Pull drm fixes from Dave Airlie:
 "Scattered selection of fixes:

   - radeon: load detect fixes from SuSE/AMD
   - intel: misc i830, sdvo regression, vesafb kickoff ums fix
   - exynos: maintainers entry update + fixes
   - udl: fix stride scanout issue

  it's slightly bigger than I'd probably like, but nothing looked
  dangerous enough to hold off on."

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  drm/udl: fix stride issues scanning out stride != width*bpp
  drm/radeon: add load detection support for ext DAC on R200 (v2)
  DRM/radeon: For single CRTC GPUs move handling of CRTC_CRT_ON to crtc_dpms().
  DRM/Radeon: Fix TV DAC Load Detection for single CRTC chips.
  DRM/Radeon: Clean up code in TV DAC load detection.
  drm/radeon: fix ATPX function documentation
  drivers/gpu/drm/radeon/evergreen_cs.c: Remove unnecessary semicolon
  DRM/Radeon: On DVI-I use Load Detection when EDID is bogus.
  DRM/Radeon: Fix primary DAC Load Detection for RV100 chips.
  DRM/Radeon: Fix Load Detection on legacy primary DAC.
  drm: exynos: removed warning due to missing typecast for mixer driver data
  drm/exynos: add support for ARCH_MULTIPLATFORM
  MAINTAINERS: Add git repository for Exynos DRM
  drm/exynos: fix display on issue
  drm/i915: Only kick out vesafb if we takeover the fbcon with KMS
  drm/i915: be less verbose about inability to provide vendor backlight
  drm/i915: clear the entire sdvo infoframe buffer
  drm/i915: VGA needs to be on pipe A on i830M
  drm/i915: fix overlay on i830M

Pull networking fixes from David Miller:
 "First post-Sandy pull request"

 1) Fix antenna gain handling and initialization of chan->max_reg_power
    in wireless, from Felix Fietkau.

 2) Fix nexthop handling in H.232 conntrack helper, from Julian
    Anastasov.

 3) Only process 80211 mesh config header in certain kinds of frames,
    from Javier Cardona.

 4) 80211 management frame header length needs to be validated, from
    Johannes Berg.

 5) Don't access free'd SKBs in ath9k driver, from Felix Fietkay.

 6) Test for permanent state correctly in VXLAN driver, from Stephen
    Hemminger.

 7) BNX2X bug fixes from Yaniv Rosner and Dmitry Kravkov.

 8) Fix off by one errors in bonding, from Nikolay ALeksandrov.

 9) Fix divide by zero in TCP-Illinois congestion control.  From Jesper
    Dangaard Brouer.

10) TCP metrics code says "Yo dawg, I heard you like sizeof, so I did a
    sizeof of a sizeof, so you can size your size" Fix from Julian
    Anastasov.

11) Several drivers do mdiobus_free without first doing an
    mdiobus_unregister leading to stray pointer references.  Fix from
    Peter Senna Tschudin.

12) Fix OOPS in l2tp_eth_create() error path, it's another danling
    pointer kinda situation.  Fix from Tom Parkin.

13) Hardware driven by the vmxnet driver can't handle larger than 16K
    fragments, so split them up when necessary.  From Eric Dumazet.

14) Handle zero length data length in tcp_send_rcvq() properly.  Fix
    from Pavel Emelyanov.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (38 commits)
  tcp-repair: Handle zero-length data put in rcv queue
  vmxnet3: must split too big fragments
  l2tp: fix oops in l2tp_eth_create() error path
  cxgb4: Fix unable to get UP event from the LLD
  drivers/net/phy/mdio-bitbang.c: Call mdiobus_unregister before mdiobus_free
  drivers/net/ethernet/nxp/lpc_eth.c: Call mdiobus_unregister before mdiobus_free
  bnx2x: fix HW initialization using fw 7.8.x
  tcp: Fix double sizeof in new tcp_metrics code
  net: fix divide by zero in tcp algorithm illinois
  net: sctp: Fix typo in net/sctp
  bonding: fix second off-by-one error
  bonding: fix off-by-one error
  bnx2x: Disable FCoE for 57840 since not yet supported by FW
  bnx2x: Fix no link on 577xx 10G-baseT
  bnx2x: Fix unrecognized SFP+ module after driver is loaded
  bnx2x: Fix potential incorrect link speed provision
  bnx2x: Restore global registers back to default.
  bnx2x: Fix link down in 57712 following LFA
  bnx2x: Fix 57810 1G-KR link against certain switches.
  ixgbe: PTP get_ts_info missing software support
  ...

When sending data into a tcp socket in repair state we should check
for the amount of data being 0 explicitly. Otherwise we'll have an skb
with seq == end_seq in rcv queue, but tcp doesn't expect this to happen
(in particular a warn_on in tcp_recvmsg shoots).
Signed-off-by: NPavel Emelyanov <xemul@parallels.com>
Reported-by: NGiorgos Mavrikas <gmavrikas@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

vmxnet3 has a 16Kbytes limit per tx descriptor, that happened to work
as long as we provided PAGE_SIZE fragments.

Our stack can now build larger fragments, so we need to split them to
the 16kbytes boundary.
Signed-off-by: NEric Dumazet <edumazet@google.com>
Reported-by: Njongman heo <jongman.heo@samsung.com>
Tested-by: Njongman heo <jongman.heo@samsung.com>
Cc: Shreyas Bhatewara <sbhatewara@vmware.com>
Reviewed-by: NBhavesh Davda <bhavesh@vmware.com>
Signed-off-by: NShreyas Bhatewara <sbhatewara@vmware.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

When creating an L2TPv3 Ethernet session, if register_netdev() should fail for
any reason (for example, automatic naming for "l2tpeth%d" interfaces hits the
32k-interface limit), the netdev is freed in the error path.  However, the
l2tp_eth_sess structure's dev pointer is left uncleared, and this results in
l2tp_eth_delete() then attempting to unregister the same netdev later in the
session teardown.  This results in an oops.

To avoid this, clear the session dev pointer in the error path.
Signed-off-by: NTom Parkin <tparkin@katalix.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

If T4 configuration file gets loaded from the /lib/firmware/cxgb4/ directory
then offload capabilities of the cards were getting disabled during
initialization. Hence ULDs do not get an UP event from the LLD.
Signed-off-by: NJay Hernandez <jay@chelsio.com>
Signed-off-by: NVipul Pandya <vipul@chelsio.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Based on commit b27393ae

Calling mdiobus_free without calling mdiobus_unregister causes
BUG_ON(). This patch fixes the issue.

The semantic patch that found this issue(http://coccinelle.lip6.fr/):
// <smpl>
@@
expression E;
@@
  ... when != mdiobus_unregister(E);

+ mdiobus_unregister(E);
  mdiobus_free(E);
// </smpl>
Signed-off-by: NPeter Senna Tschudin <peter.senna@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Based on commit b27393ae

Calling mdiobus_free without calling mdiobus_unregister causes
BUG_ON(). This patch fixes the issue.

The semantic patch that found this issue(http://coccinelle.lip6.fr/):
// <smpl>
@@
expression E;
@@
  ... when != mdiobus_unregister(E);

+ mdiobus_unregister(E);
  mdiobus_free(E);
// </smpl>
Signed-off-by: NPeter Senna Tschudin <peter.senna@gmail.com>
Tested-by: NRoland Stigge <stigge@antcom.de>
Tested-by: NAlexandre Pereira da Silva <aletes.xgr@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Since commit 96bed4b9 (use FW 7.8.2) BRB HW block needs to be
initialized using fw values for all devices.
Otherwise ETS on 57712/578xx will not work.
Signed-off-by: NDmitry Kravkov <dmitry@broadcom.com>
Signed-off-by: NAriel Elior <ariele@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Pull power management update from Rafael J. Wysocki:
 "Change the email address of the powernow-k8 maintainer."

* tag 'pm-for-3.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  cpufreq / powernow-k8: Change maintainer's email address

Pull input subsystem fixes from Dmitry Torokhov:
 "Just a few driver fixes."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: tsc40 - remove wrong announcement of pressure support
  Input: lpc32xx-keys - select INPUT_MATRIXKMAP
  Input: pxa27x_keypad - clear pending interrupts on keypad config
  Input: wacom - correct bad Cintiq 24HD check
  Input: wacom - add INPUT_PROP_DIRECT flag to Cintiq 24HD
  Input: egalax_ts - get gpio from devicetree

Pull more scsi target fixes from Nicholas Bellinger:
 "This series is a second round of target fixes for v3.7-rc4 that have
  come into target-devel over the last days, and are important enough to
  be applied ASAP.

  All are being CC'ed to stable.  The most important two are:

   - target: Re-add explict zeroing of INQUIRY bounce buffer memory to
     fix a regression for handling zero-length payloads, a bug that went
     during v3.7-rc1, and hit >= v3.6.3 stable.  (nab + paolo)

   - iscsi-target: Fix a long-standing missed R2T wakeup race in TX
     thread processing when using a single queue slot.  (Roland)

  Thanks to Roland & PureStorage team for helping to track down this
  long standing race with iscsi-target single queue slot operation.

  Also, the tcm_fc(FCoE) regression bug that was observed recently with
  -rc2 code has also been resolved with the cancel_delayed_work() return
  bugfix (commit c0158ca6: "workqueue: cancel_delayed_work() should
  return %false if work item is idle") now in -rc3.  Thanks again to Yi
  Zou, MDR, Robert Love @ Intel for helping to track this down."

* git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
  target: Fix incorrect usage of nested IRQ spinlocks in ABORT_TASK path
  iscsi-target: Fix missed wakeup race in TX thread
  target: Avoid integer overflow in se_dev_align_max_sectors()
  target: Don't return success from module_init() if setup fails
  target: Re-add explict zeroing of INQUIRY bounce buffer memory

Pull hwmon fixes from Guenter Roeck:
 "An e-mail address update, and fix a compile error on SPARC"

* tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: Only include of_match_table with CONFIG_OF_GPIO
  hwmon, fam15h_power: Change email address, MAINTAINERS entry

Pull FRV fixes from David Howells:
 "A collection of small fixes for the FRV architecture."

* tag 'frv-fixes-20121102' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-frv:
  frv: fix the broken preempt
  frv: switch to saner kernel_execve() semantics
  FRV: Fix the new-style kernel_thread() stuff
  FRV: Fix the preemption handling
  FRV: gcc-4.1.2 also inlines weak functions
  FRV: Don't objcopy the GNU build_id note
  FRV: Add missing linux/export.h #inclusions

Merge tag 'stable/for-linus-3.7-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen

Pull Xen bugfixes from Konrad Rzeszutek Wilk:
 - Use appropriate macros instead of hand-rolling our own (ARM).
 - Fixes if FB/KBD closed unexpectedly.
 - Fix memory leak in /dev/gntdev ioctl calls.
 - Fix overflow check in xenbus_file_write.
 - Document cleanup.
 - Performance optimization when migrating guests.

* tag 'stable/for-linus-3.7-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  xen/mmu: Use Xen specific TLB flush instead of the generic one.
  xen/arm: use the __HVC macro
  xen/xenbus: fix overflow check in xenbus_file_write()
  xen-kbdfront: handle backend CLOSED without CLOSING
  xen-fbfront: handle backend CLOSED without CLOSING
  xen/gntdev: don't leak memory from IOCTL_GNTDEV_MAP_GRANT_REF
  x86: remove obsolete comment from asm/xen/hypervisor.h

This hashtable implementation is using hlist buckets to provide a simple
hashtable to prevent it from getting reimplemented all over the kernel.
Signed-off-by: NSasha Levin <levinsasha928@gmail.com>
[ Merging this now, so that subsystems can start applying Sasha's
  patches that use this   - Linus ]
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Just get %icc2 into the state we would have after local_irq_disable()
and physical IRQ having happened since then.  Then we can simply
use preempt_schedule_irq() and be done with the whole mess.
Acked-by: NDavid Howells <dhowells@redhat.com>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

The kernel_thread() changes for FRV don't work, and FRV fails to boot,
starting with:

	commit 02ce496f
	Author: Al Viro <viro@zeniv.linux.org.uk>
	Date:   Tue Sep 18 22:18:51 2012 -0400
	Subject: frv: split ret_from_fork, simplify kernel_thread() a lot

The problem is that the userspace registers are completely cleared when a
kernel thread is created and all subsequent user threads are then copied from
that.  Unfortunately, however, the TBR and PSR registers are restored from the
pt_regs and the values they should be set to are clobbered by the memset.

Instead, copy across the old user registers as normal, and then merely alter
GR8 and GR9 in it if we're going to execute a kernel thread.
Signed-off-by: NDavid Howells <dhowells@redhat.com>

Fix the preemption handling in FRV code where the PREEMPT_ACTIVE value is
incorrectly loaded into the threadinfo flags rather than the threadinfo
preemption count.

Unfortunately, the code cannot be simply converted to use
preempt_schedule_irq() as is because FRV uses virtual interrupt disablement to
cut down on the cost of actually disabling interrupts and thus
local_irq_enable() doesn't actually enable interrupts.
Reported-by: NAl Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: NDavid Howells <dhowells@redhat.com>
cc: Al Viro <viro@ZenIV.linux.org.uk>

gcc-4.1.2 inlines weak functions, which causes FRV to fail when the dummy
thread_info_cache_init() gets inlined into start_kernel().
Signed-off-by: NDavid Howells <dhowells@redhat.com>

Don't let objcopy transfer the GNU build_id note into the loadable image as it
is located at address 0 and the image ends up >3G in size.
Signed-off-by: NDavid Howells <dhowells@redhat.com>

Add missing linux/export.h #inclusions to the FRV arch.
Signed-off-by: NDavid Howells <dhowells@redhat.com>

Pull Xtensa fixes from Chris Zankel:
 "Some important bug fixes.

  With the change to uapi, there was a bug introduced that results in an
  empty syscall table (mult-inclusion bug).  Switching to the generic
  thread/execve allowed us to fix a bug we had in vfork()."

* tag 'xtensa-next-20121101' of git://github.com/czankel/xtensa-linux:
  xtensa: switch to generic sys_execve()
  xtensa: switch to generic kernel_execve()
  xtensa: switch to generic kernel_thread()
  xtensa: reset windowbase/windowstart when cloning the VM
  xtensa: use physical addresses for bus addresses
  xtensa: allow multi-inclusion for uapi/unistd.h

When buffer sharing with the i915 and using a 1680x1050 monitor,
the i915 gives is a 6912 buffer for the 6720 width, the code doesn't
render this properly as it uses one value to set the base address for
reading from the vmap and for where to start on the device.

This fixes it by calculating the values correctly for the device and
for the pixmap. No idea how I haven't seen this before now.

Cc: stable@vger.kernel.org
Signed-off-by: NDave Airlie <airlied@redhat.com>

The following fixes build errors on sparc. Without any DT support,
of_match_ptr is NULL and the below is a no-op. However, if just
CONFIG_OF is defined then so is of_match_ptr.

All useful parts of the gpio-fan DT support rely on CONFIG_OF_GPIO
anyway, so of_match_table should too.
Signed-off-by: NJamie Lentin <jm@lentin.co.uk>
Signed-off-by: NGuenter Roeck <linux@roeck-us.net>

Merge branch 'exynos-drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes

Inki writes:
"As I posted before, we have added a new git repository for Exynos drm
to MAINTAINERS file so change it to new one like below,
   from git://git.infradead.org/users/kmpark/linux-samsung
   to git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos

And this pull request includes the following:
- fix display on issue when user requested dpms mode changing.
- add git repository for Exynos drm to MAINTAINERS file.
- add support for ARCH_MULTIPLATFORM.
- and code clean."

* 'exynos-drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos:
  drm: exynos: removed warning due to missing typecast for mixer driver data
  drm/exynos: add support for ARCH_MULTIPLATFORM
  MAINTAINERS: Add git repository for Exynos DRM
  drm/exynos: fix display on issue

Alex writes:
"This request is mostly load detection fixes from Egbert and me."

* 'drm-fixes-3.7' of git://people.freedesktop.org/~agd5f/linux:
  drm/radeon: add load detection support for ext DAC on R200 (v2)
  DRM/radeon: For single CRTC GPUs move handling of CRTC_CRT_ON to crtc_dpms().
  DRM/Radeon: Fix TV DAC Load Detection for single CRTC chips.
  DRM/Radeon: Clean up code in TV DAC load detection.
  drm/radeon: fix ATPX function documentation
  drivers/gpu/drm/radeon/evergreen_cs.c: Remove unnecessary semicolon
  DRM/Radeon: On DVI-I use Load Detection when EDID is bogus.
  DRM/Radeon: Fix primary DAC Load Detection for RV100 chips.
  DRM/Radeon: Fix Load Detection on legacy primary DAC.

Daniel Vetter writes"
Nothing big at all for -fixes, just small stuff:
- Two patches to fix bugs on i830M
- ums regression fixer due to kicking firmeware fbs (Chris)
- tune down a too loud warning (Jani)
- be more careful with sdvo infoframes, which fixes a long-standing
  sdvo-hdmi regression"

* 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel:
  drm/i915: Only kick out vesafb if we takeover the fbcon with KMS
  drm/i915: be less verbose about inability to provide vendor backlight
  drm/i915: clear the entire sdvo infoframe buffer
  drm/i915: VGA needs to be on pipe A on i830M
  drm/i915: fix overlay on i830M

Fix double sizeof when parsing IPv6 address from
user space because it breaks get/del by specific IPv6 address.

	Problem noticed by David Binderman:

https://bugzilla.kernel.org/show_bug.cgi?id=49171Signed-off-by: NJulian Anastasov <ja@ssi.bg>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Reading TCP stats when using TCP Illinois congestion control algorithm
can cause a divide by zero kernel oops.

The division by zero occur in tcp_illinois_info() at:
 do_div(t, ca->cnt_rtt);
where ca->cnt_rtt can become zero (when rtt_reset is called)

Steps to Reproduce:
 1. Register tcp_illinois:
     # sysctl -w net.ipv4.tcp_congestion_control=illinois
 2. Monitor internal TCP information via command "ss -i"
     # watch -d ss -i
 3. Establish new TCP conn to machine

Either it fails at the initial conn, or else it needs to wait
for a loss or a reset.

This is only related to reading stats.  The function avg_delay() also
performs the same divide, but is guarded with a (ca->cnt_rtt > 0) at its
calling point in update_params().  Thus, simply fix tcp_illinois_info().

Function tcp_illinois_info() / get_info() is called without
socket lock.  Thus, eliminate any race condition on ca->cnt_rtt
by using a local stack variable.  Simply reuse info.tcpv_rttcnt,
as its already set to ca->cnt_rtt.
Function avg_delay() is not affected by this race condition, as
its called with the socket lock.

Cc: Petr Matousek <pmatouse@redhat.com>
Signed-off-by: NJesper Dangaard Brouer <brouer@redhat.com>
Acked-by: NEric Dumazet <edumazet@google.com>
Acked-by: NStephen Hemminger <shemminger@vyatta.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Correct spelling typo in net/sctp/socket.c
Signed-off-by: NMasanari Iida <standby24x7@gmail.com>
Acked-by: NVlad Yasevich <vyasevich@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Fix off-by-one error because IFNAMSIZ == 16 and when this
code gets executed we stick a NULL byte where we should not.

How to reproduce:
 with CONFIG_CC_STACKPROTECTOR=y (otherwise it may pass by silently)
 modprobe bonding; echo 1 > /sys/class/net/bond0/bonding/mode;
 echo "AAAAAAAAAAAAAAAA" > /sys/class/net/bond0/bonding/active_slave;
Signed-off-by: NNikolay Aleksandrov <nikolay@redhat.com>

Note: Sorry for the second patch but I missed this one while checking
      the file. You can squash them into one patch.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Fix off-by-one error because IFNAMSIZ == 16 and when this
code gets executed we stick a NULL byte where we should not.

How to reproduce:
 with CONFIG_CC_STACKPROTECTOR=y (otherwise it may pass by silently)
 modprobe bonding; echo 1 > /sys/class/net/bond0/bonding/mode;
 echo "AAAAAAAAAAAAAAAA" > /sys/class/net/bond0/bonding/primary;
Signed-off-by: NNikolay Aleksandrov <nikolay@redhat.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NDmitry Kravkov <dmitry@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Since the Warpcore supports various link types, need to set only the correct
supported modes for XFI which is the serdes interface for the 10G-baseT PHY.
Signed-off-by: NYaniv Rosner <yanivr@broadcom.com>
Signed-off-by: NBarak Witkowski <barak@broadcom.com>
Signed-off-by: NDmitry Kravkov <dmitry@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

When SFP+ module is plugged in after driver is already loaded, it may not be
recognized, so set SFP module recognition time up to 300ms, without resetting
the module power in the middle.
Signed-off-by: NYaniv Rosner <yanivr@broadcom.com>
Signed-off-by: NBarak Witkowski <barak@broadcom.com>
Signed-off-by: NDmitry Kravkov <dmitry@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Fix possible incorrect link speed provision following rapid link speed change.
Clear link speed mask after each link change, and not only after link down.
Signed-off-by: NYaniv Rosner <yanivr@broadcom.com>
Signed-off-by: NBarak Witkowski <barak@broadcom.com>
Signed-off-by: NDmitry Kravkov <dmitry@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Several KR registers were not set correctly back to default after
loopback test, so set those global registers over the global WC lane (zero)
rather than the current lane.
Signed-off-by: NYaniv Rosner <yanivr@broadcom.com>
Signed-off-by: NBarak Witkowski <barak@broadcom.com>
Signed-off-by: NDmitry Kravkov <dmitry@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

In case of link flap avoidance between PXE boot and bnx2x, set the appropriate
PHY DEVAD even if LFA kicks in.
Signed-off-by: NYaniv Rosner <yanivr@broadcom.com>
Signed-off-by: NBarak Witkowski <barak@broadcom.com>
Signed-off-by: NDmitry Kravkov <dmitry@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>