commit 7459f116851565dffa17d8db43f37b693bd97b6a Author: Greg Kroah-Hartman Date: Mon Mar 12 13:22:49 2012 -0700 Linux 3.2.10 commit 75d67f37ab959dea9f23953ebda669a93bcfaca1 Author: Ohad Ben-Cohen Date: Sun Mar 4 12:01:11 2012 +0200 ARM: OMAP: fix iommu, not mailbox commit 134d12fae0bb8f3d60dc7440a9e1950bb5427167 upstream. For some weird (freudian?) reason, commit 435792d "ARM: OMAP: make iommu subsys_initcall to fix builtin omap3isp" unintentionally changed the mailbox's initcall instead of the iommu's. Fix that. Reported-by: Fernando Guzman Lugo Signed-off-by: Ohad Ben-Cohen Cc: Laurent Pinchart Cc: Joerg Roedel Cc: Tony Lindgren Signed-off-by: Joerg Roedel Signed-off-by: Greg Kroah-Hartman commit b252c0019c2f83c08a34ec30f563aeb365ab2dda Author: Danny Kukawka Date: Thu Feb 2 14:20:30 2012 +0100 spi-topcliff-pch: rename pch_spi_pcidev to pch_spi_pcidev_driver commit c88db233251b026fda775428f0250c760553e216 upstream. Rename static struct pci_driver pch_spi_pcidev to pch_spi_pcidev_driver to get rid of warnings from modpost checks. Signed-off-by: Danny Kukawka Signed-off-by: Grant Likely Signed-off-by: Greg Kroah-Hartman commit 8c40863a24b6304cdc0ee64249eee812349daa9d Author: Christian Gmeiner Date: Tue Dec 13 21:30:04 2011 +0100 mfd: Fix cs5535 section mismatch commit 97e43c983c721a47546e6db3b7711dcd912a6481 upstream. Silence following warnings: WARNING: drivers/mfd/cs5535-mfd.o(.data+0x20): Section mismatch in reference from the variable cs5535_mfd_drv to the function .devinit.text:cs5535_mfd_probe() The variable cs5535_mfd_drv references the function __devinit cs5535_mfd_probe() If the reference is valid then annotate the variable with __init* or __refdata (see linux/init.h) or name the variable: *driver, *_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console WARNING: drivers/mfd/cs5535-mfd.o(.data+0x28): Section mismatch in reference from the variable cs5535_mfd_drv to the function .devexit.text:cs5535_mfd_remove() The variable cs5535_mfd_drv references the function __devexit cs5535_mfd_remove() If the reference is valid then annotate the variable with __exit* (see linux/init.h) or name the variable: *driver, *_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console Rename the variable from *_drv to *_driver so modpost ignore the OK references to __devinit/__devexit functions. Signed-off-by: Christian Gmeiner Acked-by: Andres Salomon Signed-off-by: Samuel Ortiz Signed-off-by: Greg Kroah-Hartman commit 750e7bd21dea848cfd5cfae4dac029bd150101ee Author: Danny Kukawka Date: Thu Feb 2 14:20:29 2012 +0100 cs5535-mfgpt: don't call __init function from __devinit commit 474de3bbadd9cb75ffc32cc759c40d868343d46c upstream. Fix scan_timers() to be __devinit and not __init since the function get called from cs5535_mfgpt_probe which is __devinit. Signed-off-by: Danny Kukawka Signed-off-by: Greg Kroah-Hartman commit b6f0ec2f968e41af8c44fced27fc345ddb1b8bea Author: Jonathan E Brassow Date: Wed Mar 7 19:09:48 2012 +0000 dm raid: fix flush support commit 0ca93de9b789e0eb05e103f0c04de72df13da73a upstream. Fix dm-raid flush support. Both md and dm have support for flush, but the dm-raid target forgot to set the flag to indicate that flushes should be passed on. (Important for data integrity e.g. with writeback cache enabled.) Signed-off-by: Jonathan Brassow Acked-by: Mike Snitzer Signed-off-by: Alasdair G Kergon Signed-off-by: Greg Kroah-Hartman commit 5e3604168b5994e591db2dece06867a035cd5146 Author: Jonathan E Brassow Date: Wed Mar 7 19:09:47 2012 +0000 dm raid: set MD_CHANGE_DEVS when rebuilding commit 3aa3b2b2b1edb813dc5342d0108befc39541542d upstream. The 'rebuild' parameter is used to rebuild individual devices in an array (e.g. resynchronize a RAID1 device or recalculate a parity device in higher RAID). The MD_CHANGE_DEVS flag must be set when this parameter is given in order to write out the superblocks and make the change take immediate effect. The code that handles new devices in super_load already sets MD_CHANGE_DEVS and 'FirstUse'. (The 'FirstUse' flag was being set as a special case for rebuilds in super_init_validation.) Add a condition for rebuilds in super_load to take care of both flags without the special case in 'super_init_validation'. Signed-off-by: Jonathan Brassow Signed-off-by: Alasdair G Kergon Signed-off-by: Greg Kroah-Hartman commit 73b249403dcb121671bb1f5df101e9ee59b31160 Author: Joe Thornber Date: Wed Mar 7 19:09:44 2012 +0000 dm thin metadata: decrement counter after removing mapped block commit af63bcb817cf708f53bcae6edc2e3fb7dd7d8051 upstream. Correct the number of mapped sectors shown on a thin device's status line by decrementing td->mapped_blocks in __remove() each time a block is removed. Signed-off-by: Joe Thornber Acked-by: Mike Snitzer Signed-off-by: Alasdair G Kergon Signed-off-by: Greg Kroah-Hartman commit b995290dfc5c32a6c7006002e54fed30e4b8f829 Author: Joe Thornber Date: Wed Mar 7 19:09:43 2012 +0000 dm thin metadata: unlock superblock in init_pmd error path commit 4469a5f387fdde956894137751a41473618a4a52 upstream. If dm_sm_disk_create() fails the superblock must be unlocked. Signed-off-by: Joe Thornber Acked-by: Mike Snitzer Signed-off-by: Alasdair G Kergon Signed-off-by: Greg Kroah-Hartman commit 6cb44f13d19edb09a4d53cef4d17773d9bb03e39 Author: Mike Snitzer Date: Wed Mar 7 19:09:41 2012 +0000 dm thin metadata: remove incorrect close_device on creation error paths commit 1f3db25d8be4ac50b897b39609802183ea68a514 upstream. The __open_device() error paths in __create_thin() and __create_snap() incorrectly call __close_device() even if td was not initialized by __open_device(). Remove this. Also document __open_device() return values, remove a redundant td->changed = 1 in __create_thin(), and insert an additional safeguard against creating an already-existing device. Signed-off-by: Mike Snitzer Signed-off-by: Alasdair G Kergon Signed-off-by: Greg Kroah-Hartman commit 4175e9d6c44519cd60f4a9efbf031cfa37e42be2 Author: Mike Snitzer Date: Wed Mar 7 19:09:39 2012 +0000 dm flakey: fix crash on read when corrupt_bio_byte not set commit 1212268fd9816e3b8801e57b896fceaec71969ad upstream. The following BUG is hit on the first read that is submitted to a dm flakey test device while the device is "down" if the corrupt_bio_byte feature wasn't requested when the device's table was loaded. Example DM table that will hit this BUG: 0 2097152 flakey 8:0 2048 0 30 This bug was introduced by commit a3998799fb4df0b0af8271a7d50c4269032397aa (dm flakey: add corrupt_bio_byte feature) in v3.1-rc1. BUG: unable to handle kernel paging request at ffff8801cfce3fff IP: [] corrupt_bio_data+0x6e/0xae [dm_flakey] PGD 1606063 PUD 0 Oops: 0002 [#1] SMP ... Call Trace: [] flakey_end_io+0x42/0x48 [dm_flakey] [] clone_endio+0x54/0xb6 [dm_mod] [] bio_endio+0x2d/0x2f [] req_bio_endio+0x96/0x9f [] blk_update_request+0x1dc/0x3a9 [] ? rcu_read_unlock+0x21/0x23 [] blk_update_bidi_request+0x20/0x6e [] blk_end_bidi_request+0x1f/0x5d [] blk_end_request+0x10/0x12 [] scsi_io_completion+0x1e5/0x4b1 [] scsi_finish_command+0xec/0xf5 [] scsi_softirq_done+0xff/0x108 [] blk_done_softirq+0x84/0x98 [] __do_softirq+0xe3/0x1d5 [] ? _raw_spin_lock+0x62/0x69 [] ? handle_irq_event+0x4c/0x61 [] call_softirq+0x1c/0x30 [] do_softirq+0x4b/0xa3 [] irq_exit+0x53/0xca [] do_IRQ+0x9d/0xb4 [] common_interrupt+0x73/0x73 ... Signed-off-by: Mike Snitzer Signed-off-by: Alasdair G Kergon Signed-off-by: Greg Kroah-Hartman commit 6cfee3190217a11b1566e2fa6fe9d05c12146f4f Author: Milan Broz Date: Wed Mar 7 19:09:37 2012 +0000 dm io: fix discard support commit 0c535e0d6f463365c29623350dbd91642363c39b upstream. This patch fixes a crash by recognising discards in dm_io. Currently dm_mirror can send REQ_DISCARD bios if running over a discard-enabled device and without support in dm_io the system crashes badly. BUG: unable to handle kernel paging request at 00800000 IP: __bio_add_page.part.17+0xf5/0x1e0 ... bio_add_page+0x56/0x70 dispatch_io+0x1cf/0x240 [dm_mod] ? km_get_page+0x50/0x50 [dm_mod] ? vm_next_page+0x20/0x20 [dm_mod] ? mirror_flush+0x130/0x130 [dm_mirror] dm_io+0xdc/0x2b0 [dm_mod] ... Introduced in 2.6.38-rc1 by commit 5fc2ffeabb9ee0fc0e71ff16b49f34f0ed3d05b4 (dm raid1: support discard). Signed-off-by: Milan Broz Acked-by: Mike Snitzer Signed-off-by: Alasdair G Kergon Signed-off-by: Greg Kroah-Hartman commit e2ece17aceb773d9be4f0eb75f7f7360bcf06259 Author: Jesper Juhl Date: Wed Mar 7 19:09:34 2012 +0000 dm ioctl: do not leak argv if target message only contains whitespace commit 902c6a96a7cb9c50d2a8aed1788efad0a5d8f04c upstream. If 'argc' is zero we jump to the 'out:' label, but this leaks the (unused) memory that 'dm_split_args()' allocated for 'argv' if the string being split consisted entirely of whitespace. Jump to the 'out_argv:' label instead to free up that memory. Signed-off-by: Jesper Juhl Signed-off-by: Alasdair G Kergon Signed-off-by: Greg Kroah-Hartman commit a5a2f494f9eff644c5369807a472cc6d9722baed Author: Jan Beulich Date: Thu Mar 8 08:58:13 2012 +0000 x86/amd: iommu_set_device_table() must not be __init commit 6b7f000eb6a0b81d7a809833edb7a457eedf8512 upstream. This function is called from enable_iommus(), which in turn is used from amd_iommu_resume(). Signed-off-by: Jan Beulich Signed-off-by: Joerg Roedel Signed-off-by: Greg Kroah-Hartman commit 5df11c989c126568ce9d383ec1898bfeb8548ed4 Author: Sebastian Siewior Date: Wed Mar 7 10:19:28 2012 +0000 net/usbnet: avoid recursive locking in usbnet_stop() commit 4231d47e6fe69f061f96c98c30eaf9fb4c14b96d upstream. |kernel BUG at kernel/rtmutex.c:724! |[] (rt_spin_lock_slowlock+0x108/0x2bc) from [] (defer_bh+0x1c/0xb4) |[] (defer_bh+0x1c/0xb4) from [] (rx_complete+0x14c/0x194) |[] (rx_complete+0x14c/0x194) from [] (usb_hcd_giveback_urb+0xa0/0xf0) |[] (usb_hcd_giveback_urb+0xa0/0xf0) from [] (musb_giveback+0x34/0x40) |[] (musb_giveback+0x34/0x40) from [] (musb_advance_schedule+0xb4/0x1c0) |[] (musb_advance_schedule+0xb4/0x1c0) from [] (musb_cleanup_urb.isra.9+0x80/0x8c) |[] (musb_cleanup_urb.isra.9+0x80/0x8c) from [] (musb_urb_dequeue+0xec/0x108) |[] (musb_urb_dequeue+0xec/0x108) from [] (unlink1+0xbc/0xcc) |[] (unlink1+0xbc/0xcc) from [] (usb_hcd_unlink_urb+0x54/0xa8) |[] (usb_hcd_unlink_urb+0x54/0xa8) from [] (unlink_urbs.isra.17+0x2c/0x58) |[] (unlink_urbs.isra.17+0x2c/0x58) from [] (usbnet_terminate_urbs+0x94/0x10c) |[] (usbnet_terminate_urbs+0x94/0x10c) from [] (usbnet_stop+0x100/0x15c) |[] (usbnet_stop+0x100/0x15c) from [] (__dev_close_many+0x94/0xc8) defer_bh() takes the lock which is hold during unlink_urbs(). The safe walk suggest that the skb will be removed from the list and this is done by defer_bh() so it seems to be okay to drop the lock here. Reported-by: Aníbal Almeida Pinto Signed-off-by: Sebastian Andrzej Siewior Acked-by: Oliver Neukum Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit b5718645fe623bca4e87d3a0f5c6148d3dc19a00 Author: Marek Olšák Date: Wed Mar 7 23:33:00 2012 +0100 drm/radeon/kms: set SX_MISC in the r6xx blit code (v2) commit cf00790dea6f210ddd01a6656da58c7c9a4ea0e4 upstream. Mesa may set it to 1, causing all primitives to be killed. v2: also update the r7xx code Signed-off-by: Marek Olšák Reviewed-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 2cfb4e5c22726c099645a7e5fc447d4ffcfca85c Author: Christian Lamparter Date: Sat Feb 25 21:36:36 2012 +0100 carl9170: fix frame delivery if sta is in powersave mode commit 9926a67557532acb6cddb1c1add02952175b5c72 upstream. Nicolas Cavallari discovered that carl9170 has some serious problems delivering data to sleeping stations. It turns out that the driver was not honoring two important flags (IEEE80211_TX_CTL_POLL_RESPONSE and IEEE80211_TX_CTL_CLEAR_PS_FILT) which are set on frames that should be sent although the receiving station is still in powersave mode. Reported-by: Nicolas Cavallari Signed-off-by: Christian Lamparter Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 273c20d42332bbbf368a0c61c330055b5fd695dc Author: Nicolas Cavallari Date: Thu Feb 23 16:53:34 2012 +0100 carl9170: Fix memory accounting when sta is in power-save mode. commit 992d52529d7840236d3059b51c15d5eb9e81a869 upstream. On Access Point mode, when transmitting a packet, if the destination station is in powersave mode, we abort transmitting the packet to the device queue, but we do not reclaim the allocated memory. Given enough packets, we can go in a state where there is no packet on the device queue, but we think the device has no memory left, so no packet gets transmitted, connections breaks and the AP stops working. This undo the allocation done in the TX path when the station is in power-save mode. Signed-off-by: Nicolas Cavallari Acked-by: Christian Lamparter Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 139e7860c91207f954a87149a8d64eddbbd73bd8 Author: Guenter Roeck Date: Wed Mar 7 03:58:55 2012 -0800 hwmon: (zl6100) Maintain delay parameter in driver instance data commit 7ad6307ad6968ce25cecf209d4822d4c722be030 upstream. A global delay parameter has the side effect of being overwritten with 0 if a single ZL2004 or ZL6105 is instantiated. If other chips supported by the same driver are in the system, this will result in access errors for those chips. To solve the problem, keep a per-instance copy of the delay parameter, and do not change the original parameter. Signed-off-by: Guenter Roeck Acked-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit dabd9c99a0eb990e88aee8660272179f8d21d1fa Author: Guenter Roeck Date: Mon Mar 5 11:13:52 2012 -0800 hwmon: (jc42) Add support for AT30TS00, TS3000GB2, TSE2002GB2, and MCP9804 commit 1bd612a25855f4cc9345052b53d7da697dba6358 upstream. Also update IDT datasheet locations. Signed-off-by: Guenter Roeck Acked-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit 06a9a71eccdabd0b5e10b5965f9cbba06ee77153 Author: Jean Delvare Date: Mon Mar 5 08:32:00 2012 -0500 hwmon: (jc42) Add support for ST Microelectronics STTS2002 and STTS3000 commit 4de86126a712ba83fa038d277c8282f7ed466a4b upstream. These are fully compatible with Jedec JC 42.4 as far as I can see. Signed-off-by: Jean Delvare Cc: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit f9e158428be2eddd7de7da259e1a4d5c48ce0672 Author: Guenter Roeck Date: Sun Mar 4 08:10:57 2012 -0800 hwmon: (pmbus_core) Fix maximum number of POUT alarm attributes commit 7cb3c44fb1f7999e4c53b6a52de6bc25da6de079 upstream. There are up to three POUT alarm attributes, not two, since cap_alarm was added. Reported-by: Michele Petracca Signed-off-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit 349409f0ccd8ee34a3fe3d02f843b3fcec505719 Author: Akio Idehara Date: Thu Mar 8 13:48:12 2012 -0600 Input: ALPS - fix touchpad detection when buttons are pressed commit 99c90ab31fad855b9da9dee3a5aa6c27f263e9d6 upstream. ALPS touchpad detection fails if some buttons of ALPS are pressed. The reason is that the "E6" query response byte is different from what is expected. This was tested on a Toshiba Portege R500. Signed-off-by: Akio Idehara Tested-by: Seth Forshee Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman commit d6bc69349915e2d58499165851a17280c97126ac Author: Ben Hutchings Date: Wed Nov 16 01:54:04 2011 -0300 media: staging: lirc_serial: Do not assume error codes returned by request_irq() commit affc9a0d59ac49bd304e2137bd5e4ffdd6fdfa52 upstream. lirc_serial_probe() must fail if request_irq() returns an error, even if it isn't EBUSY or EINVAL, Signed-off-by: Ben Hutchings Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Nieder Signed-off-by: Greg Kroah-Hartman commit 47cd23fd083012c8f11a93be0af485d5f2358491 Author: Ben Hutchings Date: Wed Nov 16 01:53:25 2011 -0300 media: staging: lirc_serial: Fix deadlock on resume failure commit 1ff1d88e862948ae5bfe490248c023ff8ac2855d upstream. A resume function cannot remove the device it is resuming! Signed-off-by: Ben Hutchings Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Nieder Signed-off-by: Greg Kroah-Hartman commit 1632fb6031bb1510ec61a1540b348cf08640450c Author: Ben Hutchings Date: Wed Nov 16 01:52:11 2011 -0300 media: staging: lirc_serial: Free resources on failure paths of lirc_serial_probe() commit c8e57e1b766c2321aa76ee5e6878c69bd2313d62 upstream. Failure to allocate the I/O region leaves the IRQ allocated. A later failure leaves them both allocated. Reported-by: Torsten Crass Signed-off-by: Ben Hutchings Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Nieder Signed-off-by: Greg Kroah-Hartman commit 06b267b55cddb826dca2cc3b5eacc4ca760696f3 Author: Ben Hutchings Date: Wed Nov 16 01:49:41 2011 -0300 media: staging: lirc_serial: Fix init/exit order commit 9105b8b200410383d0854bbe237ee385d7d33ba6 upstream. Currently the module init function registers a platform_device and only then allocates its IRQ and I/O region. This allows allocation to race with the device's suspend() function. Instead, allocate resources in the platform driver's probe() function and free them in the remove() function. The module exit function removes the platform device before the character device that provides access to it. Change it to reverse the order of initialisation. Signed-off-by: Ben Hutchings Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Nieder Signed-off-by: Greg Kroah-Hartman commit 261d612b2edcb3e8b00ad990b6b81c71e4a5d108 Author: Will Deacon Date: Tue Mar 6 17:35:55 2012 +0100 ARM: 7357/1: perf: fix overflow handling for xscale2 PMUs commit 3f31ae121348afd9ed39700ea2a63c17cd7eeed1 upstream. xscale2 PMUs indicate overflow not via the PMU control register, but by a separate overflow FLAG register instead. This patch fixes the xscale2 PMU code to use this register to detect to overflow and ensures that we clear any pending overflow when disabling a counter. Signed-off-by: Will Deacon Signed-off-by: Russell King Signed-off-by: Greg Kroah-Hartman commit 288733a6065034d1870b02b164da0fb2d8452178 Author: Will Deacon Date: Tue Mar 6 17:34:50 2012 +0100 ARM: 7356/1: perf: check that we have an event in the PMU IRQ handlers commit f6f5a30c834135c9f2fa10400c59ebbdd9188567 upstream. The PMU IRQ handlers in perf assume that if a counter has overflowed then perf must be responsible. In the paranoid world of crazy hardware, this could be false, so check that we do have a valid event before attempting to dereference NULL in the interrupt path. Signed-off-by: Ming Lei Signed-off-by: Will Deacon Signed-off-by: Russell King Signed-off-by: Greg Kroah-Hartman commit 075964ad4370162964f41ba1136b8581ab1a302a Author: Will Deacon Date: Tue Mar 6 17:34:22 2012 +0100 ARM: 7355/1: perf: clear overflow flag when disabling counter on ARMv7 PMU commit 99c1745b9c76910e195889044f914b4898b7c9a5 upstream. When disabling a counter on an ARMv7 PMU, we should also clear the overflow flag in case an overflow occurred whilst stopping the counter. This prevents a spurious overflow being picked up later and leading to either false accounting or a NULL dereference. Reported-by: Ming Lei Signed-off-by: Will Deacon Signed-off-by: Russell King Signed-off-by: Greg Kroah-Hartman commit 14e84b15bcd96521190c5566c440c56553e66fc9 Author: Will Deacon Date: Tue Mar 6 17:33:17 2012 +0100 ARM: 7354/1: perf: limit sample_period to half max_period in non-sampling mode commit 5727347180ebc6b4a866fcbe00dcb39cc03acb37 upstream. On ARM, the PMU does not stop counting after an overflow and therefore IRQ latency affects the new counter value read by the kernel. This is significant for non-sampling runs where it is possible for the new value to overtake the previous one, causing the delta to be out by up to max_period events. Commit a737823d ("ARM: 6835/1: perf: ensure overflows aren't missed due to IRQ latency") attempted to fix this problem by allowing interrupt handlers to pass an overflow flag to the event update function, causing the overflow calculation to assume that the counter passed through zero when going from prev to new. Unfortunately, this doesn't work when overflow occurs on the perf_task_tick path because we have the flag cleared and end up computing a large negative delta. This patch removes the overflow flag from armpmu_event_update and instead limits the sample_period to half of the max_period for non-sampling profiling runs. Signed-off-by: Ming Lei Signed-off-by: Will Deacon Signed-off-by: Russell King Signed-off-by: Greg Kroah-Hartman commit 2ae3680cf82320f15bc142cdfa8b5499d2b17edd Author: Will Deacon Date: Fri Feb 24 12:12:38 2012 +0100 ARM: 7345/1: errata: update workaround for A9 erratum #743622 commit efbc74ace95338484f8d732037b99c7c77098fce upstream. Erratum #743622 affects all r2 variants of the Cortex-A9 processor, so ensure that the workaround is applied regardless of the revision. Reported-by: Russell King Signed-off-by: Will Deacon Signed-off-by: Russell King Signed-off-by: Greg Kroah-Hartman commit eb49e7c1013923b35e5c69a0686331477891cacb Author: Rob Clark Date: Mon Feb 20 15:03:36 2012 -0600 OMAPDSS: HDMI: hot plug detect fix commit ca888a7958b3d808e4efd08ceff88913f4212c69 upstream. The "OMAPDSS: HDMI: PHY burnout fix" commit switched the HDMI driver over to using a GPIO for plug detect. Unfortunately the ->detect() method was not also updated, causing HDMI to no longer work for the omapdrm driver (because it would actually check if a connection was detected before attempting to enable display). Signed-off-by: Rob Clark Signed-off-by: Tomi Valkeinen Signed-off-by: Greg Kroah-Hartman commit 338b2875624561c3ea57d95519497527c06d123f Author: Tomi Valkeinen Date: Tue Jan 17 11:09:57 2012 +0200 OMAPDSS: HDMI: PHY burnout fix commit c49d005b6cc8491fad5b24f82805be2d6bcbd3dd upstream. A hardware bug in the OMAP4 HDMI PHY causes physical damage to the board if the HDMI PHY is kept powered on when the cable is not connected. This patch solves the problem by adding hot-plug-detection into the HDMI IP driver. This is not a real HPD support in the sense that nobody else than the IP driver gets to know about the HPD events, but is only meant to fix the HW bug. The strategy is simple: If the display device is turned off by the user, the PHY power is set to OFF. When the display device is turned on by the user, the PHY power is set either to LDOON or TXON, depending on whether the HDMI cable is connected. The reason to avoid PHY OFF when the display device is on, but the cable is disconnected, is that when the PHY is turned OFF, the HDMI IP is not "ticking" and thus the DISPC does not receive pixel clock from the HDMI IP. This would, for example, prevent any VSYNCs from happening, and would thus affect the users of omapdss. By using LDOON when the cable is disconnected we'll avoid the HW bug, but keep the HDMI working as usual from the user's point of view. Signed-off-by: Tomi Valkeinen Signed-off-by: Greg Kroah-Hartman commit 27b7be99f3d5cca4eeb179a2cb4bf435e356665c Author: Tomi Valkeinen Date: Tue Jan 17 11:05:32 2012 +0200 OMAP: 4430SDP/Panda: add HDMI HPD gpio commit aa74274b464d4aa24703963ac89a0ee942d5d267 upstream. Both Panda and 4430SDP use GPIO 63 as HDMI hot-plug-detect. Configure this GPIO in the board files. Signed-off-by: Tomi Valkeinen Acked-by: Tony Lindgren Signed-off-by: Greg Kroah-Hartman commit 08324b6a29b9fd2886bd4e5a9bbd36fef5d97e5e Author: Tomi Valkeinen Date: Tue Jan 17 11:02:36 2012 +0200 OMAP: 4430SDP/Panda: setup HDMI GPIO muxes commit 78a1ad8f12db70b8b0a4548b90704de08ee216ce upstream. The HDMI GPIO pins LS_OE and CT_CP_HPD are not currently configured. This patch configures them as output pins. Signed-off-by: Tomi Valkeinen Acked-by: Tony Lindgren Signed-off-by: Greg Kroah-Hartman commit 9bf9c2aa95cd1029ee741d678e14c6613d000d00 Author: Tomi Valkeinen Date: Tue Jan 17 10:59:00 2012 +0200 OMAPDSS: remove wrong HDMI HPD muxing commit 7bb122d155f742fe2d79849090c825be7b4a247e upstream. "hdmi_hpd" pin is muxed to INPUT and PULLUP, but the pin is not currently used, and in the future when it is used, the pin is used as a GPIO and is board specific, not an OMAP4 wide thing. So remove the muxing for now. Signed-off-by: Tomi Valkeinen Acked-by: Tony Lindgren Signed-off-by: Greg Kroah-Hartman commit 4426a123e14c485289388aeaa3a44b960baf4761 Author: Tomi Valkeinen Date: Tue Jan 17 10:49:38 2012 +0200 OMAP: 4430SDP/Panda: rename HPD GPIO to CT_CP_HPD commit 3932a32fcf5393f8be70ac99dc718ad7ad0a415b upstream. The GPIO 60 on 4430sdp and Panda is not HPD GPIO, as currently marked in the board files, but CT_CP_HPD, which is used to enable/disable HPD functionality. This patch renames the GPIO. Signed-off-by: Tomi Valkeinen Acked-by: Tony Lindgren Signed-off-by: Greg Kroah-Hartman commit 6be5647f79a391624478597d785cc9ae79cae57b Author: Tomi Valkeinen Date: Tue Jan 17 11:04:53 2012 +0200 OMAP: 4430SDP/Panda: use gpio_free_array to free HDMI gpios commit 575753e3bea3b67eef8e454fb87f719e3f7da599 upstream. Instead of freeing the GPIOs individually, use gpio_free_array(). Signed-off-by: Tomi Valkeinen Acked-by: Tony Lindgren Signed-off-by: Greg Kroah-Hartman commit 4386ec707e18eefb8c9d41d14e27fae638f81a5b Author: Andrew Lunn Date: Wed Feb 8 15:52:07 2012 +0100 ARM: orion: Fix Orion5x GPIO regression from MPP cleanup commit b06540371063f0f07aafc1d1ac5e974da85c973c upstream. Patchset "ARM: orion: Refactor the MPP code common in the orion platform" broke at least Orion5x based platforms. These platforms have pins configured as GPIO when the selector is not 0x0. However the common code assumes the selector is always 0x0 for a GPIO lines. It then ignores the GPIO bits in the MPP definitions, resulting in that Orion5x machines cannot correctly configure there GPIO lines. The Fix removes the assumption that the selector is always 0x0. In order that none GPIO configurations are correctly blocked, Kirkwood and mv78xx0 MPP definitions are corrected to only set the GPIO bits for GPIO configurations. This third version, which does not contain any whitespace changes, and is rebased on v3.3-rc2. Signed-off-by: Andrew Lunn Acked-by: Nicolas Pitre Signed-off-by: Olof Johansson commit 041b2375a0fa2333c194c13d7615a41af6c40346 Author: Andrew Lunn Date: Wed Feb 8 15:52:47 2012 +0100 ARM: orion: Fix USB phy for orion5x. commit 72053353583230952c4b187e110e9da00dfc3afb upstream. The patch "ARM: orion: Consolidate USB platform setup code.", commit 4fcd3f374a928081d391cd9a570afe3b2c692fdc broke USB on TS-7800 and other orion5x boards, because the wrong type of PHY was being passed to the EHCI driver in the platform data. Orion5x needs EHCI_PHY_ORION and all the others want EHCI_PHY_NA. Allow the mach- code to tell the generic plat-orion code which USB PHY enum to place into the platform data. Version 2: Rebase to v3.3-rc2. Reported-by: Ambroz Bizjak Signed-off-by: Andrew Lunn Tested-by: Ambroz Bizjak Acked-by: Nicolas Pitre Signed-off-by: Olof Johansson Signed-off-by: Greg Kroah-Hartman commit 1231a3d0716d4887e974a44429102a9696117893 Author: Wu Fengguang Date: Fri Dec 9 20:42:17 2011 +0800 drm/i915: fix ELD writing for SandyBridge commit b3f33cbf7ace8fc149993ee35e0d0fd57f41d6d8 upstream. SandyBridge should be using the same register addresses as IvyBridge. Signed-off-by: Wu Fengguang Signed-off-by: Keith Packard Signed-off-by: Eugeni Dodonov Signed-off-by: Greg Kroah-Hartman commit 68d5d009e3289663097034e91e58a1bc377f94db Author: Kenneth Graunke Date: Wed Feb 8 12:53:52 2012 -0800 drm/i915: gen7: Disable the RHWO optimization as it can cause GPU hangs. commit d71de14ddf423ccc9a2e3f7e37553c99ead20d7c upstream. The BSpec Workarounds page states that bits 10 and 26 must be set to avoid 3D ring hangs. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=41353 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=44610 Tested-by: Eugeni Dodonov Signed-off-by: Kenneth Graunke Signed-off-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman commit 0cb90a0f52669b5ba8302fd74d496f8dd18d5dfd Author: Eugeni Dodonov Date: Wed Feb 8 12:53:51 2012 -0800 drm/i915: gen7: work around a system hang on IVB commit db099c8f963fe656108e0a068274c5580a17f69b upstream. This adds the workaround for WaCatErrorRejectionIssue which could result in a system hang. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=41353 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=44610 Tested-by: Eugeni Dodonov Reviewed-by: Kenneth Graunke Signed-off-by: Eugeni Dodonov Signed-off-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman commit a7cf47dd8415c695cec43316c2539ced262e7fbe Author: Eugeni Dodonov Date: Wed Feb 8 12:53:50 2012 -0800 drm/i915: gen7: Implement an L3 caching workaround. commit e4e0c058a19c41150d12ad2d3023b3cf09c5de67 upstream. This adds two cache-related workarounds for Ivy Bridge which can lead to 3D ring hangs and corruptions. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=41353 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=44610 Tested-by: Eugeni Dodonov Signed-off-by: Eugeni Dodonov Signed-off-by: Kenneth Graunke Signed-off-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman commit e48cb70003c76791ada1525755d600676e344c90 Author: Eugeni Dodonov Date: Wed Feb 8 12:53:49 2012 -0800 drm/i915: gen7: implement rczunit workaround commit eae66b50c760233fad526edf4a0d327be17a055d upstream. This is yet another workaround related to clock gating which we need on Ivy Bridge. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=41353 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=44610 Tested-by: Eugeni Dodonov Signed-off-by: Eugeni Dodonov Signed-off-by: Kenneth Graunke Signed-off-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman commit 7b53686e9944fb4cc14b47028214d615dc6fbe9e Author: Larry Finger Date: Tue Oct 18 17:52:01 2011 -0500 rtl8192cu: Add new device IDs commit 6cddafab54e9a17b2efefe982547865955a5ff3a upstream. The latest vendor (non-mac80211) driver of 9/22/2011 shows some new device IDs for rtl8192cu. In addition, some typos in the table are fixed and one duplicate is removed. Signed-off-by: Larry Finger Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit c85ec339a39f305edd1bfaebea43526ae091a213 Author: Keng-Yu Lin Date: Fri Dec 2 00:04:23 2011 +0100 ACPI / PM: Do not save/restore NVS on Asus K54C/K54HR commit 5a50a7c32d630d6cdb13d69afabb0cc81b2f379c upstream. The models do not resume correctly without acpi_sleep=nonvs. Signed-off-by: Keng-Yu Lin Signed-off-by: Rafael J. Wysocki Cc: Tim Gardner Signed-off-by: Greg Kroah-Hartman commit 5ef549f2607d18731f5c1a78f0284ba4b4e0a277 Author: Fabio Baltieri Date: Fri Feb 3 15:37:14 2012 -0800 avr32: select generic atomic64_t support commit 31e0017e6f6fb5cfdfaf932c1f98c9bef8d57688 upstream. Enable use of the generic atomic64 implementation on AVR32 platforms. Without this the kernel fails to build as the architecture does not provide its version. Signed-off-by: Fabio Baltieri Acked-by: Hans-Christian Egtvedt Cc: Haavard Skinnemoen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Cc: Jean-Christophe PLAGNIOL-VILLARD Signed-off-by: Greg Kroah-Hartman commit 6e118375b14e1cd89cab325c79faf6f48dc9c50b Author: Stanislaw Gruszka Date: Wed Feb 8 20:02:03 2012 +0100 bsg: fix sysfs link remove warning commit 37b40adf2d1b4a5e51323be73ccf8ddcf3f15dd3 upstream. We create "bsg" link if q->kobj.sd is not NULL, so remove it only when the same condition is true. Fixes: WARNING: at fs/sysfs/inode.c:323 sysfs_hash_and_remove+0x2b/0x77() sysfs: can not remove 'bsg', no directory Call Trace: [] warn_slowpath_common+0x6a/0x7f [] ? sysfs_hash_and_remove+0x2b/0x77 [] warn_slowpath_fmt+0x2b/0x2f [] sysfs_hash_and_remove+0x2b/0x77 [] sysfs_remove_link+0x20/0x23 [] bsg_unregister_queue+0x40/0x6d [] __scsi_remove_device+0x31/0x9d [] scsi_forget_host+0x41/0x52 [] scsi_remove_host+0x71/0xe0 [] quiesce_and_remove_host+0x51/0x83 [usb_storage] [] usb_stor_disconnect+0x18/0x22 [usb_storage] [] usb_unbind_interface+0x4e/0x109 [] __device_release_driver+0x6b/0xa6 [] device_release_driver+0x17/0x22 [] bus_remove_device+0xd6/0xe6 [] device_del+0xf2/0x137 [] usb_disable_device+0x94/0x1a0 Signed-off-by: Stanislaw Gruszka Signed-off-by: Jens Axboe Signed-off-by: Tim Gardner Signed-off-by: Greg Kroah-Hartman commit b3b7b02653b8b9f8f2c6fabe97801600e4716d74 Author: Javier Martin Date: Thu Feb 23 15:43:18 2012 +0100 ASoC: i.MX SSI: Fix DSP_A format. commit 5ed80a75b248bfaf840ea6b38f941edcf6ee7dc7 upstream. According to i.MX27 Reference Manual (p 1593) TXBIT0 bit selects whether the most significant or the less significant part of the data word written to the FIFO is transmitted. As DSP_A is the same as DSP_B with a data offset of 1 bit, it doesn't make any sense to remove TXBIT0 bit here. Signed-off-by: Javier Martin Acked-by: Sascha Hauer Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit aee50f92f5b1b34650f76b164537691be95bfa24 Author: Mark Brown Date: Wed Feb 22 15:52:56 2012 +0000 ASoC: dapm: Check for bias level when powering down commit 7679e42ec833ed70aa34790a5f39dcb7e5bda4fe upstream. Recent enhancements in the bias management means that we might not be in standby when the CODEC is idle and can have active widgets without being in full power mode but the shutdown functionality assumes these things. Add checks for the bias level at each stage so that we don't do transitions other than the ON->PREPARE->STANDBY->OFF ones that the drivers are expecting. Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 85115b995d54857bbaa30a4966ed5c897d903387 Author: Florian Tobias Schandinat Date: Wed Feb 22 18:53:08 2012 +0000 viafb: fix IGA1 modesetting on VX900 commit e29206381a1436e0f47c0f5b9a23159a03c57715 upstream. Even if the documentation calls this bit "Reserved" it has to be set to 0 for correct modesetting on IGA1. Signed-off-by: Florian Tobias Schandinat Signed-off-by: Greg Kroah-Hartman commit 7be431e4a9ab89aa208116fd4001be0361a0c89c Author: Florian Tobias Schandinat Date: Wed Feb 22 18:53:07 2012 +0000 viafb: select HW scaling on VX900 for IGA2 commit 050f0e02c8dc38b2b4f2df345ac760d22ca5c7ba upstream. VX900 can do hardware scaling for both IGAs in contrast to previous hardware which could do it only for IGA2. This patch ensures that we set the parameter for IGA2 and not for IGA1. This fixes hardware scaling on VX900 until we have the infrastructure to support it for both IGAs. Signed-off-by: Florian Tobias Schandinat Signed-off-by: Greg Kroah-Hartman commit 65088b82b22e2dddc522338a6b075b000a0d0d1c Author: Boaz Harrosh Date: Wed Jan 25 21:42:58 2012 +0200 osd_uld: Bump MAX_OSD_DEVICES from 64 to 1,048,576 commit 41f8ad76362e7aefe3a03949c43e23102dae6e0b upstream. It used to be that minors where 8 bit. But now they are actually 20 bit. So the fix is simplicity itself. I've tested with 300 devices and all user-mode utils work just fine. I have also mechanically added 10,000 to the ida (so devices are /dev/osd10000, /dev/osd10001 ...) and was able to mkfs an exofs filesystem and access osds from user-mode. All the open-osd user-mode code uses the same library to access devices through their symbolic names in /dev/osdX so I'd say it's pretty safe. (Well tested) This patch is very important because some of the systems that will be deploying the 3.2 pnfs-objects code are larger than 64 OSDs and will stop to work properly when reaching that number. Signed-off-by: Boaz Harrosh Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit cc64dc24b08559cb315d7328c65bfde7226f06f8 Author: Phil Sutter Date: Mon Feb 27 12:17:04 2012 +0100 crypto: mv_cesa - fix final callback not ignoring input data commit f8f54e190ddb4ed697036b60f5e2ae6dd45b801c upstream. Broken by commit 6ef84509f3d439ed2d43ea40080643efec37f54f for users passing a request with non-zero 'nbytes' field, like e.g. testmgr. Signed-off-by: Phil Sutter Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman commit 9a776502156cee284a37e2a20ea934ecc4d529cd Author: Alan Stern Date: Mon Feb 27 11:23:45 2012 -0500 HID: usbhid: Add NOGET quirk for the AIREN Slim+ keyboard commit 37891abc8464637964a26ae4b61d307fef831f80 upstream. This patch (as1531) adds a NOGET quirk for the Slim+ keyboard marketed by AIREN. This keyboard seems to have a lot of bugs; NOGET works around only one of them. Signed-off-by: Alan Stern Reported-by: okias Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit 51ee89d8195e9529e41ba46ae84a2329fe56f805 Author: Alexandre Bounine Date: Mon Mar 5 14:59:21 2012 -0800 rapidio/tsi721: fix queue wrapping bug in inbound doorbell handler commit b24823e61bfd93d0e72088e4f5245287582ed289 upstream. Fix a bug that causes a kernel panic when the number of received doorbells is larger than number of entries in the inbound doorbell queue (current default value = 512). Another possible indication for this bug is large number of spurious doorbells reported by tsi721 driver after reaching the queue size maximum. Signed-off-by: Alexandre Bounine Cc: Chul Kim Cc: Matt Porter Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit fcf3a2fb3c0a579d6ab0beb8315bbe3e95cca17e Author: Steffen Maier Date: Fri Mar 2 17:32:58 2012 +0100 S390: qdio: fix handler function arguments for zfcp data router commit 7b3cc67d4445995a025a4b55a7dc687b6829b4ca upstream. Git commit 25f269f17316549e "[S390] qdio: EQBS retry after CCQ 96" introduced a regression in regard to the zfcp data router. Revoke the incorrect simplification of the function call arguments for the qdio handler to make the zfcp hardware data router working again. This is applicable to 3.2+ kernels. Signed-off-by: Steffen Maier Reviewed-by: Jan Glauber Signed-off-by: Martin Schwidefsky Signed-off-by: Greg Kroah-Hartman commit c8db5a5fc6042f937df8034bb2ed5544574ac123 Author: Stephen Rothwell Date: Mon Feb 20 07:22:38 2012 +1100 tty/powerpc: early udbg consoles can't be modules commit f21c6d4a49179f91fd70a41382382f08c780d425 upstream. Fixes these build errors: ERROR: ".udbg_printf" [drivers/tty/ehv_bytechan.ko] undefined! ERROR: ".register_early_udbg_console" [drivers/tty/ehv_bytechan.ko] undefined! ERROR: "udbg_putc" [drivers/tty/ehv_bytechan.ko] undefined! Cc: Timur Tabi Signed-off-by: Stephen Rothwell Signed-off-by: Greg Kroah-Hartman commit dec68ee3f8f3b49388f5480ae56ec7e0cb915561 Author: Johannes Berg Date: Fri Feb 17 09:47:14 2012 -0800 iwlwifi: fix key removal commit 5dcbf480473f6c3f06ad2426b7517038a2a18911 upstream. When trying to remove a key, we always send key flags just setting the key type, not including the multicast flag and the key ID. As a result, whenever any key was removed, the unicast key 0 would be removed, causing a complete connection loss after the second rekey (the first doesn't cause a key removal). Fix the key removal code to include the key ID and multicast flag, thus removing the correct key. Reported-by: Alexander Schnaidt Tested-by: Alexander Schnaidt Signed-off-by: Johannes Berg Signed-off-by: Wey-Yi Guy Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 6226c22502ddd95f67a1c3dc6fad2862503fbb9c Author: Andrea Arcangeli Date: Mon Mar 5 14:59:20 2012 -0800 mm: thp: fix BUG on mm->nr_ptes commit 1c641e84719429bbfe62a95ed3545ee7fe24408f upstream. Dave Jones reports a few Fedora users hitting the BUG_ON(mm->nr_ptes...) in exit_mmap() recently. Quoting Hugh's discovery and explanation of the SMP race condition: "mm->nr_ptes had unusual locking: down_read mmap_sem plus page_table_lock when incrementing, down_write mmap_sem (or mm_users 0) when decrementing; whereas THP is careful to increment and decrement it under page_table_lock. Now most of those paths in THP also hold mmap_sem for read or write (with appropriate checks on mm_users), but two do not: when split_huge_page() is called by hwpoison_user_mappings(), and when called by add_to_swap(). It's conceivable that the latter case is responsible for the exit_mmap() BUG_ON mm->nr_ptes that has been reported on Fedora." The simplest way to fix it without having to alter the locking is to make split_huge_page() a noop in nr_ptes terms, so by counting the preallocated pagetables that exists for every mapped hugepage. It was an arbitrary choice not to count them and either way is not wrong or right, because they are not used but they're still allocated. Reported-by: Dave Jones Reported-by: Hugh Dickins Signed-off-by: Andrea Arcangeli Acked-by: Hugh Dickins Cc: David Rientjes Cc: Josh Boyer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 4050cecbafc6d1d89a5407f6df1dc2f08432eca4 Author: Prashanth Nageshappa Date: Mon Mar 5 14:59:12 2012 -0800 kprobes: return proper error code from register_kprobe() commit f986a499ef6f317d906e6f6f281be966e1237a10 upstream. register_kprobe() aborts if the address of the new request falls in a prohibited area (such as ftrace pouch, __kprobes annotated functions, non-kernel text addresses, jump label text). We however don't return the right error on this abort, resulting in a silent failure - incorrect adding/reporting of kprobes ('perf probe do_fork+18' or 'perf probe mcount' for instance). In V2 we are incorporating Masami Hiramatsu's feedback. This patch fixes it by returning -EINVAL upon failure. While we are here, rename the label used for exit to be more appropriate. Signed-off-by: Ananth N Mavinakayanahalli Signed-off-by: Prashanth K Nageshappa Acked-by: Masami Hiramatsu Cc: Jason Baron Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 06592e8c1b19bc007098e3d59ef6d8486a6c3c7d Author: Felix Fietkau Date: Wed Feb 15 19:31:20 2012 +0100 ath9k_hw: prevent writes to const data on AR9160 commit 9bbb8168ed3d8b946f9c1901a63a675012de88f2 upstream. Duplicate the data for iniAddac early on, to avoid having to do redundant memcpy calls later. While we're at it, make AR5416 < v2.2 use the same codepath. Fixes a reported crash on x86. Signed-off-by: Felix Fietkau Reported-by: Magnus Määttä Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 2e4c9873deea81f89798b709622bdbdec88502db Author: Mohammed Shafi Shajakhan Date: Mon Feb 20 10:05:31 2012 +0530 mac80211: zero initialize count field in ieee80211_tx_rate commit 8617b093d0031837a7be9b32bc674580cfb5f6b5 upstream. rate control algorithms concludes the rate as invalid with rate[i].idx < -1 , while they do also check for rate[i].count is non-zero. it would be safer to zero initialize the 'count' field. recently we had a ath9k rate control crash where the ath9k rate control in ath_tx_status assumed to check only for rate[i].count being non-zero in one instance and ended up in using invalid rate index for 'connection monitoring NULL func frames' which eventually lead to the crash. thanks to Pavel Roskin for fixing it and finding the root cause. https://bugzilla.redhat.com/show_bug.cgi?id=768639 Cc: Pavel Roskin Signed-off-by: Mohammed Shafi Shajakhan Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 88d7d4e4a439f32acc56a6d860e415ee71d3df08 Author: Jeff Layton Date: Thu Feb 23 09:37:45 2012 -0500 cifs: fix dentry refcount leak when opening a FIFO on lookup commit 5bccda0ebc7c0331b81ac47d39e4b920b198b2cd upstream. The cifs code will attempt to open files on lookup under certain circumstances. What happens though if we find that the file we opened was actually a FIFO or other special file? Currently, the open filehandle just ends up being leaked leading to a dentry refcount mismatch and oops on umount. Fix this by having the code close the filehandle on the server if it turns out not to be a regular file. While we're at it, change this spaghetti if statement into a switch too. Reported-by: CAI Qian Tested-by: CAI Qian Reviewed-by: Shirish Pargaonkar Signed-off-by: Jeff Layton Signed-off-by: Steve French Signed-off-by: Greg Kroah-Hartman commit ce6e3def616ad1e22443df7fc8bdaa3384cf0575 Author: David Howells Date: Thu Feb 23 13:51:00 2012 +0000 NOMMU: Don't need to clear vm_mm when deleting a VMA commit b94cfaf6685d691dc3fab023cf32f65e9b7be09c upstream. Don't clear vm_mm in a deleted VMA as it's unnecessary and might conceivably break the filesystem or driver VMA close routine. Reported-by: Al Viro Signed-off-by: David Howells Acked-by: Al Viro Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 3516a8a4a77140b9039e3266c24eb5581066779d Author: Anton Vorontsov Date: Fri Feb 24 05:14:46 2012 +0400 mm: memcg: Correct unregistring of events attached to the same eventfd commit 371528caec553785c37f73fa3926ea0de84f986f upstream. There is an issue when memcg unregisters events that were attached to the same eventfd: - On the first call mem_cgroup_usage_unregister_event() removes all events attached to a given eventfd, and if there were no events left, thresholds->primary would become NULL; - Since there were several events registered, cgroups core will call mem_cgroup_usage_unregister_event() again, but now kernel will oops, as the function doesn't expect that threshold->primary may be NULL. That's a good question whether mem_cgroup_usage_unregister_event() should actually remove all events in one go, but nowadays it can't do any better as cftype->unregister_event callback doesn't pass any private event-associated cookie. So, let's fix the issue by simply checking for threshold->primary. FWIW, w/o the patch the following oops may be observed: BUG: unable to handle kernel NULL pointer dereference at 0000000000000004 IP: [] mem_cgroup_usage_unregister_event+0x9c/0x1f0 Pid: 574, comm: kworker/0:2 Not tainted 3.3.0-rc4+ #9 Bochs Bochs RIP: 0010:[] [] mem_cgroup_usage_unregister_event+0x9c/0x1f0 RSP: 0018:ffff88001d0b9d60 EFLAGS: 00010246 Process kworker/0:2 (pid: 574, threadinfo ffff88001d0b8000, task ffff88001de91cc0) Call Trace: [] cgroup_event_remove+0x2b/0x60 [] process_one_work+0x174/0x450 [] worker_thread+0x123/0x2d0 Signed-off-by: Anton Vorontsov Acked-by: KAMEZAWA Hiroyuki Cc: Kirill A. Shutemov Cc: Michal Hocko Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 6deb7d23c3d27520f4fb0b3a622966ba6760db71 Author: Jeff Moyer Date: Mon Mar 5 14:59:12 2012 -0800 aio: wake up waiters when freeing unused kiocbs commit 880641bb9da2473e9ecf6c708d993b29928c1b3c upstream. Bart Van Assche reported a hung fio process when either hot-removing storage or when interrupting the fio process itself. The (pruned) call trace for the latter looks like so: fio D 0000000000000001 0 6849 6848 0x00000004 ffff880092541b88 0000000000000046 ffff880000000000 ffff88012fa11dc0 ffff88012404be70 ffff880092541fd8 ffff880092541fd8 ffff880092541fd8 ffff880128b894d0 ffff88012404be70 ffff880092541b88 000000018106f24d Call Trace: schedule+0x3f/0x60 io_schedule+0x8f/0xd0 wait_for_all_aios+0xc0/0x100 exit_aio+0x55/0xc0 mmput+0x2d/0x110 exit_mm+0x10d/0x130 do_exit+0x671/0x860 do_group_exit+0x44/0xb0 get_signal_to_deliver+0x218/0x5a0 do_signal+0x65/0x700 do_notify_resume+0x65/0x80 int_signal+0x12/0x17 The problem lies with the allocation batching code. It will opportunistically allocate kiocbs, and then trim back the list of iocbs when there is not enough room in the completion ring to hold all of the events. In the case above, what happens is that the pruning back of events ends up freeing up the last active request and the context is marked as dead, so it is thus responsible for waking up waiters. Unfortunately, the code does not check for this condition, so we end up with a hung task. Signed-off-by: Jeff Moyer Reported-by: Bart Van Assche Tested-by: Bart Van Assche Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 623376278e718e2afe6a81ce3fb0e3b93abcf8ba Author: Sascha Hauer Date: Fri Feb 17 11:51:49 2012 +0100 mmc: sdhci-esdhc-imx: fix for mmc cards on i.MX5 commit 5b6b0ad6e572b32a641116aaa5f897ffebe31e44 upstream. On i.MX53 we have to write a special SDHCI_CMD_ABORTCMD to the SDHCI_TRANSFER_MODE register during a MMC_STOP_TRANSMISSION command. This works for SD cards. However, with MMC cards the MMC_SET_BLOCK_COUNT command is used instead, but this needs the same handling. Fix MMC cards by testing for the MMC_SET_BLOCK_COUNT command aswell. Tested on a custom i.MX53 board with a Transcend MMC+ card and eMMC. The kernel started used MMC_SET_BLOCK_COUNT in 3.0, so this is a regression for these boards introduced in 3.0; it should go to 3.0/3.1/3.2-stable. Signed-off-by: Sascha Hauer Acked-by: Shawn Guo Signed-off-by: Chris Ball Signed-off-by: Greg Kroah-Hartman commit e8d7adfd8c088633fe764e1e698f277368e8c978 Author: Ludovic Desroches Date: Thu Feb 9 16:33:53 2012 +0100 mmc: atmel-mci: don't use dma features when using DMA with no chan available commit ef8781989a1bcd05aa47e853917c37df44917194 upstream. Some callbacks are set too early -- i.e. we can have dma capabilities but we can't get a dma channel. So wait to get the dma channel before setting callbacks and change logs consequently. Signed-off-by: Ludovic Desroches Signed-off-by: Nicolas Ferre Signed-off-by: Chris Ball Signed-off-by: Greg Kroah-Hartman commit ac42356c793d135643350b6ea19d97250f533900 Author: Andrew Morton Date: Mon Mar 5 14:59:19 2012 -0800 alpha: fix 32/64-bit bug in futex support commit 62aca403657fe30e5235c5331e9871e676d9ea0a upstream. Michael Cree said: : : I have noticed some user space problems (pulseaudio crashes in pthread : : code, glibc/nptl test suite failures, java compiler freezes on SMP alpha : : systems) that arise when using a 2.6.39 or later kernel on Alpha. : : Bisecting between 2.6.38 and 2.6.39 (using glibc/nptl test suite as : : criterion for good/bad kernel) eventually leads to: : : : : 8d7718aa082aaf30a0b4989e1f04858952f941bc is the first bad commit : : commit 8d7718aa082aaf30a0b4989e1f04858952f941bc : : Author: Michel Lespinasse : : Date: Thu Mar 10 18:50:58 2011 -0800 : : : : futex: Sanitize futex ops argument types : : : : Change futex_atomic_op_inuser and futex_atomic_cmpxchg_inatomic : : prototypes to use u32 types for the futex as this is the data type the : : futex core code uses all over the place. : : : : Looking at the commit I see there is a change of the uaddr argument in : : the Alpha architecture specific code for futexes from int to u32, but I : : don't see why this should cause a problem. Richard Henderson said: : futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, : u32 oldval, u32 newval) : ... : : "r"(uaddr), "r"((long)oldval), "r"(newval) : : : There is no 32-bit compare instruction. These are implemented by : consistently extending the values to a 64-bit type. Since the : load instruction sign-extends, we want to sign-extend the other : quantity as well (despite the fact it's logically unsigned). : : So: : : - : "r"(uaddr), "r"((long)oldval), "r"(newval) : + : "r"(uaddr), "r"((long)(int)oldval), "r"(newval) : : should do the trick. Michael said: : This fixes the glibc test suite failures and the pulseaudio related : crashes, but it does not fix the java compiiler lockups that I was (and : are still) observing. That is some other problem. Reported-by: Michael Cree Tested-by: Michael Cree Acked-by: Phil Carmody Cc: Richard Henderson Cc: Michel Lespinasse Cc: Ivan Kokshaysky Reviewed-by: Matt Turner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 4826cda9a753db2a4aea6e1292d21a1f9cd85ea3 Author: Scott Talbert Date: Tue Feb 21 13:06:00 2012 +0000 Move Logitech Harmony 900 from cdc_ether to zaurus commit ee932bf9acb2e2c6a309e808000f24856330e3f9 upstream. In the current kernel implementation, the Logitech Harmony 900 remote control is matched to the cdc_ether driver through the generic USB_CDC_SUBCLASS_MDLM entry. However, this device appears to be of the pseudo-MDLM (Belcarra) type, rather than the standard one. This patch blacklists the Harmony 900 from the cdc_ether driver and whitelists it for the pseudo-MDLM driver in zaurus. Signed-off-by: Scott Talbert Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 69c59bc6c4e7d29aabb9e7fa5825b774044940c5 Author: Gusakov Andrey Date: Sat Mar 3 07:32:36 2012 +0900 ARM: S3C24XX: DMA resume regression fix commit e39d40c65dfd8390b50c03482ae9e289b8a8f351 upstream. s3c2410_dma_suspend suspends channels from 0 to dma_channels. s3c2410_dma_resume resumes channels in reverse order. So pointer should be decremented instead of being incremented. Signed-off-by: Gusakov Andrey Reviewed-by: Heiko Stuebner Signed-off-by: Kukjin Kim Signed-off-by: Greg Kroah-Hartman commit 8ab46fc85e924390c6e8a941ac7786dc10158c05 Author: Thomas Gleixner Date: Tue Mar 6 23:18:54 2012 +0100 genirq: Clear action->thread_mask if IRQ_ONESHOT is not set commit 52abb700e16a9aa4cbc03f3d7f80206cbbc80680 upstream. Xommit ac5637611(genirq: Unmask oneshot irqs when thread was not woken) fails to unmask when a !IRQ_ONESHOT threaded handler is handled by handle_level_irq. This happens because thread_mask is or'ed unconditionally in irq_wake_thread(), but for !IRQ_ONESHOT interrupts never cleared. So the check for !desc->thread_active fails and keeps the interrupt disabled. Keep the thread_mask zero for !IRQ_ONESHOT interrupts. Document the thread_mask magic while at it. Reported-and-tested-by: Sven Joachim Reported-and-tested-by: Stefan Lippers-Hollmann Signed-off-by: Thomas Gleixner Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 315e73b400c9a287a53efb5f857d308589674ac5 Author: Mark Brown Date: Mon Feb 20 21:32:32 2012 +0000 mfd: Test for jack detection when deciding if wm8994 should suspend commit e7c248a049c2aac21bded0b0722caee6f0e57256 upstream. The jack detection on WM1811 is often required during system suspend, add it as another check when deciding if we should suspend. Signed-off-by: Mark Brown Signed-off-by: Samuel Ortiz Signed-off-by: Greg Kroah-Hartman commit 5e39bbafe82bbb12ed307af97c929627e0f9499a Author: Jean Delvare Date: Sat Feb 18 17:54:23 2012 +0100 mfd: Fix ACPI conflict check commit 81b5482c32769abb6dfb979560dab2f952ba86fa upstream. The code is currently always checking the first resource of every device only (several times.) This has been broken since the ACPI check was added in February 2010 in commit 91fedede0338eb6203cdd618d8ece873fdb7c22c. Fix the check to run on each resource individually, once. Signed-off-by: Jean Delvare Signed-off-by: Samuel Ortiz Signed-off-by: Greg Kroah-Hartman commit e34e9e8732893488893b9f8b4a449163b7fdfb19 Author: H. Peter Anvin Date: Fri Mar 2 10:43:49 2012 -0800 regset: Return -EFAULT, not -EIO, on host-side memory fault commit 5189fa19a4b2b4c3bec37c3a019d446148827717 upstream. There is only one error code to return for a bad user-space buffer pointer passed to a system call in the same address space as the system call is executed, and that is EFAULT. Furthermore, the low-level access routines, which catch most of the faults, return EFAULT already. Signed-off-by: H. Peter Anvin Reviewed-by: Oleg Nesterov Acked-by: Roland McGrath Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 58458d037c19e6d3ae5bd7cdfafc423d0d2d7984 Author: H. Peter Anvin Date: Fri Mar 2 10:43:48 2012 -0800 regset: Prevent null pointer reference on readonly regsets commit c8e252586f8d5de906385d8cf6385fee289a825e upstream. The regset common infrastructure assumed that regsets would always have .get and .set methods, but not necessarily .active methods. Unfortunately people have since written regsets without .set methods. Rather than putting in stub functions everywhere, handle regsets with null .get or .set methods explicitly. Signed-off-by: H. Peter Anvin Reviewed-by: Oleg Nesterov Acked-by: Roland McGrath Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit b1748825081ec6b89c1da25a996a7591087ca39b Author: Takashi Iwai Date: Wed Feb 29 09:41:17 2012 +0100 ALSA: hda - Always set HP pin in unsol handler for STAC/IDT codecs commit 7bff172a352a2fbe9856bba517d71a2072aab041 upstream. A bug report with an old Sony laptop showed that we can't rely on BIOS setting the pins of headphones but the driver should set always by itself. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit a4b6027fffedb34d07b671b6aebf85fc1fc2caf7 Author: Takashi Iwai Date: Mon Feb 27 15:00:58 2012 +0100 ALSA: hda - Add a fake mute feature commit 3868137ea41866773e75d9ac4b9988dcc361ff1d upstream. Some codecs don't supply the mute amp-capabilities although the lowest volume gives the mute. It'd be handy if the parser provides the mute mixers in such a case. This patch adds an extension amp-cap bit (which is used only in the driver) to represent the min volume = mute state. Also modified the amp cache code to support the fake mute feature when this bit is set but the real mute bit is unset. In addition, conexant cx5051 parser uses this new feature to implement the missing mute controls. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=42825 Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 2f5b7338fbdb695d66424d19e0bb193b4d5f6591 Author: Takashi Iwai Date: Sat Feb 25 11:13:16 2012 +0100 ALSA: hda/realtek - Fix resume of multiple input sources commit 068b939431486f524438330b0848a8222e33d421 upstream. When there are multiple input sources, the driver wrongly overwrites with the value of the last input source on other slots at resume. Thus the primary input source may be shown wrongly. Reported-and-tested-by: Julian Sikorski Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 9701e4af7147129671f1946794e52f6abcd6f17a Author: Joerg Roedel Date: Wed Feb 29 14:57:32 2012 +0100 perf/x86/kvm: Fix Host-Only/Guest-Only counting with SVM disabled commit 1018faa6cf23b256bf25919ef203cd7c129f06f2 upstream. It turned out that a performance counter on AMD does not count at all when the GO or HO bit is set in the control register and SVM is disabled in EFER. This patch works around this issue by masking out the HO bit in the performance counter control register when SVM is not enabled. The GO bit is not touched because it is only set when the user wants to count in guest-mode only. So when SVM is disabled the counter should not run at all and the not-counting is the intended behaviour. Signed-off-by: Joerg Roedel Signed-off-by: Peter Zijlstra Cc: Avi Kivity Cc: Stephane Eranian Cc: David Ahern Cc: Gleb Natapov Cc: Robert Richter Link: http://lkml.kernel.org/r/1330523852-19566-1-git-send-email-joerg.roedel@amd.com Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 5798b013af929124c7ec9872719bf94e93c4a923 Author: David Howells Date: Fri Feb 24 18:01:27 2012 +0100 S390: KEYS: Enable the compat keyctl wrapper on s390x commit 1d057720609ed052a6371fe1d53300e5e6328e94 upstream. Enable the compat keyctl wrapper on s390x so that 32-bit s390 userspace can call the keyctl() syscall. There's an s390x assembly wrapper that truncates all the register values to 32-bits and this then calls compat_sys_keyctl() - but the latter only exists if CONFIG_KEYS_COMPAT is enabled, and the s390 Kconfig doesn't enable it. Without this patch, 32-bit calls to the keyctl() syscall are given an ENOSYS error: [root@devel4 ~]# keyctl show Session Keyring -3: key inaccessible (Function not implemented) Signed-off-by: David Howells Acked-by: dan@danny.cz Cc: Carsten Otte Reviewed-by: Christian Borntraeger Cc: linux-s390@vger.kernel.org Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky Signed-off-by: Greg Kroah-Hartman commit 8916bd55247c6f75c44c63a97cfa6e7bb2a5e63a Author: Jett.Zhou Date: Thu Feb 23 19:52:08 2012 +0800 regulator: fix the ldo configure according to 88pm860x spec commit 3380643b0eaa7ecf99c4f095bdfcb6e5df471616 upstream. Signed-off-by: Jett.Zhou Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 46774e8405812c94d96d795c9f0e1750f90811e0 Author: Wolfram Sang Date: Fri Jan 13 12:14:26 2012 +0100 i2c: mxs: only flag completion when queue is completely done commit 844990daa2e69a4258049ba9c2bae1180657dac3 upstream. The hardware generates an interrupt for every completed command in the queue while the code assumed that it will only generate one interrupt when the queue is empty. So, explicitly check if the queue is really empty. This patch fixed problems which occurred due to high traffic on the bus. While we are here, move the completion-initialization after the parameter error checking. Signed-off-by: Wolfram Sang Cc: Shawn Guo Cc: Marek Vasut Cc: Lothar Waßmann Signed-off-by: Greg Kroah-Hartman commit 00974784802bca093cd5131852bb5064241be432 Author: Maxim Uvarov Date: Sun Jan 15 20:02:50 2012 -0800 watchdog: hpwdt: clean up set_memory_x call for 32 bit commit 97d2a10d5804d585ab0b58efbd710948401b886a upstream. 1. address has to be page aligned. 2. set_memory_x uses page size argument, not size. Bug causes with following commit: commit da28179b4e90dda56912ee825c7eaa62fc103797 Author: Mingarelli, Thomas Date: Mon Nov 7 10:59:00 2011 +0100 watchdog: hpwdt: Changes to handle NX secure bit in 32bit path commit e67d668e147c3b4fec638c9e0ace04319f5ceccd upstream. This patch makes use of the set_memory_x() kernel API in order to make necessary BIOS calls to source NMIs. Signed-off-by: Maxim Uvarov Signed-off-by: Wim Van Sebroeck Signed-off-by: Greg Kroah-Hartman commit 58688fc7678d0cec61788e62dfea85499bc8a3d9 Author: Roland Stigge Date: Mon Feb 27 17:28:02 2012 +0100 ARM: LPC32xx: Fix irq on GPI_28 commit f6737055c1c432a9628a9a731f9881ad8e0a9eee upstream. The GPI_28 IRQ was not registered properly. The registration of IRQ_LPC32XX_GPI_28 was added and the (wrong) IRQ_LPC32XX_GPI_11 at LPC32XX_SIC1_IRQ(4) was replaced by IRQ_LPC32XX_GPI_28 (see manual of LPC32xx / interrupt controller). Signed-off-by: Roland Stigge Signed-off-by: Greg Kroah-Hartman commit aef5ebd137305e5dd55c94c0bc32c3955588f44c Author: Roland Stigge Date: Mon Feb 27 17:28:02 2012 +0100 ARM: LPC32xx: Fix interrupt controller init commit 35dd0a75d4a382e7f769dd0277732e7aa5235718 upstream. This patch fixes the initialization of the interrupt controller of the LPC32xx by correctly setting up SIC1 and SIC2 instead of (wrongly) using the same value as for the Main Interrupt Controller (MIC). Signed-off-by: Roland Stigge Signed-off-by: Greg Kroah-Hartman commit bd4789a33ad759aa17f39dc3a22072c9d00596bc Author: Roland Stigge Date: Mon Feb 27 17:28:02 2012 +0100 ARM: LPC32xx: irq.c: Clear latched event commit 94ed7830cba4dce57b18a2926b5d826bfd184bd6 upstream. This patch fixes the wakeup disable function by clearing latched events. Signed-off-by: Roland Stigge Signed-off-by: Greg Kroah-Hartman commit 41e2eca62b408da87b7bfcd863fe9370a2a82a93 Author: Roland Stigge Date: Mon Feb 27 17:28:03 2012 +0100 ARM: LPC32xx: serial.c: Fixed loop limit commit ff424aa4c89d19082e8ae5a3351006bc8a4cd91b upstream. This patch fixes a wrong loop limit on UART init. Signed-off-by: Roland Stigge Signed-off-by: Greg Kroah-Hartman commit a1be2b5ecba619e9f5f6298af3e11dd3cd5fb094 Author: Roland Stigge Date: Mon Feb 27 17:28:02 2012 +0100 ARM: LPC32xx: serial.c: HW bug workaround commit 2707208ee8a80dbbd5426f5aa1a934f766825bb5 upstream. This patch fixes a HW bug by flushing RX FIFOs of the UARTs on init. It was ported from NXP's git.lpclinux.com tree. Signed-off-by: Roland Stigge Signed-off-by: Greg Kroah-Hartman commit c7554566fdd9b0aaff15dfda98e3a6706408a825 Author: Alban Browaeys Date: Fri Feb 24 17:12:45 2012 +0000 drm/i915: Prevent a machine hang by checking crtc->active before loading lut commit aed3f09db39596e539f90b11a5016aea4d8442e1 upstream. Before loading the lut (gamma), check the active state of intel_crtc, otherwise at least on gen2 hang ensue. This is reproducible in Xorg via: xset dpms force off then xgamma -rgamma 2.0 # freeze. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=44505 Signed-off-by: Alban Browaeys Signed-off-by: Chris Wilson Reviewed-by: Jesse Barnes Signed-off-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman commit da42eb9e4a1ee35439534941c89918a8d8a9ee59 Author: Heiko Carstens Date: Mon Feb 27 10:01:52 2012 +0100 compat: fix compile breakage on s390 commit 048cd4e51d24ebf7f3552226d03c769d6ad91658 upstream. The new is_compat_task() define for the !COMPAT case in include/linux/compat.h conflicts with a similar define in arch/s390/include/asm/compat.h. This is the minimal patch which fixes the build issues. Signed-off-by: Heiko Carstens Signed-off-by: Linus Torvalds Cc: Jonathan Nieder Signed-off-by: Greg Kroah-Hartman commit 3274092b49271e24e1da4d282817822a97591cd7 Author: Linus Torvalds Date: Sun Feb 26 09:44:55 2012 -0800 Fix autofs compile without CONFIG_COMPAT commit 3c761ea05a8900a907f32b628611873f6bef24b2 upstream. The autofs compat handling fix caused a compile failure when CONFIG_COMPAT isn't defined. Instead of adding random #ifdef'fery in autofs, let's just make the compat helpers earlier to use: without CONFIG_COMPAT, is_compat_task() just hardcodes to zero. We could probably do something similar for a number of other cases where we have #ifdef's in code, but this is the low-hanging fruit. Reported-and-tested-by: Andreas Schwab Signed-off-by: Linus Torvalds Cc: Jonathan Nieder Signed-off-by: Greg Kroah-Hartman commit cebf41113cb3be7113732039c7c22ef00decd6c0 Author: Ian Kent Date: Wed Feb 22 20:45:44 2012 +0800 autofs: work around unhappy compat problem on x86-64 commit a32744d4abae24572eff7269bc17895c41bd0085 upstream. When the autofs protocol version 5 packet type was added in commit 5c0a32fc2cd0 ("autofs4: add new packet type for v5 communications"), it obvously tried quite hard to be word-size agnostic, and uses explicitly sized fields that are all correctly aligned. However, with the final "char name[NAME_MAX+1]" array at the end, the actual size of the structure ends up being not very well defined: because the struct isn't marked 'packed', doing a "sizeof()" on it will align the size of the struct up to the biggest alignment of the members it has. And despite all the members being the same, the alignment of them is different: a "__u64" has 4-byte alignment on x86-32, but native 8-byte alignment on x86-64. And while 'NAME_MAX+1' ends up being a nice round number (256), the name[] array starts out a 4-byte aligned. End result: the "packed" size of the structure is 300 bytes: 4-byte, but not 8-byte aligned. As a result, despite all the fields being in the same place on all architectures, sizeof() will round up that size to 304 bytes on architectures that have 8-byte alignment for u64. Note that this is *not* a problem for 32-bit compat mode on POWER, since there __u64 is 8-byte aligned even in 32-bit mode. But on x86, 32-bit and 64-bit alignment is different for 64-bit entities, and as a result the structure that has exactly the same layout has different sizes. So on x86-64, but no other architecture, we will just subtract 4 from the size of the structure when running in a compat task. That way we will write the properly sized packet that user mode expects. Not pretty. Sadly, this very subtle, and unnecessary, size difference has been encoded in user space that wants to read packets of *exactly* the right size, and will refuse to touch anything else. Reported-and-tested-by: Thomas Meyer Signed-off-by: Ian Kent Signed-off-by: Linus Torvalds Cc: Jonathan Nieder Signed-off-by: Greg Kroah-Hartman commit 808288955e88e22d3711051e97ca8c33c629f69e Author: Ohad Ben-Cohen Date: Sun Feb 26 12:14:14 2012 +0200 ARM: OMAP: make iommu subsys_initcall to fix builtin omap3isp commit 435792d93410f008120c4dbab148019a3cc31dbc upstream. omap3isp depends on omap's iommu and will fail to probe if initialized before it (which always happen if they are builtin). Make omap's iommu subsys_initcall as an interim solution until the probe deferral mechanism is merged. Reported-by: James Debugged-by: Laurent Pinchart Signed-off-by: Ohad Ben-Cohen Cc: Tony Lindgren Cc: Hiroshi Doyu Cc: Joerg Roedel Signed-off-by: Joerg Roedel Signed-off-by: Greg Kroah-Hartman