commit dd49f6263809f43901e9f6131ec9c8a71cf7b7ed Author: Greg Kroah-Hartman Date: Mon Mar 15 08:52:04 2010 -0700 Linux 2.6.32.10 commit 1942aeab7ae78a4840a594ce1bf2e29d63fe426f Author: Ian Campbell Date: Wed Feb 17 10:38:10 2010 +0000 x86, mm: Allow highmem user page tables to be disabled at boot time commit 14315592009c17035cac81f4954d5a1f4d71e489 upstream. Distros generally (I looked at Debian, RHEL5 and SLES11) seem to enable CONFIG_HIGHPTE for any x86 configuration which has highmem enabled. This means that the overhead applies even to machines which have a fairly modest amount of high memory and which therefore do not really benefit from allocating PTEs in high memory but still pay the price of the additional mapping operations. Running kernbench on a 4G box I found that with CONFIG_HIGHPTE=y but no actual highptes being allocated there was a reduction in system time used from 59.737s to 55.9s. With CONFIG_HIGHPTE=y and highmem PTEs being allocated: Average Optimal load -j 4 Run (std deviation): Elapsed Time 175.396 (0.238914) User Time 515.983 (5.85019) System Time 59.737 (1.26727) Percent CPU 263.8 (71.6796) Context Switches 39989.7 (4672.64) Sleeps 42617.7 (246.307) With CONFIG_HIGHPTE=y but with no highmem PTEs being allocated: Average Optimal load -j 4 Run (std deviation): Elapsed Time 174.278 (0.831968) User Time 515.659 (6.07012) System Time 55.9 (1.07799) Percent CPU 263.8 (71.266) Context Switches 39929.6 (4485.13) Sleeps 42583.7 (373.039) This patch allows the user to control the allocation of PTEs in highmem from the command line ("userpte=nohigh") but retains the status-quo as the default. It is possible that some simple heuristic could be developed which allows auto-tuning of this option however I don't have a sufficiently large machine available to me to perform any particularly meaningful experiments. We could probably handwave up an argument for a threshold at 16G of total RAM. Assuming 768M of lowmem we have 196608 potential lowmem PTE pages. Each page can map 2M of RAM in a PAE-enabled configuration, meaning a maximum of 384G of RAM could potentially be mapped using lowmem PTEs. Even allowing generous factor of 10 to account for other required lowmem allocations, generous slop to account for page sharing (which reduces the total amount of RAM mappable by a given number of PT pages) and other innacuracies in the estimations it would seem that even a 32G machine would not have a particularly pressing need for highmem PTEs. I think 32G could be considered to be at the upper bound of what might be sensible on a 32 bit machine (although I think in practice 64G is still supported). It's seems questionable if HIGHPTE is even a win for any amount of RAM you would sensibly run a 32 bit kernel on rather than going 64 bit. Signed-off-by: Ian Campbell LKML-Reference: <1266403090-20162-1-git-send-email-ian.campbell@citrix.com> Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit 04833a6a2dd0f236d1f5c17075a34df9df74351c Author: Thomas Gleixner Date: Wed Feb 17 09:05:48 2010 +0100 sched: Don't use possibly stale sched_class commit 83ab0aa0d5623d823444db82c3b3c34d7ec364ae upstream. setscheduler() saves task->sched_class outside of the rq->lock held region for a check after the setscheduler changes have become effective. That might result in checking a stale value. rtmutex_setprio() has the same problem, though it is protected by p->pi_lock against setscheduler(), but for correctness sake (and to avoid bad examples) it needs to be fixed as well. Retrieve task->sched_class inside of the rq->lock held region. Signed-off-by: Thomas Gleixner Acked-by: Peter Zijlstra Signed-off-by: Greg Kroah-Hartman commit 76d071362505e9ea55210b4b5cb7a6824c4c0b22 Author: Suresh Siddha Date: Fri Feb 12 17:14:22 2010 -0800 sched: Fix SMT scheduler regression in find_busiest_queue() commit 9000f05c6d1607f79c0deacf42b09693be673f4c upstream. Fix a SMT scheduler performance regression that is leading to a scenario where SMT threads in one core are completely idle while both the SMT threads in another core (on the same socket) are busy. This is caused by this commit (with the problematic code highlighted) commit bdb94aa5dbd8b55e75f5a50b61312fe589e2c2d1 Author: Peter Zijlstra Date: Tue Sep 1 10:34:38 2009 +0200 sched: Try to deal with low capacity @@ -4203,15 +4223,18 @@ find_busiest_queue() ... for_each_cpu(i, sched_group_cpus(group)) { + unsigned long power = power_of(i); ... - wl = weighted_cpuload(i); + wl = weighted_cpuload(i) * SCHED_LOAD_SCALE; + wl /= power; - if (rq->nr_running == 1 && wl > imbalance) + if (capacity && rq->nr_running == 1 && wl > imbalance) continue; On a SMT system, power of the HT logical cpu will be 589 and the scheduler load imbalance (for scenarios like the one mentioned above) can be approximately 1024 (SCHED_LOAD_SCALE). The above change of scaling the weighted load with the power will result in "wl > imbalance" and ultimately resulting in find_busiest_queue() return NULL, causing load_balance() to think that the load is well balanced. But infact one of the tasks can be moved to the idle core for optimal performance. We don't need to use the weighted load (wl) scaled by the cpu power to compare with imabalance. In that condition, we already know there is only a single task "rq->nr_running == 1" and the comparison between imbalance, wl is to make sure that we select the correct priority thread which matches imbalance. So we really need to compare the imabalnce with the original weighted load of the cpu and not the scaled load. But in other conditions where we want the most hammered(busiest) cpu, we can use scaled load to ensure that we consider the cpu power in addition to the actual load on that cpu, so that we can move the load away from the guy that is getting most hammered with respect to the actual capacity, as compared with the rest of the cpu's in that busiest group. Fix it. Reported-by: Ma Ling Initial-Analysis-by: Zhang, Yanmin Signed-off-by: Suresh Siddha Signed-off-by: Peter Zijlstra LKML-Reference: <1266023662.2808.118.camel@sbs-t61.sc.intel.com> Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit d9d9736709a7fbe2ecee46e4775c825263545ad4 Author: Vaidyanathan Srinivasan Date: Mon Feb 8 15:35:55 2010 +0530 sched: Fix sched_mv_power_savings for !SMT commit 28f5318167adf23b16c844b9c2253f355cb21796 upstream. Fix for sched_mc_powersavigs for pre-Nehalem platforms. Child sched domain should clear SD_PREFER_SIBLING if parent will have SD_POWERSAVINGS_BALANCE because they are contradicting. Sets the flags correctly based on sched_mc_power_savings. Signed-off-by: Vaidyanathan Srinivasan Signed-off-by: Peter Zijlstra LKML-Reference: <20100208100555.GD2931@dirshya.in.ibm.com> Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit 0e352d472aeded6dff36d53bdac684a411ee39ee Author: Gleb Natapov Date: Wed Feb 10 14:21:35 2010 +0200 KVM: x86 emulator: Check CPL level during privilege instruction emulation commit e92805ac1228626c59c865f2f4e9059b9fb8c97b upstream. Add CPL checking in case emulator is tricked into emulating privilege instruction from userspace. Signed-off-by: Gleb Natapov Signed-off-by: Avi Kivity Signed-off-by: Greg Kroah-Hartman commit 9a93be43df449153f5504ef94ec6afe82b1ed091 Author: Gleb Natapov Date: Wed Feb 10 14:21:30 2010 +0200 KVM: x86 emulator: Add group9 instruction decoding commit 60a29d4ea4e7b6b95d9391ebc8625b0426f3a363 upstream. Use groups mechanism to decode 0F C7 instructions. Signed-off-by: Gleb Natapov Signed-off-by: Avi Kivity Signed-off-by: Greg Kroah-Hartman commit 3e338f53281fc492a931928e6e53ec15eaf9cf3d Author: Gleb Natapov Date: Thu Feb 18 12:14:59 2010 +0200 KVM: x86 emulator: Forbid modifying CS segment register by mov instruction commit 8b9f44140bc4afd2698413cd9960c3912168ee91 upstream. Inject #UD if guest attempts to do so. This is in accordance to Intel SDM. Signed-off-by: Gleb Natapov Signed-off-by: Avi Kivity Signed-off-by: Greg Kroah-Hartman commit 89412b0b75eab56d30a2592bb8fd3d8f68825803 Author: Gleb Natapov Date: Wed Feb 10 14:21:29 2010 +0200 KVM: x86 emulator: Add group8 instruction decoding commit 2db2c2eb6226e30f8059b82512a1364db98da8e3 upstream. Use groups mechanism to decode 0F BA instructions. Signed-off-by: Gleb Natapov Signed-off-by: Avi Kivity Signed-off-by: Greg Kroah-Hartman commit f23fb645ee579a2eb25a5f665ed7c40918392949 Author: Mikulas Patocka Date: Sat Mar 6 02:32:29 2010 +0000 dm: free dm_io before bio_endio not after commit a97f925a32aad2a37971d7bfb657006acf04e42d upstream. Free the dm_io structure before calling bio_endio() instead of after it, to ensure that the io_pool containing it is not referenced after it is freed. This partially fixes a problem described here https://www.redhat.com/archives/dm-devel/2010-February/msg00109.html thread 1: bio_endio(bio, io_error); /* scheduling happens */ thread 2: close the device remove the device thread 1: free_io(md, io); Thread 2, when removing the device, sees non-empty md->io_pool (because the io hasn't been freed by thread 1 yet) and may crash with BUG in mempool_free. Thread 1 may also crash, when freeing into a nonexisting mempool. To fix this we must make sure that bio_endio() is the last call and the md structure is not accessed afterwards. There is another bio_endio in process_barrier, but it is called from the thread and the thread is destroyed prior to freeing the mempools, so this call is not affected by the bug. A similar bug exists with module unloads - the module may be unloaded immediately after bio_endio - but that is more difficult to fix. Signed-off-by: Mikulas Patocka Signed-off-by: Alasdair G Kergon Signed-off-by: Greg Kroah-Hartman commit f70813429191d72bac1935d43a295ac879024ea0 Author: Trond Myklebust Date: Tue Mar 2 13:06:22 2010 -0500 NFS: Fix an allocation-under-spinlock bug commit ebed9203b68a4f333ce5d17e874b26c3afcfeff1 upstream. sunrpc_cache_update() will always call detail->update() from inside the detail->hash_lock, so it cannot allocate memory. Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit b8e5ba11fc04af9ec6fe2f9e94026a77f52a0328 Author: James Hogan Date: Fri Mar 5 13:44:31 2010 -0800 rtc-coh901331: fix braces in resume code commit 5a98c04d78c896d52baef20ffc11f6d1ba6eb786 upstream. The else part of the if statement is indented but does not have braces around it. It clearly should since it uses clk_enable and clk_disable which are supposed to balance. Signed-off-by: James Hogan Acked-by: Linus Walleij Acked-by: Alessandro Zummo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 31ec453d5d81138cf50ad1c9ac523e9aec3c3896 Author: Lars-Peter Clausen Date: Fri Mar 5 13:43:37 2010 -0800 s3cmci: s3cmci_card_present: Use no_detect to decide whether there is a card detect pin commit dc2ed552804f3a2ae41c0ffe4bc09879ec8f7396 upstream. Signed-off-by: Lars-Peter Clausen Cc: Ben Dooks Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit c73b9e0e11be512641d478628baf0f870182dc7e Author: Trond Myklebust Date: Tue Mar 2 13:06:21 2010 -0500 SUNRPC: Handle EINVAL error returns from the TCP connect operation commit 9fcfe0c83c3b04a759cde6b8c5f961237f17808b upstream. This can, for instance, happen if the user specifies a link local IPv6 address. Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 967f940095b348a1f000daf3991264a5e5dbaac3 Author: Neil Brown Date: Sat Feb 27 09:33:40 2010 +1100 sunrpc: remove unnecessary svc_xprt_put commit ab1b18f70a007ea6caeb007d269abb75b131a410 upstream. The 'struct svc_deferred_req's on the xpt_deferred queue do not own a reference to the owning xprt. This is seen in svc_revisit which is where things are added to this queue. dr->xprt is set to NULL and the reference to the xprt it put. So when this list is cleaned up in svc_delete_xprt, we mustn't put the reference. Also, replace the 'for' with a 'while' which is arguably simpler and more likely to compile efficiently. Cc: Tom Tucker Signed-off-by: NeilBrown Signed-off-by: J. Bruce Fields Signed-off-by: Greg Kroah-Hartman commit d234eee1361df33b8ab4dcc2a36f6bd605cdbb1a Author: Maarten Maathuis Date: Sat Feb 20 03:22:21 2010 +0100 drm/ttm: handle OOM in ttm_tt_swapout commit 290e55056ec3d25c72088628245d8cae037b30db upstream. - Without this change I get a general protection fault. - Also use PTR_ERR where applicable. Signed-off-by: Maarten Maathuis Reviewed-by: Dave Airlie Acked-by: Thomas Hellstrom Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 605fa278907012c31b3d3896a52dcc432a5d9953 Author: Zhao Yakui Date: Mon Feb 8 21:35:12 2010 +0800 drm/i915: Use a dmi quirk to skip a broken SDVO TV output. commit 6070a4a928f8c92b9fae7d6717ebbb05f425d6b2 upstream. This IBM system has a multi-function SDVO card that reports both VGA and TV, but the system has no TV connector. The TV connector always reported as connected, which would lead to poor modesetting choices. https://bugs.freedesktop.org/show_bug.cgi?id=25787 Signed-off-by: Zhao Yakui Tested-by: Vance Signed-off-by: Eric Anholt Signed-off-by: Greg Kroah-Hartman commit b82f4f97c4e73e5630e4d6b3faad5113b6998aab Author: Jan Dumon Date: Tue Jan 5 15:53:26 2010 +0100 USB: unusual_devs: Add support for multiple Option 3G sticks commit 46216e4fbe8c62059b5440dec0b236f386248a41 upstream. Enable the SD-Card interface on multiple Option 3G sticks. The unusual_devs.h entry is necessary because the device descriptor is vendor-specific. That prevents usb-storage from binding to it as an interface driver. Signed-off-by: Jan Dumon Signed-off-by: Phil Dibowitz Signed-off-by: Greg Kroah-Hartman commit 07623cdca9b6b527b375bb8ab777bc5a928659f8 Author: Alan Cox Date: Mon Feb 8 10:10:44 2010 +0000 USB: cp210x: Add 81E8 (Zephyr Bioharness) commit bd07c551aae5d2200c7b195142e5ba63f26424da upstream. As reported in http://bugzilla.kernel.org/show_bug.cgi?id=10980 Signed-off-by: Alan Cox Signed-off-by: Greg Kroah-Hartman commit 8b0c7df961e3a2b16c04cf98c5aaa4b6369aff5c Author: Daniel Sangorrin Date: Mon Feb 22 11:03:11 2010 +0900 USB: serial: ftdi: add CONTEC vendor and product id commit 46b72d78cb022714c89a9ebc00b9581b550cfca7 upstream. This is a patch to ftdi_sio_ids.h and ftdi_sio.c that adds identifiers for CONTEC USB serial converter. I tested it with the device COM-1(USB)H Signed-off-by: Daniel Sangorrin Cc: Andreas Mohr Signed-off-by: Greg Kroah-Hartman commit 0d37d1e4891d626cb8ed102eed86874fbe534768 Author: Mitchell Solomon Date: Fri Feb 12 13:23:18 2010 -0500 USB: add new ftdi_sio device ids commit 9714080d20f2ec4b671a06ce69367d91fa9e227e upstream. PID patch for my products Signed-off-by: Mitchell Solomon Signed-off-by: Greg Kroah-Hartman commit 8d9a38a934b1e44b10bf871d6146dd4550fd0296 Author: Andreas Mohr Date: Sun Jan 17 11:45:38 2010 +0100 USB: ftdi_sio: add device IDs (several ELV, one Mindstorms NXT) commit 65e1ec6751b3eefee6d94161185e78736366126f upstream. - add FTDI device IDs for several ELV devices and NXTCam of Lego Mindstorms NXT - add hopefully helpful new_id comment - remove less helpful "Due to many user requests for multiple ELV devices we enable them by default." comment (we simply add _all_ known devices - an enduser shouldn't have to fiddle with obscure module parameters...). - add myself to DRIVER_AUTHOR The missing NXTCam ID has been found at http://www.unixboard.de/vb3/showthread.php?t=44155 , ELV devices taken from ELV Windows .inf file. Signed-off-by: Andreas Mohr Signed-off-by: Greg Kroah-Hartman commit e60a36d2a495a0b76699354210b3afaa77b3ec4c Author: Radek Liboska Date: Wed Jan 27 15:38:34 2010 +0100 USB: ftdi_sio: new device id for papouch AD4USB commit a7787e508acb4378d62f4584bae3dd1cd0ba3eac upstream. added new device pid (PAPOUCH_AD4USB_PID) to ftdi_sio.h and ftdi_sio.c AD4USB measuring converter is a 4-input A/D converter which enables the user to measure to four current inputs ranging from 0(4) to 20 mA or voltage between 0 and 10 V. The measured values are then transferred to a superior system in digital form. The AD4USB communicates via USB. Powered is also via USB. datasheet in english is here: http://www.papouch.com/shop/scripts/pdf/ad4usb_en.pdf Signed-off-by: Radek Liboska Signed-off-by: Greg Kroah-Hartman commit ad0a5cb79efeae125e942f10435404bc427f7b4a Author: Andreas Mohr Date: Thu Dec 17 11:56:09 2009 +0100 USB: ftdi_sio: sort PID/VID entries in new ftdi_sio_ids.h header commit 4e092d110fe931db3878865db185be1c9df3e182 upstream. This is a (almost) sort-only patch to sort FTDI device product ID definitions in new ftdi_sio_ids.h header. Advantage is that new device ID submissions will now have a specific (sorted) position - less future merge conflicts. Compile-tested, based on _current_ mainline git. Minor checkpatch.pl warnings were eliminated whereever it made sense, very minor text changes. Signed-off-by: Andreas Mohr Signed-off-by: Greg Kroah-Hartman commit e9eba6da4a4d181cbcb84a664999f57d8c125276 Author: Andreas Mohr Date: Wed Dec 16 21:45:10 2009 +0100 USB: ftdi_sio: isolate all device IDs to new ftdi_sio_ids.h header commit 31844d55800e1b93fe75c4d6188a4a44db2e1bbe upstream. This is a strictly move-only patch to relocate all FTDI device product ID definitions to their own ftdi_sio_ids.h header (following the usual *_ids.h kernel tree convention, too), thus correcting the slightly too messy appearance (crucial driver defines were stuck somewhere in the decaying middle swamp of the huge existing header). Compile-tested, based on latest mainline git. Signed-off-by: Andreas Mohr Signed-off-by: Greg Kroah-Hartman commit 2de6fff1986ff1b9ff8bd77b70d3ae31aab8caf9 Author: Herbert Xu Date: Sun Jan 10 20:15:03 2010 +1100 USB: Move hcd free_dev call into usb_disconnect to fix oops commit f7410ced7f931bb1ad79d1336412cf7b7a33cb14 upstream. USB: Move hcd free_dev call into usb_disconnect I found a way to oops the kernel: 1. Open a USB device through devio. 2. Remove the hcd module in the host kernel. 3. Close the devio file descriptor. The problem is that closing the file descriptor does usb_release_dev as it is the last reference. usb_release_dev then tries to invoke the hcd free_dev function (or rather dereferencing the hcd driver struct). This causes an oops as the hcd driver has already been unloaded so the struct is gone. This patch tries to fix this by bringing the free_dev call earlier and into usb_disconnect. I have verified that repeating the above steps no longer crashes with this patch applied. Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman commit 80218d985163393676d96e3df17f80fde6c8daa8 Author: Alan Stern Date: Mon Feb 8 09:45:12 2010 -0500 USB: remove debugging message for uevent constructions commit cceffe9348f93188d7811bda95924d4bd3040d0f upstream. This patch (as1332) removes an unneeded and annoying debugging message announcing all USB uevent constructions. Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit 0f43110993a731cb24ab39befc7cb1c265a4bf20 Author: Pete Zaitcev Date: Fri Jan 8 15:39:22 2010 -0700 USB: fix crash in uhci_scan_schedule commit d23356da714595b888686d22cd19061323c09190 upstream. When hardware is removed on a Stratus, the system may crash like this: ACPI: PCI interrupt for device 0000:7c:00.1 disabled Trying to free nonexistent resource <00000000a8000000-00000000afffffff> Trying to free nonexistent resource <00000000a4800000-00000000a480ffff> uhci_hcd 0000:7e:1d.0: remove, state 1 usb usb2: USB disconnect, address 1 usb 2-1: USB disconnect, address 2 Unable to handle kernel paging request at 0000000000100100 RIP: [] :uhci_hcd:uhci_scan_schedule+0xa2/0x89c #4 [ffff81011de17e50] uhci_scan_schedule at ffffffff88021918 #5 [ffff81011de17ed0] uhci_irq at ffffffff88023cb8 #6 [ffff81011de17f10] usb_hcd_irq at ffffffff801f1c1f #7 [ffff81011de17f20] handle_IRQ_event at ffffffff8001123b #8 [ffff81011de17f50] __do_IRQ at ffffffff800ba749 This occurs because an interrupt scans uhci->skelqh, which is being freed. We do the right thing: disable the interrupts in the device, and do not do any processing if the interrupt is shared with other source, but it's possible that another CPU gets delayed somewhere (e.g. loops) until we started freeing. The agreed-upon solution is to wait for interrupts to play out before proceeding. No other bareers are neceesary. A backport of this patch was tested on a 2.6.18 based kernel. Testing of 2.6.32-based kernels is under way, but it takes us forever (months) to turn this around. So I think it's a good patch and we should keep it. Tracked in RH bz#516851 Signed-Off-By: Pete Zaitcev Signed-off-by: Greg Kroah-Hartman commit 7de0f5637dd3df19f9914055b79fbdea872f4289 Author: Alan Stern Date: Thu Feb 25 13:19:37 2010 -0500 USB: fix the idProduct value for USB-3.0 root hubs commit cd780694920fbf869b23c8afb0bd083e7b0448c7 upstream. This patch (as1346) changes the idProduct value for USB-3.0 root hubs from 0x0002 (which we already use for USB-2.0 root hubs) to 0x0003. Signed-off-by: Alan Stern Acked-by: Sarah Sharp Signed-off-by: Greg Kroah-Hartman commit bbb4ae3e0220f07cc88eb7398d7742add03542f1 Author: Edward Shao Date: Thu Feb 11 03:37:30 2010 +0800 USB: xhci: Fix finding extended capabilities registers commit 05197921ff3dad52d99fd1647974c57d9c28d40e upstream. According "5.3.6 Capability Parameters (HCCPARAMS)" of xHCI rev0.96 spec, value of xECP register indicates a relative offset, in 32-bit words, from Base to the beginning of the first extended capability. The wrong calculation will cause BIOS handoff fail (not handoff from BIOS) in some platform with BIOS USB legacy sup support. Signed-off-by: Edward Shao Cc: Sarah Sharp Signed-off-by: Greg Kroah-Hartman commit 75bf39e2123146df574e7c1b7ce9ae7c45a44ded Author: Yinghai Lu Date: Wed Feb 10 01:20:05 2010 -0800 x86: Fix SCI on IOAPIC != 0 commit 18dce6ba5c8c6bd0f3ab4efa4cbdd698dab5c40a upstream. Thomas Renninger reported on IBM x3330 booting a latest kernel on this machine results in: PCI: PCI BIOS revision 2.10 entry at 0xfd61c, last bus=1 PCI: Using configuration type 1 for base access bio: create slab at 0 ACPI: SCI (IRQ30) allocation failed ACPI Exception: AE_NOT_ACQUIRED, Unable to install System Control Interrupt handler (20090903/evevent-161) ACPI: Unable to start the ACPI Interpreter Later all kind of devices fail... and bisect it down to this commit: commit b9c61b70075c87a8612624736faf4a2de5b1ed30 x86/pci: update pirq_enable_irq() to setup io apic routing it turns out we need to set irq routing for the sci on ioapic1 early. -v2: make it work without sparseirq too. -v3: fix checkpatch.pl warning, and cc to stable Reported-by: Thomas Renninger Bisected-by: Thomas Renninger Tested-by: Thomas Renninger Signed-off-by: Yinghai Lu LKML-Reference: <1265793639-15071-2-git-send-email-yinghai@kernel.org> Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit 0a660e1ef186efc73d7398b0a9ddba754adce5d2 Author: Brandon Phiilps Date: Wed Feb 10 01:20:06 2010 -0800 x86: Avoid race condition in pci_enable_msix() commit ced5b697a76d325e7a7ac7d382dbbb632c765093 upstream. Keep chip_data in create_irq_nr and destroy_irq. When two drivers are setting up MSI-X at the same time via pci_enable_msix() there is a race. See this dmesg excerpt: [ 85.170610] ixgbe 0000:02:00.1: irq 97 for MSI/MSI-X [ 85.170611] alloc irq_desc for 99 on node -1 [ 85.170613] igb 0000:08:00.1: irq 98 for MSI/MSI-X [ 85.170614] alloc kstat_irqs on node -1 [ 85.170616] alloc irq_2_iommu on node -1 [ 85.170617] alloc irq_desc for 100 on node -1 [ 85.170619] alloc kstat_irqs on node -1 [ 85.170621] alloc irq_2_iommu on node -1 [ 85.170625] ixgbe 0000:02:00.1: irq 99 for MSI/MSI-X [ 85.170626] alloc irq_desc for 101 on node -1 [ 85.170628] igb 0000:08:00.1: irq 100 for MSI/MSI-X [ 85.170630] alloc kstat_irqs on node -1 [ 85.170631] alloc irq_2_iommu on node -1 [ 85.170635] alloc irq_desc for 102 on node -1 [ 85.170636] alloc kstat_irqs on node -1 [ 85.170639] alloc irq_2_iommu on node -1 [ 85.170646] BUG: unable to handle kernel NULL pointer dereference at 0000000000000088 As you can see igb and ixgbe are both alternating on create_irq_nr() via pci_enable_msix() in their probe function. ixgbe: While looping through irq_desc_ptrs[] via create_irq_nr() ixgbe choses irq_desc_ptrs[102] and exits the loop, drops vector_lock and calls dynamic_irq_init. Then it sets irq_desc_ptrs[102]->chip_data = NULL via dynamic_irq_init(). igb: Grabs the vector_lock now and starts looping over irq_desc_ptrs[] via create_irq_nr(). It gets to irq_desc_ptrs[102] and does this: cfg_new = irq_desc_ptrs[102]->chip_data; if (cfg_new->vector != 0) continue; This hits the NULL deref. Another possible race exists via pci_disable_msix() in a driver or in the number of error paths that call free_msi_irqs(): destroy_irq() dynamic_irq_cleanup() which sets desc->chip_data = NULL ...race window... desc->chip_data = cfg; Remove the save and restore code for cfg in create_irq_nr() and destroy_irq() and take the desc->lock when checking the irq_cfg. Reported-and-analyzed-by: Brandon Philips Signed-off-by: Yinghai Lu LKML-Reference: <1265793639-15071-3-git-send-email-yinghai@kernel.org> Signed-off-by: Brandon Phililps Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit 81a1448f6f77f2fbbc4b9be64167533d2e2181cf Author: Ian Campbell Date: Fri Feb 26 17:16:00 2010 +0000 x86, xen: Disable highmem PTE allocation even when CONFIG_HIGHPTE=y commit 817a824b75b1475f1b067c8cee318c7b4d66fcde upstream. There's a path in the pagefault code where the kernel deliberately breaks its own locking rules by kmapping a high pte page without holding the pagetable lock (in at least page_check_address). This breaks Xen's ability to track the pinned/unpinned state of the page. There does not appear to be a viable workaround for this behaviour so simply disable HIGHPTE for all Xen guests. Signed-off-by: Ian Campbell LKML-Reference: <1267204562-11844-1-git-send-email-ian.campbell@citrix.com> Cc: Jeremy Fitzhardinge Cc: Ingo Molnar Cc: Pasi Kärkkäinen Cc: Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit 3f03f7afa01b26c17c226816ab6deb222209bb43 Author: Justin P. Mattock Date: Tue Feb 16 15:17:29 2010 -0800 x86: Add iMac9,1 to pci_reboot_dmi_table commit 0a832320f1bae6a4169bf683e201378f2437cfc1 upstream. On the iMac9,1 /sbin/reboot results in a black mangled screen. Adding this DMI entry gets the machine to reboot cleanly as it should. Signed-off-by: Justin P. Mattock LKML-Reference: <1266362249-3337-1-git-send-email-justinmattock@gmail.com> Signed-off-by: H. Peter Anvin Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit dce7d6868846c12e3c99c46e71abc123c2f289e0 Author: Jiri Slaby Date: Wed Feb 10 20:55:16 2010 +0100 x86, ia32_aout: do not kill argument mapping commit 318f6b228ba88a394ef560efc1bfe028ad5ae6b6 upstream. Do not set current->mm->mmap to NULL in 32-bit emulation on 64-bit load_aout_binary after flush_old_exec as it would destroy already set brpm mapping with arguments. Introduced by b6a2fea39318e43fee84fa7b0b90d68bed92d2ba mm: variable length argument support where the argument mapping in bprm was added. [ hpa: this is a regression from 2.6.22... time to kill a.out? ] Signed-off-by: Jiri Slaby LKML-Reference: <1265831716-7668-1-git-send-email-jslaby@suse.cz> Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Ollie Wild Cc: x86@kernel.org Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit e3e48b52f53c8d5f93349364a24c6f1eb67950b8 Author: Tao Ma Date: Fri Feb 26 10:54:52 2010 +0800 ocfs2: Only bug out in direct io write for reflinked extent. commit cbaee472f274ea9a98aabe47025f6e5551acadcb upstream. In ocfs2_direct_IO_get_blocks, we only need to bug out in case of we are going to write a recounted extent rec. What a silly bug introduced by me! Signed-off-by: Tao Ma Signed-off-by: Joel Becker Signed-off-by: Greg Kroah-Hartman commit 81defc45cbae8ec28c4af87bf887a562e38474a4 Author: Henrique de Moraes Holschuh Date: Thu Feb 25 22:22:07 2010 -0300 thinkpad-acpi: fix bluetooth/wwan resume commit 08fedfc903c78e380b0baa7b57c52d367794d0a5 upstream. Studying the DSDTs of various thinkpads, it looks like bit 3 of the argument to SBDC and SWAN is not "set radio to last state on resume". Rather, it seems to be "if this bit is set, enable radio on resume, otherwise disable it on resume". So, the proper way to prepare the radios for S3 suspend is: disable radio and clear bit 3 on the SBDC/SWAN call to to resume with radio disabled, and enable radio and set bit 3 on the SBDC/SWAN call to resume with the radio enabled. Also, for persistent devices, the rfkill core does not restore state, so we really need to get the firmware to do the right thing. We don't sync the radio state on suspend, instead we trust the BIOS to not do anything weird if we never touched the radio state since boot. Time will tell if that's a wise way of doing things... Signed-off-by: Henrique de Moraes Holschuh Signed-off-by: Greg Kroah-Hartman commit 48825c5e641364ed823ba646cf0636d66f777a30 Author: Henrique de Moraes Holschuh Date: Thu Feb 25 21:29:00 2010 -0300 thinkpad-acpi: make driver events work in NVRAM poll mode commit 7f0cf712a74fcc3ad21f0bde95bd32c2f2cc3888 upstream. Thadeu Lima de Souza Cascardo reports this: Brightness notification does not work until the user writes to hotkey_mask attribute. That's because the polling thread will only run if hotkey_user_mask is set and someone is reading the input device or if hotkey_driver_mask is set. In this second case, this condition is not tested after the mask is changed, because the brightness and volume drivers are started after the hotkey drivers. Fix tpacpi_hotkey_driver_mask_set() to call hotkey_poll_setup(), so that the poller kthread will be started when needed. Reported-by: Thadeu Lima de Souza Cascardo Tested-by: Thadeu Lima de Souza Cascardo Signed-off-by: Henrique de Moraes Holschuh Cc: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit 6279896e0d676c172f50c046064f889185382eac Author: Henrique de Moraes Holschuh Date: Thu Feb 25 21:28:56 2010 -0300 thinkpad-acpi: document HKEY event 3006 commit bf8b29c8f7f8269e99eca8b19048ed5b34b51810 upstream. Event 0x3006 is used to help power management of the ODD in the UltraBay. The EC generates this event when the ODD eject button is pressed (even if the bay is powered down). Normally, Linux doesn't need this as we keep the SATA link powered up (which wastes power). The EC powers up the bay by itself when the ODD eject button is pressed, and the SATA PHY reports the hotplug. However, we could also power that SATA link down (and for that matter, also power down the Ultrabay) if the ODD is left idle for a while with no disk inside, and use event 0x3006 to know when we need that SATA link powered back up. For now, just stop asking for more information when event 0x3006 is seen, there is no point in pestering users about it anymore. Signed-off-by: Henrique de Moraes Holschuh Signed-off-by: Greg Kroah-Hartman commit ed401e38b235be93b4f34a60cfaf7ec0ded17930 Author: Henrique de Moraes Holschuh Date: Thu Feb 25 21:28:56 2010 -0300 thinkpad-acpi: R52 brightness_mode has been confirmed commit 7d1894d8d1c411d2dad95abfe0f65bacf68c4afa upstream. We can stop pestering users for confirmation of the brightness_mode default for firmware TP-76. While at it, add a few missing comments in that quirk table. Reported-by: Whoopie Signed-off-by: Henrique de Moraes Holschuh Signed-off-by: Greg Kroah-Hartman commit 88c69e8d13e46c2cab995743a42d195dc8b91882 Author: Henrique de Moraes Holschuh Date: Thu Feb 25 21:28:58 2010 -0300 thinkpad-acpi: fix poll thread auto-start commit b589ea4c44170d3f7a845684e2d1b3b9571663af upstream. The driver was not starting the NVRAM polling thread if the input device was bound immediately after registration. This fixes: http://bugzilla.kernel.org/show_bug.cgi?id=15118 Reported-by: Florian Zumbiehl Signed-off-by: Henrique de Moraes Holschuh Signed-off-by: Greg Kroah-Hartman commit 64b29318edadbf2b62ac3abe0c7f10d59bd18df5 Author: Ben Hutchings Date: Fri Feb 26 04:37:09 2010 -0800 sunxvr500: Additional PCI id for sunxvr500 driver commit 275143e9b237dd7e0b6d01660fd9b8acd9922fa7 upstream. Intergraph bought 3D Labs and some XVR-500 chips have Intergraph's vendor id. Reported-by: Jurij Smakov Signed-off-by: Ben Hutchings Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 58368fc8325ee2a9af4c29e232e319d78903f64b Author: Tim Gardner Date: Tue Feb 23 14:59:12 2010 +0100 netfilter: xt_recent: fix false match commit 8ccb92ad41cb311e52ad1b1fe77992c7f47a3b63 upstream. A rule with a zero hit_count will always match. Signed-off-by: Tim Gardner Signed-off-by: Patrick McHardy Signed-off-by: Greg Kroah-Hartman commit 6f2deb6aad5e242d5573ae8d98a90a454f5e79d0 Author: Tim Gardner Date: Tue Feb 23 14:55:21 2010 +0100 netfilter: xt_recent: fix buffer overflow commit 2c08522e5d2f0af2d6f05be558946dcbf8173683 upstream. e->index overflows e->stamps[] every ip_pkt_list_tot packets. Consider the case when ip_pkt_list_tot==1; the first packet received is stored in e->stamps[0] and e->index is initialized to 1. The next received packet timestamp is then stored at e->stamps[1] in recent_entry_update(), a buffer overflow because the maximum e->stamps[] index is 0. Signed-off-by: Tim Gardner Signed-off-by: Patrick McHardy Signed-off-by: Greg Kroah-Hartman commit 81fc8e0872c9f00ee7fb01305822758cb4bb8a2d Author: Larry Finger Date: Wed Feb 3 13:33:44 2010 -0600 b43/b43legacy: Wake queues in wireless_core_start commit 0866b03c7d7dee8a34ffa527ecda426c0f405518 upstream. If b43 or b43legacy are deauthenticated or disconnected, there is a possibility that a reconnection is tried with the queues stopped in mac80211. To prevent this, start the queues before setting STAT_INITIALIZED. In b43, a similar change has been in place (twice) in the wireless_core_init() routine. Remove the duplicate and add similar code to b43legacy. Signed-off-by: Larry Finger Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit d86f9979af6e6659158eace36273ecd401ee8a81 Author: Bob Copeland Date: Tue Feb 9 13:06:54 2010 -0500 ath5k: use correct packet type when transmitting commit 2ac2927a953a01c83df255118922cce1523d1a18 upstream. The hardware needs to know what type of frames are being sent in order to fill in various fields, for example the timestamp in probe responses (before this patch, it was always 0). Set it correctly when initializing the TX descriptor. Signed-off-by: Bob Copeland Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 31a1e79f7defaeed09b176854a09570a31f4e0fb Author: Felix Fietkau Date: Wed Feb 24 04:43:05 2010 +0100 ath9k: disable RIFS search for AR91xx based chips commit 7bfbae10dc10a5c94a780d117a57e875d77e8e5a upstream. While ath9k does not support RIFS yet, the ability to receive RIFS frames is currently enabled for most chipsets in the initvals. This is causing baseband related issues on AR9160 and AR9130 based chipsets, which can lock up under certain conditions. This patch fixes these issues by overriding the initvals, effectively disabling RIFS for all affected chipsets. Signed-off-by: Felix Fietkau Acked-by: Luis R. Rodriguez Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit f58a7b783d3642807ba44af27315b83a7d8ae525 Author: Felix Fietkau Date: Fri Feb 19 01:46:36 2010 +0100 ath9k: fix rate control fallback rate selection commit 5c0ba62fd4b2dce08055a89600f1d834f9f0fe9e upstream. When selecting the tx fallback rate, rc.c used a separate variable 'nrix' for storing the next rate index, however it did not use that as reference for further rate index lowering. Because of that, it ended up reusing the same rate for multiple multi-rate retry stages, thus decreasing delivery probability under changing link conditions. This patch removes the separate (unnecessary) variable and fixes fallback the way it was intended to work. This should result in increased throughput and better link stability. Signed-off-by: Felix Fietkau Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 9ba155b84391989fb97ddb210c741d6abc44a613 Author: Felix Fietkau Date: Fri Feb 19 18:21:42 2010 +0100 ath9k: fix beacon timer restart after a card reset commit d8728ee919282c7b01b65cd479ec1e2a9c5d3ba8 upstream. In AP mode, ath_beacon_config_ap only restarts the timer if a TSF restart is requested. Apparently this was added, because this function unconditionally sets the flag for TSF reset. The problem with this is, that ath9k_hw_reset() clobbers the timer registers (specified in the initvals), thus effectively disabling the SWBA interrupt whenever a card reset without TSF reset is issued (happens in a few places in the code). This patch fixes ath_beacon_config_ap to only issue the TSF reset flag when necessary, but reinitialize the timer unconditionally. Tests show, that this is enough to keep the SWBA interrupt going after a call to ath_reset() Signed-off-by: Felix Fietkau Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit c6476d517ed62121444df6e3cbf7a494a463a74d Author: Eric W. Biederman Date: Sun Feb 28 01:20:36 2010 +0000 scm: Only support SCM_RIGHTS on unix domain sockets. commit 76dadd76c265a0cdb5a76aa4eef03fcc9639b388 upstream. We use scm_send and scm_recv on both unix domain and netlink sockets, but only unix domain sockets support everything required for file descriptor passing, so error if someone attempts to pass file descriptors over netlink sockets. Signed-off-by: Eric W. Biederman Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit ca652afbb2e2ff892286846075380a505cec583a Author: Sergei Shtylyov Date: Mon Dec 7 23:25:52 2009 +0400 pata_hpt3x2n: always stretch UltraDMA timing commit 60661933995bc7a09686c901439e17c2a4ea7d5d upstream. The UltraDMA Tss timing must be stretched with ATA clock of 66 MHz, but the driver only does this when PCI clock is 66 MHz, whereas it always programs DPLL clock (which is used as the ATA clock) to 66 MHz. Signed-off-by: Sergei Shtylyov Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit dde60b40c56a0fa08a3aa6d6d9a8d19bf3249ca5 Author: Jean Delvare Date: Fri Mar 5 22:17:25 2010 +0100 hwmon: (tmp421) Restore missing inputs commit 8d59582a867470a3e0c3eced4a01625ae8dc546b upstream. An off-by-one error caused some inputs to not be created by the driver when they should. TMP421 gets only one input instead of two, TMP422 gets two instead of three, etc. Fix the bug by listing explicitly the number of inputs each device has. Signed-off-by: Jean Delvare Tested-by: Andre Prendel Signed-off-by: Greg Kroah-Hartman commit bc6fb9e8ba0e5ec6641527b2cfdf170e332f6a5e Author: Jean Delvare Date: Fri Mar 5 22:17:25 2010 +0100 hwmon: (tmp421) Fix temperature conversions commit a44908d742a577fb5ccb9a8c082326d4cea234c2 upstream. The low bits of temperature registers are status bits, they must be masked out before converting the register values to temperatures. Signed-off-by: Jean Delvare Tested-by: Andre Prendel Signed-off-by: Greg Kroah-Hartman commit 95c2a40e131872cef98d2ec9db1a7ced88da53b9 Author: Mark Brown Date: Wed Feb 17 18:04:35 2010 +0000 gpiolib: Actually set output state in wm831x_gpio_direction_output() commit 3383d23d86791503559cb87837491af37469d9e5 upstream. wm831x_gpio_direction_output() ignored the state passed into it. Signed-off-by: Mark Brown Signed-off-by: Samuel Ortiz Signed-off-by: Greg Kroah-Hartman commit 0936267c027ba27fd6c2b569ba2a1c6d9106b3bd Author: Christian Lamparter Date: Sun Jan 17 23:17:29 2010 +0100 p54pci: handle dma mapping errors commit 288c8ce8047695fd8872dd5db3ef21a9679c402f upstream. This patch adds error-paths to handle pci_dma_mapping errors. Signed-off-by: Christian Lamparter Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 25c08323806be68d53887720a439a9ad2e4a98da Author: Jean-François Moine Date: Wed Feb 17 10:59:31 2010 -0600 p54usb: Add the USB ID for Belkin (Accton) FD7050E ver 1010ec commit 5b9a919a97ac8bdda8020c9b366491b5b91b196e upstream. Yet another USB ID. Signed-off-by: Jean-François Moine Signed-off-by: Larry Finger Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit f56db946ddff545a71eca4194b7cef441dfc9889 Author: Luotao Fu Date: Fri Feb 19 15:42:00 2010 +0100 USB: fix I2C API usage in ohci-pnx4008. commit 8740cc7d0c532e098cc428251c08befd14f087d8 upstream. i2c_board_info doesn't contain a member called name. i2c_register_client call does not exist. Signed-off-by: Luotao Fu Acked-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit a6a2dae818b876c15adb06cb58f746d73fd550bd Author: Tanaka Akira Date: Thu Jan 21 02:31:09 2010 +0900 USB: SIS USB2VGA DRIVER: support KAIREN's USB VGA adaptor USB20SVGA-MB-PLUS commit bbcb8bbad52b8795912e8f02c2b319092b96078e upstream. This patch adds the USB product ID of KAIREN's USB VGA Adaptor, USB20SVGA-MB-PLUS, to sisusbvga work with it. Signed-off-by: Tanaka Akira Signed-off-by: Greg Kroah-Hartman commit 36afd0e4a7718115066a1e72900da66e7e8b4416 Author: Elina Pasheva Date: Mon Feb 15 14:50:14 2010 -0800 USB: serial: sierra driver indat_callback fix commit b87c6e86dac1bb5222279cc8ff7e09529e1c4ed9 upstream. A crash has been reported with sierra driver on disconnect with Ubuntu/Lucid distribution based on kernel-2.6.32. The cause of the crash was determined as "NULL tty pointer was being referenced" and the NULL pointer was passed by sierra_indat_callback(). This patch modifies sierra_indat_callback() function to check for NULL tty structure pointer. This modification prevents a crash from happening when the device is disconnected. This patch fixes the bug reported in Launchpad: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/511157 Signed-off-by: Elina Pasheva Signed-off-by: Greg Kroah-Hartman commit 83348961d7eb5072a0f5f42a587164d1a3d31fa0 Author: Baruch Siach Date: Mon Dec 21 16:26:46 2009 -0800 serial: imx: fix NULL dereference Oops when pdata == NULL commit bbcd18d1b37413d25eaf4580682b1b8e4a09ff5e upstream. The platform code doesn't have to provide platform data to get sensible default behaviour from the imx serial driver. This patch does not handle NULL dereference in the IrDA case, which still requires a valid platform data pointer (in imx_startup()/imx_shutdown()), since I don't know whether there is a sensible default behaviour, or should the operation just fail cleanly. Signed-off-by: Baruch Siach Cc: Baruch Siach Cc: Alan Cox Cc: Sascha Hauer Cc: Oskar Schirmer Cc: Fabian Godehardt Cc: Daniel Glöckner Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit 25262221921cdf3a8c7dbf3ea6a08c816fb8a222 Author: Alan Cox Date: Mon Feb 8 10:09:26 2010 +0000 tty: Fix the ldisc hangup race commit 638b9648ab51c9c549ff5735d3de519ef6199df3 upstream. This was noticed by Matthias Urlichs and he proposed a fix. This patch does the fixing a different way to avoid introducing several new race conditions into the code. The problem case is TTY_DRIVER_RESET_TERMIOS = 0. In that case while we abort the ldisc change, the hangup processing has not cleaned up and restarted the ldisc either. We can't restart the ldisc stuff in the set_ldisc as we don't know what the hangup did and may touch stuff we shouldn't as we are no longer supposed to influence the tty at that point in case it has been re-opened before we get rescheduled. Instead do it the simple way. Always re-init the ldisc on the hangup, but use TTY_DRIVER_RESET_TERMIOS to indicate that we should force N_TTY. Signed-off-by: Alan Cox Signed-off-by: Greg Kroah-Hartman commit 4e2f0b48d2a85948cef171961b60ccf994ad24dd Author: Kay Sievers Date: Wed Jan 13 14:16:36 2010 +0100 Driver-Core: devtmpfs - reset inode permissions before unlinking commit 5e31d76f2817bd50258a092a7c5b15b3006fd61c upstream. Before unlinking the inode, reset the current permissions of possible references like hardlinks, so granted permissions can not be retained across the device lifetime by creating hardlinks, in the unusual case that there is a user-writable directory on the same filesystem. Signed-off-by: Kay Sievers Signed-off-by: Greg Kroah-Hartman commit 3048a0dbd810980f67882a8b6745d4a6ff24c53e Author: Tejun Heo Date: Fri Feb 5 17:57:02 2010 +0900 driver-core: fix race condition in get_device_parent() commit 77d3d7c1d561f49f755d7390f0764dff90765974 upstream. sysfs is creating several devices in cuse class concurrently and with CONFIG_SYSFS_DEPRECATED turned off, it triggers the following oops. BUG: unable to handle kernel NULL pointer dereference at 0000000000000038 IP: [] sysfs_addrm_start+0x4a/0xf0 PGD 75bb067 PUD 75be067 PMD 0 Oops: 0000 [#1] PREEMPT SMP last sysfs file: /sys/devices/system/cpu/cpu7/topology/core_siblings CPU 1 Modules linked in: cuse fuse Pid: 4737, comm: osspd Not tainted 2.6.31-work #77 RIP: 0010:[] [] sysfs_addrm_start+0x4a/0xf0 RSP: 0018:ffff88000042f8f8 EFLAGS: 00010296 RAX: ffff88000042ffd8 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff880007eef660 RDI: 0000000000000001 RBP: ffff88000042f918 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: ffffffff81158b0a R12: ffff88000042f928 R13: 00000000fffffff4 R14: 0000000000000000 R15: ffff88000042f9a0 FS: 00007fe93905a950(0000) GS:ffff880008600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000038 CR3: 00000000077c9000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process osspd (pid: 4737, threadinfo ffff88000042e000, task ffff880007eef040) Stack: ffff880005da10e8 0000000011cc8d6e ffff88000042f928 ffff880003d28a28 <0> ffff88000042f988 ffffffff811592d7 0000000000000000 0000000000000000 <0> 0000000000000000 0000000000000000 ffff88000042f958 0000000011cc8d6e Call Trace: [] create_dir+0x67/0xe0 [] sysfs_create_dir+0x58/0xb0 [] ? kobject_add_internal+0xcc/0x220 [] ? vsnprintf+0x3c1/0xb90 [] kobject_add_internal+0x107/0x220 [] kobject_add_varg+0x47/0x80 [] kobject_add+0x53/0x90 [] device_add+0xd4/0x690 [] ? dev_set_name+0x4b/0x70 [] cuse_process_init_reply+0x2b4/0x420 [cuse] ... The problem is that kobject_add_internal() first adds a kobject to the kset and then try to create sysfs directory for it. If the creation fails, it remove the kobject from the kset. get_device_parent() accesses class_dirs kset while only holding class_dirs.list_lock to see whether the cuse class dir exists. But when it exists, it may not have finished initialization yet or may fail and get removed soon. In the above case, the former happened so the second one ends up trying to create subdirectory under NULL sysfs_dirent. Fix it by grabbing a mutex in get_device_parent(). Signed-off-by: Tejun Heo Reported-by: Colin Guthrie Signed-off-by: Greg Kroah-Hartman commit cd67f0abe5a9285051848da36379f1433d52e946 Author: Daniel Mack Date: Fri Feb 26 14:36:54 2010 +0800 ASoC: fix ak4104 register array access commit e555317c083fda01f516d2153589e82514e20e70 upstream. Don't touch the variable 'reg' to construct the value for the actual SPI transport. This variable is again used to access the driver's register cache, and so random memory is overwritten. Compute the value in-place instead. Signed-off-by: Daniel Mack Acked-by: Liam Girdwood Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit d2a4799777816e66e6776c073fe5b75b1a0161fb Author: Paul Menzel Date: Mon Feb 8 20:42:46 2010 +0100 ALSA: hda-intel: Add position_fix quirk for ASUS M2V-MX SE. commit 0708cc582f0fe2578eaab722841caf2b4f8cfe37 upstream. With PulseAudio and an application accessing an input device like `gnome-volume-manager` both have high CPU load as reported in [1]. Loading `snd-hda-intel` with `position_fix=1` fixes this issue. Therefore add a quirk for ASUS M2V-MX SE. The only downside is, when now exiting for example MPlayer when it is playing an audio file a high pitched sound is outputted by the speaker. $ lspci -vvnn | grep -A10 Audio 20:01.0 Audio device [0403]: VIA Technologies, Inc. VT1708/A [Azalia HDAC] (VIA High Definition Audio Controller) [1106:3288] (rev 10) Subsystem: ASUSTeK Computer Inc. Device [1043:8290] Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- SERR- Kernel driver in use: HDA Intel [1] http://sourceforge.net/mailarchive/forum.php?thread_name=1265550675.4642.24.camel%40mattotaupa&forum_name=alsa-user Signed-off-by: Paul Menzel Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 676cd4887dda52d48d0429c73260b388c905152e Author: Takashi Iwai Date: Tue Dec 1 14:17:37 2009 +0100 ALSA: hda - Add position_fix quirk for HP dv3 commit 2f703e7a2ea5f6d5ea14a7b2cd0d31be07839ac6 upstream. HP dv3 requires position_fix=1. Reference: Novell bnc#555935 https://bugzilla.novell.com/show_bug.cgi?id=555935 Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 3a8c3769fb3c3210377b7e3adbbf7e9c6095b182 Author: Takashi Iwai Date: Mon Nov 30 11:58:30 2009 +0100 ALSA: hda - Add a position_fix quirk for MSI Wind U115 commit 45d4ebf1a6255f2234a041685789cbecac3453f1 upstream. MSI Wind U115 seems to require position_fix=1 explicitly. Otherwise it screws up PulseAudio. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 21f038c67d52bdf9517865643c3cd465317b3134 Author: Daniel T Chen Date: Fri Mar 5 09:04:49 2010 -0500 ALSA: hda: Use LPIB for a Biostar Microtech board commit 0321b69569eadbc13242922925a4316754c5f744 upstream. BugLink: https://launchpad.net/bugs/523953 The OR has verified that position_fix=1 is necessary to work around errors on his machine. Reported-by: MMarking Signed-off-by: Daniel T Chen Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 519e8d5897d1f514e3d9f9b17483bc10161e78a4 Author: Daniel T Chen Date: Wed Mar 3 18:24:26 2010 -0500 ALSA: hda: Use LPIB for Dell Latitude 131L commit 9919c7619c52d01e89103bca405cc3d4a2b1ac31 upstream. BugLink: https://launchpad.net/bugs/530346 The OR has verified that position_fix=1 is necessary to work around errors on his machine. Reported-by: Tom Louwrier Signed-off-by: Daniel T Chen Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit d8b82553894566c0ef134bfcd3ff9506c57962ca Author: Sebastien Alaiwan Date: Tue Feb 16 08:55:08 2010 +0100 ALSA: USB MIDI support for Access Music VirusTI commit d39e82db73eb876c60d00f00219d767b3be30307 upstream. Here's a patch that adds MIDI support through USB for one of the Access Music synths, the VirusTI. The synth uses standard USBMIDI protocol on its USB interface 3, although it does signal "vendor specific" class. A magic string has to be sent on interface 3 to enable the sending of MIDI from the synth (this string was found by sniffing usb communication of the Windows driver). This is all my patch does, and it works on my computer. Please note that the synth can also do standard usb audio I/O on its interfaces 2&3, which already works with the current snd-usb-audio driver, except for the audio input from the synth. I'm going to work on it when I have some time. Signed-off-by: Sebastien Alaiwan Signed-off-by: Clemens Ladisch Signed-off-by: Jaroslav Kysela Signed-off-by: Greg Kroah-Hartman commit 8ae96d4bb9ad09d3d6fe236d65c1cbdd989327de Author: Jaroslav Kysela Date: Tue Feb 16 11:55:43 2010 +0100 ALSA: pcm core - fix fifo_size channels interval check commit 3be522a9514f58e0596db34898a514df206cadc5 upstream. Signed-off-by: Jaroslav Kysela Signed-off-by: Greg Kroah-Hartman commit be2cebf69e3faf952e1373d0b0ea59a693a0d027 Author: Clemens Ladisch Date: Mon Feb 22 10:33:13 2010 +0100 ALSA: via82xx: add quirk for D1289 motherboard commit bf30a4309d4294d3eca248ea8a20c1c3570f5e74 upstream. Add a headphones-only quirk for the Fujitsu Siemens D1289. Signed-off-by: Clemens Ladisch Reported-and-tested-by: Marc Haber Signed-off-by: Jaroslav Kysela Signed-off-by: Greg Kroah-Hartman commit b5492fca91f6b3b247f182635bab7a8ef57f23c1 Author: Daniel T Chen Date: Sat Feb 20 11:16:30 2010 -0500 ALSA: hda: Use 3stack quirk for Toshiba Satellite L40-10Q commit ba579eb7b30791751f556ee01905636cda50c864 upstream. BugLink: https://bugs.launchpad.net/bugs/524948 The OR has verified that the existing model=laptop-eapd quirk does not function correctly but instead needs model=3stack. Make this change so that manual corrections to module-init-tools file(s) are not required. Reported-by: Lasse Havelund Signed-off-by: Daniel T Chen Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 8a9bd933fb68dd7e59314bf2e20138d0f5c48dd1 Author: Robert Richter Date: Fri Feb 26 13:45:24 2010 +0100 oprofile/x86: fix msr access to reserved counters commit cfc9c0b450176a077205ef39092f0dc1a04e020a upstream. During switching virtual counters there is access to perfctr msrs. If the counter is not available this fails due to an invalid address. This patch fixes this. Signed-off-by: Robert Richter Signed-off-by: Greg Kroah-Hartman commit daed3716251c22671c6864342f40b3861cca69a2 Author: Robert Richter Date: Thu Feb 25 20:20:25 2010 +0100 oprofile/x86: use kzalloc() instead of kmalloc() commit c17c8fbf349482e89b57d1b800e83e9f4cf40c47 upstream. Signed-off-by: Robert Richter Signed-off-by: Greg Kroah-Hartman commit 6b98d0388a6c54a57f5f5da7256ccfb7f2484987 Author: Robert Richter Date: Thu Jan 28 16:50:45 2010 +0100 oprofile/x86: remove node check in AMD IBS initialization commit 89baaaa98a10cad5cc8516c7208b02d9fc711890 upstream. Standard AMD systems have the same number of nodes as there are northbridge devices. However, there may kernel configurations (especially for 32 bit) or system setups exist, where the node number is different or it can not be detected properly. Thus the check is not reliable and may fail though IBS setup was fine. For this reason it is better to remove the check. Signed-off-by: Robert Richter Signed-off-by: Greg Kroah-Hartman commit c96d1b6618c4946e4aac704fc7fbb4bba2957047 Author: Robert Richter Date: Wed Feb 10 10:03:34 2010 +0100 oprofile: remove tracing build dependency commit 18b4a4d59e97e7ff13ee84b5bec79f3fc70a9f0a upstream. The commit 1155de4 ring-buffer: Make it generally available already made ring-buffer available without the TRACING option enabled. This patch removes the TRACING dependency from oprofile. Fixes also oprofile configuration on ia64. The patch also applies to the 2.6.32-stable kernel. Reported-by: Tony Jones Signed-off-by: Robert Richter Signed-off-by: Greg Kroah-Hartman commit 0ec19d6374c345a3c66da1576bec0f2cbe4b0d95 Author: Robert Richter Date: Thu Feb 25 19:16:46 2010 +0100 oprofile/x86: fix perfctr nmi reservation for mulitplexing commit 68dc819ce829f7e7977a56524e710473bdb55115 upstream. Multiple virtual counters share one physical counter. The reservation of virtual counters fails due to duplicate allocation of the same counter. The counters are already reserved. Thus, virtual counter reservation may removed at all. This also makes the code easier. Signed-off-by: Robert Richter Signed-off-by: Greg Kroah-Hartman commit 2451bd963fac237ff5545b28b399cd952bffc035 Author: Jean Delvare Date: Sun Jan 31 04:03:23 2010 +0000 macintosh/hwmon/ams: Fix device removal sequence commit 98ceb75c7c14eada76b0aa9f03a635a735cee3cb upstream. Some code that is in ams_exit() (the module exit code) should instead be called when the device (not module) is removed. It probably doesn't make much of a difference in the PMU case, but in the I2C case it does matter. I make no guarantee that my fix isn't racy, I'm not familiar enough with the ams driver code to tell for sure. Signed-off-by: Jean Delvare Tested-by: Christian Kujau Cc: Benjamin Herrenschmidt Cc: Stelian Pop Cc: Michael Hanselmann Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit 23e87a47dce919c82073e0ab0b741f35954c7512 Author: Jean Delvare Date: Sun Jan 31 04:00:30 2010 +0000 macintosh/therm_adt746x: Fix sysfs attributes lifetime commit 33a470f6d5e1879c26f16f6b34dc09f82d44f6e9 upstream. Looking at drivers/macintosh/therm_adt746x.c, the sysfs files are created in thermostat_init() and removed in thermostat_exit(), which are the driver's init and exit functions. These files are backed-up by a per-device structure, so it looks like the wrong thing to do: the sysfs files have a lifetime longer than the data structure that is backing it up. I think that sysfs files creation should be moved to the end of probe_thermostat() and sysfs files removal should be moved to the beginning of remove_thermostat(). Signed-off-by: Jean Delvare Tested-by: Christian Kujau Cc: Benjamin Herrenschmidt Cc: Colin Leroy Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit 7ec291833eb21e96fc62f58ce14076bf01d14e97 Author: Rafael J. Wysocki Date: Thu Feb 25 22:32:37 2010 +0100 PM / Hibernate: Fix preallocating of memory commit a9c9b4429df437982d2fbfab1f4b46b01329e9ed upstream. The hibernate memory preallocation code allocates memory to push some user space data out of physical RAM, so that the hibernation image is not too large. It allocates more memory than necessary for creating the image, so it has to release some pages to make room for allocations made while suspending devices and disabling nonboot CPUs, or the system will hang due to the lack of free pages to allocate from. Unfortunately, the function used for freeing these pages, free_unnecessary_pages(), contains a bug that prevents it from doing the job on all systems without highmem. Fix this problem, which is a regression from the 2.6.30 kernel, by using the right condition for the termination of the loop in free_unnecessary_pages(). Signed-off-by: Rafael J. Wysocki Reported-and-tested-by: Alan Jenkins Signed-off-by: Greg Kroah-Hartman commit b206354c4dcd2b50858c3ff0fd06d2c1588e66ba Author: Laurent Pinchart Date: Thu Aug 6 06:05:40 2009 -0300 V4L/DVB (13148): uvcvideo: Handle V4L2_CTRL_TYPE_BUTTON control type in VIDIOC_QUERYCTRL commit f4eabafeb3ea41801260fba624cbf2da971d19f8 upstream. Return minimum, maximum and step set to 0 without querying the hardware. Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab Cc: maximilian attems Signed-off-by: Greg Kroah-Hartman commit 7ca5552dc54b963251d488fdcbbd1eb34717145b Author: Ang Way Chuang Date: Thu Feb 25 09:45:03 2010 +0800 dvb-core: Fix DoS bug in ULE decapsulation code that can be triggered by an invalid Payload Pointer commit 29e1fa3565a7951cc415c634eb2b78dbdbee151d upstream. ULE (Unidirectional Lightweight Encapsulation RFC 4326) decapsulation has a bug that causes endless loop when Payload Pointer of MPEG2-TS frame is 182 or 183. Anyone who sends malicious MPEG2-TS frame will cause the receiver of ULE SNDU to go into endless loop. This patch was generated and tested against linux-2.6.32.9 and should apply cleanly to linux-2.6.33 as well because there was only one typo fix to dvb_net.c since v2.6.32. This bug was brought to you by modern day Santa Claus who decided to shower the satellite dish at Keio University with heavy snow causing huge burst of errors. We, receiver end, received Santa Claus's gift in the form of kernel bug. Care has been taken not to introduce more bug by fixing this bug, but please scrutinize the code for I always produces buggy code. Signed-off-by: Ang Way Chuang Acked-by: Mauro Carvalho Chehab Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit a3c00018400de53d11d05ce971cd2501a4d68916 Author: Greg Kroah-Hartman Date: Thu Feb 11 17:15:14 2010 -0800 Staging: mimio: remove the mimio driver commit e37bcc0de040127281de13a84a608570355c20eb upstream. It turns out that Mimio has a userspace solution for this product using libusb, and the in-kernel driver is just getting in the way now and causing problems. So they have asked that the in-kernel driver be removed. As the staging driver wasn't quite working anyway, and Mimio supports their libusb solution for all distros, I am removing the in-kernel driver. The libusb solution can be downloaded from: http://www.mimio.com/downloads/mimio_studio_software/linux.asp Cc: Cc: Phil Hannent Cc: Marc Rousseau Signed-off-by: Greg Kroah-Hartman commit 73f9636ad6c99edb2dc124163977fb874aae7ab8 Author: Greg Kroah-Hartman Date: Thu Feb 25 16:43:15 2010 -0800 Staging: hv: match on DMI values to know if we should run. commit c22090facd354749cfe99a46e903449c7ac07788 upstream. The HV core mucks around with specific irqs and other low-level stuff and takes forever to determine that it really shouldn't be running on a machine. So instead, trigger off of the DMI system information and error out much sooner. This also allows the module loading tools to recognize that this code should be loaded on this type of system. Cc: Haiyang Zhang Cc: Hank Janssen Signed-off-by: Greg Kroah-Hartman commit c69d2d2ac9612a192c4da34ee21f040dd6237833 Author: Greg Kroah-Hartman Date: Thu Feb 25 16:42:10 2010 -0800 Staging: hv: add a pci device table commit 9a775dbd4e8c87b7d35549183145321c7205404e upstream. This allows the HV core to be properly found and autoloaded by the system tools. It uses the Microsoft virtual VGA device to trigger this. Cc: Haiyang Zhang Cc: Hank Janssen Signed-off-by: Greg Kroah-Hartman commit d236c04008335d029a518b3faab6e3841fc6e050 Author: Ben Hutchings Date: Sat Jan 23 18:40:29 2010 +0000 SCSI: qla1280: Drop host_lock while requesting firmware commit 2cec802980727f1daa46d8c31b411e083d49d7a2 upstream. request_firmware() may sleep and it appears to be safe to release the spinlock here. Signed-off-by: Ben Hutchings Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit ad10d8be3c5b7fce739d6b4c70ab712ac34d743a Author: Paul Mundt Date: Thu Feb 25 16:37:46 2010 +0900 clocksource: Fix up a registration/IRQ race in the sh drivers. commit da64c2a8dee66ca03f4f3e15d84be7bedf73db3d upstream. All of the SH clocksource drivers follow the scheme that the IRQ is setup prior to registering the clockevent. The interrupt handler in the clockevent cases looks to the event handler function pointer being filled in by the registration code, permitting us to get in to situations where asserted IRQs step in to the handler before registration has had a chance to complete and hitting a NULL pointer deref. In practice this is not an issue for most platforms, but some of them with fairly special loaders (or that are chain-loading from another kernel) may enter in to this situation. This fixes up the oops reported by Rafael on hp6xx. Reported-and-tested-by: Rafael Ignacio Zurita Signed-off-by: Paul Mundt Signed-off-by: Greg Kroah-Hartman commit 34299ab10551905d26fc13166edc4d149ab497a9 Author: Jarek Poplawski Date: Wed Dec 23 21:54:29 2009 -0800 net/via-rhine: Fix scheduling while atomic bugs commit c0d7a0212becebe11ffe6979ee3d6f1c4104568d upstream. There are BUGs "scheduling while atomic" triggered by the timer rhine_tx_timeout(). They are caused by calling napi_disable() (with msleep()). This patch fixes it by moving most of the timer content to the workqueue function (similarly to other drivers, like tg3), with spin_lock() changed to BH version. Additionally, there is spin_lock_irq() moved in rhine_close() to exclude napi_disable() etc., also tg3's way. Reported-by: Andrey Rahmatullin Tested-by: Andrey Rahmatullin Signed-off-by: Jarek Poplawski Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 654b0f73a1ab0de2bf650e86f47462562c7cdb99 Author: Jussi Kivilinna Date: Sun Nov 22 20:16:47 2009 +0200 rndis_wlan: disable stall workaround commit 77593ae28c4c134eaf28ef34ecac3cd4464ecd6e upstream. Stall workaround doesn't work with bcm4320a devices like with bcm4320b. This workaround actually causes more stalls/device freeze on bcm4320a. Therefore disable stall workaround by default. Signed-off-by: Jussi Kivilinna Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit d0fe6fb19bcc6d7483c0705d5ae05c75ddfaee59 Author: Jussi Kivilinna Date: Sun Nov 22 20:16:42 2009 +0200 rndis_wlan: fix buffer overflow in rndis_query_oid commit c1f8ca1d837148bf061d6ffa2038366e3cf0e4d7 upstream. rndis_query_oid overwrites *len which stores buffer size to return full size of received command and then uses *len with memcpy to fill buffer with command. Ofcourse memcpy should be done before replacing buffer size. Signed-off-by: Jussi Kivilinna Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 82a0114194b288ae93fa89be97c07073fafa88bd Author: Jussi Kivilinna Date: Mon Nov 16 12:49:43 2009 +0200 rndis_wlan: handle NL80211_AUTHTYPE_AUTOMATIC commit 634a555ce3ee5ea1fdcaee8b4ac9ce7b54f301ac upstream. rndis_wlan didn't know about NL80211_AUTHTYPE_AUTOMATIC and simple setup with 'iwconfig wlan essid no-encrypt' would fail (ENOSUPP). v2: use NDIS_80211_AUTH_AUTO_SWITCH instead of _OPEN. This will make device try shared key auth first, then open. Signed-off-by: Jussi Kivilinna Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit c58f49beb5837d0216adb291e3b073bf9ffcc6b7 Author: Rajiv Andrade Date: Thu Sep 10 17:09:35 2009 -0300 tpm_tis: TPM_STS_DATA_EXPECT workaround commit 3507d612366a4e81226295f646410130a1f62a5c upstream. Some newer Lenovo models are shipped with a TPM that doesn't seem to set the TPM_STS_DATA_EXPECT status bit when sending it a burst of data, so the code understands it as a failure and doesn't proceed sending the chip the intended data. In this patch we bypass this bit check in case the itpm module parameter was set. This patch is based on Andy Isaacson's one: http://marc.info/?l=linux-kernel&m=124650185023495&w=2 It was heavily discussed how should we deal with identifying the chip in kernel space, but the required patch to do so was NACK'd: http://marc.info/?l=linux-kernel&m=124650186423711&w=2 This way we let the user choose using this workaround or not based on his observations on this code behavior when trying to use the TPM. Fixed a checkpatch issue present on the previous patch, thanks to Daniel Walker. Signed-off-by: Rajiv Andrade Acked-by: Eric Paris Tested-by: Seiji Munetoh Signed-off-by: James Morris Signed-off-by: Greg Kroah-Hartman commit 3f0fdaebcd434fd9d5343f3ccccb22a9fb5381d4 Author: Dave Airlie Date: Sun Dec 6 20:01:26 2009 +0000 offb: Add support for framebuffer handoff to offb. commit ceae8cbe94f3127253110e2d01b9334069e93177 upstream. This allows offb to be used for initial framebuffer, and a kms driver to take over later in the boot sequence. Signed-off-by: Dave Airlie Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit 11f933efd75252fadcde378f3e51d2afb66dc8f4 Author: Zhenyu Wang Date: Mon Dec 28 13:15:20 2009 +0800 drm/i915: disable TV hotplug status check commit 8fcc501831aa5b37a4a5a8cd9dc965be3cacc599 upstream. As we removed TV hotplug, don't check its status ever. Reviewed-by: Adam Jackson Signed-off-by: Zhenyu Wang Signed-off-by: Eric Anholt Signed-off-by: Greg Kroah-Hartman commit 5b3fc293ff31b67890c85135f7b15b3173840540 Author: Daniel Vetter Date: Tue Nov 3 09:03:34 2009 +0000 drm/i915: fix get_core_clock_speed for G33 class desktop chips commit 43bcd61fae05fc6062b4f117c5adb1a72c9f8c57 upstream. Somehow the case for G33 got dropped while porting from ums code. This made a 400MHz chip into a 133MHz one which resulted in the unnecessary enabling of double wide pipe mode which in turn screwed up the overlay code. Nothing else (than the overlay code) seems to be affected. This fixes fdo.org bug #24835 Signed-off-by: Daniel Vetter Signed-off-by: Eric Anholt Signed-off-by: Greg Kroah-Hartman commit 1a8c3312c8db953779ba8480567880da165aa57b Author: Aaro Koskinen Date: Fri Mar 5 13:44:24 2010 -0800 rtc-core: fix memory leak commit 2a7a06a0cdd86d572e91657603180da5992be6d3 upstream. The idr should be destroyed when the module is unloaded. Found with kmemleak. Signed-off-by: Aaro Koskinen Cc: Alessandro Zummo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 154d9b4d57283cb6e6d446445fef805525f613ea Author: Anirban Chakraborty Date: Thu Feb 4 14:17:59 2010 -0800 SCSI: qla2xxx: Obtain proper host structure during response-queue processing. commit a67093d46e3caed1a42d694a7de452b61db30562 upstream. Original code incorrectly assumed only status-type-0 IOCBs would be queued to the response-queue, and thus all entries would safely reference a VHA from the IOCB 'handle.' Signed-off-by: Giridhar Malavali Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 9c69f804cf971237938adf76b04099a3307fcc88 Author: Jerome Glisse Date: Sun Feb 14 19:33:18 2010 +0000 drm/radeon: r6xx/r7xx possible security issue, system ram access commit c8c15ff1e90bfc4a2db1ba77a01b3b2783e723fc upstream This patch workaround a possible security issue which can allow user to abuse drm on r6xx/r7xx hw to access any system ram memory. This patch doesn't break userspace, it detect "valid" old use of CB_COLOR[0-7]_FRAG & CB_COLOR[0-7]_TILE registers and overwritte the address these registers are pointing to with the one of the last color buffer. This workaround will work for old mesa & xf86-video-ati and any old user which did use similar register programming pattern as those (we expect that there is no others user of those ioctl except possibly a malicious one). This patch add a warning if it detects such usage, warning encourage people to update their mesa & xf86-video-ati. New userspace will submit proper relocation. Fix for xf86-video-ati / mesa (this kernel patch is enough to prevent abuse, fix for userspace are to set proper cs stream and avoid kernel warning) : http://cgit.freedesktop.org/xorg/driver/xf86-video-ati/commit/?id=95d63e408cc88b6934bec84a0b1ef94dfe8bee7b http://cgit.freedesktop.org/mesa/mesa/commit/?id=46dc6fd3ed5ef96cda53641a97bc68c3bc104a9f Abusing this register to perform system ram memory is not easy, here is outline on how it could be achieve. First attacker must have access to the drm device and be able to submit command stream throught cs ioctl. Then attacker must build a proper command stream for r6xx/r7xx hw which will abuse the FRAG or TILE buffer to overwrite the GPU GART which is in VRAM. To achieve so attacker as to setup CB_COLOR[0-7]_FRAG or CB_COLOR[0-7]_TILE to point to the GPU GART, then it has to find a way to write predictable value into those buffer (with little cleverness i believe this can be done but this is an hard task). Once attacker have such program it can overwritte GPU GART to program GPU gart to point anywhere in system memory. It then can reusse same method as he used to reprogram GART to overwritte the system ram through the GART mapping. In the process the attacker has to be carefull to not overwritte any sensitive area of the GART table, like ring or IB gart entry as it will more then likely lead to GPU lockup. Bottom line is that i think it's very hard to use this flaw to get system ram access but in theory one can achieve so. Side note: I am not aware of anyone ever using the GPU as an attack vector, nevertheless we take great care in the opensource driver to try to detect and forbid malicious use of GPU. I don't think the closed source driver are as cautious as we are. [bwh: Adjusted context for 2.6.32] Signed-off-by: Jerome Glisse Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit b124292ef89820f7f44a892e88133f3256b19646 Author: Jerome Glisse Date: Sun Feb 14 19:31:58 2010 +0000 drm/radeon/kms: r600/r700 don't test ib if ib initialization fails commit db96380ea26fcc31ab37189aedeabd12894b1431 upstream If ib initialization failed don't try to test ib as it will result in an oops (accessing NULL ib buffer ptr). [bwh: Adjusted context for 2.6.32] Signed-off-by: Jerome Glisse Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit b74d5e0279a43ab9762c733128f05b502c6fc5a0 Author: Jerome Glisse Date: Sun Jan 17 21:21:41 2010 +0100 drm/radeon/kms: Forbid creation of framebuffer with no valid GEM object commit 7e71c9e2e7704ebf044d4a964e02fbd2098a173f upstream. This will avoid oops if at later point the fb is use. Trying to create a framebuffer with no valid GEM object is bogus and should be forbidden as this patch does. Signed-off-by: Jerome Glisse Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit a816ca1fe6aa3c3a2924936cf7c688f59099b933 Author: stephen hemminger Date: Mon Feb 1 13:41:47 2010 +0000 sky2: fix transmit DMA map leakage [ Upstream commit f6815077e75c5b7f55b56fc3788e328514d4e72a ] The book keeping structure for transmit always had the flags value cleared so transmit DMA maps were never released correctly. Based on patch by Jarek Poplawski, problem observed by Michael Breuer. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 7f376b982b1751df9e0bf8b5f38337084c2d1215 Author: Choi, David Date: Wed Jan 27 06:03:16 2010 +0000 drivers/net: ks8851_mll ethernet network driver [ Upstream commit aeedba8bd2cf2f6f7b45bc7853754a03bc926797 ] Hello David Miller, I fix a bug in ks8851_mll driver, which has existed since 2.6.32-rc6. >From : David J. Choi Fix a bug that the data pointers in the interrupt handler are set wrong, which is related with the 5th parameter of request_irq(). Signed-off-by: David J. Choi Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit c191a795447dd22e3f504bdc627ec79126629697 Author: Shan Wei Date: Tue Jan 26 02:40:38 2010 +0000 ipv6: conntrack: Add member of user to nf_ct_frag6_queue structure [ Upstream commit c92b544bd5d8e7ed7d81c77bbecab6df2a95aa53 ] The commit 0b5ccb2(title:ipv6: reassembly: use seperate reassembly queues for conntrack and local delivery) has broken the saddr&&daddr member of nf_ct_frag6_queue when creating new queue. And then hash value generated by nf_hashfn() was not equal with that generated by fq_find(). So, a new received fragment can't be inserted to right queue. The patch fixes the bug with adding member of user to nf_ct_frag6_queue structure. Signed-off-by: Shan Wei Acked-by: Patrick McHardy Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 90a362e9ee4a793cff24c7c77db10a7bf4ccabdd Author: Herbert Xu Date: Sun Feb 7 17:26:30 2010 +0000 inet: Remove bogus IGMPv3 report handling [ Upstream commit c6b471e6454c0e1c6d756672841cbaeae7c949f8 ] Currently we treat IGMPv3 reports as if it were an IGMPv2/v1 report. This is broken as IGMPv3 reports are formatted differently. So we end up suppressing a bogus multicast group (which should be harmless as long as the leading reserved field is zero). In fact, IGMPv3 does not allow membership report suppression so we should simply ignore IGMPv3 membership reports as a host. This patch does exactly that. I kept the case statement for it so people won't accidentally add it back thinking that we overlooked this case. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 3118b8e153b1d293be320240733aa32e4b8ad437 Author: Ajit Khaparde Date: Sun Feb 21 18:43:37 2010 -0800 net: bug fix for vlan + gro issue [ Upstream commit e76b69cc0133952c98aa1ad6330cacacd269fd64 ] Traffic (tcp) doesnot start on a vlan interface when gro is enabled. Even the tcp handshake was not taking place. This is because, the eth_type_trans call before the netif_receive_skb in napi_gro_finish() resets the skb->dev to napi->dev from the previously set vlan netdev interface. This causes the ip_route_input to drop the incoming packet considering it as a packet coming from a martian source. I could repro this on 2.6.32.7 (stable) and 2.6.33-rc7. With this fix, the traffic starts and the test runs fine on both vlan and non-vlan interfaces. CC: Herbert Xu CC: Patrick McHardy Signed-off-by: Ajit Khaparde Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 9c42239c50d46364aecf2d5b6a927464a52e2723 Author: Eric W. Biederman Date: Fri Feb 19 13:23:47 2010 +0000 net-sysfs: Use rtnl_trylock in wireless sysfs methods. [ Upstream commit b8afe6416101549e877f8470f2a160df69676166 ] The wireless sysfs methods like the rest of the networking sysfs methods are removed with the rtnl_lock held and block until the existing methods stop executing. So use rtnl_trylock and restart_syscall so that the code continues to work. Signed-off-by: Eric W. Biederman Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 7ee8af9de5b806144734e2bfbbd9eccf5aecb374 Author: Eric W. Biederman Date: Fri Feb 19 13:22:59 2010 +0000 net: Fix sysctl restarts... [ Upstream commit 88af182e389097997c5e2a0b42285b3522796759 ] Yuck. It turns out that when we restart sysctls we were restarting with the values already changed. Which unfortunately meant that the second time through we thought there was no change and skipped all kinds of work, despite the fact that there was indeed a change. I have fixed this the simplest way possible by restoring the changed values when we restart the sysctl write. One of my coworkers spotted this bug when after disabling forwarding on an interface pings were still forwarded. Signed-off-by: Eric W. Biederman Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 26e272a3c2670bfbf91c477c964fc14d3e6f9ed5 Author: David S. Miller Date: Fri Feb 19 15:19:52 2010 -0800 sparc64: Fix sun4u execute bit check in TSB I-TLB load. [ Upstream commit 1f474646fdc36b457606bbcd6a3592e6cbd31ac4 ] Thanks to testcase and report from Brad Spengler: -------------------- #include typedef int (* _wee)(void); int main(void) { char buf[8] = { '\x81', '\xc7', '\xe0', '\x08', '\x81', '\xe8', '\x00', '\x00' }; _wee wee; printf("%p\n", &buf); wee = (_wee)&buf; wee(); return 0; } -------------------- TSB I-tlb load code tries to use andcc to check the _PAGE_EXEC_4U bit, but that's bit 12 so it gets sign extended all the way up to bit 63 and the test nearly always passes as a result. Use sethi to fix the bug. Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit bbc9c131b1dec886899452819d0afd82c4e3c818 Author: Roel Kluin Date: Fri Jan 15 01:27:49 2010 -0800 sparc: leds_resource.end assigned to itself in clock_board_probe() [ Upstream commit 093171465235a8482fbf08a9a2e365247e1f7dd5 ] It should be a 1 byte region. Signed-off-by: Roel Kluin Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 4ce9b6fbec21d13cec19e419c7b61efb5b2f4251 Author: David S. Miller Date: Sun Feb 21 18:03:16 2010 -0800 sparc32: Fix struct stat uid/gid types. [ Upstream commit 2531be413b3f2f64c0282073de89fe52bbcbbab5 ] Commit 085219f79cad89291699bd2bfb21c9fdabafe65f ("sparc32: use proper types in struct stat") Accidently changed the struct stat uid/gid members to uid_t and gid_t, but those get set to __kernel_uid32_t and __kernel_gid32_t respectively. Those are of type 'int' but the structure is meant to have 'short'. So use uid16_t and gid16_t to correct this. Reported-by: Rob Landley Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit dcd5d32805ae970068e874c93e769db7e3d22206 Author: David S. Miller Date: Thu Jan 14 03:14:53 2010 -0800 sparc32: Fix page_to_phys(). [ Upstream commit 8654164f54bd02787ae91db8526dcae8e7e34eeb ] It doesn't account for phys_base like it should, fix by using page_to_pfn(). While we're here, make virt_to_page() use pfn_to_page() as well, so we consistently use the asm/memory-model.h abstractions instead of open-coding memory model assumptions. Tested-by: Kristoffer Glembo Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 3ec2e74fa1518e1fb8d27e08ee820bdf33c9896c Author: David S. Miller Date: Sun Feb 21 19:14:37 2010 -0800 sparc: Align clone and signal stacks to 16 bytes. [ Upstream commits f036d9f3985a529a81e582f68aa984eb7b20d54d and 440ab7ac2d6b735fb278a1ff1674f6716314c6bb ] This is mandatory for 64-bit processes, and doing it also for 32-bit processes saves a conditional in the compat case. This fixes the glibc/nptl/tst-stdio1 test case, as well as many others, on 64-bit. Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 6b3a4b9c49dfd933ca05ef9a052da8355143b849 Author: Al Viro Date: Thu Jan 14 01:03:28 2010 -0500 Switch proc/self to nd_set_link() commit 7fee4868be91e71a3ee8e57289ebf5e10a12297e upstream. Signed-off-by: Al Viro Signed-off-by: Greg Kroah-Hartman commit 5e0bf19b7e58825aac1c02df5e54fab697b910e5 Author: Tejun Heo Date: Mon Feb 22 12:44:19 2010 -0800 idr: fix a critical misallocation bug, take#2 commit d2e7276b6b5e4bc2148891a056d5862c5314342d upstream. This is retry of reverted 859ddf09743a8cc680af33f7259ccd0fd36bfe9d ("idr: fix a critical misallocation bug") which contained two bugs. * pa[idp->layers] should be cleared even if it's not used by sub_alloc() because it's used by mark idr_mark_full(). * The original condition check also assigned pa[l] to p which the new code didn't do thus leaving p pointing at the wrong layer. Both problems have been fixed and the idr code has received good amount testing using userland testing setup where simple bitmap allocator is run parallel to verify the result of idr allocation. The bug this patch fixes is caused by sub_alloc() optimization path bypassing out-of-room condition check and restarting allocation loop with starting value higher than maximum allowed value. For detailed description, please read commit message of 859ddf09. Signed-off-by: Tejun Heo Based-on-patch-from: Eric Paris Reported-by: Eric Paris Tested-by: Stefan Lippers-Hollmann Tested-by: Serge Hallyn Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 7ef79e1045213953b87f45cf5993cc9c70c873ec Author: Stanislaw Gruszka Date: Tue Feb 2 15:34:50 2010 +0100 airo: fix setting zero length WEP key commit f09c256375c7cf1e112b8ef6306cdd313490d7c0 upstream. Patch prevents call set_wep_key() with zero key length. That fix long standing regression since commit c0380693520b1a1e4f756799a0edc379378b462a "airo: clean up WEP key operations". Additionally print call trace when someone will try to use improper parameters, and remove key.len = 0 assignment, because it is in not possible code path. Reported-by: Chris Siebenmann Bisected-by: Chris Siebenmann Tested-by: Chris Siebenmann Cc: Dan Williams Signed-off-by: Stanislaw Gruszka Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 7e1228c91635433ff63583dbdc6f1a1249dd5116 Author: Oliver Neukum Date: Fri Feb 12 13:02:28 2010 +0100 HID: usbhid: introduce timeout for stuck ctrl/out URBs commit 858155fbcc0cd713f6382c527bb1c3abc0ed6d00 upstream. Some devices do not react to a control request (seen on APC UPS's) resulting in a slow stream of messages, "generic-usb ... control queue full". Therefore request needs a timeout. Signed-off-by: Oliver Neukum Signed-off-by: David Fries Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit c4eaf348b013104d7c0b3836c731a978a48e51a8 Author: Peter Hutterer Date: Thu Dec 3 15:08:10 2009 +1000 HID: add multi-input quirk for NextWindow Touchscreen. commit 9db630b48a99adb4156e205b812fba8959644280 upstream. These touchscreens are mounted onto HP TouchSmart and the Dell Studio One 19. Without a quirk they report a wrong button set and the x/y coordinates through ABS_Z/ABS_RX, confusing the higher levels (most notably X.Org's evdev driver). Device id 0x003 covers models 1900, 2150, and 2700 [1] though testing could only be performed on a model 1900. [1] http://www.nextwindow.com/nextwindow_support/latest_tech_info.html Signed-off-by: Peter Hutterer Signed-off-by: Jiri Kosina Cc: maximilian attems Signed-off-by: Greg Kroah-Hartman commit b916415ec4dfef2646c8d4dd3bd73d408c7d525f Author: Jiri Kosina Date: Wed Dec 23 14:13:46 2009 +0100 HID: remove TENX iBuddy from blacklist commit 4bb9508bbbb06f10bc3e249dd34375b4a4d6bfc0 upstream. There were multiple reports which indicate that vendor messed up horribly and the same VID/PID combination is used for completely different devices, some of them requiring the blacklist entry and other not. Remove the blacklist entry for this combination of VID/PID completely, and let the user decide and unbind the driver via sysfs eventually, if needed. Proper fix would be fixing the vendor. References: http://lkml.org/lkml/2009/2/10/434 http://bugzilla.kernel.org/show_bug.cgi?id=13411 Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit 7c083ba91b1fead40edfe8397606e04e92a0fc79 Author: Wu Fengguang Date: Fri Mar 5 13:42:03 2010 -0800 readahead: introduce FMODE_RANDOM for POSIX_FADV_RANDOM commit 0141450f66c3c12a3aaa869748caa64241885cdf upstream. This fixes inefficient page-by-page reads on POSIX_FADV_RANDOM. POSIX_FADV_RANDOM used to set ra_pages=0, which leads to poor performance: a 16K read will be carried out in 4 _sync_ 1-page reads. In other places, ra_pages==0 means - it's ramfs/tmpfs/hugetlbfs/sysfs/configfs - some IO error happened where multi-page read IO won't help or should be avoided. POSIX_FADV_RANDOM actually want a different semantics: to disable the *heuristic* readahead algorithm, and to use a dumb one which faithfully submit read IO for whatever application requests. So introduce a flag FMODE_RANDOM for POSIX_FADV_RANDOM. Note that the random hint is not likely to help random reads performance noticeably. And it may be too permissive on huge request size (its IO size is not limited by read_ahead_kb). In Quentin's report (http://lkml.org/lkml/2009/12/24/145), the overall (NFS read) performance of the application increased by 313%! Tested-by: Quentin Barnes Signed-off-by: Wu Fengguang Cc: Nick Piggin Cc: Andi Kleen Cc: Steven Whitehouse Cc: David Howells Cc: Jonathan Corbet Cc: Al Viro Cc: Christoph Hellwig Cc: Trond Myklebust Cc: Chuck Lever Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit d9ee70916b2f1bb17ebdf993e591d2fd84e7e775 Author: Wu Fengguang Date: Fri Mar 5 13:42:01 2010 -0800 vfs: take f_lock on modifying f_mode after open time commit 42e49608683ab25fbbbf9c40edb944601e543882 upstream. We'll introduce FMODE_RANDOM which will be runtime modified. So protect all runtime modification to f_mode with f_lock to avoid races. Signed-off-by: Wu Fengguang Cc: Al Viro Cc: Christoph Hellwig Cc: Trond Myklebust Cc: Chuck Lever Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 6e8b0197a96edcf0c650b508f2906e0245f73dee Author: Theodore Kilgore Date: Fri Dec 25 05:15:10 2009 -0300 V4L/DVB (13991): gspca_mr973010a: Fix cif type 1 cameras not streaming on UHCI controllers commit 70136081fc67ea77d849f86fa323e5773c8e40ea upstream. If you read the mail to Oliver Neukum on the linux-usb list, then you know that I found a cure for the mysterious problem that the MR97310a CIF "type 1" cameras have been freezing up and refusing to stream if hooked up to a machine with a UHCI controller. Namely, the cure is that if the camera is an mr97310a CIF type 1 camera, you have to send it 0xa0, 0x00. Somehow, this is a timing reset command, or such. It un-blocks whatever was previously stopping the CIF type 1 cameras from working on the UHCI-based machines. Signed-off-by: Theodore Kilgore Signed-off-by: Hans de Goede Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit 764309980c4e68ea2d3312199e436ac8549e5f84 Author: Zhu Yi Date: Mon Dec 28 16:57:15 2009 +0800 mac80211: quit addba_resp_timer if Tx BA session is torn down commit 3dc1de0bf23816ed557ac8addf680cd5ee57e805 upstream. Make addba_resp_timer aware the HT_AGG_STATE_REQ_STOP_BA_MSK mask so that when ___ieee80211_stop_tx_ba_session() is issued the timer will quit. Otherwise when suspend happens before the timer expired, the timer handler will be called immediately after resume and messes up driver status. Signed-off-by: Zhu Yi Acked-by: Johannes Berg Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit b36eb52d66d4ac8c4aa00456f5a62ec8aca1a489 Author: Haicheng Li Date: Wed Jan 6 15:25:23 2010 +0800 slab: initialize unused alien cache entry as NULL at alloc_alien_cache(). commit f3186a9c51eabe75b2780153ed7f07778d78b16e upstream. Comparing with existing code, it's a simpler way to use kzalloc_node() to ensure that each unused alien cache entry is NULL. CC: Eric Dumazet Acked-by: Andi Kleen Acked-by: Christoph Lameter Acked-by: Matt Mackall Signed-off-by: Haicheng Li Signed-off-by: Pekka Enberg Signed-off-by: Greg Kroah-Hartman commit 7c0f2aedfa71f7f48c780b11eef1322ff4b9d40f Author: Kashyap, Desai Date: Wed Dec 16 18:50:06 2009 +0530 mpt2sas: Delete volume before HBA detach. commit d7384b28afb2bf2b7be835ddc8c852bdc5e0ce1c upstream. The driver hangs when doing `rmmod mpt2sas` if there are any IR volumes present.The hang is due the scsi midlayer trying to access the IR volumes after the driver releases controller resources. Perhaps when scsi_remove_host is called,the scsi mid layer is sending some request. This doesn't occur for bare drives becuase the driver is already reporting those drives deleted prior to calling mpt2sas_base_detach. To solve this issue, we need to delete the volumes as well. Signed-off-by: Kashyap Desai Reviewed-by: Eric Moore Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit cc03dfc07cc4acf73b721ca9a57c6d4d2101ae49 Author: Pallipadi, Venkatesh Date: Wed Feb 10 10:35:31 2010 -0800 ACPI: Be in TS_POLLING state during mwait based C-state entry commit d306ebc28649b89877a22158fe0076f06cc46f60 upstream. ACPI deep C-state entry had a long standing bug/missing feature, wherein we were sending resched IPIs when an idle CPU is in mwait based deep C-state. Only mwait based C1 was using the write to the monitored address to wake up mwait'ing CPU. This patch changes the code to retain TS_POLLING bit if we are entering an mwait based deep C-state. The patch has been verified to reduce the number of resched IPIs in general and also improves the performance/power on workloads with low system utilization (i.e., when mwait based deep C-states are being used). Fixes "netperf ~50% regression with 2.6.33-rc1, bisect to 1b9508f" http://marc.info/?l=linux-kernel&m=126441481427331&w=4 Reported-by: Lin Ming Tested-by: Alex Shi Signed-off-by: Venkatesh Pallipadi Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman commit 35f32e94f5c5e392a1dcaf7af8bda33b85acc991 Author: Zhang Rui Date: Tue Feb 16 04:16:55 2010 -0500 ACPI, i915: blacklist Clevo M5x0N bad_lid state commit 1379d2fef0ec07c7027a5e89036025ce761470c8 upstream. Wrong Lid state reported. Need to blacklist this machine for LVDS detection. Signed-off-by: Zhang Rui Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman commit baa4c4c30a57e2eb1e2fe7b39105858b82195750 Author: Roel Kluin Date: Tue Feb 2 14:37:58 2010 -0800 thinkpad-acpi: wrong thermal attribute_group removed in thermal_exit() commit f04d5e012d73ea441bd39804ace39fd6d1ce5611 upstream. sysfs_remove_group() removed the wrong attribute_group for thermal_read_mode TPEC_8, ACPI_TMP07 and ACPI_UPDT Signed-off-by: Roel Kluin Acked-by: Henrique de Moraes Holschuh Signed-off-by: Andrew Morton Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman commit b8f3bf57d555898a0c4710d72f1426b8e60db1ae Author: Len Brown Date: Tue Feb 16 03:45:45 2010 -0500 ACPI: fix "acpi=ht" boot option commit 49bf83a45fc677db1ed44d0e072e6aaeabe4e124 upstream. We broke "acpi=ht" in 2.6.32 by disabling MADT parsing for acpi=disabled. e5b8fc6ac158f65598f58dba2c0d52ba3b412f52 This also broke systems which invoked acpi=ht via DMI blacklist. acpi=ht is a really ugly hack, but restore it for those that still use it. http://bugzilla.kernel.org/show_bug.cgi?id=14886 Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman commit 0cc32162e08580be90430a1e4b7b6196a6fae227 Author: Len Brown Date: Tue Feb 16 03:30:06 2010 -0500 ACPI: remove Asus P2B-DS from acpi=ht blacklist commit 97c169d39b6846a564dc8d883832e7fef9bdb77d upstream. We realized when we broke acpi=ht http://bugzilla.kernel.org/show_bug.cgi?id=14886 that acpi=ht is not needed on this box and folks have been using acpi=force on it anyway. Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman commit 3cf2600e7e8ec23e59c803460105f5ad7f15843a Author: Andrew Morton Date: Tue Feb 2 14:45:54 2010 -0800 PCI hotplug: check ioremap() return value in ibmphp_ebda.c commit ba02b242bbf8e4e1bc63d62e8ccec33b4e5ea132 upstream. check ioremap() return value. Signed-off-by: Andrew Morton Signed-off-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman commit 7bc9597fec2c87457aec0f410e907263c7304096 Author: Chandru Date: Mon Jan 11 11:49:21 2010 +0530 PCI hotplug: ibmphp: read the length of ebda and map entire ebda region commit b0fc889c4311835ae7d02f433154bc20cad9ee11 upstream. ibmphp driver currently maps only 1KB of ebda memory area into kernel address space during driver initialization. This causes kernel oops when the driver is modprobe'd and it accesses memory beyond 1KB within ebda segment. The first byte of ebda segment actually stores the length of the ebda region in Kilobytes. Hence make use of the length parameter and map the entire ebda region. Signed-off-by: Chandru Siddalingappa Signed-off-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman commit 6eefd62ab7b4fba12b7daa59a0968568e2534365 Author: Robert Hancock Date: Tue Jan 26 22:33:23 2010 -0600 ahci: disable FPDMA auto-activate optimization on NVIDIA AHCI commit 453d3131ec7aab82eaaa8401a50522a337092aa8 upstream. Mike Cui reported that his system with an NVIDIA MCP79 (aka MCP7A) chipset stopped working with 2.6.32. The problem appears to be that 2.6.32 now enables the FPDMA auto-activate optimization in the ahci driver. The drive works fine with this enabled on an Intel AHCI so this appears to be a chipset bug. Since MCP79 is a fairly recent NVIDIA chipset and we don't have any info on whether any other NVIDIA chipsets have this issue, disable FPDMA AA optimization on all NVIDIA AHCI controllers for now. Should address http://bugzilla.kernel.org/show_bug.cgi?id=14922 Signed-off-by: Robert Hancock While-we-investigate-issue-this-patch-looks-good-to-me-by: Prajakta Gudadhe Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit 15bd3e21f0b4b12aca0f016cb2d962fc227182e2 Author: Joshua Roys Date: Wed Feb 24 18:52:44 2010 -0500 netlabel: fix export of SELinux categories > 127 commit c36f74e67fa12202dbcb4ad92c5ac844f9d36b98 upstream. This fixes corrupted CIPSO packets when SELinux categories greater than 127 are used. The bug occured on the second (and later) loops through the while; the inner for loop through the ebitmap->maps array used the same index as the NetLabel catmap->bitmap array, even though the NetLabel bitmap is twice as long as the SELinux bitmap. Signed-off-by: Joshua Roys Acked-by: Paul Moore Signed-off-by: James Morris Signed-off-by: Greg Kroah-Hartman commit 44af042e42f2231579ea8ef7586d3789d198f609 Author: Stanislaw Gruszka Date: Fri Feb 19 15:47:33 2010 -0800 iwlwifi: sanity check before counting number of tfds can be free commit a120e912eb51e347f36c71b60a1d13af74d30e83 upstream. Check the frame control for ieee80211_is_data_qos() is true before counting the number of tfds can be free, the tfds_in_queue only increment when ieee80211_is_data_qos() is true before transmit; so it should only decrement if the type match. Remove ieee80211_is_data_qos check for frame_ctrl in tx_resp to avoid invalid information pass from uCode. Signed-off-by: Stanislaw Gruszka Signed-off-by: Wey-Yi Guy Signed-off-by: Reinette Chatre Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 7f9bf0abd2abda4960fbf376295eb1c20022b455 Author: Dan Halperin Date: Thu Feb 18 22:01:39 2010 -0800 iwlwifi: set HT flags after channel in rxon commit 5e2f75b8993a0d83d469388b50716dd5551f2eb4 upstream. The HT extension channel settings require priv->staging_rxon.channel to be accurate. However, iwl_set_rxon_ht was being called before iwl_set_rxon_channel and thus HT40 could be broken unless another call to iwl_mac_config came in. This problem was recently introduced by "iwlwifi: Fix to set correct ht configuration" The particular setting in which I noticed this was monitor mode: iwconfig wlan0 mode monitor ifconfig wlan0 up ./iw wlan0 set channel 64 HT40- #./iw wlan0 set channel 64 HT40- tcpdump -i wlan0 -y IEEE802_11_RADIO would only catch HT40 packets if I issued the IW command twice. From visual inspection, iwl_set_rxon_channel does not depend on iwl_set_rxon_ht, so simply swapping them should be safe and fixes this problem. Signed-off-by: Daniel Halperin Acked-by: Wey-Yi Guy Signed-off-by: Reinette Chatre Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 1109a2eae8cee1a3f7ee9d6904ad88625e2cc52f Author: Wey-Yi Guy Date: Fri Feb 19 15:47:32 2010 -0800 iwlwifi: error checking for number of tfds in queue commit a239a8b47cc0e5e6d7416a89f340beac06d5edaa upstream. When receive reply_tx and ready to decrement the count for number of tfds in queue, do error checking to prevent error condition and tfds_in_queue become negative number. Signed-off-by: Wey-Yi Guy Signed-off-by: Reinette Chatre Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 30ef8852b60f811d9ceca04590a2bd4373e7e81e Author: Michael Neuling Date: Mon Feb 22 12:44:24 2010 -0800 fs/exec.c: fix initial stack reservation commit a17e18790a8c47113a73139d54a375dc9ccd8f08 upstream. 803bf5ec259941936262d10ecc84511b76a20921 ("fs/exec.c: restrict initial stack space expansion to rlimit") attempts to limit the initial stack to 20*PAGE_SIZE. Unfortunately, in attempting ensure the stack is not reduced in size, we ended up not changing the stack at all. This size reduction check is not necessary as the expand_stack call does this already. This caused a regression in UML resulting in most guest processes being killed. Signed-off-by: Michael Neuling Reviewed-by: KOSAKI Motohiro Acked-by: WANG Cong Cc: Anton Blanchard Cc: Oleg Nesterov Cc: James Morris Cc: Serge Hallyn Cc: Benjamin Herrenschmidt Cc: Jouni Malinen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 601c25d9fd1d5c4629e5361271cfe9cd0ffb4c98 Author: KAMEZAWA Hiroyuki Date: Mon Feb 22 12:44:14 2010 -0800 memcg: fix oom killing a child process in an other cgroup commit 5a2d41961dd6815b874b5c0afec0ac96cd90eea4 upstream. Presently the oom-killer is memcg aware and it finds the worst process from processes under memcg(s) in oom. Then, it kills victim's child first. It may kill a child in another cgroup and may not be any help for recovery. And it will break the assumption users have. This patch fixes it. Signed-off-by: KAMEZAWA Hiroyuki Reviewed-by: Minchan Kim Cc: Balbir Singh Reviewed-by: Daisuke Nishimura Acked-by: David Rientjes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit fc58ea8cab4a38e2f848f32e48872194bc0cc57e Author: Ben Hutchings Date: Wed Feb 10 23:57:17 2010 -0300 V4L/DVB: cxusb: Select all required frontend and tuner modules commit fc4a7f93087a48619005111895dcaa115f807399 upstream. cxusb uses the atbm8830 and lgs8gxx (not lgs8gl5) frontends and the max2165 tuner, so it needs to select them. Signed-off-by: Ben Hutchings Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit dcb086ecb08c4ff8de15b553f07a8f0fc69dd31f Author: Jean Delvare Date: Fri Feb 19 00:18:41 2010 -0300 V4L/DVB: bttv: Move I2C IR initialization commit 2434466432464110b5307757e0285dd41f15512e upstream. Move I2C IR initialization from just after I2C bus setup to right before non-I2C IR initialization. This avoids the case where an I2C IR device is blocking audio support (at least the PV951 suffers from this). It is also more logical to group IR support together, regardless of the connectivity. This fixes bug #15184: http://bugzilla.kernel.org/show_bug.cgi?id=15184 Signed-off-by: Jean Delvare Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit a0497206defc4bc38a6bef6cb3b9bbed6be3ff50 Author: Martin Fuzzey Date: Thu Feb 11 10:50:31 2010 -0300 V4L/DVB: Video : pwc : Fix regression in pwc_set_shutter_speed caused by bad constant => sizeof conversion. commit 53f68607caba85db9a73846ccd289e4b7fa96295 upstream. Regression was caused by my commit 6b35ca0d3d586b8ecb8396821af21186e20afaf0 which determined message size using sizeof rather than hardcoded constants. Unfortunately pwc_set_shutter_speed reuses a 2 byte buffer for a one byte message too so the sizeof was bogus in this case. All other uses of sizeof checked and are ok. Acked-by: Laurent Pinchart Signed-off-by: Martin Fuzzey Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit bec3dfd4c9e939eea52a72d20d4493233dde41eb Author: Mike Frysinger Date: Mon Feb 15 19:32:25 2010 -0500 bfin: fix max timeout calculation commit 3dae93ec3ee1fceec69f40ef9b97892ce62ba7a5 upstream. Relying on overflow/wrap around isn't exact because if you wrap far enough, you get back to "valid" values. Reported-by: Thorsten Pohlmann Signed-off-by: Mike Frysinger Signed-off-by: Wim Van Sebroeck Signed-off-by: Greg Kroah-Hartman commit 98bde14156f5e705cc0e8b18e3062656fa131bb5 Author: Richard Guenther Date: Tue Feb 9 20:16:03 2010 -0300 V4L/DVB: dvb: l64781.ko broken with gcc 4.5 commit c1db53b36633e6a7511dbec7c372f01a31528f0c upstream. I'm trying to fix it on the GCC side (PR43007), but the module is quite stupid in using ULL constants to operate on u32 values: static int apply_frontend_param (struct dvb_frontend* fe, struct dvb_frontend_parameters *param) { ... static const u32 ppm = 8000; u32 spi_bias; ... spi_bias *= 1000ULL; spi_bias /= 1000ULL + ppm/1000; which causes current GCC 4.5 to emit calls to __udivdi3 for i?86 again. This patch fixes this issue. Signed-off-by: Richard Guenther Signed-off-by: Greg Kroah-Hartman Signed-off-by: Mauro Carvalho Chehab commit 487d83f91be42bef0cc65e60532da721dd832a2f Author: Guennadi Liakhovetski Date: Thu Feb 18 18:07:18 2010 +0100 ARM: 5944/1: scsi: fix timer setup in fas216.c commit b857df1acc634b18db1db2a40864af985100266e upstream. mod_timer() takes an absolute time and not a delay as its argument. Signed-off-by: Guennadi Liakhovetski Signed-off-by: Russell King Signed-off-by: Greg Kroah-Hartman commit 9922594935c0782f739086bc13b520d1b43cfffc Author: Al Viro Date: Tue Feb 16 18:09:36 2010 +0000 fix LOOKUP_FOLLOW on automount "symlinks" commit ac278a9c505092dd82077a2446af8f9fc0d9c095 upstream. Make sure that automount "symlinks" are followed regardless of LOOKUP_FOLLOW; it should have no effect on them. Signed-off-by: Al Viro Signed-off-by: Greg Kroah-Hartman