3.6.8-1.fc17.gnu

23 files changed, 704 insertions, 533 deletions

diff --git a/freed-ora/current/f17/8139cp-revert-set-ring-address-before-enabling-recei.patch b/freed-ora/current/f17/8139cp-revert-set-ring-address-before-enabling-recei.patch
new file mode 100644
index 000000000..d9ca2f2a7
--- /dev/null
+++ b/freed-ora/current/f17/8139cp-revert-set-ring-address-before-enabling-recei.patch
@@ -0,0 +1,62 @@
+From b26623dab7eeb1e9f5898c7a49458789dd492f20 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?fran=C3=A7ois=20romieu?= <romieu@fr.zoreil.com>
+Date: Wed, 21 Nov 2012 10:07:29 +0000
+Subject: [PATCH] 8139cp: revert "set ring address before enabling receiver"
+
+This patch reverts b01af4579ec41f48e9b9c774e70bd6474ad210db.
+
+The original patch was tested with emulated hardware. Real
+hardware chokes.
+
+Fixes https://bugzilla.kernel.org/show_bug.cgi?id=47041
+
+Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
+Acked-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/realtek/8139cp.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
+index 1c81825..b01f83a 100644
+--- a/drivers/net/ethernet/realtek/8139cp.c
++++ b/drivers/net/ethernet/realtek/8139cp.c
+@@ -979,17 +979,6 @@ static void cp_init_hw (struct cp_private *cp)
+ 	cpw32_f (MAC0 + 0, le32_to_cpu (*(__le32 *) (dev->dev_addr + 0)));
+ 	cpw32_f (MAC0 + 4, le32_to_cpu (*(__le32 *) (dev->dev_addr + 4)));
+ 
+-	cpw32_f(HiTxRingAddr, 0);
+-	cpw32_f(HiTxRingAddr + 4, 0);
+-
+-	ring_dma = cp->ring_dma;
+-	cpw32_f(RxRingAddr, ring_dma & 0xffffffff);
+-	cpw32_f(RxRingAddr + 4, (ring_dma >> 16) >> 16);
+-
+-	ring_dma += sizeof(struct cp_desc) * CP_RX_RING_SIZE;
+-	cpw32_f(TxRingAddr, ring_dma & 0xffffffff);
+-	cpw32_f(TxRingAddr + 4, (ring_dma >> 16) >> 16);
+-
+ 	cp_start_hw(cp);
+ 	cpw8(TxThresh, 0x06); /* XXX convert magic num to a constant */
+ 
+@@ -1003,6 +992,17 @@ static void cp_init_hw (struct cp_private *cp)
+ 
+ 	cpw8(Config5, cpr8(Config5) & PMEStatus);
+ 
++	cpw32_f(HiTxRingAddr, 0);
++	cpw32_f(HiTxRingAddr + 4, 0);
++
++	ring_dma = cp->ring_dma;
++	cpw32_f(RxRingAddr, ring_dma & 0xffffffff);
++	cpw32_f(RxRingAddr + 4, (ring_dma >> 16) >> 16);
++
++	ring_dma += sizeof(struct cp_desc) * CP_RX_RING_SIZE;
++	cpw32_f(TxRingAddr, ring_dma & 0xffffffff);
++	cpw32_f(TxRingAddr + 4, (ring_dma >> 16) >> 16);
++
+ 	cpw16(MultiIntr, 0);
+ 
+ 	cpw8_f(Cfg9346, Cfg9346_Lock);
+-- 
+1.8.0
+
diff --git a/freed-ora/current/f17/SCSI-mvsas-Fix-oops-when-ata-commond-timeout.patch b/freed-ora/current/f17/SCSI-mvsas-Fix-oops-when-ata-commond-timeout.patch
new file mode 100644
index 000000000..0d83e8d03
--- /dev/null
+++ b/freed-ora/current/f17/SCSI-mvsas-Fix-oops-when-ata-commond-timeout.patch
@@ -0,0 +1,102 @@
+From 95ab000388974d8ffef8257306b4be6e8778b768 Mon Sep 17 00:00:00 2001
+From: Jianpeng Ma <majianpeng@gmail.com>
+Date: Sat, 4 Aug 2012 10:34:14 +0800
+Subject: [PATCH] [SCSI] mvsas: Fix oops when ata commond timeout.
+
+Kernel message follows:
+
+[  511.712011] sd 11:0:0:0: [sdf] command ffff8800a4e81400 timed out
+[  511.712022] sas: Enter sas_scsi_recover_host busy: 1 failed: 1
+[  511.712024] sas: trying to find task 0xffff8800a4d24c80
+[  511.712026] sas: sas_scsi_find_task: aborting task 0xffff8800a4d24c80
+[  511.712029] drivers/scsi/mvsas/mv_sas.c 1631:mvs_abort_task()
+mvi=ffff8800b5300000 task=ffff8800a4d24c80 slot=ffff8800b5325038
+slot_idx=x0
+[  511.712035] BUG: unable to handle kernel NULL pointer dereference at
+0000000000000058
+[  511.712040] IP: [<ffffffff815f8c0c>] _raw_spin_lock_irqsave+0xc/0x30
+[  511.712047] PGD 0
+[  511.712049] Oops: 0002 [#1] SMP
+[  511.712052] Modules linked in: mvsas libsas scsi_transport_sas
+raid456 async_pq async_xor xor async_memcpy async_raid6_recov raid6_pq
+async_tx [last unloaded: mvsas]
+[  511.712062] CPU 3
+[  511.712066] Pid: 7322, comm: scsi_eh_11 Not tainted 3.5.0+ #106 To Be
+Filled By O.E.M. To Be Filled By O.E.M./To be filled by O.E.M.
+[  511.712068] RIP: 0010:[<ffffffff815f8c0c>]  [<ffffffff815f8c0c>]
+_raw_spin_lock_irqsave+0xc/0x30
+[  511.712073] RSP: 0018:ffff880098d3bcb0  EFLAGS: 00010086
+[  511.712074] RAX: 0000000000000286 RBX: 0000000000000058 RCX:
+00000000000000c3
+[  511.712076] RDX: 0000000000000100 RSI: 0000000000000046 RDI:
+0000000000000058
+[  511.712078] RBP: ffff880098d3bcb0 R08: 000000000000000a R09:
+0000000000000000
+[  511.712080] R10: 00000000000004e8 R11: 00000000000004e7 R12:
+ffff8800a4d24c80
+[  511.712082] R13: 0000000000000050 R14: ffff8800b5325038 R15:
+ffff8800a4eafe00
+[  511.712084] FS:  0000000000000000(0000) GS:ffff8800bdb80000(0000)
+knlGS:0000000000000000
+[  511.712086] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+[  511.712088] CR2: 0000000000000058 CR3: 00000000a4ce6000 CR4:
+00000000000407e0
+[  511.712090] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
+0000000000000000
+[  511.712091] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7:
+0000000000000400
+[  511.712093] Process scsi_eh_11 (pid: 7322, threadinfo
+ffff880098d3a000, task ffff8800a61dde40)
+[  511.712095] Stack:
+[  511.712096]  ffff880098d3bce0 ffffffff81060683 ffff880000000000
+0000000000000000
+[  511.712099]  ffff8800a4d24c80 ffff8800b5300000 ffff880098d3bcf0
+ffffffffa0076a88
+[  511.712102]  ffff880098d3bd50 ffffffffa0079bb5 ffff880000000000
+ffff880000000018
+[  511.712106] Call Trace:
+[  511.712110]  [<ffffffff81060683>] complete+0x23/0x60
+[  511.712115]  [<ffffffffa0076a88>] mvs_tmf_timedout+0x18/0x20 [mvsas]
+[  511.712119]  [<ffffffffa0079bb5>] mvs_slot_complete+0x765/0x7d0
+[mvsas]
+[  511.712125]  [<ffffffffa005a17d>] sas_scsi_recover_host+0x55d/0xdb0
+[libsas]
+[  511.712128]  [<ffffffff8106d600>] ? idle_balance+0xe0/0x130
+[  511.712133]  [<ffffffff813b150c>] scsi_error_handler+0xcc/0x470
+[  511.712136]  [<ffffffff815f7ad0>] ? __schedule+0x370/0x730
+[  511.712139]  [<ffffffff8105f728>] ? __wake_up_common+0x58/0x90
+[  511.712142]  [<ffffffff813b1440>] ? scsi_eh_get_sense+0x110/0x110
+[  511.712146]  [<ffffffff810571be>] kthread+0x8e/0xa0
+[  511.712150]  [<ffffffff816015f4>] kernel_thread_helper+0x4/0x10
+[  511.712153]  [<ffffffff81057130>] ? flush_kthread_work+0x120/0x120
+[  511.712156]  [<ffffffff816015f0>] ? gs_change+0xb/0xb
+[  511.712157] Code: 8a 00 01 00 00 89 d0 f0 66 0f b1 0f 66 39 d0 0f 94
+c0 0f b6 c0 5d c3 0f 1f 84 00 00 00 00 00 55 48 89 e5 9c 58 fa ba 00 01
+00 00 <f0> 66 0f c1 17 0f b6 ce 38 d1 74 11 0f 1f 84 00 00 00 00 00 f3
+[  511.712191] RIP  [<ffffffff815f8c0c>] _raw_spin_lock_irqsave+0xc/0x30
+[  511.712194]  RSP <ffff880098d3bcb0>
+[  511.712196] CR2: 0000000000000058
+[  511.712198] ---[ end trace a781c7b1e65db92c ]---
+
+Signed-off-by: Jianpeng Ma <majianpeng@gmail.com>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+---
+ drivers/scsi/mvsas/mv_sas.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c
+index 4539d59..a3776d6 100644
+--- a/drivers/scsi/mvsas/mv_sas.c
++++ b/drivers/scsi/mvsas/mv_sas.c
+@@ -1629,7 +1629,7 @@ int mvs_abort_task(struct sas_task *task)
+ 			mv_dprintk("mvs_abort_task() mvi=%p task=%p "
+ 				   "slot=%p slot_idx=x%x\n",
+ 				   mvi, task, slot, slot_idx);
+-			mvs_tmf_timedout((unsigned long)task);
++			task->task_state_flags |= SAS_TASK_STATE_ABORTED;
+ 			mvs_slot_task_free(mvi, task, slot, slot_idx);
+ 			rc = TMF_RESP_FUNC_COMPLETE;
+ 			goto out;
+-- 
+1.8.0
+
diff --git a/freed-ora/current/f17/arm-alignment-faults.patch b/freed-ora/current/f17/arm-alignment-faults.patch
new file mode 100644
index 000000000..d386a5c3e
--- /dev/null
+++ b/freed-ora/current/f17/arm-alignment-faults.patch
@@ -0,0 +1,127 @@
+ arch/arm/kernel/traps.c |   34 +++++++---------------------------
+ arch/arm/mm/alignment.c |   11 ++++-------
+ 2 files changed, 11 insertions(+), 34 deletions(-)
+
+diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
+index b0179b8..62f429e 100644
+--- a/arch/arm/kernel/traps.c
++++ b/arch/arm/kernel/traps.c
+@@ -89,17 +89,8 @@ static void dump_mem(const char *lvl, const char *str, unsigned long bottom,
+ 		     unsigned long top)
+ {
+ 	unsigned long first;
+-	mm_segment_t fs;
+ 	int i;
+ 
+-	/*
+-	 * We need to switch to kernel mode so that we can use __get_user
+-	 * to safely read from kernel space.  Note that we now dump the
+-	 * code first, just in case the backtrace kills us.
+-	 */
+-	fs = get_fs();
+-	set_fs(KERNEL_DS);
+-
+ 	printk("%s%s(0x%08lx to 0x%08lx)\n", lvl, str, bottom, top);
+ 
+ 	for (first = bottom & ~31; first < top; first += 32) {
+@@ -112,7 +103,7 @@ static void dump_mem(const char *lvl, const char *str, unsigned long bottom,
+ 		for (p = first, i = 0; i < 8 && p < top; i++, p += 4) {
+ 			if (p >= bottom && p < top) {
+ 				unsigned long val;
+-				if (__get_user(val, (unsigned long *)p) == 0)
++				if (probe_kernel_address(p, val) == 0)
+ 					sprintf(str + i * 9, " %08lx", val);
+ 				else
+ 					sprintf(str + i * 9, " ????????");
+@@ -120,8 +111,6 @@ static void dump_mem(const char *lvl, const char *str, unsigned long bottom,
+ 		}
+ 		printk("%s%04lx:%s\n", lvl, first & 0xffff, str);
+ 	}
+-
+-	set_fs(fs);
+ }
+ 
+ static void dump_instr(const char *lvl, struct pt_regs *regs)
+@@ -129,25 +118,18 @@ static void dump_instr(const char *lvl, struct pt_regs *regs)
+ 	unsigned long addr = instruction_pointer(regs);
+ 	const int thumb = thumb_mode(regs);
+ 	const int width = thumb ? 4 : 8;
+-	mm_segment_t fs;
+ 	char str[sizeof("00000000 ") * 5 + 2 + 1], *p = str;
+ 	int i;
+ 
+-	/*
+-	 * We need to switch to kernel mode so that we can use __get_user
+-	 * to safely read from kernel space.  Note that we now dump the
+-	 * code first, just in case the backtrace kills us.
+-	 */
+-	fs = get_fs();
+-	set_fs(KERNEL_DS);
+-
+ 	for (i = -4; i < 1 + !!thumb; i++) {
+ 		unsigned int val, bad;
+ 
+-		if (thumb)
+-			bad = __get_user(val, &((u16 *)addr)[i]);
+-		else
+-			bad = __get_user(val, &((u32 *)addr)[i]);
++		if (thumb) {
++			u16 instr;
++			bad = probe_kernel_address(addr, instr);
++			val = instr;
++		} else
++			bad = probe_kernel_address(addr, val);
+ 
+ 		if (!bad)
+ 			p += sprintf(p, i == 0 ? "(%0*x) " : "%0*x ",
+@@ -158,8 +140,6 @@ static void dump_instr(const char *lvl, struct pt_regs *regs)
+ 		}
+ 	}
+ 	printk("%sCode: %s\n", lvl, str);
+-
+-	set_fs(fs);
+ }
+ 
+ #ifdef CONFIG_ARM_UNWIND
+diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
+index b9f60eb..f8f14fc 100644
+--- a/arch/arm/mm/alignment.c
++++ b/arch/arm/mm/alignment.c
+@@ -749,7 +749,6 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
+ 	unsigned long instr = 0, instrptr;
+ 	int (*handler)(unsigned long addr, unsigned long instr, struct pt_regs *regs);
+ 	unsigned int type;
+-	mm_segment_t fs;
+ 	unsigned int fault;
+ 	u16 tinstr = 0;
+ 	int isize = 4;
+@@ -760,16 +759,15 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
+ 
+ 	instrptr = instruction_pointer(regs);
+ 
+-	fs = get_fs();
+-	set_fs(KERNEL_DS);
+ 	if (thumb_mode(regs)) {
+-		fault = __get_user(tinstr, (u16 *)(instrptr & ~1));
++		unsigned long ptr = instrptr;
++		fault = probe_kernel_address(ptr, tinstr);
+ 		if (!fault) {
+ 			if (cpu_architecture() >= CPU_ARCH_ARMv7 &&
+ 			    IS_T32(tinstr)) {
+ 				/* Thumb-2 32-bit */
+ 				u16 tinst2 = 0;
+-				fault = __get_user(tinst2, (u16 *)(instrptr+2));
++				fault = probe_kernel_address(ptr + 2, tinst2);
+ 				instr = (tinstr << 16) | tinst2;
+ 				thumb2_32b = 1;
+ 			} else {
+@@ -778,8 +776,7 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
+ 			}
+ 		}
+ 	} else
+-		fault = __get_user(instr, (u32 *)instrptr);
+-	set_fs(fs);
++		fault = probe_kernel_address(instrptr, instr);
+ 
+ 	if (fault) {
+ 		type = TYPE_FAULT;
diff --git a/freed-ora/current/f17/arm-fix-omapdrm.patch b/freed-ora/current/f17/arm-fix-omapdrm.patch
new file mode 100644
index 000000000..f70b861fa
--- /dev/null
+++ b/freed-ora/current/f17/arm-fix-omapdrm.patch
@@ -0,0 +1,10 @@
+--- linux-3.6.0-0.rc3.git2.1.fc18.x86_64/drivers/staging/omapdrm/omap_drv.c.orig	2012-08-28 22:52:35.950826671 +0100
++++ linux-3.6.0-0.rc3.git2.1.fc18.x86_64/drivers/staging/omapdrm/omap_drv.c	2012-08-28 22:52:49.393910353 +0100
+@@ -761,7 +761,6 @@
+ 		.irq_postinstall = dev_irq_postinstall,
+ 		.irq_uninstall = dev_irq_uninstall,
+ 		.irq_handler = dev_irq_handler,
+-		.reclaim_buffers = drm_core_reclaim_buffers,
+ #ifdef CONFIG_DEBUG_FS
+ 		.debugfs_init = omap_debugfs_init,
+ 		.debugfs_cleanup = omap_debugfs_cleanup,
diff --git a/freed-ora/current/f17/arm-fix_radio_shark.patch b/freed-ora/current/f17/arm-fix_radio_shark.patch
new file mode 100644
index 000000000..63296a90e
--- /dev/null
+++ b/freed-ora/current/f17/arm-fix_radio_shark.patch
@@ -0,0 +1,15 @@
+diff --git a/sound/pci/Kconfig b/sound/pci/Kconfig
+index ff3af6e..f99fa25 100644
+--- a/sound/pci/Kconfig
++++ b/sound/pci/Kconfig
+@@ -2,8 +2,8 @@ 
+ 
+ config SND_TEA575X
+ 	tristate
+-	depends on SND_FM801_TEA575X_BOOL || SND_ES1968_RADIO || RADIO_SF16FMR2 || RADIO_MAXIRADIO
+-	default SND_FM801 || SND_ES1968 || RADIO_SF16FMR2 || RADIO_MAXIRADIO
++	depends on SND_FM801_TEA575X_BOOL || SND_ES1968_RADIO || RADIO_SF16FMR2 || RADIO_MAXIRADIO || RADIO_SHARK
++	default SND_FM801 || SND_ES1968 || RADIO_SF16FMR2 || RADIO_MAXIRADIO || RADIO_SHARK
+ 
+ menuconfig SND_PCI
+ 	bool "PCI sound devices"
diff --git a/freed-ora/current/f17/arm-linux-3.6-revert-missaligned-access-check-on-put_user.patch b/freed-ora/current/f17/arm-linux-3.6-revert-missaligned-access-check-on-put_user.patch
deleted file mode 100644
index 155806681..000000000
--- a/freed-ora/current/f17/arm-linux-3.6-revert-missaligned-access-check-on-put_user.patch
+++ /dev/null
@@ -1,83 +0,0 @@
-commit dd945918f747f61eff384f5cb8889e524f60615a

-Author: Jon Masters <jcm@jonmasters.org>

-Date:   Fri Oct 5 22:32:29 2012 -0400

-

-    Revert "ARM: 7528/1: uaccess: annotate [__]{get,put}_user functions with might_fault()"

-    

-    This reverts commit ad72907acd2943304c292ae36960bb66e6dc23c9.

-    

-    Technically, the original commit is totally correct, however it exposes

-    a deep-rooted problem with missaligned accesses in e.g. the networking

-    stack and we need to revert this (sweep under rug) until we can get

-    a good solution in place upstream. The problem is that the compiler

-    believes the structs concerned are aligned (they are in the code),

-    however at runtime the IP structs are actually not aligned within

-    received network packets, and the fault handler is not guaranteed

-    to be entirely atomic and free of calls to the scheduler.

-    

-    Signed-off-by: Jon Masters <jcm@jonmasters.org>

-

-diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h

-index 77bd79f..6f83ad6 100644

---- a/arch/arm/include/asm/uaccess.h

-+++ b/arch/arm/include/asm/uaccess.h

-@@ -118,7 +118,7 @@ extern int __get_user_4(void *);

- 		: "0" (__p), "r" (__l)					\

- 		: __GUP_CLOBBER_##__s)

- 

--#define __get_user_check(x,p)							\

-+#define get_user(x,p)							\

- 	({								\

- 		unsigned long __limit = current_thread_info()->addr_limit - 1; \

- 		register const typeof(*(p)) __user *__p asm("r0") = (p);\

-@@ -141,12 +141,6 @@ extern int __get_user_4(void *);

- 		__e;							\

- 	})

- 

--#define get_user(x,p)							\

--	({								\

--		might_fault();						\

--		__get_user_check(x,p);					\

--	 })

--

- extern int __put_user_1(void *, unsigned int);

- extern int __put_user_2(void *, unsigned int);

- extern int __put_user_4(void *, unsigned int);

-@@ -161,7 +155,7 @@ extern int __put_user_8(void *, unsigned long long);

- 		: "0" (__p), "r" (__r2), "r" (__l)			\

- 		: "ip", "lr", "cc")

- 

--#define __put_user_check(x,p)							\

-+#define put_user(x,p)							\

- 	({								\

- 		unsigned long __limit = current_thread_info()->addr_limit - 1; \

- 		register const typeof(*(p)) __r2 asm("r2") = (x);	\

-@@ -186,12 +180,6 @@ extern int __put_user_8(void *, unsigned long long);

- 		__e;							\

- 	})

- 

--#define put_user(x,p)							\

--	({								\

--		might_fault();						\

--		__put_user_check(x,p);					\

--	 })

--

- #else /* CONFIG_MMU */

- 

- /*

-@@ -245,7 +233,6 @@ do {									\

- 	unsigned long __gu_addr = (unsigned long)(ptr);			\

- 	unsigned long __gu_val;						\

- 	__chk_user_ptr(ptr);						\

--	might_fault();							\

- 	switch (sizeof(*(ptr))) {					\

- 	case 1:	__get_user_asm_byte(__gu_val,__gu_addr,err);	break;	\

- 	case 2:	__get_user_asm_half(__gu_val,__gu_addr,err);	break;	\

-@@ -327,7 +314,6 @@ do {									\

- 	unsigned long __pu_addr = (unsigned long)(ptr);			\

- 	__typeof__(*(ptr)) __pu_val = (x);				\

- 	__chk_user_ptr(ptr);						\

--	might_fault();							\

- 	switch (sizeof(*(ptr))) {					\

- 	case 1: __put_user_asm_byte(__pu_val,__pu_addr,err);	break;	\

- 	case 2: __put_user_asm_half(__pu_val,__pu_addr,err);	break;	\

diff --git a/freed-ora/current/f17/arm-origen-regulator-fix.patch b/freed-ora/current/f17/arm-origen-regulator-fix.patch
deleted file mode 100644
index c91bfb84c..000000000
--- a/freed-ora/current/f17/arm-origen-regulator-fix.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/arch/arm/mach-exynos/mach-origen.c b/arch/arm/mach-exynos/mach-origen.c
-index 4e574c2..5028fee 100644
---- a/arch/arm/mach-exynos/mach-origen.c
-+++ b/arch/arm/mach-exynos/mach-origen.c
-@@ -121,6 +121,7 @@ static struct regulator_consumer_supply __initdata ldo14_consumer[] = {
- };
- static struct regulator_consumer_supply __initdata ldo17_consumer[] = {
- 	REGULATOR_SUPPLY("vdd33", "swb-a31"), /* AR6003 WLAN & CSR 8810 BT */
-+	REGULATOR_SUPPLY("vmmc", NULL),
- };
- static struct regulator_consumer_supply __initdata buck1_consumer[] = {
- 	REGULATOR_SUPPLY("vdd_arm", NULL), /* CPUFREQ */
diff --git a/freed-ora/current/f17/arm-read_current_timer.patch b/freed-ora/current/f17/arm-read_current_timer.patch
new file mode 100644
index 000000000..dc6a4447d
--- /dev/null
+++ b/freed-ora/current/f17/arm-read_current_timer.patch
@@ -0,0 +1,39 @@
+read_current_timer is used in the get_cycles() function when
+ARM_ARCH_TIMER is set, and that function can be inlined into
+driver modules, so we should export the function to avoid
+errors like
+
+ERROR: "read_current_timer" [drivers/video/udlfb.ko] undefined!
+ERROR: "read_current_timer" [crypto/tcrypt.ko] undefined!
+
+Signed-off-by: Arnd Bergmann <arnd@xxxxxxxx>
+Cc: Shinya Kuribayashi <shinya.kuribayashi.px@xxxxxxxxxxx>
+Cc: Stephen Boyd <sboyd@xxxxxxxxxxxxxx>
+Cc: Will Deacon <will.deacon@xxxxxxx>
+Cc: Russell King <rmk+kernel@xxxxxxxxxxxxxxxx>
+---
+ arch/arm/kernel/arch_timer.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm/kernel/arch_timer.c b/arch/arm/kernel/arch_timer.c
+index cf25880..6327d1f 100644
+--- a/arch/arm/kernel/arch_timer.c
++++ b/arch/arm/kernel/arch_timer.c
+@@ -14,6 +14,7 @@
+ #include <linux/device.h>
+ #include <linux/smp.h>
+ #include <linux/cpu.h>
++#include <linux/export.h>
+ #include <linux/jiffies.h>
+ #include <linux/clockchips.h>
+ #include <linux/interrupt.h>
+@@ -232,6 +233,7 @@ int read_current_timer(unsigned long *timer_val)
+ 	*timer_val = arch_counter_get_cntpct();
+ 	return 0;
+ }
++EXPORT_SYMBOL_GPL(read_current_timer);
+ 
+ static struct clocksource clocksource_counter = {
+ 	.name	= "arch_sys_counter",
+-- 
+1.7.10
diff --git a/freed-ora/current/f17/arm-smdk310-regulator-fix.patch b/freed-ora/current/f17/arm-smdk310-regulator-fix.patch
deleted file mode 100644
index 0e0be1e4d..000000000
--- a/freed-ora/current/f17/arm-smdk310-regulator-fix.patch
+++ /dev/null
@@ -1,36 +0,0 @@
---- linus.orig/arch/arm/mach-exynos/mach-smdkv310.c
-+++ linus/arch/arm/mach-exynos/mach-smdkv310.c
-@@ -14,6 +14,8 @@
- #include <linux/lcd.h>
- #include <linux/mmc/host.h>
- #include <linux/platform_device.h>
-+#include <linux/regulator/fixed.h>
-+#include <linux/regulator/machine.h>
- #include <linux/smsc911x.h>
- #include <linux/io.h>
- #include <linux/i2c.h>
-@@ -380,6 +382,14 @@ static void __init smdkv310_reserve(void
- 	s5p_mfc_reserve_mem(0x43000000, 8 << 20, 0x51000000, 8 << 20);
- }
- 
-+static struct regulator_consumer_supply vddmmc_consumers[] __devinitdata = {
-+	REGULATOR_SUPPLY("vmmc", "s3c-sdhci.0"),
-+	REGULATOR_SUPPLY("vmmc", "s3c-sdhci.1"),
-+	REGULATOR_SUPPLY("vmmc", "s3c-sdhci.2"),
-+	REGULATOR_SUPPLY("vdd33a", "smsc911x"),
-+	REGULATOR_SUPPLY("vddvario", "smsc911x"),
-+};
-+
- static void __init smdkv310_machine_init(void)
- {
- 	s3c_i2c1_set_platdata(NULL);
-@@ -387,6 +397,9 @@ static void __init smdkv310_machine_init
- 
- 	smdkv310_smsc911x_init();
- 
-+	regulator_register_always_on(0, "fixed-3.3V", vddmmc_consumers,
-+				     ARRAY_SIZE(vddmmc_consumers), 3300000);
-+
- 	s3c_sdhci0_set_platdata(&smdkv310_hsmmc0_pdata);
- 	s3c_sdhci1_set_platdata(&smdkv310_hsmmc1_pdata);
- 	s3c_sdhci2_set_platdata(&smdkv310_hsmmc2_pdata);
diff --git a/freed-ora/current/f17/arm-tegra-sdhci-module-fix.patch b/freed-ora/current/f17/arm-tegra-sdhci-module-fix.patch
new file mode 100644
index 000000000..24ba278ed
--- /dev/null
+++ b/freed-ora/current/f17/arm-tegra-sdhci-module-fix.patch
@@ -0,0 +1,11 @@
+--- linux-3.5.0-0.rc0.git3.1.fc18.armv7hl/drivers/mmc/host/sdhci-tegra.c.orig	2012-05-23 06:59:19.797302757 -0500
++++ linux-3.5.0-0.rc0.git3.1.fc18.armv7hl/drivers/mmc/host/sdhci-tegra.c	2012-05-22 15:26:07.154823359 -0500
+@@ -190,7 +190,7 @@
+ #endif
+ 	{}
+ };
+-MODULE_DEVICE_TABLE(of, sdhci_dt_ids);
++MODULE_DEVICE_TABLE(of, sdhci_tegra_dt_match);
+ 
+ static struct tegra_sdhci_platform_data * __devinit sdhci_tegra_dt_parse_pdata(
+ 						struct platform_device *pdev)
diff --git a/freed-ora/current/f17/config-arm-generic b/freed-ora/current/f17/config-arm-generic
index 213ef786e..107268eb8 100644
--- a/freed-ora/current/f17/config-arm-generic
+++ b/freed-ora/current/f17/config-arm-generic
@@ -37,7 +37,6 @@ CONFIG_ARM_ERRATA_754327=y
 CONFIG_ARM_ERRATA_764369=y
 CONFIG_ARM_ERRATA_775420=y
 
-
 # Generic ARM config options
 CONFIG_ZBOOT_ROM_TEXT=0
 CONFIG_ZBOOT_ROM_BSS=0
@@ -64,6 +63,9 @@ CONFIG_CPU_IDLE=y
 # CONFIG_CPU_IDLE_GOV_LADDER is not set
 CONFIG_CPU_IDLE_GOV_MENU=y
 
+CONFIG_DEFAULT_MMAP_MIN_ADDR=32768
+CONFIG_LSM_MMAP_MIN_ADDR=32768
+
 CONFIG_NO_HZ=y
 CONFIG_HIGH_RES_TIMERS=y
 
@@ -89,9 +91,6 @@ CONFIG_STRICT_DEVMEM=y
 
 CONFIG_SPARSE_IRQ=y
 
-CONFIG_DEFAULT_MMAP_MIN_ADDR=32768
-CONFIG_LSM_MMAP_MIN_ADDR=32768
-
 # Generic HW for all ARM platforms
 CONFIG_LEDS=y
 CONFIG_LEDS_CPU=y
@@ -356,4 +355,3 @@ CONFIG_EXTCON_GPIO=m
 
 # CONFIG_NET_VENDOR_CIRRUS is not set
 # CONFIG_CS89x0 is not set
-# CONFIG_VIDEO_DM6446_CCDC is not set
diff --git a/freed-ora/current/f17/config-arm-omap b/freed-ora/current/f17/config-arm-omap
index 76fd19c3f..5fb1bd668 100644
--- a/freed-ora/current/f17/config-arm-omap
+++ b/freed-ora/current/f17/config-arm-omap
@@ -210,26 +210,28 @@ CONFIG_DRM_OMAP_NUM_CRTCS=2
 # CONFIG_FB_OMAP_BOOTLOADER_INIT is not set
 # CONFIG_FB_OMAP_LCD_VGA is not set
 CONFIG_OMAP2_VRAM=y
+CONFIG_OMAP2_VRAM_SIZE=0
 CONFIG_OMAP2_VRFB=y
-CONFIG_OMAP2_DSS=y
-CONFIG_OMAP2_VRAM_SIZE=12
+# CONFIG_FB_OMAP2 is not set
+
+CONFIG_OMAP2_DSS=m
 CONFIG_OMAP2_DSS_DEBUG_SUPPORT=y
 # CONFIG_OMAP2_DSS_COLLECT_IRQ_STATS is not set
 CONFIG_OMAP2_DSS_DPI=y
-# CONFIG_OMAP2_DSS_RFBI is not set
+CONFIG_OMAP2_DSS_RFBI=y
 CONFIG_OMAP2_DSS_VENC=y
 CONFIG_OMAP4_DSS_HDMI=y
-# CONFIG_OMAP2_DSS_SDI is not set
-# CONFIG_OMAP2_DSS_DSI is not set
+CONFIG_OMAP2_DSS_SDI=y
+CONFIG_OMAP2_DSS_DSI=y
 # CONFIG_OMAP2_DSS_FAKE_VSYNC is not set
-CONFIG_OMAP2_DSS_MIN_FCK_PER_PCK=1
+CONFIG_OMAP2_DSS_MIN_FCK_PER_PCK=0
 CONFIG_OMAP2_DSS_SLEEP_BEFORE_RESET=y
 CONFIG_OMAP2_DSS_SLEEP_AFTER_VENC_RESET=y
-# CONFIG_FB_OMAP2 is not set
 CONFIG_VIDEO_DM6446_CCDC=m
 
 CONFIG_PANEL_TFP410=m
 CONFIG_PANEL_PICODLP=m
+CONFIG_PANEL_TAAL=m
 CONFIG_BACKLIGHT_PANDORA=m
 
 #
diff --git a/freed-ora/current/f17/config-powerpc64 b/freed-ora/current/f17/config-powerpc64
index ccd0e85d4..82f4c603b 100644
--- a/freed-ora/current/f17/config-powerpc64
+++ b/freed-ora/current/f17/config-powerpc64
@@ -164,6 +164,8 @@ CONFIG_PPC_ICSWX=y
 CONFIG_IO_EVENT_IRQ=y
 CONFIG_HW_RANDOM_AMD=m
 
+CONFIG_UIO_PDRV=m
+
 CONFIG_HW_RANDOM_PSERIES=m
 CONFIG_CRYPTO_DEV_NX=m
 
diff --git a/freed-ora/current/f17/dont-call-cifs_lookup-on-hashed-negative-dentry.patch b/freed-ora/current/f17/dont-call-cifs_lookup-on-hashed-negative-dentry.patch
deleted file mode 100644
index 4e25f9d20..000000000
--- a/freed-ora/current/f17/dont-call-cifs_lookup-on-hashed-negative-dentry.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-@@ -, +, @@ 
- cifs_atomic_open
- fs/cifs/dir.c | 6 ++++++
- 1 file changed, 6 insertions(+)
---- a/fs/cifs/dir.c	
-+++ a/fs/cifs/dir.c	
-@@ -398,6 +398,12 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry,
- 	 * in network traffic in the other paths.
- 	 */
- 	if (!(oflags & O_CREAT)) {
-+		/* Check for hashed negative dentry. We have already revalidated
-+		 * the dentry and it is fine. No need to perform another lookup.
-+		 */
-+		if (!d_unhashed(direntry))
-+			return -ENOENT;
-+
- 		struct dentry *res = cifs_lookup(inode, direntry, 0);
- 		if (IS_ERR(res))
- 			return PTR_ERR(res);
diff --git a/freed-ora/current/f17/exec-do-not-leave-bprm-interp-on-stack.patch b/freed-ora/current/f17/exec-do-not-leave-bprm-interp-on-stack.patch
new file mode 100644
index 000000000..2a4b2dd28
--- /dev/null
+++ b/freed-ora/current/f17/exec-do-not-leave-bprm-interp-on-stack.patch
@@ -0,0 +1,118 @@
+From 20ae2081584450e552735a3df968ce5b5946a607 Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Mon, 26 Nov 2012 08:56:37 -0500
+Subject: [PATCH 1/2] exec: do not leave bprm->interp on stack
+
+If a series of scripts are executed, each triggering module loading via
+unprintable bytes in the script header, kernel stack contents can leak
+into the command line.
+
+Normally execution of binfmt_script and binfmt_misc happens recursively.
+However, when modules are enabled, and unprintable bytes exist in the
+bprm->buf, execution will restart after attempting to load matching binfmt
+modules.  Unfortunately, the logic in binfmt_script and binfmt_misc does
+not expect to get restarted.  They leave bprm->interp pointing to their
+local stack.  This means on restart bprm->interp is left pointing into
+unused stack memory which can then be copied into the userspace argv
+areas.
+
+After additional study, it seems that both recursion and restart remains
+the desirable way to handle exec with scripts, misc, and modules.  As
+such, we need to protect the changes to interp.
+
+This changes the logic to require allocation for any changes to the
+bprm->interp.  To avoid adding a new kmalloc to every exec, the default
+value is left as-is.  Only when passing through binfmt_script or
+binfmt_misc does an allocation take place.
+
+For a proof of concept, see DoTest.sh from:
+http://www.halfdog.net/Security/2012/LinuxKernelBinfmtScriptStackDataDisclosure/
+
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Cc: halfdog <me@halfdog.net>
+Cc: P J P <ppandit@redhat.com>
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ fs/binfmt_misc.c        |  5 ++++-
+ fs/binfmt_script.c      |  4 +++-
+ fs/exec.c               | 15 +++++++++++++++
+ include/linux/binfmts.h |  1 +
+ 4 files changed, 23 insertions(+), 2 deletions(-)
+
+diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c
+index 790b3cd..772428d 100644
+--- a/fs/binfmt_misc.c
++++ b/fs/binfmt_misc.c
+@@ -176,7 +176,10 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ 		goto _error;
+ 	bprm->argc ++;
+ 
+-	bprm->interp = iname;	/* for binfmt_script */
++	/* Update interp in case binfmt_script needs it. */
++	retval = bprm_change_interp(iname, bprm);
++	if (retval < 0)
++		goto _error;
+ 
+ 	interp_file = open_exec (iname);
+ 	retval = PTR_ERR (interp_file);
+diff --git a/fs/binfmt_script.c b/fs/binfmt_script.c
+index d3b8c1f..df49d48 100644
+--- a/fs/binfmt_script.c
++++ b/fs/binfmt_script.c
+@@ -82,7 +82,9 @@ static int load_script(struct linux_binprm *bprm,struct pt_regs *regs)
+ 	retval = copy_strings_kernel(1, &i_name, bprm);
+ 	if (retval) return retval; 
+ 	bprm->argc++;
+-	bprm->interp = interp;
++	retval = bprm_change_interp(interp, bprm);
++	if (retval < 0)
++		return retval;
+ 
+ 	/*
+ 	 * OK, now restart the process with the interpreter's dentry.
+diff --git a/fs/exec.c b/fs/exec.c
+index fab2c6d..59896ae 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1202,9 +1202,24 @@ void free_bprm(struct linux_binprm *bprm)
+ 		mutex_unlock(&current->signal->cred_guard_mutex);
+ 		abort_creds(bprm->cred);
+ 	}
++	/* If a binfmt changed the interp, free it. */
++	if (bprm->interp != bprm->filename)
++		kfree(bprm->interp);
+ 	kfree(bprm);
+ }
+ 
++int bprm_change_interp(char *interp, struct linux_binprm *bprm)
++{
++	/* If a binfmt changed the interp, free it first. */
++	if (bprm->interp != bprm->filename)
++		kfree(bprm->interp);
++	bprm->interp = kstrdup(interp, GFP_KERNEL);
++	if (!bprm->interp)
++		return -ENOMEM;
++	return 0;
++}
++EXPORT_SYMBOL(bprm_change_interp);
++
+ /*
+  * install the new credentials for this executable
+  */
+diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
+index 366422b..eb53e15 100644
+--- a/include/linux/binfmts.h
++++ b/include/linux/binfmts.h
+@@ -128,6 +128,7 @@ extern int setup_arg_pages(struct linux_binprm * bprm,
+ 			   unsigned long stack_top,
+ 			   int executable_stack);
+ extern int bprm_mm_init(struct linux_binprm *bprm);
++extern int bprm_change_interp(char *interp, struct linux_binprm *bprm);
+ extern int copy_strings_kernel(int argc, const char *const *argv,
+ 			       struct linux_binprm *bprm);
+ extern int prepare_bprm_creds(struct linux_binprm *bprm);
+-- 
+1.8.0
+
diff --git a/freed-ora/current/f17/exec-use-eloop-for-max-recursion-depth.patch b/freed-ora/current/f17/exec-use-eloop-for-max-recursion-depth.patch
new file mode 100644
index 000000000..cbaff2f7a
--- /dev/null
+++ b/freed-ora/current/f17/exec-use-eloop-for-max-recursion-depth.patch
@@ -0,0 +1,144 @@
+From 4ae8186cd77835b45f1b35edb4ce70309287bfc3 Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Mon, 26 Nov 2012 09:02:11 -0500
+Subject: [PATCH 2/2] exec: use -ELOOP for max recursion depth
+
+To avoid an explosion of request_module calls on a chain of abusive
+scripts, fail maximum recursion with -ELOOP instead of -ENOEXEC. As soon
+as maximum recursion depth is hit, the error will fail all the way back
+up the chain, aborting immediately.
+
+This also has the side-effect of stopping the user's shell from attempting
+to reexecute the top-level file as a shell script. As seen in the
+dash source:
+
+        if (cmd != path_bshell && errno == ENOEXEC) {
+                *argv-- = cmd;
+                *argv = cmd = path_bshell;
+                goto repeat;
+        }
+
+The above logic was designed for running scripts automatically that lacked
+the "#!" header, not to re-try failed recursion. On a legitimate -ENOEXEC,
+things continue to behave as the shell expects.
+
+Additionally, when tracking recursion, the binfmt handlers should not be
+involved. The recursion being tracked is the depth of calls through
+search_binary_handler(), so that function should be exclusively responsible
+for tracking the depth.
+
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Cc: halfdog <me@halfdog.net>
+Cc: P J P <ppandit@redhat.com>
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ fs/binfmt_em86.c        |  1 -
+ fs/binfmt_misc.c        |  6 ------
+ fs/binfmt_script.c      |  4 +---
+ fs/exec.c               | 10 +++++-----
+ include/linux/binfmts.h |  2 --
+ 5 files changed, 6 insertions(+), 17 deletions(-)
+
+diff --git a/fs/binfmt_em86.c b/fs/binfmt_em86.c
+index 2790c7e..575796a 100644
+--- a/fs/binfmt_em86.c
++++ b/fs/binfmt_em86.c
+@@ -42,7 +42,6 @@ static int load_em86(struct linux_binprm *bprm,struct pt_regs *regs)
+ 			return -ENOEXEC;
+ 	}
+ 
+-	bprm->recursion_depth++; /* Well, the bang-shell is implicit... */
+ 	allow_write_access(bprm->file);
+ 	fput(bprm->file);
+ 	bprm->file = NULL;
+diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c
+index 772428d..f0f1a06 100644
+--- a/fs/binfmt_misc.c
++++ b/fs/binfmt_misc.c
+@@ -117,10 +117,6 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ 	if (!enabled)
+ 		goto _ret;
+ 
+-	retval = -ENOEXEC;
+-	if (bprm->recursion_depth > BINPRM_MAX_RECURSION)
+-		goto _ret;
+-
+ 	/* to keep locking time low, we copy the interpreter string */
+ 	read_lock(&entries_lock);
+ 	fmt = check_file(bprm);
+@@ -200,8 +196,6 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ 	if (retval < 0)
+ 		goto _error;
+ 
+-	bprm->recursion_depth++;
+-
+ 	retval = search_binary_handler (bprm, regs);
+ 	if (retval < 0)
+ 		goto _error;
+diff --git a/fs/binfmt_script.c b/fs/binfmt_script.c
+index df49d48..8ae4be1 100644
+--- a/fs/binfmt_script.c
++++ b/fs/binfmt_script.c
+@@ -22,15 +22,13 @@ static int load_script(struct linux_binprm *bprm,struct pt_regs *regs)
+ 	char interp[BINPRM_BUF_SIZE];
+ 	int retval;
+ 
+-	if ((bprm->buf[0] != '#') || (bprm->buf[1] != '!') ||
+-	    (bprm->recursion_depth > BINPRM_MAX_RECURSION))
++	if ((bprm->buf[0] != '#') || (bprm->buf[1] != '!'))
+ 		return -ENOEXEC;
+ 	/*
+ 	 * This section does the #! interpretation.
+ 	 * Sorta complicated, but hopefully it will work.  -TYT
+ 	 */
+ 
+-	bprm->recursion_depth++;
+ 	allow_write_access(bprm->file);
+ 	fput(bprm->file);
+ 	bprm->file = NULL;
+diff --git a/fs/exec.c b/fs/exec.c
+index 59896ae..541cc51 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1398,6 +1398,10 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
+ 	struct linux_binfmt *fmt;
+ 	pid_t old_pid, old_vpid;
+ 
++	/* This allows 4 levels of binfmt rewrites before failing hard. */
++	if (depth > 5)
++		return -ELOOP;
++
+ 	retval = security_bprm_check(bprm);
+ 	if (retval)
+ 		return retval;
+@@ -1422,12 +1426,8 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
+ 			if (!try_module_get(fmt->module))
+ 				continue;
+ 			read_unlock(&binfmt_lock);
++			bprm->recursion_depth = depth + 1;
+ 			retval = fn(bprm, regs);
+-			/*
+-			 * Restore the depth counter to its starting value
+-			 * in this call, so we don't have to rely on every
+-			 * load_binary function to restore it on return.
+-			 */
+ 			bprm->recursion_depth = depth;
+ 			if (retval >= 0) {
+ 				if (depth == 0) {
+diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
+index eb53e15..5bab59b 100644
+--- a/include/linux/binfmts.h
++++ b/include/linux/binfmts.h
+@@ -68,8 +68,6 @@ struct linux_binprm {
+ #define BINPRM_FLAGS_EXECFD_BIT 1
+ #define BINPRM_FLAGS_EXECFD (1 << BINPRM_FLAGS_EXECFD_BIT)
+ 
+-#define BINPRM_MAX_RECURSION 4
+-
+ /* Function parameter for binfmt->coredump */
+ struct coredump_params {
+ 	long signr;
+-- 
+1.8.0
+
diff --git a/freed-ora/current/f17/kernel.spec b/freed-ora/current/f17/kernel.spec
index 950bd6973..558b8e080 100644
--- a/freed-ora/current/f17/kernel.spec
+++ b/freed-ora/current/f17/kernel.spec
@@ -54,7 +54,7 @@ Summary: The Linux kernel
 # For non-released -rc kernels, this will be appended after the rcX and
 # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3"
 #
-%global baserelease 4
+%global baserelease 1
 %global fedora_build %{baserelease}
 
 # base_sublevel is the kernel version we're starting with and patching
@@ -104,7 +104,7 @@ Summary: The Linux kernel
 %if 0%{?released_kernel}
 
 # Do we have a -stable update to apply?
-%define stable_update 7
+%define stable_update 8
 # Is it a -stable RC?
 %define stable_rc 0
 # Set rpm version accordingly
@@ -288,12 +288,12 @@ Summary: The Linux kernel
 %define with_pae 0
 %endif
 
-# kernel-tegra, omap, imx and highbank are only built on armv7 hard and softfp
+# kernel up (versatile express), tegra, omap, imx and highbank are only built on armv7 hfp/sfp
 %ifnarch armv7hl armv7l
-%define with_tegra 0
-%define with_omap 0
 %define with_imx 0
 %define with_highbank 0
+%define with_omap 0
+%define with_tegra 0
 %endif
 
 # kernel-kirkwood is only built for armv5
@@ -445,12 +445,11 @@ Summary: The Linux kernel
 %define hdrarch arm
 %define make_target bzImage
 %define kernel_image arch/arm/boot/zImage
-# we build a up kernel on base softfp/hardfp platforms. its used for qemu.
+# we only build headers/perf/tools on the base arm arches
+# just like we used to only build them on i386 for x86
 %ifnarch armv5tel armv7hl
 %define with_up 0
 %endif
-# we only build headers/perf/tools on the base arm arches
-# just like we used to only build them on i386 for x86
 %ifnarch armv5tel armv7hl
 %define with_headers 0
 %define with_perf 0
@@ -771,22 +770,20 @@ Patch19000: ips-noirq.patch
 Patch19001: i82975x-edac-fix.patch
 
 # ARM
-# Flattened devicetree support
-Patch21003: arm-linux-3.6-revert-missaligned-access-check-on-put_user.patch
+Patch21000: arm-read_current_timer.patch
+Patch21001: arm-fix-omapdrm.patch
+Patch21002: arm-fix_radio_shark.patch
+Patch21003: arm-alignment-faults.patch
+# OMAP
 
 # ARM tegra
 Patch21004: arm-tegra-nvec-kconfig.patch
 Patch21005: arm-tegra-usb-no-reset-linux33.patch
-#atch21006: arm-beagle-usb-init.patch
+Patch21006: arm-tegra-sdhci-module-fix.patch
 
 # ARM highbank patches
-# Highbank clock functions need to be EXPORT for module builds
 Patch21010: arm-highbank-sata-fix.patch
 
-# ARM exynos4
-Patch21020: arm-smdk310-regulator-fix.patch
-Patch21021: arm-origen-regulator-fix.patch
-
 #rhbz 754518
 Patch21235: scsi-sd_revalidate_disk-prevent-NULL-ptr-deref.patch
 
@@ -802,11 +799,6 @@ Patch22014: efifb-skip-DMI-checks-if-bootloader-knows.patch
 #rhbz 857324
 Patch22070: net-tcp-bz857324.patch
 
-Patch22072: linux-3.6-arm-build-fixup.patch
-
-#rhbz 867344
-Patch22077: dont-call-cifs_lookup-on-hashed-negative-dentry.patch
-
 #rhbz 869904 869909 CVE-2012-4508
 Patch22080: 0001-ext4-ext4_inode_info-diet.patch
 Patch22081: 0002-ext4-give-i_aiodio_unwritten-a-more-appropriate-name.patch
@@ -824,7 +816,6 @@ Patch22091: 0012-ext4-serialize-fallocate-with-ext4_convert_unwritten.patch
 Patch22100: uprobes-upstream-backport.patch
 
 #rhbz 871078
-Patch22110: usb-audio-fix-crash-at-re-preparing-the-PCM-stream.patch
 Patch22111: USB-EHCI-urb-hcpriv-should-not-be-NULL.patch
 Patch22112: USB-report-submission-of-active-URBs.patch
 
@@ -834,9 +825,6 @@ Patch22113: smp_irq_move_cleanup_interrupt.patch
 #rhbz 873001
 Patch22114: iwlwifi-remove-queue-empty-warn-3.6.patch
 
-#rhbz 870562
-Patch22115: keyspan.patch
-
 #rhbz 812129
 Patch22120: block-fix-a-crash-when-block-device-is.patch
 Patch22121: blockdev-turn-a-rw-semaphore-into-a-percpu-rw-sem.patch
@@ -848,6 +836,16 @@ Patch22125: Bluetooth-Add-support-for-BCM20702A0.patch
 #rhbz CVE-2012-4461 862900 878518
 Patch21227: KVM-x86-invalid-opcode-oops-on-SET_SREGS-with-OSXSAV.patch
 
+#rhbz CVE-2012-4530 868285 880147
+Patch21228: exec-do-not-leave-bprm-interp-on-stack.patch
+Patch21229: exec-use-eloop-for-max-recursion-depth.patch
+
+#rhbz 869629
+Patch21230: SCSI-mvsas-Fix-oops-when-ata-commond-timeout.patch
+
+#rhbz 851278
+Patch21232: 8139cp-revert-set-ring-address-before-enabling-recei.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -1478,14 +1476,14 @@ ApplyPatch vmbugon-warnon.patch
 #
 # ARM
 #
-ApplyPatch linux-3.6-arm-build-fixup.patch
+ApplyPatch arm-read_current_timer.patch
+ApplyPatch arm-fix-omapdrm.patch
+ApplyPatch arm-fix_radio_shark.patch
 ApplyPatch arm-tegra-nvec-kconfig.patch
 ApplyPatch arm-tegra-usb-no-reset-linux33.patch
+ApplyPatch arm-tegra-sdhci-module-fix.patch
 ApplyPatch arm-highbank-sata-fix.patch
-ApplyPatch arm-linux-3.6-revert-missaligned-access-check-on-put_user.patch
-
-ApplyPatch arm-smdk310-regulator-fix.patch
-ApplyPatch arm-origen-regulator-fix.patch
+ApplyPatch arm-alignment-faults.patch
 
 #
 # bugfixes to drivers and filesystems
@@ -1609,9 +1607,6 @@ ApplyPatch efifb-skip-DMI-checks-if-bootloader-knows.patch
 #rhbz 857324
 ApplyPatch net-tcp-bz857324.patch
 
-#rhbz 867344
-ApplyPatch dont-call-cifs_lookup-on-hashed-negative-dentry.patch
-
 #rhbz 869904 869909 CVE-2012-4508
 ApplyPatch 0001-ext4-ext4_inode_info-diet.patch
 ApplyPatch 0002-ext4-give-i_aiodio_unwritten-a-more-appropriate-name.patch
@@ -1629,7 +1624,6 @@ ApplyPatch 0012-ext4-serialize-fallocate-with-ext4_convert_unwritten.patch
 ApplyPatch uprobes-upstream-backport.patch
 
 #rhbz 871078
-ApplyPatch usb-audio-fix-crash-at-re-preparing-the-PCM-stream.patch
 ApplyPatch USB-EHCI-urb-hcpriv-should-not-be-NULL.patch
 ApplyPatch USB-report-submission-of-active-URBs.patch
 
@@ -1639,9 +1633,6 @@ ApplyPatch smp_irq_move_cleanup_interrupt.patch
 #rhbz 873001
 ApplyPatch iwlwifi-remove-queue-empty-warn-3.6.patch
 
-#rhbz 870562
-ApplyPatch keyspan.patch
-
 #rhbz 812129
 ApplyPatch block-fix-a-crash-when-block-device-is.patch
 ApplyPatch blockdev-turn-a-rw-semaphore-into-a-percpu-rw-sem.patch
@@ -1653,6 +1644,16 @@ ApplyPatch Bluetooth-Add-support-for-BCM20702A0.patch
 #rhbz CVE-2012-4461 862900 878518
 ApplyPatch KVM-x86-invalid-opcode-oops-on-SET_SREGS-with-OSXSAV.patch
 
+#rhbz CVE-2012-4530 868285 880147
+ApplyPatch exec-do-not-leave-bprm-interp-on-stack.patch
+ApplyPatch exec-use-eloop-for-max-recursion-depth.patch
+
+#rhbz 869629
+ApplyPatch SCSI-mvsas-Fix-oops-when-ata-commond-timeout.patch
+
+#rhbz 851278
+ApplyPatch 8139cp-revert-set-ring-address-before-enabling-recei.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -2527,6 +2528,22 @@ fi
 #    '-'      |  |
 #              '-'
 %changelog
+* Tue Nov 27 2012 Alexandre Oliva <lxoliva@fsfla.org> -libre
+- GNU Linux-libre 3.6.8-gnu
+
+* Mon Nov 26 2012 Justin M. Forbes <jforbes@redhat.com> 3.6.8-1
+- Linux 3.6.8
+
+* Mon Nov 26 2012 Josh Boyer <jwboyer@redhat.com>
+- Fix regression in 8139cp driver, debugged by William J. Eaton (rhbz 851278)
+- Fix ACPI video after _DOD errors (rhbz 869383)
+- Fix ata command timeout oops in mvsas (rhbz 869629)
+- Enable CONFIG_UIO_PDRV on ppc64 (rhbz 878180)
+- CVE-2012-4530: stack disclosure binfmt_script load_script (rhbz 868285 880147)
+
+* Sun Nov 25 2012 Peter Robinson <pbrobinson@fedoraproject.org>
+- Update ARM kernel config and patches to fix F-17 build
+
 * Tue Nov 20 2012 Josh Boyer <jwboyer@redhat.com>
 - CVE-2012-4461: kvm: invalid opcode oops on SET_SREGS with OSXSAVE bit set (rhbz 878518 862900)
 - Add support for BCM20702A0 (rhbz 874791)
diff --git a/freed-ora/current/f17/keyspan.patch b/freed-ora/current/f17/keyspan.patch
deleted file mode 100644
index 43d116ea4..000000000
--- a/freed-ora/current/f17/keyspan.patch
+++ /dev/null
@@ -1,98 +0,0 @@
-                                                                                                                                                                                                                                                               
-Delivered-To: jwboyer@gmail.com

-Received: by 10.58.186.240 with SMTP id fn16csp155256vec;

-        Sat, 10 Nov 2012 01:14:20 -0800 (PST)

-Received: by 10.68.130.197 with SMTP id og5mr40733607pbb.138.1352538859530;

-        Sat, 10 Nov 2012 01:14:19 -0800 (PST)

-Return-Path: <stable-owner@vger.kernel.org>

-Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67])

-        by mx.google.com with ESMTP id pj1si1353832pbc.115.2012.11.10.01.14.15;

-        Sat, 10 Nov 2012 01:14:19 -0800 (PST)

-Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;

-Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mail=stable-owner@vger.kernel.org

-Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand

-	id S1750798Ab2KJJOO (ORCPT <rfc822;crquan@gmail.com> + 33 others);

-	Sat, 10 Nov 2012 04:14:14 -0500

-Received: from canardo.mork.no ([148.122.252.1]:37367 "EHLO canardo.mork.no"

-	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP

-	id S1750699Ab2KJJOM (ORCPT <rfc822;stable@vger.kernel.org>);

-	Sat, 10 Nov 2012 04:14:12 -0500

-Received: from nemi.mork.no (nemi.mork.no [IPv6:2001:4620:9:2:216:eaff:feb3:788])

-	(authenticated bits=0)

-	by canardo.mork.no (8.14.3/8.14.3) with ESMTP id qAA9E1cX010750

-	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT);

-	Sat, 10 Nov 2012 10:14:02 +0100

-Received: from bjorn by nemi.mork.no with local (Exim 4.80)

-	(envelope-from <bjorn@nemi.mork.no>)

-	id 1TX78a-0007Li-AD; Sat, 10 Nov 2012 10:14:00 +0100

-From:	=?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>

-To:	Richard <richjunk@pacbell.net>

-Cc:	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,

-	linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org,

-	=?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>,

-	<stable@vger.kernel.org>, Johan Hovold <jhovold@gmail.com>

-Subject: [PATCH usb-linus] USB: keyspan: fix typo causing GPF on open

-Date:	Sat, 10 Nov 2012 10:13:42 +0100

-Message-Id: <1352538822-28221-1-git-send-email-bjorn@mork.no>

-X-Mailer: git-send-email 1.7.10.4

-In-Reply-To: <509D5BCD.3010901@pacbell.net>

-References: <509D5BCD.3010901@pacbell.net>

-MIME-Version: 1.0

-Content-Type: text/plain; charset=UTF-8

-Content-Transfer-Encoding: 8bit

-X-Virus-Scanned: clamav-milter 0.97.6 at canardo

-X-Virus-Status:	Clean

-Sender:	stable-owner@vger.kernel.org

-Precedence: bulk

-List-ID: <stable.vger.kernel.org>

-X-Mailing-List:	stable@vger.kernel.org

-

-Commit f79b2d0f (USB: keyspan: fix NULL-pointer dereferences and

-memory leaks) had a small typo which made the driver use wrong

-offsets when mapping serial port private data.  This results in

-in a GPF when the port is opened.

-

-Reported-by: Richard <richjunk@pacbell.net>

-Cc: <stable@vger.kernel.org>

-Cc: Johan Hovold <jhovold@gmail.com>

-Signed-off-by: Bjørn Mork <bjorn@mork.no>

----

-Hello Richard,

-

-I wonder if you are able to test and verify this?  I do not guarantee

-that there aren't other issues around, but this small typo looked like

-an obvious killer...

-

-Bjørn

-

- drivers/usb/serial/keyspan.c |    3 +--

- 1 file changed, 1 insertion(+), 2 deletions(-)

-

-diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c

-index 7179b0c..cff8dd5 100644

---- a/drivers/usb/serial/keyspan.c

-+++ b/drivers/usb/serial/keyspan.c

-@@ -2430,7 +2430,7 @@ static void keyspan_release(struct usb_serial *serial)

- static int keyspan_port_probe(struct usb_serial_port *port)

- {

- 	struct usb_serial *serial = port->serial;

--	struct keyspan_port_private *s_priv;

-+	struct keyspan_serial_private *s_priv;

- 	struct keyspan_port_private *p_priv;

- 	const struct keyspan_device_details *d_details;

- 	struct callbacks *cback;

-@@ -2445,7 +2445,6 @@ static int keyspan_port_probe(struct usb_serial_port *port)

- 	if (!p_priv)

- 		return -ENOMEM;

- 

--	s_priv = usb_get_serial_data(port->serial);

- 	p_priv->device_details = d_details;

- 

- 	/* Setup values for the various callback routines */

--- 

-1.7.10.4

-

---

-To unsubscribe from this list: send the line "unsubscribe stable" in

-the body of a message to majordomo@vger.kernel.org

-More majordomo info at  http://vger.kernel.org/majordomo-info.html

diff --git a/freed-ora/current/f17/linux-3.6-arm-build-fixup.patch b/freed-ora/current/f17/linux-3.6-arm-build-fixup.patch
deleted file mode 100644
index c9ee5abb9..000000000
--- a/freed-ora/current/f17/linux-3.6-arm-build-fixup.patch
+++ /dev/null
@@ -1,103 +0,0 @@
-From: Mauro Carvalho Chehab <mchehab@redhat.com>
-Date: Fri, 12 Oct 2012 16:26:43 -0400
-Subject: [PATCH] snd-tea575x: Fix radio-shark build, when PCI is not compiled
-
-On ARM devices, those vars get undefined:
-
-ERROR: "snd_tea575x_init" [drivers/media/radio/radio-shark.ko] undefined!
-ERROR: "snd_tea575x_exit" [drivers/media/radio/radio-shark.ko] undefined!
-
-Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
-
-diff --git a/sound/Kconfig b/sound/Kconfig
-index 261a03c..fef150c 100644
---- a/sound/Kconfig
-+++ b/sound/Kconfig
-@@ -77,6 +77,12 @@ source "sound/drivers/Kconfig"
- 
- source "sound/isa/Kconfig"
- 
-+# I2C device, used by sound/pci and by some drivers/media USB devices
-+config SND_TEA575X
-+	tristate
-+	depends on SND_FM801_TEA575X_BOOL || SND_ES1968_RADIO || RADIO_SF16FMR2 || RADIO_MAXIRADIO || RADIO_SHARK
-+	default y
-+
- source "sound/pci/Kconfig"
- 
- source "sound/ppc/Kconfig"
-diff --git a/sound/pci/Kconfig b/sound/pci/Kconfig
-index ff3af6e..f93fda7 100644
---- a/sound/pci/Kconfig
-+++ b/sound/pci/Kconfig
-@@ -1,10 +1,5 @@
- # ALSA PCI drivers
- 
--config SND_TEA575X
--	tristate
--	depends on SND_FM801_TEA575X_BOOL || SND_ES1968_RADIO || RADIO_SF16FMR2 || RADIO_MAXIRADIO
--	default SND_FM801 || SND_ES1968 || RADIO_SF16FMR2 || RADIO_MAXIRADIO
--
- menuconfig SND_PCI
- 	bool "PCI sound devices"
- 	depends on PCI
-
-From: Arnd Bergmann <arnd@arndb.de>
-Subject: [PATCH] ARM: export read_current_timer
-	https://patchwork.kernel.org/patch/1361481/
-
-	read_current_timer is used in the get_cycles() function when
-	ARM_ARCH_TIMER is set, and that function can be inlined into
-	driver modules, so we should export the function to avoid
-	errors like
-
-	ERROR: "read_current_timer" [drivers/video/udlfb.ko] undefined!
-	ERROR: "read_current_timer" [crypto/tcrypt.ko] undefined!
-
-	Signed-off-by: Arnd Bergmann <arnd@arndb.de>
-	Cc: Shinya Kuribayashi <shinya.kuribayashi.px@renesas.com>
-	Cc: Stephen Boyd <sboyd@codeaurora.org>
-	Cc: Will Deacon <will.deacon@arm.com>
-	Cc: Russell King <rmk+kernel@arm.linux.org.uk>
-
-diff --git a/arch/arm/kernel/arch_timer.c b/arch/arm/kernel/arch_timer.c
-index cf25880..6327d1f 100644
---- a/arch/arm/kernel/arch_timer.c
-+++ b/arch/arm/kernel/arch_timer.c
-@@ -14,6 +14,7 @@
- #include <linux/device.h>
- #include <linux/smp.h>
- #include <linux/cpu.h>
-+#include <linux/export.h>
- #include <linux/jiffies.h>
- #include <linux/clockchips.h>
- #include <linux/interrupt.h>
-@@ -232,6 +233,7 @@ int read_current_timer(unsigned long *timer_val)
- 	*timer_val = arch_counter_get_cntpct();
- 	return 0;
- }
-+EXPORT_SYMBOL_GPL(read_current_timer);
- 
- static struct clocksource clocksource_counter = {
- 	.name	= "arch_sys_counter",
-
-From: David Cullen <david.cullen@koe-americas.com>
-Subject: [PATCH] Fix error: unknown field reclaim_buffers specified in initializer
-
-	The reclaim_buffers field has been removed from struct drm_driver.
-
-	Signed-off-by: David Cullen <david.cullen@koe-americas.com>
-diff --git a/drivers/staging/omapdrm/omap_drv.c
-b/drivers/staging/omapdrm/omap_drv.c
-index 4beab94..44149ee 100644
---- a/drivers/staging/omapdrm/omap_drv.c
-+++ b/drivers/staging/omapdrm/omap_drv.c
-@@ -761,7 +761,6 @@ static struct drm_driver omap_drm_driver = {
- 		.irq_postinstall = dev_irq_postinstall,
- 		.irq_uninstall = dev_irq_uninstall,
- 		.irq_handler = dev_irq_handler,
--		.reclaim_buffers = drm_core_reclaim_buffers,
- #ifdef CONFIG_DEBUG_FS
- 		.debugfs_init = omap_debugfs_init,
- 		.debugfs_cleanup = omap_debugfs_cleanup,
-  
diff --git a/freed-ora/current/f17/patch-3.6-gnu-3.6.7-gnu.xz.sign b/freed-ora/current/f17/patch-3.6-gnu-3.6.7-gnu.xz.sign
deleted file mode 100644
index 14d4a0cd2..000000000
--- a/freed-ora/current/f17/patch-3.6-gnu-3.6.7-gnu.xz.sign
+++ /dev/null
@@ -1,7 +0,0 @@
------BEGIN PGP SIGNATURE-----
-Version: GnuPG v2.0.18 (GNU/Linux)
-
-iEYEABECAAYFAlCoSBEACgkQvLfPh359R6cxRQCdGO9IGrzh6oUJNL56cO7x5Q4s
-t5MAmwcdMPV9Rzw6uOSZtcvNkXM9r5gu
-=cEgI
------END PGP SIGNATURE-----
diff --git a/freed-ora/current/f17/patch-3.6-gnu-3.6.8-gnu.xz.sign b/freed-ora/current/f17/patch-3.6-gnu-3.6.8-gnu.xz.sign
new file mode 100644
index 000000000..e59af1940
--- /dev/null
+++ b/freed-ora/current/f17/patch-3.6-gnu-3.6.8-gnu.xz.sign
@@ -0,0 +1,7 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v2.0.18 (GNU/Linux)
+
+iEYEABECAAYFAlC0sEsACgkQvLfPh359R6cXTwCfTmw6Op/cVGzYZaXn91H6iyOA
+gwEAnjJx/Cvwo9Fp7pmiVBaWgxdS93oB
+=cAzr
+-----END PGP SIGNATURE-----
diff --git a/freed-ora/current/f17/sources b/freed-ora/current/f17/sources
index 13501444c..31ffbc561 100644
--- a/freed-ora/current/f17/sources
+++ b/freed-ora/current/f17/sources
@@ -1,2 +1,2 @@
 a2312edd0265b5b07bd4b50afae2b380  linux-libre-3.6-gnu.tar.xz
-a4e642180c7d757a642175fe32e4a264  patch-3.6-gnu-3.6.7-gnu.xz
+3f4d630f49a12079598a3601dd2adb24  patch-3.6-gnu-3.6.8-gnu.xz
diff --git a/freed-ora/current/f17/usb-audio-fix-crash-at-re-preparing-the-PCM-stream.patch b/freed-ora/current/f17/usb-audio-fix-crash-at-re-preparing-the-PCM-stream.patch
deleted file mode 100644
index 9f3e6f993..000000000
--- a/freed-ora/current/f17/usb-audio-fix-crash-at-re-preparing-the-PCM-stream.patch
+++ /dev/null
@@ -1,125 +0,0 @@
-At Thu, 08 Nov 2012 08:31:35 +0100,
-Daniel Mack wrote:
-(snip)
-> >> We can't simply stop both endpoints in the prepare callback.
-> > 
-> > The new function doesn't stop the stream by itself but it just syncs
-> > if the stream is being stopped beforehand.  So, it's safe to call it
-> > there.
-> > 
-> > Maybe the name was confusing.  It should have been like
-> > snd_usb_endpoint_sync_pending_stop() or such.
-> 
-> Ah, right. I was errornously looking closer to Alan's patch but then
-> replied to yours. Alright then - thanks for explaining :)
-
-OK, thanks for checking.
-
-FWIW, below is the patch I applied now to for-linus branch.
-Renamed the function, added the comment and put NULL check to the
-function to simplify.
-
-
-Takashi
-
----
-From: Takashi Iwai <tiwai@suse.de>
-Subject: [PATCH] ALSA: usb-audio: Fix crash at re-preparing the PCM stream
-
-There are bug reports of a crash with USB-audio devices when PCM
-prepare is performed immediately after the stream is stopped via
-trigger callback.  It turned out that the problem is that we don't
-wait until all URBs are killed.
-
-This patch adds a new function to synchronize the pending stop
-operation on an endpoint, and calls in the prepare callback for
-avoiding the crash above.
-
-Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=49181
-
-Reported-and-tested-by: Artem S. Tashkinov <t.artem@lycos.com>
-Cc: <stable@vger.kernel.org> [v3.6]
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
----
- sound/usb/endpoint.c | 13 +++++++++++++
- sound/usb/endpoint.h |  1 +
- sound/usb/pcm.c      |  3 +++
- 3 files changed, 17 insertions(+)
-
-diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
-index 7f78c6d..34de6f2 100644
---- a/sound/usb/endpoint.c
-+++ b/sound/usb/endpoint.c
-@@ -35,6 +35,7 @@
- 
- #define EP_FLAG_ACTIVATED	0
- #define EP_FLAG_RUNNING		1
-+#define EP_FLAG_STOPPING	2
- 
- /*
-  * snd_usb_endpoint is a model that abstracts everything related to an
-@@ -502,10 +503,20 @@ static int wait_clear_urbs(struct snd_usb_endpoint *ep)
- 	if (alive)
- 		snd_printk(KERN_ERR "timeout: still %d active urbs on EP #%x\n",
- 					alive, ep->ep_num);
-+	clear_bit(EP_FLAG_STOPPING, &ep->flags);
- 
- 	return 0;
- }
- 
-+/* sync the pending stop operation;
-+ * this function itself doesn't trigger the stop operation
-+ */
-+void snd_usb_endpoint_sync_pending_stop(struct snd_usb_endpoint *ep)
-+{
-+	if (ep && test_bit(EP_FLAG_STOPPING, &ep->flags))
-+		wait_clear_urbs(ep);
-+}
-+
- /*
-  * unlink active urbs.
-  */
-@@ -918,6 +929,8 @@ void snd_usb_endpoint_stop(struct snd_usb_endpoint *ep,
- 
- 		if (wait)
- 			wait_clear_urbs(ep);
-+		else
-+			set_bit(EP_FLAG_STOPPING, &ep->flags);
- 	}
- }
- 
-diff --git a/sound/usb/endpoint.h b/sound/usb/endpoint.h
-index 6376ccf..3d4c970 100644
---- a/sound/usb/endpoint.h
-+++ b/sound/usb/endpoint.h
-@@ -19,6 +19,7 @@ int snd_usb_endpoint_set_params(struct snd_usb_endpoint *ep,
- int  snd_usb_endpoint_start(struct snd_usb_endpoint *ep, int can_sleep);
- void snd_usb_endpoint_stop(struct snd_usb_endpoint *ep,
- 			   int force, int can_sleep, int wait);
-+void snd_usb_endpoint_sync_pending_stop(struct snd_usb_endpoint *ep);
- int  snd_usb_endpoint_activate(struct snd_usb_endpoint *ep);
- int  snd_usb_endpoint_deactivate(struct snd_usb_endpoint *ep);
- void snd_usb_endpoint_free(struct list_head *head);
-diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
-index 37428f7..5c12a3f 100644
---- a/sound/usb/pcm.c
-+++ b/sound/usb/pcm.c
-@@ -552,6 +552,9 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream)
-		goto unlock;
-	}
- 
-+	snd_usb_endpoint_sync_pending_stop(subs->sync_endpoint);
-+	snd_usb_endpoint_sync_pending_stop(subs->data_endpoint);
-+
-	/* some unit conversions in runtime */
-	subs->data_endpoint->maxframesize =
-		bytes_to_frames(runtime, subs->data_endpoint->maxpacksize);
--- 
-1.8.0
-
-
---
-To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
-the body of a message to majordomo@vger.kernel.org
-More majordomo info at  http://vger.kernel.org/majordomo-info.html
-Please read the FAQ at  http://www.tux.org/lkml/