3.0 patches

10 files changed, 594 insertions, 0 deletions

diff --git a/queue-3.0/arm-7081-1-mach-integrator-fix-the-clocksource.patch b/queue-3.0/arm-7081-1-mach-integrator-fix-the-clocksource.patch
new file mode 100644
index 0000000000..dc169b53db
--- /dev/null
+++ b/queue-3.0/arm-7081-1-mach-integrator-fix-the-clocksource.patch
@@ -0,0 +1,45 @@
+From bb9ea77846620ed2b37e74c852d72c7a476b248c Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Tue, 6 Sep 2011 08:08:13 +0100
+Subject: ARM: 7081/1: mach-integrator: fix the clocksource
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+commit bb9ea77846620ed2b37e74c852d72c7a476b248c upstream.
+
+I was intrigued by the fact that the clock stood still on
+the Integrator, but it wasn't strange at all, because the
+timer was set up all wrong and probably has been for a
+while. With this patch the clock starts ticking again:
+make the timer periodic (reload), |= on the divisor bit
+and load the timer before starting it.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/mach-integrator/integrator_ap.c |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/arm/mach-integrator/integrator_ap.c
++++ b/arch/arm/mach-integrator/integrator_ap.c
+@@ -337,15 +337,15 @@ static unsigned long timer_reload;
+ static void integrator_clocksource_init(u32 khz)
+ {
+ 	void __iomem *base = (void __iomem *)TIMER2_VA_BASE;
+-	u32 ctrl = TIMER_CTRL_ENABLE;
++	u32 ctrl = TIMER_CTRL_ENABLE | TIMER_CTRL_PERIODIC;
+ 
+ 	if (khz >= 1500) {
+ 		khz /= 16;
+-		ctrl = TIMER_CTRL_DIV16;
++		ctrl |= TIMER_CTRL_DIV16;
+ 	}
+ 
+-	writel(ctrl, base + TIMER_CTRL);
+ 	writel(0xffff, base + TIMER_LOAD);
++	writel(ctrl, base + TIMER_CTRL);
+ 
+ 	clocksource_mmio_init(base + TIMER_VALUE, "timer2",
+ 		khz * 1000, 200, 16, clocksource_mmio_readl_down);
diff --git a/queue-3.0/arm-davinci-da850-evm-read-mac-address-from-spi-flash.patch b/queue-3.0/arm-davinci-da850-evm-read-mac-address-from-spi-flash.patch
new file mode 100644
index 0000000000..c7abc15fd5
--- /dev/null
+++ b/queue-3.0/arm-davinci-da850-evm-read-mac-address-from-spi-flash.patch
@@ -0,0 +1,94 @@
+From 810198bc9c109489dfadc57131c5183ce6ad2d7d Mon Sep 17 00:00:00 2001
+From: "Rajashekhara, Sudhakar" <sudhakar.raj@ti.com>
+Date: Tue, 12 Jul 2011 15:58:53 +0530
+Subject: ARM: davinci: da850 EVM: read mac address from SPI flash
+
+From: "Rajashekhara, Sudhakar" <sudhakar.raj@ti.com>
+
+commit 810198bc9c109489dfadc57131c5183ce6ad2d7d upstream.
+
+DA850/OMAP-L138 EMAC driver uses random mac address instead of
+a fixed one because the mac address is not stuffed into EMAC
+platform data.
+
+This patch provides a function which reads the mac address
+stored in SPI flash (registered as MTD device) and populates the
+EMAC platform data. The function which reads the mac address is
+registered as a callback which gets called upon addition of MTD
+device.
+
+NOTE: In case the MAC address stored in SPI flash is erased, follow
+the instructions at [1] to restore it.
+
+[1] http://processors.wiki.ti.com/index.php/GSG:_OMAP-L138_DVEVM_Additional_Procedures#Restoring_MAC_address_on_SPI_Flash
+
+Modifications in v2:
+Guarded registering the mtd_notifier only when MTD is enabled.
+Earlier this was handled using mtd_has_partitions() call, but
+this has been removed in Linux v3.0.
+
+Modifications in v3:
+a. Guarded da850_evm_m25p80_notify_add() function and
+   da850evm_spi_notifier structure with CONFIG_MTD macros.
+b. Renamed da850_evm_register_mtd_user() function to
+   da850_evm_setup_mac_addr() and removed the struct mtd_notifier
+   argument to this function.
+c. Passed the da850evm_spi_notifier structure to register_mtd_user()
+   function.
+
+Modifications in v4:
+Moved the da850_evm_setup_mac_addr() function within the first
+CONFIG_MTD ifdef construct.
+
+Signed-off-by: Rajashekhara, Sudhakar <sudhakar.raj@ti.com>
+Signed-off-by: Sekhar Nori <nsekhar@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/mach-davinci/board-da850-evm.c |   28 ++++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+--- a/arch/arm/mach-davinci/board-da850-evm.c
++++ b/arch/arm/mach-davinci/board-da850-evm.c
+@@ -115,6 +115,32 @@ static struct spi_board_info da850evm_sp
+ 	},
+ };
+ 
++#ifdef CONFIG_MTD
++static void da850_evm_m25p80_notify_add(struct mtd_info *mtd)
++{
++	char *mac_addr = davinci_soc_info.emac_pdata->mac_addr;
++	size_t retlen;
++
++	if (!strcmp(mtd->name, "MAC-Address")) {
++		mtd->read(mtd, 0, ETH_ALEN, &retlen, mac_addr);
++		if (retlen == ETH_ALEN)
++			pr_info("Read MAC addr from SPI Flash: %pM\n",
++				mac_addr);
++	}
++}
++
++static struct mtd_notifier da850evm_spi_notifier = {
++	.add	= da850_evm_m25p80_notify_add,
++};
++
++static void da850_evm_setup_mac_addr(void)
++{
++	register_mtd_user(&da850evm_spi_notifier);
++}
++#else
++static void da850_evm_setup_mac_addr(void) { }
++#endif
++
+ static struct mtd_partition da850_evm_norflash_partition[] = {
+ 	{
+ 		.name           = "bootloaders + env",
+@@ -1237,6 +1263,8 @@ static __init void da850_evm_init(void)
+ 	if (ret)
+ 		pr_warning("da850_evm_init: spi 1 registration failed: %d\n",
+ 				ret);
++
++	da850_evm_setup_mac_addr();
+ }
+ 
+ #ifdef CONFIG_SERIAL_8250_CONSOLE
diff --git a/queue-3.0/arm-davinci-fix-cache-flush-build-error.patch b/queue-3.0/arm-davinci-fix-cache-flush-build-error.patch
new file mode 100644
index 0000000000..5af8e875c7
--- /dev/null
+++ b/queue-3.0/arm-davinci-fix-cache-flush-build-error.patch
@@ -0,0 +1,41 @@
+From 897a6a1a14837d6d582bfd1fd7aba00be44b6469 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Tue, 2 Aug 2011 17:48:38 +0200
+Subject: ARM: davinci: fix cache flush build error
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+commit 897a6a1a14837d6d582bfd1fd7aba00be44b6469 upstream.
+
+The TNET variant of DaVinci compiles some code that it shares
+with other DaVinci variants, however it has a V6 CPU rather than
+an ARM926T, thus the hardcoded call to arm926_flush_kern_cache_all()
+in sleep.S will obviously fail, and we need to build with the
+v6_flush_kern_cache_all() call instead. This was triggered by
+manually altering the DaVinci config to build the TNET version.
+
+Cc: Dave Martin <dave.martin@linaro.org>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sekhar Nori <nsekhar@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/mach-davinci/sleep.S |    6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/mach-davinci/sleep.S
++++ b/arch/arm/mach-davinci/sleep.S
+@@ -217,7 +217,11 @@ ddr2clk_stop_done:
+ ENDPROC(davinci_ddr_psc_config)
+ 
+ CACHE_FLUSH:
+-	.word	arm926_flush_kern_cache_all
++#ifdef CONFIG_CPU_V6
++	.word	v6_flush_kern_cache_all
++#else
++	.word   arm926_flush_kern_cache_all
++#endif
+ 
+ ENTRY(davinci_cpu_suspend_sz)
+ 	.word	. - davinci_cpu_suspend
diff --git a/queue-3.0/avoid-dereferencing-a-request_queue-after-last-close.patch b/queue-3.0/avoid-dereferencing-a-request_queue-after-last-close.patch
new file mode 100644
index 0000000000..f86ee713db
--- /dev/null
+++ b/queue-3.0/avoid-dereferencing-a-request_queue-after-last-close.patch
@@ -0,0 +1,60 @@
+From 94007751bb02797ba87bac7aacee2731ac2039a3 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Sat, 10 Sep 2011 17:20:21 +1000
+Subject: Avoid dereferencing a 'request_queue' after last close.
+
+From: NeilBrown <neilb@suse.de>
+
+commit 94007751bb02797ba87bac7aacee2731ac2039a3 upstream.
+
+On the last close of an 'md' device which as been stopped, the device
+is destroyed and in particular the request_queue is freed.  The free
+is done in a separate thread so it might happen a short time later.
+
+__blkdev_put calls bdev_inode_switch_bdi *after* ->release has been
+called.
+
+Since commit f758eeabeb96f878c860e8f110f94ec8820822a9
+bdev_inode_switch_bdi will dereference the 'old' bdi, which lives
+inside a request_queue, to get a spin lock.  This causes the last
+close on an md device to sometime take a spin_lock which lives in
+freed memory - which results in an oops.
+
+So move the called to bdev_inode_switch_bdi before the call to
+->release.
+
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Hugh Dickins <hughd@google.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Wu Fengguang <fengguang.wu@intel.com>
+Acked-by: Wu Fengguang <fengguang.wu@intel.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/block_dev.c |    7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -1419,6 +1419,11 @@ static int __blkdev_put(struct block_dev
+ 		WARN_ON_ONCE(bdev->bd_holders);
+ 		sync_blockdev(bdev);
+ 		kill_bdev(bdev);
++		/* ->release can cause the old bdi to disappear,
++		 * so must switch it out first
++		 */
++		bdev_inode_switch_bdi(bdev->bd_inode,
++					&default_backing_dev_info);
+ 	}
+ 	if (bdev->bd_contains == bdev) {
+ 		if (disk->fops->release)
+@@ -1432,8 +1437,6 @@ static int __blkdev_put(struct block_dev
+ 		disk_put_part(bdev->bd_part);
+ 		bdev->bd_part = NULL;
+ 		bdev->bd_disk = NULL;
+-		bdev_inode_switch_bdi(bdev->bd_inode,
+-					&default_backing_dev_info);
+ 		if (bdev != bdev->bd_contains)
+ 			victim = bdev->bd_contains;
+ 		bdev->bd_contains = NULL;
diff --git a/queue-3.0/drm-nouveau-properly-handle-allocation-failure-in-nouveau_sgdma_populate.patch b/queue-3.0/drm-nouveau-properly-handle-allocation-failure-in-nouveau_sgdma_populate.patch
new file mode 100644
index 0000000000..5f0f9f3bbf
--- /dev/null
+++ b/queue-3.0/drm-nouveau-properly-handle-allocation-failure-in-nouveau_sgdma_populate.patch
@@ -0,0 +1,36 @@
+From 17c8b960930da3599e47801a54ac0ea1070545d2 Mon Sep 17 00:00:00 2001
+From: Marcin Slusarz <marcin.slusarz@gmail.com>
+Date: Mon, 22 Aug 2011 23:14:05 +0200
+Subject: drm/nouveau: properly handle allocation failure in nouveau_sgdma_populate
+
+From: Marcin Slusarz <marcin.slusarz@gmail.com>
+
+commit 17c8b960930da3599e47801a54ac0ea1070545d2 upstream.
+
+Not cleaning after alloc failure would result in crash on destroy,
+because nouveau_sgdma_clear assumes "ttm_alloced" to be not null when
+"pages" is not null.
+
+Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/nouveau/nouveau_sgdma.c |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/nouveau/nouveau_sgdma.c
++++ b/drivers/gpu/drm/nouveau/nouveau_sgdma.c
+@@ -37,8 +37,11 @@ nouveau_sgdma_populate(struct ttm_backen
+ 		return -ENOMEM;
+ 
+ 	nvbe->ttm_alloced = kmalloc(sizeof(bool) * num_pages, GFP_KERNEL);
+-	if (!nvbe->ttm_alloced)
++	if (!nvbe->ttm_alloced) {
++		kfree(nvbe->pages);
++		nvbe->pages = NULL;
+ 		return -ENOMEM;
++	}
+ 
+ 	nvbe->nr_pages = 0;
+ 	while (num_pages--) {
diff --git a/queue-3.0/hwmon-max16065-fix-current-calculation.patch b/queue-3.0/hwmon-max16065-fix-current-calculation.patch
new file mode 100644
index 0000000000..1c26f75840
--- /dev/null
+++ b/queue-3.0/hwmon-max16065-fix-current-calculation.patch
@@ -0,0 +1,30 @@
+From ff71c182f461da5ae9d2d65f8a63f5a9193b9be1 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <guenter.roeck@ericsson.com>
+Date: Sun, 28 Aug 2011 13:01:49 -0700
+Subject: hwmon: (max16065) Fix current calculation
+
+From: Guenter Roeck <guenter.roeck@ericsson.com>
+
+commit ff71c182f461da5ae9d2d65f8a63f5a9193b9be1 upstream.
+
+Current calculation is completely wrong. Add missing brackets to fix it.
+
+Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Acked-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/max16065.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/max16065.c
++++ b/drivers/hwmon/max16065.c
+@@ -124,7 +124,7 @@ static inline int MV_TO_LIMIT(int mv, in
+ 
+ static inline int ADC_TO_CURR(int adc, int gain)
+ {
+-	return adc * 1400000 / gain * 255;
++	return adc * 1400000 / (gain * 255);
+ }
+ 
+ /*
diff --git a/queue-3.0/md-fix-handling-for-devices-from-2tb-to-4tb-in-0.90.patch b/queue-3.0/md-fix-handling-for-devices-from-2tb-to-4tb-in-0.90.patch
new file mode 100644
index 0000000000..3b36d904ac
--- /dev/null
+++ b/queue-3.0/md-fix-handling-for-devices-from-2tb-to-4tb-in-0.90.patch
@@ -0,0 +1,68 @@
+From 27a7b260f71439c40546b43588448faac01adb93 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Sat, 10 Sep 2011 17:21:28 +1000
+Subject: md: Fix handling for devices from 2TB to 4TB in 0.90
+ metadata.
+
+From: NeilBrown <neilb@suse.de>
+
+commit 27a7b260f71439c40546b43588448faac01adb93 upstream.
+
+0.90 metadata uses an unsigned 32bit number to count the number of
+kilobytes used from each device.
+This should allow up to 4TB per device.
+However we multiply this by 2 (to get sectors) before casting to a
+larger type, so sizes above 2TB get truncated.
+
+Also we allow rdev->sectors to be larger than 4TB, so it is possible
+for the array to be resized larger than the metadata can handle.
+So make sure rdev->sectors never exceeds 4TB when 0.90 metadata is in
+used.
+
+Also the sanity check at the end of super_90_load should include level
+1 as it used ->size too. (RAID0 and Linear don't use ->size at all).
+
+Reported-by: Pim Zandbergen <P.Zandbergen@macroscoop.nl>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/md.c |   12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -1084,8 +1084,11 @@ static int super_90_load(mdk_rdev_t *rde
+ 			ret = 0;
+ 	}
+ 	rdev->sectors = rdev->sb_start;
++	/* Limit to 4TB as metadata cannot record more than that */
++	if (rdev->sectors >= (2ULL << 32))
++		rdev->sectors = (2ULL << 32) - 2;
+ 
+-	if (rdev->sectors < sb->size * 2 && sb->level > 1)
++	if (rdev->sectors < ((sector_t)sb->size) * 2 && sb->level >= 1)
+ 		/* "this cannot possibly happen" ... */
+ 		ret = -EINVAL;
+ 
+@@ -1119,7 +1122,7 @@ static int super_90_validate(mddev_t *md
+ 		mddev->clevel[0] = 0;
+ 		mddev->layout = sb->layout;
+ 		mddev->raid_disks = sb->raid_disks;
+-		mddev->dev_sectors = sb->size * 2;
++		mddev->dev_sectors = ((sector_t)sb->size) * 2;
+ 		mddev->events = ev1;
+ 		mddev->bitmap_info.offset = 0;
+ 		mddev->bitmap_info.default_offset = MD_SB_BYTES >> 9;
+@@ -1361,6 +1364,11 @@ super_90_rdev_size_change(mdk_rdev_t *rd
+ 	rdev->sb_start = calc_dev_sboffset(rdev);
+ 	if (!num_sectors || num_sectors > rdev->sb_start)
+ 		num_sectors = rdev->sb_start;
++	/* Limit to 4TB as metadata cannot record more than that.
++	 * 4TB == 2^32 KB, or 2*2^32 sectors.
++	 */
++	if (num_sectors >= (2ULL << 32))
++		num_sectors = (2ULL << 32) - 2;
+ 	md_super_write(rdev->mddev, rdev, rdev->sb_start, rdev->sb_size,
+ 		       rdev->sb_page);
+ 	md_super_wait(rdev->mddev);
diff --git a/queue-3.0/nuvoton-cir-simplify-raw-ir-sample-handling.patch b/queue-3.0/nuvoton-cir-simplify-raw-ir-sample-handling.patch
new file mode 100644
index 0000000000..9946283517
--- /dev/null
+++ b/queue-3.0/nuvoton-cir-simplify-raw-ir-sample-handling.patch
@@ -0,0 +1,131 @@
+From de4ed0c111ed078b8729a5cc49c23197740f5bad Mon Sep 17 00:00:00 2001
+From: Jarod Wilson <jarod@redhat.com>
+Date: Mon, 8 Aug 2011 17:20:40 -0300
+Subject: [media] nuvoton-cir: simplify raw IR sample handling
+
+From: Jarod Wilson <jarod@redhat.com>
+
+commit de4ed0c111ed078b8729a5cc49c23197740f5bad upstream.
+
+The nuvoton-cir driver was storing up consecutive pulse-pulse and
+space-space samples internally, for no good reason, since
+ir_raw_event_store_with_filter() already merges back to back like
+samples types for us. This should also fix a regression introduced late
+in 3.0 that related to a timeout change, which actually becomes correct
+when coupled with this change. Tested with RC6 and RC5 on my own
+nuvoton-cir hardware atop vanilla 3.0.0, after verifying quirky
+behavior in 3.0 due to the timeout change.
+
+Reported-by: Stephan Raue <sraue@openelec.tv>
+CC: Stephan Raue <sraue@openelec.tv>
+Signed-off-by: Jarod Wilson <jarod@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/rc/nuvoton-cir.c |   45 +++++++----------------------------------
+ drivers/media/rc/nuvoton-cir.h |    1 
+ 2 files changed, 8 insertions(+), 38 deletions(-)
+
+--- a/drivers/media/rc/nuvoton-cir.c
++++ b/drivers/media/rc/nuvoton-cir.c
+@@ -624,7 +624,6 @@ static void nvt_dump_rx_buf(struct nvt_d
+ static void nvt_process_rx_ir_data(struct nvt_dev *nvt)
+ {
+ 	DEFINE_IR_RAW_EVENT(rawir);
+-	unsigned int count;
+ 	u32 carrier;
+ 	u8 sample;
+ 	int i;
+@@ -637,65 +636,38 @@ static void nvt_process_rx_ir_data(struc
+ 	if (nvt->carrier_detect_enabled)
+ 		carrier = nvt_rx_carrier_detect(nvt);
+ 
+-	count = nvt->pkts;
+-	nvt_dbg_verbose("Processing buffer of len %d", count);
++	nvt_dbg_verbose("Processing buffer of len %d", nvt->pkts);
+ 
+ 	init_ir_raw_event(&rawir);
+ 
+-	for (i = 0; i < count; i++) {
+-		nvt->pkts--;
++	for (i = 0; i < nvt->pkts; i++) {
+ 		sample = nvt->buf[i];
+ 
+ 		rawir.pulse = ((sample & BUF_PULSE_BIT) != 0);
+ 		rawir.duration = US_TO_NS((sample & BUF_LEN_MASK)
+ 					  * SAMPLE_PERIOD);
+ 
+-		if ((sample & BUF_LEN_MASK) == BUF_LEN_MASK) {
+-			if (nvt->rawir.pulse == rawir.pulse)
+-				nvt->rawir.duration += rawir.duration;
+-			else {
+-				nvt->rawir.duration = rawir.duration;
+-				nvt->rawir.pulse = rawir.pulse;
+-			}
+-			continue;
+-		}
+-
+-		rawir.duration += nvt->rawir.duration;
+-
+-		init_ir_raw_event(&nvt->rawir);
+-		nvt->rawir.duration = 0;
+-		nvt->rawir.pulse = rawir.pulse;
+-
+-		if (sample == BUF_PULSE_BIT)
+-			rawir.pulse = false;
+-
+-		if (rawir.duration) {
+-			nvt_dbg("Storing %s with duration %d",
+-				rawir.pulse ? "pulse" : "space",
+-				rawir.duration);
++		nvt_dbg("Storing %s with duration %d",
++			rawir.pulse ? "pulse" : "space", rawir.duration);
+ 
+-			ir_raw_event_store_with_filter(nvt->rdev, &rawir);
+-		}
++		ir_raw_event_store_with_filter(nvt->rdev, &rawir);
+ 
+ 		/*
+ 		 * BUF_PULSE_BIT indicates end of IR data, BUF_REPEAT_BYTE
+ 		 * indicates end of IR signal, but new data incoming. In both
+ 		 * cases, it means we're ready to call ir_raw_event_handle
+ 		 */
+-		if ((sample == BUF_PULSE_BIT) && nvt->pkts) {
++		if ((sample == BUF_PULSE_BIT) && (i + 1 < nvt->pkts)) {
+ 			nvt_dbg("Calling ir_raw_event_handle (signal end)\n");
+ 			ir_raw_event_handle(nvt->rdev);
+ 		}
+ 	}
+ 
++	nvt->pkts = 0;
++
+ 	nvt_dbg("Calling ir_raw_event_handle (buffer empty)\n");
+ 	ir_raw_event_handle(nvt->rdev);
+ 
+-	if (nvt->pkts) {
+-		nvt_dbg("Odd, pkts should be 0 now... (its %u)", nvt->pkts);
+-		nvt->pkts = 0;
+-	}
+-
+ 	nvt_dbg_verbose("%s done", __func__);
+ }
+ 
+@@ -1054,7 +1026,6 @@ static int nvt_probe(struct pnp_dev *pde
+ 
+ 	spin_lock_init(&nvt->nvt_lock);
+ 	spin_lock_init(&nvt->tx.lock);
+-	init_ir_raw_event(&nvt->rawir);
+ 
+ 	ret = -EBUSY;
+ 	/* now claim resources */
+--- a/drivers/media/rc/nuvoton-cir.h
++++ b/drivers/media/rc/nuvoton-cir.h
+@@ -67,7 +67,6 @@ static int debug;
+ struct nvt_dev {
+ 	struct pnp_dev *pdev;
+ 	struct rc_dev *rdev;
+-	struct ir_raw_event rawir;
+ 
+ 	spinlock_t nvt_lock;
+ 
diff --git a/queue-3.0/series b/queue-3.0/series
index 155f50f913..f43c89a55e 100644
--- a/queue-3.0/series
+++ b/queue-3.0/series
@@ -69,3 +69,12 @@ mmc-sdhci-s3c-fix-mmc-card-i-o-problem.patch
 xen-use-maximum-reservation-to-limit-amount-of-usable-ram.patch
 xen-x86_32-do-not-enable-iterrupts-when-returning-from.patch
 xen-smp-warn-user-why-they-keel-over-nosmp-or-noapic-and-what-to-use-instead.patch
+hwmon-max16065-fix-current-calculation.patch
+arm-7081-1-mach-integrator-fix-the-clocksource.patch
+arm-davinci-da850-evm-read-mac-address-from-spi-flash.patch
+arm-davinci-fix-cache-flush-build-error.patch
+drm-nouveau-properly-handle-allocation-failure-in-nouveau_sgdma_populate.patch
+avoid-dereferencing-a-request_queue-after-last-close.patch
+md-fix-handling-for-devices-from-2tb-to-4tb-in-0.90.patch
+nuvoton-cir-simplify-raw-ir-sample-handling.patch
+vp7045-fix-buffer-setup.patch
diff --git a/queue-3.0/vp7045-fix-buffer-setup.patch b/queue-3.0/vp7045-fix-buffer-setup.patch
new file mode 100644
index 0000000000..00b49fe0f5
--- /dev/null
+++ b/queue-3.0/vp7045-fix-buffer-setup.patch
@@ -0,0 +1,80 @@
+From fc61ccd35fd59d5362d37c8bf9c0526c85086c84 Mon Sep 17 00:00:00 2001
+From: Florian Mickler <florian@mickler.org>
+Date: Wed, 10 Aug 2011 07:05:20 -0300
+Subject: [media] vp7045: fix buffer setup
+
+From: Florian Mickler <florian@mickler.org>
+
+commit fc61ccd35fd59d5362d37c8bf9c0526c85086c84 upstream.
+
+dvb_usb_device_init calls the frontend_attach method of this driver which
+uses vp7045_usb_ob. In order to have a buffer ready in vp7045_usb_op, it has to
+be allocated before that happens.
+
+Luckily we can use the whole private data as the buffer as it gets separately
+allocated on the heap via kzalloc in dvb_usb_device_init and is thus apt for
+use via usb_control_msg.
+
+This fixes a
+	BUG: unable to handle kernel paging request at 0000000000001e78
+
+reported by Tino Keitel and diagnosed by Dan Carpenter.
+
+Tested-by: Tino Keitel <tino.keitel@tikei.de>
+Signed-off-by: Florian Mickler <florian@mickler.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/dvb/dvb-usb/vp7045.c |   26 ++++----------------------
+ 1 file changed, 4 insertions(+), 22 deletions(-)
+
+--- a/drivers/media/dvb/dvb-usb/vp7045.c
++++ b/drivers/media/dvb/dvb-usb/vp7045.c
+@@ -224,26 +224,8 @@ static struct dvb_usb_device_properties
+ static int vp7045_usb_probe(struct usb_interface *intf,
+ 		const struct usb_device_id *id)
+ {
+-	struct dvb_usb_device *d;
+-	int ret = dvb_usb_device_init(intf, &vp7045_properties,
+-				   THIS_MODULE, &d, adapter_nr);
+-	if (ret)
+-		return ret;
+-
+-	d->priv = kmalloc(20, GFP_KERNEL);
+-	if (!d->priv) {
+-		dvb_usb_device_exit(intf);
+-		return -ENOMEM;
+-	}
+-
+-	return ret;
+-}
+-
+-static void vp7045_usb_disconnect(struct usb_interface *intf)
+-{
+-	struct dvb_usb_device *d = usb_get_intfdata(intf);
+-	kfree(d->priv);
+-	dvb_usb_device_exit(intf);
++	return dvb_usb_device_init(intf, &vp7045_properties,
++				   THIS_MODULE, NULL, adapter_nr);
+ }
+ 
+ static struct usb_device_id vp7045_usb_table [] = {
+@@ -258,7 +240,7 @@ MODULE_DEVICE_TABLE(usb, vp7045_usb_tabl
+ static struct dvb_usb_device_properties vp7045_properties = {
+ 	.usb_ctrl = CYPRESS_FX2,
+ 	.firmware = "dvb-usb-vp7045-01.fw",
+-	.size_of_priv = sizeof(u8 *),
++	.size_of_priv = 20,
+ 
+ 	.num_adapters = 1,
+ 	.adapter = {
+@@ -305,7 +287,7 @@ static struct dvb_usb_device_properties
+ static struct usb_driver vp7045_usb_driver = {
+ 	.name		= "dvb_usb_vp7045",
+ 	.probe		= vp7045_usb_probe,
+-	.disconnect	= vp7045_usb_disconnect,
++	.disconnect	= dvb_usb_device_exit,
+ 	.id_table	= vp7045_usb_table,
+ };
+