linux-ti33x-psp 3.2: update to 3.2.5

Runtime tested on a beaglebone A3 Signed-off-by: Koen Kooi <koen@dominion.thruhere.net> Signed-off-by: Denys Dmytriyenko <denys@ti.com>
2026-07-26 05:48:04 +00:00 · 2012-02-10 15:32:32 +01:00
parent 14f31c3c5a
commit c4eefd7530
277 changed files with 21802 additions and 2 deletions
@@ -0,0 +1,31 @@
+From d1fe421bb81064477843db98b4804fec79eae30e Mon Sep 17 00:00:00 2001
+From: Joe Perches <joe@perches.com>
+Date: Fri, 9 Dec 2011 13:54:34 -0800
+Subject: [PATCH 01/49] MAINTAINERS: stable: Update address
+
+commit bc7a2f3abc636d7cab84258a48e77b08fb5fd3d6 upstream.
+
+The old address hasn't worked since the great intrusion of August 2011.
+
+Signed-off-by: Joe Perches <joe@perches.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ MAINTAINERS |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/MAINTAINERS b/MAINTAINERS
+index 62f1cd3..f986e7d 100644
+--- a/MAINTAINERS
+++ b/MAINTAINERS
+@@ -6258,7 +6258,7 @@ F:	arch/alpha/kernel/srm_env.c
+ 
+ STABLE BRANCH
+ M:	Greg Kroah-Hartman <greg@kroah.com>
+-L:	stable@kernel.org
+L:	stable@vger.kernel.org
+ S:	Maintained
+ 
+ STAGING SUBSYSTEM
+-- 
+1.7.7.4
+
@@ -0,0 +1,56 @@
+From 3dc851fe5a59ee0eb306b3a29819ee040ba69a24 Mon Sep 17 00:00:00 2001
+From: Joe Perches <joe@perches.com>
+Date: Fri, 9 Dec 2011 14:12:00 -0800
+Subject: [PATCH 02/49] Documentation: Update stable address
+
+commit 2eb7f204db51969ea558802a6601d79c2fb273b9 upstream.
+
+The Japanese/Korean/Chinese versions still need updating.
+
+Also, the stable kernel 2.6.x.y descriptions are out of date
+and should be updated as well.
+
+Signed-off-by: Joe Perches <joe@perches.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ Documentation/HOWTO                         |    4 ++--
+ Documentation/development-process/5.Posting |    8 ++++----
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/Documentation/HOWTO b/Documentation/HOWTO
+index 81bc1a9..f7ade3b 100644
+--- a/Documentation/HOWTO
+++ b/Documentation/HOWTO
+@@ -275,8 +275,8 @@ versions.
+ If no 2.6.x.y kernel is available, then the highest numbered 2.6.x
+ kernel is the current stable kernel.
+ 
+-2.6.x.y are maintained by the "stable" team <stable@kernel.org>, and are
+-released as needs dictate.  The normal release period is approximately 
+2.6.x.y are maintained by the "stable" team <stable@vger.kernel.org>, and
+are released as needs dictate.  The normal release period is approximately
+ two weeks, but it can be longer if there are no pressing problems.  A
+ security-related problem, instead, can cause a release to happen almost
+ instantly.
+diff --git a/Documentation/development-process/5.Posting b/Documentation/development-process/5.Posting
+index 903a254..8a48c9b 100644
+--- a/Documentation/development-process/5.Posting
+++ b/Documentation/development-process/5.Posting
+@@ -271,10 +271,10 @@ copies should go to:
+    the linux-kernel list.
+ 
+  - If you are fixing a bug, think about whether the fix should go into the
+-   next stable update.  If so, stable@kernel.org should get a copy of the
+-   patch.  Also add a "Cc: stable@kernel.org" to the tags within the patch
+-   itself; that will cause the stable team to get a notification when your
+-   fix goes into the mainline.
+   next stable update.  If so, stable@vger.kernel.org should get a copy of
+   the patch.  Also add a "Cc: stable@vger.kernel.org" to the tags within
+   the patch itself; that will cause the stable team to get a notification
+   when your fix goes into the mainline.
+ 
+ When selecting recipients for a patch, it is good to have an idea of who
+ you think will eventually accept the patch and get it merged.  While it
+-- 
+1.7.7.4
+
@@ -0,0 +1,81 @@
+From 9fa97016831ab21d14565a478dc462f35dfb7d2b Mon Sep 17 00:00:00 2001
+From: Neil Horman <nhorman@tuxdriver.com>
+Date: Mon, 2 Jan 2012 15:31:23 -0500
+Subject: [PATCH 03/49] firmware: Fix an oops on reading fw_priv->fw in sysfs
+ loading file
+
+commit eea915bb0d1358755f151eaefb8208a2d5f3e10c upstream.
+
+This oops was reported recently:
+firmware_loading_store+0xf9/0x17b
+dev_attr_store+0x20/0x22
+sysfs_write_file+0x101/0x134
+vfs_write+0xac/0xf3
+sys_write+0x4a/0x6e
+system_call_fastpath+0x16/0x1b
+
+The complete backtrace was unfortunately not captured, but details can be found
+here:
+https://bugzilla.redhat.com/show_bug.cgi?id=769920
+
+The cause is fairly clear.
+
+Its caused by the fact that firmware_loading_store has a case 0 in its
+switch statement that reads and writes the fw_priv->fw poniter without the
+protection of the fw_lock mutex.  since there is a window between the time that
+_request_firmware sets fw_priv->fw to NULL and the time the corresponding sysfs
+file is unregistered, its possible for a user space application to race in, and
+write a zero to the loading file, causing a NULL dereference in
+firmware_loading_store.  Fix it by extending the protection of the fw_lock mutex
+to cover all of the firware_loading_store function.
+
+Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/base/firmware_class.c |   14 +++++++-------
+ 1 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
+index 06ed6b4..3719c94 100644
+--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
+@@ -226,13 +226,13 @@ static ssize_t firmware_loading_store(struct device *dev,
+ 	int loading = simple_strtol(buf, NULL, 10);
+ 	int i;
+ 
+	mutex_lock(&fw_lock);
+
+	if (!fw_priv->fw)
+		goto out;
+
+ 	switch (loading) {
+ 	case 1:
+-		mutex_lock(&fw_lock);
+-		if (!fw_priv->fw) {
+-			mutex_unlock(&fw_lock);
+-			break;
+-		}
+ 		firmware_free_data(fw_priv->fw);
+ 		memset(fw_priv->fw, 0, sizeof(struct firmware));
+ 		/* If the pages are not owned by 'struct firmware' */
+@@ -243,7 +243,6 @@ static ssize_t firmware_loading_store(struct device *dev,
+ 		fw_priv->page_array_size = 0;
+ 		fw_priv->nr_pages = 0;
+ 		set_bit(FW_STATUS_LOADING, &fw_priv->status);
+-		mutex_unlock(&fw_lock);
+ 		break;
+ 	case 0:
+ 		if (test_bit(FW_STATUS_LOADING, &fw_priv->status)) {
+@@ -274,7 +273,8 @@ static ssize_t firmware_loading_store(struct device *dev,
+ 		fw_load_abort(fw_priv);
+ 		break;
+ 	}
+-
+out:
+	mutex_unlock(&fw_lock);
+ 	return count;
+ }
+ 
+-- 
+1.7.7.4
+
@@ -0,0 +1,43 @@
+From c64f87400ad7f27c043d969e695b3b2384e8a246 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Tue, 27 Dec 2011 12:22:51 -0600
+Subject: [PATCH 04/49] rt2800usb: Move ID out of unknown
+
+commit 3f81f8f1524ccca24df1029b0cf825ecef5e5cdc upstream.
+
+Testing on the openSUSE wireless forum has shown that a Linksys
+WUSB54GC v3 with USB ID 1737:0077 works with rt2800usb when the ID is
+written to /sys/.../new_id. This ID can therefore be moved out of UNKNOWN.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
+Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/wireless/rt2x00/rt2800usb.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
+index 3778763..3265b34 100644
+--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
+@@ -976,6 +976,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ 	{ USB_DEVICE(0x13b1, 0x0031) },
+ 	{ USB_DEVICE(0x1737, 0x0070) },
+ 	{ USB_DEVICE(0x1737, 0x0071) },
+	{ USB_DEVICE(0x1737, 0x0077) },
+ 	/* Logitec */
+ 	{ USB_DEVICE(0x0789, 0x0162) },
+ 	{ USB_DEVICE(0x0789, 0x0163) },
+@@ -1171,7 +1172,6 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ 	{ USB_DEVICE(0x1740, 0x0605) },
+ 	{ USB_DEVICE(0x1740, 0x0615) },
+ 	/* Linksys */
+-	{ USB_DEVICE(0x1737, 0x0077) },
+ 	{ USB_DEVICE(0x1737, 0x0078) },
+ 	/* Logitec */
+ 	{ USB_DEVICE(0x0789, 0x0168) },
+-- 
+1.7.7.4
+
@@ -0,0 +1,92 @@
+From 698d2012f8540d1cedc1f49013ba320e382cd1d9 Mon Sep 17 00:00:00 2001
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Date: Wed, 28 Dec 2011 00:10:16 +0000
+Subject: [PATCH 05/49] offb: Fix setting of the pseudo-palette for >8bpp
+
+commit 1bb0b7d21584b3f878e2bc880db62351ddee5185 upstream.
+
+When using a >8bpp framebuffer, offb advertises truecolor, not directcolor,
+and doesn't touch the color map even if it has a corresponding access method
+for the real hardware.
+
+Thus it needs to set the pseudo-palette with all 3 components of the color,
+like other truecolor framebuffers, not with copies of the color index like
+a directcolor framebuffer would do.
+
+This went unnoticed for a long time because it's pretty hard to get offb
+to kick in with anything but 8bpp (old BootX under MacOS will do that and
+qemu does it).
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/video/offb.c |   50 +++++++++++++++++++++++---------------------------
+ 1 files changed, 23 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/video/offb.c b/drivers/video/offb.c
+index cb163a5..24e1fc6 100644
+--- a/drivers/video/offb.c
+++ b/drivers/video/offb.c
+@@ -100,36 +100,32 @@ static int offb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
+ 			  u_int transp, struct fb_info *info)
+ {
+ 	struct offb_par *par = (struct offb_par *) info->par;
+-	int i, depth;
+-	u32 *pal = info->pseudo_palette;
+-
+-	depth = info->var.bits_per_pixel;
+-	if (depth == 16)
+-		depth = (info->var.green.length == 5) ? 15 : 16;
+-
+-	if (regno > 255 ||
+-	    (depth == 16 && regno > 63) ||
+-	    (depth == 15 && regno > 31))
+-		return 1;
+-
+-	if (regno < 16) {
+-		switch (depth) {
+-		case 15:
+-			pal[regno] = (regno << 10) | (regno << 5) | regno;
+-			break;
+-		case 16:
+-			pal[regno] = (regno << 11) | (regno << 5) | regno;
+-			break;
+-		case 24:
+-			pal[regno] = (regno << 16) | (regno << 8) | regno;
+-			break;
+-		case 32:
+-			i = (regno << 8) | regno;
+-			pal[regno] = (i << 16) | i;
+-			break;
+
+	if (info->fix.visual == FB_VISUAL_TRUECOLOR) {
+		u32 *pal = info->pseudo_palette;
+		u32 cr = red >> (16 - info->var.red.length);
+		u32 cg = green >> (16 - info->var.green.length);
+		u32 cb = blue >> (16 - info->var.blue.length);
+		u32 value;
+
+		if (regno >= 16)
+			return -EINVAL;
+
+		value = (cr << info->var.red.offset) |
+			(cg << info->var.green.offset) |
+			(cb << info->var.blue.offset);
+		if (info->var.transp.length > 0) {
+			u32 mask = (1 << info->var.transp.length) - 1;
+			mask <<= info->var.transp.offset;
+			value |= mask;
+ 		}
+		pal[regno] = value;
+		return 0;
+ 	}
+ 
+	if (regno > 255)
+		return -EINVAL;
+
+ 	red >>= 8;
+ 	green >>= 8;
+ 	blue >>= 8;
+-- 
+1.7.7.4
+
@@ -0,0 +1,32 @@
+From 37c7c45ec59ce80eaedb2b8edc4b797e4ad0ef03 Mon Sep 17 00:00:00 2001
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Date: Tue, 3 Jan 2012 12:09:15 +1100
+Subject: [PATCH 06/49] offb: Fix bug in calculating requested vram size
+
+commit c055fe0797b7bd8f6f21a13598a55a16d5c13ae7 upstream.
+
+We used to try to request 8 times more vram than needed, which would
+fail if the card has a too small BAR (observed with qemu & kvm).
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/video/offb.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/video/offb.c b/drivers/video/offb.c
+index 24e1fc6..3251a02 100644
+--- a/drivers/video/offb.c
+++ b/drivers/video/offb.c
+@@ -377,7 +377,7 @@ static void __init offb_init_fb(const char *name, const char *full_name,
+ 				int pitch, unsigned long address,
+ 				int foreign_endian, struct device_node *dp)
+ {
+-	unsigned long res_size = pitch * height * (depth + 7) / 8;
+	unsigned long res_size = pitch * height;
+ 	struct offb_par *par = &default_par;
+ 	unsigned long res_start = address;
+ 	struct fb_fix_screeninfo *fix;
+-- 
+1.7.7.4
+
@@ -0,0 +1,86 @@
+From 3184baa0e69e6ad327808b91e0d915090c59b99b Mon Sep 17 00:00:00 2001
+From: Andres Salomon <dilinger@queued.net>
+Date: Mon, 19 Dec 2011 12:22:58 -0800
+Subject: [PATCH 07/49] libertas: clean up scan thread handling
+
+commit afbca95f95f2bf7283a72670c24c1f6de00b1cb5 upstream.
+
+The libertas scan thread expects priv->scan_req to be non-NULL.  In theory,
+it should always be set.  In practice, we've seen the following oops:
+
+[ 8363.067444] Unable to handle kernel NULL pointer dereference at virtual address 00000004
+[ 8363.067490] pgd = c0004000
+[ 8363.078393] [00000004] *pgd=00000000
+[ 8363.086711] Internal error: Oops: 17 [#1] PREEMPT
+[ 8363.091375] Modules linked in: fuse libertas_sdio libertas psmouse mousedev ov7670 mmp_camera joydev videobuf2_core videobuf2_dma_sg videobuf2_memops [last unloaded: scsi_wait_scan]
+[ 8363.107490] CPU: 0    Not tainted  (3.0.0-gf7ccc69 #671)
+[ 8363.112799] PC is at lbs_scan_worker+0x108/0x5a4 [libertas]
+[ 8363.118326] LR is at 0x0
+[ 8363.120836] pc : [<bf03a854>]    lr : [<00000000>]    psr: 60000113
+[ 8363.120845] sp : ee66bf48  ip : 00000000  fp : 00000000
+[ 8363.120845] r10: ee2c2088  r9 : c04e2efc  r8 : eef97005
+[ 8363.132231] r7 : eee0716f  r6 : ee2c02c0  r5 : ee2c2088  r4 : eee07160
+[ 8363.137419] r3 : 00000000  r2 : a0000113  r1 : 00000001  r0 : eee07160
+[ 8363.143896] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
+[ 8363.157630] Control: 10c5387d  Table: 2e754019  DAC: 00000015
+[ 8363.163334] Process kworker/u:1 (pid: 25, stack limit = 0xee66a2f8)
+
+While I've not found a smoking gun, there are two places that raised red flags
+for me.  The first is in _internal_start_scan, when we queue up a scan; we
+first queue the worker, and then set priv->scan_req.  There's theoretically
+a 50mS delay which should be plenty, but doing things that way just seems
+racy (and not in the good way).
+
+The second is in the scan worker thread itself.  Depending on the state of
+priv->scan_channel, we cancel pending scan runs and then requeue a run in
+300mS.  We then send the scan command down to the hardware, sleep, and if
+we get scan results for all the desired channels, we set priv->scan_req to
+NULL.  However, it that's happened in less than 300mS, what happens with
+the pending scan run?
+
+This patch addresses both of those concerns.  With the patch applied, we
+have not seen the oops in the past two weeks.
+
+Signed-off-by: Andres Salomon <dilinger@queued.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/wireless/libertas/cfg.c |   10 ++++++----
+ 1 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
+index a7f1ab2..db64ef1 100644
+--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
+@@ -728,9 +728,11 @@ static void lbs_scan_worker(struct work_struct *work)
+ 		le16_to_cpu(scan_cmd->hdr.size),
+ 		lbs_ret_scan, 0);
+ 
+-	if (priv->scan_channel >= priv->scan_req->n_channels)
+	if (priv->scan_channel >= priv->scan_req->n_channels) {
+ 		/* Mark scan done */
+		cancel_delayed_work(&priv->scan_work);
+ 		lbs_scan_done(priv);
+	}
+ 
+ 	/* Restart network */
+ 	if (carrier)
+@@ -759,12 +761,12 @@ static void _internal_start_scan(struct lbs_private *priv, bool internal,
+ 		request->n_ssids, request->n_channels, request->ie_len);
+ 
+ 	priv->scan_channel = 0;
+-	queue_delayed_work(priv->work_thread, &priv->scan_work,
+-		msecs_to_jiffies(50));
+-
+ 	priv->scan_req = request;
+ 	priv->internal_scan = internal;
+ 
+	queue_delayed_work(priv->work_thread, &priv->scan_work,
+		msecs_to_jiffies(50));
+
+ 	lbs_deb_leave(LBS_DEB_CFG80211);
+ }
+ 
+-- 
+1.7.7.4
+
@@ -0,0 +1,120 @@
+From 84c0b10f18c54e0f669f9ac81872db6aff1e59b4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Fri, 9 Dec 2011 22:16:07 +0100
+Subject: [PATCH 08/49] bcma: support for suspend and resume
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 775ab52142b02237a54184238e922251c59a2b5c upstream.
+
+bcma used to lock up machine without enabling PCI or initializing CC.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/bcma/bcma_private.h |    3 +++
+ drivers/bcma/host_pci.c     |   37 +++++++++++++++++++++++++++++++++++++
+ drivers/bcma/main.c         |   16 ++++++++++++++++
+ 3 files changed, 56 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/bcma/bcma_private.h b/drivers/bcma/bcma_private.h
+index 30a3085..fda56bd 100644
+--- a/drivers/bcma/bcma_private.h
+++ b/drivers/bcma/bcma_private.h
+@@ -18,6 +18,9 @@ void bcma_bus_unregister(struct bcma_bus *bus);
+ int __init bcma_bus_early_register(struct bcma_bus *bus,
+ 				   struct bcma_device *core_cc,
+ 				   struct bcma_device *core_mips);
+#ifdef CONFIG_PM
+int bcma_bus_resume(struct bcma_bus *bus);
+#endif
+ 
+ /* scan.c */
+ int bcma_bus_scan(struct bcma_bus *bus);
+diff --git a/drivers/bcma/host_pci.c b/drivers/bcma/host_pci.c
+index 1b51d8b..990f5a8 100644
+--- a/drivers/bcma/host_pci.c
+++ b/drivers/bcma/host_pci.c
+@@ -224,6 +224,41 @@ static void bcma_host_pci_remove(struct pci_dev *dev)
+ 	pci_set_drvdata(dev, NULL);
+ }
+ 
+#ifdef CONFIG_PM
+static int bcma_host_pci_suspend(struct pci_dev *dev, pm_message_t state)
+{
+	/* Host specific */
+	pci_save_state(dev);
+	pci_disable_device(dev);
+	pci_set_power_state(dev, pci_choose_state(dev, state));
+
+	return 0;
+}
+
+static int bcma_host_pci_resume(struct pci_dev *dev)
+{
+	struct bcma_bus *bus = pci_get_drvdata(dev);
+	int err;
+
+	/* Host specific */
+	pci_set_power_state(dev, 0);
+	err = pci_enable_device(dev);
+	if (err)
+		return err;
+	pci_restore_state(dev);
+
+	/* Bus specific */
+	err = bcma_bus_resume(bus);
+	if (err)
+		return err;
+
+	return 0;
+}
+#else /* CONFIG_PM */
+# define bcma_host_pci_suspend	NULL
+# define bcma_host_pci_resume	NULL
+#endif /* CONFIG_PM */
+
+ static DEFINE_PCI_DEVICE_TABLE(bcma_pci_bridge_tbl) = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x0576) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4331) },
+@@ -239,6 +274,8 @@ static struct pci_driver bcma_pci_bridge_driver = {
+ 	.id_table = bcma_pci_bridge_tbl,
+ 	.probe = bcma_host_pci_probe,
+ 	.remove = bcma_host_pci_remove,
+	.suspend = bcma_host_pci_suspend,
+	.resume = bcma_host_pci_resume,
+ };
+ 
+ int __init bcma_host_pci_init(void)
+diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
+index 70c84b9..10f92b3 100644
+--- a/drivers/bcma/main.c
+++ b/drivers/bcma/main.c
+@@ -240,6 +240,22 @@ int __init bcma_bus_early_register(struct bcma_bus *bus,
+ 	return 0;
+ }
+ 
+#ifdef CONFIG_PM
+int bcma_bus_resume(struct bcma_bus *bus)
+{
+	struct bcma_device *core;
+
+	/* Init CC core */
+	core = bcma_find_core(bus, BCMA_CORE_CHIPCOMMON);
+	if (core) {
+		bus->drv_cc.setup_done = false;
+		bcma_core_chipcommon_init(&bus->drv_cc);
+	}
+
+	return 0;
+}
+#endif
+
+ int __bcma_driver_register(struct bcma_driver *drv, struct module *owner)
+ {
+ 	drv->drv.name = drv->name;
+-- 
+1.7.7.4
+
@@ -0,0 +1,75 @@
+From aa9c7fd565d04120156ef720235e9a759638606a Mon Sep 17 00:00:00 2001
+From: Pontus Fuchs <pontus.fuchs@gmail.com>
+Date: Tue, 18 Oct 2011 09:23:41 +0200
+Subject: [PATCH 09/49] wl12xx: Validate FEM index from ini file and FW
+
+commit 2131d3c2f99b081806fdae7662c92fe6acda52af upstream.
+
+Check for out of bound FEM index to prevent reading beyond ini
+memory end.
+
+Signed-off-by: Pontus Fuchs <pontus.fuchs@gmail.com>
+Reviewed-by: Luciano Coelho <coelho@ti.com>
+Signed-off-by: Luciano Coelho <coelho@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/wireless/wl12xx/cmd.c |   22 ++++++++++++++++++++++
+ 1 files changed, 22 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/wireless/wl12xx/cmd.c b/drivers/net/wireless/wl12xx/cmd.c
+index a52299e..54a0d66 100644
+--- a/drivers/net/wireless/wl12xx/cmd.c
+++ b/drivers/net/wireless/wl12xx/cmd.c
+@@ -120,6 +120,11 @@ int wl1271_cmd_general_parms(struct wl1271 *wl)
+ 	if (!wl->nvs)
+ 		return -ENODEV;
+ 
+	if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
+		wl1271_warning("FEM index from INI out of bounds");
+		return -EINVAL;
+	}
+
+ 	gen_parms = kzalloc(sizeof(*gen_parms), GFP_KERNEL);
+ 	if (!gen_parms)
+ 		return -ENOMEM;
+@@ -143,6 +148,12 @@ int wl1271_cmd_general_parms(struct wl1271 *wl)
+ 	gp->tx_bip_fem_manufacturer =
+ 		gen_parms->general_params.tx_bip_fem_manufacturer;
+ 
+	if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
+		wl1271_warning("FEM index from FW out of bounds");
+		ret = -EINVAL;
+		goto out;
+	}
+
+ 	wl1271_debug(DEBUG_CMD, "FEM autodetect: %s, manufacturer: %d\n",
+ 		     answer ? "auto" : "manual", gp->tx_bip_fem_manufacturer);
+ 
+@@ -162,6 +173,11 @@ int wl128x_cmd_general_parms(struct wl1271 *wl)
+ 	if (!wl->nvs)
+ 		return -ENODEV;
+ 
+	if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
+		wl1271_warning("FEM index from ini out of bounds");
+		return -EINVAL;
+	}
+
+ 	gen_parms = kzalloc(sizeof(*gen_parms), GFP_KERNEL);
+ 	if (!gen_parms)
+ 		return -ENOMEM;
+@@ -186,6 +202,12 @@ int wl128x_cmd_general_parms(struct wl1271 *wl)
+ 	gp->tx_bip_fem_manufacturer =
+ 		gen_parms->general_params.tx_bip_fem_manufacturer;
+ 
+	if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
+		wl1271_warning("FEM index from FW out of bounds");
+		ret = -EINVAL;
+		goto out;
+	}
+
+ 	wl1271_debug(DEBUG_CMD, "FEM autodetect: %s, manufacturer: %d\n",
+ 		     answer ? "auto" : "manual", gp->tx_bip_fem_manufacturer);
+ 
+-- 
+1.7.7.4
+
@@ -0,0 +1,68 @@
+From bcd7880977c293b60ae6dbae4264d6c47be08fb9 Mon Sep 17 00:00:00 2001
+From: Pontus Fuchs <pontus.fuchs@gmail.com>
+Date: Tue, 18 Oct 2011 09:23:42 +0200
+Subject: [PATCH 10/49] wl12xx: Check buffer bound when processing nvs data
+
+commit f6efe96edd9c41c624c8f4ddbc4930c1a2d8f1e1 upstream.
+
+An nvs with malformed contents could cause the processing of the
+calibration data to read beyond the end of the buffer. Prevent this
+from happening by adding bound checking.
+
+Signed-off-by: Pontus Fuchs <pontus.fuchs@gmail.com>
+Reviewed-by: Luciano Coelho <coelho@ti.com>
+Signed-off-by: Luciano Coelho <coelho@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/wireless/wl12xx/boot.c |   14 ++++++++++++++
+ 1 files changed, 14 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/wireless/wl12xx/boot.c b/drivers/net/wireless/wl12xx/boot.c
+index 6813379..a7b327d 100644
+--- a/drivers/net/wireless/wl12xx/boot.c
+++ b/drivers/net/wireless/wl12xx/boot.c
+@@ -347,6 +347,9 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
+ 		nvs_ptr += 3;
+ 
+ 		for (i = 0; i < burst_len; i++) {
+			if (nvs_ptr + 3 >= (u8 *) wl->nvs + nvs_len)
+				goto out_badnvs;
+
+ 			val = (nvs_ptr[0] | (nvs_ptr[1] << 8)
+ 			       | (nvs_ptr[2] << 16) | (nvs_ptr[3] << 24));
+ 
+@@ -358,6 +361,9 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
+ 			nvs_ptr += 4;
+ 			dest_addr += 4;
+ 		}
+
+		if (nvs_ptr >= (u8 *) wl->nvs + nvs_len)
+			goto out_badnvs;
+ 	}
+ 
+ 	/*
+@@ -369,6 +375,10 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
+ 	 */
+ 	nvs_ptr = (u8 *)wl->nvs +
+ 			ALIGN(nvs_ptr - (u8 *)wl->nvs + 7, 4);
+
+	if (nvs_ptr >= (u8 *) wl->nvs + nvs_len)
+		goto out_badnvs;
+
+ 	nvs_len -= nvs_ptr - (u8 *)wl->nvs;
+ 
+ 	/* Now we must set the partition correctly */
+@@ -384,6 +394,10 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
+ 
+ 	kfree(nvs_aligned);
+ 	return 0;
+
+out_badnvs:
+	wl1271_error("nvs data is malformed");
+	return -EILSEQ;
+ }
+ 
+ static void wl1271_boot_enable_interrupts(struct wl1271 *wl)
+-- 
+1.7.7.4
+
@@ -0,0 +1,32 @@
+From 78848b4805314cdbf6c342b8315cdf7db2a1d09e Mon Sep 17 00:00:00 2001
+From: Pontus Fuchs <pontus.fuchs@gmail.com>
+Date: Thu, 1 Dec 2011 12:13:44 +0100
+Subject: [PATCH 11/49] wl12xx: Restore testmode ABI
+
+commit 3f1764945eaac532c20ab1f23afa352a40f797b2 upstream.
+
+Commit 80900d0140a7648587982c8f299830e900e49165 accidently broke
+the ABI for testmode commands. Restore the ABI again.
+
+Signed-off-by: Pontus Fuchs <pontus.fuchs@gmail.com>
+Signed-off-by: Luciano Coelho <coelho@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/wireless/wl12xx/testmode.c |    1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/net/wireless/wl12xx/testmode.c b/drivers/net/wireless/wl12xx/testmode.c
+index 4ae8eff..abfb120 100644
+--- a/drivers/net/wireless/wl12xx/testmode.c
+++ b/drivers/net/wireless/wl12xx/testmode.c
+@@ -36,6 +36,7 @@ enum wl1271_tm_commands {
+ 	WL1271_TM_CMD_TEST,
+ 	WL1271_TM_CMD_INTERROGATE,
+ 	WL1271_TM_CMD_CONFIGURE,
+	WL1271_TM_CMD_NVS_PUSH,		/* Not in use. Keep to not break ABI */
+ 	WL1271_TM_CMD_SET_PLT_MODE,
+ 	WL1271_TM_CMD_RECOVER,
+ 
+-- 
+1.7.7.4
+
@@ -0,0 +1,93 @@
+From 9c146884a6b099ed8892c056e26eae85019bc2c9 Mon Sep 17 00:00:00 2001
+From: Anton Blanchard <anton@samba.org>
+Date: Wed, 23 Nov 2011 20:07:17 +0000
+Subject: [PATCH 12/49] powerpc/time: Handle wrapping of decrementer
+
+commit 37fb9a0231ee43d42d069863bdfd567fca2b61af upstream.
+
+When re-enabling interrupts we have code to handle edge sensitive
+decrementers by resetting the decrementer to 1 whenever it is negative.
+If interrupts were disabled long enough that the decrementer wrapped to
+positive we do nothing. This means interrupts can be delayed for a long
+time until it finally goes negative again.
+
+While we hope interrupts are never be disabled long enough for the
+decrementer to go positive, we have a very good test team that can
+drive any kernel into the ground. The softlockup data we get back
+from these fails could be seconds in the future, completely missing
+the cause of the lockup.
+
+We already keep track of the timebase of the next event so use that
+to work out if we should trigger a decrementer exception.
+
+Signed-off-by: Anton Blanchard <anton@samba.org>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/powerpc/include/asm/time.h |    2 ++
+ arch/powerpc/kernel/irq.c       |   15 ++++++---------
+ arch/powerpc/kernel/time.c      |    9 +++++++++
+ 3 files changed, 17 insertions(+), 9 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/time.h b/arch/powerpc/include/asm/time.h
+index fe6f7c2..bc3c745 100644
+--- a/arch/powerpc/include/asm/time.h
+++ b/arch/powerpc/include/asm/time.h
+@@ -219,5 +219,7 @@ DECLARE_PER_CPU(struct cpu_usage, cpu_usage_array);
+ extern void secondary_cpu_time_init(void);
+ extern void iSeries_time_init_early(void);
+ 
+extern void decrementer_check_overflow(void);
+
+ #endif /* __KERNEL__ */
+ #endif /* __POWERPC_TIME_H */
+diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
+index 5c3c469..745c1e7 100644
+--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
+@@ -164,16 +164,13 @@ notrace void arch_local_irq_restore(unsigned long en)
+ 	 */
+ 	local_paca->hard_enabled = en;
+ 
+-#ifndef CONFIG_BOOKE
+-	/* On server, re-trigger the decrementer if it went negative since
+-	 * some processors only trigger on edge transitions of the sign bit.
+-	 *
+-	 * BookE has a level sensitive decrementer (latches in TSR) so we
+-	 * don't need that
+	/*
+	 * Trigger the decrementer if we have a pending event. Some processors
+	 * only trigger on edge transitions of the sign bit. We might also
+	 * have disabled interrupts long enough that the decrementer wrapped
+	 * to positive.
+ 	 */
+-	if ((int)mfspr(SPRN_DEC) < 0)
+-		mtspr(SPRN_DEC, 1);
+-#endif /* CONFIG_BOOKE */
+	decrementer_check_overflow();
+ 
+ 	/*
+ 	 * Force the delivery of pending soft-disabled interrupts on PS3.
+diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
+index 522bb1d..5db163c 100644
+--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
+@@ -889,6 +889,15 @@ static void __init clocksource_init(void)
+ 	       clock->name, clock->mult, clock->shift);
+ }
+ 
+void decrementer_check_overflow(void)
+{
+	u64 now = get_tb_or_rtc();
+	struct decrementer_clock *decrementer = &__get_cpu_var(decrementers);
+
+	if (now >= decrementer->next_tb)
+		set_dec(1);
+}
+
+ static int decrementer_set_next_event(unsigned long evt,
+ 				      struct clock_event_device *dev)
+ {
+-- 
+1.7.7.4
+
@@ -0,0 +1,85 @@
+From 78f337d172aafe8577dab8044f26326850b6c5d0 Mon Sep 17 00:00:00 2001
+From: Li Zhong <zhong@linux.vnet.ibm.com>
+Date: Sun, 18 Dec 2011 16:03:04 +0000
+Subject: [PATCH 13/49] powerpc: Fix unpaired probe_hcall_entry and
+ probe_hcall_exit
+
+commit e4f387d8db3ba3c2dae4d8bdfe7bb5f4fe1bcb0d upstream.
+
+Unpaired calling of probe_hcall_entry and probe_hcall_exit might happen
+as following, which could cause incorrect preempt count.
+
+__trace_hcall_entry => trace_hcall_entry -> probe_hcall_entry =>
+get_cpu_var => preempt_disable
+
+__trace_hcall_exit => trace_hcall_exit -> probe_hcall_exit =>
+put_cpu_var => preempt_enable
+
+where:
+A => B and A -> B means A calls B, but
+=> means A will call B through function name, and B will definitely be
+called.
+-> means A will call B through function pointer, so B might not be
+called if the function pointer is not set.
+
+So error happens when only one of probe_hcall_entry and probe_hcall_exit
+get called during a hcall.
+
+This patch tries to move the preempt count operations from
+probe_hcall_entry and probe_hcall_exit to its callers.
+
+Reported-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Signed-off-by: Li Zhong <zhong@linux.vnet.ibm.com>
+Tested-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/powerpc/platforms/pseries/hvCall_inst.c |    4 +---
+ arch/powerpc/platforms/pseries/lpar.c        |    2 ++
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/platforms/pseries/hvCall_inst.c b/arch/powerpc/platforms/pseries/hvCall_inst.c
+index f106662..c9311cf 100644
+--- a/arch/powerpc/platforms/pseries/hvCall_inst.c
+++ b/arch/powerpc/platforms/pseries/hvCall_inst.c
+@@ -109,7 +109,7 @@ static void probe_hcall_entry(void *ignored, unsigned long opcode, unsigned long
+ 	if (opcode > MAX_HCALL_OPCODE)
+ 		return;
+ 
+-	h = &get_cpu_var(hcall_stats)[opcode / 4];
+	h = &__get_cpu_var(hcall_stats)[opcode / 4];
+ 	h->tb_start = mftb();
+ 	h->purr_start = mfspr(SPRN_PURR);
+ }
+@@ -126,8 +126,6 @@ static void probe_hcall_exit(void *ignored, unsigned long opcode, unsigned long
+ 	h->num_calls++;
+ 	h->tb_total += mftb() - h->tb_start;
+ 	h->purr_total += mfspr(SPRN_PURR) - h->purr_start;
+-
+-	put_cpu_var(hcall_stats);
+ }
+ 
+ static int __init hcall_inst_init(void)
+diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
+index 27a4950..dc36ea6 100644
+--- a/arch/powerpc/platforms/pseries/lpar.c
+++ b/arch/powerpc/platforms/pseries/lpar.c
+@@ -554,6 +554,7 @@ void __trace_hcall_entry(unsigned long opcode, unsigned long *args)
+ 		goto out;
+ 
+ 	(*depth)++;
+	preempt_disable();
+ 	trace_hcall_entry(opcode, args);
+ 	(*depth)--;
+ 
+@@ -576,6 +577,7 @@ void __trace_hcall_exit(long opcode, unsigned long retval,
+ 
+ 	(*depth)++;
+ 	trace_hcall_exit(opcode, retval, retbuf);
+	preempt_enable();
+ 	(*depth)--;
+ 
+ out:
+-- 
+1.7.7.4
+
@@ -0,0 +1,78 @@
+From 838487db8eb68ce5fa5417e9ea1333795f172523 Mon Sep 17 00:00:00 2001
+From: Ram Vepa <ram.vepa@qlogic.com>
+Date: Fri, 23 Dec 2011 08:01:43 -0500
+Subject: [PATCH 14/49] IB/qib: Fix a possible data corruption when receiving
+ packets
+
+commit eddfb675256f49d14e8c5763098afe3eb2c93701 upstream.
+
+Prevent a receive data corruption by ensuring that the write to update
+the rcvhdrheadn register to generate an interrupt is at the very end
+of the receive processing.
+
+Signed-off-by: Ramkrishna Vepa <ram.vepa@qlogic.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@qlogic.com>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/infiniband/hw/qib/qib_iba6120.c |    4 +++-
+ drivers/infiniband/hw/qib/qib_iba7220.c |    4 +++-
+ drivers/infiniband/hw/qib/qib_iba7322.c |    6 ++++--
+ 3 files changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/qib/qib_iba6120.c b/drivers/infiniband/hw/qib/qib_iba6120.c
+index 781a802..4f18e2d 100644
+--- a/drivers/infiniband/hw/qib/qib_iba6120.c
+++ b/drivers/infiniband/hw/qib/qib_iba6120.c
+@@ -2076,9 +2076,11 @@ static void qib_6120_config_ctxts(struct qib_devdata *dd)
+ static void qib_update_6120_usrhead(struct qib_ctxtdata *rcd, u64 hd,
+ 				    u32 updegr, u32 egrhd, u32 npkts)
+ {
+-	qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
+ 	if (updegr)
+ 		qib_write_ureg(rcd->dd, ur_rcvegrindexhead, egrhd, rcd->ctxt);
+	mmiowb();
+	qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
+	mmiowb();
+ }
+ 
+ static u32 qib_6120_hdrqempty(struct qib_ctxtdata *rcd)
+diff --git a/drivers/infiniband/hw/qib/qib_iba7220.c b/drivers/infiniband/hw/qib/qib_iba7220.c
+index 439d3c5..7ec4048 100644
+--- a/drivers/infiniband/hw/qib/qib_iba7220.c
+++ b/drivers/infiniband/hw/qib/qib_iba7220.c
+@@ -2725,9 +2725,11 @@ static int qib_7220_set_loopback(struct qib_pportdata *ppd, const char *what)
+ static void qib_update_7220_usrhead(struct qib_ctxtdata *rcd, u64 hd,
+ 				    u32 updegr, u32 egrhd, u32 npkts)
+ {
+-	qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
+ 	if (updegr)
+ 		qib_write_ureg(rcd->dd, ur_rcvegrindexhead, egrhd, rcd->ctxt);
+	mmiowb();
+	qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
+	mmiowb();
+ }
+ 
+ static u32 qib_7220_hdrqempty(struct qib_ctxtdata *rcd)
+diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
+index 1d58959..5a070e8 100644
+--- a/drivers/infiniband/hw/qib/qib_iba7322.c
+++ b/drivers/infiniband/hw/qib/qib_iba7322.c
+@@ -4082,10 +4082,12 @@ static void qib_update_7322_usrhead(struct qib_ctxtdata *rcd, u64 hd,
+ 	 */
+ 	if (hd >> IBA7322_HDRHEAD_PKTINT_SHIFT)
+ 		adjust_rcv_timeout(rcd, npkts);
+-	qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
+-	qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
+ 	if (updegr)
+ 		qib_write_ureg(rcd->dd, ur_rcvegrindexhead, egrhd, rcd->ctxt);
+	mmiowb();
+	qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
+	qib_write_ureg(rcd->dd, ur_rcvhdrhead, hd, rcd->ctxt);
+	mmiowb();
+ }
+ 
+ static u32 qib_7322_hdrqempty(struct qib_ctxtdata *rcd)
+-- 
+1.7.7.4
+
@@ -0,0 +1,96 @@
+From a2beea13ae4c2ffcaa7f0ddf94fde1246e2e6fc1 Mon Sep 17 00:00:00 2001
+From: Eli Cohen <eli@dev.mellanox.co.il>
+Date: Tue, 3 Jan 2012 20:36:48 -0800
+Subject: [PATCH 15/49] IB/uverbs: Protect QP multicast list
+
+commit e214a0fe2b382fa302c036ecd6e6ffe99e3b9875 upstream.
+
+Userspace verbs multicast attach/detach operations on a QP are done
+while holding the rwsem of the QP for reading.  That's not sufficient
+since a reader lock allows more than one reader to acquire the
+lock.  However, multicast attach/detach does list manipulation that
+can corrupt the list if multiple threads run in parallel.
+
+Fix this by acquiring the rwsem as a writer to serialize attach/detach
+operations.  Add idr_write_qp() and put_qp_write() to encapsulate
+this.
+
+This fixes oops seen when running applications that perform multicast
+joins/leaves.
+
+Reported by: Mike Dubman <miked@mellanox.com>
+Signed-off-by: Eli Cohen <eli@mellanox.com>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/infiniband/core/uverbs_cmd.c |   21 +++++++++++++++++----
+ 1 files changed, 17 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
+index 254f164..e3db8ef 100644
+--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
+@@ -241,11 +241,24 @@ static struct ib_qp *idr_read_qp(int qp_handle, struct ib_ucontext *context)
+ 	return idr_read_obj(&ib_uverbs_qp_idr, qp_handle, context, 0);
+ }
+ 
+static struct ib_qp *idr_write_qp(int qp_handle, struct ib_ucontext *context)
+{
+	struct ib_uobject *uobj;
+
+	uobj = idr_write_uobj(&ib_uverbs_qp_idr, qp_handle, context);
+	return uobj ? uobj->object : NULL;
+}
+
+ static void put_qp_read(struct ib_qp *qp)
+ {
+ 	put_uobj_read(qp->uobject);
+ }
+ 
+static void put_qp_write(struct ib_qp *qp)
+{
+	put_uobj_write(qp->uobject);
+}
+
+ static struct ib_srq *idr_read_srq(int srq_handle, struct ib_ucontext *context)
+ {
+ 	return idr_read_obj(&ib_uverbs_srq_idr, srq_handle, context, 0);
+@@ -2375,7 +2388,7 @@ ssize_t ib_uverbs_attach_mcast(struct ib_uverbs_file *file,
+ 	if (copy_from_user(&cmd, buf, sizeof cmd))
+ 		return -EFAULT;
+ 
+-	qp = idr_read_qp(cmd.qp_handle, file->ucontext);
+	qp = idr_write_qp(cmd.qp_handle, file->ucontext);
+ 	if (!qp)
+ 		return -EINVAL;
+ 
+@@ -2404,7 +2417,7 @@ ssize_t ib_uverbs_attach_mcast(struct ib_uverbs_file *file,
+ 		kfree(mcast);
+ 
+ out_put:
+-	put_qp_read(qp);
+	put_qp_write(qp);
+ 
+ 	return ret ? ret : in_len;
+ }
+@@ -2422,7 +2435,7 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file,
+ 	if (copy_from_user(&cmd, buf, sizeof cmd))
+ 		return -EFAULT;
+ 
+-	qp = idr_read_qp(cmd.qp_handle, file->ucontext);
+	qp = idr_write_qp(cmd.qp_handle, file->ucontext);
+ 	if (!qp)
+ 		return -EINVAL;
+ 
+@@ -2441,7 +2454,7 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file,
+ 		}
+ 
+ out_put:
+-	put_qp_read(qp);
+	put_qp_write(qp);
+ 
+ 	return ret ? ret : in_len;
+ }
+-- 
+1.7.7.4
+
@@ -0,0 +1,50 @@
+From 274a64cd739d2b5e33e6e2112f78c896b18849a9 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Fri, 2 Dec 2011 12:22:54 -0800
+Subject: [PATCH 16/49] iwlagn: fix TID use bug
+
+commit 9a215e40d70ae63762963ab3ccc7f31dd966dc6a upstream.
+
+The driver everywhere uses max TID count as 9,
+which is wrong, it should be 8.
+
+I think the reason it uses 9 here is off-by-one
+confusion by whoever wrote this. We do use the
+value IWL_MAX_TID_COUNT for "not QoS/no TID"
+but that is completely correct even if it is 8
+and not 9 since 0-7 are only valid.
+
+As a side effect, this fixes the following bug:
+
+ Open BA session requested for 00:23:cd:16:8a:7e tid 8
+ ------------[ cut here ]------------
+ kernel BUG at drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h:350!
+ ...
+
+when you do
+echo "tx start 8" > /sys/kernel/debug/ieee80211/*/*/*/*/agg_status
+
+Reported-by: Nikolay Martynov <mar.kolya@gmail.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/wireless/iwlwifi/iwl-commands.h |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
+index 69d5f85..8b9ff28 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
+@@ -809,7 +809,7 @@ struct iwl_qosparam_cmd {
+ #define	IWLAGN_STATION_COUNT	16
+ 
+ #define	IWL_INVALID_STATION 	255
+-#define IWL_MAX_TID_COUNT	9
+#define IWL_MAX_TID_COUNT	8
+ 
+ #define STA_FLG_TX_RATE_MSK		cpu_to_le32(1 << 2)
+ #define STA_FLG_PWR_SAVE_MSK		cpu_to_le32(1 << 8)
+-- 
+1.7.7.4
+
@@ -0,0 +1,180 @@
+From 8de3e18bbd1ec02914f9bf1517d2c3557c666314 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 19 Dec 2011 14:00:59 -0800
+Subject: [PATCH 17/49] iwlagn: fix (remove) use of PAGE_SIZE
+
+commit 106671369e6d046c0b3e1e72b18ad6dd9cb298b0 upstream.
+
+The ICT code erroneously uses PAGE_SIZE. The bug
+is that PAGE_SIZE isn't necessarily 4096, so on
+such platforms this code will not work correctly
+as we'll try to attempt to read an index in the
+table that the device never wrote, it always has
+4096-byte pages.
+
+Additionally, the manual alignment code here is
+unnecessary -- Documentation/DMA-API-HOWTO.txt
+states:
+  The cpu return address and the DMA bus master address are both
+  guaranteed to be aligned to the smallest PAGE_SIZE order which
+  is greater than or equal to the requested size.  This invariant
+  exists (for example) to guarantee that if you allocate a chunk
+  which is smaller than or equal to 64 kilobytes, the extent of the
+  buffer you receive will not cross a 64K boundary.
+
+Just use appropriate new constants and get rid of
+the alignment code.
+
+Cc: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h |    2 -
+ drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c  |   73 +++++++++------------
+ 2 files changed, 31 insertions(+), 44 deletions(-)
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h
+index 2b6756e..5c29281 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h
+@@ -219,9 +219,7 @@ struct iwl_trans_pcie {
+ 
+ 	/* INT ICT Table */
+ 	__le32 *ict_tbl;
+-	void *ict_tbl_vir;
+ 	dma_addr_t ict_tbl_dma;
+-	dma_addr_t aligned_ict_tbl_dma;
+ 	int ict_index;
+ 	u32 inta;
+ 	bool use_ict;
+diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
+index 374c68c..1920237 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
+@@ -1136,7 +1136,11 @@ void iwl_irq_tasklet(struct iwl_trans *trans)
+  * ICT functions
+  *
+  ******************************************************************************/
+-#define ICT_COUNT (PAGE_SIZE/sizeof(u32))
+
+/* a device (PCI-E) page is 4096 bytes long */
+#define ICT_SHIFT	12
+#define ICT_SIZE	(1 << ICT_SHIFT)
+#define ICT_COUNT	(ICT_SIZE / sizeof(u32))
+ 
+ /* Free dram table */
+ void iwl_free_isr_ict(struct iwl_trans *trans)
+@@ -1144,21 +1148,19 @@ void iwl_free_isr_ict(struct iwl_trans *trans)
+ 	struct iwl_trans_pcie *trans_pcie =
+ 		IWL_TRANS_GET_PCIE_TRANS(trans);
+ 
+-	if (trans_pcie->ict_tbl_vir) {
+-		dma_free_coherent(bus(trans)->dev,
+-				  (sizeof(u32) * ICT_COUNT) + PAGE_SIZE,
+-				  trans_pcie->ict_tbl_vir,
+	if (trans_pcie->ict_tbl) {
+		dma_free_coherent(bus(trans)->dev, ICT_SIZE,
+				  trans_pcie->ict_tbl,
+ 				  trans_pcie->ict_tbl_dma);
+-		trans_pcie->ict_tbl_vir = NULL;
+-		memset(&trans_pcie->ict_tbl_dma, 0,
+-			sizeof(trans_pcie->ict_tbl_dma));
+-		memset(&trans_pcie->aligned_ict_tbl_dma, 0,
+-			sizeof(trans_pcie->aligned_ict_tbl_dma));
+		trans_pcie->ict_tbl = NULL;
+		trans_pcie->ict_tbl_dma = 0;
+ 	}
+ }
+ 
+ 
+-/* allocate dram shared table it is a PAGE_SIZE aligned
+/*
+ * allocate dram shared table, it is an aligned memory
+ * block of ICT_SIZE.
+  * also reset all data related to ICT table interrupt.
+  */
+ int iwl_alloc_isr_ict(struct iwl_trans *trans)
+@@ -1166,36 +1168,26 @@ int iwl_alloc_isr_ict(struct iwl_trans *trans)
+ 	struct iwl_trans_pcie *trans_pcie =
+ 		IWL_TRANS_GET_PCIE_TRANS(trans);
+ 
+-	/* allocate shrared data table */
+-	trans_pcie->ict_tbl_vir =
+-		dma_alloc_coherent(bus(trans)->dev,
+-				   (sizeof(u32) * ICT_COUNT) + PAGE_SIZE,
+-				   &trans_pcie->ict_tbl_dma, GFP_KERNEL);
+-	if (!trans_pcie->ict_tbl_vir)
+	trans_pcie->ict_tbl =
+		dma_alloc_coherent(bus(trans)->dev, ICT_SIZE,
+				   &trans_pcie->ict_tbl_dma,
+				   GFP_KERNEL);
+	if (!trans_pcie->ict_tbl)
+ 		return -ENOMEM;
+ 
+-	/* align table to PAGE_SIZE boundary */
+-	trans_pcie->aligned_ict_tbl_dma =
+-		ALIGN(trans_pcie->ict_tbl_dma, PAGE_SIZE);
+-
+-	IWL_DEBUG_ISR(trans, "ict dma addr %Lx dma aligned %Lx diff %d\n",
+-			   (unsigned long long)trans_pcie->ict_tbl_dma,
+-			   (unsigned long long)trans_pcie->aligned_ict_tbl_dma,
+-			   (int)(trans_pcie->aligned_ict_tbl_dma -
+-			   trans_pcie->ict_tbl_dma));
+	/* just an API sanity check ... it is guaranteed to be aligned */
+	if (WARN_ON(trans_pcie->ict_tbl_dma & (ICT_SIZE - 1))) {
+		iwl_free_isr_ict(trans);
+		return -EINVAL;
+	}
+ 
+-	trans_pcie->ict_tbl =  trans_pcie->ict_tbl_vir +
+-			  (trans_pcie->aligned_ict_tbl_dma -
+-			  trans_pcie->ict_tbl_dma);
+	IWL_DEBUG_ISR(trans, "ict dma addr %Lx\n",
+		      (unsigned long long)trans_pcie->ict_tbl_dma);
+ 
+-	IWL_DEBUG_ISR(trans, "ict vir addr %p vir aligned %p diff %d\n",
+-			     trans_pcie->ict_tbl, trans_pcie->ict_tbl_vir,
+-			(int)(trans_pcie->aligned_ict_tbl_dma -
+-			    trans_pcie->ict_tbl_dma));
+	IWL_DEBUG_ISR(trans, "ict vir addr %p\n", trans_pcie->ict_tbl);
+ 
+ 	/* reset table and index to all 0 */
+-	memset(trans_pcie->ict_tbl_vir, 0,
+-		(sizeof(u32) * ICT_COUNT) + PAGE_SIZE);
+	memset(trans_pcie->ict_tbl, 0, ICT_SIZE);
+ 	trans_pcie->ict_index = 0;
+ 
+ 	/* add periodic RX interrupt */
+@@ -1213,23 +1205,20 @@ int iwl_reset_ict(struct iwl_trans *trans)
+ 	struct iwl_trans_pcie *trans_pcie =
+ 		IWL_TRANS_GET_PCIE_TRANS(trans);
+ 
+-	if (!trans_pcie->ict_tbl_vir)
+	if (!trans_pcie->ict_tbl)
+ 		return 0;
+ 
+ 	spin_lock_irqsave(&trans->shrd->lock, flags);
+ 	iwl_disable_interrupts(trans);
+ 
+-	memset(&trans_pcie->ict_tbl[0], 0, sizeof(u32) * ICT_COUNT);
+	memset(trans_pcie->ict_tbl, 0, ICT_SIZE);
+ 
+-	val = trans_pcie->aligned_ict_tbl_dma >> PAGE_SHIFT;
+	val = trans_pcie->ict_tbl_dma >> ICT_SHIFT;
+ 
+ 	val |= CSR_DRAM_INT_TBL_ENABLE;
+ 	val |= CSR_DRAM_INIT_TBL_WRAP_CHECK;
+ 
+-	IWL_DEBUG_ISR(trans, "CSR_DRAM_INT_TBL_REG =0x%X "
+-			"aligned dma address %Lx\n",
+-			val,
+-			(unsigned long long)trans_pcie->aligned_ict_tbl_dma);
+	IWL_DEBUG_ISR(trans, "CSR_DRAM_INT_TBL_REG =0x%x\n", val);
+ 
+ 	iwl_write32(bus(trans), CSR_DRAM_INT_TBL_REG, val);
+ 	trans_pcie->use_ict = true;
+-- 
+1.7.7.4
+
@@ -0,0 +1,37 @@
+From 3d69705bbc0503baa930a277c3570ccdc2b82ac1 Mon Sep 17 00:00:00 2001
+From: Steven Rostedt <srostedt@redhat.com>
+Date: Fri, 4 Nov 2011 16:32:25 -0400
+Subject: [PATCH 18/49] perf: Fix parsing of __print_flags() in TP_printk()
+
+commit 49908a1b25d448d68fd26faca260e1850201575f upstream.
+
+A update is made to the sched:sched_switch event that adds some
+logic to the first parameter of the __print_flags() that shows the
+state of tasks. This change cause perf to fail parsing the flags.
+
+A simple fix is needed to have the parser be able to process ops
+within the argument.
+
+Reported-by: Andrew Vagin <avagin@openvz.org>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ tools/perf/util/trace-event-parse.c |    2 ++
+ 1 files changed, 2 insertions(+), 0 deletions(-)
+
+diff --git a/tools/perf/util/trace-event-parse.c b/tools/perf/util/trace-event-parse.c
+index 6c164dc..bf54c48 100644
+--- a/tools/perf/util/trace-event-parse.c
+++ b/tools/perf/util/trace-event-parse.c
+@@ -1582,6 +1582,8 @@ process_symbols(struct event *event, struct print_arg *arg, char **tok)
+ 	field = malloc_or_die(sizeof(*field));
+ 
+ 	type = process_arg(event, field, &token);
+	while (type == EVENT_OP)
+		type = process_op(event, field, &token);
+ 	if (test_type_token(type, token, EVENT_DELIM, ","))
+ 		goto out_free;
+ 
+-- 
+1.7.7.4
+
@@ -0,0 +1,41 @@
+From b892a813649b593177f4b36c200691ec7b610af7 Mon Sep 17 00:00:00 2001
+From: Boaz Harrosh <bharrosh@panasas.com>
+Date: Tue, 27 Dec 2011 19:23:36 +0200
+Subject: [PATCH 19/49] ore: Fix crash in case of an IO error.
+
+commit ffefb8eaa367e8a5c14f779233d9da1fbc23d164 upstream.
+
+The users of ore_check_io() expect the reported device
+(In case of error) to be indexed relative to the passed-in
+ore_components table, and not the logical dev index.
+
+This causes a crash inside objlayoutdriver in case of
+an IO error.
+
+Signed-off-by: Boaz Harrosh <bharrosh@panasas.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/exofs/ore.c |    6 +++---
+ 1 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/exofs/ore.c b/fs/exofs/ore.c
+index d271ad8..894f3e1 100644
+--- a/fs/exofs/ore.c
+++ b/fs/exofs/ore.c
+@@ -445,10 +445,10 @@ int ore_check_io(struct ore_io_state *ios, ore_on_dev_error on_dev_error)
+ 			u64 residual = ios->reading ?
+ 					or->in.residual : or->out.residual;
+ 			u64 offset = (ios->offset + ios->length) - residual;
+-			struct ore_dev *od = ios->oc->ods[
+-					per_dev->dev - ios->oc->first_dev];
+			unsigned dev = per_dev->dev - ios->oc->first_dev;
+			struct ore_dev *od = ios->oc->ods[dev];
+ 
+-			on_dev_error(ios, od, per_dev->dev, osi.osd_err_pri,
+			on_dev_error(ios, od, dev, osi.osd_err_pri,
+ 				     offset, residual);
+ 		}
+ 		if (osi.osd_err_pri >= acumulated_osd_err) {
+-- 
+1.7.7.4
+
@@ -0,0 +1,56 @@
+From 3c8f1a35fab7418f9afeda2618992c1fd5504475 Mon Sep 17 00:00:00 2001
+From: Boaz Harrosh <bharrosh@panasas.com>
+Date: Wed, 28 Dec 2011 19:14:23 +0200
+Subject: [PATCH 20/49] ore: fix BUG_ON, too few sgs when reading
+
+commit 361aba569f55dd159b850489a3538253afbb3973 upstream.
+
+When reading RAID5 files, in rare cases, we calculated too
+few sg segments. There should be two extra for the beginning
+and end partial units.
+
+Also "too few sg segments" should not be a BUG_ON there is
+all the mechanics in place to handle it, as a short read.
+So just return -ENOMEM and the rest of the code will gracefully
+split the IO.
+
+Signed-off-by: Boaz Harrosh <bharrosh@panasas.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/exofs/ore.c      |    2 +-
+ fs/exofs/ore_raid.c |    6 +++++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/fs/exofs/ore.c b/fs/exofs/ore.c
+index 894f3e1..49cf230 100644
+--- a/fs/exofs/ore.c
+++ b/fs/exofs/ore.c
+@@ -266,7 +266,7 @@ int  ore_get_rw_state(struct ore_layout *layout, struct ore_components *oc,
+ 
+ 			/* first/last seg is split */
+ 			num_raid_units += layout->group_width;
+-			sgs_per_dev = div_u64(num_raid_units, data_devs);
+			sgs_per_dev = div_u64(num_raid_units, data_devs) + 2;
+ 		} else {
+ 			/* For Writes add parity pages array. */
+ 			max_par_pages = num_raid_units * pages_in_unit *
+diff --git a/fs/exofs/ore_raid.c b/fs/exofs/ore_raid.c
+index 29c47e5..414a2df 100644
+--- a/fs/exofs/ore_raid.c
+++ b/fs/exofs/ore_raid.c
+@@ -551,7 +551,11 @@ int _ore_add_parity_unit(struct ore_io_state *ios,
+ 			    unsigned cur_len)
+ {
+ 	if (ios->reading) {
+-		BUG_ON(per_dev->cur_sg >= ios->sgs_per_dev);
+		if (per_dev->cur_sg >= ios->sgs_per_dev) {
+			ORE_DBGMSG("cur_sg(%d) >= sgs_per_dev(%d)\n" ,
+				per_dev->cur_sg, ios->sgs_per_dev);
+			return -ENOMEM;
+		}
+ 		_ore_add_sg_seg(per_dev, cur_len, true);
+ 	} else {
+ 		struct __stripe_pages_2d *sp2d = ios->sp2d;
+-- 
+1.7.7.4
+
@@ -0,0 +1,163 @@
+From f3db3efc229dac1097a71b9d793d61aefb033ac2 Mon Sep 17 00:00:00 2001
+From: Boaz Harrosh <bharrosh@panasas.com>
+Date: Wed, 28 Dec 2011 19:21:45 +0200
+Subject: [PATCH 21/49] ore: Must support none-PAGE-aligned IO
+
+commit 724577ca355795b0a25c93ccbeee927871ca1a77 upstream.
+
+NFS might send us offsets that are not PAGE aligned. So
+we must read in the reminder of the first/last pages, in cases
+we need it for Parity calculations.
+
+We only add an sg segments to read the partial page. But
+we don't mark it as read=true because it is a lock-for-write
+page.
+
+TODO: In some cases (IO spans a single unit) we can just
+adjust the raid_unit offset/length, but this is left for
+later Kernels.
+
+Signed-off-by: Boaz Harrosh <bharrosh@panasas.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/exofs/ore_raid.c |   72 ++++++++++++++++++++++++++++++++++++++++++--------
+ 1 files changed, 60 insertions(+), 12 deletions(-)
+
+diff --git a/fs/exofs/ore_raid.c b/fs/exofs/ore_raid.c
+index 414a2df..d222c77 100644
+--- a/fs/exofs/ore_raid.c
+++ b/fs/exofs/ore_raid.c
+@@ -328,8 +328,8 @@ static int _alloc_read_4_write(struct ore_io_state *ios)
+ /* @si contains info of the to-be-inserted page. Update of @si should be
+  * maintained by caller. Specificaly si->dev, si->obj_offset, ...
+  */
+-static int _add_to_read_4_write(struct ore_io_state *ios,
+-				struct ore_striping_info *si, struct page *page)
+static int _add_to_r4w(struct ore_io_state *ios, struct ore_striping_info *si,
+		       struct page *page, unsigned pg_len)
+ {
+ 	struct request_queue *q;
+ 	struct ore_per_dev_state *per_dev;
+@@ -366,17 +366,60 @@ static int _add_to_read_4_write(struct ore_io_state *ios,
+ 		_ore_add_sg_seg(per_dev, gap, true);
+ 	}
+ 	q = osd_request_queue(ore_comp_dev(read_ios->oc, per_dev->dev));
+-	added_len = bio_add_pc_page(q, per_dev->bio, page, PAGE_SIZE, 0);
+-	if (unlikely(added_len != PAGE_SIZE)) {
+	added_len = bio_add_pc_page(q, per_dev->bio, page, pg_len,
+				    si->obj_offset % PAGE_SIZE);
+	if (unlikely(added_len != pg_len)) {
+ 		ORE_DBGMSG("Failed to bio_add_pc_page bi_vcnt=%d\n",
+ 			      per_dev->bio->bi_vcnt);
+ 		return -ENOMEM;
+ 	}
+ 
+-	per_dev->length += PAGE_SIZE;
+	per_dev->length += pg_len;
+ 	return 0;
+ }
+ 
+/* read the beginning of an unaligned first page */
+static int _add_to_r4w_first_page(struct ore_io_state *ios, struct page *page)
+{
+	struct ore_striping_info si;
+	unsigned pg_len;
+
+	ore_calc_stripe_info(ios->layout, ios->offset, 0, &si);
+
+	pg_len = si.obj_offset % PAGE_SIZE;
+	si.obj_offset -= pg_len;
+
+	ORE_DBGMSG("offset=0x%llx len=0x%x index=0x%lx dev=%x\n",
+		   _LLU(si.obj_offset), pg_len, page->index, si.dev);
+
+	return _add_to_r4w(ios, &si, page, pg_len);
+}
+
+/* read the end of an incomplete last page */
+static int _add_to_r4w_last_page(struct ore_io_state *ios, u64 *offset)
+{
+	struct ore_striping_info si;
+	struct page *page;
+	unsigned pg_len, p, c;
+
+	ore_calc_stripe_info(ios->layout, *offset, 0, &si);
+
+	p = si.unit_off / PAGE_SIZE;
+	c = _dev_order(ios->layout->group_width * ios->layout->mirrors_p1,
+		       ios->layout->mirrors_p1, si.par_dev, si.dev);
+	page = ios->sp2d->_1p_stripes[p].pages[c];
+
+	pg_len = PAGE_SIZE - (si.unit_off % PAGE_SIZE);
+	*offset += pg_len;
+
+	ORE_DBGMSG("p=%d, c=%d next-offset=0x%llx len=0x%x dev=%x par_dev=%d\n",
+		   p, c, _LLU(*offset), pg_len, si.dev, si.par_dev);
+
+	BUG_ON(!page);
+
+	return _add_to_r4w(ios, &si, page, pg_len);
+}
+
+ static void _mark_read4write_pages_uptodate(struct ore_io_state *ios, int ret)
+ {
+ 	struct bio_vec *bv;
+@@ -444,9 +487,13 @@ static int _read_4_write(struct ore_io_state *ios)
+ 			struct page **pp = &_1ps->pages[c];
+ 			bool uptodate;
+ 
+-			if (*pp)
+			if (*pp) {
+				if (ios->offset % PAGE_SIZE)
+					/* Read the remainder of the page */
+					_add_to_r4w_first_page(ios, *pp);
+ 				/* to-be-written pages start here */
+ 				goto read_last_stripe;
+			}
+ 
+ 			*pp = ios->r4w->get_page(ios->private, offset,
+ 						 &uptodate);
+@@ -454,7 +501,7 @@ static int _read_4_write(struct ore_io_state *ios)
+ 				return -ENOMEM;
+ 
+ 			if (!uptodate)
+-				_add_to_read_4_write(ios, &read_si, *pp);
+				_add_to_r4w(ios, &read_si, *pp, PAGE_SIZE);
+ 
+ 			/* Mark read-pages to be cache_released */
+ 			_1ps->page_is_read[c] = true;
+@@ -465,8 +512,11 @@ static int _read_4_write(struct ore_io_state *ios)
+ 	}
+ 
+ read_last_stripe:
+-	offset = ios->offset + (ios->length + PAGE_SIZE - 1) /
+-				PAGE_SIZE * PAGE_SIZE;
+	offset = ios->offset + ios->length;
+	if (offset % PAGE_SIZE)
+		_add_to_r4w_last_page(ios, &offset);
+		/* offset will be aligned to next page */
+
+ 	last_stripe_end = div_u64(offset + bytes_in_stripe - 1, bytes_in_stripe)
+ 				 * bytes_in_stripe;
+ 	if (offset == last_stripe_end) /* Optimize for the aligned case */
+@@ -503,7 +553,7 @@ read_last_stripe:
+ 			/* Mark read-pages to be cache_released */
+ 			_1ps->page_is_read[c] = true;
+ 			if (!uptodate)
+-				_add_to_read_4_write(ios, &read_si, page);
+				_add_to_r4w(ios, &read_si, page, PAGE_SIZE);
+ 		}
+ 
+ 		offset += PAGE_SIZE;
+@@ -616,8 +666,6 @@ int _ore_post_alloc_raid_stuff(struct ore_io_state *ios)
+ 			return -ENOMEM;
+ 		}
+ 
+-		BUG_ON(ios->offset % PAGE_SIZE);
+-
+ 		/* Round io down to last full strip */
+ 		first_stripe = div_u64(ios->offset, stripe_size);
+ 		last_stripe = div_u64(ios->offset + ios->length, stripe_size);
+-- 
+1.7.7.4
+
@@ -0,0 +1,89 @@
+From db0889eb6584510c3e1d860bfcfc7a85efc6fabe Mon Sep 17 00:00:00 2001
+From: Boaz Harrosh <bharrosh@panasas.com>
+Date: Tue, 29 Nov 2011 15:35:53 -0800
+Subject: [PATCH 22/49] ore: FIX breakage when MISC_FILESYSTEMS is not set
+
+commit 831c2dc5f47c1dc79c32229d75065ada1dcc66e1 upstream.
+
+As Reported by Randy Dunlap
+
+When MISC_FILESYSTEMS is not enabled and NFS4.1 is:
+
+fs/built-in.o: In function `objio_alloc_io_state':
+objio_osd.c:(.text+0xcb525): undefined reference to `ore_get_rw_state'
+fs/built-in.o: In function `_write_done':
+objio_osd.c:(.text+0xcb58d): undefined reference to `ore_check_io'
+fs/built-in.o: In function `_read_done':
+...
+
+When MISC_FILESYSTEMS, which is more of a GUI thing then anything else,
+is not selected. exofs/Kconfig is never examined during Kconfig,
+and it can not do it's magic stuff to automatically select everything
+needed.
+
+We must split exofs/Kconfig in two. The ore one is always included.
+And the exofs one is left in it's old place in the menu.
+
+Reported-by: Randy Dunlap <rdunlap@xenotime.net>
+Signed-off-by: Boaz Harrosh <bharrosh@panasas.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/Kconfig           |    2 ++
+ fs/exofs/Kconfig     |   11 -----------
+ fs/exofs/Kconfig.ore |   12 ++++++++++++
+ 3 files changed, 14 insertions(+), 11 deletions(-)
+ create mode 100644 fs/exofs/Kconfig.ore
+
+diff --git a/fs/Kconfig b/fs/Kconfig
+index 5f4c45d..6ad58a5 100644
+--- a/fs/Kconfig
+++ b/fs/Kconfig
+@@ -218,6 +218,8 @@ source "fs/exofs/Kconfig"
+ 
+ endif # MISC_FILESYSTEMS
+ 
+source "fs/exofs/Kconfig.ore"
+
+ menuconfig NETWORK_FILESYSTEMS
+ 	bool "Network File Systems"
+ 	default y
+diff --git a/fs/exofs/Kconfig b/fs/exofs/Kconfig
+index da42f32..86194b2 100644
+--- a/fs/exofs/Kconfig
+++ b/fs/exofs/Kconfig
+@@ -1,14 +1,3 @@
+-# Note ORE needs to "select ASYNC_XOR". So Not to force multiple selects
+-# for every ORE user we do it like this. Any user should add itself here
+-# at the "depends on EXOFS_FS || ..." with an ||. The dependencies are
+-# selected here, and we default to "ON". So in effect it is like been
+-# selected by any of the users.
+-config ORE
+-	tristate
+-	depends on EXOFS_FS || PNFS_OBJLAYOUT
+-	select ASYNC_XOR
+-	default SCSI_OSD_ULD
+-
+ config EXOFS_FS
+ 	tristate "exofs: OSD based file system support"
+ 	depends on SCSI_OSD_ULD
+diff --git a/fs/exofs/Kconfig.ore b/fs/exofs/Kconfig.ore
+new file mode 100644
+index 0000000..1ca7fb7
+--- /dev/null
+++ b/fs/exofs/Kconfig.ore
+@@ -0,0 +1,12 @@
+# ORE - Objects Raid Engine (libore.ko)
+#
+# Note ORE needs to "select ASYNC_XOR". So Not to force multiple selects
+# for every ORE user we do it like this. Any user should add itself here
+# at the "depends on EXOFS_FS || ..." with an ||. The dependencies are
+# selected here, and we default to "ON". So in effect it is like been
+# selected by any of the users.
+config ORE
+	tristate
+	depends on EXOFS_FS || PNFS_OBJLAYOUT
+	select ASYNC_XOR
+	default SCSI_OSD_ULD
+-- 
+1.7.7.4
+
@@ -0,0 +1,34 @@
+From 914681dc085b7bdeae0de64fba94532a6bcd093e Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Wed, 21 Dec 2011 17:35:34 +0100
+Subject: [PATCH 23/49] reiserfs: Fix quota mount option parsing
+
+commit a06d789b424190e9f59da391681f908486db2554 upstream.
+
+When jqfmt mount option is not specified on remount, we mistakenly clear
+s_jquota_fmt value stored in superblock. Fix the problem.
+
+CC: reiserfs-devel@vger.kernel.org
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/reiserfs/super.c |    3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
+index 14363b9..f9eaa4a 100644
+--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
+@@ -1164,7 +1164,8 @@ static void handle_quota_files(struct super_block *s, char **qf_names,
+ 			kfree(REISERFS_SB(s)->s_qf_names[i]);
+ 		REISERFS_SB(s)->s_qf_names[i] = qf_names[i];
+ 	}
+-	REISERFS_SB(s)->s_jquota_fmt = *qfmt;
+	if (*qfmt)
+		REISERFS_SB(s)->s_jquota_fmt = *qfmt;
+ }
+ #endif
+ 
+-- 
+1.7.7.4
+
@@ -0,0 +1,70 @@
+From 0621050323cd3eef6fe27f168151e8823a6f63dd Mon Sep 17 00:00:00 2001
+From: Jeff Mahoney <jeffm@suse.com>
+Date: Wed, 21 Dec 2011 21:18:43 +0100
+Subject: [PATCH 24/49] reiserfs: Force inode evictions before umount to avoid
+ crash
+
+commit a9e36da655e54545c3289b2a0700b5c443de0edd upstream.
+
+This patch fixes a crash in reiserfs_delete_xattrs during umount.
+
+When shrink_dcache_for_umount clears the dcache from
+generic_shutdown_super, delayed evictions are forced to disk. If an
+evicted inode has extended attributes associated with it, it will
+need to walk the xattr tree to locate and remove them.
+
+But since shrink_dcache_for_umount will BUG if it encounters active
+dentries, the xattr tree must be released before it's called or it will
+crash during every umount.
+
+This patch forces the evictions to occur before generic_shutdown_super
+by calling shrink_dcache_sb first. The additional evictions caused
+by the removal of each associated xattr file and dir will be automatically
+handled as they're added to the LRU list.
+
+CC: reiserfs-devel@vger.kernel.org
+Signed-off-by: Jeff Mahoney <jeffm@suse.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/reiserfs/super.c |   24 ++++++++++++++----------
+ 1 files changed, 14 insertions(+), 10 deletions(-)
+
+diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
+index f9eaa4a..5e3527b 100644
+--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
+@@ -453,16 +453,20 @@ int remove_save_link(struct inode *inode, int truncate)
+ static void reiserfs_kill_sb(struct super_block *s)
+ {
+ 	if (REISERFS_SB(s)) {
+-		if (REISERFS_SB(s)->xattr_root) {
+-			d_invalidate(REISERFS_SB(s)->xattr_root);
+-			dput(REISERFS_SB(s)->xattr_root);
+-			REISERFS_SB(s)->xattr_root = NULL;
+-		}
+-		if (REISERFS_SB(s)->priv_root) {
+-			d_invalidate(REISERFS_SB(s)->priv_root);
+-			dput(REISERFS_SB(s)->priv_root);
+-			REISERFS_SB(s)->priv_root = NULL;
+-		}
+		/*
+		 * Force any pending inode evictions to occur now. Any
+		 * inodes to be removed that have extended attributes
+		 * associated with them need to clean them up before
+		 * we can release the extended attribute root dentries.
+		 * shrink_dcache_for_umount will BUG if we don't release
+		 * those before it's called so ->put_super is too late.
+		 */
+		shrink_dcache_sb(s);
+
+		dput(REISERFS_SB(s)->xattr_root);
+		REISERFS_SB(s)->xattr_root = NULL;
+		dput(REISERFS_SB(s)->priv_root);
+		REISERFS_SB(s)->priv_root = NULL;
+ 	}
+ 
+ 	kill_block_super(s);
+-- 
+1.7.7.4
+
@@ -0,0 +1,73 @@
+From d6bc098d6daabceca79a299bfe95dfe218661423 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Thu, 22 Dec 2011 16:49:05 +0100
+Subject: [PATCH 25/49] ext3: Don't warn from writepage when readonly inode is
+ spotted after error
+
+commit 33c104d415e92a51aaf638dc3d93920cfa601e5c upstream.
+
+WARN_ON_ONCE(IS_RDONLY(inode)) tends to trip when filesystem hits error and is
+remounted read-only. This unnecessarily scares users (well, they should be
+scared because of filesystem error, but the stack trace distracts them from the
+right source of their fear ;-). We could as well just remove the WARN_ON but
+it's not hard to fix it to not trip on filesystem with errors and not use more
+cycles in the common case so that's what we do.
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/ext3/inode.c |   24 +++++++++++++++++++++---
+ 1 files changed, 21 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
+index 85fe655..5b3f907 100644
+--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
+@@ -1617,7 +1617,13 @@ static int ext3_ordered_writepage(struct page *page,
+ 	int err;
+ 
+ 	J_ASSERT(PageLocked(page));
+-	WARN_ON_ONCE(IS_RDONLY(inode));
+	/*
+	 * We don't want to warn for emergency remount. The condition is
+	 * ordered to avoid dereferencing inode->i_sb in non-error case to
+	 * avoid slow-downs.
+	 */
+	WARN_ON_ONCE(IS_RDONLY(inode) &&
+		     !(EXT3_SB(inode->i_sb)->s_mount_state & EXT3_ERROR_FS));
+ 
+ 	/*
+ 	 * We give up here if we're reentered, because it might be for a
+@@ -1692,7 +1698,13 @@ static int ext3_writeback_writepage(struct page *page,
+ 	int err;
+ 
+ 	J_ASSERT(PageLocked(page));
+-	WARN_ON_ONCE(IS_RDONLY(inode));
+	/*
+	 * We don't want to warn for emergency remount. The condition is
+	 * ordered to avoid dereferencing inode->i_sb in non-error case to
+	 * avoid slow-downs.
+	 */
+	WARN_ON_ONCE(IS_RDONLY(inode) &&
+		     !(EXT3_SB(inode->i_sb)->s_mount_state & EXT3_ERROR_FS));
+ 
+ 	if (ext3_journal_current_handle())
+ 		goto out_fail;
+@@ -1735,7 +1747,13 @@ static int ext3_journalled_writepage(struct page *page,
+ 	int err;
+ 
+ 	J_ASSERT(PageLocked(page));
+-	WARN_ON_ONCE(IS_RDONLY(inode));
+	/*
+	 * We don't want to warn for emergency remount. The condition is
+	 * ordered to avoid dereferencing inode->i_sb in non-error case to
+	 * avoid slow-downs.
+	 */
+	WARN_ON_ONCE(IS_RDONLY(inode) &&
+		     !(EXT3_SB(inode->i_sb)->s_mount_state & EXT3_ERROR_FS));
+ 
+ 	if (ext3_journal_current_handle())
+ 		goto no_write;
+-- 
+1.7.7.4
+
@@ -0,0 +1,70 @@
+From b9e6c637b69ffe81b7f272f433f18e3cd2f58052 Mon Sep 17 00:00:00 2001
+From: "K. Y. Srinivasan" <kys@microsoft.com>
+Date: Thu, 1 Dec 2011 09:59:34 -0800
+Subject: [PATCH 26/49] drivers: hv: Don't OOPS when you cannot init vmbus
+
+commit cf6a2eacbcb2593b5b91d0817915c4f0464bb534 upstream.
+
+The hv vmbus driver was causing an OOPS since it was trying to register drivers
+on top of the bus even if initialization of the bus has failed for some
+reason (such as the odd chance someone would run a hv enabled kernel in a
+non-hv environment).
+
+Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/hv/vmbus_drv.c |   16 ++++++++++++++++
+ 1 files changed, 16 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
+index 0c048dd..d3b0b4f 100644
+--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
+@@ -62,6 +62,14 @@ struct hv_device_info {
+ 	struct hv_dev_port_info outbound;
+ };
+ 
+static int vmbus_exists(void)
+{
+	if (hv_acpi_dev == NULL)
+		return -ENODEV;
+
+	return 0;
+}
+
+ 
+ static void get_channel_info(struct hv_device *device,
+ 			     struct hv_device_info *info)
+@@ -590,6 +598,10 @@ int __vmbus_driver_register(struct hv_driver *hv_driver, struct module *owner, c
+ 
+ 	pr_info("registering driver %s\n", hv_driver->name);
+ 
+	ret = vmbus_exists();
+	if (ret < 0)
+		return ret;
+
+ 	hv_driver->driver.name = hv_driver->name;
+ 	hv_driver->driver.owner = owner;
+ 	hv_driver->driver.mod_name = mod_name;
+@@ -614,6 +626,9 @@ void vmbus_driver_unregister(struct hv_driver *hv_driver)
+ {
+ 	pr_info("unregistering driver %s\n", hv_driver->name);
+ 
+	if (!vmbus_exists())
+		return;
+
+ 	driver_unregister(&hv_driver->driver);
+ 
+ }
+@@ -776,6 +791,7 @@ static int __init hv_acpi_init(void)
+ 
+ cleanup:
+ 	acpi_bus_unregister_driver(&vmbus_acpi_driver);
+	hv_acpi_dev = NULL;
+ 	return ret;
+ }
+ 
+-- 
+1.7.7.4
+
@@ -0,0 +1,40 @@
+From 797931db7094985a8aa99b24695192d1773129de Mon Sep 17 00:00:00 2001
+From: "K. Y. Srinivasan" <kys@microsoft.com>
+Date: Tue, 27 Dec 2011 13:49:37 -0800
+Subject: [PATCH 27/49] Drivers:hv: Fix a bug in vmbus_driver_unregister()
+
+commit 8f257a142fc3868d69de3f996b95d7bdbc509560 upstream.
+
+The function vmbus_exists() was introduced recently to deal with cases where
+the vmbus driver failed to initialize and yet other Hyper-V drivers attempted
+to register with the vmbus bus driver. This patch introduced a bug where
+vmbus_driver_unregister() would fail to unregister the driver. This patch
+fixes the problem.
+
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Fuzhou Chen <fuzhouch@microsoft.com>
+Cc: Sasha Levin <levinsasha928@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/hv/vmbus_drv.c |    5 +----
+ 1 files changed, 1 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
+index d3b0b4f..d2d0a2a 100644
+--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
+@@ -627,10 +627,7 @@ void vmbus_driver_unregister(struct hv_driver *hv_driver)
+ 	pr_info("unregistering driver %s\n", hv_driver->name);
+ 
+ 	if (!vmbus_exists())
+-		return;
+-
+-	driver_unregister(&hv_driver->driver);
+-
+		driver_unregister(&hv_driver->driver);
+ }
+ EXPORT_SYMBOL_GPL(vmbus_driver_unregister);
+ 
+-- 
+1.7.7.4
+
@@ -0,0 +1,54 @@
+From a4d5730e9c4b209e74eab2f7650b23f95417dc71 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 4 Jan 2012 16:36:35 -0500
+Subject: [PATCH 28/49] USB: update documentation for usbmon
+
+commit d8cae98cddd286e38db1724dda1b0e7b467f9237 upstream.
+
+The documentation for usbmon is out of date; the usbfs "devices" file
+now exists in /sys/kernel/debug/usb rather than /proc/bus/usb.  This
+patch (as1505) updates the documentation accordingly, and also
+mentions that the necessary information can be found by running lsusb.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+CC: Pete Zaitcev <zaitcev@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ Documentation/usb/usbmon.txt |   14 +++++++++-----
+ 1 files changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/Documentation/usb/usbmon.txt b/Documentation/usb/usbmon.txt
+index a4efa04..5335fa8 100644
+--- a/Documentation/usb/usbmon.txt
+++ b/Documentation/usb/usbmon.txt
+@@ -47,10 +47,11 @@ This allows to filter away annoying devices that talk continuously.
+ 
+ 2. Find which bus connects to the desired device
+ 
+-Run "cat /proc/bus/usb/devices", and find the T-line which corresponds to
+-the device. Usually you do it by looking for the vendor string. If you have
+-many similar devices, unplug one and compare two /proc/bus/usb/devices outputs.
+-The T-line will have a bus number. Example:
+Run "cat /sys/kernel/debug/usb/devices", and find the T-line which corresponds
+to the device. Usually you do it by looking for the vendor string. If you have
+many similar devices, unplug one and compare the two
+/sys/kernel/debug/usb/devices outputs. The T-line will have a bus number.
+Example:
+ 
+ T:  Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12  MxCh= 0
+ D:  Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs=  1
+@@ -58,7 +59,10 @@ P:  Vendor=0557 ProdID=2004 Rev= 1.00
+ S:  Manufacturer=ATEN
+ S:  Product=UC100KM V2.00
+ 
+-Bus=03 means it's bus 3.
+"Bus=03" means it's bus 3. Alternatively, you can look at the output from
+"lsusb" and get the bus number from the appropriate line. Example:
+
+Bus 003 Device 002: ID 0557:2004 ATEN UC100KM V2.00
+ 
+ 3. Start 'cat'
+ 
+-- 
+1.7.7.4
+
@@ -0,0 +1,125 @@
+From 6b544616a14b48a670d0c7ce10a5f8de1246cc96 Mon Sep 17 00:00:00 2001
+From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Date: Fri, 16 Dec 2011 11:26:30 -0800
+Subject: [PATCH 29/49] usbfs: Fix oops related to user namespace conversion.
+
+commit 1b41c8321e495337e877ca02d0b9680bc4112eff upstream.
+
+When running the Point Grey "flycap" program for their USB 3.0 camera
+(which was running as a USB 2.0 device for some reason), I trigger this
+oops whenever I try to open a video stream:
+
+Dec 15 16:48:34 puck kernel: [ 1798.715559] BUG: unable to handle kernel NULL pointer dereference at           (null)
+Dec 15 16:48:34 puck kernel: [ 1798.719153] IP: [<ffffffff8147841e>] free_async+0x1e/0x70
+Dec 15 16:48:34 puck kernel: [ 1798.720991] PGD 6f833067 PUD 6fc56067 PMD 0
+Dec 15 16:48:34 puck kernel: [ 1798.722815] Oops: 0002 [#1] SMP
+Dec 15 16:48:34 puck kernel: [ 1798.724627] CPU 0
+Dec 15 16:48:34 puck kernel: [ 1798.724636] Modules linked in: ecryptfs encrypted_keys sha1_generic trusted binfmt_misc sha256_generic aesni_intel cryptd aes_x86_64 aes_generic parport_pc dm_crypt ppdev joydev snd_hda_codec_hdmi snd_hda_codec_conexant arc4 iwlwifi snd_hda_intel snd_hda_codec snd_hwdep snd_pcm thinkpad_acpi mac80211 snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer btusb uvcvideo snd_seq_device bluetooth videodev psmouse snd v4l2_compat_ioctl32 serio_raw tpm_tis cfg80211 tpm tpm_bios nvram soundcore snd_page_alloc lp parport i915 xhci_hcd ahci libahci drm_kms_helper drm sdhci_pci sdhci e1000e i2c_algo_bit video
+Dec 15 16:48:34 puck kernel: [ 1798.734212]
+Dec 15 16:48:34 puck kernel: [ 1798.736162] Pid: 2713, comm: FlyCap2 Not tainted 3.2.0-rc5+ #28 LENOVO 4286CTO/4286CTO
+Dec 15 16:48:34 puck kernel: [ 1798.738148] RIP: 0010:[<ffffffff8147841e>]  [<ffffffff8147841e>] free_async+0x1e/0x70
+Dec 15 16:48:34 puck kernel: [ 1798.740134] RSP: 0018:ffff88005715fd78  EFLAGS: 00010296
+Dec 15 16:48:34 puck kernel: [ 1798.742118] RAX: 00000000fffffff4 RBX: ffff88006fe8f900 RCX: 0000000000004118
+Dec 15 16:48:34 puck kernel: [ 1798.744116] RDX: 0000000001000000 RSI: 0000000000016390 RDI: 0000000000000000
+Dec 15 16:48:34 puck kernel: [ 1798.746087] RBP: ffff88005715fd88 R08: 0000000000000000 R09: ffffffff8146f22e
+Dec 15 16:48:34 puck kernel: [ 1798.748018] R10: ffff88006e520ac0 R11: 0000000000000001 R12: ffff88005715fe28
+Dec 15 16:48:34 puck kernel: [ 1798.749916] R13: ffff88005d31df00 R14: ffff88006fe8f900 R15: 00007f688c995cb8
+Dec 15 16:48:34 puck kernel: [ 1798.751785] FS:  00007f68a366da40(0000) GS:ffff880100200000(0000) knlGS:0000000000000000
+Dec 15 16:48:34 puck kernel: [ 1798.753659] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+Dec 15 16:48:34 puck kernel: [ 1798.755509] CR2: 0000000000000000 CR3: 00000000706bb000 CR4: 00000000000406f0
+Dec 15 16:48:34 puck kernel: [ 1798.757334] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+Dec 15 16:48:34 puck kernel: [ 1798.759124] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+Dec 15 16:48:34 puck kernel: [ 1798.760871] Process FlyCap2 (pid: 2713, threadinfo ffff88005715e000, task ffff88006c675b80)
+Dec 15 16:48:34 puck kernel: [ 1798.762605] Stack:
+Dec 15 16:48:34 puck kernel: [ 1798.764297]  ffff88005715fe28 0000000000000000 ffff88005715fe08 ffffffff81479058
+Dec 15 16:48:34 puck kernel: [ 1798.766020]  0000000000000000 ffffea0000004000 ffff880000004118 0000000000000000
+Dec 15 16:48:34 puck kernel: [ 1798.767750]  ffff880000000001 ffff88006e520ac0 fffffff46fd81180 0000000000000000
+Dec 15 16:48:34 puck kernel: [ 1798.769472] Call Trace:
+Dec 15 16:48:34 puck kernel: [ 1798.771147]  [<ffffffff81479058>] proc_do_submiturb+0x778/0xa00
+Dec 15 16:48:34 puck kernel: [ 1798.772798]  [<ffffffff8147a5fd>] usbdev_do_ioctl+0x24d/0x1200
+Dec 15 16:48:34 puck kernel: [ 1798.774410]  [<ffffffff8147b5de>] usbdev_ioctl+0xe/0x20
+Dec 15 16:48:34 puck kernel: [ 1798.775975]  [<ffffffff81189259>] do_vfs_ioctl+0x99/0x600
+Dec 15 16:48:34 puck kernel: [ 1798.777534]  [<ffffffff81189851>] sys_ioctl+0x91/0xa0
+Dec 15 16:48:34 puck kernel: [ 1798.779088]  [<ffffffff816247c2>] system_call_fastpath+0x16/0x1b
+ec 15 16:48:34 puck kernel: [ 1798.780634] Code: 51 ff ff ff e9 29 ff ff ff 0f 1f 40 00 55 48 89 e5 53 48 83 ec 08 66 66 66 66 90 48 89 fb 48 8b 7f 18 e8 a6 ea c0 ff 4
+8 8b 7b 20 <f0> ff 0f 0f 94 c0 84 c0 74 05 e8 d3 99 c1 ff 48 8b 43 40 48 8b
+Dec 15 16:48:34 puck kernel: [ 1798.783970] RIP  [<ffffffff8147841e>] free_async+0x1e/0x70
+Dec 15 16:48:34 puck kernel: [ 1798.785630]  RSP <ffff88005715fd78>
+Dec 15 16:48:34 puck kernel: [ 1798.787274] CR2: 0000000000000000
+Dec 15 16:48:34 puck kernel: [ 1798.794728] ---[ end trace 52894d3355f88d19 ]---
+
+markup_oops.pl says the oops is in put_cred:
+
+ ffffffff81478401:      48 89 e5                mov    %rsp,%rbp
+ ffffffff81478404:      53                      push   %rbx
+ ffffffff81478405:      48 83 ec 08             sub    $0x8,%rsp
+ ffffffff81478409:      e8 f2 c0 1a 00          callq  ffffffff81624500 <mcount>
+ ffffffff8147840e:      48 89 fb                mov    %rdi,%rbx   |  %ebx => ffff88006fe8f900
+        put_pid(as->pid);
+ ffffffff81478411:      48 8b 7f 18             mov    0x18(%rdi),%rdi
+ ffffffff81478415:      e8 a6 ea c0 ff          callq  ffffffff81086ec0 <put_pid>
+        put_cred(as->cred);
+ ffffffff8147841a:      48 8b 7b 20             mov    0x20(%rbx),%rdi |  %edi => 0  %ebx = ffff88006fe8f900
+  */
+ static inline int atomic_dec_and_test(atomic_t *v)
+ {
+        unsigned char c;
+
+        asm volatile(LOCK_PREFIX "decl %0; sete %1"
+*ffffffff8147841e:      f0 ff 0f                lock decl (%rdi)   |  %edi = 0 <--- faulting instruction
+ ffffffff81478421:      0f 94 c0                sete   %al
+ static inline void put_cred(const struct cred *_cred)
+ {
+        struct cred *cred = (struct cred *) _cred;
+
+        validate_creds(cred);
+        if (atomic_dec_and_test(&(cred)->usage))
+ ffffffff81478424:      84 c0                   test   %al,%al
+ ffffffff81478426:      74 05                   je     ffffffff8147842d <free_async+0x2d>
+                __put_cred(cred);
+ ffffffff81478428:      e8 d3 99 c1 ff          callq  ffffffff81091e00 <__put_cred>
+        kfree(as->urb->transfer_buffer);
+ ffffffff8147842d:      48 8b 43 40             mov    0x40(%rbx),%rax
+ ffffffff81478431:      48 8b 78 68             mov    0x68(%rax),%rdi
+ ffffffff81478435:      e8 a6 e1 ce ff          callq  ffffffff811665e0 <kfree>
+        kfree(as->urb->setup_packet);
+ ffffffff8147843a:      48 8b 43 40             mov    0x40(%rbx),%rax
+ ffffffff8147843e:      48 8b b8 90 00 00 00    mov    0x90(%rax),%rdi
+ ffffffff81478445:      e8 96 e1 ce ff          callq  ffffffff811665e0 <kfree>
+        usb_free_urb(as->urb);
+ ffffffff8147844a:      48 8b 7b 40             mov    0x40(%rbx),%rdi
+ ffffffff8147844e:      e8 0d 6b ff ff          callq  ffffffff8146ef60 <usb_free_urb>
+
+This bug seems to have been introduced by commit
+d178bc3a708f39cbfefc3fab37032d3f2511b4ec "user namespace: usb: make usb
+urbs user namespace aware (v2)"
+
+I'm not sure if this is right fix, but it does stop the oops.
+
+Unfortunately, the Point Grey software still refuses to work, but it's a
+closed source app, so I can't fix it.
+
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/core/devio.c |    3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index e3beaf2..7abf060 100644
+--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
+@@ -249,7 +249,8 @@ static struct async *alloc_async(unsigned int numisoframes)
+ static void free_async(struct async *as)
+ {
+ 	put_pid(as->pid);
+-	put_cred(as->cred);
+	if (as->cred)
+		put_cred(as->cred);
+ 	kfree(as->urb->transfer_buffer);
+ 	kfree(as->urb->setup_packet);
+ 	usb_free_urb(as->urb);
+-- 
+1.7.7.4
+
@@ -0,0 +1,47 @@
+From 2918b666fe0636d9d90ce6defda2d3ec908231a8 Mon Sep 17 00:00:00 2001
+From: Claudio Scordino <claudio@evidence.eu.com>
+Date: Fri, 16 Dec 2011 15:08:49 +0100
+Subject: [PATCH 30/49] atmel_serial: fix spinlock lockup in RS485 code
+
+commit dbf1115d3f8c7052788aa4e6e46abd27f3b3eeba upstream.
+
+Patch to fix a spinlock lockup in the driver that sometimes happens when the
+tasklet starts.
+
+Signed-off-by: Claudio Scordino <claudio@evidence.eu.com>
+Signed-off-by: Dave Bender <codehero@gmail.com>
+Tested-by: Dave Bender <codehero@gmail.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Acked-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/tty/serial/atmel_serial.c |    5 +++--
+ 1 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
+index 4c823f3..90c8e3a 100644
+--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
+@@ -212,8 +212,9 @@ void atmel_config_rs485(struct uart_port *port, struct serial_rs485 *rs485conf)
+ {
+ 	struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
+ 	unsigned int mode;
+	unsigned long flags;
+ 
+-	spin_lock(&port->lock);
+	spin_lock_irqsave(&port->lock, flags);
+ 
+ 	/* Disable interrupts */
+ 	UART_PUT_IDR(port, atmel_port->tx_done_mask);
+@@ -244,7 +245,7 @@ void atmel_config_rs485(struct uart_port *port, struct serial_rs485 *rs485conf)
+ 	/* Enable interrupts */
+ 	UART_PUT_IER(port, atmel_port->tx_done_mask);
+ 
+-	spin_unlock(&port->lock);
+	spin_unlock_irqrestore(&port->lock, flags);
+ 
+ }
+ 
+-- 
+1.7.7.4
+
@@ -0,0 +1,50 @@
+From 7e755f9707e34e7de22e2f3b77ab26d1d8de5a4b Mon Sep 17 00:00:00 2001
+From: Li Zefan <lizf@cn.fujitsu.com>
+Date: Tue, 27 Dec 2011 14:25:55 +0800
+Subject: [PATCH 31/49] cgroup: fix to allow mounting a hierarchy by name
+
+commit 0d19ea866562e46989412a0676412fa0983c9ce7 upstream.
+
+If we mount a hierarchy with a specified name, the name is unique,
+and we can use it to mount the hierarchy without specifying its
+set of subsystem names. This feature is documented is
+Documentation/cgroups/cgroups.txt section 2.3
+
+Here's an example:
+
+	# mount -t cgroup -o cpuset,name=myhier xxx /cgroup1
+	# mount -t cgroup -o name=myhier xxx /cgroup2
+
+But it was broken by commit 32a8cf235e2f192eb002755076994525cdbaa35a
+(cgroup: make the mount options parsing more accurate)
+
+This fixes the regression.
+
+Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ kernel/cgroup.c |    6 +++---
+ 1 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/cgroup.c b/kernel/cgroup.c
+index a184470..cdc0354 100644
+--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
+@@ -1175,10 +1175,10 @@ static int parse_cgroupfs_options(char *data, struct cgroup_sb_opts *opts)
+ 
+ 	/*
+ 	 * If the 'all' option was specified select all the subsystems,
+-	 * otherwise 'all, 'none' and a subsystem name options were not
+-	 * specified, let's default to 'all'
+	 * otherwise if 'none', 'name=' and a subsystem name options
+	 * were not specified, let's default to 'all'
+ 	 */
+-	if (all_ss || (!all_ss && !one_ss && !opts->none)) {
+	if (all_ss || (!one_ss && !opts->none && !opts->name)) {
+ 		for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
+ 			struct cgroup_subsys *ss = subsys[i];
+ 			if (ss == NULL)
+-- 
+1.7.7.4
+
@@ -0,0 +1,130 @@
+From b2b56aa7932508ce3a81187a68e6a558268efc35 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Sat, 10 Dec 2011 02:30:48 +0100
+Subject: [PATCH 32/49] udf: Fix deadlock when converting file from in-ICB one
+ to normal one
+
+commit d2eb8c359309ec45d6bf5b147303ab8e13be86ea upstream.
+
+During BKL removal in 2.6.38, conversion of files from in-ICB format to normal
+format got broken. We call ->writepage with i_data_sem held but udf_get_block()
+also acquires i_data_sem thus creating A-A deadlock.
+
+We fix the problem by dropping i_data_sem before calling ->writepage() which is
+safe since i_mutex still protects us against any changes in the file. Also fix
+pagelock - i_data_sem lock inversion in udf_expand_file_adinicb() by dropping
+i_data_sem before calling find_or_create_page().
+
+Reported-by: Matthias Matiak <netzpython@mail-on.us>
+Tested-by: Matthias Matiak <netzpython@mail-on.us>
+Reviewed-by: Namjae Jeon <linkinjeon@gmail.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/udf/file.c  |    6 +++---
+ fs/udf/inode.c |   21 ++++++++++++++++++---
+ 2 files changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/fs/udf/file.c b/fs/udf/file.c
+index d8ffa7c..dca0c38 100644
+--- a/fs/udf/file.c
+++ b/fs/udf/file.c
+@@ -125,7 +125,6 @@ static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
+ 			err = udf_expand_file_adinicb(inode);
+ 			if (err) {
+ 				udf_debug("udf_expand_adinicb: err=%d\n", err);
+-				up_write(&iinfo->i_data_sem);
+ 				return err;
+ 			}
+ 		} else {
+@@ -133,9 +132,10 @@ static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
+ 				iinfo->i_lenAlloc = pos + count;
+ 			else
+ 				iinfo->i_lenAlloc = inode->i_size;
+			up_write(&iinfo->i_data_sem);
+ 		}
+-	}
+-	up_write(&iinfo->i_data_sem);
+	} else
+		up_write(&iinfo->i_data_sem);
+ 
+ 	retval = generic_file_aio_write(iocb, iov, nr_segs, ppos);
+ 	if (retval > 0)
+diff --git a/fs/udf/inode.c b/fs/udf/inode.c
+index 4fd1d80..e2787d0 100644
+--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
+@@ -151,6 +151,12 @@ const struct address_space_operations udf_aops = {
+ 	.bmap		= udf_bmap,
+ };
+ 
+/*
+ * Expand file stored in ICB to a normal one-block-file
+ *
+ * This function requires i_data_sem for writing and releases it.
+ * This function requires i_mutex held
+ */
+ int udf_expand_file_adinicb(struct inode *inode)
+ {
+ 	struct page *page;
+@@ -169,9 +175,15 @@ int udf_expand_file_adinicb(struct inode *inode)
+ 			iinfo->i_alloc_type = ICBTAG_FLAG_AD_LONG;
+ 		/* from now on we have normal address_space methods */
+ 		inode->i_data.a_ops = &udf_aops;
+		up_write(&iinfo->i_data_sem);
+ 		mark_inode_dirty(inode);
+ 		return 0;
+ 	}
+	/*
+	 * Release i_data_sem so that we can lock a page - page lock ranks
+	 * above i_data_sem. i_mutex still protects us against file changes.
+	 */
+	up_write(&iinfo->i_data_sem);
+ 
+ 	page = find_or_create_page(inode->i_mapping, 0, GFP_NOFS);
+ 	if (!page)
+@@ -187,6 +199,7 @@ int udf_expand_file_adinicb(struct inode *inode)
+ 		SetPageUptodate(page);
+ 		kunmap(page);
+ 	}
+	down_write(&iinfo->i_data_sem);
+ 	memset(iinfo->i_ext.i_data + iinfo->i_lenEAttr, 0x00,
+ 	       iinfo->i_lenAlloc);
+ 	iinfo->i_lenAlloc = 0;
+@@ -196,17 +209,20 @@ int udf_expand_file_adinicb(struct inode *inode)
+ 		iinfo->i_alloc_type = ICBTAG_FLAG_AD_LONG;
+ 	/* from now on we have normal address_space methods */
+ 	inode->i_data.a_ops = &udf_aops;
+	up_write(&iinfo->i_data_sem);
+ 	err = inode->i_data.a_ops->writepage(page, &udf_wbc);
+ 	if (err) {
+ 		/* Restore everything back so that we don't lose data... */
+ 		lock_page(page);
+ 		kaddr = kmap(page);
+		down_write(&iinfo->i_data_sem);
+ 		memcpy(iinfo->i_ext.i_data + iinfo->i_lenEAttr, kaddr,
+ 		       inode->i_size);
+ 		kunmap(page);
+ 		unlock_page(page);
+ 		iinfo->i_alloc_type = ICBTAG_FLAG_AD_IN_ICB;
+ 		inode->i_data.a_ops = &udf_adinicb_aops;
+		up_write(&iinfo->i_data_sem);
+ 	}
+ 	page_cache_release(page);
+ 	mark_inode_dirty(inode);
+@@ -1111,10 +1127,9 @@ int udf_setsize(struct inode *inode, loff_t newsize)
+ 			if (bsize <
+ 			    (udf_file_entry_alloc_offset(inode) + newsize)) {
+ 				err = udf_expand_file_adinicb(inode);
+-				if (err) {
+-					up_write(&iinfo->i_data_sem);
+				if (err)
+ 					return err;
+-				}
+				down_write(&iinfo->i_data_sem);
+ 			} else
+ 				iinfo->i_lenAlloc = newsize;
+ 		}
+-- 
+1.7.7.4
+
@@ -0,0 +1,45 @@
+From 2aabf017a2a76405dd9efbca80320965d8361302 Mon Sep 17 00:00:00 2001
+From: Julia Lawall <julia@diku.dk>
+Date: Fri, 23 Dec 2011 14:02:55 +0100
+Subject: [PATCH 33/49] drivers/usb/class/cdc-acm.c: clear dangling pointer
+
+commit e7c8e8605d0bafc705ff27f9da98a1668427cc0f upstream.
+
+On some failures, the country_code field of an acm structure is freed
+without freeing the acm structure itself.  Elsewhere, operations including
+memcpy and kfree are performed on the country_code field.  The patch sets
+the country_code field to NULL when it is freed, and likewise sets the
+country_code_size field to 0.
+
+Signed-off-by: Julia Lawall <julia@diku.dk>
+Acked-by: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/class/cdc-acm.c |    4 ++++
+ 1 files changed, 4 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index a8078d0..ea5e487 100644
+--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
+@@ -1183,6 +1183,8 @@ made_compressed_probe:
+ 		i = device_create_file(&intf->dev, &dev_attr_wCountryCodes);
+ 		if (i < 0) {
+ 			kfree(acm->country_codes);
+			acm->country_codes = NULL;
+			acm->country_code_size = 0;
+ 			goto skip_countries;
+ 		}
+ 
+@@ -1191,6 +1193,8 @@ made_compressed_probe:
+ 		if (i < 0) {
+ 			device_remove_file(&intf->dev, &dev_attr_wCountryCodes);
+ 			kfree(acm->country_codes);
+			acm->country_codes = NULL;
+			acm->country_code_size = 0;
+ 			goto skip_countries;
+ 		}
+ 	}
+-- 
+1.7.7.4
+
@@ -0,0 +1,47 @@
+From 1d24cdb0797a26e1fb1d3545f6d4b992a5a23e96 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@suse.de>
+Date: Mon, 5 Dec 2011 14:02:59 -0800
+Subject: [PATCH 34/49] USB: isight: fix kernel bug when loading firmware
+
+commit 59bf5cf94f0fa3b08fb1258b52649077b7d0914d upstream.
+
+We were sending data on the stack when uploading firmware, which causes
+some machines fits, and is not allowed.  Fix this by using the buffer we
+already had around for this very purpose.
+
+Reported-by: Wouter M. Koolen <wmkoolen@cwi.nl>
+Tested-by: Wouter M. Koolen <wmkoolen@cwi.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/misc/isight_firmware.c |    6 ++++--
+ 1 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/misc/isight_firmware.c b/drivers/usb/misc/isight_firmware.c
+index fe1d443..8f725f6 100644
+--- a/drivers/usb/misc/isight_firmware.c
+++ b/drivers/usb/misc/isight_firmware.c
+@@ -55,8 +55,9 @@ static int isight_firmware_load(struct usb_interface *intf,
+ 
+ 	ptr = firmware->data;
+ 
+	buf[0] = 0x01;
+ 	if (usb_control_msg
+-	    (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, "\1", 1,
+	    (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, buf, 1,
+ 	     300) != 1) {
+ 		printk(KERN_ERR
+ 		       "Failed to initialise isight firmware loader\n");
+@@ -100,8 +101,9 @@ static int isight_firmware_load(struct usb_interface *intf,
+ 		}
+ 	}
+ 
+	buf[0] = 0x00;
+ 	if (usb_control_msg
+-	    (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, "\0", 1,
+	    (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, buf, 1,
+ 	     300) != 1) {
+ 		printk(KERN_ERR "isight firmware loading completion failed\n");
+ 		ret = -ENODEV;
+-- 
+1.7.7.4
+
@@ -0,0 +1,121 @@
+From 713ad0e8402a7e377bb8b4254b9b522628c9afeb Mon Sep 17 00:00:00 2001
+From: Huajun Li <huajun.li.lee@gmail.com>
+Date: Wed, 4 Jan 2012 19:25:33 +0800
+Subject: [PATCH 35/49] usb: usb-storage doesn't support dynamic id currently,
+ the patch disables the feature to fix an oops
+
+commit 1a3a026ba1b6bbfe0b7f79ab38cf991d691e7c9a upstream.
+
+Echo vendor and product number of a non usb-storage device to
+usb-storage driver's new_id, then plug in the device to host and you
+will find following oops msg, the root cause is usb_stor_probe1()
+refers invalid id entry if giving a dynamic id, so just disable the
+feature.
+
+[ 3105.018012] general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC
+[ 3105.018062] CPU 0
+[ 3105.018075] Modules linked in: usb_storage usb_libusual bluetooth
+dm_crypt binfmt_misc snd_hda_codec_analog snd_hda_intel snd_hda_codec
+snd_hwdep hp_wmi ppdev sparse_keymap snd_pcm snd_seq_midi snd_rawmidi
+snd_seq_midi_event snd_seq snd_timer snd_seq_device psmouse snd
+serio_raw tpm_infineon soundcore i915 snd_page_alloc tpm_tis
+parport_pc tpm tpm_bios drm_kms_helper drm i2c_algo_bit video lp
+parport usbhid hid sg sr_mod sd_mod ehci_hcd uhci_hcd usbcore e1000e
+usb_common floppy
+[ 3105.018408]
+[ 3105.018419] Pid: 189, comm: khubd Tainted: G          I  3.2.0-rc7+
+#29 Hewlett-Packard HP Compaq dc7800p Convertible Minitower/0AACh
+[ 3105.018481] RIP: 0010:[<ffffffffa045830d>]  [<ffffffffa045830d>]
+usb_stor_probe1+0x2fd/0xc20 [usb_storage]
+[ 3105.018536] RSP: 0018:ffff880056a3d830  EFLAGS: 00010286
+[ 3105.018562] RAX: ffff880065f4e648 RBX: ffff88006bb28000 RCX: 0000000000000000
+[ 3105.018597] RDX: ffff88006f23c7b0 RSI: 0000000000000001 RDI: 0000000000000206
+[ 3105.018632] RBP: ffff880056a3d900 R08: 0000000000000000 R09: ffff880067365000
+[ 3105.018665] R10: 00000000000002ac R11: 0000000000000010 R12: ffff6000b41a7340
+[ 3105.018698] R13: ffff880065f4ef60 R14: ffff88006bb28b88 R15: ffff88006f23d270
+[ 3105.018733] FS:  0000000000000000(0000) GS:ffff88007a200000(0000)
+knlGS:0000000000000000
+[ 3105.018773] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+[ 3105.018801] CR2: 00007fc99c8c4650 CR3: 0000000001e05000 CR4: 00000000000006f0
+[ 3105.018835] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 3105.018870] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+[ 3105.018906] Process khubd (pid: 189, threadinfo ffff880056a3c000,
+task ffff88005677a400)
+[ 3105.018945] Stack:
+[ 3105.018959]  0000000000000000 0000000000000000 ffff880056a3d8d0
+0000000000000002
+[ 3105.019011]  0000000000000000 ffff880056a3d918 ffff880000000000
+0000000000000002
+[ 3105.019058]  ffff880056a3d8d0 0000000000000012 ffff880056a3d8d0
+0000000000000006
+[ 3105.019105] Call Trace:
+[ 3105.019128]  [<ffffffffa0458cd4>] storage_probe+0xa4/0xe0 [usb_storage]
+[ 3105.019173]  [<ffffffffa0097822>] usb_probe_interface+0x172/0x330 [usbcore]
+[ 3105.019211]  [<ffffffff815fda67>] driver_probe_device+0x257/0x3b0
+[ 3105.019243]  [<ffffffff815fdd43>] __device_attach+0x73/0x90
+[ 3105.019272]  [<ffffffff815fdcd0>] ? __driver_attach+0x110/0x110
+[ 3105.019303]  [<ffffffff815fb93c>] bus_for_each_drv+0x9c/0xf0
+[ 3105.019334]  [<ffffffff815fd6c7>] device_attach+0xf7/0x120
+[ 3105.019364]  [<ffffffff815fc905>] bus_probe_device+0x45/0x80
+[ 3105.019396]  [<ffffffff815f98a6>] device_add+0x876/0x990
+[ 3105.019434]  [<ffffffffa0094e42>] usb_set_configuration+0x822/0x9e0 [usbcore]
+[ 3105.019479]  [<ffffffffa00a3492>] generic_probe+0x62/0xf0 [usbcore]
+[ 3105.019518]  [<ffffffffa0097a46>] usb_probe_device+0x66/0xb0 [usbcore]
+[ 3105.019555]  [<ffffffff815fda67>] driver_probe_device+0x257/0x3b0
+[ 3105.019589]  [<ffffffff815fdd43>] __device_attach+0x73/0x90
+[ 3105.019617]  [<ffffffff815fdcd0>] ? __driver_attach+0x110/0x110
+[ 3105.019648]  [<ffffffff815fb93c>] bus_for_each_drv+0x9c/0xf0
+[ 3105.019680]  [<ffffffff815fd6c7>] device_attach+0xf7/0x120
+[ 3105.019709]  [<ffffffff815fc905>] bus_probe_device+0x45/0x80
+[ 3105.021040] usb usb6: usb auto-resume
+[ 3105.021045] usb usb6: wakeup_rh
+[ 3105.024849]  [<ffffffff815f98a6>] device_add+0x876/0x990
+[ 3105.025086]  [<ffffffffa0088987>] usb_new_device+0x1e7/0x2b0 [usbcore]
+[ 3105.025086]  [<ffffffffa008a4d7>] hub_thread+0xb27/0x1ec0 [usbcore]
+[ 3105.025086]  [<ffffffff810d5200>] ? wake_up_bit+0x50/0x50
+[ 3105.025086]  [<ffffffffa00899b0>] ? usb_remote_wakeup+0xa0/0xa0 [usbcore]
+[ 3105.025086]  [<ffffffff810d49b8>] kthread+0xd8/0xf0
+[ 3105.025086]  [<ffffffff81939884>] kernel_thread_helper+0x4/0x10
+[ 3105.025086]  [<ffffffff8192a8c0>] ? _raw_spin_unlock_irq+0x50/0x80
+[ 3105.025086]  [<ffffffff8192b1b4>] ? retint_restore_args+0x13/0x13
+[ 3105.025086]  [<ffffffff810d48e0>] ? __init_kthread_worker+0x80/0x80
+[ 3105.025086]  [<ffffffff81939880>] ? gs_change+0x13/0x13
+[ 3105.025086] Code: 00 48 83 05 cd ad 00 00 01 48 83 05 cd ad 00 00
+01 4c 8b ab 30 0c 00 00 48 8b 50 08 48 83 c0 30 48 89 45 a0 4c 89 a3
+40 0c 00 00 <41> 0f b6 44 24 10 48 89 55 a8 3c ff 0f 84 b8 04 00 00 48
+83 05
+[ 3105.025086] RIP  [<ffffffffa045830d>] usb_stor_probe1+0x2fd/0xc20
+[usb_storage]
+[ 3105.025086]  RSP <ffff880056a3d830>
+[ 3105.060037] hub 6-0:1.0: hub_resume
+[ 3105.062616] usb usb5: usb auto-resume
+[ 3105.064317] ehci_hcd 0000:00:1d.7: resume root hub
+[ 3105.094809] ---[ end trace a7919e7f17c0a727 ]---
+[ 3105.130069] hub 5-0:1.0: hub_resume
+[ 3105.132131] usb usb4: usb auto-resume
+[ 3105.132136] usb usb4: wakeup_rh
+[ 3105.180059] hub 4-0:1.0: hub_resume
+[ 3106.290052] usb usb6: suspend_rh (auto-stop)
+[ 3106.290077] usb usb4: suspend_rh (auto-stop)
+
+Signed-off-by: Huajun Li <huajun.li.lee@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/storage/usb.c |    1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
+index c325e69..9e069ef 100644
+--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
+@@ -1073,6 +1073,7 @@ static struct usb_driver usb_storage_driver = {
+ 	.id_table =	usb_storage_usb_ids,
+ 	.supports_autosuspend = 1,
+ 	.soft_unbind =	1,
+	.no_dynamic_id = 1,
+ };
+ 
+ static int __init usb_stor_init(void)
+-- 
+1.7.7.4
+
@@ -0,0 +1,42 @@
+From 17e7ea93a7ec7bb64e3bcd6b3cbee1fea5021587 Mon Sep 17 00:00:00 2001
+From: Tanmay Upadhyay <tanmay.upadhyay@einfochips.com>
+Date: Thu, 8 Dec 2011 10:03:49 +0530
+Subject: [PATCH 36/49] USB: pxa168: Fix compilation error
+
+commit 35657c4d72925936c7219cc5caac118ca632acc2 upstream.
+
+After commit c430131a02d677aa708f56342c1565edfdacb3c0 (Support
+controllers with big endian capability regs), HC_LENGTH takes
+two arguments. This patch fixes following compilation error:
+
+In file included from drivers/usb/host/ehci-hcd.c:1323:
+drivers/usb/host/ehci-pxa168.c:302:54: error: macro "HC_LENGTH" requires 2 arguments, but only 1 given
+In file included from drivers/usb/host/ehci-hcd.c:1323:
+drivers/usb/host/ehci-pxa168.c: In function 'ehci_pxa168_drv_probe':
+drivers/usb/host/ehci-pxa168.c:302: error: 'HC_LENGTH' undeclared (first use in this function)
+drivers/usb/host/ehci-pxa168.c:302: error: (Each undeclared identifier is reported only once
+drivers/usb/host/ehci-pxa168.c:302: error: for each function it appears in.)
+
+Signed-off-by: Tanmay Upadhyay <tanmay.upadhyay@einfochips.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/host/ehci-pxa168.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/host/ehci-pxa168.c b/drivers/usb/host/ehci-pxa168.c
+index ac0c16e..8d0e7a2 100644
+--- a/drivers/usb/host/ehci-pxa168.c
+++ b/drivers/usb/host/ehci-pxa168.c
+@@ -299,7 +299,7 @@ static int __devinit ehci_pxa168_drv_probe(struct platform_device *pdev)
+ 	ehci = hcd_to_ehci(hcd);
+ 	ehci->caps = hcd->regs + 0x100;
+ 	ehci->regs = hcd->regs + 0x100 +
+-		HC_LENGTH(ehci_readl(ehci, &ehci->caps->hc_capbase));
+		HC_LENGTH(ehci, ehci_readl(ehci, &ehci->caps->hc_capbase));
+ 	ehci->hcs_params = ehci_readl(ehci, &ehci->caps->hcs_params);
+ 	hcd->has_tt = 1;
+ 	ehci->sbrn = 0x20;
+-- 
+1.7.7.4
+
@@ -0,0 +1,37 @@
+From ae803972522d34f68270782827580ba0d762468c Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oliver@neukum.org>
+Date: Tue, 3 Jan 2012 09:58:54 +0100
+Subject: [PATCH 37/49] USB: add quirk for another camera
+
+commit 35284b3d2f68a8a3703745e629999469f78386b5 upstream.
+
+The Guillemot Webcam Hercules Dualpix Exchange camera
+has been reported with a second ID.
+
+Signed-off-by: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/core/quirks.c |    5 ++++-
+ 1 files changed, 4 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index ecf12e1..4c65eb6 100644
+--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
+@@ -117,9 +117,12 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	{ USB_DEVICE(0x06a3, 0x0006), .driver_info =
+ 			USB_QUIRK_CONFIG_INTF_STRINGS },
+ 
+-	/* Guillemot Webcam Hercules Dualpix Exchange*/
+	/* Guillemot Webcam Hercules Dualpix Exchange (2nd ID) */
+ 	{ USB_DEVICE(0x06f8, 0x0804), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
+	/* Guillemot Webcam Hercules Dualpix Exchange*/
+	{ USB_DEVICE(0x06f8, 0x3005), .driver_info = USB_QUIRK_RESET_RESUME },
+
+ 	/* M-Systems Flash Disk Pioneers */
+ 	{ USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
+-- 
+1.7.7.4
+
@@ -0,0 +1,34 @@
+From 4a6a3895c6ffe420a07f90df0f8ad5d7ac5a47a4 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Sun, 6 Nov 2011 19:06:21 +0100
+Subject: [PATCH 38/49] USB: omninet: fix write_room
+
+commit 694c6301e515bad574af74b6552134c4d9dcb334 upstream.
+
+Fix regression introduced by commit 507ca9bc047666 ([PATCH] USB: add
+ability for usb-serial drivers to determine if their write urb is
+currently being used.) which inverted the logic in write_room so that it
+returns zero when the write urb is actually free.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/serial/omninet.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c
+index 60f38d5..0a8c1e6 100644
+--- a/drivers/usb/serial/omninet.c
+++ b/drivers/usb/serial/omninet.c
+@@ -315,7 +315,7 @@ static int omninet_write_room(struct tty_struct *tty)
+ 	int room = 0; /* Default: no room */
+ 
+ 	/* FIXME: no consistent locking for write_urb_busy */
+-	if (wport->write_urb_busy)
+	if (!wport->write_urb_busy)
+ 		room = wport->bulk_out_size - OMNINET_HEADERLEN;
+ 
+ 	dbg("%s - returns %d", __func__, room);
+-- 
+1.7.7.4
+
@@ -0,0 +1,53 @@
+From bd6e892c7f49027eb7d6f5739406142db70fee7e Mon Sep 17 00:00:00 2001
+From: Janne Snabb <snabb@epipe.com>
+Date: Wed, 28 Dec 2011 19:36:00 +0000
+Subject: [PATCH 39/49] usb: option: add ZD Incorporated HSPA modem
+
+commit 3c8c9316710b83e906e425024153bf0929887b59 upstream.
+
+Add support for Chinese Noname HSPA USB modem which is apparently
+manufactured by a company called ZD Incorporated (based on texts in the
+Windows drivers).
+
+This product is available at least from Dealextreme (SKU 80032) and
+possibly in India with name Olive V-MW250. It is based on Qualcomm
+MSM6280 chip.
+
+I needed to also add "options usb-storage quirks=0685:7000:i" in modprobe
+configuration because udevd or the kernel keeps poking the embedded
+fake-cd-rom which fails and causes the device to reset. There might be
+a better way to accomplish the same. usb_modeswitch is not needed with
+this device.
+
+Signed-off-by: Janne Snabb <snabb@epipe.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/serial/option.c |    5 +++++
+ 1 files changed, 5 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 6dd6453..c96b6b6 100644
+--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
+@@ -476,6 +476,10 @@ static void option_instat_callback(struct urb *urb);
+ #define VIETTEL_VENDOR_ID			0x2262
+ #define VIETTEL_PRODUCT_VT1000			0x0002
+ 
+/* ZD Incorporated */
+#define ZD_VENDOR_ID				0x0685
+#define ZD_PRODUCT_7000				0x7000
+
+ /* some devices interfaces need special handling due to a number of reasons */
+ enum option_blacklist_reason {
+ 		OPTION_BLACKLIST_NONE = 0,
+@@ -1178,6 +1182,7 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU528) },
+ 	{ USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU526) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(VIETTEL_VENDOR_ID, VIETTEL_PRODUCT_VT1000, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZD_VENDOR_ID, ZD_PRODUCT_7000, 0xff, 0xff, 0xff) },
+ 	{ } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+-- 
+1.7.7.4
+
@@ -0,0 +1,36 @@
+From a558d5668e8c66327a1a84f5db8381e94c2b0cd9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Malte=20Schr=C3=B6der?= <maltesch@gmx.de>
+Date: Thu, 5 Jan 2012 20:34:40 +0100
+Subject: [PATCH 40/49] USB: Add USB-ID for Multiplex RC serial adapter to
+ cp210x.c
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 08e87d0d773dc9ca5faf4c3306e238ed0ea129b0 upstream.
+
+Hi, below patch adds the USB-ID of the serial adapters sold by
+Multiplex RC (www.multiplex-rc.de).
+
+Signed-off-by: Malte Schröder <maltesch@gmx.de>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/serial/cp210x.c |    1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index fd67cc5..a1a324b 100644
+--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
+@@ -92,6 +92,7 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x10C4, 0x818B) }, /* AVIT Research USB to TTL */
+ 	{ USB_DEVICE(0x10C4, 0x819F) }, /* MJS USB Toslink Switcher */
+ 	{ USB_DEVICE(0x10C4, 0x81A6) }, /* ThinkOptics WavIt */
+	{ USB_DEVICE(0x10C4, 0x81A9) }, /* Multiplex RC Interface */
+ 	{ USB_DEVICE(0x10C4, 0x81AC) }, /* MSD Dash Hawk */
+ 	{ USB_DEVICE(0x10C4, 0x81AD) }, /* INSYS USB Modem */
+ 	{ USB_DEVICE(0x10C4, 0x81C8) }, /* Lipowsky Industrie Elektronik GmbH, Baby-JTAG */
+-- 
+1.7.7.4
+
@@ -0,0 +1,155 @@
+From 61ff4bd883cde399d333204fe9878e90b6f87329 Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Sat, 3 Dec 2011 23:41:31 +0100
+Subject: [PATCH 41/49] usb: fix number of mapped SG DMA entries
+
+commit bc677d5b64644c399cd3db6a905453e611f402ab upstream.
+
+Add a new field num_mapped_sgs to struct urb so that we have a place to
+store the number of mapped entries and can also retain the original
+value of entries in num_sgs.  Previously, usb_hcd_map_urb_for_dma()
+would overwrite this with the number of mapped entries, which would
+break dma_unmap_sg() because it requires the original number of entries.
+
+This fixes warnings like the following when using USB storage devices:
+ ------------[ cut here ]------------
+ WARNING: at lib/dma-debug.c:902 check_unmap+0x4e4/0x695()
+ ehci_hcd 0000:00:12.2: DMA-API: device driver frees DMA sg list with different entry count [map count=4] [unmap count=1]
+ Modules linked in: ohci_hcd ehci_hcd
+ Pid: 0, comm: kworker/0:1 Not tainted 3.2.0-rc2+ #319
+ Call Trace:
+  <IRQ>  [<ffffffff81036d3b>] warn_slowpath_common+0x80/0x98
+  [<ffffffff81036de7>] warn_slowpath_fmt+0x41/0x43
+  [<ffffffff811fa5ae>] check_unmap+0x4e4/0x695
+  [<ffffffff8105e92c>] ? trace_hardirqs_off+0xd/0xf
+  [<ffffffff8147208b>] ? _raw_spin_unlock_irqrestore+0x33/0x50
+  [<ffffffff811fa84a>] debug_dma_unmap_sg+0xeb/0x117
+  [<ffffffff8137b02f>] usb_hcd_unmap_urb_for_dma+0x71/0x188
+  [<ffffffff8137b166>] unmap_urb_for_dma+0x20/0x22
+  [<ffffffff8137b1c5>] usb_hcd_giveback_urb+0x5d/0xc0
+  [<ffffffffa0000d02>] ehci_urb_done+0xf7/0x10c [ehci_hcd]
+  [<ffffffffa0001140>] qh_completions+0x429/0x4bd [ehci_hcd]
+  [<ffffffffa000340a>] ehci_work+0x95/0x9c0 [ehci_hcd]
+  ...
+ ---[ end trace f29ac88a5a48c580 ]---
+ Mapped at:
+  [<ffffffff811faac4>] debug_dma_map_sg+0x45/0x139
+  [<ffffffff8137bc0b>] usb_hcd_map_urb_for_dma+0x22e/0x478
+  [<ffffffff8137c494>] usb_hcd_submit_urb+0x63f/0x6fa
+  [<ffffffff8137d01c>] usb_submit_urb+0x2c7/0x2de
+  [<ffffffff8137dcd4>] usb_sg_wait+0x55/0x161
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/core/hcd.c       |    5 ++---
+ drivers/usb/host/ehci-q.c    |    2 +-
+ drivers/usb/host/uhci-q.c    |    2 +-
+ drivers/usb/host/whci/qset.c |    4 ++--
+ drivers/usb/host/xhci-ring.c |    4 ++--
+ include/linux/usb.h          |    1 +
+ 6 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
+index 13222d3..179e364 100644
+--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
+@@ -1412,11 +1412,10 @@ int usb_hcd_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb,
+ 					ret = -EAGAIN;
+ 				else
+ 					urb->transfer_flags |= URB_DMA_MAP_SG;
+-				if (n != urb->num_sgs) {
+-					urb->num_sgs = n;
+				urb->num_mapped_sgs = n;
+				if (n != urb->num_sgs)
+ 					urb->transfer_flags |=
+ 							URB_DMA_SG_COMBINED;
+-				}
+ 			} else if (urb->sg) {
+ 				struct scatterlist *sg = urb->sg;
+ 				urb->transfer_dma = dma_map_page(
+diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
+index 4e4066c..fef1db3 100644
+--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
+@@ -647,7 +647,7 @@ qh_urb_transaction (
+ 	/*
+ 	 * data transfer stage:  buffer setup
+ 	 */
+-	i = urb->num_sgs;
+	i = urb->num_mapped_sgs;
+ 	if (len > 0 && i > 0) {
+ 		sg = urb->sg;
+ 		buf = sg_dma_address(sg);
+diff --git a/drivers/usb/host/uhci-q.c b/drivers/usb/host/uhci-q.c
+index f6ca80e..d2c6f5a 100644
+--- a/drivers/usb/host/uhci-q.c
+++ b/drivers/usb/host/uhci-q.c
+@@ -943,7 +943,7 @@ static int uhci_submit_common(struct uhci_hcd *uhci, struct urb *urb,
+ 	if (usb_pipein(urb->pipe))
+ 		status |= TD_CTRL_SPD;
+ 
+-	i = urb->num_sgs;
+	i = urb->num_mapped_sgs;
+ 	if (len > 0 && i > 0) {
+ 		sg = urb->sg;
+ 		data = sg_dma_address(sg);
+diff --git a/drivers/usb/host/whci/qset.c b/drivers/usb/host/whci/qset.c
+index a403b53..76083ae 100644
+--- a/drivers/usb/host/whci/qset.c
+++ b/drivers/usb/host/whci/qset.c
+@@ -443,7 +443,7 @@ static int qset_add_urb_sg(struct whc *whc, struct whc_qset *qset, struct urb *u
+ 
+ 	remaining = urb->transfer_buffer_length;
+ 
+-	for_each_sg(urb->sg, sg, urb->num_sgs, i) {
+	for_each_sg(urb->sg, sg, urb->num_mapped_sgs, i) {
+ 		dma_addr_t dma_addr;
+ 		size_t dma_remaining;
+ 		dma_addr_t sp, ep;
+@@ -561,7 +561,7 @@ static int qset_add_urb_sg_linearize(struct whc *whc, struct whc_qset *qset,
+ 
+ 	remaining = urb->transfer_buffer_length;
+ 
+-	for_each_sg(urb->sg, sg, urb->num_sgs, i) {
+	for_each_sg(urb->sg, sg, urb->num_mapped_sgs, i) {
+ 		size_t len;
+ 		size_t sg_remaining;
+ 		void *orig;
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 9f1d4b1..d28c586 100644
+--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
+@@ -2561,7 +2561,7 @@ static unsigned int count_sg_trbs_needed(struct xhci_hcd *xhci, struct urb *urb)
+ 	struct scatterlist *sg;
+ 
+ 	sg = NULL;
+-	num_sgs = urb->num_sgs;
+	num_sgs = urb->num_mapped_sgs;
+ 	temp = urb->transfer_buffer_length;
+ 
+ 	xhci_dbg(xhci, "count sg list trbs: \n");
+@@ -2745,7 +2745,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ 		return -EINVAL;
+ 
+ 	num_trbs = count_sg_trbs_needed(xhci, urb);
+-	num_sgs = urb->num_sgs;
+	num_sgs = urb->num_mapped_sgs;
+ 	total_packet_count = roundup(urb->transfer_buffer_length,
+ 			usb_endpoint_maxp(&urb->ep->desc));
+ 
+diff --git a/include/linux/usb.h b/include/linux/usb.h
+index 1cea207..7626e5a 100644
+--- a/include/linux/usb.h
+++ b/include/linux/usb.h
+@@ -1222,6 +1222,7 @@ struct urb {
+ 	void *transfer_buffer;		/* (in) associated data buffer */
+ 	dma_addr_t transfer_dma;	/* (in) dma addr for transfer_buffer */
+ 	struct scatterlist *sg;		/* (in) scatter gather buffer list */
+	int num_mapped_sgs;		/* (internal) mapped sg entries */
+ 	int num_sgs;			/* (in) number of entries in the sg list */
+ 	u32 transfer_buffer_length;	/* (in) data buffer length */
+ 	u32 actual_length;		/* (return) actual transfer length */
+-- 
+1.7.7.4
+
@@ -0,0 +1,62 @@
+From df0f4624e1225d9b7fb4d8934565418c81b42c04 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 4 Jan 2012 23:29:18 +0100
+Subject: [PATCH 42/49] xhci: Properly handle COMP_2ND_BW_ERR
+
+commit 71d85724bdd947a3b42a88d08af79f290a1a767b upstream.
+
+I encountered a result of COMP_2ND_BW_ERR while improving how the pwc
+webcam driver handles not having the full usb1 bandwidth available to
+itself.
+
+I created the following test setup, a NEC xhci controller with a
+single TT USB 2 hub plugged into it, with a usb keyboard and a pwc webcam
+plugged into the usb2 hub. This caused the following to show up in dmesg
+when trying to stream from the pwc camera at its highest alt setting:
+
+xhci_hcd 0000:01:00.0: ERROR: unexpected command completion code 0x23.
+usb 6-2.1: Not enough bandwidth for altsetting 9
+
+And usb_set_interface returned -EINVAL, which caused my pwc code to not
+do the right thing as it expected -ENOSPC.
+
+This patch makes the xhci driver properly handle COMP_2ND_BW_ERR and makes
+usb_set_interface return -ENOSPC as expected.
+
+This should be backported to stable kernels as old as 2.6.32.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/host/xhci.c |    1 +
+ drivers/usb/host/xhci.h |    1 -
+ 2 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index a1afb7c..36f9dd8 100644
+--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
+@@ -1620,6 +1620,7 @@ static int xhci_configure_endpoint_result(struct xhci_hcd *xhci,
+ 		/* FIXME: can we allocate more resources for the HC? */
+ 		break;
+ 	case COMP_BW_ERR:
+	case COMP_2ND_BW_ERR:
+ 		dev_warn(&udev->dev, "Not enough bandwidth "
+ 				"for new device state.\n");
+ 		ret = -ENOSPC;
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 3c8fbd2..09eda3a 100644
+--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
+@@ -1033,7 +1033,6 @@ struct xhci_transfer_event {
+ /* Invalid Stream ID Error */
+ #define COMP_STRID_ERR	34
+ /* Secondary Bandwidth Error - may be returned by a Configure Endpoint cmd */
+-/* FIXME - check for this */
+ #define COMP_2ND_BW_ERR	35
+ /* Split Transaction Error */
+ #define	COMP_SPLIT_ERR	36
+-- 
+1.7.7.4
+
@@ -0,0 +1,81 @@
+From db46f35cb2853ffa42157c7222335cae15eda7e0 Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <balbi@ti.com>
+Date: Mon, 2 Jan 2012 13:35:41 +0200
+Subject: [PATCH 43/49] usb: ch9: fix up MaxStreams helper
+
+commit 18b7ede5f7ee2092aedcb578d3ac30bd5d4fc23c upstream.
+
+[ removed the dwc3 portion of the patch as it didn't apply to
+older kernels - gregkh]
+
+According to USB 3.0 Specification Table 9-22, if
+bmAttributes [4:0] are set to zero, it means "no
+streams supported", but the way this helper was
+defined on Linux, we will *always* have one stream
+which might cause several problems.
+
+For example on DWC3, we would tell the controller
+endpoint has streams enabled and yet start transfers
+with Stream ID set to 0, which would goof up the host
+side.
+
+While doing that, convert the macro to an inline
+function due to the different checks we now need.
+
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/host/xhci.c |    3 +--
+ include/linux/usb/ch9.h |   20 +++++++++++++++++++-
+ 2 files changed, 20 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 36f9dd8..b33f059 100644
+--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
+@@ -2797,8 +2797,7 @@ static int xhci_calculate_streams_and_bitmask(struct xhci_hcd *xhci,
+ 		if (ret < 0)
+ 			return ret;
+ 
+-		max_streams = USB_SS_MAX_STREAMS(
+-				eps[i]->ss_ep_comp.bmAttributes);
+		max_streams = usb_ss_max_streams(&eps[i]->ss_ep_comp);
+ 		if (max_streams < (*num_streams - 1)) {
+ 			xhci_dbg(xhci, "Ep 0x%x only supports %u stream IDs.\n",
+ 					eps[i]->desc.bEndpointAddress,
+diff --git a/include/linux/usb/ch9.h b/include/linux/usb/ch9.h
+index d5da6c6..61b2905 100644
+--- a/include/linux/usb/ch9.h
+++ b/include/linux/usb/ch9.h
+@@ -605,8 +605,26 @@ struct usb_ss_ep_comp_descriptor {
+ } __attribute__ ((packed));
+ 
+ #define USB_DT_SS_EP_COMP_SIZE		6
+
+ /* Bits 4:0 of bmAttributes if this is a bulk endpoint */
+-#define USB_SS_MAX_STREAMS(p)		(1 << ((p) & 0x1f))
+static inline int
+usb_ss_max_streams(const struct usb_ss_ep_comp_descriptor *comp)
+{
+	int		max_streams;
+
+	if (!comp)
+		return 0;
+
+	max_streams = comp->bmAttributes & 0x1f;
+
+	if (!max_streams)
+		return 0;
+
+	max_streams = 1 << max_streams;
+
+	return max_streams;
+}
+
+ /* Bits 1:0 of bmAttributes if this is an isoc endpoint */
+ #define USB_SS_MULT(p)			(1 + ((p) & 0x3))
+ 
+-- 
+1.7.7.4
+
@@ -0,0 +1,37 @@
+From 53876956cbd176ad0da89ca8e066202f6c143ea8 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Mon, 9 Jan 2012 14:06:46 -0800
+Subject: [PATCH 44/49] igmp: Avoid zero delay when receiving odd mixture of
+ IGMP queries
+
+commit a8c1f65c79cbbb2f7da782d4c9d15639a9b94b27 upstream.
+
+Commit 5b7c84066733c5dfb0e4016d939757b38de189e4 ('ipv4: correct IGMP
+behavior on v3 query during v2-compatibility mode') added yet another
+case for query parsing, which can result in max_delay = 0.  Substitute
+a value of 1, as in the usual v3 case.
+
+Reported-by: Simon McVittie <smcv@debian.org>
+References: http://bugs.debian.org/654876
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ net/ipv4/igmp.c |    2 ++
+ 1 files changed, 2 insertions(+), 0 deletions(-)
+
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index b2ca095..c3cc64c 100644
+--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
+@@ -875,6 +875,8 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
+ 		 * to be intended in a v3 query.
+ 		 */
+ 		max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
+		if (!max_delay)
+			max_delay = 1;	/* can't mod w/ 0 */
+ 	} else { /* v3 */
+ 		if (!pskb_may_pull(skb, sizeof(struct igmpv3_query)))
+ 			return;
+-- 
+1.7.7.4
+
@@ -0,0 +1,38 @@
+From eaa03e7a01f7dd67773c27e82d446a44440843a6 Mon Sep 17 00:00:00 2001
+From: Aurelien Jacobs <aurel@gnuage.org>
+Date: Sat, 7 Jan 2012 12:15:16 -0800
+Subject: [PATCH 45/49] asix: fix infinite loop in rx_fixup()
+
+commit 6c15d74defd38e7e7f8805392578b7a1d508097e upstream.
+
+At this point if skb->len happens to be 2, the subsequant skb_pull(skb, 4)
+call won't work and the skb->len won't be decreased and won't ever reach 0,
+resulting in an infinite loop.
+
+With an ASIX 88772 under heavy load, without this patch, rx_fixup() reaches
+an infinite loop in less than a minute. With this patch applied,
+no infinite loop even after hours of heavy load.
+
+Signed-off-by: Aurelien Jacobs <aurel@gnuage.org>
+Cc: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/usb/asix.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
+index e95f0e6..dd2625a 100644
+--- a/drivers/net/usb/asix.c
+++ b/drivers/net/usb/asix.c
+@@ -376,7 +376,7 @@ static int asix_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ 
+ 		skb_pull(skb, (size + 1) & 0xfffe);
+ 
+-		if (skb->len == 0)
+		if (skb->len < sizeof(header))
+ 			break;
+ 
+ 		head = (u8 *) skb->data;
+-- 
+1.7.7.4
+
@@ -0,0 +1,68 @@
+From b40864c73fef3aefced0863fc2b3c3a7716d9f09 Mon Sep 17 00:00:00 2001
+From: stephen hemminger <shemminger@vyatta.com>
+Date: Sat, 31 Dec 2011 13:26:46 +0000
+Subject: [PATCH 46/49] bonding: fix error handling if slave is busy (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit f7d9821a6a9c83450ac35e76d3709e32fd38b76f upstream.
+
+If slave device already has a receive handler registered, then the
+error unwind of bonding device enslave function is broken.
+
+The following will leave a pointer to freed memory in the slave
+device list, causing a later kernel panic.
+# modprobe dummy
+# ip li add dummy0-1 link dummy0 type macvlan
+# modprobe bonding
+# echo +dummy0 >/sys/class/net/bond0/bonding/slaves
+
+The fix is to detach the slave (which removes it from the list)
+in the unwind path.
+
+Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
+Reviewed-by: Nicolas de Pesloüan <nicolas.2p.debian@free.fr>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/bonding/bond_main.c |    9 +++++++--
+ 1 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 7f87568..e58aa2b 100644
+--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
+@@ -1822,7 +1822,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
+ 				 "but new slave device does not support netpoll.\n",
+ 				 bond_dev->name);
+ 			res = -EBUSY;
+-			goto err_close;
+			goto err_detach;
+ 		}
+ 	}
+ #endif
+@@ -1831,7 +1831,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
+ 
+ 	res = bond_create_slave_symlinks(bond_dev, slave_dev);
+ 	if (res)
+-		goto err_close;
+		goto err_detach;
+ 
+ 	res = netdev_rx_handler_register(slave_dev, bond_handle_frame,
+ 					 new_slave);
+@@ -1852,6 +1852,11 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
+ err_dest_symlinks:
+ 	bond_destroy_slave_symlinks(bond_dev, slave_dev);
+ 
+err_detach:
+	write_lock_bh(&bond->lock);
+	bond_detach_slave(bond, new_slave);
+	write_unlock_bh(&bond->lock);
+
+ err_close:
+ 	dev_close(slave_dev);
+ 
+-- 
+1.7.7.4
+
@@ -0,0 +1,54 @@
+From 9d3898fe46309ee5688697d1a65975208dc49639 Mon Sep 17 00:00:00 2001
+From: Thilo-Alexander Ginkel <thilo@ginkel.com>
+Date: Sat, 17 Dec 2011 10:55:10 +0100
+Subject: [PATCH 47/49] usb: cdc-acm: Fix acm_tty_hangup() vs. acm_tty_close()
+ race
+
+[Not upstream as it was fixed differently for 3.3 with a much more
+"intrusive" rework of the driver - gregkh]
+
+There is a race condition involving acm_tty_hangup() and acm_tty_close()
+where hangup() would attempt to access tty->driver_data without proper
+locking and NULL checking after close() has potentially already set it
+to NULL.  One possibility to (sporadically) trigger this behavior is to
+perform a suspend/resume cycle with a running WWAN data connection.
+
+This patch addresses the issue by introducing a NULL check for
+tty->driver_data in acm_tty_hangup() protected by open_mutex and exiting
+gracefully when hangup() is invoked on a device that has already been
+closed.
+
+Signed-off-by: Thilo-Alexander Ginkel <thilo@ginkel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/usb/class/cdc-acm.c |   12 ++++++++++--
+ 1 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index ea5e487..e61d9c4 100644
+--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
+@@ -554,10 +554,18 @@ static void acm_port_down(struct acm *acm)
+ 
+ static void acm_tty_hangup(struct tty_struct *tty)
+ {
+-	struct acm *acm = tty->driver_data;
+-	tty_port_hangup(&acm->port);
+	struct acm *acm;
+
+ 	mutex_lock(&open_mutex);
+	acm = tty->driver_data;
+
+	if (!acm)
+		goto out;
+
+	tty_port_hangup(&acm->port);
+ 	acm_port_down(acm);
+
+out:
+ 	mutex_unlock(&open_mutex);
+ }
+ 
+-- 
+1.7.7.4
+
@@ -0,0 +1,34 @@
+From 5af63c5af9a335ff2af8d6b84d512e92ac522995 Mon Sep 17 00:00:00 2001
+From: Xi Wang <xi.wang@gmail.com>
+Date: Mon, 12 Dec 2011 21:55:52 +0000
+Subject: [PATCH 48/49] xfs: fix acl count validation in xfs_acl_from_disk()
+
+commit 093019cf1b18dd31b2c3b77acce4e000e2cbc9ce upstream.
+
+Commit fa8b18ed didn't prevent the integer overflow and possible
+memory corruption.  "count" can go negative and bypass the check.
+
+Signed-off-by: Xi Wang <xi.wang@gmail.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Ben Myers <bpm@sgi.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ fs/xfs/xfs_acl.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/fs/xfs/xfs_acl.c b/fs/xfs/xfs_acl.c
+index 76e4266..ac702a6 100644
+--- a/fs/xfs/xfs_acl.c
+++ b/fs/xfs/xfs_acl.c
+@@ -39,7 +39,7 @@ xfs_acl_from_disk(struct xfs_acl *aclp)
+ 	struct posix_acl_entry *acl_e;
+ 	struct posix_acl *acl;
+ 	struct xfs_acl_entry *ace;
+-	int count, i;
+	unsigned int count, i;
+ 
+ 	count = be32_to_cpu(aclp->acl_cnt);
+ 	if (count > XFS_ACL_MAX_ENTRIES)
+-- 
+1.7.7.4
+
@@ -0,0 +1,24 @@
+From 78d772bb92fa633fc41d234887b050dce88542bc Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@suse.de>
+Date: Thu, 12 Jan 2012 11:42:45 -0800
+Subject: [PATCH 49/49] Linux 3.2.1
+
+---
+ Makefile |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index adddd11..c5edffa 100644
+--- a/Makefile
+++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 0
+SUBLEVEL = 1
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+ 
+-- 
+1.7.7.4
+