commit dbdafe5ccf02d6a59e412ac8314a030ec703e880 Author: Greg Kroah-Hartman Date: Mon Mar 15 09:09:39 2010 -0700 Linux 2.6.33.1 commit 4f92d68b5499675b5c90d8491aaeea0b10ec97f7 Author: Ian Campbell Date: Wed Feb 17 10:38:10 2010 +0000 x86, mm: Allow highmem user page tables to be disabled at boot time commit 14315592009c17035cac81f4954d5a1f4d71e489 upstream. Distros generally (I looked at Debian, RHEL5 and SLES11) seem to enable CONFIG_HIGHPTE for any x86 configuration which has highmem enabled. This means that the overhead applies even to machines which have a fairly modest amount of high memory and which therefore do not really benefit from allocating PTEs in high memory but still pay the price of the additional mapping operations. Running kernbench on a 4G box I found that with CONFIG_HIGHPTE=y but no actual highptes being allocated there was a reduction in system time used from 59.737s to 55.9s. With CONFIG_HIGHPTE=y and highmem PTEs being allocated: Average Optimal load -j 4 Run (std deviation): Elapsed Time 175.396 (0.238914) User Time 515.983 (5.85019) System Time 59.737 (1.26727) Percent CPU 263.8 (71.6796) Context Switches 39989.7 (4672.64) Sleeps 42617.7 (246.307) With CONFIG_HIGHPTE=y but with no highmem PTEs being allocated: Average Optimal load -j 4 Run (std deviation): Elapsed Time 174.278 (0.831968) User Time 515.659 (6.07012) System Time 55.9 (1.07799) Percent CPU 263.8 (71.266) Context Switches 39929.6 (4485.13) Sleeps 42583.7 (373.039) This patch allows the user to control the allocation of PTEs in highmem from the command line ("userpte=nohigh") but retains the status-quo as the default. It is possible that some simple heuristic could be developed which allows auto-tuning of this option however I don't have a sufficiently large machine available to me to perform any particularly meaningful experiments. We could probably handwave up an argument for a threshold at 16G of total RAM. Assuming 768M of lowmem we have 196608 potential lowmem PTE pages. Each page can map 2M of RAM in a PAE-enabled configuration, meaning a maximum of 384G of RAM could potentially be mapped using lowmem PTEs. Even allowing generous factor of 10 to account for other required lowmem allocations, generous slop to account for page sharing (which reduces the total amount of RAM mappable by a given number of PT pages) and other innacuracies in the estimations it would seem that even a 32G machine would not have a particularly pressing need for highmem PTEs. I think 32G could be considered to be at the upper bound of what might be sensible on a 32 bit machine (although I think in practice 64G is still supported). It's seems questionable if HIGHPTE is even a win for any amount of RAM you would sensibly run a 32 bit kernel on rather than going 64 bit. Signed-off-by: Ian Campbell LKML-Reference: <1266403090-20162-1-git-send-email-ian.campbell@citrix.com> Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit 371f1d177527b1f815b55a03284ccb2c6dc79c3a Author: Thomas Gleixner Date: Wed Feb 17 09:05:48 2010 +0100 sched: Don't use possibly stale sched_class commit 83ab0aa0d5623d823444db82c3b3c34d7ec364ae upstream. setscheduler() saves task->sched_class outside of the rq->lock held region for a check after the setscheduler changes have become effective. That might result in checking a stale value. rtmutex_setprio() has the same problem, though it is protected by p->pi_lock against setscheduler(), but for correctness sake (and to avoid bad examples) it needs to be fixed as well. Retrieve task->sched_class inside of the rq->lock held region. Signed-off-by: Thomas Gleixner Acked-by: Peter Zijlstra Signed-off-by: Greg Kroah-Hartman commit 51c80d13a1d86848e178a5a5ea31cb0edfeb3efe Author: Suresh Siddha Date: Fri Feb 12 17:14:22 2010 -0800 sched: Fix SMT scheduler regression in find_busiest_queue() commit 9000f05c6d1607f79c0deacf42b09693be673f4c upstream. Fix a SMT scheduler performance regression that is leading to a scenario where SMT threads in one core are completely idle while both the SMT threads in another core (on the same socket) are busy. This is caused by this commit (with the problematic code highlighted) commit bdb94aa5dbd8b55e75f5a50b61312fe589e2c2d1 Author: Peter Zijlstra Date: Tue Sep 1 10:34:38 2009 +0200 sched: Try to deal with low capacity @@ -4203,15 +4223,18 @@ find_busiest_queue() ... for_each_cpu(i, sched_group_cpus(group)) { + unsigned long power = power_of(i); ... - wl = weighted_cpuload(i); + wl = weighted_cpuload(i) * SCHED_LOAD_SCALE; + wl /= power; - if (rq->nr_running == 1 && wl > imbalance) + if (capacity && rq->nr_running == 1 && wl > imbalance) continue; On a SMT system, power of the HT logical cpu will be 589 and the scheduler load imbalance (for scenarios like the one mentioned above) can be approximately 1024 (SCHED_LOAD_SCALE). The above change of scaling the weighted load with the power will result in "wl > imbalance" and ultimately resulting in find_busiest_queue() return NULL, causing load_balance() to think that the load is well balanced. But infact one of the tasks can be moved to the idle core for optimal performance. We don't need to use the weighted load (wl) scaled by the cpu power to compare with imabalance. In that condition, we already know there is only a single task "rq->nr_running == 1" and the comparison between imbalance, wl is to make sure that we select the correct priority thread which matches imbalance. So we really need to compare the imabalnce with the original weighted load of the cpu and not the scaled load. But in other conditions where we want the most hammered(busiest) cpu, we can use scaled load to ensure that we consider the cpu power in addition to the actual load on that cpu, so that we can move the load away from the guy that is getting most hammered with respect to the actual capacity, as compared with the rest of the cpu's in that busiest group. Fix it. Reported-by: Ma Ling Initial-Analysis-by: Zhang, Yanmin Signed-off-by: Suresh Siddha Signed-off-by: Peter Zijlstra LKML-Reference: <1266023662.2808.118.camel@sbs-t61.sc.intel.com> Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit 39226dabf8fe6cbd07ce5c5155f43c25b48abbd1 Author: Vaidyanathan Srinivasan Date: Mon Feb 8 15:35:55 2010 +0530 sched: Fix sched_mv_power_savings for !SMT commit 28f5318167adf23b16c844b9c2253f355cb21796 upstream. Fix for sched_mc_powersavigs for pre-Nehalem platforms. Child sched domain should clear SD_PREFER_SIBLING if parent will have SD_POWERSAVINGS_BALANCE because they are contradicting. Sets the flags correctly based on sched_mc_power_savings. Signed-off-by: Vaidyanathan Srinivasan Signed-off-by: Peter Zijlstra LKML-Reference: <20100208100555.GD2931@dirshya.in.ibm.com> Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit 065bc5cd9917ac5ae2c26c4ac9adecdae437a17a Author: Gleb Natapov Date: Wed Feb 10 14:21:35 2010 +0200 KVM: x86 emulator: Check CPL level during privilege instruction emulation commit e92805ac1228626c59c865f2f4e9059b9fb8c97b upstream. Add CPL checking in case emulator is tricked into emulating privilege instruction from userspace. Signed-off-by: Gleb Natapov Signed-off-by: Avi Kivity Signed-off-by: Greg Kroah-Hartman commit 5832b65a5cbed395d469f77859d9a26e7265254d Author: Gleb Natapov Date: Wed Feb 10 14:21:30 2010 +0200 KVM: x86 emulator: Add group9 instruction decoding commit 60a29d4ea4e7b6b95d9391ebc8625b0426f3a363 upstream. Use groups mechanism to decode 0F C7 instructions. Signed-off-by: Gleb Natapov Signed-off-by: Avi Kivity Signed-off-by: Greg Kroah-Hartman commit 8bc4cf28e87f4269773061bac06087c5efe1cc8b Author: Gleb Natapov Date: Thu Feb 18 12:14:59 2010 +0200 KVM: x86 emulator: Forbid modifying CS segment register by mov instruction commit 8b9f44140bc4afd2698413cd9960c3912168ee91 upstream. Inject #UD if guest attempts to do so. This is in accordance to Intel SDM. Signed-off-by: Gleb Natapov Signed-off-by: Avi Kivity Signed-off-by: Greg Kroah-Hartman commit 1c731613a9923eed0405f1abbc689e0a16add65a Author: Gleb Natapov Date: Wed Feb 10 14:21:29 2010 +0200 KVM: x86 emulator: Add group8 instruction decoding commit 2db2c2eb6226e30f8059b82512a1364db98da8e3 upstream. Use groups mechanism to decode 0F BA instructions. Signed-off-by: Gleb Natapov Signed-off-by: Avi Kivity Signed-off-by: Greg Kroah-Hartman commit 36725f4d9636cea24ce6ea463b1ba50a03315236 Author: Sheng Yang Date: Tue Dec 15 13:29:54 2009 +0800 KVM: VMX: Trap and invalid MWAIT/MONITOR instruction commit 59708670b639bff00f92e519df1ae14da240e919 upstream. We don't support these instructions, but guest can execute them even if the feature('monitor') haven't been exposed in CPUID. So we would trap and inject a #UD if guest try this way. Signed-off-by: Sheng Yang Signed-off-by: Avi Kivity Signed-off-by: Greg Kroah-Hartman commit 6c46bff05fb1889ff5581dcd7274db69fd4a4da3 Author: Mike Snitzer Date: Sat Mar 6 02:32:24 2010 +0000 dm ioctl: only issue uevent on resume if state changed commit 0f3649a9e305ea22eb196a84a2d7520afcaa6060 upstream. Only issue a uevent on a resume if the state of the device changed, i.e. if it was suspended and/or its table was replaced. Signed-off-by: Dave Wysochanski Signed-off-by: Mike Snitzer Signed-off-by: Alasdair G Kergon Signed-off-by: Greg Kroah-Hartman commit f64089821be953b9b5b5ff49172780c929786614 Author: Mikulas Patocka Date: Sat Mar 6 02:32:29 2010 +0000 dm: free dm_io before bio_endio not after commit a97f925a32aad2a37971d7bfb657006acf04e42d upstream. Free the dm_io structure before calling bio_endio() instead of after it, to ensure that the io_pool containing it is not referenced after it is freed. This partially fixes a problem described here https://www.redhat.com/archives/dm-devel/2010-February/msg00109.html thread 1: bio_endio(bio, io_error); /* scheduling happens */ thread 2: close the device remove the device thread 1: free_io(md, io); Thread 2, when removing the device, sees non-empty md->io_pool (because the io hasn't been freed by thread 1 yet) and may crash with BUG in mempool_free. Thread 1 may also crash, when freeing into a nonexisting mempool. To fix this we must make sure that bio_endio() is the last call and the md structure is not accessed afterwards. There is another bio_endio in process_barrier, but it is called from the thread and the thread is destroyed prior to freeing the mempools, so this call is not affected by the bug. A similar bug exists with module unloads - the module may be unloaded immediately after bio_endio - but that is more difficult to fix. Signed-off-by: Mikulas Patocka Signed-off-by: Alasdair G Kergon Signed-off-by: Greg Kroah-Hartman commit 53165f58afaf5045a52057f32b5b8dd67e90fe1c Author: Trond Myklebust Date: Tue Mar 2 13:06:22 2010 -0500 NFS: Fix an allocation-under-spinlock bug commit ebed9203b68a4f333ce5d17e874b26c3afcfeff1 upstream. sunrpc_cache_update() will always call detail->update() from inside the detail->hash_lock, so it cannot allocate memory. Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 1f2ba616b4a048ce7c4151fad1dbb92a8c93ac38 Author: James Hogan Date: Fri Mar 5 13:44:31 2010 -0800 rtc-coh901331: fix braces in resume code commit 5a98c04d78c896d52baef20ffc11f6d1ba6eb786 upstream. The else part of the if statement is indented but does not have braces around it. It clearly should since it uses clk_enable and clk_disable which are supposed to balance. Signed-off-by: James Hogan Acked-by: Linus Walleij Acked-by: Alessandro Zummo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit c54f376268f49f0fceebe06c7079b75da3ed0e74 Author: Joe Perches Date: Fri Mar 5 13:43:07 2010 -0800 scripts/get_maintainer.pl: fix possible infinite loop commit 3c840c18bcd8efb37f1a565e83a9509e1ea5d105 upstream. If MAINTAINERS section entries are misformatted, it was possible to have an infinite loop. Correct the defect by always moving the index to the end of section + 1 Also, exit check for exclude as soon as possible. Signed-off-by: Joe Perches Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit a8fe08331a02dda324267364d3f7cafb94ae60ff Author: Lars-Peter Clausen Date: Fri Mar 5 13:43:35 2010 -0800 s3cmci: initialize default platform data no_wprotect and no_detect with 1 commit c212808a1ba6bfba489006399b8152a047305acf upstream. If no platform_data was givin to the device it's going to use it's default platform data struct which has all fields initialized to zero. As a result the driver is going to try to request gpio0 both as write protect and card detect pin. Which of course will fail and makes the driver unusable Previously to the introduction of no_wprotect and no_detect the behavior was to assume that if no platform data was given there is no write protect or card detect pin. This patch restores that behavior. Signed-off-by: Lars-Peter Clausen Cc: Ben Dooks Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit b4705ec3af69e0ba1bbde3dd412261941c3e78d5 Author: Lars-Peter Clausen Date: Fri Mar 5 13:43:37 2010 -0800 s3cmci: s3cmci_card_present: Use no_detect to decide whether there is a card detect pin commit dc2ed552804f3a2ae41c0ffe4bc09879ec8f7396 upstream. Signed-off-by: Lars-Peter Clausen Cc: Ben Dooks Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit daaeb8a8219068bdb6dc597fc4dfe8fcab9dbc4c Author: Trond Myklebust Date: Tue Mar 2 13:06:21 2010 -0500 SUNRPC: Handle EINVAL error returns from the TCP connect operation commit 9fcfe0c83c3b04a759cde6b8c5f961237f17808b upstream. This can, for instance, happen if the user specifies a link local IPv6 address. Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit f774f57a79ba1515eda139023cdc00b7209ab96b Author: Neil Brown Date: Sat Feb 27 09:33:40 2010 +1100 sunrpc: remove unnecessary svc_xprt_put commit ab1b18f70a007ea6caeb007d269abb75b131a410 upstream. The 'struct svc_deferred_req's on the xpt_deferred queue do not own a reference to the owning xprt. This is seen in svc_revisit which is where things are added to this queue. dr->xprt is set to NULL and the reference to the xprt it put. So when this list is cleaned up in svc_delete_xprt, we mustn't put the reference. Also, replace the 'for' with a 'while' which is arguably simpler and more likely to compile efficiently. Cc: Tom Tucker Signed-off-by: NeilBrown Signed-off-by: J. Bruce Fields Signed-off-by: Greg Kroah-Hartman commit 293ad927682715d8f2bbe8350821b2b0d244f7eb Author: Alex Deucher Date: Tue Feb 23 21:56:12 2010 -0500 drm/radeon/kms/atom: fix shr/shl ops commit 6a8a2d702b33c6ed5c789f21b4e89fdf221f01ca upstream. The whole attribute table is valid for shr/shl ops. Fixes fdo bug 26668 Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 07406de2b68f84d1ad4ed698852ccada1c21542a Author: Maarten Maathuis Date: Sat Feb 20 03:22:21 2010 +0100 drm/ttm: handle OOM in ttm_tt_swapout commit 290e55056ec3d25c72088628245d8cae037b30db upstream. - Without this change I get a general protection fault. - Also use PTR_ERR where applicable. Signed-off-by: Maarten Maathuis Reviewed-by: Dave Airlie Acked-by: Thomas Hellstrom Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 190ef1c7ed073b4420fb58c03619a024c21ad39a Author: Zhao Yakui Date: Mon Feb 8 21:35:12 2010 +0800 drm/i915: Use a dmi quirk to skip a broken SDVO TV output. commit 6070a4a928f8c92b9fae7d6717ebbb05f425d6b2 upstream. This IBM system has a multi-function SDVO card that reports both VGA and TV, but the system has no TV connector. The TV connector always reported as connected, which would lead to poor modesetting choices. https://bugs.freedesktop.org/show_bug.cgi?id=25787 Signed-off-by: Zhao Yakui Tested-by: Vance Signed-off-by: Eric Anholt Signed-off-by: Greg Kroah-Hartman commit 011ee01431348cd201ea2c01c6f12a218bca60e2 Author: Jan Dumon Date: Tue Jan 5 15:53:26 2010 +0100 USB: unusual_devs: Add support for multiple Option 3G sticks commit 46216e4fbe8c62059b5440dec0b236f386248a41 upstream. Enable the SD-Card interface on multiple Option 3G sticks. The unusual_devs.h entry is necessary because the device descriptor is vendor-specific. That prevents usb-storage from binding to it as an interface driver. Signed-off-by: Jan Dumon Signed-off-by: Phil Dibowitz Signed-off-by: Greg Kroah-Hartman commit 40d6d89c483cf70a187050878318a5fe4a0fef82 Author: Alan Cox Date: Mon Feb 8 10:10:44 2010 +0000 USB: cp210x: Add 81E8 (Zephyr Bioharness) commit bd07c551aae5d2200c7b195142e5ba63f26424da upstream. As reported in http://bugzilla.kernel.org/show_bug.cgi?id=10980 Signed-off-by: Alan Cox Signed-off-by: Greg Kroah-Hartman commit 6d73d95b3a0e3af7f962ca8e6925c49873d792fa Author: Daniel Sangorrin Date: Mon Feb 22 11:03:11 2010 +0900 USB: serial: ftdi: add CONTEC vendor and product id commit 46b72d78cb022714c89a9ebc00b9581b550cfca7 upstream. This is a patch to ftdi_sio_ids.h and ftdi_sio.c that adds identifiers for CONTEC USB serial converter. I tested it with the device COM-1(USB)H Signed-off-by: Daniel Sangorrin Cc: Andreas Mohr Signed-off-by: Greg Kroah-Hartman commit 8abdcf11e07333d3a0d37c6b77c7574d8dbb8dca Author: Mitchell Solomon Date: Fri Feb 12 13:23:18 2010 -0500 USB: add new ftdi_sio device ids commit 9714080d20f2ec4b671a06ce69367d91fa9e227e upstream. PID patch for my products Signed-off-by: Mitchell Solomon Signed-off-by: Greg Kroah-Hartman commit e6a9c52471f3be745d05a78d3bed3b09d410f9c6 Author: Peter Korsgaard Date: Thu Feb 4 17:15:25 2010 +0100 USB: f_mass_storage: fix crash on bind() error commit 8e7e61dfbf1ec6418bf89505980b158a8d00d877 upstream. init_completion() hasn't been called yet and the thread isn't created if we end up here, so don't call complete() on thread_notifier. Signed-off-by: Peter Korsgaard Acked-by: Michal Nazarewicz Signed-off-by: Greg Kroah-Hartman commit be3da032d675cee5156260354182fee760834898 Author: Herbert Xu Date: Sun Jan 10 20:15:03 2010 +1100 USB: Move hcd free_dev call into usb_disconnect to fix oops commit f7410ced7f931bb1ad79d1336412cf7b7a33cb14 upstream. USB: Move hcd free_dev call into usb_disconnect I found a way to oops the kernel: 1. Open a USB device through devio. 2. Remove the hcd module in the host kernel. 3. Close the devio file descriptor. The problem is that closing the file descriptor does usb_release_dev as it is the last reference. usb_release_dev then tries to invoke the hcd free_dev function (or rather dereferencing the hcd driver struct). This causes an oops as the hcd driver has already been unloaded so the struct is gone. This patch tries to fix this by bringing the free_dev call earlier and into usb_disconnect. I have verified that repeating the above steps no longer crashes with this patch applied. Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman commit a5061d0d9c23a6952b7138fa35d0d43523ff22d2 Author: Alan Stern Date: Mon Feb 8 09:45:12 2010 -0500 USB: remove debugging message for uevent constructions commit cceffe9348f93188d7811bda95924d4bd3040d0f upstream. This patch (as1332) removes an unneeded and annoying debugging message announcing all USB uevent constructions. Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit 10f0b81c5532a0d46a8ed992c1f6d01e5de976da Author: Pete Zaitcev Date: Fri Jan 8 15:39:22 2010 -0700 USB: fix crash in uhci_scan_schedule commit d23356da714595b888686d22cd19061323c09190 upstream. When hardware is removed on a Stratus, the system may crash like this: ACPI: PCI interrupt for device 0000:7c:00.1 disabled Trying to free nonexistent resource <00000000a8000000-00000000afffffff> Trying to free nonexistent resource <00000000a4800000-00000000a480ffff> uhci_hcd 0000:7e:1d.0: remove, state 1 usb usb2: USB disconnect, address 1 usb 2-1: USB disconnect, address 2 Unable to handle kernel paging request at 0000000000100100 RIP: [] :uhci_hcd:uhci_scan_schedule+0xa2/0x89c #4 [ffff81011de17e50] uhci_scan_schedule at ffffffff88021918 #5 [ffff81011de17ed0] uhci_irq at ffffffff88023cb8 #6 [ffff81011de17f10] usb_hcd_irq at ffffffff801f1c1f #7 [ffff81011de17f20] handle_IRQ_event at ffffffff8001123b #8 [ffff81011de17f50] __do_IRQ at ffffffff800ba749 This occurs because an interrupt scans uhci->skelqh, which is being freed. We do the right thing: disable the interrupts in the device, and do not do any processing if the interrupt is shared with other source, but it's possible that another CPU gets delayed somewhere (e.g. loops) until we started freeing. The agreed-upon solution is to wait for interrupts to play out before proceeding. No other bareers are neceesary. A backport of this patch was tested on a 2.6.18 based kernel. Testing of 2.6.32-based kernels is under way, but it takes us forever (months) to turn this around. So I think it's a good patch and we should keep it. Tracked in RH bz#516851 Signed-Off-By: Pete Zaitcev Signed-off-by: Greg Kroah-Hartman commit c90b7955e40e961606d740d2a062ce6448bd7113 Author: Alan Stern Date: Thu Feb 25 13:19:37 2010 -0500 USB: fix the idProduct value for USB-3.0 root hubs commit cd780694920fbf869b23c8afb0bd083e7b0448c7 upstream. This patch (as1346) changes the idProduct value for USB-3.0 root hubs from 0x0002 (which we already use for USB-2.0 root hubs) to 0x0003. Signed-off-by: Alan Stern Acked-by: Sarah Sharp Signed-off-by: Greg Kroah-Hartman commit 66d23bc2605a8ada7746c75adc798e6e6ac4fe74 Author: Edward Shao Date: Thu Feb 11 03:37:30 2010 +0800 USB: xhci: Fix finding extended capabilities registers commit 05197921ff3dad52d99fd1647974c57d9c28d40e upstream. According "5.3.6 Capability Parameters (HCCPARAMS)" of xHCI rev0.96 spec, value of xECP register indicates a relative offset, in 32-bit words, from Base to the beginning of the first extended capability. The wrong calculation will cause BIOS handoff fail (not handoff from BIOS) in some platform with BIOS USB legacy sup support. Signed-off-by: Edward Shao Cc: Sarah Sharp Signed-off-by: Greg Kroah-Hartman commit 33fec1cfc33abcf1d10579dbf01139bd4556b42e Author: Yinghai Lu Date: Wed Feb 10 01:20:05 2010 -0800 x86: Fix SCI on IOAPIC != 0 commit 18dce6ba5c8c6bd0f3ab4efa4cbdd698dab5c40a upstream. Thomas Renninger reported on IBM x3330 booting a latest kernel on this machine results in: PCI: PCI BIOS revision 2.10 entry at 0xfd61c, last bus=1 PCI: Using configuration type 1 for base access bio: create slab at 0 ACPI: SCI (IRQ30) allocation failed ACPI Exception: AE_NOT_ACQUIRED, Unable to install System Control Interrupt handler (20090903/evevent-161) ACPI: Unable to start the ACPI Interpreter Later all kind of devices fail... and bisect it down to this commit: commit b9c61b70075c87a8612624736faf4a2de5b1ed30 x86/pci: update pirq_enable_irq() to setup io apic routing it turns out we need to set irq routing for the sci on ioapic1 early. -v2: make it work without sparseirq too. -v3: fix checkpatch.pl warning, and cc to stable Reported-by: Thomas Renninger Bisected-by: Thomas Renninger Tested-by: Thomas Renninger Signed-off-by: Yinghai Lu LKML-Reference: <1265793639-15071-2-git-send-email-yinghai@kernel.org> Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit 3f3880ca4a2fdfcfe6b69ce0b79e0b2a964a6147 Author: Brandon Phiilps Date: Wed Feb 10 01:20:06 2010 -0800 x86: Avoid race condition in pci_enable_msix() commit ced5b697a76d325e7a7ac7d382dbbb632c765093 upstream. Keep chip_data in create_irq_nr and destroy_irq. When two drivers are setting up MSI-X at the same time via pci_enable_msix() there is a race. See this dmesg excerpt: [ 85.170610] ixgbe 0000:02:00.1: irq 97 for MSI/MSI-X [ 85.170611] alloc irq_desc for 99 on node -1 [ 85.170613] igb 0000:08:00.1: irq 98 for MSI/MSI-X [ 85.170614] alloc kstat_irqs on node -1 [ 85.170616] alloc irq_2_iommu on node -1 [ 85.170617] alloc irq_desc for 100 on node -1 [ 85.170619] alloc kstat_irqs on node -1 [ 85.170621] alloc irq_2_iommu on node -1 [ 85.170625] ixgbe 0000:02:00.1: irq 99 for MSI/MSI-X [ 85.170626] alloc irq_desc for 101 on node -1 [ 85.170628] igb 0000:08:00.1: irq 100 for MSI/MSI-X [ 85.170630] alloc kstat_irqs on node -1 [ 85.170631] alloc irq_2_iommu on node -1 [ 85.170635] alloc irq_desc for 102 on node -1 [ 85.170636] alloc kstat_irqs on node -1 [ 85.170639] alloc irq_2_iommu on node -1 [ 85.170646] BUG: unable to handle kernel NULL pointer dereference at 0000000000000088 As you can see igb and ixgbe are both alternating on create_irq_nr() via pci_enable_msix() in their probe function. ixgbe: While looping through irq_desc_ptrs[] via create_irq_nr() ixgbe choses irq_desc_ptrs[102] and exits the loop, drops vector_lock and calls dynamic_irq_init. Then it sets irq_desc_ptrs[102]->chip_data = NULL via dynamic_irq_init(). igb: Grabs the vector_lock now and starts looping over irq_desc_ptrs[] via create_irq_nr(). It gets to irq_desc_ptrs[102] and does this: cfg_new = irq_desc_ptrs[102]->chip_data; if (cfg_new->vector != 0) continue; This hits the NULL deref. Another possible race exists via pci_disable_msix() in a driver or in the number of error paths that call free_msi_irqs(): destroy_irq() dynamic_irq_cleanup() which sets desc->chip_data = NULL ...race window... desc->chip_data = cfg; Remove the save and restore code for cfg in create_irq_nr() and destroy_irq() and take the desc->lock when checking the irq_cfg. Reported-and-analyzed-by: Brandon Philips Signed-off-by: Yinghai Lu LKML-Reference: <1265793639-15071-3-git-send-email-yinghai@kernel.org> Signed-off-by: Brandon Phililps Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit b8cfe68deb636a652d17d2de8e4a61f19a906289 Author: Ian Campbell Date: Fri Feb 26 17:16:00 2010 +0000 x86, xen: Disable highmem PTE allocation even when CONFIG_HIGHPTE=y commit 817a824b75b1475f1b067c8cee318c7b4d66fcde upstream. There's a path in the pagefault code where the kernel deliberately breaks its own locking rules by kmapping a high pte page without holding the pagetable lock (in at least page_check_address). This breaks Xen's ability to track the pinned/unpinned state of the page. There does not appear to be a viable workaround for this behaviour so simply disable HIGHPTE for all Xen guests. Signed-off-by: Ian Campbell LKML-Reference: <1267204562-11844-1-git-send-email-ian.campbell@citrix.com> Cc: Jeremy Fitzhardinge Cc: Ingo Molnar Cc: Pasi Kärkkäinen Cc: Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit 3ed5b5c623ef901be4f7e6c7e1a0d576f0e30af4 Author: Justin P. Mattock Date: Tue Feb 16 15:17:29 2010 -0800 x86: Add iMac9,1 to pci_reboot_dmi_table commit 0a832320f1bae6a4169bf683e201378f2437cfc1 upstream. On the iMac9,1 /sbin/reboot results in a black mangled screen. Adding this DMI entry gets the machine to reboot cleanly as it should. Signed-off-by: Justin P. Mattock LKML-Reference: <1266362249-3337-1-git-send-email-justinmattock@gmail.com> Signed-off-by: H. Peter Anvin Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 49370462cbfb264bba46d32a8dc6aabb8a8b2bdd Author: Jiri Slaby Date: Wed Feb 10 20:55:16 2010 +0100 x86, ia32_aout: do not kill argument mapping commit 318f6b228ba88a394ef560efc1bfe028ad5ae6b6 upstream. Do not set current->mm->mmap to NULL in 32-bit emulation on 64-bit load_aout_binary after flush_old_exec as it would destroy already set brpm mapping with arguments. Introduced by b6a2fea39318e43fee84fa7b0b90d68bed92d2ba mm: variable length argument support where the argument mapping in bprm was added. [ hpa: this is a regression from 2.6.22... time to kill a.out? ] Signed-off-by: Jiri Slaby LKML-Reference: <1265831716-7668-1-git-send-email-jslaby@suse.cz> Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Ollie Wild Cc: x86@kernel.org Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit 830ae40a16b41f081b0c9e317fd03889ea136327 Author: Tao Ma Date: Fri Feb 26 10:54:52 2010 +0800 ocfs2: Only bug out in direct io write for reflinked extent. commit cbaee472f274ea9a98aabe47025f6e5551acadcb upstream. In ocfs2_direct_IO_get_blocks, we only need to bug out in case of we are going to write a recounted extent rec. What a silly bug introduced by me! Signed-off-by: Tao Ma Signed-off-by: Joel Becker Signed-off-by: Greg Kroah-Hartman commit c9438d3d949d4c5f88f630b647011b8381c63ae5 Author: Henrique de Moraes Holschuh Date: Thu Feb 25 22:22:22 2010 -0300 thinkpad-acpi: lock down video output state access commit b525c06cdbd8a3963f0173ccd23f9147d4c384b5 upstream. Given the right combination of ThinkPad and X.org, just reading the video output control state is enough to hard-crash X.org. Until the day I somehow find out a model or BIOS cut date to not provide this feature to ThinkPads that can do video switching through X RandR, change permissions so that only processes with CAP_SYS_ADMIN can access any sort of video output control state. This bug could be considered a local DoS I suppose, as it allows any non-privledged local user to cause some versions of X.org to hard-crash some ThinkPads. Reported-by: Jidanni Signed-off-by: Henrique de Moraes Holschuh Signed-off-by: Greg Kroah-Hartman commit 6f4698f6c3846c4ddccaacee85aec17599dabcff Author: Henrique de Moraes Holschuh Date: Thu Feb 25 22:22:07 2010 -0300 thinkpad-acpi: fix bluetooth/wwan resume commit 08fedfc903c78e380b0baa7b57c52d367794d0a5 upstream. Studying the DSDTs of various thinkpads, it looks like bit 3 of the argument to SBDC and SWAN is not "set radio to last state on resume". Rather, it seems to be "if this bit is set, enable radio on resume, otherwise disable it on resume". So, the proper way to prepare the radios for S3 suspend is: disable radio and clear bit 3 on the SBDC/SWAN call to to resume with radio disabled, and enable radio and set bit 3 on the SBDC/SWAN call to resume with the radio enabled. Also, for persistent devices, the rfkill core does not restore state, so we really need to get the firmware to do the right thing. We don't sync the radio state on suspend, instead we trust the BIOS to not do anything weird if we never touched the radio state since boot. Time will tell if that's a wise way of doing things... Signed-off-by: Henrique de Moraes Holschuh Signed-off-by: Greg Kroah-Hartman commit 6a79a0708eecc65ade97a09ec4c11488374e1bbc Author: Henrique de Moraes Holschuh Date: Thu Feb 25 21:29:00 2010 -0300 thinkpad-acpi: make driver events work in NVRAM poll mode commit 7f0cf712a74fcc3ad21f0bde95bd32c2f2cc3888 upstream. Thadeu Lima de Souza Cascardo reports this: Brightness notification does not work until the user writes to hotkey_mask attribute. That's because the polling thread will only run if hotkey_user_mask is set and someone is reading the input device or if hotkey_driver_mask is set. In this second case, this condition is not tested after the mask is changed, because the brightness and volume drivers are started after the hotkey drivers. Fix tpacpi_hotkey_driver_mask_set() to call hotkey_poll_setup(), so that the poller kthread will be started when needed. Reported-by: Thadeu Lima de Souza Cascardo Tested-by: Thadeu Lima de Souza Cascardo Signed-off-by: Henrique de Moraes Holschuh Cc: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit ba0b9eadb8d5cb3679359c1064fa22de1bec393a Author: Henrique de Moraes Holschuh Date: Thu Feb 25 21:28:56 2010 -0300 thinkpad-acpi: document HKEY event 3006 commit bf8b29c8f7f8269e99eca8b19048ed5b34b51810 upstream. Event 0x3006 is used to help power management of the ODD in the UltraBay. The EC generates this event when the ODD eject button is pressed (even if the bay is powered down). Normally, Linux doesn't need this as we keep the SATA link powered up (which wastes power). The EC powers up the bay by itself when the ODD eject button is pressed, and the SATA PHY reports the hotplug. However, we could also power that SATA link down (and for that matter, also power down the Ultrabay) if the ODD is left idle for a while with no disk inside, and use event 0x3006 to know when we need that SATA link powered back up. For now, just stop asking for more information when event 0x3006 is seen, there is no point in pestering users about it anymore. Signed-off-by: Henrique de Moraes Holschuh Signed-off-by: Greg Kroah-Hartman commit 119725c3b36b64a668776dbb33e08ed90b6ed993 Author: Henrique de Moraes Holschuh Date: Thu Feb 25 21:28:56 2010 -0300 thinkpad-acpi: R52 brightness_mode has been confirmed commit 7d1894d8d1c411d2dad95abfe0f65bacf68c4afa upstream. We can stop pestering users for confirmation of the brightness_mode default for firmware TP-76. While at it, add a few missing comments in that quirk table. Reported-by: Whoopie Signed-off-by: Henrique de Moraes Holschuh Signed-off-by: Greg Kroah-Hartman commit 17cab421d82a9be3afcd59d1385eb74bbd58b432 Author: Henrique de Moraes Holschuh Date: Thu Feb 25 21:28:58 2010 -0300 thinkpad-acpi: fix poll thread auto-start commit b589ea4c44170d3f7a845684e2d1b3b9571663af upstream. The driver was not starting the NVRAM polling thread if the input device was bound immediately after registration. This fixes: http://bugzilla.kernel.org/show_bug.cgi?id=15118 Reported-by: Florian Zumbiehl Signed-off-by: Henrique de Moraes Holschuh Signed-off-by: Greg Kroah-Hartman commit 3362453cc98979c3552a1570574505fdb06e99e3 Author: Alan Jenkins Date: Sat Feb 20 11:02:24 2010 +0000 eeepc-laptop: disable wireless hotplug for 1005PE commit ced69c59811f05b2f8378467cbb82ac6ed3c6a5a upstream. The wireless hotplug code is not needed on this model, and it disables the wired ethernet card. (Like on the 1005HA and 1201N). References: Signed-off-by: Alan Jenkins Reported-by: Ansgar Burchardt Signed-off-by: Greg Kroah-Hartman commit 237ee1fee55bde35a68e0e0585a01ccd65345514 Author: Felix Fietkau Date: Fri Jan 8 18:15:13 2010 +0100 mac80211: do not transmit frames on unconfigured 4-addr vlan interfaces commit 3f0e0b220f80075ce15483b20458192c0ac27426 upstream. If frames are transmitted on 4-addr ap vlan interfaces with no station, they end up being transmitted unencrypted, even if the ap interface uses WPA. This patch add some sanity checking to make sure that this does not happen. Signed-off-by: Felix Fietkau Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit b3d55121295829160c0271c4bc3eaba894390984 Author: Ben Hutchings Date: Fri Feb 26 04:37:09 2010 -0800 sunxvr500: Additional PCI id for sunxvr500 driver commit 275143e9b237dd7e0b6d01660fd9b8acd9922fa7 upstream. Intergraph bought 3D Labs and some XVR-500 chips have Intergraph's vendor id. Reported-by: Jurij Smakov Signed-off-by: Ben Hutchings Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit b4f71387a3cd3511b25613b91a415b46580448f9 Author: Tim Gardner Date: Tue Feb 23 14:59:12 2010 +0100 netfilter: xt_recent: fix false match commit 8ccb92ad41cb311e52ad1b1fe77992c7f47a3b63 upstream. A rule with a zero hit_count will always match. Signed-off-by: Tim Gardner Signed-off-by: Patrick McHardy Signed-off-by: Greg Kroah-Hartman commit 437ccbe9b5cb9c2df272c6ff7a55ef494c2d0d67 Author: Tim Gardner Date: Tue Feb 23 14:55:21 2010 +0100 netfilter: xt_recent: fix buffer overflow commit 2c08522e5d2f0af2d6f05be558946dcbf8173683 upstream. e->index overflows e->stamps[] every ip_pkt_list_tot packets. Consider the case when ip_pkt_list_tot==1; the first packet received is stored in e->stamps[0] and e->index is initialized to 1. The next received packet timestamp is then stored at e->stamps[1] in recent_entry_update(), a buffer overflow because the maximum e->stamps[] index is 0. Signed-off-by: Tim Gardner Signed-off-by: Patrick McHardy Signed-off-by: Greg Kroah-Hartman commit 70702844e7be631ea810e752c2f089792b3364bc Author: Larry Finger Date: Wed Feb 3 13:33:44 2010 -0600 b43/b43legacy: Wake queues in wireless_core_start commit 0866b03c7d7dee8a34ffa527ecda426c0f405518 upstream. If b43 or b43legacy are deauthenticated or disconnected, there is a possibility that a reconnection is tried with the queues stopped in mac80211. To prevent this, start the queues before setting STAT_INITIALIZED. In b43, a similar change has been in place (twice) in the wireless_core_init() routine. Remove the duplicate and add similar code to b43legacy. Signed-off-by: Larry Finger Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 5c61625f566640743886f324e1fda0eef5b04e1d Author: Bob Copeland Date: Tue Feb 9 13:06:54 2010 -0500 ath5k: use correct packet type when transmitting commit 2ac2927a953a01c83df255118922cce1523d1a18 upstream. The hardware needs to know what type of frames are being sent in order to fill in various fields, for example the timestamp in probe responses (before this patch, it was always 0). Set it correctly when initializing the TX descriptor. Signed-off-by: Bob Copeland Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 85e846977ababcddc37cbe51f38e5ec9a6b21964 Author: Felix Fietkau Date: Wed Feb 24 04:43:05 2010 +0100 ath9k: disable RIFS search for AR91xx based chips commit 7bfbae10dc10a5c94a780d117a57e875d77e8e5a upstream. While ath9k does not support RIFS yet, the ability to receive RIFS frames is currently enabled for most chipsets in the initvals. This is causing baseband related issues on AR9160 and AR9130 based chipsets, which can lock up under certain conditions. This patch fixes these issues by overriding the initvals, effectively disabling RIFS for all affected chipsets. Signed-off-by: Felix Fietkau Acked-by: Luis R. Rodriguez Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit c1ea4dcc2abb87adb1d01f2c59b2aa3fe3c6739b Author: Felix Fietkau Date: Fri Feb 19 01:46:36 2010 +0100 ath9k: fix rate control fallback rate selection commit 5c0ba62fd4b2dce08055a89600f1d834f9f0fe9e upstream. When selecting the tx fallback rate, rc.c used a separate variable 'nrix' for storing the next rate index, however it did not use that as reference for further rate index lowering. Because of that, it ended up reusing the same rate for multiple multi-rate retry stages, thus decreasing delivery probability under changing link conditions. This patch removes the separate (unnecessary) variable and fixes fallback the way it was intended to work. This should result in increased throughput and better link stability. Signed-off-by: Felix Fietkau Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 3203358238f16e5ff8caa1ee10d5f23ec53547f3 Author: Felix Fietkau Date: Fri Feb 19 18:21:42 2010 +0100 ath9k: fix beacon timer restart after a card reset commit d8728ee919282c7b01b65cd479ec1e2a9c5d3ba8 upstream. In AP mode, ath_beacon_config_ap only restarts the timer if a TSF restart is requested. Apparently this was added, because this function unconditionally sets the flag for TSF reset. The problem with this is, that ath9k_hw_reset() clobbers the timer registers (specified in the initvals), thus effectively disabling the SWBA interrupt whenever a card reset without TSF reset is issued (happens in a few places in the code). This patch fixes ath_beacon_config_ap to only issue the TSF reset flag when necessary, but reinitialize the timer unconditionally. Tests show, that this is enough to keep the SWBA interrupt going after a call to ath_reset() Signed-off-by: Felix Fietkau Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 82d8cfa27fbce6dd1d3fd39cb808410337e143eb Author: Luis R. Rodriguez Date: Fri Dec 18 11:26:04 2009 -0500 ath9k: re-enable ps by default for new single chip families commit 14acdde6e527950f66c084dbf19bad6fbfcaeedc upstream. The newer single chip hardware family of chipsets have not been experiencing issues with power saving set by default with recent fixes merged (even into stable). The remaining issues are only reported with AR5416 and since enabling PS by default can increase power savings considerably best to take advantage of that feature as this has been tested properly. For more details on this issue see the bug report: http://bugzilla.kernel.org/show_bug.cgi?id=14267 We leave AR5416 with PS disabled by default, that seems to require some more work. Cc: Peter Stuge Cc: Justin P. Mattock Cc: Kristoffer Ericson Signed-off-by: Luis R. Rodriguez Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit f50debe647a919581ecb6667010124e1cc52a685 Author: John W. Linville Date: Thu Feb 25 12:02:45 2010 -0500 netdevice.h: check for CONFIG_WLAN instead of CONFIG_WLAN_80211 commit caf66e581172dc5032bb84841a91bc7b77ad9876 upstream. In "wireless: remove WLAN_80211 and WLAN_PRE80211 from Kconfig" I inadvertantly missed a line in include/linux/netdevice.h. I thereby effectively reverted "net: Set LL_MAX_HEADER properly for wireless." by accident. :-( Now we should check there for CONFIG_WLAN instead. Signed-off-by: John W. Linville Reported-by: Christoph Egger Signed-off-by: Greg Kroah-Hartman commit 7992f7313286abb36c49b65ad90a8b0c824e3a66 Author: Felix Fietkau Date: Tue Feb 23 11:45:51 2010 +0000 skbuff: align sk_buff::cb to 64 bit and close some potential holes commit da3f5cf1f8ebb0fab5c5fd09adb189166594ad6c upstream. The alignment requirement for 64-bit load/store instructions on ARM is implementation defined. Some CPUs (such as Marvell Feroceon) do not generate an exception, if such an instruction is executed with an address that is not 64 bit aligned. In such a case, the Feroceon corrupts adjacent memory, which showed up in my tests as a crash in the rx path of ath9k that only occured with CONFIG_XFRM set. This crash happened, because the first field of the mac80211 rx status info in the cb is an u64, and changing it corrupted the skb->sp field. This patch also closes some potential pre-existing holes in the sk_buff struct surrounding the cb[] area. Signed-off-by: Felix Fietkau Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 709a1e560b23235706a504323aafc9f1a9a05eb6 Author: Eric W. Biederman Date: Sun Feb 28 01:20:36 2010 +0000 scm: Only support SCM_RIGHTS on unix domain sockets. commit 76dadd76c265a0cdb5a76aa4eef03fcc9639b388 upstream. We use scm_send and scm_recv on both unix domain and netlink sockets, but only unix domain sockets support everything required for file descriptor passing, so error if someone attempts to pass file descriptors over netlink sockets. Signed-off-by: Eric W. Biederman Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 5535b536b293a3142a1d6a9b460d2a1c54dffd82 Author: Sergei Shtylyov Date: Mon Dec 7 23:25:52 2009 +0400 pata_hpt3x2n: always stretch UltraDMA timing commit 60661933995bc7a09686c901439e17c2a4ea7d5d upstream. The UltraDMA Tss timing must be stretched with ATA clock of 66 MHz, but the driver only does this when PCI clock is 66 MHz, whereas it always programs DPLL clock (which is used as the ATA clock) to 66 MHz. Signed-off-by: Sergei Shtylyov Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit a5489ec13965fc30adbf309a066242e25be4424a Author: Jean Delvare Date: Fri Mar 5 22:17:26 2010 +0100 hwmon: Fix off-by-one kind values commit dc71afe5ac7e8d049bb991330518e4c898a7d92e upstream. Recent changes on the I2C front have left off-by-one array indexes in 3 hwmon drivers. Fix them. Faulty commit: e5e9f44c2 i2c: Drop I2C_CLIENT_INSMOD_2 to 8 Reported-by: Dan Carpenter Signed-off-by: Jean Delvare Cc: Hans de Goede Cc: Andre Prendel Signed-off-by: Greg Kroah-Hartman commit d8f74643578fd5b0c35a944c32e02379e1b22838 Author: Jean Delvare Date: Fri Mar 5 22:17:25 2010 +0100 hwmon: (tmp421) Restore missing inputs commit 8d59582a867470a3e0c3eced4a01625ae8dc546b upstream. An off-by-one error caused some inputs to not be created by the driver when they should. TMP421 gets only one input instead of two, TMP422 gets two instead of three, etc. Fix the bug by listing explicitly the number of inputs each device has. Signed-off-by: Jean Delvare Tested-by: Andre Prendel Signed-off-by: Greg Kroah-Hartman commit 3db891afe349069162cf7d6fe92e12c7f75ad893 Author: Jean Delvare Date: Fri Mar 5 22:17:25 2010 +0100 hwmon: (tmp421) Fix temperature conversions commit a44908d742a577fb5ccb9a8c082326d4cea234c2 upstream. The low bits of temperature registers are status bits, they must be masked out before converting the register values to temperatures. Signed-off-by: Jean Delvare Tested-by: Andre Prendel Signed-off-by: Greg Kroah-Hartman commit 0d883db628f87f0207c555b8db396e0ffc549a1e Author: Ben Gardner Date: Fri Mar 5 13:44:38 2010 -0800 gpio: cs5535-gpio: fix input direction commit a8a5164c297c16c2f4be776714ca47dba252cc3d upstream. The cs5535-gpio driver's get() function was returning the output value. This means that the GPIO pins would never work as an input, even if configured as an input. The driver should return the READ_BACK value, which is the sensed line value. To make that work when the direction is 'output', INPUT_ENABLE needs to be set. In addition, the driver was not disabling OUTPUT_ENABLE when the direction is set to 'input'. That would cause the GPIO to continue to drive the pin if the direction was ever set to output. This issue was noticed when attempting to use the gpiolib driver to read an external input. I had previously been using the char/cs5535-gpio driver. Signed-off-by: Ben Gardner Acked-by: Andres Salomon Cc: Andrew Morton Cc: David Brownell Cc: Mark Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit b8960a6272e3016e0621d739bd6702825ae76d07 Author: Mark Brown Date: Wed Feb 17 18:04:35 2010 +0000 gpiolib: Actually set output state in wm831x_gpio_direction_output() commit 3383d23d86791503559cb87837491af37469d9e5 upstream. wm831x_gpio_direction_output() ignored the state passed into it. Signed-off-by: Mark Brown Signed-off-by: Samuel Ortiz Signed-off-by: Greg Kroah-Hartman commit d1efc1b1cbd7fa03228268af58199bd913cbc9eb Author: Christian Lamparter Date: Sun Jan 17 23:17:29 2010 +0100 p54pci: handle dma mapping errors commit 288c8ce8047695fd8872dd5db3ef21a9679c402f upstream. This patch adds error-paths to handle pci_dma_mapping errors. Signed-off-by: Christian Lamparter Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 065bbb5b19f4dffc071341f3113813714d9a564a Author: Jean-François Moine Date: Wed Feb 17 10:59:31 2010 -0600 p54usb: Add the USB ID for Belkin (Accton) FD7050E ver 1010ec commit 5b9a919a97ac8bdda8020c9b366491b5b91b196e upstream. Yet another USB ID. Signed-off-by: Jean-François Moine Signed-off-by: Larry Finger Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 5eb790672b1970f8026cc65db354966d63a23e2f Author: Luotao Fu Date: Fri Feb 19 15:42:00 2010 +0100 USB: fix I2C API usage in ohci-pnx4008. commit 8740cc7d0c532e098cc428251c08befd14f087d8 upstream. i2c_board_info doesn't contain a member called name. i2c_register_client call does not exist. Signed-off-by: Luotao Fu Acked-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit 3c0611ea174f2dd680856120272f0c8babf1aa6b Author: Elina Pasheva Date: Mon Feb 15 14:50:14 2010 -0800 USB: serial: sierra driver indat_callback fix commit b87c6e86dac1bb5222279cc8ff7e09529e1c4ed9 upstream. A crash has been reported with sierra driver on disconnect with Ubuntu/Lucid distribution based on kernel-2.6.32. The cause of the crash was determined as "NULL tty pointer was being referenced" and the NULL pointer was passed by sierra_indat_callback(). This patch modifies sierra_indat_callback() function to check for NULL tty structure pointer. This modification prevents a crash from happening when the device is disconnected. This patch fixes the bug reported in Launchpad: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/511157 Signed-off-by: Elina Pasheva Signed-off-by: Greg Kroah-Hartman commit 401c1e931d0f19af9eb25a310e1aeb187d03526d Author: Baruch Siach Date: Mon Dec 21 16:26:46 2009 -0800 serial: imx: fix NULL dereference Oops when pdata == NULL commit bbcd18d1b37413d25eaf4580682b1b8e4a09ff5e upstream. The platform code doesn't have to provide platform data to get sensible default behaviour from the imx serial driver. This patch does not handle NULL dereference in the IrDA case, which still requires a valid platform data pointer (in imx_startup()/imx_shutdown()), since I don't know whether there is a sensible default behaviour, or should the operation just fail cleanly. Signed-off-by: Baruch Siach Cc: Baruch Siach Cc: Alan Cox Cc: Sascha Hauer Cc: Oskar Schirmer Cc: Fabian Godehardt Cc: Daniel Glöckner Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit b31bb1d2ad9856e718b018012ae37a65a44894c9 Author: Alan Cox Date: Mon Feb 8 10:09:26 2010 +0000 tty: Fix the ldisc hangup race commit 638b9648ab51c9c549ff5735d3de519ef6199df3 upstream. This was noticed by Matthias Urlichs and he proposed a fix. This patch does the fixing a different way to avoid introducing several new race conditions into the code. The problem case is TTY_DRIVER_RESET_TERMIOS = 0. In that case while we abort the ldisc change, the hangup processing has not cleaned up and restarted the ldisc either. We can't restart the ldisc stuff in the set_ldisc as we don't know what the hangup did and may touch stuff we shouldn't as we are no longer supposed to influence the tty at that point in case it has been re-opened before we get rescheduled. Instead do it the simple way. Always re-init the ldisc on the hangup, but use TTY_DRIVER_RESET_TERMIOS to indicate that we should force N_TTY. Signed-off-by: Alan Cox Signed-off-by: Greg Kroah-Hartman commit 768941b8ee188e169547e6ff97c5e46dda0e16a8 Author: Eric W. Biederman Date: Fri Jan 1 14:43:53 2010 -0800 sysfs: Cache the last sysfs_dirent to improve readdir scalability v2 commit 1e5289c97bba2d8ee7239a416bc3f28743362cd9 upstream. When sysfs_readdir stops short we now cache the next sysfs_dirent to return to user space in filp->private_data. There is no impact on the rest of sysfs by doing this and in the common case it allows us to pick up exactly where we left off with no seeking. Additionally I drop and regrab the sysfs_mutex around filldir to avoid a page fault abritrarily increasing the hold time on the sysfs_mutex. v2: Returned to using INT_MAX as the EOF condition. seekdir is ambiguous unless all directory entries have a unique f_pos value. Fixes http://bugzilla.kernel.org/show_bug.cgi?id=14949 Signed-off-by: Eric W. Biederman Cc: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit b7d0e6b45107dfc86224c4f72bee12051d1fdb54 Author: Kay Sievers Date: Wed Jan 13 14:16:36 2010 +0100 Driver-Core: devtmpfs - reset inode permissions before unlinking commit 5e31d76f2817bd50258a092a7c5b15b3006fd61c upstream. Before unlinking the inode, reset the current permissions of possible references like hardlinks, so granted permissions can not be retained across the device lifetime by creating hardlinks, in the unusual case that there is a user-writable directory on the same filesystem. Signed-off-by: Kay Sievers Signed-off-by: Greg Kroah-Hartman commit b1d7e73ab2696d013b696cec61252cab8dcb3a48 Author: Tejun Heo Date: Fri Feb 5 17:57:02 2010 +0900 driver-core: fix race condition in get_device_parent() commit 77d3d7c1d561f49f755d7390f0764dff90765974 upstream. sysfs is creating several devices in cuse class concurrently and with CONFIG_SYSFS_DEPRECATED turned off, it triggers the following oops. BUG: unable to handle kernel NULL pointer dereference at 0000000000000038 IP: [] sysfs_addrm_start+0x4a/0xf0 PGD 75bb067 PUD 75be067 PMD 0 Oops: 0000 [#1] PREEMPT SMP last sysfs file: /sys/devices/system/cpu/cpu7/topology/core_siblings CPU 1 Modules linked in: cuse fuse Pid: 4737, comm: osspd Not tainted 2.6.31-work #77 RIP: 0010:[] [] sysfs_addrm_start+0x4a/0xf0 RSP: 0018:ffff88000042f8f8 EFLAGS: 00010296 RAX: ffff88000042ffd8 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff880007eef660 RDI: 0000000000000001 RBP: ffff88000042f918 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: ffffffff81158b0a R12: ffff88000042f928 R13: 00000000fffffff4 R14: 0000000000000000 R15: ffff88000042f9a0 FS: 00007fe93905a950(0000) GS:ffff880008600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000038 CR3: 00000000077c9000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process osspd (pid: 4737, threadinfo ffff88000042e000, task ffff880007eef040) Stack: ffff880005da10e8 0000000011cc8d6e ffff88000042f928 ffff880003d28a28 <0> ffff88000042f988 ffffffff811592d7 0000000000000000 0000000000000000 <0> 0000000000000000 0000000000000000 ffff88000042f958 0000000011cc8d6e Call Trace: [] create_dir+0x67/0xe0 [] sysfs_create_dir+0x58/0xb0 [] ? kobject_add_internal+0xcc/0x220 [] ? vsnprintf+0x3c1/0xb90 [] kobject_add_internal+0x107/0x220 [] kobject_add_varg+0x47/0x80 [] kobject_add+0x53/0x90 [] device_add+0xd4/0x690 [] ? dev_set_name+0x4b/0x70 [] cuse_process_init_reply+0x2b4/0x420 [cuse] ... The problem is that kobject_add_internal() first adds a kobject to the kset and then try to create sysfs directory for it. If the creation fails, it remove the kobject from the kset. get_device_parent() accesses class_dirs kset while only holding class_dirs.list_lock to see whether the cuse class dir exists. But when it exists, it may not have finished initialization yet or may fail and get removed soon. In the above case, the former happened so the second one ends up trying to create subdirectory under NULL sysfs_dirent. Fix it by grabbing a mutex in get_device_parent(). Signed-off-by: Tejun Heo Reported-by: Colin Guthrie Signed-off-by: Greg Kroah-Hartman commit 682b7d6cf5e798e6603e27820ae72050b8ff5f97 Author: Daniel Mack Date: Fri Feb 26 14:36:54 2010 +0800 ASoC: fix ak4104 register array access commit e555317c083fda01f516d2153589e82514e20e70 upstream. Don't touch the variable 'reg' to construct the value for the actual SPI transport. This variable is again used to access the driver's register cache, and so random memory is overwritten. Compute the value in-place instead. Signed-off-by: Daniel Mack Acked-by: Liam Girdwood Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit be0be57d678a2734e552a1ceabbc02868c6c4e14 Author: Paul Menzel Date: Mon Feb 8 20:42:46 2010 +0100 ALSA: hda-intel: Add position_fix quirk for ASUS M2V-MX SE. commit 0708cc582f0fe2578eaab722841caf2b4f8cfe37 upstream. With PulseAudio and an application accessing an input device like `gnome-volume-manager` both have high CPU load as reported in [1]. Loading `snd-hda-intel` with `position_fix=1` fixes this issue. Therefore add a quirk for ASUS M2V-MX SE. The only downside is, when now exiting for example MPlayer when it is playing an audio file a high pitched sound is outputted by the speaker. $ lspci -vvnn | grep -A10 Audio 20:01.0 Audio device [0403]: VIA Technologies, Inc. VT1708/A [Azalia HDAC] (VIA High Definition Audio Controller) [1106:3288] (rev 10) Subsystem: ASUSTeK Computer Inc. Device [1043:8290] Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- SERR- Kernel driver in use: HDA Intel [1] http://sourceforge.net/mailarchive/forum.php?thread_name=1265550675.4642.24.camel%40mattotaupa&forum_name=alsa-user Signed-off-by: Paul Menzel Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit c8ee5d7c679628a9a5f041c14ac77eb3c1926e44 Author: Daniel T Chen Date: Fri Mar 5 09:04:49 2010 -0500 ALSA: hda: Use LPIB for a Biostar Microtech board commit 0321b69569eadbc13242922925a4316754c5f744 upstream. BugLink: https://launchpad.net/bugs/523953 The OR has verified that position_fix=1 is necessary to work around errors on his machine. Reported-by: MMarking Signed-off-by: Daniel T Chen Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 8630c9af924e3b44080d5edfadd161e4f51136ba Author: Daniel T Chen Date: Wed Mar 3 18:24:26 2010 -0500 ALSA: hda: Use LPIB for Dell Latitude 131L commit 9919c7619c52d01e89103bca405cc3d4a2b1ac31 upstream. BugLink: https://launchpad.net/bugs/530346 The OR has verified that position_fix=1 is necessary to work around errors on his machine. Reported-by: Tom Louwrier Signed-off-by: Daniel T Chen Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit d707522d421d10bb56c5054812eb1f53a39a5c08 Author: Henrique de Moraes Holschuh Date: Sat Feb 27 18:45:29 2010 -0300 thinkpad-acpi: fix ALSA callback return status commit 88cc83772a3c7756b9f2b4ba835545ad90a08409 upstream. Clemens Ladisch reports that thinkpad-acpi improperly implements the ALSA API, and always returns 0 for success for the "put" callbacks while the API requires it to return "1" when the control value has been changed in the hardware/firmware. Rework the volume subdriver to be able to properly implement the ALSA API. Based on a patch by Clemens Ladisch . This fix is also needed on 2.6.33. Reported-by: Clemens Ladisch Signed-off-by: Henrique de Moraes Holschuh Signed-off-by: Greg Kroah-Hartman commit f4d574122bc35f8c90effac2e3a2af2889e9ba81 Author: Sebastien Alaiwan Date: Tue Feb 16 08:55:08 2010 +0100 ALSA: USB MIDI support for Access Music VirusTI commit d39e82db73eb876c60d00f00219d767b3be30307 upstream. Here's a patch that adds MIDI support through USB for one of the Access Music synths, the VirusTI. The synth uses standard USBMIDI protocol on its USB interface 3, although it does signal "vendor specific" class. A magic string has to be sent on interface 3 to enable the sending of MIDI from the synth (this string was found by sniffing usb communication of the Windows driver). This is all my patch does, and it works on my computer. Please note that the synth can also do standard usb audio I/O on its interfaces 2&3, which already works with the current snd-usb-audio driver, except for the audio input from the synth. I'm going to work on it when I have some time. Signed-off-by: Sebastien Alaiwan Signed-off-by: Clemens Ladisch Signed-off-by: Jaroslav Kysela Signed-off-by: Greg Kroah-Hartman commit c7a4ea295be34290b584bdb1382a698af3cbd97c Author: Clemens Ladisch Date: Mon Feb 15 08:55:28 2010 +0100 ALSA: usb-audio: reduce MIDI packet size to work around broken firmware commit f167e1d073278fe231bbdd5d6c24fb9d091aa544 upstream. Extend the list of devices whose firmware does not expect more than one USB MIDI packet in one USB packet. bug report: https://bugtrack.alsa-project.org/alsa-bug/view.php?id=3752 Signed-off-by: Clemens Ladisch Signed-off-by: Jaroslav Kysela Signed-off-by: Greg Kroah-Hartman commit 616b05819b8d31ecdbcbafa2794a0eb1ea5e6944 Author: Jaroslav Kysela Date: Tue Feb 16 11:55:43 2010 +0100 ALSA: pcm core - fix fifo_size channels interval check commit 3be522a9514f58e0596db34898a514df206cadc5 upstream. Signed-off-by: Jaroslav Kysela Signed-off-by: Greg Kroah-Hartman commit 4504b9999da5af251be123d69ddbf8f6f6c7a52d Author: Clemens Ladisch Date: Mon Feb 22 10:33:13 2010 +0100 ALSA: via82xx: add quirk for D1289 motherboard commit bf30a4309d4294d3eca248ea8a20c1c3570f5e74 upstream. Add a headphones-only quirk for the Fujitsu Siemens D1289. Signed-off-by: Clemens Ladisch Reported-and-tested-by: Marc Haber Signed-off-by: Jaroslav Kysela Signed-off-by: Greg Kroah-Hartman commit bcbf140797467d9e215626aff38d036eb740ef2c Author: Daniel T Chen Date: Sat Feb 20 11:16:30 2010 -0500 ALSA: hda: Use 3stack quirk for Toshiba Satellite L40-10Q commit ba579eb7b30791751f556ee01905636cda50c864 upstream. BugLink: https://bugs.launchpad.net/bugs/524948 The OR has verified that the existing model=laptop-eapd quirk does not function correctly but instead needs model=3stack. Make this change so that manual corrections to module-init-tools file(s) are not required. Reported-by: Lasse Havelund Signed-off-by: Daniel T Chen Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 89a724c83c09eb2d28df4dc150b6d17954f25d7b Author: Jeff Mahoney Date: Wed Feb 24 13:59:23 2010 -0500 tracing: Fix ftrace_event_call alignment for use with gcc 4.5 commit 86c38a31aa7f2dd6e74a262710bf8ebf7455acc5 upstream. GCC 4.5 introduces behavior that forces the alignment of structures to use the largest possible value. The default value is 32 bytes, so if some structures are defined with a 4-byte alignment and others aren't declared with an alignment constraint at all - it will align at 32-bytes. For things like the ftrace events, this results in a non-standard array. When initializing the ftrace subsystem, we traverse the _ftrace_events section and call the initialization callback for each event. When the structures are misaligned, we could be treating another part of the structure (or the zeroed out space between them) as a function pointer. This patch forces the alignment for all the ftrace_event_call structures to 4 bytes. Without this patch, the kernel fails to boot very early when built with gcc 4.5. It's trivial to check the alignment of the members of the array, so it might be worthwhile to add something to the build system to do that automatically. Unfortunately, that only covers this case. I've asked one of the gcc developers about adding a warning when this condition is seen. Signed-off-by: Jeff Mahoney LKML-Reference: <4B85770B.6010901@suse.com> Signed-off-by: Steven Rostedt Signed-off-by: Greg Kroah-Hartman commit 21a6adcde06e129b055caa3256e65a97a2986770 Author: Peter Zijlstra Date: Tue Jan 26 18:50:16 2010 +0100 perf: Reimplement frequency driven sampling commit abd50713944c8ea9e0af5b7bffa0aacae21cc91a upstream. There was a bug in the old period code that caused intel_pmu_enable_all() or native_write_msr_safe() to show up quite high in the profiles. In staring at that code it made my head hurt, so I rewrote it in a hopefully simpler fashion. Its now fully symetric between tick and overflow driven adjustments and uses less data to boot. The only complication is that it basically wants to do a u128 division. The code approximates that in a rather simple truncate until it fits fashion, taking care to balance the terms while truncating. This version does not generate that sampling artefact. Signed-off-by: Peter Zijlstra Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 69cb5f7cdc28a5352a03c16bbaa0a92cdf31b9d4 Author: Robert Richter Date: Fri Feb 26 13:45:24 2010 +0100 oprofile/x86: fix msr access to reserved counters commit cfc9c0b450176a077205ef39092f0dc1a04e020a upstream. During switching virtual counters there is access to perfctr msrs. If the counter is not available this fails due to an invalid address. This patch fixes this. Signed-off-by: Robert Richter Signed-off-by: Greg Kroah-Hartman commit 53999488a09e797fa8be01166bd3c1c08fd6f297 Author: Robert Richter Date: Thu Feb 25 20:20:25 2010 +0100 oprofile/x86: use kzalloc() instead of kmalloc() commit c17c8fbf349482e89b57d1b800e83e9f4cf40c47 upstream. Signed-off-by: Robert Richter Signed-off-by: Greg Kroah-Hartman commit 0f8bdb7e9b1ea335823bf6ea4c666bbb142d5753 Author: Robert Richter Date: Thu Jan 28 16:50:45 2010 +0100 oprofile/x86: remove node check in AMD IBS initialization commit 89baaaa98a10cad5cc8516c7208b02d9fc711890 upstream. Standard AMD systems have the same number of nodes as there are northbridge devices. However, there may kernel configurations (especially for 32 bit) or system setups exist, where the node number is different or it can not be detected properly. Thus the check is not reliable and may fail though IBS setup was fine. For this reason it is better to remove the check. Signed-off-by: Robert Richter Signed-off-by: Greg Kroah-Hartman commit 0c802e02fbaa95b9884d4b3ca1b58e2dfa7c4978 Author: Robert Richter Date: Wed Feb 10 10:03:34 2010 +0100 oprofile: remove tracing build dependency commit 18b4a4d59e97e7ff13ee84b5bec79f3fc70a9f0a upstream. The commit 1155de4 ring-buffer: Make it generally available already made ring-buffer available without the TRACING option enabled. This patch removes the TRACING dependency from oprofile. Fixes also oprofile configuration on ia64. The patch also applies to the 2.6.32-stable kernel. Reported-by: Tony Jones Signed-off-by: Robert Richter Signed-off-by: Greg Kroah-Hartman commit fc0df425c936cca6e5a306c37b96bb1f8f15371c Author: Peter Zijlstra Date: Fri Feb 26 16:36:23 2010 +0100 perf_event: Fix preempt warning in perf_clock() commit 24691ea964cc0123e386b661e03a86a481c6ee79 upstream. A recent commit introduced a preemption warning for perf_clock(), use raw_smp_processor_id() to avoid this, it really doesn't matter which cpu we use here. Signed-off-by: Peter Zijlstra LKML-Reference: <1267198583.22519.684.camel@laptop> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 5f376564288d2b6959bdd8bf5442872cb97c7ac1 Author: Zhang, Yanmin Date: Thu Feb 25 11:00:51 2010 +0800 perf symbols: Check the right return variable commit 37fe5fcb7a5b5235c8b71bf5469ce4c7246e3fab upstream. In function dso__split_kallsyms(), curr_map saves the return value of map__new2. So check it instead of var map after the call returns. Signed-off-by: Zhang Yanmin Acked-by: David S. Miller Cc: Peter Zijlstra Cc: Mike Galbraith Cc: Paul Mackerras Cc: Arnaldo Carvalho de Melo Cc: Frederic Weisbecker LKML-Reference: <1267066851.1726.9.camel@localhost> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 00faf75b763d765c9360b5be47d47f190d53f32a Author: Robert Richter Date: Thu Feb 25 19:16:46 2010 +0100 oprofile/x86: fix perfctr nmi reservation for mulitplexing commit 68dc819ce829f7e7977a56524e710473bdb55115 upstream. Multiple virtual counters share one physical counter. The reservation of virtual counters fails due to duplicate allocation of the same counter. The counters are already reserved. Thus, virtual counter reservation may removed at all. This also makes the code easier. Signed-off-by: Robert Richter Signed-off-by: Greg Kroah-Hartman commit ac89db9934244f86cd8e58704a8bcf4ba8b1e893 Author: Jean Delvare Date: Sun Jan 31 04:03:23 2010 +0000 macintosh/hwmon/ams: Fix device removal sequence commit 98ceb75c7c14eada76b0aa9f03a635a735cee3cb upstream. Some code that is in ams_exit() (the module exit code) should instead be called when the device (not module) is removed. It probably doesn't make much of a difference in the PMU case, but in the I2C case it does matter. I make no guarantee that my fix isn't racy, I'm not familiar enough with the ams driver code to tell for sure. Signed-off-by: Jean Delvare Tested-by: Christian Kujau Cc: Benjamin Herrenschmidt Cc: Stelian Pop Cc: Michael Hanselmann Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit 44fc910605e7b0ece4b2151309d6edbefa96517a Author: Jean Delvare Date: Sun Jan 31 04:00:30 2010 +0000 macintosh/therm_adt746x: Fix sysfs attributes lifetime commit 33a470f6d5e1879c26f16f6b34dc09f82d44f6e9 upstream. Looking at drivers/macintosh/therm_adt746x.c, the sysfs files are created in thermostat_init() and removed in thermostat_exit(), which are the driver's init and exit functions. These files are backed-up by a per-device structure, so it looks like the wrong thing to do: the sysfs files have a lifetime longer than the data structure that is backing it up. I think that sysfs files creation should be moved to the end of probe_thermostat() and sysfs files removal should be moved to the beginning of remove_thermostat(). Signed-off-by: Jean Delvare Tested-by: Christian Kujau Cc: Benjamin Herrenschmidt Cc: Colin Leroy Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit 9a255c79b215c5cf9790ff46a25188e3af2dfc42 Author: Rafael J. Wysocki Date: Thu Feb 25 22:32:37 2010 +0100 PM / Hibernate: Fix preallocating of memory commit a9c9b4429df437982d2fbfab1f4b46b01329e9ed upstream. The hibernate memory preallocation code allocates memory to push some user space data out of physical RAM, so that the hibernation image is not too large. It allocates more memory than necessary for creating the image, so it has to release some pages to make room for allocations made while suspending devices and disabling nonboot CPUs, or the system will hang due to the lack of free pages to allocate from. Unfortunately, the function used for freeing these pages, free_unnecessary_pages(), contains a bug that prevents it from doing the job on all systems without highmem. Fix this problem, which is a regression from the 2.6.30 kernel, by using the right condition for the termination of the loop in free_unnecessary_pages(). Signed-off-by: Rafael J. Wysocki Reported-and-tested-by: Alan Jenkins Signed-off-by: Greg Kroah-Hartman commit ac3da4193bac230e0281508c0cdf530d81b0a458 Author: Baruch Siach Date: Fri Feb 19 14:09:25 2010 -0300 V4L/DVB: v4l: soc_camera: fix bound checking of mbus_fmt[] index commit 84f3751d6a6f766780dee509433bf7b3dfcdf465 upstream. When code <= V4L2_MBUS_FMT_FIXED soc_mbus_get_fmtdesc returns a pointer to mbus_fmt[x], where x < 0. Fix this. Signed-off-by: Baruch Siach Signed-off-by: Guennadi Liakhovetski Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit 656bb504522676d4a9ebf218c37f7eb966e534ab Author: Ang Way Chuang Date: Thu Feb 25 09:45:03 2010 +0800 dvb-core: Fix DoS bug in ULE decapsulation code that can be triggered by an invalid Payload Pointer commit 29e1fa3565a7951cc415c634eb2b78dbdbee151d upstream. ULE (Unidirectional Lightweight Encapsulation RFC 4326) decapsulation has a bug that causes endless loop when Payload Pointer of MPEG2-TS frame is 182 or 183. Anyone who sends malicious MPEG2-TS frame will cause the receiver of ULE SNDU to go into endless loop. This patch was generated and tested against linux-2.6.32.9 and should apply cleanly to linux-2.6.33 as well because there was only one typo fix to dvb_net.c since v2.6.32. This bug was brought to you by modern day Santa Claus who decided to shower the satellite dish at Keio University with heavy snow causing huge burst of errors. We, receiver end, received Santa Claus's gift in the form of kernel bug. Care has been taken not to introduce more bug by fixing this bug, but please scrutinize the code for I always produces buggy code. Signed-off-by: Ang Way Chuang Acked-by: Mauro Carvalho Chehab Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 418865c74f10858d9ca4cae2889e38ddffdb5ca4 Author: Greg Kroah-Hartman Date: Thu Feb 11 17:15:14 2010 -0800 Staging: mimio: remove the mimio driver commit e37bcc0de040127281de13a84a608570355c20eb upstream. It turns out that Mimio has a userspace solution for this product using libusb, and the in-kernel driver is just getting in the way now and causing problems. So they have asked that the in-kernel driver be removed. As the staging driver wasn't quite working anyway, and Mimio supports their libusb solution for all distros, I am removing the in-kernel driver. The libusb solution can be downloaded from: http://www.mimio.com/downloads/mimio_studio_software/linux.asp Cc: Cc: Phil Hannent Cc: Marc Rousseau Signed-off-by: Greg Kroah-Hartman commit 98f7978e3205dc3e9585134056589d917cd1f4af Author: Peter Huewe Date: Thu Jan 7 21:21:35 2010 +0100 Staging: wlan-ng: Add select WEXT_PRIV to Kconfig to prevent build failure commit 8a8e29752dfdba014b866d3c587d3409e57263dd upstream. Without WEXT_PRIV set the p80211wext.c fails to build due to unknown fields in the iw_handler_def struct. Those fields are enclosed in WEXT_PRIV conditionals in the prototype of iw_handler_def in include/net/iw_handler.h Signed-off-by: Peter Huewe Acked-by: Simon Horman Signed-off-by: Greg Kroah-Hartman commit 6f72375ac0ed045feba16739884b849fe1222826 Author: Jens Axboe Date: Wed Feb 3 01:04:30 2010 +0300 Staging: Fixed pohmelfs regression because of per-bdi writeback. commit 182374a0bddeef46769d2f8ab56fcccc433b96f3 upstream. Since pohmelfs isn't tied to a single block device, it needs to setup a backing dev like nfs/btrfs/etc do. Signed-off-by: Jens Axboe Signed-off-by: Evgeniy Polyakov Signed-off-by: Greg Kroah-Hartman commit e5c79cb177f440c4c6ed1ac63d09370da92a2a8d Author: Greg Kroah-Hartman Date: Thu Feb 25 16:43:15 2010 -0800 Staging: hv: match on DMI values to know if we should run. commit c22090facd354749cfe99a46e903449c7ac07788 upstream. The HV core mucks around with specific irqs and other low-level stuff and takes forever to determine that it really shouldn't be running on a machine. So instead, trigger off of the DMI system information and error out much sooner. This also allows the module loading tools to recognize that this code should be loaded on this type of system. Cc: Haiyang Zhang Cc: Hank Janssen Signed-off-by: Greg Kroah-Hartman commit 896d0d640ce75542d0697b4b25c2b1d85c859967 Author: Greg Kroah-Hartman Date: Thu Feb 25 16:42:10 2010 -0800 Staging: hv: add a pci device table commit 9a775dbd4e8c87b7d35549183145321c7205404e upstream. This allows the HV core to be properly found and autoloaded by the system tools. It uses the Microsoft virtual VGA device to trigger this. Cc: Haiyang Zhang Cc: Hank Janssen Signed-off-by: Greg Kroah-Hartman commit ca3ee1cb47774f5575750883335817a2102d73c9 Author: Ben Hutchings Date: Sat Jan 23 18:40:29 2010 +0000 SCSI: qla1280: Drop host_lock while requesting firmware commit 2cec802980727f1daa46d8c31b411e083d49d7a2 upstream. request_firmware() may sleep and it appears to be safe to release the spinlock here. Signed-off-by: Ben Hutchings Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 95a8ed004d1cb82742012dbd44b41ab0780a59d7 Author: Paul Mundt Date: Thu Feb 25 16:37:46 2010 +0900 clocksource: Fix up a registration/IRQ race in the sh drivers. commit da64c2a8dee66ca03f4f3e15d84be7bedf73db3d upstream. All of the SH clocksource drivers follow the scheme that the IRQ is setup prior to registering the clockevent. The interrupt handler in the clockevent cases looks to the event handler function pointer being filled in by the registration code, permitting us to get in to situations where asserted IRQs step in to the handler before registration has had a chance to complete and hitting a NULL pointer deref. In practice this is not an issue for most platforms, but some of them with fairly special loaders (or that are chain-loading from another kernel) may enter in to this situation. This fixes up the oops reported by Rafael on hp6xx. Reported-and-tested-by: Rafael Ignacio Zurita Signed-off-by: Paul Mundt Signed-off-by: Greg Kroah-Hartman commit 8a2b4a7256502aa84485eca49b74d64eb4d7ba16 Author: Thomas Gleixner Date: Thu Feb 25 16:42:11 2010 +0100 x86/PCI: Prevent mmconfig memory corruption commit bb8d41330ce27edb91adb6922d3f8e1a8923f727 upstream. commit ff097ddd4 (x86/PCI: MMCONFIG: manage pci_mmcfg_region as a list, not a table) introduced a nasty memory corruption when pci_mmcfg_list is empty. pci_mmcfg_check_end_bus_number() dereferences pci_mmcfg_list.prev even when the list is empty. The following write hits some variable near to pci_mmcfg_list. Further down a similar problem exists, where cfg->list.next is dereferenced unconditionally and a comparison with some variable near to pci_mmcfg_list happens. Add a check for the last element into the for_each_entry() loop and remove all the other crappy logic which is just a leftover of the old array based code which was replaced by the list conversion. Reported-by: Ingo Molnar Signed-off-by: Thomas Gleixner Cc: Bjorn Helgaas Cc: Yinghai Lu Signed-off-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman commit 4d57ebd581a5dc9e1fdb6b59c34ddec72013f5b8 Author: Aaro Koskinen Date: Fri Mar 5 13:44:24 2010 -0800 rtc-core: fix memory leak commit 2a7a06a0cdd86d572e91657603180da5992be6d3 upstream. The idr should be destroyed when the module is unloaded. Found with kmemleak. Signed-off-by: Aaro Koskinen Cc: Alessandro Zummo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit a7ca19cde1d0a1fa9613be3d54dcd65e8ec47904 Author: Ming Lei Date: Sat Feb 6 22:38:23 2010 +0800 ath9k: fix keycache leak in split tkip case commit 733da37dab72de6b3f8b0c56b5cdea322f18a684 upstream. If split tkip key is used, ath_delete_key should delete rx key and rx mic key. This patch fixes the leak of hw keycache in the case. Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 42a89b24c741d42fbd72c9f9b390b588ad01cf6c Author: Jesse Barnes Date: Fri Feb 12 09:30:00 2010 -0800 drm/i915: give up on 8xx lid status commit 7b9c5abee98c54f85bcc04bd4d7ec8d5094c73f4 upstream. These old machines more often than not lie about their lid state. So don't use it to detect LVDS presence, but leave the event handler to deal with lid open/close, when we might need to reset the mode. Fixes kernel bug #15248 Signed-off-by: Jesse Barnes Signed-off-by: Eric Anholt Signed-off-by: Greg Kroah-Hartman commit 38050e8d4f879a4d14bbd241f7de8bfb08ca2d23 Author: Jack Steiner Date: Thu Jan 7 10:12:40 2010 -0600 x86, uv: uv_global_gru_mmr_address() macro fix commit e1e0138d7d10fd447c71cc70f367eac514bd3ce4 upstream. Fix bug in uv_global_gru_mmr_address macro. Macro failed to cast an int value to a long prior to a left shift > 32. Signed-off-by: Jack Steiner LKML-Reference: <20100107161240.GA2610@sgi.com> Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit 686056f1efec9d121a342dce70bffda664365865 Author: Wu Fengguang Date: Fri Mar 5 13:42:01 2010 -0800 vfs: take f_lock on modifying f_mode after open time commit 42e49608683ab25fbbbf9c40edb944601e543882 upstream. We'll introduce FMODE_RANDOM which will be runtime modified. So protect all runtime modification to f_mode with f_lock to avoid races. Signed-off-by: Wu Fengguang Cc: Al Viro Cc: Christoph Hellwig Cc: Trond Myklebust Cc: Chuck Lever Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 8635bb47c2a2f4d26ee42376b18e73c853570c41 Author: Theodore Kilgore Date: Fri Dec 25 05:15:10 2009 -0300 V4L/DVB (13991): gspca_mr973010a: Fix cif type 1 cameras not streaming on UHCI controllers commit 70136081fc67ea77d849f86fa323e5773c8e40ea upstream. If you read the mail to Oliver Neukum on the linux-usb list, then you know that I found a cure for the mysterious problem that the MR97310a CIF "type 1" cameras have been freezing up and refusing to stream if hooked up to a machine with a UHCI controller. Namely, the cure is that if the camera is an mr97310a CIF type 1 camera, you have to send it 0xa0, 0x00. Somehow, this is a timing reset command, or such. It un-blocks whatever was previously stopping the CIF type 1 cameras from working on the UHCI-based machines. Signed-off-by: Theodore Kilgore Signed-off-by: Hans de Goede Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit 0b7196b95e817ca95d15842269167324734c1c0e Author: Haicheng Li Date: Wed Jan 6 15:25:23 2010 +0800 slab: initialize unused alien cache entry as NULL at alloc_alien_cache(). commit f3186a9c51eabe75b2780153ed7f07778d78b16e upstream. Comparing with existing code, it's a simpler way to use kzalloc_node() to ensure that each unused alien cache entry is NULL. CC: Eric Dumazet Acked-by: Andi Kleen Acked-by: Christoph Lameter Acked-by: Matt Mackall Signed-off-by: Haicheng Li Signed-off-by: Pekka Enberg Signed-off-by: Greg Kroah-Hartman commit f6bbb1be3901ce3c9166ef541bee8d47cba5d3fc Author: Wu Fengguang Date: Fri Mar 5 13:42:03 2010 -0800 readahead: introduce FMODE_RANDOM for POSIX_FADV_RANDOM commit 0141450f66c3c12a3aaa869748caa64241885cdf upstream. This fixes inefficient page-by-page reads on POSIX_FADV_RANDOM. POSIX_FADV_RANDOM used to set ra_pages=0, which leads to poor performance: a 16K read will be carried out in 4 _sync_ 1-page reads. In other places, ra_pages==0 means - it's ramfs/tmpfs/hugetlbfs/sysfs/configfs - some IO error happened where multi-page read IO won't help or should be avoided. POSIX_FADV_RANDOM actually want a different semantics: to disable the *heuristic* readahead algorithm, and to use a dumb one which faithfully submit read IO for whatever application requests. So introduce a flag FMODE_RANDOM for POSIX_FADV_RANDOM. Note that the random hint is not likely to help random reads performance noticeably. And it may be too permissive on huge request size (its IO size is not limited by read_ahead_kb). In Quentin's report (http://lkml.org/lkml/2009/12/24/145), the overall (NFS read) performance of the application increased by 313%! Tested-by: Quentin Barnes Signed-off-by: Wu Fengguang Cc: Nick Piggin Cc: Andi Kleen Cc: Steven Whitehouse Cc: David Howells Cc: Jonathan Corbet Cc: Al Viro Cc: Christoph Hellwig Cc: Trond Myklebust Cc: Chuck Lever Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 4fa3972478b1811fea179bd36798ab3eae6babfd Author: Kashyap, Desai Date: Wed Dec 16 18:50:06 2009 +0530 mpt2sas: Delete volume before HBA detach. commit d7384b28afb2bf2b7be835ddc8c852bdc5e0ce1c upstream. The driver hangs when doing `rmmod mpt2sas` if there are any IR volumes present.The hang is due the scsi midlayer trying to access the IR volumes after the driver releases controller resources. Perhaps when scsi_remove_host is called,the scsi mid layer is sending some request. This doesn't occur for bare drives becuase the driver is already reporting those drives deleted prior to calling mpt2sas_base_detach. To solve this issue, we need to delete the volumes as well. Signed-off-by: Kashyap Desai Reviewed-by: Eric Moore Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit b65592168721ff3800a83e081b5fbb58e8f4e9be Author: Vivek Natarajan Date: Mon Feb 8 17:47:01 2010 +0530 mac80211: Reset dynamic ps timer in Rx path. commit e15276a4b220c54db665cf46a92bd9ceb9aeb052 upstream. The current mac80211 implementation enables power save if there is no Tx traffic for a specific timeout. Hence, PS is triggered even if there is a continuous Rx only traffic(like UDP) going on. This makes the drivers to wait on the tim bit in the next beacon to awake which leads to redundant sleep-wake cycles. Fix this by restarting the dynamic ps timer on receiving every data packet. Signed-off-by: Vivek Natarajan Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit a19aec3d01d42adfd11ea9fe8363d11fff5cd0b4 Author: Zhu Yi Date: Mon Dec 28 16:57:15 2009 +0800 mac80211: quit addba_resp_timer if Tx BA session is torn down commit 3dc1de0bf23816ed557ac8addf680cd5ee57e805 upstream. Make addba_resp_timer aware the HT_AGG_STATE_REQ_STOP_BA_MSK mask so that when ___ieee80211_stop_tx_ba_session() is issued the timer will quit. Otherwise when suspend happens before the timer expired, the timer handler will be called immediately after resume and messes up driver status. Signed-off-by: Zhu Yi Acked-by: Johannes Berg Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 5f5549279a5cc0d5f1feb0fcc70ea5fb60d7e109 Author: Oliver Neukum Date: Fri Feb 12 13:02:28 2010 +0100 HID: usbhid: introduce timeout for stuck ctrl/out URBs commit 858155fbcc0cd713f6382c527bb1c3abc0ed6d00 upstream. Some devices do not react to a control request (seen on APC UPS's) resulting in a slow stream of messages, "generic-usb ... control queue full". Therefore request needs a timeout. Signed-off-by: Oliver Neukum Signed-off-by: David Fries Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit 86128dc550037896f1f12880a9317c52a87fffdc Author: Jiri Kosina Date: Wed Dec 23 14:13:46 2009 +0100 HID: remove TENX iBuddy from blacklist commit 4bb9508bbbb06f10bc3e249dd34375b4a4d6bfc0 upstream. There were multiple reports which indicate that vendor messed up horribly and the same VID/PID combination is used for completely different devices, some of them requiring the blacklist entry and other not. Remove the blacklist entry for this combination of VID/PID completely, and let the user decide and unbind the driver via sysfs eventually, if needed. Proper fix would be fixing the vendor. References: http://lkml.org/lkml/2009/2/10/434 http://bugzilla.kernel.org/show_bug.cgi?id=13411 Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit 1892aa5152de460ffd7bdb1b64f84313eb14353e Author: Stanislaw Gruszka Date: Tue Feb 2 15:34:50 2010 +0100 airo: fix setting zero length WEP key commit f09c256375c7cf1e112b8ef6306cdd313490d7c0 upstream. Patch prevents call set_wep_key() with zero key length. That fix long standing regression since commit c0380693520b1a1e4f756799a0edc379378b462a "airo: clean up WEP key operations". Additionally print call trace when someone will try to use improper parameters, and remove key.len = 0 assignment, because it is in not possible code path. Reported-by: Chris Siebenmann Bisected-by: Chris Siebenmann Tested-by: Chris Siebenmann Cc: Dan Williams Signed-off-by: Stanislaw Gruszka Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 58ec4abc2202c36a4d12fd95f7030b977cc7b91d Author: Xiaotian Feng Date: Wed Feb 24 18:39:02 2010 +0800 security: fix error return path in ima_inode_alloc commit baac35c4155a8aa826c70acee6553368ca5243a2 upstream. If radix_tree_preload is failed in ima_inode_alloc, we don't need radix_tree_preload_end because kernel is alread preempt enabled Signed-off-by: Xiaotian Feng Signed-off-by: Mimi Zohar Signed-off-by: James Morris Signed-off-by: Greg Kroah-Hartman commit 9bd97ecab811f5bce4a0e9d7e316d2559fa4be65 Author: Andrew Morton Date: Tue Feb 2 14:45:54 2010 -0800 PCI hotplug: check ioremap() return value in ibmphp_ebda.c commit ba02b242bbf8e4e1bc63d62e8ccec33b4e5ea132 upstream. check ioremap() return value. Signed-off-by: Andrew Morton Signed-off-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman commit f479dae12ac8c0bea06f4c0cacb846aae66756fd Author: Chandru Date: Mon Jan 11 11:49:21 2010 +0530 PCI hotplug: ibmphp: read the length of ebda and map entire ebda region commit b0fc889c4311835ae7d02f433154bc20cad9ee11 upstream. ibmphp driver currently maps only 1KB of ebda memory area into kernel address space during driver initialization. This causes kernel oops when the driver is modprobe'd and it accesses memory beyond 1KB within ebda segment. The first byte of ebda segment actually stores the length of the ebda region in Kilobytes. Hence make use of the length parameter and map the entire ebda region. Signed-off-by: Chandru Siddalingappa Signed-off-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman commit a0fac0acdd368e8450cda2c75b4a8d86f1151ad4 Author: Joshua Roys Date: Wed Feb 24 18:52:44 2010 -0500 netlabel: fix export of SELinux categories > 127 commit c36f74e67fa12202dbcb4ad92c5ac844f9d36b98 upstream. This fixes corrupted CIPSO packets when SELinux categories greater than 127 are used. The bug occured on the second (and later) loops through the while; the inner for loop through the ebitmap->maps array used the same index as the NetLabel catmap->bitmap array, even though the NetLabel bitmap is twice as long as the SELinux bitmap. Signed-off-by: Joshua Roys Acked-by: Paul Moore Signed-off-by: James Morris Signed-off-by: Greg Kroah-Hartman commit a858b15b88214c7bf918eac57d5debbdd60fffa8 Author: Robert Hancock Date: Tue Jan 26 22:33:23 2010 -0600 ahci: disable FPDMA auto-activate optimization on NVIDIA AHCI commit 453d3131ec7aab82eaaa8401a50522a337092aa8 upstream. Mike Cui reported that his system with an NVIDIA MCP79 (aka MCP7A) chipset stopped working with 2.6.32. The problem appears to be that 2.6.32 now enables the FPDMA auto-activate optimization in the ahci driver. The drive works fine with this enabled on an Intel AHCI so this appears to be a chipset bug. Since MCP79 is a fairly recent NVIDIA chipset and we don't have any info on whether any other NVIDIA chipsets have this issue, disable FPDMA AA optimization on all NVIDIA AHCI controllers for now. Should address http://bugzilla.kernel.org/show_bug.cgi?id=14922 Signed-off-by: Robert Hancock While-we-investigate-issue-this-patch-looks-good-to-me-by: Prajakta Gudadhe Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman