--- /dev/null
+From 25dc16f69892182192b1234594fd3cf342ad4195 Mon Sep 17 00:00:00 2001
+From: Anssi Hannula <anssi.hannula@iki.fi>
+Date: Tue, 13 Mar 2012 17:43:02 +0200
+Subject: ALSA: hda - fix printing of high HDMI sample rates
+
+From: Anssi Hannula <anssi.hannula@iki.fi>
+
+commit 25dc16f69892182192b1234594fd3cf342ad4195 upstream.
+
+A previous commit af65cbf296 (ALSA: hdmi: fix printout of SAD sampling
+rates) fixed the sample rates shown in /proc/asound/cardX/eldY and
+kernel log to not be entirely wrong. However, a missing rate from the
+array added in the patch causes HDMI rates 88.2 kHz, 96 kHz, 176.4 kHz,
+and 192 kHz to be shown as 96 kHz, 176.4 kHz, 192 kHz, and 384 kHz,
+respectively.
+
+Fix the reporting by adding the ALSA rate 64 kHz into the conversion
+array between 48 kHz and 88.2 kHz.
+
+Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
+Cc: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_eld.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/hda/hda_eld.c
++++ b/sound/pci/hda/hda_eld.c
+@@ -385,8 +385,8 @@ error:
+ static void hdmi_print_pcm_rates(int pcm, char *buf, int buflen)
+ {
+ static unsigned int alsa_rates[] = {
+- 5512, 8000, 11025, 16000, 22050, 32000, 44100, 48000, 88200,
+- 96000, 176400, 192000, 384000
++ 5512, 8000, 11025, 16000, 22050, 32000, 44100, 48000, 64000,
++ 88200, 96000, 176400, 192000, 384000
+ };
+ int i, j;
+
--- /dev/null
+From 70ac07bb633dee75ac554195b9a4d69adfa7803c Mon Sep 17 00:00:00 2001
+From: Timur Tabi <timur@freescale.com>
+Date: Fri, 16 Mar 2012 16:32:52 -0500
+Subject: ASoC: fsl: p1022ds: tell the WM8776 codec driver that it's the master
+
+From: Timur Tabi <timur@freescale.com>
+
+commit 70ac07bb633dee75ac554195b9a4d69adfa7803c upstream.
+
+The WM8776 codec driver requires the machine driver to set one of the
+SND_SOC_DAIFMT_CBx_xxx values. The P1022DS machine driver should be setting
+SND_SOC_DAIFMT_CBM_CFM, but since that value was zero, no one noticed.
+
+Commit 75d9ac46 ("ASoC: Allow DAI formats to be specified in the
+dai_link"), however, changed the value of SND_SOC_DAIFMT_CBM_CFM from zero
+to a non-zero value, which means that it now needs to be specifically set
+by the machine driver.
+
+We also set SND_SOC_DAIFMT_NB_NF, for the same reason.
+
+Signed-off-by: Timur Tabi <timur@freescale.com>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/fsl/p1022_ds.c | 24 ++++++++++++++++--------
+ 1 file changed, 16 insertions(+), 8 deletions(-)
+
+--- a/sound/soc/fsl/p1022_ds.c
++++ b/sound/soc/fsl/p1022_ds.c
+@@ -395,7 +395,8 @@ static int p1022_ds_probe(struct platfor
+ }
+
+ if (strcasecmp(sprop, "i2s-slave") == 0) {
+- mdata->dai_format = SND_SOC_DAIFMT_I2S;
++ mdata->dai_format = SND_SOC_DAIFMT_NB_NF |
++ SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_CBM_CFM;
+ mdata->codec_clk_direction = SND_SOC_CLOCK_OUT;
+ mdata->cpu_clk_direction = SND_SOC_CLOCK_IN;
+
+@@ -412,31 +413,38 @@ static int p1022_ds_probe(struct platfor
+ }
+ mdata->clk_frequency = be32_to_cpup(iprop);
+ } else if (strcasecmp(sprop, "i2s-master") == 0) {
+- mdata->dai_format = SND_SOC_DAIFMT_I2S;
++ mdata->dai_format = SND_SOC_DAIFMT_NB_NF |
++ SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_CBS_CFS;
+ mdata->codec_clk_direction = SND_SOC_CLOCK_IN;
+ mdata->cpu_clk_direction = SND_SOC_CLOCK_OUT;
+ } else if (strcasecmp(sprop, "lj-slave") == 0) {
+- mdata->dai_format = SND_SOC_DAIFMT_LEFT_J;
++ mdata->dai_format = SND_SOC_DAIFMT_NB_NF |
++ SND_SOC_DAIFMT_LEFT_J | SND_SOC_DAIFMT_CBM_CFM;
+ mdata->codec_clk_direction = SND_SOC_CLOCK_OUT;
+ mdata->cpu_clk_direction = SND_SOC_CLOCK_IN;
+ } else if (strcasecmp(sprop, "lj-master") == 0) {
+- mdata->dai_format = SND_SOC_DAIFMT_LEFT_J;
++ mdata->dai_format = SND_SOC_DAIFMT_NB_NF |
++ SND_SOC_DAIFMT_LEFT_J | SND_SOC_DAIFMT_CBS_CFS;
+ mdata->codec_clk_direction = SND_SOC_CLOCK_IN;
+ mdata->cpu_clk_direction = SND_SOC_CLOCK_OUT;
+ } else if (strcasecmp(sprop, "rj-slave") == 0) {
+- mdata->dai_format = SND_SOC_DAIFMT_RIGHT_J;
++ mdata->dai_format = SND_SOC_DAIFMT_NB_NF |
++ SND_SOC_DAIFMT_RIGHT_J | SND_SOC_DAIFMT_CBM_CFM;
+ mdata->codec_clk_direction = SND_SOC_CLOCK_OUT;
+ mdata->cpu_clk_direction = SND_SOC_CLOCK_IN;
+ } else if (strcasecmp(sprop, "rj-master") == 0) {
+- mdata->dai_format = SND_SOC_DAIFMT_RIGHT_J;
++ mdata->dai_format = SND_SOC_DAIFMT_NB_NF |
++ SND_SOC_DAIFMT_RIGHT_J | SND_SOC_DAIFMT_CBS_CFS;
+ mdata->codec_clk_direction = SND_SOC_CLOCK_IN;
+ mdata->cpu_clk_direction = SND_SOC_CLOCK_OUT;
+ } else if (strcasecmp(sprop, "ac97-slave") == 0) {
+- mdata->dai_format = SND_SOC_DAIFMT_AC97;
++ mdata->dai_format = SND_SOC_DAIFMT_NB_NF |
++ SND_SOC_DAIFMT_AC97 | SND_SOC_DAIFMT_CBM_CFM;
+ mdata->codec_clk_direction = SND_SOC_CLOCK_OUT;
+ mdata->cpu_clk_direction = SND_SOC_CLOCK_IN;
+ } else if (strcasecmp(sprop, "ac97-master") == 0) {
+- mdata->dai_format = SND_SOC_DAIFMT_AC97;
++ mdata->dai_format = SND_SOC_DAIFMT_NB_NF |
++ SND_SOC_DAIFMT_AC97 | SND_SOC_DAIFMT_CBS_CFS;
+ mdata->codec_clk_direction = SND_SOC_CLOCK_IN;
+ mdata->cpu_clk_direction = SND_SOC_CLOCK_OUT;
+ } else {
--- /dev/null
+From 273b72c8ce6b28df6b49423d775c3e59072c73c5 Mon Sep 17 00:00:00 2001
+From: Daniel Mack <zonque@gmail.com>
+Date: Mon, 19 Mar 2012 09:12:53 +0100
+Subject: ASoC: pxa-ssp: atomically set stream active masks
+
+From: Daniel Mack <zonque@gmail.com>
+
+commit 273b72c8ce6b28df6b49423d775c3e59072c73c5 upstream.
+
+PXA's SSP engine fails to take its current channel phase into account
+when enabling a stream while the engine is already running. This
+results in randomly swapped left/right channels on either the record
+or the playback side, depending on which one was enabled first.
+
+The following patch fixes this by factoring out the bit field
+modifications in question to a separate function that pauses the
+engine temporarily, modifies the bits and kicks it off again
+afterwards. Appearantly, a transition of SSCR0_SSE syncs both
+directions properly.
+
+The patch has been rolled out to quite a number of devices over the
+last weeks and seems to fix the issue reliably.
+
+Signed-off-by: Daniel Mack <zonque@gmail.com>
+Reported-and-tested-by: Sven Neumann <s.neumann@raumfeld.com>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/pxa/pxa-ssp.c | 61 ++++++++++++++++++++++++++++--------------------
+ 1 file changed, 36 insertions(+), 25 deletions(-)
+
+--- a/sound/soc/pxa/pxa-ssp.c
++++ b/sound/soc/pxa/pxa-ssp.c
+@@ -668,6 +668,38 @@ static int pxa_ssp_hw_params(struct snd_
+ return 0;
+ }
+
++static void pxa_ssp_set_running_bit(struct snd_pcm_substream *substream,
++ struct ssp_device *ssp, int value)
++{
++ uint32_t sscr0 = pxa_ssp_read_reg(ssp, SSCR0);
++ uint32_t sscr1 = pxa_ssp_read_reg(ssp, SSCR1);
++ uint32_t sspsp = pxa_ssp_read_reg(ssp, SSPSP);
++ uint32_t sssr = pxa_ssp_read_reg(ssp, SSSR);
++
++ if (value && (sscr0 & SSCR0_SSE))
++ pxa_ssp_write_reg(ssp, SSCR0, sscr0 & ~SSCR0_SSE);
++
++ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
++ if (value)
++ sscr1 |= SSCR1_TSRE;
++ else
++ sscr1 &= ~SSCR1_TSRE;
++ } else {
++ if (value)
++ sscr1 |= SSCR1_RSRE;
++ else
++ sscr1 &= ~SSCR1_RSRE;
++ }
++
++ pxa_ssp_write_reg(ssp, SSCR1, sscr1);
++
++ if (value) {
++ pxa_ssp_write_reg(ssp, SSSR, sssr);
++ pxa_ssp_write_reg(ssp, SSPSP, sspsp);
++ pxa_ssp_write_reg(ssp, SSCR0, sscr0 | SSCR0_SSE);
++ }
++}
++
+ static int pxa_ssp_trigger(struct snd_pcm_substream *substream, int cmd,
+ struct snd_soc_dai *cpu_dai)
+ {
+@@ -681,42 +713,21 @@ static int pxa_ssp_trigger(struct snd_pc
+ pxa_ssp_enable(ssp);
+ break;
+ case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+- val = pxa_ssp_read_reg(ssp, SSCR1);
+- if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+- val |= SSCR1_TSRE;
+- else
+- val |= SSCR1_RSRE;
+- pxa_ssp_write_reg(ssp, SSCR1, val);
++ pxa_ssp_set_running_bit(substream, ssp, 1);
+ val = pxa_ssp_read_reg(ssp, SSSR);
+ pxa_ssp_write_reg(ssp, SSSR, val);
+ break;
+ case SNDRV_PCM_TRIGGER_START:
+- val = pxa_ssp_read_reg(ssp, SSCR1);
+- if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+- val |= SSCR1_TSRE;
+- else
+- val |= SSCR1_RSRE;
+- pxa_ssp_write_reg(ssp, SSCR1, val);
+- pxa_ssp_enable(ssp);
++ pxa_ssp_set_running_bit(substream, ssp, 1);
+ break;
+ case SNDRV_PCM_TRIGGER_STOP:
+- val = pxa_ssp_read_reg(ssp, SSCR1);
+- if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+- val &= ~SSCR1_TSRE;
+- else
+- val &= ~SSCR1_RSRE;
+- pxa_ssp_write_reg(ssp, SSCR1, val);
++ pxa_ssp_set_running_bit(substream, ssp, 0);
+ break;
+ case SNDRV_PCM_TRIGGER_SUSPEND:
+ pxa_ssp_disable(ssp);
+ break;
+ case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+- val = pxa_ssp_read_reg(ssp, SSCR1);
+- if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+- val &= ~SSCR1_TSRE;
+- else
+- val &= ~SSCR1_RSRE;
+- pxa_ssp_write_reg(ssp, SSCR1, val);
++ pxa_ssp_set_running_bit(substream, ssp, 0);
+ break;
+
+ default:
--- /dev/null
+From f5bf18fa22f8c41a13eb8762c7373eb3a93a7333 Mon Sep 17 00:00:00 2001
+From: Nishanth Aravamudan <nacc@linux.vnet.ibm.com>
+Date: Wed, 21 Mar 2012 16:34:07 -0700
+Subject: bootmem/sparsemem: remove limit constraint in alloc_bootmem_section
+
+From: Nishanth Aravamudan <nacc@linux.vnet.ibm.com>
+
+commit f5bf18fa22f8c41a13eb8762c7373eb3a93a7333 upstream.
+
+While testing AMS (Active Memory Sharing) / CMO (Cooperative Memory
+Overcommit) on powerpc, we tripped the following:
+
+ kernel BUG at mm/bootmem.c:483!
+ cpu 0x0: Vector: 700 (Program Check) at [c000000000c03940]
+ pc: c000000000a62bd8: .alloc_bootmem_core+0x90/0x39c
+ lr: c000000000a64bcc: .sparse_early_usemaps_alloc_node+0x84/0x29c
+ sp: c000000000c03bc0
+ msr: 8000000000021032
+ current = 0xc000000000b0cce0
+ paca = 0xc000000001d80000
+ pid = 0, comm = swapper
+ kernel BUG at mm/bootmem.c:483!
+ enter ? for help
+ [c000000000c03c80] c000000000a64bcc
+ .sparse_early_usemaps_alloc_node+0x84/0x29c
+ [c000000000c03d50] c000000000a64f10 .sparse_init+0x12c/0x28c
+ [c000000000c03e20] c000000000a474f4 .setup_arch+0x20c/0x294
+ [c000000000c03ee0] c000000000a4079c .start_kernel+0xb4/0x460
+ [c000000000c03f90] c000000000009670 .start_here_common+0x1c/0x2c
+
+This is
+
+ BUG_ON(limit && goal + size > limit);
+
+and after some debugging, it seems that
+
+ goal = 0x7ffff000000
+ limit = 0x80000000000
+
+and sparse_early_usemaps_alloc_node ->
+sparse_early_usemaps_alloc_pgdat_section calls
+
+ return alloc_bootmem_section(usemap_size() * count, section_nr);
+
+This is on a system with 8TB available via the AMS pool, and as a quirk
+of AMS in firmware, all of that memory shows up in node 0. So, we end
+up with an allocation that will fail the goal/limit constraints.
+
+In theory, we could "fall-back" to alloc_bootmem_node() in
+sparse_early_usemaps_alloc_node(), but since we actually have HOTREMOVE
+defined, we'll BUG_ON() instead. A simple solution appears to be to
+unconditionally remove the limit condition in alloc_bootmem_section,
+meaning allocations are allowed to cross section boundaries (necessary
+for systems of this size).
+
+Johannes Weiner pointed out that if alloc_bootmem_section() no longer
+guarantees section-locality, we need check_usemap_section_nr() to print
+possible cross-dependencies between node descriptors and the usemaps
+allocated through it. That makes the two loops in
+sparse_early_usemaps_alloc_node() identical, so re-factor the code a
+bit.
+
+[akpm@linux-foundation.org: code simplification]
+Signed-off-by: Nishanth Aravamudan <nacc@us.ibm.com>
+Cc: Dave Hansen <haveblue@us.ibm.com>
+Cc: Anton Blanchard <anton@au1.ibm.com>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Ben Herrenschmidt <benh@kernel.crashing.org>
+Cc: Robert Jennings <rcj@linux.vnet.ibm.com>
+Acked-by: Johannes Weiner <hannes@cmpxchg.org>
+Acked-by: Mel Gorman <mgorman@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/bootmem.c | 5 ++---
+ mm/sparse.c | 30 +++++++++++-------------------
+ 2 files changed, 13 insertions(+), 22 deletions(-)
+
+--- a/mm/bootmem.c
++++ b/mm/bootmem.c
+@@ -766,14 +766,13 @@ void * __init alloc_bootmem_section(unsi
+ unsigned long section_nr)
+ {
+ bootmem_data_t *bdata;
+- unsigned long pfn, goal, limit;
++ unsigned long pfn, goal;
+
+ pfn = section_nr_to_pfn(section_nr);
+ goal = pfn << PAGE_SHIFT;
+- limit = section_nr_to_pfn(section_nr + 1) << PAGE_SHIFT;
+ bdata = &bootmem_node_data[early_pfn_to_nid(pfn)];
+
+- return alloc_bootmem_core(bdata, size, SMP_CACHE_BYTES, goal, limit);
++ return alloc_bootmem_core(bdata, size, SMP_CACHE_BYTES, goal, 0);
+ }
+ #endif
+
+--- a/mm/sparse.c
++++ b/mm/sparse.c
+@@ -353,29 +353,21 @@ static void __init sparse_early_usemaps_
+
+ usemap = sparse_early_usemaps_alloc_pgdat_section(NODE_DATA(nodeid),
+ usemap_count);
+- if (usemap) {
+- for (pnum = pnum_begin; pnum < pnum_end; pnum++) {
+- if (!present_section_nr(pnum))
+- continue;
+- usemap_map[pnum] = usemap;
+- usemap += size;
++ if (!usemap) {
++ usemap = alloc_bootmem_node(NODE_DATA(nodeid), size * usemap_count);
++ if (!usemap) {
++ printk(KERN_WARNING "%s: allocation failed\n", __func__);
++ return;
+ }
+- return;
+ }
+
+- usemap = alloc_bootmem_node(NODE_DATA(nodeid), size * usemap_count);
+- if (usemap) {
+- for (pnum = pnum_begin; pnum < pnum_end; pnum++) {
+- if (!present_section_nr(pnum))
+- continue;
+- usemap_map[pnum] = usemap;
+- usemap += size;
+- check_usemap_section_nr(nodeid, usemap_map[pnum]);
+- }
+- return;
++ for (pnum = pnum_begin; pnum < pnum_end; pnum++) {
++ if (!present_section_nr(pnum))
++ continue;
++ usemap_map[pnum] = usemap;
++ usemap += size;
++ check_usemap_section_nr(nodeid, usemap_map[pnum]);
+ }
+-
+- printk(KERN_WARNING "%s: allocation failed\n", __func__);
+ }
+
+ #ifndef CONFIG_SPARSEMEM_VMEMMAP
--- /dev/null
+From a05b0855fd15504972dba2358e5faa172a1e50ba Mon Sep 17 00:00:00 2001
+From: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
+Date: Wed, 21 Mar 2012 16:34:08 -0700
+Subject: hugetlbfs: avoid taking i_mutex from hugetlbfs_read()
+
+From: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
+
+commit a05b0855fd15504972dba2358e5faa172a1e50ba upstream.
+
+Taking i_mutex in hugetlbfs_read() can result in deadlock with mmap as
+explained below
+
+ Thread A:
+ read() on hugetlbfs
+ hugetlbfs_read() called
+ i_mutex grabbed
+ hugetlbfs_read_actor() called
+ __copy_to_user() called
+ page fault is triggered
+ Thread B, sharing address space with A:
+ mmap() the same file
+ ->mmap_sem is grabbed on task_B->mm->mmap_sem
+ hugetlbfs_file_mmap() is called
+ attempt to grab ->i_mutex and block waiting for A to give it up
+ Thread A:
+ pagefault handled blocked on attempt to grab task_A->mm->mmap_sem,
+ which happens to be the same thing as task_B->mm->mmap_sem. Block waiting
+ for B to give it up.
+
+AFAIU the i_mutex locking was added to hugetlbfs_read() as per
+http://lkml.indiana.edu/hypermail/linux/kernel/0707.2/3066.html to take
+care of the race between truncate and read. This patch fixes this by
+looking at page->mapping under lock_page() (find_lock_page()) to ensure
+that the inode didn't get truncated in the range during a parallel read.
+
+Ideally we can extend the patch to make sure we don't increase i_size in
+mmap. But that will break userspace, because applications will now have
+to use truncate(2) to increase i_size in hugetlbfs.
+
+Based on the original patch from Hillf Danton.
+
+Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+Cc: Hillf Danton <dhillf@gmail.com>
+Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Hugh Dickins <hughd@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/hugetlbfs/inode.c | 25 +++++++++----------------
+ 1 file changed, 9 insertions(+), 16 deletions(-)
+
+--- a/fs/hugetlbfs/inode.c
++++ b/fs/hugetlbfs/inode.c
+@@ -238,17 +238,10 @@ static ssize_t hugetlbfs_read(struct fil
+ loff_t isize;
+ ssize_t retval = 0;
+
+- mutex_lock(&inode->i_mutex);
+-
+ /* validate length */
+ if (len == 0)
+ goto out;
+
+- isize = i_size_read(inode);
+- if (!isize)
+- goto out;
+-
+- end_index = (isize - 1) >> huge_page_shift(h);
+ for (;;) {
+ struct page *page;
+ unsigned long nr, ret;
+@@ -256,18 +249,21 @@ static ssize_t hugetlbfs_read(struct fil
+
+ /* nr is the maximum number of bytes to copy from this page */
+ nr = huge_page_size(h);
++ isize = i_size_read(inode);
++ if (!isize)
++ goto out;
++ end_index = (isize - 1) >> huge_page_shift(h);
+ if (index >= end_index) {
+ if (index > end_index)
+ goto out;
+ nr = ((isize - 1) & ~huge_page_mask(h)) + 1;
+- if (nr <= offset) {
++ if (nr <= offset)
+ goto out;
+- }
+ }
+ nr = nr - offset;
+
+ /* Find the page */
+- page = find_get_page(mapping, index);
++ page = find_lock_page(mapping, index);
+ if (unlikely(page == NULL)) {
+ /*
+ * We have a HOLE, zero out the user-buffer for the
+@@ -279,17 +275,18 @@ static ssize_t hugetlbfs_read(struct fil
+ else
+ ra = 0;
+ } else {
++ unlock_page(page);
++
+ /*
+ * We have the page, copy it to user space buffer.
+ */
+ ra = hugetlbfs_read_actor(page, offset, buf, len, nr);
+ ret = ra;
++ page_cache_release(page);
+ }
+ if (ra < 0) {
+ if (retval == 0)
+ retval = ra;
+- if (page)
+- page_cache_release(page);
+ goto out;
+ }
+
+@@ -299,16 +296,12 @@ static ssize_t hugetlbfs_read(struct fil
+ index += offset >> huge_page_shift(h);
+ offset &= ~huge_page_mask(h);
+
+- if (page)
+- page_cache_release(page);
+-
+ /* short read or no more work */
+ if ((ret != nr) || (len == 0))
+ break;
+ }
+ out:
+ *ppos = ((loff_t)index << huge_page_shift(h)) + offset;
+- mutex_unlock(&inode->i_mutex);
+ return retval;
+ }
+
--- /dev/null
+From d06283341aee9e48eff1b068779d340785c635ce Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Sun, 26 Feb 2012 22:16:07 -0800
+Subject: iscsi-target: Fix dynamic -> explict NodeACL pointer reference
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit d06283341aee9e48eff1b068779d340785c635ce upstream.
+
+This patch fixes a free after use in lio_target_make_nodeacl() where
+iscsi_node_acl was referenced from the original se_nacl_new allocation,
+instead of from core_tpg_add_initiator_node_acl() in the case of dynamic
+-> explict NodeACL conversion.
+
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/iscsi/iscsi_target_configfs.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/target/iscsi/iscsi_target_configfs.c
++++ b/drivers/target/iscsi/iscsi_target_configfs.c
+@@ -812,9 +812,6 @@ static struct se_node_acl *lio_target_ma
+ if (!se_nacl_new)
+ return ERR_PTR(-ENOMEM);
+
+- acl = container_of(se_nacl_new, struct iscsi_node_acl,
+- se_node_acl);
+-
+ cmdsn_depth = ISCSI_TPG_ATTRIB(tpg)->default_cmdsn_depth;
+ /*
+ * se_nacl_new may be released by core_tpg_add_initiator_node_acl()
+@@ -825,7 +822,8 @@ static struct se_node_acl *lio_target_ma
+ if (IS_ERR(se_nacl))
+ return se_nacl;
+
+- stats_cg = &acl->se_node_acl.acl_fabric_stat_group;
++ acl = container_of(se_nacl, struct iscsi_node_acl, se_node_acl);
++ stats_cg = &se_nacl->acl_fabric_stat_group;
+
+ stats_cg->default_groups = kzalloc(sizeof(struct config_group) * 2,
+ GFP_KERNEL);
--- /dev/null
+From d335e6054db616bce3f040e659fa38440518ad1d Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Thu, 23 Feb 2012 17:28:43 -0800
+Subject: iscsi-target: Fix iscsit_alloc_buffs() failure cases
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit d335e6054db616bce3f040e659fa38440518ad1d upstream.
+
+Make iscsit_alloc_buffs() failure case for page_alloc_failed use correct
+__free_page() SGL pointer, and return -ENOMEM for iscsit_allocate_iovecs
+failure to push se_cmd->t_mem_sg release into iscsit_release_cmd()
+callback during iscsit_add_reject_from_cmd() connection reset.
+
+Also drop cmd->t_mem_sg = NULL assignment from page_alloc_failed
+failure case.
+
+Reported-by: Roland Dreier <roland@purestorage.com>
+Cc: Andy Grover <agrover@redhat.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/iscsi/iscsi_target.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -780,7 +780,7 @@ static int iscsit_alloc_buffs(struct isc
+ struct scatterlist *sgl;
+ u32 length = cmd->se_cmd.data_length;
+ int nents = DIV_ROUND_UP(length, PAGE_SIZE);
+- int i = 0, ret;
++ int i = 0, j = 0, ret;
+ /*
+ * If no SCSI payload is present, allocate the default iovecs used for
+ * iSCSI PDU Header
+@@ -821,17 +821,15 @@ static int iscsit_alloc_buffs(struct isc
+ */
+ ret = iscsit_allocate_iovecs(cmd);
+ if (ret < 0)
+- goto page_alloc_failed;
++ return -ENOMEM;
+
+ return 0;
+
+ page_alloc_failed:
+- while (i >= 0) {
+- __free_page(sg_page(&sgl[i]));
+- i--;
+- }
+- kfree(cmd->t_mem_sg);
+- cmd->t_mem_sg = NULL;
++ while (j < i)
++ __free_page(sg_page(&sgl[j++]));
++
++ kfree(sgl);
+ return -ENOMEM;
+ }
+
--- /dev/null
+From cc85b20780562d404e18a47b9b55b4a5102ae53e Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rjw@sisk.pl>
+Date: Tue, 13 Mar 2012 22:39:31 +0100
+Subject: PM / Domains: Fix handling of wakeup devices during system resume
+
+From: "Rafael J. Wysocki" <rjw@sisk.pl>
+
+commit cc85b20780562d404e18a47b9b55b4a5102ae53e upstream.
+
+During system suspend pm_genpd_suspend_noirq() checks if the given
+device is in a wakeup path (i.e. it appears to be needed for one or
+more wakeup devices to work or is a wakeup device itself) and if it
+needs to be "active" for wakeup to work. If that is the case, the
+function returns 0 without incrementing the device domain's counter
+of suspended devices and without executing genpd_stop_dev() for the
+device. In consequence, the device is not stopped (e.g. its clock
+isn't disabled) and power is always supplied to its domain in the
+resulting system sleep state.
+
+However, pm_genpd_resume_noirq() doesn't repeat that check and it
+runs genpd_start_dev() and decrements the domain's counter of
+suspended devices even for the wakeup device that weren't stopped by
+pm_genpd_suspend_noirq(). As a result, the start callback may be run
+unnecessarily for them and their domains' counters of suspended
+devices may become negative. Both outcomes aren't desirable, so fix
+pm_genpd_resume_noirq() to look for wakeup devices that might not be
+stopped by during system suspend.
+
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Tested-by: Simon Horman <horms@verge.net.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/power/domain.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/base/power/domain.c
++++ b/drivers/base/power/domain.c
+@@ -880,7 +880,8 @@ static int pm_genpd_resume_noirq(struct
+ if (IS_ERR(genpd))
+ return -EINVAL;
+
+- if (genpd->suspend_power_off)
++ if (genpd->suspend_power_off
++ || (dev->power.wakeup_path && genpd_dev_active_wakeup(genpd, dev)))
+ return 0;
+
+ /*
--- /dev/null
+From 615a445f7f8a077c145e737864ae59a4d8717882 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rjw@sisk.pl>
+Date: Tue, 13 Mar 2012 22:40:06 +0100
+Subject: PM / shmobile: Make CMT driver use pm_genpd_dev_always_on()
+
+From: "Rafael J. Wysocki" <rjw@sisk.pl>
+
+commit 615a445f7f8a077c145e737864ae59a4d8717882 upstream.
+
+Make the CMT clocksource driver mark its device as "always on"
+using pm_genpd_dev_always_on() to protect it from surprise power
+removals.
+
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Tested-by: Simon Horman <horms@verge.net.au>
+Acked-by: Paul Mundt <lethal@linux-sh.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clocksource/sh_cmt.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/clocksource/sh_cmt.c
++++ b/drivers/clocksource/sh_cmt.c
+@@ -32,6 +32,7 @@
+ #include <linux/sh_timer.h>
+ #include <linux/slab.h>
+ #include <linux/module.h>
++#include <linux/pm_domain.h>
+
+ struct sh_cmt_priv {
+ void __iomem *mapbase;
+@@ -689,6 +690,9 @@ static int __devinit sh_cmt_probe(struct
+ struct sh_cmt_priv *p = platform_get_drvdata(pdev);
+ int ret;
+
++ if (!is_early_platform_device(pdev))
++ pm_genpd_dev_always_on(&pdev->dev, true);
++
+ if (p) {
+ dev_info(&pdev->dev, "kept as earlytimer\n");
+ return 0;
--- /dev/null
+From 57d13370cfaf6017c68981e66ff5b3bf20a2705c Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rjw@sisk.pl>
+Date: Tue, 13 Mar 2012 22:40:14 +0100
+Subject: PM / shmobile: Make MTU2 driver use pm_genpd_dev_always_on()
+
+From: "Rafael J. Wysocki" <rjw@sisk.pl>
+
+commit 57d13370cfaf6017c68981e66ff5b3bf20a2705c upstream.
+
+Make the MTU2 clocksource driver mark its device as "always on"
+using pm_genpd_dev_always_on() to protect it from surprise power
+removals.
+
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Tested-by: Simon Horman <horms@verge.net.au>
+Acked-by: Paul Mundt <lethal@linux-sh.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clocksource/sh_mtu2.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/clocksource/sh_mtu2.c
++++ b/drivers/clocksource/sh_mtu2.c
+@@ -31,6 +31,7 @@
+ #include <linux/sh_timer.h>
+ #include <linux/slab.h>
+ #include <linux/module.h>
++#include <linux/pm_domain.h>
+
+ struct sh_mtu2_priv {
+ void __iomem *mapbase;
+@@ -306,6 +307,9 @@ static int __devinit sh_mtu2_probe(struc
+ struct sh_mtu2_priv *p = platform_get_drvdata(pdev);
+ int ret;
+
++ if (!is_early_platform_device(pdev))
++ pm_genpd_dev_always_on(&pdev->dev, true);
++
+ if (p) {
+ dev_info(&pdev->dev, "kept as earlytimer\n");
+ return 0;
--- /dev/null
+From 2ee619f9487c2acc1efdf2c78e68e2bd51b635fa Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rjw@sisk.pl>
+Date: Tue, 13 Mar 2012 22:40:00 +0100
+Subject: PM / shmobile: Make TMU driver use pm_genpd_dev_always_on()
+
+From: "Rafael J. Wysocki" <rjw@sisk.pl>
+
+commit 2ee619f9487c2acc1efdf2c78e68e2bd51b635fa upstream.
+
+Make the TMU clocksource driver mark its device as "always on"
+using pm_genpd_dev_always_on() to protect it from surprise power
+removals and make sh7372_add_standard_devices() add TMU devices on
+sh7372 to the A4R power domain so that their "always on" flags
+are taken into account as appropriate.
+
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Tested-by: Simon Horman <horms@verge.net.au>
+Acked-by: Paul Mundt <lethal@linux-sh.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-shmobile/setup-sh7372.c | 2 ++
+ drivers/clocksource/sh_tmu.c | 4 ++++
+ 2 files changed, 6 insertions(+)
+
+--- a/arch/arm/mach-shmobile/setup-sh7372.c
++++ b/arch/arm/mach-shmobile/setup-sh7372.c
+@@ -1043,6 +1043,8 @@ void __init sh7372_add_standard_devices(
+ sh7372_add_device_to_domain(&sh7372_a4r, &veu2_device);
+ sh7372_add_device_to_domain(&sh7372_a4r, &veu3_device);
+ sh7372_add_device_to_domain(&sh7372_a4r, &jpu_device);
++ sh7372_add_device_to_domain(&sh7372_a4r, &tmu00_device);
++ sh7372_add_device_to_domain(&sh7372_a4r, &tmu01_device);
+ }
+
+ void __init sh7372_add_early_devices(void)
+--- a/drivers/clocksource/sh_tmu.c
++++ b/drivers/clocksource/sh_tmu.c
+@@ -32,6 +32,7 @@
+ #include <linux/sh_timer.h>
+ #include <linux/slab.h>
+ #include <linux/module.h>
++#include <linux/pm_domain.h>
+
+ struct sh_tmu_priv {
+ void __iomem *mapbase;
+@@ -410,6 +411,9 @@ static int __devinit sh_tmu_probe(struct
+ struct sh_tmu_priv *p = platform_get_drvdata(pdev);
+ int ret;
+
++ if (!is_early_platform_device(pdev))
++ pm_genpd_dev_always_on(&pdev->dev, true);
++
+ if (p) {
+ dev_info(&pdev->dev, "kept as earlytimer\n");
+ return 0;
--- /dev/null
+From df1c7baba1b7b3053950f3845a6575aca47ba9ce Mon Sep 17 00:00:00 2001
+From: Mike Christie <michaelc@cs.wisc.edu>
+Date: Thu, 26 Jan 2012 21:13:09 -0600
+Subject: SCSI: iscsi: fix setting of pid from netlink skb
+
+From: Mike Christie <michaelc@cs.wisc.edu>
+
+commit df1c7baba1b7b3053950f3845a6575aca47ba9ce upstream.
+
+NETLINK_CREDS's pid now returns 0, so I guess we are supposed to
+be using NETLINK_CB. This changed while the patch to export the
+pid was getting merged upstream, so it was not noticed until both
+the network and iscsi changes were in the same tree.
+
+Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
+Signed-off-by: James Bottomley <JBottomley@Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/scsi_transport_iscsi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -1941,7 +1941,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, s
+ switch (nlh->nlmsg_type) {
+ case ISCSI_UEVENT_CREATE_SESSION:
+ err = iscsi_if_create_session(priv, ep, ev,
+- NETLINK_CREDS(skb)->pid,
++ NETLINK_CB(skb).pid,
+ ev->u.c_session.initial_cmdsn,
+ ev->u.c_session.cmds_max,
+ ev->u.c_session.queue_depth);
+@@ -1954,7 +1954,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, s
+ }
+
+ err = iscsi_if_create_session(priv, ep, ev,
+- NETLINK_CREDS(skb)->pid,
++ NETLINK_CB(skb).pid,
+ ev->u.c_bound_session.initial_cmdsn,
+ ev->u.c_bound_session.cmds_max,
+ ev->u.c_bound_session.queue_depth);
x86-ioapic-add-register-level-checks-to-detect-bogus-io-apic-entries.patch
mm-thp-fix-pmd_bad-triggering-in-code-paths-holding-mmap_sem-read-mode.patch
tpm-zero-buffer-whole-after-copying-to-userspace.patch
+pm-domains-fix-handling-of-wakeup-devices-during-system-resume.patch
+pm-shmobile-make-mtu2-driver-use-pm_genpd_dev_always_on.patch
+pm-shmobile-make-cmt-driver-use-pm_genpd_dev_always_on.patch
+pm-shmobile-make-tmu-driver-use-pm_genpd_dev_always_on.patch
+bootmem-sparsemem-remove-limit-constraint-in-alloc_bootmem_section.patch
+hugetlbfs-avoid-taking-i_mutex-from-hugetlbfs_read.patch
+asoc-fsl-p1022ds-tell-the-wm8776-codec-driver-that-it-s-the-master.patch
+asoc-pxa-ssp-atomically-set-stream-active-masks.patch
+tcm_loop-set-residual-field-for-scsi-commands.patch
+scsi-iscsi-fix-setting-of-pid-from-netlink-skb.patch
+iscsi-target-fix-iscsit_alloc_buffs-failure-cases.patch
+iscsi-target-fix-dynamic-explict-nodeacl-pointer-reference.patch
+alsa-hda-fix-printing-of-high-hdmi-sample-rates.patch
--- /dev/null
+From 6cf3fa6918baab0c447f1206f1cef9166ad04864 Mon Sep 17 00:00:00 2001
+From: Roland Dreier <roland@purestorage.com>
+Date: Tue, 14 Feb 2012 15:30:31 -0800
+Subject: tcm_loop: Set residual field for SCSI commands
+
+From: Roland Dreier <roland@purestorage.com>
+
+commit 6cf3fa6918baab0c447f1206f1cef9166ad04864 upstream.
+
+If the target core signals an over- or under-run, tcm_loop should call
+scsi_set_resid() to tell the SCSI midlayer about the residual data length.
+
+The difference can be seen by doing something like
+
+ strace -eioctl sg_raw -r 1024 /dev/sda 8 0 0 0 1 0 > /dev/null
+
+and looking at the "resid=" part of the SG_IO ioctl -- after this patch,
+the field is correctly reported as 512.
+
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/loopback/tcm_loop.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/target/loopback/tcm_loop.c
++++ b/drivers/target/loopback/tcm_loop.c
+@@ -855,6 +855,9 @@ static int tcm_loop_queue_data_in(struct
+
+ sc->result = SAM_STAT_GOOD;
+ set_host_byte(sc, DID_OK);
++ if ((se_cmd->se_cmd_flags & SCF_OVERFLOW_BIT) ||
++ (se_cmd->se_cmd_flags & SCF_UNDERFLOW_BIT))
++ scsi_set_resid(sc, se_cmd->residual_count);
+ sc->scsi_done(sc);
+ return 0;
+ }
+@@ -880,6 +883,9 @@ static int tcm_loop_queue_status(struct
+ sc->result = se_cmd->scsi_status;
+
+ set_host_byte(sc, DID_OK);
++ if ((se_cmd->se_cmd_flags & SCF_OVERFLOW_BIT) ||
++ (se_cmd->se_cmd_flags & SCF_UNDERFLOW_BIT))
++ scsi_set_resid(sc, se_cmd->residual_count);
+ sc->scsi_done(sc);
+ return 0;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
