commit 999c1d6bc999d67657033ec780a561aa172c75a9 Author: Greg Kroah-Hartman Date: Fri Nov 11 10:12:24 2011 -0800 Linux 3.0.9 commit c54e04e9a9993da6968c8b21bdb905d07f0caed7 Author: Linus Torvalds Date: Sun Nov 6 18:34:03 2011 -0800 hid/apple: modern macbook airs use the standard apple function key translations commit 21404b772a1c65f7b935b8c0fddc388a949f4e31 upstream. This removes the use of the special "macbookair_fn_keys" keyboard translation table for the MacBookAir4,x models (ie the 2011 refresh). They use the standard apple_fn_keys[] translation. Apparently only the old MacBook Air's need a different translation table. This mirrors the change that commit da617c7cb915 ("HID: consolidate MacbookAir 4,1 mappings") did for the WELLSPRING6A ones, but does it for the WELLSPRING6 model used on the MacBookAir4,2. Reported-and-tested-by: Dirk Hohndel Cc: Jiri Kosina Cc: Joshua V Dillon Cc: Chase Douglas Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 8ac6255b5f8d69d58d4fb8ed62df2780756d4b0c Author: Jiri Kosina Date: Wed Oct 5 16:54:45 2011 +0200 HID: consolidate MacbookAir 4,1 mappings commit da617c7cb915545dda4280df888dd6f8d5697420 upstream. MacbookAir 4,1 doesn't require extra mapping table, as the mappings are identical to apple_fn_keys[]. Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit fc7c292ac74b41af17e9e8eab039322d3847bad3 Author: Andreas Krist Date: Fri Oct 28 18:50:39 2011 +0200 HID: hid-apple: add device ID of another wireless aluminium commit ad734bc1565364f9e4b70888d3ce5743b3c1030a upstream. I've recently bought a Apple wireless aluminum keyboard (model 2011) which is not yet supported by the kernel - it seems they just changed the device id. After applying the attached patch, the device is fully functional. Signed-off-by: Andreas Krist Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit 63472b615266723cb9af12e09fd32736be6b3477 Author: Gökçen Eraslan Date: Sat Oct 22 22:39:06 2011 +0300 HID: Add device IDs for Macbook Pro 8 keyboards commit 213f9da80533940560bef8fa43b10c590895459c upstream. This patch adds keyboard support for Macbook Pro 8 models which has WELLSPRING5A model name and 0x0252, 0x0253 and 0x0254 USB IDs. Trackpad support for those models are added to bcm5974 in c331eb580a0a7906c0cdb8dbae3cfe99e3c0e555 ("Input: bcm5974 - Add support for newer MacBookPro8,2). Signed-off-by: Gökçen Eraslan Acked-by: Henrik Rydberg Signed-off-by: Jiri Kosina Cc: Chase Douglas Signed-off-by: Greg Kroah-Hartman commit 4bdfc7d622b8a17bf55a7745ae77f8925843ea9d Author: Nobuhiro Iwamatsu Date: Sat Oct 1 15:54:53 2011 +0900 HID: Add support MacbookAir 4,1 keyboard commit d762cc290b9f17e346f4297fd5984b70ce71ef66 upstream. Added USB device IDs and keyboard map for MacBookAir 4,1 keyboard. Signed-off-by: Nobuhiro Iwamatsu Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit 9148573623711a6932b729f5bb752534f4834714 Author: Jiri Kosina Date: Wed Aug 10 14:12:52 2011 +0200 HID: add MacBookAir4,2 to hid_have_special_driver[] commit f6f554f09c5b831efdaf67c449e18ca06ee648fe upstream. Otherwise the generic driver wouldn't unbind from it and wouldn't let hid-apple to automatically take over. Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit bab08e54790e51a7541faf1e3029eeefc051e36c Author: Jeff Brown Date: Mon Aug 15 21:12:09 2011 -0700 HID: hid-multitouch: Add LG Display Multitouch device. commit c50bb1a4005630f47b5da26336f74a485033a515 upstream. This panel is also known as the Dell ST2220Tc. Signed-off-by: jeffbrown@android.com Reviewed-By: Benjamin Tissoires Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit c3f24bd0dcf2076ed16b8f5ea80ea001500d8095 Author: Joshua V. Dillon Date: Fri Aug 5 12:05:22 2011 -0700 HID: add support for MacBookAir4,2 keyboard. commit 5d922baa631058c7e37ae33e81c4d3e6437f8d1d upstream. Added USB device IDs for MacBookAir4,2 keyboard. Device constants were copied from the MacBookAir3,2 constants. The 4,2 device specification is reportedly unchanged from the 3,2 predecessor and seems to work well. Signed-off-by: Joshua V Dillon Signed-off-by: Chase Douglas Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit 385df62a595823f09fa9447f79c5a14ea1990a7d Author: Clemens Werther Date: Thu Aug 25 15:35:14 2011 +0200 HID: add support for HuiJia USB Gamepad connector commit 6d1db0777981e1626ae71243984ac300b61789ff upstream. Create each gamepad as a separate joystick Signed-off-by: Clemens Werther Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit 81e0a487f87844c9b4ef5d7816ef4e02482db6c6 Author: Dan Bastone Date: Sun Jul 31 07:40:49 2011 -0400 HID: add support for new revision of Apple aluminum keyboard commit 4a4c879904aa0cc64629e14a49b64fb3d149bf1a upstream. Add USB device ids for the new revision (MB110LL/B) of Apple's wired aluminum keyboard. I have only confirmed that the ANSI version is correct - it is assumed that the ISO and JIS versions follow the standard numbering convention. Signed-off-by: Dan Bastone Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit 02376e54a976843aaa722b661123a6acc2b70b14 Author: THOMSON, Adam (Adam) Date: Tue Jun 14 16:52:38 2011 +0200 mtd: nand_base: always initialise oob_poi before writing OOB data commit f722013ee9fd24623df31dec9a91a6d02c3e2f2f upstream. In nand_do_write_ops() code it is possible for a caller to provide ops.oobbuf populated and ops.mode == MTD_OOB_AUTO, which currently means that the chip->oob_poi buffer isn't initialised to all 0xFF. The nand_fill_oob() method then carries out the task of copying the provided OOB data to oob_poi, but with MTD_OOB_AUTO it skips areas marked as unavailable by the layout struct, including the bad block marker bytes. An example of this causing issues is when the last OOB data read was from the start of a bad block where the markers are not 0xFF, and the caller wishes to write new OOB data at the beginning of another block. In this scenario the caller would provide OOB data, but nand_fill_oob() would skip the bad block marker bytes in oob_poi before copying the OOB data provided by the caller. This means that when the OOB data is written back to NAND, the block is inadvertently marked as bad without the caller knowing. This has been witnessed when using YAFFS2 where tags are stored in the OOB. To avoid this oob_poi is always initialised to 0xFF to make sure no left over data is inadvertently written back to the OOB area. Credits to Brian Norris for fixing this patch. Signed-off-by: Adam Thomson Signed-off-by: Artem Bityutskiy Signed-off-by: Greg Kroah-Hartman commit 82eaf854859022f7bf1aa9122ed533516187cbff Author: Rajkumar Manoharan Date: Thu Oct 20 14:22:43 2011 +0530 ath9k_hw: Fix regression of register offset for AR9003 chips commit 52d6d4ef5e6d1517688e27c11c01ab303ec681dd upstream. My recent commits (3782c69d, 324c74a) introduced regression for register offset selection that based on the macversion. Not using parentheses in proper manner for ternary operator leads to select wrong offset for the registers. This issue was observed with AR9462 chip that immediate disconnect after the association with the following message ieee80211 phy3: wlan0: Failed to send nullfunc to AP 00:23:69:12:ea:47 after 500ms, disconnecting. Signed-off-by: Rajkumar Manoharan Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit ed288aed0796683495c51684d56f9328813c59c7 Author: Richard Cochran Date: Fri Oct 21 00:49:16 2011 +0000 dp83640: use proper function to free transmit time stamping packets commit f5ff7cd1a84caa9545d952a37ac872ccb73825fb upstream. The previous commit enforces a new rule for handling the cloned packets for transmit time stamping. These packets must not be freed using any other function than skb_complete_tx_timestamp. This commit fixes the one and only driver using this API. The driver first appeared in v3.0. Signed-off-by: Richard Cochran Acked-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 6dd160db729a0c96cc640a848e6df88ca6c19d2a Author: Herbert Xu Date: Fri Aug 19 16:11:23 2011 +0800 crypto: cryptd - Use subsys_initcall to prevent races with aesni commit b2bac6acf86d05d8af0499f37d91ecac15722803 upstream. As cryptd is depeneded on by other algorithms such as aesni-intel, it needs to be registered before them. When everything is built as modules, this occurs naturally. However, for this to work when they are built-in, we need to use subsys_initcall in cryptd. Tested-by: Josh Boyer Signed-off-by: Herbert Xu Cc: Kerin Millar Signed-off-by: Greg Kroah-Hartman commit f450df800450e9c7ec8c53bdb72d6c4ef5f17d4e Author: Dan Carpenter Date: Wed Sep 21 20:55:04 2011 +0200 PM / Suspend: Off by one in pm_suspend() commit 528f7ce6e439edeac38f6b3f8561f1be129b5e91 upstream. In enter_state() we use "state" as an offset for the pm_states[] array. The pm_states[] array only has PM_SUSPEND_MAX elements so this test is off by one. Signed-off-by: Dan Carpenter Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman commit 3fa57c1bf5fb311544199b7837a08b9f5bf5e6e4 Author: dpward Date: Mon Sep 5 16:47:24 2011 +0000 net: Handle different key sizes between address families in flow cache commit aa1c366e4febc7f5c2b84958a2dd7cd70e28f9d0 upstream. With the conversion of struct flowi to a union of AF-specific structs, some operations on the flow cache need to account for the exact size of the key. Signed-off-by: David Ward Signed-off-by: David S. Miller Cc: Kim Phillips Signed-off-by: Greg Kroah-Hartman commit 867ca3109d0289d0a62bb3c7fc3d365e9d478fae Author: David Ward Date: Mon Sep 5 16:47:23 2011 +0000 net: Align AF-specific flowi structs to long commit 728871bc05afc8ff310b17dba3e57a2472792b13 upstream. AF-specific flowi structs are now passed to flow_key_compare, which must also be aligned to a long. Signed-off-by: David Ward Signed-off-by: David S. Miller Cc: Kim Phillips Signed-off-by: Greg Kroah-Hartman commit ef52f3936f9f5d770ea177e5c769e68af1701a90 Author: Jiaying Zhang Date: Wed Aug 31 11:50:51 2011 -0400 ext4: remove i_mutex lock in ext4_evict_inode to fix lockdep complaining commit 8c0bec2151a47906bf779c6715a10ce04453ab77 upstream. The i_mutex lock and flush_completed_IO() added by commit 2581fdc810 in ext4_evict_inode() causes lockdep complaining about potential deadlock in several places. In most/all of these LOCKDEP complaints it looks like it's a false positive, since many of the potential circular locking cases can't take place by the time the ext4_evict_inode() is called; but since at the very least it may mask real problems, we need to address this. This change removes the flush_completed_IO() and i_mutex lock in ext4_evict_inode(). Instead, we take a different approach to resolve the software lockup that commit 2581fdc810 intends to fix. Rather than having ext4-dio-unwritten thread wait for grabing the i_mutex lock of an inode, we use mutex_trylock() instead, and simply requeue the work item if we fail to grab the inode's i_mutex lock. This should speed up work queue processing in general and also prevents the following deadlock scenario: During page fault, shrink_icache_memory is called that in turn evicts another inode B. Inode B has some pending io_end work so it calls ext4_ioend_wait() that waits for inode B's i_ioend_count to become zero. However, inode B's ioend work was queued behind some of inode A's ioend work on the same cpu's ext4-dio-unwritten workqueue. As the ext4-dio-unwritten thread on that cpu is processing inode A's ioend work, it tries to grab inode A's i_mutex lock. Since the i_mutex lock of inode A is still hold before the page fault happened, we enter a deadlock. Signed-off-by: Jiaying Zhang Signed-off-by: "Theodore Ts'o" Cc: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit 2fc862e051e87f66de8b505b339e55c509d684a3 Author: Daniel Mack Date: Tue Jun 7 03:01:07 2011 -0700 mtd: pxa3xx_nand: Fix blank page ECC mismatch commit 543e32d5ff165d0d68deedb0e3557478c7c36a4a upstream. This bug was introduced in f8155a40 ("mtd: pxa3xx_nand: rework irq logic") and causes the PXA3xx NAND controller fail to operate with NAND flash that has empty pages. According to the comment in this block, the hardware controller will report a double-bit error for empty pages, which can and must be ignored. This patch restores the original behaviour of the driver. Signed-off-by: Daniel Mack Acked-by: Lei Wen Cc: Haojian Zhuang Cc: David Woodhouse Signed-off-by: Artem Bityutskiy Signed-off-by: Greg Kroah-Hartman commit 7b333e0ef8a1efa488ad98956c6701884b0c2b4b Author: Lei Wen Date: Tue Jun 7 03:01:06 2011 -0700 mtd: pxa3xx_nand: fix nand detection issue commit 0fab028b77d714ad302404b23306cf7adb885223 upstream. When keep_config is set, the detection would goes different routine. That the driver would read out the setting which is set previously by bootloader. While most bootloader keep the irq mask as off, and current driver need all irq default open, keep_config behavior would lead to no irq at all. Signed-off-by: Lei Wen Tested-by: Daniel Mack Signed-off-by: Artem Bityutskiy Signed-off-by: Greg Kroah-Hartman commit 1bd1046f37d0a9a76bbcd45284229edacb8d890d Author: Andres Salomon Date: Fri Oct 14 07:33:20 2011 -0700 mtd: provide an alias for the redboot module name commit d5de1907d0af22e1a02de2b16a624148517a39c2 upstream. parse_mtd_partitions takes a list of partition types; if the driver isn't loaded, it attempts to load it, and then it grabs the partition parser. For redboot, the module name is "redboot.ko", while the parser name is "RedBoot". Since modprobe is case-sensitive, attempting to modprobe "RedBoot" will never work. I suspect the embedded systems that make use of redboot just always manually loaded redboot prior to loading their specific nand chip drivers (or statically compiled it in). Signed-off-by: Andres Salomon Signed-off-by: Artem Bityutskiy Signed-off-by: Greg Kroah-Hartman commit 5805ad8491edbc343a07de169f32ade07dcb3406 Author: Peter Wippich Date: Mon Jun 6 15:50:58 2011 +0200 mtd: mtdchar: add missing initializer on raw write commit bf5140817b2d65faac9b32fc9057a097044ac35b upstream. On writes in MODE_RAW the mtd_oob_ops struct is not sufficiently initialized which may cause nandwrite to fail. With this patch it is possible to write raw nand/oob data without additional ECC (either for testing or when some sectors need different oob layout e.g. bootloader) like nandwrite -n -r -o /dev/mtd0 Signed-off-by: Peter Wippich Tested-by: Ricard Wanderlof Signed-off-by: Artem Bityutskiy Signed-off-by: Greg Kroah-Hartman commit 041f9e20b7f794fd7b4932e05d0c938a9ebbf658 Author: Johannes Berg Date: Fri Oct 28 11:59:47 2011 +0200 mac80211: disable powersave for broken APs commit 05cb91085760ca378f28fc274fbf77fc4fd9886c upstream. Only AID values 1-2007 are valid, but some APs have been found to send random bogus values, in the reported case an AP that was sending the AID field value 0xffff, an AID of 0x3fff (16383). There isn't much we can do but disable powersave since there's no way it can work properly in this case. Reported-by: Bill C Riemers Signed-off-by: Johannes Berg Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 42c6d01ce89d43598fc804cf7c141d3252fe93b5 Author: Eliad Peller Date: Thu Oct 20 19:05:50 2011 +0200 mac80211: config hw when going back on-channel commit 6911bf0453e0d6ea8eb694a4ce67a68d071c538e upstream. When going back on-channel, we should reconfigure the hw iff the hardware is not already configured to the operational channel. Signed-off-by: Eliad Peller Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 632abf8b3f714da01daec2d43ffd9cd7b47f53a9 Author: Eliad Peller Date: Thu Oct 20 19:05:49 2011 +0200 mac80211: fix remain_off_channel regression commit eaa7af2ae582c9a8c51b374c48d5970b748a5ce2 upstream. The offchannel code is currently broken - we should remain_off_channel if the work was started, and the work's channel and channel_type are the same as local->tmp_channel and local->tmp_channel_type. However, if wk->chan_type and local->tmp_channel_type coexist (e.g. have the same channel type), we won't remain_off_channel. This behavior was introduced by commit da2fd1f ("mac80211: Allow work items to use existing channel type.") Tested-by: Ben Greear Signed-off-by: Eliad Peller Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 1cc8631784f67c62a8309897f7d4cb885a05ed6f Author: Rajkumar Manoharan Date: Mon Oct 24 18:13:40 2011 +0530 ath9k_hw: Update AR9485 initvals to fix system hang issue commit 98fb2cc115b4ef1ea0a2d87a170c183bd395dd6c upstream. This patch fixes system hang when resuming from S3 state and lower rate sens failure issue. Signed-off-by: Rajkumar Manoharan Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 6167ded5698377fca7830c22be0ba976f91f2434 Author: Johannes Berg Date: Thu Nov 3 00:07:32 2011 +0000 netlink: validate NLA_MSECS length commit c30bc94758ae2a38a5eb31767c1985c0aae0950b upstream. L2TP for example uses NLA_MSECS like this: policy: [L2TP_ATTR_RECV_TIMEOUT] = { .type = NLA_MSECS, }, code: if (info->attrs[L2TP_ATTR_RECV_TIMEOUT]) cfg.reorder_timeout = nla_get_msecs(info->attrs[L2TP_ATTR_RECV_TIMEOUT]); As nla_get_msecs() is essentially nla_get_u64() plus the conversion to a HZ-based value, this will not properly reject attributes from userspace that aren't long enough and might overrun the message. Add NLA_MSECS to the attribute minlen array to check the size properly. Cc: Thomas Graf Signed-off-by: Johannes Berg Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 1dc88f68f554b318691763867aab4ec7adc60945 Author: Luck, Tony Date: Fri Oct 21 14:42:55 2011 -0700 ACPI atomicio: Convert width in bits to bytes in __acpi_ioremap_fast() commit 3bf3f8b19d2bfccc40f13c456bf339fd8f535ebc upstream. Callers to __acpi_ioremap_fast() pass the bit_width that they found in the acpi_generic_address structure. Convert from bits to bytes when passing to __acpi_find_iomap() - as it wants to see bytes, not bits. Signed-off-by: Tony Luck Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman commit eaeafcd898108e4e026faf43ca41817f5de6ee66 Author: Anton Blanchard Date: Wed Sep 14 09:43:15 2011 +0000 powerpc: Fix deadlock in icswx code commit 8bdafa39a47265bc029838b35cc6585f69224afa upstream. The icswx code introduced an A-B B-A deadlock: CPU0 CPU1 ---- ---- lock(&anon_vma->mutex); lock(&mm->mmap_sem); lock(&anon_vma->mutex); lock(&mm->mmap_sem); Instead of using the mmap_sem to keep mm_users constant, take the page table spinlock. Signed-off-by: Anton Blanchard Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit 71b1a9d35d6cbd2e37c1101ca5f779ca55f7fb03 Author: Thadeu Lima de Souza Cascardo Date: Fri Aug 26 10:36:31 2011 +0000 powerpc/eeh: Fix /proc/ppc64/eeh creation commit 8feaa43494cee5e938fd5a57b9e9bf1c827e6ccd upstream. Since commit 188917e183cf9ad0374b571006d0fc6d48a7f447, /proc/ppc64 is a symlink to /proc/powerpc/. That means that creating /proc/ppc64/eeh will end up with a unaccessible file, that is not listed under /proc/powerpc/ and, then, not listed under /proc/ppc64/. Creating /proc/powerpc/eeh fixes that problem and maintain the compatibility intended with the ppc64 symlink. Signed-off-by: Thadeu Lima de Souza Cascardo Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit 747613961425127da9e14e020500b184d4f7a42c Author: Anton Blanchard Date: Sun Aug 14 14:30:30 2011 +0000 powerpc/pseries: Avoid spurious error during hotplug CPU add commit 9c740025c51a26ab00192cfc464064d4ccbfe3fc upstream. During hotplug CPU add we get the following error: Unexpected Error (0) returned from configure-connector ibm,configure-connector returns 0 for configuration complete, so catch this and avoid the error. Signed-off-by: Anton Blanchard Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit 55a6bcf9d9a66921b7a7a854ca86356e901114fe Author: Anton Blanchard Date: Wed Aug 10 20:44:24 2011 +0000 powerpc: Fix oops when echoing bad values to /sys/devices/system/memory/probe commit a11940978bd598e65996b4f807cf4904793f7025 upstream. If we echo an address the hypervisor doesn't like to /sys/devices/system/memory/probe we oops the box: # echo 0x10000000000 > /sys/devices/system/memory/probe kernel BUG at arch/powerpc/mm/hash_utils_64.c:541! The backtrace is: create_section_mapping arch_add_memory add_memory memory_probe_store sysdev_class_store sysfs_write_file vfs_write SyS_write In create_section_mapping we BUG if htab_bolt_mapping returned an error. A better approach is to return an error which will propagate back to userspace. Rerunning the test with this patch applied: # echo 0x10000000000 > /sys/devices/system/memory/probe -bash: echo: write error: Invalid argument Signed-off-by: Anton Blanchard Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit 2b7940d84f184ad4b71cf66465bb55212d3b3fd8 Author: Anton Blanchard Date: Wed Aug 10 20:44:21 2011 +0000 powerpc/numa: Remove double of_node_put in hot_add_node_scn_to_nid commit 6083184269fd723affca4f6340e491950267622a upstream. During memory hotplug testing, I got the following warning: ERROR: Bad of_node_put() on /memory@0 of_node_release kref_put of_node_put of_find_node_by_type hot_add_node_scn_to_nid hot_add_scn_to_nid memory_add_physaddr_to_nid ... of_find_node_by_type() loop does the of_node_put for us so we only need the handle the case where we terminate the loop early. As suggested by Stephen Rothwell we can do the of_node_put unconditionally outside of the loop since of_node_put handles a NULL argument fine. Signed-off-by: Anton Blanchard Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit 656460cd7714653cf60a10c79e02cbfe2d9bf732 Author: Al Viro Date: Mon Nov 7 21:21:26 2011 +0000 VFS: we need to set LOOKUP_JUMPED on mountpoint crossing commit a3fbbde70a0cec017f2431e8f8de208708c76acc upstream. Mountpoint crossing is similar to following procfs symlinks - we do not get ->d_revalidate() called for dentry we have arrived at, with unpleasant consequences for NFS4. Simple way to reproduce the problem in mainline: cat >/tmp/a.c <<'EOF' #include #include #include main() { struct flock fl = {.l_type = F_RDLCK, .l_whence = SEEK_SET, .l_len = 1}; if (fcntl(0, F_SETLK, &fl)) perror("setlk"); } EOF cc /tmp/a.c -o /tmp/test then on nfs4: mount --bind file1 file2 /tmp/test < file1 # ok /tmp/test < file2 # spews "setlk: No locks available"... What happens is the missing call of ->d_revalidate() after mountpoint crossing and that's where NFS4 would issue OPEN request to server. The fix is simple - treat mountpoint crossing the same way we deal with following procfs-style symlinks. I.e. set LOOKUP_JUMPED... Signed-off-by: Al Viro Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 0447f4d5654bb5d95008f16dad839104f8d0d39a Author: Mike Miller Date: Fri Oct 21 08:19:43 2011 +0200 hpsa: add small delay when using PCI Power Management to reset for kump commit c4853efec665134b2e6fc9c13447323240980351 upstream. The P600 requires a small delay when changing states. Otherwise we may think the board did not reset and we bail. This for kdump only and is particular to the P600. Signed-off-by: Mike Miller Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman commit 8185df43d48a71605934d9a7c6db4d93e7b25d5c Author: Dan McGee Date: Tue Nov 1 18:23:10 2011 -0500 VFS: fix statfs() automounter semantics regression commit 5c8a0fbba543d9428a486f0d1282bbcf3cf1d95a upstream. No one in their right mind would expect statfs() to not work on a automounter managed mount point. Fix it. [ I'm not sure about the "no one in their right mind" part. It's not mounted, and you didn't ask for it to be mounted. But nobody will really care, and this probably makes it match previous semantics, so.. - Linus ] This mirrors the fix made to the quota code in 815d405ceff0d69646. Signed-off-by: Dan McGee Cc: Trond Myklebust Cc: Alexander Viro Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 9ad93ba528bf5555a96ef64b7ec1af398277ad52 Author: Konrad Rzeszutek Wilk Date: Mon Oct 10 12:33:21 2011 -0400 xen/blkback: Report VBD_WSECT (wr_sect) properly. commit 5c62cb48602dba95159c81ffeca179d3852e25be upstream. We did not increment the amount of sectors written to disk b/c we tested for the == WRITE which is incorrect - as the operations are more of WRITE_FLUSH, WRITE_ODIRECT. This patch fixes it by doing a & WRITE check. Reported-by: Andy Burns Suggested-by: Ian Campbell Signed-off-by: Konrad Rzeszutek Wilk Signed-off-by: Greg Kroah-Hartman commit f53881e6463124c910b17a5ea722a5cf5ab67fb3 Author: Tejun Heo Date: Mon Oct 17 13:42:43 2011 +0200 block: make gendisk hold a reference to its queue commit f992ae801a7dec34a4ed99a6598bbbbfb82af4fb upstream. The following command sequence triggers an oops. # mount /dev/sdb1 /mnt # echo 1 > /sys/class/scsi_device/0\:0\:1\:0/device/delete # umount /mnt general protection fault: 0000 [#1] PREEMPT SMP CPU 2 Modules linked in: Pid: 791, comm: umount Not tainted 3.1.0-rc3-work+ #8 Bochs Bochs RIP: 0010:[] [] __lock_acquire+0x389/0x1d60 ... Call Trace: [] lock_acquire+0x95/0x140 [] _raw_spin_lock+0x3b/0x50 [] bdi_lock_two+0x5c/0x70 [] bdev_inode_switch_bdi+0x4c/0xf0 [] __blkdev_put+0x11b/0x1d0 [] __blkdev_put+0x160/0x1d0 [] blkdev_put+0x5f/0x190 [] kill_block_super+0x4d/0x80 [] deactivate_locked_super+0x45/0x70 [] deactivate_super+0x4a/0x70 [] mntput_no_expire+0xed/0x130 [] sys_umount+0x7e/0x3a0 [] system_call_fastpath+0x16/0x1b This is because bdev holds on to disk but disk doesn't pin the associated queue. If a SCSI device is removed while the device is still open, the sdev puts the base reference to the queue on release. When the bdev is finally released, the associated queue is already gone along with the bdi and bdev_inode_switch_bdi() ends up dereferencing already freed bdi. Even if it were not for this bug, disk not holding onto the associated queue is very unusual and error-prone. Fix it by making add_disk() take an extra reference to its queue and put it on disk_release() and ensuring that disk and its fops owner are put in that order after all accesses to the disk and queue are complete. Signed-off-by: Tejun Heo Cc: Jens Axboe Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman commit 6fa9e3e3e01b8741eead6e00bb968ef3b4fddc3f Author: NeilBrown Date: Tue Oct 25 10:25:49 2011 +1100 NFS/sunrpc: don't use a credential with extra groups. commit dc6f55e9f8dac4b6479be67c5c9128ad37bb491f upstream. The sunrpc layer keeps a cache of recently used credentials and 'unx_match' is used to find the credential which matches the current process. However unx_match allows a match when the cached credential has extra groups at the end of uc_gids list which are not in the process group list. So if a process with a list of (say) 4 group accesses a file and gains access because of the last group in the list, then another process with the same uid and gid, and a gid list being the first tree of the gids of the original process tries to access the file, it will be granted access even though it shouldn't as the wrong rpc credential will be used. Signed-off-by: NeilBrown Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 22bef71b2e411ee05b9b9199394c3a209924926f Author: Mark Brown Date: Tue Nov 1 13:53:37 2011 +0000 ASoC: Ensure the WM8962 oscillator and PLLs start up disabled commit 2af8de8c39cf58e5a5e40a9d5d71332da98e6ba7 upstream. Since there is no current software control for these they would otherwise be left enabled, consuming power. Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 6601dc2a3a0518851fd47b8a7e34e624c3ddceef Author: Mark Brown Date: Tue Nov 1 13:36:10 2011 +0000 ASoC: Ensure WM8962 PLL registers are reset commit 4f4488abc97c1c27ff029f887944e6a6da1f5733 upstream. The WM8962 has a separate software reset for the PLL registers. Ensure that these are reset also on startup. Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit f11d1a122ac23d7da2dedd0104851b58461e32b3 Author: Hong Xu Date: Fri Oct 28 15:36:39 2011 +0800 ASoC: WM8904: Set `invert' bit for Capture Switch commit 5a7c5f26df3c0122814dfa1c13ef6dfbdbffdb86 upstream. Set `invert' bit for Capture Switch. Otherwise analogue is muted when Capture Switch is ON. Signed-off-by: Hong Xu Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit a8c34bb24eb25d50481528cbfc70e29bde147cc2 Author: Axel Lin Date: Fri Oct 28 15:17:56 2011 +0800 ASoC: Leave input audio data bit length settings untouched in wm8711_set_dai_fmt commit d558cfc30064a97c2c65dbd2b3a4f5a1dea7ec1b upstream. Current implementation in wm8711_set_dai_fmt always clear BIT[3:2] (the Input Audio Data Bit Length Select) of WM8711_IFACE(07h) register. Input Audio Data Bit Length Select bits are set by wm8711_hw_params, we should leave BIT[3:2] untouched in wm8711_set_dai_fmt. Signed-off-by: Axel Lin Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 9eb72dda42ed9162026d69aabcdc0528d7994193 Author: Axel Lin Date: Fri Oct 28 11:08:01 2011 +0800 ASoC: wm8711: Fix wrong mask for setting input audio data bit length select commit 04c57163c8edfbc50e022737014069998ba4fc5f upstream. The Input Audio Data Bit Length Select is controlled by BIT[3:2] of WM8711_IFACE(07h) register. Current code incorrectly masks BIT[1:0] which is for Audio Data Format Select. Signed-off-by: Axel Lin Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit ac310457b4fd7634983788faf0c4f29cd2d5384b Author: nagalakshmi.nandigama@lsi.com Date: Fri Oct 21 10:06:33 2011 +0530 mpt2sas: Fix for system hang when discovery in progress commit 0167ac67ff6f35bf2364f7672c8012b0cd40277f upstream. Fix for issue : While discovery is in progress, hot unplug and hot plug of enclosure connected to the controller card is causing system to hang. When a device is in the process of being detected at driver load time then if it is removed, the device that is no longer present will not be added to the list. So the code in _scsih_probe_sas() is rearranged as such so the devices that failed to be detected are not added to the list. Signed-off-by: Nagalakshmi Nandigama Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 6fffe112243a02792d352087d32bf05ccb2cf90d Author: Anton Blanchard Date: Thu Nov 3 08:56:22 2011 +1100 Fix block queue and elevator memory leak in scsi_alloc_sdev commit f7c9c6bb14f3104608a3a83cadea10a6943d2804 upstream. When looking at memory consumption issues I noticed quite a lot of memory in the kmalloc-2048 bucket: OBJS ACTIVE USE OBJ SIZE SLABS OBJ/SLAB CACHE SIZE NAME 6561 6471 98% 2.30K 243 27 15552K kmalloc-2048 Over 15MB. slub debug shows that cfq is responsible for almost all of it: # sort -nr /sys/kernel/slab/kmalloc-2048/alloc_calls 6402 .cfq_init_queue+0xec/0x460 age=43423/43564/43655 pid=1 cpus=4,11,13 In scsi_alloc_sdev we do scsi_alloc_queue but if slave_alloc fails we don't free it with scsi_free_queue. The patch below fixes the issue: OBJS ACTIVE USE OBJ SIZE SLABS OBJ/SLAB CACHE SIZE NAME 135 72 53% 2.30K 5 27 320K kmalloc-2048 # cat /sys/kernel/slab/kmalloc-2048/alloc_calls 3 .cfq_init_queue+0xec/0x460 age=3811/3876/3925 pid=1 cpus=4,11,13 Signed-off-by: Anton Blanchard Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 8fa9474347f32c7991adc1271e6f34e01479dd31 Author: Bart Van Assche Date: Fri Sep 23 19:48:18 2011 +0200 Make scsi_free_queue() kill pending SCSI commands commit 3308511c93e6ad0d3c58984ecd6e5e57f96b12c8 upstream. Make sure that SCSI device removal via scsi_remove_host() does finish all pending SCSI commands. Currently that's not the case and hence removal of a SCSI host during I/O can cause a deadlock. See also "blkdev_issue_discard() hangs forever if underlying storage device is removed" (http://bugzilla.kernel.org/show_bug.cgi?id=40472). See also http://lkml.org/lkml/2011/8/27/6. Signed-off-by: Bart Van Assche Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 51b702dc3de6c2b5ba3c091f755271776bce7ee4 Author: Moger, Babu Date: Wed Oct 26 14:29:38 2011 -0400 scsi_dh: check queuedata pointer before proceeding further commit a18a920c70d48a8e4a2b750d8a183b3c1a4be514 upstream. This patch validates sdev pointer in scsi_dh_activate before proceeding further. Without this check we might see the panic as below. I have seen this panic multiple times.. Call trace: #0 [ffff88007d647b50] machine_kexec at ffffffff81020902 #1 [ffff88007d647ba0] crash_kexec at ffffffff810875b0 #2 [ffff88007d647c70] oops_end at ffffffff8139c650 #3 [ffff88007d647c90] __bad_area_nosemaphore at ffffffff8102dd15 #4 [ffff88007d647d50] page_fault at ffffffff8139b8cf [exception RIP: scsi_dh_activate+0x82] RIP: ffffffffa0041922 RSP: ffff88007d647e00 RFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000000093c5 RDX: 00000000000093c5 RSI: ffffffffa02e6640 RDI: ffff88007cc88988 RBP: 000000000000000f R8: ffff88007d646000 R9: 0000000000000000 R10: ffff880082293790 R11: 00000000ffffffff R12: ffff88007cc88988 R13: 0000000000000000 R14: 0000000000000286 R15: ffff880037b845e0 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0000 #5 [ffff88007d647e38] run_workqueue at ffffffff81060268 #6 [ffff88007d647e78] worker_thread at ffffffff81060386 #7 [ffff88007d647ee8] kthread at ffffffff81064436 #8 [ffff88007d647f48] kernel_thread at ffffffff81003fba Signed-off-by: Babu Moger Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 292b3893b8e010398a338b482f40cbcd62e01a97 Author: Petr Uzel Date: Fri Oct 21 13:31:09 2011 +0200 st: fix race in st_scsi_execute_end commit c68bf8eeaa57c852e74adcf597237be149eef830 upstream. The call to complete() in st_scsi_execute_end() wakes up sleeping thread in write_behind_check(), which frees the st_request, thus invalidating the pointer to the associated bio structure, which is then passed to the blk_rq_unmap_user(). Fix by storing pointer to bio structure into temporary local variable. This bug is present since at least linux-2.6.32. Signed-off-by: Petr Uzel Reported-by: Juergen Groß Reviewed-by: Jan Kara Acked-by: Kai Mäkisara Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit fef547148349098f58bcea1c6cda5be1f6f8719c Author: Nicholas Bellinger Date: Mon Oct 24 13:35:37 2011 -0700 tcm_loop: Add explict read buffer memset for SCF_SCSI_CONTROL_SG_IO_CDB commit 8cd79f24350826b81e16990d9e12bc878e67d385 upstream. This patch addresses an issue with buggy userspace code sending I/O via scsi-generic that does not explictly clear their associated read buffers. It adds an explict memset of the first SGL entry within tcm_loop_new_cmd_map() for SCF_SCSI_CONTROL_SG_IO_CDB payloads that are currently guaranteed to be a single SGL by target-core code. This issue is a side effect of the v3.1-rc1 merge to remove the extra memcpy between certain control CDB types using a contigious + cleared buffer in target-core, and performing a memcpy into the SGL list within tcm_loop. It was originally mainfesting itself by udev + scsi_id + scsi-generic not properly setting up the expected /dev/disk/by-id/ symlinks because the INQUIRY payload was containing extra bogus data preventing the proper NAA IEEE WWN from being parsed by userspace. Cc: Christoph Hellwig Cc: Andy Grover Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman commit 24b791339f0e80761de402cbb13ff2ddb19b8c03 Author: Guenter Roeck Date: Sun Nov 6 20:25:18 2011 +0100 hwmon: (w83627ehf) Fix broken driver init commit bfa02b0da66965caf46e441270af87edda4fea14 upstream. Commit 2265cef2 (hwmon: (w83627ehf) Properly report PECI and AMD-SI sensor types) results in kernel panic if data->temp_label was not initialized. The problem was found with chip W83627DHG-P. Add check if data->temp->label was set before use. Based on incomplete patch by Alexander Beregalov. Reported-by: Alexander Beregalov Tested-by: Alexander Beregalov Signed-off-by: Guenter Roeck Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit e3c298129b14f1591e647320bba3f9bc21ea63f1 Author: Jean Delvare Date: Fri Nov 4 12:00:47 2011 +0100 hwmon: (w83627ehf) Properly report PECI and AMD-SI sensor types commit 2265cef2751b3441df91f85e0107f9f549e5b711 upstream. When temperature sources are PECI or AMD-SI agents, it makes no sense to report their type as diode or thermistor. Instead we must report their digital nature. Signed-off-by: Jean Delvare Acked-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit 0fb2a32e2c8f58b5d43846e4de46364998f9af5d Author: Jean Delvare Date: Sun Nov 6 20:25:18 2011 +0100 hwmon: (coretemp) Fix for non-SMP builds commit 2aba6cac2a84f3b80e11a680c34d55e7739b474d upstream. The definition of TO_ATTR_NO in the non-SMP case is wrong. As the SMP definition resolves to the correct value, just use this for both cases. Without this fix the temperature attributes are named temp0_* instead of temp2_*, so libsensors won't pick them. Broken since kernel 3.0. Signed-off-by: Jean Delvare Tested-by: Phil Sutter Acked-by: Durgadoss R Acked-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit fa7e2a6289195e502003f59768837107a59678c0 Author: Mike Miller Date: Thu Oct 20 22:19:17 2011 +0200 cciss: add small delay when using PCI Power Management to reset for kump commit ab5dbebe33e0c353e8545f09c34553ac3351dad6 upstream. The P600 requires a small delay when changing states. Otherwise we may think the board did not reset and we bail. This for kdump only and is particular to the P600. Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman commit 5432c16a57990f12d41f57ed99ba194c368c30d0 Author: Alan Stern Date: Fri Nov 4 00:52:46 2011 +0100 USB: Update last_busy time after autosuspend fails commit b2c0a863e14676fa5760c6d828fd373288e2f64a upstream. Originally, the runtime PM core would send an idle notification whenever a suspend attempt failed. The idle callback routine could then schedule a delayed suspend for some time later. However this behavior was changed by commit f71648d73c1650b8b4aceb3856bebbde6daa3b86 (PM / Runtime: Remove idle notification after failing suspend). No notifications were sent, and there was no clear mechanism to retry failed suspends. This caused problems for the usbhid driver, because it fails autosuspend attempts as long as a key is being held down. A companion patch changes the PM core's behavior, but we also need to change the USB core. In particular, this patch (as1493) updates the device's last_busy time when an autosuspend fails, so that the PM core will retry the autosuspend in the future when the delay time expires again. Signed-off-by: Alan Stern Tested-by: Henrik Rydberg Acked-by: Greg Kroah-Hartman Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman commit 8dc9c7911421d8e45901ffaf483b5dca99cbb055 Author: Alan Stern Date: Thu Nov 3 23:39:18 2011 +0100 PM / Runtime: Automatically retry failed autosuspends commit 886486b792e4f6f96d4fbe8ec5bf20811cab7d6a upstream. Originally, the runtime PM core would send an idle notification whenever a suspend attempt failed. The idle callback routine could then schedule a delayed suspend for some time later. However this behavior was changed by commit f71648d73c1650b8b4aceb3856bebbde6daa3b86 (PM / Runtime: Remove idle notification after failing suspend). No notifications were sent, and there was no clear mechanism to retry failed suspends. This caused problems for the usbhid driver, because it fails autosuspend attempts as long as a key is being held down. Therefore this patch (as1492) adds a mechanism for retrying failed autosuspends. If the callback routine updates the last_busy field so that the next autosuspend expiration time is in the future, the autosuspend will automatically be rescheduled. Signed-off-by: Alan Stern Tested-by: Henrik Rydberg Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman commit 2d92f691cd1a1be5cdefb10d559fdd7443d4df7a Author: Srinivas Kandagatla Date: Tue Aug 2 18:49:52 2011 +0100 kbuild: Fix help text not displayed in choice option. commit 3f198dfee49d2e9c30583c62b0c79286c78c7b44 upstream. Help text under choice menu is never displayed because it does not have symbol name associated with it, however many kconfigs have help text under choice, assuming that it will be displayed when user selects help. for example in Kconfig if we have: choice prompt "Choice" ---help--- HELP TEXT ... config A bool "A" config B bool "B" endchoice Without this patch "HELP TEXT" is not displayed when user selects help option when "Choice" is highlighted from menuconfig or xconfig or gconfig. This patch changes the logic in menu_get_ext_help to display help for cases which dont have symbol names like choice. Signed-off-by: Srinivas Kandagatla Reviewed-by: Stuart Menefy Reviewed-by: Arnaud Lacombe Signed-off-by: Michal Marek Signed-off-by: Greg Kroah-Hartman commit 7a427e433356a354b29459b745ebd8103df96329 Author: Alex Deucher Date: Thu Nov 3 11:21:39 2011 -0400 drm/radeon/kms: set HPD polarity in hpd_init() commit 64912e997f0fe13512e4c7b90e4f7c11cb922ab5 upstream. Polarity needs to be set accordingly to connector status (connected or disconnected). Set it up in hpd_init() so first hotplug works reliably no matter what is the initial set of connector. hpd_init() also covers resume so HPD will work correctly after resume as well. Signed-off-by: Alex Deucher Cc: Jerome Glisse Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 053b6d52c7484feaaea4945140dd0a2dde3461e8 Author: Alex Deucher Date: Tue Nov 1 14:20:30 2011 -0400 drm/radeon/kms: add MSI module parameter commit a18cee15ed4c8b6a35f96b7b26a46bac32e04bd9 upstream. Allow the user to override whether MSIs are enabled or not on supported ASICs. MSIs are disabled by default on IGP chips as they tend not to work. However certain IGP chips only seem to work with MSIs enabled. I suspect this is a chipset or bios issue, but I'm not sure what the proper fix is. This will at least make diagnosing and working around the problem much easier. See: https://bugs.freedesktop.org/show_bug.cgi?id=37679 Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 957450510b2c59f3689e6114de6b32d5d3aad7c6 Author: Alex Deucher Date: Tue Nov 1 14:14:18 2011 -0400 drm/radeon/kms: Add MSI quirk for Dell RS690 commit 01e718ec194e30b3e8eb3858c742c13649757efc upstream. Some Dell laptops only seem to work with MSIs. This looks like a platform/bios bug. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=37679 Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 35f6259abb1d8153d6a7552895e8126b8bcf2c61 Author: Alex Deucher Date: Mon Oct 31 08:54:41 2011 -0400 drm/radeon/kms: properly set panel mode for eDP commit 00dfb8df5bf8c3afe4c0bb8361133156b06b7a2c upstream. This should make eDP more reliable. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit ff356c22478a5487e2edaaad31f60bc3868c43f5 Author: Jerome Glisse Date: Fri Oct 28 17:52:34 2011 -0400 drm/radeon: set hpd polarity at init time so hotplug detect works commit 8ab250d4484b72ccc78e34276c5ffa84c1d41303 upstream. Polarity needs to be set accordingly to connector status (connected or disconnected). Set it up at module init so first hotplug works reliably no matter what is the initial set of connector. Signed-off-by: Jerome Glisse Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit be72d16568ac4058c41baa5fb75ce906d39b9dcd Author: Alex Deucher Date: Tue Oct 25 15:11:08 2011 -0400 drm/radeon/kms: Add MSI quirk for HP RS690 commit b362105f7f5223fa4d2e03ceeea0e51da754ccc6 upstream. Some HP laptops only seem to work with MSIs. This looks like a platform/bios bug. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=37679 Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit fd33e34e106cb531435e4f7ed058c0c93a26c9d7 Author: Alex Deucher Date: Tue Oct 25 14:58:49 2011 -0400 drm/radeon/kms: split MSI check into a separate function commit 8f6c25c59b0c895c68cae59d1b34e9a7b36971bc upstream. This makes it easier to add quirks for certain systems. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 3fa1ae816c22f98f0f933ad77da681ab28f7845d Author: Jerome Glisse Date: Mon Oct 24 18:16:34 2011 -0400 drm/radeon: avoid bouncing connector status btw disconnected & unknown commit 340764465aa4a586ca332e61ae64883e5ad6f183 upstream. Since force handling rework of d0d0a225e6ad43314c9aa7ea081f76adc5098ad4 we could end up bouncing connector status btw disconnected and unknown. When connector status change a call to output_poll_changed happen which in turn ask again for detect but with force set. So set the load detect flags whenever we report the connector as connected or unknown this avoid bouncing btw disconnected and unknown. Signed-off-by: Jerome Glisse Reviewed-by: Alex Deucher Signed-off-by: Dave Airlie Cc: Stefan Lippers-Hollmann Signed-off-by: Greg Kroah-Hartman commit d429701077f158a4b7bdf4a8490d3ed9847217e5 Author: Takashi Iwai Date: Thu Nov 3 16:54:06 2011 +0100 ALSA: hda/realtek - Skip invalid digital out pins commit 51e4152a969aa6d2306492ebf143932dcb535c9b upstream. Some BIOS report invalid pins as digital output pins. The driver checks the connection but it doesn't do it fully correctly, and it leaves some undefined value as the audio-out widget, which makes the driver spewing warnings. This patch fixes the issue. Reference: https://bugzilla.novell.com/show_bug.cgi?id=727348 Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit ec0baacddc46b83b95b6bb4245f16a3c7d16988b Author: Charles Chin Date: Wed Nov 2 07:56:58 2011 +0100 ALSA: hda - Add support for 92HD65 / 92HD66 family of codecs commit ad5d8755116b431f0709c745ee17cb567a478d43 upstream. These codecs have SPDIF-in, which is new to the 92HD83xxx compatible families, so a bit of logic is added to support them. Signed-off-by: Charles Chin Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit a7ae01515249c673c1e8e8ad5addd6920b980a3b Author: Charles Chin Date: Wed Nov 2 07:53:30 2011 +0100 ALSA: hda - Disable power-widget control for IDT 92HD83/93 as default commit 35c11777b906042eca9e6f1c03e464726c7faa07 upstream. The power-widget control in patch_stac92hd83xxx() never worked properly, thus it's safer to turn it off as default for now. Signed-off-by: Charles Chin Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit c52e585cf03d3faa89ace0368bf66a3298e66a8b Author: Clemens Ladisch Date: Sat Oct 15 23:19:25 2011 +0200 ALSA: ua101: fix crash when unplugging commit 862a6244eb9f9f5123fe819454fcfcae0ee1f2f9 upstream. If the device is unplugged while running, it is possible for a PCM device to be closed after the disconnect callback has returned. This means that kill_stream_urb() and disable_iso_interface() would try to access already-invalid or freed USB data structures. The function free_usb_related_resources() was intended to prevent this, but forgot to clear the affected variables. Reported-and-tested-by: Olivier Courtay Signed-off-by: Clemens Ladisch Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 5796ee30587cb5f887a7fe6182c2bbcc3d31f0ad Author: Thomas Gleixner Date: Tue Oct 25 02:30:50 2011 +0000 net: Unlock sock before calling sk_free() [ Upstream commit b0691c8ee7c28a72748ff32e91b165ec12ae4de6 ] Signed-off-by: Thomas Gleixner Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit ce0f562ecf544f386b6ae95f490cd06f7da2deb4 Author: stephen hemminger Date: Mon Oct 3 18:14:45 2011 +0000 bridge: leave carrier on for empty bridge [ Upstream commit b64b73d7d0c480f75684519c6134e79d50c1b341 ] This resolves a regression seen by some users of bridging. Some users use the bridge like a dummy device. They expect to be able to put an IPv6 address on the device with no ports attached. Although there are better ways of doing this, there is no reason to not allow it. Note: the bridge still will reflect the state of ports in the bridge if there are any added. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 621112ec06bbe3a6dbb6af5f4db3451d01b309f9 Author: Andrea Arcangeli Date: Wed Nov 2 13:37:36 2011 -0700 thp: share get_huge_page_tail() commit b35a35b556f5e6b7993ad0baf20173e75c09ce8c upstream. This avoids duplicating the function in every arch gup_fast. Signed-off-by: Andrea Arcangeli Cc: Peter Zijlstra Cc: Hugh Dickins Cc: Johannes Weiner Cc: Rik van Riel Cc: Mel Gorman Cc: KOSAKI Motohiro Cc: Benjamin Herrenschmidt Cc: David Gibson Cc: Martin Schwidefsky Cc: Heiko Carstens Cc: David Miller Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 1a2417c30c86961992afae7eb8f803acca2f6b9b Author: Andrea Arcangeli Date: Wed Nov 2 13:37:28 2011 -0700 s390: gup_huge_pmd() return 0 if pte changes commit 0693bc9ce2cc4f6a1b9c3c05790fc149a74c0b87 upstream. s390 didn't return 0 in that case, if it's rolling back the *nr pointer it should also return zero to avoid adding pages to the array at the wrong offset. Signed-off-by: Andrea Arcangeli Cc: Peter Zijlstra Cc: Hugh Dickins Cc: Johannes Weiner Cc: Rik van Riel Cc: Mel Gorman Cc: KOSAKI Motohiro Cc: Benjamin Herrenschmidt Cc: David Gibson Cc: Martin Schwidefsky Cc: Heiko Carstens Cc: David Miller Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 7a093bf2f9356230afccb4b79091787feb5aed97 Author: Andrea Arcangeli Date: Wed Nov 2 13:37:25 2011 -0700 s390: gup_huge_pmd() support THP tail recounting commit 220a2eb228d032acde60e9fd044ca802706ff583 upstream. Up to this point the code assumed old refcounting for hugepages (pre-thp). This updates the code directly to the thp mapcount tail page refcounting. Signed-off-by: Andrea Arcangeli Cc: Peter Zijlstra Cc: Hugh Dickins Cc: Johannes Weiner Cc: Rik van Riel Cc: Mel Gorman Cc: KOSAKI Motohiro Cc: Benjamin Herrenschmidt Cc: David Gibson Cc: Martin Schwidefsky Cc: Heiko Carstens Cc: David Miller Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 2429d1c2f20466effdc70ced613f591f8675059f Author: Andrea Arcangeli Date: Wed Nov 2 13:37:19 2011 -0700 powerpc: gup_huge_pmd() return 0 if pte changes commit cf592bf768c4fa40282b8fce58a80820065de2cb upstream. powerpc didn't return 0 in that case, if it's rolling back the *nr pointer it should also return zero to avoid adding pages to the array at the wrong offset. Signed-off-by: Andrea Arcangeli Cc: Peter Zijlstra Cc: Hugh Dickins Cc: Johannes Weiner Cc: Rik van Riel Cc: Mel Gorman Cc: KOSAKI Motohiro Cc: Benjamin Herrenschmidt Acked-by: David Gibson Cc: Martin Schwidefsky Cc: Heiko Carstens Cc: David Miller Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 87c2bd66eef0c5685bb29fd995f6b77fa4d07ed1 Author: Andrea Arcangeli Date: Wed Nov 2 13:37:15 2011 -0700 powerpc: gup_hugepte() support THP based tail recounting commit 3526741f0964c88bc2ce511e1078359052bf225b upstream. Up to this point the code assumed old refcounting for hugepages (pre-thp). This updates the code directly to the thp mapcount tail page refcounting. Signed-off-by: Andrea Arcangeli Cc: Peter Zijlstra Cc: Hugh Dickins Cc: Johannes Weiner Cc: Rik van Riel Cc: Mel Gorman Cc: KOSAKI Motohiro Cc: Benjamin Herrenschmidt Cc: David Gibson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit cf2f493ba5c49afe9efd3afa02a505e9b060832d Author: Andrea Arcangeli Date: Wed Nov 2 13:37:11 2011 -0700 powerpc: gup_hugepte() avoid freeing the head page too many times commit 8596468487e2062cae2aad56e973784e03959245 upstream. We only taken "refs" pins on the head page not "*nr" pins. Signed-off-by: Andrea Arcangeli Cc: Peter Zijlstra Cc: Hugh Dickins Cc: Johannes Weiner Cc: Rik van Riel Cc: Mel Gorman Cc: KOSAKI Motohiro Cc: Benjamin Herrenschmidt Acked-by: David Gibson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit acafc792476742f042e2d7a3679dbaa097444ccc Author: Andrea Arcangeli Date: Wed Nov 2 13:37:08 2011 -0700 powerpc: get_hugepte() don't put_page() the wrong page commit 405e44f2e312dd5dd63e5a9f459bffcbcd4368ef upstream. "page" may have changed to point to the next hugepage after the loop completed, The references have been taken on the head page, so the put_page must happen there too. This is a longstanding issue pre-thp inclusion. It's totally unclear how these page_cache_add_speculative and pte_val(pte) != pte_val(*ptep) checks are necessary across all the powerpc gup_fast code, when x86 doesn't need any of that: there's no way the page can be freed with irq disabled so we're guaranteed the atomic_inc will happen on a page with page_count > 0 (so not needing the speculative check). The pte check is also meaningless on x86: no need to rollback on x86 if the pte changed, because the pte can still change a CPU tick after the check succeeded and it won't be rolled back in that case. The important thing is we got a reference on a valid page that was mapped there a CPU tick ago. So not knowing the soft tlb refill code of ppc64 in great detail I'm not removing the "speculative" page_count increase and the pte checks across all the code, but unless there's a strong reason for it they should be later cleaned up too. If a pte can change from huge to non-huge (like it could happen with THP) passing a pte_t *ptep to gup_hugepte() would also require to repeat the is_hugepd in gup_hugepte(), but that shouldn't happen with hugetlbfs only so I'm not altering that. Signed-off-by: Andrea Arcangeli Cc: Peter Zijlstra Cc: Hugh Dickins Cc: Johannes Weiner Cc: Rik van Riel Cc: Mel Gorman Cc: KOSAKI Motohiro Cc: Benjamin Herrenschmidt Acked-by: David Gibson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 45a2755f0fd17acf45c7cea183815c65f28154c3 Author: Andrea Arcangeli Date: Wed Nov 2 13:37:03 2011 -0700 powerpc: remove superfluous PageTail checks on the pte gup_fast commit 2839bdc1bfc0af76a2f0f11eca011590520a04fa upstream. This part of gup_fast doesn't seem capable of handling hugetlbfs ptes, those should be handled by gup_hugepd only, so these checks are superfluous. Plus if this wasn't a noop, it would have oopsed because, the insistence of using the speculative refcounting would trigger a VM_BUG_ON if a tail page was encountered in the page_cache_get_speculative(). Signed-off-by: Andrea Arcangeli Cc: Peter Zijlstra Cc: Hugh Dickins Cc: Johannes Weiner Cc: Rik van Riel Cc: Mel Gorman Cc: KOSAKI Motohiro Cc: Benjamin Herrenschmidt Acked-by: David Gibson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 8adc3d3df0562b8dc4008f458081dcc2d8b98863 Author: Oliver Hartkopp Date: Thu Sep 29 15:33:47 2011 -0400 can bcm: fix incomplete tx_setup fix commit 12d0d0d3a7349daa95dbfd5d7df8146255bc7c67 upstream. The commit aabdcb0b553b9c9547b1a506b34d55a764745870 ("can bcm: fix tx_setup off-by-one errors") fixed only a part of the original problem reported by Andre Naujoks. It turned out that the original code needed to be re-ordered to reduce complexity and to finally fix the reported frame counting issues. Signed-off-by: Oliver Hartkopp Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 6d3607b179804e8ff4e2a1304ee238a4f6dc035c Author: Andiry Xu Date: Fri Sep 23 14:19:50 2011 -0700 xHCI: Clear PLC for USB2 root hub ports commit 6fd4562178508a0949c9fdecd8558d8b10d671bd upstream. When the link state changes, xHC will report a port status change event and set the PORT_PLC bit, for both USB3 and USB2 root hub ports. The PLC will be cleared by usbcore for USB3 root hub ports, but not for USB2 ports, because they do not report USB_PORT_STAT_C_LINK_STATE in wPortChange. Clear it for USB2 root hub ports in handle_port_status(). Signed-off-by: Andiry Xu Signed-off-by: Sarah Sharp Signed-off-by: Greg Kroah-Hartman commit 1c349398c8583d23bdf397363aedaae55d889c03 Author: Andiry Xu Date: Fri Sep 23 14:19:49 2011 -0700 xHCI: test and clear RWC bit commit d2f52c9e585bbb1a3c164e02b8dcd0d996c67353 upstream. Introduce xhci_test_and_clear_bit() to clear RWC bit in PORTSC register. Signed-off-by: Andiry Xu Signed-off-by: Sarah Sharp Signed-off-by: Greg Kroah-Hartman commit 567c6a1ce9d9417c33176bb848a6287f5bae6dd4 Author: Sarah Sharp Date: Fri Sep 2 11:05:40 2011 -0700 xhci: If no endpoints changed, don't issue BW command. commit 2dc3753997f3c80ce8b950242ab9bb3fb936acfd upstream. Some alternate interface settings have no endpoints associated with them. This shows up in some USB webcams, particularly the Logitech HD 1080p, which uses the uvcvideo driver. If a driver switches between two alt settings with no endpoints, there is no need to issue a configure endpoint command, because there is no endpoint information to update. The only time a configure endpoint command with just the add slot flag set makes sense is when the driver is updating hub characteristics in the slot context. However, that code never calls xhci_check_bandwidth, so we should be safe not issuing a command if only the slot context add flag is set. Signed-off-by: Sarah Sharp Signed-off-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman commit 6eb006c6079fd54a260caf7dfb3c750f65f4b1fc Author: Seth Forshee Date: Tue Jul 26 09:56:07 2011 -0500 usb_storage: Don't freeze in usb-stor-scan commit f02fe890ece7d695a5744b20525d45312382e6e4 upstream. Scanning cannot be run during suspend or hibernation, but if usb-stor-scan freezes another thread waiting on scanning to complete may fail to freeze. However, if usb-stor-scan is left freezable without ever actually freezing then the freezer will wait on it to exit, and threads waiting for scanning to finish will no longer be blocked. One problem with this approach is that usb-stor-scan has a delay to wait for devices to settle (which is currently the only point where it can freeze). To work around this we can request that the freezer send a fake signal when freezing, then use interruptible sleep to wake the thread early when freezing happens. To make this happen, the following changes are made to usb-stor-scan: * Use set_freezable_with_signal() instead of set_freezable() to request a fake signal when freezing * Use wait_event_interruptible_timeout() instead of wait_event_freezable_timeout() to avoid freezing Signed-off-by: Seth Forshee Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit b710365a9a762cb6cf931a066648daf9a941a9af Author: Oliver Neukum Date: Wed Sep 21 11:41:45 2011 +0200 btusb: add device entry for Broadcom SoftSailing commit c510eae377c773241ff0b6369a8f3581da941a51 upstream. This device declares itself to be vendor specific It therefore needs to be added to the device table to make btusb bind. Signed-off-by: Oliver Neukum Signed-off-by: Gustavo F. Padovan Signed-off-by: Greg Kroah-Hartman commit 661a0d9aba272ad9e55449ce8eb9570a221b8489 Author: Jurgen Kramer Date: Sun Sep 4 18:01:42 2011 +0200 Bluetooth: add support for 2011 mac mini commit f78b68261e80899f81a21dfdf91e2a1456ea8175 upstream. Today I noticed that the usb bluetooth adapter (BCM2046B1) on my 2011 mac mini was not working. I've created a patch to get it going. Signed-off-by: Jurgen Kramer Signed-off-by: Gustavo F. Padovan Signed-off-by: Greg Kroah-Hartman commit 4770ac2af6255b6c64d290606b54fa2e2bfcbe08 Author: Steven.Li Date: Fri Jul 1 14:02:36 2011 +0800 Bluetooth: Add Atheros AR3012 one PID/VID supported commit 2d25f8b462f3b849d8913d02978657ef06e67dd8 upstream. The new Ath3k needs to download patch and radio table, and it keeps same PID/VID even after downloading the patch and radio table. This patch is to use the bcdDevice (Device Release Number) to judge whether the chip has been patched or not. The init bcdDevice value of the chip is 0x0001, this value increases after patch and radio table downloading. Signed-off-by: Steven.Li Signed-off-by: Gustavo F. Padovan Signed-off-by: Greg Kroah-Hartman commit 39361fcb63d49f4036af08473c503e006e063ddc Author: Ricardo Mendoza Date: Wed Jul 13 16:04:29 2011 +0100 Bluetooth: Add Toshiba laptops AR30XX device ID commit 8e7c3d2e4ba18ee4cdcc1f89aec944fbff4ce735 upstream. Blacklist Toshiba-branded AR3011 based AR5B195 [0930:0215] and add to ath3k.c for firmware loading. Signed-off-by: Ricardo Mendoza Signed-off-by: Gustavo F. Padovan Signed-off-by: Greg Kroah-Hartman commit efb1497bcc3a72b1617c6915bb62cf4dfa38c952 Author: Pieter-Augustijn Van Malleghem Date: Wed Sep 7 02:28:10 2011 -0400 Bluetooth: Add MacBookAir4,1 support commit a63b723d02531f7add0b2b8a0e6a77ee176f1626 upstream. This patch against current git adds the hardware ID for the Apple MacBookAir4,1, released in July 2011. The device features a BCM2046 USB chip. The patch was inspired by the previous modifications adding support for the MacBookAir3,x. Signed-off-by: Pieter-Augustijn Van Malleghem Signed-off-by: Gustavo F. Padovan Signed-off-by: Greg Kroah-Hartman commit f7f00215ba28400e0f61c55e14e3d619888231ae Author: Marek Vasut Date: Tue Jul 26 16:44:47 2011 +0000 ASIX: Use only 11 bits of header for data size commit bca0beb9363f8487ac902931a50eb00180a2d14a upstream. The AX88772B uses only 11 bits of the header for the actual size. The other bits are used for something else. This causes dmesg full of messages: asix_rx_fixup() Bad Header Length This patch trims the check to only 11 bits. I believe on older chips, the remaining 5 top bits are unused. Signed-off-by: Marek Vasut Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 611778cd2a87a9b7376994caf4faa0caac9d1037 Author: Marek Vasut Date: Tue Jul 26 16:44:46 2011 +0000 ASIX: Simplify condition in rx_fixup() commit bc466e678d0a98f445bf3f9c76fedf18e7dcc6b0 upstream. Signed-off-by: Marek Vasut Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 1a0a3b4ea5782d6f1ca10f3254b56d7be24ec4d0 Author: Andiry Xu Date: Mon Sep 19 16:05:12 2011 -0700 USB: xHCI: prevent infinite loop when processing MSE event commit c2d7b49f42f50d7fc5cbfd195b785a128723fdf4 upstream. When a xHC host is unable to handle isochronous transfer in the interval, it reports a Missed Service Error event and skips some tds. Currently xhci driver handles MSE event in the following ways: 1. When encounter a MSE event, set ep->skip flag, update event ring dequeue pointer and return. 2. When encounter the next event on this ep, the driver will run the do-while loop, fetch td from ep's td_list to find the td corresponding to this event. All tds missed are marked as short transfer(-EXDEV). The do-while loop will end in two ways: 1. If the td pointed by the event trb is found; 2. If the ep ring's td_list is empty. However, if a buggy HW reports some unpredicted event (for example, an overrun event following a MSE event while the ep ring is actually not empty), the driver will never find the td, and it will loop until the td_list is empty. Unfortunately, the spinlock is dropped when give back a urb in the do-while loop. During the spinlock released period, the class driver may still submit urbs and add tds to the td_list. This may cause disaster, since the td_list will never be empty and the loop never ends, and the system hangs. To fix this, count the number of TDs on the ep ring before skipping TDs, and quit the loop when skipped that number of tds. This guarantees the do-while loop will end after certain number of cycles, and driver will not be trapped in an infinite loop. Signed-off-by: Andiry Xu Signed-off-by: Sarah Sharp Signed-off-by: Greg Kroah-Hartman Signed-off-by: Linus Torvalds commit 869b18a75765d4f29e26ea8de123608fc9907903 Author: Kavan Smith Date: Wed Aug 31 05:12:05 2011 +0000 ipheth: iPhone 4 Verizon CDMA USB Product ID add commit 02009afc223aae43b8e18918fc816e4520791537 upstream. Add USB product ID for iPhone 4 CDMA Verizon Tested on at least 2 devices Signed-off-by: Kavan Smith Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit f6fad686650aaf264b2acee848825e2183a944e3 Author: Sarah Sharp Date: Tue Aug 9 16:31:54 2011 -0700 USB: Avoid NULL pointer deref in usb_hcd_alloc_bandwidth. commit 8a9af4fdf6d5eeb3200a088354d266a87e8260b0 upstream. usb_ifnum_to_if() can return NULL if the USB device does not have a configuration installed (usb_device->actconfig == NULL), or if we can't find the interface number in the installed configuration. Return an error instead of crashing. Signed-off-by: Sarah Sharp Signed-off-by: Greg Kroah-Hartman commit 91c193f925d75b03f5a7f31ae1358a87af33c78a Author: Josh Boyer Date: Mon Aug 8 02:34:07 2011 +0000 usbnet/cdc_ncm: Don't use stack variables for DMA commit 75bc8ef528f7c4ea7e80384c5593487b6b3b535e upstream. The cdc_ncm driver still has a few places where stack variables are passed to the cdc_ncm_do_request function. This triggers a stack trace in lib/dma-debug.c if the CONFIG_DEBUG_DMA_API option is set. Adjust these calls to pass parameters that have been allocated with kzalloc. Signed-off-by: Josh Boyer Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 510c6bcea7b81acf7c86d2d72944ed516223fcbb Author: Artur Zimmer Date: Wed Aug 10 03:51:28 2011 +0200 USB: Serial: Add PID(0xF7C0) to FTDI SIO driver for a zeitcontrol-device commit ce7e9065958191e6b7ca49d7ed0e1099c486d198 upstream. Here is a patch for a new PID (zeitcontrol-device mifare-reader FT232BL(like FT232BM but lead free)). Signed-off-by: Artur Zimmer Signed-off-by: Greg Kroah-Hartman commit 5be5de4dfc6715b424207c367dc2ed234b0bd6ce Author: Florian Echtler Date: Tue Aug 9 13:37:49 2011 +0200 USB: Serial: Add device ID for Sierra Wireless MC8305 commit 2f1def2695c223b2aa325e5e47d0d64200a45d23 upstream. A new device ID pair is added for Sierra Wireless MC8305. Signed-off-by: Florian Echtler Signed-off-by: Greg Kroah-Hartman commit e530d1a21e5c2fe3202b2fdf2f0b61100c12c70e Author: Arvid Brodin Date: Wed Jul 20 03:13:46 2011 +0200 usb/isp1760: Added missing call to usb_hcd_check_unlink_urb() during unlink commit 17d3e145a4ad680b3d1b1c30d0696a5bbb2b65c4 upstream. Signed-off-by: Arvid Brodin Signed-off-by: Greg Kroah-Hartman commit 00c37d53fdc0f671cc07228e0faf1938da741e68 Author: Boris Todorov Date: Mon Jul 11 12:03:33 2011 +0300 USB: EHCI: Fix test mode sequence commit 77636c86a600b83de01719efad83567e46d7e8ce upstream. The sequence to put port in test mode is not complete. According EHCI specification all enabled ports must be put in suspend. Signed-off-by: Boris Todorov Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit cfaef012006eddcba833b33cb7953a68b36869c6 Author: huajun li Date: Sun Aug 7 03:03:31 2011 +0000 rtl8150: rtl8150_disconnect(...) does not need tasklet_disable(...) commit c2e2a313ff8fdc25cedef5e63da712a6a0d35dfe upstream. Executing cmd 'rmmod rtl8150' does not return(if your device connects to host), the root cause is tasklet_disable() causes tasklet_kill() block, remove it from rtl8150_disconnect(). Signed-off-by: Huajun Li Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit c3db5c3702bfc283b3ea65dc1ebbf256e688baee Author: Vasanthy Kolluri Date: Thu Jun 9 10:37:07 2011 +0000 enic: Bug Fix: Fix hardware transmit queue indexing in enic_poll_controller commit b880a954b9e2585ce325aedd76e4741880cab180 upstream. Signed-off-by: Christian Benvenuti Signed-off-by: Danny Guo Signed-off-by: Vasanthy Kolluri Signed-off-by: Roopa Prabhu Signed-off-by: David Wang Signed-off-by: David S. Miller Cc: Chun-Yi Lee Signed-off-by: Greg Kroah-Hartman commit 628ee980d92cd25b8b794af59823fb93090500c3 Author: Eric Sandeen Date: Sat Oct 29 10:15:35 2011 -0400 ext4: fix race in xattr block allocation path commit 6d6a435190bdf2e04c9465cde5bdc3ac68cf11a4 upstream. Ceph users reported that when using Ceph on ext4, the filesystem would often become corrupted, containing inodes with incorrect i_blocks counters. I managed to reproduce this with a very hacked-up "streamtest" binary from the Ceph tree. Ceph is doing a lot of xattr writes, to out-of-inode blocks. There is also another thread which does sync_file_range and close, of the same files. The problem appears to happen due to this race: sync/flush thread xattr-set thread ----------------- ---------------- do_writepages ext4_xattr_set ext4_da_writepages ext4_xattr_set_handle mpage_da_map_blocks ext4_xattr_block_set set DELALLOC_RESERVE ext4_new_meta_blocks ext4_mb_new_blocks if (!i_delalloc_reserved_flag) vfs_dq_alloc_block ext4_get_blocks down_write(i_data_sem) set i_delalloc_reserved_flag ... up_write(i_data_sem) if (i_delalloc_reserved_flag) vfs_dq_alloc_block_nofail In other words, the sync/flush thread pops in and sets i_delalloc_reserved_flag on the inode, which makes the xattr thread think that it's in a delalloc path in ext4_new_meta_blocks(), and add the block for a second time, after already having added it once in the !i_delalloc_reserved_flag case in ext4_mb_new_blocks The real problem is that we shouldn't be using the DELALLOC_RESERVED state flag, and instead we should be passing EXT4_GET_BLOCKS_DELALLOC_RESERVE down to ext4_map_blocks() instead of using an inode state flag. We'll fix this for now with using i_data_sem to prevent this race, but this is really not the right way to fix things. Signed-off-by: Eric Sandeen Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 3c607445bbf6ff07c755656df331069d753569ea Author: Theodore Ts'o Date: Wed Aug 31 12:02:51 2011 -0400 ext4: call ext4_handle_dirty_metadata with correct inode in ext4_dx_add_entry commit 5930ea643805feb50a2f8383ae12eb6f10935e49 upstream. ext4_dx_add_entry manipulates bh2 and frames[0].bh, which are two buffer_heads that point to directory blocks assigned to the directory inode. However, the function calls ext4_handle_dirty_metadata with the inode of the file that's being added to the directory, not the directory inode itself. Therefore, correct the code to dirty the directory buffers with the directory inode, not the file inode. Signed-off-by: Darrick J. Wong Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 37915713a96e05b5d731b9457a0cf22ced00f36f Author: Darrick J. Wong Date: Wed Aug 31 12:00:51 2011 -0400 ext4: ext4_mkdir should dirty dir_block with newly created directory inode commit f9287c1f2d329f4d78a3bbc9cf0db0ebae6f146a upstream. ext4_mkdir calls ext4_handle_dirty_metadata with dir_block and the inode "dir". Unfortunately, dir_block belongs to the newly created directory (which is "inode"), not the parent directory (which is "dir"). Fix the incorrect association. Signed-off-by: Darrick J. Wong Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit a848dee39f54f1eb9d9b90ef172ec4e813815e21 Author: Darrick J. Wong Date: Wed Aug 31 11:58:51 2011 -0400 ext4: ext4_rename should dirty dir_bh with the correct directory commit bcaa992975041e40449be8c010c26192b8c8b409 upstream. When ext4_rename performs a directory rename (move), dir_bh is a buffer that is modified to update the '..' link in the directory being moved (old_inode). However, ext4_handle_dirty_metadata is called with the old parent directory inode (old_dir) and dir_bh, which is incorrect because dir_bh does not belong to the parent inode. Fix this error. Signed-off-by: Darrick J. Wong Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit d24f405b711a4247f31358339dc1112ca659e6fe Author: Theodore Ts'o Date: Wed Aug 31 11:54:51 2011 -0400 ext2,ext3,ext4: don't inherit APPEND_FL or IMMUTABLE_FL for new inodes commit 1cd9f0976aa4606db8d6e3dc3edd0aca8019372a upstream. This doesn't make much sense, and it exposes a bug in the kernel where attempts to create a new file in an append-only directory using O_CREAT will fail (but still leave a zero-length file). This was discovered when xfstests #79 was generalized so it could run on all file systems. Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit b97cdd64caeac76928c0bac6a844743fa2431200 Author: Clifton Barnes Date: Wed Nov 2 13:39:55 2011 -0700 drivers/power/ds2780_battery.c: fix deadlock upon insertion and removal commit 0e053fcbbbc4d945247cb32cad2767b483cb65f8 upstream. Fixes the deadlock when inserting and removing the ds2780. Signed-off-by: Clifton Barnes Cc: Evgeniy Polyakov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 101884f69106faf7c76602ad6fd12eac388b64b8 Author: Clifton Barnes Date: Wed Nov 2 13:39:52 2011 -0700 drivers/power/ds2780_battery.c: add a nolock function to w1 interface commit 9fe678fa2feb4aaac0b4220de63e1b7f8ccebae6 upstream. Adds a nolock function to the w1 interface to avoid locking the mutex if needed. Signed-off-by: Clifton Barnes Cc: Evgeniy Polyakov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 24e53017e03e9b70765cd244c5304cee4e3ef38b Author: Clifton Barnes Date: Wed Nov 2 13:39:50 2011 -0700 drivers/power/ds2780_battery.c: create central point for calling w1 interface commit 853eee72f74f449797f0500ea19fc1bf497428d8 upstream. Simply creates one point to call the w1 interface. Signed-off-by: Clifton Barnes Cc: Evgeniy Polyakov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit b323615a633b4ac47834844f330f9cc329aeaf2b Author: Juan Gutierrez Date: Tue Sep 6 09:30:16 2011 +0300 hwspinlock/core: use a mutex to protect the radix tree commit 93b465c2e186d96fb90012ba0f9372eb9952e732 upstream. Since we're using non-atomic radix tree allocations, we should be protecting the tree using a mutex and not a spinlock. Non-atomic allocations and process context locking is good enough, as the tree is manipulated only when locks are registered/ unregistered/requested/freed. The locks themselves are still protected by spinlocks of course, and mutexes are not involved in the locking/unlocking paths. Signed-off-by: Juan Gutierrez [ohad@wizery.com: rewrite the commit log, #include mutex.h, add minor commentary] [ohad@wizery.com: update register/unregister parts in hwspinlock.txt] Signed-off-by: Ohad Ben-Cohen Signed-off-by: Greg Kroah-Hartman commit 044ee31ce0a51153f27a9d8c55ea12db32e59667 Author: Alexandre Bounine Date: Wed Nov 2 13:39:15 2011 -0700 drivers/net/rionet.c: fix ethernet address macros for LE platforms commit e0c87bd95e8dad455c23bc56513af8dcb1737e55 upstream. Modify Ethernet addess macros to be compatible with BE/LE platforms Signed-off-by: Alexandre Bounine Cc: Chul Kim Cc: Kumar Gala Cc: Matt Porter Cc: Li Yang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 179b05367d02451ebf4d4b655632b6f979fcac8a Author: Johannes Berg Date: Thu Nov 3 13:46:08 2011 +0100 iwlagn: do not use interruptible waits Upstream commit effd4d9aece9184f526e6556786a94d335e38b71. Since the dawn of its time, iwlwifi has used interruptible waits to wait for synchronous commands and firmware loading. This leads to "interesting" bugs, because it can't actually handle the interruptions; for example when a command sending is interrupted it will assume the command completed fully, and then leave it pending, which leads to all kinds of trouble when the command finishes later. Since there's no easy way to gracefully deal with interruptions, fix the driver to not use interruptible waits. This at least fixes the error iwlagn 0000:02:00.0: Error: Response NULL in 'REPLY_SCAN_ABORT_CMD' I have seen in P2P testing, but it is likely that there are other errors caused by this. Cc: Stanislaw Gruszka Signed-off-by: Johannes Berg Signed-off-by: Wey-Yi Guy Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 4f0bf01fabfa6519f8d96b089e44eeaf6cc085c2 Author: Linus Torvalds Date: Sat Aug 6 11:51:33 2011 -0700 vfs: show O_CLOEXE bit properly in /proc//fdinfo/ files commit 1117f72ea0217ba0cc19f05adbbd8b9a397f5ab7 upstream. The CLOEXE bit is magical, and for performance (and semantic) reasons we don't actually maintain it in the file descriptor itself, but in a separate bit array. Which means that when we show f_flags, the CLOEXE status is shown incorrectly: we show the status not as it is now, but as it was when the file was opened. Fix that by looking up the bit properly in the 'fdt->close_on_exec' bit array. Uli needs this in order to re-implement the pfiles program: "For normal file descriptors (not sockets) this was the last piece of information which wasn't available. This is all part of my 'give Solaris users no reason to not switch' effort. I intend to offer the code to the util-linux-ng maintainers." Requested-by: Ulrich Drepper Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit bfcf6092c5b8789a179e40992ca041bbdbb859cc Author: Jiri Kosina Date: Wed Nov 2 13:37:41 2011 -0700 binfmt_elf: fix PIE execution with randomization disabled commit a3defbe5c337dbc6da911f8cc49ae3cc3b49b453 upstream. The case of address space randomization being disabled in runtime through randomize_va_space sysctl is not treated properly in load_elf_binary(), resulting in SIGKILL coming at exec() time for certain PIE-linked binaries in case the randomization has been disabled at runtime prior to calling exec(). Handle the randomize_va_space == 0 case the same way as if we were not supporting .text randomization at all. Based on original patch by H.J. Lu and Josh Boyer. Signed-off-by: Jiri Kosina Cc: Ingo Molnar Cc: Russell King Cc: H.J. Lu Cc: Tested-by: Josh Boyer Acked-by: Nicolas Pitre Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 68fe9d9c796303de600dbc622086768ca4d8408b Author: Andrea Arcangeli Date: Wed Nov 2 13:36:59 2011 -0700 mm: thp: tail page refcounting fix commit 70b50f94f1644e2aa7cb374819cfd93f3c28d725 upstream. Michel while working on the working set estimation code, noticed that calling get_page_unless_zero() on a random pfn_to_page(random_pfn) wasn't safe, if the pfn ended up being a tail page of a transparent hugepage under splitting by __split_huge_page_refcount(). He then found the problem could also theoretically materialize with page_cache_get_speculative() during the speculative radix tree lookups that uses get_page_unless_zero() in SMP if the radix tree page is freed and reallocated and get_user_pages is called on it before page_cache_get_speculative has a chance to call get_page_unless_zero(). So the best way to fix the problem is to keep page_tail->_count zero at all times. This will guarantee that get_page_unless_zero() can never succeed on any tail page. page_tail->_mapcount is guaranteed zero and is unused for all tail pages of a compound page, so we can simply account the tail page references there and transfer them to tail_page->_count in __split_huge_page_refcount() (in addition to the head_page->_mapcount). While debugging this s/_count/_mapcount/ change I also noticed get_page is called by direct-io.c on pages returned by get_user_pages. That wasn't entirely safe because the two atomic_inc in get_page weren't atomic. As opposed to other get_user_page users like secondary-MMU page fault to establish the shadow pagetables would never call any superflous get_page after get_user_page returns. It's safer to make get_page universally safe for tail pages and to use get_page_foll() within follow_page (inside get_user_pages()). get_page_foll() is safe to do the refcounting for tail pages without taking any locks because it is run within PT lock protected critical sections (PT lock for pte and page_table_lock for pmd_trans_huge). The standard get_page() as invoked by direct-io instead will now take the compound_lock but still only for tail pages. The direct-io paths are usually I/O bound and the compound_lock is per THP so very finegrined, so there's no risk of scalability issues with it. A simple direct-io benchmarks with all lockdep prove locking and spinlock debugging infrastructure enabled shows identical performance and no overhead. So it's worth it. Ideally direct-io should stop calling get_page() on pages returned by get_user_pages(). The spinlock in get_page() is already optimized away for no-THP builds but doing get_page() on tail pages returned by GUP is generally a rare operation and usually only run in I/O paths. This new refcounting on page_tail->_mapcount in addition to avoiding new RCU critical sections will also allow the working set estimation code to work without any further complexity associated to the tail page refcounting with THP. Signed-off-by: Andrea Arcangeli Reported-by: Michel Lespinasse Reviewed-by: Michel Lespinasse Reviewed-by: Minchan Kim Cc: Peter Zijlstra Cc: Hugh Dickins Cc: Johannes Weiner Cc: Rik van Riel Cc: Mel Gorman Cc: KOSAKI Motohiro Cc: Benjamin Herrenschmidt Cc: David Gibson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit a00fb1451d630898c1380349ac3776688e58010f Author: David Vrabel Date: Fri Sep 30 06:37:51 2011 +0000 net: xen-netback: correctly restart Tx after a VM restore/migrate [ Upstream commit d0e5d83284dac15c015bb48115b6780f5a6413cd ] If a VM is saved and restored (or migrated) the netback driver will no longer process any Tx packets from the frontend. xenvif_up() does not schedule the processing of any pending Tx requests from the front end because the carrier is off. Without this initial kick the frontend just adds Tx requests to the ring without raising an event (until the ring is full). This was caused by 47103041e91794acdbc6165da0ae288d844c820b (net: xen-netback: convert to hw_features) which reordered the calls to xenvif_up() and netif_carrier_on() in xenvif_connect(). Signed-off-by: David Vrabel Cc: Ian Campbell Acked-by: Ian Campbell Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 62d8d0b9b6c459789876335156c56110042f2158 Author: Willem de Bruijn Date: Fri Sep 30 10:38:28 2011 +0000 make PACKET_STATISTICS getsockopt report consistently between ring and non-ring [ Upstream commit 7091fbd82cd5686444ffe9935ed6a8190101fe9d ] This is a minor change. Up until kernel 2.6.32, getsockopt(fd, SOL_PACKET, PACKET_STATISTICS, ...) would return total and dropped packets since its last invocation. The introduction of socket queue overflow reporting [1] changed drop rate calculation in the normal packet socket path, but not when using a packet ring. As a result, the getsockopt now returns different statistics depending on the reception method used. With a ring, it still returns the count since the last call, as counts are incremented in tpacket_rcv and reset in getsockopt. Without a ring, it returns 0 if no drops occurred since the last getsockopt and the total drops over the lifespan of the socket otherwise. The culprit is this line in packet_rcv, executed on a drop: drop_n_acct: po->stats.tp_drops = atomic_inc_return(&sk->sk_drops); As it shows, the new drop number it taken from the socket drop counter, which is not reset at getsockopt. I put together a small example that demonstrates the issue [2]. It runs for 10 seconds and overflows the queue/ring on every odd second. The reported drop rates are: ring: 16, 0, 16, 0, 16, ... non-ring: 0, 15, 0, 30, 0, 46, 0, 60, 0 , 74. Note how the even ring counts monotonically increase. Because the getsockopt adds tp_drops to tp_packets, total counts are similarly reported cumulatively. Long story short, reinstating the original code, as the below patch does, fixes the issue at the cost of additional per-packet cycles. Another solution that does not introduce per-packet overhead is be to keep the current data path, record the value of sk_drops at getsockopt() at call N in a new field in struct packetsock and subtract that when reporting at call N+1. I'll be happy to code that, instead, it's just more messy. [1] http://patchwork.ozlabs.org/patch/35665/ [2] http://kernel.googlecode.com/files/test-packetsock-getstatistics.c Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 2146d4667b5fbdb0e186ca8bc6d9cbe7ac42dfdc Author: Yan, Zheng Date: Sun Sep 25 02:21:30 2011 +0000 ipv6: nullify ipv6_ac_list and ipv6_fl_list when creating new socket [ Upstream commit 676a1184e8afd4fed7948232df1ff91517400859 ] ipv6_ac_list and ipv6_fl_list from listening socket are inadvertently shared with new socket created for connection. Signed-off-by: Zheng Yan Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit ec668dbad7f732767d5484e1c7b317c767777f27 Author: Jiri Pirko Date: Tue Oct 11 23:00:41 2011 +0000 tg3: negate USE_PHYLIB flag check [ Upstream commit e730c82347b9dc75914da998c44c3f348965db41 ] USE_PHYLIB flag in tg3_remove_one() is being checked incorrectly. This results tg3_phy_fini->phy_disconnect is never called and when tg3 module is removed. In my case this resulted in panics in phy_state_machine calling function phydev->adjust_link. So correct this check. Signed-off-by: Jiri Pirko Acked-by: Matt Carlson Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit b00654416d4baccf2269ec888e55d6df069cd36f Author: Yan, Zheng Date: Sun Oct 2 04:21:50 2011 +0000 tcp: properly update lost_cnt_hint during shifting [ Upstream commit 1e5289e121372a3494402b1b131b41bfe1cf9b7f ] lost_skb_hint is used by tcp_mark_head_lost() to mark the first unhandled skb. lost_cnt_hint is the number of packets or sacked packets before the lost_skb_hint; When shifting a skb that is before the lost_skb_hint, if tcp_is_fack() is ture, the skb has already been counted in the lost_cnt_hint; if tcp_is_fack() is false, tcp_sacktag_one() will increase the lost_cnt_hint. So tcp_shifted_skb() does not need to adjust the lost_cnt_hint by itself. When shifting a skb that is equal to lost_skb_hint, the shifted packets will not be counted by tcp_mark_head_lost(). So tcp_shifted_skb() should adjust the lost_cnt_hint even tcp_is_fack(tp) is true. Signed-off-by: Zheng Yan Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 37c88f5fe7f287a945949e6f4570700c210ebe0f Author: Yan, Zheng Date: Thu Sep 29 17:10:10 2011 +0000 tcp: properly handle md5sig_pool references [ Upstream commit 260fcbeb1ae9e768a44c9925338fbacb0d7e5ba9 ] tcp_v4_clear_md5_list() assumes that multiple tcp md5sig peers only hold one reference to md5sig_pool. but tcp_v4_md5_do_add() increases use count of md5sig_pool for each peer. This patch makes tcp_v4_md5_do_add() only increases use count for the first tcp md5sig peer. Signed-off-by: Zheng Yan Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 18743353b3154f0ff7c29f3c5ae3a8466a70d73a Author: Gao feng Date: Tue Oct 11 16:08:11 2011 +0000 netconsole: enable netconsole can make net_device refcnt incorrent [ Upstream commit d5123480b1d6f7d1a5fe1a13520cef88fb5d4c84 ] There is no check if netconsole is enabled current. so when exec echo 1 > enabled; the reference of net_device will increment always. Signed-off-by: Gao feng Acked-by: Flavio Leitner Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 89c32c14c190c6113187c7c57784695701e314e4 Author: David Ward Date: Sun Sep 18 12:53:20 2011 +0000 macvlan/macvtap: Fix unicast between macvtap interfaces in bridge mode [ Upstream commit cb2d0f3e968bff7c6d262aca3e3ab8d4184e69b2 ] Packets should always be forwarded to the lowerdev using dev_forward_skb. vlan->forward is for packets being forwarded directly to another macvlan/ macvtap device (used for multicast in bridge mode). Reported-and-tested-by: Shlomo Pongratz Signed-off-by: David Ward Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit c11deb8d898318a2fea9a291b16a7a2b2507cc94 Author: Eric Dumazet Date: Fri Oct 7 05:35:46 2011 +0000 l2tp: fix a potential skb leak in l2tp_xmit_skb() [ Upstream commit 835acf5da239b91edb9f7ebe36516999e156e6ee ] l2tp_xmit_skb() can leak one skb if skb_cow_head() returns an error. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit cbbd42eb61241fcd721f3b02bcb612894e2f02e6 Author: Yan, Zheng Date: Sat Oct 22 21:58:20 2011 +0000 ipv4: fix ipsec forward performance regression [ Upstream commit b73233960a59ee66e09d642f13d0592b13651e94 ] There is bug in commit 5e2b61f(ipv4: Remove flowi from struct rtable). It makes xfrm4_fill_dst() modify wrong data structure. Signed-off-by: Zheng Yan Reported-by: Kim Phillips Acked-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 92dc979cf8a5b2439ac2764cd56675407136d329 Author: Oliver Hartkopp Date: Fri Sep 23 08:23:47 2011 +0000 can bcm: fix tx_setup off-by-one errors [ Upstream commit aabdcb0b553b9c9547b1a506b34d55a764745870 ] This patch fixes two off-by-one errors that canceled each other out. Checking for the same condition two times in bcm_tx_timeout_tsklet() reduced the count of frames to be sent by one. This did not show up the first time tx_setup is invoked as an additional frame is sent due to TX_ANNONCE. Invoking a second tx_setup on the same item led to a reduced (by 1) number of sent frames. Reported-by: Andre Naujoks Signed-off-by: Oliver Hartkopp Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 99dfac8ab234555a54f7fa6e4b7bb08bb355158b Author: stephen hemminger Date: Thu Oct 6 11:19:41 2011 +0000 bridge: fix hang on removal of bridge via netlink [ Upstream commit 1ce5cce895309862d2c35d922816adebe094fe4a ] Need to cleanup bridge device timers and ports when being bridge device is being removed via netlink. This fixes the problem of observed when doing: ip link add br0 type bridge ip link set dev eth1 master br0 ip link set br0 up ip link del br0 which would cause br0 to hang in unregister_netdev because of leftover reference count. Reported-by: Sridhar Samudrala Signed-off-by: Stephen Hemminger Acked-by: Sridhar Samudrala Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit e8c492bd9cbc8dd1002bf4bc316f21f0a002b10f Author: Mitsuo Hayasaka Date: Wed Oct 12 16:04:29 2011 +0000 bonding: use local function pointer of bond->recv_probe in bond_handle_frame [ Upstream commit 4d97480b1806e883eb1c7889d4e7a87e936e06d9 ] The bond->recv_probe is called in bond_handle_frame() when a packet is received, but bond_close() sets it to NULL. So, a panic occurs when both functions work in parallel. Why this happen: After null pointer check of bond->recv_probe, an sk_buff is duplicated and bond->recv_probe is called in bond_handle_frame. So, a panic occurs when bond_close() is called between the check and call of bond->recv_probe. Patch: This patch uses a local function pointer of bond->recv_probe in bond_handle_frame(). So, it can avoid the null pointer dereference. Signed-off-by: Mitsuo Hayasaka Cc: Jay Vosburgh Cc: Andy Gospodarek Cc: Eric Dumazet Cc: WANG Cong Acked-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 6c3ad7aee6e6d62169948d09f2b4a1279d253cbe Author: Thadeu Lima de Souza Cascardo Date: Wed Aug 24 13:14:22 2011 -0300 jsm: remove buggy write queue commit 9d898966c4a07e4a5092215b5a2829d0ef02baa2 upstream. jsm uses a write queue that copies from uart_core circular buffer. This copying however has some bugs, like not wrapping the head counter. Since this write queue is also a circular buffer, the consumer function is ready to use the uart_core circular buffer directly. This buggy copying function was making some bytes be dropped when transmitting to a raw tty, doing something like this. [root@hostname ~]$ cat /dev/ttyn1 > cascardo/dump & [1] 2658 [root@hostname ~]$ cat /proc/tty/drivers > /dev/ttyn0 [root@hostname ~]$ cat /proc/tty/drivers /dev/tty /dev/tty 5 0 system:/dev/tty /dev/console /dev/console 5 1 system:console /dev/ptmx /dev/ptmx 5 2 system /dev/vc/0 /dev/vc/0 4 0 system:vtmaster jsm /dev/ttyn 250 0-31 serial serial /dev/ttyS 4 64-95 serial hvc /dev/hvc 229 0-7 system pty_slave /dev/pts 136 0-1048575 pty:slave pty_master /dev/ptm 128 0-1048575 pty:master unknown /dev/tty 4 1-63 console [root@hostname ~]$ cat cascardo/dump /dev/tty /dev/tty 5 0 system:/dev/tty /dev/console /dev/console 5 1 system:console /dev/ptmx /dev/ptmx 5 2 system /dev/vc/0 /dev/vc/0 4 0 system:vtmaste[root@hostname ~]$ This patch drops the driver write queue entirely, using the circular buffer from uart_core only. Signed-off-by: Thadeu Lima de Souza Cascardo Signed-off-by: Greg Kroah-Hartman commit 43742b14ffbe87453e96f4411389445fc707df57 Author: Oleg Nesterov Date: Mon Sep 26 19:06:32 2011 +0200 ptrace: don't clear GROUP_STOP_SIGMASK on double-stop [This does not correspond to any specific patch in the upstream tree as it was fixed accidentally by rewriting the code in the 3.1 release] https://bugzilla.redhat.com/show_bug.cgi?id=740121 1. Luke Macken triggered WARN_ON(!(group_stop & GROUP_STOP_SIGMASK)) in do_signal_stop(). This is because do_signal_stop() clears GROUP_STOP_SIGMASK part unconditionally but doesn't update it if task_is_stopped(). 2. Looking at this problem I noticed that WARN_ON_ONCE(!ptrace) is not right, a stopped-but-resumed tracee can clone the untraced thread in the SIGNAL_STOP_STOPPED group, the new thread can start another group-stop. Remove this warning, we need more fixes to make it true. Reported-by: Luke Macken Signed-off-by: Oleg Nesterov Signed-off-by: Greg Kroah-Hartman commit eb4b2df8f20d4479eceeb9bc51695caaa7bcd229 Author: Linus Torvalds Date: Tue Oct 25 13:59:48 2011 +0200 vfs pathname lookup: Add LOOKUP_AUTOMOUNT flag Since we've now turned around and made LOOKUP_FOLLOW *not* force an automount, we want to add the ability to force an automount event on lookup even if we don't happen to have one of the other flags that force it implicitly (LOOKUP_OPEN, LOOKUP_DIRECTORY, LOOKUP_PARENT..) Most cases will never want to use this, since you'd normally want to delay automounting as long as possible, which usually implies LOOKUP_OPEN (when we open a file or directory, we really cannot avoid the automount any more). But Trond argued sufficiently forcefully that at a minimum bind mounting a file and quotactl will want to force the automount lookup. Some other cases (like nfs_follow_remote_path()) could use it too, although LOOKUP_DIRECTORY would work there as well. This commit just adds the flag and logic, no users yet, though. It also doesn't actually touch the LOOKUP_NO_AUTOMOUNT flag that is related, and was made irrelevant by the same change that made us not follow on LOOKUP_FOLLOW. Cc: Trond Myklebust Cc: Ian Kent Cc: Jeff Layton Cc: Miklos Szeredi Cc: David Howells Cc: Al Viro Signed-off-by: Linus Torvalds Signed-off-by: Miklos Szeredi Signed-off-by: Greg Kroah-Hartman commit 6c36547293e6c46fe5df46e5e1b9ce9babb9eb37 Author: Trond Myklebust Date: Tue Oct 25 13:59:47 2011 +0200 VFS: Fix the remaining automounter semantics regressions commit 815d405ceff0d6964683f033e18b9b23a88fba87 upstream. The concensus seems to be that system calls such as stat() etc should not trigger an automount. Neither should the l* versions. This patch therefore adds a LOOKUP_AUTOMOUNT flag to tag those lookups that _should_ trigger an automount on the last path element. Signed-off-by: Trond Myklebust [ Edited to leave out the cases that are already covered by LOOKUP_OPEN, LOOKUP_DIRECTORY and LOOKUP_CREATE - all of which also fundamentally force automounting for their own reasons - Linus ] Signed-off-by: Linus Torvalds Signed-off-by: Miklos Szeredi Signed-off-by: Greg Kroah-Hartman commit def3f17094d20fa85d17ff11dea54a6c6bfb3f8c Author: Miklos Szeredi Date: Tue Oct 25 13:59:46 2011 +0200 vfs: automount should ignore LOOKUP_FOLLOW commit 0ec26fd0698285b31248e34bf1abb022c00f23d6 upstream. Prior to 2.6.38 automount would not trigger on either stat(2) or lstat(2) on the automount point. After 2.6.38, with the introduction of the ->d_automount() infrastructure, stat(2) and others would start triggering automount while lstat(2), etc. still would not. This is a regression and a userspace ABI change. Problem originally reported here: http://thread.gmane.org/gmane.linux.kernel.autofs/6098 It appears that there was an attempt at fixing various userspace tools to not trigger the automount. But since the stat system call is rather common it is impossible to "fix" all userspace. This patch reverts the original behavior, which is to not trigger on stat(2) and other symlink following syscalls. [ It's not really clear what the right behavior is. Apparently Solaris does the "automount on stat, leave alone on lstat". And some programs can get unhappy when "stat+open+fstat" ends up giving a different result from the fstat than from the initial stat. But the change in 2.6.38 resulted in problems for some people, so we're going back to old behavior. Maybe we can re-visit this discussion at some future date - Linus ] Reported-by: Leonardo Chiquitto Acked-by: Ian Kent Cc: David Howells Signed-off-by: Linus Torvalds Signed-off-by: Miklos Szeredi Signed-off-by: Greg Kroah-Hartman commit f537ffabb3ed687da15ec46d72c839971b142d0a Author: David Howells Date: Tue Oct 25 13:59:45 2011 +0200 VFS: Fix automount for negative autofs dentries commit 5a30d8a2b8ddd5102c440c7e5a7c8e1fd729c818 upstream. [ backport for 3.0.x: LOOKUP_PARENT => LOOKUP_CONTINUE by Chuck Ebbert ] Autofs may set the DCACHE_NEED_AUTOMOUNT flag on negative dentries. These need attention from the automounter daemon regardless of the LOOKUP_FOLLOW flag. Signed-off-by: David Howells Acked-by: Ian Kent Signed-off-by: Al Viro Cc: Chuck Ebbert Signed-off-by: Miklos Szeredi Signed-off-by: Greg Kroah-Hartman commit b0917c31699319f0b0ce0747e26bd66e8ed83491 Author: Andy Whitcroft Date: Wed Nov 2 09:44:39 2011 +0100 readlinkat: ensure we return ENOENT for the empty pathname for normal lookups commit 1fa1e7f615f4d3ae436fa319af6e4eebdd4026a8 upstream. Since the commit below which added O_PATH support to the *at() calls, the error return for readlink/readlinkat for the empty pathname has switched from ENOENT to EINVAL: commit 65cfc6722361570bfe255698d9cd4dccaf47570d Author: Al Viro Date: Sun Mar 13 15:56:26 2011 -0400 readlinkat(), fchownat() and fstatat() with empty relative pathnames This is both unexpected for userspace and makes readlink/readlinkat inconsistant with all other interfaces; and inconsistant with our stated return for these pathnames. As the readlinkat call does not have a flags parameter we cannot use the AT_EMPTY_PATH approach used in the other calls. Therefore expose whether the original path is infact entry via a new user_path_at_empty() path lookup function. Use this to determine whether to default to EINVAL or ENOENT for failures. Addresses http://bugs.launchpad.net/bugs/817187 [akpm@linux-foundation.org: remove unused getname_flags()] Signed-off-by: Andy Whitcroft Cc: Christoph Hellwig Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Christoph Hellwig Signed-off-by: Greg Kroah-Hartman commit 5f0d9e03e7e0792fbd36ba9fb9859f0ef7956a20 Author: Richard Weinberger Date: Wed Nov 2 13:17:27 2011 +0100 um: fix ubd cow size commit 8535639810e578960233ad39def3ac2157b0c3ec upstream. ubd_file_size() cannot use ubd_dev->cow.file because at this time ubd_dev->cow.file is not initialized. Therefore, ubd_file_size() will always report a wrong disk size when COW files are used. Reading from /dev/ubd* would crash the kernel. We have to read the correct disk size from the COW file's backing file. Signed-off-by: Richard Weinberger Signed-off-by: Greg Kroah-Hartman commit 73e2fc5d34007574d25d00e7088bbd42e988bb3e Author: Takashi Iwai Date: Fri Oct 14 15:26:20 2011 +0200 ALSA: hda - Fix ADC input-amp handling for Cx20549 codec commit 6b45214277bec2193ad3ccb8d7aa6100b5a0f1a9 upstream. It seems that Conexant CX20549 chip handle only a single input-amp even though the audio-input widget has multiple sources. This has been never clear, and I implemented in the current way based on the debug information I got at the early time -- the device reacts individual input-amp values for different sources. This is true for another Conexant codec, but it's not applied to CX20549 actually. This patch changes the auto-parser code to handle a single input-amp per audio-in widget for CX20549. After applying this, you'll see only a single "Capture" volume control instead of separate "Mic" or "Line" captures when the device is set up to use a single ADC. We haven't tested 20551 and 20561 codecs yet. If these show the similar behavior like 20549, they need to set spec->single_adc_amp=1, too. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 38af8ddb4b8877c0b90f8413a20517ba245c4d0b Author: Mitsuo Hayasaka Date: Mon Oct 31 17:08:13 2011 -0700 mm: avoid null pointer access in vm_struct via /proc/vmallocinfo commit f5252e009d5b87071a919221e4f6624184005368 upstream. The /proc/vmallocinfo shows information about vmalloc allocations in vmlist that is a linklist of vm_struct. It, however, may access pages field of vm_struct where a page was not allocated. This results in a null pointer access and leads to a kernel panic. Why this happens: In __vmalloc_node_range() called from vmalloc(), newly allocated vm_struct is added to vmlist at __get_vm_area_node() and then, some fields of vm_struct such as nr_pages and pages are set at __vmalloc_area_node(). In other words, it is added to vmlist before it is fully initialized. At the same time, when the /proc/vmallocinfo is read, it accesses the pages field of vm_struct according to the nr_pages field at show_numa_info(). Thus, a null pointer access happens. The patch adds the newly allocated vm_struct to the vmlist *after* it is fully initialized. So, it can avoid accessing the pages field with unallocated page when show_numa_info() is called. Signed-off-by: Mitsuo Hayasaka Cc: Andrew Morton Cc: David Rientjes Cc: Namhyung Kim Cc: "Paul E. McKenney" Cc: Jeremy Fitzhardinge Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit ad417042d59a26bedf600ab162b20b79fdcd1fa1 Author: Linus Walleij Date: Fri Aug 12 13:54:42 2011 +0200 ARM: mach-ux500: unlock I&D l2x0 caches before init commit 1bf6d2c1bb23533af6930581cc39b74685bc29de upstream. Apparently U8500 U-Boot versions may leave the l2x0 locked down before executing the kernel. Make sure we unlock it before we initialize the l2x0. This fixes a performance problem reported by Jan Rinze. The l2x0 core has been modified to unlock the l2x0 by default, but it will not touch the locking registers if the l2x0 was already enabled, as on the ux500, so we need this quirk to make sure it is properly turned off. Cc: Srinidhi Kasagar Cc: Rabin Vincent Cc: Adrian Bunk Reported-by: Jan Rinze Tested-by: Robert Marklund Signed-off-by: Linus Walleij Signed-off-by: Greg Kroah-Hartman commit 513c4eb162aecea92e0b05a7c5e206474526eda2 Author: Paul Fertser Date: Mon Oct 10 11:19:23 2011 +0400 plat-mxc: iomux-v3.h: implicitly enable pull-up/down when that's desired commit 6571534b600b8ca1936ff5630b9e0947f21faf16 upstream. To configure pads during the initialisation a set of special constants is used, e.g. #define MX25_PAD_FEC_MDIO__FEC_MDIO IOMUX_PAD(0x3c4, 0x1cc, 0x10, 0, 0, PAD_CTL_HYS | PAD_CTL_PUS_22K_UP) The problem is that no pull-up/down is getting activated unless both PAD_CTL_PUE (pull-up enable) and PAD_CTL_PKE (pull/keeper module enable) set. This is clearly stated in the i.MX25 datasheet and is confirmed by the measurements on hardware. This leads to some rather hard to understand bugs such as misdetecting an absent ethernet PHY (a real bug i had), unstable data transfer etc. This might affect mx25, mx35, mx50, mx51 and mx53 SoCs. It's reasonable to expect that if the pullup value is specified, the intention was to have it actually active, so we implicitly add the needed bits. Signed-off-by: Paul Fertser Signed-off-by: Sascha Hauer Signed-off-by: Greg Kroah-Hartman commit b5e074a6ff4cfa090f7aa8a87f5079d19206d91c Author: Andrew Morton Date: Mon Oct 31 17:06:32 2011 -0700 /proc/self/numa_maps: restore "huge" tag for hugetlb vmas commit fc360bd9cdcf875639a77f07fafec26699c546f3 upstream. The display of the "huge" tag was accidentally removed in 29ea2f698 ("mm: use walk_page_range() instead of custom page table walking code"). Reported-by: Stephen Hemminger Tested-by: Stephen Hemminger Reviewed-by: Stephen Wilson Cc: KOSAKI Motohiro Cc: Hugh Dickins Acked-by: David Rientjes Cc: Lee Schermerhorn Cc: Alexey Dobriyan Cc: Christoph Lameter Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 1eac959e6961083087486015d87d0209a0ae45a8 Author: Mauro Carvalho Chehab Date: Thu Jul 28 16:38:54 2011 -0300 tuner_xc2028: Allow selection of the frequency adjustment code for XC3028 commit 9bed77ee2fb46b74782d0d9d14b92e9d07f3df6e upstream. This device is not using the proper demod IF. Instead of using the IF macro, it is specifying a IF frequency. This doesn't work, as xc3028 needs to load an specific SCODE for the tuner. In this case, there's no IF table for 5 MHz. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit 10d65fc3a3348315c2d30e19419e8db6ed486b8a Author: Olivier Grenie Date: Mon Aug 1 12:45:58 2011 -0300 dib0700: protect the dib0700 buffer access commit bff469f4167fdabfe15294f375577d7eadbaa1bb upstream. This patch protects the common buffer access inside the dib0700 in order to manage concurrent access. This protection is done using mutex. Cc: Mauro Carvalho Chehab Cc: Florian Mickler Signed-off-by: Javier Marcet Signed-off-by: Olivier Grenie Signed-off-by: Patrick Boettcher [mchehab@redhat.com: dprint requires 3 arguments. Replaced by dib_info] Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit 4d2ae8d3b315fbf36d760fd8dd755fb1d55a0f87 Author: Patrick Boettcher Date: Wed Aug 3 12:08:21 2011 -0300 DiBcom: protect the I2C bufer access commit 79fcce3230b140f7675f8529ee53fe2f9644f902 upstream. This patch protects the I2C buffer access in order to manage concurrent access. This protection is done using mutex. Furthermore, for the dib9000, if a pid filtering command is received during the tuning, this pid filtering command is delayed to avoid any concurrent access issue. Cc: Mauro Carvalho Chehab Cc: Florian Mickler Signed-off-by: Olivier Grenie Signed-off-by: Patrick Boettcher Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit 2ba0b8db49fe9f662eb20bd5fa84c91bcdaec206 Author: Ming Lei Date: Sat Jul 16 00:51:00 2011 -0300 uvcvideo: Set alternate setting 0 on resume if the bus has been reset commit d59a7b1dbce8b972ec2dc9fcaaae0bfa23687423 upstream. If the bus has been reset on resume, set the alternate setting to 0. This should be the default value, but some devices crash or otherwise misbehave if they don't receive a SET_INTERFACE request before any other video control request. Microdia's 0c45:6437 camera has been found to require this change or it will stop sending video data after resume. uvc_video.c] Signed-off-by: Ming Lei Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit 76ec8cdcca9f8fa8e2546ed96a2715a6654487ad Author: Florian Tobias Schandinat Date: Mon Jun 6 01:27:34 2011 +0000 viafb: improve pitch handling commit 936a3f770b8de7042d793272f008ef1bb08522e9 upstream. This patch adds checks for minimum and maximum pitch size to prevent invalid settings which could otherwise crash the machine. Also the alignment is done in a slightly more readable way. Signed-off-by: Florian Tobias Schandinat Signed-off-by: Greg Kroah-Hartman commit cdf3e3448744d14b6307dfc7f7203cba6fecf199 Author: Florian Tobias Schandinat Date: Mon May 23 21:39:58 2011 +0000 viafb: use display information in info not in var for panning commit d933990c57b498c092ceef591c7c5d69dbfe9f30 upstream. As Laurent pointed out we must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Also use the aligned fix.line_length and not the (possible) unaligned xres_virtual. Signed-off-by: Florian Tobias Schandinat Reported-by: Laurent Pinchart Acked-by: Laurent Pinchart Signed-off-by: Greg Kroah-Hartman commit 3f199a7d6f2c769131f1c0dda2eb9b30d1e21617 Author: Bruno Prémont Date: Fri Sep 2 19:24:03 2011 +0200 fb: sh-mobile: Fix deadlock risk between lock_fb_info() and console_lock() commit 4a47a0e09c504e3ce0ccdb405411aefc5b09deb8 upstream. Following on Herton's patch "fb: avoid possible deadlock caused by fb_set_suspend" which moves lock_fb_info() out of fb_set_suspend() to its callers, correct sh-mobile's locking around call to fb_set_suspend() and the same sort of deaklocks with console_lock() due to order of taking the lock. console_lock() must be taken while fb_info is already locked and fb_info must be locked while calling fb_set_suspend(). Signed-off-by: Bruno Prémont Signed-off-by: Guennadi Liakhovetski Signed-off-by: Florian Tobias Schandinat Signed-off-by: Greg Kroah-Hartman commit 627afd48f8d28f14271b9ccf3b1f5d3e77237e2c Author: Herton Ronaldo Krzesinski Date: Fri Jun 17 19:02:39 2011 +0000 fb: avoid possible deadlock caused by fb_set_suspend commit 9e769ff3f585db8f978f9113be83d36c7e3965dd upstream. A lock ordering issue can cause deadlocks: in framebuffer/console code, all needed struct fb_info locks are taken before acquire_console_sem(), in places which need to take console semaphore. But fb_set_suspend is always called with console semaphore held, and inside it we call lock_fb_info which gets the fb_info lock, inverse locking order of what the rest of the code does. This causes a real deadlock issue, when we write to state fb sysfs attribute (which calls fb_set_suspend) while a framebuffer is being unregistered by remove_conflicting_framebuffers, as can be shown by following show blocked state trace on a test program which loads i915 and runs another forked processes writing to state attribute: Test process with semaphore held and trying to get fb_info lock: .. fb-test2 D 0000000000000000 0 237 228 0x00000000 ffff8800774f3d68 0000000000000082 00000000000135c0 00000000000135c0 ffff880000000000 ffff8800774f3fd8 ffff8800774f3fd8 ffff880076ee4530 00000000000135c0 ffff8800774f3fd8 ffff8800774f2000 00000000000135c0 Call Trace: [] __mutex_lock_slowpath+0x11a/0x1e0 [] ? _raw_spin_lock_irq+0x22/0x40 [] mutex_lock+0x23/0x50 [] lock_fb_info+0x25/0x60 [] fb_set_suspend+0x20/0x80 [] store_fbstate+0x4f/0x70 [] dev_attr_store+0x20/0x30 [] sysfs_write_file+0xd4/0x160 [] vfs_write+0xc6/0x190 [] sys_write+0x51/0x90 [] system_call_fastpath+0x16/0x1b .. modprobe process stalled because has the fb_info lock (got inside unregister_framebuffer) but waiting for the semaphore held by the test process which is waiting to get the fb_info lock: .. modprobe D 0000000000000000 0 230 218 0x00000000 ffff880077a4d618 0000000000000082 0000000000000001 0000000000000001 ffff880000000000 ffff880077a4dfd8 ffff880077a4dfd8 ffff8800775a2e20 00000000000135c0 ffff880077a4dfd8 ffff880077a4c000 00000000000135c0 Call Trace: [] schedule_timeout+0x215/0x310 [] ? get_parent_ip+0x11/0x50 [] __down+0x6d/0xb0 [] down+0x41/0x50 [] acquire_console_sem+0x2c/0x50 [] unbind_con_driver+0xad/0x2d0 [] fbcon_event_notify+0x457/0x890 [] ? _raw_spin_unlock_irqrestore+0x1f/0x50 [] ? get_parent_ip+0x11/0x50 [] notifier_call_chain+0x4d/0x70 [] __blocking_notifier_call_chain+0x58/0x80 [] blocking_notifier_call_chain+0x16/0x20 [] fb_notifier_call_chain+0x1b/0x20 [] unregister_framebuffer+0x7c/0x130 [] remove_conflicting_framebuffers+0x153/0x180 [] register_framebuffer+0x93/0x2c0 [] drm_fb_helper_single_fb_probe+0x252/0x2f0 [drm_kms_helper] [] drm_fb_helper_initial_config+0x2f3/0x6d0 [drm_kms_helper] [] ? drm_fb_helper_single_add_all_connectors+0x5d/0x1c0 [drm_kms_helper] [] intel_fbdev_init+0xa8/0x160 [i915] [] i915_driver_load+0x854/0x12b0 [i915] [] drm_get_pci_dev+0x19e/0x360 [drm] [] ? sub_preempt_count+0x9d/0xd0 [] i915_pci_probe+0x15/0x17 [i915] [] local_pci_probe+0x5f/0xd0 [] pci_device_probe+0x119/0x120 [] ? driver_sysfs_add+0x7a/0xb0 [] driver_probe_device+0xa3/0x290 [] ? __driver_attach+0x0/0xb0 [] __driver_attach+0xab/0xb0 [] ? __driver_attach+0x0/0xb0 [] bus_for_each_dev+0x5e/0x90 [] driver_attach+0x1e/0x20 [] bus_add_driver+0xe2/0x320 [] ? i915_init+0x0/0x96 [i915] [] driver_register+0x76/0x140 [] ? i915_init+0x0/0x96 [i915] [] __pci_register_driver+0x56/0xd0 [] drm_pci_init+0xe4/0xf0 [drm] [] ? i915_init+0x0/0x96 [i915] [] drm_init+0x58/0x70 [drm] [] i915_init+0x94/0x96 [i915] [] do_one_initcall+0x44/0x190 [] sys_init_module+0xcb/0x210 [] system_call_fastpath+0x16/0x1b .. fb-test2 which reproduces above is available on kernel.org bug #26232. To solve this issue, avoid calling lock_fb_info inside fb_set_suspend, and move it out to where needed (callers of fb_set_suspend must call lock_fb_info before if needed). So far, the only place which needs to call lock_fb_info is store_fbstate, all other places which calls fb_set_suspend are suspend/resume hooks that should not need the lock as they should be run only when processes are already frozen in suspend/resume. References: https://bugzilla.kernel.org/show_bug.cgi?id=26232 Signed-off-by: Herton Ronaldo Krzesinski Signed-off-by: Florian Tobias Schandinat Signed-off-by: Greg Kroah-Hartman commit c10d19f3ad8294dbe5d500a46891fe94558be8ea Author: Jean Delvare Date: Fri Jul 8 11:04:38 2011 +0200 carminefb: Fix module parameters permissions commit c84c14224bbca6ec60d5851fcc87be0e34df2f44 upstream. The third parameter of module_param is supposed to be an octal value. The missing leading "0" causes the following: $ ls -l /sys/module/carminefb/parameters/ total 0 -rw-rwxr-- 1 root root 4096 Jul 8 08:55 fb_displays -rw-rwxr-- 1 root root 4096 Jul 8 08:55 fb_mode -rw-rwxr-- 1 root root 4096 Jul 8 08:55 fb_mode_str After fixing the perm parameter, we get the expected: $ ls -l /sys/module/carminefb/parameters/ total 0 -r--r--r-- 1 root root 4096 Jul 8 08:56 fb_displays -r--r--r-- 1 root root 4096 Jul 8 08:56 fb_mode -r--r--r-- 1 root root 4096 Jul 8 08:56 fb_mode_str Signed-off-by: Jean Delvare Cc: Paul Mundt Cc: Sebastian Siewior Signed-off-by: Paul Mundt Signed-off-by: Greg Kroah-Hartman commit 9bdb666778b0eb502554288ac3188139c3c45f0e Author: Joerg Roedel Date: Tue Oct 11 17:41:32 2011 +0200 iommu/amd: Fix wrong shift direction commit fcd0861db1cf4e6ed99f60a815b7b72c2ed36ea4 upstream. The shift direction was wrong because the function takes a page number and i is the address is the loop. Signed-off-by: Joerg Roedel Signed-off-by: Greg Kroah-Hartman commit cf541bb3f2532e7493720a208021e43b85156870 Author: Dmitry Torokhov Date: Wed Sep 7 15:00:02 2011 -0700 WMI: properly cleanup devices to avoid crashes commit 023b9565972a4a5e0f01b9aa32680af6e9b5c388 upstream. We need to remove devices that we destroy from the list, otherwise we'll crash if there are more than one "_WDG" methods in DSDT. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=32052 Tested-by: Ilya Tumaykin Signed-off-by: Dmitry Torokhov Acked-by: Carlos Corbacho Signed-off-by: Matthew Garrett Signed-off-by: Greg Kroah-Hartman commit 761f2b411806f70dfaa3d248b4182e7ba154efd4 Author: Sebastian Ott Date: Sun Oct 30 15:16:52 2011 +0100 ccwgroup: move attributes to attribute group commit dbdf1afcaaabe83dea15a3cb9b9013e73ae3b1ad upstream. Put sysfs attributes of ccwgroup devices in an attribute group to ensure that these attributes are actually present when userspace is notified via uevents. Signed-off-by: Sebastian Ott Signed-off-by: Martin Schwidefsky Signed-off-by: Greg Kroah-Hartman commit cd1ee66bb5156203711560ee73b00e70bb8450b5 Author: Martin Schwidefsky Date: Sun Oct 30 15:16:08 2011 +0100 memory leak with RCU_TABLE_FREE commit e73b7fffe487c315fd1a4fa22282e3362b440a06 upstream. The rcu page table free code uses a couple of bits in the page table pointer passed to tlb_remove_table to discern the different page table types. __tlb_remove_table extracts the type with an incorrect mask which leads to memory leaks. The correct mask is ((FRAG_MASK << 4) | FRAG_MASK). Signed-off-by: Martin Schwidefsky Signed-off-by: Greg Kroah-Hartman commit 0a85ef94c2af8630deb851e559c9d3bdf5530802 Author: Martin Schwidefsky Date: Sun Oct 30 15:16:07 2011 +0100 user per registers vs. ptrace single stepping commit a45aff5285871bf7be1781d9462d3fdbb6c913f9 upstream. git commit 5e9a2692 "[S390] ptrace cleanup" introduced a regression for the case when both a user PER set (e.g. a storage alteration trace) and PTRACE_SINGLESTEP are active. The new code will overrule the user PER set with a instruction-fetch PER set over the whole address space for ptrace single stepping. The inferior process will be stopped after each instruction with an instruction fetch event. Any other events that may have occurred concurrently are not reported (e.g. storage alteration event) because the control bits for them are not set. The solution is to merge the PER control bits of the user PER set with the PER_EVENT_IFETCH control bit for PTRACE_SINGLESTEP. Signed-off-by: Martin Schwidefsky Signed-off-by: Greg Kroah-Hartman commit d69540f85872860468e85ef8004f5580652b3335 Author: Carsten Otte Date: Tue Oct 18 12:27:12 2011 +0200 KVM: s390: check cpu_id prior to using it commit 4d47555a80495657161a7e71ec3014ff2021e450 upstream. We use the cpu id provided by userspace as array index here. Thus we clearly need to check it first. Ooops. Signed-off-by: Carsten Otte Signed-off-by: Christian Borntraeger Signed-off-by: Marcelo Tosatti Signed-off-by: Greg Kroah-Hartman commit 54a8a620cee91954666080a5525d7f43cad0a693 Author: Susan Gao Date: Thu Sep 29 11:08:18 2011 +0100 ASoC: Fix a bug in WM8962 DSP_A and DSP_B settings commit fbc7c62a3ff831aef24894b7982cd1adb2b7e070 upstream. Signed-off-by: Susan Gao Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 9c0390e9a3d5e768dfb2e007509e59d30fec9bb0 Author: Mark Brown Date: Fri Sep 23 21:26:33 2011 +0100 ASoC: Remove direct register cache accesses from WM8962 driver commit 38f3f31a0a797bdbcc0cdb12553bbecc2f9a91c4 upstream. Also fix return values for speaker switch updates. Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 8f4d7cf1f6e6f18f96a196a07b54b575669582cc Author: Axel Lin Date: Thu Oct 20 12:13:24 2011 +0800 ASoC: wm8994: Use SND_SOC_DAPM_AIF_OUT for AIF3 Capture commit 35024f4922f7b271e7529673413889aa3d51c5fc upstream. Signed-off-by: Axel Lin Acked-by: Liam Girdwood Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 772e6e8f76d6f0e01008b5c4bcd054be78a611ac Author: Axel Lin Date: Thu Oct 13 17:17:06 2011 +0800 ASoC: ak4535: fixup cache register table commit 7c04241acbdaf97f1448dcccd27ea0fcd1a57684 upstream. ak4535_reg should be 8bit, but cache table is defined as 16bit. Signed-off-by: Axel Lin Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 681c941ad1d50d46d61d435304f386efd763be9d Author: Kuninori Morimoto Date: Thu Oct 13 02:03:54 2011 -0700 ASoC: ak4642: fixup cache register table commit 19b115e523208a926813751aac8934cf3fc6085e upstream. ak4642 register was 8bit, but cache table was defined as 16bit. ak4642 doesn't work correctry without this patch. Signed-off-by: Kuninori Morimoto Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 311afee68d5f06f9f0910231b17e9d5b25ec4491 Author: Axel Lin Date: Mon Oct 17 20:14:56 2011 +0800 ASoC: wm8741: Fix setting interface format for DSP modes commit 3a340104fad6ecbea5ad6792a2ea855f0507a6e0 upstream. According to the datasheet: Format Control (05h) BITS[3:2] FMT[1:0] Audio data format selection 00 = right justified mode 01 = left justified mode 10 = I2S mode 11 = DSP mode BIT[4] LRP Polarity selec for LRCLK/DSP mode select 0 = normal LRCLK poalrity/DSP mode A 1 = inverted LRCLK poarity/DSP mode B For SND_SOC_DAIFMT_DSP_A, we should set 0x000C instead of 0x0003. For SND_SOC_DAIFMT_DSP_B, we should set 0x001C instead of 0x0013. Signed-off-by: Axel Lin Acked-by: Liam Girdwood Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit dae187ec04a6f7752b140d789269730791a7388f Author: Axel Lin Date: Wed Oct 26 09:53:41 2011 +0800 ASoC: wm8940: Properly set codec->dapm.bias_level commit 5927f94700e860ae27ff24e7f3bc9e4f7b9922eb upstream. Reported-by: Chris Paulson-Ellis Signed-off-by: Axel Lin Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 0198c89767e26f78e619eef2309be74186b4fdcd Author: Daniel Vetter Date: Wed Sep 28 11:57:23 2011 +0200 io-mapping: ensure io_mapping_map_atomic _is_ atomic commit 24dd85ff723f142093f44244764b9b5c152235b8 upstream. For the !HAVE_ATOMIC_IOMAP case the stub functions did not call pagefault_disable/_enable. The i915 driver relies on the map actually being atomic, otherwise it can deadlock with it's own pagefault handler in the gtt pwrite fastpath. This is exercised by gem_mmap_gtt from the intel-gpu-toosl gem testsuite. v2: Chris Wilson noted the lack of an include. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=38115 Signed-off-by: Daniel Vetter Reviewed-by: Chris Wilson Signed-off-by: Keith Packard Signed-off-by: Greg Kroah-Hartman commit 2f8c09acae88d1bf0aeedffd3f788eb5c5b4db29 Author: Bryan Schumaker Date: Fri Oct 7 13:41:15 2011 -0400 vfs: add "device" tag to /proc/self/mountstats commit a877ee03ac010ded434b77f7831f43cbb1fcc60f upstream. nfsiostat was failing to find mounted filesystems on kernels after 2.6.38 because of changes to show_vfsstat() by commit c7f404b40a3665d9f4e9a927cc5c1ee0479ed8f9. This patch adds back the "device" tag before the nfs server entry so scripts can parse the mountstats file correctly. Signed-off-by: Bryan Schumaker Signed-off-by: Christoph Hellwig Signed-off-by: Greg Kroah-Hartman commit b2f0a734b06e2e257bb0565800ac222244d981dc Author: Al Viro Date: Wed Jul 27 22:21:58 2011 -0400 hppfs: missing include commit d6b722aa383a467a43d09ee38e866981abba08ab upstream. Signed-off-by: Al Viro Cc: Miklos Szeredi Signed-off-by: Greg Kroah-Hartman commit 0dc8985b7f2da02180135396871d396f33a39b43 Author: J. Bruce Fields Date: Mon Oct 10 17:34:31 2011 -0400 nfsd4: ignore WANT bits in open downgrade commit c30e92df30d7d5fe65262fbce5d1b7de675fe34e upstream. We don't use WANT bits yet--and sending them can probably trigger a BUG() further down. Signed-off-by: J. Bruce Fields Signed-off-by: Greg Kroah-Hartman commit 279b483174560147e9f56f79e9b1fd3bd4fc8f40 Author: J. Bruce Fields Date: Mon Sep 19 15:07:41 2011 -0400 nfsd4: fix open downgrade, again commit 3d02fa29dec920c597dd7b7db608a4bc71f088ce upstream. Yet another open-management regression: - nfs4_file_downgrade() doesn't remove the BOTH access bit on downgrade, so the server's idea of the stateid's access gets out of sync with the client's. If we want to keep an O_RDWR open in this case, we should do that in the file_put_access logic rather than here. - We forgot to convert v4 access to an open mode here. This logic has proven too hard to get right. In the future we may consider: - reexamining the lock/openowner relationship (locks probably don't really need to take their own references here). - adding open upgrade/downgrade support to the vfs. - removing the atomic operations. They're redundant as long as this is all under some other lock. Also, maybe some kind of additional static checking would help catch O_/NFS4_SHARE_ACCESS confusion. Signed-off-by: J. Bruce Fields Signed-off-by: Greg Kroah-Hartman commit 0a52cb1083a662d4c417638ccdaa81df0e67494b Author: J. Bruce Fields Date: Thu Aug 25 10:48:39 2011 -0400 nfsd4: permit read opens of executable-only files commit a043226bc140a2c1dde162246d68a67e5043e6b2 upstream. A client that wants to execute a file must be able to read it. Read opens over nfs are therefore implicitly allowed for executable files even when those files are not readable. NFSv2/v3 get this right by using a passed-in NFSD_MAY_OWNER_OVERRIDE on read requests, but NFSv4 has gotten this wrong ever since dc730e173785e29b297aa605786c94adaffe2544 "nfsd4: fix owner-override on open", when we realized that the file owner shouldn't override permissions on non-reclaim NFSv4 opens. So we can't use NFSD_MAY_OWNER_OVERRIDE to tell nfsd_permission to allow reads of executable files. So, do the same thing we do whenever we encounter another weird NFS permission nit: define yet another NFSD_MAY_* flag. The industry's future standardization on 128-bit processors will be motivated primarily by the need for integers with enough bits for all the NFSD_MAY_* flags. Reported-by: Leonardo Borda Signed-off-by: J. Bruce Fields Signed-off-by: Greg Kroah-Hartman commit e3d0b28c5ec3bf7628a9707a6392cdb4adebabba Author: J. Bruce Fields Date: Wed Aug 10 19:16:22 2011 -0400 nfsd4: fix seqid_mutating_error commit 576163005de286bbd418fcb99cfd0971523a0c6d upstream. The set of errors here does *not* agree with the set of errors specified in the rfc! While we're there, turn this macros into a function, for the usual reasons, and move it to the one place where it's actually used. Signed-off-by: J. Bruce Fields Signed-off-by: Greg Kroah-Hartman commit 80931f71f0e7c151aa260590c655d536c967af56 Author: J. Bruce Fields Date: Wed Aug 10 19:07:33 2011 -0400 nfsd4: stop using nfserr_resource for transitory errors commit 3e77246393c0a433247631a1f0e9ec98d3d78a1c upstream. The server is returning nfserr_resource for both permanent errors and for errors (like allocation failures) that might be resolved by retrying later. Save nfserr_resource for the former and use delay/jukebox for the latter. Signed-off-by: J. Bruce Fields Signed-off-by: Greg Kroah-Hartman commit 6176ebe5391aa20700f9348fa7f7aca1a559e78f Author: Bernd Schubert Date: Mon Aug 8 17:38:08 2011 +0200 nfsd4: Remove check for a 32-bit cookie in nfsd4_readdir() commit 832023bffb4b493f230be901f681020caf3ed1f8 upstream. Fan Yong noticed setting FMODE_32bithash wouldn't work with nfsd v4, as nfsd4_readdir() checks for 32 bit cookies. However, according to RFC 3530 cookies have a 64 bit type and cookies are also defined as u64 in 'struct nfsd4_readdir'. So remove the test for >32-bit values. Signed-off-by: Bernd Schubert Signed-off-by: J. Bruce Fields Signed-off-by: Greg Kroah-Hartman commit 60eb9e7d1a8aeec2d4371ec445e7fd4425d05017 Author: Jeff Layton Date: Wed Oct 12 10:57:42 2011 -0400 nfs: don't try to migrate pages with active requests commit 2da956523526e440ef4f4dd174e26f5ac06fe011 upstream. nfs_find_and_lock_request will take a reference to the nfs_page and will then put it if the req is already locked. It's possible though that the reference will be the last one. That put then can kick off a whole series of reference puts: nfs_page nfs_open_context dentry inode If the inode ends up being deleted, then the VFS will call truncate_inode_pages. That function will try to take the page lock, but it was already locked when migrate_page was called. The code deadlocks. Fix this by simply refusing the migration request if PagePrivate is already set, indicating that the page is already associated with an active read or write request. We've had a customer test a backported version of this patch and the preliminary results seem good. Cc: Andrea Arcangeli Reported-by: Harshula Jayasuriya Signed-off-by: Jeff Layton Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 09bb52774e0543390bdba59b67ade093d34e4906 Author: Ian Campbell Date: Mon Oct 3 15:37:00 2011 +0100 genirq: Add IRQF_RESUME_EARLY and resume such IRQs earlier commit 9bab0b7fbaceec47d32db51cd9e59c82fb071f5a upstream. This adds a mechanism to resume selected IRQs during syscore_resume instead of dpm_resume_noirq. Under Xen we need to resume IRQs associated with IPIs early enough that the resched IPI is unmasked and we can therefore schedule ourselves out of the stop_machine where the suspend/resume takes place. This issue was introduced by 676dc3cf5bc3 "xen: Use IRQF_FORCE_RESUME". Signed-off-by: Ian Campbell Cc: Rafael J. Wysocki Cc: Jeremy Fitzhardinge Cc: xen-devel Cc: Konrad Rzeszutek Wilk Link: http://lkml.kernel.org/r/1318713254.11016.52.camel@dagon.hellion.org.uk Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit 12cb3e734a5616ea0057aee938c553ff6ccbdfbd Author: Steven Rostedt Date: Fri Oct 14 10:44:25 2011 -0400 tracing: Fix returning of duplicate data after EOF in trace_pipe_raw commit 436fc280261dcfce5af38f08b89287750dc91cd2 upstream. The trace_pipe_raw handler holds a cached page from the time the file is opened to the time it is closed. The cached page is used to handle the case of the user space buffer being smaller than what was read from the ring buffer. The left over buffer is held in the cache so that the next read will continue where the data left off. After EOF is returned (no more data in the buffer), the index of the cached page is set to zero. If a user app reads the page again after EOF, the check in the buffer will see that the cached page is less than page size and will return the cached page again. This will cause reading the trace_pipe_raw again after EOF to return duplicate data, making the output look like the time went backwards but instead data is just repeated. The fix is to not reset the index right after all data is read from the cache, but to reset it after all data is read and more data exists in the ring buffer. Reported-by: Jeremy Eder Signed-off-by: Steven Rostedt Signed-off-by: Greg Kroah-Hartman commit d59892017c5f6de2fdee221f2a7788696e9f2cda Author: Masami Hiramatsu Date: Tue Oct 4 19:45:04 2011 +0900 perf probe: Fix to show correct error string commit 44a56040a0037a845d5fa218dffde464579f0cab upstream. Fix perf probe to show correct error string when it fails to delete an event. The write(2) returns -1 if failed, and errno stores real error number. Signed-off-by: Masami Hiramatsu Cc: Peter Zijlstra Cc: Arnaldo Carvalho de Melo Cc: Paul Mackerras Cc: Ingo Molnar Link: http://lkml.kernel.org/r/20111004104504.14591.41266.stgit@fedora15 Signed-off-by: Steven Rostedt Signed-off-by: Greg Kroah-Hartman commit a847627709b3402163d99f7c6fda4a77bcd6b51b Author: NeilBrown Date: Wed Oct 26 10:31:04 2011 +1100 md/raid5: fix bug that could result in reads from a failed device. commit 355840e7a7e56bb2834fd3b0da64da5465f8aeaa upstream. This bug was introduced in 415e72d034c50520ddb7ff79e7d1792c1306f0c9 which was in 2.6.36. There is a small window of time between when a device fails and when it is removed from the array. During this time we might still read from it, but we won't write to it - so it is possible that we could read stale data. We didn't need the test of 'Faulty' before because the test on In_sync is sufficient. Since we started allowing reads from the early part of non-In_sync devices we need a test on Faulty too. This is suitable for any kernel from 2.6.36 onwards, though the patch might need a bit of tweaking in 3.0 and earlier. Signed-off-by: NeilBrown Signed-off-by: Greg Kroah-Hartman commit e747500485ddef175ac6694dcff4fd8088e62071 Author: Jan Beulich Date: Wed Sep 28 16:44:54 2011 +0100 apic, i386/bigsmp: Fix false warnings regarding logical APIC ID mismatches commit 838312be46f3abfbdc175f81c3e54a857994476d upstream. These warnings (generally one per CPU) are a result of initializing x86_cpu_to_logical_apicid while apic_default is still in use, but the check in setup_local_APIC() being done when apic_bigsmp was already used as an override in default_setup_apic_routing(): Overriding APIC driver with bigsmp Enabling APIC mode: Physflat. Using 5 I/O APICs ------------[ cut here ]------------ WARNING: at .../arch/x86/kernel/apic/apic.c:1239 ... CPU 1 irqstacks, hard=f1c9a000 soft=f1c9c000 Booting Node 0, Processors #1 smpboot cpu 1: start_ip = 9e000 Initializing CPU#1 ------------[ cut here ]------------ WARNING: at .../arch/x86/kernel/apic/apic.c:1239 setup_local_APIC+0x137/0x46b() Hardware name: ... CPU1 logical APIC ID: 2 != 8 ... Fix this (for the time being, i.e. until x86_32_early_logical_apicid() will get removed again, as Tejun says ought to be possible) by overriding the previously stored values at the point where the APIC driver gets overridden. v2: Move this and the pre-existing override logic into arch/x86/kernel/apic/bigsmp_32.c. Signed-off-by: Jan Beulich Acked-by: Tejun Heo Link: http://lkml.kernel.org/r/4E835D16020000780005844C@nat28.tlf.novell.com Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit c7f65094f7e2b8463a7c002e967e78db8f30468a Author: hank Date: Tue Sep 20 13:53:39 2011 -0700 time: Change jiffies_to_clock_t() argument type to unsigned long commit cbbc719fccdb8cbd87350a05c0d33167c9b79365 upstream. The parameter's origin type is long. On an i386 architecture, it can easily be larger than 0x80000000, causing this function to convert it to a sign-extended u64 type. Change the type to unsigned long so we get the correct result. Signed-off-by: hank Cc: John Stultz [ build fix ] Signed-off-by: Andrew Morton Signed-off-by: Thomas Gleixner Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 40b3c4dc2c6c44972323be3a1ebd62c4fe35fac0 Author: Luciano Coelho Date: Thu Sep 22 10:06:10 2011 +0300 wl12xx: fix forced passive scans commit 6cd9d21a0c1e2648c07c32c66bb25795ad3208aa upstream. We were using incorrect max and min dwell times during forced passive scans because we were still using the active scan states to scan (passively) the channels that were not marked as passive. Instead of doing passive scans in active states, we now skip active states and scan for all channels in passive states. Signed-off-by: Luciano Coelho Signed-off-by: Greg Kroah-Hartman commit babba877daf7a7ee0cb03dfb5e63f23e2d32dddf Author: Richard Cochran Date: Fri Oct 21 00:49:15 2011 +0000 net: hold sock reference while processing tx timestamps commit da92b194cc36b5dc1fbd85206aeeffd80bee0c39 upstream. The pair of functions, * skb_clone_tx_timestamp() * skb_complete_tx_timestamp() were designed to allow timestamping in PHY devices. The first function, called during the MAC driver's hard_xmit method, identifies PTP protocol packets, clones them, and gives them to the PHY device driver. The PHY driver may hold onto the packet and deliver it at a later time using the second function, which adds the packet to the socket's error queue. As pointed out by Johannes, nothing prevents the socket from disappearing while the cloned packet is sitting in the PHY driver awaiting a timestamp. This patch fixes the issue by taking a reference on the socket for each such packet. In addition, the comments regarding the usage of these function are expanded to highlight the rule that PHY drivers must use skb_complete_tx_timestamp() to release the packet, in order to release the socket reference, too. These functions first appeared in v2.6.36. Reported-by: Johannes Berg Signed-off-by: Richard Cochran Signed-off-by: Eric Dumazet Reviewed-by: Johannes Berg Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 4641f8a010eb97303fbc9bd8a094139b52ffd629 Author: Johannes Berg Date: Tue Oct 4 18:27:10 2011 +0200 mac80211: fix offchannel TX cookie matching commit 28a1bcdb57d50f3038a255741ecc83e391e5282e upstream. When I introduced in-kernel off-channel TX I introduced a bug -- the work can't be canceled again because the code clear the skb pointer. Fix this by keeping track separately of whether TX status has already been reported. Reported-by: Jouni Malinen Tested-by: Jouni Malinen Signed-off-by: Johannes Berg Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 806aeb924e925e6f1584ff956c9b9695e4ec18f9 Author: Richard Cochran Date: Fri Oct 21 00:49:17 2011 +0000 dp83640: free packet queues on remove commit 8b3408f8ee994973869d8ba32c5bf482bc4ddca4 upstream. If the PHY should disappear (for example, on an USB Ethernet MAC), then the driver would leak any undelivered time stamp packets. This commit fixes the issue by calling the appropriate functions to free any packets left in the transmit and receive queues. The driver first appeared in v3.0. Signed-off-by: Richard Cochran Acked-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 32779fa06584fdcab2228a36c3a846fa0a6f5cdb Author: Eric W. Biederman Date: Fri Oct 21 06:24:20 2011 +0000 rtnetlink: Add missing manual netlink notification in dev_change_net_namespaces commit d2237d35748e7f448a9c2d9dc6a85ef637466e24 upstream. Renato Westphal noticed that since commit a2835763e130c343ace5320c20d33c281e7097b7 "rtnetlink: handle rtnl_link netlink notifications manually" was merged we no longer send a netlink message when a networking device is moved from one network namespace to another. Fix this by adding the missing manual notification in dev_change_net_namespaces. Since all network devices that are processed by dev_change_net_namspaces are in the initialized state the complicated tests that guard the manual rtmsg_ifinfo calls in rollback_registered and register_netdevice are unnecessary and we can just perform a plain notification. Tested-by: Renato Westphal Signed-off-by: Eric W. Biederman Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit e277beeb68b1f1e9326d57913a41549744002449 Author: Ming Lei Date: Fri Oct 7 11:50:22 2011 +0800 ata_piix: make DVD Drive recognisable on systems with Intel Sandybridge chipsets(v2) commit 5e5a4f5d5a08c9c504fe956391ac3dae2c66556d upstream. This quirk patch fixes one kind of bug inside some Intel Sandybridge chipsets, see reports from https://bugzilla.kernel.org/show_bug.cgi?id=40592. Many guys also have reported the problem before: https://bugs.launchpad.net/bugs/737388 https://bugs.launchpad.net/bugs/794642 https://bugs.launchpad.net/bugs/782389 ...... With help from Tejun, the problem is found to be caused by 32bit PIO mode, so introduce the quirk patch to disable 32bit PIO on SATA piix for some Sandybridge CPT chipsets. Seth also tested the patch on all five affected chipsets (pci device ID: 0x1c00, 0x1c01, 0x1d00, 0x1e00, 0x1e01), and found the patch does fix the problem. Tested-by: Heasley, Seth Cc: Alan Cox Signed-off-by: Ming Lei Acked-by: Tejun Heo Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit 363d0372b331c8ac8ef54c0bd81aadea43cfd74c Author: Jeff Layton Date: Tue Oct 11 09:49:21 2011 -0400 nfs: don't redirty inode when ncommit == 0 in nfs_commit_unstable_pages commit 3236c3e1adc0c7ec83eaff1de2d06746b7c5bb28 upstream. commit 420e3646 allowed the kernel to reduce the number of unnecessary commit calls by skipping the commit when there are a large number of outstanding pages. However, the current test in nfs_commit_unstable_pages does not handle the edge condition properly. When ncommit == 0, then that means that the kernel doesn't need to do anything more for the inode. The current test though in the WB_SYNC_NONE case will return true, and the inode will end up being marked dirty. Once that happens the inode will never be clean until there's a WB_SYNC_ALL flush. Fix this by immediately returning from nfs_commit_unstable_pages when ncommit == 0. Mike noticed this problem initially in RHEL5 (2.6.18-based kernel) which has a backported version of 420e3646. The inode cache there was growing very large. The inode cache was unable to be shrunk since the inodes were all marked dirty. Calling sync() would essentially "fix" the problem -- the WB_SYNC_ALL flush would result in the inodes all being marked clean. What I'm not clear on is how big a problem this is in mainline kernels as the writeback code there is very different. Either way, it seems incorrect to re-mark the inode dirty in this case. Reported-by: Mike McLean Signed-off-by: Jeff Layton Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit b04a57568d86586d704babc7584e5fff4343fc61 Author: Trond Myklebust Date: Mon Oct 17 18:22:55 2011 -0700 Revert "NFS: Ensure that writeback_single_inode() calls write_inode() when syncing" commit 59b7c05fffba030e5d9e72324691e2f99aa69b79 upstream. This reverts commit b80c3cb628f0ebc241b02e38dd028969fb8026a2. The reverted commit was rendered obsolete by a VFS fix: commit 5547e8aac6f71505d621a612de2fca0dd988b439 (writeback: Update dirty flags in two steps). We now no longer need to worry about writeback_single_inode() missing our marking the inode for COMMIT in 'do_writepages()' call. Reverting this patch, fixes a performance regression in which the inode would continuously get queued to the dirty list, causing the writeback code to unnecessarily try to send a COMMIT. Signed-off-by: Trond Myklebust Tested-by: Simon Kirby Signed-off-by: Greg Kroah-Hartman commit 3cdf240310b4f3d94981d727d3660c78a50a40c6 Author: Jiri Kosina Date: Wed Oct 26 13:10:39 2011 +1030 kmod: prevent kmod_loop_msg overflow in __request_module() commit 37252db6aa576c34fd794a5a54fb32d7a8b3a07a upstream. Due to post-increment in condition of kmod_loop_msg in __request_module(), the system log can be spammed by much more than 5 instances of the 'runaway loop' message if the number of events triggering it makes the kmod_loop_msg to overflow. Fix that by making sure we never increment it past the threshold. Signed-off-by: Jiri Kosina Signed-off-by: Rusty Russell Signed-off-by: Greg Kroah-Hartman commit 50f621d8f5b6f9e8ed931df12c595fd0e882f8e3 Author: David Herrmann Date: Tue Sep 20 09:16:12 2011 -0700 Platform: Fix error path in samsung-laptop init commit a7ea19926ffba86f373f6050a106cd162dbb9a78 upstream. samsung_init() should not return success if not all devices are initialized. Otherwise, samsung_exit() will dereference sdev NULL pointers and others. Signed-off-by: David Herrmann Signed-off-by: Greg Kroah-Hartman Signed-off-by: Matthew Garrett commit 08a84a609d1679c9aeb958c3bc7886118e682b77 Author: Jason Stubbs Date: Tue Sep 20 09:16:11 2011 -0700 platform: samsung_laptop: fix samsung brightness min/max calculations commit bee460be8c691c544e84ed678280ace6153104c6 upstream. The min_brightness value of the sabi_config is incorrectly used in brightness calculations. For the config where min_brightness = 1 and max_brightness = 8, the user visible range should be 0 to 7 with hardware being set in the range of 1 to 8. What is actually happening is that the user visible range is 0 to 8 with hardware being set in the range of -1 to 7. This patch fixes the above issue as well as a miscalculation that would occur in the case of min_brightness > 1. Signed-off-by: Jason Stubbs Signed-off-by: Greg Kroah-Hartman Signed-off-by: Matthew Garrett commit 472806574215cfc649b3619b2047785fe2897b58 Author: Smelov Andrey Date: Tue Sep 20 09:16:10 2011 -0700 Platform: samsung_laptop: samsung backlight for R528/R728 commit 093ed561648d43263c009ea88abab21a31cd4f1d upstream. patch works for me, but I need to add "acpi_backlight=vendor" to kernel params Signed-off-by: Smelov Andrey Signed-off-by: Greg Kroah-Hartman Signed-off-by: Matthew Garrett commit b0da5e7b1493c59b04604d6839565a6135773002 Author: Tommaso Massimi Date: Tue Sep 20 09:16:09 2011 -0700 Platform: samsung_laptop: add support for X520 machines. commit 7500eeb08a179e61a4219288c21407d63d1e9c64 upstream. my samsung laptop would be very happy if you add these lines to the file drivers/platform/x86/samsung-laptop.c Signed-off-by: Greg Kroah-Hartman Signed-off-by: Matthew Garrett commit b78db0895fff3d3da005f8e03f700b9a559c1065 Author: Stefan Beller Date: Tue Sep 20 09:16:08 2011 -0700 platform: samsung_laptop: add dmi information for Samsung R700 laptops commit f87d02996f05ec1789ceecce9ec839f629b7aa80 upstream. My DMI model is this: >dmesg |grep DMI [ 0.000000] DMI present. [ 0.000000] DMI: SAMSUNG ELECTRONICS CO., LTD. SR700/SR700, BIOS 04SR 02/20/2008 adding dmi information of Samsung R700 laptops This adds the dmi information of Samsungs R700 laptops. Signed-off-by: Stefan Beller Signed-off-by: Greg Kroah-Hartman Signed-off-by: Matthew Garrett commit 5c2433cdc72a03446184e2f898be3b05095b5ed0 Author: David Woodhouse Date: Mon Oct 24 21:25:21 2011 +0000 caif: Fix BUG() with network namespaces commit 08613e4626c06ca408fc55071f6aedee36986a87 upstream. The caif code will register its own pernet_operations, and then register a netdevice_notifier. Each time the netdevice_notifier is triggered, it'll do some stuff... including a lookup of its own pernet stuff with net_generic(). If the net_generic() call ever returns NULL, the caif code will BUG(). That doesn't seem *so* unreasonable, I suppose — it does seem like it should never happen. However, it *does* happen. When we clone a network namespace, setup_net() runs through all the pernet_operations one at a time. It gets to loopback before it gets to caif. And loopback_net_init() registers a netdevice... while caif hasn't been initialised. So the caif netdevice notifier triggers, and immediately goes BUG(). We could imagine a complex and overengineered solution to this generic class of problems, but this patch takes the simple approach. It just makes caif_device_notify() *not* go looking for its pernet data structures if the device it's being notified about isn't a caif device in the first place. Signed-off-by: David Woodhouse Acked-by: Sjur Brændeland Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 7b59e3e29e1a28ad40892dd2115175e2702f1153 Author: Milan Broz Date: Mon Aug 22 15:51:34 2011 +0200 kobj_uevent: Ignore if some listeners cannot handle message commit ebf4127cd677e9781b450e44dfaaa1cc595efcaa upstream. kobject_uevent() uses a multicast socket and should ignore if one of listeners cannot handle messages or nobody is listening at all. Easily reproducible when a process in system is cloned with CLONE_NEWNET flag. (See also http://article.gmane.org/gmane.linux.kernel.device-mapper.dm-crypt/5256) Signed-off-by: Milan Broz Acked-by: Kay Sievers Signed-off-by: Greg Kroah-Hartman commit a19d5a89a43fa64f2739bdadbc35d4723ab9bcdb Author: Konrad Rzeszutek Wilk Date: Fri Jul 22 12:51:48 2011 -0400 xen-swiotlb: Fix wrong panic. commit ab2a47bd242d6cdcf6b2b64797f271c6f0a6d338 upstream. Propagate the baremetal git commit "swiotlb: fix wrong panic" (fba99fa38b023224680308a482e12a0eca87e4e1) in the Xen-SWIOTLB version. wherein swiotlb's map_page wrongly calls panic() when it can't find a buffer fit for device's dma mask. It should return an error instead. Devices with an odd dma mask (i.e. under 4G) like b44 network card hit this bug (the system crashes): http://marc.info/?l=linux-kernel&m=129648943830106&w=2 If xen-swiotlb returns an error, b44 driver can use the own bouncing mechanism. Signed-off-by: Konrad Rzeszutek Wilk Signed-off-by: Greg Kroah-Hartman commit 50bac9ce730674d25f010b5a591e8376e001658f Author: Konrad Rzeszutek Wilk Date: Fri Jul 22 12:18:43 2011 -0400 xen-pcifront: Update warning comment to use 'e820_host' option. commit 917e3e65c35459d52f0d0b890aa5df0cad07a051 upstream. With Xen changeset 23428 "libxl: Add 'e820_host' option to config file" the E820 as seen from the host can now be passed into the guest. This means that a PV guest can now: - Use the correct PCI I/O gap. Before these patches, Linux guest would boot up and would tell: [ 0.000000] Allocating PCI resources starting at 40000000 (gap: 40000000:c0000000) while in actuality the PCI I/O gap should have been: [ 0.000000] Allocating PCI resources starting at b0000000 (gap: b0000000:4c000000) - The PV domain with PCI devices was limited to 3GB. It now can be booted with 4GB, 8GB, or whatever number you want. The PCI devices will now _not_ conflict with System RAM. Meaning the drivers can load. CC: Jesse Barnes CC: linux-pci@vger.kernel.org [v2: Made the string less broken up. Suggested by Joe Perches] Signed-off-by: Konrad Rzeszutek Wilk Signed-off-by: Greg Kroah-Hartman commit f9409cf55e878e48f3649522b06a3f7c74d48f8c Author: Josh Boyer Date: Mon Oct 17 21:16:39 2011 -0400 Update email address for stable patch submission commit 5fa224295f0e0358c8bc0e5390702338df889def upstream. The stable@kernel.org email address has been replaced with the stable@vger.kernel.org mailing list. Change the stable kernel rules to reference the new list instead of the semi-defunct email alias. Signed-off-by: Josh Boyer Signed-off-by: Greg Kroah-Hartman commit d25b0f91d1f35a91b2eb49d139fa2803f55b6b47 Author: Jerry Huang Date: Tue Oct 18 13:09:48 2011 +0800 QE/FHCI: fixed the CONTROL bug commit 273d23574f9dacd9c63c80e7d63639a669aad441 upstream. For USB CONTROL transaction, when the data length is zero, the IN package is needed to finish this transaction in status stage. Signed-off-by: Jerry Huang Signed-off-by: Greg Kroah-Hartman commit 5b81a5e1aee86808849307d5e025185ee5bde276 Author: Sergei Kolzun Date: Thu Aug 4 00:25:56 2011 -0700 HID: ACRUX - fix enabling force feedback support commit 364b936fc38dec7653c690d710e10657af235a36 upstream. The config option needs to be a 'bool' and not a tristate, otheriwse force feedback support never makes it into the module. Signed-off-by: Sergei Kolzun Signed-off-by: Dmitry Torokhov Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit 07bb3623343d8060b6f68aa294e3ecb9391a82d4 Author: Felix Fietkau Date: Sat Oct 8 15:49:57 2011 +0200 ath9k: disable unnecessary PHY error reporting commit ac06697c79bad09e44a8b1d52104014016fb90de upstream. PHY errors relevant for ANI are always tracked by hardware counters, the bits that allow them to pass through the rx filter are independent of that. Enabling PHY errors in the rx filter often creates lots of useless DMA traffic and might be responsible for some of the rx dma stop failure warnings. Signed-off-by: Felix Fietkau Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit e4779966c769188b76ee699e0ab476030b2d2e6a Author: Mohammed Shafi Shajakhan Date: Fri Sep 30 11:31:27 2011 +0530 ath9k_hw: Fix number of GPIO pins for AR9287/9300 commit 6321eb0977b011ac61dfca36e7c69b2c4325b104 upstream. this patch fixes the assumption of maximum number of GPIO pins present in AR9287/AR9300. this fix is essential as we might encounter some functionality issues involved in accessing the status of GPIO pins which are all incorrectly assumed to be not within the range of max_num_gpio of AR9300/AR9287 chipsets Signed-off-by: Mohammed Shafi Shajakhan Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 7ff861f96140c2dc6411deafb281dbfe958324d9 Author: Luis R. Rodriguez Date: Thu Sep 29 10:42:19 2011 -0700 ath9k_htc: add AVM FRITZ!WLAN 11N v2 support commit 8c34559b4a6df32e4af1b073397fa4dc189a5485 upstream. This was reported and tested by Martin Walter over at AVM GmbH Berlin. This also applies to 3.0.1 so sendint to stable. Cc: s.kirste@avm.de Cc: d.friedel@avm.de Cc: Martin Walter Cc: Peter Grabienski Tested-by: Martin Walter Signed-off-by: Luis R. Rodriguez Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 26155866748bad74d6b257ba891d794dad85f621 Author: Rajkumar Manoharan Date: Thu Sep 15 19:02:25 2011 +0530 ath9k_hw: Fix magnitude/phase coeff correction commit e9c10469cf3c71bc1c6b0f01319161e277d6ac9b upstream. Do the magnitude/phase coeff correction only if the outlier is detected. Updating wrong magnitude/phase coeff factor impacts not only tx gain setting but also leads to poor performance in congested networks. In the clear environment the impact is very minimal because the outlier happens very rarely according to the past experiment. It occured less than once every 1000 calibrations. Signed-off-by: Rajkumar Manoharan Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 1ad894adcc396cb74d1ee7173d013a803c457ad8 Author: Rajkumar Manoharan Date: Sat Aug 20 17:22:09 2011 +0530 ath9k_hw: Fix descriptor status of TxOpExceeded commit 2a15b394f8e46dd3e2ab365ab41cfa701d92fa77 upstream. Signed-off-by: Rajkumar Manoharan Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 0ada2d28df779a5368b9ca77e1a7088bbabf68d7 Author: Luis R. Rodriguez Date: Tue Aug 23 15:07:31 2011 -0700 MAINTANERS: update Qualcomm Atheros addresses commit fe8e084455f273b32cc57a5fbaf6c22ef984d657 upstream. Qualcomm ate up Atheros, all of the old e-mail addresses no longer work and e-mails sent to it will bounce. Update the addresses to the new shiny Qualcomm Atheros (QCA) ones. Cc: stable@kernel.org Cc: netdev@vger.kernel.org Cc: jouni@qca.qualcomm.com Cc: yangjie@qca.qualcomm.com Cc: vthiagar@qca.qualcomm.com Cc: senthilb@qca.qualcomm.com Signed-off-by: Luis R. Rodriguez Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 68401aa09eece84a291c98d3c2d39d09f7f7336f Author: Dan Williams Date: Tue Sep 13 13:52:52 2011 -0500 USB: option: add various ZTE device network interfaces to the blacklist commit c58a76cdd7ab5a945a44fd2d64f6faf40323f95b upstream. IDs found in the Windows driver's ZTEusbnet.inf file from the ZTE MF100 drivers (O2 UK). Also fixes the ZTE MF626 device since it really is distinct from the 4G Systems stick and apparently needs the net interface blacklisted too, while there's no indication (yet) that the 4G Systems stick does. Signed-off-by: Dan Williams Signed-off-by: Greg Kroah-Hartman commit cf39988db6f0e4e15c6fa81100ab18ae63dcf3a1 Author: Dan Williams Date: Tue Sep 13 13:51:45 2011 -0500 USB: option: add ZTE product 0x0037 to sendsetup blacklist commit eb05ce567a81c592c58f4bdb96eb91ce96661c30 upstream. Signed-off-by: Dan Williams Signed-off-by: Greg Kroah-Hartman commit af7b2c02829fedfcc02732e31f09bf5968bb0c52 Author: Dan Williams Date: Tue Sep 13 13:51:13 2011 -0500 USB: option: convert Huawei K3765, K4505, K4605 reservered interface to blacklist commit 0d905fd5ece4ab65e8407c450077744e1c8f661b upstream. That's what the blacklist is for... Signed-off-by: Dan Williams Signed-off-by: Greg Kroah-Hartman commit 03c4fd7b657b3ea22c86a6b7e5b01aa0cfdb52bd Author: Dan Williams Date: Tue Sep 13 13:49:41 2011 -0500 USB: option: convert interface blacklisting to bitfields commit b4626c10928c13ee73b013dcbc23676333e79b59 upstream. It's cleaner than the array stuff, and we're about to add a bunch more blacklist entries. Second, there are devices that need both the sendsetup and the reserved interface blacklists, which the current code can't accommodate. Signed-off-by: Dan Williams Signed-off-by: Greg Kroah-Hartman commit 1d2c1def575aa7dec304f820fdf4c01726416042 Author: Peter Stuge Date: Mon Oct 10 03:34:54 2011 +0200 USB: ftdi_sio: Support TI/Luminary Micro Stellaris BD-ICDI Board commit 3687f641307eeff6f7fe31a88dc39db88e89238b upstream. Some Stellaris evaluation kits have the JTAG/SWD FTDI chip onboard, and some, like EK-LM3S9B90, come with a separate In-Circuit Debugger Interface Board. The ICDI board can also be used stand-alone, for other boards and chips than the kit it came with. The ICDI has both old style 20-pin JTAG connector and new style JTAG/SWD 10-pin 1.27mm pitch connector. Tested with EK-LM3S9B90, where the BD-ICDI board is included. Signed-off-by: Peter Stuge Signed-off-by: Greg Kroah-Hartman commit 9eacde321d0b3e1fed9478a8c02110392e96d039 Author: Hakan Kvist Date: Mon Oct 3 13:41:15 2011 +0200 USB: ftdi_sio: add PID for Sony Ericsson Urban commit 74bdf22b5c3858b06af46f19d05c23e76c40a3bb upstream. Add PID 0xfc8a, 0xfc8b for device Sony Ericsson Urban Signed-off-by: Hakan Kvist Signed-off-by: Oskar Andero Signed-off-by: Greg Kroah-Hartman commit f06eb26fd629d39f3cfc729dc08668d89b137650 Author: Eric Benoit Date: Sat Sep 24 02:04:50 2011 -0400 USB: pl2303: add id for SMART device commit 598f0b703506da841d3459dc0c48506be14d1778 upstream. Add vendor and product ID for the SMART USB to serial adapter. These were meant to be used with their SMART Board whiteboards, but can be re-purposed for other tasks. Tested and working (at at least 9600 bps). Signed-off-by: Eric Benoit Signed-off-by: Greg Kroah-Hartman commit 30dd5b9fd9ccc9cf661a72d54ef67511cdadbec1 Author: Jon Levell Date: Thu Sep 29 20:42:52 2011 +0100 USB: add quirk for Logitech C300 web cam commit 5b253d88cc6c65a23cefc457a5a4ef139913c5fc upstream. My webcam is a Logitech C300 and I get "chipmunk"ed squeaky sound. The following trivial patch fixes it. Signed-off-by: Jon Levell Signed-off-by: Greg Kroah-Hartman commit a8de96f08123ea80b04264e9faecfa34118ce4d8 Author: Oliver Neukum Date: Tue Sep 13 08:42:21 2011 +0200 USB: add RESET_RESUME for webcams shown to be quirky commit 2394d67e446bf616a0885167d5f0d397bdacfdfc upstream. The new runtime PM code has shown that many webcams suffer from a race condition that may crash them upon resume. Runtime PM is especially prone to show the problem because it retains power to the cameras at all times. However system suspension may also crash the devices and retain power to the devices. The only way to solve this problem without races is in usbcore with the RESET_RESUME quirk. Signed-off-by: Oliver Neukum Signed-off-by: Greg Kroah-Hartman commit 2305a1169c91eee50fe91204692eebea8dce6b6c Author: Denis Pershin Date: Sun Sep 4 17:37:21 2011 +0700 usb: cdc-acm: Owen SI-30 support commit 65e52f41fa944cef2e6d4222b8c54f46cc575214 upstream. here is the patch to support Owen SI-30 device. This is a pulse counter controller. http://www.owen.ru/en/catalog/93788515 usb-drivers output: T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 4 Spd=12 MxCh= 0 D: Ver= 2.00 Cls=02(commc) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1 P: Vendor=03eb ProdID=0030 Rev=01.01 C: #Ifs= 2 Cfg#= 1 Atr=c0 MxPwr=0mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=02 Prot=00 Driver=cdc_acm I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_acm This patch is installed on my home system which receives data from this controller connected to cold water counter. Signed-off-by: Denis Pershin Signed-off-by: Greg Kroah-Hartman commit 62a5ac8b5fa6381fca135325166fb71b5e413be6 Author: Serge Hallyn Date: Mon Sep 26 10:18:29 2011 -0500 USB: pid_ns: ensure pid is not freed during kill_pid_info_as_uid commit aec01c5895051849ed842dc5b8794017a7751f28 upstream. Alan Stern points out that after spin_unlock(&ps->lock) there is no guarantee that ps->pid won't be freed. Since kill_pid_info_as_uid() is called after the spin_unlock(), the pid passed to it must be pinned. Reported-by: Alan Stern Signed-off-by: Serge Hallyn Signed-off-by: Greg Kroah-Hartman commit 1faec480bbcf3917205feef90ae1e1b38edceaf6 Author: Matthias Dellweg <2500@gmx.de> Date: Sun Sep 25 14:26:25 2011 +0200 usb/core/devio.c: Check for printer class specific request commit 393cbb5151ecda9f9e14e3082d048dd27a1ff9f6 upstream. In the usb printer class specific request get_device_id the value of wIndex is (interface << 8 | altsetting) instead of just interface. This enables the detection of some printers with libusb. Acked-by: Alan Stern Signed-off-by: Matthias Dellweg <2500@gmx.de> Signed-off-by: Greg Kroah-Hartman commit 76fa3531d09c55ecf99ea62f13f8b1dd8be076e1 Author: Fabian Godehardt Date: Thu Sep 1 14:15:46 2011 +0200 USB: g_printer: fix bug in unregistration commit 8582d86143c690c68cc42f996def466a035bee34 upstream. The allocated chardevice region range is only 1 device but on unregister it currently tries to deregister 2. Found this while doing a insmod/rmmod/insmod/rm... of the module which seemed to eat major numbers. Signed-off-by: Fabian Godehardt Signed-off-by: Greg Kroah-Hartman commit f72d6f85aa5857d889a2b4a41f2bd6be4918703a Author: Matthew Garrett Date: Thu Oct 6 15:35:43 2011 -0400 USB: Fix runtime wakeup on OHCI commit a8b43c00ef06aec49b9fe0a5bad8a6a320e4d27b upstream. At least some OHCI hardware (such as the MCP89) fails to flag any change in the host status register or the port status registers when receiving a remote wakeup while in D3 state. This results in the controller being resumed but no device state change being noticed, at which point the controller is put back to sleep again. Since there doesn't seem to be any reliable way to identify the state change, just unconditionally resume the hub. It'll be put back to sleep in the near future anyway if there are no active devices attached to it. Signed-off-by: Matthew Garrett Cc: Alan Stern Signed-off-by: Greg Kroah-Hartman commit ab6e8fabfbdbca5a7273347e224fe59efe869e76 Author: Luben Tuikov Date: Thu Nov 11 15:43:11 2010 -0800 USB: storage: Use normalized sense when emulating autosense commit e16da02fcdf1c5e824432f88abf42623dafdf191 upstream. This patch solves two things: 1) Enables autosense emulation code to correctly interpret descriptor format sense data, and 2) Fixes a bug whereby the autosense emulation code would overwrite descriptor format sense data with SENSE KEY HARDWARE ERROR in fixed format, to incorrectly look like this: Oct 21 14:11:07 localhost kernel: sd 7:0:0:0: [sdc] Sense Key : Recovered Error [current] [descriptor] Oct 21 14:11:07 localhost kernel: Descriptor sense data with sense descriptors (in hex): Oct 21 14:11:07 localhost kernel: 72 01 04 1d 00 00 00 0e 09 0c 00 00 00 00 00 00 Oct 21 14:11:07 localhost kernel: 00 4f 00 c2 00 50 Oct 21 14:11:07 localhost kernel: sd 7:0:0:0: [sdc] ASC=0x4 ASCQ=0x1d Signed-off-by: Luben Tuikov Acked-by: Alan Stern Acked-by: Matthew Dharm Signed-off-by: Greg Kroah-Hartman commit cdf110e180a088826bfe31156276f186bf7e7e8e Author: Johannes Stezenbach Date: Thu Sep 8 15:39:15 2011 +0200 usbmon vs. tcpdump: fix dropped packet count commit 236c448cb6e7f82096101e1ace4b77f8b38f82c8 upstream. Report the number of dropped packets instead of zero when using the binary usbmon interface with tcpdump. # tcpdump -i usbmon1 -w dump tcpdump: listening on usbmon1, link-type USB_LINUX_MMAPPED (USB with padded Linux header), capture size 65535 bytes ^C2155 packets captured 2155 packets received by filter 1019 packets dropped by kernel Signed-off-by: Johannes Stezenbach Signed-off-by: Greg Kroah-Hartman commit 1470a499e1aaca5dd4bb6e0626211f91af33fb3b Author: Antonio Ospite Date: Mon Oct 31 17:12:22 2011 -0700 leds: turn the blink_timer off before starting to blink commit 488bc35bf40df89d37486c1826b178a2fba36ce7 upstream. Depending on the implementation of the hardware blinking function in blink_set(), the led can support hardware blinking for some values of delay_on and delay_off and fall-back to software blinking for some other values. Turning off the blink_timer unconditionally before starting to blink make sure that a sequence like: OFF hardware blinking software blinking hardware blinking does not leave the software blinking timer active. Signed-off-by: Antonio Ospite Reviewed-by: Johannes Berg Cc: Richard Purdie Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 52f91caed3c682bf032628eaa60a1faa0d577e78 Author: Antonio Ospite Date: Mon Oct 31 17:12:19 2011 -0700 leds: save the delay values after a successful call to blink_set() commit 6123b0e274503a0d3588e84fbe07c9aa01bfaf5d upstream. When calling the hardware blinking function implemented by blink_set(), the delay_on and delay_off values are not preserved across calls. Fix that and make the "timer" trigger work as expected when hardware blinking is available. BEFORE the fix: $ cd /sys/class/leds/someled $ echo timer > trigger $ cat delay_on delay_off 0 0 $ echo 100 > delay_on $ cat delay_on delay_off 0 0 $ echo 100 > delay_off $ cat delay_on delay_off 0 0 AFTER the fix: $ cd /sys/class/leds/someled $ echo timer > trigger $ cat delay_on delay_off 0 0 $ echo 100 > delay_on $ cat delay_on delay_off 100 0 $ echo 100 > delay_off $ cat delay_on delay_off 100 100 Signed-off-by: Antonio Ospite Reviewed-by: Johannes Berg Cc: Richard Purdie Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 3dbbae24b399adc22957217d579d53ae363f090f Author: Nelson Elhage Date: Mon Oct 31 17:13:14 2011 -0700 epoll: fix spurious lockdep warnings commit d8805e633e054c816c47cb6e727c81f156d9253d upstream. epoll can acquire recursively acquire ep->mtx on multiple "struct eventpoll"s at once in the case where one epoll fd is monitoring another epoll fd. This is perfectly OK, since we're careful about the lock ordering, but it causes spurious lockdep warnings. Annotate the recursion using mutex_lock_nested, and add a comment explaining the nesting rules for good measure. Recent versions of systemd are triggering this, and it can also be demonstrated with the following trivial test program: --------------------8<-------------------- int main(void) { int e1, e2; struct epoll_event evt = { .events = EPOLLIN }; e1 = epoll_create1(0); e2 = epoll_create1(0); epoll_ctl(e1, EPOLL_CTL_ADD, e2, &evt); return 0; } --------------------8<-------------------- Reported-by: Paul Bolle Tested-by: Paul Bolle Signed-off-by: Nelson Elhage Acked-by: Jason Baron Cc: Dave Jones Cc: Davide Libenzi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 2f3f49d0afbeb318b096f09fccaf8747251afccf Author: Josh Stone Date: Mon Oct 24 10:15:51 2011 -0700 x86: Fix compilation bug in kprobes' twobyte_is_boostable commit 315eb8a2a1b7f335d40ceeeb11b9e067475eb881 upstream. When compiling an i386_defconfig kernel with gcc-4.6.1-9.fc15.i686, I noticed a warning about the asm operand for test_bit in kprobes' can_boost. I discovered that this caused only the first long of twobyte_is_boostable[] to be output. Jakub filed and fixed gcc PR50571 to correct the warning and this output issue. But to solve it for less current gcc, we can make kprobes' twobyte_is_boostable[] non-const, and it won't be optimized out. Before: CC arch/x86/kernel/kprobes.o In file included from include/linux/bitops.h:22:0, from include/linux/kernel.h:17, from [...]/arch/x86/include/asm/percpu.h:44, from [...]/arch/x86/include/asm/current.h:5, from [...]/arch/x86/include/asm/processor.h:15, from [...]/arch/x86/include/asm/atomic.h:6, from include/linux/atomic.h:4, from include/linux/mutex.h:18, from include/linux/notifier.h:13, from include/linux/kprobes.h:34, from arch/x86/kernel/kprobes.c:43: [...]/arch/x86/include/asm/bitops.h: In function ‘can_boost.part.1’: [...]/arch/x86/include/asm/bitops.h:319:2: warning: use of memory input without lvalue in asm operand 1 is deprecated [enabled by default] $ objdump -rd arch/x86/kernel/kprobes.o | grep -A1 -w bt 551: 0f a3 05 00 00 00 00 bt %eax,0x0 554: R_386_32 .rodata.cst4 $ objdump -s -j .rodata.cst4 -j .data arch/x86/kernel/kprobes.o arch/x86/kernel/kprobes.o: file format elf32-i386 Contents of section .data: 0000 48000000 00000000 00000000 00000000 H............... Contents of section .rodata.cst4: 0000 4c030000 L... Only a single long of twobyte_is_boostable[] is in the object file. After, without the const on twobyte_is_boostable: $ objdump -rd arch/x86/kernel/kprobes.o | grep -A1 -w bt 551: 0f a3 05 20 00 00 00 bt %eax,0x20 554: R_386_32 .data $ objdump -s -j .rodata.cst4 -j .data arch/x86/kernel/kprobes.o arch/x86/kernel/kprobes.o: file format elf32-i386 Contents of section .data: 0000 48000000 00000000 00000000 00000000 H............... 0010 00000000 00000000 00000000 00000000 ................ 0020 4c030000 0f000200 ffff0000 ffcff0c0 L............... 0030 0000ffff 3bbbfff8 03ff2ebb 26bb2e77 ....;.......&..w Now all 32 bytes are output into .data instead. Signed-off-by: Josh Stone Cc: Masami Hiramatsu Cc: Jakub Jelinek Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 0989d31d57762309445fa1469907b2e6c2cd4ae5 Author: Jack Steiner Date: Tue Sep 20 13:55:04 2011 -0700 x86: uv2: Workaround for UV2 Hub bug (system global address format) commit 6a469e4665bc158599de55d64388861d0a9f10f4 upstream. This is a workaround for a UV2 hub bug that affects the format of system global addresses. The GRU API for UV2 was inadvertently broken by a hardware change. The format of the physical address used for TLB dropins and for addresses used with instructions running in unmapped mode has changed. This change was not documented and became apparent only when diags failed running on system simulators. For UV1, TLB and GRU instruction physical addresses are identical to socket physical addresses (although high NASID bits must be OR'ed into the address). For UV2, socket physical addresses need to be converted. The NODE portion of the physical address needs to be shifted so that the low bit is in bit 39 or bit 40, depending on an MMR value. It is not yet clear if this bug will be fixed in a silicon respin. If it is fixed, the hub revision will be incremented & the workaround disabled. Signed-off-by: Jack Steiner Cc: Ingo Molnar Cc: "H. Peter Anvin" Signed-off-by: Andrew Morton Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit f2c1c3233aa7b1742c458b1eed929d675222e70c Author: Nicholas Bellinger Date: Tue Oct 18 23:48:04 2011 -0700 target: Fix REPORT TARGET PORT GROUPS handling with small allocation length commit 6b20fa9aaf0c2f69ee6f9648e20ab2be0206705e upstream. This patch fixes a bug with the handling of REPORT TARGET PORT GROUPS containing a smaller allocation length than the payload requires causing memory writes beyond the end of the buffer. This patch checks for the minimum 4 byte length for the response payload length, and also checks upon each loop of T10_ALUA(su_dev)->tg_pt_gps_list to ensure the Target port group and Target port descriptor list is able to fit into the remaining allocation length. If the response payload exceeds the allocation length length, then rd_len is still increments to indicate to the initiator that the payload has been truncated. Reported-by: Roland Dreier Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman commit 133615a7e293f3628c6f7860a41b9d7964d15a60 Author: David Henningsson Date: Tue Oct 18 14:07:51 2011 +0200 ALSA: HDA: Add new revision for ALC662 commit cc667a72d471e79fd8e5e291ea115923cf44dca0 upstream. The revision 0x100300 was found for ALC662. It seems to work well with patch_alc662. BugLink: http://bugs.launchpad.net/bugs/877373 Tested-by: Shengyao Xue Signed-off-by: David Henningsson Acked-by: Kailang Yang Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 6d8891c6a14141fad833f15745ae2f637d23dd8a Author: Charles Chin Date: Thu Oct 13 07:54:09 2011 +0200 ALSA: hda - Remove bad code for IDT 92HD83 family patch commit 6c5c04e509b7000617b09d4301f0b9b6d171d1e6 upstream. The purpose of this patch is to remove a section of "bad" code that assigns the last DAC to ports E or F in order to support notebooks with docking in earlier days, around ALSA 1.0.19 - 21. This is not necessary now and actually breaks some configurations that use these ports as other devices. This have been tested on several different configurations to make sure that it is working for different combinations. Signed-off-by: Charles Chin Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit cdab390353a92844107bf49bd4bb8b436e909b2f Author: Jeff Skirvin Date: Wed Sep 28 18:35:32 2011 -0700 isci: fix missed unlock in apc_agent_timeout() commit 983d3fdd332742167d0482c06fd29cf4b8a687c0 upstream. Needed to jump to scic_lock unlock. Also spotted by coccicheck. Signed-off-by: Jeff Skirvin Signed-off-by: Dan Williams Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 5cbadb2ee60c10ada1a8bfd1f7ba67d8e30a4e39 Author: Dan Williams Date: Wed Sep 28 18:35:27 2011 -0700 isci: fix support for large smp requests commit 54b5e3a4bfa3452bc10cd4da672099ccc46b8c09 upstream. Kill the local smp response buffer. Besides being unnecessary, it is too small (currently truncates responses to 60 bytes). The mid-layer will have already allocated a sufficiently sized buffer, just kmap and copy into it directly. Reported-by: Derick Marks Tested-by: Derick Marks Signed-off-by: Dan Williams Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 31a471a2d7c27373b80677f65934b16adf4635d5 Author: Jack Wang Date: Fri Sep 23 14:32:32 2011 +0800 libsas: set sas_address and device type of rphy commit bb041a0e9c31229071b6e56e1d0d8374af0d2038 upstream. Libsas forget to set the sas_address and device type of rphy lead to file under /sys/class/sas_x show wrong value, fix that. Signed-off-by: Jack Wang Tested-by: Crystal Yu Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit fa11f5a1d9e8e199dfacb16a4288d4d4c5c549ff Author: Anton Blanchard Date: Mon Aug 1 19:43:45 2011 +1000 ipr: Always initiate hard reset in kdump kernel commit 5d7c20b7fa5c6ca19e871b4050e321c99d32bd43 upstream. During kdump testing I noticed timeouts when initialising each IPR adapter. While the driver has logic to detect an adapter in an indeterminate state, it wasn't triggering and each adapter went through a 5 minute timeout before finally going operational. Some analysis showed the needs_hard_reset flag wasn't getting set. We can check the reset_devices kernel parameter which is set by kdump and force a full reset. This fixes the problem. Signed-off-by: Anton Blanchard Acked-by: Brian King Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 20e801924287a2eebe00395f4cebc8eeb7d5aa62 Author: adam radford Date: Thu Oct 13 16:01:12 2011 -0700 megaraid_sas: Fix instance access in megasas_reset_timer commit f575c5d3ebdca3b0482847d8fcba971767754a9e upstream. The following patch for megaraid_sas will fix a potential bad pointer access in megasas_reset_timer(), when a MegaRAID 9265/9285 or 9360/9380 gets a timeout. megasas_build_io_fusion() sets SCp.ptr to be a struct megasas_cmd_fusion *, but then megasas_reset_timer() was casting SCp.ptr to be a struct megasas_cmd *, then trying to access cmd->instance, which is invalid. Just loading instance from scmd->device->host->hostdata in megasas_reset_timer() fixes the issue. Signed-off-by: Adam Radford Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 95bf50db41fbb1db306b3e636d46ce9014482a50 Author: Josh Boyer Date: Wed Oct 5 11:44:50 2011 -0400 PCI quirk: mmc: Always check for lower base frequency quirk for Ricoh 1180:e823 commit 3e309cdf07c930f29a4e0f233e47d399bea34c68 upstream. Commit 15bed0f2f added a quirk for the e823 Ricoh card reader to lower the base frequency. However, the quirk first checks to see if the proprietary MMC controller is disabled, and returns if so. On some devices, such as the Lenovo X220, the MMC controller is already disabled by firmware it seems, but the frequency change is still needed so sdhci-pci can talk to the cards. Since the MMC controller is disabled, the frequency fixup was never being run on these machines. This moves the e823 check above the MMC controller check so that it always gets run. This fixes https://bugzilla.redhat.com/show_bug.cgi?id=722509 Signed-off-by: Josh Boyer Signed-off-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman commit c359836591a99d43c5e4c6792de75dcaddee805e Author: Andrei Warkentin Date: Sat Sep 24 12:12:30 2011 -0400 mmc: core: ext_csd.raw_* used in comparison but never set commit 5238acbe36dd5100fb6b035a995ae5fc89dd0708 upstream. f39b2dd9d ("mmc: core: Bus width testing needs to handle suspend/resume") added code to only compare read-only ext_csd fields in bus width testing code, yet it's comparing some fields that are never set. The affected fields are ext_csd.raw_erased_mem_count and ext_csd.raw_partition_support. Signed-off-by: Andrei Warkentin Acked-by: Philip Rakity Signed-off-by: Chris Ball Signed-off-by: Greg Kroah-Hartman commit 311c3c10f6429f4405be6a0e98cb27c6995ca8b9 Author: Ulf Hansson Date: Wed Sep 21 14:08:13 2011 -0400 mmc: core: Fix hangs related to insert/remove of cards commit 7f7e4129c23f0419257184dff6fec89d2d5a8964 upstream. During a rescan operation mmc_attach(sd|mmc|sdio) functions are called. The error handling in these function can trigger a detach of the bus, which also meant a power off. This is not notified by the rescan operation which then continues to the next attach function. If a power off has been done, the framework must never send any new commands to the host driver, without first doing a new power up. This will most likely trigger any host driver to hang. Moving power off out of detach and instead handle power off separately when it is actually needed, solves the issue. Signed-off-by: Ulf Hansson Acked-by: Linus Walleij Signed-off-by: Chris Ball Signed-off-by: Greg Kroah-Hartman commit c86935898f7af4bbafa14c0f402a79925c53a33f Author: Jean Delvare Date: Thu Oct 6 18:16:24 2011 +0200 drm/radeon/kms: Fix I2C mask definitions commit 286e0c94f9c3f292cb38a977fbbde3433347a868 upstream. Commit 9b9fe724 accidentally used RADEON_GPIO_EN_* where RADEON_GPIO_MASK_* was intended. This caused improper initialization of I2C buses, mostly visible when setting i2c_algo_bit.bit_test=1. Using the right constants fixes the problem. Signed-off-by: Jean Delvare Reviewed-by: Alex Deucher Cc: Jerome Glisse Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 12bc1875cccdb601083183961533f64a0386370b Author: Alex Deucher Date: Fri Oct 7 14:23:48 2011 -0400 drm/radeon/kms: handle !force case in connector detect more gracefully commit d0d0a225e6ad43314c9aa7ea081f76adc5098ad4 upstream. When force == false, we don't do load detection in the connector detect functions. Unforunately, we also return the previous connector state so we never get disconnect events for DVI-I, DVI-A, or VGA. Save whether we detected the monitor via load detection previously and use that to determine whether we return the previous state or not. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=41561 Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit c271809eb4a52643cb5618678c81d682c20ad501 Author: Alex Deucher Date: Fri Oct 7 14:23:47 2011 -0400 drm/radeon/kms: bail early in dvi_detect for digital only connectors commit 5f0a26128d66ef81613fe923d5c288942844ccdc upstream. DVI-D and HDMI-A are digital only, so there's no need to attempt analog load detect. Also, skip bail before the !force check, or we fail to get a disconnect events. The next patches in the series attempt to fix disconnect events for connectors with analog support (DVI-I, HDMI-B, DVI-A). Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=41561 Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 97e4a783f6e9b5d99123c93233b4592278439377 Author: Takashi Iwai Date: Fri Oct 14 11:45:40 2011 +0200 drm/i915/panel: Always record the backlight level again (but cleverly) commit f52c619a590fa75276c07dfcaf380dee53e4ea4c upstream. The commit 47356eb67285014527a5ab87543ba1fae3d1e10a introduced a mechanism to record the backlight level only at disabling time, but it also introduced a regression. Since intel_lvds_enable() may be called without disabling (e.g. intel_lvds_commit() calls it unconditionally), the backlight gets back to the last recorded value. For example, this happens when you dim the backlight, close the lid and open the lid, then the backlight suddenly goes to the brightest. This patch fixes the bug by recording the backlight level always when changed via intel_panel_set_backlight(). And, intel_panel_{enable|disable}_backlight() call the internal function not to update the recorded level wrongly. Signed-off-by: Takashi Iwai Reviewed-by: Keith Packard Signed-off-by: Keith Packard Signed-off-by: Greg Kroah-Hartman commit b620fec43eeeadb25d96e537fc06dddf59ebfd78 Author: Keith Packard Date: Wed Sep 28 16:38:44 2011 -0700 drm/i915: Wrap DP EDID fetch functions to enable eDP panel power commit 8c241fef3e6f69f3f675678ae03599ece3f562e2 upstream. Talking to the eDP DDC channel requires that the panel be powered up. Wrap both the EDID and modes fetch code with calls to turn the vdd power on and back off. Signed-off-by: Keith Packard Reviewed-by: Daniel Vetter Signed-off-by: Greg Kroah-Hartman commit 5c7a6982e976b381595c9d4ee8e8c94564a40aec Author: Andiry Xu Date: Fri Sep 23 14:19:54 2011 -0700 xHCI: AMD isoc link TRB chain bit quirk commit 7e393a834b41001174a8fb3ae3bc23a749467760 upstream. Setting the chain (CH) bit in the link TRB of isochronous transfer rings is required by AMD 0.96 xHCI host controller to successfully transverse multi-TRB TD that span through different memory segments. When a Missed Service Error event occurs, if the chain bit is not set in the link TRB and the host skips TDs which just across a link TRB, the host may falsely recognize the link TRB as a normal TRB. You can see this may cause big trouble - the host does not jump to the right address which is pointed by the link TRB, but continue fetching the memory which is after the link TRB address, which may not even belong to the host, and the result cannot be predicted. This causes some big problems. Without the former patch I sent: "xHCI: prevent infinite loop when processing MSE event", the system may hang. With that patch applied, system does not hang, but the host still access wrong memory address and isoc transfer will fail. With this patch, isochronous transfer works as expected. This patch should be applied to kernels as old as 2.6.36, which was when the first isochronous support was added for the xHCI host controller. Signed-off-by: Andiry Xu Signed-off-by: Sarah Sharp Signed-off-by: Greg Kroah-Hartman commit fb71face21504aaf924e6084abee9512bb1f2f29 Author: Kautuk Consul Date: Mon Sep 19 16:53:12 2011 -0700 xhci-mem.c: Check for ring->first_seg != NULL commit 0e6c7f746ea99089fb3263709075c20485a479ae upstream. There are 2 situations wherein the xhci_ring* might not get freed: - When xhci_ring_alloc() -> xhci_segment_alloc() returns NULL and we goto the fail: label in xhci_ring_alloc. In this case, the ring will not get kfreed. - When the num_segs argument to xhci_ring_alloc is passed as 0 and we try to free the rung after that. ( This doesn't really happen as of now in the code but we seem to be entertaining num_segs=0 in xhci_ring_alloc ) This should be backported to kernels as old as 2.6.31. Signed-off-by: Kautuk Consul Signed-off-by: Sarah Sharp Signed-off-by: Greg Kroah-Hartman commit 21f25cdb9e476c64d504981133d0552f7d155805 Author: Alan Stern Date: Wed Oct 12 10:39:14 2011 -0400 EHCI: workaround for MosChip controller bug commit 68aa95d5d4de31c9348c1628ffa85c805305ebc5 upstream. This patch (as1489) works around a hardware bug in MosChip EHCI controllers. Evidently when one of these controllers increments the frame-index register, it changes the three low-order bits (the microframe counter) before changing the higher order bits (the frame counter). If the register is read at just the wrong time, the value obtained is too low by 8. When the appropriate quirk flag is set, we work around this problem by reading the frame-index register a second time if the first value's three low-order bits are all 0. This gives the hardware a chance to finish updating the register, yielding the correct value. Signed-off-by: Alan Stern Tested-by: Jason N Pitt Signed-off-by: Greg Kroah-Hartman commit 7eede2cbc1066124a0a4fee4d9671e28f7c62277 Author: Harro Haan Date: Mon Oct 10 14:38:27 2011 +0200 USB: fix ehci alignment error commit 276532ba9666b36974cbe16f303fc8be99c9da17 upstream. The Kirkwood gave an unaligned memory access error on line 742 of drivers/usb/host/echi-hcd.c: "ehci->last_periodic_enable = ktime_get_real();" Signed-off-by: Harro Haan Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit cd0712116761eed1500b2272a5492d2120c30f26 Author: Matthieu CASTET Date: Sat Jul 2 19:47:33 2011 +0200 EHCI : introduce a common ehci_setup commit 2093c6b49c8f1dc581d8953aca71297d4cace55e upstream. This allow to clean duplicated code in most of SOC driver. Signed-off-by: Matthieu CASTET Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit 3e9efdd45f78e0ad859b60906c6556e8efe2579b Author: Ning Jiang Date: Mon Sep 5 16:28:18 2011 +0800 serial-core: power up uart port early before we do set_termios when resuming commit 94abc56f4d90f289ea32a0a11d3577fcd8cb28fb upstream. The following patch removed uart_change_pm() in uart_resume_port(): commit 5933a161abcb8d83a2c145177f48027c3c0a8995 Author: Yin Kangkai serial-core: reset the console speed on resume It will break the pxa serial driver when the system resumes from suspend mode as it will try to set baud rate divider register in set_termios but with clock off. The register value can not be set correctly on some platform if the clock is disabled. The pxa driver will check the value and report the following warning: ------------[ cut here ]------------ WARNING: at drivers/tty/serial/pxa.c:545 serial_pxa_set_termios+0x1dc/0x250() Modules linked in: [] (unwind_backtrace+0x0/0xf0) from [] (warn_slowpath_common+0x4c/0x64) [] (warn_slowpath_common+0x4c/0x64) from [] (warn_slowpath_null+0x18/0x1c) [] (warn_slowpath_null+0x18/0x1c) from [] (serial_pxa_set_termios+0x1dc/0x250) [] (serial_pxa_set_termios+0x1dc/0x250) from [] (uart_resume_port+0x128/0x2dc) [] (uart_resume_port+0x128/0x2dc) from [] (serial_pxa_resume+0x18/0x24) [] (serial_pxa_resume+0x18/0x24) from [] (platform_pm_resume+0x40/0x4c) [] (platform_pm_resume+0x40/0x4c) from [] (pm_op+0x68/0xb4) [] (pm_op+0x68/0xb4) from [] (device_resume+0xb0/0xec) [] (device_resume+0xb0/0xec) from [] (dpm_resume+0xe0/0x194) [] (dpm_resume+0xe0/0x194) from [] (dpm_resume_end+0xc/0x18) [] (dpm_resume_end+0xc/0x18) from [] (suspend_devices_and_enter+0x16c/0x1ac) [] (suspend_devices_and_enter+0x16c/0x1ac) from [] (enter_state+0xac/0xdc) [] (enter_state+0xac/0xdc) from [] (state_store+0xa0/0xbc) [] (state_store+0xa0/0xbc) from [] (kobj_attr_store+0x18/0x1c) [] (kobj_attr_store+0x18/0x1c) from [] (sysfs_write_file+0x108/0x140) [] (sysfs_write_file+0x108/0x140) from [] (vfs_write+0xac/0x134) [] (vfs_write+0xac/0x134) from [] (sys_write+0x3c/0x68) [] (sys_write+0x3c/0x68) from [] (ret_fast_syscall+0x0/0x2c) ---[ end trace 88289eceb4675b04 ]--- This patch fix the problem by adding the power on opertion back for uart console when console_suspend_enabled is true. Signed-off-by: Ning Jiang Tested-by: Mayank Rana Signed-off-by: Greg Kroah-Hartman commit d5fe5d1648b88aa16b5d97d088d9b743bc9ce0a8 Author: Marcus Folkesson Date: Tue Aug 30 13:53:10 2011 +0200 serial: pxa: work around for errata #20 commit e44aabd649c80e8be16ede3ed3cbff6fb2561ca9 upstream. Errata E20: UART: Character Timeout interrupt remains set under certain software conditions. Implication: The software servicing the UART can be trapped in an infinite loop. Signed-off-by: Marcus Folkesson Signed-off-by: Greg Kroah-Hartman commit ee5ad2bab31967d0d836e56c10e57e74145df151 Author: Rigbert Hamisch Date: Tue Sep 27 10:46:43 2011 +0200 USB: qcserial: add device ID for "HP un2430 Mobile Broadband Module" commit 1bfac90d1b8e63a4d44158c3445d8fda3fb6d5eb upstream. add device ID for "HP un2430 Mobile Broadband Module" Signed-off-by: Rigbert Hamisch Signed-off-by: Greg Kroah-Hartman commit 285c6b4b3be21529ec5dbdfb1a6d48a3aa31d0c7 Author: Richard Hartmann Date: Tue Sep 20 20:50:51 2011 +0200 USB: qcserial: Add support for Sierra Wireless MC8355/Gobi 3000 commit 68c79e5756903229fa96826a2493c2265a3b395f upstream. Simple patch to make qcserial recognize the USB id of the Sierra Wireless MC8355 which is based on the Gobi 3000 chip. Both UMTS and GPS work fine. Signed-off-by: Richard Hartmann Signed-off-by: Greg Kroah-Hartman commit 70908d994241bb79e4f3c546f6ddd262567610c6 Author: Mike Sterling Date: Tue Sep 6 16:10:55 2011 -0700 Staging: hv: Add support for >2 TB LUN in storage driver. commit cf55f4a8b6243b42fb91c56d1421db0d36d60f96 upstream. If a LUN larger than 2 TB is attached to a Linux VM on Hyper-V, we currently report a maximum size of 2 TB. This patch resolves the issue in hv_storvsc. Thanks to Robert Scheck for reporting the issue. Reported-by: Robert Scheck Signed-off-by: Mike Sterling Signed-off-by: K.Y. Srinivasan Signed-off-by: Haiyang Zhang Signed-off-by: Greg Kroah-Hartman commit 828ed1259f73a85d47b417edd84e02bbbb52bb87 Author: Kautuk Consul Date: Wed Sep 14 08:56:21 2011 +0530 staging: quatech_usb2: Potential lost wakeup scenario in TIOCMIWAIT commit e8df1674d383d2ecc6efa8d7dba74c03aafdfdd7 upstream. If the usermode app does an ioctl over this serial device by using TIOCMIWAIT, then the code will wait by setting the current task state to TASK_INTERRUPTIBLE and then calling schedule(). This will be woken up by the qt2_process_modem_status on URB completion when the port_extra->shadowMSR is set to the new modem status. However, this could result in a lost wakeup scenario due to a race in the logic in the qt2_ioctl(TIOCMIWAIT) loop and the URB completion for new modem status in qt2_process_modem_status. Due to this, the usermode app's task will continue to sleep despite a change in the modem status. Signed-off-by: Kautuk Consul Signed-off-by: Greg Kroah-Hartman commit da7061614e7d11f0a0db96a5f507feca4ac9fa17 Author: Bill Pemberton Date: Mon Aug 29 13:48:54 2011 -0400 staging: serqt_usb2: remove ssu100 from supported devices commit 7cbf3c7cd59288fb5e9f31815c74773549668d43 upstream. The serqt_usb2 driver will not work properly with the ssu100 device even though it claims to support it. The ssu100 is supported by the ssu100 driver in mainline so there is no need to have it claimed by serqt_usb2. Signed-off-by: Bill Pemberton Signed-off-by: Greg Kroah-Hartman commit e46389fa0026dd3bbaebf92a525dad3e80b7bce2 Author: Jim Wylder Date: Tue Sep 6 21:07:20 2011 -0500 USB: for usb_autopm_get_interface_async -EINPROGRESS is not an error commit c5a48592d874ddef8c7880311581eccf0eb30c3b upstream. A return value of -EINPROGRESS from pm_runtime_get indicates that the device is already resuming due to a previous call. Internally, usb_autopm_get_interface_async doesn't treat this as an error and increments the usage count, but passes the error status along to the caller. The logical assumption of the caller is that any negative return value reflects the device not resuming and the pm_usage_cnt not being incremented. Since the usage count is being incremented and the device is resuming, return success (0) instead. Signed-off-by: James Wylder Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit eece93cccb258072bf9a355faeca2ee2752b27e3 Author: Jiri Slaby Date: Wed Oct 12 11:32:44 2011 +0200 TTY: pty, release tty in all ptmx_open fail paths commit 1177c0efc04d032644895b8d757f55b433912596 upstream. Mistakenly, commit 64ba3dc3143d (tty: never hold BTM while getting tty_mutex) switched one fail path in ptmx_open to not free the newly allocated tty. Fix that by jumping to the appropriate place. And rename the labels so that it's clear what is going on there. Introduced-in: v2.6.36-rc2 Signed-off-by: Jiri Slaby Cc: Arnd Bergmann Cc: Alan Cox Signed-off-by: Greg Kroah-Hartman commit 0c1f111ae7fcea822fd1c078ef48e88d93afc57a Author: Jiri Slaby Date: Wed Oct 12 11:32:43 2011 +0200 TTY: make tty_add_file non-failing commit fa90e1c935472281de314e6d7c9a37db9cbc2e4e upstream. If tty_add_file fails at the point it is now, we have to revert all the changes we did to the tty. It means either decrease all refcounts if this was a tty reopen or delete the tty if it was newly allocated. There was a try to fix this in v3.0-rc2 using tty_release in 0259894c7 (TTY: fix fail path in tty_open). But instead it introduced a NULL dereference. It's because tty_release dereferences filp->private_data, but that one is set even in our tty_add_file. And when tty_add_file fails, it's still NULL/garbage. Hence tty_release cannot be called there. To circumvent the original leak (and the current NULL deref) we split tty_add_file into two functions, making the latter non-failing. In that case we may do the former early in open, where handling failures is easy. The latter stays as it is now. So there is no change in functionality. The original bug (leak) was introduced by f573bd176 (tty: Remove __GFP_NOFAIL from tty_add_file()). Thanks Dan for reporting this. Later, we may split tty_release into more functions and call only some of them in this fail path instead. (If at all possible.) Introduced-in: v2.6.37-rc2 Signed-off-by: Jiri Slaby Reported-by: Dan Carpenter Cc: Alan Cox Cc: Pekka Enberg Signed-off-by: Greg Kroah-Hartman commit 36174dd629350d0654982977d7795ca28475c16f Author: Jiri Slaby Date: Wed Oct 12 11:32:42 2011 +0200 TTY: drop driver reference in tty_open fail path commit c290f8358acaeffd8e0c551ddcc24d1206143376 upstream. When tty_driver_lookup_tty fails in tty_open, we forget to drop a reference to the tty driver. This was added by commit 4a2b5fddd5 (Move tty lookup/reopen to caller). Fix that by adding tty_driver_kref_put to the fail path. I will refactor the code later. This is for the ease of backporting to stable. Introduced-in: v2.6.28-rc2 Signed-off-by: Jiri Slaby Cc: Alan Cox Acked-by: Sukadev Bhattiprolu Signed-off-by: Greg Kroah-Hartman commit 47bbdafa8ab90e3d4b7a4c6dd9bf54f7bc6df66d Author: WANG Cong Date: Thu Sep 1 13:58:29 2011 +0800 cris: fix a build error in drivers/tty/serial/crisv10.c commit 2f7861de111bb8e33e6ab9f9607583c6fbc00132 upstream. This patch fixes the following build error: drivers/tty/serial/crisv10.c:4453: error: 'if_ser0' undeclared (first use in this function): 2 errors in 2 logs v3.1-rc4/cris/cris-allmodconfig v3.1-rc4/cris/cris-allyesconfig drivers/tty/serial/crisv10.c:4453: error: (Each undeclared identifier is reported only once: 2 errors in 2 logs v3.1-rc4/cris/cris-allmodconfig v3.1-rc4/cris/cris-allyesconfig drivers/tty/serial/crisv10.c:4453: error: for each function it appears in.): 2 errors in 2 logs v3.1-rc4/cris/cris-allmodconfig v3.1-rc4/cris/cris-allyesconfig "if_ser0" is a typo, it should be "if_serial_0". Cc: Mikael Starvik Cc: Jesper Nilsson Signed-off-by: WANG Cong Signed-off-by: Greg Kroah-Hartman commit e842a3e0d2bd01e0e32c0af4ef266f08b9b9ef75 Author: Pavel Shilovsky Date: Sat Oct 22 14:37:50 2011 +0400 CIFS: Fix DFS handling in cifs_get_file_info commit 42274bb22afc3e877ae5abed787b0b09d7dede52 upstream. We should call cifs_all_info_to_fattr in rc == 0 case only. Signed-off-by: Pavel Shilovsky Reviewed-by: Jeff Layton Signed-off-by: Steve French Signed-off-by: Greg Kroah-Hartman commit 2d925a5b8e7ea244bca1e988df4ce0c6db0c4d07 Author: Pavel Shilovsky Date: Fri Oct 7 18:57:45 2011 +0400 CIFS: Fix incorrect max RFC1002 write size value commit 94443f43404239c2a6dc4252a7cb9e77f5b1eb6e upstream. ..the length field has only 17 bits. Acked-by: Jeff Layton Signed-off-by: Pavel Shilovsky Signed-off-by: Steve French Signed-off-by: Greg Kroah-Hartman