Linux 3.0.34

commit 26a7895e70104811258cf023d06a21f92ab590c6
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Sun Jun 10 00:33:45 2012 +0900

    Linux 3.0.34

commit 749c8151fdf307fb7527aded025850027d44aadc
Author: Tao Ma <boyu.mt@taobao.com>
Date:   Thu Jun 7 19:04:19 2012 -0400

    ext4: don't set i_flags in EXT4_IOC_SETFLAGS

    commit b22b1f178f6799278d3178d894f37facb2085765 upstream.

    Commit 7990696 uses the ext4_{set,clear}_inode_flags() functions to
    change the i_flags automatically but fails to remove the error setting
    of i_flags.  So we still have the problem of trashing state flags.
    Fix this by removing the assignment.

    Signed-off-by: Tao Ma <boyu.mt@taobao.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 65926f3ad3b38644b74496f2a32161f6f02f1079
Author: Grazvydas Ignotas <notasas@gmail.com>
Date:   Fri May 18 03:04:08 2012 +0300

    wl1251: fix oops on early interrupt

    commit f380f2c4a12e913356bd49f8790ec1063c4fe9f8 upstream.

    This driver disables interrupt just after requesting it and enables it
    later, after interface is up. However currently there is a time window
    between request_irq() and disable_irq() where if interrupt arrives, the
    driver oopses because it's not yet ready to process it. This can be
    reproduced by inserting the module, associating and removing the module
    multiple times.

    Eliminate this race by setting IRQF_NOAUTOEN flag before request_irq().

    Signed-off-by: Grazvydas Ignotas <notasas@gmail.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b8d3d5a553b423ab3676554aeddf30dc6ededbcb
Author: Andy Whitcroft <apw@canonical.com>
Date:   Thu May 3 14:48:26 2012 +0100

    ACPI battery: only refresh the sysfs files when pertinent information changes

    commit c5971456964290da7e98222892797b71ef793e62 upstream.

    We only need to regenerate the sysfs files when the capacity units
    change, avoid the update otherwise.

    The origin of this issue is dates way back to 2.6.38:
    da8aeb92d4853f37e281f11fddf61f9c7d84c3cd
    (ACPI / Battery: Update information on info notification and resume)

    Signed-off-by: Andy Whitcroft <apw@canonical.com>
    Tested-by: Ralf Jung <post@ralfj.de>
    Signed-off-by: Len Brown <len.brown@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 284cbb43179add9bf88083535bc39f43d16e6668
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Tue Jun 5 09:50:30 2012 -0400

    drm/radeon/kms: add new BTC PCI ids

    commit a2bef8ce826dd1e787fd8ad9b6e0566ba59dab43 upstream.

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 32e090b1f4bdfe9756e1b8f0b5280acb036d1c61
Author: Salman Qazi <sqazi@google.com>
Date:   Thu May 31 23:52:14 2012 -0400

    ext4: remove mb_groups before tearing down the buddy_cache

    commit 95599968d19db175829fb580baa6b68939b320fb upstream.

    We can't have references held on pages in the s_buddy_cache while we are
    trying to truncate its pages and put the inode.  All the pages must be
    gone before we reach clear_inode.  This can only be gauranteed if we
    can prevent new users from grabbing references to s_buddy_cache's pages.

    The original bug can be reproduced and the bug fix can be verified by:

    while true; do mount -t ext4 /dev/ram0 /export/hda3/ram0; \
    	umount /export/hda3/ram0; done &

    while true; do cat /proc/fs/ext4/ram0/mb_groups; done

    Signed-off-by: Salman Qazi <sqazi@google.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 97434cf53353728708c133af183a11a158c8c26a
Author: Salman Qazi <sqazi@google.com>
Date:   Thu May 31 23:51:27 2012 -0400

    ext4: add ext4_mb_unload_buddy in the error path

    commit 02b7831019ea4e7994968c84b5826fa8b248ffc8 upstream.

    ext4_free_blocks fails to pair an ext4_mb_load_buddy with a matching
    ext4_mb_unload_buddy when it fails a memory allocation.

    Signed-off-by: Salman Qazi <sqazi@google.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit eeb7cb57cf619ae9ab8210b21b49820ed40a472f
Author: Theodore Ts'o <tytso@mit.edu>
Date:   Thu May 31 23:46:01 2012 -0400

    ext4: don't trash state flags in EXT4_IOC_SETFLAGS

    commit 79906964a187c405db72a3abc60eb9b50d804fbc upstream.

    In commit 353eb83c we removed i_state_flags with 64-bit longs, But
    when handling the EXT4_IOC_SETFLAGS ioctl, we replace i_flags
    directly, which trashes the state flags which are stored in the high
    32-bits of i_flags on 64-bit platforms.  So use the the
    ext4_{set,clear}_inode_flags() functions which use atomic bit
    manipulation functions instead.

    Reported-by: Tao Ma <boyu.mt@taobao.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 801bdd926b6229da233f6db25770c9e817f98d4e
Author: Theodore Ts'o <tytso@mit.edu>
Date:   Wed May 30 23:00:16 2012 -0400

    ext4: add missing save_error_info() to ext4_error()

    commit f3fc0210c0fc91900766c995f089c39170e68305 upstream.

    The ext4_error() function is missing a call to save_error_info().
    Since this is the function which marks the file system as containing
    an error, this oversight (which was introduced in 2.6.36) is quite
    significant, and should be backported to older stable kernels with
    high urgency.

    Reported-by: Ken Sumrall <ksumrall@google.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Cc: ksumrall@google.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e36db7f818de59e3b0fdeaabda97e696a177b9a9
Author: Eric Sandeen <sandeen@redhat.com>
Date:   Mon May 28 14:17:25 2012 -0400

    ext4: force ro mount if ext4_setup_super() fails

    commit 7e84b6216467b84cd332c8e567bf5aa113fd2f38 upstream.

    If ext4_setup_super() fails i.e. due to a too-high revision,
    the error is logged in dmesg but the fs is not mounted RO as
    indicated.

    Tested by:

    # mkfs.ext4 -r 4 /dev/sdb6
    # mount /dev/sdb6 /mnt/test
    # dmesg | grep "too high"
    [164919.759248] EXT4-fs (sdb6): revision level too high, forcing read-only mode
    # grep sdb6 /proc/mounts
    /dev/sdb6 /mnt/test2 ext4 rw,seclabel,relatime,data=ordered 0 0

    Reviewed-by: Andreas Dilger <adilger@whamcloud.com>
    Signed-off-by: Eric Sandeen <sandeen@redhat.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 570986003b9cd61b7ccf03beacb56f5f5f6f3409
Author: Benjamin Poirier <bpoirier@suse.de>
Date:   Thu May 24 11:32:38 2012 +0000

    xfrm: take net hdr len into account for esp payload size calculation

    [ Upstream commit 91657eafb64b4cb53ec3a2fbc4afc3497f735788 ]

    Corrects the function that determines the esp payload size. The calculations
    done in esp{4,6}_get_mtu() lead to overlength frames in transport mode for
    certain mtu values and suboptimal frames for others.

    According to what is done, mainly in esp{,6}_output() and tcp_mtu_to_mss(),
    net_header_len must be taken into account before doing the alignment
    calculation.

    Signed-off-by: Benjamin Poirier <bpoirier@suse.de>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 09c073a87938a5031b396ad63c8acdfae86fc153
Author: Felix Fietkau <nbd@openwrt.org>
Date:   Tue May 29 03:35:08 2012 +0000

    skb: avoid unnecessary reallocations in __skb_cow

    [ Upstream commit 617c8c11236716dcbda877e764b7bf37c6fd8063 ]

    At the beginning of __skb_cow, headroom gets set to a minimum of
    NET_SKB_PAD. This causes unnecessary reallocations if the buffer was not
    cloned and the headroom is just below NET_SKB_PAD, but still more than the
    amount requested by the caller.
    This was showing up frequently in my tests on VLAN tx, where
    vlan_insert_tag calls skb_cow_head(skb, VLAN_HLEN).

    Locally generated packets should have enough headroom, and for forward
    paths, we already have NET_SKB_PAD bytes of headroom, so we don't need to
    add any extra space here.

    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 337c934a55a7956bcd349b6f56c6add58d2550f3
Author: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Date:   Fri May 4 05:24:54 2012 +0000

    sctp: check cached dst before using it

    [ Upstream commit e0268868ba064980488fc8c194db3d8e9fb2959c ]

    dst_check() will take care of SA (and obsolete field), hence
    IPsec rekeying scenario is taken into account.

    Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
    Acked-by: Vlad Yaseivch <vyasevich@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 83bba7979059b83df4edc16f747784c6990fc3bb
Author: David S. Miller <davem@davemloft.net>
Date:   Thu May 10 23:03:34 2012 -0400

    Revert "net: maintain namespace isolation between vlan and real device"

    [ Upstream commit 59b9997baba5242997ddc7bd96b1391f5275a5a4 ]

    This reverts commit 8a83a00b0735190384a348156837918271034144.

    It causes regressions for S390 devices, because it does an
    unconditional DST drop on SKBs for vlans and the QETH device
    needs the neighbour entry hung off the DST for certain things
    on transmit.

    Arnd can't remember exactly why he even needed this change.

    Conflicts:

    	drivers/net/macvlan.c
    	net/8021q/vlan_dev.c
    	net/core/dev.c

    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a2abc1310ff689486730215fcea629b74b01abe4
Author: Eric Dumazet <edumazet@google.com>
Date:   Thu May 17 23:52:26 2012 +0000

    pktgen: fix module unload for good

    [ Upstream commit d4b1133558e0d417342d5d2c49e4c35b428ff20d ]

    commit c57b5468406 (pktgen: fix crash at module unload) did a very poor
    job with list primitives.

    1) list_splice() arguments were in the wrong order

    2) list_splice(list, head) has undefined behavior if head is not
    initialized.

    3) We should use the list_splice_init() variant to clear pktgen_threads
    list.

    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 45d21c136849cda838e77928d544fc7cd9d6239c
Author: Eric Dumazet <eric.dumazet@gmail.com>
Date:   Wed May 9 13:29:51 2012 +0000

    pktgen: fix crash at module unload

    [ Upstream commit c57b54684060c8aced64a5b78ff69ff289af97b9 ]

    commit 7d3d43dab4e9 (net: In unregister_netdevice_notifier unregister
    the netdevices.) makes pktgen crashing at module unload.

    [  296.820578] BUG: spinlock bad magic on CPU#6, rmmod/3267
    [  296.820719]  lock: ffff880310c38000, .magic: ffff8803, .owner: <none>/-1, .owner_cpu: -1
    [  296.820943] Pid: 3267, comm: rmmod Not tainted 3.4.0-rc5+ #254
    [  296.821079] Call Trace:
    [  296.821211]  [<ffffffff8168a715>] spin_dump+0x8a/0x8f
    [  296.821345]  [<ffffffff8168a73b>] spin_bug+0x21/0x26
    [  296.821507]  [<ffffffff812b4741>] do_raw_spin_lock+0x131/0x140
    [  296.821648]  [<ffffffff8169188e>] _raw_spin_lock+0x1e/0x20
    [  296.821786]  [<ffffffffa00cc0fd>] __pktgen_NN_threads+0x4d/0x140 [pktgen]
    [  296.821928]  [<ffffffffa00ccf8d>] pktgen_device_event+0x10d/0x1e0 [pktgen]
    [  296.822073]  [<ffffffff8154ed4f>] unregister_netdevice_notifier+0x7f/0x100
    [  296.822216]  [<ffffffffa00d2a0b>] pg_cleanup+0x48/0x73 [pktgen]
    [  296.822357]  [<ffffffff8109528e>] sys_delete_module+0x17e/0x2a0
    [  296.822502]  [<ffffffff81699652>] system_call_fastpath+0x16/0x1b

    Hold the pktgen_thread_lock while splicing pktgen_threads, and test
    pktgen_exiting in pktgen_device_event() to make unload faster.

    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Cc: Eric W. Biederman <ebiederm@xmission.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3dc6bc132f2afce8da98e0f047c4cc8ae569d6cb
Author: James Chapman <jchapman@katalix.com>
Date:   Tue May 29 23:13:23 2012 +0000

    l2tp: fix oops in L2TP IP sockets for connect() AF_UNSPEC case

    [ Upstream commit c51ce49735c183ef2592db70f918ee698716276b ]

    An application may call connect() to disconnect a socket using an
    address with family AF_UNSPEC. The L2TP IP sockets were not handling
    this case when the socket is not bound and an attempt to connect()
    using AF_UNSPEC in such cases would result in an oops. This patch
    addresses the problem by protecting the sk_prot->disconnect() call
    against trying to unhash the socket before it is bound.

    The patch also adds more checks that the sockaddr supplied to bind()
    and connect() calls is valid.

     RIP: 0010:[<ffffffff82e133b0>]  [<ffffffff82e133b0>] inet_unhash+0x50/0xd0
     RSP: 0018:ffff88001989be28  EFLAGS: 00010293
     Stack:
      ffff8800407a8000 0000000000000000 ffff88001989be78 ffffffff82e3a249
      ffffffff82e3a050 ffff88001989bec8 ffff88001989be88 ffff8800407a8000
      0000000000000010 ffff88001989bec8 ffff88001989bea8 ffffffff82e42639
     Call Trace:
     [<ffffffff82e3a249>] udp_disconnect+0x1f9/0x290
     [<ffffffff82e42639>] inet_dgram_connect+0x29/0x80
     [<ffffffff82d012fc>] sys_connect+0x9c/0x100

    Reported-by: Sasha Levin <levinsasha928@gmail.com>
    Signed-off-by: James Chapman <jchapman@katalix.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5111df358197ca9c5001bf2bb542fc8c346bb5b5
Author: Gao feng <gaofeng@cn.fujitsu.com>
Date:   Sat May 26 01:30:53 2012 +0000

    ipv6: fix incorrect ipsec fragment

    [ Upstream commit 0c1833797a5a6ec23ea9261d979aa18078720b74 ]

    Since commit ad0081e43a
    "ipv6: Fragment locally generated tunnel-mode IPSec6 packets as needed"
    the fragment of packets is incorrect.
    because tunnel mode needs IPsec headers and trailer for all fragments,
    while on transport mode it is sufficient to add the headers to the
    first fragment and the trailer to the last.

    so modify mtu and maxfraglen base on ipsec mode and if fragment is first
    or last.

    with my test,it work well(every fragment's size is the mtu)
    and does not trigger slow fragment path.

    Changes from v1:
    	though optimization, mtu_prev and maxfraglen_prev can be delete.
    	replace xfrm mode codes with dst_entry's new frag DST_XFRM_TUNNEL.
    	add fuction ip6_append_data_mtu to make codes clearer.

    Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 49d7872377ba34fc2b2e1e460073a387e7adcfae
Author: Yanmin Zhang <yanmin_zhang@linux.intel.com>
Date:   Wed May 23 15:39:45 2012 +0000

    ipv4: fix the rcu race between free_fib_info and ip_route_output_slow

    [ Upstream commit e49cc0da7283088c5e03d475ffe2fdcb24a6d5b1 ]

    We hit a kernel OOPS.

    <3>[23898.789643] BUG: sleeping function called from invalid context at
    /data/buildbot/workdir/ics/hardware/intel/linux-2.6/arch/x86/mm/fault.c:1103
    <3>[23898.862215] in_atomic(): 0, irqs_disabled(): 0, pid: 10526, name:
    Thread-6683
    <4>[23898.967805] HSU serial 0000:00:05.1: 0000:00:05.2:HSU serial prevented me
    to suspend...
    <4>[23899.258526] Pid: 10526, comm: Thread-6683 Tainted: G        W
    3.0.8-137685-ge7742f9 #1
    <4>[23899.357404] HSU serial 0000:00:05.1: 0000:00:05.2:HSU serial prevented me
    to suspend...
    <4>[23899.904225] Call Trace:
    <4>[23899.989209]  [<c1227f50>] ? pgtable_bad+0x130/0x130
    <4>[23900.000416]  [<c1238c2a>] __might_sleep+0x10a/0x110
    <4>[23900.007357]  [<c1228021>] do_page_fault+0xd1/0x3c0
    <4>[23900.013764]  [<c18e9ba9>] ? restore_all+0xf/0xf
    <4>[23900.024024]  [<c17c007b>] ? napi_complete+0x8b/0x690
    <4>[23900.029297]  [<c1227f50>] ? pgtable_bad+0x130/0x130
    <4>[23900.123739]  [<c1227f50>] ? pgtable_bad+0x130/0x130
    <4>[23900.128955]  [<c18ea0c3>] error_code+0x5f/0x64
    <4>[23900.133466]  [<c1227f50>] ? pgtable_bad+0x130/0x130
    <4>[23900.138450]  [<c17f6298>] ? __ip_route_output_key+0x698/0x7c0
    <4>[23900.144312]  [<c17f5f8d>] ? __ip_route_output_key+0x38d/0x7c0
    <4>[23900.150730]  [<c17f63df>] ip_route_output_flow+0x1f/0x60
    <4>[23900.156261]  [<c181de58>] ip4_datagram_connect+0x188/0x2b0
    <4>[23900.161960]  [<c18e981f>] ? _raw_spin_unlock_bh+0x1f/0x30
    <4>[23900.167834]  [<c18298d6>] inet_dgram_connect+0x36/0x80
    <4>[23900.173224]  [<c14f9e88>] ? _copy_from_user+0x48/0x140
    <4>[23900.178817]  [<c17ab9da>] sys_connect+0x9a/0xd0
    <4>[23900.183538]  [<c132e93c>] ? alloc_file+0xdc/0x240
    <4>[23900.189111]  [<c123925d>] ? sub_preempt_count+0x3d/0x50

    Function free_fib_info resets nexthop_nh->nh_dev to NULL before releasing
    fi. Other cpu might be accessing fi. Fixing it by delaying the releasing.

    With the patch, we ran MTBF testing on Android mobile for 12 hours
    and didn't trigger the issue.

    Thank Eric for very detailed review/checking the issue.

    Signed-off-by: Yanmin Zhang <yanmin_zhang@linux.intel.com>
    Signed-off-by: Kun Jiang <kunx.jiang@intel.com>
    Acked-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f77baf324713ef5d6ae9ae63a77aed2bfbe4333d
Author: David S. Miller <davem@davemloft.net>
Date:   Thu May 10 22:16:32 2012 -0400

    ipv4: Do not use dead fib_info entries.

    [ Upstream commit dccd9ecc374462e5d6a5b8f8110415a86c2213d8 ]

    Due to RCU lookups and RCU based release, fib_info objects can
    be found during lookup which have fi->fib_dead set.

    We must ignore these entries, otherwise we risk dereferencing
    the parts of the entry which are being torn down.

    Reported-by: Yevgen Pronenko <yevgen.pronenko@sonymobile.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 166ab4d1f2a1fae8f2cbe43da0e35befadc1e90b
Author: Thomas Hellstrom <thellstrom@vmware.com>
Date:   Fri Jun 1 15:39:11 2012 +0200

    drm/ttm: Fix spinlock imbalance

    commit a8ff3ee211fccf708e1911bbc096625453ebf759 upstream.

    This imbalance may cause hangs when TTM is trying to swap out a buffer
    that is already on the delayed delete list.

    Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
    Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit df1dadab46b1a1deec017dc4bb20c6325f6fbd23
Author: Jerome Glisse <jglisse@redhat.com>
Date:   Thu May 31 19:00:24 2012 -0400

    drm/radeon: fix HD6790, HD6570 backend programming

    commit 95c4b23ec4e2fa5604df229ddf134e31d7b3b378 upstream.

    Without this bit sets we get broken rendering and
    lockups.

    fglrx sets this bit.

    Bugs that should be fixed by this patch :
    https://bugs.freedesktop.org/show_bug.cgi?id=49792
    https://bugzilla.kernel.org/show_bug.cgi?id=43207
    https://bugs.freedesktop.org/show_bug.cgi?id=39282

    Signed-off-by: Jerome Glisse <jglisse@redhat.com>
    Acked-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit eb7165df9c92e2b6d4b33a7a7176dbedac70404b
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Thu May 31 18:54:43 2012 -0400

    drm/radeon: properly program gart on rv740, juniper, cypress, barts, hemlock

    commit 0b8c30bc4943137a4a36b9cb059b1cc684f5d702 upstream.

    Need to program an additional VM register.  This doesn't not currently
    cause any problems, but allows us to program the proper backend
    map in a subsequent patch which should improve performance on these
    asics.

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 82a7795bc1860e5cfd4410f060b4dc5cbae41d1d
Author: Dmitry Maluka <D.Maluka@adbglobal.com>
Date:   Fri May 11 20:51:51 2012 +0300

    mtd: nand: fix scan_read_raw_oob

    commit 34a5704d91d6f8376a4c0a0143a1dd3eb3ccb37e upstream.

    It seems there is a bug in scan_read_raw_oob() in nand_bbt.c which
    should cause wrong functioning of NAND_BBT_SCANALLPAGES option.

    Artem: the patch did not apply and I had to amend it a bit.

    Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6baeff72b712f09aec676153d5b752dffaf90c17
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Tue May 29 22:03:48 2012 -0400

    vfs: umount_tree() might be called on subtree that had never made it

    commit 63d37a84ab6004c235314ffd7a76c5eb28c2fae0 upstream.

    __mnt_make_shortterm() in there undoes the effect of __mnt_make_longterm()
    we'd done back when we set ->mnt_ns non-NULL; it should not be done to
    vfsmounts that had never gone through commit_tree() and friends.  Kudos to
    lczerner for catching that one...

    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a6923156ec0556f79a8ec5deb40d1aa929184b21
Author: Clemens Ladisch <clemens@ladisch.de>
Date:   Fri May 18 18:00:43 2012 +0200

    ALSA: usb-audio: fix rate_list memory leak

    commit 5cd5d7c44990658df6ab49f6253c39617c53b03d upstream.

    The array of sample rates is reallocated every time when opening
    the PCM device, but was freed only once when unplugging the device.

    Reported-by: "Alexander E. Patrakov" <patrakov@gmail.com>
    Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 08bbb19de6601c4205419ad3c30b730693919b07
Author: Michael Gruetzner <mgruetzn@gmx.de>
Date:   Wed May 2 22:33:40 2012 +0200

    Bluetooth: Add support for Foxconn/Hon Hai AR5BBU22 0489:E03C

    commit 85d59726c5c66016a507f1f4a60db8e374dd284d upstream.

    Add Foxconn/Hon Hai AR5BBU22 Bluetooth Module( 0x489:0xE03C) to
    the blacklist of btusb module and add it to the ath3k module to properly
    load the firmware in Kernel 3.3.4
    The device is integrated in  e.g. some  Acer Aspire 7750G.

    Output from /sys/kernel/debug/usb/devices:

    T:  Bus=01 Lev=02 Prnt=02 Port=05 Cnt=02 Dev#=  6 Spd=12   MxCh= 0
    D:  Ver= 2.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0489 ProdID=e03c Rev= 0.02
    S:  Manufacturer=Atheros Communications
    S:  Product=Bluetooth USB Host Controller
    S:  SerialNumber=Alaska Day 2006
    C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
    E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms

    Signed-off-by: Michael Gruetzner <mgruetzn@gmx.de>
    Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2ae5f906f8f1548aa33375433ff9f03dc7a7763a
Author: Steven Harms <sjharms@gmail.com>
Date:   Fri Apr 13 14:45:55 2012 -0400

    Add Foxconn / Hon Hai IDs for btusb module

    commit 985140369be1e886754d8ac0375dd64e4f727311 upstream.

    This change adds 0x0489:0xe033 to the btusb module.

    This bluetooth usb device is integrated in the Acer TimelineX AS4830TG-6808 notebook.

    Output from /sys/kernel/debug/usb/devices:

    T:  Bus=01 Lev=02 Prnt=02 Port=05 Cnt=02 Dev#=  4 Spd=12   MxCh= 0
    D:  Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0489 ProdID=e033 Rev= 2.29
    S:  Manufacturer=Broadcom Corp
    S:  Product=Acer Module
    S:  SerialNumber=60D819F74101
    C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=  0mA
    I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
    E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
    E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    I:  If#= 1 Alt= 1 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  32 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  32 Ivl=1ms
    I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  64 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  64 Ivl=1ms
    I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  64 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  64 Ivl=1ms
    I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    E:  Ad=84(I) Atr=02(Bulk) MxPS=  32 Ivl=0ms
    E:  Ad=04(O) Atr=02(Bulk) MxPS=  32 Ivl=0ms
    I:* If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)

    Signed-off-by: Steven Harms <sjharms@gmail.com>
    Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b278d462c5d7dcf0479e90f2bc3da5b3d3419aad
Author: Don Zickus <dzickus@redhat.com>
Date:   Wed Mar 28 16:41:11 2012 -0400

    Bluetooth: btusb: typo in Broadcom SoftSailing id

    commit 2e8b506310f6433d5558387fd568d4bfb1d6a799 upstream.

    I was trying to backport the following commit to RHEL-6

        From 0cea73465cd22373c5cd43a3edd25fbd4bb532ef Mon Sep 17 00:00:00 2001
        From: Oliver Neukum <oliver@neukum.org>
        Date: Wed, 21 Sep 2011 11:37:15 +0200
        Subject: [PATCH] btusb: add device entry for Broadcom SoftSailing

    and noticed it wasn't working on an HP Elitebook.  Looking into the patch I
    noticed a very subtle typo in the ids.  The patch has '0x05ac' instead of
    '0x0a5c'.  A snippet of the lsusb -v output also shows this:

    Bus 002 Device 003: ID 0a5c:21e1 Broadcom Corp.
    Device Descriptor:
      bLength                18
      bDescriptorType         1
      bcdUSB               2.00
      bDeviceClass          255 Vendor Specific Class
      bDeviceSubClass         1
      bDeviceProtocol         1
      bMaxPacketSize0        64
      idVendor           0x0a5c Broadcom Corp.
      idProduct          0x21e1
      bcdDevice            1.12
      iManufacturer           1 Broadcom Corp
      iProduct                2 BCM20702A0
      iSerial                 3 60D819F0338C
      bNumConfigurations      1

    Looking at other Broadcom ids, the fix matches them whereas the original patch
    matches Apple's ids.

    Tested on an HP Elitebook 8760w.  The btusb binds and the userspace stuff loads
    correctly.

    Cc: Oliver Neukum <oliver@neukum.org>
    Signed-off-by: Don Zickus <dzickus@redhat.com>
    Acked-by: Marcel Holtmann <marcel@holtmann.org>
    Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
    Cc: Jonathan Nieder <jrnieder@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 604e4dfc28704f407829b10529d81d5f5ebc05ab
Author: Manoj Iyer <manoj.iyer@canonical.com>
Date:   Mon Apr 9 09:22:28 2012 -0500

    Bluetooth: btusb: Add vendor specific ID (0489 e042) for BCM20702A0

    commit 79cd76022044f8177bb00e3fd590ec8d6b5f8c35 upstream.

    T: Bus=02 Lev=02 Prnt=02 Port=04 Cnt=01 Dev#= 3 Spd=12 MxCh= 0
    D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
    P: Vendor=0489 ProdID=e042 Rev=01.12
    S: Manufacturer=Broadcom Corp
    S: Product=BCM20702A0
    S: SerialNumber=E4D53DCA61B5
    C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA
    I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
    I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
    I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    I: If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)

    Reported-by: Dennis Chua <dennis.chua@canonical.com>
    Signed-off-by: Manoj Iyer <manoj.iyer@canonical.com>
    Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
    Cc: Jonathan Nieder <jrnieder@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5cfd6dcaa23cd0c08e54a82c70cddadbce943732
Author: João Paulo Rechi Vita <jprvita@openbossa.org>
Date:   Wed Mar 14 21:45:16 2012 +0200

    Bluetooth: btusb: Add USB device ID "0a5c 21e8"

    commit 6dfc326f0605fd87e4c10ccde10de0ce4280d72d upstream.

    One more vendor-specific ID for BCM20702A0.

    T:  Bus=01 Lev=03 Prnt=05 Port=02 Cnt=01 Dev#=  9 Spd=12  MxCh= 0
    D:  Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0a5c ProdID=21e8 Rev=01.12
    S:  Manufacturer=Broadcom Corp
    S:  Product=BCM20702A0
    S:  SerialNumber=00027221F4E2
    C:  #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA
    I:  If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
    I:  If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    I:  If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)

    Signed-off-by: João Paulo Rechi Vita <jprvita@openbossa.org>
    Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
    Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
    Cc: Jonathan Nieder <jrnieder@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6241414b303a01ecd3488f3a60a597c4f7352c50
Author: James M. Leddy <james.leddy@canonical.com>
Date:   Tue Mar 6 02:41:33 2012 +0200

    Bluetooth: btusb: add support for BCM20702A0 [0a5c:21e6]

    commit 0a4eaeeb993658a4d6cff054a863241f32d3d2fb upstream.

    Add another vendor specific ID for BCM20702A0.  This has been tested and
    works on hardware with this device.

    output of usb-devices:
    T: Bus=01 Lev=02 Prnt=02 Port=03 Cnt=04 Dev#= 6 Spd=12 MxCh= 0
    D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
    P: Vendor=0a5c ProdID=21e6 Rev=01.12
    S: Manufacturer=Broadcom Corp
    S: Product=BCM20702A0
    S: SerialNumber=D0DF9AFB227B
    C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA
    I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
    I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
    I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    I: If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)

    Signed-off-by: James M. Leddy <james.leddy@canonical.com>
    Acked-by: Marcel Holtmann <marcel@holtmann.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
    Cc: Jonathan Nieder <jrnieder@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3a4f179e1eb9414d199655d460e8bb6d7a90f60d
Author: Manoj Iyer <manoj.iyer@canonical.com>
Date:   Thu Feb 2 09:32:36 2012 -0600

    Bluetooth: btusb: Add vendor specific ID (0a5c 21f3) for BCM20702A0

    commit 37305cf649689a4d2341dd6fd89b091c6007f9ba upstream.

    T: Bus=01 Lev=02 Prnt=02 Port=03 Cnt=03 Dev#= 5 Spd=12 MxCh= 0
    D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
    P: Vendor=0a5c ProdID=21f3 Rev=01.12
    S: Manufacturer=Broadcom Corp
    S: Product=BCM20702A0
    S: SerialNumber=74DE2B344A7B
    C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA
    I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
    I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
    I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    I: If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)

    Signed-off-by: Manoj Iyer <manoj.iyer@canonical.com>
    Tested-by: Dennis Chua <dennis.chua@canonical.com>
    Acked-by: Marcel Holtmann <marcel@holtmann.org>
    Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
    Cc: Jonathan Nieder <jrnieder@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4a520924f5fc7e0465538511c3fd6332c92dbd5e
Author: Jesse Sung <jesse.sung@canonical.com>
Date:   Thu Dec 22 10:48:47 2011 +0800

    Bluetooth: Add support for BCM20702A0 [0a5c:21e3]

    commit c0190925dacd976a67044f4382d4effbed568dce upstream.

    Add another vendor specific ID for BCM20702A0.

    output of usb-devices:
    T: Bus=06 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 4 Spd=12 MxCh= 0
    D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
    P: Vendor=0a5c ProdID=21e3 Rev=01.12
    S: Manufacturer=Broadcom Corp
    S: Product=BCM20702A0
    S: SerialNumber=9439E5CBF66C
    C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA
    I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
    I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
    I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    I: If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)

    Signed-off-by: Wen-chien Jesse Sung <jesse.sung@canonical.com>
    Acked-by: Marcel Holtmann <marcel@holtmann.org>
    Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
    Cc: Jonathan Nieder <jrnieder@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f109bcfe0d07f8068ef8642f4dc2f8849e6f3a37
Author: Wen-chien Jesse Sung <jesse.sung@canonical.com>
Date:   Tue Nov 8 14:30:22 2011 +0800

    Bluetooth: Add support for Broadcom BCM20702A0

    commit d13431ca3eb2a2c14314f04813cdc11cd869f150 upstream.

    Since this device declares itself as vendor specific, must add
    a new entry to device ID table to support it.

    usb-device output of this device:

    T:  Bus=01 Lev=02 Prnt=02 Port=03 Cnt=01 Dev#=  3 Spd=12  MxCh= 0
    D:  Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=413c ProdID=8197 Rev=01.12
    S:  Manufacturer=Broadcom Corp
    S:  Product=BCM20702A0
    S:  SerialNumber=D0DF9AA9C9F1
    C:  #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA
    I:  If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
    I:  If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
    I:  If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
    I:  If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)

    Signed-off-by: Wen-chien Jesse Sung <jesse.sung@canonical.com>
    Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
    Cc: Jonathan Nieder <jrnieder@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2d8666ac2e380052996fe9775e311fc8312a8d1c
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Tue May 22 21:41:25 2012 +0200

    drm/i915: wait for a vblank to pass after tv detect

    commit bf2125e2f7e931b50a6c76ba0435ba001409ccbf upstream.

    Otherwise the hw will get confused and result in a black screen.

    This regression has been most likely introduce in

    commit 974b93315b2213b74a42a87e8a9d4fc8c0dbe90c
    Author: Chris Wilson <chris@chris-wilson.co.uk>
    Date:   Sun Sep 5 00:44:20 2010 +0100

        drm/i915/tv: Poll for DAC state change

    That commit replace the first msleep(20) with a busy-loop, but failed
    to keep the 2nd msleep around. Later on we've replaced all these
    msleep(20) by proper vblanks.

    For reference also see the commit in xf86-video-intel:

    commit 1142be53eb8d2ee8a9b60ace5d49f0ba27332275
    Author: Jesse Barnes <jbarnes@hobbes.lan>
    Date:   Mon Jun 9 08:52:59 2008 -0700

        Fix TV programming:  add vblank wait after TV_CTL writes

        Fxies FDO bug #14000; we need to wait for vblank after
        writing TV_CTL or following "DPMS on" calls may not actually enable the output.

    v2: As suggested by Chris Wilson, add a small comment to ensure that
    no one accidentally removes this vblank wait again - there really
    seems to be no sane explanation for why we need it, but it is
    required.

    Launchpad: https://bugs.launchpad.net/ubuntu/+source/xserver-xorg-video-intel/+bug/763688
    Reported-and-Tested-by: Robert Lowery <rglowery@exemail.com.au>
    Cc: Rodrigo Vivi <rodrigo.vivi@gmail.com>
    Acked-by: Chris Wilson <chris@chris-wilson.co.uk>
    Signed-Off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit da94f65433119e4961748c8dc6f7603a3c53232b
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Sat May 12 22:22:58 2012 +0200

    drm/i915: properly handle interlaced bit for sdvo dtd conversion

    commit 59d92bfa5f0cdf57f82f5181b0ad6af75c3fdf41 upstream.

    We've simply ignored this, which isn't too great. With this, interlaced
    1080i works on my HDMI screen connected through sdvo. For no apparent
    reason anything else still doesn't work as it should.

    While at it, give these magic numbers in the dtd proper names and
    add a comment that they match with EDID detailed timings.

    v2: Actually use the right bit for interlaced.

    Tested-by: Peter Ross <pross@xvid.org>
    Reviewed-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
    Signed-Off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0fe9c3d32bc0e7a46d78dca13a6ed3f91ec92f47
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Wed May 23 11:48:59 2012 -0400

    drm/radeon: fix XFX quirk

    commit 1ebf169ad4dc68f18cc0dab35163b0f324fc6c41 upstream.

    Only override the ddc bus if the connector doesn't have
    a valid one.  The existing code overrode the ddc bus for
    all connectors even if it had ddc bus.

    Fixes ddc on another XFX card with the same pci ids that
    was broken by the quirk overwriting the correct ddc bus.

    Reported-by: Mehdi Aqadjani Memar <m.aqadjanimemar@student.ru.nl>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6ab5902511d32b50b4b973320979ba99693aa5be
Author: Trond Myklebust <Trond.Myklebust@netapp.com>
Date:   Mon May 28 11:36:28 2012 -0400

    NFSv4: Map NFS4ERR_SHARE_DENIED into an EACCES error instead of EIO

    commit fb13bfa7e1bcfdcfdece47c24b62f1a1cad957e9 upstream.

    If a file OPEN is denied due to a share lock, the resulting
    NFS4ERR_SHARE_DENIED is currently mapped to the default EIO.
    This patch adds a more appropriate mapping, and brings Linux
    into line with what Solaris 10 does.

    See https://bugzilla.kernel.org/show_bug.cgi?id=43286

    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6ec1d66c8d22bc76ebf37860a87ca399790beb5d
Author: Eyal Shapira <eyal@wizery.com>
Date:   Tue May 29 02:00:22 2012 -0700

    mac80211: fix ADDBA declined after suspend with wowlan

    commit 7b21aea04d084916ac4e0e8852dcc9cd60ec0d1d upstream.

    WLAN_STA_BLOCK_BA is set while suspending but doesn't get cleared
    when resuming in case of wowlan. This causes further ADDBA requests
    received to be rejected. Fix it by clearing it in the wowlan path
    as well.

    Signed-off-by: Eyal Shapira <eyal@wizery.com>
    Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 65ec0e1ca3d1ff89f36db4cd19441bf001fb7d8a
Author: David Woodhouse <dwmw2@infradead.org>
Date:   Thu May 24 04:58:27 2012 +0000

    solos-pci: Fix DMA support

    commit b4bd8ad9bb311e8536f726f7a633620ccd358cde upstream.

    DMA support has finally made its way to the top of the TODO list, having
    realised that a Geode using MMIO can't keep up with two ADSL2+ lines
    each running at 21Mb/s.

    This patch fixes a couple of bugs in the DMA support in the driver, so
    once the corresponding FPGA update is complete and tested everything
    should work properly.

    We weren't storing the currently-transmitting skb, so we were never
    unmapping it and never freeing/popping it when the TX was done.
    And the addition of pci_set_master() is fairly self-explanatory.

    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b5035120fc0b3df71a8b58f086ec32ba5a5c1c55
Author: James Bottomley <JBottomley@Parallels.com>
Date:   Mon May 21 07:49:01 2012 +0100

    PARISC: fix TLB fault path on PA2.0 narrow systems

    commit 2f649c1f6f0fef445ce79a19b79e5ce8fe9d7f19 upstream.

    commit 5e185581d7c46ddd33cd9c01106d1fc86efb9376
    Author: James Bottomley <JBottomley@Parallels.com>

        [PARISC] fix PA1.1 oops on boot

    Didn't quite fix the crash on boot.  It moved it from PA1.1 processors to
    PA2.0 narrow kernels.  The final fix is to make sure the [id]tlb_miss_20 paths
    also work.  Even on narrow systems, these paths require using the wide
    instructions becuase the tlb insertion format is wide.  Fix this by
    conditioning the dep[wd],z on whether we're being called from _11 or _20[w]
    paths.

    Tested-by: Helge Deller <deller@gmx.de>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 488f1224df8e32d9592afbcaf6d2c393d6ad6d8f
Author: John David Anglin <dave.anglin@bell.net>
Date:   Thu May 17 10:34:34 2012 -0400

    PARISC: fix boot failure on 32-bit systems caused by branch stubs placed before .text

    commit ed5fb2471b7060767957fb964eb1aaec71533ab1 upstream.

    In certain configurations, the resulting kernel becomes too large to boot
    because the linker places the long branch stubs for the merged .text section
    at the very start of the image.  As a result, the initial transfer of control
    jumps to an unexpected location.  Fix this by placing the head text in a
    separate section so the stubs for .text are not at the start of the image.

    Signed-off-by: John David Anglin <dave.anglin@bell.net>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 93b71523531161bfdd2ac30dd1ea4bb70d1708bd
Author: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
Date:   Mon May 21 09:20:12 2012 -0500

    cifs: fix oops while traversing open file list (try #4)

    commit 2c0c2a08bed7a3b791f88d09d16ace56acb3dd98 upstream.

    While traversing the linked list of open file handles, if the identfied
    file handle is invalid, a reopen is attempted and if it fails, we
    resume traversing where we stopped and cifs can oops while accessing
    invalid next element, for list might have changed.

    So mark the invalid file handle and attempt reopen if no
    valid file handle is found in rest of the list.
    If reopen fails, move the invalid file handle to the end of the list
    and start traversing the list again from the begining.
    Repeat this four times before giving up and returning an error if
    file reopen keeps failing.

    Signed-off-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
    Reviewed-by: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: Steve French <sfrench@us.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e48fdd4d095a5340bb88374bbbfa6b72625ab0c1
Author: Meenakshi Venkataraman <meenakshi.venkataraman@intel.com>
Date:   Wed May 16 22:35:57 2012 +0200

    iwlwifi: update BT traffic load states correctly

    commit 882dde8eb0d49ce0f853f8f4084dde56a21fe55f upstream.

    When BT traffic load changes from its
    previous state, a new LQ command needs to be
    sent down to the firmware. This needs to
    be done only once per change. The state
    variable that keeps track of this change is
    last_bt_traffic_load. However, it was not
    being updated when the change had been
    handled. Not updating this variable was
    causing a flood of advanced BT config
    commands to be sent to the firmware. Fix
    this.

    Signed-off-by: Meenakshi Venkataraman <meenakshi.venkataraman@intel.com>
    Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2d363e959e1980c1bd3cc4397da635e570bd8a09
Author: Andrea Arcangeli <aarcange@redhat.com>
Date:   Tue May 29 15:06:49 2012 -0700

    mm: pmd_read_atomic: fix 32bit PAE pmd walk vs pmd_populate SMP race condition

    commit 26c191788f18129af0eb32a358cdaea0c7479626 upstream.

    When holding the mmap_sem for reading, pmd_offset_map_lock should only
    run on a pmd_t that has been read atomically from the pmdp pointer,
    otherwise we may read only half of it leading to this crash.

    PID: 11679  TASK: f06e8000  CPU: 3   COMMAND: "do_race_2_panic"
     #0 [f06a9dd8] crash_kexec at c049b5ec
     #1 [f06a9e2c] oops_end at c083d1c2
     #2 [f06a9e40] no_context at c0433ded
     #3 [f06a9e64] bad_area_nosemaphore at c043401a
     #4 [f06a9e6c] __do_page_fault at c0434493
     #5 [f06a9eec] do_page_fault at c083eb45
     #6 [f06a9f04] error_code (via page_fault) at c083c5d5
        EAX: 01fb470c EBX: fff35000 ECX: 00000003 EDX: 00000100 EBP:
        00000000
        DS:  007b     ESI: 9e201000 ES:  007b     EDI: 01fb4700 GS:  00e0
        CS:  0060     EIP: c083bc14 ERR: ffffffff EFLAGS: 00010246
     #7 [f06a9f38] _spin_lock at c083bc14
     #8 [f06a9f44] sys_mincore at c0507b7d
     #9 [f06a9fb0] system_call at c083becd
                             start           len
        EAX: ffffffda  EBX: 9e200000  ECX: 00001000  EDX: 6228537f
        DS:  007b      ESI: 00000000  ES:  007b      EDI: 003d0f00
        SS:  007b      ESP: 62285354  EBP: 62285388  GS:  0033
        CS:  0073      EIP: 00291416  ERR: 000000da  EFLAGS: 00000286

    This should be a longstanding bug affecting x86 32bit PAE without THP.
    Only archs with 64bit large pmd_t and 32bit unsigned long should be
    affected.

    With THP enabled the barrier() in pmd_none_or_trans_huge_or_clear_bad()
    would partly hide the bug when the pmd transition from none to stable,
    by forcing a re-read of the *pmd in pmd_offset_map_lock, but when THP is
    enabled a new set of problem arises by the fact could then transition
    freely in any of the none, pmd_trans_huge or pmd_trans_stable states.
    So making the barrier in pmd_none_or_trans_huge_or_clear_bad()
    unconditional isn't good idea and it would be a flakey solution.

    This should be fully fixed by introducing a pmd_read_atomic that reads
    the pmd in order with THP disabled, or by reading the pmd atomically
    with cmpxchg8b with THP enabled.

    Luckily this new race condition only triggers in the places that must
    already be covered by pmd_none_or_trans_huge_or_clear_bad() so the fix
    is localized there but this bug is not related to THP.

    NOTE: this can trigger on x86 32bit systems with PAE enabled with more
    than 4G of ram, otherwise the high part of the pmd will never risk to be
    truncated because it would be zero at all times, in turn so hiding the
    SMP race.

    This bug was discovered and fully debugged by Ulrich, quote:

    ----
    [..]
    pmd_none_or_trans_huge_or_clear_bad() loads the content of edx and
    eax.

        496 static inline int pmd_none_or_trans_huge_or_clear_bad(pmd_t
        *pmd)
        497 {
        498         /* depend on compiler for an atomic pmd read */
        499         pmd_t pmdval = *pmd;

                                    // edi = pmd pointer
    0xc0507a74 <sys_mincore+548>:   mov    0x8(%esp),%edi
    ...
                                    // edx = PTE page table high address
    0xc0507a84 <sys_mincore+564>:   mov    0x4(%edi),%edx
    ...
                                    // eax = PTE page table low address
    0xc0507a8e <sys_mincore+574>:   mov    (%edi),%eax

    [..]

    Please note that the PMD is not read atomically. These are two "mov"
    instructions where the high order bits of the PMD entry are fetched
    first. Hence, the above machine code is prone to the following race.

    -  The PMD entry {high|low} is 0x0000000000000000.
       The "mov" at 0xc0507a84 loads 0x00000000 into edx.

    -  A page fault (on another CPU) sneaks in between the two "mov"
       instructions and instantiates the PMD.

    -  The PMD entry {high|low} is now 0x00000003fda38067.
       The "mov" at 0xc0507a8e loads 0xfda38067 into eax.
    ----

    Reported-by: Ulrich Obergfell <uobergfe@redhat.com>
    Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
    Cc: Mel Gorman <mgorman@suse.de>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: Larry Woodman <lwoodman@redhat.com>
    Cc: Petr Matousek <pmatouse@redhat.com>
    Cc: Rik van Riel <riel@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit dce59c2faeb130855bd05d025d854ae79d8dbedd
Author: Michal Hocko <mhocko@suse.cz>
Date:   Tue May 29 15:06:45 2012 -0700

    mm: consider all swapped back pages in used-once logic

    commit e48982734ea0500d1eba4f9d96195acc5406cad6 upstream.

    Commit 645747462435 ("vmscan: detect mapped file pages used only once")
    made mapped pages have another round in inactive list because they might
    be just short lived and so we could consider them again next time.  This
    heuristic helps to reduce pressure on the active list with a streaming
    IO worklods.

    This patch fixes a regression introduced by this commit for heavy shmem
    based workloads because unlike Anon pages, which are excluded from this
    heuristic because they are usually long lived, shmem pages are handled
    as a regular page cache.

    This doesn't work quite well, unfortunately, if the workload is mostly
    backed by shmem (in memory database sitting on 80% of memory) with a
    streaming IO in the background (backup - up to 20% of memory).  Anon
    inactive list is full of (dirty) shmem pages when watermarks are hit.
    Shmem pages are kept in the inactive list (they are referenced) in the
    first round and it is hard to reclaim anything else so we reach lower
    scanning priorities very quickly which leads to an excessive swap out.

    Let's fix this by excluding all swap backed pages (they tend to be long
    lived wrt.  the regular page cache anyway) from used-once heuristic and
    rather activate them if they are referenced.

    The customer's workload is shmem backed database (80% of RAM) and they
    are measuring transactions/s with an IO in the background (20%).
    Transactions touch more or less random rows in the table.  The
    transaction rate fell by a factor of 3 (in the worst case) because of
    commit 64574746.  This patch restores the previous numbers.

    Signed-off-by: Michal Hocko <mhocko@suse.cz>
    Acked-by: Johannes Weiner <hannes@cmpxchg.org>
    Cc: Mel Gorman <mel@csn.ul.ie>
    Cc: Minchan Kim <minchan@kernel.org>
    Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
    Reviewed-by: Rik van Riel <riel@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f4090d8272224cc1a4a83f70e2ecbd92d5c460e6
Author: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
Date:   Tue May 22 18:57:17 2012 +0900

    SCSI: Fix dm-multipath starvation when scsi host is busy

    commit b7e94a1686c5daef4f649f7f4f839cc294f07710 upstream.

    block congestion control doesn't have any concept of fairness across
    multiple queues.  This means that if SCSI reports the host as busy in
    the queue congestion control it can result in an unfair starvation
    situation in dm-mp if there are multiple multipath devices on the same
    host.  For example:
    http://www.redhat.com/archives/dm-devel/2012-May/msg00123.html

    The fix for this is to report only the sdev busy state (and ignore the
    host busy state) in the block congestion control call back.
    The host is still congested, but the SCSI subsystem will sort out the
    congestion in a fair way because it knows the relation between the
    queues and the host.

    [jejb: fixed up trailing whitespace]
    Reported-by: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>
    Tested-by: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>
    Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit af9c3bad265e370e3148d50f78a38cfbd14021f3
Author: James Bottomley <jbottomley@parallels.com>
Date:   Wed May 30 09:45:39 2012 +0000

    SCSI: fix scsi_wait_scan

    commit 1ff2f40305772b159a91c19590ee159d3a504afc upstream.

    Commit  c751085943362143f84346d274e0011419c84202
    Author: Rafael J. Wysocki <rjw@sisk.pl>
    Date:   Sun Apr 12 20:06:56 2009 +0200

        PM/Hibernate: Wait for SCSI devices scan to complete during resume

    Broke the scsi_wait_scan module in 2.6.30.  Apparently debian still uses it so
    fix it and backport to stable before removing it in 3.6.

    The breakage is caused because the function template in
    include/scsi/scsi_scan.h is defined to be a nop unless SCSI is built in.
    That means that in the modular case (which is every distro), the
    scsi_wait_scan module does a simple async_synchronize_full() instead of
    waiting for scans.

    Signed-off-by: James Bottomley <JBottomley@Parallels.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>