--- /dev/null
+From a134d228298c6aa9007205c6b81cae0cac0acb5d Mon Sep 17 00:00:00 2001
+From: Chris Metcalf <cmetcalf@tilera.com>
+Date: Wed, 16 May 2012 14:54:20 -0400
+Subject: arch/tile: apply commit 74fca9da0 to the compat signal handling as well
+
+From: Chris Metcalf <cmetcalf@tilera.com>
+
+commit a134d228298c6aa9007205c6b81cae0cac0acb5d upstream.
+
+This passes siginfo and mcontext to tilegx32 signal handlers that
+don't have SA_SIGINFO set just as we have been doing for tilegx64.
+
+Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/tile/kernel/compat_signal.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+--- a/arch/tile/kernel/compat_signal.c
++++ b/arch/tile/kernel/compat_signal.c
+@@ -403,19 +403,17 @@ int compat_setup_rt_frame(int sig, struc
+ * Set up registers for signal handler.
+ * Registers that we don't modify keep the value they had from
+ * user-space at the time we took the signal.
++ * We always pass siginfo and mcontext, regardless of SA_SIGINFO,
++ * since some things rely on this (e.g. glibc's debug/segfault.c).
+ */
+ regs->pc = ptr_to_compat_reg(ka->sa.sa_handler);
+ regs->ex1 = PL_ICS_EX1(USER_PL, 1); /* set crit sec in handler */
+ regs->sp = ptr_to_compat_reg(frame);
+ regs->lr = restorer;
+ regs->regs[0] = (unsigned long) usig;
+-
+- if (ka->sa.sa_flags & SA_SIGINFO) {
+- /* Need extra arguments, so mark to restore caller-saves. */
+- regs->regs[1] = ptr_to_compat_reg(&frame->info);
+- regs->regs[2] = ptr_to_compat_reg(&frame->uc);
+- regs->flags |= PT_FLAGS_CALLER_SAVES;
+- }
++ regs->regs[1] = ptr_to_compat_reg(&frame->info);
++ regs->regs[2] = ptr_to_compat_reg(&frame->uc);
++ regs->flags |= PT_FLAGS_CALLER_SAVES;
+
+ /*
+ * Notify any tracer that was single-stepping it.
--- /dev/null
+From 998de4acb2ba188d20768d1065658377a2e7d29b Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Fri, 11 May 2012 17:42:37 +0100
+Subject: ARM: 7417/1: vfp: ensure preemption is disabled when enabling VFP access
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit 998de4acb2ba188d20768d1065658377a2e7d29b upstream.
+
+The vfp_enable function enables access to the VFP co-processor register
+space (cp10 and cp11) on the current CPU and must be called with
+preemption disabled. Unfortunately, the vfp_init late initcall does not
+disable preemption and can lead to an oops during boot if thread
+migration occurs at the wrong time and we end up attempting to access
+the FPSID on a CPU with VFP access disabled.
+
+This patch fixes the initcall to call vfp_enable from a non-preemptible
+context on each CPU and adds a BUG_ON(preemptible) to ensure that any
+similar problems are easily spotted in the future.
+
+Reported-by: Hyungwoo Yang <hwoo.yang@gmail.com>
+Signed-off-by: Hyungwoo Yang <hyungwooy@nvidia.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/vfp/vfpmodule.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/vfp/vfpmodule.c
++++ b/arch/arm/vfp/vfpmodule.c
+@@ -11,6 +11,7 @@
+ #include <linux/types.h>
+ #include <linux/cpu.h>
+ #include <linux/cpu_pm.h>
++#include <linux/hardirq.h>
+ #include <linux/kernel.h>
+ #include <linux/notifier.h>
+ #include <linux/signal.h>
+@@ -428,7 +429,10 @@ void VFP_bounce(u32 trigger, u32 fpexc,
+
+ static void vfp_enable(void *unused)
+ {
+- u32 access = get_copro_access();
++ u32 access;
++
++ BUG_ON(preemptible());
++ access = get_copro_access();
+
+ /*
+ * Enable full access to VFP (cp10 and cp11)
+@@ -556,7 +560,7 @@ static int __init vfp_init(void)
+ unsigned int cpu_arch = cpu_architecture();
+
+ if (cpu_arch >= CPU_ARCH_ARMv6)
+- vfp_enable(NULL);
++ on_each_cpu(vfp_enable, NULL, 1);
+
+ /*
+ * First check that there is a VFP that we can use.
+@@ -577,8 +581,6 @@ static int __init vfp_init(void)
+ } else {
+ hotcpu_notifier(vfp_hotplug, 0);
+
+- smp_call_function(vfp_enable, NULL, 1);
+-
+ VFP_arch = (vfpsid & FPSID_ARCH_MASK) >> FPSID_ARCH_BIT; /* Extract the architecture version */
+ printk("implementor %02x architecture %d part %02x variant %x rev %x\n",
+ (vfpsid & FPSID_IMPLEMENTER_MASK) >> FPSID_IMPLEMENTER_BIT,
--- /dev/null
+From 9b61a4d1b2064dbd0c9e61754305ac852170509f Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Wed, 16 May 2012 15:19:20 +0100
+Subject: ARM: prevent VM_GROWSDOWN mmaps extending below FIRST_USER_ADDRESS
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit 9b61a4d1b2064dbd0c9e61754305ac852170509f upstream.
+
+Reported-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mm/fault.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/mm/fault.c
++++ b/arch/arm/mm/fault.c
+@@ -245,7 +245,9 @@ good_area:
+ return handle_mm_fault(mm, vma, addr & PAGE_MASK, flags);
+
+ check_stack:
+- if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr))
++ /* Don't allow expansion below FIRST_USER_ADDRESS */
++ if (vma->vm_flags & VM_GROWSDOWN &&
++ addr >= FIRST_USER_ADDRESS && !expand_stack(vma, addr))
+ goto good_area;
+ out:
+ return fault;
--- /dev/null
+From 5807c3bf68eb489032ca8ff70b3d3c833fd8172b Mon Sep 17 00:00:00 2001
+From: Brian Austin <brian.austin@cirrus.com>
+Date: Fri, 11 May 2012 12:54:45 -0500
+Subject: ASoC: cs42l73: Sync digital mixer kcontrols to allow for 0dB
+
+From: Brian Austin <brian.austin@cirrus.com>
+
+commit 5807c3bf68eb489032ca8ff70b3d3c833fd8172b upstream.
+
+Some of the Digital mixer kcontrol max values were off by 1 not allowing a max of 0dB.
+
+Signed-off-by: Brian Austin <brian.austin@cirrus.com>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/cs42l73.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/sound/soc/codecs/cs42l73.c
++++ b/sound/soc/codecs/cs42l73.c
+@@ -568,22 +568,22 @@ static const struct snd_kcontrol_new cs4
+ attn_tlv),
+
+ SOC_SINGLE_TLV("SPK-IP Mono Volume",
+- CS42L73_SPKMIPMA, 0, 0x3E, 1, attn_tlv),
++ CS42L73_SPKMIPMA, 0, 0x3F, 1, attn_tlv),
+ SOC_SINGLE_TLV("SPK-XSP Mono Volume",
+- CS42L73_SPKMXSPA, 0, 0x3E, 1, attn_tlv),
++ CS42L73_SPKMXSPA, 0, 0x3F, 1, attn_tlv),
+ SOC_SINGLE_TLV("SPK-ASP Mono Volume",
+- CS42L73_SPKMASPA, 0, 0x3E, 1, attn_tlv),
++ CS42L73_SPKMASPA, 0, 0x3F, 1, attn_tlv),
+ SOC_SINGLE_TLV("SPK-VSP Mono Volume",
+- CS42L73_SPKMVSPMA, 0, 0x3E, 1, attn_tlv),
++ CS42L73_SPKMVSPMA, 0, 0x3F, 1, attn_tlv),
+
+ SOC_SINGLE_TLV("ESL-IP Mono Volume",
+- CS42L73_ESLMIPMA, 0, 0x3E, 1, attn_tlv),
++ CS42L73_ESLMIPMA, 0, 0x3F, 1, attn_tlv),
+ SOC_SINGLE_TLV("ESL-XSP Mono Volume",
+- CS42L73_ESLMXSPA, 0, 0x3E, 1, attn_tlv),
++ CS42L73_ESLMXSPA, 0, 0x3F, 1, attn_tlv),
+ SOC_SINGLE_TLV("ESL-ASP Mono Volume",
+- CS42L73_ESLMASPA, 0, 0x3E, 1, attn_tlv),
++ CS42L73_ESLMASPA, 0, 0x3F, 1, attn_tlv),
+ SOC_SINGLE_TLV("ESL-VSP Mono Volume",
+- CS42L73_ESLMVSPMA, 0, 0x3E, 1, attn_tlv),
++ CS42L73_ESLMVSPMA, 0, 0x3F, 1, attn_tlv),
+
+ SOC_ENUM("IP Digital Swap/Mono Select", ip_swap_enum),
+
--- /dev/null
+From c7f5f2389377b66028bc129890aa653deafe8d39 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Tue, 15 May 2012 18:13:00 +0100
+Subject: ASoC: wm8994: Fix AIF2ADC power down
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit c7f5f2389377b66028bc129890aa653deafe8d39 upstream.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm8994.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -1073,7 +1073,7 @@ static int aif2clk_ev(struct snd_soc_dap
+ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
+ WM8994_AIF2DACL_ENA |
+ WM8994_AIF2DACR_ENA, 0);
+- snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
++ snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4,
+ WM8994_AIF2ADCL_ENA |
+ WM8994_AIF2ADCR_ENA, 0);
+
--- /dev/null
+From 4e6304b8420aba5311ba21fd68dab2924ae4d91a Mon Sep 17 00:00:00 2001
+From: Dan Williams <dcbw@redhat.com>
+Date: Mon, 7 May 2012 04:24:51 +0000
+Subject: cdc_ether: add Novatel USB551L device IDs for FLAG_WWAN
+
+From: Dan Williams <dcbw@redhat.com>
+
+commit 4e6304b8420aba5311ba21fd68dab2924ae4d91a upstream.
+
+Needs to be tagged with FLAG_WWAN, which since it has generic
+descriptors, won't happen if we don't override the generic
+driver info.
+
+Cc: Oliver Neukum <oliver@neukum.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Dan Williams <dcbw@redhat.com>
+Acked-by: Oliver Neukum <oliver@neukum.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/usb/cdc_ether.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/drivers/net/usb/cdc_ether.c
++++ b/drivers/net/usb/cdc_ether.c
+@@ -485,6 +485,7 @@ static const struct driver_info wwan_inf
+ /*-------------------------------------------------------------------------*/
+
+ #define HUAWEI_VENDOR_ID 0x12D1
++#define NOVATEL_VENDOR_ID 0x1410
+
+ static const struct usb_device_id products [] = {
+ /*
+@@ -602,6 +603,21 @@ static const struct usb_device_id produc
+ * because of bugs/quirks in a given product (like Zaurus, above).
+ */
+ {
++ /* Novatel USB551L */
++ /* This match must come *before* the generic CDC-ETHER match so that
++ * we get FLAG_WWAN set on the device, since it's descriptors are
++ * generic CDC-ETHER.
++ */
++ .match_flags = USB_DEVICE_ID_MATCH_VENDOR
++ | USB_DEVICE_ID_MATCH_PRODUCT
++ | USB_DEVICE_ID_MATCH_INT_INFO,
++ .idVendor = NOVATEL_VENDOR_ID,
++ .idProduct = 0xB001,
++ .bInterfaceClass = USB_CLASS_COMM,
++ .bInterfaceSubClass = USB_CDC_SUBCLASS_ETHERNET,
++ .bInterfaceProtocol = USB_CDC_PROTO_NONE,
++ .driver_info = (unsigned long)&wwan_info,
++}, {
+ USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ETHERNET,
+ USB_CDC_PROTO_NONE),
+ .driver_info = (unsigned long) &cdc_info,
--- /dev/null
+From 6eddcb4c82883451aec3be1240f17793370fa62f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Thu, 26 Apr 2012 02:35:10 +0000
+Subject: cdc_ether: Ignore bogus union descriptor for RNDIS devices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bjørn Mork <bjorn@mork.no>
+
+commit 6eddcb4c82883451aec3be1240f17793370fa62f upstream.
+
+Some RNDIS devices include a bogus CDC Union descriptor pointing
+to non-existing interfaces. The RNDIS code is already prepared
+to handle devices without a CDC Union descriptor by hardwiring
+the driver to use interfaces 0 and 1, which is correct for the
+devices with the bogus descriptor as well. So we can reuse the
+existing workaround.
+
+Cc: Markus Kolb <linux-201011@tower-net.de>
+Cc: Iker Salmón San Millán <shaola@esdebian.org>
+Cc: Jonathan Nieder <jrnieder@gmail.com>
+Cc: Oliver Neukum <oliver@neukum.org>
+Cc: 655387@bugs.debian.org
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/usb/cdc_ether.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/usb/cdc_ether.c
++++ b/drivers/net/usb/cdc_ether.c
+@@ -83,6 +83,7 @@ int usbnet_generic_cdc_bind(struct usbne
+ struct cdc_state *info = (void *) &dev->data;
+ int status;
+ int rndis;
++ bool android_rndis_quirk = false;
+ struct usb_driver *driver = driver_of(intf);
+ struct usb_cdc_mdlm_desc *desc = NULL;
+ struct usb_cdc_mdlm_detail_desc *detail = NULL;
+@@ -195,6 +196,11 @@ int usbnet_generic_cdc_bind(struct usbne
+ info->control,
+ info->u->bSlaveInterface0,
+ info->data);
++ /* fall back to hard-wiring for RNDIS */
++ if (rndis) {
++ android_rndis_quirk = true;
++ goto next_desc;
++ }
+ goto bad_desc;
+ }
+ if (info->control != intf) {
+@@ -271,11 +277,15 @@ next_desc:
+ /* Microsoft ActiveSync based and some regular RNDIS devices lack the
+ * CDC descriptors, so we'll hard-wire the interfaces and not check
+ * for descriptors.
++ *
++ * Some Android RNDIS devices have a CDC Union descriptor pointing
++ * to non-existing interfaces. Ignore that and attempt the same
++ * hard-wired 0 and 1 interfaces.
+ */
+- if (rndis && !info->u) {
++ if (rndis && (!info->u || android_rndis_quirk)) {
+ info->control = usb_ifnum_to_if(dev->udev, 0);
+ info->data = usb_ifnum_to_if(dev->udev, 1);
+- if (!info->control || !info->data) {
++ if (!info->control || !info->data || info->control != intf) {
+ dev_dbg(&intf->dev,
+ "rndis: master #0/%p slave #1/%p\n",
+ info->control,
--- /dev/null
+From 1ebfefcf37a6e308266a8d786e8cfea0a454058c Mon Sep 17 00:00:00 2001
+From: Alexander Clouter <alex@digriz.org.uk>
+Date: Sat, 12 May 2012 09:45:08 +0100
+Subject: crypto: mv_cesa requires on CRYPTO_HASH to build
+
+From: Alexander Clouter <alex@digriz.org.uk>
+
+commit 1ebfefcf37a6e308266a8d786e8cfea0a454058c upstream.
+
+Without CRYPTO_HASH being selected, mv_cesa has a lot of hooks
+into undefined exports.
+----
+ MODPOST 81 modules
+ Kernel: arch/arm/boot/Image is ready
+ AS arch/arm/boot/compressed/head.o
+ GZIP arch/arm/boot/compressed/piggy.gzip
+ CC arch/arm/boot/compressed/misc.o
+ CC arch/arm/boot/compressed/decompress.o
+ERROR: "crypto_ahash_type" [drivers/crypto/mv_cesa.ko] undefined!
+ERROR: "crypto_shash_final" [drivers/crypto/mv_cesa.ko] undefined!
+ERROR: "crypto_register_ahash" [drivers/crypto/mv_cesa.ko] undefined!
+ERROR: "crypto_unregister_ahash" [drivers/crypto/mv_cesa.ko] undefined!
+ERROR: "crypto_shash_update" [drivers/crypto/mv_cesa.ko] undefined!
+ERROR: "crypto_shash_digest" [drivers/crypto/mv_cesa.ko] undefined!
+ERROR: "crypto_shash_setkey" [drivers/crypto/mv_cesa.ko] undefined!
+ERROR: "crypto_alloc_shash" [drivers/crypto/mv_cesa.ko] undefined!
+make[1]: *** [__modpost] Error 1
+make: *** [modules] Error 2
+make: *** Waiting for unfinished jobs....
+----
+
+Signed-off-by: Alexander Clouter <alex@digriz.org.uk>
+Signed-off-by: Jason Cooper <jason@lakedaemon.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/crypto/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/crypto/Kconfig
++++ b/drivers/crypto/Kconfig
+@@ -173,6 +173,7 @@ config CRYPTO_DEV_MV_CESA
+ select CRYPTO_ALGAPI
+ select CRYPTO_AES
+ select CRYPTO_BLKCIPHER2
++ select CRYPTO_HASH
+ help
+ This driver allows you to utilize the Cryptographic Engines and
+ Security Accelerator (CESA) which can be found on the Marvell Orion
--- /dev/null
+From 510193a2d3d2e03ae53b95c0ae4f33cdff02cbf8 Mon Sep 17 00:00:00 2001
+From: Mike Snitzer <snitzer@redhat.com>
+Date: Sat, 12 May 2012 01:43:21 +0100
+Subject: dm mpath: check if scsi_dh module already loaded before trying to load
+
+From: Mike Snitzer <snitzer@redhat.com>
+
+commit 510193a2d3d2e03ae53b95c0ae4f33cdff02cbf8 upstream.
+
+If the requested scsi_dh module is already loaded then skip
+request_module().
+
+Multipath table loads can hang in an unnecessary __request_module.
+
+Reported-by: Ben Marzinski <bmarzins@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-mpath.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -698,8 +698,8 @@ static int parse_hw_handler(struct dm_ar
+ return 0;
+
+ m->hw_handler_name = kstrdup(dm_shift_arg(as), GFP_KERNEL);
+- request_module("scsi_dh_%s", m->hw_handler_name);
+- if (scsi_dh_handler_exist(m->hw_handler_name) == 0) {
++ if (!try_then_request_module(scsi_dh_handler_exist(m->hw_handler_name),
++ "scsi_dh_%s", m->hw_handler_name)) {
+ ti->error = "unknown hardware handler type";
+ ret = -EINVAL;
+ goto fail;
--- /dev/null
+From 8ce6909f77ba1b7bcdea65cc2388fd1742b6d669 Mon Sep 17 00:00:00 2001
+From: Tushar Dave <tushar.n.dave@intel.com>
+Date: Thu, 17 May 2012 01:04:50 +0000
+Subject: e1000: Prevent reset task killing itself.
+
+From: Tushar Dave <tushar.n.dave@intel.com>
+
+commit 8ce6909f77ba1b7bcdea65cc2388fd1742b6d669 upstream.
+
+Killing reset task while adapter is resetting causes deadlock.
+Only kill reset task if adapter is not resetting.
+Ref bug #43132 on bugzilla.kernel.org
+
+Signed-off-by: Tushar Dave <tushar.n.dave@intel.com>
+Tested-by: Aaron Brown <aaron.f.brown@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/intel/e1000/e1000_main.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
+@@ -492,7 +492,11 @@ out:
+ static void e1000_down_and_stop(struct e1000_adapter *adapter)
+ {
+ set_bit(__E1000_DOWN, &adapter->flags);
+- cancel_work_sync(&adapter->reset_task);
++
++ /* Only kill reset task if adapter is not resetting */
++ if (!test_bit(__E1000_RESETTING, &adapter->flags))
++ cancel_work_sync(&adapter->reset_task);
++
+ cancel_delayed_work_sync(&adapter->watchdog_task);
+ cancel_delayed_work_sync(&adapter->phy_info_task);
+ cancel_delayed_work_sync(&adapter->fifo_stall_task);
--- /dev/null
+From 4998a6c0edce7fae9c0a5463f6ec3fa585258ee7 Mon Sep 17 00:00:00 2001
+From: Chris Metcalf <cmetcalf@tilera.com>
+Date: Thu, 10 May 2012 13:01:44 -0700
+Subject: hugetlb: prevent BUG_ON in hugetlb_fault() -> hugetlb_cow()
+
+From: Chris Metcalf <cmetcalf@tilera.com>
+
+commit 4998a6c0edce7fae9c0a5463f6ec3fa585258ee7 upstream.
+
+Commit 66aebce747eaf ("hugetlb: fix race condition in hugetlb_fault()")
+added code to avoid a race condition by elevating the page refcount in
+hugetlb_fault() while calling hugetlb_cow().
+
+However, one code path in hugetlb_cow() includes an assertion that the
+page count is 1, whereas it may now also have the value 2 in this path.
+
+The consensus is that this BUG_ON has served its purpose, so rather than
+extending it to cover both cases, we just remove it.
+
+Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
+Acked-by: Mel Gorman <mel@csn.ul.ie>
+Acked-by: Hillf Danton <dhillf@gmail.com>
+Acked-by: Hugh Dickins <hughd@google.com>
+Cc: Michal Hocko <mhocko@suse.cz>
+Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/hugetlb.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2486,7 +2486,6 @@ retry_avoidcopy:
+ if (outside_reserve) {
+ BUG_ON(huge_pte_none(pte));
+ if (unmap_ref_private(mm, vma, old_page, address)) {
+- BUG_ON(page_count(old_page) != 1);
+ BUG_ON(huge_pte_none(pte));
+ spin_lock(&mm->page_table_lock);
+ ptep = huge_pte_offset(mm, address & huge_page_mask(h));
--- /dev/null
+From 377485f6244af255b04d662cf19cddbbc4ae4310 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <levinsasha928@gmail.com>
+Date: Sat, 5 May 2012 17:06:35 +0200
+Subject: init: don't try mounting device as nfs root unless type fully matches
+
+From: Sasha Levin <levinsasha928@gmail.com>
+
+commit 377485f6244af255b04d662cf19cddbbc4ae4310 upstream.
+
+Currently, we'll try mounting any device who's major device number is
+UNNAMED_MAJOR as NFS root. This would happen for non-NFS devices as
+well (such as 9p devices) but it wouldn't cause any issues since
+mounting the device as NFS would fail quickly and the code proceeded to
+doing the proper mount:
+
+ [ 101.522716] VFS: Unable to mount root fs via NFS, trying floppy.
+ [ 101.534499] VFS: Mounted root (9p filesystem) on device 0:18.
+
+Commit 6829a048102a ("NFS: Retry mounting NFSROOT") introduced retries
+when mounting NFS root, which means that now we don't immediately fail
+and instead it takes an additional 90+ seconds until we stop retrying,
+which has revealed the issue this patch fixes.
+
+This meant that it would take an additional 90 seconds to boot when
+we're not using a device type which gets detected in order before NFS.
+
+This patch modifies the NFS type check to require device type to be
+'Root_NFS' instead of requiring the device to have an UNNAMED_MAJOR
+major. This makes boot process cleaner since we now won't go through
+the NFS mounting code at all when the device isn't an NFS root
+("/dev/nfs").
+
+Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ init/do_mounts.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/init/do_mounts.c
++++ b/init/do_mounts.c
+@@ -472,7 +472,7 @@ void __init change_floppy(char *fmt, ...
+ void __init mount_root(void)
+ {
+ #ifdef CONFIG_ROOT_NFS
+- if (MAJOR(ROOT_DEV) == UNNAMED_MAJOR) {
++ if (ROOT_DEV == Root_NFS) {
+ if (mount_nfs_root())
+ return;
+
--- /dev/null
+From 226bb7df3d22bcf4a1c0fe8206c80cc427498eae Mon Sep 17 00:00:00 2001
+From: Josh Cartwright <joshc@linux.com>
+Date: Thu, 29 Mar 2012 19:34:53 -0400
+Subject: jffs2: Fix lock acquisition order bug in gc path
+
+From: Josh Cartwright <joshc@linux.com>
+
+commit 226bb7df3d22bcf4a1c0fe8206c80cc427498eae upstream.
+
+The locking policy is such that the erase_complete_block spinlock is
+nested within the alloc_sem mutex. This fixes a case in which the
+acquisition order was erroneously reversed. This issue was caught by
+the following lockdep splat:
+
+ =======================================================
+ [ INFO: possible circular locking dependency detected ]
+ 3.0.5 #1
+ -------------------------------------------------------
+ jffs2_gcd_mtd6/299 is trying to acquire lock:
+ (&c->alloc_sem){+.+.+.}, at: [<c01f7714>] jffs2_garbage_collect_pass+0x314/0x890
+
+ but task is already holding lock:
+ (&(&c->erase_completion_lock)->rlock){+.+...}, at: [<c01f7708>] jffs2_garbage_collect_pass+0x308/0x890
+
+ which lock already depends on the new lock.
+
+ the existing dependency chain (in reverse order) is:
+
+ -> #1 (&(&c->erase_completion_lock)->rlock){+.+...}:
+ [<c008bec4>] validate_chain+0xe6c/0x10bc
+ [<c008c660>] __lock_acquire+0x54c/0xba4
+ [<c008d240>] lock_acquire+0xa4/0x114
+ [<c046780c>] _raw_spin_lock+0x3c/0x4c
+ [<c01f744c>] jffs2_garbage_collect_pass+0x4c/0x890
+ [<c01f937c>] jffs2_garbage_collect_thread+0x1b4/0x1cc
+ [<c0071a68>] kthread+0x98/0xa0
+ [<c000f264>] kernel_thread_exit+0x0/0x8
+
+ -> #0 (&c->alloc_sem){+.+.+.}:
+ [<c008ad2c>] print_circular_bug+0x70/0x2c4
+ [<c008c08c>] validate_chain+0x1034/0x10bc
+ [<c008c660>] __lock_acquire+0x54c/0xba4
+ [<c008d240>] lock_acquire+0xa4/0x114
+ [<c0466628>] mutex_lock_nested+0x74/0x33c
+ [<c01f7714>] jffs2_garbage_collect_pass+0x314/0x890
+ [<c01f937c>] jffs2_garbage_collect_thread+0x1b4/0x1cc
+ [<c0071a68>] kthread+0x98/0xa0
+ [<c000f264>] kernel_thread_exit+0x0/0x8
+
+ other info that might help us debug this:
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(&(&c->erase_completion_lock)->rlock);
+ lock(&c->alloc_sem);
+ lock(&(&c->erase_completion_lock)->rlock);
+ lock(&c->alloc_sem);
+
+ *** DEADLOCK ***
+
+ 1 lock held by jffs2_gcd_mtd6/299:
+ #0: (&(&c->erase_completion_lock)->rlock){+.+...}, at: [<c01f7708>] jffs2_garbage_collect_pass+0x308/0x890
+
+ stack backtrace:
+ [<c00155dc>] (unwind_backtrace+0x0/0x100) from [<c0463dc0>] (dump_stack+0x20/0x24)
+ [<c0463dc0>] (dump_stack+0x20/0x24) from [<c008ae84>] (print_circular_bug+0x1c8/0x2c4)
+ [<c008ae84>] (print_circular_bug+0x1c8/0x2c4) from [<c008c08c>] (validate_chain+0x1034/0x10bc)
+ [<c008c08c>] (validate_chain+0x1034/0x10bc) from [<c008c660>] (__lock_acquire+0x54c/0xba4)
+ [<c008c660>] (__lock_acquire+0x54c/0xba4) from [<c008d240>] (lock_acquire+0xa4/0x114)
+ [<c008d240>] (lock_acquire+0xa4/0x114) from [<c0466628>] (mutex_lock_nested+0x74/0x33c)
+ [<c0466628>] (mutex_lock_nested+0x74/0x33c) from [<c01f7714>] (jffs2_garbage_collect_pass+0x314/0x890)
+ [<c01f7714>] (jffs2_garbage_collect_pass+0x314/0x890) from [<c01f937c>] (jffs2_garbage_collect_thread+0x1b4/0x1cc)
+ [<c01f937c>] (jffs2_garbage_collect_thread+0x1b4/0x1cc) from [<c0071a68>] (kthread+0x98/0xa0)
+ [<c0071a68>] (kthread+0x98/0xa0) from [<c000f264>] (kernel_thread_exit+0x0/0x8)
+
+This was introduce in '81cfc9f jffs2: Fix serious write stall due to erase'.
+
+Signed-off-by: Josh Cartwright <joshc@linux.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/jffs2/gc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/jffs2/gc.c
++++ b/fs/jffs2/gc.c
+@@ -225,8 +225,8 @@ int jffs2_garbage_collect_pass(struct jf
+ return 0;
+
+ D1(printk(KERN_DEBUG "No progress from erasing blocks; doing GC anyway\n"));
+- spin_lock(&c->erase_completion_lock);
+ mutex_lock(&c->alloc_sem);
++ spin_lock(&c->erase_completion_lock);
+ }
+
+ /* First, work out which block we're garbage-collecting */
--- /dev/null
+From 100d13c3b5b9410f604b86f5e0a34da64b8cf659 Mon Sep 17 00:00:00 2001
+From: Catalin Marinas <catalin.marinas@arm.com>
+Date: Wed, 9 May 2012 16:55:19 +0100
+Subject: kmemleak: Fix the kmemleak tracking of the percpu areas with !SMP
+
+From: Catalin Marinas <catalin.marinas@arm.com>
+
+commit 100d13c3b5b9410f604b86f5e0a34da64b8cf659 upstream.
+
+Kmemleak tracks the percpu allocations via a specific API and the
+originally allocated areas must be removed from kmemleak (via
+kmemleak_free). The code was already doing this for SMP systems.
+
+Reported-by: Sami Liedes <sami.liedes@iki.fi>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: Christoph Lameter <cl@linux-foundation.org>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/percpu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/mm/percpu.c
++++ b/mm/percpu.c
+@@ -1895,6 +1895,8 @@ void __init setup_per_cpu_areas(void)
+ fc = __alloc_bootmem(unit_size, PAGE_SIZE, __pa(MAX_DMA_ADDRESS));
+ if (!ai || !fc)
+ panic("Failed to allocate memory for percpu areas.");
++ /* kmemleak tracks the percpu allocations separately */
++ kmemleak_free(fc);
+
+ ai->dyn_size = unit_size;
+ ai->unit_size = unit_size;
--- /dev/null
+From 0d9f4f135eb6dea06bdcb7065b1e4ff78274a5e9 Mon Sep 17 00:00:00 2001
+From: Jonathan Brassow <jbrassow@redhat.com>
+Date: Wed, 16 May 2012 04:06:14 -0500
+Subject: MD: Add del_timer_sync to mddev_suspend (fix nasty panic)
+
+From: Jonathan Brassow <jbrassow@redhat.com>
+
+commit 0d9f4f135eb6dea06bdcb7065b1e4ff78274a5e9 upstream.
+
+Use del_timer_sync to remove timer before mddev_suspend finishes.
+
+We don't want a timer going off after an mddev_suspend is called. This is
+especially true with device-mapper, since it can call the destructor function
+immediately following a suspend. This results in the removal (kfree) of the
+structures upon which the timer depends - resulting in a very ugly panic.
+Therefore, we add a del_timer_sync to mddev_suspend to prevent this.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/md.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -391,6 +391,8 @@ void mddev_suspend(struct mddev *mddev)
+ synchronize_rcu();
+ wait_event(mddev->sb_wait, atomic_read(&mddev->active_io) == 0);
+ mddev->pers->quiesce(mddev, 1);
++
++ del_timer_sync(&mddev->safemode_timer);
+ }
+ EXPORT_SYMBOL_GPL(mddev_suspend);
+
--- /dev/null
+From 910a5f2e9642d5be373beae3d29e1c4a3bc7d83b Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab@redhat.com>
+Date: Mon, 7 May 2012 15:01:37 -0300
+Subject: media: dvb_frontend: fix a regression with DVB-S zig-zag
+
+From: Mauro Carvalho Chehab <mchehab@redhat.com>
+
+commit 910a5f2e9642d5be373beae3d29e1c4a3bc7d83b upstream.
+
+Changeset 5bfaadde broke zig-zag for DVB-S drivers that don't
+implement get_tune_settings() callback.
+
+Fix the code, in order to allow it to work as before, otherwise
+some channels may not be tuned anymore.
+
+Fix Fedora Bugzilla:
+ https://bugzilla.redhat.com/show_bug.cgi?id=814404
+
+Reported-by: Michael Heijenga <database.worker@googlemail.com>
+Tested-by: Michael Heijenga <database.worker@googlemail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/dvb/dvb-core/dvb_frontend.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/media/dvb/dvb-core/dvb_frontend.c
++++ b/drivers/media/dvb/dvb-core/dvb_frontend.c
+@@ -1921,6 +1921,10 @@ static int dtv_set_frontend(struct dvb_f
+ } else {
+ /* default values */
+ switch (c->delivery_system) {
++ case SYS_DVBS:
++ case SYS_DVBS2:
++ case SYS_ISDBS:
++ case SYS_TURBO:
+ case SYS_DVBC_ANNEX_A:
+ case SYS_DVBC_ANNEX_C:
+ fepriv->min_delay = HZ / 20;
--- /dev/null
+From 9967232f1be5bab10c7b7a8dcf51ff5c3c1a6d77 Mon Sep 17 00:00:00 2001
+From: Jonathan Corbet <corbet@lwn.net>
+Date: Fri, 20 Apr 2012 12:22:50 -0300
+Subject: media: marvell-cam: fix an ARM build error
+
+From: Jonathan Corbet <corbet@lwn.net>
+
+commit 9967232f1be5bab10c7b7a8dcf51ff5c3c1a6d77 upstream.
+
+One of the OLPC changes lost a little in its translation to mainline,
+leading to build errors on the ARM architecture. Remove the offending
+line, and all will be well.
+
+Reported-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Jonathan Corbet <corbet@lwn.net>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/video/marvell-ccic/mmp-driver.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/media/video/marvell-ccic/mmp-driver.c
++++ b/drivers/media/video/marvell-ccic/mmp-driver.c
+@@ -176,7 +176,6 @@ static int mmpcam_probe(struct platform_
+ INIT_LIST_HEAD(&cam->devlist);
+
+ mcam = &cam->mcam;
+- mcam->platform = MHP_Armada610;
+ mcam->plat_power_up = mmpcam_power_up;
+ mcam->plat_power_down = mmpcam_power_down;
+ mcam->dev = &pdev->dev;
--- /dev/null
+From 9ef449c6b31bb6a8e6dedc24de475a3b8c79be20 Mon Sep 17 00:00:00 2001
+From: Luis Henriques <luis.henriques@canonical.com>
+Date: Sat, 21 Apr 2012 12:25:21 -0300
+Subject: media: rc: Postpone ISR registration
+
+From: Luis Henriques <luis.henriques@canonical.com>
+
+commit 9ef449c6b31bb6a8e6dedc24de475a3b8c79be20 upstream.
+
+An early registration of an ISR was causing a crash to several users (for
+example, with the ite-cir driver: http://bugs.launchpad.net/bugs/972723).
+The reason was that IRQs were being triggered before a driver
+initialisation was completed.
+
+This patch fixes this by moving the invocation to request_irq() and to
+request_region() to a later stage on the driver probe function.
+
+Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
+Acked-by: Jarod Wilson <jarod@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/rc/ene_ir.c | 32 ++++++++--------
+ drivers/media/rc/fintek-cir.c | 20 +++++-----
+ drivers/media/rc/ite-cir.c | 20 +++++-----
+ drivers/media/rc/nuvoton-cir.c | 36 +++++++++---------
+ drivers/media/rc/winbond-cir.c | 78 ++++++++++++++++++++---------------------
+ 5 files changed, 93 insertions(+), 93 deletions(-)
+
+--- a/drivers/media/rc/ene_ir.c
++++ b/drivers/media/rc/ene_ir.c
+@@ -1018,22 +1018,6 @@ static int ene_probe(struct pnp_dev *pnp
+
+ spin_lock_init(&dev->hw_lock);
+
+- /* claim the resources */
+- error = -EBUSY;
+- dev->hw_io = pnp_port_start(pnp_dev, 0);
+- if (!request_region(dev->hw_io, ENE_IO_SIZE, ENE_DRIVER_NAME)) {
+- dev->hw_io = -1;
+- dev->irq = -1;
+- goto error;
+- }
+-
+- dev->irq = pnp_irq(pnp_dev, 0);
+- if (request_irq(dev->irq, ene_isr,
+- IRQF_SHARED, ENE_DRIVER_NAME, (void *)dev)) {
+- dev->irq = -1;
+- goto error;
+- }
+-
+ pnp_set_drvdata(pnp_dev, dev);
+ dev->pnp_dev = pnp_dev;
+
+@@ -1086,6 +1070,22 @@ static int ene_probe(struct pnp_dev *pnp
+ device_set_wakeup_capable(&pnp_dev->dev, true);
+ device_set_wakeup_enable(&pnp_dev->dev, true);
+
++ /* claim the resources */
++ error = -EBUSY;
++ dev->hw_io = pnp_port_start(pnp_dev, 0);
++ if (!request_region(dev->hw_io, ENE_IO_SIZE, ENE_DRIVER_NAME)) {
++ dev->hw_io = -1;
++ dev->irq = -1;
++ goto error;
++ }
++
++ dev->irq = pnp_irq(pnp_dev, 0);
++ if (request_irq(dev->irq, ene_isr,
++ IRQF_SHARED, ENE_DRIVER_NAME, (void *)dev)) {
++ dev->irq = -1;
++ goto error;
++ }
++
+ error = rc_register_device(rdev);
+ if (error < 0)
+ goto error;
+--- a/drivers/media/rc/fintek-cir.c
++++ b/drivers/media/rc/fintek-cir.c
+@@ -504,16 +504,6 @@ static int fintek_probe(struct pnp_dev *
+
+ spin_lock_init(&fintek->fintek_lock);
+
+- ret = -EBUSY;
+- /* now claim resources */
+- if (!request_region(fintek->cir_addr,
+- fintek->cir_port_len, FINTEK_DRIVER_NAME))
+- goto failure;
+-
+- if (request_irq(fintek->cir_irq, fintek_cir_isr, IRQF_SHARED,
+- FINTEK_DRIVER_NAME, (void *)fintek))
+- goto failure;
+-
+ pnp_set_drvdata(pdev, fintek);
+ fintek->pdev = pdev;
+
+@@ -548,6 +538,16 @@ static int fintek_probe(struct pnp_dev *
+ /* rx resolution is hardwired to 50us atm, 1, 25, 100 also possible */
+ rdev->rx_resolution = US_TO_NS(CIR_SAMPLE_PERIOD);
+
++ ret = -EBUSY;
++ /* now claim resources */
++ if (!request_region(fintek->cir_addr,
++ fintek->cir_port_len, FINTEK_DRIVER_NAME))
++ goto failure;
++
++ if (request_irq(fintek->cir_irq, fintek_cir_isr, IRQF_SHARED,
++ FINTEK_DRIVER_NAME, (void *)fintek))
++ goto failure;
++
+ ret = rc_register_device(rdev);
+ if (ret)
+ goto failure;
+--- a/drivers/media/rc/ite-cir.c
++++ b/drivers/media/rc/ite-cir.c
+@@ -1515,16 +1515,6 @@ static int ite_probe(struct pnp_dev *pde
+ /* initialize raw event */
+ init_ir_raw_event(&itdev->rawir);
+
+- ret = -EBUSY;
+- /* now claim resources */
+- if (!request_region(itdev->cir_addr,
+- dev_desc->io_region_size, ITE_DRIVER_NAME))
+- goto failure;
+-
+- if (request_irq(itdev->cir_irq, ite_cir_isr, IRQF_SHARED,
+- ITE_DRIVER_NAME, (void *)itdev))
+- goto failure;
+-
+ /* set driver data into the pnp device */
+ pnp_set_drvdata(pdev, itdev);
+ itdev->pdev = pdev;
+@@ -1600,6 +1590,16 @@ static int ite_probe(struct pnp_dev *pde
+ rdev->driver_name = ITE_DRIVER_NAME;
+ rdev->map_name = RC_MAP_RC6_MCE;
+
++ ret = -EBUSY;
++ /* now claim resources */
++ if (!request_region(itdev->cir_addr,
++ dev_desc->io_region_size, ITE_DRIVER_NAME))
++ goto failure;
++
++ if (request_irq(itdev->cir_irq, ite_cir_isr, IRQF_SHARED,
++ ITE_DRIVER_NAME, (void *)itdev))
++ goto failure;
++
+ ret = rc_register_device(rdev);
+ if (ret)
+ goto failure;
+--- a/drivers/media/rc/nuvoton-cir.c
++++ b/drivers/media/rc/nuvoton-cir.c
+@@ -1021,24 +1021,6 @@ static int nvt_probe(struct pnp_dev *pde
+ spin_lock_init(&nvt->nvt_lock);
+ spin_lock_init(&nvt->tx.lock);
+
+- ret = -EBUSY;
+- /* now claim resources */
+- if (!request_region(nvt->cir_addr,
+- CIR_IOREG_LENGTH, NVT_DRIVER_NAME))
+- goto failure;
+-
+- if (request_irq(nvt->cir_irq, nvt_cir_isr, IRQF_SHARED,
+- NVT_DRIVER_NAME, (void *)nvt))
+- goto failure;
+-
+- if (!request_region(nvt->cir_wake_addr,
+- CIR_IOREG_LENGTH, NVT_DRIVER_NAME))
+- goto failure;
+-
+- if (request_irq(nvt->cir_wake_irq, nvt_cir_wake_isr, IRQF_SHARED,
+- NVT_DRIVER_NAME, (void *)nvt))
+- goto failure;
+-
+ pnp_set_drvdata(pdev, nvt);
+ nvt->pdev = pdev;
+
+@@ -1085,6 +1067,24 @@ static int nvt_probe(struct pnp_dev *pde
+ rdev->tx_resolution = XYZ;
+ #endif
+
++ ret = -EBUSY;
++ /* now claim resources */
++ if (!request_region(nvt->cir_addr,
++ CIR_IOREG_LENGTH, NVT_DRIVER_NAME))
++ goto failure;
++
++ if (request_irq(nvt->cir_irq, nvt_cir_isr, IRQF_SHARED,
++ NVT_DRIVER_NAME, (void *)nvt))
++ goto failure;
++
++ if (!request_region(nvt->cir_wake_addr,
++ CIR_IOREG_LENGTH, NVT_DRIVER_NAME))
++ goto failure;
++
++ if (request_irq(nvt->cir_wake_irq, nvt_cir_wake_isr, IRQF_SHARED,
++ NVT_DRIVER_NAME, (void *)nvt))
++ goto failure;
++
+ ret = rc_register_device(rdev);
+ if (ret)
+ goto failure;
+--- a/drivers/media/rc/winbond-cir.c
++++ b/drivers/media/rc/winbond-cir.c
+@@ -991,39 +991,10 @@ wbcir_probe(struct pnp_dev *device, cons
+ "(w: 0x%lX, e: 0x%lX, s: 0x%lX, i: %u)\n",
+ data->wbase, data->ebase, data->sbase, data->irq);
+
+- if (!request_region(data->wbase, WAKEUP_IOMEM_LEN, DRVNAME)) {
+- dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
+- data->wbase, data->wbase + WAKEUP_IOMEM_LEN - 1);
+- err = -EBUSY;
+- goto exit_free_data;
+- }
+-
+- if (!request_region(data->ebase, EHFUNC_IOMEM_LEN, DRVNAME)) {
+- dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
+- data->ebase, data->ebase + EHFUNC_IOMEM_LEN - 1);
+- err = -EBUSY;
+- goto exit_release_wbase;
+- }
+-
+- if (!request_region(data->sbase, SP_IOMEM_LEN, DRVNAME)) {
+- dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
+- data->sbase, data->sbase + SP_IOMEM_LEN - 1);
+- err = -EBUSY;
+- goto exit_release_ebase;
+- }
+-
+- err = request_irq(data->irq, wbcir_irq_handler,
+- IRQF_DISABLED, DRVNAME, device);
+- if (err) {
+- dev_err(dev, "Failed to claim IRQ %u\n", data->irq);
+- err = -EBUSY;
+- goto exit_release_sbase;
+- }
+-
+ led_trigger_register_simple("cir-tx", &data->txtrigger);
+ if (!data->txtrigger) {
+ err = -ENOMEM;
+- goto exit_free_irq;
++ goto exit_free_data;
+ }
+
+ led_trigger_register_simple("cir-rx", &data->rxtrigger);
+@@ -1062,9 +1033,38 @@ wbcir_probe(struct pnp_dev *device, cons
+ data->dev->priv = data;
+ data->dev->dev.parent = &device->dev;
+
++ if (!request_region(data->wbase, WAKEUP_IOMEM_LEN, DRVNAME)) {
++ dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
++ data->wbase, data->wbase + WAKEUP_IOMEM_LEN - 1);
++ err = -EBUSY;
++ goto exit_free_rc;
++ }
++
++ if (!request_region(data->ebase, EHFUNC_IOMEM_LEN, DRVNAME)) {
++ dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
++ data->ebase, data->ebase + EHFUNC_IOMEM_LEN - 1);
++ err = -EBUSY;
++ goto exit_release_wbase;
++ }
++
++ if (!request_region(data->sbase, SP_IOMEM_LEN, DRVNAME)) {
++ dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
++ data->sbase, data->sbase + SP_IOMEM_LEN - 1);
++ err = -EBUSY;
++ goto exit_release_ebase;
++ }
++
++ err = request_irq(data->irq, wbcir_irq_handler,
++ IRQF_DISABLED, DRVNAME, device);
++ if (err) {
++ dev_err(dev, "Failed to claim IRQ %u\n", data->irq);
++ err = -EBUSY;
++ goto exit_release_sbase;
++ }
++
+ err = rc_register_device(data->dev);
+ if (err)
+- goto exit_free_rc;
++ goto exit_free_irq;
+
+ device_init_wakeup(&device->dev, 1);
+
+@@ -1072,14 +1072,6 @@ wbcir_probe(struct pnp_dev *device, cons
+
+ return 0;
+
+-exit_free_rc:
+- rc_free_device(data->dev);
+-exit_unregister_led:
+- led_classdev_unregister(&data->led);
+-exit_unregister_rxtrigger:
+- led_trigger_unregister_simple(data->rxtrigger);
+-exit_unregister_txtrigger:
+- led_trigger_unregister_simple(data->txtrigger);
+ exit_free_irq:
+ free_irq(data->irq, device);
+ exit_release_sbase:
+@@ -1088,6 +1080,14 @@ exit_release_ebase:
+ release_region(data->ebase, EHFUNC_IOMEM_LEN);
+ exit_release_wbase:
+ release_region(data->wbase, WAKEUP_IOMEM_LEN);
++exit_free_rc:
++ rc_free_device(data->dev);
++exit_unregister_led:
++ led_classdev_unregister(&data->led);
++exit_unregister_rxtrigger:
++ led_trigger_unregister_simple(data->rxtrigger);
++exit_unregister_txtrigger:
++ led_trigger_unregister_simple(data->txtrigger);
+ exit_free_data:
+ kfree(data);
+ pnp_set_drvdata(device, NULL);
--- /dev/null
+From e985dbf7d93e2a3e114b4525413e50f83613e0cb Mon Sep 17 00:00:00 2001
+From: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Date: Sat, 21 Apr 2012 18:46:30 -0300
+Subject: media: s5p-fimc: Fix locking in subdev set_crop op
+
+From: Sylwester Nawrocki <s.nawrocki@samsung.com>
+
+commit e985dbf7d93e2a3e114b4525413e50f83613e0cb upstream.
+
+When setting TRY crop on the sub-device the mutex was erroneously acquired
+rather than released on exit path. This bug is present in kernels starting
+from v3.2.
+
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/video/s5p-fimc/fimc-capture.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/video/s5p-fimc/fimc-capture.c
++++ b/drivers/media/video/s5p-fimc/fimc-capture.c
+@@ -1316,7 +1316,7 @@ static int fimc_subdev_set_crop(struct v
+ fimc_capture_try_crop(ctx, r, crop->pad);
+
+ if (crop->which == V4L2_SUBDEV_FORMAT_TRY) {
+- mutex_lock(&fimc->lock);
++ mutex_unlock(&fimc->lock);
+ *v4l2_subdev_get_try_crop(fh, crop->pad) = *r;
+ return 0;
+ }
--- /dev/null
+From 6bc2e853c6b46a6041980d58200ad9b0a73a60ff Mon Sep 17 00:00:00 2001
+From: Russ Anderson <rja@sgi.com>
+Date: Thu, 10 May 2012 13:01:46 -0700
+Subject: mm: nobootmem: fix sign extend problem in __free_pages_memory()
+
+From: Russ Anderson <rja@sgi.com>
+
+commit 6bc2e853c6b46a6041980d58200ad9b0a73a60ff upstream.
+
+Systems with 8 TBytes of memory or greater can hit a problem where only
+the the first 8 TB of memory shows up. This is due to "int i" being
+smaller than "unsigned long start_aligned", causing the high bits to be
+dropped.
+
+The fix is to change `i' to unsigned long to match start_aligned
+and end_aligned.
+
+Thanks to Jack Steiner for assistance tracking this down.
+
+Signed-off-by: Russ Anderson <rja@sgi.com>
+Cc: Jack Steiner <steiner@sgi.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Yinghai Lu <yinghai@kernel.org>
+Cc: Gavin Shan <shangw@linux.vnet.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/nobootmem.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/mm/nobootmem.c
++++ b/mm/nobootmem.c
+@@ -82,8 +82,7 @@ void __init free_bootmem_late(unsigned l
+
+ static void __init __free_pages_memory(unsigned long start, unsigned long end)
+ {
+- int i;
+- unsigned long start_aligned, end_aligned;
++ unsigned long i, start_aligned, end_aligned;
+ int order = ilog2(BITS_PER_LONG);
+
+ start_aligned = (start + (BITS_PER_LONG - 1)) & ~(BITS_PER_LONG - 1);
--- /dev/null
+From 7a84477c4acebf6299b6a8bd6a1d5894eb838ffa Mon Sep 17 00:00:00 2001
+From: Will Newton <will.newton@gmail.com>
+Date: Fri, 30 Mar 2012 11:51:02 +0100
+Subject: mtd: fix oops in dataflash driver
+
+From: Will Newton <will.newton@gmail.com>
+
+commit 7a84477c4acebf6299b6a8bd6a1d5894eb838ffa upstream.
+
+I'm seeing an oops in mtd_dataflash.c with Linux 3.3. What appears to
+be happening is that otp_select_filemode calls mtd_read_fact_prot_reg
+with -1 for offset and length and a NULL buffer to test if OTP
+operations are supported. This finds its way down to otp_read in
+mtd_dataflash.c and causes an oops when memcpying the returned data
+into the NULL buf.
+
+None of the checks in otp_read catches the negative length and offset.
+Changing the length of the dummy read to 0 prevents the oops.
+
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/mtdchar.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/mtdchar.c
++++ b/drivers/mtd/mtdchar.c
+@@ -369,7 +369,7 @@ static int otp_select_filemode(struct mt
+ * Make a fake call to mtd_read_fact_prot_reg() to check if OTP
+ * operations are supported.
+ */
+- if (mtd_read_fact_prot_reg(mtd, -1, -1, &retlen, NULL) == -EOPNOTSUPP)
++ if (mtd_read_fact_prot_reg(mtd, -1, 0, &retlen, NULL) == -EOPNOTSUPP)
+ return -EOPNOTSUPP;
+
+ switch (mode) {
--- /dev/null
+From 42b64281453249dac52861f9b97d18552a7ec62b Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Fri, 27 Apr 2012 08:42:53 -0700
+Subject: percpu: pcpu_embed_first_chunk() should free unused parts after all allocs are complete
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 42b64281453249dac52861f9b97d18552a7ec62b upstream.
+
+pcpu_embed_first_chunk() allocates memory for each node, copies percpu
+data and frees unused portions of it before proceeding to the next
+group. This assumes that allocations for different nodes doesn't
+overlap; however, depending on memory topology, the bootmem allocator
+may end up allocating memory from a different node than the requested
+one which may overlap with the portion freed from one of the previous
+percpu areas. This leads to percpu groups for different nodes
+overlapping which is a serious bug.
+
+This patch separates out copy & partial free from the allocation loop
+such that all allocations are complete before partial frees happen.
+
+This also fixes overlapping frees which could happen on allocation
+failure path - out_free_areas path frees whole groups but the groups
+could have portions freed at that point.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: "Pavel V. Panteleev" <pp_84@mail.ru>
+Tested-by: "Pavel V. Panteleev" <pp_84@mail.ru>
+LKML-Reference: <E1SNhwY-0007ui-V7.pp_84-mail-ru@f220.mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/percpu.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/mm/percpu.c
++++ b/mm/percpu.c
+@@ -1650,6 +1650,16 @@ int __init pcpu_embed_first_chunk(size_t
+ areas[group] = ptr;
+
+ base = min(ptr, base);
++ }
++
++ /*
++ * Copy data and free unused parts. This should happen after all
++ * allocations are complete; otherwise, we may end up with
++ * overlapping groups.
++ */
++ for (group = 0; group < ai->nr_groups; group++) {
++ struct pcpu_group_info *gi = &ai->groups[group];
++ void *ptr = areas[group];
+
+ for (i = 0; i < gi->nr_units; i++, ptr += ai->unit_size) {
+ if (gi->cpu_map[i] == NR_CPUS) {
usbnet-fix-skb-traversing-races-during-unlink-v2.patch
namespaces-pid_ns-fix-leakage-on-fork-failure.patch
sparc64-do-not-clobber-g2-in-xcall_fetch_glob_regs.patch
+media-marvell-cam-fix-an-arm-build-error.patch
+arm-7417-1-vfp-ensure-preemption-is-disabled-when-enabling-vfp-access.patch
+arm-prevent-vm_growsdown-mmaps-extending-below-first_user_address.patch
+media-s5p-fimc-fix-locking-in-subdev-set_crop-op.patch
+media-rc-postpone-isr-registration.patch
+media-dvb_frontend-fix-a-regression-with-dvb-s-zig-zag.patch
+asoc-cs42l73-sync-digital-mixer-kcontrols-to-allow-for-0db.patch
+asoc-wm8994-fix-aif2adc-power-down.patch
+cdc_ether-ignore-bogus-union-descriptor-for-rndis-devices.patch
+cdc_ether-add-novatel-usb551l-device-ids-for-flag_wwan.patch
+percpu-pcpu_embed_first_chunk-should-free-unused-parts-after-all-allocs-are-complete.patch
+kmemleak-fix-the-kmemleak-tracking-of-the-percpu-areas-with-smp.patch
+mtd-fix-oops-in-dataflash-driver.patch
+hugetlb-prevent-bug_on-in-hugetlb_fault-hugetlb_cow.patch
+mm-nobootmem-fix-sign-extend-problem-in-__free_pages_memory.patch
+jffs2-fix-lock-acquisition-order-bug-in-gc-path.patch
+arch-tile-apply-commit-74fca9da0-to-the-compat-signal-handling-as-well.patch
+crypto-mv_cesa-requires-on-crypto_hash-to-build.patch
+target-drop-incorrect-se_lun_acl-release-for-dynamic-explict-acl-conversion.patch
+target-fix-spc-2-release-bug-for-multi-session-iscsi-client-setups.patch
+target-fix-bug-in-handling-of-fileio-block_device-resize-ops.patch
+virtio-console-tell-host-of-open-ports-after-resume-from-s3-s4.patch
+dm-mpath-check-if-scsi_dh-module-already-loaded-before-trying-to-load.patch
+e1000-prevent-reset-task-killing-itself.patch
+md-add-del_timer_sync-to-mddev_suspend-fix-nasty-panic.patch
+tcp-do_tcp_sendpages-must-try-to-push-data-out-on-oom-conditions.patch
+init-don-t-try-mounting-device-as-nfs-root-unless-type-fully-matches.patch
--- /dev/null
+From cfebf8f42f47327fa54cf05c19b98f4bd5236a26 Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Thu, 10 May 2012 22:05:49 -0700
+Subject: target: Drop incorrect se_lun_acl release for dynamic -> explict ACL conversion
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit cfebf8f42f47327fa54cf05c19b98f4bd5236a26 upstream.
+
+This patch removes some potentially problematic legacy code within
+core_clear_initiator_node_from_tpg() that was originally intended to
+release left over se_lun_acl setup during dynamic NodeACL+MappedLUN
+generate when running with TPG demo-mode operation.
+
+Since we now only ever expect to allocate and release se_lun_acl from
+within target_core_fabric_configfs.c:target_fabric_make_mappedlun() and
+target_fabric_drop_mappedlun() context respectively, this code for
+demo-mode release is incorrect and needs to be removed.
+
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Andy Grover <agrover@redhat.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_tpg.c | 22 ----------------------
+ 1 file changed, 22 deletions(-)
+
+--- a/drivers/target/target_core_tpg.c
++++ b/drivers/target/target_core_tpg.c
+@@ -60,7 +60,6 @@ static void core_clear_initiator_node_fr
+ int i;
+ struct se_dev_entry *deve;
+ struct se_lun *lun;
+- struct se_lun_acl *acl, *acl_tmp;
+
+ spin_lock_irq(&nacl->device_list_lock);
+ for (i = 0; i < TRANSPORT_MAX_LUNS_PER_TPG; i++) {
+@@ -81,28 +80,7 @@ static void core_clear_initiator_node_fr
+ core_update_device_list_for_node(lun, NULL, deve->mapped_lun,
+ TRANSPORT_LUNFLAGS_NO_ACCESS, nacl, tpg, 0);
+
+- spin_lock(&lun->lun_acl_lock);
+- list_for_each_entry_safe(acl, acl_tmp,
+- &lun->lun_acl_list, lacl_list) {
+- if (!strcmp(acl->initiatorname, nacl->initiatorname) &&
+- (acl->mapped_lun == deve->mapped_lun))
+- break;
+- }
+-
+- if (!acl) {
+- pr_err("Unable to locate struct se_lun_acl for %s,"
+- " mapped_lun: %u\n", nacl->initiatorname,
+- deve->mapped_lun);
+- spin_unlock(&lun->lun_acl_lock);
+- spin_lock_irq(&nacl->device_list_lock);
+- continue;
+- }
+-
+- list_del(&acl->lacl_list);
+- spin_unlock(&lun->lun_acl_lock);
+-
+ spin_lock_irq(&nacl->device_list_lock);
+- kfree(acl);
+ }
+ spin_unlock_irq(&nacl->device_list_lock);
+ }
--- /dev/null
+From cd9323fd68aee3c1c6b5b21e5746c9d1b586fb58 Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Wed, 16 May 2012 16:05:26 -0700
+Subject: target: Fix bug in handling of FILEIO + block_device resize ops
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit cd9323fd68aee3c1c6b5b21e5746c9d1b586fb58 upstream.
+
+This patch fixes a bug in the handling of FILEIO w/ underlying block_device
+resize operations where the original fd_dev->fd_dev_size was incorrectly being
+used in fd_get_blocks() for READ_CAPACITY response payloads.
+
+This patch avoids using fd_dev->fd_dev_size for FILEIO devices with
+an underlying block_device, and instead changes fd_get_blocks() to
+get the sector count directly from i_size_read() as recommended by hch.
+
+Reported-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_file.c | 22 ++++++++++++++++------
+ 1 file changed, 16 insertions(+), 6 deletions(-)
+
+--- a/drivers/target/target_core_file.c
++++ b/drivers/target/target_core_file.c
+@@ -169,6 +169,7 @@ static struct se_device *fd_create_virtd
+ inode = file->f_mapping->host;
+ if (S_ISBLK(inode->i_mode)) {
+ struct request_queue *q;
++ unsigned long long dev_size;
+ /*
+ * Setup the local scope queue_limits from struct request_queue->limits
+ * to pass into transport_add_device_to_core_hba() as struct se_dev_limits.
+@@ -183,13 +184,12 @@ static struct se_device *fd_create_virtd
+ * one (1) logical sector from underlying struct block_device
+ */
+ fd_dev->fd_block_size = bdev_logical_block_size(inode->i_bdev);
+- fd_dev->fd_dev_size = (i_size_read(file->f_mapping->host) -
++ dev_size = (i_size_read(file->f_mapping->host) -
+ fd_dev->fd_block_size);
+
+ pr_debug("FILEIO: Using size: %llu bytes from struct"
+ " block_device blocks: %llu logical_block_size: %d\n",
+- fd_dev->fd_dev_size,
+- div_u64(fd_dev->fd_dev_size, fd_dev->fd_block_size),
++ dev_size, div_u64(dev_size, fd_dev->fd_block_size),
+ fd_dev->fd_block_size);
+ } else {
+ if (!(fd_dev->fbd_flags & FBDF_HAS_SIZE)) {
+@@ -605,10 +605,20 @@ static u32 fd_get_device_type(struct se_
+ static sector_t fd_get_blocks(struct se_device *dev)
+ {
+ struct fd_dev *fd_dev = dev->dev_ptr;
+- unsigned long long blocks_long = div_u64(fd_dev->fd_dev_size,
+- dev->se_sub_dev->se_dev_attrib.block_size);
++ struct file *f = fd_dev->fd_file;
++ struct inode *i = f->f_mapping->host;
++ unsigned long long dev_size;
++ /*
++ * When using a file that references an underlying struct block_device,
++ * ensure dev_size is always based on the current inode size in order
++ * to handle underlying block_device resize operations.
++ */
++ if (S_ISBLK(i->i_mode))
++ dev_size = (i_size_read(i) - fd_dev->fd_block_size);
++ else
++ dev_size = fd_dev->fd_dev_size;
+
+- return blocks_long;
++ return div_u64(dev_size, dev->se_sub_dev->se_dev_attrib.block_size);
+ }
+
+ static struct se_subsystem_api fileio_template = {
--- /dev/null
+From edc318d9fea6854df752ec8c645b960b0d5a1d23 Mon Sep 17 00:00:00 2001
+From: Bernhard Kohl <Riedel-und-Kohl@t-online.de>
+Date: Sun, 13 May 2012 23:39:37 +0200
+Subject: target: Fix SPC-2 RELEASE bug for multi-session iSCSI client setups
+
+From: Bernhard Kohl <Riedel-und-Kohl@t-online.de>
+
+commit edc318d9fea6854df752ec8c645b960b0d5a1d23 upstream.
+
+This patch addresses a bug in a special case for target core SPC-2 RELEASE
+logic where the same physical client (eg: iSCSI InitiatorName) with
+differing iSCSI session identifiers (ISID) is allowed to incorrectly release
+the same client's SPC-2 reservation from the non reservation holding path.
+
+Note this bug is specific to iscsi-target w/ SPC-2 reservations, and
+with the default enforce_pr_isids=1 device attr setting in target-core
+controls if a InitiatorName + different ISID reservations are handled
+the same as a single iSCSI client entity.
+
+Signed-off-by: Bernhard Kohl <bernhard.kohl@gmx.net>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_pr.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/target/target_core_pr.c
++++ b/drivers/target/target_core_pr.c
+@@ -220,6 +220,9 @@ int target_scsi2_reservation_release(str
+ if (dev->dev_reserved_node_acl != sess->se_node_acl)
+ goto out_unlock;
+
++ if (dev->dev_res_bin_isid != sess->sess_bin_isid)
++ goto out_unlock;
++
+ dev->dev_reserved_node_acl = NULL;
+ dev->dev_flags &= ~DF_SPC2_RESERVATIONS;
+ if (dev->dev_flags & DF_SPC2_RESERVATIONS_WITH_ISID) {
--- /dev/null
+From bad115cfe5b509043b684d3a007ab54b80090aa1 Mon Sep 17 00:00:00 2001
+From: Willy Tarreau <w@1wt.eu>
+Date: Thu, 17 May 2012 11:14:14 +0000
+Subject: tcp: do_tcp_sendpages() must try to push data out on oom conditions
+
+From: Willy Tarreau <w@1wt.eu>
+
+commit bad115cfe5b509043b684d3a007ab54b80090aa1 upstream.
+
+Since recent changes on TCP splicing (starting with commits 2f533844
+"tcp: allow splice() to build full TSO packets" and 35f9c09f "tcp:
+tcp_sendpages() should call tcp_push() once"), I started seeing
+massive stalls when forwarding traffic between two sockets using
+splice() when pipe buffers were larger than socket buffers.
+
+Latest changes (net: netdev_alloc_skb() use build_skb()) made the
+problem even more apparent.
+
+The reason seems to be that if do_tcp_sendpages() fails on out of memory
+condition without being able to send at least one byte, tcp_push() is not
+called and the buffers cannot be flushed.
+
+After applying the attached patch, I cannot reproduce the stalls at all
+and the data rate it perfectly stable and steady under any condition
+which previously caused the problem to be permanent.
+
+The issue seems to have been there since before the kernel migrated to
+git, which makes me think that the stalls I occasionally experienced
+with tux during stress-tests years ago were probably related to the
+same issue.
+
+This issue was first encountered on 3.0.31 and 3.2.17, so please backport
+to -stable.
+
+Signed-off-by: Willy Tarreau <w@1wt.eu>
+Acked-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ipv4/tcp.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -849,8 +849,7 @@ new_segment:
+ wait_for_sndbuf:
+ set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
+ wait_for_memory:
+- if (copied)
+- tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
++ tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
+
+ if ((err = sk_stream_wait_memory(sk, &timeo)) != 0)
+ goto do_error;
--- /dev/null
+From fa8b66ccd2d200b64496cfedcce90bf54fe7d6e9 Mon Sep 17 00:00:00 2001
+From: Amit Shah <amit.shah@redhat.com>
+Date: Wed, 25 Apr 2012 14:40:39 +0530
+Subject: virtio: console: tell host of open ports after resume from s3/s4
+
+From: Amit Shah <amit.shah@redhat.com>
+
+commit fa8b66ccd2d200b64496cfedcce90bf54fe7d6e9 upstream.
+
+If a port was open before going into one of the sleep states, the port
+can continue normal operation after restore. However, the host has to
+be told that the guest side of the connection is open to restore
+pre-suspend state.
+
+This wasn't noticed so far due to a bug in qemu that was fixed recently
+(which marked the guest-side connection as always open).
+
+Signed-off-by: Amit Shah <amit.shah@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/virtio_console.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/char/virtio_console.c
++++ b/drivers/char/virtio_console.c
+@@ -1901,6 +1901,13 @@ static int virtcons_restore(struct virti
+
+ /* Get port open/close status on the host */
+ send_control_msg(port, VIRTIO_CONSOLE_PORT_READY, 1);
++
++ /*
++ * If a port was open at the time of suspending, we
++ * have to let the host know that it's still open.
++ */
++ if (port->guest_connected)
++ send_control_msg(port, VIRTIO_CONSOLE_PORT_OPEN, 1);
+ }
+ return 0;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
