diff options
| author | Tobias Powalowski <tobias@T-POWA-LX.(none)> | 2011-03-22 15:20:43 +0100 |
|---|---|---|
| committer | Tobias Powalowski <tobias@T-POWA-LX.(none)> | 2011-03-22 15:20:43 +0100 |
| commit | 6482fa4ba90a7583eb300149ad0d4e7cadac2ee5 (patch) | |
| tree | 90b39c239a22c080036cac0988d2be367bdb1dfa | |
| parent | af3ccf96404d4a32c71b68f2a454534e03db84e5 (diff) | |
add new pre patches
| -rw-r--r-- | PATCHCFG | 3 | ||||
| -rw-r--r-- | patches/2.6.38.1-pre.patch | 5048 |
2 files changed, 5050 insertions, 1 deletions
@@ -14,6 +14,7 @@ PATCHES=( # add latest fixes from stable queue, if needed # http://git.kernel.org/?p=linux/kernel/git/stable/stable-queue.git + 2.6.38.1-pre.patch%1 # fix #19234 i1915 display size fix-i915.patch%1 @@ -24,7 +25,7 @@ PATCHES=( aufs2-standalone-20110314.patch%1 ) # Name of the resulting patch (will be bzipped afterwards) -PATCHNAME="patch-2.6.38-1-ARCH" +PATCHNAME="patch-2.6.38-2-ARCH" # Run this before applying patches pre_apply() { diff --git a/patches/2.6.38.1-pre.patch b/patches/2.6.38.1-pre.patch new file mode 100644 index 0000000..42c153b --- /dev/null +++ b/patches/2.6.38.1-pre.patch @@ -0,0 +1,5048 @@ +From c826cb7dfce80512c26c984350077a25046bd215 Mon Sep 17 00:00:00 2001 +From: Linus Torvalds <torvalds@linux-foundation.org> +Date: Tue, 15 Mar 2011 15:29:21 -0700 +Subject: dcache.c: create helper function for duplicated functionality + +From: Linus Torvalds <torvalds@linux-foundation.org> + +commit c826cb7dfce80512c26c984350077a25046bd215 upstream. + +This creates a helper function for he "try to ascend into the parent +directory" case, which was written out in triplicate before. With all +the locking and subtle sequence number stuff, we really don't want to +duplicate that kind of code. + +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + fs/dcache.c | 88 +++++++++++++++++++++++++----------------------------------- + 1 file changed, 37 insertions(+), 51 deletions(-) + +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -1012,6 +1012,34 @@ void shrink_dcache_for_umount(struct sup + } + + /* ++ * This tries to ascend one level of parenthood, but ++ * we can race with renaming, so we need to re-check ++ * the parenthood after dropping the lock and check ++ * that the sequence number still matches. ++ */ ++static struct dentry *try_to_ascend(struct dentry *old, int locked, unsigned seq) ++{ ++ struct dentry *new = old->d_parent; ++ ++ rcu_read_lock(); ++ spin_unlock(&old->d_lock); ++ spin_lock(&new->d_lock); ++ ++ /* ++ * might go back up the wrong parent if we have had a rename ++ * or deletion ++ */ ++ if (new != old->d_parent || ++ (!locked && read_seqretry(&rename_lock, seq))) { ++ spin_unlock(&new->d_lock); ++ new = NULL; ++ } ++ rcu_read_unlock(); ++ return new; ++} ++ ++ ++/* + * Search for at least 1 mount point in the dentry's subdirs. + * We descend to the next level whenever the d_subdirs + * list is non-empty and continue searching. +@@ -1066,24 +1094,10 @@ resume: + * All done at this level ... ascend and resume the search. + */ + if (this_parent != parent) { +- struct dentry *tmp; +- struct dentry *child; +- +- tmp = this_parent->d_parent; +- rcu_read_lock(); +- spin_unlock(&this_parent->d_lock); +- child = this_parent; +- this_parent = tmp; +- spin_lock(&this_parent->d_lock); +- /* might go back up the wrong parent if we have had a rename +- * or deletion */ +- if (this_parent != child->d_parent || +- (!locked && read_seqretry(&rename_lock, seq))) { +- spin_unlock(&this_parent->d_lock); +- rcu_read_unlock(); ++ struct dentry *child = this_parent; ++ this_parent = try_to_ascend(this_parent, locked, seq); ++ if (!this_parent) + goto rename_retry; +- } +- rcu_read_unlock(); + next = child->d_u.d_child.next; + goto resume; + } +@@ -1181,24 +1195,10 @@ resume: + * All done at this level ... ascend and resume the search. + */ + if (this_parent != parent) { +- struct dentry *tmp; +- struct dentry *child; +- +- tmp = this_parent->d_parent; +- rcu_read_lock(); +- spin_unlock(&this_parent->d_lock); +- child = this_parent; +- this_parent = tmp; +- spin_lock(&this_parent->d_lock); +- /* might go back up the wrong parent if we have had a rename +- * or deletion */ +- if (this_parent != child->d_parent || +- (!locked && read_seqretry(&rename_lock, seq))) { +- spin_unlock(&this_parent->d_lock); +- rcu_read_unlock(); ++ struct dentry *child = this_parent; ++ this_parent = try_to_ascend(this_parent, locked, seq); ++ if (!this_parent) + goto rename_retry; +- } +- rcu_read_unlock(); + next = child->d_u.d_child.next; + goto resume; + } +@@ -2942,28 +2942,14 @@ resume: + spin_unlock(&dentry->d_lock); + } + if (this_parent != root) { +- struct dentry *tmp; +- struct dentry *child; +- +- tmp = this_parent->d_parent; ++ struct dentry *child = this_parent; + if (!(this_parent->d_flags & DCACHE_GENOCIDE)) { + this_parent->d_flags |= DCACHE_GENOCIDE; + this_parent->d_count--; + } +- rcu_read_lock(); +- spin_unlock(&this_parent->d_lock); +- child = this_parent; +- this_parent = tmp; +- spin_lock(&this_parent->d_lock); +- /* might go back up the wrong parent if we have had a rename +- * or deletion */ +- if (this_parent != child->d_parent || +- (!locked && read_seqretry(&rename_lock, seq))) { +- spin_unlock(&this_parent->d_lock); +- rcu_read_unlock(); ++ this_parent = try_to_ascend(this_parent, locked, seq); ++ if (!this_parent) + goto rename_retry; +- } +- rcu_read_unlock(); + next = child->d_u.d_child.next; + goto resume; + } +From c83ce989cb5ff86575821992ea82c4df5c388ebc Mon Sep 17 00:00:00 2001 +From: Trond Myklebust <Trond.Myklebust@netapp.com> +Date: Tue, 15 Mar 2011 13:36:43 -0400 +Subject: VFS: Fix the nfs sillyrename regression in kernel 2.6.38 + +From: Trond Myklebust <Trond.Myklebust@netapp.com> + +commit c83ce989cb5ff86575821992ea82c4df5c388ebc upstream. + +The new vfs locking scheme introduced in 2.6.38 breaks NFS sillyrename +because the latter relies on being able to determine the parent +directory of the dentry in the ->iput() callback in order to send the +appropriate unlink rpc call. + +Looking at the code that cares about races with dput(), there doesn't +seem to be anything that specifically uses d_parent as a test for +whether or not there is a race: + - __d_lookup_rcu(), __d_lookup() all test for d_hashed() after d_parent + - shrink_dcache_for_umount() is safe since nothing else can rearrange + the dentries in that super block. + - have_submount(), select_parent() and d_genocide() can test for a + deletion if we set the DCACHE_DISCONNECTED flag when the dentry + is removed from the parent's d_subdirs list. + +Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + fs/dcache.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -296,8 +296,12 @@ static struct dentry *d_kill(struct dent + __releases(parent->d_lock) + __releases(dentry->d_inode->i_lock) + { +- dentry->d_parent = NULL; + list_del(&dentry->d_u.d_child); ++ /* ++ * Inform try_to_ascend() that we are no longer attached to the ++ * dentry tree ++ */ ++ dentry->d_flags |= DCACHE_DISCONNECTED; + if (parent) + spin_unlock(&parent->d_lock); + dentry_iput(dentry); +@@ -1030,6 +1034,7 @@ static struct dentry *try_to_ascend(stru + * or deletion + */ + if (new != old->d_parent || ++ (old->d_flags & DCACHE_DISCONNECTED) || + (!locked && read_seqretry(&rename_lock, seq))) { + spin_unlock(&new->d_lock); + new = NULL; +From 868baf07b1a259f5f3803c1dc2777b6c358f83cf Mon Sep 17 00:00:00 2001 +From: Steven Rostedt <srostedt@redhat.com> +Date: Thu, 10 Feb 2011 21:26:13 -0500 +Subject: ftrace: Fix memory leak with function graph and cpu hotplug + +From: Steven Rostedt <srostedt@redhat.com> + +commit 868baf07b1a259f5f3803c1dc2777b6c358f83cf upstream. + +When the fuction graph tracer starts, it needs to make a special +stack for each task to save the real return values of the tasks. +All running tasks have this stack created, as well as any new +tasks. + +On CPU hot plug, the new idle task will allocate a stack as well +when init_idle() is called. The problem is that cpu hotplug does +not create a new idle_task. Instead it uses the idle task that +existed when the cpu went down. + +ftrace_graph_init_task() will add a new ret_stack to the task +that is given to it. Because a clone will make the task +have a stack of its parent it does not check if the task's +ret_stack is already NULL or not. When the CPU hotplug code +starts a CPU up again, it will allocate a new stack even +though one already existed for it. + +The solution is to treat the idle_task specially. In fact, the +function_graph code already does, just not at init_idle(). +Instead of using the ftrace_graph_init_task() for the idle task, +which that function expects the task to be a clone, have a +separate ftrace_graph_init_idle_task(). Also, we will create a +per_cpu ret_stack that is used by the idle task. When we call +ftrace_graph_init_idle_task() it will check if the idle task's +ret_stack is NULL, if it is, then it will assign it the per_cpu +ret_stack. + +Reported-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> +Suggested-by: Peter Zijlstra <a.p.zijlstra@chello.nl> +Signed-off-by: Steven Rostedt <rostedt@goodmis.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + include/linux/ftrace.h | 2 + + kernel/sched.c | 2 - + kernel/trace/ftrace.c | 52 ++++++++++++++++++++++++++++++++++++++++++------- + 3 files changed, 48 insertions(+), 8 deletions(-) + +--- a/include/linux/ftrace.h ++++ b/include/linux/ftrace.h +@@ -428,6 +428,7 @@ extern void unregister_ftrace_graph(void + + extern void ftrace_graph_init_task(struct task_struct *t); + extern void ftrace_graph_exit_task(struct task_struct *t); ++extern void ftrace_graph_init_idle_task(struct task_struct *t, int cpu); + + static inline int task_curr_ret_stack(struct task_struct *t) + { +@@ -451,6 +452,7 @@ static inline void unpause_graph_tracing + + static inline void ftrace_graph_init_task(struct task_struct *t) { } + static inline void ftrace_graph_exit_task(struct task_struct *t) { } ++static inline void ftrace_graph_init_idle_task(struct task_struct *t, int cpu) { } + + static inline int register_ftrace_graph(trace_func_graph_ret_t retfunc, + trace_func_graph_ent_t entryfunc) +--- a/kernel/sched.c ++++ b/kernel/sched.c +@@ -5572,7 +5572,7 @@ void __cpuinit init_idle(struct task_str + * The idle tasks have their own, simple scheduling class: + */ + idle->sched_class = &idle_sched_class; +- ftrace_graph_init_task(idle); ++ ftrace_graph_init_idle_task(idle, cpu); + } + + /* +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -3328,7 +3328,7 @@ static int start_graph_tracing(void) + /* The cpu_boot init_task->ret_stack will never be freed */ + for_each_online_cpu(cpu) { + if (!idle_task(cpu)->ret_stack) +- ftrace_graph_init_task(idle_task(cpu)); ++ ftrace_graph_init_idle_task(idle_task(cpu), cpu); + } + + do { +@@ -3418,6 +3418,49 @@ void unregister_ftrace_graph(void) + mutex_unlock(&ftrace_lock); + } + ++static DEFINE_PER_CPU(struct ftrace_ret_stack *, idle_ret_stack); ++ ++static void ++graph_init_task(struct task_struct *t, struct ftrace_ret_stack *ret_stack) ++{ ++ atomic_set(&t->tracing_graph_pause, 0); ++ atomic_set(&t->trace_overrun, 0); ++ t->ftrace_timestamp = 0; ++ /* make curr_ret_stack visable before we add the ret_stack */ ++ smp_wmb(); ++ t->ret_stack = ret_stack; ++} ++ ++/* ++ * Allocate a return stack for the idle task. May be the first ++ * time through, or it may be done by CPU hotplug online. ++ */ ++void ftrace_graph_init_idle_task(struct task_struct *t, int cpu) ++{ ++ t->curr_ret_stack = -1; ++ /* ++ * The idle task has no parent, it either has its own ++ * stack or no stack at all. ++ */ ++ if (t->ret_stack) ++ WARN_ON(t->ret_stack != per_cpu(idle_ret_stack, cpu)); ++ ++ if (ftrace_graph_active) { ++ struct ftrace_ret_stack *ret_stack; ++ ++ ret_stack = per_cpu(idle_ret_stack, cpu); ++ if (!ret_stack) { ++ ret_stack = kmalloc(FTRACE_RETFUNC_DEPTH ++ * sizeof(struct ftrace_ret_stack), ++ GFP_KERNEL); ++ if (!ret_stack) ++ return; ++ per_cpu(idle_ret_stack, cpu) = ret_stack; ++ } ++ graph_init_task(t, ret_stack); ++ } ++} ++ + /* Allocate a return stack for newly created task */ + void ftrace_graph_init_task(struct task_struct *t) + { +@@ -3433,12 +3476,7 @@ void ftrace_graph_init_task(struct task_ + GFP_KERNEL); + if (!ret_stack) + return; +- atomic_set(&t->tracing_graph_pause, 0); +- atomic_set(&t->trace_overrun, 0); +- t->ftrace_timestamp = 0; +- /* make curr_ret_stack visable before we add the ret_stack */ +- smp_wmb(); +- t->ret_stack = ret_stack; ++ graph_init_task(t, ret_stack); + } + } + +From 77eed821accf5dd962b1f13bed0680e217e49112 Mon Sep 17 00:00:00 2001 +From: Kamal Mostafa <kamal@canonical.com> +Date: Thu, 3 Feb 2011 17:38:04 -0800 +Subject: x86: Fix panic when handling "mem={invalid}" param + +From: Kamal Mostafa <kamal@canonical.com> + +commit 77eed821accf5dd962b1f13bed0680e217e49112 upstream. + +Avoid removing all of memory and panicing when "mem={invalid}" +is specified, e.g. mem=blahblah, mem=0, or mem=nopentium (on +platforms other than x86_32). + +Signed-off-by: Kamal Mostafa <kamal@canonical.com> +BugLink: http://bugs.launchpad.net/bugs/553464 +Cc: Yinghai Lu <yinghai@kernel.org> +Cc: Len Brown <len.brown@intel.com> +Cc: Rafael J. Wysocki <rjw@sisk.pl> +LKML-Reference: <1296783486-23033-1-git-send-email-kamal@canonical.com> +Signed-off-by: Ingo Molnar <mingo@elte.hu> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + arch/x86/kernel/e820.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/x86/kernel/e820.c ++++ b/arch/x86/kernel/e820.c +@@ -856,6 +856,9 @@ static int __init parse_memopt(char *p) + + userdef = 1; + mem_size = memparse(p, &p); ++ /* don't remove all of memory when handling "mem={invalid}" param */ ++ if (mem_size == 0) ++ return -EINVAL; + e820_remove_range(mem_size, ULLONG_MAX - mem_size, E820_RAM, 1); + + return 0; +From 9a6d44b9adb777ca9549e88cd55bd8f2673c52a2 Mon Sep 17 00:00:00 2001 +From: Kamal Mostafa <kamal@canonical.com> +Date: Thu, 3 Feb 2011 17:38:05 -0800 +Subject: x86: Emit "mem=nopentium ignored" warning when not supported + +From: Kamal Mostafa <kamal@canonical.com> + +commit 9a6d44b9adb777ca9549e88cd55bd8f2673c52a2 upstream. + +Emit warning when "mem=nopentium" is specified on any arch other +than x86_32 (the only that arch supports it). + +Signed-off-by: Kamal Mostafa <kamal@canonical.com> +BugLink: http://bugs.launchpad.net/bugs/553464 +Cc: Yinghai Lu <yinghai@kernel.org> +Cc: Len Brown <len.brown@intel.com> +Cc: Rafael J. Wysocki <rjw@sisk.pl> +LKML-Reference: <1296783486-23033-2-git-send-email-kamal@canonical.com> +Signed-off-by: Ingo Molnar <mingo@elte.hu> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + arch/x86/kernel/e820.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/e820.c ++++ b/arch/x86/kernel/e820.c +@@ -847,12 +847,15 @@ static int __init parse_memopt(char *p) + if (!p) + return -EINVAL; + +-#ifdef CONFIG_X86_32 + if (!strcmp(p, "nopentium")) { ++#ifdef CONFIG_X86_32 + setup_clear_cpu_cap(X86_FEATURE_PSE); + return 0; +- } ++#else ++ printk(KERN_WARNING "mem=nopentium ignored! (only supported on x86_32)\n"); ++ return -EINVAL; + #endif ++ } + + userdef = 1; + mem_size = memparse(p, &p); +From 64a3903d0885879ba8706a8bcf71c5e3e7664db2 Mon Sep 17 00:00:00 2001 +From: Seth Heasley <seth.heasley@intel.com> +Date: Fri, 11 Mar 2011 11:57:42 -0800 +Subject: ahci: AHCI mode SATA patch for Intel Patsburg SATA RAID controller + +From: Seth Heasley <seth.heasley@intel.com> + +commit 64a3903d0885879ba8706a8bcf71c5e3e7664db2 upstream. + +This patch adds an updated SATA RAID DeviceID for the Intel Patsburg PCH. + +Signed-off-by: Seth Heasley <seth.heasley@intel.com> +Signed-off-by: Jeff Garzik <jgarzik@pobox.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/ata/ahci.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -260,6 +260,7 @@ static const struct pci_device_id ahci_p + { PCI_VDEVICE(INTEL, 0x1d02), board_ahci }, /* PBG AHCI */ + { PCI_VDEVICE(INTEL, 0x1d04), board_ahci }, /* PBG RAID */ + { PCI_VDEVICE(INTEL, 0x1d06), board_ahci }, /* PBG RAID */ ++ { PCI_VDEVICE(INTEL, 0x2826), board_ahci }, /* PBG RAID */ + { PCI_VDEVICE(INTEL, 0x2323), board_ahci }, /* DH89xxCC AHCI */ + + /* JMicron 360/1/3/5/6, match class to avoid IDE function */ +From 467b41c688c79d1b5e076fbdf082f9cd5d6a000c Mon Sep 17 00:00:00 2001 +From: Per Jessen <per@computer.org> +Date: Tue, 8 Feb 2011 13:54:32 +0100 +Subject: ahci: recognize Marvell 88se9125 PCIe SATA 6.0 Gb/s controller + +From: Per Jessen <per@computer.org> + +commit 467b41c688c79d1b5e076fbdf082f9cd5d6a000c upstream. + +Recognize Marvell 88SE9125 PCIe SATA 6.0 Gb/s controller. + +Signed-off-by: Per Jessen <per@computer.org> +Signed-off-by: Jeff Garzik <jgarzik@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/ata/ahci.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -384,6 +384,8 @@ static const struct pci_device_id ahci_p + .class = PCI_CLASS_STORAGE_SATA_AHCI, + .class_mask = 0xffffff, + .driver_data = board_ahci_yes_fbs }, /* 88se9128 */ ++ { PCI_DEVICE(0x1b4b, 0x9125), ++ .driver_data = board_ahci_yes_fbs }, /* 88se9125 */ + + /* Promise */ + { PCI_VDEVICE(PROMISE, 0x3f20), board_ahci }, /* PDC42819 */ +From eb0e85e36b971ec31610eda7e3ff5c11c1c44785 Mon Sep 17 00:00:00 2001 +From: Tejun Heo <tj@kernel.org> +Date: Thu, 24 Feb 2011 19:30:37 +0100 +Subject: libata: fix hotplug for drivers which don't implement LPM + +From: Tejun Heo <tj@kernel.org> + +commit eb0e85e36b971ec31610eda7e3ff5c11c1c44785 upstream. + +ata_eh_analyze_serror() suppresses hotplug notifications if LPM is +being used because LPM generates spurious hotplug events. It compared +whether link->lpm_policy was different from ATA_LPM_MAX_POWER to +determine whether LPM is enabled; however, this is incorrect as for +drivers which don't implement LPM, lpm_policy is always +ATA_LPM_UNKNOWN. This disabled hotplug detection for all drivers +which don't implement LPM. + +Fix it by comparing whether lpm_policy is greater than +ATA_LPM_MAX_POWER. + +Signed-off-by: Tejun Heo <tj@kernel.org> +Signed-off-by: Jeff Garzik <jgarzik@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/ata/libata-eh.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -1618,7 +1618,7 @@ static void ata_eh_analyze_serror(struct + * host links. For disabled PMP links, only N bit is + * considered as X bit is left at 1 for link plugging. + */ +- if (link->lpm_policy != ATA_LPM_MAX_POWER) ++ if (link->lpm_policy > ATA_LPM_MAX_POWER) + hotplug_mask = 0; /* hotplug doesn't work w/ LPM */ + else if (!(link->flags & ATA_LFLAG_DISABLED) || ata_is_host_link(link)) + hotplug_mask = SERR_PHYRDY_CHG | SERR_DEV_XCHG; +From 25ae21a10112875763c18b385624df713a288a05 Mon Sep 17 00:00:00 2001 +From: Sean Hefty <sean.hefty@intel.com> +Date: Wed, 23 Feb 2011 08:11:32 -0800 +Subject: RDMA/cma: Fix crash in request handlers + +From: Sean Hefty <sean.hefty@intel.com> + +commit 25ae21a10112875763c18b385624df713a288a05 upstream. + +Doug Ledford and Red Hat reported a crash when running the rdma_cm on +a real-time OS. The crash has the following call trace: + + cm_process_work + cma_req_handler + cma_disable_callback + rdma_create_id + kzalloc + init_completion + cma_get_net_info + cma_save_net_info + cma_any_addr + cma_zero_addr + rdma_translate_ip + rdma_copy_addr + cma_acquire_dev + rdma_addr_get_sgid + ib_find_cached_gid + cma_attach_to_dev + ucma_event_handler + kzalloc + ib_copy_ah_attr_to_user + cma_comp + +[ preempted ] + + cma_write + copy_from_user + ucma_destroy_id + copy_from_user + _ucma_find_context + ucma_put_ctx + ucma_free_ctx + rdma_destroy_id + cma_exch + cma_cancel_operation + rdma_node_get_transport + + rt_mutex_slowunlock + bad_area_nosemaphore + oops_enter + +They were able to reproduce the crash multiple times with the +following details: + + Crash seems to always happen on the: + mutex_unlock(&conn_id->handler_mutex); + as conn_id looks to have been freed during this code path. + +An examination of the code shows that a race exists in the request +handlers. When a new connection request is received, the rdma_cm +allocates a new connection identifier. This identifier has a single +reference count on it. If a user calls rdma_destroy_id() from another +thread after receiving a callback, rdma_destroy_id will proceed to +destroy the id and free the associated memory. However, the request +handlers may still be in the process of running. When control returns +to the request handlers, they can attempt to access the newly created +identifiers. + +Fix this by holding a reference on the newly created rdma_cm_id until +the request handler is through accessing it. + +Signed-off-by: Sean Hefty <sean.hefty@intel.com> +Acked-by: Doug Ledford <dledford@redhat.com> +Signed-off-by: Roland Dreier <roland@purestorage.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/infiniband/core/cma.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -1210,6 +1210,11 @@ static int cma_req_handler(struct ib_cm_ + cm_id->context = conn_id; + cm_id->cm_handler = cma_ib_handler; + ++ /* ++ * Protect against the user destroying conn_id from another thread ++ * until we're done accessing it. ++ */ ++ atomic_inc(&conn_id->refcount); + ret = conn_id->id.event_handler(&conn_id->id, &event); + if (!ret) { + /* +@@ -1222,8 +1227,10 @@ static int cma_req_handler(struct ib_cm_ + ib_send_cm_mra(cm_id, CMA_CM_MRA_SETTING, NULL, 0); + mutex_unlock(&lock); + mutex_unlock(&conn_id->handler_mutex); ++ cma_deref_id(conn_id); + goto out; + } ++ cma_deref_id(conn_id); + + /* Destroy the CM ID by returning a non-zero value. */ + conn_id->cm_id.ib = NULL; +@@ -1425,17 +1432,25 @@ static int iw_conn_req_handler(struct iw + event.param.conn.private_data_len = iw_event->private_data_len; + event.param.conn.initiator_depth = attr.max_qp_init_rd_atom; + event.param.conn.responder_resources = attr.max_qp_rd_atom; ++ ++ /* ++ * Protect against the user destroying conn_id from another thread ++ * until we're done accessing it. ++ */ ++ atomic_inc(&conn_id->refcount); + ret = conn_id->id.event_handler(&conn_id->id, &event); + if (ret) { + /* User wants to destroy the CM ID */ + conn_id->cm_id.iw = NULL; + cma_exch(conn_id, CMA_DESTROYING); + mutex_unlock(&conn_id->handler_mutex); ++ cma_deref_id(conn_id); + rdma_destroy_id(&conn_id->id); + goto out; + } + + mutex_unlock(&conn_id->handler_mutex); ++ cma_deref_id(conn_id); + + out: + if (dev) +From 34d211a2d5df4984a35b18d8ccacbe1d10abb067 Mon Sep 17 00:00:00 2001 +From: Linus Torvalds <torvalds@linux-foundation.org> +Date: Wed, 16 Mar 2011 08:04:07 -0700 +Subject: Increase OSF partition limit from 8 to 18 + +From: Linus Torvalds <torvalds@linux-foundation.org> + +commit 34d211a2d5df4984a35b18d8ccacbe1d10abb067 upstream. + +It turns out that while a maximum of 8 partitions may be what people +"should" have had, you can actually fit up to 18 entries(*) in a sector. + +And some people clearly were taking advantage of that, like Michael +Cree, who had ten partitions on one of his OSF disks. + +(*) The OSF partition data starts at byte offset 64 in the first sector, + and the array of 16-byte partition entries start at offset 148 in + the on-disk partition structure. + +Reported-by: Michael Cree <mcree@orcon.net.nz> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + fs/partitions/osf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/partitions/osf.c ++++ b/fs/partitions/osf.c +@@ -10,7 +10,7 @@ + #include "check.h" + #include "osf.h" + +-#define MAX_OSF_PARTITIONS 8 ++#define MAX_OSF_PARTITIONS 18 + + int osf_partition(struct parsed_partitions *state) + { +From 29963437a48475036353b95ab142bf199adb909e Mon Sep 17 00:00:00 2001 +From: Sean Hefty <sean.hefty@intel.com> +Date: Wed, 23 Feb 2011 08:17:40 -0800 +Subject: IB/cm: Bump reference count on cm_id before invoking callback + +From: Sean Hefty <sean.hefty@intel.com> + +commit 29963437a48475036353b95ab142bf199adb909e upstream. + +When processing a SIDR REQ, the ib_cm allocates a new cm_id. The +refcount of the cm_id is initialized to 1. However, cm_process_work +will decrement the refcount after invoking all callbacks. The result +is that the cm_id will end up with refcount set to 0 by the end of the +sidr req handler. + +If a user tries to destroy the cm_id, the destruction will proceed, +under the incorrect assumption that no other threads are referencing +the cm_id. This can lead to a crash when the cm callback thread tries +to access the cm_id. + +This problem was noticed as part of a larger investigation with kernel +crashes in the rdma_cm when running on a real time OS. + +Signed-off-by: Sean Hefty <sean.hefty@intel.com> +Acked-by: Doug Ledford <dledford@redhat.com> +Signed-off-by: Roland Dreier <roland@purestorage.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/infiniband/core/cm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -2989,6 +2989,7 @@ static int cm_sidr_req_handler(struct cm + goto out; /* No match. */ + } + atomic_inc(&cur_cm_id_priv->refcount); ++ atomic_inc(&cm_id_priv->refcount); + spin_unlock_irq(&cm.lock); + + cm_id_priv->id.cm_handler = cur_cm_id_priv->id.cm_handler; +From 1d3e09a304e6c4e004ca06356578b171e8735d3c Mon Sep 17 00:00:00 2001 +From: Andreas Herrmann <andreas.herrmann3@amd.com> +Date: Tue, 15 Mar 2011 15:31:37 +0100 +Subject: x86, quirk: Fix SB600 revision check + +From: Andreas Herrmann <andreas.herrmann3@amd.com> + +commit 1d3e09a304e6c4e004ca06356578b171e8735d3c upstream. + +Commit 7f74f8f28a2bd9db9404f7d364e2097a0c42cc12 +(x86 quirk: Fix polarity for IRQ0 pin2 override on SB800 +systems) introduced a regression. It removed some SB600 specific +code to determine the revision ID without adapting a +corresponding revision ID check for SB600. + +See this mail thread: + + http://marc.info/?l=linux-kernel&m=129980296006380&w=2 + +This patch adapts the corresponding check to cover all SB600 +revisions. + +Tested-by: Wang Lei <f3d27b@gmail.com> +Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com> +Cc: Andrew Morton <akpm@linux-foundation.org> +LKML-Reference: <20110315143137.GD29499@alberich.amd.com> +Signed-off-by: Ingo Molnar <mingo@elte.hu> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + arch/x86/kernel/early-quirks.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/arch/x86/kernel/early-quirks.c ++++ b/arch/x86/kernel/early-quirks.c +@@ -159,7 +159,12 @@ static void __init ati_bugs_contd(int nu + if (rev >= 0x40) + acpi_fix_pin2_polarity = 1; + +- if (rev > 0x13) ++ /* ++ * SB600: revisions 0x11, 0x12, 0x13, 0x14, ... ++ * SB700: revisions 0x39, 0x3a, ... ++ * SB800: revisions 0x40, 0x41, ... ++ */ ++ if (rev >= 0x39) + return; + + if (acpi_use_timer_override) +From 6f3946b421395ff853bc0bcdab9c26b50ebbba8f Mon Sep 17 00:00:00 2001 +From: Steven J. Magnani <steve@digidescorp.com> +Date: Thu, 10 Feb 2011 12:12:13 -0600 +Subject: microblaze: Fix /dev/zero corruption from __clear_user() + +From: Steven J. Magnani <steve@digidescorp.com> + +commit 6f3946b421395ff853bc0bcdab9c26b50ebbba8f upstream. + +A userland read of more than PAGE_SIZE bytes from /dev/zero results in +(a) not all of the bytes returned being zero, and +(b) memory corruption due to zeroing of bytes beyond the user buffer. + +This is caused by improper constraints on the assembly __clear_user function. +The constrints don't indicate to the compiler that the pointer argument is +modified. Since the function is inline, this results in double-incrementing +of the pointer when __clear_user() is invoked through a multi-page read() of +/dev/zero. + +Signed-off-by: Steven J. Magnani <steve@digidescorp.com> +Acked-by: Michal Simek <monstr@monstr.eu> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + arch/microblaze/include/asm/uaccess.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/microblaze/include/asm/uaccess.h ++++ b/arch/microblaze/include/asm/uaccess.h +@@ -120,16 +120,16 @@ static inline unsigned long __must_check + { + /* normal memset with two words to __ex_table */ + __asm__ __volatile__ ( \ +- "1: sb r0, %2, r0;" \ ++ "1: sb r0, %1, r0;" \ + " addik %0, %0, -1;" \ + " bneid %0, 1b;" \ +- " addik %2, %2, 1;" \ ++ " addik %1, %1, 1;" \ + "2: " \ + __EX_TABLE_SECTION \ + ".word 1b,2b;" \ + ".previous;" \ +- : "=r"(n) \ +- : "0"(n), "r"(to) ++ : "=r"(n), "=r"(to) \ ++ : "0"(n), "1"(to) + ); + return n; + } +From 0e00f7aed6af21fc09b2a94d28bc34e449bd3a53 Mon Sep 17 00:00:00 2001 +From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> +Date: Thu, 3 Mar 2011 11:01:37 -0500 +Subject: x86: stop_machine_text_poke() should issue sync_core() + +From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> + +commit 0e00f7aed6af21fc09b2a94d28bc34e449bd3a53 upstream. + +Intel Archiecture Software Developer's Manual section 7.1.3 specifies that a +core serializing instruction such as "cpuid" should be executed on _each_ core +before the new instruction is made visible. + +Failure to do so can lead to unspecified behavior (Intel XMC erratas include +General Protection Fault in the list), so we should avoid this at all cost. + +This problem can affect modified code executed by interrupt handlers after +interrupt are re-enabled at the end of stop_machine, because no core serializing +instruction is executed between the code modification and the moment interrupts +are reenabled. + +Because stop_machine_text_poke performs the text modification from the first CPU +decrementing stop_machine_first, modified code executed in thread context is +also affected by this problem. To explain why, we have to split the CPUs in two +categories: the CPU that initiates the text modification (calls text_poke_smp) +and all the others. The scheduler, executed on all other CPUs after +stop_machine, issues an "iret" core serializing instruction, and therefore +handles core serialization for all these CPUs. However, the text modification +initiator can continue its execution on the same thread and access the modified +text without any scheduler call. Given that the CPU that initiates the code +modification is not guaranteed to be the one actually performing the code +modification, it falls into the XMC errata. + +Q: Isn't this executed from an IPI handler, which will return with IRET (a + serializing instruction) anyway? +A: No, now stop_machine uses per-cpu workqueue, so that handler will be + executed from worker threads. There is no iret anymore. + +Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> +LKML-Reference: <20110303160137.GB1590@Krystal> +Reviewed-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com> +Cc: Arjan van de Ven <arjan@infradead.org> +Cc: Peter Zijlstra <peterz@infradead.org> +Cc: Steven Rostedt <rostedt@goodmis.org> +Cc: Andrew Morton <akpm@linux-foundation.org> +Cc: Andi Kleen <andi@firstfloor.org> +Cc: Frederic Weisbecker <fweisbec@gmail.com> +Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + arch/x86/kernel/alternative.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/arch/x86/kernel/alternative.c ++++ b/arch/x86/kernel/alternative.c +@@ -620,7 +620,12 @@ static int __kprobes stop_machine_text_p + flush_icache_range((unsigned long)p->addr, + (unsigned long)p->addr + p->len); + } +- ++ /* ++ * Intel Archiecture Software Developer's Manual section 7.1.3 specifies ++ * that a core serializing instruction such as "cpuid" should be ++ * executed on _each_ core before the new instruction is made visible. ++ */ ++ sync_core(); + return 0; + } + +From eae61f3c829439f8f9121b5cd48a14be04df451f Mon Sep 17 00:00:00 2001 +From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> +Date: Wed, 2 Mar 2011 16:54:24 +0900 +Subject: TOMOYO: Fix memory leak upon file open. + +From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> + +commit eae61f3c829439f8f9121b5cd48a14be04df451f upstream. + +In tomoyo_check_open_permission() since 2.6.36, TOMOYO was by error +recalculating already calculated pathname when checking allow_rewrite +permission. As a result, memory will leak whenever a file is opened for writing +without O_APPEND flag. Also, performance will degrade because TOMOYO is +calculating pathname regardless of profile configuration. +This patch fixes the leak and performance degrade. + +Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> +Signed-off-by: James Morris <jmorris@namei.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + security/tomoyo/file.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +--- a/security/tomoyo/file.c ++++ b/security/tomoyo/file.c +@@ -927,7 +927,7 @@ int tomoyo_check_open_permission(struct + struct path *path, const int flag) + { + const u8 acc_mode = ACC_MODE(flag); +- int error = -ENOMEM; ++ int error = 0; + struct tomoyo_path_info buf; + struct tomoyo_request_info r; + int idx; +@@ -938,9 +938,6 @@ int tomoyo_check_open_permission(struct + buf.name = NULL; + r.mode = TOMOYO_CONFIG_DISABLED; + idx = tomoyo_read_lock(); +- if (!tomoyo_get_realpath(&buf, path)) +- goto out; +- error = 0; + /* + * If the filename is specified by "deny_rewrite" keyword, + * we need to check "allow_rewrite" permission when the filename is not +From 8692d00e996ed2a6560702623e5cb646da0f9767 Mon Sep 17 00:00:00 2001 +From: Chris Wilson <chris@chris-wilson.co.uk> +Date: Sat, 5 Feb 2011 10:08:21 +0000 +Subject: drm/i915: Replace vblank PM QoS with "Interrupt-Based AGPBUSY#" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Chris Wilson <chris@chris-wilson.co.uk> + +commit 8692d00e996ed2a6560702623e5cb646da0f9767 upstream. + +I stumbled over this magic bit in the gen3 INSTPM: + +Bit11 Interrupt-Based AGPBUSY# Enable: + +‘0’ = Pending GMCH interrupts will not cause AGPBUSY# assertion. +‘1’ = Pending GMCH interrupts will cause AGPBUSY# assertion and hence + can cause the CPU to exit C3. There is no suppression of cacheable + writes. + +Note that in either case in C3 the interrupts are not lost. They will be +forwarded to the ICH when the GMCH is out of C3. + +Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> +Tested-by: Daniel Vetter <daniel.vetter@ffwll.ch> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/gpu/drm/i915/i915_irq.c | 9 +++++++++ + drivers/gpu/drm/i915/i915_reg.h | 5 ++++- + 2 files changed, 13 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/i915_irq.c ++++ b/drivers/gpu/drm/i915/i915_irq.c +@@ -1377,7 +1377,12 @@ int i915_enable_vblank(struct drm_device + else + i915_enable_pipestat(dev_priv, pipe, + PIPE_VBLANK_INTERRUPT_ENABLE); ++ ++ /* maintain vblank delivery even in deep C-states */ ++ if (dev_priv->info->gen == 3) ++ I915_WRITE(INSTPM, INSTPM_AGPBUSY_DIS << 16); + spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags); ++ + return 0; + } + +@@ -1390,6 +1395,10 @@ void i915_disable_vblank(struct drm_devi + unsigned long irqflags; + + spin_lock_irqsave(&dev_priv->irq_lock, irqflags); ++ if (dev_priv->info->gen == 3) ++ I915_WRITE(INSTPM, ++ INSTPM_AGPBUSY_DIS << 16 | INSTPM_AGPBUSY_DIS); ++ + if (HAS_PCH_SPLIT(dev)) + ironlake_disable_display_irq(dev_priv, (pipe == 0) ? + DE_PIPEA_VBLANK: DE_PIPEB_VBLANK); +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -405,9 +405,12 @@ + #define I915_ERROR_INSTRUCTION (1<<0) + #define INSTPM 0x020c0 + #define INSTPM_SELF_EN (1<<12) /* 915GM only */ ++#define INSTPM_AGPBUSY_DIS (1<<11) /* gen3: when disabled, pending interrupts ++ will not assert AGPBUSY# and will only ++ be delivered when out of C3. */ + #define ACTHD 0x020c8 + #define FW_BLC 0x020d8 +-#define FW_BLC2 0x020dc ++#define FW_BLC2 0x020dc + #define FW_BLC_SELF 0x020e0 /* 915+ only */ + #define FW_BLC_SELF_EN_MASK (1<<31) + #define FW_BLC_SELF_FIFO_MASK (1<<16) /* 945 only */ +From 942b0e95c34f1ba432d08e1c0288ed032d32c3b2 Mon Sep 17 00:00:00 2001 +From: Alex Deucher <alexdeucher@gmail.com> +Date: Mon, 14 Mar 2011 23:18:00 -0400 +Subject: drm/radeon/kms: fix typo in atom overscan setup + +From: Alex Deucher <alexdeucher@gmail.com> + +commit 942b0e95c34f1ba432d08e1c0288ed032d32c3b2 upstream. + +Typo in the aspect scale setup. + +Signed-off-by: Alex Deucher <alexdeucher@gmail.com> +Signed-off-by: Dave Airlie <airlied@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/gpu/drm/radeon/atombios_crtc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/radeon/atombios_crtc.c ++++ b/drivers/gpu/drm/radeon/atombios_crtc.c +@@ -61,8 +61,8 @@ static void atombios_overscan_setup(stru + args.usOverscanLeft = cpu_to_le16((adjusted_mode->crtc_hdisplay - (a2 / mode->crtc_vdisplay)) / 2); + args.usOverscanRight = cpu_to_le16((adjusted_mode->crtc_hdisplay - (a2 / mode->crtc_vdisplay)) / 2); + } else if (a2 > a1) { +- args.usOverscanLeft = cpu_to_le16((adjusted_mode->crtc_vdisplay - (a1 / mode->crtc_hdisplay)) / 2); +- args.usOverscanRight = cpu_to_le16((adjusted_mode->crtc_vdisplay - (a1 / mode->crtc_hdisplay)) / 2); ++ args.usOverscanTop = cpu_to_le16((adjusted_mode->crtc_vdisplay - (a1 / mode->crtc_hdisplay)) / 2); ++ args.usOverscanBottom = cpu_to_le16((adjusted_mode->crtc_vdisplay - (a1 / mode->crtc_hdisplay)) / 2); + } + break; + case RMX_FULL: +From 007c80a5497a3f9c8393960ec6e6efd30955dcb1 Mon Sep 17 00:00:00 2001 +From: Chris Wilson <chris@chris-wilson.co.uk> +Date: Tue, 15 Mar 2011 11:40:00 +0000 +Subject: drm: Hold the mode mutex whilst probing for sysfs status + +From: Chris Wilson <chris@chris-wilson.co.uk> + +commit 007c80a5497a3f9c8393960ec6e6efd30955dcb1 upstream. + +As detect will use hw registers and may modify structures, it needs to be +serialised by use of the dev->mode_config.mutex. Make it so. + +Otherwise, we may cause random crashes as the sysfs file is queried +whilst a concurrent hotplug poll is being run. For example: + +[ 1189.189626] BUG: unable to handle kernel NULL pointer dereference at 00000100 +[ 1189.189821] IP: [<e0c22019>] intel_tv_detect_type+0xa2/0x203 [i915] +[ 1189.190020] *pde = 00000000 +[ 1189.190104] Oops: 0000 [#1] SMP +[ 1189.190209] last sysfs file: /sys/devices/pci0000:00/0000:00:02.0/drm/card0/card0-SVIDEO-1/status +[ 1189.190412] Modules linked in: mperf cpufreq_conservative cpufreq_userspace cpufreq_powersave cpufreq_stats decnet uinput fuse loop joydev snd_hd a_codec_realtek snd_hda_intel snd_hda_codec snd_hwdep snd_pcm_oss snd_mixer_oss snd_pcm i915 snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq drm_kms_helper snd_timer uvcvideo d rm snd_seq_device eeepc_laptop tpm_tis usbhid videodev i2c_algo_bit v4l1_compat snd sparse_keymap i2c_core hid serio_raw tpm psmouse evdev tpm_bios rfkill shpchp ac processor rng_c ore battery video power_supply soundcore pci_hotplug button output snd_page_alloc usb_storage uas ext3 jbd mbcache sd_mod crc_t10dif ata_generic ahci libahci ata_piix libata uhci_h cd ehci_hcd scsi_mod usbcore thermal atl2 thermal_sys nls_base [last unloaded: scsi_wait_scan] +[ 1189.192007] +[ 1189.192007] Pid: 1464, comm: upowerd Not tainted 2.6.37-2-686 #1 ASUSTeK Computer INC. 701/701 +[ 1189.192007] EIP: 0060:[<e0c22019>] EFLAGS: 00010246 CPU: 0 +[ 1189.192007] EIP is at intel_tv_detect_type+0xa2/0x203 [i915] +[ 1189.192007] EAX: 00000000 EBX: dca74000 ECX: e0f68004 EDX: 00068004 +[ 1189.192007] ESI: dd110c00 EDI: 400c0c37 EBP: dca7429c ESP: de365e2c +[ 1189.192007] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 +[ 1189.192007] Process upowerd (pid: 1464, ti=de364000 task=dcc8acb0 task.ti=de364000) +[ 1189.192007] Stack: Mar 15 03:43:23 hostname kernel: [ 1189.192007] e0c2cda4 70000000 400c0c30 00000000 dd111000 de365e54 de365f24 dd110c00 +[ 1189.192007] e0c22203 01000000 00000003 00000000 00000000 00000000 00000000 4353544e +[ 1189.192007] 30383420 00000069 00000000 00000000 00000000 00000000 00000000 00000000 +[ 1189.192007] Call Trace: Mar 15 03:43:23 hostname kernel: [ 1189.192007] [<e0c22203>] ? intel_tv_detect+0x89/0x12d [i915] +[ 1189.192007] [<e0a9dcef>] ? status_show+0x0/0x2f [drm] +[ 1189.192007] [<e0a9dd03>] ? status_show+0x14/0x2f [drm] + +[Digression: what is upowerd doing reading those power hungry files?] + +Reported-by: Paul Menzel <paulepanter@users.sourceforge.net> +Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> +Signed-off-by: Dave Airlie <airlied@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/gpu/drm/drm_sysfs.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/gpu/drm/drm_sysfs.c ++++ b/drivers/gpu/drm/drm_sysfs.c +@@ -158,8 +158,15 @@ static ssize_t status_show(struct device + { + struct drm_connector *connector = to_drm_connector(device); + enum drm_connector_status status; ++ int ret; ++ ++ ret = mutex_lock_interruptible(&connector->dev->mode_config.mutex); ++ if (ret) ++ return ret; + + status = connector->funcs->detect(connector, true); ++ mutex_unlock(&connector->dev->mode_config.mutex); ++ + return snprintf(buf, PAGE_SIZE, "%s\n", + drm_get_connector_status_name(status)); + } +From 0a8d7cb0c8182df7a28ad719780071178c386f0f Mon Sep 17 00:00:00 2001 +From: Senthil Balasubramanian <senthilkumar@atheros.com> +Date: Wed, 22 Dec 2010 19:17:18 +0530 +Subject: ath9k_hw: read and backup AR_WA register value even before chip reset on. + +From: Senthil Balasubramanian <senthilkumar@atheros.com> + +commit 0a8d7cb0c8182df7a28ad719780071178c386f0f upstream. + +We need to read and backup AR_WA register value permanently and reading +this after the chip is awakened results in this register being zeroed out. + +This seems to fix the ASPM with L1 enabled issue that we have observed. +The laptop becomes very slow and hangs mostly with ASPM L1 enabled without +this fix. + +Signed-off-by: Senthil Balasubramanian <senthilkumar@atheros.com> +Signed-off-by: John W. Linville <linville@tuxdriver.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/net/wireless/ath/ath9k/hw.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/hw.c ++++ b/drivers/net/wireless/ath/ath9k/hw.c +@@ -495,6 +495,15 @@ static int __ath9k_hw_init(struct ath_hw + if (ah->hw_version.devid == AR5416_AR9100_DEVID) + ah->hw_version.macVersion = AR_SREV_VERSION_9100; + ++ /* ++ * Read back AR_WA into a permanent copy and set bits 14 and 17. ++ * We need to do this to avoid RMW of this register. We cannot ++ * read the reg when chip is asleep. ++ */ ++ ah->WARegVal = REG_READ(ah, AR_WA); ++ ah->WARegVal |= (AR_WA_D3_L1_DISABLE | ++ AR_WA_ASPM_TIMER_BASED_DISABLE); ++ + if (!ath9k_hw_set_reset_reg(ah, ATH9K_RESET_POWER_ON)) { + ath_err(common, "Couldn't reset chip\n"); + return -EIO; +@@ -563,14 +572,6 @@ static int __ath9k_hw_init(struct ath_hw + + ath9k_hw_init_mode_regs(ah); + +- /* +- * Read back AR_WA into a permanent copy and set bits 14 and 17. +- * We need to do this to avoid RMW of this register. We cannot +- * read the reg when chip is asleep. +- */ +- ah->WARegVal = REG_READ(ah, AR_WA); +- ah->WARegVal |= (AR_WA_D3_L1_DISABLE | +- AR_WA_ASPM_TIMER_BASED_DISABLE); + + if (ah->is_pciexpress) + ath9k_hw_configpcipowersave(ah, 0, 0); +From ac45c12dfb3f727a5a7a3332ed9c11b4a5ab287e Mon Sep 17 00:00:00 2001 +From: Senthil Balasubramanian <senthilkumar@atheros.com> +Date: Wed, 22 Dec 2010 21:14:20 +0530 +Subject: ath9k_hw: Fix incorrect macversion and macrev checks + +From: Senthil Balasubramanian <senthilkumar@atheros.com> + +commit ac45c12dfb3f727a5a7a3332ed9c11b4a5ab287e upstream. + +There are few places where we are checking for macversion and revsions +before RTC is powered ON. However we are reading the macversion and +revisions only after RTC is powered ON and so both macversion and +revisions are actully zero and this leads to incorrect srev checks + +Incorrect srev checks can cause registers to be configured wrongly and can +cause unexpected behavior. Fixing this seems to address the ASPM issue that +we have observed. The laptop becomes very slow and hangs mostly with ASPM L1 +enabled without this fix. + +fix this by reading the macversion and revisisons even before we start +using them. There is no reason why should we delay reading this info +until RTC is powered on as this is just a register information. + +Signed-off-by: Senthil Balasubramanian <senthilkumar@atheros.com> +Signed-off-by: John W. Linville <linville@tuxdriver.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/net/wireless/ath/ath9k/hw.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/hw.c ++++ b/drivers/net/wireless/ath/ath9k/hw.c +@@ -504,6 +504,8 @@ static int __ath9k_hw_init(struct ath_hw + ah->WARegVal |= (AR_WA_D3_L1_DISABLE | + AR_WA_ASPM_TIMER_BASED_DISABLE); + ++ ath9k_hw_read_revisions(ah); ++ + if (!ath9k_hw_set_reset_reg(ah, ATH9K_RESET_POWER_ON)) { + ath_err(common, "Couldn't reset chip\n"); + return -EIO; +@@ -1083,8 +1085,6 @@ static bool ath9k_hw_set_reset_power_on( + return false; + } + +- ath9k_hw_read_revisions(ah); +- + return ath9k_hw_set_reset(ah, ATH9K_RESET_WARM); + } + +From 2e286947f1294239527c11f9f466ddce6466455b Mon Sep 17 00:00:00 2001 +From: Felix Fietkau <nbd@openwrt.org> +Date: Wed, 9 Mar 2011 01:48:12 +0100 +Subject: ath9k: remove support for the FIF_PROMISC_IN_BSS filter flag + +From: Felix Fietkau <nbd@openwrt.org> + +commit 2e286947f1294239527c11f9f466ddce6466455b upstream. + +The hardware rx filter flag triggered by FIF_PROMISC_IN_BSS is overly broad +and covers even frames with PHY errors. When this flag is enabled, this message +shows up frequently during scanning or hardware resets: + +ath: Could not stop RX, we could be confusing the DMA engine when we start RX up + +Since promiscuous mode is usually not particularly useful, yet enabled by +default by bridging (either used normally in 4-addr mode, or with hacks +for various virtualization software), we should sacrifice it for better +reliability during normal operation. + +This patch leaves it enabled if there are active monitor mode interfaces, since +it's very useful for debugging. + +Signed-off-by: Felix Fietkau <nbd@openwrt.org> +Signed-off-by: John W. Linville <linville@tuxdriver.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/net/wireless/ath/ath9k/recv.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/net/wireless/ath/ath9k/recv.c ++++ b/drivers/net/wireless/ath/ath9k/recv.c +@@ -439,9 +439,7 @@ u32 ath_calcrxfilter(struct ath_softc *s + * mode interface or when in monitor mode. AP mode does not need this + * since it receives all in-BSS frames anyway. + */ +- if (((sc->sc_ah->opmode != NL80211_IFTYPE_AP) && +- (sc->rx.rxfilter & FIF_PROMISC_IN_BSS)) || +- (sc->sc_ah->is_monitoring)) ++ if (sc->sc_ah->is_monitoring) + rfilt |= ATH9K_RX_FILTER_PROM; + + if (sc->rx.rxfilter & FIF_CONTROL) +From d8653d305ef66861c91fa7455fb8038460a7274c Mon Sep 17 00:00:00 2001 +From: Dan Carpenter <error27@gmail.com> +Date: Tue, 25 Jan 2011 14:15:11 +0000 +Subject: serial: mrst_max3110: make buffer larger + +From: Dan Carpenter <error27@gmail.com> + +commit d8653d305ef66861c91fa7455fb8038460a7274c upstream. + +This is used to store the spi_device ->modalias so they have to be the same +size. SPI_NAME_SIZE is 32. + +Signed-off-by: Dan Carpenter <error27@gmail.com> +Signed-off-by: Alan Cox <alan@linux.intel.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/tty/serial/mrst_max3110.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/serial/mrst_max3110.c ++++ b/drivers/tty/serial/mrst_max3110.c +@@ -51,7 +51,7 @@ + struct uart_max3110 { + struct uart_port port; + struct spi_device *spi; +- char name[24]; ++ char name[SPI_NAME_SIZE]; + + wait_queue_head_t wq; + struct task_struct *main_thread; +From 95926d2db6256e08d06b753752a0d903a0580acc Mon Sep 17 00:00:00 2001 +From: Yin Kangkai <kangkai.yin@linux.intel.com> +Date: Wed, 9 Feb 2011 11:34:20 +0800 +Subject: serial: also set the uartclk value in resume after goes to highspeed + +From: Yin Kangkai <kangkai.yin@linux.intel.com> + +commit 95926d2db6256e08d06b753752a0d903a0580acc upstream. + +For any reason if the NS16550A was not work in high speed mode (e.g. we hold +NS16550A from going to high speed mode in autoconfig_16550a()), now we are +resume from suspend, we should also set the uartclk to the correct +value. Otherwise it is still the old 1843200 and that will bring issues. + +CC: Greg Kroah-Hartman <greg@kroah.com> +CC: David Woodhouse <dwmw2@infradead.org> +CC: linux-kernel@vger.kernel.org +Signed-off-by: Yin Kangkai <kangkai.yin@linux.intel.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/tty/serial/8250.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/tty/serial/8250.c ++++ b/drivers/tty/serial/8250.c +@@ -3036,6 +3036,7 @@ void serial8250_resume_port(int line) + serial_outp(up, 0x04, tmp); + + serial_outp(up, UART_LCR, 0); ++ up->port.uartclk = 921600*16; + } + uart_resume_port(&serial8250_reg, &up->port); + } +From 0d0389e5414c8950b1613e8bdc74289cde3d6d98 Mon Sep 17 00:00:00 2001 +From: Yin Kangkai <kangkai.yin@linux.intel.com> +Date: Wed, 9 Feb 2011 11:35:18 +0800 +Subject: serial: change the divisor latch only when prescalar actually changed + +From: Yin Kangkai <kangkai.yin@linux.intel.com> + +commit 0d0389e5414c8950b1613e8bdc74289cde3d6d98 upstream. + +In 8250.c original ns16550 autoconfig code, we change the divisor latch when +we goto to high speed mode, we're assuming the previous speed is legacy. This +some times is not true. + +For example in a system with both CONFIG_SERIAL_8250 and +CONFIG_SERIAL_8250_PNP set, in this case, the code (autoconfig) will be called +twice, one in serial8250_init/probe() and the other is from +serial_pnp_probe. When serial_pnp_probe calls the autoconfig for NS16550A, +it's already in high speed mode, change the divisor latch (quot << 3) in this +case will make the UART console garbled. + +CC: Greg Kroah-Hartman <greg@kroah.com> +CC: David Woodhouse <dwmw2@infradead.org> +CC: linux-kernel@vger.kernel.org +Signed-off-by: Yin Kangkai <kangkai.yin@linux.intel.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/tty/serial/8250.c | 32 ++++++++++++++++++++------------ + 1 file changed, 20 insertions(+), 12 deletions(-) + +--- a/drivers/tty/serial/8250.c ++++ b/drivers/tty/serial/8250.c +@@ -954,6 +954,23 @@ static int broken_efr(struct uart_8250_p + return 0; + } + ++static inline int ns16550a_goto_highspeed(struct uart_8250_port *up) ++{ ++ unsigned char status; ++ ++ status = serial_in(up, 0x04); /* EXCR2 */ ++#define PRESL(x) ((x) & 0x30) ++ if (PRESL(status) == 0x10) { ++ /* already in high speed mode */ ++ return 0; ++ } else { ++ status &= ~0xB0; /* Disable LOCK, mask out PRESL[01] */ ++ status |= 0x10; /* 1.625 divisor for baud_base --> 921600 */ ++ serial_outp(up, 0x04, status); ++ } ++ return 1; ++} ++ + /* + * We know that the chip has FIFOs. Does it have an EFR? The + * EFR is located in the same register position as the IIR and +@@ -1025,12 +1042,8 @@ static void autoconfig_16550a(struct uar + quot = serial_dl_read(up); + quot <<= 3; + +- status1 = serial_in(up, 0x04); /* EXCR2 */ +- status1 &= ~0xB0; /* Disable LOCK, mask out PRESL[01] */ +- status1 |= 0x10; /* 1.625 divisor for baud_base --> 921600 */ +- serial_outp(up, 0x04, status1); +- +- serial_dl_write(up, quot); ++ if (ns16550a_goto_highspeed(up)) ++ serial_dl_write(up, quot); + + serial_outp(up, UART_LCR, 0); + +@@ -3025,15 +3038,10 @@ void serial8250_resume_port(int line) + struct uart_8250_port *up = &serial8250_ports[line]; + + if (up->capabilities & UART_NATSEMI) { +- unsigned char tmp; +- + /* Ensure it's still in high speed mode */ + serial_outp(up, UART_LCR, 0xE0); + +- tmp = serial_in(up, 0x04); /* EXCR2 */ +- tmp &= ~0xB0; /* Disable LOCK, mask out PRESL[01] */ +- tmp |= 0x10; /* 1.625 divisor for baud_base --> 921600 */ +- serial_outp(up, 0x04, tmp); ++ ns16550a_goto_highspeed(up); + + serial_outp(up, UART_LCR, 0); + up->port.uartclk = 921600*16; +From 969e3033ae7733a0af8f7742ca74cd16c0857e71 Mon Sep 17 00:00:00 2001 +From: Alan Stern <stern@rowland.harvard.edu> +Date: Wed, 23 Feb 2011 15:28:18 -0500 +Subject: USB: serial drivers need to use larger bulk-in buffers + +From: Alan Stern <stern@rowland.harvard.edu> + +commit 969e3033ae7733a0af8f7742ca74cd16c0857e71 upstream. + +When a driver doesn't know how much data a device is going to send, +the buffer size should be at least as big as the endpoint's maxpacket +value. The serial drivers don't follow this rule; many of them +request only 256-byte bulk-in buffers. As a result, they suffer +overflow errors if a high-speed device wants to send a lot of data, +because high-speed bulk endpoints are required to have a maxpacket +size of 512. + +This patch (as1450) fixes the problem by using the driver's +bulk_in_size value as a minimum, always allocating buffers no smaller +than the endpoint's maxpacket size. + +Signed-off-by: Alan Stern <stern@rowland.harvard.edu> +Tested-by: Flynn Marquardt <flynn@flynnux.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/serial/usb-serial.c | 5 ++--- + include/linux/usb/serial.h | 3 ++- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/serial/usb-serial.c ++++ b/drivers/usb/serial/usb-serial.c +@@ -911,9 +911,8 @@ int usb_serial_probe(struct usb_interfac + dev_err(&interface->dev, "No free urbs available\n"); + goto probe_error; + } +- buffer_size = serial->type->bulk_in_size; +- if (!buffer_size) +- buffer_size = le16_to_cpu(endpoint->wMaxPacketSize); ++ buffer_size = max_t(int, serial->type->bulk_in_size, ++ le16_to_cpu(endpoint->wMaxPacketSize)); + port->bulk_in_size = buffer_size; + port->bulk_in_endpointAddress = endpoint->bEndpointAddress; + port->bulk_in_buffer = kmalloc(buffer_size, GFP_KERNEL); +--- a/include/linux/usb/serial.h ++++ b/include/linux/usb/serial.h +@@ -191,7 +191,8 @@ static inline void usb_set_serial_data(s + * @id_table: pointer to a list of usb_device_id structures that define all + * of the devices this structure can support. + * @num_ports: the number of different ports this device will have. +- * @bulk_in_size: bytes to allocate for bulk-in buffer (0 = end-point size) ++ * @bulk_in_size: minimum number of bytes to allocate for bulk-in buffer ++ * (0 = end-point size) + * @bulk_out_size: bytes to allocate for bulk-out buffer (0 = end-point size) + * @calc_num_ports: pointer to a function to determine how many ports this + * device has dynamically. It will be called after the probe() +From 6960f40a954619857e7095a6179eef896f297077 Mon Sep 17 00:00:00 2001 +From: Jiri Slaby <jslaby@suse.cz> +Date: Mon, 28 Feb 2011 10:34:06 +0100 +Subject: USB: serial/kobil_sct, fix potential tty NULL dereference + +From: Jiri Slaby <jslaby@suse.cz> + +commit 6960f40a954619857e7095a6179eef896f297077 upstream. + +Make sure that we check the return value of tty_port_tty_get. +Sometimes it may return NULL and we later dereference that. + +The only place here is in kobil_read_int_callback, so fix it. + +Signed-off-by: Jiri Slaby <jslaby@suse.cz> +Cc: Alan Cox <alan@linux.intel.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/serial/kobil_sct.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/serial/kobil_sct.c ++++ b/drivers/usb/serial/kobil_sct.c +@@ -372,7 +372,7 @@ static void kobil_read_int_callback(stru + } + + tty = tty_port_tty_get(&port->port); +- if (urb->actual_length) { ++ if (tty && urb->actual_length) { + + /* BEGIN DEBUG */ + /* +From 7a89e4cb9cdaba92f5fbc509945cf4e3c48db4e2 Mon Sep 17 00:00:00 2001 +From: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com> +Date: Wed, 9 Mar 2011 09:19:48 +0000 +Subject: USB: serial: option: Apply OPTION_BLACKLIST_SENDSETUP also for ZTE MF626 + +From: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com> + +commit 7a89e4cb9cdaba92f5fbc509945cf4e3c48db4e2 upstream. + +On https://bugs.launchpad.net/ubuntu/+source/linux/+bug/636091, one of +the cases reported is a big timeout on option_send_setup, which causes +some side effects as tty_lock is held. Looks like some of ZTE MF626 +devices also don't like the RTS/DTR setting in option_send_setup, like +with 4G XS Stick W14. The reporter confirms which this it solves the +long freezes in his system. + +Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/serial/option.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -652,7 +652,8 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0028, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0029, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0030, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF626, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF626, 0xff, ++ 0xff, 0xff), .driver_info = (kernel_ulong_t)&four_g_w14_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0032, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0033, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0034, 0xff, 0xff, 0xff) }, +From d0781383038e983a63843a9a6a067ed781db89c1 Mon Sep 17 00:00:00 2001 +From: wangyanqing <udknight@gmail.com> +Date: Fri, 11 Mar 2011 06:24:38 -0800 +Subject: USB: serial: ch341: add new id + +From: wangyanqing <udknight@gmail.com> + +commit d0781383038e983a63843a9a6a067ed781db89c1 upstream. + +I picked up a new DAK-780EX(professional digitl reverb/mix system), +which use CH341T chipset to communication with computer on 3/2011 +and the CH341T's vendor code is 1a86 + +Looking up the CH341T's vendor and product id's I see: + +1a86 QinHeng Electronics + 5523 CH341 in serial mode, usb to serial port converter + +CH341T,CH341 are the products of the same company, maybe +have some common hardware, and I test the ch341.c works +well with CH341T + +Cc: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/serial/ch341.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/ch341.c ++++ b/drivers/usb/serial/ch341.c +@@ -75,6 +75,7 @@ static int debug; + static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x4348, 0x5523) }, + { USB_DEVICE(0x1a86, 0x7523) }, ++ { USB_DEVICE(0x1a86, 0x5523) }, + { }, + }; + MODULE_DEVICE_TABLE(usb, id_table); +From cecf826df8648c843ea8db63b1f82c154a74db36 Mon Sep 17 00:00:00 2001 +From: Jeff Mahoney <jeffm@suse.com> +Date: Thu, 24 Feb 2011 14:49:00 -0500 +Subject: staging: winbond: needs <linux/delay.h> for msleep and friends + +From: Jeff Mahoney <jeffm@suse.com> + +commit cecf826df8648c843ea8db63b1f82c154a74db36 upstream. + +linux/delay.h is pulled in somehow on x86 but not on ia64 or powerpc. + +This fixes a build failure on those arches since they use [mu]delay. + +Signed-off-by: Jeff Mahoney <jeffm@suse.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/staging/winbond/core.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/staging/winbond/core.h ++++ b/drivers/staging/winbond/core.h +@@ -3,6 +3,7 @@ + + #include <linux/wireless.h> + #include <linux/types.h> ++#include <linux/delay.h> + + #include "wbhal.h" + #include "mto.h" +From ab42abf33a3efdf754710a0a513c00c40854cd61 Mon Sep 17 00:00:00 2001 +From: Felipe Contreras <felipe.contreras@nokia.com> +Date: Fri, 11 Mar 2011 18:29:06 -0600 +Subject: staging: tidspbridge: protect dmm_map properly + +From: Felipe Contreras <felipe.contreras@nokia.com> + +commit ab42abf33a3efdf754710a0a513c00c40854cd61 upstream. + +We need to protect not only the dmm_map list, but the individual +map_obj's, otherwise, we might be building the scatter-gather list with +garbage. So, use the existing proc_lock for that. + +I observed race conditions which caused kernel panics while running +stress tests, also, Tuomas Kulve found it happening quite often in +Gumstix Over. This patch fixes those. + +Cc: Tuomas Kulve <tuomas@kulve.fi> +Signed-off-by: Felipe Contreras <felipe.contreras@nokia.com> +Signed-off-by: Omar Ramirez Luna <omar.ramirez@ti.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/staging/tidspbridge/rmgr/proc.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +--- a/drivers/staging/tidspbridge/rmgr/proc.c ++++ b/drivers/staging/tidspbridge/rmgr/proc.c +@@ -781,12 +781,14 @@ int proc_begin_dma(void *hprocessor, voi + (u32)pmpu_addr, + ul_size, dir); + ++ mutex_lock(&proc_lock); ++ + /* find requested memory are in cached mapping information */ + map_obj = find_containing_mapping(pr_ctxt, (u32) pmpu_addr, ul_size); + if (!map_obj) { + pr_err("%s: find_containing_mapping failed\n", __func__); + status = -EFAULT; +- goto err_out; ++ goto no_map; + } + + if (memory_give_ownership(map_obj, (u32) pmpu_addr, ul_size, dir)) { +@@ -795,6 +797,8 @@ int proc_begin_dma(void *hprocessor, voi + status = -EFAULT; + } + ++no_map: ++ mutex_unlock(&proc_lock); + err_out: + + return status; +@@ -819,21 +823,24 @@ int proc_end_dma(void *hprocessor, void + (u32)pmpu_addr, + ul_size, dir); + ++ mutex_lock(&proc_lock); ++ + /* find requested memory are in cached mapping information */ + map_obj = find_containing_mapping(pr_ctxt, (u32) pmpu_addr, ul_size); + if (!map_obj) { + pr_err("%s: find_containing_mapping failed\n", __func__); + status = -EFAULT; +- goto err_out; ++ goto no_map; + } + + if (memory_regain_ownership(map_obj, (u32) pmpu_addr, ul_size, dir)) { + pr_err("%s: InValid address parameters %p %x\n", + __func__, pmpu_addr, ul_size); + status = -EFAULT; +- goto err_out; + } + ++no_map: ++ mutex_unlock(&proc_lock); + err_out: + return status; + } +@@ -1726,9 +1733,8 @@ int proc_un_map(void *hprocessor, void * + (p_proc_object->hbridge_context, va_align, size_align); + } + +- mutex_unlock(&proc_lock); + if (status) +- goto func_end; ++ goto unmap_failed; + + /* + * A successful unmap should be followed by removal of map_obj +@@ -1737,6 +1743,9 @@ int proc_un_map(void *hprocessor, void * + */ + remove_mapping_information(pr_ctxt, (u32) map_addr, size_align); + ++unmap_failed: ++ mutex_unlock(&proc_lock); ++ + func_end: + dev_dbg(bridge, "%s: hprocessor: 0x%p map_addr: 0x%p status: 0x%x\n", + __func__, hprocessor, map_addr, status); +From 6410db593e8c1b2b79a2f18554310d6da9415584 Mon Sep 17 00:00:00 2001 +From: Larry Finger <Larry.Finger@lwfinger.net> +Date: Mon, 28 Feb 2011 23:36:09 -0600 +Subject: rtl8187: Change rate-control feedback + +From: Larry Finger <Larry.Finger@lwfinger.net> + +commit 6410db593e8c1b2b79a2f18554310d6da9415584 upstream. + +The driver for the RTL8187L chips returns IEEE80211_TX_STAT_ACK for all +packets, even if the maximum number of retries was exhausted. In addition +it fails to setup max_rates in the ieee80211_hw struct, This behavior +may be responsible for the problems noted in Bug 14168. As the bug is very +old, testers have not been found, and I do not have the case where the +indicated signal is less than -70 dBm. + +Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> +Acked-by: Hin-Tak Leung <htl10@users.sourceforge.net> +Signed-off-by: John W. Linville <linville@tuxdriver.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/net/wireless/rtl818x/rtl8187/dev.c | 25 ++++++++++++++++++++----- + drivers/net/wireless/rtl818x/rtl8187/rtl8187.h | 2 ++ + 2 files changed, 22 insertions(+), 5 deletions(-) + +--- a/drivers/net/wireless/rtl818x/rtl8187/dev.c ++++ b/drivers/net/wireless/rtl818x/rtl8187/dev.c +@@ -871,23 +871,35 @@ static void rtl8187_work(struct work_str + /* The RTL8187 returns the retry count through register 0xFFFA. In + * addition, it appears to be a cumulative retry count, not the + * value for the current TX packet. When multiple TX entries are +- * queued, the retry count will be valid for the last one in the queue. +- * The "error" should not matter for purposes of rate setting. */ ++ * waiting in the queue, the retry count will be the total for all. ++ * The "error" may matter for purposes of rate setting, but there is ++ * no other choice with this hardware. ++ */ + struct rtl8187_priv *priv = container_of(work, struct rtl8187_priv, + work.work); + struct ieee80211_tx_info *info; + struct ieee80211_hw *dev = priv->dev; + static u16 retry; + u16 tmp; ++ u16 avg_retry; ++ int length; + + mutex_lock(&priv->conf_mutex); + tmp = rtl818x_ioread16(priv, (__le16 *)0xFFFA); ++ length = skb_queue_len(&priv->b_tx_status.queue); ++ if (unlikely(!length)) ++ length = 1; ++ if (unlikely(tmp < retry)) ++ tmp = retry; ++ avg_retry = (tmp - retry) / length; + while (skb_queue_len(&priv->b_tx_status.queue) > 0) { + struct sk_buff *old_skb; + + old_skb = skb_dequeue(&priv->b_tx_status.queue); + info = IEEE80211_SKB_CB(old_skb); +- info->status.rates[0].count = tmp - retry + 1; ++ info->status.rates[0].count = avg_retry + 1; ++ if (info->status.rates[0].count > RETRY_COUNT) ++ info->flags &= ~IEEE80211_TX_STAT_ACK; + ieee80211_tx_status_irqsafe(dev, old_skb); + } + retry = tmp; +@@ -933,8 +945,8 @@ static int rtl8187_start(struct ieee8021 + rtl818x_iowrite32(priv, &priv->map->TX_CONF, + RTL818X_TX_CONF_HW_SEQNUM | + RTL818X_TX_CONF_DISREQQSIZE | +- (7 << 8 /* short retry limit */) | +- (7 << 0 /* long retry limit */) | ++ (RETRY_COUNT << 8 /* short retry limit */) | ++ (RETRY_COUNT << 0 /* long retry limit */) | + (7 << 21 /* MAX TX DMA */)); + rtl8187_init_urbs(dev); + rtl8187b_init_status_urb(dev); +@@ -1378,6 +1390,9 @@ static int __devinit rtl8187_probe(struc + dev->flags = IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING | + IEEE80211_HW_SIGNAL_DBM | + IEEE80211_HW_RX_INCLUDES_FCS; ++ /* Initialize rate-control variables */ ++ dev->max_rates = 1; ++ dev->max_rate_tries = RETRY_COUNT; + + eeprom.data = dev; + eeprom.register_read = rtl8187_eeprom_register_read; +--- a/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h ++++ b/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h +@@ -35,6 +35,8 @@ + #define RFKILL_MASK_8187_89_97 0x2 + #define RFKILL_MASK_8198 0x4 + ++#define RETRY_COUNT 7 ++ + struct rtl8187_rx_info { + struct urb *urb; + struct ieee80211_hw *dev; +From b14e840d04dba211fbdc930247e379085623eacd Mon Sep 17 00:00:00 2001 +From: Sebastian Andrzej Siewior <bigeasy@linutronix.de> +Date: Tue, 8 Feb 2011 21:07:40 +0100 +Subject: USB: isp1760: Implement solution for erratum 2 + +From: Sebastian Andrzej Siewior <bigeasy@linutronix.de> + +commit b14e840d04dba211fbdc930247e379085623eacd upstream. + +The document says: +|2.1 Problem description +| When at least two USB devices are simultaneously running, it is observed that +| sometimes the INT corresponding to one of the USB devices stops occurring. This may +| be observed sometimes with USB-to-serial or USB-to-network devices. +| The problem is not noticed when only USB mass storage devices are running. +|2.2 Implication +| This issue is because of the clearing of the respective Done Map bit on reading the ATL +| PTD Done Map register when an INT is generated by another PTD completion, but is not +| found set on that read access. In this situation, the respective Done Map bit will remain +| reset and no further INT will be asserted so the data transfer corresponding to that USB +| device will stop. +|2.3 Workaround +| An SOF INT can be used instead of an ATL INT with polling on Done bits. A time-out can +| be implemented and if a certain Done bit is never set, verification of the PTD completion +| can be done by reading PTD contents (valid bit). +| This is a proven workaround implemented in software. + +Russell King run into this with an USB-to-serial converter. This patch +implements his suggestion to enable the high frequent SOF interrupt only +at the time we have ATL packages queued. It goes even one step further +and enables the SOF interrupt only if we have more than one ATL packet +queued at the same time. + +Tested-by: Russell King <rmk+kernel@arm.linux.org.uk> +Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/host/isp1760-hcd.c | 22 ++++++++++++++++------ + drivers/usb/host/isp1760-hcd.h | 1 + + 2 files changed, 17 insertions(+), 6 deletions(-) + +--- a/drivers/usb/host/isp1760-hcd.c ++++ b/drivers/usb/host/isp1760-hcd.c +@@ -33,6 +33,7 @@ struct isp1760_hcd { + struct inter_packet_info atl_ints[32]; + struct inter_packet_info int_ints[32]; + struct memory_chunk memory_pool[BLOCKS]; ++ u32 atl_queued; + + /* periodic schedule support */ + #define DEFAULT_I_TDPS 1024 +@@ -850,6 +851,11 @@ static void enqueue_an_ATL_packet(struct + skip_map &= ~queue_entry; + isp1760_writel(skip_map, hcd->regs + HC_ATL_PTD_SKIPMAP_REG); + ++ priv->atl_queued++; ++ if (priv->atl_queued == 2) ++ isp1760_writel(INTERRUPT_ENABLE_SOT_MASK, ++ hcd->regs + HC_INTERRUPT_ENABLE); ++ + buffstatus = isp1760_readl(hcd->regs + HC_BUFFER_STATUS_REG); + buffstatus |= ATL_BUFFER; + isp1760_writel(buffstatus, hcd->regs + HC_BUFFER_STATUS_REG); +@@ -992,6 +998,7 @@ static void do_atl_int(struct usb_hcd *u + u32 dw3; + + status = 0; ++ priv->atl_queued--; + + queue_entry = __ffs(done_map); + done_map &= ~(1 << queue_entry); +@@ -1054,11 +1061,6 @@ static void do_atl_int(struct usb_hcd *u + * device is not able to send data fast enough. + * This happens mostly on slower hardware. + */ +- printk(KERN_NOTICE "Reloading ptd %p/%p... qh %p read: " +- "%d of %zu done: %08x cur: %08x\n", qtd, +- urb, qh, PTD_XFERRED_LENGTH(dw3), +- qtd->length, done_map, +- (1 << queue_entry)); + + /* RL counter = ERR counter */ + dw3 &= ~(0xf << 19); +@@ -1086,6 +1088,11 @@ static void do_atl_int(struct usb_hcd *u + priv_write_copy(priv, (u32 *)&ptd, usb_hcd->regs + + atl_regs, sizeof(ptd)); + ++ priv->atl_queued++; ++ if (priv->atl_queued == 2) ++ isp1760_writel(INTERRUPT_ENABLE_SOT_MASK, ++ usb_hcd->regs + HC_INTERRUPT_ENABLE); ++ + buffstatus = isp1760_readl(usb_hcd->regs + + HC_BUFFER_STATUS_REG); + buffstatus |= ATL_BUFFER; +@@ -1191,6 +1198,9 @@ static void do_atl_int(struct usb_hcd *u + skip_map = isp1760_readl(usb_hcd->regs + + HC_ATL_PTD_SKIPMAP_REG); + } ++ if (priv->atl_queued <= 1) ++ isp1760_writel(INTERRUPT_ENABLE_MASK, ++ usb_hcd->regs + HC_INTERRUPT_ENABLE); + } + + static void do_intl_int(struct usb_hcd *usb_hcd) +@@ -1770,7 +1780,7 @@ static irqreturn_t isp1760_irq(struct us + goto leave; + + isp1760_writel(imask, usb_hcd->regs + HC_INTERRUPT_REG); +- if (imask & HC_ATL_INT) ++ if (imask & (HC_ATL_INT | HC_SOT_INT)) + do_atl_int(usb_hcd); + + if (imask & HC_INTL_INT) +--- a/drivers/usb/host/isp1760-hcd.h ++++ b/drivers/usb/host/isp1760-hcd.h +@@ -69,6 +69,7 @@ void deinit_kmem_cache(void); + + #define HC_INTERRUPT_ENABLE 0x314 + #define INTERRUPT_ENABLE_MASK (HC_INTL_INT | HC_ATL_INT | HC_EOT_INT) ++#define INTERRUPT_ENABLE_SOT_MASK (HC_INTL_INT | HC_SOT_INT | HC_EOT_INT) + + #define HC_ISO_INT (1 << 9) + #define HC_ATL_INT (1 << 8) +From 294d95f2cbc2aef5346258f216cd9df570e271a5 Mon Sep 17 00:00:00 2001 +From: Matthew Garrett <mjg@redhat.com> +Date: Tue, 11 Jan 2011 12:26:48 -0500 +Subject: ehci: Check individual port status registers on resume + +From: Matthew Garrett <mjg@redhat.com> + +commit 294d95f2cbc2aef5346258f216cd9df570e271a5 upstream. + +If a device plug/unplug is detected on an ATI SB700 USB controller in D3, +it appears to set the port status register but not the controller status +register. As a result we'll fail to detect the plug event. Check the port +status register on resume as well in order to catch this case. + +Signed-off-by: Matthew Garrett <mjg@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/host/ehci-hub.c | 23 ++++++++++++++++++++++- + 1 file changed, 22 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/ehci-hub.c ++++ b/drivers/usb/host/ehci-hub.c +@@ -106,6 +106,27 @@ static void ehci_handover_companion_port + ehci->owned_ports = 0; + } + ++static int ehci_port_change(struct ehci_hcd *ehci) ++{ ++ int i = HCS_N_PORTS(ehci->hcs_params); ++ ++ /* First check if the controller indicates a change event */ ++ ++ if (ehci_readl(ehci, &ehci->regs->status) & STS_PCD) ++ return 1; ++ ++ /* ++ * Not all controllers appear to update this while going from D3 to D0, ++ * so check the individual port status registers as well ++ */ ++ ++ while (i--) ++ if (ehci_readl(ehci, &ehci->regs->port_status[i]) & PORT_CSC) ++ return 1; ++ ++ return 0; ++} ++ + static void ehci_adjust_port_wakeup_flags(struct ehci_hcd *ehci, + bool suspending, bool do_wakeup) + { +@@ -173,7 +194,7 @@ static void ehci_adjust_port_wakeup_flag + } + + /* Does the root hub have a port wakeup pending? */ +- if (!suspending && (ehci_readl(ehci, &ehci->regs->status) & STS_PCD)) ++ if (!suspending && ehci_port_change(ehci)) + usb_hcd_resume_root_hub(ehci_to_hcd(ehci)); + + spin_unlock_irqrestore(&ehci->lock, flags); +From 9b37596a2e860404503a3f2a6513db60c296bfdc Mon Sep 17 00:00:00 2001 +From: Alan Stern <stern@rowland.harvard.edu> +Date: Mon, 7 Mar 2011 11:11:52 -0500 +Subject: USB: move usbcore away from hcd->state + +From: Alan Stern <stern@rowland.harvard.edu> + +commit 9b37596a2e860404503a3f2a6513db60c296bfdc upstream. + +The hcd->state variable is a disaster. It's not clearly owned by +either usbcore or the host controller drivers, and they both change it +from time to time, potentially stepping on each other's toes. It's +not protected by any locks. And there's no mechanism to prevent it +from going through an invalid transition. + +This patch (as1451) takes a first step toward fixing these problems. +As it turns out, usbcore uses hcd->state for essentially only two +things: checking whether the controller's root hub is running and +checking whether the controller has died. Therefore the patch adds +two new atomic bitflags to the hcd structure, to store these pieces of +information. The new flags are used only by usbcore, and a private +spinlock prevents invalid combinations (a dead controller's root hub +cannot be running). + +The patch does not change the places where usbcore sets hcd->state, +since HCDs may depend on them. Furthermore, there is one place in +usb_hcd_irq() where usbcore still must use hcd->state: An HCD's +interrupt handler can implicitly indicate that the controller died by +setting hcd->state to HC_STATE_HALT. Nevertheless, the new code is a +big improvement over the current code. + +The patch makes one other change. The hcd_bus_suspend() and +hcd_bus_resume() routines now check first whether the host controller +has died; if it has then they return immediately without calling the +HCD's bus_suspend or bus_resume methods. + +This fixes the major problem reported in Bugzilla #29902: The system +fails to suspend after a host controller dies during system resume. + +Signed-off-by: Alan Stern <stern@rowland.harvard.edu> +Tested-by: Alex Terekhov <a.terekhov@gmail.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/core/hcd-pci.c | 13 ++++------ + drivers/usb/core/hcd.c | 55 +++++++++++++++++++++++++++++++++------------ + include/linux/usb/hcd.h | 4 +++ + 3 files changed, 51 insertions(+), 21 deletions(-) + +--- a/drivers/usb/core/hcd-pci.c ++++ b/drivers/usb/core/hcd-pci.c +@@ -363,8 +363,7 @@ static int check_root_hub_suspended(stru + struct pci_dev *pci_dev = to_pci_dev(dev); + struct usb_hcd *hcd = pci_get_drvdata(pci_dev); + +- if (!(hcd->state == HC_STATE_SUSPENDED || +- hcd->state == HC_STATE_HALT)) { ++ if (HCD_RH_RUNNING(hcd)) { + dev_warn(dev, "Root hub is not suspended\n"); + return -EBUSY; + } +@@ -386,7 +385,7 @@ static int suspend_common(struct device + if (retval) + return retval; + +- if (hcd->driver->pci_suspend) { ++ if (hcd->driver->pci_suspend && !HCD_DEAD(hcd)) { + /* Optimization: Don't suspend if a root-hub wakeup is + * pending and it would cause the HCD to wake up anyway. + */ +@@ -427,7 +426,7 @@ static int resume_common(struct device * + struct usb_hcd *hcd = pci_get_drvdata(pci_dev); + int retval; + +- if (hcd->state != HC_STATE_SUSPENDED) { ++ if (HCD_RH_RUNNING(hcd)) { + dev_dbg(dev, "can't resume, not suspended!\n"); + return 0; + } +@@ -442,7 +441,7 @@ static int resume_common(struct device * + + clear_bit(HCD_FLAG_SAW_IRQ, &hcd->flags); + +- if (hcd->driver->pci_resume) { ++ if (hcd->driver->pci_resume && !HCD_DEAD(hcd)) { + if (event != PM_EVENT_AUTO_RESUME) + wait_for_companions(pci_dev, hcd); + +@@ -475,10 +474,10 @@ static int hcd_pci_suspend_noirq(struct + + pci_save_state(pci_dev); + +- /* If the root hub is HALTed rather than SUSPENDed, ++ /* If the root hub is dead rather than suspended, + * disallow remote wakeup. + */ +- if (hcd->state == HC_STATE_HALT) ++ if (HCD_DEAD(hcd)) + device_set_wakeup_enable(dev, 0); + dev_dbg(dev, "wakeup: %d\n", device_may_wakeup(dev)); + +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -983,7 +983,7 @@ static int register_root_hub(struct usb_ + spin_unlock_irq (&hcd_root_hub_lock); + + /* Did the HC die before the root hub was registered? */ +- if (hcd->state == HC_STATE_HALT) ++ if (HCD_DEAD(hcd) || hcd->state == HC_STATE_HALT) + usb_hc_died (hcd); /* This time clean up */ + } + +@@ -1089,13 +1089,10 @@ int usb_hcd_link_urb_to_ep(struct usb_hc + * Check the host controller's state and add the URB to the + * endpoint's queue. + */ +- switch (hcd->state) { +- case HC_STATE_RUNNING: +- case HC_STATE_RESUMING: ++ if (HCD_RH_RUNNING(hcd)) { + urb->unlinked = 0; + list_add_tail(&urb->urb_list, &urb->ep->urb_list); +- break; +- default: ++ } else { + rc = -ESHUTDOWN; + goto done; + } +@@ -1913,7 +1910,7 @@ int usb_hcd_get_frame_number (struct usb + { + struct usb_hcd *hcd = bus_to_hcd(udev->bus); + +- if (!HC_IS_RUNNING (hcd->state)) ++ if (!HCD_RH_RUNNING(hcd)) + return -ESHUTDOWN; + return hcd->driver->get_frame_number (hcd); + } +@@ -1930,9 +1927,15 @@ int hcd_bus_suspend(struct usb_device *r + + dev_dbg(&rhdev->dev, "bus %s%s\n", + (msg.event & PM_EVENT_AUTO ? "auto-" : ""), "suspend"); ++ if (HCD_DEAD(hcd)) { ++ dev_dbg(&rhdev->dev, "skipped %s of dead bus\n", "suspend"); ++ return 0; ++ } ++ + if (!hcd->driver->bus_suspend) { + status = -ENOENT; + } else { ++ clear_bit(HCD_FLAG_RH_RUNNING, &hcd->flags); + hcd->state = HC_STATE_QUIESCING; + status = hcd->driver->bus_suspend(hcd); + } +@@ -1940,7 +1943,12 @@ int hcd_bus_suspend(struct usb_device *r + usb_set_device_state(rhdev, USB_STATE_SUSPENDED); + hcd->state = HC_STATE_SUSPENDED; + } else { +- hcd->state = old_state; ++ spin_lock_irq(&hcd_root_hub_lock); ++ if (!HCD_DEAD(hcd)) { ++ set_bit(HCD_FLAG_RH_RUNNING, &hcd->flags); ++ hcd->state = old_state; ++ } ++ spin_unlock_irq(&hcd_root_hub_lock); + dev_dbg(&rhdev->dev, "bus %s fail, err %d\n", + "suspend", status); + } +@@ -1955,9 +1963,13 @@ int hcd_bus_resume(struct usb_device *rh + + dev_dbg(&rhdev->dev, "usb %s%s\n", + (msg.event & PM_EVENT_AUTO ? "auto-" : ""), "resume"); ++ if (HCD_DEAD(hcd)) { ++ dev_dbg(&rhdev->dev, "skipped %s of dead bus\n", "resume"); ++ return 0; ++ } + if (!hcd->driver->bus_resume) + return -ENOENT; +- if (hcd->state == HC_STATE_RUNNING) ++ if (HCD_RH_RUNNING(hcd)) + return 0; + + hcd->state = HC_STATE_RESUMING; +@@ -1966,10 +1978,15 @@ int hcd_bus_resume(struct usb_device *rh + if (status == 0) { + /* TRSMRCY = 10 msec */ + msleep(10); +- usb_set_device_state(rhdev, rhdev->actconfig +- ? USB_STATE_CONFIGURED +- : USB_STATE_ADDRESS); +- hcd->state = HC_STATE_RUNNING; ++ spin_lock_irq(&hcd_root_hub_lock); ++ if (!HCD_DEAD(hcd)) { ++ usb_set_device_state(rhdev, rhdev->actconfig ++ ? USB_STATE_CONFIGURED ++ : USB_STATE_ADDRESS); ++ set_bit(HCD_FLAG_RH_RUNNING, &hcd->flags); ++ hcd->state = HC_STATE_RUNNING; ++ } ++ spin_unlock_irq(&hcd_root_hub_lock); + } else { + hcd->state = old_state; + dev_dbg(&rhdev->dev, "bus %s fail, err %d\n", +@@ -2080,7 +2097,7 @@ irqreturn_t usb_hcd_irq (int irq, void * + */ + local_irq_save(flags); + +- if (unlikely(hcd->state == HC_STATE_HALT || !HCD_HW_ACCESSIBLE(hcd))) { ++ if (unlikely(HCD_DEAD(hcd) || !HCD_HW_ACCESSIBLE(hcd))) { + rc = IRQ_NONE; + } else if (hcd->driver->irq(hcd) == IRQ_NONE) { + rc = IRQ_NONE; +@@ -2114,6 +2131,8 @@ void usb_hc_died (struct usb_hcd *hcd) + dev_err (hcd->self.controller, "HC died; cleaning up\n"); + + spin_lock_irqsave (&hcd_root_hub_lock, flags); ++ clear_bit(HCD_FLAG_RH_RUNNING, &hcd->flags); ++ set_bit(HCD_FLAG_DEAD, &hcd->flags); + if (hcd->rh_registered) { + clear_bit(HCD_FLAG_POLL_RH, &hcd->flags); + +@@ -2256,6 +2275,12 @@ int usb_add_hcd(struct usb_hcd *hcd, + */ + device_init_wakeup(&rhdev->dev, 1); + ++ /* HCD_FLAG_RH_RUNNING doesn't matter until the root hub is ++ * registered. But since the controller can die at any time, ++ * let's initialize the flag before touching the hardware. ++ */ ++ set_bit(HCD_FLAG_RH_RUNNING, &hcd->flags); ++ + /* "reset" is misnamed; its role is now one-time init. the controller + * should already have been reset (and boot firmware kicked off etc). + */ +@@ -2323,6 +2348,7 @@ int usb_add_hcd(struct usb_hcd *hcd, + return retval; + + error_create_attr_group: ++ clear_bit(HCD_FLAG_RH_RUNNING, &hcd->flags); + if (HC_IS_RUNNING(hcd->state)) + hcd->state = HC_STATE_QUIESCING; + spin_lock_irq(&hcd_root_hub_lock); +@@ -2375,6 +2401,7 @@ void usb_remove_hcd(struct usb_hcd *hcd) + usb_get_dev(rhdev); + sysfs_remove_group(&rhdev->dev.kobj, &usb_bus_attr_group); + ++ clear_bit(HCD_FLAG_RH_RUNNING, &hcd->flags); + if (HC_IS_RUNNING (hcd->state)) + hcd->state = HC_STATE_QUIESCING; + +--- a/include/linux/usb/hcd.h ++++ b/include/linux/usb/hcd.h +@@ -99,6 +99,8 @@ struct usb_hcd { + #define HCD_FLAG_POLL_RH 2 /* poll for rh status? */ + #define HCD_FLAG_POLL_PENDING 3 /* status has changed? */ + #define HCD_FLAG_WAKEUP_PENDING 4 /* root hub is resuming? */ ++#define HCD_FLAG_RH_RUNNING 5 /* root hub is running? */ ++#define HCD_FLAG_DEAD 6 /* controller has died? */ + + /* The flags can be tested using these macros; they are likely to + * be slightly faster than test_bit(). +@@ -108,6 +110,8 @@ struct usb_hcd { + #define HCD_POLL_RH(hcd) ((hcd)->flags & (1U << HCD_FLAG_POLL_RH)) + #define HCD_POLL_PENDING(hcd) ((hcd)->flags & (1U << HCD_FLAG_POLL_PENDING)) + #define HCD_WAKEUP_PENDING(hcd) ((hcd)->flags & (1U << HCD_FLAG_WAKEUP_PENDING)) ++#define HCD_RH_RUNNING(hcd) ((hcd)->flags & (1U << HCD_FLAG_RH_RUNNING)) ++#define HCD_DEAD(hcd) ((hcd)->flags & (1U << HCD_FLAG_DEAD)) + + /* Flags that get set only during HCD registration or removal. */ + unsigned rh_registered:1;/* is root hub registered? */ +From bf161e85fb153c0dd5a95faca73fd6a9d237c389 Mon Sep 17 00:00:00 2001 +From: Sarah Sharp <sarah.a.sharp@linux.intel.com> +Date: Wed, 23 Feb 2011 15:46:42 -0800 +Subject: xhci: Update internal dequeue pointers after stalls. + +From: Sarah Sharp <sarah.a.sharp@linux.intel.com> + +commit bf161e85fb153c0dd5a95faca73fd6a9d237c389 upstream. + +When an endpoint stalls, the xHCI driver must move the endpoint ring's +dequeue pointer past the stalled transfer. To do that, the driver issues +a Set TR Dequeue Pointer command, which will complete some time later. + +Takashi was having issues with USB 1.1 audio devices that stalled, and his +analysis of the code was that the old code would not update the xHCI +driver's ring dequeue pointer after the command completes. However, the +dequeue pointer is set in xhci_find_new_dequeue_state(), just before the +set command is issued to the hardware. + +Setting the dequeue pointer before the Set TR Dequeue Pointer command +completes is a dangerous thing to do, since the xHCI hardware can fail the +command. Instead, store the new dequeue pointer in the xhci_virt_ep +structure, and update the ring's dequeue pointer when the Set TR dequeue +pointer command completes. + +While we're at it, make sure we can't queue another Set TR Dequeue Command +while the first one is still being processed. This just won't work with +the internal xHCI state code. I'm still not sure if this is the right +thing to do, since we might have a case where a driver queues multiple +URBs to a control ring, one of the URBs Stalls, and then the driver tries +to cancel the second URB. There may be a race condition there where the +xHCI driver might try to issue multiple Set TR Dequeue Pointer commands, +but I would have to think very hard about how the Stop Endpoint and +cancellation code works. Keep the fix simple until when/if we run into +that case. + +This patch should be queued to kernels all the way back to 2.6.31. + +Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> +Tested-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/host/xhci-ring.c | 29 ++++++++++++++++++++++++++--- + drivers/usb/host/xhci.h | 9 +++++++++ + 2 files changed, 35 insertions(+), 3 deletions(-) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -506,9 +506,6 @@ void xhci_find_new_dequeue_state(struct + addr = xhci_trb_virt_to_dma(state->new_deq_seg, state->new_deq_ptr); + xhci_dbg(xhci, "New dequeue pointer = 0x%llx (DMA)\n", + (unsigned long long) addr); +- xhci_dbg(xhci, "Setting dequeue pointer in internal ring state.\n"); +- ep_ring->dequeue = state->new_deq_ptr; +- ep_ring->deq_seg = state->new_deq_seg; + } + + static void td_to_noop(struct xhci_hcd *xhci, struct xhci_ring *ep_ring, +@@ -951,9 +948,26 @@ static void handle_set_deq_completion(st + } else { + xhci_dbg(xhci, "Successful Set TR Deq Ptr cmd, deq = @%08llx\n", + ep_ctx->deq); ++ if (xhci_trb_virt_to_dma(dev->eps[ep_index].queued_deq_seg, ++ dev->eps[ep_index].queued_deq_ptr) == ++ (ep_ctx->deq & ~(EP_CTX_CYCLE_MASK))) { ++ /* Update the ring's dequeue segment and dequeue pointer ++ * to reflect the new position. ++ */ ++ ep_ring->deq_seg = dev->eps[ep_index].queued_deq_seg; ++ ep_ring->dequeue = dev->eps[ep_index].queued_deq_ptr; ++ } else { ++ xhci_warn(xhci, "Mismatch between completed Set TR Deq " ++ "Ptr command & xHCI internal state.\n"); ++ xhci_warn(xhci, "ep deq seg = %p, deq ptr = %p\n", ++ dev->eps[ep_index].queued_deq_seg, ++ dev->eps[ep_index].queued_deq_ptr); ++ } + } + + dev->eps[ep_index].ep_state &= ~SET_DEQ_PENDING; ++ dev->eps[ep_index].queued_deq_seg = NULL; ++ dev->eps[ep_index].queued_deq_ptr = NULL; + /* Restart any rings with pending URBs */ + ring_doorbell_for_active_rings(xhci, slot_id, ep_index); + } +@@ -3229,6 +3243,7 @@ static int queue_set_tr_deq(struct xhci_ + u32 trb_ep_index = EP_ID_FOR_TRB(ep_index); + u32 trb_stream_id = STREAM_ID_FOR_TRB(stream_id); + u32 type = TRB_TYPE(TRB_SET_DEQ); ++ struct xhci_virt_ep *ep; + + addr = xhci_trb_virt_to_dma(deq_seg, deq_ptr); + if (addr == 0) { +@@ -3237,6 +3252,14 @@ static int queue_set_tr_deq(struct xhci_ + deq_seg, deq_ptr); + return 0; + } ++ ep = &xhci->devs[slot_id]->eps[ep_index]; ++ if ((ep->ep_state & SET_DEQ_PENDING)) { ++ xhci_warn(xhci, "WARN Cannot submit Set TR Deq Ptr\n"); ++ xhci_warn(xhci, "A Set TR Deq Ptr command is pending.\n"); ++ return 0; ++ } ++ ep->queued_deq_seg = deq_seg; ++ ep->queued_deq_ptr = deq_ptr; + return queue_command(xhci, lower_32_bits(addr) | cycle_state, + upper_32_bits(addr), trb_stream_id, + trb_slot_id | trb_ep_index | type, false); +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -644,6 +644,9 @@ struct xhci_ep_ctx { + #define AVG_TRB_LENGTH_FOR_EP(p) ((p) & 0xffff) + #define MAX_ESIT_PAYLOAD_FOR_EP(p) (((p) & 0xffff) << 16) + ++/* deq bitmasks */ ++#define EP_CTX_CYCLE_MASK (1 << 0) ++ + + /** + * struct xhci_input_control_context +@@ -746,6 +749,12 @@ struct xhci_virt_ep { + struct timer_list stop_cmd_timer; + int stop_cmds_pending; + struct xhci_hcd *xhci; ++ /* Dequeue pointer and dequeue segment for a submitted Set TR Dequeue ++ * command. We'll need to update the ring's dequeue segment and dequeue ++ * pointer after the command completes. ++ */ ++ struct xhci_segment *queued_deq_seg; ++ union xhci_trb *queued_deq_ptr; + /* + * Sometimes the xHC can not process isochronous endpoint ring quickly + * enough, and it will miss some isoc tds on the ring and generate +From 01a1fdb9a7afa5e3c14c9316d6f380732750b4e4 Mon Sep 17 00:00:00 2001 +From: Sarah Sharp <sarah.a.sharp@linux.intel.com> +Date: Wed, 23 Feb 2011 18:12:29 -0800 +Subject: xhci: Fix cycle bit calculation during stall handling. + +From: Sarah Sharp <sarah.a.sharp@linux.intel.com> + +commit 01a1fdb9a7afa5e3c14c9316d6f380732750b4e4 upstream. + +When an endpoint stalls, we need to update the xHCI host's internal +dequeue pointer to move it past the stalled transfer. This includes +updating the cycle bit (TRB ownership bit) if we have moved the dequeue +pointer past a link TRB with the toggle cycle bit set. + +When we're trying to find the new dequeue segment, find_trb_seg() is +supposed to keep track of whether we've passed any link TRBs with the +toggle cycle bit set. However, this while loop's body + + while (cur_seg->trbs > trb || + &cur_seg->trbs[TRBS_PER_SEGMENT - 1] < trb) { + +Will never get executed if the ring only contains one segment. +find_trb_seg() will return immediately, without updating the new cycle +bit. Since find_trb_seg() has no idea where in the segment the TD that +stalled was, make the caller, xhci_find_new_dequeue_state(), check for +this special case and update the cycle bit accordingly. + +This patch should be queued to kernels all the way back to 2.6.31. + +Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> +Tested-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/host/xhci-ring.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -500,6 +500,20 @@ void xhci_find_new_dequeue_state(struct + state->new_cycle_state = ~(state->new_cycle_state) & 0x1; + next_trb(xhci, ep_ring, &state->new_deq_seg, &state->new_deq_ptr); + ++ /* ++ * If there is only one segment in a ring, find_trb_seg()'s while loop ++ * will not run, and it will return before it has a chance to see if it ++ * needs to toggle the cycle bit. It can't tell if the stalled transfer ++ * ended just before the link TRB on a one-segment ring, or if the TD ++ * wrapped around the top of the ring, because it doesn't have the TD in ++ * question. Look for the one-segment case where stalled TRB's address ++ * is greater than the new dequeue pointer address. ++ */ ++ if (ep_ring->first_seg == ep_ring->first_seg->next && ++ state->new_deq_ptr < dev->eps[ep_index].stopped_trb) ++ state->new_cycle_state ^= 0x1; ++ xhci_dbg(xhci, "Cycle state = 0x%x\n", state->new_cycle_state); ++ + /* Don't update the ring cycle state for the producer (us). */ + xhci_dbg(xhci, "New dequeue segment = %p (virtual)\n", + state->new_deq_seg); +From 500132a0f26ad7d9916102193cbc6c1b1becb373 Mon Sep 17 00:00:00 2001 +From: Paul Zimmerman <Paul.Zimmerman@synopsys.com> +Date: Mon, 28 Feb 2011 18:11:27 -0800 +Subject: USB: Add support for SuperSpeed isoc endpoints + +From: Paul Zimmerman <Paul.Zimmerman@synopsys.com> + +commit 500132a0f26ad7d9916102193cbc6c1b1becb373 upstream. + +Use the Mult and bMaxBurst values from the endpoint companion +descriptor to calculate the max length of an isoc transfer. + +Add USB_SS_MULT macro to access Mult field of bmAttributes, at +Sarah's suggestion. + +This patch should be queued for the 2.6.36 and 2.6.37 stable trees, since +those were the first kernels to have isochronous support for SuperSpeed +devices. + +Signed-off-by: Paul Zimmerman <paulz@synopsys.com> +Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/usb/core/urb.c | 11 ++++++++++- + include/linux/usb/ch9.h | 2 ++ + 2 files changed, 12 insertions(+), 1 deletion(-) + +--- a/drivers/usb/core/urb.c ++++ b/drivers/usb/core/urb.c +@@ -366,7 +366,16 @@ int usb_submit_urb(struct urb *urb, gfp_ + if (xfertype == USB_ENDPOINT_XFER_ISOC) { + int n, len; + +- /* FIXME SuperSpeed isoc endpoints have up to 16 bursts */ ++ /* SuperSpeed isoc endpoints have up to 16 bursts of up to ++ * 3 packets each ++ */ ++ if (dev->speed == USB_SPEED_SUPER) { ++ int burst = 1 + ep->ss_ep_comp.bMaxBurst; ++ int mult = USB_SS_MULT(ep->ss_ep_comp.bmAttributes); ++ max *= burst; ++ max *= mult; ++ } ++ + /* "high bandwidth" mode, 1-3 packets/uframe? */ + if (dev->speed == USB_SPEED_HIGH) { + int mult = 1 + ((max >> 11) & 0x03); +--- a/include/linux/usb/ch9.h ++++ b/include/linux/usb/ch9.h +@@ -585,6 +585,8 @@ struct usb_ss_ep_comp_descriptor { + #define USB_DT_SS_EP_COMP_SIZE 6 + /* Bits 4:0 of bmAttributes if this is a bulk endpoint */ + #define USB_SS_MAX_STREAMS(p) (1 << (p & 0x1f)) ++/* Bits 1:0 of bmAttributes if this is an isoc endpoint */ ++#define USB_SS_MULT(p) (1 + ((p) & 0x3)) + + /*-------------------------------------------------------------------------*/ + +From 32eea3884debb65ec1da633bc5df5aee23879865 Mon Sep 17 00:00:00 2001 +From: David Henningsson <david.henningsson@canonical.com> +Date: Fri, 4 Mar 2011 13:37:50 +0100 +Subject: ALSA: HDA: Enable surround and subwoofer on Lenovo Ideapad Y530 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: David Henningsson <david.henningsson@canonical.com> + +commit 32eea3884debb65ec1da633bc5df5aee23879865 upstream. + +The pin config values would change the association instead of the +sequence, this commit fixes that up. + +Tested-by: BartÅ‚omiej Å»ogaÅ‚a <nusch88@gmail.com> +Signed-off-by: David Henningsson <david.henningsson@canonical.com> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + sound/pci/hda/patch_realtek.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10748,6 +10748,7 @@ static struct alc_config_preset alc882_p + */ + enum { + PINFIX_ABIT_AW9D_MAX, ++ PINFIX_LENOVO_Y530, + PINFIX_PB_M5210, + PINFIX_ACER_ASPIRE_7736, + }; +@@ -10762,6 +10763,14 @@ static const struct alc_fixup alc882_fix + { } + } + }, ++ [PINFIX_LENOVO_Y530] = { ++ .type = ALC_FIXUP_PINS, ++ .v.pins = (const struct alc_pincfg[]) { ++ { 0x15, 0x99130112 }, /* rear int speakers */ ++ { 0x16, 0x99130111 }, /* subwoofer */ ++ { } ++ } ++ }, + [PINFIX_PB_M5210] = { + .type = ALC_FIXUP_VERBS, + .v.verbs = (const struct hda_verb[]) { +@@ -10777,6 +10786,7 @@ static const struct alc_fixup alc882_fix + + static struct snd_pci_quirk alc882_fixup_tbl[] = { + SND_PCI_QUIRK(0x1025, 0x0155, "Packard-Bell M5120", PINFIX_PB_M5210), ++ SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Y530", PINFIX_LENOVO_Y530), + SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", PINFIX_ABIT_AW9D_MAX), + SND_PCI_QUIRK(0x1025, 0x0296, "Acer Aspire 7736z", PINFIX_ACER_ASPIRE_7736), + {} +From ebbeb3d6aa22433c218da6f29fd7b3ebc89b87ea Mon Sep 17 00:00:00 2001 +From: David Henningsson <david.henningsson@canonical.com> +Date: Fri, 4 Mar 2011 14:08:30 +0100 +Subject: ALSA: HDA: Fix volume control naming for surround speakers on Realtek auto-parser +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: David Henningsson <david.henningsson@canonical.com> + +commit ebbeb3d6aa22433c218da6f29fd7b3ebc89b87ea upstream. + +When more than one pair of internal speakers is present, allow names +according to their channels. + +Tested-by: BartÅ‚omiej Å»ogaÅ‚a <nusch88@gmail.com> +Signed-off-by: David Henningsson <david.henningsson@canonical.com> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + sound/pci/hda/patch_realtek.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5151,7 +5151,9 @@ static const char *alc_get_line_out_pfx( + + switch (cfg->line_out_type) { + case AUTO_PIN_SPEAKER_OUT: +- return "Speaker"; ++ if (cfg->line_outs == 1) ++ return "Speaker"; ++ break; + case AUTO_PIN_HP_OUT: + return "Headphone"; + default: +From 7e59e097c09b82760bb0fe08b0fa2b704d76c3f4 Mon Sep 17 00:00:00 2001 +From: David Henningsson <david.henningsson@canonical.com> +Date: Fri, 4 Mar 2011 14:22:25 +0100 +Subject: ALSA: HDA: Fixup unnecessary volume control index on Realtek ALC88x +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: David Henningsson <david.henningsson@canonical.com> + +commit 7e59e097c09b82760bb0fe08b0fa2b704d76c3f4 upstream. + +Without this change, a volume control named "Surround" or "Side" would +get an unnecessary index, causing it to be ignored by the vmaster and +PulseAudio. + +Tested-by: BartÅ‚omiej Å»ogaÅ‚a <nusch88@gmail.com> +Signed-off-by: David Henningsson <david.henningsson@canonical.com> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + sound/pci/hda/patch_realtek.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5207,16 +5207,19 @@ static int alc880_auto_create_multi_out_ + return err; + } else { + const char *name = pfx; +- if (!name) ++ int index = i; ++ if (!name) { + name = chname[i]; ++ index = 0; ++ } + err = __add_pb_vol_ctrl(spec, ALC_CTL_WIDGET_VOL, +- name, i, ++ name, index, + HDA_COMPOSE_AMP_VAL(nid, 3, 0, + HDA_OUTPUT)); + if (err < 0) + return err; + err = __add_pb_sw_ctrl(spec, ALC_CTL_BIND_MUTE, +- name, i, ++ name, index, + HDA_COMPOSE_AMP_VAL(nid, 3, 2, + HDA_INPUT)); + if (err < 0) +From 0a3fabe30e1a3b2037a12b863b8c45fffce38ee9 Mon Sep 17 00:00:00 2001 +From: David Henningsson <david.henningsson@canonical.com> +Date: Fri, 4 Mar 2011 16:54:52 +0100 +Subject: ALSA: HDA: Realtek ALC88x: Do not over-initialize speakers and hp that are primary outputs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: David Henningsson <david.henningsson@canonical.com> + +commit 0a3fabe30e1a3b2037a12b863b8c45fffce38ee9 upstream. + +Do not initialize again the what has already been initialized as +multi outs, as this breaks surround speakers. + +Tested-by: BartÅ‚omiej Å»ogaÅ‚a <nusch88@gmail.com> +Signed-off-by: David Henningsson <david.henningsson@canonical.com> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + sound/pci/hda/patch_realtek.c | 37 +++++++++++++++++++++---------------- + 1 file changed, 21 insertions(+), 16 deletions(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -10844,23 +10844,28 @@ static void alc882_auto_init_hp_out(stru + hda_nid_t pin, dac; + int i; + +- for (i = 0; i < ARRAY_SIZE(spec->autocfg.hp_pins); i++) { +- pin = spec->autocfg.hp_pins[i]; +- if (!pin) +- break; +- dac = spec->multiout.hp_nid; +- if (!dac) +- dac = spec->multiout.dac_nids[0]; /* to front */ +- alc882_auto_set_output_and_unmute(codec, pin, PIN_HP, dac); ++ if (spec->autocfg.line_out_type != AUTO_PIN_HP_OUT) { ++ for (i = 0; i < ARRAY_SIZE(spec->autocfg.hp_pins); i++) { ++ pin = spec->autocfg.hp_pins[i]; ++ if (!pin) ++ break; ++ dac = spec->multiout.hp_nid; ++ if (!dac) ++ dac = spec->multiout.dac_nids[0]; /* to front */ ++ alc882_auto_set_output_and_unmute(codec, pin, PIN_HP, dac); ++ } + } +- for (i = 0; i < ARRAY_SIZE(spec->autocfg.speaker_pins); i++) { +- pin = spec->autocfg.speaker_pins[i]; +- if (!pin) +- break; +- dac = spec->multiout.extra_out_nid[0]; +- if (!dac) +- dac = spec->multiout.dac_nids[0]; /* to front */ +- alc882_auto_set_output_and_unmute(codec, pin, PIN_OUT, dac); ++ ++ if (spec->autocfg.line_out_type != AUTO_PIN_SPEAKER_OUT) { ++ for (i = 0; i < ARRAY_SIZE(spec->autocfg.speaker_pins); i++) { ++ pin = spec->autocfg.speaker_pins[i]; ++ if (!pin) ++ break; ++ dac = spec->multiout.extra_out_nid[0]; ++ if (!dac) ++ dac = spec->multiout.dac_nids[0]; /* to front */ ++ alc882_auto_set_output_and_unmute(codec, pin, PIN_OUT, dac); ++ } + } + } + +From 094a42452abd5564429045e210281c6d22e67fca Mon Sep 17 00:00:00 2001 +From: Vitaliy Kulikov <Vitaliy.Kulikov@idt.com> +Date: Wed, 9 Mar 2011 19:47:43 -0600 +Subject: ALSA: hda - fix digital mic selection in mixer on 92HD8X codecs + +From: Vitaliy Kulikov <Vitaliy.Kulikov@idt.com> + +commit 094a42452abd5564429045e210281c6d22e67fca upstream. + +When the mux for digital mic is different from the mux for other mics, +the current auto-parser doesn't handle them in a right way but provides +only one mic. This patch fixes the issue. + +Signed-off-by: Vitaliy Kulikov <Vitaliy.Kulikov@idt.com> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + sound/pci/hda/patch_sigmatel.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/sound/pci/hda/patch_sigmatel.c ++++ b/sound/pci/hda/patch_sigmatel.c +@@ -757,7 +757,7 @@ static int stac92xx_mux_enum_put(struct + struct sigmatel_spec *spec = codec->spec; + unsigned int adc_idx = snd_ctl_get_ioffidx(kcontrol, &ucontrol->id); + const struct hda_input_mux *imux = spec->input_mux; +- unsigned int idx, prev_idx; ++ unsigned int idx, prev_idx, didx; + + idx = ucontrol->value.enumerated.item[0]; + if (idx >= imux->num_items) +@@ -769,7 +769,8 @@ static int stac92xx_mux_enum_put(struct + snd_hda_codec_write_cache(codec, spec->mux_nids[adc_idx], 0, + AC_VERB_SET_CONNECT_SEL, + imux->items[idx].index); +- if (prev_idx >= spec->num_analog_muxes) { ++ if (prev_idx >= spec->num_analog_muxes && ++ spec->mux_nids[adc_idx] != spec->dmux_nids[adc_idx]) { + imux = spec->dinput_mux; + /* 0 = analog */ + snd_hda_codec_write_cache(codec, +@@ -779,9 +780,13 @@ static int stac92xx_mux_enum_put(struct + } + } else { + imux = spec->dinput_mux; ++ /* first dimux item is hardcoded to select analog imux, ++ * so lets skip it ++ */ ++ didx = idx - spec->num_analog_muxes + 1; + snd_hda_codec_write_cache(codec, spec->dmux_nids[adc_idx], 0, + AC_VERB_SET_CONNECT_SEL, +- imux->items[idx - 1].index); ++ imux->items[didx].index); + } + spec->cur_mux[adc_idx] = idx; + return 1; +From 584c0c4c359bdac37d94157f8d7fc513d26c8328 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai <tiwai@suse.de> +Date: Thu, 10 Mar 2011 12:51:11 +0100 +Subject: ALSA: hda - Initialize special cases for input src in init phase + +From: Takashi Iwai <tiwai@suse.de> + +commit 584c0c4c359bdac37d94157f8d7fc513d26c8328 upstream. + +Currently some special handling for the unusual case like dual-ADCs +or a single-input-src is done in the tree-parse time in +set_capture_mixer(). But this setup could be overwritten by static +init verbs. + +This patch moves the initialization into the init phase so that +such input-src setup won't be lost. + +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + sound/pci/hda/patch_realtek.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -394,6 +394,7 @@ struct alc_spec { + /* other flags */ + unsigned int no_analog :1; /* digital I/O only */ + unsigned int dual_adc_switch:1; /* switch ADCs (for ALC275) */ ++ unsigned int single_input_src:1; + int init_amp; + int codec_variant; /* flag for other variants */ + +@@ -3919,6 +3920,8 @@ static struct hda_amp_list alc880_lg_loo + * Common callbacks + */ + ++static void alc_init_special_input_src(struct hda_codec *codec); ++ + static int alc_init(struct hda_codec *codec) + { + struct alc_spec *spec = codec->spec; +@@ -3929,6 +3932,7 @@ static int alc_init(struct hda_codec *co + + for (i = 0; i < spec->num_init_verbs; i++) + snd_hda_sequence_write(codec, spec->init_verbs[i]); ++ alc_init_special_input_src(codec); + + if (spec->init_hook) + spec->init_hook(codec); +@@ -5590,6 +5594,7 @@ static void fixup_single_adc(struct hda_ + spec->capsrc_nids += i; + spec->adc_nids += i; + spec->num_adc_nids = 1; ++ spec->single_input_src = 1; + } + } + +@@ -5601,6 +5606,16 @@ static void fixup_dual_adc_switch(struct + init_capsrc_for_pin(codec, spec->int_mic.pin); + } + ++/* initialize some special cases for input sources */ ++static void alc_init_special_input_src(struct hda_codec *codec) ++{ ++ struct alc_spec *spec = codec->spec; ++ if (spec->dual_adc_switch) ++ fixup_dual_adc_switch(codec); ++ else if (spec->single_input_src) ++ init_capsrc_for_pin(codec, spec->autocfg.inputs[0].pin); ++} ++ + static void set_capture_mixer(struct hda_codec *codec) + { + struct alc_spec *spec = codec->spec; +@@ -5616,7 +5631,7 @@ static void set_capture_mixer(struct hda + int mux = 0; + int num_adcs = spec->num_adc_nids; + if (spec->dual_adc_switch) +- fixup_dual_adc_switch(codec); ++ num_adcs = 1; + else if (spec->auto_mic) + fixup_automic_adc(codec); + else if (spec->input_mux) { +@@ -5625,8 +5640,6 @@ static void set_capture_mixer(struct hda + else if (spec->input_mux->num_items == 1) + fixup_single_adc(codec); + } +- if (spec->dual_adc_switch) +- num_adcs = 1; + spec->cap_mixer = caps[mux][num_adcs - 1]; + } + } +From 2d9ca4e9f393d81d8f37ed37505aecbf3a5e1bd6 Mon Sep 17 00:00:00 2001 +From: Henrik Rydberg <rydberg@euromail.se> +Date: Wed, 9 Mar 2011 18:38:57 +0100 +Subject: HID: hid-magicmouse: Correct touch orientation direction + +From: Henrik Rydberg <rydberg@euromail.se> + +commit 2d9ca4e9f393d81d8f37ed37505aecbf3a5e1bd6 upstream. + +The magic trackpad and mouse both report touch orientation in opposite +direction to the bcm5974 driver and what is written in +Documents/input/multi-touch-protocol.txt. This patch reverts the +direction, so that all in-kernel devices with this feature behave the +same way. + +Since no known application has been utilizing this information yet, it +seems appropriate also for stable. + +Cc: Michael Poole <mdpoole@troilus.org> +Signed-off-by: Henrik Rydberg <rydberg@euromail.se> +Acked-by: Chase Douglas <chase.douglas@canonical.com> +Signed-off-by: Jiri Kosina <jkosina@suse.cz> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/hid/hid-magicmouse.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/hid/hid-magicmouse.c ++++ b/drivers/hid/hid-magicmouse.c +@@ -258,7 +258,7 @@ static void magicmouse_emit_touch(struct + input_report_abs(input, ABS_MT_TRACKING_ID, id); + input_report_abs(input, ABS_MT_TOUCH_MAJOR, touch_major << 2); + input_report_abs(input, ABS_MT_TOUCH_MINOR, touch_minor << 2); +- input_report_abs(input, ABS_MT_ORIENTATION, orientation); ++ input_report_abs(input, ABS_MT_ORIENTATION, -orientation); + input_report_abs(input, ABS_MT_POSITION_X, x); + input_report_abs(input, ABS_MT_POSITION_Y, y); + +@@ -397,7 +397,7 @@ static void magicmouse_setup_input(struc + input_set_abs_params(input, ABS_MT_TRACKING_ID, 0, 15, 0, 0); + input_set_abs_params(input, ABS_MT_TOUCH_MAJOR, 0, 255, 4, 0); + input_set_abs_params(input, ABS_MT_TOUCH_MINOR, 0, 255, 4, 0); +- input_set_abs_params(input, ABS_MT_ORIENTATION, -32, 31, 1, 0); ++ input_set_abs_params(input, ABS_MT_ORIENTATION, -31, 32, 1, 0); + + /* Note: Touch Y position from the device is inverted relative + * to how pointer motion is reported (and relative to how USB +From 270fdc0748bd3f7b625caff985f2fcf8e2185ec7 Mon Sep 17 00:00:00 2001 +From: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com> +Date: Wed, 16 Mar 2011 14:13:53 -0300 +Subject: HID: add support for Ortek PKB-1700 + +From: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com> + +commit 270fdc0748bd3f7b625caff985f2fcf8e2185ec7 upstream. + +As reported on http://ubuntuforums.org/showthread.php?t=1594007 the +PKB-1700 needs same special handling as WKB-2000. This change is +originally based on patch posted by user asmoore82 on the Ubuntu +forums. + +Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com> +Signed-off-by: Jiri Kosina <jkosina@suse.cz> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/hid/Kconfig | 4 ++-- + drivers/hid/hid-core.c | 1 + + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-ortek.c | 3 ++- + 4 files changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/hid/Kconfig ++++ b/drivers/hid/Kconfig +@@ -319,10 +319,10 @@ config HID_NTRIG + Support for N-Trig touch screen. + + config HID_ORTEK +- tristate "Ortek WKB-2000 wireless keyboard and mouse trackpad" ++ tristate "Ortek PKB-1700/WKB-2000 wireless keyboard and mouse trackpad" + depends on USB_HID + ---help--- +- Support for Ortek WKB-2000 wireless keyboard + mouse trackpad. ++ Support for Ortek PKB-1700/WKB-2000 wireless keyboard + mouse trackpad. + + config HID_PANTHERLORD + tristate "Pantherlord/GreenAsia game controller" +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1400,6 +1400,7 @@ static const struct hid_device_id hid_ha + { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_16) }, + { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_17) }, + { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_18) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_PKB1700) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_WKB2000) }, + { HID_USB_DEVICE(USB_VENDOR_ID_PETALYNX, USB_DEVICE_ID_PETALYNX_MAXTER_REMOTE) }, + { HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH) }, +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -466,6 +466,7 @@ + #define USB_DEVICE_ID_ONTRAK_ADU100 0x0064 + + #define USB_VENDOR_ID_ORTEK 0x05a4 ++#define USB_DEVICE_ID_ORTEK_PKB1700 0x1700 + #define USB_DEVICE_ID_ORTEK_WKB2000 0x2000 + + #define USB_VENDOR_ID_PANJIT 0x134c +--- a/drivers/hid/hid-ortek.c ++++ b/drivers/hid/hid-ortek.c +@@ -1,5 +1,5 @@ + /* +- * HID driver for Ortek WKB-2000 (wireless keyboard + mouse trackpad). ++ * HID driver for Ortek PKB-1700/WKB-2000 (wireless keyboard + mouse trackpad). + * Fixes LogicalMaximum error in USB report description, see + * http://bugzilla.kernel.org/show_bug.cgi?id=14787 + * +@@ -30,6 +30,7 @@ static __u8 *ortek_report_fixup(struct h + } + + static const struct hid_device_id ortek_devices[] = { ++ { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_PKB1700) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ORTEK, USB_DEVICE_ID_ORTEK_WKB2000) }, + { } + }; +From b99af4b002e4908d1a5cdaf424529bdf1dc69768 Mon Sep 17 00:00:00 2001 +From: Brandeburg, Jesse <jesse.brandeburg@intel.com> +Date: Mon, 14 Feb 2011 09:05:02 -0800 +Subject: PCI: remove quirk for pre-production systems + +From: Brandeburg, Jesse <jesse.brandeburg@intel.com> + +commit b99af4b002e4908d1a5cdaf424529bdf1dc69768 upstream. + +Revert commit 7eb93b175d4de9438a4b0af3a94a112cb5266944 +Author: Yu Zhao <yu.zhao@intel.com> +Date: Fri Apr 3 15:18:11 2009 +0800 + + PCI: SR-IOV quirk for Intel 82576 NIC + + If BIOS doesn't allocate resources for the SR-IOV BARs, zero the Flash + BAR and program the SR-IOV BARs to use the old Flash Memory Space. + + Please refer to Intel 82576 Gigabit Ethernet Controller Datasheet + section 7.9.2.14.2 for details. + http://download.intel.com/design/network/datashts/82576_Datasheet.pdf + + Signed-off-by: Yu Zhao <yu.zhao@intel.com> + Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> + +This quirk was added before SR-IOV was in production and now all machines that +originally had this issue alreayd have bios updates to correct the issue. The +quirk itself is no longer needed and in fact causes bugs if run. Remove it. + +Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> +CC: Yu Zhao <yu.zhao@intel.com> +CC: Jesse Barnes <jbarnes@virtuousgeek.org> +Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/pci/quirks.c | 52 --------------------------------------------------- + 1 file changed, 52 deletions(-) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -2618,58 +2618,6 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AT + + #endif /* CONFIG_PCI_MSI */ + +-#ifdef CONFIG_PCI_IOV +- +-/* +- * For Intel 82576 SR-IOV NIC, if BIOS doesn't allocate resources for the +- * SR-IOV BARs, zero the Flash BAR and program the SR-IOV BARs to use the +- * old Flash Memory Space. +- */ +-static void __devinit quirk_i82576_sriov(struct pci_dev *dev) +-{ +- int pos, flags; +- u32 bar, start, size; +- +- if (PAGE_SIZE > 0x10000) +- return; +- +- flags = pci_resource_flags(dev, 0); +- if ((flags & PCI_BASE_ADDRESS_SPACE) != +- PCI_BASE_ADDRESS_SPACE_MEMORY || +- (flags & PCI_BASE_ADDRESS_MEM_TYPE_MASK) != +- PCI_BASE_ADDRESS_MEM_TYPE_32) +- return; +- +- pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_SRIOV); +- if (!pos) +- return; +- +- pci_read_config_dword(dev, pos + PCI_SRIOV_BAR, &bar); +- if (bar & PCI_BASE_ADDRESS_MEM_MASK) +- return; +- +- start = pci_resource_start(dev, 1); +- size = pci_resource_len(dev, 1); +- if (!start || size != 0x400000 || start & (size - 1)) +- return; +- +- pci_resource_flags(dev, 1) = 0; +- pci_write_config_dword(dev, PCI_BASE_ADDRESS_1, 0); +- pci_write_config_dword(dev, pos + PCI_SRIOV_BAR, start); +- pci_write_config_dword(dev, pos + PCI_SRIOV_BAR + 12, start + size / 2); +- +- dev_info(&dev->dev, "use Flash Memory Space for SR-IOV BARs\n"); +-} +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x10c9, quirk_i82576_sriov); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x10e6, quirk_i82576_sriov); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x10e7, quirk_i82576_sriov); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x10e8, quirk_i82576_sriov); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x150a, quirk_i82576_sriov); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x150d, quirk_i82576_sriov); +-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1518, quirk_i82576_sriov); +- +-#endif /* CONFIG_PCI_IOV */ +- + /* Allow manual resource allocation for PCI hotplug bridges + * via pci=hpmemsize=nnM and pci=hpiosize=nnM parameters. For + * some PCI-PCI hotplug bridges, like PLX 6254 (former HINT HB6), +From cdb9755849fbaf2bb9c0a009ba5baa817a0f152d Mon Sep 17 00:00:00 2001 +From: Jiri Slaby <jslaby@suse.cz> +Date: Mon, 28 Feb 2011 10:45:09 +0100 +Subject: PCI: add more checking to ICH region quirks + +From: Jiri Slaby <jslaby@suse.cz> + +commit cdb9755849fbaf2bb9c0a009ba5baa817a0f152d upstream. + +Per ICH4 and ICH6 specs, ACPI and GPIO regions are valid iff ACPI_EN +and GPIO_EN bits are set to 1. Add checks for these bits into the +quirks prior to the region creation. + +While at it, name the constants by macros. + +Signed-off-by: Jiri Slaby <jslaby@suse.cz> +Cc: Bjorn Helgaas <bjorn.helgaas@hp.com> +Cc: "David S. Miller" <davem@davemloft.net> +Cc: Thomas Renninger <trenn@suse.de> +Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/pci/quirks.c | 49 +++++++++++++++++++++++++++++++++++++++---------- + 1 file changed, 39 insertions(+), 10 deletions(-) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -533,6 +533,17 @@ static void __devinit quirk_piix4_acpi(s + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82371AB_3, quirk_piix4_acpi); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443MX_3, quirk_piix4_acpi); + ++#define ICH_PMBASE 0x40 ++#define ICH_ACPI_CNTL 0x44 ++#define ICH4_ACPI_EN 0x10 ++#define ICH6_ACPI_EN 0x80 ++#define ICH4_GPIOBASE 0x58 ++#define ICH4_GPIO_CNTL 0x5c ++#define ICH4_GPIO_EN 0x10 ++#define ICH6_GPIOBASE 0x48 ++#define ICH6_GPIO_CNTL 0x4c ++#define ICH6_GPIO_EN 0x10 ++ + /* + * ICH4, ICH4-M, ICH5, ICH5-M ACPI: Three IO regions pointed to by longwords at + * 0x40 (128 bytes of ACPI, GPIO & TCO registers) +@@ -541,12 +552,21 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_I + static void __devinit quirk_ich4_lpc_acpi(struct pci_dev *dev) + { + u32 region; ++ u8 enable; + +- pci_read_config_dword(dev, 0x40, ®ion); +- quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES, "ICH4 ACPI/GPIO/TCO"); +- +- pci_read_config_dword(dev, 0x58, ®ion); +- quirk_io_region(dev, region, 64, PCI_BRIDGE_RESOURCES+1, "ICH4 GPIO"); ++ pci_read_config_byte(dev, ICH_ACPI_CNTL, &enable); ++ if (enable & ICH4_ACPI_EN) { ++ pci_read_config_dword(dev, ICH_PMBASE, ®ion); ++ quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES, ++ "ICH4 ACPI/GPIO/TCO"); ++ } ++ ++ pci_read_config_byte(dev, ICH4_GPIO_CNTL, &enable); ++ if (enable & ICH4_GPIO_EN) { ++ pci_read_config_dword(dev, ICH4_GPIOBASE, ®ion); ++ quirk_io_region(dev, region, 64, PCI_BRIDGE_RESOURCES + 1, ++ "ICH4 GPIO"); ++ } + } + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801AA_0, quirk_ich4_lpc_acpi); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801AB_0, quirk_ich4_lpc_acpi); +@@ -562,12 +582,21 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_I + static void __devinit ich6_lpc_acpi_gpio(struct pci_dev *dev) + { + u32 region; ++ u8 enable; + +- pci_read_config_dword(dev, 0x40, ®ion); +- quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES, "ICH6 ACPI/GPIO/TCO"); +- +- pci_read_config_dword(dev, 0x48, ®ion); +- quirk_io_region(dev, region, 64, PCI_BRIDGE_RESOURCES+1, "ICH6 GPIO"); ++ pci_read_config_byte(dev, ICH_ACPI_CNTL, &enable); ++ if (enable & ICH6_ACPI_EN) { ++ pci_read_config_dword(dev, ICH_PMBASE, ®ion); ++ quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES, ++ "ICH6 ACPI/GPIO/TCO"); ++ } ++ ++ pci_read_config_byte(dev, ICH6_GPIO_CNTL, &enable); ++ if (enable & ICH4_GPIO_EN) { ++ pci_read_config_dword(dev, ICH6_GPIOBASE, ®ion); ++ quirk_io_region(dev, region, 64, PCI_BRIDGE_RESOURCES + 1, ++ "ICH6 GPIO"); ++ } + } + + static void __devinit ich6_lpc_generic_decode(struct pci_dev *dev, unsigned reg, const char *name, int dynsize) +From 87e3dc3855430bd254370afc79f2ed92250f5b7c Mon Sep 17 00:00:00 2001 +From: Jiri Slaby <jslaby@suse.cz> +Date: Mon, 28 Feb 2011 10:45:10 +0100 +Subject: PCI: do not create quirk I/O regions below PCIBIOS_MIN_IO for ICH + +From: Jiri Slaby <jslaby@suse.cz> + +commit 87e3dc3855430bd254370afc79f2ed92250f5b7c upstream. + +Some broken BIOSes on ICH4 chipset report an ACPI region which is in +conflict with legacy IDE ports when ACPI is disabled. Even though the +regions overlap, IDE ports are working correctly (we cannot find out +the decoding rules on chipsets). + +So the only problem is the reported region itself, if we don't reserve +the region in the quirk everything works as expected. + +This patch avoids reserving any quirk regions below PCIBIOS_MIN_IO +which is 0x1000. Some regions might be (and are by a fast google +query) below this border, but the only difference is that they won't +be reserved anymore. They should still work though the same as before. + +The conflicts look like (1f.0 is bridge, 1f.1 is IDE ctrl): +pci 0000:00:1f.1: address space collision: [io 0x0170-0x0177] conflicts with 0000:00:1f.0 [io 0x0100-0x017f] + +At 0x0100 a 128 bytes long ACPI region is reported in the quirk for +ICH4. ata_piix then fails to find disks because the IDE legacy ports +are zeroed: +ata_piix 0000:00:1f.1: device not available (can't reserve [io 0x0000-0x0007]) + +References: https://bugzilla.novell.com/show_bug.cgi?id=558740 +Signed-off-by: Jiri Slaby <jslaby@suse.cz> +Cc: Bjorn Helgaas <bjorn.helgaas@hp.com> +Cc: "David S. Miller" <davem@davemloft.net> +Cc: Thomas Renninger <trenn@suse.de> +Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/pci/quirks.c | 32 ++++++++++++++++++++++++-------- + 1 file changed, 24 insertions(+), 8 deletions(-) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -554,18 +554,30 @@ static void __devinit quirk_ich4_lpc_acp + u32 region; + u8 enable; + ++ /* ++ * The check for PCIBIOS_MIN_IO is to ensure we won't create a conflict ++ * with low legacy (and fixed) ports. We don't know the decoding ++ * priority and can't tell whether the legacy device or the one created ++ * here is really at that address. This happens on boards with broken ++ * BIOSes. ++ */ ++ + pci_read_config_byte(dev, ICH_ACPI_CNTL, &enable); + if (enable & ICH4_ACPI_EN) { + pci_read_config_dword(dev, ICH_PMBASE, ®ion); +- quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES, +- "ICH4 ACPI/GPIO/TCO"); ++ region &= PCI_BASE_ADDRESS_IO_MASK; ++ if (region >= PCIBIOS_MIN_IO) ++ quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES, ++ "ICH4 ACPI/GPIO/TCO"); + } + + pci_read_config_byte(dev, ICH4_GPIO_CNTL, &enable); + if (enable & ICH4_GPIO_EN) { + pci_read_config_dword(dev, ICH4_GPIOBASE, ®ion); +- quirk_io_region(dev, region, 64, PCI_BRIDGE_RESOURCES + 1, +- "ICH4 GPIO"); ++ region &= PCI_BASE_ADDRESS_IO_MASK; ++ if (region >= PCIBIOS_MIN_IO) ++ quirk_io_region(dev, region, 64, ++ PCI_BRIDGE_RESOURCES + 1, "ICH4 GPIO"); + } + } + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801AA_0, quirk_ich4_lpc_acpi); +@@ -587,15 +599,19 @@ static void __devinit ich6_lpc_acpi_gpio + pci_read_config_byte(dev, ICH_ACPI_CNTL, &enable); + if (enable & ICH6_ACPI_EN) { + pci_read_config_dword(dev, ICH_PMBASE, ®ion); +- quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES, +- "ICH6 ACPI/GPIO/TCO"); ++ region &= PCI_BASE_ADDRESS_IO_MASK; ++ if (region >= PCIBIOS_MIN_IO) ++ quirk_io_region(dev, region, 128, PCI_BRIDGE_RESOURCES, ++ "ICH6 ACPI/GPIO/TCO"); + } + + pci_read_config_byte(dev, ICH6_GPIO_CNTL, &enable); + if (enable & ICH4_GPIO_EN) { + pci_read_config_dword(dev, ICH6_GPIOBASE, ®ion); +- quirk_io_region(dev, region, 64, PCI_BRIDGE_RESOURCES + 1, +- "ICH6 GPIO"); ++ region &= PCI_BASE_ADDRESS_IO_MASK; ++ if (region >= PCIBIOS_MIN_IO) ++ quirk_io_region(dev, region, 64, ++ PCI_BRIDGE_RESOURCES + 1, "ICH6 GPIO"); + } + } + +From 0f12a4e29368a9476076515881d9ef4e5876c6e2 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings <bhutchings@solarflare.com> +Date: Thu, 13 Jan 2011 19:47:56 +0000 +Subject: PCI: sysfs: Fix failure path for addition of "vpd" attribute + +From: Ben Hutchings <bhutchings@solarflare.com> + +commit 0f12a4e29368a9476076515881d9ef4e5876c6e2 upstream. + +Commit 280c73d ("PCI: centralize the capabilities code in +pci-sysfs.c") changed the initialisation of the "rom" and "vpd" +attributes, and made the failure path for the "vpd" attribute +incorrect. We must free the new attribute structure (attr), but +instead we currently free dev->vpd->attr. That will normally be NULL, +resulting in a memory leak, but it might be a stale pointer, resulting +in a double-free. + +Found by inspection; compile-tested only. + +Signed-off-by: Ben Hutchings <bhutchings@solarflare.com> +Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/pci/pci-sysfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pci/pci-sysfs.c ++++ b/drivers/pci/pci-sysfs.c +@@ -1088,7 +1088,7 @@ static int pci_create_capabilities_sysfs + attr->write = write_vpd_attr; + retval = sysfs_create_bin_file(&dev->dev.kobj, attr); + if (retval) { +- kfree(dev->vpd->attr); ++ kfree(attr); + return retval; + } + dev->vpd->attr = attr; +From 4a122c10fbfe9020df469f0f669da129c5757671 Mon Sep 17 00:00:00 2001 +From: Dan Rosenberg <drosenberg@vsecurity.com> +Date: Thu, 17 Mar 2011 18:32:24 -0400 +Subject: ALSA: sound/pci/asihpi: check adapter index in hpi_ioctl + +From: Dan Rosenberg <drosenberg@vsecurity.com> + +commit 4a122c10fbfe9020df469f0f669da129c5757671 upstream. + +The user-supplied index into the adapters array needs to be checked, or +an out-of-bounds kernel pointer could be accessed and used, leading to +potentially exploitable memory corruption. + +Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + sound/pci/asihpi/hpioctl.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/sound/pci/asihpi/hpioctl.c ++++ b/sound/pci/asihpi/hpioctl.c +@@ -155,6 +155,11 @@ long asihpi_hpi_ioctl(struct file *file, + goto out; + } + ++ if (hm->h.adapter_index >= HPI_MAX_ADAPTERS) { ++ err = -EINVAL; ++ goto out; ++ } ++ + pa = &adapters[hm->h.adapter_index]; + hr->h.size = 0; + if (hm->h.object == HPI_OBJ_SUBSYSTEM) { +From 98d21df431ad55281e1abf780f8d51e3391900b2 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai <tiwai@suse.de> +Date: Fri, 18 Mar 2011 07:31:53 +0100 +Subject: ALSA: aloop - Fix possible IRQ lock inversion + +From: Takashi Iwai <tiwai@suse.de> + +commit 98d21df431ad55281e1abf780f8d51e3391900b2 upstream. + +loopback_pos_update() can be called in the timer callback, thus the lock +held should be irq-safe. Otherwise you'll get AB/BA deadlock together +with substream->self_group.lock. + +Reported-and-tested-by: Knut Petersen <Knut_Petersen@t-online.de> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + sound/drivers/aloop.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +--- a/sound/drivers/aloop.c ++++ b/sound/drivers/aloop.c +@@ -482,8 +482,9 @@ static unsigned int loopback_pos_update( + cable->streams[SNDRV_PCM_STREAM_CAPTURE]; + unsigned long delta_play = 0, delta_capt = 0; + unsigned int running; ++ unsigned long flags; + +- spin_lock(&cable->lock); ++ spin_lock_irqsave(&cable->lock, flags); + running = cable->running ^ cable->pause; + if (running & (1 << SNDRV_PCM_STREAM_PLAYBACK)) { + delta_play = jiffies - dpcm_play->last_jiffies; +@@ -495,10 +496,8 @@ static unsigned int loopback_pos_update( + dpcm_capt->last_jiffies += delta_capt; + } + +- if (delta_play == 0 && delta_capt == 0) { +- spin_unlock(&cable->lock); +- return running; +- } ++ if (delta_play == 0 && delta_capt == 0) ++ goto unlock; + + if (delta_play > delta_capt) { + loopback_bytepos_update(dpcm_play, delta_play - delta_capt, +@@ -510,14 +509,14 @@ static unsigned int loopback_pos_update( + delta_capt = delta_play; + } + +- if (delta_play == 0 && delta_capt == 0) { +- spin_unlock(&cable->lock); +- return running; +- } ++ if (delta_play == 0 && delta_capt == 0) ++ goto unlock; ++ + /* note delta_capt == delta_play at this moment */ + loopback_bytepos_update(dpcm_capt, delta_capt, BYTEPOS_UPDATE_COPY); + loopback_bytepos_update(dpcm_play, delta_play, BYTEPOS_UPDATE_POSONLY); +- spin_unlock(&cable->lock); ++ unlock: ++ spin_unlock_irqrestore(&cable->lock, flags); + return running; + } + +From 4c1847e884efddcc3ede371f7839e5e65b25c34d Mon Sep 17 00:00:00 2001 +From: Przemyslaw Bruski <pbruskispam@op.pl> +Date: Sun, 13 Mar 2011 16:18:56 +0100 +Subject: ALSA: ctxfi - Fix incorrect SPDIF status bit mask + +From: Przemyslaw Bruski <pbruskispam@op.pl> + +commit 4c1847e884efddcc3ede371f7839e5e65b25c34d upstream. + +SPDIF status mask creation was incorrect. + +Signed-off-by: Przemyslaw Bruski <pbruskispam@op.pl> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + sound/pci/ctxfi/ctatc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/pci/ctxfi/ctatc.c ++++ b/sound/pci/ctxfi/ctatc.c +@@ -869,7 +869,7 @@ spdif_passthru_playback_setup(struct ct_ + mutex_lock(&atc->atc_mutex); + dao->ops->get_spos(dao, &status); + if (((status >> 24) & IEC958_AES3_CON_FS) != iec958_con_fs) { +- status &= ((~IEC958_AES3_CON_FS) << 24); ++ status &= ~(IEC958_AES3_CON_FS << 24); + status |= (iec958_con_fs << 24); + dao->ops->set_spos(dao, status); + dao->ops->commit_write(dao); +From f164753a263bfd2daaf3e0273b179de7e099c57d Mon Sep 17 00:00:00 2001 +From: Przemyslaw Bruski <pbruskispam@op.pl> +Date: Sun, 13 Mar 2011 16:18:57 +0100 +Subject: ALSA: ctxfi - Fix SPDIF status retrieval + +From: Przemyslaw Bruski <pbruskispam@op.pl> + +commit f164753a263bfd2daaf3e0273b179de7e099c57d upstream. + +SDPIF status retrieval always returned the default settings instead of +the actual ones. + +Signed-off-by: Przemyslaw Bruski <pbruskispam@op.pl> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + sound/pci/ctxfi/ctmixer.c | 19 +++++-------------- + 1 file changed, 5 insertions(+), 14 deletions(-) + +--- a/sound/pci/ctxfi/ctmixer.c ++++ b/sound/pci/ctxfi/ctmixer.c +@@ -566,19 +566,6 @@ static int ct_spdif_get_mask(struct snd_ + return 0; + } + +-static int ct_spdif_default_get(struct snd_kcontrol *kcontrol, +- struct snd_ctl_elem_value *ucontrol) +-{ +- unsigned int status = SNDRV_PCM_DEFAULT_CON_SPDIF; +- +- ucontrol->value.iec958.status[0] = (status >> 0) & 0xff; +- ucontrol->value.iec958.status[1] = (status >> 8) & 0xff; +- ucontrol->value.iec958.status[2] = (status >> 16) & 0xff; +- ucontrol->value.iec958.status[3] = (status >> 24) & 0xff; +- +- return 0; +-} +- + static int ct_spdif_get(struct snd_kcontrol *kcontrol, + struct snd_ctl_elem_value *ucontrol) + { +@@ -586,6 +573,10 @@ static int ct_spdif_get(struct snd_kcont + unsigned int status; + + atc->spdif_out_get_status(atc, &status); ++ ++ if (status == 0) ++ status = SNDRV_PCM_DEFAULT_CON_SPDIF; ++ + ucontrol->value.iec958.status[0] = (status >> 0) & 0xff; + ucontrol->value.iec958.status[1] = (status >> 8) & 0xff; + ucontrol->value.iec958.status[2] = (status >> 16) & 0xff; +@@ -629,7 +620,7 @@ static struct snd_kcontrol_new iec958_de + .name = SNDRV_CTL_NAME_IEC958("", PLAYBACK, DEFAULT), + .count = 1, + .info = ct_spdif_info, +- .get = ct_spdif_default_get, ++ .get = ct_spdif_get, + .put = ct_spdif_put, + .private_value = MIXER_IEC958_DEFAULT + }; +From efed5f26664f93991c929d5bb343e65f900d72bc Mon Sep 17 00:00:00 2001 +From: Przemyslaw Bruski <pbruskispam@op.pl> +Date: Sun, 13 Mar 2011 16:18:58 +0100 +Subject: ALSA: ctxfi - Clear input settings before initialization + +From: Przemyslaw Bruski <pbruskispam@op.pl> + +commit efed5f26664f93991c929d5bb343e65f900d72bc upstream. + +Clear input settings before initialization. + +Signed-off-by: Przemyslaw Bruski <pbruskispam@op.pl> +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + sound/pci/ctxfi/ctdaio.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/ctxfi/ctdaio.c ++++ b/sound/pci/ctxfi/ctdaio.c +@@ -176,6 +176,7 @@ static int dao_set_left_input(struct dao + if (!entry) + return -ENOMEM; + ++ dao->ops->clear_left_input(dao); + /* Program master and conjugate resources */ + input->ops->master(input); + daio->rscl.ops->master(&daio->rscl); +@@ -204,6 +205,7 @@ static int dao_set_right_input(struct da + if (!entry) + return -ENOMEM; + ++ dao->ops->clear_right_input(dao); + /* Program master and conjugate resources */ + input->ops->master(input); + daio->rscr.ops->master(&daio->rscr); +From 64c25a92e865f06ad8782fbdaa1e2a97d50acf73 Mon Sep 17 00:00:00 2001 +From: Vasily Khoruzhick <anarsoul@gmail.com> +Date: Fri, 11 Mar 2011 11:05:38 +0200 +Subject: ASoC: PXA: Z2: Fix codec pin name + +From: Vasily Khoruzhick <anarsoul@gmail.com> + +commit 64c25a92e865f06ad8782fbdaa1e2a97d50acf73 upstream. + +MONO was renamed to MONO1. + +Signed-off-by: Vasily Khoruzhick <anarsoul@gmail.com> +Acked-by: Liam Girdwood <lrg@ti.com> +Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + sound/soc/pxa/z2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/pxa/z2.c ++++ b/sound/soc/pxa/z2.c +@@ -147,7 +147,7 @@ static int z2_wm8750_init(struct snd_soc + snd_soc_dapm_disable_pin(dapm, "LINPUT3"); + snd_soc_dapm_disable_pin(dapm, "RINPUT3"); + snd_soc_dapm_disable_pin(dapm, "OUT3"); +- snd_soc_dapm_disable_pin(dapm, "MONO"); ++ snd_soc_dapm_disable_pin(dapm, "MONO1"); + + /* Add z2 specific widgets */ + snd_soc_dapm_new_controls(dapm, wm8750_dapm_widgets, +From 904f0bc482201fa86e75c330d79dfd11be494cf8 Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger <nab@linux-iscsi.org> +Date: Wed, 2 Mar 2011 15:52:51 -0800 +Subject: [SCSI] target: Fix volume size misreporting for volumes > 2TB + +From: Nicholas Bellinger <nab@linux-iscsi.org> + +commit 904f0bc482201fa86e75c330d79dfd11be494cf8 upstream. + +the target infrastructure fails to send the correct conventional size +to READ_CAPACITY that force a retry with READ_CAPACITY_16, which reads +the capacity for devices > 2TB. Fix by adding the correct return to +trigger RC(16). + +Reported-by: Ben Jarvis <bjarvismn@gmail.com> +Signed-off-by: Signed-off-by: Nicholas A. Bellinger <nab@linux-iscsi.org> +Signed-off-by: James Bottomley <James.Bottomley@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/target/target_core_cdb.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/target/target_core_cdb.c ++++ b/drivers/target/target_core_cdb.c +@@ -667,7 +667,13 @@ target_emulate_readcapacity(struct se_cm + { + struct se_device *dev = SE_DEV(cmd); + unsigned char *buf = cmd->t_task->t_task_buf; +- u32 blocks = dev->transport->get_blocks(dev); ++ unsigned long long blocks_long = dev->transport->get_blocks(dev); ++ u32 blocks; ++ ++ if (blocks_long >= 0x00000000ffffffff) ++ blocks = 0xffffffff; ++ else ++ blocks = (u32)blocks_long; + + buf[0] = (blocks >> 24) & 0xff; + buf[1] = (blocks >> 16) & 0xff; +From ed0f36bc5719b25659b637f80ceea85494b84502 Mon Sep 17 00:00:00 2001 +From: Joseph Gruher <joseph.r.gruher@intel.com> +Date: Wed, 5 Jan 2011 16:00:21 -0500 +Subject: [SCSI] scsi_dh_alua: fix deadlock in stpg_endio + +From: Joseph Gruher <joseph.r.gruher@intel.com> + +commit ed0f36bc5719b25659b637f80ceea85494b84502 upstream. + +The use of blk_execute_rq_nowait() implies __blk_put_request() is needed +in stpg_endio() rather than blk_put_request() -- blk_finish_request() is +called with queue lock already held. + +Signed-off-by: Joseph Gruher <joseph.r.gruher@intel.com> +Signed-off-by: Ilgu Hong <ilgu.hong@promise.com> +Signed-off-by: Mike Snitzer <snitzer@redhat.com> +Signed-off-by: James Bottomley <James.Bottomley@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/scsi/device_handler/scsi_dh_alua.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/device_handler/scsi_dh_alua.c ++++ b/drivers/scsi/device_handler/scsi_dh_alua.c +@@ -285,7 +285,8 @@ static void stpg_endio(struct request *r + print_alua_state(h->state)); + } + done: +- blk_put_request(req); ++ req->end_io_data = NULL; ++ __blk_put_request(req->q, req); + if (h->callback_fn) { + h->callback_fn(h->callback_data, err); + h->callback_fn = h->callback_data = NULL; +From e020c6800c9621a77223bf2c1ff68180e41e8ebf Mon Sep 17 00:00:00 2001 +From: Trond Myklebust <Trond.Myklebust@netapp.com> +Date: Tue, 15 Mar 2011 19:56:30 -0400 +Subject: SUNRPC: Ensure we always run the tk_callback before tk_action + +From: Trond Myklebust <Trond.Myklebust@netapp.com> + +commit e020c6800c9621a77223bf2c1ff68180e41e8ebf upstream. + +This fixes a race in which the task->tk_callback() puts the rpc_task +to sleep, setting a new callback. Under certain circumstances, the current +code may end up executing the task->tk_action before it gets round to the +callback. + +Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + net/sunrpc/sched.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +--- a/net/sunrpc/sched.c ++++ b/net/sunrpc/sched.c +@@ -637,14 +637,12 @@ static void __rpc_execute(struct rpc_tas + save_callback = task->tk_callback; + task->tk_callback = NULL; + save_callback(task); +- } +- +- /* +- * Perform the next FSM step. +- * tk_action may be NULL when the task has been killed +- * by someone else. +- */ +- if (!RPC_IS_QUEUED(task)) { ++ } else { ++ /* ++ * Perform the next FSM step. ++ * tk_action may be NULL when the task has been killed ++ * by someone else. ++ */ + if (task->tk_action == NULL) + break; + task->tk_action(task); +From 8e26de238fd794c8ea56a5c98bf67c40cfeb051d Mon Sep 17 00:00:00 2001 +From: Stanislav Kinsbursky <skinsbursky@parallels.com> +Date: Thu, 17 Mar 2011 18:54:23 +0300 +Subject: RPC: killing RPC tasks races fixed + +From: Stanislav Kinsbursky <skinsbursky@parallels.com> + +commit 8e26de238fd794c8ea56a5c98bf67c40cfeb051d upstream. + +RPC task RPC_TASK_QUEUED bit is set must be checked before trying to wake up +task rpc_killall_tasks() because task->tk_waitqueue can not be set (equal to +NULL). +Also, as Trond Myklebust mentioned, such approach (instead of checking +tk_waitqueue to NULL) allows us to "optimise away the call to +rpc_wake_up_queued_task() altogether for those +tasks that aren't queued". + +Here is an example of dereferencing of tk_waitqueue equal to NULL: + +CPU 0 CPU 1 CPU 2 +-------------------- --------------------- -------------------------- +nfs4_run_open_task +rpc_run_task +rpc_execute +rpc_set_active +rpc_make_runnable +(waiting) + rpc_async_schedule + nfs4_open_prepare + nfs_wait_on_sequence + nfs_umount_begin + rpc_killall_tasks + rpc_wake_up_task + rpc_wake_up_queued_task + spin_lock(tk_waitqueue == NULL) + BUG() + rpc_sleep_on + spin_lock(&q->lock) + __rpc_sleep_on + task->tk_waitqueue = q + +Signed-off-by: Stanislav Kinsbursky <skinsbursky@openvz.org> +Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + net/sunrpc/clnt.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -436,7 +436,9 @@ void rpc_killall_tasks(struct rpc_clnt * + if (!(rovr->tk_flags & RPC_TASK_KILLED)) { + rovr->tk_flags |= RPC_TASK_KILLED; + rpc_exit(rovr, -EIO); +- rpc_wake_up_queued_task(rovr->tk_waitqueue, rovr); ++ if (RPC_IS_QUEUED(rovr)) ++ rpc_wake_up_queued_task(rovr->tk_waitqueue, ++ rovr); + } + } + spin_unlock(&clnt->cl_lock); +From 91b2f482e62ad0d444222253026a5cbca28c4ab9 Mon Sep 17 00:00:00 2001 +From: Frederic Weisbecker <fweisbec@gmail.com> +Date: Mon, 7 Mar 2011 21:27:08 +0100 +Subject: perf: Fix the software events state check + +From: Frederic Weisbecker <fweisbec@gmail.com> + +commit 91b2f482e62ad0d444222253026a5cbca28c4ab9 upstream. + +Fix the mistakenly inverted check of events state. + +Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com> +Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl> +Cc: Arnaldo Carvalho de Melo <acme@redhat.com> +Cc: Paul Mackerras <paulus@samba.org> +Cc: Stephane Eranian <eranian@google.com> +LKML-Reference: <1299529629-18280-1-git-send-email-fweisbec@gmail.com> +Signed-off-by: Ingo Molnar <mingo@elte.hu> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + kernel/perf_event.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/perf_event.c ++++ b/kernel/perf_event.c +@@ -4567,7 +4567,7 @@ static int perf_exclude_event(struct per + struct pt_regs *regs) + { + if (event->hw.state & PERF_HES_STOPPED) +- return 0; ++ return 1; + + if (regs) { + if (event->attr.exclude_user && user_mode(regs)) +From a0f7d0f7fc02465bb9758501f611f63381792996 Mon Sep 17 00:00:00 2001 +From: Frederic Weisbecker <fweisbec@gmail.com> +Date: Mon, 7 Mar 2011 21:27:09 +0100 +Subject: perf: Handle stopped state with tracepoints + +From: Frederic Weisbecker <fweisbec@gmail.com> + +commit a0f7d0f7fc02465bb9758501f611f63381792996 upstream. + +We toggle the state from start and stop callbacks but actually +don't check it when the event triggers. Do it so that +these callbacks actually work. + +Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com> +Cc: Arnaldo Carvalho de Melo <acme@redhat.com> +Cc: Paul Mackerras <paulus@samba.org> +Cc: Stephane Eranian <eranian@google.com> +Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl> +LKML-Reference: <1299529629-18280-2-git-send-email-fweisbec@gmail.com> +Signed-off-by: Ingo Molnar <mingo@elte.hu> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + kernel/perf_event.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/kernel/perf_event.c ++++ b/kernel/perf_event.c +@@ -4923,6 +4923,8 @@ static int perf_tp_event_match(struct pe + struct perf_sample_data *data, + struct pt_regs *regs) + { ++ if (event->hw.state & PERF_HES_STOPPED) ++ return 0; + /* + * All tracepoints are from kernel-space. + */ +From 0837e3242c73566fc1c0196b4ec61779c25ffc93 Mon Sep 17 00:00:00 2001 +From: Anton Blanchard <anton@samba.org> +Date: Wed, 9 Mar 2011 14:38:42 +1100 +Subject: perf, powerpc: Handle events that raise an exception without overflowing + +From: Anton Blanchard <anton@samba.org> + +commit 0837e3242c73566fc1c0196b4ec61779c25ffc93 upstream. + +Events on POWER7 can roll back if a speculative event doesn't +eventually complete. Unfortunately in some rare cases they will +raise a performance monitor exception. We need to catch this to +ensure we reset the PMC. In all cases the PMC will be 256 or less +cycles from overflow. + +Signed-off-by: Anton Blanchard <anton@samba.org> +Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl> +LKML-Reference: <20110309143842.6c22845e@kryten> +Signed-off-by: Ingo Molnar <mingo@elte.hu> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + arch/powerpc/include/asm/reg.h | 1 + + arch/powerpc/kernel/perf_event.c | 24 +++++++++++++++++++++++- + 2 files changed, 24 insertions(+), 1 deletion(-) + +--- a/arch/powerpc/include/asm/reg.h ++++ b/arch/powerpc/include/asm/reg.h +@@ -880,6 +880,7 @@ + #define PV_970 0x0039 + #define PV_POWER5 0x003A + #define PV_POWER5p 0x003B ++#define PV_POWER7 0x003F + #define PV_970FX 0x003C + #define PV_630 0x0040 + #define PV_630p 0x0041 +--- a/arch/powerpc/kernel/perf_event.c ++++ b/arch/powerpc/kernel/perf_event.c +@@ -1269,6 +1269,28 @@ unsigned long perf_instruction_pointer(s + return ip; + } + ++static bool pmc_overflow(unsigned long val) ++{ ++ if ((int)val < 0) ++ return true; ++ ++ /* ++ * Events on POWER7 can roll back if a speculative event doesn't ++ * eventually complete. Unfortunately in some rare cases they will ++ * raise a performance monitor exception. We need to catch this to ++ * ensure we reset the PMC. In all cases the PMC will be 256 or less ++ * cycles from overflow. ++ * ++ * We only do this if the first pass fails to find any overflowing ++ * PMCs because a user might set a period of less than 256 and we ++ * don't want to mistakenly reset them. ++ */ ++ if (__is_processor(PV_POWER7) && ((0x80000000 - val) <= 256)) ++ return true; ++ ++ return false; ++} ++ + /* + * Performance monitor interrupt stuff + */ +@@ -1316,7 +1338,7 @@ static void perf_event_interrupt(struct + if (is_limited_pmc(i + 1)) + continue; + val = read_pmc(i + 1); +- if ((int)val < 0) ++ if (pmc_overflow(val)) + write_pmc(i + 1, 0); + } + } +From 58d406ed6a5f1ca4bc1dba5390b718c67847fa5f Mon Sep 17 00:00:00 2001 +From: Josh Hunt <johunt@akamai.com> +Date: Tue, 15 Mar 2011 19:16:40 -0700 +Subject: perf tools: Version incorrect with some versions of grep + +From: Josh Hunt <johunt@akamai.com> + +commit 58d406ed6a5f1ca4bc1dba5390b718c67847fa5f upstream. + +Some versions of grep don't treat '\s' properly. When building perf on such +systems and using a kernel tarball the perf version is unable to be determined +from the main kernel Makefile and the user is left with a version of '..'. +Replacing the use of '\s' with '[[:space:]]', which should work in all grep +versions, gives a usable version number. + +Reported-by: Tapan Dhimant <tdhimant@akamai.com> +Cc: Ingo Molnar <mingo@elte.hu> +Cc: Paul Mackerras <paulus@samba.org> +Cc: Peter Zijlstra <a.p.zijlstra@chello.nl> +Cc: Tapan Dhimant <tdhimant@akamai.com> +Cc: linux-kernel@vger.kernel.org +LKML-Reference: <1300241800-30281-1-git-send-email-johunt@akamai.com> +Signed-off-by: Josh Hunt <johunt@akamai.com> +Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + tools/perf/util/PERF-VERSION-GEN | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/tools/perf/util/PERF-VERSION-GEN ++++ b/tools/perf/util/PERF-VERSION-GEN +@@ -23,10 +23,10 @@ if test -d ../../.git -o -f ../../.git & + then + VN=$(echo "$VN" | sed -e 's/-/./g'); + else +- eval `grep '^VERSION\s*=' ../../Makefile|tr -d ' '` +- eval `grep '^PATCHLEVEL\s*=' ../../Makefile|tr -d ' '` +- eval `grep '^SUBLEVEL\s*=' ../../Makefile|tr -d ' '` +- eval `grep '^EXTRAVERSION\s*=' ../../Makefile|tr -d ' '` ++ eval $(grep '^VERSION[[:space:]]*=' ../../Makefile|tr -d ' ') ++ eval $(grep '^PATCHLEVEL[[:space:]]*=' ../../Makefile|tr -d ' ') ++ eval $(grep '^SUBLEVEL[[:space:]]*=' ../../Makefile|tr -d ' ') ++ eval $(grep '^EXTRAVERSION[[:space:]]*=' ../../Makefile|tr -d ' ') + + VN="${VERSION}.${PATCHLEVEL}.${SUBLEVEL}${EXTRAVERSION}" + fi +From d7433142b63d727b5a217c37b1a1468b116a9771 Mon Sep 17 00:00:00 2001 +From: Eric Sandeen <sandeen@redhat.com> +Date: Fri, 4 Mar 2011 16:04:08 -0600 +Subject: ext3: Always set dx_node's fake_dirent explicitly. + +From: Eric Sandeen <sandeen@redhat.com> + +commit d7433142b63d727b5a217c37b1a1468b116a9771 upstream. + +(crossport of 1f7bebb9e911d870fa8f997ddff838e82b5715ea +by Andreas Schlick <schlick@lavabit.com>) + +When ext3_dx_add_entry() has to split an index node, it has to ensure that +name_len of dx_node's fake_dirent is also zero, because otherwise e2fsck +won't recognise it as an intermediate htree node and consider the htree to +be corrupted. + +Signed-off-by: Eric Sandeen <sandeen@redhat.com> +Signed-off-by: Jan Kara <jack@suse.cz> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + fs/ext3/namei.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/ext3/namei.c ++++ b/fs/ext3/namei.c +@@ -1540,8 +1540,8 @@ static int ext3_dx_add_entry(handle_t *h + goto cleanup; + node2 = (struct dx_node *)(bh2->b_data); + entries2 = node2->entries; ++ memset(&node2->fake, 0, sizeof(struct fake_dirent)); + node2->fake.rec_len = ext3_rec_len_to_disk(sb->s_blocksize); +- node2->fake.inode = 0; + BUFFER_TRACE(frame->bh, "get_write_access"); + err = ext3_journal_get_write_access(handle, frame->bh); + if (err) +From e6cd1e07a185d5f9b0aa75e020df02d3c1c44940 Mon Sep 17 00:00:00 2001 +From: Milton Miller <miltonm@bga.com> +Date: Tue, 15 Mar 2011 13:27:16 -0600 +Subject: call_function_many: fix list delete vs add race + +From: Milton Miller <miltonm@bga.com> + +commit e6cd1e07a185d5f9b0aa75e020df02d3c1c44940 upstream. + +Peter pointed out there was nothing preventing the list_del_rcu in +smp_call_function_interrupt from running before the list_add_rcu in +smp_call_function_many. + +Fix this by not setting refs until we have gotten the lock for the list. +Take advantage of the wmb in list_add_rcu to save an explicit additional +one. + +I tried to force this race with a udelay before the lock & list_add and +by mixing all 64 online cpus with just 3 random cpus in the mask, but +was unsuccessful. Still, inspection shows a valid race, and the fix is +a extension of the existing protection window in the current code. + +Reported-by: Peter Zijlstra <peterz@infradead.org> +Signed-off-by: Milton Miller <miltonm@bga.com> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + kernel/smp.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +--- a/kernel/smp.c ++++ b/kernel/smp.c +@@ -491,14 +491,15 @@ void smp_call_function_many(const struct + cpumask_clear_cpu(this_cpu, data->cpumask); + + /* +- * To ensure the interrupt handler gets an complete view +- * we order the cpumask and refs writes and order the read +- * of them in the interrupt handler. In addition we may +- * only clear our own cpu bit from the mask. ++ * We reuse the call function data without waiting for any grace ++ * period after some other cpu removes it from the global queue. ++ * This means a cpu might find our data block as it is writen. ++ * The interrupt handler waits until it sees refs filled out ++ * while its cpu mask bit is set; here we may only clear our ++ * own cpu mask bit, and must wait to set refs until we are sure ++ * previous writes are complete and we have obtained the lock to ++ * add the element to the queue. + */ +- smp_wmb(); +- +- atomic_set(&data->refs, cpumask_weight(data->cpumask)); + + raw_spin_lock_irqsave(&call_function.lock, flags); + /* +@@ -507,6 +508,11 @@ void smp_call_function_many(const struct + * will not miss any other list entries: + */ + list_add_rcu(&data->csd.list, &call_function.queue); ++ /* ++ * We rely on the wmb() in list_add_rcu to order the writes ++ * to func, data, and cpumask before this write to refs. ++ */ ++ atomic_set(&data->refs, cpumask_weight(data->cpumask)); + raw_spin_unlock_irqrestore(&call_function.lock, flags); + + /* +From 45a5791920ae643eafc02e2eedef1a58e341b736 Mon Sep 17 00:00:00 2001 +From: Milton Miller <miltonm@bga.com> +Date: Tue, 15 Mar 2011 13:27:16 -0600 +Subject: call_function_many: add missing ordering + +From: Milton Miller <miltonm@bga.com> + +commit 45a5791920ae643eafc02e2eedef1a58e341b736 upstream. + +Paul McKenney's review pointed out two problems with the barriers in the +2.6.38 update to the smp call function many code. + +First, a barrier that would force the func and info members of data to +be visible before their consumption in the interrupt handler was +missing. This can be solved by adding a smp_wmb between setting the +func and info members and setting setting the cpumask; this will pair +with the existing and required smp_rmb ordering the cpumask read before +the read of refs. This placement avoids the need a second smp_rmb in +the interrupt handler which would be executed on each of the N cpus +executing the call request. (I was thinking this barrier was present +but was not). + +Second, the previous write to refs (establishing the zero that we the +interrupt handler was testing from all cpus) was performed by a third +party cpu. This would invoke transitivity which, as a recient or +concurrent addition to memory-barriers.txt now explicitly states, would +require a full smp_mb(). + +However, we know the cpumask will only be set by one cpu (the data +owner) and any preivous iteration of the mask would have cleared by the +reading cpu. By redundantly writing refs to 0 on the owning cpu before +the smp_wmb, the write to refs will follow the same path as the writes +that set the cpumask, which in turn allows us to keep the barrier in the +interrupt handler a smp_rmb instead of promoting it to a smp_mb (which +will be be executed by N cpus for each of the possible M elements on the +list). + +I moved and expanded the comment about our (ab)use of the rcu list +primitives for the concurrent walk earlier into this function. I +considered moving the first two paragraphs to the queue list head and +lock, but felt it would have been too disconected from the code. + +Cc: Paul McKinney <paulmck@linux.vnet.ibm.com> +Signed-off-by: Milton Miller <miltonm@bga.com> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + kernel/smp.c | 46 +++++++++++++++++++++++++++++++++------------- + 1 file changed, 33 insertions(+), 13 deletions(-) + +--- a/kernel/smp.c ++++ b/kernel/smp.c +@@ -483,23 +483,42 @@ void smp_call_function_many(const struct + + data = &__get_cpu_var(cfd_data); + csd_lock(&data->csd); +- BUG_ON(atomic_read(&data->refs) || !cpumask_empty(data->cpumask)); + +- data->csd.func = func; +- data->csd.info = info; +- cpumask_and(data->cpumask, mask, cpu_online_mask); +- cpumask_clear_cpu(this_cpu, data->cpumask); ++ /* This BUG_ON verifies our reuse assertions and can be removed */ ++ BUG_ON(atomic_read(&data->refs) || !cpumask_empty(data->cpumask)); + + /* ++ * The global call function queue list add and delete are protected ++ * by a lock, but the list is traversed without any lock, relying ++ * on the rcu list add and delete to allow safe concurrent traversal. + * We reuse the call function data without waiting for any grace + * period after some other cpu removes it from the global queue. +- * This means a cpu might find our data block as it is writen. +- * The interrupt handler waits until it sees refs filled out +- * while its cpu mask bit is set; here we may only clear our +- * own cpu mask bit, and must wait to set refs until we are sure +- * previous writes are complete and we have obtained the lock to +- * add the element to the queue. ++ * This means a cpu might find our data block as it is being ++ * filled out. ++ * ++ * We hold off the interrupt handler on the other cpu by ++ * ordering our writes to the cpu mask vs our setting of the ++ * refs counter. We assert only the cpu owning the data block ++ * will set a bit in cpumask, and each bit will only be cleared ++ * by the subject cpu. Each cpu must first find its bit is ++ * set and then check that refs is set indicating the element is ++ * ready to be processed, otherwise it must skip the entry. ++ * ++ * On the previous iteration refs was set to 0 by another cpu. ++ * To avoid the use of transitivity, set the counter to 0 here ++ * so the wmb will pair with the rmb in the interrupt handler. + */ ++ atomic_set(&data->refs, 0); /* convert 3rd to 1st party write */ ++ ++ data->csd.func = func; ++ data->csd.info = info; ++ ++ /* Ensure 0 refs is visible before mask. Also orders func and info */ ++ smp_wmb(); ++ ++ /* We rely on the "and" being processed before the store */ ++ cpumask_and(data->cpumask, mask, cpu_online_mask); ++ cpumask_clear_cpu(this_cpu, data->cpumask); + + raw_spin_lock_irqsave(&call_function.lock, flags); + /* +@@ -509,8 +528,9 @@ void smp_call_function_many(const struct + */ + list_add_rcu(&data->csd.list, &call_function.queue); + /* +- * We rely on the wmb() in list_add_rcu to order the writes +- * to func, data, and cpumask before this write to refs. ++ * We rely on the wmb() in list_add_rcu to complete our writes ++ * to the cpumask before this write to refs, which indicates ++ * data is on the list and is ready to be processed. + */ + atomic_set(&data->refs, cpumask_weight(data->cpumask)); + raw_spin_unlock_irqrestore(&call_function.lock, flags); +From 723aae25d5cdb09962901d36d526b44d4be1051c Mon Sep 17 00:00:00 2001 +From: Milton Miller <miltonm@bga.com> +Date: Tue, 15 Mar 2011 13:27:17 -0600 +Subject: smp_call_function_many: handle concurrent clearing of mask + +From: Milton Miller <miltonm@bga.com> + +commit 723aae25d5cdb09962901d36d526b44d4be1051c upstream. + +Mike Galbraith reported finding a lockup ("perma-spin bug") where the +cpumask passed to smp_call_function_many was cleared by other cpu(s) +while a cpu was preparing its call_data block, resulting in no cpu to +clear the last ref and unlock the block. + +Having cpus clear their bit asynchronously could be useful on a mask of +cpus that might have a translation context, or cpus that need a push to +complete an rcu window. + +Instead of adding a BUG_ON and requiring yet another cpumask copy, just +detect the race and handle it. + +Note: arch_send_call_function_ipi_mask must still handle an empty +cpumask because the data block is globally visible before the that arch +callback is made. And (obviously) there are no guarantees to which cpus +are notified if the mask is changed during the call; only cpus that were +online and had their mask bit set during the whole call are guaranteed +to be called. + +Reported-by: Mike Galbraith <efault@gmx.de> +Reported-by: Jan Beulich <JBeulich@novell.com> +Acked-by: Jan Beulich <jbeulich@novell.com> +Signed-off-by: Milton Miller <miltonm@bga.com> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + kernel/smp.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +--- a/kernel/smp.c ++++ b/kernel/smp.c +@@ -450,7 +450,7 @@ void smp_call_function_many(const struct + { + struct call_function_data *data; + unsigned long flags; +- int cpu, next_cpu, this_cpu = smp_processor_id(); ++ int refs, cpu, next_cpu, this_cpu = smp_processor_id(); + + /* + * Can deadlock when called with interrupts disabled. +@@ -461,7 +461,7 @@ void smp_call_function_many(const struct + WARN_ON_ONCE(cpu_online(this_cpu) && irqs_disabled() + && !oops_in_progress && !early_boot_irqs_disabled); + +- /* So, what's a CPU they want? Ignoring this one. */ ++ /* Try to fastpath. So, what's a CPU they want? Ignoring this one. */ + cpu = cpumask_first_and(mask, cpu_online_mask); + if (cpu == this_cpu) + cpu = cpumask_next_and(cpu, mask, cpu_online_mask); +@@ -519,6 +519,13 @@ void smp_call_function_many(const struct + /* We rely on the "and" being processed before the store */ + cpumask_and(data->cpumask, mask, cpu_online_mask); + cpumask_clear_cpu(this_cpu, data->cpumask); ++ refs = cpumask_weight(data->cpumask); ++ ++ /* Some callers race with other cpus changing the passed mask */ ++ if (unlikely(!refs)) { ++ csd_unlock(&data->csd); ++ return; ++ } + + raw_spin_lock_irqsave(&call_function.lock, flags); + /* +@@ -532,7 +539,7 @@ void smp_call_function_many(const struct + * to the cpumask before this write to refs, which indicates + * data is on the list and is ready to be processed. + */ +- atomic_set(&data->refs, cpumask_weight(data->cpumask)); ++ atomic_set(&data->refs, refs); + raw_spin_unlock_irqrestore(&call_function.lock, flags); + + /* +From 4981d01eada5354d81c8929d5b2836829ba3df7b Mon Sep 17 00:00:00 2001 +From: Shaohua Li <shaohua.li@intel.com> +Date: Wed, 16 Mar 2011 11:37:29 +0800 +Subject: x86: Flush TLB if PGD entry is changed in i386 PAE mode + +From: Shaohua Li <shaohua.li@intel.com> + +commit 4981d01eada5354d81c8929d5b2836829ba3df7b upstream. + +According to intel CPU manual, every time PGD entry is changed in i386 PAE +mode, we need do a full TLB flush. Current code follows this and there is +comment for this too in the code. + +But current code misses the multi-threaded case. A changed page table +might be used by several CPUs, every such CPU should flush TLB. Usually +this isn't a problem, because we prepopulate all PGD entries at process +fork. But when the process does munmap and follows new mmap, this issue +will be triggered. + +When it happens, some CPUs keep doing page faults: + + http://marc.info/?l=linux-kernel&m=129915020508238&w=2 + +Reported-by: Yasunori Goto<y-goto@jp.fujitsu.com> +Tested-by: Yasunori Goto<y-goto@jp.fujitsu.com> +Reviewed-by: Rik van Riel <riel@redhat.com> +Signed-off-by: Shaohua Li<shaohua.li@intel.com> +Cc: Mallick Asit K <asit.k.mallick@intel.com> +Cc: Linus Torvalds <torvalds@linux-foundation.org> +Cc: Andrew Morton <akpm@linux-foundation.org> +Cc: linux-mm <linux-mm@kvack.org> +LKML-Reference: <1300246649.2337.95.camel@sli10-conroe> +Signed-off-by: Ingo Molnar <mingo@elte.hu> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + arch/x86/include/asm/pgtable-3level.h | 11 +++-------- + arch/x86/mm/pgtable.c | 3 +-- + 2 files changed, 4 insertions(+), 10 deletions(-) + +--- a/arch/x86/include/asm/pgtable-3level.h ++++ b/arch/x86/include/asm/pgtable-3level.h +@@ -69,8 +69,6 @@ static inline void native_pmd_clear(pmd_ + + static inline void pud_clear(pud_t *pudp) + { +- unsigned long pgd; +- + set_pud(pudp, __pud(0)); + + /* +@@ -79,13 +77,10 @@ static inline void pud_clear(pud_t *pudp + * section 8.1: in PAE mode we explicitly have to flush the + * TLB via cr3 if the top-level pgd is changed... + * +- * Make sure the pud entry we're updating is within the +- * current pgd to avoid unnecessary TLB flushes. ++ * Currently all places where pud_clear() is called either have ++ * flush_tlb_mm() followed or don't need TLB flush (x86_64 code or ++ * pud_clear_bad()), so we don't need TLB flush here. + */ +- pgd = read_cr3(); +- if (__pa(pudp) >= pgd && __pa(pudp) < +- (pgd + sizeof(pgd_t)*PTRS_PER_PGD)) +- write_cr3(pgd); + } + + #ifdef CONFIG_SMP +--- a/arch/x86/mm/pgtable.c ++++ b/arch/x86/mm/pgtable.c +@@ -168,8 +168,7 @@ void pud_populate(struct mm_struct *mm, + * section 8.1: in PAE mode we explicitly have to flush the + * TLB via cr3 if the top-level pgd is changed... + */ +- if (mm == current->active_mm) +- write_cr3(read_cr3()); ++ flush_tlb_mm(mm); + } + #else /* !CONFIG_X86_PAE */ + +From 0ae43810976bc969ee158510c4acbe70ed136e61 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov <dmitry.torokhov@gmail.com> +Date: Fri, 11 Mar 2011 00:27:34 -0800 +Subject: HID: ACRUX - activate the device immediately after binding + +From: Dmitry Torokhov <dmitry.torokhov@gmail.com> + +commit 0ae43810976bc969ee158510c4acbe70ed136e61 upstream. + +This device does not tolerate delayed opening and goes into a coma if +we try to that. Ubuntu even has a crutch for udev that opened the device +upon seeing it for the first time, but it did not work if we happened to +boot with the device attached, since by the time userspace got around +opening the device it was too late. Let's start the device immediately +to deal with this issue. + +Reported-by: Sergei Kolzun <x0r@dv-life.ru> +Signed-off-by: Dmitry Torokhov <dtor@mail.ru> +Signed-off-by: Jiri Kosina <jkosina@suse.cz> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/hid/Kconfig | 10 ++++++++-- + drivers/hid/Makefile | 2 +- + drivers/hid/hid-axff.c | 31 ++++++++++++++++++++++++++++--- + drivers/hid/hid-core.c | 2 -- + 4 files changed, 37 insertions(+), 8 deletions(-) + +--- a/drivers/hid/Kconfig ++++ b/drivers/hid/Kconfig +@@ -68,9 +68,15 @@ config HID_A4TECH + ---help--- + Support for A4 tech X5 and WOP-35 / Trust 450L mice. + +-config HID_ACRUX_FF +- tristate "ACRUX force feedback" ++config HID_ACRUX ++ tristate "ACRUX game controller support" + depends on USB_HID ++ ---help--- ++ Say Y here if you want to enable support for ACRUX game controllers. ++ ++config HID_ACRUX_FF ++ tristate "ACRUX force feedback support" ++ depends on HID_ACRUX + select INPUT_FF_MEMLESS + ---help--- + Say Y here if you want to enable force feedback support for ACRUX +--- a/drivers/hid/Makefile ++++ b/drivers/hid/Makefile +@@ -27,7 +27,7 @@ endif + + obj-$(CONFIG_HID_3M_PCT) += hid-3m-pct.o + obj-$(CONFIG_HID_A4TECH) += hid-a4tech.o +-obj-$(CONFIG_HID_ACRUX_FF) += hid-axff.o ++obj-$(CONFIG_HID_ACRUX) += hid-axff.o + obj-$(CONFIG_HID_APPLE) += hid-apple.o + obj-$(CONFIG_HID_BELKIN) += hid-belkin.o + obj-$(CONFIG_HID_CANDO) += hid-cando.o +--- a/drivers/hid/hid-axff.c ++++ b/drivers/hid/hid-axff.c +@@ -33,6 +33,8 @@ + #include <linux/hid.h> + + #include "hid-ids.h" ++ ++#ifdef CONFIG_HID_ACRUX_FF + #include "usbhid/usbhid.h" + + struct axff_device { +@@ -109,6 +111,12 @@ err_free_mem: + kfree(axff); + return error; + } ++#else ++static inline int axff_init(struct hid_device *hid) ++{ ++ return 0; ++} ++#endif + + static int ax_probe(struct hid_device *hdev, const struct hid_device_id *id) + { +@@ -139,9 +147,25 @@ static int ax_probe(struct hid_device *h + error); + } + ++ /* ++ * We need to start polling device right away, otherwise ++ * it will go into a coma. ++ */ ++ error = hid_hw_open(hdev); ++ if (error) { ++ dev_err(&hdev->dev, "hw open failed\n"); ++ return error; ++ } ++ + return 0; + } + ++static void ax_remove(struct hid_device *hdev) ++{ ++ hid_hw_close(hdev); ++ hid_hw_stop(hdev); ++} ++ + static const struct hid_device_id ax_devices[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_ACRUX, 0x0802), }, + { } +@@ -149,9 +173,10 @@ static const struct hid_device_id ax_dev + MODULE_DEVICE_TABLE(hid, ax_devices); + + static struct hid_driver ax_driver = { +- .name = "acrux", +- .id_table = ax_devices, +- .probe = ax_probe, ++ .name = "acrux", ++ .id_table = ax_devices, ++ .probe = ax_probe, ++ .remove = ax_remove, + }; + + static int __init ax_init(void) +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1256,9 +1256,7 @@ static const struct hid_device_id hid_ha + { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_WCP32PU) }, + { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_X5_005D) }, + { HID_USB_DEVICE(USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_RP_649) }, +-#if defined(CONFIG_HID_ACRUX_FF) || defined(CONFIG_HID_ACRUX_FF_MODULE) + { HID_USB_DEVICE(USB_VENDOR_ID_ACRUX, 0x0802) }, +-#endif + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ATV_IRCONTROL) }, + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL4) }, + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MIGHTYMOUSE) }, +From f635bd11c8d332d917fb9a4cad3071b2357d5b2a Mon Sep 17 00:00:00 2001 +From: Henrik Rydberg <rydberg@euromail.se> +Date: Thu, 24 Feb 2011 19:30:59 +0100 +Subject: HID: Do not create input devices for feature reports + +From: Henrik Rydberg <rydberg@euromail.se> + +commit f635bd11c8d332d917fb9a4cad3071b2357d5b2a upstream. + +When the multi input quirk is set, there is a new input device +created for every feature report. Since the idea is to present +features per hid device, not per input device, revert back to +the original report loop and change the feature_mapping() callback +to not take the input device as argument. + +Signed-off-by: Henrik Rydberg <rydberg@euromail.se> +Tested-by: Benjamin Tissoires <benjmain.tissoires@gmail.com> +Signed-off-by: Jiri Kosina <jkosina@suse.cz> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/hid/hid-input.c | 30 +++++++++++++++++++++--------- + drivers/hid/hid-multitouch.c | 2 +- + include/linux/hid.h | 2 +- + 3 files changed, 23 insertions(+), 11 deletions(-) + +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -290,14 +290,6 @@ static void hidinput_configure_usage(str + goto ignore; + } + +- if (field->report_type == HID_FEATURE_REPORT) { +- if (device->driver->feature_mapping) { +- device->driver->feature_mapping(device, hidinput, field, +- usage); +- } +- goto ignore; +- } +- + if (device->driver->input_mapping) { + int ret = device->driver->input_mapping(device, hidinput, field, + usage, &bit, &max); +@@ -835,6 +827,24 @@ static void hidinput_close(struct input_ + hid_hw_close(hid); + } + ++static void report_features(struct hid_device *hid) ++{ ++ struct hid_driver *drv = hid->driver; ++ struct hid_report_enum *rep_enum; ++ struct hid_report *rep; ++ int i, j; ++ ++ if (!drv->feature_mapping) ++ return; ++ ++ rep_enum = &hid->report_enum[HID_FEATURE_REPORT]; ++ list_for_each_entry(rep, &rep_enum->report_list, list) ++ for (i = 0; i < rep->maxfield; i++) ++ for (j = 0; j < rep->field[i]->maxusage; j++) ++ drv->feature_mapping(hid, rep->field[i], ++ rep->field[i]->usage + j); ++} ++ + /* + * Register the input device; print a message. + * Configure the input layer interface +@@ -863,7 +873,9 @@ int hidinput_connect(struct hid_device * + return -1; + } + +- for (k = HID_INPUT_REPORT; k <= HID_FEATURE_REPORT; k++) { ++ report_features(hid); ++ ++ for (k = HID_INPUT_REPORT; k <= HID_OUTPUT_REPORT; k++) { + if (k == HID_OUTPUT_REPORT && + hid->quirks & HID_QUIRK_SKIP_OUTPUT_REPORTS) + continue; +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -122,7 +122,7 @@ struct mt_class mt_classes[] = { + { } + }; + +-static void mt_feature_mapping(struct hid_device *hdev, struct hid_input *hi, ++static void mt_feature_mapping(struct hid_device *hdev, + struct hid_field *field, struct hid_usage *usage) + { + if (usage->hid == HID_DG_INPUTMODE) { +--- a/include/linux/hid.h ++++ b/include/linux/hid.h +@@ -638,7 +638,7 @@ struct hid_driver { + struct hid_input *hidinput, struct hid_field *field, + struct hid_usage *usage, unsigned long **bit, int *max); + void (*feature_mapping)(struct hid_device *hdev, +- struct hid_input *hidinput, struct hid_field *field, ++ struct hid_field *field, + struct hid_usage *usage); + #ifdef CONFIG_PM + int (*suspend)(struct hid_device *hdev, pm_message_t message); +From 9804c9eaeacfe78651052c5ddff31099f60ef78c Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner <tglx@linutronix.de> +Date: Mon, 7 Feb 2011 19:28:01 +0100 +Subject: [PARISC] fix per-cpu flag problem in the cpu affinity checkers + +From: Thomas Gleixner <tglx@linutronix.de> + +commit 9804c9eaeacfe78651052c5ddff31099f60ef78c upstream. + +The CHECK_IRQ_PER_CPU is wrong, it should be checking +irq_to_desc(irq)->status not just irq. + +Signed-off-by: Thomas Gleixner <tglx@linutronix.de> +Signed-off-by: James Bottomley <James.Bottomley@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + arch/parisc/kernel/irq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/parisc/kernel/irq.c ++++ b/arch/parisc/kernel/irq.c +@@ -108,7 +108,7 @@ int cpu_check_affinity(unsigned int irq, + int cpu_dest; + + /* timer and ipi have to always be received on all CPUs */ +- if (CHECK_IRQ_PER_CPU(irq)) { ++ if (CHECK_IRQ_PER_CPU(irq_to_desc(irq)->status)) { + /* Bad linux design decision. The mask has already + * been set; we must reset it */ + cpumask_setall(irq_desc[irq].affinity); +From 47340bd9fefb571888836da942b5aee0e85e959c Mon Sep 17 00:00:00 2001 +From: Andy Botting <andy@andybotting.com> +Date: Sat, 12 Mar 2011 20:27:22 -0800 +Subject: Input: bcm5974 - add support for MacBookPro8 + +From: Andy Botting <andy@andybotting.com> + +commit 47340bd9fefb571888836da942b5aee0e85e959c upstream. + +This patch add multitouch support for the MacBookPro8,1 and +MacBookPro8,2 models. + +Signed-off-by: Andy Botting <andy@andybotting.com> +Signed-off-by: Henrik Rydberg <rydberg@euromail.se> +Acked-by: Jiri Kosina <jkosina@suse.cz> +Signed-off-by: Dmitry Torokhov <dtor@mail.ru> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/hid/hid-apple.c | 6 ++++++ + drivers/hid/hid-core.c | 6 ++++++ + drivers/hid/hid-ids.h | 3 +++ + drivers/input/mouse/bcm5974.c | 20 ++++++++++++++++++++ + 4 files changed, 35 insertions(+) + +--- a/drivers/hid/hid-apple.c ++++ b/drivers/hid/hid-apple.c +@@ -481,6 +481,12 @@ static const struct hid_device_id apple_ + .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD }, + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS), + .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING5_ANSI), ++ .driver_data = APPLE_HAS_FN }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING5_ISO), ++ .driver_data = APPLE_HAS_FN | APPLE_ISO_KEYBOARD }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING5_JIS), ++ .driver_data = APPLE_HAS_FN | APPLE_RDESC_JIS }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI), + .driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO), +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1300,6 +1300,9 @@ static const struct hid_device_id hid_ha + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI) }, + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO) }, + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING5_ANSI) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING5_ISO) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING5_JIS) }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI) }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO) }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS) }, +@@ -1800,6 +1803,9 @@ static const struct hid_device_id hid_mo + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI) }, + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO) }, + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING5_ANSI) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING5_ISO) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_WELLSPRING5_JIS) }, + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) }, + { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) }, + { } +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -103,6 +103,9 @@ + #define USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI 0x0242 + #define USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO 0x0243 + #define USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS 0x0244 ++#define USB_DEVICE_ID_APPLE_WELLSPRING5_ANSI 0x0245 ++#define USB_DEVICE_ID_APPLE_WELLSPRING5_ISO 0x0246 ++#define USB_DEVICE_ID_APPLE_WELLSPRING5_JIS 0x0247 + #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI 0x0239 + #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO 0x023a + #define USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS 0x023b +--- a/drivers/input/mouse/bcm5974.c ++++ b/drivers/input/mouse/bcm5974.c +@@ -63,6 +63,10 @@ + #define USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI 0x0242 + #define USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO 0x0243 + #define USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS 0x0244 ++/* Macbook8 (unibody, March 2011) */ ++#define USB_DEVICE_ID_APPLE_WELLSPRING5_ANSI 0x0245 ++#define USB_DEVICE_ID_APPLE_WELLSPRING5_ISO 0x0246 ++#define USB_DEVICE_ID_APPLE_WELLSPRING5_JIS 0x0247 + + #define BCM5974_DEVICE(prod) { \ + .match_flags = (USB_DEVICE_ID_MATCH_DEVICE | \ +@@ -96,6 +100,10 @@ static const struct usb_device_id bcm597 + BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI), + BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO), + BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS), ++ /* MacbookPro8 */ ++ BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING5_ANSI), ++ BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING5_ISO), ++ BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING5_JIS), + /* Terminating entry */ + {} + }; +@@ -274,6 +282,18 @@ static const struct bcm5974_config bcm59 + { DIM_X, DIM_X / SN_COORD, -4616, 5112 }, + { DIM_Y, DIM_Y / SN_COORD, -142, 5234 } + }, ++ { ++ USB_DEVICE_ID_APPLE_WELLSPRING5_ANSI, ++ USB_DEVICE_ID_APPLE_WELLSPRING5_ISO, ++ USB_DEVICE_ID_APPLE_WELLSPRING5_JIS, ++ HAS_INTEGRATED_BUTTON, ++ 0x84, sizeof(struct bt_data), ++ 0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS, ++ { DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 }, ++ { DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 }, ++ { DIM_X, DIM_X / SN_COORD, -4415, 5050 }, ++ { DIM_Y, DIM_Y / SN_COORD, -55, 6680 } ++ }, + {} + }; + +From 6ced9e6b3901af4ab6ac0a11231402c888286ea6 Mon Sep 17 00:00:00 2001 +From: Roman Fietze <roman.fietze@telemotive.de> +Date: Sun, 20 Mar 2011 14:50:52 +0100 +Subject: i2c: Fix typo in instantiating-devices document + +From: Roman Fietze <roman.fietze@telemotive.de> + +commit 6ced9e6b3901af4ab6ac0a11231402c888286ea6 upstream. + +The struct i2c_board_info member holding the name is "type", not +"name". + +Signed-off-by: Roman Fietze <roman.fietze@telemotive.de> +Signed-off-by: Jean Delvare <khali@linux-fr.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + Documentation/i2c/instantiating-devices | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/Documentation/i2c/instantiating-devices ++++ b/Documentation/i2c/instantiating-devices +@@ -100,7 +100,7 @@ static int __devinit usb_hcd_pnx4008_pro + (...) + i2c_adap = i2c_get_adapter(2); + memset(&i2c_info, 0, sizeof(struct i2c_board_info)); +- strlcpy(i2c_info.name, "isp1301_pnx", I2C_NAME_SIZE); ++ strlcpy(i2c_info.type, "isp1301_pnx", I2C_NAME_SIZE); + isp1301_i2c_client = i2c_new_probed_device(i2c_adap, &i2c_info, + normal_i2c, NULL); + i2c_put_adapter(i2c_adap); +From 5fd11c0754fa069b6aba64b65734aa2fb193552d Mon Sep 17 00:00:00 2001 +From: Manoj Iyer <manoj.iyer@canonical.com> +Date: Fri, 11 Feb 2011 16:25:31 -0600 +Subject: mmc: sdhci: Add Ricoh e823 PCI ID + +From: Manoj Iyer <manoj.iyer@canonical.com> + +commit 5fd11c0754fa069b6aba64b65734aa2fb193552d upstream. + +Signed-off-by: Manoj Iyer <manoj.iyer@canonical.com> +Signed-off-by: Chris Ball <cjb@laptop.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/mmc/host/sdhci-pci.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/mmc/host/sdhci-pci.c ++++ b/drivers/mmc/host/sdhci-pci.c +@@ -547,6 +547,14 @@ static const struct pci_device_id pci_id + }, + + { ++ .vendor = PCI_VENDOR_ID_RICOH, ++ .device = 0xe823, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .driver_data = (kernel_ulong_t)&sdhci_ricoh_mmc, ++ }, ++ ++ { + .vendor = PCI_VENDOR_ID_ENE, + .device = PCI_DEVICE_ID_ENE_CB712_SD, + .subvendor = PCI_ANY_ID, +From 0aab3995485b8a994bf29a995a008c9ea4a28054 Mon Sep 17 00:00:00 2001 +From: Stefan Nilsson XK <stefan.xk.nilsson@stericsson.com> +Date: Tue, 1 Mar 2011 14:41:04 +0100 +Subject: mmc: sdio: remember new card RCA when redetecting card + +From: Stefan Nilsson XK <stefan.xk.nilsson@stericsson.com> + +commit 0aab3995485b8a994bf29a995a008c9ea4a28054 upstream. + +During redetection of a SDIO card, a request for a new card RCA +was submitted to the card, but was then overwritten by the old RCA. +This caused the card to be deselected instead of selected when using +the incorrect RCA. This bug's been present since the "oldcard" +handling was introduced in 2.6.32. + +Signed-off-by: Stefan Nilsson XK <stefan.xk.nilsson@stericsson.com> +Reviewed-by: Ulf Hansson <ulf.hansson@stericsson.com> +Reviewed-by: Pawel Wieczorkiewicz <pawel.wieczorkiewicz@stericsson.com> +Signed-off-by: Linus Walleij <linus.walleij@linaro.org> +Signed-off-by: Chris Ball <cjb@laptop.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/mmc/core/sdio.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/mmc/core/sdio.c ++++ b/drivers/mmc/core/sdio.c +@@ -395,6 +395,14 @@ static int mmc_sdio_init_card(struct mmc + if (err) + goto remove; + ++ /* ++ * Update oldcard with the new RCA received from the SDIO ++ * device -- we're doing this so that it's updated in the ++ * "card" struct when oldcard overwrites that later. ++ */ ++ if (oldcard) ++ oldcard->rca = card->rca; ++ + mmc_set_bus_mode(host, MMC_BUSMODE_PUSHPULL); + } + +From 371c394af27ab7d1e58a66bc19d9f1f3ac1f67b4 Mon Sep 17 00:00:00 2001 +From: Alexander van Heukelum <heukelum@fastmail.fm> +Date: Fri, 11 Mar 2011 21:59:38 +0100 +Subject: x86, binutils, xen: Fix another wrong size directive + +From: Alexander van Heukelum <heukelum@fastmail.fm> + +commit 371c394af27ab7d1e58a66bc19d9f1f3ac1f67b4 upstream. + +The latest binutils (2.21.0.20110302/Ubuntu) breaks the build +yet another time, under CONFIG_XEN=y due to a .size directive that +refers to a slightly differently named (hence, to the now very +strict and unforgiving assembler, non-existent) symbol. + +[ mingo: + + This unnecessary build breakage caused by new binutils + version 2.21 gets escallated back several kernel releases spanning + several years of Linux history, affecting over 130,000 upstream + kernel commits (!), on CONFIG_XEN=y 64-bit kernels (i.e. essentially + affecting all major Linux distro kernel configs). + + Git annotate tells us that this slight debug symbol code mismatch + bug has been introduced in 2008 in commit 3d75e1b8: + + 3d75e1b8 (Jeremy Fitzhardinge 2008-07-08 15:06:49 -0700 1231) ENTRY(xen_do_hypervisor_callback) # do_hypervisor_callback(struct *pt_regs) + + The 'bug' is just a slight assymetry in ENTRY()/END() + debug-symbols sequences, with lots of assembly code between the + ENTRY() and the END(): + + ENTRY(xen_do_hypervisor_callback) # do_hypervisor_callback(struct *pt_regs) + ... + END(do_hypervisor_callback) + + Human reviewers almost never catch such small mismatches, and binutils + never even warned about it either. + + This new binutils version thus breaks the Xen build on all upstream kernels + since v2.6.27, out of the blue. + + This makes a straightforward Git bisection of all 64-bit Xen-enabled kernels + impossible on such binutils, for a bisection window of over hundred + thousand historic commits. (!) + + This is a major fail on the side of binutils and binutils needs to turn + this show-stopper build failure into a warning ASAP. ] + +Signed-off-by: Alexander van Heukelum <heukelum@fastmail.fm> +Cc: Jeremy Fitzhardinge <jeremy@goop.org> +Cc: Jan Beulich <jbeulich@novell.com> +Cc: H.J. Lu <hjl.tools@gmail.com> +Cc: Linus Torvalds <torvalds@linux-foundation.org> +Cc: Andrew Morton <akpm@linux-foundation.org> +Cc: "H. Peter Anvin" <hpa@zytor.com> +Cc: Kees Cook <kees.cook@canonical.com> +LKML-Reference: <1299877178-26063-1-git-send-email-heukelum@fastmail.fm> +Signed-off-by: Ingo Molnar <mingo@elte.hu> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + arch/x86/kernel/entry_64.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/entry_64.S ++++ b/arch/x86/kernel/entry_64.S +@@ -1248,7 +1248,7 @@ ENTRY(xen_do_hypervisor_callback) # do + decl PER_CPU_VAR(irq_count) + jmp error_exit + CFI_ENDPROC +-END(do_hypervisor_callback) ++END(xen_do_hypervisor_callback) + + /* + * Hypervisor uses this for application faults while it executes. +From 60d97a840175d3becb2e6de36537a5cdfc0ec3a9 Mon Sep 17 00:00:00 2001 +From: Sergei Shtylyov <sshtylyov@ru.mvista.com> +Date: Sun, 13 Mar 2011 20:06:59 +0000 +Subject: davinci: DM644x EVM: register MUSB device earlier + +From: Sergei Shtylyov <sshtylyov@ru.mvista.com> + +commit 60d97a840175d3becb2e6de36537a5cdfc0ec3a9 upstream. + +The MUSB driver doesn't see its platform device on DM644x EVM board anymore +since commit 73b089b052a69020b953312a624a6e1eb5b81fab (usb: musb: split davinci +to its own platform_driver) because the new probe is called as subsys_initcall() +now, and the device is registered later than that by the board code. Move the +registration to davinci_evm_init() -- it's safe to do so because the MUSB core +device still gets initialized as fs_initcall() -- which is late enough for the +I2C GPIO expander (which controls VBUS) to be initialized. + +Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com> +Acked-by: Felipe Balbi <balbi@ti.com> +Tested-by: Sekhar Nori <nsekhar@ti.com> +Signed-off-by: Kevin Hilman <khilman@ti.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + arch/arm/mach-davinci/board-dm644x-evm.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +--- a/arch/arm/mach-davinci/board-dm644x-evm.c ++++ b/arch/arm/mach-davinci/board-dm644x-evm.c +@@ -440,11 +440,6 @@ evm_u35_setup(struct i2c_client *client, + gpio_request(gpio + 7, "nCF_SEL"); + gpio_direction_output(gpio + 7, 1); + +- /* irlml6401 switches over 1A, in under 8 msec; +- * now it can be managed by nDRV_VBUS ... +- */ +- davinci_setup_usb(1000, 8); +- + return 0; + } + +@@ -705,6 +700,9 @@ static __init void davinci_evm_init(void + davinci_serial_init(&uart_config); + dm644x_init_asp(&dm644x_evm_snd_data); + ++ /* irlml6401 switches over 1A, in under 8 msec */ ++ davinci_setup_usb(1000, 8); ++ + soc_info->emac_pdata->phy_id = DM644X_EVM_PHY_ID; + /* Register the fixup for PHY on DaVinci */ + phy_register_fixup_for_uid(LXT971_PHY_ID, LXT971_PHY_MASK, +From ccd32e735de7a941906e093f8dca924bb05c5794 Mon Sep 17 00:00:00 2001 +From: Vivien Didelot <vivien.didelot@savoirfairelinux.com> +Date: Mon, 21 Mar 2011 17:59:35 +0100 +Subject: hwmon: (sht15) Fix integer overflow in humidity calculation + +From: Vivien Didelot <vivien.didelot@savoirfairelinux.com> + +commit ccd32e735de7a941906e093f8dca924bb05c5794 upstream. + +An integer overflow occurs in the calculation of RHlinear when the +relative humidity is greater than around 30%. The consequence is a subtle +(but noticeable) error in the resulting humidity measurement. + +Signed-off-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com> +Signed-off-by: Jean Delvare <khali@linux-fr.org> +Cc: Jonathan Cameron <jic23@cam.ac.uk> +Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> + +--- + drivers/hwmon/sht15.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/hwmon/sht15.c ++++ b/drivers/hwmon/sht15.c +@@ -333,11 +333,11 @@ static inline int sht15_calc_humid(struc + + const int c1 = -4; + const int c2 = 40500; /* x 10 ^ -6 */ +- const int c3 = -2800; /* x10 ^ -9 */ ++ const int c3 = -28; /* x 10 ^ -7 */ + + RHlinear = c1*1000 + + c2 * data->val_humid/1000 +- + (data->val_humid * data->val_humid * c3)/1000000; ++ + (data->val_humid * data->val_humid * c3) / 10000; + return (temp - 25000) * (10000 + 80 * data->val_humid) + / 1000000 + RHlinear; + } |