Merge branch 'exynos-drm-fixes' of git://git.infradead.org/users/kmpark/linux-2.6-samsung into drm-fixes

From Inki Dae:

this patch set fixes gem allocation and mapping issue between user space and
physical memory region.

* 'exynos-drm-fixes' of git://git.infradead.org/users/kmpark/linux-2.6-samsung:
  drm/exynos: added missed vm area region mapping type.
  drm/exynos: fixed exynos_drm_gem_map_pages bug.
  drm/exynos: fixed duplicatd memory allocation bug.

Pull gfs2 fixes from Steven Whitehouse.

* git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-3.0-fixes:
  GFS2: Instruct DLM to avoid queue convert slowdown

Pull HSI fixes and ABI documentation from Carlos Chinea

* tag 'hsi_fixes_for_3.4' of git://gitorious.org/kernel-hsi/kernel-hsi:
  HSI: Add HSI ABI documentation
  HSI: hsi_char: Remove max_data_size from sysfs
  HSI: hsi: Rework hsi_event interface
  HSI: hsi: Remove controllers and ports from the bus
  HSI: hsi: Fix error path cleanup on client registration
  HSI: hsi: Rework hsi_controller release

This patch instructs DLM to prevent an "in place" conversion, where the
lock just stays on the granted queue, and instead forces the conversion to
the back of the convert queue. This is done on upward conversions only.
    
This is useful in cases where, for example, a lock is frequently needed in
PR on one node, but another node needs it temporarily in EX to update it.
This may happen, for example, when the rindex is being updated by gfs2_grow.
The gfs2_grow needs to have the lock in EX, but the other nodes need to
re-read it to retrieve the updates. The glock is already granted in PR on
the non-growing nodes, so this prevents them from continually re-granting
the lock in PR, and forces the EX from gfs2_grow to go through.
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>

Pull ext4 bug fixes from Ted Ts'o:
 "These are two low-risk bug fixes for ext4, fixing a compile warning
  and a potential deadlock."

* tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
  super.c: unused variable warning without CONFIG_QUOTA
  jbd2: use GFP_NOFS for blkdev_issue_flush

Pull Hexagon fixes from Richard Kuo:
 "It's mostly compile fixes and the Hexagon portion of a CPU hotplug
  patch set."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rkuo/linux-hexagon-kernel:
  hexagon: add missing cpu.h include
  hexagon/CPU hotplug: Add missing call to notify_cpu_starting()
  hexagon:  use renamed tick_nohz_idle_* functions
  Hexagon: misc compile warning/error cleanup due to missing headers

Pull build system failure fix from Michal Marek:
 "This fixes build failure with newer gcc that adds some internal
  symbols that end in "__mod_*_device_table", but are not actually the
  tables themselves."

* 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild:
  Fix modpost failures in fedora 17

sb info is only checked with quota support.

fs/ext4/super.c: In function ‘parse_options’:
fs/ext4/super.c:1600:23: warning: unused variable ‘sbi’ [-Wunused-variable]
Signed-off-by: Eldad Zack <eldad@fogrefinery.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>

flush request is issued in transaction commit code path, so looks using
GFP_KERNEL to allocate memory for flush request bio falls into the classic
deadlock issue.  I saw btrfs and dm get it right, but ext4, xfs and md are
using GFP.
Signed-off-by: Shaohua Li <shli@fusionio.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: stable@vger.kernel.org

Pull a few more md bug fixes from NeilBrown:
 "2 are tagged for -stable, one being for a fairly serious bug that can
  corrupt metadata and make it hard to recovery an array.  The other is
  for a more recent regression since 3.3"

* tag 'md-3.4-fixes' of git://neil.brown.name/md:
  md: fix possible corruption of array metadata on shutdown.
  md: don't call ->add_disk unless there is good reason.
  DM RAID: Use safe version of rdev_for_each

Pull dlm fixes from David Teigland:
 "This includes one short patch fixing the behavior of the QUECVT flag,
  which the gfs2 folks are waiting on."

* tag 'dlm-fixes-3.4' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm:
  dlm: fix QUECVT when convert queue is empty

Mel reports a BUG_ON(slot == NULL) in radix_tree_tag_set() on s390
3.0.13: called from __set_page_dirty_nobuffers() when page_remove_rmap()
tries to transfer dirty flag from s390 storage key to struct page and
radix_tree.

That would be because of reclaim's shrink_page_list() calling
add_to_swap() on this page at the same time: first PageSwapCache is set
(causing page_mapping(page) to appear as &swapper_space), then
page->private set, then tree_lock taken, then page inserted into
radix_tree - so there's an interval before taking the lock when the
radix_tree slot is empty.

We could fix this by moving __add_to_swap_cache()'s spin_lock_irq up
before the SetPageSwapCache.  But a better fix is simply to do what's
five years overdue: Ken Chen introduced __set_page_dirty_no_writeback()
(if !PageDirty TestSetPageDirty) for tmpfs to skip all the radix_tree
overhead, and swap is just the same - it ignores the radix_tree tag, and
does not participate in dirty page accounting, so should be using
__set_page_dirty_no_writeback() too.

s390 testing now confirms that this does indeed fix the problem.
Reported-by: Mel Gorman <mgorman@suse.de>
Signed-off-by: Hugh Dickins <hughd@google.com>
Acked-by: Mel Gorman <mgorman@suse.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Ken Chen <kenchen@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit c744a65c
  md: don't set md arrays to readonly on shutdown.

removed the possibility of a 'BUG' when data is written to an array
that has just been switched to read-only, but also introduced the
possibility that the array metadata could be corrupted.

If, when md_notify_reboot gets the mddev lock, the array is
in a state where it is assembled but hasn't been started (as can
happen if the personality module is not available, or in other unusual
situations), then incorrect metadata will be written out making it
impossible to re-assemble the array.

So only call __md_stop_writes() if the array has actually been
activated.

This patch is needed for any stable kernel which has had the above
commit applied.

Cc: stable@vger.kernel.org
Reported-by: Christoph Nelles <evilazrael@evilazrael.de>
Signed-off-by: NeilBrown <neilb@suse.de>

Commit 7bfec5f3

   md/raid5: If there is a spare and a want_replacement device, start replacement.

cause md_check_recovery to call ->add_disk much more often.
Instead of only when the array is degraded, it is now called whenever
md_check_recovery finds anything useful to do, which includes
updating the metadata for clean<->dirty transition.
This causes unnecessary work, and causes info messages from ->add_disk
to be reported much too often.

So refine md_check_recovery to only do any actual recovery checking
(including ->add_disk) if MD_RECOVERY_NEEDED is set.

This fix is suitable for 3.3.y:

Cc: stable@vger.kernel.org
Reported-by: Jan Ceuleers <jan.ceuleers@computer.org>
Signed-off-by: NeilBrown <neilb@suse.de>

Fix segfault caused by using rdev_for_each instead of rdev_for_each_safe

Commit dafb20fa mistakenly replaced a safe
iterator with an unsafe one when making some macro changes.
Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
Signed-off-by: NeilBrown <neilb@suse.de>

Signed-off-by: Richard Kuo <rkuo@codeaurora.org>

The scheduler depends on receiving the CPU_STARTING notification, without
which we end up into a lot of trouble. So add the missing call to
notify_cpu_starting() in the bringup code.
Signed-off-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
Signed-off-by: Richard Kuo <rkuo@codeaurora.org>

Signed-off-by: Richard Kuo <rkuo@codeaurora.org>

Fixed warnings/errors for EXPORT_SYMBOL, linux_binprm, elf related
defines
Signed-off-by: Richard Kuo <rkuo@codeaurora.org>

The QUECVT flag should not prevent conversions from
being granted immediately when the convert queue is
empty.
Signed-off-by: David Teigland <teigland@redhat.com>

with this patch, if the memory region is physically non-continuous
then VM_MIXEDMAP is set to vm->vm_flags otherwise VM_PFNMAP.
we had missed this flag setting.
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>

this patch fixes the problem that the physical memory region to be mapped
to user space could be exceeded. if page fault address was placed at between
buffer start and end then memory region to be mapped would be exceeded.
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>

the gem was already allocated at gem allocation time but is allocated
at page fault handler so this patch fixes the problem that gem was
allocated one more time.
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>

Adds sysfs HSI framework documentation
Signed-off-by: Carlos Chinea <carlos.chinea@nokia.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>

Remove max_data_size sysfs entry. Otherwise is possible
to have a buffer overrun if its value is increased after
the device is open.
Signed-off-by: Carlos Chinea <carlos.chinea@nokia.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>

Remove custom hack and make use of the notifier chain interfaces for
delivering events from the ports to their associated clients.
Clients that want to receive port events need to register their callbacks
using hsi_register_port_event(). The callbacks can be called in interrupt
context. Use hsi_unregestier_port_event() to undo the registration.
Signed-off-by: Carlos Chinea <carlos.chinea@nokia.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>

HSI controllers and ports do not belong to the HSI bus.
Those devices are not supposed to have a driver attached to them.
Signed-off-by: Carlos Chinea <carlos.chinea@nokia.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>

HSI client structure should be freed on error path after
calling device_registration by dropping a reference to it.
Signed-off-by: Carlos Chinea <carlos.chinea@nokia.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>

Use the proper release mechanism for hsi_controller and
hsi_ports structures. Free the structures through their
associated device release callbacks.
Signed-off-by: Carlos Chinea <carlos.chinea@nokia.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>

Pull ARM fixes from Russell King:
 "Here's my usual Sunday push, just for one revert which PeterZ hollered
  about after last weeks push.  Other than that, all seems strangely
  quiet as far as fixes go in non-platform ARM land at the moment."

* 'fixes' of git://git.linaro.org/people/rmk/linux-arm:
  Revert "ARM: 7359/2: smp_twd: Only wait for reprogramming on active cpus"

Pull powerpc fixes from Benjamin Herrenschmidt:
 "Here are a few fixes for powerpc.  Note the addition to the generic
  irq.h.  This is part of a 3-patches regression fix for mpic due to
  changes in how IRQ_TYPE_NONE is being handled.  Thomas agreed to the
  addition of the new IRQ_TYPE_DEFAULT contant, however he hasn't
  replied with an Ack to the actual patch yet.  I don't to wait much
  longer with these patches tho."

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
  powerpc/mpic: Properly set default triggers
  irq: Add IRQ_TYPE_DEFAULT for use by PIC drivers
  powerpc/mpic: Fix confusion between hw_irq and virq
  powerpc/pmac: Don't add_timer() twice
  powerpc/eeh: Fix crash caused by null eeh_dev
  powerpc/mpc85xx: add MPIC message dts node
  powerpc/mpic_msgr: fix offset error when setting mer register
  powerpc/mpic_msgr: add lock for MPIC message global variable
  powerpc/mpic_msgr: fix compile error when SMP disabled
  powerpc: fix build when CONFIG_BOOKE_WDT is enabled
  powerpc/85xx: don't call of_platform_bus_probe() twice

Pull networking fixes from David Miller:

 1) Fix namespace init and cleanup in phonet to fix some oopses, from
    Eric W. Biederman.

 2) Missing kfree_skb() in AF_KEY, from Julia Lawall.

 3) Refcount leak and source address handling fix in l2tp from James
    Chapman.

 4) Memory leak fix in CAIF from Tomasz Gregorek.

 5) When routes are cloned from ipv6 addrconf routes, we don't process
    expirations properly.  Fix from Gao Feng.

 6) Fix panic on DMA errors in atl1 driver, from Tony Zelenoff.

 7) Only enable interrupts in 8139cp driver after we've registered the
    IRQ handler.  From Jason Wang.

 8) Fix too many reads of KS_CIDER register in ks8851 during probe,
    fixing crashes on spurious interrupts.  From Matt Renzelmann.

 9) Missing include in ath5k driver and missing iounmap on probe
    failure, from Jonathan Bither.

10) Fix RX packet handling in smsc911x driver, from Will Deacon.

11) Fix ixgbe WoL on fiber by leaving the laser on during shutdown.

12) ks8851 needs MAX_RECV_FRAMES increased otherwise the internal MAC
    buffers are easily overflown.  Fix from Davide Cimingahi.

13) Fix memory leaks in peak_usb CAN driver, from Jesper Juhl.

14) gred packet scheduler can dump in WRED more when doing a netlink
    dump.  Fix from David Ward.

15) Fix MTU in USB smsc75xx driver, from Stephane Fillod.

16) Dummy device needs ->ndo_uninit handler to properly handle
    ->ndo_init failures.  From Hiroaki SHIMODA.

17) Fix TX fragmentation in ath9k driver, from Sujith Manoharan.

18) Missing RTNL lock in ixgbe PM resume, from Benjamin Poirier.

19) Missing iounmap in farsync WAN driver, from Julia Lawall.

20) With LRO/GRO, tcp_grow_window() is easily tricked into not growing
    the receive window properly, and this hurts performance.  Fix from
    Eric Dumazet.

21) Network namespace init failure can leak net_generic data, fix from
    Julian Anastasov.

22) Fix skb_over_panic due to mis-accounting in TCP for partially ACK'd
    SKBs.  From Eric Dumazet.

23) New IDs for qmi_wwan driver, from Bjørn Mork.

24) Fix races in ax25_exit(), from Eric W. Biederman.

25) IPV6 TCP doesn't handle TCP_MAXSEG socket option properly, copy over
    logic from the IPV4 side.  From Neal Cardwell.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (59 commits)
  tcp: fix TCP_MAXSEG for established IPv6 passive sockets
  drivers/net: Do not free an IRQ if its request failed
  drop_monitor: allow more events per second
  ks8851: Fix request_irq/free_irq mismatch
  net/hyperv: Adding cancellation to ensure rndis filter is closed
  ks8851: Fix mutex deadlock in ks8851_net_stop()
  net ax25: Reorder ax25_exit to remove races.
  icplus: fix interrupt for IC+ 101A/G and 1001LF
  net: qmi_wwan: support Sierra Wireless MC77xx devices in QMI mode
  bnx2x: off by one in bnx2x_ets_e3b0_sp_pri_to_cos_set()
  ksz884x: don't copy too much in netdev_set_mac_address()
  tcp: fix retransmit of partially acked frames
  netns: do not leak net_generic data on failed init
  net/sock.h: fix sk_peek_off kernel-doc warning
  tcp: fix tcp_grow_window() for large incoming frames
  drivers/net/wan/farsync.c: add missing iounmap
  davinci_mdio: Fix MDIO timeout check
  ipv6: clean up rt6_clean_expires
  ipv6: fix rt6_update_expires
  arcnet: rimi: Fix device name in debug output
  ...

This gets rid of the unused default senses array, and replaces the
incorrect use of IRQ_TYPE_NONE with the new IRQ_TYPE_DEFAULT for
the initial set_trigger() call when mapping an interrupt.

This in turn makes us read the HW state and update the irq desc
accordingly.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

This is meant typically to allow a PIC driver's irq domain map() callback
to establish sane defaults for the interrupt (and make sure that the HW
and the irq_desc are in sync as far as the trigger is concerned).

The irq core may not call the set_trigger callback if it thinks the
trigger is already set to the right setting, so we need to ensure new
descriptors are properly synchronized with the hardware.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

mpic_is_ipi() takes a virq and immediately converts it to a hw_irq.

However, one of the two call sites calls it with a ... hw_irq. The
other call site also happens to have the hw_irq at hand, so let's
change it to just take that as an argument. Also change mpic_is_tm()
for consistency.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

If the interrupt and the timeout happen roughly at the same
time, we can get into a situation where the timer function
is run while the interrupt has already been processed. In
this case, the timer function might end up doing an add_timer
on an already pending timer, causing a BUG_ON() to trigger.

Instead, just skip the whole timeout operation if we see that
the timer is pending. The spinlock ensures that the only way
that happens is if we already started a new operation and thus
the timeout can be ignored.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

The problem was reported by Anton Blanchard. While EEH error
happened to the PCI device without the corresponding device
driver, kernel crash was seen. Eventually, I successfully
reproduced the problem on Firebird-L machine with utility
"errinjct". Initially, the device driver for Emulex ethernet
MAC has been disabled from .config and force data parity on
the Emulex ethernet MAC with help of "errinjct". Eventually,
I saw the kernel crash after issueing couple of "lspci -v"
command.

The root cause behind is that the PCI device, including the
reference to the corresponding eeh device, will be removed
from the system while EEH does recovery. Afterwards, the
PCI device will be probed again and added into the system
accordingly. So it's not safe to retrieve the eeh device from
the corresponding PCI device after the PCI device has been removed
and not added again.

The patch fixes the issue and retrieve the eeh device from OF node
instead of PCI device after the PCI device has been removed.
Signed-off-by: Gavin Shan <shangw@linux.vnet.ibm.com>
Tested-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

Commit f5fff5dc forgot to fix TCP_MAXSEG behavior IPv6 sockets, so IPv6
TCP server sockets that used TCP_MAXSEG would find that the advmss of
child sockets would be incorrect. This commit mirrors the advmss logic
from tcp_v4_syn_recv_sock in tcp_v6_syn_recv_sock. Eventually this
logic should probably be shared between IPv4 and IPv6, but this at
least fixes this issue.
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>