commit 15b059e0f9e31f0e7f6b5397368054c005949fea Author: Greg Kroah-Hartman Date: Mon Aug 2 10:27:18 2010 -0700 Linux 2.6.33.7 commit f197219558c0e83f9af52944ded991233facf585 Author: Daniel Ritz Date: Sat Dec 12 14:57:17 2009 -0300 V4L/DVB (13830): uvcvideo: add another YUYV format GUID for iSight cameras commit 68f194e027ecfbbc8d5515bc40787e542eed59e9 upstream. For some unknown reason, on a MacBookPro5,3 the iSight sometimes report a different video format GUID. This patch add the other (wrong) GUID to the format table, making the iSight work always w/o other problems. What it should report: 32595559-0000-0010-8000-00aa00389b71 What it often reports: 32595559-0000-0010-8000-000000389b71 Signed-off-by: Daniel Ritz Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab Cc: Leann Ogasawara Signed-off-by: Greg Kroah-Hartman commit d6d65e5c431b58be6bda46ee453e42078faf1b55 Author: Dmitry Torokhov Date: Mon Jul 26 01:12:37 2010 -0700 Input: RX51 keymap - fix recent compile breakage commit 2e65a2075cc740b485ab203430bdf3459d5551b6 upstream. Commit 3fea60261e73 ("Input: twl40300-keypad - fix handling of "all ground" rows") broke compilation as I managed to use non-existent keycodes. Reported-by: Arjan van de Ven Signed-off-by: Dmitry Torokhov Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit e5e6ee1551f48f18e08f32cbbfe48407c2e77ae8 Author: Bob Copeland Date: Fri Jun 18 13:15:23 2010 -0400 ath5k: initialize ah->ah_current_channel commit b6855772f4a22c4fbdd4fcaceff5c8a527035123 upstream. ath5k assumes ah_current_channel is always a valid pointer in several places, but a newly created interface may not have a channel. To avoid null pointer dereferences, set it up to point to the first available channel until later reconfigured. This fixes the following oops: $ rmmod ath5k $ insmod ath5k $ iw phy0 set distance 11000 BUG: unable to handle kernel NULL pointer dereference at 00000006 IP: [] ath5k_hw_set_coverage_class+0x74/0x1b0 [ath5k] *pde = 00000000 Oops: 0000 [#1] last sysfs file: /sys/devices/pci0000:00/0000:00:0e.0/ieee80211/phy0/index Modules linked in: usbhid option usb_storage usbserial usblp evdev lm90 scx200_acb i2c_algo_bit i2c_dev i2c_core via_rhine ohci_hcd ne2k_pci 8390 leds_alix2 xt_IMQ imq nf_nat_tftp nf_conntrack_tftp nf_nat_irc nf_cc Pid: 1597, comm: iw Not tainted (2.6.32.14 #8) EIP: 0060:[] EFLAGS: 00010296 CPU: 0 EIP is at ath5k_hw_set_coverage_class+0x74/0x1b0 [ath5k] EAX: 000000c2 EBX: 00000000 ECX: ffffffff EDX: c12d2080 ESI: 00000019 EDI: cf8c0000 EBP: d0a30edc ESP: cfa09bf4 DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 Process iw (pid: 1597, ti=cfa09000 task=cf88a000 task.ti=cfa09000) Stack: d0a34f35 d0a353f8 d0a30edc 000000fe cf8c0000 00000000 1900063d cfa8c9e0 <0> cfa8c9e8 cfa8c0c0 cfa8c000 d0a27f0c 199d84b4 cfa8c200 00000010 d09bfdc7 <0> 00000000 00000000 ffffffff d08e0d28 cf9263c0 00000001 cfa09cc4 00000000 Call Trace: [] ? ath5k_hw_attach+0xc8c/0x3c10 [ath5k] [] ? __ieee80211_request_smps+0x1347/0x1580 [mac80211] [] ? nl80211_send_scan_start+0x7b8/0x4520 [cfg80211] [] ? nla_parse+0x59/0xc0 [] ? genl_rcv_msg+0x169/0x1a0 [] ? genl_rcv_msg+0x0/0x1a0 [] ? netlink_rcv_skb+0x38/0x90 [] ? genl_rcv+0x19/0x30 [] ? netlink_unicast+0x1b3/0x220 [] ? netlink_sendmsg+0x26e/0x290 [] ? sock_sendmsg+0xbe/0xf0 [] ? autoremove_wake_function+0x0/0x50 [] ? __alloc_pages_nodemask+0x106/0x530 [] ? do_lookup+0x53/0x1b0 [] ? __link_path_walk+0x9b9/0x9e0 [] ? verify_iovec+0x50/0x90 [] ? sys_sendmsg+0x1e1/0x270 [] ? find_get_page+0x10/0x50 [] ? filemap_fault+0x5f/0x370 [] ? __do_fault+0x319/0x370 [] ? sys_socketcall+0x244/0x290 [] ? do_page_fault+0x1ec/0x270 [] ? do_page_fault+0x0/0x270 [] ? syscall_call+0x7/0xb Code: 00 b8 fe 00 00 00 b9 f8 53 a3 d0 89 5c 24 14 89 7c 24 10 89 44 24 0c 89 6c 24 08 89 4c 24 04 c7 04 24 35 4f a3 d0 e8 7c 30 60 f0 <0f> b7 43 06 ba 06 00 00 00 a8 10 75 0e 83 e0 20 83 f8 01 19 d2 EIP: [] ath5k_hw_set_coverage_class+0x74/0x1b0 [ath5k] SS:ESP 0068:cfa09bf4 CR2: 0000000000000006 ---[ end trace 54f73d6b10ceb87b ]--- Reported-by: Steve Brown Signed-off-by: Bob Copeland Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 731ffe0bf1ced2526be3d0e25ca45818cac80ff2 Author: Andre Osterhues Date: Tue Jul 13 15:59:17 2010 -0500 ecryptfs: Bugfix for error related to ecryptfs_hash_buckets commit a6f80fb7b5986fda663d94079d3bba0937a6b6ff upstream. The function ecryptfs_uid_hash wrongly assumes that the second parameter to hash_long() is the number of hash buckets instead of the number of hash bits. This patch fixes that and renames the variable ecryptfs_hash_buckets to ecryptfs_hash_bits to make it clearer. Fixes: CVE-2010-2492 Signed-off-by: Andre Osterhues Signed-off-by: Tyler Hicks Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 6401245fec18068b94f557f0ba9bb23a9f8e9eec Author: Tony Luck Date: Wed Jun 30 10:46:16 2010 -0700 Fix spinaphore down_spin() commit b70f4e85bfc4d7000036355b714a92d5c574f1be upstream. Typo in down_spin() meant it only read the low 32 bits of the "serve" value, instead of the full 64 bits. This results in the system hanging when the values in ticket/serve get larger than 32-bits. A big enough system running the right test can hit this in a just a few hours. Broken since 883a3acf5b0d4782ac35981227a0d094e8b44850 [IA64] Re-implement spinaphores using ticket lock concepts Reported via IRC by Bjorn Helgaas Signed-off-by: Tony Luck Signed-off-by: Greg Kroah-Hartman commit 0bbd0365fabbccfda730b672e0f4e8a12440aa36 Author: Krzysztof Halasa Date: Fri Jun 11 01:08:20 2010 +0200 kbuild: Fix modpost segfault commit 1c938663d58b5b2965976a6f54cc51b5d6f691aa upstream. Alan writes: > program: /home/alan/GitTrees/linux-2.6-mid-ref/scripts/mod/modpost -o > Module.symvers -S vmlinux.o > > Program received signal SIGSEGV, Segmentation fault. It just hit me. It's the offset calculation in reloc_location() which overflows: return (void *)elf->hdr + sechdrs[section].sh_offset + (r->r_offset - sechdrs[section].sh_addr); E.g. for the first rodata r entry: r->r_offset < sechdrs[section].sh_addr and the expression in the parenthesis produces 0xFFFFFFE0 or something equally wise. Reported-by: Alan Signed-off-by: Krzysztof Hałasa Tested-by: Alan Signed-off-by: Michal Marek Signed-off-by: Greg Kroah-Hartman commit cf50b2cde07046a88a19d5ef100421be7efc4e5a Author: Shanyu Zhao Date: Tue Jun 1 17:13:58 2010 -0700 iwlagn: verify flow id in compressed BA packet commit b561e8274f75831ee87e4ea378cbb1f9f050a51a upstream. The flow id (scd_flow) in a compressed BA packet should match the txq_id of the queue from which the aggregated packets were sent. However, in some hardware like the 1000 series, sometimes the flow id is 0 for the txq_id (10 to 19). This can cause the annoying message: [ 2213.306191] iwlagn 0000:01:00.0: Received BA when not expected [ 2213.310178] iwlagn 0000:01:00.0: Read index for DMA queue txq id (0), index 5, is out of range [0-256] 7 7. And even worse, if agg->wait_for_ba is true when the bad BA is arriving, this can cause system hang due to NULL pointer dereference because the code is operating in a wrong tx queue! Signed-off-by: Shanyu Zhao Signed-off-by: Pradeep Kulkarni Signed-off-by: Reinette Chatre Signed-off-by: Greg Kroah-Hartman commit bcc8f887cba250b5b6f3d9d783f1d137cd4374b4 Author: Laurent Pinchart Date: Mon Apr 12 10:41:22 2010 -0300 V4L/DVB: uvcvideo: Add support for V4L2_PIX_FMT_Y16 commit 61421206833a4085d9bdf35b2b84cd9a67dfdfac upstream. The Miricle 307K (17dc:0202) camera reports a 16-bit greyscale format, support it in the driver. Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit ae6653e9ce92fa01cb504438b1deb804037907b2 Author: Laurent Pinchart Date: Sat Mar 13 18:12:15 2010 -0300 V4L/DVB: uvcvideo: Add support for Packard Bell EasyNote MX52 integrated webcam commit f129b03ba272c86c42ad476684caa0d6109cb383 upstream. The camera requires the STREAM_NO_FID quirk. Add a corresponding entry in the device IDs list. Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit 2f3ed8b90ab9df8591782214b967fa109a77995c Author: Laurent Pinchart Date: Thu Mar 4 07:51:25 2010 -0300 V4L/DVB: uvcvideo: Add support for unbranded Arkmicro 18ec:3290 webcams commit 1e4d05bc95a0fe2972c5c91ed45466587d07cd2c upstream. The camera requires the PROBE_DEF quirk. Add a corresponding entry in the device IDs list. Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit 84667df095e62869eb37c4807f86f4e3ef157a52 Author: Stanislaw Gruszka Date: Wed Apr 28 17:03:15 2010 +0200 mac80211: fix supported rates IE if AP doesn't give us it's rates commit 76f273640134f3eb8257179cd5b3bc6ba5fe4a96 upstream. If AP do not provide us supported rates before assiociation, send all rates we are supporting instead of empty information element. v1 -> v2: Add comment. Signed-off-by: Stanislaw Gruszka Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit b822f6f76c05fd1b82ec876f42dc2001e78bc739 Author: Hiroshi Shimamoto Date: Mon Apr 19 15:32:20 2010 +0000 cxgb3: fix linkup issue commit 9441cad99b4b09d6b627351c2d282833868c116c upstream. I encountered an issue that not to link up on cxgb3 fabric. I bisected and found that this regression was introduced by 0f07c4ee8c800923ae7918c231532a9256233eed. Correct to pass phy_addr to cphy_init() at t3_xaui_direct_phy_prep(). Signed-off-by: Hiroshi Shimamoto Acked-by: Divy Le Ray Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 2e0599997fefee5e8eb8a43e368f6c7b90d0d007 Author: Ben Hutchings Date: Wed Apr 7 20:55:47 2010 -0700 3c503: Fix IRQ probing commit b0cf4dfb7cd21556efd9a6a67edcba0840b4d98d upstream. The driver attempts to select an IRQ for the NIC automatically by testing which of the supported IRQs are available and then probing each available IRQ with probe_irq_{on,off}(). There are obvious race conditions here, besides which: 1. The test for availability is done by passing a NULL handler, which now always returns -EINVAL, thus the device cannot be opened: 2. probe_irq_off() will report only the first ISA IRQ handled, potentially leading to a false negative. There was another bug that meant it ignored all error codes from request_irq() except -EBUSY, so it would 'succeed' despite this (possibly causing conflicts with other ISA devices). This was fixed by ab08999d6029bb2c79c16be5405d63d2bedbdfea 'WARNING: some request_irq() failures ignored in el2_open()', which exposed bug 1. This patch: 1. Replaces the use of probe_irq_{on,off}() with a real interrupt handler 2. Adds a delay before checking the interrupt-seen flag 3. Disables interrupts on all failure paths 4. Distinguishes error codes from the second request_irq() call, consistently with the first Compile-tested only. Signed-off-by: Ben Hutchings Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit fd141e2ec1ce511e5fbade438dc7033440308399 Author: Ben Hutchings Date: Sat May 15 13:45:37 2010 -0300 V4L/DVB: budget: Select correct frontends commit d46b36e7f927772bb72524dc9f1e384e3cb4a975 upstream. Update the Kconfig selections to match the code. Signed-off-by: Ben Hutchings Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit 1d7d5ac68f9d485b77000fd2356bd199b84e806d Author: Shane McDonald Date: Thu May 6 23:26:57 2010 -0600 MIPS FPU emulator: allow Cause bits of FCSR to be writeable by ctc1 commit 95e8f634d7a3ea5af40ec3fa42c8a152fd3a0624 upstream. In the FPU emulator code of the MIPS, the Cause bits of the FCSR register are not currently writeable by the ctc1 instruction. In odd corner cases, this can cause problems. For example, a case existed where a divide-by-zero exception was generated by the FPU, and the signal handler attempted to restore the FPU registers to their state before the exception occurred. In this particular setup, writing the old value to the FCSR register would cause another divide-by-zero exception to occur immediately. The solution is to change the ctc1 instruction emulator code to allow the Cause bits of the FCSR register to be writeable. This is the behaviour of the hardware that the code is emulating. This problem was found by Shane McDonald, but the credit for the fix goes to Kevin Kissell. In Kevin's words: I submit that the bug is indeed in that ctc_op: case of the emulator. The Cause bits (17:12) are supposed to be writable by that instruction, but the CTC1 emulation won't let them be updated by the instruction. I think that actually if you just completely removed lines 387-388 [...] things would work a good deal better. At least, it would be a more accurate emulation of the architecturally defined FPU. If I wanted to be really, really pedantic (which I sometimes do), I'd also protect the reserved bits that aren't necessarily writable. Signed-off-by: Shane McDonald To: anemo@mba.ocn.ne.jp To: kevink@paralogos.com To: sshtylyov@mvista.com Patchwork: http://patchwork.linux-mips.org/patch/1205/ Signed-off-by: Ralf Baechle Cc: Ben Hutchings Signed-off-by: Greg Kroah-Hartman commit 2419d7c7f16ac8d20edacd3bb8b14ae5b4048adc Author: Richard Airlie Date: Mon Apr 5 22:22:46 2010 +0100 staging: rtl8192su: add Support for Belkin F5D8053 v6 commit d615da093eb0f691a73a754589e2a4a24a6f1ca7 upstream. Please find attached a patch which adds the device ID for the Belkin F5D8053 v6 to the rtl8192su driver. I've tested this in 2.6.34-rc3 (Ubuntu 9.10 amd64) and the network adapter is working flawlessly. Signed-off-by: Richard Airlie Cc: Ben Hutchings Signed-off-by: Greg Kroah-Hartman commit aeff222848474b810074b5fdec054fb8f9f2ecef Author: Ayaz Abdulla Date: Tue Apr 13 18:49:51 2010 -0700 forcedeth: fix tx limit2 flag check commit 5c659322a904a7cc0265e7b183372b9bdebec6db upstream. This is a fix for bug 572201 @ bugs.debian.org This patch fixes the TX_LIMIT feature flag. The previous logic check for TX_LIMIT2 also took into account a device that only had TX_LIMIT set. Reported-by: Stephen Mulcahu Reported-by: Ben Huchings Signed-off-by: Ayaz Abdulla Signed-off-by: David S. Miller Cc: Ben Hutchings Signed-off-by: Greg Kroah-Hartman commit 3742bbe7fc8747f5c01568808a4b832c4f0dd16a Author: Jean Delvare Date: Wed May 26 10:05:11 2010 -0300 V4L/DVB: FusionHDTV: Use quick reads for I2C IR device probing commit 806b07c29b711aaf90c81d2a19711607769f8246 upstream. IR support on FusionHDTV cards is broken since kernel 2.6.31. One side effect of the switch to the standard binding model for IR I2C devices was to let i2c-core do the probing instead of the ir-kbd-i2c driver. There is a slight difference between the two probe methods: i2c-core uses 0-byte writes, while the ir-kbd-i2c was using 0-byte reads. As some IR I2C devices only support reads, the new probe method fails to detect them. For now, revert to letting the driver do the probe, using 0-byte reads. In the future, i2c-core will be extended to let callers of i2c_new_probed_device() provide a custom probing function. Signed-off-by: Jean Delvare Tested-by: "Timothy D. Lenz" Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit 10f8b8a554ba0868f747a4e3040a9e3e375449f0 Author: Ang Way Chuang Date: Thu May 27 02:02:09 2010 -0300 V4L/DVB: dvb-core: Fix ULE decapsulation bug commit 5c331fc8c19e181bffab46e9d18e1637cdc47170 upstream. Fix ULE decapsulation bug when less than 4 bytes of ULE SNDU is packed into the remaining bytes of a MPEG2-TS frame ULE (Unidirectional Lightweight Encapsulation RFC 4326) decapsulation code has a bug that incorrectly treats ULE SNDU packed into the remaining 2 or 3 bytes of a MPEG2-TS frame as having invalid pointer field on the subsequent MPEG2-TS frame. Signed-off-by: Ang Way Chuang Acked-by: Jarod Wilson Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman commit 110ba286f6ed622a3ca630b6005b1a2d43b18ca5 Author: Giuliano Pochini Date: Wed Feb 17 00:57:44 2010 +0100 ALSA: Echoaudio, fix Guru Meditation #00000005.48454C50 commit b721e68bdc5b39c51bf6a1469f8d3663fbe03243 upstream. This patch fixes a division by zero error in the irq handler. There is a small window between the hw_params() callback and when runtime->frame_bits is set by ALSA middle layer. When another substream is already running, if an interrupt is delivered during that window the irq handler calls pcm_pointer() which does a division by zero. The patch below makes the irq handler skip substreams that are initialized but not started yet. Cc to Clemens Ladisch because he proposed an alternate fix. For more information, please read the original thread in the linux-kernel mailing list: http://lkml.org/lkml/2010/2/2/187 Signed-off-by: Giuliano Pochini Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 0f95c52733b433566e4e029c600cc9fe194f4a8e Author: Andrej Gelenberg Date: Fri May 14 15:15:58 2010 -0700 revert "[CPUFREQ] remove rwsem lock from CPUFREQ_GOV_STOP call (second call site)" commit accd846698439ba18250e8fd5681af280446b853 upstream. 395913d0b1db37092ea3d9d69b832183b1dd84c5 ("[CPUFREQ] remove rwsem lock from CPUFREQ_GOV_STOP call (second call site)") is not needed, because there is no rwsem lock in cpufreq_ondemand and cpufreq_conservative anymore. Lock should not be released until the work done. Addresses https://bugzilla.kernel.org/show_bug.cgi?id=1594 Signed-off-by: Andrej Gelenberg Cc: Mathieu Desnoyers Cc: Venkatesh Pallipadi Signed-off-by: Andrew Morton Acked-by: Mathieu Desnoyers Signed-off-by: Dave Jones Signed-off-by: Greg Kroah-Hartman commit 725e3ec1822fc30dae921690d3074f540d533c1d Author: David Woodhouse Date: Sun May 2 11:21:21 2010 +0300 firmware_class: fix memory leak - free allocated pages commit dd336c554d8926c3348a2d5f2a5ef5597f6d1a06 upstream. fix memory leak introduced by the patch 6e03a201bbe: firmware: speed up request_firmware() 1. vfree won't release pages there were allocated explicitly and mapped using vmap. The memory has to be vunmap-ed and the pages needs to be freed explicitly 2. page array is moved into the 'struct firmware' so that we can free it from release_firmware() and not only in fw_dev_release() The fix doesn't break the firmware load speed. Cc: Johannes Berg Cc: Ming Lei Cc: Catalin Marinas Singed-off-by: Kay Sievers Signed-off-by: David Woodhouse Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman commit e638333dcda47890094921861f24a2ec859fe0e6 Author: Baruch Siach Date: Mon May 17 17:45:48 2010 -0700 dm9000: fix "BUG: spinlock recursion" commit 380fefb2ddabd4cd5f14dbe090481f0544e65078 upstream. dm9000_set_rx_csum and dm9000_hash_table are called from atomic context (in dm9000_init_dm9000), and from non-atomic context (via ethtool_ops and net_device_ops respectively). This causes a spinlock recursion BUG. Fix this by renaming these functions to *_unlocked for the atomic context, and make the original functions locking wrappers for use in the non-atomic context. Signed-off-by: Baruch Siach Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit d5f15e4bde17db31f399bdd2c2942ad48c134ced Author: Daniel Mack Date: Tue Apr 6 10:52:44 2010 +0200 libertas/sdio: 8686: set ECSI bit for 1-bit transfers commit 8a64c0f6b7ec7f758c4ef445e49f479e27fa2236 upstream. When operating in 1-bit mode, SDAT1 is used as dedicated interrupt line. However, the 8686 will only drive this line when the ECSI bit is set in the CCCR_IF register. Thanks to Alagu Sankar for pointing me in the right direction. Signed-off-by: Daniel Mack Cc: Alagu Sankar Cc: Volker Ernst Cc: Dan Williams Cc: John W. Linville Cc: Holger Schurig Cc: Bing Zhao Cc: libertas-dev@lists.infradead.org Cc: linux-wireless@vger.kernel.org Cc: linux-mmc@vger.kernel.org Acked-by: Dan Williams Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit eb1c6217703d8cbc1c41510e393232a3c06d1a64 Author: Matthew Garrett Date: Tue May 11 13:49:25 2010 -0400 ACPI: Unconditionally set SCI_EN on resume commit b6dacf63e9fb2e7a1369843d6cef332f76fca6a3 upstream. The ACPI spec tells us that the firmware will reenable SCI_EN on resume. Reality disagrees in some cases. The ACPI spec tells us that the only way to set SCI_EN is via an SMM call. https://bugzilla.kernel.org/show_bug.cgi?id=13745 shows us that doing so may break machines. Tracing the ACPI calls made by Windows shows that it unconditionally sets SCI_EN on resume with a direct register write, and therefore the overwhelming probability is that everything is fine with this behaviour. Signed-off-by: Matthew Garrett Tested-by: Rafael J. Wysocki Signed-off-by: Len Brown Cc: Kamal Mostafa Signed-off-by: Greg Kroah-Hartman commit 75676db2d5fe83904ca91c6c40ac81aad54b6493 Author: Len Brown Date: Thu Jul 22 16:54:27 2010 -0400 ACPI: skip checking BM_STS if the BIOS doesn't ask for it commit 718be4aaf3613cf7c2d097f925abc3d3553c0605 upstream. It turns out that there is a bit in the _CST for Intel FFH C3 that tells the OS if we should be checking BM_STS or not. Linux has been unconditionally checking BM_STS. If the chip-set is configured to enable BM_STS, it can retard or completely prevent entry into deep C-states -- as illustrated by turbostat: http://userweb.kernel.org/~lenb/acpi/utils/pmtools/turbostat/ ref: Intel Processor Vendor-Specific ACPI Interface Specification table 4 "_CST FFH GAS Field Encoding" Bit 1: Set to 1 if OSPM should use Bus Master avoidance for this C-state https://bugzilla.kernel.org/show_bug.cgi?id=15886 Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman commit 8f338e228afcdf15faa127ae1c218377218ab44a Author: Ondrej Zary Date: Tue Jun 8 00:32:49 2010 +0200 PM / x86: Save/restore MISC_ENABLE register commit 85a0e7539781dad4bfcffd98e72fa9f130f4e40d upstream. Save/restore MISC_ENABLE register on suspend/resume. This fixes OOPS (invalid opcode) on resume from STR on Asus P4P800-VM, which wakes up with MWAIT disabled. Fixes https://bugzilla.kernel.org/show_bug.cgi?id=15385 Signed-off-by: Ondrej Zary Tested-by: Alan Stern Acked-by: H. Peter Anvin Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman commit e2d2ea45007eec639bf458357d0ee7545d14be52 Author: Michal Hocko Date: Wed Jun 30 09:51:19 2010 +0200 futex: futex_find_get_task remove credentails check commit 7a0ea09ad5352efce8fe79ed853150449903b9f5 upstream. futex_find_get_task is currently used (through lookup_pi_state) from two contexts, futex_requeue and futex_lock_pi_atomic. None of the paths looks it needs the credentials check, though. Different (e)uids shouldn't matter at all because the only thing that is important for shared futex is the accessibility of the shared memory. The credentail check results in glibc assert failure or process hang (if glibc is compiled without assert support) for shared robust pthread mutex with priority inheritance if a process tries to lock already held lock owned by a process with a different euid: pthread_mutex_lock.c:312: __pthread_mutex_lock_full: Assertion `(-(e)) != 3 || !robust' failed. The problem is that futex_lock_pi_atomic which is called when we try to lock already held lock checks the current holder (tid is stored in the futex value) to get the PI state. It uses lookup_pi_state which in turn gets task struct from futex_find_get_task. ESRCH is returned either when the task is not found or if credentials check fails. futex_lock_pi_atomic simply returns if it gets ESRCH. glibc code, however, doesn't expect that robust lock returns with ESRCH because it should get either success or owner died. Signed-off-by: Michal Hocko Acked-by: Darren Hart Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Nick Piggin Cc: Alexey Kuznetsov Cc: Peter Zijlstra Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 624a42cc67a592526c60a93dbcf0a1ed39b58814 Author: Marcelo Tosatti Date: Wed Jun 2 11:26:26 2010 -0300 KVM: read apic->irr with ioapic lock held Read ioapic->irr inside ioapic->lock protected section. KVM-Stable-Tag Signed-off-by: Marcelo Tosatti (cherry picked from comit 07dc7263b99e4ddad2b4c69765a428ccb7d48938) commit 9a7c231ca5905895764203e97f87457ae045f2c0 Author: Marcelo Tosatti Date: Fri May 28 09:44:59 2010 -0300 KVM: MMU: invalidate and flush on spte small->large page size change Always invalidate spte and flush TLBs when changing page size, to make sure different sized translations for the same address are never cached in a CPU's TLB. Currently the only case where this occurs is when a non-leaf spte pointer is overwritten by a leaf, large spte entry. This can happen after dirty logging is disabled on a memslot, for example. Noticed by Andrea. KVM-Stable-Tag Signed-off-by: Marcelo Tosatti Signed-off-by: Avi Kivity (cherry picked from commit 3be2264be3c00865116f997dc53ebcc90fe7fc4b) commit e94be20611f9b27a47adb6b2b47105ee7dffbf74 Author: Joerg Roedel Date: Mon May 17 14:43:35 2010 +0200 KVM: SVM: Implement workaround for Erratum 383 This patch implements a workaround for AMD erratum 383 into KVM. Without this erratum fix it is possible for a guest to kill the host machine. This patch implements the suggested workaround for hypervisors which will be published by the next revision guide update. [jan: fix overflow warning on i386] [xiao: fix unused variable warning] Cc: stable@kernel.org Signed-off-by: Joerg Roedel Signed-off-by: Jan Kiszka Signed-off-by: Xiao Guangrong Signed-off-by: Avi Kivity (cherry picked from commit 67ec66077799f2fef84b21a643912b179c422281) commit 043ea286f289514533d676d9fe66c98a84898910 Author: Joerg Roedel Date: Mon May 17 14:43:34 2010 +0200 KVM: SVM: Handle MCEs early in the vmexit process This patch moves handling of the MC vmexits to an earlier point in the vmexit. The handle_exit function is too late because the vcpu might alreadry have changed its physical cpu. Cc: stable@kernel.org Signed-off-by: Joerg Roedel Signed-off-by: Avi Kivity (cherry picked from commit fe5913e4e1700cbfc337f4b1da9ddb26f6a55586) commit 0c848bde40bcb7e6920c62c8e845d77e90fba27b Author: Avi Kivity Date: Thu May 27 14:35:58 2010 +0300 KVM: MMU: Remove user access when allowing kernel access to gpte.w=0 page If cr0.wp=0, we have to allow the guest kernel access to a page with pte.w=0. We do that by setting spte.w=1, since the host cr0.wp must remain set so the host can write protect pages. Once we allow write access, we must remove user access otherwise we mistakenly allow the user to write the page. Reviewed-by: Xiao Guangrong Signed-off-by: Avi Kivity (cherry picked from commit 69325a122580d3a7b26589e8efdd6663001c3297) commit 59346700ac87134862dc0acd0ab6c9e18cfab577 Author: Ben Hutchings Date: Wed Jul 28 23:53:47 2010 +0100 ethtool: Fix potential user buffer overflow for ETHTOOL_{G, S}RXFH commit bf988435bd5b53529f4408a8efb1f433f6ddfda9 upstream. struct ethtool_rxnfc was originally defined in 2.6.27 for the ETHTOOL_{G,S}RXFH command with only the cmd, flow_type and data fields. It was then extended in 2.6.30 to support various additional commands. These commands should have been defined to use a new structure, but it is too late to change that now. Since user-space may still be using the old structure definition for the ETHTOOL_{G,S}RXFH commands, and since they do not need the additional fields, only copy the originally defined fields to and from user-space. Signed-off-by: Ben Hutchings Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 801d4c511e43f1c0b1536f4dc425521ad8743a12 Author: Corey Minyard Date: Wed Jul 21 08:39:22 2010 -0500 USB: FTDI: Add support for the RT System VX-7 radio programming cable commit fcc6cb789c77ffee31710eec64efeb25f2124f7a upstream. RT Systems has put out bunch of ham radio cables based on the FT232RL chip. Each cable type has a unique PID, this adds one for the Yaesu VX-7 radios. Signed-off-by: Corey Minyard Signed-off-by: Greg Kroah-Hartman commit e938d46ca7fc19cf095f6e9b896e143fd3664a9c Author: Oliver Neukum Date: Wed Jul 14 18:26:22 2010 +0200 USB: add quirk for Broadcom BT dongle commit 63ab71deae67b031045bb28bf8cff45180089f8f upstream. This device needs to be reset when resuming Signed-off-by: Oliver Neukum Signed-off-by: Greg Kroah-Hartman commit ccf2268a3f72322db0b880ce1bd1e0a9d0adddd9 Author: Oliver Neukum Date: Fri Jul 16 17:36:26 2010 +0200 USB: sisusbvga: Fix for USB 3.0 commit 20a12f007feee1cfa761b431047271d1141d8031 upstream. Super speed is also fast enough to let sisusbvga operate. Therefor expand the checks. Signed-off-by: Oliver Neukum Signed-off-by: Greg Kroah-Hartman commit 8dd704a97f95c1cf7f0488ae475d3a05644be385 Author: Paul Mortier Date: Fri Jul 9 13:18:50 2010 +0100 USB: adds Artisman USB dongle to list of quirky devices commit 47f19c0eedb377ad1ee8114f464d001ec5f96a69 upstream. When an attempt is made to read the interface strings of the Artisman Watchdog USB dongle (idVendor:idProduct 04b4:0526) an error is written to the dmesg log (uhci_result_common: failed with status 440000) and the dongle resets itself, resulting in a disconnect/reconnect loop. Adding the dongle to the list of devices in quirks.c, with the same quirk Alan Stern's previous patch for the Saitek Cyborg Gold 3D joystick, stops the device from resetting and allows it to be used with no problems. Signed-off-by: Paul Mortier Signed-off-by: Greg Kroah-Hartman commit 9ded15a9bbd8c03496edb395f0c94ddcb9fbab4c Author: Dennis Jansen Date: Fri Jul 9 22:03:53 2010 +0200 USB: option: Add support for AMOI Skypephone S2 commit 7595931c986f50b1e197ce7b881563e36a7d041e upstream. usbserial: Add AMOI Skypephone S2 support. This patch adds support for the AMOI Skypephone S2 to the usbserial module. Tested-by: Dennis Jansen Signed-off-by: Dennis Jansen Signed-off-by: Greg Kroah-Hartman commit cefbdf8c3dfba0a397ca40335839bc8f6fb2810a Author: Colin Leitner Date: Thu Jul 1 10:49:55 2010 +0200 USB: ftdi_sio: support for Signalyzer tools based on FTDI chips commit 77dbd74e16b566e9d5eeb4be18ae3ee7d5902bd3 upstream. ftdi_sio: support for Signalyzer tools based on FTDI chips This patch adds support for the Xverve Signalyzers. Signed-off-by: Colin Leitner Signed-off-by: Greg Kroah-Hartman commit e07d8d023c85a8eb3e819228589c1a3848944529 Author: august huber Date: Mon Jun 28 11:46:05 2010 -0700 USB: Add PID for Sierra 250U to drivers/usb/serial/sierra.c commit 9d72c81d657340e54a260a3b621f4a9f5b33829c upstream. Add VID/PID for Sierra Wireless 250U USB dongle to sierra.c Allows use of 3G radio only Signed-off-by: August Huber Cc: Elina Pasheva Signed-off-by: Greg Kroah-Hartman commit e2a0f572be39f5cd4d0203527ba5935b66b4b66a Author: Ömer Sezgin Ugurlu Date: Mon Jun 28 19:01:58 2010 +0300 USB: option: add support for 1da5:4518 commit 646d90e2b925578abef5c45853e0b166b6a450bf upstream. Signed-off-by: Omer Sezgin Ugurlu Signed-off-by: Greg Kroah-Hartman commit 85309109179d83d6b1862c269af5fbe353f01997 Author: Wolfram Sang Date: Tue Jun 15 12:34:23 2010 +0200 USB: ehci-mxc: bail out on transceiver problems commit 4c9715de52b9b6256bf1e9510917111a47b0c176 upstream. The old code registered the hcd even if there were no transceivers detected, leading to oopses like this if we try to probe a non-existant ULPI: [ 2.730000] mxc-ehci mxc-ehci.0: unable to init transceiver [ 2.740000] timeout polling for ULPI device [ 2.740000] timeout polling for ULPI device [ 2.750000] mxc-ehci mxc-ehci.0: unable to enable vbus on transceiver [ 2.750000] mxc-ehci mxc-ehci.0: Freescale On-Chip EHCI Host Controller [ 2.760000] mxc-ehci mxc-ehci.0: new USB bus registered, assigned bus number 2 [ 2.770000] Unhandled fault: external abort on non-linefetch (0x808) at 0xc4876184 [ 2.770000] Internal error: : 808 [#1] PREEMPT [ 2.770000] last sysfs file: [ 2.770000] Modules linked in: [ 2.770000] CPU: 0 Not tainted (2.6.33.5 #5) [ 2.770000] PC is at ehci_hub_control+0x4d4/0x8f8 [ 2.770000] LR is at ehci_mxc_setup+0xbc/0xdc [ 2.770000] pc : [] lr : [] psr: 00000093 [ 2.770000] sp : c3815e40 ip : 00000001 fp : 60000013 [ 2.770000] r10: c4876184 r9 : 00000000 r8 : c3814000 [ 2.770000] r7 : c391d2cc r6 : 00000001 r5 : 00000001 r4 : 00000000 [ 2.770000] r3 : 80000000 r2 : 00000007 r1 : 80000000 r0 : c4876184 [ 2.770000] Flags: nzcv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel [ 2.770000] Control: 0005317f Table: a0004000 DAC: 00000017 [ 2.770000] Process swapper (pid: 1, stack limit = 0xc3814270) ... Signed-off-by: Wolfram Sang Cc: Sascha Hauer Acked-by: Daniel Mack Signed-off-by: Greg Kroah-Hartman commit 725861b20b3c1309eb67f46289efcdc9b41ffff8 Author: Jon Povey Date: Mon Jun 14 19:42:10 2010 +0900 USB: g_serial: fix tty cleanup on unload commit b23097b793081358a6d943263c91bae4c955c4e3 upstream. Call put_tty_driver() in cleanup function, to fix Oops when trying to open gadget serial char device after module unload. Signed-off-by: Jon Povey Acked-by: David Brownell Signed-off-by: Greg Kroah-Hartman commit 5592fb92225d302b3e3039ed762bb1e1c55f9eea Author: Jon Povey Date: Mon Jun 14 19:41:04 2010 +0900 USB: g_serial: don't set low_latency flag commit 44a0c0190b500ee6bcfc0976fe540f65dee2cd67 upstream. No longer set low_latency flag as it causes this warning backtrace: WARNING: at kernel/mutex.c:207 __mutex_lock_slowpath+0x6c/0x288() Fix associated locking and wakeups. Signed-off-by: Jon Povey Cc: Maulik Mankad Acked-by: David Brownell Signed-off-by: Greg Kroah-Hartman commit 9956a67b8bad91d9d4729b2e4f8635def41a3cc4 Author: Alan Stern Date: Tue Jun 22 16:14:48 2010 -0400 USB: obey the sysfs power/wakeup setting commit 48826626263d4a61d06fd8c5805da31f925aefa0 upstream. This patch (as1403) is a partial reversion of an earlier change (commit 5f677f1d45b2bf08085bbba7394392dfa586fa8e "USB: fix remote wakeup settings during system sleep"). After hearing from a user, I realized that remote wakeup should be enabled during system sleep whenever userspace allows it, and not only if a driver requests it too. Indeed, there could be a device with no driver, that does nothing but generate a wakeup request when the user presses a button. Such a device should be allowed to do its job. The problem fixed by the earlier patch -- device generating a wakeup request for no reason, causing system suspend to abort -- was also addressed by a later patch ("USB: don't enable remote wakeup by default", accepted but not yet merged into mainline). The device won't be able to generate the bogus wakeup requests because it will be disabled for remote wakeup by default. Hence this reversion will not re-introduce any old problems. Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit 9cfd3b84f5b450e57a6ddbbf22b1a34eab6875ec Author: Stefano Stabellini Date: Wed Jul 21 18:32:37 2010 +0100 x86: Do not try to disable hpet if it hasn't been initialized before commit ff4878089e1eaeac79d57878ad4ea32910fb4037 upstream. hpet_disable is called unconditionally on machine reboot if hpet support is compiled in the kernel. hpet_disable only checks if the machine is hpet capable but doesn't make sure that hpet has been initialized. [ tglx: Made it a one liner and removed the redundant hpet_address check ] Signed-off-by: Stefano Stabellini Acked-by: Venkatesh Pallipadi LKML-Reference: Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit b7806456d7c10c64da49005a911ba0a4998e9d1c Author: Nicolas Pitre Date: Wed Jul 14 05:21:22 2010 +0100 ARM: 6226/1: fix kprobe bug in ldr instruction emulation commit 0ebe25f90cd99bb1bcf622ec8a841421d48380d6 upstream. From: Bin Yang Signed-off-by: Bin Yang Signed-off-by: Nicolas Pitre Signed-off-by: Russell King Signed-off-by: Greg Kroah-Hartman commit c7dd3877b61ae7dc0c5815bba9f61ae0ad98e353 Author: Catalin Marinas Date: Thu Jul 1 13:21:47 2010 +0100 ARM: 6201/1: RealView: Do not use outer_sync() on ARM11MPCore boards with L220 commit 2503a5ecd86c002506001eba432c524ea009fe7f upstream. RealView boards with certain revisions of the L220 cache controller (ARM11* processors only) may have issues (hardware deadlock) with the recent changes to the mb() barrier implementation (DSB followed by an L2 cache sync). The patch redefines the RealView ARM11MPCore mandatory barriers without the outer_sync() call. Tested-by: Linus Walleij Signed-off-by: Catalin Marinas Signed-off-by: Russell King Signed-off-by: Greg Kroah-Hartman commit 2d0c02c7e6ab569c967d56fc94fc8939ed8e2ccf Author: Dmitry Torokhov Date: Tue Jul 20 20:25:35 2010 -0700 Input: twl40300-keypad - fix handling of "all ground" rows commit 3fea60261e73dbf4a51130d40cafcc8465b0f2c3 upstream. The Nokia RX51 board code (arch/arm/mach-omap2/board-rx51-peripherals.c) defines a key map for the matrix keypad keyboard. The hardware seems to use all of the 8 rows and 8 columns of the keypad, although not all possible locations are used. The TWL4030 supports keypads with at most 8 rows and 8 columns. Most keys are defined with a row and column number between 0 and 7, except KEY(0xff, 2, KEY_F9), KEY(0xff, 4, KEY_F10), KEY(0xff, 5, KEY_F11), which represent keycodes that should be emitted when entire row is connected to the ground. since the driver handles this case as if we had an extra column in the key matrix. Unfortunately we do not allocate enough space and end up owerwriting some random memory. Reported-and-tested-by: Laurent Pinchart Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman commit 5905db7eb052d833b05a487d1aace0296c3d419d Author: Kamal Mostafa Date: Mon Jul 19 11:00:52 2010 -0700 Input: i8042 - add Gigabyte Spring Peak to dmi_noloop_table commit 3e1bbc8d5018a05c0793c8a32b777a1396eb4414 upstream. Gigabyte "Spring Peak" notebook indicates wrong chassis-type, tripping up i8042 and breaking the touchpad. Add this model to i8042_dmi_noloop_table[] to resolve. BugLink: https://bugs.launchpad.net/bugs/580664 Signed-off-by: Kamal Mostafa Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman commit 4dcec29dfb7c139ed827d9ee4922f7744db0ac0f Author: Or Gerlitz Date: Sun Jun 6 04:59:16 2010 +0000 IPoIB: Fix world-writable child interface control sysfs attributes commit 7a52b34b07122ff5f45258d47f260f8a525518f0 upstream. Sumeet Lahorani reported that the IPoIB child entries are world-writable; however we don't want ordinary users to be able to create and destroy child interfaces, so fix them to be writable only by root. Signed-off-by: Or Gerlitz Signed-off-by: Roland Dreier Signed-off-by: Greg Kroah-Hartman commit 06f8a4237ecb7b0b65e71f30377c7caa37d1565e Author: Yinghai Lu Date: Thu Jul 15 00:00:59 2010 -0700 x86: Fix x2apic preenabled system with kexec commit fd19dce7ac07973f700b0f13fb7f94b951414a4c upstream. Found one x2apic system kexec loop test failed when CONFIG_NMI_WATCHDOG=y (old) or CONFIG_LOCKUP_DETECTOR=y (current tip) first kernel can kexec second kernel, but second kernel can not kexec third one. it can be duplicated on another system with BIOS preenabled x2apic. First kernel can not kexec second kernel. It turns out, when kernel boot with pre-enabled x2apic, it will not execute disable_local_APIC on shutdown path. when init_apic_mappings() is called in setup_arch, it will skip setting of apic_phys when x2apic_mode is set. ( x2apic_mode is much early check_x2apic()) Then later, disable_local_APIC() will bail out early because !apic_phys. So check !x2apic_mode in x2apic_mode in disable_local_APIC with !apic_phys. another solution could be updating init_apic_mappings() to set apic_phys even for preenabled x2apic system. Actually even for x2apic system, that lapic address is mapped already in early stage. BTW: is there any x2apic preenabled system with apicid of boot cpu > 255? Signed-off-by: Yinghai Lu LKML-Reference: <4C3EB22B.3000701@kernel.org> Acked-by: Suresh Siddha Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit b5cd6d8f6df86bf3db843877b5cfdbb7d6f6c0e3 Author: Mark Brown Date: Sat Jul 17 14:20:17 2010 +0100 ASoC: Remove duplicate AUX definition from WM8776 commit 3c0709396df0869786f83e4b2d2d687c70ee886d upstream. Signed-off-by: Mark Brown Acked-by: Liam Girdwood Signed-off-by: Greg Kroah-Hartman commit cfa1e32f577efbd4955a9caf375f78f1a62f4b9a Author: Anton Vorontsov Date: Tue Jul 20 13:24:27 2010 -0700 edac: mpc85xx: fix MPC85xx dependency commit 1cd8521e7d77def75fdb1cb35ecd135385e4be4f upstream. Since commit 5753c082f66eca5be81f6bda85c1718c5eea6ada ("powerpc/85xx: Kconfig cleanup"), there is no MPC85xx Kconfig symbol anymore, so the driver became non-selectable. This patch fixes the issue by switching to PPC_85xx symbol. Signed-off-by: Anton Vorontsov Cc: Doug Thompson Cc: Peter Tyser Cc: Dave Jiang Cc: Kumar Gala Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 346fafc876d2a54d68a946ac49a08d347a9709cc Author: Marek Szyprowski Date: Tue Jul 20 13:24:33 2010 -0700 sdhci-s3c: add missing remove function commit 9d51a6b2487724e8713cd2794cf09ffeee5f6932 upstream. System will crash sooner or later once the memory with the code of the s3c-sdhci.ko module is reused for something else. I really have no idea how the lack of remove function went unnoticed into the mainline code. Signed-off-by: Marek Szyprowski Signed-off-by: Kyungmin Park Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit c8921c571f69231934880c8f294611c5f1b5e494 Author: Anton Vorontsov Date: Thu Jul 8 21:16:14 2010 +0400 powerpc/cpm1: Fix build with various CONFIG_*_UCODE_PATCH combinations commit 2069a6ae19a34d96cc9cb284eb645b165138e03f upstream. Warnings are treated as errors for arch/powerpc code, so build fails with CONFIG_I2C_SPI_UCODE_PATCH=y: CC arch/powerpc/sysdev/micropatch.o cc1: warnings being treated as errors arch/powerpc/sysdev/micropatch.c: In function 'cpm_load_patch': arch/powerpc/sysdev/micropatch.c:630: warning: unused variable 'smp' make[1]: *** [arch/powerpc/sysdev/micropatch.o] Error 1 And with CONFIG_USB_SOF_UCODE_PATCH=y: CC arch/powerpc/sysdev/micropatch.o cc1: warnings being treated as errors arch/powerpc/sysdev/micropatch.c: In function 'cpm_load_patch': arch/powerpc/sysdev/micropatch.c:629: warning: unused variable 'spp' arch/powerpc/sysdev/micropatch.c:628: warning: unused variable 'iip' make[1]: *** [arch/powerpc/sysdev/micropatch.o] Error 1 This patch fixes these issues by introducing proper #ifdefs. Signed-off-by: Anton Vorontsov Signed-off-by: Kumar Gala Signed-off-by: Greg Kroah-Hartman commit bb5594c805d9b8857fc37a83a2b13ef45ba1a25a Author: Anton Vorontsov Date: Thu Jul 8 21:16:10 2010 +0400 powerpc/cpm: Reintroduce global spi_pram struct (fixes build issue) commit 56825c88ff438f4dbb51a44591cc29e707fe783a upstream. spi_t was removed in commit 644b2a680ccc51a9ec4d6beb12e9d47d2dee98e2 ("powerpc/cpm: Remove SPI defines and spi structs"), the commit assumed that spi_t isn't used anywhere outside of the spi_mpc8xxx driver. But it appears that the struct is needed for micropatch code. So, let's reintroduce the struct. Fixes the following build issue: CC arch/powerpc/sysdev/micropatch.o micropatch.c: In function 'cpm_load_patch': micropatch.c:629: error: expected '=', ',', ';', 'asm' or '__attribute__' before '*' token micropatch.c:629: error: 'spp' undeclared (first use in this function) micropatch.c:629: error: (Each undeclared identifier is reported only once micropatch.c:629: error: for each function it appears in.) Reported-by: LEROY Christophe Reported-by: Tony Breeds Signed-off-by: Anton Vorontsov Signed-off-by: Kumar Gala Signed-off-by: Greg Kroah-Hartman commit 185f2172bd89d83b14cb9e49fc63e6c956338d52 Author: Johannes Berg Date: Wed Jun 16 00:09:35 2010 +0000 powerpc: Fix logic error in fixup_irqs commit 3cd8519248e9e17d982c6fab0f1a89bca6feb49a upstream. When SPARSE_IRQ is set, irq_to_desc() can return NULL. While the code here has a check for NULL, it's not really correct. Fix it by separating the check for it. This fixes CPU hot unplug for me. Reported-by: Alastair Bridgewater Signed-off-by: Johannes Berg Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit 300a7b4c1e3bbb3bd5e5db9af0a059f521f00789 Author: Ben Hutchings Date: Mon Jun 28 08:44:07 2010 +0000 ethtool: Fix potential kernel buffer overflow in ETHTOOL_GRXCLSRLALL commit db048b69037e7fa6a7d9e95a1271a50dc08ae233 upstream. On a 32-bit machine, info.rule_cnt >= 0x40000000 leads to integer overflow and the buffer may be smaller than needed. Since ETHTOOL_GRXCLSRLALL is unprivileged, this can presumably be used for at least denial of service. Signed-off-by: Ben Hutchings Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 43e8821dcc7371661dc7f2afa99dd81555cb99ab Author: Tejun Heo Date: Thu Jun 17 11:42:22 2010 +0200 ahci,ata_generic: let ata_generic handle new MBP w/ MCP89 commit c6353b4520788e34098bbf61c73fb9618ca7fdd6 upstream. For yet unknown reason, MCP89 on MBP 7,1 doesn't work w/ ahci under linux but the controller doesn't require explicit mode setting and works fine with ata_generic. Make ahci ignore the controller on MBP 7,1 and let ata_generic take it for now. Reported in bko#15923. https://bugzilla.kernel.org/show_bug.cgi?id=15923 NVIDIA is investigating why ahci mode doesn't work. Signed-off-by: Tejun Heo Cc: Peer Chen Reported-by: Anders Østhus Reported-by: Andreas Graf Reported-by: Benoit Gschwind Reported-by: Damien Cassou Reported-by: tixetsal@juno.com Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit 5699b0883450cf40ea96ec7d471e1a38b16e9ed7 Author: Joakim Tjernlund Date: Tue Jun 29 15:05:34 2010 -0700 rtc: fix ds1388 time corruption commit 96fc3a45ea073136566f3c2676cad52f8b39a7df upstream. The ds1307 driver misreads the ds1388 registers when checking for 12 or 24 hour mode. Instead of checking the hour register it reads the minute register. Therefore the driver thinks minutes >= 40 has the 12HR bit set and resets the minute register by zeroing the high bits. This results in minutes are reset to 0-9, jumping back in time 40 or 50 minutes. The time jump is also written back to the RTC. Signed-off-by: Joakim Tjernlund Cc: Wan ZongShun Cc: Alessandro Zummo Cc: Paul Gortmaker Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 9b2a1b2780e63fac3728c5251d1e91fe9552cdd1 Author: Dongdong Deng Date: Thu Jun 17 11:13:40 2010 +0800 serial: cpm_uart: implement the cpm_uart_early_write() function for console poll commit 8cd774ad30c22b9d89823f1f05d845f4cdaba9e8 upstream. The cpm_uart_early_write() function which was used for console poll isn't implemented in the cpm uart driver. Implementing this function both fixes the build when CONFIG_CONSOLE_POLL is set and allows kgdboc to work via the cpm uart. Signed-off-by: Dongdong Deng Reviewed-by: Bruce Ashfield Signed-off-by: Greg Kroah-Hartman commit 7abf15d0c7d66d030be0964957555c90155cc21b Author: Jeff Moyer Date: Thu Jun 17 10:19:11 2010 -0400 cfq: Don't allow queue merges for queues that have no process references commit c10b61f0910466b4b99c266a7d76ac4390743fb5 upstream. Hi, A user reported a kernel bug when running a particular program that did the following: created 32 threads - each thread took a mutex, grabbed a global offset, added a buffer size to that offset, released the lock - read from the given offset in the file - created a new thread to do the same - exited The result is that cfq's close cooperator logic would trigger, as the threads were issuing I/O within the mean seek distance of one another. This workload managed to routinely trigger a use after free bug when walking the list of merge candidates for a particular cfqq (cfqq->new_cfqq). The logic used for merging queues looks like this: static void cfq_setup_merge(struct cfq_queue *cfqq, struct cfq_queue *new_cfqq) { int process_refs, new_process_refs; struct cfq_queue *__cfqq; /* Avoid a circular list and skip interim queue merges */ while ((__cfqq = new_cfqq->new_cfqq)) { if (__cfqq == cfqq) return; new_cfqq = __cfqq; } process_refs = cfqq_process_refs(cfqq); /* * If the process for the cfqq has gone away, there is no * sense in merging the queues. */ if (process_refs == 0) return; /* * Merge in the direction of the lesser amount of work. */ new_process_refs = cfqq_process_refs(new_cfqq); if (new_process_refs >= process_refs) { cfqq->new_cfqq = new_cfqq; atomic_add(process_refs, &new_cfqq->ref); } else { new_cfqq->new_cfqq = cfqq; atomic_add(new_process_refs, &cfqq->ref); } } When a merge candidate is found, we add the process references for the queue with less references to the queue with more. The actual merging of queues happens when a new request is issued for a given cfqq. In the case of the test program, it only does a single pread call to read in 1MB, so the actual merge never happens. Normally, this is fine, as when the queue exits, we simply drop the references we took on the other cfqqs in the merge chain: /* * If this queue was scheduled to merge with another queue, be * sure to drop the reference taken on that queue (and others in * the merge chain). See cfq_setup_merge and cfq_merge_cfqqs. */ __cfqq = cfqq->new_cfqq; while (__cfqq) { if (__cfqq == cfqq) { WARN(1, "cfqq->new_cfqq loop detected\n"); break; } next = __cfqq->new_cfqq; cfq_put_queue(__cfqq); __cfqq = next; } However, there is a hole in this logic. Consider the following (and keep in mind that each I/O keeps a reference to the cfqq): q1->new_cfqq = q2 // q2 now has 2 process references q3->new_cfqq = q2 // q2 now has 3 process references // the process associated with q2 exits // q2 now has 2 process references // queue 1 exits, drops its reference on q2 // q2 now has 1 process reference // q3 exits, so has 0 process references, and hence drops its references // to q2, which leaves q2 also with 0 process references q4 comes along and wants to merge with q3 q3->new_cfqq still points at q2! We follow that link and end up at an already freed cfqq. So, the fix is to not follow a merge chain if the top-most queue does not have a process reference, otherwise any queue in the chain could be already freed. I also changed the logic to disallow merging with a queue that does not have any process references. Previously, we did this check for one of the merge candidates, but not the other. That doesn't really make sense. Without the attached patch, my system would BUG within a couple of seconds of running the reproducer program. With the patch applied, my system ran the program for over an hour without issues. This addresses the following bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=16217 Thanks a ton to Phil Carns for providing the bug report and an excellent reproducer. [ Note for stable: this applies to 2.6.32/33/34 ]. Signed-off-by: Jeff Moyer Reported-by: Phil Carns Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman commit 3c6b1576be1d4965b34b5f01179f94669ec6c7e5 Author: Thomas Gleixner Date: Mon Jun 7 17:53:51 2010 +0200 genirq: Deal with desc->set_type() changing desc->chip commit 4673247562e39a17e09440fa1400819522ccd446 upstream. The set_type() function can change the chip implementation when the trigger mode changes. That might result in using an non-initialized irq chip when called from __setup_irq() or when called via set_irq_type() on an already enabled irq. The set_irq_type() function should not be called on an enabled irq, but because we forgot to put a check into it, we have a bunch of users which grew the habit of doing that and it never blew up as the function is serialized via desc->lock against all users of desc->chip and they never hit the non-initialized irq chip issue. The easy fix for the __setup_irq() issue would be to move the irq_chip_set_defaults(desc->chip) call after the trigger setting to make sure that a chip change is covered. But as we have already users, which do the type setting after request_irq(), the safe fix for now is to call irq_chip_set_defaults() from __irq_set_trigger() when desc->set_type() changed the irq chip. It needs a deeper analysis whether we should refuse to change the chip on an already enabled irq, but that'd be a large scale change to fix all the existing users. So that's neither stable nor 2.6.35 material. Reported-by: Esben Haabendal Signed-off-by: Thomas Gleixner Cc: Benjamin Herrenschmidt Cc: linuxppc-dev Signed-off-by: Greg Kroah-Hartman commit 56715eac6f5c8b45214f0a39fca6692fe326575a Author: Alex,Shi Date: Thu Jun 17 14:08:13 2010 +0800 sched: Fix over-scheduling bug commit 3c93717cfa51316e4dbb471e7c0f9d243359d5f8 upstream. Commit e70971591 ("sched: Optimize unused cgroup configuration") introduced an imbalanced scheduling bug. If we do not use CGROUP, function update_h_load won't update h_load. When the system has a large number of tasks far more than logical CPU number, the incorrect cfs_rq[cpu]->h_load value will cause load_balance() to pull too many tasks to the local CPU from the busiest CPU. So the busiest CPU keeps going in a round robin. That will hurt performance. The issue was found originally by a scientific calculation workload that developed by Yanmin. With that commit, the workload performance drops about 40%. CPU before after 00 : 2 : 7 01 : 1 : 7 02 : 11 : 6 03 : 12 : 7 04 : 6 : 6 05 : 11 : 7 06 : 10 : 6 07 : 12 : 7 08 : 11 : 6 09 : 12 : 6 10 : 1 : 6 11 : 1 : 6 12 : 6 : 6 13 : 2 : 6 14 : 2 : 6 15 : 1 : 6 Reviewed-by: Yanmin zhang Signed-off-by: Alex Shi Signed-off-by: Peter Zijlstra LKML-Reference: <1276754893.9452.5442.camel@debian> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit ed8cfec535b4e4b03a01b31e3b0434dd8ff078cc Author: Will Deacon Date: Mon May 24 12:11:43 2010 -0700 sched: Prevent compiler from optimising the sched_avg_update() loop commit 0d98bb2656e9bd2dfda2d089db1fe1dbdab41504 upstream. GCC 4.4.1 on ARM has been observed to replace the while loop in sched_avg_update with a call to uldivmod, resulting in the following build failure at link-time: kernel/built-in.o: In function `sched_avg_update': kernel/sched.c:1261: undefined reference to `__aeabi_uldivmod' kernel/sched.c:1261: undefined reference to `__aeabi_uldivmod' make: *** [.tmp_vmlinux1] Error 1 This patch introduces a fake data hazard to the loop body to prevent the compiler optimising the loop away. Signed-off-by: Will Deacon Signed-off-by: Andrew Morton Acked-by: Peter Zijlstra Cc: Catalin Marinas Cc: Russell King Cc: Linus Torvalds Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 6137b2bb67e74b3da3b124fc2a50bc3405015a9d Author: Darrick J. Wong Date: Wed Jun 30 17:45:19 2010 -0700 x86, Calgary: Limit the max PHB number to 256 commit d596043d71ff0d7b3d0bead19b1d68c55f003093 upstream. The x3950 family can have as many as 256 PCI buses in a single system, so change the limits to the maximum. Since there can only be 256 PCI buses in one domain, we no longer need the BUG_ON check. Signed-off-by: Darrick J. Wong LKML-Reference: <20100701004519.GQ15515@tux1.beaverton.ibm.com> Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit 4e9c6753f6bb961b99cf9671a1136763e857d9c6 Author: Darrick J. Wong Date: Thu Jun 24 14:26:47 2010 -0700 x86, Calgary: Increase max PHB number commit 499a00e92dd9a75395081f595e681629eb1eebad upstream. Newer systems (x3950M2) can have 48 PHBs per chassis and 8 chassis, so bump the limits up and provide an explanation of the requirements for each class. Signed-off-by: Darrick J. Wong Acked-by: Muli Ben-Yehuda Cc: Corinna Schultz LKML-Reference: <20100624212647.GI15515@tux1.beaverton.ibm.com> [ v2: Fixed build bug, added back PHBS_PER_CALGARY == 4 ] Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 342b5e0e33c586b71c72bc1f60eb2fc7ed359f97 Author: Andi Kleen Date: Fri Jun 18 23:09:00 2010 +0200 x86: Fix vsyscall on gcc 4.5 with -Os commit 124482935fb7fb9303c8a8ab930149c6a93d9910 upstream. This fixes the -Os breaks with gcc 4.5 bug. rdtsc_barrier needs to be force inlined, otherwise user space will jump into kernel space and kill init. This also addresses http://gcc.gnu.org/bugzilla/show_bug.cgi?id=44129 I believe. Signed-off-by: Andi Kleen LKML-Reference: <20100618210859.GA10913@basil.fritz.box> Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit c31d368130d2cdfb78096025b503b89e3e49c453 Author: Frederic Weisbecker Date: Wed Jun 30 15:09:06 2010 +0200 x86: Send a SIGTRAP for user icebp traps commit a1e80fafc9f0742a1776a0490258cb64912411b0 upstream. Before we had a generic breakpoint layer, x86 used to send a sigtrap for any debug event that happened in userspace, except if it was caused by lazy dr7 switches. Currently we only send such signal for single step or breakpoint events. However, there are three other kind of debug exceptions: - debug register access detected: trigger an exception if the next instruction touches the debug registers. We don't use it. - task switch, but we don't use tss. - icebp/int01 trap. This instruction (0xf1) is undocumented and generates an int 1 exception. Unlike single step through TF flag, it doesn't set the single step origin of the exception in dr6. icebp then used to be reported in userspace using trap signals but this have been incidentally broken with the new breakpoint code. Reenable this. Since this is the only debug event that doesn't set anything in dr6, this is all we have to check. This fixes a regression in Wine where World Of Warcraft got broken as it uses this for software protection checks purposes. And probably other apps do. Reported-and-tested-by: Alexandre Julliard Signed-off-by: Frederic Weisbecker Cc: Ingo Molnar Cc: H. Peter Anvin Cc: Thomas Gleixner Cc: Prasad Signed-off-by: Greg Kroah-Hartman commit 4747ea09742dc81d8b3f148c293ce8b15e4f99e5 Author: Frederic Weisbecker Date: Thu Jul 8 06:06:17 2010 +0200 perf: Resurrect flat callchains commit 97aa1052739c6a06cb6b0467dbf410613d20bc97 upstream. Initialize the callchain radix tree root correctly. When we walk through the parents, we must stop after the root, but since it wasn't well initialized, its parent pointer was random. Also the number of hits was random because uninitialized, hence it was part of the callchain while the root doesn't contain anything. This fixes segfaults and percentages followed by empty callchains while running: perf report -g flat Reported-by: Ingo Molnar Signed-off-by: Frederic Weisbecker Cc: Peter Zijlstra Cc: Arnaldo Carvalho de Melo Cc: Paul Mackerras Signed-off-by: Greg Kroah-Hartman commit 9c9e12e6e9980e37714f2f85287848d1c102def9 Author: Borislav Petkov Date: Fri Jul 2 17:02:43 2010 +0200 amd64_edac: Fix syndrome calculation on K8 commit 41c310447fe06bcedc22b75752c18b60e0b9521b upstream. When calculating the DCT channel from the syndrome we need to know the syndrome type (x4 vs x8). On F10h, this is read out from extended PCI cfg space register F3x180 while on K8 we only support x4 syndromes and don't have extended PCI config space anyway. Make the code accessing F3x180 F10h only and fall back to x4 syndromes on everything else. Reported-by: Jeffrey Merkey Signed-off-by: Borislav Petkov Signed-off-by: Greg Kroah-Hartman commit 3e45ee788963993dae419cc49f074f441d4c7d66 Author: Ben Hutchings Date: Wed Mar 24 03:36:31 2010 +0000 amd64-agp: Probe unknown AGP devices the right way commit 6fd024893911dcb51b4a0aa71971db5ba38f7071 upstream. The current initialisation code probes 'unsupported' AGP devices simply by calling its own probe function. It does not lock these devices or even check whether another driver is already bound to them. We must use the device core to manage this. So if the specific device id table didn't match anything and agp_try_unsupported=1, switch the device id table and call driver_attach() again. Signed-off-by: Ben Hutchings Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 7788f4675013950f6e7f6b817f620722675c7c16 Author: Prasanna S. Panchamukhi Date: Thu Jun 24 13:31:03 2010 +1000 md: raid10: Fix null pointer dereference in fix_read_error() commit 0544a21db02c1d8883158fd6f323364f830a120a upstream. Such NULL pointer dereference can occur when the driver was fixing the read errors/bad blocks and the disk was physically removed causing a system crash. This patch check if the rcu_dereference() returns valid rdev before accessing it in fix_read_error(). Signed-off-by: Prasanna S. Panchamukhi Signed-off-by: Rob Becker Signed-off-by: NeilBrown Signed-off-by: Greg Kroah-Hartman commit 728ce4de24301efd49417c8ead667f2e906bc6b3 Author: Julia Lawall Date: Sat May 15 11:46:12 2010 +0200 SCSI: aacraid: Eliminate use after free commit 8a52da632ceb9d8b776494563df579e87b7b586b upstream. The debugging code using the freed structure is moved before the kfree. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // @free@ expression E; position p; @@ kfree@p(E) @@ expression free.E, subE<=free.E, E1; position free.p; @@ kfree@p(E) ... ( subE = E1 | * E ) // Signed-off-by: Julia Lawall Signed-off-by: James Bottomley commit 14312cc5aab87a27d9064da50af4192743c1cedf Author: Eric Dumazet Date: Fri Jul 2 10:05:01 2010 +0200 netfilter: ip6t_REJECT: fix a dst leak in ipv6 REJECT commit 499031ac8a3df6738f6186ded9da853e8ea18253 upstream. We should release dst if dst->error is set. Bug introduced in 2.6.14 by commit e104411b82f5c ([XFRM]: Always release dst_entry on error in xfrm_lookup) Signed-off-by: Eric Dumazet Signed-off-by: Patrick McHardy Signed-off-by: Greg Kroah-Hartman commit d8279e0dc5e3e1520bfdad4d24489b606f54dadd Author: stephen hemminger Date: Mon Jun 21 11:00:13 2010 +0000 ipv6: fix NULL reference in proxy neighbor discovery commit 9f888160bdcccf0565dd2774956b8d9456e610be upstream. The addition of TLLAO option created a kernel OOPS regression for the case where neighbor advertisement is being sent via proxy path. When using proxy, ipv6_get_ifaddr() returns NULL causing the NULL dereference. Change causing the bug was: commit f7734fdf61ec6bb848e0bafc1fb8bad2c124bb50 Author: Octavian Purdila Date: Fri Oct 2 11:39:15 2009 +0000 make TLLAO option for NA packets configurable Signed-off-by: Stephen Hemminger Acked-by: YOSHIFUJI Hideaki Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 332fe9dd977051bdef41718836187ad89c95721a Author: Sven Wegener Date: Wed Jun 9 16:10:57 2010 +0200 ipvs: Add missing locking during connection table hashing and unhashing commit aea9d711f3d68c656ad31ab578ecfb0bb5cd7f97 upstream. The code that hashes and unhashes connections from the connection table is missing locking of the connection being modified, which opens up a race condition and results in memory corruption when this race condition is hit. Here is what happens in pretty verbose form: CPU 0 CPU 1 ------------ ------------ An active connection is terminated and we schedule ip_vs_conn_expire() on this CPU to expire this connection. IRQ assignment is changed to this CPU, but the expire timer stays scheduled on the other CPU. New connection from same ip:port comes in right before the timer expires, we find the inactive connection in our connection table and get a reference to it. We proper lock the connection in tcp_state_transition() and read the connection flags in set_tcp_state(). ip_vs_conn_expire() gets called, we unhash the connection from our connection table and remove the hashed flag in ip_vs_conn_unhash(), without proper locking! While still holding proper locks we write the connection flags in set_tcp_state() and this sets the hashed flag again. ip_vs_conn_expire() fails to expire the connection, because the other CPU has incremented the reference count. We try to re-insert the connection into our connection table, but this fails in ip_vs_conn_hash(), because the hashed flag has been set by the other CPU. We re-schedule execution of ip_vs_conn_expire(). Now this connection has the hashed flag set, but isn't actually hashed in our connection table and has a dangling list_head. We drop the reference we held on the connection and schedule the expire timer for timeouting the connection on this CPU. Further packets won't be able to find this connection in our connection table. ip_vs_conn_expire() gets called again, we think it's already hashed, but the list_head is dangling and while removing the connection from our connection table we write to the memory location where this list_head points to. The result will probably be a kernel oops at some other point in time. This race condition is pretty subtle, but it can be triggered remotely. It needs the IRQ assignment change or another circumstance where packets coming from the same ip:port for the same service are being processed on different CPUs. And it involves hitting the exact time at which ip_vs_conn_expire() gets called. It can be avoided by making sure that all packets from one connection are always processed on the same CPU and can be made harder to exploit by changing the connection timeouts to some custom values. Signed-off-by: Sven Wegener Acked-by: Simon Horman Signed-off-by: Patrick McHardy Signed-off-by: Greg Kroah-Hartman commit c19892c6a2feb72130bd5a211fa333766ae49450 Author: Rajiv Andrade Date: Wed Jun 23 12:18:56 2010 -0700 tpm_tis: fix subsequent suspend failures commit 59f6fbe4291fcc078ba26ce4edf8373a7620a13a upstream. Fix subsequent suspends by issuing tpm_continue_selftest during resume. Otherwise, the tpm chip seems to be not fully initialized and will reject the save state command during suspend, thus preventing the whole system to suspend. Addresses https://bugzilla.kernel.org/show_bug.cgi?id=16256 Signed-off-by: Helmut Schaa Signed-off-by: Rajiv Andrade Cc: James Morris Cc: Debora Velarde Cc: David Safford Signed-off-by: Andrew Morton Signed-off-by: James Morris Signed-off-by: Greg Kroah-Hartman commit ce0824b5a9740ac4d18368a224c945a10c680f1c Author: Alex Deucher Date: Sat Mar 6 09:43:41 2010 -0500 drm/radeon/kms: fix legacy tv-out pal mode commit ff3f011cd859072b5d6e64c0b968cff9bfdc0b37 upstream. fixes fdo bug 26915 Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 3e374ad3c8499c492c68d433d772b4a4a82cec23 Author: Alex Deucher Date: Wed Jul 21 19:37:21 2010 -0400 drm/radeon/kms: fix legacy LVDS dpms sequence commit 15cb02c0a0338ee724bf23e31c7c410ecbffeeba upstream. Add delay after turning off the LVDS encoder. Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=16389 Tested-by: Jan Kreuzer Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 8540cb2df9dd831a970cb8099e8d52e299d70db4 Author: Alex Deucher Date: Mon Jul 12 17:33:50 2010 -0400 drm/radeon/kms: fix possible mis-detection of sideport on rs690/rs740 commit 5099fa7f23d3711538cbe9fe072b4ce1ba814035 upstream. Check ulBootUpMemoryClock on AMD IGPs. Fix regression noticed by Torsten Kaiser Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 798271aeb0f2d92ebb7276cac0ce400b851d45b2 Author: Alex Deucher Date: Tue Jul 20 18:07:22 2010 -0400 drm/radeon/kms: add quirk for ASUS HD 3600 board commit e153b70b89770968a704eda0b55707c6066b2d44 upstream. Connector is actually DVI rather than HDMI. Reported-by: trapDoor Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 6698ddd49e632dfb49b093fa73cf9ff0001292dc Author: Alex Deucher Date: Tue Jul 20 11:27:54 2010 -0400 drm/radeon/kms: fix shared ddc harder commit 42f14c4b454946650cf0bf66e0b631d02e328f61 upstream. This fixes a regression caused by b2ea4aa67bfd084834edd070e0a4a47857d6db59 due to the way shared ddc with multiple digital connectors was handled. You generally have two cases where DDC lines are shared: - HDMI + VGA - HDMI + DVI-D HDMI + VGA is easy to deal with because you can check the EDID for the to see if the attached monitor is digital. A shared DDC line with two digital connectors is more complex. You can't use the hdmi bits in the EDID since they may not be there with DVI<->HDMI adapters. In this case all we can do is check the HPD pins to see which is connected as we have no way of knowing using the EDID. Reported-by: trapdoor6@gmail.com Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit ff98d91809b0549418be3e330c848ac0341cf4a1 Author: Alex Deucher Date: Thu Jul 1 10:34:56 2010 -0400 drm/radeon/kms: fix shared ddc handling commit b2ea4aa67bfd084834edd070e0a4a47857d6db59 upstream. Connectors with a shared ddc line can be connected to different encoders. Reported by Pasi Kärkkäinen on dri-devel Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 0ae3910ecbf2147c0b0995ef1778ae6366c36e19 Author: Roland Scheidegger Date: Sat Jun 12 12:12:37 2010 -0400 drm/radeon/kms: CS checker texture fixes for r1xx/r2xx/r3xx commit f9da52d54eb0e8822b5e7f32ab1cfa6522533d6e upstream. fixes: https://bugs.freedesktop.org/show_bug.cgi?id=28459 agd5f: apply to r1xx/r2xx as well. Signed-off-by: Roland Scheidegger Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 9441490acec1ab0d4ebae71550560c23f292872e Author: Roland Scheidegger Date: Sat Jun 12 13:31:11 2010 -0400 drm/radeon/r100/r200: fix calculation of compressed cube maps commit 37cf6b03f9f28c62dafb0b9ce5f1ba29c8baffa9 upstream. This needs similar handling to other compressed textures. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=26428 Signed-off-by: sroland@vmware.com Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 034c536f12a7c02e5069f22e734f276592ec680d Author: Roland Scheidegger Date: Sat Jun 12 13:31:10 2010 -0400 drm/radeon/r200: handle more hw tex coord types commit 688acaa2897462e4c5e2482496e2868db0760809 upstream. Code did not handle projected 2d and depth coordinates, meaning potentially set 3d or cube special handling might stick. (Not sure what depth coord actually does, but I guess handling it like a normal coordinate is the right thing to do.) Might be related to https://bugs.freedesktop.org/show_bug.cgi?id=26428 Signed-off-by: sroland@vmware.com Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 27558fd068f450936cd4b724979a277707053c98 Author: Adam Jackson Date: Fri Jul 2 16:43:30 2010 -0400 drm/i915: Make G4X-style PLL search more permissive commit 6ba770dc5c334aff1c055c8728d34656e0f091e2 upstream. Fixes an Ironlake laptop with a 68.940MHz 1280x800 panel and 120MHz SSC reference clock. More generally, the 0.488% tolerance used before is just too tight to reliably find a PLL setting. I extracted the search algorithm and modified it to find the dot clocks with maximum error over the valid range for the given output type: http://people.freedesktop.org/~ajax/intel_g4x_find_best_pll.c This gave: Worst dotclock for Ironlake DAC refclk is 350000kHz (error 0.00571) Worst dotclock for Ironlake SL-LVDS refclk is 102321kHz (error 0.00524) Worst dotclock for Ironlake DL-LVDS refclk is 219642kHz (error 0.00488) Worst dotclock for Ironlake SL-LVDS SSC refclk is 84374kHz (error 0.00529) Worst dotclock for Ironlake DL-LVDS SSC refclk is 183035kHz (error 0.00488) Worst dotclock for G4X SDVO refclk is 267600kHz (error 0.00448) Worst dotclock for G4X HDMI refclk is 334400kHz (error 0.00478) Worst dotclock for G4X SL-LVDS refclk is 95571kHz (error 0.00449) Worst dotclock for G4X DL-LVDS refclk is 224000kHz (error 0.00510) Signed-off-by: Adam Jackson Signed-off-by: Eric Anholt Signed-off-by: Greg Kroah-Hartman commit 0620e702d1124fedea823389e44a191132306d67 Author: Dave Airlie Date: Tue Jul 20 13:15:31 2010 +1000 drm/i915: enable low power render writes on GEN3 hardware. commit 944001201ca0196bcdb088129e5866a9f379d08c upstream. A lot of 945GMs have had stability issues for a long time, this manifested as X hangs, blitter engine hangs, and lots of crashes. one such report is at: https://bugs.freedesktop.org/show_bug.cgi?id=20560 along with numerous distro bugzillas. This only took a week of digging and hair ripping to figure out. Tracked down and tested on a 945GM Lenovo T60, previously running x11perf -copypixwin500 or x11perf -copywinpix500 repeatedly would cause the GPU to wedge within 4 or 5 tries, with random busy bits set. After this patch no hangs were observed. Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit fac530b7b4a53c5d7b01d3258ee152a4643fb41c Author: Keith Packard Date: Mon Jul 19 21:12:35 2010 -0700 drm/i915: Define MI_ARB_STATE bits commit 45503ded966c98e604c9667c0b458d40666b9ef3 upstream. The i915 memory arbiter has a register full of configuration bits which are currently not defined in the driver header file. Signed-off-by: Keith Packard Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 567b77304b7b93e249b839361e6305ffc952e1ce Author: Daniel J Blueman Date: Mon May 17 14:23:52 2010 +0100 i915: fix lock imbalance on error path... commit f953c9353f5fe6e98fa7f32f51060a74d845b5f8 upstream. While investigating Intel i5 Arrandale GPU lockups with -rc4, I noticed a lock imbalance. Signed-off-by: Daniel J Blueman Signed-off-by: Eric Anholt Signed-off-by: Greg Kroah-Hartman commit affda86f5b2944880f85fef1e5c8425e4353154a Author: Linus Torvalds Date: Sun Jul 18 09:44:37 2010 -0700 drm/i915: add 'reclaimable' to i915 self-reclaimable page allocations commit cd9f040df6ce46573760a507cb88192d05d27d86 upstream. The hibernate issues that got fixed in commit 985b823b9192 ("drm/i915: fix hibernation since i915 self-reclaim fixes") turn out to have been incomplete. Vefa Bicakci tested lots of hibernate cycles, and without the __GFP_RECLAIMABLE flag the system eventually fails to resume. With the flag added, Vefa can apparently hibernate forever (or until he gets bored running his automated scripts, whichever comes first). The reclaimable flag was there originally, and was one of the flags that were dropped (unintentionally) by commit 4bdadb978569 ("drm/i915: Selectively enable self-reclaim") that introduced all these problems, but I didn't want to just blindly add back all the flags in commit 985b823b9192, and it looked like __GFP_RECLAIM wasn't necessary. It clearly was. I still suspect that there is some subtle reason we're missing that causes the problems, but __GFP_RECLAIMABLE is certainly not wrong to use in this context, and is what the code historically used. And we have no idea what the causes the corruption without it. Reported-and-tested-by: M. Vefa Bicakci Cc: Dave Airlie Cc: Chris Wilson Cc: KOSAKI Motohiro Cc: Hugh Dickins Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 13096a4ba6596ca862d1a6eaa0b2e86dd88e1b90 Author: Linus Torvalds Date: Fri Jul 2 10:04:42 2010 +1000 drm/i915: fix hibernation since i915 self-reclaim fixes commit 985b823b919273fe1327d56d2196b4f92e5d0fae upstream. Since commit 4bdadb9785696439c6e2b3efe34aa76df1149c83 ("drm/i915: Selectively enable self-reclaim"), we've been passing GFP_MOVABLE to the i915 page allocator where we weren't before due to some over-eager removal of the page mapping gfp_flags games the code used to play. This caused hibernate on Intel hardware to result in a lot of memory corruptions on resume. See for example http://bugzilla.kernel.org/show_bug.cgi?id=13811 Reported-by: Evengi Golov (in bugzilla) Signed-off-by: Dave Airlie Tested-by: M. Vefa Bicakci Cc: Chris Wilson Cc: KOSAKI Motohiro Cc: Hugh Dickins Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 5a584f5f76f8dd3b22de43d5e6f4c5d3fba99ba3 Author: Jason Baron Date: Tue Jul 27 13:18:01 2010 -0700 dynamic debug: move ddebug_remove_module() down into free_module() commit b82bab4bbe9efa7bc7177fc20620fff19bd95484 upstream. The command echo "file ec.c +p" >/sys/kernel/debug/dynamic_debug/control causes an oops. Move the call to ddebug_remove_module() down into free_module(). In this way it should be called from all error paths. Currently, we are missing the remove if the module init routine fails. Signed-off-by: Jason Baron Reported-by: Thomas Renninger Tested-by: Thomas Renninger Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 2d6be56934d885c0ede350f52bcc1d1718ed8cd7 Author: Joerg Albert Date: Sun Jun 13 14:22:23 2010 +0200 p54pci: add Symbol AP-300 minipci adapters pciid commit 50900f1698f68127e54c67fdfe829e4a97b1be2b upstream. Signed-off-by: Christian Lamparter Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 31f2ec9a89ba61ae1c3cfcd987567f14462a9cb2 Author: Dan Rosenberg Date: Mon Jul 19 16:58:20 2010 -0400 Btrfs: fix checks in BTRFS_IOC_CLONE_RANGE commit 2ebc3464781ad24474abcbd2274e6254689853b5 upstream. 1. The BTRFS_IOC_CLONE and BTRFS_IOC_CLONE_RANGE ioctls should check whether the donor file is append-only before writing to it. 2. The BTRFS_IOC_CLONE_RANGE ioctl appears to have an integer overflow that allows a user to specify an out-of-bounds range to copy from the source file (if off + len wraps around). I haven't been able to successfully exploit this, but I'd imagine that a clever attacker could use this to read things he shouldn't. Even if it's not exploitable, it couldn't hurt to be safe. Signed-off-by: Dan Rosenberg Signed-off-by: Chris Mason Signed-off-by: Greg Kroah-Hartman commit 394c17d4076fe95d0033e6be390629c8fbb6ebdb Author: Javier Cardona Date: Mon Mar 29 11:00:20 2010 -0700 mac80211: Handle mesh action frames in ieee80211_rx_h_action commit 1cb561f83793191cf86a2db3948d28f5f42df9ff upstream. This fixes the problem introduced in commit 8404080568613d93ad7cf0a16dfb68 which broke mesh peer link establishment. changes: v2 Added missing break (Johannes) v3 Broke original patch into two (Johannes) Signed-off-by: Javier Cardona Reviewed-by: Johannes Berg Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 6c5ccedaebdde3f691f7e1057a50caddf7a72220 Author: Stanislaw Gruszka Date: Wed Apr 28 15:17:03 2010 +0200 mac80211: do not wip out old supported rates commit f0b058b61711ebf5be94d6865ca7b2c259b71d37 upstream. Use old supported rates, if AP do not provide supported rates information element in a new managment frame. Signed-off-by: Stanislaw Gruszka Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 6b9fb9cb4dcf339c4e1caded64485c9383b515b4 Author: John W. Linville Date: Mon Jun 14 14:30:25 2010 -0400 iwlwifi: cancel scan watchdog in iwl_bg_abort_scan commit a69b03e941abae00380fc6bc1877fb797a1b31e6 upstream. Avoids this: WARNING: at net/mac80211/scan.c:312 ieee80211_scan_completed+0x5f/0x1f1 [mac80211]() Hardware name: Latitude E5400 Modules linked in: aes_x86_64 aes_generic fuse ipt_MASQUERADE iptable_nat nf_nat rfcomm sco bridge stp llc bnep l2cap sunrpc cpufreq_ondemand acpi_cpufreq freq_table xt_physdev ip6t_REJECT nf_conntrack_ipv6 ip6table_filter ip6_tables ipv6 kvm_intel kvm uinput arc4 ecb snd_hda_codec_intelhdmi snd_hda_codec_idt snd_hda_intel iwlagn snd_hda_codec snd_hwdep snd_seq snd_seq_device iwlcore snd_pcm dell_wmi sdhci_pci sdhci iTCO_wdt tg3 dell_laptop mmc_core i2c_i801 wmi mac80211 snd_timer iTCO_vendor_support btusb joydev dcdbas cfg80211 bluetooth snd soundcore microcode rfkill snd_page_alloc firewire_ohci firewire_core crc_itu_t yenta_socket rsrc_nonstatic i915 drm_kms_helper drm i2c_algo_bit i2c_core video output [last unloaded: scsi_wait_scan] Pid: 979, comm: iwlagn Tainted: G W 2.6.33.3-85.fc13.x86_64 #1 Call Trace: [] warn_slowpath_common+0x77/0x8f [] warn_slowpath_null+0xf/0x11 [] ieee80211_scan_completed+0x5f/0x1f1 [mac80211] [] iwl_bg_scan_completed+0xbb/0x17a [iwlcore] [] worker_thread+0x1a4/0x232 [] ? iwl_bg_scan_completed+0x0/0x17a [iwlcore] [] ? autoremove_wake_function+0x0/0x34 [] ? worker_thread+0x0/0x232 [] kthread+0x7a/0x82 [] kernel_thread_helper+0x4/0x10 [] ? kthread+0x0/0x82 [] ? kernel_thread_helper+0x0/0x10 Reported here: https://bugzilla.redhat.com/show_bug.cgi?id=590436 Signed-off-by: John W. Linville Reported-by: Mihai Harpau Acked-by: Reinette Chatre Signed-off-by: Greg Kroah-Hartman commit 64e012d52956239b87dba94e7d42fd5a1f2a4a5d Author: Dave Airlie Date: Wed Jun 23 11:35:41 2010 +1000 fb: fix colliding defines for fb flags. commit b26c949755c06ec79e55a75817210083bd78fc9a upstream. When I added the flags I must have been using a 25 line terminal and missed the following flags. The collided with flag has one user in staging despite being in-tree for 5 years. I'm happy to push this via my drm tree unless someone really wants to do it. Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 790572057bad5217a989efef7ecbec82b02aa62c Author: Rajiv Andrade Date: Mon Jun 14 13:58:22 2010 -0300 TPM: ReadPubEK output struct fix commit 02a077c52ef7631275a79862ffd9f3dbe9d38bc2 upstream. This patch adds a missing element of the ReadPubEK command output, that prevents future overflow of this buffer when copying the TPM output result into it. Prevents a kernel panic in case the user tries to read the pubek from sysfs. Signed-off-by: Rajiv Andrade Signed-off-by: James Morris Signed-off-by: Greg Kroah-Hartman commit eaec05c31f3964da627b67a6ae0320052651a020 Author: Tim Gardner Date: Tue Jun 8 11:33:02 2010 -0600 hostap: Protect against initialization interrupt commit d6a574ff6bfb842bdb98065da053881ff527be46 upstream. Use an irq spinlock to hold off the IRQ handler until enough early card init is complete such that the handler can run without faulting. Signed-off-by: Tim Gardner Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit c0f998499506a7be35eaa9d9c31a2d5f6ab59cd4 Author: Vivek Natarajan Date: Tue Apr 27 13:05:38 2010 +0530 ath9k: Avoid corrupt frames being forwarded to mac80211. commit 3a37495268ab45507b4cab9d4cb18c5496ab7a10 upstream. If bit 29 is set, MAC H/W can attempt to decrypt the received aggregate with WEP or TKIP, eventhough the received frame may be a CRC failed corrupted frame. If this bit is set, H/W obeys key type in keycache. If it is not set and if the key type in keycache is neither open nor AES, H/W forces key type to be open. But bit 29 should be set to 1 for AsyncFIFO feature to encrypt/decrypt the aggregate with WEP or TKIP. Reported-by: Johan Hovold Signed-off-by: Vivek Natarajan Signed-off-by: Ranga Rao Ravuri Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 6e25e382f5a412040fe635bdc2145694f7c462d8 Author: Luis R. Rodriguez Date: Mon May 10 15:26:27 2010 -0400 ath5k: drop warning on jumbo frames commit 9637e516d16a58b13f6098cfe899e22963132be3 upstream. Jumbo frames are not supported, and if they are seen it is likely a bogus frame so just silently discard them instead of warning on them all time. Also, instead of dropping them immediately though move the check *after* we check for all sort of frame errors. This should enable us to discard these frames if the hardware picks other bogus items first. Lets see if we still get those jumbo counters increasing still with this. Jumbo frames would happen if we tell hardware we can support a small 802.11 chunks of DMA'd frame, hardware would split RX'd frames into parts and we'd have to reconstruct them in software. This is done with USB due to the bulk size but with ath5k we already provide a good limit to hardware and this should not be happening. This is reported quite often and if it fills the logs then this needs to be addressed and to avoid spurious reports. Signed-off-by: Luis R. Rodriguez Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 4de6739e5b78b776f03031017eff53495a4dab96 Author: Trond Myklebust Date: Wed Jun 16 13:57:32 2010 -0400 SUNRPC: Fix a re-entrancy bug in xs_tcp_read_calldir() commit b76ce56192bcf618013fb9aecd83488cffd645cc upstream. If the attempt to read the calldir fails, then instead of storing the read bytes, we currently discard them. This leads to a garbage final result when upon re-entry to the same routine, we read the remaining bytes. Fixes the regression in bugzilla number 16213. Please see https://bugzilla.kernel.org/show_bug.cgi?id=16213 Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit f689133642615209d3c52be3ddc6a63fb359ae6b Author: Trond Myklebust Date: Fri Jun 18 12:23:58 2010 -0400 NFSv4: Ensure that /proc/self/mountinfo displays the minor version number commit 0be8189f2c87fcc747d6a4a657a0b6e2161b2318 upstream. Currently, we do not display the minor version mount parameter in the /proc mount info. Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 8fbe5b6fd07d65fb889cf178b28978b5819f1e12 Author: Trond Myklebust Date: Tue Jun 22 08:52:39 2010 -0400 NFSv4: Fix an embarassing typo in encode_attrs() commit d3f6baaa34c54040b3ef30950e59b54ac0624b21 upstream. Apparently, we have never been able to set the atime correctly from the NFSv4 client. Reported-by: 小倉一夫 Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 3c5cbd2907f3fe594b54e766b680d0ea8be40966 Author: Mikulas Patocka Date: Tue Apr 6 16:43:33 2010 -0700 ide: Fix IDE taskfile with cfq scheduler commit 720fc22a7af79d91ec460c80efa92c65c12d105e upstream. When ide taskfile access is being used (for example with hdparm --security commands) and cfq scheduler is selected, the scheduler crashes on BUG in cfq_put_request. The reason is that the cfq scheduler is tracking counts of read and write requests separately; the ide-taskfile subsystem allocates a read request and then flips the flag to make it a write request. The counters in cfq will mismatch. This patch changes ide-taskfile to allocate the READ or WRITE request as required and don't change the flag later. Signed-off-by: Mikulas Patocka Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit e62a6abd1c6c56944c39dd4cda1b33cbdf8397ab Author: Sergei Shtylyov Date: Tue May 11 00:08:03 2010 -0700 cmd640: fix kernel oops in test_irq() method commit a9ddabc52ce3757a4331d6c1e8bf4065333cc51b upstream. When implementing the test_iqr() method, I forgot that this driver is not an ordinary PCI driver and also needs to support VLB variant of the chip. Moreover, 'hwif->dev' should be NULL, potentially causing oops in pci_read_config_byte(). Signed-off-by: Sergei Shtylyov Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit e044f44d2971649aa42c1d589d5382ef76b1303b Author: Mikael Pettersson Date: Tue Jul 20 18:45:14 2010 -0700 math-emu: correct test for downshifting fraction in _FP_FROM_INT() commit f8324e20f8289dffc646d64366332e05eaacab25 upstream. The kernel's math-emu code contains a macro _FP_FROM_INT() which is used to convert an integer to a raw normalized floating-point value. It does this basically in three steps: 1. Compute the exponent from the number of leading zero bits. 2. Downshift large fractions to put the MSB in the right position for normalized fractions. 3. Upshift small fractions to put the MSB in the right position. There is an boundary error in step 2, causing a fraction with its MSB exactly one bit above the normalized MSB position to not be downshifted. This results in a non-normalized raw float, which when packed becomes a massively inaccurate representation for that input. The impact of this depends on a number of arch-specific factors, but it is known to have broken emulation of FXTOD instructions on UltraSPARC III, which was originally reported as GCC bug 44631 . Any arch which uses math-emu to emulate conversions from integers to same-size floats may be affected. The fix is simple: the exponent comparison used to determine if the fraction should be downshifted must be "<=" not "<". I'm sending a kernel module to test this as a reply to this message. There are also SPARC user-space test cases in the GCC bug entry. Signed-off-by: Mikael Pettersson Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit f6765583a6c357428a559d50b5eef4f0420cf5fd Author: Rob Landley Date: Sat Mar 27 08:36:18 2010 -0700 sparc: Fix use of uid16_t and gid16_t in asm/stat.h commit 7469a9acf919d36836f6c635099d8edc9be4528a upstream. Signed-off-by: Rob Landley Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 0a9f8b4059504bbf26e336b843972cedd17d23e0 Author: Doug Kehn Date: Wed Jul 14 18:02:16 2010 -0700 net/core: neighbour update Oops commit 91a72a70594e5212c97705ca6a694bd307f7a26b upstream. When configuring DMVPN (GRE + openNHRP) and a GRE remote address is configured a kernel Oops is observed. The obserseved Oops is caused by a NULL header_ops pointer (neigh->dev->header_ops) in neigh_update_hhs() when void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *) = neigh->dev->header_ops->cache_update; is executed. The dev associated with the NULL header_ops is the GRE interface. This patch guards against the possibility that header_ops is NULL. This Oops was first observed in kernel version 2.6.26.8. Signed-off-by: Doug Kehn Acked-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 8b788148700f031c4f42ebd091e22d86ed3fcb71 Author: Ilpo Järvinen Date: Mon Jul 19 01:16:18 2010 +0000 tcp: fix crash in tcp_xmit_retransmit_queue commit 45e77d314585869dfe43c82679f7e08c9b35b898 upstream. It can happen that there are no packets in queue while calling tcp_xmit_retransmit_queue(). tcp_write_queue_head() then returns NULL and that gets deref'ed to get sacked into a local var. There is no work to do if no packets are outstanding so we just exit early. This oops was introduced by 08ebd1721ab8fd (tcp: remove tp->lost_out guard to make joining diff nicer). Signed-off-by: Ilpo Järvinen Reported-by: Lennart Schulte Tested-by: Lennart Schulte Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 47f13456eadc6b8cf591bd7ab11ed829c4af4b55 Author: Tom Herbert Date: Wed Jul 14 20:50:29 2010 -0700 net: fix problem in reading sock TX queue commit b0f77d0eae0c58a5a9691a067ada112ceeae2d00 upstream. Fix problem in reading the tx_queue recorded in a socket. In dev_pick_tx, the TX queue is read by doing a check with sk_tx_queue_recorded on the socket, followed by a sk_tx_queue_get. The problem is that there is not mutual exclusion across these calls in the socket so it it is possible that the queue in the sock can be invalidated after sk_tx_queue_recorded is called so that sk_tx_queue get returns -1, which sets 65535 in queue_index and thus dev_pick_tx returns 65536 which is a bogus queue and can cause crash in dev_queue_xmit. We fix this by only calling sk_tx_queue_get which does the proper checks. The interface is that sk_tx_queue_get returns the TX queue if the sock argument is non-NULL and TX queue is recorded, else it returns -1. sk_tx_queue_recorded is no longer used so it can be completely removed. Signed-off-by: Tom Herbert Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit af0216e8d8f1c2f8dade974a4db6cb08b732b484 Author: Brandon Philips Date: Wed Jun 16 16:21:58 2010 +0000 sky2: enable rx/tx in sky2_phy_reinit() commit 38000a94a902e94ca8b5498f7871c6316de8957a upstream. sky2_phy_reinit is called by the ethtool helpers sky2_set_settings, sky2_nway_reset and sky2_set_pauseparam when netif_running. However, at the end of sky2_phy_init GM_GP_CTRL has GM_GPCR_RX_ENA and GM_GPCR_TX_ENA cleared. So, doing these commands causes the device to stop working: $ ethtool -r eth0 $ ethtool -A eth0 autoneg off Fix this issue by enabling Rx/Tx after running sky2_phy_init in sky2_phy_reinit. Signed-off-by: Brandon Philips Tested-by: Brandon Philips Cc: stable@kernel.org Tested-by: Mike McCormack Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit e5f6f6e9c836a340ea654d164f3dcfaadd19eba8 Author: Florian Fainelli Date: Sun Jun 20 22:07:48 2010 +0000 cpmac: do not leak struct net_device on phy_connect errors commit ed770f01360b392564650bf1553ce723fa46afec upstream. If the call to phy_connect fails, we will return directly instead of freeing the previously allocated struct net_device. Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 24319a0851e4f6ee9a88624b2995834ee2c9a291 Author: Luke Yelavich Date: Tue Jun 22 11:04:19 2010 +1000 ALSA: hda - Add Macbook 5,2 quirk commit 3bfea98ff73d377ffce0d4c7f938b7ef958cdb35 upstream. BugLink: https://bugs.launchpad.net/bugs/463178 Set Macbook 5,2 (106b:4a00) hardware to use ALC885_MB5 Signed-off-by: Luke Yelavich Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 9603eda11d1d793f621e28c3e7bc0d25748142ee Author: David Howells Date: Thu Jul 22 12:53:18 2010 +0100 CIFS: Fix a malicious redirect problem in the DNS lookup code commit 4c0c03ca54f72fdd5912516ad0a23ec5cf01bda7 upstream. Fix the security problem in the CIFS filesystem DNS lookup code in which a malicious redirect could be installed by a random user by simply adding a result record into one of their keyrings with add_key() and then invoking a CIFS CFS lookup [CVE-2010-2524]. This is done by creating an internal keyring specifically for the caching of DNS lookups. To enforce the use of this keyring, the module init routine creates a set of override credentials with the keyring installed as the thread keyring and instructs request_key() to only install lookup result keys in that keyring. The override is then applied around the call to request_key(). This has some additional benefits when a kernel service uses this module to request a key: (1) The result keys are owned by root, not the user that caused the lookup. (2) The result keys don't pop up in the user's keyrings. (3) The result keys don't come out of the quota of the user that caused the lookup. The keyring can be viewed as root by doing cat /proc/keys: 2a0ca6c3 I----- 1 perm 1f030000 0 0 keyring .dns_resolver: 1/4 It can then be listed with 'keyctl list' by root. # keyctl list 0x2a0ca6c3 1 key in keyring: 726766307: --alswrv 0 0 dns_resolver: foo.bar.com Signed-off-by: David Howells Reviewed-and-Tested-by: Jeff Layton Acked-by: Steve French Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit e25e90d738f0094bddc1f859237ee34d1e01a839 Author: Jeff Layton Date: Tue Jun 1 16:21:01 2010 -0400 cifs: don't attempt busy-file rename unless it's in same directory commit ed0e3ace576d297a5c7015401db1060bbf677b94 upstream. Busy-file renames don't actually work across directories, so we need to limit this code to renames within the same dir. This fixes the bug detailed here: https://bugzilla.redhat.com/show_bug.cgi?id=591938 Signed-off-by: Jeff Layton Signed-off-by: Steve French Signed-off-by: Greg Kroah-Hartman commit 56c3c8412e8aa1b0b2a515824c341fa691731440 Author: Jeff Layton Date: Wed Jun 16 13:40:18 2010 -0400 cifs: remove bogus first_time check in NTLMv2 session setup code commit 8a224d489454b7457105848610cfebebdec5638d upstream. This bug appears to be the result of a cut-and-paste mistake from the NTLMv1 code. The function to generate the MAC key was commented out, but not the conditional above it. The conditional then ended up causing the session setup key not to be copied to the buffer unless this was the first session on the socket, and that made all but the first NTLMv2 session setup fail. Fix this by removing the conditional and all of the commented clutter that made it difficult to see. Reported-by: Gunther Deschner Signed-off-by: Jeff Layton Signed-off-by: Greg Kroah-Hartman commit 8550917e18a739667371a35e8c9237dff641f68d Author: Jean Delvare Date: Fri Jul 9 16:22:48 2010 +0200 hwmon: (it87) Fix in7 on IT8720F commit 436cad2a41a40c6c32bd9152b63d17eeb1f7c99b upstream. The IT8720F has no VIN7 pin, so VCCH should always be routed internally to VIN7 with an internal divider. Curiously, there still is a configuration bit to control this, which means it can be set incorrectly. And even more curiously, many boards out there are improperly configured, even though the IT8720F datasheet claims that the internal routing of VCCH to VIN7 is the default setting. So we force the internal routing in this case. It turns out that all boards with the wrong setting are from Gigabyte, so I suspect a BIOS bug. But it's easy enough to workaround in the driver, so let's do it. Signed-off-by: Jean Delvare Cc: Jean-Marc Spaggiari Signed-off-by: Greg Kroah-Hartman commit 68e5c88f53917ac48feae1dffa3b7dc242331f91 Author: Jean Delvare Date: Fri Jul 9 16:22:49 2010 +0200 hwmon: (coretemp) Skip duplicate CPU entries commit d883b9f0977269d519469da72faec6a7f72cb489 upstream. On hyper-threaded CPUs, each core appears twice in the CPU list. Skip the second entry to avoid duplicate sensors. Signed-off-by: Jean Delvare Acked-by: Huaxu Wan Signed-off-by: Greg Kroah-Hartman commit 0164d158656ab6610eb42cdcbc538f2b143f2c58 Author: Jean Delvare Date: Fri Jul 9 16:22:51 2010 +0200 hwmon: (coretemp) Properly label the sensors commit 3f4f09b4be35d38d6e2bf22c989443e65e70fc4c upstream. Don't assume that CPU entry number and core ID always match. It worked in the simple cases (single CPU, no HT) but fails on multi-CPU systems. Signed-off-by: Jean Delvare Acked-by: Huaxu Wan Signed-off-by: Greg Kroah-Hartman commit a4efa00c1d20c019cb3a40fe4a674d90a4ddccb5 Author: Jean Delvare Date: Sun Jun 20 09:22:31 2010 +0200 hwmon: (k10temp) Do not blacklist known working CPU models commit eefc2d9e3d4f8820f2c128a0e44a23de28b1ed64 upstream. When detecting AM2+ or AM3 socket with DDR2, only blacklist cores which are known to exist in AM2+ format. Signed-off-by: Jean Delvare Acked-by: Clemens Ladisch Cc: Andreas Herrmann Signed-off-by: Greg Kroah-Hartman commit 24245c932dac45c195b59a870e44c5d526d311af Author: Andreas Herrmann Date: Fri Jul 9 16:22:47 2010 +0200 hwmon: (k8temp) Fix temperature reporting for ASB1 processor revisions commit d535bad90dad4eb42ec6528043fcfb53627d4f89 upstream. Reported temperature for ASB1 CPUs is too high. Add ASB1 CPU revisions (these are also non-desktop variants) to the list of CPUs for which the temperature fixup is not required. Example: (from LENOVO ThinkPad Edge 13, 01972NG, system was idle) Current kernel reports $ sensors k8temp-pci-00c3 Adapter: PCI adapter Core0 Temp: +74.0 C Core0 Temp: +70.0 C Core1 Temp: +69.0 C Core1 Temp: +70.0 C With this patch I have $ sensors k8temp-pci-00c3 Adapter: PCI adapter Core0 Temp: +54.0 C Core0 Temp: +51.0 C Core1 Temp: +48.0 C Core1 Temp: +49.0 C Cc: Rudolf Marek Signed-off-by: Andreas Herrmann Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit 26c3091e6129c131d4e0afe9ab8f240b45f47fcb Author: Jean Delvare Date: Sun Jun 20 09:22:32 2010 +0200 hwmon: (k8temp) Bypass core swapping on single-core processors commit cd4de21f7e65a8cd04860f5661b3c18648ee52a1 upstream. Commit a2e066bba2aad6583e3ff648bf28339d6c9f0898 introduced core swapping for CPU models 64 and later. I recently had a report about a Sempron 3200+, model 95, for which this patch broke temperature reading. It happens that this is a single-core processor, so the effect of the swapping was to read a temperature value for a core that didn't exist, leading to an incorrect value (-49 degrees C.) Disabling core swapping on singe-core processors should fix this. Additional comment from Andreas: The BKDG says Thermal Sensor Core Select (ThermSenseCoreSel)-Bit 2. This bit selects the CPU whose temperature is reported in the CurTemp field. This bit only applies to dual core processors. For single core processors CPU0 Thermal Sensor is always selected. k8temp_probe() correctly detected that SEL_CORE can't be used on single core CPU. Thus k8temp did never update the temperature values stored in temp[1][x] and -49 degrees was reported. For single core CPUs we must use the values read into temp[0][x]. Signed-off-by: Jean Delvare Tested-by: Rick Moritz Acked-by: Andreas Herrmann Signed-off-by: Greg Kroah-Hartman commit 6fb037c2ed8378c7ab0c1e00536ba6b2a866503e Author: Christoph Fritz Date: Sun Jul 11 18:26:15 2010 -0500 ssb: Handle Netbook devices where the SPROM address is changed For some Netbook computers with Broadcom BCM4312 wireless interfaces, the SPROM has been moved to a new location. When the ssb driver tries to read the old location, the systems hangs when trying to read a non-existent location. Such freezes are particularly bad as they do not log the failure. This patch is modified from commit da1fdb02d9200ff28b6f3a380d21930335fe5429 with some pieces from other mainline changes so that it can be applied to stable 2.6.34.Y. Signed-off-by: Larry Finger Signed-off-by: Greg Kroah-Hartman commit e5f98e5c9f479a909d8510d46bd4874161a1c0b3 Author: Eric Dumazet Date: Mon Jul 5 22:12:53 2010 -0700 veth: Dont kfree_skb() after dev_forward_skb() [ Upstream commit 6ec82562ffc6f297d0de36d65776cff8e5704867 ] In case of congestion, netif_rx() frees the skb, so we must assume dev_forward_skb() also consume skb. Bug introduced by commit 445409602c092 (veth: move loopback logic to common location) We must change dev_forward_skb() to always consume skb, and veth to not double free it. Bug report : http://marc.info/?l=linux-netdev&m=127310770900442&w=3 Reported-by: Martín Ferrari Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit e1d08ba9d511d0152eaa80c6a460fdbd48926e12 Author: Eric Dumazet Date: Thu Jun 3 05:45:47 2010 +0000 tcp: use correct net ns in cookie_v4_check() [ Upstream commit c44649216522cd607a4027d2ebf4a8147d3fa94c ] Its better to make a route lookup in appropriate namespace. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 405c78fbc09ad80514e75fc76cafc30342a74437 Author: Eric Dumazet Date: Mon May 17 22:35:36 2010 -0700 tcp: tcp_synack_options() fix [ Upstream commit de213e5eedecdfb1b1eea7e6be28bc64cac5c078 ] Commit 33ad798c924b4a (tcp: options clean up) introduced a problem if MD5+SACK+timestamps were used in initial SYN message. Some stacks (old linux for example) try to negotiate MD5+SACK+TSTAMP sessions, but since 40 bytes of tcp options space are not enough to store all the bits needed, we chose to disable timestamps in this case. We send a SYN-ACK _without_ timestamp option, but socket has timestamps enabled and all further outgoing messages contain a TS block, all with the initial timestamp of the remote peer. Fix is to really disable timestamps option for the whole session. Reported-by: Bijay Singh Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 2d99271ad7754c30d3b1a51a5c010fe325964064 Author: Timo Teräs Date: Mon Jul 5 22:05:02 2010 -0700 r8169: fix mdio_read and update mdio_write according to hw specs [ Upstream commit 81a95f049962ec20a9aed888e676208b206f0f2e ] Realtek confirmed that a 20us delay is needed after mdio_read and mdio_write operations. Reduce the delay in mdio_write, and add it to mdio_read too. Also add a comment that the 20us is from hw specs. Signed-off-by: Timo Teräs Acked-by: Francois Romieu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 6468dd3e5de409cae58859bf574ad3a18887e24f Author: Timo Teräs Date: Mon Jul 5 22:04:45 2010 -0700 r8169: fix random mdio_write failures [ Upstream commit 024a07bacf8287a6ddfa83e9d5b951c5e8b4070e ] Some configurations need delay between the "write completed" indication and new write to work reliably. Realtek driver seems to use longer delay when polling the "write complete" bit, so it waits long enough between writes with high probability (but could probably break too). This patch adds a new udelay to make sure we wait unconditionally some time after the write complete indication. This caused a regression with XID 18000000 boards when the board specific phy configuration writing many mdio registers was added in commit 2e955856ff (r8169: phy init for the 8169scd). Some of the configration mdio writes would almost always fail, and depending on failure might leave the PHY in non-working state. Signed-off-by: Timo Teräs Acked-off-by: Francois Romieu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit a71b898b7991ab2453a4084e8957b5aa60ff4985 Author: Tadashi Abe Date: Mon May 17 22:41:45 2010 -0700 pegasus: fix USB device ID for ETX-US2 [ Upstream commit 95718c1c25370b2c85061a4d8dfab2831b3ad280 ] USB device ID definition for I-O Data ETX-US2 is wrong. Correct ID is 0x093a. Here's snippet from /proc/bus/usb/devices; T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ff(vend.) Sub=ff Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=04bb ProdID=093a Rev= 1.01 S: Manufacturer=I-O DATA DEVICE,INC. S: Product=I-O DATA ETX2-US2 S: SerialNumber=A26427 C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=224mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=00 Driver=pegasus E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 8 Ivl=125us This patch enables pegasus driver to work fine with ETX-US2. Signed-off-by: Tadashi Abe Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 36632386143cfa4deabaec2033c9c67aae7f4d5a Author: David S. Miller Date: Mon May 10 04:59:07 2010 -0700 net: Fix FDDI and TR config checks in ipv4 arp and LLC. [ Upstream commit f0ecde1466f21edf577b809735f4f35f354777a0 ] Need to check both CONFIG_FOO and CONFIG_FOO_MODULE Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 69bae45922d9df8d922d884ddcf1d3c49bd1ba56 Author: David S. Miller Date: Mon May 3 23:42:27 2010 -0700 ipv6: Fix default multicast hops setting. [ Upstream commit f935aa9e99d6ec74a50871c120e6b21de7256efb ] As per RFC 3493 the default multicast hops setting for a socket should be "1" just like ipv4. Ironically we have a IPV6_DEFAULT_MCASTHOPS macro it just wasn't being used. Reported-by: Elliot Hughes Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 8a8641620981ea60268d86b1d8107160ff0ab4d5 Author: Herbert Xu Date: Thu May 20 23:07:56 2010 -0700 gro: Fix bogus gso_size on the first fraglist entry [ Upstream commit 622e0ca1cd4d459f5af4f2c65f4dc0dd823cb4c3 ] When GRO produces fraglist entries, and the resulting skb hits an interface that is incapable of TSO but capable of FRAGLIST, we end up producing a bogus packet with gso_size non-zero. This was reported in the field with older versions of KVM that did not set the TSO bits on tuntap. This patch fixes that. Reported-by: Igor Zhang Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 6e6f920379266f7b5500be5a9f4236e0ffa546c5 Author: Yoichi Yuasa Date: Mon May 24 18:37:02 2010 -0700 net/dccp: expansion of error code size [ Upstream commit d9b52dc6fd1fbb2bad645cbc86a60f984c1cb179 ] Because MIPS's EDQUOT value is 1133(0x46d). It's larger than u8. Signed-off-by: Yoichi Yuasa Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 13c9cff2a116c5de742c9713e4c8351717adc8b3 Author: stephen hemminger Date: Tue Jun 15 06:14:12 2010 +0000 bridge: fdb cleanup runs too often [ Upstream commit 25442e06d20aaba7d7b16438078a562b3e4cf19b ] It is common in end-node, non STP bridges to set forwarding delay to zero; which causes the forwarding database cleanup to run every clock tick. Change to run only as soon as needed or at next ageing timer interval which ever is sooner. Use round_jiffies_up macro rather than attempting round up by changing value. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman