linux-ti33x-psp 3.2: update to 3.2.18

Duplicate patches between PSP and 3.2.17 have been dropped from the 3.2.17 series Signed-off-by: Koen Kooi <koen@dominion.thruhere.net> Signed-off-by: Denys Dmytriyenko <denys@ti.com>
2026-06-06 10:50:37 +00:00 · 2012-05-23 11:20:07 +02:00
parent d9d51a11b8
commit 2177f80076
223 changed files with 14794 additions and 2 deletions
@@ -4,7 +4,7 @@ require conf/machine/include/soc-family.inc
 require conf/machine/include/tune-cortexa8.inc
 PREFERRED_PROVIDER_virtual/kernel = "linux-ti33x-psp"
 # Increase this everytime you change something in the kernel
-MACHINE_KERNEL_PR = "r11"
+MACHINE_KERNEL_PR = "r12"

 KERNEL_IMAGETYPE = "uImage"

@@ -0,0 +1,37 @@
+From 56ff3a4557bf6cd95220c643eb6fdf28db222370 Mon Sep 17 00:00:00 2001
+From: Kent Yoder <key@linux.vnet.ibm.com>
+Date: Thu, 5 Apr 2012 20:34:20 +0800
+Subject: [PATCH 001/165] crypto: sha512 - Fix byte counter overflow in
+ SHA-512
+
+commit 25c3d30c918207556ae1d6e663150ebdf902186b upstream.
+
+The current code only increments the upper 64 bits of the SHA-512 byte
+counter when the number of bytes hashed happens to hit 2^64 exactly.
+
+This patch increments the upper 64 bits whenever the lower 64 bits
+overflows.
+
+Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ crypto/sha512_generic.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/crypto/sha512_generic.c b/crypto/sha512_generic.c
+index 107f6f7..dd30f40 100644
+--- a/crypto/sha512_generic.c
+++ b/crypto/sha512_generic.c
+@@ -174,7 +174,7 @@ sha512_update(struct shash_desc *desc, const u8 *data, unsigned int len)
+ 	index = sctx->count[0] & 0x7f;
+ 
+ 	/* Update number of bytes */
+-	if (!(sctx->count[0] += len))
+	if ((sctx->count[0] += len) < len)
+ 		sctx->count[1]++;
+ 
+         part_len = 128 - index;
+-- 
+1.7.7.6
+
@@ -0,0 +1,43 @@
+From b5fdd927a3527e8ed9a882d3c72e32435fa71dd3 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 19 Apr 2012 15:15:25 +0200
+Subject: [PATCH 002/165] ALSA: hda/conexant - Don't set HP pin-control bit
+ unconditionally
+
+commit ca3649de026ff95c6f2847e8d096cf2f411c02b3 upstream.
+
+Some output pins on Conexant chips have no HP control bit, but the
+auto-parser initializes these pins unconditionally with PIN_HP.
+
+Check the pin-capability and avoid the HP bit if not supported.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ sound/pci/hda/patch_conexant.c |    9 +++++++--
+ 1 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index ae94929..99a3378 100644
+--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
+@@ -4003,9 +4003,14 @@ static void cx_auto_init_output(struct hda_codec *codec)
+ 	int i;
+ 
+ 	mute_outputs(codec, spec->multiout.num_dacs, spec->multiout.dac_nids);
+-	for (i = 0; i < cfg->hp_outs; i++)
+	for (i = 0; i < cfg->hp_outs; i++) {
+		unsigned int val = PIN_OUT;
+		if (snd_hda_query_pin_caps(codec, cfg->hp_pins[i]) &
+		    AC_PINCAP_HP_DRV)
+			val |= AC_PINCTL_HP_EN;
+ 		snd_hda_codec_write(codec, cfg->hp_pins[i], 0,
+-				    AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_HP);
+				    AC_VERB_SET_PIN_WIDGET_CONTROL, val);
+	}
+ 	mute_outputs(codec, cfg->hp_outs, cfg->hp_pins);
+ 	mute_outputs(codec, cfg->line_outs, cfg->line_out_pins);
+ 	mute_outputs(codec, cfg->speaker_outs, cfg->speaker_pins);
+-- 
+1.7.7.6
+
@@ -0,0 +1,99 @@
+From 859f08d45339917d263a366170476c1f8389a2ea Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 19 Apr 2012 15:18:08 +0200
+Subject: [PATCH 003/165] ALSA: hda/conexant - Set up the missing
+ docking-station pins
+
+commit d70f363222ef373c2037412f09a600357cfa1c7a upstream.
+
+ThinkPad 410,420,510,520 and X201 with cx50585 & co chips have the
+docking-station ports, but BIOS doesn't initialize for these pins.
+Thus, like the former X200, we need to set up the pins manually in the
+driver.
+
+The odd part is that the same PCI SSID is used for X200 and T400, thus
+we need to prepare individual fixup tables for cx5051 and others.
+
+Bugzilla entries:
+	https://bugzilla.redhat.com/show_bug.cgi?id=808559
+	https://bugzilla.redhat.com/show_bug.cgi?id=806217
+	https://bugzilla.redhat.com/show_bug.cgi?id=810697
+
+Reported-by: Josh Boyer <jwboyer@redhat.com>
+Reported-by: Jens Taprogge <jens.taprogge@taprogge.org>
+Tested-by: Jens Taprogge <jens.taprogge@taprogge.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ sound/pci/hda/patch_conexant.c |   28 +++++++++++++++++++++++++---
+ 1 files changed, 25 insertions(+), 3 deletions(-)
+
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 99a3378..51a1afc 100644
+--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
+@@ -4413,8 +4413,10 @@ static void apply_pin_fixup(struct hda_codec *codec,
+ 
+ enum {
+ 	CXT_PINCFG_LENOVO_X200,
+	CXT_PINCFG_LENOVO_TP410,
+ };
+ 
+/* ThinkPad X200 & co with cxt5051 */
+ static const struct cxt_pincfg cxt_pincfg_lenovo_x200[] = {
+ 	{ 0x16, 0x042140ff }, /* HP (seq# overridden) */
+ 	{ 0x17, 0x21a11000 }, /* dock-mic */
+@@ -4422,15 +4424,33 @@ static const struct cxt_pincfg cxt_pincfg_lenovo_x200[] = {
+ 	{}
+ };
+ 
+/* ThinkPad 410/420/510/520, X201 & co with cxt5066 */
+static const struct cxt_pincfg cxt_pincfg_lenovo_tp410[] = {
+	{ 0x19, 0x042110ff }, /* HP (seq# overridden) */
+	{ 0x1a, 0x21a190f0 }, /* dock-mic */
+	{ 0x1c, 0x212140ff }, /* dock-HP */
+	{}
+};
+
+ static const struct cxt_pincfg *cxt_pincfg_tbl[] = {
+ 	[CXT_PINCFG_LENOVO_X200] = cxt_pincfg_lenovo_x200,
+	[CXT_PINCFG_LENOVO_TP410] = cxt_pincfg_lenovo_tp410,
+ };
+ 
+-static const struct snd_pci_quirk cxt_fixups[] = {
+static const struct snd_pci_quirk cxt5051_fixups[] = {
+ 	SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo X200", CXT_PINCFG_LENOVO_X200),
+ 	{}
+ };
+ 
+static const struct snd_pci_quirk cxt5066_fixups[] = {
+	SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),
+	SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo T410", CXT_PINCFG_LENOVO_TP410),
+	SND_PCI_QUIRK(0x17aa, 0x215f, "Lenovo T510", CXT_PINCFG_LENOVO_TP410),
+	SND_PCI_QUIRK(0x17aa, 0x21ce, "Lenovo T420", CXT_PINCFG_LENOVO_TP410),
+	SND_PCI_QUIRK(0x17aa, 0x21cf, "Lenovo T520", CXT_PINCFG_LENOVO_TP410),
+	{}
+};
+
+ /* add "fake" mute amp-caps to DACs on cx5051 so that mixer mute switches
+  * can be created (bko#42825)
+  */
+@@ -4467,11 +4487,13 @@ static int patch_conexant_auto(struct hda_codec *codec)
+ 		break;
+ 	case 0x14f15051:
+ 		add_cx5051_fake_mutes(codec);
+		apply_pin_fixup(codec, cxt5051_fixups, cxt_pincfg_tbl);
+		break;
+	default:
+		apply_pin_fixup(codec, cxt5066_fixups, cxt_pincfg_tbl);
+ 		break;
+ 	}
+ 
+-	apply_pin_fixup(codec, cxt_fixups, cxt_pincfg_tbl);
+-
+ 	err = cx_auto_search_adcs(codec);
+ 	if (err < 0)
+ 		return err;
+-- 
+1.7.7.6
+
@@ -0,0 +1,54 @@
+From 36a5e353678eb6856bf90e322b815865abf4c660 Mon Sep 17 00:00:00 2001
+From: Alexander Shiyan <shc_work@mail.ru>
+Date: Tue, 27 Mar 2012 12:22:49 +0400
+Subject: [PATCH 004/165] ARM: clps711x: serial driver hungs are a result of
+ call disable_irq within ISR
+
+commit 7a6fbc9a887193a1e9f8658703881c528040afbc upstream.
+
+Since 2.6.30-rc1 clps711x serial driver hungs system. This is a result
+of call disable_irq from ISR. synchronize_irq waits for end of interrupt
+and goes to infinite loop. This patch fix this problem.
+
+Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/tty/serial/clps711x.c |   14 ++++++++------
+ 1 files changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/tty/serial/clps711x.c b/drivers/tty/serial/clps711x.c
+index e6c3dbd..836fe273 100644
+--- a/drivers/tty/serial/clps711x.c
+++ b/drivers/tty/serial/clps711x.c
+@@ -154,10 +154,9 @@ static irqreturn_t clps711xuart_int_tx(int irq, void *dev_id)
+ 		port->x_char = 0;
+ 		return IRQ_HANDLED;
+ 	}
+-	if (uart_circ_empty(xmit) || uart_tx_stopped(port)) {
+-		clps711xuart_stop_tx(port);
+-		return IRQ_HANDLED;
+-	}
+
+	if (uart_circ_empty(xmit) || uart_tx_stopped(port))
+		goto disable_tx_irq;
+ 
+ 	count = port->fifosize >> 1;
+ 	do {
+@@ -171,8 +170,11 @@ static irqreturn_t clps711xuart_int_tx(int irq, void *dev_id)
+ 	if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
+ 		uart_write_wakeup(port);
+ 
+-	if (uart_circ_empty(xmit))
+-		clps711xuart_stop_tx(port);
+	if (uart_circ_empty(xmit)) {
+	disable_tx_irq:
+		disable_irq_nosync(TX_IRQ(port));
+		tx_enabled(port) = 0;
+	}
+ 
+ 	return IRQ_HANDLED;
+ }
+-- 
+1.7.7.6
+
@@ -0,0 +1,58 @@
+From 69c74a3f01d30c6dd44991f6413a4f317f4591a7 Mon Sep 17 00:00:00 2001
+From: Paul Walmsley <paul@pwsan.com>
+Date: Tue, 10 Apr 2012 18:36:02 -0600
+Subject: [PATCH 005/165] ARM: OMAP1: DMTIMER: fix broken timer clock source
+ selection
+
+commit 6aaec67da1e41a0752a2b903b989e73b9f02e182 upstream.
+
+DMTIMER source selection on OMAP1 is broken.  omap1_dm_timer_set_src()
+tries to use __raw_{read,write}l() to read from and write to physical
+addresses, but those functions take virtual addresses.
+
+sparse caught this:
+
+arch/arm/mach-omap1/timer.c:50:13: warning: incorrect type in argument 1 (different base types)
+arch/arm/mach-omap1/timer.c:50:13:    expected void const volatile [noderef] <asn:2>*<noident>
+arch/arm/mach-omap1/timer.c:50:13:    got unsigned int
+arch/arm/mach-omap1/timer.c:52:9: warning: incorrect type in argument 1 (different base types)
+arch/arm/mach-omap1/timer.c:52:9:    expected void const volatile [noderef] <asn:2>*<noident>
+arch/arm/mach-omap1/timer.c:52:9:    got unsigned int
+
+Fix by using omap_{read,writel}(), just like the other users of the
+MOD_CONF_CTRL_1 register in the OMAP1 codebase.  Of course, in the long term,
+removing omap_{read,write}l() is the appropriate thing to do; but
+this will take some work to do this cleanly.
+
+Looks like this was caused by 97933d6 (ARM: OMAP1: dmtimer: conversion
+to platform devices) that dangerously moved code and changed it in
+the same patch.
+
+Signed-off-by: Paul Walmsley <paul@pwsan.com>
+Cc: Tarun Kanti DebBarma <tarun.kanti@ti.com>
+[tony@atomide.com: updated comments to include the breaking commit]
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/arm/mach-omap1/timer.c |    4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/mach-omap1/timer.c b/arch/arm/mach-omap1/timer.c
+index 6e90665..fb202af 100644
+--- a/arch/arm/mach-omap1/timer.c
+++ b/arch/arm/mach-omap1/timer.c
+@@ -47,9 +47,9 @@ static int omap1_dm_timer_set_src(struct platform_device *pdev,
+ 	int n = (pdev->id - 1) << 1;
+ 	u32 l;
+ 
+-	l = __raw_readl(MOD_CONF_CTRL_1) & ~(0x03 << n);
+	l = omap_readl(MOD_CONF_CTRL_1) & ~(0x03 << n);
+ 	l |= source << n;
+-	__raw_writel(l, MOD_CONF_CTRL_1);
+	omap_writel(l, MOD_CONF_CTRL_1);
+ 
+ 	return 0;
+ }
+-- 
+1.7.7.6
+
@@ -0,0 +1,72 @@
+From 23e70c192386ff8d0e33f9b9225d984ae5eea97b Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Thu, 5 Apr 2012 14:45:47 +0300
+Subject: [PATCH 006/165] mmc: fixes for eMMC v4.5 discard operation
+
+commit 7194efb8f063ee3aa0cb50d9002348887e68ec10 upstream.
+
+eMMC v4.5 discard operation is significantly different from the
+existing trim operation because it is not guaranteed to work with
+the new sanitize operation.  Consequently mmc_can_trim() is
+separated from mmc_can_discard().
+
+Also the new discard operation does not result in the sectors being
+set to all-zeros, so discard_zeroes_data must not be set.
+
+In addition, the new discard has the same timeout as trim, but from
+v4.5 trim is defined to use the hc timeout.  The timeout calculation
+is adjusted accordingly.
+
+Fixes apply to linux 3.2 on.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Acked-by: Jaehoon Chung <jh80.chung@samsung.com>
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/mmc/card/queue.c |    2 +-
+ drivers/mmc/core/core.c  |    7 ++++---
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mmc/card/queue.c b/drivers/mmc/card/queue.c
+index dcad59c..78690f2 100644
+--- a/drivers/mmc/card/queue.c
+++ b/drivers/mmc/card/queue.c
+@@ -134,7 +134,7 @@ static void mmc_queue_setup_discard(struct request_queue *q,
+ 
+ 	queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, q);
+ 	q->limits.max_discard_sectors = max_discard;
+-	if (card->erased_byte == 0)
+	if (card->erased_byte == 0 && !mmc_can_discard(card))
+ 		q->limits.discard_zeroes_data = 1;
+ 	q->limits.discard_granularity = card->pref_erase << 9;
+ 	/* granularity must not be greater than max. discard */
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index 950b97d..c420a9e 100644
+--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
+@@ -1516,7 +1516,10 @@ static unsigned int mmc_mmc_erase_timeout(struct mmc_card *card,
+ {
+ 	unsigned int erase_timeout;
+ 
+-	if (card->ext_csd.erase_group_def & 1) {
+	if (arg == MMC_DISCARD_ARG ||
+	    (arg == MMC_TRIM_ARG && card->ext_csd.rev >= 6)) {
+		erase_timeout = card->ext_csd.trim_timeout;
+	} else if (card->ext_csd.erase_group_def & 1) {
+ 		/* High Capacity Erase Group Size uses HC timeouts */
+ 		if (arg == MMC_TRIM_ARG)
+ 			erase_timeout = card->ext_csd.trim_timeout;
+@@ -1788,8 +1791,6 @@ int mmc_can_trim(struct mmc_card *card)
+ {
+ 	if (card->ext_csd.sec_feature_support & EXT_CSD_SEC_GB_CL_EN)
+ 		return 1;
+-	if (mmc_can_discard(card))
+-		return 1;
+ 	return 0;
+ }
+ EXPORT_SYMBOL(mmc_can_trim);
+-- 
+1.7.7.6
+
@@ -0,0 +1,136 @@
+From 6e1972f1214d5827d22d15985bb50d1e05307e7e Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Thu, 5 Apr 2012 14:45:48 +0300
+Subject: [PATCH 007/165] mmc: fixes for eMMC v4.5 sanitize operation
+
+commit 283028122db37621b124f079ca8eae5b64807ad4 upstream.
+
+eMMC v4.5 sanitize operation erases all copies of unmapped
+data.  However trim or erase operations must be used first
+to unmap the required sectors.  That was not being done.
+
+Fixes apply to linux 3.2 on.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Acked-by: Jaehoon Chung <jh80.chung@samsung.com>
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/mmc/card/block.c |   54 ++++++++++++++++++++++++++++++++-------------
+ drivers/mmc/core/core.c  |    2 +
+ 2 files changed, 40 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
+index 60e8951..6679c4f 100644
+--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
+@@ -799,7 +799,7 @@ static int mmc_blk_issue_secdiscard_rq(struct mmc_queue *mq,
+ {
+ 	struct mmc_blk_data *md = mq->data;
+ 	struct mmc_card *card = md->queue.card;
+-	unsigned int from, nr, arg;
+	unsigned int from, nr, arg, trim_arg, erase_arg;
+ 	int err = 0, type = MMC_BLK_SECDISCARD;
+ 
+ 	if (!(mmc_can_secure_erase_trim(card) || mmc_can_sanitize(card))) {
+@@ -807,20 +807,26 @@ static int mmc_blk_issue_secdiscard_rq(struct mmc_queue *mq,
+ 		goto out;
+ 	}
+ 
+	from = blk_rq_pos(req);
+	nr = blk_rq_sectors(req);
+
+ 	/* The sanitize operation is supported at v4.5 only */
+ 	if (mmc_can_sanitize(card)) {
+-		err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
+-				EXT_CSD_SANITIZE_START, 1, 0);
+-		goto out;
+		erase_arg = MMC_ERASE_ARG;
+		trim_arg = MMC_TRIM_ARG;
+	} else {
+		erase_arg = MMC_SECURE_ERASE_ARG;
+		trim_arg = MMC_SECURE_TRIM1_ARG;
+ 	}
+ 
+-	from = blk_rq_pos(req);
+-	nr = blk_rq_sectors(req);
+-
+-	if (mmc_can_trim(card) && !mmc_erase_group_aligned(card, from, nr))
+-		arg = MMC_SECURE_TRIM1_ARG;
+-	else
+-		arg = MMC_SECURE_ERASE_ARG;
+	if (mmc_erase_group_aligned(card, from, nr))
+		arg = erase_arg;
+	else if (mmc_can_trim(card))
+		arg = trim_arg;
+	else {
+		err = -EINVAL;
+		goto out;
+	}
+ retry:
+ 	if (card->quirks & MMC_QUIRK_INAND_CMD38) {
+ 		err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
+@@ -830,25 +836,41 @@ retry:
+ 				 INAND_CMD38_ARG_SECERASE,
+ 				 0);
+ 		if (err)
+-			goto out;
+			goto out_retry;
+ 	}
+
+ 	err = mmc_erase(card, from, nr, arg);
+-	if (!err && arg == MMC_SECURE_TRIM1_ARG) {
+	if (err == -EIO)
+		goto out_retry;
+	if (err)
+		goto out;
+
+	if (arg == MMC_SECURE_TRIM1_ARG) {
+ 		if (card->quirks & MMC_QUIRK_INAND_CMD38) {
+ 			err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
+ 					 INAND_CMD38_ARG_EXT_CSD,
+ 					 INAND_CMD38_ARG_SECTRIM2,
+ 					 0);
+ 			if (err)
+-				goto out;
+				goto out_retry;
+ 		}
+
+ 		err = mmc_erase(card, from, nr, MMC_SECURE_TRIM2_ARG);
+		if (err == -EIO)
+			goto out_retry;
+		if (err)
+			goto out;
+ 	}
+-out:
+-	if (err == -EIO && !mmc_blk_reset(md, card->host, type))
+
+	if (mmc_can_sanitize(card))
+		err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
+				 EXT_CSD_SANITIZE_START, 1, 0);
+out_retry:
+	if (err && !mmc_blk_reset(md, card->host, type))
+ 		goto retry;
+ 	if (!err)
+ 		mmc_blk_reset_success(md, type);
+out:
+ 	spin_lock_irq(&md->lock);
+ 	__blk_end_request(req, err, blk_rq_bytes(req));
+ 	spin_unlock_irq(&md->lock);
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index c420a9e..411a994 100644
+--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
+@@ -1809,6 +1809,8 @@ EXPORT_SYMBOL(mmc_can_discard);
+ 
+ int mmc_can_sanitize(struct mmc_card *card)
+ {
+	if (!mmc_can_trim(card) && !mmc_can_erase(card))
+		return 0;
+ 	if (card->ext_csd.sec_feature_support & EXT_CSD_SEC_SANITIZE)
+ 		return 1;
+ 	return 0;
+-- 
+1.7.7.6
+
@@ -0,0 +1,40 @@
+From 5c4111343e2cb543a436cd23d7633a513fd8385d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Eric=20B=C3=A9nard?= <eric@eukrea.com>
+Date: Wed, 18 Apr 2012 02:30:20 +0200
+Subject: [PATCH 008/165] mmc: unbreak sdhci-esdhc-imx on i.MX25
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit b89152824f993a9572b47eb31f4579feadeac34c upstream.
+
+This was broken by me in 37865fe91582582a6f6c00652f6a2b1ff71f8a78
+("mmc: sdhci-esdhc-imx: fix timeout on i.MX's sdhci") where more
+extensive tests would have shown that read or write of data to the
+card were failing (even if the partition table was correctly read).
+
+Signed-off-by: Eric Bénard <eric@eukrea.com>
+Acked-by: Wolfram Sang <w.sang@pengutronix.de>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/mmc/host/sdhci-esdhc-imx.c |    3 +--
+ 1 files changed, 1 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
+index 4540e37..1b47937 100644
+--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
+@@ -467,8 +467,7 @@ static int __devinit sdhci_esdhc_imx_probe(struct platform_device *pdev)
+ 	clk_enable(clk);
+ 	pltfm_host->clk = clk;
+ 
+-	if (!is_imx25_esdhc(imx_data))
+-		host->quirks |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL;
+	host->quirks |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL;
+ 
+ 	if (is_imx25_esdhc(imx_data) || is_imx35_esdhc(imx_data))
+ 		/* Fix errata ENGcm07207 present on i.MX25 and i.MX35 */
+-- 
+1.7.7.6
+
@@ -0,0 +1,37 @@
+From ccc1f53caca147badfafce099bd995a33d04880a Mon Sep 17 00:00:00 2001
+From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
+Date: Tue, 3 Apr 2012 18:05:47 +0100
+Subject: [PATCH 009/165] xen/gntdev: do not set VM_PFNMAP
+
+commit e8e937be971d706061dc56220ff3605ab77622a7 upstream.
+
+Since we are using the m2p_override we do have struct pages
+corresponding to the user vma mmap'ed by gntdev.
+
+Removing the VM_PFNMAP flag makes get_user_pages work on that vma.
+An example test case would be using a Xen userspace block backend
+(QDISK) on a file on NFS using O_DIRECT.
+
+Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/xen/gntdev.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
+index afca14d..625890c 100644
+--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
+@@ -692,7 +692,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
+ 	vma->vm_flags |= VM_RESERVED|VM_DONTEXPAND;
+ 
+ 	if (use_ptemod)
+-		vma->vm_flags |= VM_DONTCOPY|VM_PFNMAP;
+		vma->vm_flags |= VM_DONTCOPY;
+ 
+ 	vma->vm_private_data = map;
+ 
+-- 
+1.7.7.6
+
@@ -0,0 +1,151 @@
+From a3da8d9a1658c86fb74dbd35b8bda473d8fe0717 Mon Sep 17 00:00:00 2001
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Date: Tue, 17 Apr 2012 22:21:38 -0400
+Subject: [PATCH 010/165] xen/xenbus: Add quirk to deal with misconfigured
+ backends.
+
+commit 3066616ce23aad5719c23a0f21f32676402cb44b upstream.
+
+A rather annoying and common case is when booting a PVonHVM guest
+and exposing the PV KBD and PV VFB - as broken toolstacks don't
+always initialize the backends correctly.
+
+Normally The HVM guest is using the VGA driver and the emulated
+keyboard for this (though upstream version of QEMU implements
+PV KBD, but still uses a VGA driver). We provide a very basic
+two-stage wait mechanism - where we wait for 30 seconds for all
+devices, and then for 270 for all them except the two mentioned.
+
+That allows us to wait for the essential devices, like network
+or disk for the full 6 minutes.
+
+To trigger this, put this in your guest config:
+
+vfb = [ 'vnc=1, vnclisten=0.0.0.0 ,vncunused=1']
+
+instead of this:
+vnc=1
+vnclisten="0.0.0.0"
+
+Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
+[v3: Split delay in non-essential (30 seconds) and essential
+ devices per Ian and Stefano suggestion]
+[v4: Added comments per Stefano suggestion]
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/xen/xenbus/xenbus_probe_frontend.c |   69 +++++++++++++++++++++------
+ 1 files changed, 53 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c
+index 2f73195..2ce95c0 100644
+--- a/drivers/xen/xenbus/xenbus_probe_frontend.c
+++ b/drivers/xen/xenbus/xenbus_probe_frontend.c
+@@ -129,7 +129,7 @@ static int read_backend_details(struct xenbus_device *xendev)
+ 	return xenbus_read_otherend_details(xendev, "backend-id", "backend");
+ }
+ 
+-static int is_device_connecting(struct device *dev, void *data)
+static int is_device_connecting(struct device *dev, void *data, bool ignore_nonessential)
+ {
+ 	struct xenbus_device *xendev = to_xenbus_device(dev);
+ 	struct device_driver *drv = data;
+@@ -146,16 +146,41 @@ static int is_device_connecting(struct device *dev, void *data)
+ 	if (drv && (dev->driver != drv))
+ 		return 0;
+ 
+	if (ignore_nonessential) {
+		/* With older QEMU, for PVonHVM guests the guest config files
+		 * could contain: vfb = [ 'vnc=1, vnclisten=0.0.0.0']
+		 * which is nonsensical as there is no PV FB (there can be
+		 * a PVKB) running as HVM guest. */
+
+		if ((strncmp(xendev->nodename, "device/vkbd", 11) == 0))
+			return 0;
+
+		if ((strncmp(xendev->nodename, "device/vfb", 10) == 0))
+			return 0;
+	}
+ 	xendrv = to_xenbus_driver(dev->driver);
+ 	return (xendev->state < XenbusStateConnected ||
+ 		(xendev->state == XenbusStateConnected &&
+ 		 xendrv->is_ready && !xendrv->is_ready(xendev)));
+ }
+static int essential_device_connecting(struct device *dev, void *data)
+{
+	return is_device_connecting(dev, data, true /* ignore PV[KBB+FB] */);
+}
+static int non_essential_device_connecting(struct device *dev, void *data)
+{
+	return is_device_connecting(dev, data, false);
+}
+ 
+-static int exists_connecting_device(struct device_driver *drv)
+static int exists_essential_connecting_device(struct device_driver *drv)
+ {
+ 	return bus_for_each_dev(&xenbus_frontend.bus, NULL, drv,
+-				is_device_connecting);
+				essential_device_connecting);
+}
+static int exists_non_essential_connecting_device(struct device_driver *drv)
+{
+	return bus_for_each_dev(&xenbus_frontend.bus, NULL, drv,
+				non_essential_device_connecting);
+ }
+ 
+ static int print_device_status(struct device *dev, void *data)
+@@ -186,6 +211,23 @@ static int print_device_status(struct device *dev, void *data)
+ /* We only wait for device setup after most initcalls have run. */
+ static int ready_to_wait_for_devices;
+ 
+static bool wait_loop(unsigned long start, unsigned int max_delay,
+		     unsigned int *seconds_waited)
+{
+	if (time_after(jiffies, start + (*seconds_waited+5)*HZ)) {
+		if (!*seconds_waited)
+			printk(KERN_WARNING "XENBUS: Waiting for "
+			       "devices to initialise: ");
+		*seconds_waited += 5;
+		printk("%us...", max_delay - *seconds_waited);
+		if (*seconds_waited == max_delay)
+			return true;
+	}
+
+	schedule_timeout_interruptible(HZ/10);
+
+	return false;
+}
+ /*
+  * On a 5-minute timeout, wait for all devices currently configured.  We need
+  * to do this to guarantee that the filesystems and / or network devices
+@@ -209,19 +251,14 @@ static void wait_for_devices(struct xenbus_driver *xendrv)
+ 	if (!ready_to_wait_for_devices || !xen_domain())
+ 		return;
+ 
+-	while (exists_connecting_device(drv)) {
+-		if (time_after(jiffies, start + (seconds_waited+5)*HZ)) {
+-			if (!seconds_waited)
+-				printk(KERN_WARNING "XENBUS: Waiting for "
+-				       "devices to initialise: ");
+-			seconds_waited += 5;
+-			printk("%us...", 300 - seconds_waited);
+-			if (seconds_waited == 300)
+-				break;
+-		}
+-
+-		schedule_timeout_interruptible(HZ/10);
+-	}
+	while (exists_non_essential_connecting_device(drv))
+		if (wait_loop(start, 30, &seconds_waited))
+			break;
+
+	/* Skips PVKB and PVFB check.*/
+	while (exists_essential_connecting_device(drv))
+		if (wait_loop(start, 270, &seconds_waited))
+			break;
+ 
+ 	if (seconds_waited)
+ 		printk("\n");
+-- 
+1.7.7.6
+
@@ -0,0 +1,48 @@
+From 607a2c7f4e227d472b7b1c6b69ec7112f5e8b142 Mon Sep 17 00:00:00 2001
+From: Tomoki Sekiyama <tomoki.sekiyama@gmail.com>
+Date: Fri, 30 Mar 2012 08:51:28 +0900
+Subject: [PATCH 011/165] USB: yurex: Remove allocation of coherent buffer for
+ setup-packet buffer
+
+commit 523fc5c14f6cad283e5a266eba0e343aed6e73d5 upstream.
+
+Removes allocation of coherent buffer for the control-request setup-packet
+buffer from the yurex driver. Using coherent buffers for setup-packet is
+obsolete and does not work with some USB host implementations.
+
+Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/misc/yurex.c |    8 ++------
+ 1 files changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
+index ac5bfd6..24bff37 100644
+--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
+@@ -99,9 +99,7 @@ static void yurex_delete(struct kref *kref)
+ 	usb_put_dev(dev->udev);
+ 	if (dev->cntl_urb) {
+ 		usb_kill_urb(dev->cntl_urb);
+-		if (dev->cntl_req)
+-			usb_free_coherent(dev->udev, YUREX_BUF_SIZE,
+-				dev->cntl_req, dev->cntl_urb->setup_dma);
+		kfree(dev->cntl_req);
+ 		if (dev->cntl_buffer)
+ 			usb_free_coherent(dev->udev, YUREX_BUF_SIZE,
+ 				dev->cntl_buffer, dev->cntl_urb->transfer_dma);
+@@ -234,9 +232,7 @@ static int yurex_probe(struct usb_interface *interface, const struct usb_device_
+ 	}
+ 
+ 	/* allocate buffer for control req */
+-	dev->cntl_req = usb_alloc_coherent(dev->udev, YUREX_BUF_SIZE,
+-					   GFP_KERNEL,
+-					   &dev->cntl_urb->setup_dma);
+	dev->cntl_req = kmalloc(YUREX_BUF_SIZE, GFP_KERNEL);
+ 	if (!dev->cntl_req) {
+ 		err("Could not allocate cntl_req");
+ 		goto error;
+-- 
+1.7.7.6
+
@@ -0,0 +1,35 @@
+From 52f84b7d4cbfe7fc0ed467312e405df648bb1dca Mon Sep 17 00:00:00 2001
+From: Tomoki Sekiyama <tomoki.sekiyama@gmail.com>
+Date: Fri, 30 Mar 2012 08:51:36 +0900
+Subject: [PATCH 012/165] USB: yurex: Fix missing URB_NO_TRANSFER_DMA_MAP flag
+ in urb
+
+commit 532f17b5d59bf0deb6f1ff9bc1fb27d5b5011c09 upstream.
+
+Current probing code is setting URB_NO_TRANSFER_DMA_MAP flag into a wrong urb
+structure, and this causes BUG_ON with some USB host implementations.
+This patch fixes the issue.
+
+Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/misc/yurex.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
+index 24bff37..2504694 100644
+--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
+@@ -282,7 +282,7 @@ static int yurex_probe(struct usb_interface *interface, const struct usb_device_
+ 			 usb_rcvintpipe(dev->udev, dev->int_in_endpointAddr),
+ 			 dev->int_buffer, YUREX_BUF_SIZE, yurex_interrupt,
+ 			 dev, 1);
+-	dev->cntl_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+	dev->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+ 	if (usb_submit_urb(dev->urb, GFP_KERNEL)) {
+ 		retval = -EIO;
+ 		err("Could not submitting URB");
+-- 
+1.7.7.6
+
@@ -0,0 +1,64 @@
+From 73b80f793567a6056f9265c82599b47bc5856db8 Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oliver@neukum.org>
+Date: Mon, 16 Apr 2012 15:28:28 +0200
+Subject: [PATCH 013/165] uwb: fix use of del_timer_sync() in interrupt
+
+commit 9426cd05682745d1024dbabdec5631309bd2f480 upstream.
+
+del_timer_sync() cannot be used in interrupt.
+Replace it with del_timer() and a flag
+
+Signed-off-by: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/uwb/neh.c |   12 +++++++++++-
+ 1 files changed, 11 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/uwb/neh.c b/drivers/uwb/neh.c
+index a269937..8cb71bb 100644
+--- a/drivers/uwb/neh.c
+++ b/drivers/uwb/neh.c
+@@ -107,6 +107,7 @@ struct uwb_rc_neh {
+ 	u8 evt_type;
+ 	__le16 evt;
+ 	u8 context;
+	u8 completed;
+ 	uwb_rc_cmd_cb_f cb;
+ 	void *arg;
+ 
+@@ -409,6 +410,7 @@ static void uwb_rc_neh_grok_event(struct uwb_rc *rc, struct uwb_rceb *rceb, size
+ 	struct device *dev = &rc->uwb_dev.dev;
+ 	struct uwb_rc_neh *neh;
+ 	struct uwb_rceb *notif;
+	unsigned long flags;
+ 
+ 	if (rceb->bEventContext == 0) {
+ 		notif = kmalloc(size, GFP_ATOMIC);
+@@ -422,7 +424,11 @@ static void uwb_rc_neh_grok_event(struct uwb_rc *rc, struct uwb_rceb *rceb, size
+ 	} else {
+ 		neh = uwb_rc_neh_lookup(rc, rceb);
+ 		if (neh) {
+-			del_timer_sync(&neh->timer);
+			spin_lock_irqsave(&rc->neh_lock, flags);
+			/* to guard against a timeout */
+			neh->completed = 1;
+			del_timer(&neh->timer);
+			spin_unlock_irqrestore(&rc->neh_lock, flags);
+ 			uwb_rc_neh_cb(neh, rceb, size);
+ 		} else
+ 			dev_warn(dev, "event 0x%02x/%04x/%02x (%zu bytes): nobody cared\n",
+@@ -568,6 +574,10 @@ static void uwb_rc_neh_timer(unsigned long arg)
+ 	unsigned long flags;
+ 
+ 	spin_lock_irqsave(&rc->neh_lock, flags);
+	if (neh->completed) {
+		spin_unlock_irqrestore(&rc->neh_lock, flags);
+		return;
+	}
+ 	if (neh->context)
+ 		__uwb_rc_neh_rm(rc, neh);
+ 	else
+-- 
+1.7.7.6
+
@@ -0,0 +1,34 @@
+From 8a03e18a4ff4ab7f3a6da08bd3f564f8a7aa2c4e Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oliver@neukum.org>
+Date: Wed, 18 Apr 2012 10:05:55 +0200
+Subject: [PATCH 014/165] uwb: fix error handling
+
+commit 5bd7b419ef2eb4989b207753e088c3437159618a upstream.
+
+Fatal errors such as a device disconnect must not trigger
+error handling. The error returns must be checked.
+
+Signed-off-by: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/uwb/hwa-rc.c |    3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c
+index 2babcd4..86685e9 100644
+--- a/drivers/uwb/hwa-rc.c
+++ b/drivers/uwb/hwa-rc.c
+@@ -645,7 +645,8 @@ void hwarc_neep_cb(struct urb *urb)
+ 		dev_err(dev, "NEEP: URB error %d\n", urb->status);
+ 	}
+ 	result = usb_submit_urb(urb, GFP_ATOMIC);
+-	if (result < 0) {
+	if (result < 0 && result != -ENODEV && result != -EPERM) {
+		/* ignoring unrecoverable errors */
+ 		dev_err(dev, "NEEP: Can't resubmit URB (%d) resetting device\n",
+ 			result);
+ 		goto error;
+-- 
+1.7.7.6
+
@@ -0,0 +1,44 @@
+From e132279cab18984918fc3cc9f8f02c8bd71e2931 Mon Sep 17 00:00:00 2001
+From: Christian Riesch <christian.riesch@omicron.at>
+Date: Mon, 16 Apr 2012 04:35:25 +0000
+Subject: [PATCH 015/165] davinci_mdio: Fix MDIO timeout check
+
+commit 5b76d0600b2b08eef77f8e9226938b7b6bde3099 upstream.
+
+Under heavy load (flood ping) it is possible for the MDIO timeout to
+expire before the loop checks the GO bit again. This patch adds an
+additional check whether the operation was done before actually
+returning -ETIMEDOUT.
+
+To reproduce this bug, flood ping the device, e.g., ping -f -l 1000
+After some time, a "timed out waiting for user access" warning
+may appear. And even worse, link may go down since the PHY reported a
+timeout.
+
+Signed-off-by: Christian Riesch <christian.riesch@omicron.at>
+Cc: Cyril Chemparathy <cyril@ti.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/ethernet/ti/davinci_mdio.c |    5 +++++
+ 1 files changed, 5 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/ethernet/ti/davinci_mdio.c b/drivers/net/ethernet/ti/davinci_mdio.c
+index 1f14be6..3802de3 100644
+--- a/drivers/net/ethernet/ti/davinci_mdio.c
+++ b/drivers/net/ethernet/ti/davinci_mdio.c
+@@ -185,6 +185,11 @@ static inline int wait_for_user_access(struct davinci_mdio_data *data)
+ 		__davinci_mdio_reset(data);
+ 		return -EAGAIN;
+ 	}
+
+	reg = __raw_readl(&regs->user[0].access);
+	if ((reg & USERACCESS_GO) == 0)
+		return 0;
+
+ 	dev_err(data->dev, "timed out waiting for user access\n");
+ 	return -ETIMEDOUT;
+ }
+-- 
+1.7.7.6
+
@@ -0,0 +1,50 @@
+From f0553ecfc94510617f6b54a980e86a197e0746ac Mon Sep 17 00:00:00 2001
+From: Bing Zhao <bzhao@marvell.com>
+Date: Thu, 12 Apr 2012 19:00:35 -0700
+Subject: [PATCH 016/165] mwifiex: update pcie8766 scratch register addresses
+
+commit 428ca8a7065354877db63ceabfc493107686eebe upstream.
+
+The scratch register addresses have been changed for newer chips.
+Since the old chip was never shipped and it will not be supported
+any more, just update register addresses to support the new chips.
+
+Signed-off-by: Bing Zhao <bzhao@marvell.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/wireless/mwifiex/pcie.h |   18 +++++++++---------
+ 1 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/wireless/mwifiex/pcie.h b/drivers/net/wireless/mwifiex/pcie.h
+index 445ff21..2f218f9 100644
+--- a/drivers/net/wireless/mwifiex/pcie.h
+++ b/drivers/net/wireless/mwifiex/pcie.h
+@@ -48,15 +48,15 @@
+ #define PCIE_HOST_INT_STATUS_MASK			0xC3C
+ #define PCIE_SCRATCH_2_REG				0xC40
+ #define PCIE_SCRATCH_3_REG				0xC44
+-#define PCIE_SCRATCH_4_REG				0xCC0
+-#define PCIE_SCRATCH_5_REG				0xCC4
+-#define PCIE_SCRATCH_6_REG				0xCC8
+-#define PCIE_SCRATCH_7_REG				0xCCC
+-#define PCIE_SCRATCH_8_REG				0xCD0
+-#define PCIE_SCRATCH_9_REG				0xCD4
+-#define PCIE_SCRATCH_10_REG				0xCD8
+-#define PCIE_SCRATCH_11_REG				0xCDC
+-#define PCIE_SCRATCH_12_REG				0xCE0
+#define PCIE_SCRATCH_4_REG				0xCD0
+#define PCIE_SCRATCH_5_REG				0xCD4
+#define PCIE_SCRATCH_6_REG				0xCD8
+#define PCIE_SCRATCH_7_REG				0xCDC
+#define PCIE_SCRATCH_8_REG				0xCE0
+#define PCIE_SCRATCH_9_REG				0xCE4
+#define PCIE_SCRATCH_10_REG				0xCE8
+#define PCIE_SCRATCH_11_REG				0xCEC
+#define PCIE_SCRATCH_12_REG				0xCF0
+ 
+ #define CPU_INTR_DNLD_RDY				BIT(0)
+ #define CPU_INTR_DOOR_BELL				BIT(1)
+-- 
+1.7.7.6
+
@@ -0,0 +1,57 @@
+From 97f7538da8a6b3e8cef6322b2024817759393079 Mon Sep 17 00:00:00 2001
+From: Arend van Spriel <arend@broadcom.com>
+Date: Wed, 11 Apr 2012 11:52:51 +0200
+Subject: [PATCH 017/165] brcm80211: smac: resume transmit fifo upon receiving
+ frames
+
+commit badc4f07622f0f7093a201638f45e85765f1b5e4 upstream.
+
+There have been reports about not being able to use access-points
+on channel 12 and 13 or having connectivity issues when these channels
+were part of the selected regulatory domain. Upon switching to these
+channels the brcmsmac driver suspends the transmit dma fifos. This
+patch resumes them upon handing over the first received beacon to
+mac80211.
+
+This patch is to be applied to the stable tree for kernel versions
+3.2 and 3.3.
+
+Tested-by: Francesco Saverio Schiavarelli <fschiava@libero.it>
+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
+Reviewed-by: Brett Rudley <brudley@broadcom.com>
+Signed-off-by: Arend van Spriel <arend@broadcom.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/wireless/brcm80211/brcmsmac/main.c |    8 ++++++++
+ 1 files changed, 8 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
+index 453f58e..f98becc 100644
+--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
+@@ -7865,6 +7865,7 @@ brcms_c_recvctl(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
+ {
+ 	int len_mpdu;
+ 	struct ieee80211_rx_status rx_status;
+	struct ieee80211_hdr *hdr;
+ 
+ 	memset(&rx_status, 0, sizeof(rx_status));
+ 	prep_mac80211_status(wlc, rxh, p, &rx_status);
+@@ -7874,6 +7875,13 @@ brcms_c_recvctl(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
+ 	skb_pull(p, D11_PHY_HDR_LEN);
+ 	__skb_trim(p, len_mpdu);
+ 
+	/* unmute transmit */
+	if (wlc->hw->suspended_fifos) {
+		hdr = (struct ieee80211_hdr *)p->data;
+		if (ieee80211_is_beacon(hdr->frame_control))
+			brcms_b_mute(wlc->hw, false);
+	}
+
+ 	memcpy(IEEE80211_SKB_RXCB(p), &rx_status, sizeof(rx_status));
+ 	ieee80211_rx_irqsafe(wlc->pub->ieee_hw, p);
+ }
+-- 
+1.7.7.6
+
@@ -0,0 +1,37 @@
+From 6dd8dc1e17571cbe55630e5d1e85aa7e27a0b257 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?David=20H=C3=A4rdeman?= <david@hardeman.nu>
+Date: Sun, 8 Apr 2012 06:13:04 -0300
+Subject: [PATCH 018/165] rc-core: set mode for winbond-cir
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit d9b786955f80fb306471fdb9ea24c6d03af6ca36 upstream.
+
+Setting the correct mode is required by rc-core or scancodes won't be
+generated (which isn't very user-friendly).
+
+This one-line fix should be suitable for 3.4-rc2.
+
+Signed-off-by: David Härdeman <david@hardeman.nu>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/media/rc/winbond-cir.c |    1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/media/rc/winbond-cir.c b/drivers/media/rc/winbond-cir.c
+index 13f54b5..a7e7d6f 100644
+--- a/drivers/media/rc/winbond-cir.c
+++ b/drivers/media/rc/winbond-cir.c
+@@ -1046,6 +1046,7 @@ wbcir_probe(struct pnp_dev *device, const struct pnp_device_id *dev_id)
+ 		goto exit_unregister_led;
+ 	}
+ 
+	data->dev->driver_type = RC_DRIVER_IR_RAW;
+ 	data->dev->driver_name = WBCIR_NAME;
+ 	data->dev->input_name = WBCIR_NAME;
+ 	data->dev->input_phys = "wbcir/cir0";
+-- 
+1.7.7.6
+
@@ -0,0 +1,41 @@
+From d5cc94665b578e3e5e87884fb802e49b2f276298 Mon Sep 17 00:00:00 2001
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Date: Thu, 5 Apr 2012 18:53:20 -0300
+Subject: [PATCH 019/165] drxk: Does not unlock mutex if sanity check failed
+ in scu_command()
+
+commit e4459e1682c107d7ee1bf102c1ba534230e9b50b upstream.
+
+If sanity check fails in scu_command(), goto error leads to unlock of
+an unheld mutex. The check should not fail in reality, but it nevertheless
+worth fixing.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/media/dvb/frontends/drxk_hard.c |    6 ++++--
+ 1 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/dvb/frontends/drxk_hard.c b/drivers/media/dvb/frontends/drxk_hard.c
+index f6431ef..a1f5e3d 100644
+--- a/drivers/media/dvb/frontends/drxk_hard.c
+++ b/drivers/media/dvb/frontends/drxk_hard.c
+@@ -1523,8 +1523,10 @@ static int scu_command(struct drxk_state *state,
+ 	dprintk(1, "\n");
+ 
+ 	if ((cmd == 0) || ((parameterLen > 0) && (parameter == NULL)) ||
+-	    ((resultLen > 0) && (result == NULL)))
+-		goto error;
+	    ((resultLen > 0) && (result == NULL))) {
+		printk(KERN_ERR "drxk: Error %d on %s\n", status, __func__);
+		return status;
+	}
+ 
+ 	mutex_lock(&state->mutex);
+ 
+-- 
+1.7.7.6
+
@@ -0,0 +1,30 @@
+From 9080bb10c5fa9dc3a8c358eec3bffc5e0dd29ea8 Mon Sep 17 00:00:00 2001
+From: Lukasz Kucharczyk <lukasz.kucharczyk@tieto.com>
+Date: Wed, 11 Apr 2012 14:55:10 +0200
+Subject: [PATCH 020/165] cfg80211: fix interface combinations check.
+
+commit e55a4046dab28c440c96890bdddcf02dc8981f2d upstream.
+
+Signed-off-by: Lukasz Kucharczyk <lukasz.kucharczyk@tieto.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/wireless/util.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/net/wireless/util.c b/net/wireless/util.c
+index 4dde429..8bf8902 100644
+--- a/net/wireless/util.c
+++ b/net/wireless/util.c
+@@ -996,7 +996,7 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
+ 			if (rdev->wiphy.software_iftypes & BIT(iftype))
+ 				continue;
+ 			for (j = 0; j < c->n_limits; j++) {
+-				if (!(limits[j].types & iftype))
+				if (!(limits[j].types & BIT(iftype)))
+ 					continue;
+ 				if (limits[j].max < num[iftype])
+ 					goto cont;
+-- 
+1.7.7.6
+
@@ -0,0 +1,54 @@
+From 3ff39b2411c6722c1ee6c490ac4ec7f90f026d64 Mon Sep 17 00:00:00 2001
+From: David Miller <davem@davemloft.net>
+Date: Wed, 25 Apr 2012 19:41:32 -0500
+Subject: [PATCH 021/165] Fix modpost failures in fedora 17
+
+commit e88aa7bbbe3046a125ea1936b16bb921cc9c6349 upstream.
+
+The symbol table on x86-64 starts to have entries that have names
+like:
+
+_GLOBAL__sub_I_65535_0___mod_x86cpu_device_table
+
+They are of type STT_FUNCTION and this one had a length of 18.  This
+matched the device ID validation logic and it barfed because the
+length did not meet the device type's criteria.
+
+--------------------
+FATAL: arch/x86/crypto/aesni-intel: sizeof(struct x86cpu_device_id)=16 is not a modulo of the size of section __mod_x86cpu_device_table=18.
+Fix definition of struct x86cpu_device_id in mod_devicetable.h
+--------------------
+
+These are some kind of compiler tool internal stuff being emitted and
+not something we want to inspect in modpost's device ID table
+validation code.
+
+So skip the symbol if it is not of type STT_OBJECT.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Michal Marek <mmarek@suse.cz>
+Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ scripts/mod/file2alias.c |    4 ++++
+ 1 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
+index f936d1f..d1d0ae8 100644
+--- a/scripts/mod/file2alias.c
+++ b/scripts/mod/file2alias.c
+@@ -926,6 +926,10 @@ void handle_moddevtable(struct module *mod, struct elf_info *info,
+ 	if (!sym->st_shndx || get_secindex(info, sym) >= info->num_sections)
+ 		return;
+ 
+	/* We're looking for an object */
+	if (ELF_ST_TYPE(sym->st_info) != STT_OBJECT)
+		return;
+
+ 	/* Handle all-NULL symbols allocated into .bss */
+ 	if (info->sechdrs[get_secindex(info, sym)].sh_type & SHT_NOBITS) {
+ 		zeros = calloc(1, sym->st_size);
+-- 
+1.7.7.6
+
@@ -0,0 +1,60 @@
+From 8afb43e5f076643f012d0267aebb215cc0f0767b Mon Sep 17 00:00:00 2001
+From: Hugh Dickins <hughd@google.com>
+Date: Mon, 23 Apr 2012 11:14:50 -0700
+Subject: [PATCH 022/165] mm: fix s390 BUG by __set_page_dirty_no_writeback on
+ swap
+
+commit aca50bd3b4c4bb5528a1878158ba7abce41de534 upstream.
+
+Mel reports a BUG_ON(slot == NULL) in radix_tree_tag_set() on s390
+3.0.13: called from __set_page_dirty_nobuffers() when page_remove_rmap()
+tries to transfer dirty flag from s390 storage key to struct page and
+radix_tree.
+
+That would be because of reclaim's shrink_page_list() calling
+add_to_swap() on this page at the same time: first PageSwapCache is set
+(causing page_mapping(page) to appear as &swapper_space), then
+page->private set, then tree_lock taken, then page inserted into
+radix_tree - so there's an interval before taking the lock when the
+radix_tree slot is empty.
+
+We could fix this by moving __add_to_swap_cache()'s spin_lock_irq up
+before the SetPageSwapCache.  But a better fix is simply to do what's
+five years overdue: Ken Chen introduced __set_page_dirty_no_writeback()
+(if !PageDirty TestSetPageDirty) for tmpfs to skip all the radix_tree
+overhead, and swap is just the same - it ignores the radix_tree tag, and
+does not participate in dirty page accounting, so should be using
+__set_page_dirty_no_writeback() too.
+
+s390 testing now confirms that this does indeed fix the problem.
+
+Reported-by: Mel Gorman <mgorman@suse.de>
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Acked-by: Mel Gorman <mgorman@suse.de>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
+Cc: Rik van Riel <riel@redhat.com>
+Cc: Ken Chen <kenchen@google.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ mm/swap_state.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/mm/swap_state.c b/mm/swap_state.c
+index 78cc4d1..7704d9c 100644
+--- a/mm/swap_state.c
+++ b/mm/swap_state.c
+@@ -27,7 +27,7 @@
+  */
+ static const struct address_space_operations swap_aops = {
+ 	.writepage	= swap_writepage,
+-	.set_page_dirty	= __set_page_dirty_nobuffers,
+	.set_page_dirty	= __set_page_dirty_no_writeback,
+ 	.migratepage	= migrate_page,
+ };
+ 
+-- 
+1.7.7.6
+
@@ -0,0 +1,51 @@
+From fd272b3336e1e535826cc345e10353eb104363e8 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Tue, 24 Apr 2012 10:23:16 +1000
+Subject: [PATCH 023/165] md: fix possible corruption of array metadata on
+ shutdown.
+
+commit 30b8aa9172dfeaac6d77897c67ee9f9fc574cdbb upstream.
+
+commit c744a65c1e2d59acc54333ce8
+  md: don't set md arrays to readonly on shutdown.
+
+removed the possibility of a 'BUG' when data is written to an array
+that has just been switched to read-only, but also introduced the
+possibility that the array metadata could be corrupted.
+
+If, when md_notify_reboot gets the mddev lock, the array is
+in a state where it is assembled but hasn't been started (as can
+happen if the personality module is not available, or in other unusual
+situations), then incorrect metadata will be written out making it
+impossible to re-assemble the array.
+
+So only call __md_stop_writes() if the array has actually been
+activated.
+
+This patch is needed for any stable kernel which has had the above
+commit applied.
+
+Reported-by: Christoph Nelles <evilazrael@evilazrael.de>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/md/md.c |    3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 6f37aa4..065ab4f 100644
+--- a/drivers/md/md.c
+++ b/drivers/md/md.c
+@@ -8100,7 +8100,8 @@ static int md_notify_reboot(struct notifier_block *this,
+ 
+ 	for_each_mddev(mddev, tmp) {
+ 		if (mddev_trylock(mddev)) {
+-			__md_stop_writes(mddev);
+			if (mddev->pers)
+				__md_stop_writes(mddev);
+ 			mddev->safemode = 2;
+ 			mddev_unlock(mddev);
+ 		}
+-- 
+1.7.7.6
+
@@ -0,0 +1,45 @@
+From 6556e20032c10ba45a6101a9454265c0f8c0fbc6 Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shli@kernel.org>
+Date: Fri, 13 Apr 2012 10:27:35 +0800
+Subject: [PATCH 024/165] jbd2: use GFP_NOFS for blkdev_issue_flush
+
+commit 99aa78466777083255b876293e9e83dec7cd809a upstream.
+
+flush request is issued in transaction commit code path, so looks using
+GFP_KERNEL to allocate memory for flush request bio falls into the classic
+deadlock issue.  I saw btrfs and dm get it right, but ext4, xfs and md are
+using GFP.
+
+Signed-off-by: Shaohua Li <shli@fusionio.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/jbd2/commit.c |    4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
+index 68d704d..d751f04 100644
+--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
+@@ -683,7 +683,7 @@ start_journal_io:
+ 	if (commit_transaction->t_need_data_flush &&
+ 	    (journal->j_fs_dev != journal->j_dev) &&
+ 	    (journal->j_flags & JBD2_BARRIER))
+-		blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
+		blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL);
+ 
+ 	/* Done it all: now write the commit record asynchronously. */
+ 	if (JBD2_HAS_INCOMPAT_FEATURE(journal,
+@@ -819,7 +819,7 @@ wait_for_iobuf:
+ 	if (JBD2_HAS_INCOMPAT_FEATURE(journal,
+ 				      JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT) &&
+ 	    journal->j_flags & JBD2_BARRIER) {
+-		blkdev_issue_flush(journal->j_dev, GFP_KERNEL, NULL);
+		blkdev_issue_flush(journal->j_dev, GFP_NOFS, NULL);
+ 	}
+ 
+ 	if (err)
+-- 
+1.7.7.6
+
@@ -0,0 +1,54 @@
+From f9515bb74e74a5f3f7cb963984bdd8c8731495ff Mon Sep 17 00:00:00 2001
+From: Yuri Matylitski <ym@tekinsoft.com>
+Date: Fri, 20 Apr 2012 12:38:32 +0300
+Subject: [PATCH 025/165] USB: serial: cp210x: Fixed usb_control_msg timeout
+ values
+
+commit 2d5733fcd33dd451022d197cb6b476e970519ca7 upstream.
+
+Fixed too small hardcoded timeout values for usb_control_msg
+in driver for SiliconLabs cp210x-based usb-to-serial adapters.
+Replaced with USB_CTRL_GET_TIMEOUT/USB_CTRL_SET_TIMEOUT.
+
+Signed-off-by: Yuri Matylitski <ym@tekinsoft.com>
+Acked-by: Kirill A. Shutemov <kirill@shutemov.name>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/serial/cp210x.c |    9 ++++++---
+ 1 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 4c12404..f2c57e0 100644
+--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
+@@ -285,7 +285,8 @@ static int cp210x_get_config(struct usb_serial_port *port, u8 request,
+ 	/* Issue the request, attempting to read 'size' bytes */
+ 	result = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
+ 				request, REQTYPE_DEVICE_TO_HOST, 0x0000,
+-				port_priv->bInterfaceNumber, buf, size, 300);
+				port_priv->bInterfaceNumber, buf, size,
+				USB_CTRL_GET_TIMEOUT);
+ 
+ 	/* Convert data into an array of integers */
+ 	for (i = 0; i < length; i++)
+@@ -335,12 +336,14 @@ static int cp210x_set_config(struct usb_serial_port *port, u8 request,
+ 		result = usb_control_msg(serial->dev,
+ 				usb_sndctrlpipe(serial->dev, 0),
+ 				request, REQTYPE_HOST_TO_DEVICE, 0x0000,
+-				port_priv->bInterfaceNumber, buf, size, 300);
+				port_priv->bInterfaceNumber, buf, size,
+				USB_CTRL_SET_TIMEOUT);
+ 	} else {
+ 		result = usb_control_msg(serial->dev,
+ 				usb_sndctrlpipe(serial->dev, 0),
+ 				request, REQTYPE_HOST_TO_DEVICE, data[0],
+-				port_priv->bInterfaceNumber, NULL, 0, 300);
+				port_priv->bInterfaceNumber, NULL, 0,
+				USB_CTRL_SET_TIMEOUT);
+ 	}
+ 
+ 	kfree(buf);
+-- 
+1.7.7.6
+
@@ -0,0 +1,55 @@
+From 069f7216ddee90ddca6e1d040e58b6735f89fca6 Mon Sep 17 00:00:00 2001
+From: Tomoya MORINAGA <tomoya.rohm@gmail.com>
+Date: Thu, 12 Apr 2012 10:47:50 +0900
+Subject: [PATCH 026/165] pch_uart: Fix dma channel unallocated issue
+
+commit af6d17cdc8c89aeb3101f0d27cd32fc0592b40b2 upstream.
+
+This driver anticipates pch_uart_verify_port() is not called
+during installation.
+However, actually pch_uart_verify_port() is called during
+installation.
+As a result, memory access violation occurs like below.
+
+0. initial value: use_dma=0
+1. starup()
+    - dma channel is not allocated because use_dma=0
+2. pch_uart_verify_port()
+    - Set use_dma=1
+3. UART processing acts DMA mode because use_dma=1
+     - memory access violation occurs!
+
+This patch fixes the issue.
+
+Solution:
+Whenever pch_uart_verify_port() is called and then
+dma channel is not allocated, the channel should be allocated.
+
+Signed-off-by: Tomoya MORINAGA <tomoya.rohm@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+[bwh: Backported to 3.2: adjust context]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/tty/serial/pch_uart.c |    4 +++-
+ 1 files changed, 3 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c
+index da776a0..a4b192d 100644
+--- a/drivers/tty/serial/pch_uart.c
+++ b/drivers/tty/serial/pch_uart.c
+@@ -1356,9 +1356,11 @@ static int pch_uart_verify_port(struct uart_port *port,
+ 			__func__);
+ 		return -EOPNOTSUPP;
+ #endif
+-		priv->use_dma = 1;
+ 		priv->use_dma_flag = 1;
+ 		dev_info(priv->port.dev, "PCH UART : Use DMA Mode\n");
+		if (!priv->use_dma)
+			pch_request_dma(port);
+		priv->use_dma = 1;
+ 	}
+ 
+ 	return 0;
+-- 
+1.7.7.6
+
@@ -0,0 +1,36 @@
+From fefc2c6916651c05eed1882c3a59a6468d91e417 Mon Sep 17 00:00:00 2001
+From: Julia Lawall <Julia.Lawall@lip6.fr>
+Date: Thu, 19 Apr 2012 18:12:40 +0200
+Subject: [PATCH 027/165] drivers/tty/amiserial.c: add missing tty_unlock
+
+commit d3a7b83f865b46bb7b5e1ed18a129ce1af349db4 upstream.
+
+tty_unlock is used on all other exits from the function.
+
+Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
+Acked-by: Jiri Slaby <jslaby@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/tty/amiserial.c |    4 +++-
+ 1 files changed, 3 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/tty/amiserial.c b/drivers/tty/amiserial.c
+index b84c834..8daf073 100644
+--- a/drivers/tty/amiserial.c
+++ b/drivers/tty/amiserial.c
+@@ -1113,8 +1113,10 @@ static int set_serial_info(struct async_struct * info,
+ 		    (new_serial.close_delay != state->close_delay) ||
+ 		    (new_serial.xmit_fifo_size != state->xmit_fifo_size) ||
+ 		    ((new_serial.flags & ~ASYNC_USR_MASK) !=
+-		     (state->flags & ~ASYNC_USR_MASK)))
+		     (state->flags & ~ASYNC_USR_MASK))) {
+			tty_unlock();
+ 			return -EPERM;
+		}
+ 		state->flags = ((state->flags & ~ASYNC_USR_MASK) |
+ 			       (new_serial.flags & ASYNC_USR_MASK));
+ 		info->flags = ((info->flags & ~ASYNC_USR_MASK) |
+-- 
+1.7.7.6
+
@@ -0,0 +1,60 @@
+From 769a100618c82ac6e8e284cc14a5fbffe13e31ce Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Tue, 17 Apr 2012 21:37:29 +0200
+Subject: [PATCH 028/165] USB: sierra: avoid QMI/wwan interface on MC77xx
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 749541d19e70905e3971f2a08335a206a98e4d0c upstream.
+
+These devices have a number of non serial interfaces as well.  Use
+the existing "Direct IP" blacklist to prevent binding to interfaces
+which are handled by other drivers.
+
+We also extend the "Direct IP" blacklist with with interfaces only
+seen in "QMI" mode, assuming that these devices use the same
+interface numbers for serial interfaces both in "Direct IP" and in
+"QMI" mode.
+
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/serial/sierra.c |    6 ++++--
+ 1 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
+index 7c3ec9e..e093585 100644
+--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
+@@ -221,7 +221,7 @@ static const struct sierra_iface_info typeB_interface_list = {
+ };
+ 
+ /* 'blacklist' of interfaces not served by this driver */
+-static const u8 direct_ip_non_serial_ifaces[] = { 7, 8, 9, 10, 11 };
+static const u8 direct_ip_non_serial_ifaces[] = { 7, 8, 9, 10, 11, 19, 20 };
+ static const struct sierra_iface_info direct_ip_interface_blacklist = {
+ 	.infolen = ARRAY_SIZE(direct_ip_non_serial_ifaces),
+ 	.ifaceinfo = direct_ip_non_serial_ifaces,
+@@ -289,7 +289,6 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x1199, 0x6856) },	/* Sierra Wireless AirCard 881 U */
+ 	{ USB_DEVICE(0x1199, 0x6859) },	/* Sierra Wireless AirCard 885 E */
+ 	{ USB_DEVICE(0x1199, 0x685A) },	/* Sierra Wireless AirCard 885 E */
+-	{ USB_DEVICE(0x1199, 0x68A2) }, /* Sierra Wireless MC7710 */
+ 	/* Sierra Wireless C885 */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x6880, 0xFF, 0xFF, 0xFF)},
+ 	/* Sierra Wireless C888, Air Card 501, USB 303, USB 304 */
+@@ -299,6 +298,9 @@ static const struct usb_device_id id_table[] = {
+ 	/* Sierra Wireless HSPA Non-Composite Device */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x6892, 0xFF, 0xFF, 0xFF)},
+ 	{ USB_DEVICE(0x1199, 0x6893) },	/* Sierra Wireless Device */
+	{ USB_DEVICE(0x1199, 0x68A2),   /* Sierra Wireless MC77xx in QMI mode */
+	  .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+	},
+ 	{ USB_DEVICE(0x1199, 0x68A3), 	/* Sierra Wireless Direct IP modems */
+ 	  .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+ 	},
+-- 
+1.7.7.6
+
@@ -0,0 +1,48 @@
+From 611589daeef0bd0f6b36f1fbb17f34b6abf05568 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 17 Apr 2012 15:24:15 -0400
+Subject: [PATCH 029/165] EHCI: fix criterion for resuming the root hub
+
+commit dc75ce9d929aabeb0843a6b1a4ab320e58ba1597 upstream.
+
+This patch (as1542) changes the criterion ehci-hcd uses to tell when
+it needs to resume the controller's root hub.  A resume is needed when
+a port status change is detected, obviously, but only if the root hub
+is currently suspended.
+
+Right now the driver tests whether the root hub is running, and that
+is not the correct test.  In particular, if the controller has died
+then the root hub should not be restarted.  In addition, some buggy
+hardware occasionally requires the root hub to be running and
+sending out SOF packets even while it is nominally supposed to be
+suspended.
+
+In the end, the test needs to be changed.  Rather than checking whether
+the root hub is currently running, the driver will now check whether
+the root hub is currently suspended.  This will yield the correct
+behavior in all cases.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+CC: Peter Chen <B29397@freescale.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/host/ehci-hcd.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
+index 3ff9f82..ffbbf54 100644
+--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
+@@ -867,7 +867,7 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
+ 		pcd_status = status;
+ 
+ 		/* resume root hub? */
+-		if (!(cmd & CMD_RUN))
+		if (ehci->rh_state == EHCI_RH_SUSPENDED)
+ 			usb_hcd_resume_root_hub(hcd);
+ 
+ 		/* get per-port change detect bits */
+-- 
+1.7.7.6
+
@@ -0,0 +1,46 @@
+From 2259a159b9b3861dcc0c8cd9c52ef85cb11ad2a5 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 18 Apr 2012 11:33:00 -0400
+Subject: [PATCH 030/165] EHCI: always clear the STS_FLR status bit
+
+commit 2fbe2bf1fd37f9d99950bd8d8093623cf22cf08b upstream.
+
+This patch (as1544) fixes a problem affecting some EHCI controllers.
+They can generate interrupts whenever the STS_FLR status bit is turned
+on, even though that bit is masked out in the Interrupt Enable
+register.
+
+Since the driver doesn't use STS_FLR anyway, the patch changes the
+interrupt routine to clear that bit whenever it is set, rather than
+leaving it alone.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-and-tested-by: Tomoya MORINAGA <tomoya.rohm@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/host/ehci-hcd.c |    7 ++++++-
+ 1 files changed, 6 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
+index ffbbf54..da2f711 100644
+--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
+@@ -815,8 +815,13 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
+ 		goto dead;
+ 	}
+ 
+	/*
+	 * We don't use STS_FLR, but some controllers don't like it to
+	 * remain on, so mask it out along with the other status bits.
+	 */
+	masked_status = status & (INTR_MASK | STS_FLR);
+
+ 	/* Shared IRQ? */
+-	masked_status = status & INTR_MASK;
+ 	if (!masked_status || unlikely(ehci->rh_state == EHCI_RH_HALTED)) {
+ 		spin_unlock(&ehci->lock);
+ 		return IRQ_NONE;
+-- 
+1.7.7.6
+
@@ -0,0 +1,116 @@
+From 770feb782844457789a51d13d2933cca141bb487 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 17 Apr 2012 15:22:39 -0400
+Subject: [PATCH 031/165] USB: fix deadlock in bConfigurationValue attribute
+ method
+
+commit 8963c487a80b4688c9e68dcc504a90074aacc145 upstream.
+
+This patch (as154) fixes a self-deadlock that occurs when userspace
+writes to the bConfigurationValue sysfs attribute for a hub with
+children.  The task tries to lock the bandwidth_mutex at a time when
+it already owns the lock:
+
+	The attribute's method calls usb_set_configuration(),
+	which calls usb_disable_device() with the bandwidth_mutex
+	held.
+
+	usb_disable_device() unregisters the existing interfaces,
+	which causes the hub driver to be unbound.
+
+	The hub_disconnect() routine calls hub_quiesce(), which
+	calls usb_disconnect() for each of the hub's children.
+
+	usb_disconnect() attempts to acquire the bandwidth_mutex
+	around a call to usb_disable_device().
+
+The solution is to make usb_disable_device() acquire the mutex for
+itself instead of requiring the caller to hold it.  Then the mutex can
+cover only the bandwidth deallocation operation and not the region
+where the interfaces are unregistered.
+
+This has the potential to change system behavior slightly when a
+config change races with another config or altsetting change.  Some of
+the bandwidth released from the old config might get claimed by the
+other config or altsetting, make it impossible to restore the old
+config in case of a failure.  But since we don't try to recover from
+config-change failures anyway, this doesn't matter.
+
+[This should be marked for stable kernels that contain the commit
+fccf4e86200b8f5edd9a65da26f150e32ba79808 "USB: Free bandwidth when
+usb_disable_device is called."
+That commit was marked for stable kernels as old as 2.6.32.]
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/core/hub.c     |    3 ---
+ drivers/usb/core/message.c |    6 +++---
+ 2 files changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 18373ec..ab4e49f 100644
+--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
+@@ -1644,7 +1644,6 @@ void usb_disconnect(struct usb_device **pdev)
+ {
+ 	struct usb_device	*udev = *pdev;
+ 	int			i;
+-	struct usb_hcd		*hcd = bus_to_hcd(udev->bus);
+ 
+ 	/* mark the device as inactive, so any further urb submissions for
+ 	 * this device (and any of its children) will fail immediately.
+@@ -1667,9 +1666,7 @@ void usb_disconnect(struct usb_device **pdev)
+ 	 * so that the hardware is now fully quiesced.
+ 	 */
+ 	dev_dbg (&udev->dev, "unregistering device\n");
+-	mutex_lock(hcd->bandwidth_mutex);
+ 	usb_disable_device(udev, 0);
+-	mutex_unlock(hcd->bandwidth_mutex);
+ 	usb_hcd_synchronize_unlinks(udev);
+ 
+ 	usb_remove_ep_devs(&udev->ep0);
+diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
+index aed3e07..ca717da 100644
+--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
+@@ -1136,8 +1136,6 @@ void usb_disable_interface(struct usb_device *dev, struct usb_interface *intf,
+  * Deallocates hcd/hardware state for the endpoints (nuking all or most
+  * pending urbs) and usbcore state for the interfaces, so that usbcore
+  * must usb_set_configuration() before any interfaces could be used.
+- *
+- * Must be called with hcd->bandwidth_mutex held.
+  */
+ void usb_disable_device(struct usb_device *dev, int skip_ep0)
+ {
+@@ -1190,7 +1188,9 @@ void usb_disable_device(struct usb_device *dev, int skip_ep0)
+ 			usb_disable_endpoint(dev, i + USB_DIR_IN, false);
+ 		}
+ 		/* Remove endpoints from the host controller internal state */
+		mutex_lock(hcd->bandwidth_mutex);
+ 		usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL);
+		mutex_unlock(hcd->bandwidth_mutex);
+ 		/* Second pass: remove endpoint pointers */
+ 	}
+ 	for (i = skip_ep0; i < 16; ++i) {
+@@ -1750,7 +1750,6 @@ free_interfaces:
+ 	/* if it's already configured, clear out old state first.
+ 	 * getting rid of old interfaces means unbinding their drivers.
+ 	 */
+-	mutex_lock(hcd->bandwidth_mutex);
+ 	if (dev->state != USB_STATE_ADDRESS)
+ 		usb_disable_device(dev, 1);	/* Skip ep0 */
+ 
+@@ -1763,6 +1762,7 @@ free_interfaces:
+ 	 * host controller will not allow submissions to dropped endpoints.  If
+ 	 * this call fails, the device state is unchanged.
+ 	 */
+	mutex_lock(hcd->bandwidth_mutex);
+ 	ret = usb_hcd_alloc_bandwidth(dev, cp, NULL, NULL);
+ 	if (ret < 0) {
+ 		mutex_unlock(hcd->bandwidth_mutex);
+-- 
+1.7.7.6
+
@@ -0,0 +1,56 @@
+From fadd4263bca7146d233ff944c17cb0f42a6e2112 Mon Sep 17 00:00:00 2001
+From: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
+Date: Wed, 28 Mar 2012 09:30:50 +0200
+Subject: [PATCH 032/165] usb: gadget: eliminate NULL pointer dereference
+ (bugfix)
+
+commit 92b0abf80c5c5f0e0d71d1309688a330fd74731b upstream.
+
+usb: gadget: eliminate NULL pointer dereference (bugfix)
+
+This patch fixes a bug which causes NULL pointer dereference in
+ffs_ep0_ioctl. The bug happens when the FunctionFS is not bound (either
+has not been bound yet or has been bound and then unbound) and can be
+reproduced with running the following commands:
+
+$ insmod g_ffs.ko
+$ mount -t functionfs func /dev/usbgadget
+$ ./null
+
+where null.c is:
+
+#include <fcntl.h>
+#include <linux/usb/functionfs.h>
+
+int main(void)
+{
+	int fd = open("/dev/usbgadget/ep0", O_RDWR);
+	ioctl(fd, FUNCTIONFS_CLEAR_HALT);
+
+	return 0;
+}
+
+Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
+Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/gadget/f_fs.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
+index acb3800..0e641a1 100644
+--- a/drivers/usb/gadget/f_fs.c
+++ b/drivers/usb/gadget/f_fs.c
+@@ -712,7 +712,7 @@ static long ffs_ep0_ioctl(struct file *file, unsigned code, unsigned long value)
+ 	if (code == FUNCTIONFS_INTERFACE_REVMAP) {
+ 		struct ffs_function *func = ffs->func;
+ 		ret = func ? ffs_func_revmap_intf(func, value) : -ENODEV;
+-	} else if (gadget->ops->ioctl) {
+	} else if (gadget && gadget->ops->ioctl) {
+ 		ret = gadget->ops->ioctl(gadget, code, value);
+ 	} else {
+ 		ret = -ENOTTY;
+-- 
+1.7.7.6
+
@@ -0,0 +1,44 @@
+From 839226b88ef2954d750d72f3ce2c6657393b8a09 Mon Sep 17 00:00:00 2001
+From: Kishon Vijay Abraham I <kishon@ti.com>
+Date: Wed, 21 Mar 2012 21:30:20 +0530
+Subject: [PATCH 033/165] usb: musb: omap: fix crash when musb glue (omap)
+ gets initialized
+
+commit 3006dc8c627d738693e910c159630e4368c9e86c upstream.
+
+pm_runtime_enable is being called after omap2430_musb_init. Hence
+pm_runtime_get_sync in omap2430_musb_init does not have any effect (does
+not enable clocks) resulting in a crash during register access. It is
+fixed here.
+
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/musb/omap2430.c |    4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
+index dd907d5..bd93e9f 100644
+--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
+@@ -463,14 +463,14 @@ static int __init omap2430_probe(struct platform_device *pdev)
+ 		goto err2;
+ 	}
+ 
+	pm_runtime_enable(&pdev->dev);
+
+ 	ret = platform_device_add(musb);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "failed to register musb device\n");
+ 		goto err2;
+ 	}
+ 
+-	pm_runtime_enable(&pdev->dev);
+-
+ 	return 0;
+ 
+ err2:
+-- 
+1.7.7.6
+
@@ -0,0 +1,48 @@
+From 150f1a9111e30cc70efdac57e72af7d537754099 Mon Sep 17 00:00:00 2001
+From: Shubhrajyoti D <shubhrajyoti@ti.com>
+Date: Thu, 22 Mar 2012 12:48:06 +0530
+Subject: [PATCH 034/165] usb: musb: omap: fix the error check for
+ pm_runtime_get_sync
+
+commit ad579699c4f0274bf522a9252ff9b20c72197e48 upstream.
+
+pm_runtime_get_sync returns a signed integer. In case of errors
+it returns a negative value. This patch fixes the error check
+by making it signed instead of unsigned thus preventing register
+access if get_sync_fails. Also passes the error cause to the
+debug message.
+
+Cc:  Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Shubhrajyoti D <shubhrajyoti@ti.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/musb/omap2430.c |    5 +++--
+ 1 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
+index bd93e9f..522ac37 100644
+--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
+@@ -283,7 +283,8 @@ static void musb_otg_notifier_work(struct work_struct *data_notifier_work)
+ 
+ static int omap2430_musb_init(struct musb *musb)
+ {
+-	u32 l, status = 0;
+	u32 l;
+	int status = 0;
+ 	struct device *dev = musb->controller;
+ 	struct musb_hdrc_platform_data *plat = dev->platform_data;
+ 	struct omap_musb_board_data *data = plat->board_data;
+@@ -302,7 +303,7 @@ static int omap2430_musb_init(struct musb *musb)
+ 
+ 	status = pm_runtime_get_sync(dev);
+ 	if (status < 0) {
+-		dev_err(dev, "pm_runtime_get_sync FAILED");
+		dev_err(dev, "pm_runtime_get_sync FAILED %d\n", status);
+ 		goto err1;
+ 	}
+ 
+-- 
+1.7.7.6
+
@@ -0,0 +1,89 @@
+From 9a9c948f1f3fdf421e090b10dc1fe15308d325d0 Mon Sep 17 00:00:00 2001
+From: Thomas Jarosch <thomas.jarosch@intra2net.com>
+Date: Wed, 7 Dec 2011 22:08:11 +0100
+Subject: [PATCH 035/165] PCI: Add quirk for still enabled interrupts on Intel
+ Sandy Bridge GPUs
+
+commit f67fd55fa96f7d7295b43ffbc4a97d8f55e473aa upstream.
+
+Some BIOS implementations leave the Intel GPU interrupts enabled,
+even though no one is handling them (f.e. i915 driver is never loaded).
+Additionally the interrupt destination is not set up properly
+and the interrupt ends up -somewhere-.
+
+These spurious interrupts are "sticky" and the kernel disables
+the (shared) interrupt line after 100.000+ generated interrupts.
+
+Fix it by disabling the still enabled interrupts.
+This resolves crashes often seen on monitor unplug.
+
+Tested on the following boards:
+- Intel DH61CR: Affected
+- Intel DH67BL: Affected
+- Intel S1200KP server board: Affected
+- Asus P8H61-M LE: Affected, but system does not crash.
+  Probably the IRQ ends up somewhere unnoticed.
+
+According to reports on the net, the Intel DH61WW board is also affected.
+
+Many thanks to Jesse Barnes from Intel for helping
+with the register configuration and to Intel in general
+for providing public hardware documentation.
+
+Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
+Tested-by: Charlie Suffin <charlie.suffin@stratus.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+[bwh: Backported to 3.2: adjust context]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/pci/quirks.c |   34 ++++++++++++++++++++++++++++++++++
+ 1 files changed, 34 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 6476547..78fda9c 100644
+--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
+@@ -2906,6 +2906,40 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x65f8, quirk_intel_mc_errata);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x65f9, quirk_intel_mc_errata);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x65fa, quirk_intel_mc_errata);
+ 
+/*
+ * Some BIOS implementations leave the Intel GPU interrupts enabled,
+ * even though no one is handling them (f.e. i915 driver is never loaded).
+ * Additionally the interrupt destination is not set up properly
+ * and the interrupt ends up -somewhere-.
+ *
+ * These spurious interrupts are "sticky" and the kernel disables
+ * the (shared) interrupt line after 100.000+ generated interrupts.
+ *
+ * Fix it by disabling the still enabled interrupts.
+ * This resolves crashes often seen on monitor unplug.
+ */
+#define I915_DEIER_REG 0x4400c
+static void __devinit disable_igfx_irq(struct pci_dev *dev)
+{
+	void __iomem *regs = pci_iomap(dev, 0, 0);
+	if (regs == NULL) {
+		dev_warn(&dev->dev, "igfx quirk: Can't iomap PCI device\n");
+		return;
+	}
+
+	/* Check if any interrupt line is still enabled */
+	if (readl(regs + I915_DEIER_REG) != 0) {
+		dev_warn(&dev->dev, "BIOS left Intel GPU interrupts enabled; "
+			"disabling\n");
+
+		writel(0, regs + I915_DEIER_REG);
+	}
+
+	pci_iounmap(dev, regs);
+}
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0102, disable_igfx_irq);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x010a, disable_igfx_irq);
+
+ static void pci_do_fixups(struct pci_dev *dev, struct pci_fixup *f,
+ 			  struct pci_fixup *end)
+ {
+-- 
+1.7.7.6
+
@@ -0,0 +1,33 @@
+From 7ae05a044d79254f47ba9cb8772f5c3137a9d17d Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Thu, 12 Apr 2012 20:32:25 -0400
+Subject: [PATCH 036/165] ext4: fix endianness breakage in
+ ext4_split_extent_at()
+
+commit af1584f570b19b0285e4402a0b54731495d31784 upstream.
+
+->ee_len is __le16, so assigning cpu_to_le32() to it is going to do
+Bad Things(tm) on big-endian hosts...
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/ext4/extents.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index c2a2012..54f2bdc 100644
+--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
+@@ -2812,7 +2812,7 @@ static int ext4_split_extent_at(handle_t *handle,
+ 		if (err)
+ 			goto fix_extent_len;
+ 		/* update the extent length and mark as initialized */
+-		ex->ee_len = cpu_to_le32(ee_len);
+		ex->ee_len = cpu_to_le16(ee_len);
+ 		ext4_ext_try_to_merge(inode, path, ex);
+ 		err = ext4_ext_dirty(handle, inode, path + depth);
+ 		goto out;
+-- 
+1.7.7.6
+
@@ -0,0 +1,109 @@
+From f6b20107e527f8d57ec7c2c745109f4609d68abf Mon Sep 17 00:00:00 2001
+From: Alex Williamson <alex.williamson@redhat.com>
+Date: Fri, 27 Apr 2012 16:54:08 -0500
+Subject: [PATCH 037/165] KVM: unmap pages from the iommu when slots are
+ removed
+
+commit 32f6daad4651a748a58a3ab6da0611862175722f upstream.
+
+We've been adding new mappings, but not destroying old mappings.
+This can lead to a page leak as pages are pinned using
+get_user_pages, but only unpinned with put_page if they still
+exist in the memslots list on vm shutdown.  A memslot that is
+destroyed while an iommu domain is enabled for the guest will
+therefore result in an elevated page reference count that is
+never cleared.
+
+Additionally, without this fix, the iommu is only programmed
+with the first translation for a gpa.  This can result in
+peer-to-peer errors if a mapping is destroyed and replaced by a
+new mapping at the same gpa as the iommu will still be pointing
+to the original, pinned memory address.
+
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ include/linux/kvm_host.h |    6 ++++++
+ virt/kvm/iommu.c         |   12 ++++++++----
+ virt/kvm/kvm_main.c      |    5 +++--
+ 3 files changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index d526231..35410ef 100644
+--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
+@@ -562,6 +562,7 @@ void kvm_free_irq_source_id(struct kvm *kvm, int irq_source_id);
+ 
+ #ifdef CONFIG_IOMMU_API
+ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot);
+void kvm_iommu_unmap_pages(struct kvm *kvm, struct kvm_memory_slot *slot);
+ int kvm_iommu_map_guest(struct kvm *kvm);
+ int kvm_iommu_unmap_guest(struct kvm *kvm);
+ int kvm_assign_device(struct kvm *kvm,
+@@ -575,6 +576,11 @@ static inline int kvm_iommu_map_pages(struct kvm *kvm,
+ 	return 0;
+ }
+ 
+static inline void kvm_iommu_unmap_pages(struct kvm *kvm,
+					 struct kvm_memory_slot *slot)
+{
+}
+
+ static inline int kvm_iommu_map_guest(struct kvm *kvm)
+ {
+ 	return -ENODEV;
+diff --git a/virt/kvm/iommu.c b/virt/kvm/iommu.c
+index a195c07..fd817a2 100644
+--- a/virt/kvm/iommu.c
+++ b/virt/kvm/iommu.c
+@@ -309,6 +309,11 @@ static void kvm_iommu_put_pages(struct kvm *kvm,
+ 	}
+ }
+ 
+void kvm_iommu_unmap_pages(struct kvm *kvm, struct kvm_memory_slot *slot)
+{
+	kvm_iommu_put_pages(kvm, slot->base_gfn, slot->npages);
+}
+
+ static int kvm_iommu_unmap_memslots(struct kvm *kvm)
+ {
+ 	int i, idx;
+@@ -317,10 +322,9 @@ static int kvm_iommu_unmap_memslots(struct kvm *kvm)
+ 	idx = srcu_read_lock(&kvm->srcu);
+ 	slots = kvm_memslots(kvm);
+ 
+-	for (i = 0; i < slots->nmemslots; i++) {
+-		kvm_iommu_put_pages(kvm, slots->memslots[i].base_gfn,
+-				    slots->memslots[i].npages);
+-	}
+	for (i = 0; i < slots->nmemslots; i++)
+		kvm_iommu_unmap_pages(kvm, &slots->memslots[i]);
+
+ 	srcu_read_unlock(&kvm->srcu, idx);
+ 
+ 	return 0;
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index d9cfb78..e401c1b 100644
+--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
+@@ -802,12 +802,13 @@ skip_lpage:
+ 	if (r)
+ 		goto out_free;
+ 
+-	/* map the pages in iommu page table */
+	/* map/unmap the pages in iommu page table */
+ 	if (npages) {
+ 		r = kvm_iommu_map_pages(kvm, &new);
+ 		if (r)
+ 			goto out_free;
+-	}
+	} else
+		kvm_iommu_unmap_pages(kvm, &old);
+ 
+ 	r = -ENOMEM;
+ 	slots = kzalloc(sizeof(struct kvm_memslots), GFP_KERNEL);
+-- 
+1.7.7.6
+
@@ -0,0 +1,58 @@
+From bbfc688f2500196757c1d7334d25e335308798c5 Mon Sep 17 00:00:00 2001
+From: AceLan Kao <acelan.kao@canonical.com>
+Date: Thu, 17 Nov 2011 15:30:42 +0800
+Subject: [PATCH 038/165] dell-laptop: add 3 machines that has touchpad LED
+
+commit 2a748853ca395c48ea75baa250f7cea6f0f23dbf upstream.
+
+Add "Vostro 3555", "Inspiron N311z", and "Inspiron M5110" into quirks,
+so that they could have touchpad LED function work.
+
+Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
+Signed-off-by: Matthew Garrett <mjg@redhat.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/platform/x86/dell-laptop.c |   27 +++++++++++++++++++++++++++
+ 1 files changed, 27 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
+index d93e962..7621ac2 100644
+--- a/drivers/platform/x86/dell-laptop.c
+++ b/drivers/platform/x86/dell-laptop.c
+@@ -184,6 +184,33 @@ static struct dmi_system_id __devinitdata dell_quirks[] = {
+ 		},
+ 		.driver_data = &quirk_dell_vostro_v130,
+ 	},
+	{
+		.callback = dmi_matched,
+		.ident = "Dell Vostro 3555",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 3555"),
+		},
+		.driver_data = &quirk_dell_vostro_v130,
+	},
+	{
+		.callback = dmi_matched,
+		.ident = "Dell Inspiron N311z",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron N311z"),
+		},
+		.driver_data = &quirk_dell_vostro_v130,
+	},
+	{
+		.callback = dmi_matched,
+		.ident = "Dell Inspiron M5110",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron M5110"),
+		},
+		.driver_data = &quirk_dell_vostro_v130,
+	},
+ };
+ 
+ static struct calling_interface_buffer *buffer;
+-- 
+1.7.7.6
+
@@ -0,0 +1,34 @@
+From 7a2e5d46e7959528fb4a7b45fc3ca55339a2445f Mon Sep 17 00:00:00 2001
+From: AceLan Kao <acelan.kao@canonical.com>
+Date: Tue, 17 Jan 2012 16:18:06 +0800
+Subject: [PATCH 039/165] dell-laptop: touchpad LED should persist its status
+ after S3
+
+commit 2d5de9e84928e35b4d9b46b4d8d5dcaac1cff1fa upstream.
+
+Touchpad LED will not turn on after S3, it will make the touchpad status
+doesn't consist with the LED.
+By adding one flag to let the LED device restore it's status.
+
+Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
+Signed-off-by: Matthew Garrett <mjg@redhat.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/platform/x86/dell-laptop.c |    1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
+index 7621ac2..92e42d4 100644
+--- a/drivers/platform/x86/dell-laptop.c
+++ b/drivers/platform/x86/dell-laptop.c
+@@ -642,6 +642,7 @@ static void touchpad_led_set(struct led_classdev *led_cdev,
+ static struct led_classdev touchpad_led = {
+ 	.name = "dell-laptop::touchpad",
+ 	.brightness_set = touchpad_led_set,
+	.flags = LED_CORE_SUSPENDRESUME,
+ };
+ 
+ static int __devinit touchpad_led_init(struct device *dev)
+-- 
+1.7.7.6
+
@@ -0,0 +1,64 @@
+From cfa160178e6da132b537331ff5fc6f091a02e44a Mon Sep 17 00:00:00 2001
+From: AceLan Kao <acelan.kao@canonical.com>
+Date: Wed, 28 Mar 2012 10:25:36 +0800
+Subject: [PATCH 040/165] Bluetooth: Add support for Atheros [04ca:3005]
+
+commit 55ed7d4d1469eafbe3ad7e8fcd44f5af27845a81 upstream.
+
+Add another vendor specific ID for Atheros AR3012 device.
+This chip is wrapped by Lite-On Technology Corp.
+
+output of usb-devices:
+T:  Bus=04 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#=  2 Spd=12  MxCh= 0
+D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
+P:  Vendor=04ca ProdID=3005 Rev=00.02
+S:  Manufacturer=Atheros Communications
+S:  Product=Bluetooth USB Host Controller
+S:  SerialNumber=Alaska Day 2006
+C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
+I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+
+Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
+Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/bluetooth/ath3k.c |    2 ++
+ drivers/bluetooth/btusb.c |    1 +
+ 2 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index 003cd8d..99fefbd 100644
+--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
+@@ -73,6 +73,7 @@ static struct usb_device_id ath3k_table[] = {
+ 	{ USB_DEVICE(0x0CF3, 0x3004) },
+ 	{ USB_DEVICE(0x0CF3, 0x311D) },
+ 	{ USB_DEVICE(0x13d3, 0x3375) },
+	{ USB_DEVICE(0x04CA, 0x3005) },
+ 
+ 	/* Atheros AR5BBU12 with sflash firmware */
+ 	{ USB_DEVICE(0x0489, 0xE02C) },
+@@ -91,6 +92,7 @@ static struct usb_device_id ath3k_blist_tbl[] = {
+ 	{ USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+	{ USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+ 
+ 	{ }	/* Terminating entry */
+ };
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index db44ad5..e56da6a 100644
+--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
+@@ -129,6 +129,7 @@ static struct usb_device_id blacklist_table[] = {
+ 	{ USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+	{ USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+ 
+ 	/* Atheros AR5BBU12 with sflash firmware */
+ 	{ USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
+-- 
+1.7.7.6
+
@@ -0,0 +1,45 @@
+From 53d02f37f9e87191afdb511e740fa506af1fe2fb Mon Sep 17 00:00:00 2001
+From: Jason Baron <jbaron@redhat.com>
+Date: Fri, 16 Mar 2012 16:34:03 -0400
+Subject: [PATCH 041/165] Don't limit non-nested epoll paths
+
+commit 93dc6107a76daed81c07f50215fa6ae77691634f upstream.
+
+Commit 28d82dc1c4ed ("epoll: limit paths") that I did to limit the
+number of possible wakeup paths in epoll is causing a few applications
+to longer work (dovecot for one).
+
+The original patch is really about limiting the amount of epoll nesting
+(since epoll fds can be attached to other fds). Thus, we probably can
+allow an unlimited number of paths of depth 1. My current patch limits
+it at 1000. And enforce the limits on paths that have a greater depth.
+
+This is captured in: https://bugzilla.redhat.com/show_bug.cgi?id=681578
+
+Signed-off-by: Jason Baron <jbaron@redhat.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/eventpoll.c |    4 ++++
+ 1 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/fs/eventpoll.c b/fs/eventpoll.c
+index ea54cde..4d9d3a4 100644
+--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
+@@ -988,6 +988,10 @@ static int path_count[PATH_ARR_SIZE];
+ 
+ static int path_count_inc(int nests)
+ {
+	/* Allow an arbitrary number of depth 1 paths */
+	if (nests == 0)
+		return 0;
+
+ 	if (++path_count[nests] > path_limits[nests])
+ 		return -1;
+ 	return 0;
+-- 
+1.7.7.6
+
@@ -0,0 +1,38 @@
+From e98347051c4edde97c0dfbc704660d9d0e4e0641 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Mon, 12 Dec 2011 01:15:06 +0100
+Subject: [PATCH 042/165] spi: Fix device unregistration when unregistering
+ the bus master
+
+commit 178db7d30f94707efca1a189753c105ef69942ed upstream.
+
+Device are added as children of the bus master's parent device, but
+spi_unregister_master() looks for devices to unregister in the bus
+master's children. This results in the child devices not being
+unregistered.
+
+Fix this by registering devices as direct children of the bus master.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/spi/spi.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 77eae99..b2ccdea 100644
+--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
+@@ -319,7 +319,7 @@ struct spi_device *spi_alloc_device(struct spi_master *master)
+ 	}
+ 
+ 	spi->master = master;
+-	spi->dev.parent = dev;
+	spi->dev.parent = &master->dev;
+ 	spi->dev.bus = &spi_bus_type;
+ 	spi->dev.release = spidev_release;
+ 	device_initialize(&spi->dev);
+-- 
+1.7.7.6
+
@@ -0,0 +1,42 @@
+From bc5969d96482b42246a0143d3f36744c8d06c8cf Mon Sep 17 00:00:00 2001
+From: Kenth Eriksson <kenth.eriksson@transmode.com>
+Date: Fri, 30 Mar 2012 17:05:30 +0200
+Subject: [PATCH 043/165] spi/mpc83xx: fix NULL pdata dereference bug
+
+commit 5039a86973cd35bdb2f64d28ee12f13fe2bb5a4c upstream.
+
+Commit 178db7d3, "spi: Fix device unregistration when unregistering
+the bus master", changed device initialization to be children of the
+bus master, not children of the bus masters parent device. The pdata
+pointer used in fsl_spi_chipselect must updated to reflect the changed
+initialization.
+
+Signed-off-by: Kenth Eriksson <kenth.eriksson@transmode.com>
+Acked-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
+Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/spi/spi-fsl-spi.c |    4 +++-
+ 1 files changed, 3 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
+index 24cacff..5f748c0 100644
+--- a/drivers/spi/spi-fsl-spi.c
+++ b/drivers/spi/spi-fsl-spi.c
+@@ -139,10 +139,12 @@ static void fsl_spi_change_mode(struct spi_device *spi)
+ static void fsl_spi_chipselect(struct spi_device *spi, int value)
+ {
+ 	struct mpc8xxx_spi *mpc8xxx_spi = spi_master_get_devdata(spi->master);
+-	struct fsl_spi_platform_data *pdata = spi->dev.parent->platform_data;
+	struct fsl_spi_platform_data *pdata;
+ 	bool pol = spi->mode & SPI_CS_HIGH;
+ 	struct spi_mpc8xxx_cs	*cs = spi->controller_state;
+ 
+	pdata = spi->dev.parent->parent->platform_data;
+
+ 	if (value == BITBANG_CS_INACTIVE) {
+ 		if (pdata->cs_control)
+ 			pdata->cs_control(spi, !pol);
+-- 
+1.7.7.6
+
@@ -0,0 +1,33 @@
+From 81eef1db7c237ecc52f165049d7b128f081bc1f1 Mon Sep 17 00:00:00 2001
+From: Alan Cox <alan@linux.intel.com>
+Date: Mon, 19 Dec 2011 21:07:33 +0000
+Subject: [PATCH 044/165] rt2800: Add support for the Fujitsu Stylistic Q550
+
+commit 3ac44670ad0fca8b6c43b3e4d8494c67c419f494 upstream.
+
+Just another USB identifier.
+
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/wireless/rt2x00/rt2800usb.c |    2 ++
+ 1 files changed, 2 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
+index cb71e88..c49b8bf 100644
+--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
+@@ -1161,6 +1161,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ 	{ USB_DEVICE(0x7392, 0x7722) },
+ 	/* Encore */
+ 	{ USB_DEVICE(0x203d, 0x14a1) },
+	/* Fujitsu Stylistic 550 */
+	{ USB_DEVICE(0x1690, 0x0761) },
+ 	/* Gemtek */
+ 	{ USB_DEVICE(0x15a9, 0x0010) },
+ 	/* Gigabyte */
+-- 
+1.7.7.6
+
@@ -0,0 +1,148 @@
+From 5d35a9613dc2f1483a1b1c8327f7050299363dee Mon Sep 17 00:00:00 2001
+From: Gertjan van Wingerde <gwingerde@gmail.com>
+Date: Wed, 28 Dec 2011 01:53:18 +0100
+Subject: [PATCH 045/165] rt2x00: Identify rt2800usb chipsets.
+
+commit bc93eda7e903ff75cefcb6e247ed9b8e9f8e9783 upstream.
+
+According to the latest USB ID database these are all RT2770 / RT2870 / RT307x
+devices.
+
+Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
+Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+[bwh: Backported to 3.2: adjust context for previously cherry-picked
+ commit d42a179b941a9e4cc6cf41d0f3cbadd75fc48a89 'rt2x00: Add support
+ for D-Link DWA-127 to rt2800usb']
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/wireless/rt2x00/rt2800usb.c |   26 ++++++++++++--------------
+ 1 files changed, 12 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
+index c49b8bf..0ffa111 100644
+--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
+@@ -914,12 +914,14 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ 	{ USB_DEVICE(0x050d, 0x8053) },
+ 	{ USB_DEVICE(0x050d, 0x805c) },
+ 	{ USB_DEVICE(0x050d, 0x815c) },
+	{ USB_DEVICE(0x050d, 0x825a) },
+ 	{ USB_DEVICE(0x050d, 0x825b) },
+ 	{ USB_DEVICE(0x050d, 0x935a) },
+ 	{ USB_DEVICE(0x050d, 0x935b) },
+ 	/* Buffalo */
+ 	{ USB_DEVICE(0x0411, 0x00e8) },
+ 	{ USB_DEVICE(0x0411, 0x0158) },
+	{ USB_DEVICE(0x0411, 0x015d) },
+ 	{ USB_DEVICE(0x0411, 0x016f) },
+ 	{ USB_DEVICE(0x0411, 0x01a2) },
+ 	/* Corega */
+@@ -934,6 +936,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ 	{ USB_DEVICE(0x07d1, 0x3c0e) },
+ 	{ USB_DEVICE(0x07d1, 0x3c0f) },
+ 	{ USB_DEVICE(0x07d1, 0x3c11) },
+	{ USB_DEVICE(0x07d1, 0x3c13) },
+	{ USB_DEVICE(0x07d1, 0x3c15) },
+ 	{ USB_DEVICE(0x07d1, 0x3c16) },
+ 	{ USB_DEVICE(0x2001, 0x3c1b) },
+ 	/* Draytek */
+@@ -944,6 +948,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ 	{ USB_DEVICE(0x7392, 0x7711) },
+ 	{ USB_DEVICE(0x7392, 0x7717) },
+ 	{ USB_DEVICE(0x7392, 0x7718) },
+	{ USB_DEVICE(0x7392, 0x7722) },
+ 	/* Encore */
+ 	{ USB_DEVICE(0x203d, 0x1480) },
+ 	{ USB_DEVICE(0x203d, 0x14a9) },
+@@ -978,6 +983,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ 	{ USB_DEVICE(0x1737, 0x0070) },
+ 	{ USB_DEVICE(0x1737, 0x0071) },
+ 	{ USB_DEVICE(0x1737, 0x0077) },
+	{ USB_DEVICE(0x1737, 0x0078) },
+ 	/* Logitec */
+ 	{ USB_DEVICE(0x0789, 0x0162) },
+ 	{ USB_DEVICE(0x0789, 0x0163) },
+@@ -1001,9 +1007,13 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ 	{ USB_DEVICE(0x0db0, 0x871b) },
+ 	{ USB_DEVICE(0x0db0, 0x871c) },
+ 	{ USB_DEVICE(0x0db0, 0x899a) },
+	/* Ovislink */
+	{ USB_DEVICE(0x1b75, 0x3071) },
+	{ USB_DEVICE(0x1b75, 0x3072) },
+ 	/* Para */
+ 	{ USB_DEVICE(0x20b8, 0x8888) },
+ 	/* Pegatron */
+	{ USB_DEVICE(0x1d4d, 0x0002) },
+ 	{ USB_DEVICE(0x1d4d, 0x000c) },
+ 	{ USB_DEVICE(0x1d4d, 0x000e) },
+ 	{ USB_DEVICE(0x1d4d, 0x0011) },
+@@ -1056,7 +1066,9 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ 	/* Sparklan */
+ 	{ USB_DEVICE(0x15a9, 0x0006) },
+ 	/* Sweex */
+	{ USB_DEVICE(0x177f, 0x0153) },
+ 	{ USB_DEVICE(0x177f, 0x0302) },
+	{ USB_DEVICE(0x177f, 0x0313) },
+ 	/* U-Media */
+ 	{ USB_DEVICE(0x157e, 0x300e) },
+ 	{ USB_DEVICE(0x157e, 0x3013) },
+@@ -1140,25 +1152,20 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ 	{ USB_DEVICE(0x13d3, 0x3322) },
+ 	/* Belkin */
+ 	{ USB_DEVICE(0x050d, 0x1003) },
+-	{ USB_DEVICE(0x050d, 0x825a) },
+ 	/* Buffalo */
+ 	{ USB_DEVICE(0x0411, 0x012e) },
+ 	{ USB_DEVICE(0x0411, 0x0148) },
+ 	{ USB_DEVICE(0x0411, 0x0150) },
+-	{ USB_DEVICE(0x0411, 0x015d) },
+ 	/* Corega */
+ 	{ USB_DEVICE(0x07aa, 0x0041) },
+ 	{ USB_DEVICE(0x07aa, 0x0042) },
+ 	{ USB_DEVICE(0x18c5, 0x0008) },
+ 	/* D-Link */
+ 	{ USB_DEVICE(0x07d1, 0x3c0b) },
+-	{ USB_DEVICE(0x07d1, 0x3c13) },
+-	{ USB_DEVICE(0x07d1, 0x3c15) },
+ 	{ USB_DEVICE(0x07d1, 0x3c17) },
+ 	{ USB_DEVICE(0x2001, 0x3c17) },
+ 	/* Edimax */
+ 	{ USB_DEVICE(0x7392, 0x4085) },
+-	{ USB_DEVICE(0x7392, 0x7722) },
+ 	/* Encore */
+ 	{ USB_DEVICE(0x203d, 0x14a1) },
+ 	/* Fujitsu Stylistic 550 */
+@@ -1174,19 +1181,13 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ 	/* LevelOne */
+ 	{ USB_DEVICE(0x1740, 0x0605) },
+ 	{ USB_DEVICE(0x1740, 0x0615) },
+-	/* Linksys */
+-	{ USB_DEVICE(0x1737, 0x0078) },
+ 	/* Logitec */
+ 	{ USB_DEVICE(0x0789, 0x0168) },
+ 	{ USB_DEVICE(0x0789, 0x0169) },
+ 	/* Motorola */
+ 	{ USB_DEVICE(0x100d, 0x9032) },
+-	/* Ovislink */
+-	{ USB_DEVICE(0x1b75, 0x3071) },
+-	{ USB_DEVICE(0x1b75, 0x3072) },
+ 	/* Pegatron */
+ 	{ USB_DEVICE(0x05a6, 0x0101) },
+-	{ USB_DEVICE(0x1d4d, 0x0002) },
+ 	{ USB_DEVICE(0x1d4d, 0x0010) },
+ 	/* Planex */
+ 	{ USB_DEVICE(0x2019, 0x5201) },
+@@ -1205,9 +1206,6 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ 	{ USB_DEVICE(0x083a, 0xc522) },
+ 	{ USB_DEVICE(0x083a, 0xd522) },
+ 	{ USB_DEVICE(0x083a, 0xf511) },
+-	/* Sweex */
+-	{ USB_DEVICE(0x177f, 0x0153) },
+-	{ USB_DEVICE(0x177f, 0x0313) },
+ 	/* Zyxel */
+ 	{ USB_DEVICE(0x0586, 0x341a) },
+ #endif
+-- 
+1.7.7.6
+
@@ -0,0 +1,45 @@
+From 41e39c9a0a6aa1e152db9dfd4019e20a9de8dce6 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Fri, 27 Apr 2012 17:42:43 -0500
+Subject: [PATCH 046/165] nfsd: fix b0rken error value for setattr on
+ read-only mount
+
+commit 96f6f98501196d46ce52c2697dd758d9300c63f5 upstream.
+
+..._want_write() returns -EROFS on failure, _not_ an NFS error value.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/nfsd/nfs4proc.c |    7 ++++---
+ 1 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index fa38336..35840aa 100644
+--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
+@@ -827,6 +827,7 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ 	      struct nfsd4_setattr *setattr)
+ {
+ 	__be32 status = nfs_ok;
+	int err;
+ 
+ 	if (setattr->sa_iattr.ia_valid & ATTR_SIZE) {
+ 		nfs4_lock_state();
+@@ -838,9 +839,9 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ 			return status;
+ 		}
+ 	}
+-	status = mnt_want_write(cstate->current_fh.fh_export->ex_path.mnt);
+-	if (status)
+-		return status;
+	err = mnt_want_write(cstate->current_fh.fh_export->ex_path.mnt);
+	if (err)
+		return nfserrno(err);
+ 	status = nfs_ok;
+ 
+ 	status = check_attr_support(rqstp, cstate, setattr->sa_bmval,
+-- 
+1.7.7.6
+
@@ -0,0 +1,73 @@
+From d0fb6592c02971a290d199c1e9ee06624fd17c1c Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Fri, 13 Apr 2012 00:00:04 -0400
+Subject: [PATCH 047/165] nfsd: fix error values returned by nfsd4_lockt()
+ when nfsd_open() fails
+
+commit 04da6e9d63427b2d0fd04766712200c250b3278f upstream.
+
+nfsd_open() already returns an NFS error value; only vfs_test_lock()
+result needs to be fed through nfserrno().  Broken by commit 55ef12
+(nfsd: Ensure nfsv4 calls the underlying filesystem on LOCKT)
+three years ago...
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/nfsd/nfs4state.c |   23 +++++++++--------------
+ 1 files changed, 9 insertions(+), 14 deletions(-)
+
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 5abced7..4cfe260 100644
+--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
+@@ -4080,16 +4080,14 @@ out:
+  * vfs_test_lock.  (Arguably perhaps test_lock should be done with an
+  * inode operation.)
+  */
+-static int nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
+static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
+ {
+ 	struct file *file;
+-	int err;
+-
+-	err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
+-	if (err)
+-		return err;
+-	err = vfs_test_lock(file, lock);
+-	nfsd_close(file);
+	__be32 err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
+	if (!err) {
+		err = nfserrno(vfs_test_lock(file, lock));
+		nfsd_close(file);
+	}
+ 	return err;
+ }
+ 
+@@ -4103,7 +4101,6 @@ nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ 	struct inode *inode;
+ 	struct file_lock file_lock;
+ 	struct nfs4_lockowner *lo;
+-	int error;
+ 	__be32 status;
+ 
+ 	if (locks_in_grace())
+@@ -4149,12 +4146,10 @@ nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ 
+ 	nfs4_transform_lock_offset(&file_lock);
+ 
+-	status = nfs_ok;
+-	error = nfsd_test_lock(rqstp, &cstate->current_fh, &file_lock);
+-	if (error) {
+-		status = nfserrno(error);
+	status = nfsd_test_lock(rqstp, &cstate->current_fh, &file_lock);
+	if (status)
+ 		goto out;
+-	}
+
+ 	if (file_lock.fl_type != F_UNLCK) {
+ 		status = nfserr_denied;
+ 		nfs4_set_lock_denied(&file_lock, &lockt->lt_denied);
+-- 
+1.7.7.6
+
@@ -0,0 +1,36 @@
+From c0326b2209aa31faeb2369d7311d0754d7b6d202 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Fri, 13 Apr 2012 00:10:34 -0400
+Subject: [PATCH 048/165] nfsd: fix endianness breakage in TEST_STATEID
+ handling
+
+commit 02f5fde5df0ea930e70f93763dd48beff182b208 upstream.
+
+->ts_id_status gets nfs errno, i.e. it's already big-endian; no need
+to apply htonl() to it.  Broken by commit 174568 (NFSD: Added TEST_STATEID
+operation) last year...
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Cc: "J. Bruce Fields" <bfields@fieldses.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/nfsd/nfs4xdr.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index b6fa792..9cfa60a 100644
+--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
+@@ -3411,7 +3411,7 @@ nfsd4_encode_test_stateid(struct nfsd4_compoundres *resp, int nfserr,
+ 		nfsd4_decode_stateid(argp, &si);
+ 		valid = nfs4_validate_stateid(cl, &si);
+ 		RESERVE_SPACE(4);
+-		*p++ = htonl(valid);
+		*p++ = valid;
+ 		resp->p = p;
+ 	}
+ 	nfs4_unlock_state();
+-- 
+1.7.7.6
+
@@ -0,0 +1,92 @@
+From 58c574420bacc1f5dc171dff6f0915ebc5749ee3 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Fri, 13 Apr 2012 00:32:14 -0400
+Subject: [PATCH 049/165] nfsd: fix compose_entry_fh() failure exits
+
+commit efe39651f08813180f37dc508d950fc7d92b29a8 upstream.
+
+Restore the original logics ("fail on mountpoints, negatives and in
+case of fh_compose() failures").  Since commit 8177e (nfsd: clean up
+readdirplus encoding) that got broken -
+	rv = fh_compose(fhp, exp, dchild, &cd->fh);
+	if (rv)
+	       goto out;
+	if (!dchild->d_inode)
+		goto out;
+	rv = 0;
+out:
+is equivalent to
+	rv = fh_compose(fhp, exp, dchild, &cd->fh);
+out:
+and the second check has no effect whatsoever...
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/nfsd/nfs3xdr.c |   22 ++++++++--------------
+ 1 files changed, 8 insertions(+), 14 deletions(-)
+
+diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
+index 08c6e36..43f46cd 100644
+--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
+@@ -803,13 +803,13 @@ encode_entry_baggage(struct nfsd3_readdirres *cd, __be32 *p, const char *name,
+ 	return p;
+ }
+ 
+-static int
+static __be32
+ compose_entry_fh(struct nfsd3_readdirres *cd, struct svc_fh *fhp,
+ 		const char *name, int namlen)
+ {
+ 	struct svc_export	*exp;
+ 	struct dentry		*dparent, *dchild;
+-	int rv = 0;
+	__be32 rv = nfserr_noent;
+ 
+ 	dparent = cd->fh.fh_dentry;
+ 	exp  = cd->fh.fh_export;
+@@ -817,26 +817,20 @@ compose_entry_fh(struct nfsd3_readdirres *cd, struct svc_fh *fhp,
+ 	if (isdotent(name, namlen)) {
+ 		if (namlen == 2) {
+ 			dchild = dget_parent(dparent);
+-			if (dchild == dparent) {
+-				/* filesystem root - cannot return filehandle for ".." */
+-				dput(dchild);
+-				return -ENOENT;
+-			}
+			/* filesystem root - cannot return filehandle for ".." */
+			if (dchild == dparent)
+				goto out;
+ 		} else
+ 			dchild = dget(dparent);
+ 	} else
+ 		dchild = lookup_one_len(name, dparent, namlen);
+ 	if (IS_ERR(dchild))
+-		return -ENOENT;
+-	rv = -ENOENT;
+		return rv;
+ 	if (d_mountpoint(dchild))
+ 		goto out;
+-	rv = fh_compose(fhp, exp, dchild, &cd->fh);
+-	if (rv)
+-		goto out;
+ 	if (!dchild->d_inode)
+ 		goto out;
+-	rv = 0;
+	rv = fh_compose(fhp, exp, dchild, &cd->fh);
+ out:
+ 	dput(dchild);
+ 	return rv;
+@@ -845,7 +839,7 @@ out:
+ static __be32 *encode_entryplus_baggage(struct nfsd3_readdirres *cd, __be32 *p, const char *name, int namlen)
+ {
+ 	struct svc_fh	fh;
+-	int err;
+	__be32 err;
+ 
+ 	fh_init(&fh, NFS3_FHSIZE);
+ 	err = compose_entry_fh(cd, &fh, name, namlen);
+-- 
+1.7.7.6
+
@@ -0,0 +1,33 @@
+From f34178385ffae408ee0ade44819875816104a99a Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Fri, 13 Apr 2012 11:49:04 -0400
+Subject: [PATCH 050/165] btrfs: btrfs_root_readonly() broken on big-endian
+
+commit 6ed3cf2cdfce4c9f1d73171bd3f27d9cb77b734e upstream.
+
+->root_flags is __le64 and all accesses to it go through the helpers
+that do proper conversions.  Except for btrfs_root_readonly(), which
+checks bit 0 as in host-endian...
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/btrfs/ctree.h |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index 6738503..83a871f 100644
+--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
+@@ -2025,7 +2025,7 @@ BTRFS_SETGET_STACK_FUNCS(root_last_snapshot, struct btrfs_root_item,
+ 
+ static inline bool btrfs_root_readonly(struct btrfs_root *root)
+ {
+-	return root->root_item.flags & BTRFS_ROOT_SUBVOL_RDONLY;
+	return (root->root_item.flags & cpu_to_le64(BTRFS_ROOT_SUBVOL_RDONLY)) != 0;
+ }
+ 
+ /* struct btrfs_root_backup */
+-- 
+1.7.7.6
+
@@ -0,0 +1,53 @@
+From e72fdd80481fa4848f1d90be6e8bcdc24db469f8 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Fri, 13 Apr 2012 12:22:00 -0400
+Subject: [PATCH 051/165] ocfs2: ->l_next_free_req breakage on big-endian
+
+commit 3a251f04fe97c3d335b745c98e4b377e3c3899f2 upstream.
+
+It's le16, not le32...
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/ocfs2/alloc.c        |    2 +-
+ fs/ocfs2/refcounttree.c |    4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
+index 3165aeb..31b9463 100644
+--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
+@@ -1134,7 +1134,7 @@ static int ocfs2_adjust_rightmost_branch(handle_t *handle,
+ 	}
+ 
+ 	el = path_leaf_el(path);
+-	rec = &el->l_recs[le32_to_cpu(el->l_next_free_rec) - 1];
+	rec = &el->l_recs[le16_to_cpu(el->l_next_free_rec) - 1];
+ 
+ 	ocfs2_adjust_rightmost_records(handle, et, path, rec);
+ 
+diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
+index cf78233..a7b7217 100644
+--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
+@@ -1036,14 +1036,14 @@ static int ocfs2_get_refcount_cpos_end(struct ocfs2_caching_info *ci,
+ 
+ 	tmp_el = left_path->p_node[subtree_root].el;
+ 	blkno = left_path->p_node[subtree_root+1].bh->b_blocknr;
+-	for (i = 0; i < le32_to_cpu(tmp_el->l_next_free_rec); i++) {
+	for (i = 0; i < le16_to_cpu(tmp_el->l_next_free_rec); i++) {
+ 		if (le64_to_cpu(tmp_el->l_recs[i].e_blkno) == blkno) {
+ 			*cpos_end = le32_to_cpu(tmp_el->l_recs[i+1].e_cpos);
+ 			break;
+ 		}
+ 	}
+ 
+-	BUG_ON(i == le32_to_cpu(tmp_el->l_next_free_rec));
+	BUG_ON(i == le16_to_cpu(tmp_el->l_next_free_rec));
+ 
+ out:
+ 	ocfs2_free_path(left_path);
+-- 
+1.7.7.6
+
@@ -0,0 +1,58 @@
+From 88f1278427aa9c75c6b4c7f59b160a9a29ae8f17 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Fri, 13 Apr 2012 12:27:11 -0400
+Subject: [PATCH 052/165] ocfs: ->rl_used breakage on big-endian
+
+commit e1bf4cc620fd143766ddfcee3b004a1d1bb34fd0 upstream.
+
+it's le16, not le32 or le64...
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/ocfs2/refcounttree.c |    8 ++++----
+ 1 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
+index a7b7217..bc90ebc 100644
+--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
+@@ -1468,7 +1468,7 @@ static int ocfs2_divide_leaf_refcount_block(struct buffer_head *ref_leaf_bh,
+ 
+ 	trace_ocfs2_divide_leaf_refcount_block(
+ 		(unsigned long long)ref_leaf_bh->b_blocknr,
+-		le32_to_cpu(rl->rl_count), le32_to_cpu(rl->rl_used));
+		le32_to_cpu(rl->rl_count), le16_to_cpu(rl->rl_used));
+ 
+ 	/*
+ 	 * XXX: Improvement later.
+@@ -2411,7 +2411,7 @@ static int ocfs2_calc_refcount_meta_credits(struct super_block *sb,
+ 				rb = (struct ocfs2_refcount_block *)
+ 							prev_bh->b_data;
+ 
+-				if (le64_to_cpu(rb->rf_records.rl_used) +
+				if (le16_to_cpu(rb->rf_records.rl_used) +
+ 				    recs_add >
+ 				    le16_to_cpu(rb->rf_records.rl_count))
+ 					ref_blocks++;
+@@ -2476,7 +2476,7 @@ static int ocfs2_calc_refcount_meta_credits(struct super_block *sb,
+ 	if (prev_bh) {
+ 		rb = (struct ocfs2_refcount_block *)prev_bh->b_data;
+ 
+-		if (le64_to_cpu(rb->rf_records.rl_used) + recs_add >
+		if (le16_to_cpu(rb->rf_records.rl_used) + recs_add >
+ 		    le16_to_cpu(rb->rf_records.rl_count))
+ 			ref_blocks++;
+ 
+@@ -3629,7 +3629,7 @@ int ocfs2_refcounted_xattr_delete_need(struct inode *inode,
+ 			 * one will split a refcount rec, so totally we need
+ 			 * clusters * 2 new refcount rec.
+ 			 */
+-			if (le64_to_cpu(rb->rf_records.rl_used) + clusters * 2 >
+			if (le16_to_cpu(rb->rf_records.rl_used) + clusters * 2 >
+ 			    le16_to_cpu(rb->rf_records.rl_count))
+ 				ref_blocks++;
+ 
+-- 
+1.7.7.6
+
@@ -0,0 +1,31 @@
+From de962467d8b4d7cd0903b5151bc5fbde4f09552f Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Fri, 13 Apr 2012 12:28:21 -0400
+Subject: [PATCH 053/165] ocfs2: ->rl_count endianness breakage
+
+commit 28748b325dc2d730ccc312830a91c4ae0c0d9379 upstream.
+
+le16, not le32...
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/ocfs2/refcounttree.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
+index bc90ebc..9f32d7c 100644
+--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
+@@ -1468,7 +1468,7 @@ static int ocfs2_divide_leaf_refcount_block(struct buffer_head *ref_leaf_bh,
+ 
+ 	trace_ocfs2_divide_leaf_refcount_block(
+ 		(unsigned long long)ref_leaf_bh->b_blocknr,
+-		le32_to_cpu(rl->rl_count), le16_to_cpu(rl->rl_used));
+		le16_to_cpu(rl->rl_count), le16_to_cpu(rl->rl_used));
+ 
+ 	/*
+ 	 * XXX: Improvement later.
+-- 
+1.7.7.6
+
@@ -0,0 +1,40 @@
+From c38877f92a9e0858b5a4902440cef2c0df1b1632 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Fri, 13 Apr 2012 12:30:02 -0400
+Subject: [PATCH 054/165] ocfs2: ->e_leaf_clusters endianness breakage
+
+commit 72094e43e3af5020510f920321d71f1798fa896d upstream.
+
+le16, not le32...
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/ocfs2/suballoc.c |    4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
+index ba5d97e..f169da4 100644
+--- a/fs/ocfs2/suballoc.c
+++ b/fs/ocfs2/suballoc.c
+@@ -600,7 +600,7 @@ static void ocfs2_bg_alloc_cleanup(handle_t *handle,
+ 		ret = ocfs2_free_clusters(handle, cluster_ac->ac_inode,
+ 					  cluster_ac->ac_bh,
+ 					  le64_to_cpu(rec->e_blkno),
+-					  le32_to_cpu(rec->e_leaf_clusters));
+					  le16_to_cpu(rec->e_leaf_clusters));
+ 		if (ret)
+ 			mlog_errno(ret);
+ 		/* Try all the clusters to free */
+@@ -1628,7 +1628,7 @@ static int ocfs2_bg_discontig_fix_by_rec(struct ocfs2_suballoc_result *res,
+ {
+ 	unsigned int bpc = le16_to_cpu(cl->cl_bpc);
+ 	unsigned int bitoff = le32_to_cpu(rec->e_cpos) * bpc;
+-	unsigned int bitcount = le32_to_cpu(rec->e_leaf_clusters) * bpc;
+	unsigned int bitcount = le16_to_cpu(rec->e_leaf_clusters) * bpc;
+ 
+ 	if (res->sr_bit_offset < bitoff)
+ 		return 0;
+-- 
+1.7.7.6
+
@@ -0,0 +1,45 @@
+From 3257f4da731bb45c2117beda34ed3202df1c74e4 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Fri, 13 Apr 2012 13:49:47 -0400
+Subject: [PATCH 055/165] lockd: fix the endianness bug
+
+commit e847469bf77a1d339274074ed068d461f0c872bc upstream.
+
+comparing be32 values for < is not doing the right thing...
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/lockd/clnt4xdr.c |    2 +-
+ fs/lockd/clntxdr.c  |    2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/lockd/clnt4xdr.c b/fs/lockd/clnt4xdr.c
+index f848b52..046bb77 100644
+--- a/fs/lockd/clnt4xdr.c
+++ b/fs/lockd/clnt4xdr.c
+@@ -241,7 +241,7 @@ static int decode_nlm4_stat(struct xdr_stream *xdr, __be32 *stat)
+ 	p = xdr_inline_decode(xdr, 4);
+ 	if (unlikely(p == NULL))
+ 		goto out_overflow;
+-	if (unlikely(*p > nlm4_failed))
+	if (unlikely(ntohl(*p) > ntohl(nlm4_failed)))
+ 		goto out_bad_xdr;
+ 	*stat = *p;
+ 	return 0;
+diff --git a/fs/lockd/clntxdr.c b/fs/lockd/clntxdr.c
+index 180ac34..36057ce 100644
+--- a/fs/lockd/clntxdr.c
+++ b/fs/lockd/clntxdr.c
+@@ -236,7 +236,7 @@ static int decode_nlm_stat(struct xdr_stream *xdr,
+ 	p = xdr_inline_decode(xdr, 4);
+ 	if (unlikely(p == NULL))
+ 		goto out_overflow;
+-	if (unlikely(*p > nlm_lck_denied_grace_period))
+	if (unlikely(ntohl(*p) > ntohl(nlm_lck_denied_grace_period)))
+ 		goto out_enum;
+ 	*stat = *p;
+ 	return 0;
+-- 
+1.7.7.6
+
@@ -0,0 +1,41 @@
+From ab98d1498e030766394cbc78259a2a9a1aa5edbe Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <balbi@ti.com>
+Date: Wed, 21 Mar 2012 11:44:00 +0200
+Subject: [PATCH 056/165] usb: dwc3: ep0: increment "actual" on bounced ep0
+ case
+
+commit cd423dd3634a5232a3019eb372b144619a61cd16 upstream.
+
+due to a HW limitation we have a bounce buffer for ep0
+out transfers which are not aligned with MaxPacketSize.
+
+On such case we were not increment r->actual as we should.
+
+This patch fixes that mistake.
+
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/usb/dwc3/ep0.c |    3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
+index 27bd50a..c0dcf69 100644
+--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
+@@ -572,9 +572,10 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
+ 		dwc->ep0_bounced = false;
+ 	} else {
+ 		transferred = ur->length - trb.length;
+-		ur->actual += transferred;
+ 	}
+ 
+	ur->actual += transferred;
+
+ 	if ((epnum & 1) && ur->actual < ur->length) {
+ 		/* for some reason we did not get everything out */
+ 
+-- 
+1.7.7.6
+
@@ -0,0 +1,185 @@
+From 83b74fb7bfab64f75ff56f20f3736c44b035c823 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Mon, 2 Apr 2012 22:33:02 +0000
+Subject: [PATCH 057/165] net: fix /proc/net/dev regression
+
+[ Upstream commit 2def16ae6b0c77571200f18ba4be049b03d75579 ]
+
+Commit f04565ddf52 (dev: use name hash for dev_seq_ops) added a second
+regression, as some devices are missing from /proc/net/dev if many
+devices are defined.
+
+When seq_file buffer is filled, the last ->next/show() method is
+canceled (pos value is reverted to value prior ->next() call)
+
+Problem is after above commit, we dont restart the lookup at right
+position in ->start() method.
+
+Fix this by removing the internal 'pos' pointer added in commit, since
+we need to use the 'loff_t *pos' provided by seq_file layer.
+
+This also reverts commit 5cac98dd0 (net: Fix corruption
+in /proc/*/net/dev_mcast), since its not needed anymore.
+
+Reported-by: Ben Greear <greearb@candelatech.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: Mihai Maruseac <mmaruseac@ixiacom.com>
+Tested-by:  Ben Greear <greearb@candelatech.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ include/linux/netdevice.h |    2 -
+ net/core/dev.c            |   58 ++++++++++----------------------------------
+ net/core/dev_addr_lists.c |    3 +-
+ 3 files changed, 15 insertions(+), 48 deletions(-)
+
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index a82ad4d..cbeb586 100644
+--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
+@@ -2536,8 +2536,6 @@ extern void		net_disable_timestamp(void);
+ extern void *dev_seq_start(struct seq_file *seq, loff_t *pos);
+ extern void *dev_seq_next(struct seq_file *seq, void *v, loff_t *pos);
+ extern void dev_seq_stop(struct seq_file *seq, void *v);
+-extern int dev_seq_open_ops(struct inode *inode, struct file *file,
+-			    const struct seq_operations *ops);
+ #endif
+ 
+ extern int netdev_class_create_file(struct class_attribute *class_attr);
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 55cd370..cd5050e 100644
+--- a/net/core/dev.c
+++ b/net/core/dev.c
+@@ -4102,54 +4102,41 @@ static int dev_ifconf(struct net *net, char __user *arg)
+ 
+ #ifdef CONFIG_PROC_FS
+ 
+-#define BUCKET_SPACE (32 - NETDEV_HASHBITS)
+-
+-struct dev_iter_state {
+-	struct seq_net_private p;
+-	unsigned int pos; /* bucket << BUCKET_SPACE + offset */
+-};
+#define BUCKET_SPACE (32 - NETDEV_HASHBITS - 1)
+ 
+ #define get_bucket(x) ((x) >> BUCKET_SPACE)
+ #define get_offset(x) ((x) & ((1 << BUCKET_SPACE) - 1))
+ #define set_bucket_offset(b, o) ((b) << BUCKET_SPACE | (o))
+ 
+-static inline struct net_device *dev_from_same_bucket(struct seq_file *seq)
+static inline struct net_device *dev_from_same_bucket(struct seq_file *seq, loff_t *pos)
+ {
+-	struct dev_iter_state *state = seq->private;
+ 	struct net *net = seq_file_net(seq);
+ 	struct net_device *dev;
+ 	struct hlist_node *p;
+ 	struct hlist_head *h;
+-	unsigned int count, bucket, offset;
+	unsigned int count = 0, offset = get_offset(*pos);
+ 
+-	bucket = get_bucket(state->pos);
+-	offset = get_offset(state->pos);
+-	h = &net->dev_name_head[bucket];
+-	count = 0;
+	h = &net->dev_name_head[get_bucket(*pos)];
+ 	hlist_for_each_entry_rcu(dev, p, h, name_hlist) {
+-		if (count++ == offset) {
+-			state->pos = set_bucket_offset(bucket, count);
+		if (++count == offset)
+ 			return dev;
+-		}
+ 	}
+ 
+ 	return NULL;
+ }
+ 
+-static inline struct net_device *dev_from_new_bucket(struct seq_file *seq)
+static inline struct net_device *dev_from_bucket(struct seq_file *seq, loff_t *pos)
+ {
+-	struct dev_iter_state *state = seq->private;
+ 	struct net_device *dev;
+ 	unsigned int bucket;
+ 
+-	bucket = get_bucket(state->pos);
+ 	do {
+-		dev = dev_from_same_bucket(seq);
+		dev = dev_from_same_bucket(seq, pos);
+ 		if (dev)
+ 			return dev;
+ 
+-		bucket++;
+-		state->pos = set_bucket_offset(bucket, 0);
+		bucket = get_bucket(*pos) + 1;
+		*pos = set_bucket_offset(bucket, 1);
+ 	} while (bucket < NETDEV_HASHENTRIES);
+ 
+ 	return NULL;
+@@ -4162,33 +4149,20 @@ static inline struct net_device *dev_from_new_bucket(struct seq_file *seq)
+ void *dev_seq_start(struct seq_file *seq, loff_t *pos)
+ 	__acquires(RCU)
+ {
+-	struct dev_iter_state *state = seq->private;
+-
+ 	rcu_read_lock();
+ 	if (!*pos)
+ 		return SEQ_START_TOKEN;
+ 
+-	/* check for end of the hash */
+-	if (state->pos == 0 && *pos > 1)
+	if (get_bucket(*pos) >= NETDEV_HASHENTRIES)
+ 		return NULL;
+ 
+-	return dev_from_new_bucket(seq);
+	return dev_from_bucket(seq, pos);
+ }
+ 
+ void *dev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+ {
+-	struct net_device *dev;
+-
+ 	++*pos;
+-
+-	if (v == SEQ_START_TOKEN)
+-		return dev_from_new_bucket(seq);
+-
+-	dev = dev_from_same_bucket(seq);
+-	if (dev)
+-		return dev;
+-
+-	return dev_from_new_bucket(seq);
+	return dev_from_bucket(seq, pos);
+ }
+ 
+ void dev_seq_stop(struct seq_file *seq, void *v)
+@@ -4287,13 +4261,7 @@ static const struct seq_operations dev_seq_ops = {
+ static int dev_seq_open(struct inode *inode, struct file *file)
+ {
+ 	return seq_open_net(inode, file, &dev_seq_ops,
+-			    sizeof(struct dev_iter_state));
+-}
+-
+-int dev_seq_open_ops(struct inode *inode, struct file *file,
+-		     const struct seq_operations *ops)
+-{
+-	return seq_open_net(inode, file, ops, sizeof(struct dev_iter_state));
+			    sizeof(struct seq_net_private));
+ }
+ 
+ static const struct file_operations dev_seq_fops = {
+diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c
+index febba51..277faef 100644
+--- a/net/core/dev_addr_lists.c
+++ b/net/core/dev_addr_lists.c
+@@ -696,7 +696,8 @@ static const struct seq_operations dev_mc_seq_ops = {
+ 
+ static int dev_mc_seq_open(struct inode *inode, struct file *file)
+ {
+-	return dev_seq_open_ops(inode, file, &dev_mc_seq_ops);
+	return seq_open_net(inode, file, &dev_mc_seq_ops,
+			    sizeof(struct seq_net_private));
+ }
+ 
+ static const struct file_operations dev_mc_seq_fops = {
+-- 
+1.7.7.6
+
@@ -0,0 +1,75 @@
+From 5a9807ef2e73be0be4b878dbec1691f91d875585 Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Mon, 9 Apr 2012 18:06:49 -0400
+Subject: [PATCH 058/165] nfsd: don't fail unchecked creates of non-special
+ files
+
+commit 9dc4e6c4d1182d34604ea40fef641775f5b15456 upstream.
+
+Allow a v3 unchecked open of a non-regular file succeed as if it were a
+lookup; typically a client in such a case will want to fall back on a
+local open, so succeeding and giving it the filehandle is more useful
+than failing with nfserr_exist, which makes it appear that nothing at
+all exists by that name.
+
+Similarly for v4, on an open-create, return the same errors we would on
+an attempt to open a non-regular file, instead of returning
+nfserr_exist.
+
+This fixes a problem found doing a v4 open of a symlink with
+O_RDONLY|O_CREAT, which resulted in the current client returning EEXIST.
+
+Thanks also to Trond for analysis.
+
+Reported-by: Orion Poplawski <orion@cora.nwra.com>
+Tested-by: Orion Poplawski <orion@cora.nwra.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+[bwh: Backported to 3.2: use &resfh, not resfh]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/nfsd/nfs4proc.c |    8 ++++----
+ fs/nfsd/vfs.c      |    2 +-
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index 35840aa..b8c5538 100644
+--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
+@@ -231,17 +231,17 @@ do_open_lookup(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_o
+ 		 */
+ 		if (open->op_createmode == NFS4_CREATE_EXCLUSIVE && status == 0)
+ 			open->op_bmval[1] = (FATTR4_WORD1_TIME_ACCESS |
+-						FATTR4_WORD1_TIME_MODIFY);
+							FATTR4_WORD1_TIME_MODIFY);
+ 	} else {
+ 		status = nfsd_lookup(rqstp, current_fh,
+ 				     open->op_fname.data, open->op_fname.len, &resfh);
+ 		fh_unlock(current_fh);
+-		if (status)
+-			goto out;
+-		status = nfsd_check_obj_isreg(&resfh);
+ 	}
+ 	if (status)
+ 		goto out;
+	status = nfsd_check_obj_isreg(&resfh);
+	if (status)
+		goto out;
+ 
+ 	if (is_create_with_attrs(open) && open->op_acl != NULL)
+ 		do_set_nfs4_acl(rqstp, &resfh, open->op_acl, open->op_bmval);
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index 7a2e442..5c3cd82 100644
+--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
+@@ -1439,7 +1439,7 @@ do_nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
+ 		switch (createmode) {
+ 		case NFS3_CREATE_UNCHECKED:
+ 			if (! S_ISREG(dchild->d_inode->i_mode))
+-				err = nfserr_exist;
+				goto out;
+ 			else if (truncp) {
+ 				/* in nfsv4, we need to treat this case a little
+ 				 * differently.  we don't want to truncate the
+-- 
+1.7.7.6
+
@@ -0,0 +1,65 @@
+From 8d46ef3ec21fd542ad3165d165a6db90427e61d8 Mon Sep 17 00:00:00 2001
+From: David Woodhouse <David.Woodhouse@intel.com>
+Date: Tue, 24 Apr 2012 22:09:47 -0400
+Subject: [PATCH 059/165] ppp: Don't stop and restart queue on every TX packet
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ This combines upstream commit
+  e675f0cc9a872fd152edc0c77acfed19bf28b81e and follow-on bug fix
+  commit 9a5d2bd99e0dfe9a31b3c160073ac445ba3d773f ]
+
+For every transmitted packet, ppp_start_xmit() will stop the netdev
+queue and then, if appropriate, restart it. This causes the TX softirq
+to run, entirely gratuitously.
+
+This is "only" a waste of CPU time in the normal case, but it's actively
+harmful when the PPP device is a TEQL slave — the wakeup will cause the
+offending device to receive the next TX packet from the TEQL queue, when
+it *should* have gone to the next slave in the list. We end up seeing
+large bursts of packets on just *one* slave device, rather than using
+the full available bandwidth over all slaves.
+
+This patch fixes the problem by *not* unconditionally stopping the queue
+in ppp_start_xmit(). It adds a return value from ppp_xmit_process()
+which indicates whether the queue should be stopped or not.
+
+It *doesn't* remove the call to netif_wake_queue() from
+ppp_xmit_process(), because other code paths (especially from
+ppp_output_wakeup()) need it there and it's messy to push it out to the
+other callers to do it based on the return value. So we leave it in
+place — it's a no-op in the case where the queue wasn't stopped, so it's
+harmless in the TX path.
+
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/ppp/ppp_generic.c |    3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
+index 486b404..3ed983c 100644
+--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
+@@ -968,7 +968,6 @@ ppp_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	proto = npindex_to_proto[npi];
+ 	put_unaligned_be16(proto, pp);
+ 
+-	netif_stop_queue(dev);
+ 	skb_queue_tail(&ppp->file.xq, skb);
+ 	ppp_xmit_process(ppp);
+ 	return NETDEV_TX_OK;
+@@ -1063,6 +1062,8 @@ ppp_xmit_process(struct ppp *ppp)
+ 		   code that we can accept some more. */
+ 		if (!ppp->xmit_pending && !skb_peek(&ppp->file.xq))
+ 			netif_wake_queue(ppp->dev);
+		else
+			netif_stop_queue(ppp->dev);
+ 	}
+ 	ppp_xmit_unlock(ppp);
+ }
+-- 
+1.7.7.6
+
@@ -0,0 +1,129 @@
+From 2d09c2df4957a8d73ea24c4464ad6942efedf590 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Tue, 24 Apr 2012 22:12:06 -0400
+Subject: [PATCH 060/165] tcp: allow splice() to build full TSO packets
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ This combines upstream commit
+  2f53384424251c06038ae612e56231b96ab610ee and the follow-on bug fix
+  commit 35f9c09fe9c72eb8ca2b8e89a593e1c151f28fc2 ]
+
+vmsplice()/splice(pipe, socket) call do_tcp_sendpages() one page at a
+time, adding at most 4096 bytes to an skb. (assuming PAGE_SIZE=4096)
+
+The call to tcp_push() at the end of do_tcp_sendpages() forces an
+immediate xmit when pipe is not already filled, and tso_fragment() try
+to split these skb to MSS multiples.
+
+4096 bytes are usually split in a skb with 2 MSS, and a remaining
+sub-mss skb (assuming MTU=1500)
+
+This makes slow start suboptimal because many small frames are sent to
+qdisc/driver layers instead of big ones (constrained by cwnd and packets
+in flight of course)
+
+In fact, applications using sendmsg() (adding an additional memory copy)
+instead of vmsplice()/splice()/sendfile() are a bit faster because of
+this anomaly, especially if serving small files in environments with
+large initial [c]wnd.
+
+Call tcp_push() only if MSG_MORE is not set in the flags parameter.
+
+This bit is automatically provided by splice() internals but for the
+last page, or on all pages if user specified SPLICE_F_MORE splice()
+flag.
+
+In some workloads, this can reduce number of sent logical packets by an
+order of magnitude, making zero-copy TCP actually faster than
+one-copy :)
+
+Reported-by: Tom Herbert <therbert@google.com>
+Cc: Nandita Dukkipati <nanditad@google.com>
+Cc: Neal Cardwell <ncardwell@google.com>
+Cc: Tom Herbert <therbert@google.com>
+Cc: Yuchung Cheng <ycheng@google.com>
+Cc: H.K. Jerry Chu <hkchu@google.com>
+Cc: Maciej Żenczykowski <maze@google.com>
+Cc: Mahesh Bandewar <maheshb@google.com>
+Cc: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/splice.c            |    5 ++++-
+ include/linux/socket.h |    2 +-
+ net/ipv4/tcp.c         |    2 +-
+ net/socket.c           |    6 +++---
+ 4 files changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/fs/splice.c b/fs/splice.c
+index fa2defa..6d0dfb8 100644
+--- a/fs/splice.c
+++ b/fs/splice.c
+@@ -31,6 +31,7 @@
+ #include <linux/uio.h>
+ #include <linux/security.h>
+ #include <linux/gfp.h>
+#include <linux/socket.h>
+ 
+ /*
+  * Attempt to steal a page from a pipe buffer. This should perhaps go into
+@@ -691,7 +692,9 @@ static int pipe_to_sendpage(struct pipe_inode_info *pipe,
+ 	if (!likely(file->f_op && file->f_op->sendpage))
+ 		return -EINVAL;
+ 
+-	more = (sd->flags & SPLICE_F_MORE) || sd->len < sd->total_len;
+	more = (sd->flags & SPLICE_F_MORE) ? MSG_MORE : 0;
+	if (sd->len < sd->total_len)
+		more |= MSG_SENDPAGE_NOTLAST;
+ 	return file->f_op->sendpage(file, buf->page, buf->offset,
+ 				    sd->len, &pos, more);
+ }
+diff --git a/include/linux/socket.h b/include/linux/socket.h
+index d0e77f6..ad919e0 100644
+--- a/include/linux/socket.h
+++ b/include/linux/socket.h
+@@ -265,7 +265,7 @@ struct ucred {
+ #define MSG_NOSIGNAL	0x4000	/* Do not generate SIGPIPE */
+ #define MSG_MORE	0x8000	/* Sender will send more */
+ #define MSG_WAITFORONE	0x10000	/* recvmmsg(): block until 1+ packets avail */
+-
+#define MSG_SENDPAGE_NOTLAST 0x20000 /* sendpage() internal : not the last page */
+ #define MSG_EOF         MSG_FIN
+ 
+ #define MSG_CMSG_CLOEXEC 0x40000000	/* Set close_on_exit for file
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 34f5db1..36611ab 100644
+--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
+@@ -860,7 +860,7 @@ wait_for_memory:
+ 	}
+ 
+ out:
+-	if (copied)
+	if (copied && !(flags & MSG_SENDPAGE_NOTLAST))
+ 		tcp_push(sk, flags, mss_now, tp->nonagle);
+ 	return copied;
+ 
+diff --git a/net/socket.c b/net/socket.c
+index 2dce67a..273cbce 100644
+--- a/net/socket.c
+++ b/net/socket.c
+@@ -791,9 +791,9 @@ static ssize_t sock_sendpage(struct file *file, struct page *page,
+ 
+ 	sock = file->private_data;
+ 
+-	flags = !(file->f_flags & O_NONBLOCK) ? 0 : MSG_DONTWAIT;
+-	if (more)
+-		flags |= MSG_MORE;
+	flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
+	/* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
+	flags |= more;
+ 
+ 	return kernel_sendpage(sock, page, offset, size, flags);
+ }
+-- 
+1.7.7.6
+
@@ -0,0 +1,56 @@
+From 8dda68d22ab01e2780f80a6afb814387fb904aa2 Mon Sep 17 00:00:00 2001
+From: Thomas Graf <tgraf@infradead.org>
+Date: Tue, 3 Apr 2012 22:17:53 +0000
+Subject: [PATCH 061/165] sctp: Allow struct sctp_event_subscribe to grow
+ without breaking binaries
+
+[ Upstream commit acdd5985364f8dc511a0762fab2e683f29d9d692 ]
+
+getsockopt(..., SCTP_EVENTS, ...) performs a length check and returns
+an error if the user provides less bytes than the size of struct
+sctp_event_subscribe.
+
+Struct sctp_event_subscribe needs to be extended by an u8 for every
+new event or notification type that is added.
+
+This obviously makes getsockopt fail for binaries that are compiled
+against an older versions of <net/sctp/user.h> which do not contain
+all event types.
+
+This patch changes getsockopt behaviour to no longer return an error
+if not enough bytes are being provided by the user. Instead, it
+returns as much of sctp_event_subscribe as fits into the provided buffer.
+
+This leads to the new behavior that users see what they have been aware
+of at compile time.
+
+The setsockopt(..., SCTP_EVENTS, ...) API is already behaving like this.
+
+Signed-off-by: Thomas Graf <tgraf@suug.ch>
+Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/sctp/socket.c |    5 +++--
+ 1 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 54a7cd2..0075554 100644
+--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
+@@ -4133,9 +4133,10 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
+ static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
+ 				  int __user *optlen)
+ {
+-	if (len < sizeof(struct sctp_event_subscribe))
+	if (len <= 0)
+ 		return -EINVAL;
+-	len = sizeof(struct sctp_event_subscribe);
+	if (len > sizeof(struct sctp_event_subscribe))
+		len = sizeof(struct sctp_event_subscribe);
+ 	if (put_user(len, optlen))
+ 		return -EFAULT;
+ 	if (copy_to_user(optval, &sctp_sk(sk)->subscribe, len))
+-- 
+1.7.7.6
+
@@ -0,0 +1,199 @@
+From 9f8774d2e33d8c44b98e76db91cfc0d35b187f58 Mon Sep 17 00:00:00 2001
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Date: Wed, 4 Apr 2012 01:01:20 +0000
+Subject: [PATCH 062/165] bridge: Do not send queries on multicast group
+ leaves
+
+[ Upstream commit 996304bbea3d2a094b7ba54c3bd65d3fffeac57b ]
+
+As it stands the bridge IGMP snooping system will respond to
+group leave messages with queries for remaining membership.
+This is both unnecessary and undesirable.  First of all any
+multicast routers present should be doing this rather than us.
+What's more the queries that we send may end up upsetting other
+multicast snooping swithces in the system that are buggy.
+
+In fact, we can simply remove the code that send these queries
+because the existing membership expiry mechanism doesn't rely
+on them anyway.
+
+So this patch simply removes all code associated with group
+queries in response to group leave messages.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/bridge/br_multicast.c |   81 ---------------------------------------------
+ net/bridge/br_private.h   |    4 --
+ 2 files changed, 0 insertions(+), 85 deletions(-)
+
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index 8eb6b15..5ac1811 100644
+--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
+@@ -241,7 +241,6 @@ static void br_multicast_group_expired(unsigned long data)
+ 	hlist_del_rcu(&mp->hlist[mdb->ver]);
+ 	mdb->size--;
+ 
+-	del_timer(&mp->query_timer);
+ 	call_rcu_bh(&mp->rcu, br_multicast_free_group);
+ 
+ out:
+@@ -271,7 +270,6 @@ static void br_multicast_del_pg(struct net_bridge *br,
+ 		rcu_assign_pointer(*pp, p->next);
+ 		hlist_del_init(&p->mglist);
+ 		del_timer(&p->timer);
+-		del_timer(&p->query_timer);
+ 		call_rcu_bh(&p->rcu, br_multicast_free_pg);
+ 
+ 		if (!mp->ports && !mp->mglist &&
+@@ -507,74 +505,6 @@ static struct sk_buff *br_multicast_alloc_query(struct net_bridge *br,
+ 	return NULL;
+ }
+ 
+-static void br_multicast_send_group_query(struct net_bridge_mdb_entry *mp)
+-{
+-	struct net_bridge *br = mp->br;
+-	struct sk_buff *skb;
+-
+-	skb = br_multicast_alloc_query(br, &mp->addr);
+-	if (!skb)
+-		goto timer;
+-
+-	netif_rx(skb);
+-
+-timer:
+-	if (++mp->queries_sent < br->multicast_last_member_count)
+-		mod_timer(&mp->query_timer,
+-			  jiffies + br->multicast_last_member_interval);
+-}
+-
+-static void br_multicast_group_query_expired(unsigned long data)
+-{
+-	struct net_bridge_mdb_entry *mp = (void *)data;
+-	struct net_bridge *br = mp->br;
+-
+-	spin_lock(&br->multicast_lock);
+-	if (!netif_running(br->dev) || !mp->mglist ||
+-	    mp->queries_sent >= br->multicast_last_member_count)
+-		goto out;
+-
+-	br_multicast_send_group_query(mp);
+-
+-out:
+-	spin_unlock(&br->multicast_lock);
+-}
+-
+-static void br_multicast_send_port_group_query(struct net_bridge_port_group *pg)
+-{
+-	struct net_bridge_port *port = pg->port;
+-	struct net_bridge *br = port->br;
+-	struct sk_buff *skb;
+-
+-	skb = br_multicast_alloc_query(br, &pg->addr);
+-	if (!skb)
+-		goto timer;
+-
+-	br_deliver(port, skb);
+-
+-timer:
+-	if (++pg->queries_sent < br->multicast_last_member_count)
+-		mod_timer(&pg->query_timer,
+-			  jiffies + br->multicast_last_member_interval);
+-}
+-
+-static void br_multicast_port_group_query_expired(unsigned long data)
+-{
+-	struct net_bridge_port_group *pg = (void *)data;
+-	struct net_bridge_port *port = pg->port;
+-	struct net_bridge *br = port->br;
+-
+-	spin_lock(&br->multicast_lock);
+-	if (!netif_running(br->dev) || hlist_unhashed(&pg->mglist) ||
+-	    pg->queries_sent >= br->multicast_last_member_count)
+-		goto out;
+-
+-	br_multicast_send_port_group_query(pg);
+-
+-out:
+-	spin_unlock(&br->multicast_lock);
+-}
+-
+ static struct net_bridge_mdb_entry *br_multicast_get_group(
+ 	struct net_bridge *br, struct net_bridge_port *port,
+ 	struct br_ip *group, int hash)
+@@ -690,8 +620,6 @@ rehash:
+ 	mp->addr = *group;
+ 	setup_timer(&mp->timer, br_multicast_group_expired,
+ 		    (unsigned long)mp);
+-	setup_timer(&mp->query_timer, br_multicast_group_query_expired,
+-		    (unsigned long)mp);
+ 
+ 	hlist_add_head_rcu(&mp->hlist[mdb->ver], &mdb->mhash[hash]);
+ 	mdb->size++;
+@@ -746,8 +674,6 @@ static int br_multicast_add_group(struct net_bridge *br,
+ 	hlist_add_head(&p->mglist, &port->mglist);
+ 	setup_timer(&p->timer, br_multicast_port_group_expired,
+ 		    (unsigned long)p);
+-	setup_timer(&p->query_timer, br_multicast_port_group_query_expired,
+-		    (unsigned long)p);
+ 
+ 	rcu_assign_pointer(*pp, p);
+ 
+@@ -1291,9 +1217,6 @@ static void br_multicast_leave_group(struct net_bridge *br,
+ 		     time_after(mp->timer.expires, time) :
+ 		     try_to_del_timer_sync(&mp->timer) >= 0)) {
+ 			mod_timer(&mp->timer, time);
+-
+-			mp->queries_sent = 0;
+-			mod_timer(&mp->query_timer, now);
+ 		}
+ 
+ 		goto out;
+@@ -1310,9 +1233,6 @@ static void br_multicast_leave_group(struct net_bridge *br,
+ 		     time_after(p->timer.expires, time) :
+ 		     try_to_del_timer_sync(&p->timer) >= 0)) {
+ 			mod_timer(&p->timer, time);
+-
+-			p->queries_sent = 0;
+-			mod_timer(&p->query_timer, now);
+ 		}
+ 
+ 		break;
+@@ -1680,7 +1600,6 @@ void br_multicast_stop(struct net_bridge *br)
+ 		hlist_for_each_entry_safe(mp, p, n, &mdb->mhash[i],
+ 					  hlist[ver]) {
+ 			del_timer(&mp->timer);
+-			del_timer(&mp->query_timer);
+ 			call_rcu_bh(&mp->rcu, br_multicast_free_group);
+ 		}
+ 	}
+diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
+index d7d6fb0..93264df 100644
+--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
+@@ -82,9 +82,7 @@ struct net_bridge_port_group {
+ 	struct hlist_node		mglist;
+ 	struct rcu_head			rcu;
+ 	struct timer_list		timer;
+-	struct timer_list		query_timer;
+ 	struct br_ip			addr;
+-	u32				queries_sent;
+ };
+ 
+ struct net_bridge_mdb_entry
+@@ -94,10 +92,8 @@ struct net_bridge_mdb_entry
+ 	struct net_bridge_port_group __rcu *ports;
+ 	struct rcu_head			rcu;
+ 	struct timer_list		timer;
+-	struct timer_list		query_timer;
+ 	struct br_ip			addr;
+ 	bool				mglist;
+-	u32				queries_sent;
+ };
+ 
+ struct net_bridge_mdb_htable
+-- 
+1.7.7.6
+
@@ -0,0 +1,39 @@
+From dda800eb86fb88c28f63c0136cc76b1346322feb Mon Sep 17 00:00:00 2001
+From: "RongQing.Li" <roy.qing.li@gmail.com>
+Date: Wed, 4 Apr 2012 16:47:04 +0000
+Subject: [PATCH 063/165] ipv6: fix array index in ip6_mc_add_src()
+
+[ Upstream commit 78d50217baf36093ab320f95bae0d6452daec85c ]
+
+Convert array index from the loop bound to the loop index.
+
+And remove the void type conversion to ip6_mc_del1_src() return
+code, seem it is unnecessary, since ip6_mc_del1_src() does not
+use __must_check similar attribute, no compiler will report the
+warning when it is removed.
+
+v2: enrich the commit header
+
+Signed-off-by: RongQing.Li <roy.qing.li@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/ipv6/mcast.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
+index 2257366..f2d74ea 100644
+--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
+@@ -2054,7 +2054,7 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
+ 		if (!delta)
+ 			pmc->mca_sfcount[sfmode]--;
+ 		for (j=0; j<i; j++)
+-			(void) ip6_mc_del1_src(pmc, sfmode, &psfsrc[i]);
+			ip6_mc_del1_src(pmc, sfmode, &psfsrc[j]);
+ 	} else if (isexclude != (pmc->mca_sfcount[MCAST_EXCLUDE] != 0)) {
+ 		struct ip6_sf_list *psf;
+ 
+-- 
+1.7.7.6
+
@@ -0,0 +1,78 @@
+From 636e8de47aae86650672a0065eb401e918544d34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <levinsasha928@gmail.com>
+Date: Thu, 5 Apr 2012 12:07:45 +0000
+Subject: [PATCH 064/165] phonet: Check input from user before allocating
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit bcf1b70ac6eb0ed8286c66e6bf37cb747cbaa04c ]
+
+A phonet packet is limited to USHRT_MAX bytes, this is never checked during
+tx which means that the user can specify any size he wishes, and the kernel
+will attempt to allocate that size.
+
+In the good case, it'll lead to the following warning, but it may also cause
+the kernel to kick in the OOM and kill a random task on the server.
+
+[ 8921.744094] WARNING: at mm/page_alloc.c:2255 __alloc_pages_slowpath+0x65/0x730()
+[ 8921.749770] Pid: 5081, comm: trinity Tainted: G        W    3.4.0-rc1-next-20120402-sasha #46
+[ 8921.756672] Call Trace:
+[ 8921.758185]  [<ffffffff810b2ba7>] warn_slowpath_common+0x87/0xb0
+[ 8921.762868]  [<ffffffff810b2be5>] warn_slowpath_null+0x15/0x20
+[ 8921.765399]  [<ffffffff8117eae5>] __alloc_pages_slowpath+0x65/0x730
+[ 8921.769226]  [<ffffffff81179c8a>] ? zone_watermark_ok+0x1a/0x20
+[ 8921.771686]  [<ffffffff8117d045>] ? get_page_from_freelist+0x625/0x660
+[ 8921.773919]  [<ffffffff8117f3a8>] __alloc_pages_nodemask+0x1f8/0x240
+[ 8921.776248]  [<ffffffff811c03e0>] kmalloc_large_node+0x70/0xc0
+[ 8921.778294]  [<ffffffff811c4bd4>] __kmalloc_node_track_caller+0x34/0x1c0
+[ 8921.780847]  [<ffffffff821b0e3c>] ? sock_alloc_send_pskb+0xbc/0x260
+[ 8921.783179]  [<ffffffff821b3c65>] __alloc_skb+0x75/0x170
+[ 8921.784971]  [<ffffffff821b0e3c>] sock_alloc_send_pskb+0xbc/0x260
+[ 8921.787111]  [<ffffffff821b002e>] ? release_sock+0x7e/0x90
+[ 8921.788973]  [<ffffffff821b0ff0>] sock_alloc_send_skb+0x10/0x20
+[ 8921.791052]  [<ffffffff824cfc20>] pep_sendmsg+0x60/0x380
+[ 8921.792931]  [<ffffffff824cb4a6>] ? pn_socket_bind+0x156/0x180
+[ 8921.794917]  [<ffffffff824cb50f>] ? pn_socket_autobind+0x3f/0x90
+[ 8921.797053]  [<ffffffff824cb63f>] pn_socket_sendmsg+0x4f/0x70
+[ 8921.798992]  [<ffffffff821ab8e7>] sock_aio_write+0x187/0x1b0
+[ 8921.801395]  [<ffffffff810e325e>] ? sub_preempt_count+0xae/0xf0
+[ 8921.803501]  [<ffffffff8111842c>] ? __lock_acquire+0x42c/0x4b0
+[ 8921.805505]  [<ffffffff821ab760>] ? __sock_recv_ts_and_drops+0x140/0x140
+[ 8921.807860]  [<ffffffff811e07cc>] do_sync_readv_writev+0xbc/0x110
+[ 8921.809986]  [<ffffffff811958e7>] ? might_fault+0x97/0xa0
+[ 8921.811998]  [<ffffffff817bd99e>] ? security_file_permission+0x1e/0x90
+[ 8921.814595]  [<ffffffff811e17e2>] do_readv_writev+0xe2/0x1e0
+[ 8921.816702]  [<ffffffff810b8dac>] ? do_setitimer+0x1ac/0x200
+[ 8921.818819]  [<ffffffff810e2ec1>] ? get_parent_ip+0x11/0x50
+[ 8921.820863]  [<ffffffff810e325e>] ? sub_preempt_count+0xae/0xf0
+[ 8921.823318]  [<ffffffff811e1926>] vfs_writev+0x46/0x60
+[ 8921.825219]  [<ffffffff811e1a3f>] sys_writev+0x4f/0xb0
+[ 8921.827127]  [<ffffffff82658039>] system_call_fastpath+0x16/0x1b
+[ 8921.829384] ---[ end trace dffe390f30db9eb7 ]---
+
+Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
+Acked-by: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/phonet/pep.c |    3 +++
+ 1 files changed, 3 insertions(+), 0 deletions(-)
+
+diff --git a/net/phonet/pep.c b/net/phonet/pep.c
+index 2ba6e9f..007546d 100644
+--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
+@@ -1046,6 +1046,9 @@ static int pep_sendmsg(struct kiocb *iocb, struct sock *sk,
+ 	int flags = msg->msg_flags;
+ 	int err, done;
+ 
+	if (len > USHRT_MAX)
+		return -EMSGSIZE;
+
+ 	if ((msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_NOSIGNAL|
+ 				MSG_CMSG_COMPAT)) ||
+ 			!(msg->msg_flags & MSG_EOR))
+-- 
+1.7.7.6
+
@@ -0,0 +1,45 @@
+From 1413698b8d47c7fb2783cafd906ac1db9b1723d7 Mon Sep 17 00:00:00 2001
+From: Veaceslav Falico <vfalico@redhat.com>
+Date: Thu, 5 Apr 2012 03:47:43 +0000
+Subject: [PATCH 065/165] bonding: properly unset current_arp_slave on slave
+ link up
+
+[ Upstream commit 5a4309746cd74734daa964acb02690c22b3c8911 ]
+
+When a slave comes up, we're unsetting the current_arp_slave without
+removing active flags from it, which can lead to situations where we have
+more than one slave with active flags in active-backup mode.
+
+To avoid this situation we must remove the active flags from a slave before
+removing it as a current_arp_slave.
+
+Signed-off-by: Veaceslav Falico <vfalico@redhat.com>
+Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
+Signed-off-by: Andy Gospodarek <andy@greyhouse.net>
+Signed-off-by: Marcelo Ricardo Leitner <mleitner@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/bonding/bond_main.c |    6 +++++-
+ 1 files changed, 5 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index e58aa2b..f65e0b9 100644
+--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
+@@ -2982,7 +2982,11 @@ static void bond_ab_arp_commit(struct bonding *bond, int delta_in_ticks)
+ 					   trans_start + delta_in_ticks)) ||
+ 			    bond->curr_active_slave != slave) {
+ 				slave->link = BOND_LINK_UP;
+-				bond->current_arp_slave = NULL;
+				if (bond->current_arp_slave) {
+					bond_set_slave_inactive_flags(
+						bond->current_arp_slave);
+					bond->current_arp_slave = NULL;
+				}
+ 
+ 				pr_info("%s: link status definitely up for interface %s.\n",
+ 					bond->dev->name, slave->dev->name);
+-- 
+1.7.7.6
+
@@ -0,0 +1,37 @@
+From 5454ccf43f7636614fc378283890bf911c2e2058 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil.sutter@viprinet.com>
+Date: Mon, 26 Mar 2012 09:01:30 +0000
+Subject: [PATCH 066/165] wimax: i2400m - prevent a possible kernel bug due to
+ missing fw_name string
+
+[ Upstream commit 4eee6a3a04e8bb53fbe7de0f64d0524d3fbe3f80 ]
+
+This happened on a machine with a custom hotplug script calling nameif,
+probably due to slow firmware loading. At the time nameif uses ethtool
+to gather interface information, i2400m->fw_name is zero and so a null
+pointer dereference occurs from within i2400m_get_drvinfo().
+
+Signed-off-by: Phil Sutter <phil.sutter@viprinet.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/wimax/i2400m/netdev.c |    3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/net/wimax/i2400m/netdev.c b/drivers/net/wimax/i2400m/netdev.c
+index 64a1106..4697cf3 100644
+--- a/drivers/net/wimax/i2400m/netdev.c
+++ b/drivers/net/wimax/i2400m/netdev.c
+@@ -607,7 +607,8 @@ static void i2400m_get_drvinfo(struct net_device *net_dev,
+ 	struct i2400m *i2400m = net_dev_to_i2400m(net_dev);
+ 
+ 	strncpy(info->driver, KBUILD_MODNAME, sizeof(info->driver) - 1);
+-	strncpy(info->fw_version, i2400m->fw_name, sizeof(info->fw_version) - 1);
+	strncpy(info->fw_version,
+	        i2400m->fw_name ? : "", sizeof(info->fw_version) - 1);
+ 	if (net_dev->dev.parent)
+ 		strncpy(info->bus_info, dev_name(net_dev->dev.parent),
+ 			sizeof(info->bus_info) - 1);
+-- 
+1.7.7.6
+
@@ -0,0 +1,82 @@
+From 0f7eb8a3cb853edf31ec23d26623b195603814b2 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Thu, 5 Apr 2012 22:17:46 +0000
+Subject: [PATCH 067/165] netlink: fix races after skb queueing
+
+[ Upstream commit 4a7e7c2ad540e54c75489a70137bf0ec15d3a127 ]
+
+As soon as an skb is queued into socket receive_queue, another thread
+can consume it, so we are not allowed to reference skb anymore, or risk
+use after free.
+
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/netlink/af_netlink.c |   24 +++++++++++++-----------
+ 1 files changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 1201b6d..a99fb41 100644
+--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
+@@ -830,12 +830,19 @@ int netlink_attachskb(struct sock *sk, struct sk_buff *skb,
+ 	return 0;
+ }
+ 
+-int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
+static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb)
+ {
+ 	int len = skb->len;
+ 
+ 	skb_queue_tail(&sk->sk_receive_queue, skb);
+ 	sk->sk_data_ready(sk, len);
+	return len;
+}
+
+int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
+{
+	int len = __netlink_sendskb(sk, skb);
+
+ 	sock_put(sk);
+ 	return len;
+ }
+@@ -960,8 +967,7 @@ static inline int netlink_broadcast_deliver(struct sock *sk,
+ 	if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
+ 	    !test_bit(0, &nlk->state)) {
+ 		skb_set_owner_r(skb, sk);
+-		skb_queue_tail(&sk->sk_receive_queue, skb);
+-		sk->sk_data_ready(sk, skb->len);
+		__netlink_sendskb(sk, skb);
+ 		return atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf;
+ 	}
+ 	return -1;
+@@ -1684,10 +1690,8 @@ static int netlink_dump(struct sock *sk)
+ 
+ 		if (sk_filter(sk, skb))
+ 			kfree_skb(skb);
+-		else {
+-			skb_queue_tail(&sk->sk_receive_queue, skb);
+-			sk->sk_data_ready(sk, skb->len);
+-		}
+		else
+			__netlink_sendskb(sk, skb);
+ 		return 0;
+ 	}
+ 
+@@ -1701,10 +1705,8 @@ static int netlink_dump(struct sock *sk)
+ 
+ 	if (sk_filter(sk, skb))
+ 		kfree_skb(skb);
+-	else {
+-		skb_queue_tail(&sk->sk_receive_queue, skb);
+-		sk->sk_data_ready(sk, skb->len);
+-	}
+	else
+		__netlink_sendskb(sk, skb);
+ 
+ 	if (cb->done)
+ 		cb->done(cb);
+-- 
+1.7.7.6
+
@@ -0,0 +1,43 @@
+From 86e0251999e198af9ae73f58db4d5689f14862ec Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Fri, 6 Apr 2012 10:49:10 +0200
+Subject: [PATCH 068/165] net: fix a race in sock_queue_err_skb()
+
+[ Upstream commit 110c43304db6f06490961529536c362d9ac5732f ]
+
+As soon as an skb is queued into socket error queue, another thread
+can consume it, so we are not allowed to reference skb anymore, or risk
+use after free.
+
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/core/skbuff.c |    4 +++-
+ 1 files changed, 3 insertions(+), 1 deletions(-)
+
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 3c30ee4..29cb392 100644
+--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
+@@ -3111,6 +3111,8 @@ static void sock_rmem_free(struct sk_buff *skb)
+  */
+ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
+ {
+	int len = skb->len;
+
+ 	if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
+ 	    (unsigned)sk->sk_rcvbuf)
+ 		return -ENOMEM;
+@@ -3125,7 +3127,7 @@ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
+ 
+ 	skb_queue_tail(&sk->sk_error_queue, skb);
+ 	if (!sock_flag(sk, SOCK_DEAD))
+-		sk->sk_data_ready(sk, skb->len);
+		sk->sk_data_ready(sk, len);
+ 	return 0;
+ }
+ EXPORT_SYMBOL(sock_queue_err_skb);
+-- 
+1.7.7.6
+
@@ -0,0 +1,50 @@
+From e371feec366591f88fd4df14f701359bd08d33e7 Mon Sep 17 00:00:00 2001
+From: Neal Cardwell <ncardwell@google.com>
+Date: Tue, 10 Apr 2012 07:59:20 +0000
+Subject: [PATCH 069/165] tcp: fix tcp_rcv_rtt_update() use of an unscaled RTT
+ sample
+
+[ Upstream commit 18a223e0b9ec8979320ba364b47c9772391d6d05 ]
+
+Fix a code path in tcp_rcv_rtt_update() that was comparing scaled and
+unscaled RTT samples.
+
+The intent in the code was to only use the 'm' measurement if it was a
+new minimum.  However, since 'm' had not yet been shifted left 3 bits
+but 'new_sample' had, this comparison would nearly always succeed,
+leading us to erroneously set our receive-side RTT estimate to the 'm'
+sample when that sample could be nearly 8x too high to use.
+
+The overall effect is to often cause the receive-side RTT estimate to
+be significantly too large (up to 40% too large for brief periods in
+my tests).
+
+Signed-off-by: Neal Cardwell <ncardwell@google.com>
+Acked-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/ipv4/tcp_input.c |    7 +++++--
+ 1 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index e4d1e4a..4c46fa7 100644
+--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
+@@ -473,8 +473,11 @@ static void tcp_rcv_rtt_update(struct tcp_sock *tp, u32 sample, int win_dep)
+ 		if (!win_dep) {
+ 			m -= (new_sample >> 3);
+ 			new_sample += m;
+-		} else if (m < new_sample)
+-			new_sample = m << 3;
+		} else {
+			m <<= 3;
+			if (m < new_sample)
+				new_sample = m;
+		}
+ 	} else {
+ 		/* No previous measure. */
+ 		new_sample = m << 3;
+-- 
+1.7.7.6
+
@@ -0,0 +1,48 @@
+From 03bdfc1371ae4ad8b2bbe50475baa6d983f62511 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Tue, 10 Apr 2012 20:08:39 +0000
+Subject: [PATCH 070/165] net: allow pskb_expand_head() to get maximum
+ tailroom
+
+[ Upstream commit 87151b8689d890dfb495081f7be9b9e257f7a2df ]
+
+Marc Merlin reported many order-1 allocations failures in TX path on its
+wireless setup, that dont make any sense with MTU=1500 network, and non
+SG capable hardware.
+
+Turns out part of the problem comes from pskb_expand_head() not using
+ksize() to get exact head size given by kmalloc(). Doing the same thing
+than __alloc_skb() allows more tailroom in skb and can prevent future
+reallocations.
+
+As a bonus, struct skb_shared_info becomes cache line aligned.
+
+Reported-by: Marc MERLIN <marc@merlins.org>
+Tested-by: Marc MERLIN <marc@merlins.org>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/core/skbuff.c |    4 +++-
+ 1 files changed, 3 insertions(+), 1 deletions(-)
+
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 29cb392..2ec200de 100644
+--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
+@@ -903,9 +903,11 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
+ 		goto adjust_others;
+ 	}
+ 
+-	data = kmalloc(size + sizeof(struct skb_shared_info), gfp_mask);
+	data = kmalloc(size + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)),
+		       gfp_mask);
+ 	if (!data)
+ 		goto nodata;
+	size = SKB_WITH_OVERHEAD(ksize(data));
+ 
+ 	/* Copy only real data... and, alas, header. This should be
+ 	 * optimized for the cases when header is void.
+-- 
+1.7.7.6
+
@@ -0,0 +1,57 @@
+From 137530e7322e536a814836856ef12183cd786e5f Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Sun, 4 Dec 2011 08:51:08 +0000
+Subject: [PATCH 071/165] tcp: fix tcp_trim_head()
+
+[ Upstream commit 4fa48bf3c75069d636fc8830743c929a062e80dc ]
+
+commit f07d960df3 (tcp: avoid frag allocation for small frames)
+breaked assumption in tcp stack that skb is either linear (skb->data_len
+== 0), or fully fragged (skb->data_len == skb->len)
+
+tcp_trim_head() made this assumption, we must fix it.
+
+Thanks to Vijay for providing a very detailed explanation.
+
+Reported-by: Vijay Subramanian <subramanian.vijay@gmail.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/ipv4/tcp_output.c |   13 ++++++++-----
+ 1 files changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 097e0c7..7413437 100644
+--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
+@@ -1093,6 +1093,13 @@ static void __pskb_trim_head(struct sk_buff *skb, int len)
+ {
+ 	int i, k, eat;
+ 
+	eat = min_t(int, len, skb_headlen(skb));
+	if (eat) {
+		__skb_pull(skb, eat);
+		len -= eat;
+		if (!len)
+			return;
+	}
+ 	eat = len;
+ 	k = 0;
+ 	for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+@@ -1124,11 +1131,7 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
+ 	if (skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
+ 		return -ENOMEM;
+ 
+-	/* If len == headlen, we avoid __skb_pull to preserve alignment. */
+-	if (unlikely(len < skb_headlen(skb)))
+-		__skb_pull(skb, len);
+-	else
+-		__pskb_trim_head(skb, len - skb_headlen(skb));
+	__pskb_trim_head(skb, len);
+ 
+ 	TCP_SKB_CB(skb)->seq += len;
+ 	skb->ip_summed = CHECKSUM_PARTIAL;
+-- 
+1.7.7.6
+
@@ -0,0 +1,134 @@
+From f5e6c8aa4ebb62b560068b1636d889b4932c4dbc Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Tue, 24 Apr 2012 23:01:22 -0400
+Subject: [PATCH 072/165] tcp: avoid order-1 allocations on wifi and tx path
+
+[ This combines upstream commit
+  a21d45726acacc963d8baddf74607d9b74e2b723 and the follow-on bug fix
+  commit 22b4a4f22da4b39c6f7f679fd35f3d35c91bf851 ]
+
+Marc Merlin reported many order-1 allocations failures in TX path on its
+wireless setup, that dont make any sense with MTU=1500 network, and non
+SG capable hardware.
+
+After investigation, it turns out TCP uses sk_stream_alloc_skb() and
+used as a convention skb_tailroom(skb) to know how many bytes of data
+payload could be put in this skb (for non SG capable devices)
+
+Note : these skb used kmalloc-4096 (MTU=1500 + MAX_HEADER +
+sizeof(struct skb_shared_info) being above 2048)
+
+Later, mac80211 layer need to add some bytes at the tail of skb
+(IEEE80211_ENCRYPT_TAILROOM = 18 bytes) and since no more tailroom is
+available has to call pskb_expand_head() and request order-1
+allocations.
+
+This patch changes sk_stream_alloc_skb() so that only
+sk->sk_prot->max_header bytes of headroom are reserved, and use a new
+skb field, avail_size to hold the data payload limit.
+
+This way, order-0 allocations done by TCP stack can leave more than 2 KB
+of tailroom and no more allocation is performed in mac80211 layer (or
+any layer needing some tailroom)
+
+avail_size is unioned with mark/dropcount, since mark will be set later
+in IP stack for output packets. Therefore, skb size is unchanged.
+
+Reported-by: Marc MERLIN <marc@merlins.org>
+Tested-by: Marc MERLIN <marc@merlins.org>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+[bwh: Correct commit hash for follow-on bug fix]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ include/linux/skbuff.h |   13 +++++++++++++
+ net/ipv4/tcp.c         |    8 ++++----
+ net/ipv4/tcp_output.c  |    3 ++-
+ 3 files changed, 19 insertions(+), 5 deletions(-)
+
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 6cf8b53..e689b47 100644
+--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
+@@ -458,6 +458,7 @@ struct sk_buff {
+ 	union {
+ 		__u32		mark;
+ 		__u32		dropcount;
+		__u32		avail_size;
+ 	};
+ 
+ 	__u16			vlan_tci;
+@@ -1326,6 +1327,18 @@ static inline int skb_tailroom(const struct sk_buff *skb)
+ }
+ 
+ /**
+ *	skb_availroom - bytes at buffer end
+ *	@skb: buffer to check
+ *
+ *	Return the number of bytes of free space at the tail of an sk_buff
+ *	allocated by sk_stream_alloc()
+ */
+static inline int skb_availroom(const struct sk_buff *skb)
+{
+	return skb_is_nonlinear(skb) ? 0 : skb->avail_size - skb->len;
+}
+
+/**
+  *	skb_reserve - adjust headroom
+  *	@skb: buffer to alter
+  *	@len: bytes to move
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 36611ab..7904db4 100644
+--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
+@@ -701,11 +701,12 @@ struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp)
+ 	skb = alloc_skb_fclone(size + sk->sk_prot->max_header, gfp);
+ 	if (skb) {
+ 		if (sk_wmem_schedule(sk, skb->truesize)) {
+			skb_reserve(skb, sk->sk_prot->max_header);
+ 			/*
+ 			 * Make sure that we have exactly size bytes
+ 			 * available to the caller, no more, no less.
+ 			 */
+-			skb_reserve(skb, skb_tailroom(skb) - size);
+			skb->avail_size = size;
+ 			return skb;
+ 		}
+ 		__kfree_skb(skb);
+@@ -995,10 +996,9 @@ new_segment:
+ 				copy = seglen;
+ 
+ 			/* Where to copy to? */
+-			if (skb_tailroom(skb) > 0) {
+			if (skb_availroom(skb) > 0) {
+ 				/* We have some space in skb head. Superb! */
+-				if (copy > skb_tailroom(skb))
+-					copy = skb_tailroom(skb);
+				copy = min_t(int, copy, skb_availroom(skb));
+ 				err = skb_add_data_nocache(sk, skb, from, copy);
+ 				if (err)
+ 					goto do_fault;
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 7413437..c51dd5b 100644
+--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
+@@ -1096,6 +1096,7 @@ static void __pskb_trim_head(struct sk_buff *skb, int len)
+ 	eat = min_t(int, len, skb_headlen(skb));
+ 	if (eat) {
+ 		__skb_pull(skb, eat);
+		skb->avail_size -= eat;
+ 		len -= eat;
+ 		if (!len)
+ 			return;
+@@ -2060,7 +2061,7 @@ static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *to,
+ 		/* Punt if not enough space exists in the first SKB for
+ 		 * the data in the second
+ 		 */
+-		if (skb->len > skb_tailroom(to))
+		if (skb->len > skb_availroom(to))
+ 			break;
+ 
+ 		if (after(TCP_SKB_CB(skb)->end_seq, tcp_wnd_end(tp)))
+-- 
+1.7.7.6
+
@@ -0,0 +1,106 @@
+From 9785af56c9a0c73e462058b63999df1c95cf6ce7 Mon Sep 17 00:00:00 2001
+From: Tony Zelenoff <antonz@parallels.com>
+Date: Wed, 11 Apr 2012 06:15:03 +0000
+Subject: [PATCH 073/165] atl1: fix kernel panic in case of DMA errors
+
+[ Upstream commit 03662e41c7cff64a776bfb1b3816de4be43de881 ]
+
+Problem:
+There was two separate work_struct structures which share one
+handler. Unfortunately getting atl1_adapter structure from
+work_struct in case of DMA error was done from incorrect
+offset which cause kernel panics.
+
+Solution:
+The useless work_struct for DMA error removed and
+handler name changed to more generic one.
+
+Signed-off-by: Tony Zelenoff <antonz@parallels.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/ethernet/atheros/atlx/atl1.c |   12 +++++-------
+ drivers/net/ethernet/atheros/atlx/atl1.h |    3 +--
+ drivers/net/ethernet/atheros/atlx/atlx.c |    2 +-
+ 3 files changed, 7 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/atheros/atlx/atl1.c b/drivers/net/ethernet/atheros/atlx/atl1.c
+index 33a4e35..ee532e1 100644
+--- a/drivers/net/ethernet/atheros/atlx/atl1.c
+++ b/drivers/net/ethernet/atheros/atlx/atl1.c
+@@ -2473,7 +2473,7 @@ static irqreturn_t atl1_intr(int irq, void *data)
+ 					"pcie phy link down %x\n", status);
+ 			if (netif_running(adapter->netdev)) {	/* reset MAC */
+ 				iowrite32(0, adapter->hw.hw_addr + REG_IMR);
+-				schedule_work(&adapter->pcie_dma_to_rst_task);
+				schedule_work(&adapter->reset_dev_task);
+ 				return IRQ_HANDLED;
+ 			}
+ 		}
+@@ -2485,7 +2485,7 @@ static irqreturn_t atl1_intr(int irq, void *data)
+ 					"pcie DMA r/w error (status = 0x%x)\n",
+ 					status);
+ 			iowrite32(0, adapter->hw.hw_addr + REG_IMR);
+-			schedule_work(&adapter->pcie_dma_to_rst_task);
+			schedule_work(&adapter->reset_dev_task);
+ 			return IRQ_HANDLED;
+ 		}
+ 
+@@ -2630,10 +2630,10 @@ static void atl1_down(struct atl1_adapter *adapter)
+ 	atl1_clean_rx_ring(adapter);
+ }
+ 
+-static void atl1_tx_timeout_task(struct work_struct *work)
+static void atl1_reset_dev_task(struct work_struct *work)
+ {
+ 	struct atl1_adapter *adapter =
+-		container_of(work, struct atl1_adapter, tx_timeout_task);
+		container_of(work, struct atl1_adapter, reset_dev_task);
+ 	struct net_device *netdev = adapter->netdev;
+ 
+ 	netif_device_detach(netdev);
+@@ -3032,12 +3032,10 @@ static int __devinit atl1_probe(struct pci_dev *pdev,
+ 		    (unsigned long)adapter);
+ 	adapter->phy_timer_pending = false;
+ 
+-	INIT_WORK(&adapter->tx_timeout_task, atl1_tx_timeout_task);
+	INIT_WORK(&adapter->reset_dev_task, atl1_reset_dev_task);
+ 
+ 	INIT_WORK(&adapter->link_chg_task, atlx_link_chg_task);
+ 
+-	INIT_WORK(&adapter->pcie_dma_to_rst_task, atl1_tx_timeout_task);
+-
+ 	err = register_netdev(netdev);
+ 	if (err)
+ 		goto err_common;
+diff --git a/drivers/net/ethernet/atheros/atlx/atl1.h b/drivers/net/ethernet/atheros/atlx/atl1.h
+index 109d6da..e04bf4d 100644
+--- a/drivers/net/ethernet/atheros/atlx/atl1.h
+++ b/drivers/net/ethernet/atheros/atlx/atl1.h
+@@ -758,9 +758,8 @@ struct atl1_adapter {
+ 	u16 link_speed;
+ 	u16 link_duplex;
+ 	spinlock_t lock;
+-	struct work_struct tx_timeout_task;
+	struct work_struct reset_dev_task;
+ 	struct work_struct link_chg_task;
+-	struct work_struct pcie_dma_to_rst_task;
+ 
+ 	struct timer_list phy_config_timer;
+ 	bool phy_timer_pending;
+diff --git a/drivers/net/ethernet/atheros/atlx/atlx.c b/drivers/net/ethernet/atheros/atlx/atlx.c
+index aabcf4b..41c6d83 100644
+--- a/drivers/net/ethernet/atheros/atlx/atlx.c
+++ b/drivers/net/ethernet/atheros/atlx/atlx.c
+@@ -193,7 +193,7 @@ static void atlx_tx_timeout(struct net_device *netdev)
+ {
+ 	struct atlx_adapter *adapter = netdev_priv(netdev);
+ 	/* Do the reset outside of interrupt context */
+-	schedule_work(&adapter->tx_timeout_task);
+	schedule_work(&adapter->reset_dev_task);
+ }
+ 
+ /*
+-- 
+1.7.7.6
+
@@ -0,0 +1,67 @@
+From d3b5873235963930f20f0900871e72ff3b80274b Mon Sep 17 00:00:00 2001
+From: Jason Wang <jasowang@redhat.com>
+Date: Wed, 11 Apr 2012 22:10:54 +0000
+Subject: [PATCH 074/165] 8139cp: set intr mask after its handler is
+ registered
+
+[ Upstream commit a8c9cb106fe79c28d6b7f1397652cadd228715ff ]
+
+We set intr mask before its handler is registered, this does not work well when
+8139cp is sharing irq line with other devices. As the irq could be enabled by
+the device before 8139cp's hander is registered which may lead unhandled
+irq. Fix this by introducing an helper cp_irq_enable() and call it after
+request_irq().
+
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Flavio Leitner <fbl@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/ethernet/realtek/8139cp.c |   10 ++++++++--
+ 1 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
+index aba4f67..8f47907 100644
+--- a/drivers/net/ethernet/realtek/8139cp.c
+++ b/drivers/net/ethernet/realtek/8139cp.c
+@@ -961,6 +961,11 @@ static inline void cp_start_hw (struct cp_private *cp)
+ 	cpw8(Cmd, RxOn | TxOn);
+ }
+ 
+static void cp_enable_irq(struct cp_private *cp)
+{
+	cpw16_f(IntrMask, cp_intr_mask);
+}
+
+ static void cp_init_hw (struct cp_private *cp)
+ {
+ 	struct net_device *dev = cp->dev;
+@@ -1000,8 +1005,6 @@ static void cp_init_hw (struct cp_private *cp)
+ 
+ 	cpw16(MultiIntr, 0);
+ 
+-	cpw16_f(IntrMask, cp_intr_mask);
+-
+ 	cpw8_f(Cfg9346, Cfg9346_Lock);
+ }
+ 
+@@ -1133,6 +1136,8 @@ static int cp_open (struct net_device *dev)
+ 	if (rc)
+ 		goto err_out_hw;
+ 
+	cp_enable_irq(cp);
+
+ 	netif_carrier_off(dev);
+ 	mii_check_media(&cp->mii_if, netif_msg_link(cp), true);
+ 	netif_start_queue(dev);
+@@ -2034,6 +2039,7 @@ static int cp_resume (struct pci_dev *pdev)
+ 	/* FIXME: sh*t may happen if the Rx ring buffer is depleted */
+ 	cp_init_rings_index (cp);
+ 	cp_init_hw (cp);
+	cp_enable_irq(cp);
+ 	netif_start_queue (dev);
+ 
+ 	spin_lock_irqsave (&cp->lock, flags);
+-- 
+1.7.7.6
+
@@ -0,0 +1,78 @@
+From d886ddd4ea18bd874325e888d3272a8db0a972ea Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Thu, 12 Apr 2012 05:54:09 +0000
+Subject: [PATCH 075/165] net: smsc911x: fix skb handling in receive path
+
+[ Upstream commit 3c5e979bd037888dd7d722da22da4b43659af485 ]
+
+The SMSC911x driver resets the ->head, ->data and ->tail pointers in the
+skb on the reset path in order to avoid buffer overflow due to packet
+padding performed by the hardware.
+
+This patch fixes the receive path so that the skb pointers are fixed up
+after the data has been read from the device, The error path is also
+fixed to use number of words consistently and prevent erroneous FIFO
+fastforwarding when skipping over bad data.
+
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/ethernet/smsc/smsc911x.c |   14 +++++---------
+ 1 files changed, 5 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
+index 8843071..8c7dd21 100644
+--- a/drivers/net/ethernet/smsc/smsc911x.c
+++ b/drivers/net/ethernet/smsc/smsc911x.c
+@@ -1089,10 +1089,8 @@ smsc911x_rx_counterrors(struct net_device *dev, unsigned int rxstat)
+ 
+ /* Quickly dumps bad packets */
+ static void
+-smsc911x_rx_fastforward(struct smsc911x_data *pdata, unsigned int pktbytes)
+smsc911x_rx_fastforward(struct smsc911x_data *pdata, unsigned int pktwords)
+ {
+-	unsigned int pktwords = (pktbytes + NET_IP_ALIGN + 3) >> 2;
+-
+ 	if (likely(pktwords >= 4)) {
+ 		unsigned int timeout = 500;
+ 		unsigned int val;
+@@ -1156,7 +1154,7 @@ static int smsc911x_poll(struct napi_struct *napi, int budget)
+ 			continue;
+ 		}
+ 
+-		skb = netdev_alloc_skb(dev, pktlength + NET_IP_ALIGN);
+		skb = netdev_alloc_skb(dev, pktwords << 2);
+ 		if (unlikely(!skb)) {
+ 			SMSC_WARN(pdata, rx_err,
+ 				  "Unable to allocate skb for rx packet");
+@@ -1166,14 +1164,12 @@ static int smsc911x_poll(struct napi_struct *napi, int budget)
+ 			break;
+ 		}
+ 
+-		skb->data = skb->head;
+-		skb_reset_tail_pointer(skb);
+		pdata->ops->rx_readfifo(pdata,
+				 (unsigned int *)skb->data, pktwords);
+ 
+ 		/* Align IP on 16B boundary */
+ 		skb_reserve(skb, NET_IP_ALIGN);
+ 		skb_put(skb, pktlength - 4);
+-		pdata->ops->rx_readfifo(pdata,
+-				 (unsigned int *)skb->head, pktwords);
+ 		skb->protocol = eth_type_trans(skb, dev);
+ 		skb_checksum_none_assert(skb);
+ 		netif_receive_skb(skb);
+@@ -1396,7 +1392,7 @@ static int smsc911x_open(struct net_device *dev)
+ 	smsc911x_reg_write(pdata, FIFO_INT, temp);
+ 
+ 	/* set RX Data offset to 2 bytes for alignment */
+-	smsc911x_reg_write(pdata, RX_CFG, (2 << 8));
+	smsc911x_reg_write(pdata, RX_CFG, (NET_IP_ALIGN << 8));
+ 
+ 	/* enable NAPI polling before enabling RX interrupts */
+ 	napi_enable(&pdata->napi);
+-- 
+1.7.7.6
+
@@ -0,0 +1,46 @@
+From 64adebf7ebe78704f2a1f09614184f1ede7631b2 Mon Sep 17 00:00:00 2001
+From: Davide Ciminaghi <ciminaghi@gnudd.com>
+Date: Fri, 13 Apr 2012 04:48:25 +0000
+Subject: [PATCH 076/165] net/ethernet: ks8851_mll fix rx frame buffer
+ overflow
+
+[ Upstream commit 8a9a0ea6032186e3030419262678d652b88bf6a8 ]
+
+At the beginning of ks_rcv(), a for loop retrieves the
+header information relevant to all the frames stored
+in the mac's internal buffers. The number of pending
+frames is stored as an 8 bits field in KS_RXFCTR.
+If interrupts are disabled long enough to allow for more than
+32 frames to accumulate in the MAC's internal buffers, a buffer
+overflow occurs.
+This patch fixes the problem by making the
+driver's frame_head_info buffer big enough.
+Well actually, since the chip appears to have 12K of
+internal rx buffers and the shortest ethernet frame should
+be 64 bytes long, maybe the limit could be set to
+12*1024/64 = 192 frames, but 255 should be safer.
+
+Signed-off-by: Davide Ciminaghi <ciminaghi@gnudd.com>
+Signed-off-by: Raffaele Recalcati <raffaele.recalcati@bticino.it>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/ethernet/micrel/ks8851_mll.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c
+index d19c849..77241b6 100644
+--- a/drivers/net/ethernet/micrel/ks8851_mll.c
+++ b/drivers/net/ethernet/micrel/ks8851_mll.c
+@@ -40,7 +40,7 @@
+ #define	DRV_NAME	"ks8851_mll"
+ 
+ static u8 KS_DEFAULT_MAC_ADDRESS[] = { 0x00, 0x10, 0xA1, 0x86, 0x95, 0x11 };
+-#define MAX_RECV_FRAMES			32
+#define MAX_RECV_FRAMES			255
+ #define MAX_BUF_SIZE			2048
+ #define TX_BUF_SIZE			2000
+ #define RX_BUF_SIZE			2000
+-- 
+1.7.7.6
+
@@ -0,0 +1,54 @@
+From fad0985a19b237d9b48ab19b767413a95314b90d Mon Sep 17 00:00:00 2001
+From: David Ward <david.ward@ll.mit.edu>
+Date: Sun, 15 Apr 2012 12:31:45 +0000
+Subject: [PATCH 077/165] net_sched: gred: Fix oops in gred_dump() in WRED
+ mode
+
+[ Upstream commit 244b65dbfede788f2fa3fe2463c44d0809e97c6b ]
+
+A parameter set exists for WRED mode, called wred_set, to hold the same
+values for qavg and qidlestart across all VQs. The WRED mode values had
+been previously held in the VQ for the default DP. After these values
+were moved to wred_set, the VQ for the default DP was no longer created
+automatically (so that it could be omitted on purpose, to have packets
+in the default DP enqueued directly to the device without using RED).
+
+However, gred_dump() was overlooked during that change; in WRED mode it
+still reads qavg/qidlestart from the VQ for the default DP, which might
+not even exist. As a result, this command sequence will cause an oops:
+
+tc qdisc add dev $DEV handle $HANDLE parent $PARENT gred setup \
+    DPs 3 default 2 grio
+tc qdisc change dev $DEV handle $HANDLE gred DP 0 prio 8 $RED_OPTIONS
+tc qdisc change dev $DEV handle $HANDLE gred DP 1 prio 8 $RED_OPTIONS
+
+This fixes gred_dump() in WRED mode to use the values held in wred_set.
+
+Signed-off-by: David Ward <david.ward@ll.mit.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/sched/sch_gred.c |    7 ++-----
+ 1 files changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
+index 6cd8ddf..e1afe0c 100644
+--- a/net/sched/sch_gred.c
+++ b/net/sched/sch_gred.c
+@@ -544,11 +544,8 @@ static int gred_dump(struct Qdisc *sch, struct sk_buff *skb)
+ 		opt.packets	= q->packetsin;
+ 		opt.bytesin	= q->bytesin;
+ 
+-		if (gred_wred_mode(table)) {
+-			q->parms.qidlestart =
+-				table->tab[table->def]->parms.qidlestart;
+-			q->parms.qavg = table->tab[table->def]->parms.qavg;
+-		}
+		if (gred_wred_mode(table))
+			gred_load_wred_set(table, q);
+ 
+ 		opt.qave = red_calc_qavg(&q->parms, q->parms.qavg);
+ 
+-- 
+1.7.7.6
+
@@ -0,0 +1,39 @@
+From a242d0ff40b2ef87f4c23c4676441ed1c4ee20cd Mon Sep 17 00:00:00 2001
+From: Stephane Fillod <fillods@users.sf.net>
+Date: Sun, 15 Apr 2012 11:38:29 +0000
+Subject: [PATCH 078/165] net: usb: smsc75xx: fix mtu
+
+[ Upstream commit a99ff7d0123b19ecad3b589480b6542716ab6b52 ]
+
+Make smsc75xx recalculate the hard_mtu after adjusting the
+hard_header_len.
+
+Without this, usbnet adjusts the MTU down to 1492 bytes, and the host is
+unable to receive standard 1500-byte frames from the device.
+
+Inspired by same fix on cdc_eem 78fb72f7936c01d5b426c03a691eca082b03f2b9.
+
+Tested on ARM/Omap3 with EVB-LAN7500-LC.
+
+Signed-off-by: Stephane Fillod <fillods@users.sf.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/usb/smsc75xx.c |    1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
+index a5b9b12..7bd219b 100644
+--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
+@@ -1050,6 +1050,7 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf)
+ 	dev->net->ethtool_ops = &smsc75xx_ethtool_ops;
+ 	dev->net->flags |= IFF_MULTICAST;
+ 	dev->net->hard_header_len += SMSC75XX_TX_OVERHEAD;
+	dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
+ 	return 0;
+ }
+ 
+-- 
+1.7.7.6
+
@@ -0,0 +1,55 @@
+From ee79f6838bd3f230ebf00849029dac3b9be112e5 Mon Sep 17 00:00:00 2001
+From: Hiroaki SHIMODA <shimoda.hiroaki@gmail.com>
+Date: Sun, 15 Apr 2012 13:26:01 +0000
+Subject: [PATCH 079/165] dummy: Add ndo_uninit().
+
+commit 890fdf2a0cb88202d1427589db2cf29c1bdd3c1d upstream.
+
+In register_netdevice(), when ndo_init() is successful and later
+some error occurred, ndo_uninit() will be called.
+So dummy deivce is desirable to implement ndo_uninit() method
+to free percpu stats for this case.
+And, ndo_uninit() is also called along with dev->destructor() when
+device is unregistered, so in order to prevent dev->dstats from
+being freed twice, dev->destructor is modified to free_netdev().
+
+Signed-off-by: Hiroaki SHIMODA <shimoda.hiroaki@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/dummy.c |    6 +++---
+ 1 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/dummy.c b/drivers/net/dummy.c
+index a7c5e88..eeac9ca 100644
+--- a/drivers/net/dummy.c
+++ b/drivers/net/dummy.c
+@@ -106,14 +106,14 @@ static int dummy_dev_init(struct net_device *dev)
+ 	return 0;
+ }
+ 
+-static void dummy_dev_free(struct net_device *dev)
+static void dummy_dev_uninit(struct net_device *dev)
+ {
+ 	free_percpu(dev->dstats);
+-	free_netdev(dev);
+ }
+ 
+ static const struct net_device_ops dummy_netdev_ops = {
+ 	.ndo_init		= dummy_dev_init,
+	.ndo_uninit		= dummy_dev_uninit,
+ 	.ndo_start_xmit		= dummy_xmit,
+ 	.ndo_validate_addr	= eth_validate_addr,
+ 	.ndo_set_rx_mode	= set_multicast_list,
+@@ -127,7 +127,7 @@ static void dummy_setup(struct net_device *dev)
+ 
+ 	/* Initialize the device structure. */
+ 	dev->netdev_ops = &dummy_netdev_ops;
+-	dev->destructor = dummy_dev_free;
+	dev->destructor = free_netdev;
+ 
+ 	/* Fill in device structure with ethernet-generic values. */
+ 	dev->tx_queue_len = 0;
+-- 
+1.7.7.6
+
@@ -0,0 +1,40 @@
+From 57c5b1028d7bffa4d7784dd4bd8743710dc62d0c Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Mon, 16 Apr 2012 23:28:07 +0000
+Subject: [PATCH 080/165] tcp: fix tcp_grow_window() for large incoming frames
+
+[ Upstream commit 4d846f02392a710f9604892ac3329e628e60a230 ]
+
+tcp_grow_window() has to grow rcv_ssthresh up to window_clamp, allowing
+sender to increase its window.
+
+tcp_grow_window() still assumes a tcp frame is under MSS, but its no
+longer true with LRO/GRO.
+
+This patch fixes one of the performance issue we noticed with GRO on.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Neal Cardwell <ncardwell@google.com>
+Cc: Tom Herbert <therbert@google.com>
+Acked-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/ipv4/tcp_input.c |    1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 4c46fa7..daedc07 100644
+--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
+@@ -334,6 +334,7 @@ static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb)
+ 			incr = __tcp_grow_window(sk, skb);
+ 
+ 		if (incr) {
+			incr = max_t(int, incr, 2 * skb->len);
+ 			tp->rcv_ssthresh = min(tp->rcv_ssthresh + incr,
+ 					       tp->window_clamp);
+ 			inet_csk(sk)->icsk_ack.quick |= 1;
+-- 
+1.7.7.6
+
@@ -0,0 +1,79 @@
+From 4637103c9e0f2f7cef243c369f6b451550a4944d Mon Sep 17 00:00:00 2001
+From: Julian Anastasov <ja@ssi.bg>
+Date: Mon, 16 Apr 2012 04:43:15 +0000
+Subject: [PATCH 081/165] netns: do not leak net_generic data on failed init
+
+[ Upstream commit b922934d017f1cc831b017913ed7d1a56c558b43 ]
+
+ops_init should free the net_generic data on
+init failure and __register_pernet_operations should not
+call ops_free when NET_NS is not enabled.
+
+Signed-off-by: Julian Anastasov <ja@ssi.bg>
+Reviewed-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/core/net_namespace.c |   33 ++++++++++++++++++---------------
+ 1 files changed, 18 insertions(+), 15 deletions(-)
+
+diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
+index 0e950fd..31a5ae5 100644
+--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
+@@ -83,21 +83,29 @@ assign:
+ 
+ static int ops_init(const struct pernet_operations *ops, struct net *net)
+ {
+-	int err;
+	int err = -ENOMEM;
+	void *data = NULL;
+
+ 	if (ops->id && ops->size) {
+-		void *data = kzalloc(ops->size, GFP_KERNEL);
+		data = kzalloc(ops->size, GFP_KERNEL);
+ 		if (!data)
+-			return -ENOMEM;
+			goto out;
+ 
+ 		err = net_assign_generic(net, *ops->id, data);
+-		if (err) {
+-			kfree(data);
+-			return err;
+-		}
+		if (err)
+			goto cleanup;
+ 	}
+	err = 0;
+ 	if (ops->init)
+-		return ops->init(net);
+-	return 0;
+		err = ops->init(net);
+	if (!err)
+		return 0;
+
+cleanup:
+	kfree(data);
+
+out:
+	return err;
+ }
+ 
+ static void ops_free(const struct pernet_operations *ops, struct net *net)
+@@ -448,12 +456,7 @@ static void __unregister_pernet_operations(struct pernet_operations *ops)
+ static int __register_pernet_operations(struct list_head *list,
+ 					struct pernet_operations *ops)
+ {
+-	int err = 0;
+-	err = ops_init(ops, &init_net);
+-	if (err)
+-		ops_free(ops, &init_net);
+-	return err;
+-	
+	return ops_init(ops, &init_net);
+ }
+ 
+ static void __unregister_pernet_operations(struct pernet_operations *ops)
+-- 
+1.7.7.6
+
@@ -0,0 +1,36 @@
+From 921c1088587031a14b41d53e69c15ea76d4124ce Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 19 Apr 2012 10:00:19 +0300
+Subject: [PATCH 082/165] ksz884x: don't copy too much in
+ netdev_set_mac_address()
+
+[ Upstream commit 716af4abd6e6370226f567af50bfaca274515980 ]
+
+MAX_ADDR_LEN is 32.  ETH_ALEN is 6.  mac->sa_data is a 14 byte array, so
+the memcpy() is doing a read past the end of the array.  I asked about
+this on netdev and Ben Hutchings told me it's supposed to be copying
+ETH_ALEN bytes (thanks Ben).
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/net/ethernet/micrel/ksz884x.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/net/ethernet/micrel/ksz884x.c b/drivers/net/ethernet/micrel/ksz884x.c
+index 7ece990..4b9f4bd 100644
+--- a/drivers/net/ethernet/micrel/ksz884x.c
+++ b/drivers/net/ethernet/micrel/ksz884x.c
+@@ -5679,7 +5679,7 @@ static int netdev_set_mac_address(struct net_device *dev, void *addr)
+ 		memcpy(hw->override_addr, mac->sa_data, MAC_ADDR_LEN);
+ 	}
+ 
+-	memcpy(dev->dev_addr, mac->sa_data, MAX_ADDR_LEN);
+	memcpy(dev->dev_addr, mac->sa_data, ETH_ALEN);
+ 
+ 	interrupt = hw_block_intr(hw);
+ 
+-- 
+1.7.7.6
+
@@ -0,0 +1,58 @@
+From 5d2236761edc280d899b5721a6aa29d2cd1d1718 Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Wed, 18 Apr 2012 16:11:23 +0000
+Subject: [PATCH 083/165] net ax25: Reorder ax25_exit to remove races.
+
+[ Upstream commit 3adadc08cc1e2cbcc15a640d639297ef5fcb17f5 ]
+
+While reviewing the sysctl code in ax25 I spotted races in ax25_exit
+where it is possible to receive notifications and packets after already
+freeing up some of the data structures needed to process those
+notifications and updates.
+
+Call unregister_netdevice_notifier early so that the rest of the cleanup
+code does not need to deal with network devices.  This takes advantage
+of my recent enhancement to unregister_netdevice_notifier to send
+unregister notifications of all network devices that are current
+registered.
+
+Move the unregistration for packet types, socket types and protocol
+types before we cleanup any of the ax25 data structures to remove the
+possibilities of other races.
+
+Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/ax25/af_ax25.c |    9 +++++----
+ 1 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
+index e7c69f4..b04a6ef 100644
+--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
+@@ -2006,16 +2006,17 @@ static void __exit ax25_exit(void)
+ 	proc_net_remove(&init_net, "ax25_route");
+ 	proc_net_remove(&init_net, "ax25");
+ 	proc_net_remove(&init_net, "ax25_calls");
+-	ax25_rt_free();
+-	ax25_uid_free();
+-	ax25_dev_free();
+ 
+-	ax25_unregister_sysctl();
+ 	unregister_netdevice_notifier(&ax25_dev_notifier);
+	ax25_unregister_sysctl();
+ 
+ 	dev_remove_pack(&ax25_packet_type);
+ 
+ 	sock_unregister(PF_AX25);
+ 	proto_unregister(&ax25_proto);
+
+	ax25_rt_free();
+	ax25_uid_free();
+	ax25_dev_free();
+ }
+ module_exit(ax25_exit);
+-- 
+1.7.7.6
+
@@ -0,0 +1,41 @@
+From 0f6ddd1f2a2e87994e797d2877e7270cfc7ec03c Mon Sep 17 00:00:00 2001
+From: Neal Cardwell <ncardwell@google.com>
+Date: Sun, 22 Apr 2012 09:45:47 +0000
+Subject: [PATCH 084/165] tcp: fix TCP_MAXSEG for established IPv6 passive
+ sockets
+
+[ Upstream commit d135c522f1234f62e81be29cebdf59e9955139ad ]
+
+Commit f5fff5d forgot to fix TCP_MAXSEG behavior IPv6 sockets, so IPv6
+TCP server sockets that used TCP_MAXSEG would find that the advmss of
+child sockets would be incorrect. This commit mirrors the advmss logic
+from tcp_v4_syn_recv_sock in tcp_v6_syn_recv_sock. Eventually this
+logic should probably be shared between IPv4 and IPv6, but this at
+least fixes this issue.
+
+Signed-off-by: Neal Cardwell <ncardwell@google.com>
+Acked-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ net/ipv6/tcp_ipv6.c |    4 ++++
+ 1 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index b859e4a..4a56574 100644
+--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
+@@ -1494,6 +1494,10 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
+ 	tcp_mtup_init(newsk);
+ 	tcp_sync_mss(newsk, dst_mtu(dst));
+ 	newtp->advmss = dst_metric_advmss(dst);
+	if (tcp_sk(sk)->rx_opt.user_mss &&
+	    tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
+		newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
+
+ 	tcp_initialize_rcv_mss(newsk);
+ 	if (tcp_rsk(req)->snt_synack)
+ 		tcp_valid_rtt_meas(newsk,
+-- 
+1.7.7.6
+
@@ -0,0 +1,49 @@
+From 5d341b71950df3cbd21a7abf61ab903aac90531b Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Sat, 3 Sep 2011 01:09:43 +0200
+Subject: [PATCH 085/165] nfs: Enclose hostname in brackets when needed in
+ nfs_do_root_mount
+
+commit 98a2139f4f4d7b5fcc3a54c7fddbe88612abed20 upstream.
+
+When hostname contains colon (e.g. when it is an IPv6 address) it needs
+to be enclosed in brackets to make parsing of NFS device string possible.
+Fix nfs_do_root_mount() to enclose hostname properly when needed. NFS code
+actually does not need this as it does not parse the string passed by
+nfs_do_root_mount() but the device string is exposed to userspace in
+/proc/mounts.
+
+CC: Josh Boyer <jwboyer@redhat.com>
+CC: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/nfs/super.c |    8 ++++++--
+ 1 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index 3ada13c..376cd65 100644
+--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
+@@ -2708,11 +2708,15 @@ static struct vfsmount *nfs_do_root_mount(struct file_system_type *fs_type,
+ 	char *root_devname;
+ 	size_t len;
+ 
+-	len = strlen(hostname) + 3;
+	len = strlen(hostname) + 5;
+ 	root_devname = kmalloc(len, GFP_KERNEL);
+ 	if (root_devname == NULL)
+ 		return ERR_PTR(-ENOMEM);
+-	snprintf(root_devname, len, "%s:/", hostname);
+	/* Does hostname needs to be enclosed in brackets? */
+	if (strchr(hostname, ':'))
+		snprintf(root_devname, len, "[%s]:/", hostname);
+	else
+		snprintf(root_devname, len, "%s:/", hostname);
+ 	root_mnt = vfs_kern_mount(fs_type, flags, root_devname, data);
+ 	kfree(root_devname);
+ 	return root_mnt;
+-- 
+1.7.7.6
+
@@ -0,0 +1,54 @@
+From 4fd3b67b3816e020c889f75e986ba290110c3224 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Wed, 18 Apr 2012 12:20:10 -0400
+Subject: [PATCH 086/165] NFSv4: Ensure that the LOCK code sets
+ exception->inode
+
+commit 05ffe24f5290dc095f98fbaf84afe51ef404ccc5 upstream.
+
+All callers of nfs4_handle_exception() that need to handle
+NFS4ERR_OPENMODE correctly should set exception->inode
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/nfs/nfs4proc.c |    9 +++++++--
+ 1 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 757293b..57f9971 100644
+--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
+@@ -4453,7 +4453,9 @@ static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *f
+ static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request)
+ {
+ 	struct nfs_server *server = NFS_SERVER(state->inode);
+-	struct nfs4_exception exception = { };
+	struct nfs4_exception exception = {
+		.inode = state->inode,
+	};
+ 	int err;
+ 
+ 	do {
+@@ -4471,7 +4473,9 @@ static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request
+ static int nfs4_lock_expired(struct nfs4_state *state, struct file_lock *request)
+ {
+ 	struct nfs_server *server = NFS_SERVER(state->inode);
+-	struct nfs4_exception exception = { };
+	struct nfs4_exception exception = {
+		.inode = state->inode,
+	};
+ 	int err;
+ 
+ 	err = nfs4_set_lock_state(state, request);
+@@ -4551,6 +4555,7 @@ static int nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock *
+ {
+ 	struct nfs4_exception exception = {
+ 		.state = state,
+		.inode = state->inode,
+ 	};
+ 	int err;
+ 
+-- 
+1.7.7.6
+
@@ -0,0 +1,45 @@
+From 2057efde24445d1ca4d192617bf7d5f4fe0f38ce Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust@netapp.com>
+Date: Wed, 18 Apr 2012 12:48:35 -0400
+Subject: [PATCH 087/165] NFSv4: Ensure that we check lock exclusive/shared
+ type against open modes
+
+commit 55725513b5ef9d462aa3e18527658a0362aaae83 upstream.
+
+Since we may be simulating flock() locks using NFS byte range locks,
+we can't rely on the VFS having checked the file open mode for us.
+
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/nfs/nfs4proc.c |   14 ++++++++++++++
+ 1 files changed, 14 insertions(+), 0 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 57f9971..51f6a40 100644
+--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
+@@ -4601,6 +4601,20 @@ nfs4_proc_lock(struct file *filp, int cmd, struct file_lock *request)
+ 
+ 	if (state == NULL)
+ 		return -ENOLCK;
+	/*
+	 * Don't rely on the VFS having checked the file open mode,
+	 * since it won't do this for flock() locks.
+	 */
+	switch (request->fl_type & (F_RDLCK|F_WRLCK|F_UNLCK)) {
+	case F_RDLCK:
+		if (!(filp->f_mode & FMODE_READ))
+			return -EBADF;
+		break;
+	case F_WRLCK:
+		if (!(filp->f_mode & FMODE_WRITE))
+			return -EBADF;
+	}
+
+ 	do {
+ 		status = nfs4_proc_setlk(state, cmd, request);
+ 		if ((status != -EAGAIN) || IS_SETLK(cmd))
+-- 
+1.7.7.6
+
@@ -0,0 +1,30 @@
+From 24f8b6b7ed6a71c4bb6b7c586a1cfa9d70e9775e Mon Sep 17 00:00:00 2001
+From: Fred Isaman <iisaman@netapp.com>
+Date: Fri, 20 Apr 2012 14:47:34 -0400
+Subject: [PATCH 088/165] NFS: put open context on error in nfs_pagein_multi
+
+commit 73fb7bc7c57d971b11f2e00536ac2d3e316e0609 upstream.
+
+Signed-off-by: Fred Isaman <iisaman@netapp.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/nfs/read.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/fs/nfs/read.c b/fs/nfs/read.c
+index cfa175c..41bae32 100644
+--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
+@@ -324,7 +324,7 @@ out_bad:
+ 	while (!list_empty(res)) {
+ 		data = list_entry(res->next, struct nfs_read_data, list);
+ 		list_del(&data->list);
+-		nfs_readdata_free(data);
+		nfs_readdata_release(data);
+ 	}
+ 	nfs_readpage_release(req);
+ 	return -ENOMEM;
+-- 
+1.7.7.6
+
@@ -0,0 +1,30 @@
+From dbef91f49d543a546ee1cbe3e839c97c69486744 Mon Sep 17 00:00:00 2001
+From: Fred Isaman <iisaman@netapp.com>
+Date: Fri, 20 Apr 2012 14:47:35 -0400
+Subject: [PATCH 089/165] NFS: put open context on error in nfs_flush_multi
+
+commit 8ccd271f7a3a846ce6f85ead0760d9d12994a611 upstream.
+
+Signed-off-by: Fred Isaman <iisaman@netapp.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/nfs/write.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/fs/nfs/write.c b/fs/nfs/write.c
+index 1dda78d..4efd421 100644
+--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
+@@ -974,7 +974,7 @@ out_bad:
+ 	while (!list_empty(res)) {
+ 		data = list_entry(res->next, struct nfs_write_data, list);
+ 		list_del(&data->list);
+-		nfs_writedata_free(data);
+		nfs_writedata_release(data);
+ 	}
+ 	nfs_redirty_request(req);
+ 	return -ENOMEM;
+-- 
+1.7.7.6
+
@@ -0,0 +1,71 @@
+From e7e6ba91db68ef0028d61a2bf8b9f3965595b944 Mon Sep 17 00:00:00 2001
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+Date: Thu, 12 Apr 2012 16:48:01 +0200
+Subject: [PATCH 090/165] x86, microcode: Fix sysfs warning during module
+ unload on unsupported CPUs
+
+commit a956bd6f8583326b18348ab1452b4686778f785d upstream.
+
+Loading the microcode driver on an unsupported CPU and subsequently
+unloading the driver causes
+
+ WARNING: at fs/sysfs/group.c:138 mc_device_remove+0x5f/0x70 [microcode]()
+ Hardware name: 01972NG
+ sysfs group ffffffffa00013d0 not found for kobject 'cpu0'
+ Modules linked in: snd_hda_codec_hdmi snd_hda_codec_conexant snd_hda_intel btusb snd_hda_codec bluetooth thinkpad_acpi rfkill microcode(-) [last unloaded: cfg80211]
+ Pid: 4560, comm: modprobe Not tainted 3.4.0-rc2-00002-g258f742 #5
+ Call Trace:
+  [<ffffffff8103113b>] ? warn_slowpath_common+0x7b/0xc0
+  [<ffffffff81031235>] ? warn_slowpath_fmt+0x45/0x50
+  [<ffffffff81120e74>] ? sysfs_remove_group+0x34/0x120
+  [<ffffffffa00000ef>] ? mc_device_remove+0x5f/0x70 [microcode]
+  [<ffffffff81331eb9>] ? subsys_interface_unregister+0x69/0xa0
+  [<ffffffff81563526>] ? mutex_lock+0x16/0x40
+  [<ffffffffa0000c3e>] ? microcode_exit+0x50/0x92 [microcode]
+  [<ffffffff8107051d>] ? sys_delete_module+0x16d/0x260
+  [<ffffffff810a0065>] ? wait_iff_congested+0x45/0x110
+  [<ffffffff815656af>] ? page_fault+0x1f/0x30
+  [<ffffffff81565ba2>] ? system_call_fastpath+0x16/0x1b
+
+on recent kernels.
+
+This is due to commit 8a25a2fd126c ("cpu: convert 'cpu' and
+'machinecheck' sysdev_class to a regular subsystem") which renders
+commit 6c53cbfced04 ("x86, microcode: Correct sysdev_add error path")
+useless.
+
+See http://marc.info/?l=linux-kernel&m=133416246406478
+
+Avoid above warning by restoring the old driver behaviour before
+6c53cbfced04 ("x86, microcode: Correct sysdev_add error path").
+
+Cc: Tigran Aivazian <tigran@aivazian.fsnet.co.uk>
+Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: http://lkml.kernel.org/r/20120411163849.GE4794@alberich.amd.com
+Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
+[bwh: Backported to 3.2: deleted line uses sys_dev, not dev]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/x86/kernel/microcode_core.c |    4 +---
+ 1 files changed, 1 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/kernel/microcode_core.c b/arch/x86/kernel/microcode_core.c
+index 9d46f5e..563a09d 100644
+--- a/arch/x86/kernel/microcode_core.c
+++ b/arch/x86/kernel/microcode_core.c
+@@ -418,10 +418,8 @@ static int mc_sysdev_add(struct sys_device *sys_dev)
+ 	if (err)
+ 		return err;
+ 
+-	if (microcode_init_cpu(cpu) == UCODE_ERROR) {
+-		sysfs_remove_group(&sys_dev->kobj, &mc_attr_group);
+	if (microcode_init_cpu(cpu) == UCODE_ERROR)
+ 		return -EINVAL;
+-	}
+ 
+ 	return err;
+ }
+-- 
+1.7.7.6
+
@@ -0,0 +1,91 @@
+From 46ed52ce8ccfe7b4b4edf99fb0aeed2fbf817727 Mon Sep 17 00:00:00 2001
+From: Bryan O'Donoghue <bryan.odonoghue@linux.intel.com>
+Date: Wed, 18 Apr 2012 17:37:39 +0100
+Subject: [PATCH 091/165] x86, apic: APIC code touches invalid MSR on P5 class
+ machines
+
+commit cbf2829b61c136edcba302a5e1b6b40e97d32c00 upstream.
+
+Current APIC code assumes MSR_IA32_APICBASE is present for all systems.
+Pentium Classic P5 and friends didn't have this MSR. MSR_IA32_APICBASE
+was introduced as an architectural MSR by Intel @ P6.
+
+Code paths that can touch this MSR invalidly are when vendor == Intel &&
+cpu-family == 5 and APIC bit is set in CPUID - or when you simply pass
+lapic on the kernel command line, on a P5.
+
+The below patch stops Linux incorrectly interfering with the
+MSR_IA32_APICBASE for P5 class machines. Other code paths exist that
+touch the MSR - however those paths are not currently reachable for a
+conformant P5.
+
+Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linux.intel.com>
+Link: http://lkml.kernel.org/r/4F8EEDD3.1080404@linux.intel.com
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/x86/kernel/apic/apic.c |   34 ++++++++++++++++++++--------------
+ 1 files changed, 20 insertions(+), 14 deletions(-)
+
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index f98d84c..c4e3581 100644
+--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
+@@ -1577,9 +1577,11 @@ static int __init apic_verify(void)
+ 	mp_lapic_addr = APIC_DEFAULT_PHYS_BASE;
+ 
+ 	/* The BIOS may have set up the APIC at some other address */
+-	rdmsr(MSR_IA32_APICBASE, l, h);
+-	if (l & MSR_IA32_APICBASE_ENABLE)
+-		mp_lapic_addr = l & MSR_IA32_APICBASE_BASE;
+	if (boot_cpu_data.x86 >= 6) {
+		rdmsr(MSR_IA32_APICBASE, l, h);
+		if (l & MSR_IA32_APICBASE_ENABLE)
+			mp_lapic_addr = l & MSR_IA32_APICBASE_BASE;
+	}
+ 
+ 	pr_info("Found and enabled local APIC!\n");
+ 	return 0;
+@@ -1597,13 +1599,15 @@ int __init apic_force_enable(unsigned long addr)
+ 	 * MSR. This can only be done in software for Intel P6 or later
+ 	 * and AMD K7 (Model > 1) or later.
+ 	 */
+-	rdmsr(MSR_IA32_APICBASE, l, h);
+-	if (!(l & MSR_IA32_APICBASE_ENABLE)) {
+-		pr_info("Local APIC disabled by BIOS -- reenabling.\n");
+-		l &= ~MSR_IA32_APICBASE_BASE;
+-		l |= MSR_IA32_APICBASE_ENABLE | addr;
+-		wrmsr(MSR_IA32_APICBASE, l, h);
+-		enabled_via_apicbase = 1;
+	if (boot_cpu_data.x86 >= 6) {
+		rdmsr(MSR_IA32_APICBASE, l, h);
+		if (!(l & MSR_IA32_APICBASE_ENABLE)) {
+			pr_info("Local APIC disabled by BIOS -- reenabling.\n");
+			l &= ~MSR_IA32_APICBASE_BASE;
+			l |= MSR_IA32_APICBASE_ENABLE | addr;
+			wrmsr(MSR_IA32_APICBASE, l, h);
+			enabled_via_apicbase = 1;
+		}
+ 	}
+ 	return apic_verify();
+ }
+@@ -2149,10 +2153,12 @@ static void lapic_resume(void)
+ 		 * FIXME! This will be wrong if we ever support suspend on
+ 		 * SMP! We'll need to do this as part of the CPU restore!
+ 		 */
+-		rdmsr(MSR_IA32_APICBASE, l, h);
+-		l &= ~MSR_IA32_APICBASE_BASE;
+-		l |= MSR_IA32_APICBASE_ENABLE | mp_lapic_addr;
+-		wrmsr(MSR_IA32_APICBASE, l, h);
+		if (boot_cpu_data.x86 >= 6) {
+			rdmsr(MSR_IA32_APICBASE, l, h);
+			l &= ~MSR_IA32_APICBASE_BASE;
+			l |= MSR_IA32_APICBASE_ENABLE | mp_lapic_addr;
+			wrmsr(MSR_IA32_APICBASE, l, h);
+		}
+ 	}
+ 
+ 	maxlvt = lapic_get_maxlvt();
+-- 
+1.7.7.6
+
@@ -0,0 +1,135 @@
+From 57ae2e2d36a3b53fa55c4e1e6cf073f566921c40 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Sat, 28 Apr 2012 08:29:56 -0700
+Subject: [PATCH 092/165] Revert "autofs: work around unhappy compat problem
+ on x86-64"
+
+commit fcbf94b9dedd2ce08e798a99aafc94fec8668161 upstream.
+
+This reverts commit a32744d4abae24572eff7269bc17895c41bd0085.
+
+While that commit was technically the right thing to do, and made the
+x86-64 compat mode work identically to native 32-bit mode (and thus
+fixing the problem with a 32-bit systemd install on a 64-bit kernel), it
+turns out that the automount binaries had workarounds for this compat
+problem.
+
+Now, the workarounds are disgusting: doing an "uname()" to find out the
+architecture of the kernel, and then comparing it for the 64-bit cases
+and fixing up the size of the read() in automount for those.  And they
+were confused: it's not actually a generic 64-bit issue at all, it's
+very much tied to just x86-64, which has different alignment for an
+'u64' in 64-bit mode than in 32-bit mode.
+
+But the end result is that fixing the compat layer actually breaks the
+case of a 32-bit automount on a x86-64 kernel.
+
+There are various approaches to fix this (including just doing a
+"strcmp()" on current->comm and comparing it to "automount"), but I
+think that I will do the one that teaches pipes about a special "packet
+mode", which will allow user space to not have to care too deeply about
+the padding at the end of the autofs packet.
+
+That change will make the compat workaround unnecessary, so let's revert
+it first, and get automount working again in compat mode.  The
+packetized pipes will then fix autofs for systemd.
+
+Reported-and-requested-by: Michael Tokarev <mjt@tls.msk.ru>
+Cc: Ian Kent <raven@themaw.net>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+[bwh: Backported to 3.2: adjust context]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ fs/autofs4/autofs_i.h  |    1 -
+ fs/autofs4/dev-ioctl.c |    1 -
+ fs/autofs4/inode.c     |    2 --
+ fs/autofs4/waitq.c     |   22 +++-------------------
+ 4 files changed, 3 insertions(+), 23 deletions(-)
+
+diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h
+index 308a98b..326dc08 100644
+--- a/fs/autofs4/autofs_i.h
+++ b/fs/autofs4/autofs_i.h
+@@ -110,7 +110,6 @@ struct autofs_sb_info {
+ 	int sub_version;
+ 	int min_proto;
+ 	int max_proto;
+-	int compat_daemon;
+ 	unsigned long exp_timeout;
+ 	unsigned int type;
+ 	int reghost_enabled;
+diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
+index 56bac70..509fe1e 100644
+--- a/fs/autofs4/dev-ioctl.c
+++ b/fs/autofs4/dev-ioctl.c
+@@ -385,7 +385,6 @@ static int autofs_dev_ioctl_setpipefd(struct file *fp,
+ 		sbi->pipefd = pipefd;
+ 		sbi->pipe = pipe;
+ 		sbi->catatonic = 0;
+-		sbi->compat_daemon = is_compat_task();
+ 	}
+ out:
+ 	mutex_unlock(&sbi->wq_mutex);
+diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c
+index 98a5695..8179f1a 100644
+--- a/fs/autofs4/inode.c
+++ b/fs/autofs4/inode.c
+@@ -19,7 +19,6 @@
+ #include <linux/parser.h>
+ #include <linux/bitops.h>
+ #include <linux/magic.h>
+-#include <linux/compat.h>
+ #include "autofs_i.h"
+ #include <linux/module.h>
+ 
+@@ -225,7 +224,6 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
+ 	set_autofs_type_indirect(&sbi->type);
+ 	sbi->min_proto = 0;
+ 	sbi->max_proto = 0;
+-	sbi->compat_daemon = is_compat_task();
+ 	mutex_init(&sbi->wq_mutex);
+ 	spin_lock_init(&sbi->fs_lock);
+ 	sbi->queues = NULL;
+diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
+index 6861f61..e1fbdee 100644
+--- a/fs/autofs4/waitq.c
+++ b/fs/autofs4/waitq.c
+@@ -90,24 +90,7 @@ static int autofs4_write(struct file *file, const void *addr, int bytes)
+ 
+ 	return (bytes > 0);
+ }
+-
+-/*
+- * The autofs_v5 packet was misdesigned.
+- *
+- * The packets are identical on x86-32 and x86-64, but have different
+- * alignment. Which means that 'sizeof()' will give different results.
+- * Fix it up for the case of running 32-bit user mode on a 64-bit kernel.
+- */
+-static noinline size_t autofs_v5_packet_size(struct autofs_sb_info *sbi)
+-{
+-	size_t pktsz = sizeof(struct autofs_v5_packet);
+-#if defined(CONFIG_X86_64) && defined(CONFIG_COMPAT)
+-	if (sbi->compat_daemon > 0)
+-		pktsz -= 4;
+-#endif
+-	return pktsz;
+-}
+-
+	
+ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
+ 				 struct autofs_wait_queue *wq,
+ 				 int type)
+@@ -164,7 +147,8 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
+ 	{
+ 		struct autofs_v5_packet *packet = &pkt.v5_pkt.v5_packet;
+ 
+-		pktsz = autofs_v5_packet_size(sbi);
+		pktsz = sizeof(*packet);
+
+ 		packet->wait_queue_token = wq->wait_queue_token;
+ 		packet->len = wq->name.len;
+ 		memcpy(packet->name, wq->name.name, wq->name.len);
+-- 
+1.7.7.6
+
@@ -0,0 +1,47 @@
+From d989ae8669c297a7873a9b5c7e406bc467323388 Mon Sep 17 00:00:00 2001
+From: David Vrabel <david.vrabel@citrix.com>
+Date: Thu, 26 Apr 2012 19:44:06 +0100
+Subject: [PATCH 093/165] xen: correctly check for pending events when
+ restoring irq flags
+
+commit 7eb7ce4d2e8991aff4ecb71a81949a907ca755ac upstream.
+
+In xen_restore_fl_direct(), xen_force_evtchn_callback() was being
+called even if no events were pending.  This resulted in (depending on
+workload) about a 100 times as many xen_version hypercalls as
+necessary.
+
+Fix this by correcting the sense of the conditional jump.
+
+This seems to give a significant performance benefit for some
+workloads.
+
+There is some subtle tricksy "..since the check here is trying to
+check both pending and masked in a single cmpw, but I think this is
+correct. It will call check_events now only when the combined
+mask+pending word is 0x0001 (aka unmasked, pending)." (Ian)
+
+Acked-by: Ian Campbell <ian.campbell@citrix.com>
+Signed-off-by: David Vrabel <david.vrabel@citrix.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/x86/xen/xen-asm.S |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/arch/x86/xen/xen-asm.S b/arch/x86/xen/xen-asm.S
+index 79d7362..3e45aa0 100644
+--- a/arch/x86/xen/xen-asm.S
+++ b/arch/x86/xen/xen-asm.S
+@@ -96,7 +96,7 @@ ENTRY(xen_restore_fl_direct)
+ 
+ 	/* check for unmasked and pending */
+ 	cmpw $0x0001, PER_CPU_VAR(xen_vcpu_info) + XEN_vcpu_info_pending
+-	jz 1f
+	jnz 1f
+ 2:	call check_events
+ 1:
+ ENDPATCH(xen_restore_fl_direct)
+-- 
+1.7.7.6
+
@@ -0,0 +1,99 @@
+From 7e7b9fb05d7e36d2d585a422de52c3b2e3345cdf Mon Sep 17 00:00:00 2001
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Date: Thu, 26 Apr 2012 13:50:03 -0400
+Subject: [PATCH 094/165] xen/smp: Fix crash when booting with ACPI hotplug
+ CPUs.
+
+commit cf405ae612b0f7e2358db7ff594c0e94846137aa upstream.
+
+When we boot on a machine that can hotplug CPUs and we
+are using 'dom0_max_vcpus=X' on the Xen hypervisor line
+to clip the amount of CPUs available to the initial domain,
+we get this:
+
+(XEN) Command line: com1=115200,8n1 dom0_mem=8G noreboot dom0_max_vcpus=8 sync_console mce_verbosity=verbose console=com1,vga loglvl=all guest_loglvl=all
+.. snip..
+DMI: Intel Corporation S2600CP/S2600CP, BIOS SE5C600.86B.99.99.x032.072520111118 07/25/2011
+.. snip.
+SMP: Allowing 64 CPUs, 32 hotplug CPUs
+installing Xen timer for CPU 7
+cpu 7 spinlock event irq 361
+NMI watchdog: disabled (cpu7): hardware events not enabled
+Brought up 8 CPUs
+.. snip..
+	[acpi processor finds the CPUs are not initialized and starts calling
+	arch_register_cpu, which creates /sys/devices/system/cpu/cpu8/online]
+CPU 8 got hotplugged
+CPU 9 got hotplugged
+CPU 10 got hotplugged
+.. snip..
+initcall 1_acpi_battery_init_async+0x0/0x1b returned 0 after 406 usecs
+calling  erst_init+0x0/0x2bb @ 1
+
+	[and the scheduler sticks newly started tasks on the new CPUs, but
+	said CPUs cannot be initialized b/c the hypervisor has limited the
+	amount of vCPUS to 8 - as per the dom0_max_vcpus=8 flag.
+	The spinlock tries to kick the other CPU, but the structure for that
+	is not initialized and we crash.]
+BUG: unable to handle kernel paging request at fffffffffffffed8
+IP: [<ffffffff81035289>] xen_spin_lock+0x29/0x60
+PGD 180d067 PUD 180e067 PMD 0
+Oops: 0002 [#1] SMP
+CPU 7
+Modules linked in:
+
+Pid: 1, comm: swapper/0 Not tainted 3.4.0-rc2upstream-00001-gf5154e8 #1 Intel Corporation S2600CP/S2600CP
+RIP: e030:[<ffffffff81035289>]  [<ffffffff81035289>] xen_spin_lock+0x29/0x60
+RSP: e02b:ffff8801fb9b3a70  EFLAGS: 00010282
+
+With this patch, we cap the amount of vCPUS that the initial domain
+can run, to exactly what dom0_max_vcpus=X has specified.
+
+In the future, if there is a hypercall that will allow a running
+domain to expand past its initial set of vCPUS, this patch should
+be re-evaluated.
+
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ arch/x86/xen/smp.c |   15 +++++++++++++++
+ 1 files changed, 15 insertions(+), 0 deletions(-)
+
+diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
+index 041d4fe..9a23fff 100644
+--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
+@@ -172,6 +172,7 @@ static void __init xen_fill_possible_map(void)
+ static void __init xen_filter_cpu_maps(void)
+ {
+ 	int i, rc;
+	unsigned int subtract = 0;
+ 
+ 	if (!xen_initial_domain())
+ 		return;
+@@ -186,8 +187,22 @@ static void __init xen_filter_cpu_maps(void)
+ 		} else {
+ 			set_cpu_possible(i, false);
+ 			set_cpu_present(i, false);
+			subtract++;
+ 		}
+ 	}
+#ifdef CONFIG_HOTPLUG_CPU
+	/* This is akin to using 'nr_cpus' on the Linux command line.
+	 * Which is OK as when we use 'dom0_max_vcpus=X' we can only
+	 * have up to X, while nr_cpu_ids is greater than X. This
+	 * normally is not a problem, except when CPU hotplugging
+	 * is involved and then there might be more than X CPUs
+	 * in the guest - which will not work as there is no
+	 * hypercall to expand the max number of VCPUs an already
+	 * running guest has. So cap it up to X. */
+	if (subtract)
+		nr_cpu_ids = nr_cpu_ids - subtract;
+#endif
+
+ }
+ 
+ static void __init xen_smp_prepare_boot_cpu(void)
+-- 
+1.7.7.6
+
@@ -0,0 +1,43 @@
+From 5cf5b5db94847bec15c83a7ba69697a74e5248e0 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Thu, 12 Apr 2012 17:29:36 +0100
+Subject: [PATCH 095/165] ASoC: dapm: Ensure power gets managed for line
+ widgets
+
+commit 7e1f7c8a6e517900cd84da1b8ae020f08f286c3b upstream.
+
+Line widgets had not been included in either the power up or power down
+sequences so if a widget had an event associated with it that event would
+never be run. Fix this minimally by adding them to the sequences, we
+should probably be doing away with the specific widget types as they all
+have the same priority anyway.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ sound/soc/soc-dapm.c |    2 ++
+ 1 files changed, 2 insertions(+), 0 deletions(-)
+
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index ea909c5..90e93bf 100644
+--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
+@@ -69,6 +69,7 @@ static int dapm_up_seq[] = {
+ 	[snd_soc_dapm_out_drv] = 10,
+ 	[snd_soc_dapm_hp] = 10,
+ 	[snd_soc_dapm_spk] = 10,
+	[snd_soc_dapm_line] = 10,
+ 	[snd_soc_dapm_post] = 11,
+ };
+ 
+@@ -77,6 +78,7 @@ static int dapm_down_seq[] = {
+ 	[snd_soc_dapm_adc] = 1,
+ 	[snd_soc_dapm_hp] = 2,
+ 	[snd_soc_dapm_spk] = 2,
+	[snd_soc_dapm_line] = 2,
+ 	[snd_soc_dapm_out_drv] = 2,
+ 	[snd_soc_dapm_pga] = 4,
+ 	[snd_soc_dapm_mixer_named_ctl] = 5,
+-- 
+1.7.7.6
+
@@ -0,0 +1,389 @@
+From 18ea02a9ec95869c1210e6ea2f10dee99c36edbd Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Thu, 12 Apr 2012 19:47:11 +0100
+Subject: [PATCH 096/165] ASoC: wm8994: Improve sequencing of AIF channel
+ enables
+
+commit 1a38336b8611a04f0a624330c1f815421f4bf5f4 upstream.
+
+This ensures a clean startup of the channels, without this change some
+use cases could result in issues in a small proportion of cases.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ sound/soc/codecs/wm8994.c |  276 ++++++++++++++++++++++++++++++++++++---------
+ 1 files changed, 222 insertions(+), 54 deletions(-)
+
+diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
+index 2f1f5f8..7806301 100644
+--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
+@@ -883,61 +883,170 @@ static void wm8994_update_class_w(struct snd_soc_codec *codec)
+ 	}
+ }
+ 
+-static int late_enable_ev(struct snd_soc_dapm_widget *w,
+-			  struct snd_kcontrol *kcontrol, int event)
+static int aif1clk_ev(struct snd_soc_dapm_widget *w,
+		      struct snd_kcontrol *kcontrol, int event)
+ {
+ 	struct snd_soc_codec *codec = w->codec;
+-	struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
+	struct wm8994 *control = codec->control_data;
+	int mask = WM8994_AIF1DAC1L_ENA | WM8994_AIF1DAC1R_ENA;
+	int dac;
+	int adc;
+	int val;
+
+	switch (control->type) {
+	case WM8994:
+	case WM8958:
+		mask |= WM8994_AIF1DAC2L_ENA | WM8994_AIF1DAC2R_ENA;
+		break;
+	default:
+		break;
+	}
+ 
+ 	switch (event) {
+ 	case SND_SOC_DAPM_PRE_PMU:
+-		if (wm8994->aif1clk_enable) {
+-			snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1,
+-					    WM8994_AIF1CLK_ENA_MASK,
+-					    WM8994_AIF1CLK_ENA);
+-			wm8994->aif1clk_enable = 0;
+-		}
+-		if (wm8994->aif2clk_enable) {
+-			snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1,
+-					    WM8994_AIF2CLK_ENA_MASK,
+-					    WM8994_AIF2CLK_ENA);
+-			wm8994->aif2clk_enable = 0;
+-		}
+		val = snd_soc_read(codec, WM8994_AIF1_CONTROL_1);
+		if ((val & WM8994_AIF1ADCL_SRC) &&
+		    (val & WM8994_AIF1ADCR_SRC))
+			adc = WM8994_AIF1ADC1R_ENA | WM8994_AIF1ADC2R_ENA;
+		else if (!(val & WM8994_AIF1ADCL_SRC) &&
+			 !(val & WM8994_AIF1ADCR_SRC))
+			adc = WM8994_AIF1ADC1L_ENA | WM8994_AIF1ADC2L_ENA;
+		else
+			adc = WM8994_AIF1ADC1R_ENA | WM8994_AIF1ADC2R_ENA |
+				WM8994_AIF1ADC1L_ENA | WM8994_AIF1ADC2L_ENA;
+
+		val = snd_soc_read(codec, WM8994_AIF1_CONTROL_2);
+		if ((val & WM8994_AIF1DACL_SRC) &&
+		    (val & WM8994_AIF1DACR_SRC))
+			dac = WM8994_AIF1DAC1R_ENA | WM8994_AIF1DAC2R_ENA;
+		else if (!(val & WM8994_AIF1DACL_SRC) &&
+			 !(val & WM8994_AIF1DACR_SRC))
+			dac = WM8994_AIF1DAC1L_ENA | WM8994_AIF1DAC2L_ENA;
+		else
+			dac = WM8994_AIF1DAC1R_ENA | WM8994_AIF1DAC2R_ENA |
+				WM8994_AIF1DAC1L_ENA | WM8994_AIF1DAC2L_ENA;
+
+		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4,
+				    mask, adc);
+		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
+				    mask, dac);
+		snd_soc_update_bits(codec, WM8994_CLOCKING_1,
+				    WM8994_AIF1DSPCLK_ENA |
+				    WM8994_SYSDSPCLK_ENA,
+				    WM8994_AIF1DSPCLK_ENA |
+				    WM8994_SYSDSPCLK_ENA);
+		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4, mask,
+				    WM8994_AIF1ADC1R_ENA |
+				    WM8994_AIF1ADC1L_ENA |
+				    WM8994_AIF1ADC2R_ENA |
+				    WM8994_AIF1ADC2L_ENA);
+		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5, mask,
+				    WM8994_AIF1DAC1R_ENA |
+				    WM8994_AIF1DAC1L_ENA |
+				    WM8994_AIF1DAC2R_ENA |
+				    WM8994_AIF1DAC2L_ENA);
+		break;
+
+	case SND_SOC_DAPM_PRE_PMD:
+	case SND_SOC_DAPM_POST_PMD:
+		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
+				    mask, 0);
+		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4,
+				    mask, 0);
+
+		val = snd_soc_read(codec, WM8994_CLOCKING_1);
+		if (val & WM8994_AIF2DSPCLK_ENA)
+			val = WM8994_SYSDSPCLK_ENA;
+		else
+			val = 0;
+		snd_soc_update_bits(codec, WM8994_CLOCKING_1,
+				    WM8994_SYSDSPCLK_ENA |
+				    WM8994_AIF1DSPCLK_ENA, val);
+ 		break;
+ 	}
+ 
+-	/* We may also have postponed startup of DSP, handle that. */
+-	wm8958_aif_ev(w, kcontrol, event);
+-
+ 	return 0;
+ }
+ 
+-static int late_disable_ev(struct snd_soc_dapm_widget *w,
+-			   struct snd_kcontrol *kcontrol, int event)
+static int aif2clk_ev(struct snd_soc_dapm_widget *w,
+		      struct snd_kcontrol *kcontrol, int event)
+ {
+ 	struct snd_soc_codec *codec = w->codec;
+-	struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
+	int dac;
+	int adc;
+	int val;
+ 
+ 	switch (event) {
+	case SND_SOC_DAPM_PRE_PMU:
+		val = snd_soc_read(codec, WM8994_AIF2_CONTROL_1);
+		if ((val & WM8994_AIF2ADCL_SRC) &&
+		    (val & WM8994_AIF2ADCR_SRC))
+			adc = WM8994_AIF2ADCR_ENA;
+		else if (!(val & WM8994_AIF2ADCL_SRC) &&
+			 !(val & WM8994_AIF2ADCR_SRC))
+			adc = WM8994_AIF2ADCL_ENA;
+		else
+			adc = WM8994_AIF2ADCL_ENA | WM8994_AIF2ADCR_ENA;
+
+
+		val = snd_soc_read(codec, WM8994_AIF2_CONTROL_2);
+		if ((val & WM8994_AIF2DACL_SRC) &&
+		    (val & WM8994_AIF2DACR_SRC))
+			dac = WM8994_AIF2DACR_ENA;
+		else if (!(val & WM8994_AIF2DACL_SRC) &&
+			 !(val & WM8994_AIF2DACR_SRC))
+			dac = WM8994_AIF2DACL_ENA;
+		else
+			dac = WM8994_AIF2DACL_ENA | WM8994_AIF2DACR_ENA;
+
+		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4,
+				    WM8994_AIF2ADCL_ENA |
+				    WM8994_AIF2ADCR_ENA, adc);
+		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
+				    WM8994_AIF2DACL_ENA |
+				    WM8994_AIF2DACR_ENA, dac);
+		snd_soc_update_bits(codec, WM8994_CLOCKING_1,
+				    WM8994_AIF2DSPCLK_ENA |
+				    WM8994_SYSDSPCLK_ENA,
+				    WM8994_AIF2DSPCLK_ENA |
+				    WM8994_SYSDSPCLK_ENA);
+		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4,
+				    WM8994_AIF2ADCL_ENA |
+				    WM8994_AIF2ADCR_ENA,
+				    WM8994_AIF2ADCL_ENA |
+				    WM8994_AIF2ADCR_ENA);
+		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
+				    WM8994_AIF2DACL_ENA |
+				    WM8994_AIF2DACR_ENA,
+				    WM8994_AIF2DACL_ENA |
+				    WM8994_AIF2DACR_ENA);
+		break;
+
+	case SND_SOC_DAPM_PRE_PMD:
+ 	case SND_SOC_DAPM_POST_PMD:
+-		if (wm8994->aif1clk_disable) {
+-			snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1,
+-					    WM8994_AIF1CLK_ENA_MASK, 0);
+-			wm8994->aif1clk_disable = 0;
+-		}
+-		if (wm8994->aif2clk_disable) {
+-			snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1,
+-					    WM8994_AIF2CLK_ENA_MASK, 0);
+-			wm8994->aif2clk_disable = 0;
+-		}
+		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
+				    WM8994_AIF2DACL_ENA |
+				    WM8994_AIF2DACR_ENA, 0);
+		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
+				    WM8994_AIF2ADCL_ENA |
+				    WM8994_AIF2ADCR_ENA, 0);
+
+		val = snd_soc_read(codec, WM8994_CLOCKING_1);
+		if (val & WM8994_AIF1DSPCLK_ENA)
+			val = WM8994_SYSDSPCLK_ENA;
+		else
+			val = 0;
+		snd_soc_update_bits(codec, WM8994_CLOCKING_1,
+				    WM8994_SYSDSPCLK_ENA |
+				    WM8994_AIF2DSPCLK_ENA, val);
+ 		break;
+ 	}
+ 
+ 	return 0;
+ }
+ 
+-static int aif1clk_ev(struct snd_soc_dapm_widget *w,
+-		      struct snd_kcontrol *kcontrol, int event)
+static int aif1clk_late_ev(struct snd_soc_dapm_widget *w,
+			   struct snd_kcontrol *kcontrol, int event)
+ {
+ 	struct snd_soc_codec *codec = w->codec;
+ 	struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
+@@ -954,8 +1063,8 @@ static int aif1clk_ev(struct snd_soc_dapm_widget *w,
+ 	return 0;
+ }
+ 
+-static int aif2clk_ev(struct snd_soc_dapm_widget *w,
+-		      struct snd_kcontrol *kcontrol, int event)
+static int aif2clk_late_ev(struct snd_soc_dapm_widget *w,
+			   struct snd_kcontrol *kcontrol, int event)
+ {
+ 	struct snd_soc_codec *codec = w->codec;
+ 	struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
+@@ -972,6 +1081,63 @@ static int aif2clk_ev(struct snd_soc_dapm_widget *w,
+ 	return 0;
+ }
+ 
+static int late_enable_ev(struct snd_soc_dapm_widget *w,
+			  struct snd_kcontrol *kcontrol, int event)
+{
+	struct snd_soc_codec *codec = w->codec;
+	struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
+
+	switch (event) {
+	case SND_SOC_DAPM_PRE_PMU:
+		if (wm8994->aif1clk_enable) {
+			aif1clk_ev(w, kcontrol, event);
+			snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1,
+					    WM8994_AIF1CLK_ENA_MASK,
+					    WM8994_AIF1CLK_ENA);
+			wm8994->aif1clk_enable = 0;
+		}
+		if (wm8994->aif2clk_enable) {
+			aif2clk_ev(w, kcontrol, event);
+			snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1,
+					    WM8994_AIF2CLK_ENA_MASK,
+					    WM8994_AIF2CLK_ENA);
+			wm8994->aif2clk_enable = 0;
+		}
+		break;
+	}
+
+	/* We may also have postponed startup of DSP, handle that. */
+	wm8958_aif_ev(w, kcontrol, event);
+
+	return 0;
+}
+
+static int late_disable_ev(struct snd_soc_dapm_widget *w,
+			   struct snd_kcontrol *kcontrol, int event)
+{
+	struct snd_soc_codec *codec = w->codec;
+	struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
+
+	switch (event) {
+	case SND_SOC_DAPM_POST_PMD:
+		if (wm8994->aif1clk_disable) {
+			snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1,
+					    WM8994_AIF1CLK_ENA_MASK, 0);
+			aif1clk_ev(w, kcontrol, event);
+			wm8994->aif1clk_disable = 0;
+		}
+		if (wm8994->aif2clk_disable) {
+			snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1,
+					    WM8994_AIF2CLK_ENA_MASK, 0);
+			aif2clk_ev(w, kcontrol, event);
+			wm8994->aif2clk_disable = 0;
+		}
+		break;
+	}
+
+	return 0;
+}
+
+ static int adc_mux_ev(struct snd_soc_dapm_widget *w,
+ 		      struct snd_kcontrol *kcontrol, int event)
+ {
+@@ -1268,9 +1434,9 @@ static const struct snd_kcontrol_new aif2dacr_src_mux =
+ 	SOC_DAPM_ENUM("AIF2DACR Mux", aif2dacr_src_enum);
+ 
+ static const struct snd_soc_dapm_widget wm8994_lateclk_revd_widgets[] = {
+-SND_SOC_DAPM_SUPPLY("AIF1CLK", SND_SOC_NOPM, 0, 0, aif1clk_ev,
+SND_SOC_DAPM_SUPPLY("AIF1CLK", SND_SOC_NOPM, 0, 0, aif1clk_late_ev,
+ 	SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+-SND_SOC_DAPM_SUPPLY("AIF2CLK", SND_SOC_NOPM, 0, 0, aif2clk_ev,
+SND_SOC_DAPM_SUPPLY("AIF2CLK", SND_SOC_NOPM, 0, 0, aif2clk_late_ev,
+ 	SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+ 
+ SND_SOC_DAPM_PGA_E("Late DAC1L Enable PGA", SND_SOC_NOPM, 0, 0, NULL, 0,
+@@ -1299,8 +1465,10 @@ SND_SOC_DAPM_POST("Late Disable PGA", late_disable_ev)
+ };
+ 
+ static const struct snd_soc_dapm_widget wm8994_lateclk_widgets[] = {
+-SND_SOC_DAPM_SUPPLY("AIF1CLK", WM8994_AIF1_CLOCKING_1, 0, 0, NULL, 0),
+-SND_SOC_DAPM_SUPPLY("AIF2CLK", WM8994_AIF2_CLOCKING_1, 0, 0, NULL, 0),
+SND_SOC_DAPM_SUPPLY("AIF1CLK", WM8994_AIF1_CLOCKING_1, 0, 0, aif1clk_ev,
+		    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_PRE_PMD),
+SND_SOC_DAPM_SUPPLY("AIF2CLK", WM8994_AIF2_CLOCKING_1, 0, 0, aif2clk_ev,
+		    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_PRE_PMD),
+ SND_SOC_DAPM_PGA("Direct Voice", SND_SOC_NOPM, 0, 0, NULL, 0),
+ SND_SOC_DAPM_MIXER("SPKL", WM8994_POWER_MANAGEMENT_3, 8, 0,
+ 		   left_speaker_mixer, ARRAY_SIZE(left_speaker_mixer)),
+@@ -1353,30 +1521,30 @@ SND_SOC_DAPM_SUPPLY("VMID", SND_SOC_NOPM, 0, 0, vmid_event,
+ SND_SOC_DAPM_SUPPLY("CLK_SYS", SND_SOC_NOPM, 0, 0, clk_sys_event,
+ 		    SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD),
+ 
+-SND_SOC_DAPM_SUPPLY("DSP1CLK", WM8994_CLOCKING_1, 3, 0, NULL, 0),
+-SND_SOC_DAPM_SUPPLY("DSP2CLK", WM8994_CLOCKING_1, 2, 0, NULL, 0),
+-SND_SOC_DAPM_SUPPLY("DSPINTCLK", WM8994_CLOCKING_1, 1, 0, NULL, 0),
+SND_SOC_DAPM_SUPPLY("DSP1CLK", SND_SOC_NOPM, 3, 0, NULL, 0),
+SND_SOC_DAPM_SUPPLY("DSP2CLK", SND_SOC_NOPM, 2, 0, NULL, 0),
+SND_SOC_DAPM_SUPPLY("DSPINTCLK", SND_SOC_NOPM, 1, 0, NULL, 0),
+ 
+ SND_SOC_DAPM_AIF_OUT("AIF1ADC1L", NULL,
+-		     0, WM8994_POWER_MANAGEMENT_4, 9, 0),
+		     0, SND_SOC_NOPM, 9, 0),
+ SND_SOC_DAPM_AIF_OUT("AIF1ADC1R", NULL,
+-		     0, WM8994_POWER_MANAGEMENT_4, 8, 0),
+		     0, SND_SOC_NOPM, 8, 0),
+ SND_SOC_DAPM_AIF_IN_E("AIF1DAC1L", NULL, 0,
+-		      WM8994_POWER_MANAGEMENT_5, 9, 0, wm8958_aif_ev,
+		      SND_SOC_NOPM, 9, 0, wm8958_aif_ev,
+ 		      SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
+ SND_SOC_DAPM_AIF_IN_E("AIF1DAC1R", NULL, 0,
+-		      WM8994_POWER_MANAGEMENT_5, 8, 0, wm8958_aif_ev,
+		      SND_SOC_NOPM, 8, 0, wm8958_aif_ev,
+ 		      SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
+ 
+ SND_SOC_DAPM_AIF_OUT("AIF1ADC2L", NULL,
+-		     0, WM8994_POWER_MANAGEMENT_4, 11, 0),
+		     0, SND_SOC_NOPM, 11, 0),
+ SND_SOC_DAPM_AIF_OUT("AIF1ADC2R", NULL,
+-		     0, WM8994_POWER_MANAGEMENT_4, 10, 0),
+		     0, SND_SOC_NOPM, 10, 0),
+ SND_SOC_DAPM_AIF_IN_E("AIF1DAC2L", NULL, 0,
+-		      WM8994_POWER_MANAGEMENT_5, 11, 0, wm8958_aif_ev,
+		      SND_SOC_NOPM, 11, 0, wm8958_aif_ev,
+ 		      SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
+ SND_SOC_DAPM_AIF_IN_E("AIF1DAC2R", NULL, 0,
+-		      WM8994_POWER_MANAGEMENT_5, 10, 0, wm8958_aif_ev,
+		      SND_SOC_NOPM, 10, 0, wm8958_aif_ev,
+ 		      SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
+ 
+ SND_SOC_DAPM_MIXER("AIF1ADC1L Mixer", SND_SOC_NOPM, 0, 0,
+@@ -1403,14 +1571,14 @@ SND_SOC_DAPM_MIXER("DAC1R Mixer", SND_SOC_NOPM, 0, 0,
+ 		   dac1r_mix, ARRAY_SIZE(dac1r_mix)),
+ 
+ SND_SOC_DAPM_AIF_OUT("AIF2ADCL", NULL, 0,
+-		     WM8994_POWER_MANAGEMENT_4, 13, 0),
+		     SND_SOC_NOPM, 13, 0),
+ SND_SOC_DAPM_AIF_OUT("AIF2ADCR", NULL, 0,
+-		     WM8994_POWER_MANAGEMENT_4, 12, 0),
+		     SND_SOC_NOPM, 12, 0),
+ SND_SOC_DAPM_AIF_IN_E("AIF2DACL", NULL, 0,
+-		      WM8994_POWER_MANAGEMENT_5, 13, 0, wm8958_aif_ev,
+		      SND_SOC_NOPM, 13, 0, wm8958_aif_ev,
+ 		      SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD),
+ SND_SOC_DAPM_AIF_IN_E("AIF2DACR", NULL, 0,
+-		      WM8994_POWER_MANAGEMENT_5, 12, 0, wm8958_aif_ev,
+		      SND_SOC_NOPM, 12, 0, wm8958_aif_ev,
+ 		      SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD),
+ 
+ SND_SOC_DAPM_AIF_IN("AIF1DACDAT", "AIF1 Playback", 0, SND_SOC_NOPM, 0, 0),
+-- 
+1.7.7.6
+
@@ -0,0 +1,40 @@
+From 461507ae293668a6dd1543092d2506fa4524d8ec Mon Sep 17 00:00:00 2001
+From: Nicolas Ferre <nicolas.ferre@atmel.com>
+Date: Mon, 16 Apr 2012 14:46:30 +0200
+Subject: [PATCH 097/165] dmaengine: at_hdmac: remove clear-on-read in
+ atc_dostart()
+
+commit ed8b0d67f33518a16c6b2450fe5ebebf180c2d04 upstream.
+
+This loop on EBCISR register was designed to clear IRQ sources before enabling
+a DMA channel. This register is clear-on-read so a race condition can appear if
+another channel is already active and has just finished its transfer.
+Removing this read on EBCISR is fixing the issue as there is no case where an IRQ
+could be pending: we already make sure that this register is drained at probe()
+time and during resume.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/dma/at_hdmac.c |    4 ----
+ 1 files changed, 0 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
+index a60adbf..79dcf6e 100644
+--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
+@@ -239,10 +239,6 @@ static void atc_dostart(struct at_dma_chan *atchan, struct at_desc *first)
+ 
+ 	vdbg_dump_regs(atchan);
+ 
+-	/* clear any pending interrupt */
+-	while (dma_readl(atdma, EBCISR))
+-		cpu_relax();
+-
+ 	channel_writel(atchan, SADDR, 0);
+ 	channel_writel(atchan, DADDR, 0);
+ 	channel_writel(atchan, CTRLA, 0);
+-- 
+1.7.7.6
+
@@ -0,0 +1,85 @@
+From 9568d8a7012a9ca0fafc44570e46030d60f22a91 Mon Sep 17 00:00:00 2001
+From: "he, bo" <bo.he@intel.com>
+Date: Wed, 25 Apr 2012 19:59:21 +0800
+Subject: [PATCH 098/165] sched: Fix OOPS when build_sched_domains() percpu
+ allocation fails
+
+commit fb2cf2c660971bea0ad86a9a5c19ad39eab61344 upstream.
+
+Under extreme memory used up situations, percpu allocation
+might fail. We hit it when system goes to suspend-to-ram,
+causing a kworker panic:
+
+ EIP: [<c124411a>] build_sched_domains+0x23a/0xad0
+ Kernel panic - not syncing: Fatal exception
+ Pid: 3026, comm: kworker/u:3
+ 3.0.8-137473-gf42fbef #1
+
+ Call Trace:
+  [<c18cc4f2>] panic+0x66/0x16c
+  [...]
+  [<c1244c37>] partition_sched_domains+0x287/0x4b0
+  [<c12a77be>] cpuset_update_active_cpus+0x1fe/0x210
+  [<c123712d>] cpuset_cpu_inactive+0x1d/0x30
+  [...]
+
+With this fix applied build_sched_domains() will return -ENOMEM and
+the suspend attempt fails.
+
+Signed-off-by: he, bo <bo.he@intel.com>
+Reviewed-by: Zhang, Yanmin <yanmin.zhang@intel.com>
+Reviewed-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Link: http://lkml.kernel.org/r/1335355161.5892.17.camel@hebo
+[ So, we fail to deallocate a CPU because we cannot allocate RAM :-/
+  I don't like that kind of sad behavior but nevertheless it should
+  not crash under high memory load. ]
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+[bwh: Backported to 3.2: change filename]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ kernel/sched.c |   22 ++++++++++++++++------
+ 1 files changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/sched.c b/kernel/sched.c
+index d6b149c..106a3b8 100644
+--- a/kernel/sched.c
+++ b/kernel/sched.c
+@@ -7605,16 +7605,26 @@ static void __sdt_free(const struct cpumask *cpu_map)
+ 		struct sd_data *sdd = &tl->data;
+ 
+ 		for_each_cpu(j, cpu_map) {
+-			struct sched_domain *sd = *per_cpu_ptr(sdd->sd, j);
+-			if (sd && (sd->flags & SD_OVERLAP))
+-				free_sched_groups(sd->groups, 0);
+-			kfree(*per_cpu_ptr(sdd->sd, j));
+-			kfree(*per_cpu_ptr(sdd->sg, j));
+-			kfree(*per_cpu_ptr(sdd->sgp, j));
+			struct sched_domain *sd;
+
+			if (sdd->sd) {
+				sd = *per_cpu_ptr(sdd->sd, j);
+				if (sd && (sd->flags & SD_OVERLAP))
+					free_sched_groups(sd->groups, 0);
+				kfree(*per_cpu_ptr(sdd->sd, j));
+			}
+
+			if (sdd->sg)
+				kfree(*per_cpu_ptr(sdd->sg, j));
+			if (sdd->sgp)
+				kfree(*per_cpu_ptr(sdd->sgp, j));
+ 		}
+ 		free_percpu(sdd->sd);
+		sdd->sd = NULL;
+ 		free_percpu(sdd->sg);
+		sdd->sg = NULL;
+ 		free_percpu(sdd->sgp);
+		sdd->sgp = NULL;
+ 	}
+ }
+ 
+-- 
+1.7.7.6
+
@@ -0,0 +1,62 @@
+From e2b214ae8c691f0fd7aeb572dda62401b9221ee4 Mon Sep 17 00:00:00 2001
+From: Steven Rostedt <srostedt@redhat.com>
+Date: Thu, 19 Apr 2012 10:31:47 -0400
+Subject: [PATCH 099/165] tracing: Fix stacktrace of latency tracers (irqsoff
+ and friends)
+
+commit db4c75cbebd7e5910cd3bcb6790272fcc3042857 upstream.
+
+While debugging a latency with someone on IRC (mirage335) on #linux-rt (OFTC),
+we discovered that the stacktrace output of the latency tracers
+(preemptirqsoff) was empty.
+
+This bug was caused by the creation of the dynamic length stack trace
+again (like commit 12b5da3 "tracing: Fix ent_size in trace output" was).
+
+This bug is caused by the latency tracers requiring the next event
+to determine the time between the current event and the next. But by
+grabbing the next event, the iter->ent_size is set to the next event
+instead of the current one. As the stacktrace event is the last event,
+this makes the ent_size zero and causes nothing to be printed for
+the stack trace. The dynamic stacktrace uses the ent_size to determine
+how much of the stack can be printed. The ent_size of zero means
+no stack.
+
+The simple fix is to save the iter->ent_size before finding the next event.
+
+Note, mirage335 asked to remain anonymous from LKML and git, so I will
+not add the Reported-by and Tested-by tags, even though he did report
+the issue and tested the fix.
+
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ kernel/trace/trace_output.c |    5 +++++
+ 1 files changed, 5 insertions(+), 0 deletions(-)
+
+diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
+index 5199930..1dcf253 100644
+--- a/kernel/trace/trace_output.c
+++ b/kernel/trace/trace_output.c
+@@ -638,6 +638,8 @@ int trace_print_lat_context(struct trace_iterator *iter)
+ {
+ 	u64 next_ts;
+ 	int ret;
+	/* trace_find_next_entry will reset ent_size */
+	int ent_size = iter->ent_size;
+ 	struct trace_seq *s = &iter->seq;
+ 	struct trace_entry *entry = iter->ent,
+ 			   *next_entry = trace_find_next_entry(iter, NULL,
+@@ -646,6 +648,9 @@ int trace_print_lat_context(struct trace_iterator *iter)
+ 	unsigned long abs_usecs = ns2usecs(iter->ts - iter->tr->time_start);
+ 	unsigned long rel_usecs;
+ 
+	/* Restore the original ent_size */
+	iter->ent_size = ent_size;
+
+ 	if (!next_entry)
+ 		next_ts = iter->ts;
+ 	rel_usecs = ns2usecs(next_ts - iter->ts);
+-- 
+1.7.7.6
+
--- a/Show More
+++ b/Show More