commit 2150f72fe35397cc6d6ce39866bd0462cfbcc916
Author: Will Deacon <email address hidden>
Date: Fri Dec 2 18:16:01 2011 +0100
ARM: 7185/1: perf: don't assign platform_device on unsupported CPUs
In the unlikely case that a platform registers a PMU platform_device
when running on a CPU that is unsupported by perf, we will encounter a
NULL dereference when trying to assign the platform_device to the
cpu_pmu structure.
This patch checks that the CPU is supported by perf before assigning
the platform_device.
Reported-by: Pawel Moll <email address hidden>
Signed-off-by: Will Deacon <email address hidden>
Signed-off-by: Russell King <email address hidden>
(cherry picked from commit 6bd054096dce061560cee0e016e292e588dc438f)
commit f8489660a18c1865ee4f4a47593fd2dcf67a4e88
Author: Will Deacon <email address hidden>
Date: Tue Nov 22 18:01:46 2011 +0000
ARM: perf: check that we have a platform device when reserving PMU
Attempting to use a hardware counter on a platform with a supported PMU
but where the platform_device (defining the interrupts) has not been
registered results in a NULL pointer dereference.
This patch fixes the problem by checking that we actually have a platform
device registered before attempting to grab the interrupts.
Reported-by: Pawel Moll <email address hidden>
Signed-off-by: Will Deacon <email address hidden>
(cherry picked from commit e5a21327644adba32816f74a415114d11c57f2e9)
commit 6014abe68ef9c0a32e9c41434d50f56a7d65bc04
Author: Will Deacon <email address hidden>
Date: Thu Nov 17 15:05:14 2011 +0000
ARM: perf: initialise used_mask for fake PMU during validation
When validating an event group, we call pmu->get_event_idx for each
group member in order to check that the group can be scheduled as a
unit on an empty PMU.
As a result of 3fc2c830 ("ARM: perf: remove event limit from
pmu_hw_events"), the used_mask member of struct cpu_hw_events must be
setup explicitly, something which we don't do for the fake cpu_hw_events
used for validation.
This patch sets up an empty used_mask for the fake validation
cpu_hw_events, preventing NULL deferences when trying to get the event
index.
Reported-by: Pawel Moll <email address hidden>
Signed-off-by: Will Deacon <email address hidden>
(cherry picked from commit bce34d14428d35d9a06ddc10cd46ecef311764c9)
commit 1226e419377fb4b53d6e08c0a9fd5ecf90597cd6
Merge: ec5237f e82b9d8
Author: Nicolas Pitre <email address hidden>
Date: Wed Dec 14 12:08:53 2011 -0500
Merge branch 'thermal_cpu_cooling' of git://git.linaro.org/people/amitdanielk/linux into linaro-3.1
Conflicts:
drivers/thermal/Kconfig
drivers/thermal/Makefile
commit ec5237f097a75b7f4d19b87377ef1557431fb199
Author: Amit Daniel Kachhap <email address hidden>
Date: Tue Dec 13 20:40:01 2011 +0530
thermal: Add generic cpu cooling implementation
This patch adds support for generic cpu thermal cooling low level
implementations using frequency scaling and cpuhotplugg currently.
Different cpu related cooling devices can be registered by the
user and the binding of these cooling devices to the corresponding
trip points can be easily done as the registration API's return the
cooling device pointer.
Signed-off-by: Amit Daniel Kachhap <email address hidden>
Signed-off-by: Nicolas Pitre <email address hidden>
commit adb2b0bf1daac11ea0284ba259ce0f88c9231591
Author: Amit Daniel Kachhap <email address hidden>
Date: Thu Dec 1 18:51:39 2011 +0530
thermal: Add a new trip type to use cooling device instance number
This patch adds a new trip type THERMAL_TRIP_STATE_ACTIVE. This
trip behaves same as THERMAL_TRIP_ACTIVE but also passes the cooling
device instance number. This helps the cooling device registered as
different instances to perform appropriate cooling action decision in
the set_cur_state call back function.
Also since the trip temperature's are in ascending order so some logic
is put in place to skip the un-necessary checks.
Signed-off-by: Amit Daniel Kachhap <email address hidden>
Signed-off-by: Nicolas Pitre <email address hidden>
commit e82b9d821ecc1f857142a55b0fb38d0d5256fbaf
Author: Amit Daniel Kachhap <email address hidden>
Date: Wed Dec 14 21:44:07 2011 +0530
ARM: exynos4: Add thermal sensor driver platform device support
This patch adds necessary source definations needed for TMU driver and
the platform device support.
Signed-off-by: Amit Daniel Kachhap <email address hidden>
commit 6bdad5c64b0482e61d20e22ddcfae40b2aa9f83f
Author: Amit Daniel Kachhap <email address hidden>
Date: Mon Dec 12 11:01:39 2011 +0530
hwmon: exynos4: Add cpu frequency clip data for certain threshold
This patch helps to modify the exynos4 tmu to get the frequency clipping
data from the platform if needed for a temperature trip points.
Signed-off-by: Amit Daniel Kachhap <email address hidden>
commit 15bfc7956f3fef104c3b3d14a414f9e80eb94d41
Author: Amit Daniel Kachhap <email address hidden>
Date: Tue Dec 13 14:57:23 2011 +0530
thermal: exynos4: Export information from the TMU driver
Export information from the hwmon tmu sensor to the samsung exynos
kernel thermal framework where different cooling devices and thermal
zone are binded. The exported information is based according to the
data structure thermal_sensor_info present in exynos_thermal.h.
HWMON sysfs functions are commented out as they are also present
in generic linux thermal layer.
Signed-off-by: Amit Daniel Kachhap <email address hidden>
commit d9f151cda68a86d176b0d6773c019eeae1d58301
Author: Amit Daniel Kachhap <email address hidden>
Date: Mon Dec 12 10:44:36 2011 +0530
thermal: exynos: Add thermal interface support for linux thermal layer
This codes uses the generic linux thermal layer and creates a bridge
between temperature sensors, linux thermal framework and cooling devices
for samsung exynos platform. This layer recieves or monitor
the temperature from the sensor and informs the generic thermal layer.
Signed-off-by: Amit Daniel Kachhap <email address hidden>
commit a3cb3d54f43aa6fdae32be9b0e12b66a0ccedfc3
Author: Amit Daniel Kachhap <email address hidden>
Date: Fri Nov 25 15:15:18 2011 +0530
ARM: EXYNOS4: Add tmu hwmon driver
Signed-off-by: Amit Daniel Kachhap <email address hidden>
commit 0e939cfbb42214337ecd1782c4e233972ed90630
Author: Amit Daniel Kachhap <email address hidden>
Date: Tue Dec 13 20:40:01 2011 +0530
thermal: Add generic cpu cooling implementation
This patch adds support for generic cpu thermal cooling low level
implementations using frequency scaling and cpuhotplugg currently.
Different cpu related cooling devices can be registered by the
user and the binding of these cooling devices to the corresponding
trip points can be easily done as the registration API's return the
cooling device pointer.
Signed-off-by: Amit Daniel Kachhap <email address hidden>
commit 3918a3c61ea129534f6c9343df59a73f23a3a331
Author: Amit Daniel Kachhap <email address hidden>
Date: Thu Dec 1 18:51:39 2011 +0530
thermal: Add a new trip type to use cooling device instance number
This patch adds a new trip type THERMAL_TRIP_STATE_ACTIVE. This
trip behaves same as THERMAL_TRIP_ACTIVE but also passes the cooling
device instance number. This helps the cooling device registered as
different instances to perform appropriate cooling action decision in
the set_cur_state call back function.
Also since the trip temperature's are in ascending order so some logic
is put in place to skip the un-necessary checks.
Signed-off-by: Amit Daniel Kachhap <email address hidden>
commit ceb077bd2729f64b4680f81dc8dee308890ac52f
Author: Jongpill Lee <email address hidden>
Date: Tue Jul 5 13:36:19 2011 +0530
EXYNOS4210: Add Support for DVS Lock
Signed-off-by: Jongpill Lee <email address hidden>
Signed-off-by: SangWook Ju <email address hidden>
Signed-off-by: Jonghwan Choi <email address hidden>
Signed-off-by: Kukjin Kim <email address hidden>
commit fd899eba028e72659bf6572c974a92652e90dd23
Author: Jongpill Lee <email address hidden>
Date: Tue Jul 5 13:36:18 2011 +0530
EXYNOS4210: Cleanup sequence and unused codes
This patch modifies following.
1. Remove unused register access
2. Change sequence of changing frequency
3. Minor optimization
Signed-off-by: Jongpill Lee <email address hidden>
Signed-off-by: SangWook Ju <email address hidden>
Signed-off-by: Jonghwan Choi <email address hidden>
Signed-off-by: Kukjin Kim <email address hidden>
commit 0a75037e551780bf2d224f7b3db691bb9aa7dd34
Author: Jongpill Lee <email address hidden>
Date: Tue Jul 5 13:36:17 2011 +0530
EXYNOS4210: Change CPU table and divider
This patch adds support 1.2GHz CPU frequency and changes
CPU table and divider for stable working.
Signed-off-by: Jongpill Lee <email address hidden>
Signed-off-by: SangWook Ju <email address hidden>
Signed-off-by: Kukjin Kim <email address hidden>
commit d8ed3dad2b9beb6cab09f00ea1011a7d35e860de
Author: Jongpill Lee <email address hidden>
Date: Tue Jul 5 13:36:16 2011 +0530
EXYNOS4210: Remove regarding busfreq codes
Since busfreq codes can be handlend on busfreq driver,
this patch removes regarding busfreq codes on cpufreq.
Signed-off-by: Jongpill Lee <email address hidden>
Signed-off-by: SangWook Ju <email address hidden>
Signed-off-by: Kukjin Kim <email address hidden>
commit 971be11492b1e248798f7078592b1fa0dfbf3534
Author: Nicolas Pitre <email address hidden>
Date: Tue Dec 13 14:28:39 2011 -0500
ARM: oprofile: don't mark oprofile_arch_exit() with __exit
When the oprofile code is built into the kernel, the code marked
with __exit is discarded at link time. This fails the build as
oprofile_arch_exit() is referenced from oprofile_init() which is
in a different section.
Signed-off-by: Nicolas Pitre <email address hidden>
commit 874b0239d896c2b493f2c4c23b2a60ad258632b3
Merge: 4cd6f5d caf4b04
Author: Nicolas Pitre <email address hidden>
Date: Mon Dec 12 11:40:50 2011 -0500
Merge commit 'v3.1.5' into linaro-3.1
commit caf4b0430be8296bf644199bf3ed3056c02420c7
Author: Greg Kroah-Hartman <email address hidden>
Date: Fri Dec 9 08:57:05 2011 -0800
Linux 3.1.5
commit 50d224d483a7dbecf84beffff9f815ac104ee5e8
Author: Eric Dumazet <email address hidden>
Date: Thu Dec 1 11:06:34 2011 +0000
sch_red: fix red_change
[ Upstream commit 1ee5fa1e9970a16036e37c7b9d5ce81c778252fc ]
Le mercredi 30 novembre 2011 à 14:36 -0800, Stephen Hemminger a écrit :
> (Almost) nobody uses RED because they can't figure it out.
> According to Wikipedia, VJ says that:
> "there are not one, but two bugs in classic RED."
RED is useful for high throughput routers, I doubt many linux machines
act as such devices.
I was considering adding Adaptative RED (Sally Floyd, Ramakrishna
Gummadi, Scott Shender), August 2001
In this version, maxp is dynamic (from 1% to 50%), and user only have to
setup min_th (target average queue size)
(max_th and wq (burst in linux RED) are automatically setup)
By the way it seems we have a small bug in red_change()
if (skb_queue_empty(&sch->q))
red_end_of_idle_period(&q->parms);
First, if queue is empty, we should call
red_start_of_idle_period(&q->parms);
Second, since we dont use anymore sch->q, but q->qdisc, the test is
meaningless.
Oh well...
[PATCH] sch_red: fix red_change()
Now RED is classful, we must check q->qdisc->q.qlen, and if queue is empty,
we start an idle period, not end it.
Signed-off-by: Eric Dumazet <email address hidden>
Signed-off-by: David S. Miller <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 4851c6a079350393f4a9219878e699845412bace
Author: Eric Dumazet <email address hidden>
Date: Wed Nov 30 12:10:53 2011 +0000
sch_red: fix red_calc_qavg_from_idle_time
[ Upstream commit ea6a5d3b97b768561db6358f15e4c84ced0f4f7e ]
Since commit a4a710c4a7490587 (pkt_sched: Change PSCHED_SHIFT from 10 to
6) it seems RED/GRED are broken.
red_calc_qavg_from_idle_time() computes a delay in us units, but this
delay is now 16 times bigger than real delay, so the final qavg result
smaller than expected.
Use standard kernel time services since there is no need to obfuscate
them.
Signed-off-by: Eric Dumazet <email address hidden>
Signed-off-by: David S. Miller <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 51338aa88d3ef2d05bf8b1f8a3019ebffcea74f1
Author: Julian Anastasov <email address hidden>
Date: Fri Dec 2 11:39:42 2011 +0000
ipv4: make sure RTO_ONLINK is saved in routing cache
[ Upstream commit f61759e6b831a55b89e584b198c3da325e2bc379 ]
__mkroute_output fails to work with the original tos
and uses value with stripped RTO_ONLINK bit. Make sure we put
the original TOS bits into rt_key_tos because it used to match
cached route.
Signed-off-by: Julian Anastasov <email address hidden>
Signed-off-by: David S. Miller <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 9fdec5ec64644ce4f4081e045dfbcd7518276edb
Author: David S. Miller <email address hidden>
Date: Thu Dec 1 13:38:59 2011 -0500
ipv4: Perform peer validation on cached route lookup.
[ Upstream commit efbc368dcc6426d5430b9b8eeda944cf2cb74b8c,
incorporating a follow-on change to prevent an OOPS ]
Otherwise we won't notice the peer GENID change.
Reported-by: Steffen Klassert <email address hidden>
Signed-off-by: David S. Miller <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 9c8da5125682191090bf32917a6bfba3d711492d
Author: Eric Dumazet <email address hidden>
Date: Sat Nov 26 12:13:44 2011 +0000
inet: add a redirect generation id in inetpeer
[ Upstream commit de68dca1816660b0d3ac89fa59ffb410007a143f ]
Now inetpeer is the place where we cache redirect information for ipv4
destinations, we must be able to invalidate informations when a route is
added/removed on host.
As inetpeer is not yet namespace aware, this patch adds a shared
redirect_genid, and a per inetpeer redirect_genid. This might be changed
later if inetpeer becomes ns aware.
Cache information for one inerpeer is valid as long as its
redirect_genid has the same value than global redirect_genid.
Reported-by: Arkadiusz Miśkiewicz <email address hidden>
Tested-by: Arkadiusz Miśkiewicz <email address hidden>
Signed-off-by: Eric Dumazet <email address hidden>
Signed-off-by: David S. Miller <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 427814da7d68739ec2c53a9433f62323c68ef34d
Author: Eric Dumazet <email address hidden>
Date: Fri Nov 18 15:24:32 2011 -0500
ipv4: fix redirect handling
[ Upstream commit 9cc20b268a5a14f5e57b8ad405a83513ab0d78dc ]
commit f39925dbde77 (ipv4: Cache learned redirect information in
inetpeer.) introduced a regression in ICMP redirect handling.
It assumed ipv4_dst_check() would be called because all possible routes
were attached to the inetpeer we modify in ip_rt_redirect(), but thats
not true.
commit 7cc9150ebe (route: fix ICMP redirect validation) tried to fix
this but solution was not complete. (It fixed only one route)
So we must lookup existing routes (including different TOS values) and
call check_peer_redir() on them.
Reported-by: Ivan Zahariev <email address hidden>
Signed-off-by: Eric Dumazet <email address hidden>
CC: Flavio Leitner <email address hidden>
Signed-off-by: David S. Miller <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 5c9c7437749337f1af355eb9e447e75a58822da4
Author: Flavio Leitner <email address hidden>
Date: Mon Oct 24 02:56:38 2011 -0400
route: fix ICMP redirect validation
[ Upstream commit 7cc9150ebe8ec06cafea9f1c10d92ddacf88d8ae ]
The commit f39925dbde7788cfb96419c0f092b086aa325c0f
(ipv4: Cache learned redirect information in inetpeer.)
removed some ICMP packet validations which are required by
RFC 1122, section 3.2.2.2:
...
A Redirect message SHOULD be silently discarded if the new
gateway address it specifies is not on the same connected
(sub-) net through which the Redirect arrived [INTRO:2,
Appendix A], or if the source of the Redirect is not the
current first-hop gateway for the specified destination (see
Section 3.3.1).
Signed-off-by: Flavio Leitner <email address hidden>
Signed-off-by: David S. Miller <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit fe421e849a3c36373dd59eb5f302705c91a14719
Author: Gao feng <email address hidden>
Date: Wed Oct 19 15:34:09 2011 +0000
ipv4: avoid useless call of the function check_peer_pmtu
[ Upstream commit 59445b6b1f90b97c4e28062b96306bacfa4fb170 ]
In func ipv4_dst_check,check_peer_pmtu should be called only when peer is updated.
So,if the peer is not updated in ip_rt_frag_needed,we can not inc __rt_peer_genid.
Signed-off-by: Gao feng <email address hidden>
Acked-by: Eric Dumazet <email address hidden>
Signed-off-by: David S. Miller <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 5eb027bb82d1f9d4af0df73a3ce08945ffc1b481
Author: Eric Dumazet <email address hidden>
Date: Wed Nov 30 04:08:58 2011 +0000
sch_teql: fix lockdep splat
[ Upstream commit f7e57044eeb1841847c24aa06766c8290c202583 ]
We need rcu_read_lock() protection before using dst_get_neighbour(), and
we must cache its value (pass it to __teql_resolve())
teql_master_xmit() is called under rcu_read_lock_bh() protection, its
not enough.
Signed-off-by: Eric Dumazet <email address hidden>
Signed-off-by: David S. Miller <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit e03d2dc771361ff27ca042b793fa34b27bd6f115
Author: Frank Blaschka <email address hidden>
Date: Tue Nov 15 02:31:15 2011 +0000
qeth: l3 fix rcu splat in xmit
[ Upstream commit 1d36cb479f204a0fedc1a3e7ce7b32c0a2c48769 ]
when use dst_get_neighbour to get neighbour, we need
rcu_read_lock to protect, since dst_get_neighbour uses
rcu_dereference.
Signed-off-by: David S. Miller <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit f667de2e66ea9b8f99353ff01221bb355faf3f3c
Author: Eric Dumazet <email address hidden>
Date: Tue Nov 29 20:05:55 2011 +0000
ipv4: fix lockdep splat in rt_cache_seq_show
[ Upstream commit 218fa90f072e4aeff9003d57e390857f4f35513e ]
After commit f2c31e32b378 (fix NULL dereferences in check_peer_redir()),
dst_get_neighbour() should be guarded by rcu_read_lock() /
rcu_read_unlock() section.
Reported-by: Miles Lane <email address hidden>
Signed-off-by: Eric Dumazet <email address hidden>
Signed-off-by: David S. Miller <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit db9a8a29b0c7c61b372300978fbe8b01606103f0
Author: Li Wei <email address hidden>
Date: Tue Nov 8 21:39:28 2011 +0000
ipv4: fix for ip_options_rcv_srr() daddr update.
[ Upstream commit b12f62efb8ec0b9523bdb6c2d412c07193086de9 ]
When opt->srr_is_hit is set skb_rtable(skb) has been updated for
'nexthop' and iph->daddr should always equals to skb_rtable->rt_dst
holds, We need update iph->daddr either.
Signed-off-by: Li Wei <email address hidden>
Signed-off-by: David S. Miller <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit f82c753512bfe2fb4127ee72c882924120c11de8
Author: Nick Bowler <email address hidden>
Date: Tue Nov 8 12:12:45 2011 +0000
ah: Read nexthdr value before overwriting it in ahash input callback.
[ Upstream commit b7ea81a58adc123a4e980cb0eff9eb5c144b5dc7 ]
The AH4/6 ahash input callbacks read out the nexthdr field from the AH
header *after* they overwrite that header. This is obviously not going
to end well. Fix it up.
Signed-off-by: Nick Bowler <email address hidden>
Signed-off-by: David S. Miller <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit cfa73cca0cac4e07cc963f332aead8d118707432
Author: Nick Bowler <email address hidden>
Date: Tue Nov 8 12:12:44 2011 +0000
ah: Correctly pass error codes in ahash output callback.
[ Upstream commit 069294e813ed5f27f82613b027609bcda5f1b914 ]
The AH4/6 ahash output callbacks pass nexthdr to xfrm_output_resume
instead of the error code. This appears to be a copy+paste error from
the input case, where nexthdr is expected. This causes the driver to
continuously add AH headers to the datagram until either an allocation
fails and the packet is dropped or the ahash driver hits a synchronous
fallback and the resulting monstrosity is transmitted.
Correct this issue by simply passing the error code unadulterated.
Signed-off-by: Nick Bowler <email address hidden>
Signed-off-by: David S. Miller <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit aeed6baa702a285cf03b7dc4182ffc1a7f4e4ed6
Author: Thomas Gleixner <email address hidden>
Date: Fri Dec 2 16:02:45 2011 +0100
clockevents: Set noop handler in clockevents_exchange_device()
commit de28f25e8244c7353abed8de0c7792f5f883588c upstream.
If a device is shutdown, then there might be a pending interrupt,
which will be processed after we reenable interrupts, which causes the
original handler to be run. If the old handler is the (broadcast)
periodic handler the shutdown state might hang the kernel completely.
Signed-off-by: Thomas Gleixner <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 5a643352d2166077f88180372431ea5e90212b15
Author: Yang Honggang (Joseph) <email address hidden>
Date: Thu Dec 1 22:22:41 2011 -0500
clocksource: Fix bug with max_deferment margin calculation
commit b1f919664d04a8d0ba29cb76673c7ca3325a2006 upstream.
In order to leave a margin of 12.5% we should >> 3 not >> 5.
Signed-off-by: Yang Honggang (Joseph) <email address hidden>
[jstultz: Modified commit subject]
Signed-off-by: John Stultz <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 3e31d12fa35d8328128ef672a933ab6b8e09e10b
Author: Robert Richter <email address hidden>
Date: Fri Oct 7 16:31:46 2011 +0200
oprofile: Fix crash when unloading module (hr timer mode)
commit 87121ca504fd1d963a66b3fb0c72054b0fd9a177 upstream.
Oprofile may crash in a KVM guest while unlaoding modules. This
happens if oprofile_arch_init() fails and oprofile switches to the hr
timer mode as a fallback. In this case oprofile_arch_exit() is called,
but it never was initialized properly which causes the crash. This
patch fixes this.
oprofile: using timer interrupt.
BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
IP: [<ffffffff8123c226>] unregister_syscore_ops+0x41/0x58
PGD 41da3f067 PUD 41d80e067 PMD 0
Oops: 0002 [#1] PREEMPT SMP
CPU 5
Modules linked in: oprofile(-)
Pid: 2382, comm: modprobe Not tainted 3.1.0-rc7-00018-g709a39d #18 Advanced Micro Device Anaheim/Anaheim
RIP: 0010:[<ffffffff8123c226>] [<ffffffff8123c226>] unregister_syscore_ops+0x41/0x58
RSP: 0018:ffff88041de1de98 EFLAGS: 00010296
RAX: 0000000000000000 RBX: ffffffffa00060e0 RCX: dead000000200200
RDX: 0000000000000000 RSI: dead000000100100 RDI: ffffffff8178c620
RBP: ffff88041de1dea8 R08: 0000000000000001 R09: 0000000000000082
R10: 0000000000000000 R11: ffff88041de1dde8 R12: 0000000000000080
R13: fffffffffffffff5 R14: 0000000000000001 R15: 0000000000610210
FS: 00007f9ae5bef700(0000) GS:ffff88042fd40000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000008 CR3: 000000041ca44000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process modprobe (pid: 2382, threadinfo ffff88041de1c000, task ffff88042db6d040)
Stack:
ffff88041de1deb8 ffffffffa0006770 ffff88041de1deb8 ffffffffa000251e
ffff88041de1dec8 ffffffffa00022c2 ffff88041de1ded8 ffffffffa0004993
ffff88041de1df78 ffffffff81073115 656c69666f72706f 0000000000610200
Call Trace:
[<ffffffffa000251e>] op_nmi_exit+0x15/0x17 [oprofile]
[<ffffffffa00022c2>] oprofile_arch_exit+0xe/0x10 [oprofile]
[<ffffffffa0004993>] oprofile_exit+0x13/0x15 [oprofile]
[<ffffffff81073115>] sys_delete_module+0x1c3/0x22f
[<ffffffff811bf09e>] ? trace_hardirqs_on_thunk+0x3a/0x3f
[<ffffffff8148070b>] system_call_fastpath+0x16/0x1b
Code: 20 c6 78 81 e8 c5 cc 23 00 48 8b 13 48 8b 43 08 48 be 00 01 10 00 00 00 ad de 48 b9 00 02 20 00 00 00 ad de 48 c7 c7 20 c6 78 81
89 42 08 48 89 10 48 89 33 48 89 4b 08 e8 a6 c0 23 00 5a 5b
RIP [<ffffffff8123c226>] unregister_syscore_ops+0x41/0x58
RSP <ffff88041de1de98>
CR2: 0000000000000008
---[ end trace 06d4e95b6aa3b437 ]---
Signed-off-by: Robert Richter <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit cf246087a19a4958fba3123d21f1359b6177ddb5
Author: Gleb Natapov <email address hidden>
Date: Tue Oct 18 19:55:51 2011 +0200
jump_label: jump_label_inc may return before the code is patched
commit bbbf7af4bf8fc69bc751818cf30521080fa47dcb upstream.
If cpu A calls jump_label_inc() just after atomic_add_return() is
called by cpu B, atomic_inc_not_zero() will return value greater then
zero and jump_label_inc() will return to a caller before jump_label_update()
finishes its job on cpu B.
Link: http://<email address hidden>
Cc: Peter Zijlstra <email address hidden>
Acked-by: Jason Baron <email address hidden>
Signed-off-by: Gleb Natapov <email address hidden>
Signed-off-by: Steven Rostedt <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 6bdf07f3dd1c2874792bb07cd84d4210cbc15ca7
Author: Steven Rostedt <email address hidden>
Date: Fri Nov 4 16:32:25 2011 -0400
perf: Fix parsing of __print_flags() in TP_printk()
commit d06c27b22aa66e48e32f03f9387328a9af9b0625 upstream.
A update is made to the sched:sched_switch event that adds some
logic to the first parameter of the __print_flags() that shows the
state of tasks. This change cause perf to fail parsing the flags.
A simple fix is needed to have the parser be able to process ops
within the argument.
Reported-by: Andrew Vagin <email address hidden>
Signed-off-by: Steven Rostedt <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 491d3a9bc2ee7ad349a2e03bf259dea8895a5edd
Author: Thomas Gleixner <email address hidden>
Date: Fri Dec 2 12:34:16 2011 +0100
tick-broadcast: Stop active broadcast device when replacing it
commit c1be84309c58b1e7c6d626e28fba41a22b364c3d upstream.
When a better rated broadcast device is installed, then the current
active device is not disabled, which results in two running broadcast
devices.
Signed-off-by: Thomas Gleixner <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit fedb66b50d774dc687ac5b6f78fbf4b9bee28865
Author: Ilya Dryomov <email address hidden>
Date: Mon Oct 31 11:07:42 2011 +0200
tracing: fix event_subsystem ref counting
commit cb59974742aea24adf6637eb0c4b8e7b48bca6fb upstream.
Fix a bug introduced by e9dbfae5, which prevents event_subsystem from
ever being released.
Ref_count was added to keep track of subsystem users, not for counting
events. Subsystem is created with ref_count = 1, so there is no need to
increment it for every event, we have nr_events for that. Fix this by
touching ref_count only when we actually have a new user -
subsystem_open().
Signed-off-by: Ilya Dryomov <email address hidden>
Link: http://<email address hidden>
Signed-off-by: Steven Rostedt <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit df9490f1a5f1019ebf36bd7820ff405ddc06bfa9
Author: Arve Hjønnevåg <email address hidden>
Date: Tue Nov 22 18:24:51 2011 -0800
rtc: Fix some bugs that allowed accumulating time drift in suspend/resume
commit 6a8943d9ec2567572fca25cf69ad45844d0141a3 upstream.
The current code checks if abs(delta_delta.tv_sec) is greater or
equal to two before it discards the old delta value, but this can
trigger at close to -1 seconds since -1.000000001 seconds is stored
as tv_sec -2 and tv_nsec 999999999 in a normalized timespec.
rtc_resume had an early return check if the rtc value had not changed
since rtc_suspend. This effectivly stops time for the duration of the
short sleep. Check if sleep_time is positive after all the adjustments
have been applied instead since this allows the old_system adjustment
in rtc_suspend to have an effect even for short sleep cycles.
Signed-off-by: Arve Hjønnevåg <email address hidden>
Signed-off-by: John Stultz <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 0cbc008c56f7b4a11ba6fe80e196d7ab322baabf
Author: Rabin Vincent <email address hidden>
Date: Tue Nov 22 11:03:14 2011 +0100
rtc: Disable the alarm in the hardware
commit c0afabd3d553c521e003779c127143ffde55a16f upstream.
Currently, the RTC code does not disable the alarm in the hardware.
This means that after a sequence such as the one below (the files are in the
RTC sysfs), the box will boot up after 2 minutes even though we've
asked for the alarm to be turned off.
# echo $((`cat since_epoch`)+120) > wakealarm
# echo 0 > wakealarm
# poweroff
Fix this by disabling the alarm when there are no timers to run.
Cc: John Stultz <email address hidden>
Signed-off-by: Rabin Vincent <email address hidden>
Signed-off-by: John Stultz <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit bf34b36a208ecca76e41814ff8837f8b41528248
Author: Tejun Heo <email address hidden>
Date: Wed Nov 23 08:49:49 2011 -0800
trace_events_filter: Use rcu_assign_pointer() when setting ftrace_event_call->filter
commit d3d9acf646679c1981032b0985b386d12fccc60c upstream.
ftrace_event_call->filter is sched RCU protected but didn't use
rcu_assign_pointer(). Use it.
TODO: Add proper __rcu annotation to call->filter and all its users.
-v2: Use RCU_INIT_POINTER() for %NULL clearing as suggested by Eric.
Link: http://<email address hidden>
Cc: Eric Dumazet <email address hidden>
Cc: Frederic Weisbecker <email address hidden>
Cc: Jiri Olsa <email address hidden>
Signed-off-by: Tejun Heo <email address hidden>
Signed-off-by: Steven Rostedt <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 03923350d5fbcdb23faca8c9ca55988aac7383c3
Author: Steven Rostedt <email address hidden>
Date: Fri Nov 4 10:45:23 2011 -0400
ftrace: Remove force undef config value left for testing
commit c7c6ec8becaf742b223c7b491f4893014be23a07 upstream.
A forced undef of a config value was used for testing and was
accidently left in during the final commit. This causes x86 to
run slower than needed while running function tracing as well
as causes the function graph selftest to fail when DYNMAIC_FTRACE
is not set. This is because the code in MCOUNT expects the ftrace
code to be processed with the config value set that happened to
be forced not set.
The forced config option was left in by:
commit 6331c28c962561aee59e5a493b7556a4bb585957
ftrace: Fix dynamic selftest failure on some archs
Link: http://lkml.kernel.org/r/20111102150255.GA6973@debian
Reported-by: Rabin Vincent <email address hidden>
Signed-off-by: Steven Rostedt <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 5c30a5b33f77264cddcfb1a6659d3a9ac2661103
Author: Johannes Berg <email address hidden>
Date: Fri Dec 2 08:19:17 2011 -0800
iwlagn: fix HW crypto for TX-only keys
commit 274b89ca3b006926cb9b45d78ab5906f4c0fc0aa upstream.
Group keys in IBSS or AP mode are not programmed
into the device since we give the key to it with
every TX packet. However, we do need mac80211 to
create the MMIC & PN in all cases. Move the code
around to set the key flags all the time. We set
them even when the key is removed again but that
is obviously harmless.
Reported-by: Reinette Chatre <email address hidden>
Signed-off-by: Johannes Berg <email address hidden>
Signed-off-by: Wey-Yi Guy <email address hidden>
Signed-off-by: John W. Linville <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 43c308bd8d0a3e7d98c5abcd41a4a3fada3d198f
Author: Wey-Yi Guy <email address hidden>
Date: Fri Dec 2 08:19:18 2011 -0800
iwlwifi: do not re-configure HT40 after associated
commit 34a5b4b6af104cf18eb50748509528b9bdbc4036 upstream.
The ht40 setting should not change after association unless channel switch
This fix a problem we are seeing which cause uCode assert because driver
sending invalid information and make uCode confuse
Here is the firmware assert message:
kernel: iwlagn 0000:03:00.0: Microcode SW error detected. Restarting 0x82000000.
kernel: iwlagn 0000:03:00.0: Loaded firmware version: 17.168.5.3 build 42301
kernel: iwlagn 0000:03:00.0: Start IWL Error Log Dump:
kernel: iwlagn 0000:03:00.0: Status: 0x000512E4, count: 6
kernel: iwlagn 0000:03:00.0: 0x00002078 | ADVANCED_SYSASSERT
kernel: iwlagn 0000:03:00.0: 0x00009514 | uPc
kernel: iwlagn 0000:03:00.0: 0x00009496 | branchlink1
kernel: iwlagn 0000:03:00.0: 0x00009496 | branchlink2
kernel: iwlagn 0000:03:00.0: 0x0000D1F2 | interruptlink1
kernel: iwlagn 0000:03:00.0: 0x00000000 | interruptlink2
kernel: iwlagn 0000:03:00.0: 0x01008035 | data1
kernel: iwlagn 0000:03:00.0: 0x0000C90F | data2
kernel: iwlagn 0000:03:00.0: 0x000005A7 | line
kernel: iwlagn 0000:03:00.0: 0x5080B520 | beacon time
kernel: iwlagn 0000:03:00.0: 0xCC515AE0 | tsf low
kernel: iwlagn 0000:03:00.0: 0x00000003 | tsf hi
kernel: iwlagn 0000:03:00.0: 0x00000000 | time gp1
kernel: iwlagn 0000:03:00.0: 0x29703BF0 | time gp2
kernel: iwlagn 0000:03:00.0: 0x00000000 | time gp3
kernel: iwlagn 0000:03:00.0: 0x000111A8 | uCode version
kernel: iwlagn 0000:03:00.0: 0x000000B0 | hw version
kernel: iwlagn 0000:03:00.0: 0x00480303 | board version
kernel: iwlagn 0000:03:00.0: 0x09E8004E | hcmd
kernel: iwlagn 0000:03:00.0: CSR values:
kernel: iwlagn 0000:03:00.0: (2nd byte of CSR_INT_COALESCING is CSR_INT_PERIODIC_REG)
kernel: iwlagn 0000:03:00.0: CSR_HW_IF_CONFIG_REG: 0X00480303
kernel: iwlagn 0000:03:00.0: CSR_INT_COALESCING: 0X0000ff40
kernel: iwlagn 0000:03:00.0: CSR_INT: 0X00000000
kernel: iwlagn 0000:03:00.0: CSR_INT_MASK: 0X00000000
kernel: iwlagn 0000:03:00.0: CSR_FH_INT_STATUS: 0X00000000
kernel: iwlagn 0000:03:00.0: CSR_GPIO_IN: 0X00000030
kernel: iwlagn 0000:03:00.0: CSR_RESET: 0X00000000
kernel: iwlagn 0000:03:00.0: CSR_GP_CNTRL: 0X080403c5
kernel: iwlagn 0000:03:00.0: CSR_HW_REV: 0X000000b0
kernel: iwlagn 0000:03:00.0: CSR_EEPROM_REG: 0X07d60ffd
kernel: iwlagn 0000:03:00.0: CSR_EEPROM_GP: 0X90000001
kernel: iwlagn 0000:03:00.0: CSR_OTP_GP_REG: 0X00030001
kernel: iwlagn 0000:03:00.0: CSR_GIO_REG: 0X00080044
kernel: iwlagn 0000:03:00.0: CSR_GP_UCODE_REG: 0X000093bb
kernel: iwlagn 0000:03:00.0: CSR_GP_DRIVER_REG: 0X00000000
kernel: iwlagn 0000:03:00.0: CSR_UCODE_DRV_GP1: 0X00000000
kernel: iwlagn 0000:03:00.0: CSR_UCODE_DRV_GP2: 0X00000000
kernel: iwlagn 0000:03:00.0: CSR_LED_REG: 0X00000078
kernel: iwlagn 0000:03:00.0: CSR_DRAM_INT_TBL_REG: 0X88214dd2
kernel: iwlagn 0000:03:00.0: CSR_GIO_CHICKEN_BITS: 0X27800200
kernel: iwlagn 0000:03:00.0: CSR_ANA_PLL_CFG: 0X00000000
kernel: iwlagn 0000:03:00.0: CSR_HW_REV_WA_REG: 0X0001001a
kernel: iwlagn 0000:03:00.0: CSR_DBG_HPET_MEM_REG: 0Xffff0010
kernel: iwlagn 0000:03:00.0: FH register values:
kernel: iwlagn 0000:03:00.0: FH_RSCSR_CHNL0_STTS_WPTR_REG: 0X21316d00
kernel: iwlagn 0000:03:00.0: FH_RSCSR_CHNL0_RBDCB_BASE_REG: 0X021479c0
kernel: iwlagn 0000:03:00.0: FH_RSCSR_CHNL0_WPTR: 0X00000060
kernel: iwlagn 0000:03:00.0: FH_MEM_RCSR_CHNL0_CONFIG_REG: 0X80819104
kernel: iwlagn 0000:03:00.0: FH_MEM_RSSR_SHARED_CTRL_REG: 0X000000fc
kernel: iwlagn 0000:03:00.0: FH_MEM_RSSR_RX_STATUS_REG: 0X07030000
kernel: iwlagn 0000:03:00.0: FH_MEM_RSSR_RX_ENABLE_ERR_IRQ2DRV: 0X00000000
kernel: iwlagn 0000:03:00.0: FH_TSSR_TX_STATUS_REG: 0X07ff0001
kernel: iwlagn 0000:03:00.0: FH_TSSR_TX_ERROR_REG: 0X00000000
kernel: iwlagn 0000:03:00.0: Start IWL Event Log Dump: display last 20 entries
kernel: ------------[ cut here ]------------
WARNING: at net/mac80211/util.c:1208 ieee80211_reconfig+0x1f1/0x407()
kernel: Hardware name: 4290W4H
kernel: Pid: 1896, comm: kworker/0:0 Not tainted 3.1.0 #2
kernel: Call Trace:
kernel: [<ffffffff81036558>] ? warn_slowpath_common+0x73/0x87
kernel: [<ffffffff813b8966>] ? ieee80211_reconfig+0x1f1/0x407
kernel: [<ffffffff8139e8dc>] ? ieee80211_recalc_smps_work+0x32/0x32
kernel: [<ffffffff8139e95a>] ? ieee80211_restart_work+0x7e/0x87
kernel: [<ffffffff810472fa>] ? process_one_work+0x1c8/0x2e3
kernel: [<ffffffff810480c9>] ? worker_thread+0x17a/0x23a
kernel: [<ffffffff81047f4f>] ? manage_workers.clone.18+0x15b/0x15b
kernel: [<ffffffff81047f4f>] ? manage_workers.clone.18+0x15b/0x15b
kernel: [<ffffffff8104ba97>] ? kthread+0x7a/0x82
kernel: [<ffffffff813d21b4>] ? kernel_thread_helper+0x4/0x10
kernel: [<ffffffff8104ba1d>] ? kthread_flush_work_fn+0x11/0x11
kernel: [<ffffffff813d21b0>] ? gs_change+0xb/0xb
Reported-by: Udo Steinberg <email address hidden>
Signed-off-by: Wey-Yi Guy <email address hidden>
Signed-off-by: John W. Linville <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 3e4f16a375aafec68144d4edaae4ebd8e5017571
Author: Peter Zijlstra <email address hidden>
Date: Mon Nov 28 21:12:40 2011 +0100
slab, lockdep: Fix silly bug
commit 52cef189165d74a5d6030184a8e05595194c69ca upstream.
Commit 30765b92 ("slab, lockdep: Annotate the locks before using
them") moves the init_lock_keys() call from after g_cpucache_up =
FULL, to before it. And overlooks the fact that init_node_lock_keys()
tests for it and ignores everything !FULL.
Introduce a LATE stage and change the lockdep test to be <LATE.
Acked-by: Christoph Lameter <email address hidden>
Cc: Pekka Enberg <email address hidden>
Signed-off-by: Peter Zijlstra <email address hidden>
Signed-off-by: Ingo Molnar <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit a4b63ef678714a98dd8886fea14d5f76da671b6f
Author: Ido Yariv <email address hidden>
Date: Thu Dec 1 13:55:08 2011 +0200
genirq: Fix race condition when stopping the irq thread
commit 550acb19269d65f32e9ac4ddb26c2b2070e37f1c upstream.
In irq_wait_for_interrupt(), the should_stop member is verified before
setting the task's state to TASK_INTERRUPTIBLE and calling schedule().
In case kthread_stop sets should_stop and wakes up the process after
should_stop is checked by the irq thread but before the task's state
is changed, the irq thread might never exit:
kthread_stop irq_wait_for_interrupt
------------ ----------------------
...
... while (!kthread_should_stop()) {
kthread->should_stop = 1;
wake_up_process(k);
wait_for_completion(&kthread->exited);
...
set_current_state(TASK_INTERRUPTIBLE);
...
schedule();
}
Fix this by checking if the thread should stop after modifying the
task's state.
[ tglx: Simplified it a bit ]
Signed-off-by: Ido Yariv <email address hidden>
Link: http://<email address hidden>
Signed-off-by: Thomas Gleixner <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit aedebb8ae9811dedc3e57757a1048cd8d902fa3a
Author: Luis R. Rodriguez <email address hidden>
Date: Mon Nov 28 16:47:16 2011 -0500
cfg80211: amend regulatory NULL dereference fix
commit 0bac71af6e66dc798bf07d0c0dd14ee5503362f9 upstream.
Johannes' patch for "cfg80211: fix regulatory NULL dereference"
broke user regulaotry hints and it did not address the fact that
last_request was left populated even if the previous regulatory
hint was stale due to the wiphy disappearing.
Fix user reguluatory hints by only bailing out if for those
regulatory hints where a request_wiphy is expected. The stale last_request
considerations are addressed through the previous fixes on last_request
where we reset the last_request to a static world regdom request upon
reset_regdomains(). In this case though we further enhance the effect
by simply restoring reguluatory settings completely.
Cc: Johannes Berg <email address hidden>
Signed-off-by: Luis R. Rodriguez <email address hidden>
Reviewed-by: Johannes Berg <email address hidden>
Signed-off-by: John W. Linville <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 5b157407b89257481a639b869f0f42532fceafaa
Author: Luis R. Rodriguez <email address hidden>
Date: Mon Nov 28 16:47:15 2011 -0500
cfg80211: fix race on init and driver registration
commit a042994dd377d86bff9446ee76151ceb6267c9ba upstream.
There is a theoretical race that if hit will trigger
a crash. The race is between when we issue the first
regulatory hint, regulatory_hint_core(), gets processed
by the workqueue and between when the first device
gets registered to the wireless core. This is not easy
to reproduce but it was easy to do so through the
regulatory simulator I have been working on. This
is a port of the fix I implemented there [1].
[1] https://github.com/mcgrof/regsim/commit/a246ccf81f059cb662eee288aa13100f631e4cc8
Cc: Johannes Berg <email address hidden>
Signed-off-by: Luis R. Rodriguez <email address hidden>
Signed-off-by: John W. Linville <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 22e244d6a7b8bedfd87cba78d339b2baee00609c
Author: Nikolay Martynov <email address hidden>
Date: Tue Dec 6 15:39:32 2011 +0100
mac80211: fix race condition caused by late addBA response
Upstream commit d305a6557b2c4dca0110f05ffe745b1ef94adb80.
If addBA responses comes in just after addba_resp_timer has
expired mac80211 will still accept it and try to open the
aggregation session. This causes drivers to be confused and
in some cases even crash.
This patch fixes the race condition and makes sure that if
addba_resp_timer has expired addBA response is not longer
accepted and we do not try to open half-closed session.
Signed-off-by: Nikolay Martynov <email address hidden>
[some adjustments]
Signed-off-by: Johannes Berg <email address hidden>
Signed-off-by: John W. Linville <email address hidden>
commit 2eca885f630f007513f9f07d9635783917bb94e2
Author: Simon Wunderlich <email address hidden>
Date: Wed Nov 30 16:56:30 2011 +0100
mac80211: fill rate filter for internal scan requests
commit c72e8d335e2c6a309b6281f2abcf491f37b8b92b upstream.
The rates bitmap for internal scan requests shoud be filled,
otherwise there will be probe requests with zero rates supported.
Signed-off-by: Simon Wunderlich <email address hidden>
Signed-off-by: Mathias Kretschmer <email address hidden>
Signed-off-by: John W. Linville <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 05602145e34077a8314636d15ad3dae4c7dd81e4
Author: Martin Schwidefsky <email address hidden>
Date: Thu Dec 1 13:32:17 2011 +0100
add missing .set function for NT_S390_LAST_BREAK regset
commit b934069c991355d27a053a932591c77960f4e414 upstream.
The last breaking event address is a read-only value, the regset misses the
.set function. If a PTRACE_SETREGSET is done for NT_S390_LAST_BREAK we
get an oops due to a branch to zero:
Kernel BUG at 0000000000000002 verbose debug info unavailable
illegal operation: 0001 #1 SMP
...
Call Trace:
(<0000000000158294> ptrace_regset+0x184/0x188)
<00000000001595b6> ptrace_request+0x37a/0x4fc
<0000000000109a78> arch_ptrace+0x108/0x1fc
<00000000001590d6> SyS_ptrace+0xaa/0x12c
<00000000005c7a42> sysc_noemu+0x16/0x1c
<000003fffd5ec10c> 0x3fffd5ec10c
Last Breaking-Event-Address:
<0000000000158242> ptrace_regset+0x132/0x188
Add a nop .set function to prevent the branch to zero.
Signed-off-by: Martin Schwidefsky <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit a6ff8af2ed1af704e400b558b2811ce7a350d2eb
Author: Robert Richter <email address hidden>
Date: Mon Oct 10 16:21:10 2011 +0200
oprofile, x86: Fix crash when unloading module (nmi timer mode)
commit 97f7f8189fe54e3cfe324ef9ad35064f3d2d3bff upstream.
If oprofile uses the nmi timer interrupt there is a crash while
unloading the module. The bug can be triggered with oprofile build as
module and kernel parameter nolapic set. This patch fixes this.
oprofile: using NMI timer interrupt.
BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
IP: [<ffffffff8123c226>] unregister_syscore_ops+0x41/0x58
PGD 42dbca067 PUD 41da6a067 PMD 0
Oops: 0002 [#1] PREEMPT SMP
CPU 5
Modules linked in: oprofile(-) [last unloaded: oprofile]
Pid: 2518, comm: modprobe Not tainted 3.1.0-rc7-00019-gb2fb49d #19 Advanced Micro Device Anaheim/Anaheim
RIP: 0010:[<ffffffff8123c226>] [<ffffffff8123c226>] unregister_syscore_ops+0x41/0x58
RSP: 0018:ffff88041ef71e98 EFLAGS: 00010296
RAX: 0000000000000000 RBX: ffffffffa0017100 RCX: dead000000200200
RDX: 0000000000000000 RSI: dead000000100100 RDI: ffffffff8178c620
RBP: ffff88041ef71ea8 R08: 0000000000000001 R09: 0000000000000082
R10: 0000000000000000 R11: ffff88041ef71de8 R12: 0000000000000080
R13: fffffffffffffff5 R14: 0000000000000001 R15: 0000000000610210
FS: 00007fc902f20700(0000) GS:ffff88042fd40000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000008 CR3: 000000041cdb6000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process modprobe (pid: 2518, threadinfo ffff88041ef70000, task ffff88041d348040)
Stack:
ffff88041ef71eb8 ffffffffa0017790 ffff88041ef71eb8 ffffffffa0013532
ffff88041ef71ec8 ffffffffa00132d6 ffff88041ef71ed8 ffffffffa00159b2
ffff88041ef71f78 ffffffff81073115 656c69666f72706f 0000000000610200
Call Trace:
[<ffffffffa0013532>] op_nmi_exit+0x15/0x17 [oprofile]
[<ffffffffa00132d6>] oprofile_arch_exit+0xe/0x10 [oprofile]
[<ffffffffa00159b2>] oprofile_exit+0x1e/0x20 [oprofile]
[<ffffffff81073115>] sys_delete_module+0x1c3/0x22f
[<ffffffff811bf09e>] ? trace_hardirqs_on_thunk+0x3a/0x3f
[<ffffffff8148070b>] system_call_fastpath+0x16/0x1b
Code: 20 c6 78 81 e8 c5 cc 23 00 48 8b 13 48 8b 43 08 48 be 00 01 10 00 00 00 ad de 48 b9 00 02 20 00 00 00 ad de 48 c7 c7 20 c6 78 81
89 42 08 48 89 10 48 89 33 48 89 4b 08 e8 a6 c0 23 00 5a 5b
RIP [<ffffffff8123c226>] unregister_syscore_ops+0x41/0x58
RSP <ffff88041ef71e98>
CR2: 0000000000000008
---[ end trace 43a541a52956b7b0 ]---
Signed-off-by: Robert Richter <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit b11ee9e9403ab72d52c46cc8b3b94de17ed196e6
Author: Peter Zijlstra <email address hidden>
Date: Fri Oct 7 13:36:40 2011 +0200
perf/x86: Fix PEBS instruction unwind
commit 57d1c0c03c6b48b2b96870d831b9ce6b917f53ac upstream.
Masami spotted that we always try to decode the instruction stream as
64bit instructions when running a 64bit kernel, this doesn't work for
ia32-compat proglets.
Use TIF_IA32 to detect if we need to use the 32bit instruction
decoder.
Reported-by: Masami Hiramatsu <email address hidden>
Signed-off-by: Peter Zijlstra <email address hidden>
Signed-off-by: Ingo Molnar <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 400b14179e4170817aa476a29e29514c53bf4e25
Author: Konrad Rzeszutek Wilk <email address hidden>
Date: Tue Nov 15 14:49:09 2011 -0800
x86/paravirt: PTE updates in k(un)map_atomic need to be synchronous, regardless of lazy_mmu mode
commit 2cd1c8d4dc7ecca9e9431e2dabe41ae9c7d89e51 upstream.
Fix an outstanding issue that has been reported since 2.6.37.
Under a heavy loaded machine processing "fork()" calls could
crash with:
BUG: unable to handle kernel paging request at f573fc8c
IP: [<c01abc54>] swap_count_continued+0x104/0x180
*pdpt = 000000002a3b9027 *pde = 0000000001bed067 *pte = 0000000000000000 Oops: 0000 [#1] SMP
Modules linked in:
Pid: 1638, comm: apache2 Not tainted 3.0.4-linode37 #1
EIP: 0061:[<c01abc54>] EFLAGS: 00210246 CPU: 3
EIP is at swap_count_continued+0x104/0x180
.. snip..
Call Trace:
[<c01ac222>] ? __swap_duplicate+0xc2/0x160
[<c01040f7>] ? pte_mfn_to_pfn+0x87/0xe0
[<c01ac2e4>] ? swap_duplicate+0x14/0x40
[<c01a0a6b>] ? copy_pte_range+0x45b/0x500
[<c01a0ca5>] ? copy_page_range+0x195/0x200
[<c01328c6>] ? dup_mmap+0x1c6/0x2c0
[<c0132cf8>] ? dup_mm+0xa8/0x130
[<c013376a>] ? copy_process+0x98a/0xb30
[<c013395f>] ? do_fork+0x4f/0x280
[<c01573b3>] ? getnstimeofday+0x43/0x100
[<c010f770>] ? sys_clone+0x30/0x40
[<c06c048d>] ? ptregs_clone+0x15/0x48
[<c06bfb71>] ? syscall_call+0x7/0xb
The problem is that in copy_page_range() we turn lazy mode on,
and then in swap_entry_free() we call swap_count_continued()
which ends up in:
map = kmap_atomic(page, KM_USER0) + offset;
and then later we touch *map.
Since we are running in batched mode (lazy) we don't actually
set up the PTE mappings and the kmap_atomic is not done
synchronously and ends up trying to dereference a page that has
not been set.
Looking at kmap_atomic_prot_pfn(), it uses
'arch_flush_lazy_mmu_mode' and doing the same in
kmap_atomic_prot() and __kunmap_atomic() makes the problem go
away.
Interestingly, commit b8bcfe997e4615 ("x86/paravirt: remove lazy
mode in interrupts") removed part of this to fix an interrupt
issue - but it went to far and did not consider this scenario.
Signed-off-by: Konrad Rzeszutek Wilk <email address hidden>
Cc: Peter Zijlstra <email address hidden>
Cc: Jeremy Fitzhardinge <email address hidden>
Signed-off-by: Andrew Morton <email address hidden>
Signed-off-by: Ingo Molnar <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 7b4a0b336d67d9f706fb83d3050bcd9bef58cb9d
Author: Peter Chubb <email address hidden>
Date: Mon Dec 5 16:53:53 2011 +0300
x86: Fix "Acer Aspire 1" reboot hang
commit 1ef03890969932e9359b9a4c658f7f87771910ac upstream.
Looks like on some Acer Aspire 1s with older bioses, reboot via bios
fails. It works on my machine, (with BIOS version 0.3310) but
not on some others (BIOS version 0.3309).
There's a log of problems at:
https://bbs.archlinux.org/viewtopic.php?id=124136
This patch adds a different callback to the reboot quirk table,
to allow rebooting via keybaord controller.
Reported-by: Uroš Vampl <email address hidden>
Tested-by: Vasily Khoruzhick <email address hidden>
Signed-off-by: Peter Chubb <email address hidden>
Cc: Don Zickus <email address hidden>
Cc: Peter Zijlstra <email address hidden>
Link: http://<email address hidden>
Signed-off-by: Ingo Molnar <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 08673cfac6768fce130a6ddb5134299beebfd14f
Author: Bjorn Helgaas <email address hidden>
Date: Sun Sep 25 15:29:00 2011 -0600
x86/mpparse: Account for bus types other than ISA and PCI
commit 9e6866686bdf2dcf3aeb0838076237ede532dcc8 upstream.
In commit f8924e770e04 ("x86: unify mp_bus_info"), the 32-bit
and 64-bit versions of MP_bus_info were rearranged to match each
other better. Unfortunately it introduced a regression: prior
to that change we used to always set the mp_bus_not_pci bit,
then clear it if we found a PCI bus. After it, we set
mp_bus_not_pci for ISA buses, clear it for PCI buses, and leave
it alone otherwise.
In the cases of ISA and PCI, there's not much difference. But
ISA is not the only non-PCI bus, so it's better to always set
mp_bus_not_pci and clear it only for PCI.
Without this change, Dan's Dell PowerEdge 4200 panics on boot
with a log indicating interrupt routing trouble unless the
"noapic" option is supplied. With this change, the machine
boots reliably without "noapic".
Fixes http://bugs.debian.org/586494
Reported-bisected-and-tested-by: Dan McGrath <email address hidden>
Signed-off-by: Bjorn Helgaas <email address hidden>
Cc: Dan McGrath <email address hidden>
Cc: Alexey Starikovskiy <email address hidden>
[<email address hidden>: clarified commit message]
Signed-off-by: Jonathan Nieder <email address hidden>
Link: http://<email address hidden>
Signed-off-by: Ingo Molnar <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 3ef3c3830482a5de31781a5dca2a9bd7ef6d1562
Author: Salman Qazi <email address hidden>
Date: Tue Nov 15 14:12:06 2011 -0800
sched, x86: Avoid unnecessary overflow in sched_clock
commit 4cecf6d401a01d054afc1e5f605bcbfe553cb9b9 upstream.
(Added the missing signed-off-by line)
In hundreds of days, the __cycles_2_ns calculation in sched_clock
has an overflow. cyc * per_cpu(cyc2ns, cpu) exceeds 64 bits, causing
the final value to become zero. We can solve this without losing
any precision.
We can decompose TSC into quotient and remainder of division by the
scale factor, and then use this to convert TSC into nanoseconds.
Signed-off-by: Salman Qazi <email address hidden>
Acked-by: John Stultz <email address hidden>
Reviewed-by: Paul Turner <email address hidden>
Signed-off-by: Peter Zijlstra <email address hidden>
Link: http://<email address hidden>
Signed-off-by: Ingo Molnar <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit ba92f7efc8390db5ed6da4966ef943718eb048b7
Author: Andiry Xu <email address hidden>
Date: Wed Nov 30 16:37:41 2011 +0800
xHCI: fix bug in xhci_clear_command_ring()
commit 158886cd2cf4599e04f9b7e10cb767f5f39b14f1 upstream.
When system enters suspend, xHCI driver clears command ring by writing zero
to all the TRBs. However, this also writes zero to the Link TRB, and the ring
is mangled. This may cause driver accesses wrong memory address and the
result is unpredicted.
When clear the command ring, keep the last Link TRB intact, only clear its
cycle bit. This should fix the "command ring full" issue reported by Oliver
Neukum.
This should be backported to stable kernels as old as 2.6.37, since the
commit 89821320 "xhci: Fix command ring replay after resume" is merged.
Signed-off-by: Andiry Xu <email address hidden>
Signed-off-by: Sarah Sharp <email address hidden>
Reported-by: Oliver Neukum <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 07b91eb2d2c53017fbae33d5eae1037cb078d3e4
Author: Matthieu CASTET <email address hidden>
Date: Mon Nov 28 11:30:22 2011 +0100
EHCI : Fix a regression in the ISO scheduler
commit e3420901eba65b1c46bed86d360e3a8685d20734 upstream.
Fix a regression that was introduced by commit
811c926c538f7e8d3c08b630dd5844efd7e000f6 (USB: EHCI: fix HUB TT scheduling
issue with iso transfer).
We detect an error if next == start, but this means uframe 0 can't be allocated
anymore for iso transfer...
Reported-by: Sander Eikelenboom <email address hidden>
Signed-off-by: Matthieu CASTET <email address hidden>
Acked-by: Alan Stern <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 027a53824cc8602232cc38a86d9499efec2dcbee
Author: Thomas Poussevin <email address hidden>
Date: Thu Oct 27 18:46:48 2011 +0200
USB: EHCI: fix HUB TT scheduling issue with iso transfer
commit 811c926c538f7e8d3c08b630dd5844efd7e000f6 upstream.
The current TT scheduling doesn't allow to play and then record on a
full-speed device connected to a high speed hub.
The IN iso stream can only start on the first uframe (0-2 for a 165 us)
because of CSPLIT transactions.
For the OUT iso stream there no such restriction. uframe 0-5 are possible.
The idea of this patch is that the first uframe are precious (for IN TT iso
stream) and we should allocate the last uframes first if possible.
For that we reverse the order of uframe allocation (last uframe first).
Here an example :
hid interrupt stream
----------------------------------------------------------------------
uframe | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 |
----------------------------------------------------------------------
max_tt_usecs | 125 | 125 | 125 | 125 | 125 | 125 | 30 | 0 |
----------------------------------------------------------------------
used usecs on a frame | 13 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
----------------------------------------------------------------------
iso OUT stream
----------------------------------------------------------------------
uframe | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 |
----------------------------------------------------------------------
max_tt_usecs | 125 | 125 | 125 | 125 | 125 | 125 | 30 | 0 |
----------------------------------------------------------------------
used usecs on a frame | 13 | 125 | 39 | 0 | 0 | 0 | 0 | 0 |
----------------------------------------------------------------------
There no place for iso IN stream (uframe 0-2 are used) and we got "cannot
submit datapipe for urb 0, error -28: not enough bandwidth" error.
With the patch this become.
iso OUT stream
----------------------------------------------------------------------
uframe | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 |
----------------------------------------------------------------------
max_tt_usecs | 125 | 125 | 125 | 125 | 125 | 125 | 30 | 0 |
----------------------------------------------------------------------
used usecs on a frame | 13 | 0 | 0 | 0 | 125 | 39 | 0 | 0 |
----------------------------------------------------------------------
iso IN stream
----------------------------------------------------------------------
uframe | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 |
----------------------------------------------------------------------
max_tt_usecs | 125 | 125 | 125 | 125 | 125 | 125 | 30 | 0 |
----------------------------------------------------------------------
used usecs on a frame | 13 | 0 | 125 | 40 | 125 | 39 | 0 | 0 |
----------------------------------------------------------------------
Signed-off-by: Matthieu Castet <email address hidden>
Signed-off-by: Thomas Poussevin <email address hidden>
Signed-off-by: Alan Stern <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit de5f8dc38303f9a1fc58349f0d1c6f46a8034a00
Author: Eric Dumazet <email address hidden>
Date: Tue Nov 29 22:31:23 2011 +0100
IB: Fix RCU lockdep splats
commit 580da35a31f91a594f3090b7a2c39b85cb051a12 upstream.
Commit f2c31e32b37 ("net: fix NULL dereferences in check_peer_redir()")
forgot to take care of infiniband uses of dst neighbours.
Many thanks to Marc Aurele who provided a nice bug report and feedback.
Reported-by: Marc Aurele La France <email address hidden>
Signed-off-by: Eric Dumazet <email address hidden>
Cc: David Miller <email address hidden>
Signed-off-by: Roland Dreier <email address hidden>
commit 829d5a92cbfe6e906bbe24a5bb1675a6d27a5db2
Author: Qinglin Ye <email address hidden>
Date: Wed Nov 23 23:39:32 2011 +0800
USB: usb-storage: unusual_devs entry for Kingston DT 101 G2
commit cec28a5428793b6bc64e56687fb239759d6da74e upstream.
Kingston DT 101 G2 replies a wrong tag while transporting, add an
unusal_devs entry to ignore the tag validation.
Signed-off-by: Qinglin Ye <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit f769c8c9d67806d5ed3c2ab555b56eef44bb08fe
Author: Veli-Pekka Peltola <email address hidden>
Date: Thu Nov 24 22:08:56 2011 +0200
usb: option: add SIMCom SIM5218
commit ec0cd94d881ca89cc9fb61d00d0f4b2b52e605b3 upstream.
Tested with SIM5218EVB-KIT evaluation kit.
Signed-off-by: Veli-Pekka Peltola <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit c61954d8c8348de93281f322a3675bb308128414
Author: Dirk Nehring <email address hidden>
Date: Thu Nov 24 19:22:23 2011 +0100
usb: option: add Huawei E353 controlling interfaces
commit 46b1848360c8e634e0b063932a1261062fa0f7d6 upstream.
This patch creates the missing controlling devices for the Huawei E353
HSPA+ stick.
Signed-off-by: Dirk Nehring <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 523cc1591e42c0b51e334609a841c7566be2091f
Author: Marcin Kościelnicki <koriakin@0x04.net>
Date: Wed Nov 30 17:01:04 2011 +0100
usb: ftdi_sio: add PID for Propox ISPcable III
commit 307369b0ca06b27b511b61714e335ddfccf19c4f upstream.
Signed-off-by: Marcin Kościelnicki <koriakin@0x04.net>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 9aee2c52173b2d5ab712d692a31c2016c1dda8f2
Author: Benjamin Tissoires <email address hidden>
Date: Wed Nov 16 11:39:52 2011 +0100
HID: Correct General touch PID
commit b1807719f6acdf18cc4bde3b5400d05d77801494 upstream.
Genera Touch told us that 0001 is their single point device
and 0003 is the multitouch one. Apparently, we made the tests
someone having a prototype, and not the final product.
They said it should be safe to do the switch.
This partially reverts 5572da0 ("HID: hid-mulitouch: add support
for the 'Sensing Win7-TwoFinger'").
Signed-off-by: Benjamin Tissoires <email address hidden>
Signed-off-by: Jiri Kosina <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit da6a65ba7034fe6273bf7dcdae174f4f04dead70
Author: Dan Carpenter <email address hidden>
Date: Tue Nov 22 10:28:31 2011 +0300
USB: whci-hcd: fix endian conversion in qset_clear()
commit 8746c83d538cab273d335acb2be226d096f4a5af upstream.
qset->qh.link is an __le64 field and we should be using cpu_to_le64()
to fill it.
Signed-off-by: Dan Carpenter <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit b5e0fb085f337c2ab00532d09056da3525f2e847
Author: Kevin Hilman <email address hidden>
Date: Tue Nov 22 17:18:24 2011 -0800
usb: musb: PM: fix context save/restore in suspend/resume path
commit 5d193ce8f1fa7c67c7fd7be2c03ef31eed344a4f upstream.
Currently the driver tries to save context in the suspend path, but
will cause an abort if the device is already runtime suspended. This
happens, for example, if MUSB loaded/compiled-in, in host mode, but no
USB devices are attached. MUSB will be runtime suspended, but then
attempting a system suspend will crash due to the context save
being attempted while the device is disabled.
On OMAP, as of v3.1, the driver's ->runtime_suspend() callback will be
called late in the suspend path (by the PM domain layer) if the driver
is not already runtime suspended, ensuring a full shutdown.
Therefore, the context save is not needed in the ->suspend() method
since it will be called in the ->runtime_suspend() method anyways
(similarily for resume.)
NOTE: this leaves the suspend/resume methods basically empty (with
some FIXMEs and comments, but I'll leave it to the maintainers
to decide whether to remove them.
Signed-off-by: Kevin Hilman <email address hidden>
Signed-off-by: Felipe Balbi <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit a7e9e05141e922b1bbf4315827dcf8c80989255c
Author: Federico Vaga <email address hidden>
Date: Sat Oct 29 09:47:39 2011 +0200
Staging: comedi: fix signal handling in read and write
commit 6a9ce6b654e491981f6ef7e214cbd4f63e033848 upstream.
After sleeping on a wait queue, signal_pending(current) should be
checked (not before sleeping).
Acked-by: Alessandro Rubini <email address hidden>
Signed-off-by: Federico Vaga <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 3762465d4a6c6a92a93d361b95dd453fd736ba73
Author: Federico Vaga <email address hidden>
Date: Sat Oct 29 09:45:39 2011 +0200
Staging: comedi: fix mmap_count
commit df30b21cb0eed5ba8a8e0cdfeebc66ba8cde821d upstream.
In comedi_fops, mmap_count is decremented at comedi_vm_ops->close but
it is not incremented at comedi_vm_ops->open. This may result in a negative
counter. The patch introduces the open method to keep the counter
consistent.
The bug was triggerd by this sample code:
mmap(0, ...., comedi_fd);
fork();
exit(0);
Acked-by: Alessandro Rubini <email address hidden>
Signed-off-by: Federico Vaga <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 7994d8747d9ac088be8a2136dc25ea30135ca1e8
Author: Bernd Porr <email address hidden>
Date: Tue Nov 8 21:23:03 2011 +0000
staging: comedi: fix oops for USB DAQ devices.
commit 3ffab428f40849ed5f21bcfd7285bdef7902f9ca upstream.
This fixes kernel oops when an USB DAQ device is plugged out while it's
communicating with the userspace software.
Signed-off-by: Bernd Porr <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit df781a42499bdf5a1a4375c55ffed1a80cbdf5b3
Author: Bart Westgeest <email address hidden>
Date: Tue Nov 1 15:01:28 2011 -0400
staging: usbip: bugfix for deadlock
commit 438957f8d4a84daa7fa5be6978ad5897a2e9e5e5 upstream.
Interrupts must be disabled prior to calling usb_hcd_unlink_urb_from_ep.
If interrupts are not disabled, it can potentially lead to a deadlock.
The deadlock is readily reproduceable on a slower (ARM based) device
such as the TI Pandaboard.
Signed-off-by: Bart Westgeest <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 60709063c5d50549e834ac75288782e84c8e53db
Author: wwang <email address hidden>
Date: Mon Oct 31 15:02:53 2011 +0800
staging:rts_pstor:Complete scanning_done variable
commit f7364ba04b0961f3a1f978bbe77102606801e35f upstream.
Complete scanning_done variable if rtsx-scan thread created failed.
Signed-off-by: wwang <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit bdbee02fb09ff4278de3c4656689261ee9647007
Author: Lars-Peter Clausen <email address hidden>
Date: Mon Nov 28 09:44:16 2011 +0100
firmware: Sigma: Fix endianess issues
commit bda63586bc5929e97288cdb371bb6456504867ed upstream.
Currently the SigmaDSP firmware loader only works correctly on little-endian
systems. Fix this by using the proper endianess conversion functions.
Signed-off-by: Lars-Peter Clausen <email address hidden>
Acked-by: Mike Frysinger <email address hidden>
Signed-off-by: Mark Brown <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 2a323db413fbe17c15cd60376d012f2ee2659f8d
Author: Lars-Peter Clausen <email address hidden>
Date: Mon Nov 28 09:44:15 2011 +0100
firmware: Sigma: Skip header during CRC generation
commit c56935bdc0a8edf50237d3b0205133a5b0adc604 upstream.
The firmware header is not part of the CRC, so skip it. Otherwise the firmware
will be rejected due to non-matching CRCs.
Signed-off-by: Lars-Peter Clausen <email address hidden>
Acked-by: Mike Frysinger <email address hidden>
Signed-off-by: Mark Brown <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 3b958a46b7e81c432d7d6ef00ee4bd51ef2d39e2
Author: Lars-Peter Clausen <email address hidden>
Date: Mon Nov 28 09:44:14 2011 +0100
firmware: Sigma: Prevent out of bounds memory access
commit 4f718a29fe4908c2cea782f751e9805319684e2b upstream.
The SigmaDSP firmware loader currently does not perform enough boundary size
checks when processing the firmware. As a result it is possible that a
malformed firmware can cause an out of bounds memory access.
This patch adds checks which ensure that both the action header and the payload
are completely inside the firmware data boundaries before processing them.
Signed-off-by: Lars-Peter Clausen <email address hidden>
Acked-by: Mike Frysinger <email address hidden>
Signed-off-by: Mark Brown <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit adc771853323bb695e50eab52299b82d675cd665
Author: Axel Lin <email address hidden>
Date: Tue Nov 22 09:46:51 2011 +0800
ASoC: Fix wrong define for AD1836_ADC_WORD_OFFSET
commit 72531c9434fa884d20cb3c36fcec83752f32fdf4 upstream.
According to the datasheet:
The BIT[5:4] of ADC Control Register 2 is to control the word width.
00 = 25 Bits
01 = 20 Bits
10 = 16 Bits
11 = Invalid
Thus, the AD1836_ADC_WORD_OFFSET should be defined as 4.
Signed-off-by: Axel Lin <email address hidden>
Acked-by: Lars-Peter Clausen <email address hidden>
Signed-off-by: Mark Brown <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 1db3bb31add93148b1a7ae35d02bff41d9357e9c
Author: Charles Chin <email address hidden>
Date: Thu Dec 1 11:21:00 2011 +0100
ALSA: hda - Fix S3/S4 problem on machines with VREF-pin mute-LED
commit 88d686027bb43f585914c77dd363f6e817b42c2a upstream.
The verb command in stac92xx_post_suspend caused the audio to stop
working after resuming from S3 mode on HP laptops with the VREF-pin
mute-LED control. Removing relevant post_suspend registering.
Although removing D3 on AFG is no optimal solution, the impact should
be small in comparison with the broken S3/S4.
Signed-off-by: Charles Chin <email address hidden>
Signed-off-by: Takashi Iwai <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 558238140c9a86bd62b9a1146f0439e28d793215
Author: Alex Deucher <email address hidden>
Date: Mon Nov 28 14:49:26 2011 -0500
drm/radeon/kms: add some loop timeouts in pageflip code
commit f64964796dedca340608fb1075ab6baad5625851 upstream.
Avoid infinite loops waiting for surface updates if a GPU
reset happens while waiting for a page flip.
See:
https://bugs.freedesktop.org/show_bug.cgi?id=43191
Signed-off-by: Alex Deucher <email address hidden>
Reviewed-by: Mario Kleiner <email address hidden>
Tested-by: Simon Farnsworth <email address hidden>
Signed-off-by: Dave Airlie <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 296573cf874d5d78314c5635de35caec372309bd
Author: Alex Deucher <email address hidden>
Date: Thu Dec 1 11:02:11 2011 -0500
drm/radeon/kms: add some new pci ids
commit 2ed4d9d648cbd4fb1c232a646dbdbdfdd373ca94 upstream.
Signed-off-by: Alex Deucher <email address hidden>
Signed-off-by: Dave Airlie <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit d22ac9ac4c241c598fba39c0f9a7dea3163e1e44
Author: Wey-Yi Guy <email address hidden>
Date: Thu Oct 27 17:19:39 2011 -0700
iwlwifi: allow pci_enable_msi fail
commit 8a39ef8ba0fa0410d71db8e981e887fe4fdeca88 upstream.
Continue the init process even fail to enable msi
out_iounmap is no longer used, remove it
Reported-by: werner <email address hidden>
Tested-by: werner <email address hidden>
Signed-off-by: Wey-Yi Guy <email address hidden>
Signed-off-by: John W. Linville <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit c66d16e59ba46314e8870e7abc3e1a0f935215e9
Author: stephen hemminger <email address hidden>
Date: Tue Nov 15 08:09:14 2011 +0000
bridge: correct IPv6 checksum after pull
commit fa2da8cdae1dd64f78fc915ca1d1a4a93c71e7cb upstream.
Bridge multicast snooping of ICMPv6 would incorrectly report a checksum problem
when used with Ethernet devices like sky2 that use CHECKSUM_COMPLETE.
When bytes are removed from skb, the computed checksum needs to be adjusted.
Signed-off-by: Stephen Hemminger <email address hidden>
Tested-by: Martin Volf <email address hidden>
Signed-off-by: David S. Miller <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit d3b2937da9fc51f48ae77735e78be53a8a4c0ae4
Author: Hillf Danton <email address hidden>
Date: Tue Nov 15 14:36:12 2011 -0800
hugetlb: release pages in the error path of hugetlb_cow()
commit ea4039a34c4c206d015d34a49d0b00868e37db1d upstream.
If we fail to prepare an anon_vma, the {new, old}_page should be released,
or they will leak.
Signed-off-by: Hillf Danton <email address hidden>
Reviewed-by: Andrea Arcangeli <email address hidden>
Cc: Hugh Dickins <email address hidden>
Cc: Johannes Weiner <email address hidden>
Signed-off-by: Andrew Morton <email address hidden>
Signed-off-by: Linus Torvalds <email address hidden>
Cc: Michal Hocko <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 6d10c223ab5a75fa961019fa91fc811128cb876b
Author: Hannes Reinecke <email address hidden>
Date: Wed Nov 9 08:39:24 2011 +0100
SCSI: Silencing 'killing requests for dead queue'
commit 745718132c3c7cac98a622b610e239dcd5217f71 upstream.
When we tear down a device we try to flush all outstanding
commands in scsi_free_queue(). However the check in
scsi_request_fn() is imperfect as it only signals that
we _might start_ aborting commands, not that we've actually
aborted some.
So move the printk inside the scsi_kill_request function,
this will also give us a hint about which commands are aborted.
Signed-off-by: Hannes Reinecke <email address hidden>
Signed-off-by: James Bottomley <email address hidden>
Cc: Christoph Biedl <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 5635019b754fa0ccfc2275369b05142a8a2dbde4
Author: Mitsuo Hayasaka <email address hidden>
Date: Thu Dec 1 17:27:44 2011 -0600
xfs: use doalloc flag in xfs_qm_dqattach_one()
commit db3e74b582915d66e10b0c73a62763418f54c340 upstream.
The doalloc arg in xfs_qm_dqattach_one() is a flag that indicates
whether a new area to handle quota information will be allocated
if needed. Originally, it was passed to xfs_qm_dqget(), but has
been removed by the following commit (probably by mistake):
commit 8e9b6e7fa4544ea8a0e030c8987b918509c8ff47
Author: Christoph Hellwig <email address hidden>
Date: Sun Feb 8 21:51:42 2009 +0100
xfs: remove the unused XFS_QMOPT_DQLOCK flag
As the result, xfs_qm_dqget() called from xfs_qm_dqattach_one()
never allocates the new area even if it is needed.
This patch gives the doalloc arg to xfs_qm_dqget() in
xfs_qm_dqattach_one() to fix this problem.
Signed-off-by: Mitsuo Hayasaka <email address hidden>
Cc: Alex Elder <email address hidden>
Cc: Christoph Hellwig <email address hidden>
Reviewed-by: Christoph Hellwig <email address hidden>
Signed-off-by: Ben Myers <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit c38aeb8cd119fddc37d7cd648d6c43e782711247
Author: Carlos Maiolino <email address hidden>
Date: Thu Dec 1 17:27:43 2011 -0600
xfs: Fix possible memory corruption in xfs_readlink
commit b52a360b2aa1c59ba9970fb0f52bbb093fcc7a24 upstream.
Fixes a possible memory corruption when the link is larger than
MAXPATHLEN and XFS_DEBUG is not enabled. This also remove the
S_ISLNK assert, since the inode mode is checked previously in
xfs_readlink_by_handle() and via VFS.
Updated to address concerns raised by Ben Hutchings about the loose
attention paid to 32- vs 64-bit values, and the lack of handling a
potentially negative pathlen value:
- Changed type of "pathlen" to be xfs_fsize_t, to match that of
ip->i_d.di_size
- Added checking for a negative pathlen to the too-long pathlen
test, and generalized the message that gets reported in that case
to reflect the change
As a result, if a negative pathlen were encountered, this function
would return EFSCORRUPTED (and would fail an assertion for a debug
build)--just as would a too-long pathlen.
Signed-off-by: Alex Elder <email address hidden>
Signed-off-by: Carlos Maiolino <email address hidden>
Reviewed-by: Christoph Hellwig <email address hidden>
Cc: Ben Myers <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 7f9fae139e1b34b0ecb0ff8ab051c4497d68db2c
Author: Christoph Hellwig <email address hidden>
Date: Thu Dec 1 17:27:42 2011 -0600
xfs: fix buffer flushing during unmount
commit 87c7bec7fc3377b3873eb3a0f4b603981ea16ebb upstream.
The code to flush buffers in the umount code is a bit iffy: we first
flush all delwri buffers out, but then might be able to queue up a
new one when logging the sb counts. On a normal shutdown that one
would get flushed out when doing the synchronous superblock write in
xfs_unmountfs_writesb, but we skip that one if the filesystem has
been shut down.
Fix this by moving the delwri list flushing until just before unmounting
the log, and while we're at it also remove the superflous delwri list
and buffer lru flusing for the rt and log device that can never have
cached or delwri buffers.
Signed-off-by: Christoph Hellwig <email address hidden>
Reported-by: Amit Sahrawat <email address hidden>
Tested-by: Amit Sahrawat <email address hidden>
Signed-off-by: Alex Elder <email address hidden>
Cc: Ben Myers <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit b4dd4c13166d1aab0c2cd8033f1cc1211f6f1678
Author: Mitsuo Hayasaka <email address hidden>
Date: Thu Dec 1 17:27:41 2011 -0600
xfs: Return -EIO when xfs_vn_getattr() failed
commit ed32201e65e15f3e6955cb84cbb544b08f81e5a5 upstream.
An attribute of inode can be fetched via xfs_vn_getattr() in XFS.
Currently it returns EIO, not negative value, when it failed. As a
result, the system call returns not negative value even though an
error occured. The stat(2), ls and mv commands cannot handle this
error and do not work correctly.
This patch fixes this bug, and returns -EIO, not EIO when an error
is detected in xfs_vn_getattr().
Signed-off-by: Mitsuo Hayasaka <email address hidden>
Reviewed-by: Christoph Hellwig <email address hidden>
Signed-off-by: Alex Elder <email address hidden>
Cc: Ben Myers <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 6a426248da83e544995fc8a494630285260ec4ee
Author: Christoph Hellwig <email address hidden>
Date: Thu Dec 1 17:27:40 2011 -0600
xfs: avoid direct I/O write vs buffered I/O race
commit c58cb165bd44de8aaee9755a144136ae743be116 upstream.
Currently a buffered reader or writer can add pages to the pagecache
while we are waiting for the iolock in xfs_file_dio_aio_write. Prevent
this by re-checking mapping->nrpages after we got the iolock, and if
nessecary upgrade the lock to exclusive mode. To simplify this a bit
only take the ilock inside of xfs_file_aio_write_checks.
Signed-off-by: Christoph Hellwig <email address hidden>
Reviewed-by: Dave Chinner <email address hidden>
Signed-off-by: Alex Elder <email address hidden>
Cc: Ben Myers <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 686da49e5aa50117d8d824c579c3fd9e0318fbc6
Author: Dave Chinner <email address hidden>
Date: Thu Dec 1 17:27:39 2011 -0600
xfs: don't serialise direct IO reads on page cache checks
commit 0c38a2512df272b14ef4238b476a2e4f70da1479 upstream.
There is no need to grab the i_mutex of the IO lock in exclusive
mode if we don't need to invalidate the page cache. Taking these
locks on every direct IO effective serialises them as taking the IO
lock in exclusive mode has to wait for all shared holders to drop
the lock. That only happens when IO is complete, so effective it
prevents dispatch of concurrent direct IO reads to the same inode.
Fix this by taking the IO lock shared to check the page cache state,
and only then drop it and take the IO lock exclusively if there is
work to be done. Hence for the normal direct IO case, no exclusive
locking will occur.
Signed-off-by: Dave Chinner <email address hidden>
Tested-by: Joern Engel <email address hidden>
Reviewed-by: Christoph Hellwig <email address hidden>
Signed-off-by: Alex Elder <email address hidden>
Cc: Ben Myers <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit f06b70aa96019273ed984f76c79ad786ac216f7e
Author: Emmanuel Grumbach <email address hidden>
Date: Sun Nov 27 15:29:44 2011 +0200
mac80211: fix race between the AGG SM and the Tx data path
commit 2a1e0fd175dcfd72096ba9291d31e3b1b5342e60 upstream.
When a packet is supposed to sent be as an a-MPDU, mac80211 sets
IEEE80211_TX_CTL_AMPDU to let the driver know. On the other
hand, mac80211 configures the driver for aggregration with the
ampdu_action callback.
There is race between these two mechanisms since the following
scenario can occur when the BA agreement is torn down:
Tx softIRQ drv configuration
========== =================
check OPERATIONAL bit
Set the TX_CTL_AMPDU bit in the packet
clear OPERATIONAL bit
stop Tx AGG
Pass Tx packet to the driver.
In that case the driver would get a packet with TX_CTL_AMPDU set
although it has already been notified that the BA session has been
torn down.
To fix this, we need to synchronize all the Qdisc activity after we
cleared the OPERATIONAL bit. After that step, all the following
packets will be buffered until the driver reports it is ready to get
new packets for this RA / TID. This buffering allows not to run into
another race that would send packets with TX_CTL_AMPDU unset while
the driver hasn't been requested to tear down the BA session yet.
This race occurs in practice and iwlwifi complains with a WARN_ON
when it happens.
Signed-off-by: Emmanuel Grumbach <email address hidden>
Reviewed-by: Johannes Berg <email address hidden>
Signed-off-by: John W. Linville <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 743646bb5669b390e18a7d1f45ab5db8db48e09d
Author: Johannes Berg <email address hidden>
Date: Thu Nov 24 20:06:14 2011 +0100
mac80211: don't stop a single aggregation session twice
commit 24f50a9d165745fd0701c6e089d35f58a229ea69 upstream.
Nikolay noticed (by code review) that mac80211 can
attempt to stop an aggregation session while it is
already being stopped. So to fix it, check whether
stop is already being done and bail out if so.
Also move setting the STOPPING state into the lock
so things are properly atomic.
Reported-by: Nikolay Martynov <email address hidden>
Signed-off-by: Johannes Berg <email address hidden>
Signed-off-by: John W. Linville <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 737df45ddfbd5f96a9b38a16d5eef9eb7cd3a9a0
Author: Johannes Berg <email address hidden>
Date: Mon Nov 21 10:44:00 2011 +0100
cfg80211: fix regulatory NULL dereference
commit de3584bd62d87b4c250129fbc46ca52c80330add upstream.
By the time userspace returns with a response to
the regulatory domain request, the wiphy causing
the request might have gone away. If this is so,
reject the update but mark the request as having
been processed anyway.
Cc: Luis R. Rodriguez <email address hidden>
Signed-off-by: Johannes Berg <email address hidden>
Signed-off-by: John W. Linville <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 5c76953157d60ee044e23c9050347dd3405a2338
Author: Eliad Peller <email address hidden>
Date: Thu Nov 24 18:13:56 2011 +0200
nl80211: fix MAC address validation
commit e007b857e88097c96c45620bf3b04a4e309053d1 upstream.
MAC addresses have a fixed length. The current
policy allows passing < ETH_ALEN bytes, which
might result in reading beyond the buffer.
Signed-off-by: Eliad Peller <email address hidden>
Signed-off-by: John W. Linville <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 7ca622f2e52f3161466ebe93e177fb64c6047dc9
Author: Gertjan van Wingerde <email address hidden>
Date: Wed Nov 16 23:16:15 2011 +0100
rt2x00: Fix efuse EEPROM reading on PPC32.
commit 68fa64ef606bcee688fce46d07aa68f175070156 upstream.
Fix __le32 to __le16 conversion of the first word of an 8-word block
of EEPROM read via the efuse method.
Reported-and-tested-by: Ingvar Hagelund <email address hidden>
Signed-off-by: Gertjan van Wingerde <email address hidden>
Acked-by: Helmut Schaa <email address hidden>
Acked-by: Ivo van Doorn <email address hidden>
Signed-off-by: John W. Linville <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 160b68b38d29c8ab41eeb8187b2d724bf69c6756
Author: Michael Büsch <email address hidden>
Date: Wed Nov 16 23:55:46 2011 +0100
p54spi: Fix workqueue deadlock
commit 2d1618170eb493d18f66f2ac03775409a6fb97c6 upstream.
priv->work must not be synced while priv->mutex is locked, because
the mutex is taken in the work handler.
Move cancel_work_sync down to after the device shutdown code.
This is safe, because the work handler checks fw_state and bails out
early in case of a race.
Signed-off-by: Michael Buesch <email address hidden>
Acked-by: Christian Lamparter <email address hidden>
Signed-off-by: John W. Linville <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 3dcc2d249f99606863f00635e2becf95a389dc9c
Author: Michael Büsch <email address hidden>
Date: Wed Nov 16 23:48:31 2011 +0100
p54spi: Add missing spin_lock_init
commit 32d3a3922d617a5a685a5e2d24b20d0e88f192a9 upstream.
The tx_lock is not initialized properly. Add spin_lock_init().
Signed-off-by: Michael Buesch <email address hidden>
Acked-by: Christian Lamparter <email address hidden>
Signed-off-by: John W. Linville <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit be80893d309e256fe05a1e55d440bd6188ba2748
Author: John Stultz <email address hidden>
Date: Mon Oct 31 17:06:35 2011 -0400
clocksource: Avoid selecting mult values that might overflow when adjusted
commit d65670a78cdbfae94f20a9e05ec705871d7cdf2b upstream.
For some frequencies, the clocks_calc_mult_shift() function will
unfortunately select mult values very close to 0xffffffff. This
has the potential to overflow when NTP adjusts the clock, adding
to the mult value.
This patch adds a clocksource.maxadj value, which provides
an approximation of an 11% adjustment(NTP limits adjustments to
500ppm and the tick adjustment is limited to 10%), which could
be made to the clocksource.mult value. This is then used to both
check that the current mult value won't overflow/underflow, as
well as warning us if the timekeeping_adjust() code pushes over
that 11% boundary.
v2: Fix max_adjustment calculation, and improve WARN_ONCE
messages.
v3: Don't warn before maxadj has actually been set
CC: Yong Zhang <email address hidden>
CC: David Daney <email address hidden>
CC: Thomas Gleixner <email address hidden>
CC: Chen Jie <email address hidden>
CC: zhangfx <email address hidden>
Reported-by: Chen Jie <email address hidden>
Reported-by: zhangfx <email address hidden>
Tested-by: Yong Zhang <email address hidden>
Signed-off-by: John Stultz <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit eb5f9ebf61f88796a19df09751762b9e086a5214
Author: Jeff Ohlstein <email address hidden>
Date: Fri Nov 18 15:47:10 2011 -0800
hrtimer: Fix extra wakeups from __remove_hrtimer()
commit 27c9cd7e601632b3794e1c3344d37b86917ffb43 upstream.
__remove_hrtimer() attempts to reprogram the clockevent device when
the timer being removed is the next to expire. However,
__remove_hrtimer() reprograms the clockevent *before* removing the
timer from the timerqueue and thus when hrtimer_force_reprogram()
finds the next timer to expire it finds the timer we're trying to
remove.
This is especially noticeable when the system switches to NOHz mode
and the system tick is removed. The timer tick is removed from the
system but the clockevent is programmed to wakeup in another HZ
anyway.
Silence the extra wakeup by removing the timer from the timerqueue
before calling hrtimer_force_reprogram() so that we actually program
the clockevent for the next timer to expire.
This was broken by 998adc3 "hrtimers: Convert hrtimers to use
timerlist infrastructure".
Signed-off-by: Jeff Ohlstein <email address hidden>
Link: http://<email address hidden>
Signed-off-by: Thomas Gleixner <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 92ad5083db212ff3c5f6d1d085d85790f7a6c42c
Author: Hector Palacios <email address hidden>
Date: Mon Nov 14 11:15:25 2011 +0100
timekeeping: add arch_offset hook to ktime_get functions
commit d004e024058a0eaca097513ce62cbcf978913e0a upstream.
ktime_get and ktime_get_ts were calling timekeeping_get_ns()
but later they were not calling arch_gettimeoffset() so architectures
using this mechanism returned 0 ns when calling these functions.
This happened for example when running Busybox's ping which calls
syscall(__NR_clock_gettime, CLOCK_MONOTONIC, ts) which eventually
calls ktime_get. As a result the returned ping travel time was zero.
Signed-off-by: Hector Palacios <email address hidden>
Signed-off-by: John Stultz <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit c1d98cbbfc393f166b8a675b3acbdfab320adadc
Author: Michal Hocko <email address hidden>
Date: Tue Nov 22 07:44:47 2011 -0800
cgroup_freezer: fix freezing groups with stopped tasks
commit 884a45d964dd395eda945842afff5e16bcaedf56 upstream.
2d3cbf8b (cgroup_freezer: update_freezer_state() does incorrect state
transitions) removed is_task_frozen_enough and replaced it with a simple
frozen call. This, however, breaks freezing for a group with stopped tasks
because those cannot be frozen and so the group remains in CGROUP_FREEZING
state (update_if_frozen doesn't count stopped tasks) and never reaches
CGROUP_FROZEN.
Let's add is_task_frozen_enough back and use it at the original locations
(update_if_frozen and try_to_freeze_cgroup). Semantically we consider
stopped tasks as frozen enough so we should consider both cases when
testing frozen tasks.
Testcase:
mkdir /dev/freezer
mount -t cgroup -o freezer none /dev/freezer
mkdir /dev/freezer/foo
sleep 1h &
pid=$!
kill -STOP $pid
echo $pid > /dev/freezer/foo/tasks
echo FROZEN > /dev/freezer/foo/freezer.state
while true
do
cat /dev/freezer/foo/freezer.state
[ "`cat /dev/freezer/foo/freezer.state`" = "FROZEN" ] && break
sleep 1
done
echo OK
Signed-off-by: Michal Hocko <email address hidden>
Acked-by: Li Zefan <email address hidden>
Cc: Tomasz Buchert <email address hidden>
Cc: Paul Menage <email address hidden>
Cc: Andrew Morton <email address hidden>
Signed-off-by: Tejun Heo <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit ffdb8ca9bea2170b97edb9372bb365fd387a1ff9
Author: Tero Kristo <email address hidden>
Date: Mon Nov 28 16:53:19 2011 +0200
regulator: twl: fix twl4030 support for smps regulators
commit ba305e31e88ea5c2f598ff9fbc5424711a429e30 upstream.
SMPS regulator voltage control differs from the one of the LDO ones.
Current TWL code was using LDO regulator ops for controlling the SMPS
regulators, which fails. This was fixed fixed by adding separate
regulator type which uses correct logic and calculations for the
voltage levels.
Signed-off-by: Tero Kristo <email address hidden>
Signed-off-by: Mark Brown <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 13e15d58a10698371a7d10b5dcdf2ce6630c35ef
Author: Axel Lin <email address hidden>
Date: Mon Nov 28 14:06:31 2011 +0800
regulator: aat2870: Fix the logic of checking if no id is matched in aat2870_get_regulator
commit d4d6373c1109b11c8118340be97ae31b8f94d66a upstream.
In current implementation, the pointer ri is not NULL if no id is matched.
Fix it by checking i == ARRAY_SIZE(aat2870_regulators) if no id is matched.
Signed-off-by: Axel Lin <email address hidden>
Signed-off-by: Mark Brown <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 4148011316b640f48be6b7dd9005033b5347172c
Author: Edward Donovan <email address hidden>
Date: Sun Nov 27 23:07:34 2011 -0500
genirq: fix regression in irqfixup, irqpoll
commit 52553ddffad76ccf192d4dd9ce88d5818f57f62a upstream.
Commit fa27271bc8d2("genirq: Fixup poll handling") introduced a
regression that broke irqfixup/irqpoll for some hardware configurations.
Amidst reorganizing 'try_one_irq', that patch removed a test that
checked for 'action->handler' returning IRQ_HANDLED, before acting on
the interrupt. Restoring this test back returns the functionality lost
since 2.6.39. In the current set of tests, after 'action' is set, it
must precede '!action->next' to take effect.
With this and my previous patch to irq/spurious.c, c75d720fca8a, all
IRQ regressions that I have encountered are fixed.
Signed-off-by: Edward Donovan <email address hidden>
Reported-and-tested-by: Rogério Brito <email address hidden>
Cc: Thomas Gleixner <email address hidden>
Signed-off-by: Linus Torvalds <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 79f1685c82d882192b1e22b3114be78159c54b86
Author: Stanislaw Gruszka <email address hidden>
Date: Mon Nov 28 10:33:40 2011 +0100
rtlwifi: fix lps_lock deadlock
commit e55b32c110b025ce07b40227f620e99700bf8741 upstream.
rtl_lps_leave can be called from interrupt context, so we have to
disable interrupts when taking lps_lock.
Below is full lockdep info about deadlock:
[ 93.815269] =================================
[ 93.815390] [ INFO: inconsistent lock state ]
[ 93.815472] 2.6.41.1-3.offch.fc15.x86_64.debug #1
[ 93.815556] ---------------------------------
[ 93.815635] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
[ 93.815743] swapper/0 [HC0[0]:SC1[1]:HE1:SE0] takes:
[ 93.815832] (&(&rtlpriv->locks.lps_lock)->rlock){+.?...}, at: [<ffffffffa025dad6>] rtl_lps_leave+0x26/0x103 [rtlwifi]
[ 93.815947] {SOFTIRQ-ON-W} state was registered at:
[ 93.815947] [<ffffffff8108e10d>] __lock_acquire+0x369/0xd0c
[ 93.815947] [<ffffffff8108efb3>] lock_acquire+0xf3/0x13e
[ 93.815947] [<ffffffff814e981d>] _raw_spin_lock+0x45/0x79
[ 93.815947] [<ffffffffa025de34>] rtl_swlps_rf_awake+0x5a/0x76 [rtlwifi]
[ 93.815947] [<ffffffffa025aec0>] rtl_op_config+0x12a/0x32a [rtlwifi]
[ 93.815947] [<ffffffffa01d614b>] ieee80211_hw_config+0x124/0x129 [mac80211]
[ 93.815947] [<ffffffffa01e0af3>] ieee80211_dynamic_ps_disable_work+0x32/0x47 [mac80211]
[ 93.815947] [<ffffffff81075aa5>] process_one_work+0x205/0x3e7
[ 93.815947] [<ffffffff81076753>] worker_thread+0xda/0x15d
[ 93.815947] [<ffffffff8107a119>] kthread+0xa8/0xb0
[ 93.815947] [<ffffffff814f3184>] kernel_thread_helper+0x4/0x10
[ 93.815947] irq event stamp: 547822
[ 93.815947] hardirqs last enabled at (547822): [<ffffffff814ea1a7>] _raw_spin_unlock_irqrestore+0x45/0x61
[ 93.815947] hardirqs last disabled at (547821): [<ffffffff814e9987>] _raw_spin_lock_irqsave+0x22/0x8e
[ 93.815947] softirqs last enabled at (547790): [<ffffffff810623ed>] _local_bh_enable+0x13/0x15
[ 93.815947] softirqs last disabled at (547791): [<ffffffff814f327c>] call_softirq+0x1c/0x30
[ 93.815947]
[ 93.815947] other info that might help us debug this:
[ 93.815947] Possible unsafe locking scenario:
[ 93.815947]
[ 93.815947] CPU0
[ 93.815947] ----
[ 93.815947] lock(&(&rtlpriv->locks.lps_lock)->rlock);
[ 93.815947] <Interrupt>
[ 93.815947] lock(&(&rtlpriv->locks.lps_lock)->rlock);
[ 93.815947]
[ 93.815947] *** DEADLOCK ***
[ 93.815947]
[ 93.815947] no locks held by swapper/0.
[ 93.815947]
[ 93.815947] stack backtrace:
[ 93.815947] Pid: 0, comm: swapper Not tainted 2.6.41.1-3.offch.fc15.x86_64.debug #1
[ 93.815947] Call Trace:
[ 93.815947] <IRQ> [<ffffffff814dfd00>] print_usage_bug+0x1e7/0x1f8
[ 93.815947] [<ffffffff8101a849>] ? save_stack_trace+0x2c/0x49
[ 93.815947] [<ffffffff8108d55c>] ? print_irq_inversion_bug.part.18+0x1a0/0x1a0
[ 93.815947] [<ffffffff8108dc8a>] mark_lock+0x106/0x220
[ 93.815947] [<ffffffff8108e099>] __lock_acquire+0x2f5/0xd0c
[ 93.815947] [<ffffffff810152af>] ? native_sched_clock+0x34/0x36
[ 93.830125] [<ffffffff810152ba>] ? sched_clock+0x9/0xd
[ 93.830125] [<ffffffff81080181>] ? sched_clock_local+0x12/0x75
[ 93.830125] [<ffffffffa025dad6>] ? rtl_lps_leave+0x26/0x103 [rtlwifi]
[ 93.830125] [<ffffffff8108efb3>] lock_acquire+0xf3/0x13e
[ 93.830125] [<ffffffffa025dad6>] ? rtl_lps_leave+0x26/0x103 [rtlwifi]
[ 93.830125] [<ffffffff814e981d>] _raw_spin_lock+0x45/0x79
[ 93.830125] [<ffffffffa025dad6>] ? rtl_lps_leave+0x26/0x103 [rtlwifi]
[ 93.830125] [<ffffffff81422467>] ? skb_dequeue+0x62/0x6d
[ 93.830125] [<ffffffffa025dad6>] rtl_lps_leave+0x26/0x103 [rtlwifi]
[ 93.830125] [<ffffffffa025f677>] _rtl_pci_ips_leave_tasklet+0xe/0x10 [rtlwifi]
[ 93.830125] [<ffffffff8106281f>] tasklet_action+0x8d/0xee
[ 93.830125] [<ffffffff810629ce>] __do_softirq+0x112/0x25a
[ 93.830125] [<ffffffff814f327c>] call_softirq+0x1c/0x30
[ 93.830125] [<ffffffff81010bf6>] do_softirq+0x4b/0xa1
[ 93.830125] [<ffffffff81062d7d>] irq_exit+0x5d/0xcf
[ 93.830125] [<ffffffff814f3b7e>] do_IRQ+0x8e/0xa5
[ 93.830125] [<ffffffff814ea533>] common_interrupt+0x73/0x73
[ 93.830125] <EOI> [<ffffffff8108b825>] ? trace_hardirqs_off+0xd/0xf
[ 93.830125] [<ffffffff812bb6d5>] ? intel_idle+0xe5/0x10c
[ 93.830125] [<ffffffff812bb6d1>] ? intel_idle+0xe1/0x10c
[ 93.830125] [<ffffffff813f8d5e>] cpuidle_idle_call+0x11c/0x1fe
[ 93.830125] [<ffffffff8100e2ef>] cpu_idle+0xab/0x101
[ 93.830125] [<ffffffff814c6373>] rest_init+0xd7/0xde
[ 93.830125] [<ffffffff814c629c>] ? csum_partial_copy_generic+0x16c/0x16c
[ 93.830125] [<ffffffff81d4bbb0>] start_kernel+0x3dd/0x3ea
[ 93.830125] [<ffffffff81d4b2c4>] x86_64_start_reservations+0xaf/0xb3
[ 93.830125] [<ffffffff81d4b140>] ? early_idt_handlers+0x140/0x140
[ 93.830125] [<ffffffff81d4b3ca>] x86_64_start_kernel+0x102/0x111
Resolves:
https://bugzilla.redhat.com/show_bug.cgi?id=755154
Reported-by: <email address hidden>
Reported-and-tested-by: Oliver Paukstadt <email address hidden>
Acked-by: Larry Finger <email address hidden>
Signed-off-by: Stanislaw Gruszka <email address hidden>
Signed-off-by: John W. Linville <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 01da30a885baa667801facc2a54c80346ab6c414
Author: Tejun Heo <email address hidden>
Date: Thu Nov 24 19:22:24 2011 -0500
ext4: fix racy use-after-free in ext4_end_io_dio()
commit 4c81f045c0bd2cbb78cc6446a4cd98038fe11a2e upstream.
ext4_end_io_dio() queues io_end->work and then clears iocb->private;
however, io_end->work calls aio_complete() which frees the iocb
object. If that slab object gets reallocated, then ext4_end_io_dio()
can end up clearing someone else's iocb->private, this use-after-free
can cause a leak of a struct ext4_io_end_t structure.
Detected and tested with slab poisoning.
[ Note: Can also reproduce using 12 fio's against 12 file systems with the
following configuration file:
[global]
direct=1
ioengine=libaio
iodepth=1
bs=4k
ba=4k
size=128m
[create]
filename=${TESTDIR}
rw=write
-- tytso ]
Google-Bug-Id: 5354697
Signed-off-by: Tejun Heo <email address hidden>
Signed-off-by: "Theodore Ts'o" <email address hidden>
Reported-by: Kent Overstreet <email address hidden>
Tested-by: Kent Overstreet <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 453fdf5561cc042b7e127af6a62138969726f539
Author: Trond Myklebust <email address hidden>
Date: Tue Nov 22 14:44:28 2011 +0200
SUNRPC: Ensure we return EAGAIN in xs_nospace if congestion is cleared
commit 24ca9a847791fd53d9b217330b15f3c285827a18 upstream.
By returning '0' instead of 'EAGAIN' when the tests in xs_nospace() fail
to find evidence of socket congestion, we are making the RPC engine believe
that the message was incorrectly sent and so it disconnects the socket
instead of just retrying.
The bug appears to have been introduced by commit
5e3771ce2d6a69e10fcc870cdf226d121d868491 (SUNRPC: Ensure that xs_nospace
return values are propagated).
Reported-by: Andrew Cooper <email address hidden>
Signed-off-by: Trond Myklebust <email address hidden>
Tested-by: Andrew Cooper <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 854b259aa1fbb2f4e63ba02a008f48c36606e73d
Author: Mark Brown <email address hidden>
Date: Mon Nov 21 11:55:41 2011 +0000
ASoC: Ensure WM8731 register cache is synced when resuming from disabled
commit ed3e80c4c991a52f9fce3421536a78e331ae0949 upstream.
Signed-off-by: Mark Brown <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 101e07082f732dfb645ba370b0c0b510e1283f25
Author: Timo Juhani Lindfors <email address hidden>
Date: Thu Nov 17 02:52:50 2011 +0200
ASoC: wm8753: Skip noop reconfiguration of DAI mode
commit 2391a0e06789a3f1718dee30b282562f7ed28c87 upstream.
This patch makes it possible to set DAI mode to its currently applied
value even if codec is active. This is necessary to allow
aplay -t raw -r 44100 -f S16_LE -c 2 < /dev/urandom &
alsactl store -f backup.state
alsactl restore -f backup.state
to work without returning errors. This patch is based on a patch sent
by Klaus Kurzmann <email address hidden>.
Signed-off-by: Timo Juhani Lindfors <email address hidden>
Signed-off-by: Mark Brown <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 38c15d6ae974128158acee43380508db968c80bf
Author: Timur Tabi <email address hidden>
Date: Mon Nov 14 16:35:26 2011 -0600
ASoC: fsl_ssi: properly initialize the sysfs attribute object
commit 0f768a7235d3dfb6f4833030a95a06419df089cb upstream.
Commit 6992f533 ("sysfs: Use one lockdep class per sysfs attribute")
requires 'struct attribute' objects to be initialized with sysfs_attr_init().
Signed-off-by: Timur Tabi <email address hidden>
Signed-off-by: Mark Brown <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 71b3b360ee04f567eded77c3bcadb510f9a7c8f0
Author: Johannes Stezenbach <email address hidden>
Date: Mon Nov 14 17:23:16 2011 +0100
ASoC: sta32x: preserve coefficient RAM
commit 54dc6cabe684375b3cf549c7b0545613d694aba8 upstream.
The coefficient RAM must be saved in a shadow so it can
be restored when the codec is powered on using
regulator_bulk_enable().
Signed-off-by: Johannes Stezenbach <email address hidden>
Signed-off-by: Mark Brown <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 45445147b0cf1c398b370aa064dc2fb7f9b5128e
Author: Takashi Iwai <email address hidden>
Date: Wed Nov 23 07:38:59 2011 +0100
ALSA: hda/realtek - Fix missing inits of item indices for auto-mic
commit 6759dc323826c2c806c998cd93945c5476688dd2 upstream.
When the imux entries are rebuilt in alc_rebuild_imux_for_auto_mic(),
the initialization of index field is missing. It may work without it
casually when the original imux was created by the auto-parser, but
it's definitely broken in the case of static configs where no imux was
parsed beforehand. Because of this, the auto-mic switching doesn't
work properly on some model options.
This patch adds the missing initialization of index field.
Reported-by: Dmitry Nezhevenko <email address hidden>
Signed-off-by: Takashi Iwai <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 30444a763d652293e36f38ca43de13d6cf5ec3b0
Author: Tim Blechmann <email address hidden>
Date: Tue Nov 22 11:15:45 2011 +0100
ALSA: lx6464es - fix device communication via command bus
commit a29878553a9a7b4c06f93c7e383527cf014d4ceb upstream.
commit 6175ddf06b6172046a329e3abfd9c901a43efd2e optimized the mem*io
functions that have been used to send commands to the device. these
optimizations somehow corrupted the communication with the lx6464es,
that resulted the device to be unusable with kernels after 2.6.33.
this patch emulates the memcpy_*_io functions via a loop to avoid these
problems.
Signed-off-by: Tim Blechmann <email address hidden>
LKML-Reference: <email address hidden>
Signed-off-by: Takashi Iwai <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 9b8fd4ef07fdfeb445ab35b2329fe3c1727297fe
Author: Takashi Iwai <email address hidden>
Date: Thu Nov 24 16:33:09 2011 +0100
ALSA: hda - Fix jack-detection control of VT1708
commit 187d333edc0a8e1bb507900ce89853ffe3bd2c84 upstream.
VT1708 has no support for unsolicited events per jack-plug, the driver
implements the workq for polling the jack-detection. The mixer element
"Jack Detect" was supposed to control this behavior on/off, but this
doesn't work properly as is now. The workq is always started and the
HP automute is always enabled.
This patch fixes the jack-detect control behavior by triggering / stopping
the work appropriately at the state change. Also the work checks the
internal state to continue scheduling or not.
Signed-off-by: Takashi Iwai <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 03c371b70411f1f2805e2965eff0629908b59c13
Author: Will Deacon <email address hidden>
Date: Mon Nov 14 17:24:58 2011 +0100
ARM: 7161/1: errata: no automatic store buffer drain
commit 11ed0ba1754841316d4095478944300acf19acc3 upstream.
This patch implements a workaround for PL310 erratum 769419. On
revisions of the PL310 prior to r3p2, the Store Buffer does not
automatically drain. This can cause normal, non-cacheable writes to be
retained when the memory system is idle, leading to suboptimal I/O
performance for drivers using coherent DMA.
This patch adds an optional wmb() call to the cpu_idle loop. On systems
with an outer cache, this causes an explicit flush of the store buffer.
Acked-by: Catalin Marinas <email address hidden>
Tested-by: Marc Zyngier <email address hidden>
Signed-off-by: Will Deacon <email address hidden>
Signed-off-by: Russell King <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit e9b529a3d8929c793ed6326d407ec7bf18bff6bb
Author: Kevin Hilman <email address hidden>
Date: Wed Nov 23 14:43:01 2011 -0800
ARM: OMAP: PM: only register TWL with voltage layer when device is present
commit 46232a3622c6e33605906ee6690dfef372925f53 upstream.
Current code registers voltage layer details for TWL PMIC even when a TWL
has not been registered. Fix this to only register the TWL with voltage
layer when the TWL PMIC is initialized by board-level code.
Signed-off-by: Kevin Hilman <email address hidden>
Signed-off-by: Tony Lindgren <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 8591c9d862e86646a1b76ca3154c0ec1b58d51c6
Author: Ming Lei <email address hidden>
Date: Wed Nov 23 14:44:50 2011 -0800
ARM: OMAP2: select ARM_AMBA if OMAP3_EMU is defined
commit a8a6565c7615cab3608d75af95b5c8a3522cd7c4 upstream.
This patch selects ARM_AMBA if OMAP3_EMU is defined because
OC_ETM depends on ARM_AMBA, so fix the link failure[1].
[1],
arch/arm/kernel/built-in.o: In function `etm_remove':
/home/tom/git/omap/linux-2.6-omap/arch/arm/kernel/etm.c:609: undefined
reference to `amba_release_regions'
arch/arm/kernel/built-in.o: In function `etb_remove':
/home/tom/git/omap/linux-2.6-omap/arch/arm/kernel/etm.c:409: undefined
reference to `amba_release_regions'
arch/arm/kernel/built-in.o: In function `etm_init':
/home/tom/git/omap/linux-2.6-omap/arch/arm/kernel/etm.c:640: undefined
reference to `amba_driver_register'
/home/tom/git/omap/linux-2.6-omap/arch/arm/kernel/etm.c:646: undefined
reference to `amba_driver_register'
/home/tom/git/omap/linux-2.6-omap/arch/arm/kernel/etm.c:648: undefined
reference to `amba_driver_unregister'
arch/arm/kernel/built-in.o: In function `etm_probe':
/home/tom/git/omap/linux-2.6-omap/arch/arm/kernel/etm.c:545: undefined
reference to `amba_request_regions'
/home/tom/git/omap/linux-2.6-omap/arch/arm/kernel/etm.c:595: undefined
reference to `amba_release_regions'
arch/arm/kernel/built-in.o: In function `etb_probe':
/home/tom/git/omap/linux-2.6-omap/arch/arm/kernel/etm.c:347: undefined
reference to `amba_request_regions'
/home/tom/git/omap/linux-2.6-omap/arch/arm/kernel/etm.c:392: undefined
reference to `amba_release_regions'
arch/arm/mach-omap2/built-in.o: In function `emu_init':
/home/tom/git/omap/linux-2.6-omap/arch/arm/mach-omap2/emu.c:62:
undefined reference to `amba_device_register'
/home/tom/git/omap/linux-2.6-omap/arch/arm/mach-omap2/emu.c:63:
undefined reference to `amba_device_register'
make: *** [.tmp_vmlinux1] Error 1
making modules
Signed-off-by: Ming Lei <email address hidden>
Signed-off-by: Tony Lindgren <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 969b42a8899f173a232b5ad14b2a0f5913c8b3b1
Author: sricharan <email address hidden>
Date: Wed Nov 23 14:35:07 2011 -0800
ARM: OMAP: hwmod: Fix the addr space, irq, dma count APIs
commit cc1b0765da6078b906772b79ff211b88cc0ae958 upstream.
The address spaces, irqs and dma reqs count APIs return the
number of corresponding entries in a hwmod including a additional
null value or a -1 terminator in the structure introduced recently.
More information here:
- 212738a4: omap_hwmod: use a terminator record with omap_hwmod_mpu_irqs
arrays
- 78183f3f: omap_hwmod: use a null structure record to terminate
omap_hwmod_addr_space arrays
- bc614958: omap_hwmod: use a terminator record with omap_hwmod_dma_info
arrays
The issue with irqs and dma info was originally reported by Benoit Cousson.
The devices which have multiple hwmods and use device_build_ss are
broken with this, as their resources are populated with a extra null
value, subsequently the probe fails. So fix the API not to include
the array terminator in the count.
Reported-by: Benoit Cousson <email address hidden>
Signed-off-by: Santosh Shilimkar <email address hidden>
Signed-off-by: sricharan <email address hidden>
Signed-off-by: Benoit Cousson <email address hidden>
Cc: Paul Walmsley <email address hidden>
Signed-off-by: Tony Lindgren <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 8fe9f659b730ca92367370cf7ae6de6ef640cf62
Author: Felipe Balbi <email address hidden>
Date: Wed Nov 23 14:43:37 2011 -0800
ARM: OMAP: smartreflex: fix IRQ handling bug
commit 5a4f1844c2ba21f804d7729306d9b16eaeb724a8 upstream.
Fix a bug which has been on this driver since
it was added by the original commit 984aa6db
which would never clear IRQSTATUS bits.
Signed-off-by: Felipe Balbi <email address hidden>
Signed-off-by: Kevin Hilman <email address hidden>
Signed-off-by: Tony Lindgren <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit acc0e76c23b07b8d0bd85774de9904ce278115c4
Author: Wolfram Sang <email address hidden>
Date: Sat Sep 10 12:26:07 2011 +0200
arm: mx28: fix bit operation in clock setting
commit c2735391fbc68feae10d6d14e60956c8106e725f upstream.
reg | (1 << clk->enable_shift) always evaluates to true. Switch it
to & which makes much more sense. Same fix as 13be9f00 (ARM i.MX28: fix
bit operation) at a different location.
Signed-off-by: Wolfram Sang <email address hidden>
Cc: Sascha Hauer <email address hidden>
Cc: Shawn Guo <email address hidden>
Signed-off-by: Shawn Guo <email address hidden>
Signed-off-by: Arnd Bergmann <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 8533dca18388b89bcb1772c5f504ac96a4826632
Author: Haojian Zhuang <email address hidden>
Date: Thu Nov 10 07:13:07 2011 +0800
ARM: pxa: fix inconsistent CONFIG_USB_PXA27X
commit c0a39151a4055332897cba615623d3de2f3896df upstream.
Since CONFIG_USB_GADGET_PXA27X and other macros are renamed to
CONFIG_USB_PXA27X. Update them in arch/arm/mach-pxa and arch/arm/configs
to keep consistent.
Signed-off-by: Haojian Zhuang <email address hidden>
Acked-by: Felipe Balbi <email address hidden>
Signed-off-by: Eric Miao <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit df01c1efffdaf26ef874f96986a64776c170b024
Author: Daniel Drake <email address hidden>
Date: Mon Nov 21 15:05:56 2011 +0000
viafb: correct sync polarity for OLPC DCON
commit a32839696a8eef813a1aff604fbad9a32dff6c95 upstream.
While the OLPC display appears to be able to handle either positive
or negative sync, the Display Controller only recognises positive sync.
This brings viafb (for XO-1.5) in line with lxfb (for XO-1) and
fixes a recent regression where the XO-1.5 DCON could no longer be
frozen. Thanks to Florian Tobias Schandinat for helping identify
the fix.
Test case: from a vt,
echo 1 > /sys/devices/platform/dcon/freeze
should cause the current screen contents to freeze, rather than garbage being
displayed.
Signed-off-by: Daniel Drake <email address hidden>
Signed-off-by: Florian Tobias Schandinat <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit cbd00285bbef94804213974a5fd084c3f7197ec6
Author: Alex Deucher <email address hidden>
Date: Mon Nov 14 14:32:01 2011 -0500
drm/radeon/kms: fix up gpio i2c mask bits for r4xx
commit 6c47e5c23aa2a7c54ad7ac13af4bd56cd9e703bf upstream.
Fixes i2c test failures when i2c_algo_bit.bit_test=1.
The hw doesn't actually require a mask, so just set it
to the default mask bits for r1xx-r4xx radeon ddc.
Signed-off-by: Alex Deucher <email address hidden>
Cc: Jean Delvare <email address hidden>
Signed-off-by: Dave Airlie <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 14855077253713109f8a835cc6e9271432460de9
Author: Bjorn Helgaas <email address hidden>
Date: Tue Aug 23 10:16:43 2011 -0600
PCI hotplug: shpchp: don't blindly claim non-AMD 0x7450 device IDs
commit 4cac2eb158c6da0c761689345c6cc5df788a6292 upstream.
Previously we claimed device ID 0x7450, regardless of the vendor, which is
clearly wrong. Now we'll claim that device ID only for AMD.
I suspect this was just a typo in the original code, but it's possible this
change will break shpchp on non-7450 AMD bridges. If so, we'll have to fix
them as we find them.
Reference: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=638863
Reported-by: Ralf Jung <email address hidden>
Cc: Joerg Roedel <email address hidden>
Signed-off-by: Bjorn Helgaas <email address hidden>
Signed-off-by: Jesse Barnes <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit d02f594b5287e6b8a0274991b6b6e645cef79b33
Author: Takashi Iwai <email address hidden>
Date: Wed Nov 16 10:58:03 2011 +0100
drm/i915: Fix inconsistent backlight level during disabled
commit 04b38670cf46c096705f24e92a8747d1ab89e53c upstream.
When the brightness property is inquired while the backlight is disabled,
the driver returns a wrong value (zero) because it probes the value after
the backlight was turned off. This caused a black screen even after the
backlight is enabled again. It should return the internal backlight_level
instead, so that it won't be influenced by the backlight-enable state.
BugLink: https://bugs.freedesktop.org/show_bug.cgi?id=41926
BugLink: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/872652
Tested-by: Kamal Mostafa <email address hidden>
Cc: Alex Davis <email address hidden>
Signed-off-by: Takashi Iwai <email address hidden>
Signed-off-by: Keith Packard <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 8f9940d1bf1d7dface90977031e327ee237408ca
Author: Eric Anholt <email address hidden>
Date: Mon Nov 7 16:07:05 2011 -0800
drm/i915: Turn on another required clock gating bit on gen6.
commit 9ca1d10d748e56964de95e3ed80211b192f56cf4 upstream.
Unlike the previous one, I don't have known testcases it fixes. I'd
rather not go through the same debug cycle on whatever testcases those
might be.
Signed-off-by: Eric Anholt <email address hidden>
Signed-off-by: Keith Packard <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 9bdbb716a8c3a3363d40b198f351d78bfecd8917
Author: Eric Anholt <email address hidden>
Date: Mon Nov 7 16:07:04 2011 -0800
drm/i915: Turn on a required 3D clock gating bit on Sandybridge.
commit 406478dc911e16677fbd9c84d1d50cdffbc031ab upstream.
Fixes rendering failures in Unigine Tropics and Sanctuary and the mesa
"fire" demo.
Signed-off-by: Eric Anholt <email address hidden>
Signed-off-by: Keith Packard <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 03d51d153892ab5f07362ba63e088f8bf2d0512e
Author: Daniel Vetter <email address hidden>
Date: Sun Oct 9 21:52:01 2011 +0200
drm/i915: Ivybridge still has fences!
commit 775d17b6ca4357048f36c22151335addfe15db4b upstream.
So don't forget to restore them on resume and dump them into
the error state.
Signed-off-by: Daniel Vetter <email address hidden>
Reviewed-by: Chris Wilson <email address hidden>
Signed-off-by: Keith Packard <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 24966e970264bfffa616f1f2d5f65a2db069b871
Author: Alex Deucher <email address hidden>
Date: Mon Nov 21 12:10:14 2011 -0500
drm/radeon/kms: fix up gpio i2c mask bits for r4xx for real
commit d724502a9d7a46f4a56a1663b1f50d2dc9d1ef40 upstream.
Fixes i2c test failures when i2c_algo_bit.bit_test=1.
The hw doesn't actually require a mask, so just set it
to the default mask bits for r1xx-r4xx radeon ddc.
I missed this part the first time through.
Signed-off-by: Alex Deucher <email address hidden>
Cc: Jean Delvare <email address hidden>
Signed-off-by: Dave Airlie <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 02a04b98adead5626a395edc21bf6d7f17611938
Author: Xi Wang <email address hidden>
Date: Wed Nov 23 01:12:01 2011 -0500
drm: integer overflow in drm_mode_dirtyfb_ioctl()
commit a5cd335165e31db9dbab636fd29895d41da55dd2 upstream.
There is a potential integer overflow in drm_mode_dirtyfb_ioctl()
if userspace passes in a large num_clips. The call to kmalloc would
allocate a small buffer, and the call to fb->funcs->dirty may result
in a memory corruption.
Reported-by: Haogang Chen <email address hidden>
Signed-off-by: Xi Wang <email address hidden>
Signed-off-by: Dave Airlie <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 49f5bf4e65140344f6ab824571b8325b7bd95d9b
Author: Phil Sutter <email address hidden>
Date: Wed Nov 16 18:28:01 2011 +0100
crypto: mv_cesa - fix hashing of chunks > 1920 bytes
commit 274252862f386b7868f35bf5ceaa5391a8ccfdf3 upstream.
This was broken by commit 7759995c75ae0cbd4c861582908449f6b6208e7a (yes,
myself). The basic problem here is since the digest state is only saved
after the last chunk, the state array is only valid when handling the
first chunk of the next buffer. Broken since linux-3.0.
Signed-off-by: Phil Sutter <email address hidden>
Signed-off-by: Herbert Xu <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 722daca8514aacaf7ed1311f2cc8e518af675049
Author: Tyler Hicks <email address hidden>
Date: Wed Nov 23 11:31:24 2011 -0600
eCryptfs: Extend array bounds for all filename chars
commit 0f751e641a71157aa584c2a2e22fda52b52b8a56 upstream.
From mhalcrow's original commit message:
Characters with ASCII values greater than the size of
filename_rev_map[] are valid filename characters.
ecryptfs_decode_from_filename() will access kernel memory beyond
that array, and ecryptfs_parse_tag_70_packet() will then decrypt
those characters. The attacker, using the FNEK of the crafted file,
can then re-encrypt the characters to reveal the kernel memory past
the end of the filename_rev_map[] array. I expect low security
impact since this array is statically allocated in the text area,
and the amount of memory past the array that is accessible is
limited by the largest possible ASCII filename character.
This patch solves the issue reported by mhalcrow but with an
implementation suggested by Linus to simply extend the length of
filename_rev_map[] to 256. Characters greater than 0x7A are mapped to
0x00, which is how invalid characters less than 0x7A were previously
being handled.
Signed-off-by: Tyler Hicks <email address hidden>
Reported-by: Michael Halcrow <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit a638f9564fd11b37efee4e78d7ef9dc52eb2a7cd
Author: Jeffrey (Sheng-Hui) Chu <email address hidden>
Date: Wed Nov 23 11:33:07 2011 +0100
i2c-algo-bit: Generate correct i2c address sequence for 10-bit target
commit cc6bcf7d2ec2234e7b41770185e4dc826390185e upstream.
The wrong bits were put on the wire, fix that.
This fixes kernel bug #42562.
Signed-off-by: Sheng-Hui J. Chu <email address hidden>
Signed-off-by: Jean Delvare <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 19c8acbc4a4d444d72d256a7541b040cebddc78b
Author: Tyler Hicks <email address hidden>
Date: Mon Nov 21 17:31:29 2011 -0600
eCryptfs: Flush file in vma close
commit 32001d6fe9ac6b0423e674a3093aa56740849f3b upstream.
Dirty pages weren't being written back when an mmap'ed eCryptfs file was
closed before the mapping was unmapped. Since f_ops->flush() is not
called by the munmap() path, the lower file was simply being released.
This patch flushes the eCryptfs file in the vm_ops->close() path.
https://launchpad.net/bugs/870326
Signed-off-by: Tyler Hicks <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit d1d274cd1ce2eb979c66233a36a7a92abfc0f18f
Author: Tyler Hicks <email address hidden>
Date: Mon Nov 21 17:31:02 2011 -0600
eCryptfs: Prevent file create race condition
commit b59db43ad4434519feb338eacb01d77eb50825c5 upstream.
The file creation path prematurely called d_instantiate() and
unlock_new_inode() before the eCryptfs inode info was fully
allocated and initialized and before the eCryptfs metadata was written
to the lower file.
This could result in race conditions in subsequent file and inode
operations leading to unexpected error conditions or a null pointer
dereference while attempting to use the unallocated memory.
https://launchpad.net/bugs/813146
Signed-off-by: Tyler Hicks <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 4cd6f5d82a1e43abb729fdfe7e7a6833892845dd
Merge: 272d3c7 74517cb
Author: Nicolas Pitre <email address hidden>
Date: Mon Nov 28 22:46:01 2011 -0500
Merge commit 'v3.1.4' into linaro-3.1
commit 74517cb61ec5b7b5902b36feb0ae2cc60444e8f0
Author: Greg Kroah-Hartman <email address hidden>
Date: Tue Nov 29 07:48:14 2011 +0900
Linux 3.1.4
commit 4a8dec4b97aaf62dd1d532fd1b2edbc26afd4cb9
Author: Greg Kroah-Hartman <email address hidden>
Date: Tue Nov 29 07:40:10 2011 +0900
Revert "USB: EHCI: fix HUB TT scheduling issue with iso transfer"
This reverts commit f0cc710a6dec5b808a6f13f1f8853c094fce5f12.
Cc: Matthieu Castet <email address hidden>
Cc: Thomas Poussevin <email address hidden>
Cc: Alan Stern <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 272d3c754502ee3ccd898264f050721f565d0c8e
Author: Kautuk Consul <email address hidden>
Date: Tue Nov 22 13:31:30 2011 -0500
arm: fault.c: Port OOM changes into do_page_fault
Commit d065bd810b6deb67d4897a14bfe21f8eb526ba99
(mm: retry page fault when blocking on disk transfer) and
commit 37b23e0525d393d48a7d59f870b3bc061a30ccdb
(x86,mm: make pagefault killable)
The above commits introduced changes into the x86 pagefault handler
for making the page fault handler retryable as well as killable.
These changes reduce the mmap_sem hold time, which is crucial
during OOM killer invocation.
Port these changes to ARM.
Without these changes, my ARM board encounters many hang and livelock
scenarios.
After applying this patch, OOM feature performance improves according to
my testing.
Signed-off-by: Kautuk Consul <email address hidden>
"I think this is fine"-by Russell King - ARM Linux <email address hidden>
Signed-off-by: Nicolas Pitre <email address hidden>
commit ca6abb54069c4ab951eb71c7034ec6b4eb626a98
Merge: f6b252b a625393
Author: Nicolas Pitre <email address hidden>
Date: Mon Nov 28 11:42:42 2011 -0500
Merge commit 'v3.1.2' into linaro-3.1
commit e6c2efafa8854e544bd15bdfc8498d4d0507d805
Author: Greg Kroah-Hartman <email address hidden>
Date: Sat Nov 26 09:08:57 2011 -0800
Linux 3.1.3
commit 26e15787b98f3cac67d0b9458befd24adbef7272
Author: Mikulas Patocka <email address hidden>
Date: Mon Oct 31 17:08:57 2011 -0700
vmscan: fix shrinker callback bug in fs/super.c
commit 09f363c7363eb10cfb4b82094bd7064e5608258b upstream.
The callback must not return -1 when nr_to_scan is zero. Fix the bug in
fs/super.c and add this requirement to the callback specification.
Signed-off-by: Mikulas Patocka <email address hidden>
Cc: Dave Chinner <email address hidden>
Signed-off-by: Andrew Morton <email address hidden>
Signed-off-by: Linus Torvalds <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 1bccf76533a1e336dfa8007554d4283253e259c7
Author: Antonio Quartulli <email address hidden>
Date: Sat Oct 22 00:55:39 2011 +0200
batman-adv: unify hash_entry field position in tt_local/global_entry
commit 93840ac40bb0d0f177ef8af74e64671be67e8c37 upstream.
Function tt_response_fill_table() actually uses a tt_local_entry pointer to
iterate either over the local or the global table entries (it depends on the
what hash table is passed as argument). To iterate over such entries the
hlist_for_each_entry_rcu() macro has to access their "hash_entry" field which
MUST be at the same position in both the tt_global/local_entry structures.
Reported-by: Simon Wunderlich <email address hidden>
Signed-off-by: Antonio Quartulli <email address hidden>
Signed-off-by: Marek Lindner <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 9bab392e4a2120bba4f6fbe8676a5baf16756926
Author: Simon Wunderlich <email address hidden>
Date: Wed Oct 19 10:28:26 2011 +0200
batman-adv: add sanity check when removing global tts
commit 6e8014947d6469df1566e9e253805557c5c0e4e0 upstream.
After removing the batman-adv module, the hash may be already gone
when tt_global_del_orig() tries to clean the hash. This patch adds
a sanity check to avoid this.
Signed-off-by: Simon Wunderlich <email address hidden>
Tested-by: Alexey Fisher <email address hidden>
Signed-off-by: Marek Lindner <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 7766f4ed0b29204dc9248dea3bc547a8c93d18cb
Author: Simon Wunderlich <email address hidden>
Date: Wed Oct 19 11:02:25 2011 +0200
batman-adv: remove references for global tt entries
commit 531027fcddbcf81c9937dd04f08a7e8f11fd47d2 upstream.
struct tt_global_entry holds a reference to an orig_node which must be
decremented before deallocating the structure.
Signed-off-by: Simon Wunderlich <email address hidden>
Tested-by: Alexey Fisher <email address hidden>
Signed-off-by: Marek Lindner <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 02460fcf18a10059eb52a223cc62d7d9b43ac3c0
Author: Antonio Quartulli <email address hidden>
Date: Mon Oct 17 14:25:13 2011 +0200
batman-adv: correctly set the data field in the TT_REPONSE packet
commit 9d8523931f7f5eb8900077f0da0fbe6b8ad0010b upstream.
In the TT_RESPONSE packet, the number of carried entries is not correctly set.
This leads to a wrong interpretation of the packet payload on the receiver side
causing random entries to be added to the global translation table. Therefore
the latter gets always corrupted, triggering a table recovery all the time.
Signed-off-by: Antonio Quartulli <email address hidden>
Signed-off-by: Marek Lindner <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit bde860c48a217a9b71fda841090afab693ccb2b6
Author: Antonio Quartulli <email address hidden>
Date: Sun Oct 16 18:53:37 2011 +0200
batman-adv: fix tt_local_reset_flags() function
commit 31901264511cf20c5ed33b8649a3ca9ce28df60b upstream.
Currently the counter of tt_local_entry structures (tt_local_num) is incremented
each time the tt_local_reset_flags() is invoked causing the node to send wrong
TT_REPONSE packets containing a copy of non-initialised memory thus corrupting
other nodes global translation table and making higher level communication
impossible.
Reported-by: Junkeun Song <email address hidden>
Signed-off-by: Antonio Quartulli <email address hidden>
Acked-by: Junkeun Song <email address hidden>
Signed-off-by: Marek Lindner <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 89c59226317ff9ebaa54e37a39ba2479c3f11fa8
Author: Jesse Barnes <email address hidden>
Date: Mon Oct 10 14:28:52 2011 -0700
drm/i915: always set FDI composite sync bit
commit c4f9c4c2b3f1831e932e04db992cf6fe92c2a95a upstream.
It's needed for 3 pipe support as well as just regular functionality
(e.g. DisplayPort).
Signed-off-by: Jesse Barnes <email address hidden>
Tested-by: Adam Jackson <email address hidden>
Tested-by: Eugeni Dodonov <email address hidden>
Signed-off-by: Keith Packard <email address hidden>
Signed-off-by: Robert Hooker <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 8ec180a74877149cc5974b221f02660114c62acb
Author: Jesse Barnes <email address hidden>
Date: Wed Oct 12 11:10:21 2011 -0700
drm/i915: fix IVB cursor support
commit 65a21cd65316145f9302594be8e69074369e1050 upstream.
The cursor regs have moved around, add the offsets and new macros for
getting at them.
Signed-off-by: Jesse Barnes <email address hidden>
Tested-By: Eugeni Dodonov <email address hidden>
Reviewed-By: Eugeni Dodonov <email address hidden>
Signed-off-by: Keith Packard <email address hidden>
Signed-off-by: Robert Hooker <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit f4fb118ca065166a74757cbfa2feac4c366deed3
Author: sordna <email address hidden>
Date: Thu Oct 27 21:06:26 2011 -0700
USB: quirks: adding more quirky webcams to avoid squeaky audio
commit 0d145d7d4a241c321c832a810bb6edad18e2217b upstream.
The following patch contains additional affected webcam models, on top of the
patches commited to linux-next 2394d67e446bf616a0885167d5f0d397bdacfdfc
and 5b253d88cc6c65a23cefc457a5a4ef139913c5fc
Signed-off-by: sordna <email address hidden>
Cc: Oliver Neukum <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 99acf71211a8e9d881461e9099cf30229f99b4d8
Author: Josh Boyer <email address hidden>
Date: Wed Oct 26 13:53:17 2011 -0400
USB: add quirk for Logitech C600 web cam
commit 60c71ca972a2dd3fd9d0165b405361c8ad48349b upstream.
We've had another report of the "chipmunk" sound on a Logitech C600 webcam.
This patch resolves the issue.
Signed-off-by: Josh Boyer <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit f0cc710a6dec5b808a6f13f1f8853c094fce5f12
Author: Thomas Poussevin <email address hidden>
Date: Thu Oct 27 18:46:48 2011 +0200
USB: EHCI: fix HUB TT scheduling issue with iso transfer
commit 811c926c538f7e8d3c08b630dd5844efd7e000f6 upstream.
The current TT scheduling doesn't allow to play and then record on a
full-speed device connected to a high speed hub.
The IN iso stream can only start on the first uframe (0-2 for a 165 us)
because of CSPLIT transactions.
For the OUT iso stream there no such restriction. uframe 0-5 are possible.
The idea of this patch is that the first uframe are precious (for IN TT iso
stream) and we should allocate the last uframes first if possible.
For that we reverse the order of uframe allocation (last uframe first).
Here an example :
hid interrupt stream
----------------------------------------------------------------------
uframe | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 |
----------------------------------------------------------------------
max_tt_usecs | 125 | 125 | 125 | 125 | 125 | 125 | 30 | 0 |
----------------------------------------------------------------------
used usecs on a frame | 13 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
----------------------------------------------------------------------
iso OUT stream
----------------------------------------------------------------------
uframe | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 |
----------------------------------------------------------------------
max_tt_usecs | 125 | 125 | 125 | 125 | 125 | 125 | 30 | 0 |
----------------------------------------------------------------------
used usecs on a frame | 13 | 125 | 39 | 0 | 0 | 0 | 0 | 0 |
----------------------------------------------------------------------
There no place for iso IN stream (uframe 0-2 are used) and we got "cannot
submit datapipe for urb 0, error -28: not enough bandwidth" error.
With the patch this become.
iso OUT stream
----------------------------------------------------------------------
uframe | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 |
----------------------------------------------------------------------
max_tt_usecs | 125 | 125 | 125 | 125 | 125 | 125 | 30 | 0 |
----------------------------------------------------------------------
used usecs on a frame | 13 | 0 | 0 | 0 | 125 | 39 | 0 | 0 |
----------------------------------------------------------------------
iso IN stream
----------------------------------------------------------------------
uframe | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 |
----------------------------------------------------------------------
max_tt_usecs | 125 | 125 | 125 | 125 | 125 | 125 | 30 | 0 |
----------------------------------------------------------------------
used usecs on a frame | 13 | 0 | 125 | 40 | 125 | 39 | 0 | 0 |
----------------------------------------------------------------------
Signed-off-by: Matthieu Castet <email address hidden>
Signed-off-by: Thomas Poussevin <email address hidden>
Signed-off-by: Alan Stern <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit ce0e4cbdc4e962aefc25bde683c415e25ed45ee6
Author: Alan Stern <email address hidden>
Date: Tue Oct 25 10:50:58 2011 -0400
usb-storage: Accept 8020i-protocol commands longer than 12 bytes
commit 2f640bf4c94324aeaa1b6385c10aab8c5ad1e1cf upstream.
The 8020i protocol (also 8070i and QIC-157) uses 12-byte commands;
shorter commands must be padded. Simon Detheridge reports that his
3-TB USB disk drive claims to use the 8020i protocol (which is
normally meant for ATAPI devices like CD drives), and because of its
large size, the disk drive requires the use of 16-byte commands.
However the usb_stor_pad12_command() routine in usb-storage always
sets the command length to 12, making the drive impossible to use.
Since the SFF-8020i specification allows for 16-byte commands in
future extensions, we may as well accept them. This patch (as1490)
changes usb_stor_pad12_command() to leave commands larger than 12
bytes alone rather than truncating them.
Signed-off-by: Alan Stern <email address hidden>
Tested-by: Simon Detheridge <email address hidden>
CC: Matthew Dharm <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 4c72dfff8cfbc0d5c63145691c9dbbd1df995c1c
Author: Andrew Worsley <email address hidden>
Date: Fri Nov 18 23:13:33 2011 +1100
USB: Fix Corruption issue in USB ftdi driver ftdi_sio.c
commit b1ffb4c851f185e9051ba837c16d9b84ef688d26 upstream.
Fix for ftdi_set_termios() glitching output
ftdi_set_termios() is constantly setting the baud rate, data bits and parity
unnecessarily on every call, . When called while characters are being
transmitted can cause the FTDI chip to corrupt the serial port bit stream
output by stalling the output half a bit during the output of a character.
Simple fix by skipping this setting if the baud rate/data bits/parity are
unchanged.
Signed-off-by: Andrew Worsley <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 22e88b06a5779026f242c2eb628ec058c79b2ed0
Author: Bart Hartgers <email address hidden>
Date: Wed Oct 26 13:29:42 2011 +0200
USB: ark3116 initialisation fix
commit 583182ba5f02c8c9be82ea550f2051eaec15b975 upstream.
This patch for the usb serial ark3116 driver fixes an initialisation
ordering bug that gets triggered on hotplug when using at least recent
debian/ubuntu userspace. Without it, ark3116 serial cables don't work.
Signed-off-by: Bart Hartgers <email address hidden>
Tested-by: <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 43e3b323523373a33e4f42304db02779ef03751a
Author: Alan Stern <email address hidden>
Date: Thu Oct 27 11:20:21 2011 -0400
USB: workaround for bug in old version of GCC
commit 97ff22ee3b4cb3a334f7385e269773141aed702f upstream.
This patch (as1491) works around a bug in GCC-3.4.6, which is still
supposed to be supported. The number of microseconds in the udelay()
call in quirk_usb_disable_ehci() is fixed at 100, but the compiler
doesn't understand this and generates a link-time error. So we
replace the otherwise unused variable "delta" with a simple constant
100. This same pattern is already used in other delay loops in that
source file.
Signed-off-by: Alan Stern <email address hidden>
Reported-by: Konrad Rzepecki <email address hidden>
Tested-by: Konrad Rzepecki <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 195f0cd98344bfa50c995add0397efe1d60501f6
Author: Havard Skinnemoen <email address hidden>
Date: Wed Nov 9 13:47:38 2011 -0800
USB: cdc-acm: Fix disconnect() vs close() race
commit 5dc2470c602da8851907ec18942cd876c3b4ecc1 upstream.
There's a race between the USB disconnect handler and the TTY close
handler which may cause the acm object to be freed while it's still
being used. This may lead to things like
http://article.gmane.org/gmane.linux.usb.general/54250
and
https://lkml.org/lkml/2011/5/29/64
This is the simplest fix I could come up with. Holding on to open_mutex
while closing the TTY device prevents acm_disconnect() from freeing the
acm object between acm->port.count drops to 0 and the TTY side of the
cleanups are finalized.
Signed-off-by: Havard Skinnemoen <email address hidden>
Cc: Oliver Neukum <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit c5d412bfb9fe3dbd61d5ce2257b2ab5ed10ee44a
Author: Tomoya MORINAGA <email address hidden>
Date: Fri Oct 28 09:37:34 2011 +0900
USB: pch_udc: Support new device LAPIS Semiconductor ML7831 IOH
commit 731ad81e2dd97e3f222361f7b3ff4b35639e46af upstream.
ML7831 is companion chip for Intel Atom E6xx series.
Signed-off-by: Tomoya MORINAGA <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit a0d5bdc518afcf0721bfb7d324e52bba2234030a
Author: wangyanqing <email address hidden>
Date: Thu Nov 10 14:04:08 2011 +0800
USB: serial: pl2303: rm duplicate id
commit 0c16595539b612fe948559433dda08ff96a8bdc7 upstream.
I get report from customer that his usb-serial
converter doesn't work well,it sometimes work,
but sometimes it doesn't.
The usb-serial converter's id:
vendor_id product_id
0x4348 0x5523
Then I search the usb-serial codes, and there are
two drivers announce support this device, pl2303
and ch341, commit 026dfaf1 cause it. Through many
times to test, ch341 works well with this device,
and pl2303 doesn't work quite often(it just work quite little).
ch341 works well with this device, so we doesn't
need pl2303 to support.I try to revert 026dfaf1 first,
but it failed. So I prepare this patch by hand to revert it.
Signed-off-by: Wang YanQing <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 6954d95fa354eb6bc277505c658fe28f9553b6b8
Author: Ferenc Wagner <email address hidden>
Date: Thu Nov 17 16:44:58 2011 +0100
USB: option: add PID of Huawei E173s 3G modem
commit 4aa3648c719265bac9c2742c9ebb043e6dbdd790 upstream.
Signed-off-by: Ferenc Wagner <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 8cf4a733a63a487d1028127ac567fef1e3d805eb
Author: <email address hidden> <email address hidden>
Date: Thu Nov 17 19:23:25 2011 +0800
USB: option: release new PID for ZTE 3G modem
commit 46b5a277ed90317a4d17e936c16037e76011b219 upstream.
This patch adds new PIDs for ZTE 3G modem, after we confirm it and tested.
Thanks for Dan's work at kernel option devier.
Signed-off-by: Alvin.Zheng <email address hidden>
Signed-off-by: wsalvin <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 78c5cd61577b370e47eaf8e8405c63fb3f5b8921
Author: Alan Stern <email address hidden>
Date: Thu Nov 3 11:37:10 2011 -0400
USB: XHCI: resume root hubs when the controller resumes
commit f69e3120df82391a0ee8118e0a156239a06b2afb upstream.
This patch (as1494) fixes a problem in xhci-hcd's resume routine.
When the controller is runtime-resumed, this can only mean that one of
the two root hubs has made a wakeup request and therefore needs to be
resumed as well. Rather than try to determine which root hub requires
attention (which might be difficult in the case where a new
non-SuperSpeed device has been plugged in), the patch simply resumes
both root hubs.
Without this change, there is a race: The controller might be put back
to sleep before it can activate its IRQ line, and the wakeup condition
might never get handled.
The patch also simplifies the logic in xhci_resume a little, combining
some repeated flag settings into a single pair of statements.
Signed-off-by: Alan Stern <email address hidden>
CC: Sarah Sharp <email address hidden>
Tested-by: Linus Torvalds <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 6b17329bbf8b902dcd1f5a0f94d43f902b72f682
Author: Don Zickus <email address hidden>
Date: Thu Oct 20 23:52:14 2011 -0400
usb, xhci: fix lockdep warning on endpoint timeout
commit f43d623164022dcbf6750ef220b7a1133a1183eb upstream.
While debugging a usb3 problem, I stumbled upon this lockdep warning.
Oct 18 21:41:17 dhcp47-74 kernel: =================================
Oct 18 21:41:17 dhcp47-74 kernel: [ INFO: inconsistent lock state ]
Oct 18 21:41:17 dhcp47-74 kernel: 3.1.0-rc4nmi+ #456
Oct 18 21:41:17 dhcp47-74 kernel: ---------------------------------
Oct 18 21:41:17 dhcp47-74 kernel: inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage.
Oct 18 21:41:17 dhcp47-74 kernel: swapper/0 [HC0[0]:SC1[1]:HE1:SE0] takes:
Oct 18 21:41:17 dhcp47-74 kernel: (&(&xhci->lock)->rlock){?.-...}, at: [<ffffffffa0228990>] xhci_stop_endpoint_command_watchdog+0x30/0x340 [xhci_hcd]
Oct 18 21:41:17 dhcp47-74 kernel: {IN-HARDIRQ-W} state was registered at:
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff8109a941>] __lock_acquire+0x781/0x1660
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff8109bed7>] lock_acquire+0x97/0x170
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff81501b46>] _raw_spin_lock+0x46/0x80
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffffa02299fa>] xhci_irq+0x3a/0x1960 [xhci_hcd]
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffffa022b351>] xhci_msi_irq+0x31/0x40 [xhci_hcd]
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff810d2305>] handle_irq_event_percpu+0x85/0x320
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff810d25e8>] handle_irq_event+0x48/0x70
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff810d537d>] handle_edge_irq+0x6d/0x130
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff810048c9>] handle_irq+0x49/0xa0
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff8150d56d>] do_IRQ+0x5d/0xe0
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff815029b0>] ret_from_intr+0x0/0x13
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff81388aca>] usb_set_device_state+0x8a/0x180
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff8138f038>] usb_add_hcd+0x2b8/0x730
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffffa022ed7e>] xhci_pci_probe+0x9e/0xd4 [xhci_hcd]
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff8127915f>] local_pci_probe+0x5f/0xd0
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff8127a569>] pci_device_probe+0x119/0x120
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff81334473>] driver_probe_device+0xa3/0x2c0
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff8133473b>] __driver_attach+0xab/0xb0
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff8133373c>] bus_for_each_dev+0x6c/0xa0
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff813341fe>] driver_attach+0x1e/0x20
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff81333b88>] bus_add_driver+0x1f8/0x2b0
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff81334df6>] driver_register+0x76/0x140
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff8127a7c6>] __pci_register_driver+0x66/0xe0
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffffa013c04a>] snd_timer_find+0x4a/0x70 [snd_timer]
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffffa013c00e>] snd_timer_find+0xe/0x70 [snd_timer]
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff810001d3>] do_one_initcall+0x43/0x180
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff810a9ed2>] sys_init_module+0x92/0x1f0
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff8150ab6b>] system_call_fastpath+0x16/0x1b
Oct 18 21:41:17 dhcp47-74 kernel: irq event stamp: 631984
Oct 18 21:41:17 dhcp47-74 kernel: hardirqs last enabled at (631984): [<ffffffff81502720>] _raw_spin_unlock_irq+0x30/0x50
Oct 18 21:41:17 dhcp47-74 kernel: hardirqs last disabled at (631983): [<ffffffff81501c49>] _raw_spin_lock_irq+0x19/0x90
Oct 18 21:41:17 dhcp47-74 kernel: softirqs last enabled at (631980): [<ffffffff8105ff63>] _local_bh_enable+0x13/0x20
Oct 18 21:41:17 dhcp47-74 kernel: softirqs last disabled at (631981): [<ffffffff8150ce6c>] call_softirq+0x1c/0x30
Oct 18 21:41:17 dhcp47-74 kernel:
Oct 18 21:41:17 dhcp47-74 kernel: other info that might help us debug this:
Oct 18 21:41:17 dhcp47-74 kernel: Possible unsafe locking scenario:
Oct 18 21:41:17 dhcp47-74 kernel:
Oct 18 21:41:17 dhcp47-74 kernel: CPU0
Oct 18 21:41:17 dhcp47-74 kernel: ----
Oct 18 21:41:17 dhcp47-74 kernel: lock(&(&xhci->lock)->rlock);
Oct 18 21:41:17 dhcp47-74 kernel: <Interrupt>
Oct 18 21:41:17 dhcp47-74 kernel: lock(&(&xhci->lock)->rlock);
Oct 18 21:41:17 dhcp47-74 kernel:
Oct 18 21:41:17 dhcp47-74 kernel: *** DEADLOCK ***
Oct 18 21:41:17 dhcp47-74 kernel:
Oct 18 21:41:17 dhcp47-74 kernel: 1 lock held by swapper/0:
Oct 18 21:41:17 dhcp47-74 kernel: #0: (&ep->stop_cmd_timer){+.-...}, at: [<ffffffff8106abf2>] run_timer_softirq+0x162/0x570
Oct 18 21:41:17 dhcp47-74 kernel:
Oct 18 21:41:17 dhcp47-74 kernel: stack backtrace:
Oct 18 21:41:17 dhcp47-74 kernel: Pid: 0, comm: swapper Tainted: G W 3.1.0-rc4nmi+ #456
Oct 18 21:41:17 dhcp47-74 kernel: Call Trace:
Oct 18 21:41:17 dhcp47-74 kernel: <IRQ> [<ffffffff81098ed7>] print_usage_bug+0x227/0x270
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff810999c6>] mark_lock+0x346/0x410
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff8109a7de>] __lock_acquire+0x61e/0x1660
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff81099893>] ? mark_lock+0x213/0x410
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff8109bed7>] lock_acquire+0x97/0x170
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffffa0228990>] ? xhci_stop_endpoint_command_watchdog+0x30/0x340 [xhci_hcd]
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff81501b46>] _raw_spin_lock+0x46/0x80
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffffa0228990>] ? xhci_stop_endpoint_command_watchdog+0x30/0x340 [xhci_hcd]
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffffa0228990>] xhci_stop_endpoint_command_watchdog+0x30/0x340 [xhci_hcd]
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff8106abf2>] ? run_timer_softirq+0x162/0x570
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff8106ac9d>] run_timer_softirq+0x20d/0x570
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff8106abf2>] ? run_timer_softirq+0x162/0x570
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffffa0228960>] ? xhci_queue_isoc_tx_prepare+0x8e0/0x8e0 [xhci_hcd]
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff810604d2>] __do_softirq+0xf2/0x3f0
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff81020edd>] ? lapic_next_event+0x1d/0x30
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff81090d4e>] ? clockevents_program_event+0x5e/0x90
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff8150ce6c>] call_softirq+0x1c/0x30
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff8100484d>] do_softirq+0x8d/0xc0
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff8105ff35>] irq_exit+0xe5/0x100
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff8150d65e>] smp_apic_timer_interrupt+0x6e/0x99
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff8150b6f0>] apic_timer_interrupt+0x70/0x80
Oct 18 21:41:17 dhcp47-74 kernel: <EOI> [<ffffffff81095d8d>] ? trace_hardirqs_off+0xd/0x10
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff812ddb76>] ? acpi_idle_enter_bm+0x227/0x25b
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff812ddb71>] ? acpi_idle_enter_bm+0x222/0x25b
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff813eda63>] cpuidle_idle_call+0x103/0x290
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff81002155>] cpu_idle+0xe5/0x160
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff814e7f50>] rest_init+0xe0/0xf0
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff814e7e70>] ? csum_partial_copy_generic+0x170/0x170
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff81df8e23>] start_kernel+0x3fc/0x407
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff81df8321>] x86_64_start_reservations+0x131/0x135
Oct 18 21:41:17 dhcp47-74 kernel: [<ffffffff81df8412>] x86_64_start_kernel+0xed/0xf4
Oct 18 21:41:17 dhcp47-74 kernel: xhci_hcd 0000:00:14.0: xHCI host not responding to stop endpoint command.
Oct 18 21:41:17 dhcp47-74 kernel: xhci_hcd 0000:00:14.0: Assuming host is dying, halting host.
Oct 18 21:41:17 dhcp47-74 kernel: xhci_hcd 0000:00:14.0: HC died; cleaning up
Oct 18 21:41:17 dhcp47-74 kernel: usb 3-4: device descriptor read/8, error -110
Oct 18 21:41:17 dhcp47-74 kernel: usb 3-4: device descriptor read/8, error -22
Oct 18 21:41:17 dhcp47-74 kernel: hub 3-0:1.0: cannot disable port 4 (err = -19)
Basically what is happening is in xhci_stop_endpoint_command_watchdog()
the xhci->lock is grabbed with just spin_lock. What lockdep deduces is
that if an interrupt occurred while in this function it would deadlock
with xhci_irq because that function also grabs the xhci->lock.
Fixing it is trivial by using spin_lock_irqsave instead.
This should be queued to stable kernels as far back as 2.6.33.
Signed-off-by: Don Zickus <email address hidden>
Signed-off-by: Sarah Sharp <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 88079a41ec43968a7be7d25f11de6d0ab3942b95
Author: Don Zickus <email address hidden>
Date: Thu Nov 3 09:07:18 2011 -0400
usb, xhci: Clear warm reset change event during init
commit 79c3dd8150fd5236d95766a9e662e3e932b462c9 upstream.
I noticed on my Panther Point system that I wasn't getting hotplug events
for my usb3.0 disk on a usb3 port. I tracked it down to the fact that the
system had the warm reset change bit still set. This seemed to block future
events from being received, including a hotplug event.
Clearing this bit during initialization allowed the hotplug event to be
received and the disk to be recognized correctly.
This patch should be backported to kernels as old as 2.6.39.
Signed-off-by: Don Zickus <email address hidden>
Signed-off-by: Sarah Sharp <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 4e2b692943de7392100f3e1463522366f810ae83
Author: Sarah Sharp <email address hidden>
Date: Thu Nov 3 13:06:08 2011 -0700
xhci: Set slot and ep0 flags for address command.
commit d31c285b3a71cf9056e6a060de41f37780b0af86 upstream.
Matt's AsMedia xHCI host controller was responding with a Context Error
to an address device command after a configured device reset. Some
sequence of events leads both the slot and endpoint zero add flags
cleared to zero, which the AsMedia host doesn't like:
[ 223.701839] xhci_hcd 0000:03:00.0: Slot ID 1 Input Context:
[ 223.701841] xhci_hcd 0000:03:00.0: @ffff880137b25000 (virt) @ffffc000 (dma) 0x000000 - drop flags
[ 223.701843] xhci_hcd 0000:03:00.0: @ffff880137b25004 (virt) @ffffc004 (dma) 0x000000 - add flags
[ 223.701846] xhci_hcd 0000:03:00.0: @ffff880137b25008 (virt) @ffffc008 (dma) 0x000000 - rsvd2[0]
[ 223.701848] xhci_hcd 0000:03:00.0: @ffff880137b2500c (virt) @ffffc00c (dma) 0x000000 - rsvd2[1]
[ 223.701850] xhci_hcd 0000:03:00.0: @ffff880137b25010 (virt) @ffffc010 (dma) 0x000000 - rsvd2[2]
[ 223.701852] xhci_hcd 0000:03:00.0: @ffff880137b25014 (virt) @ffffc014 (dma) 0x000000 - rsvd2[3]
[ 223.701854] xhci_hcd 0000:03:00.0: @ffff880137b25018 (virt) @ffffc018 (dma) 0x000000 - rsvd2[4]
[ 223.701857] xhci_hcd 0000:03:00.0: @ffff880137b2501c (virt) @ffffc01c (dma) 0x000000 - rsvd2[5]
[ 223.701858] xhci_hcd 0000:03:00.0: Slot Context:
[ 223.701860] xhci_hcd 0000:03:00.0: @ffff880137b25020 (virt) @ffffc020 (dma) 0x8400000 - dev_info
[ 223.701862] xhci_hcd 0000:03:00.0: @ffff880137b25024 (virt) @ffffc024 (dma) 0x010000 - dev_info2
[ 223.701864] xhci_hcd 0000:03:00.0: @ffff880137b25028 (virt) @ffffc028 (dma) 0x000000 - tt_info
[ 223.701866] xhci_hcd 0000:03:00.0: @ffff880137b2502c (virt) @ffffc02c (dma) 0x000000 - dev_state
[ 223.701869] xhci_hcd 0000:03:00.0: @ffff880137b25030 (virt) @ffffc030 (dma) 0x000000 - rsvd[0]
[ 223.701871] xhci_hcd 0000:03:00.0: @ffff880137b25034 (virt) @ffffc034 (dma) 0x000000 - rsvd[1]
[ 223.701873] xhci_hcd 0000:03:00.0: @ffff880137b25038 (virt) @ffffc038 (dma) 0x000000 - rsvd[2]
[ 223.701875] xhci_hcd 0000:03:00.0: @ffff880137b2503c (virt) @ffffc03c (dma) 0x000000 - rsvd[3]
[ 223.701877] xhci_hcd 0000:03:00.0: Endpoint 00 Context:
[ 223.701879] xhci_hcd 0000:03:00.0: @ffff880137b25040 (virt) @ffffc040 (dma) 0x000000 - ep_info
[ 223.701881] xhci_hcd 0000:03:00.0: @ffff880137b25044 (virt) @ffffc044 (dma) 0x2000026 - ep_info2
[ 223.701883] xhci_hcd 0000:03:00.0: @ffff880137b25048 (virt) @ffffc048 (dma) 0xffffe8e0 - deq
[ 223.701885] xhci_hcd 0000:03:00.0: @ffff880137b25050 (virt) @ffffc050 (dma) 0x000000 - tx_info
[ 223.701887] xhci_hcd 0000:03:00.0: @ffff880137b25054 (virt) @ffffc054 (dma) 0x000000 - rsvd[0]
[ 223.701889] xhci_hcd 0000:03:00.0: @ffff880137b25058 (virt) @ffffc058 (dma) 0x000000 - rsvd[1]
[ 223.701892] xhci_hcd 0000:03:00.0: @ffff880137b2505c (virt) @ffffc05c (dma) 0x000000 - rsvd[2]
...
[ 223.701927] xhci_hcd 0000:03:00.0: // Ding dong!
[ 223.701992] xhci_hcd 0000:03:00.0: Setup ERROR: address device command for slot 1.
The xHCI spec says that both flags must be set to one for the Address
Device command. When the device is first enumerated,
xhci_setup_addressable_virt_dev() does set those flags. However, when
the device is addressed after it has been reset in the configured state,
xhci_setup_addressable_virt_dev() is not called, and
xhci_copy_ep0_dequeue_into_input_ctx() is called instead. That function
relies on the flags being set up by previous commands, which apparently
isn't a good assumption.
Move the setting of the flags into the common parent function.
This should be queued for stable kernels as old as 2.6.35, since that
was the first introduction of xhci_copy_ep0_dequeue_into_input_ctx.
Signed-off-by: Sarah Sharp <email address hidden>
Tested-by: Matt <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 5bccc0d01594bef09e120a2fe3e1d48a1d74bcfe
Author: Claudio Scordino <email address hidden>
Date: Thu Nov 17 11:08:32 2011 +0100
drivers/base/node.c: fix compilation error with older versions of gcc
commit 91a13c281d7d4648c0b32dede11a0144c4e7984c upstream.
Patch to fix the error message "directives may not be used inside a macro
argument" which appears when the kernel is compiled for the cris architecture.
Signed-off-by: Claudio Scordino <email address hidden>
Acked-by: David Rientjes <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit c528b7244efaf55654b6a196234c1d3b43d29108
Author: Axel Lin <email address hidden>
Date: Mon Oct 31 10:20:28 2011 +0800
pcie-gadget-spear: Add "platform:" prefix for platform modalias
commit 161f14191dc166c4e3f37f68af1bc199c6868b7d upstream.
Since 43cc71eed1250755986da4c0f9898f9a635cb3bf (platform: prefix MODALIAS
with "platform:"), the platform modalias is prefixed with "platform:".
Signed-off-by: Axel Lin <email address hidden>
Acked-by: Pratyush Anand <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 46e18b7f722c2e4e9c4764774a2932debf35ece2
Author: Wu Fengguang <email address hidden>
Date: Tue Nov 22 16:58:35 2011 +0800
ALSA: hda - fix ELD memory leak
Backported from commit b95d68b8179764e29558b75cec35ef4a6a98925b.
memset(eld) clears eld->proc_entry which will leak the struct
snd_info_entry when unloading module.
Fix it by
- memset only the fields before eld->eld_buffer
- set eld->eld_valid to true _after_ all eld fields have been filled
Cc: Pierre-louis Bossart <email address hidden>
Acked-by: Stephen Warren <email address hidden>
Signed-off-by: Wu Fengguang <email address hidden>
Signed-off-by: Takashi Iwai <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 0d2c754e96311f4968e13d1f1744b7c2e2ad3442
Author: Jeff Layton <email address hidden>
Date: Fri Nov 4 13:31:21 2011 -0400
nfs: when attempting to open a directory, fall back on normal lookup (try #5)
commit 1788ea6e3b2a58cf4fb00206e362d9caff8d86a7 upstream.
commit d953126 changed how nfs_atomic_lookup handles an -EISDIR return
from an OPEN call. Prior to that patch, that caused the client to fall
back to doing a normal lookup. When that patch went in, the code began
returning that error to userspace. The d_revalidate codepath however
never had the corresponding change, so it was still possible to end up
with a NULL ctx->state pointer after that.
That patch caused a regression. When we attempt to open a directory that
does not have a cached dentry, that open now errors out with EISDIR. If
you attempt the same open with a cached dentry, it will succeed.
Fix this by reverting the change in nfs_atomic_lookup and allowing
attempts to open directories to fall back to a normal lookup
Also, add a NFSv4-specific f_ops->open routine that just returns
-ENOTDIR. This should never be called if things are working properly,
but if it ever is, then the dprintk may help in debugging.
To facilitate this, a new file_operations field is also added to the
nfs_rpc_ops struct.
Signed-off-by: Jeff Layton <email address hidden>
Signed-off-by: Trond Myklebust <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit e901cc458a35b928f240dd3c1e3a565bfb4efa90
Author: Jiri Slaby <email address hidden>
Date: Wed Nov 16 16:27:09 2011 +0100
TTY: ldisc, wait for ldisc infinitely in hangup
commit 0c73c08ec73dbe080b9ec56696ee21d32754d918 upstream.
For /dev/console case, we do not kill all ldisc users. It's due to
redirected_tty_write test in __tty_hangup. In that case there still
might be a process waiting e.g. in n_tty_read for input.
We wait for such processes to disappear. The problem is that we use a
timeout. After this timeout, we continue closing the ldisc and start
freeing tty resources. It obviously leads to crashes when the other
process is woken.
So to fix this, we wait infinitely before reiniting the ldisc. (The
tiocsetd remains untouched -- times out after 5s.)
This is nicely reproducible with this run from shell:
exec 0<>/dev/console 1<>/dev/console 2<>/dev/console
and stopping a getty like:
systemctl stop <email address hidden>
The crash proper may be produced only under load or with constified
timing the same as for 92f6fa09b.
Signed-off-by: Jiri Slaby <email address hidden>
Cc: Dave Young <email address hidden>
Cc: Dave Jones <email address hidden>
Cc: Ben Hutchings <email address hidden>
Cc: Dmitriy Matrosov <email address hidden>
Cc: Alan Cox <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit bb4006e04c27d6204da8b535be575d71c265875d
Author: Jiri Slaby <email address hidden>
Date: Wed Nov 16 16:27:08 2011 +0100
TTY: ldisc, move wait idle to caller
commit 300420722e0734a4254f3b634e0f82664495d210 upstream.
It is the only place where reinit is called from. And we really need
to wait for the old ldisc to go once. Actually this is the place where
the waiting originally was (before removed and re-added later).
This will make the fix in the following patch easier to implement.
Signed-off-by: Jiri Slaby <email address hidden>
Cc: Dave Young <email address hidden>
Cc: Dave Jones <email address hidden>
Cc: Ben Hutchings <email address hidden>
Cc: Dmitriy Matrosov <email address hidden>
Cc: Alan Cox <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit d21ada2ca367042fc5a1a11a2c2703e04c93211d
Author: Jiri Slaby <email address hidden>
Date: Wed Nov 16 16:27:07 2011 +0100
TTY: ldisc, allow waiting for ldisc arbitrarily long
commit df92d0561de364de53c42abc5d43e04ab6f326a5 upstream.
To fix a nasty bug in ldisc hup vs. reinit we need to wait infinitely
long for ldisc to be gone. So here we add a parameter to
tty_ldisc_wait_idle to allow that.
This is only a preparation for the real fix which is done in the
following patches.
Signed-off-by: Jiri Slaby <email address hidden>
Cc: Dave Young <email address hidden>
Cc: Dave Jones <email address hidden>
Cc: Ben Hutchings <email address hidden>
Cc: Dmitriy Matrosov <email address hidden>
Cc: Alan Cox <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 5a25cbde3ff3fafa1f48a00a37ed3fda278b5641
Author: Stephen Boyd <email address hidden>
Date: Tue Oct 25 19:19:43 2011 -0700
tty: hvc_dcc: Fix duplicate character inputs
commit c2a3e84f950e7ddba1f3914b005861d46ae60359 upstream.
Reading from the DCC grabs a character from the buffer and
clears the status bit. Since this is a context-changing
operation, instructions following the character read that rely on
the status bit being accurate need to be synchronized with an
ISB.
In this case, the status bit check needs to execute after the
character read otherwise we run the risk of reading the character
and checking the status bit before the read can clear the status
bit in the first place. When this happens, the user will see the
same character they typed twice, instead of once.
Add an ISB after the read and the write, so that the status check
is synchronized with the read/write operations.
Signed-off-by: Stephen Boyd <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 39e005fc9f29c3afc6eedb52cf02e7a3aec38c2f
Author: Tomoya MORINAGA <email address hidden>
Date: Fri Oct 28 09:38:49 2011 +0900
pch_uart: Support new device LAPIS Semiconductor ML7831 IOH
commit 8249f743f732ccbc3056428945ab1d9bd36d46bf upstream.
ML7831 is companion chip for Intel Atom E6xx series.
Signed-off-by: Tomoya MORINAGA <email address hidden>
Acked-by: Alan Cox <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 091fb7d008800a6e3d9831ace030af3370d3a307
Author: Tomoya MORINAGA <email address hidden>
Date: Fri Nov 11 10:55:27 2011 +0900
pch_uart: Fix DMA resource leak issue
commit 90f04c2926cfb5bf74533b0a7766bc896f6a0c0e upstream.
Changing UART mode PIO->DMA->PIO->DMA like below, pch_uart driver can't get
DMA channel resource.
setserial /dev/ttyPCH0 ^low_latency
setserial /dev/ttyPCH0 low_latency
CAUSE:
Changing mode using setserial command, ".startup" function which gets DMA
channel is called before ".verify_port" function which sets
dma-flag(use_dma/use_dma_flag) as 1.
PIO->DMA
.startup: Since dma-flag is 0, DMA channel is not requested.
.verify_port: dma-flag is set as 1.
.shutdown: N/A
DMA->PIO
.startup: Since dma-flag is 1, DMA channel is requested.
.verify_port: dma-flag is set as 0.
.shutdown: Since dma-flag is 0, DMA channel is not released.
This means DMA channel resource leak occurs.
Next time, this driver can't get DMA channel resource forever.
MODIFICATION:
Currently, when release DMA channel resource, this driver checks dma-flag.
However, this specification occurs the above issue.
This driver must check whether dma_request_channel is executed or not.
The values are saved in private data variable "chan_tx/chan_tx".
These variables mean if the value is NULL, DMA channel is not requested,
if not NULL, DMA channel is requested.
This patch fixes the issue.
Signed-off-by: Tomoya MORINAGA <email address hidden>
Acked-by: Alan Cox <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 81aaad2ca2193def671c16559a136b91d0d923f6
Author: Tomoya MORINAGA <email address hidden>
Date: Thu Oct 27 15:45:18 2011 +0900
pch_uart: Fix hw-flow control issue
commit a1d7cfe29f13cf45f8094929864b9c66bf0cd91b upstream.
Using hardware flow control,
currently, register of the control-bit(AFE) is not set.
This patch fixes the issue.
Signed-off-by: Tomoya MORINAGA <email address hidden>
Acked-by: Alan Cox <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 9b0c37ef53515e6b88be1fae31e3e951911365ca
Author: Tomoya MORINAGA <email address hidden>
Date: Fri Nov 11 10:12:18 2011 +0900
pch_phub: Fix MAC address writing issue for LAPIS ML7831
commit 2a9887919457c6e1bd482e8448223be59d19010a upstream.
ISSUE:
Using ML7831, MAC address writing doesn't work well.
CAUSE:
ML7831 and EG20T have the same register map for MAC address access.
However, this driver processes the writing the same as ML7223.
This is not true.
This driver must process the writing the same as EG20T.
This patch fixes the issue.
Signed-off-by: Tomoya MORINAGA <email address hidden>
Cc: Masayuki Ohtak <email address hidden>
Cc: Alexander Stein <email address hidden>
Cc: Denis Turischev <email address hidden>
Signed-off-by: Andrew Morton <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 94e595f0a54e30ea9622246faf8fd188f8868230
Author: Tomoya MORINAGA <email address hidden>
Date: Fri Oct 28 09:33:13 2011 +0900
pch_phub: Support new device LAPIS Semiconductor ML7831 IOH
commit 584ad00ce4bfe594e4c4a89944b3c635187a1ca1 upstream.
ML7831 is companion chip for Intel Atom E6xx series.
Signed-off-by: Tomoya MORINAGA <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit a896cd19d7569c9754a75fea01f4c68e355697af
Author: Peter Chen <email address hidden>
Date: Tue Nov 15 21:52:29 2011 +0100
PM / driver core: disable device's runtime PM during shutdown
commit af8db1508f2c9f3b6e633e2d2d906c6557c617f9 upstream.
There may be an issue when the user issue "reboot/shutdown" command, then
the device has shut down its hardware, after that, this runtime-pm featured
device's driver will probably be scheduled to do its suspend routine,
and at its suspend routine, it may access hardware, but the device has
already shutdown physically, then the system hang may be occurred.
I ran out this issue using an auto-suspend supported USB devices, like
3G modem, keyboard. The usb runtime suspend routine may be scheduled
after the usb controller has been shut down, and the usb runtime suspend
routine will try to suspend its roothub(controller), it will access
register, then the system hang occurs as the controller is shutdown.
Signed-off-by: Peter Chen <email address hidden>
Acked-by: Ming Lei <email address hidden>
Acked-by: Greg Kroah-Hartman <email address hidden>
Signed-off-by: Rafael J. Wysocki <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 268cd0526224188d8d36b7071e0630ae145e88bc
Author: Josh Boyer <email address hidden>
Date: Thu Nov 10 15:10:23 2011 +0000
ip6_tunnel: copy parms.name after register_netdevice
commit 731abb9cb27aef6013ce60808a04e04a545f3f4e upstream.
Commit 1c5cae815d removed an explicit call to dev_alloc_name in ip6_tnl_create
because register_netdevice will now create a valid name. This works for the
net_device itself.
However the tunnel keeps a copy of the name in the parms structure for the
ip6_tnl associated with the tunnel. parms.name is set by copying the net_device
name in ip6_tnl_dev_init_gen. That function is called from ip6_tnl_dev_init in
ip6_tnl_create, but it is done before register_netdevice is called so the name
is set to a bogus value in the parms.name structure.
This shows up if you do a simple tunnel add, followed by a tunnel show:
[root@localhost ~]# ip -6 tunnel add remote fec0::100 local fec0::200
[root@localhost ~]# ip -6 tunnel show
ip6tnl0: ipv6/ipv6 remote :: local :: encaplimit 0 hoplimit 0 tclass 0x00 flowlabel 0x00000 (flowinfo 0x00000000)
ip6tnl%d: ipv6/ipv6 remote fec0::100 local fec0::200 encaplimit 4 hoplimit 64 tclass 0x00 flowlabel 0x00000 (flowinfo 0x00000000)
[root@localhost ~]#
Fix this by moving the strcpy out of ip6_tnl_dev_init_gen, and calling it after
register_netdevice has successfully returned.
Signed-off-by: Josh Boyer <email address hidden>
Signed-off-by: David S. Miller <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 1d8fdb8410ef5aca16ddf01c1176358c9154bcfa
Author: Luis R. Rodriguez <email address hidden>
Date: Tue Nov 8 14:28:06 2011 -0800
cfg80211: fix bug on regulatory core exit on access to last_request
commit 58ebacc66bd11be2327edcefc79de94bd6f5bb4a upstream.
Commit 4d9d88d1 by Scott James Remnant <email address hidden> added
the .uevent() callback for the regulatory device used during
the platform device registration. The change was done to account
for queuing up udev change requests through udevadm triggers.
The change also meant that upon regulatory core exit we will now
send a uevent() but the uevent() callback, reg_device_uevent(),
also accessed last_request. Right before commiting device suicide
we free'd last_request but never set it to NULL so
platform_device_unregister() would lead to bogus kernel paging
request. Fix this and also simply supress uevents right before
we commit suicide as they are pointless.
This fix is required for kernels >= v2.6.39
$ git describe --contains 4d9d88d1
v2.6.39-rc1~468^2~25^2^2~21
The impact of not having this present is that a bogus paging
access may occur (only read) upon cfg80211 unload time. You
may also get this BUG complaint below. Although Johannes
could not reproduce the issue this fix is theoretically correct.
mac80211_hwsim: unregister radios
mac80211_hwsim: closing netlink
BUG: unable to handle kernel paging request at ffff88001a06b5ab
IP: [<ffffffffa030df9a>] reg_device_uevent+0x1a/0x50 [cfg80211]
PGD 1836063 PUD 183a063 PMD 1ffcb067 PTE 1a06b160
Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
CPU 0
Modules linked in: cfg80211(-) [last unloaded: mac80211]
Pid: 2279, comm: rmmod Tainted: G W 3.1.0-wl+ #663 Bochs Bochs
RIP: 0010:[<ffffffffa030df9a>] [<ffffffffa030df9a>] reg_device_uevent+0x1a/0x50 [cfg80211]
RSP: 0000:ffff88001c5f9d58 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff88001d2eda88 RCX: ffff88001c7468fc
RDX: ffff88001a06b5a0 RSI: ffff88001c7467b0 RDI: ffff88001c7467b0
RBP: ffff88001c5f9d58 R08: 000000000000ffff R09: 000000000000ffff
R10: 0000000000000000 R11: 0000000000000001 R12: ffff88001c7467b0
R13: ffff88001d2eda78 R14: ffffffff8164a840 R15: 0000000000000001
FS: 00007f8a91d8a6e0(0000) GS:ffff88001fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: ffff88001a06b5ab CR3: 000000001c62e000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process rmmod (pid: 2279, threadinfo ffff88001c5f8000, task ffff88000023c780)
Stack:
ffff88001c5f9d98 ffffffff812ff7e5 ffffffff8176ab3d ffff88001c7468c2
000000000000ffff ffff88001d2eda88 ffff88001c7467b0 ffff880000114820
ffff88001c5f9e38 ffffffff81241dc7 ffff88001c5f9db8 ffffffff81040189
Call Trace:
[<ffffffff812ff7e5>] dev_uevent+0xc5/0x170
[<ffffffff81241dc7>] kobject_uevent_env+0x1f7/0x490
[<ffffffff81040189>] ? sub_preempt_count+0x29/0x60
[<ffffffff814cab1a>] ? _raw_spin_unlock_irqrestore+0x4a/0x90
[<ffffffff81305307>] ? devres_release_all+0x27/0x60
[<ffffffff8124206b>] kobject_uevent+0xb/0x10
[<ffffffff812fee27>] device_del+0x157/0x1b0
[<ffffffff8130377d>] platform_device_del+0x1d/0x90
[<ffffffff81303b76>] platform_device_unregister+0x16/0x30
[<ffffffffa030fffd>] regulatory_exit+0x5d/0x180 [cfg80211]
[<ffffffffa032bec3>] cfg80211_exit+0x2b/0x45 [cfg80211]
[<ffffffff8109a84c>] sys_delete_module+0x16c/0x220
[<ffffffff8108a23e>] ? trace_hardirqs_on_caller+0x7e/0x120
[<ffffffff814cba02>] system_call_fastpath+0x16/0x1b
Code: <all your base are belong to me>
RIP [<ffffffffa030df9a>] reg_device_uevent+0x1a/0x50 [cfg80211]
RSP <ffff88001c5f9d58>
CR2: ffff88001a06b5ab
---[ end trace 147c5099a411e8c0 ]---
Reported-by: Johannes Berg <email address hidden>
Cc: Scott James Remnant <email address hidden>
Signed-off-by: Luis R. Rodriguez <email address hidden>
Signed-off-by: John W. Linville <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 2ebd38f358b941add49441bad15cb75217a0f08b
Author: Johannes Berg <email address hidden>
Date: Thu Nov 3 09:27:01 2011 +0100
nl80211: fix HT capability attribute validation
commit 6c7394197af90f6a332180e33f5d025d3037d883 upstream.
Since the NL80211_ATTR_HT_CAPABILITY attribute is
used as a struct, it needs a minimum, not maximum
length. Enforce that properly. Not doing so could
potentially lead to reading after the buffer.
Signed-off-by: Johannes Berg <email address hidden>
Signed-off-by: John W. Linville <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 76ba12ddde1d6d4694f6b887d960bb69d338cadf
Author: Johannes Berg <email address hidden>
Date: Tue Nov 8 13:04:41 2011 +0100
mac80211: fix bug in ieee80211_build_probe_req
commit 5b2bbf75a24d6b06afff6de0eb4819413fd81971 upstream.
ieee80211_probereq_get() can return NULL in
which case we should clean up & return NULL
in ieee80211_build_probe_req() as well.
Signed-off-by: Johannes Berg <email address hidden>
Signed-off-by: John W. Linville <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 4a4d69f0ec7cf7afdcc4346cf6bc8d3835358df8
Author: Johannes Berg <email address hidden>
Date: Tue Nov 8 12:28:33 2011 +0100
mac80211: fix NULL dereference in radiotap code
commit f8d1ccf15568268c76f913b45ecdd33134387f1a upstream.
When receiving failed PLCP frames is enabled, there
won't be a rate pointer when we add the radiotap
header and thus the kernel will crash. Fix this by
not assuming the rate pointer is always valid. It's
still always valid for frames that have good PLCP
though, and that is checked & enforced.
This was broken by my
commit fc88518916793af8ad6a02e05ff254d95c36d875
Author: Johannes Berg <email address hidden>
Date: Fri Jul 30 13:23:12 2010 +0200
mac80211: don't check rates on PLCP error frames
where I removed the check in this case but didn't
take into account that the rate info would be used.
Reported-by: Xiaokang Qin <email address hidden>
Signed-off-by: Johannes Berg <email address hidden>
Signed-off-by: John W. Linville <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 7aa8983f0b2c57c25de227909072fe4f8edaa9ad
Author: Gertjan van Wingerde <email address hidden>
Date: Sat Nov 12 19:10:44 2011 +0100
rt2x00: Fix sleep-while-atomic bug in powersaving code.
commit ed66ba472a742cd8df37d7072804b2111cdb1014 upstream.
The generic powersaving code that determines after reception of a frame
whether the device should go back to sleep or whether is could stay
awake was calling rt2x00lib_config directly from RX tasklet context.
On a number of the devices this call can actually sleep, due to having
to confirm that the sleeping commands have been executed successfully.
Fix this by moving the call to rt2x00lib_config to a workqueue call.
This fixes bug https://bugzilla.redhat.com/show_bug.cgi?id=731672
Tested-by: Tomas Trnka <email address hidden>
Signed-off-by: Gertjan van Wingerde <email address hidden>
Acked-by: Ivo van Doorn <email address hidden>
Signed-off-by: John W. Linville <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit b426a8365ad707b0f700923a5c464c3b7fed234a
Author: Jesper Juhl <email address hidden>
Date: Sun Nov 13 22:14:32 2011 +0100
Net, libertas: Resolve memory leak in if_spi_host_to_card()
commit fe09b32a4361bea44169b2063e8c867cabb6a8ba upstream.
If we hit the default case in the switch in if_spi_host_to_card() we'll leak
the memory we allocated for 'packet'. This patch resolves the leak by freeing
the allocated memory in that case.
Signed-off-by: Jesper Juhl <email address hidden>
Acked-by: Dan Williams <email address hidden>
Signed-off-by: John W. Linville <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 92fd7a89888fc223337fe5fd5dc83b79e1174340
Author: Catalin Marinas <email address hidden>
Date: Mon Nov 7 18:05:53 2011 +0100
ARM: 7150/1: Allow kernel unaligned accesses on ARMv6+ processors
commit 8428e84d42179c2a00f5f6450866e70d802d1d05 upstream.
Recent gcc versions generate unaligned accesses by default on ARMv6 and
later processors. This patch ensures that the SCTLR.A bit is always
cleared on such processors to avoid kernel traping before
alignment_init() is called.
Signed-off-by: Catalin Marinas <email address hidden>
Tested-by: John Linn <email address hidden>
Acked-by: Nicolas Pitre <email address hidden>
Signed-off-by: Russell King <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 57a3b9c22b828434d282b6f7a29d39a65d964b49
Author: Cornelia Huck <email address hidden>
Date: Thu Nov 17 11:00:41 2011 +0100
KVM: s390: Fix RUNNING flag misinterpretation
commit 9e6dabeffd1d0ec2aa19aa076c4886067238d442 upstream.
CPUSTAT_RUNNING was implemented signifying that a vcpu is not stopped.
This is not, however, what the architecture says: RUNNING should be
set when the host is acting on the behalf of the guest operating
system.
CPUSTAT_RUNNING has been changed to be set in kvm_arch_vcpu_load()
and to be unset in kvm_arch_vcpu_put().
For signifying stopped state of a vcpu, a host-controlled bit has
been used and is set/unset basically on the reverse as the old
CPUSTAT_RUNNING bit (including pushing it down into stop handling
proper in handle_stop()).
Signed-off-by: Cornelia Huck <email address hidden>
Signed-off-by: Carsten Otte <email address hidden>
Signed-off-by: Avi Kivity <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 97e14e742aa276048fa3b5456abec665799e25c0
Author: Tony Jago <email address hidden>
Date: Fri Aug 12 00:19:11 2011 -0300
saa7164: Add support for another HVR2200 hardware revision
commit 62dd28d0c659db29bdb89cfe9f0aefe42f0adfe9 upstream.
Hauppauge have released a new model rev, sub id 8940, this adds
support.
[<email address hidden>: I modified Tony's patch slightly in relation to the
card numbering in saa7164.h, appending rather than inserting the new card
- normal practise]
Signed-off-by: Tony Jago <email address hidden>
Signed-off-by: Steven Toth <email address hidden>
Signed-off-by: Mauro Carvalho Chehab <email address hidden>
Signed-off-by: Stefan Bader <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 49d1df8852cb97340c7b0fa31f4aa9be6ec8b759
Author: Vasily Averin <email address hidden>
Date: Fri Nov 11 13:42:16 2011 +0400
aacraid: controller hangs if kernel uses non-default ASPM policy
commit cf16123c9c8e346ed1dd171295a678d77648d7f8 upstream.
Aacraid controller can hang on some nodes if kernel uses non-default
(powersave) ASPM policy. Controller hangs shortly after successful load and
hardware detection. Scsi error handler detects this hang and tries to restart
hardware but it does not help.
Initially it was noticed on RHEL6-based openVZ kernel after backporting
aacraid driver from mainline (RHEL6 kernel with original driver works well)
http://bugzilla.openvz.org/show_bug.cgi?id=2043
This issue happens because default ASPM policy was changed in Red Hat
kernels. Therefore guys from Red Hat have noticed this problem long time ago:
on Fedora 12
https://bugzilla.redhat.com/show_bug.cgi?id=540478
on Fedora 14
https://bugzilla.redhat.com/show_bug.cgi?id=679385
In RHEL6 kernel this issue was fixed, ASPM was disabled in aacraid driver. In
kernel changelog I've found that seems it was done by Matthew Garrett: -
[scsi] aacraid: Disable ASPM by default (Matthew Garrett) [599735]
However seems this patch was not submitted to mainline. I've reproduced this
issue on vanilla 3.1.0 kernel booted with "pcie_aspm.policy=powersave" option,
So I believe it makes sense to do it now.
Signed-off-by: Vasily Averin <email address hidden>
[mjg: Checking the Windows drivers indicates that they disable ASPM under all
circumstances, so:]
Acked-by: Matthew Garrett <email address hidden>
Acked-by: Achim Leubner <email address hidden>
Signed-off-by: James Bottomley <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 611397f62fe6879f675587e62aa44b5a2a251569
Author: Matthew Garrett <email address hidden>
Date: Fri Nov 11 11:14:23 2011 -0500
hpsa: Disable ASPM
commit e5a44df85e8d78e5c2d3d2e4f59b460905691e2f upstream.
The Windows driver .inf disables ASPM on hpsa devices. Do the same because the
selection of a non default ASPM policy can cause the device to hang.
Signed-off-by: Matthew Garrett <email address hidden>
Acked-by: Mike Miller <email address hidden>
Signed-off-by: James Bottomley <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit bf6f111b5e891b4cfbd4f966488fd824543ba2aa
Author: James Bottomley <email address hidden>
Date: Mon Nov 7 08:51:24 2011 -0600
fix WARNING: at drivers/scsi/scsi_lib.c:1704
commit 4e6c82b3614a18740ef63109d58743a359266daf upstream.
On Mon, 2011-11-07 at 17:24 +1100, Stephen Rothwell wrote:
> Hi all,
>
> Starting some time last week I am getting the following during boot on
> our PPC970 blade:
>
> calling .ipr_init+0x0/0x68 @ 1
> ipr: IBM Power RAID SCSI Device Driver version: 2.5.2 (April 27, 2011)
> ipr 0000:01:01.0: Found IOA with IRQ: 26
> ipr 0000:01:01.0: Starting IOA initialization sequence.
> ipr 0000:01:01.0: Adapter firmware version: 06160039
> ipr 0000:01:01.0: IOA initialized.
> scsi0 : IBM 572E Storage Adapter
> ------------[ cut here ]------------
> WARNING: at drivers/scsi/scsi_lib.c:1704
> Modules linked in:
> NIP: c00000000053b3d4 LR: c00000000053e5b0 CTR: c000000000541d70
> REGS: c0000000783c2f60 TRAP: 0700 Not tainted (3.1.0-autokern1)
> MSR: 8000000000029032 <EE,ME,CE,IR,DR> CR: 24002024 XER: 20000002
> TASK = c0000000783b8000[1] 'swapper' THREAD: c0000000783c0000 CPU: 0
> GPR00: 0000000000000001 c0000000783c31e0 c000000000cf38b0 c00000000239a9d0
> GPR04: c000000000cbe8f8 0000000000000000 c0000000783c3040 0000000000000000
> GPR08: c000000075daf488 c000000078a3b7ff c000000000bcacc8 0000000000000000
> GPR12: 0000000044002028 c000000007ffb000 0000000002e40000 000000000099b800
> GPR16: 0000000000000000 c000000000bba5fc c000000000a61db8 0000000000000000
> GPR20: 0000000001b77200 0000000000000000 c000000078990000 0000000000000001
> GPR24: c000000002396828 0000000000000000 0000000000000000 c000000078a3b938
> GPR28: fffffffffffffffa c0000000008ad2c0 c000000000c7faa8 c00000000239a9d0
> NIP [c00000000053b3d4] .scsi_free_queue+0x24/0x90
> LR [c00000000053e5b0] .scsi_alloc_sdev+0x280/0x2e0
> Call Trace:
> [c0000000783c31e0] [c000000000c7faa8] wireless_seq_fops+0x278d0/0x2eb88 (unreliable)
> [c0000000783c3270] [c00000000053e5b0] .scsi_alloc_sdev+0x280/0x2e0
> [c0000000783c3330] [c00000000053eba0] .scsi_probe_and_add_lun+0x390/0xb40
> [c0000000783c34a0] [c00000000053f7ec] .__scsi_scan_target+0x16c/0x650
> [c0000000783c35f0] [c00000000053fd90] .scsi_scan_channel+0xc0/0x100
> [c0000000783c36a0] [c00000000053fefc] .scsi_scan_host_selected+0x12c/0x1c0
> [c0000000783c3750] [c00000000083dcb4] .ipr_probe+0x2c0/0x390
> [c0000000783c3830] [c0000000003f50b4] .local_pci_probe+0x34/0x50
> [c0000000783c38a0] [c0000000003f5f78] .pci_device_probe+0x148/0x150
> [c0000000783c3950] [c0000000004e1e8c] .driver_probe_device+0xdc/0x210
> [c0000000783c39f0] [c0000000004e20cc] .__driver_attach+0x10c/0x110
> [c0000000783c3a80] [c0000000004e1228] .bus_for_each_dev+0x98/0xf0
> [c0000000783c3b30] [c0000000004e1bf8] .driver_attach+0x28/0x40
> [c0000000783c3bb0] [c0000000004e07d8] .bus_add_driver+0x218/0x340
> [c0000000783c3c60] [c0000000004e2a2c] .driver_register+0x9c/0x1b0
> [c0000000783c3d00] [c0000000003f62d4] .__pci_register_driver+0x64/0x140
> [c0000000783c3da0] [c000000000b99f88] .ipr_init+0x4c/0x68
> [c0000000783c3e20] [c00000000000ad24] .do_one_initcall+0x1a4/0x1e0
> [c0000000783c3ee0] [c000000000b512d0] .kernel_init+0x14c/0x1fc
> [c0000000783c3f90] [c000000000022468] .kernel_thread+0x54/0x70
> Instruction dump:
> ebe1fff8 7c0803a6 4e800020 7c0802a6 fba1ffe8 fbe1fff8 7c7f1b78 f8010010
> f821ff71 e8030398 3120ffff 7c090110 <0b000000> e86303b0 482de065 60000000
> ---[ end trace 759bed76a85e8dec ]---
> scsi 0:0:1:0: Direct-Access IBM-ESXS MAY2036RC T106 PQ: 0 ANSI: 5
> ------------[ cut here ]------------
>
> I get lots more of these. The obvious commit to point the finger at
> is 3308511c93e6 ("[SCSI] Make scsi_free_queue() kill pending SCSI
> commands") but the root cause may be something different.
Caused by
commit f7c9c6bb14f3104608a3a83cadea10a6943d2804
Author: Anton Blanchard <email address hidden>
Date: Thu Nov 3 08:56:22 2011 +1100
[SCSI] Fix block queue and elevator memory leak in scsi_alloc_sdev
Doesn't completely do the teardown. The true fix is to do a proper
teardown instead of hand rolling it
Reported-by: Stephen Rothwell <email address hidden>
Tested-by: Stephen Rothwell <email address hidden>
Signed-off-by: James Bottomley <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit ea054a92dcd97d4f26694f7535912fc82bf0e7a9
Author: Takashi Iwai <email address hidden>
Date: Wed Nov 16 18:05:11 2011 +0100
ALSA: hda - Fix the connection selection of ADCs on Cirrus codecs
commit 05ee7964a470d29889ac48cc8274c1b5a1904a11 upstream.
spec->cur_adc isn't set until cs_capture_pcm_prepare() is called although
the driver tries to select the connection at init time and at auto-mic
switch. This results in the access to the widget NID 0, which is
obviously invalid, also a wrong capture source.
This patch fixes the issue by issuing the connect-select verb conditionally
at appropriate places.
Reported-and-tested-by: Dylan Reid <email address hidden>
Signed-off-by: Takashi Iwai <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit d6b8bd1b2d0950cd59f52d260bc7e97b04600b94
Author: Edward Donovan <email address hidden>
Date: Tue Nov 1 15:29:44 2011 -0400
genirq: Fix irqfixup, irqpoll regression
commit c75d720fca8a91ce99196d33adea383621027bf2 upstream.
commit d05c65fff0 ("genirq: spurious: Run only one poller at a time")
introduced a regression, leaving the boot options 'irqfixup' and
'irqpoll' non-functional. The patch placed tests in each function, to
exit if the function is already running. The test in 'misrouted_irq'
exited when it should have proceeded, effectively disabling
'misrouted_irq' and 'poll_spurious_irqs'.
The check for an already running poller needs to be "!= 1" not "== 1"
as "1" is the value when the first poller starts running.
Signed-off-by: Edward Donovan <email address hidden>
Cc: <email address hidden>
Link: http://lkml<email address hidden>
Signed-off-by: Thomas Gleixner <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit a6253934bbe858fca204c0b41fa9cddb6f80ab2d
Author: Greg Kroah-Hartman <email address hidden>
Date: Mon Nov 21 14:47:46 2011 -0800
Linux 3.1.2
commit 742b42b9e87b64b2d2b54826dd3761897e71502d
Author: Ben Hutchings <email address hidden>
Date: Sun Nov 13 19:58:09 2011 +0100
block: Always check length of all iov entries in blk_rq_map_user_iov()
commit 6b76106d8ef31111d6fc469564b83b5f5542794f upstream.
Even after commit 5478755616ae2ef1ce144dded589b62b2a50d575
("block: check for proper length of iov entries earlier ...")
we still won't check for zero-length entries after an unaligned
entry. Remove the break-statement, so all entries are checked.
Signed-off-by: Ben Hutchings <email address hidden>
Signed-off-by: Jens Axboe <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 5831e11b2e21372bf384ecc9ee3398fe5b8eaf6a
Author: Rabin Vincent <email address hidden>
Date: Fri Nov 11 13:29:04 2011 +0100
backing-dev: ensure wakeup_timer is deleted
commit 7a401a972df8e184b3d1a3fc958c0a4ddee8d312 upstream.
bdi_prune_sb() in bdi_unregister() attempts to removes the bdi links
from all super_blocks and then del_timer_sync() the writeback timer.
However, this can race with __mark_inode_dirty(), leading to
bdi_wakeup_thread_delayed() rearming the writeback timer on the bdi
we're unregistering, after we've called del_timer_sync().
This can end up with the bdi being freed with an active timer inside it,
as in the case of the following dump after the removal of an SD card.
Fix this by redoing the del_timer_sync() in bdi_destory().
------------[ cut here ]------------
WARNING: at /home/rabin/kernel/arm/lib/debugobjects.c:262 debug_print_object+0x9c/0xc8()
ODEBUG: free active (active state 0) object type: timer_list hint: wakeup_timer_fn+0x0/0x180
Modules linked in:
Backtrace:
[<c00109dc>] (dump_backtrace+0x0/0x110) from [<c0236e4c>] (dump_stack+0x18/0x1c)
r6:c02bc638 r5:00000106 r4:c79f5d18 r3:00000000
[<c0236e34>] (dump_stack+0x0/0x1c) from [<c0025e6c>] (warn_slowpath_common+0x54/0x6c)
[<c0025e18>] (warn_slowpath_common+0x0/0x6c) from [<c0025f28>] (warn_slowpath_fmt+0x38/0x40)
r8:20000013 r7:c780c6f0 r6:c031613c r5:c780c6f0 r4:c02b1b29
r3:00000009
[<c0025ef0>] (warn_slowpath_fmt+0x0/0x40) from [<c015eb4c>] (debug_print_object+0x9c/0xc8)
r3:c02b1b29 r2:c02bc662
[<c015eab0>] (debug_print_object+0x0/0xc8) from [<c015f574>] (debug_check_no_obj_freed+0xac/0x1dc)
r6:c7964000 r5:00000001 r4:c7964000
[<c015f4c8>] (debug_check_no_obj_freed+0x0/0x1dc) from [<c00a9e38>] (kmem_cache_free+0x88/0x1f8)
[<c00a9db0>] (kmem_cache_free+0x0/0x1f8) from [<c014286c>] (blk_release_queue+0x70/0x78)
[<c01427fc>] (blk_release_queue+0x0/0x78) from [<c015290c>] (kobject_release+0x70/0x84)
r5:c79641f0 r4:c796420c
[<c015289c>] (kobject_release+0x0/0x84) from [<c0153ce4>] (kref_put+0x68/0x80)
r7:00000083 r6:c74083d0 r5:c015289c r4:c796420c
[<c0153c7c>] (kref_put+0x0/0x80) from [<c01527d0>] (kobject_put+0x48/0x5c)
r5:c79643b4 r4:c79641f0
[<c0152788>] (kobject_put+0x0/0x5c) from [<c013ddd8>] (blk_cleanup_queue+0x68/0x74)
r4:c7964000
[<c013dd70>] (blk_cleanup_queue+0x0/0x74) from [<c01a6370>] (mmc_blk_put+0x78/0xe8)
r5:00000000 r4:c794c400
[<c01a62f8>] (mmc_blk_put+0x0/0xe8) from [<c01a64b4>] (mmc_blk_release+0x24/0x38)
r5:c794c400 r4:c0322824
[<c01a6490>] (mmc_blk_release+0x0/0x38) from [<c00de11c>] (__blkdev_put+0xe8/0x170)
r5:c78d5e00 r4:c74083c0
[<c00de034>] (__blkdev_put+0x0/0x170) from [<c00de2c0>] (blkdev_put+0x11c/0x12c)
r8:c79f5f70 r7:00000001 r6:c74083d0 r5:00000083 r4:c74083c0
r3:00000000
[<c00de1a4>] (blkdev_put+0x0/0x12c) from [<c00b0724>] (kill_block_super+0x60/0x6c)
r7:c7942300 r6:c79f4000 r5:00000083 r4:c74083c0
[<c00b06c4>] (kill_block_super+0x0/0x6c) from [<c00b0a94>] (deactivate_locked_super+0x44/0x70)
r6:c79f4000 r5:c031af64 r4:c794dc00 r3:c00b06c4
[<c00b0a50>] (deactivate_locked_super+0x0/0x70) from [<c00b1358>] (deactivate_super+0x6c/0x70)
r5:c794dc00 r4:c794dc00
[<c00b12ec>] (deactivate_super+0x0/0x70) from [<c00c88b0>] (mntput_no_expire+0x188/0x194)
r5:c794dc00 r4:c7942300
[<c00c8728>] (mntput_no_expire+0x0/0x194) from [<c00c95e0>] (sys_umount+0x2e4/0x310)
r6:c7942300 r5:00000000 r4:00000000 r3:00000000
[<c00c92fc>] (sys_umount+0x0/0x310) from [<c000d940>] (ret_fast_syscall+0x0/0x30)
---[ end trace e5c83c92ada51c76 ]---
Signed-off-by: Rabin Vincent <email address hidden>
Signed-off-by: Linus Walleij <email address hidden>
Signed-off-by: Jens Axboe <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 3549966c02c99f02ac0dd74364a4e795296d6d7e
Author: Anton Blanchard <email address hidden>
Date: Mon Nov 14 12:54:47 2011 +0000
powerpc: Copy down exception vectors after feature fixups
commit d715e433b7ad19c02fc4becf0d5e9a59f97925de upstream.
kdump fails because we try to execute an HV only instruction. Feature
fixups are being applied after we copy the exception vectors down to 0
so they miss out on any updates.
We have always had this issue but it only became critical in v3.0
when we added CFAR support (breaks POWER5) and v3.1 when we added
POWERNV (breaks everyone).
Signed-off-by: Anton Blanchard <email address hidden>
Signed-off-by: Benjamin Herrenschmidt <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit fed595473900bb9cdaf88cb56eb01b07f771f14f
Author: Michael Neuling <email address hidden>
Date: Wed Nov 9 20:39:49 2011 +0000
powerpc: Add hvcall.h include to book3s_hv.c
commit de1d9248eadd27539eba449b4d09428252e80c04 upstream.
If you build with KVM and UP it fails with the following due to a
missing include.
/arch/powerpc/kvm/book3s_hv.c: In function 'do_h_register_vpa':
arch/powerpc/kvm/book3s_hv.c:156:10: error: 'H_PARAMETER' undeclared (first use in this function)
arch/powerpc/kvm/book3s_hv.c:156:10: note: each undeclared identifier is reported only once for each function it appears in
arch/powerpc/kvm/book3s_hv.c:192:12: error: 'H_RESOURCE' undeclared (first use in this function)
arch/powerpc/kvm/book3s_hv.c:222:9: error: 'H_SUCCESS' undeclared (first use in this function)
arch/powerpc/kvm/book3s_hv.c: In function 'kvmppc_pseries_do_hcall':
arch/powerpc/kvm/book3s_hv.c:228:30: error: 'H_SUCCESS' undeclared (first use in this function)
arch/powerpc/kvm/book3s_hv.c:232:7: error: 'H_CEDE' undeclared (first use in this function)
arch/powerpc/kvm/book3s_hv.c:234:7: error: 'H_PROD' undeclared (first use in this function)
arch/powerpc/kvm/book3s_hv.c:238:10: error: 'H_PARAMETER' undeclared (first use in this function)
arch/powerpc/kvm/book3s_hv.c:250:7: error: 'H_CONFER' undeclared (first use in this function)
arch/powerpc/kvm/book3s_hv.c:252:7: error: 'H_REGISTER_VPA' undeclared (first use in this function)
make[2]: *** [arch/powerpc/kvm/book3s_hv.o] Error 1
Signed-off-by: Michael Neuling <email address hidden>
Signed-off-by: Benjamin Herrenschmidt <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 9c24bb2008643ecd7588a20fd5ac7e8491f7c5d4
Author: Geoff Levand <email address hidden>
Date: Tue Nov 8 12:37:26 2011 +0000
powerpc/ps3: Fix lost SMP IPIs
commit 72f3bea075287785ed32b777b6dd2636aa7002e8 upstream.
Fixes the PS3 bootup hang introduced in 3.0-rc1 by:
commit 317f394160e9beb97d19a84c39b7e5eb3d7815a
sched: Move the second half of ttwu() to the remote cpu
Move the PS3's LV1 EOI call lv1_end_of_interrupt_ext() from ps3_chip_eoi()
to ps3_get_irq() for IPI messages.
If lv1_send_event_locally() is called between a previous call to
lv1_send_event_locally() and the coresponding call to
lv1_end_of_interrupt_ext() the second event will not be delivered to the
target cpu.
The PS3's SMP IPIs are implemented using lv1_send_event_locally(), so if two
IPI messages of the same type are sent to the same target in a relatively
short period of time the second IPI event can become lost when
lv1_end_of_interrupt_ext() is called from ps3_chip_eoi().
Signed-off-by: Geoff Levand <email address hidden>
Signed-off-by: Benjamin Herrenschmidt <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 8bb72ab63d58957270b2dc31e6c9bcfa38470d2c
Author: Dan Carpenter <email address hidden>
Date: Fri Nov 4 21:24:36 2011 +0300
xen-gntalloc: signedness bug in add_grefs()
commit 99cb2ddcc617f43917e94a4147aa3ccdb2bcd77e upstream.
gref->gref_id is unsigned so the error handling didn't work.
gnttab_grant_foreign_access() returns an int type, so we can add a
cast here, and it doesn't cause any problems.
gnttab_grant_foreign_access() can return a variety of errors
including -ENOSPC, -ENOSYS and -ENOMEM.
Signed-off-by: Dan Carpenter <email address hidden>
Signed-off-by: Konrad Rzeszutek Wilk <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 1b4f3a211878328065ee7ae79a380241bedaef5a
Author: Dan Carpenter <email address hidden>
Date: Fri Nov 4 21:24:08 2011 +0300
xen-gntalloc: integer overflow in gntalloc_ioctl_alloc()
commit 21643e69a4c06f7ef155fbc70e3fba13fba4a756 upstream.
On 32 bit systems a high value of op.count could lead to an integer
overflow in the kzalloc() and gref_ids would be smaller than
expected. If the you triggered another integer overflow in
"if (gref_size + op.count > limit)" then you'd probably get memory
corruption inside add_grefs().
Signed-off-by: Dan Carpenter <email address hidden>
Signed-off-by: Konrad Rzeszutek Wilk <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 14fa9e2f0916742bf436e84895a3523551d325f5
Author: Zhenzhong Duan <email address hidden>
Date: Thu Oct 27 22:28:59 2011 -0700
xen:pvhvm: enable PVHVM VCPU placement when using more than 32 CPUs.
commit 90d4f5534d14815bd94c10e8ceccc57287657ecc upstream.
PVHVM running with more than 32 vcpus and pv_irq/pv_time enabled
need VCPU placement to work, or else it will softlockup.
Acked-by: Stefano Stabellini <email address hidden>
Signed-off-by: Zhenzhong Duan <email address hidden>
Signed-off-by: Konrad Rzeszutek Wilk <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 19340174d730574e9a6c119d1c9c6cbb501165a8
Author: Thomas Weber <email address hidden>
Date: Mon Sep 5 11:26:33 2011 +0200
mfd: Fix twl4030 dependencies for audio codec
commit f09ee0451a44a4e913a7c3cec3805508f7de6c54 upstream.
The codec for Devkit8000 (TWL4030) was not detected except
when build with CONFIG_SND_SOC_ALL_CODECS.
twl-core.c still uses the CONFIG_TWL4030_CODEC for
twl_has_codec().
In commit 57fe7251f5bfc4332f24479376de48a1e8ca6211
the CONFIG_TWL4030_CODEC was renamed
into CONFIG_MFD_TWL4030_AUDIO, thatswhy the codec
was not detected.
This patch renames the CONFIG_ TWL4030_CODEC into
CONFIG_MFD_TWL4030_AUDIO in twl-core.c.
Signed-off-by: Thomas Weber <email address hidden>
Acked-by: Peter Ujfalusi <email address hidden>
Signed-off-by: Samuel Ortiz <email address hidden>
Cc: Jarkko Nikula <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 261a21ff99fb3cef1958b30e4456866ec4427b5b
Author: Rafał Miłecki <email address hidden>
Date: Tue Nov 8 17:15:03 2011 +0100
b43: refuse to load unsupported firmware
[This patch is supposed to be applied in 3.1 (and maybe older) branches only.]
New kernels support newer firmware that users may try to incorrectly use
with older kernels. Display error and explain the problem in such a case
Signed-off-by: Rafał Miłecki <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 7608d6b743d5347a01d0afc1b2f8f863a21ebb01
Author: Arend van Spriel <email address hidden>
Date: Tue Aug 23 14:14:00 2011 +0200
staging: brcm80211: fill in proper rx rate in mac80211 rx status
commit 5a84d6ad4c9306afb467a600a4c6d7b50da49440 upstream.
The brcmsmac driver supports different rates on 5GHz but this is not
taken into account when providing the rate index in the receive
status information passed to mac80211.
Reviewed-by: Roland Vossen <email address hidden>
Reviewed-by: Pieter-Paul Giesberts <email address hidden>
Reviewed-by: Henry Ptasinski <email address hidden>
Signed-off-by: Arend van Spriel <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit e7829936ef31adc774aecf5f35037725b6c0e29b
Author: Alex Deucher <email address hidden>
Date: Mon Nov 14 09:33:56 2011 -0500
drm/radeon: add some missing FireMV pci ids
commit b872a37437e93df9d112ce674752b3b3a0a17020 upstream.
Noticed by Egbert.
Signed-off-by: Alex Deucher <email address hidden>
Cc: Egbert Eich <email address hidden>
Signed-off-by: Dave Airlie <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 1c08c931337ba435bf9140f43a20b26e64085cea
Author: Johan Hovold <email address hidden>
Date: Tue Nov 15 14:35:52 2011 -0800
Revert "leds: save the delay values after a successful call to blink_set()"
commit cb871513f656bdfc48b185b55f37857b5c750c40 upstream.
Revert commit 6123b0e274503a0d3588e84fbe07c9aa01bfaf5d.
The problem this patch intends to solve has alreadqy been fixed by
commit 7a5caabd090b ("drivers/leds/ledtrig-timer.c: fix broken sysfs
delay handling").
Signed-off-by: Johan Hovold <email address hidden>
Cc: Antonio Ospite <email address hidden>
Cc: Johannes Berg <email address hidden>
Cc: Richard Purdie <email address hidden>
Signed-off-by: Andrew Morton <email address hidden>
Signed-off-by: Linus Torvalds <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit b8988229c7eed0ac7967fa212a2a3a5c832e7902
Author: Dan Carpenter <email address hidden>
Date: Mon Nov 14 17:52:08 2011 +0300
hfs: add sanity check for file name length
commit bc5b8a9003132ae44559edd63a1623b7b99dfb68 upstream.
On a corrupted file system the ->len field could be wrong leading to
a buffer overflow.
Reported-and-acked-by: Clement LECIGNE <email address hidden>
Signed-off-by: Dan Carpenter <email address hidden>
Signed-off-by: Linus Torvalds <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit d18c0efc9b76aad26000bb562037a9b675f1c0ae
Author: David Howells <email address hidden>
Date: Tue Nov 15 22:09:45 2011 +0000
KEYS: Fix a NULL pointer deref in the user-defined key type
commit 9f35a33b8d06263a165efe3541d9aa0cdbd70b3b upstream.
Fix a NULL pointer deref in the user-defined key type whereby updating a
negative key into a fully instantiated key will cause an oops to occur
when the code attempts to free the non-existent old payload.
This results in an oops that looks something like the following:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
IP: [<ffffffff81085fa1>] __call_rcu+0x11/0x13e
PGD 3391d067 PUD 3894a067 PMD 0
Oops: 0002 [#1] SMP
CPU 1
Pid: 4354, comm: keyctl Not tainted 3.1.0-fsdevel+ #1140 /DG965RY
RIP: 0010:[<ffffffff81085fa1>] [<ffffffff81085fa1>] __call_rcu+0x11/0x13e
RSP: 0018:ffff88003d591df8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000006e
RDX: ffffffff8161d0c0 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff88003d591e18 R08: 0000000000000000 R09: ffffffff8152fa6c
R10: 0000000000000000 R11: 0000000000000300 R12: ffff88003b8f9538
R13: ffffffff8161d0c0 R14: ffff88003b8f9d50 R15: ffff88003c69f908
FS: 00007f97eb18c720(0000) GS:ffff88003bd00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000008 CR3: 000000003d47a000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process keyctl (pid: 4354, threadinfo ffff88003d590000, task ffff88003c78a040)
Stack:
ffff88003e0ffde0 ffff88003b8f9538 0000000000000001 ffff88003b8f9d50
ffff88003d591e28 ffffffff810860f0 ffff88003d591e68 ffffffff8117bfea
ffff88003d591e68 ffffffff00000000 ffff88003e0ffde1 ffff88003e0ffde0
Call Trace:
[<ffffffff810860f0>] call_rcu_sched+0x10/0x12
[<ffffffff8117bfea>] user_update+0x8d/0xa2
[<ffffffff8117723a>] key_create_or_update+0x236/0x270
[<ffffffff811789b1>] sys_add_key+0x123/0x17e
[<ffffffff813b84bb>] system_call_fastpath+0x16/0x1b
Signed-off-by: David Howells <email address hidden>
Acked-by: Jeff Layton <email address hidden>
Acked-by: Neil Horman <email address hidden>
Acked-by: Steve Dickson <email address hidden>
Acked-by: James Morris <email address hidden>
Signed-off-by: Linus Torvalds <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit f80f33817c973746ca0187713404461b80ef5d2d
Author: Takashi Iwai <email address hidden>
Date: Tue Nov 8 17:50:27 2011 +0100
ALSA: usb-audio - Fix the missing volume quirks at delayed init
commit dcaaf9f2c16b56f8bb316881fcd3f15c18fc71e7 upstream.
In the recent usb-audio driver, the initialization of volume ranges
may be delayed when the device doesn't respond well at the probing time.
But the volume quirks for certain devices are applied only in
mixer_ctl_feature_info() thus only at the very first probe and will be
missing when the volume range is initialized later.
This patch moves the volume quirk code to be always called from the
volume-range extraction (get_min_max()), so that the quirks are properly
applied in the later init time.
Reported-and-tested-by: Alexey Fisher <email address hidden>
Signed-off-by: Takashi Iwai <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 3485c041be44cfcbe8681a9d79f16d9aaac17529
Author: Takashi Iwai <email address hidden>
Date: Fri Aug 19 08:30:53 2011 +0200
ALSA: usb-audio - Check the dB-range validity in the later read, too
commit 9fcd0ab130579d9742538340edda3225f2b49a3e upstream.
When the initial check of dB-range failed due to the read error, try to
check again at the later read, too. When an invalid dB range is found,
remove TLV flags and notify the mixer info change.
Signed-off-by: Takashi Iwai <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit d047c6e8a7bfa830bca0741a0e38b1edc42b13b7
Author: Alex Deucher <email address hidden>
Date: Tue Nov 8 10:09:58 2011 -0500
drm/radeon/kms: make an aux failure debug only
commit 091264f0bc12419560ac64fcef4567809d611658 upstream.
Can happen when there is no DP panel attached, confusing
users. Make it debug only.
Signed-off-by: Alex Deucher <email address hidden>
Signed-off-by: Dave Airlie <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 68e7aac26cb758d7417d6689f35f2edba6f18751
Author: Marcin Slusarz <email address hidden>
Date: Fri Sep 9 14:16:42 2011 +0200
drm/nouveau: initialize chan->fence.lock before use
commit 5e60ee780e792efe6dce97eceb110b1d30bab850 upstream.
Fence lock needs to be initialized before any call to nouveau_channel_put
because it calls nouveau_channel_idle->nouveau_fence_update which uses
fence lock.
BUG: spinlock bad magic on CPU#0, test/24134
lock: ffff88019f90dba8, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
Pid: 24134, comm: test Not tainted 3.0.0-nv+ #800
Call Trace:
spin_bug+0x9c/0xa3
do_raw_spin_lock+0x29/0x13c
_raw_spin_lock+0x1e/0x22
nouveau_fence_update+0x2d/0xf1
nouveau_channel_idle+0x22/0xa0
nouveau_channel_put_unlocked+0x84/0x1bd
nouveau_channel_put+0x20/0x24
nouveau_channel_alloc+0x4ec/0x585
nouveau_ioctl_fifo_alloc+0x50/0x130
drm_ioctl+0x289/0x361
do_vfs_ioctl+0x4dd/0x52c
sys_ioctl+0x42/0x65
system_call_fastpath+0x16/0x1b
It's easily triggerable from userspace.
Additionally remove double initialization of chan->fence.pending.
Signed-off-by: Marcin Slusarz <email address hidden>
Signed-off-by: Ben Skeggs <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 650dd7ecc14205705292eb95fe73c2d2a1db3173
Author: Eric Anholt <email address hidden>
Date: Mon Oct 31 23:16:21 2011 -0700
drm/i915: Fix object refcount leak on mmappable size limit error path.
commit 14660ccd599dc7bd6ecef17408bd76dc853f9b77 upstream.
I've been seeing memory leaks on my system in the form of large
(300-400MB) GEM objects created by now-dead processes laying around
clogging up memory. I usually notice when it gets to about 1.2GB of
them. Hopefully this clears up the issue, but I just found this bug
by inspection.
Signed-off-by: Eric Anholt <email address hidden>
Signed-off-by: Keith Packard <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit aa85ae0189ef4d47456fa03a65359a7f81eabbed
Author: Nobuhiro Iwamatsu <email address hidden>
Date: Fri Nov 4 22:13:50 2011 +0900
sh: Fix cached/uncaced address calculation in 29bit mode
commit dfd3b596fbbfa48b8e7966ef996d587157554b69 upstream.
In the case of 29bit mode, CAC/UNCAC_ADDR does not return a right address.
This revises this problem by using P1SEGADDR and P2SEGADDR in 29bit mode.
Reported-by: Yutaro Ebihara <email address hidden>
Signed-off-by: Nobuhiro Iwamatsu <email address hidden>
Tested-by: Kuninori Morimoto <email address hidden>
Tested-by: Simon Horman <email address hidden>
Signed-off-by: Paul Mundt <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit d8f0e58a227e8659a357e12f0774ea63e36fd453
Author: Mark Brown <email address hidden>
Date: Fri Nov 4 15:52:31 2011 +0000
ASoC: Don't use wm8994->control_data in wm8994_readable_register()
commit 8eeea521d9d0fa6afd62df8c6e6566ee946117fa upstream.
The field is no longer initialised so this will crash if running on
wm8958.
Reported-by: Thomas Abraham <email address hidden>
Signed-off-by: Mark Brown <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit cf80307d470c66deaba601f9b55b617ca7ffc457
Author: Jochen Friedrich <email address hidden>
Date: Tue Oct 25 20:51:06 2011 +0200
ARM: at91: Fix USBA gadget registration
commit dd0b3825495a2e7a8cd6cf0ec077618c008ac7c4 upstream.
Since 193ab2a6070039e7ee2b9b9bebea754a7c52fd1b, various AT91 boards don't
register USBA adapters anymore due to depending on a now non-existing
symbol. Fix the symbol name.
Signed-off-by: Jochen Friedrich <email address hidden>
Acked-by: Nicolas Ferre <email address hidden>
Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 4dc48eb2dd088717e59911663383bf79e1aa33a6
Author: Michael S. Tsirkin <email address hidden>
Date: Mon Nov 7 18:37:05 2011 +0200
virtio-pci: fix use after free
commit 72103bd1285211440621f2c46f4fce377584de54 upstream.
Commit 31a3ddda166cda86d2b5111e09ba4bda5239fae6 introduced
a use after free in virtio-pci. The main issue is
that the release method signals removal of the virtio device,
while remove signals removal of the pci device.
For example, on driver removal or hot-unplug,
virtio_pci_release_dev is called before virtio_pci_remove.
We then might get a crash as virtio_pci_remove tries to use the
device freed by virtio_pci_release_dev.
We allocate/free all resources together with the
pci device, so we can leave the release method empty.
Signed-off-by: Michael S. Tsirkin <email address hidden>
Acked-by: Amit Shah <email address hidden>
Signed-off-by: Rusty Russell <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit 435dc21f524e0496863a82104ccec0eea8e3ddff
Author: Takashi Iwai <email address hidden>
Date: Thu Nov 10 12:28:38 2011 +0100
ALSA: hda - Don't add elements of other codecs to vmaster slave
commit aeb4b88ec0a948efce8e3a23a8f964d3560a7308 upstream.
When a virtual mater control is created, the driver looks for slave
elements from the assigned card instance. But this may include the
elements of other codecs when multiple codecs are on the same HD-audio
bus. This works at the first time, but it'll give Oops when it's once
freed and re-created via reconfig sysfs.
This patch changes the element-look-up strategy to limit only to the
mixer elements of the same codec.
Reported-by: David Henningsson <email address hidden>
Signed-off-by: Takashi Iwai <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
commit aa535b5cc1d0e7f9671292392eb34cc0849d2080
Author: Julian Wollrath <email address hidden>
Date: Wed Nov 9 10:02:40 2011 +0100
ALSA: hda - fix internal mic on Dell Vostro 3500 laptop
commit f7f9bdfadfda07afb904a9767468e38c2d1a6033 upstream.
Fix the not working internal mic on Dell Vostro 3500 laptop by introducing the
new model dell-vostro-3500.
Signed-off-by: Julian Wollrath <email address hidden>
Signed-off-by: Takashi Iwai <email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>