All of lore.kernel.org
 help / color / mirror / Atom feed
* [ 000/262] 3.5.5-stable review
@ 2012-09-28 18:48 Greg Kroah-Hartman
  2012-09-28 18:48 ` [ 001/262] codel: refine one condition to avoid a nul rec_inv_sqrt Greg Kroah-Hartman
                   ` (261 more replies)
  0 siblings, 262 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:48 UTC (permalink / raw)
  To: linux-kernel, stable, torvalds, akpm; +Cc: Greg KH, alan

From: Greg KH <gregkh@linuxfoundation.org>

This is the start of the stable review cycle for the 3.5.5 release.
There are 262 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sun Sep 30 18:28:42 UTC 2012.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.5.5-rc1.gz
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Dan Carpenter <dan.carpenter@oracle.com>
    vmwgfx: corruption in vmw_event_fence_action_create()

Jani Nikula <jani.nikula@intel.com>
    drm/i915: only enable sdvo hotplug irq if needed

Dave Airlie <airlied@redhat.com>
    drm/udl: limit modes to the sku pixel limits.

NeilBrown <neilb@suse.de>
    md/raid10: fix "enough" function for detecting if array is failed.

Roland Stigge <stigge@antcom.de>
    gpio-lpc32xx: Fix value handling of gpio_direction_output()

Mark Brown <broonie@opensource.wolfsonmicro.com>
    ASoC: wm2000: Correct register size

Daniel Mack <zonque@gmail.com>
    ALSA: snd-usb: fix next_packet_size calls for pause case

Alan Stern <stern@rowland.harvard.edu>
    USB: Fix race condition when removing host controllers

Joachim Eastwood <manabian@gmail.com>
    USB: ohci-at91: fix null pointer in ohci_hcd_at91_overcurrent_irq

Marc Kleine-Budde <mkl@pengutronix.de>
    usb: chipidea: cleanup dma_pool if udc_start() fails

Marc Kleine-Budde <mkl@pengutronix.de>
    usb: chipidea: udc: fix error path in udc_start()

Tejun Heo <tj@kernel.org>
    kthread_worker: reimplement flush_kthread_work() to allow freeing the work item being executed

Tejun Heo <tj@kernel.org>
    kthread_worker: reorganize to prepare for flush_kthread_work() reimplementation

Stanislav Kinsbursky <skinsbursky@parallels.com>
    NFSd: set nfsd_serv to NULL after service destruction

Stanislav Kinsbursky <skinsbursky@parallels.com>
    NFSd: introduce nfsd_destroy() helper

Seth Forshee <seth.forshee@canonical.com>
    irq_remap: disable IRQ remapping if any IOAPIC lacks an IOMMU

Bjørn Mork <bjorn@mork.no>
    net: qmi_wwan: new devices: UML290 and K5006-Z

Bjørn Mork <bjorn@mork.no>
    net: qmi_wwan: add Sierra Wireless devices

Bjørn Mork <bjorn@mork.no>
    net: qmi_wwan: add ZTE MF821D

Trond Myklebust <Trond.Myklebust@netapp.com>
    NFS: Fix Oopses in nfs_lookup_revalidate and nfs4_lookup_revalidate

Andreas Schwab <schwab@linux-m68k.org>
    sound/aoa: Adapt to new i2c probing scheme

Benjamin Herrenschmidt <benh@kernel.crashing.org>
    i2c/powermac: Improve detection of devices from device-tree

Keshava Munegowda <keshava_mgowda@ti.com>
    OMAP: USB : Fix the EHCI enumeration and core retention issue

Darren Hart <dvhart@linux.intel.com>
    pch_uart: Add eg20t_port lock field, avoid recursive spinlocks

Timur Tabi <timur@freescale.com>
    powerpc/85xx: p1022ds: fix DIU/LBC switching with NAND enabled

Timur Tabi <timur@freescale.com>
    powerpc/85xx: p1022ds: disable the NAND flash node if video is enabled

Tomoya MORINAGA <tomoya.rohm@gmail.com>
    pch_uart: Fix parity setting issue

Tomoya MORINAGA <tomoya.rohm@gmail.com>
    pch_uart: Fix rx error interrupt setting issue

Alan Cox <alan@linux.intel.com>
    pch_uart: Fix missing break for 16 byte fifo

Douglas Bagnall <douglas@paradise.net.nz>
    media: Avoid sysfs oops when an rc_dev's raw device is absent

John Stultz <john.stultz@linaro.org>
    time: Move ktime_t overflow checking into timespec_valid_strict

John Stultz <john.stultz@linaro.org>
    time: Avoid making adjustments if we haven't accumulated anything

John Stultz <john.stultz@linaro.org>
    time: Improve sanity checking of timekeeping inputs

Jarod Wilson <jarod@redhat.com>
    media: lirc_sir: make device registration work

Peter Zijlstra <peterz@infradead.org>
    sched: Fix race in task_group()

Daniel J Blueman <daniel@quora.org>
    libata: Prevent interface errors with Seagate FreeAgent GoFlex

Weiping Pan <wpan@redhat.com>
    rds: set correct msg_namelen

Li Zhong <zhong@linux.vnet.ibm.com>
    Fix a dead loop in async_synchronize_full()

Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
    Bluetooth: Fix sending a HCI Authorization Request over LE links

Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
    Bluetooth: Change signature of smp_conn_security()

Andre Guedes <andre.guedes@openbossa.org>
    Bluetooth: Fix use-after-free bug in SMP

Henrik Rydberg <rydberg@euromail.se>
    Bluetooth: Add support for Apple vendor-specific devices

Gustavo Padovan <gustavo.padovan@collabora.co.uk>
    Bluetooth: Use USB_VENDOR_AND_INTERFACE() for Broadcom devices

Yevgeniy Melnichuk <yevgeniy.melnichuk@googlemail.com>
    Bluetooth: Add support for Sony Vaio T-Series

Peng Chen <pengchen@qca.qualcomm.com>
    Bluetooth: add support for atheros 0489:e057

Manoj Iyer <manoj.iyer@canonical.com>
    Bluetooth: btusb: Add vendor specific ID (0a5c:21f4) BCM20702A0

Ping Cheng <pinglinux@gmail.com>
    Input: wacom - rearrange type enum

Ping Cheng <pinglinux@gmail.com>
    Input: wacom - add support to Cintiq 22HD

Lai Jiangshan <laijs@cn.fujitsu.com>
    workqueue: UNBOUND -> REBIND morphing in rebind_workers() should be atomic

Richard Cochran <richardcochran@gmail.com>
    gianfar: fix phc index build failure

Johannes Berg <johannes.berg@intel.com>
    iwlwifi: fix flow handler debug code

Johannes Berg <johannes.berg@intel.com>
    iwlwifi: protect SRAM debugfs

Emmanuel Grumbach <emmanuel.grumbach@intel.com>
    iwlwifi: don't double free the interrupt in failure path

Maxim Levitsky <maximlevitsky@gmail.com>
    drm/nv86/fifo: suspend fix

Chris Wilson <chris@chris-wilson.co.uk>
    drm/i915: Reduce a pin-leak BUG into a WARN

Wang Xingchao <xingchao.wang@intel.com>
    drm/i915: HDMI - Clear Audio Enable bit for Hot Plug

Daniel Vetter <daniel.vetter@ffwll.ch>
    drm/i915: enable lvds pin pairs before dpll on gen2

Daniel Vetter <daniel.vetter@ffwll.ch>
    drm/i915: set the right gen3 flip_done mode also at resume

Dave Airlie <airlied@redhat.com>
    drm/nouveau: fix booting with plymouth + dumb support

Christian König <deathsimple@vodafone.de>
    drm/radeon: make 64bit fences more robust v3

Alex Deucher <alexander.deucher@amd.com>
    drm/radeon: fix dig encoder selection on DCE61

Jerome Glisse <jglisse@redhat.com>
    drm/radeon: force dma32 to fix regression rs4xx,rs6xx,rs740

Alex Deucher <alexander.deucher@amd.com>
    drm/radeon: don't disable plls that are in use by other crtcs

Alex Deucher <alexander.deucher@amd.com>
    drm/radeon: convert radeon vfct code to use acpi_get_table_with_size

Xu, Anhua <anhua.xu@intel.com>
    drm/i915: fix wrong order of parameters in port checking functions

Alex Deucher <alexander.deucher@amd.com>
    drm/radeon/atom: powergating fixes for DCE6

Alex Deucher <alexander.deucher@amd.com>
    drm/radeon/atom: rework DIG modesetting on DCE3+

Ben Skeggs <bskeggs@redhat.com>
    drm/nvc0/copy: check PUNITS to determine which copy engines are disabled

Jakob Bornecrantz <jakob@vmware.com>
    drm: Check for invalid cursor flags

AceLan Kao <acelan.kao@canonical.com>
    asus-nb-wmi: add some video toggle keys

Paul Menzel <paulepanter@users.sourceforge.net>
    drm: Add EDID_QUIRK_FORCE_REDUCED_BLANKING for ASUS VW222S

Corentin Chary <corentin.chary@gmail.com>
    asus-laptop: HRWS/HWRS typo

Daniel Vetter <daniel.vetter@ffwll.ch>
    drm/i915: use hsw rps tuning values everywhere on gen6+

Jani Nikula <jani.nikula@intel.com>
    drm/i915: fall back to bit-banging if GMBUS fails in CRT EDID reads

Jani Nikula <jani.nikula@intel.com>
    drm/i915: extract connector update from intel_ddc_get_modes() for reuse

Christian König <deathsimple@vodafone.de>
    drm/radeon: init lockup timeout on ring init

Tvrtko Ursulin <tvrtko.ursulin@onelan.co.uk>
    drm/radeon/kms: extend the Fujitsu D3003-S2 board connector quirk to cover later silicon stepping

David Lamparter <equinox@diac24.net>
    drm/radeon: implement ACPI VFCT vbios fetch (v3)

Alex Deucher <alexander.deucher@amd.com>
    drm/radeon: split ATRM support out from the ATPX handler (v3)

Jerome Glisse <jglisse@redhat.com>
    drm/radeon: fence virtual address and free it once idle v4

Alex Deucher <alexander.deucher@amd.com>
    drm/radeon/ss: use num_crtc rather than hardcoded 6

Jerome Glisse <jglisse@redhat.com>
    drm/radeon: avoid turning off spread spectrum for used pll

Dave Airlie <airlied@redhat.com>
    fbcon: fix race condition between console lock and cursor timer (v1.1)

Robin Holt <holt@sgi.com>
    drivers/misc/sgi-xp/xpc_uv.c: SGI XPC fails to load when cpu 0 is out of IRQ resources

Rafael J. Wysocki <rjw@sisk.pl>
    PM / Runtime: Check device PM QoS setting before "no callbacks" check

Rafael J. Wysocki <rjw@sisk.pl>
    PM / Runtime: Clear power.deferred_resume on success in rpm_suspend()

Rafael J. Wysocki <rjw@sisk.pl>
    PM / Runtime: Fix rpm_resume() return value for power.no_callbacks set

Atsushi Nemoto <anemo@mba.ocn.ne.jp>
    drivers/rtc/rtc-rs5c348.c: fix hour decoding in 12-hour mode

Suresh Siddha <suresh.b.siddha@intel.com>
    x86, avx: don't use avx instructions with "noxsave" boot param

Will Deacon <will.deacon@arm.com>
    mutex: Place lock in contended state after fastpath_lock failure

Dirk Behme <dirk.behme@de.bosch.com>
    tty: serial: imx: don't reinit clock in imx_setup_ufcr()

Xinyu Chen <xinyu.chen@freescale.com>
    tty: serial: imx: console write routing is unsafe on SMP

Moiz Sonasath <m-sonasath@ti.com>
    usb: host: xhci: fix compilation error for non-PCI based stacks

Manoj Iyer <manoj.iyer@canonical.com>
    xhci: Recognize USB 3.0 devices as superspeed at powerup

Matthew Garrett <mjg@redhat.com>
    xhci: Make handover code more robust

Dan Carpenter <dan.carpenter@oracle.com>
    xhci: Fix a logical vs bitwise AND bug

Ruchika Kharwar <ruchika@ti.com>
    usb: host: xhci-plat: use ioremap_nocache

Keng-Yu Lin <kengyu@canonical.com>
    Intel xhci: Only switch the switchable ports

Alexis R. Cortes <alexis.cortes@ti.com>
    usb: host: xhci: Fix Compliance Mode on SN65LVPE502CP Hardware

Sergei Poselenov <sposelenov@emcraft.com>
    rt2800usb: Added rx packet length validity check

Alan Stern <stern@rowland.harvard.edu>
    USB: add device quirk for Joss Optical touchboard

Nicolas Ferre <nicolas.ferre@atmel.com>
    USB: ohci-at91: fix PIO handling in relation with number of ports

Bjørn Mork <bjorn@mork.no>
    USB: cdc-wdm: fix wdm_find_device* return value

Kishon Vijay Abraham I <kishon@ti.com>
    usb: dwc3: core: fix incorrect usage of resource pointer

Pratyush Anand <pratyush.anand@st.com>
    usb: dwc3: ep0: correct cache sync issue in case of ep0_bounced

Michael Grzeschik <m.grzeschik@pengutronix.de>
    usb: chipidea: udc: don't stall endpoint if request list is empty in isr_tr_complete_low

Michael Grzeschik <m.grzeschik@pengutronix.de>
    usb: chipidea: udc: fix setup of endpoint maxpacket size

Éric Piel <piel@delmic.com>
    USB: ftdi-sio: add support for more Physik Instrumente devices

Bjørn Mork <bjorn@mork.no>
    USB: ftdi_sio: do not claim CDC ACM function

Horst Schirmeier <horst@schirmeier.com>
    USB: ftdi_sio: PID for NZR SEM 16+ USB

Pavankumar Kondeti <pkondeti@codeaurora.org>
    EHCI: Update qTD next pointer in QH overlay region during unlink

Weston Andros Adamson <dros@netapp.com>
    NFS: return error from decode_getfh in decode open

Trond Myklebust <Trond.Myklebust@netapp.com>
    NFS: Fix a problem with the legacy binary mount code

Trond Myklebust <Trond.Myklebust@netapp.com>
    NFS: Fix the initialisation of the readdir 'cookieverf' array

Gertjan van Wingerde <gwingerde@gmail.com>
    rt2x00: Fix rfkill polling prior to interface start.

Gertjan van Wingerde <gwingerde@gmail.com>
    rt2x00: Fix word size of rt2500usb MAC_CSR19 register.

Gertjan van Wingerde <gwingerde@gmail.com>
    rt2x00: Identify ASUS USB-N53 device.

Nicolas Ferre <nicolas.ferre@atmel.com>
    dmaengine: at_hdmac: check that each sg data length is non-null

Nicolas Ferre <nicolas.ferre@atmel.com>
    dmaengine: at_hdmac: fix comment in atc_prep_slave_sg()

Sachin Kamat <sachin.kamat@linaro.org>
    DMA: PL330: Check the pointer returned by kzalloc

Sachin Kamat <sachin.kamat@linaro.org>
    DMA: PL330: Fix potential NULL pointer dereference in pl330_submit_req()

Luis R. Rodriguez <mcgrof@do-not-panic.com>
    cfg80211: fix possible circular lock on reg_regdb_search()

Ira W. Snyder <iws@ovro.caltech.edu>
    can: janz-ican3: fix support for older hardware revisions

Marc Kleine-Budde <mkl@pengutronix.de>
    can: ti_hecc: fix oops during rmmod

Søren Holm <sgh@sgh.dk>
    asix: Support DLink DUB-E100 H/W Ver C1

Larry Finger <Larry.Finger@lwfinger.net>
    rtlwifi: rtl8192ce: Log message that B_CUT device may not work

Robert Richter <robert.richter@amd.com>
    perf/x86/ibs: Check syscall attribute flags

Jovi Zhang <bookjovi@gmail.com>
    MIPS: mm: Add compound tail page _mapcount when mapped

Anisse Astier <anisse@astier.eu>
    Input: i8042 - disable mux on Toshiba C850D

Wen Congyang <wency@cn.fujitsu.com>
    tracing: Don't call page_to_pfn() if page is NULL

Matthew Leach <matthew.leach@arm.com>
    ARM: 7532/1: decompressor: reset SCTLR.TRE for VMSA ARMv7 cores

Fabio Estevam <fabio.estevam@freescale.com>
    ARM: imx: armadillo5x0: Fix illegal register access

Toshi Kani <toshi.kani@hp.com>
    hpwdt: Fix kdump issue in hpwdt

Mark Salter <msalter@redhat.com>
    c/r: prctl: fix build error for no-MMU case

Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
    Bluetooth: mgmt: Fix enabling LE while powered off

Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
    Bluetooth: Fix not removing power_off delayed work

Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
    Bluetooth: mgmt: Fix enabling SSP while powered off

Wang Sen <senwang@linux.vnet.ibm.com>
    SCSI: scsi: virtio-scsi: Fix address translation failure of HighMem pages used by sg list

Stephen M. Cameron <scameron@beardog.cce.hp.com>
    SCSI: hpsa: fix handling of protocol error

Eddie Wai <eddie.wai@broadcom.com>
    SCSI: bnx2i: Fixed NULL ptr deference for 1G bnx2 Linux iSCSI offload

sreekanth.reddy@lsi.com <sreekanth.reddy@lsi.com>
    SCSI: mpt2sas: Fix for issue - Unable to boot from the drive connected to HBA

James Bottomley <jbottomley@parallels.com>
    SCSI: lpfc: fix problems with -Werror

Hante Meuleman <meuleman@broadcom.com>
    brcmfmac: Fix big endian host configuration data.

Hante Meuleman <meuleman@broadcom.com>
    brcmfmac: fix big endian bug in i-scan.

Eliad Peller <eliad@wizery.com>
    mac80211: clear bssid on auth/assoc failure

Santiago Leon <santil@linux.vnet.ibm.com>
    ibmveth: Fix alignment of rx queue bug

Bjørn Mork <bjorn@mork.no>
    net: usbnet: fix softirq storm on suspend

Dave Airlie <airlied@redhat.com>
    vmwgfx: add dumb ioctl support

Jeff Layton <jlayton@redhat.com>
    cifs: fix return value in cifsConvertToUTF16

Nestor Lopez Casado <nlopezcasad@logitech.com>
    HID: Fix logitech-dj: missing Unifying device issue

Alan Cox <alan@linux.intel.com>
    dj: memory scribble in logi_dj

Guenter Roeck <linux@roeck-us.net>
    hwmon: (ad7314) Add 'name' sysfs attribute

Guenter Roeck <linux@roeck-us.net>
    hwmon: (ads7871) Add 'name' sysfs attribute

Andreas Herrmann <andreas.herrmann3@amd.com>
    hwmon: (fam15h_power) Tweak runavg_range on resume

Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    xen/boot: Disable NUMA for PV guests.

Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    xen/boot: Disable BIOS SMP MP table search.

Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    xen/m2p: do not reuse kmap_op->dev_bus_addr

qiuxishi <qiuxishi@gmail.com>
    memory hotplug: fix section info double registration bug

Jianguo Wu <wujianguo@huawei.com>
    mm/ia64: fix a memory block size bug

Benoît Locher <Benoit.Locher@skf.com>
    can: mcp251x: avoid repeated frame bug

Karsten Keil <keil@b1-systems.de>
    mISDN: Fix wrong usage of flush_work_sync while holding locks

Alan Cox <alan@linux.intel.com>
    gma500: Fix regression on Oaktrail devices

Charles Wang <muming.wq@taobao.com>
    sched: Add missing call to calc_load_exit_idle()

Guenter Roeck <linux@roeck-us.net>
    hwmon: (ina2xx) Fix word size register read and write operations

Guenter Roeck <linux@roeck-us.net>
    hwmon: (twl4030-madc-hwmon) Initialize uninitialized structure elements

Kevin Hilman <khilman@ti.com>
    drivers/rtc/rtc-twl.c: ensure all interrupts are disabled during probe

Li Haifeng <omycle@gmail.com>
    mm/page_alloc: fix the page address of higher page's buddy calculation

Dylan Reid <dgreid@chromium.org>
    ASoC: samsung dma - Don't indicate support for pause/resume.

Paul Clements <paul.clements@steeleye.com>
    nbd: clear waiting_queue on shutdown

NeilBrown <neilb@suse.de>
    md/raid5: fix calculate of 'degraded' when a replacement becomes active.

NeilBrown <neilb@suse.de>
    md: make sure metadata is updated when spares are activated or removed.

NeilBrown <neilb@suse.de>
    md/raid10: fix problem with on-stack allocation of r10bio structure.

NeilBrown <neilb@suse.de>
    md: Don't truncate size at 4TB for RAID0 and Linear

Trond Myklebust <Trond.Myklebust@netapp.com>
    SUNRPC: Fix a UDP transport regression

Dmitry Kasatkin <dmitry.kasatkin@intel.com>
    digsig: add hash size comparision on signature verification

Mel Gorman <mgorman@suse.de>
    Redefine ATOMIC_INIT and ATOMIC64_INIT to drop the casts

Markus Trippelsdorf <markus@trippelsdorf.de>
    dyndbg: fix for SOH in logging messages

Bjørn Mork <bjorn@mork.no>
    kobject: fix oops with "input0: bad kobj_uevent_env content in show_uevent()"

Alan Cox <alan@linux.intel.com>
    ahci: Add alternate identifier for the 88SE9172

Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    usb: gadget: at91udc: Don't check for ep->ep.desc

Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    usb: gadget: at91udc: don't overwrite driver data

Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
    usb: gadget: dummy_hcd: add support for USB_DT_BOS on rh

Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
    usb: gadget: dummy_hcd: fixup error probe path

Michael Grzeschik <m.grzeschik@pengutronix.de>
    usb: chipidea: udc: add pullup fuction, needed by the uvc gadget

Robert Richter <robert.richter@amd.com>
    oprofile, s390: Fix uninitialized memory access when writing to oprofilefs

Ian Chen <ian.cy.chen@samsung.com>
    mmc: card: Skip secure erase on MoviNAND; causes unrecoverable corruption.

Ludovic Desroches <ludovic.desroches@atmel.com>
    mmc: atmel-mci: not busy flag has also to be used for read operations

Shawn Guo <shawn.guo@linaro.org>
    mmc: sdhci-esdhc: break out early if clock is 0

Lauri Hintsala <lauri.hintsala@bluegiga.com>
    mmc: mxs-mmc: fix deadlock caused by recursion loop

Lauri Hintsala <lauri.hintsala@bluegiga.com>
    mmc: mxs-mmc: fix deadlock in SDIO IRQ case

Aaron Lu <aaron.lu@intel.com>
    ACPI / PM: Use KERN_DEBUG when no power resources are found

Lin Ming <ming.m.lin@intel.com>
    ACPI / PM: Fix resource_lock dead lock in acpi_power_on_device

Rafael J. Wysocki <rjw@sisk.pl>
    ACPI / PM: Infer parent power state from child if unknown, v2

Al Viro <viro@ZenIV.linux.org.uk>
    perf_event: Switch to internal refcount, fix race with close()

Stephen Warren <swarren@nvidia.com>
    sound: tegra_alc5632: remove HP detect GPIO inversion

Francesco Ruggeri <fruggeri@aristanetworks.com>
    fs/proc: fix potential unregister_sysctl_table hang

Bjørn Mork <bjorn@mork.no>
    USB: option: replace ZTE K5006-Z entry with vendor class rule

Ian Abbott <abbotti@mev.co.uk>
    staging: comedi: das08: Correct AI encoding for das08jr-16-ao

Ian Abbott <abbotti@mev.co.uk>
    staging: comedi: das08: Correct AO output for das08jr-16-ao

Ian Abbott <abbotti@mev.co.uk>
    staging: comedi: amplc_pci224: Fix PCI ref count

Eric Dumazet <edumazet@google.com>
    staging: r8712u: fix bug in r8712_recv_indicatepkt()

Malcolm Priestley <tvboxspy@gmail.com>
    staging: vt6656: [BUG] - Failed connection, incorrect endian.

Seth Jennings <sjenning@linux.vnet.ibm.com>
    staging: zcache: fix cleancache race condition with shrinker

Christopher Brannon <chris@the-brannons.com>
    Staging: speakup: fix an improperly-declared variable.

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Workaround for silent output on VAIO Z with ALC889

Matteo Frigo <athena@fftw.org>
    ALSA: ice1724: Use linear scale for AK4396 volume control.

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Fix Oops at codec reset/reconfig

Takashi Iwai <tiwai@suse.de>
    ALSA: usb-audio: Fix bogus error messages for delay accounting

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Fix missing Master volume for STAC9200/925x

Russell King <rmk+kernel@arm.linux.org.uk>
    ARM: Fix ioremap() of address zero

Fabio Estevam <fabio.estevam@freescale.com>
    ARM: clk-imx35: Fix SSI clock registration

Fabio Estevam <fabio.estevam@freescale.com>
    ARM: clk-imx25: Fix SSI clock registration

Igor Grinberg <grinberg@compulab.co.il>
    ARM: OMAP: timer: obey the !CONFIG_OMAP_32K_TIMER

Dae S. Kim <dae@velatum.com>
    Staging: Android alarm: IOCTL command encoding fix

Russell King <rmk+kernel@arm.linux.org.uk>
    ARM: 7527/1: uaccess: explicitly check __user pointer when !CPU_USE_DOMAINS

Will Deacon <will.deacon@arm.com>
    ARM: 7526/1: traps: send SIGILL if get_user fails on undef handling path

David Brown <davidb@codeaurora.org>
    ARM: 7513/1: Make sure dtc is built before running it

Will Deacon <will.deacon@arm.com>
    ARM: 7501/1: decompressor: reset ttbcr for VMSA ARMv7 cores

Will Deacon <will.deacon@arm.com>
    ARM: 7496/1: hw_breakpoint: don't rely on dfsr to show watchpoint access type

Paolo Bonzini <pbonzini@redhat.com>
    target: simplify code around transport_get_sense_data

Nicholas Bellinger <nab@linux-iscsi.org>
    target: Fix ->data_length re-assignment bug with SCSI overflow

Tyler Hicks <tyhicks@canonical.com>
    eCryptfs: Copy up attributes of the lower target inode after rename

Amerigo Wang <amwang@redhat.com>
    netconsole: remove a redundant netconsole_target_put()

Miklos Szeredi <mszeredi@suse.cz>
    vfs: dcache: use DCACHE_DENTRY_KILLED instead of DCACHE_DISCONNECTED in d_kill()

Linus Torvalds <torvalds@linux-foundation.org>
    vfs: make O_PATH file descriptors usable for 'fstat()'

Stephen M. Cameron <scameron@beardog.cce.hp.com>
    cciss: fix handling of protocol error

Tejun Heo <tj@kernel.org>
    cpufreq/powernow-k8: workqueue user shouldn't migrate the kworker to another CPU

Tejun Heo <tj@kernel.org>
    workqueue: reimplement work_on_cpu() using system_wq

Jesse Gross <jesse@nicira.com>
    openvswitch: Reset upper layer protocol info on internal devices.

Jaccon Bastiaansen <jaccon.bastiaansen@gmail.com>
    cs89x0 : packet reception not working

Yuval Mintz <yuvalmin@broadcom.com>
    bnx2x: fix 57840_MF pci id

Francesco Ruggeri <fruggeri@aristanetworks.com>
    net: ipv4: ipmr_expire_timer causes crash when removing net namespace

xeb@mail.ru <xeb@mail.ru>
    l2tp: avoid to use synchronize_rcu in tunnel free function

Claudiu Manoil <claudiu.manoil@freescale.com>
    gianfar: fix default tx vlan offload feature flag

Ben Hutchings <bhutchings@solarflare.com>
    sfc: Fix reporting of IPv4 full filters through ethtool

Yuchung Cheng <ycheng@google.com>
    tcp: fix cwnd reduction for non-sack recovery

Pablo Neira Ayuso <pablo@netfilter.org>
    netlink: fix possible spoofing from non-root processes

Eric Dumazet <edumazet@google.com>
    af_netlink: force credentials passing [CVE-2012-3520]

Eric Leblond <eric@regit.org>
    af_packet: don't emit packet on orig fanout group

Mathias Krause <minipli@googlemail.com>
    net: fix info leak in compat dev_ifconf()

Mathias Krause <minipli@googlemail.com>
    ipvs: fix info leak in getsockopt(IP_VS_SO_GET_TIMEOUT)

Mathias Krause <minipli@googlemail.com>
    dccp: fix info leak via getsockopt(DCCP_SOCKOPT_CCID_TX_INFO)

Mathias Krause <minipli@googlemail.com>
    llc: fix info leak via getsockname()

Mathias Krause <minipli@googlemail.com>
    l2tp: fix info leak via getsockname()

Mathias Krause <minipli@googlemail.com>
    Bluetooth: L2CAP - Fix info leak via getsockname()

Mathias Krause <minipli@googlemail.com>
    Bluetooth: RFCOMM - Fix info leak via getsockname()

Mathias Krause <minipli@googlemail.com>
    Bluetooth: RFCOMM - Fix info leak in ioctl(RFCOMMGETDEVLIST)

Mathias Krause <minipli@googlemail.com>
    Bluetooth: RFCOMM - Fix info leak in getsockopt(BT_SECURITY)

Mathias Krause <minipli@googlemail.com>
    Bluetooth: HCI - Fix info leak via getsockname()

Mathias Krause <minipli@googlemail.com>
    Bluetooth: HCI - Fix info leak in getsockopt(HCI_FILTER)

Mathias Krause <minipli@googlemail.com>
    atm: fix info leak via getsockname()

Mathias Krause <minipli@googlemail.com>
    atm: fix info leak in getsockopt(SO_ATMPVC)

Ben Hutchings <bhutchings@solarflare.com>
    ipv6: addrconf: Avoid calling netdevice notifiers with RCU read-side lock

danborkmann@iogearbox.net <danborkmann@iogearbox.net>
    af_packet: remove BUG statement in tpacket_destruct_skb

Alexey Khoroshilov <khoroshilov@ispras.ru>
    net/core: Fix potential memory leak in dev_set_alias()

Gao feng <gaofeng@cn.fujitsu.com>
    pptp: lookup route with the proper net namespace

Wu Fengguang <fengguang.wu@intel.com>
    isdnloop: fix and simplify isdnloop_init()

Hiroaki SHIMODA <shimoda.hiroaki@gmail.com>
    net_sched: gact: Fix potential panic in tcf_gact().

Ben Hutchings <bhutchings@solarflare.com>
    tcp: Apply device TSO segment limit earlier

Ben Hutchings <bhutchings@solarflare.com>
    sfc: Fix maximum number of TSO segments and minimum TX queue size

Ben Hutchings <bhutchings@solarflare.com>
    net: Allow driver to limit number of GSO segments per skb

Eric Dumazet <edumazet@google.com>
    codel: refine one condition to avoid a nul rec_inv_sqrt


-------------

Diffstat:

 Documentation/sound/alsa/HD-Audio-Models.txt          |    1 +
 Makefile                                              |    4 +-
 arch/alpha/include/asm/atomic.h                       |    4 +-
 arch/arm/Makefile                                     |    4 +-
 arch/arm/boot/compressed/head.S                       |    5 ++
 arch/arm/include/asm/assembler.h                      |    8 +++
 arch/arm/include/asm/uaccess.h                        |   40 +++++++----
 arch/arm/kernel/hw_breakpoint.c                       |   55 +++++++++++----
 arch/arm/kernel/traps.c                               |   11 +--
 arch/arm/lib/getuser.S                                |   23 ++++---
 arch/arm/lib/putuser.S                                |    6 ++
 arch/arm/mach-imx/clk-imx25.c                         |    6 +-
 arch/arm/mach-imx/clk-imx35.c                         |    6 +-
 arch/arm/mach-imx/mach-armadillo5x0.c                 |    3 +-
 arch/arm/mach-omap2/timer.c                           |    7 ++
 arch/arm/mm/mm.h                                      |    3 +
 arch/arm/mm/mmu.c                                     |    4 +-
 arch/mips/mm/gup.c                                    |    2 +
 arch/powerpc/platforms/85xx/p1022_ds.c                |  102 ++++++++++++++++++++++++---
 arch/s390/oprofile/init.c                             |   10 +--
 arch/x86/include/asm/xen/page.h                       |    3 +-
 arch/x86/kernel/cpu/common.c                          |    2 +
 arch/x86/kernel/cpu/perf_event_amd_ibs.c              |   12 ++++
 arch/x86/xen/enlighten.c                              |    4 ++
 arch/x86/xen/p2m.c                                    |   27 +++-----
 arch/x86/xen/setup.c                                  |    4 ++
 drivers/acpi/bus.c                                    |   10 +++
 drivers/acpi/power.c                                  |   36 ++++++----
 drivers/ata/ahci.c                                    |    2 +
 drivers/ata/libata-core.c                             |    1 +
 drivers/base/core.c                                   |    4 +-
 drivers/base/power/runtime.c                          |   13 ++--
 drivers/block/cciss_scsi.c                            |    1 +
 drivers/block/nbd.c                                   |    9 +++
 drivers/block/xen-blkback/blkback.c                   |    2 +-
 drivers/bluetooth/ath3k.c                             |    4 ++
 drivers/bluetooth/btusb.c                             |   12 ++--
 drivers/cpufreq/powernow-k8.c                         |   63 +++++++++--------
 drivers/dma/at_hdmac.c                                |   13 +++-
 drivers/dma/pl330.c                                   |   21 ++++--
 drivers/gpio/gpio-lpc32xx.c                           |    5 ++
 drivers/gpu/drm/drm_crtc.c                            |    2 +-
 drivers/gpu/drm/drm_edid.c                            |    3 +
 drivers/gpu/drm/gma500/oaktrail_device.c              |    2 +
 drivers/gpu/drm/i915/i915_gem.c                       |    3 +-
 drivers/gpu/drm/i915/i915_irq.c                       |    3 -
 drivers/gpu/drm/i915/intel_crt.c                      |   36 +++++++++-
 drivers/gpu/drm/i915/intel_display.c                  |   24 +++----
 drivers/gpu/drm/i915/intel_drv.h                      |    2 +
 drivers/gpu/drm/i915/intel_hdmi.c                     |    2 +-
 drivers/gpu/drm/i915/intel_modes.c                    |   31 ++++++---
 drivers/gpu/drm/i915/intel_pm.c                       |   11 +--
 drivers/gpu/drm/i915/intel_sdvo.c                     |   23 +++----
 drivers/gpu/drm/nouveau/nouveau_display.c             |    2 +-
 drivers/gpu/drm/nouveau/nouveau_state.c               |    6 +-
 drivers/gpu/drm/nouveau/nv84_fifo.c                   |    9 +++
 drivers/gpu/drm/radeon/atombios_crtc.c                |   61 +++++++++-------
 drivers/gpu/drm/radeon/atombios_encoders.c            |  140 +++++++++++++++++++------------------
 drivers/gpu/drm/radeon/radeon.h                       |   16 +----
 drivers/gpu/drm/radeon/radeon_atombios.c              |    2 +-
 drivers/gpu/drm/radeon/radeon_atpx_handler.c          |   56 +--------------
 drivers/gpu/drm/radeon/radeon_bios.c                  |  138 +++++++++++++++++++++++++++++++++++--
 drivers/gpu/drm/radeon/radeon_cs.c                    |   30 +++++++-
 drivers/gpu/drm/radeon/radeon_device.c                |    2 +-
 drivers/gpu/drm/radeon/radeon_fence.c                 |    8 ++-
 drivers/gpu/drm/radeon/radeon_gart.c                  |   24 ++++++-
 drivers/gpu/drm/radeon/radeon_gem.c                   |   13 +---
 drivers/gpu/drm/radeon/radeon_object.c                |    6 +-
 drivers/gpu/drm/radeon/radeon_ring.c                  |    1 +
 drivers/gpu/drm/udl/udl_connector.c                   |    7 ++
 drivers/gpu/drm/vmwgfx/vmwgfx_drv.c                   |    5 ++
 drivers/gpu/drm/vmwgfx/vmwgfx_drv.h                   |   10 +++
 drivers/gpu/drm/vmwgfx/vmwgfx_fence.c                 |    2 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_resource.c              |   73 ++++++++++++++++++++
 drivers/hid/hid-logitech-dj.c                         |   49 ++++++++++++-
 drivers/hid/hid-logitech-dj.h                         |    1 +
 drivers/hwmon/ad7314.c                                |    8 +++
 drivers/hwmon/ads7871.c                               |    9 +++
 drivers/hwmon/fam15h_power.c                          |   15 +++-
 drivers/hwmon/ina2xx.c                                |   30 +++-----
 drivers/hwmon/twl4030-madc-hwmon.c                    |    9 +--
 drivers/i2c/busses/i2c-powermac.c                     |  157 +++++++++++++++++++++++++++++++++++-------
 drivers/input/serio/i8042-x86ia64io.h                 |    6 ++
 drivers/input/tablet/wacom_sys.c                      |   10 +--
 drivers/input/tablet/wacom_wac.c                      |   27 ++++++--
 drivers/input/tablet/wacom_wac.h                      |    9 +--
 drivers/iommu/intel_irq_remapping.c                   |   18 +++--
 drivers/isdn/hardware/mISDN/avmfritz.c                |    3 +-
 drivers/isdn/hardware/mISDN/mISDNipac.c               |    3 +-
 drivers/isdn/hardware/mISDN/mISDNisar.c               |    3 +-
 drivers/isdn/hardware/mISDN/netjet.c                  |    3 +-
 drivers/isdn/hardware/mISDN/w6692.c                   |    3 +-
 drivers/isdn/isdnloop/isdnloop.c                      |   12 ----
 drivers/isdn/mISDN/hwchannel.c                        |    9 ++-
 drivers/md/md.c                                       |   15 ++--
 drivers/md/raid10.c                                   |   38 ++++++----
 drivers/md/raid10.h                                   |    2 +-
 drivers/md/raid5.c                                    |    4 ++
 drivers/media/rc/rc-main.c                            |    5 +-
 drivers/misc/sgi-xp/xpc_uv.c                          |   84 ++++++++++++++++++-----
 drivers/mmc/card/block.c                              |   26 ++++++-
 drivers/mmc/host/atmel-mci.c                          |    6 +-
 drivers/mmc/host/mxs-mmc.c                            |   14 ++--
 drivers/mmc/host/sdhci-esdhc.h                        |    6 +-
 drivers/net/can/janz-ican3.c                          |    4 +-
 drivers/net/can/mcp251x.c                             |   11 ++-
 drivers/net/can/ti_hecc.c                             |    2 +-
 drivers/net/ethernet/cirrus/cs89x0.c                  |   10 +--
 drivers/net/ethernet/freescale/gianfar.c              |    2 +-
 drivers/net/ethernet/freescale/gianfar_ethtool.c      |    1 +
 drivers/net/ethernet/freescale/gianfar_ptp.c          |    4 +-
 drivers/net/ethernet/ibm/ibmveth.c                    |   26 +++----
 drivers/net/ethernet/sfc/efx.c                        |    6 ++
 drivers/net/ethernet/sfc/efx.h                        |   14 ++--
 drivers/net/ethernet/sfc/ethtool.c                    |   20 ++++--
 drivers/net/ethernet/sfc/tx.c                         |   19 +++++
 drivers/net/netconsole.c                              |    1 -
 drivers/net/ppp/pptp.c                                |    4 +-
 drivers/net/usb/asix.c                                |    4 ++
 drivers/net/usb/qmi_wwan.c                            |   58 ++++++++++++++++
 drivers/net/usb/usbnet.c                              |   16 +++--
 drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c  |   26 ++++---
 drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c |    6 +-
 drivers/net/wireless/iwlwifi/iwl-debugfs.c            |    3 +
 drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h     |    2 +-
 drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c      |    2 +-
 drivers/net/wireless/iwlwifi/iwl-trans-pcie.c         |   31 +++++----
 drivers/net/wireless/rt2x00/rt2400pci.c               |    9 +++
 drivers/net/wireless/rt2x00/rt2400pci.h               |    1 +
 drivers/net/wireless/rt2x00/rt2500pci.c               |    9 +++
 drivers/net/wireless/rt2x00/rt2500usb.c               |   11 ++-
 drivers/net/wireless/rt2x00/rt2500usb.h               |   17 ++---
 drivers/net/wireless/rt2x00/rt2800pci.c               |    9 +++
 drivers/net/wireless/rt2x00/rt2800usb.c               |   22 +++++-
 drivers/net/wireless/rt2x00/rt2x00dev.c               |    2 +-
 drivers/net/wireless/rt2x00/rt61pci.c                 |    9 +++
 drivers/net/wireless/rt2x00/rt61pci.h                 |    1 +
 drivers/net/wireless/rt2x00/rt73usb.c                 |    9 +++
 drivers/net/wireless/rt2x00/rt73usb.h                 |    3 +
 drivers/net/wireless/rtlwifi/rtl8192ce/def.h          |    1 +
 drivers/net/wireless/rtlwifi/rtl8192ce/hw.c           |   12 +++-
 drivers/net/wireless/rtlwifi/rtl8192ce/sw.c           |    6 +-
 drivers/platform/x86/asus-laptop.c                    |    8 +--
 drivers/platform/x86/asus-nb-wmi.c                    |    4 ++
 drivers/rtc/rtc-rs5c348.c                             |    7 +-
 drivers/rtc/rtc-twl.c                                 |    5 ++
 drivers/scsi/bnx2i/bnx2i_hwi.c                        |    3 +
 drivers/scsi/hpsa.c                                   |    3 +-
 drivers/scsi/lpfc/Makefile                            |    2 +
 drivers/scsi/mpt2sas/mpt2sas_base.c                   |    7 ++
 drivers/scsi/virtio_scsi.c                            |    2 +-
 drivers/staging/android/android_alarm.h               |    4 +-
 drivers/staging/comedi/drivers/amplc_pci224.c         |    7 ++
 drivers/staging/comedi/drivers/das08.c                |    4 +-
 drivers/staging/media/lirc/lirc_sir.c                 |   60 +++++++++++++++-
 drivers/staging/rtl8712/recv_linux.c                  |    7 +-
 drivers/staging/speakup/main.c                        |    2 +-
 drivers/staging/vt6656/dpc.c                          |    2 +-
 drivers/staging/vt6656/rxtx.c                         |   38 +++++-----
 drivers/staging/zcache/zcache-main.c                  |    7 +-
 drivers/target/target_core_transport.c                |   58 ++++++----------
 drivers/tty/serial/imx.c                              |   30 ++++----
 drivers/tty/serial/pch_uart.c                         |   59 +++++++++++-----
 drivers/usb/chipidea/udc.c                            |   58 +++++++++++-----
 drivers/usb/class/cdc-wdm.c                           |   12 ++--
 drivers/usb/core/devices.c                            |    2 +-
 drivers/usb/core/hcd.c                                |    6 +-
 drivers/usb/core/quirks.c                             |    4 ++
 drivers/usb/dwc3/core.c                               |    9 ++-
 drivers/usb/dwc3/ep0.c                                |    1 -
 drivers/usb/dwc3/gadget.c                             |    7 +-
 drivers/usb/gadget/at91_udc.c                         |    6 +-
 drivers/usb/gadget/dummy_hcd.c                        |   41 +++++++++--
 drivers/usb/host/ehci-omap.c                          |  164 +-------------------------------------------
 drivers/usb/host/ehci-q.c                             |   12 +++-
 drivers/usb/host/ohci-at91.c                          |   13 +++-
 drivers/usb/host/pci-quirks.c                         |   42 ++++++++++--
 drivers/usb/host/pci-quirks.h                         |    1 +
 drivers/usb/host/xhci-hub.c                           |   42 ++++++++++++
 drivers/usb/host/xhci-plat.c                          |    2 +-
 drivers/usb/host/xhci.c                               |  123 ++++++++++++++++++++++++++++++++-
 drivers/usb/host/xhci.h                               |    6 ++
 drivers/usb/serial/ftdi_sio.c                         |   22 +++++-
 drivers/usb/serial/ftdi_sio_ids.h                     |   29 +++++++-
 drivers/usb/serial/option.c                           |    6 +-
 drivers/video/console/fbcon.c                         |    9 ++-
 drivers/watchdog/hpwdt.c                              |    3 +
 drivers/xen/gntdev.c                                  |    5 +-
 drivers/xen/grant-table.c                             |    6 +-
 fs/cifs/cifs_unicode.c                                |    2 +-
 fs/dcache.c                                           |    4 +-
 fs/ecryptfs/inode.c                                   |    5 ++
 fs/nfs/dir.c                                          |    4 +-
 fs/nfs/inode.c                                        |    2 +-
 fs/nfs/nfs3proc.c                                     |    2 +-
 fs/nfs/nfs4proc.c                                     |    4 +-
 fs/nfs/nfs4xdr.c                                      |    3 +-
 fs/nfs/super.c                                        |    2 +
 fs/nfsd/nfsctl.c                                      |    8 +--
 fs/nfsd/nfsd.h                                        |   11 +++
 fs/nfsd/nfssvc.c                                      |   24 +++----
 fs/proc/proc_sysctl.c                                 |    5 +-
 fs/stat.c                                             |    2 +-
 include/asm-generic/mutex-xchg.h                      |   11 ++-
 include/drm/drm_mode.h                                |    5 +-
 include/linux/dcache.h                                |    2 +
 include/linux/init_task.h                             |   12 +++-
 include/linux/kobject.h                               |    2 +-
 include/linux/kthread.h                               |    8 +--
 include/linux/ktime.h                                 |    7 --
 include/linux/mISDNhw.h                               |    2 +-
 include/linux/memory.h                                |    2 +-
 include/linux/mmc/card.h                              |    1 +
 include/linux/netdevice.h                             |    4 ++
 include/linux/nfs_fs.h                                |    5 --
 include/linux/pci_ids.h                               |    2 +-
 include/linux/perf_event.h                            |    4 +-
 include/linux/sched.h                                 |    5 +-
 include/linux/security.h                              |    1 +
 include/linux/sunrpc/xprt.h                           |    3 +
 include/linux/time.h                                  |   29 +++++++-
 include/net/bluetooth/smp.h                           |    2 +-
 include/net/codel.h                                   |    8 ++-
 include/net/scm.h                                     |    4 +-
 include/net/sock.h                                    |    2 +
 include/trace/events/kmem.h                           |    4 +-
 include/xen/grant_table.h                             |    3 +-
 kernel/async.c                                        |   13 ++--
 kernel/events/core.c                                  |   62 +++++++++--------
 kernel/kthread.c                                      |   88 ++++++++++++++----------
 kernel/sched/core.c                                   |    9 ++-
 kernel/sched/sched.h                                  |   23 +++----
 kernel/time/tick-sched.c                              |    1 +
 kernel/time/timekeeping.c                             |   32 ++++++++-
 kernel/workqueue.c                                    |   34 ++++-----
 lib/digsig.c                                          |    6 +-
 mm/memory_hotplug.c                                   |   16 +++--
 mm/page_alloc.c                                       |    2 +-
 net/atm/common.c                                      |    1 +
 net/atm/pvc.c                                         |    1 +
 net/bluetooth/hci_conn.c                              |    4 ++
 net/bluetooth/hci_core.c                              |    2 +
 net/bluetooth/hci_sock.c                              |    2 +
 net/bluetooth/l2cap_core.c                            |   11 +--
 net/bluetooth/l2cap_sock.c                            |    3 +-
 net/bluetooth/mgmt.c                                  |   16 +++++
 net/bluetooth/rfcomm/sock.c                           |    2 +
 net/bluetooth/rfcomm/tty.c                            |    2 +-
 net/bluetooth/smp.c                                   |   10 +--
 net/core/dev.c                                        |   27 ++++++--
 net/core/sock.c                                       |    1 +
 net/dccp/ccids/ccid3.c                                |    1 +
 net/ipv4/ipmr.c                                       |   14 +++-
 net/ipv4/tcp.c                                        |    4 +-
 net/ipv4/tcp_cong.c                                   |    3 +-
 net/ipv4/tcp_input.c                                  |   15 ++--
 net/ipv4/tcp_output.c                                 |   21 +++---
 net/ipv6/addrconf.c                                   |    4 +-
 net/l2tp/l2tp_core.c                                  |    3 +-
 net/l2tp/l2tp_core.h                                  |    1 +
 net/l2tp/l2tp_ip6.c                                   |    1 +
 net/llc/af_llc.c                                      |    3 +-
 net/mac80211/mlme.c                                   |    4 ++
 net/netfilter/ipvs/ip_vs_ctl.c                        |    1 +
 net/netlink/af_netlink.c                              |    6 +-
 net/openvswitch/vport-internal_dev.c                  |    8 +++
 net/packet/af_packet.c                                |   10 ++-
 net/rds/recv.c                                        |    3 +
 net/sched/act_gact.c                                  |   14 +++-
 net/socket.c                                          |    1 +
 net/sunrpc/xprt.c                                     |   34 +++++----
 net/sunrpc/xprtrdma/transport.c                       |    1 +
 net/sunrpc/xprtsock.c                                 |    3 +
 net/unix/af_unix.c                                    |    4 +-
 net/wireless/reg.c                                    |   12 +++-
 sound/aoa/codecs/onyx.c                               |   75 +-------------------
 sound/aoa/codecs/tas.c                                |   80 +--------------------
 sound/pci/hda/hda_codec.c                             |    2 +-
 sound/pci/hda/patch_realtek.c                         |   22 +++++-
 sound/pci/hda/patch_sigmatel.c                        |    2 +-
 sound/pci/ice1712/prodigy_hifi.c                      |    3 +-
 sound/soc/codecs/wm2000.c                             |    2 +-
 sound/soc/samsung/dma.c                               |    8 +--
 sound/soc/tegra/tegra_alc5632.c                       |    1 -
 sound/usb/endpoint.c                                  |    8 ++-
 sound/usb/pcm.c                                       |    6 ++
 286 files changed, 2787 insertions(+), 1399 deletions(-)



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 001/262] codel: refine one condition to avoid a nul rec_inv_sqrt
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
@ 2012-09-28 18:48 ` Greg Kroah-Hartman
  2012-09-28 18:48 ` [ 002/262] net: Allow driver to limit number of GSO segments per skb Greg Kroah-Hartman
                   ` (260 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:48 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Anton Mich, Eric Dumazet, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 2359a47671fc4fb0fe5e9945f76c2cb10792c0f8 ]

One condition before codel_Newton_step() was not good if
we never left the dropping state for a flow. As a result
rec_inv_sqrt was 0, instead of the ~0 initial value.

codel control law was then set to a very aggressive mode, dropping
many packets before reaching 'target' and recovering from this problem.

To keep codel_vars_init() as efficient as possible, refine
the condition to make sure rec_inv_sqrt initial value is correct

Many thanks to Anton Mich for discovering the issue and suggesting
a fix.

Reported-by: Anton Mich <lp2s1h@gmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/codel.h |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/include/net/codel.h
+++ b/include/net/codel.h
@@ -305,6 +305,8 @@ static struct sk_buff *codel_dequeue(str
 			}
 		}
 	} else if (drop) {
+		u32 delta;
+
 		if (params->ecn && INET_ECN_set_ce(skb)) {
 			stats->ecn_mark++;
 		} else {
@@ -320,9 +322,11 @@ static struct sk_buff *codel_dequeue(str
 		 * assume that the drop rate that controlled the queue on the
 		 * last cycle is a good starting point to control it now.
 		 */
-		if (codel_time_before(now - vars->drop_next,
+		delta = vars->count - vars->lastcount;
+		if (delta > 1 &&
+		    codel_time_before(now - vars->drop_next,
 				      16 * params->interval)) {
-			vars->count = (vars->count - vars->lastcount) | 1;
+			vars->count = delta;
 			/* we dont care if rec_inv_sqrt approximation
 			 * is not very precise :
 			 * Next Newton steps will correct it quadratically.



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 002/262] net: Allow driver to limit number of GSO segments per skb
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
  2012-09-28 18:48 ` [ 001/262] codel: refine one condition to avoid a nul rec_inv_sqrt Greg Kroah-Hartman
@ 2012-09-28 18:48 ` Greg Kroah-Hartman
  2012-09-28 18:48 ` [ 003/262] sfc: Fix maximum number of TSO segments and minimum TX queue size Greg Kroah-Hartman
                   ` (259 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:48 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Ben Hutchings, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Ben Hutchings <bhutchings@solarflare.com>

[ Upstream commit 30b678d844af3305cda5953467005cebb5d7b687 ]

A peer (or local user) may cause TCP to use a nominal MSS of as little
as 88 (actual MSS of 76 with timestamps).  Given that we have a
sufficiently prodigious local sender and the peer ACKs quickly enough,
it is nevertheless possible to grow the window for such a connection
to the point that we will try to send just under 64K at once.  This
results in a single skb that expands to 861 segments.

In some drivers with TSO support, such an skb will require hundreds of
DMA descriptors; a substantial fraction of a TX ring or even more than
a full ring.  The TX queue selected for the skb may stall and trigger
the TX watchdog repeatedly (since the problem skb will be retried
after the TX reset).  This particularly affects sfc, for which the
issue is designated as CVE-2012-3412.

Therefore:
1. Add the field net_device::gso_max_segs holding the device-specific
   limit.
2. In netif_skb_features(), if the number of segments is too high then
   mask out GSO features to force fall back to software GSO.

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/netdevice.h |    2 ++
 net/core/dev.c            |    4 ++++
 2 files changed, 6 insertions(+)

--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1301,6 +1301,8 @@ struct net_device {
 	/* for setting kernel sock attribute on TCP connection setup */
 #define GSO_MAX_SIZE		65536
 	unsigned int		gso_max_size;
+#define GSO_MAX_SEGS		65535
+	u16			gso_max_segs;
 
 #ifdef CONFIG_DCB
 	/* Data Center Bridging netlink ops */
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2119,6 +2119,9 @@ netdev_features_t netif_skb_features(str
 	__be16 protocol = skb->protocol;
 	netdev_features_t features = skb->dev->features;
 
+	if (skb_shinfo(skb)->gso_segs > skb->dev->gso_max_segs)
+		features &= ~NETIF_F_GSO_MASK;
+
 	if (protocol == htons(ETH_P_8021Q)) {
 		struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
 		protocol = veh->h_vlan_encapsulated_proto;
@@ -5911,6 +5914,7 @@ struct net_device *alloc_netdev_mqs(int
 	dev_net_set(dev, &init_net);
 
 	dev->gso_max_size = GSO_MAX_SIZE;
+	dev->gso_max_segs = GSO_MAX_SEGS;
 
 	INIT_LIST_HEAD(&dev->napi_list);
 	INIT_LIST_HEAD(&dev->unreg_list);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 003/262] sfc: Fix maximum number of TSO segments and minimum TX queue size
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
  2012-09-28 18:48 ` [ 001/262] codel: refine one condition to avoid a nul rec_inv_sqrt Greg Kroah-Hartman
  2012-09-28 18:48 ` [ 002/262] net: Allow driver to limit number of GSO segments per skb Greg Kroah-Hartman
@ 2012-09-28 18:48 ` Greg Kroah-Hartman
  2012-09-28 18:48 ` [ 004/262] tcp: Apply device TSO segment limit earlier Greg Kroah-Hartman
                   ` (258 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:48 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Ben Hutchings, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Ben Hutchings <bhutchings@solarflare.com>

[ Upstream commit 7e6d06f0de3f74ca929441add094518ae332257c ]


Currently an skb requiring TSO may not fit within a minimum-size TX
queue.  The TX queue selected for the skb may stall and trigger the TX
watchdog repeatedly (since the problem skb will be retried after the
TX reset).  This issue is designated as CVE-2012-3412.

Set the maximum number of TSO segments for our devices to 100.  This
should make no difference to behaviour unless the actual MSS is less
than about 700.  Increase the minimum TX queue size accordingly to
allow for 2 worst-case skbs, so that there will definitely be space
to add an skb after we wake a queue.

To avoid invalidating existing configurations, change
efx_ethtool_set_ringparam() to fix up values that are too small rather
than returning -EINVAL.

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/sfc/efx.c     |    6 ++++++
 drivers/net/ethernet/sfc/efx.h     |   14 ++++++++++----
 drivers/net/ethernet/sfc/ethtool.c |   16 +++++++++++-----
 drivers/net/ethernet/sfc/tx.c      |   19 +++++++++++++++++++
 4 files changed, 46 insertions(+), 9 deletions(-)

--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -1503,6 +1503,11 @@ static int efx_probe_all(struct efx_nic
 		goto fail2;
 	}
 
+	BUILD_BUG_ON(EFX_DEFAULT_DMAQ_SIZE < EFX_RXQ_MIN_ENT);
+	if (WARN_ON(EFX_DEFAULT_DMAQ_SIZE < EFX_TXQ_MIN_ENT(efx))) {
+		rc = -EINVAL;
+		goto fail3;
+	}
 	efx->rxq_entries = efx->txq_entries = EFX_DEFAULT_DMAQ_SIZE;
 
 	rc = efx_probe_filters(efx);
@@ -2070,6 +2075,7 @@ static int efx_register_netdev(struct ef
 	net_dev->irq = efx->pci_dev->irq;
 	net_dev->netdev_ops = &efx_netdev_ops;
 	SET_ETHTOOL_OPS(net_dev, &efx_ethtool_ops);
+	net_dev->gso_max_segs = EFX_TSO_MAX_SEGS;
 
 	rtnl_lock();
 
--- a/drivers/net/ethernet/sfc/efx.h
+++ b/drivers/net/ethernet/sfc/efx.h
@@ -30,6 +30,7 @@ extern netdev_tx_t
 efx_enqueue_skb(struct efx_tx_queue *tx_queue, struct sk_buff *skb);
 extern void efx_xmit_done(struct efx_tx_queue *tx_queue, unsigned int index);
 extern int efx_setup_tc(struct net_device *net_dev, u8 num_tc);
+extern unsigned int efx_tx_max_skb_descs(struct efx_nic *efx);
 
 /* RX */
 extern int efx_probe_rx_queue(struct efx_rx_queue *rx_queue);
@@ -52,10 +53,15 @@ extern void efx_schedule_slow_fill(struc
 #define EFX_MAX_EVQ_SIZE 16384UL
 #define EFX_MIN_EVQ_SIZE 512UL
 
-/* The smallest [rt]xq_entries that the driver supports. Callers of
- * efx_wake_queue() assume that they can subsequently send at least one
- * skb. Falcon/A1 may require up to three descriptors per skb_frag. */
-#define EFX_MIN_RING_SIZE (roundup_pow_of_two(2 * 3 * MAX_SKB_FRAGS))
+/* Maximum number of TCP segments we support for soft-TSO */
+#define EFX_TSO_MAX_SEGS	100
+
+/* The smallest [rt]xq_entries that the driver supports.  RX minimum
+ * is a bit arbitrary.  For TX, we must have space for at least 2
+ * TSO skbs.
+ */
+#define EFX_RXQ_MIN_ENT		128U
+#define EFX_TXQ_MIN_ENT(efx)	(2 * efx_tx_max_skb_descs(efx))
 
 /* Filters */
 extern int efx_probe_filters(struct efx_nic *efx);
--- a/drivers/net/ethernet/sfc/ethtool.c
+++ b/drivers/net/ethernet/sfc/ethtool.c
@@ -680,21 +680,27 @@ static int efx_ethtool_set_ringparam(str
 				     struct ethtool_ringparam *ring)
 {
 	struct efx_nic *efx = netdev_priv(net_dev);
+	u32 txq_entries;
 
 	if (ring->rx_mini_pending || ring->rx_jumbo_pending ||
 	    ring->rx_pending > EFX_MAX_DMAQ_SIZE ||
 	    ring->tx_pending > EFX_MAX_DMAQ_SIZE)
 		return -EINVAL;
 
-	if (ring->rx_pending < EFX_MIN_RING_SIZE ||
-	    ring->tx_pending < EFX_MIN_RING_SIZE) {
+	if (ring->rx_pending < EFX_RXQ_MIN_ENT) {
 		netif_err(efx, drv, efx->net_dev,
-			  "TX and RX queues cannot be smaller than %ld\n",
-			  EFX_MIN_RING_SIZE);
+			  "RX queues cannot be smaller than %u\n",
+			  EFX_RXQ_MIN_ENT);
 		return -EINVAL;
 	}
 
-	return efx_realloc_channels(efx, ring->rx_pending, ring->tx_pending);
+	txq_entries = max(ring->tx_pending, EFX_TXQ_MIN_ENT(efx));
+	if (txq_entries != ring->tx_pending)
+		netif_warn(efx, drv, efx->net_dev,
+			   "increasing TX queue size to minimum of %u\n",
+			   txq_entries);
+
+	return efx_realloc_channels(efx, ring->rx_pending, txq_entries);
 }
 
 static int efx_ethtool_set_pauseparam(struct net_device *net_dev,
--- a/drivers/net/ethernet/sfc/tx.c
+++ b/drivers/net/ethernet/sfc/tx.c
@@ -119,6 +119,25 @@ efx_max_tx_len(struct efx_nic *efx, dma_
 	return len;
 }
 
+unsigned int efx_tx_max_skb_descs(struct efx_nic *efx)
+{
+	/* Header and payload descriptor for each output segment, plus
+	 * one for every input fragment boundary within a segment
+	 */
+	unsigned int max_descs = EFX_TSO_MAX_SEGS * 2 + MAX_SKB_FRAGS;
+
+	/* Possibly one more per segment for the alignment workaround */
+	if (EFX_WORKAROUND_5391(efx))
+		max_descs += EFX_TSO_MAX_SEGS;
+
+	/* Possibly more for PCIe page boundaries within input fragments */
+	if (PAGE_SIZE > EFX_PAGE_SIZE)
+		max_descs += max_t(unsigned int, MAX_SKB_FRAGS,
+				   DIV_ROUND_UP(GSO_MAX_SIZE, EFX_PAGE_SIZE));
+
+	return max_descs;
+}
+
 /*
  * Add a socket buffer to a TX queue
  *



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 004/262] tcp: Apply device TSO segment limit earlier
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (2 preceding siblings ...)
  2012-09-28 18:48 ` [ 003/262] sfc: Fix maximum number of TSO segments and minimum TX queue size Greg Kroah-Hartman
@ 2012-09-28 18:48 ` Greg Kroah-Hartman
  2012-09-28 18:48 ` [ 005/262] net_sched: gact: Fix potential panic in tcf_gact() Greg Kroah-Hartman
                   ` (257 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:48 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Ben Hutchings, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Ben Hutchings <bhutchings@solarflare.com>

[ Upstream commit 1485348d2424e1131ea42efc033cbd9366462b01 ]

Cache the device gso_max_segs in sock::sk_gso_max_segs and use it to
limit the size of TSO skbs.  This avoids the need to fall back to
software GSO for local TCP senders.

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/sock.h    |    2 ++
 net/core/sock.c       |    1 +
 net/ipv4/tcp.c        |    4 +++-
 net/ipv4/tcp_cong.c   |    3 ++-
 net/ipv4/tcp_output.c |   21 ++++++++++++---------
 5 files changed, 20 insertions(+), 11 deletions(-)

--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -217,6 +217,7 @@ struct cg_proto;
   *	@sk_route_nocaps: forbidden route capabilities (e.g NETIF_F_GSO_MASK)
   *	@sk_gso_type: GSO type (e.g. %SKB_GSO_TCPV4)
   *	@sk_gso_max_size: Maximum GSO segment size to build
+  *	@sk_gso_max_segs: Maximum number of GSO segments
   *	@sk_lingertime: %SO_LINGER l_linger setting
   *	@sk_backlog: always used with the per-socket spinlock held
   *	@sk_callback_lock: used with the callbacks in the end of this struct
@@ -336,6 +337,7 @@ struct sock {
 	netdev_features_t	sk_route_nocaps;
 	int			sk_gso_type;
 	unsigned int		sk_gso_max_size;
+	u16			sk_gso_max_segs;
 	int			sk_rcvlowat;
 	unsigned long	        sk_lingertime;
 	struct sk_buff_head	sk_error_queue;
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1403,6 +1403,7 @@ void sk_setup_caps(struct sock *sk, stru
 		} else {
 			sk->sk_route_caps |= NETIF_F_SG | NETIF_F_HW_CSUM;
 			sk->sk_gso_max_size = dst->dev->gso_max_size;
+			sk->sk_gso_max_segs = dst->dev->gso_max_segs;
 		}
 	}
 }
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -805,7 +805,9 @@ static unsigned int tcp_xmit_size_goal(s
 			   old_size_goal + mss_now > xmit_size_goal)) {
 			xmit_size_goal = old_size_goal;
 		} else {
-			tp->xmit_size_goal_segs = xmit_size_goal / mss_now;
+			tp->xmit_size_goal_segs =
+				min_t(u16, xmit_size_goal / mss_now,
+				      sk->sk_gso_max_segs);
 			xmit_size_goal = tp->xmit_size_goal_segs * mss_now;
 		}
 	}
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -291,7 +291,8 @@ bool tcp_is_cwnd_limited(const struct so
 	left = tp->snd_cwnd - in_flight;
 	if (sk_can_gso(sk) &&
 	    left * sysctl_tcp_tso_win_divisor < tp->snd_cwnd &&
-	    left * tp->mss_cache < sk->sk_gso_max_size)
+	    left * tp->mss_cache < sk->sk_gso_max_size &&
+	    left < sk->sk_gso_max_segs)
 		return true;
 	return left <= tcp_max_tso_deferred_mss(tp);
 }
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1334,21 +1334,21 @@ static void tcp_cwnd_validate(struct soc
  * when we would be allowed to send the split-due-to-Nagle skb fully.
  */
 static unsigned int tcp_mss_split_point(const struct sock *sk, const struct sk_buff *skb,
-					unsigned int mss_now, unsigned int cwnd)
+					unsigned int mss_now, unsigned int max_segs)
 {
 	const struct tcp_sock *tp = tcp_sk(sk);
-	u32 needed, window, cwnd_len;
+	u32 needed, window, max_len;
 
 	window = tcp_wnd_end(tp) - TCP_SKB_CB(skb)->seq;
-	cwnd_len = mss_now * cwnd;
+	max_len = mss_now * max_segs;
 
-	if (likely(cwnd_len <= window && skb != tcp_write_queue_tail(sk)))
-		return cwnd_len;
+	if (likely(max_len <= window && skb != tcp_write_queue_tail(sk)))
+		return max_len;
 
 	needed = min(skb->len, window);
 
-	if (cwnd_len <= needed)
-		return cwnd_len;
+	if (max_len <= needed)
+		return max_len;
 
 	return needed - needed % mss_now;
 }
@@ -1577,7 +1577,8 @@ static bool tcp_tso_should_defer(struct
 	limit = min(send_win, cong_win);
 
 	/* If a full-sized TSO skb can be sent, do it. */
-	if (limit >= sk->sk_gso_max_size)
+	if (limit >= min_t(unsigned int, sk->sk_gso_max_size,
+			   sk->sk_gso_max_segs * tp->mss_cache))
 		goto send_now;
 
 	/* Middle in queue won't get any more data, full sendable already? */
@@ -1803,7 +1804,9 @@ static bool tcp_write_xmit(struct sock *
 		limit = mss_now;
 		if (tso_segs > 1 && !tcp_urg_mode(tp))
 			limit = tcp_mss_split_point(sk, skb, mss_now,
-						    cwnd_quota);
+						    min_t(unsigned int,
+							  cwnd_quota,
+							  sk->sk_gso_max_segs));
 
 		if (skb->len > limit &&
 		    unlikely(tso_fragment(sk, skb, limit, mss_now, gfp)))



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 005/262] net_sched: gact: Fix potential panic in tcf_gact().
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (3 preceding siblings ...)
  2012-09-28 18:48 ` [ 004/262] tcp: Apply device TSO segment limit earlier Greg Kroah-Hartman
@ 2012-09-28 18:48 ` Greg Kroah-Hartman
  2012-09-28 18:48 ` [ 006/262] isdnloop: fix and simplify isdnloop_init() Greg Kroah-Hartman
                   ` (256 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:48 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Hiroaki SHIMODA, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Hiroaki SHIMODA <shimoda.hiroaki@gmail.com>

[ Upstream commit 696ecdc10622d86541f2e35cc16e15b6b3b1b67e ]

gact_rand array is accessed by gact->tcfg_ptype whose value
is assumed to less than MAX_RAND, but any range checks are
not performed.

So add a check in tcf_gact_init(). And in tcf_gact(), we can
reduce a branch.

Signed-off-by: Hiroaki SHIMODA <shimoda.hiroaki@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/act_gact.c |   14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

--- a/net/sched/act_gact.c
+++ b/net/sched/act_gact.c
@@ -67,6 +67,9 @@ static int tcf_gact_init(struct nlattr *
 	struct tcf_common *pc;
 	int ret = 0;
 	int err;
+#ifdef CONFIG_GACT_PROB
+	struct tc_gact_p *p_parm = NULL;
+#endif
 
 	if (nla == NULL)
 		return -EINVAL;
@@ -82,6 +85,12 @@ static int tcf_gact_init(struct nlattr *
 #ifndef CONFIG_GACT_PROB
 	if (tb[TCA_GACT_PROB] != NULL)
 		return -EOPNOTSUPP;
+#else
+	if (tb[TCA_GACT_PROB]) {
+		p_parm = nla_data(tb[TCA_GACT_PROB]);
+		if (p_parm->ptype >= MAX_RAND)
+			return -EINVAL;
+	}
 #endif
 
 	pc = tcf_hash_check(parm->index, a, bind, &gact_hash_info);
@@ -103,8 +112,7 @@ static int tcf_gact_init(struct nlattr *
 	spin_lock_bh(&gact->tcf_lock);
 	gact->tcf_action = parm->action;
 #ifdef CONFIG_GACT_PROB
-	if (tb[TCA_GACT_PROB] != NULL) {
-		struct tc_gact_p *p_parm = nla_data(tb[TCA_GACT_PROB]);
+	if (p_parm) {
 		gact->tcfg_paction = p_parm->paction;
 		gact->tcfg_pval    = p_parm->pval;
 		gact->tcfg_ptype   = p_parm->ptype;
@@ -133,7 +141,7 @@ static int tcf_gact(struct sk_buff *skb,
 
 	spin_lock(&gact->tcf_lock);
 #ifdef CONFIG_GACT_PROB
-	if (gact->tcfg_ptype && gact_rand[gact->tcfg_ptype] != NULL)
+	if (gact->tcfg_ptype)
 		action = gact_rand[gact->tcfg_ptype](gact);
 	else
 		action = gact->tcf_action;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 006/262] isdnloop: fix and simplify isdnloop_init()
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (4 preceding siblings ...)
  2012-09-28 18:48 ` [ 005/262] net_sched: gact: Fix potential panic in tcf_gact() Greg Kroah-Hartman
@ 2012-09-28 18:48 ` Greg Kroah-Hartman
  2012-09-28 18:48 ` [ 007/262] pptp: lookup route with the proper net namespace Greg Kroah-Hartman
                   ` (255 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:48 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Fengguang Wu, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Wu Fengguang <fengguang.wu@intel.com>

[ Upstream commit 77f00f6324cb97cf1df6f9c4aaeea6ada23abdb2 ]

Fix a buffer overflow bug by removing the revision and printk.

[   22.016214] isdnloop-ISDN-driver Rev 1.11.6.7
[   22.097508] isdnloop: (loop0) virtual card added
[   22.174400] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffff83244972
[   22.174400]
[   22.436157] Pid: 1, comm: swapper Not tainted 3.5.0-bisect-00018-gfa8bbb1-dirty #129
[   22.624071] Call Trace:
[   22.720558]  [<ffffffff832448c3>] ? CallcNew+0x56/0x56
[   22.815248]  [<ffffffff8222b623>] panic+0x110/0x329
[   22.914330]  [<ffffffff83244972>] ? isdnloop_init+0xaf/0xb1
[   23.014800]  [<ffffffff832448c3>] ? CallcNew+0x56/0x56
[   23.090763]  [<ffffffff8108e24b>] __stack_chk_fail+0x2b/0x30
[   23.185748]  [<ffffffff83244972>] isdnloop_init+0xaf/0xb1

Signed-off-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/isdn/isdnloop/isdnloop.c |   12 ------------
 1 file changed, 12 deletions(-)

--- a/drivers/isdn/isdnloop/isdnloop.c
+++ b/drivers/isdn/isdnloop/isdnloop.c
@@ -16,7 +16,6 @@
 #include <linux/sched.h>
 #include "isdnloop.h"
 
-static char *revision = "$Revision: 1.11.6.7 $";
 static char *isdnloop_id = "loop0";
 
 MODULE_DESCRIPTION("ISDN4Linux: Pseudo Driver that simulates an ISDN card");
@@ -1494,17 +1493,6 @@ isdnloop_addcard(char *id1)
 static int __init
 isdnloop_init(void)
 {
-	char *p;
-	char rev[10];
-
-	if ((p = strchr(revision, ':'))) {
-		strcpy(rev, p + 1);
-		p = strchr(rev, '$');
-		*p = 0;
-	} else
-		strcpy(rev, " ??? ");
-	printk(KERN_NOTICE "isdnloop-ISDN-driver Rev%s\n", rev);
-
 	if (isdnloop_id)
 		return (isdnloop_addcard(isdnloop_id));
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 007/262] pptp: lookup route with the proper net namespace
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (5 preceding siblings ...)
  2012-09-28 18:48 ` [ 006/262] isdnloop: fix and simplify isdnloop_init() Greg Kroah-Hartman
@ 2012-09-28 18:48 ` Greg Kroah-Hartman
  2012-09-28 18:48 ` [ 008/262] net/core: Fix potential memory leak in dev_set_alias() Greg Kroah-Hartman
                   ` (254 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:48 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Gao feng, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Gao feng <gaofeng@cn.fujitsu.com>

[ Upstream commit 08252b32311c3fa84219ad794d640af7399b5485 ]

pptp always use init_net as the net namespace to lookup
route, this will cause route lookup failed in container.

because we already set the correct net namespace to struct
sock in pptp_create,so fix this by using sock_net(sk) to
replace &init_net.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ppp/pptp.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -189,7 +189,7 @@ static int pptp_xmit(struct ppp_channel
 	if (sk_pppox(po)->sk_state & PPPOX_DEAD)
 		goto tx_error;
 
-	rt = ip_route_output_ports(&init_net, &fl4, NULL,
+	rt = ip_route_output_ports(sock_net(sk), &fl4, NULL,
 				   opt->dst_addr.sin_addr.s_addr,
 				   opt->src_addr.sin_addr.s_addr,
 				   0, 0, IPPROTO_GRE,
@@ -468,7 +468,7 @@ static int pptp_connect(struct socket *s
 	po->chan.private = sk;
 	po->chan.ops = &pptp_chan_ops;
 
-	rt = ip_route_output_ports(&init_net, &fl4, sk,
+	rt = ip_route_output_ports(sock_net(sk), &fl4, sk,
 				   opt->dst_addr.sin_addr.s_addr,
 				   opt->src_addr.sin_addr.s_addr,
 				   0, 0,



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 008/262] net/core: Fix potential memory leak in dev_set_alias()
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (6 preceding siblings ...)
  2012-09-28 18:48 ` [ 007/262] pptp: lookup route with the proper net namespace Greg Kroah-Hartman
@ 2012-09-28 18:48 ` Greg Kroah-Hartman
  2012-09-28 18:48 ` [ 009/262] af_packet: remove BUG statement in tpacket_destruct_skb Greg Kroah-Hartman
                   ` (253 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:48 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Alexey Khoroshilov, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Alexey Khoroshilov <khoroshilov@ispras.ru>

[ Upstream commit 7364e445f62825758fa61195d237a5b8ecdd06ec ]

Do not leak memory by updating pointer with potentially NULL realloc return value.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/dev.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1055,6 +1055,8 @@ rollback:
  */
 int dev_set_alias(struct net_device *dev, const char *alias, size_t len)
 {
+	char *new_ifalias;
+
 	ASSERT_RTNL();
 
 	if (len >= IFALIASZ)
@@ -1068,9 +1070,10 @@ int dev_set_alias(struct net_device *dev
 		return 0;
 	}
 
-	dev->ifalias = krealloc(dev->ifalias, len + 1, GFP_KERNEL);
-	if (!dev->ifalias)
+	new_ifalias = krealloc(dev->ifalias, len + 1, GFP_KERNEL);
+	if (!new_ifalias)
 		return -ENOMEM;
+	dev->ifalias = new_ifalias;
 
 	strlcpy(dev->ifalias, alias, len+1);
 	return len;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 009/262] af_packet: remove BUG statement in tpacket_destruct_skb
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (7 preceding siblings ...)
  2012-09-28 18:48 ` [ 008/262] net/core: Fix potential memory leak in dev_set_alias() Greg Kroah-Hartman
@ 2012-09-28 18:48 ` Greg Kroah-Hartman
  2012-09-28 18:48 ` [ 010/262] ipv6: addrconf: Avoid calling netdevice notifiers with RCU read-side lock Greg Kroah-Hartman
                   ` (252 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:48 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Daniel Borkmann, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: "danborkmann@iogearbox.net" <danborkmann@iogearbox.net>

[ Upstream commit 7f5c3e3a80e6654cf48dfba7cf94f88c6b505467 ]

Here's a quote of the comment about the BUG macro from asm-generic/bug.h:

 Don't use BUG() or BUG_ON() unless there's really no way out; one
 example might be detecting data structure corruption in the middle
 of an operation that can't be backed out of.  If the (sub)system
 can somehow continue operating, perhaps with reduced functionality,
 it's probably not BUG-worthy.

 If you're tempted to BUG(), think again:  is completely giving up
 really the *only* solution?  There are usually better options, where
 users don't need to reboot ASAP and can mostly shut down cleanly.

In our case, the status flag of a ring buffer slot is managed from both sides,
the kernel space and the user space. This means that even though the kernel
side might work as expected, the user space screws up and changes this flag
right between the send(2) is triggered when the flag is changed to
TP_STATUS_SENDING and a given skb is destructed after some time. Then, this
will hit the BUG macro. As David suggested, the best solution is to simply
remove this statement since it cannot be used for kernel side internal
consistency checks. I've tested it and the system still behaves /stable/ in
this case, so in accordance with the above comment, we should rather remove it.

Signed-off-by: Daniel Borkmann <daniel.borkmann@tik.ee.ethz.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/packet/af_packet.c |    1 -
 1 file changed, 1 deletion(-)

--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1943,7 +1943,6 @@ static void tpacket_destruct_skb(struct
 
 	if (likely(po->tx_ring.pg_vec)) {
 		ph = skb_shinfo(skb)->destructor_arg;
-		BUG_ON(__packet_get_status(po, ph) != TP_STATUS_SENDING);
 		BUG_ON(atomic_read(&po->tx_ring.pending) == 0);
 		atomic_dec(&po->tx_ring.pending);
 		__packet_set_status(po, ph, TP_STATUS_AVAILABLE);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 010/262] ipv6: addrconf: Avoid calling netdevice notifiers with RCU read-side lock
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (8 preceding siblings ...)
  2012-09-28 18:48 ` [ 009/262] af_packet: remove BUG statement in tpacket_destruct_skb Greg Kroah-Hartman
@ 2012-09-28 18:48 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 011/262] atm: fix info leak in getsockopt(SO_ATMPVC) Greg Kroah-Hartman
                   ` (251 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:48 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Cong Wang, Ben Hutchings, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Ben Hutchings <bhutchings@solarflare.com>

[ Upstream commit 4acd4945cd1e1f92b20d14e349c6c6a52acbd42d ]

Cong Wang reports that lockdep detected suspicious RCU usage while
enabling IPV6 forwarding:

 [ 1123.310275] ===============================
 [ 1123.442202] [ INFO: suspicious RCU usage. ]
 [ 1123.558207] 3.6.0-rc1+ #109 Not tainted
 [ 1123.665204] -------------------------------
 [ 1123.768254] include/linux/rcupdate.h:430 Illegal context switch in RCU read-side critical section!
 [ 1123.992320]
 [ 1123.992320] other info that might help us debug this:
 [ 1123.992320]
 [ 1124.307382]
 [ 1124.307382] rcu_scheduler_active = 1, debug_locks = 0
 [ 1124.522220] 2 locks held by sysctl/5710:
 [ 1124.648364]  #0:  (rtnl_mutex){+.+.+.}, at: [<ffffffff81768498>] rtnl_trylock+0x15/0x17
 [ 1124.882211]  #1:  (rcu_read_lock){.+.+.+}, at: [<ffffffff81871df8>] rcu_lock_acquire+0x0/0x29
 [ 1125.085209]
 [ 1125.085209] stack backtrace:
 [ 1125.332213] Pid: 5710, comm: sysctl Not tainted 3.6.0-rc1+ #109
 [ 1125.441291] Call Trace:
 [ 1125.545281]  [<ffffffff8109d915>] lockdep_rcu_suspicious+0x109/0x112
 [ 1125.667212]  [<ffffffff8107c240>] rcu_preempt_sleep_check+0x45/0x47
 [ 1125.781838]  [<ffffffff8107c260>] __might_sleep+0x1e/0x19b
[...]
 [ 1127.445223]  [<ffffffff81757ac5>] call_netdevice_notifiers+0x4a/0x4f
[...]
 [ 1127.772188]  [<ffffffff8175e125>] dev_disable_lro+0x32/0x6b
 [ 1127.885174]  [<ffffffff81872d26>] dev_forward_change+0x30/0xcb
 [ 1128.013214]  [<ffffffff818738c4>] addrconf_forward_change+0x85/0xc5
[...]

addrconf_forward_change() uses RCU iteration over the netdev list,
which is unnecessary since it already holds the RTNL lock.  We also
cannot reasonably require netdevice notifier functions not to sleep.

Reported-by: Cong Wang <amwang@redhat.com>
Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/addrconf.c |    4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -493,8 +493,7 @@ static void addrconf_forward_change(stru
 	struct net_device *dev;
 	struct inet6_dev *idev;
 
-	rcu_read_lock();
-	for_each_netdev_rcu(net, dev) {
+	for_each_netdev(net, dev) {
 		idev = __in6_dev_get(dev);
 		if (idev) {
 			int changed = (!idev->cnf.forwarding) ^ (!newf);
@@ -503,7 +502,6 @@ static void addrconf_forward_change(stru
 				dev_forward_change(idev);
 		}
 	}
-	rcu_read_unlock();
 }
 
 static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int newf)



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 011/262] atm: fix info leak in getsockopt(SO_ATMPVC)
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (9 preceding siblings ...)
  2012-09-28 18:48 ` [ 010/262] ipv6: addrconf: Avoid calling netdevice notifiers with RCU read-side lock Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 012/262] atm: fix info leak via getsockname() Greg Kroah-Hartman
                   ` (250 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Mathias Krause, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Mathias Krause <minipli@googlemail.com>

[ Upstream commit e862f1a9b7df4e8196ebec45ac62295138aa3fc2 ]

The ATM code fails to initialize the two padding bytes of struct
sockaddr_atmpvc inserted for alignment. Add an explicit memset(0)
before filling the structure to avoid the info leak.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/atm/common.c |    1 +
 1 file changed, 1 insertion(+)

--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -812,6 +812,7 @@ int vcc_getsockopt(struct socket *sock,
 
 		if (!vcc->dev || !test_bit(ATM_VF_ADDR, &vcc->flags))
 			return -ENOTCONN;
+		memset(&pvc, 0, sizeof(pvc));
 		pvc.sap_family = AF_ATMPVC;
 		pvc.sap_addr.itf = vcc->dev->number;
 		pvc.sap_addr.vpi = vcc->vpi;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 012/262] atm: fix info leak via getsockname()
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (10 preceding siblings ...)
  2012-09-28 18:49 ` [ 011/262] atm: fix info leak in getsockopt(SO_ATMPVC) Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 013/262] Bluetooth: HCI - Fix info leak in getsockopt(HCI_FILTER) Greg Kroah-Hartman
                   ` (249 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Mathias Krause, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Mathias Krause <minipli@googlemail.com>

[ Upstream commit 3c0c5cfdcd4d69ffc4b9c0907cec99039f30a50a ]

The ATM code fails to initialize the two padding bytes of struct
sockaddr_atmpvc inserted for alignment. Add an explicit memset(0)
before filling the structure to avoid the info leak.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/atm/pvc.c |    1 +
 1 file changed, 1 insertion(+)

--- a/net/atm/pvc.c
+++ b/net/atm/pvc.c
@@ -95,6 +95,7 @@ static int pvc_getname(struct socket *so
 		return -ENOTCONN;
 	*sockaddr_len = sizeof(struct sockaddr_atmpvc);
 	addr = (struct sockaddr_atmpvc *)sockaddr;
+	memset(addr, 0, sizeof(*addr));
 	addr->sap_family = AF_ATMPVC;
 	addr->sap_addr.itf = vcc->dev->number;
 	addr->sap_addr.vpi = vcc->vpi;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 013/262] Bluetooth: HCI - Fix info leak in getsockopt(HCI_FILTER)
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (11 preceding siblings ...)
  2012-09-28 18:49 ` [ 012/262] atm: fix info leak via getsockname() Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 014/262] Bluetooth: HCI - Fix info leak via getsockname() Greg Kroah-Hartman
                   ` (248 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Mathias Krause, Marcel Holtmann, Gustavo Padovan,
	Johan Hedberg, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Mathias Krause <minipli@googlemail.com>

[ Upstream commit e15ca9a0ef9a86f0477530b0f44a725d67f889ee ]

The HCI code fails to initialize the two padding bytes of struct
hci_ufilter before copying it to userland -- that for leaking two
bytes kernel stack. Add an explicit memset(0) before filling the
structure to avoid the info leak.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/hci_sock.c |    1 +
 1 file changed, 1 insertion(+)

--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -1016,6 +1016,7 @@ static int hci_sock_getsockopt(struct so
 		{
 			struct hci_filter *f = &hci_pi(sk)->filter;
 
+			memset(&uf, 0, sizeof(uf));
 			uf.type_mask = f->type_mask;
 			uf.opcode    = f->opcode;
 			uf.event_mask[0] = *((u32 *) f->event_mask + 0);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 014/262] Bluetooth: HCI - Fix info leak via getsockname()
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (12 preceding siblings ...)
  2012-09-28 18:49 ` [ 013/262] Bluetooth: HCI - Fix info leak in getsockopt(HCI_FILTER) Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 015/262] Bluetooth: RFCOMM - Fix info leak in getsockopt(BT_SECURITY) Greg Kroah-Hartman
                   ` (247 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Mathias Krause, Marcel Holtmann, Gustavo Padovan,
	Johan Hedberg, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Mathias Krause <minipli@googlemail.com>

[ Upstream commit 3f68ba07b1da811bf383b4b701b129bfcb2e4988 ]

The HCI code fails to initialize the hci_channel member of struct
sockaddr_hci and that for leaks two bytes kernel stack via the
getsockname() syscall. Initialize hci_channel with 0 to avoid the
info leak.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/hci_sock.c |    1 +
 1 file changed, 1 insertion(+)

--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -706,6 +706,7 @@ static int hci_sock_getname(struct socke
 	*addr_len = sizeof(*haddr);
 	haddr->hci_family = AF_BLUETOOTH;
 	haddr->hci_dev    = hdev->id;
+	haddr->hci_channel= 0;
 
 	release_sock(sk);
 	return 0;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 015/262] Bluetooth: RFCOMM - Fix info leak in getsockopt(BT_SECURITY)
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (13 preceding siblings ...)
  2012-09-28 18:49 ` [ 014/262] Bluetooth: HCI - Fix info leak via getsockname() Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 016/262] Bluetooth: RFCOMM - Fix info leak in ioctl(RFCOMMGETDEVLIST) Greg Kroah-Hartman
                   ` (246 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Mathias Krause, Marcel Holtmann, Gustavo Padovan,
	Johan Hedberg, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Mathias Krause <minipli@googlemail.com>

[ Upstream commit 9ad2de43f1aee7e7274a4e0d41465489299e344b ]

The RFCOMM code fails to initialize the key_size member of struct
bt_security before copying it to userland -- that for leaking one
byte kernel stack. Initialize key_size with 0 to avoid the info
leak.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/rfcomm/sock.c |    1 +
 1 file changed, 1 insertion(+)

--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -841,6 +841,7 @@ static int rfcomm_sock_getsockopt(struct
 		}
 
 		sec.level = rfcomm_pi(sk)->sec_level;
+		sec.key_size = 0;
 
 		len = min_t(unsigned int, len, sizeof(sec));
 		if (copy_to_user(optval, (char *) &sec, len))



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 016/262] Bluetooth: RFCOMM - Fix info leak in ioctl(RFCOMMGETDEVLIST)
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (14 preceding siblings ...)
  2012-09-28 18:49 ` [ 015/262] Bluetooth: RFCOMM - Fix info leak in getsockopt(BT_SECURITY) Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 017/262] Bluetooth: RFCOMM - Fix info leak via getsockname() Greg Kroah-Hartman
                   ` (245 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Mathias Krause, Marcel Holtmann, Gustavo Padovan,
	Johan Hedberg, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Mathias Krause <minipli@googlemail.com>

[ Upstream commit f9432c5ec8b1e9a09b9b0e5569e3c73db8de432a ]

The RFCOMM code fails to initialize the two padding bytes of struct
rfcomm_dev_list_req inserted for alignment before copying it to
userland. Additionally there are two padding bytes in each instance of
struct rfcomm_dev_info. The ioctl() that for disclosures two bytes plus
dev_num times two bytes uninitialized kernel heap memory.

Allocate the memory using kzalloc() to fix this issue.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/rfcomm/tty.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -461,7 +461,7 @@ static int rfcomm_get_dev_list(void __us
 
 	size = sizeof(*dl) + dev_num * sizeof(*di);
 
-	dl = kmalloc(size, GFP_KERNEL);
+	dl = kzalloc(size, GFP_KERNEL);
 	if (!dl)
 		return -ENOMEM;
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 017/262] Bluetooth: RFCOMM - Fix info leak via getsockname()
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (15 preceding siblings ...)
  2012-09-28 18:49 ` [ 016/262] Bluetooth: RFCOMM - Fix info leak in ioctl(RFCOMMGETDEVLIST) Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 018/262] Bluetooth: L2CAP " Greg Kroah-Hartman
                   ` (244 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Mathias Krause, Marcel Holtmann, Gustavo Padovan,
	Johan Hedberg, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Mathias Krause <minipli@googlemail.com>

[ Upstream commit 9344a972961d1a6d2c04d9008b13617bcb6ec2ef ]

The RFCOMM code fails to initialize the trailing padding byte of struct
sockaddr_rc added for alignment. It that for leaks one byte kernel stack
via the getsockname() syscall. Add an explicit memset(0) before filling
the structure to avoid the info leak.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/rfcomm/sock.c |    1 +
 1 file changed, 1 insertion(+)

--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -547,6 +547,7 @@ static int rfcomm_sock_getname(struct so
 
 	BT_DBG("sock %p, sk %p", sock, sk);
 
+	memset(sa, 0, sizeof(*sa));
 	sa->rc_family  = AF_BLUETOOTH;
 	sa->rc_channel = rfcomm_pi(sk)->channel;
 	if (peer)



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 018/262] Bluetooth: L2CAP - Fix info leak via getsockname()
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (16 preceding siblings ...)
  2012-09-28 18:49 ` [ 017/262] Bluetooth: RFCOMM - Fix info leak via getsockname() Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 019/262] l2tp: fix " Greg Kroah-Hartman
                   ` (243 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Mathias Krause, Marcel Holtmann, Gustavo Padovan,
	Johan Hedberg, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Mathias Krause <minipli@googlemail.com>

[ Upstream commit 792039c73cf176c8e39a6e8beef2c94ff46522ed ]

The L2CAP code fails to initialize the l2_bdaddr_type member of struct
sockaddr_l2 and the padding byte added for alignment. It that for leaks
two bytes kernel stack via the getsockname() syscall. Add an explicit
memset(0) before filling the structure to avoid the info leak.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bluetooth/l2cap_sock.c |    1 +
 1 file changed, 1 insertion(+)

--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -246,6 +246,7 @@ static int l2cap_sock_getname(struct soc
 
 	BT_DBG("sock %p, sk %p", sock, sk);
 
+	memset(la, 0, sizeof(struct sockaddr_l2));
 	addr->sa_family = AF_BLUETOOTH;
 	*len = sizeof(struct sockaddr_l2);
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 019/262] l2tp: fix info leak via getsockname()
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (17 preceding siblings ...)
  2012-09-28 18:49 ` [ 018/262] Bluetooth: L2CAP " Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 020/262] llc: " Greg Kroah-Hartman
                   ` (242 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Mathias Krause, James Chapman, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Mathias Krause <minipli@googlemail.com>

[ Upstream commit 04d4fbca1017c11381e7d82acea21dd741e748bc ]

The L2TP code for IPv6 fails to initialize the l2tp_unused member of
struct sockaddr_l2tpip6 and that for leaks two bytes kernel stack via
the getsockname() syscall. Initialize l2tp_unused with 0 to avoid the
info leak.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: James Chapman <jchapman@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/l2tp/l2tp_ip6.c |    1 +
 1 file changed, 1 insertion(+)

--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -410,6 +410,7 @@ static int l2tp_ip6_getname(struct socke
 	lsa->l2tp_family = AF_INET6;
 	lsa->l2tp_flowinfo = 0;
 	lsa->l2tp_scope_id = 0;
+	lsa->l2tp_unused = 0;
 	if (peer) {
 		if (!lsk->peer_conn_id)
 			return -ENOTCONN;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 020/262] llc: fix info leak via getsockname()
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (18 preceding siblings ...)
  2012-09-28 18:49 ` [ 019/262] l2tp: fix " Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 021/262] dccp: fix info leak via getsockopt(DCCP_SOCKOPT_CCID_TX_INFO) Greg Kroah-Hartman
                   ` (241 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Mathias Krause, Arnaldo Carvalho de Melo, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Mathias Krause <minipli@googlemail.com>

[ Upstream commit 3592aaeb80290bda0f2cf0b5456c97bfc638b192 ]

The LLC code wrongly returns 0, i.e. "success", when the socket is
zapped. Together with the uninitialized uaddrlen pointer argument from
sys_getsockname this leads to an arbitrary memory leak of up to 128
bytes kernel stack via the getsockname() syscall.

Return an error instead when the socket is zapped to prevent the info
leak. Also remove the unnecessary memset(0). We don't directly write to
the memory pointed by uaddr but memcpy() a local structure at the end of
the function that is properly initialized.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/llc/af_llc.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -969,14 +969,13 @@ static int llc_ui_getname(struct socket
 	struct sockaddr_llc sllc;
 	struct sock *sk = sock->sk;
 	struct llc_sock *llc = llc_sk(sk);
-	int rc = 0;
+	int rc = -EBADF;
 
 	memset(&sllc, 0, sizeof(sllc));
 	lock_sock(sk);
 	if (sock_flag(sk, SOCK_ZAPPED))
 		goto out;
 	*uaddrlen = sizeof(sllc);
-	memset(uaddr, 0, *uaddrlen);
 	if (peer) {
 		rc = -ENOTCONN;
 		if (sk->sk_state != TCP_ESTABLISHED)



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 021/262] dccp: fix info leak via getsockopt(DCCP_SOCKOPT_CCID_TX_INFO)
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (19 preceding siblings ...)
  2012-09-28 18:49 ` [ 020/262] llc: " Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 022/262] ipvs: fix info leak in getsockopt(IP_VS_SO_GET_TIMEOUT) Greg Kroah-Hartman
                   ` (240 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Mathias Krause, Gerrit Renker, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Mathias Krause <minipli@googlemail.com>

[ Upstream commit 7b07f8eb75aa3097cdfd4f6eac3da49db787381d ]

The CCID3 code fails to initialize the trailing padding bytes of struct
tfrc_tx_info added for alignment on 64 bit architectures. It that for
potentially leaks four bytes kernel stack via the getsockopt() syscall.
Add an explicit memset(0) before filling the structure to avoid the
info leak.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/dccp/ccids/ccid3.c |    1 +
 1 file changed, 1 insertion(+)

--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -531,6 +531,7 @@ static int ccid3_hc_tx_getsockopt(struct
 	case DCCP_SOCKOPT_CCID_TX_INFO:
 		if (len < sizeof(tfrc))
 			return -EINVAL;
+		memset(&tfrc, 0, sizeof(tfrc));
 		tfrc.tfrctx_x	   = hc->tx_x;
 		tfrc.tfrctx_x_recv = hc->tx_x_recv;
 		tfrc.tfrctx_x_calc = hc->tx_x_calc;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 022/262] ipvs: fix info leak in getsockopt(IP_VS_SO_GET_TIMEOUT)
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (20 preceding siblings ...)
  2012-09-28 18:49 ` [ 021/262] dccp: fix info leak via getsockopt(DCCP_SOCKOPT_CCID_TX_INFO) Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 023/262] net: fix info leak in compat dev_ifconf() Greg Kroah-Hartman
                   ` (239 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Mathias Krause, Wensong Zhang, Simon Horman,
	Julian Anastasov, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Mathias Krause <minipli@googlemail.com>

[ Upstream commit 2d8a041b7bfe1097af21441cb77d6af95f4f4680 ]

If at least one of CONFIG_IP_VS_PROTO_TCP or CONFIG_IP_VS_PROTO_UDP is
not set, __ip_vs_get_timeouts() does not fully initialize the structure
that gets copied to userland and that for leaks up to 12 bytes of kernel
stack. Add an explicit memset(0) before passing the structure to
__ip_vs_get_timeouts() to avoid the info leak.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Wensong Zhang <wensong@linux-vs.org>
Cc: Simon Horman <horms@verge.net.au>
Cc: Julian Anastasov <ja@ssi.bg>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netfilter/ipvs/ip_vs_ctl.c |    1 +
 1 file changed, 1 insertion(+)

--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2759,6 +2759,7 @@ do_ip_vs_get_ctl(struct sock *sk, int cm
 	{
 		struct ip_vs_timeout_user t;
 
+		memset(&t, 0, sizeof(t));
 		__ip_vs_get_timeouts(net, &t);
 		if (copy_to_user(user, &t, sizeof(t)) != 0)
 			ret = -EFAULT;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 023/262] net: fix info leak in compat dev_ifconf()
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (21 preceding siblings ...)
  2012-09-28 18:49 ` [ 022/262] ipvs: fix info leak in getsockopt(IP_VS_SO_GET_TIMEOUT) Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 024/262] af_packet: dont emit packet on orig fanout group Greg Kroah-Hartman
                   ` (238 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Mathias Krause, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Mathias Krause <minipli@googlemail.com>

[ Upstream commit 43da5f2e0d0c69ded3d51907d9552310a6b545e8 ]

The implementation of dev_ifconf() for the compat ioctl interface uses
an intermediate ifc structure allocated in userland for the duration of
the syscall. Though, it fails to initialize the padding bytes inserted
for alignment and that for leaks four bytes of kernel stack. Add an
explicit memset(0) before filling the structure to avoid the info leak.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/socket.c |    1 +
 1 file changed, 1 insertion(+)

--- a/net/socket.c
+++ b/net/socket.c
@@ -2658,6 +2658,7 @@ static int dev_ifconf(struct net *net, s
 	if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
 		return -EFAULT;
 
+	memset(&ifc, 0, sizeof(ifc));
 	if (ifc32.ifcbuf == 0) {
 		ifc32.ifc_len = 0;
 		ifc.ifc_len = 0;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 024/262] af_packet: dont emit packet on orig fanout group
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (22 preceding siblings ...)
  2012-09-28 18:49 ` [ 023/262] net: fix info leak in compat dev_ifconf() Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 025/262] af_netlink: force credentials passing [CVE-2012-3520] Greg Kroah-Hartman
                   ` (237 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Aleksandr Kotov, Eric Leblond, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Eric Leblond <eric@regit.org>

[ Upstream commit c0de08d04215031d68fa13af36f347a6cfa252ca ]

If a packet is emitted on one socket in one group of fanout sockets,
it is transmitted again. It is thus read again on one of the sockets
of the fanout group. This result in a loop for software which
generate packets when receiving one.
This retransmission is not the intended behavior: a fanout group
must behave like a single socket. The packet should not be
transmitted on a socket if it originates from a socket belonging
to the same fanout group.

This patch fixes the issue by changing the transmission check to
take fanout group info account.

Reported-by: Aleksandr Kotov <a1k@mail.ru>
Signed-off-by: Eric Leblond <eric@regit.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/netdevice.h |    2 ++
 net/core/dev.c            |   16 ++++++++++++++--
 net/packet/af_packet.c    |    9 +++++++++
 3 files changed, 25 insertions(+), 2 deletions(-)

--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1520,6 +1520,8 @@ struct packet_type {
 	struct sk_buff		**(*gro_receive)(struct sk_buff **head,
 					       struct sk_buff *skb);
 	int			(*gro_complete)(struct sk_buff *skb);
+	bool			(*id_match)(struct packet_type *ptype,
+					    struct sock *sk);
 	void			*af_packet_priv;
 	struct list_head	list;
 };
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1640,6 +1640,19 @@ static inline int deliver_skb(struct sk_
 	return pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
 }
 
+static inline bool skb_loop_sk(struct packet_type *ptype, struct sk_buff *skb)
+{
+	if (ptype->af_packet_priv == NULL)
+		return false;
+
+	if (ptype->id_match)
+		return ptype->id_match(ptype, skb->sk);
+	else if ((struct sock *)ptype->af_packet_priv == skb->sk)
+		return true;
+
+	return false;
+}
+
 /*
  *	Support routine. Sends outgoing frames to any network
  *	taps currently in use.
@@ -1657,8 +1670,7 @@ static void dev_queue_xmit_nit(struct sk
 		 * they originated from - MvS (miquels@drinkel.ow.org)
 		 */
 		if ((ptype->dev == dev || !ptype->dev) &&
-		    (ptype->af_packet_priv == NULL ||
-		     (struct sock *)ptype->af_packet_priv != skb->sk)) {
+		    (!skb_loop_sk(ptype, skb))) {
 			if (pt_prev) {
 				deliver_skb(skb2, pt_prev, skb->dev);
 				pt_prev = ptype;
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1280,6 +1280,14 @@ static void __fanout_unlink(struct sock
 	spin_unlock(&f->lock);
 }
 
+bool match_fanout_group(struct packet_type *ptype, struct sock * sk)
+{
+	if (ptype->af_packet_priv == (void*)((struct packet_sock *)sk)->fanout)
+		return true;
+
+	return false;
+}
+
 static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
 {
 	struct packet_sock *po = pkt_sk(sk);
@@ -1332,6 +1340,7 @@ static int fanout_add(struct sock *sk, u
 		match->prot_hook.dev = po->prot_hook.dev;
 		match->prot_hook.func = packet_rcv_fanout;
 		match->prot_hook.af_packet_priv = match;
+		match->prot_hook.id_match = match_fanout_group;
 		dev_add_pack(&match->prot_hook);
 		list_add(&match->list, &fanout_list);
 	}



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 025/262] af_netlink: force credentials passing [CVE-2012-3520]
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (23 preceding siblings ...)
  2012-09-28 18:49 ` [ 024/262] af_packet: dont emit packet on orig fanout group Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 026/262] netlink: fix possible spoofing from non-root processes Greg Kroah-Hartman
                   ` (236 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Eric Dumazet, Petr Matousek, Florian Weimer,
	Pablo Neira Ayuso, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Eric Dumazet <edumazet@google.com>

[ Upstream commit e0e3cea46d31d23dc40df0a49a7a2c04fe8edfea ]

Pablo Neira Ayuso discovered that avahi and
potentially NetworkManager accept spoofed Netlink messages because of a
kernel bug.  The kernel passes all-zero SCM_CREDENTIALS ancillary data
to the receiver if the sender did not provide such data, instead of not
including any such data at all or including the correct data from the
peer (as it is the case with AF_UNIX).

This bug was introduced in commit 16e572626961
(af_unix: dont send SCM_CREDENTIALS by default)

This patch forces passing credentials for netlink, as
before the regression.

Another fix would be to not add SCM_CREDENTIALS in
netlink messages if not provided by the sender, but it
might break some programs.

With help from Florian Weimer & Petr Matousek

This issue is designated as CVE-2012-3520

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Petr Matousek <pmatouse@redhat.com>
Cc: Florian Weimer <fweimer@redhat.com>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/scm.h        |    4 +++-
 net/netlink/af_netlink.c |    2 +-
 net/unix/af_unix.c       |    4 ++--
 3 files changed, 6 insertions(+), 4 deletions(-)

--- a/include/net/scm.h
+++ b/include/net/scm.h
@@ -71,9 +71,11 @@ static __inline__ void scm_destroy(struc
 }
 
 static __inline__ int scm_send(struct socket *sock, struct msghdr *msg,
-			       struct scm_cookie *scm)
+			       struct scm_cookie *scm, bool forcecreds)
 {
 	memset(scm, 0, sizeof(*scm));
+	if (forcecreds)
+		scm_set_cred(scm, task_tgid(current), current_cred());
 	unix_get_peersec_dgram(sock, scm);
 	if (msg->msg_controllen <= 0)
 		return 0;
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1344,7 +1344,7 @@ static int netlink_sendmsg(struct kiocb
 	if (NULL == siocb->scm)
 		siocb->scm = &scm;
 
-	err = scm_send(sock, msg, siocb->scm);
+	err = scm_send(sock, msg, siocb->scm, true);
 	if (err < 0)
 		return err;
 
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1448,7 +1448,7 @@ static int unix_dgram_sendmsg(struct kio
 	if (NULL == siocb->scm)
 		siocb->scm = &tmp_scm;
 	wait_for_unix_gc();
-	err = scm_send(sock, msg, siocb->scm);
+	err = scm_send(sock, msg, siocb->scm, false);
 	if (err < 0)
 		return err;
 
@@ -1617,7 +1617,7 @@ static int unix_stream_sendmsg(struct ki
 	if (NULL == siocb->scm)
 		siocb->scm = &tmp_scm;
 	wait_for_unix_gc();
-	err = scm_send(sock, msg, siocb->scm);
+	err = scm_send(sock, msg, siocb->scm, false);
 	if (err < 0)
 		return err;
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 026/262] netlink: fix possible spoofing from non-root processes
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (24 preceding siblings ...)
  2012-09-28 18:49 ` [ 025/262] af_netlink: force credentials passing [CVE-2012-3520] Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 027/262] tcp: fix cwnd reduction for non-sack recovery Greg Kroah-Hartman
                   ` (235 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Pablo Neira Ayuso, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Pablo Neira Ayuso <pablo@netfilter.org>

[ Upstream commit 20e1db19db5d6b9e4e83021595eab0dc8f107bef ]

Non-root user-space processes can send Netlink messages to other
processes that are well-known for being subscribed to Netlink
asynchronous notifications. This allows ilegitimate non-root
process to send forged messages to Netlink subscribers.

The userspace process usually verifies the legitimate origin in
two ways:

a) Socket credentials. If UID != 0, then the message comes from
   some ilegitimate process and the message needs to be dropped.

b) Netlink portID. In general, portID == 0 means that the origin
   of the messages comes from the kernel. Thus, discarding any
   message not coming from the kernel.

However, ctnetlink sets the portID in event messages that has
been triggered by some user-space process, eg. conntrack utility.
So other processes subscribed to ctnetlink events, eg. conntrackd,
know that the event was triggered by some user-space action.

Neither of the two ways to discard ilegitimate messages coming
from non-root processes can help for ctnetlink.

This patch adds capability validation in case that dst_pid is set
in netlink_sendmsg(). This approach is aggressive since existing
applications using any Netlink bus to deliver messages between
two user-space processes will break. Note that the exception is
NETLINK_USERSOCK, since it is reserved for netlink-to-netlink
userspace communication.

Still, if anyone wants that his Netlink bus allows netlink-to-netlink
userspace, then they can set NL_NONROOT_SEND. However, by default,
I don't think it makes sense to allow to use NETLINK_ROUTE to
communicate two processes that are sending no matter what information
that is not related to link/neighbouring/routing. They should be using
NETLINK_USERSOCK instead for that.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netlink/af_netlink.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1355,7 +1355,8 @@ static int netlink_sendmsg(struct kiocb
 		dst_pid = addr->nl_pid;
 		dst_group = ffs(addr->nl_groups);
 		err =  -EPERM;
-		if (dst_group && !netlink_capable(sock, NL_NONROOT_SEND))
+		if ((dst_group || dst_pid) &&
+		    !netlink_capable(sock, NL_NONROOT_SEND))
 			goto out;
 	} else {
 		dst_pid = nlk->dst_pid;
@@ -2124,6 +2125,7 @@ static void __init netlink_add_usersock_
 	rcu_assign_pointer(nl_table[NETLINK_USERSOCK].listeners, listeners);
 	nl_table[NETLINK_USERSOCK].module = THIS_MODULE;
 	nl_table[NETLINK_USERSOCK].registered = 1;
+	nl_table[NETLINK_USERSOCK].nl_nonroot = NL_NONROOT_SEND;
 
 	netlink_table_ungrab();
 }



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 027/262] tcp: fix cwnd reduction for non-sack recovery
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (25 preceding siblings ...)
  2012-09-28 18:49 ` [ 026/262] netlink: fix possible spoofing from non-root processes Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 028/262] sfc: Fix reporting of IPv4 full filters through ethtool Greg Kroah-Hartman
                   ` (234 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Yuchung Cheng, Nandita Dukkipati, Neal Cardwell,
	David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Yuchung Cheng <ycheng@google.com>

[ Upstream commit 7c4a56fec379ac0d7754e0d4da6a7361f1a4fe64 ]

The cwnd reduction in fast recovery is based on the number of packets
newly delivered per ACK. For non-sack connections every DUPACK
signifies a packet has been delivered, but the sender mistakenly
skips counting them for cwnd reduction.

The fix is to compute newly_acked_sacked after DUPACKs are accounted
in sacked_out for non-sack connections.

Signed-off-by: Yuchung Cheng <ycheng@google.com>
Acked-by: Nandita Dukkipati <nanditad@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/tcp_input.c |   15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3107,13 +3107,14 @@ static void tcp_enter_recovery(struct so
  * tcp_xmit_retransmit_queue().
  */
 static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
-				  int newly_acked_sacked, bool is_dupack,
+				  int prior_sacked, bool is_dupack,
 				  int flag)
 {
 	struct inet_connection_sock *icsk = inet_csk(sk);
 	struct tcp_sock *tp = tcp_sk(sk);
 	int do_lost = is_dupack || ((flag & FLAG_DATA_SACKED) &&
 				    (tcp_fackets_out(tp) > tp->reordering));
+	int newly_acked_sacked = 0;
 	int fast_rexmit = 0;
 
 	if (WARN_ON(!tp->packets_out && tp->sacked_out))
@@ -3173,6 +3174,7 @@ static void tcp_fastretrans_alert(struct
 				tcp_add_reno_sack(sk);
 		} else
 			do_lost = tcp_try_undo_partial(sk, pkts_acked);
+		newly_acked_sacked = pkts_acked + tp->sacked_out - prior_sacked;
 		break;
 	case TCP_CA_Loss:
 		if (flag & FLAG_DATA_ACKED)
@@ -3194,6 +3196,7 @@ static void tcp_fastretrans_alert(struct
 			if (is_dupack)
 				tcp_add_reno_sack(sk);
 		}
+		newly_acked_sacked = pkts_acked + tp->sacked_out - prior_sacked;
 
 		if (icsk->icsk_ca_state <= TCP_CA_Disorder)
 			tcp_try_undo_dsack(sk);
@@ -3771,7 +3774,6 @@ static int tcp_ack(struct sock *sk, cons
 	int prior_packets;
 	int prior_sacked = tp->sacked_out;
 	int pkts_acked = 0;
-	int newly_acked_sacked = 0;
 	bool frto_cwnd = false;
 
 	/* If the ack is older than previous acks
@@ -3847,8 +3849,6 @@ static int tcp_ack(struct sock *sk, cons
 	flag |= tcp_clean_rtx_queue(sk, prior_fackets, prior_snd_una);
 
 	pkts_acked = prior_packets - tp->packets_out;
-	newly_acked_sacked = (prior_packets - prior_sacked) -
-			     (tp->packets_out - tp->sacked_out);
 
 	if (tp->frto_counter)
 		frto_cwnd = tcp_process_frto(sk, flag);
@@ -3862,7 +3862,7 @@ static int tcp_ack(struct sock *sk, cons
 		    tcp_may_raise_cwnd(sk, flag))
 			tcp_cong_avoid(sk, ack, prior_in_flight);
 		is_dupack = !(flag & (FLAG_SND_UNA_ADVANCED | FLAG_NOT_DUP));
-		tcp_fastretrans_alert(sk, pkts_acked, newly_acked_sacked,
+		tcp_fastretrans_alert(sk, pkts_acked, prior_sacked,
 				      is_dupack, flag);
 	} else {
 		if ((flag & FLAG_DATA_ACKED) && !frto_cwnd)
@@ -3877,7 +3877,7 @@ static int tcp_ack(struct sock *sk, cons
 no_queue:
 	/* If data was DSACKed, see if we can undo a cwnd reduction. */
 	if (flag & FLAG_DSACKING_ACK)
-		tcp_fastretrans_alert(sk, pkts_acked, newly_acked_sacked,
+		tcp_fastretrans_alert(sk, pkts_acked, prior_sacked,
 				      is_dupack, flag);
 	/* If this ack opens up a zero window, clear backoff.  It was
 	 * being used to time the probes, and is probably far higher than
@@ -3897,8 +3897,7 @@ old_ack:
 	 */
 	if (TCP_SKB_CB(skb)->sacked) {
 		flag |= tcp_sacktag_write_queue(sk, skb, prior_snd_una);
-		newly_acked_sacked = tp->sacked_out - prior_sacked;
-		tcp_fastretrans_alert(sk, pkts_acked, newly_acked_sacked,
+		tcp_fastretrans_alert(sk, pkts_acked, prior_sacked,
 				      is_dupack, flag);
 	}
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 028/262] sfc: Fix reporting of IPv4 full filters through ethtool
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (26 preceding siblings ...)
  2012-09-28 18:49 ` [ 027/262] tcp: fix cwnd reduction for non-sack recovery Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 029/262] gianfar: fix default tx vlan offload feature flag Greg Kroah-Hartman
                   ` (233 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Ben Hutchings

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Ben Hutchings <bhutchings@solarflare.com>

[ Upstream commit ac70b2e9a13423b5efa0178e081936ce6979aea5 ]

ETHTOOL_GRXCLSRULE returns filters for a TCP/IPv4 or UDP/IPv4 4-tuple
with source and destination swapped.

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/sfc/ethtool.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/ethernet/sfc/ethtool.c
+++ b/drivers/net/ethernet/sfc/ethtool.c
@@ -863,8 +863,8 @@ static int efx_ethtool_get_class_rule(st
 				       &ip_entry->ip4dst, &ip_entry->pdst);
 	if (rc != 0) {
 		rc = efx_filter_get_ipv4_full(
-			&spec, &proto, &ip_entry->ip4src, &ip_entry->psrc,
-			&ip_entry->ip4dst, &ip_entry->pdst);
+			&spec, &proto, &ip_entry->ip4dst, &ip_entry->pdst,
+			&ip_entry->ip4src, &ip_entry->psrc);
 		EFX_WARN_ON_PARANOID(rc);
 		ip_mask->ip4src = ~0;
 		ip_mask->psrc = ~0;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 029/262] gianfar: fix default tx vlan offload feature flag
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (27 preceding siblings ...)
  2012-09-28 18:49 ` [ 028/262] sfc: Fix reporting of IPv4 full filters through ethtool Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 030/262] l2tp: avoid to use synchronize_rcu in tunnel free function Greg Kroah-Hartman
                   ` (232 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Sebastian Poehn, Claudiu Manoil, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Claudiu Manoil <claudiu.manoil@freescale.com>

[ Upstream commit e2c53be223aca36cf93eb6a0f6bafa079e78f52b ]

Commit -
"b852b72 gianfar: fix bug caused by
87c288c6e9aa31720b72e2bc2d665e24e1653c3e"
disables by default (on mac init) the hw vlan tag insertion.
The "features" flags were not updated to reflect this, and
"ethtool -K" shows tx-vlan-offload to be "on" by default.

Cc: Sebastian Poehn <sebastian.poehn@belden.com>
Signed-off-by: Claudiu Manoil <claudiu.manoil@freescale.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/freescale/gianfar.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -1037,7 +1037,7 @@ static int gfar_probe(struct platform_de
 
 	if (priv->device_flags & FSL_GIANFAR_DEV_HAS_VLAN) {
 		dev->hw_features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
-		dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
+		dev->features |= NETIF_F_HW_VLAN_RX;
 	}
 
 	if (priv->device_flags & FSL_GIANFAR_DEV_HAS_EXTENDED_HASH) {



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 030/262] l2tp: avoid to use synchronize_rcu in tunnel free function
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (28 preceding siblings ...)
  2012-09-28 18:49 ` [ 029/262] gianfar: fix default tx vlan offload feature flag Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 031/262] net: ipv4: ipmr_expire_timer causes crash when removing net namespace Greg Kroah-Hartman
                   ` (231 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Dmitry Kozlov, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: "xeb@mail.ru" <xeb@mail.ru>

[ Upstream commit 99469c32f79a32d8481f87be0d3c66dad286f4ec ]

Avoid to use synchronize_rcu in l2tp_tunnel_free because context may be
atomic.

Signed-off-by: Dmitry Kozlov <xeb@mail.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/l2tp/l2tp_core.c |    3 +--
 net/l2tp/l2tp_core.h |    1 +
 2 files changed, 2 insertions(+), 2 deletions(-)

--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1346,11 +1346,10 @@ static void l2tp_tunnel_free(struct l2tp
 	/* Remove from tunnel list */
 	spin_lock_bh(&pn->l2tp_tunnel_list_lock);
 	list_del_rcu(&tunnel->list);
+	kfree_rcu(tunnel, rcu);
 	spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
-	synchronize_rcu();
 
 	atomic_dec(&l2tp_tunnel_count);
-	kfree(tunnel);
 }
 
 /* Create a socket for the tunnel, if one isn't set up by
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -163,6 +163,7 @@ struct l2tp_tunnel_cfg {
 
 struct l2tp_tunnel {
 	int			magic;		/* Should be L2TP_TUNNEL_MAGIC */
+	struct rcu_head rcu;
 	rwlock_t		hlist_lock;	/* protect session_hlist */
 	struct hlist_head	session_hlist[L2TP_HASH_SIZE];
 						/* hashed list of sessions,



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 031/262] net: ipv4: ipmr_expire_timer causes crash when removing net namespace
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (29 preceding siblings ...)
  2012-09-28 18:49 ` [ 030/262] l2tp: avoid to use synchronize_rcu in tunnel free function Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 032/262] bnx2x: fix 57840_MF pci id Greg Kroah-Hartman
                   ` (230 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Francesco Ruggeri, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Francesco Ruggeri <fruggeri@aristanetworks.com>

[ Upstream commit acbb219d5f53821b2d0080d047800410c0420ea1 ]

When tearing down a net namespace, ipv4 mr_table structures are freed
without first deactivating their timers. This can result in a crash in
run_timer_softirq.
This patch mimics the corresponding behaviour in ipv6.
Locking and synchronization seem to be adequate.
We are about to kfree mrt, so existing code should already make sure that
no other references to mrt are pending or can be created by incoming traffic.
The functions invoked here do not cause new references to mrt or other
race conditions to be created.
Invoking del_timer_sync guarantees that ipmr_expire_timer is inactive.
Both ipmr_expire_process (whose completion we may have to wait in
del_timer_sync) and mroute_clean_tables internally use mfc_unres_lock
or other synchronizations when needed, and they both only modify mrt.

Tested in Linux 3.4.8.

Signed-off-by: Francesco Ruggeri <fruggeri@aristanetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/ipmr.c |   14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -124,6 +124,8 @@ static DEFINE_SPINLOCK(mfc_unres_lock);
 static struct kmem_cache *mrt_cachep __read_mostly;
 
 static struct mr_table *ipmr_new_table(struct net *net, u32 id);
+static void ipmr_free_table(struct mr_table *mrt);
+
 static int ip_mr_forward(struct net *net, struct mr_table *mrt,
 			 struct sk_buff *skb, struct mfc_cache *cache,
 			 int local);
@@ -131,6 +133,7 @@ static int ipmr_cache_report(struct mr_t
 			     struct sk_buff *pkt, vifi_t vifi, int assert);
 static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
 			      struct mfc_cache *c, struct rtmsg *rtm);
+static void mroute_clean_tables(struct mr_table *mrt);
 static void ipmr_expire_process(unsigned long arg);
 
 #ifdef CONFIG_IP_MROUTE_MULTIPLE_TABLES
@@ -271,7 +274,7 @@ static void __net_exit ipmr_rules_exit(s
 
 	list_for_each_entry_safe(mrt, next, &net->ipv4.mr_tables, list) {
 		list_del(&mrt->list);
-		kfree(mrt);
+		ipmr_free_table(mrt);
 	}
 	fib_rules_unregister(net->ipv4.mr_rules_ops);
 }
@@ -299,7 +302,7 @@ static int __net_init ipmr_rules_init(st
 
 static void __net_exit ipmr_rules_exit(struct net *net)
 {
-	kfree(net->ipv4.mrt);
+	ipmr_free_table(net->ipv4.mrt);
 }
 #endif
 
@@ -336,6 +339,13 @@ static struct mr_table *ipmr_new_table(s
 	return mrt;
 }
 
+static void ipmr_free_table(struct mr_table *mrt)
+{
+	del_timer_sync(&mrt->ipmr_expire_timer);
+	mroute_clean_tables(mrt);
+	kfree(mrt);
+}
+
 /* Service routines creating virtual interfaces: DVMRP tunnels and PIMREG */
 
 static void ipmr_del_tunnel(struct net_device *dev, struct vifctl *v)



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 032/262] bnx2x: fix 57840_MF pci id
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (30 preceding siblings ...)
  2012-09-28 18:49 ` [ 031/262] net: ipv4: ipmr_expire_timer causes crash when removing net namespace Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 033/262] cs89x0 : packet reception not working Greg Kroah-Hartman
                   ` (229 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Yuval Mintz, Eilon Greenstein, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Yuval Mintz <yuvalmin@broadcom.com>

[ Upstream commit 5c879d2094946081af934739850c7260e8b25d3c ]

Commit c3def943c7117d42caaed3478731ea7c3c87190e have added support for
new pci ids of the 57840 board, while failing to change the obsolete value
in 'pci_ids.h'.
This patch does so, allowing the probe of such devices.

Signed-off-by: Yuval Mintz <yuvalmin@broadcom.com>
Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/pci_ids.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -2148,7 +2148,7 @@
 #define PCI_DEVICE_ID_TIGON3_5704S	0x16a8
 #define PCI_DEVICE_ID_NX2_57800_VF	0x16a9
 #define PCI_DEVICE_ID_NX2_5706S		0x16aa
-#define PCI_DEVICE_ID_NX2_57840_MF	0x16ab
+#define PCI_DEVICE_ID_NX2_57840_MF	0x16a4
 #define PCI_DEVICE_ID_NX2_5708S		0x16ac
 #define PCI_DEVICE_ID_NX2_57840_VF	0x16ad
 #define PCI_DEVICE_ID_NX2_57810_MF	0x16ae



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 033/262] cs89x0 : packet reception not working
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (31 preceding siblings ...)
  2012-09-28 18:49 ` [ 032/262] bnx2x: fix 57840_MF pci id Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 034/262] openvswitch: Reset upper layer protocol info on internal devices Greg Kroah-Hartman
                   ` (228 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Jaccon Bastiaansen, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Jaccon Bastiaansen <jaccon.bastiaansen@gmail.com>

[ Upstream commit b72c200975a4ed579dbf3353019e19528745a29a ]

The RxCFG register of the CS89x0 could be configured incorrectly
(because of misplaced parentheses), resulting in the disabling
of packet reception.

Signed-off-by: Jaccon Bastiaansen <jaccon.bastiaansen@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/cirrus/cs89x0.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

--- a/drivers/net/ethernet/cirrus/cs89x0.c
+++ b/drivers/net/ethernet/cirrus/cs89x0.c
@@ -1243,6 +1243,7 @@ static void set_multicast_list(struct ne
 {
 	struct net_local *lp = netdev_priv(dev);
 	unsigned long flags;
+	u16 cfg;
 
 	spin_lock_irqsave(&lp->lock, flags);
 	if (dev->flags & IFF_PROMISC)
@@ -1260,11 +1261,10 @@ static void set_multicast_list(struct ne
 	/* in promiscuous mode, we accept errored packets,
 	 * so we have to enable interrupts on them also
 	 */
-	writereg(dev, PP_RxCFG,
-		 (lp->curr_rx_cfg |
-		  (lp->rx_mode == RX_ALL_ACCEPT)
-		  ? (RX_CRC_ERROR_ENBL | RX_RUNT_ENBL | RX_EXTRA_DATA_ENBL)
-		  : 0));
+	cfg = lp->curr_rx_cfg;
+	if (lp->rx_mode == RX_ALL_ACCEPT)
+		cfg |= RX_CRC_ERROR_ENBL | RX_RUNT_ENBL | RX_EXTRA_DATA_ENBL;
+	writereg(dev, PP_RxCFG, cfg);
 	spin_unlock_irqrestore(&lp->lock, flags);
 }
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 034/262] openvswitch: Reset upper layer protocol info on internal devices.
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (32 preceding siblings ...)
  2012-09-28 18:49 ` [ 033/262] cs89x0 : packet reception not working Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 035/262] workqueue: reimplement work_on_cpu() using system_wq Greg Kroah-Hartman
                   ` (227 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Jesse Gross

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Jesse Gross <jesse@nicira.com>

[ Upstream commit 7fe99e2d434eafeac0c57b279a77e5de39212636 ]

It's possible that packets that are sent on internal devices (from
the OVS perspective) have already traversed the local IP stack.
After they go through the internal device, they will again travel
through the IP stack which may get confused by the presence of
existing information in the skb. The problem can be observed
when switching between namespaces. This clears out that information
to avoid problems but deliberately leaves other metadata alone.
This is to provide maximum flexibility in chaining together OVS
and other Linux components.

Signed-off-by: Jesse Gross <jesse@nicira.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/openvswitch/vport-internal_dev.c |    8 ++++++++
 1 file changed, 8 insertions(+)

--- a/net/openvswitch/vport-internal_dev.c
+++ b/net/openvswitch/vport-internal_dev.c
@@ -24,6 +24,9 @@
 #include <linux/ethtool.h>
 #include <linux/skbuff.h>
 
+#include <net/dst.h>
+#include <net/xfrm.h>
+
 #include "datapath.h"
 #include "vport-internal_dev.h"
 #include "vport-netdev.h"
@@ -209,6 +212,11 @@ static int internal_dev_recv(struct vpor
 	int len;
 
 	len = skb->len;
+
+	skb_dst_drop(skb);
+	nf_reset(skb);
+	secpath_reset(skb);
+
 	skb->dev = netdev;
 	skb->pkt_type = PACKET_HOST;
 	skb->protocol = eth_type_trans(skb, netdev);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 035/262] workqueue: reimplement work_on_cpu() using system_wq
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (33 preceding siblings ...)
  2012-09-28 18:49 ` [ 034/262] openvswitch: Reset upper layer protocol info on internal devices Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 036/262] cpufreq/powernow-k8: workqueue user shouldnt migrate the kworker to another CPU Greg Kroah-Hartman
                   ` (226 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Tejun Heo, Jiri Kosina, Linus Torvalds,
	Bjorn Helgaas, Len Brown, Rafael J. Wysocki

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tejun Heo <tj@kernel.org>

commit ed48ece27cd3d5ee0354c32bbaec0f3e1d4715c3 upstream.

The existing work_on_cpu() implementation is hugely inefficient.  It
creates a new kthread, execute that single function and then let the
kthread die on each invocation.

Now that system_wq can handle concurrent executions, there's no
advantage of doing this.  Reimplement work_on_cpu() using system_wq
which makes it simpler and way more efficient.

stable: While this isn't a fix in itself, it's needed to fix a
        workqueue related bug in cpufreq/powernow-k8.  AFAICS, this
        shouldn't break other existing users.

Signed-off-by: Tejun Heo <tj@kernel.org>
Acked-by: Jiri Kosina <jkosina@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Bjorn Helgaas <bhelgaas@google.com>
Cc: Len Brown <lenb@kernel.org>
Cc: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/workqueue.c |   25 ++++++++-----------------
 1 file changed, 8 insertions(+), 17 deletions(-)

--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -3628,18 +3628,17 @@ static int __devinit workqueue_cpu_down_
 #ifdef CONFIG_SMP
 
 struct work_for_cpu {
-	struct completion completion;
+	struct work_struct work;
 	long (*fn)(void *);
 	void *arg;
 	long ret;
 };
 
-static int do_work_for_cpu(void *_wfc)
+static void work_for_cpu_fn(struct work_struct *work)
 {
-	struct work_for_cpu *wfc = _wfc;
+	struct work_for_cpu *wfc = container_of(work, struct work_for_cpu, work);
+
 	wfc->ret = wfc->fn(wfc->arg);
-	complete(&wfc->completion);
-	return 0;
 }
 
 /**
@@ -3654,19 +3653,11 @@ static int do_work_for_cpu(void *_wfc)
  */
 long work_on_cpu(unsigned int cpu, long (*fn)(void *), void *arg)
 {
-	struct task_struct *sub_thread;
-	struct work_for_cpu wfc = {
-		.completion = COMPLETION_INITIALIZER_ONSTACK(wfc.completion),
-		.fn = fn,
-		.arg = arg,
-	};
+	struct work_for_cpu wfc = { .fn = fn, .arg = arg };
 
-	sub_thread = kthread_create(do_work_for_cpu, &wfc, "work_for_cpu");
-	if (IS_ERR(sub_thread))
-		return PTR_ERR(sub_thread);
-	kthread_bind(sub_thread, cpu);
-	wake_up_process(sub_thread);
-	wait_for_completion(&wfc.completion);
+	INIT_WORK_ONSTACK(&wfc.work, work_for_cpu_fn);
+	schedule_work_on(cpu, &wfc.work);
+	flush_work(&wfc.work);
 	return wfc.ret;
 }
 EXPORT_SYMBOL_GPL(work_on_cpu);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 036/262] cpufreq/powernow-k8: workqueue user shouldnt migrate the kworker to another CPU
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (34 preceding siblings ...)
  2012-09-28 18:49 ` [ 035/262] workqueue: reimplement work_on_cpu() using system_wq Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 037/262] cciss: fix handling of protocol error Greg Kroah-Hartman
                   ` (225 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Tejun Heo, Duncan, Rafael J. Wysocki, Andreas Herrmann

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tejun Heo <tj@kernel.org>

commit 6889125b8b4e09c5e53e6ecab3433bed1ce198c9 upstream.

powernowk8_target() runs off a per-cpu work item and if the
cpufreq_policy->cpu is different from the current one, it migrates the
kworker to the target CPU by manipulating current->cpus_allowed.  The
function migrates the kworker back to the original CPU but this is
still broken.  Workqueue concurrency management requires the kworkers
to stay on the same CPU and powernowk8_target() ends up triggerring
BUG_ON(rq != this_rq()) in try_to_wake_up_local() if it contends on
fidvid_mutex and sleeps.

It is unclear why this bug is being reported now.  Duncan says it
appeared to be a regression of 3.6-rc1 and couldn't reproduce it on
3.5.  Bisection seemed to point to 63d95a91 "workqueue: use @pool
instead of @gcwq or @cpu where applicable" which is an non-functional
change.  Given that the reproduce case sometimes took upto days to
trigger, it's easy to be misled while bisecting.  Maybe something made
contention on fidvid_mutex more likely?  I don't know.

This patch fixes the bug by using work_on_cpu() instead if @pol->cpu
isn't the same as the current one.  The code assumes that
cpufreq_policy->cpu is kept online by the caller, which Rafael tells
me is the case.

stable: ed48ece27c ("workqueue: reimplement work_on_cpu() using
        system_wq") should be applied before this; otherwise, the
        behavior could be horrible.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Duncan <1i5t5.duncan@cox.net>
Tested-by: Duncan <1i5t5.duncan@cox.net>
Cc: Rafael J. Wysocki <rjw@sisk.pl>
Cc: Andreas Herrmann <andreas.herrmann3@amd.com>
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=47301
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/cpufreq/powernow-k8.c |   63 ++++++++++++++++++++++--------------------
 1 file changed, 34 insertions(+), 29 deletions(-)

--- a/drivers/cpufreq/powernow-k8.c
+++ b/drivers/cpufreq/powernow-k8.c
@@ -35,7 +35,6 @@
 #include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/cpumask.h>
-#include <linux/sched.h>	/* for current / set_cpus_allowed() */
 #include <linux/io.h>
 #include <linux/delay.h>
 
@@ -1139,16 +1138,23 @@ static int transition_frequency_pstate(s
 	return res;
 }
 
-/* Driver entry point to switch to the target frequency */
-static int powernowk8_target(struct cpufreq_policy *pol,
-		unsigned targfreq, unsigned relation)
+struct powernowk8_target_arg {
+	struct cpufreq_policy		*pol;
+	unsigned			targfreq;
+	unsigned			relation;
+};
+
+static long powernowk8_target_fn(void *arg)
 {
-	cpumask_var_t oldmask;
+	struct powernowk8_target_arg *pta = arg;
+	struct cpufreq_policy *pol = pta->pol;
+	unsigned targfreq = pta->targfreq;
+	unsigned relation = pta->relation;
 	struct powernow_k8_data *data = per_cpu(powernow_data, pol->cpu);
 	u32 checkfid;
 	u32 checkvid;
 	unsigned int newstate;
-	int ret = -EIO;
+	int ret;
 
 	if (!data)
 		return -EINVAL;
@@ -1156,29 +1162,16 @@ static int powernowk8_target(struct cpuf
 	checkfid = data->currfid;
 	checkvid = data->currvid;
 
-	/* only run on specific CPU from here on. */
-	/* This is poor form: use a workqueue or smp_call_function_single */
-	if (!alloc_cpumask_var(&oldmask, GFP_KERNEL))
-		return -ENOMEM;
-
-	cpumask_copy(oldmask, tsk_cpus_allowed(current));
-	set_cpus_allowed_ptr(current, cpumask_of(pol->cpu));
-
-	if (smp_processor_id() != pol->cpu) {
-		printk(KERN_ERR PFX "limiting to cpu %u failed\n", pol->cpu);
-		goto err_out;
-	}
-
 	if (pending_bit_stuck()) {
 		printk(KERN_ERR PFX "failing targ, change pending bit set\n");
-		goto err_out;
+		return -EIO;
 	}
 
 	pr_debug("targ: cpu %d, %d kHz, min %d, max %d, relation %d\n",
 		pol->cpu, targfreq, pol->min, pol->max, relation);
 
 	if (query_current_values_with_pending_wait(data))
-		goto err_out;
+		return -EIO;
 
 	if (cpu_family != CPU_HW_PSTATE) {
 		pr_debug("targ: curr fid 0x%x, vid 0x%x\n",
@@ -1196,7 +1189,7 @@ static int powernowk8_target(struct cpuf
 
 	if (cpufreq_frequency_table_target(pol, data->powernow_table,
 				targfreq, relation, &newstate))
-		goto err_out;
+		return -EIO;
 
 	mutex_lock(&fidvid_mutex);
 
@@ -1209,9 +1202,8 @@ static int powernowk8_target(struct cpuf
 		ret = transition_frequency_fidvid(data, newstate);
 	if (ret) {
 		printk(KERN_ERR PFX "transition frequency failed\n");
-		ret = 1;
 		mutex_unlock(&fidvid_mutex);
-		goto err_out;
+		return 1;
 	}
 	mutex_unlock(&fidvid_mutex);
 
@@ -1220,12 +1212,25 @@ static int powernowk8_target(struct cpuf
 				data->powernow_table[newstate].index);
 	else
 		pol->cur = find_khz_freq_from_fid(data->currfid);
-	ret = 0;
 
-err_out:
-	set_cpus_allowed_ptr(current, oldmask);
-	free_cpumask_var(oldmask);
-	return ret;
+	return 0;
+}
+
+/* Driver entry point to switch to the target frequency */
+static int powernowk8_target(struct cpufreq_policy *pol,
+		unsigned targfreq, unsigned relation)
+{
+	struct powernowk8_target_arg pta = { .pol = pol, .targfreq = targfreq,
+					     .relation = relation };
+
+	/*
+	 * Must run on @pol->cpu.  cpufreq core is responsible for ensuring
+	 * that we're bound to the current CPU and pol->cpu stays online.
+	 */
+	if (smp_processor_id() == pol->cpu)
+		return powernowk8_target_fn(&pta);
+	else
+		return work_on_cpu(pol->cpu, powernowk8_target_fn, &pta);
 }
 
 /* Driver entry point to verify the policy and range of frequencies */



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 037/262] cciss: fix handling of protocol error
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (35 preceding siblings ...)
  2012-09-28 18:49 ` [ 036/262] cpufreq/powernow-k8: workqueue user shouldnt migrate the kworker to another CPU Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 038/262] vfs: make O_PATH file descriptors usable for fstat() Greg Kroah-Hartman
                   ` (224 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Stephen M. Cameron, Jens Axboe

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Stephen M. Cameron" <scameron@beardog.cce.hp.com>

commit 2453f5f992717251cfadab6184fbb3ec2f2e8b40 upstream.

If a command completes with a status of CMD_PROTOCOL_ERR, this
information should be conveyed to the SCSI mid layer, not dropped
on the floor.  Unlike a similar bug in the hpsa driver, this bug
only affects tape drives and CD and DVD ROM drives in the cciss
driver, and to induce it, you have to disconnect (or damage) a
cable, so it is not a very likely scenario (which would explain
why the bug has gone undetected for the last 10 years.)

Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/block/cciss_scsi.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/block/cciss_scsi.c
+++ b/drivers/block/cciss_scsi.c
@@ -795,6 +795,7 @@ static void complete_scsi_command(Comman
 				}
 			break;
 			case CMD_PROTOCOL_ERR:
+				cmd->result = DID_ERROR << 16;
 				dev_warn(&h->pdev->dev,
 					"%p has protocol error\n", c);
                         break;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 038/262] vfs: make O_PATH file descriptors usable for fstat()
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (36 preceding siblings ...)
  2012-09-28 18:49 ` [ 037/262] cciss: fix handling of protocol error Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 039/262] vfs: dcache: use DCACHE_DENTRY_KILLED instead of DCACHE_DISCONNECTED in d_kill() Greg Kroah-Hartman
                   ` (223 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan,
	ольга
	крыжановская,
	Al Viro, Linus Torvalds

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Linus Torvalds <torvalds@linux-foundation.org>

commit 55815f70147dcfa3ead5738fd56d3574e2e3c1c2 upstream.

We already use them for openat() and friends, but fstat() also wants to
be able to use O_PATH file descriptors.  This should make it more
directly comparable to the O_SEARCH of Solaris.

Note that you could already do the same thing with "fstatat()" and an
empty path, but just doing "fstat()" directly is simpler and faster, so
there is no reason not to just allow it directly.

See also commit 332a2e1244bd, which did the same thing for fchdir, for
the same reasons.

Reported-by: ольга крыжановская <olga.kryzhanovska@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/stat.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/stat.c
+++ b/fs/stat.c
@@ -58,7 +58,7 @@ EXPORT_SYMBOL(vfs_getattr);
 int vfs_fstat(unsigned int fd, struct kstat *stat)
 {
 	int fput_needed;
-	struct file *f = fget_light(fd, &fput_needed);
+	struct file *f = fget_raw_light(fd, &fput_needed);
 	int error = -EBADF;
 
 	if (f) {



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 039/262] vfs: dcache: use DCACHE_DENTRY_KILLED instead of DCACHE_DISCONNECTED in d_kill()
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (37 preceding siblings ...)
  2012-09-28 18:49 ` [ 038/262] vfs: make O_PATH file descriptors usable for fstat() Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 040/262] netconsole: remove a redundant netconsole_target_put() Greg Kroah-Hartman
                   ` (222 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Miklos Szeredi, Trond Myklebust, Linus Torvalds

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Miklos Szeredi <mszeredi@suse.cz>

commit b161dfa6937ae46d50adce8a7c6b12233e96e7bd upstream.

IBM reported a soft lockup after applying the fix for the rename_lock
deadlock.  Commit c83ce989cb5f ("VFS: Fix the nfs sillyrename regression
in kernel 2.6.38") was found to be the culprit.

The nfs sillyrename fix used DCACHE_DISCONNECTED to indicate that the
dentry was killed.  This flag can be set on non-killed dentries too,
which results in infinite retries when trying to traverse the dentry
tree.

This patch introduces a separate flag: DCACHE_DENTRY_KILLED, which is
only set in d_kill() and makes try_to_ascend() test only this flag.

IBM reported successful test results with this patch.

Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Cc: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/dcache.c            |    4 ++--
 include/linux/dcache.h |    2 ++
 2 files changed, 4 insertions(+), 2 deletions(-)

--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -389,7 +389,7 @@ static struct dentry *d_kill(struct dent
 	 * Inform try_to_ascend() that we are no longer attached to the
 	 * dentry tree
 	 */
-	dentry->d_flags |= DCACHE_DISCONNECTED;
+	dentry->d_flags |= DCACHE_DENTRY_KILLED;
 	if (parent)
 		spin_unlock(&parent->d_lock);
 	dentry_iput(dentry);
@@ -1046,7 +1046,7 @@ static struct dentry *try_to_ascend(stru
 	 * or deletion
 	 */
 	if (new != old->d_parent ||
-		 (old->d_flags & DCACHE_DISCONNECTED) ||
+		 (old->d_flags & DCACHE_DENTRY_KILLED) ||
 		 (!locked && read_seqretry(&rename_lock, seq))) {
 		spin_unlock(&new->d_lock);
 		new = NULL;
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -206,6 +206,8 @@ struct dentry_operations {
 #define DCACHE_MANAGED_DENTRY \
 	(DCACHE_MOUNTED|DCACHE_NEED_AUTOMOUNT|DCACHE_MANAGE_TRANSIT)
 
+#define DCACHE_DENTRY_KILLED	0x100000
+
 extern seqlock_t rename_lock;
 
 static inline int dname_external(struct dentry *dentry)



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 040/262] netconsole: remove a redundant netconsole_target_put()
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (38 preceding siblings ...)
  2012-09-28 18:49 ` [ 039/262] vfs: dcache: use DCACHE_DENTRY_KILLED instead of DCACHE_DISCONNECTED in d_kill() Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 041/262] eCryptfs: Copy up attributes of the lower target inode after rename Greg Kroah-Hartman
                   ` (221 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Cong Wang, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Amerigo Wang <amwang@redhat.com>

commit 72d3eb13b5c0abe7d63efac41f39c5b644c7bbaa upstream.

This netconsole_target_put() is obviously redundant, and it
causes a kernel segfault when removing a bridge device which has
netconsole running on it.

This is caused by:

	commit 8d8fc29d02a33e4bd5f4fa47823c1fd386346093
	Author: Amerigo Wang <amwang@redhat.com>
	Date:   Thu May 19 21:39:10 2011 +0000

	    netpoll: disable netpoll when enslave a device

Signed-off-by: Cong Wang <amwang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/netconsole.c |    1 -
 1 file changed, 1 deletion(-)

--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -648,7 +648,6 @@ static int netconsole_netdev_event(struc
 							  flags);
 					dev_put(nt->np.dev);
 					nt->np.dev = NULL;
-					netconsole_target_put(nt);
 				}
 				nt->enabled = 0;
 				stopped = true;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 041/262] eCryptfs: Copy up attributes of the lower target inode after rename
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (39 preceding siblings ...)
  2012-09-28 18:49 ` [ 040/262] netconsole: remove a redundant netconsole_target_put() Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 042/262] target: Fix ->data_length re-assignment bug with SCSI overflow Greg Kroah-Hartman
                   ` (220 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Tyler Hicks, Colin Ian King

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tyler Hicks <tyhicks@canonical.com>

commit 8335eafc2859e1a26282bef7c3d19f3d68868b8a upstream.

After calling into the lower filesystem to do a rename, the lower target
inode's attributes were not copied up to the eCryptfs target inode. This
resulted in the eCryptfs target inode staying around, rather than being
evicted, because i_nlink was not updated for the eCryptfs inode. This
also meant that eCryptfs didn't do the final iput() on the lower target
inode so it stayed around, as well. This would result in a failure to
free up space occupied by the target file in the rename() operation.
Both target inodes would eventually be evicted when the eCryptfs
filesystem was unmounted.

This patch calls fsstack_copy_attr_all() after the lower filesystem
does its ->rename() so that important inode attributes, such as i_nlink,
are updated at the eCryptfs layer. ecryptfs_evict_inode() is now called
and eCryptfs can drop its final reference on the lower inode.

http://launchpad.net/bugs/561129

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Tested-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ecryptfs/inode.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -621,6 +621,7 @@ ecryptfs_rename(struct inode *old_dir, s
 	struct dentry *lower_old_dir_dentry;
 	struct dentry *lower_new_dir_dentry;
 	struct dentry *trap = NULL;
+	struct inode *target_inode;
 
 	lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);
 	lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry);
@@ -628,6 +629,7 @@ ecryptfs_rename(struct inode *old_dir, s
 	dget(lower_new_dentry);
 	lower_old_dir_dentry = dget_parent(lower_old_dentry);
 	lower_new_dir_dentry = dget_parent(lower_new_dentry);
+	target_inode = new_dentry->d_inode;
 	trap = lock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
 	/* source should not be ancestor of target */
 	if (trap == lower_old_dentry) {
@@ -643,6 +645,9 @@ ecryptfs_rename(struct inode *old_dir, s
 			lower_new_dir_dentry->d_inode, lower_new_dentry);
 	if (rc)
 		goto out_lock;
+	if (target_inode)
+		fsstack_copy_attr_all(target_inode,
+				      ecryptfs_inode_to_lower(target_inode));
 	fsstack_copy_attr_all(new_dir, lower_new_dir_dentry->d_inode);
 	if (new_dir != old_dir)
 		fsstack_copy_attr_all(old_dir, lower_old_dir_dentry->d_inode);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 042/262] target: Fix ->data_length re-assignment bug with SCSI overflow
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (40 preceding siblings ...)
  2012-09-28 18:49 ` [ 041/262] eCryptfs: Copy up attributes of the lower target inode after rename Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 043/262] target: simplify code around transport_get_sense_data Greg Kroah-Hartman
                   ` (219 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Roland Dreier, Christoph Hellwig, Boaz Harrosh,
	Nicholas Bellinger

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nicholas Bellinger <nab@linux-iscsi.org>

commit 4c054ba63ad47ef244cfcfa1cea38134620a5bae upstream.

This patch fixes a long-standing bug with SCSI overflow handling
where se_cmd->data_length was incorrectly being re-assigned to
the larger CDB extracted allocation length, resulting in a number
of fabric level errors that would end up causing a session reset
in most cases.  So instead now:

 - Only re-assign se_cmd->data_length durining UNDERFLOW (to use the
   smaller value)
 - Use existing se_cmd->data_length for OVERFLOW (to use the smaller
   value)

This fix has been tested with the following CDB to generate an
SCSI overflow:

  sg_raw -r512 /dev/sdc 28 0 0 0 0 0 0 0 9 0

Tested using iscsi-target, tcm_qla2xxx, loopback and tcm_vhost fabric
ports.  Here is a bit more detail on each case:

 - iscsi-target: Bug with open-iscsi with overflow, sg_raw returns
                 -3584 bytes of data.
 - tcm_qla2xxx: Working as expected, returnins 512 bytes of data
 - loopback: sg_raw returns CHECK_CONDITION, from overflow rejection
             in transport_generic_map_mem_to_cmd()
 - tcm_vhost: Same as loopback

Reported-by: Roland Dreier <roland@purestorage.com>
Cc: Roland Dreier <roland@purestorage.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Boaz Harrosh <bharrosh@panasas.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/target/target_core_transport.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -3000,15 +3000,20 @@ static int transport_generic_cmd_sequenc
 			/* Returns CHECK_CONDITION + INVALID_CDB_FIELD */
 			goto out_invalid_cdb_field;
 		}
-
+		/*
+		 * For the overflow case keep the existing fabric provided
+		 * ->data_length.  Otherwise for the underflow case, reset
+		 * ->data_length to the smaller SCSI expected data transfer
+		 * length.
+		 */
 		if (size > cmd->data_length) {
 			cmd->se_cmd_flags |= SCF_OVERFLOW_BIT;
 			cmd->residual_count = (size - cmd->data_length);
 		} else {
 			cmd->se_cmd_flags |= SCF_UNDERFLOW_BIT;
 			cmd->residual_count = (cmd->data_length - size);
+			cmd->data_length = size;
 		}
-		cmd->data_length = size;
 	}
 
 	if (cmd->se_cmd_flags & SCF_SCSI_DATA_SG_IO_CDB) {



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 043/262] target: simplify code around transport_get_sense_data
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (41 preceding siblings ...)
  2012-09-28 18:49 ` [ 042/262] target: Fix ->data_length re-assignment bug with SCSI overflow Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 044/262] ARM: 7496/1: hw_breakpoint: dont rely on dfsr to show watchpoint access type Greg Kroah-Hartman
                   ` (218 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Paolo Bonzini, Nicholas Bellinger

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Paolo Bonzini <pbonzini@redhat.com>

commit 27a2709912ac19c755d34c79fe11994b0bf8082b upstream.

The error conditions in transport_get_sense_data are superfluous
and complicate the code unnecessarily:

* SCF_TRANSPORT_TASK_SENSE is checked in the caller;

* it's simply part of the invariants of dev->transport->get_sense_buffer
  that it must be there if transport_complete ever returns 1, and that
  it must not return NULL.  Besides, the entire callback will disappear
  with the next patch.

* similarly in the caller we can expect that sense data is only sent
  for non-zero cmd->scsi_status.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/target/target_core_transport.c |   49 ++++++++-------------------------
 1 file changed, 13 insertions(+), 36 deletions(-)

--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -2261,7 +2261,7 @@ out:
 /*
  * Used to obtain Sense Data from underlying Linux/SCSI struct scsi_cmnd
  */
-static int transport_get_sense_data(struct se_cmd *cmd)
+static void transport_get_sense_data(struct se_cmd *cmd)
 {
 	unsigned char *buffer = cmd->sense_buffer, *sense_buffer = NULL;
 	struct se_device *dev = cmd->se_dev;
@@ -2271,30 +2271,15 @@ static int transport_get_sense_data(stru
 	WARN_ON(!cmd->se_lun);
 
 	if (!dev)
-		return 0;
+		return;
 
 	spin_lock_irqsave(&cmd->t_state_lock, flags);
 	if (cmd->se_cmd_flags & SCF_SENT_CHECK_CONDITION) {
 		spin_unlock_irqrestore(&cmd->t_state_lock, flags);
-		return 0;
-	}
-
-	if (!(cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE))
-		goto out;
-
-	if (!dev->transport->get_sense_buffer) {
-		pr_err("dev->transport->get_sense_buffer is NULL\n");
-		goto out;
+		return;
 	}
 
 	sense_buffer = dev->transport->get_sense_buffer(cmd);
-	if (!sense_buffer) {
-		pr_err("ITT 0x%08x cmd %p: Unable to locate"
-			" sense buffer for task with sense\n",
-			cmd->se_tfo->get_task_tag(cmd), cmd);
-		goto out;
-	}
-
 	spin_unlock_irqrestore(&cmd->t_state_lock, flags);
 
 	offset = cmd->se_tfo->set_fabric_sense_len(cmd, TRANSPORT_SENSE_BUFFER);
@@ -2306,11 +2291,6 @@ static int transport_get_sense_data(stru
 
 	pr_debug("HBA_[%u]_PLUG[%s]: Set SAM STATUS: 0x%02x and sense\n",
 		dev->se_hba->hba_id, dev->transport->name, cmd->scsi_status);
-	return 0;
-
-out:
-	spin_unlock_irqrestore(&cmd->t_state_lock, flags);
-	return -1;
 }
 
 static inline long long transport_dev_end_lba(struct se_device *dev)
@@ -3171,7 +3151,7 @@ static void transport_handle_queue_full(
 static void target_complete_ok_work(struct work_struct *work)
 {
 	struct se_cmd *cmd = container_of(work, struct se_cmd, work);
-	int reason = 0, ret;
+	int ret;
 
 	/*
 	 * Check if we need to move delayed/dormant tasks from cmds on the
@@ -3192,19 +3172,16 @@ static void target_complete_ok_work(stru
 	 * the struct se_cmd in question.
 	 */
 	if (cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE) {
-		if (transport_get_sense_data(cmd) < 0)
-			reason = TCM_NON_EXISTENT_LUN;
+		WARN_ON(!cmd->scsi_status);
+		transport_get_sense_data(cmd);
+		ret = transport_send_check_condition_and_sense(
+					cmd, 0, 1);
+		if (ret == -EAGAIN || ret == -ENOMEM)
+			goto queue_full;
 
-		if (cmd->scsi_status) {
-			ret = transport_send_check_condition_and_sense(
-					cmd, reason, 1);
-			if (ret == -EAGAIN || ret == -ENOMEM)
-				goto queue_full;
-
-			transport_lun_remove_cmd(cmd);
-			transport_cmd_check_stop_to_fabric(cmd);
-			return;
-		}
+		transport_lun_remove_cmd(cmd);
+		transport_cmd_check_stop_to_fabric(cmd);
+		return;
 	}
 	/*
 	 * Check for a callback, used by amongst other things



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 044/262] ARM: 7496/1: hw_breakpoint: dont rely on dfsr to show watchpoint access type
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (42 preceding siblings ...)
  2012-09-28 18:49 ` [ 043/262] target: simplify code around transport_get_sense_data Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 045/262] ARM: 7501/1: decompressor: reset ttbcr for VMSA ARMv7 cores Greg Kroah-Hartman
                   ` (217 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Will Deacon, Russell King

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Will Deacon <will.deacon@arm.com>

commit bf8801145c01ab600f8df66e8c879ac642fa5846 upstream.

>From ARM debug architecture v7.1 onwards, a watchpoint exception causes
the DFAR to be updated with the faulting data address. However, DFSR.WnR
takes an UNKNOWN value and therefore cannot be used in general to
determine the access type that triggered the watchpoint.

This patch forbids watchpoints without an overflow handler from
specifying a specific access type (load/store). Those with overflow
handlers must be able to handle false positives potentially triggered by
a watchpoint of a different access type on the same address. For
SIGTRAP-based handlers (i.e. ptrace), this should have no impact.

Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/kernel/hw_breakpoint.c |   55 +++++++++++++++++++++++++++++-----------
 1 file changed, 40 insertions(+), 15 deletions(-)

--- a/arch/arm/kernel/hw_breakpoint.c
+++ b/arch/arm/kernel/hw_breakpoint.c
@@ -159,6 +159,12 @@ static int debug_arch_supported(void)
 		arch >= ARM_DEBUG_ARCH_V7_1;
 }
 
+/* Can we determine the watchpoint access type from the fsr? */
+static int debug_exception_updates_fsr(void)
+{
+	return 0;
+}
+
 /* Determine number of WRP registers available. */
 static int get_num_wrp_resources(void)
 {
@@ -619,18 +625,35 @@ int arch_validate_hwbkpt_settings(struct
 	info->address &= ~alignment_mask;
 	info->ctrl.len <<= offset;
 
-	/*
-	 * Currently we rely on an overflow handler to take
-	 * care of single-stepping the breakpoint when it fires.
-	 * In the case of userspace breakpoints on a core with V7 debug,
-	 * we can use the mismatch feature as a poor-man's hardware
-	 * single-step, but this only works for per-task breakpoints.
-	 */
-	if (!bp->overflow_handler && (arch_check_bp_in_kernelspace(bp) ||
-	    !core_has_mismatch_brps() || !bp->hw.bp_target)) {
-		pr_warning("overflow handler required but none found\n");
-		ret = -EINVAL;
+	if (!bp->overflow_handler) {
+		/*
+		 * Mismatch breakpoints are required for single-stepping
+		 * breakpoints.
+		 */
+		if (!core_has_mismatch_brps())
+			return -EINVAL;
+
+		/* We don't allow mismatch breakpoints in kernel space. */
+		if (arch_check_bp_in_kernelspace(bp))
+			return -EPERM;
+
+		/*
+		 * Per-cpu breakpoints are not supported by our stepping
+		 * mechanism.
+		 */
+		if (!bp->hw.bp_target)
+			return -EINVAL;
+
+		/*
+		 * We only support specific access types if the fsr
+		 * reports them.
+		 */
+		if (!debug_exception_updates_fsr() &&
+		    (info->ctrl.type == ARM_BREAKPOINT_LOAD ||
+		     info->ctrl.type == ARM_BREAKPOINT_STORE))
+			return -EINVAL;
 	}
+
 out:
 	return ret;
 }
@@ -706,10 +729,12 @@ static void watchpoint_handler(unsigned
 				goto unlock;
 
 			/* Check that the access type matches. */
-			access = (fsr & ARM_FSR_ACCESS_MASK) ? HW_BREAKPOINT_W :
-				 HW_BREAKPOINT_R;
-			if (!(access & hw_breakpoint_type(wp)))
-				goto unlock;
+			if (debug_exception_updates_fsr()) {
+				access = (fsr & ARM_FSR_ACCESS_MASK) ?
+					  HW_BREAKPOINT_W : HW_BREAKPOINT_R;
+				if (!(access & hw_breakpoint_type(wp)))
+					goto unlock;
+			}
 
 			/* We have a winner. */
 			info->trigger = addr;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 045/262] ARM: 7501/1: decompressor: reset ttbcr for VMSA ARMv7 cores
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (43 preceding siblings ...)
  2012-09-28 18:49 ` [ 044/262] ARM: 7496/1: hw_breakpoint: dont rely on dfsr to show watchpoint access type Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-29 12:25   ` Ben Hutchings
  2012-09-28 18:49 ` [ 046/262] ARM: 7513/1: Make sure dtc is built before running it Greg Kroah-Hartman
                   ` (216 subsequent siblings)
  261 siblings, 1 reply; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Nicolas Pitre, Matthew Leach, Will Deacon, Russell King

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Will Deacon <will.deacon@arm.com>

commit dbece45894d3ab1baac15a96dc4e1e8e23f64a93 upstream.

When enabling the MMU for ARMv7 CPUs, the decompressor does not touch
the ttbcr register, assuming that it will be zeroed (N == 0, EAE == 0).
Given that only EAE is defined as 0 for non-secure copies of the
register (and a bootloader such as kexec may leave it set to 1 anyway),
we should ensure that we reset the register ourselves before turning on
the MMU.

This patch zeroes TTBCR.EAE and TTBCR.N prior to enabling the MMU for
ARMv7 cores in the decompressor, configuring us exclusively for 32-bit
translation tables via TTBR0.

Acked-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Matthew Leach <matthew.leach@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/compressed/head.S |    4 ++++
 1 file changed, 4 insertions(+)

--- a/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@ -659,10 +659,14 @@ __armv7_mmu_cache_on:
 #ifdef CONFIG_CPU_ENDIAN_BE8
 		orr	r0, r0, #1 << 25	@ big-endian page tables
 #endif
+		mrcne   p15, 0, r6, c2, c0, 2   @ read ttb control reg
 		orrne	r0, r0, #1		@ MMU enabled
 		movne	r1, #0xfffffffd		@ domain 0 = client
+		bic     r6, r6, #1 << 31        @ 32-bit translation system
+		bic     r6, r6, #3 << 0         @ use only ttbr0
 		mcrne	p15, 0, r3, c2, c0, 0	@ load page table pointer
 		mcrne	p15, 0, r1, c3, c0, 0	@ load domain access control
+		mcrne   p15, 0, r6, c2, c0, 2   @ load ttb control
 #endif
 		mcr	p15, 0, r0, c7, c5, 4	@ ISB
 		mcr	p15, 0, r0, c1, c0, 0	@ load control register



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 046/262] ARM: 7513/1: Make sure dtc is built before running it
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (44 preceding siblings ...)
  2012-09-28 18:49 ` [ 045/262] ARM: 7501/1: decompressor: reset ttbcr for VMSA ARMv7 cores Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 047/262] ARM: 7526/1: traps: send SIGILL if get_user fails on undef handling path Greg Kroah-Hartman
                   ` (215 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, David Brown, Russell King

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Brown <davidb@codeaurora.org>

commit 70b0476a2394de4f4e32e0b67288d80ff71ca963 upstream.

'make dtbs' in a clean tree will try running the dtc before actually
building it.  Make these rules depend upon the scripts to build it.

Signed-off-by: David Brown <davidb@codeaurora.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/Makefile |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -279,10 +279,10 @@ zImage Image xipImage bootpImage uImage:
 zinstall uinstall install: vmlinux
 	$(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $@
 
-%.dtb:
+%.dtb: scripts
 	$(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $(boot)/$@
 
-dtbs:
+dtbs: scripts
 	$(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $(boot)/$@
 
 # We use MRPROPER_FILES and CLEAN_FILES now



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 047/262] ARM: 7526/1: traps: send SIGILL if get_user fails on undef handling path
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (45 preceding siblings ...)
  2012-09-28 18:49 ` [ 046/262] ARM: 7513/1: Make sure dtc is built before running it Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 048/262] ARM: 7527/1: uaccess: explicitly check __user pointer when !CPU_USE_DOMAINS Greg Kroah-Hartman
                   ` (214 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Will Deacon, Russell King

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Will Deacon <will.deacon@arm.com>

commit 2b2040af0b64cd93e5d4df2494c4486cf604090d upstream.

get_user may fail to load from the provided __user address due to an
unhandled fault generated by the access.

In the case of the undefined instruction trap, this results in failure
to load the faulting instruction, in which case we should send SIGILL to
the task rather than continue with potentially uninitialised data.

Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/kernel/traps.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -388,20 +388,23 @@ asmlinkage void __exception do_undefinst
 #endif
 			instr = *(u32 *) pc;
 	} else if (thumb_mode(regs)) {
-		get_user(instr, (u16 __user *)pc);
+		if (get_user(instr, (u16 __user *)pc))
+			goto die_sig;
 		if (is_wide_instruction(instr)) {
 			unsigned int instr2;
-			get_user(instr2, (u16 __user *)pc+1);
+			if (get_user(instr2, (u16 __user *)pc+1))
+				goto die_sig;
 			instr <<= 16;
 			instr |= instr2;
 		}
-	} else {
-		get_user(instr, (u32 __user *)pc);
+	} else if (get_user(instr, (u32 __user *)pc)) {
+		goto die_sig;
 	}
 
 	if (call_undef_hook(regs, instr) == 0)
 		return;
 
+die_sig:
 #ifdef CONFIG_DEBUG_USER
 	if (user_debug & UDBG_UNDEFINED) {
 		printk(KERN_INFO "%s (%d): undefined instruction: pc=%p\n",



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 048/262] ARM: 7527/1: uaccess: explicitly check __user pointer when !CPU_USE_DOMAINS
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (46 preceding siblings ...)
  2012-09-28 18:49 ` [ 047/262] ARM: 7526/1: traps: send SIGILL if get_user fails on undef handling path Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 049/262] Staging: Android alarm: IOCTL command encoding fix Greg Kroah-Hartman
                   ` (213 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Catalin Marinas, Will Deacon, Russell King

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Russell King <rmk+kernel@arm.linux.org.uk>

commit 8404663f81d212918ff85f493649a7991209fa04 upstream.

The {get,put}_user macros don't perform range checking on the provided
__user address when !CPU_HAS_DOMAINS.

This patch reworks the out-of-line assembly accessors to check the user
address against a specified limit, returning -EFAULT if is is out of
range.

[will: changed get_user register allocation to match put_user]
[rmk: fixed building on older ARM architectures]

Reported-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/include/asm/assembler.h |    8 +++++++
 arch/arm/include/asm/uaccess.h   |   40 ++++++++++++++++++++++++++-------------
 arch/arm/lib/getuser.S           |   23 ++++++++++++++--------
 arch/arm/lib/putuser.S           |    6 +++++
 4 files changed, 56 insertions(+), 21 deletions(-)

--- a/arch/arm/include/asm/assembler.h
+++ b/arch/arm/include/asm/assembler.h
@@ -320,4 +320,12 @@
 	.size \name , . - \name
 	.endm
 
+	.macro check_uaccess, addr:req, size:req, limit:req, tmp:req, bad:req
+#ifndef CONFIG_CPU_USE_DOMAINS
+	adds	\tmp, \addr, #\size - 1
+	sbcccs	\tmp, \tmp, \limit
+	bcs	\bad
+#endif
+	.endm
+
 #endif /* __ASM_ASSEMBLER_H__ */
--- a/arch/arm/include/asm/uaccess.h
+++ b/arch/arm/include/asm/uaccess.h
@@ -101,28 +101,39 @@ extern int __get_user_1(void *);
 extern int __get_user_2(void *);
 extern int __get_user_4(void *);
 
-#define __get_user_x(__r2,__p,__e,__s,__i...)				\
+#define __GUP_CLOBBER_1	"lr", "cc"
+#ifdef CONFIG_CPU_USE_DOMAINS
+#define __GUP_CLOBBER_2	"ip", "lr", "cc"
+#else
+#define __GUP_CLOBBER_2 "lr", "cc"
+#endif
+#define __GUP_CLOBBER_4	"lr", "cc"
+
+#define __get_user_x(__r2,__p,__e,__l,__s)				\
 	   __asm__ __volatile__ (					\
 		__asmeq("%0", "r0") __asmeq("%1", "r2")			\
+		__asmeq("%3", "r1")					\
 		"bl	__get_user_" #__s				\
 		: "=&r" (__e), "=r" (__r2)				\
-		: "0" (__p)						\
-		: __i, "cc")
+		: "0" (__p), "r" (__l)					\
+		: __GUP_CLOBBER_##__s)
 
 #define get_user(x,p)							\
 	({								\
+		unsigned long __limit = current_thread_info()->addr_limit - 1; \
 		register const typeof(*(p)) __user *__p asm("r0") = (p);\
 		register unsigned long __r2 asm("r2");			\
+		register unsigned long __l asm("r1") = __limit;		\
 		register int __e asm("r0");				\
 		switch (sizeof(*(__p))) {				\
 		case 1:							\
-			__get_user_x(__r2, __p, __e, 1, "lr");		\
-	       		break;						\
+			__get_user_x(__r2, __p, __e, __l, 1);		\
+			break;						\
 		case 2:							\
-			__get_user_x(__r2, __p, __e, 2, "r3", "lr");	\
+			__get_user_x(__r2, __p, __e, __l, 2);		\
 			break;						\
 		case 4:							\
-	       		__get_user_x(__r2, __p, __e, 4, "lr");		\
+			__get_user_x(__r2, __p, __e, __l, 4);		\
 			break;						\
 		default: __e = __get_user_bad(); break;			\
 		}							\
@@ -135,31 +146,34 @@ extern int __put_user_2(void *, unsigned
 extern int __put_user_4(void *, unsigned int);
 extern int __put_user_8(void *, unsigned long long);
 
-#define __put_user_x(__r2,__p,__e,__s)					\
+#define __put_user_x(__r2,__p,__e,__l,__s)				\
 	   __asm__ __volatile__ (					\
 		__asmeq("%0", "r0") __asmeq("%2", "r2")			\
+		__asmeq("%3", "r1")					\
 		"bl	__put_user_" #__s				\
 		: "=&r" (__e)						\
-		: "0" (__p), "r" (__r2)					\
+		: "0" (__p), "r" (__r2), "r" (__l)			\
 		: "ip", "lr", "cc")
 
 #define put_user(x,p)							\
 	({								\
+		unsigned long __limit = current_thread_info()->addr_limit - 1; \
 		register const typeof(*(p)) __r2 asm("r2") = (x);	\
 		register const typeof(*(p)) __user *__p asm("r0") = (p);\
+		register unsigned long __l asm("r1") = __limit;		\
 		register int __e asm("r0");				\
 		switch (sizeof(*(__p))) {				\
 		case 1:							\
-			__put_user_x(__r2, __p, __e, 1);		\
+			__put_user_x(__r2, __p, __e, __l, 1);		\
 			break;						\
 		case 2:							\
-			__put_user_x(__r2, __p, __e, 2);		\
+			__put_user_x(__r2, __p, __e, __l, 2);		\
 			break;						\
 		case 4:							\
-			__put_user_x(__r2, __p, __e, 4);		\
+			__put_user_x(__r2, __p, __e, __l, 4);		\
 			break;						\
 		case 8:							\
-			__put_user_x(__r2, __p, __e, 8);		\
+			__put_user_x(__r2, __p, __e, __l, 8);		\
 			break;						\
 		default: __e = __put_user_bad(); break;			\
 		}							\
--- a/arch/arm/lib/getuser.S
+++ b/arch/arm/lib/getuser.S
@@ -16,8 +16,9 @@
  * __get_user_X
  *
  * Inputs:	r0 contains the address
+ *		r1 contains the address limit, which must be preserved
  * Outputs:	r0 is the error code
- *		r2, r3 contains the zero-extended value
+ *		r2 contains the zero-extended value
  *		lr corrupted
  *
  * No other registers must be altered.  (see <asm/uaccess.h>
@@ -27,33 +28,39 @@
  * Note also that it is intended that __get_user_bad is not global.
  */
 #include <linux/linkage.h>
+#include <asm/assembler.h>
 #include <asm/errno.h>
 #include <asm/domain.h>
 
 ENTRY(__get_user_1)
+	check_uaccess r0, 1, r1, r2, __get_user_bad
 1: TUSER(ldrb)	r2, [r0]
 	mov	r0, #0
 	mov	pc, lr
 ENDPROC(__get_user_1)
 
 ENTRY(__get_user_2)
-#ifdef CONFIG_THUMB2_KERNEL
-2: TUSER(ldrb)	r2, [r0]
-3: TUSER(ldrb)	r3, [r0, #1]
+	check_uaccess r0, 2, r1, r2, __get_user_bad
+#ifdef CONFIG_CPU_USE_DOMAINS
+rb	.req	ip
+2:	ldrbt	r2, [r0], #1
+3:	ldrbt	rb, [r0], #0
 #else
-2: TUSER(ldrb)	r2, [r0], #1
-3: TUSER(ldrb)	r3, [r0]
+rb	.req	r0
+2:	ldrb	r2, [r0]
+3:	ldrb	rb, [r0, #1]
 #endif
 #ifndef __ARMEB__
-	orr	r2, r2, r3, lsl #8
+	orr	r2, r2, rb, lsl #8
 #else
-	orr	r2, r3, r2, lsl #8
+	orr	r2, rb, r2, lsl #8
 #endif
 	mov	r0, #0
 	mov	pc, lr
 ENDPROC(__get_user_2)
 
 ENTRY(__get_user_4)
+	check_uaccess r0, 4, r1, r2, __get_user_bad
 4: TUSER(ldr)	r2, [r0]
 	mov	r0, #0
 	mov	pc, lr
--- a/arch/arm/lib/putuser.S
+++ b/arch/arm/lib/putuser.S
@@ -16,6 +16,7 @@
  * __put_user_X
  *
  * Inputs:	r0 contains the address
+ *		r1 contains the address limit, which must be preserved
  *		r2, r3 contains the value
  * Outputs:	r0 is the error code
  *		lr corrupted
@@ -27,16 +28,19 @@
  * Note also that it is intended that __put_user_bad is not global.
  */
 #include <linux/linkage.h>
+#include <asm/assembler.h>
 #include <asm/errno.h>
 #include <asm/domain.h>
 
 ENTRY(__put_user_1)
+	check_uaccess r0, 1, r1, ip, __put_user_bad
 1: TUSER(strb)	r2, [r0]
 	mov	r0, #0
 	mov	pc, lr
 ENDPROC(__put_user_1)
 
 ENTRY(__put_user_2)
+	check_uaccess r0, 2, r1, ip, __put_user_bad
 	mov	ip, r2, lsr #8
 #ifdef CONFIG_THUMB2_KERNEL
 #ifndef __ARMEB__
@@ -60,12 +64,14 @@ ENTRY(__put_user_2)
 ENDPROC(__put_user_2)
 
 ENTRY(__put_user_4)
+	check_uaccess r0, 4, r1, ip, __put_user_bad
 4: TUSER(str)	r2, [r0]
 	mov	r0, #0
 	mov	pc, lr
 ENDPROC(__put_user_4)
 
 ENTRY(__put_user_8)
+	check_uaccess r0, 8, r1, ip, __put_user_bad
 #ifdef CONFIG_THUMB2_KERNEL
 5: TUSER(str)	r2, [r0]
 6: TUSER(str)	r3, [r0, #4]



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 049/262] Staging: Android alarm: IOCTL command encoding fix
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (47 preceding siblings ...)
  2012-09-28 18:49 ` [ 048/262] ARM: 7527/1: uaccess: explicitly check __user pointer when !CPU_USE_DOMAINS Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 050/262] ARM: OMAP: timer: obey the !CONFIG_OMAP_32K_TIMER Greg Kroah-Hartman
                   ` (212 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Dae S. Kim

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Dae S. Kim" <dae@velatum.com>

commit 6bd4a5d96c08dc2380f8053b1bd4f879f55cd3c9 upstream.

Fixed a bug. Data was being written to user space using an IOCTL
command encoded with _IOC_WRITE access mode.

Signed-off-by: Dae S. Kim <dae@velatum.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/android/android_alarm.h |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/staging/android/android_alarm.h
+++ b/drivers/staging/android/android_alarm.h
@@ -51,10 +51,12 @@ enum android_alarm_return_flags {
 #define ANDROID_ALARM_WAIT                  _IO('a', 1)
 
 #define ALARM_IOW(c, type, size)            _IOW('a', (c) | ((type) << 4), size)
+#define ALARM_IOR(c, type, size)            _IOR('a', (c) | ((type) << 4), size)
+
 /* Set alarm */
 #define ANDROID_ALARM_SET(type)             ALARM_IOW(2, type, struct timespec)
 #define ANDROID_ALARM_SET_AND_WAIT(type)    ALARM_IOW(3, type, struct timespec)
-#define ANDROID_ALARM_GET_TIME(type)        ALARM_IOW(4, type, struct timespec)
+#define ANDROID_ALARM_GET_TIME(type)        ALARM_IOR(4, type, struct timespec)
 #define ANDROID_ALARM_SET_RTC               _IOW('a', 5, struct timespec)
 #define ANDROID_ALARM_BASE_CMD(cmd)         (cmd & ~(_IOC(0, 0, 0xf0, 0)))
 #define ANDROID_ALARM_IOCTL_TO_TYPE(cmd)    (_IOC_NR(cmd) >> 4)



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 050/262] ARM: OMAP: timer: obey the !CONFIG_OMAP_32K_TIMER
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (48 preceding siblings ...)
  2012-09-28 18:49 ` [ 049/262] Staging: Android alarm: IOCTL command encoding fix Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 051/262] ARM: clk-imx25: Fix SSI clock registration Greg Kroah-Hartman
                   ` (211 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Igor Grinberg, Paul Walmsley, Santosh Shilimkar,
	Tony Lindgren

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Igor Grinberg <grinberg@compulab.co.il>

commit 45caae74d238ef6583e9402cb8c550cc0b0f7dbd upstream.

Currently, omap2_sync32k_clocksource_init() function initializes the 32K
timer as the system clock source regardless of the CONFIG_OMAP_32K_TIMER
setting.
Fix this by providing a default implementation for
!CONFIG_OMAP_32K_TIMER case.

Signed-off-by: Igor Grinberg <grinberg@compulab.co.il>
Reviewed-by: Paul Walmsley <paul@pwsan.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/mach-omap2/timer.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/arch/arm/mach-omap2/timer.c
+++ b/arch/arm/mach-omap2/timer.c
@@ -263,6 +263,7 @@ static u32 notrace dmtimer_read_sched_cl
 	return 0;
 }
 
+#ifdef CONFIG_OMAP_32K_TIMER
 /* Setup free-running counter for clocksource */
 static int __init omap2_sync32k_clocksource_init(void)
 {
@@ -302,6 +303,12 @@ static int __init omap2_sync32k_clocksou
 
 	return ret;
 }
+#else
+static inline int omap2_sync32k_clocksource_init(void)
+{
+	return -ENODEV;
+}
+#endif
 
 static void __init omap2_gptimer_clocksource_init(int gptimer_id,
 						const char *fck_source)



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 051/262] ARM: clk-imx25: Fix SSI clock registration
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (49 preceding siblings ...)
  2012-09-28 18:49 ` [ 050/262] ARM: OMAP: timer: obey the !CONFIG_OMAP_32K_TIMER Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 052/262] ARM: clk-imx35: " Greg Kroah-Hartman
                   ` (210 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Fabio Estevam, Sascha Hauer

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Fabio Estevam <fabio.estevam@freescale.com>

commit 912bfe76528c287bc4812521b8d53366954b39a5 upstream.

SSI block has two types of clock:

ipg: bus clock, the clock needed for accessing registers.
per: peripheral clock, the clock needed for generating the bit rate.

Currently SSI driver only supports slave mode and only need to handle
the ipg clock, because the peripheral clock comes from the master codec.

Only register the ipg clock and do not register the peripheral clock for ssi.

Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/mach-imx/clk-imx25.c |    6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

--- a/arch/arm/mach-imx/clk-imx25.c
+++ b/arch/arm/mach-imx/clk-imx25.c
@@ -222,10 +222,8 @@ int __init mx25_clocks_init(void)
 	clk_register_clkdev(clk[lcdc_ipg], "ipg", "imx-fb.0");
 	clk_register_clkdev(clk[lcdc_ahb], "ahb", "imx-fb.0");
 	clk_register_clkdev(clk[wdt_ipg], NULL, "imx2-wdt.0");
-	clk_register_clkdev(clk[ssi1_ipg_per], "per", "imx-ssi.0");
-	clk_register_clkdev(clk[ssi1_ipg], "ipg", "imx-ssi.0");
-	clk_register_clkdev(clk[ssi2_ipg_per], "per", "imx-ssi.1");
-	clk_register_clkdev(clk[ssi2_ipg], "ipg", "imx-ssi.1");
+	clk_register_clkdev(clk[ssi1_ipg], NULL, "imx-ssi.0");
+	clk_register_clkdev(clk[ssi2_ipg], NULL, "imx-ssi.1");
 	clk_register_clkdev(clk[esdhc1_ipg_per], "per", "sdhci-esdhc-imx25.0");
 	clk_register_clkdev(clk[esdhc1_ipg], "ipg", "sdhci-esdhc-imx25.0");
 	clk_register_clkdev(clk[esdhc1_ahb], "ahb", "sdhci-esdhc-imx25.0");



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 052/262] ARM: clk-imx35: Fix SSI clock registration
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (50 preceding siblings ...)
  2012-09-28 18:49 ` [ 051/262] ARM: clk-imx25: Fix SSI clock registration Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 053/262] ARM: Fix ioremap() of address zero Greg Kroah-Hartman
                   ` (209 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Fabio Estevam, Mark Brown, Sascha Hauer

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Fabio Estevam <fabio.estevam@freescale.com>

commit 48540058612786d365602f3324ed97f9071092de upstream.

SSI block has two types of clock:

ipg: bus clock, the clock needed for accessing registers.
per: peripheral clock, the clock needed for generating the bit rate.

Currently SSI driver only supports slave mode and only need to handle
the ipg clock, because the peripheral clock comes from the master codec.

Only register the ipg clock and do not register the peripheral clock for ssi.

Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Tested-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/mach-imx/clk-imx35.c |    6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

--- a/arch/arm/mach-imx/clk-imx35.c
+++ b/arch/arm/mach-imx/clk-imx35.c
@@ -230,10 +230,8 @@ int __init mx35_clocks_init()
 	clk_register_clkdev(clk[ipu_gate], NULL, "mx3_sdc_fb");
 	clk_register_clkdev(clk[owire_gate], NULL, "mxc_w1");
 	clk_register_clkdev(clk[sdma_gate], NULL, "imx35-sdma");
-	clk_register_clkdev(clk[ipg], "ipg", "imx-ssi.0");
-	clk_register_clkdev(clk[ssi1_div_post], "per", "imx-ssi.0");
-	clk_register_clkdev(clk[ipg], "ipg", "imx-ssi.1");
-	clk_register_clkdev(clk[ssi2_div_post], "per", "imx-ssi.1");
+	clk_register_clkdev(clk[ssi1_gate], NULL, "imx-ssi.0");
+	clk_register_clkdev(clk[ssi2_gate], NULL, "imx-ssi.1");
 	/* i.mx35 has the i.mx21 type uart */
 	clk_register_clkdev(clk[uart1_gate], "per", "imx21-uart.0");
 	clk_register_clkdev(clk[ipg], "ipg", "imx21-uart.0");



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 053/262] ARM: Fix ioremap() of address zero
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (51 preceding siblings ...)
  2012-09-28 18:49 ` [ 052/262] ARM: clk-imx35: " Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 054/262] ALSA: hda - Fix missing Master volume for STAC9200/925x Greg Kroah-Hartman
                   ` (208 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Murali Nalajala, Nicolas Pitre, Russell King

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Russell King <rmk+kernel@arm.linux.org.uk>

commit a849088aa1552b1a28eea3daff599ee22a734ae3 upstream.

Murali Nalajala reports a regression that ioremapping address zero
results in an oops dump:

Unable to handle kernel paging request at virtual address fa200000
pgd = d4f80000
[fa200000] *pgd=00000000
Internal error: Oops: 5 [#1] PREEMPT SMP ARM
Modules linked in:
CPU: 0    Tainted: G        W (3.4.0-g3b5f728-00009-g638207a #13)
PC is at msm_pm_config_rst_vector_before_pc+0x8/0x30
LR is at msm_pm_boot_config_before_pc+0x18/0x20
pc : [<c0078f84>]    lr : [<c007903c>]    psr: a0000093
sp : c0837ef0  ip : cfe00000  fp : 0000000d
r10: da7efc17  r9 : 225c4278  r8 : 00000006
r7 : 0003c000  r6 : c085c824  r5 : 00000001  r4 : fa101000
r3 : fa200000  r2 : c095080c  r1 : 002250fc  r0 : 00000000
Flags: NzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM Segment kernel
Control: 10c5387d  Table: 25180059  DAC: 00000015
[<c0078f84>] (msm_pm_config_rst_vector_before_pc+0x8/0x30) from [<c007903c>] (msm_pm_boot_config_before_pc+0x18/0x20)
[<c007903c>] (msm_pm_boot_config_before_pc+0x18/0x20) from [<c007a55c>] (msm_pm_power_collapse+0x410/0xb04)
[<c007a55c>] (msm_pm_power_collapse+0x410/0xb04) from [<c007b17c>] (arch_idle+0x294/0x3e0)
[<c007b17c>] (arch_idle+0x294/0x3e0) from [<c000eed8>] (default_idle+0x18/0x2c)
[<c000eed8>] (default_idle+0x18/0x2c) from [<c000f254>] (cpu_idle+0x90/0xe4)
[<c000f254>] (cpu_idle+0x90/0xe4) from [<c057231c>] (rest_init+0x88/0xa0)
[<c057231c>] (rest_init+0x88/0xa0) from [<c07ff890>] (start_kernel+0x3a8/0x40c)
Code: c0704256 e12fff1e e59f2020 e5923000 (e5930000)

This is caused by the 'reserved' entries which we insert (see
19b52abe3c5d7 - ARM: 7438/1: fill possible PMD empty section gaps)
which get matched for physical address zero.

Resolve this by marking these reserved entries with a different flag.

Tested-by: Murali Nalajala <mnalajal@codeaurora.org>
Acked-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/mm/mm.h  |    3 +++
 arch/arm/mm/mmu.c |    4 ++--
 2 files changed, 5 insertions(+), 2 deletions(-)

--- a/arch/arm/mm/mm.h
+++ b/arch/arm/mm/mm.h
@@ -55,6 +55,9 @@ extern void __flush_dcache_page(struct a
 /* permanent static mappings from iotable_init() */
 #define VM_ARM_STATIC_MAPPING	0x40000000
 
+/* empty mapping */
+#define VM_ARM_EMPTY_MAPPING	0x20000000
+
 /* mapping type (attributes) for permanent static mappings */
 #define VM_ARM_MTYPE(mt)		((mt) << 20)
 #define VM_ARM_MTYPE_MASK	(0x1f << 20)
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -813,7 +813,7 @@ static void __init pmd_empty_section_gap
 	vm = early_alloc_aligned(sizeof(*vm), __alignof__(*vm));
 	vm->addr = (void *)addr;
 	vm->size = SECTION_SIZE;
-	vm->flags = VM_IOREMAP | VM_ARM_STATIC_MAPPING;
+	vm->flags = VM_IOREMAP | VM_ARM_EMPTY_MAPPING;
 	vm->caller = pmd_empty_section_gap;
 	vm_area_add_early(vm);
 }
@@ -826,7 +826,7 @@ static void __init fill_pmd_gaps(void)
 
 	/* we're still single threaded hence no lock needed here */
 	for (vm = vmlist; vm; vm = vm->next) {
-		if (!(vm->flags & VM_ARM_STATIC_MAPPING))
+		if (!(vm->flags & (VM_ARM_STATIC_MAPPING | VM_ARM_EMPTY_MAPPING)))
 			continue;
 		addr = (unsigned long)vm->addr;
 		if (addr < next)



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 054/262] ALSA: hda - Fix missing Master volume for STAC9200/925x
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (52 preceding siblings ...)
  2012-09-28 18:49 ` [ 053/262] ARM: Fix ioremap() of address zero Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 055/262] ALSA: usb-audio: Fix bogus error messages for delay accounting Greg Kroah-Hartman
                   ` (207 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Andrew Shadura, Takashi Iwai

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit ab548d2dba63ba947287965e525cc02a15d9853d upstream.

With the commit [2faa3bf: ALSA: hda - Rewrite the mute-LED hook with
vmaster hook in patch_sigmatel.c], the former Master volume control
was converted to PCM.  This was supposed to be covered by the vmaster
control.  But due to the lack of "PCM" slave definition, this didn't
happen properly.  The patch fixes the missing entry.

Reported-by: Andrew Shadura <bugzilla@tut.by>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_sigmatel.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -1075,7 +1075,7 @@ static struct snd_kcontrol_new stac_smux
 
 static const char * const slave_pfxs[] = {
 	"Front", "Surround", "Center", "LFE", "Side",
-	"Headphone", "Speaker", "IEC958",
+	"Headphone", "Speaker", "IEC958", "PCM",
 	NULL
 };
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 055/262] ALSA: usb-audio: Fix bogus error messages for delay accounting
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (53 preceding siblings ...)
  2012-09-28 18:49 ` [ 054/262] ALSA: hda - Fix missing Master volume for STAC9200/925x Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 056/262] ALSA: hda - Fix Oops at codec reset/reconfig Greg Kroah-Hartman
                   ` (206 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Markus Trippelsdorf, Takashi Iwai

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit 1213a205f9ed27d97de3d5bed28fb085ef4853e2 upstream.

The recent fix for the missing fine delayed time adjustment gives
strange error messages at each start of the playback stream, such as
  delay: estimated 0, actual 352
  delay: estimated 353, actual 705

These come from the sanity check in retire_playback_urb().  Before the
stream is activated via start_endpoints(), a few silent packets have
been already sent.  And at this point the delay account is still in
the state as if the new packets are just queued, so the driver gets
confused and spews the bogus error messages.

For fixing the issue, we just need to check whether the received
packet is valid, whether it's zero sized or not.

Reported-by: Markus Trippelsdorf <markus@trippelsdorf.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/usb/pcm.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -1140,6 +1140,12 @@ static void retire_playback_urb(struct s
 	int processed = urb->transfer_buffer_length / stride;
 	int est_delay;
 
+	/* ignore the delay accounting when procssed=0 is given, i.e.
+	 * silent payloads are procssed before handling the actual data
+	 */
+	if (!processed)
+		return;
+
 	spin_lock_irqsave(&subs->lock, flags);
 	est_delay = snd_usb_pcm_delay(subs, runtime->rate);
 	/* update delay with exact number of samples played */



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 056/262] ALSA: hda - Fix Oops at codec reset/reconfig
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (54 preceding siblings ...)
  2012-09-28 18:49 ` [ 055/262] ALSA: usb-audio: Fix bogus error messages for delay accounting Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 057/262] ALSA: ice1724: Use linear scale for AK4396 volume control Greg Kroah-Hartman
                   ` (205 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Daniel J Blueman, Takashi Iwai

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit 07dc59f0988cb54fd87bd373b3b27eb2401dd811 upstream.

snd_hda_codec_reset() calls restore_pincfgs() where the codec is
powered up again, which eventually tries to resume and initialize via
the callbacks of the codec.  However, it's the place just after codec
free callback, thus no codec callbacks should be called after that.
On a codec like CS4206, it results in Oops due to the access in init
callback.

This patch fixes the issue by clearing the codec callbacks properly
after freeing codec.

Reported-by: Daniel J Blueman <daniel@quora.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/hda_codec.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -2325,6 +2325,7 @@ int snd_hda_codec_reset(struct hda_codec
 	}
 	if (codec->patch_ops.free)
 		codec->patch_ops.free(codec);
+	memset(&codec->patch_ops, 0, sizeof(codec->patch_ops));
 	snd_hda_jack_tbl_clear(codec);
 	codec->proc_widget_hook = NULL;
 	codec->spec = NULL;
@@ -2340,7 +2341,6 @@ int snd_hda_codec_reset(struct hda_codec
 	codec->num_pcms = 0;
 	codec->pcm_info = NULL;
 	codec->preset = NULL;
-	memset(&codec->patch_ops, 0, sizeof(codec->patch_ops));
 	codec->slave_dig_outs = NULL;
 	codec->spdif_status_reset = 0;
 	module_put(codec->owner);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 057/262] ALSA: ice1724: Use linear scale for AK4396 volume control.
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (55 preceding siblings ...)
  2012-09-28 18:49 ` [ 056/262] ALSA: hda - Fix Oops at codec reset/reconfig Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 058/262] ALSA: hda - Workaround for silent output on VAIO Z with ALC889 Greg Kroah-Hartman
                   ` (204 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Matteo Frigo, Takashi Iwai

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Matteo Frigo <athena@fftw.org>

commit 3737e2be505d872bf2b3c1cd4151b2d2b413d7b5 upstream.

The AK4396 DAC has a linear-scale attentuator, but
sound/pci/ice1712/prodigy_hifi.c used a log scale instead, which is
not quite right.  This patch restores the correct scale, borrowing
from the ak4396 code in sound/pci/oxygen/oxygen.c.

Signed-off-by: Matteo Frigo <athena@fftw.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/ice1712/prodigy_hifi.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/sound/pci/ice1712/prodigy_hifi.c
+++ b/sound/pci/ice1712/prodigy_hifi.c
@@ -297,6 +297,7 @@ static int ak4396_dac_vol_put(struct snd
 }
 
 static const DECLARE_TLV_DB_SCALE(db_scale_wm_dac, -12700, 100, 1);
+static const DECLARE_TLV_DB_LINEAR(ak4396_db_scale, TLV_DB_GAIN_MUTE, 0);
 
 static struct snd_kcontrol_new prodigy_hd2_controls[] __devinitdata = {
     {
@@ -307,7 +308,7 @@ static struct snd_kcontrol_new prodigy_h
 	.info = ak4396_dac_vol_info,
 	.get = ak4396_dac_vol_get,
 	.put = ak4396_dac_vol_put,
-	.tlv = { .p = db_scale_wm_dac },
+	.tlv = { .p = ak4396_db_scale },
     },
 };
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 058/262] ALSA: hda - Workaround for silent output on VAIO Z with ALC889
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (56 preceding siblings ...)
  2012-09-28 18:49 ` [ 057/262] ALSA: ice1724: Use linear scale for AK4396 volume control Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 059/262] Staging: speakup: fix an improperly-declared variable Greg Kroah-Hartman
                   ` (203 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Adam Williamson, Takashi Iwai

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit e427c2375646789ecd0ccaef1a1e41458559ab2d upstream.

On recent kernels, Realtek codec parser tries to optimize the routing
aggressively and take the headphone output as primary at first.  This
caused a regression on VAIO Z with ALC889, the silent output from the
speaker.

The problem seems that the speaker pin must be connected to the first
DAC (0x02) on this machine by some reason although the codec itself
advertises the flexible routing with any DACs.

This patch adds a fix-up for choosing the speaker pin as the primary
so that the right DAC is assigned on this device.

Reported-and-tested-by: Adam Williamson <awilliam@redhat.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

---
 Documentation/sound/alsa/HD-Audio-Models.txt |    1 +
 sound/pci/hda/patch_realtek.c                |   22 +++++++++++++++++++++-
 2 files changed, 22 insertions(+), 1 deletion(-)

--- a/Documentation/sound/alsa/HD-Audio-Models.txt
+++ b/Documentation/sound/alsa/HD-Audio-Models.txt
@@ -47,6 +47,7 @@ ALC882/883/885/888/889
   acer-aspire-4930g	Acer Aspire 4930G/5930G/6530G/6930G/7730G
   acer-aspire-8930g	Acer Aspire 8330G/6935G
   acer-aspire		Acer Aspire others
+  no-primary-hp		VAIO Z workaround (for fixed speaker DAC)
 
 ALC861/660
 ==========
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -201,6 +201,7 @@ struct alc_spec {
 	unsigned int vol_in_capsrc:1; /* use capsrc volume (ADC has no vol) */
 	unsigned int parse_flags; /* passed to snd_hda_parse_pin_defcfg() */
 	unsigned int shared_mic_hp:1; /* HP/Mic-in sharing */
+	unsigned int no_primary_hp:1; /* Don't prefer HP pins to speaker pins */
 
 	/* auto-mute control */
 	int automute_mode;
@@ -4182,7 +4183,8 @@ static int alc_parse_auto_config(struct
 		return 0; /* can't find valid BIOS pin config */
 	}
 
-	if (cfg->line_out_type == AUTO_PIN_SPEAKER_OUT &&
+	if (!spec->no_primary_hp &&
+	    cfg->line_out_type == AUTO_PIN_SPEAKER_OUT &&
 	    cfg->line_outs <= cfg->hp_outs) {
 		/* use HP as primary out */
 		cfg->speaker_outs = cfg->line_outs;
@@ -4909,6 +4911,7 @@ enum {
 	ALC889_FIXUP_DAC_ROUTE,
 	ALC889_FIXUP_MBP_VREF,
 	ALC889_FIXUP_IMAC91_VREF,
+	ALC882_FIXUP_NO_PRIMARY_HP,
 };
 
 static void alc889_fixup_coef(struct hda_codec *codec,
@@ -5030,6 +5033,17 @@ static void alc889_fixup_imac91_vref(str
 	spec->keep_vref_in_automute = 1;
 }
 
+/* Don't take HP output as primary
+ * strangely, the speaker output doesn't work on VAIO Z through DAC 0x05
+ */
+static void alc882_fixup_no_primary_hp(struct hda_codec *codec,
+				       const struct alc_fixup *fix, int action)
+{
+	struct alc_spec *spec = codec->spec;
+	if (action == ALC_FIXUP_ACT_PRE_PROBE)
+		spec->no_primary_hp = 1;
+}
+
 static const struct alc_fixup alc882_fixups[] = {
 	[ALC882_FIXUP_ABIT_AW9D_MAX] = {
 		.type = ALC_FIXUP_PINS,
@@ -5212,6 +5226,10 @@ static const struct alc_fixup alc882_fix
 		.chained = true,
 		.chain_id = ALC882_FIXUP_GPIO1,
 	},
+	[ALC882_FIXUP_NO_PRIMARY_HP] = {
+		.type = ALC_FIXUP_FUNC,
+		.v.func = alc882_fixup_no_primary_hp,
+	},
 };
 
 static const struct snd_pci_quirk alc882_fixup_tbl[] = {
@@ -5246,6 +5264,7 @@ static const struct snd_pci_quirk alc882
 	SND_PCI_QUIRK(0x1043, 0x1971, "Asus W2JC", ALC882_FIXUP_ASUS_W2JC),
 	SND_PCI_QUIRK(0x1043, 0x835f, "Asus Eee 1601", ALC888_FIXUP_EEE1601),
 	SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT),
+	SND_PCI_QUIRK(0x104d, 0x905a, "Sony Vaio Z", ALC882_FIXUP_NO_PRIMARY_HP),
 
 	/* All Apple entries are in codec SSIDs */
 	SND_PCI_QUIRK(0x106b, 0x00a0, "MacBookPro 3,1", ALC889_FIXUP_MBP_VREF),
@@ -5286,6 +5305,7 @@ static const struct alc_model_fixup alc8
 	{.id = ALC882_FIXUP_ACER_ASPIRE_4930G, .name = "acer-aspire-4930g"},
 	{.id = ALC882_FIXUP_ACER_ASPIRE_8930G, .name = "acer-aspire-8930g"},
 	{.id = ALC883_FIXUP_ACER_EAPD, .name = "acer-aspire"},
+	{.id = ALC882_FIXUP_NO_PRIMARY_HP, .name = "no-primary-hp"},
 	{}
 };
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 059/262] Staging: speakup: fix an improperly-declared variable.
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (57 preceding siblings ...)
  2012-09-28 18:49 ` [ 058/262] ALSA: hda - Workaround for silent output on VAIO Z with ALC889 Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 060/262] staging: zcache: fix cleancache race condition with shrinker Greg Kroah-Hartman
                   ` (202 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Christopher Brannon

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Christopher Brannon <chris@the-brannons.com>

commit 4ea418b8b2fa8a70d0fcc8231b65e67b3a72984b upstream.

A local static variable was declared as a pointer to a string
constant.  We're assigning to the underlying memory, so it
needs to be an array instead.

Signed-off-by: Christopher Brannon <chris@the-brannons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/speakup/main.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/staging/speakup/main.c
+++ b/drivers/staging/speakup/main.c
@@ -1854,7 +1854,7 @@ static void speakup_bits(struct vc_data
 
 static int handle_goto(struct vc_data *vc, u_char type, u_char ch, u_short key)
 {
-	static u_char *goto_buf = "\0\0\0\0\0\0";
+	static u_char goto_buf[8];
 	static int num;
 	int maxlen, go_pos;
 	char *cp;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 060/262] staging: zcache: fix cleancache race condition with shrinker
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (58 preceding siblings ...)
  2012-09-28 18:49 ` [ 059/262] Staging: speakup: fix an improperly-declared variable Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 061/262] staging: vt6656: [BUG] - Failed connection, incorrect endian Greg Kroah-Hartman
                   ` (201 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Seth Jennings, Konrad Rzeszutek Wilk, Minchan Kim

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Seth Jennings <sjenning@linux.vnet.ibm.com>

commit 6d7d9798ad5c97ee4e911dd070dc12dc5ae55bd0 upstream.

This patch fixes a race condition that results in memory
corruption when using cleancache.

The race exists between the zcache shrinker handler,
shrink_zcache_memory() and cleancache_get_page().

In most cases, the shrinker will both evict a zbpg
from its buddy list and flush it from tmem before a
cleancache_get_page() occurs on that page. A subsequent
cleancache_get_page() will fail in the tmem layer.

In the rare case that two occur together and the
cleancache_get_page() path gets through the tmem
layer before the shrinker path can flush tmem,
zbud_decompress() does a check to see if the zbpg is a
"zombie", i.e. not on a buddy list, which means the shrinker
is in the process of reclaiming it. If the zbpg is a zombie,
zbud_decompress() returns -EINVAL.

However, this return code is being ignored by the caller,
zcache_pampd_get_data_and_free(), which results in the
caller of cleancache_get_page() thinking that the page has
been properly retrieved when it has not.

This patch modifies zcache_pampd_get_data_and_free() to
convey the failure up the stack so that the caller of
cleancache_get_page() knows the page retrieval failed.

This needs to be applied to stable trees as well.
zcache-main.c was named zcache.c before v3.1, so
I'm not sure how you want to handle trees earlier
than that.

Signed-off-by: Seth Jennings <sjenning@linux.vnet.ibm.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Reviewed-by: Minchan Kim <minchan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/zcache/zcache-main.c |    7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

--- a/drivers/staging/zcache/zcache-main.c
+++ b/drivers/staging/zcache/zcache-main.c
@@ -1259,13 +1259,12 @@ static int zcache_pampd_get_data_and_fre
 					void *pampd, struct tmem_pool *pool,
 					struct tmem_oid *oid, uint32_t index)
 {
-	int ret = 0;
-
 	BUG_ON(!is_ephemeral(pool));
-	zbud_decompress((struct page *)(data), pampd);
+	if (zbud_decompress((struct page *)(data), pampd) < 0)
+		return -EINVAL;
 	zbud_free_and_delist((struct zbud_hdr *)pampd);
 	atomic_dec(&zcache_curr_eph_pampd_count);
-	return ret;
+	return 0;
 }
 
 /*



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 061/262] staging: vt6656: [BUG] - Failed connection, incorrect endian.
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (59 preceding siblings ...)
  2012-09-28 18:49 ` [ 060/262] staging: zcache: fix cleancache race condition with shrinker Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 062/262] staging: r8712u: fix bug in r8712_recv_indicatepkt() Greg Kroah-Hartman
                   ` (200 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Malcolm Priestley

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Malcolm Priestley <tvboxspy@gmail.com>

commit aa209eef3ce8419ff2926c2fa944dfbfb5afbacb upstream.

Hi,

This patch fixes a bug with driver failing to negotiate a connection.

The bug was traced to commit
203e4615ee9d9fa8d3506b9d0ef30095e4d5bc90
staging: vt6656: removed custom definitions of Ethernet packet types

In that patch, definitions in include/linux/if_ether.h replaced ones
in tether.h which had both big and little endian definitions.

include/linux/if_ether.h only refers to big endian values, cpu_to_be16
should be used for the correct endian architectures.

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/vt6656/dpc.c  |    2 +-
 drivers/staging/vt6656/rxtx.c |   38 +++++++++++++++++++-------------------
 2 files changed, 20 insertions(+), 20 deletions(-)

--- a/drivers/staging/vt6656/dpc.c
+++ b/drivers/staging/vt6656/dpc.c
@@ -200,7 +200,7 @@ s_vProcessRxMACHeader (
     } else if (!compare_ether_addr(pbyRxBuffer, &pDevice->abySNAP_RFC1042[0])) {
         cbHeaderSize += 6;
         pwType = (PWORD) (pbyRxBufferAddr + cbHeaderSize);
-	if ((*pwType == cpu_to_le16(ETH_P_IPX)) ||
+	if ((*pwType == cpu_to_be16(ETH_P_IPX)) ||
 	    (*pwType == cpu_to_le16(0xF380))) {
 		cbHeaderSize -= 8;
             pwType = (PWORD) (pbyRxBufferAddr + cbHeaderSize);
--- a/drivers/staging/vt6656/rxtx.c
+++ b/drivers/staging/vt6656/rxtx.c
@@ -1701,7 +1701,7 @@ s_bPacketToWirelessUsb(
     // 802.1H
     if (ntohs(psEthHeader->wType) > ETH_DATA_LEN) {
 	if (pDevice->dwDiagRefCount == 0) {
-		if ((psEthHeader->wType == cpu_to_le16(ETH_P_IPX)) ||
+		if ((psEthHeader->wType == cpu_to_be16(ETH_P_IPX)) ||
 		    (psEthHeader->wType == cpu_to_le16(0xF380))) {
 			memcpy((PBYTE) (pbyPayloadHead),
 			       abySNAP_Bridgetunnel, 6);
@@ -2840,10 +2840,10 @@ int nsDMA_tx_packet(PSDevice pDevice, un
     Packet_Type = skb->data[ETH_HLEN+1];
     Descriptor_type = skb->data[ETH_HLEN+1+1+2];
     Key_info = (skb->data[ETH_HLEN+1+1+2+1] << 8)|(skb->data[ETH_HLEN+1+1+2+2]);
-    if (pDevice->sTxEthHeader.wType == cpu_to_le16(ETH_P_PAE)) {
-	/* 802.1x OR eapol-key challenge frame transfer */
-	if (((Protocol_Version == 1) || (Protocol_Version == 2)) &&
-		(Packet_Type == 3)) {
+	if (pDevice->sTxEthHeader.wType == cpu_to_be16(ETH_P_PAE)) {
+		/* 802.1x OR eapol-key challenge frame transfer */
+		if (((Protocol_Version == 1) || (Protocol_Version == 2)) &&
+			(Packet_Type == 3)) {
                         bTxeapol_key = TRUE;
                        if(!(Key_info & BIT3) &&  //WPA or RSN group-key challenge
 			   (Key_info & BIT8) && (Key_info & BIT9)) {    //send 2/2 key
@@ -2989,19 +2989,19 @@ int nsDMA_tx_packet(PSDevice pDevice, un
         }
     }
 
-    if (pDevice->sTxEthHeader.wType == cpu_to_le16(ETH_P_PAE)) {
-        if (pDevice->byBBType != BB_TYPE_11A) {
-            pDevice->wCurrentRate = RATE_1M;
-            pDevice->byACKRate = RATE_1M;
-            pDevice->byTopCCKBasicRate = RATE_1M;
-            pDevice->byTopOFDMBasicRate = RATE_6M;
-        } else {
-            pDevice->wCurrentRate = RATE_6M;
-            pDevice->byACKRate = RATE_6M;
-            pDevice->byTopCCKBasicRate = RATE_1M;
-            pDevice->byTopOFDMBasicRate = RATE_6M;
-        }
-    }
+	if (pDevice->sTxEthHeader.wType == cpu_to_be16(ETH_P_PAE)) {
+		if (pDevice->byBBType != BB_TYPE_11A) {
+			pDevice->wCurrentRate = RATE_1M;
+			pDevice->byACKRate = RATE_1M;
+			pDevice->byTopCCKBasicRate = RATE_1M;
+			pDevice->byTopOFDMBasicRate = RATE_6M;
+		} else {
+			pDevice->wCurrentRate = RATE_6M;
+			pDevice->byACKRate = RATE_6M;
+			pDevice->byTopCCKBasicRate = RATE_1M;
+			pDevice->byTopOFDMBasicRate = RATE_6M;
+		}
+	}
 
     DBG_PRT(MSG_LEVEL_DEBUG,
 	    KERN_INFO "dma_tx: pDevice->wCurrentRate = %d\n",
@@ -3017,7 +3017,7 @@ int nsDMA_tx_packet(PSDevice pDevice, un
 
     if (bNeedEncryption == TRUE) {
         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ntohs Pkt Type=%04x\n", ntohs(pDevice->sTxEthHeader.wType));
-	if ((pDevice->sTxEthHeader.wType) == cpu_to_le16(ETH_P_PAE)) {
+	if ((pDevice->sTxEthHeader.wType) == cpu_to_be16(ETH_P_PAE)) {
 		bNeedEncryption = FALSE;
             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Pkt Type=%04x\n", (pDevice->sTxEthHeader.wType));
             if ((pMgmt->eCurrMode == WMAC_MODE_ESS_STA) && (pMgmt->eCurrState == WMAC_STATE_ASSOC)) {



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 062/262] staging: r8712u: fix bug in r8712_recv_indicatepkt()
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (60 preceding siblings ...)
  2012-09-28 18:49 ` [ 061/262] staging: vt6656: [BUG] - Failed connection, incorrect endian Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 063/262] staging: comedi: amplc_pci224: Fix PCI ref count Greg Kroah-Hartman
                   ` (199 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Eric Dumazet, Dave Jones, Larry Finger

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <edumazet@google.com>

commit abf02cfc179bb4bd30d05f582d61b3b8f429b813 upstream.

64bit arches have a buggy r8712u driver, let's fix it.

skb->tail must be set properly or network stack behavior is undefined.

Addresses https://bugzilla.redhat.com/show_bug.cgi?id=847525
Addresses https://bugzilla.kernel.org/show_bug.cgi?id=45071

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Dave Jones <davej@redhat.com>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/rtl8712/recv_linux.c |    7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

--- a/drivers/staging/rtl8712/recv_linux.c
+++ b/drivers/staging/rtl8712/recv_linux.c
@@ -117,13 +117,8 @@ void r8712_recv_indicatepkt(struct _adap
 	if (skb == NULL)
 		goto _recv_indicatepkt_drop;
 	skb->data = precv_frame->u.hdr.rx_data;
-#ifdef NET_SKBUFF_DATA_USES_OFFSET
-	skb->tail = (sk_buff_data_t)(precv_frame->u.hdr.rx_tail -
-		     precv_frame->u.hdr.rx_head);
-#else
-	skb->tail = (sk_buff_data_t)precv_frame->u.hdr.rx_tail;
-#endif
 	skb->len = precv_frame->u.hdr.len;
+	skb_set_tail_pointer(skb, skb->len);
 	if ((pattrib->tcpchk_valid == 1) && (pattrib->tcp_chkrpt == 1))
 		skb->ip_summed = CHECKSUM_UNNECESSARY;
 	else



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 063/262] staging: comedi: amplc_pci224: Fix PCI ref count
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (61 preceding siblings ...)
  2012-09-28 18:49 ` [ 062/262] staging: r8712u: fix bug in r8712_recv_indicatepkt() Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 064/262] staging: comedi: das08: Correct AO output for das08jr-16-ao Greg Kroah-Hartman
                   ` (198 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Ian Abbott

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ian Abbott <abbotti@mev.co.uk>

commit cadf84bfeb80e216fde328d357fe856160157d2c upstream.

When attaching a PCI device manually via the comedi driver `attach` hook
(`pci224_attach()`) (called by the comedi core for the
`COMEDI_DEVCONFIG` ioctl), its reference count is incremented in the
`for_each_pci_dev` loop (in `pci224_find_pci_dev()`).  It is decremented
when the `detach` hook (`pci224_detach()`) is called to detach the
device.  However, when the PCI device is attached automatically via the
`attach_pci` hook (`pci224_attach_pci()`, called at probe time via
`comedi_pci_auto_config()`) it's reference count is not incremented so
there will be an unmatched decrement when detaching the device.

Increment the PCI device reference count in `pci224_attach_pci()` to
correct the mismatch.

Once support for manual configuration has been removed from this driver,
the calls to `pci_dev_get()` and `pci_dev_put()` can be removed.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/comedi/drivers/amplc_pci224.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/staging/comedi/drivers/amplc_pci224.c
+++ b/drivers/staging/comedi/drivers/amplc_pci224.c
@@ -1519,6 +1519,13 @@ pci224_attach_pci(struct comedi_device *
 		       dev->minor, DRIVER_NAME);
 		return -EINVAL;
 	}
+	/*
+	 * Need to 'get' the PCI device to match the 'put' in pci224_detach().
+	 * TODO: Remove the pci_dev_get() and matching pci_dev_put() once
+	 * support for manual attachment of PCI devices via pci224_attach()
+	 * has been removed.
+	 */
+	pci_dev_get(pci_dev);
 	return pci224_attach_common(dev, pci_dev, NULL);
 }
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 064/262] staging: comedi: das08: Correct AO output for das08jr-16-ao
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (62 preceding siblings ...)
  2012-09-28 18:49 ` [ 063/262] staging: comedi: amplc_pci224: Fix PCI ref count Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 065/262] staging: comedi: das08: Correct AI encoding " Greg Kroah-Hartman
                   ` (197 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Ian Abbott

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ian Abbott <abbotti@mev.co.uk>

commit 61ed59ed09e6ad2b8395178ea5ad5f653bba08e3 upstream.

Don't zero out bits 15..12 of the data value in `das08jr_ao_winsn()` as
that knobbles the upper three-quarters of the output range for the
'das08jr-16-ao' board.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/comedi/drivers/das08.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/staging/comedi/drivers/das08.c
+++ b/drivers/staging/comedi/drivers/das08.c
@@ -678,7 +678,7 @@ static int das08jr_ao_winsn(struct comed
 	int chan;
 
 	lsb = data[0] & 0xff;
-	msb = (data[0] >> 8) & 0xf;
+	msb = (data[0] >> 8) & 0xff;
 
 	chan = CR_CHAN(insn->chanspec);
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 065/262] staging: comedi: das08: Correct AI encoding for das08jr-16-ao
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (63 preceding siblings ...)
  2012-09-28 18:49 ` [ 064/262] staging: comedi: das08: Correct AO output for das08jr-16-ao Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 066/262] USB: option: replace ZTE K5006-Z entry with vendor class rule Greg Kroah-Hartman
                   ` (196 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Ian Abbott

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ian Abbott <abbotti@mev.co.uk>

commit e6391a182865efc896cb2a8d79e07b7ac2f45b48 upstream.

The element of `das08_boards[]` for the 'das08jr-16-ao' board has the
`ai_encoding` member set to `das08_encode12`.  It should be set to
`das08_encode16` same as the 'das08jr/16' board.  After all, this board
has 16-bit AI resolution.

The description of the A/D LSB register at offset 0 seems incorrect in
the user manual "cio-das08jr-16-ao.pdf" as it implies that the AI
resolution is only 12 bits.  The diagrams of the A/D LSB and MSB
registers show 15 data bits and a sign bit, which matches what the
software expects for the `das08_encode16` AI encoding method.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/comedi/drivers/das08.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/staging/comedi/drivers/das08.c
+++ b/drivers/staging/comedi/drivers/das08.c
@@ -403,7 +403,7 @@ static const struct das08_board_struct d
 	 .ai = das08_ai_rinsn,
 	 .ai_nbits = 16,
 	 .ai_pg = das08_pg_none,
-	 .ai_encoding = das08_encode12,
+	 .ai_encoding = das08_encode16,
 	 .ao = das08jr_ao_winsn,
 	 .ao_nbits = 16,
 	 .di = das08jr_di_rbits,



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 066/262] USB: option: replace ZTE K5006-Z entry with vendor class rule
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (64 preceding siblings ...)
  2012-09-28 18:49 ` [ 065/262] staging: comedi: das08: Correct AI encoding " Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 067/262] fs/proc: fix potential unregister_sysctl_table hang Greg Kroah-Hartman
                   ` (195 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Thomas Schäfer, Bjørn Mork

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>

commit ba9edaa468869a8cea242a411066b0f490751798 upstream.

Fix the ZTE K5006-Z entry so that it actually matches anything

  commit f1b5c997 USB: option: add ZTE K5006-Z

added a device specific entry assuming that the device would use
class/subclass/proto == ff/ff/ff like other ZTE devices. It
turns out that ZTE has started using vendor specific subclass
and protocol codes:

T:  Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#=  4 Spd=480  MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=19d2 ProdID=1018 Rev= 0.00
S:  Manufacturer=ZTE,Incorporated
S:  Product=ZTE LTE Technologies MSM
S:  SerialNumber=MF821Vxxxxxxx
C:* #Ifs= 5 Cfg#= 1 Atr=c0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=86 Prot=10 Driver=(none)
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=02 Prot=05 Driver=(none)
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=02 Prot=01 Driver=(none)
E:  Ad=83(I) Atr=03(Int.) MxPS=  64 Ivl=2ms
E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=06 Prot=00 Driver=qmi_wwan
E:  Ad=85(I) Atr=03(Int.) MxPS=  64 Ivl=2ms
E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
I:* If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms

We do not have any information on how ZTE intend to use these
codes, but let us assume for now that the 3 sets matching
serial functions in the K5006-Z always will identify a serial
function in a ZTE device.

Cc: Thomas Schäfer <tschaefer@t-online.de>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/option.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -886,8 +886,6 @@ static const struct usb_device_id option
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff),
 	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff) },
-	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1018, 0xff, 0xff, 0xff),
-	  .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1057, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1058, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1059, 0xff, 0xff, 0xff) },
@@ -1092,6 +1090,10 @@ static const struct usb_device_id option
 	 .driver_info = (kernel_ulong_t)&zte_ad3812_z_blacklist },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2716, 0xff, 0xff, 0xff),
 	 .driver_info = (kernel_ulong_t)&zte_mc2716_z_blacklist },
+	{ USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) },
+	{ USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) },
+	{ USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) },
+
 	{ USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
 	{ USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
 	{ USB_DEVICE(ALINK_VENDOR_ID, DLINK_PRODUCT_DWM_652_U5) }, /* Yes, ALINK_VENDOR_ID */



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 067/262] fs/proc: fix potential unregister_sysctl_table hang
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (65 preceding siblings ...)
  2012-09-28 18:49 ` [ 066/262] USB: option: replace ZTE K5006-Z entry with vendor class rule Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 068/262] sound: tegra_alc5632: remove HP detect GPIO inversion Greg Kroah-Hartman
                   ` (194 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Francesco Ruggeri, Linus Torvalds

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Francesco Ruggeri <fruggeri@aristanetworks.com>

commit 6bf6104573482570f7103d3e5ddf9574db43a363 upstream.

The unregister_sysctl_table() function hangs if all references to its
ctl_table_header structure are not dropped.

This can happen sometimes because of a leak in proc_sys_lookup():
proc_sys_lookup() gets a reference to the table via lookup_entry(), but
it does not release it when a subsequent call to sysctl_follow_link()
fails.

This patch fixes this leak by making sure the reference is always
dropped on return.

See also commit 076c3eed2c31 ("sysctl: Rewrite proc_sys_lookup
introducing find_entry and lookup_entry") which reorganized this code in
3.4.

Tested in Linux 3.4.4.

Signed-off-by: Francesco Ruggeri <fruggeri@aristanetworks.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/proc/proc_sysctl.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -462,9 +462,6 @@ static struct dentry *proc_sys_lookup(st
 
 	err = ERR_PTR(-ENOMEM);
 	inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
-	if (h)
-		sysctl_head_finish(h);
-
 	if (!inode)
 		goto out;
 
@@ -473,6 +470,8 @@ static struct dentry *proc_sys_lookup(st
 	d_add(dentry, inode);
 
 out:
+	if (h)
+		sysctl_head_finish(h);
 	sysctl_head_finish(head);
 	return err;
 }



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 068/262] sound: tegra_alc5632: remove HP detect GPIO inversion
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (66 preceding siblings ...)
  2012-09-28 18:49 ` [ 067/262] fs/proc: fix potential unregister_sysctl_table hang Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 069/262] perf_event: Switch to internal refcount, fix race with close() Greg Kroah-Hartman
                   ` (193 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Stephen Warren, Andrey Danin, Mark Brown

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stephen Warren <swarren@nvidia.com>

commit c921928661eda599d73a6a86e58bdd5aecfa18cb upstream.

Both the schematics and practical testing show that the HP detect GPIO
is high when the headphones are plugged in. Hence, the snd_soc_jack_gpio
should not specify to invert the signal.

Signed-off-by: Stephen Warren <swarren@nvidia.com>
Acked-by: Andrey Danin <danindrey@mail.ru>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/soc/tegra/tegra_alc5632.c |    1 -
 1 file changed, 1 deletion(-)

--- a/sound/soc/tegra/tegra_alc5632.c
+++ b/sound/soc/tegra/tegra_alc5632.c
@@ -92,7 +92,6 @@ static struct snd_soc_jack_gpio tegra_al
 	.name = "Headset detection",
 	.report = SND_JACK_HEADSET,
 	.debounce_time = 150,
-	.invert = 1,
 };
 
 static const struct snd_soc_dapm_widget tegra_alc5632_dapm_widgets[] = {



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 069/262] perf_event: Switch to internal refcount, fix race with close()
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (67 preceding siblings ...)
  2012-09-28 18:49 ` [ 068/262] sound: tegra_alc5632: remove HP detect GPIO inversion Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:49 ` [ 070/262] ACPI / PM: Infer parent power state from child if unknown, v2 Greg Kroah-Hartman
                   ` (192 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Al Viro, Peter Zijlstra, Ingo Molnar

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Al Viro <viro@ZenIV.linux.org.uk>

commit a6fa941d94b411bbd2b6421ffbde6db3c93e65ab upstream.

Don't mess with file refcounts (or keep a reference to file, for
that matter) in perf_event.  Use explicit refcount of its own
instead.  Deal with the race between the final reference to event
going away and new children getting created for it by use of
atomic_long_inc_not_zero() in inherit_event(); just have the
latter free what it had allocated and return NULL, that works
out just fine (children of siblings of something doomed are
created as singletons, same as if the child of leader had been
created and immediately killed).

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Link: http://lkml.kernel.org/r/20120820135925.GG23464@ZenIV.linux.org.uk
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/perf_event.h |    2 -
 kernel/events/core.c       |   62 +++++++++++++++++++++++----------------------
 2 files changed, 34 insertions(+), 30 deletions(-)

--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -925,7 +925,7 @@ struct perf_event {
 	struct hw_perf_event		hw;
 
 	struct perf_event_context	*ctx;
-	struct file			*filp;
+	atomic_long_t			refcount;
 
 	/*
 	 * These accumulate total time (in nanoseconds) that children
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -2933,12 +2933,12 @@ EXPORT_SYMBOL_GPL(perf_event_release_ker
 /*
  * Called when the last reference to the file is gone.
  */
-static int perf_release(struct inode *inode, struct file *file)
+static void put_event(struct perf_event *event)
 {
-	struct perf_event *event = file->private_data;
 	struct task_struct *owner;
 
-	file->private_data = NULL;
+	if (!atomic_long_dec_and_test(&event->refcount))
+		return;
 
 	rcu_read_lock();
 	owner = ACCESS_ONCE(event->owner);
@@ -2973,7 +2973,13 @@ static int perf_release(struct inode *in
 		put_task_struct(owner);
 	}
 
-	return perf_event_release_kernel(event);
+	perf_event_release_kernel(event);
+}
+
+static int perf_release(struct inode *inode, struct file *file)
+{
+	put_event(file->private_data);
+	return 0;
 }
 
 u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running)
@@ -3225,7 +3231,7 @@ unlock:
 
 static const struct file_operations perf_fops;
 
-static struct perf_event *perf_fget_light(int fd, int *fput_needed)
+static struct file *perf_fget_light(int fd, int *fput_needed)
 {
 	struct file *file;
 
@@ -3239,7 +3245,7 @@ static struct perf_event *perf_fget_ligh
 		return ERR_PTR(-EBADF);
 	}
 
-	return file->private_data;
+	return file;
 }
 
 static int perf_event_set_output(struct perf_event *event,
@@ -3271,19 +3277,21 @@ static long perf_ioctl(struct file *file
 
 	case PERF_EVENT_IOC_SET_OUTPUT:
 	{
+		struct file *output_file = NULL;
 		struct perf_event *output_event = NULL;
 		int fput_needed = 0;
 		int ret;
 
 		if (arg != -1) {
-			output_event = perf_fget_light(arg, &fput_needed);
-			if (IS_ERR(output_event))
-				return PTR_ERR(output_event);
+			output_file = perf_fget_light(arg, &fput_needed);
+			if (IS_ERR(output_file))
+				return PTR_ERR(output_file);
+			output_event = output_file->private_data;
 		}
 
 		ret = perf_event_set_output(event, output_event);
 		if (output_event)
-			fput_light(output_event->filp, fput_needed);
+			fput_light(output_file, fput_needed);
 
 		return ret;
 	}
@@ -5922,6 +5930,7 @@ perf_event_alloc(struct perf_event_attr
 
 	mutex_init(&event->mmap_mutex);
 
+	atomic_long_set(&event->refcount, 1);
 	event->cpu		= cpu;
 	event->attr		= *attr;
 	event->group_leader	= group_leader;
@@ -6232,12 +6241,12 @@ SYSCALL_DEFINE5(perf_event_open,
 		return event_fd;
 
 	if (group_fd != -1) {
-		group_leader = perf_fget_light(group_fd, &fput_needed);
-		if (IS_ERR(group_leader)) {
-			err = PTR_ERR(group_leader);
+		group_file = perf_fget_light(group_fd, &fput_needed);
+		if (IS_ERR(group_file)) {
+			err = PTR_ERR(group_file);
 			goto err_fd;
 		}
-		group_file = group_leader->filp;
+		group_leader = group_file->private_data;
 		if (flags & PERF_FLAG_FD_OUTPUT)
 			output_event = group_leader;
 		if (flags & PERF_FLAG_FD_NO_GROUP)
@@ -6372,7 +6381,6 @@ SYSCALL_DEFINE5(perf_event_open,
 		put_ctx(gctx);
 	}
 
-	event->filp = event_file;
 	WARN_ON_ONCE(ctx->parent_ctx);
 	mutex_lock(&ctx->mutex);
 
@@ -6462,7 +6470,6 @@ perf_event_create_kernel_counter(struct
 		goto err_free;
 	}
 
-	event->filp = NULL;
 	WARN_ON_ONCE(ctx->parent_ctx);
 	mutex_lock(&ctx->mutex);
 	perf_install_in_context(ctx, event, cpu);
@@ -6511,7 +6518,7 @@ static void sync_child_event(struct perf
 	 * Release the parent event, if this was the last
 	 * reference to it.
 	 */
-	fput(parent_event->filp);
+	put_event(parent_event);
 }
 
 static void
@@ -6587,9 +6594,8 @@ static void perf_event_exit_task_context
 	 *
 	 *   __perf_event_exit_task()
 	 *     sync_child_event()
-	 *       fput(parent_event->filp)
-	 *         perf_release()
-	 *           mutex_lock(&ctx->mutex)
+	 *       put_event()
+	 *         mutex_lock(&ctx->mutex)
 	 *
 	 * But since its the parent context it won't be the same instance.
 	 */
@@ -6657,7 +6663,7 @@ static void perf_free_event(struct perf_
 	list_del_init(&event->child_list);
 	mutex_unlock(&parent->child_mutex);
 
-	fput(parent->filp);
+	put_event(parent);
 
 	perf_group_detach(event);
 	list_del_event(event, ctx);
@@ -6737,6 +6743,12 @@ inherit_event(struct perf_event *parent_
 				           NULL, NULL);
 	if (IS_ERR(child_event))
 		return child_event;
+
+	if (!atomic_long_inc_not_zero(&parent_event->refcount)) {
+		free_event(child_event);
+		return NULL;
+	}
+
 	get_ctx(child_ctx);
 
 	/*
@@ -6778,14 +6790,6 @@ inherit_event(struct perf_event *parent_
 	raw_spin_unlock_irqrestore(&child_ctx->lock, flags);
 
 	/*
-	 * Get a reference to the parent filp - we will fput it
-	 * when the child event exits. This is safe to do because
-	 * we are in the parent and we know that the filp still
-	 * exists and has a nonzero count:
-	 */
-	atomic_long_inc(&parent_event->filp->f_count);
-
-	/*
 	 * Link this into the parent event's child list
 	 */
 	WARN_ON_ONCE(parent_event->ctx->parent_ctx);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 070/262] ACPI / PM: Infer parent power state from child if unknown, v2
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (68 preceding siblings ...)
  2012-09-28 18:49 ` [ 069/262] perf_event: Switch to internal refcount, fix race with close() Greg Kroah-Hartman
@ 2012-09-28 18:49 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 071/262] ACPI / PM: Fix resource_lock dead lock in acpi_power_on_device Greg Kroah-Hartman
                   ` (191 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:49 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Aaron Lu, Rafael J. Wysocki

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Rafael J. Wysocki" <rjw@sisk.pl>

commit 8f7412a792bc989d1bddd3c802282eec09456d57 upstream.

It turns out that there are ACPI BIOSes defining device objects with
_PSx and without either _PSC or _PRx.  For devices corresponding to
those ACPI objetcs __acpi_bus_get_power() returns ACPI_STATE_UNKNOWN
and their initial power states are regarded as unknown as a result.
If such a device is a parent of another power-manageable device, the
child cannot be put into a low-power state through ACPI, because
__acpi_bus_set_power() refuses to change power states of devices
whose parents' power states are unknown.

To work around this problem, observe that the ACPI power state of
a device cannot be higher-power (lower-number) than the power state
of its parent.  Thus, if the device's _PSC method or the
configuration of its power resources indicates that the device is
in D0, the device's parent has to be in D0 as well.  Consequently,
if the parent's power state is unknown when we've just learned that
its child's power state is D0, we can safely set the parent's
power.state field to ACPI_STATE_D0.

Tested-by: Aaron Lu <aaron.lu@intel.com>
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/acpi/bus.c |   10 ++++++++++
 1 file changed, 10 insertions(+)

--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -237,6 +237,16 @@ static int __acpi_bus_get_power(struct a
 	} else if (result == ACPI_STATE_D3_HOT) {
 		result = ACPI_STATE_D3;
 	}
+
+	/*
+	 * If we were unsure about the device parent's power state up to this
+	 * point, the fact that the device is in D0 implies that the parent has
+	 * to be in D0 too.
+	 */
+	if (device->parent && device->parent->power.state == ACPI_STATE_UNKNOWN
+	    && result == ACPI_STATE_D0)
+		device->parent->power.state = ACPI_STATE_D0;
+
 	*state = result;
 
  out:



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 071/262] ACPI / PM: Fix resource_lock dead lock in acpi_power_on_device
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (69 preceding siblings ...)
  2012-09-28 18:49 ` [ 070/262] ACPI / PM: Infer parent power state from child if unknown, v2 Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 072/262] ACPI / PM: Use KERN_DEBUG when no power resources are found Greg Kroah-Hartman
                   ` (190 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Lin Ming, Aaron Lu, Rafael J. Wysocki

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lin Ming <ming.m.lin@intel.com>

commit 40bf66ec9791f1452b90b82aadc3b6e6aee201f5 upstream.

Commit 0090def("ACPI: Add interface to register/unregister device
to/from power resources") used resource_lock to protect the devices list
that relies on power resource. It caused a mutex dead lock, as below

    acpi_power_on ---> lock resource_lock
      __acpi_power_on
        acpi_power_on_device
          acpi_power_get_inferred_state
            acpi_power_get_list_state ---> lock resource_lock

This patch adds a new mutex "devices_lock" to protect the devices list
and calls acpi_power_on_device in acpi_power_on, instead of
__acpi_power_on, after the resource_lock is released.

[rjw: Changed data type of a boolean variable to bool.]

Signed-off-by: Lin Ming <ming.m.lin@intel.com>
Signed-off-by: Aaron Lu <aaron.lu@intel.com>
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/acpi/power.c |   34 +++++++++++++++++++++++-----------
 1 file changed, 23 insertions(+), 11 deletions(-)

--- a/drivers/acpi/power.c
+++ b/drivers/acpi/power.c
@@ -103,6 +103,7 @@ struct acpi_power_resource {
 
 	/* List of devices relying on this power resource */
 	struct acpi_power_resource_device *devices;
+	struct mutex devices_lock;
 };
 
 static struct list_head acpi_power_resource_list;
@@ -221,7 +222,6 @@ static void acpi_power_on_device(struct
 
 static int __acpi_power_on(struct acpi_power_resource *resource)
 {
-	struct acpi_power_resource_device *device_list = resource->devices;
 	acpi_status status = AE_OK;
 
 	status = acpi_evaluate_object(resource->device->handle, "_ON", NULL, NULL);
@@ -234,19 +234,15 @@ static int __acpi_power_on(struct acpi_p
 	ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Power resource [%s] turned on\n",
 			  resource->name));
 
-	while (device_list) {
-		acpi_power_on_device(device_list->device);
-
-		device_list = device_list->next;
-	}
-
 	return 0;
 }
 
 static int acpi_power_on(acpi_handle handle)
 {
 	int result = 0;
+	bool resume_device = false;
 	struct acpi_power_resource *resource = NULL;
+	struct acpi_power_resource_device *device_list;
 
 	result = acpi_power_get_context(handle, &resource);
 	if (result)
@@ -262,10 +258,25 @@ static int acpi_power_on(acpi_handle han
 		result = __acpi_power_on(resource);
 		if (result)
 			resource->ref_count--;
+		else
+			resume_device = true;
 	}
 
 	mutex_unlock(&resource->resource_lock);
 
+	if (!resume_device)
+		return result;
+
+	mutex_lock(&resource->devices_lock);
+
+	device_list = resource->devices;
+	while (device_list) {
+		acpi_power_on_device(device_list->device);
+		device_list = device_list->next;
+	}
+
+	mutex_unlock(&resource->devices_lock);
+
 	return result;
 }
 
@@ -351,7 +362,7 @@ static void __acpi_power_resource_unregi
 	if (acpi_power_get_context(res_handle, &resource))
 		return;
 
-	mutex_lock(&resource->resource_lock);
+	mutex_lock(&resource->devices_lock);
 	prev = NULL;
 	curr = resource->devices;
 	while (curr) {
@@ -368,7 +379,7 @@ static void __acpi_power_resource_unregi
 		prev = curr;
 		curr = curr->next;
 	}
-	mutex_unlock(&resource->resource_lock);
+	mutex_unlock(&resource->devices_lock);
 }
 
 /* Unlink dev from all power resources in _PR0 */
@@ -409,10 +420,10 @@ static int __acpi_power_resource_registe
 
 	power_resource_device->device = powered_device;
 
-	mutex_lock(&resource->resource_lock);
+	mutex_lock(&resource->devices_lock);
 	power_resource_device->next = resource->devices;
 	resource->devices = power_resource_device;
-	mutex_unlock(&resource->resource_lock);
+	mutex_unlock(&resource->devices_lock);
 
 	return 0;
 }
@@ -715,6 +726,7 @@ static int acpi_power_add(struct acpi_de
 
 	resource->device = device;
 	mutex_init(&resource->resource_lock);
+	mutex_init(&resource->devices_lock);
 	strcpy(resource->name, device->pnp.bus_id);
 	strcpy(acpi_device_name(device), ACPI_POWER_DEVICE_NAME);
 	strcpy(acpi_device_class(device), ACPI_POWER_CLASS);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 072/262] ACPI / PM: Use KERN_DEBUG when no power resources are found
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (70 preceding siblings ...)
  2012-09-28 18:50 ` [ 071/262] ACPI / PM: Fix resource_lock dead lock in acpi_power_on_device Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 073/262] mmc: mxs-mmc: fix deadlock in SDIO IRQ case Greg Kroah-Hartman
                   ` (189 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Borislav Petkov, Aaron Lu, Rafael J. Wysocki

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Aaron Lu <aaron.lu@intel.com>

commit f25b70613c048ceb1df052576fda03321ebf41cf upstream.

commit a606dac368eed5696fb38e16b1394f1d049c09e9 adds support to link
devices which have _PRx, if a device does not have _PRx, a warning
message will be printed.

This commit is for ZPODD on Intel ZPODD capable platforms, on other
platforms, it has no problem if there is no power resource for this
device, so a warning here is not appropriate, change it to debug.

Reported-by: Borislav Petkov <bp@amd64.org>
Signed-off-by: Aaron Lu <aaron.lu@intel.com>
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/acpi/power.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/acpi/power.c
+++ b/drivers/acpi/power.c
@@ -468,7 +468,7 @@ int acpi_power_resource_register_device(
 	return ret;
 
 no_power_resource:
-	printk(KERN_WARNING PREFIX "Invalid Power Resource to register!");
+	printk(KERN_DEBUG PREFIX "Invalid Power Resource to register!");
 	return -ENODEV;
 }
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 073/262] mmc: mxs-mmc: fix deadlock in SDIO IRQ case
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (71 preceding siblings ...)
  2012-09-28 18:50 ` [ 072/262] ACPI / PM: Use KERN_DEBUG when no power resources are found Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 074/262] mmc: mxs-mmc: fix deadlock caused by recursion loop Greg Kroah-Hartman
                   ` (188 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Lauri Hintsala, Shawn Guo, Chris Ball

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lauri Hintsala <lauri.hintsala@bluegiga.com>

commit 1af36b2a993dddfa3d6860ec4879c9e8abc9b976 upstream.

Release the lock before mmc_signal_sdio_irq is called by mxs_mmc_irq_handler.

Backtrace:
[   79.660000] =============================================
[   79.660000] [ INFO: possible recursive locking detected ]
[   79.660000] 3.4.0-00009-g3e96082-dirty #11 Not tainted
[   79.660000] ---------------------------------------------
[   79.660000] swapper/0 is trying to acquire lock:
[   79.660000]  (&(&host->lock)->rlock#2){-.....}, at: [<c026ea3c>] mxs_mmc_enable_sdio_irq+0x18/0xd4
[   79.660000]
[   79.660000] but task is already holding lock:
[   79.660000]  (&(&host->lock)->rlock#2){-.....}, at: [<c026f744>] mxs_mmc_irq_handler+0x1c/0xe8
[   79.660000]
[   79.660000] other info that might help us debug this:
[   79.660000]  Possible unsafe locking scenario:
[   79.660000]
[   79.660000]        CPU0
[   79.660000]        ----
[   79.660000]   lock(&(&host->lock)->rlock#2);
[   79.660000]   lock(&(&host->lock)->rlock#2);
[   79.660000]
[   79.660000]  *** DEADLOCK ***
[   79.660000]
[   79.660000]  May be due to missing lock nesting notation
[   79.660000]
[   79.660000] 1 lock held by swapper/0:
[   79.660000]  #0:  (&(&host->lock)->rlock#2){-.....}, at: [<c026f744>] mxs_mmc_irq_handler+0x1c/0xe8
[   79.660000]
[   79.660000] stack backtrace:
[   79.660000] [<c0014bd0>] (unwind_backtrace+0x0/0xf4) from [<c005f9c0>] (__lock_acquire+0x1948/0x1d48)
[   79.660000] [<c005f9c0>] (__lock_acquire+0x1948/0x1d48) from [<c005fea0>] (lock_acquire+0xe0/0xf8)
[   79.660000] [<c005fea0>] (lock_acquire+0xe0/0xf8) from [<c03a8460>] (_raw_spin_lock_irqsave+0x44/0x58)
[   79.660000] [<c03a8460>] (_raw_spin_lock_irqsave+0x44/0x58) from [<c026ea3c>] (mxs_mmc_enable_sdio_irq+0x18/0xd4)
[   79.660000] [<c026ea3c>] (mxs_mmc_enable_sdio_irq+0x18/0xd4) from [<c026f7fc>] (mxs_mmc_irq_handler+0xd4/0xe8)
[   79.660000] [<c026f7fc>] (mxs_mmc_irq_handler+0xd4/0xe8) from [<c006bdd8>] (handle_irq_event_percpu+0x70/0x254)
[   79.660000] [<c006bdd8>] (handle_irq_event_percpu+0x70/0x254) from [<c006bff8>] (handle_irq_event+0x3c/0x5c)
[   79.660000] [<c006bff8>] (handle_irq_event+0x3c/0x5c) from [<c006e6d0>] (handle_level_irq+0x90/0x110)
[   79.660000] [<c006e6d0>] (handle_level_irq+0x90/0x110) from [<c006b930>] (generic_handle_irq+0x38/0x50)
[   79.660000] [<c006b930>] (generic_handle_irq+0x38/0x50) from [<c00102fc>] (handle_IRQ+0x30/0x84)
[   79.660000] [<c00102fc>] (handle_IRQ+0x30/0x84) from [<c000f058>] (__irq_svc+0x38/0x60)
[   79.660000] [<c000f058>] (__irq_svc+0x38/0x60) from [<c0010520>] (default_idle+0x2c/0x40)
[   79.660000] [<c0010520>] (default_idle+0x2c/0x40) from [<c0010a90>] (cpu_idle+0x64/0xcc)
[   79.660000] [<c0010a90>] (cpu_idle+0x64/0xcc) from [<c04ff858>] (start_kernel+0x244/0x2c8)
[   79.660000] BUG: spinlock lockup on CPU#0, swapper/0
[   79.660000]  lock: c398cb2c, .magic: dead4ead, .owner: swapper/0, .owner_cpu: 0
[   79.660000] [<c0014bd0>] (unwind_backtrace+0x0/0xf4) from [<c01ddb1c>] (do_raw_spin_lock+0xf0/0x144)
[   79.660000] [<c01ddb1c>] (do_raw_spin_lock+0xf0/0x144) from [<c03a8468>] (_raw_spin_lock_irqsave+0x4c/0x58)
[   79.660000] [<c03a8468>] (_raw_spin_lock_irqsave+0x4c/0x58) from [<c026ea3c>] (mxs_mmc_enable_sdio_irq+0x18/0xd4)
[   79.660000] [<c026ea3c>] (mxs_mmc_enable_sdio_irq+0x18/0xd4) from [<c026f7fc>] (mxs_mmc_irq_handler+0xd4/0xe8)
[   79.660000] [<c026f7fc>] (mxs_mmc_irq_handler+0xd4/0xe8) from [<c006bdd8>] (handle_irq_event_percpu+0x70/0x254)
[   79.660000] [<c006bdd8>] (handle_irq_event_percpu+0x70/0x254) from [<c006bff8>] (handle_irq_event+0x3c/0x5c)
[   79.660000] [<c006bff8>] (handle_irq_event+0x3c/0x5c) from [<c006e6d0>] (handle_level_irq+0x90/0x110)
[   79.660000] [<c006e6d0>] (handle_level_irq+0x90/0x110) from [<c006b930>] (generic_handle_irq+0x38/0x50)
[   79.660000] [<c006b930>] (generic_handle_irq+0x38/0x50) from [<c00102fc>] (handle_IRQ+0x30/0x84)
[   79.660000] [<c00102fc>] (handle_IRQ+0x30/0x84) from [<c000f058>] (__irq_svc+0x38/0x60)
[   79.660000] [<c000f058>] (__irq_svc+0x38/0x60) from [<c0010520>] (default_idle+0x2c/0x40)
[   79.660000] [<c0010520>] (default_idle+0x2c/0x40) from [<c0010a90>] (cpu_idle+0x64/0xcc)
[   79.660000] [<c0010a90>] (cpu_idle+0x64/0xcc) from [<c04ff858>] (start_kernel+0x244/0x2c8)

Signed-off-by: Lauri Hintsala <lauri.hintsala@bluegiga.com>
Acked-by: Shawn Guo <shawn.guo@linaro.org>
Signed-off-by: Chris Ball <cjb@laptop.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mmc/host/mxs-mmc.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/mmc/host/mxs-mmc.c
+++ b/drivers/mmc/host/mxs-mmc.c
@@ -278,11 +278,11 @@ static irqreturn_t mxs_mmc_irq_handler(i
 	writel(stat & MXS_MMC_IRQ_BITS,
 	       host->base + HW_SSP_CTRL1(host) + STMP_OFFSET_REG_CLR);
 
+	spin_unlock(&host->lock);
+
 	if ((stat & BM_SSP_CTRL1_SDIO_IRQ) && (stat & BM_SSP_CTRL1_SDIO_IRQ_EN))
 		mmc_signal_sdio_irq(host->mmc);
 
-	spin_unlock(&host->lock);
-
 	if (stat & BM_SSP_CTRL1_RESP_TIMEOUT_IRQ)
 		cmd->error = -ETIMEDOUT;
 	else if (stat & BM_SSP_CTRL1_RESP_ERR_IRQ)



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 074/262] mmc: mxs-mmc: fix deadlock caused by recursion loop
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (72 preceding siblings ...)
  2012-09-28 18:50 ` [ 073/262] mmc: mxs-mmc: fix deadlock in SDIO IRQ case Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-29  7:28   ` Attila Kinali
  2012-09-28 18:50 ` [ 075/262] mmc: sdhci-esdhc: break out early if clock is 0 Greg Kroah-Hartman
                   ` (187 subsequent siblings)
  261 siblings, 1 reply; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Attila Kinali, Lauri Hintsala, Shawn Guo, Chris Ball

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lauri Hintsala <lauri.hintsala@bluegiga.com>

commit fc108d24d3a6da63576a460e122fa1df0cbdea20 upstream.

Release the lock before mmc_signal_sdio_irq is called by
mxs_mmc_enable_sdio_irq.

Backtrace:
[   65.470000] =============================================
[   65.470000] [ INFO: possible recursive locking detected ]
[   65.470000] 3.5.0-rc5 #2 Not tainted
[   65.470000] ---------------------------------------------
[   65.470000] ksdioirqd/mmc0/73 is trying to acquire lock:
[   65.470000]  (&(&host->lock)->rlock#2){-.-...}, at: [<bf054120>] mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]
[   65.470000]
[   65.470000] but task is already holding lock:
[   65.470000]  (&(&host->lock)->rlock#2){-.-...}, at: [<bf054120>] mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]
[   65.470000]
[   65.470000] other info that might help us debug this:
[   65.470000]  Possible unsafe locking scenario:
[   65.470000]
[   65.470000]        CPU0
[   65.470000]        ----
[   65.470000]   lock(&(&host->lock)->rlock#2);
[   65.470000]   lock(&(&host->lock)->rlock#2);
[   65.470000]
[   65.470000]  *** DEADLOCK ***
[   65.470000]
[   65.470000]  May be due to missing lock nesting notation
[   65.470000]
[   65.470000] 1 lock held by ksdioirqd/mmc0/73:
[   65.470000]  #0:  (&(&host->lock)->rlock#2){-.-...}, at: [<bf054120>] mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]
[   65.470000]
[   65.470000] stack backtrace:
[   65.470000] [<c0014990>] (unwind_backtrace+0x0/0xf4) from [<c005ccb8>] (__lock_acquire+0x14f8/0x1b98)
[   65.470000] [<c005ccb8>] (__lock_acquire+0x14f8/0x1b98) from [<c005d3f8>] (lock_acquire+0xa0/0x108)
[   65.470000] [<c005d3f8>] (lock_acquire+0xa0/0x108) from [<c02f671c>] (_raw_spin_lock_irqsave+0x48/0x5c)
[   65.470000] [<c02f671c>] (_raw_spin_lock_irqsave+0x48/0x5c) from [<bf054120>] (mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc])
[   65.470000] [<bf054120>] (mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]) from [<bf0541d0>] (mxs_mmc_enable_sdio_irq+0xc8/0xdc [mxs_mmc])
[   65.470000] [<bf0541d0>] (mxs_mmc_enable_sdio_irq+0xc8/0xdc [mxs_mmc]) from [<c0219b38>] (sdio_irq_thread+0x1bc/0x274)
[   65.470000] [<c0219b38>] (sdio_irq_thread+0x1bc/0x274) from [<c003c324>] (kthread+0x8c/0x98)
[   65.470000] [<c003c324>] (kthread+0x8c/0x98) from [<c00101ac>] (kernel_thread_exit+0x0/0x8)
[   65.470000] BUG: spinlock lockup suspected on CPU#0, ksdioirqd/mmc0/73
[   65.470000]  lock: 0xc3358724, .magic: dead4ead, .owner: ksdioirqd/mmc0/73, .owner_cpu: 0
[   65.470000] [<c0014990>] (unwind_backtrace+0x0/0xf4) from [<c01b46b0>] (do_raw_spin_lock+0x100/0x144)
[   65.470000] [<c01b46b0>] (do_raw_spin_lock+0x100/0x144) from [<c02f6724>] (_raw_spin_lock_irqsave+0x50/0x5c)
[   65.470000] [<c02f6724>] (_raw_spin_lock_irqsave+0x50/0x5c) from [<bf054120>] (mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc])
[   65.470000] [<bf054120>] (mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]) from [<bf0541d0>] (mxs_mmc_enable_sdio_irq+0xc8/0xdc [mxs_mmc])
[   65.470000] [<bf0541d0>] (mxs_mmc_enable_sdio_irq+0xc8/0xdc [mxs_mmc]) from [<c0219b38>] (sdio_irq_thread+0x1bc/0x274)
[   65.470000] [<c0219b38>] (sdio_irq_thread+0x1bc/0x274) from [<c003c324>] (kthread+0x8c/0x98)
[   65.470000] [<c003c324>] (kthread+0x8c/0x98) from [<c00101ac>] (kernel_thread_exit+0x0/0x8)

Reported-by: Attila Kinali <attila@kinali.ch>
Signed-off-by: Lauri Hintsala <lauri.hintsala@bluegiga.com>
Acked-by: Shawn Guo <shawn.guo@linaro.org>
Signed-off-by: Chris Ball <cjb@laptop.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mmc/host/mxs-mmc.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

--- a/drivers/mmc/host/mxs-mmc.c
+++ b/drivers/mmc/host/mxs-mmc.c
@@ -637,11 +637,6 @@ static void mxs_mmc_enable_sdio_irq(stru
 		       host->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_SET);
 		writel(BM_SSP_CTRL1_SDIO_IRQ_EN,
 		       host->base + HW_SSP_CTRL1(host) + STMP_OFFSET_REG_SET);
-
-		if (readl(host->base + HW_SSP_STATUS(host)) &
-				BM_SSP_STATUS_SDIO_IRQ)
-			mmc_signal_sdio_irq(host->mmc);
-
 	} else {
 		writel(BM_SSP_CTRL0_SDIO_IRQ_CHECK,
 		       host->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_CLR);
@@ -650,6 +645,11 @@ static void mxs_mmc_enable_sdio_irq(stru
 	}
 
 	spin_unlock_irqrestore(&host->lock, flags);
+
+	if (enable && readl(host->base + HW_SSP_STATUS(host)) &
+			BM_SSP_STATUS_SDIO_IRQ)
+		mmc_signal_sdio_irq(host->mmc);
+
 }
 
 static const struct mmc_host_ops mxs_mmc_ops = {



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 075/262] mmc: sdhci-esdhc: break out early if clock is 0
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (73 preceding siblings ...)
  2012-09-28 18:50 ` [ 074/262] mmc: mxs-mmc: fix deadlock caused by recursion loop Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 076/262] mmc: atmel-mci: not busy flag has also to be used for read operations Greg Kroah-Hartman
                   ` (186 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Shawn Guo, Chris Ball

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Shawn Guo <shawn.guo@linaro.org>

commit 74f330bceaa7b88d06062e1cac3d519a3dfc041e upstream.

Since commit 30832ab56 ("mmc: sdhci: Always pass clock request value
zero to set_clock host op") was merged, esdhc_set_clock starts hitting
"if (clock == 0)" where ESDHC_SYSTEM_CONTROL has been operated.  This
causes SDHCI card-detection function being broken.  Fix the regression
by moving "if (clock == 0)" above ESDHC_SYSTEM_CONTROL operation.

Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
Signed-off-by: Chris Ball <cjb@laptop.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mmc/host/sdhci-esdhc.h |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/mmc/host/sdhci-esdhc.h
+++ b/drivers/mmc/host/sdhci-esdhc.h
@@ -48,14 +48,14 @@ static inline void esdhc_set_clock(struc
 	int div = 1;
 	u32 temp;
 
+	if (clock == 0)
+		goto out;
+
 	temp = sdhci_readl(host, ESDHC_SYSTEM_CONTROL);
 	temp &= ~(ESDHC_CLOCK_IPGEN | ESDHC_CLOCK_HCKEN | ESDHC_CLOCK_PEREN
 		| ESDHC_CLOCK_MASK);
 	sdhci_writel(host, temp, ESDHC_SYSTEM_CONTROL);
 
-	if (clock == 0)
-		goto out;
-
 	while (host->max_clk / pre_div / 16 > clock && pre_div < 256)
 		pre_div *= 2;
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 076/262] mmc: atmel-mci: not busy flag has also to be used for read operations
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (74 preceding siblings ...)
  2012-09-28 18:50 ` [ 075/262] mmc: sdhci-esdhc: break out early if clock is 0 Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 077/262] mmc: card: Skip secure erase on MoviNAND; causes unrecoverable corruption Greg Kroah-Hartman
                   ` (185 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Ludovic Desroches, Chris Ball

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ludovic Desroches <ludovic.desroches@atmel.com>

commit 077d40731edc90ee9dedf63249034c8cd5f694ce upstream.

Even if the datasheet says that the not busy flag has to be used only
for write operations, it's false except for version lesser than v2xx.

Not waiting on the not busy flag for read operations can cause the
controller to hang-up during the initialization of some SD cards
with DMA after the first CMD6 -- the next command is sent too early.

Signed-off-by: Ludovic Desroches <ludovic.desroches@atmel.com>
Signed-off-by: Chris Ball <cjb@laptop.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mmc/host/atmel-mci.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/mmc/host/atmel-mci.c
+++ b/drivers/mmc/host/atmel-mci.c
@@ -81,6 +81,7 @@ struct atmel_mci_caps {
 	bool	has_bad_data_ordering;
 	bool	need_reset_after_xfer;
 	bool	need_blksz_mul_4;
+	bool	need_notbusy_for_read_ops;
 };
 
 struct atmel_mci_dma {
@@ -1619,7 +1620,8 @@ static void atmci_tasklet_func(unsigned
 				__func__);
 			atmci_set_completed(host, EVENT_XFER_COMPLETE);
 
-			if (host->data->flags & MMC_DATA_WRITE) {
+			if (host->caps.need_notbusy_for_read_ops ||
+			   (host->data->flags & MMC_DATA_WRITE)) {
 				atmci_writel(host, ATMCI_IER, ATMCI_NOTBUSY);
 				state = STATE_WAITING_NOTBUSY;
 			} else if (host->mrq->stop) {
@@ -2212,6 +2214,7 @@ static void __init atmci_get_cap(struct
 	host->caps.has_bad_data_ordering = 1;
 	host->caps.need_reset_after_xfer = 1;
 	host->caps.need_blksz_mul_4 = 1;
+	host->caps.need_notbusy_for_read_ops = 0;
 
 	/* keep only major version number */
 	switch (version & 0xf00) {
@@ -2232,6 +2235,7 @@ static void __init atmci_get_cap(struct
 	case 0x200:
 		host->caps.has_rwproof = 1;
 		host->caps.need_blksz_mul_4 = 0;
+		host->caps.need_notbusy_for_read_ops = 1;
 	case 0x100:
 		host->caps.has_bad_data_ordering = 0;
 		host->caps.need_reset_after_xfer = 0;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 077/262] mmc: card: Skip secure erase on MoviNAND; causes unrecoverable corruption.
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (75 preceding siblings ...)
  2012-09-28 18:50 ` [ 076/262] mmc: atmel-mci: not busy flag has also to be used for read operations Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 078/262] oprofile, s390: Fix uninitialized memory access when writing to oprofilefs Greg Kroah-Hartman
                   ` (184 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Ian Chen, Namjae Jeon, Jaehoon Chung,
	Linus Walleij, Chris Ball

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ian Chen <ian.cy.chen@samsung.com>

commit 3550ccdb9d8d350e526b809bf3dd92b550a74fe1 upstream.

For several MoviNAND eMMC parts, there are known issues with secure
erase and secure trim.  For these specific MoviNAND devices, we skip
these operations.

Specifically, there is a bug in the eMMC firmware that causes
unrecoverable corruption when the MMC is erased with MMC_CAP_ERASE
enabled.

References:

http://forum.xda-developers.com/showthread.php?t=1644364
https://plus.google.com/111398485184813224730/posts/21pTYfTsCkB#111398485184813224730/posts/21pTYfTsCkB

Signed-off-by: Ian Chen <ian.cy.chen@samsung.com>
Reviewed-by: Namjae Jeon <linkinjeon@gmail.com>
Acked-by: Jaehoon Chung <jh80.chung@samsung.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Chris Ball <cjb@laptop.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mmc/card/block.c |   26 +++++++++++++++++++++++++-
 include/linux/mmc/card.h |    1 +
 2 files changed, 26 insertions(+), 1 deletion(-)

--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -1429,7 +1429,8 @@ static int mmc_blk_issue_rq(struct mmc_q
 		/* complete ongoing async transfer before issuing discard */
 		if (card->host->areq)
 			mmc_blk_issue_rw_rq(mq, NULL);
-		if (req->cmd_flags & REQ_SECURE)
+		if (req->cmd_flags & REQ_SECURE &&
+			!(card->quirks & MMC_QUIRK_SEC_ERASE_TRIM_BROKEN))
 			ret = mmc_blk_issue_secdiscard_rq(mq, req);
 		else
 			ret = mmc_blk_issue_discard_rq(mq, req);
@@ -1734,6 +1735,7 @@ force_ro_fail:
 #define CID_MANFID_SANDISK	0x2
 #define CID_MANFID_TOSHIBA	0x11
 #define CID_MANFID_MICRON	0x13
+#define CID_MANFID_SAMSUNG	0x15
 
 static const struct mmc_fixup blk_fixups[] =
 {
@@ -1770,6 +1772,28 @@ static const struct mmc_fixup blk_fixups
 	MMC_FIXUP(CID_NAME_ANY, CID_MANFID_MICRON, 0x200, add_quirk_mmc,
 		  MMC_QUIRK_LONG_READ_TIME),
 
+	/*
+	 * On these Samsung MoviNAND parts, performing secure erase or
+	 * secure trim can result in unrecoverable corruption due to a
+	 * firmware bug.
+	 */
+	MMC_FIXUP("M8G2FA", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
+		  MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
+	MMC_FIXUP("MAG4FA", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
+		  MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
+	MMC_FIXUP("MBG8FA", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
+		  MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
+	MMC_FIXUP("MCGAFA", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
+		  MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
+	MMC_FIXUP("VAL00M", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
+		  MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
+	MMC_FIXUP("VYL00M", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
+		  MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
+	MMC_FIXUP("KYL00M", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
+		  MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
+	MMC_FIXUP("VZL00M", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
+		  MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
+
 	END_FIXUP
 };
 
--- a/include/linux/mmc/card.h
+++ b/include/linux/mmc/card.h
@@ -238,6 +238,7 @@ struct mmc_card {
 #define MMC_QUIRK_BLK_NO_CMD23	(1<<7)		/* Avoid CMD23 for regular multiblock */
 #define MMC_QUIRK_BROKEN_BYTE_MODE_512 (1<<8)	/* Avoid sending 512 bytes in */
 #define MMC_QUIRK_LONG_READ_TIME (1<<9)		/* Data read time > CSD says */
+#define MMC_QUIRK_SEC_ERASE_TRIM_BROKEN (1<<10)	/* Skip secure for erase/trim */
 						/* byte mode */
 	unsigned int    poweroff_notify_state;	/* eMMC4.5 notify feature */
 #define MMC_NO_POWER_NOTIFICATION	0



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 078/262] oprofile, s390: Fix uninitialized memory access when writing to oprofilefs
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (76 preceding siblings ...)
  2012-09-28 18:50 ` [ 077/262] mmc: card: Skip secure erase on MoviNAND; causes unrecoverable corruption Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 079/262] usb: chipidea: udc: add pullup fuction, needed by the uvc gadget Greg Kroah-Hartman
                   ` (183 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Robert Richter

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Robert Richter <robert.richter@amd.com>

commit 81ff3478d9ba7f0b48b0abef740e542fd83adf79 upstream.

If oprofilefs_ulong_from_user() is called with count equals zero, *val
remains unchanged. Depending on the implementation it might be
uninitialized. Fixing users of oprofilefs_ulong_ from_user().

We missed these s390 changes with:

 913050b oprofile: Fix uninitialized memory access when writing to writing to oprofilefs

Signed-off-by: Robert Richter <robert.richter@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/s390/oprofile/init.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

--- a/arch/s390/oprofile/init.c
+++ b/arch/s390/oprofile/init.c
@@ -171,7 +171,7 @@ static ssize_t hw_interval_write(struct
 	if (*offset)
 		return -EINVAL;
 	retval = oprofilefs_ulong_from_user(&val, buf, count);
-	if (retval)
+	if (retval <= 0)
 		return retval;
 	if (val < oprofile_min_interval)
 		oprofile_hw_interval = oprofile_min_interval;
@@ -214,7 +214,7 @@ static ssize_t hwsampler_zero_write(stru
 		return -EINVAL;
 
 	retval = oprofilefs_ulong_from_user(&val, buf, count);
-	if (retval)
+	if (retval <= 0)
 		return retval;
 	if (val != 0)
 		return -EINVAL;
@@ -245,7 +245,7 @@ static ssize_t hwsampler_kernel_write(st
 		return -EINVAL;
 
 	retval = oprofilefs_ulong_from_user(&val, buf, count);
-	if (retval)
+	if (retval <= 0)
 		return retval;
 
 	if (val != 0 && val != 1)
@@ -280,7 +280,7 @@ static ssize_t hwsampler_user_write(stru
 		return -EINVAL;
 
 	retval = oprofilefs_ulong_from_user(&val, buf, count);
-	if (retval)
+	if (retval <= 0)
 		return retval;
 
 	if (val != 0 && val != 1)
@@ -319,7 +319,7 @@ static ssize_t timer_enabled_write(struc
 		return -EINVAL;
 
 	retval = oprofilefs_ulong_from_user(&val, buf, count);
-	if (retval)
+	if (retval <= 0)
 		return retval;
 
 	if (val != 0 && val != 1)



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 079/262] usb: chipidea: udc: add pullup fuction, needed by the uvc gadget
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (77 preceding siblings ...)
  2012-09-28 18:50 ` [ 078/262] oprofile, s390: Fix uninitialized memory access when writing to oprofilefs Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 080/262] usb: gadget: dummy_hcd: fixup error probe path Greg Kroah-Hartman
                   ` (182 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Michael Grzeschik, Felipe Balbi,
	Marc Kleine-Budde, Alexander Shishkin

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Grzeschik <m.grzeschik@pengutronix.de>

commit c0a48e6c75f2ac190d812bea5fc339696e434c2e upstream.

Add function to physicaly enable or disable of pullup connection on the USB-D+
line. The uvc gaget will fail, if this function is not implemented.

Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Acked-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/chipidea/udc.c |   20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -77,8 +77,7 @@ static inline int ep_to_bit(struct ci13x
 }
 
 /**
- * hw_device_state: enables/disables interrupts & starts/stops device (execute
- *                  without interruption)
+ * hw_device_state: enables/disables interrupts (execute without interruption)
  * @dma: 0 => disable, !0 => enable and set dma engine
  *
  * This function returns an error code
@@ -92,7 +91,6 @@ static int hw_device_state(struct ci13xx
 			     USBi_UI|USBi_UEI|USBi_PCI|USBi_URI|USBi_SLI);
 		hw_write(udc, OP_USBCMD, USBCMD_RS, USBCMD_RS);
 	} else {
-		hw_write(udc, OP_USBCMD, USBCMD_RS, 0);
 		hw_write(udc, OP_USBINTR, ~0, 0);
 	}
 	return 0;
@@ -1419,6 +1417,21 @@ static int ci13xxx_vbus_draw(struct usb_
 	return -ENOTSUPP;
 }
 
+/* Change Data+ pullup status
+ * this func is used by usb_gadget_connect/disconnet
+ */
+static int ci13xxx_pullup(struct usb_gadget *_gadget, int is_on)
+{
+	struct ci13xxx *ci = container_of(_gadget, struct ci13xxx, gadget);
+
+	if (is_on)
+		hw_write(ci, OP_USBCMD, USBCMD_RS, USBCMD_RS);
+	else
+		hw_write(ci, OP_USBCMD, USBCMD_RS, 0);
+
+	return 0;
+}
+
 static int ci13xxx_start(struct usb_gadget *gadget,
 			 struct usb_gadget_driver *driver);
 static int ci13xxx_stop(struct usb_gadget *gadget,
@@ -1431,6 +1444,7 @@ static int ci13xxx_stop(struct usb_gadge
 static const struct usb_gadget_ops usb_gadget_ops = {
 	.vbus_session	= ci13xxx_vbus_session,
 	.wakeup		= ci13xxx_wakeup,
+	.pullup		= ci13xxx_pullup,
 	.vbus_draw	= ci13xxx_vbus_draw,
 	.udc_start	= ci13xxx_start,
 	.udc_stop	= ci13xxx_stop,



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 080/262] usb: gadget: dummy_hcd: fixup error probe path
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (78 preceding siblings ...)
  2012-09-28 18:50 ` [ 079/262] usb: chipidea: udc: add pullup fuction, needed by the uvc gadget Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-29 19:01   ` Ben Hutchings
  2012-09-28 18:50 ` [ 081/262] usb: gadget: dummy_hcd: add support for USB_DT_BOS on rh Greg Kroah-Hartman
                   ` (181 subsequent siblings)
  261 siblings, 1 reply; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Sebastian Andrzej Siewior, Felipe Balbi

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 1b68a4ca2d038addb7314211d122fb6d7002b38b upstream.

If USB2 host controller probes fine but USB3 does not then we don't
remove the USB controller properly and lock up the system while the HUB
code will try to enumerate the USB2 controller and access memory which
is no longer available in case the dummy_hcd was compiled as a module.

This is a problem since 448b6eb1 ("USB: Make sure to fetch the BOS desc
for roothubs.) if used in USB3 mode because dummy does not provide this
descriptor and explodes later.

Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/gadget/dummy_hcd.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/usb/gadget/dummy_hcd.c
+++ b/drivers/usb/gadget/dummy_hcd.c
@@ -2503,10 +2503,8 @@ static int dummy_hcd_probe(struct platfo
 	hs_hcd->has_tt = 1;
 
 	retval = usb_add_hcd(hs_hcd, 0, 0);
-	if (retval != 0) {
-		usb_put_hcd(hs_hcd);
-		return retval;
-	}
+	if (retval)
+		goto put_usb2_hcd;
 
 	if (mod_data.is_super_speed) {
 		ss_hcd = usb_create_shared_hcd(&dummy_hcd, &pdev->dev,
@@ -2525,6 +2523,8 @@ static int dummy_hcd_probe(struct platfo
 put_usb3_hcd:
 	usb_put_hcd(ss_hcd);
 dealloc_usb2_hcd:
+	usb_remove_hcd(hs_hcd);
+put_usb2_hcd:
 	usb_put_hcd(hs_hcd);
 	the_controller.hs_hcd = the_controller.ss_hcd = NULL;
 	return retval;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 081/262] usb: gadget: dummy_hcd: add support for USB_DT_BOS on rh
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (79 preceding siblings ...)
  2012-09-28 18:50 ` [ 080/262] usb: gadget: dummy_hcd: fixup error probe path Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 082/262] usb: gadget: at91udc: dont overwrite driver data Greg Kroah-Hartman
                   ` (180 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Sebastian Andrzej Siewior, Felipe Balbi

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 3b9c1c5ba7a95caae8440ea47308496b14f7301a upstream.

Without a reply for USB_DT_BOS the USB3 mode does not work since
448b6eb1 ("USB: Make sure to fetch the BOS desc for roothubs.).

Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/gadget/dummy_hcd.c |   33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

--- a/drivers/usb/gadget/dummy_hcd.c
+++ b/drivers/usb/gadget/dummy_hcd.c
@@ -1916,6 +1916,27 @@ done:
 	return retval;
 }
 
+/* usb 3.0 root hub device descriptor */
+struct {
+	struct usb_bos_descriptor bos;
+	struct usb_ss_cap_descriptor ss_cap;
+} __packed usb3_bos_desc = {
+
+	.bos = {
+		.bLength		= USB_DT_BOS_SIZE,
+		.bDescriptorType	= USB_DT_BOS,
+		.wTotalLength		= cpu_to_le16(sizeof(usb3_bos_desc)),
+		.bNumDeviceCaps		= 1,
+	},
+	.ss_cap = {
+		.bLength		= USB_DT_USB_SS_CAP_SIZE,
+		.bDescriptorType	= USB_DT_DEVICE_CAPABILITY,
+		.bDevCapabilityType	= USB_SS_CAP_TYPE,
+		.wSpeedSupported	= cpu_to_le16(USB_5GBPS_OPERATION),
+		.bFunctionalitySupport	= ilog2(USB_5GBPS_OPERATION),
+	},
+};
+
 static inline void
 ss_hub_descriptor(struct usb_hub_descriptor *desc)
 {
@@ -2006,6 +2027,18 @@ static int dummy_hub_control(
 		else
 			hub_descriptor((struct usb_hub_descriptor *) buf);
 		break;
+
+	case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
+		if (hcd->speed != HCD_USB3)
+			goto error;
+
+		if ((wValue >> 8) != USB_DT_BOS)
+			goto error;
+
+		memcpy(buf, &usb3_bos_desc, sizeof(usb3_bos_desc));
+		retval = sizeof(usb3_bos_desc);
+		break;
+
 	case GetHubStatus:
 		*(__le32 *) buf = cpu_to_le32(0);
 		break;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 082/262] usb: gadget: at91udc: dont overwrite driver data
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (80 preceding siblings ...)
  2012-09-28 18:50 ` [ 081/262] usb: gadget: dummy_hcd: add support for USB_DT_BOS on rh Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 083/262] usb: gadget: at91udc: Dont check for ep->ep.desc Greg Kroah-Hartman
                   ` (179 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Fabio Porcedda, Mario Isidoro,
	Sebastian Andrzej Siewior, Felipe Balbi

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>

commit 8b7dda554cf61e87523dee412eaf598f8646bd79 upstream.

The driver was converted to the new start/stop interface in f3d8bf34c2
("usb: gadget: at91_udc: convert to new style start/stop interface").
I overlooked that the driver is overwritting the private data which is
used by the composite framework. The udc driver doesn't read it, it is
only written here.

Tested-by: Fabio Porcedda <fabio.porcedda@gmail.com>
Tested-by: Mario Isidoro <Mario.Isidoro@tecmic.pt>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/gadget/at91_udc.c |    2 --
 1 file changed, 2 deletions(-)

--- a/drivers/usb/gadget/at91_udc.c
+++ b/drivers/usb/gadget/at91_udc.c
@@ -1634,7 +1634,6 @@ static int at91_start(struct usb_gadget
 	udc = container_of(gadget, struct at91_udc, gadget);
 	udc->driver = driver;
 	udc->gadget.dev.driver = &driver->driver;
-	dev_set_drvdata(&udc->gadget.dev, &driver->driver);
 	udc->enabled = 1;
 	udc->selfpowered = 1;
 
@@ -1655,7 +1654,6 @@ static int at91_stop(struct usb_gadget *
 	spin_unlock_irqrestore(&udc->lock, flags);
 
 	udc->gadget.dev.driver = NULL;
-	dev_set_drvdata(&udc->gadget.dev, NULL);
 	udc->driver = NULL;
 
 	DBG("unbound from %s\n", driver->driver.name);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 083/262] usb: gadget: at91udc: Dont check for ep->ep.desc
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (81 preceding siblings ...)
  2012-09-28 18:50 ` [ 082/262] usb: gadget: at91udc: dont overwrite driver data Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 084/262] ahci: Add alternate identifier for the 88SE9172 Greg Kroah-Hartman
                   ` (178 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Ido Shayevitz, Fabio Porcedda, Mario Isidoro,
	Sebastian Andrzej Siewior, Felipe Balbi

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>

commit f3bb8e63a8ee0398dffe412e774d8801db7e1bf1 upstream.

Earlier we used to check for ep->ep.desc to figure out if this ep has
already been enabled and if so, abort.
Ido Shayevitz removed the usb_endpoint_descriptor from private udc
structure 5a6506f00 ("usb: gadget: Update at91_udc to use
usb_endpoint_descriptor	inside the struct usb_ep") but did not fix up
the ep_enable condition because _now_ the member is always true and we
can't check if this ep is enabled twice.

Cc: Ido Shayevitz <idos@codeaurora.org>
Tested-by: Fabio Porcedda <fabio.porcedda@gmail.com>
Tested-by: Mario Isidoro <Mario.Isidoro@tecmic.pt>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/gadget/at91_udc.c |    4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

--- a/drivers/usb/gadget/at91_udc.c
+++ b/drivers/usb/gadget/at91_udc.c
@@ -475,8 +475,7 @@ static int at91_ep_enable(struct usb_ep
 	unsigned long	flags;
 
 	if (!_ep || !ep
-			|| !desc || ep->ep.desc
-			|| _ep->name == ep0name
+			|| !desc || _ep->name == ep0name
 			|| desc->bDescriptorType != USB_DT_ENDPOINT
 			|| (maxpacket = usb_endpoint_maxp(desc)) == 0
 			|| maxpacket > ep->maxpacket) {
@@ -530,7 +529,6 @@ ok:
 	tmp |= AT91_UDP_EPEDS;
 	__raw_writel(tmp, ep->creg);
 
-	ep->ep.desc = desc;
 	ep->ep.maxpacket = maxpacket;
 
 	/*



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 084/262] ahci: Add alternate identifier for the 88SE9172
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (82 preceding siblings ...)
  2012-09-28 18:50 ` [ 083/262] usb: gadget: at91udc: Dont check for ep->ep.desc Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 085/262] kobject: fix oops with "input0: bad kobj_uevent_env content in show_uevent()" Greg Kroah-Hartman
                   ` (177 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Alan Cox, Jeff Garzik

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alan Cox <alan@linux.intel.com>

commit 17c60c6b763cb5b83b0185e7d38d01d18e55a05a upstream.

This can also appear as 0x9192. Reported in bugzilla and confirmed with the
board documentation for these boards.

Resolves-bug: https://bugzilla.kernel.org/show_bug.cgi?id=42970
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/ata/ahci.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -396,6 +396,8 @@ static const struct pci_device_id ahci_p
 	  .driver_data = board_ahci_yes_fbs },			/* 88se9125 */
 	{ PCI_DEVICE(0x1b4b, 0x917a),
 	  .driver_data = board_ahci_yes_fbs },			/* 88se9172 */
+	{ PCI_DEVICE(0x1b4b, 0x9192),
+	  .driver_data = board_ahci_yes_fbs },			/* 88se9172 on some Gigabyte */
 	{ PCI_DEVICE(0x1b4b, 0x91a3),
 	  .driver_data = board_ahci_yes_fbs },
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 085/262] kobject: fix oops with "input0: bad kobj_uevent_env content in show_uevent()"
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (83 preceding siblings ...)
  2012-09-28 18:50 ` [ 084/262] ahci: Add alternate identifier for the 88SE9172 Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 086/262] dyndbg: fix for SOH in logging messages Greg Kroah-Hartman
                   ` (176 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Fengguang Wu, Bjørn Mork

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bjørn Mork <bjorn@mork.no>

commit 60e233a56609fd963c59e99bd75c663d63fa91b6 upstream.

Fengguang Wu <fengguang.wu@intel.com> writes:

> After the __devinit* removal series, I can still get kernel panic in
> show_uevent(). So there are more sources of bug..
>
> Debug patch:
>
> @@ -343,8 +343,11 @@ static ssize_t show_uevent(struct device
>                 goto out;
>
>         /* copy keys to file */
> -       for (i = 0; i < env->envp_idx; i++)
> +       dev_err(dev, "uevent %d env[%d]: %s/.../%s\n", env->buflen, env->envp_idx, top_kobj->name, dev->kobj.name);
> +       for (i = 0; i < env->envp_idx; i++) {
> +               printk(KERN_ERR "uevent %d env[%d]: %s\n", (int)count, i, env->envp[i]);
>                 count += sprintf(&buf[count], "%s\n", env->envp[i]);
> +       }
>
> Oops message, the env[] is again not properly initilized:
>
> [   44.068623] input input0: uevent 61 env[805306368]: input0/.../input0
> [   44.069552] uevent 0 env[0]: (null)

This is a completely different CONFIG_HOTPLUG problem, only
demonstrating another reason why CONFIG_HOTPLUG should go away.  I had a
hard time trying to disable it anyway ;-)

The problem this time is lots of code assuming that a call to
add_uevent_var() will guarantee that env->buflen > 0.  This is not true
if CONFIG_HOTPLUG is unset.  So things like this end up overwriting
env->envp_idx because the array index is -1:

	if (add_uevent_var(env, "MODALIAS="))
		return -ENOMEM;
        len = input_print_modalias(&env->buf[env->buflen - 1],
				   sizeof(env->buf) - env->buflen,
				   dev, 0);

Don't know what the best action is, given that there seem to be a *lot*
of this around the kernel.  This patch "fixes" the problem for me, but I
don't know if it can be considered an appropriate fix.

[ It is the correct fix for now, for 3.7 forcing CONFIG_HOTPLUG to
always be on is the longterm fix, but it's too late for 3.6 and older
kernels to resolve this that way - gregkh ]

Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Tested-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/kobject.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/include/linux/kobject.h
+++ b/include/linux/kobject.h
@@ -224,7 +224,7 @@ static inline int kobject_uevent_env(str
 
 static inline __printf(2, 3)
 int add_uevent_var(struct kobj_uevent_env *env, const char *format, ...)
-{ return 0; }
+{ return -ENOMEM; }
 
 static inline int kobject_action_type(const char *buf, size_t count,
 				      enum kobject_action *type)



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 086/262] dyndbg: fix for SOH in logging messages
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (84 preceding siblings ...)
  2012-09-28 18:50 ` [ 085/262] kobject: fix oops with "input0: bad kobj_uevent_env content in show_uevent()" Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 087/262] Redefine ATOMIC_INIT and ATOMIC64_INIT to drop the casts Greg Kroah-Hartman
                   ` (175 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Markus Trippelsdorf, Jim Cromie, Linus Torvalds,
	Andrew Morton, Jason Baron

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Markus Trippelsdorf <markus@trippelsdorf.de>

commit ebdc82899ec5ed35af1c79ed6a4eeda69dad9b90 upstream.

commit af7f2158fde was done against master, and clashed with structured
logging's change of KERN_LEVEL to SOH.

Bisected and fixed by Markus Trippelsdorf.

Reported-by: Markus Trippelsdorf <markus@trippelsdorf.de>
Signed-off-by: Jim Cromie <jim.cromie@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Jason Baron <jbaron@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/base/core.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -1895,8 +1895,8 @@ int __dev_printk(const char *level, cons
 				    "DEVICE=+%s:%s", subsys, dev_name(dev));
 	}
 skip:
-	if (level[3])
-		level_extra = &level[3]; /* skip past "<L>" */
+	if (level[2])
+		level_extra = &level[2]; /* skip past KERN_SOH "L" */
 
 	return printk_emit(0, level[1] - '0',
 			   dictlen ? dict : NULL, dictlen,



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 087/262] Redefine ATOMIC_INIT and ATOMIC64_INIT to drop the casts
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (85 preceding siblings ...)
  2012-09-28 18:50 ` [ 086/262] dyndbg: fix for SOH in logging messages Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 088/262] digsig: add hash size comparision on signature verification Greg Kroah-Hartman
                   ` (174 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Mel Gorman, Fengguang Wu, Michael Cree,
	Matt Turner, Linus Torvalds

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mel Gorman <mgorman@suse.de>

commit 67a806d9499353fabd5b5ff07337f3aa88a1c3ba upstream.

The following build error occurred during an alpha build:

  net/core/sock.c:274:36: error: initializer element is not constant

Dave Anglin says:
> Here is the line in sock.i:
>
> struct static_key memalloc_socks = ((struct static_key) { .enabled =
> ((atomic_t) { (0) }) });

The above line contains two compound literals.  It also uses a designated
initializer to initialize the field enabled.  A compound literal is not a
constant expression.

The location of the above statement isn't fully clear, but if a compound
literal occurs outside the body of a function, the initializer list must
consist of constant expressions.

Signed-off-by: Mel Gorman <mgorman@suse.de>
Signed-off-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Michael Cree <mcree@orcon.net.nz>
Acked-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/alpha/include/asm/atomic.h |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/arch/alpha/include/asm/atomic.h
+++ b/arch/alpha/include/asm/atomic.h
@@ -14,8 +14,8 @@
  */
 
 
-#define ATOMIC_INIT(i)		( (atomic_t) { (i) } )
-#define ATOMIC64_INIT(i)	( (atomic64_t) { (i) } )
+#define ATOMIC_INIT(i)		{ (i) }
+#define ATOMIC64_INIT(i)	{ (i) }
 
 #define atomic_read(v)		(*(volatile int *)&(v)->counter)
 #define atomic64_read(v)	(*(volatile long *)&(v)->counter)



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 088/262] digsig: add hash size comparision on signature verification
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (86 preceding siblings ...)
  2012-09-28 18:50 ` [ 087/262] Redefine ATOMIC_INIT and ATOMIC64_INIT to drop the casts Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 089/262] SUNRPC: Fix a UDP transport regression Greg Kroah-Hartman
                   ` (173 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Dmitry Kasatkin, Linus Torvalds

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dmitry Kasatkin <dmitry.kasatkin@intel.com>

commit bc01637a80f5b670bd70a0279d3f93fa8de1c96d upstream.

When pkcs_1_v1_5_decode_emsa() returns without error and hash sizes do
not match, hash comparision is not done and digsig_verify_rsa() returns
no error.  This is a bug and this patch fixes it.

The bug was introduced in v3.3 by commit b35e286a640f ("lib/digsig:
pkcs_1_v1_5_decode_emsa cleanup").

Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 lib/digsig.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/lib/digsig.c
+++ b/lib/digsig.c
@@ -163,9 +163,11 @@ static int digsig_verify_rsa(struct key
 	memcpy(out1 + head, p, l);
 
 	err = pkcs_1_v1_5_decode_emsa(out1, len, mblen, out2, &len);
+	if (err)
+		goto err;
 
-	if (!err && len == hlen)
-		err = memcmp(out2, h, hlen);
+	if (len != hlen || memcmp(out2, h, hlen))
+		err = -EINVAL;
 
 err:
 	mpi_free(in);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 089/262] SUNRPC: Fix a UDP transport regression
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (87 preceding siblings ...)
  2012-09-28 18:50 ` [ 088/262] digsig: add hash size comparision on signature verification Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 19:46   ` Myklebust, Trond
  2012-09-28 18:50 ` [ 090/262] md: Dont truncate size at 4TB for RAID0 and Linear Greg Kroah-Hartman
                   ` (172 subsequent siblings)
  261 siblings, 1 reply; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Dick Streefland, Trond Myklebust

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Trond Myklebust <Trond.Myklebust@netapp.com>

commit f39c1bfb5a03e2d255451bff05be0d7255298fa4 upstream.

Commit 43cedbf0e8dfb9c5610eb7985d5f21263e313802 (SUNRPC: Ensure that
we grab the XPRT_LOCK before calling xprt_alloc_slot) is causing
hangs in the case of NFS over UDP mounts.

Since neither the UDP or the RDMA transport mechanism use dynamic slot
allocation, we can skip grabbing the socket lock for those transports.
Add a new rpc_xprt_op to allow switching between the TCP and UDP/RDMA
case.

Note that the NFSv4.1 back channel assigns the slot directly
through rpc_run_bc_task, so we can ignore that case.

Reported-by: Dick Streefland <dick.streefland@altium.nl>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/sunrpc/xprt.h     |    3 +++
 net/sunrpc/xprt.c               |   34 ++++++++++++++++++++--------------
 net/sunrpc/xprtrdma/transport.c |    1 +
 net/sunrpc/xprtsock.c           |    3 +++
 4 files changed, 27 insertions(+), 14 deletions(-)

--- a/include/linux/sunrpc/xprt.h
+++ b/include/linux/sunrpc/xprt.h
@@ -114,6 +114,7 @@ struct rpc_xprt_ops {
 	void		(*set_buffer_size)(struct rpc_xprt *xprt, size_t sndsize, size_t rcvsize);
 	int		(*reserve_xprt)(struct rpc_xprt *xprt, struct rpc_task *task);
 	void		(*release_xprt)(struct rpc_xprt *xprt, struct rpc_task *task);
+	void		(*alloc_slot)(struct rpc_xprt *xprt, struct rpc_task *task);
 	void		(*rpcbind)(struct rpc_task *task);
 	void		(*set_port)(struct rpc_xprt *xprt, unsigned short port);
 	void		(*connect)(struct rpc_task *task);
@@ -279,6 +280,8 @@ void			xprt_connect(struct rpc_task *tas
 void			xprt_reserve(struct rpc_task *task);
 int			xprt_reserve_xprt(struct rpc_xprt *xprt, struct rpc_task *task);
 int			xprt_reserve_xprt_cong(struct rpc_xprt *xprt, struct rpc_task *task);
+void			xprt_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task);
+void			xprt_lock_and_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task);
 int			xprt_prepare_transmit(struct rpc_task *task);
 void			xprt_transmit(struct rpc_task *task);
 void			xprt_end_transmit(struct rpc_task *task);
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -969,11 +969,11 @@ static bool xprt_dynamic_free_slot(struc
 	return false;
 }
 
-static void xprt_alloc_slot(struct rpc_task *task)
+void xprt_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task)
 {
-	struct rpc_xprt	*xprt = task->tk_xprt;
 	struct rpc_rqst *req;
 
+	spin_lock(&xprt->reserve_lock);
 	if (!list_empty(&xprt->free)) {
 		req = list_entry(xprt->free.next, struct rpc_rqst, rq_list);
 		list_del(&req->rq_list);
@@ -994,12 +994,29 @@ static void xprt_alloc_slot(struct rpc_t
 	default:
 		task->tk_status = -EAGAIN;
 	}
+	spin_unlock(&xprt->reserve_lock);
 	return;
 out_init_req:
 	task->tk_status = 0;
 	task->tk_rqstp = req;
 	xprt_request_init(task, xprt);
+	spin_unlock(&xprt->reserve_lock);
+}
+EXPORT_SYMBOL_GPL(xprt_alloc_slot);
+
+void xprt_lock_and_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task)
+{
+	/* Note: grabbing the xprt_lock_write() ensures that we throttle
+	 * new slot allocation if the transport is congested (i.e. when
+	 * reconnecting a stream transport or when out of socket write
+	 * buffer space).
+	 */
+	if (xprt_lock_write(xprt, task)) {
+		xprt_alloc_slot(xprt, task);
+		xprt_release_write(xprt, task);
+	}
 }
+EXPORT_SYMBOL_GPL(xprt_lock_and_alloc_slot);
 
 static void xprt_free_slot(struct rpc_xprt *xprt, struct rpc_rqst *req)
 {
@@ -1083,20 +1100,9 @@ void xprt_reserve(struct rpc_task *task)
 	if (task->tk_rqstp != NULL)
 		return;
 
-	/* Note: grabbing the xprt_lock_write() here is not strictly needed,
-	 * but ensures that we throttle new slot allocation if the transport
-	 * is congested (e.g. if reconnecting or if we're out of socket
-	 * write buffer space).
-	 */
 	task->tk_timeout = 0;
 	task->tk_status = -EAGAIN;
-	if (!xprt_lock_write(xprt, task))
-		return;
-
-	spin_lock(&xprt->reserve_lock);
-	xprt_alloc_slot(task);
-	spin_unlock(&xprt->reserve_lock);
-	xprt_release_write(xprt, task);
+	xprt->ops->alloc_slot(xprt, task);
 }
 
 static inline __be32 xprt_alloc_xid(struct rpc_xprt *xprt)
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -713,6 +713,7 @@ static void xprt_rdma_print_stats(struct
 static struct rpc_xprt_ops xprt_rdma_procs = {
 	.reserve_xprt		= xprt_rdma_reserve_xprt,
 	.release_xprt		= xprt_release_xprt_cong, /* sunrpc/xprt.c */
+	.alloc_slot		= xprt_alloc_slot,
 	.release_request	= xprt_release_rqst_cong,       /* ditto */
 	.set_retrans_timeout	= xprt_set_retrans_timeout_def, /* ditto */
 	.rpcbind		= rpcb_getport_async,	/* sunrpc/rpcb_clnt.c */
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -2433,6 +2433,7 @@ static void bc_destroy(struct rpc_xprt *
 static struct rpc_xprt_ops xs_local_ops = {
 	.reserve_xprt		= xprt_reserve_xprt,
 	.release_xprt		= xs_tcp_release_xprt,
+	.alloc_slot		= xprt_alloc_slot,
 	.rpcbind		= xs_local_rpcbind,
 	.set_port		= xs_local_set_port,
 	.connect		= xs_connect,
@@ -2449,6 +2450,7 @@ static struct rpc_xprt_ops xs_udp_ops =
 	.set_buffer_size	= xs_udp_set_buffer_size,
 	.reserve_xprt		= xprt_reserve_xprt_cong,
 	.release_xprt		= xprt_release_xprt_cong,
+	.alloc_slot		= xprt_alloc_slot,
 	.rpcbind		= rpcb_getport_async,
 	.set_port		= xs_set_port,
 	.connect		= xs_connect,
@@ -2466,6 +2468,7 @@ static struct rpc_xprt_ops xs_udp_ops =
 static struct rpc_xprt_ops xs_tcp_ops = {
 	.reserve_xprt		= xprt_reserve_xprt,
 	.release_xprt		= xs_tcp_release_xprt,
+	.alloc_slot		= xprt_lock_and_alloc_slot,
 	.rpcbind		= rpcb_getport_async,
 	.set_port		= xs_set_port,
 	.connect		= xs_connect,



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 090/262] md: Dont truncate size at 4TB for RAID0 and Linear
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (88 preceding siblings ...)
  2012-09-28 18:50 ` [ 089/262] SUNRPC: Fix a UDP transport regression Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 091/262] md/raid10: fix problem with on-stack allocation of r10bio structure Greg Kroah-Hartman
                   ` (171 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Neil Brown

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: NeilBrown <neilb@suse.de>

commit 667a5313ecd7308d79629c0738b0db588b0b0a4e upstream.

commit 27a7b260f71439c40546b43588448faac01adb93
   md: Fix handling for devices from 2TB to 4TB in 0.90 metadata.

changed 0.90 metadata handling to truncated size to 4TB as that is
all that 0.90 can record.
However for RAID0 and Linear, 0.90 doesn't need to record the size, so
this truncation is not needed and causes working arrays to become too small.

So avoid the truncation for RAID0 and Linear

This bug was introduced in 3.1 and is suitable for any stable kernels
from then onwards.
As the offending commit was tagged for 'stable', any stable kernel
that it was applied to should also get this patch.  That includes
at least 2.6.32, 2.6.33 and 3.0. (Thanks to Ben Hutchings for
providing that list).

Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/md.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1157,8 +1157,11 @@ static int super_90_load(struct md_rdev
 			ret = 0;
 	}
 	rdev->sectors = rdev->sb_start;
-	/* Limit to 4TB as metadata cannot record more than that */
-	if (rdev->sectors >= (2ULL << 32))
+	/* Limit to 4TB as metadata cannot record more than that.
+	 * (not needed for Linear and RAID0 as metadata doesn't
+	 * record this size)
+	 */
+	if (rdev->sectors >= (2ULL << 32) && sb->level >= 1)
 		rdev->sectors = (2ULL << 32) - 2;
 
 	if (rdev->sectors < ((sector_t)sb->size) * 2 && sb->level >= 1)
@@ -1449,7 +1452,7 @@ super_90_rdev_size_change(struct md_rdev
 	/* Limit to 4TB as metadata cannot record more than that.
 	 * 4TB == 2^32 KB, or 2*2^32 sectors.
 	 */
-	if (num_sectors >= (2ULL << 32))
+	if (num_sectors >= (2ULL << 32) && rdev->mddev->level >= 1)
 		num_sectors = (2ULL << 32) - 2;
 	md_super_write(rdev->mddev, rdev, rdev->sb_start, rdev->sb_size,
 		       rdev->sb_page);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 091/262] md/raid10: fix problem with on-stack allocation of r10bio structure.
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (89 preceding siblings ...)
  2012-09-28 18:50 ` [ 090/262] md: Dont truncate size at 4TB for RAID0 and Linear Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 092/262] md: make sure metadata is updated when spares are activated or removed Greg Kroah-Hartman
                   ` (170 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Ivan Vasilyev, NeilBrown

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: NeilBrown <neilb@suse.de>

commit e0ee778528bbaad28a5c69d2e219269a3a096607 upstream.

A 'struct r10bio' has an array of per-copy information at the end.
This array is declared with size [0] and r10bio_pool_alloc allocates
enough extra space to store the per-copy information depending on the
number of copies needed.

So declaring a 'struct r10bio on the stack isn't going to work.  It
won't allocate enough space, and memory corruption will ensue.

So in the two places where this is done, declare a sufficiently large
structure and use that instead.

The two call-sites of this bug were introduced in 3.4 and 3.5
so this is suitable for both those kernels.  The patch will have to
be modified for 3.4 as it only has one bug.

Reported-by: Ivan Vasilyev <ivan.vasilyev@gmail.com>
Tested-by: Ivan Vasilyev <ivan.vasilyev@gmail.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/raid10.c |   30 +++++++++++++++++++-----------
 drivers/md/raid10.h |    2 +-
 2 files changed, 20 insertions(+), 12 deletions(-)

--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -645,7 +645,11 @@ static int raid10_mergeable_bvec(struct
 		max = biovec->bv_len;
 
 	if (mddev->merge_check_needed) {
-		struct r10bio r10_bio;
+		struct {
+			struct r10bio r10_bio;
+			struct r10dev devs[conf->copies];
+		} on_stack;
+		struct r10bio *r10_bio = &on_stack.r10_bio;
 		int s;
 		if (conf->reshape_progress != MaxSector) {
 			/* Cannot give any guidance during reshape */
@@ -653,18 +657,18 @@ static int raid10_mergeable_bvec(struct
 				return biovec->bv_len;
 			return 0;
 		}
-		r10_bio.sector = sector;
-		raid10_find_phys(conf, &r10_bio);
+		r10_bio->sector = sector;
+		raid10_find_phys(conf, r10_bio);
 		rcu_read_lock();
 		for (s = 0; s < conf->copies; s++) {
-			int disk = r10_bio.devs[s].devnum;
+			int disk = r10_bio->devs[s].devnum;
 			struct md_rdev *rdev = rcu_dereference(
 				conf->mirrors[disk].rdev);
 			if (rdev && !test_bit(Faulty, &rdev->flags)) {
 				struct request_queue *q =
 					bdev_get_queue(rdev->bdev);
 				if (q->merge_bvec_fn) {
-					bvm->bi_sector = r10_bio.devs[s].addr
+					bvm->bi_sector = r10_bio->devs[s].addr
 						+ rdev->data_offset;
 					bvm->bi_bdev = rdev->bdev;
 					max = min(max, q->merge_bvec_fn(
@@ -676,7 +680,7 @@ static int raid10_mergeable_bvec(struct
 				struct request_queue *q =
 					bdev_get_queue(rdev->bdev);
 				if (q->merge_bvec_fn) {
-					bvm->bi_sector = r10_bio.devs[s].addr
+					bvm->bi_sector = r10_bio->devs[s].addr
 						+ rdev->data_offset;
 					bvm->bi_bdev = rdev->bdev;
 					max = min(max, q->merge_bvec_fn(
@@ -4389,14 +4393,18 @@ static int handle_reshape_read_error(str
 {
 	/* Use sync reads to get the blocks from somewhere else */
 	int sectors = r10_bio->sectors;
-	struct r10bio r10b;
 	struct r10conf *conf = mddev->private;
+	struct {
+		struct r10bio r10_bio;
+		struct r10dev devs[conf->copies];
+	} on_stack;
+	struct r10bio *r10b = &on_stack.r10_bio;
 	int slot = 0;
 	int idx = 0;
 	struct bio_vec *bvec = r10_bio->master_bio->bi_io_vec;
 
-	r10b.sector = r10_bio->sector;
-	__raid10_find_phys(&conf->prev, &r10b);
+	r10b->sector = r10_bio->sector;
+	__raid10_find_phys(&conf->prev, r10b);
 
 	while (sectors) {
 		int s = sectors;
@@ -4407,7 +4415,7 @@ static int handle_reshape_read_error(str
 			s = PAGE_SIZE >> 9;
 
 		while (!success) {
-			int d = r10b.devs[slot].devnum;
+			int d = r10b->devs[slot].devnum;
 			struct md_rdev *rdev = conf->mirrors[d].rdev;
 			sector_t addr;
 			if (rdev == NULL ||
@@ -4415,7 +4423,7 @@ static int handle_reshape_read_error(str
 			    !test_bit(In_sync, &rdev->flags))
 				goto failed;
 
-			addr = r10b.devs[slot].addr + idx * PAGE_SIZE;
+			addr = r10b->devs[slot].addr + idx * PAGE_SIZE;
 			success = sync_page_io(rdev,
 					       addr,
 					       s << 9,
--- a/drivers/md/raid10.h
+++ b/drivers/md/raid10.h
@@ -110,7 +110,7 @@ struct r10bio {
 	 * We choose the number when they are allocated.
 	 * We sometimes need an extra bio to write to the replacement.
 	 */
-	struct {
+	struct r10dev {
 		struct bio	*bio;
 		union {
 			struct bio	*repl_bio; /* used for resync and



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 092/262] md: make sure metadata is updated when spares are activated or removed.
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (90 preceding siblings ...)
  2012-09-28 18:50 ` [ 091/262] md/raid10: fix problem with on-stack allocation of r10bio structure Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 093/262] md/raid5: fix calculate of degraded when a replacement becomes active Greg Kroah-Hartman
                   ` (169 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, NeilBrown

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: NeilBrown <neilb@suse.de>

commit 6dafab6b1383e912cd252fa809570b484eb6e0dc upstream.

It isn't always necessary to update the metadata when spares are
removed as the presence-or-not of a spare isn't really important to
the integrity of an array.
Also activating a spare doesn't always require updating the metadata
as the update on 'recovery-completed' is usually sufficient.

However the introduction of 'replacement' devices have made these
transitions sometimes more important.  For example the 'Replacement'
flag isn't cleared until the original device is removed, so we need
to ensure a metadata update after that 'spare' is removed.

So set MD_CHANGE_DEVS whenever a spare is activated or removed, to
complement the current situation where it is set when a spare is added
or a device is failed (or a number of other less common situations).

This is suitable for -stable as out-of-data metadata could lead
to data corruption.
This is only relevant for 3.3 and later 9when 'replacement' as
introduced.

Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/md.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7672,6 +7672,8 @@ static int remove_and_add_spares(struct
 			}
 		}
 	}
+	if (removed)
+		set_bit(MD_CHANGE_DEVS, &mddev->flags);
 	return spares;
 }
 
@@ -7685,9 +7687,11 @@ static void reap_sync_thread(struct mdde
 	    !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) {
 		/* success...*/
 		/* activate any spares */
-		if (mddev->pers->spare_active(mddev))
+		if (mddev->pers->spare_active(mddev)) {
 			sysfs_notify(&mddev->kobj, NULL,
 				     "degraded");
+			set_bit(MD_CHANGE_DEVS, &mddev->flags);
+		}
 	}
 	if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) &&
 	    mddev->pers->finish_reshape)



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 093/262] md/raid5: fix calculate of degraded when a replacement becomes active.
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (91 preceding siblings ...)
  2012-09-28 18:50 ` [ 092/262] md: make sure metadata is updated when spares are activated or removed Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 094/262] nbd: clear waiting_queue on shutdown Greg Kroah-Hartman
                   ` (168 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Robin Hill, John Drescher, NeilBrown

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: NeilBrown <neilb@suse.de>

commit e5c86471f933608db5d43679f84cb4346c32033e upstream.

When a replacement device becomes active, we mark the device that it
replaces as 'faulty' so that it can subsequently get removed.
However 'calc_degraded' only pays attention to the primary device, not
the replacement, so the array appears to become degraded, which is
wrong.

So teach 'calc_degraded' to consider any replacement if a primary
device is faulty.

This is suitable for -stable as an incorrect 'degraded' value can
confuse md and could lead to data corruption.
This is only relevant for 3.3 and later.

Reported-by: Robin Hill <robin@robinhill.me.uk>
Reported-by: John Drescher <drescherjm@gmail.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/raid5.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -380,6 +380,8 @@ static int calc_degraded(struct r5conf *
 	degraded = 0;
 	for (i = 0; i < conf->previous_raid_disks; i++) {
 		struct md_rdev *rdev = rcu_dereference(conf->disks[i].rdev);
+		if (rdev && test_bit(Faulty, &rdev->flags))
+			rdev = rcu_dereference(conf->disks[i].replacement);
 		if (!rdev || test_bit(Faulty, &rdev->flags))
 			degraded++;
 		else if (test_bit(In_sync, &rdev->flags))
@@ -404,6 +406,8 @@ static int calc_degraded(struct r5conf *
 	degraded2 = 0;
 	for (i = 0; i < conf->raid_disks; i++) {
 		struct md_rdev *rdev = rcu_dereference(conf->disks[i].rdev);
+		if (rdev && test_bit(Faulty, &rdev->flags))
+			rdev = rcu_dereference(conf->disks[i].replacement);
 		if (!rdev || test_bit(Faulty, &rdev->flags))
 			degraded2++;
 		else if (test_bit(In_sync, &rdev->flags))



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 094/262] nbd: clear waiting_queue on shutdown
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (92 preceding siblings ...)
  2012-09-28 18:50 ` [ 093/262] md/raid5: fix calculate of degraded when a replacement becomes active Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 095/262] ASoC: samsung dma - Dont indicate support for pause/resume Greg Kroah-Hartman
                   ` (167 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Paul Clements, Andrew Morton, Linus Torvalds

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Paul Clements <paul.clements@steeleye.com>

commit fded4e090c60100d709318896c79816d68d5b47d upstream.

Fix a serious but uncommon bug in nbd which occurs when there is heavy
I/O going to the nbd device while, at the same time, a failure (server,
network) or manual disconnect of the nbd connection occurs.

There is a small window between the time that the nbd_thread is stopped
and the socket is shutdown where requests can continue to be queued to
nbd's internal waiting_queue.  When this happens, those requests are
never completed or freed.

The fix is to clear the waiting_queue on shutdown of the nbd device, in
the same way that the nbd request queue (queue_head) is already being
cleared.

Signed-off-by: Paul Clements <paul.clements@steeleye.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/block/nbd.c |    9 +++++++++
 1 file changed, 9 insertions(+)

--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -445,6 +445,14 @@ static void nbd_clear_que(struct nbd_dev
 		req->errors++;
 		nbd_end_request(req);
 	}
+
+	while (!list_empty(&nbd->waiting_queue)) {
+		req = list_entry(nbd->waiting_queue.next, struct request,
+				 queuelist);
+		list_del_init(&req->queuelist);
+		req->errors++;
+		nbd_end_request(req);
+	}
 }
 
 
@@ -594,6 +602,7 @@ static int __nbd_ioctl(struct block_devi
 		nbd->file = NULL;
 		nbd_clear_que(nbd);
 		BUG_ON(!list_empty(&nbd->queue_head));
+		BUG_ON(!list_empty(&nbd->waiting_queue));
 		if (file)
 			fput(file);
 		return 0;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 095/262] ASoC: samsung dma - Dont indicate support for pause/resume.
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (93 preceding siblings ...)
  2012-09-28 18:50 ` [ 094/262] nbd: clear waiting_queue on shutdown Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 096/262] mm/page_alloc: fix the page address of higher pages buddy calculation Greg Kroah-Hartman
                   ` (166 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Dylan Reid, Mark Brown

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dylan Reid <dgreid@chromium.org>

commit 57b2d68863f281737d8596cb3d76d89d9cc54fd8 upstream.

The pause and resume operations indicate that the stream can be
un-paused/resumed from the exact location they were paused/suspended.
This is not true for this driver, the pause and suspend triggers share
the same code path with stop, they flush all pending DMA transfers.
This drops all pending samples.  The pause_release/resume triggers are
the same as start, except that prepare won't be called beforehand,
nothing will be enqueued to the DMA engine and nothing will happen (no
audio).  Removing the pause flag will let apps know that it isn't
supported.  Removing the resume flag will cause user space to call
prepare and start instead of resume, so audio will continue playing when
the system wakes up.

Before removing the pause and resume flags, I tested this on an exynos
5250, using 'aplay -i'. Pause/un-pause leads to silence followed by a
write error.  Suspend/resume testing led to the same result.  Removing
the two flags fixes suspend/resume (since snd_pcm_prepare is called
again). And leads to a proper reporting of pause not supported.

Signed-off-by: Dylan Reid <dgreid@chromium.org>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/soc/samsung/dma.c |    8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

--- a/sound/soc/samsung/dma.c
+++ b/sound/soc/samsung/dma.c
@@ -34,9 +34,7 @@ static const struct snd_pcm_hardware dma
 	.info			= SNDRV_PCM_INFO_INTERLEAVED |
 				    SNDRV_PCM_INFO_BLOCK_TRANSFER |
 				    SNDRV_PCM_INFO_MMAP |
-				    SNDRV_PCM_INFO_MMAP_VALID |
-				    SNDRV_PCM_INFO_PAUSE |
-				    SNDRV_PCM_INFO_RESUME,
+				    SNDRV_PCM_INFO_MMAP_VALID,
 	.formats		= SNDRV_PCM_FMTBIT_S16_LE |
 				    SNDRV_PCM_FMTBIT_U16_LE |
 				    SNDRV_PCM_FMTBIT_U8 |
@@ -246,15 +244,11 @@ static int dma_trigger(struct snd_pcm_su
 
 	switch (cmd) {
 	case SNDRV_PCM_TRIGGER_START:
-	case SNDRV_PCM_TRIGGER_RESUME:
-	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
 		prtd->state |= ST_RUNNING;
 		prtd->params->ops->trigger(prtd->params->ch);
 		break;
 
 	case SNDRV_PCM_TRIGGER_STOP:
-	case SNDRV_PCM_TRIGGER_SUSPEND:
-	case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
 		prtd->state &= ~ST_RUNNING;
 		prtd->params->ops->stop(prtd->params->ch);
 		break;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 096/262] mm/page_alloc: fix the page address of higher pages buddy calculation
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (94 preceding siblings ...)
  2012-09-28 18:50 ` [ 095/262] ASoC: samsung dma - Dont indicate support for pause/resume Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 097/262] drivers/rtc/rtc-twl.c: ensure all interrupts are disabled during probe Greg Kroah-Hartman
                   ` (165 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Haifeng Li, Gavin Shan, Michal Hocko, KyongHo Cho,
	Mel Gorman, Minchan Kim, Johannes Weiner, Andrew Morton,
	Linus Torvalds

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Li Haifeng <omycle@gmail.com>

commit 0ba8f2d59304dfe69b59c034de723ad80f7ab9ac upstream.

The heuristic method for buddy has been introduced since commit
43506fad21ca ("mm/page_alloc.c: simplify calculation of combined index
of adjacent buddy lists").  But the page address of higher page's buddy
was wrongly calculated, which will lead page_is_buddy to fail for ever.
IOW, the heuristic method would be disabled with the wrong page address
of higher page's buddy.

Calculating the page address of higher page's buddy should be based
higher_page with the offset between index of higher page and index of
higher page's buddy.

Signed-off-by: Haifeng Li <omycle@gmail.com>
Signed-off-by: Gavin Shan <shangw@linux.vnet.ibm.com>
Reviewed-by: Michal Hocko <mhocko@suse.cz>
Cc: KyongHo Cho <pullip.cho@samsung.com>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Minchan Kim <minchan.kim@gmail.com>
Cc: Johannes Weiner <jweiner@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 mm/page_alloc.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -580,7 +580,7 @@ static inline void __free_one_page(struc
 		combined_idx = buddy_idx & page_idx;
 		higher_page = page + (combined_idx - page_idx);
 		buddy_idx = __find_buddy_index(combined_idx, order + 1);
-		higher_buddy = page + (buddy_idx - combined_idx);
+		higher_buddy = higher_page + (buddy_idx - combined_idx);
 		if (page_is_buddy(higher_page, higher_buddy, order + 1)) {
 			list_add_tail(&page->lru,
 				&zone->free_area[order].free_list[migratetype]);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 097/262] drivers/rtc/rtc-twl.c: ensure all interrupts are disabled during probe
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (95 preceding siblings ...)
  2012-09-28 18:50 ` [ 096/262] mm/page_alloc: fix the page address of higher pages buddy calculation Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 098/262] hwmon: (twl4030-madc-hwmon) Initialize uninitialized structure elements Greg Kroah-Hartman
                   ` (164 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Kevin Hilman, Felipe Balbi, Steve Sakoman,
	Alessandro Zummo, Shubhrajyoti Datta, Andrew Morton,
	Linus Torvalds

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kevin Hilman <khilman@ti.com>

commit 8dcebaa9a0ae8a0487f4342f3d56d2cb1c980860 upstream.

On some platforms, bootloaders are known to do some interesting RTC
programming.  Without going into the obscurities as to why this may be
the case, suffice it to say the the driver should not make any
assumptions about the state of the RTC when the driver loads.  In
particular, the driver probe should be sure that all interrupts are
disabled until otherwise programmed.

This was discovered when finding bursty I2C traffic every second on
Overo platforms.  This I2C overhead was keeping the SoC from hitting
deep power states.  The cause was found to be the RTC firing every
second on the I2C-connected TWL PMIC.

Special thanks to Felipe Balbi for suggesting to look for a rogue driver
as the source of the I2C traffic rather than the I2C driver itself.

Special thanks to Steve Sakoman for helping track down the source of the
continuous RTC interrups on the Overo boards.

Signed-off-by: Kevin Hilman <khilman@ti.com>
Cc: Felipe Balbi <balbi@ti.com>
Tested-by: Steve Sakoman <steve@sakoman.com>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Tested-by: Shubhrajyoti Datta <omaplinuxkernel@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/rtc/rtc-twl.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/drivers/rtc/rtc-twl.c
+++ b/drivers/rtc/rtc-twl.c
@@ -495,6 +495,11 @@ static int __devinit twl_rtc_probe(struc
 	if (ret < 0)
 		goto out1;
 
+	/* ensure interrupts are disabled, bootloaders can be strange */
+	ret = twl_rtc_write_u8(0, REG_RTC_INTERRUPTS_REG);
+	if (ret < 0)
+		dev_warn(&pdev->dev, "unable to disable interrupt\n");
+
 	/* init cached IRQ enable bits */
 	ret = twl_rtc_read_u8(&rtc_irq_bits, REG_RTC_INTERRUPTS_REG);
 	if (ret < 0)



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 098/262] hwmon: (twl4030-madc-hwmon) Initialize uninitialized structure elements
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (96 preceding siblings ...)
  2012-09-28 18:50 ` [ 097/262] drivers/rtc/rtc-twl.c: ensure all interrupts are disabled during probe Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 099/262] hwmon: (ina2xx) Fix word size register read and write operations Greg Kroah-Hartman
                   ` (163 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Keerthy, Guenter Roeck, Jean Delvare

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Guenter Roeck <linux@roeck-us.net>

commit 73d7c119255615a26070f9d6cdb722a166a29015 upstream.

twl4030_madc_conversion uses do_avg and type structure elements of
twl4030_madc_request. Initialize structure to avoid random operation.

Fix for: Coverity CID 200794 Uninitialized scalar variable.

Cc: Keerthy <j-keerthy@ti.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Jean Delvare <khali@linux-fr.org>
Acked-by: Keerthy <j-keerthy@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hwmon/twl4030-madc-hwmon.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/drivers/hwmon/twl4030-madc-hwmon.c
+++ b/drivers/hwmon/twl4030-madc-hwmon.c
@@ -44,12 +44,13 @@ static ssize_t madc_read(struct device *
 			 struct device_attribute *devattr, char *buf)
 {
 	struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
-	struct twl4030_madc_request req;
+	struct twl4030_madc_request req = {
+		.channels = 1 << attr->index,
+		.method = TWL4030_MADC_SW2,
+		.type = TWL4030_MADC_WAIT,
+	};
 	long val;
 
-	req.channels = (1 << attr->index);
-	req.method = TWL4030_MADC_SW2;
-	req.func_cb = NULL;
 	val = twl4030_madc_conversion(&req);
 	if (val < 0)
 		return val;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 099/262] hwmon: (ina2xx) Fix word size register read and write operations
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (97 preceding siblings ...)
  2012-09-28 18:50 ` [ 098/262] hwmon: (twl4030-madc-hwmon) Initialize uninitialized structure elements Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 100/262] sched: Add missing call to calc_load_exit_idle() Greg Kroah-Hartman
                   ` (162 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Guenter Roeck, Jean Delvare

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Guenter Roeck <linux@roeck-us.net>

commit 080b98e9ab30734bda2f1b8b33cd55a4c4ef406a upstream.

The driver uses be16_to_cpu and cpu_to_be16 to convert data in SMBus word
operations from chip to host byte order. However, the data passed from and to
the SMBus word API functions is in host byte order, not in chip byte order.
Conversion should therefore use swab16 instead of be16 to change the byte order.

Replace driver internal word conversion functions with SMBus API functions to
solve the problem.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hwmon/ina2xx.c |   30 +++++++++---------------------
 1 file changed, 9 insertions(+), 21 deletions(-)

--- a/drivers/hwmon/ina2xx.c
+++ b/drivers/hwmon/ina2xx.c
@@ -69,22 +69,6 @@ struct ina2xx_data {
 	u16 regs[INA2XX_MAX_REGISTERS];
 };
 
-int ina2xx_read_word(struct i2c_client *client, int reg)
-{
-	int val = i2c_smbus_read_word_data(client, reg);
-	if (unlikely(val < 0)) {
-		dev_dbg(&client->dev,
-			"Failed to read register: %d\n", reg);
-		return val;
-	}
-	return be16_to_cpu(val);
-}
-
-void ina2xx_write_word(struct i2c_client *client, int reg, int data)
-{
-	i2c_smbus_write_word_data(client, reg, cpu_to_be16(data));
-}
-
 static struct ina2xx_data *ina2xx_update_device(struct device *dev)
 {
 	struct i2c_client *client = to_i2c_client(dev);
@@ -102,7 +86,7 @@ static struct ina2xx_data *ina2xx_update
 
 		/* Read all registers */
 		for (i = 0; i < data->registers; i++) {
-			int rv = ina2xx_read_word(client, i);
+			int rv = i2c_smbus_read_word_swapped(client, i);
 			if (rv < 0) {
 				ret = ERR_PTR(rv);
 				goto abort;
@@ -279,22 +263,26 @@ static int ina2xx_probe(struct i2c_clien
 	switch (data->kind) {
 	case ina219:
 		/* device configuration */
-		ina2xx_write_word(client, INA2XX_CONFIG, INA219_CONFIG_DEFAULT);
+		i2c_smbus_write_word_swapped(client, INA2XX_CONFIG,
+					     INA219_CONFIG_DEFAULT);
 
 		/* set current LSB to 1mA, shunt is in uOhms */
 		/* (equation 13 in datasheet) */
-		ina2xx_write_word(client, INA2XX_CALIBRATION, 40960000 / shunt);
+		i2c_smbus_write_word_swapped(client, INA2XX_CALIBRATION,
+					     40960000 / shunt);
 		dev_info(&client->dev,
 			 "power monitor INA219 (Rshunt = %li uOhm)\n", shunt);
 		data->registers = INA219_REGISTERS;
 		break;
 	case ina226:
 		/* device configuration */
-		ina2xx_write_word(client, INA2XX_CONFIG, INA226_CONFIG_DEFAULT);
+		i2c_smbus_write_word_swapped(client, INA2XX_CONFIG,
+					     INA226_CONFIG_DEFAULT);
 
 		/* set current LSB to 1mA, shunt is in uOhms */
 		/* (equation 1 in datasheet)*/
-		ina2xx_write_word(client, INA2XX_CALIBRATION, 5120000 / shunt);
+		i2c_smbus_write_word_swapped(client, INA2XX_CALIBRATION,
+					     5120000 / shunt);
 		dev_info(&client->dev,
 			 "power monitor INA226 (Rshunt = %li uOhm)\n", shunt);
 		data->registers = INA226_REGISTERS;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 100/262] sched: Add missing call to calc_load_exit_idle()
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (98 preceding siblings ...)
  2012-09-28 18:50 ` [ 099/262] hwmon: (ina2xx) Fix word size register read and write operations Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 101/262] gma500: Fix regression on Oaktrail devices Greg Kroah-Hartman
                   ` (161 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Charles Wang, Peter Zijlstra, Ingo Molnar

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Charles Wang <muming.wq@taobao.com>

commit 749c8814f08f12baa4a9c2812a7c6ede7d69507d upstream.

Azat Khuzhin reported high loadavg in Linux v3.6

After checking the upstream scheduler code, I found Peter's commit:

  5167e8d5417b sched/nohz: Rewrite and fix load-avg computation -- again

not fully applied, missing the call to calc_load_exit_idle().

After that idle exit in sampling window will always be calculated
to non-idle, and the load will be higher than normal.

This patch adds the missing call to calc_load_exit_idle().

Signed-off-by: Charles Wang <muming.wq@taobao.com>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Link: http://lkml.kernel.org/r/1345449754-27130-1-git-send-email-muming.wq@gmail.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/time/tick-sched.c |    1 +
 1 file changed, 1 insertion(+)

--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -145,6 +145,7 @@ static void tick_nohz_update_jiffies(kti
 	tick_do_update_jiffies64(now);
 	local_irq_restore(flags);
 
+	calc_load_exit_idle();
 	touch_softlockup_watchdog();
 }
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 101/262] gma500: Fix regression on Oaktrail devices
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (99 preceding siblings ...)
  2012-09-28 18:50 ` [ 100/262] sched: Add missing call to calc_load_exit_idle() Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 102/262] mISDN: Fix wrong usage of flush_work_sync while holding locks Greg Kroah-Hartman
                   ` (160 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Alan Cox, Dave Airlie

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alan Cox <alan@linux.intel.com>

commit 26df641eac05abe1a3276eea441359b4d1120816 upstream.

The register map patches didn't set one value for the GMA600 which
means the Fujitsu Q550 dies on boot with the GMA500 driver enabled.

Add the map entry so we don't read from the device MMIO + 0 by mistake.

Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/gma500/oaktrail_device.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/gpu/drm/gma500/oaktrail_device.c
+++ b/drivers/gpu/drm/gma500/oaktrail_device.c
@@ -476,6 +476,7 @@ static const struct psb_offset oaktrail_
 		.pos = DSPAPOS,
 		.surf = DSPASURF,
 		.addr = MRST_DSPABASE,
+		.base = MRST_DSPABASE,
 		.status = PIPEASTAT,
 		.linoff = DSPALINOFF,
 		.tileoff = DSPATILEOFF,
@@ -499,6 +500,7 @@ static const struct psb_offset oaktrail_
 		.pos = DSPBPOS,
 		.surf = DSPBSURF,
 		.addr = DSPBBASE,
+		.base = DSPBBASE,
 		.status = PIPEBSTAT,
 		.linoff = DSPBLINOFF,
 		.tileoff = DSPBTILEOFF,



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 102/262] mISDN: Fix wrong usage of flush_work_sync while holding locks
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (100 preceding siblings ...)
  2012-09-28 18:50 ` [ 101/262] gma500: Fix regression on Oaktrail devices Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 103/262] can: mcp251x: avoid repeated frame bug Greg Kroah-Hartman
                   ` (159 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Karsten Keil, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Karsten Keil <keil@b1-systems.de>

commit 4b921eda53366b319602351ff4d7256fafa4bd1b upstream.

It is a bad idea to hold a spinlock and call flush_work_sync.
Move the workqueue cleanup outside the spinlock and use cancel_work_sync,
on closing the channel this seems to be the more correct function.
Remove the never used and constant return value of mISDN_freebchannel.

Signed-off-by: Karsten Keil <keil@b1-systems.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/isdn/hardware/mISDN/avmfritz.c  |    3 ++-
 drivers/isdn/hardware/mISDN/mISDNipac.c |    3 ++-
 drivers/isdn/hardware/mISDN/mISDNisar.c |    3 ++-
 drivers/isdn/hardware/mISDN/netjet.c    |    3 ++-
 drivers/isdn/hardware/mISDN/w6692.c     |    3 ++-
 drivers/isdn/mISDN/hwchannel.c          |    9 ++++-----
 include/linux/mISDNhw.h                 |    2 +-
 7 files changed, 15 insertions(+), 11 deletions(-)

--- a/drivers/isdn/hardware/mISDN/avmfritz.c
+++ b/drivers/isdn/hardware/mISDN/avmfritz.c
@@ -857,8 +857,9 @@ avm_bctrl(struct mISDNchannel *ch, u32 c
 	switch (cmd) {
 	case CLOSE_CHANNEL:
 		test_and_clear_bit(FLG_OPEN, &bch->Flags);
+		cancel_work_sync(&bch->workq);
 		spin_lock_irqsave(&fc->lock, flags);
-		mISDN_freebchannel(bch);
+		mISDN_clear_bchannel(bch);
 		modehdlc(bch, ISDN_P_NONE);
 		spin_unlock_irqrestore(&fc->lock, flags);
 		ch->protocol = ISDN_P_NONE;
--- a/drivers/isdn/hardware/mISDN/mISDNipac.c
+++ b/drivers/isdn/hardware/mISDN/mISDNipac.c
@@ -1406,8 +1406,9 @@ hscx_bctrl(struct mISDNchannel *ch, u32
 	switch (cmd) {
 	case CLOSE_CHANNEL:
 		test_and_clear_bit(FLG_OPEN, &bch->Flags);
+		cancel_work_sync(&bch->workq);
 		spin_lock_irqsave(hx->ip->hwlock, flags);
-		mISDN_freebchannel(bch);
+		mISDN_clear_bchannel(bch);
 		hscx_mode(hx, ISDN_P_NONE);
 		spin_unlock_irqrestore(hx->ip->hwlock, flags);
 		ch->protocol = ISDN_P_NONE;
--- a/drivers/isdn/hardware/mISDN/mISDNisar.c
+++ b/drivers/isdn/hardware/mISDN/mISDNisar.c
@@ -1588,8 +1588,9 @@ isar_bctrl(struct mISDNchannel *ch, u32
 	switch (cmd) {
 	case CLOSE_CHANNEL:
 		test_and_clear_bit(FLG_OPEN, &bch->Flags);
+		cancel_work_sync(&bch->workq);
 		spin_lock_irqsave(ich->is->hwlock, flags);
-		mISDN_freebchannel(bch);
+		mISDN_clear_bchannel(bch);
 		modeisar(ich, ISDN_P_NONE);
 		spin_unlock_irqrestore(ich->is->hwlock, flags);
 		ch->protocol = ISDN_P_NONE;
--- a/drivers/isdn/hardware/mISDN/netjet.c
+++ b/drivers/isdn/hardware/mISDN/netjet.c
@@ -812,8 +812,9 @@ nj_bctrl(struct mISDNchannel *ch, u32 cm
 	switch (cmd) {
 	case CLOSE_CHANNEL:
 		test_and_clear_bit(FLG_OPEN, &bch->Flags);
+		cancel_work_sync(&bch->workq);
 		spin_lock_irqsave(&card->lock, flags);
-		mISDN_freebchannel(bch);
+		mISDN_clear_bchannel(bch);
 		mode_tiger(bc, ISDN_P_NONE);
 		spin_unlock_irqrestore(&card->lock, flags);
 		ch->protocol = ISDN_P_NONE;
--- a/drivers/isdn/hardware/mISDN/w6692.c
+++ b/drivers/isdn/hardware/mISDN/w6692.c
@@ -1054,8 +1054,9 @@ w6692_bctrl(struct mISDNchannel *ch, u32
 	switch (cmd) {
 	case CLOSE_CHANNEL:
 		test_and_clear_bit(FLG_OPEN, &bch->Flags);
+		cancel_work_sync(&bch->workq);
 		spin_lock_irqsave(&card->lock, flags);
-		mISDN_freebchannel(bch);
+		mISDN_clear_bchannel(bch);
 		w6692_mode(bc, ISDN_P_NONE);
 		spin_unlock_irqrestore(&card->lock, flags);
 		ch->protocol = ISDN_P_NONE;
--- a/drivers/isdn/mISDN/hwchannel.c
+++ b/drivers/isdn/mISDN/hwchannel.c
@@ -148,17 +148,16 @@ mISDN_clear_bchannel(struct bchannel *ch
 	ch->next_minlen = ch->init_minlen;
 	ch->maxlen = ch->init_maxlen;
 	ch->next_maxlen = ch->init_maxlen;
+	skb_queue_purge(&ch->rqueue);
+	ch->rcount = 0;
 }
 EXPORT_SYMBOL(mISDN_clear_bchannel);
 
-int
+void
 mISDN_freebchannel(struct bchannel *ch)
 {
+	cancel_work_sync(&ch->workq);
 	mISDN_clear_bchannel(ch);
-	skb_queue_purge(&ch->rqueue);
-	ch->rcount = 0;
-	flush_work_sync(&ch->workq);
-	return 0;
 }
 EXPORT_SYMBOL(mISDN_freebchannel);
 
--- a/include/linux/mISDNhw.h
+++ b/include/linux/mISDNhw.h
@@ -183,7 +183,7 @@ extern int	mISDN_initbchannel(struct bch
 				   unsigned short);
 extern int	mISDN_freedchannel(struct dchannel *);
 extern void	mISDN_clear_bchannel(struct bchannel *);
-extern int	mISDN_freebchannel(struct bchannel *);
+extern void	mISDN_freebchannel(struct bchannel *);
 extern int	mISDN_ctrl_bchannel(struct bchannel *, struct mISDN_ctrl_req *);
 extern void	queue_ch_frame(struct mISDNchannel *, u_int,
 			int, struct sk_buff *);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 103/262] can: mcp251x: avoid repeated frame bug
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (101 preceding siblings ...)
  2012-09-28 18:50 ` [ 102/262] mISDN: Fix wrong usage of flush_work_sync while holding locks Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 104/262] mm/ia64: fix a memory block size bug Greg Kroah-Hartman
                   ` (158 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Benoît Locher, Marc Kleine-Budde

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Benoît Locher <Benoit.Locher@skf.com>

commit cab32f39dcc5b35db96497dc0a026b5dea76e4e7 upstream.

The MCP2515 has a silicon bug causing repeated frame transmission, see section
5 of MCP2515 Rev. B Silicon Errata Revision G (March 2007).

Basically, setting TXBnCTRL.TXREQ in either SPI mode (00 or 11) will eventually
cause the bug. The workaround proposed by Microchip is to use mode 00 and send
a RTS command on the SPI bus to initiate the transmission.

Signed-off-by: Benoît Locher <Benoit.Locher@skf.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/can/mcp251x.c |   11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

--- a/drivers/net/can/mcp251x.c
+++ b/drivers/net/can/mcp251x.c
@@ -83,6 +83,11 @@
 #define INSTRUCTION_LOAD_TXB(n)	(0x40 + 2 * (n))
 #define INSTRUCTION_READ_RXB(n)	(((n) == 0) ? 0x90 : 0x94)
 #define INSTRUCTION_RESET	0xC0
+#define RTS_TXB0		0x01
+#define RTS_TXB1		0x02
+#define RTS_TXB2		0x04
+#define INSTRUCTION_RTS(n)	(0x80 | ((n) & 0x07))
+
 
 /* MPC251x registers */
 #define CANSTAT	      0x0e
@@ -397,6 +402,7 @@ static void mcp251x_hw_tx_frame(struct s
 static void mcp251x_hw_tx(struct spi_device *spi, struct can_frame *frame,
 			  int tx_buf_idx)
 {
+	struct mcp251x_priv *priv = dev_get_drvdata(&spi->dev);
 	u32 sid, eid, exide, rtr;
 	u8 buf[SPI_TRANSFER_BUF_LEN];
 
@@ -418,7 +424,10 @@ static void mcp251x_hw_tx(struct spi_dev
 	buf[TXBDLC_OFF] = (rtr << DLC_RTR_SHIFT) | frame->can_dlc;
 	memcpy(buf + TXBDAT_OFF, frame->data, frame->can_dlc);
 	mcp251x_hw_tx_frame(spi, buf, frame->can_dlc, tx_buf_idx);
-	mcp251x_write_reg(spi, TXBCTRL(tx_buf_idx), TXBCTRL_TXREQ);
+
+	/* use INSTRUCTION_RTS, to avoid "repeated frame problem" */
+	priv->spi_tx_buf[0] = INSTRUCTION_RTS(1 << tx_buf_idx);
+	mcp251x_spi_trans(priv->spi, 1);
 }
 
 static void mcp251x_hw_rx_frame(struct spi_device *spi, u8 *buf,



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 104/262] mm/ia64: fix a memory block size bug
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (102 preceding siblings ...)
  2012-09-28 18:50 ` [ 103/262] can: mcp251x: avoid repeated frame bug Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 105/262] memory hotplug: fix section info double registration bug Greg Kroah-Hartman
                   ` (157 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Jianguo Wu, Jiang Liu, Luck, Tony, Michal Hocko,
	Andrew Morton, Linus Torvalds

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jianguo Wu <wujianguo@huawei.com>

commit 05cf96398e1b6502f9e191291b715c7463c9d5dd upstream.

I found following definition in include/linux/memory.h, in my IA64
platform, SECTION_SIZE_BITS is equal to 32, and MIN_MEMORY_BLOCK_SIZE
will be 0.

  #define MIN_MEMORY_BLOCK_SIZE     (1 << SECTION_SIZE_BITS)

Because MIN_MEMORY_BLOCK_SIZE is int type and length of 32bits,
so MIN_MEMORY_BLOCK_SIZE(1 << 32) will will equal to 0.
Actually when SECTION_SIZE_BITS >= 31, MIN_MEMORY_BLOCK_SIZE will be wrong.
This will cause wrong system memory infomation in sysfs.
I think it should be:

  #define MIN_MEMORY_BLOCK_SIZE     (1UL << SECTION_SIZE_BITS)

And "echo offline > memory0/state" will cause following call trace:

  kernel BUG at mm/memory_hotplug.c:885!
  sh[6455]: bugcheck! 0 [1]
  Pid: 6455, CPU 0, comm:                   sh
  psr : 0000101008526030 ifs : 8000000000000fa4 ip  : [<a0000001008c40f0>]    Not tainted (3.6.0-rc1)
  ip is at offline_pages+0x210/0xee0
  Call Trace:
    show_stack+0x80/0xa0
    show_regs+0x640/0x920
    die+0x190/0x2c0
    die_if_kernel+0x50/0x80
    ia64_bad_break+0x3d0/0x6e0
    ia64_native_leave_kernel+0x0/0x270
    offline_pages+0x210/0xee0
    alloc_pages_current+0x180/0x2a0

Signed-off-by: Jianguo Wu <wujianguo@huawei.com>
Signed-off-by: Jiang Liu <jiang.liu@huawei.com>
Cc: "Luck, Tony" <tony.luck@intel.com>
Reviewed-by: Michal Hocko <mhocko@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/memory.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/include/linux/memory.h
+++ b/include/linux/memory.h
@@ -19,7 +19,7 @@
 #include <linux/compiler.h>
 #include <linux/mutex.h>
 
-#define MIN_MEMORY_BLOCK_SIZE     (1 << SECTION_SIZE_BITS)
+#define MIN_MEMORY_BLOCK_SIZE     (1UL << SECTION_SIZE_BITS)
 
 struct memory_block {
 	unsigned long start_section_nr;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 105/262] memory hotplug: fix section info double registration bug
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (103 preceding siblings ...)
  2012-09-28 18:50 ` [ 104/262] mm/ia64: fix a memory block size bug Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 106/262] xen/m2p: do not reuse kmap_op->dev_bus_addr Greg Kroah-Hartman
                   ` (156 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Xishi Qiu, Jiang Liu, Mel Gorman, Luck, Tony,
	Yasuaki Ishimatsu, Andrew Morton, Linus Torvalds

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: qiuxishi <qiuxishi@gmail.com>

commit f14851af0ebb32745c6c5a2e400aa0549f9d20df upstream.

There may be a bug when registering section info.  For example, on my
Itanium platform, the pfn range of node0 includes the other nodes, so
other nodes' section info will be double registered, and memmap's page
count will equal to 3.

  node0: start_pfn=0x100,    spanned_pfn=0x20fb00, present_pfn=0x7f8a3, => 0x000100-0x20fc00
  node1: start_pfn=0x80000,  spanned_pfn=0x80000,  present_pfn=0x80000, => 0x080000-0x100000
  node2: start_pfn=0x100000, spanned_pfn=0x80000,  present_pfn=0x80000, => 0x100000-0x180000
  node3: start_pfn=0x180000, spanned_pfn=0x80000,  present_pfn=0x80000, => 0x180000-0x200000

  free_all_bootmem_node()
	register_page_bootmem_info_node()
		register_page_bootmem_info_section()

When hot remove memory, we can't free the memmap's page because
page_count() is 2 after put_page_bootmem().

  sparse_remove_one_section()
	free_section_usemap()
		free_map_bootmem()
			put_page_bootmem()

[akpm@linux-foundation.org: add code comment]
Signed-off-by: Xishi Qiu <qiuxishi@huawei.com>
Signed-off-by: Jiang Liu <jiang.liu@huawei.com>
Acked-by: Mel Gorman <mgorman@suse.de>
Cc: "Luck, Tony" <tony.luck@intel.com>
Cc: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 mm/memory_hotplug.c |   16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -126,9 +126,6 @@ static void register_page_bootmem_info_s
 	struct mem_section *ms;
 	struct page *page, *memmap;
 
-	if (!pfn_valid(start_pfn))
-		return;
-
 	section_nr = pfn_to_section_nr(start_pfn);
 	ms = __nr_to_section(section_nr);
 
@@ -187,9 +184,16 @@ void register_page_bootmem_info_node(str
 	end_pfn = pfn + pgdat->node_spanned_pages;
 
 	/* register_section info */
-	for (; pfn < end_pfn; pfn += PAGES_PER_SECTION)
-		register_page_bootmem_info_section(pfn);
-
+	for (; pfn < end_pfn; pfn += PAGES_PER_SECTION) {
+		/*
+		 * Some platforms can assign the same pfn to multiple nodes - on
+		 * node0 as well as nodeN.  To avoid registering a pfn against
+		 * multiple nodes we check that this pfn does not already
+		 * reside in some other node.
+		 */
+		if (pfn_valid(pfn) && (pfn_to_nid(pfn) == node))
+			register_page_bootmem_info_section(pfn);
+	}
 }
 #endif /* !CONFIG_SPARSEMEM_VMEMMAP */
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 106/262] xen/m2p: do not reuse kmap_op->dev_bus_addr
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (104 preceding siblings ...)
  2012-09-28 18:50 ` [ 105/262] memory hotplug: fix section info double registration bug Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 107/262] xen/boot: Disable BIOS SMP MP table search Greg Kroah-Hartman
                   ` (155 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Stefano Stabellini, Konrad Rzeszutek Wilk

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

commit 2fc136eecd0c647a6b13fcd00d0c41a1a28f35a5 upstream.

If the caller passes a valid kmap_op to m2p_add_override, we use
kmap_op->dev_bus_addr to store the original mfn, but dev_bus_addr is
part of the interface with Xen and if we are batching the hypercalls it
might not have been written by the hypervisor yet. That means that later
on Xen will write to it and we'll think that the original mfn is
actually what Xen has written to it.

Rather than "stealing" struct members from kmap_op, keep using
page->index to store the original mfn and add another parameter to
m2p_remove_override to get the corresponding kmap_op instead.
It is now responsibility of the caller to keep track of which kmap_op
corresponds to a particular page in the m2p_override (gntdev, the only
user of this interface that passes a valid kmap_op, is already doing that).

Reported-and-Tested-By: Sander Eikelenboom <linux@eikelenboom.it>
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/include/asm/xen/page.h     |    3 ++-
 arch/x86/xen/p2m.c                  |   27 +++++++++++----------------
 drivers/block/xen-blkback/blkback.c |    2 +-
 drivers/xen/gntdev.c                |    5 +++--
 drivers/xen/grant-table.c           |    6 ++++--
 include/xen/grant_table.h           |    3 ++-
 6 files changed, 23 insertions(+), 23 deletions(-)

--- a/arch/x86/include/asm/xen/page.h
+++ b/arch/x86/include/asm/xen/page.h
@@ -51,7 +51,8 @@ extern unsigned long set_phys_range_iden
 
 extern int m2p_add_override(unsigned long mfn, struct page *page,
 			    struct gnttab_map_grant_ref *kmap_op);
-extern int m2p_remove_override(struct page *page, bool clear_pte);
+extern int m2p_remove_override(struct page *page,
+				struct gnttab_map_grant_ref *kmap_op);
 extern struct page *m2p_find_override(unsigned long mfn);
 extern unsigned long m2p_find_override_pfn(unsigned long mfn, unsigned long pfn);
 
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -828,9 +828,6 @@ int m2p_add_override(unsigned long mfn,
 
 			xen_mc_issue(PARAVIRT_LAZY_MMU);
 		}
-		/* let's use dev_bus_addr to record the old mfn instead */
-		kmap_op->dev_bus_addr = page->index;
-		page->index = (unsigned long) kmap_op;
 	}
 	spin_lock_irqsave(&m2p_override_lock, flags);
 	list_add(&page->lru,  &m2p_overrides[mfn_hash(mfn)]);
@@ -857,7 +854,8 @@ int m2p_add_override(unsigned long mfn,
 	return 0;
 }
 EXPORT_SYMBOL_GPL(m2p_add_override);
-int m2p_remove_override(struct page *page, bool clear_pte)
+int m2p_remove_override(struct page *page,
+		struct gnttab_map_grant_ref *kmap_op)
 {
 	unsigned long flags;
 	unsigned long mfn;
@@ -887,10 +885,8 @@ int m2p_remove_override(struct page *pag
 	WARN_ON(!PagePrivate(page));
 	ClearPagePrivate(page);
 
-	if (clear_pte) {
-		struct gnttab_map_grant_ref *map_op =
-			(struct gnttab_map_grant_ref *) page->index;
-		set_phys_to_machine(pfn, map_op->dev_bus_addr);
+	set_phys_to_machine(pfn, page->index);
+	if (kmap_op != NULL) {
 		if (!PageHighMem(page)) {
 			struct multicall_space mcs;
 			struct gnttab_unmap_grant_ref *unmap_op;
@@ -902,13 +898,13 @@ int m2p_remove_override(struct page *pag
 			 * issued. In this case handle is going to -1 because
 			 * it hasn't been modified yet.
 			 */
-			if (map_op->handle == -1)
+			if (kmap_op->handle == -1)
 				xen_mc_flush();
 			/*
-			 * Now if map_op->handle is negative it means that the
+			 * Now if kmap_op->handle is negative it means that the
 			 * hypercall actually returned an error.
 			 */
-			if (map_op->handle == GNTST_general_error) {
+			if (kmap_op->handle == GNTST_general_error) {
 				printk(KERN_WARNING "m2p_remove_override: "
 						"pfn %lx mfn %lx, failed to modify kernel mappings",
 						pfn, mfn);
@@ -918,8 +914,8 @@ int m2p_remove_override(struct page *pag
 			mcs = xen_mc_entry(
 					sizeof(struct gnttab_unmap_grant_ref));
 			unmap_op = mcs.args;
-			unmap_op->host_addr = map_op->host_addr;
-			unmap_op->handle = map_op->handle;
+			unmap_op->host_addr = kmap_op->host_addr;
+			unmap_op->handle = kmap_op->handle;
 			unmap_op->dev_bus_addr = 0;
 
 			MULTI_grant_table_op(mcs.mc,
@@ -930,10 +926,9 @@ int m2p_remove_override(struct page *pag
 			set_pte_at(&init_mm, address, ptep,
 					pfn_pte(pfn, PAGE_KERNEL));
 			__flush_tlb_single(address);
-			map_op->host_addr = 0;
+			kmap_op->host_addr = 0;
 		}
-	} else
-		set_phys_to_machine(pfn, page->index);
+	}
 
 	/* p2m(m2p(mfn)) == FOREIGN_FRAME(mfn): the mfn is already present
 	 * somewhere in this domain, even before being added to the
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -337,7 +337,7 @@ static void xen_blkbk_unmap(struct pendi
 		invcount++;
 	}
 
-	ret = gnttab_unmap_refs(unmap, pages, invcount, false);
+	ret = gnttab_unmap_refs(unmap, NULL, pages, invcount);
 	BUG_ON(ret);
 }
 
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -314,8 +314,9 @@ static int __unmap_grant_pages(struct gr
 		}
 	}
 
-	err = gnttab_unmap_refs(map->unmap_ops + offset, map->pages + offset,
-				pages, true);
+	err = gnttab_unmap_refs(map->unmap_ops + offset,
+			use_ptemod ? map->kmap_ops + offset : NULL, map->pages + offset,
+			pages);
 	if (err)
 		return err;
 
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -870,7 +870,8 @@ int gnttab_map_refs(struct gnttab_map_gr
 EXPORT_SYMBOL_GPL(gnttab_map_refs);
 
 int gnttab_unmap_refs(struct gnttab_unmap_grant_ref *unmap_ops,
-		      struct page **pages, unsigned int count, bool clear_pte)
+		      struct gnttab_map_grant_ref *kmap_ops,
+		      struct page **pages, unsigned int count)
 {
 	int i, ret;
 	bool lazy = false;
@@ -888,7 +889,8 @@ int gnttab_unmap_refs(struct gnttab_unma
 	}
 
 	for (i = 0; i < count; i++) {
-		ret = m2p_remove_override(pages[i], clear_pte);
+		ret = m2p_remove_override(pages[i], kmap_ops ?
+				       &kmap_ops[i] : NULL);
 		if (ret)
 			return ret;
 	}
--- a/include/xen/grant_table.h
+++ b/include/xen/grant_table.h
@@ -187,6 +187,7 @@ int gnttab_map_refs(struct gnttab_map_gr
 		    struct gnttab_map_grant_ref *kmap_ops,
 		    struct page **pages, unsigned int count);
 int gnttab_unmap_refs(struct gnttab_unmap_grant_ref *unmap_ops,
-		      struct page **pages, unsigned int count, bool clear_pte);
+		      struct gnttab_map_grant_ref *kunmap_ops,
+		      struct page **pages, unsigned int count);
 
 #endif /* __ASM_GNTTAB_H__ */



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 107/262] xen/boot: Disable BIOS SMP MP table search.
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (105 preceding siblings ...)
  2012-09-28 18:50 ` [ 106/262] xen/m2p: do not reuse kmap_op->dev_bus_addr Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 108/262] xen/boot: Disable NUMA for PV guests Greg Kroah-Hartman
                   ` (154 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Jan Beulich, Konrad Rzeszutek Wilk

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

commit bd49940a35ec7d488ae63bd625639893b3385b97 upstream.

As the initial domain we are able to search/map certain regions
of memory to harvest configuration data. For all low-level we
use ACPI tables - for interrupts we use exclusively ACPI _PRT
(so DSDT) and MADT for INT_SRC_OVR.

The SMP MP table is not used at all. As a matter of fact we do
not even support machines that only have SMP MP but no ACPI tables.

Lets follow how Moorestown does it and just disable searching
for BIOS SMP tables.

This also fixes an issue on HP Proliant BL680c G5 and DL380 G6:

9f->100 for 1:1 PTE
Freeing 9f-100 pfn range: 97 pages freed
1-1 mapping on 9f->100
.. snip..
e820: BIOS-provided physical RAM map:
Xen: [mem 0x0000000000000000-0x000000000009efff] usable
Xen: [mem 0x000000000009f400-0x00000000000fffff] reserved
Xen: [mem 0x0000000000100000-0x00000000cfd1dfff] usable
.. snip..
Scan for SMP in [mem 0x00000000-0x000003ff]
Scan for SMP in [mem 0x0009fc00-0x0009ffff]
Scan for SMP in [mem 0x000f0000-0x000fffff]
found SMP MP-table at [mem 0x000f4fa0-0x000f4faf] mapped at [ffff8800000f4fa0]
(XEN) mm.c:908:d0 Error getting mfn 100 (pfn 5555555555555555) from L1 entry 0000000000100461 for l1e_owner=0, pg_owner=0
(XEN) mm.c:4995:d0 ptwr_emulate: could not get_page_from_l1e()
BUG: unable to handle kernel NULL pointer dereference at           (null)
IP: [<ffffffff81ac07e2>] xen_set_pte_init+0x66/0x71
. snip..
Pid: 0, comm: swapper Not tainted 3.6.0-rc6upstream-00188-gb6fb969-dirty #2 HP ProLiant BL680c G5
.. snip..
Call Trace:
 [<ffffffff81ad31c6>] __early_ioremap+0x18a/0x248
 [<ffffffff81624731>] ? printk+0x48/0x4a
 [<ffffffff81ad32ac>] early_ioremap+0x13/0x15
 [<ffffffff81acc140>] get_mpc_size+0x2f/0x67
 [<ffffffff81acc284>] smp_scan_config+0x10c/0x136
 [<ffffffff81acc2e4>] default_find_smp_config+0x36/0x5a
 [<ffffffff81ac3085>] setup_arch+0x5b3/0xb5b
 [<ffffffff81624731>] ? printk+0x48/0x4a
 [<ffffffff81abca7f>] start_kernel+0x90/0x390
 [<ffffffff81abc356>] x86_64_start_reservations+0x131/0x136
 [<ffffffff81abfa83>] xen_start_kernel+0x65f/0x661
(XEN) Domain 0 crashed: 'noreboot' set - not rebooting.

which is that ioremap would end up mapping 0xff using _PAGE_IOMAP
(which is what early_ioremap sticks as a flag) - which meant
we would get MFN 0xFF (pte ff461, which is OK), and then it would
also map 0x100 (b/c ioremap tries to get page aligned request, and
it was trying to map 0xf4fa0 + PAGE_SIZE - so it mapped the next page)
as _PAGE_IOMAP. Since 0x100 is actually a RAM page, and the _PAGE_IOMAP
bypasses the P2M lookup we would happily set the PTE to 1000461.
Xen would deny the request since we do not have access to the
Machine Frame Number (MFN) of 0x100. The P2M[0x100] is for example
0x80140.

Fixes-Oracle-Bugzilla: https://bugzilla.oracle.com/bugzilla/show_bug.cgi?id=13665
Acked-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/xen/enlighten.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -1422,6 +1422,10 @@ asmlinkage void __init xen_start_kernel(
 		pci_request_acs();
 
 		xen_acpi_sleep_register();
+
+		/* Avoid searching for BIOS MP tables */
+		x86_init.mpparse.find_smp_config = x86_init_noop;
+		x86_init.mpparse.get_smp_config = x86_init_uint_noop;
 	}
 #ifdef CONFIG_PCI
 	/* PCI BIOS service won't work from a PV guest. */



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 108/262] xen/boot: Disable NUMA for PV guests.
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (106 preceding siblings ...)
  2012-09-28 18:50 ` [ 107/262] xen/boot: Disable BIOS SMP MP table search Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 109/262] hwmon: (fam15h_power) Tweak runavg_range on resume Greg Kroah-Hartman
                   ` (153 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Andre Przywara, Konrad Rzeszutek Wilk

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

commit 8d54db795dfb1049d45dc34f0dddbc5347ec5642 upstream.

The hypervisor is in charge of allocating the proper "NUMA" memory
and dealing with the CPU scheduler to keep them bound to the proper
NUMA node. The PV guests (and PVHVM) have no inkling of where they
run and do not need to know that right now. In the future we will
need to inject NUMA configuration data (if a guest spans two or more
NUMA nodes) so that the kernel can make the right choices. But those
patches are not yet present.

In the meantime, disable the NUMA capability in the PV guest, which
also fixes a bootup issue. Andre says:

"we see Dom0 crashes due to the kernel detecting the NUMA topology not
by ACPI, but directly from the northbridge (CONFIG_AMD_NUMA).

This will detect the actual NUMA config of the physical machine, but
will crash about the mismatch with Dom0's virtual memory. Variation of
the theme: Dom0 sees what it's not supposed to see.

This happens with the said config option enabled and on a machine where
this scanning is still enabled (K8 and Fam10h, not Bulldozer class)

We have this dump then:
NUMA: Warning: node ids are out of bound, from=-1 to=-1 distance=10
Scanning NUMA topology in Northbridge 24
Number of physical nodes 4
Node 0 MemBase 0000000000000000 Limit 0000000040000000
Node 1 MemBase 0000000040000000 Limit 0000000138000000
Node 2 MemBase 0000000138000000 Limit 00000001f8000000
Node 3 MemBase 00000001f8000000 Limit 0000000238000000
Initmem setup node 0 0000000000000000-0000000040000000
  NODE_DATA [000000003ffd9000 - 000000003fffffff]
Initmem setup node 1 0000000040000000-0000000138000000
  NODE_DATA [0000000137fd9000 - 0000000137ffffff]
Initmem setup node 2 0000000138000000-00000001f8000000
  NODE_DATA [00000001f095e000 - 00000001f0984fff]
Initmem setup node 3 00000001f8000000-0000000238000000
Cannot find 159744 bytes in node 3
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [<ffffffff81d220e6>] __alloc_bootmem_node+0x43/0x96
Pid: 0, comm: swapper Not tainted 3.3.6 #1 AMD Dinar/Dinar
RIP: e030:[<ffffffff81d220e6>]  [<ffffffff81d220e6>] __alloc_bootmem_node+0x43/0x96
.. snip..
  [<ffffffff81d23024>] sparse_early_usemaps_alloc_node+0x64/0x178
  [<ffffffff81d23348>] sparse_init+0xe4/0x25a
  [<ffffffff81d16840>] paging_init+0x13/0x22
  [<ffffffff81d07fbb>] setup_arch+0x9c6/0xa9b
  [<ffffffff81683954>] ? printk+0x3c/0x3e
  [<ffffffff81d01a38>] start_kernel+0xe5/0x468
  [<ffffffff81d012cf>] x86_64_start_reservations+0xba/0xc1
  [<ffffffff81007153>] ? xen_setup_runstate_info+0x2c/0x36
  [<ffffffff81d050ee>] xen_start_kernel+0x565/0x56c
"

so we just disable NUMA scanning by setting numa_off=1.

Reported-and-Tested-by: Andre Przywara <andre.przywara@amd.com>
Acked-by: Andre Przywara <andre.przywara@amd.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/xen/setup.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -17,6 +17,7 @@
 #include <asm/e820.h>
 #include <asm/setup.h>
 #include <asm/acpi.h>
+#include <asm/numa.h>
 #include <asm/xen/hypervisor.h>
 #include <asm/xen/hypercall.h>
 
@@ -549,4 +550,7 @@ void __init xen_arch_setup(void)
 	disable_cpufreq();
 	WARN_ON(set_pm_idle_to_default());
 	fiddle_vdso();
+#ifdef CONFIG_NUMA
+	numa_off = 1;
+#endif
 }



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 109/262] hwmon: (fam15h_power) Tweak runavg_range on resume
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (107 preceding siblings ...)
  2012-09-28 18:50 ` [ 108/262] xen/boot: Disable NUMA for PV guests Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 110/262] hwmon: (ads7871) Add name sysfs attribute Greg Kroah-Hartman
                   ` (152 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Andreas Herrmann, Andreas Hartmann, Jean Delvare

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andreas Herrmann <andreas.herrmann3@amd.com>

commit 5f0ecb907deb1e6f28071ee3bd568903b9da1be4 upstream.

The quirk introduced with commit
00250ec90963b7ef6678438888f3244985ecde14 (hwmon: fam15h_power: fix
bogus values with current BIOSes) is not only required during driver
load but also when system resumes from suspend. The BIOS might set the
previously recommended (but unsuitable) initilization value for the
running average range register during resume.

Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
Tested-by: Andreas Hartmann <andihartmann@01019freenet.de>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hwmon/fam15h_power.c |   15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

--- a/drivers/hwmon/fam15h_power.c
+++ b/drivers/hwmon/fam15h_power.c
@@ -128,12 +128,12 @@ static bool __devinit fam15h_power_is_in
  * counter saturations resulting in bogus power readings.
  * We correct this value ourselves to cope with older BIOSes.
  */
-static DEFINE_PCI_DEVICE_TABLE(affected_device) = {
+static const struct pci_device_id affected_device[] = {
 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) },
 	{ 0 }
 };
 
-static void __devinit tweak_runavg_range(struct pci_dev *pdev)
+static void tweak_runavg_range(struct pci_dev *pdev)
 {
 	u32 val;
 
@@ -157,6 +157,16 @@ static void __devinit tweak_runavg_range
 		REG_TDP_RUNNING_AVERAGE, val);
 }
 
+#ifdef CONFIG_PM
+static int fam15h_power_resume(struct pci_dev *pdev)
+{
+	tweak_runavg_range(pdev);
+	return 0;
+}
+#else
+#define fam15h_power_resume NULL
+#endif
+
 static void __devinit fam15h_power_init_data(struct pci_dev *f4,
 					     struct fam15h_power_data *data)
 {
@@ -255,6 +265,7 @@ static struct pci_driver fam15h_power_dr
 	.id_table = fam15h_power_id_table,
 	.probe = fam15h_power_probe,
 	.remove = __devexit_p(fam15h_power_remove),
+	.resume = fam15h_power_resume,
 };
 
 module_pci_driver(fam15h_power_driver);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 110/262] hwmon: (ads7871) Add name sysfs attribute
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (108 preceding siblings ...)
  2012-09-28 18:50 ` [ 109/262] hwmon: (fam15h_power) Tweak runavg_range on resume Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 111/262] hwmon: (ad7314) " Greg Kroah-Hartman
                   ` (151 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Paul Thomas, Guenter Roeck, Jean Delvare

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Guenter Roeck <linux@roeck-us.net>

commit 4e21f4eaa49f78d3e977e316514c941053871c76 upstream.

The 'name' sysfs attribute is mandatory for hwmon devices, but was missing
in this driver.

Cc: Paul Thomas <pthomas8589@gmail.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Jean Delvare <khali@linux-fr.org>
Acked-by: Paul Thomas <pthomas8589@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hwmon/ads7871.c |    9 +++++++++
 1 file changed, 9 insertions(+)

--- a/drivers/hwmon/ads7871.c
+++ b/drivers/hwmon/ads7871.c
@@ -139,6 +139,12 @@ static ssize_t show_voltage(struct devic
 	}
 }
 
+static ssize_t ads7871_show_name(struct device *dev,
+				 struct device_attribute *devattr, char *buf)
+{
+	return sprintf(buf, "%s\n", to_spi_device(dev)->modalias);
+}
+
 static SENSOR_DEVICE_ATTR(in0_input, S_IRUGO, show_voltage, NULL, 0);
 static SENSOR_DEVICE_ATTR(in1_input, S_IRUGO, show_voltage, NULL, 1);
 static SENSOR_DEVICE_ATTR(in2_input, S_IRUGO, show_voltage, NULL, 2);
@@ -148,6 +154,8 @@ static SENSOR_DEVICE_ATTR(in5_input, S_I
 static SENSOR_DEVICE_ATTR(in6_input, S_IRUGO, show_voltage, NULL, 6);
 static SENSOR_DEVICE_ATTR(in7_input, S_IRUGO, show_voltage, NULL, 7);
 
+static DEVICE_ATTR(name, S_IRUGO, ads7871_show_name, NULL);
+
 static struct attribute *ads7871_attributes[] = {
 	&sensor_dev_attr_in0_input.dev_attr.attr,
 	&sensor_dev_attr_in1_input.dev_attr.attr,
@@ -157,6 +165,7 @@ static struct attribute *ads7871_attribu
 	&sensor_dev_attr_in5_input.dev_attr.attr,
 	&sensor_dev_attr_in6_input.dev_attr.attr,
 	&sensor_dev_attr_in7_input.dev_attr.attr,
+	&dev_attr_name.attr,
 	NULL
 };
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 111/262] hwmon: (ad7314) Add name sysfs attribute
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (109 preceding siblings ...)
  2012-09-28 18:50 ` [ 110/262] hwmon: (ads7871) Add name sysfs attribute Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 112/262] dj: memory scribble in logi_dj Greg Kroah-Hartman
                   ` (150 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Jonathan Cameron, Guenter Roeck, Jean Delvare

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Guenter Roeck <linux@roeck-us.net>

commit 3ceefe4319636d89d4bdf40dca9471970f942e4f upstream.

The 'name' sysfs attribute is mandatory for hwmon devices, but was missing
in this driver.

Cc: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Jean Delvare <khali@linux-fr.org>
Acked-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hwmon/ad7314.c |    8 ++++++++
 1 file changed, 8 insertions(+)

--- a/drivers/hwmon/ad7314.c
+++ b/drivers/hwmon/ad7314.c
@@ -87,10 +87,18 @@ static ssize_t ad7314_show_temperature(s
 	}
 }
 
+static ssize_t ad7314_show_name(struct device *dev,
+				struct device_attribute *devattr, char *buf)
+{
+	return sprintf(buf, "%s\n", to_spi_device(dev)->modalias);
+}
+
+static DEVICE_ATTR(name, S_IRUGO, ad7314_show_name, NULL);
 static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO,
 			  ad7314_show_temperature, NULL, 0);
 
 static struct attribute *ad7314_attributes[] = {
+	&dev_attr_name.attr,
 	&sensor_dev_attr_temp1_input.dev_attr.attr,
 	NULL,
 };



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 112/262] dj: memory scribble in logi_dj
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (110 preceding siblings ...)
  2012-09-28 18:50 ` [ 111/262] hwmon: (ad7314) " Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 113/262] HID: Fix logitech-dj: missing Unifying device issue Greg Kroah-Hartman
                   ` (149 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Alan Cox, Linus Torvalds

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alan Cox <alan@linux.intel.com>

commit 8a55ade76551e3927b4e41ee9e7751875d18bc25 upstream.

Allocate a structure not a pointer to it !

Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hid/hid-logitech-dj.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -439,7 +439,7 @@ static int logi_dj_recv_query_paired_dev
 	struct dj_report *dj_report;
 	int retval;
 
-	dj_report = kzalloc(sizeof(dj_report), GFP_KERNEL);
+	dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
 	if (!dj_report)
 		return -ENOMEM;
 	dj_report->report_id = REPORT_ID_DJ_SHORT;
@@ -456,7 +456,7 @@ static int logi_dj_recv_switch_to_dj_mod
 	struct dj_report *dj_report;
 	int retval;
 
-	dj_report = kzalloc(sizeof(dj_report), GFP_KERNEL);
+	dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
 	if (!dj_report)
 		return -ENOMEM;
 	dj_report->report_id = REPORT_ID_DJ_SHORT;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 113/262] HID: Fix logitech-dj: missing Unifying device issue
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (111 preceding siblings ...)
  2012-09-28 18:50 ` [ 112/262] dj: memory scribble in logi_dj Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 114/262] cifs: fix return value in cifsConvertToUTF16 Greg Kroah-Hartman
                   ` (148 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Nestor Lopez Casado, Jiri Kosina

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nestor Lopez Casado <nlopezcasad@logitech.com>

commit 596264082f10dd4a567c43d4526b2f54ac5520bc upstream.

This patch fixes an issue introduced after commit 4ea5454203d991ec
("HID: Fix race condition between driver core and ll-driver").

After that commit, hid-core discards any incoming packet that arrives while
hid driver's probe function is being executed.

This broke the enumeration process of hid-logitech-dj, that must receive
control packets in-band with the mouse and keyboard packets. Discarding mouse
or keyboard data at the very begining is usually fine, but it is not the case
for control packets.

This patch forces a re-enumeration of the paired devices when a packet arrives
that comes from an unknown device.

Based on a patch originally written by Benjamin Tissoires.

Signed-off-by: Nestor Lopez Casado <nlopezcasad@logitech.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hid/hid-logitech-dj.c |   45 ++++++++++++++++++++++++++++++++++++++++++
 drivers/hid/hid-logitech-dj.h |    1 
 2 files changed, 46 insertions(+)

--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -193,6 +193,7 @@ static struct hid_ll_driver logi_dj_ll_d
 static int logi_dj_output_hidraw_report(struct hid_device *hid, u8 * buf,
 					size_t count,
 					unsigned char report_type);
+static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev);
 
 static void logi_dj_recv_destroy_djhid_device(struct dj_receiver_dev *djrcv_dev,
 						struct dj_report *dj_report)
@@ -233,6 +234,7 @@ static void logi_dj_recv_add_djhid_devic
 	if (dj_report->report_params[DEVICE_PAIRED_PARAM_SPFUNCTION] &
 	    SPFUNCTION_DEVICE_LIST_EMPTY) {
 		dbg_hid("%s: device list is empty\n", __func__);
+		djrcv_dev->querying_devices = false;
 		return;
 	}
 
@@ -243,6 +245,12 @@ static void logi_dj_recv_add_djhid_devic
 		return;
 	}
 
+	if (djrcv_dev->paired_dj_devices[dj_report->device_index]) {
+		/* The device is already known. No need to reallocate it. */
+		dbg_hid("%s: device is already known\n", __func__);
+		return;
+	}
+
 	dj_hiddev = hid_allocate_device();
 	if (IS_ERR(dj_hiddev)) {
 		dev_err(&djrcv_hdev->dev, "%s: hid_allocate_device failed\n",
@@ -306,6 +314,7 @@ static void delayedwork_callback(struct
 	struct dj_report dj_report;
 	unsigned long flags;
 	int count;
+	int retval;
 
 	dbg_hid("%s\n", __func__);
 
@@ -338,6 +347,25 @@ static void delayedwork_callback(struct
 		logi_dj_recv_destroy_djhid_device(djrcv_dev, &dj_report);
 		break;
 	default:
+	/* A normal report (i. e. not belonging to a pair/unpair notification)
+	 * arriving here, means that the report arrived but we did not have a
+	 * paired dj_device associated to the report's device_index, this
+	 * means that the original "device paired" notification corresponding
+	 * to this dj_device never arrived to this driver. The reason is that
+	 * hid-core discards all packets coming from a device while probe() is
+	 * executing. */
+	if (!djrcv_dev->paired_dj_devices[dj_report.device_index]) {
+		/* ok, we don't know the device, just re-ask the
+		 * receiver for the list of connected devices. */
+		retval = logi_dj_recv_query_paired_devices(djrcv_dev);
+		if (!retval) {
+			/* everything went fine, so just leave */
+			break;
+		}
+		dev_err(&djrcv_dev->hdev->dev,
+			"%s:logi_dj_recv_query_paired_devices "
+			"error:%d\n", __func__, retval);
+		}
 		dbg_hid("%s: unexpected report type\n", __func__);
 	}
 }
@@ -368,6 +396,12 @@ static void logi_dj_recv_forward_null_re
 	if (!djdev) {
 		dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]"
 			" is NULL, index %d\n", dj_report->device_index);
+		kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report));
+
+		if (schedule_work(&djrcv_dev->work) == 0) {
+			dbg_hid("%s: did not schedule the work item, was already "
+			"queued\n", __func__);
+		}
 		return;
 	}
 
@@ -398,6 +432,12 @@ static void logi_dj_recv_forward_report(
 	if (dj_device == NULL) {
 		dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]"
 			" is NULL, index %d\n", dj_report->device_index);
+		kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report));
+
+		if (schedule_work(&djrcv_dev->work) == 0) {
+			dbg_hid("%s: did not schedule the work item, was already "
+			"queued\n", __func__);
+		}
 		return;
 	}
 
@@ -439,6 +479,10 @@ static int logi_dj_recv_query_paired_dev
 	struct dj_report *dj_report;
 	int retval;
 
+	/* no need to protect djrcv_dev->querying_devices */
+	if (djrcv_dev->querying_devices)
+		return 0;
+
 	dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
 	if (!dj_report)
 		return -ENOMEM;
@@ -450,6 +494,7 @@ static int logi_dj_recv_query_paired_dev
 	return retval;
 }
 
+
 static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev,
 					  unsigned timeout)
 {
--- a/drivers/hid/hid-logitech-dj.h
+++ b/drivers/hid/hid-logitech-dj.h
@@ -101,6 +101,7 @@ struct dj_receiver_dev {
 	struct work_struct work;
 	struct kfifo notif_fifo;
 	spinlock_t lock;
+	bool querying_devices;
 };
 
 struct dj_device {



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 114/262] cifs: fix return value in cifsConvertToUTF16
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (112 preceding siblings ...)
  2012-09-28 18:50 ` [ 113/262] HID: Fix logitech-dj: missing Unifying device issue Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 115/262] vmwgfx: add dumb ioctl support Greg Kroah-Hartman
                   ` (147 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Baldvin Kovacs, Jeff Layton, Steve French

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jeff Layton <jlayton@redhat.com>

commit c73f693989d7a7d99ec66a7065295a0c93d0b127 upstream.

This function returns the wrong value, which causes the callers to get
the length of the resulting pathname wrong when it contains non-ASCII
characters.

This seems to fix https://bugzilla.samba.org/show_bug.cgi?id=6767

Reported-by: Baldvin Kovacs <baldvin.kovacs@gmail.com>
Reported-and-Tested-by: Nicolas Lefebvre <nico.lefebvre@gmail.com>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/cifs/cifs_unicode.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -328,6 +328,6 @@ cifsConvertToUTF16(__le16 *target, const
 	}
 
 ctoUTF16_out:
-	return i;
+	return j;
 }
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 115/262] vmwgfx: add dumb ioctl support
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (113 preceding siblings ...)
  2012-09-28 18:50 ` [ 114/262] cifs: fix return value in cifsConvertToUTF16 Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 116/262] net: usbnet: fix softirq storm on suspend Greg Kroah-Hartman
                   ` (146 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Jakob Bornecrantz, Dave Airlie

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dave Airlie <airlied@redhat.com>

commit 5e1782d224c79b26ab7d5c31e3f87657000714fb upstream.

Testing and works with the -modesetting driver,

Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/vmwgfx/vmwgfx_drv.c      |    5 ++
 drivers/gpu/drm/vmwgfx/vmwgfx_drv.h      |   10 ++++
 drivers/gpu/drm/vmwgfx/vmwgfx_resource.c |   73 +++++++++++++++++++++++++++++++
 3 files changed, 88 insertions(+)

--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -1159,6 +1159,11 @@ static struct drm_driver driver = {
 	.open = vmw_driver_open,
 	.preclose = vmw_preclose,
 	.postclose = vmw_postclose,
+
+	.dumb_create = vmw_dumb_create,
+	.dumb_map_offset = vmw_dumb_map_offset,
+	.dumb_destroy = vmw_dumb_destroy,
+
 	.fops = &vmwgfx_driver_fops,
 	.name = VMWGFX_DRIVER_NAME,
 	.desc = VMWGFX_DRIVER_DESC,
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -645,6 +645,16 @@ int vmw_kms_readback(struct vmw_private
 int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
 				struct drm_file *file_priv);
 
+int vmw_dumb_create(struct drm_file *file_priv,
+		    struct drm_device *dev,
+		    struct drm_mode_create_dumb *args);
+
+int vmw_dumb_map_offset(struct drm_file *file_priv,
+			struct drm_device *dev, uint32_t handle,
+			uint64_t *offset);
+int vmw_dumb_destroy(struct drm_file *file_priv,
+		     struct drm_device *dev,
+		     uint32_t handle);
 /**
  * Overlay control - vmwgfx_overlay.c
  */
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -1917,3 +1917,76 @@ err_ref:
 	vmw_resource_unreference(&res);
 	return ret;
 }
+
+
+int vmw_dumb_create(struct drm_file *file_priv,
+		    struct drm_device *dev,
+		    struct drm_mode_create_dumb *args)
+{
+	struct vmw_private *dev_priv = vmw_priv(dev);
+	struct vmw_master *vmaster = vmw_master(file_priv->master);
+	struct vmw_user_dma_buffer *vmw_user_bo;
+	struct ttm_buffer_object *tmp;
+	int ret;
+
+	args->pitch = args->width * ((args->bpp + 7) / 8);
+	args->size = args->pitch * args->height;
+
+	vmw_user_bo = kzalloc(sizeof(*vmw_user_bo), GFP_KERNEL);
+	if (vmw_user_bo == NULL)
+		return -ENOMEM;
+
+	ret = ttm_read_lock(&vmaster->lock, true);
+	if (ret != 0) {
+		kfree(vmw_user_bo);
+		return ret;
+	}
+
+	ret = vmw_dmabuf_init(dev_priv, &vmw_user_bo->dma, args->size,
+			      &vmw_vram_sys_placement, true,
+			      &vmw_user_dmabuf_destroy);
+	if (ret != 0)
+		goto out_no_dmabuf;
+
+	tmp = ttm_bo_reference(&vmw_user_bo->dma.base);
+	ret = ttm_base_object_init(vmw_fpriv(file_priv)->tfile,
+				   &vmw_user_bo->base,
+				   false,
+				   ttm_buffer_type,
+				   &vmw_user_dmabuf_release, NULL);
+	if (unlikely(ret != 0))
+		goto out_no_base_object;
+
+	args->handle = vmw_user_bo->base.hash.key;
+
+out_no_base_object:
+	ttm_bo_unref(&tmp);
+out_no_dmabuf:
+	ttm_read_unlock(&vmaster->lock);
+	return ret;
+}
+
+int vmw_dumb_map_offset(struct drm_file *file_priv,
+			struct drm_device *dev, uint32_t handle,
+			uint64_t *offset)
+{
+	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
+	struct vmw_dma_buffer *out_buf;
+	int ret;
+
+	ret = vmw_user_dmabuf_lookup(tfile, handle, &out_buf);
+	if (ret != 0)
+		return -EINVAL;
+
+	*offset = out_buf->base.addr_space_offset;
+	vmw_dmabuf_unreference(&out_buf);
+	return 0;
+}
+
+int vmw_dumb_destroy(struct drm_file *file_priv,
+		     struct drm_device *dev,
+		     uint32_t handle)
+{
+	return ttm_ref_object_base_unref(vmw_fpriv(file_priv)->tfile,
+					 handle, TTM_REF_USAGE);
+}



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 116/262] net: usbnet: fix softirq storm on suspend
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (114 preceding siblings ...)
  2012-09-28 18:50 ` [ 115/262] vmwgfx: add dumb ioctl support Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 117/262] ibmveth: Fix alignment of rx queue bug Greg Kroah-Hartman
                   ` (145 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Bjørn Mork, Ming Lei, Oliver Neukum, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bjørn Mork <bjorn@mork.no>

commit 85e87870fa18ec9f5df98e2d3b48f3699560a570 upstream.

Suspending an open usbnet device results in constant
rescheduling of usbnet_bh.

commit 65841fd5 "usbnet: handle remote wakeup asap"
refactored the usbnet_bh code to allow sharing the
urb allocate and submit code with usbnet_resume. In
this process, a test for, and immediate return on,
ENOLINK from rx_submit was unintentionally dropped.

The rx queue will not grow if rx_submit fails,
making usbnet_bh reschedule itself.  This results
in a softirq storm if the error is persistent.
rx_submit translates the usb_submit_urb error
EHOSTUNREACH into ENOLINK, so this is an expected
and persistent error for a suspended device. The
old code tested for this condition and avoided
rescheduling.  Putting this test back.

Signed-off-by: Bjørn Mork <bjorn@mork.no>
Cc: Ming Lei <ming.lei@canonical.com>
Cc: Oliver Neukum <oneukum@suse.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/usb/usbnet.c |   16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1204,19 +1204,26 @@ deferred:
 }
 EXPORT_SYMBOL_GPL(usbnet_start_xmit);
 
-static void rx_alloc_submit(struct usbnet *dev, gfp_t flags)
+static int rx_alloc_submit(struct usbnet *dev, gfp_t flags)
 {
 	struct urb	*urb;
 	int		i;
+	int		ret = 0;
 
 	/* don't refill the queue all at once */
 	for (i = 0; i < 10 && dev->rxq.qlen < RX_QLEN(dev); i++) {
 		urb = usb_alloc_urb(0, flags);
 		if (urb != NULL) {
-			if (rx_submit(dev, urb, flags) == -ENOLINK)
-				return;
+			ret = rx_submit(dev, urb, flags);
+			if (ret)
+				goto err;
+		} else {
+			ret = -ENOMEM;
+			goto err;
 		}
 	}
+err:
+	return ret;
 }
 
 /*-------------------------------------------------------------------------*/
@@ -1260,7 +1267,8 @@ static void usbnet_bh (unsigned long par
 		int	temp = dev->rxq.qlen;
 
 		if (temp < RX_QLEN(dev)) {
-			rx_alloc_submit(dev, GFP_ATOMIC);
+			if (rx_alloc_submit(dev, GFP_ATOMIC) == -ENOLINK)
+				return;
 			if (temp != dev->rxq.qlen)
 				netif_dbg(dev, link, dev->net,
 					  "rxqlen %d --> %d\n",



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 117/262] ibmveth: Fix alignment of rx queue bug
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (115 preceding siblings ...)
  2012-09-28 18:50 ` [ 116/262] net: usbnet: fix softirq storm on suspend Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 118/262] mac80211: clear bssid on auth/assoc failure Greg Kroah-Hartman
                   ` (144 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Santiago Leon, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Santiago Leon <santil@linux.vnet.ibm.com>

commit d90c92fee89ccd75ef2646f3bde0b4c0450666c3 upstream.

This patch fixes a bug found by Nish Aravamudan
(https://lkml.org/lkml/2012/5/15/220) where the driver is not following
the spec (it is not aligning the rx buffer on a 16-byte boundary) and the
hypervisor aborts the registration, making the device unusable.

The fix follows BenH's recommendation (https://lkml.org/lkml/2012/7/20/461)
to replace the kmalloc+map for a single call to dma_alloc_coherent()
because that function always aligns to a 16-byte boundary.

The stable trees will run into this bug whenever the rx buffer kmalloc call
returns something not aligned on a 16-byte boundary.

Signed-off-by: Santiago Leon <santil@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/ibm/ibmveth.c |   26 +++++++++-----------------
 1 file changed, 9 insertions(+), 17 deletions(-)

--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -472,14 +472,9 @@ static void ibmveth_cleanup(struct ibmve
 	}
 
 	if (adapter->rx_queue.queue_addr != NULL) {
-		if (!dma_mapping_error(dev, adapter->rx_queue.queue_dma)) {
-			dma_unmap_single(dev,
-					adapter->rx_queue.queue_dma,
-					adapter->rx_queue.queue_len,
-					DMA_BIDIRECTIONAL);
-			adapter->rx_queue.queue_dma = DMA_ERROR_CODE;
-		}
-		kfree(adapter->rx_queue.queue_addr);
+		dma_free_coherent(dev, adapter->rx_queue.queue_len,
+				  adapter->rx_queue.queue_addr,
+				  adapter->rx_queue.queue_dma);
 		adapter->rx_queue.queue_addr = NULL;
 	}
 
@@ -556,10 +551,13 @@ static int ibmveth_open(struct net_devic
 		goto err_out;
 	}
 
+	dev = &adapter->vdev->dev;
+
 	adapter->rx_queue.queue_len = sizeof(struct ibmveth_rx_q_entry) *
 						rxq_entries;
-	adapter->rx_queue.queue_addr = kmalloc(adapter->rx_queue.queue_len,
-						GFP_KERNEL);
+	adapter->rx_queue.queue_addr =
+	    dma_alloc_coherent(dev, adapter->rx_queue.queue_len,
+			       &adapter->rx_queue.queue_dma, GFP_KERNEL);
 
 	if (!adapter->rx_queue.queue_addr) {
 		netdev_err(netdev, "unable to allocate rx queue pages\n");
@@ -567,19 +565,13 @@ static int ibmveth_open(struct net_devic
 		goto err_out;
 	}
 
-	dev = &adapter->vdev->dev;
-
 	adapter->buffer_list_dma = dma_map_single(dev,
 			adapter->buffer_list_addr, 4096, DMA_BIDIRECTIONAL);
 	adapter->filter_list_dma = dma_map_single(dev,
 			adapter->filter_list_addr, 4096, DMA_BIDIRECTIONAL);
-	adapter->rx_queue.queue_dma = dma_map_single(dev,
-			adapter->rx_queue.queue_addr,
-			adapter->rx_queue.queue_len, DMA_BIDIRECTIONAL);
 
 	if ((dma_mapping_error(dev, adapter->buffer_list_dma)) ||
-	    (dma_mapping_error(dev, adapter->filter_list_dma)) ||
-	    (dma_mapping_error(dev, adapter->rx_queue.queue_dma))) {
+	    (dma_mapping_error(dev, adapter->filter_list_dma))) {
 		netdev_err(netdev, "unable to map filter or buffer list "
 			   "pages\n");
 		rc = -ENOMEM;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 118/262] mac80211: clear bssid on auth/assoc failure
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (116 preceding siblings ...)
  2012-09-28 18:50 ` [ 117/262] ibmveth: Fix alignment of rx queue bug Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 119/262] brcmfmac: fix big endian bug in i-scan Greg Kroah-Hartman
                   ` (143 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Eliad Peller, Johannes Berg

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eliad Peller <eliad@wizery.com>

commit 3d2abdfdf14f4d6decc2023708211e19b096f4ca upstream.

ifmgd->bssid wasn't cleared properly in some
auth/assoc failure cases, causing mac80211 and
the low-level driver to go out of sync.

Clear ifmgd->bssid on failure, and notify the driver.

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/mac80211/mlme.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3270,6 +3270,8 @@ int ieee80211_mgd_auth(struct ieee80211_
 	goto out_unlock;
 
  err_clear:
+	memset(ifmgd->bssid, 0, ETH_ALEN);
+	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
 	ifmgd->auth_data = NULL;
  err_free:
 	kfree(auth_data);
@@ -3449,6 +3451,8 @@ int ieee80211_mgd_assoc(struct ieee80211
 	err = 0;
 	goto out;
  err_clear:
+	memset(ifmgd->bssid, 0, ETH_ALEN);
+	ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
 	ifmgd->assoc_data = NULL;
  err_free:
 	kfree(assoc_data);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 119/262] brcmfmac: fix big endian bug in i-scan.
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (117 preceding siblings ...)
  2012-09-28 18:50 ` [ 118/262] mac80211: clear bssid on auth/assoc failure Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 120/262] brcmfmac: Fix big endian host configuration data Greg Kroah-Hartman
                   ` (142 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Hante Meuleman, Arend van Spriel, John W. Linville

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Hante Meuleman <meuleman@broadcom.com>

commit ed205b361956c96e0d8c09a8c9135a6a79cd9541 upstream.

ssid len is 32 bit and needs endian conversion for big endian systems.

Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -500,8 +500,10 @@ static void wl_iscan_prep(struct brcmf_s
 	params_le->active_time = cpu_to_le32(-1);
 	params_le->passive_time = cpu_to_le32(-1);
 	params_le->home_time = cpu_to_le32(-1);
-	if (ssid && ssid->SSID_len)
-		memcpy(&params_le->ssid_le, ssid, sizeof(struct brcmf_ssid));
+	if (ssid && ssid->SSID_len) {
+		params_le->ssid_le.SSID_len = cpu_to_le32(ssid->SSID_len);
+		memcpy(&params_le->ssid_le.SSID, ssid->SSID, ssid->SSID_len);
+	}
 }
 
 static s32



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 120/262] brcmfmac: Fix big endian host configuration data.
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (118 preceding siblings ...)
  2012-09-28 18:50 ` [ 119/262] brcmfmac: fix big endian bug in i-scan Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 121/262] SCSI: lpfc: fix problems with -Werror Greg Kroah-Hartman
                   ` (141 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Arend Van Spriel, Hante Meuleman, John W. Linville

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Hante Meuleman <meuleman@broadcom.com>

commit e020a83d0942a5aceac35986500c9834efc8707d upstream.

Fixes big endian host configuration parameters.

Reviewed-by: Arend Van Spriel <arend@broadcom.com>
Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c |   26 +++++++++++--------
 1 file changed, 16 insertions(+), 10 deletions(-)

--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
@@ -764,8 +764,11 @@ static void brcmf_c_arp_offload_set(stru
 {
 	char iovbuf[32];
 	int retcode;
+	__le32 arp_mode_le;
 
-	brcmf_c_mkiovar("arp_ol", (char *)&arp_mode, 4, iovbuf, sizeof(iovbuf));
+	arp_mode_le = cpu_to_le32(arp_mode);
+	brcmf_c_mkiovar("arp_ol", (char *)&arp_mode_le, 4, iovbuf,
+			sizeof(iovbuf));
 	retcode = brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR,
 				   iovbuf, sizeof(iovbuf));
 	retcode = retcode >= 0 ? 0 : retcode;
@@ -781,8 +784,11 @@ static void brcmf_c_arp_offload_enable(s
 {
 	char iovbuf[32];
 	int retcode;
+	__le32 arp_enable_le;
 
-	brcmf_c_mkiovar("arpoe", (char *)&arp_enable, 4,
+	arp_enable_le = cpu_to_le32(arp_enable);
+
+	brcmf_c_mkiovar("arpoe", (char *)&arp_enable_le, 4,
 			iovbuf, sizeof(iovbuf));
 	retcode = brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR,
 				   iovbuf, sizeof(iovbuf));
@@ -802,10 +808,10 @@ int brcmf_c_preinit_dcmds(struct brcmf_p
 	char buf[128], *ptr;
 	u32 dongle_align = drvr->bus_if->align;
 	u32 glom = 0;
-	u32 roaming = 1;
-	uint bcn_timeout = 3;
-	int scan_assoc_time = 40;
-	int scan_unassoc_time = 40;
+	__le32 roaming_le = cpu_to_le32(1);
+	__le32 bcn_timeout_le = cpu_to_le32(3);
+	__le32 scan_assoc_time_le = cpu_to_le32(40);
+	__le32 scan_unassoc_time_le = cpu_to_le32(40);
 	int i;
 
 	mutex_lock(&drvr->proto_block);
@@ -840,14 +846,14 @@ int brcmf_c_preinit_dcmds(struct brcmf_p
 
 	/* Setup timeout if Beacons are lost and roam is off to report
 		 link down */
-	brcmf_c_mkiovar("bcn_timeout", (char *)&bcn_timeout, 4, iovbuf,
+	brcmf_c_mkiovar("bcn_timeout", (char *)&bcn_timeout_le, 4, iovbuf,
 		    sizeof(iovbuf));
 	brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR, iovbuf,
 				  sizeof(iovbuf));
 
 	/* Enable/Disable build-in roaming to allowed ext supplicant to take
 		 of romaing */
-	brcmf_c_mkiovar("roam_off", (char *)&roaming, 4,
+	brcmf_c_mkiovar("roam_off", (char *)&roaming_le, 4,
 		      iovbuf, sizeof(iovbuf));
 	brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR, iovbuf,
 				  sizeof(iovbuf));
@@ -859,9 +865,9 @@ int brcmf_c_preinit_dcmds(struct brcmf_p
 				  sizeof(iovbuf));
 
 	brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_SCAN_CHANNEL_TIME,
-			 (char *)&scan_assoc_time, sizeof(scan_assoc_time));
+		 (char *)&scan_assoc_time_le, sizeof(scan_assoc_time_le));
 	brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_SCAN_UNASSOC_TIME,
-			 (char *)&scan_unassoc_time, sizeof(scan_unassoc_time));
+		 (char *)&scan_unassoc_time_le, sizeof(scan_unassoc_time_le));
 
 	/* Set and enable ARP offload feature */
 	brcmf_c_arp_offload_set(drvr, BRCMF_ARPOL_MODE);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 121/262] SCSI: lpfc: fix problems with -Werror
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (119 preceding siblings ...)
  2012-09-28 18:50 ` [ 120/262] brcmfmac: Fix big endian host configuration data Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 122/262] SCSI: mpt2sas: Fix for issue - Unable to boot from the drive connected to HBA Greg Kroah-Hartman
                   ` (140 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Fengguang Wu, Alex Iannicelli, James Smart,
	Jonathan Nieder, Mike Pagano, James Bottomley

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: James Bottomley <jbottomley@parallels.com>

commit 4bdd03e61b7a5c4c6bc2b25d46fcd491788fdfb3 upstream.

Commit d38bd3aef ("Add -Werror compilation flag") is causing build breakage
with random gcc incarnations.  These look like gcc problems, but we shouldn't
break the build because of a bad gcc.  Fix this by adding a make flag

WARNINGS_BECOME_ERRORS=1

which is the same as aic7xxx uses so ordinarily the build doesn't use -Werror

Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Cc: Alex Iannicelli <alex.iannicelli@emulex.com>
Cc: James Smart <james.smart@emulex.com>
Cc: Jonathan Nieder <jrnieder@gmail.com>
Cc: Mike Pagano <mpagano@gentoo.org>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

---
 drivers/scsi/lpfc/Makefile |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/scsi/lpfc/Makefile
+++ b/drivers/scsi/lpfc/Makefile
@@ -22,7 +22,9 @@
 ccflags-$(GCOV) := -fprofile-arcs -ftest-coverage
 ccflags-$(GCOV) += -O0
 
+ifdef WARNINGS_BECOME_ERRORS
 ccflags-y += -Werror
+endif
 
 obj-$(CONFIG_SCSI_LPFC) := lpfc.o
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 122/262] SCSI: mpt2sas: Fix for issue - Unable to boot from the drive connected to HBA
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (120 preceding siblings ...)
  2012-09-28 18:50 ` [ 121/262] SCSI: lpfc: fix problems with -Werror Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 123/262] SCSI: bnx2i: Fixed NULL ptr deference for 1G bnx2 Linux iSCSI offload Greg Kroah-Hartman
                   ` (139 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Sreekanth Reddy, James Bottomley

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "sreekanth.reddy@lsi.com" <sreekanth.reddy@lsi.com>

commit 10cce6d8b5af0b32bc4254ae4a28423a74c0921c upstream.

This patch checks whether HBA is SAS2008 B0 controller.
if it is a SAS2008 B0 controller then it use IO-APIC interrupt instead of MSIX,
as SAS2008 B0 controller doesn't support MSIX interrupts.

[jejb: fix whitespace problems]
Signed-off-by: Sreekanth Reddy <sreekanth.reddy@lsi.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/mpt2sas/mpt2sas_base.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
@@ -1209,6 +1209,13 @@ _base_check_enable_msix(struct MPT2SAS_A
 	u16 message_control;
 
 
+	/* Check whether controller SAS2008 B0 controller,
+	   if it is SAS2008 B0 controller use IO-APIC instead of MSIX */
+	if (ioc->pdev->device == MPI2_MFGPAGE_DEVID_SAS2008 &&
+	    ioc->pdev->revision == 0x01) {
+		return -EINVAL;
+	}
+
 	base = pci_find_capability(ioc->pdev, PCI_CAP_ID_MSIX);
 	if (!base) {
 		dfailprintk(ioc, printk(MPT2SAS_INFO_FMT "msix not "



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 123/262] SCSI: bnx2i: Fixed NULL ptr deference for 1G bnx2 Linux iSCSI offload
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (121 preceding siblings ...)
  2012-09-28 18:50 ` [ 122/262] SCSI: mpt2sas: Fix for issue - Unable to boot from the drive connected to HBA Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 124/262] SCSI: hpsa: fix handling of protocol error Greg Kroah-Hartman
                   ` (138 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Eddie Wai, Mike Christie, James Bottomley

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eddie Wai <eddie.wai@broadcom.com>

commit d6532207116307eb7ecbfa7b9e02c53230096a50 upstream.

This patch fixes the following kernel panic invoked by uninitialized fields
in the chip initialization for the 1G bnx2 iSCSI offload.

One of the bits in the chip initialization is being used by the latest
firmware to control overflow packets.  When this control bit gets enabled
erroneously, it would ultimately result in a bad packet placement which would
cause the bnx2 driver to dereference a NULL ptr in the placement handler.

This can happen under certain stress I/O environment under the Linux
iSCSI offload operation.

This change only affects Broadcom's 5709 chipset.

Unable to handle kernel NULL pointer dereference at 0000000000000008 RIP:
 [<ffffffff881f0e7d>] :bnx2:bnx2_poll_work+0xd0d/0x13c5
Pid: 0, comm: swapper Tainted: G     ---- 2.6.18-333.el5debug #2
RIP: 0010:[<ffffffff881f0e7d>]  [<ffffffff881f0e7d>] :bnx2:bnx2_poll_work+0xd0d/0x13c5
RSP: 0018:ffff8101b575bd50  EFLAGS: 00010216
RAX: 0000000000000005 RBX: ffff81007c5fb180 RCX: 0000000000000000
RDX: 0000000000000ffc RSI: 00000000817e8000 RDI: 0000000000000220
RBP: ffff81015bbd7ec0 R08: ffff8100817e9000 R09: 0000000000000000
R10: ffff81007c5fb180 R11: 00000000000000c8 R12: 000000007a25a010
R13: 0000000000000000 R14: 0000000000000005 R15: ffff810159f80558
FS:  0000000000000000(0000) GS:ffff8101afebc240(0000) knlGS:0000000000000000
CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 0000000000000008 CR3: 0000000000201000 CR4: 00000000000006a0
Process swapper (pid: 0, threadinfo ffff8101b5754000, task ffff8101afebd820)
Stack:  000000000000000b ffff810159f80000 0000000000000040 ffff810159f80520
 ffff810159f80500 00cf00cf8008e84b ffffc200100939e0 ffff810009035b20
 0000502900000000 000000be00000001 ffff8100817e7810 00d08101b575bea8
Call Trace:
 <IRQ>  [<ffffffff8008e0d0>] show_schedstat+0x1c2/0x25b
 [<ffffffff881f1886>] :bnx2:bnx2_poll+0xf6/0x231
 [<ffffffff8000c9b9>] net_rx_action+0xac/0x1b1
 [<ffffffff800125a0>] __do_softirq+0x89/0x133
 [<ffffffff8005e30c>] call_softirq+0x1c/0x28
 [<ffffffff8006d5de>] do_softirq+0x2c/0x7d
 [<ffffffff8006d46e>] do_IRQ+0xee/0xf7
 [<ffffffff8005d625>] ret_from_intr+0x0/0xa
 <EOI>  [<ffffffff801a5780>] acpi_processor_idle_simple+0x1c5/0x341
 [<ffffffff801a573d>] acpi_processor_idle_simple+0x182/0x341
 [<ffffffff801a55bb>] acpi_processor_idle_simple+0x0/0x341
 [<ffffffff80049560>] cpu_idle+0x95/0xb8
 [<ffffffff80078b1c>] start_secondary+0x479/0x488

Signed-off-by: Eddie Wai <eddie.wai@broadcom.com>
Reviewed-by: Mike Christie <michaelc@cs.wisc.edu>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/bnx2i/bnx2i_hwi.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/scsi/bnx2i/bnx2i_hwi.c
+++ b/drivers/scsi/bnx2i/bnx2i_hwi.c
@@ -1264,6 +1264,9 @@ int bnx2i_send_fw_iscsi_init_msg(struct
 	int rc = 0;
 	u64 mask64;
 
+	memset(&iscsi_init, 0x00, sizeof(struct iscsi_kwqe_init1));
+	memset(&iscsi_init2, 0x00, sizeof(struct iscsi_kwqe_init2));
+
 	bnx2i_adjust_qp_size(hba);
 
 	iscsi_init.flags =



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 124/262] SCSI: hpsa: fix handling of protocol error
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (122 preceding siblings ...)
  2012-09-28 18:50 ` [ 123/262] SCSI: bnx2i: Fixed NULL ptr deference for 1G bnx2 Linux iSCSI offload Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 125/262] SCSI: scsi: virtio-scsi: Fix address translation failure of HighMem pages used by sg list Greg Kroah-Hartman
                   ` (137 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Stephen M. Cameron, James Bottomley

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Stephen M. Cameron" <scameron@beardog.cce.hp.com>

commit 256d0eaac87da1e993190846064f339f4c7a63f5 upstream.

If a command status of CMD_PROTOCOL_ERR is received, this
information should be conveyed to the SCSI mid layer, not
dropped on the floor.  CMD_PROTOCOL_ERR may be received
from the Smart Array for any commands destined for an external
RAID controller such as a P2000, or commands destined for tape
drives or CD/DVD-ROM drives, if for instance a cable is
disconnected.  This mostly affects multipath configurations, as
disconnecting a cable on a non-multipath configuration is not
going to do anything good regardless of whether CMD_PROTOCOL_ERR
is handled correctly or not.  Not handling CMD_PROTOCOL_ERR
correctly in a multipath configaration involving external RAID
controllers may cause data corruption, so this is quite a serious
bug.  This bug should not normally cause a problem for direct
attached disk storage.

Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/hpsa.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -1315,8 +1315,9 @@ static void complete_scsi_command(struct
 	}
 		break;
 	case CMD_PROTOCOL_ERR:
+		cmd->result = DID_ERROR << 16;
 		dev_warn(&h->pdev->dev, "cp %p has "
-			"protocol error \n", cp);
+			"protocol error\n", cp);
 		break;
 	case CMD_HARDWARE_ERR:
 		cmd->result = DID_ERROR << 16;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 125/262] SCSI: scsi: virtio-scsi: Fix address translation failure of HighMem pages used by sg list
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (123 preceding siblings ...)
  2012-09-28 18:50 ` [ 124/262] SCSI: hpsa: fix handling of protocol error Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 126/262] Bluetooth: mgmt: Fix enabling SSP while powered off Greg Kroah-Hartman
                   ` (136 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Wang Sen, Paolo Bonzini, James Bottomley

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Wang Sen <senwang@linux.vnet.ibm.com>

commit 27e99ade81368e6fdda3212bff9345177cf9e57a upstream.

When using the commands below to write some data to a virtio-scsi LUN of the
QEMU guest(32-bit) with 1G physical memory(qemu -m 1024), the qemu will crash.

        # sudo mkfs.ext4 /dev/sdb  (/dev/sdb is the virtio-scsi LUN.)
        # sudo mount /dev/sdb /mnt
        # dd if=/dev/zero of=/mnt/file bs=1M count=1024

In current implementation, sg_set_buf is called to add buffers to sg list which
is put into the virtqueue eventually. But if there are some HighMem pages in
table->sgl you can not get virtual address by sg_virt. So, sg_virt(sg_elem) may
return NULL value. This will cause QEMU exit when virtqueue_map_sg is called
in QEMU because an invalid GPA is passed by virtqueue.

Two solutions are discussed here:
http://lkml.indiana.edu/hypermail/linux/kernel/1207.3/00675.html

Finally, value assignment approach was adopted because:

Value assignment creates a well-formed scatterlist, because the termination
marker in source sg_list has been set in blk_rq_map_sg(). The last entry of the
source sg_list is just copied to the the last entry in destination list.  Note
that, for now, virtio_ring does not care about the form of the scatterlist and
simply processes the first out_num + in_num consecutive elements of the sg[]
array.

I have tested the patch on my workstation. QEMU would not crash any more.

Signed-off-by: Wang Sen <senwang@linux.vnet.ibm.com>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/virtio_scsi.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -198,7 +198,7 @@ static void virtscsi_map_sgl(struct scat
 	int i;
 
 	for_each_sg(table->sgl, sg_elem, table->nents, i)
-		sg_set_buf(&sg[idx++], sg_virt(sg_elem), sg_elem->length);
+		sg[idx++] = *sg_elem;
 
 	*p_idx = idx;
 }



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 126/262] Bluetooth: mgmt: Fix enabling SSP while powered off
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (124 preceding siblings ...)
  2012-09-28 18:50 ` [ 125/262] SCSI: scsi: virtio-scsi: Fix address translation failure of HighMem pages used by sg list Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 127/262] Bluetooth: Fix not removing power_off delayed work Greg Kroah-Hartman
                   ` (135 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Andrzej Kaczmarek, Johan Hedberg, Gustavo Padovan

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>

commit 3d1cbdd6aefff711bcf389fdabc4af9bc22e8201 upstream.

When new BT USB adapter is plugged in it's configured while still being powered
off (HCI_AUTO_OFF flag is set), thus Set SSP will only set dev_flags but won't
write changes to controller. As a result remote devices won't use Secure Simple
Pairing with our device due to SSP Host Support flag disabled in extended
features and may also reject SSP attempt from our side (with possible fallback
to legacy pairing).

This patch ensures HCI Write Simple Pairing Mode is sent when Set Powered is
called to power on controller and clear HCI_AUTO_OFF flag.

Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/bluetooth/mgmt.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -2879,6 +2879,12 @@ int mgmt_powered(struct hci_dev *hdev, u
 		if (scan)
 			hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 
+		if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
+			u8 ssp = 1;
+
+			hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
+		}
+
 		update_class(hdev);
 		update_name(hdev, hdev->dev_name);
 		update_eir(hdev);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 127/262] Bluetooth: Fix not removing power_off delayed work
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (125 preceding siblings ...)
  2012-09-28 18:50 ` [ 126/262] Bluetooth: mgmt: Fix enabling SSP while powered off Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 128/262] Bluetooth: mgmt: Fix enabling LE while powered off Greg Kroah-Hartman
                   ` (134 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Vinicius Costa Gomes, Gustavo Padovan

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>

commit 78c04c0bf52360dc2f7185e99c8e9aa05d73ae5a upstream.

For example, when a usb reset is received (I could reproduce it
running something very similar to this[1] in a loop) it could be
that the device is unregistered while the power_off delayed work
is still scheduled to run.

Backtrace:

WARNING: at lib/debugobjects.c:261 debug_print_object+0x7c/0x8d()
Hardware name: To Be Filled By O.E.M.
ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x26
Modules linked in: nouveau mxm_wmi btusb wmi bluetooth ttm coretemp drm_kms_helper
Pid: 2114, comm: usb-reset Not tainted 3.5.0bt-next #2
Call Trace:
 [<ffffffff8124cc00>] ? free_obj_work+0x57/0x91
 [<ffffffff81058f88>] warn_slowpath_common+0x7e/0x97
 [<ffffffff81059035>] warn_slowpath_fmt+0x41/0x43
 [<ffffffff8124ccb6>] debug_print_object+0x7c/0x8d
 [<ffffffff8106e3ec>] ? __queue_work+0x259/0x259
 [<ffffffff8124d63e>] ? debug_check_no_obj_freed+0x6f/0x1b5
 [<ffffffff8124d667>] debug_check_no_obj_freed+0x98/0x1b5
 [<ffffffffa00aa031>] ? bt_host_release+0x10/0x1e [bluetooth]
 [<ffffffff810fc035>] kfree+0x90/0xe6
 [<ffffffffa00aa031>] bt_host_release+0x10/0x1e [bluetooth]
 [<ffffffff812ec2f9>] device_release+0x4a/0x7e
 [<ffffffff8123ef57>] kobject_release+0x11d/0x154
 [<ffffffff8123ed98>] kobject_put+0x4a/0x4f
 [<ffffffff812ec0d9>] put_device+0x12/0x14
 [<ffffffffa009472b>] hci_free_dev+0x22/0x26 [bluetooth]
 [<ffffffffa0280dd0>] btusb_disconnect+0x96/0x9f [btusb]
 [<ffffffff813581b4>] usb_unbind_interface+0x57/0x106
 [<ffffffff812ef988>] __device_release_driver+0x83/0xd6
 [<ffffffff812ef9fb>] device_release_driver+0x20/0x2d
 [<ffffffff813582a7>] usb_driver_release_interface+0x44/0x7b
 [<ffffffff81358795>] usb_forced_unbind_intf+0x45/0x4e
 [<ffffffff8134f959>] usb_reset_device+0xa6/0x12e
 [<ffffffff8135df86>] usbdev_do_ioctl+0x319/0xe20
 [<ffffffff81203244>] ? avc_has_perm_flags+0xc9/0x12e
 [<ffffffff812031a0>] ? avc_has_perm_flags+0x25/0x12e
 [<ffffffff81050101>] ? do_page_fault+0x31e/0x3a1
 [<ffffffff8135eaa6>] usbdev_ioctl+0x9/0xd
 [<ffffffff811126b1>] vfs_ioctl+0x21/0x34
 [<ffffffff81112f7b>] do_vfs_ioctl+0x408/0x44b
 [<ffffffff81208d45>] ? file_has_perm+0x76/0x81
 [<ffffffff8111300f>] sys_ioctl+0x51/0x76
 [<ffffffff8158db22>] system_call_fastpath+0x16/0x1b

[1] http://cpansearch.perl.org/src/DPAVLIN/Biblio-RFID-0.03/examples/usbreset.c

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/bluetooth/hci_core.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -753,6 +753,8 @@ static int hci_dev_do_close(struct hci_d
 
 	cancel_work_sync(&hdev->le_scan);
 
+	cancel_delayed_work(&hdev->power_off);
+
 	hci_req_cancel(hdev, ENODEV);
 	hci_req_lock(hdev);
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 128/262] Bluetooth: mgmt: Fix enabling LE while powered off
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (126 preceding siblings ...)
  2012-09-28 18:50 ` [ 127/262] Bluetooth: Fix not removing power_off delayed work Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 129/262] c/r: prctl: fix build error for no-MMU case Greg Kroah-Hartman
                   ` (133 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Andrzej Kaczmarek, Johan Hedberg, Gustavo Padovan

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>

commit 562fcc246ebe31ade6e1be08585673b9b2785498 upstream.

When new BT USB adapter is plugged in it's configured while still being powered
off (HCI_AUTO_OFF flag is set), thus Set LE will only set dev_flags but won't
write changes to controller. As a result it's not possible to start device
discovery session on LE controller as it uses interleaved discovery which
requires LE Supported Host flag in extended features.

This patch ensures HCI Write LE Host Supported is sent when Set Powered is
called to power on controller and clear HCI_AUTO_OFF flag.

Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/bluetooth/mgmt.c |   10 ++++++++++
 1 file changed, 10 insertions(+)

--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -2885,6 +2885,16 @@ int mgmt_powered(struct hci_dev *hdev, u
 			hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
 		}
 
+		if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
+			struct hci_cp_write_le_host_supported cp;
+
+			cp.le = 1;
+			cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
+
+			hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED,
+				     sizeof(cp), &cp);
+		}
+
 		update_class(hdev);
 		update_name(hdev, hdev->dev_name);
 		update_eir(hdev);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 129/262] c/r: prctl: fix build error for no-MMU case
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (127 preceding siblings ...)
  2012-09-28 18:50 ` [ 128/262] Bluetooth: mgmt: Fix enabling LE while powered off Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:50 ` [ 130/262] hpwdt: Fix kdump issue in hpwdt Greg Kroah-Hartman
                   ` (132 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Mark Salter, Cyrill Gorcunov, Andrew Morton,
	Linus Torvalds

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mark Salter <msalter@redhat.com>

commit be8cfc4af15cf611dfeb66a1fb5df43d5f1e280a upstream.

Commit 1ad75b9e1628 ("c/r: prctl: add minimal address test to
PR_SET_MM") added some address checking to prctl_set_mm() used by
checkpoint-restore.  This causes a build error for no-MMU systems:

   kernel/sys.c: In function 'prctl_set_mm':
   kernel/sys.c:1868:34: error: 'mmap_min_addr' undeclared (first use in this function)

The test for mmap_min_addr doesn't make a lot of sense for no-MMU code
as noted in commit 6e1415467614 ("NOMMU: Optimise away the
{dac_,}mmap_min_addr tests").

This patch defines mmap_min_addr as 0UL in the no-MMU case so that the
compiler will optimize away tests for "addr < mmap_min_addr".

Signed-off-by: Mark Salter <msalter@redhat.com>
Reviewed-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/security.h |    1 +
 1 file changed, 1 insertion(+)

--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -118,6 +118,7 @@ void reset_security_ops(void);
 extern unsigned long mmap_min_addr;
 extern unsigned long dac_mmap_min_addr;
 #else
+#define mmap_min_addr		0UL
 #define dac_mmap_min_addr	0UL
 #endif
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 130/262] hpwdt: Fix kdump issue in hpwdt
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (128 preceding siblings ...)
  2012-09-28 18:50 ` [ 129/262] c/r: prctl: fix build error for no-MMU case Greg Kroah-Hartman
@ 2012-09-28 18:50 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 131/262] ARM: imx: armadillo5x0: Fix illegal register access Greg Kroah-Hartman
                   ` (131 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:50 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Toshi Kani, Lisa Mitchell, Thomas Mingarelli,
	Wim Van Sebroeck

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Toshi Kani <toshi.kani@hp.com>

commit 308b135e4fcc00c80c07e0e04e7afa8edf78583c upstream.

kdump can be interrupted by watchdog timer when the timer is left
activated on the crash kernel. Changed the hpwdt driver to disable
watchdog timer at boot-time. This assures that watchdog timer is
disabled until /dev/watchdog is opened, and prevents watchdog timer
to be left running on the crash kernel.

Signed-off-by: Toshi Kani <toshi.kani@hp.com>
Tested-by: Lisa Mitchell <lisa.mitchell@hp.com>
Signed-off-by: Thomas Mingarelli <Thomas.Mingarelli@hp.com>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/watchdog/hpwdt.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -814,6 +814,9 @@ static int __devinit hpwdt_init_one(stru
 	hpwdt_timer_reg = pci_mem_addr + 0x70;
 	hpwdt_timer_con = pci_mem_addr + 0x72;
 
+	/* Make sure that timer is disabled until /dev/watchdog is opened */
+	hpwdt_stop();
+
 	/* Make sure that we have a valid soft_margin */
 	if (hpwdt_change_timer(soft_margin))
 		hpwdt_change_timer(DEFAULT_MARGIN);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 131/262] ARM: imx: armadillo5x0: Fix illegal register access
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (129 preceding siblings ...)
  2012-09-28 18:50 ` [ 130/262] hpwdt: Fix kdump issue in hpwdt Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 132/262] ARM: 7532/1: decompressor: reset SCTLR.TRE for VMSA ARMv7 cores Greg Kroah-Hartman
                   ` (130 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Arnd Bergmann, Fabio Estevam, Sascha Hauer

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Fabio Estevam <fabio.estevam@freescale.com>

commit 35495173e1df621dff0e9a244accbe32cd28a98f upstream.

Since commit eb92044eb (ARM i.MX3: Make ccm base address a variable )
it is necessary to pass the CCM register base as a variable.

Fix the CCM register access in mach-armadillo5x0 by passing mx3_ccm_base and
avoid illegal accesses.

Also applies to v3.5

Reported-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/mach-imx/mach-armadillo5x0.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/arch/arm/mach-imx/mach-armadillo5x0.c
+++ b/arch/arm/mach-imx/mach-armadillo5x0.c
@@ -526,7 +526,8 @@ static void __init armadillo5x0_init(voi
 	imx31_add_mxc_nand(&armadillo5x0_nand_board_info);
 
 	/* set NAND page size to 2k if not configured via boot mode pins */
-	__raw_writel(__raw_readl(MXC_CCM_RCSR) | (1 << 30), MXC_CCM_RCSR);
+	__raw_writel(__raw_readl(mx3_ccm_base + MXC_CCM_RCSR) |
+					(1 << 30), mx3_ccm_base + MXC_CCM_RCSR);
 
 	/* RTC */
 	/* Get RTC IRQ and register the chip */



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 132/262] ARM: 7532/1: decompressor: reset SCTLR.TRE for VMSA ARMv7 cores
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (130 preceding siblings ...)
  2012-09-28 18:51 ` [ 131/262] ARM: imx: armadillo5x0: Fix illegal register access Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 133/262] tracing: Dont call page_to_pfn() if page is NULL Greg Kroah-Hartman
                   ` (129 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Nicolas Pitre, Will Deacon, Matthew Leach, Russell King

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Matthew Leach <matthew.leach@arm.com>

commit e1e5b7e4251c7538ca08c2c5545b0c2fbd8a6635 upstream.

This patch zeroes the SCTLR.TRE bit prior to setting the mapping as
cacheable for ARMv7 cores in the decompressor, ensuring that the
memory region attributes are obtained from the C and B bits, not from
the page tables.

Cc: Nicolas Pitre <nico@fluxnic.net>
Reviewed-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Matthew Leach <matthew.leach@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/compressed/head.S |    1 +
 1 file changed, 1 insertion(+)

--- a/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@ -653,6 +653,7 @@ __armv7_mmu_cache_on:
 		mcrne	p15, 0, r0, c8, c7, 0	@ flush I,D TLBs
 #endif
 		mrc	p15, 0, r0, c1, c0, 0	@ read control reg
+		bic	r0, r0, #1 << 28	@ clear SCTLR.TRE
 		orr	r0, r0, #0x5000		@ I-cache enable, RR cache replacement
 		orr	r0, r0, #0x003c		@ write buffer
 #ifdef CONFIG_MMU



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 133/262] tracing: Dont call page_to_pfn() if page is NULL
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (131 preceding siblings ...)
  2012-09-28 18:51 ` [ 132/262] ARM: 7532/1: decompressor: reset SCTLR.TRE for VMSA ARMv7 cores Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 134/262] Input: i8042 - disable mux on Toshiba C850D Greg Kroah-Hartman
                   ` (128 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Mel Gorman, Frederic Weisbecker, Ingo Molnar,
	Andrew Morton, Minchan Kim, Wen Congyang, Steven Rostedt

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Wen Congyang <wency@cn.fujitsu.com>

commit 85f2a2ef1d0ab99523e0b947a2b723f5650ed6aa upstream.

When allocating memory fails, page is NULL. page_to_pfn() will
cause the kernel panicked if we don't use sparsemem vmemmap.

Link: http://lkml.kernel.org/r/505AB1FF.8020104@cn.fujitsu.com

Acked-by: Mel Gorman <mel@csn.ul.ie>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Minchan Kim <minchan@kernel.org>
Signed-off-by: Wen Congyang <wency@cn.fujitsu.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/trace/events/kmem.h |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/include/trace/events/kmem.h
+++ b/include/trace/events/kmem.h
@@ -214,7 +214,7 @@ TRACE_EVENT(mm_page_alloc,
 
 	TP_printk("page=%p pfn=%lu order=%d migratetype=%d gfp_flags=%s",
 		__entry->page,
-		page_to_pfn(__entry->page),
+		__entry->page ? page_to_pfn(__entry->page) : 0,
 		__entry->order,
 		__entry->migratetype,
 		show_gfp_flags(__entry->gfp_flags))
@@ -240,7 +240,7 @@ DECLARE_EVENT_CLASS(mm_page,
 
 	TP_printk("page=%p pfn=%lu order=%u migratetype=%d percpu_refill=%d",
 		__entry->page,
-		page_to_pfn(__entry->page),
+		__entry->page ? page_to_pfn(__entry->page) : 0,
 		__entry->order,
 		__entry->migratetype,
 		__entry->order == 0)



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 134/262] Input: i8042 - disable mux on Toshiba C850D
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (132 preceding siblings ...)
  2012-09-28 18:51 ` [ 133/262] tracing: Dont call page_to_pfn() if page is NULL Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 135/262] MIPS: mm: Add compound tail page _mapcount when mapped Greg Kroah-Hartman
                   ` (127 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Anisse Astier, Dmitry Torokhov

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Anisse Astier <anisse@astier.eu>

commit 8669cf6793bb38307a30fb6b9565ddc8840ebd3f upstream.

On Toshiba Satellite C850D, the touchpad and the keyboard might randomly
not work at boot. Preventing MUX mode activation solves this issue.

Signed-off-by: Anisse Astier <anisse@astier.eu>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/serio/i8042-x86ia64io.h |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -335,6 +335,12 @@ static const struct dmi_system_id __init
 	},
 	{
 		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE C850D"),
+		},
+	},
+	{
+		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "ALIENWARE"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Sentia"),
 		},



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 135/262] MIPS: mm: Add compound tail page _mapcount when mapped
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (133 preceding siblings ...)
  2012-09-28 18:51 ` [ 134/262] Input: i8042 - disable mux on Toshiba C850D Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 136/262] perf/x86/ibs: Check syscall attribute flags Greg Kroah-Hartman
                   ` (126 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Jovi Zhang, Youquan Song, Andi Kleen, Ralf Baechle

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jovi Zhang <bookjovi@gmail.com>

commit af89fa3986b9d034a286544ab1ed95096496a2f9 upstream.

See commit b6999b191 which did the same modification for x86's mm/gup,

Quote from commit b6999b191:
    "If compound pages are used and the page is a
    tail page, gup_huge_pmd() increases _mapcount to record tail page are
    mapped while gup_huge_pud does not do that."

[ralf@linux-mips.org: fixed rejects caused by the original patch getting
linewrapped.]

Signed-off-by: Jovi Zhang <boojovi@gmail.com>
Cc: Youquan Song <youquan.song@intel.com>
Cc: Andi Kleen <andi@firstfloor.org>
Patchwork: https://patchwork.linux-mips.org/patch/4291/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/mm/gup.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/arch/mips/mm/gup.c
+++ b/arch/mips/mm/gup.c
@@ -152,6 +152,8 @@ static int gup_huge_pud(pud_t pud, unsig
 	do {
 		VM_BUG_ON(compound_head(page) != head);
 		pages[*nr] = page;
+		if (PageTail(page))
+			get_huge_page_tail(page);
 		(*nr)++;
 		page++;
 		refs++;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 136/262] perf/x86/ibs: Check syscall attribute flags
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (134 preceding siblings ...)
  2012-09-28 18:51 ` [ 135/262] MIPS: mm: Add compound tail page _mapcount when mapped Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 137/262] rtlwifi: rtl8192ce: Log message that B_CUT device may not work Greg Kroah-Hartman
                   ` (125 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Robert Richter, Peter Zijlstra, Ingo Molnar

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Robert Richter <robert.richter@amd.com>

commit bad9ac2d7f878a31cf1ae8c1ee3768077d222bcb upstream.

Current implementation simply ignores attribute flags. Thus, there is
no notification to userland of unsupported features. Check syscall's
attribute flags to let userland know if a feature is supported by the
kernel. This is also needed to distinguish between future kernels what
might support a feature.

Signed-off-by: Robert Richter <robert.richter@amd.com>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Link: http://lkml.kernel.org/r/20120910093018.GO8285@erda.amd.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kernel/cpu/perf_event_amd_ibs.c |   12 ++++++++++++
 include/linux/perf_event.h               |    2 ++
 2 files changed, 14 insertions(+)

--- a/arch/x86/kernel/cpu/perf_event_amd_ibs.c
+++ b/arch/x86/kernel/cpu/perf_event_amd_ibs.c
@@ -207,6 +207,15 @@ static int perf_ibs_precise_event(struct
 	return -EOPNOTSUPP;
 }
 
+static const struct perf_event_attr ibs_notsupp = {
+	.exclude_user	= 1,
+	.exclude_kernel	= 1,
+	.exclude_hv	= 1,
+	.exclude_idle	= 1,
+	.exclude_host	= 1,
+	.exclude_guest	= 1,
+};
+
 static int perf_ibs_init(struct perf_event *event)
 {
 	struct hw_perf_event *hwc = &event->hw;
@@ -227,6 +236,9 @@ static int perf_ibs_init(struct perf_eve
 	if (event->pmu != &perf_ibs->pmu)
 		return -ENOENT;
 
+	if (perf_flags(&event->attr) & perf_flags(&ibs_notsupp))
+		return -EINVAL;
+
 	if (config & ~perf_ibs->config_mask)
 		return -EINVAL;
 
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -274,6 +274,8 @@ struct perf_event_attr {
 	__u64	branch_sample_type; /* enum branch_sample_type */
 };
 
+#define perf_flags(attr)	(*(&(attr)->read_format + 1))
+
 /*
  * Ioctls that can be done on a perf event fd:
  */



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 137/262] rtlwifi: rtl8192ce: Log message that B_CUT device may not work
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (135 preceding siblings ...)
  2012-09-28 18:51 ` [ 136/262] perf/x86/ibs: Check syscall attribute flags Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 138/262] asix: Support DLink DUB-E100 H/W Ver C1 Greg Kroah-Hartman
                   ` (124 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Larry Finger, Anisse Astier, Li Chaoming,
	John W. Linville

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Larry Finger <Larry.Finger@lwfinger.net>

commit 022e1d0680c7b4366017393417b8758be5abcee8 upstream.

There are a number of problems that occur for the latest version
of the Realtek RTL8188CE device with the in-kernel driver. These
include selection of the wrong firmware, and system lockup. A full
fix is known, but is too invasive for inclusion in stable. This patch
fixes the problem with loading the wrong firmware, and logs a message
that the device may not work for kernels 3.6 and older.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Anisse Astier <anisse@astier.eu>
Cc: Li Chaoming <chaoming_li@realsil.com.cn>
Tested-by: Anisse Astier <anisse@astier.eu>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/rtlwifi/rtl8192ce/def.h |    1 +
 drivers/net/wireless/rtlwifi/rtl8192ce/hw.c  |   12 ++++++++++--
 drivers/net/wireless/rtlwifi/rtl8192ce/sw.c  |    6 ++++--
 3 files changed, 15 insertions(+), 4 deletions(-)

--- a/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
@@ -117,6 +117,7 @@
 
 #define CHIP_VER_B			BIT(4)
 #define CHIP_92C_BITMASK		BIT(0)
+#define CHIP_UNKNOWN			BIT(7)
 #define CHIP_92C_1T2R			0x03
 #define CHIP_92C			0x01
 #define CHIP_88C			0x00
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
@@ -995,8 +995,16 @@ static enum version_8192c _rtl92ce_read_
 		version = (value32 & TYPE_ID) ? VERSION_A_CHIP_92C :
 			   VERSION_A_CHIP_88C;
 	} else {
-		version = (value32 & TYPE_ID) ? VERSION_B_CHIP_92C :
-			   VERSION_B_CHIP_88C;
+		version = (enum version_8192c) (CHIP_VER_B |
+				((value32 & TYPE_ID) ? CHIP_92C_BITMASK : 0) |
+				((value32 & VENDOR_ID) ? CHIP_VENDOR_UMC : 0));
+		if ((!IS_CHIP_VENDOR_UMC(version)) && (value32 &
+		     CHIP_VER_RTL_MASK)) {
+			version = (enum version_8192c)(version |
+				   ((((value32 & CHIP_VER_RTL_MASK) == BIT(12))
+				   ? CHIP_VENDOR_UMC_B_CUT : CHIP_UNKNOWN) |
+				   CHIP_VENDOR_UMC));
+		}
 	}
 
 	switch (version) {
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
@@ -162,10 +162,12 @@ int rtl92c_init_sw_vars(struct ieee80211
 
 	/* request fw */
 	if (IS_VENDOR_UMC_A_CUT(rtlhal->version) &&
-	    !IS_92C_SERIAL(rtlhal->version))
+	    !IS_92C_SERIAL(rtlhal->version)) {
 		rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cfwU.bin";
-	else if (IS_81xxC_VENDOR_UMC_B_CUT(rtlhal->version))
+	} else if (IS_81xxC_VENDOR_UMC_B_CUT(rtlhal->version)) {
 		rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cfwU_B.bin";
+		pr_info("****** This B_CUT device may not work with kernels 3.6 and earlier\n");
+	}
 
 	rtlpriv->max_fw_size = 0x4000;
 	pr_info("Using firmware %s\n", rtlpriv->cfg->fw_name);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 138/262] asix: Support DLink DUB-E100 H/W Ver C1
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (136 preceding siblings ...)
  2012-09-28 18:51 ` [ 137/262] rtlwifi: rtl8192ce: Log message that B_CUT device may not work Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 139/262] can: ti_hecc: fix oops during rmmod Greg Kroah-Hartman
                   ` (123 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Søren Holm, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Søren Holm <sgh@sgh.dk>

commit ed3770a9cd5764a575b83810ea679bbff2b03082 upstream.

Signed-off-by: Søren Holm <sgh@sgh.dk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/usb/asix.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/net/usb/asix.c
+++ b/drivers/net/usb/asix.c
@@ -1604,6 +1604,10 @@ static const struct usb_device_id	produc
 	USB_DEVICE (0x2001, 0x3c05),
 	.driver_info = (unsigned long) &ax88772_info,
 }, {
+       // DLink DUB-E100 H/W Ver C1
+       USB_DEVICE (0x2001, 0x1a02),
+       .driver_info = (unsigned long) &ax88772_info,
+}, {
 	// Linksys USB1000
 	USB_DEVICE (0x1737, 0x0039),
 	.driver_info = (unsigned long) &ax88178_info,



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 139/262] can: ti_hecc: fix oops during rmmod
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (137 preceding siblings ...)
  2012-09-28 18:51 ` [ 138/262] asix: Support DLink DUB-E100 H/W Ver C1 Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 140/262] can: janz-ican3: fix support for older hardware revisions Greg Kroah-Hartman
                   ` (122 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Jan Luebbe, Anant Gole, Marc Kleine-Budde

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marc Kleine-Budde <mkl@pengutronix.de>

commit ab04c8bd423edb03e2148350a091836c196107fc upstream.

This patch fixes an oops which occurs when unloading the driver, while the
network interface is still up. The problem is that first the io mapping is
teared own, then the CAN device is unregistered, resulting in accessing the
hardware's iomem:

[  172.744232] Unable to handle kernel paging request at virtual address c88b0040
[  172.752441] pgd = c7be4000
[  172.755645] [c88b0040] *pgd=87821811, *pte=00000000, *ppte=00000000
[  172.762207] Internal error: Oops: 807 [#1] PREEMPT ARM
[  172.767517] Modules linked in: ti_hecc(-) can_dev
[  172.772430] CPU: 0    Not tainted  (3.5.0alpha-00037-g3554cc0 #126)
[  172.778961] PC is at ti_hecc_close+0xb0/0x100 [ti_hecc]
[  172.784423] LR is at __dev_close_many+0x90/0xc0
[  172.789123] pc : [<bf00c768>]    lr : [<c033be58>]    psr: 60000013
[  172.789123] sp : c5c1de68  ip : 00040081  fp : 00000000
[  172.801025] r10: 00000001  r9 : c5c1c000  r8 : 00100100
[  172.806457] r7 : c5d0a48c  r6 : c5d0a400  r5 : 00000000  r4 : c5d0a000
[  172.813232] r3 : c88b0000  r2 : 00000001  r1 : c5d0a000  r0 : c5d0a000
[  172.820037] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
[  172.827423] Control: 10c5387d  Table: 87be4019  DAC: 00000015
[  172.833404] Process rmmod (pid: 600, stack limit = 0xc5c1c2f0)
[  172.839447] Stack: (0xc5c1de68 to 0xc5c1e000)
[  172.843994] de60:                   bf00c6b8 c5c1dec8 c5d0a000 c5d0a000 00200200 c033be58
[  172.852478] de80: c5c1de44 c5c1dec8 c5c1dec8 c033bf2c c5c1de90 c5c1de90 c5d0a084 c5c1de44
[  172.860992] dea0: c5c1dec8 c033c098 c061d3dc c5d0a000 00000000 c05edf28 c05edb34 c000d724
[  172.869476] dec0: 00000000 c033c2f8 c5d0a084 c5d0a084 00000000 c033c370 00000000 c5d0a000
[  172.877990] dee0: c05edb00 c033c3b8 c5d0a000 bf00d3ac c05edb00 bf00d7c8 bf00d7c8 c02842dc
[  172.886474] df00: c02842c8 c0282f90 c5c1c000 c05edb00 bf00d7c8 c0283668 bf00d7c8 00000000
[  172.894989] df20: c0611f98 befe2f80 c000d724 c0282d10 bf00d804 00000000 00000013 c0068a8c
[  172.903472] df40: c5c538e8 685f6974 00636365 c61571a8 c5cb9980 c61571a8 c6158a20 c00c9bc4
[  172.911987] df60: 00000000 00000000 c5cb9980 00000000 c5cb9980 00000000 c7823680 00000006
[  172.920471] df80: bf00d804 00000880 c5c1df8c 00000000 000d4267 befe2f80 00000001 b6d90068
[  172.928985] dfa0: 00000081 c000d5a0 befe2f80 00000001 befe2f80 00000880 b6d90008 00000008
[  172.937469] dfc0: befe2f80 00000001 b6d90068 00000081 00000001 00000000 befe2eac 00000000
[  172.945983] dfe0: 00000000 befe2b18 00023ba4 b6e6addc 60000010 befe2f80 a8e00190 86d2d344
[  172.954498] [<bf00c768>] (ti_hecc_close+0xb0/0x100 [ti_hecc]) from [<c033be58>] (__dev__registered_many+0xc0/0x2a0)
[  172.984161] [<c033c098>] (rollback_registered_many+0xc0/0x2a0) from [<c033c2f8>] (rollback_registered+0x20/0x30)
[  172.994750] [<c033c2f8>] (rollback_registered+0x20/0x30) from [<c033c370>] (unregister_netdevice_queue+0x68/0x98)
[  173.005401] [<c033c370>] (unregister_netdevice_queue+0x68/0x98) from [<c033c3b8>] (unregister_netdev+0x18/0x20)
[  173.015899] [<c033c3b8>] (unregister_netdev+0x18/0x20) from [<bf00d3ac>] (ti_hecc_remove+0x60/0x80 [ti_hecc])
[  173.026245] [<bf00d3ac>] (ti_hecc_remove+0x60/0x80 [ti_hecc]) from [<c02842dc>] (platform_drv_remove+0x14/0x18)
[  173.036712] [<c02842dc>] (platform_drv_remove+0x14/0x18) from [<c0282f90>] (__device_release_driver+0x7c/0xbc)

Tested-by: Jan Luebbe <jlu@pengutronix.de>
Cc: Anant Gole <anantgole@ti.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/can/ti_hecc.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/can/ti_hecc.c
+++ b/drivers/net/can/ti_hecc.c
@@ -984,12 +984,12 @@ static int __devexit ti_hecc_remove(stru
 	struct net_device *ndev = platform_get_drvdata(pdev);
 	struct ti_hecc_priv *priv = netdev_priv(ndev);
 
+	unregister_candev(ndev);
 	clk_disable(priv->clk);
 	clk_put(priv->clk);
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	iounmap(priv->base);
 	release_mem_region(res->start, resource_size(res));
-	unregister_candev(ndev);
 	free_candev(ndev);
 	platform_set_drvdata(pdev, NULL);
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 140/262] can: janz-ican3: fix support for older hardware revisions
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (138 preceding siblings ...)
  2012-09-28 18:51 ` [ 139/262] can: ti_hecc: fix oops during rmmod Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 141/262] cfg80211: fix possible circular lock on reg_regdb_search() Greg Kroah-Hartman
                   ` (121 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Ira W. Snyder, Marc Kleine-Budde

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Ira W. Snyder" <iws@ovro.caltech.edu>

commit e21093ef6fb4cbecdf926102286dbe280ae965db upstream.

The Revision 1.0 Janz CMOD-IO Carrier Board does not have support for
the reset registers. To support older hardware, the code is changed to
use the hardware reset register on the Janz VMOD-ICAN3 hardware itself.

Signed-off-by: Ira W. Snyder <iws@ovro.caltech.edu>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/can/janz-ican3.c |    4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

--- a/drivers/net/can/janz-ican3.c
+++ b/drivers/net/can/janz-ican3.c
@@ -1250,7 +1250,6 @@ static irqreturn_t ican3_irq(int irq, vo
  */
 static int ican3_reset_module(struct ican3_dev *mod)
 {
-	u8 val = 1 << mod->num;
 	unsigned long start;
 	u8 runold, runnew;
 
@@ -1264,8 +1263,7 @@ static int ican3_reset_module(struct ica
 	runold = ioread8(mod->dpm + TARGET_RUNNING);
 
 	/* reset the module */
-	iowrite8(val, &mod->ctrl->reset_assert);
-	iowrite8(val, &mod->ctrl->reset_deassert);
+	iowrite8(0x00, &mod->dpmctrl->hwreset);
 
 	/* wait until the module has finished resetting and is running */
 	start = jiffies;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 141/262] cfg80211: fix possible circular lock on reg_regdb_search()
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (139 preceding siblings ...)
  2012-09-28 18:51 ` [ 140/262] can: janz-ican3: fix support for older hardware revisions Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 142/262] DMA: PL330: Fix potential NULL pointer dereference in pl330_submit_req() Greg Kroah-Hartman
                   ` (120 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Felix Fietkau, Luis R. Rodriguez, Johannes Berg,
	John W. Linville

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Luis R. Rodriguez" <mcgrof@do-not-panic.com>

commit a85d0d7f3460b1a123b78e7f7e39bf72c37dfb78 upstream.

When call_crda() is called we kick off a witch hunt search
for the same regulatory domain on our internal regulatory
database and that work gets kicked off on a workqueue, this
is done while the cfg80211_mutex is held. If that workqueue
kicks off it will first lock reg_regdb_search_mutex and
later cfg80211_mutex but to ensure two CPUs will not contend
against cfg80211_mutex the right thing to do is to have the
reg_regdb_search() wait until the cfg80211_mutex is let go.

The lockdep report is pasted below.

cfg80211: Calling CRDA to update world regulatory domain

======================================================
[ INFO: possible circular locking dependency detected ]
3.3.8 #3 Tainted: G           O
-------------------------------------------------------
kworker/0:1/235 is trying to acquire lock:
 (cfg80211_mutex){+.+...}, at: [<816468a4>] set_regdom+0x78c/0x808 [cfg80211]

but task is already holding lock:
 (reg_regdb_search_mutex){+.+...}, at: [<81646828>] set_regdom+0x710/0x808 [cfg80211]

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #2 (reg_regdb_search_mutex){+.+...}:
       [<800a8384>] lock_acquire+0x60/0x88
       [<802950a8>] mutex_lock_nested+0x54/0x31c
       [<81645778>] is_world_regdom+0x9f8/0xc74 [cfg80211]

-> #1 (reg_mutex#2){+.+...}:
       [<800a8384>] lock_acquire+0x60/0x88
       [<802950a8>] mutex_lock_nested+0x54/0x31c
       [<8164539c>] is_world_regdom+0x61c/0xc74 [cfg80211]

-> #0 (cfg80211_mutex){+.+...}:
       [<800a77b8>] __lock_acquire+0x10d4/0x17bc
       [<800a8384>] lock_acquire+0x60/0x88
       [<802950a8>] mutex_lock_nested+0x54/0x31c
       [<816468a4>] set_regdom+0x78c/0x808 [cfg80211]

other info that might help us debug this:

Chain exists of:
  cfg80211_mutex --> reg_mutex#2 --> reg_regdb_search_mutex

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(reg_regdb_search_mutex);
                               lock(reg_mutex#2);
                               lock(reg_regdb_search_mutex);
  lock(cfg80211_mutex);

 *** DEADLOCK ***

3 locks held by kworker/0:1/235:
 #0:  (events){.+.+..}, at: [<80089a00>] process_one_work+0x230/0x460
 #1:  (reg_regdb_work){+.+...}, at: [<80089a00>] process_one_work+0x230/0x460
 #2:  (reg_regdb_search_mutex){+.+...}, at: [<81646828>] set_regdom+0x710/0x808 [cfg80211]

stack backtrace:
Call Trace:
[<80290fd4>] dump_stack+0x8/0x34
[<80291bc4>] print_circular_bug+0x2ac/0x2d8
[<800a77b8>] __lock_acquire+0x10d4/0x17bc
[<800a8384>] lock_acquire+0x60/0x88
[<802950a8>] mutex_lock_nested+0x54/0x31c
[<816468a4>] set_regdom+0x78c/0x808 [cfg80211]

Reported-by: Felix Fietkau <nbd@openwrt.org>
Tested-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: Luis R. Rodriguez <mcgrof@do-not-panic.com>
Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/wireless/reg.c |   12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -340,6 +340,9 @@ static void reg_regdb_search(struct work
 	struct reg_regdb_search_request *request;
 	const struct ieee80211_regdomain *curdom, *regdom;
 	int i, r;
+	bool set_reg = false;
+
+	mutex_lock(&cfg80211_mutex);
 
 	mutex_lock(&reg_regdb_search_mutex);
 	while (!list_empty(&reg_regdb_search_list)) {
@@ -355,9 +358,7 @@ static void reg_regdb_search(struct work
 				r = reg_copy_regd(&regdom, curdom);
 				if (r)
 					break;
-				mutex_lock(&cfg80211_mutex);
-				set_regdom(regdom);
-				mutex_unlock(&cfg80211_mutex);
+				set_reg = true;
 				break;
 			}
 		}
@@ -365,6 +366,11 @@ static void reg_regdb_search(struct work
 		kfree(request);
 	}
 	mutex_unlock(&reg_regdb_search_mutex);
+
+	if (set_reg)
+		set_regdom(regdom);
+
+	mutex_unlock(&cfg80211_mutex);
 }
 
 static DECLARE_WORK(reg_regdb_work, reg_regdb_search);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 142/262] DMA: PL330: Fix potential NULL pointer dereference in pl330_submit_req()
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (140 preceding siblings ...)
  2012-09-28 18:51 ` [ 141/262] cfg80211: fix possible circular lock on reg_regdb_search() Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 143/262] DMA: PL330: Check the pointer returned by kzalloc Greg Kroah-Hartman
                   ` (119 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Sachin Kamat, Jassi Brar, Vinod Koul

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sachin Kamat <sachin.kamat@linaro.org>

commit 2e2c682becb20416c140aa0d6d3137b51a5c76da upstream.

'r->cfg' is being checked for NULL. However, it is dereferenced
in the previous statements. Thus moving those statements within
the check.

Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Acked-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/dma/pl330.c |   16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -1567,17 +1567,19 @@ static int pl330_submit_req(void *ch_id,
 		goto xfer_exit;
 	}
 
-	/* Prefer Secure Channel */
-	if (!_manager_ns(thrd))
-		r->cfg->nonsecure = 0;
-	else
-		r->cfg->nonsecure = 1;
 
 	/* Use last settings, if not provided */
-	if (r->cfg)
+	if (r->cfg) {
+		/* Prefer Secure Channel */
+		if (!_manager_ns(thrd))
+			r->cfg->nonsecure = 0;
+		else
+			r->cfg->nonsecure = 1;
+
 		ccr = _prepare_ccr(r->cfg);
-	else
+	} else {
 		ccr = readl(regs + CC(thrd->id));
+	}
 
 	/* If this req doesn't have valid xfer settings */
 	if (!_is_valid(ccr)) {



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 143/262] DMA: PL330: Check the pointer returned by kzalloc
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (141 preceding siblings ...)
  2012-09-28 18:51 ` [ 142/262] DMA: PL330: Fix potential NULL pointer dereference in pl330_submit_req() Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 144/262] dmaengine: at_hdmac: fix comment in atc_prep_slave_sg() Greg Kroah-Hartman
                   ` (118 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Sachin Kamat, Jassi Brar, Vinod Koul

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sachin Kamat <sachin.kamat@linaro.org>

commit 61c6e7531d3b66b33187b8cdd700fd8ab93ffd62 upstream.

kzalloc could return NULL. Hence add a check to avoid
NULL pointer dereference.

Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Acked-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/dma/pl330.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -2930,6 +2930,11 @@ pl330_probe(struct amba_device *adev, co
 		num_chan = max_t(int, pi->pcfg.num_peri, pi->pcfg.num_chan);
 
 	pdmac->peripherals = kzalloc(num_chan * sizeof(*pch), GFP_KERNEL);
+	if (!pdmac->peripherals) {
+		ret = -ENOMEM;
+		dev_err(&adev->dev, "unable to allocate pdmac->peripherals\n");
+		goto probe_err5;
+	}
 
 	for (i = 0; i < num_chan; i++) {
 		pch = &pdmac->peripherals[i];



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 144/262] dmaengine: at_hdmac: fix comment in atc_prep_slave_sg()
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (142 preceding siblings ...)
  2012-09-28 18:51 ` [ 143/262] DMA: PL330: Check the pointer returned by kzalloc Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 145/262] dmaengine: at_hdmac: check that each sg data length is non-null Greg Kroah-Hartman
                   ` (117 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Nicolas Ferre, Vinod Koul

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nicolas Ferre <nicolas.ferre@atmel.com>

commit c618a9be0e8c0f36baee2560860a0118a428fb26 upstream.

s/dma_memcpy/slave_sg/ and it is sg length that we are
talking about.

Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/dma/at_hdmac.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -662,7 +662,7 @@ atc_prep_slave_sg(struct dma_chan *chan,
 			flags);
 
 	if (unlikely(!atslave || !sg_len)) {
-		dev_dbg(chan2dev(chan), "prep_dma_memcpy: length is zero!\n");
+		dev_dbg(chan2dev(chan), "prep_slave_sg: sg length is zero!\n");
 		return NULL;
 	}
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 145/262] dmaengine: at_hdmac: check that each sg data length is non-null
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (143 preceding siblings ...)
  2012-09-28 18:51 ` [ 144/262] dmaengine: at_hdmac: fix comment in atc_prep_slave_sg() Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 146/262] rt2x00: Identify ASUS USB-N53 device Greg Kroah-Hartman
                   ` (116 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Nicolas Ferre, Vinod Koul

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nicolas Ferre <nicolas.ferre@atmel.com>

commit c456797681db814f4f5b36909e8e94047bf53d9c upstream.

Avoid the construction of a malformed DMA request sent to
the DMA controller.
Log message is for debug only because this condition is unlikely to
append and may only trigger at driver development time.

Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/dma/at_hdmac.c |   11 +++++++++++
 1 file changed, 11 insertions(+)

--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -690,6 +690,11 @@ atc_prep_slave_sg(struct dma_chan *chan,
 
 			mem = sg_dma_address(sg);
 			len = sg_dma_len(sg);
+			if (unlikely(!len)) {
+				dev_dbg(chan2dev(chan),
+					"prep_slave_sg: sg(%d) data length is zero\n", i);
+				goto err;
+			}
 			mem_width = 2;
 			if (unlikely(mem & 3 || len & 3))
 				mem_width = 0;
@@ -725,6 +730,11 @@ atc_prep_slave_sg(struct dma_chan *chan,
 
 			mem = sg_dma_address(sg);
 			len = sg_dma_len(sg);
+			if (unlikely(!len)) {
+				dev_dbg(chan2dev(chan),
+					"prep_slave_sg: sg(%d) data length is zero\n", i);
+				goto err;
+			}
 			mem_width = 2;
 			if (unlikely(mem & 3 || len & 3))
 				mem_width = 0;
@@ -758,6 +768,7 @@ atc_prep_slave_sg(struct dma_chan *chan,
 
 err_desc_get:
 	dev_err(chan2dev(chan), "not enough descriptors available\n");
+err:
 	atc_desc_put(atchan, first);
 	return NULL;
 }



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 146/262] rt2x00: Identify ASUS USB-N53 device.
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (144 preceding siblings ...)
  2012-09-28 18:51 ` [ 145/262] dmaengine: at_hdmac: check that each sg data length is non-null Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 147/262] rt2x00: Fix word size of rt2500usb MAC_CSR19 register Greg Kroah-Hartman
                   ` (115 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Maximilian Engelhardt, Gertjan van Wingerde,
	Ivo Van Doorn, John W. Linville

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Gertjan van Wingerde <gwingerde@gmail.com>

commit 177ef8360fabdc49ff08d2598c06e7f7a36b53e3 upstream.

This is an RT3572 based device.

Signed-off-by: Maximilian Engelhardt <maxi@daemonizer.de>
Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
Acked-by: Ivo Van Doorn <ivdoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/rt2x00/rt2800usb.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -1157,6 +1157,8 @@ static struct usb_device_id rt2800usb_de
 	{ USB_DEVICE(0x1690, 0x0744) },
 	{ USB_DEVICE(0x1690, 0x0761) },
 	{ USB_DEVICE(0x1690, 0x0764) },
+	/* ASUS */
+	{ USB_DEVICE(0x0b05, 0x179d) },
 	/* Cisco */
 	{ USB_DEVICE(0x167b, 0x4001) },
 	/* EnGenius */
@@ -1222,7 +1224,6 @@ static struct usb_device_id rt2800usb_de
 	{ USB_DEVICE(0x0b05, 0x1760) },
 	{ USB_DEVICE(0x0b05, 0x1761) },
 	{ USB_DEVICE(0x0b05, 0x1790) },
-	{ USB_DEVICE(0x0b05, 0x179d) },
 	/* AzureWave */
 	{ USB_DEVICE(0x13d3, 0x3262) },
 	{ USB_DEVICE(0x13d3, 0x3284) },



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 147/262] rt2x00: Fix word size of rt2500usb MAC_CSR19 register.
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (145 preceding siblings ...)
  2012-09-28 18:51 ` [ 146/262] rt2x00: Identify ASUS USB-N53 device Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 148/262] rt2x00: Fix rfkill polling prior to interface start Greg Kroah-Hartman
                   ` (114 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Gertjan van Wingerde, Ivo Van Doorn, John W. Linville

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Gertjan van Wingerde <gwingerde@gmail.com>

commit 6ced58a5dbb94dbfbea1b33ca3c56d1e929cd548 upstream.

The register is 16 bits wide, not 32.

Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
Acked-by: Ivo Van Doorn <ivdoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/rt2x00/rt2500usb.c |    2 +-
 drivers/net/wireless/rt2x00/rt2500usb.h |   16 ++++++++--------
 2 files changed, 9 insertions(+), 9 deletions(-)

--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -283,7 +283,7 @@ static int rt2500usb_rfkill_poll(struct
 	u16 reg;
 
 	rt2500usb_register_read(rt2x00dev, MAC_CSR19, &reg);
-	return rt2x00_get_field32(reg, MAC_CSR19_BIT7);
+	return rt2x00_get_field16(reg, MAC_CSR19_BIT7);
 }
 
 #ifdef CONFIG_RT2X00_LIB_LEDS
--- a/drivers/net/wireless/rt2x00/rt2500usb.h
+++ b/drivers/net/wireless/rt2x00/rt2500usb.h
@@ -189,14 +189,14 @@
  * MAC_CSR19: GPIO control register.
  */
 #define MAC_CSR19			0x0426
-#define MAC_CSR19_BIT0			FIELD32(0x0001)
-#define MAC_CSR19_BIT1			FIELD32(0x0002)
-#define MAC_CSR19_BIT2			FIELD32(0x0004)
-#define MAC_CSR19_BIT3			FIELD32(0x0008)
-#define MAC_CSR19_BIT4			FIELD32(0x0010)
-#define MAC_CSR19_BIT5			FIELD32(0x0020)
-#define MAC_CSR19_BIT6			FIELD32(0x0040)
-#define MAC_CSR19_BIT7			FIELD32(0x0080)
+#define MAC_CSR19_BIT0			FIELD16(0x0001)
+#define MAC_CSR19_BIT1			FIELD16(0x0002)
+#define MAC_CSR19_BIT2			FIELD16(0x0004)
+#define MAC_CSR19_BIT3			FIELD16(0x0008)
+#define MAC_CSR19_BIT4			FIELD16(0x0010)
+#define MAC_CSR19_BIT5			FIELD16(0x0020)
+#define MAC_CSR19_BIT6			FIELD16(0x0040)
+#define MAC_CSR19_BIT7			FIELD16(0x0080)
 
 /*
  * MAC_CSR20: LED control register.



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 148/262] rt2x00: Fix rfkill polling prior to interface start.
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (146 preceding siblings ...)
  2012-09-28 18:51 ` [ 147/262] rt2x00: Fix word size of rt2500usb MAC_CSR19 register Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 149/262] NFS: Fix the initialisation of the readdir cookieverf array Greg Kroah-Hartman
                   ` (113 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Gertjan van Wingerde, Ivo Van Doorn, John W. Linville

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Gertjan van Wingerde <gwingerde@gmail.com>

commit a396e10019eaf3809b0219c966865aaafec12630 upstream.

We need to program the rfkill switch GPIO pin direction to input at
device initialization time, not only when the interface is brought up.
Doing this only when the interface is brought up could lead to rfkill
detecting the switch is turned on erroneously and inability to create
the interface and bringing it up.

Reported-and-tested-by: Andreas Messer <andi@bastelmap.de>
Signed-off-by: Gertjan van Wingerde <gwingerde@gmail.com>
Acked-by: Ivo Van Doorn <ivdoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/rt2x00/rt2400pci.c |    9 +++++++++
 drivers/net/wireless/rt2x00/rt2400pci.h |    1 +
 drivers/net/wireless/rt2x00/rt2500pci.c |    9 +++++++++
 drivers/net/wireless/rt2x00/rt2500usb.c |    9 +++++++++
 drivers/net/wireless/rt2x00/rt2500usb.h |    1 +
 drivers/net/wireless/rt2x00/rt2800pci.c |    9 +++++++++
 drivers/net/wireless/rt2x00/rt2800usb.c |    9 +++++++++
 drivers/net/wireless/rt2x00/rt61pci.c   |    9 +++++++++
 drivers/net/wireless/rt2x00/rt61pci.h   |    1 +
 drivers/net/wireless/rt2x00/rt73usb.c   |    9 +++++++++
 drivers/net/wireless/rt2x00/rt73usb.h   |    3 +++
 11 files changed, 69 insertions(+)

--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -1611,6 +1611,7 @@ static int rt2400pci_probe_hw_mode(struc
 static int rt2400pci_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
 	int retval;
+	u32 reg;
 
 	/*
 	 * Allocate eeprom data.
@@ -1624,6 +1625,14 @@ static int rt2400pci_probe_hw(struct rt2
 		return retval;
 
 	/*
+	 * Enable rfkill polling by setting GPIO direction of the
+	 * rfkill switch GPIO pin correctly.
+	 */
+	rt2x00pci_register_read(rt2x00dev, GPIOCSR, &reg);
+	rt2x00_set_field32(&reg, GPIOCSR_BIT8, 1);
+	rt2x00pci_register_write(rt2x00dev, GPIOCSR, reg);
+
+	/*
 	 * Initialize hw specifications.
 	 */
 	retval = rt2400pci_probe_hw_mode(rt2x00dev);
--- a/drivers/net/wireless/rt2x00/rt2400pci.h
+++ b/drivers/net/wireless/rt2x00/rt2400pci.h
@@ -670,6 +670,7 @@
 #define GPIOCSR_BIT5			FIELD32(0x00000020)
 #define GPIOCSR_BIT6			FIELD32(0x00000040)
 #define GPIOCSR_BIT7			FIELD32(0x00000080)
+#define GPIOCSR_BIT8			FIELD32(0x00000100)
 
 /*
  * BBPPCSR: BBP Pin control register.
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1929,6 +1929,7 @@ static int rt2500pci_probe_hw_mode(struc
 static int rt2500pci_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
 	int retval;
+	u32 reg;
 
 	/*
 	 * Allocate eeprom data.
@@ -1942,6 +1943,14 @@ static int rt2500pci_probe_hw(struct rt2
 		return retval;
 
 	/*
+	 * Enable rfkill polling by setting GPIO direction of the
+	 * rfkill switch GPIO pin correctly.
+	 */
+	rt2x00pci_register_read(rt2x00dev, GPIOCSR, &reg);
+	rt2x00_set_field32(&reg, GPIOCSR_DIR0, 1);
+	rt2x00pci_register_write(rt2x00dev, GPIOCSR, reg);
+
+	/*
 	 * Initialize hw specifications.
 	 */
 	retval = rt2500pci_probe_hw_mode(rt2x00dev);
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1768,6 +1768,7 @@ static int rt2500usb_probe_hw_mode(struc
 static int rt2500usb_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
 	int retval;
+	u16 reg;
 
 	/*
 	 * Allocate eeprom data.
@@ -1781,6 +1782,14 @@ static int rt2500usb_probe_hw(struct rt2
 		return retval;
 
 	/*
+	 * Enable rfkill polling by setting GPIO direction of the
+	 * rfkill switch GPIO pin correctly.
+	 */
+	rt2500usb_register_read(rt2x00dev, MAC_CSR19, &reg);
+	rt2x00_set_field16(&reg, MAC_CSR19_BIT8, 0);
+	rt2500usb_register_write(rt2x00dev, MAC_CSR19, reg);
+
+	/*
 	 * Initialize hw specifications.
 	 */
 	retval = rt2500usb_probe_hw_mode(rt2x00dev);
--- a/drivers/net/wireless/rt2x00/rt2500usb.h
+++ b/drivers/net/wireless/rt2x00/rt2500usb.h
@@ -197,6 +197,7 @@
 #define MAC_CSR19_BIT5			FIELD16(0x0020)
 #define MAC_CSR19_BIT6			FIELD16(0x0040)
 #define MAC_CSR19_BIT7			FIELD16(0x0080)
+#define MAC_CSR19_BIT8			FIELD16(0x0100)
 
 /*
  * MAC_CSR20: LED control register.
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -977,6 +977,7 @@ static int rt2800pci_validate_eeprom(str
 static int rt2800pci_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
 	int retval;
+	u32 reg;
 
 	/*
 	 * Allocate eeprom data.
@@ -990,6 +991,14 @@ static int rt2800pci_probe_hw(struct rt2
 		return retval;
 
 	/*
+	 * Enable rfkill polling by setting GPIO direction of the
+	 * rfkill switch GPIO pin correctly.
+	 */
+	rt2x00pci_register_read(rt2x00dev, GPIO_CTRL_CFG, &reg);
+	rt2x00_set_field32(&reg, GPIO_CTRL_CFG_GPIOD_BIT2, 1);
+	rt2x00pci_register_write(rt2x00dev, GPIO_CTRL_CFG, reg);
+
+	/*
 	 * Initialize hw specifications.
 	 */
 	retval = rt2800_probe_hw_mode(rt2x00dev);
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -736,6 +736,7 @@ static int rt2800usb_validate_eeprom(str
 static int rt2800usb_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
 	int retval;
+	u32 reg;
 
 	/*
 	 * Allocate eeprom data.
@@ -749,6 +750,14 @@ static int rt2800usb_probe_hw(struct rt2
 		return retval;
 
 	/*
+	 * Enable rfkill polling by setting GPIO direction of the
+	 * rfkill switch GPIO pin correctly.
+	 */
+	rt2x00usb_register_read(rt2x00dev, GPIO_CTRL_CFG, &reg);
+	rt2x00_set_field32(&reg, GPIO_CTRL_CFG_GPIOD_BIT2, 1);
+	rt2x00usb_register_write(rt2x00dev, GPIO_CTRL_CFG, reg);
+
+	/*
 	 * Initialize hw specifications.
 	 */
 	retval = rt2800_probe_hw_mode(rt2x00dev);
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -2832,6 +2832,7 @@ static int rt61pci_probe_hw_mode(struct
 static int rt61pci_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
 	int retval;
+	u32 reg;
 
 	/*
 	 * Disable power saving.
@@ -2850,6 +2851,14 @@ static int rt61pci_probe_hw(struct rt2x0
 		return retval;
 
 	/*
+	 * Enable rfkill polling by setting GPIO direction of the
+	 * rfkill switch GPIO pin correctly.
+	 */
+	rt2x00pci_register_read(rt2x00dev, MAC_CSR13, &reg);
+	rt2x00_set_field32(&reg, MAC_CSR13_BIT13, 1);
+	rt2x00pci_register_write(rt2x00dev, MAC_CSR13, reg);
+
+	/*
 	 * Initialize hw specifications.
 	 */
 	retval = rt61pci_probe_hw_mode(rt2x00dev);
--- a/drivers/net/wireless/rt2x00/rt61pci.h
+++ b/drivers/net/wireless/rt2x00/rt61pci.h
@@ -372,6 +372,7 @@ struct hw_pairwise_ta_entry {
 #define MAC_CSR13_BIT10			FIELD32(0x00000400)
 #define MAC_CSR13_BIT11			FIELD32(0x00000800)
 #define MAC_CSR13_BIT12			FIELD32(0x00001000)
+#define MAC_CSR13_BIT13			FIELD32(0x00002000)
 
 /*
  * MAC_CSR14: LED control register.
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2177,6 +2177,7 @@ static int rt73usb_probe_hw_mode(struct
 static int rt73usb_probe_hw(struct rt2x00_dev *rt2x00dev)
 {
 	int retval;
+	u32 reg;
 
 	/*
 	 * Allocate eeprom data.
@@ -2190,6 +2191,14 @@ static int rt73usb_probe_hw(struct rt2x0
 		return retval;
 
 	/*
+	 * Enable rfkill polling by setting GPIO direction of the
+	 * rfkill switch GPIO pin correctly.
+	 */
+	rt2x00usb_register_read(rt2x00dev, MAC_CSR13, &reg);
+	rt2x00_set_field32(&reg, MAC_CSR13_BIT15, 0);
+	rt2x00usb_register_write(rt2x00dev, MAC_CSR13, reg);
+
+	/*
 	 * Initialize hw specifications.
 	 */
 	retval = rt73usb_probe_hw_mode(rt2x00dev);
--- a/drivers/net/wireless/rt2x00/rt73usb.h
+++ b/drivers/net/wireless/rt2x00/rt73usb.h
@@ -282,6 +282,9 @@ struct hw_pairwise_ta_entry {
 #define MAC_CSR13_BIT10			FIELD32(0x00000400)
 #define MAC_CSR13_BIT11			FIELD32(0x00000800)
 #define MAC_CSR13_BIT12			FIELD32(0x00001000)
+#define MAC_CSR13_BIT13			FIELD32(0x00002000)
+#define MAC_CSR13_BIT14			FIELD32(0x00004000)
+#define MAC_CSR13_BIT15			FIELD32(0x00008000)
 
 /*
  * MAC_CSR14: LED control register.



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 149/262] NFS: Fix the initialisation of the readdir cookieverf array
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (147 preceding siblings ...)
  2012-09-28 18:51 ` [ 148/262] rt2x00: Fix rfkill polling prior to interface start Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 150/262] NFS: Fix a problem with the legacy binary mount code Greg Kroah-Hartman
                   ` (112 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Andi Kleen, David Binderman, Trond Myklebust

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Trond Myklebust <Trond.Myklebust@netapp.com>

commit c3f52af3e03013db5237e339c817beaae5ec9e3a upstream.

When the NFS_COOKIEVERF helper macro was converted into a static
inline function in commit 99fadcd764 (nfs: convert NFS_*(inode)
helpers to static inline), we broke the initialisation of the
readdir cookies, since that depended on doing a memset with an
argument of 'sizeof(NFS_COOKIEVERF(inode))' which therefore
changed from sizeof(be32 cookieverf[2]) to sizeof(be32 *).

At this point, NFS_COOKIEVERF seems to be more of an obfuscation
than a helper, so the best thing would be to just get rid of it.

Also see: https://bugzilla.kernel.org/show_bug.cgi?id=46881

Reported-by: Andi Kleen <andi@firstfloor.org>
Reported-by: David Binderman <dcb314@hotmail.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nfs/inode.c         |    2 +-
 fs/nfs/nfs3proc.c      |    2 +-
 fs/nfs/nfs4proc.c      |    4 ++--
 include/linux/nfs_fs.h |    5 -----
 4 files changed, 4 insertions(+), 9 deletions(-)

--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -152,7 +152,7 @@ static void nfs_zap_caches_locked(struct
 	nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
 	nfsi->attrtimeo_timestamp = jiffies;
 
-	memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_COOKIEVERF(inode)));
+	memset(NFS_I(inode)->cookieverf, 0, sizeof(NFS_I(inode)->cookieverf));
 	if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))
 		nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL|NFS_INO_REVAL_PAGECACHE;
 	else
--- a/fs/nfs/nfs3proc.c
+++ b/fs/nfs/nfs3proc.c
@@ -643,7 +643,7 @@ nfs3_proc_readdir(struct dentry *dentry,
 		  u64 cookie, struct page **pages, unsigned int count, int plus)
 {
 	struct inode		*dir = dentry->d_inode;
-	__be32			*verf = NFS_COOKIEVERF(dir);
+	__be32			*verf = NFS_I(dir)->cookieverf;
 	struct nfs3_readdirargs	arg = {
 		.fh		= NFS_FH(dir),
 		.cookie		= cookie,
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -3189,11 +3189,11 @@ static int _nfs4_proc_readdir(struct den
 			dentry->d_parent->d_name.name,
 			dentry->d_name.name,
 			(unsigned long long)cookie);
-	nfs4_setup_readdir(cookie, NFS_COOKIEVERF(dir), dentry, &args);
+	nfs4_setup_readdir(cookie, NFS_I(dir)->cookieverf, dentry, &args);
 	res.pgbase = args.pgbase;
 	status = nfs4_call_sync(NFS_SERVER(dir)->client, NFS_SERVER(dir), &msg, &args.seq_args, &res.seq_res, 0);
 	if (status >= 0) {
-		memcpy(NFS_COOKIEVERF(dir), res.verifier.data, NFS4_VERIFIER_SIZE);
+		memcpy(NFS_I(dir)->cookieverf, res.verifier.data, NFS4_VERIFIER_SIZE);
 		status += args.pgbase;
 	}
 
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -265,11 +265,6 @@ static inline const struct nfs_rpc_ops *
 	return NFS_SERVER(inode)->nfs_client->rpc_ops;
 }
 
-static inline __be32 *NFS_COOKIEVERF(const struct inode *inode)
-{
-	return NFS_I(inode)->cookieverf;
-}
-
 static inline unsigned NFS_MINATTRTIMEO(const struct inode *inode)
 {
 	struct nfs_server *nfss = NFS_SERVER(inode);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 150/262] NFS: Fix a problem with the legacy binary mount code
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (148 preceding siblings ...)
  2012-09-28 18:51 ` [ 149/262] NFS: Fix the initialisation of the readdir cookieverf array Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 151/262] NFS: return error from decode_getfh in decode open Greg Kroah-Hartman
                   ` (111 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Marius Tolzmann, Trond Myklebust

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Trond Myklebust <Trond.Myklebust@netapp.com>

commit 872ece86ea5c367aa92f44689c2d01a1c767aeb3 upstream.

Apparently, am-utils is still using the legacy binary mountdata interface,
and is having trouble parsing /proc/mounts due to the 'port=' field being
incorrectly set.

The following patch should fix up the regression.

Reported-by: Marius Tolzmann <tolzmann@molgen.mpg.de>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nfs/super.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1918,6 +1918,7 @@ static int nfs23_validate_mount_data(voi
 
 		memcpy(sap, &data->addr, sizeof(data->addr));
 		args->nfs_server.addrlen = sizeof(data->addr);
+		args->nfs_server.port = ntohs(data->addr.sin_port);
 		if (!nfs_verify_server_address(sap))
 			goto out_no_address;
 
@@ -2651,6 +2652,7 @@ static int nfs4_validate_mount_data(void
 			return -EFAULT;
 		if (!nfs_verify_server_address(sap))
 			goto out_no_address;
+		args->nfs_server.port = ntohs(((struct sockaddr_in *)sap)->sin_port);
 
 		if (data->auth_flavourlen) {
 			if (data->auth_flavourlen > 1)



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 151/262] NFS: return error from decode_getfh in decode open
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (149 preceding siblings ...)
  2012-09-28 18:51 ` [ 150/262] NFS: Fix a problem with the legacy binary mount code Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 152/262] EHCI: Update qTD next pointer in QH overlay region during unlink Greg Kroah-Hartman
                   ` (110 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Weston Andros Adamson, Trond Myklebust

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Weston Andros Adamson <dros@netapp.com>

commit 01913b49cf1dc6409a07dd2a4cc6af2e77f3c410 upstream.

If decode_getfh failed, nfs4_xdr_dec_open would return 0 since the last
decode_* call must have succeeded.

Signed-off-by: Weston Andros Adamson <dros@netapp.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nfs/nfs4xdr.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -6262,7 +6262,8 @@ static int nfs4_xdr_dec_open(struct rpc_
 	status = decode_open(xdr, res);
 	if (status)
 		goto out;
-	if (decode_getfh(xdr, &res->fh) != 0)
+	status = decode_getfh(xdr, &res->fh);
+	if (status)
 		goto out;
 	decode_getfattr(xdr, res->f_attr, res->server);
 out:



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 152/262] EHCI: Update qTD next pointer in QH overlay region during unlink
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (150 preceding siblings ...)
  2012-09-28 18:51 ` [ 151/262] NFS: return error from decode_getfh in decode open Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 153/262] USB: ftdi_sio: PID for NZR SEM 16+ USB Greg Kroah-Hartman
                   ` (109 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Pavankumar Kondeti, Alan Stern

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Pavankumar Kondeti <pkondeti@codeaurora.org>

commit 3d037774b42ed677f699b1dce7d548d55f4e4c2b upstream.

There is a possibility of QH overlay region having reference to a stale
qTD pointer during unlink.

Consider an endpoint having two pending qTD before unlink process begins.
The endpoint's QH queue looks like this.

qTD1 --> qTD2 --> Dummy

To unlink qTD2, QH is removed from asynchronous list and Asynchronous
Advance Doorbell is programmed.  The qTD1's next qTD pointer is set to
qTD2'2 next qTD pointer and qTD2 is retired upon controller's doorbell
interrupt.  If QH's current qTD pointer points to qTD1, transfer overlay
region still have reference to qTD2. But qtD2 is just unlinked and freed.
This may cause EHCI system error.  Fix this by updating qTD next pointer
in QH overlay region with the qTD next pointer of the current qTD.

Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/host/ehci-q.c |   12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -128,9 +128,17 @@ qh_refresh (struct ehci_hcd *ehci, struc
 	else {
 		qtd = list_entry (qh->qtd_list.next,
 				struct ehci_qtd, qtd_list);
-		/* first qtd may already be partially processed */
-		if (cpu_to_hc32(ehci, qtd->qtd_dma) == qh->hw->hw_current)
+		/*
+		 * first qtd may already be partially processed.
+		 * If we come here during unlink, the QH overlay region
+		 * might have reference to the just unlinked qtd. The
+		 * qtd is updated in qh_completions(). Update the QH
+		 * overlay here.
+		 */
+		if (cpu_to_hc32(ehci, qtd->qtd_dma) == qh->hw->hw_current) {
+			qh->hw->hw_qtd_next = qtd->hw_next;
 			qtd = NULL;
+		}
 	}
 
 	if (qtd)



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 153/262] USB: ftdi_sio: PID for NZR SEM 16+ USB
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (151 preceding siblings ...)
  2012-09-28 18:51 ` [ 152/262] EHCI: Update qTD next pointer in QH overlay region during unlink Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 154/262] USB: ftdi_sio: do not claim CDC ACM function Greg Kroah-Hartman
                   ` (108 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Horst Schirmeier

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Horst Schirmeier <horst@schirmeier.com>

commit 26a538b9ea2a3ee10dafc0068f0560dfd7b7ba37 upstream.

This adds the USB PID for the NZR SEM 16+ USB energy monitor device
<http://www.nzr.de>.  It works perfectly with the GPL software on
<http://schou.dk/linux/sparometer/>.

Signed-off-by: Horst Schirmeier <horst@schirmeier.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/ftdi_sio.c     |    1 +
 drivers/usb/serial/ftdi_sio_ids.h |    3 +++
 2 files changed, 4 insertions(+)

--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -704,6 +704,7 @@ static struct usb_device_id id_table_com
 	{ USB_DEVICE(FTDI_VID, FTDI_PCDJ_DAC2_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_RRCIRKITS_LOCOBUFFER_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_ASK_RDR400_PID) },
+	{ USB_DEVICE(FTDI_VID, FTDI_NZR_SEM_USB_PID) },
 	{ USB_DEVICE(ICOM_VID, ICOM_ID_1_PID) },
 	{ USB_DEVICE(ICOM_VID, ICOM_OPC_U_UC_PID) },
 	{ USB_DEVICE(ICOM_VID, ICOM_ID_RP2C1_PID) },
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -75,6 +75,9 @@
 #define FTDI_OPENDCC_GATEWAY_PID	0xBFDB
 #define FTDI_OPENDCC_GBM_PID	0xBFDC
 
+/* NZR SEM 16+ USB (http://www.nzr.de) */
+#define FTDI_NZR_SEM_USB_PID	0xC1E0	/* NZR SEM-LOG16+ */
+
 /*
  * RR-CirKits LocoBuffer USB (http://www.rr-cirkits.com)
  */



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 154/262] USB: ftdi_sio: do not claim CDC ACM function
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (152 preceding siblings ...)
  2012-09-28 18:51 ` [ 153/262] USB: ftdi_sio: PID for NZR SEM 16+ USB Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 155/262] USB: ftdi-sio: add support for more Physik Instrumente devices Greg Kroah-Hartman
                   ` (107 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Florian Wöhrl, Xiaofan Chen, Alan Cox,
	Bruno Thomsen, Bjørn Mork

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bjørn Mork <bjorn@mork.no>

commit f08dea734844aa42ec57c229b0b73b3d7d21f810 upstream.

The Microchip vid:pid 04d8:000a is used for their CDC ACM
demo firmware application.  This is a device with a single
function conforming to the CDC ACM specification and with
the intention of demonstrating CDC ACM class firmware and
driver interaction.  The demo is used on a number of
development boards, and may also be used unmodified by
vendors using Microchip hardware.

Some vendors have re-used this vid:pid for other types of
firmware, emulating FTDI chips. Attempting to continue to
support such devices without breaking class based
applications that by matching on interface
class/subclass/proto being ff/ff/00.  I have no information
about the actual device or interface descriptors, but this
will at least make the proper CDC ACM devices work again.
Anyone having details of the offending device's descriptors
should update this entry with the details.

Reported-by: Florian Wöhrl <fw@woehrl.biz>
Reported-by: Xiaofan Chen <xiaofanc@gmail.com>
Cc: Alan Cox <alan@linux.intel.com>
Cc: Bruno Thomsen <bruno.thomsen@gmail.com>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/ftdi_sio.c     |    4 +++-
 drivers/usb/serial/ftdi_sio_ids.h |    5 ++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -805,7 +805,9 @@ static struct usb_device_id id_table_com
 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
 	{ USB_DEVICE(ADI_VID, ADI_GNICEPLUS_PID),
 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-	{ USB_DEVICE(MICROCHIP_VID, MICROCHIP_USB_BOARD_PID) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(MICROCHIP_VID, MICROCHIP_USB_BOARD_PID,
+					USB_CLASS_VENDOR_SPEC,
+					USB_SUBCLASS_VENDOR_SPEC, 0x00) },
 	{ USB_DEVICE(JETI_VID, JETI_SPC1201_PID) },
 	{ USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID),
 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -542,7 +542,10 @@
 /*
  * Microchip Technology, Inc.
  *
- * MICROCHIP_VID (0x04D8) and MICROCHIP_USB_BOARD_PID (0x000A) are also used by:
+ * MICROCHIP_VID (0x04D8) and MICROCHIP_USB_BOARD_PID (0x000A) are
+ * used by single function CDC ACM class based firmware demo
+ * applications.  The VID/PID has also been used in firmware
+ * emulating FTDI serial chips by:
  * Hornby Elite - Digital Command Control Console
  * http://www.hornby.com/hornby-dcc/controllers/
  */



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 155/262] USB: ftdi-sio: add support for more Physik Instrumente devices
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (153 preceding siblings ...)
  2012-09-28 18:51 ` [ 154/262] USB: ftdi_sio: do not claim CDC ACM function Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 156/262] usb: chipidea: udc: fix setup of endpoint maxpacket size Greg Kroah-Hartman
                   ` (106 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Éric Piel

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Éric Piel <piel@delmic.com>

commit dafc4f7be1a556ca3868d343c00127728b397068 upstream.

Commit b69cc672052540 added support for the E-861.  After acquiring a C-867, I
realised that every Physik Instrumente's device has a different PID. They are
listed in the Windows device driver's .inf file. So here are all PIDs for the
current (and probably future) USB devices from Physik Instrumente.

Compiled, but only actually tested on the E-861 and C-867.

Signed-off-by: Éric Piel <piel@delmic.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/ftdi_sio.c     |   17 +++++++++++++++++
 drivers/usb/serial/ftdi_sio_ids.h |   21 ++++++++++++++++++++-
 2 files changed, 37 insertions(+), 1 deletion(-)

--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -813,7 +813,24 @@ static struct usb_device_id id_table_com
 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
 	{ USB_DEVICE(LARSENBRUSGAARD_VID, LB_ALTITRACK_PID) },
 	{ USB_DEVICE(GN_OTOMETRICS_VID, AURICAL_USB_PID) },
+	{ USB_DEVICE(FTDI_VID, PI_C865_PID) },
+	{ USB_DEVICE(FTDI_VID, PI_C857_PID) },
+	{ USB_DEVICE(PI_VID, PI_C866_PID) },
+	{ USB_DEVICE(PI_VID, PI_C663_PID) },
+	{ USB_DEVICE(PI_VID, PI_C725_PID) },
+	{ USB_DEVICE(PI_VID, PI_E517_PID) },
+	{ USB_DEVICE(PI_VID, PI_C863_PID) },
 	{ USB_DEVICE(PI_VID, PI_E861_PID) },
+	{ USB_DEVICE(PI_VID, PI_C867_PID) },
+	{ USB_DEVICE(PI_VID, PI_E609_PID) },
+	{ USB_DEVICE(PI_VID, PI_E709_PID) },
+	{ USB_DEVICE(PI_VID, PI_100F_PID) },
+	{ USB_DEVICE(PI_VID, PI_1011_PID) },
+	{ USB_DEVICE(PI_VID, PI_1012_PID) },
+	{ USB_DEVICE(PI_VID, PI_1013_PID) },
+	{ USB_DEVICE(PI_VID, PI_1014_PID) },
+	{ USB_DEVICE(PI_VID, PI_1015_PID) },
+	{ USB_DEVICE(PI_VID, PI_1016_PID) },
 	{ USB_DEVICE(KONDO_VID, KONDO_USB_SERIAL_PID) },
 	{ USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
 	{ USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -797,8 +797,27 @@
  * Physik Instrumente
  * http://www.physikinstrumente.com/en/products/
  */
+/* These two devices use the VID of FTDI */
+#define PI_C865_PID	0xe0a0  /* PI C-865 Piezomotor Controller */
+#define PI_C857_PID	0xe0a1  /* PI Encoder Trigger Box */
+
 #define PI_VID              0x1a72  /* Vendor ID */
-#define PI_E861_PID         0x1008  /* E-861 piezo controller USB connection */
+#define PI_C866_PID	0x1000  /* PI C-866 Piezomotor Controller */
+#define PI_C663_PID	0x1001  /* PI C-663 Mercury-Step */
+#define PI_C725_PID	0x1002  /* PI C-725 Piezomotor Controller */
+#define PI_E517_PID	0x1005  /* PI E-517 Digital Piezo Controller Operation Module */
+#define PI_C863_PID	0x1007  /* PI C-863 */
+#define PI_E861_PID	0x1008  /* PI E-861 Piezomotor Controller */
+#define PI_C867_PID	0x1009  /* PI C-867 Piezomotor Controller */
+#define PI_E609_PID	0x100D  /* PI E-609 Digital Piezo Controller */
+#define PI_E709_PID	0x100E  /* PI E-709 Digital Piezo Controller */
+#define PI_100F_PID	0x100F  /* PI Digital Piezo Controller */
+#define PI_1011_PID	0x1011  /* PI Digital Piezo Controller */
+#define PI_1012_PID	0x1012  /* PI Motion Controller */
+#define PI_1013_PID	0x1013  /* PI Motion Controller */
+#define PI_1014_PID	0x1014  /* PI Device */
+#define PI_1015_PID	0x1015  /* PI Device */
+#define PI_1016_PID	0x1016  /* PI Digital Servo Module */
 
 /*
  * Kondo Kagaku Co.Ltd.



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 156/262] usb: chipidea: udc: fix setup of endpoint maxpacket size
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (154 preceding siblings ...)
  2012-09-28 18:51 ` [ 155/262] USB: ftdi-sio: add support for more Physik Instrumente devices Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 157/262] usb: chipidea: udc: dont stall endpoint if request list is empty in isr_tr_complete_low Greg Kroah-Hartman
                   ` (105 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Michael Grzeschik, Felipe Balbi,
	Marc Kleine-Budde, Alexander Shishkin

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Grzeschik <m.grzeschik@pengutronix.de>

commit 7f67c38bdcb6d8bce02e10521fbf1618b586319f upstream.

This patch changes the setup of the endpoint maxpacket size. All non control
endpoints are initialized with an undefined ((unsigned short)~0) maxpacket
size. The maxpacket size of Endpoint 0 will be kept at CTRL_PAYLOAD_MAX.

Some gadget drivers check for the maxpacket size before they enable the
endpoint, which leads to a wrong state in these drivers.

Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Acked-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/chipidea/udc.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -1468,7 +1468,12 @@ static int init_eps(struct ci13xxx *udc)
 
 			mEp->ep.name      = mEp->name;
 			mEp->ep.ops       = &usb_ep_ops;
-			mEp->ep.maxpacket = CTRL_PAYLOAD_MAX;
+			/*
+			 * for ep0: maxP defined in desc, for other
+			 * eps, maxP is set by epautoconfig() called
+			 * by gadget layer
+			 */
+			mEp->ep.maxpacket = (unsigned short)~0;
 
 			INIT_LIST_HEAD(&mEp->qh.queue);
 			mEp->qh.ptr = dma_pool_alloc(udc->qh_pool, GFP_KERNEL,
@@ -1488,6 +1493,7 @@ static int init_eps(struct ci13xxx *udc)
 				else
 					udc->ep0in = mEp;
 
+				mEp->ep.maxpacket = CTRL_PAYLOAD_MAX;
 				continue;
 			}
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 157/262] usb: chipidea: udc: dont stall endpoint if request list is empty in isr_tr_complete_low
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (155 preceding siblings ...)
  2012-09-28 18:51 ` [ 156/262] usb: chipidea: udc: fix setup of endpoint maxpacket size Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 158/262] usb: dwc3: ep0: correct cache sync issue in case of ep0_bounced Greg Kroah-Hartman
                   ` (104 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Michael Grzeschik, Marc Kleine-Budde, Alexander Shishkin

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Grzeschik <m.grzeschik@pengutronix.de>

commit db89960e50f45274c07dc60926b5a49489b8a7a0 upstream.

When attaching an imx28 or imx53 in USB gadget mode to a Windows host and
starting a rndis connection we see this message every 4-10 seconds:

    g_ether gadget: high speed config #2: RNDIS

Analysis shows that each time this message is printed, the rndis connection is
re-establish due to a reset because of a stalled endpoint (ep 0, dir 1). The
endpoint is stalled because the reqeust complete bit on that endpoint is set,
but in isr_tr_complete_low() the endpoint request list (mEp->qh.queue) is
empty.

This patch removed this check, because the code doesn't take the following
situation into account:

The loop over all endpoints in isr_tr_complete_handler() will call ep_nuke() on
both ep0/dir0 and ep/dir1 in the first loop. Pending reqeusts will be flushed
and completed here. There seems to be a race condition, the request is nuked,
but the request complete bit will be set, too. The subsequent check (in
ep0/dir1's loop cycle) for endpoint request list (mEp->qh.queue) empty will
fail.

Both other mainline chipidea drivers (mv_udc_core.c and fsl_udc_core.c) don't
have this check.

Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/chipidea/udc.c |    5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -771,10 +771,7 @@ __acquires(mEp->lock)
 {
 	struct ci13xxx_req *mReq, *mReqTemp;
 	struct ci13xxx_ep *mEpTemp = mEp;
-	int uninitialized_var(retval);
-
-	if (list_empty(&mEp->qh.queue))
-		return -EINVAL;
+	int retval = 0;
 
 	list_for_each_entry_safe(mReq, mReqTemp, &mEp->qh.queue,
 			queue) {



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 158/262] usb: dwc3: ep0: correct cache sync issue in case of ep0_bounced
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (156 preceding siblings ...)
  2012-09-28 18:51 ` [ 157/262] usb: chipidea: udc: dont stall endpoint if request list is empty in isr_tr_complete_low Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 159/262] usb: dwc3: core: fix incorrect usage of resource pointer Greg Kroah-Hartman
                   ` (103 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Pratyush Anand, Felipe Balbi

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Pratyush Anand <pratyush.anand@st.com>

commit 0416e494ce7dc84e2719bc9fb7daecb330476074 upstream.

In case of ep0 out, if length is not aligned to maxpacket size then we use
dwc->ep_bounce_addr for dma transfer and not request->dma. Since, we have
alreday done memcpy from dwc->ep0_bounce to request->buf, so we do not need to
issue cache sync function. In fact, cache sync function will bring wrong data
in request->buf from request->dma in this scenario.

So, cache sync function must not be executed in case of ep0 bounced.

Signed-off-by: Pratyush Anand <pratyush.anand@st.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/dwc3/ep0.c    |    1 -
 drivers/usb/dwc3/gadget.c |    7 +++++--
 2 files changed, 5 insertions(+), 3 deletions(-)

--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -702,7 +702,6 @@ static void dwc3_ep0_complete_data(struc
 		transferred = min_t(u32, ur->length,
 				transfer_size - length);
 		memcpy(ur->buf, dwc->ep0_bounce, transferred);
-		dwc->ep0_bounced = false;
 	} else {
 		transferred = ur->length - length;
 	}
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -238,8 +238,11 @@ void dwc3_gadget_giveback(struct dwc3_ep
 	if (req->request.status == -EINPROGRESS)
 		req->request.status = status;
 
-	usb_gadget_unmap_request(&dwc->gadget, &req->request,
-			req->direction);
+	if (dwc->ep0_bounced && dep->number == 0)
+		dwc->ep0_bounced = false;
+	else
+		usb_gadget_unmap_request(&dwc->gadget, &req->request,
+				req->direction);
 
 	dev_dbg(dwc->dev, "request %p from %s completed %d/%d ===> %d\n",
 			req, dep->name, req->request.actual,



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 159/262] usb: dwc3: core: fix incorrect usage of resource pointer
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (157 preceding siblings ...)
  2012-09-28 18:51 ` [ 158/262] usb: dwc3: ep0: correct cache sync issue in case of ep0_bounced Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 160/262] USB: cdc-wdm: fix wdm_find_device* return value Greg Kroah-Hartman
                   ` (102 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Ruchika Kharwar, Moiz Sonasath,
	Kishon Vijay Abraham I, Felipe Balbi

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kishon Vijay Abraham I <kishon@ti.com>

commit 066618bc350cc6035c3a0fc559a8ac02f55785a9 upstream.

Populate the resources for xhci afresh instead of directly using the
*struct resource* of core. *resource* structure has parent, sibling,
child pointers which should be filled only by resource API's. By
directly using the *resource* pointer of core in xhci, these parent,
sibling, child pointers are already populated even before
*platform_device_add* causing side effects.

Reported-by: Ruchika Kharwar <ruchika@ti.com>
Tested-by: Moiz Sonasath <m-sonasath@ti.com>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/dwc3/core.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -429,16 +429,21 @@ static int __devinit dwc3_probe(struct p
 		dev_err(dev, "missing IRQ\n");
 		return -ENODEV;
 	}
-	dwc->xhci_resources[1] = *res;
+	dwc->xhci_resources[1].start = res->start;
+	dwc->xhci_resources[1].end = res->end;
+	dwc->xhci_resources[1].flags = res->flags;
+	dwc->xhci_resources[1].name = res->name;
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	if (!res) {
 		dev_err(dev, "missing memory resource\n");
 		return -ENODEV;
 	}
-	dwc->xhci_resources[0] = *res;
+	dwc->xhci_resources[0].start = res->start;
 	dwc->xhci_resources[0].end = dwc->xhci_resources[0].start +
 					DWC3_XHCI_REGS_END;
+	dwc->xhci_resources[0].flags = res->flags;
+	dwc->xhci_resources[0].name = res->name;
 
 	 /*
 	  * Request memory region but exclude xHCI regs,



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 160/262] USB: cdc-wdm: fix wdm_find_device* return value
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (158 preceding siblings ...)
  2012-09-28 18:51 ` [ 159/262] usb: dwc3: core: fix incorrect usage of resource pointer Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 161/262] USB: ohci-at91: fix PIO handling in relation with number of ports Greg Kroah-Hartman
                   ` (101 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Bjørn Mork, Oliver Neukum

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bjørn Mork <bjorn@mork.no>

commit 6a44886899ef8cc396e230e492e6a56a883889f3 upstream.

A logic error made the wdm_find_device* functions
return a bogus pointer into static data instead of
the intended NULL no matching device was found.

Signed-off-by: Bjørn Mork <bjorn@mork.no>
Cc: Oliver Neukum <oliver@neukum.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/class/cdc-wdm.c |   12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -134,12 +134,14 @@ static struct usb_driver wdm_driver;
 /* return intfdata if we own the interface, else look up intf in the list */
 static struct wdm_device *wdm_find_device(struct usb_interface *intf)
 {
-	struct wdm_device *desc = NULL;
+	struct wdm_device *desc;
 
 	spin_lock(&wdm_device_list_lock);
 	list_for_each_entry(desc, &wdm_device_list, device_list)
 		if (desc->intf == intf)
-			break;
+			goto found;
+	desc = NULL;
+found:
 	spin_unlock(&wdm_device_list_lock);
 
 	return desc;
@@ -147,12 +149,14 @@ static struct wdm_device *wdm_find_devic
 
 static struct wdm_device *wdm_find_device_by_minor(int minor)
 {
-	struct wdm_device *desc = NULL;
+	struct wdm_device *desc;
 
 	spin_lock(&wdm_device_list_lock);
 	list_for_each_entry(desc, &wdm_device_list, device_list)
 		if (desc->intf->minor == minor)
-			break;
+			goto found;
+	desc = NULL;
+found:
 	spin_unlock(&wdm_device_list_lock);
 
 	return desc;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 161/262] USB: ohci-at91: fix PIO handling in relation with number of ports
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (159 preceding siblings ...)
  2012-09-28 18:51 ` [ 160/262] USB: cdc-wdm: fix wdm_find_device* return value Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 162/262] USB: add device quirk for Joss Optical touchboard Greg Kroah-Hartman
                   ` (100 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Klaus Falkner, Nicolas Ferre, Alan Stern

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nicolas Ferre <nicolas.ferre@atmel.com>

commit 6fffb77c8393151b0cf8cef1b9c2ba90587dd2e8 upstream.

If the number of ports present on the SoC/board is not the maximum
and that the platform data is not filled with all data, there is
an easy way to mess the PIO setup for this interface.
This quick fix addresses mis-configuration in USB host platform data
that is common in at91 boards since commit 0ee6d1e (USB: ohci-at91:
change maximum number of ports) that did not modified the associatd
board files.

Reported-by: Klaus Falkner <klaus.falkner@solectrix.de>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/host/ohci-at91.c |   10 ++++++++++
 1 file changed, 10 insertions(+)

--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -570,6 +570,16 @@ static int __devinit ohci_hcd_at91_drv_p
 
 	if (pdata) {
 		at91_for_each_port(i) {
+			/*
+			 * do not configure PIO if not in relation with
+			 * real USB port on board
+			 */
+			if (i >= pdata->ports) {
+				pdata->vbus_pin[i] = -EINVAL;
+				pdata->overcurrent_pin[i] = -EINVAL;
+				break;
+			}
+
 			if (!gpio_is_valid(pdata->vbus_pin[i]))
 				continue;
 			gpio = pdata->vbus_pin[i];



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 162/262] USB: add device quirk for Joss Optical touchboard
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (160 preceding siblings ...)
  2012-09-28 18:51 ` [ 161/262] USB: ohci-at91: fix PIO handling in relation with number of ports Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 163/262] rt2800usb: Added rx packet length validity check Greg Kroah-Hartman
                   ` (99 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Alan Stern, adam ?

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alan Stern <stern@rowland.harvard.edu>

commit 92fc7a8b0f20bdb243c706daf42658e8e0cd2ef0 upstream.

This patch (as1604) adds a CONFIG_INTF_STRINGS quirk for the Joss
infrared touchboard device.  The device doesn't like to be asked for
its interface strings.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: adam ? <adam3337@wp.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/core/quirks.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -96,6 +96,10 @@ static const struct usb_device_id usb_qu
 	{ USB_DEVICE(0x04b4, 0x0526), .driver_info =
 			USB_QUIRK_CONFIG_INTF_STRINGS },
 
+	/* Microchip Joss Optical infrared touchboard device */
+	{ USB_DEVICE(0x04d8, 0x000c), .driver_info =
+			USB_QUIRK_CONFIG_INTF_STRINGS },
+
 	/* Samsung Android phone modem - ID conflict with SPH-I500 */
 	{ USB_DEVICE(0x04e8, 0x6601), .driver_info =
 			USB_QUIRK_CONFIG_INTF_STRINGS },



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 163/262] rt2800usb: Added rx packet length validity check
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (161 preceding siblings ...)
  2012-09-28 18:51 ` [ 162/262] USB: add device quirk for Joss Optical touchboard Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 164/262] usb: host: xhci: Fix Compliance Mode on SN65LVPE502CP Hardware Greg Kroah-Hartman
                   ` (98 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Sergei Poselenov, Ivo van Doorn, John W. Linville

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sergei Poselenov <sposelenov@emcraft.com>

commit efd5d6b03bd9c9e0df646c56fb5f4f3e25e5c1ac upstream.

On our system (ARM Cortex-M3 SOC running linux-2.6.33)
frequent crashes were observed in the rt2800usb module
because of the invalid length of the received packet (3392,
46920...). This patch adds the sanity check on the packet
legth. Also, changed WARNING to ERROR in rt2x00lib_rxdone()
so that the bad packet condition would be noticed.

The fix was tested on the latest compat-wireless-3.5.1-1-snpc.

Signed-off-by: Sergei Poselenov <sposelenov@emcraft.com>
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/rt2x00/rt2800usb.c |   10 +++++++++-
 drivers/net/wireless/rt2x00/rt2x00dev.c |    2 +-
 2 files changed, 10 insertions(+), 2 deletions(-)

--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -667,8 +667,16 @@ static void rt2800usb_fill_rxdone(struct
 	skb_pull(entry->skb, RXINFO_DESC_SIZE);
 
 	/*
-	 * FIXME: we need to check for rx_pkt_len validity
+	 * Check for rx_pkt_len validity. Return if invalid, leaving
+	 * rxdesc->size zeroed out by the upper level.
 	 */
+	if (unlikely(rx_pkt_len == 0 ||
+			rx_pkt_len > entry->queue->data_size)) {
+		ERROR(entry->queue->rt2x00dev,
+			"Bad frame size %d, forcing to 0\n", rx_pkt_len);
+		return;
+	}
+
 	rxd = (__le32 *)(entry->skb->data + rx_pkt_len);
 
 	/*
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -629,7 +629,7 @@ void rt2x00lib_rxdone(struct queue_entry
 	 */
 	if (unlikely(rxdesc.size == 0 ||
 		     rxdesc.size > entry->queue->data_size)) {
-		WARNING(rt2x00dev, "Wrong frame size %d max %d.\n",
+		ERROR(rt2x00dev, "Wrong frame size %d max %d.\n",
 			rxdesc.size, entry->queue->data_size);
 		dev_kfree_skb(entry->skb);
 		goto renew_skb;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 164/262] usb: host: xhci: Fix Compliance Mode on SN65LVPE502CP Hardware
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (162 preceding siblings ...)
  2012-09-28 18:51 ` [ 163/262] rt2800usb: Added rx packet length validity check Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 165/262] Intel xhci: Only switch the switchable ports Greg Kroah-Hartman
                   ` (97 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Alexis R. Cortes, Sarah Sharp

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Alexis R. Cortes" <alexis.cortes@ti.com>

commit 71c731a296f1b08a3724bd1b514b64f1bda87a23 upstream.

This patch is intended to work around a known issue on the
SN65LVPE502CP USB3.0 re-driver that can delay the negotiation
between a device and the host past the usual handshake timeout.

If that happens on the first insertion, the host controller
port will enter in Compliance Mode and NO port status event will
be generated (as per xHCI Spec) making impossible to detect this
event by software. The port will remain in compliance mode until
a warm reset is applied to it.

As a result of this, the port will seem "dead" to the user and no
device connections or disconnections will be detected.

For solving this, the patch creates a timer which polls every 2
seconds the link state of each host controller's port (this
by reading the PORTSC register) and recovers the port by issuing a
Warm reset every time Compliance mode is detected.

If a xHC USB3.0 port has previously entered to U0, the compliance
mode issue will NOT occur only until system resumes from
sleep/hibernate, therefore, the compliance mode timer is stopped
when all xHC USB 3.0 ports have entered U0. The timer is initialized
again after each system resume.

Since the issue is being caused by a piece of hardware, the timer
will be enabled ONLY on those systems that have the SN65LVPE502CP
installed (this patch uses DMI strings for detecting those systems)
therefore making this patch to act as a quirk (XHCI_COMP_MODE_QUIRK
has been added to the xhci stack).

This patch applies for these systems:
Vendor: Hewlett-Packard. System Models: Z420, Z620 and Z820.

This patch should be backported to kernels as old as 3.2, as that was
the first kernel to support warm reset.  The kernels will need to
contain both commit 10d674a82e553cb8a1f41027bb3c3e309b3f6804 "USB: When
hot reset for USB3 fails, try warm reset" and commit
8bea2bd37df08aaa599aa361a9f8b836ba98e554 "usb: Add support for root hub
port status CAS".  The first patch add warm reset support, and the
second patch modifies the USB core to issue a warm reset when the port
is in compliance mode.

Signed-off-by: Alexis R. Cortes <alexis.cortes@ti.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/host/xhci-hub.c |   42 +++++++++++++++
 drivers/usb/host/xhci.c     |  121 ++++++++++++++++++++++++++++++++++++++++++++
 drivers/usb/host/xhci.h     |    6 ++
 3 files changed, 169 insertions(+)

--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -493,11 +493,48 @@ static void xhci_hub_report_link_state(u
 		 * when this bit is set.
 		 */
 		pls |= USB_PORT_STAT_CONNECTION;
+	} else {
+		/*
+		 * If CAS bit isn't set but the Port is already at
+		 * Compliance Mode, fake a connection so the USB core
+		 * notices the Compliance state and resets the port.
+		 * This resolves an issue generated by the SN65LVPE502CP
+		 * in which sometimes the port enters compliance mode
+		 * caused by a delay on the host-device negotiation.
+		 */
+		if (pls == USB_SS_PORT_LS_COMP_MOD)
+			pls |= USB_PORT_STAT_CONNECTION;
 	}
+
 	/* update status field */
 	*status |= pls;
 }
 
+/*
+ * Function for Compliance Mode Quirk.
+ *
+ * This Function verifies if all xhc USB3 ports have entered U0, if so,
+ * the compliance mode timer is deleted. A port won't enter
+ * compliance mode if it has previously entered U0.
+ */
+void xhci_del_comp_mod_timer(struct xhci_hcd *xhci, u32 status, u16 wIndex)
+{
+	u32 all_ports_seen_u0 = ((1 << xhci->num_usb3_ports)-1);
+	bool port_in_u0 = ((status & PORT_PLS_MASK) == XDEV_U0);
+
+	if (!(xhci->quirks & XHCI_COMP_MODE_QUIRK))
+		return;
+
+	if ((xhci->port_status_u0 != all_ports_seen_u0) && port_in_u0) {
+		xhci->port_status_u0 |= 1 << wIndex;
+		if (xhci->port_status_u0 == all_ports_seen_u0) {
+			del_timer_sync(&xhci->comp_mode_recovery_timer);
+			xhci_dbg(xhci, "All USB3 ports have entered U0 already!\n");
+			xhci_dbg(xhci, "Compliance Mode Recovery Timer Deleted.\n");
+		}
+	}
+}
+
 int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 		u16 wIndex, char *buf, u16 wLength)
 {
@@ -645,6 +682,11 @@ int xhci_hub_control(struct usb_hcd *hcd
 		/* Update Port Link State for super speed ports*/
 		if (hcd->speed == HCD_USB3) {
 			xhci_hub_report_link_state(&status, temp);
+			/*
+			 * Verify if all USB3 Ports Have entered U0 already.
+			 * Delete Compliance Mode Timer if so.
+			 */
+			xhci_del_comp_mod_timer(xhci, temp, wIndex);
 		}
 		if (bus_state->port_c_suspend & (1 << wIndex))
 			status |= 1 << USB_PORT_FEAT_C_SUSPEND;
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -26,6 +26,7 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/slab.h>
+#include <linux/dmi.h>
 
 #include "xhci.h"
 
@@ -398,6 +399,95 @@ static void xhci_msix_sync_irqs(struct x
 
 #endif
 
+static void compliance_mode_recovery(unsigned long arg)
+{
+	struct xhci_hcd *xhci;
+	struct usb_hcd *hcd;
+	u32 temp;
+	int i;
+
+	xhci = (struct xhci_hcd *)arg;
+
+	for (i = 0; i < xhci->num_usb3_ports; i++) {
+		temp = xhci_readl(xhci, xhci->usb3_ports[i]);
+		if ((temp & PORT_PLS_MASK) == USB_SS_PORT_LS_COMP_MOD) {
+			/*
+			 * Compliance Mode Detected. Letting USB Core
+			 * handle the Warm Reset
+			 */
+			xhci_dbg(xhci, "Compliance Mode Detected->Port %d!\n",
+					i + 1);
+			xhci_dbg(xhci, "Attempting Recovery routine!\n");
+			hcd = xhci->shared_hcd;
+
+			if (hcd->state == HC_STATE_SUSPENDED)
+				usb_hcd_resume_root_hub(hcd);
+
+			usb_hcd_poll_rh_status(hcd);
+		}
+	}
+
+	if (xhci->port_status_u0 != ((1 << xhci->num_usb3_ports)-1))
+		mod_timer(&xhci->comp_mode_recovery_timer,
+			jiffies + msecs_to_jiffies(COMP_MODE_RCVRY_MSECS));
+}
+
+/*
+ * Quirk to work around issue generated by the SN65LVPE502CP USB3.0 re-driver
+ * that causes ports behind that hardware to enter compliance mode sometimes.
+ * The quirk creates a timer that polls every 2 seconds the link state of
+ * each host controller's port and recovers it by issuing a Warm reset
+ * if Compliance mode is detected, otherwise the port will become "dead" (no
+ * device connections or disconnections will be detected anymore). Becasue no
+ * status event is generated when entering compliance mode (per xhci spec),
+ * this quirk is needed on systems that have the failing hardware installed.
+ */
+static void compliance_mode_recovery_timer_init(struct xhci_hcd *xhci)
+{
+	xhci->port_status_u0 = 0;
+	init_timer(&xhci->comp_mode_recovery_timer);
+
+	xhci->comp_mode_recovery_timer.data = (unsigned long) xhci;
+	xhci->comp_mode_recovery_timer.function = compliance_mode_recovery;
+	xhci->comp_mode_recovery_timer.expires = jiffies +
+			msecs_to_jiffies(COMP_MODE_RCVRY_MSECS);
+
+	set_timer_slack(&xhci->comp_mode_recovery_timer,
+			msecs_to_jiffies(COMP_MODE_RCVRY_MSECS));
+	add_timer(&xhci->comp_mode_recovery_timer);
+	xhci_dbg(xhci, "Compliance Mode Recovery Timer Initialized.\n");
+}
+
+/*
+ * This function identifies the systems that have installed the SN65LVPE502CP
+ * USB3.0 re-driver and that need the Compliance Mode Quirk.
+ * Systems:
+ * Vendor: Hewlett-Packard -> System Models: Z420, Z620 and Z820
+ */
+static bool compliance_mode_recovery_timer_quirk_check(void)
+{
+	const char *dmi_product_name, *dmi_sys_vendor;
+
+	dmi_product_name = dmi_get_system_info(DMI_PRODUCT_NAME);
+	dmi_sys_vendor = dmi_get_system_info(DMI_SYS_VENDOR);
+
+	if (!(strstr(dmi_sys_vendor, "Hewlett-Packard")))
+		return false;
+
+	if (strstr(dmi_product_name, "Z420") ||
+			strstr(dmi_product_name, "Z620") ||
+			strstr(dmi_product_name, "Z820"))
+		return true;
+
+	return false;
+}
+
+static int xhci_all_ports_seen_u0(struct xhci_hcd *xhci)
+{
+	return (xhci->port_status_u0 == ((1 << xhci->num_usb3_ports)-1));
+}
+
+
 /*
  * Initialize memory for HCD and xHC (one-time init).
  *
@@ -421,6 +511,12 @@ int xhci_init(struct usb_hcd *hcd)
 	retval = xhci_mem_init(xhci, GFP_KERNEL);
 	xhci_dbg(xhci, "Finished xhci_init\n");
 
+	/* Initializing Compliance Mode Recovery Data If Needed */
+	if (compliance_mode_recovery_timer_quirk_check()) {
+		xhci->quirks |= XHCI_COMP_MODE_QUIRK;
+		compliance_mode_recovery_timer_init(xhci);
+	}
+
 	return retval;
 }
 
@@ -629,6 +725,11 @@ void xhci_stop(struct usb_hcd *hcd)
 	del_timer_sync(&xhci->event_ring_timer);
 #endif
 
+	/* Deleting Compliance Mode Recovery Timer */
+	if ((xhci->quirks & XHCI_COMP_MODE_QUIRK) &&
+			(!(xhci_all_ports_seen_u0(xhci))))
+		del_timer_sync(&xhci->comp_mode_recovery_timer);
+
 	if (xhci->quirks & XHCI_AMD_PLL_FIX)
 		usb_amd_dev_put();
 
@@ -806,6 +907,16 @@ int xhci_suspend(struct xhci_hcd *xhci)
 	}
 	spin_unlock_irq(&xhci->lock);
 
+	/*
+	 * Deleting Compliance Mode Recovery Timer because the xHCI Host
+	 * is about to be suspended.
+	 */
+	if ((xhci->quirks & XHCI_COMP_MODE_QUIRK) &&
+			(!(xhci_all_ports_seen_u0(xhci)))) {
+		del_timer_sync(&xhci->comp_mode_recovery_timer);
+		xhci_dbg(xhci, "Compliance Mode Recovery Timer Deleted!\n");
+	}
+
 	/* step 5: remove core well power */
 	/* synchronize irq when using MSI-X */
 	xhci_msix_sync_irqs(xhci);
@@ -938,6 +1049,16 @@ int xhci_resume(struct xhci_hcd *xhci, b
 		usb_hcd_resume_root_hub(hcd);
 		usb_hcd_resume_root_hub(xhci->shared_hcd);
 	}
+
+	/*
+	 * If system is subject to the Quirk, Compliance Mode Timer needs to
+	 * be re-initialized Always after a system resume. Ports are subject
+	 * to suffer the Compliance Mode issue again. It doesn't matter if
+	 * ports have entered previously to U0 before system's suspension.
+	 */
+	if (xhci->quirks & XHCI_COMP_MODE_QUIRK)
+		compliance_mode_recovery_timer_init(xhci);
+
 	return retval;
 }
 #endif	/* CONFIG_PM */
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1495,6 +1495,7 @@ struct xhci_hcd {
 #define XHCI_LPM_SUPPORT	(1 << 11)
 #define XHCI_INTEL_HOST		(1 << 12)
 #define XHCI_SPURIOUS_REBOOT	(1 << 13)
+#define XHCI_COMP_MODE_QUIRK	(1 << 14)
 	unsigned int		num_active_eps;
 	unsigned int		limit_active_eps;
 	/* There are two roothubs to keep track of bus suspend info for */
@@ -1511,6 +1512,11 @@ struct xhci_hcd {
 	unsigned		sw_lpm_support:1;
 	/* support xHCI 1.0 spec USB2 hardware LPM */
 	unsigned		hw_lpm_support:1;
+	/* Compliance Mode Recovery Data */
+	struct timer_list	comp_mode_recovery_timer;
+	u32			port_status_u0;
+/* Compliance Mode Timer Triggered every 2 seconds */
+#define COMP_MODE_RCVRY_MSECS 2000
 };
 
 /* convert between an HCD pointer and the corresponding EHCI_HCD */



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 165/262] Intel xhci: Only switch the switchable ports
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (163 preceding siblings ...)
  2012-09-28 18:51 ` [ 164/262] usb: host: xhci: Fix Compliance Mode on SN65LVPE502CP Hardware Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 166/262] usb: host: xhci-plat: use ioremap_nocache Greg Kroah-Hartman
                   ` (96 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Keng-Yu Lin, Sarah Sharp

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Keng-Yu Lin <kengyu@canonical.com>

commit a96874a2a92feaef607ddd3137277a788cb927a6 upstream.

With a previous patch to enable the EHCI/XHCI port switching, it switches
all the available ports.

The assumption is not correct because the BIOS may expect some ports
not switchable by the OS.

There are two more registers that contains the information of the switchable
and non-switchable ports.

This patch adds the checking code for the two register so that only the
switchable ports are altered.

This patch should be backported to kernels as old as 3.0, that contain
commit ID 69e848c2090aebba5698a1620604c7dccb448684 "Intel xhci: Support
EHCI/xHCI port switching."

Signed-off-by: Keng-Yu Lin <kengyu@canonical.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/host/pci-quirks.c |   27 +++++++++++++++++++++++----
 1 file changed, 23 insertions(+), 4 deletions(-)

--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -75,7 +75,9 @@
 #define	NB_PIF0_PWRDOWN_1	0x01100013
 
 #define USB_INTEL_XUSB2PR      0xD0
+#define USB_INTEL_USB2PRM      0xD4
 #define USB_INTEL_USB3_PSSEN   0xD8
+#define USB_INTEL_USB3PRM      0xDC
 
 static struct amd_chipset_info {
 	struct pci_dev	*nb_dev;
@@ -772,10 +774,18 @@ void usb_enable_xhci_ports(struct pci_de
 		return;
 	}
 
-	ports_available = 0xffffffff;
+	/* Read USB3PRM, the USB 3.0 Port Routing Mask Register
+	 * Indicate the ports that can be changed from OS.
+	 */
+	pci_read_config_dword(xhci_pdev, USB_INTEL_USB3PRM,
+			&ports_available);
+
+	dev_dbg(&xhci_pdev->dev, "Configurable ports to enable SuperSpeed: 0x%x\n",
+			ports_available);
+
 	/* Write USB3_PSSEN, the USB 3.0 Port SuperSpeed Enable
-	 * Register, to turn on SuperSpeed terminations for all
-	 * available ports.
+	 * Register, to turn on SuperSpeed terminations for the
+	 * switchable ports.
 	 */
 	pci_write_config_dword(xhci_pdev, USB_INTEL_USB3_PSSEN,
 			cpu_to_le32(ports_available));
@@ -785,7 +795,16 @@ void usb_enable_xhci_ports(struct pci_de
 	dev_dbg(&xhci_pdev->dev, "USB 3.0 ports that are now enabled "
 			"under xHCI: 0x%x\n", ports_available);
 
-	ports_available = 0xffffffff;
+	/* Read XUSB2PRM, xHCI USB 2.0 Port Routing Mask Register
+	 * Indicate the USB 2.0 ports to be controlled by the xHCI host.
+	 */
+
+	pci_read_config_dword(xhci_pdev, USB_INTEL_USB2PRM,
+			&ports_available);
+
+	dev_dbg(&xhci_pdev->dev, "Configurable USB 2.0 ports to hand over to xCHI: 0x%x\n",
+			ports_available);
+
 	/* Write XUSB2PR, the xHC USB 2.0 Port Routing Register, to
 	 * switch the USB 2.0 power and data lines over to the xHCI
 	 * host.



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 166/262] usb: host: xhci-plat: use ioremap_nocache
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (164 preceding siblings ...)
  2012-09-28 18:51 ` [ 165/262] Intel xhci: Only switch the switchable ports Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 167/262] xhci: Fix a logical vs bitwise AND bug Greg Kroah-Hartman
                   ` (95 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Ruchika Kharwar, Felipe Balbi, Sarah Sharp

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ruchika Kharwar <ruchika@ti.com>

commit 319acdfc064169023cd9ada5085b434fbcdacec2 upstream.

Use the ioremap_nocache variant of the ioremap API in
order to make sure our memory will be marked uncachable.

This patch should be backported to kernels as old as 3.4, that contain
the commit 3429e91a661e1f383aecc86c6bbcf65afb15c892 "usb: host: xhci:
add platform driver support".

Signed-off-by: Ruchika Kharwar <ruchika@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/host/xhci-plat.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -118,7 +118,7 @@ static int xhci_plat_probe(struct platfo
 		goto put_hcd;
 	}
 
-	hcd->regs = ioremap(hcd->rsrc_start, hcd->rsrc_len);
+	hcd->regs = ioremap_nocache(hcd->rsrc_start, hcd->rsrc_len);
 	if (!hcd->regs) {
 		dev_dbg(&pdev->dev, "error mapping memory\n");
 		ret = -EFAULT;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 167/262] xhci: Fix a logical vs bitwise AND bug
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (165 preceding siblings ...)
  2012-09-28 18:51 ` [ 166/262] usb: host: xhci-plat: use ioremap_nocache Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 168/262] xhci: Make handover code more robust Greg Kroah-Hartman
                   ` (94 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Dan Carpenter, Sarah Sharp

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 052c7f9ffb0e95843e75448d02664459253f9ff8 upstream.

The intent was to test whether the flag was set.

This patch should be backported to stable kernels as old as 3.0, since
it fixes a bug in commit e95829f474f0db3a4d940cae1423783edd966027 "xhci:
Switch PPT ports to EHCI on shutdown.", which was marked for stable.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/host/xhci.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -760,7 +760,7 @@ void xhci_shutdown(struct usb_hcd *hcd)
 {
 	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
 
-	if (xhci->quirks && XHCI_SPURIOUS_REBOOT)
+	if (xhci->quirks & XHCI_SPURIOUS_REBOOT)
 		usb_disable_xhci_ports(to_pci_dev(hcd->self.controller));
 
 	spin_lock_irq(&xhci->lock);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 168/262] xhci: Make handover code more robust
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (166 preceding siblings ...)
  2012-09-28 18:51 ` [ 167/262] xhci: Fix a logical vs bitwise AND bug Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 169/262] xhci: Recognize USB 3.0 devices as superspeed at powerup Greg Kroah-Hartman
                   ` (93 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Matthew Garrett, Sarah Sharp

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Matthew Garrett <mjg@redhat.com>

commit e955a1cd086de4d165ae0f4c7be7289d84b63bdc upstream.

My test platform (Intel DX79SI) boots reliably under BIOS, but frequently
crashes when booting via UEFI. I finally tracked this down to the xhci
handoff code. It seems that reads from the device occasionally just return
0xff, resulting in xhci_find_next_cap_offset generating a value that's
larger than the resource region. We then oops when attempting to read the
value. Sanity checking that value lets us avoid the crash.

I've no idea what's causing the underlying problem, and xhci still doesn't
actually *work* even with this, but the machine at least boots which will
probably make further debugging easier.

This should be backported to kernels as old as 2.6.31, that contain the
commit 66d4eadd8d067269ea8fead1a50fe87c2979a80d "USB: xhci: BIOS handoff
and HW initialization."

Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/host/pci-quirks.c |   12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -841,12 +841,12 @@ static void __devinit quirk_usb_handoff_
 	void __iomem *op_reg_base;
 	u32 val;
 	int timeout;
+	int len = pci_resource_len(pdev, 0);
 
 	if (!mmio_resource_enabled(pdev, 0))
 		return;
 
-	base = ioremap_nocache(pci_resource_start(pdev, 0),
-				pci_resource_len(pdev, 0));
+	base = ioremap_nocache(pci_resource_start(pdev, 0), len);
 	if (base == NULL)
 		return;
 
@@ -856,9 +856,17 @@ static void __devinit quirk_usb_handoff_
 	 */
 	ext_cap_offset = xhci_find_next_cap_offset(base, XHCI_HCC_PARAMS_OFFSET);
 	do {
+		if ((ext_cap_offset + sizeof(val)) > len) {
+			/* We're reading garbage from the controller */
+			dev_warn(&pdev->dev,
+				 "xHCI controller failing to respond");
+			return;
+		}
+
 		if (!ext_cap_offset)
 			/* We've reached the end of the extended capabilities */
 			goto hc_init;
+
 		val = readl(base + ext_cap_offset);
 		if (XHCI_EXT_CAPS_ID(val) == XHCI_EXT_CAPS_LEGACY)
 			break;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 169/262] xhci: Recognize USB 3.0 devices as superspeed at powerup
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (167 preceding siblings ...)
  2012-09-28 18:51 ` [ 168/262] xhci: Make handover code more robust Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 170/262] usb: host: xhci: fix compilation error for non-PCI based stacks Greg Kroah-Hartman
                   ` (92 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Manoj Iyer, Sarah Sharp

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Manoj Iyer <manoj.iyer@canonical.com>

commit 29d214576f936db627ff62afb9ef438eea18bcd2 upstream.

On Intel Panther Point chipset USB 3.0 devices show up as
high-speed devices on powerup, but after an s3 cycle they are
correctly recognized as SuperSpeed. At powerup switch the port
to xHCI so that USB 3.0 devices are correctly recognized.

BugLink: http://bugs.launchpad.net/bugs/1000424

This patch should be backported to kernels as old as 3.0, that contain
commit ID 69e848c2090aebba5698a1620604c7dccb448684 "Intel xhci: Support
EHCI/xHCI port switching."

Signed-off-by: Manoj Iyer <manoj.iyer@canonical.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/host/pci-quirks.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -897,9 +897,10 @@ static void __devinit quirk_usb_handoff_
 	/* Disable any BIOS SMIs and clear all SMI events*/
 	writel(val, base + ext_cap_offset + XHCI_LEGACY_CONTROL_OFFSET);
 
+hc_init:
 	if (usb_is_intel_switchable_xhci(pdev))
 		usb_enable_xhci_ports(pdev);
-hc_init:
+
 	op_reg_base = base + XHCI_HC_LENGTH(readl(base));
 
 	/* Wait for the host controller to be ready before writing any



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 170/262] usb: host: xhci: fix compilation error for non-PCI based stacks
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (168 preceding siblings ...)
  2012-09-28 18:51 ` [ 169/262] xhci: Recognize USB 3.0 devices as superspeed at powerup Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 171/262] tty: serial: imx: console write routing is unsafe on SMP Greg Kroah-Hartman
                   ` (91 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Moiz Sonasath, Ruchika Kharwar, Felipe Balbi, Sarah Sharp

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Moiz Sonasath <m-sonasath@ti.com>

commit 296365781903226a3fb8758901eaeec09d2798e4 upstream.

For non PCI-based stacks, this function call
usb_disable_xhci_ports(to_pci_dev(hcd->self.controller));
made from xhci_shutdown is not applicable.

Ideally, we wouldn't have any PCI-specific code on
a generic driver such as the xHCI stack, but it looks
like we should just stub usb_disable_xhci_ports() out
for non-PCI devices.

[ balbi@ti.com: slight improvement to commit log ]

This patch should be backported to kernels as old as 3.0, since the
commit it fixes (e95829f474f0db3a4d940cae1423783edd966027 "xhci: Switch
PPT ports to EHCI on shutdown.") was marked for stable.

Signed-off-by: Moiz Sonasath<m-sonasath@ti.com>
Signed-off-by: Ruchika Kharwar <ruchika@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/host/pci-quirks.h |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/usb/host/pci-quirks.h
+++ b/drivers/usb/host/pci-quirks.h
@@ -15,6 +15,7 @@ void usb_disable_xhci_ports(struct pci_d
 static inline void usb_amd_quirk_pll_disable(void) {}
 static inline void usb_amd_quirk_pll_enable(void) {}
 static inline void usb_amd_dev_put(void) {}
+static inline void usb_disable_xhci_ports(struct pci_dev *xhci_pdev) {}
 #endif  /* CONFIG_PCI */
 
 #endif  /*  __LINUX_USB_PCI_QUIRKS_H  */



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 171/262] tty: serial: imx: console write routing is unsafe on SMP
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (169 preceding siblings ...)
  2012-09-28 18:51 ` [ 170/262] usb: host: xhci: fix compilation error for non-PCI based stacks Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 172/262] tty: serial: imx: dont reinit clock in imx_setup_ufcr() Greg Kroah-Hartman
                   ` (90 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Xinyu Chen, Dirk Behme, Sascha Hauer, Shawn Guo

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Xinyu Chen <xinyu.chen@freescale.com>

commit 9ec1882df244c4ee1baa692676fef5e8b0f5487d upstream.

The console feature's write routing is unsafe on SMP with
the startup/shutdown call.

There could be several consumers of the console
* the kernel printk
* the init process using /dev/kmsg to call printk to show log
* shell, which open /dev/console and write with sys_write()

The shell goes into the normal uart open/write routing,
but the other two go into the console operations.
The open routing calls imx serial startup, which will write USR1/2
register without any lock and critical with imx_console_write call.

Add a spin_lock for startup/shutdown/console_write routing.

This patch is a port from Freescale's Android kernel.

Signed-off-by: Xinyu Chen <xinyu.chen@freescale.com>
Tested-by: Dirk Behme <dirk.behme@de.bosch.com>
CC: Sascha Hauer <s.hauer@pengutronix.de>
Acked-by: Shawn Guo <shawn.guo@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/tty/serial/imx.c |   12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -758,6 +758,7 @@ static int imx_startup(struct uart_port
 		}
 	}
 
+	spin_lock_irqsave(&sport->port.lock, flags);
 	/*
 	 * Finally, clear and enable interrupts
 	 */
@@ -811,7 +812,6 @@ static int imx_startup(struct uart_port
 	/*
 	 * Enable modem status interrupts
 	 */
-	spin_lock_irqsave(&sport->port.lock,flags);
 	imx_enable_ms(&sport->port);
 	spin_unlock_irqrestore(&sport->port.lock,flags);
 
@@ -841,10 +841,13 @@ static void imx_shutdown(struct uart_por
 {
 	struct imx_port *sport = (struct imx_port *)port;
 	unsigned long temp;
+	unsigned long flags;
 
+	spin_lock_irqsave(&sport->port.lock, flags);
 	temp = readl(sport->port.membase + UCR2);
 	temp &= ~(UCR2_TXEN);
 	writel(temp, sport->port.membase + UCR2);
+	spin_unlock_irqrestore(&sport->port.lock, flags);
 
 	if (USE_IRDA(sport)) {
 		struct imxuart_platform_data *pdata;
@@ -873,12 +876,14 @@ static void imx_shutdown(struct uart_por
 	 * Disable all interrupts, port and break condition.
 	 */
 
+	spin_lock_irqsave(&sport->port.lock, flags);
 	temp = readl(sport->port.membase + UCR1);
 	temp &= ~(UCR1_TXMPTYEN | UCR1_RRDYEN | UCR1_RTSDEN | UCR1_UARTEN);
 	if (USE_IRDA(sport))
 		temp &= ~(UCR1_IREN);
 
 	writel(temp, sport->port.membase + UCR1);
+	spin_unlock_irqrestore(&sport->port.lock, flags);
 }
 
 static void
@@ -1221,6 +1226,9 @@ imx_console_write(struct console *co, co
 	struct imx_port *sport = imx_ports[co->index];
 	struct imx_port_ucrs old_ucr;
 	unsigned int ucr1;
+	unsigned long flags;
+
+	spin_lock_irqsave(&sport->port.lock, flags);
 
 	/*
 	 *	First, save UCR1/2/3 and then disable interrupts
@@ -1246,6 +1254,8 @@ imx_console_write(struct console *co, co
 	while (!(readl(sport->port.membase + USR2) & USR2_TXDC));
 
 	imx_port_ucrs_restore(&sport->port, &old_ucr);
+
+	spin_unlock_irqrestore(&sport->port.lock, flags);
 }
 
 /*



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 172/262] tty: serial: imx: dont reinit clock in imx_setup_ufcr()
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (170 preceding siblings ...)
  2012-09-28 18:51 ` [ 171/262] tty: serial: imx: console write routing is unsafe on SMP Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 173/262] mutex: Place lock in contended state after fastpath_lock failure Greg Kroah-Hartman
                   ` (89 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Dirk Behme, Shawn Guo, Sascha Hauer, Troy Kisky,
	Xinyu Chen

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dirk Behme <dirk.behme@de.bosch.com>

commit 7be0670f7b9198382938a03ff3db7f47ef6b4780 upstream.

Remove the clock configuration from imx_setup_ufcr(). This
isn't needed here and will cause garbage output if done.

To be be sure that we only touch the bits we want (TXTL and RXTL)
we have to mask out all other bits of the UFCR register. Add
one non-existing bit macro for this, too (bit 6, DCEDTE on i.MX6).

Signed-off-by: Dirk Behme <dirk.behme@de.bosch.com>
CC: Shawn Guo <shawn.guo@linaro.org>
CC: Sascha Hauer <s.hauer@pengutronix.de>
CC: Troy Kisky <troy.kisky@boundarydevices.com>
CC: Xinyu Chen <xinyu.chen@freescale.com>
Acked-by: Shawn Guo <shawn.guo@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/tty/serial/imx.c |   18 ++++--------------
 1 file changed, 4 insertions(+), 14 deletions(-)

--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -132,6 +132,7 @@
 #define  UCR4_OREN  	 (1<<1)  /* Receiver overrun interrupt enable */
 #define  UCR4_DREN  	 (1<<0)  /* Recv data ready interrupt enable */
 #define  UFCR_RXTL_SHF   0       /* Receiver trigger level shift */
+#define  UFCR_DCEDTE	 (1<<6)  /* DCE/DTE mode select */
 #define  UFCR_RFDIV      (7<<7)  /* Reference freq divider mask */
 #define  UFCR_RFDIV_REG(x)	(((x) < 7 ? 6 - (x) : 6) << 7)
 #define  UFCR_TXTL_SHF   10      /* Transmitter trigger level shift */
@@ -668,22 +669,11 @@ static void imx_break_ctl(struct uart_po
 static int imx_setup_ufcr(struct imx_port *sport, unsigned int mode)
 {
 	unsigned int val;
-	unsigned int ufcr_rfdiv;
-
-	/* set receiver / transmitter trigger level.
-	 * RFDIV is set such way to satisfy requested uartclk value
-	 */
-	val = TXTL << 10 | RXTL;
-	ufcr_rfdiv = (clk_get_rate(sport->clk_per) + sport->port.uartclk / 2)
-			/ sport->port.uartclk;
-
-	if(!ufcr_rfdiv)
-		ufcr_rfdiv = 1;
-
-	val |= UFCR_RFDIV_REG(ufcr_rfdiv);
 
+	/* set receiver / transmitter trigger level */
+	val = readl(sport->port.membase + UFCR) & (UFCR_RFDIV | UFCR_DCEDTE);
+	val |= TXTL << UFCR_TXTL_SHF | RXTL;
 	writel(val, sport->port.membase + UFCR);
-
 	return 0;
 }
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 173/262] mutex: Place lock in contended state after fastpath_lock failure
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (171 preceding siblings ...)
  2012-09-28 18:51 ` [ 172/262] tty: serial: imx: dont reinit clock in imx_setup_ufcr() Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 19:26   ` Nicolas Pitre
  2012-09-28 18:51 ` [ 174/262] x86, avx: dont use avx instructions with "noxsave" boot param Greg Kroah-Hartman
                   ` (88 subsequent siblings)
  261 siblings, 1 reply; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Will Deacon, Arnd Bergmann, Chris Mason,
	Ingo Molnar, Nicolas Pitre, Peter Zijlstra, Thomas Gleixner

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Will Deacon <will.deacon@arm.com>

commit 0bce9c46bf3b15f485d82d7e81dabed6ebcc24b1 upstream.

ARM recently moved to asm-generic/mutex-xchg.h for its mutex
implementation after the previous implementation was found to be missing
some crucial memory barriers. However, this has revealed some problems
running hackbench on SMP platforms due to the way in which the
MUTEX_SPIN_ON_OWNER code operates.

The symptoms are that a bunch of hackbench tasks are left waiting on an
unlocked mutex and therefore never get woken up to claim it. This boils
down to the following sequence of events:

        Task A        Task B        Task C        Lock value
0                                                     1
1       lock()                                        0
2                     lock()                          0
3                     spin(A)                         0
4       unlock()                                      1
5                                   lock()            0
6                     cmpxchg(1,0)                    0
7                     contended()                    -1
8       lock()                                        0
9       spin(C)                                       0
10                                  unlock()          1
11      cmpxchg(1,0)                                  0
12      unlock()                                      1

At this point, the lock is unlocked, but Task B is in an uninterruptible
sleep with nobody to wake it up.

This patch fixes the problem by ensuring we put the lock into the
contended state if we fail to acquire it on the fastpath, ensuring that
any blocked waiters are woken up when the mutex is released.

Signed-off-by: Will Deacon <will.deacon@arm.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Chris Mason <chris.mason@fusionio.com>
Cc: Ingo Molnar <mingo@elte.hu>
Reviewed-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Link: http://lkml.kernel.org/n/tip-6e9lrw2avczr0617fzl5vqb8@git.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/asm-generic/mutex-xchg.h |   11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

--- a/include/asm-generic/mutex-xchg.h
+++ b/include/asm-generic/mutex-xchg.h
@@ -26,7 +26,13 @@ static inline void
 __mutex_fastpath_lock(atomic_t *count, void (*fail_fn)(atomic_t *))
 {
 	if (unlikely(atomic_xchg(count, 0) != 1))
-		fail_fn(count);
+		/*
+		 * We failed to acquire the lock, so mark it contended
+		 * to ensure that any waiting tasks are woken up by the
+		 * unlock slow path.
+		 */
+		if (likely(atomic_xchg(count, -1) != 1))
+			fail_fn(count);
 }
 
 /**
@@ -43,7 +49,8 @@ static inline int
 __mutex_fastpath_lock_retval(atomic_t *count, int (*fail_fn)(atomic_t *))
 {
 	if (unlikely(atomic_xchg(count, 0) != 1))
-		return fail_fn(count);
+		if (likely(atomic_xchg(count, -1) != 1))
+			return fail_fn(count);
 	return 0;
 }
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 174/262] x86, avx: dont use avx instructions with "noxsave" boot param
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (172 preceding siblings ...)
  2012-09-28 18:51 ` [ 173/262] mutex: Place lock in contended state after fastpath_lock failure Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-10-07 21:26   ` Ben Hutchings
  2012-09-28 18:51 ` [ 175/262] drivers/rtc/rtc-rs5c348.c: fix hour decoding in 12-hour mode Greg Kroah-Hartman
                   ` (87 subsequent siblings)
  261 siblings, 1 reply; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Suresh Siddha, H. Peter Anvin

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Suresh Siddha <suresh.b.siddha@intel.com>

commit c6fd893da927c6cefb2ece22402765379921a834 upstream.

Clear AVX, AVX2 features along with clearing XSAVE feature bits,
as part of the parsing "noxsave" parameter.

Fixes the kernel boot panic with "noxsave" boot parameter.

We could have checked cpu_has_osxsave along with cpu_has_avx etc, but Peter
mentioned clearing the feature bits will be better for uses like
static_cpu_has() etc.

Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
Link: http://lkml.kernel.org/r/1343755754.2041.2.camel@sbsiddha-desk.sc.intel.com
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kernel/cpu/common.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -144,6 +144,8 @@ static int __init x86_xsave_setup(char *
 {
 	setup_clear_cpu_cap(X86_FEATURE_XSAVE);
 	setup_clear_cpu_cap(X86_FEATURE_XSAVEOPT);
+	setup_clear_cpu_cap(X86_FEATURE_AVX);
+	setup_clear_cpu_cap(X86_FEATURE_AVX2);
 	return 1;
 }
 __setup("noxsave", x86_xsave_setup);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 175/262] drivers/rtc/rtc-rs5c348.c: fix hour decoding in 12-hour mode
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (173 preceding siblings ...)
  2012-09-28 18:51 ` [ 174/262] x86, avx: dont use avx instructions with "noxsave" boot param Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 176/262] PM / Runtime: Fix rpm_resume() return value for power.no_callbacks set Greg Kroah-Hartman
                   ` (86 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, James Nute, Atsushi Nemoto, Andrew Morton, Linus Torvalds

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Atsushi Nemoto <anemo@mba.ocn.ne.jp>

commit 7dbfb315b2aaef0a115765946bf3026d074c33a7 upstream.

Correct the offset by subtracting 20 from tm_hour before taking the
modulo 12.

[ "Why 20?" I hear you ask. Or at least I did.

  Here's the reason why: RS5C348_BIT_PM is 32, and is - stupidly -
  included in the RS5C348_HOURS_MASK define.  So it's really subtracting
  out that bit to get "hour+12".  But then because it does things modulo
  12, it needs to add the 12 in again afterwards anyway.

  This code is confused.  It would be much clearer if RS5C348_HOURS_MASK
  just didn't include the RS5C348_BIT_PM bit at all, then it wouldn't
  need to do the silly subtract either.

  Whatever. It's all just math, the end result is the same.   - Linus ]

Reported-by: James Nute <newten82@gmail.com>
Tested-by: James Nute <newten82@gmail.com>
Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/rtc/rtc-rs5c348.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/drivers/rtc/rtc-rs5c348.c
+++ b/drivers/rtc/rtc-rs5c348.c
@@ -122,9 +122,12 @@ rs5c348_rtc_read_time(struct device *dev
 	tm->tm_min = bcd2bin(rxbuf[RS5C348_REG_MINS] & RS5C348_MINS_MASK);
 	tm->tm_hour = bcd2bin(rxbuf[RS5C348_REG_HOURS] & RS5C348_HOURS_MASK);
 	if (!pdata->rtc_24h) {
-		tm->tm_hour %= 12;
-		if (rxbuf[RS5C348_REG_HOURS] & RS5C348_BIT_PM)
+		if (rxbuf[RS5C348_REG_HOURS] & RS5C348_BIT_PM) {
+			tm->tm_hour -= 20;
+			tm->tm_hour %= 12;
 			tm->tm_hour += 12;
+		} else
+			tm->tm_hour %= 12;
 	}
 	tm->tm_wday = bcd2bin(rxbuf[RS5C348_REG_WDAY] & RS5C348_WDAY_MASK);
 	tm->tm_mday = bcd2bin(rxbuf[RS5C348_REG_DAY] & RS5C348_DAY_MASK);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 176/262] PM / Runtime: Fix rpm_resume() return value for power.no_callbacks set
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (174 preceding siblings ...)
  2012-09-28 18:51 ` [ 175/262] drivers/rtc/rtc-rs5c348.c: fix hour decoding in 12-hour mode Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 177/262] PM / Runtime: Clear power.deferred_resume on success in rpm_suspend() Greg Kroah-Hartman
                   ` (85 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Rafael J. Wysocki, Alan Stern

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Rafael J. Wysocki" <rjw@sisk.pl>

commit 7f321c26c04807834fef4c524d2b21573423fc74 upstream.

For devices whose power.no_callbacks flag is set, rpm_resume()
should return 1 if the device's parent is already active, so that
the callers of pm_runtime_get() don't think that they have to wait
for the device to resume (asynchronously) in that case (the core
won't queue up an asynchronous resume in that case, so there's
nothing to wait for anyway).

Modify the code accordingly (and make sure that an idle notification
will be queued up on success, even if 1 is to be returned).

Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/base/power/runtime.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -584,6 +584,7 @@ static int rpm_resume(struct device *dev
 		    || dev->parent->power.runtime_status == RPM_ACTIVE) {
 			atomic_inc(&dev->parent->power.child_count);
 			spin_unlock(&dev->parent->power.lock);
+			retval = 1;
 			goto no_callback;	/* Assume success. */
 		}
 		spin_unlock(&dev->parent->power.lock);
@@ -664,7 +665,7 @@ static int rpm_resume(struct device *dev
 	}
 	wake_up_all(&dev->power.wait_queue);
 
-	if (!retval)
+	if (retval >= 0)
 		rpm_idle(dev, RPM_ASYNC);
 
  out:



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 177/262] PM / Runtime: Clear power.deferred_resume on success in rpm_suspend()
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (175 preceding siblings ...)
  2012-09-28 18:51 ` [ 176/262] PM / Runtime: Fix rpm_resume() return value for power.no_callbacks set Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 178/262] PM / Runtime: Check device PM QoS setting before "no callbacks" check Greg Kroah-Hartman
                   ` (84 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Rafael J. Wysocki, Alan Stern

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Rafael J. Wysocki" <rjw@sisk.pl>

commit 58a34de7b1a920d287d17d2ca08bc9aaf7e6d35b upstream.

The power.deferred_resume can only be set if the runtime PM status
of device is RPM_SUSPENDING and it should be cleared after its
status has been changed, regardless of whether or not the runtime
suspend has been successful.  However, it only is cleared on
suspend failure, while it may remain set on successful suspend and
is happily leaked to rpm_resume() executed in that case.

That shouldn't happen, so if power.deferred_resume is set in
rpm_suspend() after the status has been changed to RPM_SUSPENDED,
clear it before calling rpm_resume().  Then, it doesn't need to be
cleared before changing the status to RPM_SUSPENDING any more,
because it's always cleared after the status has been changed to
either RPM_SUSPENDED (on success) or RPM_ACTIVE (on failure).

Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/base/power/runtime.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -388,7 +388,6 @@ static int rpm_suspend(struct device *de
 		goto repeat;
 	}
 
-	dev->power.deferred_resume = false;
 	if (dev->power.no_callbacks)
 		goto no_callback;	/* Assume success. */
 
@@ -440,6 +439,7 @@ static int rpm_suspend(struct device *de
 	wake_up_all(&dev->power.wait_queue);
 
 	if (dev->power.deferred_resume) {
+		dev->power.deferred_resume = false;
 		rpm_resume(dev, 0);
 		retval = -EAGAIN;
 		goto out;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 178/262] PM / Runtime: Check device PM QoS setting before "no callbacks" check
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (176 preceding siblings ...)
  2012-09-28 18:51 ` [ 177/262] PM / Runtime: Clear power.deferred_resume on success in rpm_suspend() Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 179/262] drivers/misc/sgi-xp/xpc_uv.c: SGI XPC fails to load when cpu 0 is out of IRQ resources Greg Kroah-Hartman
                   ` (83 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Rafael J. Wysocki, Alan Stern

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Rafael J. Wysocki" <rjw@sisk.pl>

commit 55d7ec4520e86d735d178c15d7df33d507bd43c6 upstream.

If __dev_pm_qos_read_value(dev) returns a negative value,
rpm_suspend() should return -EPERM for dev even if its
power.no_callbacks flag is set.  For this to happen, the device's
power.no_callbacks flag has to be checked after the PM QoS check,
so move the PM QoS check to rpm_check_suspend_allowed() (this will
make it cover idle notifications as well as runtime suspend too).

Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/base/power/runtime.c |    8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -147,6 +147,8 @@ static int rpm_check_suspend_allowed(str
 	    || (dev->power.request_pending
 			&& dev->power.request == RPM_REQ_RESUME))
 		retval = -EAGAIN;
+	else if (__dev_pm_qos_read_value(dev) < 0)
+		retval = -EPERM;
 	else if (dev->power.runtime_status == RPM_SUSPENDED)
 		retval = 1;
 
@@ -402,12 +404,6 @@ static int rpm_suspend(struct device *de
 		goto out;
 	}
 
-	if (__dev_pm_qos_read_value(dev) < 0) {
-		/* Negative PM QoS constraint means "never suspend". */
-		retval = -EPERM;
-		goto out;
-	}
-
 	__update_runtime_status(dev, RPM_SUSPENDING);
 
 	if (dev->pm_domain)



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 179/262] drivers/misc/sgi-xp/xpc_uv.c: SGI XPC fails to load when cpu 0 is out of IRQ resources
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (177 preceding siblings ...)
  2012-09-28 18:51 ` [ 178/262] PM / Runtime: Check device PM QoS setting before "no callbacks" check Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 180/262] fbcon: fix race condition between console lock and cursor timer (v1.1) Greg Kroah-Hartman
                   ` (82 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Robin Holt, Andrew Morton, Linus Torvalds

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Robin Holt <holt@sgi.com>

commit 7838f994b4fceff24c343f4e26a6cf4393869579 upstream.

On many of our larger systems, CPU 0 has had all of its IRQ resources
consumed before XPC loads.  Worst cases on machines with multiple 10
GigE cards and multiple IB cards have depleted the entire first socket
of IRQs.

This patch makes selecting the node upon which IRQs are allocated (as
well as all the other GRU Message Queue structures) specifiable as a
module load param and has a default behavior of searching all nodes/cpus
for an available resources.

[akpm@linux-foundation.org: fix build: include cpu.h and module.h]
Signed-off-by: Robin Holt <holt@sgi.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/misc/sgi-xp/xpc_uv.c |   84 +++++++++++++++++++++++++++++++++----------
 1 file changed, 65 insertions(+), 19 deletions(-)

--- a/drivers/misc/sgi-xp/xpc_uv.c
+++ b/drivers/misc/sgi-xp/xpc_uv.c
@@ -18,6 +18,8 @@
 #include <linux/interrupt.h>
 #include <linux/delay.h>
 #include <linux/device.h>
+#include <linux/cpu.h>
+#include <linux/module.h>
 #include <linux/err.h>
 #include <linux/slab.h>
 #include <asm/uv/uv_hub.h>
@@ -59,6 +61,8 @@ static struct xpc_heartbeat_uv *xpc_hear
 					 XPC_NOTIFY_MSG_SIZE_UV)
 #define XPC_NOTIFY_IRQ_NAME		"xpc_notify"
 
+static int xpc_mq_node = -1;
+
 static struct xpc_gru_mq_uv *xpc_activate_mq_uv;
 static struct xpc_gru_mq_uv *xpc_notify_mq_uv;
 
@@ -109,11 +113,8 @@ xpc_get_gru_mq_irq_uv(struct xpc_gru_mq_
 #if defined CONFIG_X86_64
 	mq->irq = uv_setup_irq(irq_name, cpu, mq->mmr_blade, mq->mmr_offset,
 			UV_AFFINITY_CPU);
-	if (mq->irq < 0) {
-		dev_err(xpc_part, "uv_setup_irq() returned error=%d\n",
-			-mq->irq);
+	if (mq->irq < 0)
 		return mq->irq;
-	}
 
 	mq->mmr_value = uv_read_global_mmr64(mmr_pnode, mq->mmr_offset);
 
@@ -238,8 +239,9 @@ xpc_create_gru_mq_uv(unsigned int mq_siz
 	mq->mmr_blade = uv_cpu_to_blade_id(cpu);
 
 	nid = cpu_to_node(cpu);
-	page = alloc_pages_exact_node(nid, GFP_KERNEL | __GFP_ZERO | GFP_THISNODE,
-				pg_order);
+	page = alloc_pages_exact_node(nid,
+				      GFP_KERNEL | __GFP_ZERO | GFP_THISNODE,
+				      pg_order);
 	if (page == NULL) {
 		dev_err(xpc_part, "xpc_create_gru_mq_uv() failed to alloc %d "
 			"bytes of memory on nid=%d for GRU mq\n", mq_size, nid);
@@ -1731,9 +1733,50 @@ static struct xpc_arch_operations xpc_ar
 	.notify_senders_of_disconnect = xpc_notify_senders_of_disconnect_uv,
 };
 
+static int
+xpc_init_mq_node(int nid)
+{
+	int cpu;
+
+	get_online_cpus();
+
+	for_each_cpu(cpu, cpumask_of_node(nid)) {
+		xpc_activate_mq_uv =
+			xpc_create_gru_mq_uv(XPC_ACTIVATE_MQ_SIZE_UV, nid,
+					     XPC_ACTIVATE_IRQ_NAME,
+					     xpc_handle_activate_IRQ_uv);
+		if (!IS_ERR(xpc_activate_mq_uv))
+			break;
+	}
+	if (IS_ERR(xpc_activate_mq_uv)) {
+		put_online_cpus();
+		return PTR_ERR(xpc_activate_mq_uv);
+	}
+
+	for_each_cpu(cpu, cpumask_of_node(nid)) {
+		xpc_notify_mq_uv =
+			xpc_create_gru_mq_uv(XPC_NOTIFY_MQ_SIZE_UV, nid,
+					     XPC_NOTIFY_IRQ_NAME,
+					     xpc_handle_notify_IRQ_uv);
+		if (!IS_ERR(xpc_notify_mq_uv))
+			break;
+	}
+	if (IS_ERR(xpc_notify_mq_uv)) {
+		xpc_destroy_gru_mq_uv(xpc_activate_mq_uv);
+		put_online_cpus();
+		return PTR_ERR(xpc_notify_mq_uv);
+	}
+
+	put_online_cpus();
+	return 0;
+}
+
 int
 xpc_init_uv(void)
 {
+	int nid;
+	int ret = 0;
+
 	xpc_arch_ops = xpc_arch_ops_uv;
 
 	if (sizeof(struct xpc_notify_mq_msghdr_uv) > XPC_MSG_HDR_MAX_SIZE) {
@@ -1742,21 +1785,21 @@ xpc_init_uv(void)
 		return -E2BIG;
 	}
 
-	xpc_activate_mq_uv = xpc_create_gru_mq_uv(XPC_ACTIVATE_MQ_SIZE_UV, 0,
-						  XPC_ACTIVATE_IRQ_NAME,
-						  xpc_handle_activate_IRQ_uv);
-	if (IS_ERR(xpc_activate_mq_uv))
-		return PTR_ERR(xpc_activate_mq_uv);
+	if (xpc_mq_node < 0)
+		for_each_online_node(nid) {
+			ret = xpc_init_mq_node(nid);
 
-	xpc_notify_mq_uv = xpc_create_gru_mq_uv(XPC_NOTIFY_MQ_SIZE_UV, 0,
-						XPC_NOTIFY_IRQ_NAME,
-						xpc_handle_notify_IRQ_uv);
-	if (IS_ERR(xpc_notify_mq_uv)) {
-		xpc_destroy_gru_mq_uv(xpc_activate_mq_uv);
-		return PTR_ERR(xpc_notify_mq_uv);
-	}
+			if (!ret)
+				break;
+		}
+	else
+		ret = xpc_init_mq_node(xpc_mq_node);
 
-	return 0;
+	if (ret < 0)
+		dev_err(xpc_part, "xpc_init_mq_node() returned error=%d\n",
+			-ret);
+
+	return ret;
 }
 
 void
@@ -1765,3 +1808,6 @@ xpc_exit_uv(void)
 	xpc_destroy_gru_mq_uv(xpc_notify_mq_uv);
 	xpc_destroy_gru_mq_uv(xpc_activate_mq_uv);
 }
+
+module_param(xpc_mq_node, int, 0);
+MODULE_PARM_DESC(xpc_mq_node, "Node number on which to allocate message queues.");



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 180/262] fbcon: fix race condition between console lock and cursor timer (v1.1)
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (178 preceding siblings ...)
  2012-09-28 18:51 ` [ 179/262] drivers/misc/sgi-xp/xpc_uv.c: SGI XPC fails to load when cpu 0 is out of IRQ resources Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 181/262] drm/radeon: avoid turning off spread spectrum for used pll Greg Kroah-Hartman
                   ` (81 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Dave Airlie, Josh Boyer, Linus Torvalds

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dave Airlie <airlied@redhat.com>

commit d8636a2717bb3da2a7ce2154bf08de90bb8c87b0 upstream.

So we've had a fair few reports of fbcon handover breakage between
efi/vesafb and i915 surface recently, so I dedicated a couple of
days to finding the problem.

Essentially the last thing we saw was the conflicting framebuffer
message and that was all.

So after much tracing with direct netconsole writes (printks
under console_lock not so useful), I think I found the race.

Thread A (driver load)    Thread B (timer thread)
  unbind_con_driver ->              |
  bind_con_driver ->                |
  vc->vc_sw->con_deinit ->          |
  fbcon_deinit ->                   |
  console_lock()                    |
      |                             |
      |                       fbcon_flashcursor timer fires
      |                       console_lock() <- blocked for A
      |
      |
fbcon_del_cursor_timer ->
  del_timer_sync
  (BOOM)

Of course because all of this is under the console lock,
we never see anything, also since we also just unbound the active
console guess what we never see anything.

Hopefully this fixes the problem for anyone seeing vesafb->kms
driver handoff.

v1.1: add comment suggestion from Alan.

Signed-off-by: Dave Airlie <airlied@redhat.com>
Acked-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Tested-by: Josh Boyer <jwboyer@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/video/console/fbcon.c |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -372,8 +372,15 @@ static void fb_flashcursor(struct work_s
 	struct vc_data *vc = NULL;
 	int c;
 	int mode;
+	int ret;
+
+	/* FIXME: we should sort out the unbind locking instead */
+	/* instead we just fail to flash the cursor if we can't get
+	 * the lock instead of blocking fbcon deinit */
+	ret = console_trylock();
+	if (ret == 0)
+		return;
 
-	console_lock();
 	if (ops && ops->currcon != -1)
 		vc = vc_cons[ops->currcon].d;
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 181/262] drm/radeon: avoid turning off spread spectrum for used pll
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (179 preceding siblings ...)
  2012-09-28 18:51 ` [ 180/262] fbcon: fix race condition between console lock and cursor timer (v1.1) Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 182/262] drm/radeon/ss: use num_crtc rather than hardcoded 6 Greg Kroah-Hartman
                   ` (80 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Jerome Glisse, Alex Deucher

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jerome Glisse <jglisse@redhat.com>

commit 5efcc76c13a745f98e7b6604d6aca49761be1970 upstream.

If spread spectrum is enabled and in use for a given pll we
should not turn it off as it will lead to turning off display
for crtc that use the pll (this behavior was observed on chelsea
edp).

Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/radeon/atombios_crtc.c |   25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)

--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -444,11 +444,28 @@ union atom_enable_ss {
 static void atombios_crtc_program_ss(struct radeon_device *rdev,
 				     int enable,
 				     int pll_id,
+				     int crtc_id,
 				     struct radeon_atom_ss *ss)
 {
+	unsigned i;
 	int index = GetIndexIntoMasterTable(COMMAND, EnableSpreadSpectrumOnPPLL);
 	union atom_enable_ss args;
 
+	if (!enable) {
+		for (i = 0; i < 6; i++) {
+			if (rdev->mode_info.crtcs[i] &&
+			    rdev->mode_info.crtcs[i]->enabled &&
+			    i != crtc_id &&
+			    pll_id == rdev->mode_info.crtcs[i]->pll_id) {
+				/* one other crtc is using this pll don't turn
+				 * off spread spectrum as it might turn off
+				 * display on active crtc
+				 */
+				return;
+			}
+		}
+	}
+
 	memset(&args, 0, sizeof(args));
 
 	if (ASIC_IS_DCE5(rdev)) {
@@ -1036,7 +1053,7 @@ static void atombios_crtc_set_pll(struct
 		radeon_compute_pll_legacy(pll, adjusted_clock, &pll_clock, &fb_div, &frac_fb_div,
 					  &ref_div, &post_div);
 
-	atombios_crtc_program_ss(rdev, ATOM_DISABLE, radeon_crtc->pll_id, &ss);
+	atombios_crtc_program_ss(rdev, ATOM_DISABLE, radeon_crtc->pll_id, radeon_crtc->crtc_id, &ss);
 
 	atombios_crtc_program_pll(crtc, radeon_crtc->crtc_id, radeon_crtc->pll_id,
 				  encoder_mode, radeon_encoder->encoder_id, mode->clock,
@@ -1059,7 +1076,7 @@ static void atombios_crtc_set_pll(struct
 			ss.step = step_size;
 		}
 
-		atombios_crtc_program_ss(rdev, ATOM_ENABLE, radeon_crtc->pll_id, &ss);
+		atombios_crtc_program_ss(rdev, ATOM_ENABLE, radeon_crtc->pll_id, radeon_crtc->crtc_id, &ss);
 	}
 }
 
@@ -1576,11 +1593,11 @@ void radeon_atom_disp_eng_pll_init(struc
 								   ASIC_INTERNAL_SS_ON_DCPLL,
 								   rdev->clock.default_dispclk);
 		if (ss_enabled)
-			atombios_crtc_program_ss(rdev, ATOM_DISABLE, ATOM_DCPLL, &ss);
+			atombios_crtc_program_ss(rdev, ATOM_DISABLE, ATOM_DCPLL, -1, &ss);
 		/* XXX: DCE5, make sure voltage, dispclk is high enough */
 		atombios_crtc_set_disp_eng_pll(rdev, rdev->clock.default_dispclk);
 		if (ss_enabled)
-			atombios_crtc_program_ss(rdev, ATOM_ENABLE, ATOM_DCPLL, &ss);
+			atombios_crtc_program_ss(rdev, ATOM_ENABLE, ATOM_DCPLL, -1, &ss);
 	}
 
 }



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 182/262] drm/radeon/ss: use num_crtc rather than hardcoded 6
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (180 preceding siblings ...)
  2012-09-28 18:51 ` [ 181/262] drm/radeon: avoid turning off spread spectrum for used pll Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 183/262] drm/radeon: fence virtual address and free it once idle v4 Greg Kroah-Hartman
                   ` (79 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Alex Deucher

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alex Deucher <alexander.deucher@amd.com>

commit 5317670692f61675394db2eb6713484b67383750 upstream.

When checking if a pll is in use.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/radeon/atombios_crtc.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -452,7 +452,7 @@ static void atombios_crtc_program_ss(str
 	union atom_enable_ss args;
 
 	if (!enable) {
-		for (i = 0; i < 6; i++) {
+		for (i = 0; i < rdev->num_crtc; i++) {
 			if (rdev->mode_info.crtcs[i] &&
 			    rdev->mode_info.crtcs[i]->enabled &&
 			    i != crtc_id &&



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 183/262] drm/radeon: fence virtual address and free it once idle v4
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (181 preceding siblings ...)
  2012-09-28 18:51 ` [ 182/262] drm/radeon/ss: use num_crtc rather than hardcoded 6 Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 184/262] drm/radeon: split ATRM support out from the ATPX handler (v3) Greg Kroah-Hartman
                   ` (78 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Jerome Glisse, Alex Deucher

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jerome Glisse <jglisse@redhat.com>

commit e43b5ec05afdc232be25aa481315035c1888d389 upstream.

Virtual address need to be fenced to know when we can safely remove it.
This patch also properly clear the pagetable. Previously it was
serouisly broken.

Kernel 3.5/3.4 need a similar patch but adapted for difference in mutex locking.

v2: For to update pagetable when unbinding bo (don't bailout if
    bo_va->valid is true).
v3: Add kernel 3.5/3.4 comment.
v4: Fix compilation warnings.

Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/radeon/radeon.h        |    1 +
 drivers/gpu/drm/radeon/radeon_cs.c     |   30 +++++++++++++++++++++++++++---
 drivers/gpu/drm/radeon/radeon_gart.c   |   24 ++++++++++++++++++++++--
 drivers/gpu/drm/radeon/radeon_gem.c    |   13 ++-----------
 drivers/gpu/drm/radeon/radeon_object.c |    6 +-----
 5 files changed, 53 insertions(+), 21 deletions(-)

--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -323,6 +323,7 @@ struct radeon_bo_va {
 	uint64_t			soffset;
 	uint64_t			eoffset;
 	uint32_t			flags;
+	struct radeon_fence		*fence;
 	bool				valid;
 };
 
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -294,6 +294,28 @@ int radeon_cs_parser_init(struct radeon_
 	return 0;
 }
 
+static void radeon_bo_vm_fence_va(struct radeon_cs_parser *parser,
+				  struct radeon_fence *fence)
+{
+	struct radeon_fpriv *fpriv = parser->filp->driver_priv;
+	struct radeon_vm *vm = &fpriv->vm;
+	struct radeon_bo_list *lobj;
+
+	if (parser->chunk_ib_idx == -1)
+		return;
+	if ((parser->cs_flags & RADEON_CS_USE_VM) == 0)
+		return;
+
+	list_for_each_entry(lobj, &parser->validated, tv.head) {
+		struct radeon_bo_va *bo_va;
+		struct radeon_bo *rbo = lobj->bo;
+
+		bo_va = radeon_bo_va(rbo, vm);
+		radeon_fence_unref(&bo_va->fence);
+		bo_va->fence = radeon_fence_ref(fence);
+	}
+}
+
 /**
  * cs_parser_fini() - clean parser states
  * @parser:	parser structure holding parsing context.
@@ -306,11 +328,14 @@ static void radeon_cs_parser_fini(struct
 {
 	unsigned i;
 
-	if (!error)
+	if (!error) {
+		/* fence all bo va before ttm_eu_fence_buffer_objects so bo are still reserved */
+		radeon_bo_vm_fence_va(parser, parser->ib.fence);
 		ttm_eu_fence_buffer_objects(&parser->validated,
 					    parser->ib.fence);
-	else
+	} else {
 		ttm_eu_backoff_reservation(&parser->validated);
+	}
 
 	if (parser->relocs != NULL) {
 		for (i = 0; i < parser->nrelocs; i++) {
@@ -407,7 +432,6 @@ static int radeon_cs_ib_vm_chunk(struct
 
 	if (parser->chunk_ib_idx == -1)
 		return 0;
-
 	if ((parser->cs_flags & RADEON_CS_USE_VM) == 0)
 		return 0;
 
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -564,7 +564,7 @@ int radeon_vm_bo_update_pte(struct radeo
 		return -EINVAL;
 	}
 
-	if (bo_va->valid)
+	if (bo_va->valid && mem)
 		return 0;
 
 	ngpu_pages = radeon_bo_ngpu_pages(bo);
@@ -597,11 +597,27 @@ int radeon_vm_bo_rmv(struct radeon_devic
 		     struct radeon_bo *bo)
 {
 	struct radeon_bo_va *bo_va;
+	int r;
 
 	bo_va = radeon_bo_va(bo, vm);
 	if (bo_va == NULL)
 		return 0;
 
+	/* wait for va use to end */
+	while (bo_va->fence) {
+		r = radeon_fence_wait(bo_va->fence, false);
+		if (r) {
+			DRM_ERROR("error while waiting for fence: %d\n", r);
+		}
+		if (r == -EDEADLK) {
+			r = radeon_gpu_reset(rdev);
+			if (!r)
+				continue;
+		}
+		break;
+	}
+	radeon_fence_unref(&bo_va->fence);
+
 	radeon_mutex_lock(&rdev->cs_mutex);
 	mutex_lock(&vm->mutex);
 	radeon_vm_bo_update_pte(rdev, vm, bo, NULL);
@@ -661,12 +677,15 @@ void radeon_vm_fini(struct radeon_device
 	radeon_vm_unbind_locked(rdev, vm);
 	radeon_mutex_unlock(&rdev->cs_mutex);
 
-	/* remove all bo */
+	/* remove all bo at this point non are busy any more because unbind
+	 * waited for the last vm fence to signal
+	 */
 	r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false);
 	if (!r) {
 		bo_va = radeon_bo_va(rdev->ring_tmp_bo.bo, vm);
 		list_del_init(&bo_va->bo_list);
 		list_del_init(&bo_va->vm_list);
+		radeon_fence_unref(&bo_va->fence);
 		radeon_bo_unreserve(rdev->ring_tmp_bo.bo);
 		kfree(bo_va);
 	}
@@ -678,6 +697,7 @@ void radeon_vm_fini(struct radeon_device
 		r = radeon_bo_reserve(bo_va->bo, false);
 		if (!r) {
 			list_del_init(&bo_va->bo_list);
+			radeon_fence_unref(&bo_va->fence);
 			radeon_bo_unreserve(bo_va->bo);
 			kfree(bo_va);
 		}
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -134,25 +134,16 @@ void radeon_gem_object_close(struct drm_
 	struct radeon_device *rdev = rbo->rdev;
 	struct radeon_fpriv *fpriv = file_priv->driver_priv;
 	struct radeon_vm *vm = &fpriv->vm;
-	struct radeon_bo_va *bo_va, *tmp;
 
 	if (rdev->family < CHIP_CAYMAN) {
 		return;
 	}
 
 	if (radeon_bo_reserve(rbo, false)) {
+		dev_err(rdev->dev, "leaking bo va because we fail to reserve bo\n");
 		return;
 	}
-	list_for_each_entry_safe(bo_va, tmp, &rbo->va, bo_list) {
-		if (bo_va->vm == vm) {
-			/* remove from this vm address space */
-			mutex_lock(&vm->mutex);
-			list_del(&bo_va->vm_list);
-			mutex_unlock(&vm->mutex);
-			list_del(&bo_va->bo_list);
-			kfree(bo_va);
-		}
-	}
+	radeon_vm_bo_rmv(rdev, vm, rbo);
 	radeon_bo_unreserve(rbo);
 }
 
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -52,11 +52,7 @@ void radeon_bo_clear_va(struct radeon_bo
 
 	list_for_each_entry_safe(bo_va, tmp, &bo->va, bo_list) {
 		/* remove from all vm address space */
-		mutex_lock(&bo_va->vm->mutex);
-		list_del(&bo_va->vm_list);
-		mutex_unlock(&bo_va->vm->mutex);
-		list_del(&bo_va->bo_list);
-		kfree(bo_va);
+		radeon_vm_bo_rmv(bo->rdev, bo_va->vm, bo);
 	}
 }
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 184/262] drm/radeon: split ATRM support out from the ATPX handler (v3)
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (182 preceding siblings ...)
  2012-09-28 18:51 ` [ 183/262] drm/radeon: fence virtual address and free it once idle v4 Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 185/262] drm/radeon: implement ACPI VFCT vbios fetch (v3) Greg Kroah-Hartman
                   ` (77 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Alex Deucher

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alex Deucher <alexander.deucher@amd.com>

commit c61e2775873f603148e8e998a938721b7d222d24 upstream.

There are systems that use ATRM, but not ATPX.

Fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=41265

V2: fix #ifdefs as per Greg's comments
V3: fix it harder

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/radeon/radeon.h              |   15 -----
 drivers/gpu/drm/radeon/radeon_atpx_handler.c |   56 ------------------
 drivers/gpu/drm/radeon/radeon_bios.c         |   80 +++++++++++++++++++++++++--
 3 files changed, 77 insertions(+), 74 deletions(-)

--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -143,21 +143,6 @@ struct radeon_device;
 /*
  * BIOS.
  */
-#define ATRM_BIOS_PAGE 4096
-
-#if defined(CONFIG_VGA_SWITCHEROO)
-bool radeon_atrm_supported(struct pci_dev *pdev);
-int radeon_atrm_get_bios_chunk(uint8_t *bios, int offset, int len);
-#else
-static inline bool radeon_atrm_supported(struct pci_dev *pdev)
-{
-	return false;
-}
-
-static inline int radeon_atrm_get_bios_chunk(uint8_t *bios, int offset, int len){
-	return -EINVAL;
-}
-#endif
 bool radeon_get_bios(struct radeon_device *rdev);
 
 
--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
@@ -30,57 +30,8 @@ static struct radeon_atpx_priv {
 	/* handle for device - and atpx */
 	acpi_handle dhandle;
 	acpi_handle atpx_handle;
-	acpi_handle atrm_handle;
 } radeon_atpx_priv;
 
-/* retrieve the ROM in 4k blocks */
-static int radeon_atrm_call(acpi_handle atrm_handle, uint8_t *bios,
-			    int offset, int len)
-{
-	acpi_status status;
-	union acpi_object atrm_arg_elements[2], *obj;
-	struct acpi_object_list atrm_arg;
-	struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL};
-
-	atrm_arg.count = 2;
-	atrm_arg.pointer = &atrm_arg_elements[0];
-
-	atrm_arg_elements[0].type = ACPI_TYPE_INTEGER;
-	atrm_arg_elements[0].integer.value = offset;
-
-	atrm_arg_elements[1].type = ACPI_TYPE_INTEGER;
-	atrm_arg_elements[1].integer.value = len;
-
-	status = acpi_evaluate_object(atrm_handle, NULL, &atrm_arg, &buffer);
-	if (ACPI_FAILURE(status)) {
-		printk("failed to evaluate ATRM got %s\n", acpi_format_exception(status));
-		return -ENODEV;
-	}
-
-	obj = (union acpi_object *)buffer.pointer;
-	memcpy(bios+offset, obj->buffer.pointer, obj->buffer.length);
-	len = obj->buffer.length;
-	kfree(buffer.pointer);
-	return len;
-}
-
-bool radeon_atrm_supported(struct pci_dev *pdev)
-{
-	/* get the discrete ROM only via ATRM */
-	if (!radeon_atpx_priv.atpx_detected)
-		return false;
-
-	if (radeon_atpx_priv.dhandle == DEVICE_ACPI_HANDLE(&pdev->dev))
-		return false;
-	return true;
-}
-
-
-int radeon_atrm_get_bios_chunk(uint8_t *bios, int offset, int len)
-{
-	return radeon_atrm_call(radeon_atpx_priv.atrm_handle, bios, offset, len);
-}
-
 static int radeon_atpx_get_version(acpi_handle handle)
 {
 	acpi_status status;
@@ -198,7 +149,7 @@ static int radeon_atpx_power_state(enum
 
 static bool radeon_atpx_pci_probe_handle(struct pci_dev *pdev)
 {
-	acpi_handle dhandle, atpx_handle, atrm_handle;
+	acpi_handle dhandle, atpx_handle;
 	acpi_status status;
 
 	dhandle = DEVICE_ACPI_HANDLE(&pdev->dev);
@@ -209,13 +160,8 @@ static bool radeon_atpx_pci_probe_handle
 	if (ACPI_FAILURE(status))
 		return false;
 
-	status = acpi_get_handle(dhandle, "ATRM", &atrm_handle);
-	if (ACPI_FAILURE(status))
-		return false;
-
 	radeon_atpx_priv.dhandle = dhandle;
 	radeon_atpx_priv.atpx_handle = atpx_handle;
-	radeon_atpx_priv.atrm_handle = atrm_handle;
 	return true;
 }
 
--- a/drivers/gpu/drm/radeon/radeon_bios.c
+++ b/drivers/gpu/drm/radeon/radeon_bios.c
@@ -98,16 +98,81 @@ static bool radeon_read_bios(struct rade
 	return true;
 }
 
+#ifdef CONFIG_ACPI
 /* ATRM is used to get the BIOS on the discrete cards in
  * dual-gpu systems.
  */
+/* retrieve the ROM in 4k blocks */
+#define ATRM_BIOS_PAGE 4096
+/**
+ * radeon_atrm_call - fetch a chunk of the vbios
+ *
+ * @atrm_handle: acpi ATRM handle
+ * @bios: vbios image pointer
+ * @offset: offset of vbios image data to fetch
+ * @len: length of vbios image data to fetch
+ *
+ * Executes ATRM to fetch a chunk of the discrete
+ * vbios image on PX systems (all asics).
+ * Returns the length of the buffer fetched.
+ */
+static int radeon_atrm_call(acpi_handle atrm_handle, uint8_t *bios,
+			    int offset, int len)
+{
+	acpi_status status;
+	union acpi_object atrm_arg_elements[2], *obj;
+	struct acpi_object_list atrm_arg;
+	struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL};
+
+	atrm_arg.count = 2;
+	atrm_arg.pointer = &atrm_arg_elements[0];
+
+	atrm_arg_elements[0].type = ACPI_TYPE_INTEGER;
+	atrm_arg_elements[0].integer.value = offset;
+
+	atrm_arg_elements[1].type = ACPI_TYPE_INTEGER;
+	atrm_arg_elements[1].integer.value = len;
+
+	status = acpi_evaluate_object(atrm_handle, NULL, &atrm_arg, &buffer);
+	if (ACPI_FAILURE(status)) {
+		printk("failed to evaluate ATRM got %s\n", acpi_format_exception(status));
+		return -ENODEV;
+	}
+
+	obj = (union acpi_object *)buffer.pointer;
+	memcpy(bios+offset, obj->buffer.pointer, obj->buffer.length);
+	len = obj->buffer.length;
+	kfree(buffer.pointer);
+	return len;
+}
+
 static bool radeon_atrm_get_bios(struct radeon_device *rdev)
 {
 	int ret;
 	int size = 256 * 1024;
 	int i;
+	struct pci_dev *pdev = NULL;
+	acpi_handle dhandle, atrm_handle;
+	acpi_status status;
+	bool found = false;
 
-	if (!radeon_atrm_supported(rdev->pdev))
+	/* ATRM is for the discrete card only */
+	if (rdev->flags & RADEON_IS_IGP)
+		return false;
+
+	while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_VGA << 8, pdev)) != NULL) {
+		dhandle = DEVICE_ACPI_HANDLE(&pdev->dev);
+		if (!dhandle)
+			continue;
+
+		status = acpi_get_handle(dhandle, "ATRM", &atrm_handle);
+		if (!ACPI_FAILURE(status)) {
+			found = true;
+			break;
+		}
+	}
+
+	if (!found)
 		return false;
 
 	rdev->bios = kmalloc(size, GFP_KERNEL);
@@ -117,9 +182,10 @@ static bool radeon_atrm_get_bios(struct
 	}
 
 	for (i = 0; i < size / ATRM_BIOS_PAGE; i++) {
-		ret = radeon_atrm_get_bios_chunk(rdev->bios,
-						 (i * ATRM_BIOS_PAGE),
-						 ATRM_BIOS_PAGE);
+		ret = radeon_atrm_call(atrm_handle,
+				       rdev->bios,
+				       (i * ATRM_BIOS_PAGE),
+				       ATRM_BIOS_PAGE);
 		if (ret < ATRM_BIOS_PAGE)
 			break;
 	}
@@ -130,6 +196,12 @@ static bool radeon_atrm_get_bios(struct
 	}
 	return true;
 }
+#else
+static inline bool radeon_atrm_get_bios(struct radeon_device *rdev)
+{
+	return false;
+}
+#endif
 
 static bool ni_read_disabled_bios(struct radeon_device *rdev)
 {



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 185/262] drm/radeon: implement ACPI VFCT vbios fetch (v3)
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (183 preceding siblings ...)
  2012-09-28 18:51 ` [ 184/262] drm/radeon: split ATRM support out from the ATPX handler (v3) Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 186/262] drm/radeon/kms: extend the Fujitsu D3003-S2 board connector quirk to cover later silicon stepping Greg Kroah-Hartman
                   ` (76 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Alex Deucher, Jerome Glisse

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Lamparter <equinox@diac24.net>

commit 268ba0a99f89a84dc5eb312470896113d0709c74 upstream.

This is required for pure UEFI systems.  The vbios is stored
in ACPI rather than at the legacy vga location.

Fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=26891

V2: fix #ifdefs as per Greg's comments
V3: fix it harder

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/radeon/radeon_bios.c |   60 +++++++++++++++++++++++++++++++++++
 1 file changed, 60 insertions(+)

--- a/drivers/gpu/drm/radeon/radeon_bios.c
+++ b/drivers/gpu/drm/radeon/radeon_bios.c
@@ -32,6 +32,7 @@
 
 #include <linux/vga_switcheroo.h>
 #include <linux/slab.h>
+#include <linux/acpi.h>
 /*
  * BIOS.
  */
@@ -548,6 +549,63 @@ static bool radeon_read_disabled_bios(st
 		return legacy_read_disabled_bios(rdev);
 }
 
+#ifdef CONFIG_ACPI
+static bool radeon_acpi_vfct_bios(struct radeon_device *rdev)
+{
+	bool ret = false;
+	struct acpi_table_header *hdr;
+	/* acpi_get_table_with_size is not exported :( */
+	acpi_size tbl_size = 0x7fffffff;
+	UEFI_ACPI_VFCT *vfct;
+	GOP_VBIOS_CONTENT *vbios;
+	VFCT_IMAGE_HEADER *vhdr;
+
+	if (!ACPI_SUCCESS(acpi_get_table("VFCT", 1, &hdr)))
+		return false;
+	if (tbl_size < sizeof(UEFI_ACPI_VFCT)) {
+		DRM_ERROR("ACPI VFCT table present but broken (too short #1)\n");
+		goto out_unmap;
+	}
+
+	vfct = (UEFI_ACPI_VFCT *)hdr;
+	if (vfct->VBIOSImageOffset + sizeof(VFCT_IMAGE_HEADER) > tbl_size) {
+		DRM_ERROR("ACPI VFCT table present but broken (too short #2)\n");
+		goto out_unmap;
+	}
+
+	vbios = (GOP_VBIOS_CONTENT *)((char *)hdr + vfct->VBIOSImageOffset);
+	vhdr = &vbios->VbiosHeader;
+	DRM_INFO("ACPI VFCT contains a BIOS for %02x:%02x.%d %04x:%04x, size %d\n",
+			vhdr->PCIBus, vhdr->PCIDevice, vhdr->PCIFunction,
+			vhdr->VendorID, vhdr->DeviceID, vhdr->ImageLength);
+
+	if (vhdr->PCIBus != rdev->pdev->bus->number ||
+	    vhdr->PCIDevice != PCI_SLOT(rdev->pdev->devfn) ||
+	    vhdr->PCIFunction != PCI_FUNC(rdev->pdev->devfn) ||
+	    vhdr->VendorID != rdev->pdev->vendor ||
+	    vhdr->DeviceID != rdev->pdev->device) {
+		DRM_INFO("ACPI VFCT table is not for this card\n");
+		goto out_unmap;
+	};
+
+	if (vfct->VBIOSImageOffset + sizeof(VFCT_IMAGE_HEADER) + vhdr->ImageLength > tbl_size) {
+		DRM_ERROR("ACPI VFCT image truncated\n");
+		goto out_unmap;
+	}
+
+	rdev->bios = kmemdup(&vbios->VbiosContent, vhdr->ImageLength, GFP_KERNEL);
+	ret = !!rdev->bios;
+
+out_unmap:
+	/* uh, no idea what to do here... */
+	return ret;
+}
+#else
+static inline bool radeon_acpi_vfct_bios(struct radeon_device *rdev)
+{
+	return false;
+}
+#endif
 
 bool radeon_get_bios(struct radeon_device *rdev)
 {
@@ -556,6 +614,8 @@ bool radeon_get_bios(struct radeon_devic
 
 	r = radeon_atrm_get_bios(rdev);
 	if (r == false)
+		r = radeon_acpi_vfct_bios(rdev);
+	if (r == false)
 		r = igp_read_bios_from_vram(rdev);
 	if (r == false)
 		r = radeon_read_bios(rdev);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 186/262] drm/radeon/kms: extend the Fujitsu D3003-S2 board connector quirk to cover later silicon stepping
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (184 preceding siblings ...)
  2012-09-28 18:51 ` [ 185/262] drm/radeon: implement ACPI VFCT vbios fetch (v3) Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 187/262] drm/radeon: init lockup timeout on ring init Greg Kroah-Hartman
                   ` (75 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Tvrtko Ursulin, Alex Deucher

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tvrtko Ursulin <tvrtko.ursulin@onelan.co.uk>

commit 52e9b39d9a89ae33662596bd30e62dd56bddbe73 upstream.

There is a more recent APU stepping with a new PCI ID
shipping in the same board by Fujitsu which needs the
same quirk to correctly mark the back plane connectors.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@onelan.co.uk>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/radeon/radeon_atombios.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -452,7 +452,7 @@ static bool radeon_atom_apply_quirks(str
 	}
 
 	/* Fujitsu D3003-S2 board lists DVI-I as DVI-D and VGA */
-	if ((dev->pdev->device == 0x9802) &&
+	if (((dev->pdev->device == 0x9802) || (dev->pdev->device == 0x9806)) &&
 	    (dev->pdev->subsystem_vendor == 0x1734) &&
 	    (dev->pdev->subsystem_device == 0x11bd)) {
 		if (*connector_type == DRM_MODE_CONNECTOR_VGA) {



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 187/262] drm/radeon: init lockup timeout on ring init
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (185 preceding siblings ...)
  2012-09-28 18:51 ` [ 186/262] drm/radeon/kms: extend the Fujitsu D3003-S2 board connector quirk to cover later silicon stepping Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 188/262] drm/i915: extract connector update from intel_ddc_get_modes() for reuse Greg Kroah-Hartman
                   ` (74 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Christian König, Michel Dänzer

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Christian König <deathsimple@vodafone.de>

commit 48c0ac9911839daf188e4a0b6b132ac31050a241 upstream.

Reset the lockup timeout on ring (re-)initialisation.

Otherwise we get error messages like this on gpu resets:
[ 1559.949177] radeon 0000:01:00.0: GPU lockup CP stall for more than 1482270msec

Signed-off-by: Christian König <deathsimple@vodafone.de>
Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/radeon/radeon_ring.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -394,6 +394,7 @@ int radeon_ring_init(struct radeon_devic
 	if (radeon_debugfs_ring_init(rdev, ring)) {
 		DRM_ERROR("Failed to register debugfs file for rings !\n");
 	}
+	radeon_ring_lockup_update(ring);
 	return 0;
 }
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 188/262] drm/i915: extract connector update from intel_ddc_get_modes() for reuse
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (186 preceding siblings ...)
  2012-09-28 18:51 ` [ 187/262] drm/radeon: init lockup timeout on ring init Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 189/262] drm/i915: fall back to bit-banging if GMBUS fails in CRT EDID reads Greg Kroah-Hartman
                   ` (73 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Jani Nikula, Alex Ferrando, Daniel Vetter

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jani Nikula <jani.nikula@intel.com>

commit 4eab81366465aedcfd26de960c595bc03599c09f upstream.

Refactor the connector update part of intel_ddc_get_modes() into a separate
intel_connector_update_modes() function for reuse. No functional changes.

Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=45881
Tested-by: Alex Ferrando <alferpal@gmail.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/i915/intel_drv.h   |    2 ++
 drivers/gpu/drm/i915/intel_modes.c |   31 ++++++++++++++++++++++---------
 2 files changed, 24 insertions(+), 9 deletions(-)

--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -334,6 +334,8 @@ struct intel_fbc_work {
 	int interval;
 };
 
+int intel_connector_update_modes(struct drm_connector *connector,
+				struct edid *edid);
 int intel_ddc_get_modes(struct drm_connector *c, struct i2c_adapter *adapter);
 extern bool intel_ddc_probe(struct intel_encoder *intel_encoder, int ddc_bus);
 
--- a/drivers/gpu/drm/i915/intel_modes.c
+++ b/drivers/gpu/drm/i915/intel_modes.c
@@ -61,6 +61,25 @@ bool intel_ddc_probe(struct intel_encode
 }
 
 /**
+ * intel_connector_update_modes - update connector from edid
+ * @connector: DRM connector device to use
+ * @edid: previously read EDID information
+ */
+int intel_connector_update_modes(struct drm_connector *connector,
+				struct edid *edid)
+{
+	int ret;
+
+	drm_mode_connector_update_edid_property(connector, edid);
+	ret = drm_add_edid_modes(connector, edid);
+	drm_edid_to_eld(connector, edid);
+	connector->display_info.raw_edid = NULL;
+	kfree(edid);
+
+	return ret;
+}
+
+/**
  * intel_ddc_get_modes - get modelist from monitor
  * @connector: DRM connector device to use
  * @adapter: i2c adapter
@@ -71,18 +90,12 @@ int intel_ddc_get_modes(struct drm_conne
 			struct i2c_adapter *adapter)
 {
 	struct edid *edid;
-	int ret = 0;
 
 	edid = drm_get_edid(connector, adapter);
-	if (edid) {
-		drm_mode_connector_update_edid_property(connector, edid);
-		ret = drm_add_edid_modes(connector, edid);
-		drm_edid_to_eld(connector, edid);
-		connector->display_info.raw_edid = NULL;
-		kfree(edid);
-	}
+	if (!edid)
+		return 0;
 
-	return ret;
+	return intel_connector_update_modes(connector, edid);
 }
 
 static const struct drm_prop_enum_list force_audio_names[] = {



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 189/262] drm/i915: fall back to bit-banging if GMBUS fails in CRT EDID reads
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (187 preceding siblings ...)
  2012-09-28 18:51 ` [ 188/262] drm/i915: extract connector update from intel_ddc_get_modes() for reuse Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:51 ` [ 190/262] drm/i915: use hsw rps tuning values everywhere on gen6+ Greg Kroah-Hartman
                   ` (72 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Jani Nikula, Alex Ferrando, Daniel Vetter

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jani Nikula <jani.nikula@intel.com>

commit f1a2f5b7c5f0941d23eef0a095c0b99bf8d051e6 upstream.

GMBUS was enabled over bit-banging as the default in commits:

commit c3dfefa0a6d235bd465309e12f4c56ea16e71111
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Tue Feb 14 22:37:25 2012 +0100

    drm/i915: reenable gmbus on gen3+ again

and

commit 0fb3f969c8683505fb7323c06bf8a999a5a45a15
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Fri Mar 2 19:38:30 2012 +0100

    drm/i915: enable gmbus on gen2

Unfortunately, GMBUS seems to fail on some CRT displays. Add a bit-banging
fallback to CRT EDID reads.

LKML-Reference: <201207251020.47637.maciej.rutecki@gmail.com>
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=45881
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Tested-by: Alex Ferrando <alferpal@gmail.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/i915/intel_crt.c |   36 +++++++++++++++++++++++++++++++++---
 1 file changed, 33 insertions(+), 3 deletions(-)

--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -284,6 +284,36 @@ static bool intel_crt_detect_hotplug(str
 	return ret;
 }
 
+static struct edid *intel_crt_get_edid(struct drm_connector *connector,
+				struct i2c_adapter *i2c)
+{
+	struct edid *edid;
+
+	edid = drm_get_edid(connector, i2c);
+
+	if (!edid && !intel_gmbus_is_forced_bit(i2c)) {
+		DRM_DEBUG_KMS("CRT GMBUS EDID read failed, retry using GPIO bit-banging\n");
+		intel_gmbus_force_bit(i2c, true);
+		edid = drm_get_edid(connector, i2c);
+		intel_gmbus_force_bit(i2c, false);
+	}
+
+	return edid;
+}
+
+/* local version of intel_ddc_get_modes() to use intel_crt_get_edid() */
+static int intel_crt_ddc_get_modes(struct drm_connector *connector,
+				struct i2c_adapter *adapter)
+{
+	struct edid *edid;
+
+	edid = intel_crt_get_edid(connector, adapter);
+	if (!edid)
+		return 0;
+
+	return intel_connector_update_modes(connector, edid);
+}
+
 static bool intel_crt_detect_ddc(struct drm_connector *connector)
 {
 	struct intel_crt *crt = intel_attached_crt(connector);
@@ -299,7 +329,7 @@ static bool intel_crt_detect_ddc(struct
 		struct i2c_adapter *i2c;
 
 		i2c = intel_gmbus_get_adapter(dev_priv, dev_priv->crt_ddc_pin);
-		edid = drm_get_edid(connector, i2c);
+		edid = intel_crt_get_edid(connector, i2c);
 		/*
 		 * This may be a DVI-I connector with a shared DDC
 		 * link between analog and digital outputs, so we
@@ -498,13 +528,13 @@ static int intel_crt_get_modes(struct dr
 	struct i2c_adapter *i2c;
 
 	i2c = intel_gmbus_get_adapter(dev_priv, dev_priv->crt_ddc_pin);
-	ret = intel_ddc_get_modes(connector, i2c);
+	ret = intel_crt_ddc_get_modes(connector, i2c);
 	if (ret || !IS_G4X(dev))
 		return ret;
 
 	/* Try to probe digital port for output in DVI-I -> VGA mode. */
 	i2c = intel_gmbus_get_adapter(dev_priv, GMBUS_PORT_DPB);
-	return intel_ddc_get_modes(connector, i2c);
+	return intel_crt_ddc_get_modes(connector, i2c);
 }
 
 static int intel_crt_set_property(struct drm_connector *connector,



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 190/262] drm/i915: use hsw rps tuning values everywhere on gen6+
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (188 preceding siblings ...)
  2012-09-28 18:51 ` [ 189/262] drm/i915: fall back to bit-banging if GMBUS fails in CRT EDID reads Greg Kroah-Hartman
@ 2012-09-28 18:51 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 191/262] asus-laptop: HRWS/HWRS typo Greg Kroah-Hartman
                   ` (71 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:51 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Ben Widawsky, Daniel Vetter

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Vetter <daniel.vetter@ffwll.ch>

commit 1ee9ae3244c4789f3184c5123f3b2d7e405b3f4c upstream.

James Bottomley reported [1] a massive power regression, due to the
enabling of semaphores by default in 3.5. A workaround for him is to
again disable semaphores. And indeed, his system has a very hard time
to enter rc6 with semaphores enabled.

Ben Widawsky run around with a kill-a-watt a lot and noticed:
- There are indeed a few rare systems that seem to have a hard time
  entering rc6 when desktop-idle.
- One machine, The Indestructible Toshiba regressed in this behaviour
  between 3.5 and 3.6 in a merge commit! So rc6 behaviour with the
  current setting seems to be highly timing dependent and not robust
  at all.
- The behaviour James reported wrt semaphores seems to be a freak
  timing thing that only happens on his specific machine, confirming
  that enabling semaphores shouldn't reduce rc6 residency.

Now furthermore the Google ChromeOS guys reported [2] a while ago that
at least on some machines a simply a blinking cursor can keep the gpu
turbo at the highest frequency. This is because the current rps limits
used on snb/ivb are highly asymmetric.

On the theory that gpu turbo and rc6 tuning values are related, we've
tried whether the much saner looking (since much less asymmetric) rps
tuning values used for hsw would also help entering rc6 more robustly.

And it seems to mostly work, and we don't really have the resources to
through-roughly tune things in any better way: The values from the
ChromeOS ppl seem to fare a bit worse for James' machine, so I guess
we better stick with something vpg (the gpu hw/windows group)
provided, hoping that they've done their jobs.

Reference[1]: http://lists.freedesktop.org/archives/dri-devel/2012-July/025675.html
Reference[2]: http://lists.freedesktop.org/archives/intel-gfx/2012-July/018692.html
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=53393
Tested-by: Ben Widawsky <ben@bwidawsk.net>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/i915/intel_pm.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -2431,10 +2431,10 @@ void gen6_enable_rps(struct drm_i915_pri
 	I915_WRITE(GEN6_RP_INTERRUPT_LIMITS,
 		   dev_priv->max_delay << 24 |
 		   dev_priv->min_delay << 16);
-	I915_WRITE(GEN6_RP_UP_THRESHOLD, 10000);
-	I915_WRITE(GEN6_RP_DOWN_THRESHOLD, 1000000);
-	I915_WRITE(GEN6_RP_UP_EI, 100000);
-	I915_WRITE(GEN6_RP_DOWN_EI, 5000000);
+	I915_WRITE(GEN6_RP_UP_THRESHOLD, 59400);
+	I915_WRITE(GEN6_RP_DOWN_THRESHOLD, 245000);
+	I915_WRITE(GEN6_RP_UP_EI, 66000);
+	I915_WRITE(GEN6_RP_DOWN_EI, 350000);
 	I915_WRITE(GEN6_RP_IDLE_HYSTERSIS, 10);
 	I915_WRITE(GEN6_RP_CONTROL,
 		   GEN6_RP_MEDIA_TURBO |



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 191/262] asus-laptop: HRWS/HWRS typo
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (189 preceding siblings ...)
  2012-09-28 18:51 ` [ 190/262] drm/i915: use hsw rps tuning values everywhere on gen6+ Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 192/262] drm: Add EDID_QUIRK_FORCE_REDUCED_BLANKING for ASUS VW222S Greg Kroah-Hartman
                   ` (70 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Corentin Chary, Matthew Garrett

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Corentin Chary <corentin.chary@gmail.com>

commit 8871e99f89b7d7b1ea99de550eea2a56273f42ab upstream.

Resolves-bug: https://bugzilla.kernel.org/show_bug.cgi?id=24222
Signed-off-by: Corentin Chary <corentin.chary@gmail.com>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/platform/x86/asus-laptop.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/platform/x86/asus-laptop.c
+++ b/drivers/platform/x86/asus-laptop.c
@@ -863,9 +863,9 @@ static ssize_t show_infos(struct device
 	 * The significance of others is yet to be found.
 	 * If we don't find the method, we assume the device are present.
 	 */
-	rv = acpi_evaluate_integer(asus->handle, "HRWS", NULL, &temp);
+	rv = acpi_evaluate_integer(asus->handle, "HWRS", NULL, &temp);
 	if (!ACPI_FAILURE(rv))
-		len += sprintf(page + len, "HRWS value         : %#x\n",
+		len += sprintf(page + len, "HWRS value         : %#x\n",
 			       (uint) temp);
 	/*
 	 * Another value for userspace: the ASYM method returns 0x02 for
@@ -1751,9 +1751,9 @@ static int asus_laptop_get_info(struct a
 	 * The significance of others is yet to be found.
 	 */
 	status =
-	    acpi_evaluate_integer(asus->handle, "HRWS", NULL, &hwrs_result);
+	    acpi_evaluate_integer(asus->handle, "HWRS", NULL, &hwrs_result);
 	if (!ACPI_FAILURE(status))
-		pr_notice("  HRWS returned %x", (int)hwrs_result);
+		pr_notice("  HWRS returned %x", (int)hwrs_result);
 
 	if (!acpi_check_handle(asus->handle, METHOD_WL_STATUS, NULL))
 		asus->have_rsts = true;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 192/262] drm: Add EDID_QUIRK_FORCE_REDUCED_BLANKING for ASUS VW222S
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (190 preceding siblings ...)
  2012-09-28 18:52 ` [ 191/262] asus-laptop: HRWS/HWRS typo Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 193/262] asus-nb-wmi: add some video toggle keys Greg Kroah-Hartman
                   ` (69 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Paul Menzel, dri-devel, Adam Jackson, Ian Pilcher,
	Dave Airlie

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Paul Menzel <paulepanter@users.sourceforge.net>

commit 6f33814bd4d9cfe76033a31b1c0c76c960cd8e4b upstream.

Connecting an ASUS VW222S [1] over VGA a garbled screen is shown with
vertical stripes in the top half.

In commit bc42aabc [2]

        commit bc42aabc6a01b92b0f961d65671564e0e1cd7592
        Author: Adam Jackson <ajax@redhat.com>
        Date:   Wed May 23 16:26:54 2012 -0400

            drm/edid/quirks: ViewSonic VA2026w

Adam Jackson added the quirk `EDID_QUIRK_FORCE_REDUCED_BLANKING` which
is also needed for this ASUS monitor.

All log files and output from `xrandr` is included in the referenced
Bugzilla report #17629.

Please note that this monitor only has a VGA (D-Sub) connector [1].

[1] http://www.asus.com/Display/LCD_Monitors/VW222S/
[2] http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=commit;h=bc42aabc6a01b92b0f961d65671564e0e1cd7592

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=17629
Signed-off-by: Paul Menzel <paulepanter@users.sourceforge.net>
Cc: <dri-devel@lists.freedesktop.org>
Cc: Adam Jackson <ajax@redhat.com>
Cc: Ian Pilcher <arequipeno@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/drm_edid.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -87,6 +87,9 @@ static struct edid_quirk {
 	int product_id;
 	u32 quirks;
 } edid_quirk_list[] = {
+	/* ASUS VW222S */
+	{ "ACI", 0x22a2, EDID_QUIRK_FORCE_REDUCED_BLANKING },
+
 	/* Acer AL1706 */
 	{ "ACR", 44358, EDID_QUIRK_PREFER_LARGE_60 },
 	/* Acer F51 */



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 193/262] asus-nb-wmi: add some video toggle keys
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (191 preceding siblings ...)
  2012-09-28 18:52 ` [ 192/262] drm: Add EDID_QUIRK_FORCE_REDUCED_BLANKING for ASUS VW222S Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 194/262] drm: Check for invalid cursor flags Greg Kroah-Hartman
                   ` (68 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, AceLan Kao, Matthew Garrett, Tim Gardner

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: AceLan Kao <acelan.kao@canonical.com>

commit 3766054fff4af1b58a1440a284907887f4d2e8be upstream.

There are some new video switch keys that used by newer machines.
0xA0 - SDSP HDMI only
0xA1 - SDSP LCD + HDMI
0xA2 - SDSP CRT + HDMI
0xA3 - SDSP TV + HDMI
But in Linux, there is no suitable userspace application to handle this,
so, mapping them all to KEY_SWITCHVIDEOMODE.

Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
Cc: Tim Gardner <tim.gardner@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/platform/x86/asus-nb-wmi.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/platform/x86/asus-nb-wmi.c
+++ b/drivers/platform/x86/asus-nb-wmi.c
@@ -94,6 +94,10 @@ static const struct key_entry asus_nb_wm
 	{ KE_KEY, 0x8A, { KEY_PROG1 } },
 	{ KE_KEY, 0x95, { KEY_MEDIA } },
 	{ KE_KEY, 0x99, { KEY_PHONE } },
+	{ KE_KEY, 0xA0, { KEY_SWITCHVIDEOMODE } }, /* SDSP HDMI only */
+	{ KE_KEY, 0xA1, { KEY_SWITCHVIDEOMODE } }, /* SDSP LCD + HDMI */
+	{ KE_KEY, 0xA2, { KEY_SWITCHVIDEOMODE } }, /* SDSP CRT + HDMI */
+	{ KE_KEY, 0xA3, { KEY_SWITCHVIDEOMODE } }, /* SDSP TV + HDMI */
 	{ KE_KEY, 0xb5, { KEY_CALC } },
 	{ KE_KEY, 0xc4, { KEY_KBDILLUMUP } },
 	{ KE_KEY, 0xc5, { KEY_KBDILLUMDOWN } },



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 194/262] drm: Check for invalid cursor flags
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (192 preceding siblings ...)
  2012-09-28 18:52 ` [ 193/262] asus-nb-wmi: add some video toggle keys Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 195/262] drm/nvc0/copy: check PUNITS to determine which copy engines are disabled Greg Kroah-Hartman
                   ` (67 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Jakob Bornecrantz, Dave Airlie

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jakob Bornecrantz <jakob@vmware.com>

commit 7c4eaca4162d0b5ad4fb39f974d7ffd71b9daa09 upstream.

Signed-off-by: Jakob Bornecrantz <jakob@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/drm_crtc.c |    2 +-
 include/drm/drm_mode.h     |    5 +++--
 2 files changed, 4 insertions(+), 3 deletions(-)

--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -1981,7 +1981,7 @@ int drm_mode_cursor_ioctl(struct drm_dev
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EINVAL;
 
-	if (!req->flags)
+	if (!req->flags || (~DRM_MODE_CURSOR_FLAGS & req->flags))
 		return -EINVAL;
 
 	mutex_lock(&dev->mode_config.mutex);
--- a/include/drm/drm_mode.h
+++ b/include/drm/drm_mode.h
@@ -359,8 +359,9 @@ struct drm_mode_mode_cmd {
 	struct drm_mode_modeinfo mode;
 };
 
-#define DRM_MODE_CURSOR_BO	(1<<0)
-#define DRM_MODE_CURSOR_MOVE	(1<<1)
+#define DRM_MODE_CURSOR_BO	0x01
+#define DRM_MODE_CURSOR_MOVE	0x02
+#define DRM_MODE_CURSOR_FLAGS	0x03
 
 /*
  * depending on the value in flags different members are used.



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 195/262] drm/nvc0/copy: check PUNITS to determine which copy engines are disabled
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (193 preceding siblings ...)
  2012-09-28 18:52 ` [ 194/262] drm: Check for invalid cursor flags Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 196/262] drm/radeon/atom: rework DIG modesetting on DCE3+ Greg Kroah-Hartman
                   ` (66 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Ben Skeggs

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ben Skeggs <bskeggs@redhat.com>

commit 14f0458a41e033dee31ba605137419385c03fc78 upstream.

On some Fermi chipsets (NVCE particularly) PCOPY1 doesn't exist.  And if
what I've seen on Kepler is true of Fermi too, chipsets of the same type
can have different PCOPY units available.

This should fix a v3.5 regression reported by a number of people effecting
suspend/resume on NVC8/NVCE chipsets.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/nouveau/nouveau_state.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/drivers/gpu/drm/nouveau/nouveau_state.c
+++ b/drivers/gpu/drm/nouveau/nouveau_state.c
@@ -737,9 +737,11 @@ nouveau_card_init(struct drm_device *dev
 			}
 			break;
 		case NV_C0:
-			nvc0_copy_create(dev, 1);
+			if (!(nv_rd32(dev, 0x022500) & 0x00000200))
+				nvc0_copy_create(dev, 1);
 		case NV_D0:
-			nvc0_copy_create(dev, 0);
+			if (!(nv_rd32(dev, 0x022500) & 0x00000100))
+				nvc0_copy_create(dev, 0);
 			break;
 		default:
 			break;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 196/262] drm/radeon/atom: rework DIG modesetting on DCE3+
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (194 preceding siblings ...)
  2012-09-28 18:52 ` [ 195/262] drm/nvc0/copy: check PUNITS to determine which copy engines are disabled Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 197/262] drm/radeon/atom: powergating fixes for DCE6 Greg Kroah-Hartman
                   ` (65 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Alex Deucher

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alex Deucher <alexander.deucher@amd.com>

commit 8d1af57ae3c4458ed0de93ef97f388dd1b3239c7 upstream.

The ordering is important and the current drm code
wasn't cutting it for modern DIG encoders.  We need
to have information about crtc before setting up
the encoders so I've shifted the ordering a bit.
Probably we'll need a full rework akin to danvet's
recent intel patchs.  This patch fixes numerous
issues with DP bridge chips and makes link training
much more reliable.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/radeon/atombios_encoders.c |  109 ++++++++++++-----------------
 1 file changed, 47 insertions(+), 62 deletions(-)

--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -1379,6 +1379,8 @@ radeon_atom_encoder_dpms_dig(struct drm_
 	struct drm_device *dev = encoder->dev;
 	struct radeon_device *rdev = dev->dev_private;
 	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+	struct drm_encoder *ext_encoder = radeon_get_external_encoder(encoder);
+	struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
 	struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
 	struct radeon_connector *radeon_connector = NULL;
 	struct radeon_connector_atom_dig *radeon_dig_connector = NULL;
@@ -1390,19 +1392,37 @@ radeon_atom_encoder_dpms_dig(struct drm_
 
 	switch (mode) {
 	case DRM_MODE_DPMS_ON:
-		/* some early dce3.2 boards have a bug in their transmitter control table */
-		if ((rdev->family == CHIP_RV710) || (rdev->family == CHIP_RV730) ||
-		    ASIC_IS_DCE41(rdev) || ASIC_IS_DCE5(rdev)) {
-			if (ASIC_IS_DCE6(rdev)) {
-				/* It seems we need to call ATOM_ENCODER_CMD_SETUP again
-				 * before reenabling encoder on DPMS ON, otherwise we never
-				 * get picture
-				 */
-				atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_SETUP, 0);
+		if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE5(rdev)) {
+			if (!connector)
+				dig->panel_mode = DP_PANEL_MODE_EXTERNAL_DP_MODE;
+			else
+				dig->panel_mode = radeon_dp_get_panel_mode(encoder, connector);
+
+			/* setup and enable the encoder */
+			atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_SETUP, 0);
+			atombios_dig_encoder_setup(encoder,
+						   ATOM_ENCODER_CMD_SETUP_PANEL_MODE,
+						   dig->panel_mode);
+			if (ext_encoder) {
+				if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE61(rdev))
+					atombios_external_encoder_setup(encoder, ext_encoder,
+									EXTERNAL_ENCODER_ACTION_V3_ENCODER_SETUP);
 			}
 			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
-		} else {
+		} else if (ASIC_IS_DCE4(rdev)) {
+			/* setup and enable the encoder */
+			atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_SETUP, 0);
+			/* enable the transmitter */
+			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
 			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
+		} else {
+			/* setup and enable the encoder and transmitter */
+			atombios_dig_encoder_setup(encoder, ATOM_ENABLE, 0);
+			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_SETUP, 0, 0);
+			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
+			/* some early dce3.2 boards have a bug in their transmitter control table */
+			if ((rdev->family != CHIP_RV710) || (rdev->family != CHIP_RV730))
+				atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
 		}
 		if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && connector) {
 			if (connector->connector_type == DRM_MODE_CONNECTOR_eDP) {
@@ -1420,10 +1440,19 @@ radeon_atom_encoder_dpms_dig(struct drm_
 	case DRM_MODE_DPMS_STANDBY:
 	case DRM_MODE_DPMS_SUSPEND:
 	case DRM_MODE_DPMS_OFF:
-		if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE5(rdev))
+		if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE5(rdev)) {
+			/* disable the transmitter */
 			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
-		else
+		} else if (ASIC_IS_DCE4(rdev)) {
+			/* disable the transmitter */
+			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE_OUTPUT, 0, 0);
+			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
+		} else {
+			/* disable the encoder and transmitter */
 			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE_OUTPUT, 0, 0);
+			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
+			atombios_dig_encoder_setup(encoder, ATOM_DISABLE, 0);
+		}
 		if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && connector) {
 			if (ASIC_IS_DCE4(rdev))
 				atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_DP_VIDEO_OFF, 0);
@@ -1848,10 +1877,12 @@ radeon_atom_encoder_mode_set(struct drm_
 	struct drm_device *dev = encoder->dev;
 	struct radeon_device *rdev = dev->dev_private;
 	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
-	struct drm_encoder *ext_encoder = radeon_get_external_encoder(encoder);
 
 	radeon_encoder->pixel_clock = adjusted_mode->clock;
 
+	/* need to call this here rather than in prepare() since we need some crtc info */
+	radeon_atom_encoder_dpms(encoder, DRM_MODE_DPMS_OFF);
+
 	if (ASIC_IS_AVIVO(rdev) && !ASIC_IS_DCE4(rdev)) {
 		if (radeon_encoder->active_device & (ATOM_DEVICE_CV_SUPPORT | ATOM_DEVICE_TV_SUPPORT))
 			atombios_yuv_setup(encoder, true);
@@ -1870,38 +1901,7 @@ radeon_atom_encoder_mode_set(struct drm_
 	case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
 	case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
 	case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
-		if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE5(rdev)) {
-			struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
-			struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
-
-			if (!connector)
-				dig->panel_mode = DP_PANEL_MODE_EXTERNAL_DP_MODE;
-			else
-				dig->panel_mode = radeon_dp_get_panel_mode(encoder, connector);
-
-			/* setup and enable the encoder */
-			atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_SETUP, 0);
-			atombios_dig_encoder_setup(encoder,
-						   ATOM_ENCODER_CMD_SETUP_PANEL_MODE,
-						   dig->panel_mode);
-		} else if (ASIC_IS_DCE4(rdev)) {
-			/* disable the transmitter */
-			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
-			/* setup and enable the encoder */
-			atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_SETUP, 0);
-
-			/* enable the transmitter */
-			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
-		} else {
-			/* disable the encoder and transmitter */
-			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
-			atombios_dig_encoder_setup(encoder, ATOM_DISABLE, 0);
-
-			/* setup and enable the encoder and transmitter */
-			atombios_dig_encoder_setup(encoder, ATOM_ENABLE, 0);
-			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_SETUP, 0, 0);
-			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
-		}
+		/* handled in dpms */
 		break;
 	case ENCODER_OBJECT_ID_INTERNAL_DDI:
 	case ENCODER_OBJECT_ID_INTERNAL_DVO1:
@@ -1922,14 +1922,6 @@ radeon_atom_encoder_mode_set(struct drm_
 		break;
 	}
 
-	if (ext_encoder) {
-		if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE61(rdev))
-			atombios_external_encoder_setup(encoder, ext_encoder,
-							EXTERNAL_ENCODER_ACTION_V3_ENCODER_SETUP);
-		else
-			atombios_external_encoder_setup(encoder, ext_encoder, ATOM_ENABLE);
-	}
-
 	atombios_apply_encoder_quirks(encoder, adjusted_mode);
 
 	if (atombios_get_encoder_mode(encoder) == ATOM_ENCODER_MODE_HDMI) {
@@ -2116,7 +2108,6 @@ static void radeon_atom_encoder_prepare(
 	}
 
 	radeon_atom_output_lock(encoder, true);
-	radeon_atom_encoder_dpms(encoder, DRM_MODE_DPMS_OFF);
 
 	if (connector) {
 		struct radeon_connector *radeon_connector = to_radeon_connector(connector);
@@ -2137,6 +2128,7 @@ static void radeon_atom_encoder_prepare(
 
 static void radeon_atom_encoder_commit(struct drm_encoder *encoder)
 {
+	/* need to call this here as we need the crtc set up */
 	radeon_atom_encoder_dpms(encoder, DRM_MODE_DPMS_ON);
 	radeon_atom_output_lock(encoder, false);
 }
@@ -2177,14 +2169,7 @@ static void radeon_atom_encoder_disable(
 	case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
 	case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
 	case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
-		if (ASIC_IS_DCE4(rdev))
-			/* disable the transmitter */
-			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
-		else {
-			/* disable the encoder and transmitter */
-			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
-			atombios_dig_encoder_setup(encoder, ATOM_DISABLE, 0);
-		}
+		/* handled in dpms */
 		break;
 	case ENCODER_OBJECT_ID_INTERNAL_DDI:
 	case ENCODER_OBJECT_ID_INTERNAL_DVO1:



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 197/262] drm/radeon/atom: powergating fixes for DCE6
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (195 preceding siblings ...)
  2012-09-28 18:52 ` [ 196/262] drm/radeon/atom: rework DIG modesetting on DCE3+ Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 198/262] drm/i915: fix wrong order of parameters in port checking functions Greg Kroah-Hartman
                   ` (64 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Alex Deucher

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alex Deucher <alexander.deucher@amd.com>

commit c205b232a64fed6d26edd7e40985b396de99a27f upstream.

Power gating is per crtc pair, but the powergating registers
should be called individually.  The hw handles power up/down
properly.  The pair is powered up if either crtc in the pair
is powered up and the pair is not powered down until both
crtcs in the pair are powered down.  This simplifies
programming and should save additional power as the previous
code never actually power gated the crtc pair.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/radeon/atombios_crtc.c |   22 ++--------------------
 1 file changed, 2 insertions(+), 20 deletions(-)

--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -258,7 +258,6 @@ void atombios_crtc_dpms(struct drm_crtc
 		radeon_crtc->enabled = true;
 		/* adjust pm to dpms changes BEFORE enabling crtcs */
 		radeon_pm_compute_clocks(rdev);
-		/* disable crtc pair power gating before programming */
 		if (ASIC_IS_DCE6(rdev) && !radeon_crtc->in_mode_set)
 			atombios_powergate_crtc(crtc, ATOM_DISABLE);
 		atombios_enable_crtc(crtc, ATOM_ENABLE);
@@ -278,25 +277,8 @@ void atombios_crtc_dpms(struct drm_crtc
 			atombios_enable_crtc_memreq(crtc, ATOM_DISABLE);
 		atombios_enable_crtc(crtc, ATOM_DISABLE);
 		radeon_crtc->enabled = false;
-		/* power gating is per-pair */
-		if (ASIC_IS_DCE6(rdev) && !radeon_crtc->in_mode_set) {
-			struct drm_crtc *other_crtc;
-			struct radeon_crtc *other_radeon_crtc;
-			list_for_each_entry(other_crtc, &rdev->ddev->mode_config.crtc_list, head) {
-				other_radeon_crtc = to_radeon_crtc(other_crtc);
-				if (((radeon_crtc->crtc_id == 0) && (other_radeon_crtc->crtc_id == 1)) ||
-				    ((radeon_crtc->crtc_id == 1) && (other_radeon_crtc->crtc_id == 0)) ||
-				    ((radeon_crtc->crtc_id == 2) && (other_radeon_crtc->crtc_id == 3)) ||
-				    ((radeon_crtc->crtc_id == 3) && (other_radeon_crtc->crtc_id == 2)) ||
-				    ((radeon_crtc->crtc_id == 4) && (other_radeon_crtc->crtc_id == 5)) ||
-				    ((radeon_crtc->crtc_id == 5) && (other_radeon_crtc->crtc_id == 4))) {
-					/* if both crtcs in the pair are off, enable power gating */
-					if (other_radeon_crtc->enabled == false)
-						atombios_powergate_crtc(crtc, ATOM_ENABLE);
-					break;
-				}
-			}
-		}
+		if (ASIC_IS_DCE6(rdev) && !radeon_crtc->in_mode_set)
+			atombios_powergate_crtc(crtc, ATOM_ENABLE);
 		/* adjust pm to dpms changes AFTER disabling crtcs */
 		radeon_pm_compute_clocks(rdev);
 		break;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 198/262] drm/i915: fix wrong order of parameters in port checking functions
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (196 preceding siblings ...)
  2012-09-28 18:52 ` [ 197/262] drm/radeon/atom: powergating fixes for DCE6 Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 199/262] drm/radeon: convert radeon vfct code to use acpi_get_table_with_size Greg Kroah-Hartman
                   ` (63 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Anhua Xu, Chris Wilson, Daniel Schroeder, Daniel Vetter

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Xu, Anhua" <anhua.xu@intel.com>

commit b70ad586162609141f0aa9eb34790f31a8954f89 upstream.

Wrong order of parameters passed-in when calling hdmi/adpa
/lvds_pipe_enabled(), 2nd and 3rd parameters are reversed.

This bug was indroduced by

commit 1519b9956eb4b4180fa3f47c73341463cdcfaa37
Author: Keith Packard <keithp@keithp.com>
Date:   Sat Aug 6 10:35:34 2011 -0700

    drm/i915: Fix PCH port pipe select in CPT disable paths

The reachable tag for this commit is v3.1-rc1-3-g1519b99

Signed-off-by: Anhua Xu <anhua.xu@intel.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=44876
Tested-by: Daniel Schroeder <sec@dschroeder.info>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/i915/intel_display.c |   12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1238,7 +1238,7 @@ static void assert_pch_hdmi_disabled(str
 				     enum pipe pipe, int reg)
 {
 	u32 val = I915_READ(reg);
-	WARN(hdmi_pipe_enabled(dev_priv, val, pipe),
+	WARN(hdmi_pipe_enabled(dev_priv, pipe, val),
 	     "PCH HDMI (0x%08x) enabled on transcoder %c, should be disabled\n",
 	     reg, pipe_name(pipe));
 }
@@ -1255,13 +1255,13 @@ static void assert_pch_ports_disabled(st
 
 	reg = PCH_ADPA;
 	val = I915_READ(reg);
-	WARN(adpa_pipe_enabled(dev_priv, val, pipe),
+	WARN(adpa_pipe_enabled(dev_priv, pipe, val),
 	     "PCH VGA enabled on transcoder %c, should be disabled\n",
 	     pipe_name(pipe));
 
 	reg = PCH_LVDS;
 	val = I915_READ(reg);
-	WARN(lvds_pipe_enabled(dev_priv, val, pipe),
+	WARN(lvds_pipe_enabled(dev_priv, pipe, val),
 	     "PCH LVDS enabled on transcoder %c, should be disabled\n",
 	     pipe_name(pipe));
 
@@ -1723,7 +1723,7 @@ static void disable_pch_hdmi(struct drm_
 			     enum pipe pipe, int reg)
 {
 	u32 val = I915_READ(reg);
-	if (hdmi_pipe_enabled(dev_priv, val, pipe)) {
+	if (hdmi_pipe_enabled(dev_priv, pipe, val)) {
 		DRM_DEBUG_KMS("Disabling pch HDMI %x on pipe %d\n",
 			      reg, pipe);
 		I915_WRITE(reg, val & ~PORT_ENABLE);
@@ -1745,12 +1745,12 @@ static void intel_disable_pch_ports(stru
 
 	reg = PCH_ADPA;
 	val = I915_READ(reg);
-	if (adpa_pipe_enabled(dev_priv, val, pipe))
+	if (adpa_pipe_enabled(dev_priv, pipe, val))
 		I915_WRITE(reg, val & ~ADPA_DAC_ENABLE);
 
 	reg = PCH_LVDS;
 	val = I915_READ(reg);
-	if (lvds_pipe_enabled(dev_priv, val, pipe)) {
+	if (lvds_pipe_enabled(dev_priv, pipe, val)) {
 		DRM_DEBUG_KMS("disable lvds on pipe %d val 0x%08x\n", pipe, val);
 		I915_WRITE(reg, val & ~LVDS_PORT_EN);
 		POSTING_READ(reg);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 199/262] drm/radeon: convert radeon vfct code to use acpi_get_table_with_size
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (197 preceding siblings ...)
  2012-09-28 18:52 ` [ 198/262] drm/i915: fix wrong order of parameters in port checking functions Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 200/262] drm/radeon: dont disable plls that are in use by other crtcs Greg Kroah-Hartman
                   ` (62 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Alex Deucher

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alex Deucher <alexander.deucher@amd.com>

commit 7c3906d04a4587dceaa78cc1ae6b14e6454ee02a upstream.

Allows us to verify the table size.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/radeon/radeon_bios.c |    6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

--- a/drivers/gpu/drm/radeon/radeon_bios.c
+++ b/drivers/gpu/drm/radeon/radeon_bios.c
@@ -554,13 +554,12 @@ static bool radeon_acpi_vfct_bios(struct
 {
 	bool ret = false;
 	struct acpi_table_header *hdr;
-	/* acpi_get_table_with_size is not exported :( */
-	acpi_size tbl_size = 0x7fffffff;
+	acpi_size tbl_size;
 	UEFI_ACPI_VFCT *vfct;
 	GOP_VBIOS_CONTENT *vbios;
 	VFCT_IMAGE_HEADER *vhdr;
 
-	if (!ACPI_SUCCESS(acpi_get_table("VFCT", 1, &hdr)))
+	if (!ACPI_SUCCESS(acpi_get_table_with_size("VFCT", 1, &hdr, &tbl_size)))
 		return false;
 	if (tbl_size < sizeof(UEFI_ACPI_VFCT)) {
 		DRM_ERROR("ACPI VFCT table present but broken (too short #1)\n");
@@ -597,7 +596,6 @@ static bool radeon_acpi_vfct_bios(struct
 	ret = !!rdev->bios;
 
 out_unmap:
-	/* uh, no idea what to do here... */
 	return ret;
 }
 #else



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 200/262] drm/radeon: dont disable plls that are in use by other crtcs
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (198 preceding siblings ...)
  2012-09-28 18:52 ` [ 199/262] drm/radeon: convert radeon vfct code to use acpi_get_table_with_size Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 201/262] drm/radeon: force dma32 to fix regression rs4xx,rs6xx,rs740 Greg Kroah-Hartman
                   ` (61 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Alex Deucher, Michel Dänzer

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alex Deucher <alexander.deucher@amd.com>

commit 4e58591c8961b3e31709313f75819f2eec06e322 upstream.

Some plls are shared for DP.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/radeon/atombios_crtc.c |   14 ++++++++++++++
 1 file changed, 14 insertions(+)

--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -1668,9 +1668,22 @@ static void atombios_crtc_disable(struct
 	struct drm_device *dev = crtc->dev;
 	struct radeon_device *rdev = dev->dev_private;
 	struct radeon_atom_ss ss;
+	int i;
 
 	atombios_crtc_dpms(crtc, DRM_MODE_DPMS_OFF);
 
+	for (i = 0; i < rdev->num_crtc; i++) {
+		if (rdev->mode_info.crtcs[i] &&
+		    rdev->mode_info.crtcs[i]->enabled &&
+		    i != radeon_crtc->crtc_id &&
+		    radeon_crtc->pll_id == rdev->mode_info.crtcs[i]->pll_id) {
+			/* one other crtc is using this pll don't turn
+			 * off the pll
+			 */
+			goto done;
+		}
+	}
+
 	switch (radeon_crtc->pll_id) {
 	case ATOM_PPLL1:
 	case ATOM_PPLL2:
@@ -1687,6 +1700,7 @@ static void atombios_crtc_disable(struct
 	default:
 		break;
 	}
+done:
 	radeon_crtc->pll_id = -1;
 }
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 201/262] drm/radeon: force dma32 to fix regression rs4xx,rs6xx,rs740
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (199 preceding siblings ...)
  2012-09-28 18:52 ` [ 200/262] drm/radeon: dont disable plls that are in use by other crtcs Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 202/262] drm/radeon: fix dig encoder selection on DCE61 Greg Kroah-Hartman
                   ` (60 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Jerome Glisse, Alex Deucher

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jerome Glisse <jglisse@redhat.com>

commit 4a2b6662c3632176b4fdf012243dd3751367bf1f upstream.

It seems some of those IGP dislike non dma32 page despite what
documentation says. Fix regression since we allowed non dma32
pages. It seems it only affect some revision of those IGP chips
as we don't know which one just force dma32 for all of them.

https://bugzilla.redhat.com/show_bug.cgi?id=785375

Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/radeon/radeon_device.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -774,7 +774,7 @@ int radeon_device_init(struct radeon_dev
 	if (rdev->flags & RADEON_IS_AGP)
 		rdev->need_dma32 = true;
 	if ((rdev->flags & RADEON_IS_PCI) &&
-	    (rdev->family < CHIP_RS400))
+	    (rdev->family <= CHIP_RS740))
 		rdev->need_dma32 = true;
 
 	dma_bits = rdev->need_dma32 ? 32 : 40;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 202/262] drm/radeon: fix dig encoder selection on DCE61
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (200 preceding siblings ...)
  2012-09-28 18:52 ` [ 201/262] drm/radeon: force dma32 to fix regression rs4xx,rs6xx,rs740 Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 203/262] drm/radeon: make 64bit fences more robust v3 Greg Kroah-Hartman
                   ` (59 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Alex Deucher

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alex Deucher <alexander.deucher@amd.com>

commit 41fa54377057ab38bc3e08ebb46168a7daf2e63b upstream.

Was using the DCE41 code which was wrong. Fixes
blank displays on a number of Trinity systems.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/radeon/atombios_encoders.c |   31 ++++++++++++++++++++++++-----
 1 file changed, 26 insertions(+), 5 deletions(-)

--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -1769,13 +1769,34 @@ static int radeon_atom_pick_dig_encoder(
 	struct radeon_crtc *radeon_crtc = to_radeon_crtc(encoder->crtc);
 	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
 	struct drm_encoder *test_encoder;
-	struct radeon_encoder_atom_dig *dig;
+	struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
 	uint32_t dig_enc_in_use = 0;
 
-	/* DCE4/5 */
-	if (ASIC_IS_DCE4(rdev)) {
-		dig = radeon_encoder->enc_priv;
-		if (ASIC_IS_DCE41(rdev)) {
+	if (ASIC_IS_DCE6(rdev)) {
+		/* DCE6 */
+		switch (radeon_encoder->encoder_id) {
+		case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
+			if (dig->linkb)
+				return 1;
+			else
+				return 0;
+			break;
+		case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
+			if (dig->linkb)
+				return 3;
+			else
+				return 2;
+			break;
+		case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
+			if (dig->linkb)
+				return 5;
+			else
+				return 4;
+			break;
+		}
+	} else if (ASIC_IS_DCE4(rdev)) {
+		/* DCE4/5 */
+		if (ASIC_IS_DCE41(rdev) && !ASIC_IS_DCE61(rdev)) {
 			/* ontario follows DCE4 */
 			if (rdev->family == CHIP_PALM) {
 				if (dig->linkb)



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 203/262] drm/radeon: make 64bit fences more robust v3
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (201 preceding siblings ...)
  2012-09-28 18:52 ` [ 202/262] drm/radeon: fix dig encoder selection on DCE61 Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 204/262] drm/nouveau: fix booting with plymouth + dumb support Greg Kroah-Hartman
                   ` (58 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Christian König, Alex Deucher

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Christian König <deathsimple@vodafone.de>

commit f492c171a38d77fc13a8998a0721f2da50835224 upstream.

Only increase the higher 32bits if we really detect a wrap around.

v2: instead of increasing the higher 32bits just use the higher
    32bits from the last emitted fence.
v3: also use last emitted fence value as upper limit.

The intention of this patch is to make fences as robust as
they where before introducing 64bit fences. This is
necessary because on older systems it looks like the fence
value gets corrupted on initialization.

Fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=51344

Should also fix:
https://bugs.freedesktop.org/show_bug.cgi?id=54129
https://bugs.freedesktop.org/show_bug.cgi?id=54662
https://bugzilla.redhat.com/show_bug.cgi?id=846505
https://bugzilla.redhat.com/show_bug.cgi?id=845639

3.5 needs a separate patch due to changes in the
fence code.  Will send that out separately.

Signed-off-by: Christian König <deathsimple@vodafone.de>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>


---
 drivers/gpu/drm/radeon/radeon_fence.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

--- a/drivers/gpu/drm/radeon/radeon_fence.c
+++ b/drivers/gpu/drm/radeon/radeon_fence.c
@@ -75,7 +75,7 @@ int radeon_fence_emit(struct radeon_devi
 
 void radeon_fence_process(struct radeon_device *rdev, int ring)
 {
-	uint64_t seq, last_seq;
+	uint64_t seq, last_seq, last_emitted;
 	unsigned count_loop = 0;
 	bool wake = false;
 
@@ -102,13 +102,15 @@ void radeon_fence_process(struct radeon_
 	 */
 	last_seq = atomic64_read(&rdev->fence_drv[ring].last_seq);
 	do {
+		last_emitted = rdev->fence_drv[ring].seq;
 		seq = radeon_fence_read(rdev, ring);
 		seq |= last_seq & 0xffffffff00000000LL;
 		if (seq < last_seq) {
-			seq += 0x100000000LL;
+			seq &= 0xffffffff;
+			seq |= last_emitted & 0xffffffff00000000LL;
 		}
 
-		if (seq == last_seq) {
+		if (seq <= last_seq || seq > last_emitted) {
 			break;
 		}
 		/* If we loop over we don't want to return without



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 204/262] drm/nouveau: fix booting with plymouth + dumb support
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (202 preceding siblings ...)
  2012-09-28 18:52 ` [ 203/262] drm/radeon: make 64bit fences more robust v3 Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 205/262] drm/i915: set the right gen3 flip_done mode also at resume Greg Kroah-Hartman
                   ` (57 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Ben Skeggs, Dave Airlie

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dave Airlie <airlied@redhat.com>

commit 610bd7da160f76f1644ecb4cd7f39511b49a22cc upstream.

We noticed a plymouth bug on Fedora 18, and I then
noticed this stupid thinko, fixing it fixed the problem
with plymouth.

Acked-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/nouveau/nouveau_display.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -598,7 +598,7 @@ nouveau_display_dumb_create(struct drm_f
 	args->size = args->pitch * args->height;
 	args->size = roundup(args->size, PAGE_SIZE);
 
-	ret = nouveau_gem_new(dev, args->size, 0, TTM_PL_FLAG_VRAM, 0, 0, &bo);
+	ret = nouveau_gem_new(dev, args->size, 0, NOUVEAU_GEM_DOMAIN_VRAM, 0, 0, &bo);
 	if (ret)
 		return ret;
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 205/262] drm/i915: set the right gen3 flip_done mode also at resume
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (203 preceding siblings ...)
  2012-09-28 18:52 ` [ 204/262] drm/nouveau: fix booting with plymouth + dumb support Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 206/262] drm/i915: enable lvds pin pairs before dpll on gen2 Greg Kroah-Hartman
                   ` (56 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Chris Wilson, Daniel Vetter

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Vetter <daniel.vetter@ffwll.ch>

commit 974a3b0f9f05b748fe11f1afc31efc32aa5160cb upstream.

Currently we've only frobbed this bit at irq_init time, but did
not restore it at resume time. Move it to the gen3 clock gating
function to fix this.

Notice while reading through code.

Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/i915/i915_irq.c |    3 ---
 drivers/gpu/drm/i915/intel_pm.c |    3 +++
 2 files changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -2626,9 +2626,6 @@ void intel_irq_init(struct drm_device *d
 			dev->driver->irq_handler = i8xx_irq_handler;
 			dev->driver->irq_uninstall = i8xx_irq_uninstall;
 		} else if (INTEL_INFO(dev)->gen == 3) {
-			/* IIR "flip pending" means done if this bit is set */
-			I915_WRITE(ECOSKPD, _MASKED_BIT_DISABLE(ECO_FLIP_DONE));
-
 			dev->driver->irq_preinstall = i915_irq_preinstall;
 			dev->driver->irq_postinstall = i915_irq_postinstall;
 			dev->driver->irq_uninstall = i915_irq_uninstall;
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -3528,6 +3528,9 @@ static void gen3_init_clock_gating(struc
 
 	if (IS_PINEVIEW(dev))
 		I915_WRITE(ECOSKPD, _MASKED_BIT_ENABLE(ECO_GATING_CX_ONLY));
+
+	/* IIR "flip pending" means done if this bit is set */
+	I915_WRITE(ECOSKPD, _MASKED_BIT_DISABLE(ECO_FLIP_DONE));
 }
 
 static void i85x_init_clock_gating(struct drm_device *dev)



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 206/262] drm/i915: enable lvds pin pairs before dpll on gen2
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (204 preceding siblings ...)
  2012-09-28 18:52 ` [ 205/262] drm/i915: set the right gen3 flip_done mode also at resume Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 207/262] drm/i915: HDMI - Clear Audio Enable bit for Hot Plug Greg Kroah-Hartman
                   ` (55 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Jesse Barnes, Daniel Vetter

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Vetter <daniel.vetter@ffwll.ch>

commit 5b5896e4e1f353ef3dbc4e4e9ee44d53ccf105d7 upstream.

Otherwise things migt not work too well.

Breakage introduced in

commit eb1cbe4848b01f9f073064377875bc7d71eb401b
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Wed Mar 28 23:12:16 2012 +0200

    drm/i915: split PLL update code out of i9xx_crtc_mode_set

Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/i915/intel_display.c |   12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -3926,12 +3926,6 @@ static void i8xx_update_pll(struct drm_c
 	POSTING_READ(DPLL(pipe));
 	udelay(150);
 
-	I915_WRITE(DPLL(pipe), dpll);
-
-	/* Wait for the clocks to stabilize. */
-	POSTING_READ(DPLL(pipe));
-	udelay(150);
-
 	/* The LVDS pin pair needs to be on before the DPLLs are enabled.
 	 * This is an exception to the general rule that mode_set doesn't turn
 	 * things on.
@@ -3939,6 +3933,12 @@ static void i8xx_update_pll(struct drm_c
 	if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS))
 		intel_update_lvds(crtc, clock, adjusted_mode);
 
+	I915_WRITE(DPLL(pipe), dpll);
+
+	/* Wait for the clocks to stabilize. */
+	POSTING_READ(DPLL(pipe));
+	udelay(150);
+
 	/* The pixel multiplier can only be updated once the
 	 * DPLL is enabled and the clocks are stable.
 	 *



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 207/262] drm/i915: HDMI - Clear Audio Enable bit for Hot Plug
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (205 preceding siblings ...)
  2012-09-28 18:52 ` [ 206/262] drm/i915: enable lvds pin pairs before dpll on gen2 Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 208/262] drm/i915: Reduce a pin-leak BUG into a WARN Greg Kroah-Hartman
                   ` (54 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Wang Xingchao, Daniel Vetter

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Wang Xingchao <xingchao.wang@intel.com>

commit b98b60167279df3acac9422c3c9820d9ebbcf9fb upstream.

Clear Audio Enable bit to trigger unsolicated event to notify Audio
Driver part the HDMI hot plug change. The patch fixed the bug when
remove HDMI cable the bit was not cleared correctly.

In intel_hdmi_dpms(), if intel_hdmi->has_audio been true, the "Audio enable bit" will
be set to trigger unsolicated event to notify Alsa driver the change.

intel_hdmi->has_audio will be reset to false from intel_hdmi_detect() after
remove the hdmi cable, here's debug log:

[  187.494153] [drm:output_poll_execute], [CONNECTOR:17:HDMI-A-1] status updated from 1 to 2
[  187.525349] [drm:intel_hdmi_detect], HDMI: has_audio = 0

so when comes back to intel_hdmi_dpms(), the "Audio enable bit" will not be cleared. And this
cause the eld infomation and pin presence doesnot update accordingly in alsa driver side.

This patch will also trigger unsolicated event to alsa driver to notify the hot plug event:

[  187.853159] ALSA sound/pci/hda/patch_hdmi.c:772 HDMI hot plug event: Codec=3 Pin=5 Presence_Detect=0 ELD_Valid=1
[  187.853268] ALSA sound/pci/hda/patch_hdmi.c:990 HDMI status: Codec=3 Pin=5 Presence_Detect=0 ELD_Valid=0

Signed-off-by: Wang Xingchao <xingchao.wang@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/i915/intel_hdmi.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -400,7 +400,7 @@ static void intel_hdmi_dpms(struct drm_e
 	u32 temp;
 	u32 enable_bits = SDVO_ENABLE;
 
-	if (intel_hdmi->has_audio)
+	if (intel_hdmi->has_audio || mode != DRM_MODE_DPMS_ON)
 		enable_bits |= SDVO_AUDIO_ENABLE;
 
 	temp = I915_READ(intel_hdmi->sdvox_reg);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 208/262] drm/i915: Reduce a pin-leak BUG into a WARN
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (206 preceding siblings ...)
  2012-09-28 18:52 ` [ 207/262] drm/i915: HDMI - Clear Audio Enable bit for Hot Plug Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 209/262] drm/nv86/fifo: suspend fix Greg Kroah-Hartman
                   ` (53 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Chris Wilson, Daniel Vetter

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chris Wilson <chris@chris-wilson.co.uk>

commit 7e81a42e341a4f15d76624b7c02ffb21b085b56f upstream.

Pin-leaks persist and we get the perennial bug reports of machine
lockups to the BUG_ON(pin_count==MAX). If we instead loudly report that
the object cannot be pinned at that time it should prevent the driver from
locking up, and hopefully restore a semblance of working whilst still
leaving us a OOPS to debug.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/i915/i915_gem.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -3044,7 +3044,8 @@ i915_gem_object_pin(struct drm_i915_gem_
 {
 	int ret;
 
-	BUG_ON(obj->pin_count == DRM_I915_GEM_OBJECT_MAX_PIN_COUNT);
+	if (WARN_ON(obj->pin_count == DRM_I915_GEM_OBJECT_MAX_PIN_COUNT))
+		return -EBUSY;
 
 	if (obj->gtt_space != NULL) {
 		if ((alignment && obj->gtt_offset & (alignment - 1)) ||



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 209/262] drm/nv86/fifo: suspend fix
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (207 preceding siblings ...)
  2012-09-28 18:52 ` [ 208/262] drm/i915: Reduce a pin-leak BUG into a WARN Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 210/262] iwlwifi: dont double free the interrupt in failure path Greg Kroah-Hartman
                   ` (52 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Maxim Levitsky, Ben Skeggs, Sven Joachim

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Maxim Levitsky <maximlevitsky@gmail.com>

commit 2064db725cc6d4ea19a24c138bc37939b63e3ae6 upstream.

This fix is a backport from the reworked nouveau driver.  It masks off the
engines we're not expecting to use before attempting a channel kickoff.

Signed-off-by: Maxim Levitsky <maximlevitsky@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Cc: Sven Joachim <svenjoac@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/nouveau/nv84_fifo.c |    9 +++++++++
 1 file changed, 9 insertions(+)

--- a/drivers/gpu/drm/nouveau/nv84_fifo.c
+++ b/drivers/gpu/drm/nouveau/nv84_fifo.c
@@ -117,17 +117,22 @@ nv84_fifo_context_del(struct nouveau_cha
 	struct drm_device *dev = chan->dev;
 	struct drm_nouveau_private *dev_priv = dev->dev_private;
 	unsigned long flags;
+	u32 save;
 
 	/* remove channel from playlist, will context switch if active */
 	spin_lock_irqsave(&dev_priv->context_switch_lock, flags);
 	nv_mask(dev, 0x002600 + (chan->id * 4), 0x80000000, 0x00000000);
 	nv50_fifo_playlist_update(dev);
 
+	save = nv_mask(dev, 0x002520, 0x0000003f, 0x15);
+
 	/* tell any engines on this channel to unload their contexts */
 	nv_wr32(dev, 0x0032fc, chan->ramin->vinst >> 12);
 	if (!nv_wait_ne(dev, 0x0032fc, 0xffffffff, 0xffffffff))
 		NV_INFO(dev, "PFIFO: channel %d unload timeout\n", chan->id);
 
+	nv_wr32(dev, 0x002520, save);
+
 	nv_wr32(dev, 0x002600 + (chan->id * 4), 0x00000000);
 	spin_unlock_irqrestore(&dev_priv->context_switch_lock, flags);
 
@@ -184,10 +189,13 @@ nv84_fifo_fini(struct drm_device *dev, i
 	struct drm_nouveau_private *dev_priv = dev->dev_private;
 	struct nv84_fifo_priv *priv = nv_engine(dev, engine);
 	int i;
+	u32 save;
 
 	/* set playlist length to zero, fifo will unload context */
 	nv_wr32(dev, 0x0032ec, 0);
 
+	save = nv_mask(dev, 0x002520, 0x0000003f, 0x15);
+
 	/* tell all connected engines to unload their contexts */
 	for (i = 0; i < priv->base.channels; i++) {
 		struct nouveau_channel *chan = dev_priv->channels.ptr[i];
@@ -199,6 +207,7 @@ nv84_fifo_fini(struct drm_device *dev, i
 		}
 	}
 
+	nv_wr32(dev, 0x002520, save);
 	nv_wr32(dev, 0x002140, 0);
 	return 0;
 }



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 210/262] iwlwifi: dont double free the interrupt in failure path
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (208 preceding siblings ...)
  2012-09-28 18:52 ` [ 209/262] drm/nv86/fifo: suspend fix Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 211/262] iwlwifi: protect SRAM debugfs Greg Kroah-Hartman
                   ` (51 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Brian Cockrell, Emmanuel Grumbach, Johannes Berg,
	John W. Linville

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

commit a7be50b7e30f9d77cb059a7ffdb781bb0fb92eba upstream.

When the driver can't get the HW ready, we would release
the interrupt twice which made the kernel complain loudly.

Reported-by: Brian Cockrell <brian.cockrell@intel.com>
Tested-by: Brian Cockrell <brian.cockrell@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>


---
 drivers/net/wireless/iwlwifi/iwl-trans-pcie.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
+++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
@@ -1437,6 +1437,7 @@ static int iwl_trans_pcie_start_hw(struc
 	return err;
 
 err_free_irq:
+	trans_pcie->irq_requested = false;
 	free_irq(trans_pcie->irq, trans);
 error:
 	iwl_free_isr_ict(trans);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 211/262] iwlwifi: protect SRAM debugfs
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (209 preceding siblings ...)
  2012-09-28 18:52 ` [ 210/262] iwlwifi: dont double free the interrupt in failure path Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 212/262] iwlwifi: fix flow handler debug code Greg Kroah-Hartman
                   ` (50 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Johannes Berg, John W. Linville

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johannes Berg <johannes.berg@intel.com>

commit 4fc79db178f0a0ede479b4713e00df2d106028b3 upstream.

If the device is not started, we can't read its
SRAM and attempting to do so will cause issues.
Protect the debugfs read.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/iwlwifi/iwl-debugfs.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
@@ -128,6 +128,9 @@ static ssize_t iwl_dbgfs_sram_read(struc
 	const struct fw_img *img;
 	size_t bufsz;
 
+	if (!iwl_is_ready_rf(priv))
+		return -EAGAIN;
+
 	/* default is to dump the entire data segment */
 	if (!priv->dbgfs_sram_offset && !priv->dbgfs_sram_len) {
 		priv->dbgfs_sram_offset = 0x800000;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 212/262] iwlwifi: fix flow handler debug code
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (210 preceding siblings ...)
  2012-09-28 18:52 ` [ 211/262] iwlwifi: protect SRAM debugfs Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 213/262] gianfar: fix phc index build failure Greg Kroah-Hartman
                   ` (49 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Benjamin Herrenschmidt, Johannes Berg, John W. Linville

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johannes Berg <johannes.berg@intel.com>

commit 94543a8d4fb302817014981489f15cb3b92ec3c2 upstream.

iwl_dbgfs_fh_reg_read() can cause crashes and/or
BUG_ON in slub because the ifdefs are wrong, the
code in iwl_dump_fh() should use DEBUGFS, not
DEBUG to protect the buffer writing code.

Also, while at it, clean up the arguments to the
function, some code and make it generally safer.

Reported-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>


---
 drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h |    2 -
 drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c  |    2 -
 drivers/net/wireless/iwlwifi/iwl-trans-pcie.c     |   30 +++++++++++-----------
 3 files changed, 18 insertions(+), 16 deletions(-)

--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-int.h
@@ -355,7 +355,7 @@ int iwl_queue_space(const struct iwl_que
 /*****************************************************
 * Error handling
 ******************************************************/
-int iwl_dump_fh(struct iwl_trans *trans, char **buf, bool display);
+int iwl_dump_fh(struct iwl_trans *trans, char **buf);
 void iwl_dump_csr(struct iwl_trans *trans);
 
 /*****************************************************
--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
@@ -559,7 +559,7 @@ static void iwl_irq_handle_error(struct
 	}
 
 	iwl_dump_csr(trans);
-	iwl_dump_fh(trans, NULL, false);
+	iwl_dump_fh(trans, NULL);
 
 	iwl_op_mode_nic_error(trans->op_mode);
 }
--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
+++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
@@ -1655,13 +1655,9 @@ static const char *get_fh_string(int cmd
 #undef IWL_CMD
 }
 
-int iwl_dump_fh(struct iwl_trans *trans, char **buf, bool display)
+int iwl_dump_fh(struct iwl_trans *trans, char **buf)
 {
 	int i;
-#ifdef CONFIG_IWLWIFI_DEBUG
-	int pos = 0;
-	size_t bufsz = 0;
-#endif
 	static const u32 fh_tbl[] = {
 		FH_RSCSR_CHNL0_STTS_WPTR_REG,
 		FH_RSCSR_CHNL0_RBDCB_BASE_REG,
@@ -1673,29 +1669,35 @@ int iwl_dump_fh(struct iwl_trans *trans,
 		FH_TSSR_TX_STATUS_REG,
 		FH_TSSR_TX_ERROR_REG
 	};
-#ifdef CONFIG_IWLWIFI_DEBUG
-	if (display) {
-		bufsz = ARRAY_SIZE(fh_tbl) * 48 + 40;
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+	if (buf) {
+		int pos = 0;
+		size_t bufsz = ARRAY_SIZE(fh_tbl) * 48 + 40;
+
 		*buf = kmalloc(bufsz, GFP_KERNEL);
 		if (!*buf)
 			return -ENOMEM;
+
 		pos += scnprintf(*buf + pos, bufsz - pos,
 				"FH register values:\n");
-		for (i = 0; i < ARRAY_SIZE(fh_tbl); i++) {
+
+		for (i = 0; i < ARRAY_SIZE(fh_tbl); i++)
 			pos += scnprintf(*buf + pos, bufsz - pos,
 				"  %34s: 0X%08x\n",
 				get_fh_string(fh_tbl[i]),
 				iwl_read_direct32(trans, fh_tbl[i]));
-		}
+
 		return pos;
 	}
 #endif
+
 	IWL_ERR(trans, "FH register values:\n");
-	for (i = 0; i <  ARRAY_SIZE(fh_tbl); i++) {
+	for (i = 0; i <  ARRAY_SIZE(fh_tbl); i++)
 		IWL_ERR(trans, "  %34s: 0X%08x\n",
 			get_fh_string(fh_tbl[i]),
 			iwl_read_direct32(trans, fh_tbl[i]));
-	}
+
 	return 0;
 }
 
@@ -1990,11 +1992,11 @@ static ssize_t iwl_dbgfs_fh_reg_read(str
 					 size_t count, loff_t *ppos)
 {
 	struct iwl_trans *trans = file->private_data;
-	char *buf;
+	char *buf = NULL;
 	int pos = 0;
 	ssize_t ret = -EFAULT;
 
-	ret = pos = iwl_dump_fh(trans, &buf, true);
+	ret = pos = iwl_dump_fh(trans, &buf);
 	if (buf) {
 		ret = simple_read_from_buffer(user_buf,
 					      count, ppos, buf, pos);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 213/262] gianfar: fix phc index build failure
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (211 preceding siblings ...)
  2012-09-28 18:52 ` [ 212/262] iwlwifi: fix flow handler debug code Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 214/262] workqueue: UNBOUND -> REBIND morphing in rebind_workers() should be atomic Greg Kroah-Hartman
                   ` (48 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Richard Cochran, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Richard Cochran <richardcochran@gmail.com>

commit 28889b7e7818342f6c254e27b9b2c68702ab867a upstream.

This patch fixes a build failure introduced in commit 66636287
("gianfar: Support the get_ts_info ethtool method."). Not only was a
global variable inconsistently named, but also it was not exported as
it should have been.

This fix is also needed in stable version 3.5.

Signed-off-by: Richard Cochran <richardcochran@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/freescale/gianfar_ethtool.c |    1 +
 drivers/net/ethernet/freescale/gianfar_ptp.c     |    4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/net/ethernet/freescale/gianfar_ethtool.c
+++ b/drivers/net/ethernet/freescale/gianfar_ethtool.c
@@ -1741,6 +1741,7 @@ static int gfar_get_nfc(struct net_devic
 }
 
 int gfar_phc_index = -1;
+EXPORT_SYMBOL(gfar_phc_index);
 
 static int gfar_get_ts_info(struct net_device *dev,
 			    struct ethtool_ts_info *info)
--- a/drivers/net/ethernet/freescale/gianfar_ptp.c
+++ b/drivers/net/ethernet/freescale/gianfar_ptp.c
@@ -515,7 +515,7 @@ static int gianfar_ptp_probe(struct plat
 		err = PTR_ERR(etsects->clock);
 		goto no_clock;
 	}
-	gfar_phc_clock = ptp_clock_index(etsects->clock);
+	gfar_phc_index = ptp_clock_index(etsects->clock);
 
 	dev_set_drvdata(&dev->dev, etsects);
 
@@ -539,7 +539,7 @@ static int gianfar_ptp_remove(struct pla
 	gfar_write(&etsects->regs->tmr_temask, 0);
 	gfar_write(&etsects->regs->tmr_ctrl,   0);
 
-	gfar_phc_clock = -1;
+	gfar_phc_index = -1;
 	ptp_clock_unregister(etsects->clock);
 	iounmap(etsects->regs);
 	release_resource(etsects->rsrc);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 214/262] workqueue: UNBOUND -> REBIND morphing in rebind_workers() should be atomic
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (212 preceding siblings ...)
  2012-09-28 18:52 ` [ 213/262] gianfar: fix phc index build failure Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 215/262] Input: wacom - add support to Cintiq 22HD Greg Kroah-Hartman
                   ` (47 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Lai Jiangshan, Tejun Heo

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lai Jiangshan <laijs@cn.fujitsu.com>

commit 96e65306b81351b656835c15931d1d237b252f27 upstream.

The compiler may compile the following code into TWO write/modify
instructions.

	worker->flags &= ~WORKER_UNBOUND;
	worker->flags |= WORKER_REBIND;

so the other CPU may temporarily see worker->flags which doesn't have
either WORKER_UNBOUND or WORKER_REBIND set and perform local wakeup
prematurely.

Fix it by using single explicit assignment via ACCESS_ONCE().

Because idle workers have another WORKER_NOT_RUNNING flag, this bug
doesn't exist for them; however, update it to use the same pattern for
consistency.

tj: Applied the change to idle workers too and updated comments and
    patch description a bit.

Signed-off-by: Lai Jiangshan <laijs@cn.fujitsu.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/workqueue.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -3441,14 +3441,17 @@ static int __cpuinit trustee_thread(void
 
 	for_each_busy_worker(worker, i, pos, gcwq) {
 		struct work_struct *rebind_work = &worker->rebind_work;
+		unsigned long worker_flags = worker->flags;
 
 		/*
 		 * Rebind_work may race with future cpu hotplug
 		 * operations.  Use a separate flag to mark that
-		 * rebinding is scheduled.
+		 * rebinding is scheduled.  The morphing should
+		 * be atomic.
 		 */
-		worker->flags |= WORKER_REBIND;
-		worker->flags &= ~WORKER_ROGUE;
+		worker_flags |= WORKER_REBIND;
+		worker_flags &= ~WORKER_ROGUE;
+		ACCESS_ONCE(worker->flags) = worker_flags;
 
 		/* queue rebind_work, wq doesn't matter, use the default one */
 		if (test_and_set_bit(WORK_STRUCT_PENDING_BIT,



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 215/262] Input: wacom - add support to Cintiq 22HD
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (213 preceding siblings ...)
  2012-09-28 18:52 ` [ 214/262] workqueue: UNBOUND -> REBIND morphing in rebind_workers() should be atomic Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 216/262] Input: wacom - rearrange type enum Greg Kroah-Hartman
                   ` (46 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Ping Cheng, Dmitry Torokhov, Joseph Salisbury

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ping Cheng <pinglinux@gmail.com>

commit d838c644fea603eb24811333c6e2cf4f9722bf10 upstream.

Signed-off-by: Ping Cheng <pingc@wacom.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Joseph Salisbury <joseph.salisbury@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/tablet/wacom_wac.c |   21 +++++++++++++++++++--
 drivers/input/tablet/wacom_wac.h |    3 ++-
 2 files changed, 21 insertions(+), 3 deletions(-)

--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -464,7 +464,7 @@ static void wacom_intuos_general(struct
 		t = (data[6] << 2) | ((data[7] >> 6) & 3);
 		if ((features->type >= INTUOS4S && features->type <= INTUOS4L) ||
                     (features->type >= INTUOS5S && features->type <= INTUOS5L) ||
-		    features->type == WACOM_21UX2 || features->type == WACOM_24HD) {
+		    (features->type >= WACOM_21UX2 && features->type <= WACOM_24HD)) {
 			t = (t << 1) | (data[1] & 1);
 		}
 		input_report_abs(input, ABS_PRESSURE, t);
@@ -614,7 +614,7 @@ static int wacom_intuos_irq(struct wacom
 				input_report_abs(input, ABS_MISC, 0);
 			}
 		} else {
-			if (features->type == WACOM_21UX2) {
+			if (features->type == WACOM_21UX2 || features->type == WACOM_22HD) {
 				input_report_key(input, BTN_0, (data[5] & 0x01));
 				input_report_key(input, BTN_1, (data[6] & 0x01));
 				input_report_key(input, BTN_2, (data[6] & 0x02));
@@ -633,6 +633,12 @@ static int wacom_intuos_irq(struct wacom
 				input_report_key(input, BTN_Z, (data[8] & 0x20));
 				input_report_key(input, BTN_BASE, (data[8] & 0x40));
 				input_report_key(input, BTN_BASE2, (data[8] & 0x80));
+
+				if (features->type == WACOM_22HD) {
+					input_report_key(input, KEY_PROG1, data[9] & 0x01);
+					input_report_key(input, KEY_PROG2, data[9] & 0x02);
+					input_report_key(input, KEY_PROG3, data[9] & 0x04);
+				}
 			} else {
 				input_report_key(input, BTN_0, (data[5] & 0x01));
 				input_report_key(input, BTN_1, (data[5] & 0x02));
@@ -1230,6 +1236,7 @@ void wacom_wac_irq(struct wacom_wac *wac
 	case CINTIQ:
 	case WACOM_BEE:
 	case WACOM_21UX2:
+	case WACOM_22HD:
 	case WACOM_24HD:
 		sync = wacom_intuos_irq(wacom_wac);
 		break;
@@ -1432,6 +1439,12 @@ int wacom_setup_input_capabilities(struc
 		wacom_setup_cintiq(wacom_wac);
 		break;
 
+	case WACOM_22HD:
+		__set_bit(KEY_PROG1, input_dev->keybit);
+		__set_bit(KEY_PROG2, input_dev->keybit);
+		__set_bit(KEY_PROG3, input_dev->keybit);
+		/* fall through */
+
 	case WACOM_21UX2:
 		__set_bit(BTN_A, input_dev->keybit);
 		__set_bit(BTN_B, input_dev->keybit);
@@ -1855,6 +1868,9 @@ static const struct wacom_features wacom
 static const struct wacom_features wacom_features_0xCC =
 	{ "Wacom Cintiq 21UX2",   WACOM_PKGLEN_INTUOS,    87200, 65600, 2047,
 	  63, WACOM_21UX2, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES };
+static const struct wacom_features wacom_features_0xFA =
+	{ "Wacom Cintiq 22HD",    WACOM_PKGLEN_INTUOS,    95840, 54260, 2047,
+	  63, WACOM_22HD, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES };
 static const struct wacom_features wacom_features_0x90 =
 	{ "Wacom ISDv4 90",       WACOM_PKGLEN_GRAPHIRE,  26202, 16325,  255,
 	  0, TABLETPC, WACOM_INTUOS_RES, WACOM_INTUOS_RES };
@@ -2064,6 +2080,7 @@ const struct usb_device_id wacom_ids[] =
 	{ USB_DEVICE_WACOM(0xEC) },
 	{ USB_DEVICE_WACOM(0x47) },
 	{ USB_DEVICE_WACOM(0xF4) },
+	{ USB_DEVICE_WACOM(0xFA) },
 	{ USB_DEVICE_LENOVO(0x6004) },
 	{ }
 };
--- a/drivers/input/tablet/wacom_wac.h
+++ b/drivers/input/tablet/wacom_wac.h
@@ -74,8 +74,9 @@ enum {
 	INTUOS5S,
 	INTUOS5,
 	INTUOS5L,
-	WACOM_24HD,
 	WACOM_21UX2,
+	WACOM_22HD,
+	WACOM_24HD,
 	CINTIQ,
 	WACOM_BEE,
 	WACOM_MO,



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 216/262] Input: wacom - rearrange type enum
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (214 preceding siblings ...)
  2012-09-28 18:52 ` [ 215/262] Input: wacom - add support to Cintiq 22HD Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 217/262] Bluetooth: btusb: Add vendor specific ID (0a5c:21f4) BCM20702A0 Greg Kroah-Hartman
                   ` (45 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Ping Cheng, Chris Bagwell, Jason Gerecke, Dmitry Torokhov

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ping Cheng <pinglinux@gmail.com>

commit ea2e60244573a9204c8cee9b4fb181106784c617 upstream.

So we can simplify a few type related if statements

Also fixes https://bugzilla.kernel.org/show_bug.cgi?id=46821

Signed-off-by: Ping Cheng <pingc@wacom.com>
Acked-by: Chris Bagwell <chris@cnpbagwell.com>
Reviewed-by: Jason Gerecke <killertofu@gmail.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/tablet/wacom_sys.c |   10 +++-------
 drivers/input/tablet/wacom_wac.c |    6 ++----
 drivers/input/tablet/wacom_wac.h |    6 +++---
 3 files changed, 8 insertions(+), 14 deletions(-)

--- a/drivers/input/tablet/wacom_sys.c
+++ b/drivers/input/tablet/wacom_sys.c
@@ -445,8 +445,7 @@ static int wacom_query_tablet_data(struc
 	/* ask to report Wacom data */
 	if (features->device_type == BTN_TOOL_FINGER) {
 		/* if it is an MT Tablet PC touch */
-		if (features->type == TABLETPC2FG ||
-		    features->type == MTSCREEN) {
+		if (features->type > TABLETPC) {
 			do {
 				rep_data[0] = 3;
 				rep_data[1] = 4;
@@ -465,7 +464,7 @@ static int wacom_query_tablet_data(struc
 			} while ((error < 0 || rep_data[1] != 4) &&
 				 limit++ < WAC_MSG_RETRIES);
 		}
-	} else if (features->type != TABLETPC &&
+	} else if (features->type <= BAMBOO_PT &&
 		   features->type != WIRELESS &&
 		   features->device_type == BTN_TOOL_PEN) {
 		do {
@@ -515,10 +514,7 @@ static int wacom_retrieve_hid_descriptor
 	}
 
 	/* only devices that support touch need to retrieve the info */
-	if (features->type != TABLETPC &&
-	    features->type != TABLETPC2FG &&
-	    features->type != BAMBOO_PT &&
-	    features->type != MTSCREEN) {
+	if (features->type < BAMBOO_PT) {
 		goto out;
 	}
 
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -1324,10 +1324,8 @@ void wacom_setup_device_quirks(struct wa
 	}
 
 	/* these device have multiple inputs */
-	if (features->type == TABLETPC || features->type == TABLETPC2FG ||
-	    features->type == BAMBOO_PT || features->type == WIRELESS ||
-	    (features->type >= INTUOS5S && features->type <= INTUOS5L) ||
-	    features->type == MTSCREEN)
+	if (features->type >= WIRELESS ||
+	    (features->type >= INTUOS5S && features->type <= INTUOS5L))
 		features->quirks |= WACOM_QUIRK_MULTI_INPUT;
 
 	/* quirk for bamboo touch with 2 low res touches */
--- a/drivers/input/tablet/wacom_wac.h
+++ b/drivers/input/tablet/wacom_wac.h
@@ -62,8 +62,6 @@ enum {
 	PTU,
 	PL,
 	DTU,
-	BAMBOO_PT,
-	WIRELESS,
 	INTUOS,
 	INTUOS3S,
 	INTUOS3,
@@ -80,7 +78,9 @@ enum {
 	CINTIQ,
 	WACOM_BEE,
 	WACOM_MO,
-	TABLETPC,
+	WIRELESS,
+	BAMBOO_PT,
+	TABLETPC,   /* add new TPC below */
 	TABLETPC2FG,
 	MTSCREEN,
 	MAX_TYPE



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 217/262] Bluetooth: btusb: Add vendor specific ID (0a5c:21f4) BCM20702A0
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (215 preceding siblings ...)
  2012-09-28 18:52 ` [ 216/262] Input: wacom - rearrange type enum Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 218/262] Bluetooth: add support for atheros 0489:e057 Greg Kroah-Hartman
                   ` (44 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Manoj Iyer, Chris Gagnon, Gustavo Padovan

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Manoj Iyer <manoj.iyer@canonical.com>

commit 61c964ba1748e984cb232b431582815899bf10fe upstream.

Patch adds support for BCM20702A0 device id (0a5c:21f4).

usb-devices after patch was applied:
T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=0a5c ProdID=21f4 Rev=01.12
S: Manufacturer=Broadcom Corp
S: Product=BCM20702A0
S: SerialNumber=E4D53DF154D6
C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb
I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I: If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)

usb-devices before patch was applied:
T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=0a5c ProdID=21f4 Rev=01.12
S: Manufacturer=Broadcom Corp
S: Product=BCM20702A0
S: SerialNumber=E4D53DF154D6
C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I: If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)

Signed-off-by: Manoj Iyer <manoj.iyer@canonical.com>
Tested-by: Chris Gagnon <chris.gagnon@canonical.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/bluetooth/btusb.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -106,6 +106,7 @@ static struct usb_device_id btusb_table[
 	{ USB_DEVICE(0x0a5c, 0x21e6) },
 	{ USB_DEVICE(0x0a5c, 0x21e8) },
 	{ USB_DEVICE(0x0a5c, 0x21f3) },
+	{ USB_DEVICE(0x0a5c, 0x21f4) },
 	{ USB_DEVICE(0x413c, 0x8197) },
 
 	/* Foxconn - Hon Hai */



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 218/262] Bluetooth: add support for atheros 0489:e057
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (216 preceding siblings ...)
  2012-09-28 18:52 ` [ 217/262] Bluetooth: btusb: Add vendor specific ID (0a5c:21f4) BCM20702A0 Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 219/262] Bluetooth: Add support for Sony Vaio T-Series Greg Kroah-Hartman
                   ` (43 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Peng Chen, Gustavo Padovan

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Peng Chen <pengchen@qca.qualcomm.com>

commit 2096ae6ca647302d50a68aa36cb66a00e7dfac70 upstream.

    Add support for the AR3012 chip found on Fioxconn.

    usb-devices shows:

    T:  Bus=06 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 44 Spd=12   MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=0489 ProdID=e057 Rev= 0.02
    C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
    E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms

Signed-off-by: Peng Chen <pengchen@qca.qualcomm.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/bluetooth/ath3k.c |    2 ++
 drivers/bluetooth/btusb.c |    1 +
 2 files changed, 3 insertions(+)

--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -79,6 +79,7 @@ static struct usb_device_id ath3k_table[
 	{ USB_DEVICE(0x13d3, 0x3362) },
 	{ USB_DEVICE(0x0CF3, 0xE004) },
 	{ USB_DEVICE(0x0930, 0x0219) },
+	{ USB_DEVICE(0x0489, 0xe057) },
 
 	/* Atheros AR5BBU12 with sflash firmware */
 	{ USB_DEVICE(0x0489, 0xE02C) },
@@ -104,6 +105,7 @@ static struct usb_device_id ath3k_blist_
 	{ USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+	{ USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
 
 	/* Atheros AR5BBU22 with sflash firmware */
 	{ USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -142,6 +142,7 @@ static struct usb_device_id blacklist_ta
 	{ USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+	{ USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
 
 	/* Atheros AR5BBU12 with sflash firmware */
 	{ USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 219/262] Bluetooth: Add support for Sony Vaio T-Series
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (217 preceding siblings ...)
  2012-09-28 18:52 ` [ 218/262] Bluetooth: add support for atheros 0489:e057 Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 220/262] Bluetooth: Use USB_VENDOR_AND_INTERFACE() for Broadcom devices Greg Kroah-Hartman
                   ` (42 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Yevgeniy Melnichuk, Mohammed Shafi Shajakhan,
	Marcel Holtmann, Gustavo Padovan

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yevgeniy Melnichuk <yevgeniy.melnichuk@googlemail.com>

commit bc21fde2d549d1cb1ebef04016eb7affa43bb5c1 upstream.

Add Sony Vaio T-Series Bluetooth Module( 0x489:0xE036) to
the blacklist of btusb module and add it to the ath3k module.

output of cat /sys/kernel/debug/usb/devices

T:  Bus=01 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#=  5 Spd=12   MxCh= 0
D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=0489 ProdID=e036 Rev= 0.02
S:  Manufacturer=Atheros Communications
S:  Product=Bluetooth USB Host Controller
S:  SerialNumber=Alaska Day 2006
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms

Signed-off-by: Yevgeniy Melnichuk <yevgeniy.melnichuk@googlemail.com>
Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/bluetooth/ath3k.c |    2 ++
 drivers/bluetooth/btusb.c |    1 +
 2 files changed, 3 insertions(+)

--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -86,6 +86,7 @@ static struct usb_device_id ath3k_table[
 
 	/* Atheros AR5BBU22 with sflash firmware */
 	{ USB_DEVICE(0x0489, 0xE03C) },
+	{ USB_DEVICE(0x0489, 0xE036) },
 
 	{ }	/* Terminating entry */
 };
@@ -109,6 +110,7 @@ static struct usb_device_id ath3k_blist_
 
 	/* Atheros AR5BBU22 with sflash firmware */
 	{ USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },
+	{ USB_DEVICE(0x0489, 0xE036), .driver_info = BTUSB_ATH3012 },
 
 	{ }	/* Terminating entry */
 };
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -149,6 +149,7 @@ static struct usb_device_id blacklist_ta
 
 	/* Atheros AR5BBU12 with sflash firmware */
 	{ USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
+	{ USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
 
 	/* Broadcom BCM2035 */
 	{ USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 220/262] Bluetooth: Use USB_VENDOR_AND_INTERFACE() for Broadcom devices
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (218 preceding siblings ...)
  2012-09-28 18:52 ` [ 219/262] Bluetooth: Add support for Sony Vaio T-Series Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 221/262] Bluetooth: Add support for Apple vendor-specific devices Greg Kroah-Hartman
                   ` (41 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, John Hommel, Gustavo Padovan

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

commit 92c385f46b30f4954e9dd2d2005c12d233b479ea upstream.

Many Broadcom devices has a vendor specific devices class, with this rule
we match all existent and future controllers with this behavior.

We also remove old rules to that matches product id for Broadcom devices.

Tested-by: John Hommel <john.hommel@hp.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/bluetooth/btusb.c |    8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -102,16 +102,14 @@ static struct usb_device_id btusb_table[
 
 	/* Broadcom BCM20702A0 */
 	{ USB_DEVICE(0x0489, 0xe042) },
-	{ USB_DEVICE(0x0a5c, 0x21e3) },
-	{ USB_DEVICE(0x0a5c, 0x21e6) },
-	{ USB_DEVICE(0x0a5c, 0x21e8) },
-	{ USB_DEVICE(0x0a5c, 0x21f3) },
-	{ USB_DEVICE(0x0a5c, 0x21f4) },
 	{ USB_DEVICE(0x413c, 0x8197) },
 
 	/* Foxconn - Hon Hai */
 	{ USB_DEVICE(0x0489, 0xe033) },
 
+	/*Broadcom devices with vendor specific id */
+	{ USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) },
+
 	{ }	/* Terminating entry */
 };
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 221/262] Bluetooth: Add support for Apple vendor-specific devices
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (219 preceding siblings ...)
  2012-09-28 18:52 ` [ 220/262] Bluetooth: Use USB_VENDOR_AND_INTERFACE() for Broadcom devices Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 222/262] Bluetooth: Fix use-after-free bug in SMP Greg Kroah-Hartman
                   ` (40 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Henrik Rydberg, Shea Levy, Marcel Holtmann,
	Gustavo Padovan

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Henrik Rydberg <rydberg@euromail.se>

commit 1fa6535faf055cd71311ab887e94fc234f04ee18 upstream.

As pointed out by Gustavo and Marcel, all Apple-specific Broadcom
devices seen so far have the same interface class, subclass and
protocol numbers. This patch adds an entry which matches all of them,
using the new USB_VENDOR_AND_INTERFACE_INFO() macro.

In particular, this patch adds support for the MacBook Pro Retina
(05ac:8286), which is not in the present list.

Signed-off-by: Henrik Rydberg <rydberg@euromail.se>
Tested-by: Shea Levy <shea@shealevy.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/bluetooth/btusb.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -60,6 +60,9 @@ static struct usb_device_id btusb_table[
 	/* Generic Bluetooth USB device */
 	{ USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
 
+	/* Apple-specific (Broadcom) devices */
+	{ USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01) },
+
 	/* Broadcom SoftSailing reporting vendor specific */
 	{ USB_DEVICE(0x0a5c, 0x21e1) },
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 222/262] Bluetooth: Fix use-after-free bug in SMP
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (220 preceding siblings ...)
  2012-09-28 18:52 ` [ 221/262] Bluetooth: Add support for Apple vendor-specific devices Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 223/262] Bluetooth: Change signature of smp_conn_security() Greg Kroah-Hartman
                   ` (39 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Andre Guedes, Gustavo Padovan

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andre Guedes <andre.guedes@openbossa.org>

commit 61a0cfb008f57ecf7eb28ee762952fb42dc15d15 upstream.

If SMP fails, we should always cancel security_timer delayed work.
Otherwise, security_timer function may run after l2cap_conn object
has been freed.

This patch fixes the following warning reported by ODEBUG:

WARNING: at lib/debugobjects.c:261 debug_print_object+0x7c/0x8d()
Hardware name: Bochs
ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x27
Modules linked in: btusb bluetooth
Pid: 440, comm: kworker/u:2 Not tainted 3.5.0-rc1+ #4
Call Trace:
 [<ffffffff81174600>] ? free_obj_work+0x4a/0x7f
 [<ffffffff81023eb8>] warn_slowpath_common+0x7e/0x97
 [<ffffffff81023f65>] warn_slowpath_fmt+0x41/0x43
 [<ffffffff811746b1>] debug_print_object+0x7c/0x8d
 [<ffffffff810394f0>] ? __queue_work+0x241/0x241
 [<ffffffff81174fdd>] debug_check_no_obj_freed+0x92/0x159
 [<ffffffff810ac08e>] slab_free_hook+0x6f/0x77
 [<ffffffffa0019145>] ? l2cap_conn_del+0x148/0x157 [bluetooth]
 [<ffffffff810ae408>] kfree+0x59/0xac
 [<ffffffffa0019145>] l2cap_conn_del+0x148/0x157 [bluetooth]
 [<ffffffffa001b9a2>] l2cap_recv_frame+0xa77/0xfa4 [bluetooth]
 [<ffffffff810592f9>] ? trace_hardirqs_on_caller+0x112/0x1ad
 [<ffffffffa001c86c>] l2cap_recv_acldata+0xe2/0x264 [bluetooth]
 [<ffffffffa0002b2f>] hci_rx_work+0x235/0x33c [bluetooth]
 [<ffffffff81038dc3>] ? process_one_work+0x126/0x2fe
 [<ffffffff81038e22>] process_one_work+0x185/0x2fe
 [<ffffffff81038dc3>] ? process_one_work+0x126/0x2fe
 [<ffffffff81059f2e>] ? lock_acquired+0x1b5/0x1cf
 [<ffffffffa00028fa>] ? le_scan_work+0x11d/0x11d [bluetooth]
 [<ffffffff81036fb6>] ? spin_lock_irq+0x9/0xb
 [<ffffffff81039209>] worker_thread+0xcf/0x175
 [<ffffffff8103913a>] ? rescuer_thread+0x175/0x175
 [<ffffffff8103cfe0>] kthread+0x95/0x9d
 [<ffffffff812c5054>] kernel_threadi_helper+0x4/0x10
 [<ffffffff812c36b0>] ? retint_restore_args+0x13/0x13
 [<ffffffff8103cf4b>] ? flush_kthread_worker+0xdb/0xdb
 [<ffffffff812c5050>] ? gs_change+0x13/0x13

This bug can be reproduced using hctool lecc or l2test tools and
bluetoothd not running.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/bluetooth/smp.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -266,10 +266,10 @@ static void smp_failure(struct l2cap_con
 	mgmt_auth_failed(conn->hcon->hdev, conn->dst, hcon->type,
 			 hcon->dst_type, reason);
 
-	if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags)) {
-		cancel_delayed_work_sync(&conn->security_timer);
+	cancel_delayed_work_sync(&conn->security_timer);
+
+	if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
 		smp_chan_destroy(conn);
-	}
 }
 
 #define JUST_WORKS	0x00



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 223/262] Bluetooth: Change signature of smp_conn_security()
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (221 preceding siblings ...)
  2012-09-28 18:52 ` [ 222/262] Bluetooth: Fix use-after-free bug in SMP Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 224/262] Bluetooth: Fix sending a HCI Authorization Request over LE links Greg Kroah-Hartman
                   ` (38 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Vinicius Costa Gomes, Gustavo Padovan

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>

commit cc110922da7e902b62d18641a370fec01a9fa794 upstream.

To make it clear that it may be called from contexts that may not have
any knowledge of L2CAP, we change the connection parameter, to receive
a hci_conn.

This also makes it clear that it is checking the security of the link.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/net/bluetooth/smp.h |    2 +-
 net/bluetooth/l2cap_core.c  |   11 ++++++-----
 net/bluetooth/l2cap_sock.c  |    2 +-
 net/bluetooth/smp.c         |    4 ++--
 4 files changed, 10 insertions(+), 9 deletions(-)

--- a/include/net/bluetooth/smp.h
+++ b/include/net/bluetooth/smp.h
@@ -136,7 +136,7 @@ struct smp_chan {
 };
 
 /* SMP Commands */
-int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level);
+int smp_conn_security(struct hci_conn *hcon, __u8 sec_level);
 int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb);
 int smp_distribute_keys(struct l2cap_conn *conn, __u8 force);
 int smp_user_confirm_reply(struct hci_conn *conn, u16 mgmt_op, __le32 passkey);
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1184,14 +1184,15 @@ clean:
 static void l2cap_conn_ready(struct l2cap_conn *conn)
 {
 	struct l2cap_chan *chan;
+	struct hci_conn *hcon = conn->hcon;
 
 	BT_DBG("conn %p", conn);
 
-	if (!conn->hcon->out && conn->hcon->type == LE_LINK)
+	if (!hcon->out && hcon->type == LE_LINK)
 		l2cap_le_conn_ready(conn);
 
-	if (conn->hcon->out && conn->hcon->type == LE_LINK)
-		smp_conn_security(conn, conn->hcon->pending_sec_level);
+	if (hcon->out && hcon->type == LE_LINK)
+		smp_conn_security(hcon, hcon->pending_sec_level);
 
 	mutex_lock(&conn->chan_lock);
 
@@ -1199,8 +1200,8 @@ static void l2cap_conn_ready(struct l2ca
 
 		l2cap_chan_lock(chan);
 
-		if (conn->hcon->type == LE_LINK) {
-			if (smp_conn_security(conn, chan->sec_level))
+		if (hcon->type == LE_LINK) {
+			if (smp_conn_security(hcon, chan->sec_level))
 				l2cap_chan_ready(chan);
 
 		} else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -596,7 +596,7 @@ static int l2cap_sock_setsockopt(struct
 				break;
 			}
 
-			if (smp_conn_security(conn, sec.level))
+			if (smp_conn_security(conn->hcon, sec.level))
 				break;
 			sk->sk_state = BT_CONFIG;
 			chan->state = BT_CONFIG;
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -756,9 +756,9 @@ static u8 smp_cmd_security_req(struct l2
 	return 0;
 }
 
-int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
+int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
 {
-	struct hci_conn *hcon = conn->hcon;
+	struct l2cap_conn *conn = hcon->l2cap_data;
 	struct smp_chan *smp = conn->smp_chan;
 	__u8 authreq;
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 224/262] Bluetooth: Fix sending a HCI Authorization Request over LE links
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (222 preceding siblings ...)
  2012-09-28 18:52 ` [ 223/262] Bluetooth: Change signature of smp_conn_security() Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 225/262] Fix a dead loop in async_synchronize_full() Greg Kroah-Hartman
                   ` (37 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, João Paulo Rechi Vita, Vinicius Costa Gomes,
	Gustavo Padovan

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>

commit d8343f125710fb596f7a88cd756679f14f4e77b9 upstream.

In the case that the link is already in the connected state and a
Pairing request arrives from the mgmt interface, hci_conn_security()
would be called but it was not considering LE links.

Reported-by: João Paulo Rechi Vita <jprvita@openbossa.org>
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/bluetooth/hci_conn.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -42,6 +42,7 @@
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
+#include <net/bluetooth/smp.h>
 
 static void hci_le_connect(struct hci_conn *conn)
 {
@@ -627,6 +628,9 @@ int hci_conn_security(struct hci_conn *c
 {
 	BT_DBG("conn %p", conn);
 
+	if (conn->type == LE_LINK)
+		return smp_conn_security(conn, sec_level);
+
 	/* For sdp we don't need the link key. */
 	if (sec_level == BT_SECURITY_SDP)
 		return 1;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 225/262] Fix a dead loop in async_synchronize_full()
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (223 preceding siblings ...)
  2012-09-28 18:52 ` [ 224/262] Bluetooth: Fix sending a HCI Authorization Request over LE links Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 226/262] rds: set correct msg_namelen Greg Kroah-Hartman
                   ` (36 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Paul E. McKenney, Li Zhong, Christian Kujau,
	Andrew Morton, Dan Williams, Cong Wang

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Li Zhong <zhong@linux.vnet.ibm.com>

[Fixed upstream by commits 2955b47d2c1983998a8c5915cb96884e67f7cb53 and
a4683487f90bfe3049686fc5c566bdc1ad03ace6 from Dan Williams, but they are much
more intrusive than this tiny fix, according to Andrew - gregkh]

This patch tries to fix a dead loop in  async_synchronize_full(), which
could be seen when preemption is disabled on a single cpu machine. 

void async_synchronize_full(void)
{
        do {
                async_synchronize_cookie(next_cookie);
        } while (!list_empty(&async_running) || !
list_empty(&async_pending));
}

async_synchronize_cookie() calls async_synchronize_cookie_domain() with
&async_running as the default domain to synchronize. 

However, there might be some works in the async_pending list from other
domains. On a single cpu system, without preemption, there is no chance
for the other works to finish, so async_synchronize_full() enters a dead
loop. 

It seems async_synchronize_full() wants to synchronize all entries in
all running lists(domains), so maybe we could just check the entry_count
to know whether all works are finished. 

Currently, async_synchronize_cookie_domain() expects a non-NULL running
list ( if NULL, there would be NULL pointer dereference ), so maybe a
NULL pointer could be used as an indication for the functions to
synchronize all works in all domains. 

Reported-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Li Zhong <zhong@linux.vnet.ibm.com>
Tested-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Tested-by: Christian Kujau <lists@nerdbynature.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Dan Williams <dan.j.williams@gmail.com>
Cc: Christian Kujau <lists@nerdbynature.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/async.c |   13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

--- a/kernel/async.c
+++ b/kernel/async.c
@@ -86,6 +86,13 @@ static async_cookie_t  __lowest_in_progr
 {
 	struct async_entry *entry;
 
+	if (!running) { /* just check the entry count */
+		if (atomic_read(&entry_count))
+			return 0; /* smaller than any cookie */
+		else
+			return next_cookie;
+	}
+
 	if (!list_empty(running)) {
 		entry = list_first_entry(running,
 			struct async_entry, list);
@@ -236,9 +243,7 @@ EXPORT_SYMBOL_GPL(async_schedule_domain)
  */
 void async_synchronize_full(void)
 {
-	do {
-		async_synchronize_cookie(next_cookie);
-	} while (!list_empty(&async_running) || !list_empty(&async_pending));
+	async_synchronize_cookie_domain(next_cookie, NULL);
 }
 EXPORT_SYMBOL_GPL(async_synchronize_full);
 
@@ -258,7 +263,7 @@ EXPORT_SYMBOL_GPL(async_synchronize_full
 /**
  * async_synchronize_cookie_domain - synchronize asynchronous function calls within a certain domain with cookie checkpointing
  * @cookie: async_cookie_t to use as checkpoint
- * @running: running list to synchronize on
+ * @running: running list to synchronize on, NULL indicates all lists
  *
  * This function waits until all asynchronous function calls for the
  * synchronization domain specified by the running list @list submitted



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 226/262] rds: set correct msg_namelen
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (224 preceding siblings ...)
  2012-09-28 18:52 ` [ 225/262] Fix a dead loop in async_synchronize_full() Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 227/262] libata: Prevent interface errors with Seagate FreeAgent GoFlex Greg Kroah-Hartman
                   ` (35 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Weiping Pan, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Weiping Pan <wpan@redhat.com>

commit 06b6a1cf6e776426766298d055bb3991957d90a7 upstream.

Jay Fenlason (fenlason@redhat.com) found a bug,
that recvfrom() on an RDS socket can return the contents of random kernel
memory to userspace if it was called with a address length larger than
sizeof(struct sockaddr_in).
rds_recvmsg() also fails to set the addr_len paramater properly before
returning, but that's just a bug.
There are also a number of cases wher recvfrom() can return an entirely bogus
address. Anything in rds_recvmsg() that returns a non-negative value but does
not go through the "sin = (struct sockaddr_in *)msg->msg_name;" code path
at the end of the while(1) loop will return up to 128 bytes of kernel memory
to userspace.

And I write two test programs to reproduce this bug, you will see that in
rds_server, fromAddr will be overwritten and the following sock_fd will be
destroyed.
Yes, it is the programmer's fault to set msg_namelen incorrectly, but it is
better to make the kernel copy the real length of address to user space in
such case.

How to run the test programs ?
I test them on 32bit x86 system, 3.5.0-rc7.

1 compile
gcc -o rds_client rds_client.c
gcc -o rds_server rds_server.c

2 run ./rds_server on one console

3 run ./rds_client on another console

4 you will see something like:
server is waiting to receive data...
old socket fd=3
server received data from client:data from client
msg.msg_namelen=32
new socket fd=-1067277685
sendmsg()
: Bad file descriptor

/***************** rds_client.c ********************/

int main(void)
{
	int sock_fd;
	struct sockaddr_in serverAddr;
	struct sockaddr_in toAddr;
	char recvBuffer[128] = "data from client";
	struct msghdr msg;
	struct iovec iov;

	sock_fd = socket(AF_RDS, SOCK_SEQPACKET, 0);
	if (sock_fd < 0) {
		perror("create socket error\n");
		exit(1);
	}

	memset(&serverAddr, 0, sizeof(serverAddr));
	serverAddr.sin_family = AF_INET;
	serverAddr.sin_addr.s_addr = inet_addr("127.0.0.1");
	serverAddr.sin_port = htons(4001);

	if (bind(sock_fd, (struct sockaddr*)&serverAddr, sizeof(serverAddr)) < 0) {
		perror("bind() error\n");
		close(sock_fd);
		exit(1);
	}

	memset(&toAddr, 0, sizeof(toAddr));
	toAddr.sin_family = AF_INET;
	toAddr.sin_addr.s_addr = inet_addr("127.0.0.1");
	toAddr.sin_port = htons(4000);
	msg.msg_name = &toAddr;
	msg.msg_namelen = sizeof(toAddr);
	msg.msg_iov = &iov;
	msg.msg_iovlen = 1;
	msg.msg_iov->iov_base = recvBuffer;
	msg.msg_iov->iov_len = strlen(recvBuffer) + 1;
	msg.msg_control = 0;
	msg.msg_controllen = 0;
	msg.msg_flags = 0;

	if (sendmsg(sock_fd, &msg, 0) == -1) {
		perror("sendto() error\n");
		close(sock_fd);
		exit(1);
	}

	printf("client send data:%s\n", recvBuffer);

	memset(recvBuffer, '\0', 128);

	msg.msg_name = &toAddr;
	msg.msg_namelen = sizeof(toAddr);
	msg.msg_iov = &iov;
	msg.msg_iovlen = 1;
	msg.msg_iov->iov_base = recvBuffer;
	msg.msg_iov->iov_len = 128;
	msg.msg_control = 0;
	msg.msg_controllen = 0;
	msg.msg_flags = 0;
	if (recvmsg(sock_fd, &msg, 0) == -1) {
		perror("recvmsg() error\n");
		close(sock_fd);
		exit(1);
	}

	printf("receive data from server:%s\n", recvBuffer);

	close(sock_fd);

	return 0;
}

/***************** rds_server.c ********************/

int main(void)
{
	struct sockaddr_in fromAddr;
	int sock_fd;
	struct sockaddr_in serverAddr;
	unsigned int addrLen;
	char recvBuffer[128];
	struct msghdr msg;
	struct iovec iov;

	sock_fd = socket(AF_RDS, SOCK_SEQPACKET, 0);
	if(sock_fd < 0) {
		perror("create socket error\n");
		exit(0);
	}

	memset(&serverAddr, 0, sizeof(serverAddr));
	serverAddr.sin_family = AF_INET;
	serverAddr.sin_addr.s_addr = inet_addr("127.0.0.1");
	serverAddr.sin_port = htons(4000);
	if (bind(sock_fd, (struct sockaddr*)&serverAddr, sizeof(serverAddr)) < 0) {
		perror("bind error\n");
		close(sock_fd);
		exit(1);
	}

	printf("server is waiting to receive data...\n");
	msg.msg_name = &fromAddr;

	/*
	 * I add 16 to sizeof(fromAddr), ie 32,
	 * and pay attention to the definition of fromAddr,
	 * recvmsg() will overwrite sock_fd,
	 * since kernel will copy 32 bytes to userspace.
	 *
	 * If you just use sizeof(fromAddr), it works fine.
	 * */
	msg.msg_namelen = sizeof(fromAddr) + 16;
	/* msg.msg_namelen = sizeof(fromAddr); */
	msg.msg_iov = &iov;
	msg.msg_iovlen = 1;
	msg.msg_iov->iov_base = recvBuffer;
	msg.msg_iov->iov_len = 128;
	msg.msg_control = 0;
	msg.msg_controllen = 0;
	msg.msg_flags = 0;

	while (1) {
		printf("old socket fd=%d\n", sock_fd);
		if (recvmsg(sock_fd, &msg, 0) == -1) {
			perror("recvmsg() error\n");
			close(sock_fd);
			exit(1);
		}
		printf("server received data from client:%s\n", recvBuffer);
		printf("msg.msg_namelen=%d\n", msg.msg_namelen);
		printf("new socket fd=%d\n", sock_fd);
		strcat(recvBuffer, "--data from server");
		if (sendmsg(sock_fd, &msg, 0) == -1) {
			perror("sendmsg()\n");
			close(sock_fd);
			exit(1);
		}
	}

	close(sock_fd);
	return 0;
}

Signed-off-by: Weiping Pan <wpan@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/rds/recv.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -410,6 +410,8 @@ int rds_recvmsg(struct kiocb *iocb, stru
 
 	rdsdebug("size %zu flags 0x%x timeo %ld\n", size, msg_flags, timeo);
 
+	msg->msg_namelen = 0;
+
 	if (msg_flags & MSG_OOB)
 		goto out;
 
@@ -485,6 +487,7 @@ int rds_recvmsg(struct kiocb *iocb, stru
 			sin->sin_port = inc->i_hdr.h_sport;
 			sin->sin_addr.s_addr = inc->i_saddr;
 			memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
+			msg->msg_namelen = sizeof(*sin);
 		}
 		break;
 	}



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 227/262] libata: Prevent interface errors with Seagate FreeAgent GoFlex
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (225 preceding siblings ...)
  2012-09-28 18:52 ` [ 226/262] rds: set correct msg_namelen Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 228/262] sched: Fix race in task_group() Greg Kroah-Hartman
                   ` (34 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Daniel J Blueman, Jeff Garzik

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel J Blueman <daniel@quora.org>

commit c531077f40abc9f2129c4c83a30b3f8d6ce1c0e7 upstream.

When using my Seagate FreeAgent GoFlex eSATAp external disk enclosure,
interface errors are always seen until 1.5Gbps is negotiated [1]. This
occurs using any disk in the enclosure, and when the disk is connected
directly with a generic passive eSATAp cable, we see stable 3Gbps
operation as expected.

Blacklist 3Gbps mode to avoid dataloss and the ~30s delay bus reset
and renegotiation incurs.

Signed-off-by: Daniel J Blueman <daniel@quora.org>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/ata/libata-core.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4126,6 +4126,7 @@ static const struct ata_blacklist_entry
 
 	/* Devices which aren't very happy with higher link speeds */
 	{ "WD My Book",			NULL,	ATA_HORKAGE_1_5_GBPS, },
+	{ "Seagate FreeAgent GoFlex",	NULL,	ATA_HORKAGE_1_5_GBPS, },
 
 	/*
 	 * Devices which choke on SETXFER.  Applies only if both the



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 228/262] sched: Fix race in task_group()
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (226 preceding siblings ...)
  2012-09-28 18:52 ` [ 227/262] libata: Prevent interface errors with Seagate FreeAgent GoFlex Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 229/262] media: lirc_sir: make device registration work Greg Kroah-Hartman
                   ` (33 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Peter Zijlstra, Ingo Molnar

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Peter Zijlstra <peterz@infradead.org>

commit 8323f26ce3425460769605a6aece7a174edaa7d1 upstream.

Stefan reported a crash on a kernel before a3e5d1091c1 ("sched:
Don't call task_group() too many times in set_task_rq()"), he
found the reason to be that the multiple task_group()
invocations in set_task_rq() returned different values.

Looking at all that I found a lack of serialization and plain
wrong comments.

The below tries to fix it using an extra pointer which is
updated under the appropriate scheduler locks. Its not pretty,
but I can't really see another way given how all the cgroup
stuff works.

Reported-and-tested-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Link: http://lkml.kernel.org/r/1340364965.18025.71.camel@twins
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/init_task.h |   12 +++++++++++-
 include/linux/sched.h     |    5 ++++-
 kernel/sched/core.c       |    9 ++++++++-
 kernel/sched/sched.h      |   23 ++++++++++-------------
 4 files changed, 33 insertions(+), 16 deletions(-)

--- a/include/linux/init_task.h
+++ b/include/linux/init_task.h
@@ -123,8 +123,17 @@ extern struct group_info init_groups;
 
 extern struct cred init_cred;
 
+extern struct task_group root_task_group;
+
+#ifdef CONFIG_CGROUP_SCHED
+# define INIT_CGROUP_SCHED(tsk)						\
+	.sched_task_group = &root_task_group,
+#else
+# define INIT_CGROUP_SCHED(tsk)
+#endif
+
 #ifdef CONFIG_PERF_EVENTS
-# define INIT_PERF_EVENTS(tsk)					\
+# define INIT_PERF_EVENTS(tsk)						\
 	.perf_event_mutex = 						\
 		 __MUTEX_INITIALIZER(tsk.perf_event_mutex),		\
 	.perf_event_list = LIST_HEAD_INIT(tsk.perf_event_list),
@@ -161,6 +170,7 @@ extern struct cred init_cred;
 	},								\
 	.tasks		= LIST_HEAD_INIT(tsk.tasks),			\
 	INIT_PUSHABLE_TASKS(tsk)					\
+	INIT_CGROUP_SCHED(tsk)						\
 	.ptraced	= LIST_HEAD_INIT(tsk.ptraced),			\
 	.ptrace_entry	= LIST_HEAD_INIT(tsk.ptrace_entry),		\
 	.real_parent	= &tsk,						\
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1244,6 +1244,9 @@ struct task_struct {
 	const struct sched_class *sched_class;
 	struct sched_entity se;
 	struct sched_rt_entity rt;
+#ifdef CONFIG_CGROUP_SCHED
+	struct task_group *sched_task_group;
+#endif
 
 #ifdef CONFIG_PREEMPT_NOTIFIERS
 	/* list of struct preempt_notifier: */
@@ -2723,7 +2726,7 @@ extern int sched_group_set_rt_period(str
 extern long sched_group_rt_period(struct task_group *tg);
 extern int sched_rt_can_attach(struct task_group *tg, struct task_struct *tsk);
 #endif
-#endif
+#endif /* CONFIG_CGROUP_SCHED */
 
 extern int task_can_switch_user(struct user_struct *up,
 					struct task_struct *tsk);
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -1096,7 +1096,7 @@ void set_task_cpu(struct task_struct *p,
 	 * a task's CPU. ->pi_lock for waking tasks, rq->lock for runnable tasks.
 	 *
 	 * sched_move_task() holds both and thus holding either pins the cgroup,
-	 * see set_task_rq().
+	 * see task_group().
 	 *
 	 * Furthermore, all task_rq users should acquire both locks, see
 	 * task_rq_lock().
@@ -7596,6 +7596,7 @@ void sched_destroy_group(struct task_gro
  */
 void sched_move_task(struct task_struct *tsk)
 {
+	struct task_group *tg;
 	int on_rq, running;
 	unsigned long flags;
 	struct rq *rq;
@@ -7610,6 +7611,12 @@ void sched_move_task(struct task_struct
 	if (unlikely(running))
 		tsk->sched_class->put_prev_task(rq, tsk);
 
+	tg = container_of(task_subsys_state_check(tsk, cpu_cgroup_subsys_id,
+				lockdep_is_held(&tsk->sighand->siglock)),
+			  struct task_group, css);
+	tg = autogroup_task_group(tsk, tg);
+	tsk->sched_task_group = tg;
+
 #ifdef CONFIG_FAIR_GROUP_SCHED
 	if (tsk->sched_class->task_move_group)
 		tsk->sched_class->task_move_group(tsk, on_rq);
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -538,22 +538,19 @@ extern int group_balance_cpu(struct sche
 /*
  * Return the group to which this tasks belongs.
  *
- * We use task_subsys_state_check() and extend the RCU verification with
- * pi->lock and rq->lock because cpu_cgroup_attach() holds those locks for each
- * task it moves into the cgroup. Therefore by holding either of those locks,
- * we pin the task to the current cgroup.
+ * We cannot use task_subsys_state() and friends because the cgroup
+ * subsystem changes that value before the cgroup_subsys::attach() method
+ * is called, therefore we cannot pin it and might observe the wrong value.
+ *
+ * The same is true for autogroup's p->signal->autogroup->tg, the autogroup
+ * core changes this before calling sched_move_task().
+ *
+ * Instead we use a 'copy' which is updated from sched_move_task() while
+ * holding both task_struct::pi_lock and rq::lock.
  */
 static inline struct task_group *task_group(struct task_struct *p)
 {
-	struct task_group *tg;
-	struct cgroup_subsys_state *css;
-
-	css = task_subsys_state_check(p, cpu_cgroup_subsys_id,
-			lockdep_is_held(&p->pi_lock) ||
-			lockdep_is_held(&task_rq(p)->lock));
-	tg = container_of(css, struct task_group, css);
-
-	return autogroup_task_group(p, tg);
+	return p->sched_task_group;
 }
 
 /* Change a task's cfs_rq and parent entity if it moves across CPUs/groups */



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 229/262] media: lirc_sir: make device registration work
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (227 preceding siblings ...)
  2012-09-28 18:52 ` [ 228/262] sched: Fix race in task_group() Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 230/262] time: Improve sanity checking of timekeeping inputs Greg Kroah-Hartman
                   ` (32 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Jarod Wilson, Mauro Carvalho Chehab, Josh Boyer

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jarod Wilson <jarod@redhat.com>

commit 4b71ca6bce8fab3d08c61bf330e781f957934ae1 upstream.

For one, the driver device pointer needs to be filled in, or the lirc core
will refuse to load the driver. And we really need to wire up all the
platform_device bits. This has been tested via the lirc sourceforge tree
and verified to work, been sitting there for months, finally getting
around to sending it. :\

Signed-off-by: Jarod Wilson <jarod@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
CC: Josh Boyer <jwboyer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/media/lirc/lirc_sir.c |   60 ++++++++++++++++++++++++++++++++--
 1 file changed, 58 insertions(+), 2 deletions(-)

--- a/drivers/staging/media/lirc/lirc_sir.c
+++ b/drivers/staging/media/lirc/lirc_sir.c
@@ -52,6 +52,7 @@
 #include <linux/io.h>
 #include <asm/irq.h>
 #include <linux/fcntl.h>
+#include <linux/platform_device.h>
 #ifdef LIRC_ON_SA1100
 #include <asm/hardware.h>
 #ifdef CONFIG_SA1100_COLLIE
@@ -487,9 +488,11 @@ static struct lirc_driver driver = {
 	.owner		= THIS_MODULE,
 };
 
+static struct platform_device *lirc_sir_dev;
 
 static int init_chrdev(void)
 {
+	driver.dev = &lirc_sir_dev->dev;
 	driver.minor = lirc_register_driver(&driver);
 	if (driver.minor < 0) {
 		printk(KERN_ERR LIRC_DRIVER_NAME ": init_chrdev() failed.\n");
@@ -1215,20 +1218,71 @@ static int init_lirc_sir(void)
 	return 0;
 }
 
+static int __devinit lirc_sir_probe(struct platform_device *dev)
+{
+	return 0;
+}
+
+static int __devexit lirc_sir_remove(struct platform_device *dev)
+{
+	return 0;
+}
+
+static struct platform_driver lirc_sir_driver = {
+	.probe		= lirc_sir_probe,
+	.remove		= __devexit_p(lirc_sir_remove),
+	.driver		= {
+		.name	= "lirc_sir",
+		.owner	= THIS_MODULE,
+	},
+};
 
 static int __init lirc_sir_init(void)
 {
 	int retval;
 
+	retval = platform_driver_register(&lirc_sir_driver);
+	if (retval) {
+		printk(KERN_ERR LIRC_DRIVER_NAME ": Platform driver register "
+		       "failed!\n");
+		return -ENODEV;
+	}
+
+	lirc_sir_dev = platform_device_alloc("lirc_dev", 0);
+	if (!lirc_sir_dev) {
+		printk(KERN_ERR LIRC_DRIVER_NAME ": Platform device alloc "
+		       "failed!\n");
+		retval = -ENOMEM;
+		goto pdev_alloc_fail;
+	}
+
+	retval = platform_device_add(lirc_sir_dev);
+	if (retval) {
+		printk(KERN_ERR LIRC_DRIVER_NAME ": Platform device add "
+		       "failed!\n");
+		retval = -ENODEV;
+		goto pdev_add_fail;
+	}
+
 	retval = init_chrdev();
 	if (retval < 0)
-		return retval;
+		goto fail;
+
 	retval = init_lirc_sir();
 	if (retval) {
 		drop_chrdev();
-		return retval;
+		goto fail;
 	}
+
 	return 0;
+
+fail:
+	platform_device_del(lirc_sir_dev);
+pdev_add_fail:
+	platform_device_put(lirc_sir_dev);
+pdev_alloc_fail:
+	platform_driver_unregister(&lirc_sir_driver);
+	return retval;
 }
 
 static void __exit lirc_sir_exit(void)
@@ -1236,6 +1290,8 @@ static void __exit lirc_sir_exit(void)
 	drop_hardware();
 	drop_chrdev();
 	drop_port();
+	platform_device_unregister(lirc_sir_dev);
+	platform_driver_unregister(&lirc_sir_driver);
 	printk(KERN_INFO LIRC_DRIVER_NAME ": Uninstalled.\n");
 }
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 230/262] time: Improve sanity checking of timekeeping inputs
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (228 preceding siblings ...)
  2012-09-28 18:52 ` [ 229/262] media: lirc_sir: make device registration work Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 231/262] time: Avoid making adjustments if we havent accumulated anything Greg Kroah-Hartman
                   ` (31 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, CAI Qian, Sasha Levin, John Stultz,
	Peter Zijlstra, Prarit Bhargava, Zhouping Liu, Ingo Molnar,
	Thomas Gleixner

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: John Stultz <john.stultz@linaro.org>

commit 4e8b14526ca7fb046a81c94002c1c43b6fdf0e9b upstream.

Unexpected behavior could occur if the time is set to a value large
enough to overflow a 64bit ktime_t (which is something larger then the
year 2262).

Also unexpected behavior could occur if large negative offsets are
injected via adjtimex.

So this patch improves the sanity check timekeeping inputs by
improving the timespec_valid() check, and then makes better use of
timespec_valid() to make sure we don't set the time to an invalid
negative value or one that overflows ktime_t.

Note: This does not protect from setting the time close to overflowing
ktime_t and then letting natural accumulation cause the overflow.

Reported-by: CAI Qian <caiqian@redhat.com>
Reported-by: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Zhouping Liu <zliu@redhat.com>
Cc: Ingo Molnar <mingo@kernel.org>
Link: http://lkml.kernel.org/r/1344454580-17031-1-git-send-email-john.stultz@linaro.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/ktime.h     |    7 -------
 include/linux/time.h      |   22 ++++++++++++++++++++--
 kernel/time/timekeeping.c |   26 ++++++++++++++++++++++++--
 3 files changed, 44 insertions(+), 11 deletions(-)

--- a/include/linux/ktime.h
+++ b/include/linux/ktime.h
@@ -58,13 +58,6 @@ union ktime {
 
 typedef union ktime ktime_t;		/* Kill this */
 
-#define KTIME_MAX			((s64)~((u64)1 << 63))
-#if (BITS_PER_LONG == 64)
-# define KTIME_SEC_MAX			(KTIME_MAX / NSEC_PER_SEC)
-#else
-# define KTIME_SEC_MAX			LONG_MAX
-#endif
-
 /*
  * ktime_t definitions when using the 64-bit scalar representation:
  */
--- a/include/linux/time.h
+++ b/include/linux/time.h
@@ -107,11 +107,29 @@ static inline struct timespec timespec_s
 	return ts_delta;
 }
 
+#define KTIME_MAX			((s64)~((u64)1 << 63))
+#if (BITS_PER_LONG == 64)
+# define KTIME_SEC_MAX			(KTIME_MAX / NSEC_PER_SEC)
+#else
+# define KTIME_SEC_MAX			LONG_MAX
+#endif
+
 /*
  * Returns true if the timespec is norm, false if denorm:
  */
-#define timespec_valid(ts) \
-	(((ts)->tv_sec >= 0) && (((unsigned long) (ts)->tv_nsec) < NSEC_PER_SEC))
+static inline bool timespec_valid(const struct timespec *ts)
+{
+	/* Dates before 1970 are bogus */
+	if (ts->tv_sec < 0)
+		return false;
+	/* Can't have more nanoseconds then a second */
+	if ((unsigned long)ts->tv_nsec >= NSEC_PER_SEC)
+		return false;
+	/* Disallow values that could overflow ktime_t */
+	if ((unsigned long long)ts->tv_sec >= KTIME_SEC_MAX)
+		return false;
+	return true;
+}
 
 extern void read_persistent_clock(struct timespec *ts);
 extern void read_boot_clock(struct timespec *ts);
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -384,7 +384,7 @@ int do_settimeofday(const struct timespe
 	struct timespec ts_delta;
 	unsigned long flags;
 
-	if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
+	if (!timespec_valid(tv))
 		return -EINVAL;
 
 	write_seqlock_irqsave(&timekeeper.lock, flags);
@@ -418,6 +418,8 @@ EXPORT_SYMBOL(do_settimeofday);
 int timekeeping_inject_offset(struct timespec *ts)
 {
 	unsigned long flags;
+	struct timespec tmp;
+	int ret = 0;
 
 	if ((unsigned long)ts->tv_nsec >= NSEC_PER_SEC)
 		return -EINVAL;
@@ -426,10 +428,17 @@ int timekeeping_inject_offset(struct tim
 
 	timekeeping_forward_now();
 
+	tmp = timespec_add(timekeeper.xtime,  *ts);
+	if (!timespec_valid(&tmp)) {
+		ret = -EINVAL;
+		goto error;
+	}
+
 	timekeeper.xtime = timespec_add(timekeeper.xtime, *ts);
 	timekeeper.wall_to_monotonic =
 				timespec_sub(timekeeper.wall_to_monotonic, *ts);
 
+error: /* even if we error out, we forwarded the time, so call update */
 	timekeeping_update(true);
 
 	write_sequnlock_irqrestore(&timekeeper.lock, flags);
@@ -437,7 +446,7 @@ int timekeeping_inject_offset(struct tim
 	/* signal hrtimers about time change */
 	clock_was_set();
 
-	return 0;
+	return ret;
 }
 EXPORT_SYMBOL(timekeeping_inject_offset);
 
@@ -597,7 +606,20 @@ void __init timekeeping_init(void)
 	struct timespec now, boot;
 
 	read_persistent_clock(&now);
+	if (!timespec_valid(&now)) {
+		pr_warn("WARNING: Persistent clock returned invalid value!\n"
+			"         Check your CMOS/BIOS settings.\n");
+		now.tv_sec = 0;
+		now.tv_nsec = 0;
+	}
+
 	read_boot_clock(&boot);
+	if (!timespec_valid(&boot)) {
+		pr_warn("WARNING: Boot clock returned invalid value!\n"
+			"         Check your CMOS/BIOS settings.\n");
+		boot.tv_sec = 0;
+		boot.tv_nsec = 0;
+	}
 
 	seqlock_init(&timekeeper.lock);
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 231/262] time: Avoid making adjustments if we havent accumulated anything
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (229 preceding siblings ...)
  2012-09-28 18:52 ` [ 230/262] time: Improve sanity checking of timekeeping inputs Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 232/262] time: Move ktime_t overflow checking into timespec_valid_strict Greg Kroah-Hartman
                   ` (30 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, John Stultz, Prarit Bhargava, Ingo Molnar,
	Thomas Gleixner

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: John Stultz <john.stultz@linaro.org>

commit bf2ac312195155511a0f79325515cbb61929898a upstream.

If update_wall_time() is called and the current offset isn't large
enough to accumulate, avoid re-calling timekeeping_adjust which may
change the clock freq and can cause 1ns inconsistencies with
CLOCK_REALTIME_COARSE/CLOCK_MONOTONIC_COARSE.

Signed-off-by: John Stultz <john.stultz@linaro.org>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: stable@vger.kernel.org
Link: http://lkml.kernel.org/r/1345595449-34965-5-git-send-email-john.stultz@linaro.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/time/timekeeping.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -1055,6 +1055,10 @@ static void update_wall_time(void)
 #else
 	offset = (clock->read(clock) - clock->cycle_last) & clock->mask;
 #endif
+	/* Check if there's really nothing to do */
+	if (offset < timekeeper.cycle_interval)
+		goto out;
+
 	timekeeper.xtime_nsec = (s64)timekeeper.xtime.tv_nsec <<
 						timekeeper.shift;
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 232/262] time: Move ktime_t overflow checking into timespec_valid_strict
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (230 preceding siblings ...)
  2012-09-28 18:52 ` [ 231/262] time: Avoid making adjustments if we havent accumulated anything Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 233/262] media: Avoid sysfs oops when an rc_devs raw device is absent Greg Kroah-Hartman
                   ` (29 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Zhouping Liu, Ingo Molnar, Prarit Bhargava,
	Thomas Gleixner, John Stultz, Linus Torvalds

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: John Stultz <john.stultz@linaro.org>

commit cee58483cf56e0ba355fdd97ff5e8925329aa936 upstream.

Andreas Bombe reported that the added ktime_t overflow checking added to
timespec_valid in commit 4e8b14526ca7 ("time: Improve sanity checking of
timekeeping inputs") was causing problems with X.org because it caused
timeouts larger then KTIME_T to be invalid.

Previously, these large timeouts would be clamped to KTIME_MAX and would
never expire, which is valid.

This patch splits the ktime_t overflow checking into a new
timespec_valid_strict function, and converts the timekeeping codes
internal checking to use this more strict function.

Reported-and-tested-by: Andreas Bombe <aeb@debian.org>
Cc: Zhouping Liu <zliu@redhat.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/time.h      |    7 +++++++
 kernel/time/timekeeping.c |   10 +++++-----
 2 files changed, 12 insertions(+), 5 deletions(-)

--- a/include/linux/time.h
+++ b/include/linux/time.h
@@ -125,6 +125,13 @@ static inline bool timespec_valid(const
 	/* Can't have more nanoseconds then a second */
 	if ((unsigned long)ts->tv_nsec >= NSEC_PER_SEC)
 		return false;
+	return true;
+}
+
+static inline bool timespec_valid_strict(const struct timespec *ts)
+{
+	if (!timespec_valid(ts))
+		return false;
 	/* Disallow values that could overflow ktime_t */
 	if ((unsigned long long)ts->tv_sec >= KTIME_SEC_MAX)
 		return false;
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -384,7 +384,7 @@ int do_settimeofday(const struct timespe
 	struct timespec ts_delta;
 	unsigned long flags;
 
-	if (!timespec_valid(tv))
+	if (!timespec_valid_strict(tv))
 		return -EINVAL;
 
 	write_seqlock_irqsave(&timekeeper.lock, flags);
@@ -429,7 +429,7 @@ int timekeeping_inject_offset(struct tim
 	timekeeping_forward_now();
 
 	tmp = timespec_add(timekeeper.xtime,  *ts);
-	if (!timespec_valid(&tmp)) {
+	if (!timespec_valid_strict(&tmp)) {
 		ret = -EINVAL;
 		goto error;
 	}
@@ -606,7 +606,7 @@ void __init timekeeping_init(void)
 	struct timespec now, boot;
 
 	read_persistent_clock(&now);
-	if (!timespec_valid(&now)) {
+	if (!timespec_valid_strict(&now)) {
 		pr_warn("WARNING: Persistent clock returned invalid value!\n"
 			"         Check your CMOS/BIOS settings.\n");
 		now.tv_sec = 0;
@@ -614,7 +614,7 @@ void __init timekeeping_init(void)
 	}
 
 	read_boot_clock(&boot);
-	if (!timespec_valid(&boot)) {
+	if (!timespec_valid_strict(&boot)) {
 		pr_warn("WARNING: Boot clock returned invalid value!\n"
 			"         Check your CMOS/BIOS settings.\n");
 		boot.tv_sec = 0;
@@ -665,7 +665,7 @@ static void update_sleep_time(struct tim
  */
 static void __timekeeping_inject_sleeptime(struct timespec *delta)
 {
-	if (!timespec_valid(delta)) {
+	if (!timespec_valid_strict(delta)) {
 		printk(KERN_WARNING "__timekeeping_inject_sleeptime: Invalid "
 					"sleep delta value!\n");
 		return;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 233/262] media: Avoid sysfs oops when an rc_devs raw device is absent
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (231 preceding siblings ...)
  2012-09-28 18:52 ` [ 232/262] time: Move ktime_t overflow checking into timespec_valid_strict Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 234/262] pch_uart: Fix missing break for 16 byte fifo Greg Kroah-Hartman
                   ` (28 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Douglas Bagnall, Mauro Carvalho Chehab,
	Herton Ronaldo Krzesinski

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Douglas Bagnall <douglas@paradise.net.nz>

commit 720bb6436ff30fccad05cf5bdf961ea5b1f5686d upstream.

For some reason, when the lirc daemon learns that a usb remote control
has been unplugged, it wants to read the sysfs attributes of the
disappearing device. This is useful for uncovering transient
inconsistencies, but less so for keeping the system running when such
inconsistencies exist.

Under some circumstances (like every time I unplug my dvb stick from
my laptop), lirc catches an rc_dev whose raw event handler has been
removed (presumably by ir_raw_event_unregister), and proceeds to
interrogate the raw protocols supported by the NULL pointer.

This patch avoids the NULL dereference, and ignores the issue of how
this state of affairs came about in the first place.

Version 2 incorporates changes recommended by Mauro Carvalho Chehab
(-ENODEV instead of -EINVAL, and a signed-off-by).

Signed-off-by: Douglas Bagnall <douglas@paradise.net.nz>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Cc: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/rc/rc-main.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -775,10 +775,11 @@ static ssize_t show_protocols(struct dev
 	if (dev->driver_type == RC_DRIVER_SCANCODE) {
 		enabled = dev->rc_map.rc_type;
 		allowed = dev->allowed_protos;
-	} else {
+	} else if (dev->raw) {
 		enabled = dev->raw->enabled_protocols;
 		allowed = ir_raw_get_allowed_protocols();
-	}
+	} else
+		return -ENODEV;
 
 	IR_dprintk(1, "allowed - 0x%llx, enabled - 0x%llx\n",
 		   (long long)allowed,



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 234/262] pch_uart: Fix missing break for 16 byte fifo
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (232 preceding siblings ...)
  2012-09-28 18:52 ` [ 233/262] media: Avoid sysfs oops when an rc_devs raw device is absent Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 235/262] pch_uart: Fix rx error interrupt setting issue Greg Kroah-Hartman
                   ` (27 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, dcb314, Alan Cox, Tomoya MORINAGA

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alan Cox <alan@linux.intel.com>

commit 9bc03743fff0770dc5a5324ba92e67cc377f16ca upstream.

Otherwise we fall back to the wrong value.

Reported-by: <dcb314@hotmail.com>
Resolves-bug: https://bugzilla.kernel.org/show_bug.cgi?id=44091
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Tomoya MORINAGA <tomoya.rohm@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/tty/serial/pch_uart.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/tty/serial/pch_uart.c
+++ b/drivers/tty/serial/pch_uart.c
@@ -1263,6 +1263,7 @@ static int pch_uart_startup(struct uart_
 		break;
 	case 16:
 		fifo_size = PCH_UART_HAL_FIFO16;
+		break;
 	case 1:
 	default:
 		fifo_size = PCH_UART_HAL_FIFO_DIS;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 235/262] pch_uart: Fix rx error interrupt setting issue
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (233 preceding siblings ...)
  2012-09-28 18:52 ` [ 234/262] pch_uart: Fix missing break for 16 byte fifo Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 236/262] pch_uart: Fix parity " Greg Kroah-Hartman
                   ` (26 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Tomoya MORINAGA, Alan Cox

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tomoya MORINAGA <tomoya.rohm@gmail.com>

commit 9539dfb7ac1c84522fe1f79bb7dac2990f3de44a upstream.

Rx Error interrupt(E.G. parity error) is not enabled.
So, when parity error occurs, error interrupt is not occurred.
As a result, the received data is not dropped.

This patch adds enable/disable rx error interrupt code.

Signed-off-by: Tomoya MORINAGA <tomoya.rohm@gmail.com>
Acked-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/tty/serial/pch_uart.c |   18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

--- a/drivers/tty/serial/pch_uart.c
+++ b/drivers/tty/serial/pch_uart.c
@@ -754,7 +754,8 @@ static void pch_dma_rx_complete(void *ar
 		tty_flip_buffer_push(tty);
 	tty_kref_put(tty);
 	async_tx_ack(priv->desc_rx);
-	pch_uart_hal_enable_interrupt(priv, PCH_UART_HAL_RX_INT);
+	pch_uart_hal_enable_interrupt(priv, PCH_UART_HAL_RX_INT |
+					    PCH_UART_HAL_RX_ERR_INT);
 }
 
 static void pch_dma_tx_complete(void *arg)
@@ -809,7 +810,8 @@ static int handle_rx_to(struct eg20t_por
 	int rx_size;
 	int ret;
 	if (!priv->start_rx) {
-		pch_uart_hal_disable_interrupt(priv, PCH_UART_HAL_RX_INT);
+		pch_uart_hal_disable_interrupt(priv, PCH_UART_HAL_RX_INT |
+						     PCH_UART_HAL_RX_ERR_INT);
 		return 0;
 	}
 	buf = &priv->rxbuf;
@@ -1078,11 +1080,13 @@ static irqreturn_t pch_uart_interrupt(in
 		case PCH_UART_IID_RDR:	/* Received Data Ready */
 			if (priv->use_dma) {
 				pch_uart_hal_disable_interrupt(priv,
-							PCH_UART_HAL_RX_INT);
+						PCH_UART_HAL_RX_INT |
+						PCH_UART_HAL_RX_ERR_INT);
 				ret = dma_handle_rx(priv);
 				if (!ret)
 					pch_uart_hal_enable_interrupt(priv,
-							PCH_UART_HAL_RX_INT);
+						PCH_UART_HAL_RX_INT |
+						PCH_UART_HAL_RX_ERR_INT);
 			} else {
 				ret = handle_rx(priv);
 			}
@@ -1208,7 +1212,8 @@ static void pch_uart_stop_rx(struct uart
 	struct eg20t_port *priv;
 	priv = container_of(port, struct eg20t_port, port);
 	priv->start_rx = 0;
-	pch_uart_hal_disable_interrupt(priv, PCH_UART_HAL_RX_INT);
+	pch_uart_hal_disable_interrupt(priv, PCH_UART_HAL_RX_INT |
+					     PCH_UART_HAL_RX_ERR_INT);
 }
 
 /* Enable the modem status interrupts. */
@@ -1301,7 +1306,8 @@ static int pch_uart_startup(struct uart_
 		pch_request_dma(port);
 
 	priv->start_rx = 1;
-	pch_uart_hal_enable_interrupt(priv, PCH_UART_HAL_RX_INT);
+	pch_uart_hal_enable_interrupt(priv, PCH_UART_HAL_RX_INT |
+					    PCH_UART_HAL_RX_ERR_INT);
 	uart_update_timeout(port, CS8, default_baud);
 
 	return 0;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 236/262] pch_uart: Fix parity setting issue
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (234 preceding siblings ...)
  2012-09-28 18:52 ` [ 235/262] pch_uart: Fix rx error interrupt setting issue Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 237/262] powerpc/85xx: p1022ds: disable the NAND flash node if video is enabled Greg Kroah-Hartman
                   ` (25 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Tomoya MORINAGA, Alan Cox

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tomoya MORINAGA <tomoya.rohm@gmail.com>

commit 38bd2a1ac736901d1cf4971c78ef952ba92ef78b upstream.

Parity Setting value is reverse.
E.G. In case of setting ODD parity, EVEN value is set.
This patch inverts "if" condition.

Signed-off-by: Tomoya MORINAGA <tomoya.rohm@gmail.com>
Acked-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/tty/serial/pch_uart.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/tty/serial/pch_uart.c
+++ b/drivers/tty/serial/pch_uart.c
@@ -1365,7 +1365,7 @@ static void pch_uart_set_termios(struct
 		stb = PCH_UART_HAL_STB1;
 
 	if (termios->c_cflag & PARENB) {
-		if (!(termios->c_cflag & PARODD))
+		if (termios->c_cflag & PARODD)
 			parity = PCH_UART_HAL_PARITY_ODD;
 		else
 			parity = PCH_UART_HAL_PARITY_EVEN;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 237/262] powerpc/85xx: p1022ds: disable the NAND flash node if video is enabled
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (235 preceding siblings ...)
  2012-09-28 18:52 ` [ 236/262] pch_uart: Fix parity " Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 238/262] powerpc/85xx: p1022ds: fix DIU/LBC switching with NAND enabled Greg Kroah-Hartman
                   ` (24 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Timur Tabi, Kumar Gala

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Timur Tabi <timur@freescale.com>

commit 6269f2584a359766f53005c676daff8aee60cbed upstream.

The Freescale P1022 has a unique pin muxing "feature" where the DIU video
controller's video signals are muxed with 24 of the local bus address signals.
When the DIU is enabled, the bulk of the local bus is disabled, preventing
access to memory-mapped devices like NAND flash and the pixis FPGA.

Therefore, if the DIU is going to be enabled, then memory-mapped devices on
the localbus, like NAND flash, need to be disabled.

This patch is similar to "powerpc/85xx: p1022ds: disable the NOR flash node
if video is enabled", except that it disables the NAND flash node instead.
This PIXIS node needs to remain enabled because it is used by platform code
to switch into indirect mode.

Signed-off-by: Timur Tabi <timur@freescale.com>
Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>


---
 arch/powerpc/platforms/85xx/p1022_ds.c |   38 +++++++++++++++++++++++++--------
 1 file changed, 29 insertions(+), 9 deletions(-)

--- a/arch/powerpc/platforms/85xx/p1022_ds.c
+++ b/arch/powerpc/platforms/85xx/p1022_ds.c
@@ -435,6 +435,8 @@ static void __init disable_one_node(stru
 		prom_update_property(np, new, old);
 	else
 		prom_add_property(np, new);
+
+	pr_info("p1022ds: disabling %s node\n", np->full_name);
 }
 
 /* TRUE if there is a "video=fslfb" command-line parameter. */
@@ -499,28 +501,46 @@ static void __init p1022_ds_setup_arch(v
 	diu_ops.valid_monitor_port	= p1022ds_valid_monitor_port;
 
 	/*
-	 * Disable the NOR flash node if there is video=fslfb... command-line
-	 * parameter.  When the DIU is active, NOR flash is unavailable, so we
-	 * have to disable the node before the MTD driver loads.
+	 * Disable the NOR and NAND flash nodes if there is video=fslfb...
+	 * command-line parameter.  When the DIU is active, the localbus is
+	 * unavailable, so we have to disable these nodes before the MTD
+	 * driver loads.
 	 */
 	if (fslfb) {
 		struct device_node *np =
 			of_find_compatible_node(NULL, NULL, "fsl,p1022-elbc");
 
 		if (np) {
-			np = of_find_compatible_node(np, NULL, "cfi-flash");
-			if (np) {
+			struct device_node *np2;
+
+			of_node_get(np);
+			np2 = of_find_compatible_node(np, NULL, "cfi-flash");
+			if (np2) {
 				static struct property nor_status = {
 					.name = "status",
 					.value = "disabled",
 					.length = sizeof("disabled"),
 				};
 
-				pr_info("p1022ds: disabling %s node",
-					np->full_name);
-				disable_one_node(np, &nor_status);
-				of_node_put(np);
+				disable_one_node(np2, &nor_status);
+				of_node_put(np2);
+			}
+
+			of_node_get(np);
+			np2 = of_find_compatible_node(np, NULL,
+						      "fsl,elbc-fcm-nand");
+			if (np2) {
+				static struct property nand_status = {
+					.name = "status",
+					.value = "disabled",
+					.length = sizeof("disabled"),
+				};
+
+				disable_one_node(np2, &nand_status);
+				of_node_put(np2);
 			}
+
+			of_node_put(np);
 		}
 
 	}



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 238/262] powerpc/85xx: p1022ds: fix DIU/LBC switching with NAND enabled
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (236 preceding siblings ...)
  2012-09-28 18:52 ` [ 237/262] powerpc/85xx: p1022ds: disable the NAND flash node if video is enabled Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 239/262] pch_uart: Add eg20t_port lock field, avoid recursive spinlocks Greg Kroah-Hartman
                   ` (23 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Timur Tabi, Kumar Gala

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Timur Tabi <timur@freescale.com>

commit 896c01cb4bb3cfc2c0ea9873fa7a9f8bd0a7c8d8 upstream.

In order for indirect mode on the PIXIS to work properly, both chip selects
need to be set to GPCM mode, otherwise writes to the chip select base
addresses will not actually post to the local bus -- they'll go to the
NAND controller instead.  Therefore, we need to set BR0 and BR1 to GPCM
mode before switching to indirect mode.

Signed-off-by: Timur Tabi <timur@freescale.com>
Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/platforms/85xx/p1022_ds.c |   64 +++++++++++++++++++++++++++++++--
 1 file changed, 62 insertions(+), 2 deletions(-)

--- a/arch/powerpc/platforms/85xx/p1022_ds.c
+++ b/arch/powerpc/platforms/85xx/p1022_ds.c
@@ -208,6 +208,7 @@ static void p1022ds_set_monitor_port(enu
 	u8 __iomem *lbc_lcs0_ba = NULL;
 	u8 __iomem *lbc_lcs1_ba = NULL;
 	phys_addr_t cs0_addr, cs1_addr;
+	u32 br0, or0, br1, or1;
 	const __be32 *iprop;
 	unsigned int num_laws;
 	u8 b;
@@ -256,11 +257,70 @@ static void p1022ds_set_monitor_port(enu
 	}
 	num_laws = be32_to_cpup(iprop);
 
-	cs0_addr = lbc_br_to_phys(ecm, num_laws, in_be32(&lbc->bank[0].br));
-	cs1_addr = lbc_br_to_phys(ecm, num_laws, in_be32(&lbc->bank[1].br));
+	/*
+	 * Indirect mode requires both BR0 and BR1 to be set to "GPCM",
+	 * otherwise writes to these addresses won't actually appear on the
+	 * local bus, and so the PIXIS won't see them.
+	 *
+	 * In FCM mode, writes go to the NAND controller, which does not pass
+	 * them to the localbus directly.  So we force BR0 and BR1 into GPCM
+	 * mode, since we don't care about what's behind the localbus any
+	 * more.
+	 */
+	br0 = in_be32(&lbc->bank[0].br);
+	br1 = in_be32(&lbc->bank[1].br);
+	or0 = in_be32(&lbc->bank[0].or);
+	or1 = in_be32(&lbc->bank[1].or);
+
+	/* Make sure CS0 and CS1 are programmed */
+	if (!(br0 & BR_V) || !(br1 & BR_V)) {
+		pr_err("p1022ds: CS0 and/or CS1 is not programmed\n");
+		goto exit;
+	}
+
+	/*
+	 * Use the existing BRx/ORx values if it's already GPCM. Otherwise,
+	 * force the values to simple 32KB GPCM windows with the most
+	 * conservative timing.
+	 */
+	if ((br0 & BR_MSEL) != BR_MS_GPCM) {
+		br0 = (br0 & BR_BA) | BR_V;
+		or0 = 0xFFFF8000 | 0xFF7;
+		out_be32(&lbc->bank[0].br, br0);
+		out_be32(&lbc->bank[0].or, or0);
+	}
+	if ((br1 & BR_MSEL) != BR_MS_GPCM) {
+		br1 = (br1 & BR_BA) | BR_V;
+		or1 = 0xFFFF8000 | 0xFF7;
+		out_be32(&lbc->bank[1].br, br1);
+		out_be32(&lbc->bank[1].or, or1);
+	}
+
+	cs0_addr = lbc_br_to_phys(ecm, num_laws, br0);
+	if (!cs0_addr) {
+		pr_err("p1022ds: could not determine physical address for CS0"
+		       " (BR0=%08x)\n", br0);
+		goto exit;
+	}
+	cs1_addr = lbc_br_to_phys(ecm, num_laws, br1);
+	if (!cs0_addr) {
+		pr_err("p1022ds: could not determine physical address for CS1"
+		       " (BR1=%08x)\n", br1);
+		goto exit;
+	}
 
 	lbc_lcs0_ba = ioremap(cs0_addr, 1);
+	if (!lbc_lcs0_ba) {
+		pr_err("p1022ds: could not ioremap CS0 address %llx\n",
+		       (unsigned long long)cs0_addr);
+		goto exit;
+	}
 	lbc_lcs1_ba = ioremap(cs1_addr, 1);
+	if (!lbc_lcs1_ba) {
+		pr_err("p1022ds: could not ioremap CS1 address %llx\n",
+		       (unsigned long long)cs1_addr);
+		goto exit;
+	}
 
 	/* Make sure we're in indirect mode first. */
 	if ((in_be32(&guts->pmuxcr) & PMUXCR_ELBCDIU_MASK) !=



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 239/262] pch_uart: Add eg20t_port lock field, avoid recursive spinlocks
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (237 preceding siblings ...)
  2012-09-28 18:52 ` [ 238/262] powerpc/85xx: p1022ds: fix DIU/LBC switching with NAND enabled Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 240/262] OMAP: USB : Fix the EHCI enumeration and core retention issue Greg Kroah-Hartman
                   ` (22 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Darren Hart, Tomoya MORINAGA, Feng Tang,
	Alexander Stein, Alan Cox

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Darren Hart <dvhart@linux.intel.com>

commit 2588aba002d14e938c2f56d299ecf3e7ce1302a5 upstream.

pch_uart_interrupt() takes priv->port.lock which leads to two recursive
spinlock calls if low_latency==1 or CONFIG_PREEMPT_RT_FULL=y (one
otherwise):

pch_uart_interrupt
  spin_lock_irqsave(priv->port.lock, flags)
  case PCH_UART_IID_RDR_TO (data ready)
  handle_rx_to
    push_rx
      tty_port_tty_get
        spin_lock_irqsave(&port->lock, flags) <--- already hold this lock
        ...
      tty_flip_buffer_push
        ...
        flush_to_ldisc
          spin_lock_irqsave(&tty->buf.lock)
            spin_lock_irqsave(&tty->buf.lock)
            disc->ops->receive_buf(tty, char_buf)
              n_tty_receive_buf
                tty->ops->flush_chars()
                uart_flush_chars
                  uart_start
                    spin_lock_irqsave(&port->lock) <--- already hold this lock

Avoid this by using a dedicated lock to protect the eg20t_port structure
and IO access to its membase. This is more consistent with the 8250
driver.  Ensure priv->lock is always take prior to priv->port.lock when
taken at the same time.

V2: Remove inadvertent whitespace change.
V3: Account for oops_in_progress for the private lock in
    pch_console_write().

Note: Like the 8250 driver, if a printk is introduced anywhere inside
      the pch_console_write() critical section, the kernel will hang
      on a recursive spinlock on the private lock. The oops case is
      handled by using a trylock in the oops_in_progress case.

Signed-off-by: Darren Hart <dvhart@linux.intel.com>
CC: Tomoya MORINAGA <tomoya.rohm@gmail.com>
CC: Feng Tang <feng.tang@intel.com>
CC: Alexander Stein <alexander.stein@systec-electronic.com>
Acked-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/tty/serial/pch_uart.c |   38 ++++++++++++++++++++++++++------------
 1 file changed, 26 insertions(+), 12 deletions(-)

--- a/drivers/tty/serial/pch_uart.c
+++ b/drivers/tty/serial/pch_uart.c
@@ -253,6 +253,9 @@ struct eg20t_port {
 	dma_addr_t			rx_buf_dma;
 
 	struct dentry	*debugfs;
+
+	/* protect the eg20t_port private structure and io access to membase */
+	spinlock_t lock;
 };
 
 /**
@@ -1060,7 +1063,7 @@ static irqreturn_t pch_uart_interrupt(in
 	int next = 1;
 	u8 msr;
 
-	spin_lock_irqsave(&priv->port.lock, flags);
+	spin_lock_irqsave(&priv->lock, flags);
 	handled = 0;
 	while (next) {
 		iid = pch_uart_hal_get_iid(priv);
@@ -1120,7 +1123,7 @@ static irqreturn_t pch_uart_interrupt(in
 		handled |= (unsigned int)ret;
 	}
 
-	spin_unlock_irqrestore(&priv->port.lock, flags);
+	spin_unlock_irqrestore(&priv->lock, flags);
 	return IRQ_RETVAL(handled);
 }
 
@@ -1231,9 +1234,9 @@ static void pch_uart_break_ctl(struct ua
 	unsigned long flags;
 
 	priv = container_of(port, struct eg20t_port, port);
-	spin_lock_irqsave(&port->lock, flags);
+	spin_lock_irqsave(&priv->lock, flags);
 	pch_uart_hal_set_break(priv, ctl);
-	spin_unlock_irqrestore(&port->lock, flags);
+	spin_unlock_irqrestore(&priv->lock, flags);
 }
 
 /* Grab any interrupt resources and initialise any low level driver state. */
@@ -1383,7 +1386,8 @@ static void pch_uart_set_termios(struct
 
 	baud = uart_get_baud_rate(port, termios, old, 0, port->uartclk / 16);
 
-	spin_lock_irqsave(&port->lock, flags);
+	spin_lock_irqsave(&priv->lock, flags);
+	spin_lock(&port->lock);
 
 	uart_update_timeout(port, termios->c_cflag, baud);
 	rtn = pch_uart_hal_set_line(priv, baud, parity, bits, stb);
@@ -1396,7 +1400,8 @@ static void pch_uart_set_termios(struct
 		tty_termios_encode_baud_rate(termios, baud, baud);
 
 out:
-	spin_unlock_irqrestore(&port->lock, flags);
+	spin_unlock(&port->lock);
+	spin_unlock_irqrestore(&priv->lock, flags);
 }
 
 static const char *pch_uart_type(struct uart_port *port)
@@ -1545,8 +1550,9 @@ pch_console_write(struct console *co, co
 {
 	struct eg20t_port *priv;
 	unsigned long flags;
+	int priv_locked = 1;
+	int port_locked = 1;
 	u8 ier;
-	int locked = 1;
 
 	priv = pch_uart_ports[co->index];
 
@@ -1554,12 +1560,16 @@ pch_console_write(struct console *co, co
 
 	local_irq_save(flags);
 	if (priv->port.sysrq) {
-		/* serial8250_handle_port() already took the lock */
-		locked = 0;
+		spin_lock(&priv->lock);
+		/* serial8250_handle_port() already took the port lock */
+		port_locked = 0;
 	} else if (oops_in_progress) {
-		locked = spin_trylock(&priv->port.lock);
-	} else
+		priv_locked = spin_trylock(&priv->lock);
+		port_locked = spin_trylock(&priv->port.lock);
+	} else {
+		spin_lock(&priv->lock);
 		spin_lock(&priv->port.lock);
+	}
 
 	/*
 	 *	First save the IER then disable the interrupts
@@ -1577,8 +1587,10 @@ pch_console_write(struct console *co, co
 	wait_for_xmitr(priv, BOTH_EMPTY);
 	iowrite8(ier, priv->membase + UART_IER);
 
-	if (locked)
+	if (port_locked)
 		spin_unlock(&priv->port.lock);
+	if (priv_locked)
+		spin_unlock(&priv->lock);
 	local_irq_restore(flags);
 }
 
@@ -1676,6 +1688,8 @@ static struct eg20t_port *pch_uart_init_
 	pci_enable_msi(pdev);
 	pci_set_master(pdev);
 
+	spin_lock_init(&priv->lock);
+
 	iobase = pci_resource_start(pdev, 0);
 	mapbase = pci_resource_start(pdev, 1);
 	priv->mapbase = mapbase;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 240/262] OMAP: USB : Fix the EHCI enumeration and core retention issue
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (238 preceding siblings ...)
  2012-09-28 18:52 ` [ 239/262] pch_uart: Add eg20t_port lock field, avoid recursive spinlocks Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 241/262] i2c/powermac: Improve detection of devices from device-tree Greg Kroah-Hartman
                   ` (21 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Keshava Munegowda, Felipe Balbi

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Keshava Munegowda <keshava_mgowda@ti.com>

commit 872c495dd0f9d1f48814a8ee80c2c7b3b7c3b4d9 upstream.

This commit 354ab8567ae3107a8cbe7228c3181990ba598aac titled
"Fix OMAP EHCI suspend/resume failure (i693)" is causing
the usb hub and device detection fails in beagle XM
causeing NFS not functional. This affects the core retention too.
The same commit logic needs to be revisted adhering to hwmod and
device tree framework.
for now, this commit id 354ab8567ae3107a8cbe7228c3181990ba598aac
titled "Fix OMAP EHCI suspend/resume failure (i693)" reverted.

This patch is validated on BeagleXM with NFS support over
usb ethernet and USB mass storage and other device detection.

Signed-off-by: Keshava Munegowda <keshava_mgowda@ti.com>
Acked-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/host/ehci-omap.c |  164 -------------------------------------------
 1 file changed, 1 insertion(+), 163 deletions(-)

--- a/drivers/usb/host/ehci-omap.c
+++ b/drivers/usb/host/ehci-omap.c
@@ -56,15 +56,6 @@
 #define	EHCI_INSNREG05_ULPI_EXTREGADD_SHIFT		8
 #define	EHCI_INSNREG05_ULPI_WRDATA_SHIFT		0
 
-/* Errata i693 */
-static struct clk	*utmi_p1_fck;
-static struct clk	*utmi_p2_fck;
-static struct clk	*xclk60mhsp1_ck;
-static struct clk	*xclk60mhsp2_ck;
-static struct clk	*usbhost_p1_fck;
-static struct clk	*usbhost_p2_fck;
-static struct clk	*init_60m_fclk;
-
 /*-------------------------------------------------------------------------*/
 
 static const struct hc_driver ehci_omap_hc_driver;
@@ -80,40 +71,6 @@ static inline u32 ehci_read(void __iomem
 	return __raw_readl(base + reg);
 }
 
-/* Erratum i693 workaround sequence */
-static void omap_ehci_erratum_i693(struct ehci_hcd *ehci)
-{
-	int ret = 0;
-
-	/* Switch to the internal 60 MHz clock */
-	ret = clk_set_parent(utmi_p1_fck, init_60m_fclk);
-	if (ret != 0)
-		ehci_err(ehci, "init_60m_fclk set parent"
-			"failed error:%d\n", ret);
-
-	ret = clk_set_parent(utmi_p2_fck, init_60m_fclk);
-	if (ret != 0)
-		ehci_err(ehci, "init_60m_fclk set parent"
-			"failed error:%d\n", ret);
-
-	clk_enable(usbhost_p1_fck);
-	clk_enable(usbhost_p2_fck);
-
-	/* Wait 1ms and switch back to the external clock */
-	mdelay(1);
-	ret = clk_set_parent(utmi_p1_fck, xclk60mhsp1_ck);
-	if (ret != 0)
-		ehci_err(ehci, "xclk60mhsp1_ck set parent"
-			"failed error:%d\n", ret);
-
-	ret = clk_set_parent(utmi_p2_fck, xclk60mhsp2_ck);
-	if (ret != 0)
-		ehci_err(ehci, "xclk60mhsp2_ck set parent"
-			"failed error:%d\n", ret);
-
-	clk_disable(usbhost_p1_fck);
-	clk_disable(usbhost_p2_fck);
-}
 
 static void omap_ehci_soft_phy_reset(struct platform_device *pdev, u8 port)
 {
@@ -145,50 +102,6 @@ static void omap_ehci_soft_phy_reset(str
 	}
 }
 
-static int omap_ehci_hub_control(
-	struct usb_hcd	*hcd,
-	u16		typeReq,
-	u16		wValue,
-	u16		wIndex,
-	char		*buf,
-	u16		wLength
-)
-{
-	struct ehci_hcd	*ehci = hcd_to_ehci(hcd);
-	u32 __iomem *status_reg = &ehci->regs->port_status[
-				(wIndex & 0xff) - 1];
-	u32		temp;
-	unsigned long	flags;
-	int		retval = 0;
-
-	spin_lock_irqsave(&ehci->lock, flags);
-
-	if (typeReq == SetPortFeature && wValue == USB_PORT_FEAT_SUSPEND) {
-		temp = ehci_readl(ehci, status_reg);
-		if ((temp & PORT_PE) == 0 || (temp & PORT_RESET) != 0) {
-			retval = -EPIPE;
-			goto done;
-		}
-
-		temp &= ~PORT_WKCONN_E;
-		temp |= PORT_WKDISC_E | PORT_WKOC_E;
-		ehci_writel(ehci, temp | PORT_SUSPEND, status_reg);
-
-		omap_ehci_erratum_i693(ehci);
-
-		set_bit((wIndex & 0xff) - 1, &ehci->suspended_ports);
-		goto done;
-	}
-
-	spin_unlock_irqrestore(&ehci->lock, flags);
-
-	/* Handle the hub control events here */
-	return ehci_hub_control(hcd, typeReq, wValue, wIndex, buf, wLength);
-done:
-	spin_unlock_irqrestore(&ehci->lock, flags);
-	return retval;
-}
-
 static void disable_put_regulator(
 		struct ehci_hcd_omap_platform_data *pdata)
 {
@@ -351,76 +264,9 @@ static int ehci_hcd_omap_probe(struct pl
 	/* root ports should always stay powered */
 	ehci_port_power(omap_ehci, 1);
 
-	/* get clocks */
-	utmi_p1_fck = clk_get(dev, "utmi_p1_gfclk");
-	if (IS_ERR(utmi_p1_fck)) {
-		ret = PTR_ERR(utmi_p1_fck);
-		dev_err(dev, "utmi_p1_gfclk failed error:%d\n",	ret);
-		goto err_add_hcd;
-	}
-
-	xclk60mhsp1_ck = clk_get(dev, "xclk60mhsp1_ck");
-	if (IS_ERR(xclk60mhsp1_ck)) {
-		ret = PTR_ERR(xclk60mhsp1_ck);
-		dev_err(dev, "xclk60mhsp1_ck failed error:%d\n", ret);
-		goto err_utmi_p1_fck;
-	}
-
-	utmi_p2_fck = clk_get(dev, "utmi_p2_gfclk");
-	if (IS_ERR(utmi_p2_fck)) {
-		ret = PTR_ERR(utmi_p2_fck);
-		dev_err(dev, "utmi_p2_gfclk failed error:%d\n", ret);
-		goto err_xclk60mhsp1_ck;
-	}
-
-	xclk60mhsp2_ck = clk_get(dev, "xclk60mhsp2_ck");
-	if (IS_ERR(xclk60mhsp2_ck)) {
-		ret = PTR_ERR(xclk60mhsp2_ck);
-		dev_err(dev, "xclk60mhsp2_ck failed error:%d\n", ret);
-		goto err_utmi_p2_fck;
-	}
-
-	usbhost_p1_fck = clk_get(dev, "usb_host_hs_utmi_p1_clk");
-	if (IS_ERR(usbhost_p1_fck)) {
-		ret = PTR_ERR(usbhost_p1_fck);
-		dev_err(dev, "usbhost_p1_fck failed error:%d\n", ret);
-		goto err_xclk60mhsp2_ck;
-	}
-
-	usbhost_p2_fck = clk_get(dev, "usb_host_hs_utmi_p2_clk");
-	if (IS_ERR(usbhost_p2_fck)) {
-		ret = PTR_ERR(usbhost_p2_fck);
-		dev_err(dev, "usbhost_p2_fck failed error:%d\n", ret);
-		goto err_usbhost_p1_fck;
-	}
-
-	init_60m_fclk = clk_get(dev, "init_60m_fclk");
-	if (IS_ERR(init_60m_fclk)) {
-		ret = PTR_ERR(init_60m_fclk);
-		dev_err(dev, "init_60m_fclk failed error:%d\n", ret);
-		goto err_usbhost_p2_fck;
-	}
 
 	return 0;
 
-err_usbhost_p2_fck:
-	clk_put(usbhost_p2_fck);
-
-err_usbhost_p1_fck:
-	clk_put(usbhost_p1_fck);
-
-err_xclk60mhsp2_ck:
-	clk_put(xclk60mhsp2_ck);
-
-err_utmi_p2_fck:
-	clk_put(utmi_p2_fck);
-
-err_xclk60mhsp1_ck:
-	clk_put(xclk60mhsp1_ck);
-
-err_utmi_p1_fck:
-	clk_put(utmi_p1_fck);
-
 err_add_hcd:
 	disable_put_regulator(pdata);
 	pm_runtime_put_sync(dev);
@@ -450,14 +296,6 @@ static int ehci_hcd_omap_remove(struct p
 	iounmap(hcd->regs);
 	usb_put_hcd(hcd);
 
-	clk_put(utmi_p1_fck);
-	clk_put(utmi_p2_fck);
-	clk_put(xclk60mhsp1_ck);
-	clk_put(xclk60mhsp2_ck);
-	clk_put(usbhost_p1_fck);
-	clk_put(usbhost_p2_fck);
-	clk_put(init_60m_fclk);
-
 	pm_runtime_put_sync(dev);
 	pm_runtime_disable(dev);
 
@@ -528,7 +366,7 @@ static const struct hc_driver ehci_omap_
 	 * root hub support
 	 */
 	.hub_status_data	= ehci_hub_status_data,
-	.hub_control		= omap_ehci_hub_control,
+	.hub_control		= ehci_hub_control,
 	.bus_suspend		= ehci_bus_suspend,
 	.bus_resume		= ehci_bus_resume,
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 241/262] i2c/powermac: Improve detection of devices from device-tree
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (239 preceding siblings ...)
  2012-09-28 18:52 ` [ 240/262] OMAP: USB : Fix the EHCI enumeration and core retention issue Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 242/262] sound/aoa: Adapt to new i2c probing scheme Greg Kroah-Hartman
                   ` (20 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Benjamin Herrenschmidt, Michel Dänzer,
	Elimar Riesebieter

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Benjamin Herrenschmidt <benh@kernel.crashing.org>

commit 3a3dd0186f619b74e61e6f29dddcaf59af7d3cac upstream.

This patch adds a number of workarounds for broken Apple device-trees
mostly around sound chips. It handles creating the missing audio codec
devices and works around various issues with missing addresses or
missing compatible properties.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Michel Dänzer <michel@daenzer.net>
Cc: Elimar Riesebieter <riesebie@lxtec.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/i2c/busses/i2c-powermac.c |  157 ++++++++++++++++++++++++++++++++------
 1 file changed, 133 insertions(+), 24 deletions(-)

--- a/drivers/i2c/busses/i2c-powermac.c
+++ b/drivers/i2c/busses/i2c-powermac.c
@@ -227,28 +227,138 @@ static int __devexit i2c_powermac_remove
 	return 0;
 }
 
+static u32 __devinit i2c_powermac_get_addr(struct i2c_adapter *adap,
+					   struct pmac_i2c_bus *bus,
+					   struct device_node *node)
+{
+	const __be32 *prop;
+	int len;
+
+	/* First check for valid "reg" */
+	prop = of_get_property(node, "reg", &len);
+	if (prop && (len >= sizeof(int)))
+		return (be32_to_cpup(prop) & 0xff) >> 1;
+
+	/* Then check old-style "i2c-address" */
+	prop = of_get_property(node, "i2c-address", &len);
+	if (prop && (len >= sizeof(int)))
+		return (be32_to_cpup(prop) & 0xff) >> 1;
+
+	/* Now handle some devices with missing "reg" properties */
+	if (!strcmp(node->name, "cereal"))
+		return 0x60;
+	else if (!strcmp(node->name, "deq"))
+		return 0x34;
+
+	dev_warn(&adap->dev, "No i2c address for %s\n", node->full_name);
+
+	return 0xffffffff;
+}
+
+static void __devinit i2c_powermac_create_one(struct i2c_adapter *adap,
+					      const char *type,
+					      u32 addr)
+{
+	struct i2c_board_info info = {};
+	struct i2c_client *newdev;
+
+	strncpy(info.type, type, sizeof(info.type));
+	info.addr = addr;
+	newdev = i2c_new_device(adap, &info);
+	if (!newdev)
+		dev_err(&adap->dev,
+			"i2c-powermac: Failure to register missing %s\n",
+			type);
+}
+
+static void __devinit i2c_powermac_add_missing(struct i2c_adapter *adap,
+					       struct pmac_i2c_bus *bus,
+					       bool found_onyx)
+{
+	struct device_node *busnode = pmac_i2c_get_bus_node(bus);
+	int rc;
+
+	/* Check for the onyx audio codec */
+#define ONYX_REG_CONTROL		67
+	if (of_device_is_compatible(busnode, "k2-i2c") && !found_onyx) {
+		union i2c_smbus_data data;
+
+		rc = i2c_smbus_xfer(adap, 0x46, 0, I2C_SMBUS_READ,
+				    ONYX_REG_CONTROL, I2C_SMBUS_BYTE_DATA,
+				    &data);
+		if (rc >= 0)
+			i2c_powermac_create_one(adap, "MAC,pcm3052", 0x46);
+
+		rc = i2c_smbus_xfer(adap, 0x47, 0, I2C_SMBUS_READ,
+				    ONYX_REG_CONTROL, I2C_SMBUS_BYTE_DATA,
+				    &data);
+		if (rc >= 0)
+			i2c_powermac_create_one(adap, "MAC,pcm3052", 0x47);
+	}
+}
+
+static bool __devinit i2c_powermac_get_type(struct i2c_adapter *adap,
+					    struct device_node *node,
+					    u32 addr, char *type, int type_size)
+{
+	char tmp[16];
+
+	/* Note: we to _NOT_ want the standard
+	 * i2c drivers to match with any of our powermac stuff
+	 * unless they have been specifically modified to handle
+	 * it on a case by case basis. For example, for thermal
+	 * control, things like lm75 etc... shall match with their
+	 * corresponding windfarm drivers, _NOT_ the generic ones,
+	 * so we force a prefix of AAPL, onto the modalias to
+	 * make that happen
+	 */
+
+	/* First try proper modalias */
+	if (of_modalias_node(node, tmp, sizeof(tmp)) >= 0) {
+		snprintf(type, type_size, "MAC,%s", tmp);
+		return true;
+	}
+
+	/* Now look for known workarounds */
+	if (!strcmp(node->name, "deq")) {
+		/* Apple uses address 0x34 for TAS3001 and 0x35 for TAS3004 */
+		if (addr == 0x34) {
+			snprintf(type, type_size, "MAC,tas3001");
+			return true;
+		} else if (addr == 0x35) {
+			snprintf(type, type_size, "MAC,tas3004");
+			return true;
+		}
+	}
+
+	dev_err(&adap->dev, "i2c-powermac: modalias failure"
+		" on %s\n", node->full_name);
+	return false;
+}
+
 static void __devinit i2c_powermac_register_devices(struct i2c_adapter *adap,
 						    struct pmac_i2c_bus *bus)
 {
 	struct i2c_client *newdev;
 	struct device_node *node;
+	bool found_onyx = 0;
+
+	/*
+	 * In some cases we end up with the via-pmu node itself, in this
+	 * case we skip this function completely as the device-tree will
+	 * not contain anything useful.
+	 */
+	if (!strcmp(adap->dev.of_node->name, "via-pmu"))
+		return;
 
 	for_each_child_of_node(adap->dev.of_node, node) {
 		struct i2c_board_info info = {};
-		struct dev_archdata dev_ad = {};
-		const __be32 *reg;
-		char tmp[16];
 		u32 addr;
-		int len;
 
 		/* Get address & channel */
-		reg = of_get_property(node, "reg", &len);
-		if (!reg || (len < sizeof(int))) {
-			dev_err(&adap->dev, "i2c-powermac: invalid reg on %s\n",
-				node->full_name);
+		addr = i2c_powermac_get_addr(adap, bus, node);
+		if (addr == 0xffffffff)
 			continue;
-		}
-		addr = be32_to_cpup(reg);
 
 		/* Multibus setup, check channel */
 		if (!pmac_i2c_match_adapter(node, adap))
@@ -257,27 +367,23 @@ static void __devinit i2c_powermac_regis
 		dev_dbg(&adap->dev, "i2c-powermac: register %s\n",
 			node->full_name);
 
-		/* Make up a modalias. Note: we to _NOT_ want the standard
-		 * i2c drivers to match with any of our powermac stuff
-		 * unless they have been specifically modified to handle
-		 * it on a case by case basis. For example, for thermal
-		 * control, things like lm75 etc... shall match with their
-		 * corresponding windfarm drivers, _NOT_ the generic ones,
-		 * so we force a prefix of AAPL, onto the modalias to
-		 * make that happen
+		/*
+		 * Keep track of some device existence to handle
+		 * workarounds later.
 		 */
-		if (of_modalias_node(node, tmp, sizeof(tmp)) < 0) {
-			dev_err(&adap->dev, "i2c-powermac: modalias failure"
-				" on %s\n", node->full_name);
+		if (of_device_is_compatible(node, "pcm3052"))
+			found_onyx = true;
+
+		/* Make up a modalias */
+		if (!i2c_powermac_get_type(adap, node, addr,
+					   info.type, sizeof(info.type))) {
 			continue;
 		}
-		snprintf(info.type, sizeof(info.type), "MAC,%s", tmp);
 
 		/* Fill out the rest of the info structure */
-		info.addr = (addr & 0xff) >> 1;
+		info.addr = addr;
 		info.irq = irq_of_parse_and_map(node, 0);
 		info.of_node = of_node_get(node);
-		info.archdata = &dev_ad;
 
 		newdev = i2c_new_device(adap, &info);
 		if (!newdev) {
@@ -292,6 +398,9 @@ static void __devinit i2c_powermac_regis
 			continue;
 		}
 	}
+
+	/* Additional workarounds */
+	i2c_powermac_add_missing(adap, bus, found_onyx);
 }
 
 static int __devinit i2c_powermac_probe(struct platform_device *dev)



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 242/262] sound/aoa: Adapt to new i2c probing scheme
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (240 preceding siblings ...)
  2012-09-28 18:52 ` [ 241/262] i2c/powermac: Improve detection of devices from device-tree Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 243/262] NFS: Fix Oopses in nfs_lookup_revalidate and nfs4_lookup_revalidate Greg Kroah-Hartman
                   ` (19 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Andreas Schwab, Benjamin Herrenschmidt,
	Elimar Riesebieter, Michel Dänzer

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andreas Schwab <schwab@linux-m68k.org>

commit 26b0d14106954ae46d2f4f7eec3481828a210f7d upstream.

The i2c-powermac driver now creates the i2c devices properly
from the device-tree, including workarounds for broken or
missing device-tree bits, so let's just use the normal probe
methods and get rid of the hand made device creation code.

Signed-off-by: Andreas Schwab <schwab@linux-m68k.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Elimar Riesebieter <riesebie@lxtec.de>
Cc: Michel Dänzer <michel@daenzer.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/aoa/codecs/onyx.c |   75 +--------------------------------------------
 sound/aoa/codecs/tas.c  |   80 +-----------------------------------------------
 2 files changed, 6 insertions(+), 149 deletions(-)

--- a/sound/aoa/codecs/onyx.c
+++ b/sound/aoa/codecs/onyx.c
@@ -997,45 +997,10 @@ static void onyx_exit_codec(struct aoa_c
 	onyx->codec.soundbus_dev->detach_codec(onyx->codec.soundbus_dev, onyx);
 }
 
-static int onyx_create(struct i2c_adapter *adapter,
-		       struct device_node *node,
-		       int addr)
-{
-	struct i2c_board_info info;
-	struct i2c_client *client;
-
-	memset(&info, 0, sizeof(struct i2c_board_info));
-	strlcpy(info.type, "aoa_codec_onyx", I2C_NAME_SIZE);
-	info.addr = addr;
-	info.platform_data = node;
-	client = i2c_new_device(adapter, &info);
-	if (!client)
-		return -ENODEV;
-
-	/*
-	 * We know the driver is already loaded, so the device should be
-	 * already bound. If not it means binding failed, which suggests
-	 * the device doesn't really exist and should be deleted.
-	 * Ideally this would be replaced by better checks _before_
-	 * instantiating the device.
-	 */
-	if (!client->driver) {
-		i2c_unregister_device(client);
-		return -ENODEV;
-	}
-
-	/*
-	 * Let i2c-core delete that device on driver removal.
-	 * This is safe because i2c-core holds the core_lock mutex for us.
-	 */
-	list_add_tail(&client->detected, &client->driver->clients);
-	return 0;
-}
-
 static int onyx_i2c_probe(struct i2c_client *client,
 			  const struct i2c_device_id *id)
 {
-	struct device_node *node = client->dev.platform_data;
+	struct device_node *node = client->dev.of_node;
 	struct onyx *onyx;
 	u8 dummy;
 
@@ -1071,40 +1036,6 @@ static int onyx_i2c_probe(struct i2c_cli
 	return -ENODEV;
 }
 
-static int onyx_i2c_attach(struct i2c_adapter *adapter)
-{
-	struct device_node *busnode, *dev = NULL;
-	struct pmac_i2c_bus *bus;
-
-	bus = pmac_i2c_adapter_to_bus(adapter);
-	if (bus == NULL)
-		return -ENODEV;
-	busnode = pmac_i2c_get_bus_node(bus);
-
-	while ((dev = of_get_next_child(busnode, dev)) != NULL) {
-		if (of_device_is_compatible(dev, "pcm3052")) {
-			const u32 *addr;
-			printk(KERN_DEBUG PFX "found pcm3052\n");
-			addr = of_get_property(dev, "reg", NULL);
-			if (!addr)
-				return -ENODEV;
-			return onyx_create(adapter, dev, (*addr)>>1);
-		}
-	}
-
-	/* if that didn't work, try desperate mode for older
-	 * machines that have stuff missing from the device tree */
-
-	if (!of_device_is_compatible(busnode, "k2-i2c"))
-		return -ENODEV;
-
-	printk(KERN_DEBUG PFX "found k2-i2c, checking if onyx chip is on it\n");
-	/* probe both possible addresses for the onyx chip */
-	if (onyx_create(adapter, NULL, 0x46) == 0)
-		return 0;
-	return onyx_create(adapter, NULL, 0x47);
-}
-
 static int onyx_i2c_remove(struct i2c_client *client)
 {
 	struct onyx *onyx = i2c_get_clientdata(client);
@@ -1117,16 +1048,16 @@ static int onyx_i2c_remove(struct i2c_cl
 }
 
 static const struct i2c_device_id onyx_i2c_id[] = {
-	{ "aoa_codec_onyx", 0 },
+	{ "MAC,pcm3052", 0 },
 	{ }
 };
+MODULE_DEVICE_TABLE(i2c,onyx_i2c_id);
 
 static struct i2c_driver onyx_driver = {
 	.driver = {
 		.name = "aoa_codec_onyx",
 		.owner = THIS_MODULE,
 	},
-	.attach_adapter = onyx_i2c_attach,
 	.probe = onyx_i2c_probe,
 	.remove = onyx_i2c_remove,
 	.id_table = onyx_i2c_id,
--- a/sound/aoa/codecs/tas.c
+++ b/sound/aoa/codecs/tas.c
@@ -883,43 +883,10 @@ static void tas_exit_codec(struct aoa_co
 }
 
 
-static int tas_create(struct i2c_adapter *adapter,
-		       struct device_node *node,
-		       int addr)
-{
-	struct i2c_board_info info;
-	struct i2c_client *client;
-
-	memset(&info, 0, sizeof(struct i2c_board_info));
-	strlcpy(info.type, "aoa_codec_tas", I2C_NAME_SIZE);
-	info.addr = addr;
-	info.platform_data = node;
-
-	client = i2c_new_device(adapter, &info);
-	if (!client)
-		return -ENODEV;
-	/*
-	 * We know the driver is already loaded, so the device should be
-	 * already bound. If not it means binding failed, and then there
-	 * is no point in keeping the device instantiated.
-	 */
-	if (!client->driver) {
-		i2c_unregister_device(client);
-		return -ENODEV;
-	}
-
-	/*
-	 * Let i2c-core delete that device on driver removal.
-	 * This is safe because i2c-core holds the core_lock mutex for us.
-	 */
-	list_add_tail(&client->detected, &client->driver->clients);
-	return 0;
-}
-
 static int tas_i2c_probe(struct i2c_client *client,
 			 const struct i2c_device_id *id)
 {
-	struct device_node *node = client->dev.platform_data;
+	struct device_node *node = client->dev.of_node;
 	struct tas *tas;
 
 	tas = kzalloc(sizeof(struct tas), GFP_KERNEL);
@@ -953,47 +920,6 @@ static int tas_i2c_probe(struct i2c_clie
 	return -EINVAL;
 }
 
-static int tas_i2c_attach(struct i2c_adapter *adapter)
-{
-	struct device_node *busnode, *dev = NULL;
-	struct pmac_i2c_bus *bus;
-
-	bus = pmac_i2c_adapter_to_bus(adapter);
-	if (bus == NULL)
-		return -ENODEV;
-	busnode = pmac_i2c_get_bus_node(bus);
-
-	while ((dev = of_get_next_child(busnode, dev)) != NULL) {
-		if (of_device_is_compatible(dev, "tas3004")) {
-			const u32 *addr;
-			printk(KERN_DEBUG PFX "found tas3004\n");
-			addr = of_get_property(dev, "reg", NULL);
-			if (!addr)
-				continue;
-			return tas_create(adapter, dev, ((*addr) >> 1) & 0x7f);
-		}
-		/* older machines have no 'codec' node with a 'compatible'
-		 * property that says 'tas3004', they just have a 'deq'
-		 * node without any such property... */
-		if (strcmp(dev->name, "deq") == 0) {
-			const u32 *_addr;
-			u32 addr;
-			printk(KERN_DEBUG PFX "found 'deq' node\n");
-			_addr = of_get_property(dev, "i2c-address", NULL);
-			if (!_addr)
-				continue;
-			addr = ((*_addr) >> 1) & 0x7f;
-			/* now, if the address doesn't match any of the two
-			 * that a tas3004 can have, we cannot handle this.
-			 * I doubt it ever happens but hey. */
-			if (addr != 0x34 && addr != 0x35)
-				continue;
-			return tas_create(adapter, dev, addr);
-		}
-	}
-	return -ENODEV;
-}
-
 static int tas_i2c_remove(struct i2c_client *client)
 {
 	struct tas *tas = i2c_get_clientdata(client);
@@ -1011,16 +937,16 @@ static int tas_i2c_remove(struct i2c_cli
 }
 
 static const struct i2c_device_id tas_i2c_id[] = {
-	{ "aoa_codec_tas", 0 },
+	{ "MAC,tas3004", 0 },
 	{ }
 };
+MODULE_DEVICE_TABLE(i2c,tas_i2c_id);
 
 static struct i2c_driver tas_driver = {
 	.driver = {
 		.name = "aoa_codec_tas",
 		.owner = THIS_MODULE,
 	},
-	.attach_adapter = tas_i2c_attach,
 	.probe = tas_i2c_probe,
 	.remove = tas_i2c_remove,
 	.id_table = tas_i2c_id,



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 243/262] NFS: Fix Oopses in nfs_lookup_revalidate and nfs4_lookup_revalidate
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (241 preceding siblings ...)
  2012-09-28 18:52 ` [ 242/262] sound/aoa: Adapt to new i2c probing scheme Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-11-03 20:12   ` Myklebust, Trond
  2012-09-28 18:52 ` [ 244/262] net: qmi_wwan: add ZTE MF821D Greg Kroah-Hartman
                   ` (18 subsequent siblings)
  261 siblings, 1 reply; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Richard Ems, Trond Myklebust

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Trond Myklebust <Trond.Myklebust@netapp.com>

[Fixed upstream as part of 0b728e1911c, but that's a much larger patch,
this is only the nfs portion backported as needed.]

Fix the following Oops in 3.5.1:

 BUG: unable to handle kernel NULL pointer dereference at 0000000000000038
 IP: [<ffffffffa03789cd>] nfs_lookup_revalidate+0x2d/0x480 [nfs]
 PGD 337c63067 PUD 0
 Oops: 0000 [#1] SMP
 CPU 5
 Modules linked in: nfs fscache nfsd lockd nfs_acl auth_rpcgss sunrpc af_packet binfmt_misc cpufreq_conservative cpufreq_userspace cpufreq_powersave dm_mod acpi_cpufreq mperf coretemp gpio_ich kvm_intel joydev kvm ioatdma hid_generic igb lpc_ich i7core_edac edac_core ptp serio_raw dca pcspkr i2c_i801 mfd_core sg pps_core usbhid crc32c_intel microcode button autofs4 uhci_hcd ttm drm_kms_helper drm i2c_algo_bit sysimgblt sysfillrect syscopyarea ehci_hcd usbcore usb_common scsi_dh_rdac scsi_dh_emc scsi_dh_hp_sw scsi_dh_alua scsi_dh edd fan ata_piix thermal processor thermal_sys

 Pid: 30431, comm: java Not tainted 3.5.1-2-default #1 Supermicro X8DTT/X8DTT
 RIP: 0010:[<ffffffffa03789cd>]  [<ffffffffa03789cd>] nfs_lookup_revalidate+0x2d/0x480 [nfs]
 RSP: 0018:ffff8801b418bd38  EFLAGS: 00010292
 RAX: 00000000fffffff6 RBX: ffff88032016d800 RCX: 0000000000000020
 RDX: ffffffff00000000 RSI: 0000000000000000 RDI: ffff8801824a7b00
 RBP: ffff8801b418bdf8 R08: 7fffff0034323030 R09: fffffffff04c03ed
 R10: ffff8801824a7b00 R11: 0000000000000002 R12: ffff8801824a7b00
 R13: ffff8801824a7b00 R14: 0000000000000000 R15: ffff8803201725d0
 FS:  00002b53a46cb700(0000) GS:ffff88033fc20000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 0000000000000038 CR3: 000000020a426000 CR4: 00000000000007e0
 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
 Process java (pid: 30431, threadinfo ffff8801b418a000, task ffff8801b5d20600)
 Stack:
  ffff8801b418be44 ffff88032016d800 ffff8801b418bdf8 0000000000000000
  ffff8801824a7b00 ffff8801b418bdd7 ffff8803201725d0 ffffffff8116a9c0
  ffff8801b5c38dc0 0000000000000007 ffff88032016d800 0000000000000000
 Call Trace:
  [<ffffffff8116a9c0>] lookup_dcache+0x80/0xe0
  [<ffffffff8116aa43>] __lookup_hash+0x23/0x90
  [<ffffffff8116b4a5>] lookup_one_len+0xc5/0x100
  [<ffffffffa03869a3>] nfs_sillyrename+0xe3/0x210 [nfs]
  [<ffffffff8116cadf>] vfs_unlink.part.25+0x7f/0xe0
  [<ffffffff8116f22c>] do_unlinkat+0x1ac/0x1d0
  [<ffffffff815717b9>] system_call_fastpath+0x16/0x1b
  [<00002b5348b5f527>] 0x2b5348b5f526
 Code: ec 38 b8 f6 ff ff ff 4c 89 64 24 18 4c 89 74 24 28 49 89 fc 48 89 5c 24 08 48 89 6c 24 10 49 89 f6 4c 89 6c 24 20 4c 89 7c 24 30 <f6> 46 38 40 0f 85 d1 00 00 00 e8 c4 c4 df e0 48 8b 58 30 49 89
 RIP  [<ffffffffa03789cd>] nfs_lookup_revalidate+0x2d/0x480 [nfs]
  RSP <ffff8801b418bd38>
 CR2: 0000000000000038
 ---[ end trace 845113ed191985dd ]---

This Oops affects 3.5 kernels and older, and is due to lookup_one_len()
calling down to the dentry revalidation code with a NULL pointer
to struct nameidata.

It is fixed upstream by commit 0b728e1911c (stop passing nameidata *
to ->d_revalidate())

Reported-by: Richard Ems <richard.ems@cape-horn-eng.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfs/dir.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1123,7 +1123,7 @@ static int nfs_lookup_revalidate(struct
 	struct nfs_fattr *fattr = NULL;
 	int error;
 
-	if (nd->flags & LOOKUP_RCU)
+	if (nd && (nd->flags & LOOKUP_RCU))
 		return -ECHILD;
 
 	parent = dget_parent(dentry);
@@ -1526,7 +1526,7 @@ static int nfs4_lookup_revalidate(struct
 	struct inode *dir;
 	int openflags, ret = 0;
 
-	if (nd->flags & LOOKUP_RCU)
+	if (nd && (nd->flags & LOOKUP_RCU))
 		return -ECHILD;
 
 	inode = dentry->d_inode;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 244/262] net: qmi_wwan: add ZTE MF821D
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (242 preceding siblings ...)
  2012-09-28 18:52 ` [ 243/262] NFS: Fix Oopses in nfs_lookup_revalidate and nfs4_lookup_revalidate Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 245/262] net: qmi_wwan: add Sierra Wireless devices Greg Kroah-Hartman
                   ` (17 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Thomas Schäfer, Bjørn Mork, David S. Miller

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bjørn Mork <bjorn@mork.no>

commit db8dacf953a70274172236957a4b97d4fdb376f0 upstream.

Sold by O2 (telefonica germany) under the name "LTE4G"

Tested-by: Thomas Schäfer <tschaefer@t-online.de>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/usb/qmi_wwan.c |    9 +++++++++
 1 file changed, 9 insertions(+)

--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -453,6 +453,15 @@ static const struct usb_device_id produc
 		.bInterfaceProtocol = 0xff,
 		.driver_info        = (unsigned long)&qmi_wwan_force_int4,
 	},
+	{	/* ZTE MF821D */
+		.match_flags        = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
+		.idVendor           = 0x19d2,
+		.idProduct          = 0x0326,
+		.bInterfaceClass    = 0xff,
+		.bInterfaceSubClass = 0xff,
+		.bInterfaceProtocol = 0xff,
+		.driver_info        = (unsigned long)&qmi_wwan_force_int4,
+	},
 	{	/* ZTE (Vodafone) K3520-Z */
 		.match_flags	    = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
 		.idVendor           = 0x19d2,



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 245/262] net: qmi_wwan: add Sierra Wireless devices
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (243 preceding siblings ...)
  2012-09-28 18:52 ` [ 244/262] net: qmi_wwan: add ZTE MF821D Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 246/262] net: qmi_wwan: new devices: UML290 and K5006-Z Greg Kroah-Hartman
                   ` (16 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Bj�rn Mork, David S. Miller

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=UTF-8, Size: 4277 bytes --]

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bjørn Mork <bjorn@mork.no>

commit 9b469a60d68b13c288d5c3fc23de29d9d482dbe6 upstream.

Add 6 new devices and one modified device, based on
information from laptop vendor Windows drivers.

Sony provides a driver with two new devices using
a Gobi 2k+ layout (1199:68a5 and 1199:68a9).  The
Sony driver also adds a non-standard QMI/net
interface to the already supported 1199:9011
Gobi device. We do not know whether this is an
alternate interface number or an additional
interface which might be present, but that doesn't
really matter.

Lenovo provides a driver supporting 4 new devices:
 - MC7770 (1199:901b) with standard Gobi 2k+ layout
 - MC7700 (0f3d:68a2) with layout similar to MC7710
 - MC7750 (114f:68a2) with layout similar to MC7710
 - EM7700 (1199:901c) with layout similar to MC7710

Note regaring the three devices similar to MC7710:

The Windows drivers only support interface #8 on these
devices.  The MC7710 can support QMI/net functions on
interface #19 and #20 as well, and this driver is
verified to work on interface #19 (a firmware bug is
suspected to prevent #20 from working).

We do not enable these additional interfaces until they
either show up in a Windows driver or are verified to
work in some other way.  Therefore limiting the new
devices to interface #8 for now.

[bmork: backported to 3.4: use driver whitelisting]
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
for stable: v3.4 and v3.5

 drivers/net/usb/qmi_wwan.c |   31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -534,6 +534,33 @@ static const struct usb_device_id produc
 		.bInterfaceProtocol = 0xff,
 		.driver_info        = (unsigned long)&qmi_wwan_sierra,
 	},
+	{	/* Sierra Wireless MC7700 */
+		.match_flags	    = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
+		.idVendor           = 0x0f3d,
+		.idProduct          = 0x68a2,
+		.bInterfaceClass    = 0xff,
+		.bInterfaceSubClass = 0xff,
+		.bInterfaceProtocol = 0xff,
+		.driver_info        = (unsigned long)&qmi_wwan_sierra,
+	},
+	{	/* Sierra Wireless MC7750 */
+		.match_flags	    = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
+		.idVendor           = 0x114f,
+		.idProduct          = 0x68a2,
+		.bInterfaceClass    = 0xff,
+		.bInterfaceSubClass = 0xff,
+		.bInterfaceProtocol = 0xff,
+		.driver_info        = (unsigned long)&qmi_wwan_sierra,
+	},
+	{	/* Sierra Wireless EM7700 */
+		.match_flags	    = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
+		.idVendor           = 0x1199,
+		.idProduct          = 0x901c,
+		.bInterfaceClass    = 0xff,
+		.bInterfaceSubClass = 0xff,
+		.bInterfaceProtocol = 0xff,
+		.driver_info        = (unsigned long)&qmi_wwan_sierra,
+	},
 
 	/* Gobi 1000 devices */
 	{QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},	/* Acer Gobi Modem Device */
@@ -561,6 +588,8 @@ static const struct usb_device_id produc
 	{QMI_GOBI_DEVICE(0x05c6, 0x9265)},	/* Asus Gobi 2000 Modem device (VR305) */
 	{QMI_GOBI_DEVICE(0x05c6, 0x9235)},	/* Top Global Gobi 2000 Modem device (VR306) */
 	{QMI_GOBI_DEVICE(0x05c6, 0x9275)},	/* iRex Technologies Gobi 2000 Modem device (VR307) */
+	{QMI_GOBI_DEVICE(0x1199, 0x68a5)},	/* Sierra Wireless Modem */
+	{QMI_GOBI_DEVICE(0x1199, 0x68a9)},	/* Sierra Wireless Modem */
 	{QMI_GOBI_DEVICE(0x1199, 0x9001)},	/* Sierra Wireless Gobi 2000 Modem device (VT773) */
 	{QMI_GOBI_DEVICE(0x1199, 0x9002)},	/* Sierra Wireless Gobi 2000 Modem device (VT773) */
 	{QMI_GOBI_DEVICE(0x1199, 0x9003)},	/* Sierra Wireless Gobi 2000 Modem device (VT773) */
@@ -577,6 +606,8 @@ static const struct usb_device_id produc
 	{QMI_GOBI_DEVICE(0x1199, 0x9013)},	/* Sierra Wireless Gobi 3000 Modem device (MC8355) */
 	{QMI_GOBI_DEVICE(0x1199, 0x9015)},	/* Sierra Wireless Gobi 3000 Modem device */
 	{QMI_GOBI_DEVICE(0x1199, 0x9019)},	/* Sierra Wireless Gobi 3000 Modem device */
+	{QMI_GOBI_DEVICE(0x1199, 0x901b)},	/* Sierra Wireless MC7770 */
+
 	{ }					/* END */
 };
 MODULE_DEVICE_TABLE(usb, products);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 246/262] net: qmi_wwan: new devices: UML290 and K5006-Z
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (244 preceding siblings ...)
  2012-09-28 18:52 ` [ 245/262] net: qmi_wwan: add Sierra Wireless devices Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 247/262] irq_remap: disable IRQ remapping if any IOAPIC lacks an IOMMU Greg Kroah-Hartman
                   ` (15 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Bj�rn Mork, Dan Williams,
	Thomas Sch�fer, David S. Miller

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=UTF-8, Size: 2163 bytes --]

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bjørn Mork <bjorn@mork.no>

commit 10cbc1d97a7c7f9ae862fffe27b771ef0da9c461 upstream.

Newer firmware versions for the Pantech UML290 use a different
subclass ID.  The Windows driver match on both IDs, so we do
that as well.

The ZTE (Vodafone) K5006-Z is a new device.

Signed-off-by: Bjørn Mork <bjorn@mork.no>
Cc: Dan Williams <dcbw@redhat.com>
Cc: Thomas Schäfer <tschaefer@t-online.de>
[bmork: backported to 3.4: use driver whitelisting]
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
for stable: v3.4 and v3.5

 drivers/net/usb/qmi_wwan.c |   18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -444,6 +444,15 @@ static const struct usb_device_id produc
 		.bInterfaceProtocol = 0xff,
 		.driver_info        = (unsigned long)&qmi_wwan_shared,
 	},
+	{	/* Pantech UML290 - newer firmware */
+		.match_flags	    = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
+		.idVendor           = 0x106c,
+		.idProduct          = 0x3718,
+		.bInterfaceClass    = 0xff,
+		.bInterfaceSubClass = 0xf1,
+		.bInterfaceProtocol = 0xff,
+		.driver_info        = (unsigned long)&qmi_wwan_shared,
+	},
 	{	/* ZTE MF820D */
 		.match_flags	    = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
 		.idVendor           = 0x19d2,
@@ -516,6 +525,15 @@ static const struct usb_device_id produc
 		.bInterfaceProtocol = 0xff,
 		.driver_info        = (unsigned long)&qmi_wwan_force_int4,
 	},
+	{	/* ZTE (Vodafone) K5006-Z */
+		.match_flags	    = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
+		.idVendor           = 0x19d2,
+		.idProduct          = 0x1018,
+		.bInterfaceClass    = 0xff,
+		.bInterfaceSubClass = 0xff,
+		.bInterfaceProtocol = 0xff,
+		.driver_info        = (unsigned long)&qmi_wwan_force_int3,
+	},
 	{	/* ZTE MF60 */
 		.match_flags	    = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
 		.idVendor           = 0x19d2,



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 247/262] irq_remap: disable IRQ remapping if any IOAPIC lacks an IOMMU
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (245 preceding siblings ...)
  2012-09-28 18:52 ` [ 246/262] net: qmi_wwan: new devices: UML290 and K5006-Z Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 248/262] NFSd: introduce nfsd_destroy() helper Greg Kroah-Hartman
                   ` (14 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Suresh Siddha, Seth Forshee, Yinghai Lu,
	Joerg Roedel, Cho, Yu-Chen

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Seth Forshee <seth.forshee@canonical.com>

commit 32ab31e01e2def6f48294d872d9bb42573aae00f upstream.

The ACPI tables in the Macbook Air 5,1 define a single IOAPIC with id 2,
but the only remapping unit described in the DMAR table matches id 0.
Interrupt remapping fails as a result, and the kernel panics with the
message "timer doesn't work through Interrupt-remapped IO-APIC."

To fix this, check each IOAPIC for a corresponding IOMMU. If an IOMMU is
not found, do not allow IRQ remapping to be enabled.

v2: Move check to parse_ioapics_under_ir(), raise log level to KERN_ERR,
    and add FW_BUG to the log message
v3: Skip check if IOMMU doesn't support interrupt remapping and remove
    existing check that the IOMMU count equals the IOAPIC count

Acked-by: Suresh Siddha <suresh.b.siddha@intel.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Acked-by: Yinghai Lu <yinghai@kernel.org>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Acked-by: Cho, Yu-Chen <acho@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iommu/intel_irq_remapping.c |   18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

--- a/drivers/iommu/intel_irq_remapping.c
+++ b/drivers/iommu/intel_irq_remapping.c
@@ -736,6 +736,7 @@ int __init parse_ioapics_under_ir(void)
 {
 	struct dmar_drhd_unit *drhd;
 	int ir_supported = 0;
+	int ioapic_idx;
 
 	for_each_drhd_unit(drhd) {
 		struct intel_iommu *iommu = drhd->iommu;
@@ -748,13 +749,20 @@ int __init parse_ioapics_under_ir(void)
 		}
 	}
 
-	if (ir_supported && ir_ioapic_num != nr_ioapics) {
-		printk(KERN_WARNING
-		       "Not all IO-APIC's listed under remapping hardware\n");
-		return -1;
+	if (!ir_supported)
+		return 0;
+
+	for (ioapic_idx = 0; ioapic_idx < nr_ioapics; ioapic_idx++) {
+		int ioapic_id = mpc_ioapic_id(ioapic_idx);
+		if (!map_ioapic_to_ir(ioapic_id)) {
+			pr_err(FW_BUG "ioapic %d has no mapping iommu, "
+			       "interrupt remapping will be disabled\n",
+			       ioapic_id);
+			return -1;
+		}
 	}
 
-	return ir_supported;
+	return 1;
 }
 
 int __init ir_dev_scope_init(void)



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 248/262] NFSd: introduce nfsd_destroy() helper
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (246 preceding siblings ...)
  2012-09-28 18:52 ` [ 247/262] irq_remap: disable IRQ remapping if any IOAPIC lacks an IOMMU Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 249/262] NFSd: set nfsd_serv to NULL after service destruction Greg Kroah-Hartman
                   ` (13 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Stanislav Kinsbursky, J. Bruce Fields

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stanislav Kinsbursky <skinsbursky@parallels.com>

commit 19f7e2ca44dfc3c1b3f499fc46801f98d403500f upstream.

Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nfsd/nfsctl.c |    8 ++------
 fs/nfsd/nfsd.h   |    9 +++++++++
 fs/nfsd/nfssvc.c |   14 +++-----------
 3 files changed, 14 insertions(+), 17 deletions(-)

--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -673,9 +673,7 @@ static ssize_t __write_ports_addfd(char
 
 	err = svc_addsock(nfsd_serv, fd, buf, SIMPLE_TRANSACTION_LIMIT);
 	if (err < 0) {
-		if (nfsd_serv->sv_nrthreads == 1)
-			svc_shutdown_net(nfsd_serv, net);
-		svc_destroy(nfsd_serv);
+		nfsd_destroy(net);
 		return err;
 	}
 
@@ -744,9 +742,7 @@ out_close:
 		svc_xprt_put(xprt);
 	}
 out_err:
-	if (nfsd_serv->sv_nrthreads == 1)
-		svc_shutdown_net(nfsd_serv, net);
-	svc_destroy(nfsd_serv);
+	nfsd_destroy(net);
 	return err;
 }
 
--- a/fs/nfsd/nfsd.h
+++ b/fs/nfsd/nfsd.h
@@ -73,6 +73,15 @@ int		nfsd_nrpools(void);
 int		nfsd_get_nrthreads(int n, int *);
 int		nfsd_set_nrthreads(int n, int *);
 
+static inline void nfsd_destroy(struct net *net)
+{
+	int destroy = (nfsd_serv->sv_nrthreads == 1);
+
+	if (destroy)
+		svc_shutdown_net(nfsd_serv, net);
+	svc_destroy(nfsd_serv);
+}
+
 #if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL)
 #ifdef CONFIG_NFSD_V2_ACL
 extern struct svc_version nfsd_acl_version2;
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -427,11 +427,7 @@ int nfsd_set_nrthreads(int n, int *nthre
 		if (err)
 			break;
 	}
-
-	if (nfsd_serv->sv_nrthreads == 1)
-		svc_shutdown_net(nfsd_serv, net);
-	svc_destroy(nfsd_serv);
-
+	nfsd_destroy(net);
 	return err;
 }
 
@@ -478,9 +474,7 @@ out_shutdown:
 	if (error < 0 && !nfsd_up_before)
 		nfsd_shutdown();
 out_destroy:
-	if (nfsd_serv->sv_nrthreads == 1)
-		svc_shutdown_net(nfsd_serv, net);
-	svc_destroy(nfsd_serv);		/* Release server */
+	nfsd_destroy(net);		/* Release server */
 out:
 	mutex_unlock(&nfsd_mutex);
 	return error;
@@ -682,9 +676,7 @@ int nfsd_pool_stats_release(struct inode
 
 	mutex_lock(&nfsd_mutex);
 	/* this function really, really should have been called svc_put() */
-	if (nfsd_serv->sv_nrthreads == 1)
-		svc_shutdown_net(nfsd_serv, net);
-	svc_destroy(nfsd_serv);
+	nfsd_destroy(net);
 	mutex_unlock(&nfsd_mutex);
 	return ret;
 }



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 249/262] NFSd: set nfsd_serv to NULL after service destruction
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (247 preceding siblings ...)
  2012-09-28 18:52 ` [ 248/262] NFSd: introduce nfsd_destroy() helper Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:52 ` [ 250/262] kthread_worker: reorganize to prepare for flush_kthread_work() reimplementation Greg Kroah-Hartman
                   ` (12 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Stanislav Kinsbursky, J. Bruce Fields

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stanislav Kinsbursky <skinsbursky@parallels.com>

commit 57c8b13e3cd0f94944c9691ce7f58e5fcef8a12d upstream.

In nfsd_destroy():

	if (destroy)
		svc_shutdown_net(nfsd_serv, net);
	svc_destroy(nfsd_server);

svc_shutdown_net(nfsd_serv, net) calls nfsd_last_thread(), which sets
nfsd_serv to NULL, causing a NULL dereference on the following line.

Signed-off-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nfsd/nfsd.h   |    2 ++
 fs/nfsd/nfssvc.c |   10 +++++-----
 2 files changed, 7 insertions(+), 5 deletions(-)

--- a/fs/nfsd/nfsd.h
+++ b/fs/nfsd/nfsd.h
@@ -80,6 +80,8 @@ static inline void nfsd_destroy(struct n
 	if (destroy)
 		svc_shutdown_net(nfsd_serv, net);
 	svc_destroy(nfsd_serv);
+	if (destroy)
+		nfsd_serv = NULL;
 }
 
 #if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL)
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -254,8 +254,6 @@ static void nfsd_shutdown(void)
 
 static void nfsd_last_thread(struct svc_serv *serv, struct net *net)
 {
-	/* When last nfsd thread exits we need to do some clean-up */
-	nfsd_serv = NULL;
 	nfsd_shutdown();
 
 	svc_rpcb_cleanup(serv, net);
@@ -332,6 +330,7 @@ static int nfsd_get_default_max_blksize(
 int nfsd_create_serv(void)
 {
 	int error;
+	struct net *net = current->nsproxy->net_ns;
 
 	WARN_ON(!mutex_is_locked(&nfsd_mutex));
 	if (nfsd_serv) {
@@ -346,7 +345,7 @@ int nfsd_create_serv(void)
 	if (nfsd_serv == NULL)
 		return -ENOMEM;
 
-	error = svc_bind(nfsd_serv, current->nsproxy->net_ns);
+	error = svc_bind(nfsd_serv, net);
 	if (error < 0) {
 		svc_destroy(nfsd_serv);
 		return error;
@@ -557,12 +556,13 @@ nfsd(void *vrqstp)
 	nfsdstats.th_cnt --;
 
 out:
-	if (rqstp->rq_server->sv_nrthreads == 1)
-		svc_shutdown_net(rqstp->rq_server, &init_net);
+	rqstp->rq_server = NULL;
 
 	/* Release the thread */
 	svc_exit_thread(rqstp);
 
+	nfsd_destroy(&init_net);
+
 	/* Release module */
 	mutex_unlock(&nfsd_mutex);
 	module_put_and_exit(0);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 250/262] kthread_worker: reorganize to prepare for flush_kthread_work() reimplementation
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (248 preceding siblings ...)
  2012-09-28 18:52 ` [ 249/262] NFSd: set nfsd_serv to NULL after service destruction Greg Kroah-Hartman
@ 2012-09-28 18:52 ` Greg Kroah-Hartman
  2012-09-28 18:53 ` [ 251/262] kthread_worker: reimplement flush_kthread_work() to allow freeing the work item being executed Greg Kroah-Hartman
                   ` (11 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:52 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Tejun Heo, Andy Walls, Colin Cross

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tejun Heo <tj@kernel.org>

commit 9a2e03d8ed518a61154f18d83d6466628e519f94 upstream.

Make the following two non-functional changes.

* Separate out insert_kthread_work() from queue_kthread_work().

* Relocate struct kthread_flush_work and kthread_flush_work_fn()
  definitions above flush_kthread_work().

v2: Added lockdep_assert_held() in insert_kthread_work() as suggested
    by Andy Walls.

Signed-off-by: Tejun Heo <tj@kernel.org>
Acked-by: Andy Walls <awalls@md.metrocast.net>
Cc: Colin Cross <ccross@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/kthread.c |   42 ++++++++++++++++++++++++++----------------
 1 file changed, 26 insertions(+), 16 deletions(-)

--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -378,6 +378,19 @@ repeat:
 }
 EXPORT_SYMBOL_GPL(kthread_worker_fn);
 
+/* insert @work before @pos in @worker */
+static void insert_kthread_work(struct kthread_worker *worker,
+			       struct kthread_work *work,
+			       struct list_head *pos)
+{
+	lockdep_assert_held(&worker->lock);
+
+	list_add_tail(&work->node, pos);
+	work->queue_seq++;
+	if (likely(worker->task))
+		wake_up_process(worker->task);
+}
+
 /**
  * queue_kthread_work - queue a kthread_work
  * @worker: target kthread_worker
@@ -395,10 +408,7 @@ bool queue_kthread_work(struct kthread_w
 
 	spin_lock_irqsave(&worker->lock, flags);
 	if (list_empty(&work->node)) {
-		list_add_tail(&work->node, &worker->work_list);
-		work->queue_seq++;
-		if (likely(worker->task))
-			wake_up_process(worker->task);
+		insert_kthread_work(worker, work, &worker->work_list);
 		ret = true;
 	}
 	spin_unlock_irqrestore(&worker->lock, flags);
@@ -406,6 +416,18 @@ bool queue_kthread_work(struct kthread_w
 }
 EXPORT_SYMBOL_GPL(queue_kthread_work);
 
+struct kthread_flush_work {
+	struct kthread_work	work;
+	struct completion	done;
+};
+
+static void kthread_flush_work_fn(struct kthread_work *work)
+{
+	struct kthread_flush_work *fwork =
+		container_of(work, struct kthread_flush_work, work);
+	complete(&fwork->done);
+}
+
 /**
  * flush_kthread_work - flush a kthread_work
  * @work: work to flush
@@ -436,18 +458,6 @@ void flush_kthread_work(struct kthread_w
 }
 EXPORT_SYMBOL_GPL(flush_kthread_work);
 
-struct kthread_flush_work {
-	struct kthread_work	work;
-	struct completion	done;
-};
-
-static void kthread_flush_work_fn(struct kthread_work *work)
-{
-	struct kthread_flush_work *fwork =
-		container_of(work, struct kthread_flush_work, work);
-	complete(&fwork->done);
-}
-
 /**
  * flush_kthread_worker - flush all current works on a kthread_worker
  * @worker: worker to flush



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 251/262] kthread_worker: reimplement flush_kthread_work() to allow freeing the work item being executed
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (249 preceding siblings ...)
  2012-09-28 18:52 ` [ 250/262] kthread_worker: reorganize to prepare for flush_kthread_work() reimplementation Greg Kroah-Hartman
@ 2012-09-28 18:53 ` Greg Kroah-Hartman
  2012-09-28 18:53 ` [ 252/262] usb: chipidea: udc: fix error path in udc_start() Greg Kroah-Hartman
                   ` (10 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:53 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Tejun Heo, Colin Cross

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tejun Heo <tj@kernel.org>

commit 46f3d976213452350f9d10b0c2780c2681f7075b upstream.

kthread_worker provides minimalistic workqueue-like interface for
users which need a dedicated worker thread (e.g. for realtime
priority).  It has basic queue, flush_work, flush_worker operations
which mostly match the workqueue counterparts; however, due to the way
flush_work() is implemented, it has a noticeable difference of not
allowing work items to be freed while being executed.

While the current users of kthread_worker are okay with the current
behavior, the restriction does impede some valid use cases.  Also,
removing this difference isn't difficult and actually makes the code
easier to understand.

This patch reimplements flush_kthread_work() such that it uses a
flush_work item instead of queue/done sequence numbers.

Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Colin Cross <ccross@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/kthread.h |    8 +------
 kernel/kthread.c        |   52 ++++++++++++++++++++++++++----------------------
 2 files changed, 31 insertions(+), 29 deletions(-)

--- a/include/linux/kthread.h
+++ b/include/linux/kthread.h
@@ -49,8 +49,6 @@ extern int tsk_fork_get_node(struct task
  * can be queued and flushed using queue/flush_kthread_work()
  * respectively.  Queued kthread_works are processed by a kthread
  * running kthread_worker_fn().
- *
- * A kthread_work can't be freed while it is executing.
  */
 struct kthread_work;
 typedef void (*kthread_work_func_t)(struct kthread_work *work);
@@ -59,15 +57,14 @@ struct kthread_worker {
 	spinlock_t		lock;
 	struct list_head	work_list;
 	struct task_struct	*task;
+	struct kthread_work	*current_work;
 };
 
 struct kthread_work {
 	struct list_head	node;
 	kthread_work_func_t	func;
 	wait_queue_head_t	done;
-	atomic_t		flushing;
-	int			queue_seq;
-	int			done_seq;
+	struct kthread_worker	*worker;
 };
 
 #define KTHREAD_WORKER_INIT(worker)	{				\
@@ -79,7 +76,6 @@ struct kthread_work {
 	.node = LIST_HEAD_INIT((work).node),				\
 	.func = (fn),							\
 	.done = __WAIT_QUEUE_HEAD_INITIALIZER((work).done),		\
-	.flushing = ATOMIC_INIT(0),					\
 	}
 
 #define DEFINE_KTHREAD_WORKER(worker)					\
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -360,16 +360,12 @@ repeat:
 					struct kthread_work, node);
 		list_del_init(&work->node);
 	}
+	worker->current_work = work;
 	spin_unlock_irq(&worker->lock);
 
 	if (work) {
 		__set_current_state(TASK_RUNNING);
 		work->func(work);
-		smp_wmb();	/* wmb worker-b0 paired with flush-b1 */
-		work->done_seq = work->queue_seq;
-		smp_mb();	/* mb worker-b1 paired with flush-b0 */
-		if (atomic_read(&work->flushing))
-			wake_up_all(&work->done);
 	} else if (!freezing(current))
 		schedule();
 
@@ -386,7 +382,7 @@ static void insert_kthread_work(struct k
 	lockdep_assert_held(&worker->lock);
 
 	list_add_tail(&work->node, pos);
-	work->queue_seq++;
+	work->worker = worker;
 	if (likely(worker->task))
 		wake_up_process(worker->task);
 }
@@ -436,25 +432,35 @@ static void kthread_flush_work_fn(struct
  */
 void flush_kthread_work(struct kthread_work *work)
 {
-	int seq = work->queue_seq;
+	struct kthread_flush_work fwork = {
+		KTHREAD_WORK_INIT(fwork.work, kthread_flush_work_fn),
+		COMPLETION_INITIALIZER_ONSTACK(fwork.done),
+	};
+	struct kthread_worker *worker;
+	bool noop = false;
+
+retry:
+	worker = work->worker;
+	if (!worker)
+		return;
+
+	spin_lock_irq(&worker->lock);
+	if (work->worker != worker) {
+		spin_unlock_irq(&worker->lock);
+		goto retry;
+	}
+
+	if (!list_empty(&work->node))
+		insert_kthread_work(worker, &fwork.work, work->node.next);
+	else if (worker->current_work == work)
+		insert_kthread_work(worker, &fwork.work, worker->work_list.next);
+	else
+		noop = true;
 
-	atomic_inc(&work->flushing);
+	spin_unlock_irq(&worker->lock);
 
-	/*
-	 * mb flush-b0 paired with worker-b1, to make sure either
-	 * worker sees the above increment or we see done_seq update.
-	 */
-	smp_mb__after_atomic_inc();
-
-	/* A - B <= 0 tests whether B is in front of A regardless of overflow */
-	wait_event(work->done, seq - work->done_seq <= 0);
-	atomic_dec(&work->flushing);
-
-	/*
-	 * rmb flush-b1 paired with worker-b0, to make sure our caller
-	 * sees every change made by work->func().
-	 */
-	smp_mb__after_atomic_dec();
+	if (!noop)
+		wait_for_completion(&fwork.done);
 }
 EXPORT_SYMBOL_GPL(flush_kthread_work);
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 252/262] usb: chipidea: udc: fix error path in udc_start()
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (250 preceding siblings ...)
  2012-09-28 18:53 ` [ 251/262] kthread_worker: reimplement flush_kthread_work() to allow freeing the work item being executed Greg Kroah-Hartman
@ 2012-09-28 18:53 ` Greg Kroah-Hartman
  2012-09-28 18:53 ` [ 253/262] usb: chipidea: cleanup dma_pool if udc_start() fails Greg Kroah-Hartman
                   ` (9 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:53 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Richard Zhao, Marc Kleine-Budde, Alexander Shishkin

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marc Kleine-Budde <mkl@pengutronix.de>

commit c9d1f947a85e38b6dded469470c95ed62430cb3f upstream.

This patch fixes the error path of udc_start(). Now NULL is used to
unset the peripheral with otg_set_peripheral().

Cc: stable <stable@vger.kernel.org>
Reviewed-by: Richard Zhao <richard.zhao@freescale.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/chipidea/udc.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -1747,7 +1747,7 @@ static int udc_start(struct ci13xxx *udc
 
 remove_trans:
 	if (udc->transceiver) {
-		otg_set_peripheral(udc->transceiver->otg, &udc->gadget);
+		otg_set_peripheral(udc->transceiver->otg, NULL);
 		usb_put_transceiver(udc->transceiver);
 	}
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 253/262] usb: chipidea: cleanup dma_pool if udc_start() fails
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (251 preceding siblings ...)
  2012-09-28 18:53 ` [ 252/262] usb: chipidea: udc: fix error path in udc_start() Greg Kroah-Hartman
@ 2012-09-28 18:53 ` Greg Kroah-Hartman
  2012-09-28 18:53 ` [ 254/262] USB: ohci-at91: fix null pointer in ohci_hcd_at91_overcurrent_irq Greg Kroah-Hartman
                   ` (8 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:53 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Richard Zhao, Marc Kleine-Budde, Alexander Shishkin

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marc Kleine-Budde <mkl@pengutronix.de>

commit ad6b1b97fe8504957d017cd6e4168cac8903d3f3 upstream.

If udc_start() fails the qh_pool dma-pool cannot be closed because
it's still in use. This patch factors out the dma_pool_free() loop
into destroy_eps() and calls it in the error path of udc_start(),
too.

Reviewed-by: Richard Zhao <richard.zhao@freescale.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[mkl: backport to v3.5]
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

---
 drivers/usb/chipidea/udc.c |   23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -1500,6 +1500,17 @@ static int init_eps(struct ci13xxx *udc)
 	return retval;
 }
 
+static void destroy_eps(struct ci13xxx *udc)
+{
+	int i;
+
+	for (i = 0; i < udc->hw_ep_max; i++) {
+		struct ci13xxx_ep *mEp = &udc->ci13xxx_ep[i];
+
+		dma_pool_free(udc->qh_pool, mEp->qh.ptr, mEp->qh.dma);
+	}
+}
+
 /**
  * ci13xxx_start: register a gadget driver
  * @gadget: our gadget
@@ -1709,7 +1720,7 @@ static int udc_start(struct ci13xxx *udc
 	if (udc->udc_driver->flags & CI13XXX_REQUIRE_TRANSCEIVER) {
 		if (udc->transceiver == NULL) {
 			retval = -ENODEV;
-			goto free_pools;
+			goto destroy_eps;
 		}
 	}
 
@@ -1759,6 +1770,8 @@ unreg_device:
 put_transceiver:
 	if (udc->transceiver)
 		usb_put_transceiver(udc->transceiver);
+destroy_eps:
+	destroy_eps(udc);
 free_pools:
 	dma_pool_destroy(udc->td_pool);
 free_qh_pool:
@@ -1773,18 +1786,12 @@ free_qh_pool:
  */
 static void udc_stop(struct ci13xxx *udc)
 {
-	int i;
-
 	if (udc == NULL)
 		return;
 
 	usb_del_gadget_udc(&udc->gadget);
 
-	for (i = 0; i < udc->hw_ep_max; i++) {
-		struct ci13xxx_ep *mEp = &udc->ci13xxx_ep[i];
-
-		dma_pool_free(udc->qh_pool, mEp->qh.ptr, mEp->qh.dma);
-	}
+	destroy_eps(udc);
 
 	dma_pool_destroy(udc->td_pool);
 	dma_pool_destroy(udc->qh_pool);



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 254/262] USB: ohci-at91: fix null pointer in ohci_hcd_at91_overcurrent_irq
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (252 preceding siblings ...)
  2012-09-28 18:53 ` [ 253/262] usb: chipidea: cleanup dma_pool if udc_start() fails Greg Kroah-Hartman
@ 2012-09-28 18:53 ` Greg Kroah-Hartman
  2012-09-28 18:53 ` [ 255/262] USB: Fix race condition when removing host controllers Greg Kroah-Hartman
                   ` (7 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:53 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Joachim Eastwood

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Joachim Eastwood <manabian@gmail.com>

commit 01bb6501779ed0b6dc6c55be34b49eaa6306fdd8 upstream.

Fixes the following NULL pointer dereference:
[    7.740000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    7.810000] Unable to handle kernel NULL pointer dereference at virtual address 00000028
[    7.810000] pgd = c3a38000
[    7.810000] [00000028] *pgd=23a8c831, *pte=00000000, *ppte=00000000
[    7.810000] Internal error: Oops: 17 [#1] PREEMPT ARM
[    7.810000] Modules linked in: ohci_hcd(+) regmap_i2c snd_pcm usbcore snd_page_alloc at91_cf snd_timer pcmcia_rsrc snd soundcore gpio_keys regmap_spi pcmcia_core usb_common nls_base
[    7.810000] CPU: 0    Not tainted  (3.6.0-rc6-mpa+ #264)
[    7.810000] PC is at __gpio_to_irq+0x18/0x40
[    7.810000] LR is at ohci_hcd_at91_overcurrent_irq+0x24/0xb4 [ohci_hcd]
[    7.810000] pc : [<c01392d4>]    lr : [<bf08f694>]    psr: 40000093
[    7.810000] sp : c3a11c40  ip : c3a11c50  fp : c3a11c4c
[    7.810000] r10: 00000000  r9 : c02dcd6e  r8 : fefff400
[    7.810000] r7 : 00000000  r6 : c02cc928  r5 : 00000030  r4 : c02dd168
[    7.810000] r3 : c02e7350  r2 : ffffffea  r1 : c02cc928  r0 : 00000000
[    7.810000] Flags: nZcv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
[    7.810000] Control: c000717f  Table: 23a38000  DAC: 00000015
[    7.810000] Process modprobe (pid: 285, stack limit = 0xc3a10270)
[    7.810000] Stack: (0xc3a11c40 to 0xc3a12000)
[    7.810000] 1c40: c3a11c6c c3a11c50 bf08f694 c01392cc c3a11c84 c2c38b00 c3806900 00000030
[    7.810000] 1c60: c3a11ca4 c3a11c70 c0051264 bf08f680 c3a11cac c3a11c80 c003e764 c3806900
[    7.810000] 1c80: c2c38b00 c02cb05c c02cb000 fefff400 c3806930 c3a11cf4 c3a11cbc c3a11ca8
[    7.810000] 1ca0: c005142c c005123c c3806900 c3805a00 c3a11cd4 c3a11cc0 c0053f24 c00513e4
[    7.810000] 1cc0: c3a11cf4 00000030 c3a11cec c3a11cd8 c005120c c0053e88 00000000 00000000
[    7.810000] 1ce0: c3a11d1c c3a11cf0 c00124d0 c00511e0 01400000 00000001 00000012 00000000
[    7.810000] 1d00: ffffffff c3a11d94 00000030 00000000 c3a11d34 c3a11d20 c005120c c0012438
[    7.810000] 1d20: c001dac4 00000012 c3a11d4c c3a11d38 c0009b08 c00511e0 c00523fc 60000013
[    7.810000] 1d40: c3a11d5c c3a11d50 c0008510 c0009ab4 c3a11ddc c3a11d60 c0008eb4 c00084f0
[    7.810000] 1d60: 00000000 00000030 00000000 00000080 60000013 bf08f670 c3806900 c2c38b00
[    7.810000] 1d80: 00000030 c3806930 00000000 c3a11ddc c3a11d88 c3a11da8 c0054190 c00523fc
[    7.810000] 1da0: 60000013 ffffffff c3a11dec c3a11db8 00000000 c2c38b00 bf08f670 c3806900
[    7.810000] 1dc0: 00000000 00000080 c02cc928 00000030 c3a11e0c c3a11de0 c0052764 c00520d8
[    7.810000] 1de0: c3a11dfc 00000000 00000000 00000002 bf090f61 00000004 c02cc930 c02cc928
[    7.810000] 1e00: c3a11e4c c3a11e10 bf090978 c005269c bf090f61 c02cc928 bf093000 c02dd170
[    7.810000] 1e20: c3a11e3c c02cc930 c02cc930 bf0911d0 bf0911d0 bf093000 c3a10000 00000000
[    7.810000] 1e40: c3a11e5c c3a11e50 c0155b7c bf090808 c3a11e7c c3a11e60 c0154690 c0155b6c
[    7.810000] 1e60: c02cc930 c02cc964 bf0911d0 c3a11ea0 c3a11e9c c3a11e80 c015484c c01545e8
[    7.810000] 1e80: 00000000 00000000 c01547e4 bf0911d0 c3a11ec4 c3a11ea0 c0152e58 c01547f4
[    7.810000] 1ea0: c381b88c c384ab10 c2c10540 bf0911d0 00000000 c02d7518 c3a11ed4 c3a11ec8
[    7.810000] 1ec0: c01544c0 c0152e0c c3a11efc c3a11ed8 c01536cc c01544b0 bf091075 c3a11ee8
[    7.810000] 1ee0: bf049af0 bf09120c bf0911d0 00000000 c3a11f1c c3a11f00 c0154e9c c0153628
[    7.810000] 1f00: bf049af0 bf09120c 000ae190 00000000 c3a11f2c c3a11f20 c0155f58 c0154e04
[    7.810000] 1f20: c3a11f44 c3a11f30 bf093054 c0155f1c 00000000 00006a4f c3a11f7c c3a11f48
[    7.810000] 1f40: c0008638 bf093010 bf09120c 000ae190 00000000 c00093c4 00006a4f bf09120c
[    7.810000] 1f60: 000ae190 00000000 c00093c4 00000000 c3a11fa4 c3a11f80 c004fdc4 c000859c
[    7.810000] 1f80: c3a11fa4 000ae190 00006a4f 00016eb8 000ad018 00000080 00000000 c3a11fa8
[    7.810000] 1fa0: c0009260 c004fd58 00006a4f 00016eb8 000ae190 00006a4f 000ae100 00000000
[    7.810000] 1fc0: 00006a4f 00016eb8 000ad018 00000080 000adba0 000ad208 00000000 000ad3d8
[    7.810000] 1fe0: beaf7ae8 beaf7ad8 000172b8 b6e4e940 20000010 000ae190 00000000 00000000
[    7.810000] Backtrace:
[    7.810000] [<c01392bc>] (__gpio_to_irq+0x0/0x40) from [<bf08f694>] (ohci_hcd_at91_overcurrent_irq+0x24/0xb4 [ohci_hcd])
[    7.810000] [<bf08f670>] (ohci_hcd_at91_overcurrent_irq+0x0/0xb4 [ohci_hcd]) from [<c0051264>] (handle_irq_event_percpu+0x38/0x1a8)
[    7.810000]  r6:00000030 r5:c3806900 r4:c2c38b00
[    7.810000] [<c005122c>] (handle_irq_event_percpu+0x0/0x1a8) from [<c005142c>] (handle_irq_event+0x58/0x7c)
[    7.810000] [<c00513d4>] (handle_irq_event+0x0/0x7c) from [<c0053f24>] (handle_simple_irq+0xac/0xd8)
[    7.810000]  r5:c3805a00 r4:c3806900
[    7.810000] [<c0053e78>] (handle_simple_irq+0x0/0xd8) from [<c005120c>] (generic_handle_irq+0x3c/0x48)
[    7.810000]  r4:00000030
[    7.810000] [<c00511d0>] (generic_handle_irq+0x0/0x48) from [<c00124d0>] (gpio_irq_handler+0xa8/0xfc)
[    7.810000]  r4:00000000
[    7.810000] [<c0012428>] (gpio_irq_handler+0x0/0xfc) from [<c005120c>] (generic_handle_irq+0x3c/0x48)
[    7.810000] [<c00511d0>] (generic_handle_irq+0x0/0x48) from [<c0009b08>] (handle_IRQ+0x64/0x88)
[    7.810000]  r4:00000012
[    7.810000] [<c0009aa4>] (handle_IRQ+0x0/0x88) from [<c0008510>] (at91_aic_handle_irq+0x30/0x38)
[    7.810000]  r5:60000013 r4:c00523fc
[    7.810000] [<c00084e0>] (at91_aic_handle_irq+0x0/0x38) from [<c0008eb4>] (__irq_svc+0x34/0x60)
[    7.810000] Exception stack(0xc3a11d60 to 0xc3a11da8)
[    7.810000] 1d60: 00000000 00000030 00000000 00000080 60000013 bf08f670 c3806900 c2c38b00
[    7.810000] 1d80: 00000030 c3806930 00000000 c3a11ddc c3a11d88 c3a11da8 c0054190 c00523fc
[    7.810000] 1da0: 60000013 ffffffff
[    7.810000] [<c00520c8>] (__setup_irq+0x0/0x458) from [<c0052764>] (request_threaded_irq+0xd8/0x134)
[    7.810000] [<c005268c>] (request_threaded_irq+0x0/0x134) from [<bf090978>] (ohci_hcd_at91_drv_probe+0x180/0x41c [ohci_hcd])
[    7.810000] [<bf0907f8>] (ohci_hcd_at91_drv_probe+0x0/0x41c [ohci_hcd]) from [<c0155b7c>] (platform_drv_probe+0x20/0x24)
[    7.810000] [<c0155b5c>] (platform_drv_probe+0x0/0x24) from [<c0154690>] (driver_probe_device+0xb8/0x20c)
[    7.810000] [<c01545d8>] (driver_probe_device+0x0/0x20c) from [<c015484c>] (__driver_attach+0x68/0x88)
[    7.810000]  r7:c3a11ea0 r6:bf0911d0 r5:c02cc964 r4:c02cc930
[    7.810000] [<c01547e4>] (__driver_attach+0x0/0x88) from [<c0152e58>] (bus_for_each_dev+0x5c/0x9c)
[    7.810000]  r6:bf0911d0 r5:c01547e4 r4:00000000
[    7.810000] [<c0152dfc>] (bus_for_each_dev+0x0/0x9c) from [<c01544c0>] (driver_attach+0x20/0x28)
[    7.810000]  r7:c02d7518 r6:00000000 r5:bf0911d0 r4:c2c10540
[    7.810000] [<c01544a0>] (driver_attach+0x0/0x28) from [<c01536cc>] (bus_add_driver+0xb4/0x22c)
[    7.810000] [<c0153618>] (bus_add_driver+0x0/0x22c) from [<c0154e9c>] (driver_register+0xa8/0x144)
[    7.810000]  r7:00000000 r6:bf0911d0 r5:bf09120c r4:bf049af0
[    7.810000] [<c0154df4>] (driver_register+0x0/0x144) from [<c0155f58>] (platform_driver_register+0x4c/0x60)
[    7.810000]  r7:00000000 r6:000ae190 r5:bf09120c r4:bf049af0
[    7.810000] [<c0155f0c>] (platform_driver_register+0x0/0x60) from [<bf093054>] (ohci_hcd_mod_init+0x54/0x8c [ohci_hcd])
[    7.810000] [<bf093000>] (ohci_hcd_mod_init+0x0/0x8c [ohci_hcd]) from [<c0008638>] (do_one_initcall+0xac/0x174)
[    7.810000]  r4:00006a4f
[    7.810000] [<c000858c>] (do_one_initcall+0x0/0x174) from [<c004fdc4>] (sys_init_module+0x7c/0x1a0)
[    7.810000] [<c004fd48>] (sys_init_module+0x0/0x1a0) from [<c0009260>] (ret_fast_syscall+0x0/0x2c)
[    7.810000]  r7:00000080 r6:000ad018 r5:00016eb8 r4:00006a4f
[    7.810000] Code: e24cb004 e59f3028 e1a02000 e7930180 (e5903028)
[    7.810000] ---[ end trace 85aa37ed128143b5 ]---
[    7.810000] Kernel panic - not syncing: Fatal exception in interrupt

Commit 6fffb77c (USB: ohci-at91: fix PIO handling in relation with number of
ports) started setting unused pins to EINVAL. But this exposed a bug in the
ohci_hcd_at91_overcurrent_irq function where the gpio was used without being
checked to see if it is valid.

This patches fixed the issue by adding the gpio valid check.

Signed-off-by: Joachim Eastwood <joachim.eastwood@jotron.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/host/ohci-at91.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -467,7 +467,8 @@ static irqreturn_t ohci_hcd_at91_overcur
 	/* From the GPIO notifying the over-current situation, find
 	 * out the corresponding port */
 	at91_for_each_port(port) {
-		if (gpio_to_irq(pdata->overcurrent_pin[port]) == irq) {
+		if (gpio_is_valid(pdata->overcurrent_pin[port]) &&
+				gpio_to_irq(pdata->overcurrent_pin[port]) == irq) {
 			gpio = pdata->overcurrent_pin[port];
 			break;
 		}



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 255/262] USB: Fix race condition when removing host controllers
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (253 preceding siblings ...)
  2012-09-28 18:53 ` [ 254/262] USB: ohci-at91: fix null pointer in ohci_hcd_at91_overcurrent_irq Greg Kroah-Hartman
@ 2012-09-28 18:53 ` Greg Kroah-Hartman
  2012-09-28 18:53 ` [ 256/262] ALSA: snd-usb: fix next_packet_size calls for pause case Greg Kroah-Hartman
                   ` (6 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:53 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Alan Stern, Don Zickus

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alan Stern <stern@rowland.harvard.edu>

commit 0d00dc2611abbe6ad244d50569c2ee82ce42846c upstream.

This patch (as1607) fixes a race that can occur if a USB host
controller is removed while a process is reading the
/sys/kernel/debug/usb/devices file.

The usb_device_read() routine uses the bus->root_hub pointer to
determine whether or not the root hub is registered.  The is not a
valid test, because the pointer is set before the root hub gets
registered and remains set even after the root hub is unregistered and
deallocated.  As a result, usb_device_read() or usb_device_dump() can
access freed memory, causing an oops.

The patch changes the test to use the hcd->rh_registered flag, which
does get set and cleared at the appropriate times.  It also makes sure
to hold the usb_bus_list_lock mutex while setting the flag, so that
usb_device_read() will become aware of new root hubs as soon as they
are registered.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Don Zickus <dzickus@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/core/devices.c |    2 +-
 drivers/usb/core/hcd.c     |    6 ++----
 2 files changed, 3 insertions(+), 5 deletions(-)

--- a/drivers/usb/core/devices.c
+++ b/drivers/usb/core/devices.c
@@ -624,7 +624,7 @@ static ssize_t usb_device_read(struct fi
 	/* print devices for all busses */
 	list_for_each_entry(bus, &usb_bus_list, bus_list) {
 		/* recurse through all children of the root hub */
-		if (!bus->root_hub)
+		if (!bus_to_hcd(bus)->rh_registered)
 			continue;
 		usb_lock_device(bus->root_hub);
 		ret = usb_device_dump(&buf, &nbytes, &skip_bytes, ppos,
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1011,10 +1011,7 @@ static int register_root_hub(struct usb_
 	if (retval) {
 		dev_err (parent_dev, "can't register root hub for %s, %d\n",
 				dev_name(&usb_dev->dev), retval);
-	}
-	mutex_unlock(&usb_bus_list_lock);
-
-	if (retval == 0) {
+	} else {
 		spin_lock_irq (&hcd_root_hub_lock);
 		hcd->rh_registered = 1;
 		spin_unlock_irq (&hcd_root_hub_lock);
@@ -1023,6 +1020,7 @@ static int register_root_hub(struct usb_
 		if (HCD_DEAD(hcd))
 			usb_hc_died (hcd);	/* This time clean up */
 	}
+	mutex_unlock(&usb_bus_list_lock);
 
 	return retval;
 }



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 256/262] ALSA: snd-usb: fix next_packet_size calls for pause case
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (254 preceding siblings ...)
  2012-09-28 18:53 ` [ 255/262] USB: Fix race condition when removing host controllers Greg Kroah-Hartman
@ 2012-09-28 18:53 ` Greg Kroah-Hartman
  2012-09-28 18:53 ` [ 257/262] ASoC: wm2000: Correct register size Greg Kroah-Hartman
                   ` (5 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:53 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Daniel Mack, Takashi Iwai, Linus Torvalds

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Mack <zonque@gmail.com>

commit 8dce30c89113e314d29d3b8f362aadff8087fccb upstream.

Also fix the calls to next_packet_size() for the pause case. This was
missed in 245baf983 ("ALSA: snd-usb: fix calls to next_packet_size").

Signed-off-by: Daniel Mack <zonque@gmail.com>
Reviewed-by: Takashi Iwai <tiwai@suse.de>
Reported-and-tested-by: Christian Tefzer <ctrefzer@gmx.de>
[ Taking directly because Takashi is on vacation  - Linus ]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/usb/endpoint.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- a/sound/usb/endpoint.c
+++ b/sound/usb/endpoint.c
@@ -197,7 +197,13 @@ static void prepare_outbound_urb(struct
 			/* no data provider, so send silence */
 			unsigned int offs = 0;
 			for (i = 0; i < ctx->packets; ++i) {
-				int counts = ctx->packet_size[i];
+				int counts;
+
+				if (ctx->packet_size[i])
+					counts = ctx->packet_size[i];
+				else
+					counts = snd_usb_endpoint_next_packet_size(ep);
+
 				urb->iso_frame_desc[i].offset = offs * ep->stride;
 				urb->iso_frame_desc[i].length = counts * ep->stride;
 				offs += counts;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 257/262] ASoC: wm2000: Correct register size
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (255 preceding siblings ...)
  2012-09-28 18:53 ` [ 256/262] ALSA: snd-usb: fix next_packet_size calls for pause case Greg Kroah-Hartman
@ 2012-09-28 18:53 ` Greg Kroah-Hartman
  2012-09-28 18:53 ` [ 258/262] gpio-lpc32xx: Fix value handling of gpio_direction_output() Greg Kroah-Hartman
                   ` (4 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:53 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Mark Brown

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mark Brown <broonie@opensource.wolfsonmicro.com>

commit d0e12f3ff3472cbd8f52d3c0e6ee07a841787c40 upstream.

Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/soc/codecs/wm2000.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/soc/codecs/wm2000.c
+++ b/sound/soc/codecs/wm2000.c
@@ -675,7 +675,7 @@ static int wm2000_resume(struct snd_soc_
 #endif
 
 static const struct regmap_config wm2000_regmap = {
-	.reg_bits = 8,
+	.reg_bits = 16,
 	.val_bits = 8,
 };
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 258/262] gpio-lpc32xx: Fix value handling of gpio_direction_output()
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (256 preceding siblings ...)
  2012-09-28 18:53 ` [ 257/262] ASoC: wm2000: Correct register size Greg Kroah-Hartman
@ 2012-09-28 18:53 ` Greg Kroah-Hartman
  2012-09-28 18:53 ` [ 259/262] md/raid10: fix "enough" function for detecting if array is failed Greg Kroah-Hartman
                   ` (3 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:53 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Roland Stigge, Alexandre Pereira da Silva, Linus Walleij

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Roland Stigge <stigge@antcom.de>

commit b1268d3737c6316016026245eef276eda6b0a621 upstream.

For GPIOs of gpio-lpc32xx, gpio_direction_output() ignores the value argument
(initial value of output). This patch fixes this by setting the level
accordingly.

Signed-off-by: Roland Stigge <stigge@antcom.de>
Acked-by: Alexandre Pereira da Silva <aletes.xgr@gmail.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpio/gpio-lpc32xx.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/drivers/gpio/gpio-lpc32xx.c
+++ b/drivers/gpio/gpio-lpc32xx.c
@@ -307,6 +307,7 @@ static int lpc32xx_gpio_dir_output_p012(
 {
 	struct lpc32xx_gpio_chip *group = to_lpc32xx_gpio(chip);
 
+	__set_gpio_level_p012(group, pin, value);
 	__set_gpio_dir_p012(group, pin, 0);
 
 	return 0;
@@ -317,6 +318,7 @@ static int lpc32xx_gpio_dir_output_p3(st
 {
 	struct lpc32xx_gpio_chip *group = to_lpc32xx_gpio(chip);
 
+	__set_gpio_level_p3(group, pin, value);
 	__set_gpio_dir_p3(group, pin, 0);
 
 	return 0;
@@ -325,6 +327,9 @@ static int lpc32xx_gpio_dir_output_p3(st
 static int lpc32xx_gpio_dir_out_always(struct gpio_chip *chip, unsigned pin,
 	int value)
 {
+	struct lpc32xx_gpio_chip *group = to_lpc32xx_gpio(chip);
+
+	__set_gpo_level_p3(group, pin, value);
 	return 0;
 }
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 259/262] md/raid10: fix "enough" function for detecting if array is failed.
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (257 preceding siblings ...)
  2012-09-28 18:53 ` [ 258/262] gpio-lpc32xx: Fix value handling of gpio_direction_output() Greg Kroah-Hartman
@ 2012-09-28 18:53 ` Greg Kroah-Hartman
  2012-09-28 18:53 ` [ 260/262] drm/udl: limit modes to the sku pixel limits Greg Kroah-Hartman
                   ` (2 subsequent siblings)
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:53 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Jakub Husák, NeilBrown

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: NeilBrown <neilb@suse.de>

commit 80b4812407c6b1f66a4f2430e69747a13f010839 upstream.

The 'enough' function is written to work with 'near' arrays only
in that is implicitly assumes that the offset from one 'group' of
devices to the next is the same as the number of copies.
In reality it is the number of 'near' copies.

So change it to make this number explicit.

This bug makes it possible to run arrays without enough drives
present, which is dangerous.
It is appropriate for an -stable kernel, but will almost certainly
need to be modified for some of them.

Reported-by: Jakub Husák <jakub@gooseman.cz>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/raid10.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1492,14 +1492,16 @@ static int _enough(struct r10conf *conf,
 	do {
 		int n = conf->copies;
 		int cnt = 0;
+		int this = first;
 		while (n--) {
-			if (conf->mirrors[first].rdev &&
-			    first != ignore)
+			if (conf->mirrors[this].rdev &&
+			    this != ignore)
 				cnt++;
-			first = (first+1) % geo->raid_disks;
+			this = (this+1) % geo->raid_disks;
 		}
 		if (cnt == 0)
 			return 0;
+		first = (first + geo->near_copies) % geo->raid_disks;
 	} while (first != 0);
 	return 1;
 }



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 260/262] drm/udl: limit modes to the sku pixel limits.
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (258 preceding siblings ...)
  2012-09-28 18:53 ` [ 259/262] md/raid10: fix "enough" function for detecting if array is failed Greg Kroah-Hartman
@ 2012-09-28 18:53 ` Greg Kroah-Hartman
  2012-09-28 18:53 ` [ 261/262] drm/i915: only enable sdvo hotplug irq if needed Greg Kroah-Hartman
  2012-09-28 18:53 ` [ 262/262] vmwgfx: corruption in vmw_event_fence_action_create() Greg Kroah-Hartman
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:53 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Alex Deucher, Dave Airlie

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dave Airlie <airlied@redhat.com>

commit 3a75885848996baab5276ff37ebf7295c3c753f0 upstream.

Otherwise when X starts we commonly get a black screen scanning
out nothing, its wierd dpms on/off from userspace brings it back,

With this on F18, multi-seat works again with my 1920x1200 monitor
which is above the sku limit for the device I have.

Reviewed-by: Alex Deucher <alexander.deucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/udl/udl_connector.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/gpu/drm/udl/udl_connector.c
+++ b/drivers/gpu/drm/udl/udl_connector.c
@@ -69,6 +69,13 @@ static int udl_get_modes(struct drm_conn
 static int udl_mode_valid(struct drm_connector *connector,
 			  struct drm_display_mode *mode)
 {
+	struct udl_device *udl = connector->dev->dev_private;
+	if (!udl->sku_pixel_limit)
+		return 0;
+
+	if (mode->vdisplay * mode->hdisplay > udl->sku_pixel_limit)
+		return MODE_VIRTUAL_Y;
+
 	return 0;
 }
 



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 261/262] drm/i915: only enable sdvo hotplug irq if needed
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (259 preceding siblings ...)
  2012-09-28 18:53 ` [ 260/262] drm/udl: limit modes to the sku pixel limits Greg Kroah-Hartman
@ 2012-09-28 18:53 ` Greg Kroah-Hartman
  2012-09-28 18:53 ` [ 262/262] vmwgfx: corruption in vmw_event_fence_action_create() Greg Kroah-Hartman
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:53 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Greg KH, alan, Dominik Köppl, Jani Nikula, Daniel Vetter

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jani Nikula <jani.nikula@intel.com>

commit fcbc50da7753b210b4442ca9abc4efbd4e481f6e upstream.

Avoid constant wakeups caused by noisy irq lines when we don't even care
about the irq. This should be particularly useful for i945g/gm where the
hotplug has been disabled:

commit 768b107e4b3be0acf6f58e914afe4f337c00932b
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Fri May 4 11:29:56 2012 +0200

    drm/i915: disable sdvo hotplug on i945g/gm

v2: While at it, remove the bogus hotplug_active read, and do not mask
hotplug_active[0] before checking whether the irq is needed, per discussion
with Daniel on IRC.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=38442
Tested-by: Dominik Köppl <dominik@devwork.org>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/i915/intel_sdvo.c |   23 ++++++++++-------------
 1 file changed, 10 insertions(+), 13 deletions(-)

--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -2552,25 +2552,12 @@ bool intel_sdvo_init(struct drm_device *
 		}
 	}
 
-	if (intel_sdvo->is_sdvob)
-		dev_priv->hotplug_supported_mask |= SDVOB_HOTPLUG_INT_STATUS;
-	else
-		dev_priv->hotplug_supported_mask |= SDVOC_HOTPLUG_INT_STATUS;
-
 	drm_encoder_helper_add(&intel_encoder->base, &intel_sdvo_helper_funcs);
 
 	/* In default case sdvo lvds is false */
 	if (!intel_sdvo_get_capabilities(intel_sdvo, &intel_sdvo->caps))
 		goto err;
 
-	/* Set up hotplug command - note paranoia about contents of reply.
-	 * We assume that the hardware is in a sane state, and only touch
-	 * the bits we think we understand.
-	 */
-	intel_sdvo_get_value(intel_sdvo, SDVO_CMD_GET_ACTIVE_HOT_PLUG,
-			     &intel_sdvo->hotplug_active, 2);
-	intel_sdvo->hotplug_active[0] &= ~0x3;
-
 	if (intel_sdvo_output_setup(intel_sdvo,
 				    intel_sdvo->caps.output_flags) != true) {
 		DRM_DEBUG_KMS("SDVO output failed to setup on %s\n",
@@ -2578,6 +2565,16 @@ bool intel_sdvo_init(struct drm_device *
 		goto err;
 	}
 
+	/* Only enable the hotplug irq if we need it, to work around noisy
+	 * hotplug lines.
+	 */
+	if (intel_sdvo->hotplug_active[0]) {
+		if (intel_sdvo->is_sdvob)
+			dev_priv->hotplug_supported_mask |= SDVOB_HOTPLUG_INT_STATUS;
+		else
+			dev_priv->hotplug_supported_mask |= SDVOC_HOTPLUG_INT_STATUS;
+	}
+
 	intel_sdvo_select_ddc_bus(dev_priv, intel_sdvo, sdvo_reg);
 
 	/* Set the input timing to the screen. Assume always input 0. */



^ permalink raw reply	[flat|nested] 279+ messages in thread

* [ 262/262] vmwgfx: corruption in vmw_event_fence_action_create()
  2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
                   ` (260 preceding siblings ...)
  2012-09-28 18:53 ` [ 261/262] drm/i915: only enable sdvo hotplug irq if needed Greg Kroah-Hartman
@ 2012-09-28 18:53 ` Greg Kroah-Hartman
  261 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 18:53 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Greg KH, alan, Dan Carpenter, Dave Airlie

From: Greg KH <gregkh@linuxfoundation.org>

3.5-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 68c4fce737c4b963e336435f225621dc21138397 upstream.

We don't allocate enough data for this struct.  As soon as we start
modifying event->event on the next lines, then we're going beyond the
end of the memory we allocated.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Dave Airlie <airlied@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/vmwgfx/vmwgfx_fence.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
@@ -1018,7 +1018,7 @@ int vmw_event_fence_action_create(struct
 	}
 
 
-	event = kzalloc(sizeof(event->event), GFP_KERNEL);
+	event = kzalloc(sizeof(*event), GFP_KERNEL);
 	if (unlikely(event == NULL)) {
 		DRM_ERROR("Failed to allocate an event.\n");
 		ret = -ENOMEM;



^ permalink raw reply	[flat|nested] 279+ messages in thread

* Re: [ 173/262] mutex: Place lock in contended state after fastpath_lock failure
  2012-09-28 18:51 ` [ 173/262] mutex: Place lock in contended state after fastpath_lock failure Greg Kroah-Hartman
@ 2012-09-28 19:26   ` Nicolas Pitre
  2012-09-28 21:05     ` Greg Kroah-Hartman
  0 siblings, 1 reply; 279+ messages in thread
From: Nicolas Pitre @ 2012-09-28 19:26 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, stable, alan, Will Deacon, Arnd Bergmann,
	Chris Mason, Ingo Molnar, Peter Zijlstra, Thomas Gleixner

On Fri, 28 Sep 2012, Greg Kroah-Hartman wrote:

> From: Greg KH <gregkh@linuxfoundation.org>
> 
> 3.5-stable review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> From: Will Deacon <will.deacon@arm.com>
> 
> commit 0bce9c46bf3b15f485d82d7e81dabed6ebcc24b1 upstream.

Now that you've queued this one, could you pick up a76d7bd96d as well 
please?

Thanks


Nicolas

^ permalink raw reply	[flat|nested] 279+ messages in thread

* Re: [ 089/262] SUNRPC: Fix a UDP transport regression
  2012-09-28 18:50 ` [ 089/262] SUNRPC: Fix a UDP transport regression Greg Kroah-Hartman
@ 2012-09-28 19:46   ` Myklebust, Trond
  2012-09-28 21:05     ` Greg Kroah-Hartman
  0 siblings, 1 reply; 279+ messages in thread
From: Myklebust, Trond @ 2012-09-28 19:46 UTC (permalink / raw)
  To: Greg Kroah-Hartman; +Cc: linux-kernel, stable, alan, Dick Streefland

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset="utf-8", Size: 6779 bytes --]

On Fri, 2012-09-28 at 11:50 -0700, Greg Kroah-Hartman wrote:
> From: Greg KH <gregkh@linuxfoundation.org>
> 
> 3.5-stable review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> From: Trond Myklebust <Trond.Myklebust@netapp.com>
> 
> commit f39c1bfb5a03e2d255451bff05be0d7255298fa4 upstream.
> 
> Commit 43cedbf0e8dfb9c5610eb7985d5f21263e313802 (SUNRPC: Ensure that
> we grab the XPRT_LOCK before calling xprt_alloc_slot) is causing
> hangs in the case of NFS over UDP mounts.
> 
> Since neither the UDP or the RDMA transport mechanism use dynamic slot
> allocation, we can skip grabbing the socket lock for those transports.
> Add a new rpc_xprt_op to allow switching between the TCP and UDP/RDMA
> case.
> 
> Note that the NFSv4.1 back channel assigns the slot directly
> through rpc_run_bc_task, so we can ignore that case.
> 
> Reported-by: Dick Streefland <dick.streefland@altium.nl>
> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> 
> ---
>  include/linux/sunrpc/xprt.h     |    3 +++
>  net/sunrpc/xprt.c               |   34 ++++++++++++++++++++--------------
>  net/sunrpc/xprtrdma/transport.c |    1 +
>  net/sunrpc/xprtsock.c           |    3 +++
>  4 files changed, 27 insertions(+), 14 deletions(-)
> 
> --- a/include/linux/sunrpc/xprt.h
> +++ b/include/linux/sunrpc/xprt.h
> @@ -114,6 +114,7 @@ struct rpc_xprt_ops {
>  	void		(*set_buffer_size)(struct rpc_xprt *xprt, size_t sndsize, size_t rcvsize);
>  	int		(*reserve_xprt)(struct rpc_xprt *xprt, struct rpc_task *task);
>  	void		(*release_xprt)(struct rpc_xprt *xprt, struct rpc_task *task);
> +	void		(*alloc_slot)(struct rpc_xprt *xprt, struct rpc_task *task);
>  	void		(*rpcbind)(struct rpc_task *task);
>  	void		(*set_port)(struct rpc_xprt *xprt, unsigned short port);
>  	void		(*connect)(struct rpc_task *task);
> @@ -279,6 +280,8 @@ void			xprt_connect(struct rpc_task *tas
>  void			xprt_reserve(struct rpc_task *task);
>  int			xprt_reserve_xprt(struct rpc_xprt *xprt, struct rpc_task *task);
>  int			xprt_reserve_xprt_cong(struct rpc_xprt *xprt, struct rpc_task *task);
> +void			xprt_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task);
> +void			xprt_lock_and_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task);
>  int			xprt_prepare_transmit(struct rpc_task *task);
>  void			xprt_transmit(struct rpc_task *task);
>  void			xprt_end_transmit(struct rpc_task *task);
> --- a/net/sunrpc/xprt.c
> +++ b/net/sunrpc/xprt.c
> @@ -969,11 +969,11 @@ static bool xprt_dynamic_free_slot(struc
>  	return false;
>  }
>  
> -static void xprt_alloc_slot(struct rpc_task *task)
> +void xprt_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task)
>  {
> -	struct rpc_xprt	*xprt = task->tk_xprt;
>  	struct rpc_rqst *req;
>  
> +	spin_lock(&xprt->reserve_lock);
>  	if (!list_empty(&xprt->free)) {
>  		req = list_entry(xprt->free.next, struct rpc_rqst, rq_list);
>  		list_del(&req->rq_list);
> @@ -994,12 +994,29 @@ static void xprt_alloc_slot(struct rpc_t
>  	default:
>  		task->tk_status = -EAGAIN;
>  	}
> +	spin_unlock(&xprt->reserve_lock);
>  	return;
>  out_init_req:
>  	task->tk_status = 0;
>  	task->tk_rqstp = req;
>  	xprt_request_init(task, xprt);
> +	spin_unlock(&xprt->reserve_lock);
> +}
> +EXPORT_SYMBOL_GPL(xprt_alloc_slot);
> +
> +void xprt_lock_and_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task)
> +{
> +	/* Note: grabbing the xprt_lock_write() ensures that we throttle
> +	 * new slot allocation if the transport is congested (i.e. when
> +	 * reconnecting a stream transport or when out of socket write
> +	 * buffer space).
> +	 */
> +	if (xprt_lock_write(xprt, task)) {
> +		xprt_alloc_slot(xprt, task);
> +		xprt_release_write(xprt, task);
> +	}
>  }
> +EXPORT_SYMBOL_GPL(xprt_lock_and_alloc_slot);
>  
>  static void xprt_free_slot(struct rpc_xprt *xprt, struct rpc_rqst *req)
>  {
> @@ -1083,20 +1100,9 @@ void xprt_reserve(struct rpc_task *task)
>  	if (task->tk_rqstp != NULL)
>  		return;
>  
> -	/* Note: grabbing the xprt_lock_write() here is not strictly needed,
> -	 * but ensures that we throttle new slot allocation if the transport
> -	 * is congested (e.g. if reconnecting or if we're out of socket
> -	 * write buffer space).
> -	 */
>  	task->tk_timeout = 0;
>  	task->tk_status = -EAGAIN;
> -	if (!xprt_lock_write(xprt, task))
> -		return;
> -
> -	spin_lock(&xprt->reserve_lock);
> -	xprt_alloc_slot(task);
> -	spin_unlock(&xprt->reserve_lock);
> -	xprt_release_write(xprt, task);
> +	xprt->ops->alloc_slot(xprt, task);
>  }
>  
>  static inline __be32 xprt_alloc_xid(struct rpc_xprt *xprt)
> --- a/net/sunrpc/xprtrdma/transport.c
> +++ b/net/sunrpc/xprtrdma/transport.c
> @@ -713,6 +713,7 @@ static void xprt_rdma_print_stats(struct
>  static struct rpc_xprt_ops xprt_rdma_procs = {
>  	.reserve_xprt		= xprt_rdma_reserve_xprt,
>  	.release_xprt		= xprt_release_xprt_cong, /* sunrpc/xprt.c */
> +	.alloc_slot		= xprt_alloc_slot,
>  	.release_request	= xprt_release_rqst_cong,       /* ditto */
>  	.set_retrans_timeout	= xprt_set_retrans_timeout_def, /* ditto */
>  	.rpcbind		= rpcb_getport_async,	/* sunrpc/rpcb_clnt.c */
> --- a/net/sunrpc/xprtsock.c
> +++ b/net/sunrpc/xprtsock.c
> @@ -2433,6 +2433,7 @@ static void bc_destroy(struct rpc_xprt *
>  static struct rpc_xprt_ops xs_local_ops = {
>  	.reserve_xprt		= xprt_reserve_xprt,
>  	.release_xprt		= xs_tcp_release_xprt,
> +	.alloc_slot		= xprt_alloc_slot,
>  	.rpcbind		= xs_local_rpcbind,
>  	.set_port		= xs_local_set_port,
>  	.connect		= xs_connect,
> @@ -2449,6 +2450,7 @@ static struct rpc_xprt_ops xs_udp_ops =
>  	.set_buffer_size	= xs_udp_set_buffer_size,
>  	.reserve_xprt		= xprt_reserve_xprt_cong,
>  	.release_xprt		= xprt_release_xprt_cong,
> +	.alloc_slot		= xprt_alloc_slot,
>  	.rpcbind		= rpcb_getport_async,
>  	.set_port		= xs_set_port,
>  	.connect		= xs_connect,
> @@ -2466,6 +2468,7 @@ static struct rpc_xprt_ops xs_udp_ops =
>  static struct rpc_xprt_ops xs_tcp_ops = {
>  	.reserve_xprt		= xprt_reserve_xprt,
>  	.release_xprt		= xs_tcp_release_xprt,
> +	.alloc_slot		= xprt_lock_and_alloc_slot,
>  	.rpcbind		= rpcb_getport_async,
>  	.set_port		= xs_set_port,
>  	.connect		= xs_connect,
> 
> 

Hi Greg,

Can we please hold on this one for now. It appears that it requires an
extra initialiser in the 'bc_tcp_ops' declaration in
net/sunrpc/xprtsock.c (to set '.alloc_slot = xprt_alloc_slot').

I have a separate patch for that, but it has not yet made it upstream.

Cheers
  Trond

-- 
Trond Myklebust
Linux NFS client maintainer

NetApp
Trond.Myklebust@netapp.com
www.netapp.com
ÿôèº{.nÇ+‰·Ÿ®‰­†+%ŠËÿ±éݶ\x17¥Šwÿº{.nÇ+‰·¥Š{±þG«éÿŠ{ayº\x1dʇڙë,j\a­¢f£¢·hšïêÿ‘êçz_è®\x03(­éšŽŠÝ¢j"ú\x1a¶^[m§ÿÿ¾\a«þG«éÿ¢¸?™¨è­Ú&£ø§~á¶iO•æ¬z·švØ^\x14\x04\x1a¶^[m§ÿÿÃ\fÿ¶ìÿ¢¸?–I¥

^ permalink raw reply	[flat|nested] 279+ messages in thread

* Re: [ 089/262] SUNRPC: Fix a UDP transport regression
  2012-09-28 19:46   ` Myklebust, Trond
@ 2012-09-28 21:05     ` Greg Kroah-Hartman
  0 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 21:05 UTC (permalink / raw)
  To: Myklebust, Trond; +Cc: linux-kernel, stable, alan, Dick Streefland

On Fri, Sep 28, 2012 at 07:46:57PM +0000, Myklebust, Trond wrote:
> On Fri, 2012-09-28 at 11:50 -0700, Greg Kroah-Hartman wrote:
> > From: Greg KH <gregkh@linuxfoundation.org>
> > 
> > 3.5-stable review patch.  If anyone has any objections, please let me know.
> > 
> > ------------------
> > 
> > From: Trond Myklebust <Trond.Myklebust@netapp.com>
> > 
> > commit f39c1bfb5a03e2d255451bff05be0d7255298fa4 upstream.
> 
> Hi Greg,
> 
> Can we please hold on this one for now. It appears that it requires an
> extra initialiser in the 'bc_tcp_ops' declaration in
> net/sunrpc/xprtsock.c (to set '.alloc_slot = xprt_alloc_slot').
> 
> I have a separate patch for that, but it has not yet made it upstream.

Now dropped, thanks for letting me know.

greg k-h

^ permalink raw reply	[flat|nested] 279+ messages in thread

* Re: [ 173/262] mutex: Place lock in contended state after fastpath_lock failure
  2012-09-28 19:26   ` Nicolas Pitre
@ 2012-09-28 21:05     ` Greg Kroah-Hartman
  2012-09-28 21:16       ` Nicolas Pitre
  0 siblings, 1 reply; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 21:05 UTC (permalink / raw)
  To: Nicolas Pitre
  Cc: linux-kernel, stable, alan, Will Deacon, Arnd Bergmann,
	Chris Mason, Ingo Molnar, Peter Zijlstra, Thomas Gleixner

On Fri, Sep 28, 2012 at 03:26:40PM -0400, Nicolas Pitre wrote:
> On Fri, 28 Sep 2012, Greg Kroah-Hartman wrote:
> 
> > From: Greg KH <gregkh@linuxfoundation.org>
> > 
> > 3.5-stable review patch.  If anyone has any objections, please let me know.
> > 
> > ------------------
> > 
> > From: Will Deacon <will.deacon@arm.com>
> > 
> > commit 0bce9c46bf3b15f485d82d7e81dabed6ebcc24b1 upstream.
> 
> Now that you've queued this one, could you pick up a76d7bd96d as well 
> please?

Sure, for just 3.5.y or any other stable trees?

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 279+ messages in thread

* Re: [ 173/262] mutex: Place lock in contended state after fastpath_lock failure
  2012-09-28 21:05     ` Greg Kroah-Hartman
@ 2012-09-28 21:16       ` Nicolas Pitre
  2012-09-28 21:27         ` Greg Kroah-Hartman
  0 siblings, 1 reply; 279+ messages in thread
From: Nicolas Pitre @ 2012-09-28 21:16 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, stable, alan, Will Deacon, Arnd Bergmann,
	Chris Mason, Ingo Molnar, Peter Zijlstra, Thomas Gleixner

On Fri, 28 Sep 2012, Greg Kroah-Hartman wrote:

> On Fri, Sep 28, 2012 at 03:26:40PM -0400, Nicolas Pitre wrote:
> > On Fri, 28 Sep 2012, Greg Kroah-Hartman wrote:
> > 
> > > From: Greg KH <gregkh@linuxfoundation.org>
> > > 
> > > 3.5-stable review patch.  If anyone has any objections, please let me know.
> > > 
> > > ------------------
> > > 
> > > From: Will Deacon <will.deacon@arm.com>
> > > 
> > > commit 0bce9c46bf3b15f485d82d7e81dabed6ebcc24b1 upstream.
> > 
> > Now that you've queued this one, could you pick up a76d7bd96d as well 
> > please?
> 
> Sure, for just 3.5.y or any other stable trees?

Any other stable tree where commit 0bce9c46bf has also been merged.


Nicolas

^ permalink raw reply	[flat|nested] 279+ messages in thread

* Re: [ 173/262] mutex: Place lock in contended state after fastpath_lock failure
  2012-09-28 21:16       ` Nicolas Pitre
@ 2012-09-28 21:27         ` Greg Kroah-Hartman
  0 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-09-28 21:27 UTC (permalink / raw)
  To: Nicolas Pitre
  Cc: linux-kernel, stable, alan, Will Deacon, Arnd Bergmann,
	Chris Mason, Ingo Molnar, Peter Zijlstra, Thomas Gleixner

On Fri, Sep 28, 2012 at 05:16:28PM -0400, Nicolas Pitre wrote:
> On Fri, 28 Sep 2012, Greg Kroah-Hartman wrote:
> 
> > On Fri, Sep 28, 2012 at 03:26:40PM -0400, Nicolas Pitre wrote:
> > > On Fri, 28 Sep 2012, Greg Kroah-Hartman wrote:
> > > 
> > > > From: Greg KH <gregkh@linuxfoundation.org>
> > > > 
> > > > 3.5-stable review patch.  If anyone has any objections, please let me know.
> > > > 
> > > > ------------------
> > > > 
> > > > From: Will Deacon <will.deacon@arm.com>
> > > > 
> > > > commit 0bce9c46bf3b15f485d82d7e81dabed6ebcc24b1 upstream.
> > > 
> > > Now that you've queued this one, could you pick up a76d7bd96d as well 
> > > please?
> > 
> > Sure, for just 3.5.y or any other stable trees?
> 
> Any other stable tree where commit 0bce9c46bf has also been merged.

Ok, now applied to 3.0.y and 3.4.y and 3.5.y

greg k-h

^ permalink raw reply	[flat|nested] 279+ messages in thread

* Re: [ 074/262] mmc: mxs-mmc: fix deadlock caused by recursion loop
  2012-09-28 18:50 ` [ 074/262] mmc: mxs-mmc: fix deadlock caused by recursion loop Greg Kroah-Hartman
@ 2012-09-29  7:28   ` Attila Kinali
  0 siblings, 0 replies; 279+ messages in thread
From: Attila Kinali @ 2012-09-29  7:28 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, stable, alan, Lauri Hintsala, Shawn Guo, Chris Ball

On Fri, 28 Sep 2012 11:50:03 -0700
Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:

> From: Greg KH <gregkh@linuxfoundation.org>
> 
> 3.5-stable review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> From: Lauri Hintsala <lauri.hintsala@bluegiga.com>
> 
> commit fc108d24d3a6da63576a460e122fa1df0cbdea20 upstream.
> 
> Release the lock before mmc_signal_sdio_irq is called by
> mxs_mmc_enable_sdio_irq.


Looks ok on this side of the big pond.

			Attila Kinali

-- 
There is no secret ingredient
         -- Po, Kung Fu Panda

^ permalink raw reply	[flat|nested] 279+ messages in thread

* Re: [ 045/262] ARM: 7501/1: decompressor: reset ttbcr for VMSA ARMv7 cores
  2012-09-28 18:49 ` [ 045/262] ARM: 7501/1: decompressor: reset ttbcr for VMSA ARMv7 cores Greg Kroah-Hartman
@ 2012-09-29 12:25   ` Ben Hutchings
  0 siblings, 0 replies; 279+ messages in thread
From: Ben Hutchings @ 2012-09-29 12:25 UTC (permalink / raw)
  To: Will Deacon, Matthew Leach, Russell King
  Cc: linux-kernel, stable, alan, Nicolas Pitre, Greg Kroah-Hartman

[-- Attachment #1: Type: text/plain, Size: 1463 bytes --]

On Fri, 2012-09-28 at 11:49 -0700, Greg Kroah-Hartman wrote:
> From: Greg KH <gregkh@linuxfoundation.org>
> 
> 3.5-stable review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> From: Will Deacon <will.deacon@arm.com>
> 
> commit dbece45894d3ab1baac15a96dc4e1e8e23f64a93 upstream.
> 
> When enabling the MMU for ARMv7 CPUs, the decompressor does not touch
> the ttbcr register, assuming that it will be zeroed (N == 0, EAE == 0).
> Given that only EAE is defined as 0 for non-secure copies of the
> register (and a bootloader such as kexec may leave it set to 1 anyway),
> we should ensure that we reset the register ourselves before turning on
> the MMU.
> 
> This patch zeroes TTBCR.EAE and TTBCR.N prior to enabling the MMU for
> ARMv7 cores in the decompressor, configuring us exclusively for 32-bit
> translation tables via TTBR0.
> 
> Acked-by: Nicolas Pitre <nico@linaro.org>
> Signed-off-by: Matthew Leach <matthew.leach@arm.com>
> Signed-off-by: Will Deacon <will.deacon@arm.com>
> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[...]

Is this also needed for earlier kernel versions?  If so, can you provide
a backported version?

Ben.

-- 
Ben Hutchings
Usenet is essentially a HUGE group of people passing notes in class.
                      - Rachel Kadel, `A Quick Guide to Newsgroup Etiquette'

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 828 bytes --]

^ permalink raw reply	[flat|nested] 279+ messages in thread

* Re: [ 080/262] usb: gadget: dummy_hcd: fixup error probe path
  2012-09-28 18:50 ` [ 080/262] usb: gadget: dummy_hcd: fixup error probe path Greg Kroah-Hartman
@ 2012-09-29 19:01   ` Ben Hutchings
  2012-09-30 12:30     ` Sebastian Andrzej Siewior
  0 siblings, 1 reply; 279+ messages in thread
From: Ben Hutchings @ 2012-09-29 19:01 UTC (permalink / raw)
  To: Sebastian Andrzej Siewior, Felipe Balbi
  Cc: linux-kernel, stable, alan, Greg Kroah-Hartman

[-- Attachment #1: Type: text/plain, Size: 1183 bytes --]

On Fri, 2012-09-28 at 11:50 -0700, Greg Kroah-Hartman wrote:
> From: Greg KH <gregkh@linuxfoundation.org>
> 
> 3.5-stable review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> From: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
> 
> commit 1b68a4ca2d038addb7314211d122fb6d7002b38b upstream.
> 
> If USB2 host controller probes fine but USB3 does not then we don't
> remove the USB controller properly and lock up the system while the HUB
> code will try to enumerate the USB2 controller and access memory which
> is no longer available in case the dummy_hcd was compiled as a module.
> 
> This is a problem since 448b6eb1 ("USB: Make sure to fetch the BOS desc
> for roothubs.) if used in USB3 mode because dummy does not provide this
> descriptor and explodes later.
[...]

i.e. for 3.5 (as noted in the cc: stable line).  But I don't see why
this isn't needed for earlier kernel versions.  The same broken error
handling is present.

Ben.

-- 
Ben Hutchings
Usenet is essentially a HUGE group of people passing notes in class.
                      - Rachel Kadel, `A Quick Guide to Newsgroup Etiquette'

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 828 bytes --]

^ permalink raw reply	[flat|nested] 279+ messages in thread

* Re: [ 080/262] usb: gadget: dummy_hcd: fixup error probe path
  2012-09-29 19:01   ` Ben Hutchings
@ 2012-09-30 12:30     ` Sebastian Andrzej Siewior
  0 siblings, 0 replies; 279+ messages in thread
From: Sebastian Andrzej Siewior @ 2012-09-30 12:30 UTC (permalink / raw)
  To: Ben Hutchings
  Cc: Felipe Balbi, linux-kernel, stable, alan, Greg Kroah-Hartman

On Sat, Sep 29, 2012 at 09:01:15PM +0200, Ben Hutchings wrote:
> > This is a problem since 448b6eb1 ("USB: Make sure to fetch the BOS desc
> > for roothubs.) if used in USB3 mode because dummy does not provide this
> > descriptor and explodes later.
> [...]
> 
> i.e. for 3.5 (as noted in the cc: stable line).  But I don't see why
> this isn't needed for earlier kernel versions.  The same broken error
> handling is present.

Hmmm. The error handling is broken since day 1 that is cdfcbd2c4a ("usb:
gadget: dummy_hcd: use the shared_hcd infrastructure") / v3.1-rc1.
Prior v3.5 it is unlikely that something fails here, I never noticed it.
However you are right: wrong is wrong and thefore it should be picked up to
v3.1.

> Ben.

Sebastian

^ permalink raw reply	[flat|nested] 279+ messages in thread

* Re: [ 174/262] x86, avx: dont use avx instructions with "noxsave" boot param
  2012-09-28 18:51 ` [ 174/262] x86, avx: dont use avx instructions with "noxsave" boot param Greg Kroah-Hartman
@ 2012-10-07 21:26   ` Ben Hutchings
  2012-10-07 23:55     ` H. Peter Anvin
  0 siblings, 1 reply; 279+ messages in thread
From: Ben Hutchings @ 2012-10-07 21:26 UTC (permalink / raw)
  To: Suresh Siddha, H. Peter Anvin
  Cc: linux-kernel, stable, alan, Greg Kroah-Hartman

[-- Attachment #1: Type: text/plain, Size: 1735 bytes --]

On Fri, 2012-09-28 at 11:51 -0700, Greg Kroah-Hartman wrote:
> From: Greg KH <gregkh@linuxfoundation.org>
> 
> 3.5-stable review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> From: Suresh Siddha <suresh.b.siddha@intel.com>
> 
> commit c6fd893da927c6cefb2ece22402765379921a834 upstream.
> 
> Clear AVX, AVX2 features along with clearing XSAVE feature bits,
> as part of the parsing "noxsave" parameter.
> 
> Fixes the kernel boot panic with "noxsave" boot parameter.
> 
> We could have checked cpu_has_osxsave along with cpu_has_avx etc, but Peter
> mentioned clearing the feature bits will be better for uses like
> static_cpu_has() etc.

This was marked as needed for 3.5 only - presumably because the kernel
wasn't using AVX before this - but don't we also need to clear these
bits even in earlier versions so userland knows not to use it?

Ben.

> Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
> Link: http://lkml.kernel.org/r/1343755754.2041.2.camel@sbsiddha-desk.sc.intel.com
> Signed-off-by: H. Peter Anvin <hpa@zytor.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> 
> ---
>  arch/x86/kernel/cpu/common.c |    2 ++
>  1 file changed, 2 insertions(+)
> 
> --- a/arch/x86/kernel/cpu/common.c
> +++ b/arch/x86/kernel/cpu/common.c
> @@ -144,6 +144,8 @@ static int __init x86_xsave_setup(char *
>  {
>  	setup_clear_cpu_cap(X86_FEATURE_XSAVE);
>  	setup_clear_cpu_cap(X86_FEATURE_XSAVEOPT);
> +	setup_clear_cpu_cap(X86_FEATURE_AVX);
> +	setup_clear_cpu_cap(X86_FEATURE_AVX2);
>  	return 1;
>  }
>  __setup("noxsave", x86_xsave_setup);


-- 
Ben Hutchings
You can't have everything.  Where would you put it?

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 828 bytes --]

^ permalink raw reply	[flat|nested] 279+ messages in thread

* Re: [ 174/262] x86, avx: dont use avx instructions with "noxsave" boot param
  2012-10-07 21:26   ` Ben Hutchings
@ 2012-10-07 23:55     ` H. Peter Anvin
  2012-10-08  1:15       ` Ben Hutchings
  0 siblings, 1 reply; 279+ messages in thread
From: H. Peter Anvin @ 2012-10-07 23:55 UTC (permalink / raw)
  To: Ben Hutchings, Suresh Siddha
  Cc: linux-kernel, stable, alan, Greg Kroah-Hartman

Userland should use a different query mechanism.  On the other hand, it will not hurt either.  On pre-xsave kernels AVX is a non-option.

Ben Hutchings <ben@decadent.org.uk> wrote:

>On Fri, 2012-09-28 at 11:51 -0700, Greg Kroah-Hartman wrote:
>> From: Greg KH <gregkh@linuxfoundation.org>
>> 
>> 3.5-stable review patch.  If anyone has any objections, please let me
>know.
>> 
>> ------------------
>> 
>> From: Suresh Siddha <suresh.b.siddha@intel.com>
>> 
>> commit c6fd893da927c6cefb2ece22402765379921a834 upstream.
>> 
>> Clear AVX, AVX2 features along with clearing XSAVE feature bits,
>> as part of the parsing "noxsave" parameter.
>> 
>> Fixes the kernel boot panic with "noxsave" boot parameter.
>> 
>> We could have checked cpu_has_osxsave along with cpu_has_avx etc, but
>Peter
>> mentioned clearing the feature bits will be better for uses like
>> static_cpu_has() etc.
>
>This was marked as needed for 3.5 only - presumably because the kernel
>wasn't using AVX before this - but don't we also need to clear these
>bits even in earlier versions so userland knows not to use it?
>
>Ben.
>
>> Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
>> Link:
>http://lkml.kernel.org/r/1343755754.2041.2.camel@sbsiddha-desk.sc.intel.com
>> Signed-off-by: H. Peter Anvin <hpa@zytor.com>
>> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>> 
>> ---
>>  arch/x86/kernel/cpu/common.c |    2 ++
>>  1 file changed, 2 insertions(+)
>> 
>> --- a/arch/x86/kernel/cpu/common.c
>> +++ b/arch/x86/kernel/cpu/common.c
>> @@ -144,6 +144,8 @@ static int __init x86_xsave_setup(char *
>>  {
>>  	setup_clear_cpu_cap(X86_FEATURE_XSAVE);
>>  	setup_clear_cpu_cap(X86_FEATURE_XSAVEOPT);
>> +	setup_clear_cpu_cap(X86_FEATURE_AVX);
>> +	setup_clear_cpu_cap(X86_FEATURE_AVX2);
>>  	return 1;
>>  }
>>  __setup("noxsave", x86_xsave_setup);

-- 
Sent from my mobile phone. Please excuse brevity and lack of formatting.

^ permalink raw reply	[flat|nested] 279+ messages in thread

* Re: [ 174/262] x86, avx: dont use avx instructions with "noxsave" boot param
  2012-10-07 23:55     ` H. Peter Anvin
@ 2012-10-08  1:15       ` Ben Hutchings
  0 siblings, 0 replies; 279+ messages in thread
From: Ben Hutchings @ 2012-10-08  1:15 UTC (permalink / raw)
  To: H. Peter Anvin
  Cc: Suresh Siddha, linux-kernel, stable, alan, Greg Kroah-Hartman

[-- Attachment #1: Type: text/plain, Size: 411 bytes --]

On Mon, 2012-10-08 at 07:55 +0800, H. Peter Anvin wrote:
> Userland should use a different query mechanism.  On the other hand,
> it will not hurt either.  On pre-xsave kernels AVX is a non-option.
[...]

OK, having looked at what the SDM says I agree that there shouldn't be a
problem for userland.

Ben.

-- 
Ben Hutchings
Who are all these weirdos? - David Bowie, about L-Space IRC channel #afp

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 828 bytes --]

^ permalink raw reply	[flat|nested] 279+ messages in thread

* Re: [ 243/262] NFS: Fix Oopses in nfs_lookup_revalidate and nfs4_lookup_revalidate
  2012-09-28 18:52 ` [ 243/262] NFS: Fix Oopses in nfs_lookup_revalidate and nfs4_lookup_revalidate Greg Kroah-Hartman
@ 2012-11-03 20:12   ` Myklebust, Trond
  2012-11-05  8:23     ` Greg Kroah-Hartman
  0 siblings, 1 reply; 279+ messages in thread
From: Myklebust, Trond @ 2012-11-03 20:12 UTC (permalink / raw)
  To: Greg Kroah-Hartman; +Cc: linux-kernel, stable, alan, Richard Ems, Brian Walker

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset="utf-8", Size: 4770 bytes --]

On Fri, 2012-09-28 at 11:52 -0700, Greg Kroah-Hartman wrote:
> From: Greg KH <gregkh@linuxfoundation.org>
> 
> 3.5-stable review patch.  If anyone has any objections, please let me know.


Hi Greg,

Can we please apply this patch to the older stable kernels too? I see
that Ben has already applied it to the 3.2 kernel, but it really wants
to go into 3.4 and 3.0 as well...

Thanks!
  Trond

> ------------------
> 
> From: Trond Myklebust <Trond.Myklebust@netapp.com>
> 
> [Fixed upstream as part of 0b728e1911c, but that's a much larger patch,
> this is only the nfs portion backported as needed.]
> 
> Fix the following Oops in 3.5.1:
> 
>  BUG: unable to handle kernel NULL pointer dereference at 0000000000000038
>  IP: [<ffffffffa03789cd>] nfs_lookup_revalidate+0x2d/0x480 [nfs]
>  PGD 337c63067 PUD 0
>  Oops: 0000 [#1] SMP
>  CPU 5
>  Modules linked in: nfs fscache nfsd lockd nfs_acl auth_rpcgss sunrpc af_packet binfmt_misc cpufreq_conservative cpufreq_userspace cpufreq_powersave dm_mod acpi_cpufreq mperf coretemp gpio_ich kvm_intel joydev kvm ioatdma hid_generic igb lpc_ich i7core_edac edac_core ptp serio_raw dca pcspkr i2c_i801 mfd_core sg pps_core usbhid crc32c_intel microcode button autofs4 uhci_hcd ttm drm_kms_helper drm i2c_algo_bit sysimgblt sysfillrect syscopyarea ehci_hcd usbcore usb_common scsi_dh_rdac scsi_dh_emc scsi_dh_hp_sw scsi_dh_alua scsi_dh edd fan ata_piix thermal processor thermal_sys
> 
>  Pid: 30431, comm: java Not tainted 3.5.1-2-default #1 Supermicro X8DTT/X8DTT
>  RIP: 0010:[<ffffffffa03789cd>]  [<ffffffffa03789cd>] nfs_lookup_revalidate+0x2d/0x480 [nfs]
>  RSP: 0018:ffff8801b418bd38  EFLAGS: 00010292
>  RAX: 00000000fffffff6 RBX: ffff88032016d800 RCX: 0000000000000020
>  RDX: ffffffff00000000 RSI: 0000000000000000 RDI: ffff8801824a7b00
>  RBP: ffff8801b418bdf8 R08: 7fffff0034323030 R09: fffffffff04c03ed
>  R10: ffff8801824a7b00 R11: 0000000000000002 R12: ffff8801824a7b00
>  R13: ffff8801824a7b00 R14: 0000000000000000 R15: ffff8803201725d0
>  FS:  00002b53a46cb700(0000) GS:ffff88033fc20000(0000) knlGS:0000000000000000
>  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>  CR2: 0000000000000038 CR3: 000000020a426000 CR4: 00000000000007e0
>  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
>  DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
>  Process java (pid: 30431, threadinfo ffff8801b418a000, task ffff8801b5d20600)
>  Stack:
>   ffff8801b418be44 ffff88032016d800 ffff8801b418bdf8 0000000000000000
>   ffff8801824a7b00 ffff8801b418bdd7 ffff8803201725d0 ffffffff8116a9c0
>   ffff8801b5c38dc0 0000000000000007 ffff88032016d800 0000000000000000
>  Call Trace:
>   [<ffffffff8116a9c0>] lookup_dcache+0x80/0xe0
>   [<ffffffff8116aa43>] __lookup_hash+0x23/0x90
>   [<ffffffff8116b4a5>] lookup_one_len+0xc5/0x100
>   [<ffffffffa03869a3>] nfs_sillyrename+0xe3/0x210 [nfs]
>   [<ffffffff8116cadf>] vfs_unlink.part.25+0x7f/0xe0
>   [<ffffffff8116f22c>] do_unlinkat+0x1ac/0x1d0
>   [<ffffffff815717b9>] system_call_fastpath+0x16/0x1b
>   [<00002b5348b5f527>] 0x2b5348b5f526
>  Code: ec 38 b8 f6 ff ff ff 4c 89 64 24 18 4c 89 74 24 28 49 89 fc 48 89 5c 24 08 48 89 6c 24 10 49 89 f6 4c 89 6c 24 20 4c 89 7c 24 30 <f6> 46 38 40 0f 85 d1 00 00 00 e8 c4 c4 df e0 48 8b 58 30 49 89
>  RIP  [<ffffffffa03789cd>] nfs_lookup_revalidate+0x2d/0x480 [nfs]
>   RSP <ffff8801b418bd38>
>  CR2: 0000000000000038
>  ---[ end trace 845113ed191985dd ]---
> 
> This Oops affects 3.5 kernels and older, and is due to lookup_one_len()
> calling down to the dentry revalidation code with a NULL pointer
> to struct nameidata.
> 
> It is fixed upstream by commit 0b728e1911c (stop passing nameidata *
> to ->d_revalidate())
> 
> Reported-by: Richard Ems <richard.ems@cape-horn-eng.com>
> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
>  fs/nfs/dir.c |    4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> --- a/fs/nfs/dir.c
> +++ b/fs/nfs/dir.c
> @@ -1123,7 +1123,7 @@ static int nfs_lookup_revalidate(struct
>  	struct nfs_fattr *fattr = NULL;
>  	int error;
>  
> -	if (nd->flags & LOOKUP_RCU)
> +	if (nd && (nd->flags & LOOKUP_RCU))
>  		return -ECHILD;
>  
>  	parent = dget_parent(dentry);
> @@ -1526,7 +1526,7 @@ static int nfs4_lookup_revalidate(struct
>  	struct inode *dir;
>  	int openflags, ret = 0;
>  
> -	if (nd->flags & LOOKUP_RCU)
> +	if (nd && (nd->flags & LOOKUP_RCU))
>  		return -ECHILD;
>  
>  	inode = dentry->d_inode;
> 
> 

-- 
Trond Myklebust
Linux NFS client maintainer

NetApp
Trond.Myklebust@netapp.com
www.netapp.com
ÿôèº{.nÇ+‰·Ÿ®‰­†+%ŠËÿ±éݶ\x17¥Šwÿº{.nÇ+‰·¥Š{±þG«éÿŠ{ayº\x1dʇڙë,j\a­¢f£¢·hšïêÿ‘êçz_è®\x03(­éšŽŠÝ¢j"ú\x1a¶^[m§ÿÿ¾\a«þG«éÿ¢¸?™¨è­Ú&£ø§~á¶iO•æ¬z·švØ^\x14\x04\x1a¶^[m§ÿÿÃ\fÿ¶ìÿ¢¸?–I¥

^ permalink raw reply	[flat|nested] 279+ messages in thread

* Re: [ 243/262] NFS: Fix Oopses in nfs_lookup_revalidate and nfs4_lookup_revalidate
  2012-11-03 20:12   ` Myklebust, Trond
@ 2012-11-05  8:23     ` Greg Kroah-Hartman
  2012-11-05 15:37       ` Greg Kroah-Hartman
  0 siblings, 1 reply; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-11-05  8:23 UTC (permalink / raw)
  To: Myklebust, Trond; +Cc: linux-kernel, stable, alan, Richard Ems, Brian Walker

On Sat, Nov 03, 2012 at 08:12:28PM +0000, Myklebust, Trond wrote:
> On Fri, 2012-09-28 at 11:52 -0700, Greg Kroah-Hartman wrote:
> > From: Greg KH <gregkh@linuxfoundation.org>
> > 
> > 3.5-stable review patch.  If anyone has any objections, please let me know.
> 
> 
> Hi Greg,
> 
> Can we please apply this patch to the older stable kernels too? I see
> that Ben has already applied it to the 3.2 kernel, but it really wants
> to go into 3.4 and 3.0 as well...

Ok, I'll queue this up for the next round of releases.

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 279+ messages in thread

* Re: [ 243/262] NFS: Fix Oopses in nfs_lookup_revalidate and nfs4_lookup_revalidate
  2012-11-05  8:23     ` Greg Kroah-Hartman
@ 2012-11-05 15:37       ` Greg Kroah-Hartman
  0 siblings, 0 replies; 279+ messages in thread
From: Greg Kroah-Hartman @ 2012-11-05 15:37 UTC (permalink / raw)
  To: Myklebust, Trond; +Cc: linux-kernel, stable, alan, Richard Ems, Brian Walker

On Mon, Nov 05, 2012 at 09:23:05AM +0100, Greg Kroah-Hartman wrote:
> On Sat, Nov 03, 2012 at 08:12:28PM +0000, Myklebust, Trond wrote:
> > On Fri, 2012-09-28 at 11:52 -0700, Greg Kroah-Hartman wrote:
> > > From: Greg KH <gregkh@linuxfoundation.org>
> > > 
> > > 3.5-stable review patch.  If anyone has any objections, please let me know.
> > 
> > 
> > Hi Greg,
> > 
> > Can we please apply this patch to the older stable kernels too? I see
> > that Ben has already applied it to the 3.2 kernel, but it really wants
> > to go into 3.4 and 3.0 as well...
> 
> Ok, I'll queue this up for the next round of releases.

Now applied, thanks.

greg k-h

^ permalink raw reply	[flat|nested] 279+ messages in thread

end of thread, other threads:[~2012-11-05 15:37 UTC | newest]

Thread overview: 279+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-09-28 18:48 [ 000/262] 3.5.5-stable review Greg Kroah-Hartman
2012-09-28 18:48 ` [ 001/262] codel: refine one condition to avoid a nul rec_inv_sqrt Greg Kroah-Hartman
2012-09-28 18:48 ` [ 002/262] net: Allow driver to limit number of GSO segments per skb Greg Kroah-Hartman
2012-09-28 18:48 ` [ 003/262] sfc: Fix maximum number of TSO segments and minimum TX queue size Greg Kroah-Hartman
2012-09-28 18:48 ` [ 004/262] tcp: Apply device TSO segment limit earlier Greg Kroah-Hartman
2012-09-28 18:48 ` [ 005/262] net_sched: gact: Fix potential panic in tcf_gact() Greg Kroah-Hartman
2012-09-28 18:48 ` [ 006/262] isdnloop: fix and simplify isdnloop_init() Greg Kroah-Hartman
2012-09-28 18:48 ` [ 007/262] pptp: lookup route with the proper net namespace Greg Kroah-Hartman
2012-09-28 18:48 ` [ 008/262] net/core: Fix potential memory leak in dev_set_alias() Greg Kroah-Hartman
2012-09-28 18:48 ` [ 009/262] af_packet: remove BUG statement in tpacket_destruct_skb Greg Kroah-Hartman
2012-09-28 18:48 ` [ 010/262] ipv6: addrconf: Avoid calling netdevice notifiers with RCU read-side lock Greg Kroah-Hartman
2012-09-28 18:49 ` [ 011/262] atm: fix info leak in getsockopt(SO_ATMPVC) Greg Kroah-Hartman
2012-09-28 18:49 ` [ 012/262] atm: fix info leak via getsockname() Greg Kroah-Hartman
2012-09-28 18:49 ` [ 013/262] Bluetooth: HCI - Fix info leak in getsockopt(HCI_FILTER) Greg Kroah-Hartman
2012-09-28 18:49 ` [ 014/262] Bluetooth: HCI - Fix info leak via getsockname() Greg Kroah-Hartman
2012-09-28 18:49 ` [ 015/262] Bluetooth: RFCOMM - Fix info leak in getsockopt(BT_SECURITY) Greg Kroah-Hartman
2012-09-28 18:49 ` [ 016/262] Bluetooth: RFCOMM - Fix info leak in ioctl(RFCOMMGETDEVLIST) Greg Kroah-Hartman
2012-09-28 18:49 ` [ 017/262] Bluetooth: RFCOMM - Fix info leak via getsockname() Greg Kroah-Hartman
2012-09-28 18:49 ` [ 018/262] Bluetooth: L2CAP " Greg Kroah-Hartman
2012-09-28 18:49 ` [ 019/262] l2tp: fix " Greg Kroah-Hartman
2012-09-28 18:49 ` [ 020/262] llc: " Greg Kroah-Hartman
2012-09-28 18:49 ` [ 021/262] dccp: fix info leak via getsockopt(DCCP_SOCKOPT_CCID_TX_INFO) Greg Kroah-Hartman
2012-09-28 18:49 ` [ 022/262] ipvs: fix info leak in getsockopt(IP_VS_SO_GET_TIMEOUT) Greg Kroah-Hartman
2012-09-28 18:49 ` [ 023/262] net: fix info leak in compat dev_ifconf() Greg Kroah-Hartman
2012-09-28 18:49 ` [ 024/262] af_packet: dont emit packet on orig fanout group Greg Kroah-Hartman
2012-09-28 18:49 ` [ 025/262] af_netlink: force credentials passing [CVE-2012-3520] Greg Kroah-Hartman
2012-09-28 18:49 ` [ 026/262] netlink: fix possible spoofing from non-root processes Greg Kroah-Hartman
2012-09-28 18:49 ` [ 027/262] tcp: fix cwnd reduction for non-sack recovery Greg Kroah-Hartman
2012-09-28 18:49 ` [ 028/262] sfc: Fix reporting of IPv4 full filters through ethtool Greg Kroah-Hartman
2012-09-28 18:49 ` [ 029/262] gianfar: fix default tx vlan offload feature flag Greg Kroah-Hartman
2012-09-28 18:49 ` [ 030/262] l2tp: avoid to use synchronize_rcu in tunnel free function Greg Kroah-Hartman
2012-09-28 18:49 ` [ 031/262] net: ipv4: ipmr_expire_timer causes crash when removing net namespace Greg Kroah-Hartman
2012-09-28 18:49 ` [ 032/262] bnx2x: fix 57840_MF pci id Greg Kroah-Hartman
2012-09-28 18:49 ` [ 033/262] cs89x0 : packet reception not working Greg Kroah-Hartman
2012-09-28 18:49 ` [ 034/262] openvswitch: Reset upper layer protocol info on internal devices Greg Kroah-Hartman
2012-09-28 18:49 ` [ 035/262] workqueue: reimplement work_on_cpu() using system_wq Greg Kroah-Hartman
2012-09-28 18:49 ` [ 036/262] cpufreq/powernow-k8: workqueue user shouldnt migrate the kworker to another CPU Greg Kroah-Hartman
2012-09-28 18:49 ` [ 037/262] cciss: fix handling of protocol error Greg Kroah-Hartman
2012-09-28 18:49 ` [ 038/262] vfs: make O_PATH file descriptors usable for fstat() Greg Kroah-Hartman
2012-09-28 18:49 ` [ 039/262] vfs: dcache: use DCACHE_DENTRY_KILLED instead of DCACHE_DISCONNECTED in d_kill() Greg Kroah-Hartman
2012-09-28 18:49 ` [ 040/262] netconsole: remove a redundant netconsole_target_put() Greg Kroah-Hartman
2012-09-28 18:49 ` [ 041/262] eCryptfs: Copy up attributes of the lower target inode after rename Greg Kroah-Hartman
2012-09-28 18:49 ` [ 042/262] target: Fix ->data_length re-assignment bug with SCSI overflow Greg Kroah-Hartman
2012-09-28 18:49 ` [ 043/262] target: simplify code around transport_get_sense_data Greg Kroah-Hartman
2012-09-28 18:49 ` [ 044/262] ARM: 7496/1: hw_breakpoint: dont rely on dfsr to show watchpoint access type Greg Kroah-Hartman
2012-09-28 18:49 ` [ 045/262] ARM: 7501/1: decompressor: reset ttbcr for VMSA ARMv7 cores Greg Kroah-Hartman
2012-09-29 12:25   ` Ben Hutchings
2012-09-28 18:49 ` [ 046/262] ARM: 7513/1: Make sure dtc is built before running it Greg Kroah-Hartman
2012-09-28 18:49 ` [ 047/262] ARM: 7526/1: traps: send SIGILL if get_user fails on undef handling path Greg Kroah-Hartman
2012-09-28 18:49 ` [ 048/262] ARM: 7527/1: uaccess: explicitly check __user pointer when !CPU_USE_DOMAINS Greg Kroah-Hartman
2012-09-28 18:49 ` [ 049/262] Staging: Android alarm: IOCTL command encoding fix Greg Kroah-Hartman
2012-09-28 18:49 ` [ 050/262] ARM: OMAP: timer: obey the !CONFIG_OMAP_32K_TIMER Greg Kroah-Hartman
2012-09-28 18:49 ` [ 051/262] ARM: clk-imx25: Fix SSI clock registration Greg Kroah-Hartman
2012-09-28 18:49 ` [ 052/262] ARM: clk-imx35: " Greg Kroah-Hartman
2012-09-28 18:49 ` [ 053/262] ARM: Fix ioremap() of address zero Greg Kroah-Hartman
2012-09-28 18:49 ` [ 054/262] ALSA: hda - Fix missing Master volume for STAC9200/925x Greg Kroah-Hartman
2012-09-28 18:49 ` [ 055/262] ALSA: usb-audio: Fix bogus error messages for delay accounting Greg Kroah-Hartman
2012-09-28 18:49 ` [ 056/262] ALSA: hda - Fix Oops at codec reset/reconfig Greg Kroah-Hartman
2012-09-28 18:49 ` [ 057/262] ALSA: ice1724: Use linear scale for AK4396 volume control Greg Kroah-Hartman
2012-09-28 18:49 ` [ 058/262] ALSA: hda - Workaround for silent output on VAIO Z with ALC889 Greg Kroah-Hartman
2012-09-28 18:49 ` [ 059/262] Staging: speakup: fix an improperly-declared variable Greg Kroah-Hartman
2012-09-28 18:49 ` [ 060/262] staging: zcache: fix cleancache race condition with shrinker Greg Kroah-Hartman
2012-09-28 18:49 ` [ 061/262] staging: vt6656: [BUG] - Failed connection, incorrect endian Greg Kroah-Hartman
2012-09-28 18:49 ` [ 062/262] staging: r8712u: fix bug in r8712_recv_indicatepkt() Greg Kroah-Hartman
2012-09-28 18:49 ` [ 063/262] staging: comedi: amplc_pci224: Fix PCI ref count Greg Kroah-Hartman
2012-09-28 18:49 ` [ 064/262] staging: comedi: das08: Correct AO output for das08jr-16-ao Greg Kroah-Hartman
2012-09-28 18:49 ` [ 065/262] staging: comedi: das08: Correct AI encoding " Greg Kroah-Hartman
2012-09-28 18:49 ` [ 066/262] USB: option: replace ZTE K5006-Z entry with vendor class rule Greg Kroah-Hartman
2012-09-28 18:49 ` [ 067/262] fs/proc: fix potential unregister_sysctl_table hang Greg Kroah-Hartman
2012-09-28 18:49 ` [ 068/262] sound: tegra_alc5632: remove HP detect GPIO inversion Greg Kroah-Hartman
2012-09-28 18:49 ` [ 069/262] perf_event: Switch to internal refcount, fix race with close() Greg Kroah-Hartman
2012-09-28 18:49 ` [ 070/262] ACPI / PM: Infer parent power state from child if unknown, v2 Greg Kroah-Hartman
2012-09-28 18:50 ` [ 071/262] ACPI / PM: Fix resource_lock dead lock in acpi_power_on_device Greg Kroah-Hartman
2012-09-28 18:50 ` [ 072/262] ACPI / PM: Use KERN_DEBUG when no power resources are found Greg Kroah-Hartman
2012-09-28 18:50 ` [ 073/262] mmc: mxs-mmc: fix deadlock in SDIO IRQ case Greg Kroah-Hartman
2012-09-28 18:50 ` [ 074/262] mmc: mxs-mmc: fix deadlock caused by recursion loop Greg Kroah-Hartman
2012-09-29  7:28   ` Attila Kinali
2012-09-28 18:50 ` [ 075/262] mmc: sdhci-esdhc: break out early if clock is 0 Greg Kroah-Hartman
2012-09-28 18:50 ` [ 076/262] mmc: atmel-mci: not busy flag has also to be used for read operations Greg Kroah-Hartman
2012-09-28 18:50 ` [ 077/262] mmc: card: Skip secure erase on MoviNAND; causes unrecoverable corruption Greg Kroah-Hartman
2012-09-28 18:50 ` [ 078/262] oprofile, s390: Fix uninitialized memory access when writing to oprofilefs Greg Kroah-Hartman
2012-09-28 18:50 ` [ 079/262] usb: chipidea: udc: add pullup fuction, needed by the uvc gadget Greg Kroah-Hartman
2012-09-28 18:50 ` [ 080/262] usb: gadget: dummy_hcd: fixup error probe path Greg Kroah-Hartman
2012-09-29 19:01   ` Ben Hutchings
2012-09-30 12:30     ` Sebastian Andrzej Siewior
2012-09-28 18:50 ` [ 081/262] usb: gadget: dummy_hcd: add support for USB_DT_BOS on rh Greg Kroah-Hartman
2012-09-28 18:50 ` [ 082/262] usb: gadget: at91udc: dont overwrite driver data Greg Kroah-Hartman
2012-09-28 18:50 ` [ 083/262] usb: gadget: at91udc: Dont check for ep->ep.desc Greg Kroah-Hartman
2012-09-28 18:50 ` [ 084/262] ahci: Add alternate identifier for the 88SE9172 Greg Kroah-Hartman
2012-09-28 18:50 ` [ 085/262] kobject: fix oops with "input0: bad kobj_uevent_env content in show_uevent()" Greg Kroah-Hartman
2012-09-28 18:50 ` [ 086/262] dyndbg: fix for SOH in logging messages Greg Kroah-Hartman
2012-09-28 18:50 ` [ 087/262] Redefine ATOMIC_INIT and ATOMIC64_INIT to drop the casts Greg Kroah-Hartman
2012-09-28 18:50 ` [ 088/262] digsig: add hash size comparision on signature verification Greg Kroah-Hartman
2012-09-28 18:50 ` [ 089/262] SUNRPC: Fix a UDP transport regression Greg Kroah-Hartman
2012-09-28 19:46   ` Myklebust, Trond
2012-09-28 21:05     ` Greg Kroah-Hartman
2012-09-28 18:50 ` [ 090/262] md: Dont truncate size at 4TB for RAID0 and Linear Greg Kroah-Hartman
2012-09-28 18:50 ` [ 091/262] md/raid10: fix problem with on-stack allocation of r10bio structure Greg Kroah-Hartman
2012-09-28 18:50 ` [ 092/262] md: make sure metadata is updated when spares are activated or removed Greg Kroah-Hartman
2012-09-28 18:50 ` [ 093/262] md/raid5: fix calculate of degraded when a replacement becomes active Greg Kroah-Hartman
2012-09-28 18:50 ` [ 094/262] nbd: clear waiting_queue on shutdown Greg Kroah-Hartman
2012-09-28 18:50 ` [ 095/262] ASoC: samsung dma - Dont indicate support for pause/resume Greg Kroah-Hartman
2012-09-28 18:50 ` [ 096/262] mm/page_alloc: fix the page address of higher pages buddy calculation Greg Kroah-Hartman
2012-09-28 18:50 ` [ 097/262] drivers/rtc/rtc-twl.c: ensure all interrupts are disabled during probe Greg Kroah-Hartman
2012-09-28 18:50 ` [ 098/262] hwmon: (twl4030-madc-hwmon) Initialize uninitialized structure elements Greg Kroah-Hartman
2012-09-28 18:50 ` [ 099/262] hwmon: (ina2xx) Fix word size register read and write operations Greg Kroah-Hartman
2012-09-28 18:50 ` [ 100/262] sched: Add missing call to calc_load_exit_idle() Greg Kroah-Hartman
2012-09-28 18:50 ` [ 101/262] gma500: Fix regression on Oaktrail devices Greg Kroah-Hartman
2012-09-28 18:50 ` [ 102/262] mISDN: Fix wrong usage of flush_work_sync while holding locks Greg Kroah-Hartman
2012-09-28 18:50 ` [ 103/262] can: mcp251x: avoid repeated frame bug Greg Kroah-Hartman
2012-09-28 18:50 ` [ 104/262] mm/ia64: fix a memory block size bug Greg Kroah-Hartman
2012-09-28 18:50 ` [ 105/262] memory hotplug: fix section info double registration bug Greg Kroah-Hartman
2012-09-28 18:50 ` [ 106/262] xen/m2p: do not reuse kmap_op->dev_bus_addr Greg Kroah-Hartman
2012-09-28 18:50 ` [ 107/262] xen/boot: Disable BIOS SMP MP table search Greg Kroah-Hartman
2012-09-28 18:50 ` [ 108/262] xen/boot: Disable NUMA for PV guests Greg Kroah-Hartman
2012-09-28 18:50 ` [ 109/262] hwmon: (fam15h_power) Tweak runavg_range on resume Greg Kroah-Hartman
2012-09-28 18:50 ` [ 110/262] hwmon: (ads7871) Add name sysfs attribute Greg Kroah-Hartman
2012-09-28 18:50 ` [ 111/262] hwmon: (ad7314) " Greg Kroah-Hartman
2012-09-28 18:50 ` [ 112/262] dj: memory scribble in logi_dj Greg Kroah-Hartman
2012-09-28 18:50 ` [ 113/262] HID: Fix logitech-dj: missing Unifying device issue Greg Kroah-Hartman
2012-09-28 18:50 ` [ 114/262] cifs: fix return value in cifsConvertToUTF16 Greg Kroah-Hartman
2012-09-28 18:50 ` [ 115/262] vmwgfx: add dumb ioctl support Greg Kroah-Hartman
2012-09-28 18:50 ` [ 116/262] net: usbnet: fix softirq storm on suspend Greg Kroah-Hartman
2012-09-28 18:50 ` [ 117/262] ibmveth: Fix alignment of rx queue bug Greg Kroah-Hartman
2012-09-28 18:50 ` [ 118/262] mac80211: clear bssid on auth/assoc failure Greg Kroah-Hartman
2012-09-28 18:50 ` [ 119/262] brcmfmac: fix big endian bug in i-scan Greg Kroah-Hartman
2012-09-28 18:50 ` [ 120/262] brcmfmac: Fix big endian host configuration data Greg Kroah-Hartman
2012-09-28 18:50 ` [ 121/262] SCSI: lpfc: fix problems with -Werror Greg Kroah-Hartman
2012-09-28 18:50 ` [ 122/262] SCSI: mpt2sas: Fix for issue - Unable to boot from the drive connected to HBA Greg Kroah-Hartman
2012-09-28 18:50 ` [ 123/262] SCSI: bnx2i: Fixed NULL ptr deference for 1G bnx2 Linux iSCSI offload Greg Kroah-Hartman
2012-09-28 18:50 ` [ 124/262] SCSI: hpsa: fix handling of protocol error Greg Kroah-Hartman
2012-09-28 18:50 ` [ 125/262] SCSI: scsi: virtio-scsi: Fix address translation failure of HighMem pages used by sg list Greg Kroah-Hartman
2012-09-28 18:50 ` [ 126/262] Bluetooth: mgmt: Fix enabling SSP while powered off Greg Kroah-Hartman
2012-09-28 18:50 ` [ 127/262] Bluetooth: Fix not removing power_off delayed work Greg Kroah-Hartman
2012-09-28 18:50 ` [ 128/262] Bluetooth: mgmt: Fix enabling LE while powered off Greg Kroah-Hartman
2012-09-28 18:50 ` [ 129/262] c/r: prctl: fix build error for no-MMU case Greg Kroah-Hartman
2012-09-28 18:50 ` [ 130/262] hpwdt: Fix kdump issue in hpwdt Greg Kroah-Hartman
2012-09-28 18:51 ` [ 131/262] ARM: imx: armadillo5x0: Fix illegal register access Greg Kroah-Hartman
2012-09-28 18:51 ` [ 132/262] ARM: 7532/1: decompressor: reset SCTLR.TRE for VMSA ARMv7 cores Greg Kroah-Hartman
2012-09-28 18:51 ` [ 133/262] tracing: Dont call page_to_pfn() if page is NULL Greg Kroah-Hartman
2012-09-28 18:51 ` [ 134/262] Input: i8042 - disable mux on Toshiba C850D Greg Kroah-Hartman
2012-09-28 18:51 ` [ 135/262] MIPS: mm: Add compound tail page _mapcount when mapped Greg Kroah-Hartman
2012-09-28 18:51 ` [ 136/262] perf/x86/ibs: Check syscall attribute flags Greg Kroah-Hartman
2012-09-28 18:51 ` [ 137/262] rtlwifi: rtl8192ce: Log message that B_CUT device may not work Greg Kroah-Hartman
2012-09-28 18:51 ` [ 138/262] asix: Support DLink DUB-E100 H/W Ver C1 Greg Kroah-Hartman
2012-09-28 18:51 ` [ 139/262] can: ti_hecc: fix oops during rmmod Greg Kroah-Hartman
2012-09-28 18:51 ` [ 140/262] can: janz-ican3: fix support for older hardware revisions Greg Kroah-Hartman
2012-09-28 18:51 ` [ 141/262] cfg80211: fix possible circular lock on reg_regdb_search() Greg Kroah-Hartman
2012-09-28 18:51 ` [ 142/262] DMA: PL330: Fix potential NULL pointer dereference in pl330_submit_req() Greg Kroah-Hartman
2012-09-28 18:51 ` [ 143/262] DMA: PL330: Check the pointer returned by kzalloc Greg Kroah-Hartman
2012-09-28 18:51 ` [ 144/262] dmaengine: at_hdmac: fix comment in atc_prep_slave_sg() Greg Kroah-Hartman
2012-09-28 18:51 ` [ 145/262] dmaengine: at_hdmac: check that each sg data length is non-null Greg Kroah-Hartman
2012-09-28 18:51 ` [ 146/262] rt2x00: Identify ASUS USB-N53 device Greg Kroah-Hartman
2012-09-28 18:51 ` [ 147/262] rt2x00: Fix word size of rt2500usb MAC_CSR19 register Greg Kroah-Hartman
2012-09-28 18:51 ` [ 148/262] rt2x00: Fix rfkill polling prior to interface start Greg Kroah-Hartman
2012-09-28 18:51 ` [ 149/262] NFS: Fix the initialisation of the readdir cookieverf array Greg Kroah-Hartman
2012-09-28 18:51 ` [ 150/262] NFS: Fix a problem with the legacy binary mount code Greg Kroah-Hartman
2012-09-28 18:51 ` [ 151/262] NFS: return error from decode_getfh in decode open Greg Kroah-Hartman
2012-09-28 18:51 ` [ 152/262] EHCI: Update qTD next pointer in QH overlay region during unlink Greg Kroah-Hartman
2012-09-28 18:51 ` [ 153/262] USB: ftdi_sio: PID for NZR SEM 16+ USB Greg Kroah-Hartman
2012-09-28 18:51 ` [ 154/262] USB: ftdi_sio: do not claim CDC ACM function Greg Kroah-Hartman
2012-09-28 18:51 ` [ 155/262] USB: ftdi-sio: add support for more Physik Instrumente devices Greg Kroah-Hartman
2012-09-28 18:51 ` [ 156/262] usb: chipidea: udc: fix setup of endpoint maxpacket size Greg Kroah-Hartman
2012-09-28 18:51 ` [ 157/262] usb: chipidea: udc: dont stall endpoint if request list is empty in isr_tr_complete_low Greg Kroah-Hartman
2012-09-28 18:51 ` [ 158/262] usb: dwc3: ep0: correct cache sync issue in case of ep0_bounced Greg Kroah-Hartman
2012-09-28 18:51 ` [ 159/262] usb: dwc3: core: fix incorrect usage of resource pointer Greg Kroah-Hartman
2012-09-28 18:51 ` [ 160/262] USB: cdc-wdm: fix wdm_find_device* return value Greg Kroah-Hartman
2012-09-28 18:51 ` [ 161/262] USB: ohci-at91: fix PIO handling in relation with number of ports Greg Kroah-Hartman
2012-09-28 18:51 ` [ 162/262] USB: add device quirk for Joss Optical touchboard Greg Kroah-Hartman
2012-09-28 18:51 ` [ 163/262] rt2800usb: Added rx packet length validity check Greg Kroah-Hartman
2012-09-28 18:51 ` [ 164/262] usb: host: xhci: Fix Compliance Mode on SN65LVPE502CP Hardware Greg Kroah-Hartman
2012-09-28 18:51 ` [ 165/262] Intel xhci: Only switch the switchable ports Greg Kroah-Hartman
2012-09-28 18:51 ` [ 166/262] usb: host: xhci-plat: use ioremap_nocache Greg Kroah-Hartman
2012-09-28 18:51 ` [ 167/262] xhci: Fix a logical vs bitwise AND bug Greg Kroah-Hartman
2012-09-28 18:51 ` [ 168/262] xhci: Make handover code more robust Greg Kroah-Hartman
2012-09-28 18:51 ` [ 169/262] xhci: Recognize USB 3.0 devices as superspeed at powerup Greg Kroah-Hartman
2012-09-28 18:51 ` [ 170/262] usb: host: xhci: fix compilation error for non-PCI based stacks Greg Kroah-Hartman
2012-09-28 18:51 ` [ 171/262] tty: serial: imx: console write routing is unsafe on SMP Greg Kroah-Hartman
2012-09-28 18:51 ` [ 172/262] tty: serial: imx: dont reinit clock in imx_setup_ufcr() Greg Kroah-Hartman
2012-09-28 18:51 ` [ 173/262] mutex: Place lock in contended state after fastpath_lock failure Greg Kroah-Hartman
2012-09-28 19:26   ` Nicolas Pitre
2012-09-28 21:05     ` Greg Kroah-Hartman
2012-09-28 21:16       ` Nicolas Pitre
2012-09-28 21:27         ` Greg Kroah-Hartman
2012-09-28 18:51 ` [ 174/262] x86, avx: dont use avx instructions with "noxsave" boot param Greg Kroah-Hartman
2012-10-07 21:26   ` Ben Hutchings
2012-10-07 23:55     ` H. Peter Anvin
2012-10-08  1:15       ` Ben Hutchings
2012-09-28 18:51 ` [ 175/262] drivers/rtc/rtc-rs5c348.c: fix hour decoding in 12-hour mode Greg Kroah-Hartman
2012-09-28 18:51 ` [ 176/262] PM / Runtime: Fix rpm_resume() return value for power.no_callbacks set Greg Kroah-Hartman
2012-09-28 18:51 ` [ 177/262] PM / Runtime: Clear power.deferred_resume on success in rpm_suspend() Greg Kroah-Hartman
2012-09-28 18:51 ` [ 178/262] PM / Runtime: Check device PM QoS setting before "no callbacks" check Greg Kroah-Hartman
2012-09-28 18:51 ` [ 179/262] drivers/misc/sgi-xp/xpc_uv.c: SGI XPC fails to load when cpu 0 is out of IRQ resources Greg Kroah-Hartman
2012-09-28 18:51 ` [ 180/262] fbcon: fix race condition between console lock and cursor timer (v1.1) Greg Kroah-Hartman
2012-09-28 18:51 ` [ 181/262] drm/radeon: avoid turning off spread spectrum for used pll Greg Kroah-Hartman
2012-09-28 18:51 ` [ 182/262] drm/radeon/ss: use num_crtc rather than hardcoded 6 Greg Kroah-Hartman
2012-09-28 18:51 ` [ 183/262] drm/radeon: fence virtual address and free it once idle v4 Greg Kroah-Hartman
2012-09-28 18:51 ` [ 184/262] drm/radeon: split ATRM support out from the ATPX handler (v3) Greg Kroah-Hartman
2012-09-28 18:51 ` [ 185/262] drm/radeon: implement ACPI VFCT vbios fetch (v3) Greg Kroah-Hartman
2012-09-28 18:51 ` [ 186/262] drm/radeon/kms: extend the Fujitsu D3003-S2 board connector quirk to cover later silicon stepping Greg Kroah-Hartman
2012-09-28 18:51 ` [ 187/262] drm/radeon: init lockup timeout on ring init Greg Kroah-Hartman
2012-09-28 18:51 ` [ 188/262] drm/i915: extract connector update from intel_ddc_get_modes() for reuse Greg Kroah-Hartman
2012-09-28 18:51 ` [ 189/262] drm/i915: fall back to bit-banging if GMBUS fails in CRT EDID reads Greg Kroah-Hartman
2012-09-28 18:51 ` [ 190/262] drm/i915: use hsw rps tuning values everywhere on gen6+ Greg Kroah-Hartman
2012-09-28 18:52 ` [ 191/262] asus-laptop: HRWS/HWRS typo Greg Kroah-Hartman
2012-09-28 18:52 ` [ 192/262] drm: Add EDID_QUIRK_FORCE_REDUCED_BLANKING for ASUS VW222S Greg Kroah-Hartman
2012-09-28 18:52 ` [ 193/262] asus-nb-wmi: add some video toggle keys Greg Kroah-Hartman
2012-09-28 18:52 ` [ 194/262] drm: Check for invalid cursor flags Greg Kroah-Hartman
2012-09-28 18:52 ` [ 195/262] drm/nvc0/copy: check PUNITS to determine which copy engines are disabled Greg Kroah-Hartman
2012-09-28 18:52 ` [ 196/262] drm/radeon/atom: rework DIG modesetting on DCE3+ Greg Kroah-Hartman
2012-09-28 18:52 ` [ 197/262] drm/radeon/atom: powergating fixes for DCE6 Greg Kroah-Hartman
2012-09-28 18:52 ` [ 198/262] drm/i915: fix wrong order of parameters in port checking functions Greg Kroah-Hartman
2012-09-28 18:52 ` [ 199/262] drm/radeon: convert radeon vfct code to use acpi_get_table_with_size Greg Kroah-Hartman
2012-09-28 18:52 ` [ 200/262] drm/radeon: dont disable plls that are in use by other crtcs Greg Kroah-Hartman
2012-09-28 18:52 ` [ 201/262] drm/radeon: force dma32 to fix regression rs4xx,rs6xx,rs740 Greg Kroah-Hartman
2012-09-28 18:52 ` [ 202/262] drm/radeon: fix dig encoder selection on DCE61 Greg Kroah-Hartman
2012-09-28 18:52 ` [ 203/262] drm/radeon: make 64bit fences more robust v3 Greg Kroah-Hartman
2012-09-28 18:52 ` [ 204/262] drm/nouveau: fix booting with plymouth + dumb support Greg Kroah-Hartman
2012-09-28 18:52 ` [ 205/262] drm/i915: set the right gen3 flip_done mode also at resume Greg Kroah-Hartman
2012-09-28 18:52 ` [ 206/262] drm/i915: enable lvds pin pairs before dpll on gen2 Greg Kroah-Hartman
2012-09-28 18:52 ` [ 207/262] drm/i915: HDMI - Clear Audio Enable bit for Hot Plug Greg Kroah-Hartman
2012-09-28 18:52 ` [ 208/262] drm/i915: Reduce a pin-leak BUG into a WARN Greg Kroah-Hartman
2012-09-28 18:52 ` [ 209/262] drm/nv86/fifo: suspend fix Greg Kroah-Hartman
2012-09-28 18:52 ` [ 210/262] iwlwifi: dont double free the interrupt in failure path Greg Kroah-Hartman
2012-09-28 18:52 ` [ 211/262] iwlwifi: protect SRAM debugfs Greg Kroah-Hartman
2012-09-28 18:52 ` [ 212/262] iwlwifi: fix flow handler debug code Greg Kroah-Hartman
2012-09-28 18:52 ` [ 213/262] gianfar: fix phc index build failure Greg Kroah-Hartman
2012-09-28 18:52 ` [ 214/262] workqueue: UNBOUND -> REBIND morphing in rebind_workers() should be atomic Greg Kroah-Hartman
2012-09-28 18:52 ` [ 215/262] Input: wacom - add support to Cintiq 22HD Greg Kroah-Hartman
2012-09-28 18:52 ` [ 216/262] Input: wacom - rearrange type enum Greg Kroah-Hartman
2012-09-28 18:52 ` [ 217/262] Bluetooth: btusb: Add vendor specific ID (0a5c:21f4) BCM20702A0 Greg Kroah-Hartman
2012-09-28 18:52 ` [ 218/262] Bluetooth: add support for atheros 0489:e057 Greg Kroah-Hartman
2012-09-28 18:52 ` [ 219/262] Bluetooth: Add support for Sony Vaio T-Series Greg Kroah-Hartman
2012-09-28 18:52 ` [ 220/262] Bluetooth: Use USB_VENDOR_AND_INTERFACE() for Broadcom devices Greg Kroah-Hartman
2012-09-28 18:52 ` [ 221/262] Bluetooth: Add support for Apple vendor-specific devices Greg Kroah-Hartman
2012-09-28 18:52 ` [ 222/262] Bluetooth: Fix use-after-free bug in SMP Greg Kroah-Hartman
2012-09-28 18:52 ` [ 223/262] Bluetooth: Change signature of smp_conn_security() Greg Kroah-Hartman
2012-09-28 18:52 ` [ 224/262] Bluetooth: Fix sending a HCI Authorization Request over LE links Greg Kroah-Hartman
2012-09-28 18:52 ` [ 225/262] Fix a dead loop in async_synchronize_full() Greg Kroah-Hartman
2012-09-28 18:52 ` [ 226/262] rds: set correct msg_namelen Greg Kroah-Hartman
2012-09-28 18:52 ` [ 227/262] libata: Prevent interface errors with Seagate FreeAgent GoFlex Greg Kroah-Hartman
2012-09-28 18:52 ` [ 228/262] sched: Fix race in task_group() Greg Kroah-Hartman
2012-09-28 18:52 ` [ 229/262] media: lirc_sir: make device registration work Greg Kroah-Hartman
2012-09-28 18:52 ` [ 230/262] time: Improve sanity checking of timekeeping inputs Greg Kroah-Hartman
2012-09-28 18:52 ` [ 231/262] time: Avoid making adjustments if we havent accumulated anything Greg Kroah-Hartman
2012-09-28 18:52 ` [ 232/262] time: Move ktime_t overflow checking into timespec_valid_strict Greg Kroah-Hartman
2012-09-28 18:52 ` [ 233/262] media: Avoid sysfs oops when an rc_devs raw device is absent Greg Kroah-Hartman
2012-09-28 18:52 ` [ 234/262] pch_uart: Fix missing break for 16 byte fifo Greg Kroah-Hartman
2012-09-28 18:52 ` [ 235/262] pch_uart: Fix rx error interrupt setting issue Greg Kroah-Hartman
2012-09-28 18:52 ` [ 236/262] pch_uart: Fix parity " Greg Kroah-Hartman
2012-09-28 18:52 ` [ 237/262] powerpc/85xx: p1022ds: disable the NAND flash node if video is enabled Greg Kroah-Hartman
2012-09-28 18:52 ` [ 238/262] powerpc/85xx: p1022ds: fix DIU/LBC switching with NAND enabled Greg Kroah-Hartman
2012-09-28 18:52 ` [ 239/262] pch_uart: Add eg20t_port lock field, avoid recursive spinlocks Greg Kroah-Hartman
2012-09-28 18:52 ` [ 240/262] OMAP: USB : Fix the EHCI enumeration and core retention issue Greg Kroah-Hartman
2012-09-28 18:52 ` [ 241/262] i2c/powermac: Improve detection of devices from device-tree Greg Kroah-Hartman
2012-09-28 18:52 ` [ 242/262] sound/aoa: Adapt to new i2c probing scheme Greg Kroah-Hartman
2012-09-28 18:52 ` [ 243/262] NFS: Fix Oopses in nfs_lookup_revalidate and nfs4_lookup_revalidate Greg Kroah-Hartman
2012-11-03 20:12   ` Myklebust, Trond
2012-11-05  8:23     ` Greg Kroah-Hartman
2012-11-05 15:37       ` Greg Kroah-Hartman
2012-09-28 18:52 ` [ 244/262] net: qmi_wwan: add ZTE MF821D Greg Kroah-Hartman
2012-09-28 18:52 ` [ 245/262] net: qmi_wwan: add Sierra Wireless devices Greg Kroah-Hartman
2012-09-28 18:52 ` [ 246/262] net: qmi_wwan: new devices: UML290 and K5006-Z Greg Kroah-Hartman
2012-09-28 18:52 ` [ 247/262] irq_remap: disable IRQ remapping if any IOAPIC lacks an IOMMU Greg Kroah-Hartman
2012-09-28 18:52 ` [ 248/262] NFSd: introduce nfsd_destroy() helper Greg Kroah-Hartman
2012-09-28 18:52 ` [ 249/262] NFSd: set nfsd_serv to NULL after service destruction Greg Kroah-Hartman
2012-09-28 18:52 ` [ 250/262] kthread_worker: reorganize to prepare for flush_kthread_work() reimplementation Greg Kroah-Hartman
2012-09-28 18:53 ` [ 251/262] kthread_worker: reimplement flush_kthread_work() to allow freeing the work item being executed Greg Kroah-Hartman
2012-09-28 18:53 ` [ 252/262] usb: chipidea: udc: fix error path in udc_start() Greg Kroah-Hartman
2012-09-28 18:53 ` [ 253/262] usb: chipidea: cleanup dma_pool if udc_start() fails Greg Kroah-Hartman
2012-09-28 18:53 ` [ 254/262] USB: ohci-at91: fix null pointer in ohci_hcd_at91_overcurrent_irq Greg Kroah-Hartman
2012-09-28 18:53 ` [ 255/262] USB: Fix race condition when removing host controllers Greg Kroah-Hartman
2012-09-28 18:53 ` [ 256/262] ALSA: snd-usb: fix next_packet_size calls for pause case Greg Kroah-Hartman
2012-09-28 18:53 ` [ 257/262] ASoC: wm2000: Correct register size Greg Kroah-Hartman
2012-09-28 18:53 ` [ 258/262] gpio-lpc32xx: Fix value handling of gpio_direction_output() Greg Kroah-Hartman
2012-09-28 18:53 ` [ 259/262] md/raid10: fix "enough" function for detecting if array is failed Greg Kroah-Hartman
2012-09-28 18:53 ` [ 260/262] drm/udl: limit modes to the sku pixel limits Greg Kroah-Hartman
2012-09-28 18:53 ` [ 261/262] drm/i915: only enable sdvo hotplug irq if needed Greg Kroah-Hartman
2012-09-28 18:53 ` [ 262/262] vmwgfx: corruption in vmw_event_fence_action_create() Greg Kroah-Hartman

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.