9 years agoBlock: use a freezable workqueue for disk-event polling
Alan Stern [Fri, 2 Mar 2012 09:51:00 +0000 (10:51 +0100)]
Block: use a freezable workqueue for disk-event polling

commit 62d3c5439c534b0e6c653fc63e6d8c67be3a57b1 upstream.

This patch (as1519) fixes a bug in the block layer's disk-events
polling.  The polling is done by a work routine queued on the
system_nrt_wq workqueue.  Since that workqueue isn't freezable, the
polling continues even in the middle of a system sleep transition.

Obviously, polling a suspended drive for media changes and such isn't
a good thing to do; in the case of USB mass-storage devices it can
lead to real problems requiring device resets and even re-enumeration.

The patch fixes things by creating a new system-wide, non-reentrant,
freezable workqueue and using it for disk-events polling.

Signed-off-by: Alan Stern <>
Acked-by: Tejun Heo <>
Acked-by: Rafael J. Wysocki <>
Signed-off-by: Jens Axboe <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoblock: fix __blkdev_get and add_disk race condition
Stanislaw Gruszka [Fri, 2 Mar 2012 09:43:28 +0000 (10:43 +0100)]
block: fix __blkdev_get and add_disk race condition

commit 9f53d2fe815b4011ff930a7b6db98385d45faa68 upstream.

The following situation might occur:

__blkdev_get: add_disk:


disk->ev == NULL


disk->ev != NULL

Then we unblock events, when they are suppose to be blocked. This can
trigger events related block/genhd.c warnings, but also can crash in
sd_check_events() or other places.

I'm able to reproduce crashes with the following scripts (with
connected usb dongle as sdb disk).


function stop_me()
for i in `jobs -p` ; do kill $i 2> /dev/null ; done


for ((i = 0; i < 10; i++)) ; do
while true; do fdisk -l $DEV  2>&1 > /dev/null ; done &

while true ; do
echo 1 > $ENABLE
sleep 1
echo 0 > $ENABLE

I use the script to verify patch fixing oops in sd_revalidate_disk
Without Jun'ichi Nomura patch titled "Fix NULL pointer dereference in
sd_revalidate_disk" or this one, script easily crash kernel within
a few seconds. With both patches applied I do not observe crash.
Unfortunately after some time (dozen of minutes), script will hung in:

[ 1563.906432]  [<c08354f5>] schedule_timeout_uninterruptible+0x15/0x20
[ 1563.906437]  [<c04532d5>] msleep+0x15/0x20
[ 1563.906443]  [<c05d60b2>] blk_drain_queue+0x32/0xd0
[ 1563.906447]  [<c05d6e00>] blk_cleanup_queue+0xd0/0x170
[ 1563.906454]  [<c06d278f>] scsi_free_queue+0x3f/0x60
[ 1563.906459]  [<c06d7e6e>] __scsi_remove_device+0x6e/0xb0
[ 1563.906463]  [<c06d4aff>] scsi_forget_host+0x4f/0x60
[ 1563.906468]  [<c06cd84a>] scsi_remove_host+0x5a/0xf0
[ 1563.906482]  [<f7f030fb>] quiesce_and_remove_host+0x5b/0xa0 [usb_storage]
[ 1563.906490]  [<f7f03203>] usb_stor_disconnect+0x13/0x20 [usb_storage]

Anyway I think this patch is some step forward.

As drawback, I do not teardown on sysfs file create error, because I do
not know how to nullify disk->ev (since it can be used). However add_disk
error handling practically does not exist too, and things will work
without this sysfs file, except events will not be exported to user

Signed-off-by: Stanislaw Gruszka <>
Acked-by: Tejun Heo <>
Signed-off-by: Jens Axboe <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoblock, sx8: fix pointer math issue getting fw version
Dan Carpenter [Sat, 3 Mar 2012 11:09:17 +0000 (12:09 +0100)]
block, sx8: fix pointer math issue getting fw version

commit ea5f4db8ece896c2ab9eafa0924148a2596c52e4 upstream.

"mem" is type u8.  We need parenthesis here or it screws up the pointer
math probably leading to an oops.

Signed-off-by: Dan Carpenter <>
Acked-by: Jeff Garzik <>
Signed-off-by: Jens Axboe <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoblock: Fix NULL pointer dereference in sd_revalidate_disk
Jun'ichi Nomura [Fri, 2 Mar 2012 09:38:33 +0000 (10:38 +0100)]
block: Fix NULL pointer dereference in sd_revalidate_disk

commit fe316bf2d5847bc5dd975668671a7b1067603bc7 upstream.

Since 2.6.39 (1196f8b), when a driver returns -ENOMEDIUM for open(),
__blkdev_get() calls rescan_partitions() to remove
in-kernel partition structures and raise KOBJ_CHANGE uevent.

However it ends up calling driver's revalidate_disk without open
and could cause oops.

In the case of SCSI:

  process A                  process B
        returns -ENOMEDIUM
                               <scsi_device torn down>
Oopses are reported here:

This patch separates the partition invalidation from rescan_partitions()
and use it for -ENOMEDIUM case.

Reported-by: Huajun Li <>
Signed-off-by: Jun'ichi Nomura <>
Acked-by: Tejun Heo <>
Signed-off-by: Jens Axboe <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoregulator: Fix setting selector in tps6524x set_voltage function
Axel Lin [Thu, 8 Mar 2012 02:02:17 +0000 (10:02 +0800)]
regulator: Fix setting selector in tps6524x set_voltage function

commit f03570cf1709397ebe656608266b44ec772960c2 upstream.

Don't assign the voltage to selector.

Signed-off-by: Axel Lin <>
Signed-off-by: Mark Brown <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agousb: asix: Patch for Sitecom LN-031
Joerg Neikes [Thu, 8 Mar 2012 22:44:03 +0000 (22:44 +0000)]
usb: asix: Patch for Sitecom LN-031

commit 4e50391968849860dff1aacde358b4eb14aa5127 upstream.

This patch adds support for the Sitecom LN-031 USB adapter with a AX88178 chip.

Added USB id to find correct driver for AX88178 1000 Ethernet adapter.

Signed-off-by: Joerg Neikes <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoIPv6: Fix not join all-router mcast group when forwarding set.
Li Wei [Mon, 5 Mar 2012 14:45:17 +0000 (14:45 +0000)]
IPv6: Fix not join all-router mcast group when forwarding set.

[ Upstream commit d6ddef9e641d1229d4ec841dc75ae703171c3e92 ]

When forwarding was set and a new net device is register,
we need add this device to the all-router mcast group.

Signed-off-by: Li Wei <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agotcp: fix tcp_shift_skb_data() to not shift SACKed data below snd_una
Neal Cardwell [Mon, 5 Mar 2012 19:35:04 +0000 (19:35 +0000)]
tcp: fix tcp_shift_skb_data() to not shift SACKed data below snd_una

[ Upstream commit 4648dc97af9d496218a05353b0e442b3dfa6aaab ]

This commit fixes tcp_shift_skb_data() so that it does not shift
SACKed data below snd_una.

This fixes an issue whose symptoms exactly match reports showing
tp->sacked_out going negative since 3.3.0-rc4 (see "WARNING: at
net/ipv4/tcp_input.c:3418" thread on netdev).

Since 2008 (832d11c5cd076abc0aa1eaf7be96c81d1a59ce41)
tcp_shift_skb_data() had been shifting SACKed ranges that were below
snd_una. It checked that the *end* of the skb it was about to shift
from was above snd_una, but did not check that the end of the actual
shifted range was above snd_una; this commit adds that check.

Shifting SACKed ranges below snd_una is problematic because for such
ranges tcp_sacktag_one() short-circuits: it does not declare anything
as SACKed and does not increase sacked_out.

Before the fixes in commits cc9a672ee522d4805495b98680f4a3db5d0a0af9
and daef52bab1fd26e24e8e9578f8fb33ba1d0cb412, shifting SACKed ranges
below snd_una happened to work because tcp_shifted_skb() was always
(incorrectly) passing in to tcp_sacktag_one() an skb whose end_seq
tcp_shift_skb_data() had already guaranteed was beyond snd_una. Hence
tcp_sacktag_one() never short-circuited and always increased
tp->sacked_out in this case.

After those two fixes, my testing has verified that shifting SACKed
ranges below snd_una could cause tp->sacked_out to go negative with
the following sequence of events:

(1) tcp_shift_skb_data() sees an skb whose end_seq is beyond snd_una,
    then shifts a prefix of that skb that is below snd_una

(2) tcp_shifted_skb() increments the packet count of the
    already-SACKed prev sk_buff

(3) tcp_sacktag_one() sees the end of the new SACKed range is below
    snd_una, so it short-circuits and doesn't increase tp->sacked_out

(5) tcp_clean_rtx_queue() sees the SACKed skb has been ACKed,
    decrements tp->sacked_out by this "inflated" pcount that was
    missing a matching increase in tp->sacked_out, and hence
    tp->sacked_out underflows to a u32 like 0xFFFFFFFF, which casted
    to s32 is negative.

(6) this leads to the warnings seen in the recent "WARNING: at
    net/ipv4/tcp_input.c:3418" thread on the netdev list; e.g.:
    tcp_input.c:3418  WARN_ON((int)tp->sacked_out < 0);

More generally, I think this bug can be tickled in some cases where
two or more ACKs from the receiver are lost and then a DSACK arrives
that is immediately above an existing SACKed skb in the write queue.

This fix changes tcp_shift_skb_data() to abort this sequence at step
(1) in the scenario above by noticing that the bytes are below snd_una
and not shifting them.

Signed-off-by: Neal Cardwell <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agobridge: check return value of ipv6_dev_get_saddr()
Ulrich Weber [Mon, 5 Mar 2012 04:52:44 +0000 (04:52 +0000)]
bridge: check return value of ipv6_dev_get_saddr()

[ Upstream commit d1d81d4c3dd886d5fa25a2c4fa1e39cb89613712 ]

otherwise source IPv6 address of ICMPV6_MGM_QUERY packet
might be random junk if IPv6 is disabled on interface or
link-local address is not yet ready (DAD).

Signed-off-by: Ulrich Weber <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agotcp: don't fragment SACKed skbs in tcp_mark_head_lost()
Neal Cardwell [Fri, 2 Mar 2012 21:36:51 +0000 (21:36 +0000)]
tcp: don't fragment SACKed skbs in tcp_mark_head_lost()

[ Upstream commit c0638c247f559e1a16ee79e54df14bca2cb679ea ]

In tcp_mark_head_lost() we should not attempt to fragment a SACKed skb
to mark the first portion as lost. This is for two primary reasons:

(1) tcp_shifted_skb() coalesces adjacent regions of SACKed skbs. When
doing this, it preserves the sum of their packet counts in order to
reflect the real-world dynamics on the wire. But given that skbs can
have remainders that do not align to MSS boundaries, this packet count
preservation means that for SACKed skbs there is not necessarily a
direct linear relationship between tcp_skb_pcount(skb) and
skb->len. Thus tcp_mark_head_lost()'s previous attempts to fragment
off and mark as lost a prefix of length (packets - oldcnt)*mss from
SACKed skbs were leading to occasional failures of the WARN_ON(len >
skb->len) in tcp_fragment() (which used to be a BUG_ON(); see the
recent "crash in tcp_fragment" thread on netdev).

(2) there is no real point in fragmenting off part of a SACKed skb and
calling tcp_skb_mark_lost() on it, since tcp_skb_mark_lost() is a NOP
for SACKed skbs.

Signed-off-by: Neal Cardwell <>
Acked-by: Ilpo Järvinen <>
Acked-by: Yuchung Cheng <>
Acked-by: Nandita Dukkipati <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agor8169: corrupted IP fragments fix for large mtu.
françois romieu [Fri, 2 Mar 2012 04:43:14 +0000 (04:43 +0000)]
r8169: corrupted IP fragments fix for large mtu.

[ Upstream commit 9c5028e9da1255dd2b99762d8627b88b29f68cce ]

Noticed with the 8168d (-vb-gr, aka RTL_GIGA_MAC_VER_26).

ConfigX registers should only be written while the Config9346 lock
is held.

Signed-off-by: Francois Romieu <>
Reported-by: Nick Bowler <>
Cc: Hayes Wang <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agopacketengines: fix config default
stephen hemminger [Fri, 2 Mar 2012 13:38:56 +0000 (13:38 +0000)]
packetengines: fix config default

[ Upstream commit 3f2010b2ad3d66d5291497c9b274315e7b807ecd ]

As part of the big network driver reorg, each vendor directory defaults to
yes, so that older config's can migrate correctly. Looks like this one
got missed.

Signed-off-by: Stephen Hemminger <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agovmxnet3: Fix transport header size
Shreyas Bhatewara [Tue, 28 Feb 2012 22:17:38 +0000 (22:17 +0000)]
vmxnet3: Fix transport header size

[ Upstream commit efead8710aad9e384730ecf25eae0287878840d7 ]

Fix transport header size

Fix the transpoert header size for UDP packets.

Signed-off-by: Shreyas N Bhatewara <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agotcp: fix false reordering signal in tcp_shifted_skb
Neal Cardwell [Sun, 26 Feb 2012 10:06:19 +0000 (10:06 +0000)]
tcp: fix false reordering signal in tcp_shifted_skb

[ Upstream commit 4c90d3b30334833450ccbb02f452d4972a3c3c3f ]

When tcp_shifted_skb() shifts bytes from the skb that is currently
pointed to by 'highest_sack' then the increment of
TCP_SKB_CB(skb)->seq implicitly advances tcp_highest_sack_seq(). This
implicit advancement, combined with the recent fix to pass the correct
SACKed range into tcp_sacktag_one(), caused tcp_sacktag_one() to think
that the newly SACKed range was before the tcp_highest_sack_seq(),
leading to a call to tcp_update_reordering() with a degree of
reordering matching the size of the newly SACKed range (typically just
1 packet, which is a NOP, but potentially larger).

This commit fixes this by simply calling tcp_sacktag_one() before the
TCP_SKB_CB(skb)->seq advancement that can advance our notion of the
highest SACKed sequence.

Correspondingly, we can simplify the code a little now that
tcp_shifted_skb() should update the lost_cnt_hint in all cases where
skb == tp->lost_skb_hint.

Signed-off-by: Neal Cardwell <>
Acked-by: Yuchung Cheng <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agosfc: Fix assignment of ip_summed for pre-allocated skbs
Ben Hutchings [Fri, 24 Feb 2012 15:12:34 +0000 (15:12 +0000)]
sfc: Fix assignment of ip_summed for pre-allocated skbs

[ Upstream commit ff3bc1e7527504a93710535611b2f812f3bb89bf ]

When pre-allocating skbs for received packets, we set ip_summed =
CHECKSUM_UNNCESSARY.  We used to change it back to CHECKSUM_NONE when
the received packet had an incorrect checksum or unhandled protocol.

Commit bc8acf2c8c3e43fcc192762a9f964b3e9a17748b ('drivers/net: avoid
some skb->ip_summed initializations') mistakenly replaced the latter
assignment with a DEBUG-only assertion that ip_summed ==
CHECKSUM_NONE.  This assertion is always false, but it seems no-one
has exercised this code path in a DEBUG build.

Fix this by moving our assignment of CHECKSUM_UNNECESSARY into

Signed-off-by: Ben Hutchings <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoppp: fix 'ppp_mp_reconstruct bad seq' errors
Ben McKeegan [Fri, 24 Feb 2012 06:33:56 +0000 (06:33 +0000)]
ppp: fix 'ppp_mp_reconstruct bad seq' errors

[ Upstream commit 8a49ad6e89feb5015e77ce6efeb2678947117e20 ]

This patch fixes a (mostly cosmetic) bug introduced by the patch
'ppp: Use SKB queue abstraction interfaces in fragment processing'
found here:

The above patch rewrote and moved the code responsible for cleaning
up discarded fragments but the new code does not catch every case
where this is necessary.  This results in some discarded fragments
remaining in the queue, and triggering a 'bad seq' error on the
subsequent call to ppp_mp_reconstruct.  Fragments are discarded
whenever other fragments of the same frame have been lost.
This can generate a lot of unwanted and misleading log messages.

This patch also adds additional detail to the debug logging to
make it clearer which fragments were lost and which other fragments
were discarded as a result of losses. (Run pppd with 'kdebug 1'
option to enable debug logging.)

Signed-off-by: Ben McKeegan <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoipsec: be careful of non existing mac headers
Eric Dumazet [Thu, 23 Feb 2012 10:55:02 +0000 (10:55 +0000)]
ipsec: be careful of non existing mac headers

[ Upstream commit 03606895cd98c0a628b17324fd7b5ff15db7e3cd ]

Niccolo Belli reported ipsec crashes in case we handle a frame without
mac header (atm in his case)

Before copying mac header, better make sure it is present.

Bugzilla reference:

Reported-by: Niccolò Belli <>
Tested-by: Niccolò Belli <>
Signed-off-by: Eric Dumazet <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoneighbour: Fixed race condition at tbl->nht
Michel Machado [Tue, 21 Feb 2012 11:04:13 +0000 (11:04 +0000)]
neighbour: Fixed race condition at tbl->nht

[ Upstream commit 84338a6c9dbb6ff3de4749864020f8f25d86fc81 ]

When the fixed race condition happens:

1. While function neigh_periodic_work scans the neighbor hash table
pointed by field tbl->nht, it unlocks and locks tbl->lock between
buckets in order to call cond_resched.

2. Assume that function neigh_periodic_work calls cond_resched, that is,
the lock tbl->lock is available, and function neigh_hash_grow runs.

3. Once function neigh_hash_grow finishes, and RCU calls
neigh_hash_free_rcu, the original struct neigh_hash_table that function
neigh_periodic_work was using doesn't exist anymore.

4. Once back at neigh_periodic_work, whenever the old struct
neigh_hash_table is accessed, things can go badly.

Signed-off-by: Michel Machado <>
CC: "David S. Miller" <>
CC: Eric Dumazet <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoatl1c: dont use highprio tx queue
Eric Dumazet [Wed, 15 Feb 2012 20:43:11 +0000 (20:43 +0000)]
atl1c: dont use highprio tx queue

[ Upstream commit 11aad99af6ef629ff3b05d1c9f0936589b204316 ]

This driver attempts to use two TX rings but lacks proper support :

1) IRQ handler only takes care of TX completion on first TX ring
2) the stop/start logic uses the legacy functions (for non multiqueue

This means all packets witk skb mark set to 1 are sent through high
queue but are never cleaned and queue eventualy fills and block the
device, triggering the infamous "NETDEV WATCHDOG" message.

Lets use a single TX ring to fix the problem, this driver is not a real
multiqueue one yet.

Minimal fix for stable kernels.

Reported-by: Thomas Meyer <>
Tested-by: Thomas Meyer <>
Signed-off-by: Eric Dumazet <>
Cc: Jay Cliburn <>
Cc: Chris Snook <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoacer-wmi: No wifi rfkill on Lenovo machines
Ike Panhc [Fri, 3 Feb 2012 08:46:39 +0000 (16:46 +0800)]
acer-wmi: No wifi rfkill on Lenovo machines

commit 461e74377cfcfc2c0d6bbdfa8fc5fbc21b052c2a upstream.

We have several reports which says acer-wmi is loaded on ideapads
and register rfkill for wifi which can not be unblocked.

Since ideapad-laptop also register rfkill for wifi and it works
reliably, it will be fine acer-wmi is not going to register rfkill
for wifi once VPC2004 is found.

Also put IBM0068/LEN0068 in the list. Though thinkpad_acpi has no
wifi rfkill capability, there are reports which says acer-wmi also
block wireless on Thinkpad E520/E420.

Signed-off-by: Ike Panhc <>
Signed-off-by: Matthew Garrett <>
Cc: Jonathan Nieder <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agovfs: fix double put after complete_walk()
Miklos Szeredi [Tue, 6 Mar 2012 12:56:33 +0000 (13:56 +0100)]
vfs: fix double put after complete_walk()

commit 097b180ca09b581ef0dc24fbcfc1b227de3875df upstream.

complete_walk() already puts nd->path, no need to do it again at cleanup time.

This would result in Oopses if triggered, apparently the codepath is not too
well exercised.

Signed-off-by: Miklos Szeredi <>
Signed-off-by: Al Viro <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agovfs: fix return value from do_last()
Miklos Szeredi [Tue, 6 Mar 2012 12:56:34 +0000 (13:56 +0100)]
vfs: fix return value from do_last()

commit 7f6c7e62fcc123e6bd9206da99a2163fe3facc31 upstream.

complete_walk() returns either ECHILD or ESTALE.  do_last() turns this into
ECHILD unconditionally.  If not in RCU mode, this error will reach userspace
which is complete nonsense.

Signed-off-by: Miklos Szeredi <>
Signed-off-by: Al Viro <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoCIFS: Do not kmalloc under the flocks spinlock
Pavel Shilovsky [Mon, 5 Mar 2012 06:39:20 +0000 (09:39 +0300)]
CIFS: Do not kmalloc under the flocks spinlock

commit d5751469f210d2149cc2159ffff66cbeef6da3f2 upstream.

Reorganize the code to make the memory already allocated before
spinlock'ed loop.

Reviewed-by: Jeff Layton <>
Signed-off-by: Pavel Shilovsky <>
Signed-off-by: Steve French <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoperf/x86: Fix local vs remote memory events for NHM/WSM
Peter Zijlstra [Mon, 5 Mar 2012 22:59:25 +0000 (23:59 +0100)]
perf/x86: Fix local vs remote memory events for NHM/WSM

commit 87e24f4b67e68d9fd8df16e0bf9c66d1ad2a2533 upstream.

Verified using the below proglet.. before:

[root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 0
remote write

 Performance counter stats for './numa 0':

         2,101,554 node-stores
         2,096,931 node-store-misses

       5.021546079 seconds time elapsed

[root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 1
local write

 Performance counter stats for './numa 1':

           501,137 node-stores
               199 node-store-misses

       5.124451068 seconds time elapsed


[root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 0
remote write

 Performance counter stats for './numa 0':

         2,107,516 node-stores
         2,097,187 node-store-misses

       5.012755149 seconds time elapsed

[root@westmere ~]# perf stat -e node-stores -e node-store-misses ./numa 1
local write

 Performance counter stats for './numa 1':

         2,063,355 node-stores
               165 node-store-misses

       5.082091494 seconds time elapsed

#define _GNU_SOURCE

#include <sched.h>
#include <stdio.h>
#include <errno.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <dirent.h>
#include <signal.h>
#include <unistd.h>
#include <numaif.h>
#include <stdlib.h>

#define SIZE (32*1024*1024)

volatile int done;

void sig_done(int sig)
done = 1;

int main(int argc, char **argv)
cpu_set_t *mask, *mask2;
size_t size;
int i, err, t;
int nrcpus = 1024;
char *mem;
unsigned long nodemask = 0x01; /* node 0 */
DIR *node;
struct dirent *de;
int read = 0;
int local = 0;

if (argc < 2) {
printf("usage: %s [0-3]\n", argv[0]);
printf("  bit0 - local/remote\n");
printf("  bit1 - read/write\n");

switch (atoi(argv[1])) {
case 0:
printf("remote write\n");
case 1:
printf("local write\n");
local = 1;
case 2:
printf("remote read\n");
read = 1;
case 3:
printf("local read\n");
local = 1;
read = 1;

mask = CPU_ALLOC(nrcpus);
size = CPU_ALLOC_SIZE(nrcpus);
CPU_ZERO_S(size, mask);

node = opendir("/sys/devices/system/node/node0/");
if (!node)
while ((de = readdir(node))) {
int cpu;

if (sscanf(de->d_name, "cpu%d", &cpu) == 1)
CPU_SET_S(cpu, size, mask);

mask2 = CPU_ALLOC(nrcpus);
CPU_ZERO_S(size, mask2);
for (i = 0; i < size; i++)
CPU_SET_S(i, size, mask2);
CPU_XOR_S(size, mask2, mask2, mask); // invert

if (!local)
mask = mask2;

err = sched_setaffinity(0, size, mask);
if (err)

err = mbind(mem, SIZE, MPOL_BIND, &nodemask, 8*sizeof(nodemask), MPOL_MF_MOVE);
if (err)

signal(SIGALRM, sig_done);

if (!read) {
while (!done) {
for (i = 0; i < SIZE; i++)
mem[i] = 0x01;
} else {
while (!done) {
for (i = 0; i < SIZE; i++)
t += *(volatile char *)(mem + i);

return 0;

Signed-off-by: Peter Zijlstra <>
Cc: Stephane Eranian <>
Signed-off-by: Ingo Molnar <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agort2x00: fix random stalls
Stanislaw Gruszka [Fri, 9 Mar 2012 11:39:54 +0000 (12:39 +0100)]
rt2x00: fix random stalls

commit 3780d038fdf4b5ef26ead10b0604ab1f46dd9510 upstream.

Is possible that we stop queue and then do not wake up it again,
especially when packets are transmitted fast. That can be easily
reproduced with modified tx queue entry_num to some small value e.g. 16.

If mac80211 already hold local->queue_stop_reason_lock, then we can wait
on that lock in both rt2x00queue_pause_queue() and
rt2x00queue_unpause_queue(). After drooping ->queue_stop_reason_lock
is possible that __ieee80211_wake_queue() will be performed before
__ieee80211_stop_queue(), hence we stop queue and newer wake up it

Another race condition is possible when between rt2x00queue_threshold()
check and rt2x00queue_pause_queue() we will process all pending tx
buffers on different cpu. This might happen if for example interrupt
will be triggered on cpu performing rt2x00mac_tx().

To prevent race conditions serialize pause/unpause by queue->tx_lock.

Signed-off-by: Stanislaw Gruszka <>
Acked-by: Gertjan van Wingerde <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoomap3isp: ccdc: Fix crash in HS/VS interrupt handler
Laurent Pinchart [Fri, 11 Nov 2011 14:22:20 +0000 (11:22 -0300)]
omap3isp: ccdc: Fix crash in HS/VS interrupt handler

commit bd0f2e6da7ea9e225cb2dbd3229e25584b0e9538 upstream.

The HS/VS interrupt handler needs to access the pipeline object. It
erronously tries to get it from the CCDC output video node, which isn't
necessarily included in the pipeline. This leads to a NULL pointer

Fix the bug by getting the pipeline object from the CCDC subdev entity.

Reported-by: Gary Thomas <>
Signed-off-by: Laurent Pinchart <>
Acked-by: Sakari Ailus <>
Signed-off-by: Mauro Carvalho Chehab <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoPCI: ignore pre-1.1 ASPM quirking when ASPM is disabled
Matthew Garrett [Tue, 6 Mar 2012 18:41:49 +0000 (13:41 -0500)]
PCI: ignore pre-1.1 ASPM quirking when ASPM is disabled

commit 4949be16822e92a18ea0cc1616319926628092ee upstream.

Right now we won't touch ASPM state if ASPM is disabled, except in the case
where we find a device that appears to be too old to reliably support ASPM.
Right now we'll clear it in that case, which is almost certainly the wrong
thing to do. The easiest way around this is just to disable the blacklisting
when ASPM is disabled.

Signed-off-by: Matthew Garrett <>
Signed-off-by: Jesse Barnes <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agox86: Derandom delay_tsc for 64 bit
Thomas Gleixner [Fri, 9 Mar 2012 19:55:10 +0000 (20:55 +0100)]
x86: Derandom delay_tsc for 64 bit

commit a7f4255f906f60f72e00aad2fb000939449ff32e upstream.

Commit f0fbf0abc093 ("x86: integrate delay functions") converted
delay_tsc() into a random delay generator for 64 bit.  The reason is
that it merged the mostly identical versions of delay_32.c and
delay_64.c.  Though the subtle difference of the result was:

 static void delay_tsc(unsigned long loops)
- unsigned bclock, now;
+ unsigned long bclock, now;

Now the function uses rdtscl() which returns the lower 32bit of the
TSC. On 32bit that's not problematic as unsigned long is 32bit. On 64
bit this fails when the lower 32bit are close to wrap around when
bclock is read, because the following check

       if ((now - bclock) >= loops)

evaluated to true on 64bit for e.g. bclock = 0xffffffff and now = 0
because the unsigned long (now - bclock) of these values results in
0xffffffff00000001 which is definitely larger than the loops
value. That explains Tvortkos observation:

"Because I am seeing udelay(500) (_occasionally_) being short, and
 that by delaying for some duration between 0us (yep) and 491us."

Make those variables explicitely u32 again, so this works for both 32
and 64 bit.

Reported-by: Tvrtko Ursulin <>
Signed-off-by: Thomas Gleixner <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoaio: fix the "too late munmap()" race
Al Viro [Thu, 8 Mar 2012 17:51:19 +0000 (17:51 +0000)]
aio: fix the "too late munmap()" race

commit c7b285550544c22bc005ec20978472c9ac7138c6 upstream.

Current code has put_ioctx() called asynchronously from aio_fput_routine();
that's done *after* we have killed the request that used to pin ioctx,
so there's nothing to stop io_destroy() waiting in wait_for_all_aios()
from progressing.  As the result, we can end up with async call of
put_ioctx() being the last one and possibly happening during exit_mmap()
or elf_core_dump(), neither of which expects stray munmap() being done
to them...

We do need to prevent _freeing_ ioctx until aio_fput_routine() is done
with that, but that's all we care about - neither io_destroy() nor
exit_aio() will progress past wait_for_all_aios() until aio_fput_routine()
does really_put_req(), so the ioctx teardown won't be done until then
and we don't care about the contents of ioctx past that point.

Since actual freeing of these suckers is RCU-delayed, we don't need to
bump ioctx refcount when request goes into list for async removal.
All we need is rcu_read_lock held just over the ->ctx_lock-protected
area in aio_fput_routine().

Signed-off-by: Al Viro <>
Reviewed-by: Jeff Moyer <>
Acked-by: Benjamin LaHaise <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoaio: fix io_setup/io_destroy race
Al Viro [Wed, 7 Mar 2012 05:16:35 +0000 (05:16 +0000)]
aio: fix io_setup/io_destroy race

commit 86b62a2cb4fc09037bbce2959d2992962396fd7f upstream.

Have ioctx_alloc() return an extra reference, so that caller would drop it
on success and not bother with re-grabbing it on failure exit.  The current
code is obviously broken - io_destroy() from another thread that managed
to guess the address io_setup() would've returned would free ioctx right
under us; gets especially interesting if aio_context_t * we pass to
io_setup() points to PROT_READ mapping, so put_user() fails and we end
up doing io_destroy() on kioctx another thread has just got freed...

Signed-off-by: Al Viro <>
Acked-by: Benjamin LaHaise <>
Reviewed-by: Jeff Moyer <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoALSA: hda/realtek - Apply the coef-setup only to ALC269VB
Kailang Yang [Wed, 7 Mar 2012 07:25:20 +0000 (08:25 +0100)]
ALSA: hda/realtek - Apply the coef-setup only to ALC269VB

commit 526af6eb4dc71302f59806e2ccac7793963a7fe0 upstream.

The coef setup in alc269_fill_coef() was designed only for ALC269VB
model, and this has some bad effects for other ALC269 variants, such
as turning off the external mic input.  Apply it only to ALC269VB.

Signed-off-by: Kailang Yang <>
Signed-off-by: Takashi Iwai <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoASoC: neo1973: fix neo1973 wm8753 initialization
Denis 'GNUtoo' Carikli [Sun, 26 Feb 2012 18:21:54 +0000 (19:21 +0100)]
ASoC: neo1973: fix neo1973 wm8753 initialization

commit b2ccf065f7b23147ed135a41b01d05a332ca6b7e upstream.

The neo1973 driver had wrong codec name which prevented the "sound card"
from appearing.

Signed-off-by: Denis 'GNUtoo' Carikli <>
Signed-off-by: Mark Brown <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoLinux 3.2.11 v3.2.11
Greg Kroah-Hartman [Tue, 13 Mar 2012 17:05:09 +0000 (10:05 -0700)]
Linux 3.2.11

9 years agoRevert "mfd: Test for jack detection when deciding if wm8994 should suspend"
Greg Kroah-Hartman [Tue, 13 Mar 2012 16:36:07 +0000 (09:36 -0700)]
Revert "mfd: Test for jack detection when deciding if wm8994 should suspend"

This reverts commit 315e73b400c9a287a53efb5f857d308589674ac5 as it
breaks the 3.2-stable build.

Reported-by: Ben Guthro <>
Cc: Mark Brown <>
Cc: Samuel Ortiz <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoLinux 3.2.10 v3.2.10
Greg Kroah-Hartman [Mon, 12 Mar 2012 20:22:49 +0000 (13:22 -0700)]
Linux 3.2.10

9 years agoARM: OMAP: fix iommu, not mailbox
Ohad Ben-Cohen [Sun, 4 Mar 2012 10:01:11 +0000 (12:01 +0200)]
ARM: OMAP: fix iommu, not mailbox

commit 134d12fae0bb8f3d60dc7440a9e1950bb5427167 upstream.

For some weird (freudian?) reason, commit 435792d "ARM: OMAP: make
iommu subsys_initcall to fix builtin omap3isp" unintentionally changed
the mailbox's initcall instead of the iommu's.

Fix that.

Reported-by: Fernando Guzman Lugo <>
Signed-off-by: Ohad Ben-Cohen <>
Cc: Laurent Pinchart <>
Cc: Joerg Roedel <>
Cc: Tony Lindgren <>
Signed-off-by: Joerg Roedel <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agospi-topcliff-pch: rename pch_spi_pcidev to pch_spi_pcidev_driver
Danny Kukawka [Thu, 2 Feb 2012 13:20:30 +0000 (14:20 +0100)]
spi-topcliff-pch: rename pch_spi_pcidev to pch_spi_pcidev_driver

commit c88db233251b026fda775428f0250c760553e216 upstream.

Rename static struct pci_driver pch_spi_pcidev to
pch_spi_pcidev_driver to get rid of warnings from modpost checks.

Signed-off-by: Danny Kukawka <>
Signed-off-by: Grant Likely <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agomfd: Fix cs5535 section mismatch
Christian Gmeiner [Tue, 13 Dec 2011 20:30:04 +0000 (21:30 +0100)]
mfd: Fix cs5535 section mismatch

commit 97e43c983c721a47546e6db3b7711dcd912a6481 upstream.

Silence following warnings:
WARNING: drivers/mfd/cs5535-mfd.o(.data+0x20): Section mismatch in
reference from the variable cs5535_mfd_drv to the function
The variable cs5535_mfd_drv references
the function __devinit cs5535_mfd_probe()
If the reference is valid then annotate the
variable with __init* or __refdata (see linux/init.h) or name the variable:
*driver, *_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console

WARNING: drivers/mfd/cs5535-mfd.o(.data+0x28): Section mismatch in
reference from the variable cs5535_mfd_drv to the function
The variable cs5535_mfd_drv references
the function __devexit cs5535_mfd_remove()
If the reference is valid then annotate the
variable with __exit* (see linux/init.h) or name the variable:
*driver, *_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console

Rename the variable from *_drv to *_driver so
modpost ignore the OK references to __devinit/__devexit

Signed-off-by: Christian Gmeiner <>
Acked-by: Andres Salomon <>
Signed-off-by: Samuel Ortiz <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agocs5535-mfgpt: don't call __init function from __devinit
Danny Kukawka [Thu, 2 Feb 2012 13:20:29 +0000 (14:20 +0100)]
cs5535-mfgpt: don't call __init function from __devinit

commit 474de3bbadd9cb75ffc32cc759c40d868343d46c upstream.

Fix scan_timers() to be __devinit and not __init since
the function get called from cs5535_mfgpt_probe which is

Signed-off-by: Danny Kukawka <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodm raid: fix flush support
Jonathan E Brassow [Wed, 7 Mar 2012 19:09:48 +0000 (19:09 +0000)]
dm raid: fix flush support

commit 0ca93de9b789e0eb05e103f0c04de72df13da73a upstream.

Fix dm-raid flush support.

Both md and dm have support for flush, but the dm-raid target
forgot to set the flag to indicate that flushes should be
passed on.  (Important for data integrity e.g. with writeback cache

Signed-off-by: Jonathan Brassow <>
Acked-by: Mike Snitzer <>
Signed-off-by: Alasdair G Kergon <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodm raid: set MD_CHANGE_DEVS when rebuilding
Jonathan E Brassow [Wed, 7 Mar 2012 19:09:47 +0000 (19:09 +0000)]
dm raid: set MD_CHANGE_DEVS when rebuilding

commit 3aa3b2b2b1edb813dc5342d0108befc39541542d upstream.

The 'rebuild' parameter is used to rebuild individual devices in an
array (e.g. resynchronize a RAID1 device or recalculate a parity device
in higher RAID).  The MD_CHANGE_DEVS flag must be set when this
parameter is given in order to write out the superblocks and make the
change take immediate effect.  The code that handles new devices in
super_load already sets MD_CHANGE_DEVS and 'FirstUse'.  (The 'FirstUse'
flag was being set as a special case for rebuilds in

Add a condition for rebuilds in super_load to take care of both flags
without the special case in 'super_init_validation'.

Signed-off-by: Jonathan Brassow <>
Signed-off-by: Alasdair G Kergon <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodm thin metadata: decrement counter after removing mapped block
Joe Thornber [Wed, 7 Mar 2012 19:09:44 +0000 (19:09 +0000)]
dm thin metadata: decrement counter after removing mapped block

commit af63bcb817cf708f53bcae6edc2e3fb7dd7d8051 upstream.

Correct the number of mapped sectors shown on a thin device's
status line by decrementing td->mapped_blocks in __remove() each time
a block is removed.

Signed-off-by: Joe Thornber <>
Acked-by: Mike Snitzer <>
Signed-off-by: Alasdair G Kergon <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodm thin metadata: unlock superblock in init_pmd error path
Joe Thornber [Wed, 7 Mar 2012 19:09:43 +0000 (19:09 +0000)]
dm thin metadata: unlock superblock in init_pmd error path

commit 4469a5f387fdde956894137751a41473618a4a52 upstream.

If dm_sm_disk_create() fails the superblock must be unlocked.

Signed-off-by: Joe Thornber <>
Acked-by: Mike Snitzer <>
Signed-off-by: Alasdair G Kergon <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodm thin metadata: remove incorrect close_device on creation error paths
Mike Snitzer [Wed, 7 Mar 2012 19:09:41 +0000 (19:09 +0000)]
dm thin metadata: remove incorrect close_device on creation error paths

commit 1f3db25d8be4ac50b897b39609802183ea68a514 upstream.

The __open_device() error paths in __create_thin() and __create_snap()
incorrectly call __close_device() even if td was not initialized by
__open_device().  Remove this.

Also document __open_device() return values, remove a redundant
td->changed = 1 in __create_thin(), and insert an additional
safeguard against creating an already-existing device.

Signed-off-by: Mike Snitzer <>
Signed-off-by: Alasdair G Kergon <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodm flakey: fix crash on read when corrupt_bio_byte not set
Mike Snitzer [Wed, 7 Mar 2012 19:09:39 +0000 (19:09 +0000)]
dm flakey: fix crash on read when corrupt_bio_byte not set

commit 1212268fd9816e3b8801e57b896fceaec71969ad upstream.

The following BUG is hit on the first read that is submitted to a dm
flakey test device while the device is "down" if the corrupt_bio_byte
feature wasn't requested when the device's table was loaded.

Example DM table that will hit this BUG:
0 2097152 flakey 8:0 2048 0 30

This bug was introduced by commit a3998799fb4df0b0af8271a7d50c4269032397aa
(dm flakey: add corrupt_bio_byte feature) in v3.1-rc1.

BUG: unable to handle kernel paging request at ffff8801cfce3fff
IP: [<ffffffffa008c233>] corrupt_bio_data+0x6e/0xae [dm_flakey]
PGD 1606063 PUD 0
Oops: 0002 [#1] SMP
Call Trace:
 [<ffffffffa008c2b5>] flakey_end_io+0x42/0x48 [dm_flakey]
 [<ffffffffa00dca98>] clone_endio+0x54/0xb6 [dm_mod]
 [<ffffffff81130587>] bio_endio+0x2d/0x2f
 [<ffffffff811c819a>] req_bio_endio+0x96/0x9f
 [<ffffffff811c94b9>] blk_update_request+0x1dc/0x3a9
 [<ffffffff812f5ee2>] ? rcu_read_unlock+0x21/0x23
 [<ffffffff811c96a6>] blk_update_bidi_request+0x20/0x6e
 [<ffffffff811c9713>] blk_end_bidi_request+0x1f/0x5d
 [<ffffffff811c978d>] blk_end_request+0x10/0x12
 [<ffffffff8128f450>] scsi_io_completion+0x1e5/0x4b1
 [<ffffffff812882a9>] scsi_finish_command+0xec/0xf5
 [<ffffffff8128f830>] scsi_softirq_done+0xff/0x108
 [<ffffffff811ce284>] blk_done_softirq+0x84/0x98
 [<ffffffff81048d19>] __do_softirq+0xe3/0x1d5
 [<ffffffff8138f83f>] ? _raw_spin_lock+0x62/0x69
 [<ffffffff810997cf>] ? handle_irq_event+0x4c/0x61
 [<ffffffff8139833c>] call_softirq+0x1c/0x30
 [<ffffffff81003b37>] do_softirq+0x4b/0xa3
 [<ffffffff81048a39>] irq_exit+0x53/0xca
 [<ffffffff81398acd>] do_IRQ+0x9d/0xb4
 [<ffffffff81390333>] common_interrupt+0x73/0x73

Signed-off-by: Mike Snitzer <>
Signed-off-by: Alasdair G Kergon <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodm io: fix discard support
Milan Broz [Wed, 7 Mar 2012 19:09:37 +0000 (19:09 +0000)]
dm io: fix discard support

commit 0c535e0d6f463365c29623350dbd91642363c39b upstream.

This patch fixes a crash by recognising discards in dm_io.

Currently dm_mirror can send REQ_DISCARD bios if running over a
discard-enabled device and without support in dm_io the system
crashes badly.

BUG: unable to handle kernel paging request at 00800000
IP:  __bio_add_page.part.17+0xf5/0x1e0
 dispatch_io+0x1cf/0x240 [dm_mod]
 ? km_get_page+0x50/0x50 [dm_mod]
 ? vm_next_page+0x20/0x20 [dm_mod]
 ? mirror_flush+0x130/0x130 [dm_mirror]
 dm_io+0xdc/0x2b0 [dm_mod]

Introduced in 2.6.38-rc1 by commit 5fc2ffeabb9ee0fc0e71ff16b49f34f0ed3d05b4
(dm raid1: support discard).

Signed-off-by: Milan Broz <>
Acked-by: Mike Snitzer <>
Signed-off-by: Alasdair G Kergon <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodm ioctl: do not leak argv if target message only contains whitespace
Jesper Juhl [Wed, 7 Mar 2012 19:09:34 +0000 (19:09 +0000)]
dm ioctl: do not leak argv if target message only contains whitespace

commit 902c6a96a7cb9c50d2a8aed1788efad0a5d8f04c upstream.

If 'argc' is zero we jump to the 'out:' label, but this leaks the
(unused) memory that 'dm_split_args()' allocated for 'argv' if the
string being split consisted entirely of whitespace.  Jump to the
'out_argv:' label instead to free up that memory.

Signed-off-by: Jesper Juhl <>
Signed-off-by: Alasdair G Kergon <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agox86/amd: iommu_set_device_table() must not be __init
Jan Beulich [Thu, 8 Mar 2012 08:58:13 +0000 (08:58 +0000)]
x86/amd: iommu_set_device_table() must not be __init

commit 6b7f000eb6a0b81d7a809833edb7a457eedf8512 upstream.

This function is called from enable_iommus(), which in turn is used
from amd_iommu_resume().

Signed-off-by: Jan Beulich <>
Signed-off-by: Joerg Roedel <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agonet/usbnet: avoid recursive locking in usbnet_stop()
Sebastian Siewior [Wed, 7 Mar 2012 10:19:28 +0000 (10:19 +0000)]
net/usbnet: avoid recursive locking in usbnet_stop()

commit 4231d47e6fe69f061f96c98c30eaf9fb4c14b96d upstream.

|kernel BUG at kernel/rtmutex.c:724!
|[<c029599c>] (rt_spin_lock_slowlock+0x108/0x2bc) from [<c01c2330>] (defer_bh+0x1c/0xb4)
|[<c01c2330>] (defer_bh+0x1c/0xb4) from [<c01c3afc>] (rx_complete+0x14c/0x194)
|[<c01c3afc>] (rx_complete+0x14c/0x194) from [<c01cac88>] (usb_hcd_giveback_urb+0xa0/0xf0)
|[<c01cac88>] (usb_hcd_giveback_urb+0xa0/0xf0) from [<c01e1ff4>] (musb_giveback+0x34/0x40)
|[<c01e1ff4>] (musb_giveback+0x34/0x40) from [<c01e2b1c>] (musb_advance_schedule+0xb4/0x1c0)
|[<c01e2b1c>] (musb_advance_schedule+0xb4/0x1c0) from [<c01e2ca8>] (musb_cleanup_urb.isra.9+0x80/0x8c)
|[<c01e2ca8>] (musb_cleanup_urb.isra.9+0x80/0x8c) from [<c01e2ed0>] (musb_urb_dequeue+0xec/0x108)
|[<c01e2ed0>] (musb_urb_dequeue+0xec/0x108) from [<c01cbb90>] (unlink1+0xbc/0xcc)
|[<c01cbb90>] (unlink1+0xbc/0xcc) from [<c01cc2ec>] (usb_hcd_unlink_urb+0x54/0xa8)
|[<c01cc2ec>] (usb_hcd_unlink_urb+0x54/0xa8) from [<c01c2a84>] (unlink_urbs.isra.17+0x2c/0x58)
|[<c01c2a84>] (unlink_urbs.isra.17+0x2c/0x58) from [<c01c2b44>] (usbnet_terminate_urbs+0x94/0x10c)
|[<c01c2b44>] (usbnet_terminate_urbs+0x94/0x10c) from [<c01c2d68>] (usbnet_stop+0x100/0x15c)
|[<c01c2d68>] (usbnet_stop+0x100/0x15c) from [<c020f718>] (__dev_close_many+0x94/0xc8)

defer_bh() takes the lock which is hold during unlink_urbs(). The safe
walk suggest that the skb will be removed from the list and this is done
by defer_bh() so it seems to be okay to drop the lock here.

Reported-by: Aníbal Almeida Pinto <>
Signed-off-by: Sebastian Andrzej Siewior <>
Acked-by: Oliver Neukum <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodrm/radeon/kms: set SX_MISC in the r6xx blit code (v2)
Marek Olšák [Wed, 7 Mar 2012 22:33:00 +0000 (23:33 +0100)]
drm/radeon/kms: set SX_MISC in the r6xx blit code (v2)

commit cf00790dea6f210ddd01a6656da58c7c9a4ea0e4 upstream.

Mesa may set it to 1, causing all primitives to be killed.

v2: also update the r7xx code

Signed-off-by: Marek Olšák <>
Reviewed-by: Alex Deucher <>
Signed-off-by: Dave Airlie <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agocarl9170: fix frame delivery if sta is in powersave mode
Christian Lamparter [Sat, 25 Feb 2012 20:36:36 +0000 (21:36 +0100)]
carl9170: fix frame delivery if sta is in powersave mode

commit 9926a67557532acb6cddb1c1add02952175b5c72 upstream.

Nicolas Cavallari discovered that carl9170 has some
serious problems delivering data to sleeping stations.

It turns out that the driver was not honoring two
important flags (IEEE80211_TX_CTL_POLL_RESPONSE and
IEEE80211_TX_CTL_CLEAR_PS_FILT) which are set on
frames that should be sent although the receiving
station is still in powersave mode.

Reported-by: Nicolas Cavallari <>
Signed-off-by: Christian Lamparter <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agocarl9170: Fix memory accounting when sta is in power-save mode.
Nicolas Cavallari [Thu, 23 Feb 2012 15:53:34 +0000 (16:53 +0100)]
carl9170: Fix memory accounting when sta is in power-save mode.

commit 992d52529d7840236d3059b51c15d5eb9e81a869 upstream.

On Access Point mode, when transmitting a packet, if the destination
station is in powersave mode, we abort transmitting the packet to the
device queue, but we do not reclaim the allocated memory.  Given enough
packets, we can go in a state where there is no packet on the device
queue, but we think the device has no memory left, so no packet gets
transmitted, connections breaks and the AP stops working.

This undo the allocation done in the TX path when the station is in
power-save mode.

Signed-off-by: Nicolas Cavallari <>
Acked-by: Christian Lamparter <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agohwmon: (zl6100) Maintain delay parameter in driver instance data
Guenter Roeck [Wed, 7 Mar 2012 11:58:55 +0000 (03:58 -0800)]
hwmon: (zl6100) Maintain delay parameter in driver instance data

commit 7ad6307ad6968ce25cecf209d4822d4c722be030 upstream.

A global delay parameter has the side effect of being overwritten with 0 if a
single ZL2004 or ZL6105 is instantiated. If other chips supported by the same
driver are in the system, this will result in access errors for those chips.

To solve the problem, keep a per-instance copy of the delay parameter, and do
not change the original parameter.

Signed-off-by: Guenter Roeck <>
Acked-by: Jean Delvare <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agohwmon: (jc42) Add support for AT30TS00, TS3000GB2, TSE2002GB2, and MCP9804
Guenter Roeck [Mon, 5 Mar 2012 19:13:52 +0000 (11:13 -0800)]
hwmon: (jc42) Add support for AT30TS00, TS3000GB2, TSE2002GB2, and MCP9804

commit 1bd612a25855f4cc9345052b53d7da697dba6358 upstream.

Also update IDT datasheet locations.

Signed-off-by: Guenter Roeck <>
Acked-by: Jean Delvare <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agohwmon: (jc42) Add support for ST Microelectronics STTS2002 and STTS3000
Jean Delvare [Mon, 5 Mar 2012 13:32:00 +0000 (08:32 -0500)]
hwmon: (jc42) Add support for ST Microelectronics STTS2002 and STTS3000

commit 4de86126a712ba83fa038d277c8282f7ed466a4b upstream.

These are fully compatible with Jedec JC 42.4 as far as I can see.

Signed-off-by: Jean Delvare <>
Cc: Guenter Roeck <>
Signed-off-by: Guenter Roeck <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agohwmon: (pmbus_core) Fix maximum number of POUT alarm attributes
Guenter Roeck [Sun, 4 Mar 2012 16:10:57 +0000 (08:10 -0800)]
hwmon: (pmbus_core) Fix maximum number of POUT alarm attributes

commit 7cb3c44fb1f7999e4c53b6a52de6bc25da6de079 upstream.

There are up to three POUT alarm attributes, not two, since cap_alarm was added.

Reported-by: Michele Petracca <>
Signed-off-by: Guenter Roeck <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoInput: ALPS - fix touchpad detection when buttons are pressed
Akio Idehara [Thu, 8 Mar 2012 19:48:12 +0000 (13:48 -0600)]
Input: ALPS - fix touchpad detection when buttons are pressed

commit 99c90ab31fad855b9da9dee3a5aa6c27f263e9d6 upstream.

ALPS touchpad detection fails if some buttons of ALPS are pressed.
The reason is that the "E6" query response byte is different from
what is expected.

This was tested on a Toshiba Portege R500.

Signed-off-by: Akio Idehara <>
Tested-by: Seth Forshee <>
Signed-off-by: Dmitry Torokhov <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agomedia: staging: lirc_serial: Do not assume error codes returned by request_irq()
Ben Hutchings [Wed, 16 Nov 2011 04:54:04 +0000 (01:54 -0300)]
media: staging: lirc_serial: Do not assume error codes returned by request_irq()

commit affc9a0d59ac49bd304e2137bd5e4ffdd6fdfa52 upstream.

lirc_serial_probe() must fail if request_irq() returns an error, even if
it isn't EBUSY or EINVAL,

Signed-off-by: Ben Hutchings <>
Signed-off-by: Mauro Carvalho Chehab <>
Signed-off-by: Jonathan Nieder <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agomedia: staging: lirc_serial: Fix deadlock on resume failure
Ben Hutchings [Wed, 16 Nov 2011 04:53:25 +0000 (01:53 -0300)]
media: staging: lirc_serial: Fix deadlock on resume failure

commit 1ff1d88e862948ae5bfe490248c023ff8ac2855d upstream.

A resume function cannot remove the device it is resuming!

Signed-off-by: Ben Hutchings <>
Signed-off-by: Mauro Carvalho Chehab <>
Signed-off-by: Jonathan Nieder <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agomedia: staging: lirc_serial: Free resources on failure paths of lirc_serial_probe()
Ben Hutchings [Wed, 16 Nov 2011 04:52:11 +0000 (01:52 -0300)]
media: staging: lirc_serial: Free resources on failure paths of lirc_serial_probe()

commit c8e57e1b766c2321aa76ee5e6878c69bd2313d62 upstream.

Failure to allocate the I/O region leaves the IRQ allocated.
A later failure leaves them both allocated.

Reported-by: Torsten Crass <>
Signed-off-by: Ben Hutchings <>
Signed-off-by: Mauro Carvalho Chehab <>
Signed-off-by: Jonathan Nieder <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agomedia: staging: lirc_serial: Fix init/exit order
Ben Hutchings [Wed, 16 Nov 2011 04:49:41 +0000 (01:49 -0300)]
media: staging: lirc_serial: Fix init/exit order

commit 9105b8b200410383d0854bbe237ee385d7d33ba6 upstream.

Currently the module init function registers a platform_device and
only then allocates its IRQ and I/O region.  This allows allocation to
race with the device's suspend() function.  Instead, allocate
resources in the platform driver's probe() function and free them in
the remove() function.

The module exit function removes the platform device before the
character device that provides access to it.  Change it to reverse the
order of initialisation.

Signed-off-by: Ben Hutchings <>
Signed-off-by: Mauro Carvalho Chehab <>
Signed-off-by: Jonathan Nieder <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoARM: 7357/1: perf: fix overflow handling for xscale2 PMUs
Will Deacon [Tue, 6 Mar 2012 16:35:55 +0000 (17:35 +0100)]
ARM: 7357/1: perf: fix overflow handling for xscale2 PMUs

commit 3f31ae121348afd9ed39700ea2a63c17cd7eeed1 upstream.

xscale2 PMUs indicate overflow not via the PMU control register, but by
a separate overflow FLAG register instead.

This patch fixes the xscale2 PMU code to use this register to detect
to overflow and ensures that we clear any pending overflow when
disabling a counter.

Signed-off-by: Will Deacon <>
Signed-off-by: Russell King <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoARM: 7356/1: perf: check that we have an event in the PMU IRQ handlers
Will Deacon [Tue, 6 Mar 2012 16:34:50 +0000 (17:34 +0100)]
ARM: 7356/1: perf: check that we have an event in the PMU IRQ handlers

commit f6f5a30c834135c9f2fa10400c59ebbdd9188567 upstream.

The PMU IRQ handlers in perf assume that if a counter has overflowed
then perf must be responsible. In the paranoid world of crazy hardware,
this could be false, so check that we do have a valid event before
attempting to dereference NULL in the interrupt path.

Signed-off-by: Ming Lei <>
Signed-off-by: Will Deacon <>
Signed-off-by: Russell King <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoARM: 7355/1: perf: clear overflow flag when disabling counter on ARMv7 PMU
Will Deacon [Tue, 6 Mar 2012 16:34:22 +0000 (17:34 +0100)]
ARM: 7355/1: perf: clear overflow flag when disabling counter on ARMv7 PMU

commit 99c1745b9c76910e195889044f914b4898b7c9a5 upstream.

When disabling a counter on an ARMv7 PMU, we should also clear the
overflow flag in case an overflow occurred whilst stopping the counter.
This prevents a spurious overflow being picked up later and leading to
either false accounting or a NULL dereference.

Reported-by: Ming Lei <>
Signed-off-by: Will Deacon <>
Signed-off-by: Russell King <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoARM: 7354/1: perf: limit sample_period to half max_period in non-sampling mode
Will Deacon [Tue, 6 Mar 2012 16:33:17 +0000 (17:33 +0100)]
ARM: 7354/1: perf: limit sample_period to half max_period in non-sampling mode

commit 5727347180ebc6b4a866fcbe00dcb39cc03acb37 upstream.

On ARM, the PMU does not stop counting after an overflow and therefore
IRQ latency affects the new counter value read by the kernel. This is
significant for non-sampling runs where it is possible for the new value
to overtake the previous one, causing the delta to be out by up to
max_period events.

Commit a737823d ("ARM: 6835/1: perf: ensure overflows aren't missed due
to IRQ latency") attempted to fix this problem by allowing interrupt
handlers to pass an overflow flag to the event update function, causing
the overflow calculation to assume that the counter passed through zero
when going from prev to new. Unfortunately, this doesn't work when
overflow occurs on the perf_task_tick path because we have the flag
cleared and end up computing a large negative delta.

This patch removes the overflow flag from armpmu_event_update and
instead limits the sample_period to half of the max_period for
non-sampling profiling runs.

Signed-off-by: Ming Lei <>
Signed-off-by: Will Deacon <>
Signed-off-by: Russell King <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoARM: 7345/1: errata: update workaround for A9 erratum #743622
Will Deacon [Fri, 24 Feb 2012 11:12:38 +0000 (12:12 +0100)]
ARM: 7345/1: errata: update workaround for A9 erratum #743622

commit efbc74ace95338484f8d732037b99c7c77098fce upstream.

Erratum #743622 affects all r2 variants of the Cortex-A9 processor, so
ensure that the workaround is applied regardless of the revision.

Reported-by: Russell King <>
Signed-off-by: Will Deacon <>
Signed-off-by: Russell King <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoOMAPDSS: HDMI: hot plug detect fix
Rob Clark [Mon, 20 Feb 2012 21:03:36 +0000 (15:03 -0600)]
OMAPDSS: HDMI: hot plug detect fix

commit ca888a7958b3d808e4efd08ceff88913f4212c69 upstream.

The "OMAPDSS: HDMI: PHY burnout fix" commit switched the HDMI driver
over to using a GPIO for plug detect.  Unfortunately the ->detect()
method was not also updated, causing HDMI to no longer work for the
omapdrm driver (because it would actually check if a connection was
detected before attempting to enable display).

Signed-off-by: Rob Clark <>
Signed-off-by: Tomi Valkeinen <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoOMAPDSS: HDMI: PHY burnout fix
Tomi Valkeinen [Tue, 17 Jan 2012 09:09:57 +0000 (11:09 +0200)]
OMAPDSS: HDMI: PHY burnout fix

commit c49d005b6cc8491fad5b24f82805be2d6bcbd3dd upstream.

A hardware bug in the OMAP4 HDMI PHY causes physical damage to the board
if the HDMI PHY is kept powered on when the cable is not connected.

This patch solves the problem by adding hot-plug-detection into the HDMI
IP driver. This is not a real HPD support in the sense that nobody else
than the IP driver gets to know about the HPD events, but is only meant
to fix the HW bug.

The strategy is simple: If the display device is turned off by the user,
the PHY power is set to OFF. When the display device is turned on by the
user, the PHY power is set either to LDOON or TXON, depending on whether
the HDMI cable is connected.

The reason to avoid PHY OFF when the display device is on, but the cable
is disconnected, is that when the PHY is turned OFF, the HDMI IP is not
"ticking" and thus the DISPC does not receive pixel clock from the HDMI
IP. This would, for example, prevent any VSYNCs from happening, and
would thus affect the users of omapdss. By using LDOON when the cable is
disconnected we'll avoid the HW bug, but keep the HDMI working as usual
from the user's point of view.

Signed-off-by: Tomi Valkeinen <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoOMAP: 4430SDP/Panda: add HDMI HPD gpio
Tomi Valkeinen [Tue, 17 Jan 2012 09:05:32 +0000 (11:05 +0200)]
OMAP: 4430SDP/Panda: add HDMI HPD gpio

commit aa74274b464d4aa24703963ac89a0ee942d5d267 upstream.

Both Panda and 4430SDP use GPIO 63 as HDMI hot-plug-detect. Configure
this GPIO in the board files.

Signed-off-by: Tomi Valkeinen <>
Acked-by: Tony Lindgren <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoOMAP: 4430SDP/Panda: setup HDMI GPIO muxes
Tomi Valkeinen [Tue, 17 Jan 2012 09:02:36 +0000 (11:02 +0200)]
OMAP: 4430SDP/Panda: setup HDMI GPIO muxes

commit 78a1ad8f12db70b8b0a4548b90704de08ee216ce upstream.

The HDMI GPIO pins LS_OE and CT_CP_HPD are not currently configured.
This patch configures them as output pins.

Signed-off-by: Tomi Valkeinen <>
Acked-by: Tony Lindgren <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoOMAPDSS: remove wrong HDMI HPD muxing
Tomi Valkeinen [Tue, 17 Jan 2012 08:59:00 +0000 (10:59 +0200)]
OMAPDSS: remove wrong HDMI HPD muxing

commit 7bb122d155f742fe2d79849090c825be7b4a247e upstream.

"hdmi_hpd" pin is muxed to INPUT and PULLUP, but the pin is not
currently used, and in the future when it is used, the pin is used as a
GPIO and is board specific, not an OMAP4 wide thing.

So remove the muxing for now.

Signed-off-by: Tomi Valkeinen <>
Acked-by: Tony Lindgren <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoOMAP: 4430SDP/Panda: rename HPD GPIO to CT_CP_HPD
Tomi Valkeinen [Tue, 17 Jan 2012 08:49:38 +0000 (10:49 +0200)]
OMAP: 4430SDP/Panda: rename HPD GPIO to CT_CP_HPD

commit 3932a32fcf5393f8be70ac99dc718ad7ad0a415b upstream.

The GPIO 60 on 4430sdp and Panda is not HPD GPIO, as currently marked in
the board files, but CT_CP_HPD, which is used to enable/disable HPD

This patch renames the GPIO.

Signed-off-by: Tomi Valkeinen <>
Acked-by: Tony Lindgren <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoOMAP: 4430SDP/Panda: use gpio_free_array to free HDMI gpios
Tomi Valkeinen [Tue, 17 Jan 2012 09:04:53 +0000 (11:04 +0200)]
OMAP: 4430SDP/Panda: use gpio_free_array to free HDMI gpios

commit 575753e3bea3b67eef8e454fb87f719e3f7da599 upstream.

Instead of freeing the GPIOs individually, use gpio_free_array().

Signed-off-by: Tomi Valkeinen <>
Acked-by: Tony Lindgren <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoARM: orion: Fix Orion5x GPIO regression from MPP cleanup
Andrew Lunn [Wed, 8 Feb 2012 14:52:07 +0000 (15:52 +0100)]
ARM: orion: Fix Orion5x GPIO regression from MPP cleanup

commit b06540371063f0f07aafc1d1ac5e974da85c973c upstream.

Patchset "ARM: orion: Refactor the MPP code common in the orion
platform" broke at least Orion5x based platforms. These platforms have
pins configured as GPIO when the selector is not 0x0. However the
common code assumes the selector is always 0x0 for a GPIO lines. It
then ignores the GPIO bits in the MPP definitions, resulting in that
Orion5x machines cannot correctly configure there GPIO lines.

The Fix removes the assumption that the selector is always 0x0.
In order that none GPIO configurations are correctly blocked,
Kirkwood and mv78xx0 MPP definitions are corrected to only set the
GPIO bits for GPIO configurations.

This third version, which does not contain any whitespace changes,
and is rebased on v3.3-rc2.

Signed-off-by: Andrew Lunn <>
Acked-by: Nicolas Pitre <>
Signed-off-by: Olof Johansson <>
9 years agoARM: orion: Fix USB phy for orion5x.
Andrew Lunn [Wed, 8 Feb 2012 14:52:47 +0000 (15:52 +0100)]
ARM: orion: Fix USB phy for orion5x.

commit 72053353583230952c4b187e110e9da00dfc3afb upstream.

The patch "ARM: orion: Consolidate USB platform setup code.", commit
4fcd3f374a928081d391cd9a570afe3b2c692fdc broke USB on TS-7800 and
other orion5x boards, because the wrong type of PHY was being passed
to the EHCI driver in the platform data. Orion5x needs EHCI_PHY_ORION
and all the others want EHCI_PHY_NA.

Allow the mach- code to tell the generic plat-orion code which USB PHY
enum to place into the platform data.

Version 2: Rebase to v3.3-rc2.

Reported-by: Ambroz Bizjak <>
Signed-off-by: Andrew Lunn <>
Tested-by: Ambroz Bizjak <>
Acked-by: Nicolas Pitre <>
Signed-off-by: Olof Johansson <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodrm/i915: fix ELD writing for SandyBridge
Wu Fengguang [Fri, 9 Dec 2011 12:42:17 +0000 (20:42 +0800)]
drm/i915: fix ELD writing for SandyBridge

commit b3f33cbf7ace8fc149993ee35e0d0fd57f41d6d8 upstream.

SandyBridge should be using the same register addresses as IvyBridge.

Signed-off-by: Wu Fengguang <>
Signed-off-by: Keith Packard <>
Signed-off-by: Eugeni Dodonov <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodrm/i915: gen7: Disable the RHWO optimization as it can cause GPU hangs.
Kenneth Graunke [Wed, 8 Feb 2012 20:53:52 +0000 (12:53 -0800)]
drm/i915: gen7: Disable the RHWO optimization as it can cause GPU hangs.

commit d71de14ddf423ccc9a2e3f7e37553c99ead20d7c upstream.

The BSpec Workarounds page states that bits 10 and 26 must be set to
avoid 3D ring hangs.

Tested-by: Eugeni Dodonov <>
Signed-off-by: Kenneth Graunke <>
Signed-off-by: Jesse Barnes <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodrm/i915: gen7: work around a system hang on IVB
Eugeni Dodonov [Wed, 8 Feb 2012 20:53:51 +0000 (12:53 -0800)]
drm/i915: gen7: work around a system hang on IVB

commit db099c8f963fe656108e0a068274c5580a17f69b upstream.

This adds the workaround for WaCatErrorRejectionIssue which could result
in a system hang.

Tested-by: Eugeni Dodonov <>
Reviewed-by: Kenneth Graunke <>
Signed-off-by: Eugeni Dodonov <>
Signed-off-by: Jesse Barnes <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodrm/i915: gen7: Implement an L3 caching workaround.
Eugeni Dodonov [Wed, 8 Feb 2012 20:53:50 +0000 (12:53 -0800)]
drm/i915: gen7: Implement an L3 caching workaround.

commit e4e0c058a19c41150d12ad2d3023b3cf09c5de67 upstream.

This adds two cache-related workarounds for Ivy Bridge which can lead to
3D ring hangs and corruptions.

Tested-by: Eugeni Dodonov <>
Signed-off-by: Eugeni Dodonov <>
Signed-off-by: Kenneth Graunke <>
Signed-off-by: Jesse Barnes <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodrm/i915: gen7: implement rczunit workaround
Eugeni Dodonov [Wed, 8 Feb 2012 20:53:49 +0000 (12:53 -0800)]
drm/i915: gen7: implement rczunit workaround

commit eae66b50c760233fad526edf4a0d327be17a055d upstream.

This is yet another workaround related to clock gating which we need on
Ivy Bridge.

Tested-by: Eugeni Dodonov <>
Signed-off-by: Eugeni Dodonov <>
Signed-off-by: Kenneth Graunke <>
Signed-off-by: Jesse Barnes <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agortl8192cu: Add new device IDs
Larry Finger [Tue, 18 Oct 2011 22:52:01 +0000 (17:52 -0500)]
rtl8192cu: Add new device IDs

commit 6cddafab54e9a17b2efefe982547865955a5ff3a upstream.

The latest vendor (non-mac80211) driver of 9/22/2011 shows some new
device IDs for rtl8192cu. In addition, some typos in the table are
fixed and one duplicate is removed.

Signed-off-by: Larry Finger <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoACPI / PM: Do not save/restore NVS on Asus K54C/K54HR
Keng-Yu Lin [Thu, 1 Dec 2011 23:04:23 +0000 (00:04 +0100)]
ACPI / PM: Do not save/restore NVS on Asus K54C/K54HR

commit 5a50a7c32d630d6cdb13d69afabb0cc81b2f379c upstream.

The models do not resume correctly without acpi_sleep=nonvs.

Signed-off-by: Keng-Yu Lin <>
Signed-off-by: Rafael J. Wysocki <>
Cc: Tim Gardner <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoavr32: select generic atomic64_t support
Fabio Baltieri [Fri, 3 Feb 2012 23:37:14 +0000 (15:37 -0800)]
avr32: select generic atomic64_t support

commit 31e0017e6f6fb5cfdfaf932c1f98c9bef8d57688 upstream.

Enable use of the generic atomic64 implementation on AVR32 platforms.
Without this the kernel fails to build as the architecture does not
provide its version.

Signed-off-by: Fabio Baltieri <>
Acked-by: Hans-Christian Egtvedt <>
Cc: Haavard Skinnemoen <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Cc: Jean-Christophe PLAGNIOL-VILLARD <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agobsg: fix sysfs link remove warning
Stanislaw Gruszka [Wed, 8 Feb 2012 19:02:03 +0000 (20:02 +0100)]
bsg: fix sysfs link remove warning

commit 37b40adf2d1b4a5e51323be73ccf8ddcf3f15dd3 upstream.

We create "bsg" link if q-> is not NULL, so remove it only
when the same condition is true.


WARNING: at fs/sysfs/inode.c:323 sysfs_hash_and_remove+0x2b/0x77()
sysfs: can not remove 'bsg', no directory
Call Trace:
  [<c0429683>] warn_slowpath_common+0x6a/0x7f
  [<c0537a68>] ? sysfs_hash_and_remove+0x2b/0x77
  [<c042970b>] warn_slowpath_fmt+0x2b/0x2f
  [<c0537a68>] sysfs_hash_and_remove+0x2b/0x77
  [<c053969a>] sysfs_remove_link+0x20/0x23
  [<c05d88f1>] bsg_unregister_queue+0x40/0x6d
  [<c0692263>] __scsi_remove_device+0x31/0x9d
  [<c069149f>] scsi_forget_host+0x41/0x52
  [<c0689fa9>] scsi_remove_host+0x71/0xe0
  [<f7de5945>] quiesce_and_remove_host+0x51/0x83 [usb_storage]
  [<f7de5a1e>] usb_stor_disconnect+0x18/0x22 [usb_storage]
  [<c06c29de>] usb_unbind_interface+0x4e/0x109
  [<c067a80f>] __device_release_driver+0x6b/0xa6
  [<c067a861>] device_release_driver+0x17/0x22
  [<c067a46a>] bus_remove_device+0xd6/0xe6
  [<c06785e2>] device_del+0xf2/0x137
  [<c06c101f>] usb_disable_device+0x94/0x1a0

Signed-off-by: Stanislaw Gruszka <>
Signed-off-by: Jens Axboe <>
Signed-off-by: Tim Gardner <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoASoC: i.MX SSI: Fix DSP_A format.
Javier Martin [Thu, 23 Feb 2012 14:43:18 +0000 (15:43 +0100)]
ASoC: i.MX SSI: Fix DSP_A format.

commit 5ed80a75b248bfaf840ea6b38f941edcf6ee7dc7 upstream.

According to i.MX27 Reference Manual (p 1593) TXBIT0 bit selects
whether the most significant or the less significant part of the
data word written to the FIFO is transmitted.

As DSP_A is the same as DSP_B with a data offset of 1 bit, it
doesn't make any sense to remove TXBIT0 bit here.

Signed-off-by: Javier Martin <>
Acked-by: Sascha Hauer <>
Signed-off-by: Mark Brown <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoASoC: dapm: Check for bias level when powering down
Mark Brown [Wed, 22 Feb 2012 15:52:56 +0000 (15:52 +0000)]
ASoC: dapm: Check for bias level when powering down

commit 7679e42ec833ed70aa34790a5f39dcb7e5bda4fe upstream.

Recent enhancements in the bias management means that we might not be
in standby when the CODEC is idle and can have active widgets without
being in full power mode but the shutdown functionality assumes these
things. Add checks for the bias level at each stage so that we don't
do transitions other than the ON->PREPARE->STANDBY->OFF ones that the
drivers are expecting.

Signed-off-by: Mark Brown <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoviafb: fix IGA1 modesetting on VX900
Florian Tobias Schandinat [Wed, 22 Feb 2012 18:53:08 +0000 (18:53 +0000)]
viafb: fix IGA1 modesetting on VX900

commit e29206381a1436e0f47c0f5b9a23159a03c57715 upstream.

Even if the documentation calls this bit "Reserved" it has to be set
to 0 for correct modesetting on IGA1.

Signed-off-by: Florian Tobias Schandinat <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoviafb: select HW scaling on VX900 for IGA2
Florian Tobias Schandinat [Wed, 22 Feb 2012 18:53:07 +0000 (18:53 +0000)]
viafb: select HW scaling on VX900 for IGA2

commit 050f0e02c8dc38b2b4f2df345ac760d22ca5c7ba upstream.

VX900 can do hardware scaling for both IGAs in contrast to previous
hardware which could do it only for IGA2. This patch ensures that
we set the parameter for IGA2 and not for IGA1. This fixes hardware
scaling on VX900 until we have the infrastructure to support it for
both IGAs.

Signed-off-by: Florian Tobias Schandinat <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoosd_uld: Bump MAX_OSD_DEVICES from 64 to 1,048,576
Boaz Harrosh [Wed, 25 Jan 2012 19:42:58 +0000 (21:42 +0200)]
osd_uld: Bump MAX_OSD_DEVICES from 64 to 1,048,576

commit 41f8ad76362e7aefe3a03949c43e23102dae6e0b upstream.

It used to be that minors where 8 bit. But now they
are actually 20 bit. So the fix is simplicity itself.

I've tested with 300 devices and all user-mode utils
work just fine. I have also mechanically added 10,000
to the ida (so devices are /dev/osd10000, /dev/osd10001 ...)
and was able to mkfs an exofs filesystem and access osds
from user-mode.

All the open-osd user-mode code uses the same library
to access devices through their symbolic names in
/dev/osdX so I'd say it's pretty safe. (Well tested)

This patch is very important because some of the systems
that will be deploying the 3.2 pnfs-objects code are larger
than 64 OSDs and will stop to work properly when reaching
that number.

Signed-off-by: Boaz Harrosh <>
Signed-off-by: James Bottomley <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agocrypto: mv_cesa - fix final callback not ignoring input data
Phil Sutter [Mon, 27 Feb 2012 11:17:04 +0000 (12:17 +0100)]
crypto: mv_cesa - fix final callback not ignoring input data

commit f8f54e190ddb4ed697036b60f5e2ae6dd45b801c upstream.

Broken by commit 6ef84509f3d439ed2d43ea40080643efec37f54f for users
passing a request with non-zero 'nbytes' field, like e.g. testmgr.

Signed-off-by: Phil Sutter <>
Signed-off-by: Herbert Xu <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoHID: usbhid: Add NOGET quirk for the AIREN Slim+ keyboard
Alan Stern [Mon, 27 Feb 2012 16:23:45 +0000 (11:23 -0500)]
HID: usbhid: Add NOGET quirk for the AIREN Slim+ keyboard

commit 37891abc8464637964a26ae4b61d307fef831f80 upstream.

This patch (as1531) adds a NOGET quirk for the Slim+ keyboard marketed
by AIREN.  This keyboard seems to have a lot of bugs; NOGET works
around only one of them.

Signed-off-by: Alan Stern <>
Reported-by: okias <>
Signed-off-by: Jiri Kosina <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agorapidio/tsi721: fix queue wrapping bug in inbound doorbell handler
Alexandre Bounine [Mon, 5 Mar 2012 22:59:21 +0000 (14:59 -0800)]
rapidio/tsi721: fix queue wrapping bug in inbound doorbell handler

commit b24823e61bfd93d0e72088e4f5245287582ed289 upstream.

Fix a bug that causes a kernel panic when the number of received doorbells
is larger than number of entries in the inbound doorbell queue (current
default value = 512).

Another possible indication for this bug is large number of spurious
doorbells reported by tsi721 driver after reaching the queue size maximum.

Signed-off-by: Alexandre Bounine <>
Cc: Chul Kim <>
Cc: Matt Porter <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoS390: qdio: fix handler function arguments for zfcp data router
Steffen Maier [Fri, 2 Mar 2012 16:32:58 +0000 (17:32 +0100)]
S390: qdio: fix handler function arguments for zfcp data router

commit 7b3cc67d4445995a025a4b55a7dc687b6829b4ca upstream.

Git commit 25f269f17316549e "[S390] qdio: EQBS retry after CCQ 96"
introduced a regression in regard to the zfcp data router.
Revoke the incorrect simplification of the function call arguments
for the qdio handler to make the zfcp hardware data router working

This is applicable to 3.2+ kernels.

Signed-off-by: Steffen Maier <>
Reviewed-by: Jan Glauber <>
Signed-off-by: Martin Schwidefsky <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agotty/powerpc: early udbg consoles can't be modules
Stephen Rothwell [Sun, 19 Feb 2012 20:22:38 +0000 (07:22 +1100)]
tty/powerpc: early udbg consoles can't be modules

commit f21c6d4a49179f91fd70a41382382f08c780d425 upstream.

Fixes these build errors:

ERROR: ".udbg_printf" [drivers/tty/ehv_bytechan.ko] undefined!
ERROR: ".register_early_udbg_console" [drivers/tty/ehv_bytechan.ko] undefined!
ERROR: "udbg_putc" [drivers/tty/ehv_bytechan.ko] undefined!

Cc: Timur Tabi <>
Signed-off-by: Stephen Rothwell <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoiwlwifi: fix key removal
Johannes Berg [Fri, 17 Feb 2012 17:47:14 +0000 (09:47 -0800)]
iwlwifi: fix key removal

commit 5dcbf480473f6c3f06ad2426b7517038a2a18911 upstream.

When trying to remove a key, we always send key
flags just setting the key type, not including
the multicast flag and the key ID. As a result,
whenever any key was removed, the unicast key 0
would be removed, causing a complete connection
loss after the second rekey (the first doesn't
cause a key removal). Fix the key removal code
to include the key ID and multicast flag, thus
removing the correct key.

Reported-by: Alexander Schnaidt <>
Tested-by: Alexander Schnaidt <>
Signed-off-by: Johannes Berg <>
Signed-off-by: Wey-Yi Guy <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agomm: thp: fix BUG on mm->nr_ptes
Andrea Arcangeli [Mon, 5 Mar 2012 22:59:20 +0000 (14:59 -0800)]
mm: thp: fix BUG on mm->nr_ptes

commit 1c641e84719429bbfe62a95ed3545ee7fe24408f upstream.

Dave Jones reports a few Fedora users hitting the BUG_ON(mm->nr_ptes...)
in exit_mmap() recently.

Quoting Hugh's discovery and explanation of the SMP race condition:

  "mm->nr_ptes had unusual locking: down_read mmap_sem plus
   page_table_lock when incrementing, down_write mmap_sem (or mm_users
   0) when decrementing; whereas THP is careful to increment and
   decrement it under page_table_lock.

   Now most of those paths in THP also hold mmap_sem for read or write
   (with appropriate checks on mm_users), but two do not: when
   split_huge_page() is called by hwpoison_user_mappings(), and when
   called by add_to_swap().

   It's conceivable that the latter case is responsible for the
   exit_mmap() BUG_ON mm->nr_ptes that has been reported on Fedora."

The simplest way to fix it without having to alter the locking is to make
split_huge_page() a noop in nr_ptes terms, so by counting the preallocated
pagetables that exists for every mapped hugepage.  It was an arbitrary
choice not to count them and either way is not wrong or right, because
they are not used but they're still allocated.

Reported-by: Dave Jones <>
Reported-by: Hugh Dickins <>
Signed-off-by: Andrea Arcangeli <>
Acked-by: Hugh Dickins <>
Cc: David Rientjes <>
Cc: Josh Boyer <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agokprobes: return proper error code from register_kprobe()
Prashanth Nageshappa [Mon, 5 Mar 2012 22:59:12 +0000 (14:59 -0800)]
kprobes: return proper error code from register_kprobe()

commit f986a499ef6f317d906e6f6f281be966e1237a10 upstream.

register_kprobe() aborts if the address of the new request falls in a
prohibited area (such as ftrace pouch, __kprobes annotated functions,
non-kernel text addresses, jump label text).  We however don't return the
right error on this abort, resulting in a silent failure - incorrect
adding/reporting of kprobes ('perf probe do_fork+18' or 'perf probe
mcount' for instance).

In V2 we are incorporating Masami Hiramatsu's  feedback.

This patch fixes it by returning -EINVAL upon failure.

While we are here, rename the label used for exit to be more appropriate.

Signed-off-by: Ananth N Mavinakayanahalli <>
Signed-off-by: Prashanth K Nageshappa <>
Acked-by: Masami Hiramatsu <>
Cc: Jason Baron <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoath9k_hw: prevent writes to const data on AR9160
Felix Fietkau [Wed, 15 Feb 2012 18:31:20 +0000 (19:31 +0100)]
ath9k_hw: prevent writes to const data on AR9160

commit 9bbb8168ed3d8b946f9c1901a63a675012de88f2 upstream.

Duplicate the data for iniAddac early on, to avoid having to do redundant
memcpy calls later. While we're at it, make AR5416 < v2.2 use the same
codepath. Fixes a reported crash on x86.

Signed-off-by: Felix Fietkau <>
Reported-by: Magnus Määttä <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agomac80211: zero initialize count field in ieee80211_tx_rate
Mohammed Shafi Shajakhan [Mon, 20 Feb 2012 04:35:31 +0000 (10:05 +0530)]
mac80211: zero initialize count field in ieee80211_tx_rate

commit 8617b093d0031837a7be9b32bc674580cfb5f6b5 upstream.

rate control algorithms concludes the rate as invalid
with rate[i].idx < -1 , while they do also check for rate[i].count is
non-zero. it would be safer to zero initialize the 'count' field.
recently we had a ath9k rate control crash where the ath9k rate control
in ath_tx_status assumed to check only for rate[i].count being non-zero
in one instance and ended up in using invalid rate index for
'connection monitoring NULL func frames' which eventually lead to the crash.
thanks to Pavel Roskin for fixing it and finding the root cause.

Cc: Pavel Roskin <>
Signed-off-by: Mohammed Shafi Shajakhan <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agocifs: fix dentry refcount leak when opening a FIFO on lookup
Jeff Layton [Thu, 23 Feb 2012 14:37:45 +0000 (09:37 -0500)]
cifs: fix dentry refcount leak when opening a FIFO on lookup

commit 5bccda0ebc7c0331b81ac47d39e4b920b198b2cd upstream.

The cifs code will attempt to open files on lookup under certain
circumstances. What happens though if we find that the file we opened
was actually a FIFO or other special file?

Currently, the open filehandle just ends up being leaked leading to
a dentry refcount mismatch and oops on umount. Fix this by having the
code close the filehandle on the server if it turns out not to be a
regular file. While we're at it, change this spaghetti if statement
into a switch too.

Reported-by: CAI Qian <>
Tested-by: CAI Qian <>
Reviewed-by: Shirish Pargaonkar <>
Signed-off-by: Jeff Layton <>
Signed-off-by: Steve French <>
Signed-off-by: Greg Kroah-Hartman <>