commit 4c91a0e718837dddb8c06d5618c13d3b9fe68419 Author: Greg Kroah-Hartman Date: Thu Feb 28 05:39:14 2013 -0800 Linux 3.8.1 commit eec97fd507f92f35a87fcf59887f52167349d1ec Author: Ben Skeggs Date: Sat Feb 16 12:10:38 2013 +1000 drm/nv50/devinit: reverse the logic for running encoder init scripts commit ac8cc241a81941932da44993242e68c62e115ec7 upstream. A single U encoder table can match multiple DCB entries, whereas the reverse is not true and can lead to us not matching a DCB entry at all, and fail to initialise some encoders. Signed-off-by: Ben Skeggs Signed-off-by: Greg Kroah-Hartman commit bb1a1b5a6551b6598648abeb7863778df43a5b60 Author: Ben Skeggs Date: Sat Feb 16 12:01:59 2013 +1000 drm/nouveau/bios: store a type/mask hash in parsed dcb data commit 8e992c8d9eebc2bd3246252ee5c0422dbbbce7ae upstream. Matches format used by a couple of other vbios tables, useful to have laying around already calculated. Signed-off-by: Ben Skeggs Signed-off-by: Greg Kroah-Hartman commit a6ce39f8a5c3d15fe49fe632790435edd5f4dc7b Author: Ben Skeggs Date: Tue Feb 12 10:16:31 2013 +1000 drm/nouveau/bios: parse external transmitter type if off-chip commit f3ed1048715f2edc10c4dda6148b60e93f6282ed upstream. Signed-off-by: Ben Skeggs Signed-off-by: Greg Kroah-Hartman commit b8c53c85a6bd15bfd67ff19e1d921894be207685 Author: Fabio Baltieri Date: Mon Jan 7 17:47:41 2013 +0100 usb: musb: ux500: use clk_prepare_enable and clk_disable_unprepare commit 99d17cfa3bbc6f4edb175f819af59c6b9e245e82 upstream. This patch converts the module to use clk_prepare_enable and clk_disable_unprepare variants as required by common clock framework. Without this the system crash during probe function. Signed-off-by: Fabio Baltieri Acked-by: Linus Walleij Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 6a867cef9bfe392b9afcab6dd149ab7d524050c6 Author: Ming Lei Date: Fri Jan 4 23:13:58 2013 +0800 usb: musb: fix dependency on transceiver driver commit 25736e0c8269e9613aa6036fbc591818daa30d14 upstream. This patch let glue driver return -EPROBE_DEFER if the transceiver is not readly, so we can support defer probe on musb to fix the below error on 3.7-rc5 if transceiver drivers are built as module: [ 19.052490] unable to find transceiver of type USB2 PHY [ 19.072052] HS USB OTG: no transceiver configured [ 19.076995] musb-hdrc musb-hdrc.0.auto: musb_init_controller failed with status -19 [ 19.089355] musb-hdrc: probe of musb-hdrc.0.auto rejects match -19 [ 19.096771] driver: 'musb-omap2430': driver_bound: bound to device 'musb-omap2430' [ 19.105194] bus: 'platform': really_probe: bound device musb-omap2430 to driver musb-omap2430 [ 19.174407] bus: 'platform': add driver twl4030_usb [ 19.179656] bus: 'platform': driver_probe_device: matched device twl4030_usb with driver twl4030_usb [ 19.202270] bus: 'platform': really_probe: probing driver twl4030_usb with device twl4030_usb [ 19.214172] twl4030_usb twl4030_usb: HW_CONDITIONS 0xc0/192; link 3 [ 19.239624] musb-omap2430 musb-omap2430: musb core is not yet ready [ 19.246765] twl4030_usb twl4030_usb: Initialized TWL4030 USB module [ 19.254516] driver: 'twl4030_usb': driver_bound: bound to device 'twl4030_usb' [ 19.263580] bus: 'platform': really_probe: bound device twl4030_usb to driver twl4030_usb Cc: Sebastian Andrzej Siewior Signed-off-by: Ming Lei Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 0452c262ae9c36d5b896395bee1f7cf1e7962f75 Author: Ming Lei Date: Fri Jan 4 23:13:06 2013 +0800 usb: musb: core: fix failure path commit 681d1e8761ca773967bce9bd1bb2896f07279551 upstream. In the fail1~fail5 failure path, pm_runtime_disable() should be called to avoid 'Unbalanced pm_runtime_enable' error in next probe() which may be triggered by defer probe or next 'modprobe musb_hdrc'. Cc: Sebastian Andrzej Siewior Signed-off-by: Ming Lei Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit c8f96b36a83763b2cdedaec489eb39d3394a2366 Author: Josh Boyer Date: Thu Feb 14 09:39:09 2013 -0500 USB: usb-storage: unusual_devs update for Super TOP SATA bridge commit 18e03310b5caa6d11c1a8c61b982c37047693fba upstream. The current entry in unusual_cypress.h for the Super TOP SATA bridge devices seems to be causing corruption on newer revisions of this device. This has been reported in Arch Linux and Fedora. The original patch was tested on devices with bcdDevice of 1.60, whereas the newer devices report bcdDevice as 2.20. Limit the UNUSUAL_DEV entry to devices less than 2.20. This fixes https://bugzilla.redhat.com/show_bug.cgi?id=909591 The Arch Forum post on this is here: https://bbs.archlinux.org/viewtopic.php?id=152011 Reported-by: Carsten S. Tested-by: Carsten S. Signed-off-by: Josh Boyer Signed-off-by: Greg Kroah-Hartman commit dd150f1c63689150e3a7b72807a45383520035e6 Author: fangxiaozhi Date: Thu Feb 7 15:32:07 2013 +0800 USB: storage: properly handle the endian issues of idProduct commit cd060956c5e97931c3909e4a808508469c0bb9f6 upstream. 1. The idProduct is little endian, so make sure its value to be compatible with the current CPU. Make no break on big endian processors. Signed-off-by: fangxiaozhi Signed-off-by: Greg Kroah-Hartman commit ff8cce5dfd683b81b049ecfacc006a12623080ad Author: Roger Quadros Date: Thu Feb 14 17:08:09 2013 +0200 USB: ehci-omap: Fix autoloading of module commit 04753523266629b1cd0518091da1658755787198 upstream. The module alias should be "ehci-omap" and not "omap-ehci" to match the platform device name. The omap-ehci module should now autoload correctly. Signed-off-by: Roger Quadros Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit ea2870ffbe4082794b1beb25847fdad7fdd7ea17 Author: Bjørn Mork Date: Wed Feb 13 23:41:34 2013 +0100 USB: option: add Huawei "ACM" devices using protocol = vendor commit 1f3f687722fd9b29a0c2a85b4844e3b2a3585c63 upstream. The USB device descriptor of one identity presented by a few Huawei morphing devices have serial functions with class codes 02/02/ff, indicating CDC ACM with a vendor specific protocol. This combination is often used for MSFT RNDIS functions, and the CDC ACM class driver will therefore ignore such functions. The CDC ACM class driver cannot support functions with only 2 endpoints. The underlying serial functions of these modems are also believed to be the same as for alternate device identities already supported by the option driver. Letting the same driver handle these functions independently of the current identity ensures consistent handling and user experience. There is no need to blacklist these devices in the rndis_host driver. Huawei serial functions will either have only 2 endpoints or a CDC ACM functional descriptor with bmCapabilities != 0, making them correctly ignored as "non RNDIS" by that driver. Signed-off-by: Bjørn Mork Signed-off-by: Greg Kroah-Hartman commit c6567095d6ef41eb2d6365604fa69593fabc0c3a Author: Bjørn Mork Date: Tue Feb 12 13:42:24 2013 +0100 USB: option: add Yota / Megafon M100-1 4g modem commit cd565279e51bedee1b2988e84f9b3bef485adeb6 upstream. Interface layout: 00 CD-ROM 01 debug COM port 02 AP control port 03 modem 04 usb-ethernet Bus=01 Lev=02 Prnt=02 Port=01 Cnt=02 Dev#= 4 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=0408 ProdID=ea42 Rev= 0.00 S: Manufacturer=Qualcomm, Incorporated S: Product=Qualcomm CDMA Technologies MSM S: SerialNumber=353568051xxxxxx C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=84(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=86(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms Signed-off-by: Bjørn Mork Signed-off-by: Greg Kroah-Hartman commit a8907c21d0aa007b42134415685bd3de0f815771 Author: Bjørn Mork Date: Wed Jan 23 10:44:36 2013 +0100 USB: option: add and update Alcatel modems commit f8f0302bbcbd1b14655bef29f6996a2152be559d upstream. Adding three currently unsupported modems based on information from .inf driver files: Diag VID_1BBB&PID_0052&MI_00 AGPS VID_1BBB&PID_0052&MI_01 VOICE VID_1BBB&PID_0052&MI_02 AT VID_1BBB&PID_0052&MI_03 Modem VID_1BBB&PID_0052&MI_05 wwan VID_1BBB&PID_0052&MI_06 Diag VID_1BBB&PID_00B6&MI_00 AT VID_1BBB&PID_00B6&MI_01 Modem VID_1BBB&PID_00B6&MI_02 wwan VID_1BBB&PID_00B6&MI_03 Diag VID_1BBB&PID_00B7&MI_00 AGPS VID_1BBB&PID_00B7&MI_01 VOICE VID_1BBB&PID_00B7&MI_02 AT VID_1BBB&PID_00B7&MI_03 Modem VID_1BBB&PID_00B7&MI_04 wwan VID_1BBB&PID_00B7&MI_05 Updating the blacklist info for the X060S_X200 and X220_X500D, reserving interfaces for a wwan driver, based on wwan VID_1BBB&PID_0000&MI_04 wwan VID_1BBB&PID_0017&MI_06 Signed-off-by: Bjørn Mork Signed-off-by: Greg Kroah-Hartman commit f4138277476eb688132caa273102ec287f5035a3 Author: Maciej Sosnowski Date: Wed May 23 17:27:07 2012 +0200 dca: check against empty dca_domains list before unregister provider commit c419fcfd071cf34ba00f9f65282583772d2655e7 upstream. When providers get blocked unregister_dca_providers() is called ending up with dca_providers and dca_domain lists emptied. Dca should be prevented from trying to unregister any provider if dca_domain list is found empty. Reported-by: Jiang Liu Tested-by: Gaohuai Han Signed-off-by: Maciej Sosnowski Signed-off-by: Dan Williams Signed-off-by: Greg Kroah-Hartman commit 255ad6f9222cc28a7c76157fdeda8aa46029c34d Author: Guennadi Liakhovetski Date: Wed Nov 28 06:49:47 2012 +0000 dma: sh: Don't use ENODEV for failing slave lookup commit 7c1119bdd650fa58dad8157bc75c5fcf6ed97843 upstream. If dmaengine driver's .device_alloc_chan_resources() method returns -ENODEV, dma_request_channel() will decide, that the driver has been removed and will remove the device from its list. To prevent this use ENXIO if a slave lookup fails. Reported-by: Kuninori Morimoto Signed-off-by: Guennadi Liakhovetski Signed-off-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman commit 3a7b023830c56a1cf1d4fa8bcda1a94afc00b6d7 Author: Magnus Damm Date: Wed Feb 13 00:56:13 2013 +0900 gpio: em: Use irq_domain_add_simple() to fix runtime error commit c7886b18273b07042e25e8d3ba5c983837b84123 upstream. Adjust the gpio-em.c driver to reconsider the pdata->irq_base variable. Non-DT board code like for instance board-kzm9d.c needs to operate of a static IRQ range for platform devices. So this patch is updating the code to make use of the function irq_domain_add_simple() instead of irq_domain_add_linear(). Fixes a EMEV2 / KZM9D runtime error caused by the following commit: 7385500 gpio/em: convert to linear IRQ domain Signed-off-by: Magnus Damm Tested-by: Simon Horman Reported-by: Simon Horman Signed-off-by: Linus Walleij Signed-off-by: Greg Kroah-Hartman commit 2a4315c0903b46b5c82bbf30ccca55c731038c67 Author: Roger Quadros Date: Thu Feb 14 17:08:08 2013 +0200 USB: ehci-omap: Don't free gpios that we didn't request commit 428525f97153505e83983460a8d08a3210aa6b8a upstream. This driver does not request any gpios so don't free them. Fixes L3 bus error on multiple modprobe/rmmod of ehci_hcd with ehci-omap in use. Without this patch, EHCI will break on repeated insmod/rmmod of ehci_hcd for all OMAP2+ platforms that use EHCI and set 'phy_reset = true' in usbhs_omap_board_data. i.e. board-3430sdp.c: .phy_reset = true, board-3630sdp.c: .phy_reset = true, board-am3517crane.c: .phy_reset = true, board-am3517evm.c: .phy_reset = true, board-cm-t3517.c: .phy_reset = true, board-cm-t35.c: .phy_reset = true, board-devkit8000.c: .phy_reset = true, board-igep0020.c: .phy_reset = true, board-igep0020.c: .phy_reset = true, board-omap3beagle.c: .phy_reset = true, board-omap3evm.c: .phy_reset = true, board-omap3pandora.c: .phy_reset = true, board-omap3stalker.c: .phy_reset = true, board-omap3touchbook.c: .phy_reset = true, board-omap4panda.c: .phy_reset = false, board-overo.c: .phy_reset = true, board-zoom.c: .phy_reset = true, Signed-off-by: Roger Quadros Reviewed-by: Felipe Balbi Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit 98091839ad5b72f8aa2c9b22ed65cec6fa3bbf6f Author: Johannes Berg Date: Tue Feb 26 22:37:57 2013 +0100 mac80211: always unblock CSA queue stop when disconnecting Commit 5b36ebd8249f403c7edf7cf68d68e9a0d0f55243 upstream. In some cases when disconnecting after (or during?) CSA the queues might not recover, and then the only way to recover is reloading the module. Fix this by always unblocking the queue CSA reason when disconnecting. Reported-by: Jan-Michael Brummer Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman commit 322e31f2d47198dfd0f4e2b880cd1fbfa7a2931f Author: Cong Wang Date: Thu Feb 21 23:32:27 2013 +0000 vlan: adjust vlan_set_encap_proto() for its callers [ Upstream commit da8c87241c26aac81a64c7e4d21d438a33018f4e ] There are two places to call vlan_set_encap_proto(): vlan_untag() and __pop_vlan_tci(). vlan_untag() assumes skb->data points after mac addr, otherwise the following code vhdr = (struct vlan_hdr *) skb->data; vlan_tci = ntohs(vhdr->h_vlan_TCI); __vlan_hwaccel_put_tag(skb, vlan_tci); skb_pull_rcsum(skb, VLAN_HLEN); won't be correct. But __pop_vlan_tci() assumes points _before_ mac addr. In vlan_set_encap_proto(), it looks for some magic L2 value after mac addr: rawp = skb->data; if (*(unsigned short *) rawp == 0xFFFF) ... Therefore __pop_vlan_tci() is obviously wrong. A quick fix is avoiding using skb->data in vlan_set_encap_proto(), use 'vhdr+1' is always correct in both cases. Signed-off-by: Cong Wang Cc: David S. Miller Cc: Jesse Gross Acked-by: Jesse Gross Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 7bd46285b2bc213bb124a1ce995793a5788e3b36 Author: Mathias Krause Date: Sat Feb 23 01:13:47 2013 +0000 sock_diag: Fix out-of-bounds access to sock_diag_handlers[] [ Upstream commit 6e601a53566d84e1ffd25e7b6fe0b6894ffd79c0 ] Userland can send a netlink message requesting SOCK_DIAG_BY_FAMILY with a family greater or equal then AF_MAX -- the array size of sock_diag_handlers[]. The current code does not test for this condition therefore is vulnerable to an out-of-bound access opening doors for a privilege escalation. Signed-off-by: Mathias Krause Acked-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit a64f554348c7334e80acae165e8f0c302e50b07e Author: Kleber Sacilotto de Souza Date: Fri Feb 22 19:14:52 2013 +0000 mlx4_en: fix allocation of CPU affinity reverse-map [ Upstream commit 3770699675dd1b8fc1e86ff369eb3cce44e10082 ] The mlx4_en driver allocates the number of objects for the CPU affinity reverse-map based on the number of rx rings of the device. However, mlx4_assign_eq() calls irq_cpu_rmap_add() as many times as IRQ's are assigned to EQ's, which can be as large as mlx4_dev->caps.comp_pool. If caps.comp_pool is larger than rx_ring_num we will eventually hit the BUG_ON() in cpu_rmap_add(). Fix this problem by allocating space for the maximum number of CPU affinity reverse-map objects we might want to add. Signed-off-by: Kleber Sacilotto de Souza Acked-by: Amir Vadai Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 1707248f45ca2be86156c9ee2bf3dc34a9d55c8a Author: Kleber Sacilotto de Souza Date: Fri Feb 22 14:58:02 2013 +0000 mlx4_en: fix allocation of device tx_cq [ Upstream commit 427a96252d8eee7b9bbafce15bd37fa3387ede55 ] The memory to hold the network device tx_cq is not being allocated with the correct size in mlx4_en_init_netdev(). It should use MAX_TX_RINGS instead of MAX_RX_RINGS. This can cause problems if the number of tx rings being used is greater than MAX_RX_RINGS. Signed-off-by: Kleber Sacilotto de Souza Acked-by: Amir Vadai Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 46983ccad157df0e6dfa910b5255de6ddee35f04 Author: Yuchung Cheng Date: Fri Feb 22 08:59:06 2013 +0000 tcp: fix SYN-data space mis-accounting [ Upstream commit 1b63edd6ecc55c3a61b40297b49e2323783bddfd ] In fast open the sender unncessarily reduces the space available for data in SYN by 12 bytes. This is because in the sender incorrectly reserves space for TS option twice in tcp_send_syn_data(): tcp_mtu_to_mss() already accounts for TS option space. But it further reserves MAX_TCP_OPTION_SPACE when computing the payload space. Signed-off-by: Yuchung Cheng Acked-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 88bb40ba28f2ff6baf103b084eaaca8974b0a915 Author: Li Wei Date: Thu Feb 21 22:18:44 2013 +0000 ipv4: fix error handling in icmp_protocol. [ Upstream commit 5b0520425e5ea81ba95ec486dd6bbb59a09fff0e ] Now we handle icmp errors in each transport protocol's err_handler, for icmp protocols, that is ping_err. Since this handler only care of those icmp errors triggered by echo request, errors triggered by echo reply(which sent by kernel) are sliently ignored. So wrap ping_err() with icmp_err() to deal with those icmp errors. Signed-off-by: Li Wei Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 7e122d3c7c52acfa96c2939db26e7fd3cc96a651 Author: Eric Dumazet Date: Thu Feb 21 12:18:52 2013 +0000 ipv6: use a stronger hash for tcp [ Upstream commit 08dcdbf6a7b9d14c2302c5bd0c5390ddf122f664 ] It looks like its possible to open thousands of TCP IPv6 sessions on a server, all landing in a single slot of TCP hash table. Incoming packets have to lookup sockets in a very long list. We should hash all bits from foreign IPv6 addresses, using a salt and hash mix, not a simple XOR. inet6_ehashfn() can also separately use the ports, instead of xoring them. Reported-by: Neal Cardwell Signed-off-by: Eric Dumazet Cc: Yuchung Cheng Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 8044a3d3e58dc531791752ea593a76414d769479 Author: Li Wei Date: Thu Feb 21 00:09:54 2013 +0000 ipv4: fix a bug in ping_err(). [ Upstream commit b531ed61a2a2a77eeb2f7c88b49aa5ec7d9880d8 ] We should get 'type' and 'code' from the outer ICMP header. Signed-off-by: Li Wei Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit f2913b11974dfc6027c25080ec5f9349da76a2fc Author: YOSHIFUJI Hideaki Date: Wed Feb 20 00:29:08 2013 +0000 ipv6: fix race condition regarding dst->expires and dst->from. [ Upstream commit ecd9883724b78cc72ed92c98bcb1a46c764fff21 ] Eric Dumazet wrote: | Some strange crashes happen in rt6_check_expired(), with access | to random addresses. | | At first glance, it looks like the RTF_EXPIRES and | stuff added in commit 1716a96101c49186b | (ipv6: fix problem with expired dst cache) | are racy : same dst could be manipulated at the same time | on different cpus. | | At some point, our stack believes rt->dst.from contains a dst pointer, | while its really a jiffie value (as rt->dst.expires shares the same area | of memory) | | rt6_update_expires() should be fixed, or am I missing something ? | | CC Neil because of https://bugzilla.redhat.com/show_bug.cgi?id=892060 Because we do not have any locks for dst_entry, we cannot change essential structure in the entry; e.g., we cannot change reference to other entity. To fix this issue, split 'from' and 'expires' field in dst_entry out of union. Once it is 'from' is assigned in the constructor, keep the reference until the very last stage of the life time of the object. Of course, it is unsafe to change 'from', so make rt6_set_from simple just for fresh entries. Reported-by: Eric Dumazet Reported-by: Neil Horman CC: Gao Feng Signed-off-by: YOSHIFUJI Hideaki Reviewed-by: Eric Dumazet Reported-by: Steinar H. Gunderson Reviewed-by: Neil Horman Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit a515e3ea9d17fe16b2b15aab8dd7f85f9a3eabac Author: Eric Dumazet Date: Tue Feb 19 10:42:03 2013 -0800 ppp: set qdisc_tx_busylock to avoid LOCKDEP splat [ Upstream commit 303c07db487be59ae9fda10600ea65ca11c21497 ] If a qdisc is installed on a ppp device, its possible to get a lockdep splat under stress, because nested dev_queue_xmit() can lock busylock a second time (on a different device, so its a false positive) Avoid this problem using a distinct lock_class_key for ppp devices. Reported-by: Yanko Kaneti Tested-by: Yanko Kaneti Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 0680a2c2b6c92fdbb2ff8a8c87b0207db5323de7 Author: Romain KUNTZ Date: Mon Feb 18 02:36:24 2013 +0000 xfrm: release neighbor upon dst destruction [ Upstream commit 18cf0d0784b4a634472ed24d0d7ca1c721d93e90 ] Neighbor is cloned in xfrm6_fill_dst but seems to never be released. Neighbor entry should be released when XFRM6 dst entry is destroyed in xfrm6_dst_destroy, otherwise references may be kept forever on the device pointed by the neighbor entry. I may not have understood all the subtleties of XFRM & dst so I would be happy to receive comments on this patch. Signed-off-by: Romain Kuntz Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 2373718e7ac2bd28488778b38ef826c36aa4999a Author: Ying Xue Date: Fri Feb 15 22:28:25 2013 +0000 net: fix a compile error when SOCK_REFCNT_DEBUG is enabled [ Upstream commit dec34fb0f5b7873de45132a84a3af29e61084a6b ] When SOCK_REFCNT_DEBUG is enabled, below build error is met: kernel/sysctl_binary.o: In function `sk_refcnt_debug_release': include/net/sock.h:1025: multiple definition of `sk_refcnt_debug_release' kernel/sysctl.o:include/net/sock.h:1025: first defined here kernel/audit.o: In function `sk_refcnt_debug_release': include/net/sock.h:1025: multiple definition of `sk_refcnt_debug_release' kernel/sysctl.o:include/net/sock.h:1025: first defined here make[1]: *** [kernel/built-in.o] Error 1 make: *** [kernel] Error 2 So we decide to make sk_refcnt_debug_release static to eliminate the error. Signed-off-by: Ying Xue Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 38bb1c83c40157e4e8f683069a55334be32ea403 Author: David Vrabel Date: Thu Feb 14 03:18:58 2013 +0000 xen-netback: cancel the credit timer when taking the vif down [ Upstream commit 3e55f8b306cf305832a4ac78aa82e1b40e818ece ] If the credit timer is left armed after calling xen_netbk_remove_xenvif(), then it may fire and attempt to schedule the vif which will then oops as vif->netbk == NULL. This may happen both in the fatal error path and during normal disconnection from the front end. The sequencing during shutdown is critical to ensure that: a) vif->netbk doesn't become unexpectedly NULL; and b) the net device/vif is not freed. 1. Mark as unschedulable (netif_carrier_off()). 2. Synchronously cancel the timer. 3. Remove the vif from the schedule list. 4. Remove it from it netback thread group. 5. Wait for vif->refcnt to become 0. Signed-off-by: David Vrabel Acked-by: Ian Campbell Reported-by: Christopher S. Aker Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 8f56788f8d42ce5b5888ab7e9e7270646bcacd48 Author: David Vrabel Date: Thu Feb 14 03:18:57 2013 +0000 xen-netback: correctly return errors from netbk_count_requests() [ Upstream commit 35876b5ffc154c357476b2c3bdab10feaf4bd8f0 ] netbk_count_requests() could detect an error, call netbk_fatal_tx_error() but return 0. The vif may then be used afterwards (e.g., in a call to netbk_tx_error(). Since netbk_fatal_tx_error() could set vif->refcnt to 1, the vif may be freed immediately after the call to netbk_fatal_tx_error() (e.g., if the vif is also removed). Netback thread Xenwatch thread ------------------------------------------- netbk_fatal_tx_err() netback_remove() xenvif_disconnect() ... free_netdev() netbk_tx_err() Oops! Signed-off-by: Wei Liu Signed-off-by: Jan Beulich Signed-off-by: David Vrabel Reported-by: Christopher S. Aker Acked-by: Ian Campbell Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 8d33ee7534d7d8c0ee9f0aa5aad2fa4522463671 Author: Bjørn Mork Date: Wed Feb 13 12:09:52 2013 +0000 net: cdc_ncm: fix probing of devices with multiple control interface altsettings [ Upstream commit f350ca03703133c94fe742f6fa6ff0fd8f5a9a09 ] commit bd329e1 ("net: cdc_ncm: do not bind to NCM compatible MBIM devices") added a test for a CDC MBIM altsetting, implementing the cdc_ncm part of MBIM backward compatibility support. This intentionally made the driver behave differently for CDC NCM devices with 2 alternate settings for the Communication interface, depending on whether or not CONFIG_USB_NET_CDC_MBIM was enabled. This is correct iff alternate setting #1 really *is* a MBIM setting. If not, then NCM probing will use a different altsetting than before, possibly causing probing failures depending on CONFIG_USB_NET_CDC_MBIM. Fix by setting the altsetting back to default after the test, restoring the previous behaviour for non MBIM devices. This bug causes probing of Huawei E3276 devices to fail when the MBIM driver is enabled, because these devices have a second alternate setting with no CDC functional descriptors. Reported-and-tested-by: Jonathan A. Cc: Greg Suarez Cc: Alexey Orishko Signed-off-by: Bjørn Mork Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit e3bee3ddd2fe5af43ad52d837351eb1a12bb39dd Author: David Herrmann Date: Mon Feb 18 01:47:15 2013 +0100 HID: wiimote: fix nunchuck button parser commit 89bdd0c6f38ccf0de43d5a36ede384a730f3394e upstream. The buttons of the Wii Remote Nunchuck extension are actually active low. Fix the parser to forward the inverted values. The comment in the function always said "0 == pressed" but the implementation was wrong from the beginning. Reported-by: Victor Quicksilver Signed-off-by: David Herrmann Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit 2c3c78916a91b01d0571fbc1ae7434ca3c2d2288 Author: Balaji T K Date: Fri Jan 25 17:00:30 2013 +0530 mmc: core: expose RPMB partition only for CMD23 capable hosts commit d0123ccac55088811bde4f76c4a3fdbd39c3cfba upstream. SET_BLOCK_COUNT CMD23 is needed for all access to RPMB partition. If block count is not set by CMD23, all subsequent read/write commands fail as per eMMC specification. So, If the host does not support CMD23, do not expose RPMB partition. Accessing RPMB partition can cause hang / huge delay for hosts which do not support CMD23. Signed-off-by: Balaji T K Reported-and-Tested-by: Peter Ujfalusi Signed-off-by: Chris Ball Signed-off-by: Greg Kroah-Hartman commit 2f98d7620e47046548073bf3029f1af7a0f2d7b0 Author: Shawn Guo Date: Tue Jan 15 23:30:27 2013 +0800 mmc: sdhci-esdhc-imx: fix host version read commit ef4d0888bb7e1b963880f086575081c3d39cad2d upstream. When commit 95a2482 (mmc: sdhci-esdhc-imx: add basic imx6q usdhc support) works around host version issue on imx6q, it gets the register address fixup "reg ^= 2" lost for imx25/35/51/53 esdhc. Thus, the controller version on these SoCs is wrongly identified as v1 while it's actually v2. Add the address fixup back and take a different approach to correct imx6q host version, so that the host version read gets back to work for all SoCs. Signed-off-by: Shawn Guo Signed-off-by: Chris Ball Signed-off-by: Greg Kroah-Hartman commit c3e1d1ac1e2cb9fdb73d88427762358de63bc0ba Author: Dave Airlie Date: Fri Jan 25 11:38:56 2013 +1000 fbcon: fix locking harder commit 054430e773c9a1e26f38e30156eff02dedfffc17 upstream. Okay so Alan's patch handled the case where there was no registered fbcon, however the other path entered in set_con2fb_map pit. In there we called fbcon_takeover, but we also took the console lock in a couple of places. So push the console lock out to the callers of set_con2fb_map, this means fbmem and switcheroo needed to take the lock around the fb notifier entry points that lead to this. This should fix the efifb regression seen by Maarten. Tested-by: Maarten Lankhorst Tested-by: Lu Hua Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 65b0ff5839499e66e78f536af33fce96f86312a7 Author: Takashi Iwai Date: Fri Jan 25 10:28:18 2013 +1000 fb: Yet another band-aid for fixing lockdep mess commit e93a9a868792ad71cdd09d75e5a02d8067473c4e upstream. I've still got lockdep warnings even after Alan's patch, and it seems that yet more band aids are required to paper over similar paths for unbind_con_driver() and unregister_con_driver(). After this hack, lockdep warnings are finally gone. Signed-off-by: Takashi Iwai Cc: Alan Cox Cc: Florian Tobias Schandinat Cc: Jiri Kosina Tested-by: Sedat Dilek Signed-off-by: Andrew Morton Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit cace7c323ddde7358ab2f2390ece964c55f30330 Author: Alan Cox Date: Fri Jan 25 10:28:15 2013 +1000 fb: rework locking to fix lock ordering on takeover commit 50e244cc793d511b86adea24972f3a7264cae114 upstream. Adjust the console layer to allow a take over call where the caller already holds the locks. Make the fb layer lock in order. This is partly a band aid, the fb layer is terminally confused about the locking rules it uses for its notifiers it seems. [akpm@linux-foundation.org: remove stray non-ascii char, tidy comment] [akpm@linux-foundation.org: export do_take_over_console()] [airlied: cleanup another non-ascii char] Signed-off-by: Alan Cox Cc: Florian Tobias Schandinat Cc: Stephen Rothwell Cc: Jiri Kosina Tested-by: Sedat Dilek Reviewed-by: Daniel Vetter Signed-off-by: Andrew Morton Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit e0cfce95ff8e4789c35c02e7c1e0e88bc48ce54b Author: Dave Airlie Date: Thu Jan 24 16:12:41 2013 +1000 fbcon: don't lose the console font across generic->chip driver switch commit ae1287865f5361fa138d4d3b1b6277908b54eac9 upstream. If grub2 loads efifb/vesafb, then when systemd starts it can set the console font on that framebuffer device, however when we then load the native KMS driver, the first thing it does is tear down the generic framebuffer driver. The thing is the generic code is doing the right thing, it frees the font because otherwise it would leak memory. However we can assume that if you are removing the generic firmware driver (vesa/efi/offb), that a new driver *should* be loading soon after, so we effectively leak the font. However the old code left a dangling pointer in vc->vc_font.data and we can now reuse that dangling pointer to load the font into the new driver, now that we aren't freeing it. Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=892340 Signed-off-by: Dave Airlie Cc: Kay Sievers Signed-off-by: Greg Kroah-Hartman commit b175bab7e14904a9fc09128e0f88de89efdf9395 Author: Anatolij Gustschin Date: Sat Jan 19 10:59:10 2013 +0100 drivers/video: fsl-diu-fb: fix bugs in interrupt handling commit b2639b5f1d01f218dc95537a1c352b3a551c4dd5 upstream. Since commit f74de500 "drivers/video: fsl-diu-fb: streamline enabling of interrupts" the interrupt handling in the driver is broken. Enabling diu interrupt causes an interrupt storm and results in system lockup. The cookie for the interrupt handler function passed to request_irq() is wrong (it must be a pointer to the diu struct, and not the address of the pointer to the diu struct). As a result the interrupt handler can not read diu registers and acknowledge the interrupt. Fix cookie arguments for request_irq() and free_irq(). Registering the diu interrupt handler in probe() must happen before install_fb() calls since this function registers framebuffer devices and if fbcon tries to take over framebuffer after registering a frame buffer device, it will call fb_open of the diu driver and enable the interrupts. At this time the diu interrupt handler must be registered already. Disabling the interrupts in fsl_diu_release() must happen only if all other AOIs are closed. Otherwise closing an overlay plane will disable the interrupts even if the primary frame buffer plane is opened. Add an appropriate check in the release function. Signed-off-by: Anatolij Gustschin Cc: Timur Tabi Signed-off-by: Greg Kroah-Hartman commit bceed1271db7dbaf9ae6649d508f0577f49d4892 Author: Anatolij Gustschin Date: Thu Jan 17 21:28:37 2013 +0100 drivers/video: fsl-diu-fb: fix pixel formats for 24 and 16 bpp commit 5d3cc311a76073f6e0a27c0752f7e41f69e95ea7 upstream. Framebuffer colors for 24 and 16 bpp are currently wrong. The order of the color component arguments in the MAKE_PF() is not natural and causes some confusion. The generated pixel format values for 24 and 16 bpp depths do not much the values in the comments. Fix the macro arguments to be in the natural RGB order and adjust the arguments for all depths to generate correct pixel format values (equal to the values mentioned in the comments). Signed-off-by: Anatolij Gustschin Cc: Timur Tabi Acked-by: Timur Tabi Signed-off-by: Greg Kroah-Hartman commit 229cbc0903bd7c4eeb12b3618cfb7dd308e3c847 Author: Jean Delvare Date: Sun Dec 16 22:00:50 2012 +0100 pcmcia/vrc4171: Add missing spinlock init commit 811af9723859884f2f771f3174f3ddedab7c53b5 upstream. It doesn't seem this spinlock was properly initialized. This bug was introduced by commit 7a410e8d4d97457c8c381e2de9cdc7bd3306badc. Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit a6b3b3fb1ece9eafae7c1fb7d967f171517c0643 Author: John David Anglin Date: Mon Jan 14 19:45:00 2013 -0500 Purge existing TLB entries in set_pte_at and ptep_set_wrprotect commit 7139bc1579901b53db7e898789e916ee2fb52d78 upstream. This patch goes a long way toward fixing the minifail bug, and it  significantly improves the stability of SMP machines such as the rp3440.  When write  protecting a page for COW, we need to purge the existing translation.  Otherwise, the COW break doesn't occur as expected because the TLB may still have a stale entry which allows writes. [jejb: fix up checkpatch errors] Signed-off-by: John David Anglin Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit d6b8eaa075f9b994dac9fd63cf8622761ef62bfa Author: Thadeu Lima de Souza Cascardo Date: Fri Dec 28 09:13:19 2012 +0000 powerpc/eeh: Fix crash when adding a device in a slot with DDW commit 6a040ce72598159a74969a2d01ab0ba5ee6536b3 upstream. The DDW code uses a eeh_dev struct from the pci_dev. However, this is not set until eeh_add_device_late is called. Since pci_bus_add_devices is called before eeh_add_device_late, the PCI devices are added to the bus, making drivers' probe hooks to be called. These will call set_dma_mask, which will call the DDW code, which will require the eeh_dev struct from pci_dev. This would result in a crash, due to a NULL dereference. Calling eeh_add_device_late after pci_bus_add_devices would make the system BUG, because device files shouldn't be added to devices there were not added to the system. So, a new function is needed to add such files only after pci_bus_add_devices have been called. Signed-off-by: Thadeu Lima de Souza Cascardo Acked-by: Gavin Shan Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit 130d20b07b543f46f87ffc2b9bd1685b3bcbdbeb Author: Suzuki K. Poulose Date: Mon Jan 7 00:26:57 2013 +0000 uprobes/powerpc: Add dependency on single step emulation commit 5e249d4528528c9a77da051a89ec7f99d31b83eb upstream. Uprobes uses emulate_step in sstep.c, but we haven't explicitly specified the dependency. On pseries HAVE_HW_BREAKPOINT protects us, but 44x has no such luxury. Consolidate other users that depend on sstep and create a new config option. Signed-off-by: Ananth N Mavinakayanahalli Signed-off-by: Suzuki K. Poulose Cc: linuxppc-dev@ozlabs.org Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit ba16f36f25b9c2fd8b51477256f9a5698de2581b Author: Phileas Fogg Date: Sat Feb 23 00:32:19 2013 +0100 powerpc/kexec: Disable hard IRQ before kexec commit 8520e443aa56cc157b015205ea53e7b9fc831291 upstream. Disable hard IRQ before kexec a new kernel image. Not doing it can result in corrupted data in the memory segments reserved for the new kernel. Signed-off-by: Phileas Fogg Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Greg Kroah-Hartman commit db0f5de3c8c38c4a59b829c0117440bb851fbe0d Author: Joonsoo Kim Date: Sat Feb 9 05:52:45 2013 +0100 ARM: 7643/1: sched: correct update_sched_clock() commit 7c4e9ced424be4d36df6a3e3825763e97ee97607 upstream. If we want load epoch_cyc and epoch_ns atomically, we should update epoch_cyc_copy first of all. This notify reader that updating is in progress. If we update epoch_cyc first like as current implementation, there is subtle error case. Look at the below example. cyc = 9 ns = 900 cyc_copy = 9 == CASE 1 == write cyc = 10 read cyc = 10 read ns = 900 write ns = 1000 write cyc_copy = 10 read cyc_copy = 10 output = (10, 900) == CASE 2 == read cyc = 9 write cyc = 10 write ns = 1000 read ns = 1000 read cyc_copy = 9 write cyc_copy = 10 output = (9, 1000) If atomic read is ensured, output should be (9, 900) or (10, 1000). But, output in example case are not. So, change updating sequence in order to correct this problem. Signed-off-by: Joonsoo Kim Signed-off-by: Russell King Signed-off-by: Greg Kroah-Hartman commit 97730e9fae095b8a6da1d4b3494cc648a4c35bb1 Author: Will Deacon Date: Wed Feb 6 11:42:23 2013 +0000 arm64: compat: use compat_uptr_t type for compat_ucontext.uc_link commit c0e01d5d8f15c085236df184e5bc3d79a8b700cd upstream. struct compat_ucontext * is a 64-bit pointer, so we need to use a compat_uptr_t instead to avoid declaring a structure incompatible with what AArch32 userspace expects. Reported-by: Edmund Grimley-Evans Signed-off-by: Will Deacon Signed-off-by: Catalin Marinas Signed-off-by: Greg Kroah-Hartman commit 9165cb49782ac3321827334fd8a4d912bc902157 Author: Will Deacon Date: Wed Feb 6 18:25:12 2013 +0000 ARM: integrator: ensure ap_syscon_base is initialised when !CONFIG_MMU commit ab2a724a2ef9cee5957692257a5d1f08fd7acbbd upstream. When running on Integrator/AP using atags, ap_syscon_base is initialised in ->map_io, which isn't called for !MMU platforms. Instead, initialise the pointer in ->machine_init, as we do when booting with device-tree. Acked-by: Linus Walleij Signed-off-by: Will Deacon Signed-off-by: Olof Johansson Signed-off-by: Greg Kroah-Hartman commit 4622b3b7c0269bd2da531ea5949cadff98522da9 Author: Steffen Trumtrar Date: Wed Jan 30 14:16:00 2013 +0100 ARM: i.MX25: clk: parent per5_clk to AHB clock commit 4b526ca5f627188425184a22ed46c91baa602d43 upstream. The mxc-timer on the imx25 needs to be derived from the AHB clock. If a bootloader reparents this clock to the ipg_clk_highfreq, which according to the datasheet is a valid operation, the system can/will produce lockups/ freezes after some time [1]. This can be forced with code like while(1) syscall(SYS_clock_gettime, CLOCK_REALTIME, &tp); This was already fixed with the commit "i.MX25 GPT clock fix: ensure correct the clock source" [2], for 3.1-rc2, but was lost, when i.MX was converted to the common clock framework ("ARM i.MX25: implement clocks using common clock framework") [3] [1]: http://lists.arm.linux.org.uk/lurker/message/20130129.161230.229bda17.en.html [2]: 2012d9ca2a1381ae3e733330a7f0d1d2f1988bba [3]: 6bbaec5676e4f475b0d78743cbd4c70a8804ce14 Signed-off-by: Steffen Trumtrar Signed-off-by: Sascha Hauer Signed-off-by: Greg Kroah-Hartman commit 62c97eb5d650caec370f856d721ddacb1bcb3ab6 Author: Arnd Bergmann Date: Tue Jan 8 21:58:31 2013 +0000 ARM: samsung: fix assembly syntax for new gas commit 2815774bb38445006074e16251b9ef5123bdc616 upstream. Recent assembler versions complain about extraneous whitespace inside [] brackets. This fixes all of these instances for the samsung platforms. We should backport this to all kernels that might need to be built with new binutils. arch/arm/kernel/entry-armv.S: Assembler messages: arch/arm/kernel/entry-armv.S:214: Error: ARM register expected -- `ldr r2,[ r6,#(0x10)]' arch/arm/kernel/entry-armv.S:214: Error: ARM register expected -- `ldr r0,[ r6,#(0x14)]' arch/arm/kernel/entry-armv.S:430: Error: ARM register expected -- `ldr r2,[ r6,#(0x10)]' arch/arm/kernel/entry-armv.S:430: Error: ARM register expected -- `ldr r0,[ r6,#(0x14)]' arch/arm/mach-s3c24xx/sleep-s3c2410.S: Assembler messages: arch/arm/mach-s3c24xx/sleep-s3c2410.S:48: Error: ARM register expected -- `ldr r7,[ r4 ]' arch/arm/mach-s3c24xx/sleep-s3c2410.S:49: Error: ARM register expected -- `ldr r8,[ r5 ]' arch/arm/mach-s3c24xx/sleep-s3c2410.S:50: Error: ARM register expected -- `ldr r9,[ r6 ]' arch/arm/mach-s3c24xx/sleep-s3c2410.S:64: Error: ARM register expected -- `streq r7,[ r4 ]' arch/arm/mach-s3c24xx/sleep-s3c2410.S:65: Error: ARM register expected -- `streq r8,[ r5 ]' arch/arm/mach-s3c24xx/sleep-s3c2410.S:66: Error: ARM register expected -- `streq r9,[ r6 ]' arch/arm/kernel/debug.S: Assembler messages: arch/arm/kernel/debug.S:83: Error: ARM register expected -- `ldr r2,[ r2,#((0x0B0)+(((0x56000000)-(0x50000000))+(0xF6000000+(0x01000000))))-((0)+(((0x56000000)-(0x50000000))+(0xF6000000+(0x01000000))))]' arch/arm/kernel/debug.S:83: Error: ARM register expected -- `ldr r2,[ r3,#(0x18)]' arch/arm/kernel/debug.S:85: Error: ARM register expected -- `ldr r2,[ r2,#((0x0B0)+(((0x56000000)-(0x50000000))+(0xF6000000+(0x01000000))))-((0)+(((0x56000000)-(0x50000000))+(0xF6000000+(0x01000000))))]' arch/arm/kernel/debug.S:85: Error: ARM register expected -- `ldr r2,[ r3,#(0x18)]' arch/arm/mach-s3c24xx/pm-h1940.S: Assembler messages: arch/arm/mach-s3c24xx/pm-h1940.S:33: Error: ARM register expected -- `ldr pc,[ r0,#((0x0B8)+(((0x56000000)-(0x50000000))+(0xF6000000+(0x01000000))))-(((0x56000000)-(0x50000000))+(0xF6000000+(0x01000000)))]' arch/arm/mach-s3c24xx/sleep-s3c2412.S: Assembler messages: arch/arm/mach-s3c24xx/sleep-s3c2412.S:60: Error: ARM register expected -- `ldrne r9,[ r1 ]' arch/arm/mach-s3c24xx/sleep-s3c2412.S:61: Error: ARM register expected -- `strne r9,[ r1 ]' arch/arm/mach-s3c24xx/sleep-s3c2412.S:62: Error: ARM register expected -- `ldrne r9,[ r2 ]' arch/arm/mach-s3c24xx/sleep-s3c2412.S:63: Error: ARM register expected -- `strne r9,[ r2 ]' arch/arm/mach-s3c24xx/sleep-s3c2412.S:64: Error: ARM register expected -- `ldrne r9,[ r3 ]' arch/arm/mach-s3c24xx/sleep-s3c2412.S:65: Error: ARM register expected -- `strne r9,[ r3 ]' arch/arm/kernel/debug.S:83: Error: ARM register expected -- `ldr r2,[ r3,#(0x08)]' arch/arm/kernel/debug.S:83: Error: ARM register expected -- `ldr r2,[ r3,#(0x18)]' arch/arm/kernel/debug.S:83: Error: ARM register expected -- `ldr r2,[ r3,#(0x10)]' arch/arm/kernel/debug.S:85: Error: ARM register expected -- `ldr r2,[ r3,#(0x08)]' arch/arm/kernel/debug.S:85: Error: ARM register expected -- `ldr r2,[ r3,#(0x18)]' arch/arm/kernel/debug.S:85: Error: ARM register expected -- `ldr r2,[ r3,#(0x10)]' Signed-off-by: Arnd Bergmann Acked-by: Kukjin Kim Cc: Ben Dooks Signed-off-by: Greg Kroah-Hartman commit 6c1e1e2c227850d7a2f41e5fd129d82b826acd38 Author: Nicolas Ferre Date: Wed Jan 30 15:32:26 2013 +0100 ARM: at91/DT: remove atmel,use-dma-* from 9x5 and 9n12 USART nodes commit c3f0f282d950a1e87496a2633ed9e924e275ff8c upstream. Fix the use of USART on both at91sam9x5 and at91sam9n12. In DTS, the atmel,use-dma-[rx|tx] property is present but a DMA channel cannot be used. Indeed the connexion between the DMA engine and the slave is not implemented yet in Device Tree. Note however that this property is also used for PDC (private DMA) on older SoCs. This is why the driver alone cannot determine the validity of this property. Reported-by: Douglas Gilbert Signed-off-by: Nicolas Ferre Signed-off-by: Greg Kroah-Hartman commit d725d3b2afca8c83131357aec29a56fc809d5196 Author: Igor Grinberg Date: Sun Jan 13 13:49:47 2013 +0200 ARM: PXA3xx: program the CSMSADRCFG register commit d107a204154ddd79339203c2deeb7433f0cf6777 upstream. The Chip Select Configuration Register must be programmed to 0x2 in order to achieve the correct behavior of the Static Memory Controller. Without this patch devices wired to DFI and accessed through SMC cannot be accessed after resume from S2. Do not rely on the boot loader to program the CSMSADRCFG register by programming it in the kernel smemc module. Signed-off-by: Igor Grinberg Acked-by: Eric Miao Signed-off-by: Haojian Zhuang Signed-off-by: Greg Kroah-Hartman commit aae0966006dd119434078031c037cd6ef596f87f Author: Linus Walleij Date: Mon Jan 28 21:58:22 2013 +0100 ARM: 7635/1: versatile: fix the PCI IRQ regression commit e3e92a7be6936dff1de80e66b0b683d54e9e02d8 upstream. The PCI IRQs were regressing due to two things: - The PCI glue layer was using an hard-coded IRQ 27 offset. This caused the immediate regression. - The SIC IRQ mask was inverted (i.e. a bit was indeed set to one for each valid IRQ on the SIC, but accidentally inverted in the init call). This has been around forever, but we have been saved by some other forgiving code that would reserve IRQ descriptors in this range, as the versatile is non-sparse. When the IRQs were bumped up 32 steps so as to avoid using IRQ zero and avoid touching the 16 legacy IRQs, things broke. Introduce an explicit valid mask for the IRQs that are active on the PIC/SIC, and pass that. Use the BIT() macro from to make sure we hit the right bits, readily defined in . Reported-by: Tetsuo Handa Signed-off-by: Linus Walleij Signed-off-by: Russell King Cc: Paul Gortmaker Signed-off-by: Greg Kroah-Hartman commit e32ae42530f86a574007fbf57fbc08c2a445e939 Author: Ryo Tsutsui Date: Sun Feb 3 17:18:00 2013 +0900 ASoC: arizona: Fixed a bug in FLL fractional calculation commit 01f58153aefc158fd690b337d29ad140e963959d upstream. Previously arizona_calc_fll() was checking if the target frequency is exactly divisible by reference frequency, but should have been product of the ratio and the reference frequency. Also scale down the Lamba and Theta coefficients be under 16-bits in order to match the registers. Signed-off-by: Ryo Tsutsui Signed-off-by: Charles Keepax Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit e4822a5f9cccf33f8e371f5cd58ecae51b2c3e74 Author: Chris Rattray Date: Fri Feb 1 15:51:41 2013 +0000 ASoC: wm2200: correct IN2L and IN3L digital mute commit 0d2b6422529a26ac4dee06196524ba9da70cf735 upstream. Signed-off-by: Chris Rattray Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit e0079704759fc8a99eeb32e0fa20bca85d821947 Author: Malcolm Priestley Date: Wed Jan 30 20:07:29 2013 +0000 staging: vt6656: Fix URB submitted while active warning. commit ae5943de8c8c4438cbac5cda599ff0b88c224468 upstream. This error happens because PIPEnsControlOut and PIPEnsControlIn unlock the spin lock for delay, letting in another thread. The patch moves the current MP_SET_FLAG to before filling of sUsbCtlRequest for pControlURB and clears it in event of failing. Any thread calling either function while fMP_CONTROL_READS or fMP_CONTROL_WRITES flags set will return STATUS_FAILURE. Signed-off-by: Malcolm Priestley Signed-off-by: Greg Kroah-Hartman commit f928cb6cd36f22b1b4ee37553bbb0d33acfc82df Author: Malcolm Priestley Date: Tue Jan 22 20:13:34 2013 +0000 staging: vt6656: Revert: 64bit fixes: dpc.c incorrect addressing of void structure. commit 392c6ff87f568d573239b763855160d1f06114de upstream. The patch was totally wrong and is reverted. The problem was ultimately fixed by upstream commit. 1ee4c55fc9620451b2a825d793042a7e0775391b staging: vt6656: Fix inconsistent structure packing Reported-by: Ben Hutchings Signed-off-by: Malcolm Priestley Signed-off-by: Greg Kroah-Hartman commit 7b12be8563b3d5ebf121dd37227de37bf68123b0 Author: Malcolm Priestley Date: Tue Jan 22 20:12:34 2013 +0000 staging: vt6656: revert : 64 bit- Correctly address void structure. commit d61ac98a4bd86b3217f0c6e058bd0b3a3282899b upstream. The patch is wrong and is partially reverted. The NULL check of pTransmitKey->pvKeyTable is kept. The problem was ultimately fixed by upstream commit. 1ee4c55fc9620451b2a825d793042a7e0775391b staging: vt6656: Fix inconsistent structure packing Reported-by: Ben Hutchings Signed-off-by: Malcolm Priestley Signed-off-by: Greg Kroah-Hartman commit c82585afa07a05f8e2ed9c9fad5ca95a1ccfd8af Author: Ian Abbott Date: Fri Feb 1 14:51:58 2013 +0000 staging: comedi: ni_labpc: correct differential channel sequence for AI commands commit 4c4bc25d0fa6beaf054c0b4c3b324487f266c820 upstream. Tuomas reported problems getting meaningful output from a Lab-PC+ in differential mode for AI cmds, but AI insn reads gave correct readings. He tracked it down to two problems, one of which is addressed by this patch. It seems the setting of the channel bits for particular scanning modes was incorrect for differential mode. (Only half the number of channels are available in differential mode; comedi refers to them as channels 0, 1, 2 and 3, but the hardware documentation refers to them as channels 0, 2, 4 and 6.) In differential mode, the setting of the channel enable bits in the command1 register should depend on whether the scan enable bit is set. Effectively, we need to double the comedi channel number when the scan enable bit is not set in differential mode. The scan enable bit gets set when the AI scan mode is `MODE_MULT_CHAN_UP` or `MODE_MULT_CHAN_DOWN`, and gets cleared when the AI scan mode is `MODE_SINGLE_CHAN` or `MODE_SINGLE_CHAN_INTERVAL`. The existing test for whether the comedi channel number needs to be doubled in differential mode is incorrect in `labpc_ai_cmd()`. This patch corrects the test. Thanks to Tuomas for suggesting the fix. Signed-off-by: Ian Abbott Signed-off-by: Greg Kroah-Hartman commit 2a3eebf1655c01e55c4c8e96b3020aa532231fbc Author: Ian Abbott Date: Fri Feb 1 14:51:57 2013 +0000 staging: comedi: ni_labpc: set up command4 register *after* command3 commit 22056e2b46246d97ff0f7c6e21a77b8daa07f02c upstream. Tuomas reported problems getting meaningful output from a Lab-PC+ in differential mode for AI cmds, but AI insn reads gave correct readings. He tracked it down to two problems, one of which is addressed by this patch. It seems that writing to the command3 register after writing to the command4 register in `labpc_ai_cmd()` messes up the differential reference bit setting in the command4 register. Set up the command4 register after the command3 register (as in `labpc_ai_rinsn()`) to avoid the problem. Thanks to Tuomas for suggesting the fix. Signed-off-by: Ian Abbott Signed-off-by: Greg Kroah-Hartman commit 702734473aa1cf40a8298f63766f22fced36cdd0 Author: Ian Abbott Date: Mon Jan 28 16:14:31 2013 +0000 staging: comedi: disallow COMEDI_DEVCONFIG on non-board minors commit 754ab5c0e55dd118273ca2c217c4d95e9fbc8259 upstream. Comedi has two sorts of minor devices: (a) normal board minor devices in the range 0 to COMEDI_NUM_BOARD_MINORS-1 inclusive; and (b) special subdevice minor devices in the range COMEDI_NUM_BOARD_MINORS upwards that are used to open the same underlying comedi device as the normal board minor devices, but with non-default read and write subdevices for asynchronous commands. The special subdevice minor devices get created when a board supporting asynchronous commands is attached to a normal board minor device, and destroyed when the board is detached from the normal board minor device. One way to attach or detach a board is by using the COMEDI_DEVCONFIG ioctl. This should only be used on normal board minors as the special subdevice minors are too ephemeral. In particular, the change introduced in commit 7d3135af399e92cf4c9bbc5f86b6c140aab3b88c ("staging: comedi: prevent auto-unconfig of manually configured devices") breaks horribly for special subdevice minor devices. Since there's no legitimate use for the COMEDI_DEVCONFIG ioctl on a special subdevice minor device node, disallow it and return -ENOTTY. Signed-off-by: Ian Abbott Signed-off-by: Greg Kroah-Hartman commit 0b60ac0d2c88517452c8d77eacfaf85d546ed167 Author: Minchan Kim Date: Mon Jan 28 10:00:08 2013 +0900 staging: zsmalloc: Fix TLB coherency and build problem commit 9915518887e83764269d5b617d01782893877ed3 upstream. Recently, Matt Sealey reported he fail to build zsmalloc caused by using of local_flush_tlb_kernel_range which are architecture dependent function so !CONFIG_SMP in ARM couldn't implement it so it ends up build error following as. MODPOST 216 modules LZMA arch/arm/boot/compressed/piggy.lzma AS arch/arm/boot/compressed/lib1funcs.o ERROR: "v7wbi_flush_kern_tlb_range" [drivers/staging/zsmalloc/zsmalloc.ko] undefined! make[1]: *** [__modpost] Error 1 make: *** [modules] Error 2 make: *** Waiting for unfinished jobs.... The reason we used that function is copy method by [1] was really slow in ARM but at that time. More severe problem is ARM can prefetch speculatively on other CPUs so under us, other TLBs can have an entry only if we do flush local CPU. Russell King pointed that. Thanks! We don't have many choices except using flush_tlb_kernel_range. My experiment in ARMv7 processor 4 core didn't make any difference with zsmapbench[2] between local_flush_tlb_kernel_range and flush_tlb_kernel_range but still page-table based is much better than copy-based. * bigger is better. 1. local_flush_tlb_kernel_range: 3918795 mappings 2. flush_tlb_kernel_range : 3989538 mappings 3. copy-based: 635158 mappings This patch replace local_flush_tlb_kernel_range with flush_tlb_kernel_range which are avaialbe in all architectures because we already have used it in vmalloc allocator which are generic one so build problem should go away and performane loss shoud be void. [1] f553646, zsmalloc: add page table mapping method [2] https://github.com/spartacus06/zsmapbench Reported-by: Matt Sealey Cc: Dan Magenheimer Cc: Russell King Cc: Konrad Rzeszutek Wilk Cc: Nitin Gupta Cc: Seth Jennings Signed-off-by: Minchan Kim Signed-off-by: Greg Kroah-Hartman commit 5414a74ee10725f6a28f5e2c49559e854ddad47b Author: Chris Wilson Date: Thu Feb 21 20:04:31 2013 +0000 drm/i915: Handle untiled planes when computing their offsets commit bc752862170c135d6c09fb22d79eeb451023568e upstream. We trim the fb to fit the CRTC by computing the offset of that CRTC to its nearest tile_row origin. This allows us to use framebuffers that are larger than the CRTC limits without additional work. However, we failed to compute the offset for a linear framebuffer correctly as we treated its x-advance in whole tiles (instead of the linear increment expected), leaving the CRTC misaligned with its contents. Fixes regression from commit c2c75131244507c93f812862fdbd4f3a37139401 Author: Daniel Vetter Date: Thu Jul 5 12:17:30 2012 +0200 drm/i915: adjust framebuffer base address on gen4+ v2: Adjust relative x-coordinate after linear alignment (vsyrjala) v3: Repaint with pokadots (vsyrjala) Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=61152 Signed-off-by: Chris Wilson Cc: Daniel Vetter Reviewed-by: Ville Syrjälä Signed-off-by: Daniel Vetter Signed-off-by: Greg Kroah-Hartman commit 80927f571d384c0d5a98dfc11ca26af734054b7b Author: Daniel Vetter Date: Fri Feb 15 18:35:30 2013 +0100 drm/i915: inverted brightness quirk for Acer Aspire 4736Z commit ac4199e0f047546aa40172785e26c82b54bbe811 upstream. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=53881 Cc: Jani Nikula Tested-by: Jani Monoses Signed-off-by: Daniel Vetter Signed-off-by: Greg Kroah-Hartman commit 855fa5781e10efc6f1184a24e85be2847de6d897 Author: Daniel Vetter Date: Thu Feb 14 19:46:07 2013 +0100 drm/i915: Use HAS_L3_GPU_CACHE in i915_gem_l3_remap commit eb32e4584d8e9d6cbec20550d4f91396de2cdb55 upstream. Yet another remnant ... this might explain why l3 remapping didn't really work on HSW. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=57441 Spotted-by: Ville Syrjälä Reviewed-by: Ben Widawsky Signed-off-by: Daniel Vetter Signed-off-by: Greg Kroah-Hartman commit a441902e6a0cfed80d233d80248ab15bdc13aa03 Author: Jani Nikula Date: Thu Feb 14 11:23:35 2013 +0200 drm/i915: add missing \n to UTS_RELEASE in the error_state commit fdfa175d0a9cfa2082ce24e67e284e5acbba452a upstream. Amending commit 4518f611ba21ba165ea3714055938a8984a44ff9 Author: Daniel Vetter Date: Wed Jan 23 16:16:35 2013 +0100 drm/i915: dump UTS_RELEASE into the error_state Signed-off-by: Jani Nikula Reviewed-by: Chris Wilson Signed-off-by: Daniel Vetter Signed-off-by: Greg Kroah-Hartman commit 8cf59fe0c1dd0d07a38ecf28736b015a92eb6808 Author: Patrik Jakobsson Date: Wed Feb 13 22:20:22 2013 +0100 drm/i915: Set i9xx sdvo clock limits according to specifications commit 4f7dfb6788dd022446847fbbfbe45e13bedb5be2 upstream. The Intel PRM says the M1 and M2 divisors must be in the range of 10-20 and 5-9. Since we do all calculations based on them being register values (which are subtracted by 2) we need to specify them accordingly. Signed-off-by: Patrik Jakobsson Reviewed-by: Chris Wilson Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=56359 Signed-off-by: Daniel Vetter Signed-off-by: Greg Kroah-Hartman commit 80dda7b532285f32b6fdb23ebf29de7c035b2bae Author: Mika Kuoppala Date: Fri Feb 8 16:35:37 2013 +0200 drm/i915: disable shared panel fitter for pipe commit 24a1f16de97c4cf0029d9acd04be06db32208726 upstream. If encoder is switched off by BIOS, but the panel fitter is left on, we never try to turn off the panel fitter and leave it still attached to the pipe - which can cause blurry output elsewhere. Based on work by Chris Wilson Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=58867 Signed-off-by: Mika Kuoppala Tested-by: Andreas Sturmlechner [danvet: Remove the redundant HAS_PCH_SPLIT check and add a tiny comment.] Signed-off-by: Daniel Vetter Signed-off-by: Greg Kroah-Hartman commit 719429a54d9c8fd32d457c7d564d1272d9003282 Author: Daniel Vetter Date: Wed Feb 6 11:24:41 2013 +0100 drm/i915: write backlight harder commit cf0a6584aa6d382f802f2c3cacac23ccbccde0cd upstream. 770c12312ad617172b1a65b911d3e6564fc5aca8 is the first bad commit commit 770c12312ad617172b1a65b911d3e6564fc5aca8 Author: Takashi Iwai Date: Sat Aug 11 08:56:42 2012 +0200 drm/i915: Fix blank panel at reopening lid changed the register write sequence for restoring the backlight, which helped prevent non-working backlights on some machines. Turns out that the original sequence was the right thing to do for a different set of machines. Worse, setting the backlight level _after_ enabling it seems to reset it somehow. So we need to make that one conditional upon the backlight having been reset to zero, and add the old one back. Cargo-culting at it's best, but it seems to work. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=47941 Cc: Takashi Iwai Reviewed-by: Jani Nikula Acked-by: Takashi Iwai Signed-off-by: Daniel Vetter Signed-off-by: Greg Kroah-Hartman commit 1963d1f0a223d134186ea6c2b5540e981408d458 Author: Ben Widawsky Date: Fri Feb 1 16:41:14 2013 -0800 drm/i915: Fix RC6VIDS encode/decode commit 7083e05072b88d503d257b6f012ce56367f3ac97 upstream. The RC6 VIDS has a linear ramp starting at 250mv, which means any values below 250 are invalid. The old buggy macros tried to adjust for this to be more flexible, but there is no need. As Dan pointed out the ENCODE only ever has one value. The only invalid value for decode is an input of 0 which means something is really wonky, and the cases where DECODE are used either don't matter (debug values), or would be implicitly correct (the check for less than 450). This patch makes simpler, easier to read macros which are actually correct. Maybe this patch can actually fix some bugs now. Thanks to Dan for catching this. /me hides Reported-by: Dan Carpenter Signed-off-by: Ben Widawsky Signed-off-by: Daniel Vetter Signed-off-by: Greg Kroah-Hartman commit 93acc1b01987426940bc8403aea19e13e13da421 Author: Ben Widawsky Date: Tue Jan 29 12:00:15 2013 -0800 drm/i915: Fix CAGF for HSW commit f82855d342b6c8483c56e6d2e200a71731509a39 upstream. The shift changed, hurray. Reported-by: Kenneth Graunke Cc: Paulo Zanoni Reviewed-by: Paulo Zanoni Tested-by: Paulo Zanoni Signed-off-by: Ben Widawsky Signed-off-by: Daniel Vetter Signed-off-by: Greg Kroah-Hartman commit 6484ec24fdc5c9713c127fae89c04fe07f21f152 Author: Chris Wilson Date: Tue Jan 8 11:02:57 2013 +0000 drm/i915: Only run idle processing from i915_gem_retire_requests_worker commit 725a5b54028916cd2511a251c5b5b13d1715addc upstream. When adding the fb idle detection to mark-inactive, it was forgotten that userspace can drive the processing of retire-requests. We assumed that it would be principally driven by the retire requests worker, running once every second whilst active and so we would get the deferred timer for free. Instead we spend too many CPU cycles reclocking the LVDS preventing real work from being done. Signed-off-by: Chris Wilson Reported-and-tested-by: Alexander Lam Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=58843 Reviewed-by: Rodrigo Vivi Signed-off-by: Daniel Vetter Signed-off-by: Greg Kroah-Hartman commit 3cfe7a3476bf3831bcc079b4bff4b1d8cf195179 Author: Damien Lespiau Date: Tue Dec 11 18:48:29 2012 +0000 drm/i915: Preserve the FDI line reversal override bit on CPT commit 3e68320ef84528604d971afc3cadfbe208bef001 upstream. The FDI link has supported link reversal to make the PCB layout engineer's life easier for quite a while and we have always presered this bit as we programmed FDI_RX_CTL with a read/modify/write sequence. We're trying to take a bit more control over what the BIOS leaves in various register and with the introduction of DDI, started to program FDI_RX_CTL fully. There's a fused bit to indicate DMI link reversal and FDI defaults to mirroring that configuration. We have a bit to override that behaviour that we need to preserve from the BIOS. Signed-off-by: Damien Lespiau Reviewed-by: Rodrigo Vivi Reviewed-by: Paulo Zanoni Signed-off-by: Daniel Vetter Signed-off-by: Greg Kroah-Hartman commit 3b5d63de9fbd82a904ba165deefaf5d959dd3fcb Author: Damien Lespiau Date: Tue Dec 11 18:48:30 2012 +0000 drm/i915: Preserve the DDI link reversal configuration commit 876a8cdf92b23d268275cdce4397df0c37dac3fe upstream. Similarly to: commit 6a0d1df3d3a0d2370541164eb0595fe35dcd6de3 Author: Damien Lespiau Date: Tue Dec 11 15:18:28 2012 +0000 drm/i915: Preserve the FDI line reversal override bit on CPT DDI port support lane reversal to easy the PCB layouting work. Let's preserve the bit configured by the BIOS (until we find how to correctly retrieve the information from the VBT, but this does sound more fragile then just relying on the BIOS that has, hopefully, been validated already. Signed-off-by: Damien Lespiau Reviewed-by: Paulo Zanoni Signed-off-by: Daniel Vetter Signed-off-by: Greg Kroah-Hartman commit a21a1cac2e5b85560412e6ef0666fed5dbe02d21 Author: Al Viro Date: Fri Feb 22 22:45:42 2013 -0500 get rid of unprotected dereferencing of mnt->mnt_ns commit 9b40bc90abd126bcc5da5658059b8e72e285e559 upstream. It's safe only under namespace_sem or vfsmount_lock; all places in fs/namespace.c that want mnt->mnt_ns->user_ns actually want to use current->nsproxy->mnt_ns->user_ns (note the calls of check_mnt() in there). Signed-off-by: Al Viro Signed-off-by: Greg Kroah-Hartman commit 0f4b4029531a0595a40832b3635b57073bc873dc Author: Daniel Vetter Date: Mon Jan 21 19:48:59 2013 +0100 intel/iommu: force writebuffer-flush quirk on Gen 4 Chipsets commit 210561ffd72d00eccf12c0131b8024d5436bae95 upstream. We already have the quirk entry for the mobile platform, but also reports on some desktop versions. So be paranoid and set it everywhere. References: http://www.mail-archive.com/dri-devel@lists.freedesktop.org/msg33138.html Reported-and-tested-by: Mihai Moldovan Cc: David Woodhouse Cc: "Sankaran, Rajesh" Signed-off-by: Daniel Vetter Signed-off-by: Greg Kroah-Hartman commit 442b43c867541d0f54a3d8c917d9a00ff941e60a Author: Dave Airlie Date: Thu Feb 7 10:10:04 2013 +1000 drm/usb: bind driver to correct device commit 9f23de52b64f7fb801fd76f3dd8651a0dc89187b upstream. While looking at plymouth on udl I noticed that plymouth was trying to use its fb plugin not its drm one, it was trying to drmOpen a driver called usb not udl, noticed that we actually had out driver pointing at the wrong device. Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit f57db5e108391102c931d483762837d567bd06d0 Author: Daniel Vetter Date: Wed Feb 13 20:37:48 2013 +1000 Revert "drm: Add EDID_QUIRK_FORCE_REDUCED_BLANKING for ASUS VW222S" commit db3985e5ca8f50fc17606855ba394783d11683a5 upstream. This reverts commit 6f33814bd4d9cfe76033a31b1c0c76c960cd8e4b. The quirk cause a regression, and it looks like the original bug was simply a lack of FIFO bandwidth on the i915G of the reporter. Which should eventually be fixed as soon as we get around to implemented DSPARB FIFO reassignment on gen 3. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=52281 Signed-off-by: Daniel Vetter Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 226473550220dd22639b1f3cea23024b7ca15bbf Author: Ville Syrjälä Date: Thu Jan 31 19:43:38 2013 +0200 drm: Use C8 instead of RGB332 when determining the format from depth/bpp commit d84f031bd230fdf9c3b7734940c859bf28b90219 upstream. Support for real RGB332 is a rarity, most hardware only really support C8. So use C8 instead of RGB332 when determining the format based on depth/bpp. This fixes 8bpp fbcon on i915, since i915 will only accept C8 and not RGB332. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=59572 Signed-off-by: Ville Syrjälä Acked-by: Dave Airlie Tested-by: mlsemon35@gmail.com Signed-off-by: Daniel Vetter Signed-off-by: Greg Kroah-Hartman commit e80e11547746d223d88d1f2cb751bf03656cd682 Author: Ville Syrjälä Date: Thu Jan 31 19:43:37 2013 +0200 drm: Fill depth/bits_per_pixel for C8 format commit c51a6bc5f6d328926a9a4a1247c5030faf190a80 upstream. Set depth/bits_per_pixel to 8 for C8 format. Signed-off-by: Ville Syrjälä Acked-by: Dave Airlie Signed-off-by: Daniel Vetter Signed-off-by: Greg Kroah-Hartman commit 75f8e0e4e796eb9885057cee68c63e40622e0a53 Author: Maarten Lankhorst Date: Tue Jan 29 14:27:39 2013 +0100 drm: shut up invalid edid messages commit f934ec8c34b9dcefb5a4f35b0bda33bca289cbe6 upstream. My cheapo monitor has an invalid block 1, resulting in a lot of dmesg spam every few seconds. I get it the first time that the entire block is all 0xff.. Signed-off-by: Maarten Lankhorst Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 740922ee575f8ee4daa2bfd3db5f69dd7573fc76 Author: Paulo Zanoni Date: Fri Feb 15 13:36:27 2013 -0200 drm: don't add inferred modes for monitors that don't support them commit 196e077dc165a307efbd9e7569f81bbdbcf18f65 upstream. If bit 0 of the features byte (0x18) is set to 0, then, according to the EDID spec, "the display is non-continuous frequency (multi-mode) and is only specified to accept the video timing formats that are listed in Base EDID and certain Extension Blocks". For more information, please see the EDID spec, check the notes of the table that explains the "Feature Support" byte (18h) and also the notes on the tables of the section that explains "Display Range Limits & Additional Timing Description Definition (tag #FDh)". Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=45729 Reviewed-by: Alex Deucher Reviewed-by: Adam Jackson Signed-off-by: Paulo Zanoni Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit dc510780f52c9b4941693a5ea54ea80e0c9de846 Author: Alex Williamson Date: Thu Feb 14 11:35:42 2013 -0700 PCI: Fix PCI Express Capability accessors for PCI_EXP_FLAGS commit 969daa349f4821a02936af7202b51a9affc7b6da upstream. PCI_EXP_FLAGS_TYPE is a mask, not an offset. Fix it. Previously, pcie_capability_read_word(..., PCI_EXP_FLAGS, ...) would fail. [bhelgaas: tweak changelog] Signed-off-by: Alex Williamson Signed-off-by: Bjorn Helgaas Signed-off-by: Greg Kroah-Hartman commit cc8641df0963f820e7462aa0f4e761808f6cc683 Author: Dave Airlie Date: Thu Jan 24 14:14:19 2013 +1000 vgacon/vt: clear buffer attributes when we load a 512 character font (v2) commit 2a2483072393b27f4336ab068a1f48ca19ff1c1e upstream. When we switch from 256->512 byte font rendering mode, it means the current contents of the screen is being reinterpreted. The bit that holds the high bit of the 9-bit font, may have been previously set, and thus the new font misrenders. The problem case we see is grub2 writes spaces with the bit set, so it ends up with data like 0x820, which gets reinterpreted into 0x120 char which the font translates into G with a circumflex. This flashes up on screen at boot and is quite ugly. A current side effect of this patch though is that any rendering on the screen changes color to a slightly darker color, but at least the screen no longer corrupts. v2: as suggested by hpa, always clear the attribute space, whether we are are going to or from 512 chars. Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit 24a12bf7b45cbe990cd93ad36f4115f656ffa494 Author: Dave Airlie Date: Thu Feb 7 12:30:25 2013 +1000 drm/udl: disable fb_defio by default commit 677d23b70bf949f75746c80cbae92c233c6b5e2a upstream. There seems to be a bad interaction between gem/shmem and defio on top, I get list corruption on the page lru in the shmem code. Turn it off for now until we get some more digging done. Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit e6f2a8be594c1329e71f339d232e1df43e29482b Author: Dave Airlie Date: Thu Feb 7 11:19:15 2013 +1000 drm/udl: make usage as a console safer commit bcb39af4486be07e896fc374a2336bad3104ae0a upstream. Okay you don't really want to use udl devices as your console, but if you are unlucky enough to do so, you run into a lot of schedule while atomic due to printk being called from all sorts of funky places. So check if we are in an atomic context, and queue the damage for later, the next printk should cause it to appear. This isn't ideal, but it is simple, and seems to work okay in my testing here. (dirty area idea came from xenfb) fixes a bunch of sleeping while atomic issues running fbcon on udl devices. Signed-off-by: Dave Airlie Signed-off-by: Greg Kroah-Hartman commit d5e188ed89cc21ca2aa5245f096f08cc2770c5ad Author: Alex Deucher Date: Tue Feb 19 12:55:52 2013 -0500 drm/radeon: properly validate the atpx interface commit 43a23aa450cc19fe8996caf09e7e21ae5f6e56e8 upstream. Some bioses don't set the function mask correctly which caused required functions to be disabled. Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=53111 Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit b2654460fe50ae5c1a44f33017e0965bfe82676b Author: Alex Deucher Date: Tue Feb 12 08:39:10 2013 -0500 drm/radeon: remove overzealous warning in hdmi handling commit c944b2abb067130542055666f23409fd5e1afc8e upstream. hdmi audio works fine. The warning just confuses users. fixes: https://bugzilla.kernel.org/show_bug.cgi?id=44341 Signed-off-by: Alex Deucher Reviewed-by: Jerome Glisse Signed-off-by: Greg Kroah-Hartman commit d6309c49de766ad690722cce86d8fa27f55c1666 Author: Alex Deucher Date: Mon Feb 11 08:44:48 2013 -0500 drm/radeon: fix multi-head power profile stability on BTC+ asics commit 7ae764b11ed63279e9dcf25be972ff4ca21a9875 upstream. vddci needs to track mclk for multi-head. Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit f0a3cdd0dba567373c517c6eae29b655e3ba112c Author: Alex Deucher Date: Tue Feb 5 11:47:09 2013 -0500 drm/radeon/dce6: fix display powergating commit 0e3d50bfcbd338254795a700dcff429a96cba1a6 upstream. Only enable it when we disable the display rather than at DPMS time since enabling it requires a full modeset to restore the display state. Fixes blank screens in certain cases. Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit 4cd669a49791eb08742f24e0e62128e4d65159d7 Author: David S. Miller Date: Wed Feb 20 12:38:40 2013 -0800 sparc64: Fix huge PMD to PTE translation for sun4u in TLB miss handler. [ Upstream commit 76968ad2eac6456270353de168b21f04f4b3d1d3 ] When we set the sun4u version of the PTE execute bit, it's: or REG, _PAGE_EXEC_4U, REG _PAGE_EXEC_4U is 0x1000, unfortunately the immedate field of the 'or' instruction is a signed 13-bit value. So the above actually assembles into: or REG, -4096, REG completely corrupting the final PTE value. Set it with a: sethi %hi(_PAGE_EXEC_4U), TMP or REG, TMP, REG sequence instead. This fixes "git gc" crashes on sun4u machines. Reported-by: Meelis Roos Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit dac201911537cdf964d75074133bb04998da25c2 Author: David S. Miller Date: Tue Feb 19 22:34:10 2013 -0800 sparc64: Fix tsb_grow() in atomic context. [ Upstream commit 0fbebed682ff2788dee58e8d7f7dda46e33aa10b ] If our first THP installation for an MM is via the set_pmd_at() done during khugepaged's collapsing we'll end up in tsb_grow() trying to do a GFP_KERNEL allocation with several locks held. Simply using GFP_ATOMIC in this situation is not the best option because we really can't have this fail, so we'd really like to keep this an order 0 GFP_KERNEL allocation if possible. Also, doing the TSB allocation from khugepaged is a really bad idea because we'll allocate it potentially from the wrong NUMA node in that context. So what we do is defer the hugepage TSB allocation until the first TLB miss we take on a hugepage. This is slightly tricky because we have to handle two unusual cases: 1) Taking the first hugepage TLB miss in the window trap handler. We'll call the winfix_trampoline when that is detected. 2) An initial TSB allocation via TLB miss races with a hugetlb fault on another cpu running the same MM. We handle this by unconditionally loading the TSB we see into the current cpu even if it's non-NULL at hugetlb_setup time. Reported-by: Meelis Roos Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 77913178ddf081e3d9afe2f866fb36cc33904c92 Author: David S. Miller Date: Tue Feb 19 13:20:08 2013 -0800 sparc64: Handle hugepage TSB being NULL. [ Upstream commit bcd896bae0166b4443503482a26ecf84d9ba60ab ] Accomodate the possibility that the TSB might be NULL at the point that update_mmu_cache() is invoked. This is necessary because we will sometimes need to defer the TSB allocation to the first fault that happens in the 'mm'. Seperate out the hugepage PTE test into a seperate function so that the logic is clearer. Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 9e84c1288f809abcb9d7bfaff0dc882627a1a56d Author: David S. Miller Date: Tue Feb 19 12:56:18 2013 -0800 sparc64: Fix gfp_flags setting in tsb_grow(). [ Upstream commit a55ee1ff751f88252207160087d8197bb7538d4c ] We should "|= more_flags" rather than "= more_flags". Reported-by: David Rientjes Acked-by: David Rientjes Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit f5f9cd078adc085bc74cc5465a975beac8d4c5d3 Author: Bob Peterson Date: Fri Feb 1 12:03:02 2013 -0500 GFS2: Get a block reservation before resizing a file commit d2b47cfb26fe06002b8011707baac71a9ae8166f upstream. This patch allocates a block reservation structure before growing or shrinking a file. Without this structure, the grow or shink code can reference the bad pointer. Signed-off-by: Bob Peterson Signed-off-by: Steven Whitehouse Signed-off-by: Greg Kroah-Hartman commit ca368073ffcbdd25486d65c150039423f677f821 Author: David Henningsson Date: Tue Feb 19 16:11:22 2013 +0100 ALSA: hda - hdmi: ELD shouldn't be valid after unplug commit bbfd8a19b6913f50a362457c34d49bfafe5e456e upstream. Currently, eld_valid is never set to false, except at kernel module load time. This patch makes sure that eld is no longer valid when the cable is (hot-)unplugged. Signed-off-by: David Henningsson Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 97ec241511b9d214021f07bca39b1fbd5749cdbd Author: Takashi Iwai Date: Tue Feb 12 17:02:41 2013 +0100 ALSA: hda - Fix broken workaround for HDMI/SPDIF conflicts commit ea9b43addc4d90ca5b029f47f85ca152320a1e8d upstream. The commit [dcda58061: ALSA: hda - Add workaround for conflicting IEC958 controls] introduced a workaround for cards that have both SPDIF and HDMI devices for giving device=1 to SPDIF control elements. It turned out, however, that this workaround doesn't work well - - The workaround checks only conflicts in a single codec, but SPDIF and HDMI are provided by multiple codecs in many cases, and - ALSA mixer abstraction doesn't care about the device number in ctl elements, thus you'll get errors from amixer such as % amixer scontrols -c 0 ALSA lib simple_none.c:1551:(simple_add1) helem (MIXER,'IEC958 Playback Switch',0,1,0) appears twice or more amixer: Mixer hw:0 load error: Invalid argument This patch fixes the previous broken workaround. Instead of changing the device number of SPDIF ctl elements, shift the element indices of such controls up to 16. Also, the conflict check is performed over all codecs found on the bus. HDMI devices will be put to dev=0,index=0 as before. Only the conflicting SPDIF device is moved to a different place. The new place of SPDIF device is supposed by the updated alsa-lib HDA-Intel.conf, respectively. Reported-by: Stephan Raue Reported-by: Anssi Hannula Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 13ba2f708de20e3bb2848e2d9b5cf71d0bd69b29 Author: Fernando Luis Vazquez Cao Date: Tue Feb 12 16:47:44 2013 +0900 ALSA: hda - Workaround for silent output on Sony Vaio VGC-LN51JGB with ALC889 commit 12e31a78c70dc12897fda2489113f445c0e94a18 upstream. Some Vaio all-in-one desktop PCs (for example VGC-LN51JGB) are affected by the same issue that caused Vaio Z laptops to become silent: the speaker pin must be connected to the first DAC even though the codec itself advertises flexible routing through any of the DACs. Use the no-primary-hp fixup for choosing the speaker pin as the primary so that the right DAC is assigned on this device. Signed-off-by: Fernando Luis Vazquez Cao Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 6a9c8473ff28cccb147a067994c77b1ec755fa97 Author: Anssi Hannula Date: Sun Feb 3 17:55:45 2013 +0200 ALSA: hda - Fix default multichannel HDMI mapping regression commit 20608731f479d48be6bcb88e727f360ddf98ddaf upstream. Commit d45e6889ee69456a4d5b1bbb32252f460cd48fa9 ("ALSA: hda - Provide the proper channel mapping for generic HDMI driver") added support for custom channel maps in the HDA HDMI driver. Due to a mistake in an 'if' condition the custom map is always used even when no such map has been set. This causes incorrect channel mapping for multichannel audio by default. Pass per_pin->chmap_set to hdmi_setup_channel_mapping() as a parameter so that it can use it for detecting if a custom map has been set instead of checking if map is NULL (which is never the case). Reported-by: Staffan Lindberg Signed-off-by: Anssi Hannula Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 41e19bdaf44badcb28e78d1845138abd7758c192 Author: Takashi Iwai Date: Fri Feb 1 14:01:27 2013 +0100 ALSA: hda - Release assigned pin/cvt at error path of hdmi_pcm_open() commit 2ad779b7329d6894a80df94e693e72eaa0d56790 upstream. If the driver detects and invalid ELD, it gives an open error. But it forgot to release the assigned pin, converter and spdif ctls before returning. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 45d13ae3c09ae43a21c5560ecf4818efc6a42d75 Author: Takashi Iwai Date: Thu Feb 14 09:44:55 2013 +0100 ALSA: hda - Disable runtime PM for Intel 5 Series/3400 commit 2c1350fdeaefefe1a149d3b083383409f43f0daa upstream. We've got a regression report wrt the IRQ issue related with the power-save on a Dell machine, and disabling runtime PM works around. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=53441 Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 8304789d0be8c273e2a102049aba2408970de761 Author: Pawel Moll Date: Thu Feb 21 01:55:50 2013 +0000 ALSA: usb: Fix Processing Unit Descriptor parsers commit b531f81b0d70ffbe8d70500512483227cc532608 upstream. Commit 99fc86450c439039d2ef88d06b222fd51a779176 "ALSA: usb-mixer: parse descriptors with structs" introduced a set of useful parsers for descriptors. Unfortunately the parses for the Processing Unit Descriptor came with a very subtle bug... Functions uac_processing_unit_iProcessing() and uac_processing_unit_specific() were indexing the baSourceID array forgetting the fields before the iProcessing and process-specific descriptors. The problem was observed with Sound Blaster Extigy mixer, where nNrModes in Up/Down-mix Processing Unit Descriptor was accessed at offset 10 of the descriptor (value 0) instead of offset 15 (value 7). In result the resulting control had interesting limit values: Simple mixer control 'Channel Routing Mode Select',0 Capabilities: volume volume-joined penum Playback channels: Mono Capture channels: Mono Limits: 0 - -1 Mono: -1 [100%] Fixed by starting from the bmControls, which was calculated correctly, instead of baSourceID. Now the mentioned control is fine: Simple mixer control 'Channel Routing Mode Select',0 Capabilities: volume volume-joined penum Playback channels: Mono Capture channels: Mono Limits: 0 - 6 Mono: 0 [0%] Signed-off-by: Pawel Moll Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 28aaf89cdfff86c498d0b5e2d07664e3a98a3280 Author: Jiri Slaby Date: Sun Feb 17 14:33:04 2013 +0100 ALSA: usb/quirks, fix out-of-bounds access commit 4909a0caabb8b4352efcea223e58b86f8bc1f98b upstream. bootresponse in snd_usb_mbox2_boot_quirk is only 12 (decimal) u8's long, but i9s passed to snd_usb_ctl_msg as it would be 0x12 (hexa) long. Fix that by having proper size of the array, i.e. 0x12. Signed-off-by: Jiri Slaby Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit d8f5cd037d171e67e920edf4733b98859d04c98b Author: Clemens Ladisch Date: Thu Jan 31 21:14:33 2013 +0100 ALSA: usb-audio: fix Roland A-PRO support commit 7da58046482fceb17c4a0d4afefd9507ec56de7f upstream. The quirk for the Roland/Cakewalk A-PRO keyboards accidentally used the wrong interface number, which prevented the driver from attaching to the device. Signed-off-by: Clemens Ladisch Signed-off-by: Greg Kroah-Hartman commit 12e7426736130c1153475dc33dadf00fe1c6d5b1 Author: Tomasz Guszkowski Date: Tue Feb 5 22:10:31 2013 +0100 p54usb: corrected USB ID for T-Com Sinus 154 data II commit 008e33f733ca51acb2dd9d88ea878693b04d1d2a upstream. Corrected USB ID for T-Com Sinus 154 data II. ISL3887-based. The device was tested in managed mode with no security, WEP 128 bit and WPA-PSK (TKIP) with firmware 2.13.1.0.lm87.arm (md5sum: 7d676323ac60d6e1a3b6d61e8c528248). It works. Signed-off-by: Tomasz Guszkowski Acked-By: Christian Lamparter Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 485bd9cb6d6a545f490152df3a663cb2b3839d32 Author: Weston Andros Adamson Date: Fri Feb 15 16:03:46 2013 -0500 NFSv4.1: Don't decode skipped layoutgets commit 085b7a45c63d3da5be155faab9249a5cab224561 upstream. layoutget's prepare hook can call rpc_exit with status = NFS4_OK (0). Because of this, nfs4_proc_layoutget can't depend on a 0 status to mean that the RPC was successfully sent, received and parsed. To fix this, use the result's len member to see if parsing took place. This fixes the following OOPS -- calling xdr_init_decode() with a buffer length 0 doesn't set the stream's 'p' member and ends up using uninitialized memory in filelayout_decode_layout. BUG: unable to handle kernel paging request at 0000000000008050 IP: [] memcpy+0x18/0x120 PGD 0 Oops: 0000 [#1] SMP last sysfs file: /sys/devices/pci0000:00/0000:00:11.0/0000:02:01.0/irq CPU 1 Modules linked in: nfs_layout_nfsv41_files nfs lockd fscache auth_rpcgss nfs_acl autofs4 sunrpc ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4 iptable_filter ip_tables ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables ipv6 dm_mirror dm_region_hash dm_log dm_mod ppdev parport_pc parport snd_ens1371 snd_rawmidi snd_ac97_codec ac97_bus snd_seq snd_seq_device snd_pcm snd_timer snd soundcore snd_page_alloc e1000 microcode vmware_balloon i2c_piix4 i2c_core sg shpchp ext4 mbcache jbd2 sr_mod cdrom sd_mod crc_t10dif pata_acpi ata_generic ata_piix mptspi mptscsih mptbase scsi_transport_spi [last unloaded: speedstep_lib] Pid: 1665, comm: flush-0:22 Not tainted 2.6.32-356-test-2 #2 VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform RIP: 0010:[] [] memcpy+0x18/0x120 RSP: 0018:ffff88003dfab588 EFLAGS: 00010206 RAX: ffff88003dc42000 RBX: ffff88003dfab610 RCX: 0000000000000009 RDX: 000000003f807ff0 RSI: 0000000000008050 RDI: ffff88003dc42000 RBP: ffff88003dfab5b0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000080 R12: 0000000000000024 R13: ffff88003dc42000 R14: ffff88003f808030 R15: ffff88003dfab6a0 FS: 0000000000000000(0000) GS:ffff880003420000(0000) knlGS:0000000000000000 CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b CR2: 0000000000008050 CR3: 000000003bc92000 CR4: 00000000001407e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process flush-0:22 (pid: 1665, threadinfo ffff88003dfaa000, task ffff880037f77540) Stack: ffffffffa0398ac1 ffff8800397c5940 ffff88003dfab610 ffff88003dfab6a0 ffff88003dfab5d0 ffff88003dfab680 ffffffffa01c150b ffffea0000d82e70 000000508116713b 0000000000000000 0000000000000000 0000000000000000 Call Trace: [] ? xdr_inline_decode+0xb1/0x120 [sunrpc] [] filelayout_decode_layout+0xeb/0x350 [nfs_layout_nfsv41_files] [] filelayout_alloc_lseg+0x8c/0x3c0 [nfs_layout_nfsv41_files] [] ? __wait_on_bit+0x7e/0x90 Signed-off-by: Weston Andros Adamson Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 345387f517d74bbb83cb1a1158f06a488b452547 Author: Trond Myklebust Date: Tue Feb 12 09:48:42 2013 -0500 NFSv4.1: Fix bulk recall and destroy of layouts commit fd9a8d7160937f94aad36ac80d7255b4988740ac upstream. The current code in pnfs_destroy_all_layouts() assumes that removing the layout from the server->layouts list is sufficient to make it invisible to other processes. This ignores the fact that most users access the layout through the nfs_inode->layout... There is further breakage due to lack of reference counting of the layouts, meaning that the whole thing Oopses at the drop of a hat. The code in initiate_bulk_draining() is almost correct, and can be used as a model for pnfs_destroy_all_layouts(), so move that code to pnfs.c, and refactor the code to allow us to choose between a single filesystem bulk recall, and a recall of all layouts. Also note that initiate_bulk_draining() currently calls iput() while holding locks. Fix that too. Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit e6a6e38b72bae7e2db7e47fa5cdc15a3f2b5cc15 Author: Trond Myklebust Date: Mon Feb 11 19:01:21 2013 -0500 NFSv4.1: Fix an ABBA locking issue with session and state serialisation commit c8da19b9866ea84e9ad1c369393ea95d54ee7845 upstream. Ensure that if nfs_wait_on_sequence() causes our rpc task to wait for an NFSv4 state serialisation lock, then we also drop the session slot. Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 19cb8ef8147370e8859a863c942221920163b404 Author: Trond Myklebust Date: Tue Feb 19 12:04:42 2013 -0500 NLM: Ensure that we resend all pending blocking locks after a reclaim commit 666b3d803a511fbc9bc5e5ea8ce66010cf03ea13 upstream. Currently, nlmclnt_lock will break out of the for(;;) loop when the reclaimer wakes up the blocking lock thread by setting nlm_lck_denied_grace_period. This causes the lock request to fail with an ENOLCK error. The intention was always to ensure that we resend the lock request after the grace period has expired. Reported-by: Wangyuan Zhang Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 845d480dbebf1dc1b6b4997f14ea70ab2de665af Author: fanchaoting Date: Mon Feb 4 21:15:02 2013 +0800 umount oops when remove blocklayoutdriver first commit 5a12cca697aca5dfba42a7d4c3356acc0445a2b0 upstream. now pnfs client uses block layout, maybe we can remove blocklayoutdriver first. if we umount later, it can cause oops in unset_pnfs_layoutdriver. because nfss->pnfs_curr_ld->clear_layoutdriver is invalid. reproduce it: modprobe blocklayoutdriver mount -t nfs4 -o minorversion=1 pnfsip:/ /mnt/ rmmod blocklayoutdriver umount /mnt then you can see following CPU 0 Pid: 17023, comm: umount.nfs4 Tainted: GF O 3.7.0-rc6-pnfs #1 VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform RIP: 0010:[] [] unset_pnfs_layoutdriver+0x1d/0x70 [nfsv4] RSP: 0018:ffff8800022d9e48 EFLAGS: 00010286 RAX: ffffffffa04a1b00 RBX: ffff88000b013800 RCX: 0000000000000001 RDX: ffffffff81ae8ee0 RSI: ffff880001ee94b8 RDI: ffff88000b013800 RBP: ffff8800022d9e58 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff880001ee9400 R13: ffff8800105978c0 R14: 00007fff25846c08 R15: 0000000001bba550 FS: 00007f45ae7f0700(0000) GS:ffff880012c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: ffffffffa04a1b38 CR3: 0000000002c0c000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process umount.nfs4 (pid: 17023, threadinfo ffff8800022d8000, task ffff880006e48aa0) Stack: ffff8800105978c0 ffff88000b013800 ffff8800022d9e78 ffffffffa04cd0ce ffff8800022d9e78 ffff88000b013800 ffff8800022d9ea8 ffffffffa04755a7 ffff8800022d9ea8 ffff880002f96400 ffff88000b013800 ffff880002f96400 Call Trace: [] nfs4_destroy_server+0x1e/0x30 [nfsv4] [] nfs_free_server+0xb7/0x150 [nfs] [] nfs_kill_super+0x35/0x40 [nfs] [] deactivate_locked_super+0x45/0x70 [] deactivate_super+0x4a/0x70 [] mntput_no_expire+0xd2/0x130 [] sys_umount+0x72/0xe0 [] system_call_fastpath+0x16/0x1b Code: 06 e1 b8 ea ff ff ff eb 9e 0f 1f 44 00 00 55 48 89 e5 53 48 83 ec 08 66 66 66 66 90 48 8b 87 80 03 00 00 48 89 fb 48 85 c0 74 29 <48> 8b 40 38 48 85 c0 74 02 ff d0 48 8b 03 3e ff 48 04 0f 94 c2 RIP [] unset_pnfs_layoutdriver+0x1d/0x70 [nfsv4] RSP CR2: ffffffffa04a1b38 ---[ end trace 29f75aaedda058bf ]--- Signed-off-by: fanchaoting Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 4469887f863aa5348cc95b77a6e4b1e83a7fc6cd Author: Grant Likely Date: Thu Feb 14 18:14:27 2013 +0000 drivercore: Fix ordering between deferred_probe and exiting initcalls commit d72cca1eee5b26e313da2a380d4862924e271031 upstream. One of the side effects of deferred probe is that some drivers which used to be probed before initcalls completed are now happening slightly later. This causes two problems. - If a console driver gets deferred, then it may not be ready when userspace starts. For example, if a uart depends on pinctrl, then the uart will get deferred and /dev/console will not be available - __init sections will be discarded before built-in drivers are probed. Strictly speaking, __init functions should not be called in a drivers __probe path, but there are a lot of drivers (console stuff again) that do anyway. In the past it was perfectly safe to do so because all built-in drivers got probed before the end of initcalls. This patch fixes the problem by forcing the first pass of the deferred list to complete at late_initcall time. This is late enough to catch the drivers that are known to have the above issues. Signed-off-by: Grant Likely Tested-by: Haojian Zhuang Cc: Arnd Bergmann Cc: Russell King Cc: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit bb01afe62feca1e7cdca60696f8b074416b0910d Author: Mel Gorman Date: Fri Feb 22 16:35:59 2013 -0800 mm/fadvise.c: drain all pagevecs if POSIX_FADV_DONTNEED fails to discard all pages commit 67d46b296a1ba1477c0df8ff3bc5e0167a0b0732 upstream. Rob van der Heij reported the following (paraphrased) on private mail. The scenario is that I want to avoid backups to fill up the page cache and purge stuff that is more likely to be used again (this is with s390x Linux on z/VM, so I don't give it as much memory that we don't care anymore). So I have something with LD_PRELOAD that intercepts the close() call (from tar, in this case) and issues a posix_fadvise() just before closing the file. This mostly works, except for small files (less than 14 pages) that remains in page cache after the face. Unfortunately Rob has not had a chance to test this exact patch but the test program below should be reproducing the problem he described. The issue is the per-cpu pagevecs for LRU additions. If the pages are added by one CPU but fadvise() is called on another then the pages remain resident as the invalidate_mapping_pages() only drains the local pagevecs via its call to pagevec_release(). The user-visible effect is that a program that uses fadvise() properly is not obeyed. A possible fix for this is to put the necessary smarts into invalidate_mapping_pages() to globally drain the LRU pagevecs if a pagevec page could not be discarded. The downside with this is that an inode cache shrink would send a global IPI and memory pressure potentially causing global IPI storms is very undesirable. Instead, this patch adds a check during fadvise(POSIX_FADV_DONTNEED) to check if invalidate_mapping_pages() discarded all the requested pages. If a subset of pages are discarded it drains the LRU pagevecs and tries again. If the second attempt fails, it assumes it is due to the pages being mapped, locked or dirty and does not care. With this patch, an application using fadvise() correctly will be obeyed but there is a downside that a malicious application can force the kernel to send global IPIs and increase overhead. If accepted, I would like this to be considered as a -stable candidate. It's not an urgent issue but it's a system call that is not working as advertised which is weak. The following test program demonstrates the problem. It should never report that pages are still resident but will without this patch. It assumes that CPU 0 and 1 exist. int main() { int fd; int pagesize = getpagesize(); ssize_t written = 0, expected; char *buf; unsigned char *vec; int resident, i; cpu_set_t set; /* Prepare a buffer for writing */ expected = FILESIZE_PAGES * pagesize; buf = malloc(expected + 1); if (buf == NULL) { printf("ENOMEM\n"); exit(EXIT_FAILURE); } buf[expected] = 0; memset(buf, 'a', expected); /* Prepare the mincore vec */ vec = malloc(FILESIZE_PAGES); if (vec == NULL) { printf("ENOMEM\n"); exit(EXIT_FAILURE); } /* Bind ourselves to CPU 0 */ CPU_ZERO(&set); CPU_SET(0, &set); if (sched_setaffinity(getpid(), sizeof(set), &set) == -1) { perror("sched_setaffinity"); exit(EXIT_FAILURE); } /* open file, unlink and write buffer */ fd = open("fadvise-test-file", O_CREAT|O_EXCL|O_RDWR); if (fd == -1) { perror("open"); exit(EXIT_FAILURE); } unlink("fadvise-test-file"); while (written < expected) { ssize_t this_write; this_write = write(fd, buf + written, expected - written); if (this_write == -1) { perror("write"); exit(EXIT_FAILURE); } written += this_write; } free(buf); /* * Force ourselves to another CPU. If fadvise only flushes the local * CPUs pagevecs then the fadvise will fail to discard all file pages */ CPU_ZERO(&set); CPU_SET(1, &set); if (sched_setaffinity(getpid(), sizeof(set), &set) == -1) { perror("sched_setaffinity"); exit(EXIT_FAILURE); } /* sync and fadvise to discard the page cache */ fsync(fd); if (posix_fadvise(fd, 0, expected, POSIX_FADV_DONTNEED) == -1) { perror("posix_fadvise"); exit(EXIT_FAILURE); } /* map the file and use mincore to see which parts of it are resident */ buf = mmap(NULL, expected, PROT_READ, MAP_SHARED, fd, 0); if (buf == NULL) { perror("mmap"); exit(EXIT_FAILURE); } if (mincore(buf, expected, vec) == -1) { perror("mincore"); exit(EXIT_FAILURE); } /* Check residency */ for (i = 0, resident = 0; i < FILESIZE_PAGES; i++) { if (vec[i]) resident++; } if (resident != 0) { printf("Nr unexpected pages resident: %d\n", resident); exit(EXIT_FAILURE); } munmap(buf, expected); close(fd); free(vec); exit(EXIT_SUCCESS); } Signed-off-by: Mel Gorman Reported-by: Rob van der Heij Tested-by: Rob van der Heij Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 59a9bfae1462c0580f23151923eab77d8e18158e Author: Greg Thelen Date: Fri Feb 22 16:36:01 2013 -0800 tmpfs: fix use-after-free of mempolicy object commit 5f00110f7273f9ff04ac69a5f85bb535a4fd0987 upstream. The tmpfs remount logic preserves filesystem mempolicy if the mpol=M option is not specified in the remount request. A new policy can be specified if mpol=M is given. Before this patch remounting an mpol bound tmpfs without specifying mpol= mount option in the remount request would set the filesystem's mempolicy object to a freed mempolicy object. To reproduce the problem boot a DEBUG_PAGEALLOC kernel and run: # mkdir /tmp/x # mount -t tmpfs -o size=100M,mpol=interleave nodev /tmp/x # grep /tmp/x /proc/mounts nodev /tmp/x tmpfs rw,relatime,size=102400k,mpol=interleave:0-3 0 0 # mount -o remount,size=200M nodev /tmp/x # grep /tmp/x /proc/mounts nodev /tmp/x tmpfs rw,relatime,size=204800k,mpol=??? 0 0 # note ? garbage in mpol=... output above # dd if=/dev/zero of=/tmp/x/f count=1 # panic here Panic: BUG: unable to handle kernel NULL pointer dereference at (null) IP: [< (null)>] (null) [...] Oops: 0010 [#1] SMP DEBUG_PAGEALLOC Call Trace: mpol_shared_policy_init+0xa5/0x160 shmem_get_inode+0x209/0x270 shmem_mknod+0x3e/0xf0 shmem_create+0x18/0x20 vfs_create+0xb5/0x130 do_last+0x9a1/0xea0 path_openat+0xb3/0x4d0 do_filp_open+0x42/0xa0 do_sys_open+0xfe/0x1e0 compat_sys_open+0x1b/0x20 cstar_dispatch+0x7/0x1f Non-debug kernels will not crash immediately because referencing the dangling mpol will not cause a fault. Instead the filesystem will reference a freed mempolicy object, which will cause unpredictable behavior. The problem boils down to a dropped mpol reference below if shmem_parse_options() does not allocate a new mpol: config = *sbinfo shmem_parse_options(data, &config, true) mpol_put(sbinfo->mpol) sbinfo->mpol = config.mpol /* BUG: saves unreferenced mpol */ This patch avoids the crash by not releasing the mempolicy if shmem_parse_options() doesn't create a new mpol. How far back does this issue go? I see it in both 2.6.36 and 3.3. I did not look back further. Signed-off-by: Greg Thelen Acked-by: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 373f58fd7f38decf2756053f0ab4fb8b0662a32c Author: David Howells Date: Thu Feb 21 12:00:25 2013 +0000 KEYS: Revert one application of "Fix unreachable code" patch commit fe9453a1dcb5fb146f9653267e78f4a558066f6f upstream. A patch to fix some unreachable code in search_my_process_keyrings() got applied twice by two different routes upstream as commits e67eab39bee2 and b010520ab3d2 (both "fix unreachable code"). Unfortunately, the second application removed something it shouldn't have and this wasn't detected by GIT. This is due to the patch not having sufficient lines of context to distinguish the two places of application. The effect of this is relatively minor: inside the kernel, the keyring search routines may search multiple keyrings and then prioritise the errors if no keys or negative keys are found in any of them. With the extra deletion, the presence of a negative key in the thread keyring (causing ENOKEY) is incorrectly overridden by an error searching the process keyring. So revert the second application of the patch. Signed-off-by: David Howells Cc: Jiri Kosina Cc: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit c73fc1e7acbbf8c6346eb6035751bee9ca472d8f Author: Lars-Peter Clausen Date: Thu Feb 21 16:44:04 2013 -0800 drivers/video/backlight/adp88?0_bl.c: fix resume commit 5eb02c01bd1f3ef195989ab05e835e2b0711b5a9 upstream. Clearing the NSTBY bit in the control register also automatically clears the BLEN bit. So we need to make sure to set it again during resume, otherwise the backlight will stay off. Signed-off-by: Lars-Peter Clausen Acked-by: Michael Hennerich Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 8ed82bbebcaaddb46bc4d5531ba9fd5d6ecd77d1 Author: Junxiao Bi Date: Thu Feb 21 16:42:45 2013 -0800 ocfs2: unlock super lock if lockres refresh failed commit 3278bb748d2437eb1464765f36429e5d6aa91c38 upstream. If lockres refresh failed, the super lock will never be released which will cause some processes on other cluster nodes hung forever. Signed-off-by: Junxiao Bi Cc: Joel Becker Cc: Mark Fasheh Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 6b34c15c207370a7e29a916f0edca03d48c27ea6 Author: MITSUNARI Shigeo Date: Thu Feb 21 16:42:01 2013 -0800 fs/block_dev.c: page cache wrongly left invalidated after revalidate_disk() commit 7630b661da330b35dd57b6f5d6d62b386f2dd751 upstream. We found that bdev->bd_invalidated was left set once revalidate_disk() is called, which results in page cache flush every time that device is open. Specifically, we found this problem in MD block device. Once we resize a MD device, mdadm --monitor periodically flush all page cache for that device every 60 or 1000 seconds when it opens the device. This bug lies since at least 3.2.0 till the latest kernel(3.6.2). Patch is attached. The following steps will reproduce the problem. 1. prepair a block device (eg /dev/sdb). 2. create two partitions: sudo parted /dev/sdb mklabel gpt mkpart primary 0% 50% mkpart primary 50% 100% 3. create a md device. sudo mdadm -C /dev/md/hoge -l 1 -n 2 -e 1.2 --assume-clean --auto=md --symlink=no /dev/sdb1 /dev/sdb2 4. create file system and mount it sudo mkfs.ext3 /dev/md/hoge sudo mkdir /mnt/test sudo mount /dev/md/hoge /mnt/test 5. try to resize the device sudo mdadm -G /dev/md/hoge --size=max 6. create a file to fill file cache. sudo dd if=/dev/urandom of=/mnt/test/data bs=1M count=10 and verify the current status of file by free command. 7. mdadm monitor will open the md device every 1000 seconds and you will find all file cache on the device are cleared. The timing can be reduced by the following steps. a) kill mdadm and restart it with --delay option /sbin/mdadm --monitor --delay=30 --pid-file /var/run/mdadm/monitor.pid --daemonise --scan --syslog or open the md device directly. sudo dd if=/dev/md/hoge of=/dev/null bs=4096 count=1 Signed-off-by: MITSUNARI Shigeo Cc: Al Viro Cc: Jeff Moyer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 39ea98fbf77540d416abf2df6451f462ddd59b03 Author: Jim Somerville Date: Thu Feb 21 16:41:59 2013 -0800 inotify: remove broken mask checks causing unmount to be EINVAL commit 676a0675cf9200ac047fb50825f80867b3bb733b upstream. Running the command: inotifywait -e unmount /mnt/disk immediately aborts with a -EINVAL return code. This is however a valid parameter. This abort occurs only if unmount is the sole event parameter. If other event parameters are supplied, then the unmount event wait will work. The problem was introduced by commit 44b350fc23e ("inotify: Fix mask checks"). In that commit, it states: The mask checks in inotify_update_existing_watch() and inotify_new_watch() are useless because inotify_arg_to_mask() sets FS_IN_IGNORED and FS_EVENT_ON_CHILD bits anyway. But instead of removing the useless checks, it did this: mask = inotify_arg_to_mask(arg); - if (unlikely(!mask)) + if (unlikely(!(mask & IN_ALL_EVENTS))) return -EINVAL; The problem is that IN_ALL_EVENTS doesn't include IN_UNMOUNT, and other parts of the code keep IN_UNMOUNT separate from IN_ALL_EVENTS. So the check should be: if (unlikely(!(mask & (IN_ALL_EVENTS | IN_UNMOUNT)))) But inotify_arg_to_mask(arg) always sets the IN_UNMOUNT bit in the mask anyway, so the check is always going to pass and thus should simply be removed. Also note that inotify_arg_to_mask completely controls what mask bits get set from arg, there's no way for invalid bits to get enabled there. Lets fix it by simply removing the useless broken checks. Signed-off-by: Jim Somerville Signed-off-by: Paul Gortmaker Cc: Jerome Marchand Cc: John McCutchan Cc: Robert Love Cc: Eric Paris Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 626fa974dd746c7f25e864f2555e6a7ed0c7e8e8 Author: Thomas Gleixner Date: Mon Feb 18 09:52:08 2013 +0100 futex: Revert "futex: Mark get_robust_list as deprecated" commit fe2b05f7ca9f906be61dced5489f63b8b4d7c770 upstream. This reverts commit ec0c4274e33c0373e476b73e01995c53128f1257. get_robust_list() is in use and a removal would break existing user space. With the permission checks in place it's not longer a security hole. Remove the deprecation warnings. Signed-off-by: Thomas Gleixner Cc: Cyrill Gorcunov Cc: Richard Weinberger Cc: akpm@linux-foundation.org Cc: paul.gortmaker@windriver.com Cc: davej@redhat.com Cc: keescook@chromium.org Cc: ebiederm@xmission.com Signed-off-by: Greg Kroah-Hartman commit f12993e9c6723b3507239b4c4358348e0b182304 Author: Christian Borntraeger Date: Fri Jan 25 15:34:15 2013 +0100 s390/kvm: Fix store status for ACRS/FPRS commit 15bc8d8457875f495c59d933b05770ba88d1eacb upstream. On store status we need to copy the current state of registers into a save area. Currently we might save stale versions: The sie state descriptor doesnt have fields for guest ACRS,FPRS, those registers are simply stored in the host registers. The host program must copy these away if needed. We do that in vcpu_put/load. If we now do a store status in KVM code between vcpu_put/load, the saved values are not up-to-date. Lets collect the ACRS/FPRS before saving them. This also fixes some strange problems with hotplug and virtio-ccw, since the low level machine check handler (on hotplug a machine check will happen) will revalidate all registers with the content of the save area. Signed-off-by: Christian Borntraeger Signed-off-by: Gleb Natapov Signed-off-by: Greg Kroah-Hartman commit 92fdb6f158923fb2c45eba5d5548d930c0fe0afe Author: Cornelia Huck Date: Fri Dec 14 17:02:16 2012 +0100 KVM: s390: Handle hosts not supporting s390-virtio. commit 55c171a6d90dc0574021f9c836127cfd1a7d2e30 upstream. Running under a kvm host does not necessarily imply the presence of a page mapped above the main memory with the virtio information; however, the code includes a hard coded access to that page. Instead, check for the presence of the page and exit gracefully before we hit an addressing exception if it does not exist. Reviewed-by: Marcelo Tosatti Reviewed-by: Alexander Graf Signed-off-by: Cornelia Huck Signed-off-by: Gleb Natapov Signed-off-by: Greg Kroah-Hartman commit d6f54cabb268370ccfb66e35a7ba9f0539987a13 Author: Robin Holt Date: Fri Feb 22 16:35:34 2013 -0800 mmu_notifier_unregister NULL Pointer deref and multiple ->release() callouts commit 751efd8610d3d7d67b7bdf7f62646edea7365dd7 upstream. There is a race condition between mmu_notifier_unregister() and __mmu_notifier_release(). Assume two tasks, one calling mmu_notifier_unregister() as a result of a filp_close() ->flush() callout (task A), and the other calling mmu_notifier_release() from an mmput() (task B). A B t1 srcu_read_lock() t2 if (!hlist_unhashed()) t3 srcu_read_unlock() t4 srcu_read_lock() t5 hlist_del_init_rcu() t6 synchronize_srcu() t7 srcu_read_unlock() t8 hlist_del_rcu() <--- NULL pointer deref. Additionally, the list traversal in __mmu_notifier_release() is not protected by the by the mmu_notifier_mm->hlist_lock which can result in callouts to the ->release() notifier from both mmu_notifier_unregister() and __mmu_notifier_release(). -stable suggestions: The stable trees prior to 3.7.y need commits 21a92735f660 and 70400303ce0c cherry-picked in that order prior to cherry-picking this commit. The 3.7.y tree already has those two commits. Signed-off-by: Robin Holt Cc: Andrea Arcangeli Cc: Wanpeng Li Cc: Xiao Guangrong Cc: Avi Kivity Cc: Hugh Dickins Cc: Marcelo Tosatti Cc: Sagi Grimberg Cc: Haggai Eran Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 9b800caf48bac27baab53261e471d553f1f9809f Author: Bjorn Helgaas Date: Tue Jan 29 16:44:27 2013 -0700 Driver core: treat unregistered bus_types as having no devices commit 4fa3e78be7e985ca814ce2aa0c09cbee404efcf7 upstream. A bus_type has a list of devices (klist_devices), but the list and the subsys_private structure that contains it are not initialized until the bus_type is registered with bus_register(). The panic/reboot path has fixups that look up devices in pci_bus_type. If we panic before registering pci_bus_type, the bus_type exists but the list does not, so mach_reboot_fixups() trips over a null pointer and panics again: mach_reboot_fixups pci_get_device .. bus_find_device(&pci_bus_type, ...) bus->p is NULL Joonsoo reported a problem when panicking before PCI was initialized. I think this patch should be sufficient to replace the patch he posted here: https://lkml.org/lkml/2012/12/28/75 ("[PATCH] x86, reboot: skip reboot_fixups in early boot phase") Reported-by: Joonsoo Kim Signed-off-by: Bjorn Helgaas Signed-off-by: Greg Kroah-Hartman commit 9ff7a0c89c9331701fbd906b4e3e7308820f0e56 Author: Minchan Kim Date: Wed Jan 30 11:41:39 2013 +0900 zram: Fix deadlock bug in partial read/write commit 7e5a5104c6af709a8d97d5f4711e7c917761d464 upstream. Now zram allocates new page with GFP_KERNEL in zram I/O path if IO is partial. Unfortunately, It may cause deadlock with reclaim path like below. write_page from fs fs_lock allocation(GFP_KERNEL) reclaim pageout write_page from fs fs_lock <-- deadlock This patch fixes it by using GFP_NOIO. In read path, we reorganize code flow so that kmap_atomic is called after the GFP_NOIO allocation. Acked-by: Jerome Marchand Acked-by: Nitin Gupta [ penberg@kernel.org: don't use GFP_ATOMIC ] Signed-off-by: Pekka Enberg Signed-off-by: Minchan Kim Signed-off-by: Greg Kroah-Hartman commit 49626fbb0360332e40fd76a48cb2ba876d6134ad Author: George Spelvin Date: Tue Feb 12 02:27:20 2013 -0500 pps: Fix a use-after free bug when unregistering a source. commit d953e0e837e65ecc1ddaa4f9560f7925878a0de6 upstream. Remove the cdev from the system (with cdev_del) *before* deallocating it (in pps_device_destruct, called via kobject_put from device_destroy). Also prevent deallocating a device with open file handles. A better long-term fix is probably to remove the cdev from the pps_device entirely, and instead have all devices reference one global cdev. Then the deallocation ordering becomes simpler. But that's more complex and invasive change, so we leave that for later. Signed-off-by: George Spelvin Acked-by: Rodolfo Giometti Signed-off-by: Greg Kroah-Hartman commit de43c8b10f40a8e5bda0a32c9a7edf779c5aac15 Author: George Spelvin Date: Sun Feb 10 04:41:56 2013 -0500 pps: Use pps_lookup_dev to reduce ldisc coupling commit 03a7ffe4e542310838bac70ef85acc17536b6d7c upstream. Now that N_TTY uses tty->disc_data for its private data, 'subclass' ldiscs cannot use ->disc_data for their own private data. (This is a regression is v3.8-rc1) Use pps_lookup_dev to associate the tty with the pps source instead. This fixes a crashing regression in 3.8-rc1. Signed-off-by: George Spelvin Acked-by: Rodolfo Giometti Signed-off-by: Greg Kroah-Hartman commit 60835653a6a1b334cb552f43a4080ba408236a74 Author: George Spelvin Date: Sun Feb 10 04:08:32 2013 -0500 pps: Add pps_lookup_dev() function commit 513b032c98b4b9414aa4e9b4a315cb1bf0380101 upstream. The PPS serial line discipline wants to attach a PPS device to a tty without changing the tty code to add a struct pps_device * pointer. Since the number of PPS devices in a typical system is generally very low (n=1 is by far the most common), it's practical to search the entire list of allocated pps devices. (We capture the timestamp before the lookup, so the timing isn't affected.) It is a bit ugly that this function, which is part of the in-kernel PPS API, has to be in pps.c as opposed to kapi,c, but that's not something that affects users. Signed-off-by: George Spelvin Acked-by: Rodolfo Giometti Signed-off-by: Greg Kroah-Hartman commit d032cb6cf0be82fde1b31a3cb3cc22d38f4a25c6 Author: Wei Liu Date: Mon Feb 18 14:57:58 2013 +0000 xen: close evtchn port if binding to irq fails commit e7e44e444876478d50630f57b0c31d29f6725020 upstream. Signed-off-by: Wei Liu Signed-off-by: Konrad Rzeszutek Wilk Signed-off-by: Greg Kroah-Hartman commit b220b3bd428c85dca7c53a96273a334690638398 Author: Stefan Bader Date: Fri Feb 15 09:48:52 2013 +0100 xen: Send spinlock IPI to all waiters commit 76eaca031f0af2bb303e405986f637811956a422 upstream. There is a loophole between Xen's current implementation of pv-spinlocks and the scheduler. This was triggerable through a testcase until v3.6 changed the TLB flushing code. The problem potentially is still there just not observable in the same way. What could happen was (is): 1. CPU n tries to schedule task x away and goes into a slow wait for the runq lock of CPU n-# (must be one with a lower number). 2. CPU n-#, while processing softirqs, tries to balance domains and goes into a slow wait for its own runq lock (for updating some records). Since this is a spin_lock_irqsave in softirq context, interrupts will be re-enabled for the duration of the poll_irq hypercall used by Xen. 3. Before the runq lock of CPU n-# is unlocked, CPU n-1 receives an interrupt (e.g. endio) and when processing the interrupt, tries to wake up task x. But that is in schedule and still on_cpu, so try_to_wake_up goes into a tight loop. 4. The runq lock of CPU n-# gets unlocked, but the message only gets sent to the first waiter, which is CPU n-# and that is busily stuck. 5. CPU n-# never returns from the nested interruption to take and release the lock because the scheduler uses a busy wait. And CPU n never finishes the task migration because the unlock notification only went to CPU n-#. To avoid this and since the unlocking code has no real sense of which waiter is best suited to grab the lock, just send the IPI to all of them. This causes the waiters to return from the hyper- call (those not interrupted at least) and do active spinlocking. BugLink: http://bugs.launchpad.net/bugs/1011792 Acked-by: Jan Beulich Signed-off-by: Stefan Bader Signed-off-by: Konrad Rzeszutek Wilk Signed-off-by: Greg Kroah-Hartman commit e503e9218c460ea05587c44c0bba2131562d1e36 Author: Nicolas Pitre Date: Sun Feb 24 20:06:09 2013 -0500 tty vt: fix character insertion overflow commit a883b70d8e0a88278c0a1f80753b4dc99962b541 upstream. Commit 81732c3b2fed ("tty vt: Fix line garbage in virtual console on command line edition") broke insert_char() in multiple ways. Then commit b1a925f44a3a ("tty vt: Fix a regression in command line edition") partially fixed it. However, the buffer being moved is still too large and overflowing beyond the end of the current line, corrupting existing characters on the next line. Example test case: echo -e "abc\nde\x1b[A\x1b[4h \x1b[4l\x1b[B" Expected result: ab c de Current result: ab c e Needless to say that this is very annoying when inserting words in the middle of paragraphs with certain text editors. Signed-off-by: Nicolas Pitre Acked-by: Jean-François Moine Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit b09c7dedf089d1d9010fb3657bce7d287cb4c92c Author: Jussi Kivilinna Date: Mon Feb 18 10:29:30 2013 +0200 rtlwifi: usb: allocate URB control message setup_packet and data buffer separately commit bc6b89237acb3dee6af6e64e51a18255fef89cc2 upstream. rtlwifi allocates both setup_packet and data buffer of control message urb, using shared kmalloc in _usbctrl_vendorreq_async_write. Structure used for allocating is: struct { u8 data[254]; struct usb_ctrlrequest dr; }; Because 'struct usb_ctrlrequest' is __packed, setup packet is unaligned and DMA mapping of both 'data' and 'dr' confuses ARM/sunxi, leading to memory corruptions and freezes. Patch changes setup packet to be allocated separately. [v2]: - Use WARN_ON_ONCE instead of WARN_ON Signed-off-by: Jussi Kivilinna Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit d28bde334a635c239aab3f2a020f1515b36957cb Author: Larry Finger Date: Fri Feb 8 12:28:18 2013 -0600 rtlwifi: rtl8192cu: Add new USB ID commit 8708aac79e4572ba673d7a21e94ddca9f3abb7fc upstream. A new model of the RTL8188CUS has appeared. Reported-and-tested-by: Thomas Rosenkrantz Signed-off-by: Larry Finger Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 481d8b5ca03dafbab105b8a831694a8d9019267d Author: Larry Finger Date: Wed Feb 6 12:54:17 2013 -0600 rtlwifi: rtl8192cu: Fix NULL dereference BUG when using new_id commit 957f4aca5fa0db69635271bc4621cc0b65b2d590 upstream. When the new_id entry in /sysfs is used for a foreign USB device, rtlwifi BUGS with a NULL pointer dereference because the per-driver configuration data is not available. The probe function has been restructured as suggested by Ben Hutchings . Signed-off-by: Larry Finger Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman commit 936f8ea980bdfa57f7e55e49e020e74547329e01 Author: Larry Finger Date: Sun Feb 17 17:01:20 2013 +0000 b43: Increase number of RX DMA slots commit ccae0e50c16a7f7adb029c169147400d1ce9f703 upstream. Bastian Bittorf reported that some of the silent freezes on a Linksys WRT54G were due to overflow of the RX DMA ring buffer, which was created with 64 slots. That finding reminded me that I was seeing similar crashed on a netbook, which also has a relatively slow processor. After increasing the number of slots to 128, runs on the netbook that previously failed now worked; however, I found that 109 slots had been used in one test. For that reason, the number of slots is being increased to 256. Signed-off-by: Larry Finger Cc: Bastian Bittorf Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit abf98706b62cdd62ec5060cc921726526e2795eb Author: Michael Chan Date: Tue Jan 29 17:54:44 2013 -0800 serial_core: Fix type definition for PORT_BRCM_TRUMANAGE. commit 85f024401bf80746ae08b7fd5809a9b16accf0b1 upstream. It was mistakenly defined to be 24 instead of the next higher number 25. Reported-by: Alexander Shishkin Cc: Stephen Hurd Signed-off-by: Michael Chan Signed-off-by: Greg Kroah-Hartman commit e93a85ac6120ec0b3b53add0a5409f84aad135d8 Author: Thomas Gleixner Date: Thu Feb 14 21:01:06 2013 +0100 serial: imx: Fix recursive locking bug commit 677fe555cbfb188af58cce105f4dae9505e58c31 upstream. commit 9ec1882df2 (tty: serial: imx: console write routing is unsafe on SMP) introduced a recursive locking bug in imx_console_write(). The callchain is: imx_rxint() spin_lock_irqsave(&sport->port.lock,flags); ... uart_handle_sysrq_char(); sysrq_function(); printk(); imx_console_write(); spin_lock_irqsave(&sport->port.lock,flags); <--- DEAD The bad news is that the kernel debugging facilities can dectect the problem, but the printks never surface on the serial console for obvious reasons. There is a similar issue with oops_in_progress. If the kernel crashes we really don't want to be stuck on the lock and unable to tell what happened. In general most UP originated drivers miss these checks and nobody ever notices because CONFIG_PROVE_LOCKING seems to be still ignored by a large number of developers. The solution is to avoid locking in the sysrq case and trylock in the oops_in_progress case. This scheme is used in other drivers as well and it would be nice if we could move this to a common place, so the usual copy/paste/modify bugs can be avoided. Now there is another issue with this scheme: CPU0 CPU1 printk() rxint() sysrq_detection() -> sets port->sysrq return from interrupt console_write() if (port->sysrq) avoid locking port->sysrq is reset with the next receive character. So as long as the port->sysrq is not reset and this can take an endless amount of time if after the break no futher receive character follows, all console writes happen unlocked. While the current writer is protected against other console writers by the console sem, it's unprotected against open/close or other operations which fiddle with the port. That's what the above mentioned commit tried to solve. That's an issue in all drivers which use that scheme and unfortunately there is no easy workaround. The only solution is to have a separate indicator port->sysrq_cpu. uart_handle_sysrq_char() then sets it to smp_processor_id() before calling into handle_sysrq() and resets it to -1 after that. Then change the locking check to: if (port->sysrq_cpu == smp_processor_id()) locked = 0; else if (oops_in_progress) locked = spin_trylock_irqsave(port->lock, flags); else spin_lock_irqsave(port->lock, flags); That would force all other cpus into the spin_lock path. Problem solved, but that's way beyond the scope of this fix and really wants to be implemented in a common function which calls the uart specific write function to avoid another gazillion of hard to debug copy/paste/modify bugs. Reported-and-tested-by: Tim Sander Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit 18e0a5ee96062a403a594edd784b5ad87744c13e Author: Johan Hovold Date: Wed Feb 13 17:53:28 2013 +0100 USB: serial: fix null-pointer dereferences on disconnect commit b2ca699076573c94fee9a73cb0d8645383b602a0 upstream. Make sure serial-driver dtr_rts is called with disc_mutex held after checking the disconnected flag. Due to a bug in the tty layer, dtr_rts may get called after a device has been disconnected and the tty-device unregistered. Some drivers have had individual checks for disconnect to make sure the disconnected interface was not accessed, but this should really be handled in usb-serial core (at least until the long-standing tty-bug has been fixed). Note that the problem has been made more acute with commit 0998d0631001 ("device-core: Ensure drvdata = NULL when no driver is bound") as the port data is now also NULL when dtr_rts is called resulting in further oopses. Reported-by: Chris Ruehl Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman commit 15798c04fead68ba84313e06048ebe168a60de7b Author: Oleg Nesterov Date: Tue Jan 29 20:07:41 2013 +0100 tty: set_termios/set_termiox should not return -EINTR commit 183d95cdd834381c594d3aa801c1f9f9c0c54fa9 upstream. See https://bugzilla.redhat.com/show_bug.cgi?id=904907 read command causes bash to abort with double free or corruption (out). A simple test-case from Roman: // Compile the reproducer and send sigchld ti that process. // EINTR occurs even if SA_RESTART flag is set. void handler(int sig) { } main() { struct sigaction act; act.sa_handler = handler; act.sa_flags = SA_RESTART; sigaction (SIGCHLD, &act, 0); struct termio ttp; ioctl(0, TCGETA, &ttp); while(1) { if (ioctl(0, TCSETAW, ttp) < 0) { if (errno == EINTR) { fprintf(stderr, "BUG!"); return(1); } } } } Change set_termios/set_termiox to return -ERESTARTSYS to fix this particular problem. I didn't dare to change other EINTR's in drivers/tty/, but they look equally wrong. Reported-by: Roman Rakus Reported-by: Lingzhu Xiang Signed-off-by: Oleg Nesterov Cc: Jiri Slaby Signed-off-by: Greg Kroah-Hartman commit e3b3d4f469a05b716fb84d7849c684770945b7cc Author: Dirkjan Bussink Date: Wed Jan 30 11:44:50 2013 +0100 tty: Prevent deadlock in n_gsm driver commit 4d9b109060f690f5c835130ff54165ae157b3087 upstream. This change fixes a deadlock when the multiplexer is closed while there are still client side ports open. When the multiplexer is closed and there are active tty's it tries to close them with tty_vhangup. This has a problem though, because tty_vhangup needs the tty_lock. This patch changes it to unlock the tty_lock before attempting the hangup and relocks afterwards. The additional call to tty_port_tty_set is needed because otherwise the port stays active because of the reference counter. This change also exposed another problem that other code paths don't expect that the multiplexer could have been closed. This patch also adds checks for these cases in the gsmtty_ class of function that could be called. The documentation explicitly states that "first close all virtual ports before closing the physical port" but we've found this to not always reality in our field situations. The GPRS / UTMS modem sometimes crashes and needs a power cycle in that case which means cleanly shutting down everything is not always possible. This change makes it much more robust for our situation where at least the system is recoverable with this patch and doesn't hang in a deadlock situation inside the kernel. The patch is against the long term support kernel (3.4.27) and should apply cleanly to more recent branches. Tested with a Telit GE864-QUADV2 and Telit HE910 modem. Signed-off-by: Dirkjan Bussink Signed-off-by: Greg Kroah-Hartman commit 21d4e0aef18985f9de81e626dbf2e600e47acdc0 Author: Takashi Iwai Date: Mon Feb 4 10:28:15 2013 +0100 ALSA: aloop: Fix Oops while PM resume commit edac894389f9c9de2a1368c78809c824b343f3a5 upstream. snd-aloop driver has no proper PM implementation, thus the PM resume may trigger Oops due to leftover timer instance. This patch adds the missing suspend/resume implementation. Reported-and-tested-by: El boulangero Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 9ac6988465b1290fb70dfd9fdea1405e47b14dd0 Author: Denis Efremov Date: Mon Feb 11 19:04:06 2013 +0400 ALSA: rme32.c irq enabling after spin_lock_irq commit f49a59c4471d81a233e09dda45187cc44fda009d upstream. According to the other code in this driver and similar code in rme96 it seems, that spin_lock_irq in snd_rme32_capture_close function should be paired with spin_unlock_irq. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Denis Efremov Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 156b3e8aba7fb45d2e5460e095b424a984258936 Author: Denis Efremov Date: Mon Feb 11 19:49:48 2013 +0400 ALSA: ali5451: remove irq enabling in pointer callback commit dacae5a19b4cbe1b5e3a86de23ea74cbe9ec9652 upstream. snd_ali_pointer function is called with local interrupts disabled. However it seems very strange to reenable them in such way. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Denis Efremov Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 3b35e5879575980379a7f8dae5d03664440fb39f Author: Konstantin Khlebnikov Date: Thu Jan 24 16:36:31 2013 +0400 workqueue: un-GPL function delayed_work_timer_fn() commit 1438ade5670b56d5386c220e1ad4b5a824a1e585 upstream. commit d8e794dfd51c368ed3f686b7f4172830b60ae47b ("workqueue: set delayed_work->timer function on initialization") exports function delayed_work_timer_fn() only for GPL modules. This makes delayed-works unusable for non-GPL modules, because initialization macro now requires GPL symbol. For example schedule_delayed_work() available for non-GPL. Signed-off-by: Konstantin Khlebnikov Signed-off-by: Tejun Heo Signed-off-by: Greg Kroah-Hartman commit 62f3431166bb78638f83f3a0fcfdba6e94576621 Author: Olaf Hering <[mailto:olaf@aepfle.de]> Date: Sun Feb 3 17:22:37 2013 -0800 x86: Hyper-V: register clocksource only if its advertised commit 32068f6527b8f1822a30671dedaf59c567325026 upstream. Enable hyperv_clocksource only if its advertised as a feature. XenServer 6 returns the signature which is checked in ms_hyperv_platform(), but it does not offer all features. Currently the clocksource is enabled unconditionally in ms_hyperv_init_platform(), and the result is a hanging guest. Hyper-V spec Bit 1 indicates the availability of Partition Reference Counter. Register the clocksource only if this bit is set. The guest in question prints this in dmesg: [ 0.000000] Hypervisor detected: Microsoft HyperV [ 0.000000] HyperV: features 0x70, hints 0x0 This bug can be reproduced easily be setting 'viridian=1' in a HVM domU .cfg file. A workaround without this patch is to boot the HVM guest with 'clocksource=jiffies'. Signed-off-by: Olaf Hering Link: http://lkml.kernel.org/r/1359940959-32168-1-git-send-email-kys@microsoft.com Signed-off-by: K. Y. Srinivasan Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit 643e24307b3bbd5cdbd77423262c1d05dba2633b Author: Leonid Shatz Date: Mon Feb 4 14:33:37 2013 +0200 hrtimer: Prevent hrtimer_enqueue_reprogram race commit b22affe0aef429d657bc6505aacb1c569340ddd2 upstream. hrtimer_enqueue_reprogram contains a race which could result in timer.base switch during unlock/lock sequence. hrtimer_enqueue_reprogram is releasing the lock protecting the timer base for calling raise_softirq_irqsoff() due to a lock ordering issue versus rq->lock. If during that time another CPU calls __hrtimer_start_range_ns() on the same hrtimer, the timer base might switch, before the current CPU can lock base->lock again and therefor the unlock_timer_base() call will unlock the wrong lock. [ tglx: Added comment and massaged changelog ] Signed-off-by: Leonid Shatz Signed-off-by: Izik Eidus Cc: Andrea Arcangeli Link: http://lkml.kernel.org/r/1359981217-389-1-git-send-email-izik.eidus@ravellosystems.com Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit 6cea571c4e71c707da34163d6365859252617c81 Author: Stanislaw Gruszka Date: Fri Feb 15 11:08:11 2013 +0100 posix-cpu-timers: Fix nanosleep task_struct leak commit e6c42c295e071dd74a66b5a9fcf4f44049888ed8 upstream. The trinity fuzzer triggered a task_struct reference leak via clock_nanosleep with CPU_TIMERs. do_cpu_nanosleep() calls posic_cpu_timer_create(), but misses a corresponding posix_cpu_timer_del() which leads to the task_struct reference leak. Reported-and-tested-by: Tommi Rantala Signed-off-by: Stanislaw Gruszka Cc: Dave Jones Cc: John Stultz Cc: Oleg Nesterov Link: http://lkml.kernel.org/r/20130215100810.GF4392@redhat.com Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit a657c66d3ba73cc84201d8fe62adf7e7d97f71df Author: Thomas Gleixner Date: Fri Nov 23 10:08:44 2012 +0100 genirq: Avoid deadlock in spurious handling commit e716efde75267eab919cdb2bef5b2cb77f305326 upstream. commit 52553ddf(genirq: fix regression in irqfixup, irqpoll) introduced a potential deadlock by calling the action handler with the irq descriptor lock held. Remove the call and let the handling code run even for an interrupt where only a single action is registered. That matches the goal of the above commit and avoids the deadlock. Document the confusing action = desc->action reload in the handling loop while at it. Reported-and-tested-by: "Wang, Warner" Tested-by: Edward Donovan Cc: "Wang, Song-Bo (Stoney)" Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit 57eb4c95dff59038eb6223dc7696c93b045c4c3f Author: H. Peter Anvin Date: Thu Feb 7 17:14:08 2013 -0800 timeconst.pl: Eliminate Perl warning commit 63a3f603413ffe82ad775f2d62a5afff87fd94a0 upstream. defined(@array) is deprecated in Perl and gives off a warning. Restructure the code to remove that warning. [ hpa: it would be interesting to revert to the timeconst.bc script. It appears that the failures reported by akpm during testing of that script was due to a known broken version of make, not a problem with bc. The Makefile rules could probably be restructured to avoid the make bug, or it is probably old enough that it doesn't matter. ] Reported-by: Andi Kleen Signed-off-by: H. Peter Anvin Cc: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit 192212ec42e6b0f83b010f94c072b13c14ed1852 Author: Jiri Olsa Date: Sat Oct 20 22:14:10 2012 +0200 perf hists: Fix period symbol_conf.field_sep display commit c0d246b85fc7d42688d7a5d999ea671777caf65b upstream. Currently we don't properly display hist data with symbol_conf.field_sep separator. We need to display either space or separator. Signed-off-by: Jiri Olsa Cc: Arnaldo Carvalho de Melo Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Paul Mackerras Cc: Corey Ashford Cc: Frederic Weisbecker Cc: Namhyung Kim Link: http://lkml.kernel.org/n/tip-cyggwys0bz5kqdowwvfd8h72@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo Cc: Josh Boyer Signed-off-by: Greg Kroah-Hartman commit 98f983fc83de9034ea650d87b1ef69ff31322d5e Author: Vinson Lee Date: Wed Feb 13 13:48:58 2013 -0800 perf tools: Fix build with bison 2.3 and older. commit 85df3b3769222894e9692b383c7af124b7721086 upstream. The %name-prefix "prefix" syntax is not available on bison 2.3 and older. Substitute with the -p "prefix" command-line option for compatibility with older versions of bison. This patch fixes this build error with older versions of bison. CC util/sysfs.o BISON util/pmu-bison.c util/pmu.y:2.14-24: syntax error, unexpected string, expecting = make: *** [util/pmu-bison.c] Error 1 Signed-off-by: Vinson Lee Tested-by: Li Zefan Cc: Ingo Molnar Cc: Jiri Olsa Cc: Li Zefan Cc: Namhyung Kim Cc: Paul Mackerras Cc: Pekka Enberg Link: http://lkml.kernel.org/r/1360792138-29186-1-git-send-email-vlee@twitter.com Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Greg Kroah-Hartman commit 3deacb1e63404a9839e00d6a81d3acd721729695 Author: H. Peter Anvin Date: Thu Jan 31 14:00:48 2013 -0800 x86-32, mm: Remove reference to alloc_remap() commit 07f4207a305c834f528d08428df4531744e25678 upstream. We have removed the remap allocator for x86-32, and x86-64 never had it (and doesn't need it). Remove residual reference to it. Reported-by: Yinghai Lu Signed-off-by: H. Peter Anvin Cc: Dave Hansen Link: http://lkml.kernel.org/r/CAE9FiQVn6_QZi3fNQ-JHYiR-7jeDJ5hT0SyT_%2BzVvfOj=PzF3w@mail.gmail.com Signed-off-by: Greg Kroah-Hartman commit 06e5d6360cb315c42330e84d941ce18567b38727 Author: H. Peter Anvin Date: Thu Jan 31 13:53:10 2013 -0800 x86-32, mm: Remove reference to resume_map_numa_kva() commit bb112aec5ee41427e9b9726e3d57b896709598ed upstream. Remove reference to removed function resume_map_numa_kva(). Signed-off-by: H. Peter Anvin Cc: Dave Hansen Link: http://lkml.kernel.org/r/20130131005616.1C79F411@kernel.stglabs.ibm.com Signed-off-by: Greg Kroah-Hartman commit 65d325e1f36c6db43613802ca319c6ed48c00eb1 Author: Dave Hansen Date: Wed Jan 30 16:56:16 2013 -0800 x86-32, mm: Rip out x86_32 NUMA remapping code commit f03574f2d5b2d6229dcdf2d322848065f72953c7 upstream. This code was an optimization for 32-bit NUMA systems. It has probably been the cause of a number of subtle bugs over the years, although the conditions to excite them would have been hard to trigger. Essentially, we remap part of the kernel linear mapping area, and then sometimes part of that area gets freed back in to the bootmem allocator. If those pages get used by kernel data structures (say mem_map[] or a dentry), there's no big deal. But, if anyone ever tried to use the linear mapping for these pages _and_ cared about their physical address, bad things happen. For instance, say you passed __GFP_ZERO to the page allocator and then happened to get handed one of these pages, it zero the remapped page, but it would make a pte to the _old_ page. There are probably a hundred other ways that it could screw with things. We don't need to hang on to performance optimizations for these old boxes any more. All my 32-bit NUMA systems are long dead and buried, and I probably had access to more than most people. This code is causing real things to break today: https://lkml.org/lkml/2013/1/9/376 I looked in to actually fixing this, but it requires surgery to way too much brittle code, as well as stuff like per_cpu_ptr_to_phys(). [ hpa: Cc: this for -stable, since it is a memory corruption issue. However, an alternative is to simply mark NUMA as depends BROKEN rather than EXPERIMENTAL in the X86_32 subclause... ] Link: http://lkml.kernel.org/r/20130131005616.1C79F411@kernel.stglabs.ibm.com Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman