3.2.36-stable review

This is the start of the stable review cycle for the 3.2.36 release. There are 173 patches in this series, which will be posted as responses to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Wed Jan 2 20:00:00 GMT 2013. Anything received after that time might be too late.

A combined patch relative to 3.2.35 will be posted as an additional response to this. A shortlog and diffstat can be found below.

Ben.

-------------

Aaron Lu (1):

      libata: set dma_mode to 0xff in reset
         [5416912af75de9cba5d1c75b99a7888b0bbbd2fb]

Al Viro (1):

      ARM: missing ->mmap_sem around find_vma() in swp_emulate.c
         [7bf9b7bef881aac820bf1f2e9951a17b09bd7e04]

Alan Cox (3):
ACPI: missing break
[879dca019dc43a1622edca3e7dde644b14b5acc5]
ne2000: add the right platform device
[da9da01d9199b5bb15289d0859053c9aa3a34ac0]
pnpacpi: fix incorrect TEST_ALPHA() test
[cdc87c5a30f407ed1ce43d8a22261116873d5ef1]

Alan Stern (3):

      USB: EHCI: bugfix: urb->hcpriv should not be NULL
         [2656a9abcf1ec8dd5fee6a75d6997a0f2fa0094e]
      USB: OHCI: workaround for hardware bug: retired TDs not added to the Done Queue
         [50ce5c0683aa83eb161624ea89daa5a9eee0c2ce]
      USB: fix endpoint-disabling for failed config changes
         [36caff5d795429c572443894e8789c2150dd796b]

Alasdair G Kergon (1):
dm ioctl: prevent unsafe change to dm_ioctl data_size
[e910d7ebecd1aac43125944a8641b6cb1a0dfabe]

Alex Deucher (4):
drm/radeon/dce32+: use fractional fb dividers for high clocks
[a02dc74b317d78298cb0587b9b1f6f741fd5c139]
drm/radeon/kms: use frac fb div on APUs
[37d4174d2d252c37dcb3d88cafae488542087848]
drm/radeon: fix eDP clk and lane setup for scaled modes
[93927f9c1db5f55085457e820f0631064c7bfa34]
drm: fix documentation for drm_crtc_set_mode()
[4c9287c6009b37754c42e0ba73a4cc79de92d8f8]

Alexander Graf (1):
KVM: PPC: 44x: fix DCR read/write
[e43a028752fed049e4bd94ef895542f96d79fa74]

Alexander Shiyan (1):
irda: sir_dev: Fix copy/paste typo
[2355a62bcbdcc4b567425bab036bfab6ade87eed]

Alexander Stein (1):
can: Do not call dev_put if restart timer is running upon close
[ab48b03ec9ae1840a1e427e2375bd0d9d554b4ed]

Alexey Kaminsky (1):
HID: apple: Add Apple wireless keyboard 2011 ANSI PID
[0a97e1e9f9a6765e6243030ac42b04694f3f3647]

Alexis R. Cortes (1):
usb: host: xhci: Stricter conditional for Z1 system models for Compliance Mode Patch
[b0e4e606ff6ff26da0f60826e75577b56ba4e463]

Andreas Hartmann (1):
rt2x00: Don't let mac80211 send a BAR when an AMPDU subframe fails
[be03d4a45c09ee5100d3aaaedd087f19bc20d01f]

Anton Blanchard (1):
powerpc: Fix CONFIG_RELOCATABLE=y CONFIG_CRASH_DUMP=n build
[11ee7e99f35ecb15f59b21da6a82d96d2cd3fcc8]

Artem Bityutskiy (1):
proc: pid/status: show all supplementary groups
[8d238027b87e654be552eabdf492042a34c5c300]

Ben Hutchings (4):
HID: Add Apple wireless keyboard 2011 ANSI to special driver list
[f9af7b9edccb87d4d80b58687ab63e58f3b64c4c]
Revert "device_cgroup: fix RCU usage"
[not upstream; change was correct for mainline but not 3.2]
Revert "mm: vmscan: fix endless loop in kswapd balancing"
[not upstream; change was correct for mainline but not 3.2]
mm: add kmap_to_page()
[part of 5a178119b0fbe37f7dfb602b37df9cc4b1dc9d71]

Bjørn Mork (1):
USB: option: blacklist network interface on Huawei E173
[f36446cf9bbebaa03a80d95cfeeafbaf68218249]

Boris Ostrovsky (1):
x86,AMD: Power driver support for AMD's family 16h processors
[22e32f4f57778ebc6e17812fa3008361c05d64f9]

Bryan Schumaker (1):
NFS: Add sequence_priviliged_ops for nfs4_proc_sequence()
[6bdb5f213c4344324f600dde885f25768fbd14db]

Calvin Walton (1):
i915: Quirk no_lvds on Gigabyte GA-D525TUD ITX motherboard
[a51d4ed01e5bb39d2cf36a12f9976ab08872c192]

Charles Keepax (1):
mfd: Only unregister platform devices allocated by the mfd core
[b9fbb62eb61452d728c39b2e5020739c575aac53]

Chase Douglas (1):
HID: hid-magicmouse: Add pointer and buttonpad properties for Magic Trackpad
[503f7d53b368c8e4e13a7756220c0536fcf1a034]

Chris Ball (1):
Revert misapplied "mmc: sh-mmcif: avoid oops on spurious interrupts"
[6984f3c31bb57cb7491dbec1be44b74bd00f4648]

Chris Wilson (2):
drm/i915: Add no-lvds quirk for Supermicro X7SPA-H
[c31407a3672aaebb4acddf90944a114fa5c8af7b]
drm/i915: Close race between processing unpin task and queueing the flip
[e7d841ca03b7ab668620045cd7b428eda9f41601]

Christian Borntraeger (1):
s390/kvm: dont announce RRBM support
[87cac8f879a5ecd7109dbe688087e8810b3364eb]

Corentin Chary (1):
acpi/video_detect: blacklist samsung x360
[084940d5b101e9ca91a689eb5048151b14076839]

Corey Minyard (1):
CRIS: fix I/O macros
[c24bf9b4cc6a0f330ea355d73bfdf1dae7e63a05]

Dan Carpenter (3):
drivers/leds/leds-lp5521.c: fix lp5521_read() error handling
[5bc9ad774c063f6b41965e7314f2c26aa5e465a0]
ftrace: Clear bits properly in reset_iter_read()
[70f77b3f7ec010ff9624c1f2e39a81babc9e2429]
telephony: ijx: buffer overflow in ixj_write_cid()
[not upstream; driver has been removed]

Dan Williams (1):

      i2400m: add Intel 6150 device IDs
         [999a7c5776a0ed2133645fa7e008bec05bda9254]

Daniel Vetter (2):
drm/i915: disable cpt phase pointer fdi rx workaround
[539526b4137bc0e7a8806c38c8522f226814a0e6]
drm/i915: drop unnecessary check from fdi_link_train code
[8f5718a6d9a29bf1f51910c6b32bd0244f905303]

David Jeffery (1):
[SCSI] qla2xxx: Test and clear FCPORT_UPDATE_NEEDED atomically.
[a394aac88506159e047630fc90dc2242568382d8]

David Milburn (1):
sata_svw: check DMA start bit before reset
[b03e66a6be91f8389fcd902ab6c1563db1c9c06b]

David Rientjes (1):
thp, memcg: split hugepage for memcg oom on cow
[1f1d06c34f7675026326cd9f39ff91e4555cf355]

David Woodhouse (2):
intel-iommu: Free old page tables before creating superpage
[6491d4d02893d9787ba67279595990217177b351]
solos-pci: fix double-free of TX skb in DMA mode
[cae49ede00ec3d0cda290b03fee55b72b49efc11]

Dmitry Rogozhkin (1):
drm/i915: EBUSY status handling added to i915_gem_fault().
[e79e0fe380847493266fba557217e2773c61bd1b]

Duncan Roe (1):
ALSA: hda - Fix missing beep on ASUS X43U notebook
[7110005e8d5c3cd418fc4b64f9f124f004422a9a]

Emmanuel Grumbach (1):
iwlwifi: don't handle masked interrupt
[25a172655f837bdb032e451f95441bb4acec51bb]

Eric Dumazet (1):
rcu: Fix batch-limit size problem
[878d7439d0f45a95869e417576774673d1fa243f]

Eric Sandeen (1):
ext4: init pagevec in ext4_da_block_invalidatepages
[66bea92c69477a75a5d37b9bfed5773c92a3c4b4]

Eugene Shatokhin (1):
ext4: fix memory leak in ext4_xattr_set_acl()'s error path
[24ec19b0ae83a385ad9c55520716da671274b96c]

Eugeni Dodonov (2):
drm/i915: add Ivy Bridge GT2 Server entries
[cc22a938fc1db0c8ef5e693a69b159c4b851dab3]
drm: give up on edid retries when i2c bus is not responding
[9292f37e1f5c79400254dca46f83313488093825]

Felix Fietkau (2):
Revert "ath9k_hw: Update AR9003 high_power tx gain table"
[9c170e068636deb3e3f96114034bb711675f0faa]
ath9k_hw: Fix signal strength / channel noise reporting
[b7c0c238898d200e80487516e2b67aba2a522cc0]

Gabor Juhos (1):
ath9k: ar9003: fix OTP register offsets for AR9340
[b3cd8021379306c0be6932e4d3b4b01efc681769]

Greg KH (1):
USB: mark uas driver as BROKEN
[fb37ef98015f864d22be223a0e0d93547cd1d4ef]

Guenter Roeck (3):

      hwmon: (coretemp) Add support for Atom CE4110/4150/4170
         [1102dcab849313bd5a340b299b5cf61b518fbc0f]
      hwmon: (coretemp) Add support for Atom D2000 and N2000 series CPU models
         [5592906f8b01282ea3c2acaf641fd067ad4bb3dc]
      hwmon: (coretemp) Improve support for TjMax detection on Atom CPUs
         [41e58a1f2b90c88d94b4bd84beb9927a4c2704e9]

Gustavo Padovan (1):
Bluetooth: Add missing lock nesting notation
[dc2a0e20fbc85a71c63aa4330b496fda33f6bf80]

Herton Ronaldo Krzesinski (1):
USB: cdc-wdm: fix regression on buffer deallocation
[not upstream; code has been removed]

Huacai Chen (1):
MIPS: Fix poweroff failure when HOTPLUG_CPU configured.
[8add1ecb81f541ef2fcb0b85a5470ad9ecfb4a84]

J. Bruce Fields (2):
nfsd4: fix oops on unusual readlike compound
[d5f50b0c290431c65377c4afa1c764e2c3fe5305]
nfsd: fix v4 reply caching
[57d276d71aef7d8305ff002a070cb98deb2edced]

Jan Beulich (1):
x86: hpet: Fix masking of MSI interrupts
[6acf5a8c931da9d26c8dd77d784daaf07fa2bff0]

Jani Nikula (2):
drm/i915: do not default to 18 bpp for eDP if missing from VBT
[9a30a61f3516871c5c638fd7c025fbaa11ddf7fe]
drm/i915: do not ignore eDP bpc settings from vbt
[2f4f649a69a9eb51f6e98130e19dd90a260a4145]

Jaroslav Resler (1):

      Bluetooth: Add support for BCM20702A0 [04ca, 2003]
         [0c1abbd1aa0416258881c303a88e618cbca0759c]

Jay Purohit (1):
usb/ipheth: Add iPhone 5 support
[af1b85e49089f945deb46258b0fc4bc9910afb22]

Jean Delvare (2):
hwmon: (coretemp) Improve support of recent Atom CPU models
[fcc14ac1a86931f38da047cf8fb634c6db7b58bc]
i7300_edac: Fix error flag testing
[7e06b7a3333f5c7a0cec12aff20d39c5c87c0795]

Jeff Cook (1):

      Bluetooth: Add support for BCM20702A0 [0b05, 17b5]
         [1ee3ff6110c16acfc915a79b1e3feb5013c41e75]

Jerome Glisse (1):
drm/radeon: fix amd afusion gpu setup aka sumo v2
[bd25f0783dc3fb72e1e2779c2b99b2d34b67fa8a]

Jiri Slaby (1):
MISC: hpilo, remove pci_disable_device
[bcdee04ea7ae0406ae69094f6df1aacb66a69a0b]

Johannes Berg (2):
ipv4: ip_check_defrag must not modify skb before unsharing
[1bf3751ec90cc3174e01f0d701e8449ce163d113]
iwlwifi: handle DMA mapping failures
[7c34158231b2eda8dcbd297be2bb1559e69cb433]

Julius Werner (1):
xhci: fix null-pointer dereference when destroying half-built segment rings
[68e5254adb88bede68285f11fb442a4d34fb550c]

Kamil Iskra (1):
ACPI / battery: Correct battery capacity values on Thinkpads
[4000e626156935dfb626321ce09cae2c833eabbb]

Kees Cook (2):

      exec: do not leave bprm->interp on stack
         [b66c5984017533316fd1951770302649baf1aa33]
      use clamp_t in UNAME26 fix
         [31fd84b95eb211d5db460a1dda85e004800a7b52]

Kevin McKinney (2):
Staging: bcm: Add two products and remove an existing product.
[4f29ef050848245f7c180b95ccf67dfcd76b1fd8]
Staging: bcm: Create and initialize new device id in InterfaceInit
[e66fc1fba248738d32f3b64508f9ef1176d9e767]

Krzysztof Wilczynski (1):
scsi: aha152x: Fix sparse warning and make printing pointer address more portable.
[b631cf1f899f9d2e449884dbccc34940637c639f]

Lan Tianyu (2):
ACPI / PM: Add Sony Vaio VPCEB1S1E to nonvs blacklist.
[876ab79055019e248508cfd0dee7caa3c0c831ed]
ACPI / video: Add "Asus UL30VT" to ACPI video detect blacklist
[d0c2ce16bec0afa6013b4c5220ca4c9c67210215]

[email protected] (1):
USB: add new zte 3g-dongle's pid to option.c
[31b6a1048b7292efff8b5b53ae3d9d29adde385e]

Malcolm Priestley (6):
staging: vt6656: 64 bit fixes : correct all type sizes
[7730492855a2f9c828599bcd8d62760f96d319e4]
staging: vt6656: 64 bit fixes: fix long warning messages.
[b4dc03af5513774277c9c36b12a25cd3f25f4404]
staging: vt6656: 64 bit fixes: use u32 for QWORD definition.
[a552397d5e4ef0cc0bd3e9595d6acc9a3b381171]
staging: vt6656: 64bit fixes: key.c/h change unsigned long to u32
[c0d05b305b00c698b0a8c1b3d46c9380bce9db45]
staging: vt6656: 64bit fixes: vCommandTimerWait change calculation of timer.
[70e227790d4ee4590023d8041a3485f8053593fc]
staging: vt6656: [BUG] out of bound array reference in RFbSetPower.
[ab1dd9963137a1e122004d5378a581bf16ae9bc8]

Marco Stornelli (1):
ramoops: fix use of rounddown_pow_of_two()
[fdb5950754eb3dedb9fea7c8828d3e51d9dbc3f7]

Marcos Chaparro (1):
Bluetooth: ath3k: Add support for VAIO VPCEH [0489:e027]
[acd9454433e28c1a365d8b069813c35c1c3a8ac3]

Marek Szyprowski (1):
mm: dmapool: use provided gfp flags for all dma_alloc_coherent() calls
[387870f2d6d679746020fa8e25ef786ff338dc98]

Mark Brown (2):
regmap: debugfs: Avoid overflows for very small reads
[db04328c167ff8e7c57f4a3532214aeada3a82fd]
regulator: wm831x: Set the new rather than old value for DVS VSEL
[13ae633cf729b0ecb677b75b04886ff8fada8fad]

Markus Becker (1):

      USB: cp210x: add Virtenio Preon32 device id
         [356fe44f4b8ece867bdb9876b1854d7adbef9de2]

Martin Teichmann (1):
USB: ftdi_sio: Add support for Newport AGILIS motor drivers
[d7e14b375b40c04cd735b115713043b69a2c68ac]

Masanari Iida (1):
drivers/leds/leds-lp5521.c: fix typo
[3a2fd4a14112452eb5c1a079ac8b3f4842762afe]

Mauro Carvalho Chehab (1):
i82975x_edac: Fix dimm label initialization
[479696840239e0cc43efb3c917bdcad2174d2215]

Mel Gorman (1):
tmpfs: fix shared mempolicy leak
[18a2f371f5edf41810f6469cb9be39931ef9deb9]

Mikael Pettersson (1):
sata_promise: fix hardreset lockdep error
[3100d49d3cd236443faae9d81137c81b22d36003]

Mike Galbraith (1):
Revert "sched, autogroup: Stop going ahead if autogroup is disabled"
[fd8ef11730f1d03d5d6555aa53126e9e34f52f12]

Mike Miller (1):
[SCSI] hpsa: gen8plus Smart Array IDs
[fe0c9610bb68dd0aad1017456f5e3c31264d70c2]

Mikulas Patocka (1):
dm persistent data: rename node to btree_node
[550929faf89e2e2cdb3e9945ea87d383989274cf]

Namjae Jeon (1):
udf: fix memory leak while allocating blocks during write
[2fb7d99d0de3fd8ae869f35ab682581d8455887a]

Neil Brown (1):
nfsd: avoid permission checks on EXCLUSIVE_CREATE replay
[7007c90fb9fef593b4aeaeee57e6a6754276c97c]

NeilBrown (2):
NFS: avoid NULL dereference in nfs_destroy_server
[f259613a1e4b44a0cf85a5dafd931be96ee7c9e5]
vfs: d_obtain_alias() needs to use "/" as default name.
[b911a6bdeef5848c468597d040e3407e0aee04ce]

[email protected] (1):
bonding: fix race condition in bonding_store_slaves_active
[e196c0e579902f42cf72414461fb034e5a1ffbf7]

Oleg Nesterov (1):
freezer: PF_FREEZER_NOSIG should be cleared along with PF_NOFREEZE
[not upstream; flag has been removed]

Ondrej Zary (1):
x86, 8042: Enable A20 using KBC to fix S3 resume on some MSI laptops
[ad68652412276f68ad4fe3e1ecf5ee6880876783]

Paul Walmsley (1):
ARM: 7566/1: vfp: fix save and restore when running on pre-VFPv3 and CONFIG_VFPv3 set
[39141ddfb63a664f26d3f42f64ee386e879b492c]

Paulo Zanoni (1):
drm/i915: make the panel fitter work on pipes B and C on IVB
[13888d78c664a1f61d7b09d282f5916993827a40]

Peter Korsgaard (1):
usb: ftdi_sio: fixup BeagleBone A5+ quirk
[1a88d5eee2ef2ad1d3c4e32043e9c4c5347d4fc1]

Peter Popovec (1):
Input: walkera0701 - fix crash on startup
[a455e2985f57e2a71566bb8850094af38b2c932d]

Petr Matousek (1):
KVM: x86: invalid opcode oops on SET_SREGS with OSXSAVE bit set (CVE-2012-4461)
[6d1068b3a98519247d8ba4ec85cd40ac136dbdf9]

Rafael J. Wysocki (1):
ACPI / PNP: Do not crash due to stale pointer use during system resume
[a6b5e88c0e42093b9057856f35770966c8c591e3]

Rafał Miłecki (1):
bcma: mips: fix clearing device IRQ
[cbbc0138efe1dcd5426b8fc5d87741f5057aee72]

Rajkumar Manoharan (1):
ath9k_hw: Enable hw PLL power save for AR9462
[1680260226a8fd2aab590319da83ad8e610da9bd]

Robin Holt (1):
SGI-XP: handle non-fatal traps
[891348ca0f66206f1dc0e30d63757e3df1ae2d15]

Roland Dreier (1):
iscsi-target: Always send a response before terminating iSCSI connection
[1c5c12c666fda27c7c494b34934a0a0631a48130]

Russell Webb (1):
xhci: Add Lynx Point LP to list of Intel switchable hosts
[bb1e5dd7113d2fd178d3af9aca8f480ae0468edf]

Sarah Sharp (3):
xHCI: Fix TD Size calculation on 1.0 hosts.
[4525c0a10dff7ad3669763c28016c7daffc3900e]
xhci: Extend Fresco Logic MSI quirk.
[bba18e33f25072ebf70fd8f7f0cdbf8cdb59a746]
xhci: Fix conditional check in bandwidth calculation.
[392a07ae3316f2b90b39ce41e66d6f6b5c95de90]

Sarveshwar Bandi (1):
bonding: Bonding driver does not consider the gso_max_size/gso_max_segs setting of slave devices.
[0e376bd0b791ac6ac6bdb051492df0769c840848]

Sasha Levin (1):
[SCSI] prevent stack buffer overflow in host_reset
[072f19b4bea31cdd482d79f805413f2f9ac9e233]

Sebastian Andrzej Siewior (5):

      target/file: Fix 32-bit highmem breakage for SGL -> iovec mapping
         [40ff2c3b3da35dd3a00ac6722056a59b4b3f2caf]
      usb: gadget: midi: free hs descriptors
         [d185039f7982eb82cf8d03b6fb6689587ca5af24]
      usb: gadget: network: fix bind() error path
         [e79cc615a9bb44da72c499ccfa2c9c4bbea3aa84]
      usb: gadget: phonet: free requests in pn_bind()'s error path
         [d0eca719dd11ad0619e8dd6a1f3eceb95b0216dd]
      usb: gadget: uvc: fix error path in uvc_function_bind()
         [0f9df939385527049c8062a099fbfa1479fe7ce0]

Sebastian Ott (1):
s390/cio: fix pgid reserved check
[d99e79ec5574fc556c988f613ed6175f6de66f4a]

Sergei Shtylyov (1):
usb: musb: cppi_dma: export cppi_interrupt()
[8b416b0b25d5d8ddb3a91c1d20e1373582c50405]

Seth Heasley (1):
ALSA: hda - Add Lynx Point HD Audio Controller DeviceIDs
[8bc039a1e15a72da8426b84293723fb7181f0b5e]

Shuah Khan (1):
powerpc: fix wii_memory_fixups() compile error on 3.0.y tree
[not upstream; code has been removed]

Srinidhi KASAGAR (1):
drivers/leds/leds-lp5521.c: ret may be uninitialized
[42960b76d2c6a44d7e8000f4eb9a4ca1780059ff]

Stanislaw Gruszka (2):

      Revert: "rt2x00: Don't let mac80211 send a BAR when an AMPDU subframe fails"
         [ab9d6e4ffe192427ce9e93d4f927b0faaa8a941e]
      mac80211: introduce IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL
         [5b632fe85ec82e5c43740b52e74c66df50a37db3]

Stephan Gatzka (1):
firewire: net: Fix handling of fragmented multicast/broadcast packets.
[9d2373420900a39f5212a3b289331aa3535b1000]

Steven Rostedt (1):
ring-buffer: Fix NULL pointer if rb_set_head_page() fails
[54f7be5b831254199522523ccab4c3d954bbf576]

Takashi Iwai (6):
ALSA: hda - Add stereo-dmic fixup for Acer Aspire One 522
[63a077e27648b4043b1ca1b4e29f0c42d99616b6]
ALSA: hda - Always turn on pins for HDMI/DP
[6169b673618bf0b2518ce413b54925782a603f06]
ALSA: hda - Fix pin configuration of HP Pavilion dv7
[8ae5865ec77c22462c736846a0679947a6953548]
ALSA: hda - Fix the wrong pincaps set in ALC861VD dallas/hp fixup
[b78562b10fa66175e30b76073e32a0ad8d92aa83]
ALSA: usb-audio: Avoid autopm calls after disconnection
[59866da9e4ae54819e3c4e0a8f426bdb0c2ef993]
ALSA: usb-audio: Fix missing autopm for MIDI input
[f5f165418cabf2218eb466c0e94693b8b1aee88b]

Tejun Heo (4):

      cgroup: cgroup_subsys->fork() should be called after the task is added to css_set
         [5edee61edeaaebafe584f8fb7074c1ef4658596b]
      cgroup: remove incorrect dget/dput() pair in cgroup_create_dir()
         [175431635ec09b1d1bba04979b006b99e8305a83]
      freezer: add missing mb's to freezer_count() and freezer_should_skip()
         [dd67d32dbc5de299d70cc9e10c6c1e29ffa56b92]
      workqueue: convert BUG_ON()s in __queue_delayed_work() to WARN_ON_ONCE()s
         [fc4b514f2727f74a4587c31db87e0e93465518c3]

Thomas Gleixner (1):
genirq: Always force thread affinity
[04aa530ec04f61875b99c12721162e2964e3318c]

Tommi Rantala (2):
sctp: fix -ENOMEM result with invalid user space pointer in sendto() syscall
[6e51fe7572590d8d86e93b547fab6693d305fd0d]
sctp: fix memory leak in sctp_datamsg_from_user() when copy from user space fails
[be364c8c0f17a3dd42707b5a090b318028538eb9]

Wei Yongjun (1):
iscsit: use GFP_ATOMIC under spin lock
[3c989d7603872bf878840f7ce3ea49b73bea4c6c]

Will Deacon (4):
ARM: mm: use pteval_t to represent page protection values
[864aa04cd02979c2c755cb28b5f4fe56039171c0]
mm: highmem: export kmap_to_page for modules
[f0263d2d222e9e25f2587e51a9dc58c6fb2a9352]
virtio: 9p: correctly pass physical address to userspace for high pages
[b9cdc88df8e63e81c723b82c286fc97f5d0dc325]
virtio: force vring descriptors to be allocated from lowmem
[b92b1b89a33c172c075edccf6afb0edc41d851fd]

Wolfram Sang (1):
mtd: nand: gpmi: reset BCH earlier, too, to avoid NAND startup problems
[6f2a6a52560ad8d85710aabd92b7a3239b3a6b07]

Wu Fengguang (1):
ALSA: hda - add id for Atom Cedar Trail HDMI codec
[6edc59e602b36cd3c95a426ef6e8cad0344af8c7]

Xi Wang (1):
[SCSI] mvsas: fix undefined bit shift
[beecadea1b8d67f591b13f7099559f32f3fd601d]

Xiaotian Feng (1):
[libata] fix Null pointer dereference on disk error
[26cd4d65deba587f3cf2329b6869ce02bcbe68ec]

Yanchuan Nian (1):
nfs: fix wrong object type in lockowner_slab
[3c40794b2dd0f355ef4e6bf8d85af5dcd7da7ece]

Yi Zou (1):
target/tcm_fc: fix the lockdep warning due to inconsistent lock state
[9f4ad44b264f8bb61ffdd607148215566568430d]

Zhang Rui (2):
ACPI / video: ignore BIOS initial backlight value for HP Folio 13-2000
[129ff8f8d58297b04f47b5d6fad81aa2d08404e1]
ACPI: do acpisleep dmi check when CONFIG_ACPI_SLEEP is set
[0ac1b1d7b7424cd6f129b5454b504b3cae746f0e]

 Documentation/hwmon/coretemp                       |   12 +-
 Makefile                                           |    4 +-
 arch/arm/include/asm/hwcap.h                       |    3 +-
 arch/arm/include/asm/vfpmacros.h                   |   12 +-
 arch/arm/kernel/swp_emulate.c                      |    2 +
 arch/arm/mm/mmu.c                                  |    2 +-
 arch/arm/vfp/vfpmodule.c                           |    9 +-
 arch/cris/include/asm/io.h                         |   39 ++-
 arch/mips/kernel/process.c                         |    4 +-
 arch/powerpc/kernel/head_64.S                      |    2 +-
 arch/powerpc/kvm/44x_emulate.c                     |    2 +
 arch/powerpc/platforms/embedded6xx/wii.c           |    6 +-
 arch/s390/kvm/kvm-s390.c                           |    2 +-
 arch/x86/kernel/hpet.c                             |    4 +-
 arch/x86/kvm/x86.c                                 |    6 +
 drivers/acpi/battery.c                             |   77 +++++
 drivers/acpi/processor_driver.c                    |    1 +
 drivers/acpi/sleep.c                               |  340 ++++++++++----------
 drivers/acpi/video.c                               |   14 +
 drivers/acpi/video_detect.c                        |   37 +++
 drivers/ata/libata-core.c                          |    1 +
 drivers/ata/libata-eh.c                            |    1 +
 drivers/ata/libata-scsi.c                          |    6 +-
 drivers/ata/sata_promise.c                         |   15 +-
 drivers/ata/sata_svw.c                             |   35 ++
 drivers/atm/solos-pci.c                            |    5 +-
 drivers/base/regmap/regmap-debugfs.c               |    2 +-
 drivers/bcma/driver_mips.c                         |    2 +-
 drivers/bluetooth/ath3k.c                          |    1 +
 drivers/bluetooth/btusb.c                          |    3 +
 drivers/char/agp/intel-agp.h                       |    1 +
 drivers/char/agp/intel-gtt.c                       |    2 +
 drivers/char/ramoops.c                             |    4 +-
 drivers/edac/i7300_edac.c                          |    8 +-
 drivers/edac/i82975x_edac.c                        |   11 +-
 drivers/firewire/net.c                             |   13 +-
 drivers/gpu/drm/drm_crtc_helper.c                  |    4 +-
 drivers/gpu/drm/drm_edid.c                         |    5 +
 drivers/gpu/drm/i915/i915_debugfs.c                |    4 +-
 drivers/gpu/drm/i915/i915_drv.c                    |    1 +
 drivers/gpu/drm/i915/i915_gem.c                    |    5 +
 drivers/gpu/drm/i915/i915_irq.c                    |    4 +-
 drivers/gpu/drm/i915/i915_reg.h                    |    2 +
 drivers/gpu/drm/i915/intel_bios.c                  |   11 +-
 drivers/gpu/drm/i915/intel_display.c               |   95 +++---
 drivers/gpu/drm/i915/intel_drv.h                   |    5 +-
 drivers/gpu/drm/i915/intel_lvds.c                  |   16 +
 drivers/gpu/drm/radeon/atombios_crtc.c             |    5 +
 drivers/gpu/drm/radeon/atombios_encoders.c         |    2 +-
 drivers/gpu/drm/radeon/evergreen.c                 |    4 +-
 drivers/hid/hid-apple.c                            |    3 +
 drivers/hid/hid-core.c                             |    1 +
 drivers/hid/hid-ids.h                              |    1 +
 drivers/hid/hid-magicmouse.c                       |    2 +
 drivers/hwmon/coretemp.c                           |   34 +-
 drivers/hwmon/fam15h_power.c                       |    4 +
 drivers/input/joystick/walkera0701.c               |    7 +-
 drivers/input/serio/i8042-x86ia64io.h              |    9 +
 drivers/iommu/intel-iommu.c                        |   11 +-
 drivers/leds/leds-lp5521.c                         |   16 +-
 drivers/md/dm-ioctl.c                              |    8 +
 drivers/md/persistent-data/dm-btree-internal.h     |   16 +-
 drivers/md/persistent-data/dm-btree-remove.c       |   50 +--
 drivers/md/persistent-data/dm-btree-spine.c        |    6 +-
 drivers/md/persistent-data/dm-btree.c              |   22 +-
 drivers/mfd/mfd-core.c                             |   15 +-
 drivers/misc/hpilo.c                               |   11 +-
 drivers/misc/sgi-xp/xpc_main.c                     |   34 +-
 drivers/mmc/host/sh_mmcif.c                        |    4 -
 drivers/mtd/nand/gpmi-nand/gpmi-lib.c              |    9 +
 drivers/net/bonding/bond_main.c                    |    7 +
 drivers/net/bonding/bond_sysfs.c                   |    2 +
 drivers/net/can/dev.c                              |    3 +-
 drivers/net/ethernet/8390/ne.c                     |    1 +
 drivers/net/irda/sir_dev.c                         |    2 +-
 drivers/net/usb/ipheth.c                           |    5 +
 drivers/net/wimax/i2400m/i2400m-usb.h              |    3 +
 drivers/net/wimax/i2400m/usb.c                     |    6 +
 .../net/wireless/ath/ath9k/ar9003_2p2_initvals.h   |  172 +++++-----
 drivers/net/wireless/ath/ath9k/ar9003_eeprom.h     |    6 +-
 drivers/net/wireless/ath/ath9k/ar9003_hw.c         |   11 +-
 drivers/net/wireless/ath/ath9k/calib.c             |    1 +
 drivers/net/wireless/ath/ath9k/calib.h             |    3 +
 drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c   |   35 +-
 drivers/net/wireless/rt2x00/rt2800lib.c            |    3 +-
 drivers/pnp/pnpacpi/core.c                         |    5 +-
 drivers/regulator/wm831x-dcdc.c                    |    2 +-
 drivers/s390/cio/device_pgid.c                     |   10 +-
 drivers/scsi/aha152x.c                             |    4 +-
 drivers/scsi/hpsa.c                                |   32 +-
 drivers/scsi/mvsas/mv_94xx.h                       |   14 +-
 drivers/scsi/mvsas/mv_sas.h                        |    2 +-
 drivers/scsi/qla2xxx/qla_os.c                      |    4 +-
 drivers/scsi/scsi_sysfs.c                          |   11 +-
 drivers/staging/bcm/InterfaceInit.c                |    4 +-
 drivers/staging/bcm/InterfaceInit.h                |    5 +-
 drivers/staging/vt6656/dpc.c                       |    4 +-
 drivers/staging/vt6656/key.c                       |   53 ++-
 drivers/staging/vt6656/key.h                       |    8 +-
 drivers/staging/vt6656/mac.c                       |    6 +-
 drivers/staging/vt6656/rf.c                        |    3 +
 drivers/staging/vt6656/rxtx.c                      |   18 +-
 drivers/staging/vt6656/ttype.h                     |   16 +-
 drivers/staging/vt6656/wcmd.c                      |   20 +-
 drivers/staging/vt6656/wpa2.h                      |    4 +-
 drivers/target/iscsi/iscsi_target.c                |    2 +-
 drivers/target/iscsi/iscsi_target_login.c          |    8 +-
 drivers/target/iscsi/iscsi_target_nego.c           |   10 +-
 drivers/target/target_core_file.c                  |    9 +-
 drivers/target/tcm_fc/tfc_sess.c                   |    2 +-
 drivers/telephony/ixj.c                            |   24 +-
 drivers/usb/class/cdc-wdm.c                        |    4 +-
 drivers/usb/core/message.c                         |   53 +--
 drivers/usb/gadget/f_ecm.c                         |    4 +-
 drivers/usb/gadget/f_eem.c                         |    5 +-
 drivers/usb/gadget/f_midi.c                        |    1 +
 drivers/usb/gadget/f_ncm.c                         |    4 +-
 drivers/usb/gadget/f_phonet.c                      |    8 +-
 drivers/usb/gadget/f_rndis.c                       |    4 +-
 drivers/usb/gadget/f_subset.c                      |    4 +-
 drivers/usb/gadget/f_uvc.c                         |   39 +--
 drivers/usb/host/ehci-pci.c                        |    3 +-
 drivers/usb/host/ehci-q.c                          |   16 +-
 drivers/usb/host/ehci-sched.c                      |    4 +-
 drivers/usb/host/ohci-q.c                          |   19 ++
 drivers/usb/host/pci-quirks.c                      |    4 +-
 drivers/usb/host/xhci-mem.c                        |   11 +-
 drivers/usb/host/xhci-pci.c                        |    7 +-
 drivers/usb/host/xhci-ring.c                       |   32 +-
 drivers/usb/host/xhci.c                            |    4 +-
 drivers/usb/musb/cppi_dma.c                        |    1 +
 drivers/usb/serial/cp210x.c                        |    1 +
 drivers/usb/serial/ftdi_sio.c                      |    3 +-
 drivers/usb/serial/ftdi_sio_ids.h                  |    6 +
 drivers/usb/serial/option.c                        |   25 ++
 drivers/usb/storage/Kconfig                        |    2 +-
 drivers/virtio/virtio_ring.c                       |    7 +
 fs/binfmt_misc.c                                   |    5 +-
 fs/binfmt_script.c                                 |    4 +-
 fs/dcache.c                                        |    2 +-
 fs/exec.c                                          |   18 +-
 fs/ext4/acl.c                                      |    6 +-
 fs/ext4/inode.c                                    |    1 +
 fs/nfs/client.c                                    |    3 +-
 fs/nfs/nfs4proc.c                                  |   21 +-
 fs/nfsd/nfs4proc.c                                 |    8 +-
 fs/nfsd/nfs4state.c                                |    2 +-
 fs/nfsd/nfs4xdr.c                                  |   11 +-
 fs/nfsd/nfssvc.c                                   |    2 +-
 fs/nfsd/vfs.c                                      |   10 +-
 fs/proc/array.c                                    |    2 +-
 fs/udf/inode.c                                     |    4 +
 include/linux/binfmts.h                            |    1 +
 include/linux/cgroup.h                             |    1 -
 include/linux/freezer.h                            |   51 ++-
 include/linux/highmem.h                            |    7 +
 include/linux/mempolicy.h                          |   16 -
 include/linux/pci_ids.h                            |    1 +
 include/net/mac80211.h                             |    5 +
 kernel/cgroup.c                                    |   52 ++-
 kernel/cgroup_freezer.c                            |   13 +-
 kernel/fork.c                                      |    9 +-
 kernel/irq/manage.c                                |   23 +-
 kernel/rcutree.c                                   |   14 +-
 kernel/sched_autogroup.c                           |    4 -
 kernel/sched_autogroup.h                           |    5 -
 kernel/sys.c                                       |    2 +-
 kernel/trace/ftrace.c                              |    2 +-
 kernel/trace/ring_buffer.c                         |    7 +-
 kernel/workqueue.c                                 |    4 +-
 mm/dmapool.c                                       |   31 +-
 mm/highmem.c                                       |   13 +
 mm/huge_memory.c                                   |    3 +
 mm/memory.c                                        |   18 +-
 mm/mempolicy.c                                     |   22 --
 mm/shmem.c                                         |   26 +-
 mm/vmscan.c                                        |   27 +-
 net/9p/trans_virtio.c                              |    3 +-
 net/bluetooth/rfcomm/sock.c                        |    4 +-
 net/ipv4/ip_fragment.c                             |   19 +-
 net/mac80211/status.c                              |    6 +-
 net/sctp/chunk.c                                   |   20 +-
 net/sctp/socket.c                                  |    4 +-
 security/device_cgroup.c                           |    6 +-
 sound/pci/hda/hda_intel.c                          |    5 +
 sound/pci/hda/patch_conexant.c                     |    1 +
 sound/pci/hda/patch_hdmi.c                         |   20 +-
 sound/pci/hda/patch_realtek.c                      |    5 +-
 sound/pci/hda/patch_sigmatel.c                     |    2 +-
 sound/usb/midi.c                                   |   91 ++++--
 190 files changed, 1641 insertions(+), 926 deletions(-)

Ben Hutchings
The world is coming to an end.	Please log off.

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ben Hutchings <[email protected]>

This reverts commit c5ee58688baa98bc3a4f6095a1acf6fd7fd9e967, which was commit 201e72acb2d3821e2de9ce6091e98859c316b29a upstream.

Herton Ronaldo Krzesinski pointed out that the race condition this dealt with does not exist in 3.2.y.

---
 security/device_cgroup.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

index 92e24bb..4450fbe 100644
@@ -202,8 +202,8 @@ static void devcgroup_destroy(struct cgroup_subsys *ss,
 
 	dev_cgroup = cgroup_to_devcgroup(cgroup);
 	list_for_each_entry_safe(wh, tmp, &dev_cgroup->whitelist, list) {
-		list_del_rcu(&wh->list);
-		kfree_rcu(wh, rcu);
+		list_del(&wh->list);
+		kfree(wh);
 	}
 	kfree(dev_cgroup);
 }

@@ -278,7 +278,7 @@ static int may_access_whitelist(struct dev_cgroup *c,
 {
 	struct dev_whitelist_item *whitem;
 
-	list_for_each_entry_rcu(whitem, &c->whitelist, list) {
+	list_for_each_entry(whitem, &c->whitelist, list) {
 		if (whitem->type & DEV_ALL)
 			return 1;
 		if ((refwh->type & DEV_BLOCK) && !(whitem->type & DEV_BLOCK))

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Oleg Nesterov <[email protected]>

This patch is only for pre-v3.3 stable trees which backported b40a7959 "freezer: exec should clear PF_NOFREEZE along with PF_KTHREAD". v3.3+ doesn't need this fix.

b40a7959 is the trivial bugfix, but unfortunately I forgot that until 34b087e4 "freezer: kill unused set_freezable_with_signal()" there were another only-for-kernel-threads flag, PF_FREEZER_NOSIG, which should be cleared as well.

See https://bugs.launchpad.net/ubuntu/+source/v86d/+bug/1080530
The freezer fails because it expects that a PF_FREEZER_NOSIG task doesn't need a signal. Before b40a7959 it wrongly succeeds leaving the PF_NOFREEZE | PF_FREEZER_NOSIG task unfrozen.

@@ -1095,7 +1095,8 @@ int flush_old_exec(struct linux_binprm *
 	bprm->mm = NULL;		/* We're using it now */
 
 	set_fs(USER_DS);
-	current->flags &= ~(PF_RANDOMIZE | PF_KTHREAD | PF_NOFREEZE);
+	current->flags &=
+		~(PF_RANDOMIZE | PF_KTHREAD | PF_NOFREEZE | PF_FREEZER_NOSIG);
 	flush_thread();
 	current->personality &= ~bprm->per_clear;
 

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Petr Matousek <[email protected]>

commit 6d1068b3a98519247d8ba4ec85cd40ac136dbdf9 upstream.

On hosts without the XSAVE support unprivileged local user can trigger oops similar to the one below by setting X86_CR4_OSXSAVE bit in guest cr4 register using KVM_SET_SREGS ioctl and later issuing KVM_RUN ioctl.

invalid opcode: 0000 [#2] SMP

Modules linked in: tun ip6table_filter ip6_tables ebtable_nat ebtables

...
Pid: 24935, comm: zoog_kvm_monito Tainted: G D 3.2.0-3-686-pae
EIP: 0060:[<f8b9550c>] EFLAGS: 00210246 CPU: 0
EIP is at kvm_arch_vcpu_ioctl_run+0x92a/0xd13 [kvm]
EAX: 00000001 EBX: 000f387e ECX: 00000000 EDX: 00000000
ESI: 00000000 EDI: 00000000 EBP: ef5a0060 ESP: d7c63e70
DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process zoog_kvm_monito (pid: 24935, ti=d7c62000 task=ed84a0c0 task.ti=d7c62000)

Stack:
 00000001 f70a1200 f8b940a9 ef5a0060 00000000 00200202 f8769009 00000000
 ef5a0060 000f387e eda5c020 8722f9c8 00015bae 00000000 ed84a0c0 ed84a0c0
 c12bf02d 0000ae80 ef7f8740 fffffffb f359b740 ef5a0060 f8b85dc1 0000ae80
Call Trace:
 [<f8b940a9>] ? kvm_arch_vcpu_ioctl_set_sregs+0x2fe/0x308 [kvm]
...
 [<c12bfb44>] ? syscall_call+0x7/0xb
Code: 89 e8 e8 14 ee ff ff ba 00 00 04 00 89 e8 e8 98 48 ff ff 85 c0 74

1e 83 7d 48 00 75 18 8b 85 08 07 00 00 31 c9 8b 95 0c 07 00 00 <0f> 01 d1 c7 45 48 01 00 00 00 c7 45 1c 01 00 00 00 0f ae f0 89
EIP: [<f8b9550c>] kvm_arch_vcpu_ioctl_run+0x92a/0xd13 [kvm] SS:ESP 0068:d7c63e70

QEMU first retrieves the supported features via KVM_GET_SUPPORTED_CPUID and then sets them later. So guest's X86_FEATURE_XSAVE should be masked out on hosts without X86_FEATURE_XSAVE, making kvm_set_cr4 with X86_CR4_OSXSAVE fail. Userspaces that allow specifying guest cpuid with X86_FEATURE_XSAVE even on hosts that do not support it, might be susceptible to this attack from inside the guest as well.

Allow setting X86_CR4_OSXSAVE bit only if host has XSAVE support.

---

@@ -578,6 +578,9 @@ static bool guest_cpuid_has_xsave(struct
 {
 	struct kvm_cpuid_entry2 *best;
 
+	if (!static_cpu_has(X86_FEATURE_XSAVE))
+		return 0;
+
 	best = kvm_find_cpuid_entry(vcpu, 1, 0);
 	return best && (best->ecx & bit(X86_FEATURE_XSAVE));
 }

@@ -6149,6 +6152,9 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct
 	int pending_vec, max_bits, idx;
 	struct desc_ptr dt;
 
+	if (!guest_cpuid_has_xsave(vcpu) && (sregs->cr4 & X86_CR4_OSXSAVE))
+		return -EINVAL;
+
 	dt.size = sregs->idt.limit;
 	dt.address = sregs->idt.base;
 	kvm_x86_ops->set_idt(vcpu, &dt);

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chase Douglas <[email protected]>

commit 503f7d53b368c8e4e13a7756220c0536fcf1a034 upstream.

---
 drivers/hid/hid-magicmouse.c |    2 ++
 1 file changed, 2 insertions(+)

index 2ab7175..7cf3ffe 100644
@@ -418,6 +418,8 @@ static void magicmouse_setup_input(struct input_dev *input, struct hid_device *h
 		__set_bit(BTN_TOOL_TRIPLETAP, input->keybit);
 		__set_bit(BTN_TOOL_QUADTAP, input->keybit);
 		__set_bit(BTN_TOUCH, input->keybit);
+		__set_bit(INPUT_PROP_POINTER, input->propbit);
+		__set_bit(INPUT_PROP_BUTTONPAD, input->propbit);
 	}
 
 	if (report_touches) {

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Seth Heasley <[email protected]>

commit 8bc039a1e15a72da8426b84293723fb7181f0b5e upstream.

This patch adds the HD Audio DeviceIDs for the Intel Lynx Point PCH.

---
 sound/pci/hda/hda_intel.c |    5 +++++
 1 file changed, 5 insertions(+)

index d3bd3e7..e354c16 100644
@@ -148,6 +148,7 @@ MODULE_SUPPORTED_DEVICE("{{Intel, ICH6},"
 			 "{Intel, PCH},"
 			 "{Intel, CPT},"
 			 "{Intel, PPT},"
+			 "{Intel, LPT},"
 			 "{Intel, PBG},"
 			 "{Intel, SCH},"
 			 "{ATI, SB450},"

@@ -3001,6 +3002,10 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids) = {
 	{ PCI_DEVICE(0x8086, 0x1e20),
 	  .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_SCH_SNOOP |
 	  AZX_DCAPS_BUFSIZE},
+	/* Lynx Point */
+	{ PCI_DEVICE(0x8086, 0x8c20),
+	  .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_SCH_SNOOP |
+	  AZX_DCAPS_BUFSIZE},
 	/* SCH */
 	{ PCI_DEVICE(0x8086, 0x811b),
 	  .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_SCH_SNOOP |

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Eugeni Dodonov <[email protected]>

commit 9292f37e1f5c79400254dca46f83313488093825 upstream.

This allows to avoid talking to a non-responding bus repeatedly until we finally timeout after 15 attempts. We can do this by catching the -ENXIO error, provided by i2c_algo_bit:bit_doAddress call.

Within the bit_doAddress we already try 3 times to get the edid data, so if the routine tells us that bus is not responding, it is mostly pointless to keep re-trying those attempts over and over again until we reach final number of retries.

This change should fix https://bugs.freedesktop.org/show_bug.cgi?id=41059
and improve overall edid detection timing by 10-30% in most cases, and by a much larger margin in case of phantom outputs (up to 30x in one worst case).

Timing results for i915-powered machines for 'time xrandr' command:
Machine 1: from 0.840s to 0.290s
Machine 2: from 0.315s to 0.280s
Machine 3: from +/- 4s to 0.184s

Timing results for HD5770 with 'time xrandr' command:
Machine 4: from 3.210s to 1.060s

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=41059

---
 drivers/gpu/drm/drm_edid.c |    5 +++++
 1 file changed, 5 insertions(+)

index ece03fc..54a4efa 100644
@@ -266,6 +266,11 @@ drm_do_probe_ddc_edid(struct i2c_adapter *adapter, unsigned char *buf,
 			}
 		};
 		ret = i2c_transfer(adapter, msgs, 2);
+		if (ret == -ENXIO) {
+			DRM_DEBUG_KMS("drm: skipping non-existent adapter %s\n",
+					adapter->name);
+			break;
+		}
 	} while (ret != 2 && --retries);
 
 	return ret == 2 ? 0 : -1;

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Wu Fengguang <[email protected]>

commit 6edc59e602b36cd3c95a426ef6e8cad0344af8c7 upstream.

[the order sorted by tiwai]

---
 sound/pci/hda/patch_hdmi.c |    2 ++
 1 file changed, 2 insertions(+)

index 1168ebd..540cd13 100644
@@ -1912,6 +1912,7 @@ static const struct hda_codec_preset snd_hda_preset_hdmi[] = {
 { .id = 0x80862804, .name = "IbexPeak HDMI",	.patch = patch_generic_hdmi },
 { .id = 0x80862805, .name = "CougarPoint HDMI",	.patch = patch_generic_hdmi },
 { .id = 0x80862806, .name = "PantherPoint HDMI", .patch = patch_generic_hdmi },
+{ .id = 0x80862880, .name = "CedarTrail HDMI",	.patch = patch_generic_hdmi },
 { .id = 0x808629fb, .name = "Crestline HDMI",	.patch = patch_generic_hdmi },
 {} /* terminator */
 };

@@ -1958,6 +1959,7 @@ MODULE_ALIAS("snd-hda-codec-id:80862803");
 MODULE_ALIAS("snd-hda-codec-id:80862804");
 MODULE_ALIAS("snd-hda-codec-id:80862805");
 MODULE_ALIAS("snd-hda-codec-id:80862806");
+MODULE_ALIAS("snd-hda-codec-id:80862880");
 MODULE_ALIAS("snd-hda-codec-id:808629fb");
 
 MODULE_LICENSE("GPL");

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Calvin Walton <[email protected]>

commit a51d4ed01e5bb39d2cf36a12f9976ab08872c192 upstream.

This board is incorrectly detected as having an LVDS connector, resulting in the VGA output (the only available output on the board) showing the console only in the top-left 1024x768 pixels, and an extra LVDS connector appearing in X.

It's a desktop Mini-ITX board using an Atom D525 CPU with an NM10 chipset.

I've had this board for about a year, but this is the first time I noticed the issue because I've been running it headless for most of its life.

---
 drivers/gpu/drm/i915/intel_lvds.c |    8 ++++++++
 1 file changed, 8 insertions(+)

index e05c0d3..e9a6f6a 100644
@@ -780,6 +780,14 @@ static const struct dmi_system_id intel_no_lvds[] = {
 			DMI_MATCH(DMI_BOARD_NAME, "ZBOXSD-ID12/ID13"),
 		},
 	},
+	{
+		.callback = intel_no_lvds_dmi_callback,
+		.ident = "Gigabyte GA-D525TUD",
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "Gigabyte Technology Co., Ltd."),
+			DMI_MATCH(DMI_BOARD_NAME, "D525TUD"),
+		},
+	},
 
 	{ }	/* terminating entry */
 };

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chris Wilson <[email protected]>

commit c31407a3672aaebb4acddf90944a114fa5c8af7b upstream.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=55375

---
 drivers/gpu/drm/i915/intel_lvds.c |    8 ++++++++
 1 file changed, 8 insertions(+)

index 40d72bd..224ae5f 100644
@@ -778,6 +778,14 @@ static const struct dmi_system_id intel_no_lvds[] = {
 			DMI_MATCH(DMI_BOARD_NAME, "D525TUD"),
 		},
 	},
+	{
+		.callback = intel_no_lvds_dmi_callback,
+		.ident = "Supermicro X7SPA-H",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Supermicro"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "X7SPA-H"),
+		},
+	},
 
 	{ }	/* terminating entry */
 };

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alan Cox <[email protected]>

commit 879dca019dc43a1622edca3e7dde644b14b5acc5 upstream.

We handle NOTIFY_THROTTLING so don't then fall through to unsupported event.

---
 drivers/acpi/processor_driver.c |    1 +
 1 file changed, 1 insertion(+)

index e78c2a5..bd4e5dc 100644
@@ -409,6 +409,7 @@ static void acpi_processor_notify(struct acpi_device *device, u32 event)
 		acpi_bus_generate_proc_event(device, event, 0);
 		acpi_bus_generate_netlink_event(device->pnp.device_class,
 						  dev_name(&device->dev), event, 0);
+		break;
 	default:
 		ACPI_DEBUG_PRINT((ACPI_DB_INFO,
 				  "Unsupported event [0x%x]\n", event));

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tejun Heo <[email protected]>

commit fc4b514f2727f74a4587c31db87e0e93465518c3 upstream.

8852aac25e ("workqueue: mod_delayed_work_on() shouldn't queue timer on 0 delay") unexpectedly uncovered a very nasty abuse of delayed_work in megaraid - it allocated work_struct, casted it to delayed_work and then pass that into queue_delayed_work().

Previously, this was okay because 0 @delay short-circuited to queue_work() before doing anything with delayed_work. 8852aac25e moved 0 @delay test into __queue_delayed_work() after sanity check on delayed_work making megaraid trigger BUG_ON().

Although megaraid is already fixed by c1d390d8e6 ("megaraid: fix BUG_ON() from incorrect use of delayed work"), this patch converts BUG_ON()s in __queue_delayed_work() to WARN_ON_ONCE()s so that such abusers, if there are more, trigger warning but don't crash the machine.

[Shuah Khan: This change is back-ported from upstream change that
converted BUG_ON()s in __queue_delayed_work() to WARN_ON_ONCE()s.]
Tested on Stable Trees: 3.0.x, 3.4.x, 3.6.x

---
 kernel/workqueue.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -1146,8 +1146,8 @@ int queue_delayed_work_on(int cpu, struc
 	if (!test_and_set_bit(WORK_STRUCT_PENDING_BIT, work_data_bits(work))) {
 		unsigned int lcpu;
 
-		BUG_ON(timer_pending(timer));
-		BUG_ON(!list_empty(&work->entry));
+		WARN_ON_ONCE(timer_pending(timer));
+		WARN_ON_ONCE(!list_empty(&work->entry));
 
 		timer_stats_timer_set_start_info(&dwork->timer);
 

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jean Delvare <[email protected]>

commit fcc14ac1a86931f38da047cf8fb634c6db7b58bc upstream.

Document the new Atom series (Tunnel Creek and Medfield) as being supported, and list TjMax for the Atom E600 series.

Also enable the Atom tjmax heuristic for these Atom CPU models.

---
 Documentation/hwmon/coretemp |    8 +++++++-
 drivers/hwmon/coretemp.c     |    3 ++-
 2 files changed, 9 insertions(+), 2 deletions(-)

index 84d46c0..f6aed440 100644
@@ -6,7 +6,8 @@ Supported chips:
     Prefix: 'coretemp'
     CPUID: family 0x6, models 0xe (Pentium M DC), 0xf (Core 2 DC 65nm),
                               0x16 (Core 2 SC 65nm), 0x17 (Penryn 45nm),
-                              0x1a (Nehalem), 0x1c (Atom), 0x1e (Lynnfield)
+                              0x1a (Nehalem), 0x1c (Atom), 0x1e (Lynnfield),
+                              0x26 (Tunnel Creek Atom), 0x27 (Medfield Atom)
     Datasheet: Intel 64 and IA-32 Architectures Software Developer's Manual
                Volume 3A: System Programming Guide
                http://softwarecommunity.intel.com/Wiki/Mobility/720.htm

@@ -65,6 +66,9 @@ Process		Processor					TjMax(C)
 		U3400						105
 		P4505/P4500 					90
 
+32nm		Atom Processors
+		Z2460						90
+
 45nm		Xeon Processors 5400 Quad-Core
 		X5492, X5482, X5472, X5470, X5460, X5450	85
 		E5472, E5462, E5450/40/30/20/10/05		85

@@ -85,6 +89,8 @@ Process		Processor					TjMax(C)
 		N475/470/455/450				100
 		N280/270					90
 		330/230						125
+		E680/660/640/620				90
+		E680T/660T/640T/620T				110
 
 45nm		Core2 Processors
 		Solo ULV SU3500/3300				100

index b9d5123..495add5 100644
@@ -210,7 +210,8 @@ static int __cpuinit adjust_tjmax(struct cpuinfo_x86 *c, u32 id,
 
 	/* Atom CPUs */
 
-	if (c->x86_model == 0x1c) {
+	if (c->x86_model == 0x1c || c->x86_model == 0x26
+	    || c->x86_model == 0x27) {
 		usemsr_ee = 0;
 
 		host_bridge = pci_get_bus_and_slot(0, PCI_DEVFN(0, 0));

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Guenter Roeck <[email protected]>

commit 5592906f8b01282ea3c2acaf641fd067ad4bb3dc upstream.

Document the Atom series D2000 and N2000 (Cedar Trail) as being supported. List and set TjMax for those series.

---
 Documentation/hwmon/coretemp |    5 ++++-
 drivers/hwmon/coretemp.c     |    3 +++
 2 files changed, 7 insertions(+), 1 deletion(-)

index f6aed440..71d83d2 100644
@@ -7,7 +7,8 @@ Supported chips:
     CPUID: family 0x6, models 0xe (Pentium M DC), 0xf (Core 2 DC 65nm),
                               0x16 (Core 2 SC 65nm), 0x17 (Penryn 45nm),
                               0x1a (Nehalem), 0x1c (Atom), 0x1e (Lynnfield),
-                              0x26 (Tunnel Creek Atom), 0x27 (Medfield Atom)
+                              0x26 (Tunnel Creek Atom), 0x27 (Medfield Atom),
+                              0x36 (Cedar Trail Atom)
     Datasheet: Intel 64 and IA-32 Architectures Software Developer's Manual
                Volume 3A: System Programming Guide
                http://softwarecommunity.intel.com/Wiki/Mobility/720.htm

@@ -68,6 +69,8 @@ Process		Processor					TjMax(C)
 
 32nm		Atom Processors
 		Z2460						90
+		D2700/2550/2500					100
+		N2850/2800/2650/2600				100
 
 45nm		Xeon Processors 5400 Quad-Core
 		X5492, X5482, X5472, X5470, X5460, X5450	85

index 495add5..42c2f43 100644
@@ -224,6 +224,9 @@ static int __cpuinit adjust_tjmax(struct cpuinfo_x86 *c, u32 id,
 			tjmax = 90000;
 
 		pci_dev_put(host_bridge);
+	} else if (c->x86_model == 0x36) {
+		usemsr_ee = 0;
+		tjmax = 100000;
 	}
 
 	if (c->x86_model > 0xe && usemsr_ee) {

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Guenter Roeck <[email protected]>

commit 41e58a1f2b90c88d94b4bd84beb9927a4c2704e9 upstream.

Atom CPUs don't have a register to retrieve TjMax. Detection so far was incomplete. Use the X86 model ID to improve it.

---
 drivers/hwmon/coretemp.c |   25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

@@ -190,6 +190,24 @@ static ssize_t show_temp(struct device *
 	return tdata->valid ? sprintf(buf, "%d\n", tdata->temp) : -EAGAIN;
 }
 
+struct tjmax {
+	char const *id;
+	int tjmax;
+};
+
+static struct tjmax __cpuinitconst tjmax_table[] = {
+	{ "CPU D410", 100000 },
+	{ "CPU D425", 100000 },
+	{ "CPU D510", 100000 },
+	{ "CPU D525", 100000 },
+	{ "CPU N450", 100000 },
+	{ "CPU N455", 100000 },
+	{ "CPU N470", 100000 },
+	{ "CPU N475", 100000 },
+	{ "CPU  230", 100000 },
+	{ "CPU  330", 125000 },
+};
+
 static int adjust_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
 {
 	/* The 100C is default for both mobile and non mobile CPUs */

@@ -200,6 +218,13 @@ static int adjust_tjmax(struct cpuinfo_x
 	int err;
 	u32 eax, edx;
 	struct pci_dev *host_bridge;
+	int i;
+
+	/* explicit tjmax table entries override heuristics */
+	for (i = 0; i < ARRAY_SIZE(tjmax_table); i++) {
+		if (strstr(c->x86_model_id, tjmax_table[i].id))
+			return tjmax_table[i].tjmax;
+	}
 
 	/* Early chips have no MSR for TjMax */
 

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Guenter Roeck <[email protected]>

commit 1102dcab849313bd5a340b299b5cf61b518fbc0f upstream.

TjMax for the CE4100 series of Atom CPUs was previously reported to be 110 degrees C.

cpuinfo logs on the web show existing CPU types CE4110, CE4150, and CE4170, reported as "model name : Intel(R) Atom(TM) CPU CE41{1|5|7}0 @ 1.{2|6}0GHz" with model 28 (0x1c) and stepping 10 (0x0a). Add the three known variants to the tjmax table.

---
 Documentation/hwmon/coretemp |    1 +
 drivers/hwmon/coretemp.c     |    7 +++++--
 2 files changed, 6 insertions(+), 2 deletions(-)

@@ -94,6 +94,7 @@ Process		Processor					TjMax(C)
 		330/230						125
 		E680/660/640/620				90
 		E680T/660T/640T/620T				110
+		CE4170/4150/4110				110
 
 45nm		Core2 Processors
 		Solo ULV SU3500/3300				100

@@ -204,8 +204,11 @@ static struct tjmax __cpuinitconst tjmax
 	{ "CPU N455", 100000 },
 	{ "CPU N470", 100000 },
 	{ "CPU N475", 100000 },
-	{ "CPU  230", 100000 },
-	{ "CPU  330", 125000 },
+	{ "CPU  230", 100000 },		/* Model 0x1c, stepping 2	*/
+	{ "CPU  330", 125000 },		/* Model 0x1c, stepping 2	*/
+	{ "CPU CE4110", 110000 },	/* Model 0x1c, stepping 10	*/
+	{ "CPU CE4150", 110000 },	/* Model 0x1c, stepping 10	*/
+	{ "CPU CE4170", 110000 },	/* Model 0x1c, stepping 10	*/
 };
 
 static int adjust_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kees Cook <[email protected]>

commit 31fd84b95eb211d5db460a1dda85e004800a7b52 upstream.

The min/max call needed to have explicit types on some architectures (e.g. mn10300). Use clamp_t instead to avoid the warning:

kernel/sys.c: In function 'override_release':
kernel/sys.c:1287:10: warning: comparison of distinct pointer types lacks a cast [enabled by default]

---
 kernel/sys.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 01865c6..e6e0ece 100644
@@ -1284,7 +1284,7 @@ static int override_release(char __user *release, size_t len)
 			rest++;
 		}
 		v = ((LINUX_VERSION_CODE >> 8) & 0xff) + 40;
-		copy = min(sizeof(buf), max_t(size_t, 1, len));
+		copy = clamp_t(size_t, len, 1, sizeof(buf));
 		copy = scnprintf(buf, copy, "2.6.%u%s", v, rest);
 		ret = copy_to_user(release, buf, copy + 1);
 	}

[...]

[...]

Neither do I, but I'm including it now just to be consistent with other stable series.

Ben.

Ben Hutchings
It is easier to change the specification to fit the program than vice versa.

Thanks for explaining. That makes sense and the patch is harmless, so why not.

The patch still leaves me worried that there might be more problems lurking on mn10300, but that's more of a question for upstream.

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Paul Walmsley <[email protected]>

commit 39141ddfb63a664f26d3f42f64ee386e879b492c upstream.

After commit 846a136881b8f73c1f74250bf6acfaa309cab1f2 ("ARM: vfp: fix saving d16-d31 vfp registers on v6+ kernels"), the OMAP 2430SDP board started crashing during boot with omap2plus_defconfig:

[    3.875122] mmcblk0: mmc0:e624 SD04G 3.69 GiB
[    3.915954]  mmcblk0: p1
[    4.086639] Internal error: Oops - undefined instruction: 0 [#1] SMP ARM
[    4.093719] Modules linked in:
[    4.096954] CPU: 0    Not tainted  (3.6.0-02232-g759e00b #570)
[    4.103149] PC is at vfp_reload_hw+0x1c/0x44
[    4.107666] LR is at __und_usr_fault_32+0x0/0x8

It turns out that the context save/restore fix unmasked a latent bug in commit 5aaf254409f8d58229107b59507a8235b715a960 ("ARM: 6203/1: Make VFPv3 usable on ARMv6"). When CONFIG_VFPv3 is set, but the kernel is booted on a pre-VFPv3 core, the code attempts to save and restore the d16-d31 VFP registers. These are only present on non-D16 VFPv3+, so this results in an undefined instruction exception. The code didn't crash before commit 846a136 because the save and restore code was only touching d0-d15, present on all VFP.

Fix by implementing a request from Russell King to add a new HWCAP flag that affirmatively indicates the presence of the d16-d31 registers:

http://marc.info/?l=linux-arm-kernel&m=135013547905283&w=2

and some feedback from Måns to clarify the name of the HWCAP flag.

---

@@ -27,9 +27,9 @@
 #if __LINUX_ARM_ARCH__ <= 6
 	ldr	\tmp, =elf_hwcap		    @ may not have MVFR regs
 	ldr	\tmp, [\tmp, #0]
-	tst	\tmp, #HWCAP_VFPv3D16
-	ldceql	p11, cr0, [\base],#32*4		    @ FLDMIAD \base!, {d16-d31}
-	addne	\base, \base, #32*4		    @ step over unused register space
+	tst	\tmp, #HWCAP_VFPD32
+	ldcnel	p11, cr0, [\base],#32*4		    @ FLDMIAD \base!, {d16-d31}
+	addeq	\base, \base, #32*4		    @ step over unused register space
 #else
 	VFPFMRX	\tmp, MVFR0			    @ Media and VFP Feature Register 0
 	and	\tmp, \tmp, #MVFR0_A_SIMD_MASK	    @ A_SIMD field

@@ -51,9 +51,9 @@
 #if __LINUX_ARM_ARCH__ <= 6
 	ldr	\tmp, =elf_hwcap		    @ may not have MVFR regs
 	ldr	\tmp, [\tmp, #0]
-	tst	\tmp, #HWCAP_VFPv3D16
-	stceql	p11, cr0, [\base],#32*4		    @ FSTMIAD \base!, {d16-d31}
-	addne	\base, \base, #32*4		    @ step over unused register space
+	tst	\tmp, #HWCAP_VFPD32
+	stcnel	p11, cr0, [\base],#32*4		    @ FSTMIAD \base!, {d16-d31}
+	addeq	\base, \base, #32*4		    @ step over unused register space
 #else
 	VFPFMRX	\tmp, MVFR0			    @ Media and VFP Feature Register 0
 	and	\tmp, \tmp, #MVFR0_A_SIMD_MASK	    @ A_SIMD field

@@ -18,11 +18,12 @@
 #define HWCAP_THUMBEE	(1 << 11)
 #define HWCAP_NEON	(1 << 12)
 #define HWCAP_VFPv3	(1 << 13)
-#define HWCAP_VFPv3D16	(1 << 14)
+#define HWCAP_VFPv3D16	(1 << 14)	/* also set for VFPv4-D16 */
 #define HWCAP_TLS	(1 << 15)
 #define HWCAP_VFPv4	(1 << 16)
 #define HWCAP_IDIVA	(1 << 17)
 #define HWCAP_IDIVT	(1 << 18)
+#define HWCAP_VFPD32	(1 << 19)	/* set if VFP has 32 regs (not 16) */
 #define HWCAP_IDIV	(HWCAP_IDIVA | HWCAP_IDIVT)
 
 #if defined(__KERNEL__) && !defined(__ASSEMBLY__)

@@ -610,11 +610,14 @@ static int __init vfp_init(void)
 			elf_hwcap |= HWCAP_VFPv3;
 
 			/*
-			 * Check for VFPv3 D16. CPUs in this configuration
-			 * only have 16 x 64bit registers.
+			 * Check for VFPv3 D16 and VFPv4 D16.  CPUs in
+			 * this configuration only have 16 x 64bit
+			 * registers.
 			 */
 			if (((fmrx(MVFR0) & MVFR0_A_SIMD_MASK)) == 1)
-				elf_hwcap |= HWCAP_VFPv3D16;
+				elf_hwcap |= HWCAP_VFPv3D16; /* also v4-D16 */
+			else
+				elf_hwcap |= HWCAP_VFPD32;
 		}
 #endif
 		/*

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: David Milburn <[email protected]>

commit b03e66a6be91f8389fcd902ab6c1563db1c9c06b upstream.

If kdump is triggered with pending IO, controller may not respond causing kdump to fail.

http://marc.info/?l=linux-ide&m=133032255424658&w=2

During error recovery ata_do_dev_read_id never completes due hang in mmio_insw.

ata_do_dev_read_id
ata_sff_data_xfer
ioread16_rep
mmio_insw

if DMA start bit is cleared before reset, PIO command is successful and kdump succeeds.

---
 drivers/ata/sata_svw.c |   35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

index 44a4256..08608de 100644
@@ -142,6 +142,39 @@ static int k2_sata_scr_write(struct ata_link *link,
 	return 0;
 }
 
+static int k2_sata_softreset(struct ata_link *link,
+			     unsigned int *class, unsigned long deadline)
+{
+	u8 dmactl;
+	void __iomem *mmio = link->ap->ioaddr.bmdma_addr;
+
+	dmactl = readb(mmio + ATA_DMA_CMD);
+
+	/* Clear the start bit */
+	if (dmactl & ATA_DMA_START) {
+		dmactl &= ~ATA_DMA_START;
+		writeb(dmactl, mmio + ATA_DMA_CMD);
+	}
+
+	return ata_sff_softreset(link, class, deadline);
+}
+
+static int k2_sata_hardreset(struct ata_link *link,
+			     unsigned int *class, unsigned long deadline)
+{
+	u8 dmactl;
+	void __iomem *mmio = link->ap->ioaddr.bmdma_addr;
+
+	dmactl = readb(mmio + ATA_DMA_CMD);
+
+	/* Clear the start bit */
+	if (dmactl & ATA_DMA_START) {
+		dmactl &= ~ATA_DMA_START;
+		writeb(dmactl, mmio + ATA_DMA_CMD);
+	}
+
+	return sata_sff_hardreset(link, class, deadline);
+}
 
 static void k2_sata_tf_load(struct ata_port *ap, const struct ata_taskfile *tf)
 {

@@ -346,6 +379,8 @@ static struct scsi_host_template k2_sata_sht = {
 
 static struct ata_port_operations k2_sata_ops = {
 	.inherits		= &ata_bmdma_port_ops,
+	.softreset              = k2_sata_softreset,
+	.hardreset              = k2_sata_hardreset,
 	.sff_tf_load		= k2_sata_tf_load,
 	.sff_tf_read		= k2_sata_tf_read,
 	.sff_check_status	= k2_stat_check_status,

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Masanari Iida <[email protected]>

commit 3a2fd4a14112452eb5c1a079ac8b3f4842762afe upstream.

"reseting" -> "resetting"

---
 drivers/leds/leds-lp5521.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index d62a798..c42c8f0 100644
@@ -694,7 +694,7 @@ static int __devinit lp5521_probe(struct i2c_client *client,
 	 */
 	lp5521_read(client, LP5521_REG_R_CURRENT, &buf);
 	if (buf != LP5521_REG_R_CURR_DEFAULT) {
-		dev_err(&client->dev, "error in reseting chip\n");
+		dev_err(&client->dev, "error in resetting chip\n");
 		goto fail2;
 	}
 	usleep_range(10000, 20000);

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Srinidhi KASAGAR <[email protected]>

commit 42960b76d2c6a44d7e8000f4eb9a4ca1780059ff upstream.

Fix it by assigning the lp5521_read return value.

---
 drivers/leds/leds-lp5521.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index de7b8fe..410a723 100644
@@ -784,7 +784,7 @@ static int __devinit lp5521_probe(struct i2c_client *client,
 	 * otherwise further access to the R G B channels in the
 	 * LP5521_REG_ENABLE register will not have any effect - strange!
 	 */
-	lp5521_read(client, LP5521_REG_R_CURRENT, &buf);
+	ret = lp5521_read(client, LP5521_REG_R_CURRENT, &buf);
 	if (buf != LP5521_REG_R_CURR_DEFAULT) {
 		dev_err(&client->dev, "error in resetting chip\n");
 		goto fail2;

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <[email protected]>

commit 5bc9ad774c063f6b41965e7314f2c26aa5e465a0 upstream.

Gcc 4.6.2 complains that:

drivers/leds/leds-lp5521.c: In function `lp5521_load_program':
drivers/leds/leds-lp5521.c:214:21: warning: mode' may be used uninitialized in this function [-Wuninitialized] drivers/leds/leds-lp5521.c: In function lp5521_probe':
drivers/leds/leds-lp5521.c:788:5: warning: buf' may be used uninitialized in this function [-Wuninitialized] drivers/leds/leds-lp5521.c:740:6: warning: ret' may be used uninitialized in this function [-Wuninitialized]

These are real problems if lp5521_read() returns an error. When that happens we should handle it, instead of ignoring it or doing a bitwise OR with all the other error codes and continuing.

---
 drivers/leds/leds-lp5521.c |   12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

index 410a723..2381562 100644
@@ -193,9 +193,14 @@ static int lp5521_load_program(struct lp5521_engine *eng, const u8 *pattern)
 
 	/* move current engine to direct mode and remember the state */
 	ret = lp5521_set_engine_mode(eng, LP5521_CMD_DIRECT);
+	if (ret)
+		return ret;
+
 	/* Mode change requires min 500 us delay. 1 - 2 ms  with margin */
 	usleep_range(1000, 2000);
-	ret |= lp5521_read(client, LP5521_REG_OP_MODE, &mode);
+	ret = lp5521_read(client, LP5521_REG_OP_MODE, &mode);
+	if (ret)
+		return ret;
 
 	/* For loading, all the engines to load mode */
 	lp5521_write(client, LP5521_REG_OP_MODE, LP5521_CMD_DIRECT);

@@ -211,8 +216,7 @@ static int lp5521_load_program(struct lp5521_engine *eng, const u8 *pattern)
 				LP5521_PROG_MEM_SIZE,
 				pattern);
 
-	ret |= lp5521_write(client, LP5521_REG_OP_MODE, mode);
-	return ret;
+	return lp5521_write(client, LP5521_REG_OP_MODE, mode);
 }
 
 static int lp5521_set_led_current(struct lp5521_chip *chip, int led, u8 curr)

@@ -785,7 +789,7 @@ static int __devinit lp5521_probe(struct i2c_client *client,
 	 * LP5521_REG_ENABLE register will not have any effect - strange!
 	 */
 	ret = lp5521_read(client, LP5521_REG_R_CURRENT, &buf);
-	if (buf != LP5521_REG_R_CURR_DEFAULT) {
+	if (ret || buf != LP5521_REG_R_CURR_DEFAULT) {
 		dev_err(&client->dev, "error in resetting chip\n");
 		goto fail2;
 	}

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Krzysztof Wilczynski <[email protected]>

commit b631cf1f899f9d2e449884dbccc34940637c639f upstream.

This is to change use of "0x%08x" in favour of "%p" as per ../Documentation/printk-formats.txt, which also takes care about the following warning during compilation time:

drivers/scsi/aha152x.c: In function ‘get_command’:
drivers/scsi/aha152x.c:2987: warning: cast from pointer to integer of different size

---
 drivers/scsi/aha152x.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index 19a3694..dd4547b 100644
@@ -2984,8 +2984,8 @@ static int get_command(char *pos, Scsi_Cmnd * ptr)
 	char *start = pos;
 	int i;
 
-	SPRINTF("0x%08x: target=%d; lun=%d; cmnd=( ",
-		(unsigned int) ptr, ptr->device->id, ptr->device->lun);
+	SPRINTF("%p: target=%d; lun=%d; cmnd=( ",
+		ptr, ptr->device->id, ptr->device->lun);
 
 	for (i = 0; i < COMMAND_SIZE(ptr->cmnd[0]); i++)
 		SPRINTF("0x%02x ", ptr->cmnd[i]);

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Duncan Roe <[email protected]>

commit 7110005e8d5c3cd418fc4b64f9f124f004422a9a upstream.

---
 sound/pci/hda/patch_realtek.c |    1 +
 1 file changed, 1 insertion(+)

index 8568aee..7bec68c 100644
@@ -4245,6 +4245,7 @@ static void alc_auto_init_std(struct hda_codec *codec)
 	((spec)->beep_amp = HDA_COMPOSE_AMP_VAL(nid, 3, idx, dir))
 
 static const struct snd_pci_quirk beep_white_list[] = {
+	SND_PCI_QUIRK(0x1043, 0x103c, "ASUS", 1),
 	SND_PCI_QUIRK(0x1043, 0x829f, "ASUS", 1),
 	SND_PCI_QUIRK(0x1043, 0x83ce, "EeePC", 1),
 	SND_PCI_QUIRK(0x1043, 0x831a, "EeePC", 1),

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Eugeni Dodonov <[email protected]>

commit cc22a938fc1db0c8ef5e693a69b159c4b851dab3 upstream.

This adds PCI ID for IVB GT2 server variant which we were missing.

---
 drivers/char/agp/intel-agp.h    |    1 +
 drivers/char/agp/intel-gtt.c    |    2 ++
 drivers/gpu/drm/i915/i915_drv.c |    1 +
 3 files changed, 4 insertions(+)

index 5da67f1..7ea18a5 100644
@@ -234,6 +234,7 @@
 #define PCI_DEVICE_ID_INTEL_IVYBRIDGE_M_GT2_IG		0x0166
 #define PCI_DEVICE_ID_INTEL_IVYBRIDGE_S_HB		0x0158  /* Server */
 #define PCI_DEVICE_ID_INTEL_IVYBRIDGE_S_GT1_IG		0x015A
+#define PCI_DEVICE_ID_INTEL_IVYBRIDGE_S_GT2_IG		0x016A
 
 int intel_gmch_probe(struct pci_dev *pdev,
 			       struct agp_bridge_data *bridge);

index 5cf47ac..f493546 100644
@@ -1459,6 +1459,8 @@ static const struct intel_gtt_driver_description {
 	    "Ivybridge", &sandybridge_gtt_driver },
 	{ PCI_DEVICE_ID_INTEL_IVYBRIDGE_S_GT1_IG,
 	    "Ivybridge", &sandybridge_gtt_driver },
+	{ PCI_DEVICE_ID_INTEL_IVYBRIDGE_S_GT2_IG,
+	    "Ivybridge", &sandybridge_gtt_driver },
 	{ 0, NULL, NULL }
 };
 

index c7d689e..77afd31 100644
@@ -296,6 +296,7 @@ static const struct pci_device_id pciidlist[] = {		/* aka */
 	INTEL_VGA_DEVICE(0x0152, &intel_ivybridge_d_info), /* GT1 desktop */
 	INTEL_VGA_DEVICE(0x0162, &intel_ivybridge_d_info), /* GT2 desktop */
 	INTEL_VGA_DEVICE(0x015a, &intel_ivybridge_d_info), /* GT1 server */
+	INTEL_VGA_DEVICE(0x016a, &intel_ivybridge_d_info), /* GT2 server */
 	{0, 0, 0}
 };
 

As discussed at [1], this triggers a small regression with Debian wheezy userspace (X freezing instead of erroring out). libdrm hasn't been updated in wheezy since then, and I wouldn't be surprised if other distros were affected, too. Has there been a kernel patch since then to avoid that?

Though I wouldn't mind seeing this applied anyway, FWIW, as long as the announcement mentions the userspace bugfix needed.

Thanks,
Jonathan

[1] http://thread.gmane.org/gmane.linux.debian.devel.bugs.general/978320/focus=74843

Sorry, forgot we'd discussed this before. Thinking over this again, I'm not convinced that X freezing at startup is a significant regression from X failing to start. Either way, it's unusable unless you explicitly configure it to use vesa.

Ben.

Ben Hutchings
It is easier to change the specification to fit the program than vice versa.

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Dmitry Rogozhkin <[email protected]>

commit e79e0fe380847493266fba557217e2773c61bd1b upstream.

Subsequent threads returning EBUSY from vm_insert_pfn() was not handled correctly. As a result concurrent access from new threads to mmapped data caused SIGBUS.

Note that this fixes i-g-t/tests/gem_threaded_tiled_access.

---
 drivers/gpu/drm/i915/i915_gem.c |    5 +++++
 1 file changed, 5 insertions(+)

index 76bbb37..5fa3419 100644
@@ -1400,6 +1400,11 @@ out:
 	case 0:
 	case -ERESTARTSYS:
 	case -EINTR:
+	case -EBUSY:
+		/*
+		 * EBUSY is ok: this just means that another thread
+		 * already did the job.
+		 */
 		return VM_FAULT_NOPAGE;
 	case -ENOMEM:
 		return VM_FAULT_OOM;

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jean Delvare <[email protected]>

commit 7e06b7a3333f5c7a0cec12aff20d39c5c87c0795 upstream.

* Right-shift the values in GET_FBD_FAT_IDX and GET_FBD_NF_IDX, so that the callers get the result they expect.
* Fix definition of FERR_FAT_FBD_ERR_MASK.
* Call GET_FBD_NF_IDX, not GET_FBD_FAT_IDX, when operating on register FERR_NF_FBD. We were lucky they have the same definition.

This fixes kernel bug #44131:
https://bugzilla.kernel.org/show_bug.cgi?id=44131

---
 drivers/edac/i7300_edac.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

index a09d066..9d669cd 100644
@@ -197,8 +197,8 @@ static const char *ferr_fat_fbd_name[] = {
 	[0]  = "Memory Write error on non-redundant retry or "
 	       "FBD configuration Write error on retry",
 };
-#define GET_FBD_FAT_IDX(fbderr)	(fbderr & (3 << 28))
-#define FERR_FAT_FBD_ERR_MASK ((1 << 0) | (1 << 1) | (1 << 2) | (1 << 3))
+#define GET_FBD_FAT_IDX(fbderr)	(((fbderr) >> 28) & 3)
+#define FERR_FAT_FBD_ERR_MASK ((1 << 0) | (1 << 1) | (1 << 2) | (1 << 22))
 
 #define FERR_NF_FBD	0xa0
 static const char *ferr_nf_fbd_name[] = {

@@ -225,7 +225,7 @@ static const char *ferr_nf_fbd_name[] = {
 	[1]  = "Aliased Uncorrectable Non-Mirrored Demand Data ECC",
 	[0]  = "Uncorrectable Data ECC on Replay",
 };
-#define GET_FBD_NF_IDX(fbderr)	(fbderr & (3 << 28))
+#define GET_FBD_NF_IDX(fbderr)	(((fbderr) >> 28) & 3)
 #define FERR_NF_FBD_ERR_MASK ((1 << 24) | (1 << 23) | (1 << 22) | (1 << 21) |\
 			      (1 << 18) | (1 << 17) | (1 << 16) | (1 << 15) |\
 			      (1 << 14) | (1 << 13) | (1 << 11) | (1 << 10) |\

@@ -464,7 +464,7 @@ static void i7300_process_fbd_error(struct mem_ctl_info *mci)
 		errnum = find_first_bit(&errors,
 					ARRAY_SIZE(ferr_nf_fbd_name));
 		specific = GET_ERR_FROM_TABLE(ferr_nf_fbd_name, errnum);
-		branch = (GET_FBD_FAT_IDX(error_reg) == 2) ? 1 : 0;
+		branch = (GET_FBD_NF_IDX(error_reg) == 2) ? 1 : 0;
 
 		pci_read_config_dword(pvt->pci_dev_16_1_fsb_addr_map,
 			REDMEMA, &syndrome);

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mike Galbraith <[email protected]>

commit fd8ef11730f1d03d5d6555aa53126e9e34f52f12 upstream.

This reverts commit 800d4d30c8f20bd728e5741a3b77c4859a613f7c.

Between commits 8323f26ce342 ("sched: Fix race in task_group()") and 800d4d30c8f2 ("sched, autogroup: Stop going ahead if autogroup is disabled"), autogroup is a wreck.

With both applied, all you have to do to crash a box is disable autogroup during boot up, then reboot.. boom, NULL pointer dereference due to commit 800d4d30c8f2 not allowing autogroup to move things, and commit 8323f26ce342 making that the only way to switch runqueues:

  BUG: unable to handle kernel NULL pointer dereference at           (null)
  IP: [<ffffffff81063ac0>] effective_load.isra.43+0x50/0x90
  Pid: 7047, comm: systemd-user-se Not tainted 3.6.8-smp #7 MEDIONPC MS-7502/MS-7502
  RIP: effective_load.isra.43+0x50/0x90
  Process systemd-user-se (pid: 7047, threadinfo ffff880221dde000, task ffff88022618b3a0)
  Call Trace:
    select_task_rq_fair+0x255/0x780
    try_to_wake_up+0x156/0x2c0
    wake_up_state+0xb/0x10
    signal_wake_up+0x28/0x40
    complete_signal+0x1d6/0x250
    __send_signal+0x170/0x310
    send_signal+0x40/0x80
    do_send_sig_info+0x47/0x90
    group_send_sig_info+0x4a/0x70
    kill_pid_info+0x3a/0x60
    sys_kill+0x97/0x1a0
    ? vfs_read+0x120/0x160
    ? sys_read+0x45/0x90
    system_call_fastpath+0x16/0x1b
  Code: 49 0f af 41 50 31 d2 49 f7 f0 48 83 f8 01 48 0f 46 c6 48 2b 07 48 8b bf 40 01 00 00 48 85 ff 74 3a 45 31 c0 48 8b 8f 50 01 00 00 <48> 8b 11 4c 8b 89 80 00 00 00 49 89 d2 48 01 d0 45 8b 59 58 4c
  RIP  [<ffffffff81063ac0>] effective_load.isra.43+0x50/0x90
   RSP <ffff880221ddfbd8>
  CR2: 0000000000000000

---

@@ -160,15 +160,11 @@ autogroup_move_group(struct task_struct
 
 	p->signal->autogroup = autogroup_kref_get(ag);
 
-	if (!ACCESS_ONCE(sysctl_sched_autogroup_enabled))
-		goto out;
-
 	t = p;
 	do {
 		sched_move_task(t);
 	} while_each_thread(p, t);
 
-out:
 	unlock_task_sighand(p, &flags);
 	autogroup_kref_put(prev);
 }

@@ -1,11 +1,6 @@
 #ifdef CONFIG_SCHED_AUTOGROUP
 
 struct autogroup {
-	/*
-	 * reference doesn't mean how many thread attach to this
-	 * autogroup now. It just stands for the number of task
-	 * could use this autogroup.
-	 */
 	struct kref		kref;
 	struct task_group	*tg;
 	struct rw_semaphore	lock;

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chris Ball <[email protected]>

commit 6984f3c31bb57cb7491dbec1be44b74bd00f4648 upstream.

This reverts commit 8464dd52d3198dd05, which was a misapplied debugging version of the patch, not the final patch itself.

---
 drivers/mmc/host/sh_mmcif.c |    4 ----
 1 file changed, 4 deletions(-)

@@ -1003,10 +1003,6 @@ static irqreturn_t sh_mmcif_intr(int irq
 		host->sd_error = true;
 		dev_dbg(&host->pd->dev, "int err state = %08x\n", state);
 	}
-	if (host->state == STATE_IDLE) {
-		dev_info(&host->pd->dev, "Spurious IRQ status 0x%x", state);
-		return IRQ_HANDLED;
-	}
 	if (state & ~(INT_CMD12RBE | INT_CMD12CRE))
 		complete(&host->intr_wait);
 	else

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mel Gorman <[email protected]>

commit 18a2f371f5edf41810f6469cb9be39931ef9deb9 upstream.

This fixes a regression in 3.7-rc, which has since gone into stable.

Commit 00442ad04a5e ("mempolicy: fix a memory corruption by refcount imbalance in alloc_pages_vma()") changed get_vma_policy() to raise the refcount on a shmem shared mempolicy; whereas shmem_alloc_page() went on expecting alloc_page_vma() to drop the refcount it had acquired. This deserves a rework: but for now fix the leak in shmem_alloc_page().

Hugh: shmem_swapin() did not need a fix, but surely it's clearer to use the same refcounting there as in shmem_alloc_page(), delete its onstack mempolicy, and the strange mpol_cond_copy() and __mpol_cond_copy() - those were invented to let swapin_readahead() make an unknown number of calls to alloc_pages_vma() with one mempolicy; but since 00442ad04a5e, alloc_pages_vma() has kept refcount in balance, so now no problem.

---
 include/linux/mempolicy.h |   16 ----------------
 mm/mempolicy.c            |   22 ----------------------
 mm/shmem.c                |   26 ++++++++++++++++----------
 3 files changed, 16 insertions(+), 48 deletions(-)

@@ -137,16 +137,6 @@ static inline void mpol_cond_put(struct
 		__mpol_put(pol);
 }
 
-extern struct mempolicy *__mpol_cond_copy(struct mempolicy *tompol,
-					  struct mempolicy *frompol);
-static inline struct mempolicy *mpol_cond_copy(struct mempolicy *tompol,
-						struct mempolicy *frompol)
-{
-	if (!frompol)
-		return frompol;
-	return __mpol_cond_copy(tompol, frompol);
-}
-
 extern struct mempolicy *__mpol_dup(struct mempolicy *pol);
 static inline struct mempolicy *mpol_dup(struct mempolicy *pol)
 {

@@ -270,12 +260,6 @@ static inline void mpol_cond_put(struct
 {
 }
 
-static inline struct mempolicy *mpol_cond_copy(struct mempolicy *to,
-						struct mempolicy *from)
-{
-	return from;
-}
-
 static inline void mpol_get(struct mempolicy *pol)
 {
 }

@@ -1999,28 +1999,6 @@ struct mempolicy *__mpol_dup(struct memp
 	return new;
 }
 
-/*
- * If *frompol needs [has] an extra ref, copy *frompol to *tompol ,
- * eliminate the * MPOL_F_* flags that require conditional ref and
- * [NOTE!!!] drop the extra ref.  Not safe to reference *frompol directly
- * after return.  Use the returned value.
- *
- * Allows use of a mempolicy for, e.g., multiple allocations with a single
- * policy lookup, even if the policy needs/has extra ref on lookup.
- * shmem_readahead needs this.
- */
-struct mempolicy *__mpol_cond_copy(struct mempolicy *tompol,
-						struct mempolicy *frompol)
-{
-	if (!mpol_needs_cond_ref(frompol))
-		return frompol;
-
-	*tompol = *frompol;
-	tompol->flags &= ~MPOL_F_SHARED;	/* copy doesn't need unref */
-	__mpol_put(frompol);
-	return tompol;
-}
-
 /* Slow path of a mempolicy comparison */
 int __mpol_equal(struct mempolicy *a, struct mempolicy *b)
 {

@@ -798,24 +798,28 @@ static struct mempolicy *shmem_get_sbmpo
 static struct page *shmem_swapin(swp_entry_t swap, gfp_t gfp,
 			struct shmem_inode_info *info, pgoff_t index)
 {
-	struct mempolicy mpol, *spol;
 	struct vm_area_struct pvma;
-
-	spol = mpol_cond_copy(&mpol,
-			mpol_shared_policy_lookup(&info->policy, index));
+	struct page *page;
 
 	/* Create a pseudo vma that just contains the policy */
 	pvma.vm_start = 0;
 	pvma.vm_pgoff = index;
 	pvma.vm_ops = NULL;
-	pvma.vm_policy = spol;
-	return swapin_readahead(swap, gfp, &pvma, 0);
+	pvma.vm_policy = mpol_shared_policy_lookup(&info->policy, index);
+
+	page = swapin_readahead(swap, gfp, &pvma, 0);
+
+	/* Drop reference taken by mpol_shared_policy_lookup() */
+	mpol_cond_put(pvma.vm_policy);
+
+	return page;
 }
 
 static struct page *shmem_alloc_page(gfp_t gfp,
 			struct shmem_inode_info *info, pgoff_t index)
 {
 	struct vm_area_struct pvma;
+	struct page *page;
 
 	/* Create a pseudo vma that just contains the policy */
 	pvma.vm_start = 0;

@@ -823,10 +827,12 @@ static struct page *shmem_alloc_page(gfp
 	pvma.vm_ops = NULL;
 	pvma.vm_policy = mpol_shared_policy_lookup(&info->policy, index);
 
-	/*
-	 * alloc_page_vma() will drop the shared policy reference
-	 */
-	return alloc_page_vma(gfp, &pvma, 0);
+	page = alloc_page_vma(gfp, &pvma, 0);
+
+	/* Drop reference taken by mpol_shared_policy_lookup() */
+	mpol_cond_put(pvma.vm_policy);
+
+	return page;
 }
 #else /* !CONFIG_NUMA */
 #ifdef CONFIG_TMPFS

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Shuah Khan <[email protected]>

Fix wii_memory_fixups() the following compile error on 3.0.y tree with wii_defconfig on 3.0.y tree.

CC arch/powerpc/platforms/embedded6xx/wii.o
arch/powerpc/platforms/embedded6xx/wii.c: In function ‘wii_memory_fixups’:
arch/powerpc/platforms/embedded6xx/wii.c:88:2: error: format ‘%llx’ expects argument of type ‘long long unsigned int’, but argument 2 has type ‘phys_addr_t’ [-Werror=format] arch/powerpc/platforms/embedded6xx/wii.c:88:2: error: format ‘%llx’ expects argument of type ‘long long unsigned int’, but argument 3 has type ‘phys_addr_t’ [-Werror=format] arch/powerpc/platforms/embedded6xx/wii.c:90:2: error: format ‘%llx’ expects argument of type ‘long long unsigned int’, but argument 2 has type ‘phys_addr_t’ [-Werror=format] arch/powerpc/platforms/embedded6xx/wii.c:90:2: error: format ‘%llx’ expects argument of type ‘long long unsigned int’, but argument 3 has type ‘phys_addr_t’ [-Werror=format]
cc1: all warnings being treated as errors
make[2]: *** [arch/powerpc/platforms/embedded6xx/wii.o] Error 1
make[1]: *** [arch/powerpc/platforms/embedded6xx] Error 2
make: *** [arch/powerpc/platforms] Error 2

---
 arch/powerpc/platforms/embedded6xx/wii.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

index 1b5dc1a..daf793b 100644
@@ -85,9 +85,11 @@ void __init wii_memory_fixups(void)
 	wii_hole_start = p[0].base + p[0].size;
 	wii_hole_size = p[1].base - wii_hole_start;
 
-	pr_info("MEM1: <%08llx %08llx>\n", p[0].base, p[0].size);
+	pr_info("MEM1: <%08llx %08llx>\n",
+		(unsigned long long) p[0].base, (unsigned long long) p[0].size);
 	pr_info("HOLE: <%08lx %08lx>\n", wii_hole_start, wii_hole_size);
-	pr_info("MEM2: <%08llx %08llx>\n", p[1].base, p[1].size);
+	pr_info("MEM2: <%08llx %08llx>\n",
+		(unsigned long long) p[1].base, (unsigned long long) p[1].size);
 
 	p[0].size += wii_hole_size + p[1].size;
 

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Christian Borntraeger <[email protected]>

commit 87cac8f879a5ecd7109dbe688087e8810b3364eb upstream.

Newer kernels (linux-next with the transparent huge page patches) use rrbm if the feature is announced via feature bit 66. RRBM will cause intercepts, so KVM does not handle it right now, causing an illegal instruction in the guest.
The easy solution is to disable the feature bit for the guest.

This fixes bugs like:

Kernel BUG at 0000000000124c2a [verbose debug info unavailable]
illegal operation: 0001 [#1] SMP
Modules linked in: virtio_balloon virtio_net ipv6 autofs4
CPU: 0 Not tainted 3.5.4 #1
Process fmempig (pid: 659, task: 000000007b712fd0, ksp: 000000007bed3670)
Krnl PSW : 0704d00180000000 0000000000124c2a (pmdp_clear_flush_young+0x5e/0x80)
     R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 EA:3
     00000000003cc000 0000000000000004 0000000000000000 0000000079800000
     0000000000040000 0000000000000000 000000007bed3918 000000007cf40000
     0000000000000001 000003fff7f00000 000003d281a94000 000000007bed383c
     000000007bed3918 00000000005ecbf8 00000000002314a6 000000007bed36e0
 Krnl Code:>0000000000124c2a: b9810025          ogr     %r2,%r5
           0000000000124c2e: 41343000           la      %r3,0(%r4,%r3)
           0000000000124c32: a716fffa           brct    %r1,124c26
           0000000000124c36: b9010022           lngr    %r2,%r2
           0000000000124c3a: e3d0f0800004       lg      %r13,128(%r15)
           0000000000124c40: eb22003f000c       srlg    %r2,%r2,63
[ 2150.713198] Call Trace:
[ 2150.713223] ([<00000000002312c4>] page_referenced_one+0x6c/0x27c)
[ 2150.713749]  [<0000000000233812>] page_referenced+0x32a/0x410

[...]

---
 arch/s390/kvm/kvm-s390.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index ecced9d..38883f0 100644
@@ -997,7 +997,7 @@ static int __init kvm_s390_init(void)
 	}
 	memcpy(facilities, S390_lowcore.stfle_fac_list, 16);
 	facilities[0] &= 0xff00fff3f47c0000ULL;
-	facilities[1] &= 0x201c000000000000ULL;
+	facilities[1] &= 0x001c000000000000ULL;
 	return 0;
 }
 

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tejun Heo <[email protected]>

commit 5edee61edeaaebafe584f8fb7074c1ef4658596b upstream.

cgroup core has a bug which violates a basic rule about event notifications - when a new entity needs to be added, you add that to the notification list first and then make the new entity conform to the current state. If done in the reverse order, an event happening inbetween will be lost.

cgroup_subsys->fork() is invoked way before the new task is added to the css_set. Currently, cgroup_freezer is the only user of ->fork() and uses it to make new tasks conform to the current state of the freezer. If FROZEN state is requested while fork is in progress between cgroup_fork_callbacks() and cgroup_post_fork(), the child could escape freezing - the cgroup isn't frozen when ->fork() is called and the freezer couldn't see the new task on the css_set.

This patch moves cgroup_subsys->fork() invocation to cgroup_post_fork() after the new task is added to the css_set. cgroup_fork_callbacks() is removed.

Because now a task may be migrated during cgroup_subsys->fork(), freezer_fork() is updated so that it adheres to the usual RCU locking and the rather pointless comment on why locking can be different there is removed (if it doesn't make anything simpler, why even bother?).

[bwh: Backported to 3.2:
- Adjust context
- Iterate over first CGROUP_BUILTIN_SUBSYS_COUNT elements of subsys
- cgroup_subsys::fork takes cgroup_subsys pointer as first parameter]

---
 include/linux/cgroup.h  |    1 -
 kernel/cgroup.c         |   62 +++++++++++++++++++++++------------------------
 kernel/cgroup_freezer.c |   13 +++-------
 kernel/fork.c           |    9 +------
 4 files changed, 35 insertions(+), 50 deletions(-)

@@ -32,7 +32,6 @@ extern int cgroup_lock_is_held(void);
 extern bool cgroup_lock_live_group(struct cgroup *cgrp);
 extern void cgroup_unlock(void);
 extern void cgroup_fork(struct task_struct *p);
-extern void cgroup_fork_callbacks(struct task_struct *p);
 extern void cgroup_post_fork(struct task_struct *p);
 extern void cgroup_exit(struct task_struct *p, int run_callbacks);
 extern int cgroupstats_build(struct cgroupstats *stats,

@@ -197,23 +197,15 @@ static void freezer_fork(struct cgroup_s
 {
 	struct freezer *freezer;
 
-	/*
-	 * No lock is needed, since the task isn't on tasklist yet,
-	 * so it can't be moved to another cgroup, which means the
-	 * freezer won't be removed and will be valid during this
-	 * function call.  Nevertheless, apply RCU read-side critical
-	 * section to suppress RCU lockdep false positives.
-	 */
 	rcu_read_lock();
 	freezer = task_freezer(task);
-	rcu_read_unlock();
 
 	/*
 	 * The root cgroup is non-freezable, so we can skip the
 	 * following check.
 	 */
 	if (!freezer->css.cgroup->parent)
-		return;
+		goto out;
 
 	spin_lock_irq(&freezer->lock);
 	BUG_ON(freezer->state == CGROUP_FROZEN);

@@ -221,7 +213,10 @@ static void freezer_fork(struct cgroup_s
 	/* Locking avoids race with FREEZING -> THAWED transitions. */
 	if (freezer->state == CGROUP_FREEZING)
 		freeze_task(task, true);
+
 	spin_unlock_irq(&freezer->lock);
+out:
+	rcu_read_unlock();
 }
 
 /*

@@ -1057,7 +1057,6 @@ static struct task_struct *copy_process(
 {
 	int retval;
 	struct task_struct *p;
-	int cgroup_callbacks_done = 0;
 
 	if ((clone_flags & (CLONE_NEWNS|CLONE_FS)) == (CLONE_NEWNS|CLONE_FS))
 		return ERR_PTR(-EINVAL);

@@ -1312,12 +1311,6 @@ static struct task_struct *copy_process(
 	p->group_leader = p;
 	INIT_LIST_HEAD(&p->thread_group);
 
-	/* Now that the task is set up, run cgroup callbacks if
-	 * necessary. We need to run them before the task is visible
-	 * on the tasklist. */
-	cgroup_fork_callbacks(p);
-	cgroup_callbacks_done = 1;
-
 	/* Need tasklist lock for parent etc handling! */
 	write_lock_irq(&tasklist_lock);
 

@@ -1419,7 +1412,7 @@ bad_fork_cleanup_cgroup:
 #endif
 	if (clone_flags & CLONE_THREAD)
 		threadgroup_fork_read_unlock(current);
-	cgroup_exit(p, cgroup_callbacks_done);
+	cgroup_exit(p, 0);
 	delayacct_tsk_free(p);
 	module_put(task_thread_info(p)->exec_domain->module);
 bad_fork_cleanup_count:

Hi Ben,

At Fri, 28 Dec 2012 20:04:02 +0100,

I failed to compile 3.2.36-rc1 with my x86_64 box with enabling cgroup.

build log:
===============================================================================
...
CC kernel/cgroup.o
kernel/cgroup.c: In function ‘cgroup_post_fork’:
kernel/cgroup.c:4540:5: warning: passing argument 1 of ‘ss->fork’ from incompatible pointer type [enabled by default] kernel/cgroup.c:4540:5: note: expected ‘struct cgroup_subsys *’ but argument is of type ‘struct task_struct *’ kernel/cgroup.c:4540:5: error: too few arguments to function ‘ss->fork’
make[2]: *** [kernel/cgroup.o] Error 1
make[1]: *** [kernel] Error 2
make[1]: Leaving directory `/home/sat/src/linux-stable'
make: *** [debian/stamp/build/kernel] Error 2
===============================================================================

It comes from the ss->fork()'s API change introduced by commit 761b3ef50e1c2.

---
 include/linux/cgroup.h  |    1 -
 kernel/cgroup.c         |   62 +++++++++++++++++++++++------------------------
 kernel/cgroup_freezer.c |   13 +++-------
 kernel/fork.c           |    9 +------
 4 files changed, 35 insertions(+), 50 deletions(-)

@@ -32,7 +32,6 @@ extern int cgroup_lock_is_held(void);
 extern bool cgroup_lock_live_group(struct cgroup *cgrp);
 extern void cgroup_unlock(void);
 extern void cgroup_fork(struct task_struct *p);
-extern void cgroup_fork_callbacks(struct task_struct *p);
 extern void cgroup_post_fork(struct task_struct *p);
 extern void cgroup_exit(struct task_struct *p, int run_callbacks);
 extern int cgroupstats_build(struct cgroupstats *stats,

@@ -197,23 +197,15 @@ static void freezer_fork(struct cgroup_s
 {
 	struct freezer *freezer;
 
-	/*
-	 * No lock is needed, since the task isn't on tasklist yet,
-	 * so it can't be moved to another cgroup, which means the
-	 * freezer won't be removed and will be valid during this
-	 * function call.  Nevertheless, apply RCU read-side critical
-	 * section to suppress RCU lockdep false positives.
-	 */
 	rcu_read_lock();
 	freezer = task_freezer(task);
-	rcu_read_unlock();
 
 	/*
 	 * The root cgroup is non-freezable, so we can skip the
 	 * following check.
 	 */
 	if (!freezer->css.cgroup->parent)
-		return;
+		goto out;
 
 	spin_lock_irq(&freezer->lock);
 	BUG_ON(freezer->state == CGROUP_FROZEN);

@@ -221,7 +213,10 @@ static void freezer_fork(struct cgroup_s
 	/* Locking avoids race with FREEZING -> THAWED transitions. */
 	if (freezer->state == CGROUP_FREEZING)
 		freeze_task(task, true);
+
 	spin_unlock_irq(&freezer->lock);
+out:
+	rcu_read_unlock();
 }
 
 /*

@@ -1057,7 +1057,6 @@ static struct task_struct *copy_process(
 {
 	int retval;
 	struct task_struct *p;
-	int cgroup_callbacks_done = 0;
 
 	if ((clone_flags & (CLONE_NEWNS|CLONE_FS)) == (CLONE_NEWNS|CLONE_FS))
 		return ERR_PTR(-EINVAL);

@@ -1312,12 +1311,6 @@ static struct task_struct *copy_process(
 	p->group_leader = p;
 	INIT_LIST_HEAD(&p->thread_group);
 
-	/* Now that the task is set up, run cgroup callbacks if
-	 * necessary. We need to run them before the task is visible
-	 * on the tasklist. */
-	cgroup_fork_callbacks(p);
-	cgroup_callbacks_done = 1;
-
 	/* Need tasklist lock for parent etc handling! */
 	write_lock_irq(&tasklist_lock);
 

@@ -1419,7 +1412,7 @@ bad_fork_cleanup_cgroup:
 #endif
 	if (clone_flags & CLONE_THREAD)
 		threadgroup_fork_read_unlock(current);
-	cgroup_exit(p, cgroup_callbacks_done);
+	cgroup_exit(p, 0);
 	delayacct_tsk_free(p);
 	module_put(task_thread_info(p)->exec_domain->module);
 bad_fork_cleanup_count:

[...]

[...]

[...]

The correct version is in the combined patch, but I somehow missed refreshing this individual patch. Thanks for pointing this out.

Ben.

Ben Hutchings
It is easier to change the specification to fit the program than vice versa.

At Tue, 01 Jan 2013 14:20:56 +0000,
Ben Hutchings wrote:
...

Ah, I got your patches from your git tree instead of combined patch since I lost that patch's mail. Anyway, this kernel can be built and boot without any problem. Building a kernel with this kernel also works fine.

- Build Machine: debian wheezy x86_64
CPU: Intel(R) Core(TM) i5-2400 CPU @ 3.10GHz x 4
memory: 8GB

- Test machine: debian wheezy x86_64(KVM guest on the Build Machine)
vCPU: x2
memory: 2GB

I reviewed the following patches and it looks good to me.

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

Thanks,
Satoru

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tejun Heo <[email protected]>

commit dd67d32dbc5de299d70cc9e10c6c1e29ffa56b92 upstream.

A task is considered frozen enough between freezer_do_not_count() and freezer_count() and freezers use freezer_should_skip() to test this condition. This supposedly works because freezer_count() always calls try_to_freezer() after clearing %PF_FREEZER_SKIP.

However, there currently is nothing which guarantees that freezer_count() sees %true freezing() after clearing %PF_FREEZER_SKIP when freezing is in progress, and vice-versa. A task can escape the freezing condition in effect by freezer_count() seeing !freezing() and freezer_should_skip() seeing %PF_FREEZER_SKIP.

This patch adds smp_mb()'s to freezer_count() and freezer_should_skip() such that either %true freezing() is visible to freezer_count() or !PF_FREEZER_SKIP is visible to freezer_should_skip().

[bwh: Backported to 3.2:
- Adjust context and indentation
- freezer_do_not_count() and freezer_count() are no-ops for kernel tasks]

---
 include/linux/freezer.h |   50 +++++++++++++++++++++++++++++++++++++++--------
 1 file changed, 42 insertions(+), 8 deletions(-)

@@ -88,9 +88,16 @@ static inline int cgroup_freezing_or_fro
  * parent.
  */
 
-/*
- * If the current task is a user space one, tell the freezer not to count it as
- * freezable.
+/**
+ * freezer_do_not_count - tell freezer to ignore %current if a user space task
+ *
+ * Tell freezers to ignore the current task when determining whether the
+ * target frozen state is reached.  IOW, the current task will be
+ * considered frozen enough by freezers.
+ *
+ * The caller shouldn't do anything which isn't allowed for a frozen task
+ * until freezer_cont() is called.  Usually, freezer[_do_not]_count() pair
+ * wrap a scheduling operation and nothing much else.
  */
 static inline void freezer_do_not_count(void)
 {

@@ -98,24 +105,48 @@ static inline void freezer_do_not_count(
 		current->flags |= PF_FREEZER_SKIP;
 }
 
-/*
- * If the current task is a user space one, tell the freezer to count it as
- * freezable again and try to freeze it.
+/**
+ * freezer_count - tell freezer to stop ignoring %current if a user space task
+ *
+ * Undo freezer_do_not_count().  It tells freezers that %current should be
+ * considered again and tries to freeze if freezing condition is already in
+ * effect.
  */
 static inline void freezer_count(void)
 {
 	if (current->mm) {
 		current->flags &= ~PF_FREEZER_SKIP;
+		/*
+		 * If freezing is in progress, the following paired with smp_mb()
+		 * in freezer_should_skip() ensures that either we see %true
+		 * freezing() or freezer_should_skip() sees !PF_FREEZER_SKIP.
+		 */
+		smp_mb();
 		try_to_freeze();
 	}
 }
 
-/*
- * Check if the task should be counted as freezable by the freezer
+/**
+ * freezer_should_skip - whether to skip a task when determining frozen
+ *			 state is reached
+ * @p: task in quesion
+ *
+ * This function is used by freezers after establishing %true freezing() to
+ * test whether a task should be skipped when determining the target frozen
+ * state is reached.  IOW, if this function returns %true, @p is considered
+ * frozen enough.
  */
-static inline int freezer_should_skip(struct task_struct *p)
+static inline bool freezer_should_skip(struct task_struct *p)
 {
-	return !!(p->flags & PF_FREEZER_SKIP);
+	/*
+	 * The following smp_mb() paired with the one in freezer_count()
+	 * ensures that either freezer_count() sees %true freezing() or we
+	 * see cleared %PF_FREEZER_SKIP and return %false.  This makes it
+	 * impossible for a task to slip frozen state testing after
+	 * clearing %PF_FREEZER_SKIP.
+	 */
+	smp_mb();
+	return p->flags & PF_FREEZER_SKIP;
 }
 
 /*

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ben Hutchings <[email protected]>

This is extracted from Mel Gorman's commit 5a178119b0fb ('mm: add support for direct_IO to highmem pages') upstream.

Required to backport commit b9cdc88df8e6 ('virtio: 9p: correctly pass physical address to userspace for high pages').

---
 include/linux/highmem.h |    7 +++++++
 mm/highmem.c            |   12 ++++++++++++
 mm/page_io.c            |    3 ++-
 mm/swap.c               |    3 +--
 4 files changed, 22 insertions(+), 3 deletions(-)

@@ -38,10 +38,17 @@ extern unsigned long totalhigh_pages;
 
 void kmap_flush_unused(void);
 
+struct page *kmap_to_page(void *addr);
+
 #else /* CONFIG_HIGHMEM */
 
 static inline unsigned int nr_free_highpages(void) { return 0; }
 
+static inline struct page *kmap_to_page(void *addr)
+{
+	return virt_to_page(addr);
+}
+
 #define totalhigh_pages 0UL
 
 #ifndef ARCH_HAS_KMAP

@@ -94,6 +94,18 @@ static DECLARE_WAIT_QUEUE_HEAD(pkmap_map
 		do { spin_unlock(&kmap_lock); (void)(flags); } while (0)
 #endif
 
+struct page *kmap_to_page(void *vaddr)
+{
+	unsigned long addr = (unsigned long)vaddr;
+
+	if (addr >= PKMAP_ADDR(0) && addr <= PKMAP_ADDR(LAST_PKMAP)) {
+		int i = (addr - PKMAP_ADDR(0)) >> PAGE_SHIFT;
+		return pte_page(pkmap_page_table[i]);
+	}
+
+	return virt_to_page(addr);
+}
+
 static void flush_all_zero_pkmaps(void)
 {
 	int i;

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Will Deacon <[email protected]>

commit f0263d2d222e9e25f2587e51a9dc58c6fb2a9352 upstream.

Some virtio device drivers (9p) need to translate high virtual addresses to physical addresses, which are inserted into the virtqueue for processing by userspace.

This patch exports the kmap_to_page symbol, so that the affected drivers can be compiled as modules.

---
 mm/highmem.c |    1 +
 1 file changed, 1 insertion(+)

index d517cd1..2a07f97 100644
@@ -105,6 +105,7 @@ struct page *kmap_to_page(void *vaddr)
 
 	return virt_to_page(addr);
 }
+EXPORT_SYMBOL(kmap_to_page);
 
 static void flush_all_zero_pkmaps(void)
 {

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Will Deacon <[email protected]>

commit b9cdc88df8e63e81c723b82c286fc97f5d0dc325 upstream.

When using a virtio transport, the 9p net device may pass the physical address of a kernel buffer to userspace via a scatterlist inside a virtqueue. If the kernel buffer is mapped outside of the linear mapping (e.g. highmem), then virt_to_page will return a bogus value and we will populate the scatterlist with junk.

This patch uses kmap_to_page when populating the page array for a kernel buffer.

---
 net/9p/trans_virtio.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

index 35b8911..fd05c81 100644
@@ -39,6 +39,7 @@
 #include <linux/inet.h>
 #include <linux/idr.h>
 #include <linux/file.h>
+#include <linux/highmem.h>
 #include <linux/slab.h>
 #include <net/9p/9p.h>
 #include <linux/parser.h>

@@ -325,7 +326,7 @@ static int p9_get_mapped_pages(struct virtio_chan *chan,
 		int count = nr_pages;
 		while (nr_pages) {
 			s = rest_of_page(data);
-			pages[index++] = virt_to_page(data);
+			pages[index++] = kmap_to_page(data);
 			data += s;
 			nr_pages--;
 		}

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Will Deacon <[email protected]>

commit b92b1b89a33c172c075edccf6afb0edc41d851fd upstream.

Virtio devices may attempt to add descriptors to a virtqueue from atomic context using GFP_ATOMIC allocation. This is problematic because such allocations can fall outside of the lowmem mapping, causing virt_to_phys to report bogus physical addresses which are subsequently passed to userspace via the buffers for the virtual device.

This patch masks out __GFP_HIGH and __GFP_HIGHMEM from the requested flags when allocating descriptors for a virtqueue. If an atomic allocation is requested and later fails, we will return -ENOSPC which will be handled by the driver.

---
 drivers/virtio/virtio_ring.c |    7 +++++++
 1 file changed, 7 insertions(+)

index e639584..286c30c 100644
@@ -135,6 +135,13 @@ static int vring_add_indirect(struct vring_virtqueue *vq,
 	unsigned head;
 	int i;
 
+	/*
+	 * We require lowmem mappings for the descriptors because
+	 * otherwise virt_to_phys will give us bogus addresses in the
+	 * virtqueue.
+	 */
+	gfp &= ~(__GFP_HIGHMEM | __GFP_HIGH);
+
 	desc = kmalloc((out + in) * sizeof(struct vring_desc), gfp);
 	if (!desc)
 		return -ENOMEM;

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Rajkumar Manoharan <[email protected]>

commit 1680260226a8fd2aab590319da83ad8e610da9bd upstream.

This reduced the power consumption to half in full and network sleep.

[bwh: Backported to 3.2:
- INIT_INI_ARRAY macro requires an explicit size argument
- Remove the now-redundant macro PCIE_PLL_ON_CREQ_DIS_L1_2P0]

---
 drivers/net/wireless/ath/ath9k/ar9003_hw.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -34,9 +34,6 @@
  */
 static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
 {
-#define PCIE_PLL_ON_CREQ_DIS_L1_2P0 \
-		ar9462_pciephy_pll_on_clkreq_disable_L1_2p0
-
 #define AR9462_BB_CTX_COEFJ(x)	\
 		ar9462_##x##_baseband_core_txfir_coeff_japan_2484
 

@@ -369,13 +366,13 @@ static void ar9003_hw_init_mode_regs(str
 
 		/* Awake -> Sleep Setting */
 		INIT_INI_ARRAY(&ah->iniPcieSerdes,
-				PCIE_PLL_ON_CREQ_DIS_L1_2P0,
-				ARRAY_SIZE(PCIE_PLL_ON_CREQ_DIS_L1_2P0),
+				ar9462_pciephy_clkreq_disable_L1_2p0,
+				ARRAY_SIZE(ar9462_pciephy_clkreq_disable_L1_2p0),
 				2);
 		/* Sleep -> Awake Setting */
 		INIT_INI_ARRAY(&ah->iniPcieSerdesLowPower,
-				PCIE_PLL_ON_CREQ_DIS_L1_2P0,
-				ARRAY_SIZE(PCIE_PLL_ON_CREQ_DIS_L1_2P0),
+				ar9462_pciephy_clkreq_disable_L1_2p0,
+				ARRAY_SIZE(ar9462_pciephy_clkreq_disable_L1_2p0),
 				2);
 
 		/* Fast clock modal settings */

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alexander Graf <[email protected]>

commit e43a028752fed049e4bd94ef895542f96d79fa74 upstream.

When remembering the direction of a DCR transaction, we should write to the same variable that we interpret on later when doing vcpu_run again.

---
 arch/powerpc/kvm/44x_emulate.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -79,6 +79,7 @@ int kvmppc_core_emulate_op(struct kvm_ru
 				run->dcr.dcrn = dcrn;
 				run->dcr.data =  0;
 				run->dcr.is_write = 0;
+				vcpu->arch.dcr_is_write = 0;
 				vcpu->arch.io_gpr = rt;
 				vcpu->arch.dcr_needed = 1;
 				kvmppc_account_exit(vcpu, DCR_EXITS);

@@ -100,6 +101,7 @@ int kvmppc_core_emulate_op(struct kvm_ru
 				run->dcr.dcrn = dcrn;
 				run->dcr.data = kvmppc_get_gpr(vcpu, rs);
 				run->dcr.is_write = 1;
+				vcpu->arch.dcr_is_write = 1;
 				vcpu->arch.dcr_needed = 1;
 				kvmppc_account_exit(vcpu, DCR_EXITS);
 				emulated = EMULATE_DO_DCR;

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sebastian Andrzej Siewior <[email protected]>

commit e79cc615a9bb44da72c499ccfa2c9c4bbea3aa84 upstream.

I think this is wrong since 72c973dd ("usb: gadget: add usb_endpoint_descriptor to struct usb_ep"). If we fail to allocate an ep or bail out early we shouldn't check for the descriptor which is assigned at ep_enable() time.

---
 drivers/usb/gadget/f_ecm.c    |    4 ++--
 drivers/usb/gadget/f_eem.c    |    5 ++---
 drivers/usb/gadget/f_ncm.c    |    4 ++--
 drivers/usb/gadget/f_rndis.c  |    4 ++--
 drivers/usb/gadget/f_subset.c |    4 ++--
 5 files changed, 10 insertions(+), 11 deletions(-)

index 7892427..a158740 100644
@@ -809,9 +809,9 @@ fail:
 	/* we might as well release our claims on endpoints */
 	if (ecm->notify)
 		ecm->notify->driver_data = NULL;
-	if (ecm->port.out_ep->desc)
+	if (ecm->port.out_ep)
 		ecm->port.out_ep->driver_data = NULL;
-	if (ecm->port.in_ep->desc)
+	if (ecm->port.in_ep)
 		ecm->port.in_ep->driver_data = NULL;
 
 	ERROR(cdev, "%s: can't bind, err %d\n", f->name, status);

index 1a7b2dd..a9cf2052 100644
@@ -319,10 +319,9 @@ fail:
 	if (f->hs_descriptors)
 		usb_free_descriptors(f->hs_descriptors);
 
-	/* we might as well release our claims on endpoints */
-	if (eem->port.out_ep->desc)
+	if (eem->port.out_ep)
 		eem->port.out_ep->driver_data = NULL;
-	if (eem->port.in_ep->desc)
+	if (eem->port.in_ep)
 		eem->port.in_ep->driver_data = NULL;
 
 	ERROR(cdev, "%s: can't bind, err %d\n", f->name, status);

index 4f09500..424fc3d 100644
@@ -1259,9 +1259,9 @@ fail:
 	/* we might as well release our claims on endpoints */
 	if (ncm->notify)
 		ncm->notify->driver_data = NULL;
-	if (ncm->port.out_ep->desc)
+	if (ncm->port.out_ep)
 		ncm->port.out_ep->driver_data = NULL;
-	if (ncm->port.in_ep->desc)
+	if (ncm->port.in_ep)
 		ncm->port.in_ep->driver_data = NULL;
 
 	ERROR(cdev, "%s: can't bind, err %d\n", f->name, status);

index 61f4b13..7c27626 100644
@@ -803,9 +803,9 @@ fail:
 	/* we might as well release our claims on endpoints */
 	if (rndis->notify)
 		rndis->notify->driver_data = NULL;
-	if (rndis->port.out_ep->desc)
+	if (rndis->port.out_ep)
 		rndis->port.out_ep->driver_data = NULL;
-	if (rndis->port.in_ep->desc)
+	if (rndis->port.in_ep)
 		rndis->port.in_ep->driver_data = NULL;
 
 	ERROR(cdev, "%s: can't bind, err %d\n", f->name, status);

index 4060c0b..deb437c 100644
@@ -370,9 +370,9 @@ fail:
 		usb_free_descriptors(f->hs_descriptors);
 
 	/* we might as well release our claims on endpoints */
-	if (geth->port.out_ep->desc)
+	if (geth->port.out_ep)
 		geth->port.out_ep->driver_data = NULL;
-	if (geth->port.in_ep->desc)
+	if (geth->port.in_ep)
 		geth->port.in_ep->driver_data = NULL;
 
 	ERROR(cdev, "%s: can't bind, err %d\n", f->name, status);

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sebastian Andrzej Siewior <[email protected]>

commit d185039f7982eb82cf8d03b6fb6689587ca5af24 upstream.

The HS descriptors are only created if HS is supported by the UDC but we never free them.

---
 drivers/usb/gadget/f_midi.c |    1 +
 1 file changed, 1 insertion(+)

index b2522ba..b978c5d 100644
@@ -415,6 +415,7 @@ static void f_midi_unbind(struct usb_configuration *c, struct usb_function *f)
 	midi->id = NULL;
 
 	usb_free_descriptors(f->descriptors);
+	usb_free_descriptors(f->hs_descriptors);
 	kfree(midi);
 }
 

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sebastian Andrzej Siewior <[email protected]>

commit d0eca719dd11ad0619e8dd6a1f3eceb95b0216dd upstream.

---
 drivers/usb/gadget/f_phonet.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

index 8ee9268..a6c19a4 100644
@@ -531,7 +531,7 @@ int pn_bind(struct usb_configuration *c, struct usb_function *f)
 
 		req = usb_ep_alloc_request(fp->out_ep, GFP_KERNEL);
 		if (!req)
-			goto err;
+			goto err_req;
 
 		req->complete = pn_rx_complete;
 		fp->out_reqv[i] = req;

@@ -540,14 +540,18 @@ int pn_bind(struct usb_configuration *c, struct usb_function *f)
 	/* Outgoing USB requests */
 	fp->in_req = usb_ep_alloc_request(fp->in_ep, GFP_KERNEL);
 	if (!fp->in_req)
-		goto err;
+		goto err_req;
 
 	INFO(cdev, "USB CDC Phonet function\n");
 	INFO(cdev, "using %s, OUT %s, IN %s\n", cdev->gadget->name,
 		fp->out_ep->name, fp->in_ep->name);
 	return 0;
 
+err_req:
+	for (i = 0; i < phonet_rxq_size && fp->out_reqv[i]; i++)
+		usb_ep_free_request(fp->out_ep, fp->out_reqv[i]);
 err:
+
 	if (fp->out_ep)
 		fp->out_ep->driver_data = NULL;
 	if (fp->in_ep)

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sebastian Andrzej Siewior <[email protected]>

commit 0f9df939385527049c8062a099fbfa1479fe7ce0 upstream.

The "video->minor = -1" assigment is done in V4L2 by video_register_device() so it is removed here.
Now. uvc_function_bind() calls in error case uvc_function_unbind() for cleanup. The problem is that uvc_function_unbind() frees the uvc struct and uvc_bind_config() does as well in error case of usb_add_function(). Removing kfree() in usb_add_function() would make the patch smaller but it would look odd because the new allocated memory is not cleaned up. However it is not guaranteed that if we call usb_add_function() we also get to the bind function.
Therefore the patch extracts the conditional cleanup from uvc_function_unbind() applies to uvc_function_bind(). uvc_function_unbind() now contains only the complete cleanup which is required once everything has been registrated.

---
 drivers/usb/gadget/f_uvc.c |   39 +++++++++++++++++++++------------------
 1 file changed, 21 insertions(+), 18 deletions(-)

index 2a8bf06..10f13c1 100644
@@ -417,7 +417,6 @@ uvc_register_video(struct uvc_device *uvc)
 		return -ENOMEM;
 
 	video->parent = &cdev->gadget->dev;
-	video->minor = -1;
 	video->fops = &uvc_v4l2_fops;
 	video->release = video_device_release;
 	strncpy(video->name, cdev->gadget->name, sizeof(video->name));

@@ -577,23 +576,12 @@ uvc_function_unbind(struct usb_configuration *c, struct usb_function *f)
 
 	INFO(cdev, "uvc_function_unbind\n");
 
-	if (uvc->vdev) {
-		if (uvc->vdev->minor == -1)
-			video_device_release(uvc->vdev);
-		else
-			video_unregister_device(uvc->vdev);
-		uvc->vdev = NULL;
-	}
-
-	if (uvc->control_ep)
-		uvc->control_ep->driver_data = NULL;
-	if (uvc->video.ep)
-		uvc->video.ep->driver_data = NULL;
+	video_unregister_device(uvc->vdev);
+	uvc->control_ep->driver_data = NULL;
+	uvc->video.ep->driver_data = NULL;
 
-	if (uvc->control_req) {
-		usb_ep_free_request(cdev->gadget->ep0, uvc->control_req);
-		kfree(uvc->control_buf);
-	}
+	usb_ep_free_request(cdev->gadget->ep0, uvc->control_req);
+	kfree(uvc->control_buf);
 
 	kfree(f->descriptors);
 	kfree(f->hs_descriptors);

@@ -740,7 +728,22 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f)
 	return 0;
 
 error:
-	uvc_function_unbind(c, f);
+	if (uvc->vdev)
+		video_device_release(uvc->vdev);
+
+	if (uvc->control_ep)
+		uvc->control_ep->driver_data = NULL;
+	if (uvc->video.ep)
+		uvc->video.ep->driver_data = NULL;
+
+	if (uvc->control_req) {
+		usb_ep_free_request(cdev->gadget->ep0, uvc->control_req);
+		kfree(uvc->control_buf);
+	}
+
+	kfree(f->descriptors);
+	kfree(f->hs_descriptors);
+	kfree(f->ss_descriptors);
 	return ret;
 }
 

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jan Beulich <[email protected]>

commit 6acf5a8c931da9d26c8dd77d784daaf07fa2bff0 upstream.

HPET_TN_FSB is not a proper mask bit; it merely toggles between MSI and legacy interrupt delivery. The proper mask bit is HPET_TN_ENABLE, so use both bits when (un)masking the interrupt.

---
 arch/x86/kernel/hpet.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index 1460a5d..e28670f 100644
@@ -434,7 +434,7 @@ void hpet_msi_unmask(struct irq_data *data)
 
 	/* unmask it */
 	cfg = hpet_readl(HPET_Tn_CFG(hdev->num));
-	cfg |= HPET_TN_FSB;
+	cfg |= HPET_TN_ENABLE | HPET_TN_FSB;
 	hpet_writel(cfg, HPET_Tn_CFG(hdev->num));
 }
 

@@ -445,7 +445,7 @@ void hpet_msi_mask(struct irq_data *data)
 
 	/* mask it */
 	cfg = hpet_readl(HPET_Tn_CFG(hdev->num));
-	cfg &= ~HPET_TN_FSB;
+	cfg &= ~(HPET_TN_ENABLE | HPET_TN_FSB);
 	hpet_writel(cfg, HPET_Tn_CFG(hdev->num));
 }
 

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sergei Shtylyov <[email protected]>

commit 8b416b0b25d5d8ddb3a91c1d20e1373582c50405 upstream.

Now that DaVinci glue layer can be modular, we must export cppi_interrupt() that it may call...

---
 drivers/usb/musb/cppi_dma.c |    1 +
 1 file changed, 1 insertion(+)

@@ -1313,6 +1313,7 @@ irqreturn_t cppi_interrupt(int irq, void
 
 	return IRQ_HANDLED;
 }
+EXPORT_SYMBOL_GPL(cppi_interrupt);
 
 /* Instantiate a software object representing a DMA controller. */
 struct dma_controller *__init

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yanchuan Nian <[email protected]>

commit 3c40794b2dd0f355ef4e6bf8d85af5dcd7da7ece upstream.

The object type in the cache of lockowner_slab is wrong, and it is better to fix it.

---
 fs/nfsd/nfs4state.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 620ff81..fba2996 100644
@@ -2340,7 +2340,7 @@ nfsd4_init_slabs(void)
 	if (openowner_slab == NULL)
 		goto out_nomem;
 	lockowner_slab = kmem_cache_create("nfsd4_lockowners",
-			sizeof(struct nfs4_openowner), 0, 0, NULL);
+			sizeof(struct nfs4_lockowner), 0, 0, NULL);
 	if (lockowner_slab == NULL)
 		goto out_nomem;
 	file_slab = kmem_cache_create("nfsd4_files",

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Roland Dreier <[email protected]>

commit 1c5c12c666fda27c7c494b34934a0a0631a48130 upstream.

There are some cases, for example when the initiator sends an out-of-bounds ErrorRecoveryLevel value, where the iSCSI target terminates the connection without sending back any error. Audit the login path and add appropriate iscsit_tx_login_rsp() calls to make sure this doesn't happen.

---
 drivers/target/iscsi/iscsi_target_login.c |    8 ++++----
 drivers/target/iscsi/iscsi_target_nego.c  |   10 ++++++++--
 2 files changed, 12 insertions(+), 6 deletions(-)

@@ -130,13 +130,13 @@ int iscsi_check_for_session_reinstatemen
 
 	initiatorname_param = iscsi_find_param_from_key(
 			INITIATORNAME, conn->param_list);
-	if (!initiatorname_param)
-		return -1;
-
 	sessiontype_param = iscsi_find_param_from_key(
 			SESSIONTYPE, conn->param_list);
-	if (!sessiontype_param)
+	if (!initiatorname_param || !sessiontype_param) {
+		iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_INITIATOR_ERR,
+			ISCSI_LOGIN_STATUS_MISSING_FIELDS);
 		return -1;
+	}
 
 	sessiontype = (strncmp(sessiontype_param->value, NORMAL, 6)) ? 1 : 0;
 

@@ -632,8 +632,11 @@ static int iscsi_target_handle_csg_one(s
 			login->req_buf,
 			payload_length,
 			conn->param_list);
-	if (ret < 0)
+	if (ret < 0) {
+		iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_INITIATOR_ERR,
+				ISCSI_LOGIN_STATUS_INIT_ERR);
 		return -1;
+	}
 
 	if (login->first_request)
 		if (iscsi_target_check_first_request(conn, login) < 0)

@@ -648,8 +651,11 @@ static int iscsi_target_handle_csg_one(s
 			login->rsp_buf,
 			&login->rsp_length,
 			conn->param_list);
-	if (ret < 0)
+	if (ret < 0) {
+		iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_INITIATOR_ERR,
+				ISCSI_LOGIN_STATUS_INIT_ERR);
 		return -1;
+	}
 
 	if (!login->auth_complete &&
 	     ISCSI_TPG_ATTRIB(ISCSI_TPG_C(conn))->authentication) {

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Eugene Shatokhin <[email protected]>

commit 24ec19b0ae83a385ad9c55520716da671274b96c upstream.

In ext4_xattr_set_acl(), if ext4_journal_start() returns an error, posix_acl_release() will not be called for 'acl' which may result in a memory leak.

This patch fixes that.

---
 fs/ext4/acl.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

index d3c5b88..e6e0d98 100644
@@ -423,8 +423,10 @@ ext4_xattr_set_acl(struct dentry *dentry, const char *name, const void *value,
 
 retry:
 	handle = ext4_journal_start(inode, EXT4_DATA_TRANS_BLOCKS(inode->i_sb));
-	if (IS_ERR(handle))
-		return PTR_ERR(handle);
+	if (IS_ERR(handle)) {
+		error = PTR_ERR(handle);
+		goto release_and_out;
+	}
 	error = ext4_set_acl(handle, inode, type, acl);
 	ext4_journal_stop(handle);
 	if (error == -ENOSPC && ext4_should_retry_alloc(inode->i_sb, &retries))

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Will Deacon <[email protected]>

commit 864aa04cd02979c2c755cb28b5f4fe56039171c0 upstream.

When updating the page protection map after calculating the user_pgprot value, the base protection map is temporarily stored in an unsigned long type, causing truncation of the protection bits when LPAE is enabled. This effectively means that calls to mprotect() will corrupt the upper page attributes, clearing the XN bit unconditionally.

This patch uses pteval_t to store the intermediate protection values, preserving the upper bits for 64-bit descriptors.

---
 arch/arm/mm/mmu.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -475,7 +475,7 @@ static void __init build_mem_type_table(
 	}
 
 	for (i = 0; i < 16; i++) {
-		unsigned long v = pgprot_val(protection_map[i]);
+		pteval_t v = pgprot_val(protection_map[i]);
 		protection_map[i] = __pgprot(v | user_pgprot);
 	}
 

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alan Stern <[email protected]>

commit 36caff5d795429c572443894e8789c2150dd796b upstream.

This patch (as1631) fixes a bug that shows up when a config change fails for a device under an xHCI controller. The controller needs to be told to disable the endpoints that have been enabled for the new config. The existing code does this, but before storing the information about which endpoints were enabled! As a result, any second attempt to install the new config is doomed to fail because xhci-hcd will refuse to enable an endpoint that is already enabled.

The patch optimistically initializes the new endpoints' device structures before asking the device to switch to the new config. If the request fails then the endpoint information is already stored, so we can use usb_hcd_alloc_bandwidth() to disable the endpoints with no trouble. The rest of the error path is slightly more complex now; we have to disable the new interfaces and call put_device() rather than simply deallocating them.

---
 drivers/usb/core/message.c |   54 +++++++++++++++++++++++++-------------------
 1 file changed, 31 insertions(+), 23 deletions(-)

@@ -1770,28 +1770,8 @@ free_interfaces:
 		goto free_interfaces;
 	}
 
-	ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
-			      USB_REQ_SET_CONFIGURATION, 0, configuration, 0,
-			      NULL, 0, USB_CTRL_SET_TIMEOUT);
-	if (ret < 0) {
-		/* All the old state is gone, so what else can we do?
-		 * The device is probably useless now anyway.
-		 */
-		cp = NULL;
-	}
-
-	dev->actconfig = cp;
-	if (!cp) {
-		usb_set_device_state(dev, USB_STATE_ADDRESS);
-		usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL);
-		mutex_unlock(hcd->bandwidth_mutex);
-		usb_autosuspend_device(dev);
-		goto free_interfaces;
-	}
-	mutex_unlock(hcd->bandwidth_mutex);
-	usb_set_device_state(dev, USB_STATE_CONFIGURED);
-
-	/* Initialize the new interface structures and the
+	/*
+	 * Initialize the new interface structures and the
 	 * hc/hcd/usbcore interface/endpoint state.
 	 */
 	for (i = 0; i < nintf; ++i) {

@@ -1835,6 +1815,35 @@ free_interfaces:
 	}
 	kfree(new_interfaces);
 
+	ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
+			      USB_REQ_SET_CONFIGURATION, 0, configuration, 0,
+			      NULL, 0, USB_CTRL_SET_TIMEOUT);
+	if (ret < 0 && cp) {
+		/*
+		 * All the old state is gone, so what else can we do?
+		 * The device is probably useless now anyway.
+		 */
+		usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL);
+		for (i = 0; i < nintf; ++i) {
+			usb_disable_interface(dev, cp->interface[i], true);
+			put_device(&cp->interface[i]->dev);
+			cp->interface[i] = NULL;
+		}
+		cp = NULL;
+	}
+
+	dev->actconfig = cp;
+	mutex_unlock(hcd->bandwidth_mutex);
+
+	if (!cp) {
+		usb_set_device_state(dev, USB_STATE_ADDRESS);
+
+		/* Leave LPM disabled while the device is unconfigured. */
+		usb_autosuspend_device(dev);
+		return ret;
+	}
+	usb_set_device_state(dev, USB_STATE_CONFIGURED);
+
 	if (cp->string == NULL &&
 			!(dev->quirks & USB_QUIRK_CONFIG_INTF_STRINGS))
 		cp->string = usb_cache_string(dev, cp->desc.iConfiguration);

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alan Stern <[email protected]>

commit 2656a9abcf1ec8dd5fee6a75d6997a0f2fa0094e upstream.

This patch (as1632b) fixes a bug in ehci-hcd. The USB core uses urb->hcpriv to determine whether or not an URB is active; host controller drivers are supposed to set this pointer to a non-NULL value when an URB is queued. However ehci-hcd sets it to NULL for isochronous URBs, which defeats the check in usbcore.

In itself this isn't a big deal. But people have recently found that certain sequences of actions will cause the snd-usb-audio driver to reuse URBs without waiting for them to complete. In the absence of proper checking by usbcore, the URBs get added to their endpoint list twice. This leads to list corruption and a system freeze.

The patch makes ehci-hcd assign a meaningful value to urb->hcpriv for isochronous URBs. Improving robustness always helps.

[bwh: Backported to 3.2:
- Adjust context
- Also use usb_pipetype() to work out whether we should call qh_put()]

---
 drivers/usb/host/ehci-q.c     |   12 +++---------
 drivers/usb/host/ehci-sched.c |    4 ++--
 2 files changed, 5 insertions(+), 11 deletions(-)

@@ -264,18 +264,14 @@ ehci_urb_done(struct ehci_hcd *ehci, str
 __releases(ehci->lock)
 __acquires(ehci->lock)
 {
-	if (likely (urb->hcpriv != NULL)) {
-		struct ehci_qh	*qh = (struct ehci_qh *) urb->hcpriv;
-
-		/* S-mask in a QH means it's an interrupt urb */
-		if ((qh->hw->hw_info2 & cpu_to_hc32(ehci, QH_SMASK)) != 0) {
-
-			/* ... update hc-wide periodic stats (for usbfs) */
-			ehci_to_hcd(ehci)->self.bandwidth_int_reqs--;
-		}
-		qh_put (qh);
+	if (usb_pipetype(urb->pipe) == PIPE_INTERRUPT) {
+		/* ... update hc-wide periodic stats */
+		ehci_to_hcd(ehci)->self.bandwidth_int_reqs--;
 	}
 
+	if (usb_pipetype(urb->pipe) != PIPE_ISOCHRONOUS)
+		qh_put((struct ehci_qh *) urb->hcpriv);
+
 	if (unlikely(urb->unlinked)) {
 		COUNT(ehci->stats.unlink);
 	} else {

@@ -1684,7 +1684,7 @@ itd_link_urb (
 
 	/* don't need that schedule data any more */
 	iso_sched_free (stream, iso_sched);
-	urb->hcpriv = NULL;
+	urb->hcpriv = stream;
 
 	timer_action (ehci, TIMER_IO_WATCHDOG);
 	return enable_periodic(ehci);

@@ -2094,7 +2094,7 @@ sitd_link_urb (
 
 	/* don't need that schedule data any more */
 	iso_sched_free (stream, sched);
-	urb->hcpriv = NULL;
+	urb->hcpriv = stream;
 
 	timer_action (ehci, TIMER_IO_WATCHDOG);
 	return enable_periodic(ehci);

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Thomas Gleixner <[email protected]>

commit 04aa530ec04f61875b99c12721162e2964e3318c upstream.

Sankara reported that the genirq core code fails to adjust the affinity of an interrupt thread in several cases:

1) On request/setup_irq() the call to setup_affinity() happens before the new action is registered, so the new thread is not notified.

2) For secondary shared interrupts nothing notifies the new thread to change its affinity.

3) Interrupts which have the IRQ_NO_BALANCE flag set are not moving the thread either.

Fix this by setting the thread affinity flag right on thread creation time. This ensures that under all circumstances the thread moves to the right place. Requires a check in irq_thread_check_affinity for an existing affinity mask (CONFIG_CPU_MASK_OFFSTACK=y)

---
 kernel/irq/manage.c |   23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

index 1cbd572..35c70c9 100644
@@ -732,6 +732,7 @@ static void
 irq_thread_check_affinity(struct irq_desc *desc, struct irqaction *action)
 {
 	cpumask_var_t mask;
+	bool valid = true;
 
 	if (!test_and_clear_bit(IRQTF_AFFINITY, &action->thread_flags))
 		return;

@@ -746,10 +747,18 @@ irq_thread_check_affinity(struct irq_desc *desc, struct irqaction *action)
 	}
 
 	raw_spin_lock_irq(&desc->lock);
-	cpumask_copy(mask, desc->irq_data.affinity);
+	/*
+	 * This code is triggered unconditionally. Check the affinity
+	 * mask pointer. For CPU_MASK_OFFSTACK=n this is optimized out.
+	 */
+	if (desc->irq_data.affinity)
+		cpumask_copy(mask, desc->irq_data.affinity);
+	else
+		valid = false;
 	raw_spin_unlock_irq(&desc->lock);
 
-	set_cpus_allowed_ptr(current, mask);
+	if (valid)
+		set_cpus_allowed_ptr(current, mask);
 	free_cpumask_var(mask);
 }
 #else

@@ -954,6 +963,16 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
 		 */
 		get_task_struct(t);
 		new->thread = t;
+		/*
+		 * Tell the thread to set its affinity. This is
+		 * important for shared interrupt handlers as we do
+		 * not invoke setup_affinity() for the secondary
+		 * handlers as everything is already set up. Even for
+		 * interrupts marked with IRQF_NO_BALANCE this is
+		 * correct as we want the thread to move to the cpu(s)
+		 * on which the requesting code placed the interrupt.
+		 */
+		set_bit(IRQTF_AFFINITY, &new->thread_flags);
 	}
 
 	if (!alloc_cpumask_var(&mask, GFP_KERNEL)) {

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sarah Sharp <[email protected]>

commit 392a07ae3316f2b90b39ce41e66d6f6b5c95de90 upstream.

David reports that at drivers/usb/host/xhci.c:2257:

static bool xhci_is_sync_in_ep(unsigned int ep_type)

{
    return (ep_type == ISOC_IN_EP || ep_type != INT_IN_EP);
}

The static analyser cppcheck says

[linux-3.7-rc2/drivers/usb/host/xhci.c:2257]: (style) Redundant condition: If ep_type == 5, the comparison ep_type != 7 is always true.

Maybe the original programmer intention was something like

static bool xhci_is_sync_in_ep(unsigned int ep_type)

{
    return (ep_type == ISOC_IN_EP || ep_type == INT_IN_EP);
}

Fix this.

This patch should be backported to stable kernels as old as 3.2, that contain the commit 2b69899934c63b7b9432568584fb4c4a2924f40c "xhci: USB 3.0 BW checking."

---
 drivers/usb/host/xhci.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 1ca0f3a..2e29f2f 100644
@@ -2255,7 +2255,7 @@ static bool xhci_is_async_ep(unsigned int ep_type)
 
 static bool xhci_is_sync_in_ep(unsigned int ep_type)
 {
-	return (ep_type == ISOC_IN_EP || ep_type != INT_IN_EP);
+	return (ep_type == ISOC_IN_EP || ep_type == INT_IN_EP);
 }
 
 static unsigned int xhci_get_ss_bw_consumed(struct xhci_bw_info *ep_bw)

3.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sarah Sharp <[email protected]>

commit 4525c0a10dff7ad3669763c28016c7daffc3900e upstream.

The xHCI 1.0 specification made a change to the TD Size field in TRBs. The value is now the number of packets that remain to be sent in the TD, not including this TRB. The TD Size value for the last TRB in a TD must always be zero.

The xHCI function xhci_v1_0_td_remainder() attempts to calculate this, but it gets it wrong. First, it erroneously reuses the old xhci_td_remainder function, which will right shift the value by 10. The xHCI 1.0 spec as of June 2011 says nothing about right shifting by 10. Second, it does not set the TD size for the last TRB in a TD to zero.