commit 1b6e1688bd215cd7c9cb75650fa815a1ec6567e1 Author: Greg Kroah-Hartman Date: Thu Apr 1 15:59:14 2010 -0700 Linux 2.6.32.11 commit 788b99c41012b7bdee8e43c79b081a92161ef8de Author: Sachin Prabhu Date: Thu Mar 11 12:24:45 2010 -0500 GFS2: Skip check for mandatory locks when unlocking commit 720e7749279bde0d08684b1bb4e7a2eedeec6394 upstream. gfs2_lock() will skip locks on file which have mode set to 02666. This is a problem in cases where the mode of the file is changed after a process has obtained a lock on the file. Such a lock will be skipped and will result in a BUG in locks_remove_flock(). gfs2_lock() should skip the check for mandatory locks when unlocking a file. Signed-off-by: Sachin Prabhu Signed-off-by: Steven Whitehouse Signed-off-by: Greg Kroah-Hartman commit 847d52cc4a3e149949df66d7484aba999dc61e19 Author: Dimitri Sivanich Date: Mon Mar 1 11:48:15 2010 -0600 x86: Fix sched_clock_cpu for systems with unsynchronized TSC commit 14be1f7454ea96ee614467a49cf018a1a383b189 upstream. On UV systems, the TSC is not synchronized across blades. The sched_clock_cpu() function is returning values that can go backwards (I've seen as much as 8 seconds) when switching between cpus. As each cpu comes up, early_init_intel() will currently set the sched_clock_stable flag true. When mark_tsc_unstable() runs, it clears the flag, but this only occurs once (the first time a cpu comes up whose TSC is not synchronized with cpu 0). After this, early_init_intel() will set the flag again as the next cpu comes up. Only set sched_clock_stable if tsc has not been marked unstable. Signed-off-by: Dimitri Sivanich Acked-by: Venkatesh Pallipadi Acked-by: Peter Zijlstra LKML-Reference: <20100301174815.GC8224@sgi.com> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 37c3a08ca3714118fe8f931f28b2cc76bb4ac0e5 Author: Lars-Peter Clausen Date: Fri Mar 5 13:43:35 2010 -0800 s3cmci: initialize default platform data no_wprotect and no_detect with 1 commit c212808a1ba6bfba489006399b8152a047305acf upstream. If no platform_data was givin to the device it's going to use it's default platform data struct which has all fields initialized to zero. As a result the driver is going to try to request gpio0 both as write protect and card detect pin. Which of course will fail and makes the driver unusable Previously to the introduction of no_wprotect and no_detect the behavior was to assume that if no platform data was given there is no write protect or card detect pin. This patch restores that behavior. Signed-off-by: Lars-Peter Clausen Cc: Ben Dooks Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 9b2ff973b075293e16e148e57a1856498e23e95d Author: Martin K. Petersen Date: Tue Mar 16 20:30:01 2010 -0400 block: Backport of various I/O topology fixes from 2.6.33 and 2.6.34 block: Backport of various I/O topology fixes from 2.6.33 and 2.6.34 The stacking code incorrectly scaled up the data offset in some cases causing misaligned devices to report alignment. Rewrite the stacking algorithm to remedy this. (Upstream commit 9504e0864b58b4a304820dcf3755f1da80d5e72f) The top device misalignment flag would not be set if the added bottom device was already misaligned as opposed to causing a stacking failure. Also massage the reporting so that an error is only returned if adding the bottom device caused the misalignment. I.e. don't return an error if the top is already flagged as misaligned. (Upstream commit fe0b393f2c0a0d23a9bc9ed7dc51a1ee511098bd) lcm() was defined to take integer-sized arguments. The supplied arguments are multiplied, however, causing us to overflow given sufficiently large input. That in turn led to incorrect optimal I/O size reporting in some cases. Switch lcm() over to unsigned long similar to gcd() and move the function from blk-settings.c to lib. Signed-off-by: Martin K. Petersen Reviewed-by: Mike Snitzer Signed-off-by: Greg Kroah-Hartman commit e548510b30a5b74f9be9c501d955ca90c7d1a8d0 Author: Michael Buesch Date: Fri Mar 19 10:38:33 2010 -0500 b43: Workaround circular locking in hw-tkip key update callback commit 96869a39399269a776a94812e9fff3d38b47d838 upstream The TKIP key update callback is called from the RX path, where the driver mutex is already locked. This results in a circular locking bug. Avoid this by removing the lock. Johannes noted that there is a separate bug: The callback still breaks on SDIO hardware, because SDIO hardware access needs to sleep, but we are not allowed to sleep in the callback due to mac80211's RCU locking. Signed-off-by: Michael Buesch Tested-by: Larry Finger Reported-by: kecsa@kutfo.hit.bme.hu Cc: Johannes Berg Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit f15a9d8a07f97af708304414910e7daeb5e5936d Author: Nobuhiro Iwamatsu Date: Sat Mar 20 16:42:54 2010 +0900 sh: Fix zImage boot using fixed PMB. commit 319c2cc761505ee54a9536c5d0b9c2ee3fb33866 upstream. Signed-off-by: Nobuhiro Iwamatsu Signed-off-by: Yoshihiro Shimoda Signed-off-by: Paul Mundt Signed-off-by: Greg Kroah-Hartman commit fc4da4ab6ea18f1f5073c2af98d554cd69f632e8 Author: Andrei Emeltchenko Date: Fri Mar 19 10:26:28 2010 +0200 Bluetooth: Fix kernel crash on L2CAP stress tests commit c2c77ec83bdad17fb688557b5b3fdc36661dd1c6 upstream. Added very simple check that req buffer has enough space to fit configuration parameters. Shall be enough to reject packets with configuration size more than req buffer. Crash trace below [ 6069.659393] Unable to handle kernel paging request at virtual address 02000205 [ 6069.673034] Internal error: Oops: 805 [#1] PREEMPT ... [ 6069.727172] PC is at l2cap_add_conf_opt+0x70/0xf0 [l2cap] [ 6069.732604] LR is at l2cap_recv_frame+0x1350/0x2e78 [l2cap] ... [ 6070.030303] Backtrace: [ 6070.032806] [] (l2cap_add_conf_opt+0x0/0xf0 [l2cap]) from [] (l2cap_recv_frame+0x1350/0x2e78 [l2cap]) [ 6070.043823] r8:dc5d3100 r7:df2a91d6 r6:00000001 r5:df2a8000 r4:00000200 [ 6070.050659] [] (l2cap_recv_frame+0x0/0x2e78 [l2cap]) from [] (l2cap_recv_acldata+0x2bc/0x350 [l2cap]) [ 6070.061798] [] (l2cap_recv_acldata+0x0/0x350 [l2cap]) from [] (hci_rx_task+0x244/0x478 [bluetooth]) [ 6070.072631] r6:dc647700 r5:00000001 r4:df2ab740 [ 6070.077362] [] (hci_rx_task+0x0/0x478 [bluetooth]) from [] (tasklet_action+0x78/0xd8) [ 6070.087005] [] (tasklet_action+0x0/0xd8) from [] Signed-off-by: Andrei Emeltchenko Acked-by: Gustavo F. Padovan Signed-off-by: Marcel Holtmann Signed-off-by: Greg Kroah-Hartman commit e1c20f724d1f9f857dee1a13d0ecc11c4b834db7 Author: Marcel Holtmann Date: Mon Mar 15 14:12:58 2010 -0700 Bluetooth: Fix potential bad memory access with sysfs files commit 101545f6fef4a0a3ea8daf0b5b880df2c6a92a69 upstream. When creating a high number of Bluetooth sockets (L2CAP, SCO and RFCOMM) it is possible to scribble repeatedly on arbitrary pages of memory. Ensure that the content of these sysfs files is always less than one page. Even if this means truncating. The files in question are scheduled to be moved over to debugfs in the future anyway. Based on initial patches from Neil Brown and Linus Torvalds Reported-by: Neil Brown Signed-off-by: Marcel Holtmann Signed-off-by: Greg Kroah-Hartman commit 5bc44b4059b09f5035c7dbbf13552de42ac73f6a Author: Tejun Heo Date: Tue Mar 16 09:50:26 2010 +0900 ahci: use BIOS date in broken_suspend list commit 9deb343189b3cf45e84dd08480f330575ffe2004 upstream. HP is recycling both DMI_PRODUCT_NAME and DMI_BIOS_VERSION making ahci_broken_suspend() trigger for later products which are not affected by the original problems. Match BIOS date instead of version and add references to bko's so that full information can be found easier later. This fixes http://bugzilla.kernel.org/show_bug.cgi?id=15462 Signed-off-by: Tejun Heo Reported-by: tigerfishdaisy@gmail.com Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit 17884de64aa5dd5806c4a64f80a10dd229fb6143 Author: Jan Kara Date: Tue Feb 9 18:20:39 2010 +0100 quota: Fix warning when a delayed write happens before quota is enabled commit 0a5a9c725512461d19397490f3adf29931dca1f2 upstream. If a delayed-allocation write happens before quota is enabled, the kernel spits out a warning: WARNING: at fs/quota/dquot.c:988 dquot_claim_space+0x77/0x112() because the fact that user has some delayed allocation is not recorded in quota structure. Make dquot_initialize() update amount of reserved space for user if it sees inode has some space reserved. Also make sure that reserved quota space does not go negative and we warn about the filesystem bug just once. Signed-off-by: Jan Kara Signed-off-by: Greg Kroah-Hartman commit 97068a372bcb543d824f330808d0a20ffed85d91 Author: Dmitry Monakhov Date: Tue Feb 9 17:53:36 2010 +0100 quota: manage reserved space when quota is not active [v2] commit c469070aea5a0ada45a836937c776fd3083dae2b upstream. Since we implemented generic reserved space management interface, then it is possible to account reserved space even when quota is not active (similar to i_blocks/i_bytes). Without this patch following testcase result in massive comlain from WARN_ON in dquot_claim_space() TEST_CASE: mount /dev/sdb /mnt -oquota dd if=/dev/zero of=/mnt/test bs=1M count=1 quotaon /mnt # fs_reserved_spave == 1Mb # quota_reserved_space == 0, because quota was disabled dd if=/dev/zero of=/mnt/test seek=1 bs=1M count=1 # fs_reserved_spave == 2Mb # quota_reserved_space == 1Mb sync # ->dquot_claim_space() -> WARN_ON Signed-off-by: Dmitry Monakhov Signed-off-by: Jan Kara Signed-off-by: Greg Kroah-Hartman commit 78164a9748e276563ec008ed916720d8a90db86b Author: Anton Vorontsov Date: Thu Mar 11 13:58:47 2010 -0800 leds-gpio: fix default state handling on OF platforms commit 0493a4ff10959ff4c8e0d65efee25b7ffd4fa5db upstream. The driver wrongly sets default state for LEDs that don't specify default-state property. Currently the driver handles default state this way: memset(&led, 0, sizeof(led)); for_each_child_of_node(np, child) { state = of_get_property(child, "default-state", NULL); if (state) { if (!strcmp(state, "keep")) led.default_state = LEDS_GPIO_DEFSTATE_KEEP; ... } ret = create_gpio_led(&led, ...); } Which means that all LEDs that do not specify default-state will inherit the last value of the default-state property, which is wrong. This patch fixes the issue by moving LED's template initialization into the loop body. Signed-off-by: Anton Vorontsov Signed-off-by: Andrew Morton Signed-off-by: Richard Purdie Signed-off-by: Greg Kroah-Hartman commit 8900170d176e29c905d959e515b502debc58219c Author: Vivek Natarajan Date: Thu Mar 11 14:54:34 2010 -0800 mac80211: Reset dynamic ps timer in Rx path. commit e15276a4b220c54db665cf46a92bd9ceb9aeb052 upstream. The current mac80211 implementation enables power save if there is no Tx traffic for a specific timeout. Hence, PS is triggered even if there is a continuous Rx only traffic(like UDP) going on. This makes the drivers to wait on the tim bit in the next beacon to awake which leads to redundant sleep-wake cycles. Fix this by restarting the dynamic ps timer on receiving every data packet. Signed-off-by: Vivek Natarajan Signed-off-by: John W. Linville Signed-off-by: Luis R. Rodriguez Signed-off-by: Greg Kroah-Hartman commit 948dc19cef84be418aadc6b3ade94207c0888937 Author: Vivek Natarajan Date: Thu Mar 11 13:03:01 2010 -0800 ath9k: Enable IEEE80211_HW_REPORTS_TX_ACK_STATUS flag for ath9k commit 05df49865be08b30e7ba91b9d3d94d7d52dd3033 upstream. Signed-off-by: Vivek Natarajan Signed-off-by: John W. Linville Signed-off-by: Luis R. Rodriguez Signed-off-by: Greg Kroah-Hartman commit 10275a53c5ed0ddc826449d6df052bb41a1fcbce Author: Vivek Natarajan Date: Thu Mar 11 13:10:03 2010 -0800 mac80211: Retry null data frame for power save commit 375177bf35efc08e1bd37bbda4cc0c8cc4db8500 upstream. Even if the null data frame is not acked by the AP, mac80211 goes into power save. This might lead to loss of frames from the AP. Prevent this by restarting dynamic_ps_timer when ack is not received for null data frames. Cc: Johannes Berg Signed-off-by: Vivek Natarajan Signed-off-by: John W. Linville Signed-off-by: Luis R. Rodriguez Signed-off-by: Greg Kroah-Hartman commit 525ad995580f1d760cbf4a3b42df1cba3df6821b Author: Senthil Balasubramanian Date: Thu Mar 11 11:50:54 2010 -0800 ath9k: Enable TIM timer interrupt only when needed. commit 3f7c5c10e9dc6bf90179eb9f7c06151d508fb324 upstream. The TIM timer interrupt is enabled even before the ACK of nullqos is received which is unnecessary. Also clean up the CONF_PS part of config callback properly for better readability. Signed-off-by: Senthil Balasubramanian Signed-off-by: John W. Linville Signed-off-by: Luis R. Rodriguez Signed-off-by: Greg Kroah-Hartman commit d6c28b2d48657234e15ac7ce417d25980af74ca6 Author: Daniel T Chen Date: Sun Dec 13 14:11:02 2009 -0500 ALSA: hda: Use ALC260_WILL quirk for another Acer model (0x1025007f) commit 950200e2ff11daae1c5d9426703bdd494603f38b upstream. BugLink: https://bugs.launchpad.net/bugs/418627 The original reporter states that this quirk is necessary to obtain reasonable gain for playback. Without it, sound is inaudible. Tested with playback (spkr and hp) and capture. Signed-off-by: Daniel T Chen Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 08cabf40e01bc3406e9d18ae1c80c471b7a48151 Author: Daniel T Chen Date: Thu Mar 25 22:38:15 2010 -0700 ALSA: ac97: Add IBM ThinkPad R40e to Headphone/Line Jack Sense blacklist commit e1f7f02b45cf33a774d56e505ce1718af9392f5e upstream. BugLink: https://launchpad.net/bugs/303789 This model needs both 'Headphone Jack Sense' and 'Line Jack Sense' muted for audible audio, so just add its SSID to the blacklist and don't enumerate the controls. Signed-off-by: Daniel T Chen Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit cd91c89077519a8743e4d9435760de592f639159 Author: Daniel Chen Date: Sun Mar 28 13:32:34 2010 -0700 ALSA: ac97: Add Toshiba P500 to ac97 jack sense blacklist commit 5cd165e7057020884e430941c24454d3df9a799d upstream. BugLink: https://launchpad.net/bugs/481058 The OR has verified that both 'Headphone Jack Sense' and 'Line Jack Sense' need to be muted for sound to be audible, so just add the machine's SSID to the ac97 jack sense blacklist. Reported-by: Richard Gagne Tested-by: Richard Gagne Signed-off-by: Daniel T Chen Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit d93c75131e5b97d72854ca8e38853421d33d50f9 Author: Daniel T Chen Date: Sun Mar 28 02:34:40 2010 -0400 ALSA: hda: Use LPIB for ga-ma770-ud3 board commit 9ec8ddad59fadd8021adfea4cb716a49b0e232e9 upstream. BugLink: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=575669 The OR states that position_fix=1 is necessary to work around glitching during volume adjustments using PulseAudio. Reported-by: Carlos Laviola Tested-by: Carlos Laviola Signed-off-by: Daniel T Chen Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 66730dc9cceb31f8425aa52d8c5ee99c348a07b9 Author: Dean Nelson Date: Mon Mar 29 22:03:00 2010 +0200 hwmon: (coretemp) Add missing newline to dev_warn() message commit 4d7a5644e4adfafe76c2bd8ee168e3f3b5dae3a8 upstream. Add missing newline to dev_warn() message string. This is more of an issue with older kernels that don't automatically add a newline if it was missing from the end of the previous line. Signed-off-by: Dean Nelson Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit 341badb52110ba8fff671b3078da7ff45440fc4c Author: Andreas Herrmann Date: Fri Mar 19 12:09:22 2010 +0100 x86, amd: Restrict usage of c1e_idle() commit 035a02c1e1de31888e8b6adac0ff667971ac04db upstream. Currently c1e_idle returns true for all CPUs greater than or equal to family 0xf model 0x40. This covers too many CPUs. Meanwhile a respective erratum for the underlying problem was filed (#400). This patch adds the logic to check whether erratum #400 applies to a given CPU. Especially for CPUs where SMI/HW triggered C1e is not supported, c1e_idle() doesn't need to be used. We can check this by looking at the respective OSVW bit for erratum #400. Signed-off-by: Andreas Herrmann LKML-Reference: <20100319110922.GA19614@alberich.amd.com> Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit 566c0284389aa5d097356ae016cf04d3aa837195 Author: Jan Beulich Date: Mon Mar 15 10:11:15 2010 +0000 x86: Fix placement of FIX_OHCI1394_BASE commit ff30a0543e9a6cd732582063e7cae951cdb7acf2 upstream. Ever for 32-bit with sufficiently high NR_CPUS, and starting with commit 789d03f584484af85dbdc64935270c8e45f36ef7 also for 64-bit, the statically allocated early fixmap page tables were not covering FIX_OHCI1394_BASE, leading to a boot time crash when "ohci1394_dma=early" was used. Despite this entry not being a permanently used one, it needs to be moved into the permanent range since it has to be close to FIX_DBGP_BASE and FIX_EARLYCON_MEM_BASE. Reported-bisected-and-tested-by: Justin P. Mattock Fixes-bug: http://bugzilla.kernel.org/show_bug.cgi?id=14487 Signed-off-by: Jan Beulich LKML-Reference: <4B9E15D30200007800034D23@vpn.id2.novell.com> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 5a32ab6f23dd07b97a6095d6ddbfa79c47cf3bbd Author: Patrick McHardy Date: Mon Mar 22 18:25:20 2010 +0100 netfilter: xt_recent: fix regression in rules using a zero hit_count commit ef1691504c83ba3eb636c0cfd3ed33f7a6d0b4ee upstream. Commit 8ccb92ad (netfilter: xt_recent: fix false match) fixed supposedly false matches in rules using a zero hit_count. As it turns out there is nothing false about these matches and people are actually using entries with a hit_count of zero to make rules dependant on addresses inserted manually through /proc. Since this slipped past the eyes of three reviewers, instead of reverting the commit in question, this patch explicitly checks for a hit_count of zero to make the intentions more clear. Reported-by: Thomas Jarosch Tested-by: Thomas Jarosch Signed-off-by: Patrick McHardy Signed-off-by: Greg Kroah-Hartman commit 710b70e8150e412aa809fadb028147952c56a4cc Author: Chris Wilson Date: Fri Mar 12 19:52:55 2010 +0000 drm/i915: Avoid NULL deref in get_pages() unwind after error. commit 1f2b10131f83f7caa67bf1273cec126b4283015d upstream. Fixes: http://bugzilla.kernel.org/show_bug.cgi?id=15527 NULL pointer dereference in i915_gem_object_save_bit_17_swizzle BUG: unable to handle kernel NULL pointer dereference at (null) IP: [] i915_gem_object_save_bit_17_swizzle+0x5b/0xc0 [i915] Call Trace: [] ? i915_gem_object_put_pages+0x125/0x150 [i915] [] ? i915_gem_object_get_pages+0xf1/0x110 [i915] [] ? i915_gem_object_bind_to_gtt+0xb8/0x2a0 [i915] [] ? drm_mm_get_block_generic+0x4d/0x180 [] ? i915_gem_mmap_gtt_ioctl+0x16d/0x240 [i915] [] ? i915_gem_madvise_ioctl+0x86/0x120 [i915] Signed-off-by: Chris Wilson Reported-by: maciej.rutecki@gmail.com Cc: stable@kernel.org Reviewed-by: Eric Anholt Signed-off-by: Eric Anholt Signed-off-by: Greg Kroah-Hartman commit 7b6c1753bc0ee455adf4f4ed489a367c7dc7c432 Author: Colin Ian King Date: Fri Mar 19 10:28:02 2010 +0000 softlockup: Stop spurious softlockup messages due to overflow commit 8c2eb4805d422bdbf60ba00ff233c794d23c3c00 upstream. Ensure additions on touch_ts do not overflow. This can occur when the top 32 bits of the TSC reach 0xffffffff causing additions to touch_ts to overflow and this in turn generates spurious softlockup warnings. Signed-off-by: Colin Ian King Cc: Peter Zijlstra Cc: Eric Dumazet LKML-Reference: <1268994482.1798.6.camel@lenovo> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 893b328f07c17aa84f562fc5566eb524bd76188e Author: Miao Xie Date: Tue Mar 23 13:35:34 2010 -0700 cpuset: fix the problem that cpuset_mem_spread_node() returns an offline node commit 5ab116c9349ef52d6fbd2e2917a53f13194b048e upstream. cpuset_mem_spread_node() returns an offline node, and causes an oops. This patch fixes it by initializing task->mems_allowed to node_states[N_HIGH_MEMORY], and updating task->mems_allowed when doing memory hotplug. Signed-off-by: Miao Xie Acked-by: David Rientjes Reported-by: Nick Piggin Tested-by: Nick Piggin Cc: Paul Menage Cc: Li Zefan Cc: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit fa8e8558a6874707d8e30c85bb386f43cb61a6e1 Author: Felix Fietkau Date: Fri Mar 12 04:02:43 2010 +0100 ath9k: fix BUG_ON triggered by PAE frames commit 4fdec031b9169b3c17938b9c4168f099f457169c upstream. When I initially stumbled upon sequence number problems with PAE frames in ath9k, I submitted a patch to remove all special cases for PAE frames and let them go through the normal transmit path. Out of concern about crypto incompatibility issues, this change was merged instead: commit 6c8afef551fef87a3bf24f8a74c69a7f2f72fc82 Author: Sujith Date: Tue Feb 9 10:07:00 2010 +0530 ath9k: Fix sequence numbers for PAE frames After a lot of testing, I'm able to reliably trigger a driver crash on rekeying with current versions with this change in place. It seems that the driver does not support sending out regular MPDUs with the same TID while an A-MPDU session is active. This leads to duplicate entries in the TID Tx buffer, which hits the following BUG_ON in ath_tx_addto_baw(): index = ATH_BA_INDEX(tid->seq_start, bf->bf_seqno); cindex = (tid->baw_head + index) & (ATH_TID_MAX_BUFS - 1); BUG_ON(tid->tx_buf[cindex] != NULL); I believe until we actually have a reproducible case of an incompatibility with another AP using no PAE special cases, we should simply get rid of this mess. This patch completely fixes my crash issues in STA mode and makes it stay connected without throughput drops or connectivity issues even when the AP is configured to a very short group rekey interval. Signed-off-by: Felix Fietkau Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 6334272a8a08048a57d450fe889b317dbe4a5d6d Author: Ben Hutchings Date: Mon Mar 29 01:09:17 2010 +0100 rt2860sta: Fix argument to linux_pci_unmap_single() John Halton wrote in : > Whenever wpa_supplicant is deactivated (whether by killing the process or > during a normal shutdown) I am getting a kerneloops that prevents the > computer from completing shutdown. Here is the relevant syslog output: The backtrace points to an incorrect call from RTMPFreeTxRxRingMemory() into linux_pci_unmap_single(). This appears to have been fixed in Linux 2.6.33 by this change: commit ca97b8388838ee9ea4b4bad04948f8f7f8a607a3 Author: Bartlomiej Zolnierkiewicz Date: Tue Sep 22 20:44:07 2009 +0200 Staging: rt28x0: updates from vendor's V2.1.0.0 drivers For stable-2.6.32, just fix this one function call. Signed-off-by: Ben Hutchings Signed-off-by: Greg Kroah-Hartman commit 5aaccdbc120176e53be48922c087eda7d7f65e83 Author: Dean Nelson Date: Tue Mar 9 22:26:55 2010 -0500 PCI: cleanup error return for pcix get and set mmrbc functions commit 7c9e2b1c4784c6e574f69dbd904b2822f2e04d6e upstream. pcix_get_mmrbc() returns the maximum memory read byte count (mmrbc), if successful, or an appropriate error value, if not. Distinguishing errors from correct values and understanding the meaning of an error can be somewhat confusing in that: correct values: 512, 1024, 2048, 4096 errors: -EINVAL -22 PCIBIOS_FUNC_NOT_SUPPORTED 0x81 PCIBIOS_BAD_VENDOR_ID 0x83 PCIBIOS_DEVICE_NOT_FOUND 0x86 PCIBIOS_BAD_REGISTER_NUMBER 0x87 PCIBIOS_SET_FAILED 0x88 PCIBIOS_BUFFER_TOO_SMALL 0x89 The PCIBIOS_ errors are returned from the PCI functions generated by the PCI_OP_READ() and PCI_OP_WRITE() macros. In a similar manner, pcix_set_mmrbc() also returns the PCIBIOS_ error values returned from pci_read_config_[word|dword]() and pci_write_config_word(). Following pcix_get_max_mmrbc()'s example, the following patch simply returns -EINVAL for all PCIBIOS_ errors encountered by pcix_get_mmrbc(), and -EINVAL or -EIO for those encountered by pcix_set_mmrbc(). This simplification was chosen in light of the fact that none of the current callers of these functions are interested in the specific type of error encountered. In the future, should this change, one could simply create a function that maps each PCIBIOS_ error to a corresponding unique errno value, which could be called by pcix_get_max_mmrbc(), pcix_get_mmrbc(), and pcix_set_mmrbc(). Additionally, this patch eliminates some unnecessary variables. Signed-off-by: Dean Nelson Signed-off-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman commit d548d479f2240e1aaf3ef29606ca98ef22a2b129 Author: Dean Nelson Date: Tue Mar 9 22:26:48 2010 -0500 PCI: fix access of PCI_X_CMD by pcix get and set mmrbc functions commit bdc2bda7c4dd253026cc1fce45fc939304749029 upstream. An e1000 driver on a system with a PCI-X bus was always being returned a value of 135 from both pcix_get_mmrbc() and pcix_set_mmrbc(). This value reflects an error return of PCIBIOS_BAD_REGISTER_NUMBER from pci_bus_read_config_dword(,, cap + PCI_X_CMD,). This is because for a dword, the following portion of the PCI_OP_READ() macro: if (PCI_##size##_BAD) return PCIBIOS_BAD_REGISTER_NUMBER; expands to: if (pos & 3) return PCIBIOS_BAD_REGISTER_NUMBER; And is always true for 'cap + PCI_X_CMD', which is 0xe4 + 2 = 0xe6. ('cap' is the result of calling pci_find_capability(, PCI_CAP_ID_PCIX).) The same problem exists for pci_bus_write_config_dword(,, cap + PCI_X_CMD,). In both cases, instead of calling _dword(), _word() should be called. Signed-off-by: Dean Nelson Signed-off-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman commit aa6760432ad3a02d191b61bf224bb36f952fa0c9 Author: Dean Nelson Date: Tue Mar 9 22:26:40 2010 -0500 PCI: fix return value from pcix_get_max_mmrbc() commit 25daeb550b69e89aff59bc6a84218a12b5203531 upstream. For the PCI_X_STATUS register, pcix_get_max_mmrbc() is returning an incorrect value, which is based on: (stat & PCI_X_STATUS_MAX_READ) >> 12 Valid return values are 512, 1024, 2048, 4096, which correspond to a 'stat' (masked and right shifted by 21) of 0, 1, 2, 3, respectively. A right shift by 11 would generate the correct return value when 'stat' (masked and right shifted by 21) has a value of 1 or 2. But for a value of 0 or 3 it's not possible to generate the correct return value by only right shifting. Fix is based on pcix_get_mmrbc()'s similar dealings with the PCI_X_CMD register. Signed-off-by: Dean Nelson Signed-off-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman commit 2a3046b3ac262a2af01b857071401200f876da65 Author: OGAWA Hirofumi Date: Tue Mar 23 13:35:50 2010 -0700 fs/partition/msdos: fix unusable extended partition for > 512B sector commit 8e0cc811e0f8029a7225372fb0951fab102c012f upstream. Smaller size than a minimum blocksize can't be used, after all it's handled like 0 size. For extended partition itself, this makes sure to use bigger size than one logical sector size at least. Signed-off-by: OGAWA Hirofumi Cc: Daniel Taylor Cc: "H. Peter Anvin" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 1abac82345f0b5e8505964854730ee4551926ac0 Author: Daniel Taylor Date: Tue Mar 23 13:35:50 2010 -0700 fs/partitions/msdos: add support for large disks commit 3fbf586cf7f245392142e5407c2a56f1cff979b6 upstream. In order to use disks larger than 2TiB on Windows XP, it is necessary to use 4096-byte logical sectors in an MBR. Although the kernel storage and functions called from msdos.c used "sector_t" internally, msdos.c still used u32 variables, which results in the ability to handle XP-compatible large disks. This patch changes the internal variables to "sector_t". Daniel said: "In the near future, WD will be releasing products that need this patch". [hirofumi@mail.parknet.co.jp: tweaks and fix] Signed-off-by: Daniel Taylor Signed-off-by: OGAWA Hirofumi Cc: "H. Peter Anvin" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit b39b928d063227f1950e05a8e3815e608fcfdb60 Author: Paulius Zaleckas Date: Sun Mar 21 21:19:02 2010 -0700 if_tunnel.h: add missing ams/byteorder.h include commit 9bf35c8dddd56f7f247a27346f74f5adc18071f4 upstream. When compiling userspace application which includes if_tunnel.h and uses GRE_* defines you will get undefined reference to __cpu_to_be16. Fix this by adding missing #include Signed-off-by: Paulius Zaleckas Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit a420c0a1ec9d34fa8923f59e12d4ad9047db490b Author: Dan Carpenter Date: Sun Mar 21 12:10:34 2010 -0400 sunrpc: handle allocation errors from __rpc_lookup_create() commit f1f0abe192a72e75d7c59972e30784d043fd8d73 upstream. __rpc_lookup_create() can return ERR_PTR(-ENOMEM). Signed-off-by: Dan Carpenter Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit ea374cba047ddb056ca4b4f8813282ad7642201e Author: Trond Myklebust Date: Fri Mar 19 15:36:22 2010 -0400 SUNRPC: Fix a potential memory leak in auth_gss commit cdead7cf12896c0e50a8be2e52de52c364603095 upstream. The function alloc_enc_pages() currently fails to release the pointer rqstp->rq_enc_pages in the error path. Signed-off-by: Trond Myklebust Acked-by: J. Bruce Fields Signed-off-by: Greg Kroah-Hartman commit 632682a2eccc96b1b5238e274dde6b18a5b670f1 Author: Adel Gadllah Date: Sun Mar 14 19:16:25 2010 +0100 iwlwifi: Silence tfds_in_queue message commit c8406ea8fa1adde8dc5400127281d497bbcdb84a upstream. Commit a239a8b47cc0e5e6d7416a89f340beac06d5edaa introduced a noisy message, that fills up the log very fast. The error seems not to be fatal (the connection is stable and performance is ok), so make it IWL_DEBUG_TX rather than IWL_ERR. Signed-off-by: Adel Gadllah Acked-by: Reinette Chatre Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 7a8a56a5be1dcaa8c3668b5293ed3a5df771e25a Author: Stanislaw Gruszka Date: Fri Mar 19 11:10:41 2010 +0100 iwlwifi: use dma_alloc_coherent commit f36d04abe684f9e2b07c6ebe9f77ae20eb5c1e84 upstream. Change pci_alloc_consistent() to dma_alloc_coherent() so we can use GFP_KERNEL flag. Signed-off-by: Stanislaw Gruszka Signed-off-by: Reinette Chatre Signed-off-by: Greg Kroah-Hartman commit ceb2ef9f7300353db873587c7fd6fc8ade79610e Author: Borislav Petkov Date: Tue Mar 9 20:38:48 2010 +0100 edac, mce: Filter out invalid values commit 5b89d2f9ace1970324facc68ca9b8fae19ce8096 upstream. Print the CPU associated with the error only when the field is valid. Signed-off-by: Borislav Petkov Signed-off-by: Greg Kroah-Hartman commit a72fce06535457d953da1ee7d9ef9773c5925fd0 Author: Guo-Fu Tseng Date: Wed Mar 17 00:09:30 2010 +0000 jme: Protect vlgrp structure by pause RX actions. commit bf5e5360fd1df1ae429ebbd81838d7d0879797d1 upstream. Temporary stop the RX IRQ, and disable (sync) tasklet or napi. And restore it after finished the vlgrp pointer assignment. Signed-off-by: Guo-Fu Tseng Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 7aa5e834a22b77dc16a992e8af54514021f05744 Author: Guo-Fu Tseng Date: Wed Mar 17 00:09:29 2010 +0000 jme: Fix VLAN memory leak commit 17da69b8bfbe441a33a873ad5dd7d3d85800bf2b upstream. Fix memory leak while receiving 8021q tagged packet which is not registered by user. Signed-off-by: Guo-Fu Tseng Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 70aba33f52d17490d8b0b5ba2d8b0ac17220ba03 Author: Grazvydas Ignotas Date: Thu Mar 11 17:45:26 2010 +0200 wl1251: fix potential crash commit 3f60ebc9d6291863652d564bacc430629271e6a9 upstream. In case debugfs does not init for some reason (or is disabled on older kernels) driver does not allocate stats.fw_stats structure, but tries to clear it later and trips on a NULL pointer: Unable to handle kernel NULL pointer dereference at virtual address 00000000 PC is at __memzero+0x24/0x80 Backtrace: [] (wl1251_debugfs_reset+0x0/0x30 [wl1251]) [] (wl1251_op_stop+0x0/0x12c [wl1251]) [] (ieee80211_stop_device+0x0/0x74 [mac80211]) [] (ieee80211_stop+0x0/0x4ac [mac80211]) [] (dev_close+0x0/0xb4) [] (dev_change_flags+0x0/0x184) [] (devinet_ioctl+0x0/0x704) [] (inet_ioctl+0x0/0x100) Add a NULL pointer check to fix this. Signed-off-by: Grazvydas Ignotas Acked-by: Kalle Valo Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit b6bc58585c030713f82f11097929b7caada57a79 Author: Yoshihiro Shimoda Date: Tue Mar 16 12:29:35 2010 +0900 usb: r8a66597-hcd: fix removed from an attached hub commit d835933436ac0d1e8f5b35fe809fd4e767e55d6e upstream. fix the problem that when a USB hub is attached to the r8a66597-hcd and a device is removed from that hub, it's likely that a kernel panic follows. Reported-by: Markus Pietrek Signed-off-by: Yoshihiro Shimoda Signed-off-by: Greg Kroah-Hartman commit bf465bba93e5b97c98c6f587055cc514b73e18ea Author: Nathaniel McCallum Date: Thu Mar 11 13:09:26 2010 -0500 USB: option: add support for a new CMOTECH device to usb/serial/option commit 3b04872aa75006e2a4adaaec21e9c9ede8b8ad9d upstream. Signed-off-by: Nathaniel McCallum Signed-off-by: Greg Kroah-Hartman commit 96f0d2a07b6c5f63ca0f9d94937a99244c8ac18e Author: Nathaniel McCallum Date: Thu Mar 11 13:01:17 2010 -0500 USB: option: move hardcoded PID to a macro in usb/serial/option commit bb73ed2a268a29ab1b7d8cc50b5f248578e7e188 upstream. Signed-off-by: Nathaniel McCallum Signed-off-by: Greg Kroah-Hartman commit 8fbe38ee12e1623b8c3850ea8f8f95fa6d6976ce Author: Nathaniel McCallum Date: Thu Mar 11 13:09:24 2010 -0500 USB: option: fix incorrect manufacturer name in usb/serial/option: MAXON->CMOTECH commit eaff4cdc978f414cf7b5441a333de3070d80e9c7 upstream. Signed-off-by: Nathaniel McCallum Signed-off-by: Greg Kroah-Hartman commit ada56d503396115467987eaad3a58dfd9647f38c Author: Daniel Sangorrin Date: Thu Mar 11 14:10:58 2010 -0800 USB: serial: ftdi: add CONTEC vendor and product id commit dee5658b482e9e2ac7d6205dc876fc11d4008138 upstream. This is a patch to ftdi_sio_ids.h and ftdi_sio.c that adds identifiers for CONTEC USB serial converter. I tested it with the device COM-1(USB)H [akpm@linux-foundation.org: keep the VIDs sorted a bit] Signed-off-by: Daniel Sangorrin Cc: Andreas Mohr Cc: Radek Liboska Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit 29e72304e5757345c9ece8962230b5a7eae8eeba Author: Andiry Xu Date: Fri Mar 12 17:10:04 2010 +0800 USB: xHCI: re-initialize cmd_completion commit 1d68064a7d80da4a7334cab0356162e36229c1a1 upstream. When a signal interrupts a Configure Endpoint command, the cmd_completion used in xhci_configure_endpoint() is not re-initialized and the wait_for_completion_interruptible_timeout() will return failure. Initialize cmd_completion in xhci_configure_endpoint(). Signed-off-by: Andiry Xu Signed-off-by: Sarah Sharp Signed-off-by: Greg Kroah-Hartman commit 07b6e21a50ad6b33c45c978497c6f7fcfff5dbab Author: Bernhard Rosenkraenzer Date: Wed Mar 10 12:36:43 2010 +0100 USB: qcserial: add new device ids commit 0725e95ea56698774e893edb7e7276b1d6890954 upstream. This patch adds various USB device IDs for Gobi 2000 devices, as found in the drivers available at https://www.codeaurora.org/wiki/GOBI_Releases Signed-off-by: Bernhard Rosenkraenzer Signed-off-by: Greg Kroah-Hartman commit 43763b6eece07ec97e36e00205c3d54f4a57754e Author: Clemens Ladisch Date: Mon Mar 1 17:18:56 2010 +0100 USB: EHCI: adjust ehci_iso_stream for changes in ehci_qh commit 1082f57abfa26590b60c43f503afb24102a37016 upstream. The EHCI driver stores in usb_host_endpoint.hcpriv a pointer to either an ehci_qh or an ehci_iso_stream structure, and uses the contents of the hw_info1 field to distinguish the two cases. After ehci_qh was split into hw and sw parts, ehci_iso_stream must also be adjusted so that it again looks like an ehci_qh structure. This fixes a NULL pointer access in ehci_endpoint_disable() when it tries to access qh->hw->hw_info1. Signed-off-by: Clemens Ladisch Reported-by: Colin Fletcher Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit 5fe90f08a129e9fd8bda0e0c54746eb7b5297768 Author: Clemens Ladisch Date: Mon Mar 1 09:12:50 2010 +0100 USB: EHCI: fix ITD list order commit 92bc3648e6027384479852b770a542722fadee7c upstream. When isochronous URBs are shorter than one frame and when more than one ITD in a frame has been completed before the interrupt can be handled, scan_periodic() completes the URBs in the order in which they are found in the descriptor list. Therefore, the descriptor list must contain the ITDs in the correct order, i.e., a new ITD must be linked in after any previous ITDs of the same endpoint. This should fix garbled capture data in the USB audio drivers. Signed-off-by: Clemens Ladisch Reported-by: Colin Fletcher Signed-off-by: Greg Kroah-Hartman commit 3863f0615c1c6417a4db65b8bfa32aa49cc0c35e Author: Alan Stern Date: Sat Mar 6 15:04:03 2010 -0500 USB: fix usbfs regression commit 7152b592593b9d48b33f8997b1dfd6df9143f7ec upstream. This patch (as1352) fixes a bug in the way isochronous input data is returned to userspace for usbfs transfers. The entire buffer must be copied, not just the first actual_length bytes, because the individual packets will be discontiguous if any of them are short. Reported-by: Markus Rechberger Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit d640f45411308c70e205d04938dfda94152738fb Author: Mel Gorman Date: Tue Mar 2 22:24:19 2010 +0000 tty: Take a 256 byte padding into account when buffering below sub-page units commit 352fa6ad16b89f8ffd1a93b4419b1a8f2259feab upstream. The TTY layer takes some care to ensure that only sub-page allocations are made with interrupts disabled. It does this by setting a goal of "TTY_BUFFER_PAGE" to allocate. Unfortunately, while TTY_BUFFER_PAGE takes the size of tty_buffer into account, it fails to account that tty_buffer_find() rounds the buffer size out to the next 256 byte boundary before adding on the size of the tty_buffer. This patch adjusts the TTY_BUFFER_PAGE calculation to take into account the size of the tty_buffer and the padding. Once applied, tty_buffer_alloc() should not require high-order allocations. Signed-off-by: Mel Gorman Signed-off-by: Greg Kroah-Hartman commit d560f99c9aafb9ebe1911541cf30d909819564eb Author: Alan Cox Date: Thu Feb 18 16:43:47 2010 +0000 tty: Keep the default buffering to sub-page units commit d9661adfb8e53a7647360140af3b92284cbe52d4 upstream. We allocate during interrupts so while our buffering is normally diced up small anyway on some hardware at speed we can pressure the VM excessively for page pairs. We don't really need big buffers to be linear so don't try so hard. In order to make this work well we will tidy up excess callers to request_room, which cannot itself enforce this break up. Signed-off-by: Alan Cox Signed-off-by: Greg Kroah-Hartman commit 0b4d9d6ac1f1d22fb0342305cd1e9bf67307d194 Author: Trond Myklebust Date: Fri Mar 19 13:55:17 2010 -0400 NFS: Prevent another deadlock in nfs_release_page() commit d812e575822a2b7ab1a7cadae2571505ec6ec2bd upstream. We should not attempt to free the page if __GFP_FS is not set. Otherwise we can deadlock as per http://bugzilla.kernel.org/show_bug.cgi?id=15578 Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 619338378356905f8a9ca6fdf94097389328f4f0 Author: Trond Myklebust Date: Thu Mar 11 09:19:35 2010 -0500 NFS: Avoid a deadlock in nfs_release_page commit bb6fbc4548b9ae7ebbd06ef72f00229df259d217 upstream. J.R. Okajima reports the following deadlock: INFO: task kswapd0:305 blocked for more than 120 seconds. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kswapd0 D 0000000000000001 0 305 2 0x00000000 ffff88001f21d4f0 0000000000000046 ffff88001fdea680 ffff88001f21c000 ffff88001f21dfd8 ffff88001f21c000 ffff88001f21dfd8 ffff88001f21dfd8 ffff88001fdea040 0000000000014c00 0000000000000001 ffff88001fdea040 Call Trace: [] io_schedule+0x4d/0x70 [] sync_page+0x65/0xa0 [] __wait_on_bit_lock+0x52/0xb0 [] ? sync_page+0x0/0xa0 [] __lock_page+0x64/0x70 [] ? wake_bit_function+0x0/0x40 [] truncate_inode_pages_range+0x344/0x4a0 [] truncate_inode_pages+0x10/0x20 [] generic_delete_inode+0x15e/0x190 [] generic_drop_inode+0x5d/0x80 [] iput+0x78/0x80 [] nfs_dentry_iput+0x38/0x50 [] dentry_iput+0x84/0x110 [] d_kill+0x2e/0x60 [] dput+0x7a/0x170 [] path_put+0x15/0x40 [] __put_nfs_open_context+0xa4/0xb0 [] ? nfs_free_request+0x0/0x50 [] put_nfs_open_context+0xb/0x10 [] nfs_free_request+0x29/0x50 [] kref_put+0x8e/0xe0 [] nfs_release_request+0x14/0x20 [] nfs_find_and_lock_request+0x89/0xa0 [] nfs_wb_page+0x80/0x110 [] nfs_release_page+0x70/0x90 [] try_to_release_page+0x5e/0x80 [] shrink_page_list+0x638/0x860 [] shrink_zone+0x63e/0xc40 We can fix this by making the call to put_nfs_open_context() happen when we actually remove the write request from the inode (which is done by the nfsiod thread in this case). Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 627da2da32ff37214854ef629dcedb3ab2e98be1 Author: Trond Myklebust Date: Wed Mar 10 15:21:44 2010 -0500 NFSv4: Don't ignore the NFS_INO_REVAL_FORCED flag in nfs_revalidate_inode() commit b4d2314bb88b07e5a04e6c75b442a1dfcd60e340 upstream. If the NFS_INO_REVAL_FORCED flag is set, that means that we don't yet have an up to date attribute cache. Even if we hold a delegation, we must put a GETATTR on the wire. Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 81bcb4936047e401417726fa8c55c9ead312d5f3 Author: Gal Rosen Date: Thu Jan 21 10:15:32 2010 +0200 SCSI: scsi_transport_fc: Fix synchronization issue while deleting vport commit 0d9dc7c8b9b7fa0f53647423b41056ee1beed735 upstream. The issue occur while deleting 60 virtual ports through the sys interface /sys/class/fc_vports/vport-X/vport_delete. It happen while in a mistake each request sent twice for the same vport. This interface is asynchronous, entering the delete request into a work queue, allowing more than one request to enter to the delete work queue. The result is a NULL pointer. The first request already delete the vport, while the second request got a pointer to the vport before the device destroyed. Re-create vport later cause system freeze. Solution: Check vport flags before entering the request to the work queue. [jejb: fixed int<->long problem on spinlock flags variable] Signed-off-by: Gal Rosen Acked-by: James Smart Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 457396780d363fc2bc19301a31d489210bbfe365 Author: KOSAKI Motohiro Date: Tue Mar 23 13:35:33 2010 -0700 doc: add the documentation for mpol=local commit 5574169613b40b85d6f4c67208fa4846b897a0a1 upstream. commit 3f226aa1c (mempolicy: support mpol=local tmpfs mount option) added new mpol=local mount option. but it didn't add a documentation. This patch does it. Signed-off-by: KOSAKI Motohiro Cc: Ravikiran Thirumalai Cc: Christoph Lameter Cc: Mel Gorman Acked-by: Lee Schermerhorn Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 85f820d5853c4baf6ead331c00972b6eef255f30 Author: KOSAKI Motohiro Date: Tue Mar 23 13:35:32 2010 -0700 tmpfs: cleanup mpol_parse_str() commit 926f2ae04f183098cf9a30521776fb2759c8afeb upstream. mpol_parse_str() made lots 'err' variable related bug. Because it is ugly and reviewing unfriendly. This patch simplifies it. Signed-off-by: KOSAKI Motohiro Cc: Ravikiran Thirumalai Cc: Christoph Lameter Cc: Mel Gorman Acked-by: Lee Schermerhorn Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit e02271b82e636b0028d33cfa6bd2e6aad8642f5b Author: KOSAKI Motohiro Date: Tue Mar 23 13:35:31 2010 -0700 tmpfs: handle MPOL_LOCAL mount option properly commit 12821f5fb942e795f8009ece14bde868893bd811 upstream. commit 71fe804b6d5 (mempolicy: use struct mempolicy pointer in shmem_sb_info) added mpol=local mount option. but its feature is broken since it was born. because such code always return 1 (i.e. mount failure). This patch fixes it. Signed-off-by: KOSAKI Motohiro Cc: Ravikiran Thirumalai Cc: Christoph Lameter Cc: Mel Gorman Acked-by: Lee Schermerhorn Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 55bb6ea6c037942d111e812f0b212f3d9065a735 Author: KOSAKI Motohiro Date: Tue Mar 23 13:35:30 2010 -0700 tmpfs: mpol=bind:0 don't cause mount error. commit d69b2e63e9172afb4d07c305601b79a55509ac4c upstream. Currently, following mount operation cause mount error. % mount -t tmpfs -ompol=bind:0 none /tmp Because commit 71fe804b6d5 (mempolicy: use struct mempolicy pointer in shmem_sb_info) corrupted MPOL_BIND parse code. This patch restore the needed one. Signed-off-by: KOSAKI Motohiro Cc: Ravikiran Thirumalai Cc: Christoph Lameter Cc: Mel Gorman Acked-by: Lee Schermerhorn Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit c67cc76d1b8da6a7eb74716255c2f0db20d66d64 Author: Ravikiran G Thirumalai Date: Tue Mar 23 13:35:28 2010 -0700 tmpfs: fix oops on mounts with mpol=default commit 413b43deab8377819aba1dbad2abf0c15d59b491 upstream. Fix an 'oops' when a tmpfs mount point is mounted with the mpol=default mempolicy. Upon remounting a tmpfs mount point with 'mpol=default' option, the mount code crashed with a null pointer dereference. The initial problem report was on 2.6.27, but the problem exists in mainline 2.6.34-rc as well. On examining the code, we see that mpol_new returns NULL if default mempolicy was requested. This 'NULL' mempolicy is accessed to store the node mask resulting in oops. The following patch fixes it. Signed-off-by: Ravikiran Thirumalai Signed-off-by: KOSAKI Motohiro Cc: Christoph Lameter Cc: Mel Gorman Acked-by: Lee Schermerhorn Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 25b6e384dc523fdfff039405defd415c6e067108 Author: Paul Mackerras Date: Wed Mar 10 20:45:52 2010 +1100 perf_event: Fix oops triggered by cpu offline/online commit 220b140b52ab6cc133f674a7ffec8fa792054f25 upstream. Anton Blanchard found that he could reliably make the kernel hit a BUG_ON in the slab allocator by taking a cpu offline and then online while a system-wide perf record session was running. The reason is that when the cpu comes up, we completely reinitialize the ctx field of the struct perf_cpu_context for the cpu. If there is a system-wide perf record session running, then there will be a struct perf_event that has a reference to the context, so its refcount will be 2. (The perf_event has been removed from the context's group_entry and event_entry lists by perf_event_exit_cpu(), but that doesn't remove the perf_event's reference to the context and doesn't decrement the context's refcount.) When the cpu comes up, perf_event_init_cpu() gets called, and it calls __perf_event_init_context() on the cpu's context. That resets the refcount to 1. Then when the perf record session finishes and the perf_event is closed, the refcount gets decremented to 0 and the context gets kfreed after an RCU grace period. Since the context wasn't kmalloced -- it's part of a per-cpu variable -- bad things happen. In fact we don't need to completely reinitialize the context when the cpu comes up. It's sufficient to initialize the context once at boot, but we need to do it for all possible cpus. This moves the context initialization to happen at boot time. With this, we don't trash the refcount and the context never gets kfreed, and we don't hit the BUG_ON. Reported-by: Anton Blanchard Signed-off-by: Paul Mackerras Tested-by: Anton Blanchard Acked-by: Peter Zijlstra Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 1245bd8d18584ad5f14185439de0aad1a9d97a43 Author: John Kacur Date: Thu Mar 11 13:57:00 2010 +0100 perf: Make the install relative to DESTDIR if specified commit 7ae5f21361fea11f58c398701da635f778635d13 upstream. Without this change, the install path is relative to prefix/DESTDIR where prefix is automatically set to $HOME. This can produce unexpected results. For example: make -C tools/perf DESTDIR=/home/jkacur/tmp install-man creates the directory: /home/jkacur/home/jkacur/tmp/share/... instead of the expected: /home/jkacur/tmp/share/... Signed-off-by: John Kacur Cc: Peter Zijlstra Cc: Paul Mackerras Cc: Arnaldo Carvalho de Melo Cc: Frederic Weisbecker Cc: Tom Zanussi Cc: Kyle McMartin LKML-Reference: <1268312220-12880-1-git-send-email-jkacur@redhat.com> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit bddf110a16cb4095ae2b8105133f4bdb618a8ea9 Author: Tilman Schmidt Date: Sun Mar 14 12:58:05 2010 +0000 gigaset: prune use of tty_buffer_request_room commit 873a69a358a6b393fd8d9d92e193ec8895cac4d7 upstream. Calling tty_buffer_request_room() before tty_insert_flip_string() is unnecessary, costs CPU and for big buffers can mess up the multi-page allocation avoidance. Signed-off-by: Tilman Schmidt Acked-by: Karsten Keil CC: Alan Cox Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 4ea1533c2bfcda2eccf6167a565385ece50b9cb9 Author: Tilman Schmidt Date: Sun Mar 14 12:58:05 2010 +0000 gigaset: correct clearing of at_state strings on RING commit 3a0a3a6b92edf181f849ebd8417122392ba73a96 upstream. In RING handling, clear the table of received parameter strings in a loop like everywhere else, instead of by enumeration which had already gotten out of sync. Impact: minor bugfix Signed-off-by: Tilman Schmidt Acked-by: Karsten Keil Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 7a1bd86e2609609c9e8d8a4589d75a383cbbbc61 Author: Clemens Ladisch Date: Wed Mar 24 07:10:54 2010 +0100 ALSA: cmipci: work around invalid PCM pointer commit 1c583063a5c769fe2ec604752e383972c69e6d9b upstream. When the CMI8738 FRAME2 register is read, the chip sometimes (probably when wrapping around) returns an invalid value that would be outside the programmed DMA buffer. This leads to an inconsistent PCM pointer that is likely to result in an underrun. To work around this, read the register multiple times until we get a valid value; the error state seems to be very short-lived. Signed-off-by: Clemens Ladisch Reported-and-tested-by: Matija Nalis Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit f09315f7cd6cfdb98e90e6686116251bb026020b Author: Daniel T Chen Date: Sun Mar 21 18:34:43 2010 -0400 ALSA: hda: Fix 0 dB offset for HP laptops using CX20551 (Waikiki) commit 025f206c9e0f96cc41567b01c07fb852d8900da1 upstream. BugLink: https://launchpad.net/bugs/420578 The OR has verified that his hardware distorts because of the 0 dB offset not corresponding to the highest PCM level. Fix this by capping said PCM level to 0 dB similarly to what we do for CX20549 (Venice). Reported-by: Mike Pontillo Tested-by: Mike Pontillo Signed-off-by: Daniel T Chen Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 1ae20fd7e9fed26a480e3c078e498e6acb5f7828 Author: Takashi Iwai Date: Mon Mar 15 09:07:52 2010 +0100 ALSA: hda - Fix secondary ADC of ALC260 basic model commit 9c4cc0bdede1c39bde60a0d5d9251aac71fbe719 upstream. Fix adc_nids[] for ALC260 basic model to match with num_adc_nids. Otherwise you get an invalid NID in the secondary "Input Source" mixer element. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 013e2704f288bb892b9f9c92a2db459242b10ceb Author: Takashi Iwai Date: Mon Mar 15 15:51:53 2010 +0100 ALSA: hda - Disable MSI for Nvidia controller commit 80c43ed724797627d8f86855248c497a6161a214 upstream. Judging from the member of enable_msi white-list, Nvidia controller seems to cause troubles with MSI enabled, e.g. boot hang up or other serious issue may come up. It's safer to disable MSI as default for Nvidia controllers again for now. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit fbaa3a9c9613af15fb76feefaabc600d92b55040 Author: Daniel T Chen Date: Sun Mar 14 23:44:03 2010 -0400 ALSA: hda: Use LPIB and 6stack-dig for eMachines T5212 commit 572c0e3c73341755f3e7dfaaef6b26df12bd709c upstream. BugLink: https://bugs.launchpad.net/bugs/538895 The OR has verified that both position_fix=1 and model=6stack-dig are necessary to have capture function properly. (The existing 3stack-6ch model quirk seems to be incorrect.) Reported-by: Reuben Bailey Tested-by: Reuben Bailey Signed-off-by: Daniel T Chen Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit e5d17b3597e0314445d661e3263e41457545d48b Author: Hisashi Hifumi Date: Thu Dec 17 15:27:26 2009 -0800 readahead: add blk_run_backing_dev commit 65a80b4c61f5b5f6eb0f5669c8fb120893bfb388 upstream. I added blk_run_backing_dev on page_cache_async_readahead so readahead I/O is unpluged to improve throughput on especially RAID environment. The normal case is, if page N become uptodate at time T(N), then T(N) <= T(N+1) holds. With RAID (and NFS to some degree), there is no strict ordering, the data arrival time depends on runtime status of individual disks, which breaks that formula. So in do_generic_file_read(), just after submitting the async readahead IO request, the current page may well be uptodate, so the page won't be locked, and the block device won't be implicitly unplugged: if (PageReadahead(page)) page_cache_async_readahead() if (!PageUptodate(page)) goto page_not_up_to_date; //... page_not_up_to_date: lock_page_killable(page); Therefore explicit unplugging can help. Following is the test result with dd. #dd if=testdir/testfile of=/dev/null bs=16384 -2.6.30-rc6 1048576+0 records in 1048576+0 records out 17179869184 bytes (17 GB) copied, 224.182 seconds, 76.6 MB/s -2.6.30-rc6-patched 1048576+0 records in 1048576+0 records out 17179869184 bytes (17 GB) copied, 206.465 seconds, 83.2 MB/s (7Disks RAID-0 Array) -2.6.30-rc6 1054976+0 records in 1054976+0 records out 17284726784 bytes (17 GB) copied, 212.233 seconds, 81.4 MB/s -2.6.30-rc6-patched 1054976+0 records out 17284726784 bytes (17 GB) copied, 198.878 seconds, 86.9 MB/s (7Disks RAID-5 Array) The patch was found to improve performance with the SCST scsi target driver. See http://sourceforge.net/mailarchive/forum.php?thread_name=a0272b440906030714g67eabc5k8f847fb1e538cc62%40mail.gmail.com&forum_name=scst-devel [akpm@linux-foundation.org: unbust comment layout] [akpm@linux-foundation.org: "fix" CONFIG_BLOCK=n] Signed-off-by: Hisashi Hifumi Acked-by: Wu Fengguang Cc: Jens Axboe Cc: KOSAKI Motohiro Tested-by: Ronald Cc: Bart Van Assche Cc: Vladislav Bolkhovitin Cc: Randy Dunlap Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 8cefe8b8849627e6e90337107f58e2b1972e7906 Author: Suresh Siddha Date: Thu Mar 11 09:45:44 2010 +0100 sched: Fix SCHED_MC regression caused by change in sched cpu_power commit dd5feea14a7de4edbd9f36db1a2db785de91b88d upstream On platforms like dual socket quad-core platform, the scheduler load balancer is not detecting the load imbalances in certain scenarios. This is leading to scenarios like where one socket is completely busy (with all the 4 cores running with 4 tasks) and leaving another socket completely idle. This causes performance issues as those 4 tasks share the memory controller, last-level cache bandwidth etc. Also we won't be taking advantage of turbo-mode as much as we would like, etc. Some of the comparisons in the scheduler load balancing code are comparing the "weighted cpu load that is scaled wrt sched_group's cpu_power" with the "weighted average load per task that is not scaled wrt sched_group's cpu_power". While this has probably been broken for a longer time (for multi socket numa nodes etc), the problem got aggrevated via this recent change: | | commit f93e65c186ab3c05ce2068733ca10e34fd00125e | Author: Peter Zijlstra | Date: Tue Sep 1 10:34:32 2009 +0200 | | sched: Restore __cpu_power to a straight sum of power | Also with this change, the sched group cpu power alone no longer reflects the group capacity that is needed to implement MC, MT performance (default) and power-savings (user-selectable) policies. We need to use the computed group capacity (sgs.group_capacity, that is computed using the SD_PREFER_SIBLING logic in update_sd_lb_stats()) to find out if the group with the max load is above its capacity and how much load to move etc. Reported-by: Ma Ling Initial-Analysis-by: Zhang, Yanmin Signed-off-by: Suresh Siddha [ -v2: build fix ] Signed-off-by: Peter Zijlstra LKML-Reference: <1266970432.11588.22.camel@sbs-t61.sc.intel.com> Signed-off-by: Ingo Molnar commit aa004fb34a5c71a2f6f175bc2f510cce018fd792 Author: Oleg Nesterov Date: Tue Feb 16 15:02:13 2010 +0100 x86: set_personality_ia32() misses force_personality32 commit 1252f238db48ec419f40c1bdf30fda649860eed9 upstream. 05d43ed8a "x86: get rid of the insane TIF_ABI_PENDING bit" forgot about force_personality32. Fix. Signed-off-by: Oleg Nesterov Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit d283dafb0da7addffa267216733b2ad2bed15ec0 Author: Michael S. Tsirkin Date: Thu Feb 25 19:08:55 2010 +0200 virtio: fix out of range array access commit 3119815912a220bdac943dfbdfee640414c0c611 upstream. I have observed the following error on virtio-net module unload: ------------[ cut here ]------------ WARNING: at kernel/irq/manage.c:858 __free_irq+0xa0/0x14c() Hardware name: Bochs Trying to free already-free IRQ 0 Modules linked in: virtio_net(-) virtio_blk virtio_pci virtio_ring virtio af_packet e1000 shpchp aacraid uhci_hcd ohci_hcd ehci_hcd [last unloaded: scsi_wait_scan] Pid: 1957, comm: rmmod Not tainted 2.6.33-rc8-vhost #24 Call Trace: [] warn_slowpath_common+0x7c/0x94 [] warn_slowpath_fmt+0x41/0x43 [] ? __free_pages+0x5a/0x70 [] __free_irq+0xa0/0x14c [] free_irq+0x3f/0x65 [] vp_del_vqs+0x81/0xb1 [virtio_pci] [] virtnet_remove+0xda/0x10b [virtio_net] [] virtio_dev_remove+0x22/0x4a [virtio] [] __device_release_driver+0x66/0xac [] driver_detach+0x83/0xa9 [] bus_remove_driver+0x91/0xb4 [] driver_unregister+0x6c/0x74 [] unregister_virtio_driver+0xe/0x10 [virtio] [] fini+0x15/0x17 [virtio_net] [] sys_delete_module+0x1c3/0x230 [] ? old_ich_force_enable_hpet+0x117/0x164 [] ? do_page_fault+0x29c/0x2cc [] sysenter_dispatch+0x7/0x27 ---[ end trace 15e88e4c576cc62b ]--- The bug is in virtio-pci: we use msix_vector as array index to get irq entry, but some vqs do not have a dedicated vector so this causes an out of bounds access. By chance, we seem to often get 0 value, which results in this error. Fix by verifying that vector is legal before using it as index. Signed-off-by: Michael S. Tsirkin Acked-by: Anthony Liguori Acked-by: Shirley Ma Acked-by: Amit Shah Signed-off-by: Greg Kroah-Hartman commit cdaab88937d2dbbeb27e4b837abf5d3206ddc1ec Author: André Goddard Rosa Date: Tue Feb 23 04:04:28 2010 -0300 mqueue: fix mq_open() file descriptor leak on user-space processes commit 4294a8eedb17bbc45e1e7447c2a4d05332943248 upstream. We leak fd on lookup_one_len() failure Signed-off-by: André Goddard Rosa Signed-off-by: Al Viro Signed-off-by: Greg Kroah-Hartman commit 0dcc9985f34aef3c60bffab3dfc7f7ba3748f35a Author: Ming Lei Date: Sun Feb 28 00:56:24 2010 +0800 ath9k: fix lockdep warning when unloading module commit a9f042cbe5284f34ccff15f3084477e11b39b17b upstream. Since txq->axq_lock may be hold in softirq context, it must be acquired with spin_lock_bh() instead of spin_lock() if softieq is enabled. The patch fixes the lockdep warning below when unloading ath9k modules. ================================= [ INFO: inconsistent lock state ] 2.6.33-wl #12 --------------------------------- inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. rmmod/3642 [HC0[0]:SC0[0]:HE1:SE1] takes: (&(&txq->axq_lock)->rlock){+.?...}, at: [] ath_tx_node_cleanup+0x62/0x180 [ath9k] {IN-SOFTIRQ-W} state was registered at: [] __lock_acquire+0x2f6/0xd35 [] lock_acquire+0xcd/0xf1 [] _raw_spin_lock_bh+0x3b/0x6e [] spin_lock_bh+0xe/0x10 [ath9k] [] ath_tx_tasklet+0xcd/0x391 [ath9k] [] ath9k_tasklet+0x70/0xc8 [ath9k] [] tasklet_action+0x8c/0xf4 [] __do_softirq+0xf8/0x1cd [] call_softirq+0x1c/0x30 [] do_softirq+0x4b/0xa3 [] irq_exit+0x4a/0x8c [] do_IRQ+0xac/0xc3 [] ret_from_intr+0x0/0x16 [] cpuidle_idle_call+0x9e/0xf8 [] cpu_idle+0x62/0x9d [] rest_init+0x7e/0x80 [] start_kernel+0x3e8/0x3f3 [] x86_64_start_reservations+0xa7/0xab [] x86_64_start_kernel+0xf8/0x107 irq event stamp: 42037 hardirqs last enabled at (42037): [] _raw_spin_unlock_irqrestore+0x47/0x56 hardirqs last disabled at (42036): [] _raw_spin_lock_irqsave+0x2b/0x88 softirqs last enabled at (42000): [] spin_unlock_bh+0xe/0x10 [ath9k] softirqs last disabled at (41998): [] _raw_spin_lock_bh+0x18/0x6e other info that might help us debug this: 4 locks held by rmmod/3642: #0: (rtnl_mutex){+.+.+.}, at: [] rtnl_lock+0x17/0x19 #1: (&wdev->mtx){+.+.+.}, at: [] cfg80211_netdev_notifier_call+0x28d/0x46d [cfg80211] #2: (&ifmgd->mtx){+.+.+.}, at: [] ieee80211_mgd_deauth+0x3f/0x17e [mac80211] #3: (&local->sta_mtx){+.+.+.}, at: [] sta_info_destroy_addr+0x2b/0x5e [mac80211] stack backtrace: Pid: 3642, comm: rmmod Not tainted 2.6.33-wl #12 Call Trace: [] valid_state+0x178/0x18b [] ? save_stack_trace+0x2f/0x4c [] ? check_usage_backwards+0x0/0x88 [] mark_lock+0x113/0x230 [] __lock_acquire+0x36a/0xd35 [] ? native_sched_clock+0x2d/0x5f [] ? ath_tx_node_cleanup+0x62/0x180 [ath9k] [] lock_acquire+0xcd/0xf1 [] ? ath_tx_node_cleanup+0x62/0x180 [ath9k] [] ? trace_hardirqs_off+0xd/0xf [] _raw_spin_lock+0x36/0x69 [] ? ath_tx_node_cleanup+0x62/0x180 [ath9k] [] ath_tx_node_cleanup+0x62/0x180 [ath9k] [] ? trace_hardirqs_on+0xd/0xf [] ath9k_sta_remove+0x22/0x26 [ath9k] [] __sta_info_destroy+0x1ad/0x38c [mac80211] [] sta_info_destroy_addr+0x3e/0x5e [mac80211] [] ieee80211_set_disassoc+0x175/0x180 [mac80211] [] ieee80211_mgd_deauth+0x58/0x17e [mac80211] [] ? __mutex_lock_common+0x37f/0x3a4 [] ? cfg80211_netdev_notifier_call+0x28d/0x46d [cfg80211] [] ieee80211_deauth+0x1e/0x20 [mac80211] [] __cfg80211_mlme_deauth+0x130/0x13f [cfg80211] [] ? cfg80211_netdev_notifier_call+0x28d/0x46d [cfg80211] [] ? trace_hardirqs_off+0xd/0xf [] __cfg80211_disconnect+0x111/0x189 [cfg80211] [] cfg80211_netdev_notifier_call+0x2ce/0x46d [cfg80211] [] notifier_call_chain+0x37/0x63 [] raw_notifier_call_chain+0x14/0x16 [] call_netdevice_notifiers+0x1b/0x1d [] dev_close+0x6a/0xa6 [] rollback_registered_many+0xb6/0x2f4 [] unregister_netdevice_many+0x1b/0x66 [] ieee80211_remove_interfaces+0xc5/0xd0 [mac80211] [] ieee80211_unregister_hw+0x47/0xe8 [mac80211] [] ath9k_deinit_device+0x7a/0x9b [ath9k] [] ath_pci_remove+0x38/0x76 [ath9k] [] pci_device_remove+0x2d/0x51 [] __device_release_driver+0x7b/0xd1 [] driver_detach+0x98/0xbe [] bus_remove_driver+0x94/0xb7 [] driver_unregister+0x6c/0x74 [] pci_unregister_driver+0x46/0xad [] ath_pci_exit+0x15/0x17 [ath9k] [] ath9k_exit+0xe/0x2f [ath9k] [] sys_delete_module+0x1c7/0x236 [] ? retint_swapgs+0x13/0x1b [] ? trace_hardirqs_on_caller+0x119/0x144 [] ? audit_syscall_entry+0x11e/0x14a [] system_call_fastpath+0x16/0x1b wlan1: deauthenticating from 00:23:cd:e1:f9:b2 by local choice (reason=3) PM: Removing info for No Bus:wlan1 cfg80211: Calling CRDA to update world regulatory domain PM: Removing info for No Bus:rfkill2 PM: Removing info for No Bus:phy1 ath9k 0000:16:00.0: PCI INT A disabled Signed-off-by: Ming Lei Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit cb53e875e1d567724ef60f68ae66ec71b31bb54f Author: Ping Cheng Date: Tue Dec 15 00:35:24 2009 -0800 Input: wacom - ensure the device is initialized properly upon resume commit 232f5693e5c9483e222528ef81979e42ea2f2908 upstream. Call wacom_query_tablet_data() from wacom_resume() so the device will be switched to Wacom mode upon resume. Devices that require this are: regular tablets and two finger touch devices. Signed-off-by: Ping Cheng Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman commit 69edae683a24583f5d00dfd53d5d25c77f89a573 Author: Don Skidmore Date: Tue Dec 8 07:22:23 2009 +0000 ixgbe: add support for 82599 KR device 0x1517 commit 74757d49016a8b06ca028196886641d7aeb78de5 upstream. Signed-off-by: Don Skidmore Acked-by: Peter P Waskiewicz Jr Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 29ffe730a6769b61dd4342802c7836c67e2bd79a Author: Bruce Allan Date: Tue Dec 1 15:50:31 2009 +0000 e1000e: enable new 82567V-3 device commit 9e135a2e6266eba276f33c404a2478499bc07ff5 upstream. This new PCI device ID is for a new combination of MAC and PHY both of which already have supporting code in the driver, just not yet in this combination. During validation of the device, an intermittent issue was discovered with waking it from a suspended state which can be resolved with the pre-existing workaround to disable gigabit speed prior to suspending. Signed-off-by: Bruce Allan Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit c907edc64f5ccc35c81b44fd0444646ba97edfc4 Author: Kees Cook Date: Sun Nov 8 09:37:00 2009 -0800 sysctl: require CAP_SYS_RAWIO to set mmap_min_addr commit 0e1a6ef2dea88101b056b6d9984f3325c5efced3 upstream. Currently the mmap_min_addr value can only be bypassed during mmap when the task has CAP_SYS_RAWIO. However, the mmap_min_addr sysctl value itself can be adjusted to 0 if euid == 0, allowing a bypass without CAP_SYS_RAWIO. This patch adds a check for the capability before allowing mmap_min_addr to be changed. Signed-off-by: Kees Cook Acked-by: Serge Hallyn Signed-off-by: James Morris Signed-off-by: Greg Kroah-Hartman commit a6c4c1c5057d956af87679861f5eeb80c72e3a5e Author: David S. Miller Date: Wed Mar 3 09:06:03 2010 -0800 sparc64: Make prom entry spinlock NMI safe. [ Upstream commit 8a4fd1e4922413cfdfa6c51a59efb720d904a5eb ] If we do something like try to print to the OF console from an NMI while we're already in OpenFirmware, we'll deadlock on the spinlock. Use a raw spinlock and disable NMIs when we take it. Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 8c2b12e12010928b6c5dd06447eccb99b0629515 Author: Peter Zijlstra Date: Wed Dec 16 18:04:31 2009 +0100 sched: Mark boot-cpu active before smp_init() commit 933b0618d8b2a59c7a0742e43836544e02f1e9bd upstream. A UP machine has 1 active cpu, not having the boot-cpu in the active map when starting the scheduler confuses things. Signed-off-by: Peter Zijlstra Cc: Mike Galbraith LKML-Reference: <20091216170517.423469527@chello.nl> Signed-off-by: Ingo Molnar Cc: Christoph Biedl Signed-off-by: Greg Kroah-Hartman commit 81aa42727eba53401948ec04b4825b8ef30d6fdc Author: Alexander Duyck Date: Fri Feb 19 17:57:46 2010 +0000 pci: add support for 82576NS serdes to existing SR-IOV quirk commit 7a0deb6bcda98c2a764cb87f1441eef920fd3663 upstream. This patch adds support for the 82576NS Serdes adapter to the existing pci quirk for 82576 parts. Signed-off-by: Alexander Duyck Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit f9404808f47e0ed18f68fc5957acec2022572820 Author: Srinivas Date: Tue Nov 24 20:07:39 2009 +0530 mvsas: add support for Adaptec ASC-1045/1405 SAS/SATA HBA commit 7ec4ad0125db0222e397508c190b01c8f2b5f7cd upstream. This is support for Adaptec ASC-1045/1405 SAS/SATA HBA on mvsas, which is based on Marvell 88SE6440 chipset. Signed-off-by: Srinivas Cc: Andy Yan Signed-off-by: James Bottomley Cc: Thomas Voegtle Signed-off-by: Greg Kroah-Hartman commit dd5a2355ad5af18cc8fef4844e51e49197942c3a Author: Suresh Siddha Date: Thu Feb 18 15:30:55 2010 -0800 x86, apic: Don't use logical-flat mode when CPU hotplug may exceed 8 CPUs commit 681ee44d40d7c93b42118320e4620d07d8704fd6 upstream We need to fall back from logical-flat APIC mode to physical-flat mode when we have more than 8 CPUs. However, in the presence of CPU hotplug(with bios listing not enabled but possible cpus as disabled cpus in MADT), we have to consider the number of possible CPUs rather than the number of current CPUs; otherwise we may cross the 8-CPU boundary when CPUs are added later. 32bit apic code can use more cleanups (like the removal of vendor checks in 32bit default_setup_apic_routing()) and more unifications with 64bit code. Yinghai has some patches in works already. This patch addresses the boot issue that is reported in the virtualization guest context. Signed-off-by: Suresh Siddha Acked-by: Shaohui Zheng Reviewed-by: Yinghai Lu Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit 2605c157ed3bb18e66a6a08263448046f77ba5fb Author: Thomas Gleixner Date: Fri Nov 13 17:05:44 2009 +0100 hrtimer: Tune hrtimer_interrupt hang logic commit 41d2e494937715d3150e5c75d01f0e75ae899337 upstream. The hrtimer_interrupt hang logic adjusts min_delta_ns based on the execution time of the hrtimer callbacks. This is error-prone for virtual machines, where a guest vcpu can be scheduled out during the execution of the callbacks (and the callbacks themselves can do operations that translate to blocking operations in the hypervisor), which in can lead to large min_delta_ns rendering the system unusable. Replace the current heuristics with something more reliable. Allow the interrupt code to try 3 times to catch up with the lost time. If that fails use the total time spent in the interrupt handler to defer the next timer interrupt so the system can catch up with other things which got delayed. Limit that deferment to 100ms. The retry events and the maximum time spent in the interrupt handler are recorded and exposed via /proc/timer_list Inspired by a patch from Marcelo. Reported-by: Michael Tokarev Signed-off-by: Thomas Gleixner Tested-by: Marcelo Tosatti Cc: kvm@vger.kernel.org Cc: Jeremy Fitzhardinge Signed-off-by: Greg Kroah-Hartman commit 0192e1bfd9a979b014a59da0c32e50d4aa3f8f1d Author: Francesco Lavra Date: Thu Dec 31 08:47:11 2009 -0300 V4L/DVB (13961): em28xx-dvb: fix memleak in dvb_fini() commit 19f48cb105b7fa18d0dcab435919a3a29b7a7c4c upstream. this patch fixes a memory leak which occurs when an em28xx card with DVB extension is unplugged or its DVB extension driver is unloaded. In dvb_fini(), dev->dvb must be freed before being set to NULL, as is done in dvb_init() in case of error. Note that this bug is also present in the latest stable kernel release. Signed-off-by: Francesco Lavra Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit e88e473bf3124044738f44a6e40e4a03a13ecbe7 Author: Neil Horman Date: Fri Mar 5 13:44:16 2010 -0800 coredump: suppress uid comparison test if core output files are pipes commit 76595f79d76fbe6267a51b3a866a028d150f06d4 upstream. Modify uid check in do_coredump so as to not apply it in the case of pipes. This just got noticed in testing. The end of do_coredump validates the uid of the inode for the created file against the uid of the crashing process to ensure that no one can pre-create a core file with different ownership and grab the information contained in the core when they shouldn' tbe able to. This causes failures when using pipes for a core dumps if the crashing process is not root, which is the uid of the pipe when it is created. The fix is simple. Since the check for matching uid's isn't relevant for pipes (a process can't create a pipe that the uermodehelper code will open anyway), we can just just skip it in the event ispipe is non-zero Reverts a pipe-affecting change which was accidentally made in : commit c46f739dd39db3b07ab5deb4e3ec81e1c04a91af : Author: Ingo Molnar : AuthorDate: Wed Nov 28 13:59:18 2007 +0100 : Commit: Linus Torvalds : CommitDate: Wed Nov 28 10:58:01 2007 -0800 : : vfs: coredumping fix Signed-off-by: Neil Horman Cc: Andi Kleen Cc: Oleg Nesterov Cc: Alan Cox Cc: Al Viro Cc: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Cc: maximilian attems Signed-off-by: Greg Kroah-Hartman commit dac5e7849034825665bb114dc554e35cae449f49 Author: Marcin Slusarz Date: Mon Feb 22 12:44:22 2010 -0800 efifb: fix framebuffer handoff commit 89f3f2199084a160a3a45fa6d9af235696321758 upstream. Commit 4410f3910947dcea8672280b3adecd53cec4e85e ("fbdev: add support for handoff from firmware to hw framebuffers") didn't add fb_destroy operation to efifb. Fix it and change aperture_size to match size passed to request_mem_region. Addresses http://bugzilla.kernel.org/show_bug.cgi?id=15151 Signed-off-by: Marcin Slusarz Reported-by: Alex Zhavnerchik Tested-by: Alex Zhavnerchik Acked-by: Peter Jones Cc: Huang Ying Cc: Dave Airlie Cc: "Rafael J. Wysocki" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Cc: maximilian attems Signed-off-by: Greg Kroah-Hartman commit 1ba878babba0a55acf89882c5adc44335db8a7c9 Author: Adam Jackson Date: Thu Dec 3 17:44:36 2009 -0500 drm/edid: Unify detailed block parsing between base and extension blocks commit 9cf00977da092096c7a983276dad8b3002d23a99 upstream. Also fix an embarassing bug in standard timing subblock parsing that would result in an infinite loop. Signed-off-by: Adam Jackson Signed-off-by: Dave Airlie Cc: maximilian attems Signed-off-by: Greg Kroah-Hartman commit 1ebf19e8a1402842dcd2f34a4032922170de4218 Author: Andrew Patterson Date: Thu Dec 3 10:28:20 2009 -0700 PCI: unconditionally clear AER uncorr status register during cleanup commit 6cdfd995a65a52e05b99e3a72a9b979abe73b312 upstream. The current implementation of pci_cleanup_aer_uncorrect_error_status only clears either fatal or non-fatal error status bits depending on the state of the I/O channel. This implementation will then often leave some bits set after PCI error recovery completes. The uncleared bit settings will then be falsely reported the next time an AER interrupt is generated for that hierarchy. An easy way to illustrate this issue is to use the aer-inject module to simultaneously inject both an uncorrectable non-fatal and uncorrectable fatal error. One of the errors will not be cleared. This patch resolves this issue by unconditionally clearing all bits in the AER uncorrectable status register. All settings and corrective action strategies are saved and determined before pci_cleanup_aer_uncorrect_error_status is called, so this change should not affect errory handling functionality. Signed-off-by: Andrew Patterson Signed-off-by: Jesse Barnes Cc: Alex Chiang Signed-off-by: Greg Kroah-Hartman commit 80736c50f92cc545fe190d5ca47ca04fd3eca860 Author: Steven Rostedt Date: Fri Mar 12 20:03:30 2010 -0500 tracing: Do not record user stack trace from NMI context commit b6345879ccbd9b92864fbd7eb8ac48acdb4d6b15 upstream. A bug was found with Li Zefan's ftrace_stress_test that caused applications to segfault during the test. Placing a tracing_off() in the segfault code, and examining several traces, I found that the following was always the case. The lock tracer was enabled (lockdep being required) and userstack was enabled. Testing this out, I just enabled the two, but that was not good enough. I needed to run something else that could trigger it. Running a load like hackbench did not work, but executing a new program would. The following would trigger the segfault within seconds: # echo 1 > /debug/tracing/options/userstacktrace # echo 1 > /debug/tracing/events/lock/enable # while :; do ls > /dev/null ; done Enabling the function graph tracer and looking at what was happening I finally noticed that all cashes happened just after an NMI. 1) | copy_user_handle_tail() { 1) | bad_area_nosemaphore() { 1) | __bad_area_nosemaphore() { 1) | no_context() { 1) | fixup_exception() { 1) 0.319 us | search_exception_tables(); 1) 0.873 us | } [...] 1) 0.314 us | __rcu_read_unlock(); 1) 0.325 us | native_apic_mem_write(); 1) 0.943 us | } 1) 0.304 us | rcu_nmi_exit(); [...] 1) 0.479 us | find_vma(); 1) | bad_area() { 1) | __bad_area() { After capturing several traces of failures, all of them happened after an NMI. Curious about this, I added a trace_printk() to the NMI handler to read the regs->ip to see where the NMI happened. In which I found out it was here: ffffffff8135b660 : ffffffff8135b660: 48 83 ec 78 sub $0x78,%rsp ffffffff8135b664: e8 97 01 00 00 callq ffffffff8135b800 What was happening is that the NMI would happen at the place that a page fault occurred. It would call rcu_read_lock() which was traced by the lock events, and the user_stack_trace would run. This would trigger a page fault inside the NMI. I do not see where the CR2 register is saved or restored in NMI handling. This means that it would corrupt the page fault handling that the NMI interrupted. The reason the while loop of ls helped trigger the bug, was that each execution of ls would cause lots of pages to be faulted in, and increase the chances of the race happening. The simple solution is to not allow user stack traces in NMI context. After this patch, I ran the above "ls" test for a couple of hours without any issues. Without this patch, the bug would trigger in less than a minute. Reported-by: Li Zefan Signed-off-by: Steven Rostedt Signed-off-by: Greg Kroah-Hartman commit 95b9725fa051fe1a58d89b1c445948881f998907 Author: Steven Rostedt Date: Fri Mar 12 19:56:00 2010 -0500 tracing: Disable buffer switching when starting or stopping trace commit a2f8071428ed9a0f06865f417c962421c9a6b488 upstream. When the trace iterator is read, tracing_start() and tracing_stop() is called to stop tracing while the iterator is processing the trace output. These functions disable both the standard buffer and the max latency buffer. But if the wakeup tracer is running, it can switch these buffers between the two disables: buffer = global_trace.buffer; if (buffer) ring_buffer_record_disable(buffer); <<<--------- swap happens here buffer = max_tr.buffer; if (buffer) ring_buffer_record_disable(buffer); What happens is that we disabled the same buffer twice. On tracing_start() we can enable the same buffer twice. All ring_buffer_record_disable() must be matched with a ring_buffer_record_enable() or the buffer can be disable permanently, or enable prematurely, and cause a bug where a reset happens while a trace is commiting. This patch protects these two by taking the ftrace_max_lock to prevent a switch from occurring. Found with Li Zefan's ftrace_stress_test. Reported-by: Lai Jiangshan Signed-off-by: Steven Rostedt Signed-off-by: Greg Kroah-Hartman commit c087612ab2608cab63d5525e2fe0d3d6eb0bd3af Author: Steven Rostedt Date: Fri Mar 12 19:48:41 2010 -0500 tracing: Use same local variable when resetting the ring buffer commit 283740c619d211e34572cc93c8cdba92ccbdb9cc upstream. In the ftrace code that resets the ring buffer it references the buffer with a local variable, but then uses the tr->buffer as the parameter to reset. If the wakeup tracer is running, which can switch the tr->buffer with the max saved buffer, this can break the requirement of disabling the buffer before the reset. buffer = tr->buffer; ring_buffer_record_disable(buffer); synchronize_sched(); __tracing_reset(tr->buffer, cpu); If the tr->buffer is swapped, then the reset is not happening to the buffer that was disabled. This will cause the ring buffer to fail. Found with Li Zefan's ftrace_stress_test. Reported-by: Lai Jiangshan Signed-off-by: Steven Rostedt Signed-off-by: Greg Kroah-Hartman commit 1020738fc1de56751c902c0f26eac5a61a0d9790 Author: Marcel Holtmann Date: Wed Feb 3 15:52:18 2010 -0800 Bluetooth: Fix sleeping function in RFCOMM within invalid context commit 485f1eff73a7b932fd3abb0dfcf804e1a1f59025 upstream. With the commit 9e726b17422bade75fba94e625cd35fd1353e682 the rfcomm_session_put() gets accidentially called from a timeout callback and results in this: BUG: sleeping function called from invalid context at net/core/sock.c:1897 in_atomic(): 1, irqs_disabled(): 0, pid: 0, name: swapper Pid: 0, comm: swapper Tainted: P 2.6.32 #31 Call Trace: [] __might_sleep+0xf8/0xfa [] lock_sock_nested+0x29/0xc4 [] lock_sock+0xb/0xd [l2cap] [] l2cap_sock_shutdown+0x1c/0x76 [l2cap] [] ? clockevents_program_event+0x75/0x7e [] ? tick_dev_program_event+0x37/0xa5 [] l2cap_sock_release+0x27/0x67 [l2cap] [] sock_release+0x1a/0x67 [] rfcomm_session_del+0x34/0x53 [rfcomm] [] rfcomm_session_put+0x14/0x16 [rfcomm] [] rfcomm_session_timeout+0xe/0x1a [rfcomm] [] run_timer_softirq+0x1e2/0x29a [] ? rfcomm_session_timeout+0x0/0x1a [rfcomm] [] __do_softirq+0xfe/0x1c5 [] ? timer_interrupt+0x1a/0x21 [] call_softirq+0x1c/0x28 [] do_softirq+0x33/0x6b [] irq_exit+0x36/0x85 [] do_IRQ+0xa6/0xbd [] ret_from_intr+0x0/0xa [] ? acpi_idle_enter_bm+0x269/0x294 [] ? acpi_idle_enter_bm+0x25f/0x294 [] ? cpuidle_idle_call+0x97/0x107 [] ? cpu_idle+0x53/0xaa [] ? rest_init+0x7a/0x7c [] ? start_kernel+0x389/0x394 [] ? x86_64_start_reservations+0xac/0xb0 [] ? x86_64_start_kernel+0xe4/0xeb To fix this, the rfcomm_session_put() needs to be moved out of rfcomm_session_timeout() into rfcomm_process_sessions(). In that context it is perfectly fine to sleep and disconnect the socket. Signed-off-by: Marcel Holtmann Tested-by: David John Cc: Chase Douglas Signed-off-by: Greg Kroah-Hartman commit 090fe6cbe1fe9f15a219e38c0edea6960dcadb69 Author: Steven Rostedt Date: Fri Mar 12 19:41:23 2010 -0500 function-graph: Init curr_ret_stack with ret_stack commit ea14eb714041d40fcc5180b5a586034503650149 upstream. If the graph tracer is active, and a task is forked but the allocating of the processes graph stack fails, it can cause crash later on. This is due to the temporary stack being NULL, but the curr_ret_stack variable is copied from the parent. If it is not -1, then in ftrace_graph_probe_sched_switch() the following: for (index = next->curr_ret_stack; index >= 0; index--) next->ret_stack[index].calltime += timestamp; Will cause a kernel OOPS. Found with Li Zefan's ftrace_stress_test. Signed-off-by: Steven Rostedt Signed-off-by: Greg Kroah-Hartman commit 9dfa691caee866df28691815e708a914349a6f10 Author: Lai Jiangshan Date: Mon Mar 8 14:50:43 2010 +0800 ring-buffer: Move disabled check into preempt disable section commit 52fbe9cde7fdb5c6fac196d7ebd2d92d05ef3cd4 upstream. The ring buffer resizing and resetting relies on a schedule RCU action. The buffers are disabled, a synchronize_sched() is called and then the resize or reset takes place. But this only works if the disabling of the buffers are within the preempt disabled section, otherwise a window exists that the buffers can be written to while a reset or resize takes place. Reported-by: Li Zefan Signed-off-by: Lai Jiangshan LKML-Reference: <4B949E43.2010906@cn.fujitsu.com> Signed-off-by: Steven Rostedt Signed-off-by: Greg Kroah-Hartman commit a0d8ffd630563ec37d9a38999ecdf516b570a0ac Author: Bob Copeland Date: Wed Jan 20 23:51:04 2010 -0500 ath5k: fix setup for CAB queue commit a951ae2176b982574ffa197455db6c89359fd5eb upstream. The beacon sent gating doesn't seem to work with any combination of flags. Thus, buffered frames tend to stay buffered forever, using up tx descriptors. Instead, use the DBA gating and hold transmission of the buffered frames until 80% of the beacon interval has elapsed using the ready time. This fixes the following error in AP mode: ath5k phy0: no further txbuf available, dropping packet Add a comment to acknowledge that this isn't the best solution. Signed-off-by: Bob Copeland Acked-by: Nick Kossifidis Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit d69b8a11c138141bf2ee5f0d218111e923061a62 Author: Bob Copeland Date: Thu Mar 11 18:23:48 2010 -0500 ath5k: dont use external sleep clock in AP mode commit 5d6ce628f986d1a3c523cbb0a5a52095c48cc332 upstream When using the external sleep clock in AP mode, the TSF increments too quickly, causing beacon interval to be much lower than it is supposed to be, resulting in lots of beacon-not-ready interrupts. This fixes http://bugzilla.kernel.org/show_bug.cgi?id=14802. Signed-off-by: Bob Copeland Acked-by: Nick Kossifidis Signed-off-by: John W. Linville Cc: Luis Rodriguez Signed-off-by: Greg Kroah-Hartman commit cde4ff84e046eaed345bde28aa2e5529b5124d02 Author: Jean Delvare Date: Sat Mar 13 20:56:53 2010 +0100 i2c-i801: Don't use the block buffer for I2C block writes commit c074c39d62306efa5ba7c69c1a1531bc7333d252 upstream. Experience has shown that the block buffer can only be used for SMBus (not I2C) block transactions, even though the datasheet doesn't mention this limitation. Reported-by: Felix Rubinstein Signed-off-by: Jean Delvare Cc: Oleg Ryjkov Signed-off-by: Greg Kroah-Hartman commit 93c676ec4c60765cef691d4dd585b9866e9090a6 Author: Christoph Fritz Date: Sat Mar 13 22:26:23 2010 -0800 Input: i8042 - add ALDI/MEDION netbook E1222 to qurik reset table commit 31968ecf584330b51a25b7bf881c2b632a02a3fb upstream. ALDI/MEDION netbook E1222 needs to be in the reset quirk list for its touchpad's proper function. Reported-by: Michael Fischer Signed-off-by: Christoph Fritz Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman commit e2d83be64e73388316e13dc99dee660ee359a071 Author: Thomas Bächler Date: Tue Mar 9 20:38:48 2010 -0800 Input: alps - add support for the touchpad on Toshiba Tecra A11-11L commit eb8bff85c5bd5caef7c374ff32b86545029efb56 upstream. Signed-off-by: Thomas Bächler Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman commit 74b176077272028d0a88eddd59e630abc37cd475 Author: john stultz Date: Mon Mar 1 12:34:43 2010 -0800 timekeeping: Prevent oops when GENERIC_TIME=n commit ad6759fbf35d104dbf573cd6f4c6784ad6823f7e upstream. Aaro Koskinen reported an issue in kernel.org bugzilla #15366, where on non-GENERIC_TIME systems, accessing /sys/devices/system/clocksource/clocksource0/current_clocksource results in an oops. It seems the timekeeper/clocksource rework missed initializing the curr_clocksource value in the !GENERIC_TIME case. Thanks to Aaro for reporting and diagnosing the issue as well as testing the fix! Reported-by: Aaro Koskinen Signed-off-by: John Stultz Cc: Martin Schwidefsky LKML-Reference: <1267475683.4216.61.camel@localhost.localdomain> Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit bc176c0d57c093240097fda93c8c6c3578eb5822 Author: Daniel T Chen Date: Mon Mar 15 01:04:26 2010 -0400 ALSA: hda: enable MSI for Gateway M-6866 BugLink: https://bugs.launchpad.net/bugs/538918 The OR has verified that explicitly enabling MSI is necessary for audio to be audible by default. This patch is only applicable to 2.6.32.y; in 2.6.33, MSI is enabled by default. Reported-by: Sam Townsend Tested-by: Sam Townsend Acked-by: Takashi Iwai Signed-off-by: Daniel T Chen Signed-off-by: Greg Kroah-Hartman commit 35d14dd03fe79d9e695fe9e33697b76672ad03c2 Author: Takashi Iwai Date: Mon Mar 8 12:13:07 2010 +0100 ALSA: hda - Fix input source elements of secondary ADCs on Realtek commit 5311114d4867113c00f78829d4ce14be458ec925 upstream. Since alc_auto_create_input_ctls() doesn't set the elements for the secondary ADCs, "Input Source" elemtns for these also get empty, resulting in buggy outputs of alsactl like: control.14 { comment.access 'read write' comment.type ENUMERATED comment.count 1 iface MIXER name 'Input Source' index 1 value 0 } This patch fixes alc_mux_enum_*() (and others) to fall back to the first entry if the secondary input mux is empty. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 9d3ba2e2f7634d85cd891cdf3463723fa7651951 Author: Matt Carlson Date: Fri Mar 12 18:12:13 2010 -0500 tg3: Fix 5906 transmit hangs This is a resubmit backport of commit 92c6b8d16a36df3f28b2537bed2a56491fb08f11 to kernel version 2.6.32. The gentoo bug report can be found at https://bugs.gentoo.org/show_bug.cgi?id=301091. Thanks to Matt Carlson for his assistance and working me to fix a regression caused by the initial patch. The original description is as follows: The 5906 has trouble with fragments that are less than 8 bytes in size. This patch works around the problem by pivoting the 5906's transmit routine to tg3_start_xmit_dma_bug() and introducing a new SHORT_DMA_BUG flag that enables code to detect and react to the problematic condition. Signed-off-by: Mike Pagano Signed-off-by: Matt Carlson Signed-off-by: Michael Chan Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 1ab7275579d5a90d988c477653a2b1dfb64cc065 Author: Louis Rilling Date: Tue Mar 9 06:14:41 2010 +0000 tg3: Fix tg3_poll_controller() passing wrong pointer to tg3_interrupt() commit fe234f0e5cbb880792d2d1ac0743cf8c07e9dde3 upstream. Commit 09943a1819a240ff4a72f924d0038818fcdd0a90 Author: Matt Carlson Date: Fri Aug 28 14:01:57 2009 +0000 tg3: Convert ISR parameter to tnapi forgot to update tg3_poll_controller(), leading to intermittent crashes with netpoll. Fix this. Signed-off-by: Louis Rilling Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 16dc6f06d35a472191c2b00ab95a856b85201002 Author: David Daney Date: Thu Dec 3 17:43:54 2009 -0800 MIPS: Cleanup forgotten label_module_alloc in tlbex.c commit abbdc3d88aa2d5c937b21044c336bcd056c1732f upstream. commit c8af165342e83a4eb078c9607d29a7c399d30a53 (lmo) rsp. e0cc87f59490d7d62a8ab2a76498dc8a2b64927a (kernel.org) left label_module_alloc unused. Remove it now. Signed-off-by: David Daney Cc: linux-mips@linux-mips.org Patchwork: http://patchwork.linux-mips.org/patch/752/ Signed-off-by: Ralf Baechle Signed-off-by: Greg Kroah-Hartman commit 5f1cbd20c51c81c6ca7a479551471327d85fae85 Author: Russell King Date: Thu Feb 25 23:56:38 2010 +0000 ARM: Fix decompressor's kernel size estimation for ROM=y commit 98e12b5a6e05413420a7e3b3eca7fbfc2ff41b6d upstream. Commit 2552fc2 changed the way the decompressor decides if it is safe to decompress the kernel directly to its final location. Unfortunately, it took the top of the compressed data as being the stack pointer, which it is for ROM=n cases. However, for ROM=y, the stack pointer is not relevant, and results in the wrong answer. Fix this by explicitly storing the end of the biggybacked data in the decompressor, and use that to calculate the compressed image size. Signed-off-by: Russell King Signed-off-by: Greg Kroah-Hartman commit e99a084b767971afec5449db8143353062800264 Author: Russell King Date: Wed Mar 10 15:23:53 2010 -0800 decompress: fix new decompressor for PIC commit 5ceaa2f39bfa73c4398cd01e78f1c3ebde3d3383 upstream. The ARM kernel decompressor wants to be able to relocate r/w data independently from the rest of the image, and we do this by ensuring that r/w data has global visibility. Define STATIC_RW_DATA to be empty to achieve this. Signed-off-by: Russell King Cc: Alain Knaff Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit b4c8997c1f1ba84bee4c916b9107e308366f1cf4 Author: Julia Lawall Date: Wed Mar 10 15:20:42 2010 -0800 drivers/scsi/ses.c: eliminate double free commit 9b3a6549b2602ca30f58715a0071e29f9898cae9 upstream. The few lines below the kfree of hdr_buf may go to the label err_free which will also free hdr_buf. The most straightforward solution seems to be to just move the kfree of hdr_buf after these gotos. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // @r@ identifier E; expression E1; iterator I; statement S; @@ *kfree(E); ... when != E = E1 when != I(E,...) S when != &E *kfree(E); // Signed-off-by: Julia Lawall Cc: James Bottomley Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit f0c639348c47d456bff4b424584f4b880baf8042 Author: Shaohua Li Date: Wed Nov 18 15:15:02 2009 +0800 drm/i915: fix gpio register detection logic for BIOS without VBT commit 29874f44fbcbc24b231b42c9956f8f9de9407231 upstream. if no VBT is present, crt_ddc_bus will be left at 0, and cause us to use that for the GPIO register offset. That's never a valid register offset, so let the "undefined" value be 0 instead of -1. Signed-off-by: Shaohua Li Signed-off-by: Zhao Yakui Signed-off-by: Eric Anholt [anholt: clarified the commit message a bit] Signed-off-by: Greg Kroah-Hartman