commit c3b92c8787367a8bb53d57d9789b558f1295cc96 Author: Linus Torvalds Date: Mon Oct 24 09:10:05 2011 +0200 Linux 3.1 commit 6a0596583fadd15dca293736114abdea306d3d7c Merge: 15cc91011246 4399c8bf2b90 Author: Linus Torvalds Date: Mon Oct 24 07:08:24 2011 +0200 Merge git://git.infradead.org/iommu-2.6 * git://git.infradead.org/iommu-2.6: intel-iommu: fix superpage support in pfn_to_dma_pte() intel-iommu: set iommu_superpage on VM domains to lowest common denominator intel-iommu: fix return value of iommu_unmap() API MAINTAINERS: Update VT-d entry for drivers/pci -> drivers/iommu move intel-iommu: Export a flag indicating that the IOMMU is used for iGFX. intel-iommu: Workaround IOTLB hang on Ironlake GPU intel-iommu: Fix AB-BA lockdep report commit 15cc91011246fa67f755eb3feea08d57a7692fde Merge: 8548c84da2f4 d136f2efdf3a Author: Linus Torvalds Date: Mon Oct 24 07:05:38 2011 +0200 Merge branch 'for-linus' of http://people.redhat.com/agk/git/linux-dm * 'for-linus' of http://people.redhat.com/agk/git/linux-dm: dm kcopyd: fix job_pool leak commit 8548c84da2f47e71bbbe300f55edb768492575f7 Author: Takashi Iwai Date: Sun Oct 23 23:19:12 2011 +0200 x86: Fix S4 regression Commit 4b239f458 ("x86-64, mm: Put early page table high") causes a S4 regression since 2.6.39, namely the machine reboots occasionally at S4 resume. It doesn't happen always, overall rate is about 1/20. But, like other bugs, once when this happens, it continues to happen. This patch fixes the problem by essentially reverting the memory assignment in the older way. Signed-off-by: Takashi Iwai Cc: Cc: Rafael J. Wysocki Cc: Yinghai Lu [ We'll hopefully find the real fix, but that's too late for 3.1 now ] Signed-off-by: Linus Torvalds commit d136f2efdf3a4faba47f58603f8ace2207234d75 Author: Alasdair G Kergon Date: Sun Oct 23 20:55:17 2011 +0100 dm kcopyd: fix job_pool leak Fix memory leak introduced by commit a6e50b409d3f9e0833e69c3c9cca822e8fa4adbb (dm snapshot: skip reading origin when overwriting complete chunk). When allocating a set of jobs from kc->job_pool, job->master_job must be set (to point to itself) so that the mempool item gets freed when the master_job completes. master_job was introduced by commit c6ea41fbbe08f270a8edef99dc369faf809d1bd6 (dm kcopyd: preallocate sub jobs to avoid deadlock) Reported-by: Michael Leun Cc: Mikulas Patocka Signed-off-by: Alasdair G Kergon commit 1bf1aacedcda23c75e70fa3394e1caa6d4b5ee49 Merge: 5117cc25fd43 fb630b9fc902 Author: Linus Torvalds Date: Sun Oct 23 10:44:40 2011 +0300 Merge branch 'samsung-fixes-4' of git://github.com/kgene/linux-samsung * 'samsung-fixes-4' of git://github.com/kgene/linux-samsung: ARM: S3C24XX: Fix s3c24xx build errors if !CONFIG_PM ARM: S5P: fix offset calculation on gpio-interrupt commit 5117cc25fd43add94c04c9d2ace713c69a21bdb1 Merge: 2efd7c0fdcbe 133d324d82e1 Author: Linus Torvalds Date: Sun Oct 23 10:43:31 2011 +0300 Merge branch 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging * 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (w83627ehf) Fix negative 8-bit temperature values commit fb630b9fc902e24209166b1659a8b375bf38099c Author: Domenico Andreoli Date: Sat Oct 22 04:00:53 2011 +0900 ARM: S3C24XX: Fix s3c24xx build errors if !CONFIG_PM v2: - register_syscore_ops(&s3c24xx_irq_syscore_ops) does not need to be conditionally compiled out, it is already optimized out on !CONFIG_PM - fix also s3c2412 and s3c2416 affected by the same build issue v1: s3c2440.c fails to build if !CONFIG_PM because in such case s3c2410_pm_syscore_ops is not defined. Same error should happen also in s3c2410.c and s3c2442.c Signed-off-by: Domenico Andreoli Signed-off-by: Kukjin Kim commit 2efd7c0fdcbe041173e248ccc2d9c91df7f84ce5 Merge: 62ddc0046eae 7ed47b7d142e Author: Linus Torvalds Date: Fri Oct 21 17:02:18 2011 +0300 Merge git://github.com/herbertx/crypto * git://github.com/herbertx/crypto: crypto: ghash - Avoid null pointer dereference if no key is set commit 62ddc0046eae6b8e8374f0ac3b27b12a57baa2f6 Merge: fd11e153b82a ca201c096269 Author: Linus Torvalds Date: Fri Oct 21 17:01:21 2011 +0300 Merge branch 'fix/hda' of git://github.com/tiwai/sound * 'fix/hda' of git://github.com/tiwai/sound: ALSA: HDA: conexant support for Lenovo T520/W520 ALSA: hda - Add position_fix quirk for Dell Inspiron 1010 commit 7ed47b7d142ec99ad6880bbbec51e9f12b3af74c Author: Nick Bowler Date: Thu Oct 20 14:16:55 2011 +0200 crypto: ghash - Avoid null pointer dereference if no key is set The ghash_update function passes a pointer to gf128mul_4k_lle which will be NULL if ghash_setkey is not called or if the most recent call to ghash_setkey failed to allocate memory. This causes an oops. Fix this up by returning an error code in the null case. This is trivially triggered from unprivileged userspace through the AF_ALG interface by simply writing to the socket without setting a key. The ghash_final function has a similar issue, but triggering it requires a memory allocation failure in ghash_setkey _after_ at least one successful call to ghash_update. BUG: unable to handle kernel NULL pointer dereference at 00000670 IP: [] gf128mul_4k_lle+0x23/0x60 [gf128mul] *pde = 00000000 Oops: 0000 [#1] PREEMPT SMP Modules linked in: ghash_generic gf128mul algif_hash af_alg nfs lockd nfs_acl sunrpc bridge ipv6 stp llc Pid: 1502, comm: hashatron Tainted: G W 3.1.0-rc9-00085-ge9308cf #32 Bochs Bochs EIP: 0060:[] EFLAGS: 00000202 CPU: 0 EIP is at gf128mul_4k_lle+0x23/0x60 [gf128mul] EAX: d69db1f0 EBX: d6b8ddac ECX: 00000004 EDX: 00000000 ESI: 00000670 EDI: d6b8ddac EBP: d6b8ddc8 ESP: d6b8dda4 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 Process hashatron (pid: 1502, ti=d6b8c000 task=d6810000 task.ti=d6b8c000) Stack: 00000000 d69db1f0 00000163 00000000 d6b8ddc8 c101a520 d69db1f0 d52aa000 00000ff0 d6b8dde8 d88d310f d6b8a3f8 d52aa000 00001000 d88d502c d6b8ddfc 00001000 d6b8ddf4 c11676ed d69db1e8 d6b8de24 c11679ad d52aa000 00000000 Call Trace: [] ? kmap_atomic_prot+0x37/0xa6 [] ghash_update+0x85/0xbe [ghash_generic] [] crypto_shash_update+0x18/0x1b [] shash_ahash_update+0x22/0x36 [] shash_async_update+0xb/0xd [] hash_sendpage+0xba/0xf2 [algif_hash] [] kernel_sendpage+0x39/0x4e [] ? 0xd88cdfff [] sock_sendpage+0x37/0x3e [] ? kernel_sendpage+0x4e/0x4e [] pipe_to_sendpage+0x56/0x61 [] splice_from_pipe_feed+0x58/0xcd [] ? splice_from_pipe_begin+0x10/0x10 [] __splice_from_pipe+0x36/0x55 [] ? splice_from_pipe_begin+0x10/0x10 [] splice_from_pipe+0x51/0x64 [] ? default_file_splice_write+0x2c/0x2c [] generic_splice_sendpage+0x13/0x15 [] ? splice_from_pipe_begin+0x10/0x10 [] do_splice_from+0x5d/0x67 [] sys_splice+0x2bf/0x363 [] ? sysenter_exit+0xf/0x16 [] ? trace_hardirqs_on_caller+0x10e/0x13f [] sysenter_do_call+0x12/0x32 Code: 83 c4 0c 5b 5e 5f c9 c3 55 b9 04 00 00 00 89 e5 57 8d 7d e4 56 53 8d 5d e4 83 ec 18 89 45 e0 89 55 dc 0f b6 70 0f c1 e6 04 01 d6 a5 be 0f 00 00 00 4e 89 d8 e8 48 ff ff ff 8b 45 e0 89 da 0f EIP: [] gf128mul_4k_lle+0x23/0x60 [gf128mul] SS:ESP 0068:d6b8dda4 CR2: 0000000000000670 ---[ end trace 4eaa2a86a8e2da24 ]--- note: hashatron[1502] exited with preempt_count 1 BUG: scheduling while atomic: hashatron/1502/0x10000002 INFO: lockdep is turned off. [...] Signed-off-by: Nick Bowler Cc: stable@kernel.org [2.6.37+] Signed-off-by: Herbert Xu commit 1052cff317e7636456595f2246b9f644c53eccbd Author: Marek Szyprowski Date: Fri Oct 21 18:04:54 2011 +0900 ARM: S5P: fix offset calculation on gpio-interrupt Offsets of the irq controller registers were calculated correctly only for first GPIO bank. This patch fixes calculation of the register offsets for all GPIO banks. Reported-by: Sylwester Nawrocki Signed-off-by: Marek Szyprowski Signed-off-by: Kyungmin Park Signed-off-by: Kukjin Kim commit fd11e153b82ad1c84ccc71ba1cfedc222465198c Merge: 505f48b53478 aad4564498dc Author: Linus Torvalds Date: Thu Oct 20 22:16:28 2011 +0300 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc: sparc: Add alignment flag to PCI expansion resources sparc: Avoid calling sigprocmask() sparc: Use set_current_blocked() sparc32,leon: SRMMU MMU Table probe fix commit 505f48b53478d3816d1f3b001815703cfd7afa09 Merge: 486cf46f3f9b afaef734e5f0 Author: Linus Torvalds Date: Thu Oct 20 22:15:20 2011 +0300 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: fib_rules: fix unresolved_rules counting r8169: fix wrong eee setting for rlt8111evl r8169: fix driver shutdown WoL regression. ehea: Change maintainer to me pptp: pptp_rcv_core() misses pskb_may_pull() call tproxy: copy transparent flag when creating a time wait pptp: fix skb leak in pptp_xmit() bonding: use local function pointer of bond->recv_probe in bond_handle_frame smsc911x: Add support for SMSC LAN89218 tg3: negate USE_PHYLIB flag check netconsole: enable netconsole can make net_device refcnt incorrent bluetooth: Properly clone LSM attributes to newly created child connections l2tp: fix a potential skb leak in l2tp_xmit_skb() bridge: fix hang on removal of bridge via netlink x25: Prevent skb overreads when checking call user data x25: Handle undersized/fragmented skbs x25: Validate incoming call user data lengths udplite: fast-path computation of checksum coverage IPVS netns shutdown/startup dead-lock netfilter: nf_conntrack: fix event flooding in GRE protocol tracker commit 133d324d82e144588939ad25b732b5b6c33b03d9 Author: Jean Delvare Date: Thu Oct 20 03:06:45 2011 -0400 hwmon: (w83627ehf) Fix negative 8-bit temperature values Since 8-bit temperature values are now handled in 16-bit struct members, values have to be cast to s8 for negative temperatures to be properly handled. This is broken since kernel version 2.6.39 (commit bce26c58df86599c9570cee83eac58bdaae760e4.) Signed-off-by: Jean Delvare Cc: Guenter Roeck Cc: stable@kernel.org # 2.6.39+ Signed-off-by: Guenter Roeck commit 486cf46f3f9be5f2a966016c1a8fe01e32cde09e Author: Hugh Dickins Date: Wed Oct 19 12:50:35 2011 -0700 mm: fix race between mremap and removing migration entry I don't usually pay much attention to the stale "? " addresses in stack backtraces, but this lucky report from Pawel Sikora hints that mremap's move_ptes() has inadequate locking against page migration. 3.0 BUG_ON(!PageLocked(p)) in migration_entry_to_page(): kernel BUG at include/linux/swapops.h:105! RIP: 0010:[] [] migration_entry_wait+0x156/0x160 [] handle_pte_fault+0xae1/0xaf0 [] ? __pte_alloc+0x42/0x120 [] ? do_huge_pmd_anonymous_page+0xab/0x310 [] handle_mm_fault+0x181/0x310 [] ? vma_adjust+0x537/0x570 [] do_page_fault+0x11d/0x4e0 [] ? do_mremap+0x2d5/0x570 [] page_fault+0x1f/0x30 mremap's down_write of mmap_sem, together with i_mmap_mutex or lock, and pagetable locks, were good enough before page migration (with its requirement that every migration entry be found) came in, and enough while migration always held mmap_sem; but not enough nowadays, when there's memory hotremove and compaction. The danger is that move_ptes() lets a migration entry dodge around behind remove_migration_pte()'s back, so it's in the old location when looking at the new, then in the new location when looking at the old. Either mremap's move_ptes() must additionally take anon_vma lock(), or migration's remove_migration_pte() must stop peeking for is_swap_entry() before it takes pagetable lock. Consensus chooses the latter: we prefer to add overhead to migration than to mremapping, which gets used by JVMs and by exec stack setup. Reported-and-tested-by: Paweł Sikora Signed-off-by: Hugh Dickins Acked-by: Andrea Arcangeli Acked-by: Mel Gorman Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds commit aad4564498dcb0aad769a79e5e2aa9a661dfb51f Author: Kjetil Oftedal Date: Wed Oct 19 16:20:50 2011 -0700 sparc: Add alignment flag to PCI expansion resources Currently no type of alignment is specified for PCI expansion roms while parsing the openfirmware tree. This causes calls to pci_map_rom() to fail. IORESOURCE_SIZEALIGN is the default alignment used for rom resouces in pci/probe.c, and has been verified to work with various cards on a ultra 10. Signed-off-By: Kjetil Oftedal Signed-off-by: David S. Miller commit afaef734e5f0004916d07ecf7d86292cdd00d59b Author: Yan, Zheng Date: Mon Oct 17 15:20:28 2011 +0000 fib_rules: fix unresolved_rules counting we should decrease ops->unresolved_rules when deleting a unresolved rule. Signed-off-by: Zheng Yan Acked-by: Eric Dumazet Signed-off-by: David S. Miller commit 1b23a3e3d1b969e285c57a2d38f3739283ecfb80 Author: hayeswang Date: Thu Oct 13 20:14:37 2011 +0000 r8169: fix wrong eee setting for rlt8111evl Correct the wrong parameter for setting EEE for RTL8111E-VL. Signed-off-by: Hayes Wang Signed-off-by: David S. Miller commit 649b3b8c4e8681de443b4dc9e387c3036369e02e Author: françois romieu Date: Fri Oct 14 00:57:45 2011 +0000 r8169: fix driver shutdown WoL regression. Due to commit 92fc43b4159b518f5baae57301f26d770b0834c9 ("r8169: modify the flow of the hw reset."), rtl8169_hw_reset stomps during driver shutdown on RxConfig bits which are needed for WOL on some versions of the hardware. As these bits were formerly set from the r81{0x, 68}_pll_power_down methods, factor them out for use in the driver shutdown (rtl_shutdown) handler. I favored __rtl8169_get_wol() -hardware state indication- over RTL_FEATURE_WOL as the latter has become a good candidate for removal. Signed-off-by: Francois Romieu Cc: Hayes Tested-by: Marc Ballarin Signed-off-by: David S. Miller commit 34b1901abdf8793cd679d0e48012d3d7570f88d6 Author: Thadeu Lima de Souza Cascardo Date: Thu Oct 13 09:56:19 2011 +0000 ehea: Change maintainer to me Breno Leitao has passed the maintainership to me. Signed-off-by: Thadeu Lima de Souza Cascardo Cc: Breno Leitao Acked-by: Breno Leitão Signed-off-by: David S. Miller commit e4fcd69c9e4e273352e0f87cabd9648606da0c3e Merge: f91f6cfd4f9e e58fced201ad Author: Linus Torvalds Date: Wed Oct 19 06:44:11 2011 -0700 Merge branch 'v4l_for_linus' of git://linuxtv.org/mchehab/for_linus * 'v4l_for_linus' of git://linuxtv.org/mchehab/for_linus: [media] videodev: fix a NULL pointer dereference in v4l2_device_release() commit f91f6cfd4f9ea794dc3d0bbd54cb1d29d6ef3843 Merge: bcd5cff7216f 5a6e8482a16e Author: Linus Torvalds Date: Wed Oct 19 06:43:24 2011 -0700 Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/radeon/kms/atom: fix handling of FB scratch indices drm/radeon/kms/DCE4.1: fix Select_CrtcSource EncodeMode setting for DP bridges (v2) drm/radeon/kms/DCE4.1: ss is not supported on the internal pplls drm/radeon/kms/DCE4.1: fix dig encoder to transmitter mapping ttm: Fix error-path using an uninitialized value commit e58fced201ad6e6cb673f07499919c3b20792d94 Author: Antonio Ospite Date: Wed Oct 12 17:59:26 2011 -0300 [media] videodev: fix a NULL pointer dereference in v4l2_device_release() The change in 8280b66 does not cover the case when v4l2_dev is already NULL, fix that. With a Kinect sensor, seen as an USB camera using GSPCA in this context, a NULL pointer dereference BUG can be triggered by just unplugging the device after the camera driver has been loaded. Signed-off-by: Antonio Ospite Signed-off-by: Mauro Carvalho Chehab commit 4399c8bf2b9093696fa8160d79712e7346989c46 Author: Allen Kay Date: Fri Oct 14 12:32:46 2011 -0700 intel-iommu: fix superpage support in pfn_to_dma_pte() If target_level == 0, current code breaks out of the while-loop if SUPERPAGE bit is set. We should also break out if PTE is not present. If we don't do this, KVM calls to iommu_iova_to_phys() will cause pfn_to_dma_pte() to create mapping for 4KiB pages. Signed-off-by: Allen Kay Signed-off-by: David Woodhouse commit 8140a95d228efbcd64d84150e794761a32463947 Author: Allen Kay Date: Fri Oct 14 12:32:17 2011 -0700 intel-iommu: set iommu_superpage on VM domains to lowest common denominator set dmar->iommu_superpage field to the smallest common denominator of super page sizes supported by all active VT-d engines. Initialize this field in intel_iommu_domain_init() API so intel_iommu_map() API will be able to use iommu_superpage field to determine the appropriate super page size to use. Signed-off-by: Allen Kay Signed-off-by: David Woodhouse commit 292827cb164ad00cc7689a21283b1261c0b6daed Author: Allen Kay Date: Fri Oct 14 12:31:54 2011 -0700 intel-iommu: fix return value of iommu_unmap() API iommu_unmap() API expects IOMMU drivers to return the actual page order of the address being unmapped. Previous code was just returning page order passed in from the caller. This patch fixes this problem. Signed-off-by: Allen Kay Signed-off-by: David Woodhouse commit 3fb39615007d0645ad7f3a509d7120a1987d95b2 Author: Roland Dreier Date: Mon Oct 10 17:07:15 2011 -0700 MAINTAINERS: Update VT-d entry for drivers/pci -> drivers/iommu move Commit 166e9278a3f9 ("x86/ia64: intel-iommu: move to drivers/iommu/") moved the VT-d driver to drivers/iommu, but left the "F:" line in MAINTAINERS pointing to drivers/pci, which breaks scripts/get_maintainer.pl. Signed-off-by: Roland Dreier Signed-off-by: David Woodhouse commit 5a6e8482a16e61250a9121fc9ec719ab0529e760 Author: Alex Deucher Date: Tue Oct 18 20:10:05 2011 -0400 drm/radeon/kms/atom: fix handling of FB scratch indices FB scratch indices are dword indices, but we were treating them as byte indices. As such, we were getting the wrong FB scratch data for non-0 indices. Fix the indices and guard the indexing against indices larger than the scratch allocation. Fixes memory corruption on some boards if data was written past the end of the FB scratch array. Signed-off-by: Alex Deucher Reported-by: Dave Airlie Tested-by: Dave Airlie Cc: stable@kernel.org Signed-off-by: Dave Airlie commit 4ea2739ea89883ddf79980a8aa27d5e57093e464 Author: Eric Dumazet Date: Mon Oct 17 17:59:53 2011 +0000 pptp: pptp_rcv_core() misses pskb_may_pull() call e1000e uses paged frags, so any layer incorrectly pulling bytes from skb can trigger a BUG in skb_pull() [951.142737] [] skb_pull+0x15/0x17 [951.142737] [] pptp_rcv_core+0x126/0x19a [pptp] [951.152725] [] sk_receive_skb+0x69/0x105 [951.163558] [] pptp_rcv+0xc8/0xdc [pptp] [951.165092] [] gre_rcv+0x62/0x75 [gre] [951.165092] [] ip_local_deliver_finish+0x150/0x1c1 [951.177599] [] ? ip_local_deliver_finish+0x0/0x1c1 [951.177599] [] NF_HOOK.clone.7+0x51/0x58 [951.177599] [] ip_local_deliver+0x51/0x55 [951.177599] [] ip_rcv_finish+0x31a/0x33e [951.177599] [] ? ip_rcv_finish+0x0/0x33e [951.204898] [] NF_HOOK.clone.7+0x51/0x58 [951.214651] [] ip_rcv+0x21b/0x246 pptp_rcv_core() is a nice example of a function assuming everything it needs is available in skb head. Reported-by: Bradley Peterson Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 58af19e387d8821927e49be3f467da5e6a0aa8fd Author: KOVACS Krisztian Date: Tue Oct 18 10:17:35 2011 +0000 tproxy: copy transparent flag when creating a time wait The transparent socket option setting was not copied to the time wait socket when an inet socket was being replaced by a time wait socket. This broke the --transparent option of the socket match and may have caused that FIN packets belonging to sockets in FIN_WAIT2 or TIME_WAIT state were being dropped by the packet filter. Signed-off-by: KOVACS Krisztian Signed-off-by: David S. Miller commit 8bae8bd6cb24eecad9fda3e125d36ab9c67d3fd7 Author: Eric Dumazet Date: Mon Oct 17 17:01:47 2011 +0000 pptp: fix skb leak in pptp_xmit() In case we cant transmit skb, we must free it Signed-off-by: Eric Dumazet CC: Dmitry Kozlov Signed-off-by: David S. Miller commit 4d97480b1806e883eb1c7889d4e7a87e936e06d9 Author: Mitsuo Hayasaka Date: Wed Oct 12 16:04:29 2011 +0000 bonding: use local function pointer of bond->recv_probe in bond_handle_frame The bond->recv_probe is called in bond_handle_frame() when a packet is received, but bond_close() sets it to NULL. So, a panic occurs when both functions work in parallel. Why this happen: After null pointer check of bond->recv_probe, an sk_buff is duplicated and bond->recv_probe is called in bond_handle_frame. So, a panic occurs when bond_close() is called between the check and call of bond->recv_probe. Patch: This patch uses a local function pointer of bond->recv_probe in bond_handle_frame(). So, it can avoid the null pointer dereference. Signed-off-by: Mitsuo Hayasaka Cc: Jay Vosburgh Cc: Andy Gospodarek Cc: Eric Dumazet Cc: WANG Cong Acked-by: Eric Dumazet Signed-off-by: David S. Miller commit 28c213793c994e4aac5f669ce856b5682a549bbb Author: Phil Edworthy Date: Wed Oct 12 02:29:39 2011 +0000 smsc911x: Add support for SMSC LAN89218 LAN89218 is register compatible with LAN911x. Signed-off-by: Phil Edworthy Signed-off-by: David S. Miller commit e730c82347b9dc75914da998c44c3f348965db41 Author: Jiri Pirko Date: Tue Oct 11 23:00:41 2011 +0000 tg3: negate USE_PHYLIB flag check USE_PHYLIB flag in tg3_remove_one() is being checked incorrectly. This results tg3_phy_fini->phy_disconnect is never called and when tg3 module is removed. In my case this resulted in panics in phy_state_machine calling function phydev->adjust_link. So correct this check. Signed-off-by: Jiri Pirko Acked-by: Matt Carlson Signed-off-by: David S. Miller commit d5123480b1d6f7d1a5fe1a13520cef88fb5d4c84 Author: Gao feng Date: Tue Oct 11 16:08:11 2011 +0000 netconsole: enable netconsole can make net_device refcnt incorrent There is no check if netconsole is enabled current. so when exec echo 1 > enabled; the reference of net_device will increment always. Signed-off-by: Gao feng Acked-by: Flavio Leitner Signed-off-by: David S. Miller commit 6230c9b4f8957c8938ee4cf2d03166d3c2dc89de Author: Paul Moore Date: Fri Oct 7 09:40:59 2011 +0000 bluetooth: Properly clone LSM attributes to newly created child connections The Bluetooth stack has internal connection handlers for all of the various Bluetooth protocols, and unfortunately, they are currently lacking the LSM hooks found in the core network stack's connection handlers. I say unfortunately, because this can cause problems for users who have have an LSM enabled and are using certain Bluetooth devices. See one problem report below: * http://bugzilla.redhat.com/show_bug.cgi?id=741703 In order to keep things simple at this point in time, this patch fixes the problem by cloning the parent socket's LSM attributes to the newly created child socket. If we decide we need a more elaborate LSM marking mechanism for Bluetooth (I somewhat doubt this) we can always revisit this decision in the future. Reported-by: James M. Cape Signed-off-by: Paul Moore Acked-by: James Morris Signed-off-by: David S. Miller commit 835acf5da239b91edb9f7ebe36516999e156e6ee Author: Eric Dumazet Date: Fri Oct 7 05:35:46 2011 +0000 l2tp: fix a potential skb leak in l2tp_xmit_skb() l2tp_xmit_skb() can leak one skb if skb_cow_head() returns an error. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 1ce5cce895309862d2c35d922816adebe094fe4a Author: stephen hemminger Date: Thu Oct 6 11:19:41 2011 +0000 bridge: fix hang on removal of bridge via netlink Need to cleanup bridge device timers and ports when being bridge device is being removed via netlink. This fixes the problem of observed when doing: ip link add br0 type bridge ip link set dev eth1 master br0 ip link set br0 up ip link del br0 which would cause br0 to hang in unregister_netdev because of leftover reference count. Reported-by: Sridhar Samudrala Signed-off-by: Stephen Hemminger Acked-by: Sridhar Samudrala Signed-off-by: David S. Miller commit bcd5cff7216f9b2de0a148cc355eac199dc6f1cf Author: Peter Zijlstra Date: Mon Oct 17 11:50:30 2011 +0200 cputimer: Cure lock inversion There's a lock inversion between the cputimer->lock and rq->lock; notably the two callchains involved are: update_rlimit_cpu() sighand->siglock set_process_cpu_timer() cpu_timer_sample_group() thread_group_cputimer() cputimer->lock thread_group_cputime() task_sched_runtime() ->pi_lock rq->lock scheduler_tick() rq->lock task_tick_fair() update_curr() account_group_exec() cputimer->lock Where the first one is enabling a CLOCK_PROCESS_CPUTIME_ID timer, and the second one is keeping up-to-date. This problem was introduced by e8abccb7193 ("posix-cpu-timers: Cure SMP accounting oddities"). Cure the problem by removing the cputimer->lock and rq->lock nesting, this leaves concurrent enablers doing duplicate work, but the time wasted should be on the same order otherwise wasted spinning on the lock and the greater-than assignment filter should ensure we preserve monotonicity. Reported-by: Dave Jones Reported-by: Simon Kirby Signed-off-by: Peter Zijlstra Cc: stable@kernel.org Cc: Linus Torvalds Cc: Martin Schwidefsky Link: http://lkml.kernel.org/r/1318928713.21167.4.camel@twins Signed-off-by: Thomas Gleixner commit a4863ca93ccc52a83e7fbfc068b411b7faa03805 Author: Alex Deucher Date: Wed Oct 12 18:49:53 2011 -0400 drm/radeon/kms/DCE4.1: fix Select_CrtcSource EncodeMode setting for DP bridges (v2) Settings in this table reflect the physical panel/connector rather than the internal dig encoding. v2: fix typo for DRM_MODE_CONNECTOR_VGA case. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie commit 09cc6506f9e234b2ead60398ebb88c4b44421a93 Author: Alex Deucher Date: Wed Oct 12 18:44:33 2011 -0400 drm/radeon/kms/DCE4.1: ss is not supported on the internal pplls It's handled via external clock. It should already be protected by the external ss flag, but add an explicit check just in case. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie commit 3a6dea31453a101bd5e9e9c89a79f4fcb6b0342e Author: Alex Deucher Date: Wed Oct 12 18:44:32 2011 -0400 drm/radeon/kms/DCE4.1: fix dig encoder to transmitter mapping llano has fully routeable dig encoders similar to DCE3.2 while ontario has a hardcoded mapping similar to DCE4.0. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie commit ca201c096269ee2d40037fea96a59fd0695888c4 Author: Daniel Suchy Date: Tue Oct 18 11:09:44 2011 +0200 ALSA: HDA: conexant support for Lenovo T520/W520 This is patch for Conexant codec of Intel HDA driver, adding new quirk for Lenovo Thinkpad T520 and W520. Conexant autodetection works fine for T520 (similar subsystem ID is used also in W520 model) and detects more mixer features compared to generic (fallback) Lenovo quirk with hardcoded options in Conexant codec. Patch was activelly tested with Linux 3.0.4, 3.0.6 and 3.0.7 without any problems. Signed-off-by: Daniel Suchy Cc: [3.0+] Signed-off-by: Takashi Iwai commit 051a8cb6550d917225ead1cd008b5966350f6d53 Author: Takashi Iwai Date: Tue Oct 18 10:44:05 2011 +0200 ALSA: hda - Add position_fix quirk for Dell Inspiron 1010 The previous fix for the position-buffer check gives yet another regression on a Dell laptop. The safest fix right now is to add a static quirk for this device (and better to apply it for stable kernels too). Reported-by: Éric Piel Cc: Signed-off-by: Takashi Iwai commit e22469ca88a8f1f6fe47adbf5e5ce0906aec07cd Author: Thomas Hellstrom Date: Mon Oct 17 13:27:34 2011 +0200 ttm: Fix error-path using an uninitialized value Pointed out by Michel Daenzer. Signed-off-by: Thomas Hellstrom Signed-off-by: Dave Airlie commit 899e3ee404961a90b828ad527573aaaac39f0ab1 Author: Linus Torvalds Date: Mon Oct 17 21:06:23 2011 -0700 Linux 3.1-rc10 commit ae2a4583154a5b985ed4a81c6259c55bafe6d810 Merge: 7f81e25befdf ae1d48b23d5e Author: David S. Miller Date: Mon Oct 17 19:38:03 2011 -0400 Merge branch 'nf' of git://1984.lsi.us.es/net commit 7f81e25befdfb3272345a2e775f520e1d515fa20 Author: Matthew Daley Date: Fri Oct 14 18:45:05 2011 +0000 x25: Prevent skb overreads when checking call user data x25_find_listener does not check that the amount of call user data given in the skb is big enough in per-socket comparisons, hence buffer overreads may occur. Fix this by adding a check. Signed-off-by: Matthew Daley Cc: Eric Dumazet Cc: Andrew Hendry Cc: stable Acked-by: Andrew Hendry Signed-off-by: David S. Miller commit cb101ed2c3c7c0224d16953fe77bfb9d6c2cb9df Author: Matthew Daley Date: Fri Oct 14 18:45:04 2011 +0000 x25: Handle undersized/fragmented skbs There are multiple locations in the X.25 packet layer where a skb is assumed to be of at least a certain size and that all its data is currently available at skb->data. These assumptions are not checked, hence buffer overreads may occur. Use pskb_may_pull to check these minimal size assumptions and ensure that data is available at skb->data when necessary, as well as use skb_copy_bits where needed. Signed-off-by: Matthew Daley Cc: Eric Dumazet Cc: Andrew Hendry Cc: stable Acked-by: Andrew Hendry Signed-off-by: David S. Miller commit c7fd0d48bde943e228e9c28ce971a22d6a1744c4 Author: Matthew Daley Date: Fri Oct 14 18:45:03 2011 +0000 x25: Validate incoming call user data lengths X.25 call user data is being copied in its entirety from incoming messages without consideration to the size of the destination buffers, leading to possible buffer overflows. Validate incoming call user data lengths before these copies are performed. It appears this issue was noticed some time ago, however nothing seemed to come of it: see http://www.spinics.net/lists/linux-x25/msg00043.html and commit 8db09f26f912f7c90c764806e804b558da520d4f. Signed-off-by: Matthew Daley Acked-by: Eric Dumazet Tested-by: Andrew Hendry Cc: stable Signed-off-by: David S. Miller commit f36c23bb9f822904dacf83a329518d0a5fde7968 Author: Gerrit Renker Date: Mon Oct 17 19:07:30 2011 -0400 udplite: fast-path computation of checksum coverage Commit 903ab86d195cca295379699299c5fc10beba31c7 of 1 March this year ("udp: Add lockless transmit path") introduced a new fast TX path that broke the checksum coverage computation of UDP-lite, which so far depended on up->len (only set if the socket is locked and 0 in the fast path). Fixed by providing both fast- and slow-path computation of checksum coverage. The latter can be removed when UDP(-lite)v6 also uses a lockless transmit path. Reported-by: Thomas Volkert Signed-off-by: Gerrit Renker Signed-off-by: David S. Miller commit a84a79e4d369a73c0130b5858199e949432da4c6 Author: Linus Torvalds Date: Mon Oct 17 08:24:24 2011 -0700 Avoid using variable-length arrays in kernel/sys.c The size is always valid, but variable-length arrays generate worse code for no good reason (unless the function happens to be inlined and the compiler sees the length for the simple constant it is). Also, there seems to be some code generation problem on POWER, where Henrik Bakken reports that register r28 can get corrupted under some subtle circumstances (interrupt happening at the wrong time?). That all indicates some seriously broken compiler issues, but since variable length arrays are bad regardless, there's little point in trying to chase it down. "Just don't do that, then". Reported-by: Henrik Grindal Bakken Cc: Benjamin Herrenschmidt Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit 8bc03e8f3a334e09e89a7dffb486ee97a5ce84ae Merge: 4c41042d1d4c f8be12d15374 Author: Linus Torvalds Date: Sun Oct 16 13:08:27 2011 -0700 Merge branch 'fixes' of http://ftp.arm.linux.org.uk/pub/linux/arm/kernel/git-cur/linux-2.6-arm * 'fixes' of http://ftp.arm.linux.org.uk/pub/linux/arm/kernel/git-cur/linux-2.6-arm: ARM: 7128/1: vic: Don't write to the read-only register VIC_IRQ_STATUS ARM: 7122/1: localtimer: add header linux/errno.h explicitly ARM: 7117/1: perf: fix HW_CACHE_* events on Cortex-A9 ARM: 7113/1: mm: Align bank start to MAX_ORDER_NR_PAGES commit f8be12d15374413cf437741a282e97129e759209 Author: Zoltan Devai Date: Mon Oct 10 14:54:12 2011 +0100 ARM: 7128/1: vic: Don't write to the read-only register VIC_IRQ_STATUS This is unneeded and causes an abort on the SPMP8000 platform. Acked-by: Linus Walleij Signed-off-by: Zoltan Devai Signed-off-by: Russell King commit bb1ac3ec95cf0cce5145617b140f2090ed45d565 Author: Shawn Guo Date: Thu Oct 6 14:57:24 2011 +0100 ARM: 7122/1: localtimer: add header linux/errno.h explicitly Per the text in Documentation/SubmitChecklist as below, we should explicitly have header linux/errno.h in localtimer.h for ENXIO reference. 1: If you use a facility then #include the file that defines/declares that facility. Don't depend on other header files pulling in ones that you use. Otherwise, we may run into some compiling error like the following one, if any file includes localtimer.h without CONFIG_LOCAL_TIMERS defined. arch/arm/include/asm/localtimer.h: In function ‘local_timer_setup’: arch/arm/include/asm/localtimer.h:53:10: error: ‘ENXIO’ undeclared (first use in this function) Signed-off-by: Shawn Guo Signed-off-by: Russell King commit 29a541f6c1f6e4a85628bb86071b9e72c9f8be2c Author: Will Deacon Date: Mon Oct 3 18:30:53 2011 +0100 ARM: 7117/1: perf: fix HW_CACHE_* events on Cortex-A9 Using COHERENT_LINE_{MISS,HIT} for cache misses and references respectively is completely wrong. Instead, use the L1D events which are a better and more useful approximation despite ignoring instruction traffic. Reported-by: Alasdair Grant Reported-by: Matt Horsnell Reported-by: Michael Williams Cc: stable@kernel.org Cc: Jean Pihet Signed-off-by: Will Deacon Signed-off-by: Russell King commit 4c41042d1d4c29e596b31e2d14b26d2940fb24b4 Merge: e9308cfd5ab4 bf164c58e583 Author: Linus Torvalds Date: Sat Oct 15 08:29:09 2011 +1200 Merge branch 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging * 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (w83627ehf) Properly report thermal diode sensors commit c0771df8d5297bfb9c4fbe8ada085a49cb22ec4f Author: David Woodhouse Date: Fri Oct 14 20:59:46 2011 +0100 intel-iommu: Export a flag indicating that the IOMMU is used for iGFX. We really don't want this to work in the general case; device drivers *shouldn't* care whether they are behind an IOMMU or not. But the integrated graphics is a special case, because the IOMMU and the GTT are all kind of smashed into one and generally horrifically buggy, so it's reasonable for the graphics driver to want to know when the IOMMU is active for the graphics hardware. Signed-off-by: David Woodhouse commit 6fbcfb3e467adb414e235eeefaeaf51ad12f2461 Author: David Woodhouse Date: Sun Sep 25 19:11:14 2011 -0700 intel-iommu: Workaround IOTLB hang on Ironlake GPU To work around a hardware issue, we have to submit IOTLB flushes while the graphics engine is idle. The graphics driver will (we hope) go to great lengths to ensure that it gets that right on the affected chipset(s)... so let's not screw it over by deferring the unmap and doing it later. That wouldn't be very helpful. Signed-off-by: David Woodhouse commit e9308cfd5ab4ade3d81cf591c7599c3a05a21b04 Merge: 480082968a78 25fcf2b7f1f6 Author: Linus Torvalds Date: Fri Oct 14 17:07:52 2011 +1200 Merge branch 'gpio/merge' of git://git.secretlab.ca/git/linux-2.6 * 'gpio/merge' of git://git.secretlab.ca/git/linux-2.6: gpio-pca953x: fix gpio_base gpio/omap: fix build error with certain OMAP1 configs commit 480082968a78151e731ebd304eeb6cada61a1cd1 Merge: 95bc156c62a5 0030807c66f0 Author: Linus Torvalds Date: Fri Oct 14 17:06:39 2011 +1200 Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs * 'for-linus' of git://oss.sgi.com/xfs/xfs: xfs: revert to using a kthread for AIL pushing xfs: force the log if we encounter pinned buffers in .iop_pushbuf xfs: do not update xa_last_pushed_lsn for locked items commit 95bc156c62a57cda1b225e03ae23eb2764ee1046 Merge: 2ad53110d654 d52104b29a37 Author: Linus Torvalds Date: Fri Oct 14 16:59:11 2011 +1200 Merge branch 'stable' of git://github.com/cmetcalf-tilera/linux-tile * 'stable' of git://github.com/cmetcalf-tilera/linux-tile: tile: revert change from to in asm files commit 2ad53110d654c7c9a80dcea341f4117246c1b6f9 Merge: 153b19a3b9fd 2b666859ec32 Author: Linus Torvalds Date: Fri Oct 14 16:54:56 2011 +1200 Merge branch 'x86-urgent-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip * 'x86-urgent-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip: x86: Default to vsyscall=native for now commit 153b19a3b9fd8b9478495b9ee1f93f6a77c564f9 Author: Mika Westerberg Date: Thu Oct 13 12:04:20 2011 +0300 x86, mrst: use a temporary variable for SFI irq SFI tables reside in RAM and should not be modified once they are written. Current code went to set pentry->irq to zero which causes subsequent reads to fail with invalid SFI table checksum. This will break kexec as the second kernel fails to validate SFI tables. To fix this we use temporary variable for irq number. Signed-off-by: Mika Westerberg Reviewed-by: Kirill A. Shutemov Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit bf164c58e58328c40ebc597a8ac00cc6840f9703 Author: Jean Delvare Date: Thu Oct 13 15:49:08 2011 -0400 hwmon: (w83627ehf) Properly report thermal diode sensors The w83627ehf driver is improperly reporting thermal diode sensors as type 2, instead of 3. This caused "sensors" and possibly other monitoring tools to report these sensors as "transistor" instead of "thermal diode". Furthermore, diode subtype selection (CPU vs. external) is only supported by the original W83627EHF/EHG. All later models only support CPU diode type, and some (NCT6776F) don't even have the register in question so we should avoid reading from it. Signed-off-by: Jean Delvare Cc: stable@kernel.org Signed-off-by: Guenter Roeck commit 25fcf2b7f1f65d2cc12182ced3ccd47576970be4 Author: Hartmut Knaack Date: Tue Oct 11 00:22:45 2011 +0200 gpio-pca953x: fix gpio_base gpio_base was set to 0 if no system platform data or open firmware platform data was provided. This led to conflicts, if any other gpiochip with a gpiobase of 0 was instantiated already. Setting it to -1 will automatically use the first one available. Signed-off-by: Hartmut Knaack Signed-off-by: Grant Likely commit 78a43158724793f9dc25f1e4c866393654704b87 Author: Janusz Krzysztofik Date: Tue Aug 23 13:42:24 2011 +0200 gpio/omap: fix build error with certain OMAP1 configs With commit f64ad1a0e21a, "gpio/omap: cleanup _set_gpio_wakeup(), remove ifdefs", access to build time conditionally omitted 'suspend_wakeup' member of the 'gpio_bank' structure has been placed unconditionally in function _set_gpio_wakeup(), which is always built. This resulted in the driver compilation broken for certain OMAP1, i.e., non-OMAP16xx, configurations. Really required or not in previously excluded cases, define this structure member unconditionally as a fix. Tested with a custom OMAP1510 only configuration. Signed-off-by: Janusz Krzysztofik Acked-by: Kevin Hilman Tested-by: Aaro Koskinen Signed-off-by: Grant Likely commit d52104b29a3735f2b4dceefcb01b19d370a783ea Author: Chris Metcalf Date: Wed Oct 5 17:09:29 2011 -0400 tile: revert change from to in asm files The 32-bit TILEPro support uses some #defines in for atomic support routines in assembly. To make this more explicit, I've turned those includes into includes of , which should hopefully make it clear that they shouldn't be bombed into in any cleanups. Signed-off-by: Chris Metcalf commit 37cf95162af4036b4198756a590aab8126fa2ce4 Merge: 1d1136012163 a3a4bfde8a27 Author: Linus Torvalds Date: Thu Oct 13 18:25:45 2011 +1200 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: mscan: too much data copied to CAN frame due to 16 bit accesses gro: refetch inet6_protos[] after pulling ext headers bnx2x: fix cl_id allocation for non-eth clients for NPAR mode mlx4_en: fix endianness with blue frame support commit 1d1136012163ab5e33a97f9779af269cf4049cb9 Author: Johann Felix Soden Date: Mon Oct 10 11:37:00 2011 -0700 ide: Fix file references in drivers/ide/ Fix file references in drivers/ide/ There are a lot of file references to now moved or deleted files in the whole tree, especially in documentation and Kconfig files. This patch fixes the references in drivers/ide/. Signed-off-by: Johann Felix Soden Signed-off-by: Randy Dunlap Acked-by: David S. Miller Signed-off-by: Linus Torvalds commit b2f9452bd5234d573898bbda52a410b154f8f510 Merge: 65112dccf8a1 f7f43cc84152 Author: Linus Torvalds Date: Thu Oct 13 18:20:40 2011 +1200 Merge branch 'btrfs-3.0' of git://github.com/chrismason/linux * 'btrfs-3.0' of git://github.com/chrismason/linux: Btrfs: make sure not to defrag extents past i_size Btrfs: fix recursive auto-defrag commit 27f20dca01b00eac445e5193565dd185548e7e34 Author: David S. Miller Date: Wed Oct 12 12:27:35 2011 -0700 sparc: Avoid calling sigprocmask() Use set_current_blocked() instead. Signed-off-by: David S. Miller commit faddf598f0ba98ba329bb83acad51aea40313c2a Author: Matt Fleming Date: Thu Aug 11 14:57:02 2011 +0100 sparc: Use set_current_blocked() As described in e6fa16ab ("signal: sigprocmask() should do retarget_shared_pending()") the modification of current->blocked is incorrect as we need to check whether the signal we're about to block is pending in the shared queue. Cc: Oleg Nesterov Cc: "David S. Miller" Signed-off-by: Matt Fleming Signed-off-by: David S. Miller commit ae1d48b23d5e79efbcf0cef4f0ebb9742361af59 Author: Hans Schillstrom Date: Tue Oct 11 10:54:35 2011 +0900 IPVS netns shutdown/startup dead-lock ip_vs_mutext is used by both netns shutdown code and startup and both implicit uses sk_lock-AF_INET mutex. cleanup CPU-1 startup CPU-2 ip_vs_dst_event() ip_vs_genl_set_cmd() sk_lock-AF_INET __ip_vs_mutex sk_lock-AF_INET __ip_vs_mutex * DEAD LOCK * A new mutex placed in ip_vs netns struct called sync_mutex is added. Comments from Julian and Simon added. This patch has been running for more than 3 month now and it seems to work. Ver. 3 IP_VS_SO_GET_DAEMON in do_ip_vs_get_ctl protected by sync_mutex instead of __ip_vs_mutex as sugested by Julian. Signed-off-by: Hans Schillstrom Acked-by: Julian Anastasov Signed-off-by: Simon Horman Signed-off-by: Pablo Neira Ayuso commit 0030807c66f058230bcb20d2573bcaf28852e804 Author: Christoph Hellwig Date: Tue Oct 11 11:14:10 2011 -0400 xfs: revert to using a kthread for AIL pushing Currently we have a few issues with the way the workqueue code is used to implement AIL pushing: - it accidentally uses the same workqueue as the syncer action, and thus can be prevented from running if there are enough sync actions active in the system. - it doesn't use the HIGHPRI flag to queue at the head of the queue of work items At this point I'm not confident enough in getting all the workqueue flags and tweaks right to provide a perfectly reliable execution context for AIL pushing, which is the most important piece in XFS to make forward progress when the log fills. Revert back to use a kthread per filesystem which fixes all the above issues at the cost of having a task struct and stack around for each mounted filesystem. In addition this also gives us much better ways to diagnose any issues involving hung AIL pushing and removes a small amount of code. Signed-off-by: Christoph Hellwig Reported-by: Stefan Priebe Tested-by: Stefan Priebe Reviewed-by: Dave Chinner Signed-off-by: Alex Elder commit 17b38471c3c07a49f0bbc2ecc2e92050c164e226 Author: Christoph Hellwig Date: Tue Oct 11 15:14:09 2011 +0000 xfs: force the log if we encounter pinned buffers in .iop_pushbuf We need to check for pinned buffers even in .iop_pushbuf given that inode items flush into the same buffers that may be pinned directly due operations on the unlinked inode list operating directly on buffers. To do this add a return value to .iop_pushbuf that tells the AIL push about this and use the existing log force mechanisms to unpin it. Signed-off-by: Christoph Hellwig Reported-by: Stefan Priebe Tested-by: Stefan Priebe Reviewed-by: Dave Chinner Signed-off-by: Alex Elder commit bc6e588a8971aa74c02e42db4d6e0248679f3738 Author: Christoph Hellwig Date: Tue Oct 11 15:14:08 2011 +0000 xfs: do not update xa_last_pushed_lsn for locked items If an item was locked we should not update xa_last_pushed_lsn and thus skip it when restarting the AIL scan as we need to be able to lock and write it out as soon as possible. Otherwise heavy lock contention might starve AIL pushing too easily, especially given the larger backoff once we moved xa_last_pushed_lsn all the way to the target lsn. Signed-off-by: Christoph Hellwig Reported-by: Stefan Priebe Tested-by: Stefan Priebe Reviewed-by: Dave Chinner Signed-off-by: Alex Elder commit f7f43cc84152e53b5687cd0eb8823310ba065524 Author: Chris Mason Date: Tue Oct 11 11:41:40 2011 -0400 Btrfs: make sure not to defrag extents past i_size The btrfs file defrag code will loop through the extents and force COW on them. But there is a concurrent truncate in the middle of the defrag, it might end up defragging the same range over and over again. The problem is that writepage won't go through and do anything on pages past i_size, so the cow won't happen, so the file will appear to still be fragmented. defrag will end up hitting the same extents again and again. In the worst case, the truncate can actually live lock with the defrag because the defrag keeps creating new ordered extents which the truncate code keeps waiting on. The fix here is to make defrag check for i_size inside the main loop, instead of just once before the looping starts. Signed-off-by: Chris Mason commit 2b666859ec323403ac9a3a441d16eab30945404b Author: Adrian Bunk Date: Thu Oct 6 00:40:47 2011 +0300 x86: Default to vsyscall=native for now This UML breakage: linux-2.6.30.1[3800] vsyscall fault (exploit attempt?) ip:ffffffffff600000 cs:33 sp:7fbfb9c498 ax:ffffffffff600000 si:0 di:606790 linux-2.6.30.1[3856] vsyscall fault (exploit attempt?) ip:ffffffffff600000 cs:33 sp:7fbfb13168 ax:ffffffffff600000 si:0 di:606790 Is caused by commit 3ae36655 ("x86-64: Rework vsyscall emulation and add vsyscall= parameter") - the vsyscall emulation code is not fully cooked yet as UML relies on some rather fragile SIGSEGV semantics. Linus suggested in https://lkml.org/lkml/2011/8/9/376 to default to vsyscall=native for now, this patch implements that. Signed-off-by: Adrian Bunk Acked-by: Andrew Lutomirski Cc: H. Peter Anvin Link: http://lkml.kernel.org/r/20111005214047.GE14406@localhost.pp.htv.fi Signed-off-by: Ingo Molnar commit 3e7abe2556b583e87dabda3e0e6178a67b20d06f Author: Roland Dreier Date: Wed Jul 20 06:22:21 2011 -0700 intel-iommu: Fix AB-BA lockdep report When unbinding a device so that I could pass it through to a KVM VM, I got the lockdep report below. It looks like a legitimate lock ordering problem: - domain_context_mapping_one() takes iommu->lock and calls iommu_support_dev_iotlb(), which takes device_domain_lock (inside iommu->lock). - domain_remove_one_dev_info() starts by taking device_domain_lock then takes iommu->lock inside it (near the end of the function). So this is the classic AB-BA deadlock. It looks like a safe fix is to simply release device_domain_lock a bit earlier, since as far as I can tell, it doesn't protect any of the stuff accessed at the end of domain_remove_one_dev_info() anyway. BTW, the use of device_domain_lock looks a bit unsafe to me... it's at least not obvious to me why we aren't vulnerable to the race below: iommu_support_dev_iotlb() domain_remove_dev_info() lock device_domain_lock find info unlock device_domain_lock lock device_domain_lock find same info unlock device_domain_lock free_devinfo_mem(info) do stuff with info after it's free However I don't understand the locking here well enough to know if this is a real problem, let alone what the best fix is. Anyway here's the full lockdep output that prompted all of this: ======================================================= [ INFO: possible circular locking dependency detected ] 2.6.39.1+ #1 ------------------------------------------------------- bash/13954 is trying to acquire lock: (&(&iommu->lock)->rlock){......}, at: [] domain_remove_one_dev_info+0x121/0x230 but task is already holding lock: (device_domain_lock){-.-...}, at: [] domain_remove_one_dev_info+0x208/0x230 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (device_domain_lock){-.-...}: [] lock_acquire+0x9d/0x130 [] _raw_spin_lock_irqsave+0x55/0xa0 [] domain_context_mapping_one+0x600/0x750 [] domain_context_mapping+0x3f/0x120 [] iommu_prepare_identity_map+0x1c5/0x1e0 [] intel_iommu_init+0x88e/0xb5e [] pci_iommu_init+0x16/0x41 [] do_one_initcall+0x45/0x190 [] kernel_init+0xe3/0x168 [] kernel_thread_helper+0x4/0x10 -> #0 (&(&iommu->lock)->rlock){......}: [] __lock_acquire+0x195e/0x1e10 [] lock_acquire+0x9d/0x130 [] _raw_spin_lock_irqsave+0x55/0xa0 [] domain_remove_one_dev_info+0x121/0x230 [] device_notifier+0x72/0x90 [] notifier_call_chain+0x8c/0xc0 [] __blocking_notifier_call_chain+0x78/0xb0 [] blocking_notifier_call_chain+0x16/0x20 [] __device_release_driver+0xbc/0xe0 [] device_release_driver+0x2f/0x50 [] driver_unbind+0xa3/0xc0 [] drv_attr_store+0x2c/0x30 [] sysfs_write_file+0xe6/0x170 [] vfs_write+0xce/0x190 [] sys_write+0x54/0xa0 [] system_call_fastpath+0x16/0x1b other info that might help us debug this: 6 locks held by bash/13954: #0: (&buffer->mutex){+.+.+.}, at: [] sysfs_write_file+0x44/0x170 #1: (s_active#3){++++.+}, at: [] sysfs_write_file+0xcd/0x170 #2: (&__lockdep_no_validate__){+.+.+.}, at: [] driver_unbind+0x9b/0xc0 #3: (&__lockdep_no_validate__){+.+.+.}, at: [] device_release_driver+0x27/0x50 #4: (&(&priv->bus_notifier)->rwsem){.+.+.+}, at: [] __blocking_notifier_call_chain+0x5f/0xb0 #5: (device_domain_lock){-.-...}, at: [] domain_remove_one_dev_info+0x208/0x230 stack backtrace: Pid: 13954, comm: bash Not tainted 2.6.39.1+ #1 Call Trace: [] print_circular_bug+0xf7/0x100 [] __lock_acquire+0x195e/0x1e10 [] ? trace_hardirqs_off+0xd/0x10 [] ? trace_hardirqs_on_caller+0x13d/0x180 [] lock_acquire+0x9d/0x130 [] ? domain_remove_one_dev_info+0x121/0x230 [] _raw_spin_lock_irqsave+0x55/0xa0 [] ? domain_remove_one_dev_info+0x121/0x230 [] ? trace_hardirqs_off+0xd/0x10 [] domain_remove_one_dev_info+0x121/0x230 [] device_notifier+0x72/0x90 [] notifier_call_chain+0x8c/0xc0 [] __blocking_notifier_call_chain+0x78/0xb0 [] blocking_notifier_call_chain+0x16/0x20 [] __device_release_driver+0xbc/0xe0 [] device_release_driver+0x2f/0x50 [] driver_unbind+0xa3/0xc0 [] drv_attr_store+0x2c/0x30 [] sysfs_write_file+0xe6/0x170 [] vfs_write+0xce/0x190 [] sys_write+0x54/0xa0 [] system_call_fastpath+0x16/0x1b Signed-off-by: Roland Dreier Signed-off-by: David Woodhouse commit 2a0f7f5769992bae5b3f97157fd80b2b943be485 Author: Li Zefan Date: Mon Oct 10 15:43:34 2011 -0400 Btrfs: fix recursive auto-defrag Follow those steps: # mount -o autodefrag /dev/sda7 /mnt # dd if=/dev/urandom of=/mnt/tmp bs=200K count=1 # sync # dd if=/dev/urandom of=/mnt/tmp bs=8K count=1 conv=notrunc and then it'll go into a loop: writeback -> defrag -> writeback ... It's because writeback writes [8K, 200K] and then writes [0, 8K]. I tried to make writeback know if the pages are dirtied by defrag, but the patch was a bit intrusive. Here I simply set writeback_index when we defrag a file. Signed-off-by: Li Zefan Signed-off-by: Chris Mason commit a3a4bfde8a271df7ee56fcf31b8d907d50e7f216 Author: Wolfgang Grandegger Date: Fri Oct 7 09:28:14 2011 +0000 mscan: too much data copied to CAN frame due to 16 bit accesses Due to the 16 bit access to mscan registers there's too much data copied to the zero initialized CAN frame when having an odd number of bytes to copy. This patch ensures that only the requested bytes are copied by using an 8 bit access for the remaining byte. Reported-by: Andre Naujoks Signed-off-by: Oliver Hartkopp Signed-off-by: Wolfgang Grandegger Signed-off-by: David S. Miller commit cdaf557034bb4397b2c86bb424de1788b134f610 Author: Yan, Zheng Date: Sat Oct 8 22:34:35 2011 +0000 gro: refetch inet6_protos[] after pulling ext headers ipv6_gro_receive() doesn't update the protocol ops after pulling the ext headers. It looks like a typo. Signed-off-by: Zheng Yan Acked-by: Eric Dumazet Signed-off-by: David S. Miller commit 134d0f974c55c942541f1663d51fa846257eff2a Author: Dmitry Kravkov Date: Sun Oct 9 23:57:36 2011 +0000 bnx2x: fix cl_id allocation for non-eth clients for NPAR mode There are some consolidations of NPAR configuration when FCoE and iSCSI L2 clients will get the same id, in this case FCoE ring will be non-functional. Signed-off-by: Dmitry Kravkov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit c5d6136e10d667965e46f998c01863802f7b89c8 Author: Thadeu Lima de Souza Cascardo Date: Mon Oct 10 06:42:23 2011 +0000 mlx4_en: fix endianness with blue frame support The doorbell register was being unconditionally swapped. In x86, that meant it was being swapped to BE and written to the descriptor and to memory, depending on the case of blue frame support or writing to doorbell register. On PPC, this meant it was being swapped to LE and then swapped back to BE while writing to the register. But in the blue frame case, it was being written as LE to the descriptor. The fix is not to swap doorbell unconditionally, write it to the register as BE and convert it to BE when writing it to the descriptor. Signed-off-by: Thadeu Lima de Souza Cascardo Reported-by: Richard Hendrickson Cc: Eli Cohen Cc: Yevgeny Petrilin Cc: Benjamin Herrenschmidt Signed-off-by: David S. Miller commit 65112dccf8a113737684366349d7f9ec373ddc47 Merge: bbf5e9743fd6 9d1e397b7baf Author: Linus Torvalds Date: Mon Oct 10 14:53:11 2011 +1200 Merge git://git.samba.org/sfrench/cifs-2.6 * git://git.samba.org/sfrench/cifs-2.6: [CIFS] Fix first time message on mount, ntlmv2 upgrade delayed to 3.2 commit bbf5e9743fd6c9b4ef8a34db8a9502baf4191524 Merge: 3faf12cd8603 aab3a70e98a1 Author: Linus Torvalds Date: Mon Oct 10 14:48:27 2011 +1200 Merge branch 'fixes' of git://git.linaro.org/people/arnd/arm-soc * 'fixes' of git://git.linaro.org/people/arnd/arm-soc: ARM: mach-ux500: enable fix for ARM errata 754322 ARM: OMAP: musb: Remove a redundant omap4430_phy_init call in usb_musb_init ARM: OMAP: Fix i2c init for twl4030 ARM: OMAP4: MMC: fix power and audio issue, decouple USBC1 from MMC1 commit 3faf12cd8603e3efbcc7e570e07dfd1ea2a17095 Author: Marc Dietrich Date: Fri Oct 7 08:31:41 2011 -0700 ARM: tegra: fix compilation error due to mach/hardware.h removal This fixes a compilation error in cpu-tegra.c which was introduced in dc8d966bccde ("ARM: convert PCI defines to variables") which removed the now obsolete mach/hardware.h from the mach-tegra subtree. Signed-off-by: Marc Dietrich Signed-off-by: Olof Johansson Cc: Sergei Shtylyov Signed-off-by: Linus Torvalds commit 84c861161404658c866835bf9ca07eb487added8 Merge: 746fb63c54d2 cb7cf41961fe Author: Linus Torvalds Date: Mon Oct 10 14:43:06 2011 +1200 Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/radeon/kms: use hardcoded dig encoder to transmitter mapping for DCE4.1 drm/radeon/kms: fix dp_detect handling for DP bridge chips drm/radeon/kms: retry aux transactions if there are status flags commit 746fb63c54d2659e1da3c5e90a77ccb23a309cc5 Author: Olof Johansson Date: Fri Oct 7 13:27:48 2011 -0700 MAINTAINERS: Update tegra maintainer information A couple of changes to the Tegra maintainership setup: I'm very glad to bring on Stephen Warren on board as a maintainer. The work he has done so far is excellent, and the fact that he works for Nvidia means he has long-term interest in the platform. Erik Gilling did an astounding amount of work on getting things up and running but has been a silent partner on the maintainership side for a while, and is stepping down. Thanks for your contributions so far, Erik. Finally, update the git URL since I'll take over running the main repo for a while. Overall maintainership model isn't changing much at this time: We'll all three review patches as appropriate, and one of us will collect the main repo (me at this time). Signed-off-by: Olof Johansson Cc: Erik Gilling Acked-by: Colin Cross Acked-by: Stephen Warren Signed-off-by: Linus Torvalds commit a24d025a08c90355bd39e95a34dbc4c806ff1d25 Merge: 3ee72ca99288 8742cd234716 Author: Linus Torvalds Date: Mon Oct 10 14:39:03 2011 +1200 Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/upstream-linus * 'upstream' of git://git.linux-mips.org/pub/scm/upstream-linus: (29 commits) MIPS: Call oops_enter, oops_exit in die staging/octeon: Software should check the checksum of no tcp/udp packets MIPS: Octeon: Enable C0_UserLocal probing. MIPS: No branches in delay slots for huge pages in handle_tlbl MIPS: Don't clobber CP0_STATUS value for CONFIG_MIPS_MT_SMTC MIPS: Octeon: Select CONFIG_HOLES_IN_ZONE MIPS: PM: Use struct syscore_ops instead of sysdevs for PM (v2) MIPS: Compat: Use 32-bit wrapper for compat_sys_futex. MIPS: Do not use EXTRA_CFLAGS MIPS: Alchemy: DB1200: Disable cascade IRQ in handler SERIAL: Lantiq: Set timeout in uart_port MIPS: Lantiq: Fix setting the PCI bus speed on AR9 MIPS: Lantiq: Fix external interrupt sources MIPS: tlbex: Fix build error in R3000 code. MIPS: Alchemy: Include Au1100 in PM code. MIPS: Alchemy: Fix typo in MAC0 registration MIPS: MSP71xx: Fix build error. MIPS: Handle __put_user() sleeping. MIPS: Allow forced irq threading MIPS: i8259: Mark cascade interrupt non-threaded ... commit aab3a70e98a1492833c713fe095dbdccb3bc6262 Merge: 98e87d57aab9 b8e111a74d28 Author: Arnd Bergmann Date: Sat Oct 8 22:21:07 2011 +0200 Merge branch 'omap/fixes-for-3.1' into fixes commit 9d1e397b7bafe843564eab26ed3f682637159c6c Author: Steve French Date: Thu Oct 6 23:14:07 2011 -0500 [CIFS] Fix first time message on mount, ntlmv2 upgrade delayed to 3.2 Microsoft has a bug with ntlmv2 that requires use of ntlmssp, but we didn't get the required information on when/how to use ntlmssp to old (but once very popular) legacy servers (various NT4 fixpacks for example) until too late to merge for 3.1. Will upgrade to NTLMv2 in NTLMSSP in 3.2 Signed-off-by: Steve French Reviewed-by: Jeff Layton commit f22ed71cd60210d2f476986c0266004e4db45f34 Author: Daniel Hellstrom Date: Thu Sep 8 03:11:15 2011 +0000 sparc32,leon: SRMMU MMU Table probe fix The LEON MMU Model (SRMMU) does not implement MMu Table probing in hardware, instead it is implemented in software. However the software implementation does not return the PTE as it should which always results in INVALID entires and the PROM mappings are not inherited as they should during startup. The following patch removes the masking of the PTE. Signed-off-by: Daniel Hellstrom Signed-off-by: David S. Miller commit 98e87d57aab9b1594f9cc53a386fcb6f2f2ba6e2 Author: srinidhi kasagar Date: Tue Sep 20 11:15:46 2011 +0530 ARM: mach-ux500: enable fix for ARM errata 754322 This applies ARM errata fix 754322 for all ux500 platforms. Cc: stable@kernel.org Signed-off-by: srinidhi kasagar Signed-off-by: Linus Walleij commit 3ee72ca99288f1de95ec9c570e43f531c8799f06 Merge: 29cf7a30f8a0 186c6bbced72 Author: Linus Torvalds Date: Thu Oct 6 16:15:10 2011 -0700 Merge git://github.com/davem330/net * git://github.com/davem330/net: net: fix typos in Documentation/networking/scaling.txt bridge: leave carrier on for empty bridge netfilter: Use proper rwlock init function tcp: properly update lost_cnt_hint during shifting tcp: properly handle md5sig_pool references macvlan/macvtap: Fix unicast between macvtap interfaces in bridge mode commit 29cf7a30f8a0ce4af2406d93d5a332099be26923 Author: Paul Menzel Date: Wed Aug 31 17:07:10 2011 +0200 x86/PCI: use host bridge _CRS info on ASUS M2V-MX SE In summary, this DMI quirk uses the _CRS info by default for the ASUS M2V-MX SE by turning on `pci=use_crs` and is similar to the quirk added by commit 2491762cfb47 ("x86/PCI: use host bridge _CRS info on ASRock ALiveSATA2-GLAN") whose commit message should be read for further information. Since commit 3e3da00c01d0 ("x86/pci: AMD one chain system to use pci read out res") Linux gives the following oops: parport0: PC-style at 0x378, irq 7 [PCSPP,TRISTATE] HDA Intel 0000:20:01.0: PCI INT A -> GSI 17 (level, low) -> IRQ 17 HDA Intel 0000:20:01.0: setting latency timer to 64 BUG: unable to handle kernel paging request at ffffc90011c08000 IP: [] azx_probe+0x3ad/0x86b [snd_hda_intel] PGD 13781a067 PUD 13781b067 PMD 1300ba067 PTE 800000fd00000173 Oops: 0009 [#1] SMP last sysfs file: /sys/module/snd_pcm/initstate CPU 0 Modules linked in: snd_hda_intel(+) snd_hda_codec snd_hwdep snd_pcm_oss snd_mixer_oss snd_pcm snd_seq_midi snd_rawmidi snd_seq_midi_event tpm_tis tpm snd_seq tpm_bios psmouse parport_pc snd_timer snd_seq_device parport processor evdev snd i2c_viapro thermal_sys amd64_edac_mod k8temp i2c_core soundcore shpchp pcspkr serio_raw asus_atk0110 pci_hotplug edac_core button snd_page_alloc edac_mce_amd ext3 jbd mbcache sha256_generic cryptd aes_x86_64 aes_generic cbc dm_crypt dm_mod raid1 md_mod usbhid hid sg sd_mod crc_t10dif sr_mod cdrom ata_generic uhci_hcd sata_via pata_via libata ehci_hcd usbcore scsi_mod via_rhine mii nls_base [last unloaded: scsi_wait_scan] Pid: 1153, comm: work_for_cpu Not tainted 2.6.37-1-amd64 #1 M2V-MX SE/System Product Name RIP: 0010:[] [] azx_probe+0x3ad/0x86b [snd_hda_intel] RSP: 0018:ffff88013153fe50 EFLAGS: 00010286 RAX: ffffc90011c08000 RBX: ffff88013029ec00 RCX: 0000000000000006 RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246 RBP: ffff88013341d000 R08: 0000000000000000 R09: 0000000000000040 R10: 0000000000000286 R11: 0000000000003731 R12: ffff88013029c400 R13: 0000000000000000 R14: 0000000000000000 R15: ffff88013341d090 FS: 0000000000000000(0000) GS:ffff8800bfc00000(0000) knlGS:00000000f7610ab0 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: ffffc90011c08000 CR3: 0000000132f57000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process work_for_cpu (pid: 1153, threadinfo ffff88013153e000, task ffff8801303c86c0) Stack: 0000000000000005 ffffffff8123ad65 00000000000136c0 ffff88013029c400 ffff8801303c8998 ffff88013341d000 ffff88013341d090 ffff8801322d9dc8 ffff88013341d208 0000000000000000 0000000000000000 ffffffff811ad232 Call Trace: [] ? __pm_runtime_set_status+0x162/0x186 [] ? local_pci_probe+0x49/0x92 [] ? do_work_for_cpu+0x0/0x1b [] ? do_work_for_cpu+0x0/0x1b [] ? do_work_for_cpu+0xb/0x1b [] ? kthread+0x7a/0x82 [] ? kernel_thread_helper+0x4/0x10 [] ? kthread+0x0/0x82 [] ? kernel_thread_helper+0x0/0x10 Code: f4 01 00 00 ef 31 f6 48 89 df e8 29 dd ff ff 85 c0 0f 88 2b 03 00 00 48 89 ef e8 b4 39 c3 e0 8b 7b 40 e8 fc 9d b1 e0 48 8b 43 38 <66> 8b 10 66 89 14 24 8b 43 14 83 e8 03 83 f8 01 77 32 31 d2 be RIP [] azx_probe+0x3ad/0x86b [snd_hda_intel] RSP CR2: ffffc90011c08000 ---[ end trace 8d1f3ebc136437fd ]--- Trusting the ACPI _CRS information (`pci=use_crs`) fixes this problem. $ dmesg | grep -i crs # with the quirk PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug The match has to be against the DMI board entries though since the vendor entries are not populated. DMI: System manufacturer System Product Name/M2V-MX SE, BIOS 0304 10/30/2007 This quirk should be removed when `pci=use_crs` is enabled for machines from 2006 or earlier or some other solution is implemented. Using coreboot [1] with this board the problem does not exist but this quirk also does not affect it either. To be safe though the check is tightened to only take effect when the BIOS from American Megatrends is used. 15:13 < ruik> but coreboot does not need that 15:13 < ruik> because i have there only one root bus 15:13 < ruik> the audio is behind a bridge $ sudo dmidecode BIOS Information Vendor: American Megatrends Inc. Version: 0304 Release Date: 10/30/2007 [1] http://www.coreboot.org/ Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=30552 Cc: stable@kernel.org (2.6.34) Cc: Thomas Gleixner Cc: Ingo Molnar Cc: H. Peter Anvin Cc: x86@kernel.org Signed-off-by: Paul Menzel Signed-off-by: Bjorn Helgaas Acked-by: Jesse Barnes Signed-off-by: Linus Torvalds commit 186c6bbced722cfeff041d2a1264c95f5d042050 Author: Benjamin Poirier Date: Tue Oct 4 04:00:30 2011 +0000 net: fix typos in Documentation/networking/scaling.txt The second hunk fixes rps_sock_flow_table but has to re-wrap the paragraph. Signed-off-by: Benjamin Poirier Signed-off-by: David S. Miller commit b64b73d7d0c480f75684519c6134e79d50c1b341 Author: stephen hemminger Date: Mon Oct 3 18:14:45 2011 +0000 bridge: leave carrier on for empty bridge This resolves a regression seen by some users of bridging. Some users use the bridge like a dummy device. They expect to be able to put an IPv6 address on the device with no ports attached. Although there are better ways of doing this, there is no reason to not allow it. Note: the bridge still will reflect the state of ports in the bridge if there are any added. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller commit 6367f1775ebb66b0f0e9e3512159f3257a6fde0e Merge: a7c56ebac1bc 983c7db347db Author: Linus Torvalds Date: Thu Oct 6 08:31:47 2011 -0700 Merge branch 'for-linus' of http://people.redhat.com/agk/git/linux-dm * 'for-linus' of http://people.redhat.com/agk/git/linux-dm: dm crypt: always disable discard_zeroes_data dm: raid fix write_mostly arg validation dm table: avoid crash if integrity profile changes dm: flakey fix corrupt_bio_byte error path commit a7c56ebac1bce799b583230595b4de9ccb8162d0 Merge: 538d2882213e 01f96c0a9922 Author: Linus Torvalds Date: Thu Oct 6 08:30:03 2011 -0700 Merge branch 'for-linus' of git://neil.brown.name/md * 'for-linus' of git://neil.brown.name/md: md: Avoid waking up a thread after it has been freed. commit cb7cf41961fe10773c491c75ae73539ad4bbed66 Author: Alex Deucher Date: Wed Oct 5 18:36:50 2011 -0400 drm/radeon/kms: use hardcoded dig encoder to transmitter mapping for DCE4.1 The encoders are supposedly fully routeable, but changing the mapping doesn't always seem to take. Using a hardcoded mapping is much more reliable. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=41366 Signed-off-by: Alex Deucher Tested-by: Simon Farnsworth Cc: stable@kernel.org Signed-off-by: Dave Airlie commit 3458e21c0d384ca04b27a2ea24d9314c1b57530f Author: Thomas Gleixner Date: Wed Oct 5 03:24:43 2011 +0000 netfilter: Use proper rwlock init function Replace the open coded initialization with the init function. Signed-off-by: Thomas Gleixner Acked-by: Hans Schillstrom Signed-off-by: David S. Miller commit 538d2882213ef4f076108f3edda2c39a584c4c2b Merge: 71277a663589 d6069dae4700 Author: Linus Torvalds Date: Wed Oct 5 09:22:38 2011 -0700 Merge branch 'for-linus' of git://github.com/dtor/input * 'for-linus' of git://github.com/dtor/input: Input: wacom - revert "Cintiq 21UX2 does not have menu strips" commit 71277a6635890ab401f0a9dd7d5d9e652eea44ef Merge: 976d167615b6 a73914c35b05 Author: Linus Torvalds Date: Wed Oct 5 09:16:11 2011 -0700 Merge git://bedivere.hansenpartnership.com/git/scsi-rc-fixes-2.6 * git://bedivere.hansenpartnership.com/git/scsi-rc-fixes-2.6: [SCSI] libsas: fix panic when single phy is disabled on a wide port [SCSI] qla2xxx: Fix crash in qla2x00_abort_all_cmds() on unload commit 6777a4f6898a53974ef7fe7ce09ec41fae0f32db Author: Alex Deucher Date: Tue Oct 4 12:23:24 2011 -0400 drm/radeon/kms: fix dp_detect handling for DP bridge chips The HPD pin is not reliable for detecting whether a monitor is connected or not. Skip HPD and just use DDC or load detection. Fixes phantom VGA connected bugs. [Michel: fixes phantom VGA bugs on his llano system.] Signed-off-by: Alex Deucher Reviewed-by: Michel Dänzer Tested-by: Michel Dänzer Cc: stable@kernel.org Signed-off-by: Dave Airlie commit 4f332844cc87c5f99c5300f788abbe8a8c731390 Author: Alex Deucher Date: Tue Oct 4 17:23:15 2011 -0400 drm/radeon/kms: retry aux transactions if there are status flags If there are error flags in the aux status, retry the transaction. This makes aux much more reliable, especially on llano systems. Signed-off-by: Alex Deucher Reviewed-by: Michel Dänzer Cc: stable@kernel.org Signed-off-by: Dave Airlie commit d6069dae4700cf5290a75002c46b9be8ea7eef3c Author: Jason Gerecke Date: Tue Oct 4 22:50:45 2011 -0700 Input: wacom - revert "Cintiq 21UX2 does not have menu strips" This reverts commit 71c86ce59791bcd67af937bbea719a508079d7c2. The 21UX2 does have touchstrips, but they are in a somewhat- hidden location. Signed-off-by: Jason Gerecke Acked-by: Ping Cheng Signed-off-by: Dmitry Torokhov commit 1e5289e121372a3494402b1b131b41bfe1cf9b7f Author: Yan, Zheng Date: Sun Oct 2 04:21:50 2011 +0000 tcp: properly update lost_cnt_hint during shifting lost_skb_hint is used by tcp_mark_head_lost() to mark the first unhandled skb. lost_cnt_hint is the number of packets or sacked packets before the lost_skb_hint; When shifting a skb that is before the lost_skb_hint, if tcp_is_fack() is ture, the skb has already been counted in the lost_cnt_hint; if tcp_is_fack() is false, tcp_sacktag_one() will increase the lost_cnt_hint. So tcp_shifted_skb() does not need to adjust the lost_cnt_hint by itself. When shifting a skb that is equal to lost_skb_hint, the shifted packets will not be counted by tcp_mark_head_lost(). So tcp_shifted_skb() should adjust the lost_cnt_hint even tcp_is_fack(tp) is true. Signed-off-by: Zheng Yan Signed-off-by: David S. Miller commit 260fcbeb1ae9e768a44c9925338fbacb0d7e5ba9 Author: Yan, Zheng Date: Thu Sep 29 17:10:10 2011 +0000 tcp: properly handle md5sig_pool references tcp_v4_clear_md5_list() assumes that multiple tcp md5sig peers only hold one reference to md5sig_pool. but tcp_v4_md5_do_add() increases use count of md5sig_pool for each peer. This patch makes tcp_v4_md5_do_add() only increases use count for the first tcp md5sig peer. Signed-off-by: Zheng Yan Signed-off-by: David S. Miller commit cb2d0f3e968bff7c6d262aca3e3ab8d4184e69b2 Author: David Ward Date: Sun Sep 18 12:53:20 2011 +0000 macvlan/macvtap: Fix unicast between macvtap interfaces in bridge mode Packets should always be forwarded to the lowerdev using dev_forward_skb. vlan->forward is for packets being forwarded directly to another macvlan/ macvtap device (used for multicast in bridge mode). Reported-and-tested-by: Shlomo Pongratz Signed-off-by: David Ward Signed-off-by: David S. Miller commit 976d167615b64e14bc1491ca51d424e2ba9a5e84 Author: Linus Torvalds Date: Tue Oct 4 18:11:50 2011 -0700 Linux 3.1-rc9 commit 8a04b45367c7943f8f7f30257d42e2106ab7a0bf Merge: a8062e421f8a 805e969f6151 Author: Linus Torvalds Date: Tue Oct 4 10:37:06 2011 -0700 Merge git://github.com/davem330/net * git://github.com/davem330/net: pch_gbe: Fixed the issue on which a network freezes pch_gbe: Fixed the issue on which PC was frozen when link was downed. make PACKET_STATISTICS getsockopt report consistently between ring and non-ring net: xen-netback: correctly restart Tx after a VM restore/migrate bonding: properly stop queuing work when requested can bcm: fix incomplete tx_setup fix RDSRDMA: Fix cleanup of rds_iw_mr_pool net: Documentation: Fix type of variables ibmveth: Fix oops on request_irq failure ipv6: nullify ipv6_ac_list and ipv6_fl_list when creating new socket cxgb4: Fix EEH on IBM P7IOC can bcm: fix tx_setup off-by-one errors MAINTAINERS: tehuti: Alexander Indenbaum's address bounces dp83640: reduce driver noise ptp: fix L2 event message recognition commit a8062e421f8a5800c83b85ab10c4cefd8409844f Merge: 1fd2a850ecad b5c49d49b9e1 Author: Linus Torvalds Date: Tue Oct 4 09:59:22 2011 -0700 Merge branch 'fix/asoc' of git://github.com/tiwai/sound * 'fix/asoc' of git://github.com/tiwai/sound: ASoC: omap_mcpdm_remove cannot be __devexit ASoC: Fix setting update bits for WM8753_LADC and WM8753_RADC ASoC: use a valid device for dev_err() in Zylonite commit 1fd2a850ecad717113cb36fa9d6e4304cd19b89d Merge: f8451c3f1598 12d5180bd7e6 Author: Linus Torvalds Date: Tue Oct 4 09:54:18 2011 -0700 Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/radeon/kms: fix channel_remap setup (v2) drm/radeon: Set cursor x/y to 0 when x/yorigin > 0. drm/radeon: Update AVIVO cursor coordinate origin before x/yorigin calculation. drm/radeon: Simplify cursor x/yorigin calculation. drm/radeon/kms: fix cursor image off-by-one error drm/radeon/kms: Fix logic error in DP HPD handler drm/radeon/kms: add retry limits for native DP aux defer drm/radeon/kms: fix regression in DP aux defer handling commit f8451c3f15982ebdf71f7b5e155ade38efc5993f Merge: 5f39e6705faa f3e03e2eb0bc Author: Linus Torvalds Date: Tue Oct 4 09:52:56 2011 -0700 Merge branch 'spi/merge' of git://git.secretlab.ca/git/linux-2.6 * 'spi/merge' of git://git.secretlab.ca/git/linux-2.6: spi-topcliff-pch: Fix overrun issue spi-topcliff-pch: Add recovery processing in case FIFO overrun error occurs spi-topcliff-pch: Fix CPU read complete condition issue spi-topcliff-pch: Fix SSN Control issue spi-topcliff-pch: add tx-memory clear after complete transmitting commit 5f39e6705faade2e89d119958a8c51b9b6e2c53c Author: Jon Mason Date: Mon Oct 3 09:50:20 2011 -0500 PCI: Disable MPS configuration by default Add the ability to disable PCI-E MPS turning and using the BIOS configured MPS defaults. Due to the number of issues recently discovered on some x86 chipsets, make this the default behavior. Also, add the option for peer to peer DMA MPS configuration. Peer to peer DMA is outside the scope of this patch, but MPS configuration could prevent it from working by having the MPS on one root port different than the MPS on another. To work around this, simply make the system wide MPS the smallest possible value (128B). Signed-off-by: Jon Mason Acked-by: Benjamin Herrenschmidt Signed-off-by: Linus Torvalds commit 12d5180bd7e683a4ae80830b82ba67e7b7fac7b2 Author: Alex Deucher Date: Tue Oct 4 10:46:34 2011 -0400 drm/radeon/kms: fix channel_remap setup (v2) Most asics just use the hw default value which requires no explicit programming. For those that need a different value, the vbios will program it properly. As such, there's no need to program these registers explicitly in the driver. Changing MC_SHARED_CHREMAP requires a reload of all data in vram otherwise its contents will be scambled. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=40103 v2: drop now unused channel_remap functions. Signed-off-by: Alex Deucher Reviewed-by: Michel Dänzer Cc: stable@kernel.org Signed-off-by: Dave Airlie commit f3e03e2eb0bcd9266720695b82a523e6bc526ff7 Author: Tomoya MORINAGA Date: Tue Sep 6 17:16:38 2011 +0900 spi-topcliff-pch: Fix overrun issue We found that adding load, Rx data sometimes drops.(with DMA transfer mode) The cause is that before starting Rx-DMA processing, Tx-DMA processing starts. This causes FIFO overrun occurs. This patch fixes the issue by modifying FIFO tx-threshold and DMA descriptor size like below. Current this patch Rx-descriptor 4Byte+12Byte*341 --> 12Byte*340-4Byte-12Byte Rx-threshold (Not modified) Tx-descriptor 4Byte+12Byte*341 --> 16Byte-12Byte*340 Rx-threshold 12Byte --> 2Byte Signed-off-by: Tomoya MORINAGA Signed-off-by: Grant Likely commit 25e803f9c339a070cd7361e853aebde11b1f9217 Author: Tomoya MORINAGA Date: Tue Sep 6 17:16:37 2011 +0900 spi-topcliff-pch: Add recovery processing in case FIFO overrun error occurs Add recovery processing in case FIFO overrun error occurs with DMA transfer mode. Signed-off-by: Tomoya MORINAGA Signed-off-by: Grant Likely commit 373b0eb64b9c97a14720896dcfdebfa3268b1991 Author: Tomoya MORINAGA Date: Tue Sep 6 17:16:36 2011 +0900 spi-topcliff-pch: Fix CPU read complete condition issue We found Rx data sometimes drops.(with non-DMA transfer mode) The cause is read complete condition is not true. This patch fixes the issue. Signed-off-by: Tomoya MORINAGA Signed-off-by: Grant Likely commit 8b7aa961a815dad389525dcd1c36a44c249b1760 Author: Tomoya MORINAGA Date: Tue Sep 6 17:16:35 2011 +0900 spi-topcliff-pch: Fix SSN Control issue During processing 1 command/data series, SSN should keep LOW. However, currently, SSN becomes HIGH. This patch fixes the issue. Signed-off-by: Tomoya MORINAGA Signed-off-by: Grant Likely commit 27504be5c10bdc61761ec0126b3645428598ad91 Author: Tomoya MORINAGA Date: Tue Sep 6 17:16:34 2011 +0900 spi-topcliff-pch: add tx-memory clear after complete transmitting Currently, in case of reading date from SPI flash, command is sent twice. The cause is that tx-memory clear processing is missing . This patch adds the tx-momory clear processing. Signed-off-by: Tomoya MORINAGA Signed-off-by: Grant Likely commit 05faadcf59507e8eea57ffbeea9cbb14c9a2ab3d Author: Takashi Iwai Date: Mon Oct 3 18:09:14 2011 -0700 lis3: fix regression of HP DriveGuard with 8bit chip Commit 2a7fade7e03 ("hwmon: lis3: Power on corrections") caused a regression on HP laptops with 8bit chip. Writing CTRL2_BOOT_8B bit seems clearing the BIOS setup, and no proper interrupt for DriveGuard will be triggered any more. Since the init code there is basically only for embedded devices, put a pdata check so that the problematic initialization will be skipped for hp_accel stuff. Signed-off-by: Takashi Iwai Cc: Eric Piel Cc: Samu Onkalo Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0f86267b79bc6e357b8606077c7f70239045ea9c Merge: 0d617928f5f5 20ecb499f64a Author: Linus Torvalds Date: Mon Oct 3 12:54:56 2011 -0700 Merge branch 'hwmon-for-linus' of git://github.com/groeck/linux * 'hwmon-for-linus' of git://github.com/groeck/linux: hwmon: (coretemp) Avoid leaving around dangling pointer hwmon: (coretemp) Fixup platform device ID change commit 0d617928f5f5426f6e40edaacbfa80e73d67e0cd Merge: 7fd21be75dce 2c8fc867602e Author: Linus Torvalds Date: Mon Oct 3 12:53:43 2011 -0700 Merge git://github.com/davem330/ide * git://github.com/davem330/ide: ide-disk: Fix request requeuing commit 7fd21be75dce605e7cf273bd64b6d733d422fb04 Merge: 9b13776977d4 b6316429af7f Author: Linus Torvalds Date: Mon Oct 3 12:17:44 2011 -0700 Merge branch 'btrfs-3.0' of git://github.com/chrismason/linux * 'btrfs-3.0' of git://github.com/chrismason/linux: Btrfs: force a page fault if we have a shorty copy on a page boundary commit 2c8fc867602e385fd2abe76da0b6bda8ed907547 Author: Borislav Petkov Date: Mon Oct 3 14:28:18 2011 -0400 ide-disk: Fix request requeuing Simon Kirby reported that on his RAID setup with idedisk underneath the box OOMs after a couple of days of runtime. Running with CONFIG_DEBUG_KMEMLEAK pointed to idedisk_prep_fn() which unconditionally allocates an ide_cmd struct. However, ide_requeue_and_plug() can be called more than once per request, either from the request issue or the IRQ handler path and do blk_peek_request() ends up in idedisk_prep_fn() repeatedly, allocating a struct ide_cmd everytime and "forgetting" the previous pointer. Make sure the code reuses the old allocated chunk. Reported-and-tested-by: Simon Kirby Cc: [ 39.x, 3.0.x ] Link: http://marc.info/?l=linux-kernel&m=131667641517919 Link: http://lkml.kernel.org/r/20110922072643.GA27232@hostway.ca Signed-off-by: Borislav Petkov Signed-off-by: David S. Miller commit 805e969f6151eda7bc1a57e9c737054230acc3cc Author: Toshiharu Okada Date: Sun Sep 25 21:27:43 2011 +0000 pch_gbe: Fixed the issue on which a network freezes The pch_gbe driver has an issue which a network stops, when receiving traffic is high. In the case, The link down and up are necessary to return a network. This patch fixed this issue. Signed-off-by: Toshiharu Okada Signed-off-by: David S. Miller commit 5f3a11419099d5cc010cfbfc524ca10d8fb81f89 Author: Toshiharu Okada Date: Sun Sep 25 21:27:42 2011 +0000 pch_gbe: Fixed the issue on which PC was frozen when link was downed. When a link was downed during network use, there is an issue on which PC freezes. This patch fixed this issue. Signed-off-by: Toshiharu Okada Signed-off-by: David S. Miller commit 7091fbd82cd5686444ffe9935ed6a8190101fe9d Author: Willem de Bruijn Date: Fri Sep 30 10:38:28 2011 +0000 make PACKET_STATISTICS getsockopt report consistently between ring and non-ring This is a minor change. Up until kernel 2.6.32, getsockopt(fd, SOL_PACKET, PACKET_STATISTICS, ...) would return total and dropped packets since its last invocation. The introduction of socket queue overflow reporting [1] changed drop rate calculation in the normal packet socket path, but not when using a packet ring. As a result, the getsockopt now returns different statistics depending on the reception method used. With a ring, it still returns the count since the last call, as counts are incremented in tpacket_rcv and reset in getsockopt. Without a ring, it returns 0 if no drops occurred since the last getsockopt and the total drops over the lifespan of the socket otherwise. The culprit is this line in packet_rcv, executed on a drop: drop_n_acct: po->stats.tp_drops = atomic_inc_return(&sk->sk_drops); As it shows, the new drop number it taken from the socket drop counter, which is not reset at getsockopt. I put together a small example that demonstrates the issue [2]. It runs for 10 seconds and overflows the queue/ring on every odd second. The reported drop rates are: ring: 16, 0, 16, 0, 16, ... non-ring: 0, 15, 0, 30, 0, 46, 0, 60, 0 , 74. Note how the even ring counts monotonically increase. Because the getsockopt adds tp_drops to tp_packets, total counts are similarly reported cumulatively. Long story short, reinstating the original code, as the below patch does, fixes the issue at the cost of additional per-packet cycles. Another solution that does not introduce per-packet overhead is be to keep the current data path, record the value of sk_drops at getsockopt() at call N in a new field in struct packetsock and subtract that when reporting at call N+1. I'll be happy to code that, instead, it's just more messy. [1] http://patchwork.ozlabs.org/patch/35665/ [2] http://kernel.googlecode.com/files/test-packetsock-getstatistics.c Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller commit d0e5d83284dac15c015bb48115b6780f5a6413cd Author: David Vrabel Date: Fri Sep 30 06:37:51 2011 +0000 net: xen-netback: correctly restart Tx after a VM restore/migrate If a VM is saved and restored (or migrated) the netback driver will no longer process any Tx packets from the frontend. xenvif_up() does not schedule the processing of any pending Tx requests from the front end because the carrier is off. Without this initial kick the frontend just adds Tx requests to the ring without raising an event (until the ring is full). This was caused by 47103041e91794acdbc6165da0ae288d844c820b (net: xen-netback: convert to hw_features) which reordered the calls to xenvif_up() and netif_carrier_on() in xenvif_connect(). Signed-off-by: David Vrabel Cc: Ian Campbell Acked-by: Ian Campbell Signed-off-by: David S. Miller commit a0db2dad0935e798973bb79676e722b82f177206 Author: Andy Gospodarek Date: Fri Sep 23 10:53:34 2011 +0000 bonding: properly stop queuing work when requested During a test where a pair of bonding interfaces using ARP monitoring were both brought up and torn down (with an rmmod) repeatedly, a panic in the timer code was noticed. I tracked this down and determined that any of the bonding functions that ran as workqueue handlers and requeued more work might not properly exit when the module was removed. There was a flag protected by the bond lock called kill_timers that is set when the interface goes down or the module is removed, but many of the functions that monitor link status now unlock the bond lock to take rtnl first. There is a chance that another CPU running the rmmod could get the lock and set kill_timers after the first check has passed. This patch does not allow any function to queue work that will make itself run unless kill_timers is not set. I also noticed while doing this work that bond_resend_igmp_join_requests did not have a check for kill_timers, so I added the needed call there as well. Signed-off-by: Andy Gospodarek Reported-by: Liang Zheng Signed-off-by: David S. Miller commit 02e6859eae4a8e511fa1a2c9a689ea25cdc6166a Author: Michel Dänzer Date: Fri Sep 30 17:16:53 2011 +0200 drm/radeon: Set cursor x/y to 0 when x/yorigin > 0. Apart from the obvious cleanup, this should make the line cursor_end = x - xorigin + w; correct now. Signed-off-by: Michel Dänzer Reviewed-by: Alex Deucher Signed-off-by: Dave Airlie commit b8aee294d89502469f2d80ae6afb93398d8227e0 Author: Michel Dänzer Date: Fri Sep 30 17:16:52 2011 +0200 drm/radeon: Update AVIVO cursor coordinate origin before x/yorigin calculation. Fixes cursor disappearing prematurely when moving off a top/left edge which is not located at the desktop top/left edge. Signed-off-by: Michel Dänzer Cc: stable@kernel.org Reviewed-by: Alex Deucher Signed-off-by: Dave Airlie commit 7d309529b4c1a6281549bf86681cdfb4fbed49ed Author: Michel Dänzer Date: Fri Sep 30 17:16:51 2011 +0200 drm/radeon: Simplify cursor x/yorigin calculation. Signed-off-by: Michel Dänzer Reviewed-by: Alex Deucher Signed-off-by: Dave Airlie commit b356fe0afe9aa2cfdc7be0bae22ea1c93afc2451 Author: Nicholas Miell Date: Thu Sep 29 19:07:14 2011 -0700 drm/radeon/kms: fix cursor image off-by-one error The mouse cursor hotspot calculation when the cursor is partially off the top or left side of the screen was off by one. Fixes https://bugs.freedesktop.org/show_bug.cgi?id=41158 Signed-off-by: Nicholas Miell Reviewed-by: Michel Dänzer Reviewed-by: Alex Deucher Signed-off-by: Dave Airlie commit 5ba7ddf81634bfdf32d09261d2959e3f5b7c4263 Author: Alex Deucher Date: Mon Oct 3 08:37:33 2011 -0400 drm/radeon/kms: Fix logic error in DP HPD handler Only disable the pipe if the monitor is physically disconnected. The previous logic also disabled the pipe if the link was trained. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=41248 Signed-off-by: Alex Deucher Cc: stable@kernel.org Signed-off-by: Dave Airlie commit 6375bda073724ead7df08746866b724b1799a295 Author: Alex Deucher Date: Mon Oct 3 09:13:46 2011 -0400 drm/radeon/kms: add retry limits for native DP aux defer The previous code could potentially loop forever. Limit the number of DP aux defer retries to 4 for native aux transactions, same as i2c over aux transactions. Noticed by: Brad Campbell Signed-off-by: Alex Deucher Cc: Brad Campbell Cc: stable@kernel.org Signed-off-by: Dave Airlie commit 109bc10d30f33e84f1d7289f0039e0c858ade82f Author: Alex Deucher Date: Mon Oct 3 09:13:45 2011 -0400 drm/radeon/kms: fix regression in DP aux defer handling An incorrect ordering in the error checking code lead to DP aux defer being skipped in the aux native write path. Move the bytes transferred check (ret == 0) below the defer check. Tracked down by: Brad Campbell Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=41121 Signed-off-by: Alex Deucher Cc: Brad Campbell Cc: stable@kernel.org Signed-off-by: Dave Airlie commit 98d9ae841ad620045d653fb05764e4a899f42dbd Author: Florian Westphal Date: Fri Sep 30 16:38:29 2011 +0200 netfilter: nf_conntrack: fix event flooding in GRE protocol tracker GRE connections cause ctnetlink event flood because the ASSURED event is set for every packet received. Reported-by: Denys Fedoryshchenko Tested-by: Denys Fedoryshchenko Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 9b13776977d45505469edc6decc93e9e3799afe2 Merge: 4edf5886bba1 6fcb8a3a3a54 Author: Linus Torvalds Date: Sun Oct 2 19:23:44 2011 -0700 Merge branch 'for-linus' of git://git.infradead.org/users/sameo/mfd-2.6 * 'for-linus' of git://git.infradead.org/users/sameo/mfd-2.6: mfd: Fix generic irq chip ack function name for jz4740-adc commit 4edf5886bba1a3fba3b780c7263f64c23536a4a5 Merge: 2e518181074b 798cb7e89721 Author: Linus Torvalds Date: Sun Oct 2 19:22:44 2011 -0700 Merge branch 'for-linus' of git://github.com/tiwai/sound * 'for-linus' of git://github.com/tiwai/sound: ALSA: hda - Fix a regression of the position-buffer check commit b5c49d49b9e175fd56cb4b5cf2c4fd972d15e013 Author: Arnd Bergmann Date: Sun Oct 2 16:45:31 2011 +0200 ASoC: omap_mcpdm_remove cannot be __devexit omap_mcpdm_remove is used from asoc_mcpdm_probe, which is an initcall, and must not be discarded when HOTPLUG is disabled. Signed-off-by: Arnd Bergmann Signed-off-by: Mark Brown commit 21d17dd2a377ba894f26989915eb3c6e427a3656 Author: Axel Lin Date: Sun Oct 2 20:41:04 2011 +0800 ASoC: Fix setting update bits for WM8753_LADC and WM8753_RADC Current code set update bits for WM8753_LDAC and WM8753_RDAC twice, but missed setting update bits for WM8753_LADC and WM8753_RADC. I think it is a copy-paste bug in commit 776065 "ASoC: codecs: wm8753: Fix register cache incoherency". Signed-off-by: Axel Lin Signed-off-by: Mark Brown Cc: stable@kernel.org commit a73914c35b05d80f8ce78288e10056c91090b666 Author: Mark Salyzyn Date: Thu Sep 22 08:32:23 2011 -0700 [SCSI] libsas: fix panic when single phy is disabled on a wide port When a wide port is being utilized to a target, if one disables only one of the phys, we get an OS crash: BUG: unable to handle kernel NULL pointer dereference at 0000000000000238 IP: [] mutex_lock+0x21/0x50 PGD 4103f5067 PUD 41dba9067 PMD 0 Oops: 0002 [#1] SMP last sysfs file: /sys/bus/pci/slots/5/address CPU 0 Modules linked in: pm8001(U) ses enclosure fuse nfsd exportfs autofs4 ipmi_devintf ipmi_si ipmi_msghandler nfs lockd fscache nfs_acl auth_rpcgss 8021q fcoe libfcoe garp libfc scsi_transport_fc stp scsi_tgt llc sunrpc cpufreq_ondemand acpi_cpufreq freq_table ipv6 sr_mod cdrom dm_mirror dm_region_hash dm_log uinput sg i2c_i801 i2c_core iTCO_wdt iTCO_vendor_support e1000e mlx4_ib ib_mad ib_core mlx4_en mlx4_core ext3 jbd mbcache sd_mod crc_t10dif usb_storage ata_generic pata_acpi ata_piix libsas(U) scsi_transport_sas dm_mod [last unloaded: pm8001] Modules linked in: pm8001(U) ses enclosure fuse nfsd exportfs autofs4 ipmi_devintf ipmi_si ipmi_msghandler nfs lockd fscache nfs_acl auth_rpcgss 8021q fcoe libfcoe garp libfc scsi_transport_fc stp scsi_tgt llc sunrpc cpufreq_ondemand acpi_cpufreq freq_table ipv6 sr_mod cdrom dm_mirror dm_region_hash dm_log uinput sg i2c_i801 i2c_core iTCO_wdt iTCO_vendor_support e1000e mlx4_ib ib_mad ib_core mlx4_en mlx4_core ext3 jbd mbcache sd_mod crc_t10dif usb_storage ata_generic pata_acpi ata_piix libsas(U) scsi_transport_sas dm_mod [last unloaded: pm8001] Pid: 5146, comm: scsi_wq_5 Not tainted 2.6.32-71.29.1.el6.lustre.7.x86_64 #1 Storage Server RIP: 0010:[] [] mutex_lock+0x21/0x50 RSP: 0018:ffff8803e4e33d30 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000238 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff8803e664c800 RDI: 0000000000000238 RBP: ffff8803e4e33d40 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000238 R14: ffff88041acb7200 R15: ffff88041c51ada0 FS: 0000000000000000(0000) GS:ffff880028200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b CR2: 0000000000000238 CR3: 0000000410143000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process scsi_wq_5 (pid: 5146, threadinfo ffff8803e4e32000, task ffff8803e4e294a0) Stack: ffff8803e664c800 0000000000000000 ffff8803e4e33d70 ffffffffa001f06e <0> ffff8803e4e33d60 ffff88041c51ada0 ffff88041acb7200 ffff88041bc0aa00 <0> ffff8803e4e33d90 ffffffffa0032b6c 0000000000000014 ffff88041acb7200 Call Trace: [] sas_port_delete_phy+0x2e/0xa0 [scsi_transport_sas] [] sas_unregister_devs_sas_addr+0xac/0xe0 [libsas] [] sas_ex_revalidate_domain+0x204/0x330 [libsas] [] ? sas_revalidate_domain+0x0/0x90 [libsas] [] sas_revalidate_domain+0x65/0x90 [libsas] [] worker_thread+0x170/0x2a0 [] ? autoremove_wake_function+0x0/0x40 [] ? worker_thread+0x0/0x2a0 [] kthread+0x96/0xa0 [] child_rip+0xa/0x20 [] ? kthread+0x0/0xa0 [] ? child_rip+0x0/0x20 Code: ff ff 85 c0 75 ed eb d6 66 90 55 48 89 e5 48 83 ec 10 48 89 1c 24 4c 89 64 24 08 0f 1f 44 00 00 48 89 fb e8 92 f4 ff ff 48 89 df ff 0f 79 05 e8 25 00 00 00 65 48 8b 04 25 08 cc 00 00 48 2d RIP [] mutex_lock+0x21/0x50 RSP CR2: 0000000000000238 The following patch is admittedly a band-aid, and does not solve the root cause, but it still is a good candidate for hardening as a pointer check before reference. Signed-off-by: Mark Salyzyn Tested-by: Jack Wang Cc: stable@kernel.org Signed-off-by: James Bottomley commit eff919ac0fc7565e71ffa35657c333dd8cdc0520 Author: Arnd Bergmann Date: Sat Oct 1 22:03:34 2011 +0200 ASoC: use a valid device for dev_err() in Zylonite A recent conversion has introduced references to &pdev->dev, which does not actually exist in all the contexts it's used in. Replace this with card->dev where necessary, in order to let the driver build again. Signed-off-by: Arnd Bergmann Signed-off-by: Mark Brown Cc: stable@kernel.org commit 9bfacd01dc9b7519e1e6da12b01963550b9d09a2 Author: Roland Dreier Date: Thu Sep 22 00:06:05 2011 -0700 [SCSI] qla2xxx: Fix crash in qla2x00_abort_all_cmds() on unload I hit a crash in qla2x00_abort_all_cmds() if the qla2xxx module is unloaded right after it is loaded. I debugged this down to the abort handling improperly treating a command of type SRB_ADISC_CMD as if it had a bsg_job to complete when that command actually uses the iocb_cmd part of the union. (I guess to hit this one has to unload the module while the async FC initialization is still in progress) It seems we should only look for a bsg_job if type is SRB_ELS_CMD_RPT, SRB_ELS_CMD_HST or SRB_CT_CMD, so switch the test to make that explicit. Signed-off-by: Roland Dreier Acked-by: Chad Dupuis Cc: stable@kernel.org Signed-off-by: James Bottomley commit 2e518181074b4ac67c27768f44a1515c4fc1bff9 Merge: f72a209a3e69 9d3ec7a0c41d Author: Linus Torvalds Date: Sat Oct 1 17:46:13 2011 -0700 Merge branch 'perf-urgent-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip * 'perf-urgent-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip: perf tools: Fix raw sample reading commit 8742cd23471635f8b069bf9a6806200a77397ddb Author: Nathan Lynch Date: Fri Sep 30 13:49:35 2011 -0500 MIPS: Call oops_enter, oops_exit in die This allows pause_on_oops and mtdoops to work. Signed-off-by: Nathan Lynch To: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/2810/ Signed-off-by: Ralf Baechle commit 002ea9eefec98dada56fd5f8e432a4e8570c2a26 Author: Linus Walleij Date: Thu Sep 29 09:37:23 2011 +0100 ARM: 7113/1: mm: Align bank start to MAX_ORDER_NR_PAGES The VM subsystem assumes that there are valid memmap entries from the bank start aligned to MAX_ORDER_NR_PAGES. On the Ux500 we have a lot of mem=N arguments on the commandline triggering this bug several times over and causing kernel oops messages. Cc: stable@kernel.org Cc: Michael Bohan Cc: Nicolas Pitre Signed-off-by: Johan Palsson Signed-off-by: Rabin Vincent Signed-off-by: Linus Walleij Signed-off-by: Russell King commit f72a209a3e694ecb8d3ceed4671d98c4364e00e3 Merge: 47ea91b4052d eef24afb2856 47997d756aa2 d670ec13178d Author: Linus Torvalds Date: Sat Oct 1 08:37:25 2011 -0700 Merge branches 'irq-urgent-for-linus', 'x86-urgent-for-linus' and 'sched-urgent-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip * 'irq-urgent-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip: irq: Fix check for already initialized irq_domain in irq_domain_add irq: Add declaration of irq_domain_simple_ops to irqdomain.h * 'x86-urgent-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip: x86/rtc: Don't recursively acquire rtc_lock * 'sched-urgent-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip: posix-cpu-timers: Cure SMP wobbles sched: Fix up wchan borkage sched/rt: Migrate equal priority tasks to available CPUs commit b6316429af7f365f307dfd2b6a7a42f2563aef19 Author: Josef Bacik Date: Fri Sep 30 15:23:54 2011 -0400 Btrfs: force a page fault if we have a shorty copy on a page boundary A user reported a problem where ceph was getting into 100% cpu usage while doing some writing. It turns out it's because we were doing a short write on a not uptodate page, which means we'd fall back at one page at a time and fault the page in. The problem is our position is on the page boundary, so our fault in logic wasn't actually reading the page, so we'd just spin forever or until the page got read in by somebody else. This will force a readpage if we end up doing a short copy. Alexandre could reproduce this easily with ceph and reports it fixes his problem. I also wrote a reproducer that no longer hangs my box with this patch. Thanks, Reported-and-tested-by: Alexandre Oliva Signed-off-by: Josef Bacik Signed-off-by: Chris Mason commit 9d3ec7a0c41d010153c9d20577cb1bcf9c4f65df Merge: 47ea91b4052d 8e303f20f4b3 Author: Ingo Molnar Date: Fri Sep 30 20:08:56 2011 +0200 Merge branch 'perf/urgent' of git://github.com/acmel/linux into perf/urgent commit b8e111a74d281b70e88bd67fec48cfda4f9bdce2 Author: Axel Lin Date: Fri Sep 30 11:05:55 2011 -0700 ARM: OMAP: musb: Remove a redundant omap4430_phy_init call in usb_musb_init Current code calls omap4430_phy_init() twice in usb_musb_init(). Calling omap4430_phy_init() once is enough. This patch removes the first omap4430_phy_init() call, which using an uninitialized pointer as parameter. This patch elimates below build warning: arch/arm/mach-omap2/usb-musb.c: In function 'usb_musb_init': arch/arm/mach-omap2/usb-musb.c:141: warning: 'dev' may be used uninitialized in this function Signed-off-by: Axel Lin Bjarne Steinsbo Acked-by: Felipe Balbi Signed-off-by: Tony Lindgren commit bfd46a543f8f90bb197225900e355ce3c7daeb1f Author: Tony Lindgren Date: Fri Sep 30 11:05:55 2011 -0700 ARM: OMAP: Fix i2c init for twl4030 Looks like 2600 kHz rate does not work reliably on 2430, so just use the 100 kHz rate. Otherwise the system often fails to boot properly with: omap_i2c omap_i2c.2: timeout waiting for bus ready omap_i2c omap_i2c.2: timeout waiting for bus ready twl: i2c_write failed to transfer all messages omap_i2c omap_i2c.2: timeout waiting for bus ready twl: i2c_write failed to transfer all messages omap_i2c omap_i2c.2: timeout waiting for bus ready twl: i2c_write failed to transfer all messages twl: clock init err [-110] omap_i2c omap_i2c.2: timeout waiting for bus ready twl: i2c_write failed to transfer all messages TWL4030 Unable to unlock IDCODE registers --110 Signed-off-by: Tony Lindgren commit 3696d303d6a39f916f9ace37d79e3db7937c68a7 Author: Bryan Buckley Date: Fri Sep 30 11:05:55 2011 -0700 ARM: OMAP4: MMC: fix power and audio issue, decouple USBC1 from MMC1 Remove OMAP4_USBC1_ICUSB_PWRDNZ_MASK during enable/disable PWRDNZ mode for MMC1_PBIAS and associated extended-drain MMC1 I/O cell. This is in accordance with the control module programming guide. This fixes a bug where if trying to use gpio_98 or gpio_99 and MMC1 at the same time the GPIO signal will be affected by a changing SDMMC1_VDDS. Software must keep MMC1_PBIAS cell and MMC1_IO cell PWRDNZ signals low whenever SDMMC1_VDDS ramps up/down or changes for cell protection purposes. MMC1 is based on SDMMC1_VDDS whereas USBC1 is based on SIM_VDDS therefore they can operate independently. Signed-off-by: Bryan Buckley Acked-by: Kishore Kadiyala Tested-by: Balaji T K Signed-off-by: Tony Lindgren commit d670ec13178d0fd8680e6742a2bc6e04f28f87d8 Author: Peter Zijlstra Date: Thu Sep 1 12:42:04 2011 +0200 posix-cpu-timers: Cure SMP wobbles David reported: Attached below is a watered-down version of rt/tst-cpuclock2.c from GLIBC. Just build it with "gcc -o test test.c -lpthread -lrt" or similar. Run it several times, and you will see cases where the main thread will measure a process clock difference before and after the nanosleep which is smaller than the cpu-burner thread's individual thread clock difference. This doesn't make any sense since the cpu-burner thread is part of the top-level process's thread group. I've reproduced this on both x86-64 and sparc64 (using both 32-bit and 64-bit binaries). For example: [davem@boricha build-x86_64-linux]$ ./test process: before(0.001221967) after(0.498624371) diff(497402404) thread: before(0.000081692) after(0.498316431) diff(498234739) self: before(0.001223521) after(0.001240219) diff(16698) [davem@boricha build-x86_64-linux]$ The diff of 'process' should always be >= the diff of 'thread'. I make sure to wrap the 'thread' clock measurements the most tightly around the nanosleep() call, and that the 'process' clock measurements are the outer-most ones. --- #include #include #include #include #include #include #include #include static pthread_barrier_t barrier; static void *chew_cpu(void *arg) { pthread_barrier_wait(&barrier); while (1) __asm__ __volatile__("" : : : "memory"); return NULL; } int main(void) { clockid_t process_clock, my_thread_clock, th_clock; struct timespec process_before, process_after; struct timespec me_before, me_after; struct timespec th_before, th_after; struct timespec sleeptime; unsigned long diff; pthread_t th; int err; err = clock_getcpuclockid(0, &process_clock); if (err) return 1; err = pthread_getcpuclockid(pthread_self(), &my_thread_clock); if (err) return 1; pthread_barrier_init(&barrier, NULL, 2); err = pthread_create(&th, NULL, chew_cpu, NULL); if (err) return 1; err = pthread_getcpuclockid(th, &th_clock); if (err) return 1; pthread_barrier_wait(&barrier); err = clock_gettime(process_clock, &process_before); if (err) return 1; err = clock_gettime(my_thread_clock, &me_before); if (err) return 1; err = clock_gettime(th_clock, &th_before); if (err) return 1; sleeptime.tv_sec = 0; sleeptime.tv_nsec = 500000000; nanosleep(&sleeptime, NULL); err = clock_gettime(th_clock, &th_after); if (err) return 1; err = clock_gettime(my_thread_clock, &me_after); if (err) return 1; err = clock_gettime(process_clock, &process_after); if (err) return 1; diff = process_after.tv_nsec - process_before.tv_nsec; printf("process: before(%lu.%.9lu) after(%lu.%.9lu) diff(%lu)\n", process_before.tv_sec, process_before.tv_nsec, process_after.tv_sec, process_after.tv_nsec, diff); diff = th_after.tv_nsec - th_before.tv_nsec; printf("thread: before(%lu.%.9lu) after(%lu.%.9lu) diff(%lu)\n", th_before.tv_sec, th_before.tv_nsec, th_after.tv_sec, th_after.tv_nsec, diff); diff = me_after.tv_nsec - me_before.tv_nsec; printf("self: before(%lu.%.9lu) after(%lu.%.9lu) diff(%lu)\n", me_before.tv_sec, me_before.tv_nsec, me_after.tv_sec, me_after.tv_nsec, diff); return 0; } This is due to us using p->se.sum_exec_runtime in thread_group_cputime() where we iterate the thread group and sum all data. This does not take time since the last schedule operation (tick or otherwise) into account. We can cure this by using task_sched_runtime() at the cost of having to take locks. This also means we can (and must) do away with thread_group_sched_runtime() since the modified thread_group_cputime() is now more accurate and would deadlock when called from thread_group_sched_runtime(). Aside of that it makes the function safe on 32 bit systems. The old code added t->se.sum_exec_runtime unprotected. sum_exec_runtime is a 64bit value and could be changed on another cpu at the same time. Reported-by: David Miller Signed-off-by: Peter Zijlstra Cc: stable@kernel.org Link: http://lkml.kernel.org/r/1314874459.7945.22.camel@twins Tested-by: David Miller Signed-off-by: Thomas Gleixner commit 798cb7e897210dbf827f69a302c0967e0380ebac Author: Takashi Iwai Date: Fri Sep 30 08:52:26 2011 +0200 ALSA: hda - Fix a regression of the position-buffer check The commit a810364a0424c297242c6c66071a42f7675a5568 ALSA: hda - Handle -1 as invalid position, too caused a regression on some machines that require the position-buffer instead of LPIB, e.g. resulting in noises with mic recording with PulseAudio. This patch fixes the detection by delaying the test at the timing as same as 3.0, i.e. doing the position check only when requested in azx_position_ok(). Reported-and-tested-by: Rocko Requin Signed-off-by: Takashi Iwai commit 47ea91b4052d9e94b9dca5d7a3d947fbebd07ba9 Author: Ram Pai Date: Thu Sep 22 15:48:58 2011 +0800 Resource: fix wrong resource window calculation __find_resource() incorrectly returns a resource window which overlaps an existing allocated window. This happens when the parent's resource-window spans 0x00000000 to 0xffffffff and is entirely allocated to all its children resource-windows. __find_resource() looks for gaps in resource allocation among the children resource windows. When it encounters the last child window it blindly tries the range next to one allocated to the last child. Since the last child's window ends at 0xffffffff the calculation overflows, leading the algorithm to believe that any window in the range 0x0000000 to 0xfffffff is available for allocation. This leads to a conflicting window allocation. Michal Ludvig reported this issue seen on his platform. The following patch fixes the problem and has been verified by Michal. I believe this bug has been there for ages. It got exposed by git commit 2bbc6942273b ("PCI : ability to relocate assigned pci-resources") Signed-off-by: Ram Pai Tested-by: Michal Ludvig Signed-off-by: Linus Torvalds commit 92bb062fe36132a04c6dc8b3c51c945730b05224 Merge: 7409b7132ca9 8adc8b3d7803 Author: Linus Torvalds Date: Thu Sep 29 19:58:58 2011 -0700 Merge branch 'for-linus' of git://github.com/NewDreamNetwork/ceph-client * 'for-linus' of git://github.com/NewDreamNetwork/ceph-client: libceph: fix pg_temp mapping update libceph: fix pg_temp mapping calculation libceph: fix linger request requeuing libceph: fix parse options memory leak libceph: initialize ack_stamp to avoid unnecessary connection reset commit 7409b7132ca96d01b373541d788e8c5893bec1f3 Merge: 0ecdb12a7ae9 e74d83aad370 Author: Linus Torvalds Date: Thu Sep 29 19:29:45 2011 -0700 Merge branch 'v4l_for_linus' of git://linuxtv.org/mchehab/for_linus * 'v4l_for_linus' of git://linuxtv.org/mchehab/for_linus: [media] omap3isp: Fix build error in ispccdc.c [media] uvcvideo: Fix crash when linking entities [media] v4l: Make sure we hold a reference to the v4l2_device before using it [media] v4l: Fix use-after-free case in v4l2_device_release [media] uvcvideo: Set alternate setting 0 on resume if the bus has been reset [media] OMAP_VOUT: Fix build break caused by update_mode removal in DSS2 commit 0ecdb12a7ae983a012f662373fb3ccc22b920ed8 Merge: 5fe858b5b76b a681887f7b0f Author: Linus Torvalds Date: Thu Sep 29 19:28:26 2011 -0700 Merge branch 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6 * 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6: [S390] cio: fix cio_tpi ignoring adapter interrupts [S390] gmap: always up mmap_sem properly [S390] Do not clobber personality flags on exec commit 5fe858b5b76be3cb1b1cf3ea40b7ca6706f8329c Merge: 8e8e500fcada f4142cba4e40 Author: Linus Torvalds Date: Thu Sep 29 19:24:33 2011 -0700 Merge git://github.com/davem330/sparc * git://github.com/davem330/sparc: sparc64: Force the execute bit in OpenFirmware's translation entries. sparc: Make '-p' boot option meaningful again. sparc, exec: remove redundant addr_limit assignment sparc64: Future proof Niagara cpu detection. commit 8e8e500fcadaf2e39f4f119ae60c289456527727 Merge: 16fa42affd48 cd0de039bff3 Author: Linus Torvalds Date: Thu Sep 29 19:23:30 2011 -0700 Merge branch 'drm-intel-fixes' of git://people.freedesktop.org/~keithp/linux * 'drm-intel-fixes' of git://people.freedesktop.org/~keithp/linux: drm/i915: FBC off for ironlake and older, otherwise on by default drm/i915: Enable SDVO hotplug interrupts for HDMI and DVI drm/i915: Enable dither whenever display bpc < frame buffer bpc commit 16fa42affd484bb500533a7e78e0c72687eddd58 Author: Benjamin Herrenschmidt Date: Thu Sep 29 15:57:01 2011 +1000 powerpc: Fix device-tree matching for Apple U4 bridge Apple Quad G5 has some oddity in it's device-tree which causes the new generic matching code to fail to relate nodes for PCI-E devices below U4 with their respective struct pci_dev. This breaks graphics on those machines among others. This fixes it using a quirk which copies the node pointer from the host bridge for the root complex, which makes the generic code work for the children afterward. Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Linus Torvalds commit b0f84374b6ab0dc9c47975df0b02d46165d558d4 Author: wangyanqing Date: Thu Sep 29 15:09:40 2011 +0800 bootup: move 'usermodehelper_enable()' a little earlier Commit d5767c53535a ("bootup: move 'usermodehelper_enable()' to the end of do_basic_setup()") moved 'usermodehelper_enable()' to end of do_basic_setup() to after the initcalls. But then I get failed to let uvesafb work on my computer, and lose the splash boot. So maybe we could start usermodehelper_enable a little early to make some task work that need eary init with the help of user mode. [ I would *really* prefer that initcalls not call into user space - even the real 'init' hasn't been execve'd yet, after all! But for uvesafb it really does look like we don't have much choice. I considered doing this when we mount the root filesystem, but depending on config options that is in multiple places. We could do the usermode helper enable as a rootfs_initcall().. So I'm just using wang yanqing's trivial patch. It's not wonderful, but it's simple and should work. We should revisit this some day, though. - Linus ] Signed-off-by: Linus Torvalds commit 12d0d0d3a7349daa95dbfd5d7df8146255bc7c67 Author: Oliver Hartkopp Date: Thu Sep 29 15:33:47 2011 -0400 can bcm: fix incomplete tx_setup fix The commit aabdcb0b553b9c9547b1a506b34d55a764745870 ("can bcm: fix tx_setup off-by-one errors") fixed only a part of the original problem reported by Andre Naujoks. It turned out that the original code needed to be re-ordered to reduce complexity and to finally fix the reported frame counting issues. Signed-off-by: Oliver Hartkopp Signed-off-by: David S. Miller commit 8e303f20f4b3611615118a22a737fd2dc7c4ef81 Author: Jiri Olsa Date: Thu Sep 29 17:05:08 2011 +0200 perf tools: Fix raw sample reading Wrong pointer is being passed for raw data sanity checking, when parsing sample event. This ends up with invalid event and perf record being stuck in __perf_session__process_events function during processing build IDs (process_buildids function). Following command hangs up in my setup: ./perf record -e raw_syscalls:sys_enter ls The fix is to use proper pointer to the raw data instead of the 'u' union. Reviewed-by: David Ahern Cc: David Ahern Cc: Eric Dumazet Cc: Ingo Molnar Cc: Neil Horman Cc: Paul Mackerras Cc: Peter Zijlstra Cc: Steven Rostedt Link: http://lkml.kernel.org/r/1317308709-9474-2-git-send-email-jolsa@redhat.com Signed-off-by: Jiri Olsa Signed-off-by: Arnaldo Carvalho de Melo commit f4142cba4e4065a416e78ade905bea29ff3930e6 Author: David S. Miller Date: Thu Sep 29 12:18:59 2011 -0700 sparc64: Force the execute bit in OpenFirmware's translation entries. In the OF 'translations' property, the template TTEs in the mappings never specify the executable bit. This is the case even though some of these mappings are for OF's code segment. Therefore, we need to force the execute bit on in every mapping. This problem can only really trigger on Niagara/sun4v machines and the history behind this is a little complicated. Previous to sun4v, the sun4u TTE entries lacked a hardware execute permission bit. So OF didn't have to ever worry about setting anything to handle executable pages. Any valid TTE loaded into the I-TLB would be respected by the chip. But sun4v Niagara chips have a real hardware enforced executable bit in their TTEs. So it has to be set or else the I-TLB throws an instruction access exception with type code 6 (protection violation). We've been extremely fortunate to not get bitten by this in the past. The best I can tell is that the OF's mappings for it's executable code were mapped using permanent locked mappings on sun4v in the past. Therefore, the fact that we didn't have the exec bit set in the OF translations we would use did not matter in practice. Thanks to Greg Onufer for helping me track this down. Signed-off-by: David S. Miller commit 85a64889492b45f931ddac87ec09d84aa7347ee1 Author: Jonathan Lallinger Date: Thu Sep 29 07:58:41 2011 +0000 RDSRDMA: Fix cleanup of rds_iw_mr_pool In the rds_iw_mr_pool struct the free_pinned field keeps track of memory pinned by free MRs. While this field is incremented properly upon allocation, it is never decremented upon unmapping. This would cause the rds_rdma module to crash the kernel upon unloading, by triggering the BUG_ON in the rds_iw_destroy_mr_pool function. This change keeps track of the MRs that become unpinned, so that free_pinned can be decremented appropriately. Signed-off-by: Jonathan Lallinger Signed-off-by: Steve Wise Signed-off-by: David S. Miller commit 605b91c8f619047ed6d88e24c531d4bdddad46f4 Author: Roy.Li Date: Wed Sep 28 19:51:54 2011 +0000 net: Documentation: Fix type of variables Signed-off-by: Roy.Li Signed-off-by: David S. Miller commit 95de86cf5162f78bc5aea80d1a9e5a248196ffaf Author: Brian King Date: Wed Sep 28 05:33:43 2011 +0000 ibmveth: Fix oops on request_irq failure If request_irq fails, the ibmveth driver will overwrite the rc and end up returning a successful rc on its open function, resulting in an oops later when a packet gets sent and buffers are not allocated due to the failed open. Signed-off-by: Brian King Signed-off-by: David S. Miller commit 676a1184e8afd4fed7948232df1ff91517400859 Author: Yan, Zheng Date: Sun Sep 25 02:21:30 2011 +0000 ipv6: nullify ipv6_ac_list and ipv6_fl_list when creating new socket ipv6_ac_list and ipv6_fl_list from listening socket are inadvertently shared with new socket created for connection. Signed-off-by: Zheng Yan Signed-off-by: David S. Miller commit 6482aa7c120447858da1869197b48eff66435a31 Author: Divy Le Ray Date: Sat Sep 24 06:11:31 2011 +0000 cxgb4: Fix EEH on IBM P7IOC Fix EEH recovery on new P Series platform by requesting fundamental reset. Signed-off-by: Divy Le Ray Signed-off-by: David S. Miller commit aabdcb0b553b9c9547b1a506b34d55a764745870 Author: Oliver Hartkopp Date: Fri Sep 23 08:23:47 2011 +0000 can bcm: fix tx_setup off-by-one errors This patch fixes two off-by-one errors that canceled each other out. Checking for the same condition two times in bcm_tx_timeout_tsklet() reduced the count of frames to be sent by one. This did not show up the first time tx_setup is invoked as an additional frame is sent due to TX_ANNONCE. Invoking a second tx_setup on the same item led to a reduced (by 1) number of sent frames. Reported-by: Andre Naujoks Signed-off-by: Oliver Hartkopp Signed-off-by: David S. Miller commit d3c52173be57ec920deda28923d80b68e5630594 Author: Ian Campbell Date: Wed Sep 21 22:08:26 2011 +0000 MAINTAINERS: tehuti: Alexander Indenbaum's address bounces I got: Generating server: Tehuti.onmicrosoft.com baum@tehutinetworks.net #< #5.1.1 smtp;550 5.1.1 RESOLVER.ADR.RecipNotFound; not found> #SMTP# Signed-off-by: Ian Campbell Cc: Alexander Indenbaum Cc: Andy Gospodarek Cc: Andrew Morton Cc: netdev@vger.kernel.org Signed-off-by: David S. Miller commit 02715ed2e7b71569ed6e61f0b23b0736a509913d Author: Richard Cochran Date: Tue Sep 20 01:25:42 2011 +0000 dp83640: reduce driver noise The driver has two warning messages that might be triggered by normal use cases. When they appear, the messages give the impression of a never ending series of errors. This commit changes them to debug messages instead. Signed-off-by: Richard Cochran Signed-off-by: David S. Miller commit f75159e9936143177b442afc78150b7a7ad8aa07 Author: Richard Cochran Date: Tue Sep 20 01:25:41 2011 +0000 ptp: fix L2 event message recognition The IEEE 1588 standard defines two kinds of messages, event and general messages. Event messages require time stamping, and general do not. When using UDP transport, two separate ports are used for the two message types. The BPF designed to recognize event messages incorrectly classifies L2 general messages as event messages. This commit fixes the issue by extending the filter to check the message type field for L2 PTP packets. Event messages are be distinguished from general messages by testing the "general" bit. Signed-off-by: Richard Cochran Cc: Signed-off-by: David S. Miller commit d5767c53535ac79758084773418e0ad186aba4a2 Author: Linus Torvalds Date: Wed Sep 28 10:23:44 2011 -0700 bootup: move 'usermodehelper_enable()' to the end of do_basic_setup() Doing it just before starting to call into cpu_idle() made a sick kind of sense only because the original bug we fixed (see commit 288d5abec831: "Boot up with usermodehelper disabled") was about problems with some scheduler data structures not being initialized, and they had better be initialized at that point. But it really didn't make any other conceptual sense, and doing it after the initial "schedule()" call for the idle thread actually opened up a race: what if the main initialization thread did everything without needing to sleep, and got all the way into user land too? Without actually having scheduled back to the idle thread? Now, in normal circumstances that doesn't ever happen, but it looks like Richard Cochran triggered exactly that on his ARM IXP4xx machines: "I have some ARM IXP4xx based machines that use the two on chip MAC ports (aka NPEs). The NPE needs a firmware in order to function. Ever since the following commit [that 288d5abec831 one], it is no longer possible to bring up the interfaces during the init scripts." with a call trace showing an ioctl coming from user space. Richard says: "The init is busybox, and the startup script does mount, syslogd, and then ifup, so that all can go by quickly." The fix is to move the usermodehelper_enable() into the main 'init' thread, and just put it after we've done all our initcalls. By then, everything really should be up, but we've obviously not actually started the user-mode portion of init yet. Reported-and-tested-by: Richard Cochran Signed-off-by: Linus Torvalds commit 8adc8b3d780363d5df0dd6ace10336e3d7e331a1 Author: Sage Weil Date: Wed Sep 28 10:11:04 2011 -0700 libceph: fix pg_temp mapping update The incremental map updates have a record for each pg_temp mapping that is to be add/updated (len > 0) or removed (len == 0). The old code was written as if the updates were a complete enumeration; that was just wrong. Update the code to remove 0-length entries and drop the rbtree traversal. This avoids misdirected (and hung) requests that manifest as server errors like [WRN] client4104 10.0.1.219:0/275025290 misdirected client4104.1:129 0.1 to osd0 not [1,0] in e11/11 Signed-off-by: Sage Weil commit 782e182e91e97f529a1edb30fdece9f1bef90ecc Author: Sage Weil Date: Wed Sep 28 10:08:27 2011 -0700 libceph: fix pg_temp mapping calculation We need to apply the modulo pg_num calculation before looking up a pgid in the pg_temp mapping rbtree. This fixes pg_temp mappings, and fixes (some) misdirected requests that result in messages like [WRN] client4104 10.0.1.219:0/275025290 misdirected client4104.1:129 0.1 to osd0 not [1,0] in e11/11 on the server and stall make the client block without getting a reply (at least until the pg_temp mapping goes way, but that can take a long long time). Reorder calc_pg_raw() a bit to make more sense. Signed-off-by: Sage Weil commit 2ef7b45a5925c54d948f858e42babb0533b9a3c5 Merge: 07117e305487 b582ad8e961c Author: Linus Torvalds Date: Wed Sep 28 08:39:05 2011 -0700 Merge git://github.com/davem330/net * git://github.com/davem330/net: ipv6-multicast: Fix memory leak in IPv6 multicast. ipv6: check return value for dst_alloc net: check return value for dst_alloc ipv6-multicast: Fix memory leak in input path. bnx2x: add missing break in bnx2x_dcbnl_get_cap bnx2x: fix WOL by enablement PME in config space bnx2x: fix hw attention handling net: fix a typo in Documentation/networking/scaling.txt ath9k: Fix a dma warning/memory leak rtlwifi: rtl8192cu: Fix unitialized struct iwlagn: fix dangling scan request batman-adv: do_bcast has to be true for broadcast packets only cfg80211: Fix validation of AKM suites iwlegacy: do not use interruptible waits iwlegacy: fix command queue timeout ath9k_hw: Fix Rx DMA stuck for AR9003 chips commit 07117e305487b0d4251a97d3529fa2c7d930d36a Merge: c54a06d45a93 96067723e46b Author: Linus Torvalds Date: Wed Sep 28 08:23:39 2011 -0700 Merge git://bedivere.hansenpartnership.com/git/scsi-rc-fixes-2.6 * git://bedivere.hansenpartnership.com/git/scsi-rc-fixes-2.6: [SCSI] 3w-9xxx: fix iommu_iova leak [SCSI] cxgb3i: convert cdev->l2opt to use rcu to prevent NULL dereference [SCSI] scsi: qla4xxx needs libiscsi.o [SCSI] libsas: fix failure to revalidate domain for anything but the first expander child. [SCSI] aacraid: reset should disable MSI interrupt commit 20ecb499f64a7e8e7fe03f6098ab25c71b7a6481 Author: Guenter Roeck Date: Sat Sep 24 15:27:04 2011 -0700 hwmon: (coretemp) Avoid leaving around dangling pointer Storing the struct temp_data pointer allocated from create_core_data() when returning an error has the potential of leaving around a pointer to freed memory. Reset it to NULL for error returns. Reported-by: Jan Beulich Signed-off-by: Guenter Roeck Acked-by: Jean Delvare commit 0eb9782ad9b1bd496ba61cd5ea27ccb8db21e885 Author: Jean Delvare Date: Wed Sep 28 08:11:00 2011 -0700 hwmon: (coretemp) Fixup platform device ID change With recent change "hwmon: (coretemp) don't use kernel assigned CPU number as platform device ID", the microcode check is now running on random CPU. Fix that by checking the microcode before creating the platform device rather than at probe time. Also avoid calling TO_PHYS_ID(cpu) twice in the same function, it's expensive. Signed-off-by: Jean Delvare Cc: Jan Beulich Cc: Guenter Roeck Signed-off-by: Guenter Roeck commit c54a06d45a937750e76df2f91e940f82c07c5bf7 Merge: e689ec8057ea 777eb1bf15b8 Author: Linus Torvalds Date: Wed Sep 28 08:03:00 2011 -0700 Merge branch 'for-linus' of git://git.kernel.dk/linux-block * 'for-linus' of git://git.kernel.dk/linux-block: block: Free queue resources at blk_release_queue() commit e689ec8057ea07f918dc2201a5beb7f2292db32f Merge: a102a9ece548 c8ad620638f9 Author: Linus Torvalds Date: Wed Sep 28 08:01:05 2011 -0700 Merge branch 'writeback-for-linus' of git://github.com/fengguang/linux * 'writeback-for-linus' of git://github.com/fengguang/linux: writeback: show raw dirtied_when in trace writeback_single_inode commit 777eb1bf15b8532c396821774bf6451e563438f5 Author: Hannes Reinecke Date: Wed Sep 28 08:07:01 2011 -0600 block: Free queue resources at blk_release_queue() A kernel crash is observed when a mounted ext3/ext4 filesystem is physically removed. The problem is that blk_cleanup_queue() frees up some resources eg by calling elevator_exit(), which are not checked for in normal operation. So we should rather move these calls to the destructor function blk_release_queue() as at that point all remaining references are gone. However, in doing so we have to ensure that any externally supplied queue_lock is disconnected as the driver might free up the lock after the call of blk_cleanup_queue(), Signed-off-by: Hannes Reinecke Signed-off-by: Jens Axboe commit b582ad8e961c78458005250ae28fdd7a25db55aa Merge: 67928c404160 a8acfd82ebef Author: David S. Miller Date: Tue Sep 27 22:42:30 2011 -0400 Merge branch 'for-davem' of git://git.infradead.org/users/linville/wireless commit a102a9ece5489e1718cd7543aa079082450ac3a2 Author: Linus Torvalds Date: Tue Sep 27 15:48:34 2011 -0700 Linux 3.1-rc8 commit 058e0676ba73d1345e70d07d341a29e2073b2e67 Merge: 57119327df3a 0fac25908f8e Author: Linus Torvalds Date: Tue Sep 27 15:46:21 2011 -0700 Merge branch 'for-linus' of git://github.com/tiwai/sound * 'for-linus' of git://github.com/tiwai/sound: ASoC: ssm2602: Re-enable oscillator after suspend ALSA: usb-audio: Check for possible chip NULL pointer before clearing probing flag ALSA: hda/realtek - Don't detect LO jack when identical with HP ALSA: hda/realtek - Avoid bogus HP-pin assignment ALSA: HDA: No power nids on 92HD93 ASoC: omap-mcbsp: Do not attempt to change DAI sysclk if stream is active commit 57119327df3a824dc9a59973d3db7e5bdd2e75cc Merge: b6c8069d3577 e8b364b88cc4 Author: Linus Torvalds Date: Tue Sep 27 15:41:32 2011 -0700 Merge branch 'pm-fixes' of git://github.com/rjwysocki/linux-pm * 'pm-fixes' of git://github.com/rjwysocki/linux-pm: PM / Clocks: Do not acquire a mutex under a spinlock commit a8acfd82ebefbb32f12f413019e53f9e939cf44e Merge: d93dc5c4478c ba5423855262 Author: John W. Linville Date: Tue Sep 27 15:47:33 2011 -0400 Merge branch 'master' of git://git.infradead.org/users/linville/wireless into for-davem commit 67928c4041606f02725f3c95c4c0404e4532df1b Author: Ben Greear Date: Fri Sep 23 13:11:01 2011 +0000 ipv6-multicast: Fix memory leak in IPv6 multicast. If reg_vif_xmit cannot find a routing entry, be sure to free the skb before returning the error. Signed-off-by: Ben Greear Signed-off-by: David S. Miller commit fbe58186901155c0cb5398dd343337be0c456c04 Author: Madalin Bucur Date: Mon Sep 26 07:04:56 2011 +0000 ipv6: check return value for dst_alloc return value of dst_alloc must be checked before use Signed-off-by: Madalin Bucur Signed-off-by: David S. Miller commit d4cae56219755ccf8acfc8e2c1927009ff29d8c6 Author: Madalin Bucur Date: Mon Sep 26 07:04:36 2011 +0000 net: check return value for dst_alloc return value of dst_alloc must be checked before use Signed-off-by: Madalin Bucur Signed-off-by: David S. Miller commit 2015de5fe2a47086a3260802275932bfd810884e Author: Ben Greear Date: Tue Sep 27 15:16:08 2011 -0400 ipv6-multicast: Fix memory leak in input path. Have to free the skb before returning if we fail the fib lookup. Signed-off-by: Ben Greear Signed-off-by: David S. Miller commit 29453f65a4d0a46190dedf93ab31717d4c26bda6 Merge: a0babc80eb37 8b267b312df9 Author: David S. Miller Date: Tue Sep 27 15:05:47 2011 -0400 Merge branch 'batman-adv/maint' of git://git.open-mesh.org/linux-merge commit a0babc80eb375aad69dab4687c3b44c47d42f241 Author: Shmulik Ravid Date: Thu Sep 22 02:33:33 2011 +0000 bnx2x: add missing break in bnx2x_dcbnl_get_cap Signed-off-by: Dmitry Kravkov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit f99779035730f8c3be8aeadd386cc9e77e086446 Author: Dmitry Kravkov Date: Thu Sep 22 02:33:32 2011 +0000 bnx2x: fix WOL by enablement PME in config space Signed-off-by: Dmitry Kravkov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit f2eaeb58bf6995a979c413ea0cc73289533feacb Author: Dmitry Kravkov Date: Thu Sep 22 02:33:31 2011 +0000 bnx2x: fix hw attention handling Use register name to initialize attention mask Signed-off-by: Dmitry Kravkov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit e451e61b56b0401442f7a306cd309c3b0c56c285 Author: Jason Wang Date: Tue Sep 27 13:26:27 2011 -0400 net: fix a typo in Documentation/networking/scaling.txt Signed-off-by: Jason Wang Signed-off-by: David S. Miller commit 0fac25908f8e26a27d869f0aa4fad04c3db60dc7 Merge: 61a6a108d152 9058020cd9ae Author: Takashi Iwai Date: Tue Sep 27 18:21:41 2011 +0200 Merge branch 'fix/asoc' into for-linus commit a4be637b34a543af5b5421a8ee0ee04d30f5f58e Author: Roy.Li Date: Mon Sep 26 09:08:00 2011 +0800 staging/octeon: Software should check the checksum of no tcp/udp packets Icmp packets with wrong checksum are never dropped since skb->ip_summed is set to CHECKSUM_UNNECESSARY. When icmp packets with wrong checksum pass through the octeon net driver, the not_IP, IP_exc, L4_error hardware indicators show no error. so the driver sets CHECKSUM_UNNECESSARY on skb->ip_summed. L4_error only works for TCP/UDP, not for ICMP. Signed-off-by: Roy.Li To: linux-mips@linux-mips.org Cc: netdev@vger.kernel.org Cc: ralf@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/2798/ Acked-by: David Daney Cc: Greg KH commit b6c8069d3577481390b3f24a8434ad72a3235594 Author: Linus Torvalds Date: Tue Sep 27 08:12:33 2011 -0700 vfs: remove LOOKUP_NO_AUTOMOUNT flag That flag no longer makes sense, since we don't look up automount points as eagerly any more. Additionally, it turns out that the NO_AUTOMOUNT handling was buggy to begin with: it would avoid automounting even for cases where we really *needed* to do the automount handling, and could return ENOENT for autofs entries that hadn't been instantiated yet. With our new non-eager automount semantics, one discussion has been about adding a AT_AUTOMOUNT flag to vfs_fstatat (and thus the newfstatat() and fstatat64() system calls), but it's probably not worth it: you can always force at least directory automounting by simply adding the final '/' to the filename, which works for *all* of the stat family system calls, old and new. So AT_NO_AUTOMOUNT (and thus LOOKUP_NO_AUTOMOUNT) really were just a result of our bad default behavior. Acked-by: Ian Kent Acked-by: Trond Myklebust Signed-off-by: Linus Torvalds commit 9058020cd9ae3423d6fe7de591698dc96b6701aa Author: Lars-Peter Clausen Date: Tue Sep 27 11:08:46 2011 +0200 ASoC: ssm2602: Re-enable oscillator after suspend Currently the the internal oscillator is powered down when entering BIAS_OFF state, but not re-enabled when going back to BIAS_STANDBY. As a result the CODEC will stop working after suspend if the internal oscillator is used to generate the sysclock signal. This patch fixes it by clearing the appropriate bit in the power down register when the CODEC is re-enabled. Signed-off-by: Lars-Peter Clausen Signed-off-by: Mark Brown Cc: stable@kernel.org commit 815d405ceff0d6964683f033e18b9b23a88fba87 Author: Trond Myklebust Date: Mon Sep 26 20:36:09 2011 -0400 VFS: Fix the remaining automounter semantics regressions The concensus seems to be that system calls such as stat() etc should not trigger an automount. Neither should the l* versions. This patch therefore adds a LOOKUP_AUTOMOUNT flag to tag those lookups that _should_ trigger an automount on the last path element. Signed-off-by: Trond Myklebust [ Edited to leave out the cases that are already covered by LOOKUP_OPEN, LOOKUP_DIRECTORY and LOOKUP_CREATE - all of which also fundamentally force automounting for their own reasons - Linus ] Signed-off-by: Linus Torvalds commit d94c177beeb4469cd4f6e83354ab0223353e98ed Author: Linus Torvalds Date: Mon Sep 26 17:44:55 2011 -0700 vfs pathname lookup: Add LOOKUP_AUTOMOUNT flag Since we've now turned around and made LOOKUP_FOLLOW *not* force an automount, we want to add the ability to force an automount event on lookup even if we don't happen to have one of the other flags that force it implicitly (LOOKUP_OPEN, LOOKUP_DIRECTORY, LOOKUP_PARENT..) Most cases will never want to use this, since you'd normally want to delay automounting as long as possible, which usually implies LOOKUP_OPEN (when we open a file or directory, we really cannot avoid the automount any more). But Trond argued sufficiently forcefully that at a minimum bind mounting a file and quotactl will want to force the automount lookup. Some other cases (like nfs_follow_remote_path()) could use it too, although LOOKUP_DIRECTORY would work there as well. This commit just adds the flag and logic, no users yet, though. It also doesn't actually touch the LOOKUP_NO_AUTOMOUNT flag that is related, and was made irrelevant by the same change that made us not follow on LOOKUP_FOLLOW. Cc: Trond Myklebust Cc: Ian Kent Cc: Jeff Layton Cc: Miklos Szeredi Cc: David Howells Cc: Al Viro Cc: Greg KH Signed-off-by: Linus Torvalds commit 858b1814b89d043a3866299c258ccdc27eb2538c Merge: ef82bdc57a20 00aaad227aeb Author: Linus Torvalds Date: Mon Sep 26 16:29:26 2011 -0700 Merge branch 'samsung-fixes-3' of git://github.com/kgene/linux-samsung * 'samsung-fixes-3' of git://github.com/kgene/linux-samsung: ARM: EXYNOS4: Rename sclk_cam clocks for FIMC driver ARM: S5PV210: Rename sclk_cam clocks for FIMC media driver ARM: S5P: fix incorrect loop iterator usage on gpio-interrupt ARM: S3C2443: Fix bit-reset in setrate of clk_armdiv commit 00aaad227aeb30800ac85b981f3ea4e20ae9bd9e Author: Sylwester Nawrocki Date: Tue Sep 27 07:00:59 2011 +0900 ARM: EXYNOS4: Rename sclk_cam clocks for FIMC driver The sclk_cam clocks are now controlled by the top level FIMC media device driver bound to "s5p-fimc-md" platform device. Rename sclk_cam clocks so they accessible by the corresponding driver. Signed-off-by: Sylwester Nawrocki Signed-off-by: Kyungmin Park Signed-off-by: Kukjin Kim commit 83427c23a44e34be2985f5b1440c645ea8577938 Author: Sylwester Nawrocki Date: Tue Sep 27 07:00:53 2011 +0900 ARM: S5PV210: Rename sclk_cam clocks for FIMC media driver The sclk_cam clocks are now controlled by the top level FIMC media device driver bound to "s5p-fimc-md" platform device. Rename sclk_cam clocks so they accessible by the corresponding driver. Signed-off-by: Sylwester Nawrocki Signed-off-by: Kyungmin Park Signed-off-by: Kukjin Kim commit ef82bdc57a204bf452da9f7c273c21462f17344e Merge: 231e58e7d949 2f1c3db0a6ad Author: Linus Torvalds Date: Mon Sep 26 13:35:43 2011 -0700 Merge branch 'hwmon-for-linus' of git://github.com/groeck/linux * 'hwmon-for-linus' of git://github.com/groeck/linux: hwmon: (coretemp) remove struct platform_data * parameter from create_core_data() hwmon: (coretemp) constify static data hwmon: (coretemp) don't use kernel assigned CPU number as platform device ID hwmon: (ds620) Fix handling of negative temperatures hwmon: (w83791d) rename prototype parameter from 'register' to 'reg' hwmon: (coretemp) Don't use threshold registers for tempX_max hwmon: (coretemp) Let the user force TjMax hwmon: (coretemp) Drop duplicate function get_pkg_tjmax commit 231e58e7d9494bddbd05479f9f50ed0be66794d7 Merge: a2b49102daac 9be3be1f153e Author: Linus Torvalds Date: Mon Sep 26 13:33:44 2011 -0700 Merge branch 'kvm-updates/3.1' of git://github.com/avikivity/kvm * 'kvm-updates/3.1' of git://github.com/avikivity/kvm: KVM: x86 emulator: fix Src2CL decode KVM: MMU: fix incorrect return of spte commit a2b49102daac7a1d90dc01bfc4350ef68aa1204d Merge: f9d81f61c84a df77abcafc8d Author: Linus Torvalds Date: Mon Sep 26 13:26:30 2011 -0700 Merge branch 'fixes' of http://ftp.arm.linux.org.uk/pub/linux/arm/kernel/git-cur/linux-2.6-arm * 'fixes' of http://ftp.arm.linux.org.uk/pub/linux/arm/kernel/git-cur/linux-2.6-arm: ARM: 7099/1: futex: preserve oldval in SMP __futex_atomic_op ARM: dma-mapping: free allocated page if unable to map ARM: fix vmlinux.lds.S discarding sections ARM: nommu: fix warning with checksyscalls.sh ARM: 7091/1: errata: D-cache line maintenance operation by MVA may not succeed commit ba54238552625aad2d75f455a4d3db18ea7dec68 Author: Mohammed Shafi Shajakhan Date: Fri Sep 23 14:33:14 2011 +0530 ath9k: Fix a dma warning/memory leak proper dma_unmapping and freeing of skb's has to be done in the rx cleanup for EDMA chipsets when the device is unloaded and this also seems to address the following warning which shows up occasionally when the device is unloaded Call Trace: [] warn_slowpath_common+0x72/0xa0 [] ? dma_debug_device_change+0x19c/0x200 [] ? dma_debug_device_change+0x19c/0x200 [] warn_slowpath_fmt+0x33/0x40 [] dma_debug_device_change+0x19c/0x200 [] notifier_call_chain+0x82/0xb0 [] __blocking_notifier_call_chain+0x60/0x90 [] blocking_notifier_call_chain+0x1f/0x30 [] __device_release_driver+0xa4/0xc0 [] driver_detach+0x97/0xa0 [] bus_remove_driver+0x6c/0xe0 [] ? sysfs_addrm_finish+0x4b/0x60 [] driver_unregister+0x49/0x80 [] ? sysfs_remove_file+0x14/0x20 [] pci_unregister_driver+0x32/0x80 [] ath_pci_exit+0x12/0x20 [ath9k] [] ath9k_exit+0x17/0x36 [ath9k] [] ? mutex_unlock+0xd/0x10 [] sys_delete_module+0x13f/0x200 [] ? sys_munmap+0x4b/0x60 [] ? restore_all+0xf/0xf [] ? spurious_fault+0xe0/0xe0 [] ? trace_hardirqs_on_caller+0xf4/0x180 [] sysenter_do_call+0x12/0x38 ---[ end trace 16e1c1521c06bcf9 ]--- Mapped at: [] debug_dma_map_page+0x48/0x120 [] ath_rx_init+0x3f8/0x4b0 [ath9k] [] ath9k_init_device+0x4c4/0x7b0 [ath9k] [] ath_pci_probe+0x263/0x330 [ath9k] Signed-off-by: Mohammed Shafi Shajakhan Signed-off-by: John W. Linville commit 831d85471e761e190c3c8979b37540d699ae5812 Author: Larry Finger Date: Thu Sep 22 22:59:02 2011 -0500 rtlwifi: rtl8192cu: Fix unitialized struct Driver rtl8192cu assigns a new struct rtl_tcb_desc object, but fails to clear it. Signed-off-by: Larry Finger Cc: Stable [2.6.39+] Signed-off-by: John W. Linville commit 6c80c39d9a6986a566c30d797aae37bfb697eea3 Author: Johannes Berg Date: Thu Sep 22 14:59:04 2011 -0700 iwlagn: fix dangling scan request If iwl_scan_initiate() fails for any reason, priv->scan_request and priv->scan_vif are left dangling. This can lead to a crash later when iwl_bg_scan_completed() tries to run a pending scan request. In practice, this seems to be very rare due to the STATUS_SCANNING check earlier. That check, however, is wrong -- it should allow a scan to be queued when a reset/roc scan is going on. When a normal scan is already going on, a new one can't be issued by mac80211, so that code can be removed completely. I introduced this bug when adding off-channel support in commit 266af4c745952e9bebf687dd68af58df553cb59d. Cc: stable@kernel.org [3.0] Reported-by: Peng Yan Signed-off-by: Johannes Berg Signed-off-by: Wey-Yi Guy Signed-off-by: John W. Linville commit e8b364b88cc4001b21c28c1ecf1e1e3ffbe162e6 Author: Rafael J. Wysocki Date: Mon Sep 26 19:40:23 2011 +0200 PM / Clocks: Do not acquire a mutex under a spinlock Commit b7ab83e (PM: Use spinlock instead of mutex in clock management functions) introduced a regression causing clocks_mutex to be acquired under a spinlock. This happens because pm_clk_suspend() and pm_clk_resume() call pm_clk_acquire() under pcd->lock, but pm_clk_acquire() executes clk_get() which causes clocks_mutex to be acquired. Similarly, __pm_clk_remove(), executed under pcd->lock, calls clk_put(), which also causes clocks_mutex to be acquired. To fix those problems make pm_clk_add() call pm_clk_acquire(), so that pm_clk_suspend() and pm_clk_resume() don't have to do that. Change pm_clk_remove() and pm_clk_destroy() to separate modifications of the pcd->clock_list list from the actual removal of PM clock entry objects done by __pm_clk_remove(). Reported-and-tested-by: Guennadi Liakhovetski Signed-off-by: Rafael J. Wysocki Acked-by: Russell King commit a681887f7b0f8b7698e4b22f1191015424fa96e4 Author: Peter Oberparleiter Date: Mon Sep 26 16:40:35 2011 +0200 [S390] cio: fix cio_tpi ignoring adapter interrupts Ensure that adapter interrupts are correctly processed when they are retrieved using TEST PENDING INTERRUPTION. Signed-off-by: Peter Oberparleiter Signed-off-by: Martin Schwidefsky commit 05873df981ca1dd32f398e7b4e19864de907e064 Author: Carsten Otte Date: Mon Sep 26 16:40:34 2011 +0200 [S390] gmap: always up mmap_sem properly If gmap_unmap_segment figures that the segment was not mapped in the first place, it need to up mmap_sem on exit. Cc: Signed-off-by: Carsten Otte Signed-off-by: Martin Schwidefsky commit f9783ec862ea8ce0071f34a7fd028229d9fd98b4 Author: Martin Schwidefsky Date: Mon Sep 26 16:40:33 2011 +0200 [S390] Do not clobber personality flags on exec Analog to git commit 59e4c3a2fe9cb1681bb2cff508ff79466f7585ba do not clear the additional personality flags on exec. We need to inherit the personality bits in PER_MASK across exec. Signed-off-by: Martin Schwidefsky commit 96067723e46b0dd24ae7b934085ab4eff4d26a1b Author: James Bottomley Date: Sun Sep 18 18:56:20 2011 +0400 [SCSI] 3w-9xxx: fix iommu_iova leak Following reports on the list, it looks like the 3e-9xxx driver will leak dma mappings every time we get a transient queueing error back from the card. This is because it maps the sg list in the routine that sends the command, but doesn't unmap again in the transient failure path (even though the command is sent back to the block layer). Fix by unmapping before returning the status. Reported-by: Chris Boot Tested-by: Chris Boot Acked-by: Adam Radford Cc: stable@kernel.org Signed-off-by: James Bottomley commit e48f129c2f200dde8899f6ea5c6e7173674fc482 Author: Neil Horman Date: Tue Sep 6 13:59:13 2011 -0400 [SCSI] cxgb3i: convert cdev->l2opt to use rcu to prevent NULL dereference This oops was reported recently: d:mon> e cpu 0xd: Vector: 300 (Data Access) at [c0000000fd4c7120] pc: d00000000076f194: .t3_l2t_get+0x44/0x524 [cxgb3] lr: d000000000b02108: .init_act_open+0x150/0x3d4 [cxgb3i] sp: c0000000fd4c73a0 msr: 8000000000009032 dar: 0 dsisr: 40000000 current = 0xc0000000fd640d40 paca = 0xc00000000054ff80 pid = 5085, comm = iscsid d:mon> t [c0000000fd4c7450] d000000000b02108 .init_act_open+0x150/0x3d4 [cxgb3i] [c0000000fd4c7500] d000000000e45378 .cxgbi_ep_connect+0x784/0x8e8 [libcxgbi] [c0000000fd4c7650] d000000000db33f0 .iscsi_if_rx+0x71c/0xb18 [scsi_transport_iscsi2] [c0000000fd4c7740] c000000000370c9c .netlink_data_ready+0x40/0xa4 [c0000000fd4c77c0] c00000000036f010 .netlink_sendskb+0x4c/0x9c [c0000000fd4c7850] c000000000370c18 .netlink_sendmsg+0x358/0x39c [c0000000fd4c7950] c00000000033be24 .sock_sendmsg+0x114/0x1b8 [c0000000fd4c7b50] c00000000033d208 .sys_sendmsg+0x218/0x2ac [c0000000fd4c7d70] c00000000033f55c .sys_socketcall+0x228/0x27c [c0000000fd4c7e30] c0000000000086a4 syscall_exit+0x0/0x40 --- Exception: c01 (System Call) at 00000080da560cfc The root cause was an EEH error, which sent us down the offload_close path in the cxgb3 driver, which in turn sets cdev->l2opt to NULL, without regard for upper layer driver (like the cxgbi drivers) which might have execution contexts in the middle of its use. The result is the oops above, when t3_l2t_get attempts to dereference L2DATA(cdev)->nentries in arp_hash right after the EEH error handler sets it to NULL. The fix is to prevent the setting of the NULL pointer until after there are no further users of it. The t3cdev->l2opt pointer is now converted to be an rcu pointer and the L2DATA macro is now called under the protection of the rcu_read_lock(). When the EEH error path: t3_adapter_error->offload_close->cxgb3_offload_deactivate Is exectured, setting of that l2opt pointer to NULL, is now gated on an rcu quiescence point, preventing, allowing L2DATA callers to safely check for a NULL pointer without concern that the underlying data will be freeded before the pointer is dereferenced. This has been tested by the reporter and shown to fix the reproted oops [nhorman: fix up unitinialised variable reported by Dan Carpenter] Signed-off-by: Neil Horman Reviewed-by: Karen Xie Cc: stable@kernel.org Signed-off-by: James Bottomley commit 61a6a108d15213f5ee06332e1e7766d3860e4453 Author: Thomas Pfaff Date: Mon Sep 26 15:43:59 2011 +0200 ALSA: usb-audio: Check for possible chip NULL pointer before clearing probing flag Before clearing the probing flag in the error exit path, check that the chip pointer is not NULL. Signed-off-by: Thomas Pfaff Cc: [2.6.39+] Signed-off-by: Takashi Iwai commit e0d32e335fc0e354db93a807736243f5035fbc67 Author: Takashi Iwai Date: Mon Sep 26 15:19:55 2011 +0200 ALSA: hda/realtek - Don't detect LO jack when identical with HP The spec->autocfg.line_out_pins[] may contain the same pins as hp_pins[] depending on the configuration. When they are identical, detecting the line_jack_present flag screws up the auto-mute because alc_line_automute() is called unconditionally at initialization while it won't be triggered by unsol events, thus the old line_jack_present flag is kept for the whole run. For fixing this buggy behavior, the driver needs to check whether the line-outs are really individual, and skip if same as headphone jacks. Reference: https://bugzilla.novell.com/show_bug.cgi?id=716104 Signed-off-by: Takashi Iwai commit df77abcafc8dc881b6c9347548651777088e4b27 Author: Will Deacon Date: Fri Sep 23 14:34:12 2011 +0100 ARM: 7099/1: futex: preserve oldval in SMP __futex_atomic_op The SMP implementation of __futex_atomic_op clobbers oldval with the status flag from the exclusive store. This causes it to always read as zero when performing the FUTEX_OP_CMP_* operation. This patch updates the ARM __futex_atomic_op implementations to take a tmp argument, allowing us to store the strex status flag without overwriting the register containing oldval. Cc: stable@kernel.org Reported-by: Minho Ban Reviewed-by: Nicolas Pitre Signed-off-by: Will Deacon Signed-off-by: Russell King commit 6ebbe7a07b3bc40b168d2afc569a6543c020d2e3 Author: Simon Kirby Date: Thu Sep 22 17:03:46 2011 -0700 sched: Fix up wchan borkage Commit c259e01a1ec ("sched: Separate the scheduler entry for preemption") contained a boo-boo wrecking wchan output. It forgot to put the new schedule() function in the __sched section and thereby doesn't get properly ignored for things like wchan. Tested-by: Simon Kirby Cc: stable@kernel.org # 2.6.39+ Signed-off-by: Peter Zijlstra Link: http://lkml.kernel.org/r/20110923000346.GA25425@hostway.ca Signed-off-by: Ingo Molnar commit 5fe6e0151dbd969f5fbcd94d05c968b76d76952b Author: Takashi Iwai Date: Mon Sep 26 10:41:21 2011 +0200 ALSA: hda/realtek - Avoid bogus HP-pin assignment When the headphone pin is assigned as primary output to line_out_pins[], the automatic HP-pin assignment by ASSID must be suppressed. Otherwise a wrong pin might be assigned to the headphone and breaks the auto-mute. Reference: https://bugzilla.novell.com/show_bug.cgi?id=716104 Signed-off-by: Takashi Iwai Cc: commit d8e89b47e00ee80e920761145144640aac4cf71a Author: Russell King Date: Thu Sep 22 10:32:25 2011 +0100 ARM: dma-mapping: free allocated page if unable to map If the attempt to map a page for DMA fails (eg, because we're out of mapping space) then we must not hold on to the page we allocated for DMA - doing so will result in a memory leak. Cc: Reported-by: Bryan Phillippe Tested-by: Bryan Phillippe Signed-off-by: Russell King commit b76f7cdca5af18fa7a59a5c8a9eb5e02418e827a Author: Marek Szyprowski Date: Mon Sep 26 13:16:45 2011 +0900 ARM: S5P: fix incorrect loop iterator usage on gpio-interrupt Loop iterator value after terminating list_for_each_entry() is not NULL. This patch fixes incorrect iterator usage in GPIO interrupt code for SAMSUNG S5P platforms. Signed-off-by: Marek Szyprowski Signed-off-by: Kyungmin Park Signed-off-by: Kukjin Kim commit 4344646ff127eaea4d58266ccd8fdd2a38fb9672 Author: Heiko Stuebner Date: Mon Sep 26 10:30:29 2011 +0900 ARM: S3C2443: Fix bit-reset in setrate of clk_armdiv The changed statement should set the old armdiv bits to 0 and not everything else, before setting the new value. Signed-off-by: Heiko Stuebner Signed-off-by: Kukjin Kim commit 983c7db347db8ce2d8453fd1d89b7a4bb6920d56 Author: Milan Broz Date: Sun Sep 25 23:26:21 2011 +0100 dm crypt: always disable discard_zeroes_data If optional discard support in dm-crypt is enabled, discards requests bypass the crypt queue and blocks of the underlying device are discarded. For the read path, discarded blocks are handled the same as normal ciphertext blocks, thus decrypted. So if the underlying device announces discarded regions return zeroes, dm-crypt must disable this flag because after decryption there is just random noise instead of zeroes. Signed-off-by: Milan Broz Signed-off-by: Alasdair G Kergon commit 8232480944d173378082ebb2cac8a3207c08cf31 Author: Jonthan Brassow Date: Sun Sep 25 23:26:19 2011 +0100 dm: raid fix write_mostly arg validation Fix off-by-one error in validation of write_mostly. The user-supplied value given for the 'write_mostly' argument must be an index starting at 0. The validation of the supplied argument failed to check for 'N' ('>' vs '>='), which would have caused an access beyond the end of the array. Reported-by: Doug Ledford Signed-off-by: Jonathan Brassow Signed-off-by: Alasdair G Kergon commit 876fbba1db4a377f050a2bb49b474c7527b2995d Author: Mike Snitzer Date: Sun Sep 25 23:26:17 2011 +0100 dm table: avoid crash if integrity profile changes Commit a63a5cf (dm: improve block integrity support) introduced a two-phase initialization of a DM device's integrity profile. This patch avoids dereferencing a NULL 'template_disk' pointer in blk_integrity_register() if there is an integrity profile mismatch in dm_table_set_integrity(). This can occur if the integrity profiles for stacked devices in a DM table are changed between the call to dm_table_prealloc_integrity() and dm_table_set_integrity(). Reported-by: Zdenek Kabelac Signed-off-by: Mike Snitzer Signed-off-by: Alasdair G Kergon Cc: stable@kernel.org # 2.6.39 commit 68e58a294fb26f692697179e3f3ecf88dd8cb97c Author: Mike Snitzer Date: Sun Sep 25 23:26:15 2011 +0100 dm: flakey fix corrupt_bio_byte error path If no arguments were provided to the corrupt_bio_byte feature an error should be returned immediately. Reported-by: Zdenek Kabelac Signed-off-by: Mike Snitzer Signed-off-by: Alasdair G Kergon commit f9d81f61c84aca693bc353dfef4b8c36c2e5e1b5 Author: Oleg Nesterov Date: Sun Sep 25 19:46:22 2011 +0200 ptrace: PTRACE_LISTEN forgets to unlock ->siglock If PTRACE_LISTEN fails after lock_task_sighand() it doesn't drop ->siglock. Reported-by: Matt Fleming Signed-off-by: Oleg Nesterov Signed-off-by: Linus Torvalds commit 9be3be1f153e90ea4e1e5b6ed1d72a73d44318d1 Author: Avi Kivity Date: Tue Sep 13 10:45:38 2011 +0300 KVM: x86 emulator: fix Src2CL decode Src2CL decode (used for double width shifts) erronously decodes only bit 3 of %rcx, instead of bits 7:0. Fix by decoding %cl in its entirety. Signed-off-by: Avi Kivity Signed-off-by: Marcelo Tosatti commit 41bc3186b3c92a4ca05e2aa14bb6272fb491e679 Author: Zhao Jin Date: Mon Sep 19 12:19:51 2011 +0800 KVM: MMU: fix incorrect return of spte __update_clear_spte_slow should return original spte while the current code returns low half of original spte combined with high half of new spte. Signed-off-by: Zhao Jin Reviewed-by: Xiao Guangrong Signed-off-by: Marcelo Tosatti commit 6656b15d675c9c6a049db48d50994b3cd4e76bd6 Author: David Henningsson Date: Sat Sep 24 08:30:44 2011 +0200 ALSA: HDA: No power nids on 92HD93 This patch is necessary to make internal speakers work on this chip. Cc: stable@kernel.org BugLink: http://bugs.launchpad.net/bugs/854468 Tested-by: Alex Wolfson Signed-off-by: David Henningsson Signed-off-by: Takashi Iwai commit b172e38e435a158cc84169d5b9127a8dd8d21e76 Merge: 8ec9c7fb15fd 387719c2ec99 Author: Linus Torvalds Date: Fri Sep 23 16:53:16 2011 -0700 Merge branch 'spi/merge' of git://git.secretlab.ca/git/linux-2.6 * 'spi/merge' of git://git.secretlab.ca/git/linux-2.6: spi: Fix WARN when removing spi-fsl-spi module spi/imx: Fix spi-imx when the hardware SPI chipselects are used commit 2f19d080fb14bdddf11bf54d4db6306235c46c99 Author: David Daney Date: Tue Jul 5 16:35:53 2011 -0700 MIPS: Octeon: Enable C0_UserLocal probing. Octeon2 processor cores have a UserLocal register. Remove the hard coded negative probe and allow the standard probing to detect this feature. Signed-off-by: David Daney To: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/2578/ Signed-off-by: Ralf Baechle commit 387719c2ec995019e0af0dc537ca17c9ebd5b64f Author: Jeff Harris Date: Fri Sep 23 11:49:36 2011 -0400 spi: Fix WARN when removing spi-fsl-spi module If CPM mode is not used, the fsl_dummy_rx variable is never allocated. When the cleanup attempts to free it, the reference count is zero and a WARN is generated. The same CPM mode check used in the initialize is applied to the free as well. Tested on 2.6.33 with the previous spi_mpc8xxx driver. The renamed spi-fsl-spi driver looks to have the same problem. Signed-off-by: Jeff Harris Signed-off-by: Grant Likely commit 8ec9c7fb15fd8edf6b34555f5b498033121b2173 Author: Randy Dunlap Date: Fri Sep 23 15:40:50 2011 -0700 scsi: fix qla2xxx printk format warning sector_t can be different types, so cast it to its largest possible type. drivers/scsi/qla2xxx/qla_isr.c:1509:5: warning: format '%lx' expects type 'long unsigned int', but argument 5 has type 'sector_t' Signed-off-by: Randy Dunlap Signed-off-by: Linus Torvalds commit 2b7fe39babcbd67458a0c4fbed5704089e0c8c1f Author: Randy Dunlap Date: Fri Sep 23 15:43:54 2011 -0700 scsi: SCSI_ISCI needs to select SCSI_SAS_HOST_SMP, fixes build error SCSI_ISCI needs to select SCSI_SAS_HOST_SMP to ensure that all needed symbols are available to it. Fixes this build error: ERROR: "try_test_sas_gpio_gp_bit" [drivers/scsi/isci/isci.ko] undefined! Signed-off-by: Randy Dunlap Signed-off-by: Linus Torvalds commit 78bbd284e85f1af56a9fa30760c019357c2a1b4b Merge: eab8bcb67a6f 2b022a82a017 Author: Linus Torvalds Date: Fri Sep 23 15:17:02 2011 -0700 Merge branch 'perf-tools-for-linus' of git://github.com/acmel/linux * 'perf-tools-for-linus' of git://github.com/acmel/linux: perf python: Add missing perf_event__parse_sample 'swapped' parm commit eab8bcb67a6f4e8d428b76c894a447229812c8ac Merge: f35f3dc4850d 9e59e0995a57 Author: Linus Torvalds Date: Fri Sep 23 13:59:37 2011 -0700 Merge branch 'perf-tools-for-linus' of git://github.com/acmel/linux * 'perf-tools-for-linus' of git://github.com/acmel/linux: perf tools: Add support for disabling -Werror via WERROR=0 perf top: Fix userspace sample addr map offset perf symbols: Fix issue with binaries using 16-bytes buildids (v2) perf tool: Fix endianness handling of u32 data in samples perf sort: Fix symbol sort output by separating unresolved samples by type perf symbols: Synthesize anonymous mmap events perf record: Create events initially disabled and enable after init perf symbols: Add some heuristics for choosing the best duplicate symbol perf symbols: Preserve symbol scope when parsing /proc/kallsyms perf symbols: /proc/kallsyms does not sort module symbols perf symbols: Fix ppc64 SEGV in dso__load_sym with debuginfo files perf probe: Fix regression of variable finder commit f35f3dc4850d482143233fb51c714a81ce24083a Merge: 0acf043e89af fdfc61594e6d Author: Linus Torvalds Date: Fri Sep 23 12:05:53 2011 -0700 Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/radeon/kms: fix DDIA enable on some rs690 systems Revert "drm/radeon/kms: fix typo in r100_blit_copy" commit 0acf043e89afa5181c30cba4d7e0a92e913cb096 Merge: d942e43b58dc 3127b6aa752d Author: Linus Torvalds Date: Fri Sep 23 12:04:32 2011 -0700 Merge branch 'for-linus' of git://github.com/tiwai/sound * 'for-linus' of git://github.com/tiwai/sound: ALSA: usb-audio - clear chip->probing on error exit ALSA: fm801: Gracefully handle failure of tuner auto-detect ALSA: fm801: Fix double free in case of error in tuner detection ASoC: Ensure we generate a driver name ASoC: Remove bitrotted wm8962_resume() ASoC: bf5xx-ad73311: Fix prototype for bf5xx_probe commit 2b022a82a01737012155b5ba462db74232ff1f2e Author: Arnaldo Carvalho de Melo Date: Fri Sep 23 15:38:53 2011 -0300 perf python: Add missing perf_event__parse_sample 'swapped' parm Problem introduced in 936be50, that missed one perf_event__parse_sample user, the python binding. Reported-by: Linus Torvalds Cc: David Ahern Cc: Frederic Weisbecker Cc: Mike Galbraith Cc: Paul Mackerras Cc: Peter Zijlstra Cc: Stephane Eranian Link: http://lkml.kernel.org/n/tip-ja4phms9618ggi657plyuch2@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 2f1c3db0a6adcfd12d556afa3605d4923658b307 Author: Jan Beulich Date: Fri Sep 23 06:40:08 2011 -0400 hwmon: (coretemp) remove struct platform_data * parameter from create_core_data() The only caller of the function obtained the pointer solely for the purpose of passing it to this function, while it can be easily determined from the struct platform_device * parameter also passed. Signed-off-by: Jan Beulich Signed-off-by: Guenter Roeck commit e3204ed3a4a78ca4d10eee8b661b94429bd38da8 Author: Jan Beulich Date: Fri Sep 23 06:36:53 2011 -0400 hwmon: (coretemp) constify static data These arrays won't ever be written to, so protect them from unintentional modification. Signed-off-by: Jan Beulich Signed-off-by: Guenter Roeck commit b3a242a6e4b8c09dbb466ab7a9d2c724e75faa67 Author: Jan Beulich Date: Fri Sep 23 06:35:00 2011 -0400 hwmon: (coretemp) don't use kernel assigned CPU number as platform device ID ... as that has the potential to conflict with (particularly soft) CPU hot removal and re-adding. Signed-off-by: Jan Beulich [guenter.roeck@ericsson.com: use platform device ID as physical CPU id] Signed-off-by: Guenter Roeck commit 9e59e0995a57048c53773f1de99c6637ad12dd25 Author: Darren Hart Date: Thu Sep 8 13:42:39 2011 -0700 perf tools: Add support for disabling -Werror via WERROR=0 GCC often introduces new warnings with lots of false positives - breaking -Werror builds. WERROR=0 allows one to build perf without much fuss - while still encouraging people to send patches to avoid the fuss of having to type WERROR=0. Bisecting back to commits that produce a (mostly harmless) warning on some compilers is more difficult. With WERROR=0 one could bisect without worrying about harmless warnings. Cc: Ingo Molnar Link: http://lkml.kernel.org/r/eac06c7cc4920e5d4830417d466161fb26c7359c.1315514559.git.dvhart@linux.intel.com Signed-off-by: Darren Hart Signed-off-by: Arnaldo Carvalho de Melo commit af52aafad26fe83edc3ff95d6f630c2fc98a0c4c Author: Arnaldo Carvalho de Melo Date: Wed Sep 14 15:54:30 2011 -0300 perf top: Fix userspace sample addr map offset The 'perf top' tool came from the kernel where we had each DSO (vmlinux, modules) loaded just once at a time. But userspace may have DSOs loaded in multiple addresses (shared libraries), requiring that we use the just resolved map instead of the first one found. Cc: David Ahern Cc: Frederic Weisbecker Cc: Mike Galbraith Cc: Paul Mackerras Cc: Peter Zijlstra Cc: Stephane Eranian Link: http://lkml.kernel.org/n/tip-ag53wz0yllpgers0n2w7hchp@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit be96ea8ffa788dccb1ba895cced29db6687c4911 Author: Stephane Eranian Date: Fri Oct 22 17:25:01 2010 +0200 perf symbols: Fix issue with binaries using 16-bytes buildids (v2) Buildid can vary in size. According to the man page of ld, buildid can be 160 bits (sha1) or 128 bits (md5, uuid). Perf assumes buildid size of 20 bytes (160 bits) regardless. When dealing with md5 buildids, it would thus read more than needed and that would cause mismatches and samples without symbols. This patch fixes this by taking into account the actual buildid size as encoded int he section header. The leftover bytes are also cleared. This second version fixes a minor issue with the memset() base position. Cc: David S. Miller Cc: Frederic Weisbecker Cc: Ingo Molnar Cc: Paul Mackerras Cc: Peter Zijlstra Cc: Robert Richter Cc: Stephane Eranian Link: http://lkml.kernel.org/r/4cc1af3c.8ee7d80a.5a28.ffff868e@mx.google.com Signed-off-by: Stephane Eranian Signed-off-by: Arnaldo Carvalho de Melo commit 936be50306a92356367f330ef9d44f1f62478d22 Author: David Ahern Date: Tue Sep 6 09:12:26 2011 -0600 perf tool: Fix endianness handling of u32 data in samples Currently, analyzing PPC data files on x86 the cpu field is always 0 and the tid and pid are backwards. For example, analyzing a PPC file on PPC the pid/tid fields show: rsyslogd 1210/1212 and analyzing the same PPC file using an x86 perf binary shows: rsyslogd 1212/1210 The problem is that the swap_op method for samples is perf_event__all64_swap which assumes all elements in the sample_data struct are u64s. cpu, tid and pid are u32s and need to be handled individually. Given that the swap is done before the sample is parsed, the simplest solution is to undo the 64-bit swap of those elements when the sample is parsed and do the proper swap. The RAW data field is generic and perf cannot have programmatic knowledge of how to treat that data. Instead a warning is given to the user. Thanks to Anton Blanchard for providing a data file for a mult-CPU PPC system so I could verify the fix for the CPU fields. v3 -> v4: - fixed use of WARN_ONCE v2 -> v3: - used WARN_ONCE for message regarding raw data - removed struct wrapper around union - fixed whitespace issues v1 -> v2: - added a union for undoing the byte-swap on u64 and redoing swap on u32's to address compiler errors (see git commit 65014ab3) Cc: Anton Blanchard Cc: Frederic Weisbecker Cc: Ingo Molnar Cc: Paul Mackerras Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/1315321946-16993-1-git-send-email-dsahern@gmail.com Signed-off-by: David Ahern Signed-off-by: Arnaldo Carvalho de Melo commit 6bb8f311a870d6042e0310309eb3d607ae52fe3e Author: Anton Blanchard Date: Wed Aug 31 11:51:45 2011 +1000 perf sort: Fix symbol sort output by separating unresolved samples by type I took a profile that suggested 60% of total CPU time was in the hypervisor: ... 60.20% [H] 0x33d43c 4.43% [k] ._spin_lock_irqsave 1.07% [k] ._spin_lock Using perf stat to get the user/kernel/hypervisor breakdown contradicted this. The problem is we merge all unresolved samples into the one unknown bucket. If add a comparison by sample type to sort__sym_cmp we get the real picture: ... 57.11% [.] 0x80fbf63c 4.43% [k] ._spin_lock_irqsave 1.07% [k] ._spin_lock 0.65% [H] 0x33d43c So it was almost all userspace, not hypervisor as the initial profile suggested. I found another issue while adding this. Symbol sorting sometimes shows multiple entries for the unknown bucket: ... 16.65% [.] 0x6cd3a8 7.25% [.] 0x422460 5.37% [.] yylex 4.79% [.] malloc 4.78% [.] _int_malloc 4.03% [.] _int_free 3.95% [.] hash_source_code_string 2.82% [.] 0x532908 2.64% [.] 0x36b538 0.94% [H] 0x8000000000e132a4 0.82% [H] 0x800000000000e8b0 This happens because we aren't consistent with our sorting. On one hand we check to see if both symbols match and for two unresolved samples sym is NULL so we match: if (left->ms.sym == right->ms.sym) return 0; On the other hand we use sample IP for unresolved samples when comparing against a symbol: ip_l = left->ms.sym ? left->ms.sym->start : left->ip; ip_r = right->ms.sym ? right->ms.sym->start : right->ip; This means unresolved samples end up spread across the rbtree and we can't merge them all. If we use cmp_null all unresolved samples will end up in the one bucket and the output makes more sense: ... 39.12% [.] 0x36b538 5.37% [.] yylex 4.79% [.] malloc 4.78% [.] _int_malloc 4.03% [.] _int_free 3.95% [.] hash_source_code_string 2.26% [H] 0x800000000000e8b0 Acked-by: Eric B Munson Cc: Eric B Munson Cc: Frederic Weisbecker Cc: Ingo Molnar Cc: Paul Mackerras Cc: Peter Zijlstra Cc: Ian Munsie Link: http://lkml.kernel.org/r/20110831115145.4f598ab2@kryten Signed-off-by: Anton Blanchard Signed-off-by: Arnaldo Carvalho de Melo commit 6a0e55d85babfccfd976703852ec8bab388b3a10 Author: Anton Blanchard Date: Tue Aug 30 09:15:06 2011 +1000 perf symbols: Synthesize anonymous mmap events perf_event__synthesize_mmap_events does not create anonymous mmap events even though the kernel does. As a result an already running application with dynamically created code will not get profiled - all samples end up in the unknown bucket. This patch skips any entries with '[' in the name to avoid adding events for special regions (eg the vsyscall page). All other executable mmaps are assumed to be anonymous and an event is synthesized. Acked-by: Pekka Enberg Cc: Eric B Munson Cc: Ingo Molnar Cc: Paul Mackerras Cc: Peter Zijlstra Cc: Pekka Enberg Link: http://lkml.kernel.org/r/20110830091506.60b51fe8@kryten Signed-off-by: Anton Blanchard Signed-off-by: Arnaldo Carvalho de Melo commit 764e16a30a77a9c8346fbae6615e7c818ce9d00f Author: David Ahern Date: Thu Aug 25 10:17:55 2011 -0600 perf record: Create events initially disabled and enable after init perf-record currently creates events enabled. When doing a system wide collection (-a arg) this causes data collection for perf's initialization activities -- eg., perf_event__synthesize_threads(). For some events (e.g., context switch S/W event or tracepoints like syscalls) perf's initialization causes a lot of events to be captured frequently generating "Check IO/CPU overload!" warnings on larger systems (e.g., 2 socket, quad core, hyperthreading). perf's initialization phase can be skipped by creating events disabled and then enabling them once the initialization is done. Cc: Frederic Weisbecker Cc: Ingo Molnar Cc: Paul Mackerras Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/1314289075-14706-1-git-send-email-dsahern@gmail.com Signed-off-by: David Ahern Signed-off-by: Arnaldo Carvalho de Melo commit 694bf407b06113f5e0f71764756f11903126fec0 Author: Anton Blanchard Date: Wed Aug 24 16:40:17 2011 +1000 perf symbols: Add some heuristics for choosing the best duplicate symbol Try and pick the best symbol based on a few heuristics: - Prefer a non weak symbol over a weak one - Prefer a global symbol over a non global one - Prefer a symbol with less underscores (idea taken from kallsyms.c) - If all else fails, choose the symbol with the longest name Cc: Eric B Munson Cc: Ingo Molnar Cc: Paul Mackerras Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/20110824065243.161953371@samba.org Signed-off-by: Anton Blanchard Signed-off-by: Arnaldo Carvalho de Melo commit 318779086086f46127a249878eeebb3dc80578eb Author: Anton Blanchard Date: Wed Aug 24 16:40:16 2011 +1000 perf symbols: Preserve symbol scope when parsing /proc/kallsyms kallsyms__parse capitalises the symbol type, so every symbol is marked global. Remove this and fix symbol_type__is_a to handle both local and global symbols. Cc: Eric B Munson Cc: Ingo Molnar Cc: Paul Mackerras Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/20110824065243.077125989@samba.org Signed-off-by: Anton Blanchard Signed-off-by: Arnaldo Carvalho de Melo commit 3f5a42722b9e78a434d5a4ee5e607dc33c69ac80 Author: Anton Blanchard Date: Wed Aug 24 16:40:15 2011 +1000 perf symbols: /proc/kallsyms does not sort module symbols kallsyms__parse assumes that /proc/kallsyms is sorted and sets the end of the previous symbol to the start of the current one. Unfortunately module symbols are not sorted, eg: ffffffffa0081f30 t e1000_clean_rx_irq [e1000e] ffffffffa00817a0 t e1000_alloc_rx_buffers [e1000e] Some symbols end up with a negative length and others have a length larger than they should. This results in confusing perf output. We already have a function to fixup the end of zero length symbols so use that instead. Cc: Eric B Munson Cc: Ingo Molnar Cc: Paul Mackerras Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/20110824065242.969681349@samba.org Signed-off-by: Anton Blanchard Signed-off-by: Arnaldo Carvalho de Melo commit adb091846318f86e4f46c7d6a7b40d2f478abdbe Author: Anton Blanchard Date: Wed Aug 24 16:40:14 2011 +1000 perf symbols: Fix ppc64 SEGV in dso__load_sym with debuginfo files 64bit PowerPC debuginfo files have an empty function descriptor section. I hit a SEGV when perf tried to use this section for symbol resolution. To fix this we need to check the section is valid and we can do this by checking for type SHT_PROGBITS. Cc: Cc: Ingo Molnar Cc: Paul Mackerras Cc: Peter Zijlstra Cc: Eric B Munson Link: http://lkml.kernel.org/r/20110824065242.895239970@samba.org Signed-off-by: Anton Blanchard Signed-off-by: Arnaldo Carvalho de Melo commit f66fedcb723a9f118170200e21dbabb305f8c702 Author: Masami Hiramatsu Date: Sat Aug 20 14:39:23 2011 +0900 perf probe: Fix regression of variable finder Fix to call convert_variable() if previous call does not fail. To call convert_variable, it ensures "ret" is 0. However, since "ret" has the return value of synthesize_perf_probe_arg() which always returns positive value if it succeeded, perf probe doesn't call convert_variable(). This will cause a SEGV when we add an event with arguments. This has to be fixed as it ensures "ret" is greater than 0 (or not negative). This regression has been introduced by my previous patch, f182e3e1. Cc: Frederic Weisbecker Cc: Ingo Molnar Cc: Paul Mackerras Cc: Pekka Enberg Cc: Peter Zijlstra Cc: yrl.pp-manager.tt@hitachi.com Link: http://lkml.kernel.org/r/20110820053922.3286.65805.stgit@fedora15 Signed-off-by: Masami Hiramatsu Signed-off-by: Arnaldo Carvalho de Melo commit 3127b6aa752d1329dbd79f669b53027905d1976a Merge: 362e4e49abe5 f0e8ed858edb Author: Takashi Iwai Date: Fri Sep 23 15:26:37 2011 +0200 Merge branch 'fix/asoc' into for-linus commit 362e4e49abe53e89d87455dfcd7c1bbaf08a839d Author: Thomas Pfaff Date: Thu Sep 22 18:26:06 2011 +0200 ALSA: usb-audio - clear chip->probing on error exit The Terratec Aureon 5.1 USB sound card support is broken since kernel 2.6.39. 2.6.39 introduced power management support for USB sound cards that added a probing flag in struct snd_usb_audio. During the probe of the card it gives following error message : usb 7-2: new full speed USB device number 2 using uhci_hcd cannot find UAC_HEADER snd-usb-audio: probe of 7-2:1.3 failed with error -5 input: USB Audio as /devices/pci0000:00/0000:00:1d.1/usb7/7-2/7-2:1.3/input/input6 generic-usb 0003:0CCD:0028.0001: input: USB HID v1.00 Device [USB Audio] on usb-0000:00:1d.1-2/input3 I can not comment about that "cannot find UAC_HEADER" error, but until 2.6.38 the card worked anyway. With 2.6.39 chip->probing remains 1 on error exit, and any later ioctl stops in snd_usb_autoresume with -ENODEV. Signed-off-by: Thomas Pfaff Cc: [2.6.39+] Signed-off-by: Takashi Iwai commit fdfc61594e6de21c23f955818ef78bcab9bafe40 Author: Alex Deucher Date: Thu Sep 22 10:47:23 2011 -0400 drm/radeon/kms: fix DDIA enable on some rs690 systems DVOOutputControl checks the value of of bios scratch reg 3 on some tables and assumes the encoder is already enabled if the DFP2_ACTIVE bit is set. Clear that bit so the table sets the DDIA enable bit properly. Signed-off-by: Alex Deucher Cc: stable@kernel.org Signed-off-by: Dave Airlie commit d9ad77ebfd3a304306f9f18ff3f9e522da075e27 Author: Dave Airlie Date: Fri Sep 23 14:00:54 2011 +0100 Revert "drm/radeon/kms: fix typo in r100_blit_copy" This reverts commit 18b4fada275dd2b6dd9db904ddf70fe39e272222. This code was correct, apologies to anyone who noticed things broke. revert contents are different due to another commit in between. Signed-off-by: Dave Airlie commit 34c869855a28af3c6031d29e2267b5a3cce0d67d Author: Jarkko Nikula Date: Fri Sep 23 11:19:13 2011 +0300 ASoC: omap-mcbsp: Do not attempt to change DAI sysclk if stream is active Attempt to change McBSP CLKS source while another stream is active is not safe after commit d135865 ("OMAP: McBSP: implement functional clock switching via clock framework") in 2.6.37. CLKS parent clock switching using clock framework have to idle the McBSP before switching and then activate it again. This short break can cause a DMA transaction error to already running stream which halts and recovers only by closing and restarting the stream. This goes more fatal after commit e2fa61d ("OMAP3: l3: Introduce l3-interconnect error handling driver") in 2.6.39 where l3 driver detects a severe timeout error and does BUG_ON(). Fix this by not changing any configuration in omap_mcbsp_dai_set_dai_sysclk if the McBSP is already active. This test should have been here just from the beginning anyway. Signed-off-by: Jarkko Nikula Acked-by: Peter Ujfalusi Signed-off-by: Mark Brown Cc: stable@kernel.org commit d942e43b58dc27b36305bcd374a74f7cc15183a3 Merge: e369fde1af20 3321c07ae506 Author: Linus Torvalds Date: Thu Sep 22 19:57:27 2011 -0700 Merge branch 'for-linus' of git://git.selinuxproject.org/~jmorris/linux-security * 'for-linus' of git://git.selinuxproject.org/~jmorris/linux-security: TPM: Zero buffer after copying to userspace TPM: Call tpm_transmit with correct size TPM: tpm_nsc: Fix a double free of pdev in cleanup_nsc TPM: TCG_ATMEL should depend on HAS_IOPORT commit 3321c07ae5068568cd61ac9f4ba749006a7185c9 Author: Peter Huewe Date: Thu Sep 15 14:47:42 2011 -0300 TPM: Zero buffer after copying to userspace Since the buffer might contain security related data it might be a good idea to zero the buffer after we have copied it to userspace. This got assigned CVE-2011-1162. Signed-off-by: Rajiv Andrade Cc: Stable Kernel Signed-off-by: James Morris commit 6b07d30aca7e52f2881b8c8c20c8a2cd28e8b3d3 Author: Peter Huewe Date: Thu Sep 15 14:37:43 2011 -0300 TPM: Call tpm_transmit with correct size This patch changes the call of tpm_transmit by supplying the size of the userspace buffer instead of TPM_BUFSIZE. This got assigned CVE-2011-1161. [The first hunk didn't make sense given one could expect way less data than TPM_BUFSIZE, so added tpm_transmit boundary check over bufsiz instead The last parameter of tpm_transmit() reflects the amount of data expected from the device, and not the buffer size being supplied to it. It isn't ideal to parse it directly, so we just set it to the maximum the input buffer can handle and let the userspace API to do such job.] Signed-off-by: Rajiv Andrade Cc: Stable Kernel Signed-off-by: James Morris commit de69113ec1896443c732e8b812e8005fb44eeeeb Author: Axel Lin Date: Thu Aug 4 07:58:07 2011 +0800 TPM: tpm_nsc: Fix a double free of pdev in cleanup_nsc platform_device_unregister() will release all resources and remove it from the subsystem, then drop reference count by calling platform_device_put(). We should not call kfree(pdev) after platform_device_unregister(pdev). Signed-off-by: Axel Lin Signed-off-by: Rajiv Andrade Signed-off-by: James Morris commit 5ce5ed35939ece8a9c7e0f10c7f3d5bc000c6b64 Author: Geert Uytterhoeven Date: Mon Aug 8 13:08:19 2011 +0200 TPM: TCG_ATMEL should depend on HAS_IOPORT On m68k, I get: drivers/char/tpm/tpm_atmel.h: In function ‘atmel_get_base_addr’: drivers/char/tpm/tpm_atmel.h:129: error: implicit declaration of function ‘ioport_map’ drivers/char/tpm/tpm_atmel.h:129: warning: return makes pointer from integer without a cast The code in tpm_atmel.h supports PPC64 (using the device tree and ioremap()) and "anything else" (using ioport_map()). However, ioportmap() is only available on platforms that set HAS_IOPORT. Although PC64 seems to have HAS_IOPORT, a "depends on HAS_IOPORT" should work, but I think it's better to expose the special PPC64 handling explicit using "depends on PPC64 || HAS_IOPORT". Signed-off-by: Geert Uytterhoeven Signed-off-by: Rajiv Andrade Signed-off-by: James Morris commit e369fde1af20c7c67acff3bc4a36e451f38ae7d0 Author: David Rientjes Date: Thu Sep 22 14:11:38 2011 -0700 thp: fix khugepaged defrag tunable documentation Commit e27e6151b154 ("mm/thp: use conventional format for boolean attributes") changed /sys/kernel/mm/transparent_hugepage/khugepaged/defrag to be tuned by using 1 (enabled) or 0 (disabled) instead of "yes" and "no", respectively. Update the documentation. Signed-off-by: David Rientjes Signed-off-by: Linus Torvalds commit a7f4d00a82feb5b311f765bf9522bc55bee0684f Author: Geert Uytterhoeven Date: Thu Sep 22 21:47:38 2011 +0200 zorro: Defer device_register() until all devices have been identified As the Amiga Zorro II address space is limited to 8.5 MiB and Zorro devices can contain only one BAR, several Amiga Zorro II expansion boards (mainly graphics cards) contain multiple Zorro devices: a small one for the control registers and one (or more) for the graphics memory. The conversion of cirrusfb to the new driver framework introduced a regression: the driver contains a zorro_driver for the first Zorro device, and uses the (old) zorro_find_device() call to find the second Zorro device. However, as the Zorro core calls device_register() as soon as a Zorro device is identified, it may not have identified the second Zorro device belonging to the same physical Zorro expansion card. Hence cirrusfb could no longer find the second part of the Picasso II graphics card, causing a NULL pointer dereference. Defer the registration of Zorro devices with the driver framework until all Zorro devices have been identified to fix this. Note that the alternative solution (modifying cirrusfb to register a zorro_driver for all Zorro devices belonging to a graphics card, instead of only for the first one, and adding a synchronization mechanism to defer initialization until all have been found), is not an option, as on some cards one device may be optional (e.g. the second bank of 2 MiB of graphics memory on the Picasso IV in Zorro II mode). Reported-by: Ingo Jürgensmann Signed-off-by: Geert Uytterhoeven Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit 8b267b312df9343fea3bd679c509b36214b5a854 Author: Antonio Quartulli Date: Wed Sep 21 16:06:42 2011 +0200 batman-adv: do_bcast has to be true for broadcast packets only corrects a critical bug of the GW feature. This bug made all the unicast packets destined to a GW to be sent as broadcast. This bug is present even if the sender GW feature is configured as OFF. It's an urgent bug fix and should be committed as soon as possible. This was a regression introduced by 43676ab590c3f8686fd047d34c3e33803eef71f0 Signed-off-by: Antonio Quartulli Signed-off-by: Marek Lindner commit fae3f6f2eed147092e4612177972d46e542cab71 Merge: d93dc5c4478c b6cf8788a338 Author: Linus Torvalds Date: Thu Sep 22 09:32:21 2011 -0700 Merge branch 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6 * 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6: [S390] kvm: extension capability for new address space layout [S390] kvm: fix address mode switching commit c37279b92aba2893578f61076cd2eef5c5fa0e99 Author: Ben Hutchings Date: Thu Sep 22 14:39:52 2011 +0100 ALSA: fm801: Gracefully handle failure of tuner auto-detect Commit 9676001559fce06e37c7dc230ab275f605556176 ("ALSA: fm801: add error handling if auto-detect fails") seems to break systems that were previously working without a tuner. As a bonus, this should fix init and cleanup for the case where the tuner is explicitly disabled. Reported-and-tested-by: Hor Jiun Shyong References: http://bugs.debian.org/641946 Signed-off-by: Ben Hutchings Cc: stable@kernel.org [v3.0+] Signed-off-by: Takashi Iwai commit 2ba34e43ba0469086d1ff81c13a9aa9070c1a0e1 Author: Ben Hutchings Date: Thu Sep 22 14:38:58 2011 +0100 ALSA: fm801: Fix double free in case of error in tuner detection Commit 9676001559fce06e37c7dc230ab275f605556176 ("ALSA: fm801: add error handling if auto-detect fails") added incorrect error handling. Once we have successfully called snd_device_new(), the cleanup function fm801_free() will automatically be called by snd_card_free() and we must *not* also call fm801_free() directly. Reported-by: Hor Jiun Shyong References: http://bugs.debian.org/641946 Signed-off-by: Ben Hutchings Cc: stable@kernel.org [v3.0+] Signed-off-by: Takashi Iwai commit 3538a001ea7db13fa1be2966b71f69d808acff01 Author: Randy Dunlap Date: Wed Aug 31 15:02:00 2011 -0700 [SCSI] scsi: qla4xxx needs libiscsi.o qla4xxx driver needs to be linked with libiscsi.o to fix build errors. This happens when no other drivers that use libiscsi.o are enabled. ERROR: "iscsi_conn_stop" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined! ERROR: "iscsi_conn_get_addr_param" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined! ERROR: "iscsi_session_teardown" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined! ERROR: "iscsi_host_alloc" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined! ERROR: "iscsi_conn_start" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined! ERROR: "iscsi_conn_send_pdu" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined! ERROR: "iscsi_session_get_param" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined! ERROR: "iscsi_conn_get_param" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined! ERROR: "iscsi_set_param" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined! ERROR: "iscsi_session_failure" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined! ERROR: "iscsi_complete_pdu" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined! ERROR: "iscsi_session_setup" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined! ERROR: "iscsi_conn_bind" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined! ERROR: "iscsi_conn_setup" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined! ERROR: "iscsi_itt_to_task" [drivers/scsi/qla4xxx/qla4xxx.ko] undefined! Signed-off-by: Randy Dunlap Reviewed-by: Mike Christie Cc: stable@kernel.org Signed-off-by: James Bottomley commit 24926dadc41cc566e974022b0e66231b82c6375f Author: Mark Salyzyn Date: Thu Sep 1 06:11:17 2011 -0700 [SCSI] libsas: fix failure to revalidate domain for anything but the first expander child. In an enclosure model where there are chaining expanders to a large body of storage, it was discovered that libsas, responding to a broadcast event change, would only revalidate the domain of first child expander in the list. The issue is that the pointer value to the discovered source device was used to break out of the loop, rather than the content of the pointer. This still remains non-compliant as the revalidate domain code is supposed to loop through all child expanders, and not stop at the first one it finds that reports a change count. However, the design of this routine does not allow multiple device discoveries and that would be a more complicated set of patches reserved for another day. We are fixing the glaring bug rather than refactoring the code. Signed-off-by: Mark Salyzyn Cc: stable@kernel.org Signed-off-by: James Bottomley commit d0efab26f89506387a1bde898556660e06d7eb15 Author: Vasily Averin Date: Fri Sep 2 19:31:46 2011 +0400 [SCSI] aacraid: reset should disable MSI interrupt scsi reset on hardware with enabled MSI interrupts generates WARNING message [11027.798722] aacraid: Host adapter abort request (0,0,0,0) [11027.798814] aacraid: Host adapter reset request. SCSI hang ? [11087.762237] aacraid: SCSI bus appears hung [11135.082543] ------------[ cut here ]------------ [11135.082646] WARNING: at drivers/pci/msi.c:658 pci_enable_msi_block+0x251/0x290() Signed-off-by: Vasily Averin Acked-by: Mark Salyzyn Cc: stable@kernel.org Signed-off-by: James Bottomley commit e74d83aad3709a17d68f01481f2b5f240250b1c3 Author: Joerg Roedel Date: Tue Sep 6 11:02:15 2011 -0300 [media] omap3isp: Fix build error in ispccdc.c The following build error occurs with 3.1-rc5: CC drivers/media/video/omap3isp/ispccdc.o This patch adds the missing 'linux/slab.h' include to fix the problem. Signed-off-by: Joerg Roedel Acked-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab commit 4d9b2ebd335d83044b9e6656d0e604e8e1300334 Author: Laurent Pinchart Date: Tue Sep 6 19:16:18 2011 -0300 [media] uvcvideo: Fix crash when linking entities The uvc_mc_register_entity() function wrongfully selects the media_entity associated with a UVC entity when creating links. This results in access to uninitialized media_entity structures and can hit a BUG_ON statement in media_entity_create_link(). Fix it. Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab commit 236c5441d70312242b5b32d229259930046a80e5 Author: Dave Young Date: Tue Sep 6 09:08:08 2011 -0300 [media] v4l: Make sure we hold a reference to the v4l2_device before using it v4l2_device_disconnect() calls dev_get_drvdata() and dev_set_drvdata() on the device it received in v4l2_device_register(). Get a reference to the device in v4l2_device_register() to make sure it won't disappear as long as we need it. Reported-by: Sitsofe Wheeler Signed-off-by: Dave Young Tested-by: Sitsofe Wheeler Acked-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab commit 8280b662df96f4172c4972b14a4aec0daf272b8f Author: Hans Verkuil Date: Tue Sep 6 10:23:18 2011 -0300 [media] v4l: Fix use-after-free case in v4l2_device_release Drivers that have no v4l2_device release callback might free the v4l2_device instance in the video_device release callback. Make sure we don't access the v4l2_device instance after it gets freed. Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab commit dd182e5416e872e30d90cf071758eec1cf6340d5 Author: Ming Lei Date: Sat Jul 16 00:51:00 2011 -0300 [media] uvcvideo: Set alternate setting 0 on resume if the bus has been reset If the bus has been reset on resume, set the alternate setting to 0. This should be the default value, but some devices crash or otherwise misbehave if they don't receive a SET_INTERFACE request before any other video control request. Microdia's 0c45:6437 camera has been found to require this change or it will stop sending video data after resume. uvc_video.c] Signed-off-by: Ming Lei Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab commit 5ebbf72dc51bd3b481aa91fea37a7157da5fc548 Author: archit taneja Date: Fri Aug 5 04:19:21 2011 -0300 [media] OMAP_VOUT: Fix build break caused by update_mode removal in DSS2 The DSS2 driver does not support the configuration of the update_mode of a panel anymore. Remove the setting of update_mode done in omap_vout_probe(). Ignore configuration of TE since omap_vout driver doesn't support manual update displays anyway. Signed-off-by: Archit Taneja Tested-by: Koen Kooi Signed-off-by: Vaibhav Hiremath Signed-off-by: Mauro Carvalho Chehab commit cc41d586e8b4d76164fe7731c1c49be6cc5fc7e6 Author: Roland Stigge Date: Wed Sep 21 13:06:11 2011 -0400 hwmon: (ds620) Fix handling of negative temperatures Signed (negative) temperatures were not handled correctly. Signed-off-by: Roland Stigge Signed-off-by: Guenter Roeck Cc: stable@kernel.org # v2.6.38+ commit 7cbe1ceeb6ab2e4bc334b3dab3254d4414b72a23 Author: Chris Peterson Date: Wed Sep 21 06:52:09 2011 -0700 hwmon: (w83791d) rename prototype parameter from 'register' to 'reg' gcc -Wextra warns "register is not at beginning of declaration" because the compiler thinks the parameter has been marked as a 'register' variable, but the function prototype intended to name the parameter "register" (which is a reserved keyword). Signed-off-by: Chris Peterson Acked-by: Marc Hulsman Signed-off-by: Guenter Roeck commit f4af6fd6e21792ca4deca3d29c113a575594078e Author: Guenter Roeck Date: Mon Sep 19 21:41:16 2011 -0700 hwmon: (coretemp) Don't use threshold registers for tempX_max With commit c814a4c7c4aad795835583344353963a0a673eb0, the meaning of tempX_max was changed. It no longer returns the value of bits 8:15 of MSR_IA32_TEMPERATURE_TARGET, but instead returns the value of CPU threshold register T1. tempX_max_hyst was added to reflect the value of temperature threshold register T0. As it turns out, T0 and T1 are used on some systems, presumably by the BIOS. Also, T0 and T1 don't have a well defined meaning. The thresholds may be used as upper or lower limits, and it is not guaranteed that T0 <= T1. Thus, the new attribute mapping does not reflect the actual usage of the threshold registers. Also, register contents are changed during runtime by an entity other than the hwmon driver, meaning the values cached by the driver do not reflect actual register contents. Revert most of c814a4c7c4aad795835583344353963a0a673eb0 to address the problem. Support for T0 and T1 will be added back in with a separate commit, using new attribute names. Signed-off-by: Guenter Roeck Cc: Fenghua Yu Cc: Durgadoss R Acked-by: Jean Delvare commit a45a8c8571c0be6a6bd72ae5a14255c26b14b504 Author: Jean Delvare Date: Fri Sep 16 21:24:02 2011 +0200 hwmon: (coretemp) Let the user force TjMax On old CPUs (and even some recent Atom CPUs) TjMax can't be read from the CPU registers, so it is guessed by the driver using a complex heuristic which isn't reliable. So let users who know their CPU's TjMax pass it as a module parameter. Signed-off-by: Jean Delvare Cc: Fenghua Yu Cc: "R, Durgadoss" Cc: Guenter Roeck Cc: Alexander Stein Acked-by: Fenghua Yu Signed-off-by: Guenter Roeck commit 6bf9e9b09c3abb5447bbbf16c2d0cbe721e44f3f Author: Jean Delvare Date: Fri Sep 16 21:21:43 2011 +0200 hwmon: (coretemp) Drop duplicate function get_pkg_tjmax Function get_pkg_tjmax is a simplified copy of get_tjmax. Drop it and always use get_tjmax, result is the same and this avoids code duplication. Also make get_tjmax less verbose: don't warn about MSR read failure when failure was expected, and don't report TjMax in the logs unless debugging is enabled. Signed-off-by: Jean Delvare Cc: Fenghua Yu Cc: Guenter Roeck Cc: Durgadoss R Acked-by: Fenghua Yu Signed-off-by: Guenter Roeck commit d93dc5c4478c1fd5de85a3e8aece9aad7bbae044 Author: Linus Torvalds Date: Wed Sep 21 16:58:15 2011 -0700 Linux 3.1-rc7 commit cd0de039bff32ee314046c0e4c047c38aa696f84 Author: Keith Packard Date: Mon Sep 19 21:34:19 2011 -0700 drm/i915: FBC off for ironlake and older, otherwise on by default Make the default FBC behaviour chipset specific, allowing us to turn it on by default for Ironlake and older where it has been seen to cause trouble with screen updates. Signed-off-by: Keith Packard Tested-by: Francis Moreau commit cc68c81aed7d892deaf12d720d5455208e94cd0a Author: Simon Farnsworth Date: Wed Sep 21 17:13:30 2011 +0100 drm/i915: Enable SDVO hotplug interrupts for HDMI and DVI I was seeing a nasty 5 frame glitch every 10 seconds, caused by the poll for connection on DVI attached by SDVO. As my SDVO DVI supports hotplug detect interrupts, the fix is to enable them, and hook them in to the various bits of driver infrastructure so that they work reliably. Note that this is only tested on single-function DVI-D SDVOs, on two platforms (965GME and 945GSE), and has not been checked against a specification document. With lots of help from Adam Jackson on IRC. Signed-off-by: Simon Farnsworth Reviewed-by: Keith Packard Signed-off-by: Keith Packard commit 9c1f8594df4814ebfd6822ca3c9444fb3445888d Author: Lasse Collin Date: Wed Sep 21 17:30:50 2011 +0300 XZ: Fix incorrect XZ_BUF_ERROR xz_dec_run() could incorrectly return XZ_BUF_ERROR if all of the following was true: - The caller knows how many bytes of output to expect and only provides that much output space. - When the last output bytes are decoded, the caller-provided input buffer ends right before the LZMA2 end of payload marker. So LZMA2 won't provide more output anymore, but it won't know it yet and thus won't return XZ_STREAM_END yet. - A BCJ filter is in use and it hasn't left any unfiltered bytes in the temp buffer. This can happen with any BCJ filter, but in practice it's more likely with filters other than the x86 BCJ. This fixes where Squashfs thinks that a valid file system is corrupt. This also fixes a similar bug in single-call mode where the uncompressed size of a block using BCJ + LZMA2 was 0 bytes and caller provided no output space. Many empty .xz files don't contain any blocks and thus don't trigger this bug. This also tweaks a closely related detail: xz_dec_bcj_run() could call xz_dec_lzma2_run() to decode into temp buffer when it was known to be useless. This was harmless although it wasted a minuscule number of CPU cycles. Signed-off-by: Lasse Collin Cc: stable Signed-off-by: Linus Torvalds commit e5b26a88f13dfe3162acd50490c0c8504af81b26 Merge: fed678dc8a8b bcf66bf54aab Author: Linus Torvalds Date: Wed Sep 21 13:35:00 2011 -0700 Merge git://github.com/davem330/net * git://github.com/davem330/net: (27 commits) xfrm: Perform a replay check after return from async codepaths fib:fix BUG_ON in fib_nl_newrule when add new fib rule ixgbe: fix possible null buffer error tg3: fix VLAN tagging regression net: pxa168: Fix build errors by including interrupt.h netconsole: switch init_netconsole() to late_initcall gianfar: Fix overflow check and return value for gfar_get_cls_all() ppp_generic: fix multilink fragment MTU calculation (again) GRETH: avoid overwrite IP-stack's IP-frags checksum GRETH: RX/TX bytes were never increased ipv6: fix a possible double free b43: Fix beacon problem in ad-hoc mode Bluetooth: add support for 2011 mac mini Bluetooth: Add MacBookAir4,1 support Bluetooth: Fixed BT ST Channel reg order r8169: do not enable the TBI for anything but the original 8169. r8169: remove erroneous processing of always set bit. r8169: fix WOL setting for 8105 and 8111evl r8169: add MODULE_FIRMWARE for the firmware of 8111evl r8169: fix the reset setting for 8111evl ... commit fed678dc8a8b839c8189b5d889a94e865cd327dd Merge: 808bf29b9195 6c4867f64699 Author: Linus Torvalds Date: Wed Sep 21 13:20:21 2011 -0700 Merge branch 'for-linus' of git://git.kernel.dk/linux-block * 'for-linus' of git://git.kernel.dk/linux-block: floppy: use del_timer_sync() in init cleanup blk-cgroup: be able to remove the record of unplugged device block: Don't check QUEUE_FLAG_SAME_COMP in __blk_complete_request mm: Add comment explaining task state setting in bdi_forker_thread() mm: Cleanup clearing of BDI_pending bit in bdi_forker_thread() block: simplify force plug flush code a little bit block: change force plug flush call order block: Fix queue_flag update when rq_affinity goes from 2 to 1 block: separate priority boosting from REQ_META block: remove READ_META and WRITE_META xen-blkback: fixed indentation and comments xen-blkback: Don't disconnect backend until state switched to XenbusStateClosed. commit 808bf29b9195c52239b9aaeda7c6082a0ddf07c6 Author: Alexander Sverdlin Date: Wed Sep 21 09:51:40 2011 +0200 init: carefully handle loglevel option on kernel cmdline. When a malformed loglevel value (for example "${abc}") is passed on the kernel cmdline, the loglevel itself is being set to 0. That then suppresses all following messages, including all the errors and crashes caused by other malformed cmdline options. This could make debugging process quite tricky. This patch leaves the previous value of loglevel if the new value is incorrect and reports an error code in this case. Signed-off-by: Alexander Sverdlin Signed-off-by: Linus Torvalds commit 32ef43848f283e0ef945d3c67e851c143fea3970 Author: Dave Hansen Date: Tue Sep 20 15:19:41 2011 -0700 teach /proc/$pid/numa_maps about transparent hugepages This is modeled after the smaps code. It detects transparent hugepages and then does a single gather_stats() for the page as a whole. This has two benifits: 1. It is more efficient since it does many pages in a single shot. 2. It does not have to break down the huge page. Signed-off-by: Dave Hansen Acked-by: Hugh Dickins Acked-by: David Rientjes Signed-off-by: Linus Torvalds commit 3200a8aaab0c9ccdc0f59b0dac2d4a47029137fa Author: Dave Hansen Date: Tue Sep 20 15:19:39 2011 -0700 break out numa_maps gather_pte_stats() checks gather_pte_stats() does a number of checks on a target page to see whether it should even be considered for statistics. This breaks that code out in to a separate function so that we can use it in the transparent hugepage case in the next patch. Signed-off-by: Dave Hansen Acked-by: Hugh Dickins Reviewed-by: Christoph Lameter Acked-by: David Rientjes Signed-off-by: Linus Torvalds commit eb4866d0066ffd5446751c102d64feb3318d8bd1 Author: Dave Hansen Date: Tue Sep 20 15:19:38 2011 -0700 make /proc/$pid/numa_maps gather_stats() take variable page size We need to teach the numa_maps code about transparent huge pages. The first step is to teach gather_stats() that the pte it is dealing with might represent more than one page. Note that will we use this in a moment for transparent huge pages since they have use a single pmd_t which _acts_ as a "surrogate" for a bunch of smaller pte_t's. I'm a _bit_ unhappy that this interface counts in hugetlbfs page sizes for hugetlbfs pages and PAGE_SIZE for normal pages. That means that to figure out how many _bytes_ "dirty=1" means, you must first know the hugetlbfs page size. That's easier said than done especially if you don't have visibility in to the mount. But, that's probably a discussion for another day especially since it would change behavior to fix it. But, just in case anyone wonders why this patch only passes a '1' in the hugetlb case... Signed-off-by: Dave Hansen Acked-by: Hugh Dickins Acked-by: David Rientjes Signed-off-by: Linus Torvalds commit 1b9ca0272ffae212e726380f66777b30a56ed7a5 Author: Jouni Malinen Date: Wed Sep 21 16:13:07 2011 +0300 cfg80211: Fix validation of AKM suites Incorrect variable was used in validating the akm_suites array from NL80211_ATTR_AKM_SUITES. In addition, there was no explicit validation of the array length (we only have room for NL80211_MAX_NR_AKM_SUITES). This can result in a buffer write overflow for stack variables with arbitrary data from user space. The nl80211 commands using the affected functionality require GENL_ADMIN_PERM, so this is only exposed to admin users. Cc: stable@kernel.org Signed-off-by: Jouni Malinen Signed-off-by: John W. Linville commit 65d0f19e583e80e42b1c67c166bfc4dfdf6ab693 Author: Stanislaw Gruszka Date: Tue Sep 20 16:49:03 2011 +0200 iwlegacy: do not use interruptible waits iwlegacy version of fix: commit effd4d9aece9184f526e6556786a94d335e38b71 Author: Johannes Berg Date: Thu Sep 15 11:46:52 2011 -0700 iwlagn: do not use interruptible waits Since the dawn of its time, iwlwifi has used interruptible waits to wait for synchronous commands and firmware loading. This leads to "interesting" bugs, because it can't actually handle the interruptions; for example when a command sending is interrupted it will assume the command completed fully, and then leave it pending, which leads to all kinds of trouble when the command finishes later. Since there's no easy way to gracefully deal with interruptions, fix the driver to not use interruptible waits. This at least fixes the error iwlagn 0000:02:00.0: Error: Response NULL in 'REPLY_SCAN_ABORT_CMD' I have seen in P2P testing, but it is likely that there are other errors caused by this. Cc: stable@kernel.org # 2.6.39+ Signed-off-by: Stanislaw Gruszka Signed-off-by: John W. Linville commit 2e2a41d6ca07d1b2aa67015c35fd80701c98e867 Author: Stanislaw Gruszka Date: Tue Sep 20 16:46:36 2011 +0200 iwlegacy: fix command queue timeout iwlegacy version of fix: commit 282cdb325aea4ebbc42ce753b47cc96145eb54bc Author: Johannes Berg Date: Mon Sep 12 12:09:10 2011 -0700 iwlagn: fix command queue timeout If the command queue is constantly busy, which can happen in P2P, the hangcheck timer will frequently find a command in it and will eventually reset the device because nothing sets the timestamp for this queue when commands are processed. Fix this by setting the timestamp when a command completes. iwlegacy does not support P2P, but this patch fix possible unneeded hardware resets, hence is needed. Cc: stable@kernel.org # 2.6.39+ Signed-off-by: Stanislaw Gruszka Signed-off-by: John W. Linville commit e9f9530bb697f53dd620df290102359a3325bb23 Author: Rajkumar Manoharan Date: Tue Sep 20 16:23:51 2011 +0530 ath9k_hw: Fix Rx DMA stuck for AR9003 chips During the endurance testing, rx frames are not getting DMAd from MAC whereas pcu rx frame counters are getting updated properly. As per systems team input updated the initval to fix rx dma stuck issue. Cc: stable@kernel.org Signed-off-by: Rajkumar Manoharan Signed-off-by: John W. Linville commit 11032c17bd3f96a4319e4415c07fc791525b79fd Author: David S. Miller Date: Wed Sep 21 12:48:06 2011 -0700 sparc: Make '-p' boot option meaningful again. If "-p" is given on the command line, clear the CON_BOOT flag for the initial early boot PROM console. This is necessary to try and see crash messages that occur between the registry of the VT console and the probing of the first framebuffer or serial console. During this time no console messages are emitted because the VT console registry (even if no backend is registered to it) removes the early console if CON_BOOT is set. Signed-off-by: David S. Miller commit bcf66bf54aabffc150acd1c99e0f4bc51935eada Author: Steffen Klassert Date: Tue Sep 20 23:38:58 2011 +0000 xfrm: Perform a replay check after return from async codepaths When asyncronous crypto algorithms are used, there might be many packets that passed the xfrm replay check, but the replay advance function is not called yet for these packets. So the replay check function would accept a replay of all of these packets. Also the system might crash if there are more packets in async processing than the size of the anti replay window, because the replay advance function would try to update the replay window beyond the bounds. This pach adds a second replay check after resuming from the async processing to fix these issues. Signed-off-by: Steffen Klassert Acked-by: Herbert Xu Signed-off-by: David S. Miller commit 561dac2d410ffac0b57a23b85ae0a623c1a076ca Author: Gao feng Date: Sun Sep 11 15:36:05 2011 +0000 fib:fix BUG_ON in fib_nl_newrule when add new fib rule add new fib rule can cause BUG_ON happen the reproduce shell is ip rule add pref 38 ip rule add pref 38 ip rule add to 192.168.3.0/24 goto 38 ip rule del pref 38 ip rule add to 192.168.3.0/24 goto 38 ip rule add pref 38 then the BUG_ON will happen del BUG_ON and use (ctarget == NULL) identify whether this rule is unresolved Signed-off-by: Gao feng Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 0f4ccbc835036cbcc2513585bb2e93ee62e12674 Author: David Daney Date: Fri Sep 16 18:06:02 2011 -0700 MIPS: No branches in delay slots for huge pages in handle_tlbl For the case PM_DEFAULT_MASK == 0, we were placing a branch in the delay slot of another branch. This leads to undefined behavior. Signed-off-by: David Daney Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/2775/ Signed-off-by: Ralf Baechle commit d968275921f9fa7fbc602ac6618ffec6a062ee3c Author: David Daney Date: Tue Aug 30 06:45:20 2011 -0700 MIPS: Don't clobber CP0_STATUS value for CONFIG_MIPS_MT_SMTC Reported-by: Edgar E. Iglesias Signed-off-by: David Daney Patchwork: https://patchwork.linux-mips.org/patch/2753/ Signed-off-by: Ralf Baechle commit 465aaed0030b23d905f3eca5e65481773bea9ea1 Author: David Daney Date: Sat Aug 20 08:44:00 2011 -0700 MIPS: Octeon: Select CONFIG_HOLES_IN_ZONE Current Octeon systems do in fact have holes in their memory zones. We need to select HOLES_IN_ZONE. If we do not, some memory configurations will result in crashes at boot time like this: . . . CPU 6 Unable to handle kernel paging request at virtual address 0000000000700000, epc == ffffffff8118fe00, ra == ffffffff8118fe9c Oops[#1]: Cpu 6 . . . ... Call Trace: [] setup_per_zone_wmarks+0x1b0/0x338 [] init_per_zone_wmark_min+0x64/0xd0 [] do_one_initcall+0x38/0x160 . . . Reported-by: Jason Kwon Signed-off-by: David Daney To: linux-mips@linux-mips.org Cc: Jason Kwon Patchwork: https://patchwork.linux-mips.org/patch/2724/ Tested-by: Guenter Roeck Signed-off-by: Ralf Baechle commit bd7100099a46b59f433dd15ad60adbb4d4f3d625 Author: Rafael J. Wysocki Date: Thu Jun 2 21:06:48 2011 +0200 MIPS: PM: Use struct syscore_ops instead of sysdevs for PM (v2) Convert some MIPS architecture's code to using struct syscore_ops objects for power management instead of sysdev classes and sysdevs. This simplifies the code and reduces the kernel's memory footprint. It also is necessary for removing sysdevs from the kernel entirely in the future. Signed-off-by: Rafael J. Wysocki Acked-by: Greg Kroah-Hartman Acked-and-tested-by: Lars-Peter Clausen Signed-off-by: Lars-Peter Clausen Cc: linux-kernel@vger.kernel.org Cc: "Rafael J. Wysocki" Patchwork: http://patchwork.linux-mips.org/patch/2431/ Signed-off-by: Ralf Baechle commit 1eec6cd08b4feb72a73aff468ab72bdd21e1dc61 Author: Yong Zhang Date: Tue Aug 16 09:54:54 2011 +0800 MIPS: Compat: Use 32-bit wrapper for compat_sys_futex. We can't trust userspace to pass signed-extend arguments. Not correctly sign-extended arguments to futex-wait result in architecturally undefined operation of 32-bit arithmetic instructions. For example, if 'val' is too big and bit-31 is 1, the caller may enter endless loop at: futex_wait_setup() { ... if (uval != val) { queue_unlock(q, *hb); ret = -EWOULDBLOCK; ... } Signed-off-by: Yong Zhang To: linux-mips@linux-mips.org To: linux-kernel@vger.kernel.org Patchwork: https://patchwork.linux-mips.org/patch/2714/ Signed-off-by: Ralf Baechle commit b8ecf341f1b7ca7bf3cb80c48cbbae33b79947d0 Author: Arnaud Lacombe Date: Mon Aug 15 13:07:05 2011 -0400 MIPS: Do not use EXTRA_CFLAGS Usage of these flags has been deprecated for nearly 4 years by: commit f77bf01425b11947eeb3b5b54685212c302741b8 Author: Sam Ravnborg Date: Mon Oct 15 22:25:06 2007 +0200 kbuild: introduce ccflags-y, asflags-y and ldflags-y Moreover, these flags (at least EXTRA_CFLAGS) have been documented for command line use. By default, gmake(1) do not override command line setting, so this is likely to result in build failure or unexpected behavior. Replace their usage by Kbuild's `{as,cc,ld}flags-y'. To: linux-kernel@vger.kernel.org Cc: Sam Ravnborg Patchwork: https://patchwork.linux-mips.org/patch/2710/ Cc: linux-mips@linux-mips.org Signed-off-by: Arnaud Lacombe Signed-off-by: Ralf Baechle commit dd0a028183369cccc0826199a7ccdc850ece289b Author: Manuel Lauss Date: Fri Aug 12 08:28:35 2011 +0200 MIPS: Alchemy: DB1200: Disable cascade IRQ in handler Disable the cascade IRQ in the cascade handler. This is required to get the DB1300 working, and also gets rid of all spurious interrupts previously observed on the DB1200; so Config[OD] can be disabled again for better performance. Signed-off-by: Manuel Lauss To: Linux-MIPS Patchwork: https://patchwork.linux-mips.org/patch/2708/ Signed-off-by: Ralf Baechle commit b7867f1bfcb76c75d98d35f576fcd9d7759a96fe Author: John Crispin Date: Wed Aug 3 13:37:24 2011 +0100 SERIAL: Lantiq: Set timeout in uart_port Without this patch apps using readline hang. Signed-off-by: Thomas Langer Signed-off-by: John Crispin Cc: linux-mips@linux-mips.org Cc: linux-serial@vger.kernel.org Patchwork: https://patchwork.linux-mips.org/patch/2687/ Signed-off-by: Alan Cox Signed-off-by: Ralf Baechle commit 0596954681859f1b7b7adfd58fa738c09ed2affa Author: John Crispin Date: Mon Jul 18 18:04:12 2011 +0200 MIPS: Lantiq: Fix setting the PCI bus speed on AR9 The bits used to set the PCI bus speed on AR9 are slightly different to those used on Danube. Signed-off-by: John Crispin Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/2614/ Signed-off-by: Ralf Baechle commit 77fbdb30f045084f1c65b72bd457d7406343aad7 Author: John Crispin Date: Mon Jul 18 18:08:40 2011 +0200 MIPS: Lantiq: Fix external interrupt sources The irq base offset needs to be ignored when matching irqs to external interrupt pins. Taking the offset into account resulted in the EIU not being brought up properly. Signed-off-by: John Crispin Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/2616/ Signed-off-by: Ralf Baechle commit d954ffe34a606d4ec34cd3c2b0b5974779759f25 Author: Ralf Baechle Date: Tue Aug 2 22:52:48 2011 +0100 MIPS: tlbex: Fix build error in R3000 code. Only some GCC versions such as gcc 4.2 notice that the variable wr in build_r3000_tlb_modify_handler is used uninitialized. When using one of those GCCs the build will fail due to -Werror. GCC 4.6 does not warn about the uninitialized use of wr. This issue was introduced by 7211f4d7a3dcbe57c5d396c334dca525315dceb2 [MIPS: Close races in TLB modify handlers.] Reported-by: Ganesan Ramalingam Signed-off-by: Ralf Baechle commit 870168a031b3c5b78191d719d375221f01e98e11 Author: Manuel Lauss Date: Tue Aug 2 15:50:58 2011 +0200 MIPS: Alchemy: Include Au1100 in PM code. The current code forgets the Au1100 when looking for the correct method to suspend the chip. Signed-off-by: Manuel Lauss To: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/2675/ Signed-off-by: Ralf Baechle commit c78c48827336b8aec2a5afcf249f0d0a7fe16859 Author: Manuel Lauss Date: Tue Aug 2 15:50:56 2011 +0200 MIPS: Alchemy: Fix typo in MAC0 registration Harmless typo which prints an error message although MAC0 was registered successfully. Signed-off-by: Manuel Lauss To: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/2672/ Signed-off-by: Ralf Baechle commit a705dc7cf4edbf110af19ea55cb5e5d0465adcf4 Author: Ralf Baechle Date: Thu Jul 28 13:31:48 2011 +0100 MIPS: MSP71xx: Fix build error. CC arch/mips/pmc-sierra/msp71xx/msp_irq.o /home/ralf/src/linux/linux-mips/arch/mips/pmc-sierra/msp71xx/msp_irq.c:112:2: error: request for member ‘flags’ in something not a structure or union /home/ralf/src/linux/linux-mips/arch/mips/pmc-sierra/msp71xx/msp_irq.c:118:2: error: request for member ‘flags’ in something not a structure or union make[4]: *** [arch/mips/pmc-sierra/msp71xx/msp_irq.o] Error 1 caused by 57336bc1056798d89714b7fb1b1d197e6bda6819 [MIPS: Mark cascade and low level interrupts IRQF_NO_THREAD]. Commas to separate struct initializers generally are considered useful to enhance the compilation experience of the user. Signed-off-by: Ralf Baechle commit 1f717929e987fc55bb6be02df994945f8edbd46c Author: Ralf Baechle Date: Wed Jul 27 11:44:47 2011 +0100 MIPS: Handle __put_user() sleeping. do_signal() does __put_user() which can fault, resulting in a might_sleep() warning in down_read(&mm->mmap_sem) and a "scheduling while atomic" warning when mmap_sem is contented. On Swarm this also results in: WARNING: at kernel/smp.c:459 smp_call_function_many+0x148/0x398() Modules linked in: Call Trace: [] dump_stack+0x1c/0x50 [] warn_slowpath_common+0x8c/0xc8 [] warn_slowpath_null+0x2c/0x40 [] smp_call_function_many+0x148/0x398 [] smp_call_function+0x58/0xa8 [] r4k_flush_data_cache_page+0x54/0xd8 [] handle_pte_fault+0xa9c/0xad0 [] handle_mm_fault+0x158/0x200 [] do_page_fault+0x218/0x3b0 [] ret_from_exception+0x0/0x10 [] copy_siginfo_to_user32+0x50/0x298 [] setup_rt_frame_32+0x90/0x250 [] do_notify_resume+0x154/0x358 [] work_notifysig+0xc/0x14 Fixed by enabling interrupts in do_notify_resume before delivering signals. [ralf@linux-mips.org: Reported and original fix by tglx but I wanted to minimize the amount of code being run with interrupts disabled so I moved the local_irq_disable() call right into do_notify_resume. Which is saner than doing it in entry.S.] Reported-by: Thomas Gleixner Signed-off-by: Ralf Baechle commit 0f462e3c1281fd679b4c626612bfa59eb964bafd Author: Thomas Gleixner Date: Sat Jul 23 12:41:25 2011 +0000 MIPS: Allow forced irq threading All low level interrupts have been marked NO_THREAD, so MIPS can enjoy the wonderful world of forced threaded interrupt handlers. Signed-off-by: Thomas Gleixner To: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/2639/ Signed-off-by: Ralf Baechle commit 5c22cd407574988cc1580108e0df25ee64ea3d59 Author: Liming Wang Date: Fri Aug 26 07:00:04 2011 +0800 MIPS: i8259: Mark cascade interrupt non-threaded Cascade interrupts cannot be threaded. Signed-off-by: Liming Wang Signed-off-by: Bruce Ashfield Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/1314370804-21266-1-git-send-email-liming.wang@windriver.com Signed-off-by: Thomas Gleixner Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/2770/ Signed-off-by: Ralf Baechle commit 77cbece76723dc9e77497c042827155388bdae6d Author: Wu Zhangjin Date: Sat Jul 23 12:41:24 2011 +0000 MIPS: Loongson: Mark cascade interrupts IRQF_NO_THREAD There are two cascade interrupts in Loongson machines, one for bonito northbridge, another for the 8259A controller in the southbridge. Both want to be non threaded. Signed-off-by: Wu Zhangjin Signed-off-by: Thomas Gleixner Cc: linux-mips@linux-mips.org Cc: Wu Zhangjin Patchwork: https://patchwork.linux-mips.org/patch/2638/ Signed-off-by: Ralf Baechle commit 5a4a4ad851dd8db2d888fb86c8bd946b2ae79f60 Author: Wu Zhangjin Date: Sat Jul 23 12:41:24 2011 +0000 MIPS: Mark cascade and low level interrupts IRQF_NO_THREAD Mark interrupts with no_action handler, cascade interrupts, low level interrupts (bus error, halt ..) with IRQF_NO_THREAD to exclude them from forced threading. Signed-off-by: Wu Zhangjin Signed-off-by: Thomas Gleixner Cc: linux-mips@linux-mips.org Cc: Wu Zhangjin Signed-off-by: Ralf Baechle commit 4d85f6afa43d366868fdaa19595722309e4843f6 Author: Wu Zhangjin Date: Sat Jul 23 12:41:24 2011 +0000 MIPS: Make the die_lock be raw On preempt-rt this lock needs to be raw, so it does not get converted to a sleeping spinlock. Trying to sleep in a panic is not really desireable. Signed-off-by: Wu Zhangjin Signed-off-by: Thomas Gleixner Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/2636/ Signed-off-by: Ralf Baechle commit 49de830ad7b94d05f6dbfbae97a03f80169a7462 Author: Thomas Gleixner Date: Sat Jul 23 12:41:23 2011 +0000 MIPS: Ftrace: Fix the CONFIG_DYNAMIC_FTRACE=n compile arch/mips/kernel/ftrace.c: In function ‘ftrace_get_parent_ra_addr’: arch/mips/kernel/ftrace.c:212: error: implicit declaration of function ‘in_kernel_space’ arch/mips/kernel/ftrace.c: In function ‘prepare_ftrace_return’: arch/mips/kernel/ftrace.c:314: error: ‘MCOUNT_OFFSET_INSNS’ undeclared (first use in this function) arch/mips/kernel/ftrace.c:314: error: (Each undeclared identifier is reported only once arch/mips/kernel/ftrace.c:314: error: for each function it appears in.) Signed-off-by: Thomas Gleixner To: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/2634/ Signed-off-by: Ralf Baechle commit 20ef5d3a23d5aacb85d0a2808d949e3daf83cd20 Author: Yoichi Yuasa Date: Tue Jul 26 18:19:01 2011 +0900 MIPS: RC32434: Fix PCI build error arch/mips/pci/pci-rc32434.c: In function 'rc32434_pci_init': arch/mips/pci/pci-rc32434.c:217:16: error: 'rcrc32434_res_pci_io1' undeclared (first use in this function) arch/mips/pci/pci-rc32434.c:217:16: note: each undeclared identifier is reported only once for each function it appears in make[1]: *** [arch/mips/pci/pci-rc32434.o] Error 1 This problem is included in the following commit. commit 28f65c11f2ffb3957259dece647a24f8ad2e241b Author: Joe Perches Date: Thu Jun 9 09:13:32 2011 -0700 treewide: Convert uses of struct resource to resource_size(ptr) Signed-off-by: Yoichi Yuasa Cc: linux-mips Cc: Joe Perches Patchwork: https://patchwork.linux-mips.org/patch/2654/ Signed-off-by: Ralf Baechle commit 47997d756aa2a84ab577e1b0383cc12d582fc69c Author: Matt Fleming Date: Wed Sep 21 16:08:03 2011 +0200 x86/rtc: Don't recursively acquire rtc_lock A deadlock was introduced on x86 in commit ef68c8f87ed1 ("x86: Serialize EFI time accesses on rtc_lock") because efi_get_time() and friends can be called with rtc_lock already held by read_persistent_time(), e.g.: timekeeping_init() read_persistent_clock() <-- acquire rtc_lock efi_get_time() phys_efi_get_time() <-- acquire rtc_lock To fix this let's push the locking down into the get_wallclock() and set_wallclock() implementations. Only the clock implementations that access the x86 RTC directly need to acquire rtc_lock, so it makes sense to push the locking down into the rtc, vrtc and efi code. The virtualization implementations don't require rtc_lock to be held because they provide their own serialization. Signed-off-by: Matt Fleming Acked-by: Jan Beulich Acked-by: Avi Kivity [for the virtualization aspect] Cc: "H. Peter Anvin" Cc: Zhang Rui Cc: Josh Boyer Signed-off-by: Andrew Morton Signed-off-by: Thomas Gleixner Signed-off-by: Ingo Molnar commit f0e8ed858edb327802ee65fd695cc1538286226f Author: Mark Brown Date: Tue Sep 20 11:41:54 2011 +0100 ASoC: Ensure we generate a driver name Commit 873bd4c (ASoC: Don't set invalid name string to snd_card->driver field) broke generation of a driver name for all ASoC cards relying on the automatic generation of one. Fix this by using the old default with spaces replaced by underscores. Signed-off-by: Mark Brown Acked-by: Takashi Iwai commit 6fcb8a3a3a542ca078dc739fe0ea97191bc59e74 Author: Lars-Peter Clausen Date: Mon Sep 19 16:17:55 2011 +0200 mfd: Fix generic irq chip ack function name for jz4740-adc In commit 659fb32d1b6("genirq: replace irq_gc_ack() with {set,clr}_bit variants"), irq_gc_ack was renamed to irq_gc_ack_set_bit. The jz4740-adc driver still uses the old name which results in a compile error. Signed-off-by: Lars-Peter Clausen Signed-off-by: Samuel Ortiz commit 6c4867f6469964e34c5f4ee229a2a7f71a34c7ff Author: Carsten Emde Date: Wed Sep 21 10:22:11 2011 +0200 floppy: use del_timer_sync() in init cleanup When no floppy is found the module code can be released while a timer function is pending or about to be executed. CPU0 CPU1 floppy_init() timer_softirq() spin_lock_irq(&base->lock); detach_timer(); spin_unlock_irq(&base->lock); -> Interrupt del_timer(); return -ENODEV; module_cleanup(); <- EOI call_timer_fn(); OOPS Use del_timer_sync() to prevent this. Signed-off-by: Carsten Emde Signed-off-by: Thomas Gleixner Cc: Jens Axboe Cc: Signed-off-by: Andrew Morton Signed-off-by: Jens Axboe commit d11bb4462c4cc6ddd45c6927c617ad79fa6fb8fc Author: Wanlong Gao Date: Wed Sep 21 10:22:10 2011 +0200 blk-cgroup: be able to remove the record of unplugged device The bug is we're not able to remove the device from blkio cgroup's per-device control files if it gets unplugged. To reproduce the bug: # mount -t cgroup -o blkio xxx /cgroup # cd /cgroup # echo "8:0 1000" > blkio.throttle.read_bps_device # unplug the device # cat blkio.throttle.read_bps_device 8:0 1000 # echo "8:0 0" > blkio.throttle.read_bps_device -bash: echo: write error: No such device After patching, the device removal will succeed. Thanks for the comments of Paul, Zefan, and Vivek. Signed-off-by: Wanlong Gao Cc: Li Zefan Cc: Paul Menage Acked-by: Vivek Goyal Cc: Jens Axboe Cc: Signed-off-by: Andrew Morton Signed-off-by: Jens Axboe commit b811ce9104a7f7663ddae4f7795a194a103b8f90 Author: Jesse Brandeburg Date: Tue Sep 20 15:13:03 2011 +0000 ixgbe: fix possible null buffer error It seems that at least one PPC machine would occasionally give a (valid) 0 as the return value from dma_map, this caused the ixgbe code to not work correctly. A fix is pending in the PPC tree to not return 0 from dma map, but we can also fix the driver to make sure we don't mess up in other arches as well. This patch is applicable to all current stable kernels. Ref: https://bugzilla.redhat.com/show_bug.cgi?id=683611 Reported-by: Neil Horman Signed-off-by: Jesse Brandeburg CC: Alexander Duyck CC: stable@kernel.org Tested-by: Thadeu Lima de Souza Cascardo Tested-by: Phil Schmitt Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit 5c1e688388f629e8d8e88183b5ebc21e209252aa Author: Kasper Pedersen Date: Tue Sep 20 12:41:17 2011 +0000 tg3: fix VLAN tagging regression commit 92cd3a17ce9c719abb4c28dee3438e0c641f8de4 tg3: Simplify tx bd assignments broke VLAN tagging on outbound packets. It ifdef'ed BCM_KERNEL_SUPPORTS_8021Q, but this is not set anywhere. So vlan never gets set, and all packets are sent with vlan=0. v2: We can just remove the test. vlan_tx_tag_present is valid regardless of whether the 802.1q module is built. Tested on BCM5721 rev 11. Signed-off-by: Kasper Pedersen Signed-off-by: David S. Miller commit ddd53bf11172822bc02b32b876a491010257d1b0 Author: Mathias Krause Date: Tue Sep 20 14:22:59 2011 -0700 sparc, exec: remove redundant addr_limit assignment The address limit is already set in flush_old_exec() so this assignment of USER_DS is redundant. Signed-off-by: Mathias Krause Cc: David Miller Signed-off-by: Andrew Morton Signed-off-by: David S. Miller commit 01f96c0a9922cd9919baf9d16febdf7016177a12 Author: NeilBrown Date: Wed Sep 21 15:30:20 2011 +1000 md: Avoid waking up a thread after it has been freed. Two related problems: 1/ some error paths call "md_unregister_thread(mddev->thread)" without subsequently clearing ->thread. A subsequent call to mddev_unlock will try to wake the thread, and crash. 2/ Most calls to md_wakeup_thread are protected against the thread disappeared either by: - holding the ->mutex - having an active request, so something else must be keeping the array active. However mddev_unlock calls md_wakeup_thread after dropping the mutex and without any certainty of an active request, so the ->thread could theoretically disappear. So we need a spinlock to provide some protections. So change md_unregister_thread to take a pointer to the thread pointer, and ensure that it always does the required locking, and clears the pointer properly. Reported-by: "Moshe Melnikov" Signed-off-by: NeilBrown cc: stable@kernel.org commit 6760b109603c794e4bd281c0014fef069c019b6a Author: Russell King Date: Tue Sep 20 23:35:15 2011 +0100 ARM: fix vmlinux.lds.S discarding sections We are seeing linker errors caused by sections being discarded, despite the linker script trying to keep them. The result is (eg): `.exit.text' referenced in section `.alt.smp.init' of drivers/built-in.o: defined in discarded section `.exit.text' of drivers/built-in.o `.exit.text' referenced in section `.alt.smp.init' of net/built-in.o: defined in discarded section `.exit.text' of net/built-in.o This is the relevent part of the linker script (reformatted to make it clearer): | SECTIONS | { | /* | * unwind exit sections must be discarded before the rest of the | * unwind sections get included. | */ | /DISCARD/ : { | *(.ARM.exidx.exit.text) | *(.ARM.extab.exit.text) | } | ... | .exit.text : { | *(.exit.text) | *(.memexit.text) | } | ... | /DISCARD/ : { | *(.exit.text) | *(.memexit.text) | *(.exit.data) | *(.memexit.data) | *(.memexit.rodata) | *(.exitcall.exit) | *(.discard) | *(.discard.*) | } | } Now, this is what the linker manual says about discarded output sections: | The special output section name `/DISCARD/' may be used to discard | input sections. Any input sections which are assigned to an output | section named `/DISCARD/' are not included in the output file. No questions, no exceptions. It doesn't say "unless they are listed before the /DISCARD/ section." Now, this is what asn-generic/vmlinux.lds.S says: | /* | * Default discarded sections. | * | * Some archs want to discard exit text/data at runtime rather than | * link time due to cross-section references such as alt instructions, | * bug table, eh_frame, etc. DISCARDS must be the last of output | * section definitions so that such archs put those in earlier section | * definitions. | */ And guess what - the list _always_ includes .exit.text etc. Now, what's actually happening is that the linker is reading the script, and it finds the first /DISCARD/ output section at the beginning of the script. It continues reading the script, and finds the 'DISCARD' macro at the end, which having been postprocessed results in another /DISCARD/ output section. As the linker already contains the earlier /DISCARD/ output section, it adds it to that existing section, so it effectively is placed at the start. This can be seen by using the -M option to ld: | Linker script and memory map | | 0xc037c080 jiffies = jiffies_64 | | /DISCARD/ | *(.ARM.exidx.exit.text) | *(.ARM.extab.exit.text) | *(.exit.text) | *(.memexit.text) | *(.exit.data) | *(.memexit.data) | *(.memexit.rodata) | *(.exitcall.exit) | *(.discard) | *(.discard.*) | | 0xc0008000 . = 0xc0008000 | | .head.text 0xc0008000 0x1d0 | 0xc0008000 _text = . | *(.head.text) | .head.text 0xc0008000 0x1d0 arch/arm/kernel/head.o | 0xc0008000 stext | | .text 0xc0008200 0x2d78d0 | 0xc0008200 _stext = . | 0xc0008200 __exception_text_start = . | *(.exception.text) | .exception.text | ... As you can see, all the discarded sections are grouped together - and as a result of it being the first output section, they all appear before any other section. The result is that not only is the unwind information discarded (as intended), but also the .exit.text, despite us wanting to have the .exit.text preserved. We can't move the unwind information elsewhere, because it'll then be included even when we do actually discard the .exit.text (and similar) sections. So, work around this by avoiding the generic DISCARDS macro, and instead conditionalize the sections to be discarded ourselves. This avoids the ambiguity in how the linker assigns input sections to output sections, making our script less dependent on undocumented linker behaviour. Reported-by: Rob Herring Tested-by: Mark Brown Signed-off-by: Russell King commit 38867a28a7dc9d69389990bcd42f6b7c77da3d9d Merge: 43a964a7bfd1 b71d8429ec36 Author: Linus Torvalds Date: Tue Sep 20 14:23:16 2011 -0700 Merge branch 'fixes' of git://git.linaro.org/people/arnd/arm-soc * 'fixes' of git://git.linaro.org/people/arnd/arm-soc: mach-integrator: fix VGA base regression arm/dt: Tegra: Update SDHCI nodes to match bindings ARM: EXYNOS4: fix incorrect pad configuration for keypad row lines ARM: SAMSUNG: fix to prevent declaring duplicated ARM: SAMSUNG: fix watchdog reset issue with clk_get() ARM: S3C64XX: Remove un-used code backlight code on SMDK6410 ARM: EXYNOS4: restart clocksource while system resumes ARM: EXYNOS4: Fix routing timer interrupt to offline CPU ARM: EXYNOS4: Fix return type of local_timer_setup() ARM: EXYNOS4: Fix wrong pll type for vpll ARM: Dove: fix second SPI initialization call commit 43a964a7bfd15a2ed9e801c18dd327565edb4e62 Merge: 80976804f501 0a7a0519d178 Author: Linus Torvalds Date: Tue Sep 20 14:22:55 2011 -0700 Merge branch 'for-linus' of git://github.com/chrismason/linux * 'for-linus' of git://github.com/chrismason/linux: Btrfs: reserve sufficient space for ioctl clone commit 80976804f501303a34a76e925119393722596dca Author: Seth Jennings Date: Tue Sep 20 13:09:56 2011 -0700 staging: zcache: fix cleancache crash After commit c5f5c4db3938 ("staging: zcache: fix crash on high memory swap") cleancache crashes on the first successful get. This was caused by a remaining virt_to_page() call in zcache_pampd_get_data_and_free() that only gets run in the cleancache path. The patch converts the virt_to_page() to struct page casting like was done for other instances in c5f5c4db3938. Signed-off-by: Seth Jennings Tested-By: Valdis Kletnieks Acked-by: Dan Magenheimer Signed-off-by: Greg Kroah-Hartman Signed-off-by: Linus Torvalds commit b71d8429ec364ef8eada011dded2e23aaecde53e Author: Linus Walleij Date: Sun Sep 4 23:40:08 2011 +0200 mach-integrator: fix VGA base regression The changes introduced in commit cc22b4c18540e5e8bf55c7d124044f9317527d3c "ARM: set vga memory base at run-time" Makes the Integrator/AP freeze completely. I appears that this is due to the VGA base address being assigned at PCI init time, while this base is needed earlier than that. Moving the initialization of the base address to the .map_io function solves this problem. Cc: Rob Herring Cc: Nicolas Pitre Cc: Arnd Bergmann Signed-off-by: Linus Walleij Acked-by: Rob Herring Signed-off-by: Arnd Bergmann commit a0638eb6a2979840ff4cde19b100e96b97a91dfd Author: Stephen Warren Date: Tue Sep 20 10:46:25 2011 -0600 arm/dt: Tegra: Update SDHCI nodes to match bindings The bindings were recently updated to have separate properties for each type of GPIO. Update the Device Tree source to match that. Signed-off-by: Stephen Warren Acked-by: Olof Johansson Signed-off-by: Arnd Bergmann commit b7e43381260e56840fd2fa582565c362d2fba1d9 Author: Tanmay Upadhyay Date: Mon Sep 5 19:32:04 2011 +0000 net: pxa168: Fix build errors by including interrupt.h Commit a6b7a407865aab9f849dd99a71072b7cd1175116 removed linux/interrupt.h from netdevice.h. This fixes below build failure drivers/net/pxa168_eth.c: In function 'pxa168_eth_collect_events': drivers/net/pxa168_eth.c:866: error: 'IRQ_NONE' undeclared (first use in this function) drivers/net/pxa168_eth.c:866: error: (Each undeclared identifier is reported only once drivers/net/pxa168_eth.c:866: error: for each function it appears in.) drivers/net/pxa168_eth.c: At top level: drivers/net/pxa168_eth.c:913: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'pxa168_eth_int_handler' drivers/net/pxa168_eth.c: In function 'pxa168_eth_open': drivers/net/pxa168_eth.c:1133: error: implicit declaration of function 'request_irq' drivers/net/pxa168_eth.c:1133: error: 'pxa168_eth_int_handler' undeclared (first use in this function) drivers/net/pxa168_eth.c:1134: error: 'IRQF_DISABLED' undeclared (first use in this function) drivers/net/pxa168_eth.c:1160: error: implicit declaration of function 'free_irq' Signed-off-by: Tanmay Upadhyay Signed-off-by: David S. Miller commit 97c7de055713afddf4218f19c896b5185555da15 Author: Lin Ming Date: Tue Sep 20 15:45:07 2011 -0400 netconsole: switch init_netconsole() to late_initcall Commit 88491d8(drivers/net: Kconfig & Makefile cleanup) causes a regression that netconsole does not work if netconsole and network device driver are build into kernel, because netconsole is linked before network device driver. Andrew Morton suggested to fix this with initcall ordering. Fixes it by switching init_netconsole() to late_initcall. Signed-off-by: Lin Ming Signed-off-by: David S. Miller commit 710778ff878a06654175863db133293007d45aee Author: Ben Hutchings Date: Tue Sep 6 12:44:25 2011 +0000 gianfar: Fix overflow check and return value for gfar_get_cls_all() This function may currently fill one entry beyond the end of the array it is given. It also doesn't return an error code in case it does detect overflow. Signed-off-by: Ben Hutchings Signed-off-by: David S. Miller commit 22e83a2926998fe132ae4dd26f1e998c70ae2e38 Author: Henry Wong Date: Sun Sep 18 13:41:49 2011 +0000 ppp_generic: fix multilink fragment MTU calculation (again) When using MLPPP, the maximum size of a fragment is incorrectly calculated with an offset of -2. This patch reverses the changes in the patch found here: http://marc.info/?l=linux-netdev&m=123541324010539&w=2 The value of hdrlen includes the size of both the 2-byte PPP protocol field and the 2- or 4-byte multilink header (2+4=6 for long sequence numbers, 2+2=4 for short sequence numbers). Section 2 of RFC1661 says that the MRU that is negotiated (i.e., the MTU of the sending system) includes only the PPP payload but not the protocol field, thus the correct MTU should be the link's MTU minus the multilink header (mtu - (hdrlen-2)). The incorrect calculation causes Linux to fragment packets to a size two bytes smaller than the allowed MTU. While not technically illegal, this behaviour confounds MRU-tuning to avoid PPP-layer fragmentation. Signed-off-by: Henry Wong Signed-off-by: David S. Miller commit d706f00f65146822c0097b796b3557ea8980c305 Author: Daniel Hellstrom Date: Fri Sep 9 05:17:54 2011 +0000 GRETH: avoid overwrite IP-stack's IP-frags checksum The GRETH GBIT core does not do checksum offloading for IP segmentation. This patch adds a check in the xmit function to determine if the stack has calculated the checksum for us. Signed-off-by: Daniel Hellstrom Signed-off-by: David S. Miller commit 6af29a963cecf426966d56935d60a984bd5594ea Author: Daniel Hellstrom Date: Thu Sep 8 03:14:35 2011 +0000 GRETH: RX/TX bytes were never increased Signed-off-by: Daniel Hellstrom Signed-off-by: David S. Miller commit 8603e33d01cb6bd32de46b2596fe47f0c4df6c12 Author: Roy Li Date: Tue Sep 20 15:10:16 2011 -0400 ipv6: fix a possible double free When calling snmp6_alloc_dev fails, the snmp6 relevant memory are freed by snmp6_alloc_dev. Calling in6_dev_finish_destroy will free these memory twice. Double free will lead that undefined behavior occurs. Signed-off-by: Roy Li Acked-by: Eric Dumazet Signed-off-by: David S. Miller commit 0a7a0519d1789f3a222849421dbe91b6bddb88f5 Merge: a66e7cc626f4 b6f3409b2197 Author: Chris Mason Date: Tue Sep 20 14:49:29 2011 -0400 Merge branch 'btrfs-3.0' into for-linus commit b6f3409b2197e8fcedb43e6600e37b7cfbe0715b Author: Sage Weil Date: Tue Sep 20 14:48:51 2011 -0400 Btrfs: reserve sufficient space for ioctl clone Fix a crash/BUG_ON in the clone ioctl due to insufficient reservation. We need to reserve space for: - adjusting the old extent (possibly splitting it) - adding the new extent - updating the inode Signed-off-by: Sage Weil Signed-off-by: Chris Mason commit fe7d189d4a2ccbb3590b1da97a3f6a83fc2efd80 Merge: eebb6fb4ae2f 2544bfc0eb25 Author: David S. Miller Date: Tue Sep 20 14:42:45 2011 -0400 Merge branch 'davem.r8169.fixes' of git://violet.fr.zoreil.com/romieu/linux commit 2838888f3f268344d42ac088c8abcff91c505ced Merge: d006de93531a cfbd6f84c2e2 Author: Linus Torvalds Date: Tue Sep 20 10:28:52 2011 -0700 Merge git://git.samba.org/sfrench/cifs-2.6 * git://git.samba.org/sfrench/cifs-2.6: cifs: Fix broken sec=ntlmv2/i sec option (try #2) Fix the conflict between rwpidforward and rw mount options CIFS: Fix ERR_PTR dereference in cifs_get_root cifs: fix possible memory corruption in CIFSFindNext commit d006de93531a9876b26919e9d2bbf562654ab736 Merge: 0ad79ed34c90 4e8858d51304 Author: Linus Torvalds Date: Tue Sep 20 10:24:46 2011 -0700 Merge git://www.linux-watchdog.org/linux-watchdog * git://www.linux-watchdog.org/linux-watchdog: watchdog: Initconst section fixes for watchdog watchdog: lantiq: fix watchdogs timeout handling watchdog: hpwdt: prevent multiple "NMI occurred" messages watchdog: WatchDog Timer Driver Core - use passed watchdog_device commit 0ad79ed34c909205184cb85e855cdf3e17a6eac8 Merge: 9d037a777695 46724c2e023c Author: Linus Torvalds Date: Tue Sep 20 10:21:52 2011 -0700 Merge branch 'for-linus' of git://github.com/tiwai/sound * 'for-linus' of git://github.com/tiwai/sound: ALSA: HDA: Add support for IDT 92HD93 ALSA: hda/realtek - Fix auto-mute with HP+LO configuration commit b6cf8788a3382c2000743a0e393bcc8aeb0601cb Author: Christian Borntraeger Date: Tue Sep 20 17:07:29 2011 +0200 [S390] kvm: extension capability for new address space layout 598841ca9919d008b520114d8a4378c4ce4e40a1 ([S390] use gmap address spaces for kvm guest images) changed kvm on s390 to use a separate address space for kvm guests. We can now put KVM guests anywhere in the user address mode with a size up to 8PB - as long as the memory is 1MB-aligned. This change was done without KVM extension capability bit. The change was added after 3.0, but we still have a chance to add a feature bit before 3.1 (keeping the releases in a sane state). We use number 71 to avoid collisions with other pending kvm patches as requested by Alexander Graf. Signed-off-by: Christian Borntraeger Acked-by: Avi Kivity Cc: Alexander Graf Signed-off-by: Heiko Carstens commit 480e5926ce3bb61ec229be2dab08bdce8abb8d2e Author: Christian Borntraeger Date: Tue Sep 20 17:07:28 2011 +0200 [S390] kvm: fix address mode switching 598841ca9919d008b520114d8a4378c4ce4e40a1 ([S390] use gmap address spaces for kvm guest images) changed kvm to use a separate address space for kvm guests. This address space was switched in __vcpu_run In some cases (preemption, page fault) there is the possibility that this address space switch is lost. The typical symptom was a huge amount of validity intercepts or random guest addressing exceptions. Fix this by doing the switch in sie_loop and sie_exit and saving the address space in the gmap structure itself. Also use the preempt notifier. Signed-off-by: Christian Borntraeger Acked-by: Avi Kivity Signed-off-by: Heiko Carstens commit eebb6fb4ae2f60a82e38afb6d8b373a4216bf891 Merge: 9d037a777695 8c23516fbb20 Author: John W. Linville Date: Tue Sep 20 09:19:14 2011 -0400 Merge branch 'master' of ssh://infradead/~/public_git/wireless into for-davem commit 4e8858d5130459c4af80b990c2280115a1d49877 Author: Andi Kleen Date: Thu Sep 15 13:09:51 2011 -0700 watchdog: Initconst section fixes for watchdog Signed-off-by: Andi Kleen Signed-off-by: Wim Van Sebroeck commit 9cfce47b146cb492b8d5e7b40d6f7b3ea1963d50 Author: John Crispin Date: Wed Aug 24 10:31:39 2011 +0200 watchdog: lantiq: fix watchdogs timeout handling The enable function was using the global timeout variable for local operations. This resulted in the value of the global variable being corrupted, thus breaking the code. Signed-off-by: John Crispin Signed-off-by: Thomas Langer Signed-off-by: Wim Van Sebroeck Cc: linux-watchdog@vger.kernel.org Cc: linux-mips@linux-mips.org commit dbc018eca386b4e2670fc3116feada19f3db664c Author: Naga Chumbalkar Date: Tue Aug 9 22:27:26 2011 +0000 watchdog: hpwdt: prevent multiple "NMI occurred" messages On platforms with no iCRU support don't print two, (possibly conflicting), "NMI occurred" messages when the firmware is unable to source the NMI. Please note that one of the enhancements to the v1.3.0 hpwdt driver is to panic and allow KDUMP to succeed even on NMIs that are unknown to the platform firmware. Signed-off-by: Naga Chumbalkar Reviewed-by: Thomas Mingarelli Signed-off-by: Wim Van Sebroeck commit cb7efc02c6dbc3bfe9d5d1509ed790fc757e05a9 Author: H Hartley Sweeten Date: Wed Aug 3 15:38:20 2011 -0700 watchdog: WatchDog Timer Driver Core - use passed watchdog_device Use the passed watchdog_device instead of the static global variable when testing and setting the status in watchdog_ping, watchdog_start, and watchdog_stop. Note that the callers of these functions are actually passing the static global variable. Signed-off-by: H Hartley Sweeten Signed-off-by: Wim Van Sebroeck commit f93dc4b6c975baeef9267a62451b370fbc586f3f Author: Mark Brown Date: Mon Sep 19 23:33:35 2011 +0100 ASoC: Remove bitrotted wm8962_resume() This functionality is now subsumed within the bias management, using the standard cache management functionality, without assuming the cache type. Signed-off-by: Mark Brown Acked-by: Liam Girdwood commit eef24afb28561a5a9f4be8f8da97735b7e6a826f Author: Rob Herring Date: Wed Sep 14 11:31:37 2011 -0500 irq: Fix check for already initialized irq_domain in irq_domain_add The sanity check in irq_domain_add() tests desc->irq_data != NULL or irq_data->domain != NULL. This prevents adding an irq_domain to a irq descriptor when irq_data exists, which true when the irq descriptor exists. This went unnoticed so far as the simple domain code did not enter this code path because domain->nr_irqs is always 0 for the simple domains. Split the check for irq_data == NULL out and have a separate warning for it. [ tglx: Made the check for irq_data == NULL separate ] Signed-off-by: Rob Herring Cc: Grant Likely Cc: marc.zyngier@arm.com Cc: thomas.abraham@linaro.org Cc: jamie@jamieiles.com Cc: b-cousson@ti.com Cc: shawn.guo@linaro.org Cc: linux-arm-kernel@lists.infradead.org Cc: devicetree-discuss@lists.ozlabs.org Link: http://lkml.kernel.org/r/1316017900-19918-3-git-send-email-robherring2@gmail.com Signed-off-by: Thomas Gleixner commit 5bd078dda4d4fbdb4bd138a6bd5b6e274c019ed2 Author: Rob Herring Date: Wed Sep 14 11:31:36 2011 -0500 irq: Add declaration of irq_domain_simple_ops to irqdomain.h irq_domain_simple_ops is exported, but is not declared in irqdomain.h, so add it. Signed-off-by: Rob Herring Cc: Grant Likely Cc: marc.zyngier@arm.com Cc: thomas.abraham@linaro.org Cc: jamie@jamieiles.com Cc: b-cousson@ti.com Cc: shawn.guo@linaro.org Cc: linux-arm-kernel@lists.infradead.org Cc: devicetree-discuss@lists.ozlabs.org Link: http://lkml.kernel.org/r/1316017900-19918-2-git-send-email-robherring2@gmail.com Signed-off-by: Thomas Gleixner commit 46724c2e023cb7ba5cd5000dee6481f0a15ebed9 Author: David Henningsson Date: Tue Sep 20 09:02:22 2011 +0200 ALSA: HDA: Add support for IDT 92HD93 Cc: stable@kernel.org BugLink: http://bugs.launchpad.net/bugs/854468 Signed-off-by: David Henningsson Signed-off-by: Takashi Iwai commit cfbd6f84c2e26c13ded16b6bb0871edb7d75974f Author: Shirish Pargaonkar Date: Wed Aug 24 23:05:46 2011 -0500 cifs: Fix broken sec=ntlmv2/i sec option (try #2) Fix sec=ntlmv2/i authentication option during mount of Samba shares. cifs client was coding ntlmv2 response incorrectly. All that is needed in temp as specified in MS-NLMP seciton 3.3.2 "Define ComputeResponse(NegFlg, ResponseKeyNT, ResponseKeyLM, CHALLENGE_MESSAGE.ServerChallenge, ClientChallenge, Time, ServerName) as Set temp to ConcatenationOf(Responserversion, HiResponserversion, Z(6), Time, ClientChallenge, Z(4), ServerName, Z(4)" is MsvAvNbDomainName. For sec=ntlmsspi, build_av_pair is not used, a blob is plucked from type 2 response sent by the server to use in authentication. I tested sec=ntlmv2/i and sec=ntlmssp/i mount options against Samba (3.6) and Windows - XP, 2003 Server and 7. They all worked. Signed-off-by: Shirish Pargaonkar Signed-off-by: Steve French commit c9c7fa0064f4afe1d040e72f24c2256dd8ac402d Author: Steve French Date: Mon Aug 29 18:54:12 2011 +0000 Fix the conflict between rwpidforward and rw mount options Both these options are started with "rw" - that's why the first one isn't switched on even if it is specified. Fix this by adding a length check for "rw" option check. Cc: Signed-off-by: Pavel Shilovsky Signed-off-by: Steve French commit 5b980b01212199833ee8023770fa4cbf1b85e9f4 Author: Pavel Shilovsky Date: Sun Aug 21 19:30:15 2011 +0400 CIFS: Fix ERR_PTR dereference in cifs_get_root move it to the beginning of the loop. Signed-off-by: Pavel Shilovsky Reviewed-by: Jeff Layton Signed-off-by: Steve French commit 9438fabb73eb48055b58b89fc51e0bc4db22fabd Author: Jeff Layton Date: Tue Aug 23 07:21:28 2011 -0400 cifs: fix possible memory corruption in CIFSFindNext The name_len variable in CIFSFindNext is a signed int that gets set to the resume_name_len in the cifs_search_info. The resume_name_len however is unsigned and for some infolevels is populated directly from a 32 bit value sent by the server. If the server sends a very large value for this, then that value could look negative when converted to a signed int. That would make that value pass the PATH_MAX check later in CIFSFindNext. The name_len would then be used as a length value for a memcpy. It would then be treated as unsigned again, and the memcpy scribbles over a ton of memory. Fix this by making the name_len an unsigned value in CIFSFindNext. Cc: Reported-by: Darren Lavender Signed-off-by: Jeff Layton Signed-off-by: Steve French commit 7cd015a0a37265e23bbdce7ce8f7e00507abe9ed Author: Keith Packard Date: Mon Sep 5 11:53:21 2011 -0700 drm/i915: Enable dither whenever display bpc < frame buffer bpc We want to enable dithering on any pipe where the frame buffer has more color resolution than the output device. The previous code was incorrectly clamping the frame buffer bpc to the display bpc, effectively disabling dithering all of the time as the computed frame buffer bpc would never be larger than the display bpc. Signed-off-by: Keith Packard Reported-by: Oliver Hartkopp Tested-by: Oliver Hartkopp commit 9d037a777695993ec7437e5f451647dea7919d4c Merge: 50f2d407c09b 477694e71113 Author: Linus Torvalds Date: Mon Sep 19 17:23:41 2011 -0700 Merge branch 'irq-fixes-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip * 'irq-fixes-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip: x86, iommu: Mark DMAR IRQ as non-threaded genirq: Make irq_shutdown() symmetric vs. irq_startup again commit 50f2d407c09be74c77cf9d502d087398a5ba6055 Merge: c2d7b49f42f5 a66e7cc626f4 Author: Linus Torvalds Date: Mon Sep 19 17:17:32 2011 -0700 Merge branch 'for-linus' of git://github.com/chrismason/linux * 'for-linus' of git://github.com/chrismason/linux: Btrfs: only clear the need lookup flag after the dentry is setup BTRFS: Fix lseek return value for error Btrfs: don't change inode flag of the dest clone file Btrfs: don't make a file partly checksummed through file clone Btrfs: fix pages truncation in btrfs_ioctl_clone() btrfs: fix d_off in the first dirent commit c2d7b49f42f50d7fc5cbfd195b785a128723fdf4 Author: Andiry Xu Date: Mon Sep 19 16:05:12 2011 -0700 USB: xHCI: prevent infinite loop when processing MSE event When a xHC host is unable to handle isochronous transfer in the interval, it reports a Missed Service Error event and skips some tds. Currently xhci driver handles MSE event in the following ways: 1. When encounter a MSE event, set ep->skip flag, update event ring dequeue pointer and return. 2. When encounter the next event on this ep, the driver will run the do-while loop, fetch td from ep's td_list to find the td corresponding to this event. All tds missed are marked as short transfer(-EXDEV). The do-while loop will end in two ways: 1. If the td pointed by the event trb is found; 2. If the ep ring's td_list is empty. However, if a buggy HW reports some unpredicted event (for example, an overrun event following a MSE event while the ep ring is actually not empty), the driver will never find the td, and it will loop until the td_list is empty. Unfortunately, the spinlock is dropped when give back a urb in the do-while loop. During the spinlock released period, the class driver may still submit urbs and add tds to the td_list. This may cause disaster, since the td_list will never be empty and the loop never ends, and the system hangs. To fix this, count the number of TDs on the ep ring before skipping TDs, and quit the loop when skipped that number of tds. This guarantees the do-while loop will end after certain number of cycles, and driver will not be trapped in an infinite loop. Signed-off-by: Andiry Xu Signed-off-by: Sarah Sharp Signed-off-by: Greg Kroah-Hartman Signed-off-by: Linus Torvalds commit 44f4c3ed60fb21e1d2dd98304390ac121e6c7c6d Author: Greg KH Date: Mon Sep 19 16:05:11 2011 -0700 USB: xhci: Set change bit when warm reset change is set. Sometimes, when a USB 3.0 device is disconnected, the Intel Panther Point xHCI host controller will report a link state change with the state set to "SS.Inactive". This causes the xHCI host controller to issue a warm port reset, which doesn't finish before the USB core times out while waiting for it to complete. When the warm port reset does complete, and the xHC gives back a port status change event, the xHCI driver kicks khubd. However, it fails to set the bit indicating there is a change event for that port because the logic in xhci-hub.c doesn't check for the warm port reset bit. After that, the warm port status change bit is never cleared by the USB core, and the xHC stops reporting port status change bits. (The xHCI spec says it shouldn't report more port events until all change bits are cleared.) This means any port changes when a new device is connected will never be reported, and the port will seem "dead" until the xHCI driver is unloaded and reloaded, or the computer is rebooted. Fix this by making the xHCI driver set the port change bit when a warm port reset change bit is set. A better solution would be to make the USB core handle warm port reset in differently, merging the current code with the standard port reset code that does an incremental backoff on the timeout, and tries to complete the port reset two more times before giving up. That more complicated fix will be merged next window, and this fix will be backported to stable. This should be backported to kernels as old as 3.0, since that was the first kernel with commit a11496ebf375 ("xHCI: warm reset support"). Signed-off-by: Sarah Sharp Cc: stable@kernel.org Signed-off-by: Greg Kroah-Hartman Signed-off-by: Linus Torvalds commit c19cc78efe922e86da7ba694dbfc4be066dd7eb4 Author: Randy Dunlap Date: Mon Sep 19 16:05:10 2011 -0700 staging: fix comedi build when ISA_DMA_API is enabled but COMEDI_PCI is not enabled Fix build when CONFIG_ISA_DMA_API is enabled but CONFIG_COMEDI_PCI[_DRIVERS] is not enabled. Fixes these build errors: drivers/staging/comedi/drivers/ni_labpc.c: In function 'labpc_ai_cmd': drivers/staging/comedi/drivers/ni_labpc.c:1351: error: implicit declaration of function 'labpc_suggest_transfer_size' drivers/staging/comedi/drivers/ni_labpc.c: At top level: drivers/staging/comedi/drivers/ni_labpc.c:1802: error: conflicting types for 'labpc_suggest_transfer_size' drivers/staging/comedi/drivers/ni_labpc.c:1351: note: previous implicit declaration of 'labpc_suggest_transfer_size' was here Signed-off-by: Randy Dunlap Signed-off-by: Greg Kroah-Hartman Signed-off-by: Linus Torvalds commit 58c3c3aa01b455ecb99d61ce73f1444274af696b Author: Linus Torvalds Date: Mon Sep 19 17:10:57 2011 -0700 Make taskstats round statistics down to nearest 1k bytes/events Even with just the interface limited to admin, there really is little to reason to give byte-per-byte counts for taskstats. So round it down to something less intrusive. Acked-by: Balbir Singh Signed-off-by: Linus Torvalds commit 1a51410abe7d0ee4b1d112780f46df87d3621043 Author: Linus Torvalds Date: Mon Sep 19 17:04:37 2011 -0700 Make TASKSTATS require root access Ok, this isn't optimal, since it means that 'iotop' needs admin capabilities, and we may have to work on this some more. But at the same time it is very much not acceptable to let anybody just read anybody elses IO statistics quite at this level. Use of the GENL_ADMIN_PERM suggested by Johannes Berg as an alternative to checking the capabilities by hand. Reported-by: Vasiliy Kulikov Cc: Johannes Berg Acked-by: Balbir Singh Signed-off-by: Linus Torvalds commit 8c23516fbb209ccf8f8c36268311c721faff29ee Author: Manual Munz Date: Sun Sep 18 18:24:03 2011 -0500 b43: Fix beacon problem in ad-hoc mode In ad-hoc mode, driver b43 does not issue beacons. Signed-off-by: Manual Munz Tested-by: Larry Finger Signed-off-by: Larry Finger Cc: Stable Signed-off-by: John W. Linville commit 5d59bbce3d5fba0c612e830f919e003d3da90d70 Merge: 2249b011432c f78b68261e80 Author: John W. Linville Date: Mon Sep 19 14:47:29 2011 -0400 Merge branch 'for-3.1' of git://github.com/padovan/bluetooth-next commit b6a68a5ba4a5111379625d6d921e1c24fc17dc3a Merge: 6d7c2b4cfa5c 130655ef0979 Author: Linus Torvalds Date: Mon Sep 19 08:02:41 2011 -0700 Merge branch 'slab/urgent' of git://github.com/penberg/linux * 'slab/urgent' of git://github.com/penberg/linux: slub: add slab with one free object to partial list tail commit 6d7c2b4cfa5cb17c9f84c949bfece17b60b0f929 Merge: 1f0772fe27aa 003cefe0c238 Author: Linus Torvalds Date: Mon Sep 19 07:55:43 2011 -0700 Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/radeon/kms: Make GPU/CPU page size handling consistent in blit code (v2) drm/radeon/kms: fix typo in r100_blit_copy drm/radeon: Unreference GEM object outside of spinlock in page flip error path. drm/radeon: Don't read from CP ring write pointer registers. drm/ttm: request zeroed system memory pages for new TT buffer objects commit 1f0772fe27aa03764478bd9d3a4cbad417a854cc Merge: 6bf3b0dc32a2 f779b2d60ab9 Author: Linus Torvalds Date: Mon Sep 19 07:48:04 2011 -0700 Merge git://github.com/davem330/net * git://github.com/davem330/net: tcp: fix validation of D-SACK tcp: fix build error if !CONFIG_SYN_COOKIES commit 8974bd51a77824d91010176f9a5da28513c2e1f5 Author: Takashi Iwai Date: Mon Sep 19 11:31:34 2011 +0200 ALSA: hda/realtek - Fix auto-mute with HP+LO configuration When the system has only the headphone and the line-out jacks without speakers, the current auto-mute code doesn't work. It's because the spec->automute_lines flag is wrongly referred in update_speakers(). This flag must be meaningless when spec->automute_hp_lo isn't set, thus they should be always coupled. The patch fixes the problem and add a comment to indicate the relationship briefly. BugLink: http://bugs.launchpad.net/bugs/851697 Reported-by: David Henningsson Tested-By: Jayne Han Cc: stable@kernel.org (3.0) Signed-off-by: Takashi Iwai commit f779b2d60ab95c17f1e025778ed0df3ec2f05d75 Author: Zheng Yan Date: Sun Sep 18 22:37:34 2011 -0400 tcp: fix validation of D-SACK D-SACK is allowed to reside below snd_una. But the corresponding check in tcp_is_sackblock_valid() is the exact opposite. It looks like a typo. Signed-off-by: Zheng Yan Acked-by: Eric Dumazet Signed-off-by: David S. Miller commit e05c82d3666119075615fdbf6abca0266344f27b Author: Eric Dumazet Date: Sun Sep 18 21:02:55 2011 -0400 tcp: fix build error if !CONFIG_SYN_COOKIES commit 946cedccbd7387 (tcp: Change possible SYN flooding messages) added a build error if CONFIG_SYN_COOKIES=n Reported-by: Markus Trippelsdorf Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 6bf3b0dc32a27c6e1ba3dcdaf428a043113cd389 Merge: b0e7031ac08f 417e206b16e1 Author: Linus Torvalds Date: Sun Sep 18 18:18:55 2011 -0700 Merge branch 'for-linus' of git://git.infradead.org/users/sameo/mfd-2.6 * 'for-linus' of git://git.infradead.org/users/sameo/mfd-2.6: mfd: Fix omap-usb-host build failure mfd: Make omap-usb-host TLL mode work again mfd: Set MAX8997 irq pointer mfd: Fix initialisation of tps65910 interrupts mfd: Check for twl4030-madc NULL pointer mfd: Copy the device pointer to the twl4030-madc structure mfd: Rename wm8350 static gpio_set_debounce() mfd: Fix value of WM8994_CONFIGURE_GPIO commit 003cefe0c238e683a29d2207dba945b508cd45b7 Author: Alex Deucher Date: Fri Sep 16 12:04:08 2011 -0400 drm/radeon/kms: Make GPU/CPU page size handling consistent in blit code (v2) The BO blit code inconsistenly handled the page size. This wasn't an issue on system with 4k pages since the GPU's page size is 4k as well. Switch the driver blit callbacks to take num pages in GPU page units. Fixes lemote mipsel systems using AMD rs780/rs880 chipsets. v2: incorporate suggestions from Michel. Signed-off-by: Alex Deucher Reviewed-by: Michel Dänzer Cc: stable@kernel.org Signed-off-by: Dave Airlie commit 18b4fada275dd2b6dd9db904ddf70fe39e272222 Author: Alex Deucher Date: Fri Sep 16 12:04:07 2011 -0400 drm/radeon/kms: fix typo in r100_blit_copy cur_pages is the number of pages per loop iteration. Signed-off-by: Alex Deucher Reviewed-by: Michel Dänzer Cc: stable@kernel.org Signed-off-by: Dave Airlie commit b0e7031ac08fa0aa242531c8d9a0cf9ae8ee276d Merge: 01a7143586f5 8e2ec639173f Author: Linus Torvalds Date: Sun Sep 18 11:02:26 2011 -0700 Merge git://github.com/davem330/net * git://github.com/davem330/net: (62 commits) ipv6: don't use inetpeer to store metrics for routes. can: ti_hecc: include linux/io.h IRDA: Fix global type conflicts in net/irda/irsysctl.c v2 net: Handle different key sizes between address families in flow cache net: Align AF-specific flowi structs to long ipv4: Fix fib_info->fib_metrics leak caif: fix a potential NULL dereference sctp: deal with multiple COOKIE_ECHO chunks ibmveth: Fix checksum offload failure handling ibmveth: Checksum offload is always disabled ibmveth: Fix issue with DMA mapping failure ibmveth: Fix DMA unmap error pch_gbe: support ML7831 IOH pch_gbe: added the process of FIFO over run error pch_gbe: fixed the issue which receives an unnecessary packet. sfc: Use 64-bit writes for TX push where possible Revert "sfc: Use write-combining to reduce TX latency" and follow-ups bnx2x: Fix ethtool advertisement bnx2x: Fix 578xx link LED bnx2x: Fix XMAC loopback test ... commit a66e7cc626f42de6c745963fe0d807518fa49d39 Author: Josef Bacik Date: Sun Sep 18 10:34:03 2011 -0400 Btrfs: only clear the need lookup flag after the dentry is setup We can race with readdir and the RCU path walking stuff. This is because we clear the need lookup flag before actually instantiating the inode. This will lead the RCU path walk stuff to find a dentry it thinks is valid without a d_inode attached. So instead unhash the dentry when we first start the lookup, and then clear the flag after we've instantiated the dentry so we're garunteed to either try the slow lookup, or have the d_inode set properly. Signed-off-by: Josef Bacik Signed-off-by: Chris Mason commit 48802c8ae2a9d618ec734a61283d645ad527e06c Author: Jeff Liu Date: Sun Sep 18 10:34:02 2011 -0400 BTRFS: Fix lseek return value for error The recent reworking of btrfs' lseek lead to incorrect values being returned. This adds checks for seeking beyond EOF in SEEK_HOLE and makes sure the error values come back correct. Andi Kleen also sent in similar patches. Signed-off-by: Jie Liu Reported-by: Andi Kleen Signed-off-by: Chris Mason commit 2cf4ce7c2a07782c3f4d899b380a78522bca3238 Merge: b6fd41e29dea dde820fbf717 Author: Chris Mason Date: Sun Sep 18 10:31:44 2011 -0400 Merge branch 'btrfs-3.0' into for-linus commit dde820fbf7176b64daddc1856597d9c61dac19e2 Author: Li Zefan Date: Sun Sep 18 10:20:46 2011 -0400 Btrfs: don't change inode flag of the dest clone file The dst file will have the same inode flags with dst file after file clone, and I think it's unexpected. For example, the dst file will suddenly become immutable after getting some share of data with src file, if the src is immutable. Signed-off-by: Li Zefan Signed-off-by: Chris Mason commit 0e7b824c4ef9f5bcf5e48cdce164a7b349dde969 Author: Li Zefan Date: Sun Sep 18 10:20:46 2011 -0400 Btrfs: don't make a file partly checksummed through file clone To reproduce the bug: # mount /dev/sda7 /mnt # dd if=/dev/zero of=/mnt/src bs=4K count=1 # umount /mnt # mount -o nodatasum /dev/sda7 /mnt # dd if=/dev/zero of=/mnt/dst bs=4K count=1 # clone_range -s 4K -l 4K /mnt/src /mnt/dst # echo 3 > /proc/sys/vm/drop_caches # cat /mnt/dst # dmesg ... btrfs no csum found for inode 258 start 0 btrfs csum failed ino 258 off 0 csum 2566472073 private 0 It's because part of the file is checksummed and the other part is not, and then btrfs will complain checksum is not found when we read the file. Disallow file clone if src and dst file have different checksum flag, so we ensure a file is completely checksummed or unchecksummed. Signed-off-by: Li Zefan Signed-off-by: Chris Mason commit 71ef07861080418d125dcf454af41baafa409a2c Author: Li Zefan Date: Sun Sep 18 10:20:46 2011 -0400 Btrfs: fix pages truncation in btrfs_ioctl_clone() It's a bug in commit f81c9cdc567cd3160ff9e64868d9a1a7ee226480 (Btrfs: truncate pages from clone ioctl target range) We should pass the dest range to the truncate function, but not the src range. Also move the function before locking extent state. Signed-off-by: Li Zefan Signed-off-by: Chris Mason commit 3765fefaee2da83f10829fa64a74e6b7360350cb Author: Hidetoshi Seto Date: Sun Sep 18 10:20:46 2011 -0400 btrfs: fix d_off in the first dirent Since the d_off in the first dirent for "." (that originates from the 4th argument "offset" of filldir() for the 2nd dirent for "..") is wrongly assigned in btrfs_real_readdir(), telldir returns same offset for different locations. | # mkfs.btrfs /dev/sdb1 | # mount /dev/sdb1 fs0 | # cd fs0 | # touch file0 file1 | # ../test | telldir: 0 | readdir: d_off = 2, d_name = "." | telldir: 2 | readdir: d_off = 2, d_name = ".." | telldir: 2 | readdir: d_off = 3, d_name = "file0" | telldir: 3 | readdir: d_off = 2147483647, d_name = "file1" | telldir: 2147483647 To fix this problem, pass filp->f_pos (which is loff_t) instead. | # ../test | telldir: 0 | readdir: d_off = 1, d_name = "." | telldir: 1 | readdir: d_off = 2, d_name = ".." | telldir: 2 | readdir: d_off = 3, d_name = "file0" : At the moment the "offset" for "." is unused because there is no preceding dirent, however it is better to pass filp->f_pos to follow grammatical usage. Signed-off-by: Hidetoshi Seto Signed-off-by: Chris Mason commit 3be209a8e22cedafc1b6945608b7bb8d9887ab61 Author: Shawn Bohrer Date: Mon Sep 12 09:28:04 2011 -0500 sched/rt: Migrate equal priority tasks to available CPUs Commit 43fa5460fe60dea5c610490a1d263415419c60f6 ("sched: Try not to migrate higher priority RT tasks") also introduced a change in behavior which keeps RT tasks on the same CPU if there is an equal priority RT task currently running even if there are empty CPUs available. This can cause unnecessary wakeup latencies, and can prevent the scheduler from balancing all RT tasks across available CPUs. This change causes an RT task to search for a new CPU if an equal priority RT task is already running on wakeup. Lower priority tasks will still have to wait on higher priority tasks, but the system should still balance out because there is always the possibility that if there are both a high and low priority RT tasks on a given CPU that the high priority task could wakeup while the low priority task is running and force it to search for a better runqueue. Signed-off-by: Shawn Bohrer Acked-by: Steven Rostedt Tested-by: Steven Rostedt Signed-off-by: Peter Zijlstra Cc: stable@kernel.org # 37+ Link: http://lkml.kernel.org/r/1315837684-18733-1-git-send-email-sbohrer@rgmadvisors.com Signed-off-by: Ingo Molnar commit 01a7143586f51f80e1b29ebf240c6e5390657450 Merge: 4be0ed42c56c f39aa30d7741 Author: Linus Torvalds Date: Sat Sep 17 16:54:41 2011 -0700 Merge branch 'fixes' of git://git.user.in-berlin.de/s5r6/linux1394 * 'fixes' of git://git.user.in-berlin.de/s5r6/linux1394: firewire: ohci: add no MSI quirk for O2Micro controller commit 4be0ed42c56c84d980a851f0bdd0fc20b45c3944 Merge: 279b1e0fd90e 40b054970afc Author: Linus Torvalds Date: Sat Sep 17 16:52:13 2011 -0700 Merge branch '3.1-rc-fixes' of git://linux-iscsi.org/target-pending * '3.1-rc-fixes' of git://linux-iscsi.org/target-pending: iscsi-target: Fix sendpage breakage with proper padding+DataDigest iovec offsets iscsi-target: Disable markers + remove dangerous local scope array usage target: Skip non hex characters for VPD=0x83 NAA IEEE Registered Extended tcm_fc: Work queue based approach instead of managing own thread and event based mechanism tcm_fc: Invalidation of DDP context for FCoE target in error conditions target: Fix race between multiple invocations of target_qf_do_work() commit f78b68261e80899f81a21dfdf91e2a1456ea8175 Author: Jurgen Kramer Date: Sun Sep 4 18:01:42 2011 +0200 Bluetooth: add support for 2011 mac mini Today I noticed that the usb bluetooth adapter (BCM2046B1) on my 2011 mac mini was not working. I've created a patch to get it going. Signed-off-by: Jurgen Kramer Signed-off-by: Gustavo F. Padovan commit a63b723d02531f7add0b2b8a0e6a77ee176f1626 Author: Pieter-Augustijn Van Malleghem Date: Wed Sep 7 02:28:10 2011 -0400 Bluetooth: Add MacBookAir4,1 support This patch against current git adds the hardware ID for the Apple MacBookAir4,1, released in July 2011. The device features a BCM2046 USB chip. The patch was inspired by the previous modifications adding support for the MacBookAir3,x. Signed-off-by: Pieter-Augustijn Van Malleghem Signed-off-by: Gustavo F. Padovan commit 8be964d2364e8fbe302850f60d9d514c3e134510 Author: Chen Ganir Date: Tue Aug 30 13:58:28 2011 +0300 Bluetooth: Fixed BT ST Channel reg order Reordered the BT ST channel registration, to make sure that the event channel is registered before all others. This prevents a situation where incoming events may cause kernel panic in the ST driver if the event channel is not yet registered to handle incoming events.In addition, the deregistration of the channels was also modified, to be in the reversed order of the registration, to allow the event channel to be the last one unregistered. Signed-off-by: Chen Ganir Signed-off-by: Gustavo F. Padovan commit 4dfa33868d9f8595717047eb058322e0999691cc Author: Russell King Date: Sat Sep 17 12:50:27 2011 +0100 ARM: nommu: fix warning with checksyscalls.sh CALL scripts/checksyscalls.sh :46:1: warning: "__IGNORE_migrate_pages" redefined In file included from :2: arch/arm/include/asm/unistd.h:482:1: warning: this is the location of the previous definition This is caused because we define __IGNORE_migrate_pages to be 1, but in the case of nommu, it's defined to be empty. Fix this by just defining the __IGNORE_ symbols to be empty. Signed-off-by: Russell King commit f630c1bdfbf8fe423325beaf60027cfc7fd7c610 Author: Will Deacon Date: Thu Sep 15 11:45:15 2011 +0100 ARM: 7091/1: errata: D-cache line maintenance operation by MVA may not succeed This patch implements a workaround for erratum 764369 affecting Cortex-A9 MPCore with two or more processors (all current revisions). Under certain timing circumstances, a data cache line maintenance operation by MVA targeting an Inner Shareable memory region may fail to proceed up to either the Point of Coherency or to the Point of Unification of the system. This workaround adds a DSB instruction before the relevant cache maintenance functions and sets a specific bit in the diagnostic control register of the SCU. Cc: Signed-off-by: Will Deacon Signed-off-by: Catalin Marinas Tested-by: Mark Rutland Signed-off-by: Russell King commit 2544bfc0eb2581e0eedbdfea1468b3866223d47e Author: Francois Romieu Date: Thu Sep 1 18:42:09 2011 +0200 r8169: do not enable the TBI for anything but the original 8169. The TBI bit in PHYStatus is reserved on anything but the oldest 8169. Nobody complained after I disabled it for the 8168 and the 810x (see 66ec5d4fb1ce6f0bd9df4bc4b758f0916d9f37ab). Signed-off-by: Francois Romieu Cc: Hayes Wang commit e03f33af79f0772156e1a1a1e36bdddf8012b2e4 Author: Francois Romieu Date: Thu Aug 25 18:47:24 2011 +0200 r8169: remove erroneous processing of always set bit. When set, RxFOVF (resp. RxBOVF) is always 1 (resp. 0). Signed-off-by: Francois Romieu Cc: Hayes commit 106633897e086e1b47126996aac1a427eb80eb1b Author: Hayes Wang Date: Tue Sep 6 16:55:14 2011 +0800 r8169: fix WOL setting for 8105 and 8111evl rtl8105, rtl8111E, and rtl8111evl need enable RxConfig bit 1 ~ 3 for supporting wake on lan. Signed-off-by: Hayes Wang commit bbb8af75d0a6a5138ff00fe0b1b95c4824effd55 Author: Hayes Wang Date: Tue Sep 6 16:55:17 2011 +0800 r8169: add MODULE_FIRMWARE for the firmware of 8111evl Add MODULE_FIRMWARE for the firmware of RTL8111E-VL Signed-off-by: Hayes Wang commit c2b0c1e7fb69b54e704cb2dae5a80cc78a8cb0b2 Author: Hayes Wang Date: Tue Sep 6 16:55:16 2011 +0800 r8169: fix the reset setting for 8111evl rtl8111evl should stop any TLP requirement before resetting by enabling register 0x37 bit 7. Signed-off-by: Hayes Wang commit 8e2ec639173f325977818c45011ee176ef2b11f6 Author: Yan, Zheng Date: Mon Sep 5 21:34:30 2011 +0000 ipv6: don't use inetpeer to store metrics for routes. Current IPv6 implementation uses inetpeer to store metrics for routes. The problem of inetpeer is that it doesn't take subnet prefix length in to consideration. If two routes have the same address but different prefix length, they share same inetpeer. So changing metrics of one route also affects the other. The fix is to allocate separate metrics storage for each route. Signed-off-by: Zheng Yan Signed-off-by: David S. Miller commit d4001e086babc77f26b599893d803a2b6e46d602 Author: Jesper Juhl Date: Thu Jun 23 22:07:13 2011 +0200 MIPS: Remove unneeded version.h includes from arch/mips/ It was pointed out by 'make versioncheck' that some includes of linux/version.h are not needed in arch/mips/. This patch removes them. Signed-off-by: Jesper Juhl To: LKML Cc: trivial@kernel.org Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/2540/ Signed-off-by: Ralf Baechle commit 16650107579aed81e0b0534a60400f9ba911fe9b Author: Kevin Cernekee Date: Sat Jun 18 11:28:48 2011 -0700 MIPS: Trivial style cleanups in mmap.c Fix checkpatch warnings. Rename arch_get_unmapped_area_foo() to arch_get_unmapped_area_common(). Make indentations and spacing more consistent. Add for likely/unlikely. Signed-off-by: Kevin Cernekee Cc: Jian Peng Cc: David Daney Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/2506/ Signed-off-by: Ralf Baechle commit fe0b030cf016ee9a4b0ae4adb0095c46d0e461cc Author: Hillf Danton Date: Thu Aug 4 22:46:41 2011 +0800 MIPS: i8259: Correct comment for i8259 The comment for the slave PIC is changed from 8259A-1 to 8259A-2. Signed-off-by: Hillf Danton To: LKML Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/2693/ Signed-off-by: Ralf Baechle commit 9fbcbd7e1fa9acde67f3516f7aceef2c0d968a7b Author: Hillf Danton Date: Thu Aug 4 22:38:31 2011 +0800 MIPS: VPE: Select correct tc If we could find tc on the tc list for @index, the found tc should be returned. Signed-off-by: Hillf Danton To: LKML Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/2692/ Signed-off-by: Ralf Baechle commit 40b054970afcf067896d62cd6f7e617c62665304 Author: Nicholas Bellinger Date: Fri Sep 16 16:55:47 2011 -0700 iscsi-target: Fix sendpage breakage with proper padding+DataDigest iovec offsets This patch fixes a bug in the iscsit_fe_sendpage_sg() transmit codepath that was originally introduced with the v3.1 iscsi-target merge that incorrectly uses hardcoded cmd->iov_data_count values to determine cmd->iov_data[] offsets for extra outgoing padding and DataDigest payload vectors. This code is obviously incorrect for the DataDigest enabled case with sendpage offload, and this fix ensures correct operation for padding + DataDigest, padding only, and DataDigest only cases. The bug was introduced during a pre-merge change in iscsit_fe_sendpage_sg() to natively use struct scatterlist instead of the legacy v3.0 struct se_mem logic. Cc: Andy Grover Cc: Christoph Hellwig Signed-off-by: Nicholas Bellinger commit 34b8686d278f00fb16234e74be44c253d6d6b676 Author: Daniel Mack Date: Fri Sep 16 07:57:43 2011 +0000 can: ti_hecc: include linux/io.h This fixes a build breakage for OMAP3 boards. Signed-off-by: Daniel Mack Cc: Wolfgang Grandegger Cc: netdev@vger.kernel.org Acked-by: Wolfgang Grandegger Signed-off-by: David S. Miller commit 9566042ef84fd2a282d00d3163074ec9b3f93a70 Author: Andi Kleen Date: Fri Sep 16 09:09:50 2011 +0000 IRDA: Fix global type conflicts in net/irda/irsysctl.c v2 The externs here didn't agree with the declarations in qos.c. Better would be probably to move this into a header, but since it's common practice to have naked externs with sysctls I left it for now. Cc: samuel@sortiz.org Signed-off-by: Andi Kleen Signed-off-by: David S. Miller commit aa1c366e4febc7f5c2b84958a2dd7cd70e28f9d0 Author: dpward Date: Mon Sep 5 16:47:24 2011 +0000 net: Handle different key sizes between address families in flow cache With the conversion of struct flowi to a union of AF-specific structs, some operations on the flow cache need to account for the exact size of the key. Signed-off-by: David Ward Signed-off-by: David S. Miller commit 728871bc05afc8ff310b17dba3e57a2472792b13 Author: David Ward Date: Mon Sep 5 16:47:23 2011 +0000 net: Align AF-specific flowi structs to long AF-specific flowi structs are now passed to flow_key_compare, which must also be aligned to a long. Signed-off-by: David Ward Signed-off-by: David S. Miller commit 19c1ea14c930db5e9c0cd7c3c6f4d01457dfcd69 Author: Yan, Zheng Date: Sun Sep 4 20:24:20 2011 +0000 ipv4: Fix fib_info->fib_metrics leak Commit 4670994d(net,rcu: convert call_rcu(fc_rport_free_rcu) to kfree_rcu()) introduced a memory leak. This patch reverts it. Signed-off-by: Zheng Yan Signed-off-by: David S. Miller commit 4fb66b8210c7d7147b164e19b1b44da916a75691 Author: Eric Dumazet Date: Fri Sep 2 02:19:23 2011 +0000 caif: fix a potential NULL dereference Commit bd30ce4bc0b7 (caif: Use RCU instead of spin-lock in caif_dev.c) added a potential NULL dereference in case alloc_percpu() fails. caif_device_alloc() can also use GFP_KERNEL instead of GFP_ATOMIC. Signed-off-by: Eric Dumazet CC: Sjur Brændeland Acked-by: Sjur Brændeland Signed-off-by: David S. Miller commit 08cefa9fa7e5b3ddaefb8b7bfa408d148429c08d Author: David S. Miller Date: Sun Sep 11 10:42:20 2011 -0700 sparc64: Future proof Niagara cpu detection. Recognize T4 and T5 chips. Treating them both as "T2 plus other stuff" should be extremely safe and make sure distributions will work when those chips actually ship to customers. Signed-off-by: David S. Miller commit d5ccd496601b8776a516d167a6485754575dc38f Author: Max Matveev Date: Mon Aug 29 21:02:24 2011 +0000 sctp: deal with multiple COOKIE_ECHO chunks Attempt to reduce the number of IP packets emitted in response to single SCTP packet (2e3216cd) introduced a complication - if a packet contains two COOKIE_ECHO chunks and nothing else then SCTP state machine corks the socket while processing first COOKIE_ECHO and then loses the association and forgets to uncork the socket. To deal with the issue add new SCTP command which can be used to set association explictly. Use this new command when processing second COOKIE_ECHO chunk to restore the context for SCTP state machine. Signed-off-by: Max Matveev Signed-off-by: David S. Miller commit 279b1e0fd90ef63c7acb34a5ca573f065a6fefb4 Merge: abbe0d3c26c5 8f9068609e8a Author: Linus Torvalds Date: Fri Sep 16 14:09:19 2011 -0700 Merge branch 'for-linus' of git://github.com/dtor/input * 'for-linus' of git://github.com/dtor/input: Input: wacom - fix touch parsing on newer Bamboos Input: bcm5974 - add MacBookAir4,1 trackpad support Input: wacom - add POINTER and DIRECT device properties Input: adp5588-keys - remove incorrect modalias Input: cm109 - fix checking return value of usb_control_msg Input: wacom - advertise BTN_TOOL_PEN and BTN_STYLUS for PenPartner Input: wacom - remove pressure for touch devices commit f39aa30d7741f40ad964341e9243dbbd7f8ff057 Author: Ming Lei Date: Wed Aug 31 10:45:46 2011 +0800 firewire: ohci: add no MSI quirk for O2Micro controller This fixes https://bugs.launchpad.net/ubuntu/+source/linux/+bug/801719 . An O2Micro PCI Express FireWire controller, "FireWire (IEEE 1394) [0c00]: O2 Micro, Inc. Device [1217:11f7] (rev 05)" which is a combination device together with an SDHCI controller and some sort of storage controller, misses SBP-2 status writes from an attached FireWire HDD. This problem goes away if MSI is disabled for this FireWire controller. The device reportedly does not require QUIRK_CYCLE_TIMER. Signed-off-by: Ming Lei Signed-off-by: Stefan Richter (amended changelog) Cc: commit 2ff017f5b4299e24a7f22d9a336dd162bf52bb54 Author: Nicholas Bellinger Date: Fri Sep 16 01:44:54 2011 -0700 iscsi-target: Disable markers + remove dangerous local scope array usage This patch makes iscsi-target explictly disable OFMarker=Yes and IFMarker=yes parameter key usage during iscsi login by setting IFMarkInt_Reject and OFMarkInt_Reject values in iscsi_enforce_integrity_rules() to effectively disable iscsi marker usage. With this patch, an initiator proposer asking to enable either marker parameter keys will be issued a 'No' response, and the target sets OFMarkInt + IFMarkInt parameter key response to 'Irrelevant'. With markers disabled during iscsi login, this patch removes the problematic on-stack local-scope array for marker intervals in iscsit_do_rx_data() + iscsit_do_tx_data(), and other related marker code in iscsi_target_util.c. This fixes a potentional stack smashing scenario with small range markers enabled and a large MRDSL as reported by DanC here: [bug report] target: stack can be smashed http://www.spinics.net/lists/target-devel/msg00453.html Reported-by: Dan Carpenter Signed-off-by: Nicholas Bellinger commit 784eb99ebad91db4c8c231c4b17f203147ab827b Author: Nicholas Bellinger Date: Fri Sep 16 01:31:28 2011 -0700 target: Skip non hex characters for VPD=0x83 NAA IEEE Registered Extended This patch adds target_parse_naa_6h_vendor_specific() to address a bug where the conversion of PRODUCT SERIAL NUMBER to use hex2bin() in target_emulate_evpd_83() was not doing proper isxdigit() checking. This conversion of the vpd_unit_serial configifs attribute is done while generating a VPD=0x83 NAA IEEE Registered Extended DESIGNATOR format's 100 bits of unique VENDOR SPECIFIC IDENTIFIER + VENDOR SPECIFIC IDENTIFIER EXTENSION area. This patch allows vpd_unit_serial (VPD=0x80) and the T10 Vendor ID DESIGNATOR format (VPD=0x83) to continue to use free-form variable length ASCII values, and now skips any non hex characters for fixed length NAA IEEE Registered Extended DESIGNATOR format (VPD=0x83) requring the binary conversion. This was originally reported by Martin after the v3.1-rc1 change to use hex2bin() in commit 11650b859681e03fdbf26277fcfc5f1f62186703 where the use of non hex characters in vpd_unit_serial generated different values than the original v3.0 internal hex -> binary code. This v3.1 change caused a problem with filesystems who write a NAA DESIGNATOR onto it's ondisk metadata, and this patch will (again) change existing values to ensure that non hex characters are not included in the fixed length NAA DESIGNATOR. Note this patch still expects vpd_unit_serial to be set via existing userspace methods of uuid generation, and does not do strict formatting via configfs input. The original bug report and thread can be found here: NAA breakage http://www.spinics.net/lists/target-devel/msg00477.html The v3.1-rc1 formatting of VPD=0x83 w/o this patch: VPD INQUIRY: Device Identification page Designation descriptor number 1, descriptor length: 20 designator_type: NAA, code_set: Binary associated with the addressed logical unit NAA 6, IEEE Company_id: 0x1405 Vendor Specific Identifier: 0xffde35ebf Vendor Specific Identifier Extension: 0x3092f498ffa820f9 [0x6001405ffde35ebf3092f498ffa820f9] Designation descriptor number 2, descriptor length: 56 designator_type: T10 vendor identification, code_set: ASCII associated with the addressed logical unit vendor id: LIO-ORG vendor specific: IBLOCK:ffde35ec-3092-4980-a820-917636ca54f1 The v3.1-final formatting of VPD=0x83 w/ this patch: VPD INQUIRY: Device Identification page Designation descriptor number 1, descriptor length: 20 designator_type: NAA, code_set: Binary associated with the addressed logical unit NAA 6, IEEE Company_id: 0x1405 Vendor Specific Identifier: 0xffde35ec3 Vendor Specific Identifier Extension: 0x924980a82091763 [0x6001405ffde35ec30924980a82091763] Designation descriptor number 2, descriptor length: 56 designator_type: T10 vendor identification, code_set: ASCII associated with the addressed logical unit vendor id: LIO-ORG vendor specific: IBLOCK:ffde35ec-3092-4980-a820-917636ca54f1 (v2: Fix parsing code to dereference + check for string terminator instead of null pointer to ensure a zeroed payload for vpd_unit_serial less than 100 bits of NAA DESIGNATOR VENDOR SPECIFIC area. Also, remove the unnecessary bitwise assignment) Reported-by: Martin Svec Signed-off-by: Nicholas Bellinger commit 2249b011432ca3dcce112f0f71e0f531b4bb9347 Author: Don Fry Date: Thu Sep 15 08:36:22 2011 -0700 iwlagn: workaround bug crashing some APs This patch reverts commit 9b7688328422b88a7a15dc0dc123ad9ab1a6e22d which was introduced in 2.6.38-rc1. It works around a problem where the iwlagn driver stimulates a bug crashing (requiring power cycle to recover) some APs under heavy traffic. CC: stable@kernel.org #2.6.39, #3.0.0 #3.1.0 Signed-off-by: Don Fry SIgned-off-by: Wey-Yi Guy Signed-off-by: John W. Linville commit 3965ac00204e0ccd89e1e73ead4d2098dc8f7bd1 Author: Rajkumar Manoharan Date: Thu Sep 15 15:12:29 2011 +0530 wireless: Fix rate mask for scan request The scan request received from cfg80211_connect do not have proper rate mast. So the probe request sent on each channel do not have proper the supported rates ie. Cc: stable@kernel.org Reviewed-by: Johannes Berg Signed-off-by: Rajkumar Manoharan Signed-off-by: John W. Linville commit daabead1c32f331edcfb255fd973411c667977e8 Author: Larry Finger Date: Wed Sep 14 16:50:23 2011 -0500 rtl2800usb: Fix incorrect storage of MAC address on big-endian platforms The eeprom data is stored in little-endian order in the rt2x00 library. As it was converted to cpu order in the read routines, the data need to be converted to LE on a big-endian platform. Signed-off-by: Larry Finger Cc: Stable Signed-off-by: John W. Linville commit d331eb51e4d4190b2178c30fcafea54a94a577e8 Author: Larry Finger Date: Wed Sep 14 16:50:22 2011 -0500 rt2800pci: Fix compiler error on PowerPC Using gcc 4.4.5 on a Powerbook G4 with a PPC cpu, a complicated if statement results in incorrect flow, whereas the equivalent switch statement works correctly. Signed-off-by: Larry Finger Cc: stable Signed-off-by: John W. Linville commit 7cabafcea793c003503a118da58da358b0692930 Author: Stanislaw Gruszka Date: Wed Sep 14 16:47:50 2011 +0200 ipw2x00: fix rtnl mutex deadlock This fix regression introduced by: commit: ecb4433550f0620f3d1471ae7099037ede30a91e Author: Stanislaw Gruszka Date: Fri Aug 12 14:00:59 2011 +0200 mac80211: fix suspend/resume races with unregister hw Above commit add rtnl_lock() into wiphy_register(), what cause deadlock when initializing ipw2x00 driver, which itself call wiphy_register() from register_netdev() internal callback with rtnl mutex taken. To fix move wiphy_register() outside register_netdev(). This solution have side effect of not creating /sys/class/net/wlanX/phy80211 link, but that's a minor issue we can live with. Bisected-by: Witold Baryluk Bisected-by: Michael Witten Tested-by: Witold Baryluk Tested-by: Michael Witten Signed-off-by: Stanislaw Gruszka Signed-off-by: John W. Linville commit aa3d7eef398dd4f29045e9889b817d5161afe03e Author: Rajkumar Manoharan Date: Wed Sep 14 14:28:17 2011 +0530 wireless: Reset beacon_found while updating regulatory During the association, the regulatory is updated by country IE that reaps the previously found beacons. The impact is that after a STA disconnects *or* when for any reason a regulatory domain change happens the beacon hint flag is not cleared therefore preventing future beacon hints to be learned. This is important as a regulatory domain change or a restore of regulatory settings would set back the passive scan and no-ibss flags on the channel. This is the right place to do this given that it covers any regulatory domain change. Cc: stable@kernel.org Reviewed-by: Luis R. Rodriguez Signed-off-by: Rajkumar Manoharan Acked-by: Luis R. Rodriguez Signed-off-by: John W. Linville commit fb82fd204b6e6c67661bbd37df032edafb2da56e Author: Anton Blanchard Date: Wed Sep 7 14:41:06 2011 +0000 ibmveth: Fix checksum offload failure handling Fix a number of issues in ibmveth_set_csum_offload: - set_attr6 and clr_attr6 may be used uninitialised - We store the result of the IPV4 checksum change in ret but overwrite it in a couple of places before checking it again later. Add ret4 to make it obvious what we are doing. - We weren't clearing the NETIF_F_IP_CSUM and NETIF_F_IPV6_CSUM flags if the enable of that hypervisor feature failed. Signed-off-by: Anton Blanchard Signed-off-by: David S. Miller commit 91aae1e5c407d4fc79f6983e6c6ba04756c004cb Author: Anton Blanchard Date: Wed Sep 7 14:41:05 2011 +0000 ibmveth: Checksum offload is always disabled Commit b9367bf3ee6d (net: ibmveth: convert to hw_features) reversed a check in ibmveth_set_csum_offload that results in checksum offload never being enabled. Signed-off-by: Anton Blanchard Cc: # 3.0+ Signed-off-by: David S. Miller commit b93da27f5234198433345e40b39ff59797bc6f6e Author: Anton Blanchard Date: Wed Sep 7 14:41:04 2011 +0000 ibmveth: Fix issue with DMA mapping failure descs[].fields.address is 32bit which truncates any dma mapping errors so dma_mapping_error() fails to catch it. Use a dma_addr_t to do the comparison. With this patch I was able to transfer many gigabytes of data with IOMMU fault injection set at 10% probability. Signed-off-by: Anton Blanchard Cc: # v2.6.37+ Signed-off-by: David S. Miller commit 33a48ab105a75d37021e422a0a3283241099b142 Author: Brian King Date: Wed Sep 7 14:41:03 2011 +0000 ibmveth: Fix DMA unmap error Commit 6e8ab30ec677 (ibmveth: Add scatter-gather support) introduced a DMA mapping API inconsistency resulting in dma_unmap_page getting called on memory mapped via dma_map_single. This was seen when CONFIG_DMA_API_DEBUG was enabled. Fix up this API usage inconsistency. Signed-off-by: Brian King Acked-by: Anton Blanchard Cc: # v2.6.37+ Signed-off-by: David S. Miller commit abbe0d3c26c545930492981cbd64be340ff41e05 Merge: c455ea4f122d 61cca2fab7ec Author: Linus Torvalds Date: Fri Sep 16 11:28:11 2011 -0700 Merge branch 'stable/bug.fixes' of git://oss.oracle.com/git/kwilk/xen * 'stable/bug.fixes' of git://oss.oracle.com/git/kwilk/xen: xen/i386: follow-up to "replace order-based range checking of M2P table by linear one" xen/irq: Alter the locking to use a mutex instead of a spinlock. xen/e820: if there is no dom0_mem=, don't tweak extra_pages. xen: disable PV spinlocks on HVM commit 935b639a049053d0ccbcf7422f2f9cd221642f58 Author: Sage Weil Date: Fri Sep 16 11:13:17 2011 -0700 libceph: fix linger request requeuing The r_req_lru_item list node moves between several lists, and that cycle is not directly related (and does not begin) with __register_request(). Initialize it in the request constructor, not __register_request(). This fixes later badness (below) when OSDs restart underneath an rbd mount. Crashes we've seen due to this include: [ 213.974288] kernel BUG at net/ceph/messenger.c:2193! and [ 144.035274] BUG: unable to handle kernel NULL pointer dereference at 0000000000000048 [ 144.035278] IP: [] con_work+0x1463/0x2ce0 [libceph] Signed-off-by: Sage Weil commit 1cad78932a0d139dceff78e68808e160a224d57a Author: Noah Watkins Date: Mon Sep 12 14:51:53 2011 -0700 libceph: fix parse options memory leak ceph_destroy_options does not free opt->mon_addr that is allocated in ceph_parse_options. Signed-off-by: Noah Watkins Signed-off-by: Sage Weil commit c0d5f9db1c7d1b8a9e2f217706e8ea233bac2754 Author: Jim Schutt Date: Fri Sep 16 08:27:31 2011 -0600 libceph: initialize ack_stamp to avoid unnecessary connection reset Commit 4cf9d544631c recorded when an outgoing ceph message was ACKed, in order to avoid unnecessary connection resets when an OSD is busy. However, ack_stamp is uninitialized, so there is a window between when the message is sent and when it is ACKed in which handle_timeout() interprets the unitialized value as an expired timeout, and resets the connection unnecessarily. Close the window by initializing ack_stamp. Signed-off-by: Jim Schutt Signed-off-by: Sage Weil commit 58fc73d10f3e92bfcd1e9a8391eb3e49b68df8e5 Author: Christoph Hellwig Date: Fri Aug 26 09:25:38 2011 -0700 tcm_fc: Work queue based approach instead of managing own thread and event based mechanism Problem: Changed from wake_up_interruptible -> wake_up_process and wait_event_interruptible-> schedule_timeout_interruptible broke the FCoE target. Earlier approach of wake_up_interruptible was also looking at 'queue_cnt' which is not necessary, because it increment of 'queue_cnt' with wake_up_inetrriptible / waker_up_process introduces race condition. Fix: Instead of fixing the code which used wake_up_process and remove 'queue_cnt', using work_queue based approach is cleaner and acheives same result. As well, work queue based approach has less programming overhead and OS manages threads which processes work queues. This patch is developed by Christoph Hellwig and reviwed+validated by Kiran Patil. Signed-off-by: Christoph Hellwig Signed-off-by: Kiran Patil Signed-off-by: Nicholas Bellinger commit 079587b4eb4d3b78a4d65d142f662aa9d7eedab4 Author: Kiran Patil Date: Fri Aug 26 09:25:25 2011 -0700 tcm_fc: Invalidation of DDP context for FCoE target in error conditions Problem: HW DDP context wasn;t invalidated in case of ABORTS, etc... This leads to the problem where memory pages which are used for DDP as user descriptor could get reused for some other purpose (such as to satisfy new memory allocation request either by kernel or user mode threads) and since HW DDP context was not invalidated, HW continue to write to those pages, hence causing memory corruption. Fix: Either on incoming ABORTS or due to exchange time out, allowed the target to cleanup HW DDP context if it was setup for respective ft_cmd. Added new function to perform this cleanup, furthur it can be enhanced for other cleanup activity. Additinal Notes: To avoid calling ddp_done from multiple places, composed the functionality in helper function "ft_invl_hw_context" and it is being called from multiple places. Cleaned up code in function "ft_recv_write_data" w.r.t DDP. Signed-off-by: Kiran Patil Signed-off-by: Nicholas Bellinger commit bcac364a24c894c4cf8cf219b7863c192cd34079 Author: Roland Dreier Date: Sat Aug 27 21:33:16 2011 -0700 target: Fix race between multiple invocations of target_qf_do_work() When work is scheduled with schedule_work(), the work can end up running on multiple CPUs at the same time -- this happens if the work is already running on one CPU and schedule_work() is called on another CPU. This leads to list corruption with target_qf_do_work(), which is roughly doing: spin_lock(...); list_for_each_entry_safe(...) { list_del(...); spin_unlock(...); // do stuff spin_lock(...); } With multiple CPUs running this code, one CPU can end up deleting the list entry that the other CPU is about to work on. Fix this by splicing the list entries onto a local list and then operating on that in the work function. This way, each invocation of target_qf_do_work() operates on its own local list and so multiple invocations don't corrupt each other's list. This also avoids dropping and reacquiring the lock for each list entry. Signed-off-by: Roland Dreier Signed-off-by: Nicholas Bellinger commit c455ea4f122d21c91fcf4c36c3f0c08535ba3ce8 Merge: a7f934d4f161 763437a9e773 Author: Linus Torvalds Date: Thu Sep 15 22:13:48 2011 -0700 Merge branch 'for-linus' of git://github.com/tiwai/sound * 'for-linus' of git://github.com/tiwai/sound: ALSA: pcm - fix race condition in wait_for_avail() ALSA: HDA: Cirrus - fix "Surround Speaker" volume control name ALSA: hda - Terminate the recursive connection search properly ASoC: Fix trivial build regression in Kirkwood I2S ASoC: Blackfin: bf5xx-ad193x: Fix codec device name ASoC: Fix reporting of partial jack updates ASoC: imx: Fix build warning of unused 'card' variable ASoC: Fix register cache sync register_writable WARN_ONs ASoC: snd_soc_codec_{readable,writable}_register change default to true ASoC: soc-dapm: Fix parameter comment for snd_soc_dapm_free MAINTAINERS: Add some missed Wolfson files ASoC: MPC5200: replace of_device with platform_device commit 52b9aca7ae8726d1fb41b97dd1d243d107fef11b Merge: 7756332f5b64 e2faeec2de9e Author: David S. Miller Date: Fri Sep 16 01:09:02 2011 -0400 Merge branch 'master' of ../netdev/ commit 4f6c7e159361b330d767b107226bcc6938abad16 Author: Axel Lin Date: Thu Sep 15 11:04:56 2011 +0800 ASoC: bf5xx-ad73311: Fix prototype for bf5xx_probe Fix below build warning: sound/soc/blackfin/bf5xx-ad73311.c: warning: initialization from incompatible pointer type Signed-off-by: Axel Lin Acked-by: Liam Girdwood Signed-off-by: Mark Brown commit 4cc122ac913dbd662403a4a173c41e0d59ab5bdd Author: Fabio Estevam Date: Thu Sep 15 17:21:15 2011 -0300 spi/imx: Fix spi-imx when the hardware SPI chipselects are used commit 22a85e4cd51 (spi/imx: add device tree probe support) broke spi-imx usage when the SPI chipselect is the one internal to the controller. On a mx31pdk board the following error is seen: Registering mxc_nand as whole device ------------[ cut here ]------------ WARNING: at drivers/gpio/gpiolib.c:101 gpio_ensure_requested+0x4c/0xf4() autorequest GPIO-0 Modules linked in: [] (unwind_backtrace+0x0/0xf4) from [] (warn_slowpath_common+0x4c/0x64) [] (warn_slowpath_common+0x4c/0x64) from [] (warn_slowpath_fmt+0x30/0x40) [] (warn_slowpath_fmt+0x30/0x40) from [] (gpio_ensure_requested+0x4c/0xf4) [] (gpio_ensure_requested+0x4c/0xf4) from [] (gpio_direction_output+0xa0/0x138) [] (gpio_direction_output+0xa0/0x138) from [] (spi_imx_setup+0x38/0x4c) [] (spi_imx_setup+0x38/0x4c) from [] (spi_setup+0x38/0x50) [] (spi_setup+0x38/0x50) from [] (spi_add_device+0x94/0x124) [] (spi_add_device+0x94/0x124) from [] (spi_new_device+0x74/0xac) [] (spi_new_device+0x74/0xac) from [] (spi_match_master_to_boardinfo+0x20/0x40) [] (spi_match_master_to_boardinfo+0x20/0x40) from [] (spi_register_master+0xb0/0x104) [] (spi_register_master+0xb0/0x104) from [] (spi_bitbang_start+0x104/0x17c) [] (spi_bitbang_start+0x104/0x17c) from [] (spi_imx_probe+0x2fc/0x404) [] (spi_imx_probe+0x2fc/0x404) from [] (platform_drv_probe+0x18/0x1c) [] (platform_drv_probe+0x18/0x1c) from [] (driver_probe_device+0x78/0x174) [] (driver_probe_device+0x78/0x174) from [] (__driver_attach+0x8c/0x90) [] (__driver_attach+0x8c/0x90) from [] (bus_for_each_dev+0x60/0x8c) [] (bus_for_each_dev+0x60/0x8c) from [] (bus_add_driver+0xa0/0x288) [] (bus_add_driver+0xa0/0x288) from [] (driver_register+0x78/0x18c) [] (driver_register+0x78/0x18c) from [] (do_one_initcall+0x34/0x178) [] (do_one_initcall+0x34/0x178) from [] (kernel_init+0x74/0x118) [] (kernel_init+0x74/0x118) from [] (kernel_thread_exit+0x0/0x8) ---[ end trace 759f924b30fd5a44 ]--- Fix this issue by using the original chip select logic and make spi-imx to work again. Tested on a mx31pdk that uses the hardware SPI chipselect pins and also on a mx27pdk that uses GPIO as SPI chipselect. Signed-off-by: Fabio Estevam Signed-off-by: Grant Likely commit 7756332f5b64c9c1535712b9679792e8bd4f0019 Author: Toshiharu Okada Date: Thu Sep 1 14:20:09 2011 +0000 pch_gbe: support ML7831 IOH Support new device OKI SEMICONDUCTOR ML7831 IOH(Input/Output Hub) ML7831 is for general purpose use. ML7831 is companion chip for Intel Atom E6xx series. ML7831 is completely compatible for Intel EG20T PCH. Signed-off-by: Toshiharu Okada Signed-off-by: David S. Miller commit 124d770a6459be21b84445f6ebf7dbfb60d43585 Author: Toshiharu Okada Date: Thu Sep 1 14:20:08 2011 +0000 pch_gbe: added the process of FIFO over run error This patch added the processing which should be done to hardware, when a FIFO over run error occurred. Signed-off-by: Toshiharu Okada Signed-off-by: David S. Miller commit 5229d87edcd80a3bceb0708ebd767faff2e589a9 Author: Toshiharu Okada Date: Thu Sep 1 14:20:07 2011 +0000 pch_gbe: fixed the issue which receives an unnecessary packet. This patch fixed the issue which receives an unnecessary packet before link When using PHY of GMII, an unnecessary packet is received, And it becomes impossible to receive a packet after link up. Signed-off-by: Toshiharu Okada Signed-off-by: David S. Miller commit 483f97f8b2b7f0ab09e14c06fe327d5e346fac28 Author: Ben Hutchings Date: Thu Sep 1 12:09:59 2011 +0000 sfc: Use 64-bit writes for TX push where possible This was originally done as part of commit 65f0b417dee94f779ce9b77102b7d73c93723b39 ("sfc: Use write-combining to reduce TX latency"), but that had to be reverted. Signed-off-by: Ben Hutchings Signed-off-by: David S. Miller commit 86c432ca5d6da90a26ac8d3e680f2268b502d9c5 Author: Ben Hutchings Date: Thu Sep 1 12:09:29 2011 +0000 Revert "sfc: Use write-combining to reduce TX latency" and follow-ups This reverts commits 65f0b417dee94f779ce9b77102b7d73c93723b39, d88d6b05fee3cc78e5b0273eb58c31201dcc6b76, fcfa060468a4edcf776f0c1211d826d5de1668c1, 747df2258b1b9a2e25929ef496262c339c380009 and 867955f5682f7157fdafe8670804b9f8ea077bc7. Depending on the processor model, write-combining may result in reordering that the NIC will not tolerate. This typically results in a DMA error event and reset by the driver, logged as: sfc 0000:0e:00.0: eth2: TX DMA Q reports TX_EV_PKT_ERR. sfc 0000:0e:00.0: eth2: resetting (ALL) Signed-off-by: Ben Hutchings Signed-off-by: David S. Miller commit 883cb075833e7e4356207569e0daefa2c2a3f700 Merge: 8d6616374079 8ea9ac0a47a1 Author: David S. Miller Date: Thu Sep 15 17:13:04 2011 -0400 Merge branch 'for-davem' of git://git.infradead.org/users/linville/wireless commit a7f934d4f16144cb9521b62e9b8c9ac0118097da Author: Linus Torvalds Date: Thu Sep 15 13:28:33 2011 -0700 asm alternatives: remove incorrect alignment notes On x86-64, they were just wasteful: with the explicitly added (now unnecessary) padding, the size of the alternatives structure was 16 bytes, and an alignment of 8 bytes didn't hurt much. However, it was still silly, since the natural size and alignment for the structure is actually just 12 bytes, 4-byte aligned since commit 59e97e4d6fbc ("x86: Make alternative instruction pointers relative"). So removing the padding, and removing the extra alignment is just a good idea. On x86-32, the alignment of 4 bytes was correct, but was incorrectly hardcoded as 8 bytes in . That header file had used to be an x86-64 only header file, but various unification efforts have made it be used for x86-32 too (ie the unification of rwlock and rwsem). That in turn caused x86-32 boot failures, because the extra alignment would result in random zero-filled words in the altinstructions section, causing oopses early at boot when doing alternative instruction replacement. So just remove all the alignment noise entirely. It's wrong, and it's unnecessary. The section itself is already properly aligned by the linker scripts, and all additions to the section had better be of the proper 12-byte format, keeping it aligned. So if the align directive were to ever make a difference, that would be an indication of a serious bug to begin with. Reported-by: Werner Landgraf Acked-by: Andrew Lutomirski Signed-off-by: Linus Torvalds commit 8d661637407963d1990e53c36d53ace123219da3 Author: Yaniv Rosner Date: Wed Sep 7 00:48:11 2011 +0000 bnx2x: Fix ethtool advertisement Enable changing advertisement settings via ethtool. Signed-off-by: Yaniv Rosner Signed-off-by: Eilon Greenstein Reviewed-by: Ben Hutchings Signed-off-by: David S. Miller commit ab505dec96340946079d1288f49041bea9f259ff Author: Yaniv Rosner Date: Wed Sep 7 00:48:06 2011 +0000 bnx2x: Fix 578xx link LED Fix 1G link LED for the BCM578xx-SFI/KR. Signed-off-by: Yaniv Rosner Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit 4d7e25d6cc4312b1f949123fea7026fd56441513 Author: Yaniv Rosner Date: Wed Sep 7 00:48:03 2011 +0000 bnx2x: Fix XMAC loopback test Change XMAC loopback type from CORE LOCAL to LINE LOCAL for the BCM578xx due to intermittent problem with the loopback with this configuration. Signed-off-by: Yaniv Rosner Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit 0582242049c67d59c3a95cd1cba8995fa955c858 Author: Yaniv Rosner Date: Wed Sep 7 00:47:58 2011 +0000 bnx2x: Remove fiber remote fault detection Remove remote fault detection as a tactic retreat due to link issues involved with it. Once issue is resolved, this feature will be restored again. Signed-off-by: Yaniv Rosner Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit 6b1f3900fc0909fbf3bd672242378015f76b3df8 Author: Yaniv Rosner Date: Wed Sep 7 00:47:54 2011 +0000 bnx2x: Enable FEC for 57810-KR Enable FEC(Forward Error Correction) for 57810-KR to reduce link errors. Signed-off-by: Yaniv Rosner Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit c482e6c064613b3fd40758ef6c33318462b83789 Author: Yaniv Rosner Date: Wed Sep 7 00:47:49 2011 +0000 bnx2x: Fix ETS bandwidth ETS bandwidth of 0% is not allowed by driver, so provide alternative HW configuration for this case. Signed-off-by: Yaniv Rosner Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit 8ea9ac0a47a179bf404b4f451e5e82cffe11940d Merge: 31dda0ae933b 282cdb325aea Author: John W. Linville Date: Thu Sep 15 15:37:02 2011 -0400 Merge branch 'master' of git://git.infradead.org/users/linville/wireless into for-davem commit 17d8428e4c911f7877d8470bca7a09a4b2aa2d57 Merge: fa758702c298 fb2088ccc139 Author: Linus Torvalds Date: Thu Sep 15 12:36:01 2011 -0700 Merge branch 'bugfixes' of git://git.linux-nfs.org/projects/trondmy/linux-nfs * 'bugfixes' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: nfs: Do not allow multiple mounts on same mountpoint when using -o noac NFS: Fix a typo in nfs_flush_multi NFSv4: renewd needs to be able to handle the NFS4ERR_CB_PATH_DOWN error NFSv4: The NFSv4.0 client must send RENEW calls if it holds a delegation NFSv4: nfs4_proc_renew should be declared static NFSv4: nfs4_proc_async_renew should use a GFP_NOFS allocation commit fa758702c298c98674ec641e9252e507ddaa29be Merge: f1fcd9f0e96d cd5bd3df1a6e Author: Linus Torvalds Date: Thu Sep 15 12:34:59 2011 -0700 Merge branch 'hwmon-for-linus' of git://github.com/groeck/linux * 'hwmon-for-linus' of git://github.com/groeck/linux: hwmon: (coretemp) Initialize tmin hwmon: (pmbus) Fix low limit temperature alarms commit 31dda0ae933bb9fea9cfe000b698c41af0417cac Author: nhorman Date: Wed Sep 14 03:05:02 2011 +0000 net: don't clear IFF_XMIT_DST_RELEASE in ether_setup d88733150 introduced the IFF_SKB_TX_SHARING flag, which I unilaterally set in ether_setup. In doing this I didn't realize that other flags (such as IFF_XMIT_DST_RELEASE) might be set prior to calling the ether_setup routine. This patch changes ether_setup to or in SKB_TX_SHARING so as not to inadvertently clear other existing flags. Thanks to Pekka Riikonen for pointing out my error Signed-off-by: Neil Horman Reported-by: Pekka Riikonen CC: "David S. Miller" Acked-by: Eric Dumazet Signed-off-by: David S. Miller commit 48c830120f2a20b44220aa26feda9ed15f49eaab Author: Michael S. Tsirkin Date: Wed Aug 31 08:03:29 2011 +0000 net: copy userspace buffers on device forwarding dev_forward_skb loops an skb back into host networking stack which might hang on the memory indefinitely. In particular, this can happen in macvtap in bridged mode. Copy the userspace fragments to avoid blocking the sender in that case. As this patch makes skb_copy_ubufs extern now, I also added some documentation and made it clear the SKBTX_DEV_ZEROCOPY flag automatically instead of doing it in all callers. This can be made into a separate patch if people feel it's worth it. Signed-off-by: Michael S. Tsirkin Signed-off-by: David S. Miller commit 0542b69e2c57fc9668ce6a03155bea6e1f557901 Author: dpward Date: Wed Aug 31 06:05:27 2011 +0000 net: Make flow cache namespace-aware flow_cache_lookup will return a cached object (or null pointer) that the resolver (i.e. xfrm_policy_lookup) previously found for another namespace using the same key/family/dir. Instead, make the namespace part of what identifies entries in the cache. As before, flow_entry_valid will return 0 for entries where the namespace has been deleted, and they will be removed from the cache the next time flow_cache_gc_task is run. Reported-by: Andrew Dickinson Signed-off-by: David Ward Signed-off-by: David S. Miller commit 02009afc223aae43b8e18918fc816e4520791537 Author: Kavan Smith Date: Wed Aug 31 05:12:05 2011 +0000 ipheth: iPhone 4 Verizon CDMA USB Product ID add Add USB product ID for iPhone 4 CDMA Verizon Tested on at least 2 devices Signed-off-by: Kavan Smith Signed-off-by: David S. Miller commit d9e64f83ebb8f563810b10536b23516d3bd30e80 Author: rajan.aggarwal85@gmail.com Date: Tue Aug 30 23:57:38 2011 +0000 net/can/af_can.c: Change del_timer to del_timer_sync This is important for SMP platform to check if timer function is executing on other CPU with deleting the timer. Signed-off-by: Rajan Aggarwal Acked-by: Oliver Hartkopp Signed-off-by: David S. Miller commit 6b59e3191daade2b975eeec1c71c591eb5c86b7b Author: Marcos Paulo de Souza Date: Tue Aug 30 05:33:57 2011 +0000 Documentation: networking: dmfe.txt: Remove the maintainer of orphan networking driver The dmfe module is a orphan driver, and with this was removed the maintainer of the documentation. Signed-off-by: Marcos Paulo de Souza Signed-off-by: David S. Miller commit 946cedccbd7387488d2cee5da92cdfeb28d2e670 Author: Eric Dumazet Date: Tue Aug 30 03:21:44 2011 +0000 tcp: Change possible SYN flooding messages "Possible SYN flooding on port xxxx " messages can fill logs on servers. Change logic to log the message only once per listener, and add two new SNMP counters to track : TCPReqQFullDoCookies : number of times a SYNCOOKIE was replied to client TCPReqQFullDrop : number of times a SYN request was dropped because syncookies were not enabled. Based on a prior patch from Tom Herbert, and suggestions from David. Signed-off-by: Eric Dumazet CC: Tom Herbert Signed-off-by: David S. Miller commit 27e95a8c670e0c587990ec5b9a87a7ea17873d28 Author: Igor Maravić Date: Tue Aug 30 03:12:55 2011 +0000 pkt_sched: cls_rsvp.h was outdated File cls_rsvp.h in /net/sched was outdated. I'm sending you patch for this file. [ tb[] array should be indexed by X not X-1 -DaveM ] Signed-off-by: Igor Maravić Signed-off-by: David S. Miller commit 150966ad56291776a1f3fed86000a027e0794922 Author: Ariel Elior Date: Tue Aug 30 00:08:46 2011 +0000 bnx2x: Fix for a host coalescing bug which impared latency. Seperated Rx and Tx coalescing to different state machines. Signed-off-by: Ariel Elior Signed-off-by: Eilon Greenstein Signed-off-by: Dmitry Kravkov Signed-off-by: David S. Miller commit a5c53dbcde9a156e8303acc6ecb2296bf609fe38 Author: Dmitry Kravkov Date: Tue Aug 30 00:08:45 2011 +0000 bnx2x: don't access removed registers on 57712 and above Signed-off-by: Dmitry Kravkov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit 0735f2fc8c49f1fbbbb245d038582922984ed3d5 Author: Dmitry Kravkov Date: Tue Aug 30 00:08:44 2011 +0000 bnx2x: init fw_seq after undi_unload is done Signed-off-by: Dmitry Kravkov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit 7a06a122322c89544774e789a11aa671423e9362 Author: Dmitry Kravkov Date: Tue Aug 30 00:08:43 2011 +0000 bnx2x: don't reset device while reading its configuration. Signed-off-by: Dmitry Kravkov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit 3395a033a7c2f1a089fae7e89bf108764b59529c Author: Dmitry Kravkov Date: Tue Aug 30 00:08:42 2011 +0000 bnx2x: fix MF for 4-port devices Number of VNs for 4-port devices is 2 instead of 4 Signed-off-by: Dmitry Kravkov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit c2188952fc7d2ca54bb8aca1bc502618a7488baf Author: Vladislav Zolotarov Date: Tue Aug 30 00:08:41 2011 +0000 bnx2x: fix rx ring size report Store the size in bp, read from bp when queried. Signed-off-by: Dmitry Kravkov Signed-off-by: Vladislav Zolotarov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit 5f837363457a2280530373267f86092625d15a4d Author: Dmitry Kravkov Date: Tue Aug 30 00:08:40 2011 +0000 bnx2x: decrease print level to debug It may happen every link toggle. Signed-off-by: Dmitry Kravkov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit dfacf1387ceb6d7d6df614b18016fd1f347a1996 Author: Dmitry Kravkov Date: Tue Aug 30 00:08:39 2011 +0000 bnx2x: fix BRB thresholds for dropless_fc mode Fix the thresholds according to 5778x HW and increase rx_ring size to suit new thresholds in dropless_fc mode. Signed-off-by: Dmitry Kravkov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit f1fcd9f0e96d12498afb5543107f560f196cfcf3 Author: Christoph Hellwig Date: Thu Sep 15 10:48:40 2011 -0400 hfsplus: fix filesystem size checks generic_check_addressable can't deal with hfsplus's larger than page size allocation blocks, so simply opencode the checks that we actually need in hfsplus_fill_super. Signed-off-by: Christoph Hellwig Reported-by: Pavel Ivanov Tested-by: Pavel Ivanov Signed-off-by: Linus Torvalds commit f588c960fcaa6fa8bf82930bb819c9aca4eb9347 Author: Seth Forshee Date: Thu Sep 15 10:48:27 2011 -0400 hfsplus: Fix kfree of wrong pointers in hfsplus_fill_super() error path Commit 6596528e391a ("hfsplus: ensure bio requests are not smaller than the hardware sectors") changed the pointers used for volume header allocations but failed to free the correct pointers in the error path path of hfsplus_fill_super() and hfsplus_read_wrapper. The second hunk came from a separate patch by Pavel Ivanov. Reported-by: Pavel Ivanov Signed-off-by: Seth Forshee Signed-off-by: Christoph Hellwig Cc: Signed-off-by: Linus Torvalds commit c488637cf0e028ed7973614ee708f94b4dc9c16e Merge: 72cc20561187 d03c35939d2a Author: Arnd Bergmann Date: Thu Sep 15 17:28:07 2011 +0200 Merge branch 'samsung-fixes-2' of git://github.com/kgene/linux-samsung into HEAD commit 2d20a26a92f72e3bb658fe8ce99c3663756e9e7a Author: Oliver Neukum Date: Tue Aug 30 15:52:18 2011 +0200 Bluetooth: Fix timeout on scanning for the second time The checks for HCI_INQUIRY and HCI_MGMT were in the wrong order, so that second scans always failed. Signed-off-by: Oliver Neukum Signed-off-by: Gustavo F. Padovan commit 61cca2fab7ecba18f9b9680cd736ef5fa82ad3b1 Author: Jan Beulich Date: Thu Sep 15 08:52:40 2011 +0100 xen/i386: follow-up to "replace order-based range checking of M2P table by linear one" The numbers obtained from the hypervisor really can't ever lead to an overflow here, only the original calculation going through the order of the range could have. This avoids the (as Jeremy points outs) somewhat ugly NULL-based calculation here. Signed-off-by: Jan Beulich Signed-off-by: Konrad Rzeszutek Wilk commit 773659483685d652970583384a0294948e57f8b3 Author: Konrad Rzeszutek Wilk Date: Wed Sep 14 05:10:00 2011 -0400 xen/irq: Alter the locking to use a mutex instead of a spinlock. When we allocate/change the IRQ informations, we do not need to use spinlocks. We can use a mutex (which is what the generic IRQ code does for allocations/changes). Fixes a slew of: BUG: sleeping function called from invalid context at /linux/kernel/mutex.c:271 in_atomic(): 1, irqs_disabled(): 0, pid: 3216, name: xenstored 2 locks held by xenstored/3216: #0: (&u->bind_mutex){......}, at: [] evtchn_ioctl+0x30/0x3a0 [xen_evtchn] #1: (irq_mapping_update_lock){......}, at: [] bind_evtchn_to_irq+0x24/0x90 Pid: 3216, comm: xenstored Not tainted 3.1.0-rc6-00021-g437a3d1 #2 Call Trace: [] __might_sleep+0x100/0x130 [] mutex_lock_nested+0x2f/0x50 [] __irq_alloc_descs+0x49/0x200 [] ? evtchn_ioctl+0x30/0x3a0 [xen_evtchn] [] xen_allocate_irq_dynamic+0x34/0x70 [] bind_evtchn_to_irq+0x5d/0x90 [] ? evtchn_bind_to_user+0x60/0x60 [xen_evtchn] [] bind_evtchn_to_irqhandler+0x32/0x80 [] evtchn_bind_to_user+0x49/0x60 [xen_evtchn] [] evtchn_ioctl+0x144/0x3a0 [xen_evtchn] [] ? vfsmount_lock_local_unlock+0x50/0x80 [] do_vfs_ioctl+0x9a/0x5e0 [] ? mntput+0x1f/0x30 [] ? fput+0x199/0x240 [] sys_ioctl+0xa1/0xb0 [] system_call_fastpath+0x16/0x1b Reported-by: Jim Burns Acked-by: Ian Campbell Signed-off-by: Konrad Rzeszutek Wilk commit 763437a9e7737535b2fc72175ad4974048769be6 Author: Arjan van de Ven Date: Thu Sep 15 08:49:25 2011 +0200 ALSA: pcm - fix race condition in wait_for_avail() wait_for_avail() in pcm_lib.c has a race in it (observed in practice by an Intel validation group). The function is supposed to return once space in the buffer has become available, or if some timeout happens. The entity that creates space (irq handler of sound driver and some such) will do a wake up on a waitqueue that this function registers for. However there are two races in the existing code 1) If space became available between the caller noticing there was no space and this function actually sleeping, the wakeup is missed and the timeout condition will happen instead 2) If a wakeup happened but not sufficient space became available, the code will loop again and wait for more space. However, if the second wake comes in prior to hitting the schedule_timeout_interruptible(), it will be missed, and potentially you'll wait out until the timeout happens. The fix consists of using more careful setting of the current state (so that if a wakeup happens in the main loop window, the schedule_timeout() falls through) and by checking for available space prior to going into the schedule_timeout() loop, but after being on the waitqueue and having the state set to interruptible. [tiwai: the following changes have been added to Arjan's original patch: - merged akpm's fix for waitqueue adding order into a single patch - reduction of duplicated code of avail check ] Signed-off-by: Arjan van de Ven Signed-off-by: Andrew Morton Cc: Signed-off-by: Takashi Iwai commit d03c35939d2a447093e60133156217d6512aa9e3 Author: Thomas Abraham Date: Thu Sep 15 14:34:03 2011 +0900 ARM: EXYNOS4: fix incorrect pad configuration for keypad row lines The keypad controller requires a external pull-up for all the keypad row lines. Fix the incorrect pad configuration for keypad controller row lines by enabling the pad pull-up for the all row lines of the keypad controller. Signed-off-by: Thomas Abraham Signed-off-by: Kukjin Kim commit 3a0ec25954a2667738f39f34096df3f4cb102983 Author: Kukjin Kim Date: Fri Aug 19 21:12:19 2011 +0900 ARM: SAMSUNG: fix to prevent declaring duplicated The plat/clock.h revised to prevent declaring duplicated. Signed-off-by: Kukjin Kim commit caf27307fa322f079338480c7a3387e79d7d3712 Author: Marek Szyprowski Date: Mon Sep 5 20:10:06 2011 +0900 ARM: SAMSUNG: fix watchdog reset issue with clk_get() clkdev framework uses global mutex to protect clock tree, so it is not possible to call clk_get() in interrupt context. This patch fixes this issue and makes system reset by watchdog call working again. Signed-off-by: Marek Szyprowski Signed-off-by: Kyungmin Park Signed-off-by: Kukjin Kim commit 0685d5ec3e8a2462c29920c1f8187a6c640b6fc9 Author: Banajit Goswami Date: Thu Aug 18 21:34:56 2011 +0900 ARM: S3C64XX: Remove un-used code backlight code on SMDK6410 According to commit 96d78686d4("ARM: S3C64XX: Add PWM backlight support on SMDK6410") and commit f00207b255("ARM: SAMSUNG: Create a common infrastructure for PWM backlight support"), this should not be used anymore. And this patch fixes follwing warning: arch/arm/mach-s3c64xx/mach-smdk6410.c:296: warning: 'smdk6410_backlight_device' defined but not used Signed-off-by: Banajit Goswami [kgene.kim@samsung.com: modified commit message] Signed-off-by: Kukjin Kim commit aa421c13a9e318a75b42d9dd2eb85cc73d8aab6b Author: Changhwan Youn Date: Fri Sep 2 14:10:52 2011 +0900 ARM: EXYNOS4: restart clocksource while system resumes System resume can't be completed because mct-frc isn't restarted after system suspends. This patch restarts mct-frc during system resume. Reported-by: Jongpill Lee Signed-off-by: Changhwan Youn Signed-off-by: Kukjin Kim commit 4bd0fe1c78623062263cf5ae875fd484c5b8256d Author: Kukjin Kim Date: Wed Aug 24 20:05:21 2011 +0900 ARM: EXYNOS4: Fix routing timer interrupt to offline CPU The commit 5dfc54e087c15f823ee9b6541d2f0f314e69cbed ("ARM: GIC: avoid routing interrupts to offline CPUs") prevents routing interrupts to offline CPUs. But in case of timer on EXYNOS4, the irq_set_affinity() method is called in percpu_timer_setup() before CPU1 becomes online. So this patch fixes routing timer interrupt to offline CPU. Reported-by: Changhwan Youn Signed-off-by: Kukjin Kim commit 4d487d7ed46b9172664073dde324f55f9ab50f18 Author: Kukjin Kim Date: Wed Aug 24 16:07:39 2011 +0900 ARM: EXYNOS4: Fix return type of local_timer_setup() According to commmit af90f10d ("ARM: 6759/1: smp: Select local timers vs broadcast timer support"), the return type of local_timer_setup() should be int instead of void. Reported-by: Changhwan Youn Signed-off-by: Kukjin Kim commit 6861a197e2ed6dd05c0316ee2006730fbb6e7f9a Author: Jonghwan Choi Date: Tue Aug 23 16:27:17 2011 +0900 ARM: EXYNOS4: Fix wrong pll type for vpll The PLL4650C is used for VPLL on EXYNOS4 so should be fixed. Signed-off-by: Jonghwan Choi [kgene.kim@samsung.com: added message] Signed-off-by: Kukjin Kim commit cc39c6a9bbdebfcf1a7dee64d83bf302bc38d941 Author: Shaohua Li Date: Thu Sep 15 08:45:19 2011 +0800 mm: account skipped entries to avoid looping in find_get_pages The found entries by find_get_pages() could be all swap entries. In this case we skip the entries, but make sure the skipped entries are accounted, so we don't keep looping. Using nr_found > nr_skip to simplify code as suggested by Eric. Reported-and-tested-by: Eric Dumazet Signed-off-by: Shaohua Li Signed-off-by: Linus Torvalds commit 4f5b04800a224aadb6cffcbbc3d3fa26e2367c7f Author: Russell King Date: Wed Sep 14 16:22:29 2011 -0700 drivers/gpio/gpio-generic.c: fix build errors Building a kernel with hotplug disabled results in a link failure: `bgpio_remove' referenced in section `___ksymtab_gpl+bgpio_remove' of drivers/built-in.o: defined in discarded section `.devexit.text' of drivers/built-in.o This is because of bgpio_remove() is exported. It is illegal to export symbols which are discarded either at link time or as part of an init/exit section. Fix this by dropping the __devexit attributation from bgpio_remove(). Also drop the __devinit attributation from bgpio_init(). Signed-off-by: Russell King Cc: Grant Likely Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fa2563e41c3d6d6e8af437643981ed28ae0cb56d Author: Thomas Tuttle Date: Wed Sep 14 16:22:28 2011 -0700 workqueue: lock cwq access in drain_workqueue Take cwq->gcwq->lock to avoid racing between drain_workqueue checking to make sure the workqueues are empty and cwq_dec_nr_in_flight decrementing and then incrementing nr_active when it activates a delayed work. We discovered this when a corner case in one of our drivers resulted in us trying to destroy a workqueue in which the remaining work would always requeue itself again in the same workqueue. We would hit this race condition and trip the BUG_ON on workqueue.c:3080. Signed-off-by: Thomas Tuttle Acked-by: Tejun Heo Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit df4e33ad249b7480d6ba5dd11fc1dac5cfaffce1 Author: Benny Halevy Date: Wed Sep 14 16:22:26 2011 -0700 MAINTAINERS: update e-mail address of Benny Halevy Acked-by: Boaz Harrosh Signed-off-by: Benny Halevy Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e71f5cc402ecb42b407ae52add7b173bf1c53daa Author: Naga Chumbalkar Date: Wed Sep 14 16:22:23 2011 -0700 drivers/cpufreq/pcc-cpufreq.c: avoid NULL pointer dereference per_cpu(processors, n) can be NULL, resulting in: Loading CPUFreq modules[ 437.661360] BUG: unable to handle kernel NULL pointer dereference at (null) IP: [] pcc_cpufreq_cpu_init+0x74/0x220 [pcc_cpufreq] It's better to avoid the oops by failing the driver, and allowing the system to boot. Signed-off-by: Naga Chumbalkar Cc: Dave Jones Cc: Len Brown Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 88cee8fd77af28d414b983798dd30c8950c71e31 Author: Donggeun Kim Date: Wed Sep 14 16:22:19 2011 -0700 drivers/rtc/rtc-s3c.c: fix no occurrence of alarm interrupt The driver does not generate an alarm interrupt even though a time for an alarm is set. This results from disabling rtc_clk after setting the alarm time. To generate an alarm interrupt the driver should maintain its enabled state for rtc_clk the until alarm interrupt occurs. This patch permits generation of an alarm interrupt. [akpm@linux-foundation.org: make s3c_rtc_alarm_clk_lock local to s3c_rtc_alarm_clk_enable()] Signed-off-by: Donggeun Kim Signed-off-by: MyungJoo Ham Signed-off-by: Kyungmin Park Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7a5caabd090b8f7d782c40fc1c048d798f2b6fd7 Author: Johan Hovold Date: Wed Sep 14 16:22:16 2011 -0700 drivers/leds/ledtrig-timer.c: fix broken sysfs delay handling Fix regression introduced by commit 5ada28bf7675 ("led-class: always implement blinking") which broke sysfs delay handling by not storing the updated value. Consequently it was only possible to set one of the delays through the sysfs interface as the other delay was automatically restored to it's default value. Reading the parameters always gave the defaults. Signed-off-by: Johan Hovold Acked-by: Florian Fainelli Acked-by: Richard Purdie Cc: [2.6.37+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1ebe9dad947d3158676f5ae55fc8b4f05b85c527 Author: Jesper Juhl Date: Wed Sep 14 16:22:12 2011 -0700 drivers/misc/pti.c: give 'comm' function scope in pti_control_frame_built_and_sent() In drivers/misc/pti.c::pti_control_frame_built_and_sent() we assign 'comm' to 'thread_name_p' if (!thread_name). The problem is that 'comm' then goes out of scope and later we use 'thread_name_p' which now refers to an out-of-scope variable. To fix that, simply move 'comm' up to have function scope. Signed-off-by: Jesper Juhl Cc: Greg Kroah-Hartman Cc: J Freyensee Cc: Jeremy Rocher Cc: Sergei Trofimovich Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 83ede96e98f5a7eb3ed07c78cb1dd166581eb864 Author: WANG Cong Date: Wed Sep 14 16:22:06 2011 -0700 cris: fix a build error in drivers/tty/serial/crisv10.c Fix these errors: drivers/tty/serial/crisv10.c:4453: error: 'if_ser0' undeclared (first use in this function): 2 errors in 2 logs drivers/tty/serial/crisv10.c:4453: error: (Each undeclared identifier is reported only once: 2 errors in 2 logs drivers/tty/serial/crisv10.c:4453: error: for each function it appears in.): 2 errors in 2 logs "if_ser0" is a typo, it should be "if_serial_0". Signed-off-by: WANG Cong Cc: Mikael Starvik Cc: Jesper Nilsson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 461ae488ecb125b140d7ea29ceeedbcce9327003 Author: David Vrabel Date: Wed Sep 14 16:22:02 2011 -0700 mm: sync vmalloc address space page tables in alloc_vm_area() Xen backend drivers (e.g., blkback and netback) would sometimes fail to map grant pages into the vmalloc address space allocated with alloc_vm_area(). The GNTTABOP_map_grant_ref would fail because Xen could not find the page (in the L2 table) containing the PTEs it needed to update. (XEN) mm.c:3846:d0 Could not find L1 PTE for address fbb42000 netback and blkback were making the hypercall from a kernel thread where task->active_mm != &init_mm and alloc_vm_area() was only updating the page tables for init_mm. The usual method of deferring the update to the page tables of other processes (i.e., after taking a fault) doesn't work as a fault cannot occur during the hypercall. This would work on some systems depending on what else was using vmalloc. Fix this by reverting ef691947d8a3 ("vmalloc: remove vmalloc_sync_all() from alloc_vm_area()") and add a comment to explain why it's needed. Signed-off-by: David Vrabel Cc: Jeremy Fitzhardinge Cc: Konrad Rzeszutek Wilk Cc: Ian Campbell Cc: Keir Fraser Cc: [3.0.x] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 185efc0f9a1f2d6ad6d4782c5d9e529f3290567f Author: Johannes Weiner Date: Wed Sep 14 16:21:58 2011 -0700 memcg: Revert "memcg: add memory.vmscan_stat" Revert the post-3.0 commit 82f9d486e59f5 ("memcg: add memory.vmscan_stat"). The implementation of per-memcg reclaim statistics violates how memcg hierarchies usually behave: hierarchically. The reclaim statistics are accounted to child memcgs and the parent hitting the limit, but not to hierarchy levels in between. Usually, hierarchical statistics are perfectly recursive, with each level representing the sum of itself and all its children. Since this exports statistics to userspace, this may lead to confusion and problems with changing things after the release, so revert it now, we can try again later. Signed-off-by: Johannes Weiner Acked-by: KAMEZAWA Hiroyuki Cc: Daisuke Nishimura Cc: Michal Hocko Cc: Ying Han Cc: Balbir Singh Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a4d3e9e76337059406fcf3ead288c0df22a790e9 Author: Johannes Weiner Date: Wed Sep 14 16:21:52 2011 -0700 mm: vmscan: fix force-scanning small targets without swap Without swap, anonymous pages are not scanned. As such, they should not count when considering force-scanning a small target if there is no swap. Otherwise, targets are not force-scanned even when their effective scan number is zero and the other conditions--kswapd/memcg--apply. This fixes 246e87a93934 ("memcg: fix get_scan_count() for small targets"). [akpm@linux-foundation.org: fix comment] Signed-off-by: Johannes Weiner Acked-by: KAMEZAWA Hiroyuki Reviewed-by: Michal Hocko Cc: Ying Han Cc: Balbir Singh Cc: KOSAKI Motohiro Cc: Daisuke Nishimura Acked-by: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d4c32f355cec2647efb65e4b24e630bd2386f787 Author: Axel Lin Date: Wed Sep 14 16:21:47 2011 -0700 drivers/rtc/rtc-imxdi.c needs linux/sched.h Include linux/sched.h to fix below build error. CC drivers/rtc/rtc-imxdi.o drivers/rtc/rtc-imxdi.c: In function 'di_write_wait': drivers/rtc/rtc-imxdi.c:168: error: 'TASK_INTERRUPTIBLE' undeclared (first use in this function) drivers/rtc/rtc-imxdi.c:168: error: (Each undeclared identifier is reported only once drivers/rtc/rtc-imxdi.c:168: error: for each function it appears in.) drivers/rtc/rtc-imxdi.c:168: error: implicit declaration of function 'signal_pending' drivers/rtc/rtc-imxdi.c:168: error: implicit declaration of function 'schedule_timeout' drivers/rtc/rtc-imxdi.c: In function 'dryice_norm_irq': drivers/rtc/rtc-imxdi.c:329: error: 'TASK_INTERRUPTIBLE' undeclared (first use in this function) Signed-off-by: Axel Lin Cc: Baruch Siach Cc: Wan ZongShun Cc: Alessandro Zummo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8694a1840c71fc7835595ee69139c83f7a8e5543 Author: Ben Hutchings Date: Wed Sep 14 16:21:42 2011 -0700 alpha, gpio: GENERIC_GPIO default must be n Since GPIOLIB is optional on alpha, GENERIC_GPIO must not be selected by default. If GPIOLIB is enabled, it will select GENERIC_GPIO. See for an example of what 'def_bool y' breaks. Reported-by: Michael Cree Signed-off-by: Ben Hutchings Cc: Richard Henderson Cc: Ivan Kokshaysky Cc: Matt Turner Cc: Michael Cree Cc: Mark Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2c51a4bc0233487db81706a0189715a59b18e9d6 Author: Al Viro Date: Wed Sep 14 16:21:38 2011 -0700 um: fix strrchr() problems richard@nod.at: Fixes: /usr/lib/gcc/x86_64-linux-gnu/4.4.5/../../../../lib/libc.a(strrchr.o): In function `rindex': (.text+0x0): multiple definition of `strrchr' If both STATIC_LINK and UML_NET_VDE are set to "y" libc's strrchr may clash with the kernel implementation. This workaround comes originally from Jeff Dike: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494995#35 Signed-off-by: Al Viro Signed-off-by: Richard Weinberger Cc: Jeff Dike Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f2833aef6a0517e933992c8007f330d0df5d9317 Author: Al Viro Date: Wed Sep 14 16:21:37 2011 -0700 um: clean arch_ptrace() up a bit 1) take subarch-specific stuff to subarch_ptrace() 2) PTRACE_{PEEK,POKE}{TEXT,DATA} is handled by ptrace_request() just fine... Signed-off-by: Al Viro Signed-off-by: Richard Weinberger Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 01599cdc2f891415387aed9921909b3e9f27c801 Author: Al Viro Date: Wed Sep 14 16:21:34 2011 -0700 um: PTRACE_[GS]ETFPXREGS had been wired on the wrong subarch It's 32bit-only, not 64bit-only... And while we are at it, it's set_fpxregs(), not set_fpregs()... Signed-off-by: Al Viro Signed-off-by: Richard Weinberger Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7cf3cf21aac7d75d27e8e7cd039bd33d19fb300d Author: Al Viro Date: Wed Sep 14 16:21:31 2011 -0700 um: fix free_winch() mess while not doing free_irq() from irq handler is commendable, kfree() on the data passed to said handler before free_irq() is Not Good(tm). Freeing the stack it's being run on is also not nice... Solution: delay actually freeing stuff. Signed-off-by: Al Viro Signed-off-by: Richard Weinberger Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 45cd5e2d4e632f55af1d6131f33b554c98f8b929 Author: Al Viro Date: Wed Sep 14 16:21:28 2011 -0700 um: winch_interrupt() can happen inside of free_winch() ... so set winch->fd to -1 before doing free_irq(), to avoid having winch_interrupt() come from/during the latter and attempt to do reactivate_fd() on something that's already gone. Signed-off-by: Al Viro Signed-off-by: Richard Weinberger Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f71f94845e0126884eca8ce57a92e30b189c8e71 Author: Al Viro Date: Wed Sep 14 16:21:25 2011 -0700 um: fix oopsable race in line_close() tty->count is decremented only after ->close() had been called and several tasks can hit it in parallel. As the result, using tty->count to check if you are the last one is broken. We end up leaving line->tty not reset to NULL and the next IRQ on that sucker will blow up trying to dereference pointers from kfree'd struct tty. Fix is obvious: we need to use a counter of our own. Signed-off-by: Al Viro Signed-off-by: Richard Weinberger Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fbfe9c847edf57ac8232aeafb290f272289893a3 Author: Ingo van Lil Date: Wed Sep 14 16:21:23 2011 -0700 um: Save FPU registers between task switches Some time ago Jeff prepared 42daba316557 ("uml: stop saving process FP state") for UML to stop saving the process FP state between task switches. The assumption was that since with SKAS0 every guest process runs inside a host process context the host OS will take care of keeping the proper FP state. Unfortunately this is not true for multi-threaded applications, where all guest threads share a single host process context yet all may use the FPU on their own. Although I haven't verified it I suspect things to be even worse in SKAS3 mode where all guest processes run inside a single host process. The patch reintroduces the saving and restoring of the FP context between task switches. [richard@nod.at: Ingo posted this patch in 2009, sadly it was never applied and got lost. Now in 2011 the problem was reported by Gunnar.] Signed-off-by: Ingo van Lil Signed-off-by: Richard Weinberger Reported-by: Tested-by: Cc: Stanislav Meduna Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b40997b872cdb70140f127af6069f00a86b6cf81 Author: Jonathan Neuschäfer Date: Wed Sep 14 16:21:20 2011 -0700 um: drivers/xterm.c: fix a file descriptor leak I could use out_close1, but that seems to be the code path to close the fd returned by os_create_unix_socket, and using it to close the fd returned by mkstemp might lead to some confusion, so I don't do it. Signed-off-by: Jonathan Neuschäfer Signed-off-by: Richard Weinberger Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e5f0bdc7840bdb791247cb98dfc1dab6ea6c7da4 Author: Thadeu Lima de Souza Cascardo Date: Wed Sep 14 16:21:08 2011 -0700 um: disable CMPXCHG_DOUBLE as it breaks UML build Commit b789ef518b2 ("slub: Add cmpxchg_double_slab()") tests for cmpxchg_double support in the SLUB code and it breaks UML builds with SLUB. Since UML does not support checking for CPU features, disable CMPXCHG_DOUBLE just like CMPXCHG_LOCAL is disabled for UML. Signed-off-by: Thadeu Lima de Souza Cascardo Reviewed-by: Christoph Lameter Cc: Jeff Dike Cc: Richard Weinberger Signed-off-by: Richard Weinberger Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0d6617c7732c083659566117ca620eda6f1a87af Author: David Rientjes Date: Wed Sep 14 16:21:05 2011 -0700 numa: fix NUMA compile error when sysfs and procfs are disabled The vmstat_text array is only defined for CONFIG_SYSFS or CONFIG_PROC_FS, yet it is referenced for per-node vmstat with CONFIG_NUMA: drivers/built-in.o: In function `node_read_vmstat': node.c:(.text+0x1106df): undefined reference to `vmstat_text' Introduced in commit fa25c503dfa2 ("mm: per-node vmstat: show proper vmstats"). Define the array for CONFIG_NUMA as well. [akpm@linux-foundation.org: remove unneeded ifdefs] Signed-off-by: David Rientjes Reported-by: Cong Wang Acked-by: Randy Dunlap Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2bbff6c761e31b4642d297513cd3e0e89bc68ff7 Author: KAMEZAWA Hiroyuki Date: Wed Sep 14 16:21:02 2011 -0700 mm/mempolicy.c: make copy_from_user() provably correct When compiling mm/mempolicy.c with struct user copy checks the following warning is shown: In file included from arch/x86/include/asm/uaccess.h:572, from include/linux/uaccess.h:5, from include/linux/highmem.h:7, from include/linux/pagemap.h:10, from include/linux/mempolicy.h:70, from mm/mempolicy.c:68: In function `copy_from_user', inlined from `compat_sys_get_mempolicy' at mm/mempolicy.c:1415: arch/x86/include/asm/uaccess_64.h:64: warning: call to `copy_from_user_overflow' declared with attribute warning: copy_from_user() buffer size is not provably correct LD mm/built-in.o Fix this by passing correct buffer size value. Signed-off-by: KAMEZAWA Hiroyuki Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8aacc9f550feb09c8b26470498345c192996a68e Author: Caspar Zhang Date: Wed Sep 14 16:20:58 2011 -0700 mm/mempolicy.c: fix pgoff in mbind vma merge commit 9d8cebd4bcd7 ("mm: fix mbind vma merge problem") didn't really fix the mbind vma merge problem due to wrong pgoff value passing to vma_merge(), which made vma_merge() always return NULL. Before the patch applied, we are getting a result like: addr = 0x7fa58f00c000 [snip] 7fa58f00c000-7fa58f00d000 rw-p 00000000 00:00 0 7fa58f00d000-7fa58f00e000 rw-p 00000000 00:00 0 7fa58f00e000-7fa58f00f000 rw-p 00000000 00:00 0 here 7fa58f00c000->7fa58f00f000 we get 3 VMAs which are expected to be merged described as described in commit 9d8cebd. Re-testing the patched kernel with the reproducer provided in commit 9d8cebd, we get the correct result: addr = 0x7ffa5aaa2000 [snip] 7ffa5aaa2000-7ffa5aaa6000 rw-p 00000000 00:00 0 7fffd556f000-7fffd5584000 rw-p 00000000 00:00 0 [stack] Signed-off-by: Caspar Zhang Cc: KOSAKI Motohiro Cc: Christoph Lameter Cc: Hugh Dickins Cc: Mel Gorman Cc: Lee Schermerhorn Cc: Minchan Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bcd438be3b66110dfe70f655cadb2b20e201f076 Merge: 53d872e99520 610602f369b4 Author: Linus Torvalds Date: Wed Sep 14 16:09:14 2011 -0700 Merge git://bedivere.hansenpartnership.com/git/scsi-rc-fixes-2.6 * git://bedivere.hansenpartnership.com/git/scsi-rc-fixes-2.6: (25 commits) [SCSI] bnx2i: Fixed the endian on TTT for NOP out transmission [SCSI] libfc: fix referencing to fc_fcp_pkt from the frame pointer via fr_fsp() [SCSI] libfc: block SCSI eh thread for blocked rports [SCSI] libfc: fix fc_eh_host_reset [SCSI] fcoe: Fix deadlock between fip's recv_work and rtnl [SCSI] qla2xxx: Update version number to 8.03.07.07-k. [SCSI] qla2xxx: Set the task attributes after memsetting fcp cmnd. [SCSI] qla2xxx: Correct inadvertent loop state transitions during port-update handling. [SCSI] qla2xxx: Save and restore irq in the response queue interrupt handler. [SCSI] qla2xxx: Double check for command completion if abort mailbox command fails. [SCSI] qla2xxx: Acquire hardware lock while manipulating dsd list. [SCSI] qla2xxx: Fix qla24xx revision check while enabling interrupts. [SCSI] qla2xxx: T10 DIF - Fix incorrect error reporting. [SCSI] qla2xxx: T10 DIF - Handle uninitalized sectors. [SCSI] hpsa: fix physical device lun and target numbering problem [SCSI] hpsa: fix problem that OBDR devices are not detected [SCSI] isci: add version number [SCSI] isci: fix event-get pointer increment [SCSI] isci: dynamic interrupt coalescing [SCSI] isci: Leave requests alone if already terminating. ... commit 53d872e99520bbc7d83c34a416144e591ef69584 Merge: 1d2ef5901483 2d2422aebc03 Author: Linus Torvalds Date: Wed Sep 14 16:08:29 2011 -0700 Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs * 'for-linus' of git://oss.sgi.com/xfs/xfs: xfs: fix a use after free in xfs_end_io_direct_write commit 1d2ef5901483004d74947bbf78d5146c24038fe7 Author: Al Viro Date: Wed Sep 14 18:55:41 2011 +0100 restore pinning the victim dentry in vfs_rmdir()/vfs_rename_dir() We used to get the victim pinned by dentry_unhash() prior to commit 64252c75a219 ("vfs: remove dget() from dentry_unhash()") and ->rmdir() and ->rename() instances relied on that; most of them don't care, but ones that used d_delete() themselves do. As the result, we are getting rmdir() oopses on NFS now. Just grab the reference before locking the victim and drop it explicitly after unlocking, same as vfs_rename_other() does. Signed-off-by: Al Viro Tested-by: Simon Kirby Cc: stable@kernel.org (3.0.x) Signed-off-by: Linus Torvalds commit 4038a12e7443b5fed3e526c475c38c115d9600f6 Merge: 2e1210bc3d06 5013951be88e Author: Takashi Iwai Date: Wed Sep 14 19:11:13 2011 +0200 Merge branch 'fix/asoc' into for-linus commit 2d2422aebc037095f77551119f795449d29befed Author: Christoph Hellwig Date: Tue Sep 13 22:26:00 2011 +0000 xfs: fix a use after free in xfs_end_io_direct_write There is a window in which the ioend that we call inode_dio_wake on in xfs_end_io_direct_write is already free. Fix this by storing the inode pointer in a local variable. This is a fix for the regression introduced in 3.1-rc by "fs: move inode_dio_done to the end_io handler". Signed-off-by: Christoph Hellwig Signed-off-by: Alex Elder commit db318d7a8a910657f10ffdf223c971af20a9b09c Author: Michel Dänzer Date: Tue Sep 13 11:29:12 2011 +0200 drm/radeon: Unreference GEM object outside of spinlock in page flip error path. Should fix https://bugzilla.redhat.com/show_bug.cgi?id=726277 . Signed-off-by: Michel Dänzer cc: stable@kernel.org Signed-off-by: Dave Airlie commit 87463ff83bcda210d8f0ae440bd64d1548f852e7 Author: Michel Dänzer Date: Tue Sep 13 11:27:35 2011 +0200 drm/radeon: Don't read from CP ring write pointer registers. Apparently this doesn't always work reliably, e.g. at resume time. Just initialize to 0, so the ring is considered empty. Tested with hibernation on Sumo and Cayman cards. Should fix https://bugs.launchpad.net/ubuntu/+source/linux/+bug/820746/ . Signed-off-by: Michel Dänzer Reviewed-by: Alex Deucher cc: stable@kernel.org Signed-off-by: Dave Airlie commit ff02b13f6867af72682d7a9bb9bd705f9af2bab0 Author: Ben Skeggs Date: Wed Sep 14 06:08:06 2011 +1000 drm/ttm: request zeroed system memory pages for new TT buffer objects Fixes an information leak to userspace, we were handing out un-zeroed pages for any newly created TTM_PL_TT buffer. Reported-by: Marcin Slusarz Signed-off-by: Ben Skeggs Tested-by: Marcin Slusarz Cc: stable@kernel.org Signed-off-by: Dave Airlie commit 72cc205611879525db0374d9831f84f787112b25 Author: Nicolas Pitre Date: Wed Sep 14 01:22:05 2011 -0400 ARM: Dove: fix second SPI initialization call Commit 980f9f601a "ARM: orion: Consolidate SPI initialization." broke it by overwriting the SPI0 registration. Signed-off-by: Nicolas Pitre Cc: Signed-off-by: Arnd Bergmann commit 2e1210bc3d065a6e26ff5fef228a9a7e08921d2c Author: David Henningsson Date: Wed Sep 14 13:22:54 2011 +0200 ALSA: HDA: Cirrus - fix "Surround Speaker" volume control name This patch fixes "Surround Speaker Playback Volume" being cut off. (Commit b4dabfc452a10 was probably meant to fix this, but it fixed only the "Switch" name, not the "Volume" name.) Signed-off-by: David Henningsson Cc: Signed-off-by: Takashi Iwai commit cd5bd3df1a6e7a68454734fb109c409101c20f42 Author: Jean Delvare Date: Wed Sep 14 04:43:07 2011 -0400 hwmon: (coretemp) Initialize tmin ttarget is initialized when the driver is loaded, but tmin is not. As a result, tempX_max_hyst attributes read 0. Fix this. Also use THERM_*_THRESHOLD* constants in these initializations instead of hard-coding the constants. Signed-off-by: Jean Delvare Cc: "R, Durgadoss" Cc: Guenter Roeck Cc: Fenghua Yu Signed-off-by: Guenter Roeck commit 8ad6a56f5679a987bfeacad1bd818a2a381aa98e Author: Tao Ma Date: Wed Sep 14 09:31:01 2011 +0200 block: Don't check QUEUE_FLAG_SAME_COMP in __blk_complete_request In __blk_complete_request, we check both QUEUE_FLAG_SAME_COMP and req->cpu to decide whether we should use req->cpu. Actually the user can also select the complete cpu by either setting BIO_CPU_AFFINE or by calling bio_set_completion_cpu. Current solution makes these 2 ways don't work any more. So we'd better just check req->cpu. Signed-off-by: Tao Ma Signed-off-by: Jens Axboe commit 003f6c9df54970d8b19578d195b3e2b398cdbde2 Author: H Hartley Sweeten Date: Fri Sep 9 11:30:27 2011 -0700 lib/sha1.c: quiet sparse noise about symbol not declared Include to pickup the declarations for sha_transform and sha_init to quite the sparse noise: warning: symbol 'sha_transform' was not declared. Should it be static? warning: symbol 'sha_init' was not declared. Should it be static? Signed-off-by: H Hartley Sweeten Acked-by: Mandeep Singh Baines Signed-off-by: Linus Torvalds commit 1a4b1a41b8a3d5256019854e851beed063b34344 Author: Benjamin Herrenschmidt Date: Tue Sep 13 15:16:33 2011 -0300 pci: Don't crash when reading mpss from root complex In pcie_find_smpss(), we have the following statement: if (dev->is_hotplug_bridge && (!list_is_singular(&dev->bus->devices) || dev->bus->self->pcie_type != PCI_EXP_TYPE_ROOT_PORT)) The problem is that at least on my machine, this gets called for the root complex (virtual P2P bridge), and dev->bus->self is NULL since the parent bus for this is not itself anchor to a PCI device. This adds the necessary NULL check. Signed-off-by: Benjamin Herrenschmidt Acked-by: Jon Mason Signed-off-by: Linus Torvalds commit 477694e71113fd0694b6bb0bcc2d006b8ac62691 Author: Thomas Gleixner Date: Tue Jul 19 16:25:42 2011 +0200 x86, iommu: Mark DMAR IRQ as non-threaded Mark this lowlevel IRQ handler as non-threaded. This prevents a boot crash when "threadirqs" is on the kernel commandline. Also the interrupt handler is handling hardware critical events which should not be delayed into a thread. Signed-off-by: Thomas Gleixner Cc: stable@kernel.org Signed-off-by: Ingo Molnar commit fb2088ccc139ffbf1cf359216883712dab4ae43d Author: Sachin Prabhu Date: Mon Aug 1 12:10:12 2011 +0100 nfs: Do not allow multiple mounts on same mountpoint when using -o noac Do not allow multiple mounts on same mountpoint when using -o noac When you normally attempt to mount a share twice on the same mountpoint, a check in do_add_mount causes it to return an error # mount localhost:/nfsv3 /mnt # mount localhost:/nfsv3 /mnt mount.nfs: /mnt is already mounted or busy However when using the option 'noac', the user is able to mount the same share on the same mountpoint multiple times. This happens because a share mounted with the noac option is automatically assigned the 'sync' flag MS_SYNCHRONOUS in nfs_initialise_sb(). This flag is set after the check for already existing superblocks is done in sget(). The check for the mount flags in nfs_compare_mount_options() does not take into account the 'sync' flag applied later on in the code path. This means that when using 'noac', a new superblock structure is assigned for every new mount of the same share and multiple shares on the same mountpoint are allowed. ie. # mount -onoac localhost:/nfsv3 /mnt can be run multiple times. The patch checks for noac and assigns the sync flag before sget() is called to obtain an already existing superblock structure. Signed-off-by: Sachin Prabhu Reviewed-by: Jeff Layton Signed-off-by: Trond Myklebust commit f13c3620a4d1123dbf032f93f350b856ef292ced Author: Trond Myklebust Date: Mon Sep 12 11:47:53 2011 -0400 NFS: Fix a typo in nfs_flush_multi Fix a typo which causes an Oops in the RPC layer, when using wsize < 4k. Signed-off-by: Trond Myklebust Tested-by: Sricharan R commit 282cdb325aea4ebbc42ce753b47cc96145eb54bc Author: Johannes Berg Date: Mon Sep 12 12:09:10 2011 -0700 iwlagn: fix command queue timeout If the command queue is constantly busy, which can happen in P2P, the hangcheck timer will frequently find a command in it and will eventually reset the device because nothing sets the timestamp for this queue when commands are processed. Fix this by setting the timestamp when a command completes. Cc: stable@kernel.org #2.6.39, #3.0.0 #3.1.0 Signed-off-by: Johannes Berg SIgned-off-by: Wey-Yi Guy Signed-off-by: John W. Linville commit 456fc37e4519f3f551830ce01c58ddaa35807204 Author: Johannes Berg Date: Mon Sep 12 21:08:25 2011 +0200 iwlagn: fix stack corruption Alexander reported a strange crash in iwlagn that Meenakshi and Wey couldn't reproduce. I just ran into the same issue and tracked it down to stack corruption. This fixes it. The problem was introduced in commit 4b8b99b6e650d0527f3a123744b7459976581d14 Author: Wey-Yi Guy Date: Fri Jul 8 14:29:48 2011 -0700 iwlagn: radio sensor offset in le16 format Cc: Wey-Yi Guy Cc: Meenakshi Venkataraman Reported-by: Alexander Diewald Signed-off-by: Johannes Berg Signed-off-by: John W. Linville commit 6a6b3f3e13decfc4b97263a83ea4e80ac8cc89ae Author: Mohammed Shafi Shajakhan Date: Fri Sep 9 10:41:08 2011 +0530 ath9k: Fix kernel panic on unplugging the device when the device is yanked out ath_pci_remove starts doing the cleanups, unregistering the hardware etc. so we should bail out immediately when we get drv_flush callback from mac80211 when the card is being unplugged. the panic occurs after we had associated to an AP. EIP: 0060:[] EFLAGS: 00010246 CPU: 0 EIP is at ath_reset+0xa0/0x1c0 [ath9k] EAX: 00000000 EBX: 000697c0 ECX: 00000002 EDX: f3c3ccf0 ESI: 00000000 EDI: 00000000 EBP: f43e7b78 ESP: f43e7b50 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 Process kworker/u:2 (pid: 182, ti=f43e6000 task=f3c3c7c0 task.ti=f43e6000) Stack: 0000002a 00000000 00000000 003e7b78 0000000f eaaa8500 ffffffea eaaa97c0 eaaaa000 00000001 f43e7ba8 fb315d23 f99e7721 ecece680 eaaac738 eaaa8500 eaaaa020 000000c8 000000c8 00000000 eaaa8d58 eaaa8500 f43e7bd0 fb080b29 Call Trace: [] ath9k_flush+0x103/0x170 [ath9k] [] __ieee80211_recalc_idle+0x2c9/0x400 [mac80211] [] ieee80211_recalc_idle+0x2e/0x60 [mac80211] [] ieee80211_mgd_deauth+0x173/0x210 [mac80211] [] ieee80211_deauth+0x19/0x20 [mac80211] [] __cfg80211_mlme_deauth+0xf3/0x140 [cfg80211] [] ? __mutex_lock_common+0x1f0/0x380 [] __cfg80211_disconnect+0x18d/0x1f0 [cfg80211] [] cfg80211_netdev_notifier_call+0x159/0x5c0 [cfg80211] [] ? packet_notifier+0x174/0x1f0 [] notifier_call_chain+0x82/0xb0 [] raw_notifier_call_chain+0x1f/0x30 [] call_netdevice_notifiers+0x2c/0x60 [] ? trace_hardirqs_on_caller+0xf4/0x180 [] __dev_close_many+0x4c/0xd0 [] dev_close_many+0x6d/0xc0 [] rollback_registered_many+0x93/0x1c0 [] ? trace_hardirqs_on+0xb/0x10 [] unregister_netdevice_many+0x15/0x50 [] ieee80211_remove_interfaces+0x7b/0xb0 [mac80211] [] ieee80211_unregister_hw+0x4b/0x110 [mac80211] [] ath9k_deinit_device+0x3a/0x60 [ath9k] [] ath_pci_remove+0x46/0x90 [ath9k] [] pci_device_remove+0x44/0x100 [] __device_release_driver+0x64/0xb0 [] device_release_driver+0x27/0x40 [] bus_remove_device+0x7b/0xa0 [] device_del+0xf1/0x180 [] device_unregister+0x10/0x20 [] pci_stop_bus_device+0x6e/0x80 [] pci_remove_bus_device+0x12/0xa0 [] pciehp_unconfigure_device+0x89/0x180 [] ? mark_held_locks+0x64/0x100 [] ? __mutex_unlock_slowpath+0xaf/0x140 [] pciehp_disable_slot+0x64/0x1b0 [] pciehp_power_thread+0xd0/0x100 [] ? process_one_work+0x100/0x4d0 [] process_one_work+0x17c/0x4d0 [] ? process_one_work+0x100/0x4d0 [] ? queue_interrupt_event+0xa0/0xa0 [] worker_thread+0x13b/0x320 [] ? trace_hardirqs_on+0xb/0x10 [] ? manage_workers+0x1e0/0x1e0 [] kthread+0x84/0x90 [] ? __init_kthread_worker+0x60/0x60 [] kernel_thread_helper+0x6/0x10 Cc: Rajkumar Manoharan Signed-off-by: Mohammed Shafi Shajakhan Signed-off-by: John W. Linville commit 4bae7d976976fa52d345805ba686934cd548343e Author: Johannes Berg Date: Tue Sep 6 12:47:39 2011 +0200 mac80211: fix missing sta_lock in __sta_info_destroy Since my commit 34e895075e21be3e21e71d6317440d1ee7969ad0 ("mac80211: allow station add/remove to sleep") there is a race in mac80211 when it clears the TIM bit because a sleeping station disconnected, the spinlock isn't held around the relevant code any more. Use the right API to acquire the spinlock correctly. Cc: stable@kernel.org [2.6.34+] Signed-off-by: Johannes Berg Signed-off-by: John W. Linville commit bac2555c6d86387132930af4d14cb47c4dd3f4f7 Author: George Date: Sat Sep 3 10:58:48 2011 -0500 rtlwifi: Fix problem when switching connections The driver fails to clear encryption keys making it impossible to switch connections. Signed-off-by: George Signed-off-by: Larry Finger Cc: Stable [2.6.39+] Signed-off-by: John W. Linville commit 3401dc6eba788ebc7c14ce51018d775b1c263399 Author: George Date: Sat Sep 3 10:58:47 2011 -0500 rtlwifi: rtl8192su: Fix problem connecting to HT-enabled AP The driver fails to connect to 802.11n-enabled APs. The patch fixes Bug #42262. Signed-off-by: George Signed-off-by: Larry Finger Cc: Stable [2.6.39+] Signed-off-by: John W. Linville commit e3b73c4a25e9a5705b4ef28b91676caf01f9bc9f Author: David Vrabel Date: Tue Sep 13 10:17:32 2011 -0400 xen/e820: if there is no dom0_mem=, don't tweak extra_pages. The patch "xen: use maximum reservation to limit amount of usable RAM" (d312ae878b6aed3912e1acaaf5d0b2a9d08a4f11) breaks machines that do not use 'dom0_mem=' argument with: reserve RAM buffer: 000000133f2e2000 - 000000133fffffff (XEN) mm.c:4976:d0 Global bit is set to kernel page fffff8117e (XEN) domain_crash_sync called from entry.S (XEN) Domain 0 (vcpu#0) crashed on cpu#0: ... The reason being that the last E820 entry is created using the 'extra_pages' (which is based on how many pages have been freed). The mentioned git commit sets the initial value of 'extra_pages' using a hypercall which returns the number of pages (if dom0_mem has been used) or -1 otherwise. If the later we return with MAX_DOMAIN_PAGES as basis for calculation: return min(max_pages, MAX_DOMAIN_PAGES); and use it: extra_limit = xen_get_max_pages(); if (extra_limit >= max_pfn) extra_pages = extra_limit - max_pfn; else extra_pages = 0; which means we end up with extra_pages = 128GB in PFNs (33554432) - 8GB in PFNs (2097152, on this specific box, can be larger or smaller), and then we add that value to the E820 making it: Xen: 00000000ff000000 - 0000000100000000 (reserved) Xen: 0000000100000000 - 000000133f2e2000 (usable) which is clearly wrong. It should look as so: Xen: 00000000ff000000 - 0000000100000000 (reserved) Xen: 0000000100000000 - 000000027fbda000 (usable) Naturally this problem does not present itself if dom0_mem=max:X is used. CC: stable@kernel.org Signed-off-by: David Vrabel Signed-off-by: Konrad Rzeszutek Wilk commit 40257b953fdd519c743138f3fbe3962d54991116 Author: Guenter Roeck Date: Sat Sep 10 06:02:12 2011 -0700 hwmon: (pmbus) Fix low limit temperature alarms Temperature alarms are detected by checking the alarm bit and comparing temperature limits against the current temperature. For low limits, this comparison needs to be reversed (temp < limit instead of temp > limit). This was not taken into account, resulting in wrong alarms if a temperature fell below a low limit. Fix by adding a low limit flag in the limit data structure. When creating the sensor entry, the order of registers to compare is now reversed for low limits. Signed-off-by: Guenter Roeck Acked-by: Jean Delvare Cc: stable@kernel.org # 3.0+ commit 99e14c9d4140e9ed2c8810322a377e2a51b356eb Author: Takashi Iwai Date: Tue Sep 13 10:33:16 2011 +0200 ALSA: hda - Terminate the recursive connection search properly The recursive search of widget connections in snd_hda_get_conn_index() must be terminated at the pin and the audio-out widgets. Otherwise you'll get "too deep connection" warnings unnecessarily. Reported-by: Francis Moreau Signed-off-by: Takashi Iwai commit 8f9068609e8a5b4cbac9e0cf8332b5dcabf05422 Author: Chris Bagwell Date: Fri Sep 9 13:38:10 2011 -0700 Input: wacom - fix touch parsing on newer Bamboos Bamboos with Product ID's > 0xD4 return values unrelated to pressure in touch 1 pressure field. They also report 2nd touch X/Y values shifted down 1 byte (where pressure was). This results in jumpy 1 finger touch and totally invalid 2nd finger data. For touch detection, switch to a Touch Present single bit that all versions of Bamboo support. For touch 2 offset, calculate offset based on a bit that is set different between the two packet layouts. Since touch pressure reports were removed from driver, there was no need to be reading pressure any more. Signed-off-by: Chris Bagwell Reviewed-by: Ping Cheng Signed-off-by: Dmitry Torokhov commit 2f4d3218e95d48de2951dcf2bea619ea49ef93de Merge: d9543314ee4b 38c0a0c9ae0d Author: Linus Torvalds Date: Mon Sep 12 20:39:53 2011 -0700 Merge branch 'acpi' of git://github.com/lenb/linux * 'acpi' of git://github.com/lenb/linux: acpica: ACPI_MAX_SLEEP should be 2 sec, not 20 ACPI APEI: Add Kconfig option IRQ_WORK for GHES PNP: update pnp.debug usage (needs value on command line) APEI: Fix WHEA _OSC call commit d9543314ee4b6b276af539cc9fc12c614816c74a Merge: b6fd41e29dea f1c39625d63c Author: Linus Torvalds Date: Mon Sep 12 17:22:31 2011 -0700 Merge branch 'upstream/bugfix' of git://github.com/jsgf/linux-xen * 'upstream/bugfix' of git://github.com/jsgf/linux-xen: xen: use non-tracing preempt in xen_clocksource_read() commit 38c0a0c9ae0d145d72c6865f4aec1107aef81310 Merge: b6fd41e29dea 03ba176a29da b33c25d6a62a 96242116d483 Author: Len Brown Date: Mon Sep 12 20:00:00 2011 -0400 Merge branches 'apei', 'bz-13195' and 'doc' into acpi commit b6fd41e29dea9c6753b1843a77e50433e6123bcb Author: Linus Torvalds Date: Mon Sep 12 14:02:02 2011 -0700 Linux 3.1-rc6 commit 8cb3ed17cb88f2f1fe1cf36c8d48bccd4d9f459e Merge: 4c7527821c12 55a01f6f6840 Author: Linus Torvalds Date: Mon Sep 12 13:49:07 2011 -0700 Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm: Remove duplicate "return" statement drm/nv04/crtc: Bail out if FB is not bound to crtc drm/nouveau: fix nv04_sgdma_bind on non-"4kB pages" archs drm/nouveau: properly handle allocation failure in nouveau_sgdma_populate drm/nouveau: fix oops on pre-semaphore hardware drm/nv50/crtc: Bail out if FB is not bound to crtc drm/radeon/kms: fix DP detect and EDID fetch for DP bridges commit 4c7527821c125c76432c30c8781667f55bed600c Merge: 14d01ff53418 15ce92861f7f Author: Linus Torvalds Date: Mon Sep 12 11:51:35 2011 -0700 Merge branch 'fixes' of git://git.linaro.org/people/arnd/arm-soc * 'fixes' of git://git.linaro.org/people/arnd/arm-soc: ARM: CSR: add missing sentinels to of_device_id tables ARM: cns3xxx: Fix newly introduced warnings in the PCIe code ARM: cns3xxx: Fix compile error caused by hardware.h removed ARM: davinci: fix cache flush build error ARM: davinci: correct MDSTAT_STATE_MASK ARM: davinci: da850 EVM: read mac address from SPI flash OMAP: omap_device: fix !CONFIG_SUSPEND case in _noirq handlers OMAP2430: hwmod: musb: add missing terminator to omap2430_usbhsotg_addrs[] OMAP3: clock: indicate that gpt12_fck and wdt1_fck are in the WKUP clockdomain OMAP4: clock: fix compile warning OMAP4: clock: re-enable previous clockdomain enable/disable sequence OMAP: clockdomain: Wait for powerdomain to be ON when using clockdomain force wakeup OMAP: powerdomains: Make all powerdomain target states as ON at init commit 14d01ff5341866773e24c5b54a94f7e2520ca271 Author: Mathieu Desnoyers Date: Sun Sep 11 17:59:04 2011 -0400 ioctl: register LTTng ioctl The LTTng 2.0 kernel tracer (stand-alone module package, available at http://lttng.org) uses the 0xF6 ioctl range for tracer control and transport operations. Signed-off-by: Mathieu Desnoyers Signed-off-by: Linus Torvalds commit 0b001b2edaead6fd906b1f87967ae05f082189c4 Merge: 5dfcc87fd79d d525e8ab022c Author: Linus Torvalds Date: Mon Sep 12 11:47:49 2011 -0700 Merge branch 'for-linus' of git://github.com/chrismason/linux * 'for-linus' of git://github.com/chrismason/linux: Btrfs: add dummy extent if dst offset excceeds file end in Btrfs: calc file extent num_bytes correctly in file clone btrfs: xattr: fix attribute removal Btrfs: fix wrong nbytes information of the inode Btrfs: fix the file extent gap when doing direct IO Btrfs: fix unclosed transaction handle in btrfs_cont_expand Btrfs: fix misuse of trans block rsv Btrfs: reset to appropriate block rsv after orphan operations Btrfs: skip locking if searching the commit root in csum lookup btrfs: fix warning in iput for bad-inode Btrfs: fix an oops when deleting snapshots commit 5dfcc87fd79dfb96ed155b524337dbd0da4f5993 Author: Miklos Szeredi Date: Mon Sep 12 09:38:03 2011 +0200 fuse: fix memory leak kmemleak is reporting that 32 bytes are being leaked by FUSE: unreferenced object 0xe373b270 (size 32): comm "fusermount", pid 1207, jiffies 4294707026 (age 2675.187s) hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] kmemleak_alloc+0x27/0x50 [] kmem_cache_alloc+0xc5/0x180 [] fuse_alloc_forget+0x1e/0x20 [] fuse_alloc_inode+0xb0/0xd0 [] alloc_inode+0x1c/0x80 [] iget5_locked+0x8f/0x1a0 [] fuse_iget+0x72/0x1a0 [] fuse_get_root_inode+0x8a/0x90 [] fuse_fill_super+0x3ef/0x590 [] mount_nodev+0x3f/0x90 [] fuse_mount+0x15/0x20 [] mount_fs+0x1c/0xc0 [] vfs_kern_mount+0x41/0x90 [] do_kern_mount+0x39/0xd0 [] do_mount+0x2e5/0x660 [] sys_mount+0x66/0xa0 This leak report is consistent and happens once per boot on 3.1.0-rc5-dirty. This happens if a FORGET request is queued after the fuse device was released. Reported-by: Sitsofe Wheeler Signed-off-by: Miklos Szeredi Tested-by: Sitsofe Wheeler Signed-off-by: Linus Torvalds commit 24114504c4d585ec4aae7a2b2acb81bf741f8c8a Author: Miklos Szeredi Date: Mon Sep 12 09:31:49 2011 +0200 fuse: fix flock breakage Commit 37fb3a30b4 ("fuse: fix flock") added in 3.1-rc4 caused flock() to fail with ENOSYS with the kernel ABI version 7.16 or earlier. Fix by falling back to testing FUSE_POSIX_LOCKS for ABI versions 7.16 and earlier. Reported-by: Martin Ziegler Signed-off-by: Miklos Szeredi Tested-by: Martin Ziegler Signed-off-by: Linus Torvalds commit 15ce92861f7fe59de83667c0124a7ead3423c7a0 Merge: d035953e59ca 126caf1376e7 Author: Arnd Bergmann Date: Mon Sep 12 20:30:22 2011 +0200 Merge branch 'for_3.1/pm-fixes-2' of git://gitorious.org/khilman/linux-omap-pm into fixes commit d035953e59ca8bb7ffc1023efba72438524457bb Merge: 1f51b001cccf 6a53747be5f0 Author: Arnd Bergmann Date: Mon Sep 12 14:59:37 2011 +0000 Merge branch 'sirf/fixes' into fixes commit 5013951be88e136d9990ef55303276e2779ce8d8 Author: Arnd Bergmann Date: Sun Sep 11 20:07:30 2011 +0200 ASoC: Fix trivial build regression in Kirkwood I2S A fix merged in 3.1-rc2 introduced a small regression, this should get it to build again. Signed-off-by: Arnd Bergmann Acked-by: Liam Girdwood Signed-off-by: Mark Brown commit ed585a651681e822089087b426e6ebfb6d3d9873 Author: Geert Uytterhoeven Date: Sun Sep 11 13:59:27 2011 +0200 genirq: Make irq_shutdown() symmetric vs. irq_startup again If an irq_chip provides .irq_shutdown(), but neither of .irq_disable() or .irq_mask(), free_irq() crashes when jumping to NULL. Fix this by only trying .irq_disable() and .irq_mask() if there's no .irq_shutdown() provided. This revives the symmetry with irq_startup(), which tries .irq_startup(), .irq_enable(), and irq_unmask(), and makes it consistent with the comment for irq_chip.irq_shutdown() in , which says: * @irq_shutdown: shut down the interrupt (defaults to ->disable if NULL) This is also how __free_irq() behaved before the big overhaul, cfr. e.g. 3b56f0585fd4c02d047dc406668cb40159b2d340 ("genirq: Remove bogus conditional"), where the core interrupt code always overrode .irq_shutdown() to .irq_disable() if .irq_shutdown() was NULL. Signed-off-by: Geert Uytterhoeven Cc: linux-m68k@lists.linux-m68k.org Link: http://lkml.kernel.org/r/1315742394-16036-2-git-send-email-geert@linux-m68k.org Cc: stable@kernel.org Signed-off-by: Thomas Gleixner commit 87adf1c66cacbc4acd0e696c896755a5091a9d3d Merge: 14f69ec706e5 fc61ccd35fd5 Author: Linus Torvalds Date: Sun Sep 11 14:58:47 2011 -0700 Merge branch 'v4l_for_linus' of git://linuxtv.org/mchehab/for_linus * 'v4l_for_linus' of git://linuxtv.org/mchehab/for_linus: [media] vp7045: fix buffer setup [media] nuvoton-cir: simplify raw IR sample handling [media] [Resend] viacam: Don't explode if pci_find_bus() returns NULL [media] v4l2: Fix documentation of the codec device controls [media] gspca - sonixj: Fix the darkness of sensor om6802 in 320x240 [media] gspca - sonixj: Fix wrong register mask for sensor om6802 [media] gspca - ov519: Fix LED inversion of some ov519 webcams [media] pwc: precedence bug in pwc_init_controls() commit 14f69ec706e596a2443fe6c296c522c33584a77e Merge: d7a210f3d356 707b38a00bd2 Author: Linus Torvalds Date: Sun Sep 11 14:55:43 2011 -0700 Merge branch 'for-linus' of git://openrisc.net/~jonas/linux * 'for-linus' of git://openrisc.net/~jonas/linux: Add missing DMA ops openrisc: don't use pt_regs in struct sigcontext commit d525e8ab022cb000e6e31a515ba8c3cf0d9c6130 Author: Li Zefan Date: Sun Sep 11 10:52:25 2011 -0400 Btrfs: add dummy extent if dst offset excceeds file end in You can see there's no file extent with range [0, 4096]. Check this by btrfsck: # btrfsck /dev/sda7 root 5 inode 258 errors 100 ... Signed-off-by: Li Zefan Signed-off-by: Chris Mason commit d72c0842ff0e71342857723bb65f35b71f57b264 Author: Li Zefan Date: Sun Sep 11 10:52:25 2011 -0400 Btrfs: calc file extent num_bytes correctly in file clone num_bytes should be 4096 not 12288. Signed-off-by: Li Zefan Signed-off-by: Chris Mason commit 4815053aba7f2304055745df820cd74a39fdaab2 Author: David Sterba Date: Sun Sep 11 10:52:25 2011 -0400 btrfs: xattr: fix attribute removal An attribute is not removed by 'setfattr -x attr file' and remains visible in attr list. This makes xfstests/062 pass again. Signed-off-by: David Sterba Signed-off-by: Chris Mason commit a39f75214358d715efa21e2bccf5a709d8649144 Author: Miao Xie Date: Sun Sep 11 10:52:25 2011 -0400 Btrfs: fix wrong nbytes information of the inode If we write some data into the data hole of the file(no preallocation for this hole), Btrfs will allocate some disk space, and update nbytes of the inode, but the other element--disk_i_size needn't be updated. At this condition, we must update inode metadata though disk_i_size is not changed(btrfs_ordered_update_i_size() return 1). # mkfs.btrfs /dev/sdb1 # mount /dev/sdb1 /mnt # touch /mnt/a # truncate -s 856002 /mnt/a # dd if=/dev/zero of=/mnt/a bs=4K count=1 conv=nocreat,notrunc # umount /mnt # btrfsck /dev/sdb1 root 5 inode 257 errors 400 found 32768 bytes used err is 1 Signed-off-by: Miao Xie Signed-off-by: Chris Mason commit 0c1a98c81413e00a6c379d898e06a09350d31926 Author: Miao Xie Date: Sun Sep 11 10:52:24 2011 -0400 Btrfs: fix the file extent gap when doing direct IO When we write some data to the place that is beyond the end of the file in direct I/O mode, a data hole will be created. And Btrfs should insert a file extent item that point to this hole into the fs tree. But unfortunately Btrfs forgets doing it. The following is a simple way to reproduce it: # mkfs.btrfs /dev/sdc2 # mount /dev/sdc2 /test4 # touch /test4/a # dd if=/dev/zero of=/test4/a seek=8 count=1 bs=4K oflag=direct conv=nocreat,notrunc # umount /test4 # btrfsck /dev/sdc2 root 5 inode 257 errors 100 Reported-by: Tsutomu Itoh Signed-off-by: Miao Xie Tested-by: Tsutomu Itoh Signed-off-by: Chris Mason commit 5b397377e97d436fc2ed872fc53f85395bb984e0 Author: Miao Xie Date: Sun Sep 11 10:52:24 2011 -0400 Btrfs: fix unclosed transaction handle in btrfs_cont_expand The function - btrfs_cont_expand() forgot to close the transaction handle before it jump out the while loop. Fix it. Signed-off-by: Miao Xie Signed-off-by: Chris Mason commit 98c9942aca05fff198cd5ca629599cd193444809 Author: Liu Bo Date: Sun Sep 11 10:52:24 2011 -0400 Btrfs: fix misuse of trans block rsv At the beginning of create_pending_snapshot, trans->block_rsv is set to pending->block_rsv and is used for snapshot things, however, when it is done, we do not recover it as will. Signed-off-by: Liu Bo Signed-off-by: Chris Mason commit 65450aa645b1ef7ed74e41c34b28d53333744978 Author: Liu Bo Date: Sun Sep 11 10:52:24 2011 -0400 Btrfs: reset to appropriate block rsv after orphan operations While truncating free space cache, we forget to change trans->block_rsv back to the original one, but leave it with the orphan_block_rsv, and then with option inode_cache enable, it leads to countless warnings of btrfs_alloc_free_block and btrfs_orphan_commit_root: WARNING: at fs/btrfs/extent-tree.c:5711 btrfs_alloc_free_block+0x180/0x350 [btrfs]() ... WARNING: at fs/btrfs/inode.c:2193 btrfs_orphan_commit_root+0xb0/0xc0 [btrfs]() Signed-off-by: Liu Bo Signed-off-by: Chris Mason commit ddf23b3fc6850bd4654d51ec9457fe7c77cde51e Author: Josef Bacik Date: Sun Sep 11 10:52:24 2011 -0400 Btrfs: skip locking if searching the commit root in csum lookup It's not enough to just search the commit root, since we could be cow'ing the very block we need to search through, which would mean that its locked and we'll still deadlock. So use path->skip_locking as well. Thanks, Signed-off-by: Josef Bacik Signed-off-by: Chris Mason commit e0b6d65be57fb37ca67b04ce8964546a74d2125c Author: Sergei Trofimovich Date: Sun Sep 11 10:52:24 2011 -0400 btrfs: fix warning in iput for bad-inode iput() shouldn't be called for inodes in I_NEW state. We need to mark inode as constructed first. WARNING: at fs/inode.c:1309 iput+0x20b/0x210() Call Trace: [] warn_slowpath_common+0x7a/0xb0 [] warn_slowpath_null+0x15/0x20 [] iput+0x20b/0x210 [] btrfs_iget+0x1eb/0x4a0 [] btrfs_run_defrag_inodes+0x136/0x210 [] cleaner_kthread+0x17f/0x1a0 [] ? sub_preempt_count+0x9d/0xd0 [] ? transaction_kthread+0x280/0x280 [] kthread+0x96/0xa0 [] kernel_thread_helper+0x4/0x10 [] ? kthread_worker_fn+0x190/0x190 [] ? gs_change+0xb/0xb Signed-off-by: Sergei Trofimovich CC: Konstantin Khlebnikov Tested-by: David Sterba CC: Josef Bacik CC: Chris Mason Signed-off-by: Chris Mason commit 14c7cca780bd210564ae964f57a8bb807d0b3dbf Author: Liu Bo Date: Sun Sep 11 10:52:24 2011 -0400 Btrfs: fix an oops when deleting snapshots We can reproduce this oops via the following steps: $ mkfs.btrfs /dev/sdb7 $ mount /dev/sdb7 /mnt/btrfs $ for ((i=0; i<3; i++)); do btrfs sub snap /mnt/btrfs /mnt/btrfs/s_$i; done $ rm -fr /mnt/btrfs/* $ rm -fr /mnt/btrfs/* then we'll get ------------[ cut here ]------------ kernel BUG at fs/btrfs/inode.c:2264! [...] Call Trace: [] btrfs_rmdir+0xf7/0x1b0 [btrfs] [] vfs_rmdir+0xa5/0xf0 [] do_rmdir+0x123/0x140 [] ? fput+0x197/0x260 [] ? audit_syscall_entry+0x1bf/0x1f0 [] sys_unlinkat+0x2d/0x40 [] system_call_fastpath+0x16/0x1b RIP [] btrfs_orphan_add+0x179/0x1a0 [btrfs] When it comes to btrfs_lookup_dentry, we may set a snapshot's inode->i_ino to BTRFS_EMPTY_SUBVOL_DIR_OBJECTID instead of BTRFS_FIRST_FREE_OBJECTID, while the snapshot's location.objectid remains unchanged. However, btrfs_ino() does not take this into account, and returns a wrong ino, and causes the oops. Signed-off-by: Liu Bo Signed-off-by: Chris Mason commit fc61ccd35fd59d5362d37c8bf9c0526c85086c84 Author: Florian Mickler Date: Wed Aug 10 07:05:20 2011 -0300 [media] vp7045: fix buffer setup dvb_usb_device_init calls the frontend_attach method of this driver which uses vp7045_usb_ob. In order to have a buffer ready in vp7045_usb_op, it has to be allocated before that happens. Luckily we can use the whole private data as the buffer as it gets separately allocated on the heap via kzalloc in dvb_usb_device_init and is thus apt for use via usb_control_msg. This fixes a BUG: unable to handle kernel paging request at 0000000000001e78 reported by Tino Keitel and diagnosed by Dan Carpenter. Cc: stable@kernel.org # For v3.0 and upper Tested-by: Tino Keitel Signed-off-by: Florian Mickler Signed-off-by: Mauro Carvalho Chehab commit de4ed0c111ed078b8729a5cc49c23197740f5bad Author: Jarod Wilson Date: Mon Aug 8 17:20:40 2011 -0300 [media] nuvoton-cir: simplify raw IR sample handling The nuvoton-cir driver was storing up consecutive pulse-pulse and space-space samples internally, for no good reason, since ir_raw_event_store_with_filter() already merges back to back like samples types for us. This should also fix a regression introduced late in 3.0 that related to a timeout change, which actually becomes correct when coupled with this change. Tested with RC6 and RC5 on my own nuvoton-cir hardware atop vanilla 3.0.0, after verifying quirky behavior in 3.0 due to the timeout change. Reported-by: Stephan Raue CC: Stephan Raue CC: stable@vger.kernel.org Signed-off-by: Jarod Wilson Signed-off-by: Mauro Carvalho Chehab commit c8814df3a578895390fe5c05a76328d8d111ed25 Author: Jesper Juhl Date: Mon Aug 1 18:39:17 2011 -0300 [media] [Resend] viacam: Don't explode if pci_find_bus() returns NULL In the unlikely case that pci_find_bus() should return NULL viacam_serial_is_enabled() is going to dereference a NULL pointer and blow up. Better safe than sorry, so be defensive and check the pointer. Signed-off-by: Jesper Juhl Acked-by: Jonathan Corbet Signed-off-by: Mauro Carvalho Chehab commit 6a02a3306769c6f0fa8ebd92d5046c841e4e740d Author: Kamil Debski Date: Tue Aug 2 12:53:49 2011 -0300 [media] v4l2: Fix documentation of the codec device controls Fixed missing ids of the codec controls description in the controls.xml file. Signed-off-by: Kamil Debski Signed-off-by: Kyungmin Park Reported-by: Randy Dunlap Acked-by: Randy Dunlap Signed-off-by: Mauro Carvalho Chehab commit 5b5cfc3674756d249cb389bbd2a0be94abae5f7c Author: Jean-François Moine Date: Tue Aug 9 15:13:50 2011 -0300 [media] gspca - sonixj: Fix the darkness of sensor om6802 in 320x240 The images are clearer with a lower bridge clock. Signed-off-by: Jean-François Moine Signed-off-by: Mauro Carvalho Chehab commit 313c68e644326e88731f03371baa8b5f3d68ef11 Author: Luiz Carlos Ramos Date: Tue Aug 9 14:36:57 2011 -0300 [media] gspca - sonixj: Fix wrong register mask for sensor om6802 The bug was introduced by git commit 0e4d413af1a9d, giving very dark images. Signed-off-by: Luiz Carlos Ramos Signed-off-by: Jean-François Moine Signed-off-by: Mauro Carvalho Chehab commit 55c53e1f24d46fd20e74d3a5089ed9f6e0e9ab14 Author: Jean-François Moine Date: Tue Aug 9 05:28:17 2011 -0300 [media] gspca - ov519: Fix LED inversion of some ov519 webcams The list of the webcams which have LED inversion was rebuild scanning ms-win .inf files. Signed-off-by: Jean-François Moine Signed-off-by: Mauro Carvalho Chehab commit 4264a8b6388f5ba16a5c362857cb8bda0b14167f Author: Dan Carpenter Date: Sat Jul 23 15:53:03 2011 -0300 [media] pwc: precedence bug in pwc_init_controls() '!' has higher precedence than '&' so we need parenthesis here. Signed-off-by: Dan Carpenter Signed-off-by: Hans de Goede Signed-off-by: Mauro Carvalho Chehab commit 707b38a00bd2e7cac60afc75abe826e68ca83cfb Author: Jonas Bonn Date: Mon Sep 5 13:47:10 2011 +0200 Add missing DMA ops For the initial architecture submission, not all of the DMA ops were implemented. This patch adds the *map_page and *map_sg variants of the DMA mapping ops. This patch is currently of interest mainly to some drivers that haven't been submitted upstream yet. Signed-off-by: Jonas Bonn commit 6a53747be5f02ba7b37ff5131330363270782dc3 Author: Jamie Iles Date: Mon Aug 1 21:09:36 2011 +0100 ARM: CSR: add missing sentinels to of_device_id tables The of_device_id tables used for matching should be terminated with empty sentinel values. Signed-off-by: Jamie Iles Signed-off-by: Barry Song commit d7a210f3d356371677cf553ce6241b620e389844 Author: Randy Dunlap Date: Sat Sep 10 17:13:34 2011 -0700 scsi: qla4xxx driver depends on NET When CONFIG_NET is disabled, SCSI_QLA_ISCSI selects SCSI_ISCSI_ATTRS, which uses network interfaces, so the build fails with multiple errors: warning: (ISCSI_TCP && SCSI_CXGB3_ISCSI && SCSI_CXGB4_ISCSI && SCSI_QLA_ISCSI && INFINIBAND_ISER) selects SCSI_ISCSI_ATTRS which has unmet direct dependencies (SCSI && NET) ERROR: "skb_trim" [drivers/scsi/scsi_transport_iscsi.ko] undefined! ERROR: "netlink_kernel_create" [drivers/scsi/scsi_transport_iscsi.ko] undefined! ERROR: "netlink_kernel_release" [drivers/scsi/scsi_transport_iscsi.ko] undefined! ... so make SCSI_QLA_ISCSI also depend on NET to prevent the build errors. Signed-off-by: Randy Dunlap Cc: Ravi Anand Cc: Vikas Chaudhary Cc: iscsi-driver@qlogic.com Signed-off-by: Linus Torvalds commit d0a77454c70d0449a5f87087deb8f0cb15145e90 Merge: c338bfb5ecf6 6c6d8deb5d95 Author: Linus Torvalds Date: Sat Sep 10 17:28:46 2011 -0700 Merge branch 'fixes' of http://ftp.arm.linux.org.uk/pub/linux/arm/kernel/git-cur/linux-2.6-arm * 'fixes' of http://ftp.arm.linux.org.uk/pub/linux/arm/kernel/git-cur/linux-2.6-arm: ARM: 7088/1: entry: fix wrong parameter name used in do_thumb_abort ARM: 7080/1: l2x0: make sure I&D are not locked down on init ARM: 7081/1: mach-integrator: fix the clocksource NET: am79c961: fix race in link status code ARM: 7067/1: mm: keep significant bits in pfn_valid commit 6c6d8deb5d95a0675a8edd588bbc2249cbce5b34 Author: Janusz Krzysztofik Date: Thu Sep 8 18:45:40 2011 +0100 ARM: 7088/1: entry: fix wrong parameter name used in do_thumb_abort Commit be020f8618ca, "ARM: entry: abort-macro: specify registers to be used for macros", while replacing register numbers with macro parameter names, mismatched the name used for r1. For me, this resulted in user space built for EABI with -march=armv4t -mtune=arm920t -mthumb-interwork -mthumb broken on my OMAP1510 based Amstrad Delta (old ABI and no thumb still worked for me though). Fix this by using correct parameter name fsr instead of mismatched psr, used by callers for another purpose. Signed-off-by: Janusz Krzysztofik Signed-off-by: Russell King commit 1f51b001cccf3a16b9191de3dc67c58689cc44d6 Merge: 7caaf7efb98a 876355014ce3 897a6a1a1483 Author: Arnd Bergmann Date: Sat Sep 10 23:20:25 2011 +0200 Merge branches 'cns3xxx/fixes', 'omap/fixes' and 'davinci/fixes' into fixes commit c338bfb5ecf6c36b2112479691d69db4c2b5a78a Author: Bart Van Assche Date: Sat Sep 10 20:13:01 2011 +0200 backlight: Declare backlight_types[] const Since backlight_types[] isn't modified, let's declare it const. That was probably the intention of the author of commit bb7ca747f8d6 ("backlight: add backlight type"), via which the "const char const *" construct was introduced. The duplicate const was detected by sparse. Signed-off-by: Bart Van Assche Cc: Matthew Garrett Cc: Richard Purdie Cc: Florian Tobias Schandinat Cc: Andrew Morton Signed-off-by: Linus Torvalds commit 290a1cc4f725a53076e0fda804cd4fea84ee4564 Merge: ed2888e906b5 27a7b260f714 Author: Linus Torvalds Date: Sat Sep 10 10:19:15 2011 -0700 Merge branch 'for-linus' of git://neil.brown.name/md * 'for-linus' of git://neil.brown.name/md: md: Fix handling for devices from 2TB to 4TB in 0.90 metadata. md/raid1,10: Remove use-after-free bug in make_request. md/raid10: unify handling of write completion. Avoid dereferencing a 'request_queue' after last close. commit 27a7b260f71439c40546b43588448faac01adb93 Author: NeilBrown Date: Sat Sep 10 17:21:28 2011 +1000 md: Fix handling for devices from 2TB to 4TB in 0.90 metadata. 0.90 metadata uses an unsigned 32bit number to count the number of kilobytes used from each device. This should allow up to 4TB per device. However we multiply this by 2 (to get sectors) before casting to a larger type, so sizes above 2TB get truncated. Also we allow rdev->sectors to be larger than 4TB, so it is possible for the array to be resized larger than the metadata can handle. So make sure rdev->sectors never exceeds 4TB when 0.90 metadata is in used. Also the sanity check at the end of super_90_load should include level 1 as it used ->size too. (RAID0 and Linear don't use ->size at all). Reported-by: Pim Zandbergen Cc: stable@kernel.org Signed-off-by: NeilBrown commit 079fa166a2874985ae58b2e21e26e1cbc91127d4 Author: NeilBrown Date: Sat Sep 10 17:21:23 2011 +1000 md/raid1,10: Remove use-after-free bug in make_request. A single request to RAID1 or RAID10 might result in multiple requests if there are known bad blocks that need to be avoided. To detect if we need to submit another write request we test: if (sectors_handled < (bio->bi_size >> 9)) { However this is after we call **_write_done() so the 'bio' no longer belongs to us - the writes could have completed and the bio freed. So move the **_write_done call until after the test against bio->bi_size. This addresses https://bugzilla.kernel.org/show_bug.cgi?id=41862 Reported-by: Bruno Wolff III Tested-by: Bruno Wolff III Signed-off-by: NeilBrown commit 19d5f834d6aff7efb1c9353523865c5bce869470 Author: NeilBrown Date: Sat Sep 10 17:21:17 2011 +1000 md/raid10: unify handling of write completion. A write can complete at two different places: 1/ when the last member-device write completes, through raid10_end_write_request 2/ in make_request() when we remove the initial bias from ->remaining. These two should do exactly the same thing and the comment says they do, but they don't. So factor the correct code out into a function and call it in both places. This makes the code much more similar to RAID1. The difference is only significant if there is an error, and they usually take a while, so it is unlikely that there will be an error already when make_request is completing, so this is unlikely to cause real problems. Signed-off-by: NeilBrown commit 94007751bb02797ba87bac7aacee2731ac2039a3 Author: NeilBrown Date: Sat Sep 10 17:20:21 2011 +1000 Avoid dereferencing a 'request_queue' after last close. On the last close of an 'md' device which as been stopped, the device is destroyed and in particular the request_queue is freed. The free is done in a separate thread so it might happen a short time later. __blkdev_put calls bdev_inode_switch_bdi *after* ->release has been called. Since commit f758eeabeb96f878c860e8f110f94ec8820822a9 bdev_inode_switch_bdi will dereference the 'old' bdi, which lives inside a request_queue, to get a spin lock. This causes the last close on an md device to sometime take a spin_lock which lives in freed memory - which results in an oops. So move the called to bdev_inode_switch_bdi before the call to ->release. Cc: Christoph Hellwig Cc: Hugh Dickins Cc: Andrew Morton Cc: Wu Fengguang Acked-by: Wu Fengguang Cc: stable@kernel.org Signed-off-by: NeilBrown commit ed2888e906b56769b4ffabb9c577190438aa68b8 Author: Jon Mason Date: Thu Sep 8 16:41:18 2011 -0500 PCI: Remove MRRS modification from MPS setting code Modifying the Maximum Read Request Size to 0 (value of 128Bytes) has massive negative ramifications on some devices. Without knowing which devices have this issue, do not modify from the default value when walking the PCI-E bus in pcie_bus_safe mode. Also, make pcie_bus_safe the default procedure. Tested-by: Sven Schnelle Tested-by: Simon Kirby Tested-by: Stephen M. Cameron Reported-and-tested-by: Eric Dumazet Reported-and-tested-by: Niels Ole Salscheider References: https://bugzilla.kernel.org/show_bug.cgi?id=42162 Signed-off-by: Jon Mason Acked-by: Jesse Barnes Signed-off-by: Linus Torvalds commit 5307f6d5fb12fd01f9f321bc4a8fd77e74858647 Author: Shyam Iyer Date: Thu Sep 8 16:41:17 2011 -0500 Fix pointer dereference before call to pcie_bus_configure_settings Commit b03e7495a862 ("PCI: Set PCI-E Max Payload Size on fabric") introduced a potential NULL pointer dereference in calls to pcie_bus_configure_settings due to attempts to access pci_bus self variables when the self pointer is NULL. To correct this, verify that the self pointer in pci_bus is non-NULL before dereferencing it. Reported-by: Stanislaw Gruszka Signed-off-by: Shyam Iyer Signed-off-by: Jon Mason Acked-by: Jesse Barnes Signed-off-by: Linus Torvalds commit a6a5ed0dd36b4977789e888170f96840cc8b4501 Merge: 0d20fbbe82da 49bb1e619568 Author: Linus Torvalds Date: Fri Sep 9 15:50:25 2011 -0700 Merge branch 'for-linus' of git://dev.laptop.org/users/cjb/mmc * 'for-linus' of git://dev.laptop.org/users/cjb/mmc: mmc: sdhci-s3c: Fix mmc card I/O problem mmc: sd: UHS-I bus speed should be set last in UHS initialization mmc: sdhi: initialise mmc_data->flags before use mmc: core: use non-reentrant workqueue for clock gating mmc: core: prevent aggressive clock gating racing with ios updates mmc: rename mmc_host_clk_{ungate|gate} to mmc_host_clk_{hold|release} mmc: sdhci-esdhc-imx: add missing inclusion of linux/module.h commit 0d20fbbe82dadc43f50a4ca5346e962de23cf950 Merge: 0ec26fd06982 aca420bc51f4 Author: Linus Torvalds Date: Fri Sep 9 15:48:34 2011 -0700 Merge branch 'for-linus' of git://ceph.newdream.net/git/ceph-client * 'for-linus' of git://ceph.newdream.net/git/ceph-client: libceph: fix leak of osd structs during shutdown ceph: fix memory leak ceph: fix encoding of ino only (not relative) paths libceph: fix msgpool commit 0ec26fd0698285b31248e34bf1abb022c00f23d6 Author: Miklos Szeredi Date: Mon Sep 5 18:06:26 2011 +0200 vfs: automount should ignore LOOKUP_FOLLOW Prior to 2.6.38 automount would not trigger on either stat(2) or lstat(2) on the automount point. After 2.6.38, with the introduction of the ->d_automount() infrastructure, stat(2) and others would start triggering automount while lstat(2), etc. still would not. This is a regression and a userspace ABI change. Problem originally reported here: http://thread.gmane.org/gmane.linux.kernel.autofs/6098 It appears that there was an attempt at fixing various userspace tools to not trigger the automount. But since the stat system call is rather common it is impossible to "fix" all userspace. This patch reverts the original behavior, which is to not trigger on stat(2) and other symlink following syscalls. [ It's not really clear what the right behavior is. Apparently Solaris does the "automount on stat, leave alone on lstat". And some programs can get unhappy when "stat+open+fstat" ends up giving a different result from the fstat than from the initial stat. But the change in 2.6.38 resulted in problems for some people, so we're going back to old behavior. Maybe we can re-visit this discussion at some future date - Linus ] Reported-by: Leonardo Chiquitto Signed-off-by: Miklos Szeredi Acked-by: Ian Kent Cc: David Howells Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit 1c601beaf21671b5033169d04efeda462bf58f01 Author: Pieter-Augustijn Van Malleghem Date: Fri Sep 9 13:29:45 2011 -0700 Input: bcm5974 - add MacBookAir4,1 trackpad support This patch adds trackpad support for the MacBookAir4,1, released in July 2011. It is very similar to the MacBookAir4,2 patch submitted by Joshua Dillon and Chase Douglas. Signed-off-by: Pieter-Augustijn Van Malleghem Signed-off-by: Dmitry Torokhov commit 7caaf7efb98a4f713e4c8b16289e03874aace493 Author: Anton Vorontsov Date: Fri Sep 9 23:18:00 2011 +0400 ARM: cns3xxx: Fix newly introduced warnings in the PCIe code commit d5341942d784134f2997b3ff82cd63cf71d1f932 ("PCI: Make the struct pci_dev * argument of pci_fixup_irqs const") did not change argument of pdev_to_cnspci(), and thus introduced the following warnings: CHECK arch/arm/mach-cns3xxx/pcie.c pcie.c:177:60: warning: incorrect type in argument 1 (different modifiers) pcie.c:177:60: expected struct pci_dev *dev pcie.c:177:60: got struct pci_dev const *dev CC arch/arm/mach-cns3xxx/pcie.o pcie.c: In function 'cns3xxx_pcie_map_irq': pcie.c:177: warning: passing argument 1 of 'pdev_to_cnspci' discards qualifiers from pointer target type pcie.c:52: note: expected 'struct pci_dev *' but argument is of type 'const struct pci_dev *' This patch fixes the issue. Signed-off-by: Anton Vorontsov commit 83a497cab1baec75e3e493a96e3456db14729ce0 Author: Tommy Lin Date: Fri Jul 29 01:14:46 2011 +0800 ARM: cns3xxx: Fix compile error caused by hardware.h removed Commit c9d95fbe59e426eed7f16e7cac812e46ac4772d0 "ARM: convert PCI defines to variables" deleted cns3xxx' hardware.h, but didn't remove references for it, so do it now. This patch removes lines that refer to hardware.h. Signed-off-by: Tommy Lin Signed-off-by: Imre Kaloz Signed-off-by: Anton Vorontsov commit 55a01f6f6840b6310b073afabda649727d2ddb24 Author: Lin Ming Date: Wed Sep 7 22:58:09 2011 +0800 drm: Remove duplicate "return" statement Remove the duplicate "return" statement in drm_fb_helper_panic(). Signed-off-by: Lin Ming Signed-off-by: Dave Airlie commit 909d6e0cb6f947278e0479d67323d5bef6309a50 Merge: b06947b50053 0e83bb4eee1c Author: Dave Airlie Date: Fri Sep 9 09:10:04 2011 +0100 Merge branch 'drm-nouveau-fixes' of git://anongit.freedesktop.org/git/nouveau/linux-2.6 into drm-test * 'drm-nouveau-fixes' of git://anongit.freedesktop.org/git/nouveau/linux-2.6: drm/nv04/crtc: Bail out if FB is not bound to crtc drm/nouveau: fix nv04_sgdma_bind on non-"4kB pages" archs drm/nouveau: properly handle allocation failure in nouveau_sgdma_populate drm/nouveau: fix oops on pre-semaphore hardware drm/nv50/crtc: Bail out if FB is not bound to crtc commit 0e83bb4eee1c504ab98367b4f7d1bc337ab213d2 Author: Emil Velikov Date: Thu Aug 25 21:36:51 2011 +0100 drm/nv04/crtc: Bail out if FB is not bound to crtc This commit resolves a possible 'NULL pointer dereference' It uses the same approach as radeon, intel and nouveau/nv50 Fixes bug 'Nouveau: Kernel oops when unplugging external monitor' https://bugs.freedesktop.org/show_bug.cgi?id=40336 Signed-off-by: Emil Velikov Signed-off-by: Ben Skeggs commit 1bf27066017c820b8ab2a1ac8430ea470c2de0c3 Author: Marcin Slusarz Date: Mon Aug 22 23:22:13 2011 +0200 drm/nouveau: fix nv04_sgdma_bind on non-"4kB pages" archs nv04_sgdma_bind binds the same page multiple times on architectures where PAGE_SIZE != 4096. Let's fix it. Signed-off-by: Marcin Slusarz Signed-off-by: Ben Skeggs commit 17c8b960930da3599e47801a54ac0ea1070545d2 Author: Marcin Slusarz Date: Mon Aug 22 23:14:05 2011 +0200 drm/nouveau: properly handle allocation failure in nouveau_sgdma_populate Not cleaning after alloc failure would result in crash on destroy, because nouveau_sgdma_clear assumes "ttm_alloced" to be not null when "pages" is not null. Signed-off-by: Marcin Slusarz Cc: stable@kernel.org Signed-off-by: Ben Skeggs commit cfd8be088e97a762902a4820f501fb13102984e9 Author: Ben Skeggs Date: Tue Aug 23 10:23:11 2011 +1000 drm/nouveau: fix oops on pre-semaphore hardware Signed-off-by: Ben Skeggs commit ffbc559b0699891c6deb9fd2b4750671eab94999 Author: Emil Velikov Date: Sun Aug 21 22:48:12 2011 +0100 drm/nv50/crtc: Bail out if FB is not bound to crtc Fixes possbile NULL pointer dereference Resolves 'kernel crash in nv50_crtc_do_mode_set_base during shutdown' https://bugs.freedesktop.org/show_bug.cgi?id=40005 Signed-off-by: Emil Velikov Signed-off-by: Ben Skeggs commit e4e436e0bd480668834fe6849a52c5397b7be4fb Merge: 9ba365438a53 82babbb361f2 Author: Linus Torvalds Date: Thu Sep 8 16:49:32 2011 -0700 Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dma * 'fixes' of git://git.infradead.org/users/vkoul/slave-dma: dmaengine/ste_dma40: fix memory leak due to prepared descriptors dmaengine/ste_dma40: fix Oops due to double free of client descriptor dmaengine/ste_dma40: remove duplicate call to d40_pool_lli_free(). dmaengine/ste_dma40: add missing kernel doc for pending_queue commit 9ba365438a532436ecd96a089fb29b01516bed33 Merge: 3d0283ebc871 5204f5e3f5b3 Author: Linus Torvalds Date: Thu Sep 8 16:47:52 2011 -0700 Merge branch 'for-linus' of git://opensource.wolfsonmicro.com/regmap * 'for-linus' of git://opensource.wolfsonmicro.com/regmap: regmap: Remove bitrotted module_put()s commit 3d0283ebc8718f793a14971041b1c99afce714ac Merge: 4dcaadc3193d 882aba010524 Author: Linus Torvalds Date: Thu Sep 8 16:45:37 2011 -0700 Merge branch 'for-linus' of git://twin.jikos.cz/jikos/hid * 'for-linus' of git://twin.jikos.cz/jikos/hid: HID: wacom: Unregister sysfs attributes on remove HID: wacom: Fix error path of power-supply initialization HID: add support for HuiJia USB Gamepad connector HID: magicmouse: ignore 'ivalid report id' while switching modes, v2 HID: magicmouse: Set resolution of touch surfaces commit 4dcaadc3193d494baed79dc2055a6eefbebe0454 Merge: 4fbcc42dc4d0 96219c3a257c Author: Linus Torvalds Date: Thu Sep 8 16:42:34 2011 -0700 Merge branch 'for-31-rc5/i2c-fixes' of git://git.fluff.org/bjdooks/linux * 'for-31-rc5/i2c-fixes' of git://git.fluff.org/bjdooks/linux: i2c-tegra: fix possible race condition after tx i2c-tegra: add I2C_FUNC_SMBUS_EMUL i2c-tegra: Add of_match_table i2c-pxa2xx: return proper error code in ce4100_i2c_probe error paths commit 4fbcc42dc4d069aa941873ce28f3e98f51cb4fd3 Merge: bff747c58cf9 e33acde91140 Author: Linus Torvalds Date: Thu Sep 8 16:39:47 2011 -0700 Merge branch 'amd/fixes' of git://git.8bytes.org/scm/iommu * 'amd/fixes' of git://git.8bytes.org/scm/iommu: iommu/amd: Don't take domain->lock recursivly iommu/amd: Make sure iommu->need_sync contains correct value commit bff747c58cf97bf4fc8b499ee0f419b59d6b226d Author: Randy Dunlap Date: Thu Sep 8 10:16:47 2011 -0700 regulator: fix kernel-doc warning in consumer.h Fix kernel-doc warning about internal/private data by marking it as "private:" so that kernel-doc will ignore it. Warning(include/linux/regulator/consumer.h:128): No description found for parameter 'ret' Signed-off-by: Randy Dunlap Acked-by: Mark Brown Signed-off-by: Linus Torvalds commit d2f152878d457a84f3708acee5f682322386a79b Author: Randy Dunlap Date: Thu Sep 8 10:16:50 2011 -0700 wireless: fix kernel-doc warning in net/cfg80211.h Fix kernel-doc warning in net/cfg80211.h: Warning(include/net/cfg80211.h:1884): No description found for parameter 'registered' Signed-off-by: Randy Dunlap Signed-off-by: Linus Torvalds commit f10cd522c5fbfec9ae3cc01967868c9c2401ed23 Author: Stefano Stabellini Date: Tue Sep 6 17:41:47 2011 +0100 xen: disable PV spinlocks on HVM PV spinlocks cannot possibly work with the current code because they are enabled after pvops patching has already been done, and because PV spinlocks use a different data structure than native spinlocks so we cannot switch between them dynamically. A spinlock that has been taken once by the native code (__ticket_spin_lock) cannot be taken by __xen_spin_lock even after it has been released. Reported-and-Tested-by: Stefan Bader Signed-off-by: Stefano Stabellini Signed-off-by: Konrad Rzeszutek Wilk commit 3512069eefd3c3424b12f21a68fd473c3fd57220 Author: Jason Gerecke Date: Thu Sep 8 09:38:14 2011 -0700 Input: wacom - add POINTER and DIRECT device properties Adds INPUT_PROP_POINTER or INPUT_PROP_DIRECT as necessary to the hardware supported by the Wacom driver. The DIRECT property is assigned to devices with an embedded screen (i.e. touchscreens and display tablets). The POINTER property is assigned to those without embedded screens. Signed-off-by: Jason Gerecke Reviewed-by: Ping Cheng Signed-off-by: Dmitry Torokhov commit 79016f648872549392d232cd648bd02298c2d2bb Merge: e81b693c0104 486257130873 Author: Linus Torvalds Date: Wed Sep 7 13:03:48 2011 -0700 Merge branch 'timers-fixes-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip * 'timers-fixes-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip: rtc: twl: Fix registration vs. init order rtc: Initialized rtc_time->tm_isdst rtc: Fix RTC PIE frequency limit rtc: rtc-twl: Remove lockdep related local_irq_enable() rtc: rtc-twl: Switch to using threaded irq rtc: ep93xx: Fix 'rtc' may be used uninitialized warning alarmtimers: Avoid possible denial of service with high freq periodic timers alarmtimers: Memset itimerspec passed into alarm_timer_get alarmtimers: Avoid possible null pointer traversal commit e81b693c0104d6a767f998ee5a2e00b5acbbcd18 Merge: b0fb422281c8 feff8fa0075b Author: Linus Torvalds Date: Wed Sep 7 13:01:34 2011 -0700 Merge branch 'sched-fixes-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip * 'sched-fixes-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip: sched: Fix a memory leak in __sdt_free() sched: Move blk_schedule_flush_plug() out of __schedule() sched: Separate the scheduler entry for preemption commit b0fb422281c8c09c8dcf03ca44ec343f0ff9df0b Merge: 54d6d5374491 20afc60f892d Author: Linus Torvalds Date: Wed Sep 7 13:00:11 2011 -0700 Merge branch 'perf-fixes-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip * 'perf-fixes-for-linus' of git://tesla.tglx.de/git/linux-2.6-tip: x86, perf: Check that current->mm is alive before getting user callchain perf_event: Fix broken calc_timer_values() perf events: Fix slow and broken cgroup context switch code commit 54d6d5374491387eafe7f6e05e065232071cc4f0 Merge: 4fc1d39e079e 016f1c54408b 9efabc84768e Author: Linus Torvalds Date: Wed Sep 7 09:51:43 2011 -0700 Merge branch 'linux-next' of git://git.infradead.org/ubifs-2.6 and git://git.infradead.org/ubi-2.6 * branch 'linux-next' of git://git.infradead.org/ubifs-2.6: UBIFS: not build debug messages with CONFIG_UBIFS_FS_DEBUG disabled * branch 'linux-next' of git://git.infradead.org/ubi-2.6: UBI: do not link debug messages when debugging is disabled commit 4fc1d39e079e28a5daa2e6ffe6d27c064c7493ce Merge: 28c51ee3da3b f020b007d5dd Author: Linus Torvalds Date: Wed Sep 7 08:11:43 2011 -0700 Merge branch 'hwmon-for-linus' of git://github.com/groeck/linux * 'hwmon-for-linus' of git://github.com/groeck/linux: hwmon: (ucd9000/ucd9200) Optimize array walk hwmon: (max16065) Add chip access warning to documentation hwmon: (max16065) Fix current calculation commit 28c51ee3da3be98a3d7ce54250ec0b4d99826bb7 Merge: 115452675361 51b8b4fb3227 Author: Linus Torvalds Date: Wed Sep 7 07:48:00 2011 -0700 Merge branch 'for-linus' of git://github.com/ericvh/linux * 'for-linus' of git://github.com/ericvh/linux: fs/9p: Use protocol-defined value for lock/getlock 'type' field. fs/9p: Always ask new inode in lookup for cache mode disabled fs/9p: Add OS dependent open flags in 9p protocol net/9p: Fix kernel crash with msize 512K fs/9p: Don't update file type when updating file attributes fs/9p: Add fid before dentry instantiation commit 115452675361dbef2dfb59f4cbd922637be3dc5b Merge: 768b56f59869 ed467e69f16e Author: Linus Torvalds Date: Wed Sep 7 07:46:48 2011 -0700 Merge branch 'stable/bug.fixes' of git://oss.oracle.com/git/kwilk/xen * 'stable/bug.fixes' of git://oss.oracle.com/git/kwilk/xen: xen/smp: Warn user why they keel over - nosmp or noapic and what to use instead. xen: x86_32: do not enable iterrupts when returning from exception in interrupt context xen: use maximum reservation to limit amount of usable RAM commit 768b56f598694ed7215723d402ca3b388106b042 Merge: ddf28352b80c 3b217116edaa Author: Linus Torvalds Date: Wed Sep 7 07:45:43 2011 -0700 Merge branch 'kvm-updates/3.1' of git://github.com/avikivity/kvm * 'kvm-updates/3.1' of git://github.com/avikivity/kvm: KVM: Fix instruction size issue in pvclock scaling commit 882aba01052476cbe3cd7339a3e6784b2437f18d Merge: ddf28352b80c 9086617ea3a7 35d851df23b0 Author: Jiri Kosina Date: Wed Sep 7 13:53:17 2011 +0200 Merge branches 'upstream-fixes' and 'magicmouse' into for-linus commit 897a6a1a14837d6d582bfd1fd7aba00be44b6469 Author: Linus Walleij Date: Tue Aug 2 17:48:38 2011 +0200 ARM: davinci: fix cache flush build error The TNET variant of DaVinci compiles some code that it shares with other DaVinci variants, however it has a V6 CPU rather than an ARM926T, thus the hardcoded call to arm926_flush_kern_cache_all() in sleep.S will obviously fail, and we need to build with the v6_flush_kern_cache_all() call instead. This was triggered by manually altering the DaVinci config to build the TNET version. Cc: Dave Martin Cc: Arnd Bergmann Signed-off-by: Linus Walleij Signed-off-by: Sekhar Nori Cc: stable@kernel.org commit 9086617ea3a7f3e574ca64392b827bdd56f607eb Author: David Herrmann Date: Mon Sep 5 18:45:29 2011 +0200 HID: wacom: Unregister sysfs attributes on remove HID devices can be hotplugged so we should unregister all sysfs attributes when removing a driver. Otherwise, manually unloading the wacom-driver will not remove the sysfs attributes. Only when the device is disconnected, they are removed, eventually. Signed-off-by: David Herrmann Signed-off-by: Jiri Kosina commit dde58cfcc3b6dd2f160ffd355f76ae526155a4df Author: David Herrmann Date: Mon Sep 5 18:45:28 2011 +0200 HID: wacom: Fix error path of power-supply initialization power_supply_unregister() must not be called if power_supply_register() failed. The wdata->psy.dev pointer may point to invalid memory after a failed power_supply_register() and hence wacom_remove() will fail while calling power_supply_unregister(). This changes the wacom_probe function to fail if it cannot register the power_supply devices. If we would want to keep the previous behaviour we had to keep some flag about the power_supply state and check it on wacom_remove, but this seems inappropriate here. Hence, we simply fail, too, if power_supply_register fails. Signed-off-by: David Herrmann Signed-off-by: Jiri Kosina commit c08748005d56084a205f5c5db5f211b07a97a9be Author: Sergei Shtylyov Date: Fri Jul 8 19:24:57 2011 +0400 ARM: davinci: correct MDSTAT_STATE_MASK MDSTAT.STATE occupies bits 0..5 according to all available documentation, so fix the #define MDSTAT_STATE_MASK at last. Using the wrong value seems to have been harmless though... Signed-off-by: Sergei Shtylyov Signed-off-by: Sekhar Nori commit 810198bc9c109489dfadc57131c5183ce6ad2d7d Author: Rajashekhara, Sudhakar Date: Tue Jul 12 15:58:53 2011 +0530 ARM: davinci: da850 EVM: read mac address from SPI flash DA850/OMAP-L138 EMAC driver uses random mac address instead of a fixed one because the mac address is not stuffed into EMAC platform data. This patch provides a function which reads the mac address stored in SPI flash (registered as MTD device) and populates the EMAC platform data. The function which reads the mac address is registered as a callback which gets called upon addition of MTD device. NOTE: In case the MAC address stored in SPI flash is erased, follow the instructions at [1] to restore it. [1] http://processors.wiki.ti.com/index.php/GSG:_OMAP-L138_DVEVM_Additional_Procedures#Restoring_MAC_address_on_SPI_Flash Modifications in v2: Guarded registering the mtd_notifier only when MTD is enabled. Earlier this was handled using mtd_has_partitions() call, but this has been removed in Linux v3.0. Modifications in v3: a. Guarded da850_evm_m25p80_notify_add() function and da850evm_spi_notifier structure with CONFIG_MTD macros. b. Renamed da850_evm_register_mtd_user() function to da850_evm_setup_mac_addr() and removed the struct mtd_notifier argument to this function. c. Passed the da850evm_spi_notifier structure to register_mtd_user() function. Modifications in v4: Moved the da850_evm_setup_mac_addr() function within the first CONFIG_MTD ifdef construct. Signed-off-by: Rajashekhara, Sudhakar Signed-off-by: Sekhar Nori Cc: stable@kernel.org commit bac7e6ecf60933b68af910eb4c83a775a8b20b19 Author: Linus Walleij Date: Tue Sep 6 07:45:46 2011 +0100 ARM: 7080/1: l2x0: make sure I&D are not locked down on init Fighting unfixed U-Boots and other beasts that may the cache in a locked-down state when starting the kernel, we make sure to disable all cache lock-down when initializing the l2x0 so we are in a known state. Cc: Srinidhi Kasagar Cc: Rabin Vincent Cc: Adrian Bunk Cc: Rob Herring Cc: Catalin Marinas Cc: Will Deacon Reviewed-by: Santosh Shilimkar Reported-by: Jan Rinze Tested-by: Robert Marklund Signed-off-by: Linus Walleij Signed-off-by: Russell King commit bb9ea77846620ed2b37e74c852d72c7a476b248c Author: Linus Walleij Date: Tue Sep 6 08:08:13 2011 +0100 ARM: 7081/1: mach-integrator: fix the clocksource I was intrigued by the fact that the clock stood still on the Integrator, but it wasn't strange at all, because the timer was set up all wrong and probably has been for a while. With this patch the clock starts ticking again: make the timer periodic (reload), |= on the divisor bit and load the timer before starting it. Cc: stable@kernel.org Signed-off-by: Linus Walleij Signed-off-by: Russell King commit 96219c3a257cc8ba3b3cae67efdc88be37cf7c9d Author: Doug Anderson Date: Tue Aug 30 11:46:10 2011 -0600 i2c-tegra: fix possible race condition after tx In tegra_i2c_fill_tx_fifo, once we have finished pushing all the bytes to the I2C hardware controller, the interrupt might happen before we have updated i2c_dev->msg_buf_remaining at the end of the function. Then, in tegra_i2c_isr, we will call again tegra_i2c_fill_tx_fifo triggering weird behaviour. This has been shown to happen under real conditions. Signed-off-by: Doug Anderson Tested-by: Vincent Palatin Acked-by: Rhyland Klein Acked-by: Stephen Warren Signed-off-by: Stephen Warren Signed-off-by: Ben Dooks commit 048e29cff95168ea3a9f176e84cc0bae54d0ae64 Author: Mike Rapoport Date: Tue Aug 30 11:46:09 2011 -0600 i2c-tegra: add I2C_FUNC_SMBUS_EMUL Signed-off-by: Mike Rapoport Signed-off-by: Stephen Warren Signed-off-by: Ben Dooks commit 406bd18a7a39ef69f1d60a41d9de74932bcb98d4 Author: John Bonesio Date: Tue Aug 30 11:46:08 2011 -0600 i2c-tegra: Add of_match_table This patch was intended to be part of 7ca2d1a105a239e300b937e9c41a10a4bd08f569 "i2c: Tegra: Add DeviceTree support". However, an early version of that patch, which was missing a chunk, was applied to next-i2c. This change is that missing chunk. Signed-off-by: John Bonesio Signed-off-by: Stephen Warren Signed-off-by: Ben Dooks commit 7a703aded97e01d7f4a6b8440a431117399666ba Author: Axel Lin Date: Tue Aug 30 14:37:37 2011 +0800 i2c-pxa2xx: return proper error code in ce4100_i2c_probe error paths Signed-off-by: Axel Lin Acked-by: Sebastian Andrzej Siewior Signed-off-by: Ben Dooks commit 126caf1376e75ce597f993b66241210c7171b04e Author: Kevin Hilman Date: Thu Sep 1 10:59:36 2011 -0700 OMAP: omap_device: fix !CONFIG_SUSPEND case in _noirq handlers The suspend/resume _noirq handlers were #ifdef'd out in the !CONFIG_SUSPEND case, but were still assigned to the dev_pm_ops struct. Fix by defining them to NULL in the !CONFIG_SUSPEND case. Reported-by: Arnd Bergmann Acked-by: Arnd Bergmann Signed-off-by: Kevin Hilman commit f020b007d5dd24597f5e985a6309bcb8393797ed Author: Jean Delvare Date: Wed Aug 31 11:53:41 2011 -0400 hwmon: (ucd9000/ucd9200) Optimize array walk Rewrite the loop walking the id array during probe. The new code is better adapted to a null-terminated array, and is also clearer and more efficient than the original. Signed-off-by: Jean Delvare Cc: Axel Lin Cc: Guenter Roeck Signed-off-by: Guenter Roeck commit d91aae1e52e5289a94f4ddff968decfc8d37271e Author: Guenter Roeck Date: Mon Aug 29 22:53:20 2011 -0700 hwmon: (max16065) Add chip access warning to documentation The chips supported by the max16065 driver should not be accessed using direct i2ctools commands. Add warning to driver documentation to alert users. Signed-off-by: Guenter Roeck Acked-by: Jean Delvare commit ff71c182f461da5ae9d2d65f8a63f5a9193b9be1 Author: Guenter Roeck Date: Sun Aug 28 13:01:49 2011 -0700 hwmon: (max16065) Fix current calculation Current calculation is completely wrong. Add missing brackets to fix it. Signed-off-by: Guenter Roeck Acked-by: Jean Delvare Cc: stable@kernel.org # 3.0+ commit 417e206b16e18bc729346b6db668031498975b8e Author: Ming Lei Date: Fri Aug 19 16:57:54 2011 +0800 mfd: Fix omap-usb-host build failure The patch fixes the build failure: drivers/mfd/omap-usb-host.c:1034:1: warning: data definition has no type or storage class drivers/mfd/omap-usb-host.c:1034:1: warning: type defaults to 'int' in declaration of 'EXPORT_SYMBOL_GPL' drivers/mfd/omap-usb-host.c:1034:1: warning: parameter names (without types) in function declaration drivers/mfd/omap-usb-host.c:1040:1: warning: data definition has no type or storage class drivers/mfd/omap-usb-host.c:1040:1: warning: type defaults to 'int' in declaration of 'EXPORT_SYMBOL_GPL' drivers/mfd/omap-usb-host.c:1040:1: warning: parameter names (without types) in function declaration drivers/mfd/omap-usb-host.c:1045:13: error: 'THIS_MODULE' undeclared here (not in a function) drivers/mfd/omap-usb-host.c:1050:15: error: expected declaration specifiers or '...' before string constant drivers/mfd/omap-usb-host.c:1050:1: warning: data definition has no type or storage class drivers/mfd/omap-usb-host.c:1050:1: warning: type defaults to 'int' in declaration of 'MODULE_AUTHOR' drivers/mfd/omap-usb-host.c:1050:15: warning: function declaration isn't a prototype drivers/mfd/omap-usb-host.c:1051:14: error: expected declaration specifiers or '...' before string constant drivers/mfd/omap-usb-host.c:1051:1: warning: data definition has no type or storage class drivers/mfd/omap-usb-host.c:1051:1: warning: type defaults to 'int' in declaration of 'MODULE_ALIAS' drivers/mfd/omap-usb-host.c:1051:14: warning: function declaration isn't a prototype drivers/mfd/omap-usb-host.c:1052:16: error: expected declaration specifiers or '...' before string constant drivers/mfd/omap-usb-host.c:1052:1: warning: data definition has no type or storage class drivers/mfd/omap-usb-host.c:1052:1: warning: type defaults to 'int' in declaration of 'MODULE_LICENSE' drivers/mfd/omap-usb-host.c:1052:16: warning: function declaration isn't a prototype drivers/mfd/omap-usb-host.c:1053:20: error: expected declaration specifiers or '...' before string constant drivers/mfd/omap-usb-host.c:1053:1: warning: data definition has no type or storage class drivers/mfd/omap-usb-host.c:1053:1: warning: type defaults to 'int' in declaration of 'MODULE_DESCRIPTION' drivers/mfd/omap-usb-host.c:1053:20: warning: function declaration isn't a prototype make[2]: *** [drivers/mfd/omap-usb-host.o] Error 1 CC fs/proc/namespaces.o make[1]: *** [drivers/mfd] Error 2 make: *** [drivers] Error 2 make: *** Waiting for unfinished jobs.... Signed-off-by: Ming Lei Signed-off-by: Samuel Ortiz commit e600cffe618ff0da29ae1f8b8d3824ce0e2409fc Author: Anand Gadiyar Date: Thu Aug 18 16:14:31 2011 +0530 mfd: Make omap-usb-host TLL mode work again This code section seems to have been accidentally copy pasted. It causes incorrect bits to be set up in the TLL_CHANNEL_CONF register and prevents the TLL mode from working correctly. Cc: stable@kernel.org Signed-off-by: Anand Gadiyar Cc: Keshava Munegowda Acked-by: Felipe Balbi Signed-off-by: Samuel Ortiz commit 7eb3154e6caf7945ce60c196637b7ac06213befd Author: MyungJoo Ham Date: Thu Aug 18 16:37:35 2011 +0900 mfd: Set MAX8997 irq pointer Required platform information is not handed to max8997-irq.c properly. This patch enables to hand over such information to max8997-irq.c so that max8997-irq functions properly. Signed-off-by: MyungJoo Ham Signed-off-by: Kyungmin Park Signed-off-by: Samuel Ortiz commit fa948761e685fb03823b3029e5b6bdb52229d6ce Author: Johan Hovold Date: Mon Aug 15 12:42:03 2011 +0200 mfd: Fix initialisation of tps65910 interrupts Fix regression introduced by commit a2974732ca7614aaf0baf9d6dd3ad893d50ce1c5 (TPS65911: Add new irq definitions) which caused irq_num to be incorrectly set for tps65910. Cc: stable@kernel.org Signed-off-by: Johan Hovold Acked-by: Graeme Gregory Signed-off-by: Samuel Ortiz commit d0e84caeb4cd535923884735906e5730329505b4 Author: Kyle Manna Date: Thu Aug 11 22:33:14 2011 -0500 mfd: Check for twl4030-madc NULL pointer If the twl4030-madc device wasn't registered, and another device, such as twl4030-madc-hwmon, calls twl4030_madc_conversion() a NULL pointer is dereferenced. Signed-off-by: Kyle Manna Signed-off-by: Samuel Ortiz commit 66cc5b8e50af87b0bbd0f179d76d2826f4549c13 Author: Kyle Manna Date: Thu Aug 11 22:33:12 2011 -0500 mfd: Copy the device pointer to the twl4030-madc structure Worst case this fixes the following error: [ 72.086212] (NULL device *): conversion timeout! Best case it prevents a crash Signed-off-by: Kyle Manna Signed-off-by: Samuel Ortiz commit aa9d842c5f2da6cdef2777f2f062f61898be89d3 Author: Sascha Hauer Date: Wed Aug 10 10:05:49 2011 +0200 mfd: Rename wm8350 static gpio_set_debounce() The kernel already has a function with this name declared in asm-generic/gpio.h. So if this header leaks into wm8350/gpio.c we get drivers/mfd/wm8350-gpio.c:40:12: error: conflicting types for 'gpio_set_debounce' include/asm-generic/gpio.h:156:12: note: previous declaration of 'gpio_set_debounce' was here Fix this by adding a wm8350_ prefix to the function. Signed-off-by: Sascha Hauer Acked-by: Mark Brown Signed-off-by: Samuel Ortiz commit 8efcc57dedfebc99c3cd39564e3fc47cd1a24b75 Author: Mark Brown Date: Wed Aug 3 18:04:29 2011 +0900 mfd: Fix value of WM8994_CONFIGURE_GPIO This needs to be an out of band value for the register and on this device registers are 16 bit so we must shift left one to the 17th bit. Signed-off-by: Mark Brown Cc: stable@kernel.org Signed-off-by: Samuel Ortiz commit 51b8b4fb32271d39fbdd760397406177b2b0fd36 Author: Jim Garlick Date: Sun Aug 21 00:21:18 2011 +0530 fs/9p: Use protocol-defined value for lock/getlock 'type' field. Signed-off-by: Jim Garlick Signed-off-by: Aneesh Kumar K.V commit 73f507171cfa407b19f254aef95cbb058c8180cf Author: Aneesh Kumar K.V Date: Tue Aug 16 22:19:28 2011 +0530 fs/9p: Always ask new inode in lookup for cache mode disabled This make sure we don't end up reusing the unlinked inode object. The ideal way is to use inode i_generation. But i_generation is not available in userspace always. Signed-off-by: Aneesh Kumar K.V commit f88657ce3f9713a0c62101dffb0e972a979e77b9 Author: Aneesh Kumar K.V Date: Wed Aug 3 19:55:32 2011 +0530 fs/9p: Add OS dependent open flags in 9p protocol Some of the flags are OS/arch dependent we add a 9p protocol value which maps to asm-generic/fcntl.h values in Linux Based on the original patch from Venkateswararao Jujjuri Signed-off-by: Aneesh Kumar K.V commit b49d8b5d7007a673796f3f99688b46931293873e Author: Aneesh Kumar K.V Date: Wed Aug 17 16:56:04 2011 +0000 net/9p: Fix kernel crash with msize 512K With msize equal to 512K (PAGE_SIZE * VIRTQUEUE_NUM), we hit multiple crashes. This patch fix those. Signed-off-by: Aneesh Kumar K.V Signed-off-by: Eric Van Hensbergen commit 45089142b1497dab2327d60f6c71c40766fc3ea4 Author: Aneesh Kumar K.V Date: Mon Jul 25 18:06:33 2011 +0000 fs/9p: Don't update file type when updating file attributes We should only update attributes that we can change on stat2inode. Also do file type initialization in v9fs_init_inode. Signed-off-by: Aneesh Kumar K.V Signed-off-by: Eric Van Hensbergen commit 5441ae5eb3614d3c28f77073370738a2820c88e4 Author: Aneesh Kumar K.V Date: Mon Jul 25 18:06:32 2011 +0000 fs/9p: Add fid before dentry instantiation d_instantiate marks the dentry positive. So a parallel lookup and mkdir of the directory can find dentry that doesn't have fid attached. This can result in both the code path doing v9fs_fid_add which results in v9fs_dentry leak. Signed-off-by: Aneesh Kumar K.V Signed-off-by: Eric Van Hensbergen commit b06947b50053f2d21ad8ddf218cdb64fc8026896 Author: Alex Deucher Date: Fri Sep 2 14:23:09 2011 +0000 drm/radeon/kms: fix DP detect and EDID fetch for DP bridges Sink type is always DP for DP bridges and EDID fetch on DP bridges is always i2c over aux rather than plain i2c. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie commit c5d2e650bd805a00ff9af537d5b5dede598a198c Author: Lars-Peter Clausen Date: Mon Sep 5 13:49:57 2011 +0200 ASoC: Blackfin: bf5xx-ad193x: Fix codec device name Fix the codec_name field of the dai_link to match the actual device name of the codec. Otherwise the card won't be instantiated. Signed-off-by: Lars-Peter Clausen Acked-by: Liam Girdwood Signed-off-by: Mark Brown Cc: stable@kernel.org commit 747da0f80e566500421bd7760b2e050fea3fde5e Author: Mark Brown Date: Sun Sep 4 08:18:18 2011 -0700 ASoC: Fix reporting of partial jack updates We need to report the entire jack state to the core jack code, not just the bits that were being updated by the caller, otherwise the status reported by other detection methods will be omitted from the state seen by userspace. Signed-off-by: Mark Brown Acked-by: Liam Girdwood Cc: stable@kernel.org commit 5204f5e3f5b3c706e52682590de5974a82ea54f9 Author: Mark Brown Date: Mon Sep 5 08:07:47 2011 -0700 regmap: Remove bitrotted module_put()s The conversion to per bus type registration functions means we don't need to do module_get()s to hold the bus types in memory (their users will link to them) so we removed all those calls. This left module_put() calls in the cleanup paths which aren't needed and which cause unbalanced puts if we ever try to unload anything. Reported-by: Jonathan Cameron Signed-off-by: Mark Brown commit d7cb6667090511755fc8bb294982783b087baef7 Author: Jonas Bonn Date: Sat Jul 30 16:15:42 2011 +0200 openrisc: don't use pt_regs in struct sigcontext As it was decided not to export struct pt_regs to userspace, struct sigcontext shouldn't be using it either. The pt_regs struct for OpenRISC is kernel internal and the layout of the registers may change in the future. The struct user_regs_struct is what is guaranteed to remain stable, so struct sigcontext may use that instead. This patch removes the usage of struct pt_regs in struct sigcontext and makes according changes in signal.c to get the register layout right. The usp field is removed from the sigcontext structure as this information is already contained in the user_regs_struct. Signed-off-by: Jonas Bonn Reviewed-by: Emilio Cota commit 82babbb361f207a80cffa8ac34c2b6a0b62acc88 Author: Per Forlin Date: Mon Aug 29 13:33:35 2011 +0200 dmaengine/ste_dma40: fix memory leak due to prepared descriptors Prepared descriptors that are not submitted will not be freed. Add prepared descriptor to a list to be able to release them upon dmaengine_terminate_all(). Signed-off-by: Per Forlin Acked-by: Linus Walleij Signed-off-by: Vinod Koul commit 7404368c22b4910ab839238e48d96be45180f6fc Author: Per Forlin Date: Mon Aug 29 13:33:34 2011 +0200 dmaengine/ste_dma40: fix Oops due to double free of client descriptor The client list may exist in two lists at the same time. This makes free fail since the same desc is freed multiple times. Remove desc from client list when adding it to the pending queue. Move free of client owned descriptors from free_dma() to terminate_all(). Unable to handle kernel paging request at virtual address 00100104 pgd = dea8c000 [00100104] *pgd=1ea62831, *pte=00000000, *ppte=00000000 Internal error: Oops: 817 [#1] PREEMPT SMP Modules linked in: CPU: 0 Not tainted (3.1.0-rc3+ #58) PC is at d40_free_chan_resources+0x64/0x330 Signed-off-by: Per Forlin Acked-by: Linus Walleij Signed-off-by: Vinod Koul commit 3b3d5b0f855b3eec45a02832e97c3c1890ff8823 Author: Per Forlin Date: Mon Aug 29 13:33:33 2011 +0200 dmaengine/ste_dma40: remove duplicate call to d40_pool_lli_free(). d40_desc_free() already calls d40_pool_lli_free(). Signed-off-by: Per Forlin Acked-by: Linus Walleij Signed-off-by: Vinod Koul commit da063d260969c4e5e5f91d911ba87f7f6b48ead0 Author: Per Forlin Date: Mon Aug 29 13:33:32 2011 +0200 dmaengine/ste_dma40: add missing kernel doc for pending_queue Signed-off-by: Per Forlin Acked-by: Linus Walleij Signed-off-by: Vinod Koul commit 1df726ef0a700587a712a3660b2caa8e533c7de9 Author: Russell King Date: Mon Sep 5 08:58:29 2011 +0100 NET: am79c961: fix race in link status code The link status code operates from a timer, and writes the index register without first taking a lock. A well-placed interrupt between writing the index register and reading the data register could change the index register on us, which will return wrong data. Add the necessary lock. Signed-off-by: Russell King commit 876355014ce3a7ba8ca299522b215365b4a3fb61 Merge: 9c5f560173a4 e21757a05730 450a37d2eca6 10167873a415 b1cbdb00da2a Author: Paul Walmsley Date: Sun Sep 4 20:21:16 2011 -0600 Merge branches 'non_hwmod_compliant_fix_3.1rc', 'omap3_clock_fixes_3.1rc', 'omap4_clock_fixes_3.1rc', 'missing_2430_musb_adds_terminator_fix_3.1rc' and 'pwrdm_clkdm_fixes_3.1rc' into prcm-fixes-a-3.1rc commit 10167873a415ba642aa2eee0c310ebd5a4633573 Author: Paul Walmsley Date: Sun Sep 4 20:20:53 2011 -0600 OMAP2430: hwmod: musb: add missing terminator to omap2430_usbhsotg_addrs[] Add a missing array terminator to omap2430_usbhsotg_addrs[]. Without this terminator, the omap_hwmod resource building code runs off the end of the array, resulting in at least this error -- if not worse behavior: [ 0.578002] musb-omap2430: failed to claim resource 4 [ 0.583465] omap_device: musb-omap2430: build failed (-16) [ 0.589294] Could not build omap_device for musb-omap2430 usb_otg_hs This should have been part of commit 78183f3fdf76f422431a81852468be01b36db325 ("omap_hwmod: use a null structure record to terminate omap_hwmod_addr_space arrays") but was evidently missed. Signed-off-by: Paul Walmsley commit ddf28352b80c86754a6424e3a61e8bdf9213b3c7 Author: Linus Torvalds Date: Sun Sep 4 15:45:10 2011 -0700 Linux 3.1-rc5 commit fb492c9160f3d40d09456a79cc669fba74d7d9cc Author: Mark Rutland Date: Tue Aug 30 17:45:10 2011 +0100 ARM: 7067/1: mm: keep significant bits in pfn_valid When ARCH_HAS_HOLES_MEMORYMODEL is selected, pfn_valid calls memblock_is_memory to test validity of a pfn: > memblock_is_memory(pfn << PAGE_SHIFT); On LPAE systems this cuts off the top bits, as the shift occurs before the value is promoted to a phys_addr_t. This patch replaces the shift with a call to __pfn_to_phys (which casts pfn to phys_addr_t before shifting), preventing the loss of significant bits. Signed-off-by: Mark Rutland Acked-by: Will Deacon Signed-off-by: Russell King commit 09f40f98bfa2ac22a332a713629a2f8f92896834 Author: Jan Kara Date: Fri Sep 2 17:04:10 2011 -0600 mm: Add comment explaining task state setting in bdi_forker_thread() CC: Wu Fengguang CC: Andrew Morton Signed-off-by: Jan Kara Signed-off-by: Jens Axboe commit 5a042aa4b8e994a15d2c2ee750219971f0ab3905 Author: Jan Kara Date: Fri Sep 2 17:04:09 2011 -0600 mm: Cleanup clearing of BDI_pending bit in bdi_forker_thread() bdi_forker_thread() clears BDI_pending bit at the end of the main loop. However clearing of this bit must not be done in some cases which is handled by calling 'continue' from switch statement. That's kind of unusual construct and without a good reason so change the function into more intuitive code flow. CC: Wu Fengguang CC: Andrew Morton Signed-off-by: Jan Kara Signed-off-by: Jens Axboe commit 0b043686fd7136a47d9868e3386cefdc0452018f Merge: 4d7b5a116f9c d054ac16eeb6 Author: Linus Torvalds Date: Fri Sep 2 08:27:01 2011 -0700 Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/radeon/kms: make sure pci max read request size is valid on evergreen+ (v2) drm/radeon/kms: set a default max_pixel_clock commit 4d7b5a116f9c08719d98f81e21c7d47f672bdb69 Merge: b79c4f75e4d3 58d84c4ee038 Author: Linus Torvalds Date: Fri Sep 2 08:25:23 2011 -0700 Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs * 'for-linus' of git://oss.sgi.com/xfs/xfs: xfs: fix ->write_inode return values xfs: fix xfs_mark_inode_dirty during umount xfs: deprecate the nodelaylog mount option commit e33acde91140f1809952d1c135c36feb66a51887 Author: Joerg Roedel Date: Fri Sep 2 14:19:50 2011 +0200 iommu/amd: Don't take domain->lock recursivly The domain_flush_devices() function takes the domain->lock. But this function is only called from update_domain() which itself is already called unter the domain->lock. This causes a deadlock situation when the dma-address-space of a domain grows larger than 1GB. Cc: stable@kernel.org Signed-off-by: Joerg Roedel commit f1ca1512e765337a7c09eb875eedef8ea4e07654 Author: Joerg Roedel Date: Fri Sep 2 14:10:32 2011 +0200 iommu/amd: Make sure iommu->need_sync contains correct value The value is only set to true but never set back to false, which causes to many completion-wait commands to be sent to hardware. Fix it with this patch. Cc: stable@kernel.org Signed-off-by: Joerg Roedel commit 486257130873a2172d8eac2c182f7e578465bdd0 Merge: 6af7e471e5a7 7e72c6863475 Author: Thomas Gleixner Date: Fri Sep 2 10:50:05 2011 +0200 Merge branch 'fortglx/3.1/tip/timers/rtc' of git://git.linaro.org/people/jstultz/linux into timers/urgent commit d054ac16eeb658bccadb06b12c39cee22243b10f Author: Alex Deucher Date: Thu Sep 1 17:46:15 2011 +0000 drm/radeon/kms: make sure pci max read request size is valid on evergreen+ (v2) If the bios or OS sets the pci max read request size to 0 or an invalid value (6,7), it can result in a hang or slowdown. Check and set it to something sane if it's invalid. Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=42162 v2: use pci reg defines from include/linux/pci_regs.h Signed-off-by: Alex Deucher Cc: stable@kernel.org Reviewed-by: Michel Dänzer Signed-off-by: Dave Airlie commit ed467e69f16e6b480e2face7bc5963834d025f91 Author: Konrad Rzeszutek Wilk Date: Thu Sep 1 09:48:27 2011 -0400 xen/smp: Warn user why they keel over - nosmp or noapic and what to use instead. We have hit a couple of customer bugs where they would like to use those parameters to run an UP kernel - but both of those options turn of important sources of interrupt information so we end up not being able to boot. The correct way is to pass in 'dom0_max_vcpus=1' on the Xen hypervisor line and the kernel will patch itself to be a UP kernel. Fixes bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=637308 CC: stable@kernel.org Acked-by: Ian Campbell Signed-off-by: Konrad Rzeszutek Wilk commit d198d499148a0c64a41b3aba9e7dd43772832b91 Author: Igor Mammedov Date: Thu Sep 1 13:46:55 2011 +0200 xen: x86_32: do not enable iterrupts when returning from exception in interrupt context If vmalloc page_fault happens inside of interrupt handler with interrupts disabled then on exit path from exception handler when there is no pending interrupts, the following code (arch/x86/xen/xen-asm_32.S:112): cmpw $0x0001, XEN_vcpu_info_pending(%eax) sete XEN_vcpu_info_mask(%eax) will enable interrupts even if they has been previously disabled according to eflags from the bounce frame (arch/x86/xen/xen-asm_32.S:99) testb $X86_EFLAGS_IF>>8, 8+1+ESP_OFFSET(%esp) setz XEN_vcpu_info_mask(%eax) Solution is in setting XEN_vcpu_info_mask only when it should be set according to cmpw $0x0001, XEN_vcpu_info_pending(%eax) but not clearing it if there isn't any pending events. Reproducer for bug is attached to RHBZ 707552 CC: stable@kernel.org Signed-off-by: Igor Mammedov Acked-by: Jeremy Fitzhardinge Signed-off-by: Konrad Rzeszutek Wilk commit 58d84c4ee0389ddeb86238d5d8359a982c9f7a5b Author: Christoph Hellwig Date: Sat Aug 27 05:57:55 2011 +0000 xfs: fix ->write_inode return values Currently we always redirty an inode that was attempted to be written out synchronously but has been cleaned by an AIL pushed internall, which is rather bogus. Fix that by doing the i_update_core check early on and return 0 for it. Also include async calls for it, as doing any work for those is just as pointless. While we're at it also fix the sign for the EIO return in case of a filesystem shutdown, and fix the completely non-sensical locking around xfs_log_inode. Signed-off-by: Christoph Hellwig Reviewed-by: Dave Chinner Signed-off-by: Alex Elder (cherry picked from commit 297db93bb74cf687510313eb235a7aec14d67e97) Signed-off-by: Alex Elder commit d312ae878b6aed3912e1acaaf5d0b2a9d08a4f11 Author: David Vrabel Date: Fri Aug 19 15:57:16 2011 +0100 xen: use maximum reservation to limit amount of usable RAM Use the domain's maximum reservation to limit the amount of extra RAM for the memory balloon. This reduces the size of the pages tables and the amount of reserved low memory (which defaults to about 1/32 of the total RAM). On a system with 8 GiB of RAM with the domain limited to 1 GiB the kernel reports: Before: Memory: 627792k/4472000k available After: Memory: 549740k/11132224k available A increase of about 76 MiB (~1.5% of the unused 7 GiB). The reserved low memory is also reduced from 253 MiB to 32 MiB. The total additional usable RAM is 329 MiB. For dom0, this requires at patch to Xen ('x86: use 'dom0_mem' to limit the number of pages for dom0') (c/s 23790) CC: stable@kernel.org Signed-off-by: David Vrabel Signed-off-by: Konrad Rzeszutek Wilk commit 866e4ed77448a0c311e1b055eb72ea05423fd799 Author: Christoph Hellwig Date: Sat Aug 27 05:57:44 2011 +0000 xfs: fix xfs_mark_inode_dirty during umount During umount we do not add a dirty inode to the lru and wait for it to become clean first, but force writeback of data and metadata with I_WILL_FREE set. Currently there is no way for XFS to detect that the inode has been redirtied for metadata operations, as we skip the mark_inode_dirty call during teardown. Fix this by setting i_update_core nanually in that case, so that the inode gets flushed during inode reclaim. Alternatively we could enable calling mark_inode_dirty for inodes in I_WILL_FREE state, and let the VFS dirty tracking handle this. I decided against this as we will get better I/O patterns from reclaim compared to the synchronous writeout in write_inode_now, and always marking the inode dirty in some way from xfs_mark_inode_dirty is a better safetly net in either case. Signed-off-by: Christoph Hellwig Reviewed-by: Dave Chinner Signed-off-by: Alex Elder (cherry picked from commit da6742a5a4cc844a9982fdd936ddb537c0747856) Signed-off-by: Alex Elder commit aca420bc51f48b0701963ba3a6234442a0cabebd Author: Sage Weil Date: Wed Aug 31 14:45:53 2011 -0700 libceph: fix leak of osd structs during shutdown We want to remove all OSDs, not just those on the idle LRU. Signed-off-by: Sage Weil commit b79c4f75e4d3fbfd225660c12f29a7fafcd8e6d9 Merge: fd53f7d8eea9 8c0bec2151a4 Author: Linus Torvalds Date: Wed Aug 31 15:08:19 2011 -0700 Merge tag 'for_linus-20110831' of git://github.com/tytso/ext4 * tag 'for_linus-20110831' of git://github.com/tytso/ext4: ext4: remove i_mutex lock in ext4_evict_inode to fix lockdep complaining commit 49bb1e619568ec84785ceb366f07db2a6f0b64cc Author: Girish K S Date: Fri Aug 26 14:58:18 2011 +0530 mmc: sdhci-s3c: Fix mmc card I/O problem This patch fixes the problem in sdhci-s3c host driver for Samsung Soc's. During the card identification stage the mmc core driver enumerates for the best bus width in combination with the highest available data rate. It starts enumerating from the highest bus width (8) to lowest width (1). In case of few MMC cards the 4-bit bus enumeration fails and tries the 1-bit bus enumeration. When switched to 1-bit bus mode the host driver has to clear the previous bus width setting and apply the new setting. The current patch will clear the previous bus mode and apply the new mode setting. Signed-off-by: Girish K S Acked-by: Jaehoon Chung Cc: Signed-off-by: Chris Ball commit 93c712f99d8e412b2d297edfe9f59b90636897c1 Author: Subhash Jadavani Date: Tue Aug 9 12:19:31 2011 +0530 mmc: sd: UHS-I bus speed should be set last in UHS initialization mmc_sd_init_uhs_card function sets the driver type, current limit and bus speed mode on card as well as on host controller side. Currently bus speed mode is set by sending CMD6 to card and immediately setting the timing mode in host controller. But then before initiating tuning sequence, it also tries to set current limit by sending CMD6 to card which results in data timeout errors in controller if bus speed mode is SDR50/SDR104 mode. So basically bus speed mode should be set only after current limit is set in the card and immediately after setting the bus speed mode, tuning sequence should be initiated. Signed-off-by: Subhash Jadavani Reviewed-by: Arindam Nath Signed-off-by: Chris Ball commit b91df1593e361109f1fe665ce17c5e87ca60582b Author: Simon Horman Date: Fri Aug 19 10:07:07 2011 +0900 mmc: sdhi: initialise mmc_data->flags before use This corrects a logic error that I introduced in "mmc: sdhi: Add write16_hook" Reported-by: Magnus Damm Signed-off-by: Simon Horman Signed-off-by: Chris Ball commit 50a50f9248497484c678631a9c1a719f1aaeab79 Author: Mika Westerberg Date: Thu Aug 18 15:23:49 2011 +0300 mmc: core: use non-reentrant workqueue for clock gating The default multithread workqueue can cause the same work to be executed concurrently on a different CPUs. This isn't really suitable for clock gating as it might already gated the clock and gating it twice results both host->clk_old and host->ios.clock to be set to 0. To prevent this from happening we use system_nrt_wq instead. Signed-off-by: Mika Westerberg Reviewed-by: Linus Walleij Tested-by: Chris Ball Cc: Signed-off-by: Chris Ball commit 778e277cb82411c9002ca28ccbd216c4d9eb9158 Author: Mika Westerberg Date: Thu Aug 18 15:23:48 2011 +0300 mmc: core: prevent aggressive clock gating racing with ios updates We have seen at least two different races when clock gating kicks in in a middle of ios structure update. First one happens when ios->clock is changed outside of aggressive clock gating framework, for example via mmc_set_clock(). The race might happen when we run following code: mmc_set_ios(): ... if (ios->clock > 0) mmc_set_ungated(host); Now if gating kicks in right after the condition check we end up setting host->clk_gated to false even though we have just gated the clock. Next time a request is started we try to ungate and restore the clock in mmc_host_clk_hold(). However since we have host->clk_gated set to false the original clock is not restored. This eventually will cause the host controller to hang since its clock is disabled while we are trying to issue a request. For example on Intel Medfield platform we see: [ 13.818610] mmc2: Timeout waiting for hardware interrupt. [ 13.818698] sdhci: =========== REGISTER DUMP (mmc2)=========== [ 13.818753] sdhci: Sys addr: 0x00000000 | Version: 0x00008901 [ 13.818804] sdhci: Blk size: 0x00000000 | Blk cnt: 0x00000000 [ 13.818853] sdhci: Argument: 0x00000000 | Trn mode: 0x00000000 [ 13.818903] sdhci: Present: 0x1fff0000 | Host ctl: 0x00000001 [ 13.818951] sdhci: Power: 0x0000000d | Blk gap: 0x00000000 [ 13.819000] sdhci: Wake-up: 0x00000000 | Clock: 0x00000000 [ 13.819049] sdhci: Timeout: 0x00000000 | Int stat: 0x00000000 [ 13.819098] sdhci: Int enab: 0x00ff00c3 | Sig enab: 0x00ff00c3 [ 13.819147] sdhci: AC12 err: 0x00000000 | Slot int: 0x00000000 [ 13.819196] sdhci: Caps: 0x6bee32b2 | Caps_1: 0x00000000 [ 13.819245] sdhci: Cmd: 0x00000000 | Max curr: 0x00000000 [ 13.819292] sdhci: Host ctl2: 0x00000000 [ 13.819331] sdhci: ADMA Err: 0x00000000 | ADMA Ptr: 0x00000000 [ 13.819377] sdhci: =========================================== [ 13.919605] mmc2: Reset 0x2 never completed. and it never recovers. Second race might happen while running mmc_power_off(): static void mmc_power_off(struct mmc_host *host) { host->ios.clock = 0; host->ios.vdd = 0; [ clock gating kicks in here ] /* * Reset ocr mask to be the highest possible voltage supported for * this mmc host. This value will be used at next power up. */ host->ocr = 1 << (fls(host->ocr_avail) - 1); if (!mmc_host_is_spi(host)) { host->ios.bus_mode = MMC_BUSMODE_OPENDRAIN; host->ios.chip_select = MMC_CS_DONTCARE; } host->ios.power_mode = MMC_POWER_OFF; host->ios.bus_width = MMC_BUS_WIDTH_1; host->ios.timing = MMC_TIMING_LEGACY; mmc_set_ios(host); } If the clock gating worker kicks in while we are only partially updated the ios structure the host controller gets incomplete ios and might not work as supposed. Again on Intel Medfield platform we get: [ 4.185349] kernel BUG at drivers/mmc/host/sdhci.c:1155! [ 4.185422] invalid opcode: 0000 [#1] PREEMPT SMP [ 4.185509] Modules linked in: [ 4.185565] [ 4.185608] Pid: 4, comm: kworker/0:0 Not tainted 3.0.0+ #240 Intel Corporation Medfield/iCDKA [ 4.185742] EIP: 0060:[] EFLAGS: 00010083 CPU: 0 [ 4.185827] EIP is at sdhci_set_power+0x3e/0xd0 [ 4.185891] EAX: f5ff98e0 EBX: f5ff98e0 ECX: 00000000 EDX: 00000001 [ 4.185970] ESI: f5ff977c EDI: f5ff9904 EBP: f644fe98 ESP: f644fe94 [ 4.186049] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 [ 4.186125] Process kworker/0:0 (pid: 4, ti=f644e000 task=f644c0e0 task.ti=f644e000) [ 4.186219] Stack: [ 4.186257] f5ff98e0 f644feb0 c1365173 00000282 f5ff9460 f5ff96e0 f5ff96e0 f644feec [ 4.186418] c1355bd8 f644c0e0 c1499c3d f5ff96e0 f644fed4 00000006 f5ff96e0 00000286 [ 4.186579] f644fedc c107922b f644feec 00000286 f5ff9460 f5ff9700 f644ff10 c135839e [ 4.186739] Call Trace: [ 4.186802] [] sdhci_set_ios+0x1c3/0x340 [ 4.186883] [] mmc_gate_clock+0x68/0x120 [ 4.186963] [] ? _raw_spin_unlock_irqrestore+0x4d/0x60 [ 4.187052] [] ? trace_hardirqs_on+0xb/0x10 [ 4.187134] [] mmc_host_clk_gate_delayed+0xbe/0x130 [ 4.187219] [] ? process_one_work+0xf9/0x5b0 [ 4.187300] [] mmc_host_clk_gate_work+0xd/0x10 [ 4.187379] [] process_one_work+0x172/0x5b0 [ 4.187457] [] ? process_one_work+0xf9/0x5b0 [ 4.187538] [] ? mmc_host_clk_gate_delayed+0x130/0x130 [ 4.187625] [] worker_thread+0x118/0x330 [ 4.187700] [] ? preempt_schedule+0x2e/0x50 [ 4.187779] [] ? rescuer_thread+0x1f0/0x1f0 [ 4.187857] [] kthread+0x74/0x80 [ 4.187931] [] ? __init_kthread_worker+0x60/0x60 [ 4.188015] [] kernel_thread_helper+0x6/0xd [ 4.188079] Code: 81 fa 00 00 04 00 0f 84 a7 00 00 00 7f 21 81 fa 80 00 00 00 0f 84 92 00 00 00 81 fa 00 00 0 [ 4.188780] EIP: [] sdhci_set_power+0x3e/0xd0 SS:ESP 0068:f644fe94 [ 4.188898] ---[ end trace a7b23eecc71777e4 ]--- This BUG() comes from the fact that ios.power_mode was still in previous value (MMC_POWER_ON) and ios.vdd was set to zero. We prevent these by inhibiting the clock gating while we update the ios structure. Both problems can be reproduced by simply running the device in a reboot loop. Signed-off-by: Mika Westerberg Reviewed-by: Linus Walleij Tested-by: Chris Ball Cc: Signed-off-by: Chris Ball commit 08c14071fda4e69abb9d5b1566651cd092b158d3 Author: Mika Westerberg Date: Thu Aug 18 15:23:47 2011 +0300 mmc: rename mmc_host_clk_{ungate|gate} to mmc_host_clk_{hold|release} As per suggestion by Linus Walleij: > If you think the names of the functions are confusing then > you may rename them, say like this: > > mmc_host_clk_ungate() -> mmc_host_clk_hold() > mmc_host_clk_gate() -> mmc_host_clk_release() > > Which would make the usecases more clear (This is CC'd to stable@ because the next two patches, which fix observable races, depend on it.) Signed-off-by: Mika Westerberg Reviewed-by: Linus Walleij Cc: Signed-off-by: Chris Ball commit fd53f7d8eea9cd43c5fb6d316ea1ed128c9b8e45 Merge: e9208a4eec8a 43220aa0f22c Author: Linus Torvalds Date: Wed Aug 31 09:02:06 2011 -0700 Merge branch 'for-linus' of git://neil.brown.name/md * 'for-linus' of git://neil.brown.name/md: md/raid5: fix a hang on device failure. md: fix clearing of 'blocked' flag in the presence of bad blocks. md/linear: avoid corrupting structure while waiting for rcu_free to complete. md: use REQ_NOIDLE flag in md_super_write() md: ensure changes to 'write-mostly' are reflected in metadata. md: report failure if a 'set faulty' request doesn't. commit e9208a4eec8acbde7ede6516c39dea05f3b700dc Merge: 9e79e3e9dd96 0c81e4b426a1 Author: Linus Torvalds Date: Wed Aug 31 08:58:36 2011 -0700 Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: powerpc/p1023rds: Fix the error of bank-width of nor flash powerpc/85xx: enable caam crypto driver by default powerpc/85xx: enable the audio drivers in the defconfigs commit 8c0bec2151a47906bf779c6715a10ce04453ab77 Author: Jiaying Zhang Date: Wed Aug 31 11:50:51 2011 -0400 ext4: remove i_mutex lock in ext4_evict_inode to fix lockdep complaining The i_mutex lock and flush_completed_IO() added by commit 2581fdc810 in ext4_evict_inode() causes lockdep complaining about potential deadlock in several places. In most/all of these LOCKDEP complaints it looks like it's a false positive, since many of the potential circular locking cases can't take place by the time the ext4_evict_inode() is called; but since at the very least it may mask real problems, we need to address this. This change removes the flush_completed_IO() and i_mutex lock in ext4_evict_inode(). Instead, we take a different approach to resolve the software lockup that commit 2581fdc810 intends to fix. Rather than having ext4-dio-unwritten thread wait for grabing the i_mutex lock of an inode, we use mutex_trylock() instead, and simply requeue the work item if we fail to grab the inode's i_mutex lock. This should speed up work queue processing in general and also prevents the following deadlock scenario: During page fault, shrink_icache_memory is called that in turn evicts another inode B. Inode B has some pending io_end work so it calls ext4_ioend_wait() that waits for inode B's i_ioend_count to become zero. However, inode B's ioend work was queued behind some of inode A's ioend work on the same cpu's ext4-dio-unwritten workqueue. As the ext4-dio-unwritten thread on that cpu is processing inode A's ioend work, it tries to grab inode A's i_mutex lock. Since the i_mutex lock of inode A is still hold before the page fault happened, we enter a deadlock. Signed-off-by: Jiaying Zhang Signed-off-by: "Theodore Ts'o" commit 20afc60f892d285fde179ead4b24e6a7938c2f1b Author: Andrey Vagin Date: Tue Aug 30 12:32:36 2011 +0400 x86, perf: Check that current->mm is alive before getting user callchain An event may occur when an mm is already released. I added an event in dequeue_entity() and caught a panic with the following backtrace: [ 434.421110] BUG: unable to handle kernel NULL pointer dereference at 0000000000000050 [ 434.421258] IP: [] __get_user_pages_fast+0x9c/0x120 ... [ 434.421258] Call Trace: [ 434.421258] [] copy_from_user_nmi+0x51/0xf0 [ 434.421258] [] ? sched_clock_local+0x25/0x90 [ 434.421258] [] perf_callchain_user+0x128/0x170 [ 434.421258] [] ? __perf_event_header__init_id+0xed/0x100 [ 434.421258] [] perf_prepare_sample+0x200/0x280 [ 434.421258] [] __perf_event_overflow+0x1b8/0x290 [ 434.421258] [] ? tg_shares_up+0x0/0x670 [ 434.421258] [] ? walk_tg_tree+0x6a/0xb0 [ 434.421258] [] perf_swevent_overflow+0xc4/0xf0 [ 434.421258] [] do_perf_sw_event+0x1e0/0x250 [ 434.421258] [] perf_tp_event+0x44/0x70 [ 434.421258] [] ftrace_profile_sched_block+0xdf/0x110 [ 434.421258] [] dequeue_entity+0x2ad/0x2d0 [ 434.421258] [] dequeue_task_fair+0x1c/0x60 [ 434.421258] [] dequeue_task+0x9a/0xb0 [ 434.421258] [] deactivate_task+0x42/0xe0 [ 434.421258] [] thread_return+0x191/0x808 [ 434.421258] [] ? switch_task_namespaces+0x24/0x60 [ 434.421258] [] do_exit+0x464/0x910 [ 434.421258] [] do_group_exit+0x58/0xd0 [ 434.421258] [] sys_exit_group+0x17/0x20 [ 434.421258] [] system_call_fastpath+0x16/0x1b Signed-off-by: Andrey Vagin Signed-off-by: Peter Zijlstra Cc: stable@kernel.org Link: http://lkml.kernel.org/r/1314693156-24131-1-git-send-email-avagin@openvz.org Signed-off-by: Ingo Molnar commit 7f310a5d4e8525ac0cc2f58c973d2100ce034410 Author: Eric B Munson Date: Thu Jun 23 16:34:38 2011 -0400 perf_event: Fix broken calc_timer_values() We detected a serious issue with PERF_SAMPLE_READ and timing information when events were being multiplexing. Samples would have time_running > time_enabled. That was easy to reproduce with a libpfm4 example (ran 3 times to cause multiplexing on Core 2): $ syst_smpl -e uops_retired:freq=1 & $ syst_smpl -e uops_retired:freq=1 & $ syst_smpl -e uops_retired:freq=1 & IIP:0x0000000040062d ... PERIOD:2355332948 ENA=40144625315 RUN=60014875184 syst_smpl: WARNING: time_running > time_enabled 63277537998 uops_retired:freq=1 , scaled The bug was not present in kernel up to (and including) 3.0. It turns out the bug was introduced by the following commit: commit c4794295917ebeda8013b6cb9c8d71ab4f74a1fa events: Move lockless timer calculation into helper function The parameters of the function got reversed yet the call sites were not updated to reflect the change. That lead to time_running and time_enabled being swapped. That had no effect when there was no multiplexing because in that case time_running = time_enabled but it would show up in any other scenario. Signed-off-by: Stephane Eranian Signed-off-by: Peter Zijlstra Link: http://lkml.kernel.org/r/20110829124112.GA4828@quad Signed-off-by: Ingo Molnar commit 9adceaa5b3d2480e2252c4a7f9c4bd7d66b8c4a2 Author: Dave Airlie Date: Tue Aug 30 20:22:04 2011 +0100 drm/radeon/kms: set a default max_pixel_clock On some Power rv100 cards, we have no ATY OF table, but we have no combios table either, and hence we refuse all modes on VGA-0 since we end up with a 0 max pixel clock. Signed-off-by: Dave Airlie Cc: stable@kernel.org Reviewed-by: Alex Deucher Reviewed-by: Jerome Glisse commit 117ef9570bf3a332eca443231f41dd3a52fcfb2c Author: Fabio Estevam Date: Tue Aug 30 00:28:42 2011 -0300 ASoC: imx: Fix build warning of unused 'card' variable Fixes the following warning: CC sound/soc/imx/imx-pcm-fiq.o sound/soc/imx/imx-pcm-fiq.c: In function 'imx_pcm_fiq_new': sound/soc/imx/imx-pcm-fiq.c:243: warning: unused variable 'card' CC sound/soc/imx/imx-pcm-dma-mx2.o Signed-off-by: Fabio Estevam Signed-off-by: Mark Brown commit 6c5b756aaa3e4a20c8d4b47b9dc4799b9cfdfcb8 Author: Lars-Peter Clausen Date: Sat Aug 27 18:24:13 2011 +0200 ASoC: Fix register cache sync register_writable WARN_ONs Currently the condition for these WARN_ONs is reversed and they are placed before the actual check whether we are going to write to that register. So if the codec implements the register_writable callback we'll get a warning for each writable register when syncing the register cache. While we are at it change the check to use snd_soc_codec_writable_register instead of open-coding it. Signed-off-by: Lars-Peter Clausen Acked-by: Liam Girdwood Signed-off-by: Mark Brown commit 63fa0a288cfedca681175fe13cf15677e944cdb2 Author: Lars-Peter Clausen Date: Sat Aug 27 18:24:12 2011 +0200 ASoC: snd_soc_codec_{readable,writable}_register change default to true Change the default return value of snd_soc_codec_{readable,writable}_register to true when no codec specific callback for this function is given. Otherwise all registers of that codec will neither be readable nor writable, which is most certainly not what we want. Signed-off-by: Lars-Peter Clausen Acked-by: Liam Girdwood Signed-off-by: Mark Brown commit 728a52222461a8cf0d5c375da1ef514a72d5194b Author: Peter Ujfalusi Date: Fri Aug 26 16:33:52 2011 +0300 ASoC: soc-dapm: Fix parameter comment for snd_soc_dapm_free We have dapm_context instead of codec parameter. Signed-off-by: Peter Ujfalusi Signed-off-by: Mark Brown commit 43220aa0f22cd3ce5b30246d50ccd696d119edea Author: NeilBrown Date: Wed Aug 31 12:49:14 2011 +1000 md/raid5: fix a hang on device failure. Waiting for a 'blocked' rdev to become unblocked in the raid5d thread cannot work with internal metadata as it is the raid5d thread which will clear the blocked flag. This wasn't a problem in 3.0 and earlier as we only set the blocked flag when external metadata was used then. However we now set it always, so we need to be more careful. Signed-off-by: NeilBrown commit 0c81e4b426a17785ebd4f41d1e14a818706bdc90 Author: Chunhe Lan Date: Fri Aug 12 19:00:09 2011 +0800 powerpc/p1023rds: Fix the error of bank-width of nor flash In the p1023rds, a physical bus of nor flash is 16 bits width. The bank-width is width (in bytes) of the bus width. So, the value of bank-width of nor flash is not one, and it should be two. Signed-off-by: Chunhe Lan Signed-off-by: Kumar Gala commit e09e2fb51385fe6f9beca0a27ae6f1299097bbcd Author: Kim Phillips Date: Fri Jul 22 15:48:08 2011 -0500 powerpc/85xx: enable caam crypto driver by default corenet based SoCs have SEC4 h/w, so enable the SEC4 driver, caam, and the algorithms it supports, and disable the SEC2/3 driver, talitos. Signed-off-by: Kim Phillips Signed-off-by: Kumar Gala commit 39c428f753fc9514e5042d4ec736f80065e6c3a7 Author: Timur Tabi Date: Tue Aug 16 18:44:39 2011 -0400 powerpc/85xx: enable the audio drivers in the defconfigs Enable the audio drivers in the non-corenet 85xx defconfigs so that audio is enabled on the Freescale P1022DS reference board. Signed-off-by: Timur Tabi Signed-off-by: Kumar Gala commit e2faeec2de9e2c73958e6ea6065dde1e8cd6f3a2 Author: Jeff Kirsher Date: Tue Aug 30 20:58:56 2011 -0400 e1000: Fix driver to be used on PA RISC C8000 workstations The checksum field in the EEPROM on HPPA is really not a checksum but a signature (0x16d6). So allow 0x16d6 as the matching checksum on HPPA systems. This issue is present on longterm/stable kernels, I have verified that this patch is applicable back to at least 2.6.32.y kernels. v2- changed ifdef to use CONFIG_PARISC instead of __hppa__ CC: Guy Martin CC: Rolf Eike Beer CC: Matt Turner Reported-by: Mikulas Patocka Signed-off-by: Jeff Kirsher Acked-by: Jesse Brandeburg Signed-off-by: David S. Miller commit c8ad620638f97bdb7c8ef8cc788f08a04b14eadc Author: Wu Fengguang Date: Mon Aug 29 09:52:23 2011 -0600 writeback: show raw dirtied_when in trace writeback_single_inode Save inode->dirtied_when in the raw trace output for reliable scripting, and to also show in formatted output the relative age in seconds for easy human reading. CC: Jan Kara Acked-by: Christoph Hellwig Signed-off-by: Wu Fengguang commit 31a0479546a7f91ec959560be01a0b1243a2b20c Author: Ian Campbell Date: Mon Aug 29 23:42:58 2011 +0000 MAINTAINERS: Update BNA 10G Maintainer ddutt@brocade.com bounces with 550 "RESOLVER.ADR.RecipNotFound" Signed-off-by: Ian Campbell Cc: Rasesh Mody Cc: Andrew Morton Cc: Joe Perches Cc: netdev@vger.kernel.org Signed-off-by: David S. Miller commit 40a9f52e584936267228740bf7c16c5343166d11 Author: Ian Campbell Date: Mon Aug 29 23:41:09 2011 +0000 MAINTAINERS: Update Cisco VIC driver maintainers vkolluri@cisco.com bounces and I get "Unknown address error 550". Signed-off-by: Ian Campbell Cc: Christian Benvenuti Cc: Roopa Prabhu Cc: David Wang Cc: Andrew Morton Cc: Joe Perches Cc: netdev@vger.kernel.org Signed-off-by: David S. Miller commit bfbed02ff54b3f97c8a00ef1657049448f1f172a Author: Ian Campbell Date: Mon Aug 29 23:34:47 2011 +0000 MAINTAINERS: Update ATLX driver maintainers jie.yang@atheros.com bounces and I get a 550 "Unknown address error". Perhaps they have moved on? Signed-off-by: Ian Campbell Cc: Jay Cliburn Cc: Chris Snook Cc: Jie Yang Cc: Andrew Morton Cc: Joe Perches Cc: netdev@vger.kernel.org Signed-off-by: David S. Miller commit 29c486df6a208432b370bd4be99ae1369ede28d8 Author: Eric Dumazet Date: Tue Aug 30 18:57:00 2011 -0400 net: ipv4: relax AF_INET check in bind() commit d0733d2e29b65 (Check for mistakenly passed in non-IPv4 address) added regression on legacy apps that use bind() with AF_UNSPEC family. Relax the check, but make sure the bind() is done on INADDR_ANY addresses, as AF_UNSPEC has probably no sane meaning for other addresses. Bugzilla reference : https://bugzilla.kernel.org/show_bug.cgi?id=42012 Signed-off-by: Eric Dumazet Reported-and-bisected-by: Rene Meier CC: Marcus Meissner Signed-off-by: David S. Miller commit 785824165508a65478474f0c87f6b8c3ad048c62 Merge: ec0506dbe4e2 768b1031dc9f Author: David S. Miller Date: Tue Aug 30 17:43:56 2011 -0400 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-2.6 commit ec0506dbe4e240ecd4c32bf74c84a88ce1ddb414 Author: Maciej Żenczykowski Date: Sun Aug 28 12:35:31 2011 +0000 net: relax PKTINFO non local ipv6 udp xmit check Allow transparent sockets to be less restrictive about the source ip of ipv6 udp packets being sent. Google-Bug-Id: 5018138 Signed-off-by: Maciej Żenczykowski CC: "Erik Kline" CC: "Lorenzo Colitti" Signed-off-by: David S. Miller commit 0e4660cbe51276e86dbdab17228733dbcdb49249 Author: Felix Fietkau Date: Mon Aug 29 10:06:14 2011 +0200 ath9k_hw: fix calibration on 5 ghz ADC calibrations cannot run on 5 GHz with fast clock enabled. They need to be disabled, otherwise they'll hang and IQ mismatch calibration will not be run either. Signed-off-by: Felix Fietkau Reported-by: Adrian Chadd Cc: stable@kernel.org Signed-off-by: John W. Linville commit 9e79e3e9dd9672b37ac9412e9a926714306551fe Merge: ebde8b022302 1a8e0da5937a Author: Linus Torvalds Date: Tue Aug 30 11:28:18 2011 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc: sparc64: Only Panther cheetah+ chips have POPC. commit ebde8b0223020b0cdd18c284ab5c0bb67ebc787e Merge: bd823821e68e 302a8e8b06d3 Author: Linus Torvalds Date: Tue Aug 30 10:34:24 2011 -0700 Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/radeon/kms: add s/r quirk for Compaq Presario V5245EU drm/radeon/kms: evergreen & ni reset SPI block on CP resume drm: Fix the number of connector and encoder to cleanup functions commit bd823821e68e5de6d680cbbf1c8654c9c36674e1 Author: Geert Uytterhoeven Date: Tue Aug 30 15:17:03 2011 +0200 bitops: Move find_next_bit.o from lib-y to obj-y If there are no builtin users of find_next_bit_le() and find_next_zero_bit_le(), these functions are not present in the kernel image, causing m68k allmodconfig to fail with: ERROR: "find_next_zero_bit_le" [fs/ufs/ufs.ko] undefined! ERROR: "find_next_bit_le" [fs/udf/udf.ko] undefined! ... This started to happen after commit 171d809df189 ("m68k: merge mmu and non-mmu bitops.h"), as m68k had its own inline versions before. commit 63e424c84429 ("arch: remove CONFIG_GENERIC_FIND_{NEXT_BIT, BIT_LE, LAST_BIT}") added find_last_bit.o to obj-y (so it's always included), but find_next_bit.o to lib-y (so it gets removed by the linker if there are no builtin users). Signed-off-by: Geert Uytterhoeven Cc: Akinobu Mita Cc: Greg Ungerer Cc: Andrew Morton Signed-off-by: Linus Torvalds commit 768b1031dc9f3eabe3e9f603e33617a0215c12a8 Author: Patrick McHardy Date: Tue Aug 30 16:33:04 2011 +0200 netfilter: update netfilter git URL Netfilter git trees are moving to a directory shared by Pablo and myself, update git URLs. Signed-off-by: Patrick McHardy commit bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9 Author: Jozsef Kadlecsik Date: Tue Aug 30 15:46:13 2011 +0200 netfilter: nf_ct_tcp: wrong multiplication of TCPOLEN_TSTAMP_ALIGNED in tcp_sack skips fastpath The wrong multiplication of TCPOLEN_TSTAMP_ALIGNED by 4 skips the fast path for the timestamp-only option. Bug reported by Michael M. Builov (netfilter bugzilla #738). Signed-off-by: Jozsef Kadlecsik Signed-off-by: Patrick McHardy commit 4a5cc84ae7e19fb7a72a30332ba67af43e0ad1ad Author: Jozsef Kadlecsik Date: Tue Aug 30 15:45:10 2011 +0200 netfilter: nf_ct_tcp: fix incorrect handling of invalid TCP option Michael M. Builov reported that in the tcp_options and tcp_sack functions of netfilter TCP conntrack the incorrect handling of invalid TCP option with too big opsize may lead to read access beyond tcp-packet or buffer allocated on stack (netfilter bugzilla #738). The fix is to stop parsing the options at detecting the broken option. Signed-off-by: Jozsef Kadlecsik Signed-off-by: Patrick McHardy commit 4c6e4209662b2a4147cde16c2144a253a7430a49 Author: Sanket Shah Date: Tue Aug 30 15:23:03 2011 +0200 netfilter: nf_ct_pptp: fix DNATed PPTP connection address translation When both the server and the client are NATed, the set-link-info control packet containing the peer's call-id field is not properly translated. I have verified that it was working in 2.6.16.13 kernel previously but due to rewrite, this scenario stopped working (Not knowing exact version when it stopped working). Signed-off-by: Sanket Shah Signed-off-by: Patrick McHardy commit c6675233f9015d3c0460c8aab53ed9b99d915c64 Author: Florian Westphal Date: Tue Aug 30 15:01:20 2011 +0200 netfilter: nf_queue: reject NF_STOLEN verdicts from userspace A userspace listener may send (bogus) NF_STOLEN verdict, which causes skb leak. This problem was previously fixed via 64507fdbc29c3a622180378210ecea8659b14e40 (netfilter: nf_queue: fix NF_STOLEN skb leak) but this had to be reverted because NF_STOLEN can also be returned by a netfilter hook when iterating the rules in nf_reinject. Reject userspace NF_STOLEN verdict, as suggested by Michal Miroslaw. This is complementary to commit fad54440438a7c231a6ae347738423cbabc936d9 (netfilter: avoid double free in nf_reinject). Cc: Julian Anastasov Cc: Eric Dumazet Signed-off-by: Florian Westphal Signed-off-by: Patrick McHardy commit 3b217116edaac634bf31e85c35708298059a8171 Author: Duncan Sands Date: Tue Aug 30 10:58:22 2011 +0200 KVM: Fix instruction size issue in pvclock scaling Commit de2d1a524e94 ("KVM: Fix register corruption in pvclock_scale_delta") introduced a mul instruction that may have only a memory operand; the assembler therefore cannot select the correct size: pvclock.s:229: Error: no instruction mnemonic suffix given and no register operands; can't size instruction In this example the assembler is: #APP mul -48(%rbp) ; shrd $32, %rdx, %rax #NO_APP A simple solution is to use mulq. Signed-off-by: Duncan Sands Signed-off-by: Avi Kivity commit 302a8e8b06d312dcb3b718dfeb42aa912b5f426b Author: Alex Deucher Date: Mon Aug 29 14:55:25 2011 +0000 drm/radeon/kms: add s/r quirk for Compaq Presario V5245EU Fixes resume on Compaq Presario V5245EU. Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=41642 Signed-off-by: Alex Deucher Cc: stable@kernel.org Signed-off-by: Dave Airlie commit a49a50dad48586d42ebac1a6730c3a3cd5603421 Author: Jerome Glisse Date: Wed Aug 24 20:00:17 2011 +0000 drm/radeon/kms: evergreen & ni reset SPI block on CP resume For some reason SPI block is in broken state after module unloading. This lead to broken rendering after reloading module. Fix this by reseting SPI block in CP resume function Signed-off-by: Jerome Glisse Cc: stable@kernel.org Signed-off-by: Dave Airlie commit 7da64a0abc3b2c6cbd3521672e9bb74dd560bb89 Author: NeilBrown Date: Tue Aug 30 16:20:17 2011 +1000 md: fix clearing of 'blocked' flag in the presence of bad blocks. When the 'blocked' flag on a device is cleared while there are unacknowledged bad blocks we must fail the device. This is needed for backwards compatability of the interface. The code currently uses the wrong test for "unacknowledged bad blocks exist". Change it to the right test. Signed-off-by: NeilBrown commit 1a8e0da5937a6c87807083baa318cf8f98dac9aa Author: David S. Miller Date: Mon Aug 29 21:14:29 2011 -0700 sparc64: Only Panther cheetah+ chips have POPC. Signed-off-by: David S. Miller commit b33c25d6a62ac253caabda2b5f43258abff451c0 Author: Len Brown Date: Mon Aug 29 23:01:58 2011 -0400 acpica: ACPI_MAX_SLEEP should be 2 sec, not 20 This limit is a workaround for AML that sleeps too long, but the workaround didn't work b/c of a typo. https://bugzilla.kernel.org/show_bug.cgi?id=13195 Signed-off-by: Len Brown cc: stable@kernel.org # 2.6.35..3.0 commit 90e93648c41bd29a72f6ec55ce27a23c209eab8c Merge: 3ae627b5a6c8 25904157168d Author: Linus Torvalds Date: Mon Aug 29 16:34:07 2011 -0700 Merge branch 'fixes' of master.kernel.org:/home/rmk/linux-2.6-arm * 'fixes' of master.kernel.org:/home/rmk/linux-2.6-arm: ARM: pm: avoid writing the auxillary control register for ARMv7 ARM: pm: some ARMv7 requires a dsb in resume to ensure correctness ARM: pm: arm920/926: fix number of registers saved ARM: pm: CPU specific code should not overwrite r1 (v:p offset) ARM: 7066/1: proc-v7: disable SCTLR.TE when disabling MMU ARM: 7065/1: kexec: ensure new kernel is entered in ARM state ARM: 7003/1: vexpress: Add clock definition for the SP805. ARM: 7051/1: cpuimx* boards: fix mach-types errors ARM: 7019/1: Footbridge: select CLKEVT_I8253 for ARCH_NETWINDER ARM: 7015/1: ARM errata: Possible cache data corruption with hit-under-miss enabled ARM: 7014/1: cache-l2x0: Fix L2 Cache size calculation. ARM: 6967/1: ep93xx: ts72xx: fix board model detection ARM: 6965/1: ep93xx: add model detection for ts-7300 and ts-7400 boards ARM: cache: detect VIPT aliasing I-cache on ARMv6 ARM: twd: register clockevents device before enabling PPI ARM: realview: ensure visibility of writes during reset ARM: perf: make name of arm_pmu_type consistent ARM: perf: fix prototype of release_pmu ARM: fix perf build with uclibc toolchains commit 3ae627b5a6c8f6bf992eee6a3399a1854641a476 Merge: d4d7b2a11c42 039920ccdde7 Author: Linus Torvalds Date: Mon Aug 29 16:33:32 2011 -0700 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/linux-arm-soc * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/linux-arm-soc: ARM: mach-footbridge: add missing header file