--- /dev/null
+From 4542b6a0fa6b48d9ae6b41c1efeb618b7a221b2a Mon Sep 17 00:00:00 2001
+From: Dima Zavin <dima@android.com>
+Date: Thu, 29 Mar 2012 20:44:06 +0100
+Subject: ARM: 7365/1: drop unused parameter from flush_cache_user_range
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dima Zavin <dima@android.com>
+
+commit 4542b6a0fa6b48d9ae6b41c1efeb618b7a221b2a upstream.
+
+vma isn't used and flush_cache_user_range isn't a standard macro that
+is used on several archs with the same prototype. In fact only unicore32
+has a macro with the same name (with an identical implementation and no
+in-tree users).
+
+This is a part of a patch proposed by Dima Zavin (with Message-id:
+1272439931-12795-1-git-send-email-dima@android.com) that didn't get
+accepted.
+
+Cc: Dima Zavin <dima@android.com>
+Acked-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Cc: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ arch/arm/include/asm/cacheflush.h | 2 +-
+ arch/arm/kernel/traps.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/include/asm/cacheflush.h
++++ b/arch/arm/include/asm/cacheflush.h
+@@ -249,7 +249,7 @@ extern void flush_cache_page(struct vm_a
+ * Harvard caches are synchronised for the user space address range.
+ * This is used for the ARM private sys_cacheflush system call.
+ */
+-#define flush_cache_user_range(vma,start,end) \
++#define flush_cache_user_range(start,end) \
+ __cpuc_coherent_user_range((start) & PAGE_MASK, PAGE_ALIGN(end))
+
+ /*
+--- a/arch/arm/kernel/traps.c
++++ b/arch/arm/kernel/traps.c
+@@ -496,7 +496,7 @@ do_cache_op(unsigned long start, unsigne
+ if (end > vma->vm_end)
+ end = vma->vm_end;
+
+- flush_cache_user_range(vma, start, end);
++ flush_cache_user_range(start, end);
+ }
+ up_read(&mm->mmap_sem);
+ }
--- /dev/null
+From 435a7ef52db7d86e67a009b36cac1457f8972391 Mon Sep 17 00:00:00 2001
+From: Dima Zavin <dima@android.com>
+Date: Mon, 30 Apr 2012 10:26:14 +0100
+Subject: ARM: 7409/1: Do not call flush_cache_user_range with mmap_sem held
+
+From: Dima Zavin <dima@android.com>
+
+commit 435a7ef52db7d86e67a009b36cac1457f8972391 upstream.
+
+We can't be holding the mmap_sem while calling flush_cache_user_range
+because the flush can fault. If we fault on a user address, the
+page fault handler will try to take mmap_sem again. Since both places
+acquire the read lock, most of the time it succeeds. However, if another
+thread tries to acquire the write lock on the mmap_sem (e.g. mmap) in
+between the call to flush_cache_user_range and the fault, the down_read
+in do_page_fault will deadlock.
+
+[will: removed drop of vma parameter as already queued by rmk (7365/1)]
+
+Acked-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Dima Zavin <dima@android.com>
+Signed-off-by: John Stultz <john.stultz@linaro.org>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/kernel/traps.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm/kernel/traps.c
++++ b/arch/arm/kernel/traps.c
+@@ -496,7 +496,9 @@ do_cache_op(unsigned long start, unsigne
+ if (end > vma->vm_end)
+ end = vma->vm_end;
+
++ up_read(&mm->mmap_sem);
+ flush_cache_user_range(start, end);
++ return;
+ }
+ up_read(&mm->mmap_sem);
+ }
--- /dev/null
+From 1dfebb426cfd16e2080f8c95e00ca2462f2325d4 Mon Sep 17 00:00:00 2001
+From: Stephen Warren <swarren@nvidia.com>
+Date: Fri, 11 May 2012 18:01:38 -0600
+Subject: ARM: dt: tegra cardhu: fix typo in SDHCI node name
+
+From: Stephen Warren <swarren@nvidia.com>
+
+commit 1dfebb426cfd16e2080f8c95e00ca2462f2325d4 upstream.
+
+Cardhu's eMMC controller is on sdhci@78000600, not sdhci@78000400.
+Fix the typo. This roughly doubles the IO performance, since the
+support-8bit property actually takes effect.
+
+Signed-off-by: Stephen Warren <swarren@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/tegra-cardhu.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/tegra-cardhu.dts
++++ b/arch/arm/boot/dts/tegra-cardhu.dts
+@@ -64,7 +64,7 @@
+ status = "disable";
+ };
+
+- sdhci@78000400 {
++ sdhci@78000600 {
+ support-8bit;
+ };
+ };
--- /dev/null
+From 9868a060ccf769c08ec378a9829137e272e9a92c Mon Sep 17 00:00:00 2001
+From: Marcus Folkesson <marcus.folkesson@gmail.com>
+Date: Thu, 3 May 2012 15:56:36 +0200
+Subject: i2c: davinci: Free requested IRQ in remove
+
+From: Marcus Folkesson <marcus.folkesson@gmail.com>
+
+commit 9868a060ccf769c08ec378a9829137e272e9a92c upstream.
+
+The freed IRQ is not necessary the one requested in probe.
+Even if it was, with two or more i2c-controllers it will fails anyway.
+
+Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
+Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-davinci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-davinci.c
++++ b/drivers/i2c/busses/i2c-davinci.c
+@@ -755,7 +755,7 @@ static int davinci_i2c_remove(struct pla
+ dev->clk = NULL;
+
+ davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, 0);
+- free_irq(IRQ_I2C, dev);
++ free_irq(dev->irq, dev);
+ iounmap(dev->base);
+ kfree(dev);
+
--- /dev/null
+From c889e91d2cc22123f20f40dde0c0a91856a20eea Mon Sep 17 00:00:00 2001
+From: Laxman Dewangan <ldewangan@nvidia.com>
+Date: Mon, 7 May 2012 12:16:19 +0530
+Subject: i2c: tegra: notify transfer-complete after clearing status.
+
+From: Laxman Dewangan <ldewangan@nvidia.com>
+
+commit c889e91d2cc22123f20f40dde0c0a91856a20eea upstream.
+
+The notification of the transfer complete by calling complete()
+should be done after clearing all interrupt status.
+This avoids the race condition of misconfigure the i2c controller
+in multi-core environment.
+
+Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com>
+Acked-by: Stephen Warren <swarren@wwwdotorg.org>
+Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-tegra.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-tegra.c
++++ b/drivers/i2c/busses/i2c-tegra.c
+@@ -401,8 +401,6 @@ static irqreturn_t tegra_i2c_isr(int irq
+ disable_irq_nosync(i2c_dev->irq);
+ i2c_dev->irq_disabled = 1;
+ }
+-
+- complete(&i2c_dev->msg_complete);
+ goto err;
+ }
+
+@@ -411,7 +409,6 @@ static irqreturn_t tegra_i2c_isr(int irq
+ i2c_dev->msg_err |= I2C_ERR_NO_ACK;
+ if (status & I2C_INT_ARBITRATION_LOST)
+ i2c_dev->msg_err |= I2C_ERR_ARBITRATION_LOST;
+- complete(&i2c_dev->msg_complete);
+ goto err;
+ }
+
+@@ -429,14 +426,14 @@ static irqreturn_t tegra_i2c_isr(int irq
+ tegra_i2c_mask_irq(i2c_dev, I2C_INT_TX_FIFO_DATA_REQ);
+ }
+
++ i2c_writel(i2c_dev, status, I2C_INT_STATUS);
++ if (i2c_dev->is_dvc)
++ dvc_writel(i2c_dev, DVC_STATUS_I2C_DONE_INTR, DVC_STATUS);
++
+ if (status & I2C_INT_PACKET_XFER_COMPLETE) {
+ BUG_ON(i2c_dev->msg_buf_remaining);
+ complete(&i2c_dev->msg_complete);
+ }
+-
+- i2c_writel(i2c_dev, status, I2C_INT_STATUS);
+- if (i2c_dev->is_dvc)
+- dvc_writel(i2c_dev, DVC_STATUS_I2C_DONE_INTR, DVC_STATUS);
+ return IRQ_HANDLED;
+ err:
+ /* An error occurred, mask all interrupts */
+@@ -446,6 +443,8 @@ err:
+ i2c_writel(i2c_dev, status, I2C_INT_STATUS);
+ if (i2c_dev->is_dvc)
+ dvc_writel(i2c_dev, DVC_STATUS_I2C_DONE_INTR, DVC_STATUS);
++
++ complete(&i2c_dev->msg_complete);
+ return IRQ_HANDLED;
+ }
+
--- /dev/null
+From e2ad23d04c1304431ab5176c89b7b476ded2d995 Mon Sep 17 00:00:00 2001
+From: David Woodhouse <dwmw2@infradead.org>
+Date: Fri, 25 May 2012 17:42:54 +0100
+Subject: intel-iommu: Add device info into list before doing context mapping
+
+From: David Woodhouse <dwmw2@infradead.org>
+
+commit e2ad23d04c1304431ab5176c89b7b476ded2d995 upstream.
+
+Add device info into list before doing context mapping, because device
+info will be used by iommu_enable_dev_iotlb(). Without it, ATS won't get
+enabled as it should be.
+
+ATS, while a dubious decision from a security point of view, can be very
+important for performance.
+
+Signed-off-by: Xudong Hao <xudong.hao@intel.com>
+Signed-off-by: Xiantao Zhang <xiantao.zhang@intel.com>
+Acked-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/intel-iommu.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -2286,12 +2286,6 @@ static int domain_add_dev_info(struct dm
+ if (!info)
+ return -ENOMEM;
+
+- ret = domain_context_mapping(domain, pdev, translation);
+- if (ret) {
+- free_devinfo_mem(info);
+- return ret;
+- }
+-
+ info->segment = pci_domain_nr(pdev->bus);
+ info->bus = pdev->bus->number;
+ info->devfn = pdev->devfn;
+@@ -2304,6 +2298,17 @@ static int domain_add_dev_info(struct dm
+ pdev->dev.archdata.iommu = info;
+ spin_unlock_irqrestore(&device_domain_lock, flags);
+
++ ret = domain_context_mapping(domain, pdev, translation);
++ if (ret) {
++ spin_lock_irqsave(&device_domain_lock, flags);
++ list_del(&info->link);
++ list_del(&info->global);
++ pdev->dev.archdata.iommu = NULL;
++ spin_unlock_irqrestore(&device_domain_lock, flags);
++ free_devinfo_mem(info);
++ return ret;
++ }
++
+ return 0;
+ }
+
--- /dev/null
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Sun, 13 May 2012 20:09:38 +0300
+Subject: iommu: Fix off by one in dmar_get_fault_reason()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit fefe1ed1398b81e3fadc92d11d91162d343c8836 upstream.
+
+fault_reason - 0x20 == ARRAY_SIZE(irq_remap_fault_reasons) is
+one past the end of the array.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Joerg Roedel <joerg.roedel@amd.com>
+Cc: Youquan Song <youquan.song@intel.com>
+Cc: walter harms <wharms@bfs.de>
+Cc: Suresh Siddha <suresh.b.siddha@intel.com>
+Link: http://lkml.kernel.org/r/20120513170938.GA4280@elgon.mountain
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+[bwh: Backported to 3.2: s/irq_remap_fault_reasons/intr_remap_fault_reasons/]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iommu/dmar.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/iommu/dmar.c
++++ b/drivers/iommu/dmar.c
+@@ -1056,8 +1056,8 @@ static const char *intr_remap_fault_reas
+
+ const char *dmar_get_fault_reason(u8 fault_reason, int *fault_type)
+ {
+- if (fault_reason >= 0x20 && (fault_reason <= 0x20 +
+- ARRAY_SIZE(intr_remap_fault_reasons))) {
++ if (fault_reason >= 0x20 && (fault_reason - 0x20 <
++ ARRAY_SIZE(intr_remap_fault_reasons))) {
+ *fault_type = INTR_REMAP;
+ return intr_remap_fault_reasons[fault_reason - 0x20];
+ } else if (fault_reason < ARRAY_SIZE(dma_remap_fault_reasons)) {
--- /dev/null
+From a129a7c84582629741e5fa6f40026efcd7a65bd4 Mon Sep 17 00:00:00 2001
+From: Andi Kleen <andi@firstfloor.org>
+Date: Fri, 19 Nov 2010 13:16:22 +0100
+Subject: MCE: Fix vm86 handling for 32bit mce handler
+
+From: Andi Kleen <andi@firstfloor.org>
+
+commit a129a7c84582629741e5fa6f40026efcd7a65bd4 upstream.
+
+When running on 32bit the mce handler could misinterpret
+vm86 mode as ring 0. This can affect whether it does recovery
+or not; it was possible to panic when recovery was actually
+possible.
+
+Fix this by always forcing vm86 to look like ring 3.
+
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/cpu/mcheck/mce.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -437,6 +437,14 @@ static inline void mce_gather_info(struc
+ if (m->mcgstatus & (MCG_STATUS_RIPV|MCG_STATUS_EIPV)) {
+ m->ip = regs->ip;
+ m->cs = regs->cs;
++
++ /*
++ * When in VM86 mode make the cs look like ring 3
++ * always. This is a lie, but it's better than passing
++ * the additional vm86 bit around everywhere.
++ */
++ if (v8086_mode(regs))
++ m->cs |= 3;
+ }
+ /* Use accurate RIP reporting if available. */
+ if (rip_msr)
--- /dev/null
+From 0e9f480bb553d39ee06ccd45639ba7a5446a7b81 Mon Sep 17 00:00:00 2001
+From: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+Date: Tue, 24 Apr 2012 17:56:29 +0200
+Subject: mmc: cd-gpio: protect against NULL context in mmc_cd_gpio_free()
+
+From: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+
+commit 0e9f480bb553d39ee06ccd45639ba7a5446a7b81 upstream.
+
+Do not oops, even if mmc_cd_gpio_free() is mistakenly called on a driver
+cleanup path, even though a previous call to mmc_cd_gpio_request() failed.
+
+Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
+[stable@: please apply to 3.3-stable]
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/core/cd-gpio.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/mmc/core/cd-gpio.c
++++ b/drivers/mmc/core/cd-gpio.c
+@@ -73,6 +73,9 @@ void mmc_cd_gpio_free(struct mmc_host *h
+ {
+ struct mmc_cd_gpio *cd = host->hotplug.handler_priv;
+
++ if (!cd)
++ return;
++
+ free_irq(host->hotplug.irq, host);
+ gpio_free(cd->gpio);
+ kfree(cd);
--- /dev/null
+From db35f83ef47b5f180f2670d11f5f93992314ea09 Mon Sep 17 00:00:00 2001
+From: Ming Lei <ming.lei@canonical.com>
+Date: Thu, 17 May 2012 10:27:12 +0800
+Subject: mmc: omap_hsmmc: pass IRQF_ONESHOT to request_threaded_irq
+
+From: Ming Lei <ming.lei@canonical.com>
+
+commit db35f83ef47b5f180f2670d11f5f93992314ea09 upstream.
+
+The flag of IRQF_ONESHOT should be passed to request_threaded_irq,
+otherwise the following failure message should be dumped because
+hardware handler is defined as NULL:
+
+[ 3.383483] genirq: Threaded irq requested with handler=NULL and
+!ONESHOT for irq 368
+[ 3.392730] omap_hsmmc: probe of omap_hsmmc.0 failed with error -22
+
+The patch fixes one kernel hang bug which is caused by mmc card
+probe failure and root device can't be brought up.
+
+Signed-off-by: Ming Lei <ming.lei@canonical.com>
+Acked-by: Venkatraman S <svenkatr@ti.com>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/omap_hsmmc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/omap_hsmmc.c
++++ b/drivers/mmc/host/omap_hsmmc.c
+@@ -1969,7 +1969,7 @@ static int __devinit omap_hsmmc_probe(st
+ ret = request_threaded_irq(mmc_slot(host).card_detect_irq,
+ NULL,
+ omap_hsmmc_detect,
+- IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
++ IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
+ mmc_hostname(mmc), host);
+ if (ret) {
+ dev_dbg(mmc_dev(host->mmc),
--- /dev/null
+From bbbc4c4d8c5face097d695f9bf3a39647ba6b7e7 Mon Sep 17 00:00:00 2001
+From: Nicolas Pitre <nicolas.pitre@linaro.org>
+Date: Mon, 16 Apr 2012 19:16:54 -0400
+Subject: mmc: sdio: avoid spurious calls to interrupt handlers
+
+From: Nicolas Pitre <nicolas.pitre@linaro.org>
+
+commit bbbc4c4d8c5face097d695f9bf3a39647ba6b7e7 upstream.
+
+Commit 06e8935feb ("optimized SDIO IRQ handling for single irq")
+introduced some spurious calls to SDIO function interrupt handlers,
+such as when the SDIO IRQ thread is started, or the safety check
+performed upon a system resume. Let's add a flag to perform the
+optimization only when a real interrupt is signaled by the host
+driver and we know there is no point confirming it.
+
+Reported-by: Sujit Reddy Thumma <sthumma@codeaurora.org>
+Signed-off-by: Nicolas Pitre <nico@linaro.org>
+Signed-off-by: Chris Ball <cjb@laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/core/sdio.c | 2 +-
+ drivers/mmc/core/sdio_irq.c | 11 +++++++----
+ include/linux/mmc/host.h | 2 ++
+ 3 files changed, 10 insertions(+), 5 deletions(-)
+
+--- a/drivers/mmc/core/sdio.c
++++ b/drivers/mmc/core/sdio.c
+@@ -947,7 +947,7 @@ static int mmc_sdio_resume(struct mmc_ho
+ }
+
+ if (!err && host->sdio_irqs)
+- mmc_signal_sdio_irq(host);
++ wake_up_process(host->sdio_irq_thread);
+ mmc_release_host(host);
+
+ /*
+--- a/drivers/mmc/core/sdio_irq.c
++++ b/drivers/mmc/core/sdio_irq.c
+@@ -28,18 +28,20 @@
+
+ #include "sdio_ops.h"
+
+-static int process_sdio_pending_irqs(struct mmc_card *card)
++static int process_sdio_pending_irqs(struct mmc_host *host)
+ {
++ struct mmc_card *card = host->card;
+ int i, ret, count;
+ unsigned char pending;
+ struct sdio_func *func;
+
+ /*
+ * Optimization, if there is only 1 function interrupt registered
+- * call irq handler directly
++ * and we know an IRQ was signaled then call irq handler directly.
++ * Otherwise do the full probe.
+ */
+ func = card->sdio_single_irq;
+- if (func) {
++ if (func && host->sdio_irq_pending) {
+ func->irq_handler(func);
+ return 1;
+ }
+@@ -116,7 +118,8 @@ static int sdio_irq_thread(void *_host)
+ ret = __mmc_claim_host(host, &host->sdio_irq_thread_abort);
+ if (ret)
+ break;
+- ret = process_sdio_pending_irqs(host->card);
++ ret = process_sdio_pending_irqs(host);
++ host->sdio_irq_pending = false;
+ mmc_release_host(host);
+
+ /*
+--- a/include/linux/mmc/host.h
++++ b/include/linux/mmc/host.h
+@@ -297,6 +297,7 @@ struct mmc_host {
+
+ unsigned int sdio_irqs;
+ struct task_struct *sdio_irq_thread;
++ bool sdio_irq_pending;
+ atomic_t sdio_irq_thread_abort;
+
+ mmc_pm_flag_t pm_flags; /* requested pm features */
+@@ -352,6 +353,7 @@ extern int mmc_cache_ctrl(struct mmc_hos
+ static inline void mmc_signal_sdio_irq(struct mmc_host *host)
+ {
+ host->ops->enable_sdio_irq(host, 0);
++ host->sdio_irq_pending = true;
+ wake_up_process(host->sdio_irq_thread);
+ }
+
nouveau-nouveau_set_bo_placement-takes-ttm-flags.patch
smsusb-add-autodetection-support-for-usb-id-2040-c0a0.patch
media-uvcvideo-fix-enuminput-handling.patch
+x86-relocs-build-clean-fix.patch
+x86-32-relocs-whitelist-more-symbols-for-ld-bug-workaround.patch
+x86-relocs-add-jiffies-and-jiffies_64-to-the-relative-whitelist.patch
+x86-mce-fix-check-for-processor-context-when-machine-check-was-taken.patch
+mmc-sdio-avoid-spurious-calls-to-interrupt-handlers.patch
+mmc-cd-gpio-protect-against-null-context-in-mmc_cd_gpio_free.patch
+mmc-omap_hsmmc-pass-irqf_oneshot-to-request_threaded_irq.patch
+tile-fix-bug-where-fls-0-was-not-returning-0.patch
+intel-iommu-add-device-info-into-list-before-doing-context-mapping.patch
+iommu-fix-off-by-one-in-dmar_get_fault_reason.patch
+arm-7365-1-drop-unused-parameter-from-flush_cache_user_range.patch
+arm-7409-1-do-not-call-flush_cache_user_range-with-mmap_sem-held.patch
+arm-dt-tegra-cardhu-fix-typo-in-sdhci-node-name.patch
+mce-fix-vm86-handling-for-32bit-mce-handler.patch
+i2c-davinci-free-requested-irq-in-remove.patch
+i2c-tegra-notify-transfer-complete-after-clearing-status.patch
--- /dev/null
+From 9f1d62bed7f015d11b9164078b7fea433b474114 Mon Sep 17 00:00:00 2001
+From: Chris Metcalf <cmetcalf@tilera.com>
+Date: Fri, 25 May 2012 12:32:09 -0400
+Subject: tile: fix bug where fls(0) was not returning 0
+
+From: Chris Metcalf <cmetcalf@tilera.com>
+
+commit 9f1d62bed7f015d11b9164078b7fea433b474114 upstream.
+
+This is because __builtin_clz(0) returns 64 for the "undefined" case
+of 0, since the builtin just does a right-shift 32 and "clz" instruction.
+So, use the alpha approach of casting to u32 and using __builtin_clzll().
+
+Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/tile/include/asm/bitops.h | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/arch/tile/include/asm/bitops.h
++++ b/arch/tile/include/asm/bitops.h
+@@ -77,6 +77,11 @@ static inline int ffs(int x)
+ return __builtin_ffs(x);
+ }
+
++static inline int fls64(__u64 w)
++{
++ return (sizeof(__u64) * 8) - __builtin_clzll(w);
++}
++
+ /**
+ * fls - find last set bit in word
+ * @x: the word to search
+@@ -90,12 +95,7 @@ static inline int ffs(int x)
+ */
+ static inline int fls(int x)
+ {
+- return (sizeof(int) * 8) - __builtin_clz(x);
+-}
+-
+-static inline int fls64(__u64 w)
+-{
+- return (sizeof(__u64) * 8) - __builtin_clzll(w);
++ return fls64((unsigned int) x);
+ }
+
+ static inline unsigned int __arch_hweight32(unsigned int w)
--- /dev/null
+From fd952815307f0f272bf49fd364a7fd2f9992bc42 Mon Sep 17 00:00:00 2001
+From: "H. Peter Anvin" <hpa@zytor.com>
+Date: Wed, 23 May 2012 14:02:34 -0700
+Subject: x86-32, relocs: Whitelist more symbols for ld bug workaround
+
+From: "H. Peter Anvin" <hpa@zytor.com>
+
+commit fd952815307f0f272bf49fd364a7fd2f9992bc42 upstream.
+
+As noted in checkin:
+
+a3e854d95 x86, relocs: Workaround for binutils 2.22.52.0.1 section bug
+
+ld version 2.22.52.0.[12] can incorrectly promote relative symbols to
+absolute, if the output section they appear in is otherwise empty.
+
+Since checkin:
+
+6520fe55 x86, realmode: 16-bit real-mode code support for relocs tool
+
+we actually check for this and error out rather than silently creating
+a kernel which will malfunction if relocated.
+
+Ingo found a configuration in which __start_builtin_fw triggered the
+warning.
+
+Go through the linker script sources and look for more symbols that
+could plausibly get bogusly promoted to absolute, and add them to the
+whitelist.
+
+In general, if the following error triggers:
+
+ Invalid absolute R_386_32 relocation: <symbol>
+
+... then we should verify that <symbol> is really meant to be
+relocated, and add it and any related symbols manually to the S_REL
+regexp.
+
+Please note that 6520fe55 does not introduce the error, only the check
+for the error -- without 6520fe55 this version of ld will simply
+produce a corrupt kernel if CONFIG_RELOCATABLE is set on x86-32.
+
+Reported-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/tools/relocs.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/arch/x86/tools/relocs.c
++++ b/arch/x86/tools/relocs.c
+@@ -60,6 +60,17 @@ static const char * const sym_regex_kern
+ "__x86_cpu_dev_(start|end)|"
+ "(__parainstructions|__alt_instructions)(|_end)|"
+ "(__iommu_table|__apicdrivers|__smp_locks)(|_end)|"
++ "__(start|end)_pci_.*|"
++ "__(start|end)_builtin_fw|"
++ "__(start|stop)___ksymtab(|_gpl|_unused|_unused_gpl|_gpl_future)|"
++ "__(start|stop)___kcrctab(|_gpl|_unused|_unused_gpl|_gpl_future)|"
++ "__(start|stop)___param|"
++ "__(start|stop)___modver|"
++ "__(start|stop)___bug_table|"
++ "__tracedata_(start|end)|"
++ "__(start|stop)_notes|"
++ "__end_rodata|"
++ "__initramfs_start|"
+ "_end)$"
+ };
+
--- /dev/null
+From 875e26648cf9b6db9d8dc07b7959d7c61fb3f49c Mon Sep 17 00:00:00 2001
+From: Tony Luck <tony.luck@intel.com>
+Date: Wed, 23 May 2012 14:14:22 -0700
+Subject: x86/mce: Fix check for processor context when machine check was taken.
+
+From: Tony Luck <tony.luck@intel.com>
+
+commit 875e26648cf9b6db9d8dc07b7959d7c61fb3f49c upstream.
+
+Linus pointed out that there was no value is checking whether m->ip
+was zero - because zero is a legimate value. If we have a reliable
+(or faked in the VM86 case) "m->cs" we can use it to tell whether we
+were in user mode or kernelwhen the machine check hit.
+
+Reported-by: Linus Torvalds <torvalds@linuxfoundation.org>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/cpu/mcheck/mce-severity.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/arch/x86/kernel/cpu/mcheck/mce-severity.c
++++ b/arch/x86/kernel/cpu/mcheck/mce-severity.c
+@@ -165,15 +165,19 @@ static struct severity {
+ };
+
+ /*
+- * If the EIPV bit is set, it means the saved IP is the
+- * instruction which caused the MCE.
++ * If mcgstatus indicated that ip/cs on the stack were
++ * no good, then "m->cs" will be zero and we will have
++ * to assume the worst case (IN_KERNEL) as we actually
++ * have no idea what we were executing when the machine
++ * check hit.
++ * If we do have a good "m->cs" (or a faked one in the
++ * case we were executing in VM86 mode) we can use it to
++ * distinguish an exception taken in user from from one
++ * taken in the kernel.
+ */
+ static int error_context(struct mce *m)
+ {
+- if (m->mcgstatus & MCG_STATUS_EIPV)
+- return (m->ip && (m->cs & 3) == 3) ? IN_USER : IN_KERNEL;
+- /* Unknown, assume kernel */
+- return IN_KERNEL;
++ return ((m->cs & 3) == 3) ? IN_USER : IN_KERNEL;
+ }
+
+ int mce_severity(struct mce *m, int tolerant, char **msg)
--- /dev/null
+From ea17e7414bc62e8d3bde8d08e3df1d921c518c17 Mon Sep 17 00:00:00 2001
+From: "H. Peter Anvin" <hpa@zytor.com>
+Date: Thu, 24 May 2012 07:01:38 -0700
+Subject: x86, relocs: Add jiffies and jiffies_64 to the relative whitelist
+
+From: "H. Peter Anvin" <hpa@zytor.com>
+
+commit ea17e7414bc62e8d3bde8d08e3df1d921c518c17 upstream.
+
+The symbol jiffies is created in the linker script as an alias to
+jiffies_64. Unfortunately this is done outside any section, and
+apparently GNU ld 2.21 doesn't carry the section with it, so we end up
+with an absolute symbol and therefore a broken kernel.
+
+Add jiffies and jiffies_64 to the whitelist.
+
+The most disturbing bit with this discovery is that it shows that we
+have had multiple linker bugs in this area crossing multiple
+generations, and have been silently building bad kernels for some time.
+
+Link: http://lkml.kernel.org/r/20120524171604.0d98284f3affc643e9714470@canb.auug.org.au
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/tools/relocs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/x86/tools/relocs.c
++++ b/arch/x86/tools/relocs.c
+@@ -71,6 +71,7 @@ static const char * const sym_regex_kern
+ "__(start|stop)_notes|"
+ "__end_rodata|"
+ "__initramfs_start|"
++ "(jiffies|jiffies_64)|"
+ "_end)$"
+ };
+
--- /dev/null
+From b2d668da9307c4c163dd603d2bb3cadb10f9fd37 Mon Sep 17 00:00:00 2001
+From: Jarkko Sakkinen <jarkko.sakkinen@intel.com>
+Date: Mon, 21 May 2012 20:51:24 +0300
+Subject: x86, relocs: Build clean fix
+
+From: Jarkko Sakkinen <jarkko.sakkinen@intel.com>
+
+commit b2d668da9307c4c163dd603d2bb3cadb10f9fd37 upstream.
+
+relocs was not cleaned up when "make clean" is issued. This
+patch fixes the issue.
+
+Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@intel.com>
+Link: http://lkml.kernel.org/r/1337622684-6834-1-git-send-email-jarkko.sakkinen@intel.com
+Signed-off-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/x86/Makefile
++++ b/arch/x86/Makefile
+@@ -206,6 +206,7 @@ archclean:
+ $(Q)rm -rf $(objtree)/arch/i386
+ $(Q)rm -rf $(objtree)/arch/x86_64
+ $(Q)$(MAKE) $(clean)=$(boot)
++ $(Q)$(MAKE) $(clean)=arch/x86/tools
+
+ define archhelp
+ echo '* bzImage - Compressed kernel image (arch/x86/boot/bzImage)'
projects / thirdparty / kernel / stable-queue.git / commitdiff
