>
+Date: Wed, 2 Feb 2011 09:30:36 +0000
+Subject: e1000e: disable broken PHY wakeup for ICH10 LOMs, use MAC wakeup instead
+
+From: Bruce Allan <bruce.w.allan@intel.com>
+
+commit 4def99bbfd46e05c5e03b5b282cb4ee30e27ff19 upstream.
+
+When support for 82577/82578 was added[1] in 2.6.31, PHY wakeup was in-
+advertently enabled (even though it does not function properly) on ICH10
+LOMs. This patch makes it so that the ICH10 LOMs use MAC wakeup instead
+as was done with the initial support for those devices (i.e. 82567LM-3,
+82567LF-3 and 82567V-4).
+
+[1] commit a4f58f5455ba0efda36fb33c37074922d1527a10
+
+Reported-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/e1000e/netdev.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/e1000e/netdev.c
++++ b/drivers/net/e1000e/netdev.c
+@@ -5884,7 +5884,8 @@ static int __devinit e1000_probe(struct
+ /* APME bit in EEPROM is mapped to WUC.APME */
+ eeprom_data = er32(WUC);
+ eeprom_apme_mask = E1000_WUC_APME;
+- if (eeprom_data & E1000_WUC_PHY_WAKE)
++ if ((hw->mac.type > e1000_ich10lan) &&
++ (eeprom_data & E1000_WUC_PHY_WAKE))
+ adapter->flags2 |= FLAG2_HAS_PHY_WAKEUP;
+ } else if (adapter->flags & FLAG_APME_IN_CTRL3) {
+ if (adapter->flags & FLAG_APME_CHECK_PORT_B &&
--- /dev/null
+From 4f919a3bc54da01db829c520ce4b1fabfde1c3f7 Mon Sep 17 00:00:00 2001
+From: Daniel J Blueman <daniel.blueman@gmail.com>
+Date: Tue, 22 Feb 2011 00:11:06 +0800
+Subject: fix cfg80211_wext_siwfreq lock ordering...
+
+From: Daniel J Blueman <daniel.blueman@gmail.com>
+
+commit 4f919a3bc54da01db829c520ce4b1fabfde1c3f7 upstream.
+
+I previously managed to reproduce a hang while scanning wireless
+channels (reproducible with airodump-ng hopping channels); subsequent
+lockdep instrumentation revealed a lock ordering issue.
+
+Without knowing the design intent, it looks like the locks should be
+taken in reverse order; please comment.
+
+=======================================================
+[ INFO: possible circular locking dependency detected ]
+2.6.38-rc5-341cd #4
+-------------------------------------------------------
+airodump-ng/15445 is trying to acquire lock:
+ (&rdev->devlist_mtx){+.+.+.}, at: [<ffffffff816b1266>]
+cfg80211_wext_siwfreq+0xc6/0x100
+
+but task is already holding lock:
+ (&wdev->mtx){+.+.+.}, at: [<ffffffff816b125c>] cfg80211_wext_siwfreq+0xbc/0x100
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #1 (&wdev->mtx){+.+.+.}:
+ [<ffffffff810a79d6>] lock_acquire+0xc6/0x280
+ [<ffffffff816d6bce>] mutex_lock_nested+0x6e/0x4b0
+ [<ffffffff81696080>] cfg80211_netdev_notifier_call+0x430/0x5f0
+ [<ffffffff8109351b>] notifier_call_chain+0x8b/0x100
+ [<ffffffff810935b1>] raw_notifier_call_chain+0x11/0x20
+ [<ffffffff81576d92>] call_netdevice_notifiers+0x32/0x60
+ [<ffffffff815771a4>] __dev_notify_flags+0x34/0x80
+ [<ffffffff81577230>] dev_change_flags+0x40/0x70
+ [<ffffffff8158587c>] do_setlink+0x1fc/0x8d0
+ [<ffffffff81586042>] rtnl_setlink+0xf2/0x140
+ [<ffffffff81586923>] rtnetlink_rcv_msg+0x163/0x270
+ [<ffffffff8159d741>] netlink_rcv_skb+0xa1/0xd0
+ [<ffffffff815867b0>] rtnetlink_rcv+0x20/0x30
+ [<ffffffff8159d39a>] netlink_unicast+0x2ba/0x300
+ [<ffffffff8159dd57>] netlink_sendmsg+0x267/0x3e0
+ [<ffffffff8155e364>] sock_sendmsg+0xe4/0x110
+ [<ffffffff8155f3a3>] sys_sendmsg+0x253/0x3b0
+ [<ffffffff81003192>] system_call_fastpath+0x16/0x1b
+
+-> #0 (&rdev->devlist_mtx){+.+.+.}:
+ [<ffffffff810a7222>] __lock_acquire+0x1622/0x1d10
+ [<ffffffff810a79d6>] lock_acquire+0xc6/0x280
+ [<ffffffff816d6bce>] mutex_lock_nested+0x6e/0x4b0
+ [<ffffffff816b1266>] cfg80211_wext_siwfreq+0xc6/0x100
+ [<ffffffff816b2fad>] ioctl_standard_call+0x5d/0xd0
+ [<ffffffff816b3223>] T.808+0x163/0x170
+ [<ffffffff816b326a>] wext_handle_ioctl+0x3a/0x90
+ [<ffffffff815798d2>] dev_ioctl+0x6f2/0x830
+ [<ffffffff8155cf3d>] sock_ioctl+0xfd/0x290
+ [<ffffffff8117dffd>] do_vfs_ioctl+0x9d/0x590
+ [<ffffffff8117e53a>] sys_ioctl+0x4a/0x80
+ [<ffffffff81003192>] system_call_fastpath+0x16/0x1b
+
+other info that might help us debug this:
+
+2 locks held by airodump-ng/15445:
+ #0: (rtnl_mutex){+.+.+.}, at: [<ffffffff81586782>] rtnl_lock+0x12/0x20
+ #1: (&wdev->mtx){+.+.+.}, at: [<ffffffff816b125c>]
+cfg80211_wext_siwfreq+0xbc/0x100
+
+stack backtrace:
+Pid: 15445, comm: airodump-ng Not tainted 2.6.38-rc5-341cd #4
+Call Trace:
+ [<ffffffff810a3f0a>] ? print_circular_bug+0xfa/0x100
+ [<ffffffff810a7222>] ? __lock_acquire+0x1622/0x1d10
+ [<ffffffff810a1f99>] ? trace_hardirqs_off_caller+0x29/0xc0
+ [<ffffffff810a79d6>] ? lock_acquire+0xc6/0x280
+ [<ffffffff816b1266>] ? cfg80211_wext_siwfreq+0xc6/0x100
+ [<ffffffff810a31d7>] ? mark_held_locks+0x67/0x90
+ [<ffffffff816d6bce>] ? mutex_lock_nested+0x6e/0x4b0
+ [<ffffffff816b1266>] ? cfg80211_wext_siwfreq+0xc6/0x100
+ [<ffffffff810a31d7>] ? mark_held_locks+0x67/0x90
+ [<ffffffff816b1266>] ? cfg80211_wext_siwfreq+0xc6/0x100
+ [<ffffffff816b1266>] ? cfg80211_wext_siwfreq+0xc6/0x100
+ [<ffffffff816b2fad>] ? ioctl_standard_call+0x5d/0xd0
+ [<ffffffff8157818b>] ? __dev_get_by_name+0x9b/0xc0
+ [<ffffffff816b2f50>] ? ioctl_standard_call+0x0/0xd0
+ [<ffffffff816b3223>] ? T.808+0x163/0x170
+ [<ffffffff8112ddf2>] ? might_fault+0x72/0xd0
+ [<ffffffff816b326a>] ? wext_handle_ioctl+0x3a/0x90
+ [<ffffffff8112de3b>] ? might_fault+0xbb/0xd0
+ [<ffffffff815798d2>] ? dev_ioctl+0x6f2/0x830
+ [<ffffffff810a1bae>] ? put_lock_stats+0xe/0x40
+ [<ffffffff810a1c8c>] ? lock_release_holdtime+0xac/0x150
+ [<ffffffff8155cf3d>] ? sock_ioctl+0xfd/0x290
+ [<ffffffff8117dffd>] ? do_vfs_ioctl+0x9d/0x590
+ [<ffffffff8116c8ff>] ? fget_light+0x1df/0x3c0
+ [<ffffffff8117e53a>] ? sys_ioctl+0x4a/0x80
+ [<ffffffff81003192>] ? system_call_fastpath+0x16/0x1b
+
+Signed-off-by: Daniel J Blueman <daniel.blueman@gmail.com>
+Acked-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/wireless/wext-compat.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/wireless/wext-compat.c
++++ b/net/wireless/wext-compat.c
+@@ -802,11 +802,11 @@ int cfg80211_wext_siwfreq(struct net_dev
+ return freq;
+ if (freq == 0)
+ return -EINVAL;
+- wdev_lock(wdev);
+ mutex_lock(&rdev->devlist_mtx);
++ wdev_lock(wdev);
+ err = cfg80211_set_freq(rdev, wdev, freq, NL80211_CHAN_NO_HT);
+- mutex_unlock(&rdev->devlist_mtx);
+ wdev_unlock(wdev);
++ mutex_unlock(&rdev->devlist_mtx);
+ return err;
+ default:
+ return -EOPNOTSUPP;
--- /dev/null
+From b44129b30652c8771db2265939bb8b463724043d Mon Sep 17 00:00:00 2001
+From: Mel Gorman <mel@csn.ul.ie>
+Date: Thu, 13 Jan 2011 15:45:43 -0800
+Subject: mm: vmstat: use a single setter function and callback for adjusting percpu thresholds
+
+From: Mel Gorman <mel@csn.ul.ie>
+
+commit b44129b30652c8771db2265939bb8b463724043d upstream.
+
+reduce_pgdat_percpu_threshold() and restore_pgdat_percpu_threshold() exist
+to adjust the per-cpu vmstat thresholds while kswapd is awake to avoid
+errors due to counter drift. The functions duplicate some code so this
+patch replaces them with a single set_pgdat_percpu_threshold() that takes
+a callback function to calculate the desired threshold as a parameter.
+
+[akpm@linux-foundation.org: readability tweak]
+[kosaki.motohiro@jp.fujitsu.com: set_pgdat_percpu_threshold(): don't use for_each_online_cpu]
+Signed-off-by: Mel Gorman <mel@csn.ul.ie>
+Reviewed-by: Christoph Lameter <cl@linux.com>
+Reviewed-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/vmstat.h | 10 ++++++----
+ mm/vmscan.c | 19 +++++++++++++++++--
+ mm/vmstat.c | 36 +++++++-----------------------------
+ 3 files changed, 30 insertions(+), 35 deletions(-)
+
+--- a/include/linux/vmstat.h
++++ b/include/linux/vmstat.h
+@@ -254,8 +254,11 @@ extern void dec_zone_state(struct zone *
+ extern void __dec_zone_state(struct zone *, enum zone_stat_item);
+
+ void refresh_cpu_vm_stats(int);
+-void reduce_pgdat_percpu_threshold(pg_data_t *pgdat);
+-void restore_pgdat_percpu_threshold(pg_data_t *pgdat);
++
++int calculate_pressure_threshold(struct zone *zone);
++int calculate_normal_threshold(struct zone *zone);
++void set_pgdat_percpu_threshold(pg_data_t *pgdat,
++ int (*calculate_pressure)(struct zone *));
+ #else /* CONFIG_SMP */
+
+ /*
+@@ -300,8 +303,7 @@ static inline void __dec_zone_page_state
+ #define dec_zone_page_state __dec_zone_page_state
+ #define mod_zone_page_state __mod_zone_page_state
+
+-static inline void reduce_pgdat_percpu_threshold(pg_data_t *pgdat) { }
+-static inline void restore_pgdat_percpu_threshold(pg_data_t *pgdat) { }
++#define set_pgdat_percpu_threshold(pgdat, callback) { }
+
+ static inline void refresh_cpu_vm_stats(int cpu) { }
+ #endif
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -2448,9 +2448,24 @@ static int kswapd(void *p)
+ */
+ if (!sleeping_prematurely(pgdat, order, remaining)) {
+ trace_mm_vmscan_kswapd_sleep(pgdat->node_id);
+- restore_pgdat_percpu_threshold(pgdat);
++
++ /*
++ * vmstat counters are not perfectly
++ * accurate and the estimated value
++ * for counters such as NR_FREE_PAGES
++ * can deviate from the true value by
++ * nr_online_cpus * threshold. To
++ * avoid the zone watermarks being
++ * breached while under pressure, we
++ * reduce the per-cpu vmstat threshold
++ * while kswapd is awake and restore
++ * them before going back to sleep.
++ */
++ set_pgdat_percpu_threshold(pgdat,
++ calculate_normal_threshold);
+ schedule();
+- reduce_pgdat_percpu_threshold(pgdat);
++ set_pgdat_percpu_threshold(pgdat,
++ calculate_pressure_threshold);
+ } else {
+ if (remaining)
+ count_vm_event(KSWAPD_LOW_WMARK_HIT_QUICKLY);
+--- a/mm/vmstat.c
++++ b/mm/vmstat.c
+@@ -83,7 +83,7 @@ EXPORT_SYMBOL(vm_stat);
+
+ #ifdef CONFIG_SMP
+
+-static int calculate_pressure_threshold(struct zone *zone)
++int calculate_pressure_threshold(struct zone *zone)
+ {
+ int threshold;
+ int watermark_distance;
+@@ -107,7 +107,7 @@ static int calculate_pressure_threshold(
+ return threshold;
+ }
+
+-static int calculate_threshold(struct zone *zone)
++int calculate_normal_threshold(struct zone *zone)
+ {
+ int threshold;
+ int mem; /* memory in 128 MB units */
+@@ -166,7 +166,7 @@ static void refresh_zone_stat_thresholds
+ for_each_populated_zone(zone) {
+ unsigned long max_drift, tolerate_drift;
+
+- threshold = calculate_threshold(zone);
++ threshold = calculate_normal_threshold(zone);
+
+ for_each_online_cpu(cpu)
+ per_cpu_ptr(zone->pageset, cpu)->stat_threshold
+@@ -185,46 +185,24 @@ static void refresh_zone_stat_thresholds
+ }
+ }
+
+-void reduce_pgdat_percpu_threshold(pg_data_t *pgdat)
++void set_pgdat_percpu_threshold(pg_data_t *pgdat,
++ int (*calculate_pressure)(struct zone *))
+ {
+ struct zone *zone;
+ int cpu;
+ int threshold;
+ int i;
+
+- get_online_cpus();
+ for (i = 0; i < pgdat->nr_zones; i++) {
+ zone = &pgdat->node_zones[i];
+ if (!zone->percpu_drift_mark)
+ continue;
+
+- threshold = calculate_pressure_threshold(zone);
+- for_each_online_cpu(cpu)
+- per_cpu_ptr(zone->pageset, cpu)->stat_threshold
+- = threshold;
+- }
+- put_online_cpus();
+-}
+-
+-void restore_pgdat_percpu_threshold(pg_data_t *pgdat)
+-{
+- struct zone *zone;
+- int cpu;
+- int threshold;
+- int i;
+-
+- get_online_cpus();
+- for (i = 0; i < pgdat->nr_zones; i++) {
+- zone = &pgdat->node_zones[i];
+- if (!zone->percpu_drift_mark)
+- continue;
+-
+- threshold = calculate_threshold(zone);
+- for_each_online_cpu(cpu)
++ threshold = (*calculate_pressure)(zone);
++ for_each_possible_cpu(cpu)
+ per_cpu_ptr(zone->pageset, cpu)->stat_threshold
+ = threshold;
+ }
+- put_online_cpus();
+ }
+
+ /*
--- /dev/null
+From 72746ac643928f6c3113b5aa783d8ea1b13949d2 Mon Sep 17 00:00:00 2001
+From: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Date: Mon, 28 Feb 2011 13:41:11 +0900
+Subject: nilfs2: fix regression that i-flag is not set on changeless checkpoints
+
+From: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+
+commit 72746ac643928f6c3113b5aa783d8ea1b13949d2 upstream.
+
+According to the report from Jiro SEKIBA titled "regression in
+2.6.37?" (Message-Id: <8739n8vs1f.wl%jir@sekiba.com>), on 2.6.37 and
+later kernels, lscp command no longer displays "i" flag on checkpoints
+that snapshot operations or garbage collection created.
+
+This is a regression of nilfs2 checkpointing function, and it's
+critical since it broke behavior of a part of nilfs2 applications.
+For instance, snapshot manager of TimeBrowse gets to create
+meaningless snapshots continuously; snapshot creation triggers another
+checkpoint, but applications cannot distinguish whether the new
+checkpoint contains meaningful changes or not without the i-flag.
+
+This patch fixes the regression and brings that application behavior
+back to normal.
+
+Reported-by: Jiro SEKIBA <jir@unicus.jp>
+Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Tested-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
+Tested-by: Jiro SEKIBA <jir@unicus.jp>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nilfs2/segment.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/nilfs2/segment.c
++++ b/fs/nilfs2/segment.c
+@@ -430,7 +430,8 @@ static void nilfs_segctor_begin_finfo(st
+ nilfs_segctor_map_segsum_entry(
+ sci, &sci->sc_binfo_ptr, sizeof(struct nilfs_finfo));
+
+- if (inode->i_sb && !test_bit(NILFS_SC_HAVE_DELTA, &sci->sc_flags))
++ if (NILFS_I(inode)->i_root &&
++ !test_bit(NILFS_SC_HAVE_DELTA, &sci->sc_flags))
+ set_bit(NILFS_SC_HAVE_DELTA, &sci->sc_flags);
+ /* skip finfo */
+ }
--- /dev/null
+From 2b799a6b25bb9f9fbc478782cd9503e8066ab618 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@googlemail.com>
+Date: Sat, 26 Feb 2011 12:58:06 +0100
+Subject: p54usb: add Senao NUB-350 usbid
+
+From: Christian Lamparter <chunkeey@googlemail.com>
+
+commit 2b799a6b25bb9f9fbc478782cd9503e8066ab618 upstream.
+
+Reported-by: Mark Davis
+Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/p54/p54usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/p54/p54usb.c
++++ b/drivers/net/wireless/p54/p54usb.c
+@@ -98,6 +98,7 @@ static struct usb_device_id p54u_table[]
+ {USB_DEVICE(0x1413, 0x5400)}, /* Telsey 802.11g USB2.0 Adapter */
+ {USB_DEVICE(0x1435, 0x0427)}, /* Inventel UR054G */
+ {USB_DEVICE(0x1668, 0x1050)}, /* Actiontec 802UIG-1 */
++ {USB_DEVICE(0x1740, 0x1000)}, /* Senao NUB-350 */
+ {USB_DEVICE(0x2001, 0x3704)}, /* DLink DWL-G122 rev A2 */
+ {USB_DEVICE(0x2001, 0x3705)}, /* D-Link DWL-G120 rev C1 */
+ {USB_DEVICE(0x413c, 0x5513)}, /* Dell WLA3310 USB Wireless Adapter */
--- /dev/null
+From ba04c7c93bbcb48ce880cf75b6e9dffcd79d4c7b Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Tue, 22 Feb 2011 02:00:11 +0000
+Subject: r8169: disable ASPM
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit ba04c7c93bbcb48ce880cf75b6e9dffcd79d4c7b upstream.
+
+For some time is known that ASPM is causing troubles on r8169, i.e. make
+device randomly stop working without any errors in dmesg.
+
+Currently Tomi Leppikangas reports that system with r8169 device hangs
+with MCE errors when ASPM is enabled:
+https://bugzilla.redhat.com/show_bug.cgi?id=642861#c4
+
+Lets disable ASPM for r8169 devices at all, to avoid problems with
+r8169 PCIe devices at least for some users.
+
+Reported-by: Tomi Leppikangas <tomi.leppikangas@gmail.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/r8169.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/r8169.c
++++ b/drivers/net/r8169.c
+@@ -24,6 +24,7 @@
+ #include <linux/init.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/pm_runtime.h>
++#include <linux/pci-aspm.h>
+
+ #include <asm/system.h>
+ #include <asm/io.h>
+@@ -3047,6 +3048,11 @@ rtl8169_init_one(struct pci_dev *pdev, c
+ mii->reg_num_mask = 0x1f;
+ mii->supports_gmii = !!(cfg->features & RTL_FEATURE_GMII);
+
++ /* disable ASPM completely as that cause random device stop working
++ * problems as well as full system hangs for some PCIe devices users */
++ pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1 |
++ PCIE_LINK_STATE_CLKPM);
++
+ /* enable device (incl. PCI PM wakeup and hotplug setup) */
+ rc = pci_enable_device(pdev);
+ if (rc < 0) {
fuse-fix-hang-of-single-threaded-fuseblk-filesystem.patch
clockevents-prevent-oneshot-mode-when-broadcast-device-is-periodic.patch
ext2-fix-link-count-corruption-under-heavy-link-rename-load.patch
+mm-vmstat-use-a-single-setter-function-and-callback-for-adjusting-percpu-thresholds.patch
+e1000e-82579-phy-incorrectly-identified-during-init.patch
+staging-comedi-add-module_license-and-similar-to-ni-modules.patch
+fix-cfg80211_wext_siwfreq-lock-ordering.patch
+tg3-restrict-phy-ioctl-access.patch
+drm-i915-fix-memory-corruption-with-gm965-and-4gb-ram.patch
+blk-throttle-do-not-use-kblockd-workqueue-for-throtl-work.patch
+block-add-force_kblockd-to-__blk_run_queue.patch
+block-blk-flush-shouldn-t-call-directly-into-q-request_fn-__blk_run_queue.patch
+block-kill-loop_mutex.patch
+ath9k_htc-fix-an-endian-issue.patch
+p54usb-add-senao-nub-350-usbid.patch
+nilfs2-fix-regression-that-i-flag-is-not-set-on-changeless-checkpoints.patch
+carl9170-add-airlive-x.usb-a-b-g-n-usbid.patch
+r8169-disable-aspm.patch
+dccp-fix-oops-on-reset-after-close.patch
+e1000e-disable-broken-phy-wakeup-for-ich10-loms-use-mac-wakeup-instead.patch
+dns-fix-a-null-pointer-deref-when-trying-to-read-an-error-key.patch
--- /dev/null
+From 3c323c01b6bd5fd01be21a8f0cdc11e55997aa06 Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Mon, 7 Feb 2011 13:39:52 +0000
+Subject: Staging: comedi: Add MODULE_LICENSE and similar to NI modules
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit 3c323c01b6bd5fd01be21a8f0cdc11e55997aa06 upstream.
+
+As mentioned by W. Trevor King on the devel@linuxdriverproject.org list
+on "Thu, 27 Jan 2011 18:52:15 -0500", "Message-ID:
+<20110127235214.GA5107@thialfi.dhcp.drexel.edu>", the ni_pcimio module
+is missing module metadata, including a license.
+
+This patch adds module metadata to all the NI comedi driver modules. It
+also removes a duplicate MODULE_LICENSE("GPL") line from the "mite"
+module.
+
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Cc: W. Trevor King <wking@drexel.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/comedi/drivers/mite.c | 2 --
+ drivers/staging/comedi/drivers/ni_6527.c | 4 ++++
+ drivers/staging/comedi/drivers/ni_65xx.c | 4 ++++
+ drivers/staging/comedi/drivers/ni_660x.c | 4 ++++
+ drivers/staging/comedi/drivers/ni_670x.c | 4 ++++
+ drivers/staging/comedi/drivers/ni_pcidio.c | 4 ++++
+ drivers/staging/comedi/drivers/ni_pcimio.c | 4 ++++
+ 7 files changed, 24 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/comedi/drivers/mite.c
++++ b/drivers/staging/comedi/drivers/mite.c
+@@ -61,8 +61,6 @@
+ #define PCI_DAQ_SIZE 4096
+ #define PCI_DAQ_SIZE_660X 8192
+
+-MODULE_LICENSE("GPL");
+-
+ struct mite_struct *mite_devices;
+ EXPORT_SYMBOL(mite_devices);
+
+--- a/drivers/staging/comedi/drivers/ni_6527.c
++++ b/drivers/staging/comedi/drivers/ni_6527.c
+@@ -527,3 +527,7 @@ static void __exit driver_ni6527_cleanup
+
+ module_init(driver_ni6527_init_module);
+ module_exit(driver_ni6527_cleanup_module);
++
++MODULE_AUTHOR("Comedi http://www.comedi.org");
++MODULE_DESCRIPTION("Comedi low-level driver");
++MODULE_LICENSE("GPL");
+--- a/drivers/staging/comedi/drivers/ni_65xx.c
++++ b/drivers/staging/comedi/drivers/ni_65xx.c
+@@ -871,3 +871,7 @@ static void __exit driver_ni_65xx_cleanu
+
+ module_init(driver_ni_65xx_init_module);
+ module_exit(driver_ni_65xx_cleanup_module);
++
++MODULE_AUTHOR("Comedi http://www.comedi.org");
++MODULE_DESCRIPTION("Comedi low-level driver");
++MODULE_LICENSE("GPL");
+--- a/drivers/staging/comedi/drivers/ni_660x.c
++++ b/drivers/staging/comedi/drivers/ni_660x.c
+@@ -1421,3 +1421,7 @@ static int ni_660x_dio_insn_config(struc
+ };
+ return 0;
+ }
++
++MODULE_AUTHOR("Comedi http://www.comedi.org");
++MODULE_DESCRIPTION("Comedi low-level driver");
++MODULE_LICENSE("GPL");
+--- a/drivers/staging/comedi/drivers/ni_670x.c
++++ b/drivers/staging/comedi/drivers/ni_670x.c
+@@ -384,3 +384,7 @@ static int ni_670x_find_device(struct co
+ mite_list_devices();
+ return -EIO;
+ }
++
++MODULE_AUTHOR("Comedi http://www.comedi.org");
++MODULE_DESCRIPTION("Comedi low-level driver");
++MODULE_LICENSE("GPL");
+--- a/drivers/staging/comedi/drivers/ni_pcidio.c
++++ b/drivers/staging/comedi/drivers/ni_pcidio.c
+@@ -1354,3 +1354,7 @@ static void __exit driver_pcidio_cleanup
+
+ module_init(driver_pcidio_init_module);
+ module_exit(driver_pcidio_cleanup_module);
++
++MODULE_AUTHOR("Comedi http://www.comedi.org");
++MODULE_DESCRIPTION("Comedi low-level driver");
++MODULE_LICENSE("GPL");
+--- a/drivers/staging/comedi/drivers/ni_pcimio.c
++++ b/drivers/staging/comedi/drivers/ni_pcimio.c
+@@ -1853,3 +1853,7 @@ static int pcimio_dio_change(struct come
+
+ return 0;
+ }
++
++MODULE_AUTHOR("Comedi http://www.comedi.org");
++MODULE_DESCRIPTION("Comedi low-level driver");
++MODULE_LICENSE("GPL");
--- /dev/null
+From ed199facd070f8e551dc16a2ae1baa01d8d28ed4 Mon Sep 17 00:00:00 2001
+From: Matt Carlson <mcarlson@broadcom.com>
+Date: Tue, 15 Feb 2011 12:51:10 +0000
+Subject: tg3: Restrict phy ioctl access
+
+From: Matt Carlson <mcarlson@broadcom.com>
+
+commit ed199facd070f8e551dc16a2ae1baa01d8d28ed4 upstream.
+
+If management firmware is present and the device is down, the firmware
+will assume control of the phy. If a phy access were allowed from the
+host, it will collide with firmware phy accesses, resulting in
+unpredictable behavior. This patch fixes the problem by disallowing phy
+accesses during the problematic condition.
+
+Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
+Reviewed-by: Michael Chan <mchan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/tg3.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/tg3.c
++++ b/drivers/net/tg3.c
+@@ -11165,7 +11165,9 @@ static int tg3_ioctl(struct net_device *
+ if (tp->phy_flags & TG3_PHYFLG_PHY_SERDES)
+ break; /* We have no PHY */
+
+- if (tp->phy_flags & TG3_PHYFLG_IS_LOW_POWER)
++ if ((tp->phy_flags & TG3_PHYFLG_IS_LOW_POWER) ||
++ ((tp->tg3_flags & TG3_FLAG_ENABLE_ASF) &&
++ !netif_running(dev)))
+ return -EAGAIN;
+
+ spin_lock_bh(&tp->lock);
+@@ -11181,7 +11183,9 @@ static int tg3_ioctl(struct net_device *
+ if (tp->phy_flags & TG3_PHYFLG_PHY_SERDES)
+ break; /* We have no PHY */
+
+- if (tp->phy_flags & TG3_PHYFLG_IS_LOW_POWER)
++ if ((tp->phy_flags & TG3_PHYFLG_IS_LOW_POWER) ||
++ ((tp->tg3_flags & TG3_FLAG_ENABLE_ASF) &&
++ !netif_running(dev)))
+ return -EAGAIN;
+
+ spin_lock_bh(&tp->lock);
projects / thirdparty / kernel / stable-queue.git / commitdiff
