linux-ti33x-psp 3.2: update to 3.2.21, add libertas fixes

Signed-off-by: Koen Kooi <koen@dominion.thruhere.net> Signed-off-by: Denys Dmytriyenko <denys@ti.com>
2026-06-05 02:11:00 +00:00 · 2012-06-20 12:42:22 +02:00
parent 2257c7b47a
commit 189ce92b4c
419 changed files with 21742 additions and 357 deletions
@@ -4,7 +4,7 @@ require conf/machine/include/soc-family.inc
 require conf/machine/include/tune-cortexa8.inc
 PREFERRED_PROVIDER_virtual/kernel = "linux-ti33x-psp"
 # Increase this everytime you change something in the kernel
-MACHINE_KERNEL_PR = "r12"
+MACHINE_KERNEL_PR = "r13"

 KERNEL_IMAGETYPE = "uImage"

@@ -0,0 +1,79 @@
+From e29e69cb6dff635429cbda9a9548c3d0390689f9 Mon Sep 17 00:00:00 2001
+From: Takuya Yoshikawa <yoshikawa.takuya@oss.ntt.co.jp>
+Date: Fri, 10 Feb 2012 15:28:31 +0900
+Subject: [PATCH 001/117] KVM: mmu_notifier: Flush TLBs before releasing
+ mmu_lock
+
+(cherry picked from commit 565f3be2174611f364405bbea2d86e153c2e7e78
+
+Other threads may process the same page in that small window and skip
+TLB flush and then return before these functions do flush.
+
+Signed-off-by: Takuya Yoshikawa <yoshikawa.takuya@oss.ntt.co.jp>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ virt/kvm/kvm_main.c |   19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index e401c1b..9ffac2e 100644
+--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
+@@ -289,15 +289,15 @@ static void kvm_mmu_notifier_invalidate_page(struct mmu_notifier *mn,
+ 	 */
+ 	idx = srcu_read_lock(&kvm->srcu);
+ 	spin_lock(&kvm->mmu_lock);
+
+ 	kvm->mmu_notifier_seq++;
+ 	need_tlb_flush = kvm_unmap_hva(kvm, address) | kvm->tlbs_dirty;
+-	spin_unlock(&kvm->mmu_lock);
+-	srcu_read_unlock(&kvm->srcu, idx);
+-
+ 	/* we've to flush the tlb before the pages can be freed */
+ 	if (need_tlb_flush)
+ 		kvm_flush_remote_tlbs(kvm);
+ 
+	spin_unlock(&kvm->mmu_lock);
+	srcu_read_unlock(&kvm->srcu, idx);
+ }
+ 
+ static void kvm_mmu_notifier_change_pte(struct mmu_notifier *mn,
+@@ -335,12 +335,12 @@ static void kvm_mmu_notifier_invalidate_range_start(struct mmu_notifier *mn,
+ 	for (; start < end; start += PAGE_SIZE)
+ 		need_tlb_flush |= kvm_unmap_hva(kvm, start);
+ 	need_tlb_flush |= kvm->tlbs_dirty;
+-	spin_unlock(&kvm->mmu_lock);
+-	srcu_read_unlock(&kvm->srcu, idx);
+-
+ 	/* we've to flush the tlb before the pages can be freed */
+ 	if (need_tlb_flush)
+ 		kvm_flush_remote_tlbs(kvm);
+
+	spin_unlock(&kvm->mmu_lock);
+	srcu_read_unlock(&kvm->srcu, idx);
+ }
+ 
+ static void kvm_mmu_notifier_invalidate_range_end(struct mmu_notifier *mn,
+@@ -378,13 +378,14 @@ static int kvm_mmu_notifier_clear_flush_young(struct mmu_notifier *mn,
+ 
+ 	idx = srcu_read_lock(&kvm->srcu);
+ 	spin_lock(&kvm->mmu_lock);
+-	young = kvm_age_hva(kvm, address);
+-	spin_unlock(&kvm->mmu_lock);
+-	srcu_read_unlock(&kvm->srcu, idx);
+ 
+	young = kvm_age_hva(kvm, address);
+ 	if (young)
+ 		kvm_flush_remote_tlbs(kvm);
+ 
+	spin_unlock(&kvm->mmu_lock);
+	srcu_read_unlock(&kvm->srcu, idx);
+
+ 	return young;
+ }
+ 
+-- 
+1.7.9.5
+
@@ -0,0 +1,110 @@
+From 54719e9d5196e2af1e358795de9face038502343 Mon Sep 17 00:00:00 2001
+From: Avi Kivity <avi@redhat.com>
+Date: Mon, 5 Mar 2012 14:23:29 +0200
+Subject: [PATCH 002/117] KVM: Ensure all vcpus are consistent with in-kernel
+ irqchip settings
+
+(cherry picked from commit 3e515705a1f46beb1c942bb8043c16f8ac7b1e9e)
+
+If some vcpus are created before KVM_CREATE_IRQCHIP, then
+irqchip_in_kernel() and vcpu->arch.apic will be inconsistent, leading
+to potential NULL pointer dereferences.
+
+Fix by:
+- ensuring that no vcpus are installed when KVM_CREATE_IRQCHIP is called
+- ensuring that a vcpu has an apic if it is installed after KVM_CREATE_IRQCHIP
+
+This is somewhat long winded because vcpu->arch.apic is created without
+kvm->lock held.
+
+Based on earlier patch by Michael Ellerman.
+
+Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/ia64/kvm/kvm-ia64.c |    5 +++++
+ arch/x86/kvm/x86.c       |    8 ++++++++
+ include/linux/kvm_host.h |    7 +++++++
+ virt/kvm/kvm_main.c      |    4 ++++
+ 4 files changed, 24 insertions(+)
+
+diff --git a/arch/ia64/kvm/kvm-ia64.c b/arch/ia64/kvm/kvm-ia64.c
+index 43f4c92..7073185 100644
+--- a/arch/ia64/kvm/kvm-ia64.c
+++ b/arch/ia64/kvm/kvm-ia64.c
+@@ -1169,6 +1169,11 @@ out:
+ 
+ #define PALE_RESET_ENTRY    0x80000000ffffffb0UL
+ 
+bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu)
+{
+	return irqchip_in_kernel(vcpu->kcm) == (vcpu->arch.apic != NULL);
+}
+
+ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
+ {
+ 	struct kvm_vcpu *v;
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index e04cae1..4fc5323 100644
+--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
+@@ -3579,6 +3579,9 @@ long kvm_arch_vm_ioctl(struct file *filp,
+ 		r = -EEXIST;
+ 		if (kvm->arch.vpic)
+ 			goto create_irqchip_unlock;
+		r = -EINVAL;
+		if (atomic_read(&kvm->online_vcpus))
+			goto create_irqchip_unlock;
+ 		r = -ENOMEM;
+ 		vpic = kvm_create_pic(kvm);
+ 		if (vpic) {
+@@ -6486,6 +6489,11 @@ void kvm_arch_check_processor_compat(void *rtn)
+ 	kvm_x86_ops->check_processor_compatibility(rtn);
+ }
+ 
+bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu)
+{
+	return irqchip_in_kernel(vcpu->kvm) == (vcpu->arch.apic != NULL);
+}
+
+ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
+ {
+ 	struct page *page;
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index 35410ef..6136821 100644
+--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
+@@ -744,6 +744,13 @@ static inline bool kvm_vcpu_is_bsp(struct kvm_vcpu *vcpu)
+ {
+ 	return vcpu->kvm->bsp_vcpu_id == vcpu->vcpu_id;
+ }
+
+bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu);
+
+#else
+
+static inline bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu) { return true; }
+
+ #endif
+ 
+ #ifdef __KVM_HAVE_DEVICE_ASSIGNMENT
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 9ffac2e..ec747dc 100644
+--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
+@@ -1667,6 +1667,10 @@ static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, u32 id)
+ 		goto vcpu_destroy;
+ 
+ 	mutex_lock(&kvm->lock);
+	if (!kvm_vcpu_compatible(vcpu)) {
+		r = -EINVAL;
+		goto unlock_vcpu_destroy;
+	}
+ 	if (atomic_read(&kvm->online_vcpus) == KVM_MAX_VCPUS) {
+ 		r = -EINVAL;
+ 		goto unlock_vcpu_destroy;
+-- 
+1.7.9.5
+
@@ -0,0 +1,83 @@
+From 2464830dde6595631a26a5178946f8d8d0ac974f Mon Sep 17 00:00:00 2001
+From: Alex Williamson <alex.williamson@redhat.com>
+Date: Tue, 17 Apr 2012 21:46:44 -0600
+Subject: [PATCH 003/117] KVM: lock slots_lock around device assignment
+
+(cherry picked from commit 21a1416a1c945c5aeaeaf791b63c64926018eb77)
+
+As pointed out by Jason Baron, when assigning a device to a guest
+we first set the iommu domain pointer, which enables mapping
+and unmapping of memory slots to the iommu.  This leaves a window
+where this path is enabled, but we haven't synchronized the iommu
+mappings to the existing memory slots.  Thus a slot being removed
+at that point could send us down unexpected code paths removing
+non-existent pinnings and iommu mappings.  Take the slots_lock
+around creating the iommu domain and initial mappings as well as
+around iommu teardown to avoid this race.
+
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ virt/kvm/iommu.c |   23 +++++++++++++++--------
+ 1 file changed, 15 insertions(+), 8 deletions(-)
+
+diff --git a/virt/kvm/iommu.c b/virt/kvm/iommu.c
+index fd817a2..533db33 100644
+--- a/virt/kvm/iommu.c
+++ b/virt/kvm/iommu.c
+@@ -239,9 +239,13 @@ int kvm_iommu_map_guest(struct kvm *kvm)
+ 		return -ENODEV;
+ 	}
+ 
+	mutex_lock(&kvm->slots_lock);
+
+ 	kvm->arch.iommu_domain = iommu_domain_alloc(&pci_bus_type);
+-	if (!kvm->arch.iommu_domain)
+-		return -ENOMEM;
+	if (!kvm->arch.iommu_domain) {
+		r = -ENOMEM;
+		goto out_unlock;
+	}
+ 
+ 	if (!allow_unsafe_assigned_interrupts &&
+ 	    !iommu_domain_has_cap(kvm->arch.iommu_domain,
+@@ -252,17 +256,16 @@ int kvm_iommu_map_guest(struct kvm *kvm)
+ 		       " module option.\n", __func__);
+ 		iommu_domain_free(kvm->arch.iommu_domain);
+ 		kvm->arch.iommu_domain = NULL;
+-		return -EPERM;
+		r = -EPERM;
+		goto out_unlock;
+ 	}
+ 
+ 	r = kvm_iommu_map_memslots(kvm);
+ 	if (r)
+-		goto out_unmap;
+-
+-	return 0;
+		kvm_iommu_unmap_memslots(kvm);
+ 
+-out_unmap:
+-	kvm_iommu_unmap_memslots(kvm);
+out_unlock:
+	mutex_unlock(&kvm->slots_lock);
+ 	return r;
+ }
+ 
+@@ -338,7 +341,11 @@ int kvm_iommu_unmap_guest(struct kvm *kvm)
+ 	if (!domain)
+ 		return 0;
+ 
+	mutex_lock(&kvm->slots_lock);
+ 	kvm_iommu_unmap_memslots(kvm);
+	kvm->arch.iommu_domain = NULL;
+	mutex_unlock(&kvm->slots_lock);
+
+ 	iommu_domain_free(domain);
+ 	return 0;
+ }
+-- 
+1.7.9.5
+
@@ -0,0 +1,36 @@
+From c997d0a009e5eb7b372287c13fc9eaba901533e8 Mon Sep 17 00:00:00 2001
+From: Nadav Har'El <nyh@math.technion.ac.il>
+Date: Tue, 6 Mar 2012 16:39:22 +0200
+Subject: [PATCH 004/117] KVM: nVMX: Fix erroneous exception bitmap check
+
+(cherry picked from commit 9587190107d0c0cbaccbf7bf6b0245d29095a9ae)
+
+The code which checks whether to inject a pagefault to L1 or L2 (in
+nested VMX) was wrong, incorrect in how it checked the PF_VECTOR bit.
+Thanks to Dan Carpenter for spotting this.
+
+Signed-off-by: Nadav Har'El <nyh@il.ibm.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/x86/kvm/vmx.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 4ea7678..7ac5993 100644
+--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
+@@ -1677,7 +1677,7 @@ static int nested_pf_handled(struct kvm_vcpu *vcpu)
+ 	struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+ 
+ 	/* TODO: also check PFEC_MATCH/MASK, not just EB.PF. */
+-	if (!(vmcs12->exception_bitmap & PF_VECTOR))
+	if (!(vmcs12->exception_bitmap & (1u << PF_VECTOR)))
+ 		return 0;
+ 
+ 	nested_vmx_vmexit(vcpu);
+-- 
+1.7.9.5
+
@@ -0,0 +1,35 @@
+From 6d02e81e40e77ff4e0d65ae89cf91a7402d3255f Mon Sep 17 00:00:00 2001
+From: Marcelo Tosatti <mtosatti@redhat.com>
+Date: Tue, 27 Mar 2012 19:47:26 -0300
+Subject: [PATCH 005/117] KVM: VMX: vmx_set_cr0 expects kvm->srcu locked
+
+(cherry picked from commit 7a4f5ad051e02139a9f1c0f7f4b1acb88915852b)
+
+vmx_set_cr0 is called from vcpu run context, therefore it expects
+kvm->srcu to be held (for setting up the real-mode TSS).
+
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/x86/kvm/vmx.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 7ac5993..7315488 100644
+--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
+@@ -3915,7 +3915,9 @@ static int vmx_vcpu_reset(struct kvm_vcpu *vcpu)
+ 		vmcs_write16(VIRTUAL_PROCESSOR_ID, vmx->vpid);
+ 
+ 	vmx->vcpu.arch.cr0 = X86_CR0_NW | X86_CR0_CD | X86_CR0_ET;
+	vcpu->srcu_idx = srcu_read_lock(&vcpu->kvm->srcu);
+ 	vmx_set_cr0(&vmx->vcpu, kvm_read_cr0(vcpu)); /* enter rmode */
+	srcu_read_unlock(&vcpu->kvm->srcu, vcpu->srcu_idx);
+ 	vmx_set_cr4(&vmx->vcpu, 0);
+ 	vmx_set_efer(&vmx->vcpu, 0);
+ 	vmx_fpu_activate(&vmx->vcpu);
+-- 
+1.7.9.5
+
@@ -0,0 +1,65 @@
+From 4ec77e205d0abcfd9d48332ac0a8d60322966562 Mon Sep 17 00:00:00 2001
+From: Jens Freimann <jfrei@linux.vnet.ibm.com>
+Date: Mon, 6 Feb 2012 10:59:03 +0100
+Subject: [PATCH 006/117] KVM: s390: do store status after handling
+ STOP_ON_STOP bit
+
+(cherry picked from commit 9e0d5473e2f0ba2d2fe9dab9408edef3060b710e)
+
+In handle_stop() handle the stop bit before doing the store status as
+described for "Stop and Store Status" in the Principles of Operation.
+We have to give up the local_int.lock before calling kvm store status
+since it calls gmap_fault() which might sleep. Since local_int.lock
+only protects local_int.* and not guest memory we can give up the lock.
+
+Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com>
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/s390/kvm/intercept.c |   20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/arch/s390/kvm/intercept.c b/arch/s390/kvm/intercept.c
+index 0243454..a5f6eff 100644
+--- a/arch/s390/kvm/intercept.c
+++ b/arch/s390/kvm/intercept.c
+@@ -133,13 +133,6 @@ static int handle_stop(struct kvm_vcpu *vcpu)
+ 
+ 	vcpu->stat.exit_stop_request++;
+ 	spin_lock_bh(&vcpu->arch.local_int.lock);
+-	if (vcpu->arch.local_int.action_bits & ACTION_STORE_ON_STOP) {
+-		vcpu->arch.local_int.action_bits &= ~ACTION_STORE_ON_STOP;
+-		rc = kvm_s390_vcpu_store_status(vcpu,
+-						  KVM_S390_STORE_STATUS_NOADDR);
+-		if (rc >= 0)
+-			rc = -EOPNOTSUPP;
+-	}
+ 
+ 	if (vcpu->arch.local_int.action_bits & ACTION_RELOADVCPU_ON_STOP) {
+ 		vcpu->arch.local_int.action_bits &= ~ACTION_RELOADVCPU_ON_STOP;
+@@ -155,7 +148,18 @@ static int handle_stop(struct kvm_vcpu *vcpu)
+ 		rc = -EOPNOTSUPP;
+ 	}
+ 
+-	spin_unlock_bh(&vcpu->arch.local_int.lock);
+	if (vcpu->arch.local_int.action_bits & ACTION_STORE_ON_STOP) {
+		vcpu->arch.local_int.action_bits &= ~ACTION_STORE_ON_STOP;
+		/* store status must be called unlocked. Since local_int.lock
+		 * only protects local_int.* and not guest memory we can give
+		 * up the lock here */
+		spin_unlock_bh(&vcpu->arch.local_int.lock);
+		rc = kvm_s390_vcpu_store_status(vcpu,
+						KVM_S390_STORE_STATUS_NOADDR);
+		if (rc >= 0)
+			rc = -EOPNOTSUPP;
+	} else
+		spin_unlock_bh(&vcpu->arch.local_int.lock);
+ 	return rc;
+ }
+ 
+-- 
+1.7.9.5
+
@@ -0,0 +1,36 @@
+From 12632a351defb18140a84df1720a363d94991973 Mon Sep 17 00:00:00 2001
+From: Christian Borntraeger <borntraeger@de.ibm.com>
+Date: Mon, 6 Feb 2012 10:59:02 +0100
+Subject: [PATCH 007/117] KVM: s390: Sanitize fpc registers for KVM_SET_FPU
+
+(cherry picked from commit 851755871c1f3184f4124c466e85881f17fa3226)
+
+commit 7eef87dc99e419b1cc051e4417c37e4744d7b661 (KVM: s390: fix
+register setting) added a load of the floating point control register
+to the KVM_SET_FPU path. Lets make sure that the fpc is valid.
+
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/s390/kvm/kvm-s390.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index d1c44573..d3cb86c 100644
+--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
+@@ -418,7 +418,7 @@ int kvm_arch_vcpu_ioctl_get_sregs(struct kvm_vcpu *vcpu,
+ int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
+ {
+ 	memcpy(&vcpu->arch.guest_fpregs.fprs, &fpu->fprs, sizeof(fpu->fprs));
+-	vcpu->arch.guest_fpregs.fpc = fpu->fpc;
+	vcpu->arch.guest_fpregs.fpc = fpu->fpc & FPC_VALID_MASK;
+ 	restore_fp_regs(&vcpu->arch.guest_fpregs);
+ 	return 0;
+ }
+-- 
+1.7.9.5
+
@@ -0,0 +1,61 @@
+From ac72e8c98ddb0c511b506472d9bc5afcf720babc Mon Sep 17 00:00:00 2001
+From: Kent Overstreet <kent.overstreet@gmail.com>
+Date: Wed, 8 Feb 2012 22:07:18 +0100
+Subject: [PATCH 008/117] bio: don't overflow in bio_get_nr_vecs()
+
+commit 5abebfdd02450fa1349daacf242e70b3736581e3 upstream.
+
+There were two places bio_get_nr_vecs() could overflow:
+
+First, it did a left shift to convert from sectors to bytes immediately
+before dividing by PAGE_SIZE.  If PAGE_SIZE ever was less than 512 a great
+many things would break, so dividing by PAGE_SIZE >> 9 is safe and will
+generate smaller code too.
+
+The nastier overflow was in the DIV_ROUND_UP() (that's what the code was
+effectively doing, anyways).  If n + d overflowed, the whole thing would
+return 0 which breaks things rather effectively.
+
+bio_get_nr_vecs() doesn't claim to give an exact value anyways, so the
+DIV_ROUND_UP() is silly; we could do a straight divide except if a
+device's queue_max_sectors was less than PAGE_SIZE we'd return 0.  So we
+just add 1; this should always be safe - things will break badly if
+bio_get_nr_vecs() returns > BIO_MAX_PAGES (bio_alloc() will suddenly start
+failing) but it's queue_max_segments that must guard against this, if
+queue_max_sectors is preventing this from happen things are going to
+explode on architectures with different PAGE_SIZE.
+
+Signed-off-by: Kent Overstreet <koverstreet@google.com>
+Cc: Tejun Heo <tj@kernel.org>
+Acked-by: Valdis Kletnieks <Valdis.Kletnieks@vt.edu>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/bio.c |   10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/fs/bio.c b/fs/bio.c
+index b1fe82c..b980ecd 100644
+--- a/fs/bio.c
+++ b/fs/bio.c
+@@ -505,13 +505,9 @@ EXPORT_SYMBOL(bio_clone);
+ int bio_get_nr_vecs(struct block_device *bdev)
+ {
+ 	struct request_queue *q = bdev_get_queue(bdev);
+-	int nr_pages;
+-
+-	nr_pages = ((queue_max_sectors(q) << 9) + PAGE_SIZE - 1) >> PAGE_SHIFT;
+-	if (nr_pages > queue_max_segments(q))
+-		nr_pages = queue_max_segments(q);
+-
+-	return nr_pages;
+	return min_t(unsigned,
+		     queue_max_segments(q),
+		     queue_max_sectors(q) / (PAGE_SIZE >> 9) + 1);
+ }
+ EXPORT_SYMBOL(bio_get_nr_vecs);
+ 
+-- 
+1.7.9.5
+
@@ -0,0 +1,49 @@
+From a98c14f6d0a745c09fa0ebf22c2ce8913c211d9b Mon Sep 17 00:00:00 2001
+From: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>
+Date: Fri, 11 May 2012 16:36:44 +0200
+Subject: [PATCH 009/117] bio allocation failure due to bio_get_nr_vecs()
+
+commit f908ee9463b09ddd05e1c1a0111132212dc05fac upstream.
+
+The number of bio_get_nr_vecs() is passed down via bio_alloc() to
+bvec_alloc_bs(), which fails the bio allocation if
+nr_iovecs > BIO_MAX_PAGES. For the underlying caller this causes an
+unexpected bio allocation failure.
+Limiting to queue_max_segments() is not sufficient, as max_segments
+also might be very large.
+
+bvec_alloc_bs(gfp_mask, nr_iovecs, ) => NULL when nr_iovecs  > BIO_MAX_PAGES
+bio_alloc_bioset(gfp_mask, nr_iovecs, ...)
+bio_alloc(GFP_NOIO, nvecs)
+xfs_alloc_ioend_bio()
+
+Signed-off-by: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/bio.c |    7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/fs/bio.c b/fs/bio.c
+index b980ecd..4fc4dbb 100644
+--- a/fs/bio.c
+++ b/fs/bio.c
+@@ -505,9 +505,14 @@ EXPORT_SYMBOL(bio_clone);
+ int bio_get_nr_vecs(struct block_device *bdev)
+ {
+ 	struct request_queue *q = bdev_get_queue(bdev);
+-	return min_t(unsigned,
+	int nr_pages;
+
+	nr_pages = min_t(unsigned,
+ 		     queue_max_segments(q),
+ 		     queue_max_sectors(q) / (PAGE_SIZE >> 9) + 1);
+
+	return min_t(unsigned, nr_pages, BIO_MAX_PAGES);
+
+ }
+ EXPORT_SYMBOL(bio_get_nr_vecs);
+ 
+-- 
+1.7.9.5
+
@@ -0,0 +1,98 @@
+From 6a6f5fba154e1400185844d74b953fba440fda63 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Tue, 15 May 2012 08:22:04 +0200
+Subject: [PATCH 010/117] block: fix buffer overflow when printing partition
+ UUIDs
+
+commit 05c69d298c96703741cac9a5cbbf6c53bd55a6e2 upstream.
+
+6d1d8050b4bc8 "block, partition: add partition_meta_info to hd_struct"
+added part_unpack_uuid() which assumes that the passed in buffer has
+enough space for sprintfing "%pU" - 37 characters including '\0'.
+
+Unfortunately, b5af921ec0233 "init: add support for root devices
+specified by partition UUID" supplied 33 bytes buffer to the function
+leading to the following panic with stackprotector enabled.
+
+  Kernel panic - not syncing: stack-protector: Kernel stack corrupted in: ffffffff81b14c7e
+
+  [<ffffffff815e226b>] panic+0xba/0x1c6
+  [<ffffffff81b14c7e>] ? printk_all_partitions+0x259/0x26xb
+  [<ffffffff810566bb>] __stack_chk_fail+0x1b/0x20
+  [<ffffffff81b15c7e>] printk_all_paritions+0x259/0x26xb
+  [<ffffffff81aedfe0>] mount_block_root+0x1bc/0x27f
+  [<ffffffff81aee0fa>] mount_root+0x57/0x5b
+  [<ffffffff81aee23b>] prepare_namespace+0x13d/0x176
+  [<ffffffff8107eec0>] ? release_tgcred.isra.4+0x330/0x30
+  [<ffffffff81aedd60>] kernel_init+0x155/0x15a
+  [<ffffffff81087b97>] ? schedule_tail+0x27/0xb0
+  [<ffffffff815f4d24>] kernel_thread_helper+0x5/0x10
+  [<ffffffff81aedc0b>] ? start_kernel+0x3c5/0x3c5
+  [<ffffffff815f4d20>] ? gs_change+0x13/0x13
+
+Increase the buffer size, remove the dangerous part_unpack_uuid() and
+use snprintf() directly from printk_all_partitions().
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Szymon Gruszczynski <sz.gruszczynski@googlemail.com>
+Cc: Will Drewry <wad@chromium.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ block/genhd.c         |   10 ++++++----
+ include/linux/genhd.h |    6 ------
+ 2 files changed, 6 insertions(+), 10 deletions(-)
+
+diff --git a/block/genhd.c b/block/genhd.c
+index 997afd6..4927476 100644
+--- a/block/genhd.c
+++ b/block/genhd.c
+@@ -744,7 +744,7 @@ void __init printk_all_partitions(void)
+ 		struct hd_struct *part;
+ 		char name_buf[BDEVNAME_SIZE];
+ 		char devt_buf[BDEVT_SIZE];
+-		u8 uuid[PARTITION_META_INFO_UUIDLTH * 2 + 1];
+		char uuid_buf[PARTITION_META_INFO_UUIDLTH * 2 + 5];
+ 
+ 		/*
+ 		 * Don't show empty devices or things that have been
+@@ -763,14 +763,16 @@ void __init printk_all_partitions(void)
+ 		while ((part = disk_part_iter_next(&piter))) {
+ 			bool is_part0 = part == &disk->part0;
+ 
+-			uuid[0] = 0;
+			uuid_buf[0] = '\0';
+ 			if (part->info)
+-				part_unpack_uuid(part->info->uuid, uuid);
+				snprintf(uuid_buf, sizeof(uuid_buf), "%pU",
+					 part->info->uuid);
+ 
+ 			printk("%s%s %10llu %s %s", is_part0 ? "" : "  ",
+ 			       bdevt_str(part_devt(part), devt_buf),
+ 			       (unsigned long long)part->nr_sects >> 1,
+-			       disk_name(disk, part->partno, name_buf), uuid);
+			       disk_name(disk, part->partno, name_buf),
+			       uuid_buf);
+ 			if (is_part0) {
+ 				if (disk->driverfs_dev != NULL &&
+ 				    disk->driverfs_dev->driver != NULL)
+diff --git a/include/linux/genhd.h b/include/linux/genhd.h
+index c6f7f6a..4eec461 100644
+--- a/include/linux/genhd.h
+++ b/include/linux/genhd.h
+@@ -222,12 +222,6 @@ static inline void part_pack_uuid(const u8 *uuid_str, u8 *to)
+ 	}
+ }
+ 
+-static inline char *part_unpack_uuid(const u8 *uuid, char *out)
+-{
+-	sprintf(out, "%pU", uuid);
+-	return out;
+-}
+-
+ static inline int disk_max_parts(struct gendisk *disk)
+ {
+ 	if (disk->flags & GENHD_FL_EXT_DEVT)
+-- 
+1.7.9.5
+
@@ -0,0 +1,43 @@
+From 882770bdde14aed9bf896980f51fe2fc8a55623f Mon Sep 17 00:00:00 2001
+From: James Bottomley <JBottomley@Parallels.com>
+Date: Tue, 15 May 2012 11:04:19 +0100
+Subject: [PATCH 011/117] fix PA1.1 oops on boot
+
+commit 5e185581d7c46ddd33cd9c01106d1fc86efb9376 upstream.
+
+All PA1.1 systems have been oopsing on boot since
+
+commit f311847c2fcebd81912e2f0caf8a461dec28db41
+Author: James Bottomley <James.Bottomley@HansenPartnership.com>
+Date:   Wed Dec 22 10:22:11 2010 -0600
+
+    parisc: flush pages through tmpalias space
+
+because a PA2.0 instruction was accidentally introduced into the PA1.1 TLB
+insertion interruption path when it was consolidated with the do_alias macro.
+Fix the do_alias macro only to use PA2.0 instructions if compiled for 64 bit.
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/parisc/kernel/entry.S |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
+index 6f05944..5350342 100644
+--- a/arch/parisc/kernel/entry.S
+++ b/arch/parisc/kernel/entry.S
+@@ -581,7 +581,11 @@
+ 	 */
+ 	cmpiclr,=	0x01,\tmp,%r0
+ 	ldi		(_PAGE_DIRTY|_PAGE_READ|_PAGE_WRITE),\prot
+#ifdef CONFIG_64BIT
+ 	depd,z		\prot,8,7,\prot
+#else
+	depw,z		\prot,8,7,\prot
+#endif
+ 	/*
+ 	 * OK, it is in the temp alias region, check whether "from" or "to".
+ 	 * Check "subtle" note in pacache.S re: r23/r26.
+-- 
+1.7.9.5
+
@@ -0,0 +1,91 @@
+From 95093fb411e522ec7a6c33d12863107ba841fe72 Mon Sep 17 00:00:00 2001
+From: John David Anglin <dave.anglin@bell.net>
+Date: Wed, 16 May 2012 10:14:52 +0100
+Subject: [PATCH 012/117] fix crash in flush_icache_page_asm on PA1.1
+
+commit 207f583d7179f707f402c36a7bda5ca1fd03ad5b upstream.
+
+As pointed out by serveral people, PA1.1 only has a type 26 instruction
+meaning that the space register must be explicitly encoded.  Not giving an
+explicit space means that the compiler uses the type 24 version which is PA2.0
+only resulting in an illegal instruction crash.
+
+This regression was caused by
+
+    commit f311847c2fcebd81912e2f0caf8a461dec28db41
+    Author: James Bottomley <James.Bottomley@HansenPartnership.com>
+    Date:   Wed Dec 22 10:22:11 2010 -0600
+
+        parisc: flush pages through tmpalias space
+
+Reported-by: Helge Deller <deller@gmx.de>
+Signed-off-by: John David Anglin <dave.anglin@bell.net>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/parisc/kernel/pacache.S |   38 ++++++++++++++++++++------------------
+ 1 file changed, 20 insertions(+), 18 deletions(-)
+
+diff --git a/arch/parisc/kernel/pacache.S b/arch/parisc/kernel/pacache.S
+index 93ff3d9..5d7218a 100644
+--- a/arch/parisc/kernel/pacache.S
+++ b/arch/parisc/kernel/pacache.S
+@@ -692,7 +692,7 @@ ENTRY(flush_icache_page_asm)
+ 
+ 	/* Purge any old translation */
+ 
+-	pitlb		(%sr0,%r28)
+	pitlb		(%sr4,%r28)
+ 
+ 	ldil		L%icache_stride, %r1
+ 	ldw		R%icache_stride(%r1), %r1
+@@ -706,27 +706,29 @@ ENTRY(flush_icache_page_asm)
+ 	sub		%r25, %r1, %r25
+ 
+ 
+-1:      fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
+-	fic,m		%r1(%r28)
+	/* fic only has the type 26 form on PA1.1, requiring an
+	 * explicit space specification, so use %sr4 */
+1:      fic,m		%r1(%sr4,%r28)
+	fic,m		%r1(%sr4,%r28)
+	fic,m		%r1(%sr4,%r28)
+	fic,m		%r1(%sr4,%r28)
+	fic,m		%r1(%sr4,%r28)
+	fic,m		%r1(%sr4,%r28)
+	fic,m		%r1(%sr4,%r28)
+	fic,m		%r1(%sr4,%r28)
+	fic,m		%r1(%sr4,%r28)
+	fic,m		%r1(%sr4,%r28)
+	fic,m		%r1(%sr4,%r28)
+	fic,m		%r1(%sr4,%r28)
+	fic,m		%r1(%sr4,%r28)
+	fic,m		%r1(%sr4,%r28)
+	fic,m		%r1(%sr4,%r28)
+ 	cmpb,COND(<<)		%r28, %r25,1b
+-	fic,m		%r1(%r28)
+	fic,m		%r1(%sr4,%r28)
+ 
+ 	sync
+ 	bv		%r0(%r2)
+-	pitlb		(%sr0,%r25)
+	pitlb		(%sr4,%r25)
+ 	.exit
+ 
+ 	.procend
+-- 
+1.7.9.5
+
@@ -0,0 +1,39 @@
+From ae4fc9e89e9e7fb510ddbff1c3ca6d41477f45e1 Mon Sep 17 00:00:00 2001
+From: James Bottomley <JBottomley@Parallels.com>
+Date: Wed, 16 May 2012 11:10:27 +0100
+Subject: [PATCH 013/117] fix panic on prefetch(NULL) on PA7300LC
+
+commit b3cb8674811d1851bbf1486a73d62b90c119b994 upstream.
+
+Due to an errata, the PA7300LC generates a TLB miss interruption even on the
+prefetch instruction.  This means that prefetch(NULL), which is supposed to be
+a nop on linux actually generates a NULL deref fault.  Fix this by testing the
+address of prefetch against NULL before doing the prefetch.
+
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/parisc/include/asm/prefetch.h |    7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/arch/parisc/include/asm/prefetch.h b/arch/parisc/include/asm/prefetch.h
+index c5edc60..1ee7c82 100644
+--- a/arch/parisc/include/asm/prefetch.h
+++ b/arch/parisc/include/asm/prefetch.h
+@@ -21,7 +21,12 @@
+ #define ARCH_HAS_PREFETCH
+ static inline void prefetch(const void *addr)
+ {
+-	__asm__("ldw 0(%0), %%r0" : : "r" (addr));
+	__asm__(
+#ifndef CONFIG_PA20
+		/* Need to avoid prefetch of NULL on PA7300LC */
+		"	extrw,u,= %0,31,32,%%r0\n"
+#endif
+		"	ldw 0(%0), %%r0" : : "r" (addr));
+ }
+ 
+ /* LDD is a PA2.0 addition. */
+-- 
+1.7.9.5
+
@@ -0,0 +1,31 @@
+From 083a3c3d326ad085b05c8606f4ea8594ca6467b8 Mon Sep 17 00:00:00 2001
+From: Chris Metcalf <cmetcalf@tilera.com>
+Date: Tue, 27 Mar 2012 13:47:57 -0400
+Subject: [PATCH 014/117] arch/tile/Kconfig: remove pointless "!M386" test.
+
+commit 8d6951439ef524683057251f1231df232046b6b6 upstream.
+
+Looks like a cut and paste bug from the x86 version.
+
+Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/tile/Kconfig |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/tile/Kconfig b/arch/tile/Kconfig
+index 70a0de4..7c9d2d4 100644
+--- a/arch/tile/Kconfig
+++ b/arch/tile/Kconfig
+@@ -12,7 +12,7 @@ config TILE
+ 	select GENERIC_PENDING_IRQ if SMP
+ 	select GENERIC_IRQ_SHOW
+ 	select SYS_HYPERVISOR
+-	select ARCH_HAVE_NMI_SAFE_CMPXCHG if !M386
+	select ARCH_HAVE_NMI_SAFE_CMPXCHG
+ 
+ # FIXME: investigate whether we need/want these options.
+ #	select HAVE_IOREMAP_PROT
+-- 
+1.7.9.5
+
@@ -0,0 +1,39 @@
+From 7f297eaca9b90a9be05ebe02c90efca3692136db Mon Sep 17 00:00:00 2001
+From: Chris Metcalf <cmetcalf@tilera.com>
+Date: Fri, 18 May 2012 13:33:24 -0400
+Subject: [PATCH 015/117] tilegx: enable SYSCALL_WRAPPERS support
+
+commit e6d9668e119af44ae5bcd5f1197174531458afe3 upstream.
+
+Some discussion with the glibc mailing lists revealed that this was
+necessary for 64-bit platforms with MIPS-like sign-extension rules
+for 32-bit values.  The original symptom was that passing (uid_t)-1 to
+setreuid() was failing in programs linked -pthread because of the "setxid"
+mechanism for passing setxid-type function arguments to the syscall code.
+SYSCALL_WRAPPERS handles ensuring that all syscall arguments end up with
+proper sign-extension and is thus the appropriate fix for this problem.
+
+On other platforms (s390, powerpc, sparc64, and mips) this was fixed
+in 2.6.28.6.  The general issue is tracked as CVE-2009-0029.
+
+Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/tile/Kconfig |    1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/tile/Kconfig b/arch/tile/Kconfig
+index 7c9d2d4..6cb8319 100644
+--- a/arch/tile/Kconfig
+++ b/arch/tile/Kconfig
+@@ -11,6 +11,7 @@ config TILE
+ 	select GENERIC_IRQ_PROBE
+ 	select GENERIC_PENDING_IRQ if SMP
+ 	select GENERIC_IRQ_SHOW
+	select HAVE_SYSCALL_WRAPPERS if TILEGX
+ 	select SYS_HYPERVISOR
+ 	select ARCH_HAVE_NMI_SAFE_CMPXCHG
+ 
+-- 
+1.7.9.5
+
@@ -0,0 +1,33 @@
+From 183929ad3fad7588523ae70fa91912196d4697db Mon Sep 17 00:00:00 2001
+From: Maxim Levitsky <maximlevitsky@gmail.com>
+Date: Sat, 17 Mar 2012 20:16:53 +0200
+Subject: [PATCH 016/117] mtd: sm_ftl: fix typo in major number.
+
+commit 452380efbd72d8d41f53ea64c8a6ea1fedc4394d upstream.
+
+major == 0 allocates dynamic major, not major == -1
+
+Signed-off-by: Maxim Levitsky <maximlevitsky@gmail.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/mtd/sm_ftl.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/sm_ftl.c b/drivers/mtd/sm_ftl.c
+index fddb714..a9ff89ff 100644
+--- a/drivers/mtd/sm_ftl.c
+++ b/drivers/mtd/sm_ftl.c
+@@ -1256,7 +1256,7 @@ static void sm_remove_dev(struct mtd_blktrans_dev *dev)
+ 
+ static struct mtd_blktrans_ops sm_ftl_ops = {
+ 	.name		= "smblk",
+-	.major		= -1,
+	.major		= 0,
+ 	.part_bits	= SM_FTL_PARTN_BITS,
+ 	.blksize	= SM_SECTOR_SIZE,
+ 	.getgeo		= sm_getgeo,
+-- 
+1.7.9.5
+
@@ -0,0 +1,77 @@
+From 3b1c9abc52f8145721d64abf54bf65139554f2be Mon Sep 17 00:00:00 2001
+From: "Stephen M. Cameron" <scameron@beardog.cce.hp.com>
+Date: Thu, 19 Jan 2012 14:01:04 -0600
+Subject: [PATCH 017/117] hpsa: Fix problem with MSA2xxx devices
+
+commit 9bc3711cbb67ac620bf09b4a147cbab45b2c36c0 upstream.
+
+Upgraded firmware on Smart Array P7xx (and some others) made them show up as
+SCSI revision 5 devices and this caused the driver to fail to map MSA2xxx
+logical drives to the correct bus/target/lun.  A symptom of this would be that
+the target ID of the logical drives as presented by the external storage array
+is ignored, and all such logical drives are assigned to target zero,
+differentiated only by LUN.  Some multipath software reportedly does not deal
+well with this behavior, failing to recognize different paths to the same
+device as such.
+
+Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>
+Signed-off-by: Scott Teel <scott.teel@hp.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/scsi/hpsa.c |   34 +++++++++++++++-------------------
+ 1 file changed, 15 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index 865d452..dc9dea3 100644
+--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
+@@ -1674,30 +1674,26 @@ static void figure_bus_target_lun(struct ctlr_info *h,
+ 
+ 	if (is_logical_dev_addr_mode(lunaddrbytes)) {
+ 		/* logical device */
+-		if (unlikely(is_scsi_rev_5(h))) {
+-			/* p1210m, logical drives lun assignments
+-			 * match SCSI REPORT LUNS data.
+		lunid = le32_to_cpu(*((__le32 *) lunaddrbytes));
+		if (is_msa2xxx(h, device)) {
+			/* msa2xxx way, put logicals on bus 1
+			 * and match target/lun numbers box
+			 * reports.
+ 			 */
+-			lunid = le32_to_cpu(*((__le32 *) lunaddrbytes));
+-			*bus = 0;
+-			*target = 0;
+-			*lun = (lunid & 0x3fff) + 1;
+			*bus = 1;
+			*target = (lunid >> 16) & 0x3fff;
+			*lun = lunid & 0x00ff;
+ 		} else {
+-			/* not p1210m... */
+-			lunid = le32_to_cpu(*((__le32 *) lunaddrbytes));
+-			if (is_msa2xxx(h, device)) {
+-				/* msa2xxx way, put logicals on bus 1
+-				 * and match target/lun numbers box
+-				 * reports.
+-				 */
+-				*bus = 1;
+-				*target = (lunid >> 16) & 0x3fff;
+-				*lun = lunid & 0x00ff;
+			if (likely(is_scsi_rev_5(h))) {
+				/* All current smart arrays (circa 2011) */
+				*bus = 0;
+				*target = 0;
+				*lun = (lunid & 0x3fff) + 1;
+ 			} else {
+-				/* Traditional smart array way. */
+				/* Traditional old smart array way. */
+ 				*bus = 0;
+-				*lun = 0;
+ 				*target = lunid & 0x3fff;
+				*lun = 0;
+ 			}
+ 		}
+ 	} else {
+-- 
+1.7.9.5
+
@@ -0,0 +1,34 @@
+From d5263c321d2e9dcacc4eed438d3dad60c13f95ba Mon Sep 17 00:00:00 2001
+From: Eric Paris <eparis@redhat.com>
+Date: Wed, 4 Apr 2012 13:47:11 -0400
+Subject: [PATCH 018/117] SELinux: if sel_make_bools errors don't leave
+ inconsistent state
+
+commit 154c50ca4eb9ae472f50b6a481213e21ead4457d upstream.
+
+We reset the bool names and values array to NULL, but do not reset the
+number of entries in these arrays to 0.  If we error out and then get back
+into this function we will walk these NULL pointers based on the belief
+that they are non-zero length.
+
+Signed-off-by: Eric Paris <eparis@redhat.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ security/selinux/selinuxfs.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
+index f466587..b4f802d 100644
+--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
+@@ -1238,6 +1238,7 @@ static int sel_make_bools(void)
+ 		kfree(bool_pending_names[i]);
+ 	kfree(bool_pending_names);
+ 	kfree(bool_pending_values);
+	bool_num = 0;
+ 	bool_pending_names = NULL;
+ 	bool_pending_values = NULL;
+ 
+-- 
+1.7.9.5
+
@@ -0,0 +1,86 @@
+From d9029a9d61ea9f9f8b153d7967365d66229b3874 Mon Sep 17 00:00:00 2001
+From: "Luis R. Rodriguez" <mcgrof@frijolero.org>
+Date: Fri, 23 Mar 2012 07:23:31 -0700
+Subject: [PATCH 019/117] cfg80211: warn if db.txt is empty with
+ CONFIG_CFG80211_INTERNAL_REGDB
+
+commit 80007efeff0568375b08faf93c7aad65602cb97e upstream.
+
+It has happened twice now where elaborate troubleshooting has
+undergone on systems where CONFIG_CFG80211_INTERNAL_REGDB [0]
+has been set but yet net/wireless/db.txt was not updated.
+
+Despite the documentation on this it seems system integrators could
+use some more help with this, so throw out a kernel warning at boot time
+when their database is empty.
+
+This does mean that the error-prone system integrator won't likely
+realize the issue until they boot the machine but -- it does not seem
+to make sense to enable a build bug breaking random build testing.
+
+[0] http://wireless.kernel.org/en/developers/Regulatory/CRDA#CONFIG_CFG80211_INTERNAL_REGDB
+
+Cc: Stephen Rothwell <sfr@canb.auug.org.au>
+Cc: Youngsin Lee <youngsin@qualcomm.com>
+Cc: Raja Mani <rmani@qca.qualcomm.com>
+Cc: Senthil Kumar Balasubramanian <senthilb@qca.qualcomm.com>
+Cc: Vipin Mehta <vipimeht@qca.qualcomm.com>
+Cc: yahuan@qca.qualcomm.com
+Cc: jjan@qca.qualcomm.com
+Cc: vthiagar@qca.qualcomm.com
+Cc: henrykim@qualcomm.com
+Cc: jouni@qca.qualcomm.com
+Cc: athiruve@qca.qualcomm.com
+Cc: cjkim@qualcomm.com
+Cc: philipk@qca.qualcomm.com
+Cc: sunnykim@qualcomm.com
+Cc: sskwak@qualcomm.com
+Cc: kkim@qualcomm.com
+Cc: mattbyun@qualcomm.com
+Cc: ryanlee@qualcomm.com
+Cc: simbap@qualcomm.com
+Cc: krislee@qualcomm.com
+Cc: conner@qualcomm.com
+Cc: hojinkim@qualcomm.com
+Cc: honglee@qualcomm.com
+Cc: johnwkim@qualcomm.com
+Cc: jinyong@qca.qualcomm.com
+Signed-off-by: Luis R. Rodriguez <mcgrof@frijolero.org>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/wireless/reg.c |   10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 3302c56..c1c99dd 100644
+--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
+@@ -379,7 +379,15 @@ static void reg_regdb_query(const char *alpha2)
+ 
+ 	schedule_work(&reg_regdb_work);
+ }
+
+/* Feel free to add any other sanity checks here */
+static void reg_regdb_size_check(void)
+{
+	/* We should ideally BUILD_BUG_ON() but then random builds would fail */
+	WARN_ONCE(!reg_regdb_size, "db.txt is empty, you should update it...");
+}
+ #else
+static inline void reg_regdb_size_check(void) {}
+ static inline void reg_regdb_query(const char *alpha2) {}
+ #endif /* CONFIG_CFG80211_INTERNAL_REGDB */
+ 
+@@ -2236,6 +2244,8 @@ int __init regulatory_init(void)
+ 	spin_lock_init(&reg_requests_lock);
+ 	spin_lock_init(&reg_pending_beacons_lock);
+ 
+	reg_regdb_size_check();
+
+ 	cfg80211_regdomain = cfg80211_world_regdom;
+ 
+ 	user_alpha2[0] = '9';
+-- 
+1.7.9.5
+
@@ -0,0 +1,60 @@
+From b12bc1d8337657ea79d90aecba397eaee36d10f6 Mon Sep 17 00:00:00 2001
+From: "nagalakshmi.nandigama@lsi.com" <nagalakshmi.nandigama@lsi.com>
+Date: Tue, 20 Mar 2012 12:10:01 +0530
+Subject: [PATCH 020/117] mpt2sas: Fix for panic happening because of improper
+ memory allocation
+
+commit e42fafc25fa86c61824e8d4c5e7582316415d24f upstream.
+
+The ioc->pfacts member in the IOC structure is getting set to zero
+following a call to _base_get_ioc_facts due to the memset in that routine.
+So if the ioc->pfacts was read after a host reset, there would be a NULL
+pointer dereference. The routine _base_get_ioc_facts is called from context
+of host reset.  The problem in _base_get_ioc_facts  is the size of
+Mpi2IOCFactsReply is 64, whereas the sizeof "struct mpt2sas_facts" is 60,
+so there is a four byte overflow resulting from the memset.
+
+Also, there is memset in _base_get_port_facts using the incorrect structure,
+it should be "struct mpt2sas_port_facts" instead of Mpi2PortFactsReply.
+
+Signed-off-by: Nagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/scsi/mpt2sas/mpt2sas_base.c |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
+index b1ddfef..ac336e1 100644
+--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
+@@ -3274,7 +3274,7 @@ _base_get_port_facts(struct MPT2SAS_ADAPTER *ioc, int port, int sleep_flag)
+ 	}
+ 
+ 	pfacts = &ioc->pfacts[port];
+-	memset(pfacts, 0, sizeof(Mpi2PortFactsReply_t));
+	memset(pfacts, 0, sizeof(struct mpt2sas_port_facts));
+ 	pfacts->PortNumber = mpi_reply.PortNumber;
+ 	pfacts->VP_ID = mpi_reply.VP_ID;
+ 	pfacts->VF_ID = mpi_reply.VF_ID;
+@@ -3316,7 +3316,7 @@ _base_get_ioc_facts(struct MPT2SAS_ADAPTER *ioc, int sleep_flag)
+ 	}
+ 
+ 	facts = &ioc->facts;
+-	memset(facts, 0, sizeof(Mpi2IOCFactsReply_t));
+	memset(facts, 0, sizeof(struct mpt2sas_facts));
+ 	facts->MsgVersion = le16_to_cpu(mpi_reply.MsgVersion);
+ 	facts->HeaderVersion = le16_to_cpu(mpi_reply.HeaderVersion);
+ 	facts->VP_ID = mpi_reply.VP_ID;
+@@ -4193,7 +4193,7 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc)
+ 		goto out_free_resources;
+ 
+ 	ioc->pfacts = kcalloc(ioc->facts.NumberOfPorts,
+-	    sizeof(Mpi2PortFactsReply_t), GFP_KERNEL);
+	    sizeof(struct mpt2sas_port_facts), GFP_KERNEL);
+ 	if (!ioc->pfacts) {
+ 		r = -ENOMEM;
+ 		goto out_free_resources;
+-- 
+1.7.9.5
+
@@ -0,0 +1,87 @@
+From cb510e3381f2dda5ad0cdf3519e6eee50ee2081e Mon Sep 17 00:00:00 2001
+From: Tilman Schmidt <tilman@imap.cc>
+Date: Wed, 25 Apr 2012 13:02:19 +0000
+Subject: [PATCH 021/117] isdn/gigaset: ratelimit CAPI message dumps
+
+commit 8e618aad5348b6e6c5a90e8d97ea643197963b20 upstream.
+
+Introduce a global ratelimit for CAPI message dumps to protect
+against possible log flood.
+Drop the ratelimit for ignored messages which is now covered by the
+global one.
+
+Signed-off-by: Tilman Schmidt <tilman@imap.cc>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/isdn/gigaset/capi.c |   22 +++++++++-------------
+ 1 file changed, 9 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/isdn/gigaset/capi.c b/drivers/isdn/gigaset/capi.c
+index 6d5ceee..5b80ef7 100644
+--- a/drivers/isdn/gigaset/capi.c
+++ b/drivers/isdn/gigaset/capi.c
+@@ -14,6 +14,7 @@
+ #include "gigaset.h"
+ #include <linux/proc_fs.h>
+ #include <linux/seq_file.h>
+#include <linux/ratelimit.h>
+ #include <linux/isdn/capilli.h>
+ #include <linux/isdn/capicmd.h>
+ #include <linux/isdn/capiutil.h>
+@@ -223,10 +224,14 @@ get_appl(struct gigaset_capi_ctr *iif, u16 appl)
+ static inline void dump_cmsg(enum debuglevel level, const char *tag, _cmsg *p)
+ {
+ #ifdef CONFIG_GIGASET_DEBUG
+	/* dump at most 20 messages in 20 secs */
+	static DEFINE_RATELIMIT_STATE(msg_dump_ratelimit, 20 * HZ, 20);
+ 	_cdebbuf *cdb;
+ 
+ 	if (!(gigaset_debuglevel & level))
+ 		return;
+	if (!___ratelimit(&msg_dump_ratelimit, tag))
+		return;
+ 
+ 	cdb = capi_cmsg2str(p);
+ 	if (cdb) {
+@@ -2059,12 +2064,6 @@ static void do_reset_b3_req(struct gigaset_capi_ctr *iif,
+ }
+ 
+ /*
+- * dump unsupported/ignored messages at most twice per minute,
+- * some apps send those very frequently
+- */
+-static unsigned long ignored_msg_dump_time;
+-
+-/*
+  * unsupported CAPI message handler
+  */
+ static void do_unsupported(struct gigaset_capi_ctr *iif,
+@@ -2073,8 +2072,7 @@ static void do_unsupported(struct gigaset_capi_ctr *iif,
+ {
+ 	/* decode message */
+ 	capi_message2cmsg(&iif->acmsg, skb->data);
+-	if (printk_timed_ratelimit(&ignored_msg_dump_time, 30 * 1000))
+-		dump_cmsg(DEBUG_CMD, __func__, &iif->acmsg);
+	dump_cmsg(DEBUG_CMD, __func__, &iif->acmsg);
+ 	send_conf(iif, ap, skb, CapiMessageNotSupportedInCurrentState);
+ }
+ 
+@@ -2085,11 +2083,9 @@ static void do_nothing(struct gigaset_capi_ctr *iif,
+ 		       struct gigaset_capi_appl *ap,
+ 		       struct sk_buff *skb)
+ {
+-	if (printk_timed_ratelimit(&ignored_msg_dump_time, 30 * 1000)) {
+-		/* decode message */
+-		capi_message2cmsg(&iif->acmsg, skb->data);
+-		dump_cmsg(DEBUG_CMD, __func__, &iif->acmsg);
+-	}
+	/* decode message */
+	capi_message2cmsg(&iif->acmsg, skb->data);
+	dump_cmsg(DEBUG_CMD, __func__, &iif->acmsg);
+ 	dev_kfree_skb_any(skb);
+ }
+ 
+-- 
+1.7.9.5
+
@@ -0,0 +1,46 @@
+From 49aed427d03f5bc84f690900a4a13c52b4c0916c Mon Sep 17 00:00:00 2001
+From: Tilman Schmidt <tilman@imap.cc>
+Date: Wed, 25 Apr 2012 13:02:20 +0000
+Subject: [PATCH 022/117] isdn/gigaset: fix CAPI disconnect B3 handling
+
+commit 62a1cfe052346b96a552b6a9178d412c709711bb upstream.
+
+If DISCONNECT_B3_IND was synthesized because of a DISCONNECT_REQ
+with existing logical connections, the connection state wasn't
+updated accordingly. Also the emitted DISCONNECT_B3_IND message
+wasn't included in the debug log as requested.
+This patch fixes both of these issues.
+
+Signed-off-by: Tilman Schmidt <tilman@imap.cc>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+[bwh: Backported to 3.2: adjust context]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/isdn/gigaset/capi.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/isdn/gigaset/capi.c b/drivers/isdn/gigaset/capi.c
+index 5b80ef7..fd17bb3 100644
+--- a/drivers/isdn/gigaset/capi.c
+++ b/drivers/isdn/gigaset/capi.c
+@@ -1887,6 +1887,9 @@ static void do_disconnect_req(struct gigaset_capi_ctr *iif,
+ 
+ 	/* check for active logical connection */
+ 	if (bcs->apconnstate >= APCONN_ACTIVE) {
+		/* clear it */
+		bcs->apconnstate = APCONN_SETUP;
+
+ 		/*
+ 		 * emit DISCONNECT_B3_IND with cause 0x3301
+ 		 * use separate cmsg structure, as the content of iif->acmsg
+@@ -1911,6 +1914,7 @@ static void do_disconnect_req(struct gigaset_capi_ctr *iif,
+ 		}
+ 		capi_cmsg2message(b3cmsg,
+ 			__skb_put(b3skb, CAPI_DISCONNECT_B3_IND_BASELEN));
+		dump_cmsg(DEBUG_CMD, __func__, b3cmsg);
+ 		kfree(b3cmsg);
+ 		capi_ctr_handle_message(&iif->ctr, ap->id, b3skb);
+ 	}
+-- 
+1.7.9.5
+
@@ -0,0 +1,47 @@
+From acee45e91a831a741676284dc84513b074705805 Mon Sep 17 00:00:00 2001
+From: Tilman Schmidt <tilman@imap.cc>
+Date: Wed, 25 Apr 2012 13:02:20 +0000
+Subject: [PATCH 023/117] isdn/gigaset: improve error handling querying
+ firmware version
+
+commit e055d03dc088a990fe5ea24a2d64033a168da23c upstream.
+
+An out-of-place "OK" response to the "AT+GMR" (get firmware version)
+command turns out to be, more often than not, a delayed response to
+a previous command rather than an actual error, so continue waiting
+for the version number in that case.
+
+Signed-off-by: Tilman Schmidt <tilman@imap.cc>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+[bwh: Backported to 3.2: adjust indentation]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/isdn/gigaset/ev-layer.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/isdn/gigaset/ev-layer.c b/drivers/isdn/gigaset/ev-layer.c
+index 6d12623..e95fac0 100644
+--- a/drivers/isdn/gigaset/ev-layer.c
+++ b/drivers/isdn/gigaset/ev-layer.c
+@@ -190,6 +190,7 @@ struct reply_t gigaset_tab_nocid[] =
+ 							  ACT_INIT} },
+ {RSP_OK,	121, 121, -1,			  0,  0, {ACT_GOTVER,
+ 							  ACT_INIT} },
+{RSP_NONE,	121, 121, -1,			120,  0, {ACT_GETSTRING} },
+ 
+ /* leave dle mode */
+ {RSP_INIT,	  0,   0, SEQ_DLE0,		201,  5, {0},	"^SDLE=0\r"},
+@@ -1314,8 +1315,9 @@ static void do_action(int action, struct cardstate *cs,
+ 		s = ev->ptr;
+ 
+ 		if (!strcmp(s, "OK")) {
+			/* OK without version string: assume old response */
+ 			*p_genresp = 1;
+-			*p_resp_code = RSP_ERROR;
+			*p_resp_code = RSP_NONE;
+ 			break;
+ 		}
+ 
+-- 
+1.7.9.5
+
@@ -0,0 +1,60 @@
+From ab5b15d0550f35ed49bb445fe04092d8b6fac542 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Fri, 11 May 2012 10:56:56 +0100
+Subject: [PATCH 024/117] KEYS: Use the compat keyctl() syscall wrapper on
+ Sparc64 for Sparc32 compat
+
+commit 45de6767dc51358a188f75dc4ad9dfddb7fb9480 upstream.
+
+Use the 32-bit compat keyctl() syscall wrapper on Sparc64 for Sparc32 binary
+compatibility.
+
+Without this, keyctl(KEYCTL_INSTANTIATE_IOV) is liable to malfunction as it
+uses an iovec array read from userspace - though the kernel should survive this
+as it checks pointers and sizes anyway.
+
+I think all the other keyctl() function should just work, provided (a) the top
+32-bits of each 64-bit argument register are cleared prior to invoking the
+syscall routine, and the 32-bit address space is right at the 0-end of the
+64-bit address space.  Most of the arguments are 32-bit anyway, and so for
+those clearing is not required.
+
+Signed-off-by: David Howells <dhowells@redhat.com
+cc: "David S. Miller" <davem@davemloft.net>
+cc: sparclinux@vger.kernel.org
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/sparc/Kconfig             |    3 +++
+ arch/sparc/kernel/systbls_64.S |    2 +-
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
+index f92602e..f210d51 100644
+--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
+@@ -583,6 +583,9 @@ config SYSVIPC_COMPAT
+ 	depends on COMPAT && SYSVIPC
+ 	default y
+ 
+config KEYS_COMPAT
+	def_bool y if COMPAT && KEYS
+
+ endmenu
+ 
+ source "net/Kconfig"
+diff --git a/arch/sparc/kernel/systbls_64.S b/arch/sparc/kernel/systbls_64.S
+index db86b1a..3a58e0d 100644
+--- a/arch/sparc/kernel/systbls_64.S
+++ b/arch/sparc/kernel/systbls_64.S
+@@ -74,7 +74,7 @@ sys_call_table32:
+ 	.word sys_timer_delete, compat_sys_timer_create, sys_ni_syscall, compat_sys_io_setup, sys_io_destroy
+ /*270*/	.word sys32_io_submit, sys_io_cancel, compat_sys_io_getevents, sys32_mq_open, sys_mq_unlink
+ 	.word compat_sys_mq_timedsend, compat_sys_mq_timedreceive, compat_sys_mq_notify, compat_sys_mq_getsetattr, compat_sys_waitid
+-/*280*/	.word sys32_tee, sys_add_key, sys_request_key, sys_keyctl, compat_sys_openat
+/*280*/	.word sys32_tee, sys_add_key, sys_request_key, compat_sys_keyctl, compat_sys_openat
+ 	.word sys_mkdirat, sys_mknodat, sys_fchownat, compat_sys_futimesat, compat_sys_fstatat64
+ /*290*/	.word sys_unlinkat, sys_renameat, sys_linkat, sys_symlinkat, sys_readlinkat
+ 	.word sys_fchmodat, sys_faccessat, compat_sys_pselect6, compat_sys_ppoll, sys_unshare
+-- 
+1.7.9.5
+
@@ -0,0 +1,38 @@
+From a107ab4ce96a6243eca41ca139acc033a8be253b Mon Sep 17 00:00:00 2001
+From: Yishai Hadas <yishaih@mellanox.com>
+Date: Thu, 10 May 2012 23:28:05 +0300
+Subject: [PATCH 025/117] IB/core: Fix mismatch between locked and pinned
+ pages
+
+commit c4870eb874ac16dccef40e1bc7a002c7e9156adc upstream.
+
+Commit bc3e53f682d9 ("mm: distinguish between mlocked and pinned
+pages") introduced a separate counter for pinned pages and used it in
+the IB stack.  However, in ib_umem_get() the pinned counter is
+incremented, but ib_umem_release() wrongly decrements the locked
+counter.  Fix this.
+
+Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
+Reviewed-by: Christoph Lameter <cl@linux.com>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/infiniband/core/umem.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
+index 71f0c0f..a841123 100644
+--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
+@@ -269,7 +269,7 @@ void ib_umem_release(struct ib_umem *umem)
+ 	} else
+ 		down_write(&mm->mmap_sem);
+ 
+-	current->mm->locked_vm -= diff;
+	current->mm->pinned_vm -= diff;
+ 	up_write(&mm->mmap_sem);
+ 	mmput(mm);
+ 	kfree(umem);
+-- 
+1.7.9.5
+
@@ -0,0 +1,34 @@
+From 675478b722ec5e21b9e1db453e3c59ced85b2008 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Sun, 13 May 2012 18:35:56 +0100
+Subject: [PATCH 026/117] regulator: core: Release regulator-regulator
+ supplies on error
+
+commit e81dba85c6388dfabcb76cbc2b8bd02836a53ae5 upstream.
+
+If we fail while registering a regulator make sure we release the supply
+for the regulator if there is one.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Acked-by: Liam Girdwood <lrg@ti.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/regulator/core.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 938398f..6ec610c 100644
+--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
+@@ -2765,6 +2765,8 @@ unset_supplies:
+ 	unset_regulator_supplies(rdev);
+ 
+ scrub:
+	if (rdev->supply)
+		regulator_put(rdev->supply);
+ 	kfree(rdev->constraints);
+ 	device_unregister(&rdev->dev);
+ 	/* device core frees rdev */
+-- 
+1.7.9.5
+
@@ -0,0 +1,41 @@
+From 3dd0f718e41c8a6e580d3c11f8153ffd7ddeacde Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Sun, 13 May 2012 20:09:38 +0300
+Subject: [PATCH 027/117] iommu: Fix off by one in dmar_get_fault_reason()
+
+commit fefe1ed1398b81e3fadc92d11d91162d343c8836 upstream.
+
+fault_reason - 0x20 == ARRAY_SIZE(irq_remap_fault_reasons) is
+one past the end of the array.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Joerg Roedel <joerg.roedel@amd.com>
+Cc: Youquan Song <youquan.song@intel.com>
+Cc: walter harms <wharms@bfs.de>
+Cc: Suresh Siddha <suresh.b.siddha@intel.com>
+Link: http://lkml.kernel.org/r/20120513170938.GA4280@elgon.mountain
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+[bwh: Backported to 3.2: s/irq_remap_fault_reasons/intr_remap_fault_reasons/]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/iommu/dmar.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
+index 35c1e17..97b2e21 100644
+--- a/drivers/iommu/dmar.c
+++ b/drivers/iommu/dmar.c
+@@ -1056,8 +1056,8 @@ static const char *intr_remap_fault_reasons[] =
+ 
+ const char *dmar_get_fault_reason(u8 fault_reason, int *fault_type)
+ {
+-	if (fault_reason >= 0x20 && (fault_reason <= 0x20 +
+-				     ARRAY_SIZE(intr_remap_fault_reasons))) {
+	if (fault_reason >= 0x20 && (fault_reason - 0x20 <
+					ARRAY_SIZE(intr_remap_fault_reasons))) {
+ 		*fault_type = INTR_REMAP;
+ 		return intr_remap_fault_reasons[fault_reason - 0x20];
+ 	} else if (fault_reason < ARRAY_SIZE(dma_remap_fault_reasons)) {
+-- 
+1.7.9.5
+
@@ -0,0 +1,38 @@
+From e8cefa61ecf62e7ec98658843627df00696699d5 Mon Sep 17 00:00:00 2001
+From: Steve Wise <swise@opengridcomputing.com>
+Date: Fri, 27 Apr 2012 09:59:16 -0500
+Subject: [PATCH 028/117] RDMA/cxgb4: Always wake up waiters in
+ c4iw_peer_abort_intr()
+
+commit 0f1dcfae6bc5563424346ad3a03282b8235a4c33 upstream.
+
+This fixes a race where an ingress abort fails to wake up the thread
+blocked in rdma_init() causing the app to hang.
+
+Signed-off-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/infiniband/hw/cxgb4/cm.c |    5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index 0747004..151334c 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -2725,11 +2725,8 @@ static int peer_abort_intr(struct c4iw_dev *dev, struct sk_buff *skb)
+ 
+ 	/*
+ 	 * Wake up any threads in rdma_init() or rdma_fini().
+-	 * However, this is not needed if com state is just
+-	 * MPA_REQ_SENT
+ 	 */
+-	if (ep->com.state != MPA_REQ_SENT)
+-		c4iw_wake_up(&ep->com.wr_wait, -ECONNRESET);
+	c4iw_wake_up(&ep->com.wr_wait, -ECONNRESET);
+ 	sched(dev, skb);
+ 	return 0;
+ }
+-- 
+1.7.9.5
+
@@ -0,0 +1,37 @@
+From 6ccdd0ede34681b1bdda91a5735e700274db9e5c Mon Sep 17 00:00:00 2001
+From: Steve Wise <swise@opengridcomputing.com>
+Date: Mon, 30 Apr 2012 15:31:29 -0500
+Subject: [PATCH 029/117] RDMA/cxgb4: Drop peer_abort when no endpoint found
+
+commit 14b9222808bb8bfefc71f72bc0dbdcf3b2f0140f upstream.
+
+Log a warning and drop the abort message.  Otherwise we will do a
+bogus wake_up() and crash.
+
+Signed-off-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/infiniband/hw/cxgb4/cm.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index 151334c..2e6a538 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -2714,6 +2714,12 @@ static int peer_abort_intr(struct c4iw_dev *dev, struct sk_buff *skb)
+ 	unsigned int tid = GET_TID(req);
+ 
+ 	ep = lookup_tid(t, tid);
+	if (!ep) {
+		printk(KERN_WARNING MOD
+		       "Abort on non-existent endpoint, tid %d\n", tid);
+		kfree_skb(skb);
+		return 0;
+	}
+ 	if (is_neg_adv_abort(req->status)) {
+ 		PDBG("%s neg_adv_abort ep %p tid %u\n", __func__, ep,
+ 		     ep->hwtid);
+-- 
+1.7.9.5
+
@@ -0,0 +1,82 @@
+From f292f8180fb1ab073d5e88859f3d05608fa1fbe7 Mon Sep 17 00:00:00 2001
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+Date: Wed, 9 May 2012 09:37:30 +0200
+Subject: [PATCH 030/117] s390/pfault: fix task state race
+
+commit d5e50a51ccbda36b379aba9d1131a852eb908dda upstream.
+
+When setting the current task state to TASK_UNINTERRUPTIBLE this can
+race with a different cpu. The other cpu could set the task state after
+it inspected it (while it was still TASK_RUNNING) to TASK_RUNNING which
+would change the state from TASK_UNINTERRUPTIBLE to TASK_RUNNING again.
+
+This race was always present in the pfault interrupt code but didn't
+cause anything harmful before commit f2db2e6c "[S390] pfault: cpu hotplug
+vs missing completion interrupts" which relied on the fact that after
+setting the task state to TASK_UNINTERRUPTIBLE the task would really
+sleep.
+Since this is not necessarily the case the result may be a list corruption
+of the pfault_list or, as observed, a use-after-free bug while trying to
+access the task_struct of a task which terminated itself already.
+
+To fix this, we need to get a reference of the affected task when receiving
+the initial pfault interrupt and add special handling if we receive yet
+another initial pfault interrupt when the task is already enqueued in the
+pfault list.
+
+Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Reviewed-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/s390/mm/fault.c |   14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
+index c7f0fbc..b28aaa4 100644
+--- a/arch/s390/mm/fault.c
+++ b/arch/s390/mm/fault.c
+@@ -583,6 +583,7 @@ static void pfault_interrupt(unsigned int ext_int_code,
+ 			tsk->thread.pfault_wait = 0;
+ 			list_del(&tsk->thread.list);
+ 			wake_up_process(tsk);
+			put_task_struct(tsk);
+ 		} else {
+ 			/* Completion interrupt was faster than initial
+ 			 * interrupt. Set pfault_wait to -1 so the initial
+@@ -597,14 +598,22 @@ static void pfault_interrupt(unsigned int ext_int_code,
+ 		put_task_struct(tsk);
+ 	} else {
+ 		/* signal bit not set -> a real page is missing. */
+-		if (tsk->thread.pfault_wait == -1) {
+		if (tsk->thread.pfault_wait == 1) {
+			/* Already on the list with a reference: put to sleep */
+			set_task_state(tsk, TASK_UNINTERRUPTIBLE);
+			set_tsk_need_resched(tsk);
+		} else if (tsk->thread.pfault_wait == -1) {
+ 			/* Completion interrupt was faster than the initial
+ 			 * interrupt (pfault_wait == -1). Set pfault_wait
+ 			 * back to zero and exit. */
+ 			tsk->thread.pfault_wait = 0;
+ 		} else {
+ 			/* Initial interrupt arrived before completion
+-			 * interrupt. Let the task sleep. */
+			 * interrupt. Let the task sleep.
+			 * An extra task reference is needed since a different
+			 * cpu may set the task state to TASK_RUNNING again
+			 * before the scheduler is reached. */
+			get_task_struct(tsk);
+ 			tsk->thread.pfault_wait = 1;
+ 			list_add(&tsk->thread.list, &pfault_list);
+ 			set_task_state(tsk, TASK_UNINTERRUPTIBLE);
+@@ -629,6 +638,7 @@ static int __cpuinit pfault_cpu_notify(struct notifier_block *self,
+ 			list_del(&thread->list);
+ 			tsk = container_of(thread, struct task_struct, thread);
+ 			wake_up_process(tsk);
+			put_task_struct(tsk);
+ 		}
+ 		spin_unlock_irq(&pfault_lock);
+ 		break;
+-- 
+1.7.9.5
+
@@ -0,0 +1,46 @@
+From 51945640120dea3c9b3a0207bc864138c6c1c8a8 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Mon, 30 Apr 2012 11:57:44 -0700
+Subject: [PATCH 031/117] isci: fix oem parameter validation on single
+ controller skus
+
+commit fc25f79af321c01a739150ba2c09435cf977a63d upstream.
+
+OEM parameters [1] are parsed from the platform option-rom / efi
+driver.  By default the driver was validating the parameters for the
+dual-controller case, but in single-controller case only the first set
+of parameters may be valid.
+
+Limit the validation to the number of actual controllers detected
+otherwise the driver may fail to parse the valid parameters leading to
+driver-load or runtime failures.
+
+[1] the platform specific set of phy address, configuration,and analog
+    tuning values
+
+[stable v3.0+]
+Reported-by: Dave Jiang <dave.jiang@intel.com>
+Tested-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+[bwh: Backported to 3.2: adjust context]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/scsi/isci/init.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c
+index a97edab..83d08b6 100644
+--- a/drivers/scsi/isci/init.c
+++ b/drivers/scsi/isci/init.c
+@@ -465,7 +465,7 @@ static int __devinit isci_pci_probe(struct pci_dev *pdev, const struct pci_devic
+ 	if (!orom)
+ 		orom = isci_request_oprom(pdev);
+ 
+-	for (i = 0; orom && i < ARRAY_SIZE(orom->ctrl); i++) {
+	for (i = 0; orom && i < num_controllers(pdev); i++) {
+ 		if (sci_oem_parameters_validate(&orom->ctrl[i])) {
+ 			dev_warn(&pdev->dev,
+ 				 "[%d]: invalid oem parameters detected, falling back to firmware\n", i);
+-- 
+1.7.9.5
+
@@ -0,0 +1,69 @@
+From 193433aeaf9380a822cd4bf7f5777e70b2e86550 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Mon, 21 May 2012 12:52:42 -0700
+Subject: [PATCH 032/117] Fix blocking allocations called very early during
+ bootup
+
+commit 31a67102f4762df5544bc2dfb34a931233d2a5b2 upstream.
+
+During early boot, when the scheduler hasn't really been fully set up,
+we really can't do blocking allocations because with certain (dubious)
+configurations the "might_resched()" calls can actually result in
+scheduling events.
+
+We could just make such users always use GFP_ATOMIC, but quite often the
+code that does the allocation isn't really aware of the fact that the
+scheduler isn't up yet, and forcing that kind of random knowledge on the
+initialization code is just annoying and not good for anybody.
+
+And we actually have a the 'gfp_allowed_mask' exactly for this reason:
+it's just that the kernel init sequence happens to set it to allow
+blocking allocations much too early.
+
+So move the 'gfp_allowed_mask' initialization from 'start_kernel()'
+(which is some of the earliest init code, and runs with preemption
+disabled for good reasons) into 'kernel_init()'.  kernel_init() is run
+in the newly created thread that will become the 'init' process, as
+opposed to the early startup code that runs within the context of what
+will be the first idle thread.
+
+So by the time we reach 'kernel_init()', we know that the scheduler must
+be at least limping along, because we've already scheduled from the idle
+thread into the init thread.
+
+Reported-by: Steven Rostedt <rostedt@goodmis.org>
+Cc: David Rientjes <rientjes@google.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ init/main.c |    7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/init/main.c b/init/main.c
+index 217ed23..cb08fea2 100644
+--- a/init/main.c
+++ b/init/main.c
+@@ -563,9 +563,6 @@ asmlinkage void __init start_kernel(void)
+ 	early_boot_irqs_disabled = false;
+ 	local_irq_enable();
+ 
+-	/* Interrupts are enabled now so all GFP allocations are safe. */
+-	gfp_allowed_mask = __GFP_BITS_MASK;
+-
+ 	kmem_cache_init_late();
+ 
+ 	/*
+@@ -798,6 +795,10 @@ static int __init kernel_init(void * unused)
+ 	 * Wait until kthreadd is all set-up.
+ 	 */
+ 	wait_for_completion(&kthreadd_done);
+
+	/* Now the scheduler is fully set up and can do blocking allocations */
+	gfp_allowed_mask = __GFP_BITS_MASK;
+
+ 	/*
+ 	 * init can allocate pages on any node
+ 	 */
+-- 
+1.7.9.5
+
@@ -0,0 +1,109 @@
+From 078dda1f3c0c180fc5d408f9f087752a0afbed3f Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Mon, 21 May 2012 16:06:20 -0700
+Subject: [PATCH 033/117] vfs: make AIO use the proper rw_verify_area() area
+ helpers
+
+commit a70b52ec1aaeaf60f4739edb1b422827cb6f3893 upstream.
+
+We had for some reason overlooked the AIO interface, and it didn't use
+the proper rw_verify_area() helper function that checks (for example)
+mandatory locking on the file, and that the size of the access doesn't
+cause us to overflow the provided offset limits etc.
+
+Instead, AIO did just the security_file_permission() thing (that
+rw_verify_area() also does) directly.
+
+This fixes it to do all the proper helper functions, which not only
+means that now mandatory file locking works with AIO too, we can
+actually remove lines of code.
+
+Reported-by: Manish Honap <manish_honap_vit@yahoo.co.in>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/aio.c |   30 ++++++++++++++----------------
+ 1 file changed, 14 insertions(+), 16 deletions(-)
+
+diff --git a/fs/aio.c b/fs/aio.c
+index b9d64d8..3b65ee7 100644
+--- a/fs/aio.c
+++ b/fs/aio.c
+@@ -1477,6 +1477,10 @@ static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
+ 	if (ret < 0)
+ 		goto out;
+ 
+	ret = rw_verify_area(type, kiocb->ki_filp, &kiocb->ki_pos, ret);
+	if (ret < 0)
+		goto out;
+
+ 	kiocb->ki_nr_segs = kiocb->ki_nbytes;
+ 	kiocb->ki_cur_seg = 0;
+ 	/* ki_nbytes/left now reflect bytes instead of segs */
+@@ -1488,11 +1492,17 @@ out:
+ 	return ret;
+ }
+ 
+-static ssize_t aio_setup_single_vector(struct kiocb *kiocb)
+static ssize_t aio_setup_single_vector(int type, struct file * file, struct kiocb *kiocb)
+ {
+	int bytes;
+
+	bytes = rw_verify_area(type, file, &kiocb->ki_pos, kiocb->ki_left);
+	if (bytes < 0)
+		return bytes;
+
+ 	kiocb->ki_iovec = &kiocb->ki_inline_vec;
+ 	kiocb->ki_iovec->iov_base = kiocb->ki_buf;
+-	kiocb->ki_iovec->iov_len = kiocb->ki_left;
+	kiocb->ki_iovec->iov_len = bytes;
+ 	kiocb->ki_nr_segs = 1;
+ 	kiocb->ki_cur_seg = 0;
+ 	return 0;
+@@ -1517,10 +1527,7 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
+ 		if (unlikely(!access_ok(VERIFY_WRITE, kiocb->ki_buf,
+ 			kiocb->ki_left)))
+ 			break;
+-		ret = security_file_permission(file, MAY_READ);
+-		if (unlikely(ret))
+-			break;
+-		ret = aio_setup_single_vector(kiocb);
+		ret = aio_setup_single_vector(READ, file, kiocb);
+ 		if (ret)
+ 			break;
+ 		ret = -EINVAL;
+@@ -1535,10 +1542,7 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
+ 		if (unlikely(!access_ok(VERIFY_READ, kiocb->ki_buf,
+ 			kiocb->ki_left)))
+ 			break;
+-		ret = security_file_permission(file, MAY_WRITE);
+-		if (unlikely(ret))
+-			break;
+-		ret = aio_setup_single_vector(kiocb);
+		ret = aio_setup_single_vector(WRITE, file, kiocb);
+ 		if (ret)
+ 			break;
+ 		ret = -EINVAL;
+@@ -1549,9 +1553,6 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
+ 		ret = -EBADF;
+ 		if (unlikely(!(file->f_mode & FMODE_READ)))
+ 			break;
+-		ret = security_file_permission(file, MAY_READ);
+-		if (unlikely(ret))
+-			break;
+ 		ret = aio_setup_vectored_rw(READ, kiocb, compat);
+ 		if (ret)
+ 			break;
+@@ -1563,9 +1564,6 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
+ 		ret = -EBADF;
+ 		if (unlikely(!(file->f_mode & FMODE_WRITE)))
+ 			break;
+-		ret = security_file_permission(file, MAY_WRITE);
+-		if (unlikely(ret))
+-			break;
+ 		ret = aio_setup_vectored_rw(WRITE, kiocb, compat);
+ 		if (ret)
+ 			break;
+-- 
+1.7.9.5
+
@@ -0,0 +1,100 @@
+From d2c7de1fefbc917e3731bf69e18b553b3c7a165f Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Wed, 18 Apr 2012 23:16:45 -0700
+Subject: [PATCH 034/117] docs: update HOWTO for 2.6.x -> 3.x versioning
+
+commit 591bfc6bf9e5e25e464fd4c87d64afd5135667c4 upstream.
+
+The HOWTO document needed updating for the new kernel versioning. The
+git URI for -next was updated as well.
+
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ Documentation/HOWTO |   32 ++++++++++++++++----------------
+ 1 file changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/Documentation/HOWTO b/Documentation/HOWTO
+index f7ade3b..59c080f 100644
+--- a/Documentation/HOWTO
+++ b/Documentation/HOWTO
+@@ -218,16 +218,16 @@ The development process
+ Linux kernel development process currently consists of a few different
+ main kernel "branches" and lots of different subsystem-specific kernel
+ branches.  These different branches are:
+-  - main 2.6.x kernel tree
+-  - 2.6.x.y -stable kernel tree
+-  - 2.6.x -git kernel patches
+  - main 3.x kernel tree
+  - 3.x.y -stable kernel tree
+  - 3.x -git kernel patches
+   - subsystem specific kernel trees and patches
+-  - the 2.6.x -next kernel tree for integration tests
+  - the 3.x -next kernel tree for integration tests
+ 
+-2.6.x kernel tree
+3.x kernel tree
+ -----------------
+-2.6.x kernels are maintained by Linus Torvalds, and can be found on
+-kernel.org in the pub/linux/kernel/v2.6/ directory.  Its development
+3.x kernels are maintained by Linus Torvalds, and can be found on
+kernel.org in the pub/linux/kernel/v3.x/ directory.  Its development
+ process is as follows:
+   - As soon as a new kernel is released a two weeks window is open,
+     during this period of time maintainers can submit big diffs to
+@@ -262,20 +262,20 @@ mailing list about kernel releases:
+ 	released according to perceived bug status, not according to a
+ 	preconceived timeline."
+ 
+-2.6.x.y -stable kernel tree
+3.x.y -stable kernel tree
+ ---------------------------
+-Kernels with 4-part versions are -stable kernels. They contain
+Kernels with 3-part versions are -stable kernels. They contain
+ relatively small and critical fixes for security problems or significant
+-regressions discovered in a given 2.6.x kernel.
+regressions discovered in a given 3.x kernel.
+ 
+ This is the recommended branch for users who want the most recent stable
+ kernel and are not interested in helping test development/experimental
+ versions.
+ 
+-If no 2.6.x.y kernel is available, then the highest numbered 2.6.x
+If no 3.x.y kernel is available, then the highest numbered 3.x
+ kernel is the current stable kernel.
+ 
+-2.6.x.y are maintained by the "stable" team <stable@vger.kernel.org>, and
+3.x.y are maintained by the "stable" team <stable@vger.kernel.org>, and
+ are released as needs dictate.  The normal release period is approximately
+ two weeks, but it can be longer if there are no pressing problems.  A
+ security-related problem, instead, can cause a release to happen almost
+@@ -285,7 +285,7 @@ The file Documentation/stable_kernel_rules.txt in the kernel tree
+ documents what kinds of changes are acceptable for the -stable tree, and
+ how the release process works.
+ 
+-2.6.x -git patches
+3.x -git patches
+ ------------------
+ These are daily snapshots of Linus' kernel tree which are managed in a
+ git repository (hence the name.) These patches are usually released
+@@ -317,13 +317,13 @@ revisions to it, and maintainers can mark patches as under review,
+ accepted, or rejected.  Most of these patchwork sites are listed at
+ http://patchwork.kernel.org/.
+ 
+-2.6.x -next kernel tree for integration tests
+3.x -next kernel tree for integration tests
+ ---------------------------------------------
+-Before updates from subsystem trees are merged into the mainline 2.6.x
+Before updates from subsystem trees are merged into the mainline 3.x
+ tree, they need to be integration-tested.  For this purpose, a special
+ testing repository exists into which virtually all subsystem trees are
+ pulled on an almost daily basis:
+-	http://git.kernel.org/?p=linux/kernel/git/sfr/linux-next.git
+	http://git.kernel.org/?p=linux/kernel/git/next/linux-next.git
+ 	http://linux.f-seidel.de/linux-next/pmwiki/
+ 
+ This way, the -next kernel gives a summary outlook onto what will be
+-- 
+1.7.9.5
+
@@ -0,0 +1,34 @@
+From bf21ec2ca510b5e8d017ea1177ffa78a2fec5b93 Mon Sep 17 00:00:00 2001
+From: Julia Lawall <Julia.Lawall@lip6.fr>
+Date: Sun, 22 Apr 2012 13:37:09 +0200
+Subject: [PATCH 035/117] drivers/staging/comedi/comedi_fops.c: add missing
+ vfree
+
+commit abae41e6438b798e046d721b6ccdd55b4a398170 upstream.
+
+aux_free is freed on all other exits from the function.  By removing the
+return, we can benefit from the vfree already at the end of the function.
+
+Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/staging/comedi/comedi_fops.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
+index 5e78c77..4ad2c0e 100644
+--- a/drivers/staging/comedi/comedi_fops.c
+++ b/drivers/staging/comedi/comedi_fops.c
+@@ -280,7 +280,7 @@ static int do_devconfig_ioctl(struct comedi_device *dev,
+ 	if (ret == 0) {
+ 		if (!try_module_get(dev->driver->module)) {
+ 			comedi_device_detach(dev);
+-			return -ENOSYS;
+			ret = -ENOSYS;
+ 		}
+ 	}
+ 
+-- 
+1.7.9.5
+
@@ -0,0 +1,70 @@
+From a62e9c8e391b91bd60c705748ea8ec207ef72eab Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Thu, 10 Nov 2011 14:58:26 +0100
+Subject: [PATCH 036/117] USB: move usb_translate_errors to linux/usb.h
+
+commit 2c4d6bf295ae10ffcd84f0df6cb642598eb66603 upstream.
+
+Move usb_translate_errors from usb core to linux/usb.h as it is meant to
+be accessed from drivers.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/core/usb.h |   14 --------------
+ include/linux/usb.h    |   13 +++++++++++++
+ 2 files changed, 13 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
+index 3888778..45e8479 100644
+--- a/drivers/usb/core/usb.h
+++ b/drivers/usb/core/usb.h
+@@ -132,20 +132,6 @@ static inline int is_usb_device_driver(struct device_driver *drv)
+ 			for_devices;
+ }
+ 
+-/* translate USB error codes to codes user space understands */
+-static inline int usb_translate_errors(int error_code)
+-{
+-	switch (error_code) {
+-	case 0:
+-	case -ENOMEM:
+-	case -ENODEV:
+-		return error_code;
+-	default:
+-		return -EIO;
+-	}
+-}
+-
+-
+ /* for labeling diagnostics */
+ extern const char *usbcore_name;
+ 
+diff --git a/include/linux/usb.h b/include/linux/usb.h
+index 7626e5a..68cdc84 100644
+--- a/include/linux/usb.h
+++ b/include/linux/usb.h
+@@ -1600,6 +1600,19 @@ usb_maxpacket(struct usb_device *udev, int pipe, int is_out)
+ 
+ /* ----------------------------------------------------------------------- */
+ 
+/* translate USB error codes to codes user space understands */
+static inline int usb_translate_errors(int error_code)
+{
+	switch (error_code) {
+	case 0:
+	case -ENOMEM:
+	case -ENODEV:
+		return error_code;
+	default:
+		return -EIO;
+	}
+}
+
+ /* Events from the usb core */
+ #define USB_DEVICE_ADD		0x0001
+ #define USB_DEVICE_REMOVE	0x0002
+-- 
+1.7.9.5
+
@@ -0,0 +1,33 @@
+From 1676590583666a41bf8b26924d0ab9b729455813 Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oliver@neukum.org>
+Date: Fri, 27 Apr 2012 14:23:54 +0200
+Subject: [PATCH 037/117] USB: cdc-wdm: sanitize error returns
+
+commit 24a85bae5da2b43fed423859c09c5a81ab359473 upstream.
+
+wdm_flush() returns unsanitized USB error codes.
+They must be cleaned up to before being anded to user space
+
+Signed-off-by: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/class/cdc-wdm.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 2db0327..ac9099a 100644
+--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
+@@ -500,7 +500,7 @@ static int wdm_flush(struct file *file, fl_owner_t id)
+ 		dev_err(&desc->intf->dev, "Error in flush path: %d\n",
+ 			desc->werr);
+ 
+-	return desc->werr;
+	return usb_translate_errors(desc->werr);
+ }
+ 
+ static unsigned int wdm_poll(struct file *file, struct poll_table_struct *wait)
+-- 
+1.7.9.5
+
@@ -0,0 +1,35 @@
+From bc51604d6cadd35fa7a9a4d70644471cb6ab81f8 Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oliver@neukum.org>
+Date: Fri, 27 Apr 2012 14:36:37 +0200
+Subject: [PATCH 038/117] USB: cdc-wdm: fix memory leak
+
+commit 2f338c8a1904e2e7aa5a8bd12fb0cf2422d17da4 upstream.
+
+cleanup() is not called if the last close() comes after
+disconnect(). That leads to a memory leak. Rectified
+by checking for an earlier disconnect() in release()
+
+Signed-off-by: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+[bwh: Backported to 3.2: adjust context]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/class/cdc-wdm.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index ac9099a..cfe5be4 100644
+--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
+@@ -590,6 +590,8 @@ static int wdm_release(struct inode *inode, struct file *file)
+ 		kill_urbs(desc);
+ 		if (!test_bit(WDM_DISCONNECTING, &desc->flags))
+ 			desc->intf->needs_remote_wakeup = 0;
+		else
+			cleanup(desc);
+ 	}
+ 	mutex_unlock(&wdm_mutex);
+ 	return 0;
+-- 
+1.7.9.5
+
@@ -0,0 +1,102 @@
+From e90d4ef7a5801bf1e9c956edf51d22f6c8f33611 Mon Sep 17 00:00:00 2001
+From: Arnaud Patard <apatard@hupstream.com>
+Date: Wed, 25 Apr 2012 12:17:24 +0200
+Subject: [PATCH 039/117] 8250_pci: fix pch uart matching
+
+commit aaa10eb1d0034eccc096f583fe308f0921617598 upstream.
+
+The rules used to make 8250_pci "ignore" the PCH uarts are lacking pci subids
+entries, preventing it to match and thus is breaking serial port support for
+theses systems.
+
+This has been tested on a nanoETXexpress-TT, which has a specifici uart clock.
+
+Tested-by: Erwan Velu <Erwan.Velu@zodiacaerospace.com>
+Signed-off-by: Arnaud Patard <apatard@hupstream.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+[bwh: Backported to 3.2: adjust filename]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/tty/serial/8250_pci.c |   18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/drivers/tty/serial/8250_pci.c b/drivers/tty/serial/8250_pci.c
+index 825937a..482d51e 100644
+--- a/drivers/tty/serial/8250_pci.c
+++ b/drivers/tty/serial/8250_pci.c
+@@ -1590,54 +1590,72 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = {
+ 	{
+ 		.vendor         = PCI_VENDOR_ID_INTEL,
+ 		.device         = 0x8811,
+		.subvendor	= PCI_ANY_ID,
+		.subdevice	= PCI_ANY_ID,
+ 		.init		= pci_eg20t_init,
+ 		.setup		= pci_default_setup,
+ 	},
+ 	{
+ 		.vendor         = PCI_VENDOR_ID_INTEL,
+ 		.device         = 0x8812,
+		.subvendor	= PCI_ANY_ID,
+		.subdevice	= PCI_ANY_ID,
+ 		.init		= pci_eg20t_init,
+ 		.setup		= pci_default_setup,
+ 	},
+ 	{
+ 		.vendor         = PCI_VENDOR_ID_INTEL,
+ 		.device         = 0x8813,
+		.subvendor	= PCI_ANY_ID,
+		.subdevice	= PCI_ANY_ID,
+ 		.init		= pci_eg20t_init,
+ 		.setup		= pci_default_setup,
+ 	},
+ 	{
+ 		.vendor         = PCI_VENDOR_ID_INTEL,
+ 		.device         = 0x8814,
+		.subvendor	= PCI_ANY_ID,
+		.subdevice	= PCI_ANY_ID,
+ 		.init		= pci_eg20t_init,
+ 		.setup		= pci_default_setup,
+ 	},
+ 	{
+ 		.vendor         = 0x10DB,
+ 		.device         = 0x8027,
+		.subvendor	= PCI_ANY_ID,
+		.subdevice	= PCI_ANY_ID,
+ 		.init		= pci_eg20t_init,
+ 		.setup		= pci_default_setup,
+ 	},
+ 	{
+ 		.vendor         = 0x10DB,
+ 		.device         = 0x8028,
+		.subvendor	= PCI_ANY_ID,
+		.subdevice	= PCI_ANY_ID,
+ 		.init		= pci_eg20t_init,
+ 		.setup		= pci_default_setup,
+ 	},
+ 	{
+ 		.vendor         = 0x10DB,
+ 		.device         = 0x8029,
+		.subvendor	= PCI_ANY_ID,
+		.subdevice	= PCI_ANY_ID,
+ 		.init		= pci_eg20t_init,
+ 		.setup		= pci_default_setup,
+ 	},
+ 	{
+ 		.vendor         = 0x10DB,
+ 		.device         = 0x800C,
+		.subvendor	= PCI_ANY_ID,
+		.subdevice	= PCI_ANY_ID,
+ 		.init		= pci_eg20t_init,
+ 		.setup		= pci_default_setup,
+ 	},
+ 	{
+ 		.vendor         = 0x10DB,
+ 		.device         = 0x800D,
+		.subvendor	= PCI_ANY_ID,
+		.subdevice	= PCI_ANY_ID,
+ 		.init		= pci_eg20t_init,
+ 		.setup		= pci_default_setup,
+ 	},
+-- 
+1.7.9.5
+
@@ -0,0 +1,36 @@
+From aa66cb26f7b032f3ae43ff3cb126b3a3cff9b151 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Steffen=20M=C3=BCller?= <steffen.mueller@radio-frei.de>
+Date: Mon, 30 Apr 2012 13:05:34 +0200
+Subject: [PATCH 040/117] usb: add USB_QUIRK_RESET_RESUME for M-Audio 88es
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 166cb70e97bd83d7ae9bbec6ae59a178fd9bb823 upstream.
+
+Tested-by: Steffen Müller <steffen.mueller@radio-frei.de>
+Signed-off-by: Steffen Müller <steffen.mueller@radio-frei.de>
+Signed-off-by: Stefan Seyfried <seife+kernel@b1-systems.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/core/quirks.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 4c65eb6..32d3adc 100644
+--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
+@@ -123,6 +123,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	/* Guillemot Webcam Hercules Dualpix Exchange*/
+ 	{ USB_DEVICE(0x06f8, 0x3005), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
+	/* Midiman M-Audio Keystation 88es */
+	{ USB_DEVICE(0x0763, 0x0192), .driver_info = USB_QUIRK_RESET_RESUME },
+
+ 	/* M-Systems Flash Disk Pioneers */
+ 	{ USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
+-- 
+1.7.9.5
+
@@ -0,0 +1,60 @@
+From bb6dfbca863a06884b7af33a6c46fddb690eb7d3 Mon Sep 17 00:00:00 2001
+From: Paul Zimmerman <Paul.Zimmerman@synopsys.com>
+Date: Mon, 16 Apr 2012 14:19:07 -0700
+Subject: [PATCH 041/117] usb: usbtest: two super speed fixes for usbtest
+
+commit 6a23ccd216b6a8ba2c67a9f9d8969b4431ad2920 upstream.
+
+bMaxPacketSize0 field for super speed is a power of 2, not a count.
+The size itself is always 512.
+
+Max packet size for a super speed bulk endpoint is 1024, so
+allocate the urb size in halt_simple() accordingly.
+
+Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
+Acked-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/misc/usbtest.c |   17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
+index bd6d008..b9ac9a3 100644
+--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
+@@ -1025,7 +1025,10 @@ test_ctrl_queue(struct usbtest_dev *dev, struct usbtest_param *param)
+ 		case 13:	/* short read, resembling case 10 */
+ 			req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
+ 			/* last data packet "should" be DATA1, not DATA0 */
+-			len = 1024 - udev->descriptor.bMaxPacketSize0;
+			if (udev->speed == USB_SPEED_SUPER)
+				len = 1024 - 512;
+			else
+				len = 1024 - udev->descriptor.bMaxPacketSize0;
+ 			expected = -EREMOTEIO;
+ 			break;
+ 		case 14:	/* short read; try to fill the last packet */
+@@ -1384,11 +1387,15 @@ static int test_halt(struct usbtest_dev *tdev, int ep, struct urb *urb)
+ 
+ static int halt_simple(struct usbtest_dev *dev)
+ {
+-	int		ep;
+-	int		retval = 0;
+-	struct urb	*urb;
+	int			ep;
+	int			retval = 0;
+	struct urb		*urb;
+	struct usb_device	*udev = testdev_to_usbdev(dev);
+ 
+-	urb = simple_alloc_urb(testdev_to_usbdev(dev), 0, 512);
+	if (udev->speed == USB_SPEED_SUPER)
+		urb = simple_alloc_urb(udev, 0, 1024);
+	else
+		urb = simple_alloc_urb(udev, 0, 512);
+ 	if (urb == NULL)
+ 		return -ENOMEM;
+ 
+-- 
+1.7.9.5
+
@@ -0,0 +1,51 @@
+From 52c1820cb4b5f10c0664104bb6f570305d0c49cc Mon Sep 17 00:00:00 2001
+From: Christian Melki <christian.melki@ericsson.se>
+Date: Mon, 30 Apr 2012 11:21:26 +0200
+Subject: [PATCH 042/117] 8250.c: less than 2400 baud fix.
+
+commit f9a9111b540fd67db5dab332f4b83d86c90e27b1 upstream.
+
+We noticed that we were loosing data at speed less than 2400 baud.
+It turned out our (TI16750 compatible) uart with 64 byte outgoing fifo
+was truncated to 16 byte (bit 5 sets fifo len) when modifying the fcr
+reg.
+The input code still fills the buffer with 64 bytes if I remember
+correctly and thus data is lost.
+Our fix was to remove whiping of the fcr content and just add the
+TRIGGER_1 which we want for latency.
+I can't see why this would not work on less than 2400 always, for all
+uarts ...
+Otherwise one would have to make sure the filling of the fifo re-checks
+the current state of available fifo size (urrk).
+
+Signed-off-by: Christian Melki <christian.melki@ericsson.se>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+[bwh: Backported to 3.2: adjust filename; replace *port with up->port]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/tty/serial/8250.c |    9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/tty/serial/8250.c b/drivers/tty/serial/8250.c
+index eeadf1b..70585b6 100644
+--- a/drivers/tty/serial/8250.c
+++ b/drivers/tty/serial/8250.c
+@@ -2327,10 +2327,11 @@ serial8250_do_set_termios(struct uart_port *port, struct ktermios *termios,
+ 		quot++;
+ 
+ 	if (up->capabilities & UART_CAP_FIFO && up->port.fifosize > 1) {
+-		if (baud < 2400)
+-			fcr = UART_FCR_ENABLE_FIFO | UART_FCR_TRIGGER_1;
+-		else
+-			fcr = uart_config[up->port.type].fcr;
+		fcr = uart_config[up->port.type].fcr;
+		if (baud < 2400) {
+			fcr &= ~UART_FCR_TRIGGER_MASK;
+			fcr |= UART_FCR_TRIGGER_1;
+		}
+ 	}
+ 
+ 	/*
+-- 
+1.7.9.5
+
@@ -0,0 +1,49 @@
+From 5ccddedea273a8a59eda8f3a7ad026d0751ada3d Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 23 Apr 2012 15:06:09 +0200
+Subject: [PATCH 043/117] usb-xhci: Handle COMP_TX_ERR for isoc tds
+
+commit 9c745995ae5c4ff787f34a359de908facc11ee00 upstream.
+
+While testing unplugging an UVC HD webcam with usb-redirection (so through
+usbdevfs), my userspace usb-redir code was getting a value of -1 in
+iso_frame_desc[n].status, which according to Documentation/usb/error-codes.txt
+is not a valid value.
+
+The source of this -1 is the default case in xhci-ring.c:process_isoc_td()
+adding a kprintf there showed the value of trb_comp_code to be COMP_TX_ERR
+in this case, so this patch adds handling for that completion code to
+process_isoc_td().
+
+This was observed and tested with the following xhci controller:
+1033:0194 NEC Corporation uPD720200 USB 3.0 Host Controller (rev 04)
+
+Note: I also wonder if setting frame->status to -1 (-EPERM) is the best we can
+do, but since I cannot come up with anything better I've left that as is.
+
+This patch should be backported to kernels as old as 2.6.36, which contain the
+commit 04e51901dd44f40a5a385ced897f6bca87d5f40a "USB: xHCI: Isochronous
+transfer implementation".
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/host/xhci-ring.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 43b3447..2304c45 100644
+--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
+@@ -1752,6 +1752,7 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ 		break;
+ 	case COMP_DEV_ERR:
+ 	case COMP_STALL:
+	case COMP_TX_ERR:
+ 		frame->status = -EPROTO;
+ 		skip_td = true;
+ 		break;
+-- 
+1.7.9.5
+
@@ -0,0 +1,63 @@
+From 48a73f4c8ba6d9e5587a29aa4f9710f405a28cc7 Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Mon, 16 Apr 2012 10:56:47 -0700
+Subject: [PATCH 044/117] xhci: Avoid dead ports when CONFIG_USB_XHCI_HCD=n
+
+commit 51c9e6c7732b67769c0a514d31f505e49fa82dd4 upstream.
+
+If the user chooses to say "no" to CONFIG_USB_XHCI_HCD on a system
+with an Intel Panther Point chipset, the PCI quirks code or the EHCI
+driver will switch the ports over to the xHCI host, but the xHCI driver
+will never load.  The ports will be powered off and seem "dead" to the
+user.
+
+Fix this by only switching the ports over if CONFIG_USB_XHCI_HCD is
+either compiled in, or compiled as a module.
+
+This patch should be backported to stable kernels as old as 3.0,
+that contain commit 69e848c2090aebba5698a1620604c7dccb448684
+"Intel xhci: Support EHCI/xHCI port switching."
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Reported-by: Eric Anholt <eric.anholt@intel.com>
+Reported-by: David Bein <d.bein@f5.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/host/pci-quirks.c |   14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
+index 2afff88..a33362b 100644
+--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
+@@ -9,6 +9,7 @@
+  */
+ 
+ #include <linux/types.h>
+#include <linux/kconfig.h>
+ #include <linux/kernel.h>
+ #include <linux/pci.h>
+ #include <linux/init.h>
+@@ -742,6 +743,19 @@ void usb_enable_xhci_ports(struct pci_dev *xhci_pdev)
+ {
+ 	u32		ports_available;
+ 
+	/* Don't switchover the ports if the user hasn't compiled the xHCI
+	 * driver.  Otherwise they will see "dead" USB ports that don't power
+	 * the devices.
+	 */
+	if (!IS_ENABLED(CONFIG_USB_XHCI_HCD)) {
+		dev_warn(&xhci_pdev->dev,
+				"CONFIG_USB_XHCI_HCD is turned off, "
+				"defaulting to EHCI.\n");
+		dev_warn(&xhci_pdev->dev,
+				"USB 3.0 devices will work at USB 2.0 speeds.\n");
+		return;
+	}
+
+ 	ports_available = 0xffffffff;
+ 	/* Write USB3_PSSEN, the USB 3.0 Port SuperSpeed Enable
+ 	 * Register, to turn on SuperSpeed terminations for all
+-- 
+1.7.9.5
+
@@ -0,0 +1,81 @@
+From cc4326a34985d9ce41cd590e7cf7275a0fbaa9dd Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Thu, 9 Feb 2012 15:55:13 -0800
+Subject: [PATCH 045/117] xhci: Add Lynx Point to list of Intel switchable
+ hosts.
+
+commit 1c12443ab8eba71a658fae4572147e56d1f84f66 upstream.
+
+The upcoming Intel Lynx Point chipset includes an xHCI host controller
+that can have ports switched from the EHCI host controller, just like
+the Intel Panther Point xHCI host.  This time, ports from both EHCI
+hosts can be switched to the xHCI host controller.  The PCI config
+registers to do the port switching are in the exact same place in the
+xHCI PCI configuration registers, with the same semantics.
+
+Hooray for shipping patches for next-gen hardware before the current gen
+hardware is even available for purchase!
+
+This patch should be backported to stable kernels as old as 3.0,
+that contain commit 69e848c2090aebba5698a1620604c7dccb448684
+"Intel xhci: Support EHCI/xHCI port switching."
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/host/ehci-pci.c   |    4 +++-
+ drivers/usb/host/pci-quirks.c |   18 +++++++++++++++++-
+ 2 files changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
+index 971d312..ee85e81 100644
+--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
+@@ -365,7 +365,9 @@ static bool usb_is_intel_switchable_ehci(struct pci_dev *pdev)
+ {
+ 	return pdev->class == PCI_CLASS_SERIAL_USB_EHCI &&
+ 		pdev->vendor == PCI_VENDOR_ID_INTEL &&
+-		pdev->device == 0x1E26;
+		(pdev->device == 0x1E26 ||
+		 pdev->device == 0x8C2D ||
+		 pdev->device == 0x8C26);
+ }
+ 
+ static void ehci_enable_xhci_companion(void)
+diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
+index a33362b..833b3c6 100644
+--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
+@@ -713,12 +713,28 @@ static int handshake(void __iomem *ptr, u32 mask, u32 done,
+ 	return -ETIMEDOUT;
+ }
+ 
+-bool usb_is_intel_switchable_xhci(struct pci_dev *pdev)
+#define PCI_DEVICE_ID_INTEL_LYNX_POINT_XHCI	0x8C31
+
+bool usb_is_intel_ppt_switchable_xhci(struct pci_dev *pdev)
+ {
+ 	return pdev->class == PCI_CLASS_SERIAL_USB_XHCI &&
+ 		pdev->vendor == PCI_VENDOR_ID_INTEL &&
+ 		pdev->device == PCI_DEVICE_ID_INTEL_PANTHERPOINT_XHCI;
+ }
+
+/* The Intel Lynx Point chipset also has switchable ports. */
+bool usb_is_intel_lpt_switchable_xhci(struct pci_dev *pdev)
+{
+	return pdev->class == PCI_CLASS_SERIAL_USB_XHCI &&
+		pdev->vendor == PCI_VENDOR_ID_INTEL &&
+		pdev->device == PCI_DEVICE_ID_INTEL_LYNX_POINT_XHCI;
+}
+
+bool usb_is_intel_switchable_xhci(struct pci_dev *pdev)
+{
+	return usb_is_intel_ppt_switchable_xhci(pdev) ||
+		usb_is_intel_lpt_switchable_xhci(pdev);
+}
+ EXPORT_SYMBOL_GPL(usb_is_intel_switchable_xhci);
+ 
+ /*
+-- 
+1.7.9.5
+
@@ -0,0 +1,44 @@
+From 45bf78829065725fa73b4cacfaf2a2142056d301 Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@freescale.com>
+Date: Sun, 1 Apr 2012 15:17:16 +0800
+Subject: [PATCH 046/117] usb: gadget: fsl_udc_core: dTD's next dtd pointer
+ need to be updated once written
+
+commit 4d0947dec4db1224354e2f6f00ae22ce38e62a43 upstream.
+
+dTD's next dtd pointer need to be updated once CPU writes it, or this
+request may not be handled by controller, then host will get NAK from
+device forever.
+
+This problem occurs when there is a request is handling, we need to add
+a new request to dTD list, if this new request is added before the current
+one is finished, the new request is intended to added as next dtd pointer
+at current dTD, but without wmb(), the dTD's next dtd pointer may not be
+updated when the controller reads it. In that case, the controller will
+still get Terminate Bit is 1 at dTD's next dtd pointer, that means there is
+no next request, then this new request is missed by controller.
+
+Signed-off-by: Peter Chen <peter.chen@freescale.com>
+Acked-by: Li Yang <leoli@freescale.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/gadget/fsl_udc_core.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/gadget/fsl_udc_core.c b/drivers/usb/gadget/fsl_udc_core.c
+index 9085d14..185db03 100644
+--- a/drivers/usb/gadget/fsl_udc_core.c
+++ b/drivers/usb/gadget/fsl_udc_core.c
+@@ -736,6 +736,8 @@ static void fsl_queue_td(struct fsl_ep *ep, struct fsl_req *req)
+ 		lastreq = list_entry(ep->queue.prev, struct fsl_req, queue);
+ 		lastreq->tail->next_td_ptr =
+ 			cpu_to_hc32(req->head->td_dma & DTD_ADDR_MASK);
+		/* Ensure dTD's next dtd pointer to be updated */
+		wmb();
+ 		/* Read prime bit, if 1 goto done */
+ 		if (fsl_readl(&dr_regs->endpointprime) & bitmask)
+ 			return;
+-- 
+1.7.9.5
+
@@ -0,0 +1,36 @@
+From 17e2d3e18d2042fb6fb23605752754deb87772c5 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Lothar=20Wa=C3=9Fmann?= <LW@KARO-electronics.de>
+Date: Thu, 3 May 2012 11:37:12 +0200
+Subject: [PATCH 047/117] Add missing call to uart_update_timeout()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 8b979f7c6bf13a57e7b6002f1175312a44773960 upstream.
+
+This patch fixes a problem reported here:
+http://article.gmane.org/gmane.linux.ports.arm.kernel/155242/match=auart
+
+Signed-off-by: Lothar Waßmann <LW@KARO-electronics.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/tty/serial/mxs-auart.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
+index 7e02c9c..5b3d063 100644
+--- a/drivers/tty/serial/mxs-auart.c
+++ b/drivers/tty/serial/mxs-auart.c
+@@ -368,6 +368,8 @@ static void mxs_auart_settermios(struct uart_port *u,
+ 
+ 	writel(ctrl, u->membase + AUART_LINECTRL);
+ 	writel(ctrl2, u->membase + AUART_CTRL2);
+
+	uart_update_timeout(u, termios->c_cflag, baud);
+ }
+ 
+ static irqreturn_t mxs_auart_irq_handle(int irq, void *context)
+-- 
+1.7.9.5
+
@@ -0,0 +1,58 @@
+From 52bf48eda8302a253e63ac9ec069a1635932b237 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=89ric=20Piel?= <piel@delmic.com>
+Date: Mon, 7 May 2012 12:37:54 +0200
+Subject: [PATCH 048/117] USB: ftdi-sio: add support for Physik Instrumente
+ E-861
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit b69cc672052540e8efb1368420f10d7d4d8b8a3d upstream.
+
+This adds VID/PID for the PI E-861. Without it, I had to do:
+modprobe -q ftdi-sio product=0x1008 vendor=0x1a72
+
+http://www.physikinstrumente.com/en/products/prdetail.php?sortnr=900610
+
+Signed-off-by: Éric Piel <piel@delmic.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/serial/ftdi_sio.c     |    1 +
+ drivers/usb/serial/ftdi_sio_ids.h |    8 ++++++++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index c4cf3f3..450bdfe 100644
+--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
+@@ -809,6 +809,7 @@ static struct usb_device_id id_table_combined [] = {
+ 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ 	{ USB_DEVICE(LARSENBRUSGAARD_VID, LB_ALTITRACK_PID) },
+ 	{ USB_DEVICE(GN_OTOMETRICS_VID, AURICAL_USB_PID) },
+	{ USB_DEVICE(PI_VID, PI_E861_PID) },
+ 	{ USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
+ 	{ USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
+ 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index c6dd18e..219b199 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -785,6 +785,14 @@
+ #define RTSYSTEMS_SERIAL_VX7_PID	0x9e52	/* Serial converter for VX-7 Radios using FT232RL */
+ #define RTSYSTEMS_CT29B_PID		0x9e54	/* CT29B Radio Cable */
+ 
+
+/*
+ * Physik Instrumente
+ * http://www.physikinstrumente.com/en/products/
+ */
+#define PI_VID              0x1a72  /* Vendor ID */
+#define PI_E861_PID         0x1008  /* E-861 piezo controller USB connection */
+
+ /*
+  * Bayer Ascensia Contour blood glucose meter USB-converter cable.
+  * http://winglucofacts.com/cables/
+-- 
+1.7.9.5
+
@@ -0,0 +1,36 @@
+From 7041c376790f592d9ed3c6b88a44a6cf18b8423c Mon Sep 17 00:00:00 2001
+From: Matthias Fend <Matthias.Fend@wolfvision.net>
+Date: Mon, 7 May 2012 14:37:30 +0200
+Subject: [PATCH 049/117] USB: ffs-test: fix length argument of out function
+ call
+
+commit eb9c5836384cd2a276254df6254ed71117983626 upstream.
+
+The out functions should only handle actual available data instead of the complete buffer.
+Otherwise for example the ep0_consume function will report ghost events since it tries to decode
+the complete buffer - which may contain partly invalid data.
+
+Signed-off-by: Matthias Fend <matthias.fend@wolfvision.net>
+Acked-by: Michal Nazarewicz <mina86@mina86.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ tools/usb/ffs-test.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/usb/ffs-test.c b/tools/usb/ffs-test.c
+index b9c7986..f17dfee 100644
+--- a/tools/usb/ffs-test.c
+++ b/tools/usb/ffs-test.c
+@@ -324,7 +324,7 @@ static void *start_thread_helper(void *arg)
+ 
+ 		ret = t->in(t, t->buf, t->buf_size);
+ 		if (ret > 0) {
+-			ret = t->out(t, t->buf, t->buf_size);
+			ret = t->out(t, t->buf, ret);
+ 			name = out_name;
+ 			op = "write";
+ 		} else {
+-- 
+1.7.9.5
+
@@ -0,0 +1,60 @@
+From 0842fcae9a509f08c6d540dfa4d3f097c4f3f92d Mon Sep 17 00:00:00 2001
+From: David Herrmann <dh.herrmann@googlemail.com>
+Date: Tue, 8 May 2012 16:52:31 +0200
+Subject: [PATCH 050/117] HID: wiimote: Fix IR data parser
+
+commit 74b89e8a3625c17c7452532dfb997ac4f1a38751 upstream.
+
+We incorrectly parse incoming IR data. The extra byte contains the upper
+bits and not the lower bits of the x/y coordinates. User-space expects
+absolute position data from us so this patch does not break existing
+applications. On the contrary, it extends the virtual view and fixes
+garbage reports for margin areas of the virtual screen.
+
+Reported-by: Peter Bukovsky <bukovsky.peter@gmail.com>
+Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+[bwh: Backported to 3.2: adjust filename]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/hid/hid-wiimote.c |   16 +++++-----------
+ 1 file changed, 5 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/hid/hid-wiimote.c b/drivers/hid/hid-wiimote.c
+index 76739c0..bfa9a27 100644
+--- a/drivers/hid/hid-wiimote.c
+++ b/drivers/hid/hid-wiimote.c
+@@ -829,7 +829,7 @@ static void __ir_to_input(struct wiimote_data *wdata, const __u8 *ir,
+ 
+ 	/*
+ 	 * Basic IR data is encoded into 3 bytes. The first two bytes are the
+-	 * upper 8 bit of the X/Y data, the 3rd byte contains the lower 2 bits
+	 * lower 8 bit of the X/Y data, the 3rd byte contains the upper 2 bits
+ 	 * of both.
+ 	 * If data is packed, then the 3rd byte is put first and slightly
+ 	 * reordered. This allows to interleave packed and non-packed data to
+@@ -838,17 +838,11 @@ static void __ir_to_input(struct wiimote_data *wdata, const __u8 *ir,
+ 	 */
+ 
+ 	if (packed) {
+-		x = ir[1] << 2;
+-		y = ir[2] << 2;
+-
+-		x |= ir[0] & 0x3;
+-		y |= (ir[0] >> 2) & 0x3;
+		x = ir[1] | ((ir[0] & 0x03) << 8);
+		y = ir[2] | ((ir[0] & 0x0c) << 6);
+ 	} else {
+-		x = ir[0] << 2;
+-		y = ir[1] << 2;
+-
+-		x |= (ir[2] >> 4) & 0x3;
+-		y |= (ir[2] >> 6) & 0x3;
+		x = ir[0] | ((ir[2] & 0x30) << 4);
+		y = ir[1] | ((ir[2] & 0xc0) << 2);
+ 	}
+ 
+ 	input_report_abs(wdata->ir, xid, x);
+-- 
+1.7.9.5
+
@@ -0,0 +1,41 @@
+From a595c200511d66729bc55aadbb93adb96988c590 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 8 May 2012 15:15:25 -0400
+Subject: [PATCH 051/117] usb-storage: unusual_devs entry for Yarvik PMP400
+ MP4 player
+
+commit df767b71e5816692134d59c0c17e0f77cd73333d upstream.
+
+This patch (as1553) adds an unusual_dev entrie for the Yarvik PMP400
+MP4 music player.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Jesse Feddema <jdfeddema@gmail.com>
+Tested-by: Jesse Feddema <jdfeddema@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/storage/unusual_devs.h |    7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 24caba7..591f57f 100644
+--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
+@@ -1885,6 +1885,13 @@ UNUSUAL_DEV(  0x1652, 0x6600, 0x0201, 0x0201,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_IGNORE_RESIDUE ),
+ 
+/* Reported by Jesse Feddema <jdfeddema@gmail.com> */
+UNUSUAL_DEV(  0x177f, 0x0400, 0x0000, 0x0000,
+		"Yarvik",
+		"PMP400",
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+		US_FL_BULK_IGNORE_TAG | US_FL_MAX_SECTORS_64 ),
+
+ /* Reported by Hans de Goede <hdegoede@redhat.com>
+  * These Appotech controllers are found in Picture Frames, they provide a
+  * (buggy) emulation of a cdrom drive which contains the windows software
+-- 
+1.7.9.5
+
@@ -0,0 +1,63 @@
+From ac7728e7d633262cd020d764404abf381f282d12 Mon Sep 17 00:00:00 2001
+From: Nicolas Ferre <nicolas.ferre@atmel.com>
+Date: Wed, 9 May 2012 10:48:54 +0200
+Subject: [PATCH 052/117] USB: ohci-at91: add a reset function to fix race
+ condition
+
+commit 07e4e556eff4938eb2edf2591de3aa7d7fb82b52 upstream.
+
+A possible race condition appears because we are not initializing
+the ohci->regs before calling usb_hcd_request_irqs().
+We move the call to ohci_init() in hcd->driver->reset() instead of
+hcd->driver->start() to fix this.
+This was experienced when we share the same IRQ line between OHCI and EHCI
+controllers.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Tested-by: Christian Eggers <christian.eggers@kathrein.de>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/host/ohci-at91.c |   11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
+index 95a9fec..a60c7aa 100644
+--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
+@@ -199,7 +199,7 @@ static void usb_hcd_at91_remove(struct usb_hcd *hcd,
+ /*-------------------------------------------------------------------------*/
+ 
+ static int __devinit
+-ohci_at91_start (struct usb_hcd *hcd)
+ohci_at91_reset (struct usb_hcd *hcd)
+ {
+ 	struct at91_usbh_data	*board = hcd->self.controller->platform_data;
+ 	struct ohci_hcd		*ohci = hcd_to_ohci (hcd);
+@@ -209,6 +209,14 @@ ohci_at91_start (struct usb_hcd *hcd)
+ 		return ret;
+ 
+ 	ohci->num_ports = board->ports;
+	return 0;
+}
+
+static int __devinit
+ohci_at91_start (struct usb_hcd *hcd)
+{
+	struct ohci_hcd		*ohci = hcd_to_ohci (hcd);
+	int			ret;
+ 
+ 	if ((ret = ohci_run(ohci)) < 0) {
+ 		err("can't start %s", hcd->self.bus_name);
+@@ -390,6 +398,7 @@ static const struct hc_driver ohci_at91_hc_driver = {
+ 	/*
+ 	 * basic lifecycle operations
+ 	 */
+	.reset =		ohci_at91_reset,
+ 	.start =		ohci_at91_start,
+ 	.stop =			ohci_stop,
+ 	.shutdown =		ohci_shutdown,
+-- 
+1.7.9.5
+
@@ -0,0 +1,70 @@
+From 4061b435a02342ee10ee34fb69f2c75d53e8da70 Mon Sep 17 00:00:00 2001
+From: Jonathan Nieder <jrnieder@gmail.com>
+Date: Fri, 11 May 2012 16:17:16 +0200
+Subject: [PATCH 053/117] HID: logitech: read all 32 bits of report type
+ bitfield
+
+commit 44d27f7dfedd9aadc082cda31462f6600f56e4ec upstream.
+
+On big-endian systems (e.g., Apple PowerBook), trying to use a
+logitech wireless mouse with the Logitech Unifying Receiver does not
+work with v3.2 and later kernels.  The device doesn't show up in
+/dev/input.  Older kernels work fine.
+
+That is because the new hid-logitech-dj driver claims the device.  The
+device arrival notification appears:
+
+	20 00 41 02 00 00 00 00 00 00 00 00 00 00 00
+
+and we read the report_types bitfield (02 00 00 00) to find out what
+kind of device it is.  Unfortunately the driver only reads the first 8
+bits and treats that value as a 32-bit little-endian number, so on a
+powerpc the report type seems to be 0x02000000 and is not recognized.
+
+Even on little-endian machines, connecting a media center remote
+control (report type 00 01 00 00) with this driver loaded would
+presumably fail for the same reason.
+
+Fix both problems by using get_unaligned_le32() to read all four
+bytes, which is a little clearer anyway.  After this change, the
+wireless mouse works on Hugo's PowerBook again.
+
+Based on a patch by Nestor Lopez Casado.
+Addresses http://bugs.debian.org/671292
+
+Reported-by: Hugo Osvaldo Barrera <hugo@osvaldobarrera.com.ar>
+Inspired-by: Nestor Lopez Casado <nlopezcasad@logitech.com>
+Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
+Signed-off-by: Nestor Lopez Casado <nlopezcasad@logitech.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/hid/hid-logitech-dj.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
+index 38b12e4..2eac8c5 100644
+--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
+@@ -26,6 +26,7 @@
+ #include <linux/hid.h>
+ #include <linux/module.h>
+ #include <linux/usb.h>
+#include <asm/unaligned.h>
+ #include "usbhid/usbhid.h"
+ #include "hid-ids.h"
+ #include "hid-logitech-dj.h"
+@@ -265,8 +266,8 @@ static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
+ 		goto dj_device_allocate_fail;
+ 	}
+ 
+-	dj_dev->reports_supported = le32_to_cpu(
+-		dj_report->report_params[DEVICE_PAIRED_RF_REPORT_TYPE]);
+	dj_dev->reports_supported = get_unaligned_le32(
+		dj_report->report_params + DEVICE_PAIRED_RF_REPORT_TYPE);
+ 	dj_dev->hdev = dj_hiddev;
+ 	dj_dev->dj_receiver_dev = djrcv_dev;
+ 	dj_dev->device_index = dj_report->device_index;
+-- 
+1.7.9.5
+
@@ -0,0 +1,77 @@
+From 38827d01920cd8adbdbdb89d79b749f6cb50b8f0 Mon Sep 17 00:00:00 2001
+From: Darren Hart <dvhart@linux.intel.com>
+Date: Fri, 11 May 2012 13:56:57 -0700
+Subject: [PATCH 054/117] USB: serial: ti_usb_3410_5052: Add support for the
+ FRI2 serial console
+
+commit 975dc33b82cb887d75a29b1e3835c8eb063a8e99 upstream.
+
+The Kontron M2M development board, also known as the Fish River Island II,
+has an optional daughter card providing access to the PCH_UART (EG20T) via
+a ti_usb_3410_5052 uart to usb chip.
+
+http://us.kontron.com/products/systems+and+platforms/m2m/m2m+smart+services+developer+kit.html
+
+Signed-off-by: Darren Hart <dvhart@linux.intel.com>
+CC: Al Borchers <alborchers@steinerpoint.com>
+CC: Peter Berger <pberger@brimson.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/serial/ti_usb_3410_5052.c |    6 ++++--
+ drivers/usb/serial/ti_usb_3410_5052.h |    1 +
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
+index 21c82b0..2856474 100644
+--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
+@@ -165,7 +165,7 @@ static unsigned int product_5052_count;
+ /* the array dimension is the number of default entries plus */
+ /* TI_EXTRA_VID_PID_COUNT user defined entries plus 1 terminating */
+ /* null entry */
+-static struct usb_device_id ti_id_table_3410[14+TI_EXTRA_VID_PID_COUNT+1] = {
+static struct usb_device_id ti_id_table_3410[15+TI_EXTRA_VID_PID_COUNT+1] = {
+ 	{ USB_DEVICE(TI_VENDOR_ID, TI_3410_PRODUCT_ID) },
+ 	{ USB_DEVICE(TI_VENDOR_ID, TI_3410_EZ430_ID) },
+ 	{ USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_NO_FW_PRODUCT_ID) },
+@@ -180,6 +180,7 @@ static struct usb_device_id ti_id_table_3410[14+TI_EXTRA_VID_PID_COUNT+1] = {
+ 	{ USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
+ 	{ USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
+ 	{ USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) },
+	{ USB_DEVICE(TI_VENDOR_ID, FRI2_PRODUCT_ID) },
+ };
+ 
+ static struct usb_device_id ti_id_table_5052[5+TI_EXTRA_VID_PID_COUNT+1] = {
+@@ -189,7 +190,7 @@ static struct usb_device_id ti_id_table_5052[5+TI_EXTRA_VID_PID_COUNT+1] = {
+ 	{ USB_DEVICE(TI_VENDOR_ID, TI_5052_FIRMWARE_PRODUCT_ID) },
+ };
+ 
+-static struct usb_device_id ti_id_table_combined[18+2*TI_EXTRA_VID_PID_COUNT+1] = {
+static struct usb_device_id ti_id_table_combined[19+2*TI_EXTRA_VID_PID_COUNT+1] = {
+ 	{ USB_DEVICE(TI_VENDOR_ID, TI_3410_PRODUCT_ID) },
+ 	{ USB_DEVICE(TI_VENDOR_ID, TI_3410_EZ430_ID) },
+ 	{ USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_NO_FW_PRODUCT_ID) },
+@@ -208,6 +209,7 @@ static struct usb_device_id ti_id_table_combined[18+2*TI_EXTRA_VID_PID_COUNT+1]
+ 	{ USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
+ 	{ USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
+ 	{ USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) },
+	{ USB_DEVICE(TI_VENDOR_ID, FRI2_PRODUCT_ID) },
+ 	{ }
+ };
+ 
+diff --git a/drivers/usb/serial/ti_usb_3410_5052.h b/drivers/usb/serial/ti_usb_3410_5052.h
+index f140f1b..b353e7e 100644
+--- a/drivers/usb/serial/ti_usb_3410_5052.h
+++ b/drivers/usb/serial/ti_usb_3410_5052.h
+@@ -37,6 +37,7 @@
+ #define TI_5152_BOOT_PRODUCT_ID		0x5152	/* no EEPROM, no firmware */
+ #define TI_5052_EEPROM_PRODUCT_ID	0x505A	/* EEPROM, no firmware */
+ #define TI_5052_FIRMWARE_PRODUCT_ID	0x505F	/* firmware is running */
+#define FRI2_PRODUCT_ID			0x5053  /* Fish River Island II */
+ 
+ /* Multi-Tech vendor and product ids */
+ #define MTS_VENDOR_ID			0x06E0
+-- 
+1.7.9.5
+
@@ -0,0 +1,38 @@
+From 420e76b95a867f5105ee9b3d824c47f62601c19b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Wed, 9 May 2012 13:53:21 +0200
+Subject: [PATCH 055/117] USB: cdc-wdm: poll must return POLLHUP if device is
+ gone
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 616b6937e348ef2b4c6ea5fef2cd3c441145efb0 upstream.
+
+Else the poll will be restarted indefinitely in a tight loop,
+preventing final device cleanup.
+
+Cc: Oliver Neukum <oliver@neukum.org>
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/class/cdc-wdm.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index cfe5be4..38d8c33 100644
+--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
+@@ -511,7 +511,7 @@ static unsigned int wdm_poll(struct file *file, struct poll_table_struct *wait)
+ 
+ 	spin_lock_irqsave(&desc->iuspin, flags);
+ 	if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
+-		mask = POLLERR;
+		mask = POLLHUP | POLLERR;
+ 		spin_unlock_irqrestore(&desc->iuspin, flags);
+ 		goto desc_out;
+ 	}
+-- 
+1.7.9.5
+
@@ -0,0 +1,54 @@
+From ec4941d4623bada1da050a962485961da8c928d6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Mon, 30 Apr 2012 09:26:11 +0200
+Subject: [PATCH 056/117] USB: cdc-wdm: add debug messages on cleanup
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 880bca3a2a6f159d7453e0cbcbfe2f1d8204d907 upstream.
+
+Device state cleanup is done in either wdm_disconnect or
+wdm_release depending on the order they are called. Adding
+a couple of debug messages to document the program flow.
+
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Acked-by: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+[bwh: Backported to 3.2: adjust context]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/class/cdc-wdm.c |    8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 38d8c33..40a3f0b 100644
+--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
+@@ -588,10 +588,12 @@ static int wdm_release(struct inode *inode, struct file *file)
+ 	if (!desc->count) {
+ 		dev_dbg(&desc->intf->dev, "wdm_release: cleanup");
+ 		kill_urbs(desc);
+-		if (!test_bit(WDM_DISCONNECTING, &desc->flags))
+		if (!test_bit(WDM_DISCONNECTING, &desc->flags)) {
+ 			desc->intf->needs_remote_wakeup = 0;
+-		else
+		} else {
+			dev_dbg(&desc->intf->dev, "%s: device gone - cleaning up\n", __func__);
+ 			cleanup(desc);
+		}
+ 	}
+ 	mutex_unlock(&wdm_mutex);
+ 	return 0;
+@@ -807,6 +809,8 @@ static void wdm_disconnect(struct usb_interface *intf)
+ 	mutex_unlock(&desc->rlock);
+ 	if (!desc->count)
+ 		cleanup(desc);
+	else
+		dev_dbg(&intf->dev, "%s: %d open files - postponing cleanup\n", __func__, desc->count);
+ 	mutex_unlock(&wdm_mutex);
+ }
+ 
+-- 
+1.7.9.5
+
@@ -0,0 +1,66 @@
+From beaa75548738c322895c5b3ca7c010397cfb0afb Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Wed, 9 May 2012 13:53:22 +0200
+Subject: [PATCH 057/117] USB: cdc-wdm: cannot use dev_printk when device is
+ gone
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 6b0b79d38806481c1c8fffa7c5842f3c83679a42 upstream.
+
+We cannot dereference a removed USB interface for
+dev_printk. Use pr_debug instead where necessary.
+
+Flush errors are expected if device is unplugged and are
+therefore best ingored at this point.
+
+Move the kill_urbs() call in wdm_release with dev_dbg()
+for the non disconnect, as we know it has already been
+called if WDM_DISCONNECTING is set.  This does not
+actually fix anything, but keeps the code more consistent.
+
+Cc: Oliver Neukum <oliver@neukum.org>
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+[bwh: Backported to 3.2: adjust context]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/class/cdc-wdm.c |   11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 40a3f0b..554ac90 100644
+--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
+@@ -496,7 +496,9 @@ static int wdm_flush(struct file *file, fl_owner_t id)
+ 	struct wdm_device *desc = file->private_data;
+ 
+ 	wait_event(desc->wait, !test_bit(WDM_IN_USE, &desc->flags));
+-	if (desc->werr < 0)
+
+	/* cannot dereference desc->intf if WDM_DISCONNECTING */
+	if (desc->werr < 0 && !test_bit(WDM_DISCONNECTING, &desc->flags))
+ 		dev_err(&desc->intf->dev, "Error in flush path: %d\n",
+ 			desc->werr);
+ 
+@@ -586,12 +588,13 @@ static int wdm_release(struct inode *inode, struct file *file)
+ 	mutex_unlock(&desc->wlock);
+ 
+ 	if (!desc->count) {
+-		dev_dbg(&desc->intf->dev, "wdm_release: cleanup");
+-		kill_urbs(desc);
+ 		if (!test_bit(WDM_DISCONNECTING, &desc->flags)) {
+			dev_dbg(&desc->intf->dev, "wdm_release: cleanup");
+			kill_urbs(desc);
+ 			desc->intf->needs_remote_wakeup = 0;
+ 		} else {
+-			dev_dbg(&desc->intf->dev, "%s: device gone - cleaning up\n", __func__);
+			/* must avoid dev_printk here as desc->intf is invalid */
+			pr_debug(KBUILD_MODNAME " %s: device gone - cleaning up\n", __func__);
+ 			cleanup(desc);
+ 		}
+ 	}
+-- 
+1.7.9.5
+
@@ -0,0 +1,33 @@
+From d3f8f68e0ff8065d2769fc80ebab6cd4a99df65d Mon Sep 17 00:00:00 2001
+From: Alan Cox <alan@linux.intel.com>
+Date: Mon, 14 May 2012 14:51:22 +0100
+Subject: [PATCH 058/117] tty: Allow uart_register/unregister/register
+
+commit 1e66cded334e6cea596c72f6f650eec351b1e959 upstream.
+
+This is legitimate but because we don't clear the drv->state pointer in the
+unregister code causes a bogus BUG().
+
+Resolves-bug: https://bugzilla.kernel.org/show_bug.cgi?id=42880
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/tty/serial/serial_core.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index 0406d7f..af5ffb9 100644
+--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
+@@ -2305,6 +2305,7 @@ void uart_unregister_driver(struct uart_driver *drv)
+ 	tty_unregister_driver(p);
+ 	put_tty_driver(p);
+ 	kfree(drv->state);
+	drv->state = NULL;
+ 	drv->tty_driver = NULL;
+ }
+ 
+-- 
+1.7.9.5
+
@@ -0,0 +1,51 @@
+From ac2fd7de4ac5b536aace631588cdab6c27a3ef9d Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Mon, 14 May 2012 15:04:50 -0700
+Subject: [PATCH 059/117] workqueue: skip nr_running sanity check in
+ worker_enter_idle() if trustee is active
+
+commit 544ecf310f0e7f51fa057ac2a295fc1b3b35a9d3 upstream.
+
+worker_enter_idle() has WARN_ON_ONCE() which triggers if nr_running
+isn't zero when every worker is idle.  This can trigger spuriously
+while a cpu is going down due to the way trustee sets %WORKER_ROGUE
+and zaps nr_running.
+
+It first sets %WORKER_ROGUE on all workers without updating
+nr_running, releases gcwq->lock, schedules, regrabs gcwq->lock and
+then zaps nr_running.  If the last running worker enters idle
+inbetween, it would see stale nr_running which hasn't been zapped yet
+and trigger the WARN_ON_ONCE().
+
+Fix it by performing the sanity check iff the trustee is idle.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ kernel/workqueue.c |    9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index bb425b1..7947e16 100644
+--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
+@@ -1215,8 +1215,13 @@ static void worker_enter_idle(struct worker *worker)
+ 	} else
+ 		wake_up_all(&gcwq->trustee_wait);
+ 
+-	/* sanity check nr_running */
+-	WARN_ON_ONCE(gcwq->nr_workers == gcwq->nr_idle &&
+	/*
+	 * Sanity check nr_running.  Because trustee releases gcwq->lock
+	 * between setting %WORKER_ROGUE and zapping nr_running, the
+	 * warning may trigger spuriously.  Check iff trustee is idle.
+	 */
+	WARN_ON_ONCE(gcwq->trustee_state == TRUSTEE_DONE &&
+		     gcwq->nr_workers == gcwq->nr_idle &&
+ 		     atomic_read(get_gcwq_nr_running(gcwq->cpu)));
+ }
+ 
+-- 
+1.7.9.5
+
@@ -0,0 +1,129 @@
+From 24338a0903923d202e90e35100abe050436bf00a Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Tue, 8 May 2012 09:22:49 -0700
+Subject: [PATCH 060/117] xhci: Add new short TX quirk for Fresco Logic host.
+
+commit 1530bbc6272d9da1e39ef8e06190d42c13a02733 upstream.
+
+Sergio reported that when he recorded audio from a USB headset mic
+plugged into the USB 3.0 port on his ASUS N53SV-DH72, the audio sounded
+"robotic".  When plugged into the USB 2.0 port under EHCI on the same
+laptop, the audio sounded fine.  The device is:
+
+Bus 002 Device 004: ID 046d:0a0c Logitech, Inc. Clear Chat Comfort USB Headset
+
+The problem was tracked down to the Fresco Logic xHCI host controller
+not correctly reporting short transfers on isochronous IN endpoints.
+The driver would submit a 96 byte transfer, the device would only send
+88 or 90 bytes, and the xHCI host would report the transfer had a
+"successful" completion code, with an untransferred buffer length of 8
+or 6 bytes.
+
+The successful completion code and non-zero untransferred length is a
+contradiction.  The xHCI host is supposed to only mark a transfer as
+successful if all the bytes are transferred.  Otherwise, the transfer
+should be marked with a short packet completion code.  Without the EHCI
+bus trace, we wouldn't know whether the xHCI driver should trust the
+completion code or the untransferred length.  With it, we know to trust
+the untransferred length.
+
+Add a new xHCI quirk for the Fresco Logic host controller.  If a
+transfer is reported as successful, but the untransferred length is
+non-zero, print a warning.  For the Fresco Logic host, change the
+completion code to COMP_SHORT_TX and process the transfer like a short
+transfer.
+
+This should be backported to stable kernels that contain the commit
+f5182b4155b9d686c5540a6822486400e34ddd98 "xhci: Disable MSI for some
+Fresco Logic hosts."  That commit was marked for stable kernels as old
+as 2.6.36.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Reported-by: Sergio Correia <lists@uece.net>
+Tested-by: Sergio Correia <lists@uece.net>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/host/xhci-pci.c  |    1 +
+ drivers/usb/host/xhci-ring.c |   20 +++++++++++++++++---
+ drivers/usb/host/xhci.h      |    1 +
+ 3 files changed, 19 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 211296a..daf5754 100644
+--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
+@@ -72,6 +72,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ 		xhci_dbg(xhci, "QUIRK: Fresco Logic revision %u "
+ 				"has broken MSI implementation\n",
+ 				pdev->revision);
+		xhci->quirks |= XHCI_TRUST_TX_LENGTH;
+ 	}
+ 
+ 	if (pdev->vendor == PCI_VENDOR_ID_NEC)
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 2304c45..fb0981e 100644
+--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
+@@ -1735,8 +1735,12 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ 	/* handle completion code */
+ 	switch (trb_comp_code) {
+ 	case COMP_SUCCESS:
+-		frame->status = 0;
+-		break;
+		if (TRB_LEN(le32_to_cpu(event->transfer_len)) == 0) {
+			frame->status = 0;
+			break;
+		}
+		if ((xhci->quirks & XHCI_TRUST_TX_LENGTH))
+			trb_comp_code = COMP_SHORT_TX;
+ 	case COMP_SHORT_TX:
+ 		frame->status = td->urb->transfer_flags & URB_SHORT_NOT_OK ?
+ 				-EREMOTEIO : 0;
+@@ -1833,13 +1837,16 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ 	switch (trb_comp_code) {
+ 	case COMP_SUCCESS:
+ 		/* Double check that the HW transferred everything. */
+-		if (event_trb != td->last_trb) {
+		if (event_trb != td->last_trb ||
+				TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
+ 			xhci_warn(xhci, "WARN Successful completion "
+ 					"on short TX\n");
+ 			if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
+ 				*status = -EREMOTEIO;
+ 			else
+ 				*status = 0;
+			if ((xhci->quirks & XHCI_TRUST_TX_LENGTH))
+				trb_comp_code = COMP_SHORT_TX;
+ 		} else {
+ 			*status = 0;
+ 		}
+@@ -1978,6 +1985,13 @@ static int handle_tx_event(struct xhci_hcd *xhci,
+ 	 * transfer type
+ 	 */
+ 	case COMP_SUCCESS:
+		if (TRB_LEN(le32_to_cpu(event->transfer_len)) == 0)
+			break;
+		if (xhci->quirks & XHCI_TRUST_TX_LENGTH)
+			trb_comp_code = COMP_SHORT_TX;
+		else
+			xhci_warn(xhci, "WARN Successful completion on short TX: "
+					"needs XHCI_TRUST_TX_LENGTH quirk?\n");
+ 	case COMP_SHORT_TX:
+ 		break;
+ 	case COMP_STOP:
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 4850c4d..363b141 100644
+--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
+@@ -1466,6 +1466,7 @@ struct xhci_hcd {
+ #define XHCI_RESET_ON_RESUME	(1 << 7)
+ #define	XHCI_SW_BW_CHECKING	(1 << 8)
+ #define XHCI_AMD_0x96_HOST	(1 << 9)
+#define XHCI_TRUST_TX_LENGTH	(1 << 10)
+ 	unsigned int		num_active_eps;
+ 	unsigned int		limit_active_eps;
+ 	/* There are two roothubs to keep track of bus suspend info for */
+-- 
+1.7.9.5
+
@@ -0,0 +1,43 @@
+From 644753e795bddc5e687932d9e8b6795859553ac3 Mon Sep 17 00:00:00 2001
+From: Andiry Xu <andiry.xu@gmail.com>
+Date: Sat, 5 May 2012 00:50:10 +0800
+Subject: [PATCH 061/117] usbcore: enable USB2 LPM if port suspend fails
+
+commit c3e751e4f4754793bb52bd5ae30e9cc027edbb12 upstream.
+
+USB2 LPM is disabled when device begin to suspend and enabled after device
+is resumed. That's because USB spec does not define the transition from
+U1/U2 state to U3 state.
+
+If usb_port_suspend() fails, usb_port_resume() is never called, and USB2 LPM
+is disabled in this situation. Enable USB2 LPM if port suspend fails.
+
+This patch should be backported to kernels as old as 3.2, that contain
+the commit 65580b4321eb36f16ae8b5987bfa1bb948fc5112 "xHCI: set USB2
+hardware LPM".
+
+Signed-off-by: Andiry Xu <andiry.xu@gmail.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/core/hub.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index ab4e49f..50cf41a 100644
+--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
+@@ -2420,6 +2420,10 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ 				NULL, 0,
+ 				USB_CTRL_SET_TIMEOUT);
+ 
+		/* Try to enable USB2 hardware LPM again */
+		if (udev->usb2_hw_lpm_capable == 1)
+			usb_set_usb2_hardware_lpm(udev, 1);
+
+ 		/* System sleep transitions should never fail */
+ 		if (!PMSG_IS_AUTO(msg))
+ 			status = 0;
+-- 
+1.7.9.5
+
@@ -0,0 +1,62 @@
+From 2ece12a2e8f1df09f28dbed203e3295d99d94c83 Mon Sep 17 00:00:00 2001
+From: Robert Richter <robert.richter@amd.com>
+Date: Fri, 18 May 2012 12:40:42 +0200
+Subject: [PATCH 062/117] perf/x86: Update event scheduling constraints for
+ AMD family 15h models
+
+commit 5bcdf5e4fee3c45e1281c25e4941f2163cb28c65 upstream.
+
+This update is for newer family 15h cpu models from 0x02 to 0x1f.
+
+Signed-off-by: Robert Richter <robert.richter@amd.com>
+Acked-by: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Link: http://lkml.kernel.org/r/1337337642-1621-1-git-send-email-robert.richter@amd.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/x86/kernel/cpu/perf_event_amd.c |   11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/cpu/perf_event_amd.c b/arch/x86/kernel/cpu/perf_event_amd.c
+index f64a039..3dbfb00 100644
+--- a/arch/x86/kernel/cpu/perf_event_amd.c
+++ b/arch/x86/kernel/cpu/perf_event_amd.c
+@@ -473,6 +473,7 @@ static __initconst const struct x86_pmu amd_pmu = {
+  * 0x023	DE	PERF_CTL[2:0]
+  * 0x02D	LS	PERF_CTL[3]
+  * 0x02E	LS	PERF_CTL[3,0]
+ * 0x031	LS	PERF_CTL[2:0] (**)
+  * 0x043	CU	PERF_CTL[2:0]
+  * 0x045	CU	PERF_CTL[2:0]
+  * 0x046	CU	PERF_CTL[2:0]
+@@ -486,10 +487,12 @@ static __initconst const struct x86_pmu amd_pmu = {
+  * 0x0DD	LS	PERF_CTL[5:0]
+  * 0x0DE	LS	PERF_CTL[5:0]
+  * 0x0DF	LS	PERF_CTL[5:0]
+ * 0x1C0	EX	PERF_CTL[5:3]
+  * 0x1D6	EX	PERF_CTL[5:0]
+  * 0x1D8	EX	PERF_CTL[5:0]
+  *
+- * (*) depending on the umask all FPU counters may be used
+ * (*)  depending on the umask all FPU counters may be used
+ * (**) only one unitmask enabled at a time
+  */
+ 
+ static struct event_constraint amd_f15_PMC0  = EVENT_CONSTRAINT(0, 0x01, 0);
+@@ -539,6 +542,12 @@ amd_get_event_constraints_f15h(struct cpu_hw_events *cpuc, struct perf_event *ev
+ 			return &amd_f15_PMC3;
+ 		case 0x02E:
+ 			return &amd_f15_PMC30;
+		case 0x031:
+			if (hweight_long(hwc->config & ARCH_PERFMON_EVENTSEL_UMASK) <= 1)
+				return &amd_f15_PMC20;
+			return &emptyconstraint;
+		case 0x1C0:
+			return &amd_f15_PMC53;
+ 		default:
+ 			return &amd_f15_PMC50;
+ 		}
+-- 
+1.7.9.5
+
@@ -0,0 +1,74 @@
+From 51025bed29bdd5301f9028357e13707356ae9692 Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.de>
+Date: Thu, 10 May 2012 10:19:21 +0200
+Subject: [PATCH 063/117] USB: fix resource leak in xhci power loss path
+
+commit f8a9e72d125f4e00ec529ba67b674321a1f3bf31 upstream.
+
+Some more data structures must be freed and counters
+reset if an XHCI controller has lost power. The failure
+to do so renders some chips inoperative after a certain number
+of S4 cycles.
+
+This patch should be backported to kernels as old as 3.2,
+that contain the commits c29eea621900f18287d50519f72cb9113746d75a
+"xhci: Implement HS/FS/LS bandwidth checking." and
+commit 839c817ce67178ca3c7c7ad534c571bba1e69ebe
+"xhci: Implement HS/FS/LS bandwidth checking."
+
+Signed-off-by: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/host/xhci-mem.c |   26 ++++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index 01c3800..a7b0676 100644
+--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
+@@ -1699,6 +1699,14 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
+ {
+ 	struct pci_dev	*pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
+ 	struct dev_info	*dev_info, *next;
+	struct list_head *tt_list_head;
+	struct list_head *tt;
+	struct list_head *endpoints;
+	struct list_head *ep, *q;
+	struct xhci_tt_bw_info *tt_info;
+	struct xhci_interval_bw_table *bwt;
+	struct xhci_virt_ep *virt_ep;
+
+ 	unsigned long	flags;
+ 	int size;
+ 	int i;
+@@ -1757,8 +1765,26 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
+ 	}
+ 	spin_unlock_irqrestore(&xhci->lock, flags);
+ 
+	bwt = &xhci->rh_bw->bw_table;
+	for (i = 0; i < XHCI_MAX_INTERVAL; i++) {
+		endpoints = &bwt->interval_bw[i].endpoints;
+		list_for_each_safe(ep, q, endpoints) {
+			virt_ep = list_entry(ep, struct xhci_virt_ep, bw_endpoint_list);
+			list_del(&virt_ep->bw_endpoint_list);
+			kfree(virt_ep);
+		}
+	}
+
+	tt_list_head = &xhci->rh_bw->tts;
+	list_for_each_safe(tt, q, tt_list_head) {
+		tt_info = list_entry(tt, struct xhci_tt_bw_info, tt_list);
+		list_del(tt);
+		kfree(tt_info);
+	}
+
+ 	xhci->num_usb2_ports = 0;
+ 	xhci->num_usb3_ports = 0;
+	xhci->num_active_eps = 0;
+ 	kfree(xhci->usb2_ports);
+ 	kfree(xhci->usb3_ports);
+ 	kfree(xhci->port_array);
+-- 
+1.7.9.5
+
@@ -0,0 +1,39 @@
+From 06abda2cc51b6f5ffcb67e7b7299ffd7e3af966b Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Tue, 8 May 2012 07:09:26 -0700
+Subject: [PATCH 064/117] xhci: Reset reserved command ring TRBs on cleanup.
+
+commit 33b2831ac870d50cc8e01c317b07fb1e69c13fe1 upstream.
+
+When the xHCI driver needs to clean up memory (perhaps due to a failed
+register restore on resume from S3 or resume from S4), it needs to reset
+the number of reserved TRBs on the command ring to zero.  Otherwise,
+several resume cycles (about 30) with a UAS device attached will
+continually increment the number of reserved TRBs, until all command
+submissions fail because there isn't enough room on the command ring.
+
+This patch should be backported to kernels as old as 2.6.32,
+that contain the commit 913a8a344ffcaf0b4a586d6662a2c66a7106557d
+"USB: xhci: Change how xHCI commands are handled."
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/host/xhci-mem.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index a7b0676..4232e868 100644
+--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
+@@ -1723,6 +1723,7 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
+ 	xhci->event_ring = NULL;
+ 	xhci_dbg(xhci, "Freed event ring\n");
+ 
+	xhci->cmd_ring_reserved_trbs = 0;
+ 	if (xhci->cmd_ring)
+ 		xhci_ring_free(xhci, xhci->cmd_ring);
+ 	xhci->cmd_ring = NULL;
+-- 
+1.7.9.5
+
@@ -0,0 +1,132 @@
+From 13538bbeb4fc2e5f45d426579967a675474e4f16 Mon Sep 17 00:00:00 2001
+From: Huajun Li <huajun.li.lee@gmail.com>
+Date: Fri, 18 May 2012 20:12:51 +0800
+Subject: [PATCH 065/117] USB: Remove races in devio.c
+
+commit 4e09dcf20f7b5358615514c2ec8584b248ab8874 upstream.
+
+There exist races in devio.c, below is one case,
+and there are similar races in destroy_async()
+and proc_unlinkurb().  Remove these races.
+
+ cancel_bulk_urbs()        async_completed()
+-------------------                -----------------------
+ spin_unlock(&ps->lock);
+
+                           list_move_tail(&as->asynclist,
+		                    &ps->async_completed);
+
+                           wake_up(&ps->wait);
+
+                           Lead to free_async() be triggered,
+                           then urb and 'as' will be freed.
+
+ usb_unlink_urb(as->urb);
+ ===> refer to the freed 'as'
+
+Signed-off-by: Huajun Li <huajun.li.lee@gmail.com>
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Cc: Oncaphillis <oncaphillis@snafu.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/core/devio.c |   33 +++++++++++++++++++++++++--------
+ 1 file changed, 25 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index 7abf060..f6ff837 100644
+--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
+@@ -295,17 +295,14 @@ static struct async *async_getcompleted(struct dev_state *ps)
+ static struct async *async_getpending(struct dev_state *ps,
+ 					     void __user *userurb)
+ {
+-	unsigned long flags;
+ 	struct async *as;
+ 
+-	spin_lock_irqsave(&ps->lock, flags);
+ 	list_for_each_entry(as, &ps->async_pending, asynclist)
+ 		if (as->userurb == userurb) {
+ 			list_del_init(&as->asynclist);
+-			spin_unlock_irqrestore(&ps->lock, flags);
+ 			return as;
+ 		}
+-	spin_unlock_irqrestore(&ps->lock, flags);
+
+ 	return NULL;
+ }
+ 
+@@ -360,6 +357,7 @@ static void cancel_bulk_urbs(struct dev_state *ps, unsigned bulk_addr)
+ __releases(ps->lock)
+ __acquires(ps->lock)
+ {
+	struct urb *urb;
+ 	struct async *as;
+ 
+ 	/* Mark all the pending URBs that match bulk_addr, up to but not
+@@ -382,8 +380,11 @@ __acquires(ps->lock)
+ 	list_for_each_entry(as, &ps->async_pending, asynclist) {
+ 		if (as->bulk_status == AS_UNLINK) {
+ 			as->bulk_status = 0;		/* Only once */
+			urb = as->urb;
+			usb_get_urb(urb);
+ 			spin_unlock(&ps->lock);		/* Allow completions */
+-			usb_unlink_urb(as->urb);
+			usb_unlink_urb(urb);
+			usb_put_urb(urb);
+ 			spin_lock(&ps->lock);
+ 			goto rescan;
+ 		}
+@@ -434,6 +435,7 @@ static void async_completed(struct urb *urb)
+ 
+ static void destroy_async(struct dev_state *ps, struct list_head *list)
+ {
+	struct urb *urb;
+ 	struct async *as;
+ 	unsigned long flags;
+ 
+@@ -441,10 +443,13 @@ static void destroy_async(struct dev_state *ps, struct list_head *list)
+ 	while (!list_empty(list)) {
+ 		as = list_entry(list->next, struct async, asynclist);
+ 		list_del_init(&as->asynclist);
+		urb = as->urb;
+		usb_get_urb(urb);
+ 
+ 		/* drop the spinlock so the completion handler can run */
+ 		spin_unlock_irqrestore(&ps->lock, flags);
+-		usb_kill_urb(as->urb);
+		usb_kill_urb(urb);
+		usb_put_urb(urb);
+ 		spin_lock_irqsave(&ps->lock, flags);
+ 	}
+ 	spin_unlock_irqrestore(&ps->lock, flags);
+@@ -1350,12 +1355,24 @@ static int proc_submiturb(struct dev_state *ps, void __user *arg)
+ 
+ static int proc_unlinkurb(struct dev_state *ps, void __user *arg)
+ {
+	struct urb *urb;
+ 	struct async *as;
+	unsigned long flags;
+ 
+	spin_lock_irqsave(&ps->lock, flags);
+ 	as = async_getpending(ps, arg);
+-	if (!as)
+	if (!as) {
+		spin_unlock_irqrestore(&ps->lock, flags);
+ 		return -EINVAL;
+-	usb_kill_urb(as->urb);
+	}
+
+	urb = as->urb;
+	usb_get_urb(urb);
+	spin_unlock_irqrestore(&ps->lock, flags);
+
+	usb_kill_urb(urb);
+	usb_put_urb(urb);
+
+ 	return 0;
+ }
+ 
+-- 
+1.7.9.5
+
@@ -0,0 +1,37 @@
+From d4bae88d4fc370e24457c3cf69fb343316b8f759 Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shli@kernel.org>
+Date: Mon, 21 May 2012 09:26:59 +1000
+Subject: [PATCH 066/117] md: using GFP_NOIO to allocate bio for flush request
+
+commit b5e1b8cee7ad58a15d2fa79bcd7946acb592602d upstream.
+
+A flush request is usually issued in transaction commit code path, so
+using GFP_KERNEL to allocate memory for flush request bio falls into
+the classic deadlock issue.
+
+This is suitable for any -stable kernel to which it applies as it
+avoids a possible deadlock.
+
+Signed-off-by: Shaohua Li <shli@fusionio.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/md/md.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index adcd850..700ecae 100644
+--- a/drivers/md/md.c
+++ b/drivers/md/md.c
+@@ -453,7 +453,7 @@ static void submit_flushes(struct work_struct *ws)
+ 			atomic_inc(&rdev->nr_pending);
+ 			atomic_inc(&rdev->nr_pending);
+ 			rcu_read_unlock();
+-			bi = bio_alloc_mddev(GFP_KERNEL, 0, mddev);
+			bi = bio_alloc_mddev(GFP_NOIO, 0, mddev);
+ 			bi->bi_end_io = md_end_flush;
+ 			bi->bi_private = rdev;
+ 			bi->bi_bdev = rdev->bdev;
+-- 
+1.7.9.5
+
@@ -0,0 +1,41 @@
+From ed8e2c17d62006fb136c30abeb552673727c5eee Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Sat, 14 Apr 2012 17:29:30 +0200
+Subject: [PATCH 067/117] um: Implement a custom pte_same() function
+
+commit f15b9000eb1d09bbaa4b0a6b2089d7e1f64e84b3 upstream.
+
+UML uses the _PAGE_NEWPAGE flag to mark pages which are not jet
+installed on the host side using mmap().
+pte_same() has to ignore this flag, otherwise unuse_pte_range()
+is unable to unuse the page because two identical
+page tables entries with different _PAGE_NEWPAGE flags would not
+match and swapoff() would never return.
+
+Analyzed-by: Hugh Dickins <hughd@google.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/um/include/asm/pgtable.h |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/um/include/asm/pgtable.h b/arch/um/include/asm/pgtable.h
+index 41474fb..0fea0ec 100644
+--- a/arch/um/include/asm/pgtable.h
+++ b/arch/um/include/asm/pgtable.h
+@@ -271,6 +271,12 @@ static inline void set_pte(pte_t *pteptr, pte_t pteval)
+ }
+ #define set_pte_at(mm,addr,ptep,pteval) set_pte(ptep,pteval)
+ 
+#define __HAVE_ARCH_PTE_SAME
+static inline int pte_same(pte_t pte_a, pte_t pte_b)
+{
+	return !((pte_val(pte_a) ^ pte_val(pte_b)) & ~_PAGE_NEWPAGE);
+}
+
+ /*
+  * Conversion functions: convert a page and protection to a page entry,
+  * and a page entry and page directory to the page they refer to.
+-- 
+1.7.9.5
+
@@ -0,0 +1,39 @@
+From a8f0308ef13a60d8103b7635fdbd54e10a621a0a Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Sat, 14 Apr 2012 17:46:01 +0200
+Subject: [PATCH 068/117] um: Fix __swp_type()
+
+commit 2b76ebaa728f8a3967c52aa189261c72fe56a6f1 upstream.
+
+The current __swp_type() function uses a too small bitshift.
+Using more than one swap files causes bad pages because
+the type bits clash with other page flags.
+
+Analyzed-by: Hugh Dickins <hughd@google.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/um/include/asm/pgtable.h |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/um/include/asm/pgtable.h b/arch/um/include/asm/pgtable.h
+index 0fea0ec..aa365c5 100644
+--- a/arch/um/include/asm/pgtable.h
+++ b/arch/um/include/asm/pgtable.h
+@@ -352,11 +352,11 @@ extern pte_t *virt_to_pte(struct mm_struct *mm, unsigned long addr);
+ #define update_mmu_cache(vma,address,ptep) do ; while (0)
+ 
+ /* Encode and de-code a swap entry */
+-#define __swp_type(x)			(((x).val >> 4) & 0x3f)
+#define __swp_type(x)			(((x).val >> 5) & 0x1f)
+ #define __swp_offset(x)			((x).val >> 11)
+ 
+ #define __swp_entry(type, offset) \
+-	((swp_entry_t) { ((type) << 4) | ((offset) << 11) })
+	((swp_entry_t) { ((type) << 5) | ((offset) << 11) })
+ #define __pte_to_swp_entry(pte) \
+ 	((swp_entry_t) { pte_val(pte_mkuptodate(pte)) })
+ #define __swp_entry_to_pte(x)		((pte_t) { (x).val })
+-- 
+1.7.9.5
+
@@ -0,0 +1,41 @@
+From c3ad2b1e42ce62ce0b8aa5283e5f1eee851dd3fb Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shli@kernel.org>
+Date: Wed, 21 Mar 2012 16:34:17 -0700
+Subject: [PATCH 069/117] swap: don't do discard if no discard option added
+
+commit 052b1987faca3606109d88d96bce124851f7c4c2 upstream.
+
+When swapon() was not passed the SWAP_FLAG_DISCARD option, sys_swapon()
+will still perform a discard operation.  This can cause problems if
+discard is slow or buggy.
+
+Reverse the order of the check so that a discard operation is performed
+only if the sys_swapon() caller is attempting to enable discard.
+
+Signed-off-by: Shaohua Li <shli@fusionio.com>
+Reported-by: Holger Kiehl <Holger.Kiehl@dwd.de>
+Tested-by: Holger Kiehl <Holger.Kiehl@dwd.de>
+Cc: Hugh Dickins <hughd@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ mm/swapfile.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mm/swapfile.c b/mm/swapfile.c
+index 2015a1e..d3955f2 100644
+--- a/mm/swapfile.c
+++ b/mm/swapfile.c
+@@ -2102,7 +2102,7 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
+ 			p->flags |= SWP_SOLIDSTATE;
+ 			p->cluster_next = 1 + (random32() % p->highest_bit);
+ 		}
+-		if (discard_swap(p) == 0 && (swap_flags & SWAP_FLAG_DISCARD))
+		if ((swap_flags & SWAP_FLAG_DISCARD) && discard_swap(p) == 0)
+ 			p->flags |= SWP_DISCARDABLE;
+ 	}
+ 
+-- 
+1.7.9.5
+
@@ -0,0 +1,42 @@
+From ae03191fbcee985e26e744fc2e3b928077e647a1 Mon Sep 17 00:00:00 2001
+From: Chris Bagwell <chris@cnpbagwell.com>
+Date: Wed, 26 Oct 2011 22:28:34 -0700
+Subject: [PATCH 070/117] Input: wacom - relax Bamboo stylus ID check
+
+commit c5981411f60c31f0dff6f0f98d2d3711384badaf upstream.
+
+Bit 0x02 always means tip versus eraser. Bit 0x01 is something related
+to version of stylus and different values are starting to be used.
+
+Relaxing proximity check is required to be used with 3rd generation
+Bamboo Pen and Touch tablets.
+
+Signed-off-by: Chris Bagwell <chris@cnpbagwell.com>
+Acked-by: Ping Cheng <pingc@wacom.com>
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/input/tablet/wacom_wac.c |    7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
+index 2ee47d0..f00c70e 100644
+--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
+@@ -843,12 +843,7 @@ static int wacom_bpt_pen(struct wacom_wac *wacom)
+ 	unsigned char *data = wacom->data;
+ 	int prox = 0, x = 0, y = 0, p = 0, d = 0, pen = 0, btn1 = 0, btn2 = 0;
+ 
+-	/*
+-	 * Similar to Graphire protocol, data[1] & 0x20 is proximity and
+-	 * data[1] & 0x18 is tool ID.  0x30 is safety check to ignore
+-	 * 2 unused tool ID's.
+-	 */
+-	prox = (data[1] & 0x30) == 0x30;
+	prox = (data[1] & 0x20) == 0x20;
+ 
+ 	/*
+ 	 * All reports shared between PEN and RUBBER tool must be
+-- 
+1.7.9.5
+
@@ -0,0 +1,35 @@
+From 3e4b4afbb70e3054734cacd6aacf50024f27c3dd Mon Sep 17 00:00:00 2001
+From: Matt Johnson <johnso87@illinois.edu>
+Date: Fri, 27 Apr 2012 01:42:30 -0500
+Subject: [PATCH 071/117] ahci: Detect Marvell 88SE9172 SATA controller
+
+commit 642d89252201c4155fc3946bf9cdea409e5d263e upstream.
+
+The Marvell 88SE9172 SATA controller (PCI ID 1b4b 917a) already worked
+once it was detected, but was missing an ahci_pci_tbl entry.
+
+Boot tested on a Gigabyte Z68X-UD3H-B3 motherboard.
+
+Signed-off-by: Matt Johnson <johnso87@illinois.edu>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/ata/ahci.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index cf26222..fb65915 100644
+--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
+@@ -384,6 +384,8 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ 	  .driver_data = board_ahci_yes_fbs },			/* 88se9128 */
+ 	{ PCI_DEVICE(0x1b4b, 0x9125),
+ 	  .driver_data = board_ahci_yes_fbs },			/* 88se9125 */
+	{ PCI_DEVICE(0x1b4b, 0x917a),
+	  .driver_data = board_ahci_yes_fbs },			/* 88se9172 */
+ 	{ PCI_DEVICE(0x1b4b, 0x91a3),
+ 	  .driver_data = board_ahci_yes_fbs },
+ 
+-- 
+1.7.9.5
+
@@ -0,0 +1,59 @@
+From 06d6cd667991ac824b4e32c07ad4c382e202b920 Mon Sep 17 00:00:00 2001
+From: Dima Zavin <dima@android.com>
+Date: Thu, 29 Mar 2012 20:44:06 +0100
+Subject: [PATCH 072/117] ARM: 7365/1: drop unused parameter from
+ flush_cache_user_range
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 4542b6a0fa6b48d9ae6b41c1efeb618b7a221b2a upstream.
+
+vma isn't used and flush_cache_user_range isn't a standard macro that
+is used on several archs with the same prototype. In fact only unicore32
+has a macro with the same name (with an identical implementation and no
+in-tree users).
+
+This is a part of a patch proposed by Dima Zavin (with Message-id:
+1272439931-12795-1-git-send-email-dima@android.com) that didn't get
+accepted.
+
+Cc: Dima Zavin <dima@android.com>
+Acked-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/arm/include/asm/cacheflush.h |    2 +-
+ arch/arm/kernel/traps.c           |    2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
+index d5d8d5c..1252a26 100644
+--- a/arch/arm/include/asm/cacheflush.h
+++ b/arch/arm/include/asm/cacheflush.h
+@@ -249,7 +249,7 @@ extern void flush_cache_page(struct vm_area_struct *vma, unsigned long user_addr
+  * Harvard caches are synchronised for the user space address range.
+  * This is used for the ARM private sys_cacheflush system call.
+  */
+-#define flush_cache_user_range(vma,start,end) \
+#define flush_cache_user_range(start,end) \
+ 	__cpuc_coherent_user_range((start) & PAGE_MASK, PAGE_ALIGN(end))
+ 
+ /*
+diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
+index 99a5727..f363ad9 100644
+--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
+@@ -488,7 +488,7 @@ do_cache_op(unsigned long start, unsigned long end, int flags)
+ 		if (end > vma->vm_end)
+ 			end = vma->vm_end;
+ 
+-		flush_cache_user_range(vma, start, end);
+		flush_cache_user_range(start, end);
+ 	}
+ 	up_read(&mm->mmap_sem);
+ }
+-- 
+1.7.9.5
+
@@ -0,0 +1,45 @@
+From bf1dbf3f545a79e9ac5ff460053283f2760f095b Mon Sep 17 00:00:00 2001
+From: Dima Zavin <dima@android.com>
+Date: Mon, 30 Apr 2012 10:26:14 +0100
+Subject: [PATCH 073/117] ARM: 7409/1: Do not call flush_cache_user_range with
+ mmap_sem held
+
+commit 435a7ef52db7d86e67a009b36cac1457f8972391 upstream.
+
+We can't be holding the mmap_sem while calling flush_cache_user_range
+because the flush can fault. If we fault on a user address, the
+page fault handler will try to take mmap_sem again. Since both places
+acquire the read lock, most of the time it succeeds. However, if another
+thread tries to acquire the write lock on the mmap_sem (e.g. mmap) in
+between the call to flush_cache_user_range and the fault, the down_read
+in do_page_fault will deadlock.
+
+[will: removed drop of vma parameter as already queued by rmk (7365/1)]
+
+Acked-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Dima Zavin <dima@android.com>
+Signed-off-by: John Stultz <john.stultz@linaro.org>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/arm/kernel/traps.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
+index f363ad9..160cb16 100644
+--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
+@@ -488,7 +488,9 @@ do_cache_op(unsigned long start, unsigned long end, int flags)
+ 		if (end > vma->vm_end)
+ 			end = vma->vm_end;
+ 
+		up_read(&mm->mmap_sem);
+ 		flush_cache_user_range(start, end);
+		return;
+ 	}
+ 	up_read(&mm->mmap_sem);
+ }
+-- 
+1.7.9.5
+
@@ -0,0 +1,48 @@
+From 444d2b8e5c56b431d2aa79db0c1742c6159b661a Mon Sep 17 00:00:00 2001
+From: Josh Boyer <jwboyer@redhat.com>
+Date: Wed, 2 Nov 2011 14:32:00 -0400
+Subject: [PATCH 074/117] sony-laptop: Enable keyboard backlight by default
+
+commit 6fe6ae56a7cebaebc2e6daa11c423e4692f9b592 upstream.
+
+When the keyboard backlight support was originally added, the commit said
+to default it to on with a 10 second timeout.  That actually wasn't the
+case, as the default value is commented out for the kbd_backlight parameter.
+Because it is a static variable, it gets set to 0 by default without some
+other form of initialization.
+
+However, it seems the function to set the value wasn't actually called
+immediately, so whatever state the keyboard was in initially would remain.
+Then commit df410d522410e67660 was introduced during the 2.6.39 timeframe to
+immediately set whatever value was present (as well as attempt to
+restore/reset the state on module removal or resume).  That seems to have
+now forced the light off immediately when the module is loaded unless
+the option kbd_backlight=1 is specified.
+
+Let's enable it by default again (for the first time).  This should solve
+https://bugzilla.redhat.com/show_bug.cgi?id=728478
+
+Signed-off-by: Josh Boyer <jwboyer@redhat.com>
+Acked-by: Mattia Dongili <malattia@linux.it>
+Signed-off-by: Matthew Garrett <mjg@redhat.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/platform/x86/sony-laptop.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
+index c006dee..40c4705 100644
+--- a/drivers/platform/x86/sony-laptop.c
+++ b/drivers/platform/x86/sony-laptop.c
+@@ -127,7 +127,7 @@ MODULE_PARM_DESC(minor,
+ 		 "default is -1 (automatic)");
+ #endif
+ 
+-static int kbd_backlight;	/* = 1 */
+static int kbd_backlight = 1;
+ module_param(kbd_backlight, int, 0444);
+ MODULE_PARM_DESC(kbd_backlight,
+ 		 "set this to 0 to disable keyboard backlight, "
+-- 
+1.7.9.5
+
@@ -0,0 +1,54 @@
+From b277e4c19f3668e1a58e03d8933a3c6cd612c5e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <levinsasha928@gmail.com>
+Date: Sat, 5 May 2012 17:06:35 +0200
+Subject: [PATCH 075/117] init: don't try mounting device as nfs root unless
+ type fully matches
+
+commit 377485f6244af255b04d662cf19cddbbc4ae4310 upstream.
+
+Currently, we'll try mounting any device who's major device number is
+UNNAMED_MAJOR as NFS root.  This would happen for non-NFS devices as
+well (such as 9p devices) but it wouldn't cause any issues since
+mounting the device as NFS would fail quickly and the code proceeded to
+doing the proper mount:
+
+       [  101.522716] VFS: Unable to mount root fs via NFS, trying floppy.
+       [  101.534499] VFS: Mounted root (9p filesystem) on device 0:18.
+
+Commit 6829a048102a ("NFS: Retry mounting NFSROOT") introduced retries
+when mounting NFS root, which means that now we don't immediately fail
+and instead it takes an additional 90+ seconds until we stop retrying,
+which has revealed the issue this patch fixes.
+
+This meant that it would take an additional 90 seconds to boot when
+we're not using a device type which gets detected in order before NFS.
+
+This patch modifies the NFS type check to require device type to be
+'Root_NFS' instead of requiring the device to have an UNNAMED_MAJOR
+major.  This makes boot process cleaner since we now won't go through
+the NFS mounting code at all when the device isn't an NFS root
+("/dev/nfs").
+
+Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ init/do_mounts.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/init/do_mounts.c b/init/do_mounts.c
+index db6e5ee..d6c229f 100644
+--- a/init/do_mounts.c
+++ b/init/do_mounts.c
+@@ -470,7 +470,7 @@ void __init change_floppy(char *fmt, ...)
+ void __init mount_root(void)
+ {
+ #ifdef CONFIG_ROOT_NFS
+-	if (MAJOR(ROOT_DEV) == UNNAMED_MAJOR) {
+	if (ROOT_DEV == Root_NFS) {
+ 		if (mount_nfs_root())
+ 			return;
+ 
+-- 
+1.7.9.5
+
@@ -0,0 +1,40 @@
+From 0b0f028ae418e6b772241ed68bee5f2d0c6bcb3a Mon Sep 17 00:00:00 2001
+From: Sha Zhengju <handai.szj@taobao.com>
+Date: Thu, 10 May 2012 13:01:45 -0700
+Subject: [PATCH 076/117] memcg: free spare array to avoid memory leak
+
+commit 8c7577637ca31385e92769a77e2ab5b428e8b99c upstream.
+
+When the last event is unregistered, there is no need to keep the spare
+array anymore.  So free it to avoid memory leak.
+
+Signed-off-by: Sha Zhengju <handai.szj@taobao.com>
+Acked-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Reviewed-by: Kirill A. Shutemov <kirill@shutemov.name>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ mm/memcontrol.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 778554f..c8425b1 100644
+--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
+@@ -4549,6 +4549,12 @@ static void mem_cgroup_usage_unregister_event(struct cgroup *cgrp,
+ swap_buffers:
+ 	/* Swap primary and spare array */
+ 	thresholds->spare = thresholds->primary;
+	/* If all events are unregistered, free the spare array */
+	if (!new) {
+		kfree(thresholds->spare);
+		thresholds->spare = NULL;
+	}
+
+ 	rcu_assign_pointer(thresholds->primary, new);
+ 
+ 	/* To be sure that nobody uses thresholds */
+-- 
+1.7.9.5
+
@@ -0,0 +1,107 @@
+From 2ed9e3e61cd65b3a43998d48846744be1b263394 Mon Sep 17 00:00:00 2001
+From: Jan Kiszka <jan.kiszka@siemens.com>
+Date: Thu, 10 May 2012 10:04:36 -0300
+Subject: [PATCH 077/117] compat: Fix RT signal mask corruption via
+ sigprocmask
+
+commit b7dafa0ef3145c31d7753be0a08b3cbda51f0209 upstream.
+
+compat_sys_sigprocmask reads a smaller signal mask from userspace than
+sigprogmask accepts for setting.  So the high word of blocked.sig[0]
+will be cleared, releasing any potentially blocked RT signal.
+
+This was discovered via userspace code that relies on get/setcontext.
+glibc's i386 versions of those functions use sigprogmask instead of
+rt_sigprogmask to save/restore signal mask and caused RT signal
+unblocking this way.
+
+As suggested by Linus, this replaces the sys_sigprocmask based compat
+version with one that open-codes the required logic, including the merge
+of the existing blocked set with the new one provided on SIG_SETMASK.
+
+Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ kernel/compat.c |   63 ++++++++++++++++++++++++++++++++++++++++---------------
+ 1 file changed, 46 insertions(+), 17 deletions(-)
+
+diff --git a/kernel/compat.c b/kernel/compat.c
+index f346ced..a6d0649 100644
+--- a/kernel/compat.c
+++ b/kernel/compat.c
+@@ -320,25 +320,54 @@ asmlinkage long compat_sys_sigpending(compat_old_sigset_t __user *set)
+ 
+ #ifdef __ARCH_WANT_SYS_SIGPROCMASK
+ 
+-asmlinkage long compat_sys_sigprocmask(int how, compat_old_sigset_t __user *set,
+-		compat_old_sigset_t __user *oset)
+/*
+ * sys_sigprocmask SIG_SETMASK sets the first (compat) word of the
+ * blocked set of signals to the supplied signal set
+ */
+static inline void compat_sig_setmask(sigset_t *blocked, compat_sigset_word set)
+ {
+-	old_sigset_t s;
+-	long ret;
+-	mm_segment_t old_fs;
+	memcpy(blocked->sig, &set, sizeof(set));
+}
+ 
+-	if (set && get_user(s, set))
+-		return -EFAULT;
+-	old_fs = get_fs();
+-	set_fs(KERNEL_DS);
+-	ret = sys_sigprocmask(how,
+-			      set ? (old_sigset_t __user *) &s : NULL,
+-			      oset ? (old_sigset_t __user *) &s : NULL);
+-	set_fs(old_fs);
+-	if (ret == 0)
+-		if (oset)
+-			ret = put_user(s, oset);
+-	return ret;
+asmlinkage long compat_sys_sigprocmask(int how,
+				       compat_old_sigset_t __user *nset,
+				       compat_old_sigset_t __user *oset)
+{
+	old_sigset_t old_set, new_set;
+	sigset_t new_blocked;
+
+	old_set = current->blocked.sig[0];
+
+	if (nset) {
+		if (get_user(new_set, nset))
+			return -EFAULT;
+		new_set &= ~(sigmask(SIGKILL) | sigmask(SIGSTOP));
+
+		new_blocked = current->blocked;
+
+		switch (how) {
+		case SIG_BLOCK:
+			sigaddsetmask(&new_blocked, new_set);
+			break;
+		case SIG_UNBLOCK:
+			sigdelsetmask(&new_blocked, new_set);
+			break;
+		case SIG_SETMASK:
+			compat_sig_setmask(&new_blocked, new_set);
+			break;
+		default:
+			return -EINVAL;
+		}
+
+		set_current_blocked(&new_blocked);
+	}
+
+	if (oset) {
+		if (put_user(old_set, oset))
+			return -EFAULT;
+	}
+
+	return 0;
+ }
+ 
+ #endif
+-- 
+1.7.9.5
+
@@ -0,0 +1,43 @@
+From c95c67d82938539844654f8d12a831e06ddae45a Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Thu, 8 Dec 2011 21:13:46 +0100
+Subject: [PATCH 078/117] ext3: Fix error handling on inode bitmap corruption
+
+commit 1415dd8705394399d59a3df1ab48d149e1e41e77 upstream.
+
+When insert_inode_locked() fails in ext3_new_inode() it most likely
+means inode bitmap got corrupted and we allocated again inode which
+is already in use. Also doing unlock_new_inode() during error recovery
+is wrong since inode does not have I_NEW set. Fix the problem by jumping
+to fail: (instead of fail_drop:) which declares filesystem error and
+does not call unlock_new_inode().
+
+Reviewed-by: Eric Sandeen <sandeen@redhat.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/ext3/ialloc.c |    8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ext3/ialloc.c b/fs/ext3/ialloc.c
+index 5c866e0..adae962 100644
+--- a/fs/ext3/ialloc.c
+++ b/fs/ext3/ialloc.c
+@@ -525,8 +525,12 @@ got:
+ 	if (IS_DIRSYNC(inode))
+ 		handle->h_sync = 1;
+ 	if (insert_inode_locked(inode) < 0) {
+-		err = -EINVAL;
+-		goto fail_drop;
+		/*
+		 * Likely a bitmap corruption causing inode to be allocated
+		 * twice.
+		 */
+		err = -EIO;
+		goto fail;
+ 	}
+ 	spin_lock(&sbi->s_next_gen_lock);
+ 	inode->i_generation = sbi->s_next_generation++;
+-- 
+1.7.9.5
+
@@ -0,0 +1,42 @@
+From 92d372ef4ce9cea8d08163f727e4eeac7e9a2472 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Sun, 18 Dec 2011 17:37:02 -0500
+Subject: [PATCH 079/117] ext4: fix error handling on inode bitmap corruption
+
+commit acd6ad83517639e8f09a8c5525b1dccd81cd2a10 upstream.
+
+When insert_inode_locked() fails in ext4_new_inode() it most likely means inode
+bitmap got corrupted and we allocated again inode which is already in use. Also
+doing unlock_new_inode() during error recovery is wrong since the inode does
+not have I_NEW set. Fix the problem by jumping to fail: (instead of fail_drop:)
+which declares filesystem error and does not call unlock_new_inode().
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/ext4/ialloc.c |    8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
+index 00beb4f..8fb6844 100644
+--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
+@@ -885,8 +885,12 @@ got:
+ 	if (IS_DIRSYNC(inode))
+ 		ext4_handle_sync(handle);
+ 	if (insert_inode_locked(inode) < 0) {
+-		err = -EINVAL;
+-		goto fail_drop;
+		/*
+		 * Likely a bitmap corruption causing inode to be allocated
+		 * twice.
+		 */
+		err = -EIO;
+		goto fail;
+ 	}
+ 	spin_lock(&sbi->s_next_gen_lock);
+ 	inode->i_generation = sbi->s_next_generation++;
+-- 
+1.7.9.5
+
@@ -0,0 +1,42 @@
+From 1155d70b0cfab4cef0edb62753bc9b5053d6fa8e Mon Sep 17 00:00:00 2001
+From: Lan Tianyu <tianyu.lan@intel.com>
+Date: Sat, 21 Jan 2012 09:23:56 +0800
+Subject: [PATCH 080/117] ACPI / PM: Add Sony Vaio VPCCW29FX to nonvs
+ blacklist.
+
+commit 93f770846e8dedc5d9117bd4ad9d7efd18420627 upstream.
+
+Sony Vaio VPCCW29FX does not resume correctly without
+acpi_sleep=nonvs, so add it to the ACPI sleep blacklist.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=34722
+
+Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/acpi/sleep.c |    8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
+index 0a7ed69..ca191ff 100644
+--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
+@@ -438,6 +438,14 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
+ 	},
+ 	{
+ 	.callback = init_nvs_nosave,
+	.ident = "Sony Vaio VPCCW29FX",
+	.matches = {
+		DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+		DMI_MATCH(DMI_PRODUCT_NAME, "VPCCW29FX"),
+		},
+	},
+	{
+	.callback = init_nvs_nosave,
+ 	.ident = "Averatec AV1020-ED2",
+ 	.matches = {
+ 		DMI_MATCH(DMI_SYS_VENDOR, "AVERATEC"),
+-- 
+1.7.9.5
+
@@ -0,0 +1,42 @@
+From a9b96c2354127a1d9d0401564b6359403aecdb66 Mon Sep 17 00:00:00 2001
+From: "Stephen M. Cameron" <scameron@beardog.cce.hp.com>
+Date: Mon, 28 Nov 2011 10:15:20 -0600
+Subject: [PATCH 081/117] hpsa: Add IRQF_SHARED back in for the non-MSI(X)
+ interrupt handler
+
+commit 45bcf018d1a4779d592764ef57517c92589d55d7 upstream.
+
+IRQF_SHARED is required for older controllers that don't support MSI(X)
+and which may end up sharing an interrupt.  All the controllers hpsa
+normally supports have MSI(X) capability, but older controllers may be
+encountered via the hpsa_allow_any=1 module parameter.
+
+Also remove deprecated IRQF_DISABLED.
+
+Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/scsi/hpsa.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index dc9dea3..b4d2c86 100644
+--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
+@@ -4068,10 +4068,10 @@ static int hpsa_request_irq(struct ctlr_info *h,
+ 
+ 	if (h->msix_vector || h->msi_vector)
+ 		rc = request_irq(h->intr[h->intr_mode], msixhandler,
+-				IRQF_DISABLED, h->devname, h);
+				0, h->devname, h);
+ 	else
+ 		rc = request_irq(h->intr[h->intr_mode], intxhandler,
+-				IRQF_DISABLED, h->devname, h);
+				IRQF_SHARED, h->devname, h);
+ 	if (rc) {
+ 		dev_err(&h->pdev->dev, "unable to get irq %d for %s\n",
+ 		       h->intr[h->intr_mode], h->devname);
+-- 
+1.7.9.5
+
@@ -0,0 +1,42 @@
+From ab66f47089f09bceebe3bee38d5e76e08ec748d0 Mon Sep 17 00:00:00 2001
+From: Kazuya Mio <k-mio@sx.jp.nec.com>
+Date: Thu, 1 Dec 2011 16:51:07 +0900
+Subject: [PATCH 082/117] wake up s_wait_unfrozen when ->freeze_fs fails
+
+commit e1616300a20c80396109c1cf013ba9a36055a3da upstream.
+
+dd slept infinitely when fsfeeze failed because of EIO.
+To fix this problem, if ->freeze_fs fails, freeze_super() wakes up
+the tasks waiting for the filesystem to become unfrozen.
+
+When s_frozen isn't SB_UNFROZEN in __generic_file_aio_write(),
+the function sleeps until FITHAW ioctl wakes up s_wait_unfrozen.
+
+However, if ->freeze_fs fails, s_frozen is set to SB_UNFROZEN and then
+freeze_super() returns an error number. In this case, FITHAW ioctl returns
+EINVAL because s_frozen is already SB_UNFROZEN. There is no way to wake up
+s_wait_unfrozen, so __generic_file_aio_write() sleeps infinitely.
+
+Signed-off-by: Kazuya Mio <k-mio@sx.jp.nec.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/super.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/super.c b/fs/super.c
+index afd0f1a..2a698f6 100644
+--- a/fs/super.c
+++ b/fs/super.c
+@@ -1166,6 +1166,8 @@ int freeze_super(struct super_block *sb)
+ 			printk(KERN_ERR
+ 				"VFS:Filesystem freeze failed\n");
+ 			sb->s_frozen = SB_UNFROZEN;
+			smp_wmb();
+			wake_up(&sb->s_wait_unfrozen);
+ 			deactivate_locked_super(sb);
+ 			return ret;
+ 		}
+-- 
+1.7.9.5
+
@@ -0,0 +1,35 @@
+From 3f974a0efbf9480d3a540a029f5a98da92ce772e Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 30 Apr 2012 17:36:21 +0300
+Subject: [PATCH 083/117] cifs: fix revalidation test in cifs_llseek()
+
+commit 48a5730e5b71201e226ff06e245bf308feba5f10 upstream.
+
+This test is always true so it means we revalidate the length every
+time, which generates more network traffic.  When it is SEEK_SET or
+SEEK_CUR, then we don't need to revalidate.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/cifs/cifsfs.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index b4c2c99..b1451af 100644
+--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
+@@ -703,7 +703,7 @@ static loff_t cifs_llseek(struct file *file, loff_t offset, int origin)
+ 	 * origin == SEEK_END || SEEK_DATA || SEEK_HOLE => we must revalidate
+ 	 * the cached file length
+ 	 */
+-	if (origin != SEEK_SET || origin != SEEK_CUR) {
+	if (origin != SEEK_SET && origin != SEEK_CUR) {
+ 		int rc;
+ 		struct inode *inode = file->f_path.dentry->d_inode;
+ 
+-- 
+1.7.9.5
+
@@ -0,0 +1,123 @@
+From 69fa22d4b635612c73cb0427447c5916e18a217e Mon Sep 17 00:00:00 2001
+From: Jeff Mahoney <jeffm@suse.com>
+Date: Wed, 25 Apr 2012 14:32:09 +0000
+Subject: [PATCH 084/117] dl2k: Clean up rio_ioctl
+
+commit 1bb57e940e1958e40d51f2078f50c3a96a9b2d75 upstream.
+
+The dl2k driver's rio_ioctl call has a few issues:
+- No permissions checking
+- Implements SIOCGMIIREG and SIOCGMIIREG using the SIOCDEVPRIVATE numbers
+- Has a few ioctls that may have been used for debugging at one point
+  but have no place in the kernel proper.
+
+This patch removes all but the MII ioctls, renumbers them to use the
+standard ones, and adds the proper permission check for SIOCSMIIREG.
+
+We can also get rid of the dl2k-specific struct mii_data in favor of
+the generic struct mii_ioctl_data.
+
+Since we have the phyid on hand, we can add the SIOCGMIIPHY ioctl too.
+
+Most of the MII code for the driver could probably be converted to use
+the generic MII library but I don't have a device to test the results.
+
+Reported-by: Stephan Mueller <stephan.mueller@atsec.com>
+Signed-off-by: Jeff Mahoney <jeffm@suse.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/ethernet/dlink/dl2k.c |   52 +++++++------------------------------
+ drivers/net/ethernet/dlink/dl2k.h |    7 -----
+ 2 files changed, 9 insertions(+), 50 deletions(-)
+
+diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
+index b2dc2c8..2e09edb 100644
+--- a/drivers/net/ethernet/dlink/dl2k.c
+++ b/drivers/net/ethernet/dlink/dl2k.c
+@@ -1259,55 +1259,21 @@ rio_ioctl (struct net_device *dev, struct ifreq *rq, int cmd)
+ {
+ 	int phy_addr;
+ 	struct netdev_private *np = netdev_priv(dev);
+-	struct mii_data *miidata = (struct mii_data *) &rq->ifr_ifru;
+-
+-	struct netdev_desc *desc;
+-	int i;
+	struct mii_ioctl_data *miidata = if_mii(rq);
+ 
+ 	phy_addr = np->phy_addr;
+ 	switch (cmd) {
+-	case SIOCDEVPRIVATE:
+-		break;
+-
+-	case SIOCDEVPRIVATE + 1:
+-		miidata->out_value = mii_read (dev, phy_addr, miidata->reg_num);
+	case SIOCGMIIPHY:
+		miidata->phy_id = phy_addr;
+ 		break;
+-	case SIOCDEVPRIVATE + 2:
+-		mii_write (dev, phy_addr, miidata->reg_num, miidata->in_value);
+	case SIOCGMIIREG:
+		miidata->val_out = mii_read (dev, phy_addr, miidata->reg_num);
+ 		break;
+-	case SIOCDEVPRIVATE + 3:
+-		break;
+-	case SIOCDEVPRIVATE + 4:
+-		break;
+-	case SIOCDEVPRIVATE + 5:
+-		netif_stop_queue (dev);
+	case SIOCSMIIREG:
+		if (!capable(CAP_NET_ADMIN))
+			return -EPERM;
+		mii_write (dev, phy_addr, miidata->reg_num, miidata->val_in);
+ 		break;
+-	case SIOCDEVPRIVATE + 6:
+-		netif_wake_queue (dev);
+-		break;
+-	case SIOCDEVPRIVATE + 7:
+-		printk
+-		    ("tx_full=%x cur_tx=%lx old_tx=%lx cur_rx=%lx old_rx=%lx\n",
+-		     netif_queue_stopped(dev), np->cur_tx, np->old_tx, np->cur_rx,
+-		     np->old_rx);
+-		break;
+-	case SIOCDEVPRIVATE + 8:
+-		printk("TX ring:\n");
+-		for (i = 0; i < TX_RING_SIZE; i++) {
+-			desc = &np->tx_ring[i];
+-			printk
+-			    ("%02x:cur:%08x next:%08x status:%08x frag1:%08x frag0:%08x",
+-			     i,
+-			     (u32) (np->tx_ring_dma + i * sizeof (*desc)),
+-			     (u32)le64_to_cpu(desc->next_desc),
+-			     (u32)le64_to_cpu(desc->status),
+-			     (u32)(le64_to_cpu(desc->fraginfo) >> 32),
+-			     (u32)le64_to_cpu(desc->fraginfo));
+-			printk ("\n");
+-		}
+-		printk ("\n");
+-		break;
+-
+ 	default:
+ 		return -EOPNOTSUPP;
+ 	}
+diff --git a/drivers/net/ethernet/dlink/dl2k.h b/drivers/net/ethernet/dlink/dl2k.h
+index ba0adca..30c2da3 100644
+--- a/drivers/net/ethernet/dlink/dl2k.h
+++ b/drivers/net/ethernet/dlink/dl2k.h
+@@ -365,13 +365,6 @@ struct ioctl_data {
+ 	char *data;
+ };
+ 
+-struct mii_data {
+-	__u16 reserved;
+-	__u16 reg_num;
+-	__u16 in_value;
+-	__u16 out_value;
+-};
+-
+ /* The Rx and Tx buffer descriptors. */
+ struct netdev_desc {
+ 	__le64 next_desc;
+-- 
+1.7.9.5
+
@@ -0,0 +1,41 @@
+From ad7129ee930fa9b9efd04490a4ddcd5d5a9039a9 Mon Sep 17 00:00:00 2001
+From: Danny Kukawka <danny.kukawka@bisect.de>
+Date: Tue, 24 Jan 2012 16:44:42 +0100
+Subject: [PATCH 085/117] OMAPDSS: VENC: fix NULL pointer dereference in DSS2
+ VENC sysfs debug attr on OMAP4
+
+commit cc1d3e032df53d83d0ca4d537d8eb67eb5b3e808 upstream.
+
+Commit ba02fa37de80bea10d706f39f076dd848348320a disabled the
+venc driver registration on OMAP4. Since the driver never gets
+probed/initialised your get a dereferenceed NULL pointer if you
+try to get info from /sys/kernel/debug/omapdss/venc
+
+Return info message about disabled venc if venc_dump_regs() gets called.
+
+Signed-off-by: Danny Kukawka <danny.kukawka@bisect.de>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/video/omap2/dss/venc.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/video/omap2/dss/venc.c b/drivers/video/omap2/dss/venc.c
+index 7533458..7152b53 100644
+--- a/drivers/video/omap2/dss/venc.c
+++ b/drivers/video/omap2/dss/venc.c
+@@ -679,6 +679,11 @@ void venc_dump_regs(struct seq_file *s)
+ {
+ #define DUMPREG(r) seq_printf(s, "%-35s %08x\n", #r, venc_read_reg(r))
+ 
+	if (cpu_is_omap44xx()) {
+		seq_printf(s, "VENC currently disabled on OMAP44xx\n");
+		return;
+	}
+
+ 	if (venc_runtime_get())
+ 		return;
+ 
+-- 
+1.7.9.5
+
@@ -0,0 +1,36 @@
+From 64affee5c2afb0dff67a4c3669e3c44c98575809 Mon Sep 17 00:00:00 2001
+From: Tomoya MORINAGA <tomoya.rohm@gmail.com>
+Date: Mon, 26 Mar 2012 14:55:25 +0900
+Subject: [PATCH 086/117] i2c-eg20t: change timeout value 50msec to 1000msec
+
+commit 8a52f9f347da721b199b7f9dcc0168bbe7d0baae upstream.
+
+Currently, during i2c works alone, wait-event timeout is not occurred.
+However, as CPU load increases, timeout occurs frequently.
+So, I modified like this patch.
+Modifying like this patch, I've never seen the timeout event with high
+load test.
+
+Signed-off-by: Tomoya MORINAGA <tomoya.rohm@gmail.com>
+Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/i2c/busses/i2c-eg20t.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c
+index 730215e..2cda65bf 100644
+--- a/drivers/i2c/busses/i2c-eg20t.c
+++ b/drivers/i2c/busses/i2c-eg20t.c
+@@ -315,7 +315,7 @@ static s32 pch_i2c_wait_for_xfer_complete(struct i2c_algo_pch_data *adap)
+ {
+ 	long ret;
+ 	ret = wait_event_timeout(pch_event,
+-			(adap->pch_event_flag != 0), msecs_to_jiffies(50));
+			(adap->pch_event_flag != 0), msecs_to_jiffies(1000));
+ 
+ 	if (ret == 0) {
+ 		pch_err(adap, "timeout: %x\n", adap->pch_event_flag);
+-- 
+1.7.9.5
+
@@ -0,0 +1,100 @@
+From b8fd6d0d306fe861b9a5d692b5d14c169a14bc7e Mon Sep 17 00:00:00 2001
+From: Ben Widawsky <ben@bwidawsk.net>
+Date: Sat, 14 Apr 2012 18:41:32 -0700
+Subject: [PATCH 087/117] drm/i915: [GEN7] Use HW scheduler for fixed function
+ shaders
+
+commit a1e969e0332de7a430e62822cee8f2ec8d83cd7c upstream.
+
+This originally started as a patch from Bernard as a way of simply
+setting the VS scheduler. After submitting the RFC patch, we decided to
+also modify the DS scheduler. To be most explicit, I've made the patch
+explicitly set all scheduler modes, and included the defines for other
+modes (in case someone feels frisky later).
+
+The rest of the story gets a bit weird. The first version of the patch
+showed an almost unbelievable performance improvement. Since rebasing my
+branch it appears the performance improvement has gone, unfortunately.
+But setting these bits seem to be the right thing to do given that the
+docs describe corruption that can occur with the default settings.
+
+In summary, I am seeing no more perf improvements (or regressions) in my
+limited testing, but we believe this should be set to prevent rendering
+corruption, therefore cc stable.
+
+v1: Clear bit 4 also (Ken + Eugeni)
+Do a full clear + set of the bits we want (Me).
+
+Cc: Bernard Kilarski <bernard.r.kilarski@intel.com>
+Reviewed-by (RFC): Kenneth Graunke <kenneth@whitecape.org>
+Signed-off-by: Ben Widawsky <benjamin.widawsky@intel.com>
+Reviewed-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
+Reviewed-by: Kenneth Graunke <kenneth@whitecape.org>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/gpu/drm/i915/i915_reg.h      |   15 +++++++++++++++
+ drivers/gpu/drm/i915/intel_display.c |   14 ++++++++++++++
+ 2 files changed, 29 insertions(+)
+
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index cbe5a88..a1d53b6 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -570,6 +570,21 @@
+ 
+ #define GEN6_BSD_RNCID			0x12198
+ 
+#define GEN7_FF_THREAD_MODE		0x20a0
+#define   GEN7_FF_SCHED_MASK		0x0077070
+#define   GEN7_FF_TS_SCHED_HS1		(0x5<<16)
+#define   GEN7_FF_TS_SCHED_HS0		(0x3<<16)
+#define   GEN7_FF_TS_SCHED_LOAD_BALANCE	(0x1<<16)
+#define   GEN7_FF_TS_SCHED_HW		(0x0<<16) /* Default */
+#define   GEN7_FF_VS_SCHED_HS1		(0x5<<12)
+#define   GEN7_FF_VS_SCHED_HS0		(0x3<<12)
+#define   GEN7_FF_VS_SCHED_LOAD_BALANCE	(0x1<<12) /* Default */
+#define   GEN7_FF_VS_SCHED_HW		(0x0<<12)
+#define   GEN7_FF_DS_SCHED_HS1		(0x5<<4)
+#define   GEN7_FF_DS_SCHED_HS0		(0x3<<4)
+#define   GEN7_FF_DS_SCHED_LOAD_BALANCE	(0x1<<4)  /* Default */
+#define   GEN7_FF_DS_SCHED_HW		(0x0<<4)
+
+ /*
+  * Framebuffer compression (915+ only)
+  */
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 390768f..68fa8f8 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -8245,6 +8245,18 @@ static void gen6_init_clock_gating(struct drm_device *dev)
+ 	}
+ }
+ 
+static void gen7_setup_fixed_func_scheduler(struct drm_i915_private *dev_priv)
+{
+	uint32_t reg = I915_READ(GEN7_FF_THREAD_MODE);
+
+	reg &= ~GEN7_FF_SCHED_MASK;
+	reg |= GEN7_FF_TS_SCHED_HW;
+	reg |= GEN7_FF_VS_SCHED_HW;
+	reg |= GEN7_FF_DS_SCHED_HW;
+
+	I915_WRITE(GEN7_FF_THREAD_MODE, reg);
+}
+
+ static void ivybridge_init_clock_gating(struct drm_device *dev)
+ {
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+@@ -8285,6 +8297,8 @@ static void ivybridge_init_clock_gating(struct drm_device *dev)
+ 			   DISPPLANE_TRICKLE_FEED_DISABLE);
+ 		intel_flush_display_plane(dev_priv, pipe);
+ 	}
+
+	gen7_setup_fixed_func_scheduler(dev_priv);
+ }
+ 
+ static void g4x_init_clock_gating(struct drm_device *dev)
+-- 
+1.7.9.5
+
@@ -0,0 +1,99 @@
+From 418111eaa285eb1418ef4634eb2a24e955d0c0a4 Mon Sep 17 00:00:00 2001
+From: Nicolas Pitre <nicolas.pitre@linaro.org>
+Date: Mon, 16 Apr 2012 19:16:54 -0400
+Subject: [PATCH 088/117] mmc: sdio: avoid spurious calls to interrupt
+ handlers
+
+commit bbbc4c4d8c5face097d695f9bf3a39647ba6b7e7 upstream.
+
+Commit 06e8935feb ("optimized SDIO IRQ handling for single irq")
+introduced some spurious calls to SDIO function interrupt handlers,
+such as when the SDIO IRQ thread is started, or the safety check
+performed upon a system resume.  Let's add a flag to perform the
+optimization only when a real interrupt is signaled by the host
+driver and we know there is no point confirming it.
+
+Reported-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
+Signed-off-by: Nicolas Pitre <nico@linaro.org>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/mmc/core/sdio.c     |    2 +-
+ drivers/mmc/core/sdio_irq.c |   11 +++++++----
+ include/linux/mmc/host.h    |    2 ++
+ 3 files changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c
+index 3ab565e..558a495 100644
+--- a/drivers/mmc/core/sdio.c
+++ b/drivers/mmc/core/sdio.c
+@@ -663,7 +663,7 @@ static int mmc_sdio_resume(struct mmc_host *host)
+ 	}
+ 
+ 	if (!err && host->sdio_irqs)
+-		mmc_signal_sdio_irq(host);
+		wake_up_process(host->sdio_irq_thread);
+ 	mmc_release_host(host);
+ 
+ 	/*
+diff --git a/drivers/mmc/core/sdio_irq.c b/drivers/mmc/core/sdio_irq.c
+index 68f81b9..9dd0462 100644
+--- a/drivers/mmc/core/sdio_irq.c
+++ b/drivers/mmc/core/sdio_irq.c
+@@ -28,18 +28,20 @@
+ 
+ #include "sdio_ops.h"
+ 
+-static int process_sdio_pending_irqs(struct mmc_card *card)
+static int process_sdio_pending_irqs(struct mmc_host *host)
+ {
+	struct mmc_card *card = host->card;
+ 	int i, ret, count;
+ 	unsigned char pending;
+ 	struct sdio_func *func;
+ 
+ 	/*
+ 	 * Optimization, if there is only 1 function interrupt registered
+-	 * call irq handler directly
+	 * and we know an IRQ was signaled then call irq handler directly.
+	 * Otherwise do the full probe.
+ 	 */
+ 	func = card->sdio_single_irq;
+-	if (func) {
+	if (func && host->sdio_irq_pending) {
+ 		func->irq_handler(func);
+ 		return 1;
+ 	}
+@@ -116,7 +118,8 @@ static int sdio_irq_thread(void *_host)
+ 		ret = __mmc_claim_host(host, &host->sdio_irq_thread_abort);
+ 		if (ret)
+ 			break;
+-		ret = process_sdio_pending_irqs(host->card);
+		ret = process_sdio_pending_irqs(host);
+		host->sdio_irq_pending = false;
+ 		mmc_release_host(host);
+ 
+ 		/*
+diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
+index a3ac9c4..deb6282 100644
+--- a/include/linux/mmc/host.h
+++ b/include/linux/mmc/host.h
+@@ -303,6 +303,7 @@ struct mmc_host {
+ 
+ 	unsigned int		sdio_irqs;
+ 	struct task_struct	*sdio_irq_thread;
+	bool			sdio_irq_pending;
+ 	atomic_t		sdio_irq_thread_abort;
+ 
+ 	mmc_pm_flag_t		pm_flags;	/* requested pm features */
+@@ -356,6 +357,7 @@ extern int mmc_cache_ctrl(struct mmc_host *, u8);
+ static inline void mmc_signal_sdio_irq(struct mmc_host *host)
+ {
+ 	host->ops->enable_sdio_irq(host, 0);
+	host->sdio_irq_pending = true;
+ 	wake_up_process(host->sdio_irq_thread);
+ }
+ 
+-- 
+1.7.9.5
+
@@ -0,0 +1,31 @@
+From f408079974e4190a820716d82a01af3f3201cd56 Mon Sep 17 00:00:00 2001
+From: Michael Krufky <mkrufky@linuxtv.org>
+Date: Thu, 22 Mar 2012 13:55:05 -0300
+Subject: [PATCH 089/117] smsusb: add autodetection support for USB ID
+ 2040:c0a0
+
+commit 4d1b58b84472d1d300a66e1c5fd765b21e74ba15 upstream.
+
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/media/dvb/siano/smsusb.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/dvb/siano/smsusb.c b/drivers/media/dvb/siano/smsusb.c
+index 51c7121..b7d1e3e 100644
+--- a/drivers/media/dvb/siano/smsusb.c
+++ b/drivers/media/dvb/siano/smsusb.c
+@@ -542,6 +542,8 @@ static const struct usb_device_id smsusb_id_table[] __devinitconst = {
+ 		.driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
+ 	{ USB_DEVICE(0x2040, 0xc090),
+ 		.driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
+	{ USB_DEVICE(0x2040, 0xc0a0),
+		.driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
+ 	{ } /* Terminating entry */
+ 	};
+ 
+-- 
+1.7.9.5
+
@@ -0,0 +1,34 @@
+From 1565ef649160b0fb7c0911ce172ecc475db2741e Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Wed, 21 Mar 2012 09:50:36 -0300
+Subject: [PATCH 090/117] uvcvideo: Fix ENUMINPUT handling
+
+commit 31c5f0c5e25ed71eeced170f113bb590f2f1f6f3 upstream.
+
+Properly validate the user-supplied index against the number of inputs.
+The code used the pin local variable instead of the index by mistake.
+
+Reported-by: Jozef Vesely <vesely@gjh.sk>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/media/video/uvc/uvc_v4l2.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/video/uvc/uvc_v4l2.c b/drivers/media/video/uvc/uvc_v4l2.c
+index cf7788f..1030479 100644
+--- a/drivers/media/video/uvc/uvc_v4l2.c
+++ b/drivers/media/video/uvc/uvc_v4l2.c
+@@ -689,7 +689,7 @@ static long uvc_v4l2_do_ioctl(struct file *file, unsigned int cmd, void *arg)
+ 					break;
+ 			}
+ 			pin = iterm->id;
+-		} else if (pin < selector->bNrInPins) {
+		} else if (index < selector->bNrInPins) {
+ 			pin = selector->baSourceID[index];
+ 			list_for_each_entry(iterm, &chain->entities, chain) {
+ 				if (!UVC_ENTITY_IS_ITERM(iterm))
+-- 
+1.7.9.5
+
@@ -0,0 +1,63 @@
+From e7fcb3c81686f5853ff08909c0f580536291be51 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Wed, 9 May 2012 21:45:43 +0100
+Subject: [PATCH 091/117] drm/i915: Avoid a double-read of PCH_IIR during
+ interrupt handling
+
+commit 9adab8b5a7fde248504f484e197589f3e3c922e2 upstream.
+
+Currently the code re-reads PCH_IIR during the hotplug interrupt
+processing. Not only is this a wasted read, but introduces a potential
+for handling a spurious interrupt as we then may not clear all the
+interrupts processed (since the re-read IIR may contains more interrupts
+asserted than we clear using the result of the original read).
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/gpu/drm/i915/i915_irq.c |    9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
+index d47a53b..d3820c2 100644
+--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -424,14 +424,11 @@ static void gen6_pm_rps_work(struct work_struct *work)
+ 	mutex_unlock(&dev_priv->dev->struct_mutex);
+ }
+ 
+-static void pch_irq_handler(struct drm_device *dev)
+static void pch_irq_handler(struct drm_device *dev, u32 pch_iir)
+ {
+ 	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+-	u32 pch_iir;
+ 	int pipe;
+ 
+-	pch_iir = I915_READ(SDEIIR);
+-
+ 	if (pch_iir & SDE_AUDIO_POWER_MASK)
+ 		DRM_DEBUG_DRIVER("PCH audio power change on port %d\n",
+ 				 (pch_iir & SDE_AUDIO_POWER_MASK) >>
+@@ -529,7 +526,7 @@ static irqreturn_t ivybridge_irq_handler(DRM_IRQ_ARGS)
+ 	if (de_iir & DE_PCH_EVENT_IVB) {
+ 		if (pch_iir & SDE_HOTPLUG_MASK_CPT)
+ 			queue_work(dev_priv->wq, &dev_priv->hotplug_work);
+-		pch_irq_handler(dev);
+		pch_irq_handler(dev, pch_iir);
+ 	}
+ 
+ 	if (pm_iir & GEN6_PM_DEFERRED_EVENTS) {
+@@ -629,7 +626,7 @@ static irqreturn_t ironlake_irq_handler(DRM_IRQ_ARGS)
+ 	if (de_iir & DE_PCH_EVENT) {
+ 		if (pch_iir & hotplug_mask)
+ 			queue_work(dev_priv->wq, &dev_priv->hotplug_work);
+-		pch_irq_handler(dev);
+		pch_irq_handler(dev, pch_iir);
+ 	}
+ 
+ 	if (de_iir & DE_PCU_EVENT) {
+-- 
+1.7.9.5
+
@@ -0,0 +1,35 @@
+From 6f8ba55029ac1a15f55de85122401036a08d6b89 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sun, 6 May 2012 16:01:05 -0500
+Subject: [PATCH 092/117] b43legacy: Fix error due to MMIO access with SSB
+ unpowered
+
+commit 8f4b20388fa77226a3605627a33a23f90d559e50 upstream.
+
+There is a dummy read of a PCI MMIO register that occurs before the SSB bus
+has been powered, which is an error. This bug has not been seen earlier,
+but was apparently exposed when udev was updated to version 182.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/wireless/b43legacy/main.c |    2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
+index 20f0243..c5ce163 100644
+--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
+@@ -1564,8 +1564,6 @@ static int b43legacy_request_firmware(struct b43legacy_wldev *dev)
+ 	const char *filename;
+ 	int err;
+ 
+-	/* do dummy read */
+-	ssb_read32(dev->dev, SSB_TMSHIGH);
+ 	if (!fw->ucode) {
+ 		if (rev == 2)
+ 			filename = "ucode2";
+-- 
+1.7.9.5
+
@@ -0,0 +1,45 @@
+From 3a36f1d3f5cc6f221848df7c4cdc1269fc2085e9 Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Thu, 3 May 2012 12:22:06 +0200
+Subject: [PATCH 093/117] gpio: mpc8xxx: Prevent NULL pointer deref in demux
+ handler
+
+commit d6de85e85edcc38c9edcde45a0a568818fcddc13 upstream.
+
+commit cfadd838(powerpc/8xxx: Fix interrupt handling in MPC8xxx GPIO
+driver) added an unconditional call of chip->irq_eoi() to the demux
+handler.
+
+This leads to a NULL pointer derefernce on MPC512x platforms which use
+this driver as well.
+
+Make it conditional.
+
+Reported-by: Thomas Wucher <thwucher@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Felix Radensky <felix@embedded-sol.com>
+Cc: Kumar Gala <galak@kernel.crashing.org>
+Cc: Grant Likely <grant.likely@secretlab.ca>
+Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/gpio/gpio-mpc8xxx.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
+index 5cd04b6..edcffd6 100644
+--- a/drivers/gpio/gpio-mpc8xxx.c
+++ b/drivers/gpio/gpio-mpc8xxx.c
+@@ -163,7 +163,8 @@ static void mpc8xxx_gpio_irq_cascade(unsigned int irq, struct irq_desc *desc)
+ 	if (mask)
+ 		generic_handle_irq(irq_linear_revmap(mpc8xxx_gc->irq,
+ 						     32 - ffs(mask)));
+-	chip->irq_eoi(&desc->irq_data);
+	if (chip->irq_eoi)
+		chip->irq_eoi(&desc->irq_data);
+ }
+ 
+ static void mpc8xxx_irq_unmask(struct irq_data *d)
+-- 
+1.7.9.5
+
@@ -0,0 +1,52 @@
+From 031b0156d47e41f3815fcee8b2043c0b7d21dba0 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Sun, 13 May 2012 22:29:25 +0200
+Subject: [PATCH 094/117] drm/i915: don't clobber the pipe param in
+ sanitize_modesetting
+
+commit a9dcf84b14ef4e9a609910367576995e6f32f3dc upstream.
+
+... we need it later on in the function to clean up pipe <-> plane
+associations. This regression has been introduced in
+
+commit f47166d2b0001fcb752b40c5a2d4db986dfbea68
+Author: Chris Wilson <chris@chris-wilson.co.uk>
+Date:   Thu Mar 22 15:00:50 2012 +0000
+
+    drm/i915: Sanitize BIOS debugging bits from PIPECONF
+
+Spotted by staring at debug output of an (as it turns out) totally
+unrelated bug.
+
+v2: I've totally failed to do the s/pipe/i/ correctly, spotted by
+Chris Wilson.
+
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Reviewed-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
+Signed-Off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/gpu/drm/i915/intel_display.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 68fa8f8..3ff980d 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -7280,10 +7280,11 @@ static void intel_sanitize_modesetting(struct drm_device *dev,
+ {
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+ 	u32 reg, val;
+	int i;
+ 
+ 	/* Clear any frame start delays used for debugging left by the BIOS */
+-	for_each_pipe(pipe) {
+-		reg = PIPECONF(pipe);
+	for_each_pipe(i) {
+		reg = PIPECONF(i);
+ 		I915_WRITE(reg, I915_READ(reg) & ~PIPECONF_FRAME_START_DELAY_MASK);
+ 	}
+ 
+-- 
+1.7.9.5
+
@@ -0,0 +1,42 @@
+From ee003c924af5accb5545a0f07b09f488cdd16e76 Mon Sep 17 00:00:00 2001
+From: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
+Date: Fri, 11 May 2012 15:29:50 -0700
+Subject: [PATCH 095/117] spi/spi-fsl-spi: reference correct pdata in
+ fsl_spi_cs_control
+
+commit 067aa4815a9bc12a569d8a06afef50ba5773afbf upstream.
+
+Commit 178db7d3, "spi: Fix device unregistration when unregistering
+the bus master", changed spi device initialization of dev.parent pointer
+to be the master's device pointer instead of his parent.
+
+This introduced a bug in spi-fsl-spi, since its usage of spi device
+pointer was not updated accordingly. This was later fixed by commit
+5039a86, "spi/mpc83xx: fix NULL pdata dereference bug", but it missed
+another spot on fsl_spi_cs_control function where we also need to update
+usage of spi device pointer. This change address that.
+
+Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
+Acked-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
+Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/spi/spi-fsl-spi.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
+index 5f748c0..6a62934 100644
+--- a/drivers/spi/spi-fsl-spi.c
+++ b/drivers/spi/spi-fsl-spi.c
+@@ -933,7 +933,7 @@ err:
+ 
+ static void fsl_spi_cs_control(struct spi_device *spi, bool on)
+ {
+-	struct device *dev = spi->dev.parent;
+	struct device *dev = spi->dev.parent->parent;
+ 	struct mpc8xxx_spi_probe_info *pinfo = to_of_pinfo(dev->platform_data);
+ 	u16 cs = spi->chip_select;
+ 	int gpio = pinfo->gpios[cs];
+-- 
+1.7.9.5
+
@@ -0,0 +1,90 @@
+From ccee9896b442dd46dc0fd4c7ae4b9e8e470fab2b Mon Sep 17 00:00:00 2001
+From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
+Date: Mon, 21 May 2012 16:54:10 +0100
+Subject: [PATCH 096/117] xen: do not map the same GSI twice in PVHVM guests.
+
+commit 68c2c39a76b094e9b2773e5846424ea674bf2c46 upstream.
+
+PV on HVM guests map GSIs into event channels. At restore time the
+event channels are resumed by restore_pirqs.
+
+Device drivers might try to register the same GSI again through ACPI at
+restore time, but the GSI has already been mapped and bound by
+restore_pirqs. This patch detects these situations and avoids
+ mapping the same GSI multiple times.
+
+Without this patch we get:
+(XEN) irq.c:2235: dom4: pirq 23 or emuirq 28 already mapped
+and waste a pirq.
+
+Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/x86/pci/xen.c   |    4 ++++
+ drivers/xen/events.c |    5 +++--
+ include/xen/events.h |    3 +++
+ 3 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c
+index d99346e..4c262f6 100644
+--- a/arch/x86/pci/xen.c
+++ b/arch/x86/pci/xen.c
+@@ -64,6 +64,10 @@ static int xen_register_pirq(u32 gsi, int gsi_override, int triggering,
+ 	int shareable = 0;
+ 	char *name;
+ 
+	irq = xen_irq_from_gsi(gsi);
+	if (irq > 0)
+		return irq;
+
+ 	if (set_pirq)
+ 		pirq = gsi;
+ 
+diff --git a/drivers/xen/events.c b/drivers/xen/events.c
+index 6e075cd..fec1204 100644
+--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
+@@ -600,7 +600,7 @@ static void disable_pirq(struct irq_data *data)
+ 	disable_dynirq(data);
+ }
+ 
+-static int find_irq_by_gsi(unsigned gsi)
+int xen_irq_from_gsi(unsigned gsi)
+ {
+ 	struct irq_info *info;
+ 
+@@ -614,6 +614,7 @@ static int find_irq_by_gsi(unsigned gsi)
+ 
+ 	return -1;
+ }
+EXPORT_SYMBOL_GPL(xen_irq_from_gsi);
+ 
+ /*
+  * Do not make any assumptions regarding the relationship between the
+@@ -633,7 +634,7 @@ int xen_bind_pirq_gsi_to_irq(unsigned gsi,
+ 
+ 	mutex_lock(&irq_mapping_update_lock);
+ 
+-	irq = find_irq_by_gsi(gsi);
+	irq = xen_irq_from_gsi(gsi);
+ 	if (irq != -1) {
+ 		printk(KERN_INFO "xen_map_pirq_gsi: returning irq %d for gsi %u\n",
+ 		       irq, gsi);
+diff --git a/include/xen/events.h b/include/xen/events.h
+index d287997..8f3d622 100644
+--- a/include/xen/events.h
+++ b/include/xen/events.h
+@@ -96,6 +96,9 @@ int xen_irq_from_pirq(unsigned pirq);
+ /* Return the pirq allocated to the irq. */
+ int xen_pirq_from_irq(unsigned irq);
+ 
+/* Return the irq allocated to the gsi */
+int xen_irq_from_gsi(unsigned gsi);
+
+ /* Determine whether to ignore this IRQ if it is passed to a guest. */
+ int xen_test_irq_shared(int irq);
+ 
+-- 
+1.7.9.5
+
@@ -0,0 +1,32 @@
+From 49228e195ea0ed24fe598a16c8721ee019df508d Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Fri, 18 May 2012 15:31:12 +0100
+Subject: [PATCH 097/117] nouveau: nouveau_set_bo_placement takes TTM flags
+
+commit c284815debba2f14ee2fd07b1b4cc972ab116110 upstream.
+
+This seems to be wrong to me, spotted while thinking about dma-buf.
+
+Reviewed-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/gpu/drm/nouveau/nouveau_bo.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
+index 7cc37e6..d5af089 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
+@@ -1024,7 +1024,7 @@ nouveau_ttm_fault_reserve_notify(struct ttm_buffer_object *bo)
+ 
+ 	nvbo->placement.fpfn = 0;
+ 	nvbo->placement.lpfn = dev_priv->fb_mappable_pages;
+-	nouveau_bo_placement_set(nvbo, TTM_PL_VRAM, 0);
+	nouveau_bo_placement_set(nvbo, TTM_PL_FLAG_VRAM, 0);
+ 	return nouveau_bo_validate(nvbo, false, true, false);
+ }
+ 
+-- 
+1.7.9.5
+
@@ -0,0 +1,43 @@
+From 7a3402ddb979d26b777cc6f99824881af9362e8d Mon Sep 17 00:00:00 2001
+From: Andi Kleen <andi@firstfloor.org>
+Date: Fri, 19 Nov 2010 13:16:22 +0100
+Subject: [PATCH 098/117] MCE: Fix vm86 handling for 32bit mce handler
+
+commit a129a7c84582629741e5fa6f40026efcd7a65bd4 upstream.
+
+When running on 32bit the mce handler could misinterpret
+vm86 mode as ring 0. This can affect whether it does recovery
+or not; it was possible to panic when recovery was actually
+possible.
+
+Fix this by always forcing vm86 to look like ring 3.
+
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/x86/kernel/cpu/mcheck/mce.c |    8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
+index 2af127d..b0f1271 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -389,6 +389,14 @@ static inline void mce_gather_info(struct mce *m, struct pt_regs *regs)
+ 		if (m->mcgstatus & (MCG_STATUS_RIPV|MCG_STATUS_EIPV)) {
+ 			m->ip = regs->ip;
+ 			m->cs = regs->cs;
+
+			/*
+			 * When in VM86 mode make the cs look like ring 3
+			 * always. This is a lie, but it's better than passing
+			 * the additional vm86 bit around everywhere.
+			 */
+			if (v8086_mode(regs))
+				m->cs |= 3;
+ 		}
+ 		/* Use accurate RIP reporting if available. */
+ 		if (rip_msr)
+-- 
+1.7.9.5
+
@@ -0,0 +1,53 @@
+From 7938ffb57366a0e5f4b878955148f515d9940453 Mon Sep 17 00:00:00 2001
+From: Tony Luck <tony.luck@intel.com>
+Date: Wed, 23 May 2012 14:14:22 -0700
+Subject: [PATCH 099/117] x86/mce: Fix check for processor context when
+ machine check was taken.
+
+commit 875e26648cf9b6db9d8dc07b7959d7c61fb3f49c upstream.
+
+Linus pointed out that there was no value is checking whether m->ip
+was zero - because zero is a legimate value.  If we have a reliable
+(or faked in the VM86 case) "m->cs" we can use it to tell whether we
+were in user mode or kernelwhen the machine check hit.
+
+Reported-by: Linus Torvalds <torvalds@linuxfoundation.org>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/x86/kernel/cpu/mcheck/mce-severity.c |   16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/mcheck/mce-severity.c b/arch/x86/kernel/cpu/mcheck/mce-severity.c
+index 7395d5f..c9c9cfe 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce-severity.c
+++ b/arch/x86/kernel/cpu/mcheck/mce-severity.c
+@@ -145,15 +145,19 @@ static struct severity {
+ };
+ 
+ /*
+- * If the EIPV bit is set, it means the saved IP is the
+- * instruction which caused the MCE.
+ * If mcgstatus indicated that ip/cs on the stack were
+ * no good, then "m->cs" will be zero and we will have
+ * to assume the worst case (IN_KERNEL) as we actually
+ * have no idea what we were executing when the machine
+ * check hit.
+ * If we do have a good "m->cs" (or a faked one in the
+ * case we were executing in VM86 mode) we can use it to
+ * distinguish an exception taken in user from from one
+ * taken in the kernel.
+  */
+ static int error_context(struct mce *m)
+ {
+-	if (m->mcgstatus & MCG_STATUS_EIPV)
+-		return (m->ip && (m->cs & 3) == 3) ? IN_USER : IN_KERNEL;
+-	/* Unknown, assume kernel */
+-	return IN_KERNEL;
+	return ((m->cs & 3) == 3) ? IN_USER : IN_KERNEL;
+ }
+ 
+ int mce_severity(struct mce *m, int tolerant, char **msg)
+-- 
+1.7.9.5
+
--- a/Show More
+++ b/Show More