--- /dev/null
+From abf9d005375d6c6160cc9c17e5dcac32e412c8dc Mon Sep 17 00:00:00 2001
+From: Gianluca Gennari <gennarone@gmail.com>
+Date: Tue, 6 Mar 2012 09:47:45 -0300
+Subject: [media] as102: add __packed attribute to structs defined inside packed structs
+
+From: Gianluca Gennari <gennarone@gmail.com>
+
+commit abf9d005375d6c6160cc9c17e5dcac32e412c8dc upstream.
+
+This patch fixes a regression in kernel 3.3 due to this patch:
+
+http://patchwork.linuxtv.org/patch/8332/
+
+That patch changes "#pragma pack(1)" with "__packed" attributes, but it is not
+complete. In fact, in the as102 driver there are a lot of structs/unions
+defined inside other structs/unions.
+When the "__packed" attribute is applied only on the external struct, it will
+not affect the internal struct definitions.
+So the regression is fixed by specifiying the "__packed" attribute also on the
+internal structs.
+
+This patch should go into 3.3, as it fixes a regression introduced in the new
+kernel version.
+
+Signed-off-by: Gianluca Gennari <gennarone@gmail.com>
+Signed-off-by: Ryley Angus <rangus@student.unimelb.edu.au>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/media/as102/as102_fw.h | 2
+ drivers/staging/media/as102/as10x_cmd.h | 80 +++++++++++++++---------------
+ drivers/staging/media/as102/as10x_types.h | 2
+ 3 files changed, 42 insertions(+), 42 deletions(-)
+
+--- a/drivers/staging/media/as102/as102_fw.h
++++ b/drivers/staging/media/as102/as102_fw.h
+@@ -29,7 +29,7 @@ struct as10x_fw_pkt_t {
+ union {
+ unsigned char request[2];
+ unsigned char length[2];
+- } u;
++ } __packed u;
+ struct as10x_raw_fw_pkt raw;
+ } __packed;
+
+--- a/drivers/staging/media/as102/as10x_cmd.h
++++ b/drivers/staging/media/as102/as10x_cmd.h
+@@ -99,14 +99,14 @@ union as10x_turn_on {
+ struct {
+ /* request identifier */
+ uint16_t proc_id;
+- } req;
++ } __packed req;
+ /* response */
+ struct {
+ /* response identifier */
+ uint16_t proc_id;
+ /* error */
+ uint8_t error;
+- } rsp;
++ } __packed rsp;
+ } __packed;
+
+ union as10x_turn_off {
+@@ -114,14 +114,14 @@ union as10x_turn_off {
+ struct {
+ /* request identifier */
+ uint16_t proc_id;
+- } req;
++ } __packed req;
+ /* response */
+ struct {
+ /* response identifier */
+ uint16_t proc_id;
+ /* error */
+ uint8_t err;
+- } rsp;
++ } __packed rsp;
+ } __packed;
+
+ union as10x_set_tune {
+@@ -131,14 +131,14 @@ union as10x_set_tune {
+ uint16_t proc_id;
+ /* tune params */
+ struct as10x_tune_args args;
+- } req;
++ } __packed req;
+ /* response */
+ struct {
+ /* response identifier */
+ uint16_t proc_id;
+ /* response error */
+ uint8_t error;
+- } rsp;
++ } __packed rsp;
+ } __packed;
+
+ union as10x_get_tune_status {
+@@ -146,7 +146,7 @@ union as10x_get_tune_status {
+ struct {
+ /* request identifier */
+ uint16_t proc_id;
+- } req;
++ } __packed req;
+ /* response */
+ struct {
+ /* response identifier */
+@@ -155,7 +155,7 @@ union as10x_get_tune_status {
+ uint8_t error;
+ /* tune status */
+ struct as10x_tune_status sts;
+- } rsp;
++ } __packed rsp;
+ } __packed;
+
+ union as10x_get_tps {
+@@ -163,7 +163,7 @@ union as10x_get_tps {
+ struct {
+ /* request identifier */
+ uint16_t proc_id;
+- } req;
++ } __packed req;
+ /* response */
+ struct {
+ /* response identifier */
+@@ -172,7 +172,7 @@ union as10x_get_tps {
+ uint8_t error;
+ /* tps details */
+ struct as10x_tps tps;
+- } rsp;
++ } __packed rsp;
+ } __packed;
+
+ union as10x_common {
+@@ -180,14 +180,14 @@ union as10x_common {
+ struct {
+ /* request identifier */
+ uint16_t proc_id;
+- } req;
++ } __packed req;
+ /* response */
+ struct {
+ /* response identifier */
+ uint16_t proc_id;
+ /* response error */
+ uint8_t error;
+- } rsp;
++ } __packed rsp;
+ } __packed;
+
+ union as10x_add_pid_filter {
+@@ -201,7 +201,7 @@ union as10x_add_pid_filter {
+ uint8_t stream_type;
+ /* PID index in filter table */
+ uint8_t idx;
+- } req;
++ } __packed req;
+ /* response */
+ struct {
+ /* response identifier */
+@@ -210,7 +210,7 @@ union as10x_add_pid_filter {
+ uint8_t error;
+ /* Filter id */
+ uint8_t filter_id;
+- } rsp;
++ } __packed rsp;
+ } __packed;
+
+ union as10x_del_pid_filter {
+@@ -220,14 +220,14 @@ union as10x_del_pid_filter {
+ uint16_t proc_id;
+ /* PID to remove */
+ uint16_t pid;
+- } req;
++ } __packed req;
+ /* response */
+ struct {
+ /* response identifier */
+ uint16_t proc_id;
+ /* response error */
+ uint8_t error;
+- } rsp;
++ } __packed rsp;
+ } __packed;
+
+ union as10x_start_streaming {
+@@ -235,14 +235,14 @@ union as10x_start_streaming {
+ struct {
+ /* request identifier */
+ uint16_t proc_id;
+- } req;
++ } __packed req;
+ /* response */
+ struct {
+ /* response identifier */
+ uint16_t proc_id;
+ /* error */
+ uint8_t error;
+- } rsp;
++ } __packed rsp;
+ } __packed;
+
+ union as10x_stop_streaming {
+@@ -250,14 +250,14 @@ union as10x_stop_streaming {
+ struct {
+ /* request identifier */
+ uint16_t proc_id;
+- } req;
++ } __packed req;
+ /* response */
+ struct {
+ /* response identifier */
+ uint16_t proc_id;
+ /* error */
+ uint8_t error;
+- } rsp;
++ } __packed rsp;
+ } __packed;
+
+ union as10x_get_demod_stats {
+@@ -265,7 +265,7 @@ union as10x_get_demod_stats {
+ struct {
+ /* request identifier */
+ uint16_t proc_id;
+- } req;
++ } __packed req;
+ /* response */
+ struct {
+ /* response identifier */
+@@ -274,7 +274,7 @@ union as10x_get_demod_stats {
+ uint8_t error;
+ /* demod stats */
+ struct as10x_demod_stats stats;
+- } rsp;
++ } __packed rsp;
+ } __packed;
+
+ union as10x_get_impulse_resp {
+@@ -282,7 +282,7 @@ union as10x_get_impulse_resp {
+ struct {
+ /* request identifier */
+ uint16_t proc_id;
+- } req;
++ } __packed req;
+ /* response */
+ struct {
+ /* response identifier */
+@@ -291,7 +291,7 @@ union as10x_get_impulse_resp {
+ uint8_t error;
+ /* impulse response ready */
+ uint8_t is_ready;
+- } rsp;
++ } __packed rsp;
+ } __packed;
+
+ union as10x_fw_context {
+@@ -305,7 +305,7 @@ union as10x_fw_context {
+ uint16_t tag;
+ /* context request type */
+ uint16_t type;
+- } req;
++ } __packed req;
+ /* response */
+ struct {
+ /* response identifier */
+@@ -316,7 +316,7 @@ union as10x_fw_context {
+ uint16_t type;
+ /* error */
+ uint8_t error;
+- } rsp;
++ } __packed rsp;
+ } __packed;
+
+ union as10x_set_register {
+@@ -328,14 +328,14 @@ union as10x_set_register {
+ struct as10x_register_addr reg_addr;
+ /* register content */
+ struct as10x_register_value reg_val;
+- } req;
++ } __packed req;
+ /* response */
+ struct {
+ /* response identifier */
+ uint16_t proc_id;
+ /* error */
+ uint8_t error;
+- } rsp;
++ } __packed rsp;
+ } __packed;
+
+ union as10x_get_register {
+@@ -345,7 +345,7 @@ union as10x_get_register {
+ uint16_t proc_id;
+ /* register description */
+ struct as10x_register_addr reg_addr;
+- } req;
++ } __packed req;
+ /* response */
+ struct {
+ /* response identifier */
+@@ -354,7 +354,7 @@ union as10x_get_register {
+ uint8_t error;
+ /* register content */
+ struct as10x_register_value reg_val;
+- } rsp;
++ } __packed rsp;
+ } __packed;
+
+ union as10x_cfg_change_mode {
+@@ -364,14 +364,14 @@ union as10x_cfg_change_mode {
+ uint16_t proc_id;
+ /* mode */
+ uint8_t mode;
+- } req;
++ } __packed req;
+ /* response */
+ struct {
+ /* response identifier */
+ uint16_t proc_id;
+ /* error */
+ uint8_t error;
+- } rsp;
++ } __packed rsp;
+ } __packed;
+
+ struct as10x_cmd_header_t {
+@@ -394,7 +394,7 @@ union as10x_dump_memory {
+ struct as10x_register_addr reg_addr;
+ /* nb blocks to read */
+ uint16_t num_blocks;
+- } req;
++ } __packed req;
+ /* response */
+ struct {
+ /* response identifier */
+@@ -408,8 +408,8 @@ union as10x_dump_memory {
+ uint8_t data8[DUMP_BLOCK_SIZE];
+ uint16_t data16[DUMP_BLOCK_SIZE / sizeof(uint16_t)];
+ uint32_t data32[DUMP_BLOCK_SIZE / sizeof(uint32_t)];
+- } u;
+- } rsp;
++ } __packed u;
++ } __packed rsp;
+ } __packed;
+
+ union as10x_dumplog_memory {
+@@ -418,7 +418,7 @@ union as10x_dumplog_memory {
+ uint16_t proc_id;
+ /* dump memory type request */
+ uint8_t dump_req;
+- } req;
++ } __packed req;
+ struct {
+ /* request identifier */
+ uint16_t proc_id;
+@@ -428,7 +428,7 @@ union as10x_dumplog_memory {
+ uint8_t dump_rsp;
+ /* dump data */
+ uint8_t data[DUMP_BLOCK_SIZE];
+- } rsp;
++ } __packed rsp;
+ } __packed;
+
+ union as10x_raw_data {
+@@ -437,14 +437,14 @@ union as10x_raw_data {
+ uint16_t proc_id;
+ uint8_t data[64 - sizeof(struct as10x_cmd_header_t)
+ - 2 /* proc_id */];
+- } req;
++ } __packed req;
+ /* response */
+ struct {
+ uint16_t proc_id;
+ uint8_t error;
+ uint8_t data[64 - sizeof(struct as10x_cmd_header_t)
+ - 2 /* proc_id */ - 1 /* rc */];
+- } rsp;
++ } __packed rsp;
+ } __packed;
+
+ struct as10x_cmd_t {
+@@ -469,7 +469,7 @@ struct as10x_cmd_t {
+ union as10x_dump_memory dump_memory;
+ union as10x_dumplog_memory dumplog_memory;
+ union as10x_raw_data raw_data;
+- } body;
++ } __packed body;
+ } __packed;
+
+ struct as10x_token_cmd_t {
+--- a/drivers/staging/media/as102/as10x_types.h
++++ b/drivers/staging/media/as102/as10x_types.h
+@@ -181,7 +181,7 @@ struct as10x_register_value {
+ uint8_t value8; /* 8 bit value */
+ uint16_t value16; /* 16 bit value */
+ uint32_t value32; /* 32 bit value */
+- } u;
++ } __packed u;
+ } __packed;
+
+ struct as10x_register_addr {
--- /dev/null
+From ef3d2dc366c8c32d58dbbf9898cfd4f853ff8fe0 Mon Sep 17 00:00:00 2001
+From: Michael Krufky <mkrufky@kernellabs.com>
+Date: Mon, 12 Mar 2012 17:07:22 -0300
+Subject: [media] au8522: bug-fix: enable modulation AFTER tune (instead of before tuning)
+
+From: Michael Krufky <mkrufky@kernellabs.com>
+
+commit ef3d2dc366c8c32d58dbbf9898cfd4f853ff8fe0 upstream.
+
+The au8522 driver programs the tuner after programming the demodulator,
+but the tuner should be programmed first. This patch fixes this behavior.
+
+EDIT: Apparantly Devin created a similar patch some time ago, but hasn't
+submitted it for merge. I never saw his patch, but I thank him anyhow
+for his efforts. In addition, Devin pointed out a flaw in my patch:
+
+This newly generated patch takes Devin's comments into account.
+
+Thanks-to: Devin Heitmueller <dheitmueller@kernellabs.com>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/dvb/frontends/au8522_dig.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/dvb/frontends/au8522_dig.c
++++ b/drivers/media/dvb/frontends/au8522_dig.c
+@@ -588,11 +588,6 @@ static int au8522_set_frontend(struct dv
+ (state->current_modulation == c->modulation))
+ return 0;
+
+- au8522_enable_modulation(fe, c->modulation);
+-
+- /* Allow the demod to settle */
+- msleep(100);
+-
+ if (fe->ops.tuner_ops.set_params) {
+ if (fe->ops.i2c_gate_ctrl)
+ fe->ops.i2c_gate_ctrl(fe, 1);
+@@ -604,6 +599,11 @@ static int au8522_set_frontend(struct dv
+ if (ret < 0)
+ return ret;
+
++ /* Allow the tuner to settle */
++ msleep(100);
++
++ au8522_enable_modulation(fe, c->modulation);
++
+ state->current_frequency = c->frequency;
+
+ return 0;
--- /dev/null
+From fc0900cbda9243957d812cd6b4cc87965f9fe75f Mon Sep 17 00:00:00 2001
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+Date: Fri, 23 Mar 2012 10:02:17 +0100
+Subject: hwmon: (fam15h_power) Correct sign extension of running_avg_capture
+
+From: Andreas Herrmann <andreas.herrmann3@amd.com>
+
+commit fc0900cbda9243957d812cd6b4cc87965f9fe75f upstream.
+
+Wrong bit was used for sign extension which caused wrong end results.
+Thanks to Andre for spotting this bug.
+
+Reported-by: Andre Przywara <andre.przywara@amd.com>
+Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
+Acked-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/fam15h_power.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/fam15h_power.c
++++ b/drivers/hwmon/fam15h_power.c
+@@ -60,7 +60,7 @@ static ssize_t show_power(struct device
+ pci_bus_read_config_dword(f4->bus, PCI_DEVFN(PCI_SLOT(f4->devfn), 5),
+ REG_TDP_RUNNING_AVERAGE, &val);
+ running_avg_capture = (val >> 4) & 0x3fffff;
+- running_avg_capture = sign_extend32(running_avg_capture, 22);
++ running_avg_capture = sign_extend32(running_avg_capture, 21);
+ running_avg_range = val & 0xf;
+
+ pci_bus_read_config_dword(f4->bus, PCI_DEVFN(PCI_SLOT(f4->devfn), 5),
--- /dev/null
+From cebd5fa4d3046d5b43ce1836a0120612822a7fb0 Mon Sep 17 00:00:00 2001
+From: Steffen Persvold <sp@numascale.com>
+Date: Thu, 15 Mar 2012 15:20:29 +0100
+Subject: iommu/amd: Fix section warning for prealloc_protection_domains
+
+From: Steffen Persvold <sp@numascale.com>
+
+commit cebd5fa4d3046d5b43ce1836a0120612822a7fb0 upstream.
+
+Fix the following section warning in drivers/iommu/amd_iommu.c :
+
+WARNING: vmlinux.o(.text+0x526e77): Section mismatch in reference from the function prealloc_protection_domains() to the function .init.text:alloc_passthrough_domain()
+The function prealloc_protection_domains() references
+the function __init alloc_passthrough_domain().
+This is often because prealloc_protection_domains lacks a __init
+annotation or the annotation of alloc_passthrough_domain is wrong.
+
+Signed-off-by: Steffen Persvold <sp@numascale.com>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/amd_iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -2804,7 +2804,7 @@ static int amd_iommu_dma_supported(struc
+ * we don't need to preallocate the protection domains anymore.
+ * For now we have to.
+ */
+-static void prealloc_protection_domains(void)
++static void __init prealloc_protection_domains(void)
+ {
+ struct iommu_dev_data *dev_data;
+ struct dma_ops_domain *dma_dom;
--- /dev/null
+From 9ddd592a191b32f2ee6c4b6ed2bd52665c3a49f5 Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <joerg.roedel@amd.com>
+Date: Thu, 15 Mar 2012 16:29:47 +0100
+Subject: iommu/amd: Make sure IOMMU interrupts are re-enabled on resume
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+commit 9ddd592a191b32f2ee6c4b6ed2bd52665c3a49f5 upstream.
+
+Unfortunatly the interrupts for the event log and the
+peripheral page-faults are only enabled at boot but not
+re-enabled at resume. Fix that.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/amd_iommu_init.c | 30 ++++++++++++++++++++----------
+ 1 file changed, 20 insertions(+), 10 deletions(-)
+
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -1131,8 +1131,9 @@ static int iommu_setup_msi(struct amd_io
+ {
+ int r;
+
+- if (pci_enable_msi(iommu->dev))
+- return 1;
++ r = pci_enable_msi(iommu->dev);
++ if (r)
++ return r;
+
+ r = request_threaded_irq(iommu->dev->irq,
+ amd_iommu_int_handler,
+@@ -1142,27 +1143,36 @@ static int iommu_setup_msi(struct amd_io
+
+ if (r) {
+ pci_disable_msi(iommu->dev);
+- return 1;
++ return r;
+ }
+
+ iommu->int_enabled = true;
+- iommu_feature_enable(iommu, CONTROL_EVT_INT_EN);
+-
+- if (iommu->ppr_log != NULL)
+- iommu_feature_enable(iommu, CONTROL_PPFINT_EN);
+
+ return 0;
+ }
+
+ static int iommu_init_msi(struct amd_iommu *iommu)
+ {
++ int ret;
++
+ if (iommu->int_enabled)
+- return 0;
++ goto enable_faults;
+
+ if (pci_find_capability(iommu->dev, PCI_CAP_ID_MSI))
+- return iommu_setup_msi(iommu);
++ ret = iommu_setup_msi(iommu);
++ else
++ ret = -ENODEV;
++
++ if (ret)
++ return ret;
+
+- return 1;
++enable_faults:
++ iommu_feature_enable(iommu, CONTROL_EVT_INT_EN);
++
++ if (iommu->ppr_log != NULL)
++ iommu_feature_enable(iommu, CONTROL_PPFINT_EN);
++
++ return 0;
+ }
+
+ /****************************************************************************
--- /dev/null
+From 34817174fca0c5512c2d5b6ea0fc37a0337ce1d8 Mon Sep 17 00:00:00 2001
+From: Xi Wang <xi.wang@gmail.com>
+Date: Tue, 14 Feb 2012 14:32:41 -0300
+Subject: [media] lgdt330x: fix signedness error in i2c_read_demod_bytes()
+
+From: Xi Wang <xi.wang@gmail.com>
+
+commit 34817174fca0c5512c2d5b6ea0fc37a0337ce1d8 upstream.
+
+The error handling in lgdt3303_read_status() and lgdt330x_read_ucblocks()
+doesn't work, because i2c_read_demod_bytes() returns a u8 and (err < 0)
+is always false.
+
+ err = i2c_read_demod_bytes(state, 0x58, buf, 1);
+ if (err < 0)
+ return err;
+
+Change the return type of i2c_read_demod_bytes() to int. Also change
+the return value on error to -EIO to make (err < 0) work.
+
+Signed-off-by: Xi Wang <xi.wang@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/dvb/frontends/lgdt330x.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/dvb/frontends/lgdt330x.c
++++ b/drivers/media/dvb/frontends/lgdt330x.c
+@@ -104,8 +104,8 @@ static int i2c_write_demod_bytes (struct
+ * then reads the data returned for (len) bytes.
+ */
+
+-static u8 i2c_read_demod_bytes (struct lgdt330x_state* state,
+- enum I2C_REG reg, u8* buf, int len)
++static int i2c_read_demod_bytes(struct lgdt330x_state *state,
++ enum I2C_REG reg, u8 *buf, int len)
+ {
+ u8 wr [] = { reg };
+ struct i2c_msg msg [] = {
+@@ -118,6 +118,8 @@ static u8 i2c_read_demod_bytes (struct l
+ ret = i2c_transfer(state->i2c, msg, 2);
+ if (ret != 2) {
+ printk(KERN_WARNING "lgdt330x: %s: addr 0x%02x select 0x%02x error (ret == %i)\n", __func__, state->config->demod_address, reg, ret);
++ if (ret >= 0)
++ ret = -EIO;
+ } else {
+ ret = 0;
+ }
--- /dev/null
+From 3be5bb71fbf18f83cb88b54a62a78e03e5a4f30a Mon Sep 17 00:00:00 2001
+From: Michael Krufky <mkrufky@linuxtv.org>
+Date: Sun, 18 Mar 2012 14:35:57 -0300
+Subject: [media] mxl111sf: fix error on stream stop in mxl111sf_ep6_streaming_ctrl()
+
+From: Michael Krufky <mkrufky@linuxtv.org>
+
+commit 3be5bb71fbf18f83cb88b54a62a78e03e5a4f30a upstream.
+
+Remove unnecessary register access in mxl111sf_ep6_streaming_ctrl()
+
+This code breaks driver operation in kernel 3.3 and later, although
+it works properly in 3.2 Disable register access to 0x12 for now.
+
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/dvb/dvb-usb/mxl111sf.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/dvb/dvb-usb/mxl111sf.c
++++ b/drivers/media/dvb/dvb-usb/mxl111sf.c
+@@ -351,15 +351,13 @@ static int mxl111sf_ep6_streaming_ctrl(s
+ adap_state->ep6_clockphase,
+ 0, 0);
+ mxl_fail(ret);
++#if 0
+ } else {
+ ret = mxl111sf_disable_656_port(state);
+ mxl_fail(ret);
++#endif
+ }
+
+- mxl111sf_read_reg(state, 0x12, &tmp);
+- tmp &= ~0x04;
+- mxl111sf_write_reg(state, 0x12, tmp);
+-
+ return ret;
+ }
+
--- /dev/null
+From 1b26c9b334044cff6d1d2698f2be41bc7d9a0864 Mon Sep 17 00:00:00 2001
+From: Pravin B Shelar <pshelar@nicira.com>
+Date: Fri, 23 Mar 2012 15:02:55 -0700
+Subject: proc-ns: use d_set_d_op() API to set dentry ops in proc_ns_instantiate().
+
+From: Pravin B Shelar <pshelar@nicira.com>
+
+commit 1b26c9b334044cff6d1d2698f2be41bc7d9a0864 upstream.
+
+The namespace cleanup path leaks a dentry which holds a reference count
+on a network namespace. Keeping that network namespace from being freed
+when the last user goes away. Leaving things like vlan devices in the
+leaked network namespace.
+
+If you use ip netns add for much real work this problem becomes apparent
+pretty quickly. It light testing the problem hides because frequently
+you simply don't notice the leak.
+
+Use d_set_d_op() so that DCACHE_OP_* flags are set correctly.
+
+This issue exists back to 3.0.
+
+Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Reported-by: Justin Pettit <jpettit@nicira.com>
+Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
+Signed-off-by: Jesse Gross <jesse@nicira.com>
+Cc: David Miller <davem@davemloft.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/proc/namespaces.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/proc/namespaces.c
++++ b/fs/proc/namespaces.c
+@@ -53,7 +53,7 @@ static struct dentry *proc_ns_instantiat
+ ei->ns_ops = ns_ops;
+ ei->ns = ns;
+
+- dentry->d_op = &pid_dentry_operations;
++ d_set_d_op(dentry, &pid_dentry_operations);
+ d_add(dentry, inode);
+ /* Close the race of the process dying before we return the dentry */
+ if (pid_revalidate(dentry, NULL))
--- /dev/null
+From 9ab2393fc3e460cd2040de1483918eb17abb822f Mon Sep 17 00:00:00 2001
+From: Michael Krufky <mkrufky@linuxtv.org>
+Date: Tue, 7 Feb 2012 13:28:33 -0300
+Subject: [media] pvrusb2: fix 7MHz & 8MHz DVB-T tuner support for HVR1900 rev D1F5
+
+From: Michael Krufky <mkrufky@linuxtv.org>
+
+commit 9ab2393fc3e460cd2040de1483918eb17abb822f upstream.
+
+The D1F5 revision of the WinTV HVR-1900 uses a tda18271c2 tuner
+instead of a tda18271c1 tuner as used in revision D1E9. To
+account for this, we must hardcode the frontend configuration
+to use the same IF frequency configuration for both revisions
+of the device.
+
+6MHz DVB-T is unaffected by this issue, as the recommended
+IF Frequency configuration for 6MHz DVB-T is the same on both
+c1 and c2 revisions of the tda18271 tuner.
+
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Cc: Mike Isely <isely@pobox.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/video/pvrusb2/pvrusb2-devattr.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/media/video/pvrusb2/pvrusb2-devattr.c
++++ b/drivers/media/video/pvrusb2/pvrusb2-devattr.c
+@@ -320,7 +320,17 @@ static struct tda829x_config tda829x_no_
+ .probe_tuner = TDA829X_DONT_PROBE,
+ };
+
++static struct tda18271_std_map hauppauge_tda18271_dvbt_std_map = {
++ .dvbt_6 = { .if_freq = 3300, .agc_mode = 3, .std = 4,
++ .if_lvl = 1, .rfagc_top = 0x37, },
++ .dvbt_7 = { .if_freq = 3800, .agc_mode = 3, .std = 5,
++ .if_lvl = 1, .rfagc_top = 0x37, },
++ .dvbt_8 = { .if_freq = 4300, .agc_mode = 3, .std = 6,
++ .if_lvl = 1, .rfagc_top = 0x37, },
++};
++
+ static struct tda18271_config hauppauge_tda18271_dvb_config = {
++ .std_map = &hauppauge_tda18271_dvbt_std_map,
+ .gate = TDA18271_GATE_ANALOG,
+ .output_opt = TDA18271_OUTPUT_LT_OFF,
+ };
sunrpc-we-must-not-use-list_for_each_entry_safe-in-rpc_wake_up.patch
usbnet-increase-urb-reference-count-before-usb_unlink_urb.patch
usbnet-don-t-clear-urb-dev-in-tx_complete.patch
+x86-32-fix-typo-for-mq_getsetattr-in-syscall-table.patch
+x86-32-fix-endless-loop-when-processing-signals-for-kernel-tasks.patch
+proc-ns-use-d_set_d_op-api-to-set-dentry-ops-in-proc_ns_instantiate.patch
+iommu-amd-fix-section-warning-for-prealloc_protection_domains.patch
+iommu-amd-make-sure-iommu-interrupts-are-re-enabled-on-resume.patch
+sysctl-protect-poll-in-entries-that-may-go-away.patch
+hwmon-fam15h_power-correct-sign-extension-of-running_avg_capture.patch
+lgdt330x-fix-signedness-error-in-i2c_read_demod_bytes.patch
+as102-add-__packed-attribute-to-structs-defined-inside-packed-structs.patch
+tda10071-fix-the-delivery-system.patch
+au8522-bug-fix-enable-modulation-after-tune-instead-of-before-tuning.patch
+pvrusb2-fix-7mhz-8mhz-dvb-t-tuner-support-for-hvr1900-rev-d1f5.patch
+mxl111sf-fix-error-on-stream-stop-in-mxl111sf_ep6_streaming_ctrl.patch
--- /dev/null
+From 4e474a00d7ff746ed177ddae14fa8b2d4bad7a00 Mon Sep 17 00:00:00 2001
+From: Lucas De Marchi <lucas.demarchi@profusion.mobi>
+Date: Thu, 22 Mar 2012 14:42:22 -0700
+Subject: sysctl: protect poll() in entries that may go away
+
+From: Lucas De Marchi <lucas.demarchi@profusion.mobi>
+
+commit 4e474a00d7ff746ed177ddae14fa8b2d4bad7a00 upstream.
+
+Protect code accessing ctl_table by grabbing the header with grab_header()
+and after releasing with sysctl_head_finish(). This is needed if poll()
+is called in entries created by modules: currently only hostname and
+domainname support poll(), but this bug may be triggered when/if modules
+use it and if user called poll() in a file that doesn't support it.
+
+Dave Jones reported the following when using a syscall fuzzer while
+hibernating/resuming:
+
+RIP: 0010:[<ffffffff81233e3e>] [<ffffffff81233e3e>] proc_sys_poll+0x4e/0x90
+RAX: 0000000000000145 RBX: ffff88020cab6940 RCX: 0000000000000000
+RDX: ffffffff81233df0 RSI: 6b6b6b6b6b6b6b6b RDI: ffff88020cab6940
+[ ... ]
+Code: 00 48 89 fb 48 89 f1 48 8b 40 30 4c 8b 60 e8 b8 45 01 00 00 49 83
+7c 24 28 00 74 2e 49 8b 74 24 30 48 85 f6 74 24 48 85 c9 75 32 <8b> 16
+b8 45 01 00 00 48 63 d2 49 39 d5 74 10 8b 06 48 98 48 89
+
+If an entry goes away while we are polling() it, ctl_table may not exist
+anymore.
+
+Reported-by: Dave Jones <davej@redhat.com>
+Signed-off-by: Lucas De Marchi <lucas.demarchi@profusion.mobi>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/proc/proc_sysctl.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+--- a/fs/proc/proc_sysctl.c
++++ b/fs/proc/proc_sysctl.c
+@@ -188,20 +188,32 @@ static ssize_t proc_sys_write(struct fil
+
+ static int proc_sys_open(struct inode *inode, struct file *filp)
+ {
++ struct ctl_table_header *head = grab_header(inode);
+ struct ctl_table *table = PROC_I(inode)->sysctl_entry;
+
++ /* sysctl was unregistered */
++ if (IS_ERR(head))
++ return PTR_ERR(head);
++
+ if (table->poll)
+ filp->private_data = proc_sys_poll_event(table->poll);
+
++ sysctl_head_finish(head);
++
+ return 0;
+ }
+
+ static unsigned int proc_sys_poll(struct file *filp, poll_table *wait)
+ {
+ struct inode *inode = filp->f_path.dentry->d_inode;
++ struct ctl_table_header *head = grab_header(inode);
+ struct ctl_table *table = PROC_I(inode)->sysctl_entry;
+- unsigned long event = (unsigned long)filp->private_data;
+ unsigned int ret = DEFAULT_POLLMASK;
++ unsigned long event;
++
++ /* sysctl was unregistered */
++ if (IS_ERR(head))
++ return POLLERR | POLLHUP;
+
+ if (!table->proc_handler)
+ goto out;
+@@ -209,6 +221,7 @@ static unsigned int proc_sys_poll(struct
+ if (!table->poll)
+ goto out;
+
++ event = (unsigned long)filp->private_data;
+ poll_wait(filp, &table->poll->wait, wait);
+
+ if (event != atomic_read(&table->poll->event)) {
+@@ -217,6 +230,8 @@ static unsigned int proc_sys_poll(struct
+ }
+
+ out:
++ sysctl_head_finish(head);
++
+ return ret;
+ }
+
--- /dev/null
+From 2b49fad59513b07f976c9711b99f93ae74d081c5 Mon Sep 17 00:00:00 2001
+From: Antti Palosaari <crope@iki.fi>
+Date: Mon, 12 Mar 2012 18:21:20 -0300
+Subject: [media] tda10071: fix the delivery system
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Antti Palosaari <crope@iki.fi>
+
+commit 2b49fad59513b07f976c9711b99f93ae74d081c5 upstream.
+
+Commit b2a29b578d9c21b2e5c88020f830d3c42115c51d sets accidentally
+supported delivery systems as DVB-T/T2 whilst it should be
+DVB-S/S2. Due to that frontend cannot be used at all.
+
+Reported-by: Jiří Zelenka <klacek@bubakov.net>
+Signed-off-by: Antti Palosaari <crope@iki.fi>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/dvb/frontends/tda10071.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/dvb/frontends/tda10071.c
++++ b/drivers/media/dvb/frontends/tda10071.c
+@@ -1215,7 +1215,7 @@ error:
+ EXPORT_SYMBOL(tda10071_attach);
+
+ static struct dvb_frontend_ops tda10071_ops = {
+- .delsys = { SYS_DVBT, SYS_DVBT2 },
++ .delsys = { SYS_DVBS, SYS_DVBS2 },
+ .info = {
+ .name = "NXP TDA10071",
+ .frequency_min = 950000,
--- /dev/null
+From 29a2e2836ff9ea65a603c89df217f4198973a74f Mon Sep 17 00:00:00 2001
+From: Dmitry Adamushko <dmitry.adamushko@gmail.com>
+Date: Thu, 22 Mar 2012 21:39:25 +0100
+Subject: x86-32: Fix endless loop when processing signals for kernel tasks
+
+From: Dmitry Adamushko <dmitry.adamushko@gmail.com>
+
+commit 29a2e2836ff9ea65a603c89df217f4198973a74f upstream.
+
+The problem occurs on !CONFIG_VM86 kernels [1] when a kernel-mode task
+returns from a system call with a pending signal.
+
+A real-life scenario is a child of 'khelper' returning from a failed
+kernel_execve() in ____call_usermodehelper() [ kernel/kmod.c ].
+kernel_execve() fails due to a pending SIGKILL, which is the result of
+"kill -9 -1" (at least, busybox's init does it upon reboot).
+
+The loop is as follows:
+
+* syscall_exit_work:
+ - work_pending: // start_of_the_loop
+ - work_notify_sig:
+ - do_notify_resume()
+ - do_signal()
+ - if (!user_mode(regs)) return;
+ - resume_userspace // TIF_SIGPENDING is still set
+ - work_pending // so we call work_pending => goto
+ // start_of_the_loop
+
+More information can be found in another LKML thread:
+http://www.serverphorums.com/read.php?12,457826
+
+[1] the problem was also seen on MIPS.
+
+Signed-off-by: Dmitry Adamushko <dmitry.adamushko@gmail.com>
+Link: http://lkml.kernel.org/r/1332448765.2299.68.camel@dimm
+Cc: Oleg Nesterov <oleg@redhat.com>
+Cc: Roland McGrath <roland@hack.frob.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/entry_32.S | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+--- a/arch/x86/kernel/entry_32.S
++++ b/arch/x86/kernel/entry_32.S
+@@ -98,12 +98,6 @@
+ #endif
+ .endm
+
+-#ifdef CONFIG_VM86
+-#define resume_userspace_sig check_userspace
+-#else
+-#define resume_userspace_sig resume_userspace
+-#endif
+-
+ /*
+ * User gs save/restore
+ *
+@@ -327,10 +321,19 @@ ret_from_exception:
+ preempt_stop(CLBR_ANY)
+ ret_from_intr:
+ GET_THREAD_INFO(%ebp)
+-check_userspace:
++resume_userspace_sig:
++#ifdef CONFIG_VM86
+ movl PT_EFLAGS(%esp), %eax # mix EFLAGS and CS
+ movb PT_CS(%esp), %al
+ andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
++#else
++ /*
++ * We can be coming here from a syscall done in the kernel space,
++ * e.g. a failed kernel_execve().
++ */
++ movl PT_CS(%esp), %eax
++ andl $SEGMENT_RPL_MASK, %eax
++#endif
+ cmpl $USER_RPL, %eax
+ jb resume_kernel # not returning to v8086 or userspace
+
--- /dev/null
+From 13354dc412c36fe554f9904a92f1268c74af7e87 Mon Sep 17 00:00:00 2001
+From: Thierry Reding <thierry.reding@avionic-design.de>
+Date: Wed, 21 Mar 2012 22:50:08 +0100
+Subject: x86-32: Fix typo for mq_getsetattr in syscall table
+
+From: Thierry Reding <thierry.reding@avionic-design.de>
+
+commit 13354dc412c36fe554f9904a92f1268c74af7e87 upstream.
+
+Syscall 282 was mistakenly named mq_getsetaddr instead of mq_getsetattr.
+When building uClibc against the Linux kernel this would result in a
+shared library that doesn't provide the mq_getattr() and mq_setattr()
+functions.
+
+Signed-off-by: Thierry Reding <thierry.reding@avionic-design.de>
+Link: http://lkml.kernel.org/r/1332366608-2695-2-git-send-email-thierry.reding@avionic-design.de
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/syscalls/syscall_32.tbl | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/syscalls/syscall_32.tbl
++++ b/arch/x86/syscalls/syscall_32.tbl
+@@ -288,7 +288,7 @@
+ 279 i386 mq_timedsend sys_mq_timedsend compat_sys_mq_timedsend
+ 280 i386 mq_timedreceive sys_mq_timedreceive compat_sys_mq_timedreceive
+ 281 i386 mq_notify sys_mq_notify compat_sys_mq_notify
+-282 i386 mq_getsetaddr sys_mq_getsetattr compat_sys_mq_getsetattr
++282 i386 mq_getsetattr sys_mq_getsetattr compat_sys_mq_getsetattr
+ 283 i386 kexec_load sys_kexec_load compat_sys_kexec_load
+ 284 i386 waitid sys_waitid compat_sys_waitid
+ # 285 sys_setaltroot
projects / thirdparty / kernel / stable-queue.git / commitdiff
