2.6.32-stable patches

added patches:
	mmc-cb710-core-add-missing-spin_lock_init-for-irq_lock-of-struct-cb710_chip.patch
	staging-android-binder-don-t-call-dump_stack-in-binder_vma_open.patch
	staging-android-binder-fix-crashes-when-sharing-a-binder-file-between-processes.patch
	staging-asus_oled-fix-image-processing.patch
	usb-gadget-zero-fix-bug-in-loopback-autoresume-handling.patch
	usb-skip-pci-usb-quirk-handling-for-netlogic-xlp.patch
	usb-usbserial-add-new-pid-number-0xa951-to-the-ftdi-driver.patch

8 files changed, 333 insertions, 0 deletions

diff --git a/queue-2.6.32/mmc-cb710-core-add-missing-spin_lock_init-for-irq_lock-of-struct-cb710_chip.patch b/queue-2.6.32/mmc-cb710-core-add-missing-spin_lock_init-for-irq_lock-of-struct-cb710_chip.patch
new file mode 100644
index 0000000..cde15ce
--- /dev/null
+++ b/queue-2.6.32/mmc-cb710-core-add-missing-spin_lock_init-for-irq_lock-of-struct-cb710_chip.patch
@@ -0,0 +1,30 @@
+From b5266ea675c5a041e2852c7ccec4cf2d4f5e0cf4 Mon Sep 17 00:00:00 2001
+From: Axel Lin <axel.lin@gmail.com>
+Date: Wed, 1 Feb 2012 12:31:47 +0800
+Subject: mmc: cb710 core: Add missing spin_lock_init for irq_lock of struct cb710_chip
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Axel Lin <axel.lin@gmail.com>
+
+commit b5266ea675c5a041e2852c7ccec4cf2d4f5e0cf4 upstream.
+
+Signed-off-by: Axel Lin <axel.lin@gmail.com>
+Acked-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/cb710/core.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/misc/cb710/core.c
++++ b/drivers/misc/cb710/core.c
+@@ -244,6 +244,7 @@ static int __devinit cb710_probe(struct
+ 	if (err)
+ 		return err;
+ 
++	spin_lock_init(&chip->irq_lock);
+ 	chip->pdev = pdev;
+ 	chip->iobase = pcim_iomap_table(pdev)[0];
+ 
diff --git a/queue-2.6.32/series b/queue-2.6.32/series
index d643618..afd0f44 100644
--- a/queue-2.6.32/series
+++ b/queue-2.6.32/series
@@ -10,3 +10,10 @@ udf-mark-lvid-buffer-as-uptodate-before-marking-it-dirty.patch
 drm-i915-fix-tv-out-refresh-rate.patch
 ecryptfs-infinite-loop-due-to-overflow-in-ecryptfs_write.patch
 atmel_lcdfb-fix-usage-of-contrast_ctr-in-suspend-resume.patch
+staging-asus_oled-fix-image-processing.patch
+staging-android-binder-don-t-call-dump_stack-in-binder_vma_open.patch
+staging-android-binder-fix-crashes-when-sharing-a-binder-file-between-processes.patch
+usb-gadget-zero-fix-bug-in-loopback-autoresume-handling.patch
+usb-skip-pci-usb-quirk-handling-for-netlogic-xlp.patch
+usb-usbserial-add-new-pid-number-0xa951-to-the-ftdi-driver.patch
+mmc-cb710-core-add-missing-spin_lock_init-for-irq_lock-of-struct-cb710_chip.patch
diff --git a/queue-2.6.32/staging-android-binder-don-t-call-dump_stack-in-binder_vma_open.patch b/queue-2.6.32/staging-android-binder-don-t-call-dump_stack-in-binder_vma_open.patch
new file mode 100644
index 0000000..f57463c
--- /dev/null
+++ b/queue-2.6.32/staging-android-binder-don-t-call-dump_stack-in-binder_vma_open.patch
@@ -0,0 +1,34 @@
+From 3c1b86f17068cf6476fb2d022b9c8b44dedea2e5 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@android.com>
+Date: Fri, 20 Jan 2012 19:56:21 -0800
+Subject: Staging: android: binder: Don't call dump_stack in binder_vma_open
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arve Hjønnevåg <arve@android.com>
+
+commit 3c1b86f17068cf6476fb2d022b9c8b44dedea2e5 upstream.
+
+If user-space partially unmaps the driver, binder_vma_open
+would dump the kernel stack. This is not a kernel bug however
+and will be treated as if the whole area was unmapped once
+binder_vma_close gets called.
+
+Signed-off-by: Arve Hjønnevåg <arve@android.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/android/binder.c |    1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/staging/android/binder.c
++++ b/drivers/staging/android/binder.c
+@@ -2741,7 +2741,6 @@ static void binder_vma_open(struct vm_ar
+ 		     proc->pid, vma->vm_start, vma->vm_end,
+ 		     (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
+ 		     (unsigned long)pgprot_val(vma->vm_page_prot));
+-	dump_stack();
+ }
+ 
+ static void binder_vma_close(struct vm_area_struct *vma)
diff --git a/queue-2.6.32/staging-android-binder-fix-crashes-when-sharing-a-binder-file-between-processes.patch b/queue-2.6.32/staging-android-binder-fix-crashes-when-sharing-a-binder-file-between-processes.patch
new file mode 100644
index 0000000..be8c1f6
--- /dev/null
+++ b/queue-2.6.32/staging-android-binder-fix-crashes-when-sharing-a-binder-file-between-processes.patch
@@ -0,0 +1,89 @@
+From bd1eff9741af27378b241b347041c724bb28e857 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@android.com>
+Date: Wed, 1 Feb 2012 15:29:13 -0800
+Subject: Staging: android: binder: Fix crashes when sharing a binder file between processes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arve Hjønnevåg <arve@android.com>
+
+commit bd1eff9741af27378b241b347041c724bb28e857 upstream.
+
+Opening the binder driver and sharing the file returned with
+other processes (e.g. by calling fork) can crash the kernel.
+Prevent these crashes with the following changes:
+- Add a mutex to protect against two processes mmapping the
+  same binder_proc.
+- After locking mmap_sem, check that the vma we want to access
+  (still) points to the same mm_struct.
+- Use proc->tsk instead of current to get the files struct since
+  this is where we get the rlimit from.
+
+Signed-off-by: Arve Hjønnevåg <arve@android.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/android/binder.c |   12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/android/binder.c
++++ b/drivers/staging/android/binder.c
+@@ -36,6 +36,7 @@
+ 
+ static DEFINE_MUTEX(binder_lock);
+ static DEFINE_MUTEX(binder_deferred_lock);
++static DEFINE_MUTEX(binder_mmap_lock);
+ 
+ static HLIST_HEAD(binder_procs);
+ static HLIST_HEAD(binder_deferred_list);
+@@ -614,6 +615,11 @@ static int binder_update_page_range(stru
+ 	if (mm) {
+ 		down_write(&mm->mmap_sem);
+ 		vma = proc->vma;
++		if (vma && mm != vma->vm_mm) {
++			pr_err("binder: %d: vma mm and task mm mismatch\n",
++				proc->pid);
++			vma = NULL;
++		}
+ 	}
+ 
+ 	if (allocate == 0)
+@@ -2784,6 +2790,7 @@ static int binder_mmap(struct file *filp
+ 	}
+ 	vma->vm_flags = (vma->vm_flags | VM_DONTCOPY) & ~VM_MAYWRITE;
+ 
++	mutex_lock(&binder_mmap_lock);
+ 	if (proc->buffer) {
+ 		ret = -EBUSY;
+ 		failure_string = "already mapped";
+@@ -2798,6 +2805,7 @@ static int binder_mmap(struct file *filp
+ 	}
+ 	proc->buffer = area->addr;
+ 	proc->user_buffer_offset = vma->vm_start - (uintptr_t)proc->buffer;
++	mutex_unlock(&binder_mmap_lock);
+ 
+ #ifdef CONFIG_CPU_CACHE_VIPT
+ 	if (cache_is_vipt_aliasing()) {
+@@ -2830,7 +2838,7 @@ static int binder_mmap(struct file *filp
+ 	binder_insert_free_buffer(proc, buffer);
+ 	proc->free_async_space = proc->buffer_size / 2;
+ 	barrier();
+-	proc->files = get_files_struct(current);
++	proc->files = get_files_struct(proc->tsk);
+ 	proc->vma = vma;
+ 
+ 	/*printk(KERN_INFO "binder_mmap: %d %lx-%lx maps %p\n",
+@@ -2841,10 +2849,12 @@ err_alloc_small_buf_failed:
+ 	kfree(proc->pages);
+ 	proc->pages = NULL;
+ err_alloc_pages_failed:
++	mutex_lock(&binder_mmap_lock);
+ 	vfree(proc->buffer);
+ 	proc->buffer = NULL;
+ err_get_vm_area_failed:
+ err_already_mapped:
++	mutex_unlock(&binder_mmap_lock);
+ err_bad_arg:
+ 	printk(KERN_ERR "binder_mmap: %d %lx-%lx %s failed %d\n",
+ 	       proc->pid, vma->vm_start, vma->vm_end, failure_string, ret);
diff --git a/queue-2.6.32/staging-asus_oled-fix-image-processing.patch b/queue-2.6.32/staging-asus_oled-fix-image-processing.patch
new file mode 100644
index 0000000..d9cdba0
--- /dev/null
+++ b/queue-2.6.32/staging-asus_oled-fix-image-processing.patch
@@ -0,0 +1,57 @@
+From 635032cb397b396241372fa0ff36ae758e658b23 Mon Sep 17 00:00:00 2001
+From: Pekka Paalanen <pq@iki.fi>
+Date: Sun, 22 Jan 2012 16:33:46 +0200
+Subject: Staging: asus_oled: fix image processing
+
+From: Pekka Paalanen <pq@iki.fi>
+
+commit 635032cb397b396241372fa0ff36ae758e658b23 upstream.
+
+Programming an image was broken, because odev->buf_offs was not advanced
+for val == 0 in append_values(). This regression was introduced in:
+
+ commit 1ff12a4aa354bed093a0240d5e6347b1e27601bc
+ Author: Kevin A. Granade <kevin.granade@gmail.com>
+ Date:   Sat Sep 5 01:03:39 2009 -0500
+
+     Staging: asus_oled: Cleaned up checkpatch issues.
+
+Fix the image processing by special-casing val == 0.
+
+I have tested this change on an Asus G50V laptop only.
+
+Cc: Jakub Schmidtke <sjakub@gmail.com>
+Cc: Kevin A. Granade <kevin.granade@gmail.com>
+Signed-off-by: Pekka Paalanen <pq@iki.fi>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/asus_oled/asus_oled.c |   10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/asus_oled/asus_oled.c
++++ b/drivers/staging/asus_oled/asus_oled.c
+@@ -349,7 +349,14 @@ static void send_data(struct asus_oled_d
+ 
+ static int append_values(struct asus_oled_dev *odev, uint8_t val, size_t count)
+ {
+-	while (count-- > 0 && val) {
++	odev->last_val = val;
++
++	if (val == 0) {
++		odev->buf_offs += count;
++		return 0;
++	}
++
++	while (count-- > 0) {
+ 		size_t x = odev->buf_offs % odev->width;
+ 		size_t y = odev->buf_offs / odev->width;
+ 		size_t i;
+@@ -400,7 +407,6 @@ static int append_values(struct asus_ole
+ 			;
+ 		}
+ 
+-		odev->last_val = val;
+ 		odev->buf_offs++;
+ 	}
+ 
diff --git a/queue-2.6.32/usb-gadget-zero-fix-bug-in-loopback-autoresume-handling.patch b/queue-2.6.32/usb-gadget-zero-fix-bug-in-loopback-autoresume-handling.patch
new file mode 100644
index 0000000..2a64648
--- /dev/null
+++ b/queue-2.6.32/usb-gadget-zero-fix-bug-in-loopback-autoresume-handling.patch
@@ -0,0 +1,33 @@
+From 683da59d7b8ae04891636d4b59893cd4e9b0b7e5 Mon Sep 17 00:00:00 2001
+From: Timo Juhani Lindfors <timo.lindfors@iki.fi>
+Date: Sun, 29 Jan 2012 16:12:13 +0200
+Subject: usb: gadget: zero: fix bug in loopback autoresume handling
+
+From: Timo Juhani Lindfors <timo.lindfors@iki.fi>
+
+commit 683da59d7b8ae04891636d4b59893cd4e9b0b7e5 upstream.
+
+ab943a2e125b (USB: gadget: gadget zero uses new suspend/resume hooks)
+introduced a copy-paste error where f_loopback.c writes to a variable
+declared in f_sourcesink.c. This prevents one from creating gadgets
+that only have a loopback function.
+
+Signed-off-by: Timo Juhani Lindfors <timo.lindfors@iki.fi>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/f_loopback.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/f_loopback.c
++++ b/drivers/usb/gadget/f_loopback.c
+@@ -373,7 +373,7 @@ int __init loopback_add(struct usb_compo
+ 
+ 	/* support autoresume for remote wakeup testing */
+ 	if (autoresume)
+-		sourcesink_driver.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
++		loopback_driver.bmAttributes |= USB_CONFIG_ATT_WAKEUP;
+ 
+ 	/* support OTG systems */
+ 	if (gadget_is_otg(cdev->gadget)) {
diff --git a/queue-2.6.32/usb-skip-pci-usb-quirk-handling-for-netlogic-xlp.patch b/queue-2.6.32/usb-skip-pci-usb-quirk-handling-for-netlogic-xlp.patch
new file mode 100644
index 0000000..5a997ac
--- /dev/null
+++ b/queue-2.6.32/usb-skip-pci-usb-quirk-handling-for-netlogic-xlp.patch
@@ -0,0 +1,43 @@
+From e4436a7c17ac2b5e138f93f83a541cba9b311685 Mon Sep 17 00:00:00 2001
+From: Jayachandran C <jayachandranc@netlogicmicro.com>
+Date: Fri, 27 Jan 2012 20:27:32 +0530
+Subject: usb: Skip PCI USB quirk handling for Netlogic XLP
+
+From: Jayachandran C <jayachandranc@netlogicmicro.com>
+
+commit e4436a7c17ac2b5e138f93f83a541cba9b311685 upstream.
+
+The Netlogic XLP SoC's on-chip USB controller appears as a PCI
+USB device, but does not need the EHCI/OHCI handoff done in
+usb/host/pci-quirks.c.
+
+The pci-quirks.c is enabled for all vendors and devices, and is
+enabled if USB and PCI are configured.
+
+If we do not skip the qurik handling on XLP, the readb() call in
+ehci_bios_handoff() will cause a crash since byte access is not
+supported for EHCI registers in XLP.
+
+Signed-off-by: Jayachandran C <jayachandranc@netlogicmicro.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/pci-quirks.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -498,6 +498,12 @@ hc_init:
+ 
+ static void __devinit quirk_usb_early_handoff(struct pci_dev *pdev)
+ {
++	/* Skip Netlogic mips SoC's internal PCI USB controller.
++	 * This device does not need/support EHCI/OHCI handoff
++	 */
++	if (pdev->vendor == 0x184e)	/* vendor Netlogic */
++		return;
++
+ 	if (pdev->class == PCI_CLASS_SERIAL_USB_UHCI)
+ 		quirk_usb_handoff_uhci(pdev);
+ 	else if (pdev->class == PCI_CLASS_SERIAL_USB_OHCI)
diff --git a/queue-2.6.32/usb-usbserial-add-new-pid-number-0xa951-to-the-ftdi-driver.patch b/queue-2.6.32/usb-usbserial-add-new-pid-number-0xa951-to-the-ftdi-driver.patch
new file mode 100644
index 0000000..36ec7fd
--- /dev/null
+++ b/queue-2.6.32/usb-usbserial-add-new-pid-number-0xa951-to-the-ftdi-driver.patch
@@ -0,0 +1,40 @@
+From 90451e6973a5da155c6f315a409ca0a8d3ce6b76 Mon Sep 17 00:00:00 2001
+From: Milan Kocian <milon@wq.cz>
+Date: Fri, 3 Feb 2012 14:28:00 +0100
+Subject: USB: usbserial: add new PID number (0xa951) to the ftdi driver
+
+From: Milan Kocian <milon@wq.cz>
+
+commit 90451e6973a5da155c6f315a409ca0a8d3ce6b76 upstream.
+
+Signed-off-by: Milan Kocian <milon@wq.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c     |    1 +
+ drivers/usb/serial/ftdi_sio_ids.h |    7 +++++++
+ 2 files changed, 8 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -840,6 +840,7 @@ static struct usb_device_id id_table_com
+ 	{ USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_LOGBOOKML_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_LS_LOGBOOK_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_HS_LOGBOOK_PID) },
++	{ USB_DEVICE(FTDI_VID, FTDI_CINTERION_MC55I_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_DOTEC_PID) },
+ 	{ USB_DEVICE(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID),
+ 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -1192,3 +1192,10 @@
+  */
+ /* ZigBee controller */
+ #define FTDI_RF_R106		0x8A28
++
++/*
++ * Product: HCP HIT GPRS modem
++ * Manufacturer: HCP d.o.o.
++ * ATI command output: Cinterion MC55i
++ */
++#define FTDI_CINTERION_MC55I_PID	0xA951