9 years agoLinux 3.2.10 v3.2.10
Greg Kroah-Hartman [Mon, 12 Mar 2012 20:22:49 +0000 (13:22 -0700)]
Linux 3.2.10

9 years agoARM: OMAP: fix iommu, not mailbox
Ohad Ben-Cohen [Sun, 4 Mar 2012 10:01:11 +0000 (12:01 +0200)]
ARM: OMAP: fix iommu, not mailbox

commit 134d12fae0bb8f3d60dc7440a9e1950bb5427167 upstream.

For some weird (freudian?) reason, commit 435792d "ARM: OMAP: make
iommu subsys_initcall to fix builtin omap3isp" unintentionally changed
the mailbox's initcall instead of the iommu's.

Fix that.

Reported-by: Fernando Guzman Lugo <>
Signed-off-by: Ohad Ben-Cohen <>
Cc: Laurent Pinchart <>
Cc: Joerg Roedel <>
Cc: Tony Lindgren <>
Signed-off-by: Joerg Roedel <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agospi-topcliff-pch: rename pch_spi_pcidev to pch_spi_pcidev_driver
Danny Kukawka [Thu, 2 Feb 2012 13:20:30 +0000 (14:20 +0100)]
spi-topcliff-pch: rename pch_spi_pcidev to pch_spi_pcidev_driver

commit c88db233251b026fda775428f0250c760553e216 upstream.

Rename static struct pci_driver pch_spi_pcidev to
pch_spi_pcidev_driver to get rid of warnings from modpost checks.

Signed-off-by: Danny Kukawka <>
Signed-off-by: Grant Likely <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agomfd: Fix cs5535 section mismatch
Christian Gmeiner [Tue, 13 Dec 2011 20:30:04 +0000 (21:30 +0100)]
mfd: Fix cs5535 section mismatch

commit 97e43c983c721a47546e6db3b7711dcd912a6481 upstream.

Silence following warnings:
WARNING: drivers/mfd/cs5535-mfd.o(.data+0x20): Section mismatch in
reference from the variable cs5535_mfd_drv to the function
The variable cs5535_mfd_drv references
the function __devinit cs5535_mfd_probe()
If the reference is valid then annotate the
variable with __init* or __refdata (see linux/init.h) or name the variable:
*driver, *_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console

WARNING: drivers/mfd/cs5535-mfd.o(.data+0x28): Section mismatch in
reference from the variable cs5535_mfd_drv to the function
The variable cs5535_mfd_drv references
the function __devexit cs5535_mfd_remove()
If the reference is valid then annotate the
variable with __exit* (see linux/init.h) or name the variable:
*driver, *_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console

Rename the variable from *_drv to *_driver so
modpost ignore the OK references to __devinit/__devexit

Signed-off-by: Christian Gmeiner <>
Acked-by: Andres Salomon <>
Signed-off-by: Samuel Ortiz <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agocs5535-mfgpt: don't call __init function from __devinit
Danny Kukawka [Thu, 2 Feb 2012 13:20:29 +0000 (14:20 +0100)]
cs5535-mfgpt: don't call __init function from __devinit

commit 474de3bbadd9cb75ffc32cc759c40d868343d46c upstream.

Fix scan_timers() to be __devinit and not __init since
the function get called from cs5535_mfgpt_probe which is

Signed-off-by: Danny Kukawka <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodm raid: fix flush support
Jonathan E Brassow [Wed, 7 Mar 2012 19:09:48 +0000 (19:09 +0000)]
dm raid: fix flush support

commit 0ca93de9b789e0eb05e103f0c04de72df13da73a upstream.

Fix dm-raid flush support.

Both md and dm have support for flush, but the dm-raid target
forgot to set the flag to indicate that flushes should be
passed on.  (Important for data integrity e.g. with writeback cache

Signed-off-by: Jonathan Brassow <>
Acked-by: Mike Snitzer <>
Signed-off-by: Alasdair G Kergon <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodm raid: set MD_CHANGE_DEVS when rebuilding
Jonathan E Brassow [Wed, 7 Mar 2012 19:09:47 +0000 (19:09 +0000)]
dm raid: set MD_CHANGE_DEVS when rebuilding

commit 3aa3b2b2b1edb813dc5342d0108befc39541542d upstream.

The 'rebuild' parameter is used to rebuild individual devices in an
array (e.g. resynchronize a RAID1 device or recalculate a parity device
in higher RAID).  The MD_CHANGE_DEVS flag must be set when this
parameter is given in order to write out the superblocks and make the
change take immediate effect.  The code that handles new devices in
super_load already sets MD_CHANGE_DEVS and 'FirstUse'.  (The 'FirstUse'
flag was being set as a special case for rebuilds in

Add a condition for rebuilds in super_load to take care of both flags
without the special case in 'super_init_validation'.

Signed-off-by: Jonathan Brassow <>
Signed-off-by: Alasdair G Kergon <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodm thin metadata: decrement counter after removing mapped block
Joe Thornber [Wed, 7 Mar 2012 19:09:44 +0000 (19:09 +0000)]
dm thin metadata: decrement counter after removing mapped block

commit af63bcb817cf708f53bcae6edc2e3fb7dd7d8051 upstream.

Correct the number of mapped sectors shown on a thin device's
status line by decrementing td->mapped_blocks in __remove() each time
a block is removed.

Signed-off-by: Joe Thornber <>
Acked-by: Mike Snitzer <>
Signed-off-by: Alasdair G Kergon <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodm thin metadata: unlock superblock in init_pmd error path
Joe Thornber [Wed, 7 Mar 2012 19:09:43 +0000 (19:09 +0000)]
dm thin metadata: unlock superblock in init_pmd error path

commit 4469a5f387fdde956894137751a41473618a4a52 upstream.

If dm_sm_disk_create() fails the superblock must be unlocked.

Signed-off-by: Joe Thornber <>
Acked-by: Mike Snitzer <>
Signed-off-by: Alasdair G Kergon <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodm thin metadata: remove incorrect close_device on creation error paths
Mike Snitzer [Wed, 7 Mar 2012 19:09:41 +0000 (19:09 +0000)]
dm thin metadata: remove incorrect close_device on creation error paths

commit 1f3db25d8be4ac50b897b39609802183ea68a514 upstream.

The __open_device() error paths in __create_thin() and __create_snap()
incorrectly call __close_device() even if td was not initialized by
__open_device().  Remove this.

Also document __open_device() return values, remove a redundant
td->changed = 1 in __create_thin(), and insert an additional
safeguard against creating an already-existing device.

Signed-off-by: Mike Snitzer <>
Signed-off-by: Alasdair G Kergon <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodm flakey: fix crash on read when corrupt_bio_byte not set
Mike Snitzer [Wed, 7 Mar 2012 19:09:39 +0000 (19:09 +0000)]
dm flakey: fix crash on read when corrupt_bio_byte not set

commit 1212268fd9816e3b8801e57b896fceaec71969ad upstream.

The following BUG is hit on the first read that is submitted to a dm
flakey test device while the device is "down" if the corrupt_bio_byte
feature wasn't requested when the device's table was loaded.

Example DM table that will hit this BUG:
0 2097152 flakey 8:0 2048 0 30

This bug was introduced by commit a3998799fb4df0b0af8271a7d50c4269032397aa
(dm flakey: add corrupt_bio_byte feature) in v3.1-rc1.

BUG: unable to handle kernel paging request at ffff8801cfce3fff
IP: [<ffffffffa008c233>] corrupt_bio_data+0x6e/0xae [dm_flakey]
PGD 1606063 PUD 0
Oops: 0002 [#1] SMP
Call Trace:
 [<ffffffffa008c2b5>] flakey_end_io+0x42/0x48 [dm_flakey]
 [<ffffffffa00dca98>] clone_endio+0x54/0xb6 [dm_mod]
 [<ffffffff81130587>] bio_endio+0x2d/0x2f
 [<ffffffff811c819a>] req_bio_endio+0x96/0x9f
 [<ffffffff811c94b9>] blk_update_request+0x1dc/0x3a9
 [<ffffffff812f5ee2>] ? rcu_read_unlock+0x21/0x23
 [<ffffffff811c96a6>] blk_update_bidi_request+0x20/0x6e
 [<ffffffff811c9713>] blk_end_bidi_request+0x1f/0x5d
 [<ffffffff811c978d>] blk_end_request+0x10/0x12
 [<ffffffff8128f450>] scsi_io_completion+0x1e5/0x4b1
 [<ffffffff812882a9>] scsi_finish_command+0xec/0xf5
 [<ffffffff8128f830>] scsi_softirq_done+0xff/0x108
 [<ffffffff811ce284>] blk_done_softirq+0x84/0x98
 [<ffffffff81048d19>] __do_softirq+0xe3/0x1d5
 [<ffffffff8138f83f>] ? _raw_spin_lock+0x62/0x69
 [<ffffffff810997cf>] ? handle_irq_event+0x4c/0x61
 [<ffffffff8139833c>] call_softirq+0x1c/0x30
 [<ffffffff81003b37>] do_softirq+0x4b/0xa3
 [<ffffffff81048a39>] irq_exit+0x53/0xca
 [<ffffffff81398acd>] do_IRQ+0x9d/0xb4
 [<ffffffff81390333>] common_interrupt+0x73/0x73

Signed-off-by: Mike Snitzer <>
Signed-off-by: Alasdair G Kergon <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodm io: fix discard support
Milan Broz [Wed, 7 Mar 2012 19:09:37 +0000 (19:09 +0000)]
dm io: fix discard support

commit 0c535e0d6f463365c29623350dbd91642363c39b upstream.

This patch fixes a crash by recognising discards in dm_io.

Currently dm_mirror can send REQ_DISCARD bios if running over a
discard-enabled device and without support in dm_io the system
crashes badly.

BUG: unable to handle kernel paging request at 00800000
IP:  __bio_add_page.part.17+0xf5/0x1e0
 dispatch_io+0x1cf/0x240 [dm_mod]
 ? km_get_page+0x50/0x50 [dm_mod]
 ? vm_next_page+0x20/0x20 [dm_mod]
 ? mirror_flush+0x130/0x130 [dm_mirror]
 dm_io+0xdc/0x2b0 [dm_mod]

Introduced in 2.6.38-rc1 by commit 5fc2ffeabb9ee0fc0e71ff16b49f34f0ed3d05b4
(dm raid1: support discard).

Signed-off-by: Milan Broz <>
Acked-by: Mike Snitzer <>
Signed-off-by: Alasdair G Kergon <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodm ioctl: do not leak argv if target message only contains whitespace
Jesper Juhl [Wed, 7 Mar 2012 19:09:34 +0000 (19:09 +0000)]
dm ioctl: do not leak argv if target message only contains whitespace

commit 902c6a96a7cb9c50d2a8aed1788efad0a5d8f04c upstream.

If 'argc' is zero we jump to the 'out:' label, but this leaks the
(unused) memory that 'dm_split_args()' allocated for 'argv' if the
string being split consisted entirely of whitespace.  Jump to the
'out_argv:' label instead to free up that memory.

Signed-off-by: Jesper Juhl <>
Signed-off-by: Alasdair G Kergon <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agox86/amd: iommu_set_device_table() must not be __init
Jan Beulich [Thu, 8 Mar 2012 08:58:13 +0000 (08:58 +0000)]
x86/amd: iommu_set_device_table() must not be __init

commit 6b7f000eb6a0b81d7a809833edb7a457eedf8512 upstream.

This function is called from enable_iommus(), which in turn is used
from amd_iommu_resume().

Signed-off-by: Jan Beulich <>
Signed-off-by: Joerg Roedel <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agonet/usbnet: avoid recursive locking in usbnet_stop()
Sebastian Siewior [Wed, 7 Mar 2012 10:19:28 +0000 (10:19 +0000)]
net/usbnet: avoid recursive locking in usbnet_stop()

commit 4231d47e6fe69f061f96c98c30eaf9fb4c14b96d upstream.

|kernel BUG at kernel/rtmutex.c:724!
|[<c029599c>] (rt_spin_lock_slowlock+0x108/0x2bc) from [<c01c2330>] (defer_bh+0x1c/0xb4)
|[<c01c2330>] (defer_bh+0x1c/0xb4) from [<c01c3afc>] (rx_complete+0x14c/0x194)
|[<c01c3afc>] (rx_complete+0x14c/0x194) from [<c01cac88>] (usb_hcd_giveback_urb+0xa0/0xf0)
|[<c01cac88>] (usb_hcd_giveback_urb+0xa0/0xf0) from [<c01e1ff4>] (musb_giveback+0x34/0x40)
|[<c01e1ff4>] (musb_giveback+0x34/0x40) from [<c01e2b1c>] (musb_advance_schedule+0xb4/0x1c0)
|[<c01e2b1c>] (musb_advance_schedule+0xb4/0x1c0) from [<c01e2ca8>] (musb_cleanup_urb.isra.9+0x80/0x8c)
|[<c01e2ca8>] (musb_cleanup_urb.isra.9+0x80/0x8c) from [<c01e2ed0>] (musb_urb_dequeue+0xec/0x108)
|[<c01e2ed0>] (musb_urb_dequeue+0xec/0x108) from [<c01cbb90>] (unlink1+0xbc/0xcc)
|[<c01cbb90>] (unlink1+0xbc/0xcc) from [<c01cc2ec>] (usb_hcd_unlink_urb+0x54/0xa8)
|[<c01cc2ec>] (usb_hcd_unlink_urb+0x54/0xa8) from [<c01c2a84>] (unlink_urbs.isra.17+0x2c/0x58)
|[<c01c2a84>] (unlink_urbs.isra.17+0x2c/0x58) from [<c01c2b44>] (usbnet_terminate_urbs+0x94/0x10c)
|[<c01c2b44>] (usbnet_terminate_urbs+0x94/0x10c) from [<c01c2d68>] (usbnet_stop+0x100/0x15c)
|[<c01c2d68>] (usbnet_stop+0x100/0x15c) from [<c020f718>] (__dev_close_many+0x94/0xc8)

defer_bh() takes the lock which is hold during unlink_urbs(). The safe
walk suggest that the skb will be removed from the list and this is done
by defer_bh() so it seems to be okay to drop the lock here.

Reported-by: Aníbal Almeida Pinto <>
Signed-off-by: Sebastian Andrzej Siewior <>
Acked-by: Oliver Neukum <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodrm/radeon/kms: set SX_MISC in the r6xx blit code (v2)
Marek Olšák [Wed, 7 Mar 2012 22:33:00 +0000 (23:33 +0100)]
drm/radeon/kms: set SX_MISC in the r6xx blit code (v2)

commit cf00790dea6f210ddd01a6656da58c7c9a4ea0e4 upstream.

Mesa may set it to 1, causing all primitives to be killed.

v2: also update the r7xx code

Signed-off-by: Marek Olšák <>
Reviewed-by: Alex Deucher <>
Signed-off-by: Dave Airlie <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agocarl9170: fix frame delivery if sta is in powersave mode
Christian Lamparter [Sat, 25 Feb 2012 20:36:36 +0000 (21:36 +0100)]
carl9170: fix frame delivery if sta is in powersave mode

commit 9926a67557532acb6cddb1c1add02952175b5c72 upstream.

Nicolas Cavallari discovered that carl9170 has some
serious problems delivering data to sleeping stations.

It turns out that the driver was not honoring two
important flags (IEEE80211_TX_CTL_POLL_RESPONSE and
IEEE80211_TX_CTL_CLEAR_PS_FILT) which are set on
frames that should be sent although the receiving
station is still in powersave mode.

Reported-by: Nicolas Cavallari <>
Signed-off-by: Christian Lamparter <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agocarl9170: Fix memory accounting when sta is in power-save mode.
Nicolas Cavallari [Thu, 23 Feb 2012 15:53:34 +0000 (16:53 +0100)]
carl9170: Fix memory accounting when sta is in power-save mode.

commit 992d52529d7840236d3059b51c15d5eb9e81a869 upstream.

On Access Point mode, when transmitting a packet, if the destination
station is in powersave mode, we abort transmitting the packet to the
device queue, but we do not reclaim the allocated memory.  Given enough
packets, we can go in a state where there is no packet on the device
queue, but we think the device has no memory left, so no packet gets
transmitted, connections breaks and the AP stops working.

This undo the allocation done in the TX path when the station is in
power-save mode.

Signed-off-by: Nicolas Cavallari <>
Acked-by: Christian Lamparter <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agohwmon: (zl6100) Maintain delay parameter in driver instance data
Guenter Roeck [Wed, 7 Mar 2012 11:58:55 +0000 (03:58 -0800)]
hwmon: (zl6100) Maintain delay parameter in driver instance data

commit 7ad6307ad6968ce25cecf209d4822d4c722be030 upstream.

A global delay parameter has the side effect of being overwritten with 0 if a
single ZL2004 or ZL6105 is instantiated. If other chips supported by the same
driver are in the system, this will result in access errors for those chips.

To solve the problem, keep a per-instance copy of the delay parameter, and do
not change the original parameter.

Signed-off-by: Guenter Roeck <>
Acked-by: Jean Delvare <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agohwmon: (jc42) Add support for AT30TS00, TS3000GB2, TSE2002GB2, and MCP9804
Guenter Roeck [Mon, 5 Mar 2012 19:13:52 +0000 (11:13 -0800)]
hwmon: (jc42) Add support for AT30TS00, TS3000GB2, TSE2002GB2, and MCP9804

commit 1bd612a25855f4cc9345052b53d7da697dba6358 upstream.

Also update IDT datasheet locations.

Signed-off-by: Guenter Roeck <>
Acked-by: Jean Delvare <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agohwmon: (jc42) Add support for ST Microelectronics STTS2002 and STTS3000
Jean Delvare [Mon, 5 Mar 2012 13:32:00 +0000 (08:32 -0500)]
hwmon: (jc42) Add support for ST Microelectronics STTS2002 and STTS3000

commit 4de86126a712ba83fa038d277c8282f7ed466a4b upstream.

These are fully compatible with Jedec JC 42.4 as far as I can see.

Signed-off-by: Jean Delvare <>
Cc: Guenter Roeck <>
Signed-off-by: Guenter Roeck <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agohwmon: (pmbus_core) Fix maximum number of POUT alarm attributes
Guenter Roeck [Sun, 4 Mar 2012 16:10:57 +0000 (08:10 -0800)]
hwmon: (pmbus_core) Fix maximum number of POUT alarm attributes

commit 7cb3c44fb1f7999e4c53b6a52de6bc25da6de079 upstream.

There are up to three POUT alarm attributes, not two, since cap_alarm was added.

Reported-by: Michele Petracca <>
Signed-off-by: Guenter Roeck <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoInput: ALPS - fix touchpad detection when buttons are pressed
Akio Idehara [Thu, 8 Mar 2012 19:48:12 +0000 (13:48 -0600)]
Input: ALPS - fix touchpad detection when buttons are pressed

commit 99c90ab31fad855b9da9dee3a5aa6c27f263e9d6 upstream.

ALPS touchpad detection fails if some buttons of ALPS are pressed.
The reason is that the "E6" query response byte is different from
what is expected.

This was tested on a Toshiba Portege R500.

Signed-off-by: Akio Idehara <>
Tested-by: Seth Forshee <>
Signed-off-by: Dmitry Torokhov <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agomedia: staging: lirc_serial: Do not assume error codes returned by request_irq()
Ben Hutchings [Wed, 16 Nov 2011 04:54:04 +0000 (01:54 -0300)]
media: staging: lirc_serial: Do not assume error codes returned by request_irq()

commit affc9a0d59ac49bd304e2137bd5e4ffdd6fdfa52 upstream.

lirc_serial_probe() must fail if request_irq() returns an error, even if
it isn't EBUSY or EINVAL,

Signed-off-by: Ben Hutchings <>
Signed-off-by: Mauro Carvalho Chehab <>
Signed-off-by: Jonathan Nieder <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agomedia: staging: lirc_serial: Fix deadlock on resume failure
Ben Hutchings [Wed, 16 Nov 2011 04:53:25 +0000 (01:53 -0300)]
media: staging: lirc_serial: Fix deadlock on resume failure

commit 1ff1d88e862948ae5bfe490248c023ff8ac2855d upstream.

A resume function cannot remove the device it is resuming!

Signed-off-by: Ben Hutchings <>
Signed-off-by: Mauro Carvalho Chehab <>
Signed-off-by: Jonathan Nieder <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agomedia: staging: lirc_serial: Free resources on failure paths of lirc_serial_probe()
Ben Hutchings [Wed, 16 Nov 2011 04:52:11 +0000 (01:52 -0300)]
media: staging: lirc_serial: Free resources on failure paths of lirc_serial_probe()

commit c8e57e1b766c2321aa76ee5e6878c69bd2313d62 upstream.

Failure to allocate the I/O region leaves the IRQ allocated.
A later failure leaves them both allocated.

Reported-by: Torsten Crass <>
Signed-off-by: Ben Hutchings <>
Signed-off-by: Mauro Carvalho Chehab <>
Signed-off-by: Jonathan Nieder <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agomedia: staging: lirc_serial: Fix init/exit order
Ben Hutchings [Wed, 16 Nov 2011 04:49:41 +0000 (01:49 -0300)]
media: staging: lirc_serial: Fix init/exit order

commit 9105b8b200410383d0854bbe237ee385d7d33ba6 upstream.

Currently the module init function registers a platform_device and
only then allocates its IRQ and I/O region.  This allows allocation to
race with the device's suspend() function.  Instead, allocate
resources in the platform driver's probe() function and free them in
the remove() function.

The module exit function removes the platform device before the
character device that provides access to it.  Change it to reverse the
order of initialisation.

Signed-off-by: Ben Hutchings <>
Signed-off-by: Mauro Carvalho Chehab <>
Signed-off-by: Jonathan Nieder <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoARM: 7357/1: perf: fix overflow handling for xscale2 PMUs
Will Deacon [Tue, 6 Mar 2012 16:35:55 +0000 (17:35 +0100)]
ARM: 7357/1: perf: fix overflow handling for xscale2 PMUs

commit 3f31ae121348afd9ed39700ea2a63c17cd7eeed1 upstream.

xscale2 PMUs indicate overflow not via the PMU control register, but by
a separate overflow FLAG register instead.

This patch fixes the xscale2 PMU code to use this register to detect
to overflow and ensures that we clear any pending overflow when
disabling a counter.

Signed-off-by: Will Deacon <>
Signed-off-by: Russell King <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoARM: 7356/1: perf: check that we have an event in the PMU IRQ handlers
Will Deacon [Tue, 6 Mar 2012 16:34:50 +0000 (17:34 +0100)]
ARM: 7356/1: perf: check that we have an event in the PMU IRQ handlers

commit f6f5a30c834135c9f2fa10400c59ebbdd9188567 upstream.

The PMU IRQ handlers in perf assume that if a counter has overflowed
then perf must be responsible. In the paranoid world of crazy hardware,
this could be false, so check that we do have a valid event before
attempting to dereference NULL in the interrupt path.

Signed-off-by: Ming Lei <>
Signed-off-by: Will Deacon <>
Signed-off-by: Russell King <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoARM: 7355/1: perf: clear overflow flag when disabling counter on ARMv7 PMU
Will Deacon [Tue, 6 Mar 2012 16:34:22 +0000 (17:34 +0100)]
ARM: 7355/1: perf: clear overflow flag when disabling counter on ARMv7 PMU

commit 99c1745b9c76910e195889044f914b4898b7c9a5 upstream.

When disabling a counter on an ARMv7 PMU, we should also clear the
overflow flag in case an overflow occurred whilst stopping the counter.
This prevents a spurious overflow being picked up later and leading to
either false accounting or a NULL dereference.

Reported-by: Ming Lei <>
Signed-off-by: Will Deacon <>
Signed-off-by: Russell King <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoARM: 7354/1: perf: limit sample_period to half max_period in non-sampling mode
Will Deacon [Tue, 6 Mar 2012 16:33:17 +0000 (17:33 +0100)]
ARM: 7354/1: perf: limit sample_period to half max_period in non-sampling mode

commit 5727347180ebc6b4a866fcbe00dcb39cc03acb37 upstream.

On ARM, the PMU does not stop counting after an overflow and therefore
IRQ latency affects the new counter value read by the kernel. This is
significant for non-sampling runs where it is possible for the new value
to overtake the previous one, causing the delta to be out by up to
max_period events.

Commit a737823d ("ARM: 6835/1: perf: ensure overflows aren't missed due
to IRQ latency") attempted to fix this problem by allowing interrupt
handlers to pass an overflow flag to the event update function, causing
the overflow calculation to assume that the counter passed through zero
when going from prev to new. Unfortunately, this doesn't work when
overflow occurs on the perf_task_tick path because we have the flag
cleared and end up computing a large negative delta.

This patch removes the overflow flag from armpmu_event_update and
instead limits the sample_period to half of the max_period for
non-sampling profiling runs.

Signed-off-by: Ming Lei <>
Signed-off-by: Will Deacon <>
Signed-off-by: Russell King <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoARM: 7345/1: errata: update workaround for A9 erratum #743622
Will Deacon [Fri, 24 Feb 2012 11:12:38 +0000 (12:12 +0100)]
ARM: 7345/1: errata: update workaround for A9 erratum #743622

commit efbc74ace95338484f8d732037b99c7c77098fce upstream.

Erratum #743622 affects all r2 variants of the Cortex-A9 processor, so
ensure that the workaround is applied regardless of the revision.

Reported-by: Russell King <>
Signed-off-by: Will Deacon <>
Signed-off-by: Russell King <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoOMAPDSS: HDMI: hot plug detect fix
Rob Clark [Mon, 20 Feb 2012 21:03:36 +0000 (15:03 -0600)]
OMAPDSS: HDMI: hot plug detect fix

commit ca888a7958b3d808e4efd08ceff88913f4212c69 upstream.

The "OMAPDSS: HDMI: PHY burnout fix" commit switched the HDMI driver
over to using a GPIO for plug detect.  Unfortunately the ->detect()
method was not also updated, causing HDMI to no longer work for the
omapdrm driver (because it would actually check if a connection was
detected before attempting to enable display).

Signed-off-by: Rob Clark <>
Signed-off-by: Tomi Valkeinen <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoOMAPDSS: HDMI: PHY burnout fix
Tomi Valkeinen [Tue, 17 Jan 2012 09:09:57 +0000 (11:09 +0200)]
OMAPDSS: HDMI: PHY burnout fix

commit c49d005b6cc8491fad5b24f82805be2d6bcbd3dd upstream.

A hardware bug in the OMAP4 HDMI PHY causes physical damage to the board
if the HDMI PHY is kept powered on when the cable is not connected.

This patch solves the problem by adding hot-plug-detection into the HDMI
IP driver. This is not a real HPD support in the sense that nobody else
than the IP driver gets to know about the HPD events, but is only meant
to fix the HW bug.

The strategy is simple: If the display device is turned off by the user,
the PHY power is set to OFF. When the display device is turned on by the
user, the PHY power is set either to LDOON or TXON, depending on whether
the HDMI cable is connected.

The reason to avoid PHY OFF when the display device is on, but the cable
is disconnected, is that when the PHY is turned OFF, the HDMI IP is not
"ticking" and thus the DISPC does not receive pixel clock from the HDMI
IP. This would, for example, prevent any VSYNCs from happening, and
would thus affect the users of omapdss. By using LDOON when the cable is
disconnected we'll avoid the HW bug, but keep the HDMI working as usual
from the user's point of view.

Signed-off-by: Tomi Valkeinen <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoOMAP: 4430SDP/Panda: add HDMI HPD gpio
Tomi Valkeinen [Tue, 17 Jan 2012 09:05:32 +0000 (11:05 +0200)]
OMAP: 4430SDP/Panda: add HDMI HPD gpio

commit aa74274b464d4aa24703963ac89a0ee942d5d267 upstream.

Both Panda and 4430SDP use GPIO 63 as HDMI hot-plug-detect. Configure
this GPIO in the board files.

Signed-off-by: Tomi Valkeinen <>
Acked-by: Tony Lindgren <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoOMAP: 4430SDP/Panda: setup HDMI GPIO muxes
Tomi Valkeinen [Tue, 17 Jan 2012 09:02:36 +0000 (11:02 +0200)]
OMAP: 4430SDP/Panda: setup HDMI GPIO muxes

commit 78a1ad8f12db70b8b0a4548b90704de08ee216ce upstream.

The HDMI GPIO pins LS_OE and CT_CP_HPD are not currently configured.
This patch configures them as output pins.

Signed-off-by: Tomi Valkeinen <>
Acked-by: Tony Lindgren <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoOMAPDSS: remove wrong HDMI HPD muxing
Tomi Valkeinen [Tue, 17 Jan 2012 08:59:00 +0000 (10:59 +0200)]
OMAPDSS: remove wrong HDMI HPD muxing

commit 7bb122d155f742fe2d79849090c825be7b4a247e upstream.

"hdmi_hpd" pin is muxed to INPUT and PULLUP, but the pin is not
currently used, and in the future when it is used, the pin is used as a
GPIO and is board specific, not an OMAP4 wide thing.

So remove the muxing for now.

Signed-off-by: Tomi Valkeinen <>
Acked-by: Tony Lindgren <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoOMAP: 4430SDP/Panda: rename HPD GPIO to CT_CP_HPD
Tomi Valkeinen [Tue, 17 Jan 2012 08:49:38 +0000 (10:49 +0200)]
OMAP: 4430SDP/Panda: rename HPD GPIO to CT_CP_HPD

commit 3932a32fcf5393f8be70ac99dc718ad7ad0a415b upstream.

The GPIO 60 on 4430sdp and Panda is not HPD GPIO, as currently marked in
the board files, but CT_CP_HPD, which is used to enable/disable HPD

This patch renames the GPIO.

Signed-off-by: Tomi Valkeinen <>
Acked-by: Tony Lindgren <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoOMAP: 4430SDP/Panda: use gpio_free_array to free HDMI gpios
Tomi Valkeinen [Tue, 17 Jan 2012 09:04:53 +0000 (11:04 +0200)]
OMAP: 4430SDP/Panda: use gpio_free_array to free HDMI gpios

commit 575753e3bea3b67eef8e454fb87f719e3f7da599 upstream.

Instead of freeing the GPIOs individually, use gpio_free_array().

Signed-off-by: Tomi Valkeinen <>
Acked-by: Tony Lindgren <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoARM: orion: Fix Orion5x GPIO regression from MPP cleanup
Andrew Lunn [Wed, 8 Feb 2012 14:52:07 +0000 (15:52 +0100)]
ARM: orion: Fix Orion5x GPIO regression from MPP cleanup

commit b06540371063f0f07aafc1d1ac5e974da85c973c upstream.

Patchset "ARM: orion: Refactor the MPP code common in the orion
platform" broke at least Orion5x based platforms. These platforms have
pins configured as GPIO when the selector is not 0x0. However the
common code assumes the selector is always 0x0 for a GPIO lines. It
then ignores the GPIO bits in the MPP definitions, resulting in that
Orion5x machines cannot correctly configure there GPIO lines.

The Fix removes the assumption that the selector is always 0x0.
In order that none GPIO configurations are correctly blocked,
Kirkwood and mv78xx0 MPP definitions are corrected to only set the
GPIO bits for GPIO configurations.

This third version, which does not contain any whitespace changes,
and is rebased on v3.3-rc2.

Signed-off-by: Andrew Lunn <>
Acked-by: Nicolas Pitre <>
Signed-off-by: Olof Johansson <>
9 years agoARM: orion: Fix USB phy for orion5x.
Andrew Lunn [Wed, 8 Feb 2012 14:52:47 +0000 (15:52 +0100)]
ARM: orion: Fix USB phy for orion5x.

commit 72053353583230952c4b187e110e9da00dfc3afb upstream.

The patch "ARM: orion: Consolidate USB platform setup code.", commit
4fcd3f374a928081d391cd9a570afe3b2c692fdc broke USB on TS-7800 and
other orion5x boards, because the wrong type of PHY was being passed
to the EHCI driver in the platform data. Orion5x needs EHCI_PHY_ORION
and all the others want EHCI_PHY_NA.

Allow the mach- code to tell the generic plat-orion code which USB PHY
enum to place into the platform data.

Version 2: Rebase to v3.3-rc2.

Reported-by: Ambroz Bizjak <>
Signed-off-by: Andrew Lunn <>
Tested-by: Ambroz Bizjak <>
Acked-by: Nicolas Pitre <>
Signed-off-by: Olof Johansson <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodrm/i915: fix ELD writing for SandyBridge
Wu Fengguang [Fri, 9 Dec 2011 12:42:17 +0000 (20:42 +0800)]
drm/i915: fix ELD writing for SandyBridge

commit b3f33cbf7ace8fc149993ee35e0d0fd57f41d6d8 upstream.

SandyBridge should be using the same register addresses as IvyBridge.

Signed-off-by: Wu Fengguang <>
Signed-off-by: Keith Packard <>
Signed-off-by: Eugeni Dodonov <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodrm/i915: gen7: Disable the RHWO optimization as it can cause GPU hangs.
Kenneth Graunke [Wed, 8 Feb 2012 20:53:52 +0000 (12:53 -0800)]
drm/i915: gen7: Disable the RHWO optimization as it can cause GPU hangs.

commit d71de14ddf423ccc9a2e3f7e37553c99ead20d7c upstream.

The BSpec Workarounds page states that bits 10 and 26 must be set to
avoid 3D ring hangs.

Tested-by: Eugeni Dodonov <>
Signed-off-by: Kenneth Graunke <>
Signed-off-by: Jesse Barnes <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodrm/i915: gen7: work around a system hang on IVB
Eugeni Dodonov [Wed, 8 Feb 2012 20:53:51 +0000 (12:53 -0800)]
drm/i915: gen7: work around a system hang on IVB

commit db099c8f963fe656108e0a068274c5580a17f69b upstream.

This adds the workaround for WaCatErrorRejectionIssue which could result
in a system hang.

Tested-by: Eugeni Dodonov <>
Reviewed-by: Kenneth Graunke <>
Signed-off-by: Eugeni Dodonov <>
Signed-off-by: Jesse Barnes <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodrm/i915: gen7: Implement an L3 caching workaround.
Eugeni Dodonov [Wed, 8 Feb 2012 20:53:50 +0000 (12:53 -0800)]
drm/i915: gen7: Implement an L3 caching workaround.

commit e4e0c058a19c41150d12ad2d3023b3cf09c5de67 upstream.

This adds two cache-related workarounds for Ivy Bridge which can lead to
3D ring hangs and corruptions.

Tested-by: Eugeni Dodonov <>
Signed-off-by: Eugeni Dodonov <>
Signed-off-by: Kenneth Graunke <>
Signed-off-by: Jesse Barnes <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodrm/i915: gen7: implement rczunit workaround
Eugeni Dodonov [Wed, 8 Feb 2012 20:53:49 +0000 (12:53 -0800)]
drm/i915: gen7: implement rczunit workaround

commit eae66b50c760233fad526edf4a0d327be17a055d upstream.

This is yet another workaround related to clock gating which we need on
Ivy Bridge.

Tested-by: Eugeni Dodonov <>
Signed-off-by: Eugeni Dodonov <>
Signed-off-by: Kenneth Graunke <>
Signed-off-by: Jesse Barnes <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agortl8192cu: Add new device IDs
Larry Finger [Tue, 18 Oct 2011 22:52:01 +0000 (17:52 -0500)]
rtl8192cu: Add new device IDs

commit 6cddafab54e9a17b2efefe982547865955a5ff3a upstream.

The latest vendor (non-mac80211) driver of 9/22/2011 shows some new
device IDs for rtl8192cu. In addition, some typos in the table are
fixed and one duplicate is removed.

Signed-off-by: Larry Finger <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoACPI / PM: Do not save/restore NVS on Asus K54C/K54HR
Keng-Yu Lin [Thu, 1 Dec 2011 23:04:23 +0000 (00:04 +0100)]
ACPI / PM: Do not save/restore NVS on Asus K54C/K54HR

commit 5a50a7c32d630d6cdb13d69afabb0cc81b2f379c upstream.

The models do not resume correctly without acpi_sleep=nonvs.

Signed-off-by: Keng-Yu Lin <>
Signed-off-by: Rafael J. Wysocki <>
Cc: Tim Gardner <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoavr32: select generic atomic64_t support
Fabio Baltieri [Fri, 3 Feb 2012 23:37:14 +0000 (15:37 -0800)]
avr32: select generic atomic64_t support

commit 31e0017e6f6fb5cfdfaf932c1f98c9bef8d57688 upstream.

Enable use of the generic atomic64 implementation on AVR32 platforms.
Without this the kernel fails to build as the architecture does not
provide its version.

Signed-off-by: Fabio Baltieri <>
Acked-by: Hans-Christian Egtvedt <>
Cc: Haavard Skinnemoen <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Cc: Jean-Christophe PLAGNIOL-VILLARD <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agobsg: fix sysfs link remove warning
Stanislaw Gruszka [Wed, 8 Feb 2012 19:02:03 +0000 (20:02 +0100)]
bsg: fix sysfs link remove warning

commit 37b40adf2d1b4a5e51323be73ccf8ddcf3f15dd3 upstream.

We create "bsg" link if q-> is not NULL, so remove it only
when the same condition is true.


WARNING: at fs/sysfs/inode.c:323 sysfs_hash_and_remove+0x2b/0x77()
sysfs: can not remove 'bsg', no directory
Call Trace:
  [<c0429683>] warn_slowpath_common+0x6a/0x7f
  [<c0537a68>] ? sysfs_hash_and_remove+0x2b/0x77
  [<c042970b>] warn_slowpath_fmt+0x2b/0x2f
  [<c0537a68>] sysfs_hash_and_remove+0x2b/0x77
  [<c053969a>] sysfs_remove_link+0x20/0x23
  [<c05d88f1>] bsg_unregister_queue+0x40/0x6d
  [<c0692263>] __scsi_remove_device+0x31/0x9d
  [<c069149f>] scsi_forget_host+0x41/0x52
  [<c0689fa9>] scsi_remove_host+0x71/0xe0
  [<f7de5945>] quiesce_and_remove_host+0x51/0x83 [usb_storage]
  [<f7de5a1e>] usb_stor_disconnect+0x18/0x22 [usb_storage]
  [<c06c29de>] usb_unbind_interface+0x4e/0x109
  [<c067a80f>] __device_release_driver+0x6b/0xa6
  [<c067a861>] device_release_driver+0x17/0x22
  [<c067a46a>] bus_remove_device+0xd6/0xe6
  [<c06785e2>] device_del+0xf2/0x137
  [<c06c101f>] usb_disable_device+0x94/0x1a0

Signed-off-by: Stanislaw Gruszka <>
Signed-off-by: Jens Axboe <>
Signed-off-by: Tim Gardner <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoASoC: i.MX SSI: Fix DSP_A format.
Javier Martin [Thu, 23 Feb 2012 14:43:18 +0000 (15:43 +0100)]
ASoC: i.MX SSI: Fix DSP_A format.

commit 5ed80a75b248bfaf840ea6b38f941edcf6ee7dc7 upstream.

According to i.MX27 Reference Manual (p 1593) TXBIT0 bit selects
whether the most significant or the less significant part of the
data word written to the FIFO is transmitted.

As DSP_A is the same as DSP_B with a data offset of 1 bit, it
doesn't make any sense to remove TXBIT0 bit here.

Signed-off-by: Javier Martin <>
Acked-by: Sascha Hauer <>
Signed-off-by: Mark Brown <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoASoC: dapm: Check for bias level when powering down
Mark Brown [Wed, 22 Feb 2012 15:52:56 +0000 (15:52 +0000)]
ASoC: dapm: Check for bias level when powering down

commit 7679e42ec833ed70aa34790a5f39dcb7e5bda4fe upstream.

Recent enhancements in the bias management means that we might not be
in standby when the CODEC is idle and can have active widgets without
being in full power mode but the shutdown functionality assumes these
things. Add checks for the bias level at each stage so that we don't
do transitions other than the ON->PREPARE->STANDBY->OFF ones that the
drivers are expecting.

Signed-off-by: Mark Brown <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoviafb: fix IGA1 modesetting on VX900
Florian Tobias Schandinat [Wed, 22 Feb 2012 18:53:08 +0000 (18:53 +0000)]
viafb: fix IGA1 modesetting on VX900

commit e29206381a1436e0f47c0f5b9a23159a03c57715 upstream.

Even if the documentation calls this bit "Reserved" it has to be set
to 0 for correct modesetting on IGA1.

Signed-off-by: Florian Tobias Schandinat <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoviafb: select HW scaling on VX900 for IGA2
Florian Tobias Schandinat [Wed, 22 Feb 2012 18:53:07 +0000 (18:53 +0000)]
viafb: select HW scaling on VX900 for IGA2

commit 050f0e02c8dc38b2b4f2df345ac760d22ca5c7ba upstream.

VX900 can do hardware scaling for both IGAs in contrast to previous
hardware which could do it only for IGA2. This patch ensures that
we set the parameter for IGA2 and not for IGA1. This fixes hardware
scaling on VX900 until we have the infrastructure to support it for
both IGAs.

Signed-off-by: Florian Tobias Schandinat <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoosd_uld: Bump MAX_OSD_DEVICES from 64 to 1,048,576
Boaz Harrosh [Wed, 25 Jan 2012 19:42:58 +0000 (21:42 +0200)]
osd_uld: Bump MAX_OSD_DEVICES from 64 to 1,048,576

commit 41f8ad76362e7aefe3a03949c43e23102dae6e0b upstream.

It used to be that minors where 8 bit. But now they
are actually 20 bit. So the fix is simplicity itself.

I've tested with 300 devices and all user-mode utils
work just fine. I have also mechanically added 10,000
to the ida (so devices are /dev/osd10000, /dev/osd10001 ...)
and was able to mkfs an exofs filesystem and access osds
from user-mode.

All the open-osd user-mode code uses the same library
to access devices through their symbolic names in
/dev/osdX so I'd say it's pretty safe. (Well tested)

This patch is very important because some of the systems
that will be deploying the 3.2 pnfs-objects code are larger
than 64 OSDs and will stop to work properly when reaching
that number.

Signed-off-by: Boaz Harrosh <>
Signed-off-by: James Bottomley <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agocrypto: mv_cesa - fix final callback not ignoring input data
Phil Sutter [Mon, 27 Feb 2012 11:17:04 +0000 (12:17 +0100)]
crypto: mv_cesa - fix final callback not ignoring input data

commit f8f54e190ddb4ed697036b60f5e2ae6dd45b801c upstream.

Broken by commit 6ef84509f3d439ed2d43ea40080643efec37f54f for users
passing a request with non-zero 'nbytes' field, like e.g. testmgr.

Signed-off-by: Phil Sutter <>
Signed-off-by: Herbert Xu <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoHID: usbhid: Add NOGET quirk for the AIREN Slim+ keyboard
Alan Stern [Mon, 27 Feb 2012 16:23:45 +0000 (11:23 -0500)]
HID: usbhid: Add NOGET quirk for the AIREN Slim+ keyboard

commit 37891abc8464637964a26ae4b61d307fef831f80 upstream.

This patch (as1531) adds a NOGET quirk for the Slim+ keyboard marketed
by AIREN.  This keyboard seems to have a lot of bugs; NOGET works
around only one of them.

Signed-off-by: Alan Stern <>
Reported-by: okias <>
Signed-off-by: Jiri Kosina <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agorapidio/tsi721: fix queue wrapping bug in inbound doorbell handler
Alexandre Bounine [Mon, 5 Mar 2012 22:59:21 +0000 (14:59 -0800)]
rapidio/tsi721: fix queue wrapping bug in inbound doorbell handler

commit b24823e61bfd93d0e72088e4f5245287582ed289 upstream.

Fix a bug that causes a kernel panic when the number of received doorbells
is larger than number of entries in the inbound doorbell queue (current
default value = 512).

Another possible indication for this bug is large number of spurious
doorbells reported by tsi721 driver after reaching the queue size maximum.

Signed-off-by: Alexandre Bounine <>
Cc: Chul Kim <>
Cc: Matt Porter <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoS390: qdio: fix handler function arguments for zfcp data router
Steffen Maier [Fri, 2 Mar 2012 16:32:58 +0000 (17:32 +0100)]
S390: qdio: fix handler function arguments for zfcp data router

commit 7b3cc67d4445995a025a4b55a7dc687b6829b4ca upstream.

Git commit 25f269f17316549e "[S390] qdio: EQBS retry after CCQ 96"
introduced a regression in regard to the zfcp data router.
Revoke the incorrect simplification of the function call arguments
for the qdio handler to make the zfcp hardware data router working

This is applicable to 3.2+ kernels.

Signed-off-by: Steffen Maier <>
Reviewed-by: Jan Glauber <>
Signed-off-by: Martin Schwidefsky <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agotty/powerpc: early udbg consoles can't be modules
Stephen Rothwell [Sun, 19 Feb 2012 20:22:38 +0000 (07:22 +1100)]
tty/powerpc: early udbg consoles can't be modules

commit f21c6d4a49179f91fd70a41382382f08c780d425 upstream.

Fixes these build errors:

ERROR: ".udbg_printf" [drivers/tty/ehv_bytechan.ko] undefined!
ERROR: ".register_early_udbg_console" [drivers/tty/ehv_bytechan.ko] undefined!
ERROR: "udbg_putc" [drivers/tty/ehv_bytechan.ko] undefined!

Cc: Timur Tabi <>
Signed-off-by: Stephen Rothwell <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoiwlwifi: fix key removal
Johannes Berg [Fri, 17 Feb 2012 17:47:14 +0000 (09:47 -0800)]
iwlwifi: fix key removal

commit 5dcbf480473f6c3f06ad2426b7517038a2a18911 upstream.

When trying to remove a key, we always send key
flags just setting the key type, not including
the multicast flag and the key ID. As a result,
whenever any key was removed, the unicast key 0
would be removed, causing a complete connection
loss after the second rekey (the first doesn't
cause a key removal). Fix the key removal code
to include the key ID and multicast flag, thus
removing the correct key.

Reported-by: Alexander Schnaidt <>
Tested-by: Alexander Schnaidt <>
Signed-off-by: Johannes Berg <>
Signed-off-by: Wey-Yi Guy <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agomm: thp: fix BUG on mm->nr_ptes
Andrea Arcangeli [Mon, 5 Mar 2012 22:59:20 +0000 (14:59 -0800)]
mm: thp: fix BUG on mm->nr_ptes

commit 1c641e84719429bbfe62a95ed3545ee7fe24408f upstream.

Dave Jones reports a few Fedora users hitting the BUG_ON(mm->nr_ptes...)
in exit_mmap() recently.

Quoting Hugh's discovery and explanation of the SMP race condition:

  "mm->nr_ptes had unusual locking: down_read mmap_sem plus
   page_table_lock when incrementing, down_write mmap_sem (or mm_users
   0) when decrementing; whereas THP is careful to increment and
   decrement it under page_table_lock.

   Now most of those paths in THP also hold mmap_sem for read or write
   (with appropriate checks on mm_users), but two do not: when
   split_huge_page() is called by hwpoison_user_mappings(), and when
   called by add_to_swap().

   It's conceivable that the latter case is responsible for the
   exit_mmap() BUG_ON mm->nr_ptes that has been reported on Fedora."

The simplest way to fix it without having to alter the locking is to make
split_huge_page() a noop in nr_ptes terms, so by counting the preallocated
pagetables that exists for every mapped hugepage.  It was an arbitrary
choice not to count them and either way is not wrong or right, because
they are not used but they're still allocated.

Reported-by: Dave Jones <>
Reported-by: Hugh Dickins <>
Signed-off-by: Andrea Arcangeli <>
Acked-by: Hugh Dickins <>
Cc: David Rientjes <>
Cc: Josh Boyer <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agokprobes: return proper error code from register_kprobe()
Prashanth Nageshappa [Mon, 5 Mar 2012 22:59:12 +0000 (14:59 -0800)]
kprobes: return proper error code from register_kprobe()

commit f986a499ef6f317d906e6f6f281be966e1237a10 upstream.

register_kprobe() aborts if the address of the new request falls in a
prohibited area (such as ftrace pouch, __kprobes annotated functions,
non-kernel text addresses, jump label text).  We however don't return the
right error on this abort, resulting in a silent failure - incorrect
adding/reporting of kprobes ('perf probe do_fork+18' or 'perf probe
mcount' for instance).

In V2 we are incorporating Masami Hiramatsu's  feedback.

This patch fixes it by returning -EINVAL upon failure.

While we are here, rename the label used for exit to be more appropriate.

Signed-off-by: Ananth N Mavinakayanahalli <>
Signed-off-by: Prashanth K Nageshappa <>
Acked-by: Masami Hiramatsu <>
Cc: Jason Baron <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoath9k_hw: prevent writes to const data on AR9160
Felix Fietkau [Wed, 15 Feb 2012 18:31:20 +0000 (19:31 +0100)]
ath9k_hw: prevent writes to const data on AR9160

commit 9bbb8168ed3d8b946f9c1901a63a675012de88f2 upstream.

Duplicate the data for iniAddac early on, to avoid having to do redundant
memcpy calls later. While we're at it, make AR5416 < v2.2 use the same
codepath. Fixes a reported crash on x86.

Signed-off-by: Felix Fietkau <>
Reported-by: Magnus Määttä <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agomac80211: zero initialize count field in ieee80211_tx_rate
Mohammed Shafi Shajakhan [Mon, 20 Feb 2012 04:35:31 +0000 (10:05 +0530)]
mac80211: zero initialize count field in ieee80211_tx_rate

commit 8617b093d0031837a7be9b32bc674580cfb5f6b5 upstream.

rate control algorithms concludes the rate as invalid
with rate[i].idx < -1 , while they do also check for rate[i].count is
non-zero. it would be safer to zero initialize the 'count' field.
recently we had a ath9k rate control crash where the ath9k rate control
in ath_tx_status assumed to check only for rate[i].count being non-zero
in one instance and ended up in using invalid rate index for
'connection monitoring NULL func frames' which eventually lead to the crash.
thanks to Pavel Roskin for fixing it and finding the root cause.

Cc: Pavel Roskin <>
Signed-off-by: Mohammed Shafi Shajakhan <>
Signed-off-by: John W. Linville <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agocifs: fix dentry refcount leak when opening a FIFO on lookup
Jeff Layton [Thu, 23 Feb 2012 14:37:45 +0000 (09:37 -0500)]
cifs: fix dentry refcount leak when opening a FIFO on lookup

commit 5bccda0ebc7c0331b81ac47d39e4b920b198b2cd upstream.

The cifs code will attempt to open files on lookup under certain
circumstances. What happens though if we find that the file we opened
was actually a FIFO or other special file?

Currently, the open filehandle just ends up being leaked leading to
a dentry refcount mismatch and oops on umount. Fix this by having the
code close the filehandle on the server if it turns out not to be a
regular file. While we're at it, change this spaghetti if statement
into a switch too.

Reported-by: CAI Qian <>
Tested-by: CAI Qian <>
Reviewed-by: Shirish Pargaonkar <>
Signed-off-by: Jeff Layton <>
Signed-off-by: Steve French <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoNOMMU: Don't need to clear vm_mm when deleting a VMA
David Howells [Thu, 23 Feb 2012 13:51:00 +0000 (13:51 +0000)]
NOMMU: Don't need to clear vm_mm when deleting a VMA

commit b94cfaf6685d691dc3fab023cf32f65e9b7be09c upstream.

Don't clear vm_mm in a deleted VMA as it's unnecessary and might
conceivably break the filesystem or driver VMA close routine.

Reported-by: Al Viro <>
Signed-off-by: David Howells <>
Acked-by: Al Viro <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agomm: memcg: Correct unregistring of events attached to the same eventfd
Anton Vorontsov [Fri, 24 Feb 2012 01:14:46 +0000 (05:14 +0400)]
mm: memcg: Correct unregistring of events attached to the same eventfd

commit 371528caec553785c37f73fa3926ea0de84f986f upstream.

There is an issue when memcg unregisters events that were attached to
the same eventfd:

- On the first call mem_cgroup_usage_unregister_event() removes all
  events attached to a given eventfd, and if there were no events left,
  thresholds->primary would become NULL;

- Since there were several events registered, cgroups core will call
  mem_cgroup_usage_unregister_event() again, but now kernel will oops,
  as the function doesn't expect that threshold->primary may be NULL.

That's a good question whether mem_cgroup_usage_unregister_event()
should actually remove all events in one go, but nowadays it can't
do any better as cftype->unregister_event callback doesn't pass
any private event-associated cookie. So, let's fix the issue by
simply checking for threshold->primary.

FWIW, w/o the patch the following oops may be observed:

 BUG: unable to handle kernel NULL pointer dereference at 0000000000000004
 IP: [<ffffffff810be32c>] mem_cgroup_usage_unregister_event+0x9c/0x1f0
 Pid: 574, comm: kworker/0:2 Not tainted 3.3.0-rc4+ #9 Bochs Bochs
 RIP: 0010:[<ffffffff810be32c>]  [<ffffffff810be32c>] mem_cgroup_usage_unregister_event+0x9c/0x1f0
 RSP: 0018:ffff88001d0b9d60  EFLAGS: 00010246
 Process kworker/0:2 (pid: 574, threadinfo ffff88001d0b8000, task ffff88001de91cc0)
 Call Trace:
  [<ffffffff8107092b>] cgroup_event_remove+0x2b/0x60
  [<ffffffff8103db94>] process_one_work+0x174/0x450
  [<ffffffff8103e413>] worker_thread+0x123/0x2d0

Signed-off-by: Anton Vorontsov <>
Acked-by: KAMEZAWA Hiroyuki <>
Cc: Kirill A. Shutemov <>
Cc: Michal Hocko <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoaio: wake up waiters when freeing unused kiocbs
Jeff Moyer [Mon, 5 Mar 2012 22:59:12 +0000 (14:59 -0800)]
aio: wake up waiters when freeing unused kiocbs

commit 880641bb9da2473e9ecf6c708d993b29928c1b3c upstream.

Bart Van Assche reported a hung fio process when either hot-removing
storage or when interrupting the fio process itself.  The (pruned) call
trace for the latter looks like so:

  fio             D 0000000000000001     0  6849   6848 0x00000004
   ffff880092541b88 0000000000000046 ffff880000000000 ffff88012fa11dc0
   ffff88012404be70 ffff880092541fd8 ffff880092541fd8 ffff880092541fd8
   ffff880128b894d0 ffff88012404be70 ffff880092541b88 000000018106f24d
  Call Trace:

The problem lies with the allocation batching code.  It will
opportunistically allocate kiocbs, and then trim back the list of iocbs
when there is not enough room in the completion ring to hold all of the

In the case above, what happens is that the pruning back of events ends
up freeing up the last active request and the context is marked as dead,
so it is thus responsible for waking up waiters.  Unfortunately, the
code does not check for this condition, so we end up with a hung task.

Signed-off-by: Jeff Moyer <>
Reported-by: Bart Van Assche <>
Tested-by: Bart Van Assche <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agommc: sdhci-esdhc-imx: fix for mmc cards on i.MX5
Sascha Hauer [Fri, 17 Feb 2012 10:51:49 +0000 (11:51 +0100)]
mmc: sdhci-esdhc-imx: fix for mmc cards on i.MX5

commit 5b6b0ad6e572b32a641116aaa5f897ffebe31e44 upstream.

On i.MX53 we have to write a special SDHCI_CMD_ABORTCMD to the
command. This works for SD cards. However, with MMC cards
the MMC_SET_BLOCK_COUNT command is used instead, but this
needs the same handling. Fix MMC cards by testing for the
MMC_SET_BLOCK_COUNT command aswell. Tested on a custom i.MX53
board with a Transcend MMC+ card and eMMC.

The kernel started used MMC_SET_BLOCK_COUNT in 3.0, so this
is a regression for these boards introduced in 3.0; it should
go to 3.0/3.1/3.2-stable.

Signed-off-by: Sascha Hauer <>
Acked-by: Shawn Guo <>
Signed-off-by: Chris Ball <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agommc: atmel-mci: don't use dma features when using DMA with no chan available
Ludovic Desroches [Thu, 9 Feb 2012 15:33:53 +0000 (16:33 +0100)]
mmc: atmel-mci: don't use dma features when using DMA with no chan available

commit ef8781989a1bcd05aa47e853917c37df44917194 upstream.

Some callbacks are set too early -- i.e. we can have dma capabilities but
we can't get a dma channel. So wait to get the dma channel before setting
callbacks and change logs consequently.

Signed-off-by: Ludovic Desroches <>
Signed-off-by: Nicolas Ferre <>
Signed-off-by: Chris Ball <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoalpha: fix 32/64-bit bug in futex support
Andrew Morton [Mon, 5 Mar 2012 22:59:19 +0000 (14:59 -0800)]
alpha: fix 32/64-bit bug in futex support

commit 62aca403657fe30e5235c5331e9871e676d9ea0a upstream.

Michael Cree said:

: : I have noticed some user space problems (pulseaudio crashes in pthread
: : code, glibc/nptl test suite failures, java compiler freezes on SMP alpha
: : systems) that arise when using a 2.6.39 or later kernel on Alpha.
: : Bisecting between 2.6.38 and 2.6.39 (using glibc/nptl test suite as
: : criterion for good/bad kernel) eventually leads to:
: :
: : 8d7718aa082aaf30a0b4989e1f04858952f941bc is the first bad commit
: : commit 8d7718aa082aaf30a0b4989e1f04858952f941bc
: : Author: Michel Lespinasse <>
: : Date:   Thu Mar 10 18:50:58 2011 -0800
: :
: :     futex: Sanitize futex ops argument types
: :
: :     Change futex_atomic_op_inuser and futex_atomic_cmpxchg_inatomic
: :     prototypes to use u32 types for the futex as this is the data type the
: :     futex core code uses all over the place.
: :
: : Looking at the commit I see there is a change of the uaddr argument in
: : the Alpha architecture specific code for futexes from int to u32, but I
: : don't see why this should cause a problem.

Richard Henderson said:

: futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
:                               u32 oldval, u32 newval)
: ...
:         :       "r"(uaddr), "r"((long)oldval), "r"(newval)
: There is no 32-bit compare instruction.  These are implemented by
: consistently extending the values to a 64-bit type.  Since the
: load instruction sign-extends, we want to sign-extend the other
: quantity as well (despite the fact it's logically unsigned).
: So:
: -        :       "r"(uaddr), "r"((long)oldval), "r"(newval)
: +        :       "r"(uaddr), "r"((long)(int)oldval), "r"(newval)
: should do the trick.

Michael said:

: This fixes the glibc test suite failures and the pulseaudio related
: crashes, but it does not fix the java compiiler lockups that I was (and
: are still) observing.  That is some other problem.

Reported-by: Michael Cree <>
Tested-by: Michael Cree <>
Acked-by: Phil Carmody <>
Cc: Richard Henderson <>
Cc: Michel Lespinasse <>
Cc: Ivan Kokshaysky <>
Reviewed-by: Matt Turner <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoMove Logitech Harmony 900 from cdc_ether to zaurus
Scott Talbert [Tue, 21 Feb 2012 13:06:00 +0000 (13:06 +0000)]
Move Logitech Harmony 900 from cdc_ether to zaurus

commit ee932bf9acb2e2c6a309e808000f24856330e3f9 upstream.

In the current kernel implementation, the Logitech Harmony 900 remote
control is matched to the cdc_ether driver through the generic
USB_CDC_SUBCLASS_MDLM entry.  However, this device appears to be of the
pseudo-MDLM (Belcarra) type, rather than the standard one.  This patch
blacklists the Harmony 900 from the cdc_ether driver and whitelists it for
the pseudo-MDLM driver in zaurus.

Signed-off-by: Scott Talbert <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoARM: S3C24XX: DMA resume regression fix
Gusakov Andrey [Fri, 2 Mar 2012 22:32:36 +0000 (07:32 +0900)]
ARM: S3C24XX: DMA resume regression fix

commit e39d40c65dfd8390b50c03482ae9e289b8a8f351 upstream.

s3c2410_dma_suspend suspends channels from 0 to dma_channels.
s3c2410_dma_resume resumes channels in reverse order. So
pointer should be decremented instead of being incremented.

Signed-off-by: Gusakov Andrey <>
Reviewed-by: Heiko Stuebner <>
Signed-off-by: Kukjin Kim <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agogenirq: Clear action->thread_mask if IRQ_ONESHOT is not set
Thomas Gleixner [Tue, 6 Mar 2012 22:18:54 +0000 (23:18 +0100)]
genirq: Clear action->thread_mask if IRQ_ONESHOT is not set

commit 52abb700e16a9aa4cbc03f3d7f80206cbbc80680 upstream.

Xommit ac5637611(genirq: Unmask oneshot irqs when thread was not woken)
fails to unmask when a !IRQ_ONESHOT threaded handler is handled by

This happens because thread_mask is or'ed unconditionally in
irq_wake_thread(), but for !IRQ_ONESHOT interrupts never cleared.  So
the check for !desc->thread_active fails and keeps the interrupt

Keep the thread_mask zero for !IRQ_ONESHOT interrupts.

Document the thread_mask magic while at it.

Reported-and-tested-by: Sven Joachim <>
Reported-and-tested-by: Stefan Lippers-Hollmann <>
Signed-off-by: Thomas Gleixner <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agomfd: Test for jack detection when deciding if wm8994 should suspend
Mark Brown [Mon, 20 Feb 2012 21:32:32 +0000 (21:32 +0000)]
mfd: Test for jack detection when deciding if wm8994 should suspend

commit e7c248a049c2aac21bded0b0722caee6f0e57256 upstream.

The jack detection on WM1811 is often required during system suspend, add
it as another check when deciding if we should suspend.

Signed-off-by: Mark Brown <>
Signed-off-by: Samuel Ortiz <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agomfd: Fix ACPI conflict check
Jean Delvare [Sat, 18 Feb 2012 16:54:23 +0000 (17:54 +0100)]
mfd: Fix ACPI conflict check

commit 81b5482c32769abb6dfb979560dab2f952ba86fa upstream.

The code is currently always checking the first resource of every
device only (several times.) This has been broken since the ACPI check
was added in February 2010 in commit

Fix the check to run on each resource individually, once.

Signed-off-by: Jean Delvare <>
Signed-off-by: Samuel Ortiz <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoregset: Return -EFAULT, not -EIO, on host-side memory fault
H. Peter Anvin [Fri, 2 Mar 2012 18:43:49 +0000 (10:43 -0800)]
regset: Return -EFAULT, not -EIO, on host-side memory fault

commit 5189fa19a4b2b4c3bec37c3a019d446148827717 upstream.

There is only one error code to return for a bad user-space buffer
pointer passed to a system call in the same address space as the
system call is executed, and that is EFAULT.  Furthermore, the
low-level access routines, which catch most of the faults, return
EFAULT already.

Signed-off-by: H. Peter Anvin <>
Reviewed-by: Oleg Nesterov <>
Acked-by: Roland McGrath <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoregset: Prevent null pointer reference on readonly regsets
H. Peter Anvin [Fri, 2 Mar 2012 18:43:48 +0000 (10:43 -0800)]
regset: Prevent null pointer reference on readonly regsets

commit c8e252586f8d5de906385d8cf6385fee289a825e upstream.

The regset common infrastructure assumed that regsets would always
have .get and .set methods, but not necessarily .active methods.
Unfortunately people have since written regsets without .set methods.

Rather than putting in stub functions everywhere, handle regsets with
null .get or .set methods explicitly.

Signed-off-by: H. Peter Anvin <>
Reviewed-by: Oleg Nesterov <>
Acked-by: Roland McGrath <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoALSA: hda - Always set HP pin in unsol handler for STAC/IDT codecs
Takashi Iwai [Wed, 29 Feb 2012 08:41:17 +0000 (09:41 +0100)]
ALSA: hda - Always set HP pin in unsol handler for STAC/IDT codecs

commit 7bff172a352a2fbe9856bba517d71a2072aab041 upstream.

A bug report with an old Sony laptop showed that we can't rely on BIOS
setting the pins of headphones but the driver should set always by

Signed-off-by: Takashi Iwai <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoALSA: hda - Add a fake mute feature
Takashi Iwai [Mon, 27 Feb 2012 14:00:58 +0000 (15:00 +0100)]
ALSA: hda - Add a fake mute feature

commit 3868137ea41866773e75d9ac4b9988dcc361ff1d upstream.

Some codecs don't supply the mute amp-capabilities although the lowest
volume gives the mute.  It'd be handy if the parser provides the mute
mixers in such a case.

This patch adds an extension amp-cap bit (which is used only in the
driver) to represent the min volume = mute state.  Also modified the
amp cache code to support the fake mute feature when this bit is set
but the real mute bit is unset.

In addition, conexant cx5051 parser uses this new feature to implement
the missing mute controls.


Signed-off-by: Takashi Iwai <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoALSA: hda/realtek - Fix resume of multiple input sources
Takashi Iwai [Sat, 25 Feb 2012 10:13:16 +0000 (11:13 +0100)]
ALSA: hda/realtek - Fix resume of multiple input sources

commit 068b939431486f524438330b0848a8222e33d421 upstream.

When there are multiple input sources, the driver wrongly overwrites with
the value of the last input source on other slots at resume.  Thus the
primary input source may be shown wrongly.

Reported-and-tested-by: Julian Sikorski <>
Signed-off-by: Takashi Iwai <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoperf/x86/kvm: Fix Host-Only/Guest-Only counting with SVM disabled
Joerg Roedel [Wed, 29 Feb 2012 13:57:32 +0000 (14:57 +0100)]
perf/x86/kvm: Fix Host-Only/Guest-Only counting with SVM disabled

commit 1018faa6cf23b256bf25919ef203cd7c129f06f2 upstream.

It turned out that a performance counter on AMD does not
count at all when the GO or HO bit is set in the control
register and SVM is disabled in EFER.

This patch works around this issue by masking out the HO bit
in the performance counter control register when SVM is not

The GO bit is not touched because it is only set when the
user wants to count in guest-mode only. So when SVM is
disabled the counter should not run at all and the
not-counting is the intended behaviour.

Signed-off-by: Joerg Roedel <>
Signed-off-by: Peter Zijlstra <>
Cc: Avi Kivity <>
Cc: Stephane Eranian <>
Cc: David Ahern <>
Cc: Gleb Natapov <>
Cc: Robert Richter <>
Signed-off-by: Ingo Molnar <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoS390: KEYS: Enable the compat keyctl wrapper on s390x
David Howells [Fri, 24 Feb 2012 17:01:27 +0000 (18:01 +0100)]
S390: KEYS: Enable the compat keyctl wrapper on s390x

commit 1d057720609ed052a6371fe1d53300e5e6328e94 upstream.

Enable the compat keyctl wrapper on s390x so that 32-bit s390 userspace can
call the keyctl() syscall.

There's an s390x assembly wrapper that truncates all the register values to
32-bits and this then calls compat_sys_keyctl() - but the latter only exists if
CONFIG_KEYS_COMPAT is enabled, and the s390 Kconfig doesn't enable it.

Without this patch, 32-bit calls to the keyctl() syscall are given an ENOSYS

[root@devel4 ~]# keyctl show
Session Keyring
-3: key inaccessible (Function not implemented)

Signed-off-by: David Howells <>
Cc: Carsten Otte <>
Reviewed-by: Christian Borntraeger <>
Signed-off-by: Heiko Carstens <>
Signed-off-by: Martin Schwidefsky <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoregulator: fix the ldo configure according to 88pm860x spec
Jett.Zhou [Thu, 23 Feb 2012 11:52:08 +0000 (19:52 +0800)]
regulator: fix the ldo configure according to 88pm860x spec

commit 3380643b0eaa7ecf99c4f095bdfcb6e5df471616 upstream.

Signed-off-by: Jett.Zhou <>
Signed-off-by: Mark Brown <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoi2c: mxs: only flag completion when queue is completely done
Wolfram Sang [Fri, 13 Jan 2012 11:14:26 +0000 (12:14 +0100)]
i2c: mxs: only flag completion when queue is completely done

commit 844990daa2e69a4258049ba9c2bae1180657dac3 upstream.

The hardware generates an interrupt for every completed command in the
queue while the code assumed that it will only generate one interrupt
when the queue is empty. So, explicitly check if the queue is really
empty. This patch fixed problems which occurred due to high traffic on
the bus. While we are here, move the completion-initialization after the
parameter error checking.

Signed-off-by: Wolfram Sang <>
Cc: Shawn Guo <>
Cc: Marek Vasut <>
Cc: Lothar Waßmann <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agowatchdog: hpwdt: clean up set_memory_x call for 32 bit
Maxim Uvarov [Mon, 16 Jan 2012 04:02:50 +0000 (20:02 -0800)]
watchdog: hpwdt: clean up set_memory_x call for 32 bit

commit 97d2a10d5804d585ab0b58efbd710948401b886a upstream.

1. address has to be page aligned.
2. set_memory_x uses page size argument, not size.
Bug causes with following commit:
commit da28179b4e90dda56912ee825c7eaa62fc103797
Author: Mingarelli, Thomas <>
Date:   Mon Nov 7 10:59:00 2011 +0100

     watchdog: hpwdt: Changes to handle NX secure bit in 32bit path

    commit e67d668e147c3b4fec638c9e0ace04319f5ceccd upstream.

    This patch makes use of the set_memory_x() kernel API in order
    to make necessary BIOS calls to source NMIs.

Signed-off-by: Maxim Uvarov <>
Signed-off-by: Wim Van Sebroeck <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoARM: LPC32xx: Fix irq on GPI_28
Roland Stigge [Mon, 27 Feb 2012 16:28:02 +0000 (17:28 +0100)]
ARM: LPC32xx: Fix irq on GPI_28

commit f6737055c1c432a9628a9a731f9881ad8e0a9eee upstream.

The GPI_28 IRQ was not registered properly. The registration of
IRQ_LPC32XX_GPI_28 was added and the (wrong) IRQ_LPC32XX_GPI_11 at
LPC32XX_SIC1_IRQ(4) was replaced by IRQ_LPC32XX_GPI_28 (see manual of
LPC32xx / interrupt controller).

Signed-off-by: Roland Stigge <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoARM: LPC32xx: Fix interrupt controller init
Roland Stigge [Mon, 27 Feb 2012 16:28:02 +0000 (17:28 +0100)]
ARM: LPC32xx: Fix interrupt controller init

commit 35dd0a75d4a382e7f769dd0277732e7aa5235718 upstream.

This patch fixes the initialization of the interrupt controller of the LPC32xx
by correctly setting up SIC1 and SIC2 instead of (wrongly) using the same value
as for the Main Interrupt Controller (MIC).

Signed-off-by: Roland Stigge <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoARM: LPC32xx: irq.c: Clear latched event
Roland Stigge [Mon, 27 Feb 2012 16:28:02 +0000 (17:28 +0100)]
ARM: LPC32xx: irq.c: Clear latched event

commit 94ed7830cba4dce57b18a2926b5d826bfd184bd6 upstream.

This patch fixes the wakeup disable function by clearing latched events.

Signed-off-by: Roland Stigge <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoARM: LPC32xx: serial.c: Fixed loop limit
Roland Stigge [Mon, 27 Feb 2012 16:28:03 +0000 (17:28 +0100)]
ARM: LPC32xx: serial.c: Fixed loop limit

commit ff424aa4c89d19082e8ae5a3351006bc8a4cd91b upstream.

This patch fixes a wrong loop limit on UART init.

Signed-off-by: Roland Stigge <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoARM: LPC32xx: serial.c: HW bug workaround
Roland Stigge [Mon, 27 Feb 2012 16:28:02 +0000 (17:28 +0100)]
ARM: LPC32xx: serial.c: HW bug workaround

commit 2707208ee8a80dbbd5426f5aa1a934f766825bb5 upstream.

This patch fixes a HW bug by flushing RX FIFOs of the UARTs on init. It was
ported from NXP's tree.

Signed-off-by: Roland Stigge <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agodrm/i915: Prevent a machine hang by checking crtc->active before loading lut
Alban Browaeys [Fri, 24 Feb 2012 17:12:45 +0000 (17:12 +0000)]
drm/i915: Prevent a machine hang by checking crtc->active before loading lut

commit aed3f09db39596e539f90b11a5016aea4d8442e1 upstream.

Before loading the lut (gamma), check the active state of intel_crtc,
otherwise at least on gen2 hang ensue.

This is reproducible in Xorg via:
  xset dpms force off
  xgamma -rgamma 2.0 # freeze.

Signed-off-by: Alban Browaeys <>
Signed-off-by: Chris Wilson <>
Reviewed-by: Jesse Barnes <>
Signed-off-by: Jesse Barnes <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agocompat: fix compile breakage on s390
Heiko Carstens [Mon, 27 Feb 2012 09:01:52 +0000 (10:01 +0100)]
compat: fix compile breakage on s390

commit 048cd4e51d24ebf7f3552226d03c769d6ad91658 upstream.

The new is_compat_task() define for the !COMPAT case in
include/linux/compat.h conflicts with a similar define in

This is the minimal patch which fixes the build issues.

Signed-off-by: Heiko Carstens <>
Signed-off-by: Linus Torvalds <>
Cc: Jonathan Nieder <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoFix autofs compile without CONFIG_COMPAT
Linus Torvalds [Sun, 26 Feb 2012 17:44:55 +0000 (09:44 -0800)]
Fix autofs compile without CONFIG_COMPAT

commit 3c761ea05a8900a907f32b628611873f6bef24b2 upstream.

The autofs compat handling fix caused a compile failure when
CONFIG_COMPAT isn't defined.

Instead of adding random #ifdef'fery in autofs, let's just make the
compat helpers earlier to use: without CONFIG_COMPAT, is_compat_task()
just hardcodes to zero.

We could probably do something similar for a number of other cases where
we have #ifdef's in code, but this is the low-hanging fruit.

Reported-and-tested-by: Andreas Schwab <>
Signed-off-by: Linus Torvalds <>
Cc: Jonathan Nieder <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoautofs: work around unhappy compat problem on x86-64
Ian Kent [Wed, 22 Feb 2012 12:45:44 +0000 (20:45 +0800)]
autofs: work around unhappy compat problem on x86-64

commit a32744d4abae24572eff7269bc17895c41bd0085 upstream.

When the autofs protocol version 5 packet type was added in commit
5c0a32fc2cd0 ("autofs4: add new packet type for v5 communications"), it
obvously tried quite hard to be word-size agnostic, and uses explicitly
sized fields that are all correctly aligned.

However, with the final "char name[NAME_MAX+1]" array at the end, the
actual size of the structure ends up being not very well defined:
because the struct isn't marked 'packed', doing a "sizeof()" on it will
align the size of the struct up to the biggest alignment of the members
it has.

And despite all the members being the same, the alignment of them is
different: a "__u64" has 4-byte alignment on x86-32, but native 8-byte
alignment on x86-64.  And while 'NAME_MAX+1' ends up being a nice round
number (256), the name[] array starts out a 4-byte aligned.

End result: the "packed" size of the structure is 300 bytes: 4-byte, but
not 8-byte aligned.

As a result, despite all the fields being in the same place on all
architectures, sizeof() will round up that size to 304 bytes on
architectures that have 8-byte alignment for u64.

Note that this is *not* a problem for 32-bit compat mode on POWER, since
there __u64 is 8-byte aligned even in 32-bit mode.  But on x86, 32-bit
and 64-bit alignment is different for 64-bit entities, and as a result
the structure that has exactly the same layout has different sizes.

So on x86-64, but no other architecture, we will just subtract 4 from
the size of the structure when running in a compat task.  That way we
will write the properly sized packet that user mode expects.

Not pretty.  Sadly, this very subtle, and unnecessary, size difference
has been encoded in user space that wants to read packets of *exactly*
the right size, and will refuse to touch anything else.

Reported-and-tested-by: Thomas Meyer <>
Signed-off-by: Ian Kent <>
Signed-off-by: Linus Torvalds <>
Cc: Jonathan Nieder <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoARM: OMAP: make iommu subsys_initcall to fix builtin omap3isp
Ohad Ben-Cohen [Sun, 26 Feb 2012 10:14:14 +0000 (12:14 +0200)]
ARM: OMAP: make iommu subsys_initcall to fix builtin omap3isp

commit 435792d93410f008120c4dbab148019a3cc31dbc upstream.

omap3isp depends on omap's iommu and will fail to probe if
initialized before it (which always happen if they are builtin).

Make omap's iommu subsys_initcall as an interim solution until
the probe deferral mechanism is merged.

Reported-by: James <>
Debugged-by: Laurent Pinchart <>
Signed-off-by: Ohad Ben-Cohen <>
Cc: Tony Lindgren <>
Cc: Hiroshi Doyu <>
Cc: Joerg Roedel <>
Signed-off-by: Joerg Roedel <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoLinux 3.2.9 v3.2.9
Greg Kroah-Hartman [Thu, 1 Mar 2012 00:32:49 +0000 (16:32 -0800)]
Linux 3.2.9

9 years agocdrom: use copy_to_user() without the underscores
Dan Carpenter [Mon, 6 Feb 2012 09:20:45 +0000 (10:20 +0100)]
cdrom: use copy_to_user() without the underscores

commit 822bfa51ce44f2c63c300fdb76dc99c4d5a5ca9f upstream.

"nframes" comes from the user and "nframes * CD_FRAMESIZE_RAW" can wrap
on 32 bit systems.  That would have been ok if we used the same wrapped
value for the copy, but we use a shifted value.  We should just use the
checked version of copy_to_user() because it's not going to make a
difference to the speed.

Signed-off-by: Dan Carpenter <>
Signed-off-by: Jens Axboe <>
Signed-off-by: Greg Kroah-Hartman <>
9 years agoepoll: limit paths
Jason Baron [Fri, 13 Jan 2012 01:17:43 +0000 (17:17 -0800)]
epoll: limit paths

commit 28d82dc1c4edbc352129f97f4ca22624d1fe61de upstream.

The current epoll code can be tickled to run basically indefinitely in
both loop detection path check (on ep_insert()), and in the wakeup paths.
The programs that tickle this behavior set up deeply linked networks of
epoll file descriptors that cause the epoll algorithms to traverse them
indefinitely.  A couple of these sample programs have been previously
posted in this thread:

To fix the loop detection path check algorithms, I simply keep track of
the epoll nodes that have been already visited.  Thus, the loop detection
becomes proportional to the number of epoll file descriptor and links.
This dramatically decreases the run-time of the loop check algorithm.  In
one diabolical case I tried it reduced the run-time from 15 mintues (all
in kernel time) to .3 seconds.

Fixing the wakeup paths could be done at wakeup time in a similar manner
by keeping track of nodes that have already been visited, but the
complexity is harder, since there can be multiple wakeups on different
cpus...Thus, I've opted to limit the number of possible wakeup paths when
the paths are created.

This is accomplished, by noting that the end file descriptor points that
are found during the loop detection pass (from the newly added link), are
actually the sources for wakeup events.  I keep a list of these file
descriptors and limit the number and length of these paths that emanate
from these 'source file descriptors'.  In the current implemetation I
allow 1000 paths of length 1, 500 of length 2, 100 of length 3, 50 of
length 4 and 10 of length 5.  Note that it is sufficient to check the
'source file descriptors' reachable from the newly added link, since no
other 'source file descriptors' will have newly added links.  This allows
us to check only the wakeup paths that may have gotten too long, and not
re-check all possible wakeup paths on the system.

In terms of the path limit selection, I think its first worth noting that
the most common case for epoll, is probably the model where you have 1
epoll file descriptor that is monitoring n number of 'source file
descriptors'.  In this case, each 'source file descriptor' has a 1 path of
length 1.  Thus, I believe that the limits I'm proposing are quite
reasonable and in fact may be too generous.  Thus, I'm hoping that the
proposed limits will not prevent any workloads that currently work to

In terms of locking, I have extended the use of the 'epmutex' to all
epoll_ctl add and remove operations.  Currently its only used in a subset
of the add paths.  I need to hold the epmutex, so that we can correctly
traverse a coherent graph, to check the number of paths.  I believe that
this additional locking is probably ok, since its in the setup/teardown
paths, and doesn't affect the running paths, but it certainly is going to
add some extra overhead.  Also, worth noting is that the epmuex was
recently added to the ep_ctl add operations in the initial path loop
detection code using the argument that it was not on a critical path.

Another thing to note here, is the length of epoll chains that is allowed.
Currently, eventpoll.c defines:

/* Maximum number of nesting allowed inside epoll sets */
#define EP_MAX_NESTS 4

This basically means that I am limited to a graph depth of 5 (EP_MAX_NESTS
+ 1).  However, this limit is currently only enforced during the loop
check detection code, and only when the epoll file descriptors are added
in a certain order.  Thus, this limit is currently easily bypassed.  The
newly added check for wakeup paths, stricly limits the wakeup paths to a
length of 5, regardless of the order in which ep's are linked together.
Thus, a side-effect of the new code is a more consistent enforcement of
the graph depth.

Thus far, I've tested this, using the sample programs previously
mentioned, which now either return quickly or return -EINVAL.  I've also
testing using the piptest.c epoll tester, which showed no difference in
performance.  I've also created a number of different epoll networks and
tested that they behave as expectded.

I believe this solves the original diabolical test cases, while still
preserving the sane epoll nesting.

Signed-off-by: Jason Baron <>
Cc: Nelson Elhage <>
Cc: Davide Libenzi <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>