--- /dev/null
+From bda3a47c886664e86ee14eb79e9072b9e341f575 Mon Sep 17 00:00:00 2001
+From: Nikolaus Voss <n.voss@weinmann.de>
+Date: Tue, 17 Jan 2012 10:28:33 +0100
+Subject: at_hdmac: bugfix for enabling channel irq
+
+From: Nikolaus Voss <n.voss@weinmann.de>
+
+commit bda3a47c886664e86ee14eb79e9072b9e341f575 upstream.
+
+commit 463894705e4089d0ff69e7d877312d496ac70e5b deleted redundant
+chan_id and chancnt initialization in dma drivers as this is done
+in dma_async_device_register().
+
+However, atc_enable_irq() relied on chan_id set before registering
+the device, what left only channel 0 functional for this driver.
+
+This patch introduces atc_enable/disable_chan_irq() as a variant
+of atc_enable/disable_irq() with the channel as explicit argument.
+
+Signed-off-by: Nikolaus Voss <n.voss@weinmann.de>
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/at_hdmac.c | 4 ++--
+ drivers/dma/at_hdmac_regs.h | 17 ++++++++---------
+ 2 files changed, 10 insertions(+), 11 deletions(-)
+
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -1286,7 +1286,7 @@ static int __init at_dma_probe(struct pl
+
+ tasklet_init(&atchan->tasklet, atc_tasklet,
+ (unsigned long)atchan);
+- atc_enable_irq(atchan);
++ atc_enable_chan_irq(atdma, i);
+ }
+
+ /* set base routines */
+@@ -1353,7 +1353,7 @@ static int __exit at_dma_remove(struct p
+ struct at_dma_chan *atchan = to_at_dma_chan(chan);
+
+ /* Disable interrupts */
+- atc_disable_irq(atchan);
++ atc_disable_chan_irq(atdma, chan->chan_id);
+ tasklet_disable(&atchan->tasklet);
+
+ tasklet_kill(&atchan->tasklet);
+--- a/drivers/dma/at_hdmac_regs.h
++++ b/drivers/dma/at_hdmac_regs.h
+@@ -326,28 +326,27 @@ static void atc_dump_lli(struct at_dma_c
+ }
+
+
+-static void atc_setup_irq(struct at_dma_chan *atchan, int on)
++static void atc_setup_irq(struct at_dma *atdma, int chan_id, int on)
+ {
+- struct at_dma *atdma = to_at_dma(atchan->chan_common.device);
+- u32 ebci;
++ u32 ebci;
+
+ /* enable interrupts on buffer transfer completion & error */
+- ebci = AT_DMA_BTC(atchan->chan_common.chan_id)
+- | AT_DMA_ERR(atchan->chan_common.chan_id);
++ ebci = AT_DMA_BTC(chan_id)
++ | AT_DMA_ERR(chan_id);
+ if (on)
+ dma_writel(atdma, EBCIER, ebci);
+ else
+ dma_writel(atdma, EBCIDR, ebci);
+ }
+
+-static inline void atc_enable_irq(struct at_dma_chan *atchan)
++static void atc_enable_chan_irq(struct at_dma *atdma, int chan_id)
+ {
+- atc_setup_irq(atchan, 1);
++ atc_setup_irq(atdma, chan_id, 1);
+ }
+
+-static inline void atc_disable_irq(struct at_dma_chan *atchan)
++static void atc_disable_chan_irq(struct at_dma *atdma, int chan_id)
+ {
+- atc_setup_irq(atchan, 0);
++ atc_setup_irq(atdma, chan_id, 0);
+ }
+
+
--- /dev/null
+From 525895ba388c949aa906f26e3ec5cb1ab041f56b Mon Sep 17 00:00:00 2001
+From: Ben Skeggs <bskeggs@redhat.com>
+Date: Tue, 10 Jan 2012 10:18:28 +1000
+Subject: drm/nouveau/gem: fix fence_sync race / oops
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+commit 525895ba388c949aa906f26e3ec5cb1ab041f56b upstream.
+
+Due to a race it was possible for a fence to be destroyed while another
+thread was trying to synchronise with it. If this happened in the fallback
+non-semaphore path, it lead to the following oops due to fence->channel
+being NULL.
+
+BUG: unable to handle kernel NULL pointer dereference at (null)
+IP: [<fa9632ce>] nouveau_fence_update+0xe/0xe0 [nouveau]
+*pde = a649c067
+SMP
+Modules linked in: fuse nouveau(O) ttm(O) drm_kms_helper(O) drm(O) mxm_wmi video wmi netconsole configfs lockd bnep bluetooth rfkill ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack ip6table_filter ip6_tables snd_hda_codec_realtek snd_hda_intel snd_hda_cobinfmt_misc uinput ata_generic pata_acpi pata_aet2c_algo_bit i2c_core [last unloaded: wmi]
+
+Pid: 2255, comm: gnome-shell Tainted: G O 3.2.0-0.rc5.git0.1.fc17.i686 #1 System manufacturer System Product Name/M2A-VM
+EIP: 0060:[<fa9632ce>] EFLAGS: 00010296 CPU: 1
+EIP is at nouveau_fence_update+0xe/0xe0 [nouveau]
+EAX: 00000000 EBX: ddfc6dd0 ECX: dd111580 EDX: 00000000
+ESI: 00003e80 EDI: dd111580 EBP: dd121d00 ESP: dd121ce8
+ DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
+Process gnome-shell (pid: 2255, ti=dd120000 task=dd111580 task.ti=dd120000)
+Stack:
+ 7dc86c76 00000000 00003e80 ddfc6dd0 00003e80 dd111580 dd121d0c fa96371f
+ 00000000 dd121d3c fa963773 dd111580 01000246 000ec53d 00000000 ddfc6dd0
+ 00001f40 00000000 ddfc6dd0 00000010 dc7df840 dd121d6c fa9639a0 00000000
+Call Trace:
+ [<fa96371f>] __nouveau_fence_signalled+0x1f/0x30 [nouveau]
+ [<fa963773>] __nouveau_fence_wait+0x43/0xd0 [nouveau]
+ [<fa9639a0>] nouveau_fence_sync+0x1a0/0x1c0 [nouveau]
+ [<fa964046>] validate_list+0x176/0x300 [nouveau]
+ [<f7d9c9c0>] ? ttm_bo_mem_put+0x30/0x30 [ttm]
+ [<fa964b8a>] nouveau_gem_ioctl_pushbuf+0x48a/0xfd0 [nouveau]
+ [<c0406481>] ? die+0x31/0x80
+ [<f7c93d98>] drm_ioctl+0x388/0x490 [drm]
+ [<c0406481>] ? die+0x31/0x80
+ [<fa964700>] ? nouveau_gem_ioctl_new+0x150/0x150 [nouveau]
+ [<c0635c7b>] ? file_has_perm+0xcb/0xe0
+ [<f7c93a10>] ? drm_copy_field+0x80/0x80 [drm]
+ [<c0564f56>] do_vfs_ioctl+0x86/0x5b0
+ [<c0406481>] ? die+0x31/0x80
+ [<c0635f22>] ? selinux_file_ioctl+0x62/0x130
+ [<c0554f30>] ? fget_light+0x30/0x340
+ [<c05654ef>] sys_ioctl+0x6f/0x80
+ [<c099e3a4>] syscall_call+0x7/0xb
+ [<c0406481>] ? die+0x31/0x80
+ [<c0406481>] ? die+0x31/0x80
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/nouveau/nouveau_gem.c | 23 +++++++++++++++++++++--
+ 1 file changed, 21 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
++++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
+@@ -380,6 +380,25 @@ retry:
+ }
+
+ static int
++validate_sync(struct nouveau_channel *chan, struct nouveau_bo *nvbo)
++{
++ struct nouveau_fence *fence = NULL;
++ int ret = 0;
++
++ spin_lock(&nvbo->bo.bdev->fence_lock);
++ if (nvbo->bo.sync_obj)
++ fence = nouveau_fence_ref(nvbo->bo.sync_obj);
++ spin_unlock(&nvbo->bo.bdev->fence_lock);
++
++ if (fence) {
++ ret = nouveau_fence_sync(fence, chan);
++ nouveau_fence_unref(&fence);
++ }
++
++ return ret;
++}
++
++static int
+ validate_list(struct nouveau_channel *chan, struct list_head *list,
+ struct drm_nouveau_gem_pushbuf_bo *pbbo, uint64_t user_pbbo_ptr)
+ {
+@@ -393,7 +412,7 @@ validate_list(struct nouveau_channel *ch
+ list_for_each_entry(nvbo, list, entry) {
+ struct drm_nouveau_gem_pushbuf_bo *b = &pbbo[nvbo->pbbo_index];
+
+- ret = nouveau_fence_sync(nvbo->bo.sync_obj, chan);
++ ret = validate_sync(chan, nvbo);
+ if (unlikely(ret)) {
+ NV_ERROR(dev, "fail pre-validate sync\n");
+ return ret;
+@@ -416,7 +435,7 @@ validate_list(struct nouveau_channel *ch
+ return ret;
+ }
+
+- ret = nouveau_fence_sync(nvbo->bo.sync_obj, chan);
++ ret = validate_sync(chan, nvbo);
+ if (unlikely(ret)) {
+ NV_ERROR(dev, "fail post-validate sync\n");
+ return ret;
--- /dev/null
+From 86698c20f71d488b32c49ed4687fb3cf8a88a5ca Mon Sep 17 00:00:00 2001
+From: Seth Forshee <seth.forshee@canonical.com>
+Date: Tue, 31 Jan 2012 19:06:25 -0600
+Subject: drm/radeon/kms: disable output polling when suspended
+
+From: Seth Forshee <seth.forshee@canonical.com>
+
+commit 86698c20f71d488b32c49ed4687fb3cf8a88a5ca upstream.
+
+Polling the outputs when the device is suspended can result in erroneous
+status updates. Disable output polling during suspend to prevent this
+from happening.
+
+Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_device.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -864,6 +864,8 @@ int radeon_suspend_kms(struct drm_device
+ if (dev->switch_power_state == DRM_SWITCH_POWER_OFF)
+ return 0;
+
++ drm_kms_helper_poll_disable(dev);
++
+ /* turn off display hw */
+ list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+ drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
+@@ -950,6 +952,8 @@ int radeon_resume_kms(struct drm_device
+ list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+ drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
+ }
++
++ drm_kms_helper_poll_enable(dev);
+ return 0;
+ }
+
--- /dev/null
+From 304a48400d9718f74ec35ae46f30868a5f4c4516 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Thu, 2 Feb 2012 10:18:00 -0500
+Subject: drm/radeon/kms: fix TRAVIS panel setup
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 304a48400d9718f74ec35ae46f30868a5f4c4516 upstream.
+
+Different versions of the DP to LVDS bridge chip
+need different panel mode settings depending on
+the chip version used.
+
+Fixes:
+https://bugs.freedesktop.org/show_bug.cgi?id=41569
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/atombios_dp.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/atombios_dp.c
++++ b/drivers/gpu/drm/radeon/atombios_dp.c
+@@ -564,9 +564,21 @@ int radeon_dp_get_panel_mode(struct drm_
+ ENCODER_OBJECT_ID_NUTMEG)
+ panel_mode = DP_PANEL_MODE_INTERNAL_DP1_MODE;
+ else if (radeon_connector_encoder_get_dp_bridge_encoder_id(connector) ==
+- ENCODER_OBJECT_ID_TRAVIS)
+- panel_mode = DP_PANEL_MODE_INTERNAL_DP2_MODE;
+- else if (connector->connector_type == DRM_MODE_CONNECTOR_eDP) {
++ ENCODER_OBJECT_ID_TRAVIS) {
++ u8 id[6];
++ int i;
++ for (i = 0; i < 6; i++)
++ id[i] = radeon_read_dpcd_reg(radeon_connector, 0x503 + i);
++ if (id[0] == 0x73 &&
++ id[1] == 0x69 &&
++ id[2] == 0x76 &&
++ id[3] == 0x61 &&
++ id[4] == 0x72 &&
++ id[5] == 0x54)
++ panel_mode = DP_PANEL_MODE_INTERNAL_DP1_MODE;
++ else
++ panel_mode = DP_PANEL_MODE_INTERNAL_DP2_MODE;
++ } else if (connector->connector_type == DRM_MODE_CONNECTOR_eDP) {
+ u8 tmp = radeon_read_dpcd_reg(radeon_connector, DP_EDP_CONFIGURATION_CAP);
+ if (tmp & 1)
+ panel_mode = DP_PANEL_MODE_INTERNAL_DP2_MODE;
--- /dev/null
+From 1b61925061660009f5b8047f93c5297e04541273 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <michel.daenzer@amd.com>
+Date: Wed, 1 Feb 2012 12:09:55 +0100
+Subject: drm/radeon: Set DESKTOP_HEIGHT register to the framebuffer (not mode) height.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <michel.daenzer@amd.com>
+
+commit 1b61925061660009f5b8047f93c5297e04541273 upstream.
+
+The value of this register is transferred to the V_COUNTER register at the
+beginning of vertical blank. V_COUNTER is the reference for VLINE waits and
+goes from VIEWPORT_Y_START to VIEWPORT_Y_START+VIEWPORT_HEIGHT during scanout,
+so if VIEWPORT_Y_START is not 0, V_COUNTER actually went backwards at the
+beginning of vertical blank, and VLINE waits excluding the whole scanout area
+could never finish (possibly only if VIEWPORT_Y_START is larger than the length
+of vertical blank in scanlines). Setting DESKTOP_HEIGHT to the framebuffer
+height should prevent this for any kind of VLINE wait.
+
+Fixes https://bugs.freedesktop.org/show_bug.cgi?id=45329 .
+
+Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/atombios_crtc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -1189,7 +1189,7 @@ static int dce4_crtc_do_set_base(struct
+ WREG32(EVERGREEN_GRPH_ENABLE + radeon_crtc->crtc_offset, 1);
+
+ WREG32(EVERGREEN_DESKTOP_HEIGHT + radeon_crtc->crtc_offset,
+- crtc->mode.vdisplay);
++ target_fb->height);
+ x &= ~3;
+ y &= ~1;
+ WREG32(EVERGREEN_VIEWPORT_START + radeon_crtc->crtc_offset,
+@@ -1358,7 +1358,7 @@ static int avivo_crtc_do_set_base(struct
+ WREG32(AVIVO_D1GRPH_ENABLE + radeon_crtc->crtc_offset, 1);
+
+ WREG32(AVIVO_D1MODE_DESKTOP_HEIGHT + radeon_crtc->crtc_offset,
+- crtc->mode.vdisplay);
++ target_fb->height);
+ x &= ~3;
+ y &= ~1;
+ WREG32(AVIVO_D1MODE_VIEWPORT_START + radeon_crtc->crtc_offset,
--- /dev/null
+From 0bf380bc70ecba68cb4d74dc656cc2fa8c4d801a Mon Sep 17 00:00:00 2001
+From: Mel Gorman <mgorman@suse.de>
+Date: Fri, 3 Feb 2012 15:37:18 -0800
+Subject: mm: compaction: check pfn_valid when entering a new MAX_ORDER_NR_PAGES block during isolation for migration
+
+From: Mel Gorman <mgorman@suse.de>
+
+commit 0bf380bc70ecba68cb4d74dc656cc2fa8c4d801a upstream.
+
+When isolating for migration, migration starts at the start of a zone
+which is not necessarily pageblock aligned. Further, it stops isolating
+when COMPACT_CLUSTER_MAX pages are isolated so migrate_pfn is generally
+not aligned. This allows isolate_migratepages() to call pfn_to_page() on
+an invalid PFN which can result in a crash. This was originally reported
+against a 3.0-based kernel with the following trace in a crash dump.
+
+PID: 9902 TASK: d47aecd0 CPU: 0 COMMAND: "memcg_process_s"
+ #0 [d72d3ad0] crash_kexec at c028cfdb
+ #1 [d72d3b24] oops_end at c05c5322
+ #2 [d72d3b38] __bad_area_nosemaphore at c0227e60
+ #3 [d72d3bec] bad_area at c0227fb6
+ #4 [d72d3c00] do_page_fault at c05c72ec
+ #5 [d72d3c80] error_code (via page_fault) at c05c47a4
+ EAX: 00000000 EBX: 000c0000 ECX: 00000001 EDX: 00000807 EBP: 000c0000
+ DS: 007b ESI: 00000001 ES: 007b EDI: f3000a80 GS: 6f50
+ CS: 0060 EIP: c030b15a ERR: ffffffff EFLAGS: 00010002
+ #6 [d72d3cb4] isolate_migratepages at c030b15a
+ #7 [d72d3d14] zone_watermark_ok at c02d26cb
+ #8 [d72d3d2c] compact_zone at c030b8de
+ #9 [d72d3d68] compact_zone_order at c030bba1
+#10 [d72d3db4] try_to_compact_pages at c030bc84
+#11 [d72d3ddc] __alloc_pages_direct_compact at c02d61e7
+#12 [d72d3e08] __alloc_pages_slowpath at c02d66c7
+#13 [d72d3e78] __alloc_pages_nodemask at c02d6a97
+#14 [d72d3eb8] alloc_pages_vma at c030a845
+#15 [d72d3ed4] do_huge_pmd_anonymous_page at c03178eb
+#16 [d72d3f00] handle_mm_fault at c02f36c6
+#17 [d72d3f30] do_page_fault at c05c70ed
+#18 [d72d3fb0] error_code (via page_fault) at c05c47a4
+ EAX: b71ff000 EBX: 00000001 ECX: 00001600 EDX: 00000431
+ DS: 007b ESI: 08048950 ES: 007b EDI: bfaa3788
+ SS: 007b ESP: bfaa36e0 EBP: bfaa3828 GS: 6f50
+ CS: 0073 EIP: 080487c8 ERR: ffffffff EFLAGS: 00010202
+
+It was also reported by Herbert van den Bergh against 3.1-based kernel
+with the following snippet from the console log.
+
+BUG: unable to handle kernel paging request at 01c00008
+IP: [<c0522399>] isolate_migratepages+0x119/0x390
+*pdpt = 000000002f7ce001 *pde = 0000000000000000
+
+It is expected that it also affects 3.2.x and current mainline.
+
+The problem is that pfn_valid is only called on the first PFN being
+checked and that PFN is not necessarily aligned. Lets say we have a case
+like this
+
+H = MAX_ORDER_NR_PAGES boundary
+| = pageblock boundary
+m = cc->migrate_pfn
+f = cc->free_pfn
+o = memory hole
+
+H------|------H------|----m-Hoooooo|ooooooH-f----|------H
+
+The migrate_pfn is just below a memory hole and the free scanner is beyond
+the hole. When isolate_migratepages started, it scans from migrate_pfn to
+migrate_pfn+pageblock_nr_pages which is now in a memory hole. It checks
+pfn_valid() on the first PFN but then scans into the hole where there are
+not necessarily valid struct pages.
+
+This patch ensures that isolate_migratepages calls pfn_valid when
+necessary.
+
+Reported-by: Herbert van den Bergh <herbert.van.den.bergh@oracle.com>
+Tested-by: Herbert van den Bergh <herbert.van.den.bergh@oracle.com>
+Signed-off-by: Mel Gorman <mgorman@suse.de>
+Acked-by: Michal Nazarewicz <mina86@mina86.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/compaction.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/mm/compaction.c
++++ b/mm/compaction.c
+@@ -313,6 +313,19 @@ static isolate_migrate_t isolate_migrate
+ } else if (!locked)
+ spin_lock_irq(&zone->lru_lock);
+
++ /*
++ * migrate_pfn does not necessarily start aligned to a
++ * pageblock. Ensure that pfn_valid is called when moving
++ * into a new MAX_ORDER_NR_PAGES range in case of large
++ * memory holes within the zone
++ */
++ if ((low_pfn & (MAX_ORDER_NR_PAGES - 1)) == 0) {
++ if (!pfn_valid(low_pfn)) {
++ low_pfn += MAX_ORDER_NR_PAGES - 1;
++ continue;
++ }
++ }
++
+ if (!pfn_valid_within(low_pfn))
+ continue;
+ nr_scanned++;
--- /dev/null
+From 99f02ef1f18631eb0a4e0ea0a3d56878dbcb4b90 Mon Sep 17 00:00:00 2001
+From: Carsten Otte <carsteno@de.ibm.com>
+Date: Fri, 3 Feb 2012 15:37:14 -0800
+Subject: mm/filemap_xip.c: fix race condition in xip_file_fault()
+
+From: Carsten Otte <carsteno@de.ibm.com>
+
+commit 99f02ef1f18631eb0a4e0ea0a3d56878dbcb4b90 upstream.
+
+Fix a race condition that shows in conjunction with xip_file_fault() when
+two threads of the same user process fault on the same memory page.
+
+In this case, the race winner will install the page table entry and the
+unlucky loser will cause an oops: xip_file_fault calls vm_insert_pfn (via
+vm_insert_mixed) which drops out at this check:
+
+ retval = -EBUSY;
+ if (!pte_none(*pte))
+ goto out_unlock;
+
+The resulting -EBUSY return value will trigger a BUG_ON() in
+xip_file_fault.
+
+This fix simply considers the fault as fixed in this case, because the
+race winner has successfully installed the pte.
+
+[akpm@linux-foundation.org: use conventional (and consistent) comment layout]
+Reported-by: David Sadler <dsadler@us.ibm.com>
+Signed-off-by: Carsten Otte <cotte@de.ibm.com>
+Reported-by: Louis Alex Eisner <leisner@cs.ucsd.edu>
+Cc: Hugh Dickins <hughd@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/filemap_xip.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/mm/filemap_xip.c
++++ b/mm/filemap_xip.c
+@@ -263,7 +263,12 @@ found:
+ xip_pfn);
+ if (err == -ENOMEM)
+ return VM_FAULT_OOM;
+- BUG_ON(err);
++ /*
++ * err == -EBUSY is fine, we've raced against another thread
++ * that faulted-in the same page
++ */
++ if (err != -EBUSY)
++ BUG_ON(err);
+ return VM_FAULT_NOPAGE;
+ } else {
+ int err, ret = VM_FAULT_OOM;
--- /dev/null
+From 9398d1ce09b9009996f7d2468e1d3c785fa6feda Mon Sep 17 00:00:00 2001
+From: Huang Shijie <b32955@freescale.com>
+Date: Wed, 4 Jan 2012 11:18:46 +0800
+Subject: mtd: gpmi-nand bugfix: reset the BCH module when it is not MX23
+
+From: Huang Shijie <b32955@freescale.com>
+
+commit 9398d1ce09b9009996f7d2468e1d3c785fa6feda upstream.
+
+In MX28, if we do not reset the BCH module. The BCH module may
+becomes unstable when the board reboots for several thousands times.
+This bug has been catched in customer's production.
+
+The patch adds some comments (some from Wolfram Sang), and fixes it now.
+
+Also change gpmi_reset_block() to static.
+
+Signed-off-by: Huang Shijie <b32955@freescale.com>
+Acked-by: Marek Vasut <marek.vasut@gmail.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/gpmi-nand/gpmi-lib.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+--- a/drivers/mtd/nand/gpmi-nand/gpmi-lib.c
++++ b/drivers/mtd/nand/gpmi-nand/gpmi-lib.c
+@@ -69,17 +69,19 @@ static int clear_poll_bit(void __iomem *
+ * [1] enable the module.
+ * [2] reset the module.
+ *
+- * In most of the cases, it's ok. But there is a hardware bug in the BCH block.
++ * In most of the cases, it's ok.
++ * But in MX23, there is a hardware bug in the BCH block (see erratum #2847).
+ * If you try to soft reset the BCH block, it becomes unusable until
+ * the next hard reset. This case occurs in the NAND boot mode. When the board
+ * boots by NAND, the ROM of the chip will initialize the BCH blocks itself.
+ * So If the driver tries to reset the BCH again, the BCH will not work anymore.
+- * You will see a DMA timeout in this case.
++ * You will see a DMA timeout in this case. The bug has been fixed
++ * in the following chips, such as MX28.
+ *
+ * To avoid this bug, just add a new parameter `just_enable` for
+ * the mxs_reset_block(), and rewrite it here.
+ */
+-int gpmi_reset_block(void __iomem *reset_addr, bool just_enable)
++static int gpmi_reset_block(void __iomem *reset_addr, bool just_enable)
+ {
+ int ret;
+ int timeout = 0x400;
+@@ -206,7 +208,15 @@ int bch_set_geometry(struct gpmi_nand_da
+ if (ret)
+ goto err_out;
+
+- ret = gpmi_reset_block(r->bch_regs, true);
++ /*
++ * Due to erratum #2847 of the MX23, the BCH cannot be soft reset on this
++ * chip, otherwise it will lock up. So we skip resetting BCH on the MX23.
++ * On the other hand, the MX28 needs the reset, because one case has been
++ * seen where the BCH produced ECC errors constantly after 10000
++ * consecutive reboots. The latter case has not been seen on the MX23 yet,
++ * still we don't know if it could happen there as well.
++ */
++ ret = gpmi_reset_block(r->bch_regs, GPMI_IS_MX23(this));
+ if (ret)
+ goto err_out;
+
--- /dev/null
+From 181e9bdef37bfcaa41f3ab6c948a2a0d60a268b5 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rjw@sisk.pl>
+Date: Sun, 29 Jan 2012 20:35:52 +0100
+Subject: PM / Hibernate: Fix s2disk regression related to freezing workqueues
+
+From: "Rafael J. Wysocki" <rjw@sisk.pl>
+
+commit 181e9bdef37bfcaa41f3ab6c948a2a0d60a268b5 upstream.
+
+Commit 2aede851ddf08666f68ffc17be446420e9d2a056
+
+ PM / Hibernate: Freeze kernel threads after preallocating memory
+
+introduced a mechanism by which kernel threads were frozen after
+the preallocation of hibernate image memory to avoid problems with
+frozen kernel threads not responding to memory freeing requests.
+However, it overlooked the s2disk code path in which the
+SNAPSHOT_CREATE_IMAGE ioctl was run directly after SNAPSHOT_FREE,
+which caused freeze_workqueues_begin() to BUG(), because it saw
+that worqueues had been already frozen.
+
+Although in principle this issue might be addressed by removing
+the relevant BUG_ON() from freeze_workqueues_begin(), that would
+reintroduce the very problem that commit 2aede851ddf08666f68ffc17be4
+attempted to avoid into that particular code path. For this reason,
+to fix the issue at hand, introduce thaw_kernel_threads() and make
+the SNAPSHOT_FREE ioctl execute it.
+
+Special thanks to Srivatsa S. Bhat for detailed analysis of the
+problem.
+
+Reported-and-tested-by: Jiri Slaby <jslaby@suse.cz>
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Acked-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/freezer.h | 2 ++
+ kernel/power/process.c | 9 +++++++++
+ kernel/power/user.c | 9 +++++++++
+ 3 files changed, 20 insertions(+)
+
+--- a/include/linux/freezer.h
++++ b/include/linux/freezer.h
+@@ -51,6 +51,7 @@ extern void refrigerator(void);
+ extern int freeze_processes(void);
+ extern int freeze_kernel_threads(void);
+ extern void thaw_processes(void);
++extern void thaw_kernel_threads(void);
+
+ static inline int try_to_freeze(void)
+ {
+@@ -185,6 +186,7 @@ static inline void refrigerator(void) {}
+ static inline int freeze_processes(void) { return -ENOSYS; }
+ static inline int freeze_kernel_threads(void) { return -ENOSYS; }
+ static inline void thaw_processes(void) {}
++static inline void thaw_kernel_threads(void) {}
+
+ static inline int try_to_freeze(void) { return 0; }
+
+--- a/kernel/power/process.c
++++ b/kernel/power/process.c
+@@ -203,3 +203,12 @@ void thaw_processes(void)
+ printk("done.\n");
+ }
+
++void thaw_kernel_threads(void)
++{
++ printk("Restarting kernel threads ... ");
++ thaw_workqueues();
++ thaw_tasks(true);
++ schedule();
++ printk("done.\n");
++}
++
+--- a/kernel/power/user.c
++++ b/kernel/power/user.c
+@@ -303,6 +303,15 @@ static long snapshot_ioctl(struct file *
+ swsusp_free();
+ memset(&data->handle, 0, sizeof(struct snapshot_handle));
+ data->ready = 0;
++ /*
++ * It is necessary to thaw kernel threads here, because
++ * SNAPSHOT_CREATE_IMAGE may be invoked directly after
++ * SNAPSHOT_FREE. In that case, if kernel threads were not
++ * thawed, the preallocation of memory carried out by
++ * hibernation_snapshot() might run into problems (i.e. it
++ * might fail or even deadlock).
++ */
++ thaw_kernel_threads();
+ break;
+
+ case SNAPSHOT_SET_IMAGE_SIZE:
--- /dev/null
+From d020283dc694c9ec31b410f522252f7a8397e67d Mon Sep 17 00:00:00 2001
+From: Venkatesh Pallipadi <venki@google.com>
+Date: Fri, 3 Feb 2012 22:22:25 +0100
+Subject: PM / QoS: CPU C-state breakage with PM Qos change
+
+From: Venkatesh Pallipadi <venki@google.com>
+
+commit d020283dc694c9ec31b410f522252f7a8397e67d upstream.
+
+Looks like change "PM QoS: Move and rename the implementation files"
+merged during the 3.2 development cycle made PM QoS depend on
+CONFIG_PM which depends on (PM_SLEEP || PM_RUNTIME).
+
+That breaks CPU C-states with kernels not having these CONFIGs, causing CPUs
+to spend time in Polling loop idle instead of going into deep C-states,
+consuming way way more power. This is with either acpi idle or intel idle
+enabled.
+
+Either CONFIG_PM should be enabled with any pm_qos users or
+the !CONFIG_PM pm_qos_request() should return sane defaults not to break
+the existing users. Here's is the patch for the latter option.
+
+[rjw: Modified the changelog slightly.]
+
+Signed-off-by: Venkatesh Pallipadi <venki@google.com>
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/pm_qos.h | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+--- a/include/linux/pm_qos.h
++++ b/include/linux/pm_qos.h
+@@ -107,7 +107,19 @@ static inline void pm_qos_remove_request
+ { return; }
+
+ static inline int pm_qos_request(int pm_qos_class)
+- { return 0; }
++{
++ switch (pm_qos_class) {
++ case PM_QOS_CPU_DMA_LATENCY:
++ return PM_QOS_CPU_DMA_LAT_DEFAULT_VALUE;
++ case PM_QOS_NETWORK_LATENCY:
++ return PM_QOS_NETWORK_LAT_DEFAULT_VALUE;
++ case PM_QOS_NETWORK_THROUGHPUT:
++ return PM_QOS_NETWORK_THROUGHPUT_DEFAULT_VALUE;
++ default:
++ return PM_QOS_DEFAULT_VALUE;
++ }
++}
++
+ static inline int pm_qos_add_notifier(int pm_qos_class,
+ struct notifier_block *notifier)
+ { return 0; }
--- /dev/null
+From 500823195d0c9eec2a4637484f30cc93ec633d4a Mon Sep 17 00:00:00 2001
+From: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Date: Thu, 2 Feb 2012 13:54:25 +0200
+Subject: Revert "mtd: atmel_nand: optimize read/write buffer functions"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+
+commit 500823195d0c9eec2a4637484f30cc93ec633d4a upstream.
+
+This reverts commit fb5427508abbd635e877fabdf55795488119c2d6.
+
+The reason is that it breaks 16 bits NAND flash as it was reported by
+Nikolaus Voss and confirmed by Eric Bénard.
+
+Nicolas Ferre <nicolas.ferre@atmel.com> alco confirmed:
+"After double checking with designers, I must admit that I misunderstood
+the way of optimizing accesses to SMC. 16 bit nand is not so common
+those days..."
+
+Reported-by: Nikolaus Voss <n.voss@weinmann.de>
+Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/atmel_nand.c | 45 ++++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 41 insertions(+), 4 deletions(-)
+
+--- a/drivers/mtd/nand/atmel_nand.c
++++ b/drivers/mtd/nand/atmel_nand.c
+@@ -161,6 +161,37 @@ static int atmel_nand_device_ready(struc
+ !!host->board->rdy_pin_active_low;
+ }
+
++/*
++ * Minimal-overhead PIO for data access.
++ */
++static void atmel_read_buf8(struct mtd_info *mtd, u8 *buf, int len)
++{
++ struct nand_chip *nand_chip = mtd->priv;
++
++ __raw_readsb(nand_chip->IO_ADDR_R, buf, len);
++}
++
++static void atmel_read_buf16(struct mtd_info *mtd, u8 *buf, int len)
++{
++ struct nand_chip *nand_chip = mtd->priv;
++
++ __raw_readsw(nand_chip->IO_ADDR_R, buf, len / 2);
++}
++
++static void atmel_write_buf8(struct mtd_info *mtd, const u8 *buf, int len)
++{
++ struct nand_chip *nand_chip = mtd->priv;
++
++ __raw_writesb(nand_chip->IO_ADDR_W, buf, len);
++}
++
++static void atmel_write_buf16(struct mtd_info *mtd, const u8 *buf, int len)
++{
++ struct nand_chip *nand_chip = mtd->priv;
++
++ __raw_writesw(nand_chip->IO_ADDR_W, buf, len / 2);
++}
++
+ static void dma_complete_func(void *completion)
+ {
+ complete(completion);
+@@ -235,27 +266,33 @@ err_buf:
+ static void atmel_read_buf(struct mtd_info *mtd, u8 *buf, int len)
+ {
+ struct nand_chip *chip = mtd->priv;
++ struct atmel_nand_host *host = chip->priv;
+
+ if (use_dma && len > mtd->oobsize)
+ /* only use DMA for bigger than oob size: better performances */
+ if (atmel_nand_dma_op(mtd, buf, len, 1) == 0)
+ return;
+
+- /* if no DMA operation possible, use PIO */
+- memcpy_fromio(buf, chip->IO_ADDR_R, len);
++ if (host->board->bus_width_16)
++ atmel_read_buf16(mtd, buf, len);
++ else
++ atmel_read_buf8(mtd, buf, len);
+ }
+
+ static void atmel_write_buf(struct mtd_info *mtd, const u8 *buf, int len)
+ {
+ struct nand_chip *chip = mtd->priv;
++ struct atmel_nand_host *host = chip->priv;
+
+ if (use_dma && len > mtd->oobsize)
+ /* only use DMA for bigger than oob size: better performances */
+ if (atmel_nand_dma_op(mtd, (void *)buf, len, 0) == 0)
+ return;
+
+- /* if no DMA operation possible, use PIO */
+- memcpy_toio(chip->IO_ADDR_W, buf, len);
++ if (host->board->bus_width_16)
++ atmel_write_buf16(mtd, buf, len);
++ else
++ atmel_write_buf8(mtd, buf, len);
+ }
+
+ /*
ib-mlx4-pass-smp-vendor-specific-attribute-mads-to-firmware.patch
rdma-core-fix-kernel-panic-by-always-initializing-qp-usecnt.patch
kprobes-fix-a-memory-leak-in-function-pre_handler_kretprobe.patch
+mtd-gpmi-nand-bugfix-reset-the-bch-module-when-it-is-not-mx23.patch
+revert-mtd-atmel_nand-optimize-read-write-buffer-functions.patch
+at_hdmac-bugfix-for-enabling-channel-irq.patch
+mm-filemap_xip.c-fix-race-condition-in-xip_file_fault.patch
+mm-compaction-check-pfn_valid-when-entering-a-new-max_order_nr_pages-block-during-isolation-for-migration.patch
+pm-hibernate-fix-s2disk-regression-related-to-freezing-workqueues.patch
+pm-qos-cpu-c-state-breakage-with-pm-qos-change.patch
+drm-radeon-set-desktop_height-register-to-the-framebuffer-not-mode-height.patch
+drm-nouveau-gem-fix-fence_sync-race-oops.patch
+drm-radeon-kms-disable-output-polling-when-suspended.patch
+drm-radeon-kms-fix-travis-panel-setup.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
