commit 999c1d6bc999d67657033ec780a561aa172c75a9
Author: Greg Kroah-Hartman <gregkh@suse.de>
Date:   Fri Nov 11 10:12:24 2011 -0800

    Linux 3.0.9

commit c54e04e9a9993da6968c8b21bdb905d07f0caed7
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sun Nov 6 18:34:03 2011 -0800

    hid/apple: modern macbook airs use the standard apple function key translations
    
    commit 21404b772a1c65f7b935b8c0fddc388a949f4e31 upstream.
    
    This removes the use of the special "macbookair_fn_keys" keyboard
    translation table for the MacBookAir4,x models (ie the 2011 refresh).
    They use the standard apple_fn_keys[] translation.  Apparently only the
    old MacBook Air's need a different translation table.
    
    This mirrors the change that commit da617c7cb915 ("HID: consolidate
    MacbookAir 4,1 mappings") did for the WELLSPRING6A ones, but does it for
    the WELLSPRING6 model used on the MacBookAir4,2.
    
    Reported-and-tested-by: Dirk Hohndel <hohndel@infradead.org>
    Cc: Jiri Kosina <jkosina@suse.cz>
    Cc: Joshua V Dillon <jvdillon@gmail.com>
    Cc: Chase Douglas <chase.douglas@canonical.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 8ac6255b5f8d69d58d4fb8ed62df2780756d4b0c
Author: Jiri Kosina <jkosina@suse.cz>
Date:   Wed Oct 5 16:54:45 2011 +0200

    HID: consolidate MacbookAir 4,1 mappings
    
    commit da617c7cb915545dda4280df888dd6f8d5697420 upstream.
    
    MacbookAir 4,1 doesn't require extra mapping table, as the mappings
    are identical to apple_fn_keys[].
    
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit fc7c292ac74b41af17e9e8eab039322d3847bad3
Author: Andreas Krist <andreas.krist@gmail.com>
Date:   Fri Oct 28 18:50:39 2011 +0200

    HID: hid-apple: add device ID of another wireless aluminium
    
    commit ad734bc1565364f9e4b70888d3ce5743b3c1030a upstream.
    
    I've recently bought a Apple wireless aluminum keyboard (model 2011) which is
    not yet supported by the kernel - it seems they just changed the device id.
    After applying the attached patch, the device is fully functional.
    
    Signed-off-by: Andreas Krist <andreas.krist@gmail.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 63472b615266723cb9af12e09fd32736be6b3477
Author: Gökçen Eraslan <gokcen@pardus.org.tr>
Date:   Sat Oct 22 22:39:06 2011 +0300

    HID: Add device IDs for Macbook Pro 8 keyboards
    
    commit 213f9da80533940560bef8fa43b10c590895459c upstream.
    
    This patch adds keyboard support for Macbook Pro 8 models which has
    WELLSPRING5A model name and 0x0252, 0x0253 and 0x0254 USB IDs. Trackpad
    support for those models are added to bcm5974 in
    c331eb580a0a7906c0cdb8dbae3cfe99e3c0e555 ("Input: bcm5974 - Add
    support for newer MacBookPro8,2).
    
    Signed-off-by: Gökçen Eraslan <gokcen@pardus.org.tr>
    Acked-by: Henrik Rydberg <rydberg@euromail.se>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Cc: Chase Douglas <chase.douglas@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 4bdfc7d622b8a17bf55a7745ae77f8925843ea9d
Author: Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
Date:   Sat Oct 1 15:54:53 2011 +0900

    HID: Add support MacbookAir 4,1 keyboard
    
    commit d762cc290b9f17e346f4297fd5984b70ce71ef66 upstream.
    
    Added USB device IDs and keyboard map for MacBookAir 4,1 keyboard.
    
    Signed-off-by: Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 9148573623711a6932b729f5bb752534f4834714
Author: Jiri Kosina <jkosina@suse.cz>
Date:   Wed Aug 10 14:12:52 2011 +0200

    HID: add MacBookAir4,2 to hid_have_special_driver[]
    
    commit f6f554f09c5b831efdaf67c449e18ca06ee648fe upstream.
    
    Otherwise the generic driver wouldn't unbind from it and wouldn't
    let hid-apple to automatically take over.
    
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit bab08e54790e51a7541faf1e3029eeefc051e36c
Author: Jeff Brown <jeffbrown@android.com>
Date:   Mon Aug 15 21:12:09 2011 -0700

    HID: hid-multitouch: Add LG Display Multitouch device.
    
    commit c50bb1a4005630f47b5da26336f74a485033a515 upstream.
    
    This panel is also known as the Dell ST2220Tc.
    
    Signed-off-by: jeffbrown@android.com
    Reviewed-By: Benjamin Tissoires <Benjamin_Tissoires@logitech.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit c3f24bd0dcf2076ed16b8f5ea80ea001500d8095
Author: Joshua V. Dillon <jvdillon@gmail.com>
Date:   Fri Aug 5 12:05:22 2011 -0700

    HID: add support for MacBookAir4,2 keyboard.
    
    commit 5d922baa631058c7e37ae33e81c4d3e6437f8d1d upstream.
    
    Added USB device IDs for MacBookAir4,2 keyboard. Device constants were
    copied from the MacBookAir3,2 constants. The 4,2 device specification is
    reportedly unchanged from the 3,2 predecessor and seems to work well.
    
    Signed-off-by: Joshua V Dillon <jvdillon@gmail.com>
    Signed-off-by: Chase Douglas <chase.douglas@canonical.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 385df62a595823f09fa9447f79c5a14ea1990a7d
Author: Clemens Werther <clemens.werther@gmail.com>
Date:   Thu Aug 25 15:35:14 2011 +0200

    HID: add support for HuiJia USB Gamepad connector
    
    commit 6d1db0777981e1626ae71243984ac300b61789ff upstream.
    
    Create each gamepad as a separate joystick
    
    Signed-off-by: Clemens Werther <clemens.werther@gmail.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 81e0a487f87844c9b4ef5d7816ef4e02482db6c6
Author: Dan Bastone <dan@pwienterprises.com>
Date:   Sun Jul 31 07:40:49 2011 -0400

    HID: add support for new revision of Apple aluminum keyboard
    
    commit 4a4c879904aa0cc64629e14a49b64fb3d149bf1a upstream.
    
    Add USB device ids for the new revision (MB110LL/B) of Apple's wired aluminum
    keyboard.  I have only confirmed that the ANSI version is correct - it is
    assumed that the ISO and JIS versions follow the standard numbering convention.
    
    Signed-off-by: Dan Bastone <dan@pwienterprises.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 02376e54a976843aaa722b661123a6acc2b70b14
Author: THOMSON, Adam (Adam) <adam.thomson@alcatel-lucent.com>
Date:   Tue Jun 14 16:52:38 2011 +0200

    mtd: nand_base: always initialise oob_poi before writing OOB data
    
    commit f722013ee9fd24623df31dec9a91a6d02c3e2f2f upstream.
    
    In nand_do_write_ops() code it is possible for a caller to provide
    ops.oobbuf populated and ops.mode == MTD_OOB_AUTO, which currently
    means that the chip->oob_poi buffer isn't initialised to all 0xFF.
    The nand_fill_oob() method then carries out the task of copying
    the provided OOB data to oob_poi, but with MTD_OOB_AUTO it skips
    areas marked as unavailable by the layout struct, including the
    bad block marker bytes.
    
    An example of this causing issues is when the last OOB data read
    was from the start of a bad block where the markers are not 0xFF,
    and the caller wishes to write new OOB data at the beginning of
    another block. In this scenario the caller would provide OOB data,
    but nand_fill_oob() would skip the bad block marker bytes in
    oob_poi before copying the OOB data provided by the caller.
    This means that when the OOB data is written back to NAND,
    the block is inadvertently marked as bad without the caller knowing.
    This has been witnessed when using YAFFS2 where tags are stored
    in the OOB.
    
    To avoid this oob_poi is always initialised to 0xFF to make sure
    no left over data is inadvertently written back to the OOB area.
    
    Credits to Brian Norris <computersforpeace@gmail.com> for fixing this
    patch.
    
    Signed-off-by: Adam Thomson <adam.thomson@alcatel-lucent.com>
    Signed-off-by: Artem Bityutskiy <dedekind1@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 82eaf854859022f7bf1aa9122ed533516187cbff
Author: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Date:   Thu Oct 20 14:22:43 2011 +0530

    ath9k_hw: Fix regression of register offset for AR9003 chips
    
    commit 52d6d4ef5e6d1517688e27c11c01ab303ec681dd upstream.
    
    My recent commits (3782c69d, 324c74a) introduced regression
    for register offset selection that based on the macversion.
    Not using parentheses in proper manner for ternary operator
    leads to select wrong offset for the registers.
    
    This issue was observed with AR9462 chip that immediate disconnect
    after the association with the following message
    
    ieee80211 phy3: wlan0: Failed to send nullfunc to AP 00:23:69:12:ea:47
    after 500ms, disconnecting.
    
    Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit ed288aed0796683495c51684d56f9328813c59c7
Author: Richard Cochran <richardcochran@gmail.com>
Date:   Fri Oct 21 00:49:16 2011 +0000

    dp83640: use proper function to free transmit time stamping packets
    
    commit f5ff7cd1a84caa9545d952a37ac872ccb73825fb upstream.
    
    The previous commit enforces a new rule for handling the cloned packets
    for transmit time stamping. These packets must not be freed using any other
    function than skb_complete_tx_timestamp. This commit fixes the one and only
    driver using this API.
    
    The driver first appeared in v3.0.
    
    Signed-off-by: Richard Cochran <richard.cochran@omicron.at>
    Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 6dd160db729a0c96cc640a848e6df88ca6c19d2a
Author: Herbert Xu <herbert@gondor.apana.org.au>
Date:   Fri Aug 19 16:11:23 2011 +0800

    crypto: cryptd - Use subsys_initcall to prevent races with aesni
    
    commit b2bac6acf86d05d8af0499f37d91ecac15722803 upstream.
    
    As cryptd is depeneded on by other algorithms such as aesni-intel,
    it needs to be registered before them.  When everything is built
    as modules, this occurs naturally.  However, for this to work when
    they are built-in, we need to use subsys_initcall in cryptd.
    
    Tested-by: Josh Boyer <jwboyer@redhat.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Cc: Kerin Millar <kerframil@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit f450df800450e9c7ec8c53bdb72d6c4ef5f17d4e
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Wed Sep 21 20:55:04 2011 +0200

    PM / Suspend: Off by one in pm_suspend()
    
    commit 528f7ce6e439edeac38f6b3f8561f1be129b5e91 upstream.
    
    In enter_state() we use "state" as an offset for the pm_states[]
    array.  The pm_states[] array only has PM_SUSPEND_MAX elements so
    this test is off by one.
    
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 3fa57c1bf5fb311544199b7837a08b9f5bf5e6e4
Author: dpward <david.ward@ll.mit.edu>
Date:   Mon Sep 5 16:47:24 2011 +0000

    net: Handle different key sizes between address families in flow cache
    
    commit aa1c366e4febc7f5c2b84958a2dd7cd70e28f9d0 upstream.
    
    With the conversion of struct flowi to a union of AF-specific structs, some
    operations on the flow cache need to account for the exact size of the key.
    
    Signed-off-by: David Ward <david.ward@ll.mit.edu>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Cc: Kim Phillips <kim.phillips@freescale.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 867ca3109d0289d0a62bb3c7fc3d365e9d478fae
Author: David Ward <david.ward@ll.mit.edu>
Date:   Mon Sep 5 16:47:23 2011 +0000

    net: Align AF-specific flowi structs to long
    
    commit 728871bc05afc8ff310b17dba3e57a2472792b13 upstream.
    
    AF-specific flowi structs are now passed to flow_key_compare, which must
    also be aligned to a long.
    
    Signed-off-by: David Ward <david.ward@ll.mit.edu>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Cc: Kim Phillips <kim.phillips@freescale.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit ef52f3936f9f5d770ea177e5c769e68af1701a90
Author: Jiaying Zhang <jiayingz@google.com>
Date:   Wed Aug 31 11:50:51 2011 -0400

    ext4: remove i_mutex lock in ext4_evict_inode to fix lockdep complaining
    
    commit 8c0bec2151a47906bf779c6715a10ce04453ab77 upstream.
    
    The i_mutex lock and flush_completed_IO() added by commit 2581fdc810
    in ext4_evict_inode() causes lockdep complaining about potential
    deadlock in several places.  In most/all of these LOCKDEP complaints
    it looks like it's a false positive, since many of the potential
    circular locking cases can't take place by the time the
    ext4_evict_inode() is called; but since at the very least it may mask
    real problems, we need to address this.
    
    This change removes the flush_completed_IO() and i_mutex lock in
    ext4_evict_inode().  Instead, we take a different approach to resolve
    the software lockup that commit 2581fdc810 intends to fix.  Rather
    than having ext4-dio-unwritten thread wait for grabing the i_mutex
    lock of an inode, we use mutex_trylock() instead, and simply requeue
    the work item if we fail to grab the inode's i_mutex lock.
    
    This should speed up work queue processing in general and also
    prevents the following deadlock scenario: During page fault,
    shrink_icache_memory is called that in turn evicts another inode B.
    Inode B has some pending io_end work so it calls ext4_ioend_wait()
    that waits for inode B's i_ioend_count to become zero.  However, inode
    B's ioend work was queued behind some of inode A's ioend work on the
    same cpu's ext4-dio-unwritten workqueue.  As the ext4-dio-unwritten
    thread on that cpu is processing inode A's ioend work, it tries to
    grab inode A's i_mutex lock.  Since the i_mutex lock of inode A is
    still hold before the page fault happened, we enter a deadlock.
    
    Signed-off-by: Jiaying Zhang <jiayingz@google.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 2fc862e051e87f66de8b505b339e55c509d684a3
Author: Daniel Mack <zonque@gmail.com>
Date:   Tue Jun 7 03:01:07 2011 -0700

    mtd: pxa3xx_nand: Fix blank page ECC mismatch
    
    commit 543e32d5ff165d0d68deedb0e3557478c7c36a4a upstream.
    
    This bug was introduced in f8155a40 ("mtd: pxa3xx_nand: rework irq
    logic") and causes the PXA3xx NAND controller fail to operate with NAND
    flash that has empty pages. According to the comment in this block, the
    hardware controller will report a double-bit error for empty pages,
    which can and must be ignored.
    
    This patch restores the original behaviour of the driver.
    
    Signed-off-by: Daniel Mack <zonque@gmail.com>
    Acked-by: Lei Wen <leiwen@marvell.com>
    Cc: Haojian Zhuang <haojian.zhuang@marvell.com>
    Cc: David Woodhouse <David.Woodhouse@intel.com>
    Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 7b333e0ef8a1efa488ad98956c6701884b0c2b4b
Author: Lei Wen <leiwen@marvell.com>
Date:   Tue Jun 7 03:01:06 2011 -0700

    mtd: pxa3xx_nand: fix nand detection issue
    
    commit 0fab028b77d714ad302404b23306cf7adb885223 upstream.
    
    When keep_config is set, the detection would goes different routine.
    That the driver would read out the setting which is set previously
    by bootloader. While most bootloader keep the irq mask as off, and
    current driver need all irq default open, keep_config behavior would
    lead to no irq at all.
    
    Signed-off-by: Lei Wen <leiwen@marvell.com>
    Tested-by: Daniel Mack <zonque@gmail.com>
    Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 1bd1046f37d0a9a76bbcd45284229edacb8d890d
Author: Andres Salomon <dilinger@queued.net>
Date:   Fri Oct 14 07:33:20 2011 -0700

    mtd: provide an alias for the redboot module name
    
    commit d5de1907d0af22e1a02de2b16a624148517a39c2 upstream.
    
    parse_mtd_partitions takes a list of partition types; if the driver
    isn't loaded, it attempts to load it, and then it grabs the partition
    parser.  For redboot, the module name is "redboot.ko", while the parser
    name is "RedBoot".  Since modprobe is case-sensitive, attempting to
    modprobe "RedBoot" will never work.  I suspect the embedded systems that
    make use of redboot just always manually loaded redboot prior to loading
    their specific nand chip drivers (or statically compiled it in).
    
    Signed-off-by: Andres Salomon <dilinger@queued.net>
    Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 5805ad8491edbc343a07de169f32ade07dcb3406
Author: Peter Wippich <pewi@gw-instruments.de>
Date:   Mon Jun 6 15:50:58 2011 +0200

    mtd: mtdchar: add missing initializer on raw write
    
    commit bf5140817b2d65faac9b32fc9057a097044ac35b upstream.
    
    On writes in MODE_RAW the mtd_oob_ops struct is not sufficiently
    initialized which may cause nandwrite to fail. With this patch
    it is possible to write raw nand/oob data without additional ECC
    (either for testing or when some sectors need different oob layout
    e.g. bootloader) like
    nandwrite  -n -r -o  /dev/mtd0 <myfile>
    
    Signed-off-by: Peter Wippich <pewi@gw-instruments.de>
    Tested-by: Ricard Wanderlof <ricardw@axis.com>
    Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 041f9e20b7f794fd7b4932e05d0c938a9ebbf658
Author: Johannes Berg <johannes.berg@intel.com>
Date:   Fri Oct 28 11:59:47 2011 +0200

    mac80211: disable powersave for broken APs
    
    commit 05cb91085760ca378f28fc274fbf77fc4fd9886c upstream.
    
    Only AID values 1-2007 are valid, but some APs have been
    found to send random bogus values, in the reported case an
    AP that was sending the AID field value 0xffff, an AID of
    0x3fff (16383).
    
    There isn't much we can do but disable powersave since
    there's no way it can work properly in this case.
    
    Reported-by: Bill C Riemers <briemers@redhat.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 42c6d01ce89d43598fc804cf7c141d3252fe93b5
Author: Eliad Peller <eliad@wizery.com>
Date:   Thu Oct 20 19:05:50 2011 +0200

    mac80211: config hw when going back on-channel
    
    commit 6911bf0453e0d6ea8eb694a4ce67a68d071c538e upstream.
    
    When going back on-channel, we should reconfigure
    the hw iff the hardware is not already configured
    to the operational channel.
    
    Signed-off-by: Eliad Peller <eliad@wizery.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 632abf8b3f714da01daec2d43ffd9cd7b47f53a9
Author: Eliad Peller <eliad@wizery.com>
Date:   Thu Oct 20 19:05:49 2011 +0200

    mac80211: fix remain_off_channel regression
    
    commit eaa7af2ae582c9a8c51b374c48d5970b748a5ce2 upstream.
    
    The offchannel code is currently broken - we should
    remain_off_channel if the work was started, and
    the work's channel and channel_type are the same
    as local->tmp_channel and local->tmp_channel_type.
    
    However, if wk->chan_type and local->tmp_channel_type
    coexist (e.g. have the same channel type), we won't
    remain_off_channel.
    
    This behavior was introduced by commit da2fd1f
    ("mac80211: Allow work items to use existing
    channel type.")
    
    Tested-by: Ben Greear <greearb@candelatech.com>
    Signed-off-by: Eliad Peller <eliad@wizery.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 1cc8631784f67c62a8309897f7d4cb885a05ed6f
Author: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Date:   Mon Oct 24 18:13:40 2011 +0530

    ath9k_hw: Update AR9485 initvals to fix system hang issue
    
    commit 98fb2cc115b4ef1ea0a2d87a170c183bd395dd6c upstream.
    
    This patch fixes system hang when resuming from S3 state
    and lower rate sens failure issue.
    
    Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 6167ded5698377fca7830c22be0ba976f91f2434
Author: Johannes Berg <johannes.berg@intel.com>
Date:   Thu Nov 3 00:07:32 2011 +0000

    netlink: validate NLA_MSECS length
    
    commit c30bc94758ae2a38a5eb31767c1985c0aae0950b upstream.
    
    L2TP for example uses NLA_MSECS like this:
    policy:
            [L2TP_ATTR_RECV_TIMEOUT]        = { .type = NLA_MSECS, },
    code:
            if (info->attrs[L2TP_ATTR_RECV_TIMEOUT])
                    cfg.reorder_timeout = nla_get_msecs(info->attrs[L2TP_ATTR_RECV_TIMEOUT]);
    
    As nla_get_msecs() is essentially nla_get_u64() plus the
    conversion to a HZ-based value, this will not properly
    reject attributes from userspace that aren't long enough
    and might overrun the message.
    
    Add NLA_MSECS to the attribute minlen array to check the
    size properly.
    
    Cc: Thomas Graf <tgraf@suug.ch>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 1dc88f68f554b318691763867aab4ec7adc60945
Author: Luck, Tony <tony.luck@intel.com>
Date:   Fri Oct 21 14:42:55 2011 -0700

    ACPI atomicio: Convert width in bits to bytes in __acpi_ioremap_fast()
    
    commit 3bf3f8b19d2bfccc40f13c456bf339fd8f535ebc upstream.
    
    Callers to __acpi_ioremap_fast() pass the bit_width that they found in the
    acpi_generic_address structure. Convert from bits to bytes when passing to
    __acpi_find_iomap() - as it wants to see bytes, not bits.
    
    Signed-off-by: Tony Luck <tony.luck@intel.com>
    Signed-off-by: Len Brown <len.brown@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit eaeafcd898108e4e026faf43ca41817f5de6ee66
Author: Anton Blanchard <anton@samba.org>
Date:   Wed Sep 14 09:43:15 2011 +0000

    powerpc: Fix deadlock in icswx code
    
    commit 8bdafa39a47265bc029838b35cc6585f69224afa upstream.
    
    The icswx code introduced an A-B B-A deadlock:
    
         CPU0                    CPU1
         ----                    ----
    lock(&anon_vma->mutex);
                                 lock(&mm->mmap_sem);
                                 lock(&anon_vma->mutex);
    lock(&mm->mmap_sem);
    
    Instead of using the mmap_sem to keep mm_users constant, take the
    page table spinlock.
    
    Signed-off-by: Anton Blanchard <anton@samba.org>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 71b1a9d35d6cbd2e37c1101ca5f779ca55f7fb03
Author: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
Date:   Fri Aug 26 10:36:31 2011 +0000

    powerpc/eeh: Fix /proc/ppc64/eeh creation
    
    commit 8feaa43494cee5e938fd5a57b9e9bf1c827e6ccd upstream.
    
    Since commit 188917e183cf9ad0374b571006d0fc6d48a7f447, /proc/ppc64 is a
    symlink to /proc/powerpc/. That means that creating /proc/ppc64/eeh will
    end up with a unaccessible file, that is not listed under /proc/powerpc/
    and, then, not listed under /proc/ppc64/.
    
    Creating /proc/powerpc/eeh fixes that problem and maintain the
    compatibility intended with the ppc64 symlink.
    
    Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 747613961425127da9e14e020500b184d4f7a42c
Author: Anton Blanchard <anton@samba.org>
Date:   Sun Aug 14 14:30:30 2011 +0000

    powerpc/pseries: Avoid spurious error during hotplug CPU add
    
    commit 9c740025c51a26ab00192cfc464064d4ccbfe3fc upstream.
    
    During hotplug CPU add we get the following error:
    
    Unexpected Error (0) returned from configure-connector
    
    ibm,configure-connector returns 0 for configuration complete, so
    catch this and avoid the error.
    
    Signed-off-by: Anton Blanchard <anton@samba.org>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 55a6bcf9d9a66921b7a7a854ca86356e901114fe
Author: Anton Blanchard <anton@samba.org>
Date:   Wed Aug 10 20:44:24 2011 +0000

    powerpc: Fix oops when echoing bad values to /sys/devices/system/memory/probe
    
    commit a11940978bd598e65996b4f807cf4904793f7025 upstream.
    
    If we echo an address the hypervisor doesn't like to
    /sys/devices/system/memory/probe we oops the box:
    
    # echo 0x10000000000 > /sys/devices/system/memory/probe
    
    kernel BUG at arch/powerpc/mm/hash_utils_64.c:541!
    
    The backtrace is:
    
    create_section_mapping
    arch_add_memory
    add_memory
    memory_probe_store
    sysdev_class_store
    sysfs_write_file
    vfs_write
    SyS_write
    
    In create_section_mapping we BUG if htab_bolt_mapping returned
    an error. A better approach is to return an error which will
    propagate back to userspace.
    
    Rerunning the test with this patch applied:
    
    # echo 0x10000000000 > /sys/devices/system/memory/probe
    -bash: echo: write error: Invalid argument
    
    Signed-off-by: Anton Blanchard <anton@samba.org>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 2b7940d84f184ad4b71cf66465bb55212d3b3fd8
Author: Anton Blanchard <anton@samba.org>
Date:   Wed Aug 10 20:44:21 2011 +0000

    powerpc/numa: Remove double of_node_put in hot_add_node_scn_to_nid
    
    commit 6083184269fd723affca4f6340e491950267622a upstream.
    
    During memory hotplug testing, I got the following warning:
    
    ERROR: Bad of_node_put() on /memory@0
    
    of_node_release
    kref_put
    of_node_put
    of_find_node_by_type
    hot_add_node_scn_to_nid
    hot_add_scn_to_nid
    memory_add_physaddr_to_nid
    ...
    
    of_find_node_by_type() loop does the of_node_put for us so we only
    need the handle the case where we terminate the loop early.
    
    As suggested by Stephen Rothwell we can do the of_node_put
    unconditionally outside of the loop since of_node_put handles a
    NULL argument fine.
    
    Signed-off-by: Anton Blanchard <anton@samba.org>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 656460cd7714653cf60a10c79e02cbfe2d9bf732
Author: Al Viro <viro@ZenIV.linux.org.uk>
Date:   Mon Nov 7 21:21:26 2011 +0000

    VFS: we need to set LOOKUP_JUMPED on mountpoint crossing
    
    commit a3fbbde70a0cec017f2431e8f8de208708c76acc upstream.
    
    Mountpoint crossing is similar to following procfs symlinks - we do
    not get ->d_revalidate() called for dentry we have arrived at, with
    unpleasant consequences for NFS4.
    
    Simple way to reproduce the problem in mainline:
    
        cat >/tmp/a.c <<'EOF'
        #include <unistd.h>
        #include <fcntl.h>
        #include <stdio.h>
        main()
        {
                struct flock fl = {.l_type = F_RDLCK, .l_whence = SEEK_SET, .l_len = 1};
                if (fcntl(0, F_SETLK, &fl))
                        perror("setlk");
        }
        EOF
        cc /tmp/a.c -o /tmp/test
    
    then on nfs4:
    
        mount --bind file1 file2
        /tmp/test < file1		# ok
        /tmp/test < file2		# spews "setlk: No locks available"...
    
    What happens is the missing call of ->d_revalidate() after mountpoint
    crossing and that's where NFS4 would issue OPEN request to server.
    
    The fix is simple - treat mountpoint crossing the same way we deal with
    following procfs-style symlinks.  I.e.  set LOOKUP_JUMPED...
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 0447f4d5654bb5d95008f16dad839104f8d0d39a
Author: Mike Miller <mike.miller@hp.com>
Date:   Fri Oct 21 08:19:43 2011 +0200

    hpsa: add small delay when using PCI Power Management to reset for kump
    
    commit c4853efec665134b2e6fc9c13447323240980351 upstream.
    
    The P600 requires a small delay when changing states. Otherwise we may think
    the board did not reset and we bail. This for kdump only and is particular
    to the P600.
    
    Signed-off-by: Mike Miller <mike.miller@hp.com>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 8185df43d48a71605934d9a7c6db4d93e7b25d5c
Author: Dan McGee <dpmcgee@gmail.com>
Date:   Tue Nov 1 18:23:10 2011 -0500

    VFS: fix statfs() automounter semantics regression
    
    commit 5c8a0fbba543d9428a486f0d1282bbcf3cf1d95a upstream.
    
    No one in their right mind would expect statfs() to not work on a
    automounter managed mount point. Fix it.
    
    [ I'm not sure about the "no one in their right mind" part.  It's not
      mounted, and you didn't ask for it to be mounted.  But nobody will
      really care, and this probably makes it match previous semantics, so..
          - Linus ]
    
    This mirrors the fix made to the quota code in 815d405ceff0d69646.
    
    Signed-off-by: Dan McGee <dpmcgee@gmail.com>
    Cc: Trond Myklebust <Trond.Myklebust@netapp.com>
    Cc: Alexander Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 9ad93ba528bf5555a96ef64b7ec1af398277ad52
Author: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Date:   Mon Oct 10 12:33:21 2011 -0400

    xen/blkback: Report VBD_WSECT (wr_sect) properly.
    
    commit 5c62cb48602dba95159c81ffeca179d3852e25be upstream.
    
    We did not increment the amount of sectors written to disk
    b/c we tested for the == WRITE which is incorrect - as the
    operations are more of WRITE_FLUSH, WRITE_ODIRECT. This patch
    fixes it by doing a & WRITE check.
    
    Reported-by: Andy Burns <xen.lists@burns.me.uk>
    Suggested-by: Ian Campbell <Ian.Campbell@citrix.com>
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit f53881e6463124c910b17a5ea722a5cf5ab67fb3
Author: Tejun Heo <tj@kernel.org>
Date:   Mon Oct 17 13:42:43 2011 +0200

    block: make gendisk hold a reference to its queue
    
    commit f992ae801a7dec34a4ed99a6598bbbbfb82af4fb upstream.
    
    The following command sequence triggers an oops.
    
    # mount /dev/sdb1 /mnt
    # echo 1 > /sys/class/scsi_device/0\:0\:1\:0/device/delete
    # umount /mnt
    
     general protection fault: 0000 [#1] PREEMPT SMP
     CPU 2
     Modules linked in:
    
     Pid: 791, comm: umount Not tainted 3.1.0-rc3-work+ #8 Bochs Bochs
     RIP: 0010:[<ffffffff810d0879>]  [<ffffffff810d0879>] __lock_acquire+0x389/0x1d60
    ...
     Call Trace:
      [<ffffffff810d2845>] lock_acquire+0x95/0x140
      [<ffffffff81aed87b>] _raw_spin_lock+0x3b/0x50
      [<ffffffff811573bc>] bdi_lock_two+0x5c/0x70
      [<ffffffff811c2f6c>] bdev_inode_switch_bdi+0x4c/0xf0
      [<ffffffff811c3fcb>] __blkdev_put+0x11b/0x1d0
      [<ffffffff811c4010>] __blkdev_put+0x160/0x1d0
      [<ffffffff811c40df>] blkdev_put+0x5f/0x190
      [<ffffffff8118f18d>] kill_block_super+0x4d/0x80
      [<ffffffff8118f4a5>] deactivate_locked_super+0x45/0x70
      [<ffffffff8119003a>] deactivate_super+0x4a/0x70
      [<ffffffff811ac4ad>] mntput_no_expire+0xed/0x130
      [<ffffffff811acf2e>] sys_umount+0x7e/0x3a0
      [<ffffffff81aeeeab>] system_call_fastpath+0x16/0x1b
    
    This is because bdev holds on to disk but disk doesn't pin the
    associated queue.  If a SCSI device is removed while the device is
    still open, the sdev puts the base reference to the queue on release.
    When the bdev is finally released, the associated queue is already
    gone along with the bdi and bdev_inode_switch_bdi() ends up
    dereferencing already freed bdi.
    
    Even if it were not for this bug, disk not holding onto the associated
    queue is very unusual and error-prone.
    
    Fix it by making add_disk() take an extra reference to its queue and
    put it on disk_release() and ensuring that disk and its fops owner are
    put in that order after all accesses to the disk and queue are
    complete.
    
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Cc: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 6fa9e3e3e01b8741eead6e00bb968ef3b4fddc3f
Author: NeilBrown <neilb@suse.de>
Date:   Tue Oct 25 10:25:49 2011 +1100

    NFS/sunrpc: don't use a credential with extra groups.
    
    commit dc6f55e9f8dac4b6479be67c5c9128ad37bb491f upstream.
    
    The sunrpc layer keeps a cache of recently used credentials and
    'unx_match' is used to find the credential which matches the current
    process.
    
    However unx_match allows a match when the cached credential has extra
    groups at the end of uc_gids list which are not in the process group list.
    
    So if a process with a list of (say) 4 group accesses a file and gains
    access because of the last group in the list, then another process
    with the same uid and gid, and a gid list being the first tree of the
    gids of the original process tries to access the file, it will be
    granted access even though it shouldn't as the wrong rpc credential
    will be used.
    
    Signed-off-by: NeilBrown <neilb@suse.de>
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 22bef71b2e411ee05b9b9199394c3a209924926f
Author: Mark Brown <broonie@opensource.wolfsonmicro.com>
Date:   Tue Nov 1 13:53:37 2011 +0000

    ASoC: Ensure the WM8962 oscillator and PLLs start up disabled
    
    commit 2af8de8c39cf58e5a5e40a9d5d71332da98e6ba7 upstream.
    
    Since there is no current software control for these they would otherwise
    be left enabled, consuming power.
    
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 6601dc2a3a0518851fd47b8a7e34e624c3ddceef
Author: Mark Brown <broonie@opensource.wolfsonmicro.com>
Date:   Tue Nov 1 13:36:10 2011 +0000

    ASoC: Ensure WM8962 PLL registers are reset
    
    commit 4f4488abc97c1c27ff029f887944e6a6da1f5733 upstream.
    
    The WM8962 has a separate software reset for the PLL registers. Ensure that
    these are reset also on startup.
    
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit f11d1a122ac23d7da2dedd0104851b58461e32b3
Author: Hong Xu <hong.xu@atmel.com>
Date:   Fri Oct 28 15:36:39 2011 +0800

    ASoC: WM8904: Set `invert' bit for Capture Switch
    
    commit 5a7c5f26df3c0122814dfa1c13ef6dfbdbffdb86 upstream.
    
    Set `invert' bit for Capture Switch. Otherwise analogue is muted when
    Capture Switch is ON.
    
    Signed-off-by: Hong Xu <hong.xu@atmel.com>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit a8c34bb24eb25d50481528cbfc70e29bde147cc2
Author: Axel Lin <axel.lin@gmail.com>
Date:   Fri Oct 28 15:17:56 2011 +0800

    ASoC: Leave input audio data bit length settings untouched in wm8711_set_dai_fmt
    
    commit d558cfc30064a97c2c65dbd2b3a4f5a1dea7ec1b upstream.
    
    Current implementation in wm8711_set_dai_fmt always clear BIT[3:2]
    (the Input Audio Data Bit Length Select) of WM8711_IFACE(07h) register.
    Input Audio Data Bit Length Select bits are set by wm8711_hw_params,
    we should leave BIT[3:2] untouched in wm8711_set_dai_fmt.
    
    Signed-off-by: Axel Lin <axel.lin@gmail.com>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 9eb72dda42ed9162026d69aabcdc0528d7994193
Author: Axel Lin <axel.lin@gmail.com>
Date:   Fri Oct 28 11:08:01 2011 +0800

    ASoC: wm8711: Fix wrong mask for setting input audio data bit length select
    
    commit 04c57163c8edfbc50e022737014069998ba4fc5f upstream.
    
    The Input Audio Data Bit Length Select is controlled by BIT[3:2] of
    WM8711_IFACE(07h) register.
    Current code incorrectly masks BIT[1:0] which is for Audio Data Format Select.
    
    Signed-off-by: Axel Lin <axel.lin@gmail.com>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit ac310457b4fd7634983788faf0c4f29cd2d5384b
Author: nagalakshmi.nandigama@lsi.com <nagalakshmi.nandigama@lsi.com>
Date:   Fri Oct 21 10:06:33 2011 +0530

    mpt2sas: Fix for system hang when discovery in progress
    
    commit 0167ac67ff6f35bf2364f7672c8012b0cd40277f upstream.
    
    Fix for issue : While discovery is in progress, hot unplug and hot plug of
    enclosure connected to the controller card is causing system to hang.
    
    When a device is in the process of being detected at driver load time then
    if it is removed, the device that is no longer present will not be added
    to the list. So the code in _scsih_probe_sas() is rearranged as such so
    the devices that failed to be detected are not added to the list.
    
    Signed-off-by: Nagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 6fffe112243a02792d352087d32bf05ccb2cf90d
Author: Anton Blanchard <anton@samba.org>
Date:   Thu Nov 3 08:56:22 2011 +1100

    Fix block queue and elevator memory leak in scsi_alloc_sdev
    
    commit f7c9c6bb14f3104608a3a83cadea10a6943d2804 upstream.
    
    When looking at memory consumption issues I noticed quite a
    lot of memory in the kmalloc-2048 bucket:
    
      OBJS ACTIVE  USE OBJ SIZE  SLABS OBJ/SLAB CACHE SIZE NAME
      6561   6471  98%    2.30K    243       27     15552K kmalloc-2048
    
    Over 15MB. slub debug shows that cfq is responsible for almost
    all of it:
    
    # sort -nr /sys/kernel/slab/kmalloc-2048/alloc_calls
    6402 .cfq_init_queue+0xec/0x460 age=43423/43564/43655 pid=1 cpus=4,11,13
    
    In scsi_alloc_sdev we do scsi_alloc_queue but if slave_alloc
    fails we don't free it with scsi_free_queue.
    
    The patch below fixes the issue:
    
      OBJS ACTIVE  USE OBJ SIZE  SLABS OBJ/SLAB CACHE SIZE NAME
       135     72  53%    2.30K      5       27       320K kmalloc-2048
    
    # cat /sys/kernel/slab/kmalloc-2048/alloc_calls
    3 .cfq_init_queue+0xec/0x460 age=3811/3876/3925 pid=1 cpus=4,11,13
    
    Signed-off-by: Anton Blanchard <anton@samba.org>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 8fa9474347f32c7991adc1271e6f34e01479dd31
Author: Bart Van Assche <bvanassche@acm.org>
Date:   Fri Sep 23 19:48:18 2011 +0200

    Make scsi_free_queue() kill pending SCSI commands
    
    commit 3308511c93e6ad0d3c58984ecd6e5e57f96b12c8 upstream.
    
    Make sure that SCSI device removal via scsi_remove_host() does finish
    all pending SCSI commands. Currently that's not the case and hence
    removal of a SCSI host during I/O can cause a deadlock. See also
    "blkdev_issue_discard() hangs forever if underlying storage device is
    removed" (http://bugzilla.kernel.org/show_bug.cgi?id=40472). See also
    http://lkml.org/lkml/2011/8/27/6.
    
    Signed-off-by: Bart Van Assche <bvanassche@acm.org>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 51b702dc3de6c2b5ba3c091f755271776bce7ee4
Author: Moger, Babu <Babu.Moger@netapp.com>
Date:   Wed Oct 26 14:29:38 2011 -0400

    scsi_dh: check queuedata pointer before proceeding further
    
    commit a18a920c70d48a8e4a2b750d8a183b3c1a4be514 upstream.
    
    This patch validates sdev pointer in scsi_dh_activate before proceeding further.
    
    Without this check we might see the panic as below. I have seen this
    panic multiple times..
    
    Call trace:
    
     #0 [ffff88007d647b50] machine_kexec at ffffffff81020902
     #1 [ffff88007d647ba0] crash_kexec at ffffffff810875b0
     #2 [ffff88007d647c70] oops_end at ffffffff8139c650
     #3 [ffff88007d647c90] __bad_area_nosemaphore at ffffffff8102dd15
     #4 [ffff88007d647d50] page_fault at ffffffff8139b8cf
        [exception RIP: scsi_dh_activate+0x82]
        RIP: ffffffffa0041922  RSP: ffff88007d647e00  RFLAGS: 00010046
        RAX: 0000000000000000  RBX: 0000000000000000  RCX: 00000000000093c5
        RDX: 00000000000093c5  RSI: ffffffffa02e6640  RDI: ffff88007cc88988
        RBP: 000000000000000f   R8: ffff88007d646000   R9: 0000000000000000
        R10: ffff880082293790  R11: 00000000ffffffff  R12: ffff88007cc88988
        R13: 0000000000000000  R14: 0000000000000286  R15: ffff880037b845e0
        ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0000
     #5 [ffff88007d647e38] run_workqueue at ffffffff81060268
     #6 [ffff88007d647e78] worker_thread at ffffffff81060386
     #7 [ffff88007d647ee8] kthread at ffffffff81064436
     #8 [ffff88007d647f48] kernel_thread at ffffffff81003fba
    
    Signed-off-by: Babu Moger <babu.moger@netapp.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 292b3893b8e010398a338b482f40cbcd62e01a97
Author: Petr Uzel <petr.uzel@suse.cz>
Date:   Fri Oct 21 13:31:09 2011 +0200

    st: fix race in st_scsi_execute_end
    
    commit c68bf8eeaa57c852e74adcf597237be149eef830 upstream.
    
    The call to complete() in st_scsi_execute_end() wakes up sleeping thread
    in write_behind_check(), which frees the st_request, thus invalidating
    the pointer to the associated bio structure, which is then passed to the
    blk_rq_unmap_user(). Fix by storing pointer to bio structure into
    temporary local variable.
    
    This bug is present since at least linux-2.6.32.
    
    Signed-off-by: Petr Uzel <petr.uzel@suse.cz>
    Reported-by: Juergen Groß <juergen.gross@ts.fujitsu.com>
    Reviewed-by: Jan Kara <jack@suse.cz>
    Acked-by: Kai Mäkisara <kai.makisara@kolumbus.fi>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit fef547148349098f58bcea1c6cda5be1f6f8719c
Author: Nicholas Bellinger <nab@linux-iscsi.org>
Date:   Mon Oct 24 13:35:37 2011 -0700

    tcm_loop: Add explict read buffer memset for SCF_SCSI_CONTROL_SG_IO_CDB
    
    commit 8cd79f24350826b81e16990d9e12bc878e67d385 upstream.
    
    This patch addresses an issue with buggy userspace code sending I/O
    via scsi-generic that does not explictly clear their associated read
    buffers.  It adds an explict memset of the first SGL entry within
    tcm_loop_new_cmd_map() for SCF_SCSI_CONTROL_SG_IO_CDB payloads that
    are currently guaranteed to be a single SGL by target-core code.
    
    This issue is a side effect of the v3.1-rc1 merge to remove the
    extra memcpy between certain control CDB types using a contigious
    + cleared buffer in target-core, and performing a memcpy into the
    SGL list within tcm_loop.
    
    It was originally mainfesting itself by udev + scsi_id + scsi-generic
    not properly setting up the expected /dev/disk/by-id/ symlinks because
    the INQUIRY payload was containing extra bogus data preventing the
    proper NAA IEEE WWN from being parsed by userspace.
    
    Cc: Christoph Hellwig <hch@lst.de>
    Cc: Andy Grover <agrover@redhat.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 24b791339f0e80761de402cbb13ff2ddb19b8c03
Author: Guenter Roeck <guenter.roeck@ericsson.com>
Date:   Sun Nov 6 20:25:18 2011 +0100

    hwmon: (w83627ehf) Fix broken driver init
    
    commit bfa02b0da66965caf46e441270af87edda4fea14 upstream.
    
    Commit 2265cef2 (hwmon: (w83627ehf) Properly report PECI and AMD-SI
    sensor types) results in kernel panic if data->temp_label was not
    initialized.
    The problem was found with chip W83627DHG-P.
    
    Add check if data->temp->label was set before use.
    
    Based on incomplete patch by Alexander Beregalov.
    
    Reported-by: Alexander Beregalov <a.beregalov@gmail.com>
    Tested-by: Alexander Beregalov <a.beregalov@gmail.com>
    Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
    Signed-off-by: Jean Delvare <khali@linux-fr.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit e3c298129b14f1591e647320bba3f9bc21ea63f1
Author: Jean Delvare <khali@linux-fr.org>
Date:   Fri Nov 4 12:00:47 2011 +0100

    hwmon: (w83627ehf) Properly report PECI and AMD-SI sensor types
    
    commit 2265cef2751b3441df91f85e0107f9f549e5b711 upstream.
    
    When temperature sources are PECI or AMD-SI agents, it makes no sense
    to report their type as diode or thermistor. Instead we must report
    their digital nature.
    
    Signed-off-by: Jean Delvare <khali@linux-fr.org>
    Acked-by: Guenter Roeck <guenter.roeck@ericsson.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 0fb2a32e2c8f58b5d43846e4de46364998f9af5d
Author: Jean Delvare <khali@linux-fr.org>
Date:   Sun Nov 6 20:25:18 2011 +0100

    hwmon: (coretemp) Fix for non-SMP builds
    
    commit 2aba6cac2a84f3b80e11a680c34d55e7739b474d upstream.
    
    The definition of TO_ATTR_NO in the non-SMP case is wrong. As the SMP
    definition resolves to the correct value, just use this for both
    cases.
    
    Without this fix the temperature attributes are named temp0_* instead
    of temp2_*, so libsensors won't pick them. Broken since kernel 3.0.
    
    Signed-off-by: Jean Delvare <khali@linux-fr.org>
    Tested-by: Phil Sutter <phil@nwl.cc>
    Acked-by: Durgadoss R <Durgadoss.r@intel.com>
    Acked-by: Guenter Roeck <guenter.roeck@ericsson.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit fa7e2a6289195e502003f59768837107a59678c0
Author: Mike Miller <mike.miller@hp.com>
Date:   Thu Oct 20 22:19:17 2011 +0200

    cciss: add small delay when using PCI Power Management to reset for kump
    
    commit ab5dbebe33e0c353e8545f09c34553ac3351dad6 upstream.
    
    The P600 requires a small delay when changing states. Otherwise we may think
    the board did not reset and we bail. This for kdump only and is particular
    to the P600.
    
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 5432c16a57990f12d41f57ed99ba194c368c30d0
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Fri Nov 4 00:52:46 2011 +0100

    USB: Update last_busy time after autosuspend fails
    
    commit b2c0a863e14676fa5760c6d828fd373288e2f64a upstream.
    
    Originally, the runtime PM core would send an idle notification
    whenever a suspend attempt failed.  The idle callback routine could
    then schedule a delayed suspend for some time later.
    
    However this behavior was changed by commit
    f71648d73c1650b8b4aceb3856bebbde6daa3b86 (PM / Runtime: Remove idle
    notification after failing suspend).  No notifications were sent, and
    there was no clear mechanism to retry failed suspends.
    
    This caused problems for the usbhid driver, because it fails
    autosuspend attempts as long as a key is being held down.  A companion
    patch changes the PM core's behavior, but we also need to change the
    USB core.  In particular, this patch (as1493) updates the device's
    last_busy time when an autosuspend fails, so that the PM core will
    retry the autosuspend in the future when the delay time expires
    again.
    
    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Tested-by: Henrik Rydberg <rydberg@euromail.se>
    Acked-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 8dc9c7911421d8e45901ffaf483b5dca99cbb055
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Thu Nov 3 23:39:18 2011 +0100

    PM / Runtime: Automatically retry failed autosuspends
    
    commit 886486b792e4f6f96d4fbe8ec5bf20811cab7d6a upstream.
    
    Originally, the runtime PM core would send an idle notification
    whenever a suspend attempt failed.  The idle callback routine could
    then schedule a delayed suspend for some time later.
    
    However this behavior was changed by commit
    f71648d73c1650b8b4aceb3856bebbde6daa3b86 (PM / Runtime: Remove idle
    notification after failing suspend).  No notifications were sent, and
    there was no clear mechanism to retry failed suspends.
    
    This caused problems for the usbhid driver, because it fails
    autosuspend attempts as long as a key is being held down.  Therefore
    this patch (as1492) adds a mechanism for retrying failed
    autosuspends.  If the callback routine updates the last_busy field so
    that the next autosuspend expiration time is in the future, the
    autosuspend will automatically be rescheduled.
    
    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Tested-by: Henrik Rydberg <rydberg@euromail.se>
    Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 2d92f691cd1a1be5cdefb10d559fdd7443d4df7a
Author: Srinivas Kandagatla <srinivas.kandagatla@st.com>
Date:   Tue Aug 2 18:49:52 2011 +0100

    kbuild: Fix help text not displayed in choice option.
    
    commit 3f198dfee49d2e9c30583c62b0c79286c78c7b44 upstream.
    
    Help text under choice menu is never displayed because it does not have
    symbol name associated with it, however many kconfigs have help text
    under choice, assuming that it will be displayed when user selects help.
    for example in Kconfig if we have:
    choice
            prompt "Choice"
            ---help---
               HELP TEXT ...
    
    config A
            bool "A"
    
    config B
            bool "B"
    
    endchoice
    
    Without this patch "HELP TEXT" is not displayed when user selects help
    option when "Choice" is highlighted from menuconfig or xconfig or
    gconfig.
    
    This patch changes the logic in menu_get_ext_help to display help for
    cases which dont have symbol names like choice.
    
    Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@st.com>
    Reviewed-by: Stuart Menefy <stuart.menefy@st.com>
    Reviewed-by: Arnaud Lacombe <lacombar@gmail.com>
    Signed-off-by: Michal Marek <mmarek@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 7a427e433356a354b29459b745ebd8103df96329
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Thu Nov 3 11:21:39 2011 -0400

    drm/radeon/kms: set HPD polarity in hpd_init()
    
    commit 64912e997f0fe13512e4c7b90e4f7c11cb922ab5 upstream.
    
    Polarity needs to be set accordingly to connector status (connected
    or disconnected). Set it up in hpd_init() so first hotplug works
    reliably no matter what is the initial set of connector. hpd_init()
    also covers resume so HPD will work correctly after resume as well.
    
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Cc: Jerome Glisse <j.glisse@gmail.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 053b6d52c7484feaaea4945140dd0a2dde3461e8
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Tue Nov 1 14:20:30 2011 -0400

    drm/radeon/kms: add MSI module parameter
    
    commit a18cee15ed4c8b6a35f96b7b26a46bac32e04bd9 upstream.
    
    Allow the user to override whether MSIs are enabled
    or not on supported ASICs.  MSIs are disabled by default
    on IGP chips as they tend not to work.  However certain
    IGP chips only seem to work with MSIs enabled.
    
    I suspect this is a chipset or bios issue, but I'm not sure
    what the proper fix is.  This will at least make diagnosing
    and working around the problem much easier.
    
    See:
    https://bugs.freedesktop.org/show_bug.cgi?id=37679
    
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 957450510b2c59f3689e6114de6b32d5d3aad7c6
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Tue Nov 1 14:14:18 2011 -0400

    drm/radeon/kms: Add MSI quirk for Dell RS690
    
    commit 01e718ec194e30b3e8eb3858c742c13649757efc upstream.
    
    Some Dell laptops only seem to work with MSIs.  This
    looks like a platform/bios bug.
    
    Fixes:
    https://bugs.freedesktop.org/show_bug.cgi?id=37679
    
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 35f6259abb1d8153d6a7552895e8126b8bcf2c61
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Mon Oct 31 08:54:41 2011 -0400

    drm/radeon/kms: properly set panel mode for eDP
    
    commit 00dfb8df5bf8c3afe4c0bb8361133156b06b7a2c upstream.
    
    This should make eDP more reliable.
    
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit ff356c22478a5487e2edaaad31f60bc3868c43f5
Author: Jerome Glisse <jglisse@redhat.com>
Date:   Fri Oct 28 17:52:34 2011 -0400

    drm/radeon: set hpd polarity at init time so hotplug detect works
    
    commit 8ab250d4484b72ccc78e34276c5ffa84c1d41303 upstream.
    
    Polarity needs to be set accordingly to connector status (connected
    or disconnected). Set it up at module init so first hotplug works
    reliably no matter what is the initial set of connector.
    
    Signed-off-by: Jerome Glisse <jglisse@redhat.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit be72d16568ac4058c41baa5fb75ce906d39b9dcd
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Tue Oct 25 15:11:08 2011 -0400

    drm/radeon/kms: Add MSI quirk for HP RS690
    
    commit b362105f7f5223fa4d2e03ceeea0e51da754ccc6 upstream.
    
    Some HP laptops only seem to work with MSIs.  This
    looks like a platform/bios bug.
    
    Fixes:
    https://bugs.freedesktop.org/show_bug.cgi?id=37679
    
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit fd33e34e106cb531435e4f7ed058c0c93a26c9d7
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Tue Oct 25 14:58:49 2011 -0400

    drm/radeon/kms: split MSI check into a separate function
    
    commit 8f6c25c59b0c895c68cae59d1b34e9a7b36971bc upstream.
    
    This makes it easier to add quirks for certain systems.
    
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 3fa1ae816c22f98f0f933ad77da681ab28f7845d
Author: Jerome Glisse <jglisse@redhat.com>
Date:   Mon Oct 24 18:16:34 2011 -0400

    drm/radeon: avoid bouncing connector status btw disconnected & unknown
    
    commit 340764465aa4a586ca332e61ae64883e5ad6f183 upstream.
    
    Since force handling rework of d0d0a225e6ad43314c9aa7ea081f76adc5098ad4
    we could end up bouncing connector status btw disconnected and unknown.
    When connector status change a call to output_poll_changed happen which
    in turn ask again for detect but with force set.
    
    So set the load detect flags whenever we report the connector as
    connected or unknown this avoid bouncing btw disconnected and unknown.
    
    Signed-off-by: Jerome Glisse <jglisse@redhat.com>
    Reviewed-by: Alex Deucher <alexdeucher@gmail.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Cc: Stefan Lippers-Hollmann <s.L-H@gmx.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit d429701077f158a4b7bdf4a8490d3ed9847217e5
Author: Takashi Iwai <tiwai@suse.de>
Date:   Thu Nov 3 16:54:06 2011 +0100

    ALSA: hda/realtek - Skip invalid digital out pins
    
    commit 51e4152a969aa6d2306492ebf143932dcb535c9b upstream.
    
    Some BIOS report invalid pins as digital output pins.  The driver checks
    the connection but it doesn't do it fully correctly, and it leaves some
    undefined value as the audio-out widget, which makes the driver spewing
    warnings.  This patch fixes the issue.
    
    Reference: https://bugzilla.novell.com/show_bug.cgi?id=727348
    
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit ec0baacddc46b83b95b6bb4245f16a3c7d16988b
Author: Charles Chin <Charles.Chin@idt.com>
Date:   Wed Nov 2 07:56:58 2011 +0100

    ALSA: hda - Add support for 92HD65 / 92HD66 family of codecs
    
    commit ad5d8755116b431f0709c745ee17cb567a478d43 upstream.
    
    These codecs have SPDIF-in, which is new to the 92HD83xxx compatible
    families, so a bit of logic is added to support them.
    
    Signed-off-by: Charles Chin <Charles.Chin@idt.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit a7ae01515249c673c1e8e8ad5addd6920b980a3b
Author: Charles Chin <Charles.Chin@idt.com>
Date:   Wed Nov 2 07:53:30 2011 +0100

    ALSA: hda - Disable power-widget control for IDT 92HD83/93 as default
    
    commit 35c11777b906042eca9e6f1c03e464726c7faa07 upstream.
    
    The power-widget control in patch_stac92hd83xxx() never worked properly,
    thus it's safer to turn it off as default for now.
    
    Signed-off-by: Charles Chin <Charles.Chin@idt.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit c52e585cf03d3faa89ace0368bf66a3298e66a8b
Author: Clemens Ladisch <clemens@ladisch.de>
Date:   Sat Oct 15 23:19:25 2011 +0200

    ALSA: ua101: fix crash when unplugging
    
    commit 862a6244eb9f9f5123fe819454fcfcae0ee1f2f9 upstream.
    
    If the device is unplugged while running, it is possible for a PCM
    device to be closed after the disconnect callback has returned.  This
    means that kill_stream_urb() and disable_iso_interface() would try to
    access already-invalid or freed USB data structures.
    
    The function free_usb_related_resources() was intended to prevent this,
    but forgot to clear the affected variables.
    
    Reported-and-tested-by: Olivier Courtay <olivier@courtay.org>
    Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 5796ee30587cb5f887a7fe6182c2bbcc3d31f0ad
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Tue Oct 25 02:30:50 2011 +0000

    net: Unlock sock before calling sk_free()
    
    [ Upstream commit b0691c8ee7c28a72748ff32e91b165ec12ae4de6 ]
    
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit ce0f562ecf544f386b6ae95f490cd06f7da2deb4
Author: stephen hemminger <shemminger@vyatta.com>
Date:   Mon Oct 3 18:14:45 2011 +0000

    bridge: leave carrier on for empty bridge
    
    [ Upstream commit b64b73d7d0c480f75684519c6134e79d50c1b341 ]
    
    This resolves a regression seen by some users of bridging.
    Some users use the bridge like a dummy device.
    They expect to be able to put an IPv6 address on the device
    with no ports attached. Although there are better ways of doing
    this, there is no reason to not allow it.
    
    Note: the bridge still will reflect the state of ports in the
    bridge if there are any added.
    
    Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 621112ec06bbe3a6dbb6af5f4db3451d01b309f9
Author: Andrea Arcangeli <aarcange@redhat.com>
Date:   Wed Nov 2 13:37:36 2011 -0700

    thp: share get_huge_page_tail()
    
    commit b35a35b556f5e6b7993ad0baf20173e75c09ce8c upstream.
    
    This avoids duplicating the function in every arch gup_fast.
    
    Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: Johannes Weiner <jweiner@redhat.com>
    Cc: Rik van Riel <riel@redhat.com>
    Cc: Mel Gorman <mgorman@suse.de>
    Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Cc: David Gibson <david@gibson.dropbear.id.au>
    Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
    Cc: David Miller <davem@davemloft.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 1a2417c30c86961992afae7eb8f803acca2f6b9b
Author: Andrea Arcangeli <aarcange@redhat.com>
Date:   Wed Nov 2 13:37:28 2011 -0700

    s390: gup_huge_pmd() return 0 if pte changes
    
    commit 0693bc9ce2cc4f6a1b9c3c05790fc149a74c0b87 upstream.
    
    s390 didn't return 0 in that case, if it's rolling back the *nr pointer it
    should also return zero to avoid adding pages to the array at the wrong
    offset.
    
    Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: Johannes Weiner <jweiner@redhat.com>
    Cc: Rik van Riel <riel@redhat.com>
    Cc: Mel Gorman <mgorman@suse.de>
    Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Cc: David Gibson <david@gibson.dropbear.id.au>
    Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
    Cc: David Miller <davem@davemloft.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 7a093bf2f9356230afccb4b79091787feb5aed97
Author: Andrea Arcangeli <aarcange@redhat.com>
Date:   Wed Nov 2 13:37:25 2011 -0700

    s390: gup_huge_pmd() support THP tail recounting
    
    commit 220a2eb228d032acde60e9fd044ca802706ff583 upstream.
    
    Up to this point the code assumed old refcounting for hugepages (pre-thp).
    This updates the code directly to the thp mapcount tail page refcounting.
    
    Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: Johannes Weiner <jweiner@redhat.com>
    Cc: Rik van Riel <riel@redhat.com>
    Cc: Mel Gorman <mgorman@suse.de>
    Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Cc: David Gibson <david@gibson.dropbear.id.au>
    Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
    Cc: David Miller <davem@davemloft.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 2429d1c2f20466effdc70ced613f591f8675059f
Author: Andrea Arcangeli <aarcange@redhat.com>
Date:   Wed Nov 2 13:37:19 2011 -0700

    powerpc: gup_huge_pmd() return 0 if pte changes
    
    commit cf592bf768c4fa40282b8fce58a80820065de2cb upstream.
    
    powerpc didn't return 0 in that case, if it's rolling back the *nr pointer
    it should also return zero to avoid adding pages to the array at the wrong
    offset.
    
    Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: Johannes Weiner <jweiner@redhat.com>
    Cc: Rik van Riel <riel@redhat.com>
    Cc: Mel Gorman <mgorman@suse.de>
    Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Acked-by: David Gibson <david@gibson.dropbear.id.au>
    Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
    Cc: David Miller <davem@davemloft.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 87c2bd66eef0c5685bb29fd995f6b77fa4d07ed1
Author: Andrea Arcangeli <aarcange@redhat.com>
Date:   Wed Nov 2 13:37:15 2011 -0700

    powerpc: gup_hugepte() support THP based tail recounting
    
    commit 3526741f0964c88bc2ce511e1078359052bf225b upstream.
    
    Up to this point the code assumed old refcounting for hugepages (pre-thp).
    This updates the code directly to the thp mapcount tail page refcounting.
    
    Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: Johannes Weiner <jweiner@redhat.com>
    Cc: Rik van Riel <riel@redhat.com>
    Cc: Mel Gorman <mgorman@suse.de>
    Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Cc: David Gibson <david@gibson.dropbear.id.au>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit cf2f493ba5c49afe9efd3afa02a505e9b060832d
Author: Andrea Arcangeli <aarcange@redhat.com>
Date:   Wed Nov 2 13:37:11 2011 -0700

    powerpc: gup_hugepte() avoid freeing the head page too many times
    
    commit 8596468487e2062cae2aad56e973784e03959245 upstream.
    
    We only taken "refs" pins on the head page not "*nr" pins.
    
    Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: Johannes Weiner <jweiner@redhat.com>
    Cc: Rik van Riel <riel@redhat.com>
    Cc: Mel Gorman <mgorman@suse.de>
    Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Acked-by: David Gibson <david@gibson.dropbear.id.au>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit acafc792476742f042e2d7a3679dbaa097444ccc
Author: Andrea Arcangeli <aarcange@redhat.com>
Date:   Wed Nov 2 13:37:08 2011 -0700

    powerpc: get_hugepte() don't put_page() the wrong page
    
    commit 405e44f2e312dd5dd63e5a9f459bffcbcd4368ef upstream.
    
    "page" may have changed to point to the next hugepage after the loop
    completed, The references have been taken on the head page, so the
    put_page must happen there too.
    
    This is a longstanding issue pre-thp inclusion.
    
    It's totally unclear how these page_cache_add_speculative and
    pte_val(pte) != pte_val(*ptep) checks are necessary across all the
    powerpc gup_fast code, when x86 doesn't need any of that: there's no way
    the page can be freed with irq disabled so we're guaranteed the
    atomic_inc will happen on a page with page_count > 0 (so not needing the
    speculative check).
    
    The pte check is also meaningless on x86: no need to rollback on x86 if
    the pte changed, because the pte can still change a CPU tick after the
    check succeeded and it won't be rolled back in that case.  The important
    thing is we got a reference on a valid page that was mapped there a CPU
    tick ago.  So not knowing the soft tlb refill code of ppc64 in great
    detail I'm not removing the "speculative" page_count increase and the
    pte checks across all the code, but unless there's a strong reason for
    it they should be later cleaned up too.
    
    If a pte can change from huge to non-huge (like it could happen with
    THP) passing a pte_t *ptep to gup_hugepte() would also require to repeat
    the is_hugepd in gup_hugepte(), but that shouldn't happen with hugetlbfs
    only so I'm not altering that.
    
    Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: Johannes Weiner <jweiner@redhat.com>
    Cc: Rik van Riel <riel@redhat.com>
    Cc: Mel Gorman <mgorman@suse.de>
    Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Acked-by: David Gibson <david@gibson.dropbear.id.au>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 45a2755f0fd17acf45c7cea183815c65f28154c3
Author: Andrea Arcangeli <aarcange@redhat.com>
Date:   Wed Nov 2 13:37:03 2011 -0700

    powerpc: remove superfluous PageTail checks on the pte gup_fast
    
    commit 2839bdc1bfc0af76a2f0f11eca011590520a04fa upstream.
    
    This part of gup_fast doesn't seem capable of handling hugetlbfs ptes,
    those should be handled by gup_hugepd only, so these checks are
    superfluous.
    
    Plus if this wasn't a noop, it would have oopsed because, the insistence
    of using the speculative refcounting would trigger a VM_BUG_ON if a tail
    page was encountered in the page_cache_get_speculative().
    
    Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: Johannes Weiner <jweiner@redhat.com>
    Cc: Rik van Riel <riel@redhat.com>
    Cc: Mel Gorman <mgorman@suse.de>
    Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Acked-by: David Gibson <david@gibson.dropbear.id.au>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 8adc3d3df0562b8dc4008f458081dcc2d8b98863
Author: Oliver Hartkopp <socketcan@hartkopp.net>
Date:   Thu Sep 29 15:33:47 2011 -0400

    can bcm: fix incomplete tx_setup fix
    
    commit 12d0d0d3a7349daa95dbfd5d7df8146255bc7c67 upstream.
    
    The commit aabdcb0b553b9c9547b1a506b34d55a764745870 ("can bcm: fix tx_setup
    off-by-one errors") fixed only a part of the original problem reported by
    Andre Naujoks. It turned out that the original code needed to be re-ordered
    to reduce complexity and to finally fix the reported frame counting issues.
    
    Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 6d3607b179804e8ff4e2a1304ee238a4f6dc035c
Author: Andiry Xu <andiry.xu@amd.com>
Date:   Fri Sep 23 14:19:50 2011 -0700

    xHCI: Clear PLC for USB2 root hub ports
    
    commit 6fd4562178508a0949c9fdecd8558d8b10d671bd upstream.
    
    When the link state changes, xHC will report a port status change event
    and set the PORT_PLC bit, for both USB3 and USB2 root hub ports.
    
    The PLC will be cleared by usbcore for USB3 root hub ports, but not for
    USB2 ports, because they do not report USB_PORT_STAT_C_LINK_STATE in
    wPortChange.
    
    Clear it for USB2 root hub ports in handle_port_status().
    
    Signed-off-by: Andiry Xu <andiry.xu@amd.com>
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 1c349398c8583d23bdf397363aedaae55d889c03
Author: Andiry Xu <andiry.xu@amd.com>
Date:   Fri Sep 23 14:19:49 2011 -0700

    xHCI: test and clear RWC bit
    
    commit d2f52c9e585bbb1a3c164e02b8dcd0d996c67353 upstream.
    
    Introduce xhci_test_and_clear_bit() to clear RWC bit in PORTSC register.
    
    Signed-off-by: Andiry Xu <andiry.xu@amd.com>
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 567c6a1ce9d9417c33176bb848a6287f5bae6dd4
Author: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Date:   Fri Sep 2 11:05:40 2011 -0700

    xhci: If no endpoints changed, don't issue BW command.
    
    commit 2dc3753997f3c80ce8b950242ab9bb3fb936acfd upstream.
    
    Some alternate interface settings have no endpoints associated with them.
    This shows up in some USB webcams, particularly the Logitech HD 1080p,
    which uses the uvcvideo driver.  If a driver switches between two alt
    settings with no endpoints, there is no need to issue a configure endpoint
    command, because there is no endpoint information to update.
    
    The only time a configure endpoint command with just the add slot flag set
    makes sense is when the driver is updating hub characteristics in the slot
    context.  However, that code never calls xhci_check_bandwidth, so we
    should be safe not issuing a command if only the slot context add flag is
    set.
    
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 6eb006c6079fd54a260caf7dfb3c750f65f4b1fc
Author: Seth Forshee <seth.forshee@canonical.com>
Date:   Tue Jul 26 09:56:07 2011 -0500

    usb_storage: Don't freeze in usb-stor-scan
    
    commit f02fe890ece7d695a5744b20525d45312382e6e4 upstream.
    
    Scanning cannot be run during suspend or hibernation, but if
    usb-stor-scan freezes another thread waiting on scanning to
    complete may fail to freeze.
    
    However, if usb-stor-scan is left freezable without ever actually
    freezing then the freezer will wait on it to exit, and threads
    waiting for scanning to finish will no longer be blocked. One
    problem with this approach is that usb-stor-scan has a delay to
    wait for devices to settle (which is currently the only point where
    it can freeze). To work around this we can request that the freezer
    send a fake signal when freezing, then use interruptible sleep to
    wake the thread early when freezing happens.
    
    To make this happen, the following changes are made to
    usb-stor-scan:
    
     * Use set_freezable_with_signal() instead of set_freezable() to
       request a fake signal when freezing
    
     * Use wait_event_interruptible_timeout() instead of
       wait_event_freezable_timeout() to avoid freezing
    
    Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit b710365a9a762cb6cf931a066648daf9a941a9af
Author: Oliver Neukum <oneukum@suse.de>
Date:   Wed Sep 21 11:41:45 2011 +0200

    btusb: add device entry for Broadcom SoftSailing
    
    commit c510eae377c773241ff0b6369a8f3581da941a51 upstream.
    
    
    This device declares itself to be vendor specific
    It therefore needs to be added to the device table
    to make btusb bind.
    
    Signed-off-by: Oliver Neukum <oneukum@suse.de>
    Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 661a0d9aba272ad9e55449ce8eb9570a221b8489
Author: Jurgen Kramer <gtmkramer@xs4all.nl>
Date:   Sun Sep 4 18:01:42 2011 +0200

    Bluetooth: add support for 2011 mac mini
    
    commit f78b68261e80899f81a21dfdf91e2a1456ea8175 upstream.
    
    Today I noticed that the usb bluetooth adapter (BCM2046B1) on my 2011
    mac mini was not working. I've created a patch to get it going.
    
    Signed-off-by: Jurgen Kramer <gtmkramer@xs4all.nl>
    Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 4770ac2af6255b6c64d290606b54fa2e2bfcbe08
Author: Steven.Li <Steven.Li@Atheros.com>
Date:   Fri Jul 1 14:02:36 2011 +0800

    Bluetooth: Add Atheros AR3012 one PID/VID supported
    
    commit 2d25f8b462f3b849d8913d02978657ef06e67dd8 upstream.
    
    The new Ath3k needs to download patch and radio table,
    and it keeps same PID/VID even after downloading the patch and radio
    table. This patch is to use the bcdDevice (Device Release Number) to
    judge whether the chip has been patched or not. The init bcdDevice
    value of the chip is 0x0001, this value increases after patch and
    radio table downloading.
    
    Signed-off-by: Steven.Li <yongli@qca.qualcomm.com>
    Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 39361fcb63d49f4036af08473c503e006e063ddc
Author: Ricardo Mendoza <ricmm@gentoo.org>
Date:   Wed Jul 13 16:04:29 2011 +0100

    Bluetooth: Add Toshiba laptops AR30XX device ID
    
    commit 8e7c3d2e4ba18ee4cdcc1f89aec944fbff4ce735 upstream.
    
    Blacklist Toshiba-branded AR3011 based AR5B195 [0930:0215] and add to
    ath3k.c for firmware loading.
    
    Signed-off-by: Ricardo Mendoza <ricmm@gentoo.org>
    Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit efb1497bcc3a72b1617c6915bb62cf4dfa38c952
Author: Pieter-Augustijn Van Malleghem <p-a@scarlet.be>
Date:   Wed Sep 7 02:28:10 2011 -0400

    Bluetooth: Add MacBookAir4,1 support
    
    commit a63b723d02531f7add0b2b8a0e6a77ee176f1626 upstream.
    
    This patch against current git adds the hardware ID for the Apple
    MacBookAir4,1, released in July 2011. The device features a BCM2046
    USB chip. The patch was inspired by the previous modifications adding
    support for the MacBookAir3,x.
    
    Signed-off-by: Pieter-Augustijn Van Malleghem <p-a@scarlet.be>
    Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit f7f00215ba28400e0f61c55e14e3d619888231ae
Author: Marek Vasut <marek.vasut@gmail.com>
Date:   Tue Jul 26 16:44:47 2011 +0000

    ASIX: Use only 11 bits of header for data size
    
    commit bca0beb9363f8487ac902931a50eb00180a2d14a upstream.
    
    The AX88772B uses only 11 bits of the header for the actual size. The other bits
    are used for something else. This causes dmesg full of messages:
    
    	asix_rx_fixup() Bad Header Length
    
    This patch trims the check to only 11 bits. I believe on older chips, the
    remaining 5 top bits are unused.
    
    Signed-off-by: Marek Vasut <marek.vasut@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 611778cd2a87a9b7376994caf4faa0caac9d1037
Author: Marek Vasut <marek.vasut@gmail.com>
Date:   Tue Jul 26 16:44:46 2011 +0000

    ASIX: Simplify condition in rx_fixup()
    
    commit bc466e678d0a98f445bf3f9c76fedf18e7dcc6b0 upstream.
    
    Signed-off-by: Marek Vasut <marek.vasut@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 1a0a3b4ea5782d6f1ca10f3254b56d7be24ec4d0
Author: Andiry Xu <andiry.xu@amd.com>
Date:   Mon Sep 19 16:05:12 2011 -0700

    USB: xHCI: prevent infinite loop when processing MSE event
    
    commit c2d7b49f42f50d7fc5cbfd195b785a128723fdf4 upstream.
    
    When a xHC host is unable to handle isochronous transfer in the
    interval, it reports a Missed Service Error event and skips some tds.
    
    Currently xhci driver handles MSE event in the following ways:
    
    1. When encounter a MSE event, set ep->skip flag, update event ring
       dequeue pointer and return.
    
    2. When encounter the next event on this ep, the driver will run the
       do-while loop, fetch td from ep's td_list to find the td
       corresponding to this event.  All tds missed are marked as short
       transfer(-EXDEV).
    
    The do-while loop will end in two ways:
    
    1. If the td pointed by the event trb is found;
    
    2. If the ep ring's td_list is empty.
    
    However, if a buggy HW reports some unpredicted event (for example, an
    overrun event following a MSE event while the ep ring is actually not
    empty), the driver will never find the td, and it will loop until the
    td_list is empty.
    
    Unfortunately, the spinlock is dropped when give back a urb in the
    do-while loop.  During the spinlock released period, the class driver
    may still submit urbs and add tds to the td_list.  This may cause
    disaster, since the td_list will never be empty and the loop never ends,
    and the system hangs.
    
    To fix this, count the number of TDs on the ep ring before skipping TDs,
    and quit the loop when skipped that number of tds.  This guarantees the
    do-while loop will end after certain number of cycles, and driver will
    not be trapped in an infinite loop.
    
    Signed-off-by: Andiry Xu <andiry.xu@amd.com>
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 869b18a75765d4f29e26ea8de123608fc9907903
Author: Kavan Smith <kavansmith82@gmail.com>
Date:   Wed Aug 31 05:12:05 2011 +0000

    ipheth: iPhone 4 Verizon CDMA USB Product ID add
    
    commit 02009afc223aae43b8e18918fc816e4520791537 upstream.
    
    Add USB product ID for iPhone 4 CDMA Verizon
    Tested on at least 2 devices
    
    Signed-off-by: Kavan Smith <kavansmith82@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit f6fad686650aaf264b2acee848825e2183a944e3
Author: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Date:   Tue Aug 9 16:31:54 2011 -0700

    USB: Avoid NULL pointer deref in usb_hcd_alloc_bandwidth.
    
    commit 8a9af4fdf6d5eeb3200a088354d266a87e8260b0 upstream.
    
    usb_ifnum_to_if() can return NULL if the USB device does not have a
    configuration installed (usb_device->actconfig == NULL), or if we can't
    find the interface number in the installed configuration.  Return an
    error instead of crashing.
    
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 91c193f925d75b03f5a7f31ae1358a87af33c78a
Author: Josh Boyer <jwboyer@redhat.com>
Date:   Mon Aug 8 02:34:07 2011 +0000

    usbnet/cdc_ncm: Don't use stack variables for DMA
    
    commit 75bc8ef528f7c4ea7e80384c5593487b6b3b535e upstream.
    
    The cdc_ncm driver still has a few places where stack variables are
    passed to the cdc_ncm_do_request function.  This triggers a stack trace in
    lib/dma-debug.c if the CONFIG_DEBUG_DMA_API option is set.
    
    Adjust these calls to pass parameters that have been allocated with
    kzalloc.
    
    Signed-off-by: Josh Boyer <jwboyer@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 510c6bcea7b81acf7c86d2d72944ed516223fcbb
Author: Artur Zimmer <artur128@3dzimmer.de>
Date:   Wed Aug 10 03:51:28 2011 +0200

    USB: Serial: Add PID(0xF7C0) to FTDI SIO driver for a zeitcontrol-device
    
    commit ce7e9065958191e6b7ca49d7ed0e1099c486d198 upstream.
    
    Here is a patch for a new PID (zeitcontrol-device mifare-reader FT232BL(like FT232BM but lead free)).
    
    Signed-off-by: Artur Zimmer <artur128@3dzimmer.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 5be5de4dfc6715b424207c367dc2ed234b0bd6ce
Author: Florian Echtler <floe@butterbrot.org>
Date:   Tue Aug 9 13:37:49 2011 +0200

    USB: Serial: Add device ID for Sierra Wireless MC8305
    
    commit 2f1def2695c223b2aa325e5e47d0d64200a45d23 upstream.
    
    A new device ID pair is added for Sierra Wireless MC8305.
    
    Signed-off-by: Florian Echtler <floe@butterbrot.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit e530d1a21e5c2fe3202b2fdf2f0b61100c12c70e
Author: Arvid Brodin <arvid.brodin@enea.com>
Date:   Wed Jul 20 03:13:46 2011 +0200

    usb/isp1760: Added missing call to usb_hcd_check_unlink_urb() during unlink
    
    commit 17d3e145a4ad680b3d1b1c30d0696a5bbb2b65c4 upstream.
    
    Signed-off-by: Arvid Brodin <arvid.brodin@enea.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 00c37d53fdc0f671cc07228e0faf1938da741e68
Author: Boris Todorov <boris.st.todorov@gmail.com>
Date:   Mon Jul 11 12:03:33 2011 +0300

    USB: EHCI: Fix test mode sequence
    
    commit 77636c86a600b83de01719efad83567e46d7e8ce upstream.
    
    The sequence to put port in test mode is not complete.
    According EHCI specification all enabled ports must be
    put in suspend.
    
    Signed-off-by: Boris Todorov <boris.st.todorov@gmail.com>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit cfaef012006eddcba833b33cb7953a68b36869c6
Author: huajun li <huajun.li.lee@gmail.com>
Date:   Sun Aug 7 03:03:31 2011 +0000

    rtl8150: rtl8150_disconnect(...) does not need tasklet_disable(...)
    
    commit c2e2a313ff8fdc25cedef5e63da712a6a0d35dfe upstream.
    
    Executing cmd 'rmmod rtl8150' does not return(if your device connects
    to host), the root cause is tasklet_disable() causes tasklet_kill()
    block, remove it from rtl8150_disconnect().
    
    Signed-off-by: Huajun Li <huajun.li.lee@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit c3db5c3702bfc283b3ea65dc1ebbf256e688baee
Author: Vasanthy Kolluri <vkolluri@cisco.com>
Date:   Thu Jun 9 10:37:07 2011 +0000

    enic: Bug Fix: Fix hardware transmit queue indexing in enic_poll_controller
    
    commit b880a954b9e2585ce325aedd76e4741880cab180 upstream.
    
    Signed-off-by: Christian Benvenuti <benve@cisco.com>
    Signed-off-by: Danny Guo <dannguo@cisco.com>
    Signed-off-by: Vasanthy Kolluri <vkolluri@cisco.com>
    Signed-off-by: Roopa Prabhu <roprabhu@cisco.com>
    Signed-off-by: David Wang <dwang2@cisco.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Cc: Chun-Yi Lee <jlee@suse.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 628ee980d92cd25b8b794af59823fb93090500c3
Author: Eric Sandeen <sandeen@redhat.com>
Date:   Sat Oct 29 10:15:35 2011 -0400

    ext4: fix race in xattr block allocation path
    
    commit 6d6a435190bdf2e04c9465cde5bdc3ac68cf11a4 upstream.
    
    Ceph users reported that when using Ceph on ext4, the filesystem
    would often become corrupted, containing inodes with incorrect
    i_blocks counters.
    
    I managed to reproduce this with a very hacked-up "streamtest"
    binary from the Ceph tree.
    
    Ceph is doing a lot of xattr writes, to out-of-inode blocks.
    There is also another thread which does sync_file_range and close,
    of the same files.  The problem appears to happen due to this race:
    
    sync/flush thread               xattr-set thread
    -----------------               ----------------
    
    do_writepages                   ext4_xattr_set
    ext4_da_writepages              ext4_xattr_set_handle
    mpage_da_map_blocks             ext4_xattr_block_set
            set DELALLOC_RESERVE
                                    ext4_new_meta_blocks
                                            ext4_mb_new_blocks
                                                    if (!i_delalloc_reserved_flag)
                                                            vfs_dq_alloc_block
    ext4_get_blocks
    	down_write(i_data_sem)
            set i_delalloc_reserved_flag
    	...
    	up_write(i_data_sem)
                                            if (i_delalloc_reserved_flag)
                                                    vfs_dq_alloc_block_nofail
    
    
    In other words, the sync/flush thread pops in and sets
    i_delalloc_reserved_flag on the inode, which makes the xattr thread
    think that it's in a delalloc path in ext4_new_meta_blocks(),
    and add the block for a second time, after already having added
    it once in the !i_delalloc_reserved_flag case in ext4_mb_new_blocks
    
    The real problem is that we shouldn't be using the DELALLOC_RESERVED
    state flag, and instead we should be passing
    EXT4_GET_BLOCKS_DELALLOC_RESERVE down to ext4_map_blocks() instead of
    using an inode state flag.  We'll fix this for now with using
    i_data_sem to prevent this race, but this is really not the right way
    to fix things.
    
    Signed-off-by: Eric Sandeen <sandeen@redhat.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 3c607445bbf6ff07c755656df331069d753569ea
Author: Theodore Ts'o <tytso@mit.edu>
Date:   Wed Aug 31 12:02:51 2011 -0400

    ext4: call ext4_handle_dirty_metadata with correct inode in ext4_dx_add_entry
    
    commit 5930ea643805feb50a2f8383ae12eb6f10935e49 upstream.
    
    ext4_dx_add_entry manipulates bh2 and frames[0].bh, which are two buffer_heads
    that point to directory blocks assigned to the directory inode.  However, the
    function calls ext4_handle_dirty_metadata with the inode of the file that's
    being added to the directory, not the directory inode itself.  Therefore,
    correct the code to dirty the directory buffers with the directory inode, not
    the file inode.
    
    Signed-off-by: Darrick J. Wong <djwong@us.ibm.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 37915713a96e05b5d731b9457a0cf22ced00f36f
Author: Darrick J. Wong <djwong@us.ibm.com>
Date:   Wed Aug 31 12:00:51 2011 -0400

    ext4: ext4_mkdir should dirty dir_block with newly created directory inode
    
    commit f9287c1f2d329f4d78a3bbc9cf0db0ebae6f146a upstream.
    
    ext4_mkdir calls ext4_handle_dirty_metadata with dir_block and the inode "dir".
    Unfortunately, dir_block belongs to the newly created directory (which is
    "inode"), not the parent directory (which is "dir").  Fix the incorrect
    association.
    
    Signed-off-by: Darrick J. Wong <djwong@us.ibm.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit a848dee39f54f1eb9d9b90ef172ec4e813815e21
Author: Darrick J. Wong <djwong@us.ibm.com>
Date:   Wed Aug 31 11:58:51 2011 -0400

    ext4: ext4_rename should dirty dir_bh with the correct directory
    
    commit bcaa992975041e40449be8c010c26192b8c8b409 upstream.
    
    When ext4_rename performs a directory rename (move), dir_bh is a
    buffer that is modified to update the '..' link in the directory being
    moved (old_inode).  However, ext4_handle_dirty_metadata is called with
    the old parent directory inode (old_dir) and dir_bh, which is
    incorrect because dir_bh does not belong to the parent inode.  Fix
    this error.
    
    Signed-off-by: Darrick J. Wong <djwong@us.ibm.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit d24f405b711a4247f31358339dc1112ca659e6fe
Author: Theodore Ts'o <tytso@mit.edu>
Date:   Wed Aug 31 11:54:51 2011 -0400

    ext2,ext3,ext4: don't inherit APPEND_FL or IMMUTABLE_FL for new inodes
    
    commit 1cd9f0976aa4606db8d6e3dc3edd0aca8019372a upstream.
    
    This doesn't make much sense, and it exposes a bug in the kernel where
    attempts to create a new file in an append-only directory using
    O_CREAT will fail (but still leave a zero-length file).  This was
    discovered when xfstests #79 was generalized so it could run on all
    file systems.
    
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit b97cdd64caeac76928c0bac6a844743fa2431200
Author: Clifton Barnes <cabarnes@indesign-llc.com>
Date:   Wed Nov 2 13:39:55 2011 -0700

    drivers/power/ds2780_battery.c: fix deadlock upon insertion and removal
    
    commit 0e053fcbbbc4d945247cb32cad2767b483cb65f8 upstream.
    
    Fixes the deadlock when inserting and removing the ds2780.
    
    Signed-off-by: Clifton Barnes <cabarnes@indesign-llc.com>
    Cc: Evgeniy Polyakov <zbr@ioremap.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 101884f69106faf7c76602ad6fd12eac388b64b8
Author: Clifton Barnes <cabarnes@indesign-llc.com>
Date:   Wed Nov 2 13:39:52 2011 -0700

    drivers/power/ds2780_battery.c: add a nolock function to w1 interface
    
    commit 9fe678fa2feb4aaac0b4220de63e1b7f8ccebae6 upstream.
    
    Adds a nolock function to the w1 interface to avoid locking the
    mutex if needed.
    
    Signed-off-by: Clifton Barnes <cabarnes@indesign-llc.com>
    Cc: Evgeniy Polyakov <zbr@ioremap.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 24e53017e03e9b70765cd244c5304cee4e3ef38b
Author: Clifton Barnes <cabarnes@indesign-llc.com>
Date:   Wed Nov 2 13:39:50 2011 -0700

    drivers/power/ds2780_battery.c: create central point for calling w1 interface
    
    commit 853eee72f74f449797f0500ea19fc1bf497428d8 upstream.
    
    Simply creates one point to call the w1 interface.
    
    Signed-off-by: Clifton Barnes <cabarnes@indesign-llc.com>
    Cc: Evgeniy Polyakov <zbr@ioremap.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit b323615a633b4ac47834844f330f9cc329aeaf2b
Author: Juan Gutierrez <jgutierrez@ti.com>
Date:   Tue Sep 6 09:30:16 2011 +0300

    hwspinlock/core: use a mutex to protect the radix tree
    
    commit 93b465c2e186d96fb90012ba0f9372eb9952e732 upstream.
    
    Since we're using non-atomic radix tree allocations, we
    should be protecting the tree using a mutex and not a
    spinlock.
    
    Non-atomic allocations and process context locking is good enough,
    as the tree is manipulated only when locks are registered/
    unregistered/requested/freed.
    
    The locks themselves are still protected by spinlocks of course,
    and mutexes are not involved in the locking/unlocking paths.
    
    Signed-off-by: Juan Gutierrez <jgutierrez@ti.com>
    [ohad@wizery.com: rewrite the commit log, #include mutex.h, add minor
    commentary]
    [ohad@wizery.com: update register/unregister parts in hwspinlock.txt]
    Signed-off-by: Ohad Ben-Cohen <ohad@wizery.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 044ee31ce0a51153f27a9d8c55ea12db32e59667
Author: Alexandre Bounine <alexandre.bounine@idt.com>
Date:   Wed Nov 2 13:39:15 2011 -0700

    drivers/net/rionet.c: fix ethernet address macros for LE platforms
    
    commit e0c87bd95e8dad455c23bc56513af8dcb1737e55 upstream.
    
    Modify Ethernet addess macros to be compatible with BE/LE platforms
    
    Signed-off-by: Alexandre Bounine <alexandre.bounine@idt.com>
    Cc: Chul Kim <chul.kim@idt.com>
    Cc: Kumar Gala <galak@kernel.crashing.org>
    Cc: Matt Porter <mporter@kernel.crashing.org>
    Cc: Li Yang <leoli@freescale.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 179b05367d02451ebf4d4b655632b6f979fcac8a
Author: Johannes Berg <johannes.berg@intel.com>
Date:   Thu Nov 3 13:46:08 2011 +0100

    iwlagn: do not use interruptible waits
    
    Upstream commit effd4d9aece9184f526e6556786a94d335e38b71.
    
    Since the dawn of its time, iwlwifi has used
    interruptible waits to wait for synchronous
    commands and firmware loading.
    
    This leads to "interesting" bugs, because it
    can't actually handle the interruptions; for
    example when a command sending is interrupted
    it will assume the command completed fully,
    and then leave it pending, which leads to all
    kinds of trouble when the command finishes
    later.
    
    Since there's no easy way to gracefully deal
    with interruptions, fix the driver to not use
    interruptible waits.
    
    This at least fixes the error
    iwlagn 0000:02:00.0: Error: Response NULL in  'REPLY_SCAN_ABORT_CMD'
    
    I have seen in P2P testing, but it is likely
    that there are other errors caused by this.
    
    Cc: Stanislaw Gruszka <sgruszka@redhat.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 4f0bf01fabfa6519f8d96b089e44eeaf6cc085c2
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sat Aug 6 11:51:33 2011 -0700

    vfs: show O_CLOEXE bit properly in /proc/<pid>/fdinfo/<fd> files
    
    commit 1117f72ea0217ba0cc19f05adbbd8b9a397f5ab7 upstream.
    
    The CLOEXE bit is magical, and for performance (and semantic) reasons we
    don't actually maintain it in the file descriptor itself, but in a
    separate bit array.  Which means that when we show f_flags, the CLOEXE
    status is shown incorrectly: we show the status not as it is now, but as
    it was when the file was opened.
    
    Fix that by looking up the bit properly in the 'fdt->close_on_exec' bit
    array.
    
    Uli needs this in order to re-implement the pfiles program:
    
      "For normal file descriptors (not sockets) this was the last piece of
       information which wasn't available.  This is all part of my 'give
       Solaris users no reason to not switch' effort.  I intend to offer the
       code to the util-linux-ng maintainers."
    
    Requested-by: Ulrich Drepper <drepper@akkadia.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit bfcf6092c5b8789a179e40992ca041bbdbb859cc
Author: Jiri Kosina <jkosina@suse.cz>
Date:   Wed Nov 2 13:37:41 2011 -0700

    binfmt_elf: fix PIE execution with randomization disabled
    
    commit a3defbe5c337dbc6da911f8cc49ae3cc3b49b453 upstream.
    
    The case of address space randomization being disabled in runtime through
    randomize_va_space sysctl is not treated properly in load_elf_binary(),
    resulting in SIGKILL coming at exec() time for certain PIE-linked binaries
    in case the randomization has been disabled at runtime prior to calling
    exec().
    
    Handle the randomize_va_space == 0 case the same way as if we were not
    supporting .text randomization at all.
    
    Based on original patch by H.J. Lu and Josh Boyer.
    
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Cc: Ingo Molnar <mingo@elte.hu>
    Cc: Russell King <rmk@arm.linux.org.uk>
    Cc: H.J. Lu <hongjiu.lu@intel.com>
    Cc: <stable@kernel.org>
    Tested-by: Josh Boyer <jwboyer@redhat.com>
    Acked-by: Nicolas Pitre <nicolas.pitre@linaro.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 68fe9d9c796303de600dbc622086768ca4d8408b
Author: Andrea Arcangeli <aarcange@redhat.com>
Date:   Wed Nov 2 13:36:59 2011 -0700

    mm: thp: tail page refcounting fix
    
    commit 70b50f94f1644e2aa7cb374819cfd93f3c28d725 upstream.
    
    Michel while working on the working set estimation code, noticed that
    calling get_page_unless_zero() on a random pfn_to_page(random_pfn)
    wasn't safe, if the pfn ended up being a tail page of a transparent
    hugepage under splitting by __split_huge_page_refcount().
    
    He then found the problem could also theoretically materialize with
    page_cache_get_speculative() during the speculative radix tree lookups
    that uses get_page_unless_zero() in SMP if the radix tree page is freed
    and reallocated and get_user_pages is called on it before
    page_cache_get_speculative has a chance to call get_page_unless_zero().
    
    So the best way to fix the problem is to keep page_tail->_count zero at
    all times.  This will guarantee that get_page_unless_zero() can never
    succeed on any tail page.  page_tail->_mapcount is guaranteed zero and
    is unused for all tail pages of a compound page, so we can simply
    account the tail page references there and transfer them to
    tail_page->_count in __split_huge_page_refcount() (in addition to the
    head_page->_mapcount).
    
    While debugging this s/_count/_mapcount/ change I also noticed get_page is
    called by direct-io.c on pages returned by get_user_pages.  That wasn't
    entirely safe because the two atomic_inc in get_page weren't atomic.  As
    opposed to other get_user_page users like secondary-MMU page fault to
    establish the shadow pagetables would never call any superflous get_page
    after get_user_page returns.  It's safer to make get_page universally safe
    for tail pages and to use get_page_foll() within follow_page (inside
    get_user_pages()).  get_page_foll() is safe to do the refcounting for tail
    pages without taking any locks because it is run within PT lock protected
    critical sections (PT lock for pte and page_table_lock for
    pmd_trans_huge).
    
    The standard get_page() as invoked by direct-io instead will now take
    the compound_lock but still only for tail pages.  The direct-io paths
    are usually I/O bound and the compound_lock is per THP so very
    finegrined, so there's no risk of scalability issues with it.  A simple
    direct-io benchmarks with all lockdep prove locking and spinlock
    debugging infrastructure enabled shows identical performance and no
    overhead.  So it's worth it.  Ideally direct-io should stop calling
    get_page() on pages returned by get_user_pages().  The spinlock in
    get_page() is already optimized away for no-THP builds but doing
    get_page() on tail pages returned by GUP is generally a rare operation
    and usually only run in I/O paths.
    
    This new refcounting on page_tail->_mapcount in addition to avoiding new
    RCU critical sections will also allow the working set estimation code to
    work without any further complexity associated to the tail page
    refcounting with THP.
    
    Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
    Reported-by: Michel Lespinasse <walken@google.com>
    Reviewed-by: Michel Lespinasse <walken@google.com>
    Reviewed-by: Minchan Kim <minchan.kim@gmail.com>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: Johannes Weiner <jweiner@redhat.com>
    Cc: Rik van Riel <riel@redhat.com>
    Cc: Mel Gorman <mgorman@suse.de>
    Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Cc: David Gibson <david@gibson.dropbear.id.au>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit a00fb1451d630898c1380349ac3776688e58010f
Author: David Vrabel <david.vrabel@citrix.com>
Date:   Fri Sep 30 06:37:51 2011 +0000

    net: xen-netback: correctly restart Tx after a VM restore/migrate
    
    [ Upstream commit d0e5d83284dac15c015bb48115b6780f5a6413cd ]
    
    If a VM is saved and restored (or migrated) the netback driver will no
    longer process any Tx packets from the frontend.  xenvif_up() does not
    schedule the processing of any pending Tx requests from the front end
    because the carrier is off.  Without this initial kick the frontend
    just adds Tx requests to the ring without raising an event (until the
    ring is full).
    
    This was caused by 47103041e91794acdbc6165da0ae288d844c820b (net:
    xen-netback: convert to hw_features) which reordered the calls to
    xenvif_up() and netif_carrier_on() in xenvif_connect().
    
    Signed-off-by: David Vrabel <david.vrabel@citrix.com>
    Cc: Ian Campbell <ian.campbell@citrix.com>
    Acked-by: Ian Campbell <ian.campbell@citrix.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 62d8d0b9b6c459789876335156c56110042f2158
Author: Willem de Bruijn <willemb@google.com>
Date:   Fri Sep 30 10:38:28 2011 +0000

    make PACKET_STATISTICS getsockopt report consistently between ring and non-ring
    
    [ Upstream commit 7091fbd82cd5686444ffe9935ed6a8190101fe9d ]
    
    This is a minor change.
    
    Up until kernel 2.6.32, getsockopt(fd, SOL_PACKET, PACKET_STATISTICS,
    ...) would return total and dropped packets since its last invocation. The
    introduction of socket queue overflow reporting [1] changed drop
    rate calculation in the normal packet socket path, but not when using a
    packet ring. As a result, the getsockopt now returns different statistics
    depending on the reception method used. With a ring, it still returns the
    count since the last call, as counts are incremented in tpacket_rcv and
    reset in getsockopt. Without a ring, it returns 0 if no drops occurred
    since the last getsockopt and the total drops over the lifespan of
    the socket otherwise. The culprit is this line in packet_rcv, executed
    on a drop:
    
    drop_n_acct:
            po->stats.tp_drops = atomic_inc_return(&sk->sk_drops);
    
    As it shows, the new drop number it taken from the socket drop counter,
    which is not reset at getsockopt. I put together a small example
    that demonstrates the issue [2]. It runs for 10 seconds and overflows
    the queue/ring on every odd second. The reported drop rates are:
    ring: 16, 0, 16, 0, 16, ...
    non-ring: 0, 15, 0, 30, 0, 46, 0, 60, 0 , 74.
    
    Note how the even ring counts monotonically increase. Because the
    getsockopt adds tp_drops to tp_packets, total counts are similarly
    reported cumulatively. Long story short, reinstating the original code, as
    the below patch does, fixes the issue at the cost of additional per-packet
    cycles. Another solution that does not introduce per-packet overhead
    is be to keep the current data path, record the value of sk_drops at
    getsockopt() at call N in a new field in struct packetsock and subtract
    that when reporting at call N+1. I'll be happy to code that, instead,
    it's just more messy.
    
    [1] http://patchwork.ozlabs.org/patch/35665/
    [2] http://kernel.googlecode.com/files/test-packetsock-getstatistics.c
    
    Signed-off-by: Willem de Bruijn <willemb@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 2146d4667b5fbdb0e186ca8bc6d9cbe7ac42dfdc
Author: Yan, Zheng <zheng.z.yan@intel.com>
Date:   Sun Sep 25 02:21:30 2011 +0000

    ipv6: nullify ipv6_ac_list and ipv6_fl_list when creating new socket
    
    [ Upstream commit 676a1184e8afd4fed7948232df1ff91517400859 ]
    
    ipv6_ac_list and ipv6_fl_list from listening socket are inadvertently
    shared with new socket created for connection.
    
    Signed-off-by: Zheng Yan <zheng.z.yan@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit ec668dbad7f732767d5484e1c7b317c767777f27
Author: Jiri Pirko <jpirko@redhat.com>
Date:   Tue Oct 11 23:00:41 2011 +0000

    tg3: negate USE_PHYLIB flag check
    
    [ Upstream commit e730c82347b9dc75914da998c44c3f348965db41 ]
    
    USE_PHYLIB flag in tg3_remove_one() is being checked incorrectly. This
    results tg3_phy_fini->phy_disconnect is never called and when tg3 module
    is removed.
    
    In my case this resulted in panics in phy_state_machine calling function
    phydev->adjust_link.
    
    So correct this check.
    
    Signed-off-by: Jiri Pirko <jpirko@redhat.com>
    Acked-by: Matt Carlson <mcarlson@broadcom.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit b00654416d4baccf2269ec888e55d6df069cd36f
Author: Yan, Zheng <zheng.z.yan@intel.com>
Date:   Sun Oct 2 04:21:50 2011 +0000

    tcp: properly update lost_cnt_hint during shifting
    
    [ Upstream commit 1e5289e121372a3494402b1b131b41bfe1cf9b7f ]
    
    lost_skb_hint is used by tcp_mark_head_lost() to mark the first unhandled skb.
    lost_cnt_hint is the number of packets or sacked packets before the lost_skb_hint;
    When shifting a skb that is before the lost_skb_hint, if tcp_is_fack() is ture,
    the skb has already been counted in the lost_cnt_hint; if tcp_is_fack() is false,
    tcp_sacktag_one() will increase the lost_cnt_hint. So tcp_shifted_skb() does not
    need to adjust the lost_cnt_hint by itself. When shifting a skb that is equal to
    lost_skb_hint, the shifted packets will not be counted by tcp_mark_head_lost().
    So tcp_shifted_skb() should adjust the lost_cnt_hint even tcp_is_fack(tp) is true.
    
    Signed-off-by: Zheng Yan <zheng.z.yan@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 37c88f5fe7f287a945949e6f4570700c210ebe0f
Author: Yan, Zheng <zheng.z.yan@intel.com>
Date:   Thu Sep 29 17:10:10 2011 +0000

    tcp: properly handle md5sig_pool references
    
    [ Upstream commit 260fcbeb1ae9e768a44c9925338fbacb0d7e5ba9 ]
    
    tcp_v4_clear_md5_list() assumes that multiple tcp md5sig peers
    only hold one reference to md5sig_pool. but tcp_v4_md5_do_add()
    increases use count of md5sig_pool for each peer. This patch
    makes tcp_v4_md5_do_add() only increases use count for the first
    tcp md5sig peer.
    
    Signed-off-by: Zheng Yan <zheng.z.yan@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 18743353b3154f0ff7c29f3c5ae3a8466a70d73a
Author: Gao feng <gaofeng@cn.fujitsu.com>
Date:   Tue Oct 11 16:08:11 2011 +0000

    netconsole: enable netconsole can make net_device refcnt incorrent
    
    [ Upstream commit d5123480b1d6f7d1a5fe1a13520cef88fb5d4c84 ]
    
    There is no check if netconsole is enabled current.
    so when exec echo 1 > enabled;
    the reference of net_device will increment always.
    
    Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
    Acked-by: Flavio Leitner <fbl@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 89c32c14c190c6113187c7c57784695701e314e4
Author: David Ward <david.ward@ll.mit.edu>
Date:   Sun Sep 18 12:53:20 2011 +0000

    macvlan/macvtap: Fix unicast between macvtap interfaces in bridge mode
    
    [ Upstream commit cb2d0f3e968bff7c6d262aca3e3ab8d4184e69b2 ]
    
    Packets should always be forwarded to the lowerdev using dev_forward_skb.
    vlan->forward is for packets being forwarded directly to another macvlan/
    macvtap device (used for multicast in bridge mode).
    
    Reported-and-tested-by: Shlomo Pongratz <shlomop@mellanox.com>
    Signed-off-by: David Ward <david.ward@ll.mit.edu>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit c11deb8d898318a2fea9a291b16a7a2b2507cc94
Author: Eric Dumazet <eric.dumazet@gmail.com>
Date:   Fri Oct 7 05:35:46 2011 +0000

    l2tp: fix a potential skb leak in l2tp_xmit_skb()
    
    [ Upstream commit 835acf5da239b91edb9f7ebe36516999e156e6ee ]
    
    l2tp_xmit_skb() can leak one skb if skb_cow_head() returns an error.
    
    Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit cbbd42eb61241fcd721f3b02bcb612894e2f02e6
Author: Yan, Zheng <zheng.z.yan@intel.com>
Date:   Sat Oct 22 21:58:20 2011 +0000

    ipv4: fix ipsec forward performance regression
    
    [ Upstream commit b73233960a59ee66e09d642f13d0592b13651e94 ]
    
    There is bug in commit 5e2b61f(ipv4: Remove flowi from struct rtable).
    It makes xfrm4_fill_dst() modify wrong data structure.
    
    Signed-off-by: Zheng Yan <zheng.z.yan@intel.com>
    Reported-by: Kim Phillips <kim.phillips@freescale.com>
    Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 92dc979cf8a5b2439ac2764cd56675407136d329
Author: Oliver Hartkopp <socketcan@hartkopp.net>
Date:   Fri Sep 23 08:23:47 2011 +0000

    can bcm: fix tx_setup off-by-one errors
    
    [ Upstream commit aabdcb0b553b9c9547b1a506b34d55a764745870 ]
    
    This patch fixes two off-by-one errors that canceled each other out.
    Checking for the same condition two times in bcm_tx_timeout_tsklet() reduced
    the count of frames to be sent by one. This did not show up the first time
    tx_setup is invoked as an additional frame is sent due to TX_ANNONCE.
    Invoking a second tx_setup on the same item led to a reduced (by 1) number of
    sent frames.
    
    Reported-by: Andre Naujoks <nautsch@gmail.com>
    Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 99dfac8ab234555a54f7fa6e4b7bb08bb355158b
Author: stephen hemminger <shemminger@vyatta.com>
Date:   Thu Oct 6 11:19:41 2011 +0000

    bridge: fix hang on removal of bridge via netlink
    
    [ Upstream commit 1ce5cce895309862d2c35d922816adebe094fe4a ]
    
    Need to cleanup bridge device timers and ports when being bridge
    device is being removed via netlink.
    
    This fixes the problem of observed when doing:
     ip link add br0 type bridge
     ip link set dev eth1 master br0
     ip link set br0 up
     ip link del br0
    
    which would cause br0 to hang in unregister_netdev because
    of leftover reference count.
    
    Reported-by: Sridhar Samudrala <sri@us.ibm.com>
    Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
    Acked-by: Sridhar Samudrala <sri@us.ibm.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit e8c492bd9cbc8dd1002bf4bc316f21f0a002b10f
Author: Mitsuo Hayasaka <mitsuo.hayasaka.hu@hitachi.com>
Date:   Wed Oct 12 16:04:29 2011 +0000

    bonding: use local function pointer of bond->recv_probe in bond_handle_frame
    
    [ Upstream commit 4d97480b1806e883eb1c7889d4e7a87e936e06d9 ]
    
    The bond->recv_probe is called in bond_handle_frame() when
    a packet is received, but bond_close() sets it to NULL. So,
    a panic occurs when both functions work in parallel.
    
    Why this happen:
    After null pointer check of bond->recv_probe, an sk_buff is
    duplicated and bond->recv_probe is called in bond_handle_frame.
    So, a panic occurs when bond_close() is called between the
    check and call of bond->recv_probe.
    
    Patch:
    This patch uses a local function pointer of bond->recv_probe
    in bond_handle_frame(). So, it can avoid the null pointer
    dereference.
    
    Signed-off-by: Mitsuo Hayasaka <mitsuo.hayasaka.hu@hitachi.com>
    Cc: Jay Vosburgh <fubar@us.ibm.com>
    Cc: Andy Gospodarek <andy@greyhouse.net>
    Cc: Eric Dumazet <eric.dumazet@gmail.com>
    Cc: WANG Cong <xiyou.wangcong@gmail.com>
    Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 6c3ad7aee6e6d62169948d09f2b4a1279d253cbe
Author: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
Date:   Wed Aug 24 13:14:22 2011 -0300

    jsm: remove buggy write queue
    
    commit 9d898966c4a07e4a5092215b5a2829d0ef02baa2 upstream.
    
    jsm uses a write queue that copies from uart_core circular buffer. This
    copying however has some bugs, like not wrapping the head counter. Since
    this write queue is also a circular buffer, the consumer function is
    ready to use the uart_core circular buffer directly.
    
    This buggy copying function was making some bytes be dropped when
    transmitting to a raw tty, doing something like this.
    
    [root@hostname ~]$ cat /dev/ttyn1 > cascardo/dump &
    [1] 2658
    [root@hostname ~]$ cat /proc/tty/drivers > /dev/ttyn0
    [root@hostname ~]$ cat /proc/tty/drivers
    /dev/tty             /dev/tty        5       0 system:/dev/tty
    /dev/console         /dev/console    5       1 system:console
    /dev/ptmx            /dev/ptmx       5       2 system
    /dev/vc/0            /dev/vc/0       4       0 system:vtmaster
    jsm                  /dev/ttyn     250 0-31 serial
    serial               /dev/ttyS       4 64-95 serial
    hvc                  /dev/hvc      229 0-7 system
    pty_slave            /dev/pts      136 0-1048575 pty:slave
    pty_master           /dev/ptm      128 0-1048575 pty:master
    unknown              /dev/tty        4 1-63 console
    [root@hostname ~]$ cat cascardo/dump
    /dev/tty             /dev/tty        5       0 system:/dev/tty
    /dev/console         /dev/console    5       1 system:console
    /dev/ptmx            /dev/ptmx       5       2 system
    /dev/vc/0            /dev/vc/0       4       0 system:vtmaste[root@hostname ~]$
    
    This patch drops the driver write queue entirely, using the circular
    buffer from uart_core only.
    
    Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 43742b14ffbe87453e96f4411389445fc707df57
Author: Oleg Nesterov <oleg@redhat.com>
Date:   Mon Sep 26 19:06:32 2011 +0200

    ptrace: don't clear GROUP_STOP_SIGMASK on double-stop
    
    [This does not correspond to any specific patch in the upstream tree as it was
    fixed accidentally by rewriting the code in the 3.1 release]
    
    https://bugzilla.redhat.com/show_bug.cgi?id=740121
    
    1. Luke Macken triggered WARN_ON(!(group_stop & GROUP_STOP_SIGMASK))
       in do_signal_stop().
    
       This is because do_signal_stop() clears GROUP_STOP_SIGMASK part
       unconditionally but doesn't update it if task_is_stopped().
    
    2. Looking at this problem I noticed that WARN_ON_ONCE(!ptrace) is
       not right, a stopped-but-resumed tracee can clone the untraced
       thread in the SIGNAL_STOP_STOPPED group, the new thread can start
       another group-stop.
    
       Remove this warning, we need more fixes to make it true.
    
    Reported-by: Luke Macken <lmacken@redhat.com>
    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit eb4b2df8f20d4479eceeb9bc51695caaa7bcd229
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Oct 25 13:59:48 2011 +0200

    vfs pathname lookup: Add LOOKUP_AUTOMOUNT flag
    
    Since we've now turned around and made LOOKUP_FOLLOW *not* force an
    automount, we want to add the ability to force an automount event on
    lookup even if we don't happen to have one of the other flags that force
    it implicitly (LOOKUP_OPEN, LOOKUP_DIRECTORY, LOOKUP_PARENT..)
    
    Most cases will never want to use this, since you'd normally want to
    delay automounting as long as possible, which usually implies
    LOOKUP_OPEN (when we open a file or directory, we really cannot avoid
    the automount any more).
    
    But Trond argued sufficiently forcefully that at a minimum bind mounting
    a file and quotactl will want to force the automount lookup.  Some other
    cases (like nfs_follow_remote_path()) could use it too, although
    LOOKUP_DIRECTORY would work there as well.
    
    This commit just adds the flag and logic, no users yet, though.  It also
    doesn't actually touch the LOOKUP_NO_AUTOMOUNT flag that is related, and
    was made irrelevant by the same change that made us not follow on
    LOOKUP_FOLLOW.
    
    Cc: Trond Myklebust <Trond.Myklebust@netapp.com>
    Cc: Ian Kent <raven@themaw.net>
    Cc: Jeff Layton <jlayton@redhat.com>
    Cc: Miklos Szeredi <miklos@szeredi.hu>
    Cc: David Howells <dhowells@redhat.com>
    Cc: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 6c36547293e6c46fe5df46e5e1b9ce9babb9eb37
Author: Trond Myklebust <Trond.Myklebust@netapp.com>
Date:   Tue Oct 25 13:59:47 2011 +0200

    VFS: Fix the remaining automounter semantics regressions
    
    commit 815d405ceff0d6964683f033e18b9b23a88fba87 upstream.
    
    The concensus seems to be that system calls such as stat() etc should
    not trigger an automount.  Neither should the l* versions.
    
    This patch therefore adds a LOOKUP_AUTOMOUNT flag to tag those lookups
    that _should_ trigger an automount on the last path element.
    
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    [ Edited to leave out the cases that are already covered by LOOKUP_OPEN,
      LOOKUP_DIRECTORY and LOOKUP_CREATE - all of which also fundamentally
      force automounting for their own reasons   - Linus ]
    
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit def3f17094d20fa85d17ff11dea54a6c6bfb3f8c
Author: Miklos Szeredi <mszeredi@suse.cz>
Date:   Tue Oct 25 13:59:46 2011 +0200

    vfs: automount should ignore LOOKUP_FOLLOW
    
    commit 0ec26fd0698285b31248e34bf1abb022c00f23d6 upstream.
    
    Prior to 2.6.38 automount would not trigger on either stat(2) or
    lstat(2) on the automount point.
    
    After 2.6.38, with the introduction of the ->d_automount()
    infrastructure, stat(2) and others would start triggering automount
    while lstat(2), etc. still would not.  This is a regression and a
    userspace ABI change.
    
    Problem originally reported here:
    
      http://thread.gmane.org/gmane.linux.kernel.autofs/6098
    
    It appears that there was an attempt at fixing various userspace tools
    to not trigger the automount.  But since the stat system call is
    rather common it is impossible to "fix" all userspace.
    
    This patch reverts the original behavior, which is to not trigger on
    stat(2) and other symlink following syscalls.
    
    [ It's not really clear what the right behavior is.  Apparently Solaris
      does the "automount on stat, leave alone on lstat".  And some programs
      can get unhappy when "stat+open+fstat" ends up giving a different
      result from the fstat than from the initial stat.
    
      But the change in 2.6.38 resulted in problems for some people, so
      we're going back to old behavior.  Maybe we can re-visit this
      discussion at some future date  - Linus ]
    
    Reported-by: Leonardo Chiquitto <leonardo.lists@gmail.com>
    Acked-by: Ian Kent <raven@themaw.net>
    Cc: David Howells <dhowells@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit f537ffabb3ed687da15ec46d72c839971b142d0a
Author: David Howells <dhowells@redhat.com>
Date:   Tue Oct 25 13:59:45 2011 +0200

    VFS: Fix automount for negative autofs dentries
    
    commit 5a30d8a2b8ddd5102c440c7e5a7c8e1fd729c818 upstream.
    [ backport for 3.0.x: LOOKUP_PARENT => LOOKUP_CONTINUE by Chuck Ebbert
    <cebbert@redhat.com> ]
    
    Autofs may set the DCACHE_NEED_AUTOMOUNT flag on negative dentries.  These
    need attention from the automounter daemon regardless of the LOOKUP_FOLLOW flag.
    
    Signed-off-by: David Howells <dhowells@redhat.com>
    Acked-by: Ian Kent <raven@themaw.net>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Cc: Chuck Ebbert <cebbert@redhat.com>
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit b0917c31699319f0b0ce0747e26bd66e8ed83491
Author: Andy Whitcroft <apw@canonical.com>
Date:   Wed Nov 2 09:44:39 2011 +0100

    readlinkat: ensure we return ENOENT for the empty pathname for normal lookups
    
    commit 1fa1e7f615f4d3ae436fa319af6e4eebdd4026a8 upstream.
    
    Since the commit below which added O_PATH support to the *at() calls, the
    error return for readlink/readlinkat for the empty pathname has switched
    from ENOENT to EINVAL:
    
      commit 65cfc6722361570bfe255698d9cd4dccaf47570d
      Author: Al Viro <viro@zeniv.linux.org.uk>
      Date:   Sun Mar 13 15:56:26 2011 -0400
    
        readlinkat(), fchownat() and fstatat() with empty relative pathnames
    
    This is both unexpected for userspace and makes readlink/readlinkat
    inconsistant with all other interfaces; and inconsistant with our stated
    return for these pathnames.
    
    As the readlinkat call does not have a flags parameter we cannot use the
    AT_EMPTY_PATH approach used in the other calls.  Therefore expose whether
    the original path is infact entry via a new user_path_at_empty() path
    lookup function.  Use this to determine whether to default to EINVAL or
    ENOENT for failures.
    
    Addresses http://bugs.launchpad.net/bugs/817187
    
    [akpm@linux-foundation.org: remove unused getname_flags()]
    Signed-off-by: Andy Whitcroft <apw@canonical.com>
    Cc: Christoph Hellwig <hch@lst.de>
    Cc: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 5f0d9e03e7e0792fbd36ba9fb9859f0ef7956a20
Author: Richard Weinberger <richard@nod.at>
Date:   Wed Nov 2 13:17:27 2011 +0100

    um: fix ubd cow size
    
    commit 8535639810e578960233ad39def3ac2157b0c3ec upstream.
    
    ubd_file_size() cannot use ubd_dev->cow.file because at this time
    ubd_dev->cow.file is not initialized.
    Therefore, ubd_file_size() will always report a wrong disk size when
    COW files are used.
    Reading from /dev/ubd* would crash the kernel.
    
    We have to read the correct disk size from the COW file's backing
    file.
    
    Signed-off-by: Richard Weinberger <richard@nod.at>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 73e2fc5d34007574d25d00e7088bbd42e988bb3e
Author: Takashi Iwai <tiwai@suse.de>
Date:   Fri Oct 14 15:26:20 2011 +0200

    ALSA: hda - Fix ADC input-amp handling for Cx20549 codec
    
    commit 6b45214277bec2193ad3ccb8d7aa6100b5a0f1a9 upstream.
    
    It seems that Conexant CX20549 chip handle only a single input-amp even
    though the audio-input widget has multiple sources.  This has been never
    clear, and I implemented in the current way based on the debug information
    I got at the early time -- the device reacts individual input-amp values
    for different sources.  This is true for another Conexant codec, but it's
    not applied to CX20549 actually.
    
    This patch changes the auto-parser code to handle a single input-amp
    per audio-in widget for CX20549.  After applying this, you'll see only a
    single "Capture" volume control instead of separate "Mic" or "Line"
    captures when the device is set up to use a single ADC.
    
    We haven't tested 20551 and 20561 codecs yet.  If these show the similar
    behavior like 20549, they need to set spec->single_adc_amp=1, too.
    
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 38af8ddb4b8877c0b90f8413a20517ba245c4d0b
Author: Mitsuo Hayasaka <mitsuo.hayasaka.hu@hitachi.com>
Date:   Mon Oct 31 17:08:13 2011 -0700

    mm: avoid null pointer access in vm_struct via /proc/vmallocinfo
    
    commit f5252e009d5b87071a919221e4f6624184005368 upstream.
    
    The /proc/vmallocinfo shows information about vmalloc allocations in
    vmlist that is a linklist of vm_struct.  It, however, may access pages
    field of vm_struct where a page was not allocated.  This results in a null
    pointer access and leads to a kernel panic.
    
    Why this happens: In __vmalloc_node_range() called from vmalloc(), newly
    allocated vm_struct is added to vmlist at __get_vm_area_node() and then,
    some fields of vm_struct such as nr_pages and pages are set at
    __vmalloc_area_node().  In other words, it is added to vmlist before it is
    fully initialized.  At the same time, when the /proc/vmallocinfo is read,
    it accesses the pages field of vm_struct according to the nr_pages field
    at show_numa_info().  Thus, a null pointer access happens.
    
    The patch adds the newly allocated vm_struct to the vmlist *after* it is
    fully initialized.  So, it can avoid accessing the pages field with
    unallocated page when show_numa_info() is called.
    
    Signed-off-by: Mitsuo Hayasaka <mitsuo.hayasaka.hu@hitachi.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: David Rientjes <rientjes@google.com>
    Cc: Namhyung Kim <namhyung@gmail.com>
    Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
    Cc: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit ad417042d59a26bedf600ab162b20b79fdcd1fa1
Author: Linus Walleij <linus.walleij@linaro.org>
Date:   Fri Aug 12 13:54:42 2011 +0200

    ARM: mach-ux500: unlock I&D l2x0 caches before init
    
    commit 1bf6d2c1bb23533af6930581cc39b74685bc29de upstream.
    
    Apparently U8500 U-Boot versions may leave the l2x0 locked down
    before executing the kernel. Make sure we unlock it before we
    initialize the l2x0. This fixes a performance problem reported
    by Jan Rinze.
    
    The l2x0 core has been modified to unlock the l2x0 by default,
    but it will not touch the locking registers if the l2x0 was
    already enabled, as on the ux500, so we need this quirk to
    make sure it is properly turned off.
    
    Cc: Srinidhi Kasagar <srinidhi.kasagar@stericsson.com>
    Cc: Rabin Vincent <rabin.vincent@stericsson.com>
    Cc: Adrian Bunk <adrian.bunk@movial.com>
    Reported-by: Jan Rinze <janrinze@gmail.com>
    Tested-by: Robert Marklund <robert.marklund@stericsson.com>
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 513c4eb162aecea92e0b05a7c5e206474526eda2
Author: Paul Fertser <fercerpav@gmail.com>
Date:   Mon Oct 10 11:19:23 2011 +0400

    plat-mxc: iomux-v3.h: implicitly enable pull-up/down when that's desired
    
    commit 6571534b600b8ca1936ff5630b9e0947f21faf16 upstream.
    
    To configure pads during the initialisation a set of special constants
    is used, e.g.
    #define MX25_PAD_FEC_MDIO__FEC_MDIO IOMUX_PAD(0x3c4, 0x1cc, 0x10, 0, 0, PAD_CTL_HYS | PAD_CTL_PUS_22K_UP)
    
    The problem is that no pull-up/down is getting activated unless both
    PAD_CTL_PUE (pull-up enable) and PAD_CTL_PKE (pull/keeper module
    enable) set. This is clearly stated in the i.MX25 datasheet and is
    confirmed by the measurements on hardware. This leads to some rather
    hard to understand bugs such as misdetecting an absent ethernet PHY (a
    real bug i had), unstable data transfer etc. This might affect mx25,
    mx35, mx50, mx51 and mx53 SoCs.
    
    It's reasonable to expect that if the pullup value is specified, the
    intention was to have it actually active, so we implicitly add the
    needed bits.
    
    Signed-off-by: Paul Fertser <fercerpav@gmail.com>
    Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit b5e074a6ff4cfa090f7aa8a87f5079d19206d91c
Author: Andrew Morton <akpm@linux-foundation.org>
Date:   Mon Oct 31 17:06:32 2011 -0700

    /proc/self/numa_maps: restore "huge" tag for hugetlb vmas
    
    commit fc360bd9cdcf875639a77f07fafec26699c546f3 upstream.
    
    The display of the "huge" tag was accidentally removed in 29ea2f698 ("mm:
    use walk_page_range() instead of custom page table walking code").
    
    Reported-by: Stephen Hemminger <shemminger@vyatta.com>
    Tested-by: Stephen Hemminger <shemminger@vyatta.com>
    Reviewed-by: Stephen Wilson <wilsons@start.ca>
    Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Cc: Hugh Dickins <hughd@google.com>
    Acked-by: David Rientjes <rientjes@google.com>
    Cc: Lee Schermerhorn <lee.schermerhorn@hp.com>
    Cc: Alexey Dobriyan <adobriyan@gmail.com>
    Cc: Christoph Lameter <cl@linux-foundation.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 1eac959e6961083087486015d87d0209a0ae45a8
Author: Mauro Carvalho Chehab <mchehab@redhat.com>
Date:   Thu Jul 28 16:38:54 2011 -0300

    tuner_xc2028: Allow selection of the frequency adjustment code for XC3028
    
    commit 9bed77ee2fb46b74782d0d9d14b92e9d07f3df6e upstream.
    
    This device is not using the proper demod IF. Instead of using the
    IF macro, it is specifying a IF frequency. This doesn't work, as xc3028
    needs to load an specific SCODE for the tuner. In this case, there's
    no IF table for 5 MHz.
    
    Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 10d65fc3a3348315c2d30e19419e8db6ed486b8a
Author: Olivier Grenie <olivier.grenie@dibcom.fr>
Date:   Mon Aug 1 12:45:58 2011 -0300

    dib0700: protect the dib0700 buffer access
    
    commit bff469f4167fdabfe15294f375577d7eadbaa1bb upstream.
    
    This patch protects the common buffer access inside the dib0700 in order
    to manage concurrent access. This protection is done using mutex.
    
    Cc: Mauro Carvalho Chehab <mchehab@redhat.com>
    Cc: Florian Mickler <florian@mickler.org>
    Signed-off-by: Javier Marcet <javier@marcet.info>
    Signed-off-by: Olivier Grenie <olivier.grenie@dibcom.fr>
    Signed-off-by: Patrick Boettcher <patrick.boettcher@dibcom.fr>
    [mchehab@redhat.com: dprint requires 3 arguments. Replaced by dib_info]
    Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 4d2ae8d3b315fbf36d760fd8dd755fb1d55a0f87
Author: Patrick Boettcher <Patrick.Boettcher@dibcom.fr>
Date:   Wed Aug 3 12:08:21 2011 -0300

    DiBcom: protect the I2C bufer access
    
    commit 79fcce3230b140f7675f8529ee53fe2f9644f902 upstream.
    
    This patch protects the I2C buffer access in order to manage concurrent
    access. This protection is done using mutex.
    Furthermore, for the dib9000, if a pid filtering command is
    received during the tuning, this pid filtering command is delayed to
    avoid any concurrent access issue.
    
    Cc: Mauro Carvalho Chehab <mchehab@redhat.com>
    Cc: Florian Mickler <florian@mickler.org>
    Signed-off-by: Olivier Grenie <olivier.grenie@dibcom.fr>
    Signed-off-by: Patrick Boettcher <Patrick.Boettcher@dibcom.fr>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 2ba0b8db49fe9f662eb20bd5fa84c91bcdaec206
Author: Ming Lei <tom.leiming@gmail.com>
Date:   Sat Jul 16 00:51:00 2011 -0300

    uvcvideo: Set alternate setting 0 on resume if the bus has been reset
    
    commit d59a7b1dbce8b972ec2dc9fcaaae0bfa23687423 upstream.
    
    If the bus has been reset on resume, set the alternate setting to 0.
    This should be the default value, but some devices crash or otherwise
    misbehave if they don't receive a SET_INTERFACE request before any other
    video control request.
    
    Microdia's 0c45:6437 camera has been found to require this change or it
    will stop sending video data after resume.
    
    uvc_video.c]
    
    Signed-off-by: Ming Lei <ming.lei@canonical.com>
    Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 76ec8cdcca9f8fa8e2546ed96a2715a6654487ad
Author: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
Date:   Mon Jun 6 01:27:34 2011 +0000

    viafb: improve pitch handling
    
    commit 936a3f770b8de7042d793272f008ef1bb08522e9 upstream.
    
    This patch adds checks for minimum and maximum pitch size to prevent
    invalid settings which could otherwise crash the machine. Also the
    alignment is done in a slightly more readable way.
    
    Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit cdf3e3448744d14b6307dfc7f7203cba6fecf199
Author: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
Date:   Mon May 23 21:39:58 2011 +0000

    viafb: use display information in info not in var for panning
    
    commit d933990c57b498c092ceef591c7c5d69dbfe9f30 upstream.
    
    As Laurent pointed out we must not use any information in the passed
    var besides xoffset, yoffset and vmode as otherwise applications
    might abuse it. Also use the aligned fix.line_length and not the
    (possible) unaligned xres_virtual.
    
    Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
    Reported-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 3f199a7d6f2c769131f1c0dda2eb9b30d1e21617
Author: Bruno Prémont <bonbons@linux-vserver.org>
Date:   Fri Sep 2 19:24:03 2011 +0200

    fb: sh-mobile: Fix deadlock risk between lock_fb_info() and console_lock()
    
    commit 4a47a0e09c504e3ce0ccdb405411aefc5b09deb8 upstream.
    
    Following on Herton's patch "fb: avoid possible deadlock caused by
    fb_set_suspend" which moves lock_fb_info() out of fb_set_suspend()
    to its callers, correct sh-mobile's locking around call to
    fb_set_suspend() and the same sort of deaklocks with console_lock()
    due to order of taking the lock.
    
    console_lock() must be taken while fb_info is already locked and fb_info
    must be locked while calling fb_set_suspend().
    
    Signed-off-by: Bruno Prémont <bonbons@linux-vserver.org>
    Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
    Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 627afd48f8d28f14271b9ccf3b1f5d3e77237e2c
Author: Herton Ronaldo Krzesinski <herton@mandriva.com.br>
Date:   Fri Jun 17 19:02:39 2011 +0000

    fb: avoid possible deadlock caused by fb_set_suspend
    
    commit 9e769ff3f585db8f978f9113be83d36c7e3965dd upstream.
    
    A lock ordering issue can cause deadlocks: in framebuffer/console code,
    all needed struct fb_info locks are taken before acquire_console_sem(),
    in places which need to take console semaphore.
    
    But fb_set_suspend is always called with console semaphore held, and
    inside it we call lock_fb_info which gets the fb_info lock, inverse
    locking order of what the rest of the code does. This causes a real
    deadlock issue, when we write to state fb sysfs attribute (which calls
    fb_set_suspend) while a framebuffer is being unregistered by
    remove_conflicting_framebuffers, as can be shown by following show
    blocked state trace on a test program which loads i915 and runs another
    forked processes writing to state attribute:
    
    Test process with semaphore held and trying to get fb_info lock:
    ..
    fb-test2      D 0000000000000000     0   237    228 0x00000000
     ffff8800774f3d68 0000000000000082 00000000000135c0 00000000000135c0
     ffff880000000000 ffff8800774f3fd8 ffff8800774f3fd8 ffff880076ee4530
     00000000000135c0 ffff8800774f3fd8 ffff8800774f2000 00000000000135c0
    Call Trace:
     [<ffffffff8141287a>] __mutex_lock_slowpath+0x11a/0x1e0
     [<ffffffff814142f2>] ? _raw_spin_lock_irq+0x22/0x40
     [<ffffffff814123d3>] mutex_lock+0x23/0x50
     [<ffffffff8125dfc5>] lock_fb_info+0x25/0x60
     [<ffffffff8125e3f0>] fb_set_suspend+0x20/0x80
     [<ffffffff81263e2f>] store_fbstate+0x4f/0x70
     [<ffffffff812e7f70>] dev_attr_store+0x20/0x30
     [<ffffffff811c46b4>] sysfs_write_file+0xd4/0x160
     [<ffffffff81155a26>] vfs_write+0xc6/0x190
     [<ffffffff81155d51>] sys_write+0x51/0x90
     [<ffffffff8100c012>] system_call_fastpath+0x16/0x1b
    ..
    modprobe process stalled because has the fb_info lock (got inside
    unregister_framebuffer) but waiting for the semaphore held by the
    test process which is waiting to get the fb_info lock:
    ..
    modprobe      D 0000000000000000     0   230    218 0x00000000
     ffff880077a4d618 0000000000000082 0000000000000001 0000000000000001
     ffff880000000000 ffff880077a4dfd8 ffff880077a4dfd8 ffff8800775a2e20
     00000000000135c0 ffff880077a4dfd8 ffff880077a4c000 00000000000135c0
    Call Trace:
     [<ffffffff81411fe5>] schedule_timeout+0x215/0x310
     [<ffffffff81058051>] ? get_parent_ip+0x11/0x50
     [<ffffffff814130dd>] __down+0x6d/0xb0
     [<ffffffff81089f71>] down+0x41/0x50
     [<ffffffff810629ac>] acquire_console_sem+0x2c/0x50
     [<ffffffff812ca53d>] unbind_con_driver+0xad/0x2d0
     [<ffffffff8126f5f7>] fbcon_event_notify+0x457/0x890
     [<ffffffff814144ff>] ? _raw_spin_unlock_irqrestore+0x1f/0x50
     [<ffffffff81058051>] ? get_parent_ip+0x11/0x50
     [<ffffffff8141836d>] notifier_call_chain+0x4d/0x70
     [<ffffffff8108a3b8>] __blocking_notifier_call_chain+0x58/0x80
     [<ffffffff8108a3f6>] blocking_notifier_call_chain+0x16/0x20
     [<ffffffff8125dabb>] fb_notifier_call_chain+0x1b/0x20
     [<ffffffff8125e6ac>] unregister_framebuffer+0x7c/0x130
     [<ffffffff8125e8b3>] remove_conflicting_framebuffers+0x153/0x180
     [<ffffffff8125eef3>] register_framebuffer+0x93/0x2c0
     [<ffffffffa0331112>] drm_fb_helper_single_fb_probe+0x252/0x2f0 [drm_kms_helper]
     [<ffffffffa03314a3>] drm_fb_helper_initial_config+0x2f3/0x6d0 [drm_kms_helper]
     [<ffffffffa03318dd>] ? drm_fb_helper_single_add_all_connectors+0x5d/0x1c0 [drm_kms_helper]
     [<ffffffffa037b588>] intel_fbdev_init+0xa8/0x160 [i915]
     [<ffffffffa0343d74>] i915_driver_load+0x854/0x12b0 [i915]
     [<ffffffffa02f0e7e>] drm_get_pci_dev+0x19e/0x360 [drm]
     [<ffffffff8141821d>] ? sub_preempt_count+0x9d/0xd0
     [<ffffffffa0386f91>] i915_pci_probe+0x15/0x17 [i915]
     [<ffffffff8124481f>] local_pci_probe+0x5f/0xd0
     [<ffffffff81244f89>] pci_device_probe+0x119/0x120
     [<ffffffff812eccaa>] ? driver_sysfs_add+0x7a/0xb0
     [<ffffffff812ed003>] driver_probe_device+0xa3/0x290
     [<ffffffff812ed1f0>] ? __driver_attach+0x0/0xb0
     [<ffffffff812ed29b>] __driver_attach+0xab/0xb0
     [<ffffffff812ed1f0>] ? __driver_attach+0x0/0xb0
     [<ffffffff812ebd3e>] bus_for_each_dev+0x5e/0x90
     [<ffffffff812ecc2e>] driver_attach+0x1e/0x20
     [<ffffffff812ec6f2>] bus_add_driver+0xe2/0x320
     [<ffffffffa03aa000>] ? i915_init+0x0/0x96 [i915]
     [<ffffffff812ed536>] driver_register+0x76/0x140
     [<ffffffffa03aa000>] ? i915_init+0x0/0x96 [i915]
     [<ffffffff81245216>] __pci_register_driver+0x56/0xd0
     [<ffffffffa02f1264>] drm_pci_init+0xe4/0xf0 [drm]
     [<ffffffffa03aa000>] ? i915_init+0x0/0x96 [i915]
     [<ffffffffa02e84a8>] drm_init+0x58/0x70 [drm]
     [<ffffffffa03aa094>] i915_init+0x94/0x96 [i915]
     [<ffffffff81002194>] do_one_initcall+0x44/0x190
     [<ffffffff810a066b>] sys_init_module+0xcb/0x210
     [<ffffffff8100c012>] system_call_fastpath+0x16/0x1b
    ..
    
    fb-test2 which reproduces above is available on kernel.org bug #26232.
    To solve this issue, avoid calling lock_fb_info inside fb_set_suspend,
    and move it out to where needed (callers of fb_set_suspend must call
    lock_fb_info before if needed). So far, the only place which needs to
    call lock_fb_info is store_fbstate, all other places which calls
    fb_set_suspend are suspend/resume hooks that should not need the lock as
    they should be run only when processes are already frozen in
    suspend/resume.
    
    References: https://bugzilla.kernel.org/show_bug.cgi?id=26232
    Signed-off-by: Herton Ronaldo Krzesinski <herton@mandriva.com.br>
    Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit c10d19f3ad8294dbe5d500a46891fe94558be8ea
Author: Jean Delvare <jdelvare@suse.de>
Date:   Fri Jul 8 11:04:38 2011 +0200

    carminefb: Fix module parameters permissions
    
    commit c84c14224bbca6ec60d5851fcc87be0e34df2f44 upstream.
    
    The third parameter of module_param is supposed to be an octal value.
    The missing leading "0" causes the following:
    
    $ ls -l /sys/module/carminefb/parameters/
    total 0
    -rw-rwxr-- 1 root root 4096 Jul  8 08:55 fb_displays
    -rw-rwxr-- 1 root root 4096 Jul  8 08:55 fb_mode
    -rw-rwxr-- 1 root root 4096 Jul  8 08:55 fb_mode_str
    
    After fixing the perm parameter, we get the expected:
    
    $ ls -l /sys/module/carminefb/parameters/
    total 0
    -r--r--r-- 1 root root 4096 Jul  8 08:56 fb_displays
    -r--r--r-- 1 root root 4096 Jul  8 08:56 fb_mode
    -r--r--r-- 1 root root 4096 Jul  8 08:56 fb_mode_str
    
    Signed-off-by: Jean Delvare <jdelvare@suse.de>
    Cc: Paul Mundt <lethal@linux-sh.org>
    Cc: Sebastian Siewior <bigeasy@linutronix.de>
    Signed-off-by: Paul Mundt <lethal@linux-sh.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 9bdb666778b0eb502554288ac3188139c3c45f0e
Author: Joerg Roedel <joerg.roedel@amd.com>
Date:   Tue Oct 11 17:41:32 2011 +0200

    iommu/amd: Fix wrong shift direction
    
    commit fcd0861db1cf4e6ed99f60a815b7b72c2ed36ea4 upstream.
    
    The shift direction was wrong because the function takes a
    page number and i is the address is the loop.
    
    Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit cf541bb3f2532e7493720a208021e43b85156870
Author: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Date:   Wed Sep 7 15:00:02 2011 -0700

    WMI: properly cleanup devices to avoid crashes
    
    commit 023b9565972a4a5e0f01b9aa32680af6e9b5c388 upstream.
    
    We need to remove devices that we destroy from the list, otherwise
    we'll crash if there are more than one "_WDG" methods in DSDT.
    
    This fixes https://bugzilla.kernel.org/show_bug.cgi?id=32052
    
    Tested-by: Ilya Tumaykin <librarian_rus@yahoo.com>
    Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
    Acked-by: Carlos Corbacho <carlos@strangeworlds.co.uk>
    Signed-off-by: Matthew Garrett <mjg@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 761f2b411806f70dfaa3d248b4182e7ba154efd4
Author: Sebastian Ott <sebott@linux.vnet.ibm.com>
Date:   Sun Oct 30 15:16:52 2011 +0100

    ccwgroup: move attributes to attribute group
    
    commit dbdf1afcaaabe83dea15a3cb9b9013e73ae3b1ad upstream.
    
    Put sysfs attributes of ccwgroup devices in an attribute group to
    ensure that these attributes are actually present when userspace
    is notified via uevents.
    
    Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
    Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit cd1ee66bb5156203711560ee73b00e70bb8450b5
Author: Martin Schwidefsky <schwidefsky@de.ibm.com>
Date:   Sun Oct 30 15:16:08 2011 +0100

    memory leak with RCU_TABLE_FREE
    
    commit e73b7fffe487c315fd1a4fa22282e3362b440a06 upstream.
    
    The rcu page table free code uses a couple of bits in the page table
    pointer passed to tlb_remove_table to discern the different page table
    types. __tlb_remove_table extracts the type with an incorrect mask which
    leads to memory leaks. The correct mask is ((FRAG_MASK << 4) | FRAG_MASK).
    
    Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 0a85ef94c2af8630deb851e559c9d3bdf5530802
Author: Martin Schwidefsky <schwidefsky@de.ibm.com>
Date:   Sun Oct 30 15:16:07 2011 +0100

    user per registers vs. ptrace single stepping
    
    commit a45aff5285871bf7be1781d9462d3fdbb6c913f9 upstream.
    
    git commit 5e9a2692 "[S390] ptrace cleanup" introduced a regression
    for the case when both a user PER set (e.g. a storage alteration trace) and
    PTRACE_SINGLESTEP are active. The new code will overrule the user PER set
    with a instruction-fetch PER set over the whole address space for ptrace
    single stepping. The inferior process will be stopped after each instruction
    with an instruction fetch event. Any other events that may have occurred
    concurrently are not reported (e.g. storage alteration event) because the
    control bits for them are not set. The solution is to merge the PER control
    bits of the user PER set with the PER_EVENT_IFETCH control bit for
    PTRACE_SINGLESTEP.
    
    Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit d69540f85872860468e85ef8004f5580652b3335
Author: Carsten Otte <cotte@de.ibm.com>
Date:   Tue Oct 18 12:27:12 2011 +0200

    KVM: s390: check cpu_id prior to using it
    
    commit 4d47555a80495657161a7e71ec3014ff2021e450 upstream.
    
    We use the cpu id provided by userspace as array index here. Thus we
    clearly need to check it first. Ooops.
    
    Signed-off-by: Carsten Otte <cotte@de.ibm.com>
    Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
    Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 54a8a620cee91954666080a5525d7f43cad0a693
Author: Susan Gao <sgao@opensource.wolfsonmicro.com>
Date:   Thu Sep 29 11:08:18 2011 +0100

    ASoC: Fix a bug in WM8962 DSP_A and DSP_B settings
    
    commit fbc7c62a3ff831aef24894b7982cd1adb2b7e070 upstream.
    
    Signed-off-by: Susan Gao <sgao@opensource.wolfsonmicro.com>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmico.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 9c0390e9a3d5e768dfb2e007509e59d30fec9bb0
Author: Mark Brown <broonie@opensource.wolfsonmicro.com>
Date:   Fri Sep 23 21:26:33 2011 +0100

    ASoC: Remove direct register cache accesses from WM8962 driver
    
    commit 38f3f31a0a797bdbcc0cdb12553bbecc2f9a91c4 upstream.
    
    Also fix return values for speaker switch updates.
    
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 8f4d7cf1f6e6f18f96a196a07b54b575669582cc
Author: Axel Lin <axel.lin@gmail.com>
Date:   Thu Oct 20 12:13:24 2011 +0800

    ASoC: wm8994: Use SND_SOC_DAPM_AIF_OUT for AIF3 Capture
    
    commit 35024f4922f7b271e7529673413889aa3d51c5fc upstream.
    
    Signed-off-by: Axel Lin <axel.lin@gmail.com>
    Acked-by: Liam Girdwood <lrg@ti.com>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 772e6e8f76d6f0e01008b5c4bcd054be78a611ac
Author: Axel Lin <axel.lin@gmail.com>
Date:   Thu Oct 13 17:17:06 2011 +0800

    ASoC: ak4535: fixup cache register table
    
    commit 7c04241acbdaf97f1448dcccd27ea0fcd1a57684 upstream.
    
    ak4535_reg should be 8bit, but cache table is defined as 16bit.
    
    Signed-off-by: Axel Lin <axel.lin@gmail.com>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 681c941ad1d50d46d61d435304f386efd763be9d
Author: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Date:   Thu Oct 13 02:03:54 2011 -0700

    ASoC: ak4642: fixup cache register table
    
    commit 19b115e523208a926813751aac8934cf3fc6085e upstream.
    
    ak4642 register was 8bit, but cache table was defined as 16bit.
    ak4642 doesn't work correctry without this patch.
    
    Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 311afee68d5f06f9f0910231b17e9d5b25ec4491
Author: Axel Lin <axel.lin@gmail.com>
Date:   Mon Oct 17 20:14:56 2011 +0800

    ASoC: wm8741: Fix setting interface format for DSP modes
    
    commit 3a340104fad6ecbea5ad6792a2ea855f0507a6e0 upstream.
    
    According to the datasheet:
    Format Control (05h)
    BITS[3:2]
            FMT[1:0] Audio data format selection
                    00 = right justified mode
                    01 = left justified mode
                    10 = I2S mode
                    11 = DSP mode
    BIT[4]  LRP Polarity selec for LRCLK/DSP mode select
                    0 = normal LRCLK poalrity/DSP mode A
                    1 = inverted LRCLK poarity/DSP mode B
    
    For SND_SOC_DAIFMT_DSP_A, we should set 0x000C instead of 0x0003.
    For SND_SOC_DAIFMT_DSP_B, we should set 0x001C instead of 0x0013.
    
    Signed-off-by: Axel Lin <axel.lin@gmail.com>
    Acked-by: Liam Girdwood <lrg@ti.com>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit dae187ec04a6f7752b140d789269730791a7388f
Author: Axel Lin <axel.lin@gmail.com>
Date:   Wed Oct 26 09:53:41 2011 +0800

    ASoC: wm8940: Properly set codec->dapm.bias_level
    
    commit 5927f94700e860ae27ff24e7f3bc9e4f7b9922eb upstream.
    
    Reported-by: Chris Paulson-Ellis <chris@edesix.com>
    Signed-off-by: Axel Lin <axel.lin@gmail.com>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 0198c89767e26f78e619eef2309be74186b4fdcd
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Wed Sep 28 11:57:23 2011 +0200

    io-mapping: ensure io_mapping_map_atomic _is_ atomic
    
    commit 24dd85ff723f142093f44244764b9b5c152235b8 upstream.
    
    For the !HAVE_ATOMIC_IOMAP case the stub functions did not call
    pagefault_disable/_enable. The i915 driver relies on the map
    actually being atomic, otherwise it can deadlock with it's own
    pagefault handler in the gtt pwrite fastpath.
    
    This is exercised by gem_mmap_gtt from the intel-gpu-toosl gem
    testsuite.
    
    v2: Chris Wilson noted the lack of an include.
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=38115
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 2f8c09acae88d1bf0aeedffd3f788eb5c5b4db29
Author: Bryan Schumaker <bjschuma@netapp.com>
Date:   Fri Oct 7 13:41:15 2011 -0400

    vfs: add "device" tag to /proc/self/mountstats
    
    commit a877ee03ac010ded434b77f7831f43cbb1fcc60f upstream.
    
    nfsiostat was failing to find mounted filesystems on kernels after
    2.6.38 because of changes to show_vfsstat() by commit
    c7f404b40a3665d9f4e9a927cc5c1ee0479ed8f9.  This patch adds back the
    "device" tag before the nfs server entry so scripts can parse the
    mountstats file correctly.
    
    Signed-off-by: Bryan Schumaker <bjschuma@netapp.com>
    Signed-off-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit b2f0a734b06e2e257bb0565800ac222244d981dc
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Wed Jul 27 22:21:58 2011 -0400

    hppfs: missing include
    
    commit d6b722aa383a467a43d09ee38e866981abba08ab upstream.
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Cc: Miklos Szeredi <miklos@szeredi.hu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 0dc8985b7f2da02180135396871d396f33a39b43
Author: J. Bruce Fields <bfields@redhat.com>
Date:   Mon Oct 10 17:34:31 2011 -0400

    nfsd4: ignore WANT bits in open downgrade
    
    commit c30e92df30d7d5fe65262fbce5d1b7de675fe34e upstream.
    
    We don't use WANT bits yet--and sending them can probably trigger a
    BUG() further down.
    
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 279b483174560147e9f56f79e9b1fd3bd4fc8f40
Author: J. Bruce Fields <bfields@redhat.com>
Date:   Mon Sep 19 15:07:41 2011 -0400

    nfsd4: fix open downgrade, again
    
    commit 3d02fa29dec920c597dd7b7db608a4bc71f088ce upstream.
    
    Yet another open-management regression:
    
    	- nfs4_file_downgrade() doesn't remove the BOTH access bit on
    	  downgrade, so the server's idea of the stateid's access gets
    	  out of sync with the client's.  If we want to keep an O_RDWR
    	  open in this case, we should do that in the file_put_access
    	  logic rather than here.
    	- We forgot to convert v4 access to an open mode here.
    
    This logic has proven too hard to get right.  In the future we may
    consider:
    	- reexamining the lock/openowner relationship (locks probably
    	  don't really need to take their own references here).
    	- adding open upgrade/downgrade support to the vfs.
    	- removing the atomic operations.  They're redundant as long as
    	  this is all under some other lock.
    
    Also, maybe some kind of additional static checking would help catch
    O_/NFS4_SHARE_ACCESS confusion.
    
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 0a52cb1083a662d4c417638ccdaa81df0e67494b
Author: J. Bruce Fields <bfields@redhat.com>
Date:   Thu Aug 25 10:48:39 2011 -0400

    nfsd4: permit read opens of executable-only files
    
    commit a043226bc140a2c1dde162246d68a67e5043e6b2 upstream.
    
    A client that wants to execute a file must be able to read it.  Read
    opens over nfs are therefore implicitly allowed for executable files
    even when those files are not readable.
    
    NFSv2/v3 get this right by using a passed-in NFSD_MAY_OWNER_OVERRIDE on
    read requests, but NFSv4 has gotten this wrong ever since
    dc730e173785e29b297aa605786c94adaffe2544 "nfsd4: fix owner-override on
    open", when we realized that the file owner shouldn't override
    permissions on non-reclaim NFSv4 opens.
    
    So we can't use NFSD_MAY_OWNER_OVERRIDE to tell nfsd_permission to allow
    reads of executable files.
    
    So, do the same thing we do whenever we encounter another weird NFS
    permission nit: define yet another NFSD_MAY_* flag.
    
    The industry's future standardization on 128-bit processors will be
    motivated primarily by the need for integers with enough bits for all
    the NFSD_MAY_* flags.
    
    Reported-by: Leonardo Borda <leonardoborda@gmail.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit e3d0b28c5ec3bf7628a9707a6392cdb4adebabba
Author: J. Bruce Fields <bfields@redhat.com>
Date:   Wed Aug 10 19:16:22 2011 -0400

    nfsd4: fix seqid_mutating_error
    
    commit 576163005de286bbd418fcb99cfd0971523a0c6d upstream.
    
    The set of errors here does *not* agree with the set of errors specified
    in the rfc!
    
    While we're there, turn this macros into a function, for the usual
    reasons, and move it to the one place where it's actually used.
    
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 80931f71f0e7c151aa260590c655d536c967af56
Author: J. Bruce Fields <bfields@redhat.com>
Date:   Wed Aug 10 19:07:33 2011 -0400

    nfsd4: stop using nfserr_resource for transitory errors
    
    commit 3e77246393c0a433247631a1f0e9ec98d3d78a1c upstream.
    
    The server is returning nfserr_resource for both permanent errors and
    for errors (like allocation failures) that might be resolved by retrying
    later.  Save nfserr_resource for the former and use delay/jukebox for
    the latter.
    
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 6176ebe5391aa20700f9348fa7f7aca1a559e78f
Author: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>
Date:   Mon Aug 8 17:38:08 2011 +0200

    nfsd4: Remove check for a 32-bit cookie in nfsd4_readdir()
    
    commit 832023bffb4b493f230be901f681020caf3ed1f8 upstream.
    
    Fan Yong <yong.fan@whamcloud.com> noticed setting
    FMODE_32bithash wouldn't work with nfsd v4, as
    nfsd4_readdir() checks for 32 bit cookies. However, according to RFC 3530
    cookies have a 64 bit type and cookies are also defined as u64 in
    'struct nfsd4_readdir'. So remove the test for >32-bit values.
    
    Signed-off-by: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 60eb9e7d1a8aeec2d4371ec445e7fd4425d05017
Author: Jeff Layton <jlayton@redhat.com>
Date:   Wed Oct 12 10:57:42 2011 -0400

    nfs: don't try to migrate pages with active requests
    
    commit 2da956523526e440ef4f4dd174e26f5ac06fe011 upstream.
    
    nfs_find_and_lock_request will take a reference to the nfs_page and
    will then put it if the req is already locked. It's possible though
    that the reference will be the last one. That put then can kick off
    a whole series of reference puts:
    
    nfs_page
       nfs_open_context
          dentry
              inode
    
    If the inode ends up being deleted, then the VFS will call
    truncate_inode_pages. That function will try to take the page lock, but
    it was already locked when migrate_page was called. The code
    deadlocks.
    
    Fix this by simply refusing the migration request if PagePrivate is
    already set, indicating that the page is already associated with an
    active read or write request.
    
    We've had a customer test a backported version of this patch and
    the preliminary results seem good.
    
    Cc: Andrea Arcangeli <aarcange@redhat.com>
    Reported-by: Harshula Jayasuriya <harshula@redhat.com>
    Signed-off-by: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 09bb52774e0543390bdba59b67ade093d34e4906
Author: Ian Campbell <ian.campbell@citrix.com>
Date:   Mon Oct 3 15:37:00 2011 +0100

    genirq: Add IRQF_RESUME_EARLY and resume such IRQs earlier
    
    commit 9bab0b7fbaceec47d32db51cd9e59c82fb071f5a upstream.
    
    This adds a mechanism to resume selected IRQs during syscore_resume
    instead of dpm_resume_noirq.
    
    Under Xen we need to resume IRQs associated with IPIs early enough
    that the resched IPI is unmasked and we can therefore schedule
    ourselves out of the stop_machine where the suspend/resume takes
    place.
    
    This issue was introduced by 676dc3cf5bc3 "xen: Use IRQF_FORCE_RESUME".
    
    Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
    Cc: Rafael J. Wysocki <rjw@sisk.pl>
    Cc: Jeremy Fitzhardinge <Jeremy.Fitzhardinge@citrix.com>
    Cc: xen-devel <xen-devel@lists.xensource.com>
    Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Link: http://lkml.kernel.org/r/1318713254.11016.52.camel@dagon.hellion.org.uk
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 12cb3e734a5616ea0057aee938c553ff6ccbdfbd
Author: Steven Rostedt <srostedt@redhat.com>
Date:   Fri Oct 14 10:44:25 2011 -0400

    tracing: Fix returning of duplicate data after EOF in trace_pipe_raw
    
    commit 436fc280261dcfce5af38f08b89287750dc91cd2 upstream.
    
    The trace_pipe_raw handler holds a cached page from the time the file
    is opened to the time it is closed. The cached page is used to handle
    the case of the user space buffer being smaller than what was read from
    the ring buffer. The left over buffer is held in the cache so that the
    next read will continue where the data left off.
    
    After EOF is returned (no more data in the buffer), the index of
    the cached page is set to zero. If a user app reads the page again
    after EOF, the check in the buffer will see that the cached page
    is less than page size and will return the cached page again. This
    will cause reading the trace_pipe_raw again after EOF to return
    duplicate data, making the output look like the time went backwards
    but instead data is just repeated.
    
    The fix is to not reset the index right after all data is read
    from the cache, but to reset it after all data is read and more
    data exists in the ring buffer.
    
    Reported-by: Jeremy Eder <jeder@redhat.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit d59892017c5f6de2fdee221f2a7788696e9f2cda
Author: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Date:   Tue Oct 4 19:45:04 2011 +0900

    perf probe: Fix to show correct error string
    
    commit 44a56040a0037a845d5fa218dffde464579f0cab upstream.
    
    Fix perf probe to show correct error string when it
    fails to delete an event. The write(2) returns -1
    if failed, and errno stores real error number.
    
    Signed-off-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
    Cc: Paul Mackerras <paulus@samba.org>
    Cc: Ingo Molnar <mingo@elte.hu>
    Link: http://lkml.kernel.org/r/20111004104504.14591.41266.stgit@fedora15
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit a847627709b3402163d99f7c6fda4a77bcd6b51b
Author: NeilBrown <neilb@suse.de>
Date:   Wed Oct 26 10:31:04 2011 +1100

    md/raid5: fix bug that could result in reads from a failed device.
    
    commit 355840e7a7e56bb2834fd3b0da64da5465f8aeaa upstream.
    
    This bug was introduced in 415e72d034c50520ddb7ff79e7d1792c1306f0c9
    which was in 2.6.36.
    
    There is a small window of time between when a device fails and when
    it is removed from the array.  During this time we might still read
    from it, but we won't write to it - so it is possible that we could
    read stale data.
    
    We didn't need the test of 'Faulty' before because the test on
    In_sync is sufficient.  Since we started allowing reads from the early
    part of non-In_sync devices we need a test on Faulty too.
    
    This is suitable for any kernel from 2.6.36 onwards, though the patch
    might need a bit of tweaking in 3.0 and earlier.
    
    Signed-off-by: NeilBrown <neilb@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit e747500485ddef175ac6694dcff4fd8088e62071
Author: Jan Beulich <JBeulich@suse.com>
Date:   Wed Sep 28 16:44:54 2011 +0100

    apic, i386/bigsmp: Fix false warnings regarding logical APIC ID mismatches
    
    commit 838312be46f3abfbdc175f81c3e54a857994476d upstream.
    
    These warnings (generally one per CPU) are a result of
    initializing x86_cpu_to_logical_apicid while apic_default is
    still in use, but the check in setup_local_APIC() being done
    when apic_bigsmp was already used as an override in
    default_setup_apic_routing():
    
     Overriding APIC driver with bigsmp
     Enabling APIC mode:  Physflat.  Using 5 I/O APICs
     ------------[ cut here ]------------
     WARNING: at .../arch/x86/kernel/apic/apic.c:1239
     ...
     CPU 1 irqstacks, hard=f1c9a000 soft=f1c9c000
     Booting Node   0, Processors  #1
     smpboot cpu 1: start_ip = 9e000
     Initializing CPU#1
     ------------[ cut here ]------------
     WARNING: at .../arch/x86/kernel/apic/apic.c:1239
     setup_local_APIC+0x137/0x46b() Hardware name: ...
     CPU1 logical APIC ID: 2 != 8
     ...
    
    Fix this (for the time being, i.e. until
    x86_32_early_logical_apicid() will get removed again, as Tejun
    says ought to be possible) by overriding the previously stored
    values at the point where the APIC driver gets overridden.
    
    v2: Move this and the pre-existing override logic into
        arch/x86/kernel/apic/bigsmp_32.c.
    
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Tejun Heo <tj@kernel.org>
    Link: http://lkml.kernel.org/r/4E835D16020000780005844C@nat28.tlf.novell.com
    Signed-off-by: Ingo Molnar <mingo@elte.hu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit c7f65094f7e2b8463a7c002e967e78db8f30468a
Author: hank <pyu@redhat.com>
Date:   Tue Sep 20 13:53:39 2011 -0700

    time: Change jiffies_to_clock_t() argument type to unsigned long
    
    commit cbbc719fccdb8cbd87350a05c0d33167c9b79365 upstream.
    
    The parameter's origin type is long. On an i386 architecture, it can
    easily be larger than 0x80000000, causing this function to convert it
    to a sign-extended u64 type.
    
    Change the type to unsigned long so we get the correct result.
    
    Signed-off-by: hank <pyu@redhat.com>
    Cc: John Stultz <john.stultz@linaro.org>
    [ build fix ]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Ingo Molnar <mingo@elte.hu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 40b3c4dc2c6c44972323be3a1ebd62c4fe35fac0
Author: Luciano Coelho <coelho@ti.com>
Date:   Thu Sep 22 10:06:10 2011 +0300

    wl12xx: fix forced passive scans
    
    commit 6cd9d21a0c1e2648c07c32c66bb25795ad3208aa upstream.
    
    We were using incorrect max and min dwell times during forced passive
    scans because we were still using the active scan states to scan
    (passively) the channels that were not marked as passive.
    
    Instead of doing passive scans in active states, we now skip active
    states and scan for all channels in passive states.
    
    Signed-off-by: Luciano Coelho <coelho@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit babba877daf7a7ee0cb03dfb5e63f23e2d32dddf
Author: Richard Cochran <richardcochran@gmail.com>
Date:   Fri Oct 21 00:49:15 2011 +0000

    net: hold sock reference while processing tx timestamps
    
    commit da92b194cc36b5dc1fbd85206aeeffd80bee0c39 upstream.
    
    The pair of functions,
    
     * skb_clone_tx_timestamp()
     * skb_complete_tx_timestamp()
    
    were designed to allow timestamping in PHY devices. The first
    function, called during the MAC driver's hard_xmit method, identifies
    PTP protocol packets, clones them, and gives them to the PHY device
    driver. The PHY driver may hold onto the packet and deliver it at a
    later time using the second function, which adds the packet to the
    socket's error queue.
    
    As pointed out by Johannes, nothing prevents the socket from
    disappearing while the cloned packet is sitting in the PHY driver
    awaiting a timestamp. This patch fixes the issue by taking a reference
    on the socket for each such packet. In addition, the comments
    regarding the usage of these function are expanded to highlight the
    rule that PHY drivers must use skb_complete_tx_timestamp() to release
    the packet, in order to release the socket reference, too.
    
    These functions first appeared in v2.6.36.
    
    Reported-by: Johannes Berg <johannes@sipsolutions.net>
    Signed-off-by: Richard Cochran <richard.cochran@omicron.at>
    Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
    Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 4641f8a010eb97303fbc9bd8a094139b52ffd629
Author: Johannes Berg <johannes.berg@intel.com>
Date:   Tue Oct 4 18:27:10 2011 +0200

    mac80211: fix offchannel TX cookie matching
    
    commit 28a1bcdb57d50f3038a255741ecc83e391e5282e upstream.
    
    When I introduced in-kernel off-channel TX I
    introduced a bug -- the work can't be canceled
    again because the code clear the skb pointer.
    Fix this by keeping track separately of whether
    TX status has already been reported.
    
    Reported-by: Jouni Malinen <j@w1.fi>
    Tested-by: Jouni Malinen <j@w1.fi>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 806aeb924e925e6f1584ff956c9b9695e4ec18f9
Author: Richard Cochran <richardcochran@gmail.com>
Date:   Fri Oct 21 00:49:17 2011 +0000

    dp83640: free packet queues on remove
    
    commit 8b3408f8ee994973869d8ba32c5bf482bc4ddca4 upstream.
    
    If the PHY should disappear (for example, on an USB Ethernet MAC), then
    the driver would leak any undelivered time stamp packets. This commit
    fixes the issue by calling the appropriate functions to free any packets
    left in the transmit and receive queues.
    
    The driver first appeared in v3.0.
    
    Signed-off-by: Richard Cochran <richard.cochran@omicron.at>
    Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 32779fa06584fdcab2228a36c3a846fa0a6f5cdb
Author: Eric W. Biederman <ebiederm@xmission.com>
Date:   Fri Oct 21 06:24:20 2011 +0000

    rtnetlink: Add missing manual netlink notification in dev_change_net_namespaces
    
    commit d2237d35748e7f448a9c2d9dc6a85ef637466e24 upstream.
    
    Renato Westphal noticed that since commit a2835763e130c343ace5320c20d33c281e7097b7
    "rtnetlink: handle rtnl_link netlink notifications manually" was merged
    we no longer send a netlink message when a networking device is moved
    from one network namespace to another.
    
    Fix this by adding the missing manual notification in dev_change_net_namespaces.
    
    Since all network devices that are processed by dev_change_net_namspaces are
    in the initialized state the complicated tests that guard the manual
    rtmsg_ifinfo calls in rollback_registered and register_netdevice are
    unnecessary and we can just perform a plain notification.
    
    Tested-by: Renato Westphal <renatowestphal@gmail.com>
    Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit e277beeb68b1f1e9326d57913a41549744002449
Author: Ming Lei <ming.lei@canonical.com>
Date:   Fri Oct 7 11:50:22 2011 +0800

    ata_piix: make DVD Drive recognisable on systems with Intel Sandybridge chipsets(v2)
    
    commit 5e5a4f5d5a08c9c504fe956391ac3dae2c66556d upstream.
    
    This quirk patch fixes one kind of bug inside some Intel Sandybridge
    chipsets, see reports from
    
           https://bugzilla.kernel.org/show_bug.cgi?id=40592.
    
    Many guys also have reported the problem before:
    
    	https://bugs.launchpad.net/bugs/737388
    	https://bugs.launchpad.net/bugs/794642
    	https://bugs.launchpad.net/bugs/782389
    	......
    
    With help from Tejun, the problem is found to be caused by 32bit PIO
    mode, so introduce the quirk patch to disable 32bit PIO on SATA piix
    for some Sandybridge CPT chipsets.
    
    Seth also tested the patch on all five affected chipsets
    (pci device ID: 0x1c00, 0x1c01, 0x1d00, 0x1e00, 0x1e01), and found
    the patch does fix the problem.
    
    Tested-by: Heasley, Seth <seth.heasley@intel.com>
    Cc: Alan Cox <alan@linux.intel.com>
    Signed-off-by: Ming Lei <ming.lei@canonical.com>
    Acked-by: Tejun Heo <htejun@gmail.com>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 363d0372b331c8ac8ef54c0bd81aadea43cfd74c
Author: Jeff Layton <jlayton@redhat.com>
Date:   Tue Oct 11 09:49:21 2011 -0400

    nfs: don't redirty inode when ncommit == 0 in nfs_commit_unstable_pages
    
    commit 3236c3e1adc0c7ec83eaff1de2d06746b7c5bb28 upstream.
    
    commit 420e3646 allowed the kernel to reduce the number of unnecessary
    commit calls by skipping the commit when there are a large number of
    outstanding pages.
    
    However, the current test in nfs_commit_unstable_pages does not handle
    the edge condition properly. When ncommit == 0, then that means that the
    kernel doesn't need to do anything more for the inode. The current test
    though in the WB_SYNC_NONE case will return true, and the inode will end
    up being marked dirty. Once that happens the inode will never be clean
    until there's a WB_SYNC_ALL flush.
    
    Fix this by immediately returning from nfs_commit_unstable_pages when
    ncommit == 0.
    
    Mike noticed this problem initially in RHEL5 (2.6.18-based kernel) which
    has a backported version of 420e3646. The inode cache there was growing
    very large. The inode cache was unable to be shrunk since the inodes
    were all marked dirty. Calling sync() would essentially "fix" the
    problem -- the WB_SYNC_ALL flush would result in the inodes all being
    marked clean.
    
    What I'm not clear on is how big a problem this is in mainline kernels
    as the writeback code there is very different. Either way, it seems
    incorrect to re-mark the inode dirty in this case.
    
    Reported-by: Mike McLean <mikem@redhat.com>
    Signed-off-by: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit b04a57568d86586d704babc7584e5fff4343fc61
Author: Trond Myklebust <Trond.Myklebust@netapp.com>
Date:   Mon Oct 17 18:22:55 2011 -0700

    Revert "NFS: Ensure that writeback_single_inode() calls write_inode() when syncing"
    
    commit 59b7c05fffba030e5d9e72324691e2f99aa69b79 upstream.
    
    This reverts commit b80c3cb628f0ebc241b02e38dd028969fb8026a2.
    
    The reverted commit was rendered obsolete by a VFS fix: commit
    5547e8aac6f71505d621a612de2fca0dd988b439 (writeback: Update dirty flags in
    two steps). We now no longer need to worry about writeback_single_inode()
    missing our marking the inode for COMMIT in 'do_writepages()' call.
    
    Reverting this patch, fixes a performance regression in which the inode
    would continuously get queued to the dirty list, causing the writeback
    code to unnecessarily try to send a COMMIT.
    
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Tested-by: Simon Kirby <sim@hostway.ca>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 3cdf240310b4f3d94981d727d3660c78a50a40c6
Author: Jiri Kosina <jkosina@suse.cz>
Date:   Wed Oct 26 13:10:39 2011 +1030

    kmod: prevent kmod_loop_msg overflow in __request_module()
    
    commit 37252db6aa576c34fd794a5a54fb32d7a8b3a07a upstream.
    
    Due to post-increment in condition of kmod_loop_msg in __request_module(),
    the system log can be spammed by much more than 5 instances of the 'runaway
    loop' message if the number of events triggering it makes the kmod_loop_msg
    to overflow.
    
    Fix that by making sure we never increment it past the threshold.
    
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 50f621d8f5b6f9e8ed931df12c595fd0e882f8e3
Author: David Herrmann <dh.herrmann@googlemail.com>
Date:   Tue Sep 20 09:16:12 2011 -0700

    Platform: Fix error path in samsung-laptop init
    
    commit a7ea19926ffba86f373f6050a106cd162dbb9a78 upstream.
    
    samsung_init() should not return success if not all devices are initialized.
    Otherwise, samsung_exit() will dereference sdev NULL pointers and others.
    
    Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Matthew Garrett <mjg@redhat.com>

commit 08a84a609d1679c9aeb958c3bc7886118e682b77
Author: Jason Stubbs <jasonbstubbs@gmail.com>
Date:   Tue Sep 20 09:16:11 2011 -0700

    platform: samsung_laptop: fix samsung brightness min/max calculations
    
    commit bee460be8c691c544e84ed678280ace6153104c6 upstream.
    
    The min_brightness value of the sabi_config is incorrectly used in brightness
    calculations. For the config where min_brightness = 1 and max_brightness = 8,
    the user visible range should be 0 to 7 with hardware being set in the range
    of 1 to 8. What is actually happening is that the user visible range is 0 to
    8 with hardware being set in the range of -1 to 7.
    
    This patch fixes the above issue as well as a miscalculation that would occur
    in the case of min_brightness > 1.
    
    Signed-off-by: Jason Stubbs <jasonbstubbs@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Matthew Garrett <mjg@redhat.com>

commit 472806574215cfc649b3619b2047785fe2897b58
Author: Smelov Andrey <xor29a@bk.ru>
Date:   Tue Sep 20 09:16:10 2011 -0700

    Platform: samsung_laptop: samsung backlight for R528/R728
    
    commit 093ed561648d43263c009ea88abab21a31cd4f1d upstream.
    
    patch works for me, but I need to add "acpi_backlight=vendor" to kernel
    params
    
    Signed-off-by: Smelov Andrey <xor29a@bk.ru>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Matthew Garrett <mjg@redhat.com>

commit b0da5e7b1493c59b04604d6839565a6135773002
Author: Tommaso Massimi <tmassimi@gmail.com>
Date:   Tue Sep 20 09:16:09 2011 -0700

    Platform: samsung_laptop: add support for X520 machines.
    
    commit 7500eeb08a179e61a4219288c21407d63d1e9c64 upstream.
    
    my samsung laptop would be very happy if you add
    these lines to the file drivers/platform/x86/samsung-laptop.c
    
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Matthew Garrett <mjg@redhat.com>

commit b78db0895fff3d3da005f8e03f700b9a559c1065
Author: Stefan Beller <stefanbeller@googlemail.com>
Date:   Tue Sep 20 09:16:08 2011 -0700

    platform: samsung_laptop: add dmi information for Samsung R700 laptops
    
    commit f87d02996f05ec1789ceecce9ec839f629b7aa80 upstream.
    
    My DMI model is this:
    >dmesg |grep DMI
    [    0.000000] DMI present.
    [    0.000000] DMI: SAMSUNG ELECTRONICS CO., LTD. SR700/SR700, BIOS
    04SR 02/20/2008
    
    adding dmi information of Samsung R700 laptops
    This adds the dmi information of Samsungs R700 laptops.
    
    Signed-off-by: Stefan Beller <stefanbeller@googlemail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Matthew Garrett <mjg@redhat.com>

commit 5c2433cdc72a03446184e2f898be3b05095b5ed0
Author: David Woodhouse <dwmw2@infradead.org>
Date:   Mon Oct 24 21:25:21 2011 +0000

    caif: Fix BUG() with network namespaces
    
    commit 08613e4626c06ca408fc55071f6aedee36986a87 upstream.
    
    The caif code will register its own pernet_operations, and then register
    a netdevice_notifier. Each time the netdevice_notifier is triggered,
    it'll do some stuff... including a lookup of its own pernet stuff with
    net_generic().
    
    If the net_generic() call ever returns NULL, the caif code will BUG().
    That doesn't seem *so* unreasonable, I suppose — it does seem like it
    should never happen.
    
    However, it *does* happen. When we clone a network namespace,
    setup_net() runs through all the pernet_operations one at a time. It
    gets to loopback before it gets to caif. And loopback_net_init()
    registers a netdevice... while caif hasn't been initialised. So the caif
    netdevice notifier triggers, and immediately goes BUG().
    
    We could imagine a complex and overengineered solution to this generic
    class of problems, but this patch takes the simple approach. It just
    makes caif_device_notify() *not* go looking for its pernet data
    structures if the device it's being notified about isn't a caif device
    in the first place.
    
    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
    Acked-by: Sjur Brændeland <sjur.brandeland@stericsson.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 7b59e3e29e1a28ad40892dd2115175e2702f1153
Author: Milan Broz <mbroz@redhat.com>
Date:   Mon Aug 22 15:51:34 2011 +0200

    kobj_uevent: Ignore if some listeners cannot handle message
    
    commit ebf4127cd677e9781b450e44dfaaa1cc595efcaa upstream.
    
    kobject_uevent() uses a multicast socket and should ignore
    if one of listeners cannot handle messages or nobody is
    listening at all.
    
    Easily reproducible when a process in system is cloned
    with CLONE_NEWNET flag.
    
    (See also http://article.gmane.org/gmane.linux.kernel.device-mapper.dm-crypt/5256)
    
    Signed-off-by: Milan Broz <mbroz@redhat.com>
    Acked-by: Kay Sievers <kay.sievers@vrfy.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit a19d5a89a43fa64f2739bdadbc35d4723ab9bcdb
Author: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Date:   Fri Jul 22 12:51:48 2011 -0400

    xen-swiotlb: Fix wrong panic.
    
    commit ab2a47bd242d6cdcf6b2b64797f271c6f0a6d338 upstream.
    
    Propagate the baremetal git commit "swiotlb: fix wrong panic"
    (fba99fa38b023224680308a482e12a0eca87e4e1) in the Xen-SWIOTLB version.
    wherein swiotlb's map_page wrongly calls panic() when it can't find
    a buffer fit for device's dma mask.  It should return an error instead.
    
    Devices with an odd dma mask (i.e.  under 4G) like b44 network card hit
    this bug (the system crashes):
    
    http://marc.info/?l=linux-kernel&m=129648943830106&w=2
    
    If xen-swiotlb returns an error, b44 driver can use the own bouncing
    mechanism.
    
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 50bac9ce730674d25f010b5a591e8376e001658f
Author: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Date:   Fri Jul 22 12:18:43 2011 -0400

    xen-pcifront: Update warning comment to use 'e820_host' option.
    
    commit 917e3e65c35459d52f0d0b890aa5df0cad07a051 upstream.
    
    With Xen changeset 23428 "libxl: Add 'e820_host' option to config file"
    the E820 as seen from the host can now be passed into the guest.
    This means that a PV guest can now:
     - Use the correct PCI I/O gap. Before these patches, Linux guest would
       boot up and would tell:
       [    0.000000] Allocating PCI resources starting at 40000000 (gap: 40000000:c0000000)
       while in actuality the PCI I/O gap should have been:
       [    0.000000] Allocating PCI resources starting at b0000000 (gap: b0000000:4c000000)
    
     - The PV domain with PCI devices was limited to 3GB. It now can be booted
       with 4GB, 8GB, or whatever number you want. The PCI devices will now _not_ conflict
       with System RAM. Meaning the drivers can load.
    
    CC: Jesse Barnes <jbarnes@virtuousgeek.org>
    CC: linux-pci@vger.kernel.org
    [v2: Made the string less broken up. Suggested by Joe Perches]
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit f9409cf55e878e48f3649522b06a3f7c74d48f8c
Author: Josh Boyer <jwboyer@redhat.com>
Date:   Mon Oct 17 21:16:39 2011 -0400

    Update email address for stable patch submission
    
    commit 5fa224295f0e0358c8bc0e5390702338df889def upstream.
    
    The stable@kernel.org email address has been replaced with the
    stable@vger.kernel.org mailing list.  Change the stable kernel rules to
    reference the new list instead of the semi-defunct email alias.
    
    Signed-off-by: Josh Boyer <jwboyer@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit d25b0f91d1f35a91b2eb49d139fa2803f55b6b47
Author: Jerry Huang <r66093@freescale.com>
Date:   Tue Oct 18 13:09:48 2011 +0800

    QE/FHCI: fixed the CONTROL bug
    
    commit 273d23574f9dacd9c63c80e7d63639a669aad441 upstream.
    
    For USB CONTROL transaction, when the data length is zero,
    the IN package is needed to finish this transaction in status stage.
    
    Signed-off-by: Jerry Huang <r66093@freescale.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 5b81a5e1aee86808849307d5e025185ee5bde276
Author: Sergei Kolzun <x0r@dv-life.ru>
Date:   Thu Aug 4 00:25:56 2011 -0700

    HID: ACRUX - fix enabling force feedback support
    
    commit 364b936fc38dec7653c690d710e10657af235a36 upstream.
    
    The config option needs to be a 'bool' and not a tristate, otheriwse
    force feedback support never makes it into the module.
    
    Signed-off-by: Sergei Kolzun <x0r@dv-life.ru>
    Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 07bb3623343d8060b6f68aa294e3ecb9391a82d4
Author: Felix Fietkau <nbd@openwrt.org>
Date:   Sat Oct 8 15:49:57 2011 +0200

    ath9k: disable unnecessary PHY error reporting
    
    commit ac06697c79bad09e44a8b1d52104014016fb90de upstream.
    
    PHY errors relevant for ANI are always tracked by hardware counters, the
    bits that allow them to pass through the rx filter are independent of that.
    Enabling PHY errors in the rx filter often creates lots of useless DMA traffic
    and might be responsible for some of the rx dma stop failure warnings.
    
    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit e4779966c769188b76ee699e0ab476030b2d2e6a
Author: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Date:   Fri Sep 30 11:31:27 2011 +0530

    ath9k_hw: Fix number of GPIO pins for AR9287/9300
    
    commit 6321eb0977b011ac61dfca36e7c69b2c4325b104 upstream.
    
    this patch fixes the assumption of maximum number of GPIO pins present
    in AR9287/AR9300. this fix is essential as we might encounter some
    functionality issues involved in accessing the status of GPIO pins which
    are all incorrectly assumed to be not within the range of max_num_gpio
    of AR9300/AR9287 chipsets
    
    Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 7ff861f96140c2dc6411deafb281dbfe958324d9
Author: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
Date:   Thu Sep 29 10:42:19 2011 -0700

    ath9k_htc: add AVM FRITZ!WLAN 11N v2 support
    
    commit 8c34559b4a6df32e4af1b073397fa4dc189a5485 upstream.
    
    This was reported and tested by Martin Walter over at AVM GmbH Berlin.
    This also applies to 3.0.1 so sendint to stable.
    
    Cc: s.kirste@avm.de
    Cc: d.friedel@avm.de
    Cc: Martin Walter <m.walter@avm.de>
    Cc: Peter Grabienski <pgrabien@qca.qualcomm.com>
    Tested-by: Martin Walter <m.walter@avm.de>
    Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 26155866748bad74d6b257ba891d794dad85f621
Author: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Date:   Thu Sep 15 19:02:25 2011 +0530

    ath9k_hw: Fix magnitude/phase coeff correction
    
    commit e9c10469cf3c71bc1c6b0f01319161e277d6ac9b upstream.
    
    Do the magnitude/phase coeff correction only if the outlier
    is detected. Updating wrong magnitude/phase coeff factor
    impacts not only tx gain setting but also leads to poor
    performance in congested networks. In the clear environment
    the impact is very minimal because the outlier happens
    very rarely according to the past experiment. It occured
    less than once every 1000 calibrations.
    
    Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 1ad894adcc396cb74d1ee7173d013a803c457ad8
Author: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
Date:   Sat Aug 20 17:22:09 2011 +0530

    ath9k_hw: Fix descriptor status of TxOpExceeded
    
    commit 2a15b394f8e46dd3e2ab365ab41cfa701d92fa77 upstream.
    
    Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 0ada2d28df779a5368b9ca77e1a7088bbabf68d7
Author: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
Date:   Tue Aug 23 15:07:31 2011 -0700

    MAINTANERS: update Qualcomm Atheros addresses
    
    commit fe8e084455f273b32cc57a5fbaf6c22ef984d657 upstream.
    
    Qualcomm ate up Atheros, all of the old e-mail addresses
    no longer work and e-mails sent to it will bounce. Update
    the addresses to the new shiny Qualcomm Atheros (QCA) ones.
    
    Cc: stable@kernel.org
    Cc: netdev@vger.kernel.org
    Cc: jouni@qca.qualcomm.com
    Cc: yangjie@qca.qualcomm.com
    Cc: vthiagar@qca.qualcomm.com
    Cc: senthilb@qca.qualcomm.com
    Signed-off-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 68401aa09eece84a291c98d3c2d39d09f7f7336f
Author: Dan Williams <dcbw@redhat.com>
Date:   Tue Sep 13 13:52:52 2011 -0500

    USB: option: add various ZTE device network interfaces to the blacklist
    
    commit c58a76cdd7ab5a945a44fd2d64f6faf40323f95b upstream.
    
    IDs found in the Windows driver's ZTEusbnet.inf file from the
    ZTE MF100 drivers (O2 UK).  Also fixes the ZTE MF626 device
    since it really is distinct from the 4G Systems stick and
    apparently needs the net interface blacklisted too, while
    there's no indication (yet) that the 4G Systems stick does.
    
    Signed-off-by: Dan Williams <dcbw@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit cf39988db6f0e4e15c6fa81100ab18ae63dcf3a1
Author: Dan Williams <dcbw@redhat.com>
Date:   Tue Sep 13 13:51:45 2011 -0500

    USB: option: add ZTE product 0x0037 to sendsetup blacklist
    
    commit eb05ce567a81c592c58f4bdb96eb91ce96661c30 upstream.
    
    Signed-off-by: Dan Williams <dcbw@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit af7b2c02829fedfcc02732e31f09bf5968bb0c52
Author: Dan Williams <dcbw@redhat.com>
Date:   Tue Sep 13 13:51:13 2011 -0500

    USB: option: convert Huawei K3765, K4505, K4605 reservered interface to blacklist
    
    commit 0d905fd5ece4ab65e8407c450077744e1c8f661b upstream.
    
    That's what the blacklist is for...
    
    Signed-off-by: Dan Williams <dcbw@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 03c4fd7b657b3ea22c86a6b7e5b01aa0cfdb52bd
Author: Dan Williams <dcbw@redhat.com>
Date:   Tue Sep 13 13:49:41 2011 -0500

    USB: option: convert interface blacklisting to bitfields
    
    commit b4626c10928c13ee73b013dcbc23676333e79b59 upstream.
    
    It's cleaner than the array stuff, and we're about to add a bunch
    more blacklist entries.  Second, there are devices that need both
    the sendsetup and the reserved interface blacklists, which the
    current code can't accommodate.
    
    Signed-off-by: Dan Williams <dcbw@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 1d2c1def575aa7dec304f820fdf4c01726416042
Author: Peter Stuge <peter@stuge.se>
Date:   Mon Oct 10 03:34:54 2011 +0200

    USB: ftdi_sio: Support TI/Luminary Micro Stellaris BD-ICDI Board
    
    commit 3687f641307eeff6f7fe31a88dc39db88e89238b upstream.
    
    Some Stellaris evaluation kits have the JTAG/SWD FTDI chip onboard,
    and some, like EK-LM3S9B90, come with a separate In-Circuit Debugger
    Interface Board. The ICDI board can also be used stand-alone, for
    other boards and chips than the kit it came with. The ICDI has both
    old style 20-pin JTAG connector and new style JTAG/SWD 10-pin 1.27mm
    pitch connector.
    
    Tested with EK-LM3S9B90, where the BD-ICDI board is included.
    
    Signed-off-by: Peter Stuge <peter@stuge.se>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 9eacde321d0b3e1fed9478a8c02110392e96d039
Author: Hakan Kvist <hakan.kvist@sonyericsson.com>
Date:   Mon Oct 3 13:41:15 2011 +0200

    USB: ftdi_sio: add PID for Sony Ericsson Urban
    
    commit 74bdf22b5c3858b06af46f19d05c23e76c40a3bb upstream.
    
    Add PID 0xfc8a, 0xfc8b for device Sony Ericsson Urban
    
    Signed-off-by: Hakan Kvist <hakan.kvist@sonyericsson.com>
    Signed-off-by: Oskar Andero <oskar.andero@sonyericsson.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit f06eb26fd629d39f3cfc729dc08668d89b137650
Author: Eric Benoit <eric@ecks.ca>
Date:   Sat Sep 24 02:04:50 2011 -0400

    USB: pl2303: add id for SMART device
    
    commit 598f0b703506da841d3459dc0c48506be14d1778 upstream.
    
    Add vendor and product ID for the SMART USB to serial adapter. These
    were meant to be used with their SMART Board whiteboards, but can be
    re-purposed for other tasks. Tested and working (at at least 9600 bps).
    
    Signed-off-by: Eric Benoit <eric@ecks.ca>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 30dd5b9fd9ccc9cf661a72d54ef67511cdadbec1
Author: Jon Levell <linuxusb@coralbark.net>
Date:   Thu Sep 29 20:42:52 2011 +0100

    USB: add quirk for Logitech C300 web cam
    
    commit 5b253d88cc6c65a23cefc457a5a4ef139913c5fc upstream.
    
    My webcam is a Logitech C300 and I get "chipmunk"ed squeaky sound.
    The following trivial patch fixes it.
    
    Signed-off-by: Jon Levell <linuxusb@coralbark.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit a8de96f08123ea80b04264e9faecfa34118ce4d8
Author: Oliver Neukum <oneukum@suse.de>
Date:   Tue Sep 13 08:42:21 2011 +0200

    USB: add RESET_RESUME for webcams shown to be quirky
    
    commit 2394d67e446bf616a0885167d5f0d397bdacfdfc upstream.
    
    The new runtime PM code has shown that many webcams suffer
    from a race condition that may crash them upon resume.
    Runtime PM is especially prone to show the problem because
    it retains power to the cameras at all times. However
    system suspension may also crash the devices and retain
    power to the devices.
    The only way to solve this problem without races is in
    usbcore with the RESET_RESUME quirk.
    
    Signed-off-by: Oliver Neukum <oneukum@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 2305a1169c91eee50fe91204692eebea8dce6b6c
Author: Denis Pershin <dyp@perchine.com>
Date:   Sun Sep 4 17:37:21 2011 +0700

    usb: cdc-acm: Owen SI-30 support
    
    commit 65e52f41fa944cef2e6d4222b8c54f46cc575214 upstream.
    
    here is the patch to support Owen SI-30 device.
    This is a pulse counter controller.
    http://www.owen.ru/en/catalog/93788515
    
    usb-drivers output:
    T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  4 Spd=12  MxCh= 0
    D:  Ver= 2.00 Cls=02(commc) Sub=00 Prot=00 MxPS= 8 #Cfgs=  1
    P:  Vendor=03eb ProdID=0030 Rev=01.01
    C:  #Ifs= 2 Cfg#= 1 Atr=c0 MxPwr=0mA
    I:  If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=02 Prot=00 Driver=cdc_acm
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_acm
    
    This patch is installed on my home system which receives data from this
    controller connected to cold water counter.
    
    Signed-off-by: Denis Pershin <dyp@perchine.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 62a5ac8b5fa6381fca135325166fb71b5e413be6
Author: Serge Hallyn <serge.hallyn@canonical.com>
Date:   Mon Sep 26 10:18:29 2011 -0500

    USB: pid_ns: ensure pid is not freed during kill_pid_info_as_uid
    
    commit aec01c5895051849ed842dc5b8794017a7751f28 upstream.
    
    Alan Stern points out that after spin_unlock(&ps->lock) there is no
    guarantee that ps->pid won't be freed.  Since kill_pid_info_as_uid() is
    called after the spin_unlock(), the pid passed to it must be pinned.
    
    Reported-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 1faec480bbcf3917205feef90ae1e1b38edceaf6
Author: Matthias Dellweg <2500@gmx.de>
Date:   Sun Sep 25 14:26:25 2011 +0200

    usb/core/devio.c: Check for printer class specific request
    
    commit 393cbb5151ecda9f9e14e3082d048dd27a1ff9f6 upstream.
    
    In the usb printer class specific request get_device_id the value of
    wIndex is (interface << 8 | altsetting) instead of just interface.
    This enables the detection of some printers with libusb.
    
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Matthias Dellweg <2500@gmx.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 76fa3531d09c55ecf99ea62f13f8b1dd8be076e1
Author: Fabian Godehardt <fg@emlix.com>
Date:   Thu Sep 1 14:15:46 2011 +0200

    USB: g_printer: fix bug in unregistration
    
    commit 8582d86143c690c68cc42f996def466a035bee34 upstream.
    
    The allocated chardevice region range is only 1 device but on
    unregister it currently tries to deregister 2.
    
    Found this while doing a insmod/rmmod/insmod/rm... of the module
    which seemed to eat major numbers.
    
    Signed-off-by: Fabian Godehardt <fg@emlix.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit f72d6f85aa5857d889a2b4a41f2bd6be4918703a
Author: Matthew Garrett <mjg@redhat.com>
Date:   Thu Oct 6 15:35:43 2011 -0400

    USB: Fix runtime wakeup on OHCI
    
    commit a8b43c00ef06aec49b9fe0a5bad8a6a320e4d27b upstream.
    
    At least some OHCI hardware (such as the MCP89) fails to flag any change
    in the host status register or the port status registers when receiving
    a remote wakeup while in D3 state. This results in the controller being
    resumed but no device state change being noticed, at which point the
    controller is put back to sleep again. Since there doesn't seem to be any
    reliable way to identify the state change, just unconditionally resume the
    hub. It'll be put back to sleep in the near future anyway if there are no
    active devices attached to it.
    
    Signed-off-by: Matthew Garrett <mjg@redhat.com>
    Cc: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit ab6e8fabfbdbca5a7273347e224fe59efe869e76
Author: Luben Tuikov <ltuikov@yahoo.com>
Date:   Thu Nov 11 15:43:11 2010 -0800

    USB: storage: Use normalized sense when emulating autosense
    
    commit e16da02fcdf1c5e824432f88abf42623dafdf191 upstream.
    
    This patch solves two things:
    1) Enables autosense emulation code to correctly
    interpret descriptor format sense data, and
    2) Fixes a bug whereby the autosense emulation
    code would overwrite descriptor format sense data
    with SENSE KEY HARDWARE ERROR in fixed format, to
    incorrectly look like this:
    
    Oct 21 14:11:07 localhost kernel: sd 7:0:0:0: [sdc]  Sense Key : Recovered Error [current] [descriptor]
    Oct 21 14:11:07 localhost kernel: Descriptor sense data with sense descriptors (in hex):
    Oct 21 14:11:07 localhost kernel:        72 01 04 1d 00 00 00 0e 09 0c 00 00 00 00 00 00
    Oct 21 14:11:07 localhost kernel:        00 4f 00 c2 00 50
    Oct 21 14:11:07 localhost kernel: sd 7:0:0:0: [sdc]  ASC=0x4 ASCQ=0x1d
    
    Signed-off-by: Luben Tuikov <ltuikov@yahoo.com>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Acked-by: Matthew Dharm <mdharm-usb@one-eyed-alien.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit cdf110e180a088826bfe31156276f186bf7e7e8e
Author: Johannes Stezenbach <js@sig21.net>
Date:   Thu Sep 8 15:39:15 2011 +0200

    usbmon vs. tcpdump: fix dropped packet count
    
    commit 236c448cb6e7f82096101e1ace4b77f8b38f82c8 upstream.
    
    Report the number of dropped packets instead of zero
    when using the binary usbmon interface with tcpdump.
    
    # tcpdump -i usbmon1 -w dump
    tcpdump: listening on usbmon1, link-type USB_LINUX_MMAPPED (USB with padded Linux header), capture size 65535 bytes
    ^C2155 packets captured
    2155 packets received by filter
    1019 packets dropped by kernel
    
    Signed-off-by: Johannes Stezenbach <js@sig21.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 1470a499e1aaca5dd4bb6e0626211f91af33fb3b
Author: Antonio Ospite <ospite@studenti.unina.it>
Date:   Mon Oct 31 17:12:22 2011 -0700

    leds: turn the blink_timer off before starting to blink
    
    commit 488bc35bf40df89d37486c1826b178a2fba36ce7 upstream.
    
    Depending on the implementation of the hardware blinking function in
    blink_set(), the led can support hardware blinking for some values of
    delay_on and delay_off and fall-back to software blinking for some other
    values.
    
    Turning off the blink_timer unconditionally before starting to blink
    make sure that a sequence like:
    
      OFF
      hardware blinking
      software blinking
      hardware blinking
    
    does not leave the software blinking timer active.
    
    Signed-off-by: Antonio Ospite <ospite@studenti.unina.it>
    Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
    Cc: Richard Purdie <rpurdie@rpsys.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 52f91caed3c682bf032628eaa60a1faa0d577e78
Author: Antonio Ospite <ospite@studenti.unina.it>
Date:   Mon Oct 31 17:12:19 2011 -0700

    leds: save the delay values after a successful call to blink_set()
    
    commit 6123b0e274503a0d3588e84fbe07c9aa01bfaf5d upstream.
    
    When calling the hardware blinking function implemented by blink_set(),
    the delay_on and delay_off values are not preserved across calls.
    
    Fix that and make the "timer" trigger work as expected when hardware
    blinking is available.
    
    BEFORE the fix:
      $ cd /sys/class/leds/someled
      $ echo timer > trigger
      $ cat delay_on delay_off
      0
      0
      $ echo 100 > delay_on
      $ cat delay_on delay_off
      0
      0
      $ echo 100 > delay_off
      $ cat delay_on delay_off
      0
      0
    
    AFTER the fix:
      $ cd /sys/class/leds/someled
      $ echo timer > trigger
      $ cat delay_on delay_off
      0
      0
      $ echo 100 > delay_on
      $ cat delay_on delay_off
      100
      0
      $ echo 100 > delay_off
      $ cat delay_on delay_off
      100
      100
    
    Signed-off-by: Antonio Ospite <ospite@studenti.unina.it>
    Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
    Cc: Richard Purdie <rpurdie@rpsys.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 3dbbae24b399adc22957217d579d53ae363f090f
Author: Nelson Elhage <nelhage@nelhage.com>
Date:   Mon Oct 31 17:13:14 2011 -0700

    epoll: fix spurious lockdep warnings
    
    commit d8805e633e054c816c47cb6e727c81f156d9253d upstream.
    
    epoll can acquire recursively acquire ep->mtx on multiple "struct
    eventpoll"s at once in the case where one epoll fd is monitoring another
    epoll fd.  This is perfectly OK, since we're careful about the lock
    ordering, but it causes spurious lockdep warnings.  Annotate the recursion
    using mutex_lock_nested, and add a comment explaining the nesting rules
    for good measure.
    
    Recent versions of systemd are triggering this, and it can also be
    demonstrated with the following trivial test program:
    
    --------------------8<--------------------
    
    int main(void) {
       int e1, e2;
       struct epoll_event evt = {
           .events = EPOLLIN
       };
    
       e1 = epoll_create1(0);
       e2 = epoll_create1(0);
       epoll_ctl(e1, EPOLL_CTL_ADD, e2, &evt);
       return 0;
    }
    --------------------8<--------------------
    
    Reported-by: Paul Bolle <pebolle@tiscali.nl>
    Tested-by: Paul Bolle <pebolle@tiscali.nl>
    Signed-off-by: Nelson Elhage <nelhage@nelhage.com>
    Acked-by: Jason Baron <jbaron@redhat.com>
    Cc: Dave Jones <davej@redhat.com>
    Cc: Davide Libenzi <davidel@xmailserver.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 2f3f49d0afbeb318b096f09fccaf8747251afccf
Author: Josh Stone <jistone@redhat.com>
Date:   Mon Oct 24 10:15:51 2011 -0700

    x86: Fix compilation bug in kprobes' twobyte_is_boostable
    
    commit 315eb8a2a1b7f335d40ceeeb11b9e067475eb881 upstream.
    
    When compiling an i386_defconfig kernel with gcc-4.6.1-9.fc15.i686, I
    noticed a warning about the asm operand for test_bit in kprobes'
    can_boost.  I discovered that this caused only the first long of
    twobyte_is_boostable[] to be output.
    
    Jakub filed and fixed gcc PR50571 to correct the warning and this output
    issue.  But to solve it for less current gcc, we can make kprobes'
    twobyte_is_boostable[] non-const, and it won't be optimized out.
    
    Before:
    
        CC      arch/x86/kernel/kprobes.o
      In file included from include/linux/bitops.h:22:0,
                       from include/linux/kernel.h:17,
                       from [...]/arch/x86/include/asm/percpu.h:44,
                       from [...]/arch/x86/include/asm/current.h:5,
                       from [...]/arch/x86/include/asm/processor.h:15,
                       from [...]/arch/x86/include/asm/atomic.h:6,
                       from include/linux/atomic.h:4,
                       from include/linux/mutex.h:18,
                       from include/linux/notifier.h:13,
                       from include/linux/kprobes.h:34,
                       from arch/x86/kernel/kprobes.c:43:
      [...]/arch/x86/include/asm/bitops.h: In function ‘can_boost.part.1’:
      [...]/arch/x86/include/asm/bitops.h:319:2: warning: use of memory input
            without lvalue in asm operand 1 is deprecated [enabled by default]
    
      $ objdump -rd arch/x86/kernel/kprobes.o | grep -A1 -w bt
           551:	0f a3 05 00 00 00 00 	bt     %eax,0x0
                              554: R_386_32	.rodata.cst4
    
      $ objdump -s -j .rodata.cst4 -j .data arch/x86/kernel/kprobes.o
    
      arch/x86/kernel/kprobes.o:     file format elf32-i386
    
      Contents of section .data:
       0000 48000000 00000000 00000000 00000000  H...............
      Contents of section .rodata.cst4:
       0000 4c030000                             L...
    
    Only a single long of twobyte_is_boostable[] is in the object file.
    
    After, without the const on twobyte_is_boostable:
    
      $ objdump -rd arch/x86/kernel/kprobes.o | grep -A1 -w bt
           551:	0f a3 05 20 00 00 00 	bt     %eax,0x20
                              554: R_386_32	.data
    
      $ objdump -s -j .rodata.cst4 -j .data arch/x86/kernel/kprobes.o
    
      arch/x86/kernel/kprobes.o:     file format elf32-i386
    
      Contents of section .data:
       0000 48000000 00000000 00000000 00000000  H...............
       0010 00000000 00000000 00000000 00000000  ................
       0020 4c030000 0f000200 ffff0000 ffcff0c0  L...............
       0030 0000ffff 3bbbfff8 03ff2ebb 26bb2e77  ....;.......&..w
    
    Now all 32 bytes are output into .data instead.
    
    Signed-off-by: Josh Stone <jistone@redhat.com>
    Cc: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
    Cc: Jakub Jelinek <jakub@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 0989d31d57762309445fa1469907b2e6c2cd4ae5
Author: Jack Steiner <steiner@sgi.com>
Date:   Tue Sep 20 13:55:04 2011 -0700

    x86: uv2: Workaround for UV2 Hub bug (system global address format)
    
    commit 6a469e4665bc158599de55d64388861d0a9f10f4 upstream.
    
    This is a workaround for a UV2 hub bug that affects the format of system
    global addresses.
    
    The GRU API for UV2 was inadvertently broken by a hardware change.  The
    format of the physical address used for TLB dropins and for addresses used
    with instructions running in unmapped mode has changed.  This change was
    not documented and became apparent only when diags failed running on
    system simulators.
    
    For UV1, TLB and GRU instruction physical addresses are identical to
    socket physical addresses (although high NASID bits must be OR'ed into the
    address).
    
    For UV2, socket physical addresses need to be converted.  The NODE portion
    of the physical address needs to be shifted so that the low bit is in bit
    39 or bit 40, depending on an MMR value.
    
    It is not yet clear if this bug will be fixed in a silicon respin.  If it
    is fixed, the hub revision will be incremented & the workaround disabled.
    
    Signed-off-by: Jack Steiner <steiner@sgi.com>
    Cc: Ingo Molnar <mingo@elte.hu>
    Cc: "H. Peter Anvin" <hpa@zytor.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit f2c1c3233aa7b1742c458b1eed929d675222e70c
Author: Nicholas Bellinger <nab@linux-iscsi.org>
Date:   Tue Oct 18 23:48:04 2011 -0700

    target: Fix REPORT TARGET PORT GROUPS handling with small allocation length
    
    commit 6b20fa9aaf0c2f69ee6f9648e20ab2be0206705e upstream.
    
    This patch fixes a bug with the handling of REPORT TARGET PORT GROUPS
    containing a smaller allocation length than the payload requires causing
    memory writes beyond the end of the buffer.  This patch checks for the
    minimum 4 byte length for the response payload length, and also checks
    upon each loop of T10_ALUA(su_dev)->tg_pt_gps_list to ensure the Target
    port group and Target port descriptor list is able to fit into the
    remaining allocation length.
    
    If the response payload exceeds the allocation length length, then rd_len
    is still increments to indicate to the initiator that the payload has
    been truncated.
    
    Reported-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Nicholas Bellinger <nab@risingtidesystems.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 133615a7e293f3628c6f7860a41b9d7964d15a60
Author: David Henningsson <david.henningsson@canonical.com>
Date:   Tue Oct 18 14:07:51 2011 +0200

    ALSA: HDA: Add new revision for ALC662
    
    commit cc667a72d471e79fd8e5e291ea115923cf44dca0 upstream.
    
    The revision 0x100300 was found for ALC662. It seems to work well
    with patch_alc662.
    
    BugLink: http://bugs.launchpad.net/bugs/877373
    Tested-by: Shengyao Xue <Shengyao.xue@canonical.com>
    Signed-off-by: David Henningsson <david.henningsson@canonical.com>
    Acked-by: Kailang Yang <kailang@realtek.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 6d8891c6a14141fad833f15745ae2f637d23dd8a
Author: Charles Chin <Charles.Chin@idt.com>
Date:   Thu Oct 13 07:54:09 2011 +0200

    ALSA: hda - Remove bad code for IDT 92HD83 family patch
    
    commit 6c5c04e509b7000617b09d4301f0b9b6d171d1e6 upstream.
    
    The purpose of this patch is to remove a section of "bad" code that
    assigns the last DAC to ports E or F in order to support notebooks
    with docking in earlier days, around ALSA 1.0.19 - 21.  This is not
    necessary now and actually breaks some configurations that use these
    ports as other devices.  This have been tested on several different
    configurations to make sure that it is working for different combinations.
    
    Signed-off-by: Charles Chin <Charles.Chin@idt.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit cdab390353a92844107bf49bd4bb8b436e909b2f
Author: Jeff Skirvin <jeffrey.d.skirvin@intel.com>
Date:   Wed Sep 28 18:35:32 2011 -0700

    isci: fix missed unlock in apc_agent_timeout()
    
    commit 983d3fdd332742167d0482c06fd29cf4b8a687c0 upstream.
    
    Needed to jump to scic_lock unlock.
    
    Also spotted by coccicheck.
    
    Signed-off-by: Jeff Skirvin <jeffrey.d.skirvin@intel.com>
    Signed-off-by: Dan Williams <dan.j.williams@intel.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 5cbadb2ee60c10ada1a8bfd1f7ba67d8e30a4e39
Author: Dan Williams <dan.j.williams@intel.com>
Date:   Wed Sep 28 18:35:27 2011 -0700

    isci: fix support for large smp requests
    
    commit 54b5e3a4bfa3452bc10cd4da672099ccc46b8c09 upstream.
    
    Kill the local smp response buffer.
    
    Besides being unnecessary, it is too small (currently truncates
    responses to 60 bytes).  The mid-layer will have already allocated a
    sufficiently sized buffer, just kmap and copy into it directly.
    
    Reported-by: Derick Marks <derick.w.marks@intel.com>
    Tested-by: Derick Marks <derick.w.marks@intel.com>
    Signed-off-by: Dan Williams <dan.j.williams@intel.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 31a471a2d7c27373b80677f65934b16adf4635d5
Author: Jack Wang <jack_wang@usish.com>
Date:   Fri Sep 23 14:32:32 2011 +0800

    libsas: set sas_address and device type of rphy
    
    commit bb041a0e9c31229071b6e56e1d0d8374af0d2038 upstream.
    
    Libsas forget to set the sas_address and device type of rphy lead to file
    under /sys/class/sas_x show wrong value, fix that.
    
    Signed-off-by: Jack Wang <jack_wang@usish.com>
    Tested-by: Crystal Yu <crystal_yu@usish.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit fa11f5a1d9e8e199dfacb16a4288d4d4c5c549ff
Author: Anton Blanchard <anton@samba.org>
Date:   Mon Aug 1 19:43:45 2011 +1000

    ipr: Always initiate hard reset in kdump kernel
    
    commit 5d7c20b7fa5c6ca19e871b4050e321c99d32bd43 upstream.
    
    During kdump testing I noticed timeouts when initialising each IPR
    adapter. While the driver has logic to detect an adapter in an
    indeterminate state, it wasn't triggering and each adapter went
    through a 5 minute timeout before finally going operational.
    
    Some analysis showed the needs_hard_reset flag wasn't getting set.
    We can check the reset_devices kernel parameter which is set by
    kdump and force a full reset. This fixes the problem.
    
    Signed-off-by: Anton Blanchard <anton@samba.org>
    Acked-by: Brian King <brking@linux.vnet.ibm.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 20e801924287a2eebe00395f4cebc8eeb7d5aa62
Author: adam radford <aradford@gmail.com>
Date:   Thu Oct 13 16:01:12 2011 -0700

    megaraid_sas: Fix instance access in megasas_reset_timer
    
    commit f575c5d3ebdca3b0482847d8fcba971767754a9e upstream.
    
    The following patch for megaraid_sas will fix a potential bad pointer access
    in megasas_reset_timer(), when a MegaRAID 9265/9285 or 9360/9380 gets a
    timeout.  megasas_build_io_fusion() sets SCp.ptr to be a struct
    megasas_cmd_fusion *, but then megasas_reset_timer() was casting SCp.ptr to be
    a struct megasas_cmd *, then trying to access cmd->instance, which is invalid.
    
    Just loading instance from scmd->device->host->hostdata in
    megasas_reset_timer() fixes the issue.
    
    Signed-off-by: Adam Radford <aradford@gmail.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 95bf50db41fbb1db306b3e636d46ce9014482a50
Author: Josh Boyer <jwboyer@redhat.com>
Date:   Wed Oct 5 11:44:50 2011 -0400

    PCI quirk: mmc: Always check for lower base frequency quirk for Ricoh 1180:e823
    
    commit 3e309cdf07c930f29a4e0f233e47d399bea34c68 upstream.
    
    Commit 15bed0f2f added a quirk for the e823 Ricoh card reader to lower the
    base frequency.  However, the quirk first checks to see if the proprietary
    MMC controller is disabled, and returns if so.  On some devices, such as the
    Lenovo X220, the MMC controller is already disabled by firmware it seems,
    but the frequency change is still needed so sdhci-pci can talk to the cards.
    Since the MMC controller is disabled, the frequency fixup was never being run
    on these machines.
    
    This moves the e823 check above the MMC controller check so that it always
    gets run.
    
    This fixes https://bugzilla.redhat.com/show_bug.cgi?id=722509
    
    Signed-off-by: Josh Boyer <jwboyer@redhat.com>
    Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit c359836591a99d43c5e4c6792de75dcaddee805e
Author: Andrei Warkentin <andrey.warkentin@gmail.com>
Date:   Sat Sep 24 12:12:30 2011 -0400

    mmc: core: ext_csd.raw_* used in comparison but never set
    
    commit 5238acbe36dd5100fb6b035a995ae5fc89dd0708 upstream.
    
    f39b2dd9d ("mmc: core: Bus width testing needs to handle suspend/resume")
    added code to only compare read-only ext_csd fields in bus width testing
    code, yet it's comparing some fields that are never set.
    
    The affected fields are ext_csd.raw_erased_mem_count and
    ext_csd.raw_partition_support.
    
    Signed-off-by: Andrei Warkentin <andrey.warkentin@gmail.com>
    Acked-by: Philip Rakity <prakity@marvell.com>
    Signed-off-by: Chris Ball <cjb@laptop.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 311c3c10f6429f4405be6a0e98cb27c6995ca8b9
Author: Ulf Hansson <ulf.hansson@stericsson.com>
Date:   Wed Sep 21 14:08:13 2011 -0400

    mmc: core: Fix hangs related to insert/remove of cards
    
    commit 7f7e4129c23f0419257184dff6fec89d2d5a8964 upstream.
    
    During a rescan operation mmc_attach(sd|mmc|sdio) functions are
    called. The error handling in these function can trigger a detach
    of the bus, which also meant a power off. This is not notified by
    the rescan operation which then continues to the next attach function.
    
    If a power off has been done, the framework must never send any
    new commands to the host driver, without first doing a new power up.
    This will most likely trigger any host driver to hang.
    
    Moving power off out of detach and instead handle power off
    separately when it is actually needed, solves the issue.
    
    Signed-off-by: Ulf Hansson <ulf.hansson@stericsson.com>
    Acked-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Chris Ball <cjb@laptop.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit c86935898f7af4bbafa14c0f402a79925c53a33f
Author: Jean Delvare <jdelvare@suse.de>
Date:   Thu Oct 6 18:16:24 2011 +0200

    drm/radeon/kms: Fix I2C mask definitions
    
    commit 286e0c94f9c3f292cb38a977fbbde3433347a868 upstream.
    
    Commit 9b9fe724 accidentally used RADEON_GPIO_EN_* where
    RADEON_GPIO_MASK_* was intended. This caused improper initialization
    of I2C buses, mostly visible when setting i2c_algo_bit.bit_test=1.
    Using the right constants fixes the problem.
    
    Signed-off-by: Jean Delvare <jdelvare@suse.de>
    Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
    Cc: Jerome Glisse <j.glisse@gmail.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 12bc1875cccdb601083183961533f64a0386370b
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Fri Oct 7 14:23:48 2011 -0400

    drm/radeon/kms: handle !force case in connector detect more gracefully
    
    commit d0d0a225e6ad43314c9aa7ea081f76adc5098ad4 upstream.
    
    When force == false, we don't do load detection in the connector
    detect functions.  Unforunately, we also return the previous
    connector state so we never get disconnect events for DVI-I, DVI-A,
    or VGA.  Save whether we detected the monitor via load detection
    previously and use that to determine whether we return the previous
    state or not.
    
    Fixes:
    https://bugs.freedesktop.org/show_bug.cgi?id=41561
    
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit c271809eb4a52643cb5618678c81d682c20ad501
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Fri Oct 7 14:23:47 2011 -0400

    drm/radeon/kms: bail early in dvi_detect for digital only connectors
    
    commit 5f0a26128d66ef81613fe923d5c288942844ccdc upstream.
    
    DVI-D and HDMI-A are digital only, so there's no need to
    attempt analog load detect.  Also, skip bail before the
    !force check, or we fail to get a disconnect events.
    The next patches in the series attempt to fix disconnect
    events for connectors with analog support (DVI-I, HDMI-B,
    DVI-A).
    
    Fixes:
    https://bugs.freedesktop.org/show_bug.cgi?id=41561
    
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 97e4a783f6e9b5d99123c93233b4592278439377
Author: Takashi Iwai <tiwai@suse.de>
Date:   Fri Oct 14 11:45:40 2011 +0200

    drm/i915/panel: Always record the backlight level again (but cleverly)
    
    commit f52c619a590fa75276c07dfcaf380dee53e4ea4c upstream.
    
    The commit 47356eb67285014527a5ab87543ba1fae3d1e10a introduced a
    mechanism to record the backlight level only at disabling time, but it
    also introduced a regression.  Since intel_lvds_enable() may be called
    without disabling (e.g. intel_lvds_commit() calls it unconditionally),
    the backlight gets back to the last recorded value.  For example, this
    happens when you dim the backlight, close the lid and open the lid,
    then the backlight suddenly goes to the brightest.
    
    This patch fixes the bug by recording the backlight level always
    when changed via intel_panel_set_backlight().  And,
    intel_panel_{enable|disable}_backlight() call the internal function not
    to update the recorded level wrongly.
    
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Reviewed-by: Keith Packard <keithp@keithp.com>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit b620fec43eeeadb25d96e537fc06dddf59ebfd78
Author: Keith Packard <keithp@keithp.com>
Date:   Wed Sep 28 16:38:44 2011 -0700

    drm/i915: Wrap DP EDID fetch functions to enable eDP panel power
    
    commit 8c241fef3e6f69f3f675678ae03599ece3f562e2 upstream.
    
    Talking to the eDP DDC channel requires that the panel be powered
    up. Wrap both the EDID and modes fetch code with calls to turn the vdd
    power on and back off.
    
    Signed-off-by: Keith Packard <keithp@keithp.com>
    Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 5c7a6982e976b381595c9d4ee8e8c94564a40aec
Author: Andiry Xu <andiry.xu@amd.com>
Date:   Fri Sep 23 14:19:54 2011 -0700

    xHCI: AMD isoc link TRB chain bit quirk
    
    commit 7e393a834b41001174a8fb3ae3bc23a749467760 upstream.
    
    Setting the chain (CH) bit in the link TRB of isochronous transfer rings
    is required by AMD 0.96 xHCI host controller to successfully transverse
    multi-TRB TD that span through different memory segments.
    
    When a Missed Service Error event occurs, if the chain bit is not set in
    the link TRB and the host skips TDs which just across a link TRB, the
    host may falsely recognize the link TRB as a normal TRB. You can see
    this may cause big trouble - the host does not jump to the right address
    which is pointed by the link TRB, but continue fetching the memory which
    is after the link TRB address, which may not even belong to the host,
    and the result cannot be predicted.
    
    This causes some big problems. Without the former patch I sent: "xHCI:
    prevent infinite loop when processing MSE event", the system may hang.
    With that patch applied, system does not hang, but the host still access
    wrong memory address and isoc transfer will fail. With this patch,
    isochronous transfer works as expected.
    
    This patch should be applied to kernels as old as 2.6.36, which was when
    the first isochronous support was added for the xHCI host controller.
    
    Signed-off-by: Andiry Xu <andiry.xu@amd.com>
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit fb71face21504aaf924e6084abee9512bb1f2f29
Author: Kautuk Consul <consul.kautuk@gmail.com>
Date:   Mon Sep 19 16:53:12 2011 -0700

    xhci-mem.c: Check for ring->first_seg != NULL
    
    commit 0e6c7f746ea99089fb3263709075c20485a479ae upstream.
    
    There are 2 situations wherein the xhci_ring* might not get freed:
    - When xhci_ring_alloc() -> xhci_segment_alloc() returns NULL and
      we goto the fail: label in xhci_ring_alloc. In this case, the ring
      will not get kfreed.
    - When the num_segs argument to xhci_ring_alloc is passed as 0 and
      we try to free the rung after that.
      ( This doesn't really happen as of now in the code but we seem to
        be entertaining num_segs=0 in xhci_ring_alloc )
    
    This should be backported to kernels as old as 2.6.31.
    
    Signed-off-by: Kautuk Consul <consul.kautuk@gmail.com>
    Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 21f25cdb9e476c64d504981133d0552f7d155805
Author: Alan Stern <stern@rowland.harvard.edu>
Date:   Wed Oct 12 10:39:14 2011 -0400

    EHCI: workaround for MosChip controller bug
    
    commit 68aa95d5d4de31c9348c1628ffa85c805305ebc5 upstream.
    
    This patch (as1489) works around a hardware bug in MosChip EHCI
    controllers.  Evidently when one of these controllers increments the
    frame-index register, it changes the three low-order bits (the
    microframe counter) before changing the higher order bits (the frame
    counter).  If the register is read at just the wrong time, the value
    obtained is too low by 8.
    
    When the appropriate quirk flag is set, we work around this problem by
    reading the frame-index register a second time if the first value's
    three low-order bits are all 0.  This gives the hardware a chance to
    finish updating the register, yielding the correct value.
    
    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Tested-by: Jason N Pitt <jpitt@fhcrc.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 7eede2cbc1066124a0a4fee4d9671e28f7c62277
Author: Harro Haan <hrhaan@gmail.com>
Date:   Mon Oct 10 14:38:27 2011 +0200

    USB: fix ehci alignment error
    
    commit 276532ba9666b36974cbe16f303fc8be99c9da17 upstream.
    
    The Kirkwood gave an unaligned memory access error on
    line 742 of drivers/usb/host/echi-hcd.c:
    "ehci->last_periodic_enable = ktime_get_real();"
    
    Signed-off-by: Harro Haan <hrhaan@gmail.com>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit cd0712116761eed1500b2272a5492d2120c30f26
Author: Matthieu CASTET <castet.matthieu@free.fr>
Date:   Sat Jul 2 19:47:33 2011 +0200

    EHCI : introduce a common ehci_setup
    
    commit 2093c6b49c8f1dc581d8953aca71297d4cace55e upstream.
    
    This allow to clean duplicated code in most of SOC driver.
    
    Signed-off-by: Matthieu CASTET <castet.matthieu@free.fr>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 3e9efdd45f78e0ad859b60906c6556e8efe2579b
Author: Ning Jiang <ning.jiang@marvell.com>
Date:   Mon Sep 5 16:28:18 2011 +0800

    serial-core: power up uart port early before we do set_termios when resuming
    
    commit 94abc56f4d90f289ea32a0a11d3577fcd8cb28fb upstream.
    
    The following patch removed uart_change_pm() in uart_resume_port():
    
    commit 5933a161abcb8d83a2c145177f48027c3c0a8995
    Author: Yin Kangkai <kangkai.yin@linux.intel.com>
        serial-core: reset the console speed on resume
    
    It will break the pxa serial driver when the system resumes from suspend mode
    as it will try to set baud rate divider register in set_termios but with
    clock off. The register value can not be set correctly on some platform if
    the clock is disabled. The pxa driver will check the value and report the
    following warning:
    
    ------------[ cut here ]------------
    WARNING: at drivers/tty/serial/pxa.c:545 serial_pxa_set_termios+0x1dc/0x250()
    Modules linked in:
    [<c0281f30>] (unwind_backtrace+0x0/0xf0) from [<c029341c>] (warn_slowpath_common+0x4c/0x64)
    [<c029341c>] (warn_slowpath_common+0x4c/0x64) from [<c029344c>] (warn_slowpath_null+0x18/0x1c)
    [<c029344c>] (warn_slowpath_null+0x18/0x1c) from [<c044b1e4>] (serial_pxa_set_termios+0x1dc/0x250)
    [<c044b1e4>] (serial_pxa_set_termios+0x1dc/0x250) from [<c044a840>] (uart_resume_port+0x128/0x2dc)
    [<c044a840>] (uart_resume_port+0x128/0x2dc) from [<c044bbe0>] (serial_pxa_resume+0x18/0x24)
    [<c044bbe0>] (serial_pxa_resume+0x18/0x24) from [<c0454d34>] (platform_pm_resume+0x40/0x4c)
    [<c0454d34>] (platform_pm_resume+0x40/0x4c) from [<c0457ebc>] (pm_op+0x68/0xb4)
    [<c0457ebc>] (pm_op+0x68/0xb4) from [<c0458368>] (device_resume+0xb0/0xec)
    [<c0458368>] (device_resume+0xb0/0xec) from [<c04584c8>] (dpm_resume+0xe0/0x194)
    [<c04584c8>] (dpm_resume+0xe0/0x194) from [<c0458588>] (dpm_resume_end+0xc/0x18)
    [<c0458588>] (dpm_resume_end+0xc/0x18) from [<c02c518c>] (suspend_devices_and_enter+0x16c/0x1ac)
    [<c02c518c>] (suspend_devices_and_enter+0x16c/0x1ac) from [<c02c5278>] (enter_state+0xac/0xdc)
    [<c02c5278>] (enter_state+0xac/0xdc) from [<c02c48ec>] (state_store+0xa0/0xbc)
    [<c02c48ec>] (state_store+0xa0/0xbc) from [<c0408f7c>] (kobj_attr_store+0x18/0x1c)
    [<c0408f7c>] (kobj_attr_store+0x18/0x1c) from [<c034a6a4>] (sysfs_write_file+0x108/0x140)
    [<c034a6a4>] (sysfs_write_file+0x108/0x140) from [<c02fb798>] (vfs_write+0xac/0x134)
    [<c02fb798>] (vfs_write+0xac/0x134) from [<c02fb8cc>] (sys_write+0x3c/0x68)
    [<c02fb8cc>] (sys_write+0x3c/0x68) from [<c027c700>] (ret_fast_syscall+0x0/0x2c)
    ---[ end trace 88289eceb4675b04 ]---
    
    This patch fix the problem by adding the power on opertion back for uart
    console when console_suspend_enabled is true.
    
    Signed-off-by: Ning Jiang <ning.jiang@marvell.com>
    Tested-by: Mayank Rana <mrana@codeaurora.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit d5fe5d1648b88aa16b5d97d088d9b743bc9ce0a8
Author: Marcus Folkesson <marcus.folkesson@gmail.com>
Date:   Tue Aug 30 13:53:10 2011 +0200

    serial: pxa: work around for errata #20
    
    commit e44aabd649c80e8be16ede3ed3cbff6fb2561ca9 upstream.
    
    Errata E20: UART: Character Timeout interrupt remains set under certain
    software conditions.
    
    Implication: The software servicing the UART can be trapped in an infinite loop.
    
    Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit ee5ad2bab31967d0d836e56c10e57e74145df151
Author: Rigbert Hamisch <rigbert@gmx.de>
Date:   Tue Sep 27 10:46:43 2011 +0200

    USB: qcserial: add device ID for "HP un2430 Mobile Broadband Module"
    
    commit 1bfac90d1b8e63a4d44158c3445d8fda3fb6d5eb upstream.
    
    add device ID for "HP un2430 Mobile Broadband Module"
    
    Signed-off-by: Rigbert Hamisch <rigbert@gmx.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 285c6b4b3be21529ec5dbdfb1a6d48a3aa31d0c7
Author: Richard Hartmann <richih.mailinglist@gmail.com>
Date:   Tue Sep 20 20:50:51 2011 +0200

    USB: qcserial: Add support for Sierra Wireless MC8355/Gobi 3000
    
    commit 68c79e5756903229fa96826a2493c2265a3b395f upstream.
    
    Simple patch to make qcserial recognize the USB id of the Sierra
    Wireless MC8355 which is based on the Gobi 3000 chip.
    
    Both UMTS and GPS work fine.
    
    Signed-off-by: Richard Hartmann <richih.mailinglist@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 70908d994241bb79e4f3c546f6ddd262567610c6
Author: Mike Sterling <mike.sterling@microsoft.com>
Date:   Tue Sep 6 16:10:55 2011 -0700

    Staging: hv: Add support for >2 TB LUN in storage driver.
    
    commit cf55f4a8b6243b42fb91c56d1421db0d36d60f96 upstream.
    
    If a LUN larger than 2 TB is attached to a Linux VM on Hyper-V, we currently
    report a maximum size of 2 TB. This patch resolves the issue in hv_storvsc.
    Thanks to Robert Scheck <robert.scheck@etes.de> for reporting the issue.
    
    Reported-by: Robert Scheck <robert.scheck@etes.de>
    Signed-off-by: Mike Sterling <mike.sterling@microsoft.com>
    Signed-off-by: K.Y. Srinivasan <kys@microsoft.com>
    Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 828ed1259f73a85d47b417edd84e02bbbb52bb87
Author: Kautuk Consul <consul.kautuk@gmail.com>
Date:   Wed Sep 14 08:56:21 2011 +0530

    staging: quatech_usb2: Potential lost wakeup scenario in TIOCMIWAIT
    
    commit e8df1674d383d2ecc6efa8d7dba74c03aafdfdd7 upstream.
    
    If the usermode app does an ioctl over this serial device  by
    using TIOCMIWAIT, then the code will wait by setting the current
    task state to TASK_INTERRUPTIBLE and then calling schedule().
    This will be woken up by the qt2_process_modem_status on URB
    completion when the port_extra->shadowMSR is set to the new
    modem status.
    
    However, this could result in a lost wakeup scenario due to a race
    in the logic in the qt2_ioctl(TIOCMIWAIT) loop and the URB completion
    for new modem status in qt2_process_modem_status.
    Due to this, the usermode app's task will continue to sleep despite a
    change in the modem status.
    
    Signed-off-by: Kautuk Consul <consul.kautuk@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit da7061614e7d11f0a0db96a5f507feca4ac9fa17
Author: Bill Pemberton <wfp5p@virginia.edu>
Date:   Mon Aug 29 13:48:54 2011 -0400

    staging: serqt_usb2: remove ssu100 from supported devices
    
    commit 7cbf3c7cd59288fb5e9f31815c74773549668d43 upstream.
    
    The serqt_usb2 driver will not work properly with the ssu100 device
    even though it claims to support it.  The ssu100 is supported by the
    ssu100 driver in mainline so there is no need to have it claimed by
    serqt_usb2.
    
    Signed-off-by: Bill Pemberton <wfp5p@virginia.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit e46389fa0026dd3bbaebf92a525dad3e80b7bce2
Author: Jim Wylder <jwylder1@motorola.com>
Date:   Tue Sep 6 21:07:20 2011 -0500

    USB: for usb_autopm_get_interface_async -EINPROGRESS is not an error
    
    commit c5a48592d874ddef8c7880311581eccf0eb30c3b upstream.
    
    A return value of -EINPROGRESS from pm_runtime_get indicates that
    the device is already resuming due to a previous call.  Internally,
    usb_autopm_get_interface_async doesn't treat this as an error and
    increments the usage count, but passes the error status along
    to the caller.  The logical assumption of the caller is that
    any negative return value reflects the device not resuming
    and the pm_usage_cnt not being incremented.  Since the usage count
    is being incremented and the device is resuming, return success (0)
    instead.
    
    Signed-off-by: James Wylder <james.wylder@motorola.com>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit eece93cccb258072bf9a355faeca2ee2752b27e3
Author: Jiri Slaby <jslaby@suse.cz>
Date:   Wed Oct 12 11:32:44 2011 +0200

    TTY: pty, release tty in all ptmx_open fail paths
    
    commit 1177c0efc04d032644895b8d757f55b433912596 upstream.
    
    Mistakenly, commit 64ba3dc3143d (tty: never hold BTM while getting
    tty_mutex) switched one fail path in ptmx_open to not free the newly
    allocated tty.
    
    Fix that by jumping to the appropriate place. And rename the labels so
    that it's clear what is going on there.
    
    Introduced-in: v2.6.36-rc2
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    Cc: Arnd Bergmann <arnd@arndb.de>
    Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 0c1f111ae7fcea822fd1c078ef48e88d93afc57a
Author: Jiri Slaby <jslaby@suse.cz>
Date:   Wed Oct 12 11:32:43 2011 +0200

    TTY: make tty_add_file non-failing
    
    commit fa90e1c935472281de314e6d7c9a37db9cbc2e4e upstream.
    
    If tty_add_file fails at the point it is now, we have to revert all
    the changes we did to the tty. It means either decrease all refcounts
    if this was a tty reopen or delete the tty if it was newly allocated.
    
    There was a try to fix this in v3.0-rc2 using tty_release in 0259894c7
    (TTY: fix fail path in tty_open). But instead it introduced a NULL
    dereference. It's because tty_release dereferences
    filp->private_data, but that one is set even in our tty_add_file. And
    when tty_add_file fails, it's still NULL/garbage. Hence tty_release
    cannot be called there.
    
    To circumvent the original leak (and the current NULL deref) we split
    tty_add_file into two functions, making the latter non-failing. In
    that case we may do the former early in open, where handling failures
    is easy. The latter stays as it is now. So there is no change in
    functionality.
    
    The original bug (leak) was introduced by f573bd176 (tty: Remove
    __GFP_NOFAIL from tty_add_file()). Thanks Dan for reporting this.
    
    Later, we may split tty_release into more functions and call only some
    of them in this fail path instead. (If at all possible.)
    
    Introduced-in: v2.6.37-rc2
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
    Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
    Cc: Pekka Enberg <penberg@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 36174dd629350d0654982977d7795ca28475c16f
Author: Jiri Slaby <jslaby@suse.cz>
Date:   Wed Oct 12 11:32:42 2011 +0200

    TTY: drop driver reference in tty_open fail path
    
    commit c290f8358acaeffd8e0c551ddcc24d1206143376 upstream.
    
    When tty_driver_lookup_tty fails in tty_open, we forget to drop a
    reference to the tty driver. This was added by commit 4a2b5fddd5 (Move
    tty lookup/reopen to caller).
    
    Fix that by adding tty_driver_kref_put to the fail path.
    
    I will refactor the code later. This is for the ease of backporting to
    stable.
    
    Introduced-in: v2.6.28-rc2
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
    Acked-by: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 47bbdafa8ab90e3d4b7a4c6dd9bf54f7bc6df66d
Author: WANG Cong <xiyou.wangcong@gmail.com>
Date:   Thu Sep 1 13:58:29 2011 +0800

    cris: fix a build error in drivers/tty/serial/crisv10.c
    
    commit 2f7861de111bb8e33e6ab9f9607583c6fbc00132 upstream.
    
    This patch fixes the following build error:
    
    drivers/tty/serial/crisv10.c:4453: error: 'if_ser0' undeclared (first use in this function): 2 errors in 2 logs
            v3.1-rc4/cris/cris-allmodconfig v3.1-rc4/cris/cris-allyesconfig
    drivers/tty/serial/crisv10.c:4453: error: (Each undeclared identifier is reported only once: 2 errors in 2 logs
            v3.1-rc4/cris/cris-allmodconfig v3.1-rc4/cris/cris-allyesconfig
    drivers/tty/serial/crisv10.c:4453: error: for each function it appears in.): 2 errors in 2 logs
            v3.1-rc4/cris/cris-allmodconfig v3.1-rc4/cris/cris-allyesconfig
    
    "if_ser0" is a typo, it should be "if_serial_0".
    
    Cc: Mikael Starvik <starvik@axis.com>
    Cc: Jesper Nilsson <jesper.nilsson@axis.com>
    Signed-off-by: WANG Cong <xiyou.wangcong@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit e842a3e0d2bd01e0e32c0af4ef266f08b9b9ef75
Author: Pavel Shilovsky <piastry@etersoft.ru>
Date:   Sat Oct 22 14:37:50 2011 +0400

    CIFS: Fix DFS handling in cifs_get_file_info
    
    commit 42274bb22afc3e877ae5abed787b0b09d7dede52 upstream.
    
    We should call cifs_all_info_to_fattr in rc == 0 case only.
    
    Signed-off-by: Pavel Shilovsky <piastry@etersoft.ru>
    Reviewed-by: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: Steve French <smfrench@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

commit 2d925a5b8e7ea244bca1e988df4ce0c6db0c4d07
Author: Pavel Shilovsky <piastry@etersoft.ru>
Date:   Fri Oct 7 18:57:45 2011 +0400

    CIFS: Fix incorrect max RFC1002 write size value
    
    commit 94443f43404239c2a6dc4252a7cb9e77f5b1eb6e upstream.
    
    ..the length field has only 17 bits.
    
    Acked-by: Jeff Layton <jlayton@samba.org>
    Signed-off-by: Pavel Shilovsky <piastry@etersoft.ru>
    Signed-off-by: Steve French <smfrench@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>