commit b48635635c1a696aea6423ec6c547c8c7bbf7aab Author: Greg Kroah-Hartman Date: Fri Nov 11 12:19:27 2011 -0800 Linux 3.1.1 commit eeb85d10c712860e656728df24a8402243d47083 Author: Linus Torvalds Date: Sun Nov 6 18:34:03 2011 -0800 hid/apple: modern macbook airs use the standard apple function key translations commit 21404b772a1c65f7b935b8c0fddc388a949f4e31 upstream. This removes the use of the special "macbookair_fn_keys" keyboard translation table for the MacBookAir4,x models (ie the 2011 refresh). They use the standard apple_fn_keys[] translation. Apparently only the old MacBook Air's need a different translation table. This mirrors the change that commit da617c7cb915 ("HID: consolidate MacbookAir 4,1 mappings") did for the WELLSPRING6A ones, but does it for the WELLSPRING6 model used on the MacBookAir4,2. Reported-and-tested-by: Dirk Hohndel Cc: Jiri Kosina Cc: Joshua V Dillon Cc: Chase Douglas Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 2cd4c0389efbeb4f5da9be66f809f3aacb10a4c5 Author: Jiri Kosina Date: Wed Oct 5 16:54:45 2011 +0200 HID: consolidate MacbookAir 4,1 mappings commit da617c7cb915545dda4280df888dd6f8d5697420 upstream. MacbookAir 4,1 doesn't require extra mapping table, as the mappings are identical to apple_fn_keys[]. Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit 0cb53a56c2d80485fd53b030c349d35845bbbd63 Author: Andreas Krist Date: Fri Oct 28 18:50:39 2011 +0200 HID: hid-apple: add device ID of another wireless aluminium commit ad734bc1565364f9e4b70888d3ce5743b3c1030a upstream. I've recently bought a Apple wireless aluminum keyboard (model 2011) which is not yet supported by the kernel - it seems they just changed the device id. After applying the attached patch, the device is fully functional. Signed-off-by: Andreas Krist Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit dfd42513bbbbc815f8fb689fbd3d890ea49ea6d3 Author: Gökçen Eraslan Date: Sat Oct 22 22:39:06 2011 +0300 HID: Add device IDs for Macbook Pro 8 keyboards commit 213f9da80533940560bef8fa43b10c590895459c upstream. This patch adds keyboard support for Macbook Pro 8 models which has WELLSPRING5A model name and 0x0252, 0x0253 and 0x0254 USB IDs. Trackpad support for those models are added to bcm5974 in c331eb580a0a7906c0cdb8dbae3cfe99e3c0e555 ("Input: bcm5974 - Add support for newer MacBookPro8,2). Signed-off-by: Gökçen Eraslan Acked-by: Henrik Rydberg Signed-off-by: Jiri Kosina Cc: Chase Douglas Signed-off-by: Greg Kroah-Hartman commit a3a551581717d70236cdfe0c485629811b78b2a2 Author: Nobuhiro Iwamatsu Date: Sat Oct 1 15:54:53 2011 +0900 HID: Add support MacbookAir 4,1 keyboard commit d762cc290b9f17e346f4297fd5984b70ce71ef66 upstream. Added USB device IDs and keyboard map for MacBookAir 4,1 keyboard. Signed-off-by: Nobuhiro Iwamatsu Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit a75ed02e7e629e7bfd4b47d9c43d9efe35a9304f Author: Jiri Kosina Date: Wed Aug 10 14:12:52 2011 +0200 HID: add MacBookAir4,2 to hid_have_special_driver[] commit f6f554f09c5b831efdaf67c449e18ca06ee648fe upstream. Otherwise the generic driver wouldn't unbind from it and wouldn't let hid-apple to automatically take over. Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit 321d64bb3c3df7a283425895298154104532cefc Author: Jeff Brown Date: Mon Aug 15 21:12:09 2011 -0700 HID: hid-multitouch: Add LG Display Multitouch device. commit c50bb1a4005630f47b5da26336f74a485033a515 upstream. This panel is also known as the Dell ST2220Tc. Signed-off-by: jeffbrown@android.com Reviewed-By: Benjamin Tissoires Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit ad0eb51015fb012f01d5ebee23399e265da3cbce Author: Joshua V. Dillon Date: Fri Aug 5 12:05:22 2011 -0700 HID: add support for MacBookAir4,2 keyboard. commit 5d922baa631058c7e37ae33e81c4d3e6437f8d1d upstream. Added USB device IDs for MacBookAir4,2 keyboard. Device constants were copied from the MacBookAir3,2 constants. The 4,2 device specification is reportedly unchanged from the 3,2 predecessor and seems to work well. Signed-off-by: Joshua V Dillon Signed-off-by: Chase Douglas Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit ab2726208f3d735946908fe0145de7b6c2288fae Author: THOMSON, Adam (Adam) Date: Tue Jun 14 16:52:38 2011 +0200 mtd: nand_base: always initialise oob_poi before writing OOB data commit f722013ee9fd24623df31dec9a91a6d02c3e2f2f upstream. In nand_do_write_ops() code it is possible for a caller to provide ops.oobbuf populated and ops.mode == MTD_OOB_AUTO, which currently means that the chip->oob_poi buffer isn't initialised to all 0xFF. The nand_fill_oob() method then carries out the task of copying the provided OOB data to oob_poi, but with MTD_OOB_AUTO it skips areas marked as unavailable by the layout struct, including the bad block marker bytes. An example of this causing issues is when the last OOB data read was from the start of a bad block where the markers are not 0xFF, and the caller wishes to write new OOB data at the beginning of another block. In this scenario the caller would provide OOB data, but nand_fill_oob() would skip the bad block marker bytes in oob_poi before copying the OOB data provided by the caller. This means that when the OOB data is written back to NAND, the block is inadvertently marked as bad without the caller knowing. This has been witnessed when using YAFFS2 where tags are stored in the OOB. To avoid this oob_poi is always initialised to 0xFF to make sure no left over data is inadvertently written back to the OOB area. Credits to Brian Norris for fixing this patch. Signed-off-by: Adam Thomson Signed-off-by: Artem Bityutskiy Signed-off-by: Greg Kroah-Hartman commit 9851882600e7ad611093c661e785572bc8161493 Author: Dan Williams Date: Tue Nov 8 16:22:06 2011 +1100 md/raid5: STRIPE_ACTIVE has lock semantics, add barriers commit 257a4b42af7586fab4eaec7f04e6896b86551843 upstream. All updates that occur under STRIPE_ACTIVE should be globally visible when STRIPE_ACTIVE clears. test_and_set_bit() implies a barrier, but clear_bit() does not. This is suitable for 3.1-stable. Signed-off-by: Dan Williams Signed-off-by: NeilBrown Signed-off-by: Greg Kroah-Hartman commit 8bf61ab910e9de3cb55db58794ec07c737089b10 Author: NeilBrown Date: Tue Nov 8 16:22:01 2011 +1100 md/raid5: abort any pending parity operations when array fails. commit 9a3f530f39f4490eaa18b02719fb74ce5f4d2d86 upstream. When the number of failed devices exceeds the allowed number we must abort any active parity operations (checks or updates) as they are no longer meaningful, and can lead to a BUG_ON in handle_parity_checks6. This bug was introduce by commit 6c0069c0ae9659e3a91b68eaed06a5c6c37f45c8 in 2.6.29. Reported-by: Manish Katiyar Tested-by: Manish Katiyar Acked-by: Dan Williams Signed-off-by: NeilBrown Signed-off-by: Greg Kroah-Hartman commit e0171f6d9a9c9a2e398fb40345ffbe0b3181057f Author: Rajkumar Manoharan Date: Thu Oct 20 14:22:43 2011 +0530 ath9k_hw: Fix regression of register offset for AR9003 chips commit 52d6d4ef5e6d1517688e27c11c01ab303ec681dd upstream. My recent commits (3782c69d, 324c74a) introduced regression for register offset selection that based on the macversion. Not using parentheses in proper manner for ternary operator leads to select wrong offset for the registers. This issue was observed with AR9462 chip that immediate disconnect after the association with the following message ieee80211 phy3: wlan0: Failed to send nullfunc to AP 00:23:69:12:ea:47 after 500ms, disconnecting. Signed-off-by: Rajkumar Manoharan Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 45db66ee98f480c80fa7e2c87c8ec6252181b638 Author: Richard Cochran Date: Fri Oct 21 00:49:16 2011 +0000 dp83640: use proper function to free transmit time stamping packets commit f5ff7cd1a84caa9545d952a37ac872ccb73825fb upstream. The previous commit enforces a new rule for handling the cloned packets for transmit time stamping. These packets must not be freed using any other function than skb_complete_tx_timestamp. This commit fixes the one and only driver using this API. The driver first appeared in v3.0. Signed-off-by: Richard Cochran Acked-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 48384756ccd3b787829007c48a29b8fada46beb8 Author: Herbert Xu Date: Fri Aug 19 16:11:23 2011 +0800 crypto: cryptd - Use subsys_initcall to prevent races with aesni commit b2bac6acf86d05d8af0499f37d91ecac15722803 upstream. As cryptd is depeneded on by other algorithms such as aesni-intel, it needs to be registered before them. When everything is built as modules, this occurs naturally. However, for this to work when they are built-in, we need to use subsys_initcall in cryptd. Tested-by: Josh Boyer Signed-off-by: Herbert Xu Cc: Kerin Millar Signed-off-by: Greg Kroah-Hartman commit ca9b9d7bf6fc89a8a72c6aa37c683d02b7782b0b Author: Dan Carpenter Date: Wed Sep 21 20:55:04 2011 +0200 PM / Suspend: Off by one in pm_suspend() commit 528f7ce6e439edeac38f6b3f8561f1be129b5e91 upstream. In enter_state() we use "state" as an offset for the pm_states[] array. The pm_states[] array only has PM_SUSPEND_MAX elements so this test is off by one. Signed-off-by: Dan Carpenter Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman commit 4d25350da904f3e4d8f0da1e41a4d9807bb3525b Author: Daniel Mack Date: Tue Jun 7 03:01:07 2011 -0700 mtd: pxa3xx_nand: Fix blank page ECC mismatch commit 543e32d5ff165d0d68deedb0e3557478c7c36a4a upstream. This bug was introduced in f8155a40 ("mtd: pxa3xx_nand: rework irq logic") and causes the PXA3xx NAND controller fail to operate with NAND flash that has empty pages. According to the comment in this block, the hardware controller will report a double-bit error for empty pages, which can and must be ignored. This patch restores the original behaviour of the driver. Signed-off-by: Daniel Mack Acked-by: Lei Wen Cc: Haojian Zhuang Cc: David Woodhouse Signed-off-by: Artem Bityutskiy Signed-off-by: Greg Kroah-Hartman commit 33e73819e7e48d76d40e292be8d4213684a3369f Author: Lei Wen Date: Tue Jun 7 03:01:06 2011 -0700 mtd: pxa3xx_nand: fix nand detection issue commit 0fab028b77d714ad302404b23306cf7adb885223 upstream. When keep_config is set, the detection would goes different routine. That the driver would read out the setting which is set previously by bootloader. While most bootloader keep the irq mask as off, and current driver need all irq default open, keep_config behavior would lead to no irq at all. Signed-off-by: Lei Wen Tested-by: Daniel Mack Signed-off-by: Artem Bityutskiy Signed-off-by: Greg Kroah-Hartman commit 4ac405dc9ea822fc96debff9b97e001029a9a465 Author: Andres Salomon Date: Fri Oct 14 07:33:20 2011 -0700 mtd: provide an alias for the redboot module name commit d5de1907d0af22e1a02de2b16a624148517a39c2 upstream. parse_mtd_partitions takes a list of partition types; if the driver isn't loaded, it attempts to load it, and then it grabs the partition parser. For redboot, the module name is "redboot.ko", while the parser name is "RedBoot". Since modprobe is case-sensitive, attempting to modprobe "RedBoot" will never work. I suspect the embedded systems that make use of redboot just always manually loaded redboot prior to loading their specific nand chip drivers (or statically compiled it in). Signed-off-by: Andres Salomon Signed-off-by: Artem Bityutskiy Signed-off-by: Greg Kroah-Hartman commit ae3cf122cbdea40704270c88a5dbd2ab053402ee Author: Peter Wippich Date: Mon Jun 6 15:50:58 2011 +0200 mtd: mtdchar: add missing initializer on raw write commit bf5140817b2d65faac9b32fc9057a097044ac35b upstream. On writes in MODE_RAW the mtd_oob_ops struct is not sufficiently initialized which may cause nandwrite to fail. With this patch it is possible to write raw nand/oob data without additional ECC (either for testing or when some sectors need different oob layout e.g. bootloader) like nandwrite -n -r -o /dev/mtd0 Signed-off-by: Peter Wippich Tested-by: Ricard Wanderlof Signed-off-by: Artem Bityutskiy Signed-off-by: Greg Kroah-Hartman commit ed89d010e4d505f4dc1afa77c45d65f1980e46da Author: Johannes Berg Date: Fri Oct 28 11:59:47 2011 +0200 mac80211: disable powersave for broken APs commit 05cb91085760ca378f28fc274fbf77fc4fd9886c upstream. Only AID values 1-2007 are valid, but some APs have been found to send random bogus values, in the reported case an AP that was sending the AID field value 0xffff, an AID of 0x3fff (16383). There isn't much we can do but disable powersave since there's no way it can work properly in this case. Reported-by: Bill C Riemers Signed-off-by: Johannes Berg Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit a7870d687773d35a18bc5af7fc7a81963fe2fa02 Author: Eliad Peller Date: Thu Oct 20 19:05:50 2011 +0200 mac80211: config hw when going back on-channel commit 6911bf0453e0d6ea8eb694a4ce67a68d071c538e upstream. When going back on-channel, we should reconfigure the hw iff the hardware is not already configured to the operational channel. Signed-off-by: Eliad Peller Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 0ecc0ae0b8a9d86cd1adc68506c5d4bd77d740cc Author: Eliad Peller Date: Thu Oct 20 19:05:49 2011 +0200 mac80211: fix remain_off_channel regression commit eaa7af2ae582c9a8c51b374c48d5970b748a5ce2 upstream. The offchannel code is currently broken - we should remain_off_channel if the work was started, and the work's channel and channel_type are the same as local->tmp_channel and local->tmp_channel_type. However, if wk->chan_type and local->tmp_channel_type coexist (e.g. have the same channel type), we won't remain_off_channel. This behavior was introduced by commit da2fd1f ("mac80211: Allow work items to use existing channel type.") Tested-by: Ben Greear Signed-off-by: Eliad Peller Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit ab4ff307d18f5aa924c31e8b99bec3d8c560464e Author: Rajkumar Manoharan Date: Mon Oct 24 18:13:40 2011 +0530 ath9k_hw: Update AR9485 initvals to fix system hang issue commit 98fb2cc115b4ef1ea0a2d87a170c183bd395dd6c upstream. This patch fixes system hang when resuming from S3 state and lower rate sens failure issue. Signed-off-by: Rajkumar Manoharan Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 61ec3a5696f0c32448c93b713f934b007b85f961 Author: Johannes Berg Date: Thu Nov 3 00:07:32 2011 +0000 netlink: validate NLA_MSECS length commit c30bc94758ae2a38a5eb31767c1985c0aae0950b upstream. L2TP for example uses NLA_MSECS like this: policy: [L2TP_ATTR_RECV_TIMEOUT] = { .type = NLA_MSECS, }, code: if (info->attrs[L2TP_ATTR_RECV_TIMEOUT]) cfg.reorder_timeout = nla_get_msecs(info->attrs[L2TP_ATTR_RECV_TIMEOUT]); As nla_get_msecs() is essentially nla_get_u64() plus the conversion to a HZ-based value, this will not properly reject attributes from userspace that aren't long enough and might overrun the message. Add NLA_MSECS to the attribute minlen array to check the size properly. Cc: Thomas Graf Signed-off-by: Johannes Berg Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 0fb9f687964a4b4a557b4f2e8676e1236a9e269b Author: Bart Van Assche Date: Wed Nov 2 20:16:05 2011 +0100 ACPI: Fix CONFIG_ACPI_DOCK=n compiler warning commit c1056b42a87b59375f8f81a92ef029165f44fcce upstream. Recently the ACPI ops structs were constified but the inline version of register_hotplug_dock_device() was overlooked (see also commit 9c8b04b, June 25 2011). Update the inline function register_hotplug_dock_device() that is enabled with CONFIG_ACPI_DOCK=n too. This patch fixes at least the following compiler warnings: drivers/ata/libata-acpi.c: In function .ata_acpi_associate.: drivers/ata/libata-acpi.c:266:11: warning: passing argument 2 of .register_hotplug_dock_device. discards qualifiers from pointer target type include/acpi/acpi_drivers.h:146:19: note: expected .struct acpi_dock_ops *. but argument is of type .const struct acpi_dock_ops *. drivers/ata/libata-acpi.c:275:11: warning: passing argument 2 of .register_hotplug_dock_device. discards qualifiers from pointer target type include/acpi/acpi_drivers.h:146:19: note: expected .struct acpi_dock_ops *. but argument is of type .const struct acpi_dock_ops *. Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman commit 97a83dd85386b78ca2e6e14442fece6a45eabdd2 Author: Luck, Tony Date: Fri Oct 21 14:42:55 2011 -0700 ACPI atomicio: Convert width in bits to bytes in __acpi_ioremap_fast() commit 3bf3f8b19d2bfccc40f13c456bf339fd8f535ebc upstream. Callers to __acpi_ioremap_fast() pass the bit_width that they found in the acpi_generic_address structure. Convert from bits to bytes when passing to __acpi_find_iomap() - as it wants to see bytes, not bits. Signed-off-by: Tony Luck Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman commit 3493ce844f598f2b732a7e831afb6b1d5be4296f Author: Anton Blanchard Date: Wed Sep 14 09:43:15 2011 +0000 powerpc: Fix deadlock in icswx code commit 8bdafa39a47265bc029838b35cc6585f69224afa upstream. The icswx code introduced an A-B B-A deadlock: CPU0 CPU1 ---- ---- lock(&anon_vma->mutex); lock(&mm->mmap_sem); lock(&anon_vma->mutex); lock(&mm->mmap_sem); Instead of using the mmap_sem to keep mm_users constant, take the page table spinlock. Signed-off-by: Anton Blanchard Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit 85e71ae3431f786adea84c0f879dc02d7474c566 Author: Thadeu Lima de Souza Cascardo Date: Fri Aug 26 10:36:31 2011 +0000 powerpc/eeh: Fix /proc/ppc64/eeh creation commit 8feaa43494cee5e938fd5a57b9e9bf1c827e6ccd upstream. Since commit 188917e183cf9ad0374b571006d0fc6d48a7f447, /proc/ppc64 is a symlink to /proc/powerpc/. That means that creating /proc/ppc64/eeh will end up with a unaccessible file, that is not listed under /proc/powerpc/ and, then, not listed under /proc/ppc64/. Creating /proc/powerpc/eeh fixes that problem and maintain the compatibility intended with the ppc64 symlink. Signed-off-by: Thadeu Lima de Souza Cascardo Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit 488d4d2d0a7078b89ac898606cfce65ea93aadd2 Author: Anton Blanchard Date: Sun Aug 14 14:30:30 2011 +0000 powerpc/pseries: Avoid spurious error during hotplug CPU add commit 9c740025c51a26ab00192cfc464064d4ccbfe3fc upstream. During hotplug CPU add we get the following error: Unexpected Error (0) returned from configure-connector ibm,configure-connector returns 0 for configuration complete, so catch this and avoid the error. Signed-off-by: Anton Blanchard Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit 7bd46f22875431f4ec2a21cefd1aecf80193b6d7 Author: Anton Blanchard Date: Wed Aug 10 20:44:24 2011 +0000 powerpc: Fix oops when echoing bad values to /sys/devices/system/memory/probe commit a11940978bd598e65996b4f807cf4904793f7025 upstream. If we echo an address the hypervisor doesn't like to /sys/devices/system/memory/probe we oops the box: # echo 0x10000000000 > /sys/devices/system/memory/probe kernel BUG at arch/powerpc/mm/hash_utils_64.c:541! The backtrace is: create_section_mapping arch_add_memory add_memory memory_probe_store sysdev_class_store sysfs_write_file vfs_write SyS_write In create_section_mapping we BUG if htab_bolt_mapping returned an error. A better approach is to return an error which will propagate back to userspace. Rerunning the test with this patch applied: # echo 0x10000000000 > /sys/devices/system/memory/probe -bash: echo: write error: Invalid argument Signed-off-by: Anton Blanchard Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit 9d99c1d2bd6aedb02a70d2cb9f1edb0b416a443e Author: Anton Blanchard Date: Wed Aug 10 20:44:21 2011 +0000 powerpc/numa: Remove double of_node_put in hot_add_node_scn_to_nid commit 6083184269fd723affca4f6340e491950267622a upstream. During memory hotplug testing, I got the following warning: ERROR: Bad of_node_put() on /memory@0 of_node_release kref_put of_node_put of_find_node_by_type hot_add_node_scn_to_nid hot_add_scn_to_nid memory_add_physaddr_to_nid ... of_find_node_by_type() loop does the of_node_put for us so we only need the handle the case where we terminate the loop early. As suggested by Stephen Rothwell we can do the of_node_put unconditionally outside of the loop since of_node_put handles a NULL argument fine. Signed-off-by: Anton Blanchard Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit 8981e86717bf2d682bf08db846d7daafd9fb6a45 Author: Joern Engel Date: Wed Oct 26 13:37:56 2011 -0700 target: Fix wrong se_tmr being added to drain_tmr_list commit 6eb40b2af4908e9aee71e43e7a384243128c56dd upstream. This patch fixes another bug from LUN_RESET re-org fallout in core_tmr_drain_tmr_list() that was adding the wrong se_tmr_req into the local drain_tmr_list to be walked + released. Signed-off-by: Joern Engel Cc: Joern Engel Reviewed-by: Roland Dreier Cc: Roland Dreier Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman commit a1dc5b0de6f3083000c3b990dc319dd842ad7420 Author: Joern Engel Date: Tue Oct 25 22:08:43 2011 -0700 target: Fix incorrect se_cmd assignment in core_tmr_drain_tmr_list commit 80ccbc8e00f7001d79dd503c2781487906b98611 upstream. This patch fixes a bug in core_tmr_drain_tmr_list() where drain_tmr_list was using the wrong se_tmr_req for cmd assignment due to a typo during the LUN_RESET re-org. This was resulting in general protection faults while using the leftover bogus *tmr_p pointer from list_for_each_entry_safe(). Signed-off-by: Joern Engel Cc: Joern Engel Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman commit edfaaac6ea69b97b993d7a88f027b3d0f8cc2c63 Author: Al Viro Date: Mon Nov 7 21:21:26 2011 +0000 VFS: we need to set LOOKUP_JUMPED on mountpoint crossing commit a3fbbde70a0cec017f2431e8f8de208708c76acc upstream. Mountpoint crossing is similar to following procfs symlinks - we do not get ->d_revalidate() called for dentry we have arrived at, with unpleasant consequences for NFS4. Simple way to reproduce the problem in mainline: cat >/tmp/a.c <<'EOF' #include #include #include main() { struct flock fl = {.l_type = F_RDLCK, .l_whence = SEEK_SET, .l_len = 1}; if (fcntl(0, F_SETLK, &fl)) perror("setlk"); } EOF cc /tmp/a.c -o /tmp/test then on nfs4: mount --bind file1 file2 /tmp/test < file1 # ok /tmp/test < file2 # spews "setlk: No locks available"... What happens is the missing call of ->d_revalidate() after mountpoint crossing and that's where NFS4 would issue OPEN request to server. The fix is simple - treat mountpoint crossing the same way we deal with following procfs-style symlinks. I.e. set LOOKUP_JUMPED... Signed-off-by: Al Viro Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit e94d1d00463f6fdcef956828ff698a2bce3f7a8f Author: Jeff Moyer Date: Mon Oct 17 12:57:23 2011 +0200 blk-flush: move the queue kick into commit e67b77c791ca2778198c9e7088f3266ed2da7a55 upstream. A dm-multipath user reported[1] a problem when trying to boot a kernel with commit 4853abaae7e4a2af938115ce9071ef8684fb7af4 (block: fix flush machinery for stacking drivers with differring flush flags) applied. It turns out that an empty flush request can be sent into blk_insert_flush. When the BUG_ON was fixed to allow for this, I/O on the underlying device would stall. The reason is that blk_insert_cloned_request does not kick the queue. In the aforementioned commit, I had added a special case to kick the queue if data was sent down but the queue flags did not require a flush. A better solution is to push the queue kick up into blk_insert_cloned_request. This patch, along with a follow-on which fixes the BUG_ON, fixes the issue reported. [1] http://www.redhat.com/archives/dm-devel/2011-September/msg00154.html Reported-by: Christophe Saout Signed-off-by: Jeff Moyer Acked-by: Tejun Heo Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman commit d16a63a89dcb0cece02469b3bb17062c3d48656f Author: Jeff Moyer Date: Mon Oct 17 12:57:22 2011 +0200 blk-flush: fix invalid BUG_ON in blk_insert_flush commit 834f9f61a525d2f6d3d0c93894e26326c8d3ceed upstream. A user reported a regression due to commit 4853abaae7e4a2af938115ce9071ef8684fb7af4 (block: fix flush machinery for stacking drivers with differring flush flags). Part of the problem is that blk_insert_flush required a single bio be attached to the request. In reality, having no attached bio is also a valid case, as can be observed with an empty flush. [1] http://www.redhat.com/archives/dm-devel/2011-September/msg00154.html Reported-by: Christophe Saout Signed-off-by: Jeff Moyer Acked-by: Tejun Heo Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman commit e0aef70cc677fdfaa195b04eea389a9b9b40eeaa Author: Mike Miller Date: Fri Oct 21 08:19:43 2011 +0200 hpsa: add small delay when using PCI Power Management to reset for kump commit c4853efec665134b2e6fc9c13447323240980351 upstream. The P600 requires a small delay when changing states. Otherwise we may think the board did not reset and we bail. This for kdump only and is particular to the P600. Signed-off-by: Mike Miller Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman commit 5a1c73b64b44e2c3dc30f69b2eea9ee1a8035905 Author: Dan McGee Date: Tue Nov 1 18:23:10 2011 -0500 VFS: fix statfs() automounter semantics regression commit 5c8a0fbba543d9428a486f0d1282bbcf3cf1d95a upstream. No one in their right mind would expect statfs() to not work on a automounter managed mount point. Fix it. [ I'm not sure about the "no one in their right mind" part. It's not mounted, and you didn't ask for it to be mounted. But nobody will really care, and this probably makes it match previous semantics, so.. - Linus ] This mirrors the fix made to the quota code in 815d405ceff0d69646. Signed-off-by: Dan McGee Cc: Trond Myklebust Cc: Alexander Viro Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 690a2c64c5b550763debf1111720f923e6a42d63 Author: Konrad Rzeszutek Wilk Date: Mon Oct 10 12:33:21 2011 -0400 xen/blkback: Report VBD_WSECT (wr_sect) properly. commit 5c62cb48602dba95159c81ffeca179d3852e25be upstream. We did not increment the amount of sectors written to disk b/c we tested for the == WRITE which is incorrect - as the operations are more of WRITE_FLUSH, WRITE_ODIRECT. This patch fixes it by doing a & WRITE check. Reported-by: Andy Burns Suggested-by: Ian Campbell Signed-off-by: Konrad Rzeszutek Wilk Signed-off-by: Greg Kroah-Hartman commit 6022736e9bb4ff26f0e5556814aa43c4057e7e86 Author: Tejun Heo Date: Mon Oct 17 13:42:43 2011 +0200 block: make gendisk hold a reference to its queue commit f992ae801a7dec34a4ed99a6598bbbbfb82af4fb upstream. The following command sequence triggers an oops. # mount /dev/sdb1 /mnt # echo 1 > /sys/class/scsi_device/0\:0\:1\:0/device/delete # umount /mnt general protection fault: 0000 [#1] PREEMPT SMP CPU 2 Modules linked in: Pid: 791, comm: umount Not tainted 3.1.0-rc3-work+ #8 Bochs Bochs RIP: 0010:[] [] __lock_acquire+0x389/0x1d60 ... Call Trace: [] lock_acquire+0x95/0x140 [] _raw_spin_lock+0x3b/0x50 [] bdi_lock_two+0x5c/0x70 [] bdev_inode_switch_bdi+0x4c/0xf0 [] __blkdev_put+0x11b/0x1d0 [] __blkdev_put+0x160/0x1d0 [] blkdev_put+0x5f/0x190 [] kill_block_super+0x4d/0x80 [] deactivate_locked_super+0x45/0x70 [] deactivate_super+0x4a/0x70 [] mntput_no_expire+0xed/0x130 [] sys_umount+0x7e/0x3a0 [] system_call_fastpath+0x16/0x1b This is because bdev holds on to disk but disk doesn't pin the associated queue. If a SCSI device is removed while the device is still open, the sdev puts the base reference to the queue on release. When the bdev is finally released, the associated queue is already gone along with the bdi and bdev_inode_switch_bdi() ends up dereferencing already freed bdi. Even if it were not for this bug, disk not holding onto the associated queue is very unusual and error-prone. Fix it by making add_disk() take an extra reference to its queue and put it on disk_release() and ensuring that disk and its fops owner are put in that order after all accesses to the disk and queue are complete. Signed-off-by: Tejun Heo Cc: Jens Axboe Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman commit 819bac2f91d8ae8433bd5beb85797bb0c63cbaa2 Author: NeilBrown Date: Tue Oct 25 10:25:49 2011 +1100 NFS/sunrpc: don't use a credential with extra groups. commit dc6f55e9f8dac4b6479be67c5c9128ad37bb491f upstream. The sunrpc layer keeps a cache of recently used credentials and 'unx_match' is used to find the credential which matches the current process. However unx_match allows a match when the cached credential has extra groups at the end of uc_gids list which are not in the process group list. So if a process with a list of (say) 4 group accesses a file and gains access because of the last group in the list, then another process with the same uid and gid, and a gid list being the first tree of the gids of the original process tries to access the file, it will be granted access even though it shouldn't as the wrong rpc credential will be used. Signed-off-by: NeilBrown Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 3911ea7beedc6fbcce9235bda520749a6dfd4c57 Author: Mark Brown Date: Tue Nov 1 13:53:54 2011 +0000 ASoC: Ensure we always delay for WM8962 FLL when starting from SYSCLK commit 0b7dd6ad92b6cace35dc5d06d6e236c2751c85dc upstream. Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 5b8cf7c773f0b2a48e7d546acd5edf054e51d286 Author: Mark Brown Date: Tue Nov 1 13:53:37 2011 +0000 ASoC: Ensure the WM8962 oscillator and PLLs start up disabled commit 2af8de8c39cf58e5a5e40a9d5d71332da98e6ba7 upstream. Since there is no current software control for these they would otherwise be left enabled, consuming power. Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 90ec08224834dc4db2fadbadf03e1502dfdf2575 Author: Mark Brown Date: Tue Nov 1 13:36:10 2011 +0000 ASoC: Ensure WM8962 PLL registers are reset commit 4f4488abc97c1c27ff029f887944e6a6da1f5733 upstream. The WM8962 has a separate software reset for the PLL registers. Ensure that these are reset also on startup. Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit df4c76cf735efca988dda57d003cfcc024e6b673 Author: Hong Xu Date: Fri Oct 28 15:36:39 2011 +0800 ASoC: WM8904: Set `invert' bit for Capture Switch commit 5a7c5f26df3c0122814dfa1c13ef6dfbdbffdb86 upstream. Set `invert' bit for Capture Switch. Otherwise analogue is muted when Capture Switch is ON. Signed-off-by: Hong Xu Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit e93919557cdb979cfc7ab232be705876cbcfa015 Author: Axel Lin Date: Fri Oct 28 15:17:56 2011 +0800 ASoC: Leave input audio data bit length settings untouched in wm8711_set_dai_fmt commit d558cfc30064a97c2c65dbd2b3a4f5a1dea7ec1b upstream. Current implementation in wm8711_set_dai_fmt always clear BIT[3:2] (the Input Audio Data Bit Length Select) of WM8711_IFACE(07h) register. Input Audio Data Bit Length Select bits are set by wm8711_hw_params, we should leave BIT[3:2] untouched in wm8711_set_dai_fmt. Signed-off-by: Axel Lin Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 55c618c61940db0845744db9acce6319f0783252 Author: Axel Lin Date: Fri Oct 28 11:08:01 2011 +0800 ASoC: wm8711: Fix wrong mask for setting input audio data bit length select commit 04c57163c8edfbc50e022737014069998ba4fc5f upstream. The Input Audio Data Bit Length Select is controlled by BIT[3:2] of WM8711_IFACE(07h) register. Current code incorrectly masks BIT[1:0] which is for Audio Data Format Select. Signed-off-by: Axel Lin Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 218782d30177214893625e8d6523191caa5e023b Author: nagalakshmi.nandigama@lsi.com Date: Fri Oct 21 10:06:33 2011 +0530 mpt2sas: Fix for system hang when discovery in progress commit 0167ac67ff6f35bf2364f7672c8012b0cd40277f upstream. Fix for issue : While discovery is in progress, hot unplug and hot plug of enclosure connected to the controller card is causing system to hang. When a device is in the process of being detected at driver load time then if it is removed, the device that is no longer present will not be added to the list. So the code in _scsih_probe_sas() is rearranged as such so the devices that failed to be detected are not added to the list. Signed-off-by: Nagalakshmi Nandigama Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit c0224b906310fc773affedc88056e8d873617248 Author: Anton Blanchard Date: Thu Nov 3 08:56:22 2011 +1100 Fix block queue and elevator memory leak in scsi_alloc_sdev commit f7c9c6bb14f3104608a3a83cadea10a6943d2804 upstream. When looking at memory consumption issues I noticed quite a lot of memory in the kmalloc-2048 bucket: OBJS ACTIVE USE OBJ SIZE SLABS OBJ/SLAB CACHE SIZE NAME 6561 6471 98% 2.30K 243 27 15552K kmalloc-2048 Over 15MB. slub debug shows that cfq is responsible for almost all of it: # sort -nr /sys/kernel/slab/kmalloc-2048/alloc_calls 6402 .cfq_init_queue+0xec/0x460 age=43423/43564/43655 pid=1 cpus=4,11,13 In scsi_alloc_sdev we do scsi_alloc_queue but if slave_alloc fails we don't free it with scsi_free_queue. The patch below fixes the issue: OBJS ACTIVE USE OBJ SIZE SLABS OBJ/SLAB CACHE SIZE NAME 135 72 53% 2.30K 5 27 320K kmalloc-2048 # cat /sys/kernel/slab/kmalloc-2048/alloc_calls 3 .cfq_init_queue+0xec/0x460 age=3811/3876/3925 pid=1 cpus=4,11,13 Signed-off-by: Anton Blanchard Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit a3576ddc753b2d9704a9e9b668becdee4c166c88 Author: Bart Van Assche Date: Fri Sep 23 19:48:18 2011 +0200 Make scsi_free_queue() kill pending SCSI commands commit 3308511c93e6ad0d3c58984ecd6e5e57f96b12c8 upstream. Make sure that SCSI device removal via scsi_remove_host() does finish all pending SCSI commands. Currently that's not the case and hence removal of a SCSI host during I/O can cause a deadlock. See also "blkdev_issue_discard() hangs forever if underlying storage device is removed" (http://bugzilla.kernel.org/show_bug.cgi?id=40472). See also http://lkml.org/lkml/2011/8/27/6. Signed-off-by: Bart Van Assche Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 2ac819e95c1cf0455ba22a8a295f0998df9e33c2 Author: Moger, Babu Date: Wed Oct 26 14:29:38 2011 -0400 scsi_dh: check queuedata pointer before proceeding further commit a18a920c70d48a8e4a2b750d8a183b3c1a4be514 upstream. This patch validates sdev pointer in scsi_dh_activate before proceeding further. Without this check we might see the panic as below. I have seen this panic multiple times.. Call trace: #0 [ffff88007d647b50] machine_kexec at ffffffff81020902 #1 [ffff88007d647ba0] crash_kexec at ffffffff810875b0 #2 [ffff88007d647c70] oops_end at ffffffff8139c650 #3 [ffff88007d647c90] __bad_area_nosemaphore at ffffffff8102dd15 #4 [ffff88007d647d50] page_fault at ffffffff8139b8cf [exception RIP: scsi_dh_activate+0x82] RIP: ffffffffa0041922 RSP: ffff88007d647e00 RFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000000093c5 RDX: 00000000000093c5 RSI: ffffffffa02e6640 RDI: ffff88007cc88988 RBP: 000000000000000f R8: ffff88007d646000 R9: 0000000000000000 R10: ffff880082293790 R11: 00000000ffffffff R12: ffff88007cc88988 R13: 0000000000000000 R14: 0000000000000286 R15: ffff880037b845e0 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0000 #5 [ffff88007d647e38] run_workqueue at ffffffff81060268 #6 [ffff88007d647e78] worker_thread at ffffffff81060386 #7 [ffff88007d647ee8] kthread at ffffffff81064436 #8 [ffff88007d647f48] kernel_thread at ffffffff81003fba Signed-off-by: Babu Moger Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 2753feb58ab8704715aace3ad49ec545ffa8b8a4 Author: Petr Uzel Date: Fri Oct 21 13:31:09 2011 +0200 st: fix race in st_scsi_execute_end commit c68bf8eeaa57c852e74adcf597237be149eef830 upstream. The call to complete() in st_scsi_execute_end() wakes up sleeping thread in write_behind_check(), which frees the st_request, thus invalidating the pointer to the associated bio structure, which is then passed to the blk_rq_unmap_user(). Fix by storing pointer to bio structure into temporary local variable. This bug is present since at least linux-2.6.32. Signed-off-by: Petr Uzel Reported-by: Juergen Groß Reviewed-by: Jan Kara Acked-by: Kai Mäkisara Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 622dadf0a4cb5bcf648363121733031b2b2eb93a Author: Nicholas Bellinger Date: Fri Oct 28 13:37:19 2011 -0700 iscsi-target: Fix non-immediate TMR handling commit 5a4c8666c6d576f076a7c6824589cdbb984c0f84 upstream. This patch addresses two issues with non immediate TMR handling in iscsit_handle_task_mgt_cmd(). The first involves breakage due to v3.1-rc conversion of iscsit_sequence_cmd(), which upon good status would hit the iscsit_add_reject_from_cmd() block of code. This patch adds an explict check for CMDSN_ERROR_CANNOT_RECOVER. The second adds a check to return when non immediate TMR operation is detected after iscsit_ack_from_expstatsn(), as iscsit_sequence_cmd() -> iscsit_execute_cmd() will have called transport_generic_handle_tmr() for the non immediate TMR case already. Cc: Andy Grover Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman commit ebe1d9e9db0783fc3c74f239db7833dff28d1218 Author: Nicholas Bellinger Date: Fri Oct 28 13:32:35 2011 -0700 iscsi-target: Add missing CMDSN_LOWER_THAN_EXP check in iscsit_handle_scsi_cmd commit 7e32da55e26b80d57961681e53aa67938268db3f upstream. This patch adds a missing CMDSN_LOWER_THAN_EXP return check for iscsit_sequence_cmd() in iscsit_handle_scsi_cmd() that was incorrectly dropped during the v3.1-rc cleanups to use iscsit_sequence_cmd(). Cc: Andy Grover Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman commit eb19a9536584a60abf2b50fde2895f3559bfce75 Author: Nicholas Bellinger Date: Mon Oct 24 13:35:37 2011 -0700 tcm_loop: Add explict read buffer memset for SCF_SCSI_CONTROL_SG_IO_CDB commit 8cd79f24350826b81e16990d9e12bc878e67d385 upstream. This patch addresses an issue with buggy userspace code sending I/O via scsi-generic that does not explictly clear their associated read buffers. It adds an explict memset of the first SGL entry within tcm_loop_new_cmd_map() for SCF_SCSI_CONTROL_SG_IO_CDB payloads that are currently guaranteed to be a single SGL by target-core code. This issue is a side effect of the v3.1-rc1 merge to remove the extra memcpy between certain control CDB types using a contigious + cleared buffer in target-core, and performing a memcpy into the SGL list within tcm_loop. It was originally mainfesting itself by udev + scsi_id + scsi-generic not properly setting up the expected /dev/disk/by-id/ symlinks because the INQUIRY payload was containing extra bogus data preventing the proper NAA IEEE WWN from being parsed by userspace. Cc: Christoph Hellwig Cc: Andy Grover Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman commit d7ded4428c788fb09e5587afa4a5d244e0be33b8 Author: Guenter Roeck Date: Sun Nov 6 20:25:18 2011 +0100 hwmon: (w83627ehf) Fix broken driver init commit bfa02b0da66965caf46e441270af87edda4fea14 upstream. Commit 2265cef2 (hwmon: (w83627ehf) Properly report PECI and AMD-SI sensor types) results in kernel panic if data->temp_label was not initialized. The problem was found with chip W83627DHG-P. Add check if data->temp->label was set before use. Based on incomplete patch by Alexander Beregalov. Reported-by: Alexander Beregalov Tested-by: Alexander Beregalov Signed-off-by: Guenter Roeck Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit 27393d86d5d7b7b4abd0b340ed8b1691e13b2461 Author: Jean Delvare Date: Fri Nov 4 12:00:47 2011 +0100 hwmon: (w83627ehf) Properly report PECI and AMD-SI sensor types commit 2265cef2751b3441df91f85e0107f9f549e5b711 upstream. When temperature sources are PECI or AMD-SI agents, it makes no sense to report their type as diode or thermistor. Instead we must report their digital nature. Signed-off-by: Jean Delvare Acked-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit e4b63698cd98b7726ba097ef058af8e481bd8556 Author: Jean Delvare Date: Sun Nov 6 20:25:18 2011 +0100 hwmon: (coretemp) Fix for non-SMP builds commit 2aba6cac2a84f3b80e11a680c34d55e7739b474d upstream. The definition of TO_ATTR_NO in the non-SMP case is wrong. As the SMP definition resolves to the correct value, just use this for both cases. Without this fix the temperature attributes are named temp0_* instead of temp2_*, so libsensors won't pick them. Broken since kernel 3.0. Signed-off-by: Jean Delvare Tested-by: Phil Sutter Acked-by: Durgadoss R Acked-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman commit b9b6bdf987c633aad39d5ce70835679014a5b27d Author: Mike Miller Date: Thu Oct 20 22:19:17 2011 +0200 cciss: add small delay when using PCI Power Management to reset for kump commit ab5dbebe33e0c353e8545f09c34553ac3351dad6 upstream. The P600 requires a small delay when changing states. Otherwise we may think the board did not reset and we bail. This for kdump only and is particular to the P600. Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman commit 54974aaab296975b7dd3512686d38ec658048b04 Author: Alan Stern Date: Fri Nov 4 00:52:46 2011 +0100 USB: Update last_busy time after autosuspend fails commit b2c0a863e14676fa5760c6d828fd373288e2f64a upstream. Originally, the runtime PM core would send an idle notification whenever a suspend attempt failed. The idle callback routine could then schedule a delayed suspend for some time later. However this behavior was changed by commit f71648d73c1650b8b4aceb3856bebbde6daa3b86 (PM / Runtime: Remove idle notification after failing suspend). No notifications were sent, and there was no clear mechanism to retry failed suspends. This caused problems for the usbhid driver, because it fails autosuspend attempts as long as a key is being held down. A companion patch changes the PM core's behavior, but we also need to change the USB core. In particular, this patch (as1493) updates the device's last_busy time when an autosuspend fails, so that the PM core will retry the autosuspend in the future when the delay time expires again. Signed-off-by: Alan Stern Tested-by: Henrik Rydberg Acked-by: Greg Kroah-Hartman Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman commit da5c50811e8e2342fd83c3d9fbd6609175fa2cf5 Author: Alan Stern Date: Thu Nov 3 23:39:18 2011 +0100 PM / Runtime: Automatically retry failed autosuspends commit 886486b792e4f6f96d4fbe8ec5bf20811cab7d6a upstream. Originally, the runtime PM core would send an idle notification whenever a suspend attempt failed. The idle callback routine could then schedule a delayed suspend for some time later. However this behavior was changed by commit f71648d73c1650b8b4aceb3856bebbde6daa3b86 (PM / Runtime: Remove idle notification after failing suspend). No notifications were sent, and there was no clear mechanism to retry failed suspends. This caused problems for the usbhid driver, because it fails autosuspend attempts as long as a key is being held down. Therefore this patch (as1492) adds a mechanism for retrying failed autosuspends. If the callback routine updates the last_busy field so that the next autosuspend expiration time is in the future, the autosuspend will automatically be rescheduled. Signed-off-by: Alan Stern Tested-by: Henrik Rydberg Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman commit f571b637c81f3cbac21c93c2f0e283965235b152 Author: Srinivas Kandagatla Date: Tue Aug 2 18:49:52 2011 +0100 kbuild: Fix help text not displayed in choice option. commit 3f198dfee49d2e9c30583c62b0c79286c78c7b44 upstream. Help text under choice menu is never displayed because it does not have symbol name associated with it, however many kconfigs have help text under choice, assuming that it will be displayed when user selects help. for example in Kconfig if we have: choice prompt "Choice" ---help--- HELP TEXT ... config A bool "A" config B bool "B" endchoice Without this patch "HELP TEXT" is not displayed when user selects help option when "Choice" is highlighted from menuconfig or xconfig or gconfig. This patch changes the logic in menu_get_ext_help to display help for cases which dont have symbol names like choice. Signed-off-by: Srinivas Kandagatla Reviewed-by: Stuart Menefy Reviewed-by: Arnaud Lacombe Signed-off-by: Michal Marek Signed-off-by: Greg Kroah-Hartman commit 29ac4c3a5cc34c3fa5a44cdba3be3fd606cac748 Author: Alex Deucher Date: Thu Nov 3 11:21:39 2011 -0400 drm/radeon/kms: set HPD polarity in hpd_init() commit 64912e997f0fe13512e4c7b90e4f7c11cb922ab5 upstream. Polarity needs to be set accordingly to connector status (connected or disconnected). Set it up in hpd_init() so first hotplug works reliably no matter what is the initial set of connector. hpd_init() also covers resume so HPD will work correctly after resume as well. Signed-off-by: Alex Deucher Cc: Jerome Glisse Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 55fe133c7286a789ad5eb3f1afca27c2348fddd5 Author: Alex Deucher Date: Tue Nov 1 14:20:30 2011 -0400 drm/radeon/kms: add MSI module parameter commit a18cee15ed4c8b6a35f96b7b26a46bac32e04bd9 upstream. Allow the user to override whether MSIs are enabled or not on supported ASICs. MSIs are disabled by default on IGP chips as they tend not to work. However certain IGP chips only seem to work with MSIs enabled. I suspect this is a chipset or bios issue, but I'm not sure what the proper fix is. This will at least make diagnosing and working around the problem much easier. See: https://bugs.freedesktop.org/show_bug.cgi?id=37679 Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit d75d680945bd3624f4c1958e0a5d8216983d30b6 Author: Alex Deucher Date: Tue Nov 1 14:14:18 2011 -0400 drm/radeon/kms: Add MSI quirk for Dell RS690 commit 01e718ec194e30b3e8eb3858c742c13649757efc upstream. Some Dell laptops only seem to work with MSIs. This looks like a platform/bios bug. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=37679 Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 74fce3bc7bc4428d3bdffd93385ca382a7057683 Author: Alex Deucher Date: Mon Oct 31 08:54:41 2011 -0400 drm/radeon/kms: properly set panel mode for eDP commit 00dfb8df5bf8c3afe4c0bb8361133156b06b7a2c upstream. This should make eDP more reliable. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 6af5ee884ffb226251e019b582697ff1b5814f40 Author: Jerome Glisse Date: Fri Oct 28 17:52:34 2011 -0400 drm/radeon: set hpd polarity at init time so hotplug detect works commit 8ab250d4484b72ccc78e34276c5ffa84c1d41303 upstream. Polarity needs to be set accordingly to connector status (connected or disconnected). Set it up at module init so first hotplug works reliably no matter what is the initial set of connector. Signed-off-by: Jerome Glisse Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit e04f9bf1f41102bfee254f2e1b7c05231227e047 Author: Alex Deucher Date: Tue Oct 25 15:11:08 2011 -0400 drm/radeon/kms: Add MSI quirk for HP RS690 commit b362105f7f5223fa4d2e03ceeea0e51da754ccc6 upstream. Some HP laptops only seem to work with MSIs. This looks like a platform/bios bug. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=37679 Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit e85066637fe392f796c29d9b9cad5ac16bd80d04 Author: Alex Deucher Date: Tue Oct 25 14:58:49 2011 -0400 drm/radeon/kms: split MSI check into a separate function commit 8f6c25c59b0c895c68cae59d1b34e9a7b36971bc upstream. This makes it easier to add quirks for certain systems. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 291adcd899bd2e023ed2ed7c4fdc5d5bc014d235 Author: Jerome Glisse Date: Mon Oct 24 18:16:34 2011 -0400 drm/radeon: avoid bouncing connector status btw disconnected & unknown commit 340764465aa4a586ca332e61ae64883e5ad6f183 upstream. Since force handling rework of d0d0a225e6ad43314c9aa7ea081f76adc5098ad4 we could end up bouncing connector status btw disconnected and unknown. When connector status change a call to output_poll_changed happen which in turn ask again for detect but with force set. So set the load detect flags whenever we report the connector as connected or unknown this avoid bouncing btw disconnected and unknown. Signed-off-by: Jerome Glisse Reviewed-by: Alex Deucher Signed-off-by: Dave Airlie Cc: Stefan Lippers-Hollmann Signed-off-by: Greg Kroah-Hartman commit 9a98a80b52e4691925fba54785af0ffff08f543a Author: Takashi Iwai Date: Sun Nov 6 13:49:13 2011 +0100 ALSA: hda - Fix a regression for DMA-position check with CA0110 commit 69f9ba9b0cad67bc03f0a096f7f274de795ca844 upstream. The regression-fix in 3.1 for the check of DMA-position validity caused yet another regression for CA0110. As usual, this hardware seems working only with LPIB properly. Adding the appropriate driver-caps bit to force LPIB fixes the problem. Reported-and-tested-by: Andres Freund Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 06a7f3b7c095b22b5a8ddec54e38993f8e70058b Author: Takashi Iwai Date: Sun Nov 6 11:25:34 2011 +0100 ALSA: hda - Fix silent output regression with ALC861 commit 43dea228a3ba5463392281535dfb3d3fe56f4c2c upstream. The 3.1 kernel has a regression for ALC861 codec where no sound output is heard with the default setup. It's because the amps in DACs aren't properly unmuted while the output mixers are assigned only to pins. This patch fixes the missing initialization of DACs when no mixer is assigned to them. Tested-by: Andrea Iob Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit e39c381f3828cda41d6b96ce3612db66ad6eb786 Author: Takashi Iwai Date: Thu Nov 3 16:54:06 2011 +0100 ALSA: hda/realtek - Skip invalid digital out pins commit 51e4152a969aa6d2306492ebf143932dcb535c9b upstream. Some BIOS report invalid pins as digital output pins. The driver checks the connection but it doesn't do it fully correctly, and it leaves some undefined value as the audio-out widget, which makes the driver spewing warnings. This patch fixes the issue. Reference: https://bugzilla.novell.com/show_bug.cgi?id=727348 Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 7d0db8193d1e0090791a33037b6af934d2ad3543 Author: Takashi Iwai Date: Wed Nov 2 21:30:51 2011 +0100 ALSA: hda/realtek - Don't create alt-stream for capture when unnecessary commit 1fa1757366783fb52e6e85c2d735db49b818d382 upstream. When the driver finds multiple ADCs, it tries to create an alternative capture PCM stream. However, these secondary ADCs might be useless or in uncontrolled paths in some cases, e.g. when auto-mic or dynamic ADC-switching is enabled. Also, when only a single capture source is available, the multi-streams don't make sense, too. With this patch, the driver checks such condition and skips the alt stream appropriately. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit c8d8433258effb001d91cca846c66bab5f9876c5 Author: Charles Chin Date: Wed Nov 2 07:56:58 2011 +0100 ALSA: hda - Add support for 92HD65 / 92HD66 family of codecs commit ad5d8755116b431f0709c745ee17cb567a478d43 upstream. These codecs have SPDIF-in, which is new to the 92HD83xxx compatible families, so a bit of logic is added to support them. Signed-off-by: Charles Chin Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 18bee4881f3efef0dd9cb108639a5fa40c3c6521 Author: Charles Chin Date: Wed Nov 2 07:53:30 2011 +0100 ALSA: hda - Disable power-widget control for IDT 92HD83/93 as default commit 35c11777b906042eca9e6f1c03e464726c7faa07 upstream. The power-widget control in patch_stac92hd83xxx() never worked properly, thus it's safer to turn it off as default for now. Signed-off-by: Charles Chin Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 427d615a29d6d629c843f2e0756a0cacd3844f22 Author: Clemens Ladisch Date: Sat Oct 15 23:19:25 2011 +0200 ALSA: ua101: fix crash when unplugging commit 862a6244eb9f9f5123fe819454fcfcae0ee1f2f9 upstream. If the device is unplugged while running, it is possible for a PCM device to be closed after the disconnect callback has returned. This means that kill_stream_urb() and disable_iso_interface() would try to access already-invalid or freed USB data structures. The function free_usb_related_resources() was intended to prevent this, but forgot to clear the affected variables. Reported-and-tested-by: Olivier Courtay Signed-off-by: Clemens Ladisch Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit e2e70d61f72a03751e0b44e4d2630ce5fdf158c4 Author: Thomas Gleixner Date: Tue Oct 25 02:30:50 2011 +0000 net: Unlock sock before calling sk_free() [ Upstream commit b0691c8ee7c28a72748ff32e91b165ec12ae4de6 ] Signed-off-by: Thomas Gleixner Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 58f18f91c6758bfe5375125f63615bbd18ed506b Author: Andrea Arcangeli Date: Wed Nov 2 13:37:36 2011 -0700 thp: share get_huge_page_tail() commit b35a35b556f5e6b7993ad0baf20173e75c09ce8c upstream. This avoids duplicating the function in every arch gup_fast. Signed-off-by: Andrea Arcangeli Cc: Peter Zijlstra Cc: Hugh Dickins Cc: Johannes Weiner Cc: Rik van Riel Cc: Mel Gorman Cc: KOSAKI Motohiro Cc: Benjamin Herrenschmidt Cc: David Gibson Cc: Martin Schwidefsky Cc: Heiko Carstens Cc: David Miller Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit e852a85448fb1fbf6cd8f8c9cbf0102f9372f45f Author: Andrea Arcangeli Date: Wed Nov 2 13:37:31 2011 -0700 sparc: gup_pte_range() support THP based tail recounting commit e0d85a366c2300efd230ef82a9b22110b0658331 upstream. Up to this point the code assumed old refcounting for hugepages (pre-thp). This updates the code directly to the thp mapcount tail page refcounting. Signed-off-by: Andrea Arcangeli Cc: Peter Zijlstra Cc: Hugh Dickins Cc: Johannes Weiner Cc: Rik van Riel Cc: Mel Gorman Cc: KOSAKI Motohiro Cc: Benjamin Herrenschmidt Cc: David Gibson Cc: Martin Schwidefsky Cc: Heiko Carstens Acked-by: David Miller Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 05ed1d8991ab010c81b2c4018d973752677843d7 Author: Andrea Arcangeli Date: Wed Nov 2 13:37:28 2011 -0700 s390: gup_huge_pmd() return 0 if pte changes commit 0693bc9ce2cc4f6a1b9c3c05790fc149a74c0b87 upstream. s390 didn't return 0 in that case, if it's rolling back the *nr pointer it should also return zero to avoid adding pages to the array at the wrong offset. Signed-off-by: Andrea Arcangeli Cc: Peter Zijlstra Cc: Hugh Dickins Cc: Johannes Weiner Cc: Rik van Riel Cc: Mel Gorman Cc: KOSAKI Motohiro Cc: Benjamin Herrenschmidt Cc: David Gibson Cc: Martin Schwidefsky Cc: Heiko Carstens Cc: David Miller Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 931064483618f938e2c4e491fd218514da4bc2a9 Author: Andrea Arcangeli Date: Wed Nov 2 13:37:25 2011 -0700 s390: gup_huge_pmd() support THP tail recounting commit 220a2eb228d032acde60e9fd044ca802706ff583 upstream. Up to this point the code assumed old refcounting for hugepages (pre-thp). This updates the code directly to the thp mapcount tail page refcounting. Signed-off-by: Andrea Arcangeli Cc: Peter Zijlstra Cc: Hugh Dickins Cc: Johannes Weiner Cc: Rik van Riel Cc: Mel Gorman Cc: KOSAKI Motohiro Cc: Benjamin Herrenschmidt Cc: David Gibson Cc: Martin Schwidefsky Cc: Heiko Carstens Cc: David Miller Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit ddb693af6f408a08c3e000856ab0e4d3217145f3 Author: Andrea Arcangeli Date: Wed Nov 2 13:37:19 2011 -0700 powerpc: gup_huge_pmd() return 0 if pte changes commit cf592bf768c4fa40282b8fce58a80820065de2cb upstream. powerpc didn't return 0 in that case, if it's rolling back the *nr pointer it should also return zero to avoid adding pages to the array at the wrong offset. Signed-off-by: Andrea Arcangeli Cc: Peter Zijlstra Cc: Hugh Dickins Cc: Johannes Weiner Cc: Rik van Riel Cc: Mel Gorman Cc: KOSAKI Motohiro Cc: Benjamin Herrenschmidt Acked-by: David Gibson Cc: Martin Schwidefsky Cc: Heiko Carstens Cc: David Miller Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 956b251c2f65362487d23a42c5aa2f7955f8fea7 Author: Andrea Arcangeli Date: Wed Nov 2 13:37:15 2011 -0700 powerpc: gup_hugepte() support THP based tail recounting commit 3526741f0964c88bc2ce511e1078359052bf225b upstream. Up to this point the code assumed old refcounting for hugepages (pre-thp). This updates the code directly to the thp mapcount tail page refcounting. Signed-off-by: Andrea Arcangeli Cc: Peter Zijlstra Cc: Hugh Dickins Cc: Johannes Weiner Cc: Rik van Riel Cc: Mel Gorman Cc: KOSAKI Motohiro Cc: Benjamin Herrenschmidt Cc: David Gibson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 9aa7c2a5e45e27dafa757989b307df18a8e7309b Author: Andrea Arcangeli Date: Wed Nov 2 13:37:11 2011 -0700 powerpc: gup_hugepte() avoid freeing the head page too many times commit 8596468487e2062cae2aad56e973784e03959245 upstream. We only taken "refs" pins on the head page not "*nr" pins. Signed-off-by: Andrea Arcangeli Cc: Peter Zijlstra Cc: Hugh Dickins Cc: Johannes Weiner Cc: Rik van Riel Cc: Mel Gorman Cc: KOSAKI Motohiro Cc: Benjamin Herrenschmidt Acked-by: David Gibson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 80a76e1db5d707c14b0a8f519ff08d4ee4586482 Author: Andrea Arcangeli Date: Wed Nov 2 13:37:08 2011 -0700 powerpc: get_hugepte() don't put_page() the wrong page commit 405e44f2e312dd5dd63e5a9f459bffcbcd4368ef upstream. "page" may have changed to point to the next hugepage after the loop completed, The references have been taken on the head page, so the put_page must happen there too. This is a longstanding issue pre-thp inclusion. It's totally unclear how these page_cache_add_speculative and pte_val(pte) != pte_val(*ptep) checks are necessary across all the powerpc gup_fast code, when x86 doesn't need any of that: there's no way the page can be freed with irq disabled so we're guaranteed the atomic_inc will happen on a page with page_count > 0 (so not needing the speculative check). The pte check is also meaningless on x86: no need to rollback on x86 if the pte changed, because the pte can still change a CPU tick after the check succeeded and it won't be rolled back in that case. The important thing is we got a reference on a valid page that was mapped there a CPU tick ago. So not knowing the soft tlb refill code of ppc64 in great detail I'm not removing the "speculative" page_count increase and the pte checks across all the code, but unless there's a strong reason for it they should be later cleaned up too. If a pte can change from huge to non-huge (like it could happen with THP) passing a pte_t *ptep to gup_hugepte() would also require to repeat the is_hugepd in gup_hugepte(), but that shouldn't happen with hugetlbfs only so I'm not altering that. Signed-off-by: Andrea Arcangeli Cc: Peter Zijlstra Cc: Hugh Dickins Cc: Johannes Weiner Cc: Rik van Riel Cc: Mel Gorman Cc: KOSAKI Motohiro Cc: Benjamin Herrenschmidt Acked-by: David Gibson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 5db7016cf280d1505807b013aca0cd4a3f0882a7 Author: Andrea Arcangeli Date: Wed Nov 2 13:37:03 2011 -0700 powerpc: remove superfluous PageTail checks on the pte gup_fast commit 2839bdc1bfc0af76a2f0f11eca011590520a04fa upstream. This part of gup_fast doesn't seem capable of handling hugetlbfs ptes, those should be handled by gup_hugepd only, so these checks are superfluous. Plus if this wasn't a noop, it would have oopsed because, the insistence of using the speculative refcounting would trigger a VM_BUG_ON if a tail page was encountered in the page_cache_get_speculative(). Signed-off-by: Andrea Arcangeli Cc: Peter Zijlstra Cc: Hugh Dickins Cc: Johannes Weiner Cc: Rik van Riel Cc: Mel Gorman Cc: KOSAKI Motohiro Cc: Benjamin Herrenschmidt Acked-by: David Gibson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit d3196f067c4e9dc58d70d8e091805c45c83e0302 Author: Andiry Xu Date: Fri Sep 23 14:19:50 2011 -0700 xHCI: Clear PLC for USB2 root hub ports commit 6fd4562178508a0949c9fdecd8558d8b10d671bd upstream. When the link state changes, xHC will report a port status change event and set the PORT_PLC bit, for both USB3 and USB2 root hub ports. The PLC will be cleared by usbcore for USB3 root hub ports, but not for USB2 ports, because they do not report USB_PORT_STAT_C_LINK_STATE in wPortChange. Clear it for USB2 root hub ports in handle_port_status(). Signed-off-by: Andiry Xu Signed-off-by: Sarah Sharp Signed-off-by: Greg Kroah-Hartman commit 445762a5b85e7460aa2f49a24698f8a4b758ec56 Author: Andiry Xu Date: Fri Sep 23 14:19:49 2011 -0700 xHCI: test and clear RWC bit commit d2f52c9e585bbb1a3c164e02b8dcd0d996c67353 upstream. Introduce xhci_test_and_clear_bit() to clear RWC bit in PORTSC register. Signed-off-by: Andiry Xu Signed-off-by: Sarah Sharp Signed-off-by: Greg Kroah-Hartman commit 6fcb7a033dcadbc4691a1f54325a6001a31849ef Author: Sarah Sharp Date: Fri Sep 2 11:05:40 2011 -0700 xhci: If no endpoints changed, don't issue BW command. commit 2dc3753997f3c80ce8b950242ab9bb3fb936acfd upstream. Some alternate interface settings have no endpoints associated with them. This shows up in some USB webcams, particularly the Logitech HD 1080p, which uses the uvcvideo driver. If a driver switches between two alt settings with no endpoints, there is no need to issue a configure endpoint command, because there is no endpoint information to update. The only time a configure endpoint command with just the add slot flag set makes sense is when the driver is updating hub characteristics in the slot context. However, that code never calls xhci_check_bandwidth, so we should be safe not issuing a command if only the slot context add flag is set. Signed-off-by: Sarah Sharp Signed-off-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman commit e6cf500251900275b34ca3f57c04d41d7ee3baf0 Author: Seth Forshee Date: Tue Jul 26 09:56:07 2011 -0500 usb_storage: Don't freeze in usb-stor-scan commit f02fe890ece7d695a5744b20525d45312382e6e4 upstream. Scanning cannot be run during suspend or hibernation, but if usb-stor-scan freezes another thread waiting on scanning to complete may fail to freeze. However, if usb-stor-scan is left freezable without ever actually freezing then the freezer will wait on it to exit, and threads waiting for scanning to finish will no longer be blocked. One problem with this approach is that usb-stor-scan has a delay to wait for devices to settle (which is currently the only point where it can freeze). To work around this we can request that the freezer send a fake signal when freezing, then use interruptible sleep to wake the thread early when freezing happens. To make this happen, the following changes are made to usb-stor-scan: * Use set_freezable_with_signal() instead of set_freezable() to request a fake signal when freezing * Use wait_event_interruptible_timeout() instead of wait_event_freezable_timeout() to avoid freezing Signed-off-by: Seth Forshee Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit 87556ecf5d093a7d083ce909476783bf98dc4725 Author: Eric Sandeen Date: Sat Oct 29 10:15:35 2011 -0400 ext4: fix race in xattr block allocation path commit 6d6a435190bdf2e04c9465cde5bdc3ac68cf11a4 upstream. Ceph users reported that when using Ceph on ext4, the filesystem would often become corrupted, containing inodes with incorrect i_blocks counters. I managed to reproduce this with a very hacked-up "streamtest" binary from the Ceph tree. Ceph is doing a lot of xattr writes, to out-of-inode blocks. There is also another thread which does sync_file_range and close, of the same files. The problem appears to happen due to this race: sync/flush thread xattr-set thread ----------------- ---------------- do_writepages ext4_xattr_set ext4_da_writepages ext4_xattr_set_handle mpage_da_map_blocks ext4_xattr_block_set set DELALLOC_RESERVE ext4_new_meta_blocks ext4_mb_new_blocks if (!i_delalloc_reserved_flag) vfs_dq_alloc_block ext4_get_blocks down_write(i_data_sem) set i_delalloc_reserved_flag ... up_write(i_data_sem) if (i_delalloc_reserved_flag) vfs_dq_alloc_block_nofail In other words, the sync/flush thread pops in and sets i_delalloc_reserved_flag on the inode, which makes the xattr thread think that it's in a delalloc path in ext4_new_meta_blocks(), and add the block for a second time, after already having added it once in the !i_delalloc_reserved_flag case in ext4_mb_new_blocks The real problem is that we shouldn't be using the DELALLOC_RESERVED state flag, and instead we should be passing EXT4_GET_BLOCKS_DELALLOC_RESERVE down to ext4_map_blocks() instead of using an inode state flag. We'll fix this for now with using i_data_sem to prevent this race, but this is really not the right way to fix things. Signed-off-by: Eric Sandeen Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 6ff60a6de3b107b9c78eb10b2c9a9987bab5138c Author: Yongqiang Yang Date: Wed Oct 26 05:00:19 2011 -0400 ext4: let ext4_page_mkwrite stop started handle in failure commit fcbb5515825f1bb20b7a6f75ec48bee61416f879 upstream. The started journal handle should be stopped in failure case. Signed-off-by: Yongqiang Yang Signed-off-by: "Theodore Ts'o" Acked-by: Jan Kara Signed-off-by: Greg Kroah-Hartman commit caf61680a4f161a4b6d1c6e734ec0fb8233d45d7 Author: Theodore Ts'o Date: Wed Aug 31 12:02:51 2011 -0400 ext4: call ext4_handle_dirty_metadata with correct inode in ext4_dx_add_entry commit 5930ea643805feb50a2f8383ae12eb6f10935e49 upstream. ext4_dx_add_entry manipulates bh2 and frames[0].bh, which are two buffer_heads that point to directory blocks assigned to the directory inode. However, the function calls ext4_handle_dirty_metadata with the inode of the file that's being added to the directory, not the directory inode itself. Therefore, correct the code to dirty the directory buffers with the directory inode, not the file inode. Signed-off-by: Darrick J. Wong Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 523d90b566448dd9ca31b0a93b3cf9f601118d5c Author: Darrick J. Wong Date: Wed Aug 31 12:00:51 2011 -0400 ext4: ext4_mkdir should dirty dir_block with newly created directory inode commit f9287c1f2d329f4d78a3bbc9cf0db0ebae6f146a upstream. ext4_mkdir calls ext4_handle_dirty_metadata with dir_block and the inode "dir". Unfortunately, dir_block belongs to the newly created directory (which is "inode"), not the parent directory (which is "dir"). Fix the incorrect association. Signed-off-by: Darrick J. Wong Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 76e72d11365ce08b2800ac70b7abc0d46ee9727d Author: Darrick J. Wong Date: Wed Aug 31 11:58:51 2011 -0400 ext4: ext4_rename should dirty dir_bh with the correct directory commit bcaa992975041e40449be8c010c26192b8c8b409 upstream. When ext4_rename performs a directory rename (move), dir_bh is a buffer that is modified to update the '..' link in the directory being moved (old_inode). However, ext4_handle_dirty_metadata is called with the old parent directory inode (old_dir) and dir_bh, which is incorrect because dir_bh does not belong to the parent inode. Fix this error. Signed-off-by: Darrick J. Wong Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 305b7dd039f8c4ab5a38057f8c6fbcc50e4f4e43 Author: Theodore Ts'o Date: Wed Aug 31 11:54:51 2011 -0400 ext2,ext3,ext4: don't inherit APPEND_FL or IMMUTABLE_FL for new inodes commit 1cd9f0976aa4606db8d6e3dc3edd0aca8019372a upstream. This doesn't make much sense, and it exposes a bug in the kernel where attempts to create a new file in an append-only directory using O_CREAT will fail (but still leave a zero-length file). This was discovered when xfstests #79 was generalized so it could run on all file systems. Signed-off-by: "Theodore Ts'o" Signed-off-by: Greg Kroah-Hartman commit 7414af4ea686db48b0985a5d26a6639bbad271ea Author: Clifton Barnes Date: Wed Nov 2 13:39:55 2011 -0700 drivers/power/ds2780_battery.c: fix deadlock upon insertion and removal commit 0e053fcbbbc4d945247cb32cad2767b483cb65f8 upstream. Fixes the deadlock when inserting and removing the ds2780. Signed-off-by: Clifton Barnes Cc: Evgeniy Polyakov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 1b4e7370d4b6591f64e12f8f35bc219996c509f6 Author: Clifton Barnes Date: Wed Nov 2 13:39:52 2011 -0700 drivers/power/ds2780_battery.c: add a nolock function to w1 interface commit 9fe678fa2feb4aaac0b4220de63e1b7f8ccebae6 upstream. Adds a nolock function to the w1 interface to avoid locking the mutex if needed. Signed-off-by: Clifton Barnes Cc: Evgeniy Polyakov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 17fd351616a1c63239ec7530eeb97354002c6eba Author: Clifton Barnes Date: Wed Nov 2 13:39:50 2011 -0700 drivers/power/ds2780_battery.c: create central point for calling w1 interface commit 853eee72f74f449797f0500ea19fc1bf497428d8 upstream. Simply creates one point to call the w1 interface. Signed-off-by: Clifton Barnes Cc: Evgeniy Polyakov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 798e0d0e7d11915656a2fbee2bce8d79fb27ccb5 Author: Juan Gutierrez Date: Tue Sep 6 09:30:16 2011 +0300 hwspinlock/core: use a mutex to protect the radix tree commit 93b465c2e186d96fb90012ba0f9372eb9952e732 upstream. Since we're using non-atomic radix tree allocations, we should be protecting the tree using a mutex and not a spinlock. Non-atomic allocations and process context locking is good enough, as the tree is manipulated only when locks are registered/ unregistered/requested/freed. The locks themselves are still protected by spinlocks of course, and mutexes are not involved in the locking/unlocking paths. Signed-off-by: Juan Gutierrez [ohad@wizery.com: rewrite the commit log, #include mutex.h, add minor commentary] [ohad@wizery.com: update register/unregister parts in hwspinlock.txt] Signed-off-by: Ohad Ben-Cohen Signed-off-by: Greg Kroah-Hartman commit 46651269fdcf9b6d0d47920dbf838d252943320b Author: Alexandre Bounine Date: Wed Nov 2 13:39:15 2011 -0700 drivers/net/rionet.c: fix ethernet address macros for LE platforms commit e0c87bd95e8dad455c23bc56513af8dcb1737e55 upstream. Modify Ethernet addess macros to be compatible with BE/LE platforms Signed-off-by: Alexandre Bounine Cc: Chul Kim Cc: Kumar Gala Cc: Matt Porter Cc: Li Yang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 5a9f0bfd978cc5aa504c1ff7ad3a79da73b71404 Author: Takashi Iwai Date: Thu Nov 3 15:56:55 2011 +0100 ALSA: hda - Add missing static ADC tables for ALC269 quirks [There is no upstream commit for this patch since the corresponding code was removed from 3.2 kernel. This is a regression found only in 3.1 kernel, so please apply this only to 3.1.x series.] Some ALC269 quirks define their own .cap_mixer field but without the static adc_nids[]. This resulted in the mismatch of ADC because ALC269 may have the widget 0x07 for another audio-in, and the auto-parser picks this up instead. This patch fixes the problem by adding the static adc_nids[] and co again to these entries. Tested-by: Chris Vine Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 47c5d5e0bb289d3f25b2521304eb22b8e23d2b65 Author: Jiri Kosina Date: Wed Nov 2 13:37:41 2011 -0700 binfmt_elf: fix PIE execution with randomization disabled commit a3defbe5c337dbc6da911f8cc49ae3cc3b49b453 upstream. The case of address space randomization being disabled in runtime through randomize_va_space sysctl is not treated properly in load_elf_binary(), resulting in SIGKILL coming at exec() time for certain PIE-linked binaries in case the randomization has been disabled at runtime prior to calling exec(). Handle the randomize_va_space == 0 case the same way as if we were not supporting .text randomization at all. Based on original patch by H.J. Lu and Josh Boyer. Signed-off-by: Jiri Kosina Cc: Ingo Molnar Cc: Russell King Cc: H.J. Lu Cc: Tested-by: Josh Boyer Acked-by: Nicolas Pitre Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 1e565a292a31ca798604b25b780e1878b4bb00cb Author: Andrea Arcangeli Date: Wed Nov 2 13:36:59 2011 -0700 mm: thp: tail page refcounting fix commit 70b50f94f1644e2aa7cb374819cfd93f3c28d725 upstream. Michel while working on the working set estimation code, noticed that calling get_page_unless_zero() on a random pfn_to_page(random_pfn) wasn't safe, if the pfn ended up being a tail page of a transparent hugepage under splitting by __split_huge_page_refcount(). He then found the problem could also theoretically materialize with page_cache_get_speculative() during the speculative radix tree lookups that uses get_page_unless_zero() in SMP if the radix tree page is freed and reallocated and get_user_pages is called on it before page_cache_get_speculative has a chance to call get_page_unless_zero(). So the best way to fix the problem is to keep page_tail->_count zero at all times. This will guarantee that get_page_unless_zero() can never succeed on any tail page. page_tail->_mapcount is guaranteed zero and is unused for all tail pages of a compound page, so we can simply account the tail page references there and transfer them to tail_page->_count in __split_huge_page_refcount() (in addition to the head_page->_mapcount). While debugging this s/_count/_mapcount/ change I also noticed get_page is called by direct-io.c on pages returned by get_user_pages. That wasn't entirely safe because the two atomic_inc in get_page weren't atomic. As opposed to other get_user_page users like secondary-MMU page fault to establish the shadow pagetables would never call any superflous get_page after get_user_page returns. It's safer to make get_page universally safe for tail pages and to use get_page_foll() within follow_page (inside get_user_pages()). get_page_foll() is safe to do the refcounting for tail pages without taking any locks because it is run within PT lock protected critical sections (PT lock for pte and page_table_lock for pmd_trans_huge). The standard get_page() as invoked by direct-io instead will now take the compound_lock but still only for tail pages. The direct-io paths are usually I/O bound and the compound_lock is per THP so very finegrined, so there's no risk of scalability issues with it. A simple direct-io benchmarks with all lockdep prove locking and spinlock debugging infrastructure enabled shows identical performance and no overhead. So it's worth it. Ideally direct-io should stop calling get_page() on pages returned by get_user_pages(). The spinlock in get_page() is already optimized away for no-THP builds but doing get_page() on tail pages returned by GUP is generally a rare operation and usually only run in I/O paths. This new refcounting on page_tail->_mapcount in addition to avoiding new RCU critical sections will also allow the working set estimation code to work without any further complexity associated to the tail page refcounting with THP. Signed-off-by: Andrea Arcangeli Reported-by: Michel Lespinasse Reviewed-by: Michel Lespinasse Reviewed-by: Minchan Kim Cc: Peter Zijlstra Cc: Hugh Dickins Cc: Johannes Weiner Cc: Rik van Riel Cc: Mel Gorman Cc: KOSAKI Motohiro Cc: Benjamin Herrenschmidt Cc: David Gibson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 04f915f43427c8b20af479ad67b4f857ab946ff5 Author: Eric Dumazet Date: Sat Oct 22 03:29:53 2011 -0400 tg3: fix tigon3_dma_hwbug_workaround() [ Upstream commit f7ff19871bb4a3451e1ca2cf660bf633018cfbec ] Ari got kernel panics using tg3 NIC, and bisected to 2669069aacc9 "tg3: enable transmit time stamping." This is because tigon3_dma_hwbug_workaround() might alloc a new skb and free the original. We panic when skb_tx_timestamp() is called on freed skb. Reported-by: Ari Savolainen Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 7d1be381b53d55d3a0ff0565922d29420985a3fe Author: Gao feng Date: Fri Oct 28 02:46:57 2011 +0000 ipv6: fix route error binding peer in func icmp6_dst_alloc [ Upstream commit 7011687f0f2f12cc348f6a693fafe63d89167eac ] in func icmp6_dst_alloc,dst_metric_set call ipv6_cow_metrics to set metric. ipv6_cow_metrics may will call rt6_bind_peer to set rt6_info->rt6i_peer. So,we should move ipv6_addr_copy before dst_metric_set to make sure rt6_bind_peer success. Signed-off-by: Gao feng Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 9dcc771f0944de26f5ad73edffe7f9c4985e3f6c Author: Yan, Zheng Date: Sat Oct 22 21:58:20 2011 +0000 ipv4: fix ipsec forward performance regression [ Upstream commit b73233960a59ee66e09d642f13d0592b13651e94 ] There is bug in commit 5e2b61f(ipv4: Remove flowi from struct rtable). It makes xfrm4_fill_dst() modify wrong data structure. Signed-off-by: Zheng Yan Reported-by: Kim Phillips Acked-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 3512abc22491c30115ee5ba371975f25d86a13a2 Author: Thadeu Lima de Souza Cascardo Date: Wed Aug 24 13:14:22 2011 -0300 jsm: remove buggy write queue commit 9d898966c4a07e4a5092215b5a2829d0ef02baa2 upstream. jsm uses a write queue that copies from uart_core circular buffer. This copying however has some bugs, like not wrapping the head counter. Since this write queue is also a circular buffer, the consumer function is ready to use the uart_core circular buffer directly. This buggy copying function was making some bytes be dropped when transmitting to a raw tty, doing something like this. [root@hostname ~]$ cat /dev/ttyn1 > cascardo/dump & [1] 2658 [root@hostname ~]$ cat /proc/tty/drivers > /dev/ttyn0 [root@hostname ~]$ cat /proc/tty/drivers /dev/tty /dev/tty 5 0 system:/dev/tty /dev/console /dev/console 5 1 system:console /dev/ptmx /dev/ptmx 5 2 system /dev/vc/0 /dev/vc/0 4 0 system:vtmaster jsm /dev/ttyn 250 0-31 serial serial /dev/ttyS 4 64-95 serial hvc /dev/hvc 229 0-7 system pty_slave /dev/pts 136 0-1048575 pty:slave pty_master /dev/ptm 128 0-1048575 pty:master unknown /dev/tty 4 1-63 console [root@hostname ~]$ cat cascardo/dump /dev/tty /dev/tty 5 0 system:/dev/tty /dev/console /dev/console 5 1 system:console /dev/ptmx /dev/ptmx 5 2 system /dev/vc/0 /dev/vc/0 4 0 system:vtmaste[root@hostname ~]$ This patch drops the driver write queue entirely, using the circular buffer from uart_core only. Signed-off-by: Thadeu Lima de Souza Cascardo Signed-off-by: Greg Kroah-Hartman commit 52e17e7874e216526d84af50f4661aa2cb7413c0 Author: Shubhrajyoti D Date: Mon Oct 24 15:54:24 2011 +0530 OMAP: SPI: Fix the trying to free nonexistent resource error commit 1458d160de3f1862aeaac57447ba96e7857ac52b upstream. Currently there is a request_mem_region(r->start, .. followed by r->start += pdata->regs_offset; And then in remove r = platform_get_resource(pdev, IORESOURCE_MEM, 0); release_mem_region(r->start, resource_size(r)); Here the offset addition is not taken care. Fix the code for the same. Signed-off-by: Shubhrajyoti D Signed-off-by: Grant Likely Signed-off-by: Greg Kroah-Hartman commit 76c125d2658e301689c0b812977eebbef17d8c0c Author: Dave Jones Date: Mon Oct 24 18:15:32 2011 -0400 um: Fix kmalloc argument order in um/vdso/vma.c commit 0d65ede0a605d6252acc5c8a9c536c4cd0211f3c upstream. kmalloc size is 1st arg, not second. Signed-off-by: Dave Jones Signed-off-by: Richard Weinberger Signed-off-by: Greg Kroah-Hartman commit 4f0d844bad2b3c705767e3df85978aae2ca5beb7 Author: Andy Whitcroft Date: Wed Nov 2 09:44:39 2011 +0100 readlinkat: ensure we return ENOENT for the empty pathname for normal lookups commit 1fa1e7f615f4d3ae436fa319af6e4eebdd4026a8 upstream. Since the commit below which added O_PATH support to the *at() calls, the error return for readlink/readlinkat for the empty pathname has switched from ENOENT to EINVAL: commit 65cfc6722361570bfe255698d9cd4dccaf47570d Author: Al Viro Date: Sun Mar 13 15:56:26 2011 -0400 readlinkat(), fchownat() and fstatat() with empty relative pathnames This is both unexpected for userspace and makes readlink/readlinkat inconsistant with all other interfaces; and inconsistant with our stated return for these pathnames. As the readlinkat call does not have a flags parameter we cannot use the AT_EMPTY_PATH approach used in the other calls. Therefore expose whether the original path is infact entry via a new user_path_at_empty() path lookup function. Use this to determine whether to default to EINVAL or ENOENT for failures. Addresses http://bugs.launchpad.net/bugs/817187 [akpm@linux-foundation.org: remove unused getname_flags()] Signed-off-by: Andy Whitcroft Cc: Christoph Hellwig Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Christoph Hellwig Signed-off-by: Greg Kroah-Hartman commit 02e66bee63c63c2bec1947553e6c5b58b3f0c67d Author: Richard Weinberger Date: Wed Nov 2 13:17:27 2011 +0100 um: fix ubd cow size commit 8535639810e578960233ad39def3ac2157b0c3ec upstream. ubd_file_size() cannot use ubd_dev->cow.file because at this time ubd_dev->cow.file is not initialized. Therefore, ubd_file_size() will always report a wrong disk size when COW files are used. Reading from /dev/ubd* would crash the kernel. We have to read the correct disk size from the COW file's backing file. Signed-off-by: Richard Weinberger Signed-off-by: Greg Kroah-Hartman commit 9ae9f13480be10697214ed82f4a0f32681309822 Author: Johannes Berg Date: Thu Sep 15 11:46:52 2011 -0700 iwlagn: do not use interruptible waits commit effd4d9aece9184f526e6556786a94d335e38b71 upstream. Since the dawn of its time, iwlwifi has used interruptible waits to wait for synchronous commands and firmware loading. This leads to "interesting" bugs, because it can't actually handle the interruptions; for example when a command sending is interrupted it will assume the command completed fully, and then leave it pending, which leads to all kinds of trouble when the command finishes later. Since there's no easy way to gracefully deal with interruptions, fix the driver to not use interruptible waits. This at least fixes the error iwlagn 0000:02:00.0: Error: Response NULL in 'REPLY_SCAN_ABORT_CMD' I have seen in P2P testing, but it is likely that there are other errors caused by this. Cc: Stanislaw Gruszka Signed-off-by: Johannes Berg Signed-off-by: Wey-Yi Guy Signed-off-by: John W. Linville commit a4fd5a818d0bc41dd3cb8ee4b73312004e6b02d6 Author: Takashi Iwai Date: Fri Oct 14 15:26:20 2011 +0200 ALSA: hda - Fix ADC input-amp handling for Cx20549 codec commit 6b45214277bec2193ad3ccb8d7aa6100b5a0f1a9 upstream. It seems that Conexant CX20549 chip handle only a single input-amp even though the audio-input widget has multiple sources. This has been never clear, and I implemented in the current way based on the debug information I got at the early time -- the device reacts individual input-amp values for different sources. This is true for another Conexant codec, but it's not applied to CX20549 actually. This patch changes the auto-parser code to handle a single input-amp per audio-in widget for CX20549. After applying this, you'll see only a single "Capture" volume control instead of separate "Mic" or "Line" captures when the device is set up to use a single ADC. We haven't tested 20551 and 20561 codecs yet. If these show the similar behavior like 20549, they need to set spec->single_adc_amp=1, too. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit cc3370d8221a8561a0f955aedc243af971b1e9d7 Author: Mitsuo Hayasaka Date: Mon Oct 31 17:08:13 2011 -0700 mm: avoid null pointer access in vm_struct via /proc/vmallocinfo commit f5252e009d5b87071a919221e4f6624184005368 upstream. The /proc/vmallocinfo shows information about vmalloc allocations in vmlist that is a linklist of vm_struct. It, however, may access pages field of vm_struct where a page was not allocated. This results in a null pointer access and leads to a kernel panic. Why this happens: In __vmalloc_node_range() called from vmalloc(), newly allocated vm_struct is added to vmlist at __get_vm_area_node() and then, some fields of vm_struct such as nr_pages and pages are set at __vmalloc_area_node(). In other words, it is added to vmlist before it is fully initialized. At the same time, when the /proc/vmallocinfo is read, it accesses the pages field of vm_struct according to the nr_pages field at show_numa_info(). Thus, a null pointer access happens. The patch adds the newly allocated vm_struct to the vmlist *after* it is fully initialized. So, it can avoid accessing the pages field with unallocated page when show_numa_info() is called. Signed-off-by: Mitsuo Hayasaka Cc: Andrew Morton Cc: David Rientjes Cc: Namhyung Kim Cc: "Paul E. McKenney" Cc: Jeremy Fitzhardinge Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit f9f92901e2810448ed31691613a78cc232e4bc84 Author: Linus Walleij Date: Fri Aug 12 13:54:42 2011 +0200 ARM: mach-ux500: unlock I&D l2x0 caches before init commit 1bf6d2c1bb23533af6930581cc39b74685bc29de upstream. Apparently U8500 U-Boot versions may leave the l2x0 locked down before executing the kernel. Make sure we unlock it before we initialize the l2x0. This fixes a performance problem reported by Jan Rinze. The l2x0 core has been modified to unlock the l2x0 by default, but it will not touch the locking registers if the l2x0 was already enabled, as on the ux500, so we need this quirk to make sure it is properly turned off. Cc: Srinidhi Kasagar Cc: Rabin Vincent Cc: Adrian Bunk Reported-by: Jan Rinze Tested-by: Robert Marklund Signed-off-by: Linus Walleij Signed-off-by: Greg Kroah-Hartman commit 859967a0ffdb214e97ea202bcafc7bf41a73bb34 Author: Axel Lin Date: Sat Sep 17 22:15:34 2011 +0800 ARM: pxa/cm-x300: properly set bt_reset pin commit 1a64200ec5e93be03e27c3b2fc332e04ae443eb2 upstream. Fix below build warning and properly set bt_reset pin. CC arch/arm/mach-pxa/cm-x300.o arch/arm/mach-pxa/cm-x300.c: In function 'cm_x300_init_wi2wi': arch/arm/mach-pxa/cm-x300.c:779: warning: unused variable 'wlan_en' arch/arm/mach-pxa/cm-x300.c:795: warning: 'bt_reset' may be used uninitialized in this function Signed-off-by: Axel Lin Acked-by: Igor Grinberg Signed-off-by: Eric Miao Signed-off-by: Greg Kroah-Hartman commit a54059bb11df75d9ddf3c4d98f20b78c5b017bb9 Author: Paul Fertser Date: Mon Oct 10 11:19:23 2011 +0400 plat-mxc: iomux-v3.h: implicitly enable pull-up/down when that's desired commit 6571534b600b8ca1936ff5630b9e0947f21faf16 upstream. To configure pads during the initialisation a set of special constants is used, e.g. #define MX25_PAD_FEC_MDIO__FEC_MDIO IOMUX_PAD(0x3c4, 0x1cc, 0x10, 0, 0, PAD_CTL_HYS | PAD_CTL_PUS_22K_UP) The problem is that no pull-up/down is getting activated unless both PAD_CTL_PUE (pull-up enable) and PAD_CTL_PKE (pull/keeper module enable) set. This is clearly stated in the i.MX25 datasheet and is confirmed by the measurements on hardware. This leads to some rather hard to understand bugs such as misdetecting an absent ethernet PHY (a real bug i had), unstable data transfer etc. This might affect mx25, mx35, mx50, mx51 and mx53 SoCs. It's reasonable to expect that if the pullup value is specified, the intention was to have it actually active, so we implicitly add the needed bits. Signed-off-by: Paul Fertser Signed-off-by: Sascha Hauer Signed-off-by: Greg Kroah-Hartman commit 908accb6a475037a826cc151609c575415aa7e89 Author: NeilBrown Date: Mon Oct 31 12:59:44 2011 +1100 md/raid10: Fix bug when activating a hot-spare. commit 7fcc7c8acf0fba44d19a713207af7e58267c1179 upstream. This is a fairly serious bug in RAID10. When a RAID10 array is degraded and a hot-spare is activated, the spare does not take up the empty slot, but rather replaces the first working device. This is likely to make the array non-functional. It would normally be possible to recover the data, but that would need care and is not guaranteed. This bug was introduced in commit 2bb77736ae5dca0a189829fbb7379d43364a9dac which first appeared in 3.1. Signed-off-by: NeilBrown Signed-off-by: Greg Kroah-Hartman commit 9d6af07ac7e925a9a7dcb46d6b25021112b203e1 Author: Andrew Morton Date: Mon Oct 31 17:06:32 2011 -0700 /proc/self/numa_maps: restore "huge" tag for hugetlb vmas commit fc360bd9cdcf875639a77f07fafec26699c546f3 upstream. The display of the "huge" tag was accidentally removed in 29ea2f698 ("mm: use walk_page_range() instead of custom page table walking code"). Reported-by: Stephen Hemminger Tested-by: Stephen Hemminger Reviewed-by: Stephen Wilson Cc: KOSAKI Motohiro Cc: Hugh Dickins Acked-by: David Rientjes Cc: Lee Schermerhorn Cc: Alexey Dobriyan Cc: Christoph Lameter Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit de4ad65cf337fab8ba439c2ee8bc8c30fb799add Author: Mauro Carvalho Chehab Date: Thu Jul 28 16:38:54 2011 -0300 tuner_xc2028: Allow selection of the frequency adjustment code for XC3028 commit 9bed77ee2fb46b74782d0d9d14b92e9d07f3df6e upstream. This device is not using the proper demod IF. Instead of using the IF macro, it is specifying a IF frequency. This doesn't work, as xc3028 needs to load an specific SCODE for the tuner. In this case, there's no IF table for 5 MHz. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit 7846990372f8ba213d1fdfb9eed22ca7969fa437 Author: Olivier Grenie Date: Mon Aug 1 12:45:58 2011 -0300 dib0700: protect the dib0700 buffer access commit bff469f4167fdabfe15294f375577d7eadbaa1bb upstream. This patch protects the common buffer access inside the dib0700 in order to manage concurrent access. This protection is done using mutex. Cc: Mauro Carvalho Chehab Cc: Florian Mickler Signed-off-by: Javier Marcet Signed-off-by: Olivier Grenie Signed-off-by: Patrick Boettcher [mchehab@redhat.com: dprint requires 3 arguments. Replaced by dib_info] Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit 4c505e95cf8dd1ce490c65fc89da183a535d9132 Author: Patrick Boettcher Date: Wed Aug 3 12:08:21 2011 -0300 DiBcom: protect the I2C bufer access commit 79fcce3230b140f7675f8529ee53fe2f9644f902 upstream. This patch protects the I2C buffer access in order to manage concurrent access. This protection is done using mutex. Furthermore, for the dib9000, if a pid filtering command is received during the tuning, this pid filtering command is delayed to avoid any concurrent access issue. Cc: Mauro Carvalho Chehab Cc: Florian Mickler Signed-off-by: Olivier Grenie Signed-off-by: Patrick Boettcher Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit 9578e52e8847be8b342e0dbc61409d940e73666c Author: Florian Tobias Schandinat Date: Mon Jun 6 01:27:34 2011 +0000 viafb: improve pitch handling commit 936a3f770b8de7042d793272f008ef1bb08522e9 upstream. This patch adds checks for minimum and maximum pitch size to prevent invalid settings which could otherwise crash the machine. Also the alignment is done in a slightly more readable way. Signed-off-by: Florian Tobias Schandinat Signed-off-by: Greg Kroah-Hartman commit 51bbfa9ef00ac1773d8bf121d2b5e1dcc85d3406 Author: Florian Tobias Schandinat Date: Mon May 23 21:39:58 2011 +0000 viafb: use display information in info not in var for panning commit d933990c57b498c092ceef591c7c5d69dbfe9f30 upstream. As Laurent pointed out we must not use any information in the passed var besides xoffset, yoffset and vmode as otherwise applications might abuse it. Also use the aligned fix.line_length and not the (possible) unaligned xres_virtual. Signed-off-by: Florian Tobias Schandinat Reported-by: Laurent Pinchart Acked-by: Laurent Pinchart Signed-off-by: Greg Kroah-Hartman commit f39f31b7c70cb84805b4dcae76a9161510c0b01c Author: Bruno Prémont Date: Fri Sep 2 19:24:03 2011 +0200 fb: sh-mobile: Fix deadlock risk between lock_fb_info() and console_lock() commit 4a47a0e09c504e3ce0ccdb405411aefc5b09deb8 upstream. Following on Herton's patch "fb: avoid possible deadlock caused by fb_set_suspend" which moves lock_fb_info() out of fb_set_suspend() to its callers, correct sh-mobile's locking around call to fb_set_suspend() and the same sort of deaklocks with console_lock() due to order of taking the lock. console_lock() must be taken while fb_info is already locked and fb_info must be locked while calling fb_set_suspend(). Signed-off-by: Bruno Prémont Signed-off-by: Guennadi Liakhovetski Signed-off-by: Florian Tobias Schandinat Signed-off-by: Greg Kroah-Hartman commit b4dac1778497fc43092231647833e32f68fdf54d Author: Herton Ronaldo Krzesinski Date: Fri Jun 17 19:02:39 2011 +0000 fb: avoid possible deadlock caused by fb_set_suspend commit 9e769ff3f585db8f978f9113be83d36c7e3965dd upstream. A lock ordering issue can cause deadlocks: in framebuffer/console code, all needed struct fb_info locks are taken before acquire_console_sem(), in places which need to take console semaphore. But fb_set_suspend is always called with console semaphore held, and inside it we call lock_fb_info which gets the fb_info lock, inverse locking order of what the rest of the code does. This causes a real deadlock issue, when we write to state fb sysfs attribute (which calls fb_set_suspend) while a framebuffer is being unregistered by remove_conflicting_framebuffers, as can be shown by following show blocked state trace on a test program which loads i915 and runs another forked processes writing to state attribute: Test process with semaphore held and trying to get fb_info lock: .. fb-test2 D 0000000000000000 0 237 228 0x00000000 ffff8800774f3d68 0000000000000082 00000000000135c0 00000000000135c0 ffff880000000000 ffff8800774f3fd8 ffff8800774f3fd8 ffff880076ee4530 00000000000135c0 ffff8800774f3fd8 ffff8800774f2000 00000000000135c0 Call Trace: [] __mutex_lock_slowpath+0x11a/0x1e0 [] ? _raw_spin_lock_irq+0x22/0x40 [] mutex_lock+0x23/0x50 [] lock_fb_info+0x25/0x60 [] fb_set_suspend+0x20/0x80 [] store_fbstate+0x4f/0x70 [] dev_attr_store+0x20/0x30 [] sysfs_write_file+0xd4/0x160 [] vfs_write+0xc6/0x190 [] sys_write+0x51/0x90 [] system_call_fastpath+0x16/0x1b .. modprobe process stalled because has the fb_info lock (got inside unregister_framebuffer) but waiting for the semaphore held by the test process which is waiting to get the fb_info lock: .. modprobe D 0000000000000000 0 230 218 0x00000000 ffff880077a4d618 0000000000000082 0000000000000001 0000000000000001 ffff880000000000 ffff880077a4dfd8 ffff880077a4dfd8 ffff8800775a2e20 00000000000135c0 ffff880077a4dfd8 ffff880077a4c000 00000000000135c0 Call Trace: [] schedule_timeout+0x215/0x310 [] ? get_parent_ip+0x11/0x50 [] __down+0x6d/0xb0 [] down+0x41/0x50 [] acquire_console_sem+0x2c/0x50 [] unbind_con_driver+0xad/0x2d0 [] fbcon_event_notify+0x457/0x890 [] ? _raw_spin_unlock_irqrestore+0x1f/0x50 [] ? get_parent_ip+0x11/0x50 [] notifier_call_chain+0x4d/0x70 [] __blocking_notifier_call_chain+0x58/0x80 [] blocking_notifier_call_chain+0x16/0x20 [] fb_notifier_call_chain+0x1b/0x20 [] unregister_framebuffer+0x7c/0x130 [] remove_conflicting_framebuffers+0x153/0x180 [] register_framebuffer+0x93/0x2c0 [] drm_fb_helper_single_fb_probe+0x252/0x2f0 [drm_kms_helper] [] drm_fb_helper_initial_config+0x2f3/0x6d0 [drm_kms_helper] [] ? drm_fb_helper_single_add_all_connectors+0x5d/0x1c0 [drm_kms_helper] [] intel_fbdev_init+0xa8/0x160 [i915] [] i915_driver_load+0x854/0x12b0 [i915] [] drm_get_pci_dev+0x19e/0x360 [drm] [] ? sub_preempt_count+0x9d/0xd0 [] i915_pci_probe+0x15/0x17 [i915] [] local_pci_probe+0x5f/0xd0 [] pci_device_probe+0x119/0x120 [] ? driver_sysfs_add+0x7a/0xb0 [] driver_probe_device+0xa3/0x290 [] ? __driver_attach+0x0/0xb0 [] __driver_attach+0xab/0xb0 [] ? __driver_attach+0x0/0xb0 [] bus_for_each_dev+0x5e/0x90 [] driver_attach+0x1e/0x20 [] bus_add_driver+0xe2/0x320 [] ? i915_init+0x0/0x96 [i915] [] driver_register+0x76/0x140 [] ? i915_init+0x0/0x96 [i915] [] __pci_register_driver+0x56/0xd0 [] drm_pci_init+0xe4/0xf0 [drm] [] ? i915_init+0x0/0x96 [i915] [] drm_init+0x58/0x70 [drm] [] i915_init+0x94/0x96 [i915] [] do_one_initcall+0x44/0x190 [] sys_init_module+0xcb/0x210 [] system_call_fastpath+0x16/0x1b .. fb-test2 which reproduces above is available on kernel.org bug #26232. To solve this issue, avoid calling lock_fb_info inside fb_set_suspend, and move it out to where needed (callers of fb_set_suspend must call lock_fb_info before if needed). So far, the only place which needs to call lock_fb_info is store_fbstate, all other places which calls fb_set_suspend are suspend/resume hooks that should not need the lock as they should be run only when processes are already frozen in suspend/resume. References: https://bugzilla.kernel.org/show_bug.cgi?id=26232 Signed-off-by: Herton Ronaldo Krzesinski Signed-off-by: Florian Tobias Schandinat Signed-off-by: Greg Kroah-Hartman commit 4817ab23763560a00d8f0fb9937c439cb1e221ac Author: Jean Delvare Date: Fri Jul 8 11:04:38 2011 +0200 carminefb: Fix module parameters permissions commit c84c14224bbca6ec60d5851fcc87be0e34df2f44 upstream. The third parameter of module_param is supposed to be an octal value. The missing leading "0" causes the following: $ ls -l /sys/module/carminefb/parameters/ total 0 -rw-rwxr-- 1 root root 4096 Jul 8 08:55 fb_displays -rw-rwxr-- 1 root root 4096 Jul 8 08:55 fb_mode -rw-rwxr-- 1 root root 4096 Jul 8 08:55 fb_mode_str After fixing the perm parameter, we get the expected: $ ls -l /sys/module/carminefb/parameters/ total 0 -r--r--r-- 1 root root 4096 Jul 8 08:56 fb_displays -r--r--r-- 1 root root 4096 Jul 8 08:56 fb_mode -r--r--r-- 1 root root 4096 Jul 8 08:56 fb_mode_str Signed-off-by: Jean Delvare Cc: Paul Mundt Cc: Sebastian Siewior Signed-off-by: Paul Mundt Signed-off-by: Greg Kroah-Hartman commit 2570d310e29899e6b6754198b6a85f0c8a5fd109 Author: Joerg Roedel Date: Tue Oct 11 17:41:32 2011 +0200 iommu/amd: Fix wrong shift direction commit fcd0861db1cf4e6ed99f60a815b7b72c2ed36ea4 upstream. The shift direction was wrong because the function takes a page number and i is the address is the loop. Signed-off-by: Joerg Roedel Signed-off-by: Greg Kroah-Hartman commit 78cffaa4aa23af882a66352cfc55a6b9ac404d56 Author: Dmitry Torokhov Date: Wed Sep 7 15:00:02 2011 -0700 WMI: properly cleanup devices to avoid crashes commit 023b9565972a4a5e0f01b9aa32680af6e9b5c388 upstream. We need to remove devices that we destroy from the list, otherwise we'll crash if there are more than one "_WDG" methods in DSDT. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=32052 Tested-by: Ilya Tumaykin Signed-off-by: Dmitry Torokhov Acked-by: Carlos Corbacho Signed-off-by: Matthew Garrett Signed-off-by: Greg Kroah-Hartman commit caca58832e441c347c3a236b5356eaa7c3c7c49f Author: Sebastian Ott Date: Sun Oct 30 15:16:52 2011 +0100 ccwgroup: move attributes to attribute group commit dbdf1afcaaabe83dea15a3cb9b9013e73ae3b1ad upstream. Put sysfs attributes of ccwgroup devices in an attribute group to ensure that these attributes are actually present when userspace is notified via uevents. Signed-off-by: Sebastian Ott Signed-off-by: Martin Schwidefsky Signed-off-by: Greg Kroah-Hartman commit 4dc17f0c422d685fb1e31e5cb6762bc1322843b0 Author: Martin Schwidefsky Date: Sun Oct 30 15:16:08 2011 +0100 memory leak with RCU_TABLE_FREE commit e73b7fffe487c315fd1a4fa22282e3362b440a06 upstream. The rcu page table free code uses a couple of bits in the page table pointer passed to tlb_remove_table to discern the different page table types. __tlb_remove_table extracts the type with an incorrect mask which leads to memory leaks. The correct mask is ((FRAG_MASK << 4) | FRAG_MASK). Signed-off-by: Martin Schwidefsky Signed-off-by: Greg Kroah-Hartman commit 98ef836b07bd10dec2b07d2c11a6357f7909f978 Author: Martin Schwidefsky Date: Sun Oct 30 15:16:07 2011 +0100 user per registers vs. ptrace single stepping commit a45aff5285871bf7be1781d9462d3fdbb6c913f9 upstream. git commit 5e9a2692 "[S390] ptrace cleanup" introduced a regression for the case when both a user PER set (e.g. a storage alteration trace) and PTRACE_SINGLESTEP are active. The new code will overrule the user PER set with a instruction-fetch PER set over the whole address space for ptrace single stepping. The inferior process will be stopped after each instruction with an instruction fetch event. Any other events that may have occurred concurrently are not reported (e.g. storage alteration event) because the control bits for them are not set. The solution is to merge the PER control bits of the user PER set with the PER_EVENT_IFETCH control bit for PTRACE_SINGLESTEP. Signed-off-by: Martin Schwidefsky Signed-off-by: Greg Kroah-Hartman commit 715afafe876a366e0d71d98cdee585e0c7f64044 Author: Carsten Otte Date: Tue Oct 18 12:27:12 2011 +0200 KVM: s390: check cpu_id prior to using it commit 4d47555a80495657161a7e71ec3014ff2021e450 upstream. We use the cpu id provided by userspace as array index here. Thus we clearly need to check it first. Ooops. Signed-off-by: Carsten Otte Signed-off-by: Christian Borntraeger Signed-off-by: Marcelo Tosatti Signed-off-by: Greg Kroah-Hartman commit 427dd3016f4dea9153207f8f5cac4fcf285bdf54 Author: Susan Gao Date: Thu Sep 29 11:08:18 2011 +0100 ASoC: Fix a bug in WM8962 DSP_A and DSP_B settings commit fbc7c62a3ff831aef24894b7982cd1adb2b7e070 upstream. Signed-off-by: Susan Gao Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit fe0c608d1d02d7618a8404fd740b5fb1124605de Author: Mark Brown Date: Fri Sep 23 21:26:33 2011 +0100 ASoC: Remove direct register cache accesses from WM8962 driver commit 38f3f31a0a797bdbcc0cdb12553bbecc2f9a91c4 upstream. Also fix return values for speaker switch updates. Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 047885f24f492854e00996720e900f0dbcde4cec Author: Axel Lin Date: Thu Oct 20 12:13:24 2011 +0800 ASoC: wm8994: Use SND_SOC_DAPM_AIF_OUT for AIF3 Capture commit 35024f4922f7b271e7529673413889aa3d51c5fc upstream. Signed-off-by: Axel Lin Acked-by: Liam Girdwood Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit a18470be6afe994201aec8e3c45bd0079df5364d Author: Axel Lin Date: Tue Oct 4 22:07:18 2011 +0800 ASoC: wm8994: Fix setting rate_reg for wm8994-aif2 commit c527e6aadc8f142ad388b6aa59a1ce6a4bfb1966 upstream. For wm8994-aif2, the rate_reg should be WM8994_AIF2_RATE. Signed-off-by: Axel Lin Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit ba69b896ad2634f80a1e8ffae4196cc16c835569 Author: Axel Lin Date: Fri Oct 21 10:44:07 2011 +0800 ASoC: wm8996: Fix wrong mask for setting WM8996_AIF_CLOCKING_2 commit 3205e6629bc0eb747fb7d1b4b8fec00b7b919e58 upstream. Signed-off-by: Axel Lin Acked-by: Liam Girdwood Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 8a01ef312df45fa685e687d2de25a2ebebcad532 Author: Axel Lin Date: Thu Oct 13 17:17:06 2011 +0800 ASoC: ak4535: fixup cache register table commit 7c04241acbdaf97f1448dcccd27ea0fcd1a57684 upstream. ak4535_reg should be 8bit, but cache table is defined as 16bit. Signed-off-by: Axel Lin Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 78e2d997086452b780857682c155e3167274528b Author: Kuninori Morimoto Date: Thu Oct 13 02:03:54 2011 -0700 ASoC: ak4642: fixup cache register table commit 19b115e523208a926813751aac8934cf3fc6085e upstream. ak4642 register was 8bit, but cache table was defined as 16bit. ak4642 doesn't work correctry without this patch. Signed-off-by: Kuninori Morimoto Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit c53b51237441c749675b2ef1c3a194f7358a0924 Author: Axel Lin Date: Mon Oct 17 20:14:56 2011 +0800 ASoC: wm8741: Fix setting interface format for DSP modes commit 3a340104fad6ecbea5ad6792a2ea855f0507a6e0 upstream. According to the datasheet: Format Control (05h) BITS[3:2] FMT[1:0] Audio data format selection 00 = right justified mode 01 = left justified mode 10 = I2S mode 11 = DSP mode BIT[4] LRP Polarity selec for LRCLK/DSP mode select 0 = normal LRCLK poalrity/DSP mode A 1 = inverted LRCLK poarity/DSP mode B For SND_SOC_DAIFMT_DSP_A, we should set 0x000C instead of 0x0003. For SND_SOC_DAIFMT_DSP_B, we should set 0x001C instead of 0x0013. Signed-off-by: Axel Lin Acked-by: Liam Girdwood Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 7ee913a7aea14df8d8e8b9d464a17b60990c9a46 Author: Axel Lin Date: Wed Oct 26 09:53:41 2011 +0800 ASoC: wm8940: Properly set codec->dapm.bias_level commit 5927f94700e860ae27ff24e7f3bc9e4f7b9922eb upstream. Reported-by: Chris Paulson-Ellis Signed-off-by: Axel Lin Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 12b9a1c1f27e73e4ff6e57f1787eed9d06429f74 Author: Daniel Vetter Date: Wed Sep 28 11:57:23 2011 +0200 io-mapping: ensure io_mapping_map_atomic _is_ atomic commit 24dd85ff723f142093f44244764b9b5c152235b8 upstream. For the !HAVE_ATOMIC_IOMAP case the stub functions did not call pagefault_disable/_enable. The i915 driver relies on the map actually being atomic, otherwise it can deadlock with it's own pagefault handler in the gtt pwrite fastpath. This is exercised by gem_mmap_gtt from the intel-gpu-toosl gem testsuite. v2: Chris Wilson noted the lack of an include. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=38115 Signed-off-by: Daniel Vetter Reviewed-by: Chris Wilson Signed-off-by: Keith Packard Signed-off-by: Greg Kroah-Hartman commit ac155955e6fa06982e0a310c154c279aad0cc91f Author: Bryan Schumaker Date: Fri Oct 7 13:41:15 2011 -0400 vfs: add "device" tag to /proc/self/mountstats commit a877ee03ac010ded434b77f7831f43cbb1fcc60f upstream. nfsiostat was failing to find mounted filesystems on kernels after 2.6.38 because of changes to show_vfsstat() by commit c7f404b40a3665d9f4e9a927cc5c1ee0479ed8f9. This patch adds back the "device" tag before the nfs server entry so scripts can parse the mountstats file correctly. Signed-off-by: Bryan Schumaker Signed-off-by: Christoph Hellwig Signed-off-by: Greg Kroah-Hartman commit 3a1f47cef0246bfcbd8719f2191754c3a7b86c0b Author: J. Bruce Fields Date: Mon Oct 10 17:34:31 2011 -0400 nfsd4: ignore WANT bits in open downgrade commit c30e92df30d7d5fe65262fbce5d1b7de675fe34e upstream. We don't use WANT bits yet--and sending them can probably trigger a BUG() further down. Signed-off-by: J. Bruce Fields Signed-off-by: Greg Kroah-Hartman commit 68251a1702ee17bd375a5b7907ce8794d7dadf6d Author: J. Bruce Fields Date: Mon Sep 19 15:07:41 2011 -0400 nfsd4: fix open downgrade, again commit 3d02fa29dec920c597dd7b7db608a4bc71f088ce upstream. Yet another open-management regression: - nfs4_file_downgrade() doesn't remove the BOTH access bit on downgrade, so the server's idea of the stateid's access gets out of sync with the client's. If we want to keep an O_RDWR open in this case, we should do that in the file_put_access logic rather than here. - We forgot to convert v4 access to an open mode here. This logic has proven too hard to get right. In the future we may consider: - reexamining the lock/openowner relationship (locks probably don't really need to take their own references here). - adding open upgrade/downgrade support to the vfs. - removing the atomic operations. They're redundant as long as this is all under some other lock. Also, maybe some kind of additional static checking would help catch O_/NFS4_SHARE_ACCESS confusion. Signed-off-by: J. Bruce Fields Signed-off-by: Greg Kroah-Hartman commit fdbc365c5c59f7b8ce619299097225e556e4f0f7 Author: J. Bruce Fields Date: Thu Aug 25 10:48:39 2011 -0400 nfsd4: permit read opens of executable-only files commit a043226bc140a2c1dde162246d68a67e5043e6b2 upstream. A client that wants to execute a file must be able to read it. Read opens over nfs are therefore implicitly allowed for executable files even when those files are not readable. NFSv2/v3 get this right by using a passed-in NFSD_MAY_OWNER_OVERRIDE on read requests, but NFSv4 has gotten this wrong ever since dc730e173785e29b297aa605786c94adaffe2544 "nfsd4: fix owner-override on open", when we realized that the file owner shouldn't override permissions on non-reclaim NFSv4 opens. So we can't use NFSD_MAY_OWNER_OVERRIDE to tell nfsd_permission to allow reads of executable files. So, do the same thing we do whenever we encounter another weird NFS permission nit: define yet another NFSD_MAY_* flag. The industry's future standardization on 128-bit processors will be motivated primarily by the need for integers with enough bits for all the NFSD_MAY_* flags. Reported-by: Leonardo Borda Signed-off-by: J. Bruce Fields Signed-off-by: Greg Kroah-Hartman commit c86f82f0ef280dfe03d14d46b2265fbc63849efb Author: J. Bruce Fields Date: Wed Aug 10 19:16:22 2011 -0400 nfsd4: fix seqid_mutating_error commit 576163005de286bbd418fcb99cfd0971523a0c6d upstream. The set of errors here does *not* agree with the set of errors specified in the rfc! While we're there, turn this macros into a function, for the usual reasons, and move it to the one place where it's actually used. Signed-off-by: J. Bruce Fields Signed-off-by: Greg Kroah-Hartman commit ab10f211c7bbb1e5637eb4b31eae6447ff3ddcee Author: J. Bruce Fields Date: Wed Aug 10 19:07:33 2011 -0400 nfsd4: stop using nfserr_resource for transitory errors commit 3e77246393c0a433247631a1f0e9ec98d3d78a1c upstream. The server is returning nfserr_resource for both permanent errors and for errors (like allocation failures) that might be resolved by retrying later. Save nfserr_resource for the former and use delay/jukebox for the latter. Signed-off-by: J. Bruce Fields Signed-off-by: Greg Kroah-Hartman commit b44ecd56e9bf4d4b09c8639b7d13d2a931f0d0a5 Author: Bernd Schubert Date: Mon Aug 8 17:38:08 2011 +0200 nfsd4: Remove check for a 32-bit cookie in nfsd4_readdir() commit 832023bffb4b493f230be901f681020caf3ed1f8 upstream. Fan Yong noticed setting FMODE_32bithash wouldn't work with nfsd v4, as nfsd4_readdir() checks for 32 bit cookies. However, according to RFC 3530 cookies have a 64 bit type and cookies are also defined as u64 in 'struct nfsd4_readdir'. So remove the test for >32-bit values. Signed-off-by: Bernd Schubert Signed-off-by: J. Bruce Fields Signed-off-by: Greg Kroah-Hartman commit c56f5c1b3e815614d5bc92e19d1c7633fc1d07e2 Author: Jeff Layton Date: Wed Oct 12 10:57:42 2011 -0400 nfs: don't try to migrate pages with active requests commit 2da956523526e440ef4f4dd174e26f5ac06fe011 upstream. nfs_find_and_lock_request will take a reference to the nfs_page and will then put it if the req is already locked. It's possible though that the reference will be the last one. That put then can kick off a whole series of reference puts: nfs_page nfs_open_context dentry inode If the inode ends up being deleted, then the VFS will call truncate_inode_pages. That function will try to take the page lock, but it was already locked when migrate_page was called. The code deadlocks. Fix this by simply refusing the migration request if PagePrivate is already set, indicating that the page is already associated with an active read or write request. We've had a customer test a backported version of this patch and the preliminary results seem good. Cc: Andrea Arcangeli Reported-by: Harshula Jayasuriya Signed-off-by: Jeff Layton Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit cce574ff161d0f5e4263ed28a4a3785220802922 Author: Ian Campbell Date: Mon Oct 3 15:37:00 2011 +0100 genirq: Add IRQF_RESUME_EARLY and resume such IRQs earlier commit 9bab0b7fbaceec47d32db51cd9e59c82fb071f5a upstream. This adds a mechanism to resume selected IRQs during syscore_resume instead of dpm_resume_noirq. Under Xen we need to resume IRQs associated with IPIs early enough that the resched IPI is unmasked and we can therefore schedule ourselves out of the stop_machine where the suspend/resume takes place. This issue was introduced by 676dc3cf5bc3 "xen: Use IRQF_FORCE_RESUME". Signed-off-by: Ian Campbell Cc: Rafael J. Wysocki Cc: Jeremy Fitzhardinge Cc: xen-devel Cc: Konrad Rzeszutek Wilk Link: http://lkml.kernel.org/r/1318713254.11016.52.camel@dagon.hellion.org.uk Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit 734c81f73201c96a4669793c27f363a334770d79 Author: Steven Rostedt Date: Fri Oct 14 10:44:25 2011 -0400 tracing: Fix returning of duplicate data after EOF in trace_pipe_raw commit 436fc280261dcfce5af38f08b89287750dc91cd2 upstream. The trace_pipe_raw handler holds a cached page from the time the file is opened to the time it is closed. The cached page is used to handle the case of the user space buffer being smaller than what was read from the ring buffer. The left over buffer is held in the cache so that the next read will continue where the data left off. After EOF is returned (no more data in the buffer), the index of the cached page is set to zero. If a user app reads the page again after EOF, the check in the buffer will see that the cached page is less than page size and will return the cached page again. This will cause reading the trace_pipe_raw again after EOF to return duplicate data, making the output look like the time went backwards but instead data is just repeated. The fix is to not reset the index right after all data is read from the cache, but to reset it after all data is read and more data exists in the ring buffer. Reported-by: Jeremy Eder Signed-off-by: Steven Rostedt Signed-off-by: Greg Kroah-Hartman commit 16fd0c4105bb27e0050ce4a5d948408f7369ad63 Author: Masami Hiramatsu Date: Tue Oct 4 19:44:38 2011 +0900 ftrace/kprobes: Fix not to delete probes if in use commit 02ca1521ad404cf566e0075848f80d064c0a0503 upstream. Fix kprobe-tracer not to delete a probe if the probe is in use. In that case, delete operation will return -EBUSY. This bug can cause a kernel panic if enabled probes are deleted during perf record. (Add some probes on functions) sh-4.2# perf probe --del probe:\* sh-4.2# exit (kernel panic) This is originally reported on the fedora bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=742383 I've also checked that this problem doesn't happen on tracepoints when module removing because perf event locks target module. $ sudo ./perf record -e xfs:\* -aR sh sh-4.2# rmmod xfs ERROR: Module xfs is in use sh-4.2# exit [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.203 MB perf.data (~8862 samples) ] Signed-off-by: Masami Hiramatsu Cc: Arnaldo Carvalho de Melo Cc: Ingo Molnar Cc: Frederic Weisbecker Cc: Frank Ch. Eigler Link: http://lkml.kernel.org/r/20111004104438.14591.6553.stgit@fedora15 Signed-off-by: Steven Rostedt Signed-off-by: Greg Kroah-Hartman commit fa73b411b41b050e212a20fc33ab45f2eb781c24 Author: Masami Hiramatsu Date: Tue Oct 4 19:45:04 2011 +0900 perf probe: Fix to show correct error string commit 44a56040a0037a845d5fa218dffde464579f0cab upstream. Fix perf probe to show correct error string when it fails to delete an event. The write(2) returns -1 if failed, and errno stores real error number. Signed-off-by: Masami Hiramatsu Cc: Peter Zijlstra Cc: Arnaldo Carvalho de Melo Cc: Paul Mackerras Cc: Ingo Molnar Link: http://lkml.kernel.org/r/20111004104504.14591.41266.stgit@fedora15 Signed-off-by: Steven Rostedt Signed-off-by: Greg Kroah-Hartman commit 4921487cb0a15e3fb28bc0b2410890f8fe7b161e Author: NeilBrown Date: Wed Oct 26 10:31:04 2011 +1100 md/raid5: fix bug that could result in reads from a failed device. commit 355840e7a7e56bb2834fd3b0da64da5465f8aeaa upstream. This bug was introduced in 415e72d034c50520ddb7ff79e7d1792c1306f0c9 which was in 2.6.36. There is a small window of time between when a device fails and when it is removed from the array. During this time we might still read from it, but we won't write to it - so it is possible that we could read stale data. We didn't need the test of 'Faulty' before because the test on In_sync is sufficient. Since we started allowing reads from the early part of non-In_sync devices we need a test on Faulty too. This is suitable for any kernel from 2.6.36 onwards, though the patch might need a bit of tweaking in 3.0 and earlier. Signed-off-by: NeilBrown Signed-off-by: Greg Kroah-Hartman commit d6a615f1c468aa7583b671ab474d7abe25b105c0 Author: Jan Beulich Date: Wed Sep 28 16:44:54 2011 +0100 apic, i386/bigsmp: Fix false warnings regarding logical APIC ID mismatches commit 838312be46f3abfbdc175f81c3e54a857994476d upstream. These warnings (generally one per CPU) are a result of initializing x86_cpu_to_logical_apicid while apic_default is still in use, but the check in setup_local_APIC() being done when apic_bigsmp was already used as an override in default_setup_apic_routing(): Overriding APIC driver with bigsmp Enabling APIC mode: Physflat. Using 5 I/O APICs ------------[ cut here ]------------ WARNING: at .../arch/x86/kernel/apic/apic.c:1239 ... CPU 1 irqstacks, hard=f1c9a000 soft=f1c9c000 Booting Node 0, Processors #1 smpboot cpu 1: start_ip = 9e000 Initializing CPU#1 ------------[ cut here ]------------ WARNING: at .../arch/x86/kernel/apic/apic.c:1239 setup_local_APIC+0x137/0x46b() Hardware name: ... CPU1 logical APIC ID: 2 != 8 ... Fix this (for the time being, i.e. until x86_32_early_logical_apicid() will get removed again, as Tejun says ought to be possible) by overriding the previously stored values at the point where the APIC driver gets overridden. v2: Move this and the pre-existing override logic into arch/x86/kernel/apic/bigsmp_32.c. Signed-off-by: Jan Beulich Acked-by: Tejun Heo Link: http://lkml.kernel.org/r/4E835D16020000780005844C@nat28.tlf.novell.com Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 10bb7e9e824bc2d727a7b5a0813ded0461a293e9 Author: hank Date: Tue Sep 20 13:53:39 2011 -0700 time: Change jiffies_to_clock_t() argument type to unsigned long commit cbbc719fccdb8cbd87350a05c0d33167c9b79365 upstream. The parameter's origin type is long. On an i386 architecture, it can easily be larger than 0x80000000, causing this function to convert it to a sign-extended u64 type. Change the type to unsigned long so we get the correct result. Signed-off-by: hank Cc: John Stultz [ build fix ] Signed-off-by: Andrew Morton Signed-off-by: Thomas Gleixner Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 986666ccf6868d11606dc28973979806d5525af9 Author: Stanislaw Gruszka Date: Wed Oct 12 10:16:35 2011 +0200 iwlagn: fix priv->cfg->ht_params NULL pointer dereference commit 107ef97a170dec95893f34614edd92eb8cb9b5d0 upstream. This fix regression introduced by commit: commit 15b3f3b006b42a678523cad989bfd60b76bf4403 Author: Wey-Yi Guy Date: Fri Jun 3 07:54:13 2011 -0700 iwlagn: set smps mode after assoc for 1000 device Also remove unneeded brackets on the way. Address: https://bugzilla.redhat.com/show_bug.cgi?id=744155 Signed-off-by: Stanislaw Gruszka Acked-by: Wey-Yi Guy Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 212b9506b3f6b27cd0c3a2eed9ba1a3aa8d674d7 Author: Luciano Coelho Date: Thu Sep 22 10:06:10 2011 +0300 wl12xx: fix forced passive scans commit 6cd9d21a0c1e2648c07c32c66bb25795ad3208aa upstream. We were using incorrect max and min dwell times during forced passive scans because we were still using the active scan states to scan (passively) the channels that were not marked as passive. Instead of doing passive scans in active states, we now skip active states and scan for all channels in passive states. Signed-off-by: Luciano Coelho Signed-off-by: Greg Kroah-Hartman commit 6d06e8d0a5bcc13717291fe46303bfd32cfb9d7a Author: Richard Cochran Date: Fri Oct 21 00:49:15 2011 +0000 net: hold sock reference while processing tx timestamps commit da92b194cc36b5dc1fbd85206aeeffd80bee0c39 upstream. The pair of functions, * skb_clone_tx_timestamp() * skb_complete_tx_timestamp() were designed to allow timestamping in PHY devices. The first function, called during the MAC driver's hard_xmit method, identifies PTP protocol packets, clones them, and gives them to the PHY device driver. The PHY driver may hold onto the packet and deliver it at a later time using the second function, which adds the packet to the socket's error queue. As pointed out by Johannes, nothing prevents the socket from disappearing while the cloned packet is sitting in the PHY driver awaiting a timestamp. This patch fixes the issue by taking a reference on the socket for each such packet. In addition, the comments regarding the usage of these function are expanded to highlight the rule that PHY drivers must use skb_complete_tx_timestamp() to release the packet, in order to release the socket reference, too. These functions first appeared in v2.6.36. Reported-by: Johannes Berg Signed-off-by: Richard Cochran Signed-off-by: Eric Dumazet Reviewed-by: Johannes Berg Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit f9aea842ccd9be4c49e90c848afd187dd9880638 Author: Johannes Berg Date: Tue Oct 4 18:27:10 2011 +0200 mac80211: fix offchannel TX cookie matching commit 28a1bcdb57d50f3038a255741ecc83e391e5282e upstream. When I introduced in-kernel off-channel TX I introduced a bug -- the work can't be canceled again because the code clear the skb pointer. Fix this by keeping track separately of whether TX status has already been reported. Reported-by: Jouni Malinen Tested-by: Jouni Malinen Signed-off-by: Johannes Berg Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 94ae8dc8223b4ec190c4de2b8bee90f5eff1f6cc Author: Richard Cochran Date: Fri Oct 21 00:49:17 2011 +0000 dp83640: free packet queues on remove commit 8b3408f8ee994973869d8ba32c5bf482bc4ddca4 upstream. If the PHY should disappear (for example, on an USB Ethernet MAC), then the driver would leak any undelivered time stamp packets. This commit fixes the issue by calling the appropriate functions to free any packets left in the transmit and receive queues. The driver first appeared in v3.0. Signed-off-by: Richard Cochran Acked-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 75938a8059eade538a6616f52a5af2c138301d48 Author: Eric W. Biederman Date: Fri Oct 21 06:24:20 2011 +0000 rtnetlink: Add missing manual netlink notification in dev_change_net_namespaces commit d2237d35748e7f448a9c2d9dc6a85ef637466e24 upstream. Renato Westphal noticed that since commit a2835763e130c343ace5320c20d33c281e7097b7 "rtnetlink: handle rtnl_link netlink notifications manually" was merged we no longer send a netlink message when a networking device is moved from one network namespace to another. Fix this by adding the missing manual notification in dev_change_net_namespaces. Since all network devices that are processed by dev_change_net_namspaces are in the initialized state the complicated tests that guard the manual rtmsg_ifinfo calls in rollback_registered and register_netdevice are unnecessary and we can just perform a plain notification. Tested-by: Renato Westphal Signed-off-by: Eric W. Biederman Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 94ab1982e35ba7f316df7a3c53f155ddc8e7ceee Author: Ming Lei Date: Fri Oct 7 11:50:22 2011 +0800 ata_piix: make DVD Drive recognisable on systems with Intel Sandybridge chipsets(v2) commit 5e5a4f5d5a08c9c504fe956391ac3dae2c66556d upstream. This quirk patch fixes one kind of bug inside some Intel Sandybridge chipsets, see reports from https://bugzilla.kernel.org/show_bug.cgi?id=40592. Many guys also have reported the problem before: https://bugs.launchpad.net/bugs/737388 https://bugs.launchpad.net/bugs/794642 https://bugs.launchpad.net/bugs/782389 ...... With help from Tejun, the problem is found to be caused by 32bit PIO mode, so introduce the quirk patch to disable 32bit PIO on SATA piix for some Sandybridge CPT chipsets. Seth also tested the patch on all five affected chipsets (pci device ID: 0x1c00, 0x1c01, 0x1d00, 0x1e00, 0x1e01), and found the patch does fix the problem. Tested-by: Heasley, Seth Cc: Alan Cox Signed-off-by: Ming Lei Acked-by: Tejun Heo Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit 9c8b701a3df234e8ebc4caa66745720084a2083d Author: Jeff Layton Date: Tue Oct 11 09:49:21 2011 -0400 nfs: don't redirty inode when ncommit == 0 in nfs_commit_unstable_pages commit 3236c3e1adc0c7ec83eaff1de2d06746b7c5bb28 upstream. commit 420e3646 allowed the kernel to reduce the number of unnecessary commit calls by skipping the commit when there are a large number of outstanding pages. However, the current test in nfs_commit_unstable_pages does not handle the edge condition properly. When ncommit == 0, then that means that the kernel doesn't need to do anything more for the inode. The current test though in the WB_SYNC_NONE case will return true, and the inode will end up being marked dirty. Once that happens the inode will never be clean until there's a WB_SYNC_ALL flush. Fix this by immediately returning from nfs_commit_unstable_pages when ncommit == 0. Mike noticed this problem initially in RHEL5 (2.6.18-based kernel) which has a backported version of 420e3646. The inode cache there was growing very large. The inode cache was unable to be shrunk since the inodes were all marked dirty. Calling sync() would essentially "fix" the problem -- the WB_SYNC_ALL flush would result in the inodes all being marked clean. What I'm not clear on is how big a problem this is in mainline kernels as the writeback code there is very different. Either way, it seems incorrect to re-mark the inode dirty in this case. Reported-by: Mike McLean Signed-off-by: Jeff Layton Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 53e34d24256cd58db78debd2599f1d49b51a60d8 Author: Peng Tao Date: Thu Sep 22 21:50:10 2011 -0400 SUNRPC/NFS: make rpc pipe upcall generic commit c1225158a8dad9e9d5eee8a17dbbd9c7cda05ab9 upstream. The same function is used by idmap, gss and blocklayout code. Make it generic. Signed-off-by: Peng Tao Signed-off-by: Jim Rees Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit ddd5310cb95cac1f698d3f9e35c454e32699b81d Author: Trond Myklebust Date: Mon Oct 17 18:22:55 2011 -0700 Revert "NFS: Ensure that writeback_single_inode() calls write_inode() when syncing" commit 59b7c05fffba030e5d9e72324691e2f99aa69b79 upstream. This reverts commit b80c3cb628f0ebc241b02e38dd028969fb8026a2. The reverted commit was rendered obsolete by a VFS fix: commit 5547e8aac6f71505d621a612de2fca0dd988b439 (writeback: Update dirty flags in two steps). We now no longer need to worry about writeback_single_inode() missing our marking the inode for COMMIT in 'do_writepages()' call. Reverting this patch, fixes a performance regression in which the inode would continuously get queued to the dirty list, causing the writeback code to unnecessarily try to send a COMMIT. Signed-off-by: Trond Myklebust Tested-by: Simon Kirby Signed-off-by: Greg Kroah-Hartman commit 112e8e4019fdf3fc987cf0f839a2bfbd6c169e60 Author: Jiri Kosina Date: Wed Oct 26 13:10:39 2011 +1030 kmod: prevent kmod_loop_msg overflow in __request_module() commit 37252db6aa576c34fd794a5a54fb32d7a8b3a07a upstream. Due to post-increment in condition of kmod_loop_msg in __request_module(), the system log can be spammed by much more than 5 instances of the 'runaway loop' message if the number of events triggering it makes the kmod_loop_msg to overflow. Fix that by making sure we never increment it past the threshold. Signed-off-by: Jiri Kosina Signed-off-by: Rusty Russell Signed-off-by: Greg Kroah-Hartman commit 9c348b765479ebc59251c84147bfe008b8ecafe6 Author: Peng Tao Date: Thu Sep 22 21:50:17 2011 -0400 pnfsblock: fix writeback deadlock commit 7542274519b3ba87555410c66e8356ac1e3bc9b3 upstream. We should check if the sector is already initialized before trying to grab the page from page cache. Otherwise when two pages of the same block are written back by two threads each calling from writepage_locked, it can cause deadlock like bellow. [ 1080.972099] INFO: task kswapd0:25 blocked for more than 120 seconds. [ 1080.972377] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1080.972812] kswapd0 D ffff88000c4926c0 0 25 2 0x00000000 [ 1080.972816] ffff88000df276b0 0000000000000046 ffff88000df27640 ffffffff81013ba7 [ 1080.972821] ffff88000c492310 ffff88000df27fd8 ffff88000df27fd8 00000000001d3440 [ 1080.972824] ffff88000c378000 ffff88000c492310 ffff8800175d3d40 ffff880017fc75a8 [ 1080.972828] Call Trace: [ 1080.972860] [] ? read_tsc+0x9/0x19 [ 1080.972877] [] ? lock_page+0x2b/0x2b [ 1080.972899] [] io_schedule+0x63/0x7e [ 1080.972902] [] sleep_on_page+0xe/0x12 [ 1080.972905] [] __wait_on_bit_lock+0x46/0x8f [ 1080.972916] [] ? lock_release_holdtime.part.7+0x6b/0x72 [ 1080.972919] [] __lock_page+0x66/0x68 [ 1080.972928] [] ? autoremove_wake_function+0x3d/0x3d [ 1080.972932] [] lock_page+0x27/0x2b [ 1080.972934] [] find_lock_page+0x34/0x57 [ 1080.972937] [] find_or_create_page+0x34/0x8a [ 1080.972947] [] bl_write_pagelist+0x205/0x6da [blocklayoutdriver] [ 1080.972951] [] ? bl_free_lseg+0x38/0x38 [blocklayoutdriver] [ 1080.972995] [] ? nfs_write_rpcsetup+0x118/0x123 [nfs] [ 1080.973033] [] pnfs_generic_pg_writepages+0x10b/0x1f4 [nfs] [ 1080.973089] [] nfs_pageio_doio+0x1a/0x43 [nfs] [ 1080.973098] [] nfs_pageio_complete+0x16/0x2d [nfs] [ 1080.973108] [] nfs_writepage_locked+0xa0/0xbf [nfs] [ 1080.973119] [] nfs_writepage+0x16/0x2b [nfs] [ 1080.973122] [] ? clear_page_dirty_for_io+0x87/0x9a [ 1080.973133] [] shrink_page_list+0x39b/0x6c8 [ 1080.973139] [] shrink_inactive_list+0x22c/0x39e [ 1080.973144] [] ? lock_release_holdtime.part.7+0x6b/0x72 [ 1080.973148] [] shrink_zone+0x445/0x588 [ 1080.973152] [] balance_pgdat+0x2c2/0x56b [ 1080.973170] [] ? __bitmap_weight+0x34/0x80 [ 1080.973175] [] kswapd+0x2be/0x2fa [ 1080.973179] [] ? __init_waitqueue_head+0x4b/0x4b [ 1080.973183] [] ? balance_pgdat+0x56b/0x56b [ 1080.973187] [] kthread+0xa8/0xb0 [ 1080.973200] [] kernel_thread_helper+0x4/0x10 [ 1080.973205] [] ? __init_kthread_worker+0x5a/0x5a [ 1080.973210] [] ? gs_change+0x13/0x13 [ 1080.973213] no locks held by kswapd0/25. Signed-off-by: Peng Tao Signed-off-by: Jim Rees Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit e799f152fb72a820df19d11117f18d614f838054 Author: Peng Tao Date: Thu Sep 22 21:50:16 2011 -0400 pnfsblock: fix NULL pointer dereference commit e6d05a757c314ad88d0649d3835a8a1daa964236 upstream. bl_add_page_to_bio returns error pointer. bio should be reset to NULL in failure cases as the out path always calls bl_submit_bio. Signed-off-by: Peng Tao Signed-off-by: Jim Rees Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 01e4e1d23615e3b970480c63f7d9b0eeb4daa276 Author: Peng Tao Date: Thu Sep 22 21:50:15 2011 -0400 pnfs: recoalesce when ld read pagelist fails commit 9b7eecdcfeb943f130d86bbc249fde4994b6fe30 upstream. For pnfs pagelist read failure, we need to pg_recoalesce and resend IO to mds. Signed-off-by: Peng Tao Signed-off-by: Jim Rees Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 626a6d5541e87d0812a5246f46462a83f89ce683 Author: Peng Tao Date: Thu Sep 22 21:50:14 2011 -0400 pnfs: recoalesce when ld write pagelist fails commit 8ce160c5ef06cc89c2b6b26bfa5ef7a5ce2c93e0 upstream. For pnfs pagelist write failure, we need to pg_recoalesce and resend IO to mds. Signed-off-by: Peng Tao Signed-off-by: Jim Rees Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit bef05def5076587c99095a7c7fd3637b0c9ec178 Author: Peng Tao Date: Thu Sep 22 21:50:12 2011 -0400 pnfs: make _set_lo_fail generic commit 1b0ae068779874f54b55aac3a2a992bcf3f2c3c4 upstream. file layout and block layout both use it to set mark layout io failure bit. So make it generic. Signed-off-by: Peng Tao Signed-off-by: Jim Rees Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit f135656f64649c09545808f8846c33700f34f476 Author: Peng Tao Date: Thu Sep 22 21:50:11 2011 -0400 pnfsblock: add missing rpc_put_mount and path_put commit 760383f1ee4d14b0e0bdf0cddee648d9b8633429 upstream. Reviewed-by: Jeff Layton Signed-off-by: Peng Tao Signed-off-by: Jim Rees Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 7ab7073b8bc0f145644db0f6c0de2d90a05ae168 Author: Jim Rees Date: Thu Sep 22 21:50:09 2011 -0400 pnfsblock: fix size of upcall message commit fdc17abbc4b6094b34ee8ff5d91eaba8637594a2 upstream. Make the status field explicitly 32 bits. "...it's unlikely that the kernel and userspace would differ on the size of an int here, but it might be a good idea to go ahead and make that explicitly 32 bits in case we end up dealing with more exotic arches at some point in the future." Suggested-by: Jeff Layton Signed-off-by: Jim Rees Signed-off-by: Benny Halevy Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 029bc659415f3835a5ec6485b40cc2e53283c0dc Author: Jim Rees Date: Thu Sep 22 21:50:08 2011 -0400 pnfsblock: fix return code confusion commit 516f2e24faa7548a61d9ba790958528469c2e284 upstream. Always return PTR_ERR, not NULL, from nfs4_blk_get_deviceinfo and nfs4_blk_decode_device. Check for IS_ERR, not NULL, in bl_set_layoutdriver when calling nfs4_blk_get_deviceinfo. Signed-off-by: Jim Rees Signed-off-by: Benny Halevy Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 2a8796e3653ee5a99c16e029b22ec78b14818286 Author: David Herrmann Date: Tue Sep 20 09:16:12 2011 -0700 Platform: Fix error path in samsung-laptop init commit a7ea19926ffba86f373f6050a106cd162dbb9a78 upstream. samsung_init() should not return success if not all devices are initialized. Otherwise, samsung_exit() will dereference sdev NULL pointers and others. Signed-off-by: David Herrmann Signed-off-by: Greg Kroah-Hartman Signed-off-by: Matthew Garrett commit 9cb3ef17ebb449a3ae6deb564463b611fa945c32 Author: Jason Stubbs Date: Tue Sep 20 09:16:11 2011 -0700 platform: samsung_laptop: fix samsung brightness min/max calculations commit bee460be8c691c544e84ed678280ace6153104c6 upstream. The min_brightness value of the sabi_config is incorrectly used in brightness calculations. For the config where min_brightness = 1 and max_brightness = 8, the user visible range should be 0 to 7 with hardware being set in the range of 1 to 8. What is actually happening is that the user visible range is 0 to 8 with hardware being set in the range of -1 to 7. This patch fixes the above issue as well as a miscalculation that would occur in the case of min_brightness > 1. Signed-off-by: Jason Stubbs Signed-off-by: Greg Kroah-Hartman Signed-off-by: Matthew Garrett commit 9393a575db4d55a806d5b1250f6a9e987d8c8788 Author: Smelov Andrey Date: Tue Sep 20 09:16:10 2011 -0700 Platform: samsung_laptop: samsung backlight for R528/R728 commit 093ed561648d43263c009ea88abab21a31cd4f1d upstream. patch works for me, but I need to add "acpi_backlight=vendor" to kernel params Signed-off-by: Smelov Andrey Signed-off-by: Greg Kroah-Hartman Signed-off-by: Matthew Garrett commit c81e3126ff63f7b996c339541f0d276d4c3e93a7 Author: Tommaso Massimi Date: Tue Sep 20 09:16:09 2011 -0700 Platform: samsung_laptop: add support for X520 machines. commit 7500eeb08a179e61a4219288c21407d63d1e9c64 upstream. my samsung laptop would be very happy if you add these lines to the file drivers/platform/x86/samsung-laptop.c Signed-off-by: Greg Kroah-Hartman Signed-off-by: Matthew Garrett commit 54339c72b22d130b633c357fe374a9bd88b5cf6b Author: Stefan Beller Date: Tue Sep 20 09:16:08 2011 -0700 platform: samsung_laptop: add dmi information for Samsung R700 laptops commit f87d02996f05ec1789ceecce9ec839f629b7aa80 upstream. My DMI model is this: >dmesg |grep DMI [ 0.000000] DMI present. [ 0.000000] DMI: SAMSUNG ELECTRONICS CO., LTD. SR700/SR700, BIOS 04SR 02/20/2008 adding dmi information of Samsung R700 laptops This adds the dmi information of Samsungs R700 laptops. Signed-off-by: Stefan Beller Signed-off-by: Greg Kroah-Hartman Signed-off-by: Matthew Garrett commit 7725834e59651e172bf812c435d9b6867b15892f Author: David Woodhouse Date: Mon Oct 24 21:25:21 2011 +0000 caif: Fix BUG() with network namespaces commit 08613e4626c06ca408fc55071f6aedee36986a87 upstream. The caif code will register its own pernet_operations, and then register a netdevice_notifier. Each time the netdevice_notifier is triggered, it'll do some stuff... including a lookup of its own pernet stuff with net_generic(). If the net_generic() call ever returns NULL, the caif code will BUG(). That doesn't seem *so* unreasonable, I suppose — it does seem like it should never happen. However, it *does* happen. When we clone a network namespace, setup_net() runs through all the pernet_operations one at a time. It gets to loopback before it gets to caif. And loopback_net_init() registers a netdevice... while caif hasn't been initialised. So the caif netdevice notifier triggers, and immediately goes BUG(). We could imagine a complex and overengineered solution to this generic class of problems, but this patch takes the simple approach. It just makes caif_device_notify() *not* go looking for its pernet data structures if the device it's being notified about isn't a caif device in the first place. Signed-off-by: David Woodhouse Acked-by: Sjur Brændeland Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit c9f58861ac90db24064789f6edcad255c2621ce9 Author: Milan Broz Date: Mon Aug 22 15:51:34 2011 +0200 kobj_uevent: Ignore if some listeners cannot handle message commit ebf4127cd677e9781b450e44dfaaa1cc595efcaa upstream. kobject_uevent() uses a multicast socket and should ignore if one of listeners cannot handle messages or nobody is listening at all. Easily reproducible when a process in system is cloned with CLONE_NEWNET flag. (See also http://article.gmane.org/gmane.linux.kernel.device-mapper.dm-crypt/5256) Signed-off-by: Milan Broz Acked-by: Kay Sievers Signed-off-by: Greg Kroah-Hartman commit 5de4a6505f61c1edd821e48795581a19f8f2d6dc Author: Adam Cozzette Date: Wed Aug 24 12:22:37 2011 -0600 ums_realtek: do not use stack memory for DMA commit 065e60964e293227e4feb0c1f7e27e609316ed9a upstream. This patch changes rts51x_read_mem, rts51x_write_mem, and rts51x_read_status to allocate temporary buffers with kmalloc. This way stack addresses are not used for DMA when these functions call rts51x_bulk_transport. Signed-off-by: Adam Cozzette Signed-off-by: Greg Kroah-Hartman commit 3401c775a446527091f720a6c65a1ecc7644776a Author: Konrad Rzeszutek Wilk Date: Fri Jul 22 12:51:48 2011 -0400 xen-swiotlb: Fix wrong panic. commit ab2a47bd242d6cdcf6b2b64797f271c6f0a6d338 upstream. Propagate the baremetal git commit "swiotlb: fix wrong panic" (fba99fa38b023224680308a482e12a0eca87e4e1) in the Xen-SWIOTLB version. wherein swiotlb's map_page wrongly calls panic() when it can't find a buffer fit for device's dma mask. It should return an error instead. Devices with an odd dma mask (i.e. under 4G) like b44 network card hit this bug (the system crashes): http://marc.info/?l=linux-kernel&m=129648943830106&w=2 If xen-swiotlb returns an error, b44 driver can use the own bouncing mechanism. Signed-off-by: Konrad Rzeszutek Wilk Signed-off-by: Greg Kroah-Hartman commit 6d473ffdabc38ccad26986f61a2e10fd487bb86d Author: Konrad Rzeszutek Wilk Date: Fri Jul 22 12:18:43 2011 -0400 xen-pcifront: Update warning comment to use 'e820_host' option. commit 917e3e65c35459d52f0d0b890aa5df0cad07a051 upstream. With Xen changeset 23428 "libxl: Add 'e820_host' option to config file" the E820 as seen from the host can now be passed into the guest. This means that a PV guest can now: - Use the correct PCI I/O gap. Before these patches, Linux guest would boot up and would tell: [ 0.000000] Allocating PCI resources starting at 40000000 (gap: 40000000:c0000000) while in actuality the PCI I/O gap should have been: [ 0.000000] Allocating PCI resources starting at b0000000 (gap: b0000000:4c000000) - The PV domain with PCI devices was limited to 3GB. It now can be booted with 4GB, 8GB, or whatever number you want. The PCI devices will now _not_ conflict with System RAM. Meaning the drivers can load. CC: Jesse Barnes CC: linux-pci@vger.kernel.org [v2: Made the string less broken up. Suggested by Joe Perches] Signed-off-by: Konrad Rzeszutek Wilk Signed-off-by: Greg Kroah-Hartman commit 26b90428f17961c1983f961f7e7ae9365cf1043d Author: Josh Boyer Date: Mon Oct 17 21:16:39 2011 -0400 Update email address for stable patch submission commit 5fa224295f0e0358c8bc0e5390702338df889def upstream. The stable@kernel.org email address has been replaced with the stable@vger.kernel.org mailing list. Change the stable kernel rules to reference the new list instead of the semi-defunct email alias. Signed-off-by: Josh Boyer Signed-off-by: Greg Kroah-Hartman commit 6ed5bebf24c72d2c9c4950826335fff2dca8da22 Author: Russell King Date: Thu Oct 20 22:04:18 2011 +0100 ARM: smp: fix clipping of number of CPUs commit a06f916b7a9b57447ceb875eb0a89f1a66b31bca upstream. Rather than clipping the number of CPUs using the compile-time NR_CPUS constant, use the runtime nr_cpu_ids value instead. This allows the nr_cpus command line option to work as expected. Reported-by: Mark Salter Signed-off-by: Russell King Signed-off-by: Greg Kroah-Hartman commit c35ffa5200629d3e91cc508819d92ed4274d67ee Author: Jerry Huang Date: Tue Oct 18 13:09:48 2011 +0800 QE/FHCI: fixed the CONTROL bug commit 273d23574f9dacd9c63c80e7d63639a669aad441 upstream. For USB CONTROL transaction, when the data length is zero, the IN package is needed to finish this transaction in status stage. Signed-off-by: Jerry Huang Signed-off-by: Greg Kroah-Hartman commit b80ece94065343609f73fd82d45a7dfeae5279b2 Author: Sergei Kolzun Date: Thu Aug 4 00:25:56 2011 -0700 HID: ACRUX - fix enabling force feedback support commit 364b936fc38dec7653c690d710e10657af235a36 upstream. The config option needs to be a 'bool' and not a tristate, otheriwse force feedback support never makes it into the module. Signed-off-by: Sergei Kolzun Signed-off-by: Dmitry Torokhov Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit 69b5709c67c8647f56e37d522f608d9e48a1a878 Author: Jon Levell Date: Thu Sep 29 20:42:52 2011 +0100 USB: add quirk for Logitech C300 web cam commit 5b253d88cc6c65a23cefc457a5a4ef139913c5fc upstream. My webcam is a Logitech C300 and I get "chipmunk"ed squeaky sound. The following trivial patch fixes it. Signed-off-by: Jon Levell Signed-off-by: Greg Kroah-Hartman commit 7ea775ce8a1325ca58245523eddd8709d73993a0 Author: Felix Fietkau Date: Sat Oct 8 15:49:57 2011 +0200 ath9k: disable unnecessary PHY error reporting commit ac06697c79bad09e44a8b1d52104014016fb90de upstream. PHY errors relevant for ANI are always tracked by hardware counters, the bits that allow them to pass through the rx filter are independent of that. Enabling PHY errors in the rx filter often creates lots of useless DMA traffic and might be responsible for some of the rx dma stop failure warnings. Signed-off-by: Felix Fietkau Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit cfd45841b2cd3e91e57b613b32419dddecf9cdc7 Author: Mohammed Shafi Shajakhan Date: Fri Sep 30 11:31:27 2011 +0530 ath9k_hw: Fix number of GPIO pins for AR9287/9300 commit 6321eb0977b011ac61dfca36e7c69b2c4325b104 upstream. this patch fixes the assumption of maximum number of GPIO pins present in AR9287/AR9300. this fix is essential as we might encounter some functionality issues involved in accessing the status of GPIO pins which are all incorrectly assumed to be not within the range of max_num_gpio of AR9300/AR9287 chipsets Signed-off-by: Mohammed Shafi Shajakhan Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit b6fef1a36bb9e662e6f02e46f44d5085184f18b5 Author: Luis R. Rodriguez Date: Thu Sep 29 10:42:19 2011 -0700 ath9k_htc: add AVM FRITZ!WLAN 11N v2 support commit 8c34559b4a6df32e4af1b073397fa4dc189a5485 upstream. This was reported and tested by Martin Walter over at AVM GmbH Berlin. This also applies to 3.0.1 so sendint to stable. Cc: s.kirste@avm.de Cc: d.friedel@avm.de Cc: Martin Walter Cc: Peter Grabienski Tested-by: Martin Walter Signed-off-by: Luis R. Rodriguez Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 41a5bf6108079254a3f2aa82ab192ce641ebfbfd Author: Rajkumar Manoharan Date: Thu Sep 15 19:02:25 2011 +0530 ath9k_hw: Fix magnitude/phase coeff correction commit e9c10469cf3c71bc1c6b0f01319161e277d6ac9b upstream. Do the magnitude/phase coeff correction only if the outlier is detected. Updating wrong magnitude/phase coeff factor impacts not only tx gain setting but also leads to poor performance in congested networks. In the clear environment the impact is very minimal because the outlier happens very rarely according to the past experiment. It occured less than once every 1000 calibrations. Signed-off-by: Rajkumar Manoharan Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 9b463e944a682cf1cad8483172325c2864deeeba Author: Rajkumar Manoharan Date: Sat Aug 20 17:22:09 2011 +0530 ath9k_hw: Fix descriptor status of TxOpExceeded commit 2a15b394f8e46dd3e2ab365ab41cfa701d92fa77 upstream. Signed-off-by: Rajkumar Manoharan Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 63fd3173e6613bed17978c9a0843d20fc55f2642 Author: Luis R. Rodriguez Date: Tue Aug 23 15:07:31 2011 -0700 MAINTANERS: update Qualcomm Atheros addresses commit fe8e084455f273b32cc57a5fbaf6c22ef984d657 upstream. Qualcomm ate up Atheros, all of the old e-mail addresses no longer work and e-mails sent to it will bounce. Update the addresses to the new shiny Qualcomm Atheros (QCA) ones. Cc: stable@kernel.org Cc: netdev@vger.kernel.org Cc: jouni@qca.qualcomm.com Cc: yangjie@qca.qualcomm.com Cc: vthiagar@qca.qualcomm.com Cc: senthilb@qca.qualcomm.com Signed-off-by: Luis R. Rodriguez Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 53a7038255b9ff5e958eb4ffb5852385ce208d1c Author: Dan Williams Date: Tue Sep 13 13:52:52 2011 -0500 USB: option: add various ZTE device network interfaces to the blacklist commit c58a76cdd7ab5a945a44fd2d64f6faf40323f95b upstream. IDs found in the Windows driver's ZTEusbnet.inf file from the ZTE MF100 drivers (O2 UK). Also fixes the ZTE MF626 device since it really is distinct from the 4G Systems stick and apparently needs the net interface blacklisted too, while there's no indication (yet) that the 4G Systems stick does. Signed-off-by: Dan Williams Signed-off-by: Greg Kroah-Hartman commit 743d41c9900fb1c57ab7092330b39440ce9fd1ab Author: Dan Williams Date: Tue Sep 13 13:51:45 2011 -0500 USB: option: add ZTE product 0x0037 to sendsetup blacklist commit eb05ce567a81c592c58f4bdb96eb91ce96661c30 upstream. Signed-off-by: Dan Williams Signed-off-by: Greg Kroah-Hartman commit dae45875d85dfdbd34aed6d15846763dd9a3d41b Author: Dan Williams Date: Tue Sep 13 13:51:13 2011 -0500 USB: option: convert Huawei K3765, K4505, K4605 reservered interface to blacklist commit 0d905fd5ece4ab65e8407c450077744e1c8f661b upstream. That's what the blacklist is for... Signed-off-by: Dan Williams Signed-off-by: Greg Kroah-Hartman commit 027721a5bed0408d888c75a1f0fbfc2b347f6eb7 Author: Dan Williams Date: Tue Sep 13 13:49:41 2011 -0500 USB: option: convert interface blacklisting to bitfields commit b4626c10928c13ee73b013dcbc23676333e79b59 upstream. It's cleaner than the array stuff, and we're about to add a bunch more blacklist entries. Second, there are devices that need both the sendsetup and the reserved interface blacklists, which the current code can't accommodate. Signed-off-by: Dan Williams Signed-off-by: Greg Kroah-Hartman commit 3ff8d843b44ab55bb080b4b57af4aa74842eef56 Author: Peter Stuge Date: Mon Oct 10 03:34:54 2011 +0200 USB: ftdi_sio: Support TI/Luminary Micro Stellaris BD-ICDI Board commit 3687f641307eeff6f7fe31a88dc39db88e89238b upstream. Some Stellaris evaluation kits have the JTAG/SWD FTDI chip onboard, and some, like EK-LM3S9B90, come with a separate In-Circuit Debugger Interface Board. The ICDI board can also be used stand-alone, for other boards and chips than the kit it came with. The ICDI has both old style 20-pin JTAG connector and new style JTAG/SWD 10-pin 1.27mm pitch connector. Tested with EK-LM3S9B90, where the BD-ICDI board is included. Signed-off-by: Peter Stuge Signed-off-by: Greg Kroah-Hartman commit 283839dc10951e68bf127fa497d57f6176d210e1 Author: Hakan Kvist Date: Mon Oct 3 13:41:15 2011 +0200 USB: ftdi_sio: add PID for Sony Ericsson Urban commit 74bdf22b5c3858b06af46f19d05c23e76c40a3bb upstream. Add PID 0xfc8a, 0xfc8b for device Sony Ericsson Urban Signed-off-by: Hakan Kvist Signed-off-by: Oskar Andero Signed-off-by: Greg Kroah-Hartman commit bb5a6199e172f488f21fe4b4b24e4419decb5232 Author: Eric Benoit Date: Sat Sep 24 02:04:50 2011 -0400 USB: pl2303: add id for SMART device commit 598f0b703506da841d3459dc0c48506be14d1778 upstream. Add vendor and product ID for the SMART USB to serial adapter. These were meant to be used with their SMART Board whiteboards, but can be re-purposed for other tasks. Tested and working (at at least 9600 bps). Signed-off-by: Eric Benoit Signed-off-by: Greg Kroah-Hartman commit e7f5326684730b0bed49e6df926b36bf8e0d8ac7 Author: Oliver Neukum Date: Tue Sep 13 08:42:21 2011 +0200 USB: add RESET_RESUME for webcams shown to be quirky commit 2394d67e446bf616a0885167d5f0d397bdacfdfc upstream. The new runtime PM code has shown that many webcams suffer from a race condition that may crash them upon resume. Runtime PM is especially prone to show the problem because it retains power to the cameras at all times. However system suspension may also crash the devices and retain power to the devices. The only way to solve this problem without races is in usbcore with the RESET_RESUME quirk. Signed-off-by: Oliver Neukum Signed-off-by: Greg Kroah-Hartman commit 98e918a7a5dc4a333339ccf26aba08e343a8b26e Author: Denis Pershin Date: Sun Sep 4 17:37:21 2011 +0700 usb: cdc-acm: Owen SI-30 support commit 65e52f41fa944cef2e6d4222b8c54f46cc575214 upstream. here is the patch to support Owen SI-30 device. This is a pulse counter controller. http://www.owen.ru/en/catalog/93788515 usb-drivers output: T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 4 Spd=12 MxCh= 0 D: Ver= 2.00 Cls=02(commc) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1 P: Vendor=03eb ProdID=0030 Rev=01.01 C: #Ifs= 2 Cfg#= 1 Atr=c0 MxPwr=0mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=02 Prot=00 Driver=cdc_acm I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_acm This patch is installed on my home system which receives data from this controller connected to cold water counter. Signed-off-by: Denis Pershin Signed-off-by: Greg Kroah-Hartman commit d950e568728e94f7b495214fd887aea2a07f0d05 Author: Serge Hallyn Date: Mon Sep 26 10:18:29 2011 -0500 USB: pid_ns: ensure pid is not freed during kill_pid_info_as_uid commit aec01c5895051849ed842dc5b8794017a7751f28 upstream. Alan Stern points out that after spin_unlock(&ps->lock) there is no guarantee that ps->pid won't be freed. Since kill_pid_info_as_uid() is called after the spin_unlock(), the pid passed to it must be pinned. Reported-by: Alan Stern Signed-off-by: Serge Hallyn Signed-off-by: Greg Kroah-Hartman commit 54a996b2eb057a5d375ab33425a0b2d24567219b Author: Matthias Dellweg <2500@gmx.de> Date: Sun Sep 25 14:26:25 2011 +0200 usb/core/devio.c: Check for printer class specific request commit 393cbb5151ecda9f9e14e3082d048dd27a1ff9f6 upstream. In the usb printer class specific request get_device_id the value of wIndex is (interface << 8 | altsetting) instead of just interface. This enables the detection of some printers with libusb. Acked-by: Alan Stern Signed-off-by: Matthias Dellweg <2500@gmx.de> Signed-off-by: Greg Kroah-Hartman commit 17195239b64caba1522ddebe5210b804bbb37d74 Author: Fabian Godehardt Date: Thu Sep 1 14:15:46 2011 +0200 USB: g_printer: fix bug in unregistration commit 8582d86143c690c68cc42f996def466a035bee34 upstream. The allocated chardevice region range is only 1 device but on unregister it currently tries to deregister 2. Found this while doing a insmod/rmmod/insmod/rm... of the module which seemed to eat major numbers. Signed-off-by: Fabian Godehardt Signed-off-by: Greg Kroah-Hartman commit aa5f85cae9e4d36ba4c53d6cdd5bc3640c7f581a Author: Matthew Garrett Date: Thu Oct 6 15:35:43 2011 -0400 USB: Fix runtime wakeup on OHCI commit a8b43c00ef06aec49b9fe0a5bad8a6a320e4d27b upstream. At least some OHCI hardware (such as the MCP89) fails to flag any change in the host status register or the port status registers when receiving a remote wakeup while in D3 state. This results in the controller being resumed but no device state change being noticed, at which point the controller is put back to sleep again. Since there doesn't seem to be any reliable way to identify the state change, just unconditionally resume the hub. It'll be put back to sleep in the near future anyway if there are no active devices attached to it. Signed-off-by: Matthew Garrett Cc: Alan Stern Signed-off-by: Greg Kroah-Hartman commit f2da6eea83c56477fdfec9ebf38e812e440f269f Author: Luben Tuikov Date: Thu Nov 11 15:43:11 2010 -0800 USB: storage: Use normalized sense when emulating autosense commit e16da02fcdf1c5e824432f88abf42623dafdf191 upstream. This patch solves two things: 1) Enables autosense emulation code to correctly interpret descriptor format sense data, and 2) Fixes a bug whereby the autosense emulation code would overwrite descriptor format sense data with SENSE KEY HARDWARE ERROR in fixed format, to incorrectly look like this: Oct 21 14:11:07 localhost kernel: sd 7:0:0:0: [sdc] Sense Key : Recovered Error [current] [descriptor] Oct 21 14:11:07 localhost kernel: Descriptor sense data with sense descriptors (in hex): Oct 21 14:11:07 localhost kernel: 72 01 04 1d 00 00 00 0e 09 0c 00 00 00 00 00 00 Oct 21 14:11:07 localhost kernel: 00 4f 00 c2 00 50 Oct 21 14:11:07 localhost kernel: sd 7:0:0:0: [sdc] ASC=0x4 ASCQ=0x1d Signed-off-by: Luben Tuikov Acked-by: Alan Stern Acked-by: Matthew Dharm Signed-off-by: Greg Kroah-Hartman commit 336c01ce32fd06cc51f474c1a14781f535871ae3 Author: Vincent Palatin Date: Thu Sep 1 14:05:15 2011 -0700 usb-storage: fix realtek cr configuration commit 839f245f8f1e7d7efd7ba12a7d735f13e8293a2b upstream. A typo in the configuration variable name prevents from activating the USB autosuspend on the device. Signed-off-by: Vincent Palatin Signed-off-by: Greg Kroah-Hartman commit 4bb9e14219c65d969fac4fd3fed2696a9cd483aa Author: Johannes Stezenbach Date: Thu Sep 8 15:39:15 2011 +0200 usbmon vs. tcpdump: fix dropped packet count commit 236c448cb6e7f82096101e1ace4b77f8b38f82c8 upstream. Report the number of dropped packets instead of zero when using the binary usbmon interface with tcpdump. # tcpdump -i usbmon1 -w dump tcpdump: listening on usbmon1, link-type USB_LINUX_MMAPPED (USB with padded Linux header), capture size 65535 bytes ^C2155 packets captured 2155 packets received by filter 1019 packets dropped by kernel Signed-off-by: Johannes Stezenbach Signed-off-by: Greg Kroah-Hartman commit 0ff8844071f0ede41221a137db54736c11f56e8e Author: Nicholas Bellinger Date: Wed Sep 28 21:37:29 2011 -0700 target: Re-org of core_tmr_lun_reset commit d050ffb922c782f092234611b9019e95024481ab upstream. This patch is a re-orginzation of core_tmr_lun_reset() logic to properly scan the active tmr_list, dev->state_task_list and qobj->qobj_list w/ the relivent locks held, and performing a list_move_tail onto seperate local scope lists before performing the full drain. This involves breaking out the code into three seperate list specific functions: core_tmr_drain_tmr_list(), core_tmr_drain_task_list() and core_tmr_drain_cmd_list(). (nab: Include target: Remove non-active tasks from execute list during LUN_RESET patch to address original breakage) Reported-by: Roland Dreier Cc: Roland Dreier Cc: Christoph Hellwig Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman commit 0667cc007504db38b2a831da7e8b6a642ba9722f Author: Antonio Ospite Date: Mon Oct 31 17:12:22 2011 -0700 leds: turn the blink_timer off before starting to blink commit 488bc35bf40df89d37486c1826b178a2fba36ce7 upstream. Depending on the implementation of the hardware blinking function in blink_set(), the led can support hardware blinking for some values of delay_on and delay_off and fall-back to software blinking for some other values. Turning off the blink_timer unconditionally before starting to blink make sure that a sequence like: OFF hardware blinking software blinking hardware blinking does not leave the software blinking timer active. Signed-off-by: Antonio Ospite Reviewed-by: Johannes Berg Cc: Richard Purdie Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit d25cfa5af43cdcf1f5135f3f4dcae9ed5e965509 Author: Antonio Ospite Date: Mon Oct 31 17:12:19 2011 -0700 leds: save the delay values after a successful call to blink_set() commit 6123b0e274503a0d3588e84fbe07c9aa01bfaf5d upstream. When calling the hardware blinking function implemented by blink_set(), the delay_on and delay_off values are not preserved across calls. Fix that and make the "timer" trigger work as expected when hardware blinking is available. BEFORE the fix: $ cd /sys/class/leds/someled $ echo timer > trigger $ cat delay_on delay_off 0 0 $ echo 100 > delay_on $ cat delay_on delay_off 0 0 $ echo 100 > delay_off $ cat delay_on delay_off 0 0 AFTER the fix: $ cd /sys/class/leds/someled $ echo timer > trigger $ cat delay_on delay_off 0 0 $ echo 100 > delay_on $ cat delay_on delay_off 100 0 $ echo 100 > delay_off $ cat delay_on delay_off 100 100 Signed-off-by: Antonio Ospite Reviewed-by: Johannes Berg Cc: Richard Purdie Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit cc1548ae4462033f00b72bff3dbb16f5a3e54f6c Author: Nelson Elhage Date: Mon Oct 31 17:13:14 2011 -0700 epoll: fix spurious lockdep warnings commit d8805e633e054c816c47cb6e727c81f156d9253d upstream. epoll can acquire recursively acquire ep->mtx on multiple "struct eventpoll"s at once in the case where one epoll fd is monitoring another epoll fd. This is perfectly OK, since we're careful about the lock ordering, but it causes spurious lockdep warnings. Annotate the recursion using mutex_lock_nested, and add a comment explaining the nesting rules for good measure. Recent versions of systemd are triggering this, and it can also be demonstrated with the following trivial test program: --------------------8<-------------------- int main(void) { int e1, e2; struct epoll_event evt = { .events = EPOLLIN }; e1 = epoll_create1(0); e2 = epoll_create1(0); epoll_ctl(e1, EPOLL_CTL_ADD, e2, &evt); return 0; } --------------------8<-------------------- Reported-by: Paul Bolle Tested-by: Paul Bolle Signed-off-by: Nelson Elhage Acked-by: Jason Baron Cc: Dave Jones Cc: Davide Libenzi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 2b810d996387de3ed71e22f324707a6ca9d891ed Author: Josh Stone Date: Mon Oct 24 10:15:51 2011 -0700 x86: Fix compilation bug in kprobes' twobyte_is_boostable commit 315eb8a2a1b7f335d40ceeeb11b9e067475eb881 upstream. When compiling an i386_defconfig kernel with gcc-4.6.1-9.fc15.i686, I noticed a warning about the asm operand for test_bit in kprobes' can_boost. I discovered that this caused only the first long of twobyte_is_boostable[] to be output. Jakub filed and fixed gcc PR50571 to correct the warning and this output issue. But to solve it for less current gcc, we can make kprobes' twobyte_is_boostable[] non-const, and it won't be optimized out. Before: CC arch/x86/kernel/kprobes.o In file included from include/linux/bitops.h:22:0, from include/linux/kernel.h:17, from [...]/arch/x86/include/asm/percpu.h:44, from [...]/arch/x86/include/asm/current.h:5, from [...]/arch/x86/include/asm/processor.h:15, from [...]/arch/x86/include/asm/atomic.h:6, from include/linux/atomic.h:4, from include/linux/mutex.h:18, from include/linux/notifier.h:13, from include/linux/kprobes.h:34, from arch/x86/kernel/kprobes.c:43: [...]/arch/x86/include/asm/bitops.h: In function ‘can_boost.part.1’: [...]/arch/x86/include/asm/bitops.h:319:2: warning: use of memory input without lvalue in asm operand 1 is deprecated [enabled by default] $ objdump -rd arch/x86/kernel/kprobes.o | grep -A1 -w bt 551: 0f a3 05 00 00 00 00 bt %eax,0x0 554: R_386_32 .rodata.cst4 $ objdump -s -j .rodata.cst4 -j .data arch/x86/kernel/kprobes.o arch/x86/kernel/kprobes.o: file format elf32-i386 Contents of section .data: 0000 48000000 00000000 00000000 00000000 H............... Contents of section .rodata.cst4: 0000 4c030000 L... Only a single long of twobyte_is_boostable[] is in the object file. After, without the const on twobyte_is_boostable: $ objdump -rd arch/x86/kernel/kprobes.o | grep -A1 -w bt 551: 0f a3 05 20 00 00 00 bt %eax,0x20 554: R_386_32 .data $ objdump -s -j .rodata.cst4 -j .data arch/x86/kernel/kprobes.o arch/x86/kernel/kprobes.o: file format elf32-i386 Contents of section .data: 0000 48000000 00000000 00000000 00000000 H............... 0010 00000000 00000000 00000000 00000000 ................ 0020 4c030000 0f000200 ffff0000 ffcff0c0 L............... 0030 0000ffff 3bbbfff8 03ff2ebb 26bb2e77 ....;.......&..w Now all 32 bytes are output into .data instead. Signed-off-by: Josh Stone Cc: Masami Hiramatsu Cc: Jakub Jelinek Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit f584ab5b90eee42b9399ada4f7078157b98fcbaa Author: Jack Steiner Date: Tue Sep 20 13:55:04 2011 -0700 x86: uv2: Workaround for UV2 Hub bug (system global address format) commit 6a469e4665bc158599de55d64388861d0a9f10f4 upstream. This is a workaround for a UV2 hub bug that affects the format of system global addresses. The GRU API for UV2 was inadvertently broken by a hardware change. The format of the physical address used for TLB dropins and for addresses used with instructions running in unmapped mode has changed. This change was not documented and became apparent only when diags failed running on system simulators. For UV1, TLB and GRU instruction physical addresses are identical to socket physical addresses (although high NASID bits must be OR'ed into the address). For UV2, socket physical addresses need to be converted. The NODE portion of the physical address needs to be shifted so that the low bit is in bit 39 or bit 40, depending on an MMR value. It is not yet clear if this bug will be fixed in a silicon respin. If it is fixed, the hub revision will be incremented & the workaround disabled. Signed-off-by: Jack Steiner Cc: Ingo Molnar Cc: "H. Peter Anvin" Signed-off-by: Andrew Morton Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit d3f7430cc10223cb13fc7943c599ae5f20030686 Author: Nicholas Bellinger Date: Tue Oct 18 23:48:04 2011 -0700 target: Fix REPORT TARGET PORT GROUPS handling with small allocation length commit 6b20fa9aaf0c2f69ee6f9648e20ab2be0206705e upstream. This patch fixes a bug with the handling of REPORT TARGET PORT GROUPS containing a smaller allocation length than the payload requires causing memory writes beyond the end of the buffer. This patch checks for the minimum 4 byte length for the response payload length, and also checks upon each loop of T10_ALUA(su_dev)->tg_pt_gps_list to ensure the Target port group and Target port descriptor list is able to fit into the remaining allocation length. If the response payload exceeds the allocation length length, then rd_len is still increments to indicate to the initiator that the payload has been truncated. Reported-by: Roland Dreier Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman commit be9f40a76784d667ef3743cd756f1cec4ea4e714 Author: Nicholas Bellinger Date: Tue Oct 11 06:02:48 2011 +0000 target: Prevent TRANSPORT_FREE_CMD_INTR processing in core_tmr_drain_cmd_list commit b0e062aec578c756d1aea4b5809294488366a6e8 upstream. This patch contains a bugfix for TMR LUN_RESET related to TRANSPORT_FREE_CMD_INTR operation, where core_tmr_drain_cmd_list() will now skip processing for this case to prevent an ABORT_TASK status from being returned for descriptors that are already queued up to be released by processing thread context. Cc: Roland Dreier Cc: Christoph Hellwig Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman commit 6f47552250e7d3a1bab3e75cc9e36015a7fa93f9 Author: Nicholas Bellinger Date: Thu Sep 29 14:22:13 2011 -0700 target: Prevent transport_send_task_abort when CHECK_CONDITION status commit c252f003470a99d319db4ebd12f4a9e4710a65db upstream. This patch fixes a bug where transport_send_task_abort() could be called during LUN_RESET to return SAM_STAT_TASK_ABORTED + tfo->queue_status(), when SCF_SENT_CHECK_CONDITION -> tfo->queue_status() has already been sent from within another context via transport_send_check_condition_and_sense(). Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman commit 15e2ab5ff4e52cfe76eab123655701ab623aeeb8 Author: Nicholas Bellinger Date: Thu Sep 29 01:01:35 2011 -0700 target: Fix transport_cmd_finish_abort queue removal bug commit 77039d1eafbbc192df71ee84b157b8973766737d upstream. This patch fixes a bug in LUN_RESET operation with transport_cmd_finish_abort() where transport_remove_cmd_from_queue() was incorrectly being called, causing descriptors with t_state == TRANSPORT_FREE_CMD_INTR to be incorrectly removed from qobj->qobj_list during process context release. This change ensures the descriptor is only removed via transport_remove_cmd_from_queue() when doing a direct release via transport_generic_remove(). Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman commit 4013ba5c21af68a4257729ff04b0441165ffe215 Author: Roland Dreier Date: Wed Sep 28 22:12:07 2011 -0700 target: Prevent cmd->se_queue_node double add commit 79a7fef26431830e22e282053d050af790117db8 upstream. This patch addresses a bug with the lio-core-2.6.git conversion of transport_add_cmd_to_queue() to use a single embedded list_head, instead of individual struct se_queue_req allocations allowing a single se_cmd to be added to the queue mulitple times. This was changed in the following: commit 2a9e4d5ca5d99f4c600578d6285d45142e7e5208 Author: Andy Grover Date: Tue Apr 26 17:45:51 2011 -0700 target: Embed qr in struct se_cmd The problem is that some target code still assumes performing multiple adds is allowed via transport_add_cmd_to_queue(), which ends up causing list corruption in qobj->qobj_list code. This patch addresses this by removing an existing struct se_cmd from the list before the add, and removes an unnecessary list walk in transport_remove_cmd_from_queue() It also changes cmd->t_transport_queue_active to use explict sets intead of increment/decrement to prevent confusion during exception path handling. Signed-off-by: Roland Dreier Cc: Andy Grover Signed-off-by: Nicholas Bellinger Signed-off-by: Greg Kroah-Hartman commit 1c146e2bbcbac885a02e90e0614d7287268b45d1 Author: David Henningsson Date: Tue Oct 18 14:07:51 2011 +0200 ALSA: HDA: Add new revision for ALC662 commit cc667a72d471e79fd8e5e291ea115923cf44dca0 upstream. The revision 0x100300 was found for ALC662. It seems to work well with patch_alc662. BugLink: http://bugs.launchpad.net/bugs/877373 Tested-by: Shengyao Xue Signed-off-by: David Henningsson Acked-by: Kailang Yang Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 46bf15fc7eae441bf3e94edf20f0ae0f4e5b56de Author: Takashi Iwai Date: Fri Oct 14 15:22:34 2011 +0200 ALSA: hda - Keep EAPD turned on for old Conexant chips commit 254f296840b64b034a4c850d45dbde7c040f0819 upstream. In the old Conexant chips (5045, 5047, 5051 and 5066), a single EAPD may handle both headphone and speaker outputs while it's assigned only to one of them. Turning off dynamically leads to the unexpected silent output in such a configuration with the auto-mute function. Since it's difficult to know how the EAPD is handled in the actual h/w implementation, better to keep EAPD on while running for such codecs. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit fcc517bdf7ffc8ecf46c20bef7cba8d154d0420e Author: Charles Chin Date: Thu Oct 13 07:54:09 2011 +0200 ALSA: hda - Remove bad code for IDT 92HD83 family patch commit 6c5c04e509b7000617b09d4301f0b9b6d171d1e6 upstream. The purpose of this patch is to remove a section of "bad" code that assigns the last DAC to ports E or F in order to support notebooks with docking in earlier days, around ALSA 1.0.19 - 21. This is not necessary now and actually breaks some configurations that use these ports as other devices. This have been tested on several different configurations to make sure that it is working for different combinations. Signed-off-by: Charles Chin Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 07cb3ce0ec51d6b51a0874a071825f210a850591 Author: Jeff Skirvin Date: Wed Sep 28 18:35:32 2011 -0700 isci: fix missed unlock in apc_agent_timeout() commit 983d3fdd332742167d0482c06fd29cf4b8a687c0 upstream. Needed to jump to scic_lock unlock. Also spotted by coccicheck. Signed-off-by: Jeff Skirvin Signed-off-by: Dan Williams Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit a4db97d5243e5711284a7083af2f25191592c091 Author: Dan Williams Date: Wed Sep 28 18:35:27 2011 -0700 isci: fix support for large smp requests commit 54b5e3a4bfa3452bc10cd4da672099ccc46b8c09 upstream. Kill the local smp response buffer. Besides being unnecessary, it is too small (currently truncates responses to 60 bytes). The mid-layer will have already allocated a sufficiently sized buffer, just kmap and copy into it directly. Reported-by: Derick Marks Tested-by: Derick Marks Signed-off-by: Dan Williams Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 0c70e4fdd745b267179f8a9d3d03c656dfb251dc Author: Jack Wang Date: Fri Sep 23 14:32:32 2011 +0800 libsas: set sas_address and device type of rphy commit bb041a0e9c31229071b6e56e1d0d8374af0d2038 upstream. Libsas forget to set the sas_address and device type of rphy lead to file under /sys/class/sas_x show wrong value, fix that. Signed-off-by: Jack Wang Tested-by: Crystal Yu Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 101e5772280589d83f2a9f56d62faa42285d5f65 Author: Anton Blanchard Date: Mon Aug 1 19:43:45 2011 +1000 ipr: Always initiate hard reset in kdump kernel commit 5d7c20b7fa5c6ca19e871b4050e321c99d32bd43 upstream. During kdump testing I noticed timeouts when initialising each IPR adapter. While the driver has logic to detect an adapter in an indeterminate state, it wasn't triggering and each adapter went through a 5 minute timeout before finally going operational. Some analysis showed the needs_hard_reset flag wasn't getting set. We can check the reset_devices kernel parameter which is set by kdump and force a full reset. This fixes the problem. Signed-off-by: Anton Blanchard Acked-by: Brian King Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 50311c8ba6d62ef6e35ffdc3081a83ce7087bf15 Author: adam radford Date: Thu Oct 13 16:01:12 2011 -0700 megaraid_sas: Fix instance access in megasas_reset_timer commit f575c5d3ebdca3b0482847d8fcba971767754a9e upstream. The following patch for megaraid_sas will fix a potential bad pointer access in megasas_reset_timer(), when a MegaRAID 9265/9285 or 9360/9380 gets a timeout. megasas_build_io_fusion() sets SCp.ptr to be a struct megasas_cmd_fusion *, but then megasas_reset_timer() was casting SCp.ptr to be a struct megasas_cmd *, then trying to access cmd->instance, which is invalid. Just loading instance from scmd->device->host->hostdata in megasas_reset_timer() fixes the issue. Signed-off-by: Adam Radford Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit d0dab5614492504dffb2b99c6ba88e77393a3d06 Author: Josh Boyer Date: Wed Oct 5 11:44:50 2011 -0400 PCI quirk: mmc: Always check for lower base frequency quirk for Ricoh 1180:e823 commit 3e309cdf07c930f29a4e0f233e47d399bea34c68 upstream. Commit 15bed0f2f added a quirk for the e823 Ricoh card reader to lower the base frequency. However, the quirk first checks to see if the proprietary MMC controller is disabled, and returns if so. On some devices, such as the Lenovo X220, the MMC controller is already disabled by firmware it seems, but the frequency change is still needed so sdhci-pci can talk to the cards. Since the MMC controller is disabled, the frequency fixup was never being run on these machines. This moves the e823 check above the MMC controller check so that it always gets run. This fixes https://bugzilla.redhat.com/show_bug.cgi?id=722509 Signed-off-by: Josh Boyer Signed-off-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman commit 737b5831488eb449d29178b627abd14261c24e17 Author: Andrei Warkentin Date: Sat Sep 24 12:12:30 2011 -0400 mmc: core: ext_csd.raw_* used in comparison but never set commit 5238acbe36dd5100fb6b035a995ae5fc89dd0708 upstream. f39b2dd9d ("mmc: core: Bus width testing needs to handle suspend/resume") added code to only compare read-only ext_csd fields in bus width testing code, yet it's comparing some fields that are never set. The affected fields are ext_csd.raw_erased_mem_count and ext_csd.raw_partition_support. Signed-off-by: Andrei Warkentin Acked-by: Philip Rakity Signed-off-by: Chris Ball Signed-off-by: Greg Kroah-Hartman commit ce509f04d262d15f5f42d33d3d99ac2d27b8c674 Author: Ulf Hansson Date: Wed Sep 21 14:08:13 2011 -0400 mmc: core: Fix hangs related to insert/remove of cards commit 7f7e4129c23f0419257184dff6fec89d2d5a8964 upstream. During a rescan operation mmc_attach(sd|mmc|sdio) functions are called. The error handling in these function can trigger a detach of the bus, which also meant a power off. This is not notified by the rescan operation which then continues to the next attach function. If a power off has been done, the framework must never send any new commands to the host driver, without first doing a new power up. This will most likely trigger any host driver to hang. Moving power off out of detach and instead handle power off separately when it is actually needed, solves the issue. Signed-off-by: Ulf Hansson Acked-by: Linus Walleij Signed-off-by: Chris Ball Signed-off-by: Greg Kroah-Hartman commit bfa1e25f24b16d1b2b26951155064f555a9bfd8c Author: Jean Delvare Date: Thu Oct 6 18:16:24 2011 +0200 drm/radeon/kms: Fix I2C mask definitions commit 286e0c94f9c3f292cb38a977fbbde3433347a868 upstream. Commit 9b9fe724 accidentally used RADEON_GPIO_EN_* where RADEON_GPIO_MASK_* was intended. This caused improper initialization of I2C buses, mostly visible when setting i2c_algo_bit.bit_test=1. Using the right constants fixes the problem. Signed-off-by: Jean Delvare Reviewed-by: Alex Deucher Cc: Jerome Glisse Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit f407df3970271253a9ffd96575ec8feada34bf24 Author: Alex Deucher Date: Fri Oct 7 14:23:48 2011 -0400 drm/radeon/kms: handle !force case in connector detect more gracefully commit d0d0a225e6ad43314c9aa7ea081f76adc5098ad4 upstream. When force == false, we don't do load detection in the connector detect functions. Unforunately, we also return the previous connector state so we never get disconnect events for DVI-I, DVI-A, or VGA. Save whether we detected the monitor via load detection previously and use that to determine whether we return the previous state or not. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=41561 Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit e5edf277645a096ccdca1fe6b8ea31831c89b04a Author: Alex Deucher Date: Fri Oct 7 14:23:47 2011 -0400 drm/radeon/kms: bail early in dvi_detect for digital only connectors commit 5f0a26128d66ef81613fe923d5c288942844ccdc upstream. DVI-D and HDMI-A are digital only, so there's no need to attempt analog load detect. Also, skip bail before the !force check, or we fail to get a disconnect events. The next patches in the series attempt to fix disconnect events for connectors with analog support (DVI-I, HDMI-B, DVI-A). Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=41561 Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 2350d1616e7e2e5b1075a0e3ebcf9933d09b7b5d Author: Jesse Barnes Date: Thu Sep 22 11:16:01 2011 +0530 drm/i915: use correct SPD type value commit 260052100ef669b5374f72055379adc5da35034b upstream. SPD frames are actually type 0x83, not just 0x3. Signed-off-by: Jesse Barnes Signed-off-by: Keith Packard Signed-off-by: Greg Kroah-Hartman commit b9fac9d41ceea38e4f8684281c57a096c6d12e1f Author: Takashi Iwai Date: Fri Oct 14 11:45:40 2011 +0200 drm/i915/panel: Always record the backlight level again (but cleverly) commit f52c619a590fa75276c07dfcaf380dee53e4ea4c upstream. The commit 47356eb67285014527a5ab87543ba1fae3d1e10a introduced a mechanism to record the backlight level only at disabling time, but it also introduced a regression. Since intel_lvds_enable() may be called without disabling (e.g. intel_lvds_commit() calls it unconditionally), the backlight gets back to the last recorded value. For example, this happens when you dim the backlight, close the lid and open the lid, then the backlight suddenly goes to the brightest. This patch fixes the bug by recording the backlight level always when changed via intel_panel_set_backlight(). And, intel_panel_{enable|disable}_backlight() call the internal function not to update the recorded level wrongly. Signed-off-by: Takashi Iwai Reviewed-by: Keith Packard Signed-off-by: Keith Packard Signed-off-by: Greg Kroah-Hartman commit a5f1e25ba199a7aa851d57e34d914cfdc25692ff Author: Keith Packard Date: Wed Sep 28 16:38:44 2011 -0700 drm/i915: Wrap DP EDID fetch functions to enable eDP panel power commit 8c241fef3e6f69f3f675678ae03599ece3f562e2 upstream. Talking to the eDP DDC channel requires that the panel be powered up. Wrap both the EDID and modes fetch code with calls to turn the vdd power on and back off. Signed-off-by: Keith Packard Reviewed-by: Daniel Vetter Signed-off-by: Greg Kroah-Hartman commit f12ea4a8ca7009fa2d54794c3fcb8e638453bcff Author: Andiry Xu Date: Fri Sep 23 14:19:54 2011 -0700 xHCI: AMD isoc link TRB chain bit quirk commit 7e393a834b41001174a8fb3ae3bc23a749467760 upstream. Setting the chain (CH) bit in the link TRB of isochronous transfer rings is required by AMD 0.96 xHCI host controller to successfully transverse multi-TRB TD that span through different memory segments. When a Missed Service Error event occurs, if the chain bit is not set in the link TRB and the host skips TDs which just across a link TRB, the host may falsely recognize the link TRB as a normal TRB. You can see this may cause big trouble - the host does not jump to the right address which is pointed by the link TRB, but continue fetching the memory which is after the link TRB address, which may not even belong to the host, and the result cannot be predicted. This causes some big problems. Without the former patch I sent: "xHCI: prevent infinite loop when processing MSE event", the system may hang. With that patch applied, system does not hang, but the host still access wrong memory address and isoc transfer will fail. With this patch, isochronous transfer works as expected. This patch should be applied to kernels as old as 2.6.36, which was when the first isochronous support was added for the xHCI host controller. Signed-off-by: Andiry Xu Signed-off-by: Sarah Sharp Signed-off-by: Greg Kroah-Hartman commit 697ec8fd0a3d6cbe8fd6d2bfb50f486f6239709c Author: Kautuk Consul Date: Mon Sep 19 16:53:12 2011 -0700 xhci-mem.c: Check for ring->first_seg != NULL commit 0e6c7f746ea99089fb3263709075c20485a479ae upstream. There are 2 situations wherein the xhci_ring* might not get freed: - When xhci_ring_alloc() -> xhci_segment_alloc() returns NULL and we goto the fail: label in xhci_ring_alloc. In this case, the ring will not get kfreed. - When the num_segs argument to xhci_ring_alloc is passed as 0 and we try to free the rung after that. ( This doesn't really happen as of now in the code but we seem to be entertaining num_segs=0 in xhci_ring_alloc ) This should be backported to kernels as old as 2.6.31. Signed-off-by: Kautuk Consul Signed-off-by: Sarah Sharp Signed-off-by: Greg Kroah-Hartman commit dc7623dab0940ea39408cb033a16b5f092c985a7 Author: Alan Stern Date: Wed Oct 12 10:39:14 2011 -0400 EHCI: workaround for MosChip controller bug commit 68aa95d5d4de31c9348c1628ffa85c805305ebc5 upstream. This patch (as1489) works around a hardware bug in MosChip EHCI controllers. Evidently when one of these controllers increments the frame-index register, it changes the three low-order bits (the microframe counter) before changing the higher order bits (the frame counter). If the register is read at just the wrong time, the value obtained is too low by 8. When the appropriate quirk flag is set, we work around this problem by reading the frame-index register a second time if the first value's three low-order bits are all 0. This gives the hardware a chance to finish updating the register, yielding the correct value. Signed-off-by: Alan Stern Tested-by: Jason N Pitt Signed-off-by: Greg Kroah-Hartman commit ad758ade42246e5339491d6b902964cc4b7d40cd Author: Harro Haan Date: Mon Oct 10 14:38:27 2011 +0200 USB: fix ehci alignment error commit 276532ba9666b36974cbe16f303fc8be99c9da17 upstream. The Kirkwood gave an unaligned memory access error on line 742 of drivers/usb/host/echi-hcd.c: "ehci->last_periodic_enable = ktime_get_real();" Signed-off-by: Harro Haan Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit 0e8749ebf69099c00e2cd618e2ba725147cd56ff Author: Matthieu CASTET Date: Sat Jul 2 19:47:33 2011 +0200 EHCI : introduce a common ehci_setup commit 2093c6b49c8f1dc581d8953aca71297d4cace55e upstream. This allow to clean duplicated code in most of SOC driver. Signed-off-by: Matthieu CASTET Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit a717f83d88fee104f61eac2ad9ad5816825f6247 Author: Ning Jiang Date: Mon Sep 5 16:28:18 2011 +0800 serial-core: power up uart port early before we do set_termios when resuming commit 94abc56f4d90f289ea32a0a11d3577fcd8cb28fb upstream. The following patch removed uart_change_pm() in uart_resume_port(): commit 5933a161abcb8d83a2c145177f48027c3c0a8995 Author: Yin Kangkai serial-core: reset the console speed on resume It will break the pxa serial driver when the system resumes from suspend mode as it will try to set baud rate divider register in set_termios but with clock off. The register value can not be set correctly on some platform if the clock is disabled. The pxa driver will check the value and report the following warning: ------------[ cut here ]------------ WARNING: at drivers/tty/serial/pxa.c:545 serial_pxa_set_termios+0x1dc/0x250() Modules linked in: [] (unwind_backtrace+0x0/0xf0) from [] (warn_slowpath_common+0x4c/0x64) [] (warn_slowpath_common+0x4c/0x64) from [] (warn_slowpath_null+0x18/0x1c) [] (warn_slowpath_null+0x18/0x1c) from [] (serial_pxa_set_termios+0x1dc/0x250) [] (serial_pxa_set_termios+0x1dc/0x250) from [] (uart_resume_port+0x128/0x2dc) [] (uart_resume_port+0x128/0x2dc) from [] (serial_pxa_resume+0x18/0x24) [] (serial_pxa_resume+0x18/0x24) from [] (platform_pm_resume+0x40/0x4c) [] (platform_pm_resume+0x40/0x4c) from [] (pm_op+0x68/0xb4) [] (pm_op+0x68/0xb4) from [] (device_resume+0xb0/0xec) [] (device_resume+0xb0/0xec) from [] (dpm_resume+0xe0/0x194) [] (dpm_resume+0xe0/0x194) from [] (dpm_resume_end+0xc/0x18) [] (dpm_resume_end+0xc/0x18) from [] (suspend_devices_and_enter+0x16c/0x1ac) [] (suspend_devices_and_enter+0x16c/0x1ac) from [] (enter_state+0xac/0xdc) [] (enter_state+0xac/0xdc) from [] (state_store+0xa0/0xbc) [] (state_store+0xa0/0xbc) from [] (kobj_attr_store+0x18/0x1c) [] (kobj_attr_store+0x18/0x1c) from [] (sysfs_write_file+0x108/0x140) [] (sysfs_write_file+0x108/0x140) from [] (vfs_write+0xac/0x134) [] (vfs_write+0xac/0x134) from [] (sys_write+0x3c/0x68) [] (sys_write+0x3c/0x68) from [] (ret_fast_syscall+0x0/0x2c) ---[ end trace 88289eceb4675b04 ]--- This patch fix the problem by adding the power on opertion back for uart console when console_suspend_enabled is true. Signed-off-by: Ning Jiang Tested-by: Mayank Rana Signed-off-by: Greg Kroah-Hartman commit fcdff906dbb3f327c2588e45260df896f1236056 Author: Marcus Folkesson Date: Tue Aug 30 13:53:10 2011 +0200 serial: pxa: work around for errata #20 commit e44aabd649c80e8be16ede3ed3cbff6fb2561ca9 upstream. Errata E20: UART: Character Timeout interrupt remains set under certain software conditions. Implication: The software servicing the UART can be trapped in an infinite loop. Signed-off-by: Marcus Folkesson Signed-off-by: Greg Kroah-Hartman commit 1058a893dde12abcd22f1c9f33199b1967171880 Author: Rigbert Hamisch Date: Tue Sep 27 10:46:43 2011 +0200 USB: qcserial: add device ID for "HP un2430 Mobile Broadband Module" commit 1bfac90d1b8e63a4d44158c3445d8fda3fb6d5eb upstream. add device ID for "HP un2430 Mobile Broadband Module" Signed-off-by: Rigbert Hamisch Signed-off-by: Greg Kroah-Hartman commit f1d23c5e1689070518e94874048432e3764275f7 Author: Richard Hartmann Date: Tue Sep 20 20:50:51 2011 +0200 USB: qcserial: Add support for Sierra Wireless MC8355/Gobi 3000 commit 68c79e5756903229fa96826a2493c2265a3b395f upstream. Simple patch to make qcserial recognize the USB id of the Sierra Wireless MC8355 which is based on the Gobi 3000 chip. Both UMTS and GPS work fine. Signed-off-by: Richard Hartmann Signed-off-by: Greg Kroah-Hartman commit e1afc0992140bea385c76f751a5728e2ac321b1d Author: Haiyang Zhang Date: Thu Sep 1 12:19:42 2011 -0700 staging: hv: fix a kernel warning in netvsc_linkstatus_callback() commit c4b6a2eaf1c14810a4803d658f68614365978738 upstream. netif_notify_peers() caused a kernel warning in netvsc_linkstatus_callback(), because netvsc_linkstatus_callback() is within IRQ context. So we move the first call to netif_notify_peers() into queued work as well, but with zero delay. In addition to "staging-next", this should also be back-ported to stable kernels 2.6.32 and later. Signed-off-by: Haiyang Zhang Signed-off-by: K. Y. Srinivasan Signed-off-by: Greg Kroah-Hartman commit 2ef6c9968b8f64206bddcd0b74a75c9b22faf2a8 Author: Mike Sterling Date: Tue Sep 6 16:10:55 2011 -0700 Staging: hv: Add support for >2 TB LUN in storage driver. commit cf55f4a8b6243b42fb91c56d1421db0d36d60f96 upstream. If a LUN larger than 2 TB is attached to a Linux VM on Hyper-V, we currently report a maximum size of 2 TB. This patch resolves the issue in hv_storvsc. Thanks to Robert Scheck for reporting the issue. Reported-by: Robert Scheck Signed-off-by: Mike Sterling Signed-off-by: K.Y. Srinivasan Signed-off-by: Haiyang Zhang Signed-off-by: Greg Kroah-Hartman commit 19993a56ee693a0c5563b657ef46ae32fb92ecc7 Author: Kautuk Consul Date: Wed Sep 14 08:56:21 2011 +0530 staging: quatech_usb2: Potential lost wakeup scenario in TIOCMIWAIT commit e8df1674d383d2ecc6efa8d7dba74c03aafdfdd7 upstream. If the usermode app does an ioctl over this serial device by using TIOCMIWAIT, then the code will wait by setting the current task state to TASK_INTERRUPTIBLE and then calling schedule(). This will be woken up by the qt2_process_modem_status on URB completion when the port_extra->shadowMSR is set to the new modem status. However, this could result in a lost wakeup scenario due to a race in the logic in the qt2_ioctl(TIOCMIWAIT) loop and the URB completion for new modem status in qt2_process_modem_status. Due to this, the usermode app's task will continue to sleep despite a change in the modem status. Signed-off-by: Kautuk Consul Signed-off-by: Greg Kroah-Hartman commit f1635ec762e16e05ca1052393c9c7334582746c2 Author: Bill Pemberton Date: Mon Aug 29 13:48:54 2011 -0400 staging: serqt_usb2: remove ssu100 from supported devices commit 7cbf3c7cd59288fb5e9f31815c74773549668d43 upstream. The serqt_usb2 driver will not work properly with the ssu100 device even though it claims to support it. The ssu100 is supported by the ssu100 driver in mainline so there is no need to have it claimed by serqt_usb2. Signed-off-by: Bill Pemberton Signed-off-by: Greg Kroah-Hartman commit ac1a2c7112204e6f4565cf5f47baf5c19b395dc8 Author: Alexander Thomas Date: Mon Sep 19 16:56:51 2011 +0200 staging: usbip: fix up api changes that broke windows clients commit 7518b9b8fc72a6c0ba67f33bdd4689c7dd28686a upstream. Revert changes in definitions that were submitted on May 11 2011 and committed on June 7 2011. No reason for the change in these values was given in the patch comment, it broke compatibility with older versions, and was difficult to detect by the simultaneous move of the lines of code. Signed-off-by: Alexander Thomas Signed-off-by: Greg Kroah-Hartman commit d8d92c4fdbcf740765e4a3f95a8476f78568b3eb Author: Jim Wylder Date: Tue Sep 6 21:07:20 2011 -0500 USB: for usb_autopm_get_interface_async -EINPROGRESS is not an error commit c5a48592d874ddef8c7880311581eccf0eb30c3b upstream. A return value of -EINPROGRESS from pm_runtime_get indicates that the device is already resuming due to a previous call. Internally, usb_autopm_get_interface_async doesn't treat this as an error and increments the usage count, but passes the error status along to the caller. The logical assumption of the caller is that any negative return value reflects the device not resuming and the pm_usage_cnt not being incremented. Since the usage count is being incremented and the device is resuming, return success (0) instead. Signed-off-by: James Wylder Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit 368f255e470106869fcae4e2e7b2a911f944a7d1 Author: Jiri Slaby Date: Wed Oct 12 11:32:44 2011 +0200 TTY: pty, release tty in all ptmx_open fail paths commit 1177c0efc04d032644895b8d757f55b433912596 upstream. Mistakenly, commit 64ba3dc3143d (tty: never hold BTM while getting tty_mutex) switched one fail path in ptmx_open to not free the newly allocated tty. Fix that by jumping to the appropriate place. And rename the labels so that it's clear what is going on there. Introduced-in: v2.6.36-rc2 Signed-off-by: Jiri Slaby Cc: Arnd Bergmann Cc: Alan Cox Signed-off-by: Greg Kroah-Hartman commit 5112c311dc253acd3c89c4b9fb69e200178c71a8 Author: Jiri Slaby Date: Wed Oct 12 11:32:43 2011 +0200 TTY: make tty_add_file non-failing commit fa90e1c935472281de314e6d7c9a37db9cbc2e4e upstream. If tty_add_file fails at the point it is now, we have to revert all the changes we did to the tty. It means either decrease all refcounts if this was a tty reopen or delete the tty if it was newly allocated. There was a try to fix this in v3.0-rc2 using tty_release in 0259894c7 (TTY: fix fail path in tty_open). But instead it introduced a NULL dereference. It's because tty_release dereferences filp->private_data, but that one is set even in our tty_add_file. And when tty_add_file fails, it's still NULL/garbage. Hence tty_release cannot be called there. To circumvent the original leak (and the current NULL deref) we split tty_add_file into two functions, making the latter non-failing. In that case we may do the former early in open, where handling failures is easy. The latter stays as it is now. So there is no change in functionality. The original bug (leak) was introduced by f573bd176 (tty: Remove __GFP_NOFAIL from tty_add_file()). Thanks Dan for reporting this. Later, we may split tty_release into more functions and call only some of them in this fail path instead. (If at all possible.) Introduced-in: v2.6.37-rc2 Signed-off-by: Jiri Slaby Reported-by: Dan Carpenter Cc: Alan Cox Cc: Pekka Enberg Signed-off-by: Greg Kroah-Hartman commit bebd46c74cf5d8c7d4972f543cafa0ee20b184f9 Author: Jiri Slaby Date: Wed Oct 12 11:32:42 2011 +0200 TTY: drop driver reference in tty_open fail path commit c290f8358acaeffd8e0c551ddcc24d1206143376 upstream. When tty_driver_lookup_tty fails in tty_open, we forget to drop a reference to the tty driver. This was added by commit 4a2b5fddd5 (Move tty lookup/reopen to caller). Fix that by adding tty_driver_kref_put to the fail path. I will refactor the code later. This is for the ease of backporting to stable. Introduced-in: v2.6.28-rc2 Signed-off-by: Jiri Slaby Cc: Alan Cox Acked-by: Sukadev Bhattiprolu Signed-off-by: Greg Kroah-Hartman commit 436318f9b483fa56bbecd8316b921f5876eddc14 Author: Pavel Shilovsky Date: Sat Oct 22 14:37:50 2011 +0400 CIFS: Fix DFS handling in cifs_get_file_info commit 42274bb22afc3e877ae5abed787b0b09d7dede52 upstream. We should call cifs_all_info_to_fattr in rc == 0 case only. Signed-off-by: Pavel Shilovsky Reviewed-by: Jeff Layton Signed-off-by: Steve French Signed-off-by: Greg Kroah-Hartman commit 405a281820d8be91ca88d160560770aa6df26679 Author: Pavel Shilovsky Date: Fri Oct 7 18:57:45 2011 +0400 CIFS: Fix incorrect max RFC1002 write size value commit 94443f43404239c2a6dc4252a7cb9e77f5b1eb6e upstream. ..the length field has only 17 bits. Acked-by: Jeff Layton Signed-off-by: Pavel Shilovsky Signed-off-by: Steve French Signed-off-by: Greg Kroah-Hartman