commit db49cf204b56e7f067063a4c47a704eaf9a381ed Author: Greg Kroah-Hartman Date: Mon Sep 20 13:59:09 2010 -0700 Linux 2.6.35.5 commit d3ad7717c9fbfd738308b39d47bf830aad23f408 Author: Chris Wilson Date: Thu Sep 9 09:41:32 2010 +0100 drm: Only decouple the old_fb from the crtc is we call mode_set* commit 356ad3cd616185631235ffb48b3efbf39f9923b3 upstream. Otherwise when disabling the output we switch to the new fb (which is likely NULL) and skip the call to mode_set -- leaking driver private state on the old_fb. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=29857 Reported-by: Sitsofe Wheeler Signed-off-by: Chris Wilson Cc: Dave Airlie Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 7e8ceff067f0482ee15a7b0b944f958a00a3fac3 Author: Chris Wilson Date: Tue Sep 7 23:39:28 2010 +0100 Revert "drm/i915: Allow LVDS on pipe A on gen4+" commit 12e8ba25ef52f19e7a42e61aecb3c1fef83b2a82 upstream. This reverts commit 0f3ee801b332d6ff22285386675fe5aaedf035c3. Enabling LVDS on pipe A was causing excessive wakeups on otherwise idle systems due to i915 interrupts. So restrict the LVDS to pipe B once more, whilst the issue is properly diagnosed. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=16307 Reported-and-tested-by: Enrico Bandiello Poked-by: Florian Mickler Signed-off-by: Chris Wilson Cc: Adam Jackson Signed-off-by: Greg Kroah-Hartman commit d9a9ffcc0d6d47bb0bdea19fc8e37577da3ee8bb Author: Jesse Barnes Date: Thu Sep 9 11:58:02 2010 -0700 drm/i915: don't enable self-refresh on Ironlake commit dd8849c8f59ec1cee4809a0c5e603e045abe860e upstream. We don't know how to enable it safely, especially as outputs turn on and off. When disabling LP1 we also need to make sure LP2 and 3 are already disabled. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=29173 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=29082 Reported-by: Chris Lord Signed-off-by: Jesse Barnes Tested-by: Daniel Vetter Signed-off-by: Chris Wilson Signed-off-by: Greg Kroah-Hartman commit 2a0726e890af8f37f039cbec69b7c4f422e5ddf7 Author: Chris Wilson Date: Mon Sep 6 16:17:22 2010 +0100 drm/i915: Prevent double dpms on commit 032d2a0d068b0368296a56469761394ef03207c3 upstream. Arguably this is a bug in drm-core in that we should not be called twice in succession with DPMS_ON, however this is still occuring and we see FDI link training failures on the second call leading to the occassional blank display. For the time being ignore the repeated call. Original patch by Dave Airlie Signed-off-by: Chris Wilson Signed-off-by: Greg Kroah-Hartman commit d3899a1634c427dbc7c43a6133b126a58c66a934 Author: Daniel Vetter Date: Mon Aug 30 21:25:23 2010 +0200 drm/i915: overlay on gen2 can't address above 1G commit 9f82d23846146990d475f6753be733e55788d88d upstream. So set the coherent dma mask accordingly. This dma mask is only used for physical objects, so it won't really matter allocation-wise. Now this never really surfaced because sane 32bit kernels only have 1G of lowmem. But some eager testers (distros?) still carry around the patch to adjust lowmem via a kconfig option. And the kernel seems to favour high allocations on boot-up, hence the overlay blowing up reliably. Because the patch is tiny and nicely shows how broken gen2 is it's imho worth to merge despite the fact that mucking around with the lowmem/ highmem division is (no longer) supported. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=28318 Signed-off-by: Daniel Vetter Signed-off-by: Chris Wilson Signed-off-by: Greg Kroah-Hartman commit 3eef1e7f9a6569add20ce16afdf52aca42661997 Author: Chris Wilson Date: Fri Aug 20 14:36:45 2010 +0100 drm/i915: Allocate the PCI resource for the MCHBAR commit a25c25c2a2aa55e609099a9f74453c518aec29a6 upstream. We were failing when trying to allocate the resource for MMIO of the MCHBAR because we forgot to specify what type of resource we wanted. Signed-off-by: Chris Wilson Cc: Jesse Barnes Reviewed-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman commit 1c6fd63ca08484ee60853bd17ba18dd24bd21616 Author: Chris Wilson Date: Wed Aug 18 18:12:56 2010 +0100 drm/i915/dp: Really try 5 times before giving up. commit 4f7f7b7eb94bd37c449f06932459bbed78826f8d upstream. Only stop trying if the aux channel sucessfully reports that the transmission was completed, otherwise try again. On the 5th failure, bail and report that something is amiss. This fixes a sporadic failure in reading the EDID for my external panel over DP. Signed-off-by: Chris Wilson Signed-off-by: Greg Kroah-Hartman commit 9ee313881759bde1d4bd812dda4fb53d856be4a2 Author: Dan Carpenter Date: Wed Jun 23 19:03:01 2010 +0200 i915_gem: return -EFAULT if copy_to_user fails commit c877cdce93a44eea96f6cf7fc04be7d0372db2be upstream. copy_to_user() returns the number of bytes remaining to be copied and I'm pretty sure we want to return a negative error code here. Signed-off-by: Dan Carpenter Signed-off-by: Chris Wilson Signed-off-by: Greg Kroah-Hartman commit 8ea422ed02643c645c75cbf29921fdcc8638bc99 Author: Dan Carpenter Date: Sat Jun 19 15:12:51 2010 +0200 i915: return -EFAULT if copy_to_user fails commit 9927a403ca8c97798129953fa9cbb5dc259c7cb9 upstream. copy_to_user returns the number of bytes remaining to be copied, but we want to return a negative error code here. These are returned to userspace. Signed-off-by: Dan Carpenter Signed-off-by: Chris Wilson Signed-off-by: Greg Kroah-Hartman commit 6a32943a76ec1489c497c8f1671080043686f31f Author: Alex Deucher Date: Thu Sep 9 19:15:23 2010 -0400 drm/radeon/kms/evergreen: fix backend setup commit b741be82cf2079f71553af595610f17a3a3a752a upstream. This patch fixes rendering errors on some evergreen boards. Hardcoding the backend map is not an optimal solution, but a better fix is being worked on. Similar to the fix for rv740 (6271901d828b34b27607314026deaf417f9f9b75). Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=29986 Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 262a57c09e0c11f9ba2343664998585ece06104e Author: Alex Deucher Date: Thu Sep 2 21:32:32 2010 -0400 drm/radeon/kms/evergreen: fix gpu hangs in userspace accel code commit 7e7b41d2ff30ed7ad4bf401d18566e6f38e42e4f upstream. These VGT regs need to be programmed via the ring rather than MMIO as on previous asics (r6xx/r7xx). Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 314a41c56b32278dcce158a35cabfde3f9e4dcd1 Author: Alex Deucher Date: Wed Sep 1 17:20:42 2010 -0400 drm/radeon/kms: properly set crtc high base on r7xx commit 95347871865ca5093c7e87a223274f7c3b5eccda upstream. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit af38a70db3311742ab23f02bc17cd7400bd6202a Author: Alex Deucher Date: Tue Sep 7 11:42:45 2010 -0400 drm/radeon/kms: force legacy pll algo for RV620 LVDS commit f90087eea44ce5fad139f086bc9d89ca37b0edc2 upstream. There has been periodic evidence that LVDS, on at least some panels, prefers the dividers selected by the legacy pll algo. This patch forces the use of the legacy pll algo on RV620 LVDS panels. The old behavior (new pll algo) can be selected by setting the new_pll module parameter to 1. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=30029 Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 8fa162939f360898dfefde73219b1a2682051b01 Author: Alex Deucher Date: Wed Sep 1 12:03:37 2010 -0400 drm/radeon/kms: force legacy pll algo for RV515 LVDS commit 0d9958b18e10d7426d94cc3dd024920a40db3ee2 upstream. There has been periodic evidence that LVDS, on at least some panels, prefers the dividers selected by the legacy pll algo. This patch forces the use of the legacy pll algo on RV515 LVDS panels. The old behavior (new pll algo) can be selected by setting the new_pll module parameter to 1. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit b04d80baa88f163b0793318ee4423097f47c59c7 Author: Zhenyu Wang Date: Mon Aug 30 16:12:42 2010 +0800 drm/i915: Enable MI_FLUSH on Sandybridge commit a69ffdbfcba8eabf2ca9d384b578e6f28b339c61 upstream. MI_FLUSH is being deprecated, but still available on Sandybridge. Make sure it's enabled as userspace still uses MI_FLUSH. Signed-off-by: Zhenyu Wang Signed-off-by: Chris Wilson Signed-off-by: Greg Kroah-Hartman commit 0e4112f04521bddfd3ce4598076bb0c557b259c6 Author: Alex Deucher Date: Fri Aug 27 13:59:54 2010 -0400 drm/radeon/kms: fix a regression on r7xx AGP due to the HDP flush fix commit 87cbf8f2c5d1b1fc4642c3dc0bb6efc587479603 upstream. commit: 812d046915f48236657f02c06d7dc47140e9ceda drm/radeon/kms/r7xx: add workaround for hw issue with HDP flush breaks on AGP boards since there is no VRAM gart table. This patch fixes the issue by creating a VRAM scratch page so that can be used on both AGP and PCIE. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=29834 Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 0b6945bff05e0426960c5db1f5b94f7627d0fe62 Author: Chris Wilson Date: Sat Sep 4 14:57:27 2010 +0100 agp/intel: Promote warning about failure to setup flush to error. commit df51e7aa2cf204e3a65657a1d60b96cfda133e9b upstream. Make sure we always detect when we fail to correctly allocate the Isoch Flush Page and print an error to warn the user about the likely memory corruption that will result in invalid rendering or worse. Signed-off-by: Chris Wilson Signed-off-by: Greg Kroah-Hartman commit 661b2c51d9f019662ce1584d6def2fe2f05096da Author: Trond Myklebust Date: Sun Sep 12 19:55:25 2010 -0400 SUNRPC: Fix race corrupting rpc upcall commit 5a67657a2e90c9e4a48518f95d4ba7777aa20fbb upstream. If rpc_queue_upcall() adds a new upcall to the rpci->pipe list just after rpc_pipe_release calls rpc_purge_list(), but before it calls gss_pipe_release (as rpci->ops->release_pipe(inode)), then the latter will free a message without deleting it from the rpci->pipe list. We will be left with a freed object on the rpc->pipe list. Most frequent symptoms are kernel crashes in rpc.gssd system calls on the pipe in question. Reported-by: J. Bruce Fields Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 5c41628055bec9f45fe29c8b553c6048c053236c Author: Trond Myklebust Date: Sun Sep 12 19:55:26 2010 -0400 NFS: Fix a typo in nfs_sockaddr_match_ipaddr6 commit b20d37ca9561711c6a3c4b859c2855f49565e061 upstream. Reported-by: Ben Greear Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 801c1aca52fb016a47c77c8e61df5e2f6da5c406 Author: Jeff Layton Date: Tue Sep 14 11:38:24 2010 -0400 cifs: fix potential double put of TCP session reference commit 460cf3411b858ad509d5255e0dfaf862a83c0299 upstream. cifs_get_smb_ses must be called on a server pointer on which it holds an active reference. It first does a search for an existing SMB session. If it finds one, it'll put the server reference and then try to ensure that the negprot is done, etc. If it encounters an error at that point then it'll return an error. There's a potential problem here though. When cifs_get_smb_ses returns an error, the caller will also put the TCP server reference leading to a double-put. Fix this by having cifs_get_smb_ses only put the server reference if it found an existing session that it could use and isn't returning an error. Reviewed-by: Suresh Jayaraman Signed-off-by: Jeff Layton Signed-off-by: Steve French Signed-off-by: Greg Kroah-Hartman commit 1a5029d51d4a82c05596b317be20a2c660f68853 Author: Anton Vorontsov Date: Wed Sep 8 00:10:26 2010 +0400 apm_power: Add missing break statement commit 1d220334d6a8a711149234dc5f98d34ae02226b8 upstream. The missing break statement causes wrong capacity calculation for batteries that report energy. Reported-by: d binderman Signed-off-by: Anton Vorontsov Signed-off-by: Greg Kroah-Hartman commit 12c5db341875a05f9986a3f18d008f0f423ec390 Author: Guillem Jover Date: Fri Sep 17 17:24:12 2010 +0200 hwmon: (f75375s) Do not overwrite values read from registers commit c3b327d60bbba3f5ff8fd87d1efc0e95eb6c121b upstream. All bits in the values read from registers to be used for the next write were getting overwritten, avoid doing so to not mess with the current configuration. Signed-off-by: Guillem Jover Cc: Riku Voipio Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit 75455a5495aff05dfae801e29764ce65cd59862a Author: Guillem Jover Date: Fri Sep 17 17:24:11 2010 +0200 hwmon: (f75375s) Shift control mode to the correct bit position commit 96f3640894012be7dd15a384566bfdc18297bc6c upstream. The spec notes that fan0 and fan1 control mode bits are located in bits 7-6 and 5-4 respectively, but the FAN_CTRL_MODE macro was making the bits shift by 5 instead of by 4. Signed-off-by: Guillem Jover Cc: Riku Voipio Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit dd32c724fe62ccb8675f703481694a5ac5ebfa0d Author: Yong Wang Date: Fri Sep 17 17:24:12 2010 +0200 hwmon: (emc1403) Remove unnecessary hwmon_device_unregister commit f17c811d1433aa1966f9c5a744841427e9a97ecf upstream. It is unnecessary and wrong to call hwmon_device_unregister in error handling before hwmon_device_register is called. Signed-off-by: Yong Wang Reviewed-by: Guenter Roeck Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit 9f6ea8d2fd0d4cb9939aae51a6522600f93161f6 Author: Al Viro Date: Fri Sep 17 14:34:39 2010 +0100 arm: fix really nasty sigreturn bug commit 653d48b22166db2d8b1515ebe6f9f0f7c95dfc86 upstream. If a signal hits us outside of a syscall and another gets delivered when we are in sigreturn (e.g. because it had been in sa_mask for the first one and got sent to us while we'd been in the first handler), we have a chance of returning from the second handler to location one insn prior to where we ought to return. If r0 happens to contain -513 (-ERESTARTNOINTR), sigreturn will get confused into doing restart syscall song and dance. Incredible joy to debug, since it manifests as random, infrequent and very hard to reproduce double execution of instructions in userland code... The fix is simple - mark it "don't bother with restarts" in wrapper, i.e. set r8 to 0 in sys_sigreturn and sys_rt_sigreturn wrappers, suppressing the syscall restart handling on return from these guys. They can't legitimately return a restart-worthy error anyway. Testcase: #include #include #include #include #include void f(int n) { __asm__ __volatile__( "ldr r0, [%0]\n" "b 1f\n" "b 2f\n" "1:b .\n" "2:\n" : : "r"(&n)); } void handler1(int sig) { } void handler2(int sig) { raise(1); } void handler3(int sig) { exit(0); } main() { struct sigaction s = {.sa_handler = handler2}; struct itimerval t1 = { .it_value = {1} }; struct itimerval t2 = { .it_value = {2} }; signal(1, handler1); sigemptyset(&s.sa_mask); sigaddset(&s.sa_mask, 1); sigaction(SIGALRM, &s, NULL); signal(SIGVTALRM, handler3); setitimer(ITIMER_REAL, &t1, NULL); setitimer(ITIMER_VIRTUAL, &t2, NULL); f(-513); /* -ERESTARTNOINTR */ write(1, "buggered\n", 9); return 1; } Signed-off-by: Al Viro Acked-by: Russell King Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit e8ba36a90f25685bbdb5a4e4df8a8321ba9f7144 Author: Thomas Gleixner Date: Tue Sep 14 22:10:21 2010 +0200 x86: hpet: Work around hardware stupidity commit 54ff7e595d763d894104d421b103a89f7becf47c upstream. This more or less reverts commits 08be979 (x86: Force HPET readback_cmp for all ATI chipsets) and 30a564be (x86, hpet: Restrict read back to affected ATI chipsets) to the status of commit 8da854c (x86, hpet: Erratum workaround for read after write of HPET comparator). The delta to commit 8da854c is mostly comments and the change from WARN_ONCE to printk_once as we know the call path of this function already. This needs really in depth explanation: First of all the HPET design is a complete failure. Having a counter compare register which generates an interrupt on matching values forces the software to do at least one superfluous readback of the counter register. While it is nice in theory to program "absolute" time events it is practically useless because the timer runs at some absurd frequency which can never be matched to real world units. So we are forced to calculate a relative delta and this forces a readout of the actual counter value, adding the delta and programming the compare register. When the delta is small enough we run into the danger that we program a compare value which is already in the past. Due to the compare for equal nature of HPET we need to read back the counter value after writing the compare rehgister (btw. this is necessary for absolute timeouts as well) to make sure that we did not miss the timer event. We try to work around that by setting the minimum delta to a value which is larger than the theoretical time which elapses between the counter readout and the compare register write, but that's only true in theory. A NMI or SMI which hits between the readout and the write can easily push us beyond that limit. This would result in waiting for the next HPET timer interrupt until the 32bit wraparound of the counter happens which takes about 306 seconds. So we designed the next event function to look like: match = read_cnt() + delta; write_compare_ref(match); return read_cnt() < match ? 0 : -ETIME; At some point we got into trouble with certain ATI chipsets. Even the above "safe" procedure failed. The reason was that the write to the compare register was delayed probably for performance reasons. The theory was that they wanted to avoid the synchronization of the write with the HPET clock, which is understandable. So the write does not hit the compare register directly instead it goes to some intermediate register which is copied to the real compare register in sync with the HPET clock. That opens another window for hitting the dreaded "wait for a wraparound" problem. To work around that "optimization" we added a read back of the compare register which either enforced the update of the just written value or just delayed the readout of the counter enough to avoid the issue. We unfortunately never got any affirmative info from ATI/AMD about this. One thing is sure, that we nuked the performance "optimization" that way completely and I'm pretty sure that the result is worse than before some HW folks came up with those. Just for paranoia reasons I added a check whether the read back compare register value was the same as the value we wrote right before. That paranoia check triggered a couple of years after it was added on an Intel ICH9 chipset. Venki added a workaround (commit 8da854c) which was reading the compare register twice when the first check failed. We considered this to be a penalty in general and restricted the readback (thus the wasted CPU cycles) to the known to be affected ATI chipsets. This turned out to be a utterly wrong decision. 2.6.35 testers experienced massive problems and finally one of them bisected it down to commit 30a564be which spured some further investigation. Finally we got confirmation that the write to the compare register can be delayed by up to two HPET clock cycles which explains the problems nicely. All we can do about this is to go back to Venki's initial workaround in a slightly modified version. Just for the record I need to say, that all of this could have been avoided if hardware designers and of course the HPET committee would have thought about the consequences for a split second. It's out of my comprehension why designing a working timer is so hard. There are two ways to achieve it: 1) Use a counter wrap around aware compare_reg <= counter_reg implementation instead of the easy compare_reg == counter_reg Downsides: - It needs more silicon. - It needs a readout of the counter to apply a relative timeout. This is necessary as the counter does not run in any useful (and adjustable) frequency and there is no guarantee that the counter which is used for timer events is the same which is used for reading the actual time (and therefor for calculating the delta) Upsides: - None 2) Use a simple down counter for relative timer events Downsides: - Absolute timeouts are not possible, which is not a problem at all in the context of an OS and the expected max. latencies/jitter (also see Downsides of #1) Upsides: - It needs less or equal silicon. - It works ALWAYS - It is way faster than a compare register based solution (One write versus one write plus at least one and up to four reads) I would not be so grumpy about all of this, if I would not have been ignored for many years when pointing out these flaws to various hardware folks. I really hate timers (at least those which seem to be designed by janitors). Though finally we got a reasonable explanation plus a solution and I want to thank all the folks involved in chasing it down and providing valuable input to this. Bisected-by: Nix Reported-by: Artur Skawina Reported-by: Damien Wyart Reported-by: John Drescher Cc: Venkatesh Pallipadi Cc: Ingo Molnar Cc: H. Peter Anvin Cc: Arjan van de Ven Cc: Andreas Herrmann Cc: Borislav Petkov Cc: stable@kernel.org Acked-by: Suresh Siddha Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit 1f4536a2af4726c1e27c2fda343d02879eb61e5b Author: David Henningsson Date: Thu Sep 16 10:07:53 2010 +0200 ALSA: HDA: Enable internal speaker on Dell M101z commit 145a902bfeb1f89a41165bd2d1e633ce070bcb73 upstream. BugLink: http://launchpad.net/bugs/640254 In some cases a magic processing coefficient is needed to enable the internal speaker on Dell M101z. According to Realtek, this processing coefficient is only present on ALC269vb. Signed-off-by: David Henningsson Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 428b01232e08df89751ed5d1683953ebcc6a9035 Author: Roland McGrath Date: Tue Sep 14 12:22:58 2010 -0700 x86-64, compat: Retruncate rax after ia32 syscall entry tracing commit eefdca043e8391dcd719711716492063030b55ac upstream. In commit d4d6715, we reopened an old hole for a 64-bit ptracer touching a 32-bit tracee in system call entry. A %rax value set via ptrace at the entry tracing stop gets used whole as a 32-bit syscall number, while we only check the low 32 bits for validity. Fix it by truncating %rax back to 32 bits after syscall_trace_enter, in addition to testing the full 64 bits as has already been added. Reported-by: Ben Hawkes Signed-off-by: Roland McGrath Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit b2e19c77678a5ca5f1233eb7d1989c143386d838 Author: H. Peter Anvin Date: Tue Sep 7 16:16:18 2010 -0700 compat: Make compat_alloc_user_space() incorporate the access_ok() commit c41d68a513c71e35a14f66d71782d27a79a81ea6 upstream. compat_alloc_user_space() expects the caller to independently call access_ok() to verify the returned area. A missing call could introduce problems on some architectures. This patch incorporates the access_ok() check into compat_alloc_user_space() and also adds a sanity check on the length. The existing compat_alloc_user_space() implementations are renamed arch_compat_alloc_user_space() and are used as part of the implementation of the new global function. This patch assumes NULL will cause __get_user()/__put_user() to either fail or access userspace on all architectures. This should be followed by checking the return value of compat_access_user_space() for NULL in the callers, at which time the access_ok() in the callers can also be removed. Reported-by: Ben Hawkes Signed-off-by: H. Peter Anvin Acked-by: Benjamin Herrenschmidt Acked-by: Chris Metcalf Acked-by: David S. Miller Acked-by: Ingo Molnar Acked-by: Thomas Gleixner Acked-by: Tony Luck Cc: Andrew Morton Cc: Arnd Bergmann Cc: Fenghua Yu Cc: H. Peter Anvin Cc: Heiko Carstens Cc: Helge Deller Cc: James Bottomley Cc: Kyle McMartin Cc: Martin Schwidefsky Cc: Paul Mackerras Cc: Ralf Baechle Signed-off-by: Greg Kroah-Hartman commit 0fd7b7cbc7e04bc859456fbd862dedd6985f85e5 Author: H. Peter Anvin Date: Tue Sep 14 12:42:41 2010 -0700 x86-64, compat: Test %rax for the syscall number, not %eax commit 36d001c70d8a0144ac1d038f6876c484849a74de upstream. On 64 bits, we always, by necessity, jump through the system call table via %rax. For 32-bit system calls, in theory the system call number is stored in %eax, and the code was testing %eax for a valid system call number. At one point we loaded the stored value back from the stack to enforce zero-extension, but that was removed in checkin d4d67150165df8bf1cc05e532f6efca96f907cab. An actual 32-bit process will not be able to introduce a non-zero-extended number, but it can happen via ptrace. Instead of re-introducing the zero-extension, test what we are actually going to use, i.e. %rax. This only adds a handful of REX prefixes to the code. Reported-by: Ben Hawkes Signed-off-by: H. Peter Anvin Cc: Roland McGrath Cc: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit 51fccd339ff9d32702051b240bf2f8fcdd42749b Author: Peter Zijlstra Date: Fri Sep 10 22:32:53 2010 +0200 x86, tsc: Fix a preemption leak in restore_sched_clock_state() commit 55496c896b8a695140045099d4e0175cf09d4eae upstream. Doh, a real life genuine preemption leak.. This caused a suspend failure. Reported-bisected-and-tested-by-the-invaluable: Jeff Chua Acked-by: Suresh Siddha Signed-off-by: Peter Zijlstra Cc: Rafael J. Wysocki Cc: Nico Schottelius Cc: Jesse Barnes Cc: Linus Torvalds Cc: Florian Pritz Cc: Suresh Siddha Cc: Len Brown sleep states LKML-Reference: <1284150773.402.122.camel@laptop> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit f155ee1b5def75927fd86a839d7ab10b8fa07e79 Author: Steve Wise Date: Sat Aug 28 13:35:05 2010 +0000 RDMA/cxgb3: Don't exceed the max HW CQ depth commit dc4e96ce2dceb649224ee84f83592aac8c54c9b7 upstream. The max depth supported by T3 is 64K entries. This fixes a bug introduced in commit 9918b28d ("RDMA/cxgb3: Increase the max CQ depth") that causes stalls and possibly crashes in large MPI clusters. Signed-off-by: Steve Wise Signed-off-by: Roland Dreier Signed-off-by: Greg Kroah-Hartman commit 53d9dee0d76a860134cb8360f296bb01efea2558 Author: Johannes Berg Date: Mon Aug 30 12:24:54 2010 +0200 wireless extensions: fix kernel heap content leak commit 42da2f948d949efd0111309f5827bf0298bcc9a4 upstream. Wireless extensions have an unfortunate, undocumented requirement which requires drivers to always fill iwp->length when returning a successful status. When a driver doesn't do this, it leads to a kernel heap content leak when userspace offers a larger buffer than would have been necessary. Arguably, this is a driver bug, as it should, if it returns 0, fill iwp->length, even if it separately indicated that the buffer contents was not valid. However, we can also at least avoid the memory content leak if the driver doesn't do this by setting the iwp length to max_tokens, which then reflects how big the buffer is that the driver may fill, regardless of how big the userspace buffer is. To illustrate the point, this patch also fixes a corresponding cfg80211 bug (since this requirement isn't documented nor was ever pointed out by anyone during code review, I don't trust all drivers nor all cfg80211 handlers to implement it correctly). Signed-off-by: Johannes Berg Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 39fc0591b8b83310bcdf8436bd1f226fc4d6fd23 Author: John W. Linville Date: Tue Aug 24 15:27:34 2010 -0400 ath5k: check return value of ieee80211_get_tx_rate commit d8e1ba76d619dbc0be8fbeee4e6c683b5c812d3a upstream. This avoids a NULL pointer dereference as reported here: https://bugzilla.redhat.com/show_bug.cgi?id=625889 When the WARN condition is hit in ieee80211_get_tx_rate, it will return NULL. So, we need to check the return value and avoid dereferencing it in that case. Signed-off-by: John W. Linville Acked-by: Bob Copeland Signed-off-by: Greg Kroah-Hartman commit 13d7e89ea21d11921cc64729341edb3fbdb70ca9 Author: Christian Lamparter Date: Tue Aug 24 22:54:05 2010 +0200 p54: fix tx feedback status flag check commit f880c2050f30b23c9b6f80028c09f76e693bf309 upstream. Michael reported that p54* never really entered power save mode, even tough it was enabled. It turned out that upon a power save mode change the firmware will set a special flag onto the last outgoing frame tx status (which in this case is almost always the designated PSM nullfunc frame). This flag confused the driver; It erroneously reported transmission failures to the stack, which then generated the next nullfunc. and so on... Reported-by: Michael Buesch Tested-by: Michael Buesch Signed-off-by: Christian Lamparter Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit f4d60f54ed93f427219b359a1bbc29e2fc04cc67 Author: Paul Mackerras Date: Tue Aug 10 20:38:23 2010 +0000 powerpc/perf_event: Reduce latency of calling perf_event_do_pending commit b0d278b7d3ae9115939ddcea93f516308cc367e2 upstream. Commit 0fe1ac48 ("powerpc/perf_event: Fix oops due to perf_event_do_pending call") moved the call to perf_event_do_pending in timer_interrupt() down so that it was after the irq_enter() call. Unfortunately this moved it after the code that checks whether it is time for the next decrementer clock event. The result is that the call to perf_event_do_pending() won't happen until the next decrementer clock event is due. This was pointed out by Milton Miller. This fixes it by moving the check for whether it's time for the next decrementer clock event down to the point where we're about to call the event handler, after we've called perf_event_do_pending. This has the side effect that on old pre-Core99 Powermacs where we use the ppc_n_lost_interrupts mechanism to replay interrupts, a replayed interrupt will incur a little more latency since it will now do the code from the irq_enter down to the irq_exit, that it used to skip. However, these machines are now old and rare enough that this doesn't matter. To make it clear that ppc_n_lost_interrupts is only used on Powermacs, and to speed up the code slightly on non-Powermac ppc32 machines, the code that tests ppc_n_lost_interrupts is now conditional on CONFIG_PMAC as well as CONFIG_PPC32. Signed-off-by: Paul Mackerras Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit c0016ec4e51c5ae58dfbe15974192badf567b5f4 Author: Frederic Weisbecker Date: Sun Aug 22 04:29:17 2010 +0200 perf: Initialize callchains roots's childen hits commit 5225c45899e872383ca39f5533d28ec63c54b39e upstream. Each histogram entry has a callchain root that stores the callchain samples. However we forgot to initialize the tracking of children hits of these roots, which then got random values on their creation. The root children hits is multiplied by the minimum percentage of hits provided by the user, and the result becomes the minimum hits expected from children branches. If the random value due to the uninitialization is big enough, then this minimum number of hits can be huge and eventually filter every children branches. The end result was invisible callchains. All we need to fix this is to initialize the children hits of the root. Reported-by: Christoph Hellwig Signed-off-by: Frederic Weisbecker Cc: Ingo Molnar Cc: Peter Zijlstra Cc: Arnaldo Carvalho de Melo Cc: Paul Mackerras Signed-off-by: Greg Kroah-Hartman commit 1d1a528b65f9c4f9f5f1bb2341aef6e4f3bfc5d1 Author: KAMEZAWA Hiroyuki Date: Thu Sep 9 16:38:01 2010 -0700 memory hotplug: fix next block calculation in is_removable commit 0dcc48c15f63ee86c2fcd33968b08d651f0360a5 upstream. next_active_pageblock() is for finding next _used_ freeblock. It skips several blocks when it finds there are a chunk of free pages lager than pageblock. But it has 2 bugs. 1. We have no lock. page_order(page) - pageblock_order can be minus. 2. pageblocks_stride += is wrong. it should skip page_order(p) of pages. Signed-off-by: KAMEZAWA Hiroyuki Cc: Michal Hocko Cc: Wu Fengguang Cc: Mel Gorman Cc: KAMEZAWA Hiroyuki Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit ac1a91ede75a5311e57b1a093d8b313cd7c9f515 Author: Dmitry Torokhov Date: Tue Jul 20 20:25:34 2010 -0700 Input: i8042 - reset keyboard controller wehen resuming from S2R commit 1ca56e513a9fd356d5a9e0de45dbe0e189e00386 upstream. Some laptops, such as Lenovo 3000 N100, require keyboard controller reset in order to have touchpad operable after suspend to RAM. Even if box does not need the reset it should be safe to do so, so instead of chasing after misbehaving boxes and grow DMI tables, let's reset the controller unconditionally. Reported-and-tested-by: Jerome Lacoste Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman commit e9d3ad84a2b475896c74e41036ba0e8b591fac8e Author: Dmitry Torokhov Date: Tue Aug 31 17:27:02 2010 -0700 Input: i8042 - fix device removal on unload commit af045b86662f17bf130239a65995c61a34f00a6b upstream. We need to call platform_device_unregister(i8042_platform_device) before calling platform_driver_unregister() because i8042_remove() resets i8042_platform_device to NULL. This leaves the platform device instance behind and prevents driver reload. Fixes https://bugzilla.kernel.org/show_bug.cgi?id=16613 Reported-by: Seryodkin Victor Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman commit 964c3f00ecc7a6c789f7c9d0231ded4ab0ae1610 Author: Jan Sembera Date: Thu Sep 9 16:37:54 2010 -0700 binfmt_misc: fix binfmt_misc priority commit ee3aebdd8f5f8eac41c25c80ceee3d728f920f3b upstream. Commit 74641f584da ("alpha: binfmt_aout fix") (May 2009) introduced a regression - binfmt_misc is now consulted after binfmt_elf, which will unfortunately break ia32el. ia32 ELF binaries on ia64 used to be matched using binfmt_misc and executed using wrapper. As 32bit binaries are now matched by binfmt_elf before bindmt_misc kicks in, the wrapper is ignored. The fix increases precedence of binfmt_misc to the original state. Signed-off-by: Jan Sembera Cc: Ivan Kokshaysky Cc: Al Viro Cc: Richard Henderson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 9eca1e9defb46502949e35d1c81ad98d682da9e5 Author: Jerome Marchand Date: Thu Sep 9 16:37:59 2010 -0700 kernel/groups.c: fix integer overflow in groups_search commit 1c24de60e50fb19b94d94225458da17c720f0729 upstream. gid_t is a unsigned int. If group_info contains a gid greater than MAX_INT, groups_search() function may look on the wrong side of the search tree. This solves some unfair "permission denied" problems. Signed-off-by: Jerome Marchand Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 5b253de765e92893bd5431ed995e3ca58bac274c Author: Minchan Kim Date: Thu Sep 9 16:38:00 2010 -0700 mm: compaction: handle active and inactive fairly in too_many_isolated commit bc6930457460788e14b2c0808ed4632a1592bd61 upstream. Iram reported that compaction's too_many_isolated() loops forever. (http://www.spinics.net/lists/linux-mm/msg08123.html) The meminfo when the situation happened was inactive anon is zero. That's because the system has no memory pressure until then. While all anon pages were in the active lru, compaction could select active lru as well as inactive lru. That's a different thing from vmscan's isolated. So we has been two too_many_isolated. While compaction can isolate pages in both active and inactive, current implementation of too_many_isolated only considers inactive. It made Iram's problem. This patch handles active and inactive fairly. That's because we can't expect where from and how many compaction would isolated pages. This patch changes (nr_isolated > nr_inactive) with nr_isolated > (nr_active + nr_inactive) / 2. Signed-off-by: Minchan Kim Reported-by: Iram Shahzad Acked-by: Mel Gorman Acked-by: Wu Fengguang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit cfa7e5c5fce001efa3d35c84229aec67ae6ade7a Author: Gary King Date: Thu Sep 9 16:38:05 2010 -0700 bounce: call flush_dcache_page() after bounce_copy_vec() commit ac8456d6f9a3011c824176bd6084d39e5f70a382 upstream. I have been seeing problems on Tegra 2 (ARMv7 SMP) systems with HIGHMEM enabled on 2.6.35 (plus some patches targetted at 2.6.36 to perform cache maintenance lazily), and the root cause appears to be that the mm bouncing code is calling flush_dcache_page before it copies the bounce buffer into the bio. The bounced page needs to be flushed after data is copied into it, to ensure that architecture implementations can synchronize instruction and data caches if necessary. Signed-off-by: Gary King Cc: Tejun Heo Cc: Russell King Acked-by: Jens Axboe Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit b49853780d6aaf8a5cccf6667648e428719f8f3e Author: Jorge Boncompte [DTI2] Date: Thu Sep 9 16:38:19 2010 -0700 minix: fix regression in minix_mkdir() commit eee743fd7eac9f2ea69ad06d093dfb5a12538fe5 upstream. Commit 9eed1fb721c ("minix: replace inode uid,gid,mode init with helper") broke directory creation on minix filesystems. Fix it by passing the needed mode flag to inode init helper. Signed-off-by: Jorge Boncompte [DTI2] Cc: Dmitry Monakhov Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit bcedd390d037d0e3b43da97a86e37a9bb7ceac91 Author: Menyhart Zoltan Date: Sun Sep 12 19:55:26 2010 -0400 statfs() gives ESTALE error commit fbf3fdd2443965d9ba6fb4b5fecd1f6e0847218f upstream. Hi, An NFS client executes a statfs("file", &buff) call. "file" exists / existed, the client has read / written it, but it has already closed it. user_path(pathname, &path) looks up "file" successfully in the directory-cache and restarts the aging timer of the directory-entry. Even if "file" has already been removed from the server, because the lookupcache=positive option I use, keeps the entries valid for a while. nfs_statfs() returns ESTALE if "file" has already been removed from the server. If the user application repeats the statfs("file", &buff) call, we are stuck: "file" remains young forever in the directory-cache. Signed-off-by: Zoltan Menyhart Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit e921923ed257d47c720f4fd71eeed812c4f5af9b Author: Uwe Kleine-König Date: Wed Aug 18 09:25:38 2010 -0700 mmc: build fix: mmc_pm_notify is only available with CONFIG_PM=y commit 81ca03a0e2ea0207b2df80e0edcf4c775c07a505 upstream. This fixes a build breakage introduced by commit 4c2ef25fe0b8 ("mmc: fix all hangs related to mmc/sd card insert/removal during suspend/resume") Cc: David Brownell Cc: Alan Stern Cc: linux-mmc@vger.kernel.org Cc: Andrew Morton Signed-off-by: Uwe Kleine-König Acked-by: Kukjin Kim Acked-by: Maxim Levitsky Acked-by: Randy Dunlap Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 094b59b2cff1d17310037e957c7e343921d86aaa Author: Maxim Levitsky Date: Tue Aug 10 18:01:41 2010 -0700 mmc: fix all hangs related to mmc/sd card insert/removal during suspend/resume commit 4c2ef25fe0b847d2ae818f74758ddb0be1c27d8e upstream. If you don't use CONFIG_MMC_UNSAFE_RESUME, as soon as you attempt to suspend, the card will be removed, therefore this patch doesn't change the behavior of this option. However the removal will be done by pm notifier, which runs while userspace is still not frozen and thus can freely use del_gendisk, without the risk of deadlock which would happen otherwise. Card detect workqueue is now disabled while userspace is frozen, Therefore if you do use CONFIG_MMC_UNSAFE_RESUME, and remove the card during suspend, the removal will be detected as soon as userspace is unfrozen, again at the moment it is safe to call del_gendisk. Tested with and without CONFIG_MMC_UNSAFE_RESUME with suspend and hibernate. [akpm@linux-foundation.org: clean up function prototype] [akpm@linux-foundation.org: fix CONFIG_PM-n linkage, small cleanups] [akpm@linux-foundation.org: coding-style fixes] Signed-off-by: Maxim Levitsky Cc: David Brownell Cc: Alan Stern Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Cc: Lee Jones Signed-off-by: Greg Kroah-Hartman commit 77dc28848881926ba46e9b6bb9f64fb71d61bddc Author: Guennadi Liakhovetski Date: Thu Sep 9 16:37:43 2010 -0700 mmc: fix the use of kunmap_atomic() in tmio_mmc.h commit 5600efb1bc2745d93ae0bc08130117a84f2b9d69 upstream. kunmap_atomic() takes the cookie, returned by the kmap_atomic() as its argument and not the page address, used as an argument to kmap_atomic(). This patch fixes the compile error: In file included from drivers/mmc/host/tmio_mmc.c:37: drivers/mmc/host/tmio_mmc.h: In function 'tmio_mmc_kunmap_atomic': drivers/mmc/host/tmio_mmc.h:192: error: negative width in bit-field '' Signed-off-by: Guennadi Liakhovetski Acked-by: Eric Miao Tested-by: Magnus Damm Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 99e2e17956364653157150b8304ee3565539338e Author: Yusuke Goda Date: Thu Sep 9 16:37:39 2010 -0700 tmio_mmc: don't clear unhandled pending interrupts commit b78d6c5f51935ba89df8db33a57bacb547aa7325 upstream. Previously, it was possible for ack_mmc_irqs() to clear pending interrupt bits in the CTL_STATUS register, even though the interrupt handler had not been called. This was because of a race that existed when doing a read-modify-write sequence on CTL_STATUS. After the read step in this sequence, if an interrupt occurred (causing one of the bits in CTL_STATUS to be set) the write step would inadvertently clear it. Observed with the TMIO_STAT_RXRDY bit together with CMD53 on AR6002 and BCM4318 SDIO cards in polled mode. This patch eliminates this race by only writing to CTL_STATUS and clearing the interrupts that were passed as an argument to ack_mmc_irqs()." [matt@console-pimps.org: rewrote changelog] Signed-off-by: Yusuke Goda Acked-by: Magnus Damm Tested-by: Arnd Hannemann " Acked-by: Ian Molton Cc: Matt Fleming Cc: Samuel Ortiz Cc: Paul Mundt Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit b2f62d51745043996a75a45ba9e40b4be9595332 Author: Peter Oberparleiter Date: Thu Sep 9 16:37:35 2010 -0700 gcov: fix null-pointer dereference for certain module types commit 85a0fdfd0f967507f3903e8419bc7e408f5a59de upstream. The gcov-kernel infrastructure expects that each object file is loaded only once. This may not be true, e.g. when loading multiple kernel modules which are linked to the same object file. As a result, loading such kernel modules will result in incorrect gcov results while unloading will cause a null-pointer dereference. This patch fixes these problems by changing the gcov-kernel infrastructure so that multiple profiling data sets can be associated with one debugfs entry. It applies to 2.6.36-rc1. Signed-off-by: Peter Oberparleiter Reported-by: Werner Spies Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 8417544f5bba23a210528125af2c4fa04f5e1683 Author: Takashi Iwai Date: Thu Sep 9 16:37:31 2010 -0700 hp_accel: add quirks for HP ProBook 532x and HP Mini 5102 commit 4e70598c3b56e6fec551454c495d4d4025834749 upstream. Added missing axis-mapping for HP ProBook 532x and HP Mini 5102. Signed-off-by: Takashi Iwai Cc: Eric Piel Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit edcc17148783ddd92a0e23c1a8ae3282607b1220 Author: Dan Carpenter Date: Sat Sep 4 03:14:35 2010 +0000 irda: off by one commit cf9b94f88bdbe8a02015fc30d7c232b2d262d4ad upstream. This is an off by one. We would go past the end when we NUL terminate the "value" string at end of the function. The "value" buffer is allocated in irlan_client_parse_response() or irlan_provider_parse_command(). CC: stable@kernel.org Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller commit 1b8c931cecdda5ce851b206e7dae5ff4470ec125 Author: Chris Wright Date: Thu Sep 9 16:34:59 2010 -0700 tracing: t_start: reset FTRACE_ITER_HASH in case of seek/pread commit df09162550fbb53354f0c88e85b5d0e6129ee9cc upstream. Be sure to avoid entering t_show() with FTRACE_ITER_HASH set without having properly started the iterator to iterate the hash. This case is degenerate and, as discovered by Robert Swiecki, can cause t_hash_show() to misuse a pointer. This causes a NULL ptr deref with possible security implications. Tracked as CVE-2010-3079. Cc: Robert Swiecki Cc: Eugene Teo Signed-off-by: Chris Wright Signed-off-by: Steven Rostedt Signed-off-by: Greg Kroah-Hartman commit 3c3d2da76db54975593ef526cbb17b94054c0fa2 Author: Steven Rostedt Date: Wed Sep 8 11:20:37 2010 -0400 tracing: Do not allow llseek to set_ftrace_filter commit 9c55cb12c1c172e2d51e85fbb5a4796ca86b77e7 upstream. Reading the file set_ftrace_filter does three things. 1) shows whether or not filters are set for the function tracer 2) shows what functions are set for the function tracer 3) shows what triggers are set on any functions 3 is independent from 1 and 2. The way this file currently works is that it is a state machine, and as you read it, it may change state. But this assumption breaks when you use lseek() on the file. The state machine gets out of sync and the t_show() may use the wrong pointer and cause a kernel oops. Luckily, this will only kill the app that does the lseek, but the app dies while holding a mutex. This prevents anyone else from using the set_ftrace_filter file (or any other function tracing file for that matter). A real fix for this is to rewrite the code, but that is too much for a -rc release or stable. This patch simply disables llseek on the set_ftrace_filter() file for now, and we can do the proper fix for the next major release. Reported-by: Robert Swiecki Cc: Chris Wright Cc: Tavis Ormandy Cc: Eugene Teo Cc: vendor-sec@lst.de Signed-off-by: Steven Rostedt Signed-off-by: Greg Kroah-Hartman commit b8536db269735d35d2b9a6480d40de212fed1b3c Author: Li Zefan Date: Mon Aug 23 16:50:12 2010 +0800 tracing: Fix a race in function profile commit 3aaba20f26f58843e8f20611e5c0b1c06954310f upstream. While we are reading trace_stat/functionX and someone just disabled function_profile at that time, we can trigger this: divide error: 0000 [#1] PREEMPT SMP ... EIP is at function_stat_show+0x90/0x230 ... This fix just takes the ftrace_profile_lock and checks if rec->counter is 0. If it's 0, we know the profile buffer has been reset. Signed-off-by: Li Zefan LKML-Reference: <4C723644.4040708@cn.fujitsu.com> Signed-off-by: Steven Rostedt Signed-off-by: Greg Kroah-Hartman commit 803ac2f1bd3eea08152c253dbc5f7c9865010331 Author: Jeff Moyer Date: Thu Sep 9 16:37:33 2010 -0700 O_DIRECT: fix the splitting up of contiguous I/O commit 7a801ac6f5067539ceb5fad0fe90ec49fc156e47 upstream. commit c2c6ca4 (direct-io: do not merge logically non-contiguous requests) introduced a bug whereby all O_DIRECT I/Os were submitted a page at a time to the block layer. The problem is that the code expected dio->block_in_file to correspond to the current page in the dio. In fact, it corresponds to the previous page submitted via submit_page_section. This was purely an oversight, as the dio->cur_page_fs_offset field was introduced for just this purpose. This patch simply uses the correct variable when calculating whether there is a mismatch between contiguous logical blocks and contiguous physical blocks (as described in the comments). I also switched the if conditional following this check to an else if, to ensure that we never call dio_bio_submit twice for the same dio (in theory, this should not happen, anyway). I've tested this by running blktrace and verifying that a 64KB I/O was submitted as a single I/O. I also ran the patched kernel through xfstests' aio tests using xfs, ext4 (with 1k and 4k block sizes) and btrfs and verified that there were no regressions as compared to an unpatched kernel. Signed-off-by: Jeff Moyer Acked-by: Josef Bacik Cc: Christoph Hellwig Cc: Chris Mason Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 2b88bc4f87ca83631af8ab3286964a547835a0df Author: Tejun Heo Date: Fri Aug 27 11:09:15 2010 +0200 ahci: fix hang on failed softreset commit f1f5a807b051eddd3f302e503d39214e5bde0ef2 upstream. ahci_do_softreset() compared the current time and deadline in reverse when calculating timeout for SRST issue. The result is that if @deadline is in future, SRST is issued with 0 timeout, which hasn't caused any problem because it later waits for DRDY with the correct timeout. If deadline is already exceeded by the time SRST is about to be issued, the timeout calculation underflows and if the device doesn't respond, timeout doesn't trigger for a _very_ long time. Reverse the incorrect comparison order. Signed-off-by: Tejun Heo Reported-by: Anssi Hannula Tested-by: Gwendal Grignou Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit 63b754139e3c4b1e24e0e488a7864b136738032f Author: Tejun Heo Date: Thu Sep 9 17:13:31 2010 +0200 libata,pata_via: revert ata_wait_idle() removal from ata_sff/via_tf_load() commit 40c6023031369ae5573e622ca54fa3ffe89fb865 upstream. Commit 978c0666 (libata: Remove excess delay in the tf_load path) removed ata_wait_idle() from ata_sff_tf_load() and via_tf_load(). This caused obscure detection problems in sata_sil. https://bugzilla.kernel.org/show_bug.cgi?id=16606 The commit was pure performance optimization. Revert it for now. Reported-by: Dieter Plaetinck Reported-by: Jan Beulich Bisected-by: gianluca Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit ff4adc0b087a98b7202a53fd134d18fb078c1d12 Author: Tejun Heo Date: Tue Sep 7 14:05:31 2010 +0200 libata: skip EH autopsy and recovery during suspend commit e2f3d75fc0e4a0d03c61872bad39ffa2e74a04ff upstream. For some mysterious reason, certain hardware reacts badly to usual EH actions while the system is going for suspend. As the devices won't be needed until the system is resumed, ask EH to skip usual autopsy and recovery and proceed directly to suspend. Signed-off-by: Tejun Heo Tested-by: Stephan Diestelhorst Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit 25de680b83ee668dd4d7c3d530217cb70cf58833 Author: Alan Ott Date: Tue Aug 17 00:44:04 2010 -0400 HID: Set Report ID properly for Output reports on the Control endpoint. commit c29771c2d8ceb907ed45eb8c7fc0450308140aca upstream. When I made commit 29129a98e6fc89 ("HID: Send Report ID when numbered reports are sent over the control endpoint"), I didn't account for *buf not being the report ID anymore, as buf is incremented. Signed-off-by: Alan Ott Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit b68ccacffdfb1fbcab3a39a960260c617569af8b Author: Robert Richter Date: Wed Sep 1 14:50:50 2010 +0200 oprofile, x86: fix init_sysfs() function stub commit 269f45c25028c75fe10e6d9be86e7202ab461fbc upstream. The use of the return value of init_sysfs() with commit 10f0412 oprofile, x86: fix init_sysfs error handling discovered the following build error for !CONFIG_PM: .../linux/arch/x86/oprofile/nmi_int.c: In function ‘op_nmi_init’: .../linux/arch/x86/oprofile/nmi_int.c:784: error: expected expression before ‘do’ make[2]: *** [arch/x86/oprofile/nmi_int.o] Error 1 make[1]: *** [arch/x86/oprofile] Error 2 This patch fixes this. Reported-by: Ingo Molnar Signed-off-by: Robert Richter Signed-off-by: Greg Kroah-Hartman commit ad8096c8a02ca8340cdeb34ab0f368c97adffd1f Author: Robert Richter Date: Mon Aug 30 10:56:18 2010 +0200 oprofile, x86: fix init_sysfs error handling commit 10f0412f57f2a76a90eff4376f59cbb0a39e4e18 upstream. On failure init_sysfs() might not properly free resources. The error code of the function is not checked. And, when reinitializing the exit function might be called twice. This patch fixes all this. Signed-off-by: Robert Richter Signed-off-by: Greg Kroah-Hartman commit 3f0cfc091f8593dc2ccb282d8155225fd56b03f1 Author: Robert Richter Date: Fri Aug 13 16:29:04 2010 +0200 oprofile: fix crash when accessing freed task structs commit 750d857c682f4db60d14722d430c7ccc35070962 upstream. This patch fixes a crash during shutdown reported below. The crash is caused by accessing already freed task structs. The fix changes the order for registering and unregistering notifier callbacks. All notifiers must be initialized before buffers start working. To stop buffer synchronization we cancel all workqueues, unregister the notifier callback and then flush all buffers. After all of this we finally can free all tasks listed. This should avoid accessing freed tasks. On 22.07.10 01:14:40, Benjamin Herrenschmidt wrote: > So the initial observation is a spinlock bad magic followed by a crash > in the spinlock debug code: > > [ 1541.586531] BUG: spinlock bad magic on CPU#5, events/5/136 > [ 1541.597564] Unable to handle kernel paging request for data at address 0x6b6b6b6b6b6b6d03 > > Backtrace looks like: > > spin_bug+0x74/0xd4 > ._raw_spin_lock+0x48/0x184 > ._spin_lock+0x10/0x24 > .get_task_mm+0x28/0x8c > .sync_buffer+0x1b4/0x598 > .wq_sync_buffer+0xa0/0xdc > .worker_thread+0x1d8/0x2a8 > .kthread+0xa8/0xb4 > .kernel_thread+0x54/0x70 > > So we are accessing a freed task struct in the work queue when > processing the samples. Reported-by: Benjamin Herrenschmidt Signed-off-by: Robert Richter Signed-off-by: Greg Kroah-Hartman commit a319dbda7a69f218b56d7a3424f2dba3b7dc2350 Author: Dan Carpenter Date: Wed Aug 25 09:12:29 2010 +0200 sysfs: checking for NULL instead of ERR_PTR commit 57f9bdac2510cd7fda58e4a111d250861eb1ebeb upstream. d_path() returns an ERR_PTR and it doesn't return NULL. Signed-off-by: Dan Carpenter Reviewed-by: "Eric W. Biederman" Signed-off-by: Greg Kroah-Hartman commit 697c5a83eae7228e8591bbbf0f88dbbb73d281f7 Author: Christoph Hellwig Date: Thu Sep 9 16:38:10 2010 -0700 swap: do not send discards as barriers commit 8f2ae0faa3a119158c4dcfe89926d6fad5f5332c upstream. The swap code already uses synchronous discards, no need to add I/O barriers. This fixes the worst of the terrible slowdown in swap allocation for hibernation, reported on 2.6.35 by Nigel Cunningham; but does not entirely eliminate that regression. [tj@kernel.org: superflous newlines removed] Signed-off-by: Christoph Hellwig Tested-by: Nigel Cunningham Signed-off-by: Tejun Heo Signed-off-by: Hugh Dickins Cc: Jens Axboe Cc: James Bottomley Cc: "Martin K. Petersen" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit eb5b5fb7667d74ceeb3c409e20ac0340f48c9d20 Author: Hugh Dickins Date: Thu Sep 9 16:38:11 2010 -0700 swap: discard while swapping only if SWAP_FLAG_DISCARD commit 3399446632739fcd05fd8b272b476a69c6e6d14a upstream. Tests with recent firmware on Intel X25-M 80GB and OCZ Vertex 60GB SSDs show a shift since I last tested in December: in part because of firmware updates, in part because of the necessary move from barriers to awaiting completion at the block layer. While discard at swapon still shows as slightly beneficial on both, discarding 1MB swap cluster when allocating is now disadvanteous: adds 25% overhead on Intel, adds 230% on OCZ (YMMV). Surrender: discard as presently implemented is more hindrance than help for swap; but might prove useful on other devices, or with improvements. So continue to do the discard at swapon, but make discard while swapping conditional on a SWAP_FLAG_DISCARD to sys_swapon() (which has been using only the lower 16 bits of int flags). We can add a --discard or -d to swapon(8), and a "discard" to swap in /etc/fstab: matching the mount option for btrfs, ext4, fat, gfs2, nilfs2. Signed-off-by: Hugh Dickins Cc: Christoph Hellwig Cc: Nigel Cunningham Cc: Tejun Heo Cc: Jens Axboe Cc: James Bottomley Cc: "Martin K. Petersen" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit b77c254d8d66e5e9aa81239fedba9f3d568097d9 Author: Hugh Dickins Date: Thu Sep 9 16:38:09 2010 -0700 swap: prevent reuse during hibernation commit b73d7fcecd93dc15eaa3c45c8c587b613f6673c4 upstream. Move the hibernation check from scan_swap_map() into try_to_free_swap(): to catch not only the common case when hibernation's allocation itself triggers swap reuse, but also the less likely case when concurrent page reclaim (shrink_page_list) might happen to try_to_free_swap from a page. Hibernation already clears __GFP_IO from the gfp_allowed_mask, to stop reclaim from going to swap: check that to prevent swap reuse too. Signed-off-by: Hugh Dickins Cc: KAMEZAWA Hiroyuki Cc: KOSAKI Motohiro Cc: "Rafael J. Wysocki" Cc: Ondrej Zary Cc: Andrea Gelmini Cc: Balbir Singh Cc: Andrea Arcangeli Cc: Nigel Cunningham Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit ac6042dd0aa278b74f774fa35af05721e865a13a Author: Stephen Warren Date: Mon Aug 9 22:41:40 2010 -0600 ALSA: hda - patch_nvhdmi.c: Add missing codec IDs, unify names commit 9cf2657d05f9f9e04c3e113d68bf7cef5a942070 upstream. * Add missing codec IDs. * Modify some existing codec names for discrete GPUs to match newly added IDs. Note: existing names were a mixture of marketing and engineering GPU names. Equally, there's no reason that codec IDs have to be specific to a particular GPU or board, so identify codecs in a less marketing-oriented fashion. * Reformat codec ID table so it's easier to read, for me at least. Signed-off-by: Stephen Warren Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 7a2a632d33a13111fdc7cb141958db8894653279 Author: Daniel Mack Date: Thu Sep 2 17:13:15 2010 +0800 ALSA: usb-audio: Assume first control interface is for audio commit 7b6717e144de6592e614fd7fc3b914b6bf686a9d upstream. For devices with more than one control interface, let's assume the first one contains the audio controls. Unfortunately, there is no field in any of the descriptors to tell us whether a control interface is for audio or MIDI controls, so a better check is not easy to implement. On a composite device with audio and MIDI functions, for example, the code currently overwrites chip->ctrl_intf, causing operations on the control interface to fail if they are issued after the device probe. Signed-off-by: Daniel Mack Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit e46eb17f9d1ed722daae4297623e267c3fc17547 Author: Takashi Iwai Date: Wed Sep 8 14:57:04 2010 +0200 ALSA: hda - Fix wrong HP pin detection in snd_hda_parse_pin_def_config() commit 122661b67899980f1372812d907e73ebcfb3d037 upstream. snd_hda_parse_pin_def_config() has some workaround for re-assigning some pins declared as headphones to line-outs. This didn't work properly for some cases because it used memmove() stupidly wrongly. Reference: Novell bnc#637263 https://bugzilla.novell.com/show_bug.cgi?id=637263 Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit e9073fb9554a452a7ec7731b7f36f1e8e07106fe Author: Brian Austin Date: Tue Sep 7 14:36:22 2010 -0500 ALSA: hda - Add errata initverb sequence for CS42xx codecs commit a769cbcf60cee51f4431c0938acd39e7e5b76b8d upstream. Add init verb sequence for errata ER880C3 http://www.cirrus.com/en/pubs/errata/ER880C3.pdf Signed-off-by: Brian Austin Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 511ff6d61096894acff3664951b52f8584c78776 Author: Takashi Iwai Date: Tue Sep 7 11:58:30 2010 +0200 ALSA: hda - Add quirk for Lenovo T400s commit 4d155641c81203440da64c4633b4efaab75f63b3 upstream. Lenovo T400s requires the quirk to make automatic HP/mic switching working. Reported-by: Frank Becker Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit e45ef8fb8d9e08be9997f2c530ce83237351373f Author: Takashi Iwai Date: Wed Sep 8 08:27:02 2010 +0200 ALSA: usb - Release capture substream URBs properly commit 76195fb096ca6db2f8bbaffb96e3025aaf1649a0 upstream. Due to the wrong "return" in the loop, a capture substream won't be released at disconnection properly if the device is capture only and has no playback substream. This caused Oops occasionally at the device reconnection. Reported-by: Kim Minhyoung Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 7ab99e2ebb57576e1e853e9de18f242558196f6f Author: Takashi Iwai Date: Mon Sep 6 09:13:45 2010 +0200 ALSA: seq/oss - Fix double-free at error path of snd_seq_oss_open() commit 27f7ad53829f79e799a253285318bff79ece15bd upstream. The error handling in snd_seq_oss_open() has several bad codes that do dereferecing released pointers and double-free of kmalloc'ed data. The object dp is release in free_devinfo() that is called via private_free callback. The rest shouldn't touch this object any more. The patch changes delete_port() to call kfree() in any case, and gets rid of unnecessary calls of destructors in snd_seq_oss_open(). Fixes CVE-2010-3080. Reported-and-tested-by: Tavis Ormandy Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 0aa2a836bdf2314b452a7c08a614d5b55029a93c Author: Clemens Ladisch Date: Tue Sep 7 13:38:49 2010 +0200 ALSA: virtuoso: fix setting of Xonar DS line-in/mic-in controls commit fe6ce80ae25953d95ebaf9bce27b585218cda25c upstream. The Line and Mic inputs cannot be used at the same time, so the driver has to automatically disable one of them if both are set. However, it forgot to notify userspace about this change, so the mixer state would be inconsistent. To fix this, check if the other control gets muted, and send a notification event in this case. Signed-off-by: Clemens Ladisch Reported-and-tested-by: Nathan Schagen Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 62f520f10a2b563d3d6239925af57c8f865b48b3 Author: Clemens Ladisch Date: Tue Sep 7 13:37:10 2010 +0200 ALSA: virtuoso: work around missing reset in the Xonar DS Windows driver commit 4c25b93223340deff73381cc47f9244fb379a74d upstream. For the WM8776 chip, this driver uses a different sample format and more features than the Windows driver. When rebooting from Linux into Windows, the latter driver does not reset the chip but assumes all its registers have their default settings, so we get garbled sound or, if the output happened to be muted before rebooting, no sound. To make that driver happy, hook our driver's cleanup function into the shutdown notifier and ensure that the chip gets reset. Signed-off-by: Clemens Ladisch Reported-and-tested-by: Nathan Schagen Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit a8ff79954a0cd5041c2c7ddd96be446ecf1273de Author: Clemens Ladisch Date: Fri Sep 3 10:53:11 2010 +0200 ALSA: usb-audio: fix detection of vendor-specific device protocol settings commit a2acad8298a42b7be684a32fafaf83332bba9c2b upstream. The Audio Class v2 support code in 2.6.35 added checks for the bInterfaceProtocol field. However, there are devices (usually those detected by vendor-specific quirks) that do not have one of the predefined values in this field, which made the driver reject them. To fix this regression, restore the old behaviour, i.e., assume that a device with an unknown bInterfaceProtocol field (other than UAC_VERSION_2) has more or less UAC-v1-compatible descriptors. [compile warning fixes by tiwai] Signed-off-by: Clemens Ladisch Cc: Daniel Mack Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit a6a72ec7a8343e9839f689513f6cc7b35b57487b Author: David Henningsson Date: Thu Sep 2 08:35:47 2010 +0200 ALSA: hda - Add a new hp-laptop model for Conexant 5066, tested on HP G60 commit 048e78a5bc22c27410cb5ca9680c3c7ac400607f upstream. This new model adds the following functionality to HP G60: - Automute of internal speakers - Autoswitch of internal/external mics - Remove SPDIF not physically present BugLink: http://launchpad.net/bugs/587388 Signed-off-by: David Henningsson Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit f723b548653996b6e7dfbabd8e431e3fd1dc3c17 Author: Toby Gray Date: Thu Sep 2 10:46:20 2010 +0100 USB: cdc-acm: Fixing crash when ACM probing interfaces with no endpoint descriptors. commit 577045c0a76e34294f902a7d5d60e90b04d094d0 upstream. Certain USB devices, such as the Nokia X6 mobile phone, don't expose any endpoint descriptors on some of their interfaces. If the ACM driver is forced to probe all interfaces on a device the a NULL pointer dereference will occur when the ACM driver attempts to use the endpoint of the alternative settings. One way to get the ACM driver to probe all the interfaces is by using the /sys/bus/usb/drivers/cdc_acm/new_id interface. This patch checks that the endpoint pointer for the current alternate settings is non-NULL before using it. Signed-off-by: Toby Gray Cc: Oliver Neukum Signed-off-by: Greg Kroah-Hartman commit 67584f5e2e19499c8484991684110730080d7221 Author: Philippe Corbes Date: Tue Aug 31 19:31:32 2010 +0200 USB: cdc-acm: Add pseudo modem without AT command capabilities commit 5b239f0aebd4dd6f85b13decf5e18e86e35d57f0 upstream. cdc-acm.c : Manage pseudo-modem without AT commands capabilities Enable to drive electronic simple gadgets based on microcontrolers. The Interface descriptor is like this: bInterfaceClass 2 Communications bInterfaceSubClass 2 Abstract (modem) bInterfaceProtocol 0 None Signed-off-by: Philippe Corbes Signed-off-by: Greg Kroah-Hartman commit 7b4275fe849cd3f0fd9843e6bdfdd51dfc804d39 Author: Toby Gray Date: Wed Sep 1 16:01:19 2010 +0100 USB: cdc-acm: Adding second ACM channel support for various Nokia and one Samsung phones commit 4035e45632c2a8bb4edae83c20447051bd9a9604 upstream. S60 phones from Nokia and Samsung expose two ACM channels. The first is a modem with a standard AT-command interface, which is picked up correctly by CDC-ACM. The second ACM port is marked as having a vendor-specific protocol. This means that the ACM driver will not claim the second channel by default. This adds support for the second ACM channel for the following devices: Nokia E63 Nokia E75 Nokia 6760 Slide Nokia E52 Nokia E55 Nokia E72 Nokia X6 Nokia N97 Mini Nokia 5800 Xpressmusic Nokia E90 Samsung GTi8510 (INNOV8) Signed-off-by: Toby Gray Cc: Oliver Neukum Signed-off-by: Greg Kroah-Hartman commit aef30a0bfdf6c10565285fff1ae8400b34ee0d81 Author: Simon Arlott Date: Wed Sep 1 18:37:12 2010 +0100 USB: cxacru: Use a bulk/int URB to access the command endpoint commit 902ffc3c707c1d459ea57428a619a807cbe412f9 upstream. The command endpoint is either a bulk or interrupt endpoint, but using the wrong type of transfer causes an error if CONFIG_USB_DEBUG is enabled after commit f661c6f8c67bd55e93348f160d590ff9edf08904, which checks for this mismatch. Detect which type of endpoint it is and use a bulk/int URB as appropriate. There are other function calls specifying a bulk pipe, but usb_clear_halt doesn't use the pipe type (only the endpoint) and usb_bulk_msg auto-detects interrupt transfers. Signed-off-by: Simon Arlott Signed-off-by: Greg Kroah-Hartman commit 652d6da0a0a42632330737e1d6d87c82da819fcf Author: Mimi Zohar Date: Tue Aug 31 09:38:51 2010 -0400 ima: always maintain counters commit e950598d43dce8d97e7d5270808393425d1e5cbd upstream. commit 8262bb85da allocated the inode integrity struct (iint) before any inodes were created. Only after IMA was initialized in late_initcall were the counters updated. This patch updates the counters, whether or not IMA has been initialized, to resolve 'imbalance' messages. This patch fixes the bug as reported in bugzilla: 15673. When the i915 is builtin, the ring_buffer is initialized before IMA, causing the imbalance message on suspend. Reported-by: Thomas Meyer Signed-off-by: Mimi Zohar Tested-by: Thomas Meyer Tested-by: David Safford Signed-off-by: James Morris Signed-off-by: Greg Kroah-Hartman commit d2d1443783dd810cc7d6987a2510ecf43f549f62 Author: Dave Ludlow Date: Wed Sep 1 12:33:30 2010 -0400 usb: serial: mos7840: Add USB IDs to support more B&B USB/RS485 converters. commit 870408c8291015872a7a0b583673a9e56b3e73f4 upstream. Add the USB IDs needed to support the B&B USOPTL4-4P, USO9ML2-2P, and USO9ML2-4P. This patch expands and corrects a typo in the patch sent on 08-31-2010. Signed-off-by: Dave Ludlow Signed-off-by: Greg Kroah-Hartman commit 0679cf82538fcd56cc9f1ac0d892e9e2bf52eb35 Author: Dave Ludlow Date: Tue Aug 31 14:26:17 2010 -0400 usb: serial: mos7840: Add USB ID to support the B&B Electronics USOPTL4-2P. commit caf3a636a9f809fdca5fa746e6687096457accb1 upstream. Add the USB ID needed to support B&B Electronic's 2-port, optically-isolated, powered, USB to RS485 converter. Signed-off-by: Dave Ludlow Signed-off-by: Greg Kroah-Hartman commit 6b0ad10a69b5ecb7e39c249d4e33412e07aa72d7 Author: Luke Lowrey Date: Thu Sep 2 11:39:49 2010 +0100 USB: ftdi_sio: Added custom PIDs for ChamSys products commit 657373883417b2618023fd4135d251ba06a2c30a upstream. Added the 0xDAF8 to 0xDAFF PID range for ChamSys limited USB interface/wing products Signed-off-by: Luke Lowrey Signed-off-by: Greg Kroah-Hartman commit 91ffbb4a336762e363ef74197e712010c6c31e6f Author: Thadeu Lima de Souza Cascardo Date: Sat Aug 28 03:06:29 2010 -0300 usb: allow drivers to use allocated bandwidth until unbound commit 0791971ba8fbc44e4f476079f856335ed45e6324 upstream. When using the remove sysfs file, the device configuration is set to -1 (unconfigured). This eventually unbind drivers with the bandwidth_mutex held. Some drivers may call functions that hold said mutex, like usb_reset_device. This is the case for rtl8187, for example. This will lead to the same process holding the mutex twice, which deadlocks. Besides, according to Alan Stern: "The deadlock problem probably could be handled somehow, but there's a separate issue: Until the usb_disable_device call finishes unbinding the drivers, the drivers are free to continue using their allocated bandwidth. We musn't change the bandwidth allocations until after the unbinding is done. So this patch is indeed necessary." Unbinding the driver before holding the bandwidth_mutex solves the problem. If any operation after that fails, drivers are not bound again. But that would be a problem anyway that the user may solve resetting the device configuration to one that works, just like he would need to do in most other failure cases. Signed-off-by: Thadeu Lima de Souza Cascardo Cc: Alan Stern Cc: Sarah Sharp Signed-off-by: Greg Kroah-Hartman commit a1af0d0dd0d3258f673c509b20c9834e78dbbfac Author: Jason Detring Date: Thu Aug 26 15:08:54 2010 -0500 USB: cp210x: Add B&G H3000 link cable ID commit 0bf7a81c5d447c21db434be35363c44c0a30f598 upstream. This is the cable between an H3000 navigation unit and a multi-function display. http://www.bandg.com/en/Products/H3000/Spares-and-Accessories/Cables/H3000-CPU-USB-Cable-Pack/ Signed-off-by: Jason Detring Signed-off-by: Greg Kroah-Hartman commit 55772a66572b8e888ab6cffc00aa30c4b60aa073 Author: Craig Shelley Date: Mon Aug 23 20:50:57 2010 +0100 USB: CP210x Add new device ID commit 541e05ec3add5ab5bcf238d60161b53480280b20 upstream. New device ID added for Balluff RFID reader. Signed-off-by: Craig Shelley Signed-off-by: Greg Kroah-Hartman commit f813a03cb84b98820bd2f54273a373f0f01973df Author: Maxim Osipov Date: Sat Aug 21 14:54:06 2010 +0400 USB: Fix kernel oops with g_ether and Windows commit 037d3656adbd7e8cb848f01cf5dec423ed76bbe7 upstream. Please find attached patch for https://bugzilla.kernel.org/show_bug.cgi?id=16023 problem. Signed-off-by: Maxim Osipov Signed-off-by: Greg Kroah-Hartman commit 654931d5fa6ad8aec46c6220d800235f2085eef6 Author: Dan Carpenter Date: Sat Aug 14 11:06:19 2010 +0200 USB: ehci-ppc-of: problems in unwind commit 08a3b3b1c2e622e378d9086aee9e2e42ce37591d upstream. The iounmap(ehci->ohci_hcctrl_reg); should be the first thing we do because the ioremap() was the last thing we did. Also if we hit any of the goto statements in the original code then it would have led to a NULL dereference of "ehci". This bug was introduced in: 796bcae7361c "USB: powerpc: Workaround for the PPC440EPX USBH_23 errata [take 3]" I modified the few lines in front a little so that my code didn't obscure the return success code path. Signed-off-by: Dan Carpenter Reviewed-by: Grant Likely Signed-off-by: Greg Kroah-Hartman commit ab36a5f7408546676c79ce7bd20633a5a76ecb58 Author: Sonic Zhang Date: Sat Aug 28 16:32:55 2010 -0400 serial: bfin_sport_uart: restore transmit frame sync fix commit 336746918299f2ca16b31490655b4ff7c8824c87 upstream. The large cleanup/rewrite of resources in commit ccf68e59e93181df9353c0cc accidentally reverted an earlier fix in commit a19e8b205915b2925aca75b. So restore it here. Signed-off-by: Sonic Zhang Signed-off-by: Mike Frysinger Signed-off-by: Greg Kroah-Hartman commit 1e34225fcdadc793e910d5edfd9c2a48930d42d4 Author: Sunil Mushran Date: Thu Aug 12 16:24:26 2010 -0700 ocfs2: Fix incorrect checksum validation error commit f5ce5a08a40f2086435858ddc80cb40394b082eb upstream. For local mounts, ocfs2_read_locked_inode() calls ocfs2_read_blocks_sync() to read the inode off the disk. The latter first checks to see if that block is cached in the journal, and, if so, returns that block. That is ok. But ocfs2_read_locked_inode() goes wrong when it tries to validate the checksum of such blocks. Blocks that are cached in the journal may not have had their checksum computed as yet. We should not validate the checksums of such blocks. Fixes ossbz#1282 http://oss.oracle.com/bugzilla/show_bug.cgi?id=1282 Signed-off-by: Sunil Mushran Singed-off-by: Tao Ma Signed-off-by: Greg Kroah-Hartman commit 5f555d8ad4b3e1cd500f6dac90b317c61695a19a Author: Luis R. Rodriguez Date: Mon Aug 30 19:26:33 2010 -0400 ath9k_hw: fix parsing of HT40 5 GHz CTLs commit 904879748d7439a6dabdc6be9aad983e216b027d upstream. The 5 GHz CTL indexes were not being read for all hardware devices due to the masking out through the CTL_MODE_M mask being one bit too short. Without this the calibrated regulatory maximum values were not being picked up when devices operate on 5 GHz in HT40 mode. The final output power used for Atheros devices is the minimum between the calibrated CTL values and what CRDA provides. Signed-off-by: Luis R. Rodriguez Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 5db688f45431d16ac961b441d4125f7b1243051d Author: Luis R. Rodriguez Date: Mon Aug 30 19:26:32 2010 -0400 ath9k_hw: Fix EEPROM uncompress block reading on AR9003 commit 803288e61e346ba367373bc7d5eeb6e11c81a33c upstream. The EEPROM is compressed on AR9003, upon decompression the wrong upper limit was being used for the block which prevented the 5 GHz CTL indexes from being used, which are stored towards the end of the EEPROM block. This fix allows the actual intended regulatory limits to be used on AR9003 hardware. Signed-off-by: Luis R. Rodriguez Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit f8d958a95ec0f26ff05bdc75f24887203e701826 Author: Vivek Natarajan Date: Thu Aug 12 14:23:28 2010 +0530 ath9k_htc: Fix disconnect issue in HT40 mode. commit 71ba186c123630ddab17667ec9ecf7e2ef211295 upstream. Some APs advertise that they may be HT40 capable in the capabilites but the current operating channel configuration may be only HT20. This causes disconnection as ath9k_htc sets WLAN_RC_40_FLAG despite the AP operating in HT20 mode. Hence set this flag only if the current channel configuration is HT40 enabled. Signed-off-by: Vivek Natarajan Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 58b29725e5bd74da734c6f3fd1eac934a8fed73e Author: Johannes Berg Date: Wed Aug 25 14:47:38 2010 +0200 mac80211: delete work timer commit 071249b1d501b1f31a6b1af3fbcbe03158a84e5c upstream. The new workqueue changes helped me find this bug that's been lingering since the changes to the work processing in mac80211 -- the work timer is never deleted properly. Do that to avoid having it fire after all data structures have been freed. It can't be re-armed because all it will do, if running, is schedule the work, but that gets flushed later and won't have anything to do since all work items are gone by now (by way of interface removal). Signed-off-by: Johannes Berg Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit b7a83862f3f9b3b95719a5c3dafacdf2bb52ddda Author: Miklos Szeredi Date: Tue Sep 7 13:42:41 2010 +0200 fuse: flush background queue on connection close commit 595afaf9e6ee1b48e13ec4b8bcc8c7dee888161a upstream. David Bartly reported that fuse can hang in fuse_get_req_nofail() when the connection to the filesystem server is no longer active. If bg_queue is not empty then flush_bg_queue() called from request_end() can put more requests on to the pending queue. If this happens while ending requests on the processing queue then those background requests will be queued to the pending list and never ended. Another problem is that fuse_dev_release() didn't wake up processes sleeping on blocked_waitq. Solve this by: a) flushing the background queue before calling end_requests() on the pending and processing queues b) setting blocked = 0 and waking up processes waiting on blocked_waitq() Thanks to David for an excellent bug report. Reported-by: David Bartley Signed-off-by: Miklos Szeredi Signed-off-by: Greg Kroah-Hartman commit eddbe634c915e5243906558cd091a00988b86b00 Author: Hank Janssen Date: Wed Sep 1 11:10:41 2010 -0700 staging: hv: Fixed lockup problem with bounce_buffer scatter list commit 77c5ceaff31645ea049c6706b99e699eae81fb88 upstream. Fixed lockup problem with bounce_buffer scatter list which caused crashes in heavy loads. And minor code indentation cleanup in effected area. Removed whitespace and noted minor indentation changes in description as pointed out by Joe Perches. (Thanks for reviewing Joe) Signed-off-by: Hank Janssen Signed-off-by: Haiyang Zhang Signed-off-by: Greg Kroah-Hartman commit bac51cb88cbcddeffc45e16a3224b992dc19ec66 Author: Hank Janssen Date: Thu Aug 5 19:30:31 2010 +0000 staging: hv: Increased storvsc ringbuffer and max_io_requests commit 15dd1c9f53b31cdc84b8072a88c23fa09527c596 upstream. Increased storvsc ringbuffer and max_io_requests. This now more closely mimics the numbers on Hyper-V. And will allow more IO requests to take place for the SCSI driver. Max_IO is set to double from what it was before, Hyper-V allows it and we have had appliance builder requests to see if it was a problem to increase the number. Ringbuffer size for storvsc is now increased because I have seen A few buffer problems on extremely busy systems. They were Set pretty low before. And since max_io_requests is increased I Really needed to increase the buffer as well. Signed-off-by: Hank Janssen Signed-off-by: Haiyang Zhang Signed-off-by: Greg Kroah-Hartman commit 7d98d6ffab9bca18d610ec08cbd2b41b2911f315 Author: Haiyang Zhang Date: Thu Aug 5 19:30:01 2010 +0000 staging: hv: Fixed the value of the 64bit-hole inside ring buffer commit e5fa721d1c2a54261a37eb59686e18dee34b6af6 upstream. Fixed the value of the 64bit-hole inside ring buffer, this caused a problem on Hyper-V when running checked Windows builds. Checked builds of Windows are used internally and given to external system integrators at times. They are builds that for example that all elements in a structure follow the definition of that Structure. The bug this fixed was for a field that we did not fill in at all (Because we do Not use it on the Linux side), and the checked build of windows gives errors on it internally to the Windows logs. This fixes that error. Signed-off-by: Hank Janssen Signed-off-by: Haiyang Zhang Signed-off-by: Greg Kroah-Hartman commit 0dfc7206252e2dcb48d4b0d69147616261dda491 Author: Hank Janssen Date: Thu Aug 5 19:29:44 2010 +0000 staging: hv: Fixed bounce kmap problem by using correct index commit 0c47a70a9a8a6d1ec37a53d2f9cb82f8b8ef8aa2 upstream. Fixed bounce offset kmap problem by using correct index. The symptom of the problem is that in some NAS appliances this problem represents Itself by a unresponsive VM under a load with many clients writing small files. Signed-off-by:Hank Janssen Signed-off-by:Haiyang Zhang Signed-off-by: Greg Kroah-Hartman commit 920438158deaee30a18bdb3d2f491443c45afdb8 Author: Haiyang Zhang Date: Tue Aug 3 19:15:31 2010 +0000 staging: hv: Fix missing functions for net_device_ops commit b681b5886bb5d1f5b6750a0ed7c62846da7ccea4 upstream. Fix missing functions for net_device_ops. It's a bug when porting the drivers from 2.6.27 to 2.6.32. In 2.6.27, the default functions for Ethernet, like eth_change_mtu(), were assigned by ether_setup(). But in 2.6.32, these function pointers moved to net_device_ops structure and no longer be assigned in ether_setup(). So we need to set these functions in our driver code. It will ensure the MTU won't be set beyond 1500. Otherwise, this can cause an error on the server side, because the HyperV linux driver doesn't support jumbo frame yet. Signed-off-by: Haiyang Zhang Signed-off-by: Hank Janssen Signed-off-by: Greg Kroah-Hartman commit 738931dd84518fc0ef51bfb4715c11738dbd715e Author: Ben Hutchings Date: Sun Aug 29 02:13:11 2010 +0100 Staging: rt2870sta: Add more device IDs from vendor drivers commit 9e693e4375689cb1cd1529aba011de0044f74ef5 upstream. Taken from DPO_RT3070_LinuxSTA_V2.3.0.4_20100604.tar.bz2 and 2010_0709_RT2870_Linux_STA_v2.4.0.1.tar.bz2, with duplicates removed. Signed-off-by: Ben Hutchings Signed-off-by: Greg Kroah-Hartman commit 34096073e8ca66f69a42b2697bf1ccc8dc805843 Author: Takashi Iwai Date: Fri Jul 30 14:08:25 2010 +0200 ALSA: hda - Handle pin NID 0x1a on ALC259/269 commit b08b1637ce1c0196970348bcabf40f04b6b3d58e upstream. The pin NID 0x1a should be handled as well as NID 0x1b. Also added comments. Signed-off-by: Takashi Iwai Cc: David Henningsson Signed-off-by: Greg Kroah-Hartman commit 96f44a8631764ad755ed701efd7e2b5193e54474 Author: Takashi Iwai Date: Fri Jul 30 10:51:10 2010 +0200 ALSA: hda - Handle missing NID 0x1b on ALC259 codec commit 5d4abf93ea3192cc666430225a29a4978c97c57d upstream. Since ALC259/269 use the same parser of ALC268, the pin 0x1b was ignored as an invalid widget. Just add this NID to handle properly. This will add the missing mixer controls for some devices. Signed-off-by: Takashi Iwai Cc: David Henningsson Signed-off-by: Greg Kroah-Hartman commit e3086e9d419b26bd00da78c204c0ab30f1cbbd51 Author: Benjamin Herrenschmidt Date: Mon Aug 9 13:48:08 2010 +1000 Revert "Input: appletouch - fix integer overflow issue" commit 6e49c1a407c8af8d779a24fd2428857991514a7b upstream. This reverts commit 04b4b88cca0ebe3813b4b6f014fb6a0db380b137. While the original problem only caused a slight disturbance on the edge of the touchpad, the commit above to "fix" it completely breaks operation on some other models such as mine. We'll sort this out separately, revert the patch for now. Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman commit 96d55caad409caedd5c0d8342cc76c5d8d6a80fd Author: Christoph Hellwig Date: Sun Jul 18 21:17:10 2010 +0000 xfs: move aio completion after unwritten extent conversion commit fb511f2150174b18b28ad54708c1adda0df39b17 upstream. If we write into an unwritten extent using AIO we need to complete the AIO request after the extent conversion has finished. Without that a read could race to see see the extent still unwritten and return zeros. For synchronous I/O we already take care of that by flushing the xfsconvertd workqueue (which might be a bit of overkill). To do that add iocb and result fields to struct xfs_ioend, so that we can call aio_complete from xfs_end_io after the extent conversion has happened. Note that we need a new result field as io_error is used for positive errno values, while the AIO code can return negative error values and positive transfer sizes. Signed-off-by: Christoph Hellwig Reviewed-by: Dave Chinner Signed-off-by: Alex Elder Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman commit f2b23f0ffc7acdc8a49ba749e3843c43e97c301a Author: Jiaying Zhang Date: Tue Jul 27 11:56:06 2010 -0400 ext4: move aio completion after unwritten extent conversion commit 5b3ff237bef43b9e7fb7d1eb858e29b73fd664f9 upstream. This patch is to be applied upon Christoph's "direct-io: move aio_complete into ->end_io" patch. It adds iocb and result fields to struct ext4_io_end_t, so that we can call aio_complete from ext4_end_io_nolock() after the extent conversion has finished. I have verified with Christoph's aio-dio test that used to fail after a few runs on an original kernel but now succeeds on the patched kernel. See http://thread.gmane.org/gmane.comp.file-systems.ext4/19659 for details. Signed-off-by: Jiaying Zhang Signed-off-by: "Theodore Ts'o" Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman commit 1ee3a461df139a0dc8642d951a41507fd80df30c Author: Christoph Hellwig Date: Sun Jul 18 21:17:09 2010 +0000 direct-io: move aio_complete into ->end_io commit 40e2e97316af6e62affab7a392e792494b8d9dde upstream. Filesystems with unwritten extent support must not complete an AIO request until the transaction to convert the extent has been commited. That means the aio_complete calls needs to be moved into the ->end_io callback so that the filesystem can control when to call it exactly. This makes a bit of a mess out of dio_complete and the ->end_io callback prototype even more complicated. Signed-off-by: Christoph Hellwig Reviewed-by: Jan Kara Signed-off-by: Alex Elder Cc: Chuck Ebbert Signed-off-by: Greg Kroah-Hartman commit 339cdb0406b8faae3a8250478059360f32e6a1bf Author: Ben Hutchings Date: Fri Jul 23 14:56:28 2010 +0100 PCI: MSI: Restore read_msi_msg_desc(); add get_cached_msi_msg_desc() commit 30da55242818a8ca08583188ebcbaccd283ad4d9 upstream. commit 2ca1af9aa3285c6a5f103ed31ad09f7399fc65d7 "PCI: MSI: Remove unsafe and unnecessary hardware access" changed read_msi_msg_desc() to return the last MSI message written instead of reading it from the device, since it may be called while the device is in a reduced power state. However, the pSeries platform code really does need to read messages from the device, since they are initially written by firmware. Therefore: - Restore the previous behaviour of read_msi_msg_desc() - Add new functions get_cached_msi_msg{,_desc}() which return the last MSI message written - Use the new functions where appropriate Acked-by: Michael Ellerman Signed-off-by: Ben Hutchings Signed-off-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman commit fa4dc90c63ad8bd633a082f848c937d0d967d162 Author: Ben Hutchings Date: Thu Jun 17 20:16:36 2010 +0100 PCI: MSI: Remove unsafe and unnecessary hardware access commit fcd097f31a6ee207cc0c3da9cccd2a86d4334785 upstream. During suspend on an SMP system, {read,write}_msi_msg_desc() may be called to mask and unmask interrupts on a device that is already in a reduced power state. At this point memory-mapped registers including MSI-X tables are not accessible, and config space may not be fully functional either. While a device is in a reduced power state its interrupts are effectively masked and its MSI(-X) state will be restored when it is brought back to D0. Therefore these functions can simply read and write msi_desc::msg for devices not in D0. Further, read_msi_msg_desc() should only ever be used to update a previously written message, so it can always read msi_desc::msg and never needs to touch the hardware. Tested-by: "Michael Chan" Signed-off-by: Ben Hutchings Signed-off-by: Jesse Barnes Signed-off-by: Greg Kroah-Hartman commit aa7fe1f4b6b1380162c10676676abdc29fdb4461 Author: Florian Westphal Date: Mon Aug 23 14:41:22 2010 -0700 netfilter: fix CONFIG_COMPAT support commit cca77b7c81876d819a5806f408b3c29b5b61a815 upstream. commit f3c5c1bfd430858d3a05436f82c51e53104feb6b (netfilter: xtables: make ip_tables reentrant) forgot to also compute the jumpstack size in the compat handlers. Result is that "iptables -I INPUT -j userchain" turns into -j DROP. Reported by Sebastian Roesner on #netfilter, closes http://bugzilla.netfilter.org/show_bug.cgi?id=669. Note: arptables change is compile-tested only. Signed-off-by: Florian Westphal Acked-by: Eric Dumazet Tested-by: Mikael Pettersson Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 133aa6cbaf169f375a70d0ed8df7bc2ab583cc34 Author: Lin Ming Date: Wed Aug 25 21:06:32 2010 +0000 perf, x86, Pentium4: Clear the P4_CCCR_FORCE_OVF flag commit 8d330919927ea31fa083b5a80084dc991da813a0 upstream. If on Pentium4 CPUs the FORCE_OVF flag is set then an NMI happens on every event, which can generate a flood of NMIs. Clear it. Reported-by: Vince Weaver Signed-off-by: Lin Ming Signed-off-by: Cyrill Gorcunov Cc: Frederic Weisbecker Cc: Peter Zijlstra Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit de9711df2a891af562936c1eafb3c2e25121c213 Author: Suresh Siddha Date: Thu Aug 19 17:03:38 2010 -0700 x86, tsc, sched: Recompute cyc2ns_offset's during resume from sleep states commit cd7240c0b900eb6d690ccee088a6c9b46dae815a upstream. TSC's get reset after suspend/resume (even on cpu's with invariant TSC which runs at a constant rate across ACPI P-, C- and T-states). And in some systems BIOS seem to reinit TSC to arbitrary large value (still sync'd across cpu's) during resume. This leads to a scenario of scheduler rq->clock (sched_clock_cpu()) less than rq->age_stamp (introduced in 2.6.32). This leads to a big value returned by scale_rt_power() and the resulting big group power set by the update_group_power() is causing improper load balancing between busy and idle cpu's after suspend/resume. This resulted in multi-threaded workloads (like kernel-compilation) go slower after suspend/resume cycle on core i5 laptops. Fix this by recomputing cyc2ns_offset's during resume, so that sched_clock() continues from the point where it was left off during suspend. Reported-by: Florian Pritz Signed-off-by: Suresh Siddha Signed-off-by: Peter Zijlstra LKML-Reference: <1282262618.2675.24.camel@sbsiddha-MOBL3.sc.intel.com> Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit 6d09dba30dfb88cd8bd3c73d09e4c4209bfd1847 Author: Dave Chinner Date: Tue Aug 24 11:44:34 2010 +1000 writeback: write_cache_pages doesn't terminate at nr_to_write <= 0 commit 546a1924224078c6f582e68f890b05b387b42653 upstream. I noticed XFS writeback in 2.6.36-rc1 was much slower than it should have been. Enabling writeback tracing showed: flush-253:16-8516 [007] 1342952.351608: wbc_writepage: bdi 253:16: towrt=1024 skip=0 mode=0 kupd=0 bgrd=1 reclm=0 cyclic=1 more=0 older=0x0 start=0x0 end=0x0 flush-253:16-8516 [007] 1342952.351654: wbc_writepage: bdi 253:16: towrt=1023 skip=0 mode=0 kupd=0 bgrd=1 reclm=0 cyclic=1 more=0 older=0x0 start=0x0 end=0x0 flush-253:16-8516 [000] 1342952.369520: wbc_writepage: bdi 253:16: towrt=0 skip=0 mode=0 kupd=0 bgrd=1 reclm=0 cyclic=1 more=0 older=0x0 start=0x0 end=0x0 flush-253:16-8516 [000] 1342952.369542: wbc_writepage: bdi 253:16: towrt=-1 skip=0 mode=0 kupd=0 bgrd=1 reclm=0 cyclic=1 more=0 older=0x0 start=0x0 end=0x0 flush-253:16-8516 [000] 1342952.369549: wbc_writepage: bdi 253:16: towrt=-2 skip=0 mode=0 kupd=0 bgrd=1 reclm=0 cyclic=1 more=0 older=0x0 start=0x0 end=0x0 Writeback is not terminating in background writeback if ->writepage is returning with wbc->nr_to_write == 0, resulting in sub-optimal single page writeback on XFS. Fix the write_cache_pages loop to terminate correctly when this situation occurs and so prevent this sub-optimal background writeback pattern. This improves sustained sequential buffered write performance from around 250MB/s to 750MB/s for a 100GB file on an XFS filesystem on my 8p test VM. Signed-off-by: Dave Chinner Reviewed-by: Wu Fengguang Reviewed-by: Christoph Hellwig Signed-off-by: Greg Kroah-Hartman commit 480a3d4a3bd4f645c8d5139fc65922be14ba09fa Author: Tejun Heo Date: Tue Aug 17 14:13:42 2010 +0200 pata_cmd64x: revert commit d62f5576 commit aba8a08ded89a74f1ba04ae94ecc98f26e27d41c upstream. Commit d62f5576 (pata_cmd64x: fix handling of address setup timings) incorrectly called ata_timing_compute() on UDMA mode on 0 @UT leading to devide by zero fault. Revert it until better fix is available. This is reported in bko#16607 by Milan Kocian who also root caused it. https://bugzilla.kernel.org/show_bug.cgi?id=16607 Signed-off-by: Tejun Heo Reported-and-root-caused-by: Milan Kocian Cc: Bartlomiej Zolnierkiewicz Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit 004c068df2ac250553936de1833c59b6294e266b Author: Mark Lord Date: Thu Aug 19 21:40:44 2010 -0400 sata_mv: fix broken DSM/TRIM support (v2) commit 44b733809a5aba7f6b15a548d31a56d25bf3851c upstream. Fix DSM/TRIM commands in sata_mv (v2). These need to be issued using old-school "BM DMA", rather than via the EDMA host queue. Since the chips don't have proper BM DMA status, we need to be more careful with setting the ATA_DMA_INTR bit, since DSM/TRIM often has a long delay between "DMA complete" and "command complete". GEN_I chips don't have BM DMA, so no TRIM for them. Signed-off-by: Mark Lord Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit 53c51d4aeb274e26155cfff8e09f0aad32f667a0 Author: Mark Lord Date: Fri Aug 20 10:13:16 2010 -0400 libata-sff: remove harmful BUG_ON from ata_bmdma_qc_issue commit 55ee67f837882f28a900705a2ca1af257ab6c53d upstream. Remove harmful BUG_ON() from ata_bmdma_qc_issue(), as it casts too wide of a net and breaks sata_mv. It also crashes the kernel while doing the BUG_ON(). There's already a WARN_ON_ONCE() further down to catch the case of POLLING for a BMDMA operation. Signed-off-by: Mark Lord Signed-off-by: Jeff Garzik Signed-off-by: Greg Kroah-Hartman commit d518262124b8577550865a6a82ea25be4ef40ac1 Author: David Henningsson Date: Thu Jul 29 14:46:42 2010 +0200 ALSA: hda - Rename iMic to Int Mic on Lenovo NB0763 commit 150b432f448281d5518f5229d240923f9a9c5459 upstream. The non-standard name "iMic" makes PulseAudio ignore the microphone. BugLink: https://launchpad.net/bugs/605101 Signed-off-by: David Henningsson Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit ba106dfd9692193e4406ced6314c57762a5c7520 Author: David Henningsson Date: Tue Aug 10 09:18:00 2010 +0200 ALSA: HDA: Use model=auto for LG R510 commit 81cd3fca642cecb40a1ccef099799dcb5730734b upstream. Two users report model=auto is needed to make the internal mic work properly. BugLink: https://bugs.launchpad.net/bugs/495134 Signed-off-by: David Henningsson Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 5beda62ad5ad32189e1e872afb5cc7cbedfcd6fb Author: David Henningsson Date: Mon Aug 23 08:14:35 2010 +0200 ALSA: hda - Add Sony VAIO quirk for ALC269 commit dbbcbc073ad3132bfbc410b11546b2fb4bdf2568 upstream. The attached patch enables playback on a Sony VAIO machine. BugLink: http://launchpad.net/bugs/618271 Signed-off-by: David Henningsson Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit efa1f7cba7a728169b7c797dc66cab2a9d8526de Author: Dave Chinner Date: Tue Aug 24 11:42:41 2010 +1000 xfs: ensure we mark all inodes in a freed cluster XFS_ISTALE commit 5b3eed756cd37255cad1181bd86bfd0977e97953 upstream. Under heavy load parallel metadata loads (e.g. dbench), we can fail to mark all the inodes in a cluster being freed as XFS_ISTALE as we skip inodes we cannot get the XFS_ILOCK_EXCL or the flush lock on. When this happens and the inode cluster buffer has already been marked stale and freed, inode reclaim can try to write the inode out as it is dirty and not marked stale. This can result in writing th metadata to an freed extent, or in the case it has already been overwritten trigger a magic number check failure and return an EUCLEAN error such as: Filesystem "ram0": inode 0x442ba1 background reclaim flush failed with 117 Fix this by ensuring that we hoover up all in memory inodes in the cluster and mark them XFS_ISTALE when freeing the cluster. Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Signed-off-by: Greg Kroah-Hartman commit cf4f5ceca8d72ee794410cb26dc4b64b11d4965f Author: Dave Chinner Date: Tue Aug 24 11:42:30 2010 +1000 xfs: fix untrusted inode number lookup commit 4536f2ad8b330453d7ebec0746c4374eadd649b1 upstream. Commit 7124fe0a5b619d65b739477b3b55a20bf805b06d ("xfs: validate untrusted inode numbers during lookup") changes the inode lookup code to do btree lookups for untrusted inode numbers. This change made an invalid assumption about the alignment of inodes and hence incorrectly calculated the first inode in the cluster. As a result, some inode numbers were being incorrectly considered invalid when they were actually valid. The issue was not picked up by the xfstests suite because it always runs fsr and dump (the two utilities that utilise the bulkstat interface) on cache hot inodes and hence the lookup code in the cold cache path was not sufficiently exercised to uncover this intermittent problem. Fix the issue by relaxing the btree lookup criteria and then checking if the record returned contains the inode number we are lookup for. If it we get an incorrect record, then the inode number is invalid. Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Signed-off-by: Greg Kroah-Hartman commit fb412a178502dc498430723b082a932f797e4763 Author: Jeremy Fitzhardinge Date: Fri Aug 20 18:57:53 2010 -0700 xen: use percpu interrupts for IPIs and VIRQs commit aaca49642b92c8a57d3ca5029a5a94019c7af69f upstream. IPIs and VIRQs are inherently per-cpu event types, so treat them as such: - use a specific percpu irq_chip implementation, and - handle them with handle_percpu_irq This makes the path for delivering these interrupts more efficient (no masking/unmasking, no locks), and it avoid problems with attempts to migrate them. Signed-off-by: Jeremy Fitzhardinge Signed-off-by: Greg Kroah-Hartman commit 62b1700a2d04d5a5a8a506b7c604be9bd0b5ca79 Author: Jeremy Fitzhardinge Date: Fri Aug 20 19:10:01 2010 -0700 xen: handle events as edge-triggered commit dffe2e1e1a1ddb566a76266136c312801c66dcf7 upstream. Xen events are logically edge triggered, as Xen only calls the event upcall when an event is newly set, but not continuously as it remains set. As a result, use handle_edge_irq rather than handle_level_irq. This has the important side-effect of fixing a long-standing bug of events getting lost if: - an event's interrupt handler is running - the event is migrated to a different vcpu - the event is re-triggered The most noticable symptom of these lost events is occasional lockups of blkfront. Many thanks to Tom Kopec and Daniel Stodden in tracking this down. Signed-off-by: Jeremy Fitzhardinge Cc: Tom Kopec Cc: Daniel Stodden Signed-off-by: Greg Kroah-Hartman commit 4427834682c11181af9627b99beabbe38f0830be Author: Andreas Herrmann Date: Wed Aug 25 15:42:12 2010 +0200 hwmon: (k8temp) Differentiate between AM2 and ASB1 commit a05e93f3b3fc2f53c1d0de3b17019e207c482349 upstream. Commit 8bf0223ed515be24de0c671eedaff49e78bebc9c (hwmon, k8temp: Fix temperature reporting for ASB1 processor revisions) fixed temperature reporting for ASB1 CPUs. But those CPU models (model 0x6b, 0x6f, 0x7f) were packaged both as AM2 (desktop) and ASB1 (mobile). Thus the commit leads to wrong temperature reporting for AM2 CPU parts. The solution is to determine the package type for models 0x6b, 0x6f, 0x7f. This is done using BrandId from CPUID Fn8000_0001_EBX[15:0]. See "Constructing the processor Name String" in "Revision Guide for AMD NPT Family 0Fh Processors" (Rev. 3.46). Cc: Rudolf Marek Reported-by: Vladislav Guberinic Signed-off-by: Andreas Herrmann Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit b3f69c04298fecbd5ca382679bac644433771dae Author: Axel Lin Date: Wed Aug 25 15:42:10 2010 +0200 hwmon: (ads7871) Fix ads7871_probe error paths commit c12c507d7185fe4e8ada7ed9832957576eefecf8 upstream. 1. remove 'status' variable 2. remove unneeded initialization of 'err' variable 3. return missing error code if sysfs_create_group fail. 4. fix the init sequence as: - check hardware existence - kzalloc for ads7871_data - sysfs_create_group - hwmon_device_register Signed-off-by: Axel Lin Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman