Permalink
Commits on Aug 16, 2010
  1. initial overclock commit

    jamespaul11 committed Aug 16, 2010
Commits on Aug 14, 2010
  1. cm: Update defconfig

    cyanogen committed Aug 14, 2010
  2. Linux 2.6.34.4

    gregkh committed with cyanogen Aug 13, 2010
    x86, vmware: Preset lpj values when on VMware.
    
    commit 9f242dc upstream.
    
    When running on VMware's platform, we have seen situations where
    the AP's try to calibrate the lpj values and fail to get good calibration
    runs becasue of timing issues. As a result delays don't work correctly
    on all cpus.
    
    The solutions is to set preset_lpj value based on the current tsc frequency
    value. This is similar to what KVM does as well.
    
    Signed-off-by: Alok N Kataria <akataria@vmware.com>
    LKML-Reference: <1280790637.14933.29.camel@ank32.eng.vmware.com>
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    ata_piix: fix locking around SIDPR access
    
    commit 213373c upstream.
    
    SIDPR window registers are shared across ports and as each access is
    done in two steps, accesses to different ports under EH may race.
    This primarily is caused by incorrect host locking in EH context and
    should be fixed by defining locking requirements for each EH operation
    which can be used during EH and enforcing them but for now work around
    the problem by adding a dedicated SIDPR lock and grabbing it for each
    SIDPR access.
    
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Reported-by: Mark Knecht <markknecht@gmail.com>
    Reported-by: Paul Check <paul@thechecks.ca>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    powerpc: fix build with make 3.82
    
    commit e32e78c upstream.
    
    Thomas Backlund reported that the powerpc build broke with make 3.82.
    It failed with the following message:
    
        arch/powerpc/Makefile:183: *** mixed implicit and normal rules.  Stop.
    
    The fix is to avoid mixing non-wildcard and wildcard targets.
    
    Reported-by: Thomas Backlund <tmb@mandriva.org>
    Tested-by: Thomas Backlund <tmb@mandriva.org>
    Cc: Michal Marek <mmarek@suse.cz>
    Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    x86, kmmio/mmiotrace: Fix double free of kmmio_fault_pages
    
    commit 8b8f79b upstream.
    
    After every iounmap mmiotrace has to free kmmio_fault_pages, but
    it can't do it directly, so it defers freeing by RCU.
    
    It usually works, but when mmiotraced code calls ioremap-iounmap
    multiple times without sleeping between (so RCU won't kick in
    and start freeing) it can be given the same virtual address, so
    at every iounmap mmiotrace will schedule the same pages for
    release. Obviously it will explode on second free.
    
    Fix it by marking kmmio_fault_pages which are scheduled for
    release and not adding them second time.
    
    Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
    Tested-by: Marcin Kocielnicki <koriakin@0x04.net>
    Tested-by: Shinpei KATO <shinpei@il.is.s.u-tokyo.ac.jp>
    Acked-by: Pekka Paalanen <pq@iki.fi>
    Cc: Stuart Bennett <stuart@freedesktop.org>
    Cc: Marcin Kocielnicki <koriakin@0x04.net>
    Cc: nouveau@lists.freedesktop.org
    LKML-Reference: <20100613215654.GA3829@joi.lan>
    Signed-off-by: Ingo Molnar <mingo@elte.hu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    x86/PCI: use host bridge _CRS info on ASRock ALiveSATA2-GLAN
    
    commit 2491762 upstream.
    
    This DMI quirk turns on "pci=use_crs" for the ALiveSATA2-GLAN because
    amd_bus.c doesn't handle this system correctly.
    
    The system has a single HyperTransport I/O chain, but has two PCI host
    bridges to buses 00 and 80.  amd_bus.c learns the MMIO range associated
    with buses 00-ff and that this range is routed to the HT chain hosted at
    node 0, link 0:
    
        bus: [00, ff] on node 0 link 0
        bus: 00 index 1 [mem 0x80000000-0xfcffffffff]
    
    This includes the address space for both bus 00 and bus 80, and amd_bus.c
    assumes it's all routed to bus 00.
    
    We find device 80:01.0, which BIOS left in the middle of that space, but
    we don't find a bridge from bus 00 to bus 80, so we conclude that 80:01.0
    is unreachable from bus 00, and we move it from the original, working,
    address to something outside the bus 00 aperture, which does not work:
    
        pci 0000:80:01.0: reg 10: [mem 0xfebfc000-0xfebfffff 64bit]
        pci 0000:80:01.0: BAR 0: assigned [mem 0xfd00000000-0xfd00003fff 64bit]
    
    The BIOS told us everything we need to know to handle this correctly,
    so we're better off if we just pay attention, which lets us leave the
    80:01.0 device at the original, working, address:
    
        ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-7f])
        pci_root PNP0A03:00: host bridge window [mem 0x80000000-0xff37ffff]
        ACPI: PCI Root Bridge [PCI1] (domain 0000 [bus 80-ff])
        pci_root PNP0A08:00: host bridge window [mem 0xfebfc000-0xfebfffff]
    
    This was a regression between 2.6.33 and 2.6.34.  In 2.6.33, amd_bus.c
    was used only when we found multiple HT chains.  3e3da00, which
    enabled amd_bus.c even on systems with a single HT chain, caused this
    failure.
    
    This quirk was written by Graham.  If we ever enable "pci=use_crs" for
    machines from 2006 or earlir, this quirk should be removed.
    
    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=16007
    
    Reported-by: Graham Ramsey <ramsey.graham@ntlworld.com>
    Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
    Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    x86: Add memory modify constraints to xchg() and cmpxchg()
    
    commit 113fc5a upstream.
    
    xchg() and cmpxchg() modify their memory operands, not merely read
    them.  For some versions of gcc the "memory" clobber has apparently
    dealt with the situation, but not for all.
    
    Originally-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: H. Peter Anvin <hpa@zytor.com>
    Cc: Glauber Costa <glommer@redhat.com>
    Cc: Avi Kivity <avi@redhat.com>
    Cc: Peter Palfrader <peter@palfrader.org>
    Cc: Greg KH <gregkh@suse.de>
    Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
    Cc: Zachary Amsden <zamsden@redhat.com>
    Cc: Marcelo Tosatti <mtosatti@redhat.com>
    LKML-Reference: <4C4F7277.8050306@zytor.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    staging: rt2870: Add USB ID for Belkin F6D4050 v2
    
    commit 5d92fe3 upstream.
    
    Device missing from current tables.
    
    Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
    Tested-by: Rod Huffaker <rod.huffaker@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    Staging: line6: needs to select SND_PCM
    
    commit e928c07 upstream.
    
    line6 uses snd_pcm*() functions, so it should select SND_PCM.
    
    ERROR: "snd_pcm_period_elapsed" [drivers/staging/line6/line6usb.ko] undefined!
    ERROR: "snd_pcm_set_ops" [drivers/staging/line6/line6usb.ko] undefined!
    ERROR: "snd_pcm_lib_free_pages" [drivers/staging/line6/line6usb.ko] undefined!
    ERROR: "snd_pcm_lib_ioctl" [drivers/staging/line6/line6usb.ko] undefined!
    ERROR: "snd_pcm_lib_malloc_pages" [drivers/staging/line6/line6usb.ko] undefined!
    ERROR: "snd_pcm_hw_constraint_ratdens" [drivers/staging/line6/line6usb.ko] undefined!
    ERROR: "snd_pcm_format_physical_width" [drivers/staging/line6/line6usb.ko] undefined!
    ERROR: "snd_pcm_lib_preallocate_pages_for_all" [drivers/staging/line6/line6usb.ko] undefined!
    ERROR: "snd_pcm_new" [drivers/staging/line6/line6usb.ko] undefined!
    
    Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
    Cc: Markus Grabner <grabner@icg.tugraz.at>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    Staging: panel: Prevent double-calling of parport_release - fix oops.
    
    commit 060132a upstream.
    
    This patch prevents the code from calling parport_release and
    parport_unregister_device twice with the same arguments - and thus fixes an oops.
    
    Rationale:
    After the first call the parport is already released and the
    handle isn't valid anymore and calling parport_release and
    parport_unregister_device twice isn't a good idea.
    
    Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
    Acked-by: Willy Tarreau <w@1wt.eu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    PCI: Do not run NVidia quirks related to MSI with MSI disabled
    
    commit 3d2a531 upstream.
    
    There is no reason to run NVidia-specific quirks related to HT MSI
    mappings with MSI disabled via pci=nomsi, so make
    __nv_msi_ht_cap_quirk() return immediately in that case.
    
    This allows at least one machine to boot 100% of the time with
    pci=nomsi (it still doesn't boot reliably without that).
    
    Addresses https://bugzilla.kernel.org/show_bug.cgi?id=16443 .
    
    Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
    Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    PCI: disable MSI on VIA K8M800
    
    commit 549e156 upstream.
    
    MSI delivery from on-board ahci controller doesn't work on K8M800.  At
    this point, it's unclear whether the culprit is with the ahci
    controller or the host bridge.  Given the track record and considering
    the rather minimal impact of MSI, disabling it seems reasonable.
    
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Reported-by: Rainer Hurtado Navarro <publio.escipion.el.africano@gmail.com>
    Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    solos-pci: Fix race condition in tasklet RX handling
    
    commit 1f6ea6e upstream.
    
    We were seeing faults in the solos-pci receive tasklet when packets
    arrived for a VCC which was currently being closed:
    
    [18842.727906] EIP: [<e082f490>] br2684_push+0x19/0x234 [br2684] SS:ESP 0068:dfb89d14
    
    [18845.090712] [<c13ecff3>] ? do_page_fault+0x0/0x2e1
    [18845.120042] [<e082f490>] ? br2684_push+0x19/0x234 [br2684]
    [18845.153530] [<e084fa13>] solos_bh+0x28b/0x7c8 [solos_pci]
    [18845.186488] [<e084f711>] ? solos_irq+0x2d/0x51 [solos_pci]
    [18845.219960] [<c100387b>] ? handle_irq+0x3b/0x48
    [18845.247732] [<c10265cb>] ? irq_exit+0x34/0x57
    [18845.274437] [<c1025720>] tasklet_action+0x42/0x69
    [18845.303247] [<c102643f>] __do_softirq+0x8e/0x129
    [18845.331540] [<c10264ff>] do_softirq+0x25/0x2a
    [18845.358274] [<c102664c>] _local_bh_enable_ip+0x5e/0x6a
    [18845.389677] [<c102666d>] local_bh_enable+0xb/0xe
    [18845.417944] [<e08490a8>] ppp_unregister_channel+0x32/0xbb [ppp_generic]
    [18845.458193] [<e08731ad>] pppox_unbind_sock+0x18/0x1f [pppox]
    
    This patch uses an RCU-inspired approach to fix it. In the RX tasklet's
    find_vcc() function we first refuse to use a VCC which already has the
    ATM_VF_READY bit cleared. And in the VCC close function, we synchronise
    with the tasklet to ensure that it can't still be using the VCC before
    we continue and allow the VCC to be destroyed.
    
    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
    Tested-by: Nathan Williams <nathan@traverse.com.au>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    splice: fix misuse of SPLICE_F_NONBLOCK
    
    commit 6965031 upstream.
    
    SPLICE_F_NONBLOCK is clearly documented to only affect blocking on the
    pipe.  In __generic_file_splice_read(), however, it causes an EAGAIN
    if the page is currently being read.
    
    This makes it impossible to write an application that only wants
    failure if the pipe is full.  For example if the same process is
    handling both ends of a pipe and isn't otherwise able to determine
    whether a splice to the pipe will fill it or not.
    
    We could make the read non-blocking on O_NONBLOCK or some other splice
    flag, but for now this is the simplest fix.
    
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
    Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    Char: nozomi, fix tty->count counting
    
    commit ee78bb9 upstream.
    
    Currently ntty_install omits to increment tty count and we get the
    following warnings:
    Warning: dev (noz2) tty->count(0) != #fd's(1) in tty_open
    
    So to fix that, add one tty->count++ there.
    
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    Cc: Alan Cox <alan@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    Char: nozomi, set tty->driver_data appropriately
    
    commit bf9c1fc upstream.
    
    Sorry, one more fix, this one depends on the other, so this is rather 2/2.
    --
    
    tty->driver_data is used all over the code, but never set. This
    results in oopses like:
    BUG: unable to handle kernel NULL pointer dereference at 0000000000000130
    IP: [<ffffffff814a0040>] mutex_lock+0x10/0x40
    ...
    Pid: 2157, comm: modem-manager Not tainted 2.6.34.1-0.1-desktop #1 2768DR7/2768DR7
    RIP: 0010:[<ffffffff814a0040>]  [<ffffffff814a0040>] mutex_lock+0x10/0x40
    RSP: 0018:ffff88007b16fa50  EFLAGS: 00010286
    RAX: 0000000000000000 RBX: 0000000000000130 RCX: 0000000000000003
    RDX: 0000000000000003 RSI: 0000000000000286 RDI: 0000000000000130
    RBP: 0000000000001000 R08: 0000000000000000 R09: 0000000000000000
    R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000130
    R13: 0000000000000001 R14: 0000000000000000 R15: ffff88007b16feb4
    ...
    Call Trace:
     [<ffffffffa077690d>] ntty_write_room+0x4d/0x90 [nozomi]
    ...
    
    Set tty->driver_data to the computed port in .install to not recompute it in
    every place where needed. Switch .open to use driver_data too.
    
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    Cc: Alan Cox <alan@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    mm: fix corruption of hibernation caused by reusing swap during image saving
    
    commit 966cca0 upstream.
    
    Since 2.6.31, swap_map[]'s refcounting was changed to show that a used
    swap entry is just for swap-cache, can be reused.  Then, while scanning
    free entry in swap_map[], a swap entry may be able to be reclaimed and
    reused.  It was caused by commit c9e4441 ("mm: reuse unused swap
    entry if necessary").
    
    But this caused deta corruption at resume. The scenario is
    
    - Assume a clean-swap cache, but mapped.
    
    - at hibernation_snapshot[], clean-swap-cache is saved as
      clean-swap-cache and swap_map[] is marked as SWAP_HAS_CACHE.
    
    - then, save_image() is called.  And reuse SWAP_HAS_CACHE entry to save
      image, and break the contents.
    
    After resume:
    
    - the memory reclaim runs and finds clean-not-referenced-swap-cache and
      discards it because it's marked as clean.  But here, the contents on
      disk and swap-cache is inconsistent.
    
    Hance memory is corrupted.
    
    This patch avoids the bug by not reclaiming swap-entry during hibernation.
    This is a quick fix for backporting.
    
    Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
    Cc: Rafael J. Wysocki <rjw@sisk.pl>
    Reported-by: Ondreg Zary <linux@rainbow-software.org>
    Tested-by: Ondreg Zary <linux@rainbow-software.org>
    Tested-by: Andrea Gelmini <andrea.gelmini@gmail.com>
    Acked-by: Hugh Dickins <hughd@google.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    drivers/video/w100fb.c: ignore void return value / fix build failure
    
    commit fa260c0 upstream.
    
    Fix a build failure "error: void value not ignored as it ought to be"
    by removing an assignment of a void return value.  The functionality of
    the code is not changed.
    
    Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
    Acked-by: Henrik Kretzschmar <henne@nachtwindheim.de>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    iwlwifi: fix TX tracer
    
    commit e95b743 upstream.
    
    The TX tracing code copies with the wrong length,
    which will typically copy too little data. Fix
    this by using the correct length variable.
    
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    ide-cd: Do not access completed requests in the irq handler
    
    commit 1107128 upstream.
    
    ide_cd_error_cmd() can complete an erroneous request with leftover
    buffers. Signal this with its return value so that the request is not
    accessed after its completion in the irq handler and we oops.
    
    Signed-off-by: Borislav Petkov <bp@alien8.de>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    md/raid10: fix deadlock with unaligned read during resync
    
    commit 51e9ac7 upstream.
    
    If the 'bio_split' path in raid10-read is used while
    resync/recovery is happening it is possible to deadlock.
    Fix this be elevating ->nr_waiting for the duration of both
    parts of the split request.
    
    This fixes a bug that has been present since 2.6.22
    but has only started manifesting recently for unknown reasons.
    It is suitable for and -stable since then.
    
    Reported-by:  Justin Bronder <jsbronder@gentoo.org>
    Tested-by:  Justin Bronder <jsbronder@gentoo.org>
    Signed-off-by: NeilBrown <neilb@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    blkdev: cgroup whitelist permission fix
    
    commit b7300b7 upstream.
    
    The cgroup device whitelist code gets confused when trying to grant
    permission to a disk partition that is not currently open.  Part of
    blkdev_open() includes __blkdev_get() on the whole disk.
    
    Basically, the only ways to reliably allow a cgroup access to a partition
    on a block device when using the whitelist are to 1) also give it access
    to the whole block device or 2) make sure the partition is already open in
    a different context.
    
    The patch avoids the cgroup check for the whole disk case when opening a
    partition.
    
    Addresses https://bugzilla.redhat.com/show_bug.cgi?id=589662
    
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>
    Acked-by: Serge E. Hallyn <serue@us.ibm.com>
    Tested-by: Serge E. Hallyn <serue@us.ibm.com>
    Reported-by: Vivek Goyal <vgoyal@redhat.com>
    Cc: Al Viro <viro@ZenIV.linux.org.uk>
    Cc: Christoph Hellwig <hch@infradead.org>
    Cc: "Daniel P. Berrange" <berrange@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    eCryptfs: Handle ioctl calls with unlocked and compat functions
    
    commit c43f7b8 upstream.
    
    Lower filesystems that only implemented unlocked_ioctl weren't being
    passed ioctl calls because eCryptfs only checked for
    lower_file->f_op->ioctl and returned -ENOTTY if it was NULL.
    
    eCryptfs shouldn't implement ioctl(), since it doesn't require the BKL.
    This patch introduces ecryptfs_unlocked_ioctl() and
    ecryptfs_compat_ioctl(), which passes the calls on to the lower file
    system.
    
    https://bugs.launchpad.net/ecryptfs/+bug/469664
    
    Reported-by: James Dupin <james.dupin@gmail.com>
    Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    ecryptfs: release reference to lower mount if interpose fails
    
    commit 31f73be upstream.
    
    In ecryptfs_lookup_and_interpose_lower() the lower mount is not decremented
    if allocation of a dentry info struct failed. As a result the lower filesystem
    cant be unmounted any more (since it is considered busy). This patch corrects
    the reference counting.
    
    Signed-off-by: Lino Sanfilippo <LinoSanfilippo@gmx.de>
    Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    fs/ecryptfs/file.c: introduce missing free
    
    commit ceeab92 upstream.
    
    The comments in the code indicate that file_info should be released if the
    function fails.  This releasing is done at the label out_free, not out.
    
    The semantic match that finds this problem is as follows:
    (http://www.emn.fr/x-info/coccinelle/)
    
    // <smpl>
    @r exists@
    local idexpression x;
    statement S;
    expression E;
    identifier f,f1,l;
    position p1,p2;
    expression *ptr != NULL;
    @@
    
    x@p1 = kmem_cache_zalloc(...);
    ...
    if (x == NULL) S
    <... when != x
         when != if (...) { <+...x...+> }
    (
    x->f1 = E
    |
     (x->f1 == NULL || ...)
    |
     f(...,x->f1,...)
    )
    ...>
    (
     return <+...x...+>;
    |
     return@p2 ...;
    )
    
    @script:python@
    p1 << r.p1;
    p2 << r.p2;
    @@
    
    print "* file: %s kmem_cache_zalloc %s" % (p1[0].file,p1[0].line)
    // </smpl>
    
    Signed-off-by: Julia Lawall <julia@diku.dk>
    Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    pxa/cm-x300: fix ffuart registration
    
    commit a6cd7eb upstream.
    
    ffuart is available on cm-x300 only with pxa300.
    
    Signed-off-by: Igor Grinberg <grinberg@compulab.co.il>
    Signed-off-by: Eric Miao <eric.y.miao@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    signalfd: fill in ssi_int for posix timers and message queues
    
    commit a2a20c4 upstream.
    
    If signalfd is used to consume a signal generated by a POSIX interval
    timer or POSIX message queue, the ssi_int field does not reflect the data
    (sigevent->sigev_value) supplied to timer_create(2) or mq_notify(3).  (The
    ssi_ptr field, however, is filled in.)
    
    This behavior differs from signalfd's treatment of sigqueue-generated
    signals -- see the default case in signalfd_copyinfo.  It also gives
    results that differ from the case when a signal is handled conventionally
    via a sigaction-registered handler.
    
    So, set signalfd_siginfo->ssi_int in the remaining cases (__SI_TIMER,
    __SI_MESGQ) where ssi_ptr is set.
    
    akpm: a non-back-compatible change.  Merge into -stable to minimise the
    number of kernels which are in the field and which miss this feature.
    
    Signed-off-by: Nathan Lynch <ntl@pobox.com>
    Acked-by: Davide Libenzi <davidel@xmailserver.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    bio, fs: update RWA_MASK, READA and SWRITE to match the corresponding BIO_RW_* bits
    
    commit aca27ba upstream.
    
    Commit a82afdf (block: use the same failfast bits for bio and request)
    moved BIO_RW_* bits around such that they match up with REQ_* bits.
    Unfortunately, fs.h hard coded RW_MASK, RWA_MASK, READ, WRITE, READA
    and SWRITE as 0, 1, 2 and 3, and expected them to match with BIO_RW_*
    bits.  READ/WRITE didn't change but BIO_RW_AHEAD was moved to bit 4
    instead of bit 1, breaking RWA_MASK, READA and SWRITE.
    
    This patch updates RWA_MASK, READA and SWRITE such that they match the
    BIO_RW_* bits again.  A follow up patch will update the definitions to
    directly use BIO_RW_* bits so that this kind of breakage won't happen
    again.
    
    Neil also spotted missing RWA_MASK conversion.
    
    Stable: The offending commit a82afdf was released with v2.6.32, so
    this patch should be applied to all kernels since then but it must
    _NOT_ be applied to kernels earlier than that.
    
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Reported-and-bisected-by: Vladislav Bolkhovitin <vst@vlnb.net>
    Root-caused-by: Neil Brown <neilb@suse.de>
    Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    smsc911x: Add spinlocks around registers access
    
    commit 492c5d9 upstream.
    
    On SMP systems, the SMSC911x registers may be accessed by multiple CPUs
    and this seems to put the chip in an inconsistent state. The patch adds
    spinlocks to the smsc911x_reg_read, smsc911x_reg_write,
    smsc911x_rx_readfifo and smsc911x_tx_writefifo functions.
    
    Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    ARM: 6299/1: errata: TLBIASIDIS and TLBIMVAIS operations can broadcast a faulty ASID
    
    commit cdf357f upstream.
    
    On versions of the Cortex-A9 prior to r2p0, performing TLB invalidations by
    ASID match can result in the incorrect ASID being broadcast to other CPUs.
    As a consequence of this, the targetted TLB entries are not invalidated
    across the system.
    
    This workaround changes the TLB flushing routines to invalidate entries
    regardless of the ASID.
    
    Tested-by: Rob Clark <rob@ti.com>
    Acked-by: Catalin Marinas <catalin.marinas@arm.com>
    Signed-off-by: Will Deacon <will.deacon@arm.com>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    ARM: 6280/1: imx: Fix build failure when including <mach/gpio.h> without <linux/spinlock.h>
    
    commit 868003c upstream.
    
    This is a follow up to
    
    	14cb0de (arm/imx/gpio: add spinlock protection)
    
    and fixes the following build failure:
    
    	  CC      arch/arm/mach-imx/pcm970-baseboard.o
    	In file included from arch/arm/include/asm/gpio.h:6,
    			 from include/linux/gpio.h:8,
    			 from arch/arm/mach-imx/pcm970-baseboard.c:20:
    	arch/arm/plat-mxc/include/mach/gpio.h:40: error: expected specifier-qualifier-list before 'spinlock_t'
    
    Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    
    USB: EHCI: remove PCI assumption
    
    commit ae68a83 upstream.
    
    This patch (as1405) fixes a small bug in ehci-hcd's isochronous
    scheduler.  Not all EHCI controllers are PCI, and the code shouldn't
    assume that they are.  Instead, introduce a special flag for
    controllers which need to delay iso scheduling for full-speed devices
    beyond the scheduling threshold.
    
    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    CC: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    CC: David Brownell <david-b@pacbell.net>
    Acked-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    USB: resizing usbmon binary interface buffer causes protection faults
    
    commit 33d973a upstream.
    
    Enlarging the buffer size via the MON_IOCT_RING_SIZE ioctl causes
    general protection faults. It appears the culprit is an incorrect
    argument to mon_free_buff: instead of passing the size of the current
    buffer being freed, the size of the new buffer is passed.
    
    Use the correct size argument to mon_free_buff when changing the size of
    the buffer.
    
    Signed-off-by: Steven Robertson <steven@strobe.cc>
    Acked-by: Pete Zaitcev <zaitcev@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    USB delay init quirk for logitech Harmony 700-series devices
    
    commit 93362a8 upstream.
    
    The Logitech Harmony 700 series needs an extra delay during
    initialization.  This patch adds a USB quirk which enables such a delay
    and adds the device to the quirks list.
    
    Signed-off-by: Phil Dibowitz <phil@ipom.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    USB: serial: enabling support for Segway RMP in ftdi_sio
    
    commit afad196 upstream.
    
    I have added the ProductID=0xe729 VendorID=FTDI_VID=0x0403 which will
    enable support for the Segway Robotic Mobility Platform (RMP200) in the
    ftdi_sio kernel module.  Currently, users of the Segway RMP200 must use
    a RUN+="/sbin/modprobe -q ftdi-sio product=0xe729 vendor=0x0403 in a
    udev rule to get the ftdi_sio module to handle the usb interface and
    mount it on /dev/ttyXXX.  This is not a good solution because some users
    will have multiple USB to Serial converters which will use the ftdi_sio
    module.
    
    Signed-off-by: John Rogers <jgrogers@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    USB: option: Huawei ETS 1220 support added
    
    commit b972302 upstream.
    
    The patch adds Huawei ETS 1220 product id into the list of supported
    devices in 'option' usb serial driver.
    
    Signed-off-by: Pavel Kazlou <p.i.kazlou@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    USB: option: add huawei k3765 k4505 devices to work properly
    
    commit 0372a75 upstream.
    
    This patch adds the product IDs of Huawei's K3765 and K4505 mobile
    broadband usb modems to option.c. It also adds a quirk to the option
    probe function so that binding to the device's network interface(class
    0xff) is avoided. This is necessary to allow another driver to bind to
    that, and to avoid programs like wvdial opening a nonfunctioning tty
    during modem discovery.
    
    Signed-off-by: Andrew Bird <ajb@spheresystems.co.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    USB: ftdi_sio: device id for Navitator
    
    commit b6180ef upstream.
    
    This patch is to add a US Interface, Inc. "Navigator" USB device.
    Specifically, it's a HAM Radio USB sound modem that also
    incorporates three pairs of unique FTDI serial ports.  The standard
    Linux FTDI serial driver will only recognize the first two serial
    ports of an unknown FDTI derived device and this patch adds in
    recognition to these specific new IDs.
    
    Signed-off-by: David A. Ranch <dranch@trinnet.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    USB: cp210x: Add four new device IDs
    
    commit 356c5a4 upstream.
    
    Signed-off-by: Alessio Igor Bogani <abogani@texware.it>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    USB: usbtest: avoid to free coherent buffer in atomic context
    
    commit e10e1be upstream.
    
    This patch fixes the warning below:
    [30753.755998] ------------[ cut here ]------------
    [30753.755998] WARNING: at /home/tom/git/linux-2.6/linux-2.6-next/arch/x86/include/asm/dma-mapping.h:155 hcd_buffer_free+0xb1/0xd4 [usbcore]()
    [30753.755998] Hardware name: 6475EK2
    [30753.755998] Modules linked in: uvcvideo ehci_hcd usbtest cdc_ether usbnet vfat fat usb_storage nfsd lockd nfs_acl auth_rpcgss exportfs mii tun videodev v4l1_compat v4l2_compat_ioctl32 fuse bridge stp llc sunrpc ipv6 cpufreq_ondemand acpi_cpufreq freq_table mperf kvm_intel kvm arc4 ecb ath5k usbhid mac80211 snd_hda_codec_conexant ch341 usbserial ath cfg80211 thinkpad_acpi snd_hda_intel pcspkr wmi hwmon yenta_socket iTCO_wdt iTCO_vendor_support i2c_i801 e1000e snd_hda_codec snd_hwdep snd_pcm snd_timer snd soundcore snd_page_alloc pata_acpi uhci_hcd ohci_hcd usbcore i915 drm_kms_helper drm i2c_algo_bit i2c_core video output [last unloaded: uvcvideo]
    [30753.755998] Pid: 0, comm: swapper Tainted: G        W   2.6.35-rc6-gkh-wl+ #49
    [30753.755998] Call Trace:
    [30753.755998]  <IRQ>  [<ffffffff8104478a>] warn_slowpath_common+0x80/0x98
    [30753.755998]  [<ffffffff810447b7>] warn_slowpath_null+0x15/0x17
    [30753.755998]  [<ffffffffa00ce02d>] hcd_buffer_free+0xb1/0xd4 [usbcore]
    [30753.755998]  [<ffffffffa00c1345>] usb_free_coherent+0x1c/0x1e [usbcore]
    [30753.755998]  [<ffffffffa00b13e4>] simple_free_urb+0x23/0x2f [usbtest]
    [30753.755998]  [<ffffffffa00b210b>] iso_callback+0xbb/0x10f [usbtest]
    [30753.755998]  [<ffffffffa00c7390>] usb_hcd_giveback_urb+0x8c/0xc0 [usbcore]
    [30753.755998]  [<ffffffffa0449b35>] ehci_urb_done+0x84/0x95 [ehci_hcd]
    [30753.755998]  [<ffffffffa044b5a5>] ehci_work+0x41a/0x7dd [ehci_hcd]
    [30753.755998]  [<ffffffffa044e298>] ehci_irq+0x33b/0x370 [ehci_hcd]
    [30753.755998]  [<ffffffff8100fb05>] ? sched_clock+0x9/0xd
    [30753.755998]  [<ffffffff8105e641>] ? sched_clock_local+0x1c/0x82
    [30753.755998]  [<ffffffff8105e76a>] ? sched_clock_cpu+0xc3/0xce
    [30753.755998]  [<ffffffff81067c7e>] ? trace_hardirqs_off+0xd/0xf
    [30753.755998]  [<ffffffff8105e7b8>] ? cpu_clock+0x43/0x5e
    [30753.755998]  [<ffffffffa00c6999>] usb_hcd_irq+0x45/0xa1 [usbcore]
    [30753.755998]  [<ffffffff81092e02>] handle_IRQ_event+0x20/0xa5
    [30753.755998]  [<ffffffff81094cea>] handle_fasteoi_irq+0x92/0xd2
    [30753.755998]  [<ffffffff8100c0ed>] handle_irq+0x1f/0x2a
    [30753.755998]  [<ffffffff8100b75d>] do_IRQ+0x57/0xbe
    [30753.755998]  [<ffffffff8136a693>] ret_from_intr+0x0/0x16
    [30753.755998]  <EOI>  [<ffffffff81223baa>] ? acpi_idle_enter_bm+0x231/0x269
    [30753.755998]  [<ffffffff81223ba3>] ? acpi_idle_enter_bm+0x22a/0x269
    [30753.755998]  [<ffffffff812c4b6b>] cpuidle_idle_call+0x99/0xce
    [30753.755998]  [<ffffffff81008dd5>] cpu_idle+0x61/0xaa
    [30753.755998]  [<ffffffff8136374b>] start_secondary+0x1c2/0x1c6
    [30753.755998] ---[ end trace 904cfaf7ab4cb1a2 ]---
    
    Signed-off-by: Ming Lei <tom.leiming@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    USB: fix thread-unsafe anchor utiliy routines
    
    commit b3e6704 upstream.
    
    This patch fixes a race condition in two utility routines
    related to the removal/unlinking of urbs from an anchor.
    
    If two threads are concurrently accessing the same anchor,
    both could end up with the same urb - thinking they are
    the exclusive owner.
    
    Alan Stern pointed out a related issue in
    usb_unlink_anchored_urbs:
    
    "The URB isn't removed from the anchor until it completes
     (as a by-product of completion, in fact), which might not
     be for quite some time after the unlink call returns.
     In the meantime, the subroutine will keep trying to unlink
     it, over and over again."
    
    Cc: Oliver Neukum <oneukum@suse.de>
    Cc: Greg Kroah-Hartman <greg@kroah.com>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    drm/edid: Fix the HDTV hack sync adjustment
    
    commit a4967de upstream.
    
    We're adjusting horizontal timings only here, moving vsync was just a
    slavish translation of a typo in the X server.
    
    Signed-off-by: Adam Jackson <ajax@redhat.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    Bluetooth: Added support for controller shipped with iMac i5
    
    commit 0a79f67 upstream.
    
    Device class is ff(vend.) instead of e0(wlcon).
    
    Output from command `usb-devices`:
    T:  Bus=01 Lev=03 Prnt=03 Port=00 Cnt=01 Dev#=  6 Spd=12  MxCh= 0
    D:  Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=05ac ProdID=8215 Rev=01.82
    S:  Manufacturer=Apple Inc.
    S:  Product=Bluetooth USB Host Controller
    S:  SerialNumber=7C6D62936607
    C:  #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA
    I:  If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    I:  If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    I:  If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=00 Driver=(none)
    
    Signed-off-by: Cyril Lacoux <clacoux@ifeelgood.org>
    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    mtd: gen_nand: fix support for multiple chips
    
    commit 81cbb0b upstream.
    
    This patch corrects a problem where gen_nand driver assumed there can be only
    one chip and ignored the pdata->chip.nr_chips value.
    
    Signed-off-by: Marek Vasut <marek.vasut@gmail.com>
    Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    jfs: don't allow os2 xattr namespace overlap with others
    
    commit aca0fa3 upstream.
    
    It's currently possible to bypass xattr namespace access rules by
    prefixing valid xattr names with "os2.", since the os2 namespace stores
    extended attributes in a legacy format with no prefix.
    
    This patch adds checking to deny access to any valid namespace prefix
    following "os2.".
    
    Signed-off-by: Dave Kleikamp <shaggy@linux.vnet.ibm.com>
    Reported-by: Sergey Vlasov <vsu@altlinux.ru>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    arp_notify: allow drivers to explicitly request a notification event.
    
    commit 06c4648 upstream.
    
    Currently such notifications are only generated when the device comes up or the
    address changes. However one use case for these notifications is to enable
    faster network recovery after a virtual machine migration (by causing switches
    to relearn their MAC tables). A migration appears to the network stack as a
    temporary loss of carrier and therefore does not trigger either of the current
    conditions. Rather than adding carrier up as a trigger (which can cause issues
    when interfaces a flapping) simply add an interface which the driver can use
    to explicitly trigger the notification.
    
    Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
    Cc: Stephen Hemminger <shemminger@linux-foundation.org>
    Cc: Jeremy Fitzhardinge <jeremy@goop.org>
    Cc: David S. Miller <davem@davemloft.net>
    Cc: netdev@vger.kernel.org
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    xen: netfront: explicitly generate arp_notify event after migration.
    
    commit 5929706 upstream.
    
    Use newly introduced netif_notify_peers() method to ensure a gratuitous ARP is
    generated after a migration.
    
    Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
    Cc: Stephen Hemminger <shemminger@linux-foundation.org>
    Cc: Jeremy Fitzhardinge <jeremy@goop.org>
    Cc: David S. Miller <davem@davemloft.net>
    Cc: netdev@vger.kernel.org
    Cc: xen-devel@lists.xensource.com
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    net: Fix NETDEV_NOTIFY_PEERS to not conflict with NETDEV_BONDING_DESLAVE.
    
    commit 38117d1 upstream.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    irq: Add new IRQ flag IRQF_NO_SUSPEND
    
    commit 685fd0b upstream.
    
    A small number of users of IRQF_TIMER are using it for the implied no
    suspend behaviour on interrupts which are not timer interrupts.
    
    Therefore add a new IRQF_NO_SUSPEND flag, rename IRQF_TIMER to
    __IRQF_TIMER and redefine IRQF_TIMER in terms of these new flags.
    
    Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
    Cc: Jeremy Fitzhardinge <jeremy@goop.org>
    Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Cc: Paul Mackerras <paulus@samba.org>
    Cc: Grant Likely <grant.likely@secretlab.ca>
    Cc: xen-devel@lists.xensource.com
    Cc: linux-input@vger.kernel.org
    Cc: linuxppc-dev@ozlabs.org
    Cc: devicetree-discuss@lists.ozlabs.org
    LKML-Reference: <1280398595-29708-1-git-send-email-ian.campbell@citrix.com>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    xen: Do not suspend IPI IRQs.
    
    commit 4877c73 upstream.
    
    In general the semantics of IPIs are that they are are expected to
    continue functioning after dpm_suspend_noirq().
    
    Specifically I have seen a deadlock between the callfunc IPI and the
    stop machine used by xen's do_suspend() routine. If one CPU has already
    called dpm_suspend_noirq() then there is a window where it can be sent
    a callfunc IPI before all the other CPUs have entered stop_cpu().
    
    If this happens then the first CPU ends up spinning in stop_cpu()
    waiting for the other to rendezvous in state STOPMACHINE_PREPARE while
    the other is spinning in csd_lock_wait().
    
    Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
    Cc: Jeremy Fitzhardinge <jeremy@goop.org>
    Cc: xen-devel@lists.xensource.com
    LKML-Reference: <1280398595-29708-4-git-send-email-ian.campbell@citrix.com>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    drm/i915: Use RSEN instead of HTPLG for tfp410 monitor detection.
    
    commit f458823 upstream.
    
    Presence detection of a digital monitor seems not to be reliable using
    the HTPLG bit.
    
    Dave Müller <dave.mueller@gmx.ch>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    i915: fix ironlake edp panel setup (v4)
    
    commit fe27d53 upstream.
    
    The eDP spec claims a 20% overhead for the 8:10 encoding scheme used
    on the wire. Take this into account when picking the lane/clock speed
    for the panel.
    
    v3: some panels are out of spec, try our best to deal with them, don't
    refuse modes on eDP panels, and try the largest allowed settings if
    all else fails on eDP.
    v4: fix stupid typo, forgot to git add before amending.
    
    Fixes several reports in bugzilla:
    
          https://bugs.freedesktop.org/show_bug.cgi?id=28070
    
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Eric Anholt <eric@anholt.net>
    Cc: Manoj Iyer <manoj.iyer@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    ibmvfc: Fix command completion handling
    
    commit f5832fa upstream.
    
    Commands which are completed by the VIOS are placed on a CRQ
    in kernel memory for the ibmvfc driver to process. Each CRQ
    entry is 16 bytes. The ibmvfc driver reads the first 8 bytes
    to check if the entry is valid, then reads the next 8 bytes to get
    the handle, which is a pointer the completed command. This fixes
    an issue seen on Power 7 where the processor reordered the
    loads from memory, resulting in processing command completion
    with a stale handle. This could result in command timeouts,
    and also early completion of commands.
    
    Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
    Signed-off-by: James Bottomley <James.Bottomley@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    ibmvfc: Reduce error recovery timeout
    
    commit daa142d upstream.
    
    If a command times out resulting in EH getting invoked, we wait for the
    aborted commands to come back after sending the abort. Shorten
    the amount of time we wait for these responses, to ensure we don't
    get stuck in EH for several minutes.
    
    Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
    Signed-off-by: James Bottomley <James.Bottomley@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    md/raid1: delay reads that could overtake behind-writes.
    
    commit e555190 upstream.
    
    When a raid1 array is configured to support write-behind
    on some devices, it normally only reads from other devices.
    If all devices are write-behind (because the rest have failed)
    it is possible for a read request to be serviced before a
    behind-write request, which would appear as data corruption.
    
    So when forced to read from a WriteMostly device, wait for any
    write-behind to complete, and don't start any more behind-writes.
    
    Signed-off-by: NeilBrown <neilb@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    mm: keep a guard page below a grow-down stack segment
    
    commit 320b2b8 upstream.
    
    This is a rather minimally invasive patch to solve the problem of the
    user stack growing into a memory mapped area below it.  Whenever we fill
    the first page of the stack segment, expand the segment down by one
    page.
    
    Now, admittedly some odd application might _want_ the stack to grow down
    into the preceding memory mapping, and so we may at some point need to
    make this a process tunable (some people might also want to have more
    than a single page of guarding), but let's try the minimal approach
    first.
    
    Tested with trivial application that maps a single page just below the
    stack, and then starts recursing.  Without this, we will get a SIGSEGV
    _after_ the stack has smashed the mapping.  With this patch, we'll get a
    nice SIGBUS just as the stack touches the page just above the mapping.
    
    Requested-by: Keith Packard <keithp@keithp.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    mm: fix missing page table unmap for stack guard page failure case
    
    commit 5528f91 upstream.
    
    .. which didn't show up in my tests because it's a no-op on x86-64 and
    most other architectures.  But we enter the function with the last-level
    page table mapped, and should unmap it at exit.
    
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    x86: don't send SIGBUS for kernel page faults
    
    commit 9605456 upstream.
    
    It's wrong for several reasons, but the most direct one is that the
    fault may be for the stack accesses to set up a previous SIGBUS.  When
    we have a kernel exception, the kernel exception handler does all the
    fixups, not some user-level signal handler.
    
    Even apart from the nested SIGBUS issue, it's also wrong to give out
    kernel fault addresses in the signal handler info block, or to send a
    SIGBUS when a system call already returns EFAULT.
    
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  3. Linux 2.6.34.3

    gregkh committed with cyanogen Aug 10, 2010
    add random binaries to .gitignore
    
    commit 7926c09 upstream.
    
    Signed-off-by: Jan III Sobieski <jan3sobi3ski@gmail.com>
    Signed-off-by: Michal Marek <mmarek@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    mm: fix ia64 crash when gcore reads gate area
    
    commit de51257 upstream.
    
    Debian's ia64 autobuilders have been seeing kernel freeze or reboot
    when running the gdb testsuite (Debian bug 588574): dannf bisected to
    2.6.32 62eede6 "mm: ZERO_PAGE without
    PTE_SPECIAL"; and reproduced it with gdb's gcore on a simple target.
    
    I'd missed updating the gate_vma handling in __get_user_pages(): that
    happens to use vm_normal_page() (nowadays failing on the zero page),
    yet reported success even when it failed to get a page - boom when
    access_process_vm() tried to copy that to its intermediate buffer.
    
    Fix this, resisting cleanups: in particular, leave it for now reporting
    success when not asked to get any pages - very probably safe to change,
    but let's not risk it without testing exposure.
    
    Why did ia64 crash with 16kB pages, but succeed with 64kB pages?
    Because setup_gate() pads each 64kB of its gate area with zero pages.
    
    Reported-by: Andreas Barth <aba@not.so.argh.org>
    Bisected-by: dann frazier <dannf@debian.org>
    Signed-off-by: Hugh Dickins <hughd@google.com>
    Tested-by: dann frazier <dannf@dannf.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    NFS: kswapd must not block in nfs_release_page
    
    commit b608b28 upstream.
    
    See https://bugzilla.kernel.org/show_bug.cgi?id=16056
    
    If other processes are blocked waiting for kswapd to free up some memory so
    that they can make progress, then we cannot allow kswapd to block on those
    processes.
    
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    NFS: Fix a typo in include/linux/nfs_fs.h
    
    commit 77a63f3 upstream.
    
    nfs_commit_inode() needs to be defined irrespectively of whether or not
    we are supporting NFSv3 and NFSv4.
    
    Allow the compiler to optimise away code in the NFSv2-only case by
    converting it into an inlined stub function.
    
    Reported-and-tested-by: Ingo Molnar <mingo@elte.hu>
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    comedi: Uncripple 8255-based DIO subdevices
    
    (Note: upstream comedi configuration has been overhauled, so this patch
    does not apply there.)
    
    Several comedi drivers call subdev_8255_init() (declared in
    "drivers/staging/comedi/drivers/8255.h") to set up one or more DIO
    subdevices.  This should be provided by the 8255.ko module, but unless
    the CONFIG_COMEDI_8255 or CONFIG_COMEDI_8255_MODULE macro is defined,
    the 8255.h header uses a dummy inline version of the function instead.
    This means the comedi devices end up with an "unused" subdevice with 0
    channels instead of a "DIO" subdevice with 24 channels!
    
    This patch provides a non-interactive COMEDI_8255 option and selects it
    whenever the COMEDI_PCI_DRIVERS or COMEDI_PCMCIA_DRIVERS options are
    selected.
    
    Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    PARISC: led.c - fix potential stack overflow in led_proc_write()
    
    commit 4b4fd27 upstream.
    
    avoid potential stack overflow by correctly checking count parameter
    
    Reported-by: Ilja <ilja@netric.org>
    Signed-off-by: Helge Deller <deller@gmx.de>
    Acked-by: Kyle McMartin <kyle@mcmartin.ca>
    Cc: James E.J. Bottomley <jejb@parisc-linux.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    arm/imx/gpio: add spinlock protection
    
    commit 14cb0de upstream.
    
    The GPIO registers need protection from concurrent access for operations that
    are not atomic.
    
    Cc: Juergen Beisert <j.beisert@pengutronix.de>
    Cc: Daniel Mack <daniel@caiaq.de>
    Reported-by: rpkamiak@rockwellcollins.com
    Signed-off-by: Baruch Siach <baruch@tkos.co.il>
    Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    parisc: pass through '\t' to early (iodc) console
    
    commit d9b68e5 upstream.
    
    The firmware handles '\t' internally, so stop trying to emulate it
    (which, incidentally, had a bug in it.)
    
    Fixes a really weird hang at bootup in rcu_bootup_announce, which,
    as far as I can tell, is the first printk in the core kernel to use
    a tab as the first character.
    
    Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    amd64_edac: Fix DCT base address selector
    
    commit 9975a5f upstream.
    
    The correct check is to verify whether in high range we're below 4GB
    and not to extract the DctSelBaseAddr again. See "2.8.5 Routing DRAM
    Requests" in the F10h BKDG.
    
    Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
    Acked-by: Doug Thompson <dougthompson@xmission.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    amd64_edac: Correct scrub rate setting
    
    commit bc57117 upstream.
    
    Exit early when setting scrub rate on unknown/unsupported families.
    
    Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
    Acked-by: Doug Thompson <dougthompson@xmission.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    amd64_edac: Fix operator precendence error
    
    commit 962b70a upstream.
    
    The bitwise AND is of higher precedence, make that explicit.
    
    Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    e1000e: don't inadvertently re-set INTX_DISABLE
    
    commit 36f2407 upstream.
    
    Should e1000_test_msi() fail to see an msi interrupt, it attempts to
    fallback to legacy INTx interrupts. But an error in the code may prevent
    this from happening correctly.
    
    Before calling e1000_test_msi_interrupt(), e1000_test_msi() disables SERR
    by clearing the SERR bit from the just read PCI_COMMAND bits as it writes
    them back out.
    
    Upon return from calling e1000_test_msi_interrupt(), it re-enables SERR
    by writing out the version of PCI_COMMAND it had previously read.
    
    The problem with this is that e1000_test_msi_interrupt() calls
    pci_disable_msi(), which eventually ends up in pci_intx(). And because
    pci_intx() was called with enable set to 1, the INTX_DISABLE bit gets
    cleared from PCI_COMMAND, which is what we want. But when we get back to
    e1000_test_msi(), the INTX_DISABLE bit gets inadvertently re-set because
    of the attempt by e1000_test_msi() to re-enable SERR.
    
    The solution is to have e1000_test_msi() re-read the PCI_COMMAND bits as
    part of its attempt to re-enable SERR.
    
    During debugging/testing of this issue I found that not all the systems
    I ran on had the SERR bit set to begin with. And on some of the systems
    the same could be said for the INTX_DISABLE bit. Needless to say these
    latter systems didn't have a problem falling back to legacy INTx
    interrupts with the code as is.
    
    Signed-off-by: Dean Nelson <dnelson@redhat.com>
    Tested-by: Emil Tantilov <emil.s.tantilov@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    e1000e: 82577/82578 PHY register access issues
    
    commit ff847ac upstream.
    
    The MAC-PHY interconnect on 82577/82578 uses a power management feature
    (called K1) which must be disabled when in 1Gbps due to a hardware issue on
    these parts.  The #define bit setting used to enable/disable K1 is
    incorrect and can cause PHY register accesses to stop working altogether
    until the next device reset.  This patch sets the register correctly.
    
    This issue is present in kernels since 2.6.32.
    
    Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
    Tested-by: Jeff Pieper <jeffrey.e.pieper@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    9p: strlen() doesn't count the terminator
    
    commit 5c4bfa1 upstream.
    
    This is an off by one bug because strlen() doesn't count the NULL
    terminator.  We strcpy() addr into a fixed length array of size
    UNIX_PATH_MAX later on.
    
    The addr variable is the name of the device being mounted.
    
    Signed-off-by: Dan Carpenter <error27@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    igb: Use only a single Tx queue in SR-IOV mode
    
    commit 5fa8517 upstream.
    
    The 82576 expects the second rx queue in any pool to receive L2 switch
    loop back packets sent from the second tx queue in another pool.  The
    82576 VF driver does not enable the second rx queue so if the PF driver
    sends packets destined to a VF from its second tx queue then the VF
    driver will never see them.  In SR-IOV mode limit the number of tx queues
    used by the PF driver to one. This patch fixes a bug reported in which
    the PF cannot communciate with the VF and should be considered for 2.6.34
    stable.
    
    Signed-off-by: Greg Rose <gregory.v.rose@intel.com>
    Tested-by: Jeff Pieper <jeffrey.e.pieper@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    ath9k: enable serialize_regmode for non-PCIE AR9160
    
    commit 4c85ab1 upstream.
    
    https://bugzilla.kernel.org/show_bug.cgi?id=16476
    
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Acked-by: Luis R. Rodriguez <lrodriguez@atheros.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    ath9k: fix a potential buffer leak in the STA teardown path
    
    commit 2b40994 upstream.
    
    It looks like it might be possible for a TID to be paused, while still
    holding some queued buffers, however ath_tx_node_cleanup currently only
    iterates over active TIDs.
    Fix this by always checking every allocated TID for the STA that is being
    cleaned up.
    
    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    ath9k_hw: fix an off-by-one error in the PDADC boundaries calculation
    
    commit 03b4776 upstream.
    
    PDADC values were only generated for values surrounding the target
    index, however not for the target index itself, leading to a minor
    error in the generated curve.
    
    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    ath9k: fix TSF after reset on AR913x
    
    commit f860d52 upstream.
    
    When issuing a reset, the TSF value is lost in the hardware because of
    the 913x specific cold reset. As with some AR9280 cards, the TSF needs
    to be preserved in software here.
    
    Additionally, there's an issue that frequently prevents a successful
    TSF write directly after the chip reset. In this case, repeating the
    TSF write after the initval-writes usually works.
    
    This patch detects failed TSF writes and recovers from them, taking
    into account the delay caused by the initval writes.
    
    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
    Reported-by: Björn Smedman <bjorn.smedman@venatech.se>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    ath9k: fix yet another buffer leak in the tx aggregation code
    
    commit 4cee786 upstream.
    
    When an aggregation session is being cleaned up, while the tx status
    for some frames is being processed, the TID is flushed and its buffers
    are sent out.
    
    Unfortunately that left the pending un-acked frames unprocessed, thus
    leaking buffers. Fix this by reordering the code so that those frames
    are processed first, before the TID is flushed.
    
    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    iwlwifi: fix scan abort
    
    commit d28232b upstream.
    
    Fix possible double priv->mutex lock introduced by commit
    a69b03e
    "iwlwifi: cancel scan watchdog in iwl_bg_abort_scan" .
    We can not call cancel_delayed_work_sync(&priv->scan_check) with
    priv->mutex locked because workqueue function iwl_bg_scan_check()
    take that lock internally.
    
    We do not need to synchronize when canceling priv->scan_check work.
    We can avoid races (sending double abort command or send no
    command at all) using STATUS_SCAN_ABORT bit. Moreover
    current iwl_bg_scan_check() code seems to be broken, as
    we should not send abort commands when currently aborting.
    
    Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    cfg80211: ignore spurious deauth
    
    commit 643f82e upstream.
    
    Ever since mac80211/drivers are no longer
    fully in charge of keeping track of the
    auth status, trying to make them do so will
    fail. Instead of warning and reporting the
    deauthentication to userspace, cfg80211 must
    simply ignore it so that spurious
    deauthentications, e.g. before starting
    authentication, aren't seen by userspace as
    actual deauthentications.
    
    Reported-by: Paul Stewart <pstew@google.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    cfg80211: don't get expired BSSes
    
    commit ccb6c13 upstream.
    
    When kernel-internal users use cfg80211_get_bss()
    to get a reference to a BSS struct, they may end
    up getting one that would have been removed from
    the list if there had been any userspace access
    to the list. This leads to inconsistencies and
    problems.
    
    Fix it by making cfg80211_get_bss() ignore BSSes
    that cfg80211_bss_expire() would remove.
    
    Fixes http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2180
    
    Reported-by: Jiajia Zheng <jiajia.zheng@intel.com>
    Tested-by: Jiajia Zheng <jiajia.zheng@intel.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    mac80211: avoid scheduling while atomic in mesh_rx_plink_frame
    
    commit c937019 upstream.
    
    While mesh_rx_plink_frame holds sta->lock...
    
    mesh_rx_plink_frame ->
    	mesh_plink_inc_estab_count ->
    		ieee80211_bss_info_change_notify
    
    ...but ieee80211_bss_info_change_notify is allowed to sleep.  A driver
    taking advantage of that allowance can cause a scheduling while
    atomic bug.  Similar paths exist for mesh_plink_dec_estab_count,
    so work around those as well.
    
    http://bugzilla.kernel.org/show_bug.cgi?id=16099
    
    Also, correct a minor kerneldoc comment error (mismatched function names).
    
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    SCSI: enclosure: fix error path - actually return ERR_PTR() on error
    
    commit a91c1be upstream.
    
    we also need to clean up and free the cdev.
    
    Reported-by: Jani Nikula <ext-jani.1.nikula@nokia.com>
    Signed-off-by: James Bottomley <James.Bottomley@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    GFS2: rename causes kernel Oops
    
    commit 728a756 upstream.
    
    This patch fixes a kernel Oops in the GFS2 rename code.
    
    The problem was in the way the gfs2 directory code was trying
    to re-use sentinel directory entries.
    
    In the failing case, gfs2's rename function was renaming a
    file to another name that had the same non-trivial length.
    The file being renamed happened to be the first directory
    entry on the leaf block.
    
    First, the rename code (gfs2_rename in ops_inode.c) found the
    original directory entry and decided it could do its job by
    simply replacing the directory entry with another.  Therefore
    it determined correctly that no block allocations were needed.
    
    Next, the rename code deleted the old directory entry prior to
    replacing it with the new name.  Therefore, the soon-to-be
    replaced directory entry was temporarily made into a directory
    entry "sentinel" or a place holder at the start of a leaf block.
    
    Lastly, it went to re-add the replacement directory entry in
    that leaf block.  However, when gfs2_dirent_find_space was
    looking for space in the leaf block, it used the wrong value
    for the sentinel.  That threw off its calculations so later
    it decides it can't really re-use the sentinel and therefore
    must allocate a new leaf block.  But because it previously decided
    to re-use the directory entry, it didn't waste the time to
    grab a new block allocation for the inode.  Therefore, the
    inode's i_alloc pointer was still NULL and it crashes trying to
    reference it.
    
    In the case of sentinel directory entries, the entire dirent is
    reused, not just the "free space" portion of it, and therefore
    the function gfs2_dirent_find_space should use the value 0
    rather than GFS2_DIRENT_SIZE(0) for the actual dirent size.
    
    Fixing this calculation enables the reproducer programs to work
    properly.
    
    Signed-off-by: Bob Peterson <rpeterso@redhat.com>
    Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    KVM: MMU: flush remote tlbs when overwriting spte with different pfn
    
    (cherry picked from commit 9154635)
    
    After remove a rmap, we should flush all vcpu's tlb
    
    Signed-off-by: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
    Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    xen: drop xen_sched_clock in favour of using plain wallclock time
    
    commit 8a22b99 upstream.
    
    xen_sched_clock only counts unstolen time.  In principle this should
    be useful to the Linux scheduler so that it knows how much time a process
    actually consumed.  But in practice this doesn't work very well as the
    scheduler expects the sched_clock time to be synchronized between
    cpus.  It also uses sched_clock to measure the time a task spends
    sleeping, in which case "unstolen time" isn't meaningful.
    
    So just use plain xen_clocksource_read to return wallclock nanoseconds
    for sched_clock.
    
    Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    drm/radeon/kms/igp: sideport is AMD only
    
    commit 4c70b2e upstream.
    
    Intel variants don't support it.
    
    Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    drm/radeon: add new pci ids
    
    commit 1297c05 upstream.
    
    New evergreen and r7xx ids.
    
    Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    drm/radeon/kms/r7xx: add workaround for hw issue with HDP flush
    
    commit 812d046 upstream.
    
    Use of HDP_*_COHERENCY_FLUSH_CNTL can cause a hang in certain
    situations.  Add workaround.
    
    Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    drm/i915: Check overlay stride errata for i830 and i845
    
    commit a1efd14 upstream.
    
    Apparently i830 and i845 cannot handle any stride that is not a multiple
    of 256, unlike their brethren which do support 64 byte aligned strides.
    
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
    Signed-off-by: Eric Anholt <eric@anholt.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    Revert "ssb: Handle Netbook devices where the SPROM address is changed"
    
    Turns out this isn't the best way to resolve this issue.  The
    individual patches will be applied instead.
    
    Cc: Larry Finger <Larry.Finger@lwfinger.net>
    Cc: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    ssb: do not read SPROM if it does not exist
    
    commit d53cdbb upstream.
    
    Attempting to read registers that don't exist on the SSB bus can cause
    hangs on some boxes.  At least some b43 devices are 'in the wild' that
    don't have SPROMs at all.  When the SSB bus support loads, it attempts
    to read these (non-existant) SPROMs and causes hard hangs on the box --
    no console output, etc.
    
    This patch adds some intelligence to determine whether or not the SPROM
    is present before attempting to read it.  This avoids those hard hangs
    on those devices with no SPROM attached to their SSB bus.  The
    SSB-attached devices (e.g. b43, et al.) won't work, but at least the box
    will survive to test further patches. :-)
    
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
    Cc: Larry Finger <Larry.Finger@lwfinger.net>
    Cc: Michael Buesch <mb@bu3sch.de>
    Cc: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    ssb: Look for SPROM at different offset on higher rev CC
    
    commit ea2db49 upstream.
    
    Our offset handling becomes even a little more hackish now. For some reason I
    do not understand all offsets as inrelative. It assumes base offset is 0x1000
    but it will work for now as we make offsets relative anyway by removing base
    0x1000. Should be cleaner however.
    
    Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Cc: Larry Finger <Larry.Finger@lwfinger.net>
    Cc: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    ssb: fix NULL ptr deref when pcihost_wrapper is used
    
    commit da1fdb0 upstream.
    
    Ethernet driver b44 does register ssb by it's pcihost_wrapper
    and doesn't set ssb_chipcommon. A check on this value
    introduced with commit d53cdbb
    and ea2db49 triggers:
    
    BUG: unable to handle kernel NULL pointer dereference at 00000010
    IP: [<c1266c36>] ssb_is_sprom_available+0x16/0x30
    
    Signed-off-by: Christoph Fritz <chf.fritz@googlemail.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Cc: Larry Finger <Larry.Finger@lwfinger.net>
    Cc: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    ssb: Handle alternate SSPROM location
    
    commit 9d1ac34 upstream.
    
    In kernel Bugzilla #15825 (2 users), in a wireless mailing list thread
    (http://lists.infradead.org/pipermail/b43-dev/2010-May/000124.html), and on a
    netbook owned by John Linville
    (http://marc.info/?l=linux-wireless&m=127230751408818&w=4), there are reports
    of ssb failing to detect an SPROM at the normal location. After studying the
    MMIO trace dump for the Broadcom wl driver, it was determined that the affected
    boxes had a relocated SPROM.
    
    This patch fixes all systems that have reported this problem.
    
    Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Cc: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    
    USB: add missing "{}" in map_urb_for_dma
    
    commit f537da6 upstream.
    
    Obviously, {} is needed in the branch of
    	"else if (hcd->driver->flags & HCD_LOCAL_MEM)"
    for handling of setup packet mapping.
    
    Signed-off-by: Ming Lei <tom.leiming@gmail.com>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  4. vdec: Add VDEC_IOCTL_GETVERSION

    cyanogen committed Aug 14, 2010
  5. net: wireless: bcm4329: Add memory barriers to wait functions

    Dmitry Shmidt committed with cyanogen Aug 13, 2010
    Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
  6. net: wireless: bcm4329: Fix unregister_early_suspend() in dhd_detach()

    Dmitry Shmidt committed with cyanogen Aug 10, 2010
    Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
  7. net: wireless: bcm4329: Fix "setsuspend" behavior

    Dmitry Shmidt committed with cyanogen Aug 13, 2010
    Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
Commits on Aug 12, 2010
Commits on Aug 11, 2010
  1. yaffs: sync with yaffs repo

    Patrick Jacques committed with kmobs Aug 11, 2010
    Merge recent changes by Charles Manning for yaffs and
    2.6.34 kernel, including:
    
    commit 10baaa5
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs: Skip checkpoint writing if mounted readonly
    
    commit 4c78eb9
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs: Batter read-only support handling
    
    commit ca04740
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs: Fix return value for yaffs direct sync
    
    commit 66dfee0
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs: Add new follow link code for 2.6.34 support
    
    commit 1079104
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs  Fix yaffs1 soft delete issue
    
    commit 570d9b8
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs  Changes to direct tests
    
    commit 9d8bb3a
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs Get fuzz tester to run further
    
    commit 2d221c0
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs: Fix issues kicked up by fuzz testing
    
    commit d22f345
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs Implement phase 1 fuzz testing.
    
    commit 497c3cf
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs Update RAM simulator to support start and end blocks
    
    commit 2597593
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs: Fix AutoUnicode handling
    
    commit a6fbf61
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs Fix yaffs direct creating opening files with no name
    
    commit 505255d
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs Add another test to basic tests
    
    commit 993de0d
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs Keep unused linux alloactor code up to date
    
    commit 2da4395
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs Fix in-kernel makefile to use correct allocator
    
    commit 32b9c53
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs Fix xattrib headers for use with unicode
    
    commit 227cbf5
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs Move yaffscfg.h to where it should be
    
    And more from http://yaffs.net/gitweb?p=yaffs2/.git
  2. Revert "yaffs: Sync with yaffs repo"

    kmobs committed Aug 11, 2010
    This reverts commit 33aa12b.
  3. yaffs: Sync with yaffs repo

    Patrick Jacques committed with kmobs Aug 11, 2010
    Merge recent changes by Charles Manning for yaffs and
    2.6.34 kernel, including:
    
    commit 10baaa5
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs: Skip checkpoint writing if mounted readonly
    
    commit 4c78eb9
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs: Batter read-only support handling
    
    commit ca04740
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs: Fix return value for yaffs direct sync
    
    commit 66dfee0
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs: Add new follow link code for 2.6.34 support
    
    commit 1079104
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs  Fix yaffs1 soft delete issue
    
    commit 570d9b8
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs  Changes to direct tests
    
    commit 9d8bb3a
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs Get fuzz tester to run further
    
    commit 2d221c0
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs: Fix issues kicked up by fuzz testing
    
    commit d22f345
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs Implement phase 1 fuzz testing.
    
    commit 497c3cf
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs Update RAM simulator to support start and end blocks
    
    commit 2597593
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs: Fix AutoUnicode handling
    
    commit a6fbf61
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs Fix yaffs direct creating opening files with no name
    
    commit 505255d
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs Add another test to basic tests
    
    commit 993de0d
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs Keep unused linux alloactor code up to date
    
    commit 2da4395
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs Fix in-kernel makefile to use correct allocator
    
    commit 32b9c53
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs Fix xattrib headers for use with unicode
    
    commit 227cbf5
    Author: Charles Manning <cdhmanning@gmail.com>
    
        yaffs Move yaffscfg.h to where it should be
    
    And more from http://yaffs.net/gitweb?p=yaffs2/.git
  4. ipv6: initialize idev in addrconf_ip6_tnl_config

    Patrick Jacques committed with kmobs Aug 11, 2010
    Corrects error message display on ipv6 tunnel failure
    that was introduced from previous commit 4c069538
  5. ARM: only allow 26-bit user mode on CPUs that support it

    Dima Zavin committed with cyanogen Jul 29, 2010
    Change-Id: If62616ee826b3786b9fc7a877bff5584e69f7173
    Reviewed-by: Arve Hjønnevåg <arve@android.com>
    Signed-off-by: Dima Zavin <dima@android.com>
  6. net: wireless: bcm4329: Fix dhd_bus_watchdog() race conditions

    GregBRCM committed with cyanogen Aug 10, 2010
    Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
Commits on Aug 10, 2010
  1. ipv6: Don't add routes to ipv6 disabled interfaces.

    Patrick Jacques committed with kmobs Aug 10, 2010
    If the interface has IPv6 disabled, don't add a multicast or
    link-local route since we won't be adding a link-local address.
    
    author	Brian Haley <brian.haley@hp.com>
    commit	64e724f
  2. I need to stop gitfailing. Revert "my UV values"

    kmobs committed Aug 10, 2010
    This reverts commit ed0d921.
Commits on Aug 9, 2010
  1. my UV values

    kmobs committed Aug 3, 2010
  2. msm: camera: Add MSM_CAMERA_LED_DEATH_RAY

    cyanogen committed Aug 9, 2010
    This is a high-brightness LED mode that should never be used.
    
    Do not look into MSM_CAMERA_LED_DEATH_RAY with remaining good eye.
  3. tcp: bind() fix when many ports are bound

    Patrick Jacques committed with kmobs Aug 8, 2010
    Port autoselection done by kernel only works when number of bound
    sockets is under a threshold (typically 30000).
    
    When this threshold is over, we must check if there is a conflict before
    exiting first loop in inet_csk_get_port()
    
    Change inet_csk_bind_conflict() to forbid two reuse-enabled sockets to
    bind on same (address,port) tuple (with a non ANY address)
    
    Same change for inet6_csk_bind_conflict()
    
    author	Eric Dumazet <eric.dumazet@gmail.com>
    commit	fda48a0
  4. mm/vmscan.c: fix mapping use after free

    Patrick Jacques committed with kmobs Aug 8, 2010
    We need lock_page_nosync() here because we have no reference to the
    mapping when taking the page lock.
    
    author	Nick Piggin <npiggin@suse.de>
    commit	a6aa62a
Commits on Aug 7, 2010
  1. net: wireless: bcm4329: Fix scan timeout for abg case

    GregBRCM committed with cyanogen Aug 6, 2010
    Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
  2. net: wireless: bcm4329: Force scan when driver is loaded

    GregBRCM committed with cyanogen Aug 5, 2010
    Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
Commits on Aug 6, 2010
  1. enable IP_ADVANCED_ROUTER for busybox 'ip rule show'

    jac299792458 committed with cyanogen Aug 2, 2010
    Adding this config option allows the user who has enabled the feature
    CONFIG_FEATURE_IP_RULE in busybox to see the various routing table
    prio's and set/change them with 'ip route ... table ...' and 'ip rule'.
    
    Signed-off-by: Jason <github@lakedaemon.net>
  2. [ARM] msm: defconfig: disable V4L2, fix ipcomp6 dependencies

    Patrick Jacques committed with cyanogen Aug 6, 2010
    V4L on msm is unused, disable it to reduce kernel size.
    Eclair (and more heavily, Froyo) Google Experience (tm) apps
    are dependant on ipv6 and prefer compression. The ipcomp6
    module needs xfrm tunnel module, and that module, in turn,
    requires the ipv4 compression module.
  3. pmr: off by one in __ipmr_fill_mroute()

    Patrick Jacques committed with cyanogen Aug 6, 2010
    This fixes a smatch warning:
    net/ipv4/ipmr.c +1917 __ipmr_fill_mroute(12) error: buffer overflow
    '(mrt)->vif_table' 32 <= 32
    The ipv6 version had the same issue.
    
    - Backported from 2.6.35
    
    author:	Dan Carpenter <error27@gmail.com>
    aosp commit: ed0f160
  4. [ARM] msm_camera: add mutex lock to ioctl

    Patrick Jacques committed with cyanogen Aug 5, 2010
    Add a mutex lock to fix concurrency issue of processing
    more than one blocking call at a time in MSM_CAM_IOCTL_CTRL_COMMAND.
    Also apply to trout/sapphire msm_camera_old driver.
    
    author: Nagesh Reddy <nageshsreddy@codeaurora.org>
    codeaurora commit: fd27fc8f1edd31ed64d5f8aa08aa2f1ec2420534