Skip to contentSkip to conversation

2.6.37.1-stable review

PATCH In review Greg KH 4 participants 280 messages Feb 16, 2011 Page 1 of 2

Subsystems (113)
lore
Share & tools
lore

Greg KH

author
#0 lore raw

cover 2.6.37.1-stable review

Note, there are still some patches that people have sent me that did not make it to this release. They will show up in the next one, this one is big enough, as I'm sure you will agree.

This is the start of the stable review cycle for the 2.6.37.1 release. There are 272 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let us know. If anyone is a maintainer of the proper subsystem, and wants to add a Signed-off-by: line to the patch, please respond with it.

Responses should be made by Friday, Feb 18, 2011 00:00:00 UTC. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.37.1-rc1.gz

and the diffstat can be found below.

thanks,

greg k-h

 Documentation/kernel-parameters.txt            |    1 +
 Makefile                                       |    2 +-
 arch/arm/kernel/head.S                         |   41 ++++---
 arch/arm/mach-s5pv310/cpu.c                    |    2 +-
 arch/arm/mm/init.c                             |    6 +
 arch/arm/oprofile/common.c                     |   12 +--
 arch/avr32/include/asm/syscalls.h              |    9 --
 arch/parisc/kernel/firmware.c                  |   13 +--
 arch/powerpc/boot/dts/p1022ds.dts              |    4 +-
 arch/powerpc/kernel/cpu_setup_6xx.S            |   40 +++---
 arch/powerpc/mm/numa.c                         |    2 +-
 arch/powerpc/platforms/pseries/lpar.c          |   37 ++++++
 arch/powerpc/sysdev/fsl_rio.c                  |    1 -
 arch/sh/include/asm/io.h                       |   10 ++-
 arch/sh/include/asm/pgtable_32.h               |    7 +-
 arch/x86/Kconfig                               |    1 +
 arch/x86/include/asm/mmu_context.h             |    5 +-
 arch/x86/include/asm/uv/uv_bau.h               |    9 +-
 arch/x86/kernel/cpu/mtrr/main.c                |   10 ++-
 arch/x86/kernel/irq.c                          |    3 +-
 arch/x86/kernel/process.c                      |   22 +++-
 arch/x86/platform/uv/tlb_uv.c                  |   22 +++-
 block/blk-core.c                               |   26 +++-
 block/blk-merge.c                              |    3 +-
 block/cfq-iosched.c                            |    4 +
 block/genhd.c                                  |    1 +
 drivers/ata/libata-scsi.c                      |   24 +++-
 drivers/ata/pata_mpc52xx.c                     |    2 +-
 drivers/base/power/runtime.c                   |    9 +-
 drivers/block/nbd.c                            |    3 -
 drivers/char/agp/intel-agp.c                   |   27 +++--
 drivers/char/ipmi/ipmi_si_intf.c               |   12 +--
 drivers/char/tpm/tpm.c                         |   28 ++++-
 drivers/char/tpm/tpm.h                         |    2 +
 drivers/char/tpm/tpm_tis.c                     |   10 +-
 drivers/char/virtio_console.c                  |   15 ++-
 drivers/cpuidle/cpuidle.c                      |   82 ++++++------
 drivers/firewire/core-card.c                   |   11 ++-
 drivers/firmware/dmi_scan.c                    |   11 ++-
 drivers/gpu/drm/Kconfig                        |    3 +
 drivers/gpu/drm/drm_crtc_helper.c              |   17 ++-
 drivers/gpu/drm/i915/i915_dma.c                |   10 ++-
 drivers/gpu/drm/i915/i915_drv.c                |   10 ++-
 drivers/gpu/drm/i915/i915_drv.h                |    1 +
 drivers/gpu/drm/i915/i915_reg.h                |    9 +-
 drivers/gpu/drm/i915/intel_crt.c               |   30 ++++-
 drivers/gpu/drm/i915/intel_display.c           |    4 +-
 drivers/gpu/drm/i915/intel_dp.c                |   23 +++-
 drivers/gpu/drm/i915/intel_drv.h               |    3 +
 drivers/gpu/drm/i915/intel_lvds.c              |   18 ++--
 drivers/gpu/drm/i915/intel_panel.c             |   31 +++++
 drivers/gpu/drm/i915/intel_sdvo.c              |   33 ++----
 drivers/gpu/drm/radeon/atombios_crtc.c         |   18 +++-
 drivers/gpu/drm/radeon/atombios_dp.c           |    4 +-
 drivers/gpu/drm/radeon/evergreen.c             |    7 +-
 drivers/gpu/drm/radeon/evergreen_blit_kms.c    |   39 +++++-
 drivers/gpu/drm/radeon/radeon_atombios.c       |   47 ++++----
 drivers/gpu/drm/radeon/radeon_display.c        |  132 +++++++++++++++++++--
 drivers/gpu/drm/radeon/radeon_legacy_crtc.c    |    6 +-
 drivers/gpu/drm/radeon/radeon_mode.h           |   23 +++-
 drivers/gpu/vga/vgaarb.c                       |    2 +-
 drivers/hwmon/applesmc.c                       |   48 +++-----
 drivers/hwmon/lm63.c                           |   59 +++++++--
 drivers/hwmon/via686a.c                        |   14 ++-
 drivers/i2c/i2c-core.c                         |   14 ++-
 drivers/idle/intel_idle.c                      |   43 +++++++-
 drivers/infiniband/hw/cxgb4/cm.c               |    2 +-
 drivers/infiniband/hw/cxgb4/qp.c               |    6 +-
 drivers/input/input.c                          |   37 ++----
 drivers/input/mouse/bcm5974.c                  |   40 ++++++
 drivers/input/serio/i8042-x86ia64io.h          |   21 +++
 drivers/input/serio/i8042.c                    |    6 +-
 drivers/md/dm-mpath.c                          |   12 --
 drivers/md/dm.c                                |    5 +-
 drivers/md/md.c                                |   27 +++--
 drivers/md/md.h                                |    3 +-
 drivers/media/IR/ir-keytable.c                 |   28 +++--
 drivers/media/dvb/frontends/ix2505v.c          |    2 +-
 drivers/media/radio/radio-aimslab.c            |   23 +---
 drivers/media/video/em28xx/em28xx-cards.c      |    4 +-
 drivers/mmc/host/bfin_sdh.c                    |    2 +-
 drivers/mtd/nand/pxa3xx_nand.c                 |    2 +-
 drivers/net/e1000/e1000_main.c                 |   10 +-
 drivers/net/fec.c                              |    4 +-
 drivers/net/ixgbe/ixgbe_main.c                 |   11 ++-
 drivers/net/virtio_net.c                       |   27 +++--
 drivers/net/wireless/ath/ath9k/ar9002_calib.c  |   10 +-
 drivers/net/wireless/ath/ath9k/ar9002_hw.c     |    3 +-
 drivers/net/wireless/ath/ath9k/ar9003_eeprom.c |   14 ++-
 drivers/net/wireless/ath/ath9k/ath9k.h         |    4 +-
 drivers/net/wireless/ath/ath9k/hif_usb.c       |   40 ++++++-
 drivers/net/wireless/ath/ath9k/hif_usb.h       |    1 +
 drivers/net/wireless/ath/ath9k/hw.c            |    6 +-
 drivers/net/wireless/ath/ath9k/hw.h            |    1 +
 drivers/net/wireless/ath/ath9k/main.c          |    8 +-
 drivers/net/wireless/ath/ath9k/pci.c           |    4 +
 drivers/net/wireless/ath/carl9170/rx.c         |    2 +-
 drivers/net/wireless/ath/key.c                 |    2 +
 drivers/net/wireless/hostap/hostap_cs.c        |   15 +--
 drivers/net/wireless/iwlwifi/iwl-agn.c         |   15 ++-
 drivers/net/wireless/iwlwifi/iwl-helpers.h     |    6 +
 drivers/net/wireless/p54/txrx.c                |    2 +-
 drivers/net/wireless/rt2x00/rt73usb.c          |    1 +
 drivers/pci/pci-stub.c                         |    3 +
 drivers/power/ds2760_battery.c                 |    2 +-
 drivers/power/jz4740-battery.c                 |    7 +
 drivers/rtc/rtc-cmos.c                         |   16 ++-
 drivers/s390/cio/qdio.h                        |    6 +
 drivers/s390/cio/qdio_main.c                   |   43 +++++---
 drivers/s390/crypto/ap_bus.c                   |    2 +-
 drivers/scsi/libsas/sas_scsi_host.c            |    1 +
 drivers/scsi/mpt2sas/mpt2sas_base.c            |   24 +++-
 drivers/scsi/mpt2sas/mpt2sas_scsih.c           |   64 ++++++++--
 drivers/scsi/sd.c                              |    9 ++-
 drivers/serial/68360serial.c                   |    1 +
 drivers/serial/8250.c                          |    3 +-
 drivers/ssb/pcmcia.c                           |    2 +-
 drivers/staging/bcm/InterfaceInit.c            |    1 +
 drivers/staging/bcm/InterfaceInit.h            |    1 +
 drivers/staging/brcm80211/sys/wl_mac80211.c    |   45 ++++----
 drivers/staging/comedi/drivers/jr3_pci.c       |    7 +
 drivers/staging/comedi/drivers/ni_labpc.c      |    3 +-
 drivers/staging/hv/blkvsc_drv.c                |    1 +
 drivers/staging/hv/netvsc.c                    |    2 +-
 drivers/staging/hv/netvsc_drv.c                |    2 +-
 drivers/staging/iio/adc/ad7476_core.c          |    2 +-
 drivers/staging/iio/adc/ad799x_core.c          |    2 +-
 drivers/staging/rt2860/chips/rt3090.c          |    3 +-
 drivers/staging/rt2860/chips/rt30xx.c          |    4 +-
 drivers/staging/rt2860/rt_main_dev.c           |    2 -
 drivers/staging/rt2860/usb_main_dev.c          |    1 +
 drivers/staging/rtl8712/usb_intf.c             |  145 +++++++++++++++++-----
 drivers/staging/speakup/kobjects.c             |    2 +-
 drivers/staging/usbip/vhci_hcd.c               |   14 --
 drivers/staging/zram/zram_drv.c                |    4 +
 drivers/tty/n_gsm.c                            |    1 +
 drivers/tty/sysrq.c                            |   19 +++-
 drivers/usb/class/cdc-acm.c                    |    1 +
 drivers/usb/core/hcd-pci.c                     |    7 +-
 drivers/usb/core/hcd.c                         |    2 +-
 drivers/usb/core/hub.c                         |   26 ++++
 drivers/usb/gadget/printer.c                   |   19 ++--
 drivers/usb/host/ehci-au1xxx.c                 |    2 +-
 drivers/usb/host/ehci-hcd.c                    |   27 +++-
 drivers/usb/host/ehci-hub.c                    |    7 +
 drivers/usb/host/ehci-pci.c                    |   41 ++++++-
 drivers/usb/host/ehci-sched.c                  |   79 ++++++++++++
 drivers/usb/host/ehci.h                        |    1 +
 drivers/usb/host/xhci-ring.c                   |    2 +-
 drivers/usb/host/xhci.c                        |   60 ++++------
 drivers/usb/serial/ch341.c                     |   10 ++
 drivers/usb/serial/cp210x.c                    |   16 +--
 drivers/usb/serial/digi_acceleport.c           |   10 --
 drivers/usb/serial/ftdi_sio.c                  |   39 ++++++-
 drivers/usb/serial/ftdi_sio_ids.h              |   32 +++++-
 drivers/usb/serial/generic.c                   |   20 +++
 drivers/usb/serial/io_edgeport.c               |    4 +-
 drivers/usb/serial/io_tables.h                 |    1 +
 drivers/usb/serial/iuu_phoenix.c               |    1 +
 drivers/usb/serial/keyspan.h                   |    4 +
 drivers/usb/serial/keyspan_pda.c               |   17 ---
 drivers/usb/serial/moto_modem.c                |    1 +
 drivers/usb/serial/option.c                    |   23 +++-
 drivers/usb/serial/oti6858.c                   |    1 +
 drivers/usb/serial/pl2303.c                    |   12 ++
 drivers/usb/serial/pl2303.h                    |    1 +
 drivers/usb/serial/qcaux.c                     |    3 +
 drivers/usb/serial/siemens_mpi.c               |    1 +
 drivers/usb/serial/spcp8x5.c                   |    7 +-
 drivers/usb/serial/ti_usb_3410_5052.c          |    2 +-
 drivers/usb/serial/usb-serial.c                |    8 +-
 drivers/usb/serial/usb_debug.c                 |    1 +
 drivers/usb/storage/unusual_cypress.h          |    5 +
 drivers/usb/storage/unusual_devs.h             |   32 +++++
 drivers/video/aty/atyfb_base.c                 |   27 +----
 drivers/video/backlight/88pm860x_bl.c          |    4 +-
 drivers/virtio/virtio_pci.c                    |   20 +---
 drivers/xen/platform-pci.c                     |   21 +--
 fs/cifs/cifsproto.h                            |    2 +-
 fs/cifs/cifssmb.c                              |    4 +-
 fs/cifs/connect.c                              |    4 +-
 fs/cifs/file.c                                 |   21 ++--
 fs/cifs/misc.c                                 |    2 +-
 fs/direct-io.c                                 |   10 +-
 fs/eventpoll.c                                 |   16 ++-
 fs/exofs/inode.c                               |    2 -
 fs/ext4/inode.c                                |    1 +
 fs/ext4/mballoc.c                              |  102 +++++++++------
 fs/ext4/page-io.c                              |   11 +-
 fs/ext4/super.c                                |   41 ++++---
 fs/fs-writeback.c                              |   98 ++++++++++++---
 fs/nfs/delegation.c                            |    6 +-
 fs/nfs/dir.c                                   |   50 ++++----
 fs/nfs/direct.c                                |   34 +++--
 fs/nfs/nfs2xdr.c                               |    6 -
 fs/nfs/nfs3xdr.c                               |    6 -
 fs/nfs/nfs4xdr.c                               |    6 -
 fs/nfsd/nfs4idmap.c                            |    4 +-
 fs/nfsd/nfsd.h                                 |    1 +
 fs/nfsd/nfsproc.c                              |    2 +-
 fs/nilfs2/super.c                              |    3 +-
 fs/partitions/check.c                          |   10 ++-
 fs/proc/kcore.c                                |    2 +-
 include/drm/drm_pciids.h                       |    1 -
 include/linux/blkdev.h                         |    1 +
 include/linux/completion.h                     |    8 +-
 include/linux/dynamic_debug.h                  |   18 +--
 include/linux/genhd.h                          |    2 +
 include/linux/ieee80211.h                      |    2 +-
 include/linux/klist.h                          |    2 +-
 include/linux/kref.h                           |    1 +
 include/linux/lockdep.h                        |    3 +
 include/linux/memory_hotplug.h                 |    6 +
 include/linux/mmzone.h                         |   10 +-
 include/linux/nl80211.h                        |    6 +-
 include/linux/oprofile.h                       |   13 ++-
 include/linux/radix-tree.h                     |   16 +++
 include/linux/security.h                       |   15 +--
 include/linux/sunrpc/xdr.h                     |    4 +-
 include/linux/sysrq.h                          |    3 +
 include/linux/usb/hcd.h                        |    1 +
 include/linux/usb/serial.h                     |    3 +
 include/linux/vmstat.h                         |    5 +
 include/net/cfg80211.h                         |   15 ++-
 include/scsi/scsi.h                            |    1 +
 init/calibrate.c                               |    6 +-
 kernel/irq/migration.c                         |   14 ++-
 kernel/perf_event.c                            |   15 ++-
 kernel/ptrace.c                                |    2 +-
 kernel/sched.c                                 |   22 +++-
 kernel/sched_rt.c                              |    2 +-
 kernel/smp.c                                   |   30 +++++
 kernel/sys.c                                   |    3 +-
 kernel/sysctl.c                                |    3 +-
 kernel/trace/trace.c                           |    6 +-
 kernel/watchdog.c                              |   41 +++----
 kernel/workqueue.c                             |   14 ++-
 lib/dynamic_debug.c                            |    9 +-
 lib/kref.c                                     |   12 ++
 mm/memcontrol.c                                |    7 +-
 mm/memory_hotplug.c                            |    4 +
 mm/migrate.c                                   |   75 ++++--------
 mm/mmzone.c                                    |   21 ---
 mm/page_alloc.c                                |   35 ++++--
 mm/slub.c                                      |    4 +-
 mm/vmscan.c                                    |   23 ++--
 mm/vmstat.c                                    |   68 ++++++++++-
 net/ax25/af_ax25.c                             |    2 +-
 net/core/ethtool.c                             |    2 +-
 net/core/rtnetlink.c                           |    3 +
 net/core/sock.c                                |    2 +-
 net/ipv4/ip_fragment.c                         |   34 +++++
 net/ipv6/ip6_output.c                          |    3 +
 net/mac80211/agg-rx.c                          |   11 +--
 net/mac80211/key.c                             |    6 +
 net/mac80211/rx.c                              |    4 +-
 net/mac80211/tx.c                              |    6 +-
 net/sched/sch_fifo.c                           |    2 -
 net/sunrpc/xdr.c                               |  155 +++++++++++++++++++-----
 net/unix/af_unix.c                             |    2 +-
 net/wireless/reg.c                             |   33 +++++-
 security/capability.c                          |    2 +-
 security/security.c                            |    3 +-
 security/selinux/hooks.c                       |   15 ++-
 security/selinux/nlmsgtab.c                    |    2 +
 security/smack/smack_lsm.c                     |   14 +-
 sound/atmel/ac97c.c                            |    5 +-
 sound/core/hrtimer.c                           |    5 +-
 sound/pci/au88x0/au88x0_pcm.c                  |   24 +++-
 sound/pci/hda/hda_codec.c                      |    3 +
 sound/pci/hda/hda_eld.c                        |    2 +-
 sound/pci/hda/patch_conexant.c                 |    9 ++-
 sound/pci/hda/patch_hdmi.c                     |   51 ++++++++-
 sound/pci/hda/patch_realtek.c                  |    2 +
 sound/pci/hda/patch_sigmatel.c                 |    2 +-
 sound/soc/blackfin/bf5xx-ac97.c                |    4 +-
 sound/soc/blackfin/bf5xx-tdm.c                 |    2 +-
 sound/soc/codecs/wm8990.c                      |   10 +-
 sound/soc/codecs/wm8994.c                      |   17 ++-
 sound/soc/codecs/wm_hubs.c                     |   15 +--
 sound/soc/davinci/davinci-evm.c                |    2 +-
 sound/soc/pxa/corgi.c                          |    4 +-
 sound/soc/pxa/poodle.c                         |    2 +-
 sound/soc/pxa/spitz.c                          |    4 +-
 sound/soc/soc-core.c                           |    2 +-
 sound/usb/midi.c                               |   11 ++-
 sound/usb/usx2y/us122l.c                       |   41 +++---
 287 files changed, 2858 insertions(+), 1280 deletions(-)
author
#1 lore raw

PATCH 1/272 Staging: Beceem: add USB id for BCSM250 Mobile WiMAX

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Dan Carpenter <[email protected]>

commit 85c0b1760a7c259679d188bef58866fc641deca5 upstream.

---
 drivers/staging/bcm/InterfaceInit.c |    1 +
 drivers/staging/bcm/InterfaceInit.h |    1 +
 2 files changed, 2 insertions(+)
drivers/staging/bcm/InterfaceInit.c +1 -0
@@ -4,6 +4,7 @@ static struct usb_device_id InterfaceUsb
     { USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_T3) },
 	{ USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_T3B) },
 	{ USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_T3L) },
+	{ USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_SM250) },
     	{ USB_DEVICE(BCM_USB_VENDOR_ID_ZTE, BCM_USB_PRODUCT_ID_226) },
 	{ USB_DEVICE(BCM_USB_VENDOR_ID_FOXCONN, BCM_USB_PRODUCT_ID_1901) },
     {}
drivers/staging/bcm/InterfaceInit.h +1 -0
@@ -8,6 +8,7 @@
 #define BCM_USB_PRODUCT_ID_T3 	0x0300
 #define BCM_USB_PRODUCT_ID_T3B 	0x0210
 #define BCM_USB_PRODUCT_ID_T3L 	0x0220
+#define BCM_USB_PRODUCT_ID_SM250 	0xbccd
 #define BCM_USB_PRODUCT_ID_SYM  0x15E
 #define BCM_USB_PRODUCT_ID_1901 0xe017
 #define BCM_USB_PRODUCT_ID_226  0x0132
author
#2 lore raw

PATCH 2/272 staging: usbip: remove double giveback of URB

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: =?UTF-8?q?M=C3=A1rton=20N=C3=A9meth?= <[email protected]>

commit 7571f089d7522a95c103558faf313c7af8856ceb upstream.

In the vhci_urb_dequeue() function the TCP connection is checked twice. Each time when the TCP connection is closed the URB is unlinked and given back. Remove the second attempt of unlinking and giving back of the URB completely.

This patch fixes the bug described at https://bugzilla.kernel.org/show_bug.cgi?id=24872 .

---
 drivers/staging/usbip/vhci_hcd.c |   14 --------------
 1 file changed, 14 deletions(-)
drivers/staging/usbip/vhci_hcd.c +0 -14
@@ -799,20 +799,6 @@ static int vhci_urb_dequeue(struct usb_h
 		spin_unlock_irqrestore(&vdev->priv_lock, flags2);
 	}
 
-
-	if (!vdev->ud.tcp_socket) {
-		/* tcp connection is closed */
-		usbip_uinfo("vhci_hcd: vhci_urb_dequeue() gives back urb %p\n",
-									urb);
-
-		usb_hcd_unlink_urb_from_ep(hcd, urb);
-
-		spin_unlock_irqrestore(&the_controller->lock, flags);
-		usb_hcd_giveback_urb(vhci_to_hcd(the_controller), urb,
-								urb->status);
-		spin_lock_irqsave(&the_controller->lock, flags);
-	}
-
 	spin_unlock_irqrestore(&the_controller->lock, flags);
 
 	usbip_dbg_vhci_hc("leave\n");
author
#3 lore raw

PATCH 3/272 USB: EHCI: ASPM quirk of ISOC on AMD SB800

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Alex He <[email protected]>

commit 05570297ecbe834b1756b522412b68eaffb9ab11 upstream.

When ASPM PM Feature is enabled on UMI link, devices that use ISOC stream of data transfer may be exposed to longer latency causing less than optimal per- formance of the device. The longer latencies are normal and are due to link wake time coming out of low power state which happens frequently to save power when the link is not active.
The following code will make exception for certain features of ASPM to be by passed and keep the logic normal state only when the ISOC device is connected and active. This change will allow the device to run at optimal performance yet minimize the impact on overall power savings.

---
 drivers/usb/host/ehci-hcd.c   |    8 ++++
 drivers/usb/host/ehci-pci.c   |   32 +++++++++++++++++
 drivers/usb/host/ehci-sched.c |   79 ++++++++++++++++++++++++++++++++++++++++++
 drivers/usb/host/ehci.h       |    1 
 4 files changed, 120 insertions(+)
drivers/usb/host/ehci-hcd.c +8 -0
@@ -114,6 +114,9 @@ MODULE_PARM_DESC(hird, "host initiated r
 
 #define	INTR_MASK (STS_IAA | STS_FATAL | STS_PCD | STS_ERR | STS_INT)
 
+/* for ASPM quirk of ISOC on AMD SB800 */
+static struct pci_dev *amd_nb_dev;
+
 /*-------------------------------------------------------------------------*/
 
 #include "ehci.h"
@@ -529,6 +532,11 @@ static void ehci_stop (struct usb_hcd *h
 	spin_unlock_irq (&ehci->lock);
 	ehci_mem_cleanup (ehci);
 
+	if (amd_nb_dev) {
+		pci_dev_put(amd_nb_dev);
+		amd_nb_dev = NULL;
+	}
+
 #ifdef	EHCI_STATS
 	ehci_dbg (ehci, "irq normal %ld err %ld reclaim %ld (lost %ld)\n",
 		ehci->stats.normal, ehci->stats.error, ehci->stats.reclaim,
drivers/usb/host/ehci-pci.c +32 -0
@@ -41,6 +41,35 @@ static int ehci_pci_reinit(struct ehci_h
 	return 0;
 }
 
+static int ehci_quirk_amd_SB800(struct ehci_hcd *ehci)
+{
+	struct pci_dev *amd_smbus_dev;
+	u8 rev = 0;
+
+	amd_smbus_dev = pci_get_device(PCI_VENDOR_ID_ATI, 0x4385, NULL);
+	if (!amd_smbus_dev)
+		return 0;
+
+	pci_read_config_byte(amd_smbus_dev, PCI_REVISION_ID, &rev);
+	if (rev < 0x40) {
+		pci_dev_put(amd_smbus_dev);
+		amd_smbus_dev = NULL;
+		return 0;
+	}
+
+	if (!amd_nb_dev)
+		amd_nb_dev = pci_get_device(PCI_VENDOR_ID_AMD, 0x1510, NULL);
+	if (!amd_nb_dev)
+		ehci_err(ehci, "QUIRK: unable to get AMD NB device\n");
+
+	ehci_info(ehci, "QUIRK: Enable AMD SB800 L1 fix\n");
+
+	pci_dev_put(amd_smbus_dev);
+	amd_smbus_dev = NULL;
+
+	return 1;
+}
+
 /* called during probe() after chip reset completes */
 static int ehci_pci_setup(struct usb_hcd *hcd)
 {
@@ -99,6 +128,9 @@ static int ehci_pci_setup(struct usb_hcd
 	/* cache this readonly data; minimize chip reads */
 	ehci->hcs_params = ehci_readl(ehci, &ehci->caps->hcs_params);
 
+	if (ehci_quirk_amd_SB800(ehci))
+		ehci->amd_l1_fix = 1;
+
 	retval = ehci_halt(ehci);
 	if (retval)
 		return retval;
drivers/usb/host/ehci-sched.c +79 -0

109 lines not on this page · raw message

drivers/usb/host/ehci.h +1 -0
@@ -131,6 +131,7 @@ struct ehci_hcd {			/* one per controlle
 	unsigned		has_amcc_usb23:1;
 	unsigned		need_io_watchdog:1;
 	unsigned		broken_periodic:1;
+	unsigned		amd_l1_fix:1;
 	unsigned		fs_i_thresh:1;	/* Intel iso scheduling */
 	unsigned		use_dummy_qh:1;	/* AMD Frame List table quirk*/
 
author
#4 lore raw

PATCH 4/272 rt2x00: add device id for windy31 usb device

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Greg Kroah-Hartman <[email protected]>

commit 9c4cf6d94fb362c27a24df5223ed6e327eb7279a upstream.

This patch adds the device id for the windy31 USB device to the rt73usb driver.

Thanks to Ralf Flaxa for reporting this and providing testing and a sample device.

---
 drivers/net/wireless/rt2x00/rt73usb.c |    1 +
 1 file changed, 1 insertion(+)
drivers/net/wireless/rt2x00/rt73usb.c +1 -0
@@ -2417,6 +2417,7 @@ static struct usb_device_id rt73usb_devi
 	{ USB_DEVICE(0x04bb, 0x093d), USB_DEVICE_DATA(&rt73usb_ops) },
 	{ USB_DEVICE(0x148f, 0x2573), USB_DEVICE_DATA(&rt73usb_ops) },
 	{ USB_DEVICE(0x148f, 0x2671), USB_DEVICE_DATA(&rt73usb_ops) },
+	{ USB_DEVICE(0x0812, 0x3101), USB_DEVICE_DATA(&rt73usb_ops) },
 	/* Qcom */
 	{ USB_DEVICE(0x18e8, 0x6196), USB_DEVICE_DATA(&rt73usb_ops) },
 	{ USB_DEVICE(0x18e8, 0x6229), USB_DEVICE_DATA(&rt73usb_ops) },
author
#5 lore raw

PATCH 5/272 staging: rt2870sta: Add ID for Linksys WUSB100v2

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Larry Finger <[email protected]>

commit 27c82819a5a42f08fc0f787ab1b0c129cbdda801 upstream.

This device was tested with rt2870sta by setting new_id.

---
 drivers/staging/rt2860/usb_main_dev.c |    1 +
 1 file changed, 1 insertion(+)
drivers/staging/rt2860/usb_main_dev.c +1 -0
@@ -106,6 +106,7 @@ struct usb_device_id rtusb_usb_id[] = {
 	{USB_DEVICE(0x0411, 0x016f)},	/* MelCo.,Inc. WLI-UC-G301N */
 	{USB_DEVICE(0x1737, 0x0070)},	/* Linksys WUSB100 */
 	{USB_DEVICE(0x1737, 0x0071)},	/* Linksys WUSB600N */
+	{USB_DEVICE(0x1737, 0x0078)},	/* Linksys WUSB100v2 */
 	{USB_DEVICE(0x0411, 0x00e8)},	/* Buffalo WLI-UC-G300N */
 	{USB_DEVICE(0x050d, 0x815c)},	/* Belkin F5D8053 */
 	{USB_DEVICE(0x100D, 0x9031)},	/* Motorola 2770 */
author
#6 lore raw

PATCH 6/272 ALSA: snd-usb-us122l: Fix MIDI output

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Karsten Wiese <[email protected]>

commit 921eebdc18c82268eab446592191b39e35d031d6 upstream.

The US-122L always reads 9 bytes per urb unless they are set to 0xFD.

---
 sound/usb/midi.c |   11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)
sound/usb/midi.c +9 -2
@@ -850,8 +850,8 @@ static void snd_usbmidi_us122l_output(st
 		return;
 	}
 
-	memset(urb->transfer_buffer + count, 0xFD, 9 - count);
-	urb->transfer_buffer_length = count;
+	memset(urb->transfer_buffer + count, 0xFD, ep->max_transfer - count);
+	urb->transfer_buffer_length = ep->max_transfer;
 }
 
 static struct usb_protocol_ops snd_usbmidi_122l_ops = {
@@ -1295,6 +1295,13 @@ static int snd_usbmidi_out_endpoint_crea
 	case USB_ID(0x1a86, 0x752d): /* QinHeng CH345 "USB2.0-MIDI" */
 		ep->max_transfer = 4;
 		break;
+		/*
+		 * Some devices only work with 9 bytes packet size:
+		 */
+	case USB_ID(0x0644, 0x800E): /* Tascam US-122L */
+	case USB_ID(0x0644, 0x800F): /* Tascam US-144 */
+		ep->max_transfer = 9;
+		break;
 	}
 	for (i = 0; i < OUTPUT_URBS; ++i) {
 		buffer = usb_alloc_coherent(umidi->dev,
author
#7 lore raw

PATCH 7/272 ALSA: snd-usb-us122l: Fix missing NULL checks

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Karsten Wiese <[email protected]>

commit cdce2db74e156fbd9a2dc3c7b246166f8b70955b upstream.

Fix missing NULL checks in usb_stream_hwdep_poll() and usb_stream_hwdep_ioctl(). Wake up poll waiters before returning from usb_stream_hwdep_ioctl().

---
 sound/usb/usx2y/us122l.c |   41 ++++++++++++++++++++---------------------
 1 file changed, 20 insertions(+), 21 deletions(-)
sound/usb/usx2y/us122l.c +20 -21
@@ -273,29 +273,26 @@ static unsigned int usb_stream_hwdep_pol
 					  struct file *file, poll_table *wait)
 {
 	struct us122l	*us122l = hw->private_data;
-	struct usb_stream *s = us122l->sk.s;
 	unsigned	*polled;
 	unsigned int	mask;
 
 	poll_wait(file, &us122l->sk.sleep, wait);
 
-	switch (s->state) {
-	case usb_stream_ready:
-		if (us122l->first == file)
-			polled = &s->periods_polled;
-		else
-			polled = &us122l->second_periods_polled;
-		if (*polled != s->periods_done) {
-			*polled = s->periods_done;
-			mask = POLLIN | POLLOUT | POLLWRNORM;
-			break;
+	mask = POLLIN | POLLOUT | POLLWRNORM | POLLERR;
+	if (mutex_trylock(&us122l->mutex)) {
+		struct usb_stream *s = us122l->sk.s;
+		if (s && s->state == usb_stream_ready) {
+			if (us122l->first == file)
+				polled = &s->periods_polled;
+			else
+				polled = &us122l->second_periods_polled;
+			if (*polled != s->periods_done) {
+				*polled = s->periods_done;
+				mask = POLLIN | POLLOUT | POLLWRNORM;
+			} else
+				mask = 0;
 		}
-		/* Fall through */
-		mask = 0;
-		break;
-	default:
-		mask = POLLIN | POLLOUT | POLLWRNORM | POLLERR;
-		break;
+		mutex_unlock(&us122l->mutex);
 	}
 	return mask;
 }
@@ -381,6 +378,7 @@ static int usb_stream_hwdep_ioctl(struct
 {
 	struct usb_stream_config *cfg;
 	struct us122l *us122l = hw->private_data;
+	struct usb_stream *s;
 	unsigned min_period_frames;
 	int err = 0;
 	bool high_speed;
@@ -426,18 +424,18 @@ static int usb_stream_hwdep_ioctl(struct
 	snd_power_wait(hw->card, SNDRV_CTL_POWER_D0);
 
 	mutex_lock(&us122l->mutex);
+	s = us122l->sk.s;
 	if (!us122l->master)
 		us122l->master = file;
 	else if (us122l->master != file) {
-		if (memcmp(cfg, &us122l->sk.s->cfg, sizeof(*cfg))) {
+		if (!s || memcmp(cfg, &s->cfg, sizeof(*cfg))) {
 			err = -EIO;
 			goto unlock;
 		}
 		us122l->slave = file;
 	}
-	if (!us122l->sk.s ||
-	    memcmp(cfg, &us122l->sk.s->cfg, sizeof(*cfg)) ||
-	    us122l->sk.s->state == usb_stream_xrun) {
+	if (!s || memcmp(cfg, &s->cfg, sizeof(*cfg)) ||
+	    s->state == usb_stream_xrun) {
 		us122l_stop(us122l);
 		if (!us122l_start(us122l, cfg->sample_rate, cfg->period_frames))
 			err = -EIO;
@@ -448,6 +446,7 @@ unlock:
 	mutex_unlock(&us122l->mutex);
 free:
 	kfree(cfg);
+	wake_up_all(&us122l->sk.sleep);
 	return err;
 }
 
author
#8 lore raw

PATCH 8/272 libata: set queue DMA alignment to sector size for ATAPI too

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Tejun Heo <[email protected]>

commit 729a6a300e628a48cf12bac93a964a535e83cd1d upstream.

ata_pio_sectors() expects buffer for each sector to be contained in a single page; otherwise, it ends up overrunning the first page. This is achieved by setting queue DMA alignment. If sector_size is smaller than PAGE_SIZE and all buffers are sector_size aligned, buffer for each sector is always contained in a single page.

This wasn't applied to ATAPI devices but IDENTIFY_PACKET is executed as ATA_PROT_PIO and thus uses ata_pio_sectors(). Newer versions of udev issue IDENTIFY_PACKET with unaligned buffer triggering the problem and causing oops.

This patch fixes the problem by setting sdev->sector_size to ATA_SECT_SIZE on ATATPI devices and always setting DMA alignment to sector_size. While at it, add a warning for the unlikely but still possible scenario where sector_size is larger than PAGE_SIZE, in which case the alignment wouldn't be enough.

---
 drivers/ata/libata-scsi.c |   24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)
drivers/ata/libata-scsi.c +18 -6
@@ -1102,9 +1102,9 @@ static int ata_scsi_dev_config(struct sc
 		struct request_queue *q = sdev->request_queue;
 		void *buf;
 
-		/* set the min alignment and padding */
-		blk_queue_update_dma_alignment(sdev->request_queue,
-					       ATA_DMA_PAD_SZ - 1);
+		sdev->sector_size = ATA_SECT_SIZE;
+
+		/* set DMA padding */
 		blk_queue_update_dma_pad(sdev->request_queue,
 					 ATA_DMA_PAD_SZ - 1);
 
@@ -1118,13 +1118,25 @@ static int ata_scsi_dev_config(struct sc
 
 		blk_queue_dma_drain(q, atapi_drain_needed, buf, ATAPI_MAX_DRAIN);
 	} else {
-		/* ATA devices must be sector aligned */
 		sdev->sector_size = ata_id_logical_sector_size(dev->id);
-		blk_queue_update_dma_alignment(sdev->request_queue,
-					       sdev->sector_size - 1);
 		sdev->manage_start_stop = 1;
 	}
 
+	/*
+	 * ata_pio_sectors() expects buffer for each sector to not cross
+	 * page boundary.  Enforce it by requiring buffers to be sector
+	 * aligned, which works iff sector_size is not larger than
+	 * PAGE_SIZE.  ATAPI devices also need the alignment as
+	 * IDENTIFY_PACKET is executed as ATA_PROT_PIO.
+	 */
+	if (sdev->sector_size > PAGE_SIZE)
+		ata_dev_printk(dev, KERN_WARNING,
+			"sector_size=%u > PAGE_SIZE, PIO may malfunction\n",
+			sdev->sector_size);
+
+	blk_queue_update_dma_alignment(sdev->request_queue,
+				       sdev->sector_size - 1);
+
 	if (dev->flags & ATA_DFLAG_AN)
 		set_bit(SDEV_EVT_MEDIA_CHANGE, sdev->supported_events);
 
author
#9 lore raw

PATCH 9/272 x86, UV, BAU: Extend for more than 16 cpus per socket

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Cliff Wickman <[email protected]>

commit cfa60917f0ba6eca83f41aef3cb4a7dd7736ac9f upstream.

Fix a hard-coded limit of a maximum of 16 cpu's per socket.

The UV Broadcast Assist Unit code initializes by scanning the cpu topology of the system and assigning a master cpu for each socket and UV hub. That scan had an assumption of a limit of 16 cpus per socket. With Westmere we are going over that limit. The UV hub hardware will allow up to 32.

If the scan finds the system has gone over that limit it returns an error and we print a warning and fall back to doing TLB shootdowns without the BAU.

LKML-Reference: <[email protected]>

---
 arch/x86/include/asm/uv/uv_bau.h |    9 +++++----
 arch/x86/platform/uv/tlb_uv.c    |   22 ++++++++++++++++++----
 2 files changed, 23 insertions(+), 8 deletions(-)
arch/x86/include/asm/uv/uv_bau.h +5 -4
@@ -26,20 +26,22 @@
  * BAU_SB_DESCRIPTOR_BASE register, set 1 is located at BASE + 512,
  * set 2 is at BASE + 2*512, set 3 at BASE + 3*512, and so on.
  *
- * We will use 31 sets, one for sending BAU messages from each of the 32
+ * We will use one set for sending BAU messages from each of the
  * cpu's on the uvhub.
  *
  * TLB shootdown will use the first of the 8 descriptors of each set.
  * Each of the descriptors is 64 bytes in size (8*64 = 512 bytes in a set).
  */
 
+#define MAX_CPUS_PER_UVHUB		64
+#define MAX_CPUS_PER_SOCKET		32
+#define UV_ADP_SIZE			64 /* hardware-provided max. */
+#define UV_CPUS_PER_ACT_STATUS		32 /* hardware-provided max. */
 #define UV_ITEMS_PER_DESCRIPTOR		8
 /* the 'throttle' to prevent the hardware stay-busy bug */
 #define MAX_BAU_CONCURRENT		3
-#define UV_CPUS_PER_ACT_STATUS		32
 #define UV_ACT_STATUS_MASK		0x3
 #define UV_ACT_STATUS_SIZE		2
-#define UV_ADP_SIZE			32
 #define UV_DISTRIBUTION_SIZE		256
 #define UV_SW_ACK_NPENDING		8
 #define UV_NET_ENDPOINT_INTD		0x38
@@ -100,7 +102,6 @@
  * number of destination side software ack resources
  */
 #define DEST_NUM_RESOURCES		8
-#define MAX_CPUS_PER_NODE		32
 /*
  * completion statuses for sending a TLB flush message
  */
arch/x86/platform/uv/tlb_uv.c +18 -4
@@ -1341,7 +1341,7 @@ uv_activation_descriptor_init(int node,
 
 	/*
 	 * each bau_desc is 64 bytes; there are 8 (UV_ITEMS_PER_DESCRIPTOR)
-	 * per cpu; and up to 32 (UV_ADP_SIZE) cpu's per uvhub
+	 * per cpu; and one per cpu on the uvhub (UV_ADP_SIZE)
 	 */
 	bau_desc = kmalloc_node(sizeof(struct bau_desc) * UV_ADP_SIZE
 				* UV_ITEMS_PER_DESCRIPTOR, GFP_KERNEL, node);
@@ -1490,7 +1490,7 @@ calculate_destination_timeout(void)
 /*
  * initialize the bau_control structure for each cpu
  */
-static void __init uv_init_per_cpu(int nuvhubs)
+static int __init uv_init_per_cpu(int nuvhubs)
 {
 	int i;
 	int cpu;
@@ -1507,7 +1507,7 @@ static void __init uv_init_per_cpu(int n
 	struct bau_control *smaster = NULL;
 	struct socket_desc {
 		short num_cpus;
-		short cpu_number[16];
+		short cpu_number[MAX_CPUS_PER_SOCKET];
 	};
 	struct uvhub_desc {
 		unsigned short socket_mask;
@@ -1540,6 +1540,10 @@ static void __init uv_init_per_cpu(int n
 		sdp = &bdp->socket[socket];
 		sdp->cpu_number[sdp->num_cpus] = cpu;
 		sdp->num_cpus++;
+		if (sdp->num_cpus > MAX_CPUS_PER_SOCKET) {
+			printk(KERN_EMERG "%d cpus per socket invalid\n", sdp->num_cpus);
+			return 1;
+		}
 	}
 	for (uvhub = 0; uvhub < nuvhubs; uvhub++) {
 		if (!(*(uvhub_mask + (uvhub/8)) & (1 << (uvhub%8))))
@@ -1570,6 +1574,12 @@ static void __init uv_init_per_cpu(int n
 				bcp->uvhub_master = hmaster;
 				bcp->uvhub_cpu = uv_cpu_hub_info(cpu)->
 						blade_processor_id;
+				if (bcp->uvhub_cpu >= MAX_CPUS_PER_UVHUB) {
+					printk(KERN_EMERG
+						"%d cpus per uvhub invalid\n",
+						bcp->uvhub_cpu);
+					return 1;
+				}
 			}
 nextsocket:
 			socket++;
@@ -1595,6 +1605,7 @@ nextsocket:
 		bcp->congested_reps = congested_reps;
 		bcp->congested_period = congested_period;
 	}
+	return 0;
 }
 
 /*
@@ -1625,7 +1636,10 @@ static int __init uv_bau_init(void)
 	spin_lock_init(&disable_lock);
 	congested_cycles = microsec_2_cycles(congested_response_us);
 
-	uv_init_per_cpu(nuvhubs);
+	if (uv_init_per_cpu(nuvhubs)) {
+		nobau = 1;
+		return 0;
+	}
 
 	uv_partition_base_pnode = 0x7fffffff;
 	for (uvhub = 0; uvhub < nuvhubs; uvhub++)
author
#10 lore raw

PATCH 10/272 hwmon: (via686a) Initialize fan_div values

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Jean Delvare <[email protected]>

commit f790674d3f87df6390828ac21a7d1530f71b59c8 upstream.

Functions set_fan_min() and set_fan_div() assume that the fan_div values have already been read from the register. The driver currently doesn't initialize them at load time, they are only set when function via686a_update_device() is called. This means that set_fan_min() and set_fan_div() misbehave if, for example, "sensors -s" is called before any monitoring application (e.g. "sensors") is has been run.

Fix the problem by always initializing the fan_div values at device bind time.

---
 drivers/hwmon/via686a.c |   14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/hwmon/via686a.c +11 -3
@@ -687,6 +687,13 @@ static int __devexit via686a_remove(stru
 	return 0;
 }
 
+static void via686a_update_fan_div(struct via686a_data *data)
+{
+	int reg = via686a_read_value(data, VIA686A_REG_FANDIV);
+	data->fan_div[0] = (reg >> 4) & 0x03;
+	data->fan_div[1] = reg >> 6;
+}
+
 static void __devinit via686a_init_device(struct via686a_data *data)
 {
 	u8 reg;
@@ -700,6 +707,9 @@ static void __devinit via686a_init_devic
 	via686a_write_value(data, VIA686A_REG_TEMP_MODE,
 			    (reg & ~VIA686A_TEMP_MODE_MASK)
 			    | VIA686A_TEMP_MODE_CONTINUOUS);
+
+	/* Pre-read fan clock divisor values */
+	via686a_update_fan_div(data);
 }
 
 static struct via686a_data *via686a_update_device(struct device *dev)
@@ -751,9 +761,7 @@ static struct via686a_data *via686a_upda
 		    (via686a_read_value(data, VIA686A_REG_TEMP_LOW23) &
 		     0xc0) >> 6;
 
-		i = via686a_read_value(data, VIA686A_REG_FANDIV);
-		data->fan_div[0] = (i >> 4) & 0x03;
-		data->fan_div[1] = i >> 6;
+		via686a_update_fan_div(data);
 		data->alarms =
 		    via686a_read_value(data,
 				       VIA686A_REG_ALARM1) |
author
#11 lore raw

PATCH 11/272 hwmon: (applesmc) Add MacBookAir3,1(3,2) support

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Edgar Hucek <[email protected]>

commit 132af03233b493101a53010383b5abb5b9ff1e51 upstream.

This patch add support for the MacBookAir3,1 and MacBookAir3,2 to the applesmc driver.

---
 drivers/hwmon/applesmc.c |   10 ++++++++++
 1 file changed, 10 insertions(+)
drivers/hwmon/applesmc.c +10 -0
@@ -162,6 +162,10 @@ static const char *temperature_sensors_s
 /* Set 22: MacBook Pro 7,1 */
 	{ "TB0T", "TB1T", "TB2T", "TC0D", "TC0P", "TN0D", "TN0P", "TN0S",
 	  "TN1D", "TN1F", "TN1G", "TN1S", "Th1H", "Ts0P", "Ts0S", NULL },
+/* Set 23: MacBook Air 3,1 */
+	{ "TB0T", "TB1T", "TB2T", "TC0D", "TC0E", "TC0P", "TC1E", "TCZ3",
+	  "TCZ4", "TCZ5", "TG0E", "TG1E", "TG2E", "TGZ3", "TGZ4", "TGZ5",
+	  "TH0F", "TH0O", "TM0P" },
 };
 
 /* List of keys used to read/write fan speeds */
@@ -1524,11 +1528,17 @@ static __initdata struct dmi_match_data
 	{ .accelerometer = 1, .light = 1, .temperature_set = 21 },
 /* MacBook Pro 7,1: accelerometer, backlight and temperature set 22 */
 	{ .accelerometer = 1, .light = 1, .temperature_set = 22 },
+/* MacBook Air 3,1: accelerometer, backlight and temperature set 23 */
+	{ .accelerometer = 0, .light = 0, .temperature_set = 23 },
 };
 
 /* Note that DMI_MATCH(...,"MacBook") will match "MacBookPro1,1".
  * So we need to put "Apple MacBook Pro" before "Apple MacBook". */
 static __initdata struct dmi_system_id applesmc_whitelist[] = {
+	{ applesmc_dmi_match, "Apple MacBook Air 3", {
+	  DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
+	  DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir3") },
+		&applesmc_dmi_data[23]},
 	{ applesmc_dmi_match, "Apple MacBook Air 2", {
 	  DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
 	  DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir2") },
author
#12 lore raw

PATCH 12/272 hwmon: (applesmc) Relax the severity of device init failure

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Henrik Rydberg <[email protected]>

commit 2344cd0c2e9ea8f3037be11fb997ddbeda0237ca upstream.

The device init is used to reset the accelerometer. Failure to reset is not severe enough to stop loading the module or to resume from hibernation. This patch relaxes failure to a warning and drops output in case of success.

---
 drivers/hwmon/applesmc.c |   38 +++++++-------------------------------
 1 file changed, 7 insertions(+), 31 deletions(-)
drivers/hwmon/applesmc.c +7 -31
@@ -448,38 +448,22 @@ static int applesmc_read_motion_sensor(i
 }
 
 /*
- * applesmc_device_init - initialize the accelerometer.  Returns zero on success
- * and negative error code on failure.  Can sleep.
+ * applesmc_device_init - initialize the accelerometer.  Can sleep.
  */
-static int applesmc_device_init(void)
+static void applesmc_device_init(void)
 {
-	int total, ret = -ENXIO;
+	int total;
 	u8 buffer[2];
 
 	if (!applesmc_accelerometer)
-		return 0;
+		return;
 
 	mutex_lock(&applesmc_lock);
 
 	for (total = INIT_TIMEOUT_MSECS; total > 0; total -= INIT_WAIT_MSECS) {
-		if (debug)
-			printk(KERN_DEBUG "applesmc try %d\n", total);
 		if (!applesmc_read_key(MOTION_SENSOR_KEY, buffer, 2) &&
-				(buffer[0] != 0x00 || buffer[1] != 0x00)) {
-			if (total == INIT_TIMEOUT_MSECS) {
-				printk(KERN_DEBUG "applesmc: device has"
-						" already been initialized"
-						" (0x%02x, 0x%02x).\n",
-						buffer[0], buffer[1]);
-			} else {
-				printk(KERN_DEBUG "applesmc: device"
-						" successfully initialized"
-						" (0x%02x, 0x%02x).\n",
-						buffer[0], buffer[1]);
-			}
-			ret = 0;
+				(buffer[0] != 0x00 || buffer[1] != 0x00))
 			goto out;
-		}
 		buffer[0] = 0xe0;
 		buffer[1] = 0x00;
 		applesmc_write_key(MOTION_SENSOR_KEY, buffer, 2);
@@ -490,7 +474,6 @@ static int applesmc_device_init(void)
 
 out:
 	mutex_unlock(&applesmc_lock);
-	return ret;
 }
 
 /*
@@ -516,13 +499,8 @@ static int applesmc_get_fan_count(void)
 /* Device model stuff */
 static int applesmc_probe(struct platform_device *dev)
 {
-	int ret;
-
-	ret = applesmc_device_init();
-	if (ret)
-		return ret;
+	applesmc_device_init();
 
-	printk(KERN_INFO "applesmc: device successfully initialized.\n");
 	return 0;
 }
 
@@ -539,9 +517,7 @@ static int applesmc_pm_resume(struct dev
 /* Reinitialize device on resume from hibernation */
 static int applesmc_pm_restore(struct device *dev)
 {
-	int ret = applesmc_device_init();
-	if (ret)
-		return ret;
+	applesmc_device_init();
 	return applesmc_pm_resume(dev);
 }
 
author
#13 lore raw

PATCH 13/272 USB: serial: handle Data Carrier Detect changes

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Libor Pechacek <[email protected]>

commit d14fc1a74e846d7851f24fc9519fe87dc12a1231 upstream.

Alan's commit 335f8514f200e63d689113d29cb7253a5c282967 introduced .carrier_raised function in several drivers. That also means tty_port_block_til_ready can now suspend the process trying to open the serial port when Carrier Detect is low and put it into tty_port.open_wait queue. We need to wake up the process when Carrier Detect goes high and trigger TTY hangup when CD goes low.

Some of the devices do not report modem status line changes, or at least we don't understand the status message, so for those we remove .carrier_raised again.

---
 drivers/usb/serial/ch341.c           |   10 ++++++++++
 drivers/usb/serial/cp210x.c          |   13 +------------
 drivers/usb/serial/digi_acceleport.c |   10 ----------
 drivers/usb/serial/generic.c         |   20 ++++++++++++++++++++
 drivers/usb/serial/keyspan_pda.c     |   17 -----------------
 drivers/usb/serial/pl2303.c          |   11 +++++++++++
 drivers/usb/serial/spcp8x5.c         |    6 +++++-
 include/linux/usb/serial.h           |    3 +++
 8 files changed, 50 insertions(+), 40 deletions(-)
drivers/usb/serial/ch341.c +10 -0
@@ -486,12 +486,22 @@ static void ch341_read_int_callback(stru
 	if (actual_length >= 4) {
 		struct ch341_private *priv = usb_get_serial_port_data(port);
 		unsigned long flags;
+		u8 prev_line_status = priv->line_status;
 
 		spin_lock_irqsave(&priv->lock, flags);
 		priv->line_status = (~(data[2])) & CH341_BITS_MODEM_STAT;
 		if ((data[1] & CH341_MULT_STAT))
 			priv->multi_status_change = 1;
 		spin_unlock_irqrestore(&priv->lock, flags);
+
+		if ((priv->line_status ^ prev_line_status) & CH341_BIT_DCD) {
+			struct tty_struct *tty = tty_port_tty_get(&port->port);
+			if (tty)
+				usb_serial_handle_dcd_change(port, tty,
+					    priv->line_status & CH341_BIT_DCD);
+			tty_kref_put(tty);
+		}
+
 		wake_up_interruptible(&priv->delta_msr_wait);
 	}
 
drivers/usb/serial/cp210x.c +1 -12
@@ -49,7 +49,6 @@ static int cp210x_tiocmset_port(struct u
 static void cp210x_break_ctl(struct tty_struct *, int);
 static int cp210x_startup(struct usb_serial *);
 static void cp210x_dtr_rts(struct usb_serial_port *p, int on);
-static int cp210x_carrier_raised(struct usb_serial_port *p);
 
 static int debug;
 
@@ -165,8 +164,7 @@ static struct usb_serial_driver cp210x_d
 	.tiocmget 		= cp210x_tiocmget,
 	.tiocmset		= cp210x_tiocmset,
 	.attach			= cp210x_startup,
-	.dtr_rts		= cp210x_dtr_rts,
-	.carrier_raised		= cp210x_carrier_raised
+	.dtr_rts		= cp210x_dtr_rts
 };
 
 /* Config request types */
@@ -765,15 +763,6 @@ static int cp210x_tiocmget (struct tty_s
 	return result;
 }
 
-static int cp210x_carrier_raised(struct usb_serial_port *p)
-{
-	unsigned int control;
-	cp210x_get_config(p, CP210X_GET_MDMSTS, &control, 1);
-	if (control & CONTROL_DCD)
-		return 1;
-	return 0;
-}
-
 static void cp210x_break_ctl (struct tty_struct *tty, int break_state)
 {
 	struct usb_serial_port *port = tty->driver_data;
drivers/usb/serial/digi_acceleport.c +0 -10
@@ -455,7 +455,6 @@ static int digi_write_room(struct tty_st
 static int digi_chars_in_buffer(struct tty_struct *tty);
 static int digi_open(struct tty_struct *tty, struct usb_serial_port *port);
 static void digi_close(struct usb_serial_port *port);
-static int digi_carrier_raised(struct usb_serial_port *port);
 static void digi_dtr_rts(struct usb_serial_port *port, int on);
 static int digi_startup_device(struct usb_serial *serial);
 static int digi_startup(struct usb_serial *serial);
@@ -511,7 +510,6 @@ static struct usb_serial_driver digi_acc
 	.open =				digi_open,
 	.close =			digi_close,
 	.dtr_rts =			digi_dtr_rts,
-	.carrier_raised =		digi_carrier_raised,
 	.write =			digi_write,
 	.write_room =			digi_write_room,
 	.write_bulk_callback = 		digi_write_bulk_callback,
@@ -1339,14 +1337,6 @@ static void digi_dtr_rts(struct usb_seri
 	digi_set_modem_signals(port, on * (TIOCM_DTR|TIOCM_RTS), 1);
 }
 
-static int digi_carrier_raised(struct usb_serial_port *port)
-{
-	struct digi_port *priv = usb_get_serial_port_data(port);
-	if (priv->dp_modem_signals & TIOCM_CD)
-		return 1;
-	return 0;
-}
-
 static int digi_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
 	int ret;
drivers/usb/serial/generic.c +20 -0
@@ -479,6 +479,26 @@ int usb_serial_handle_break(struct usb_s
 }
 EXPORT_SYMBOL_GPL(usb_serial_handle_break);
 
+/**
+ *	usb_serial_handle_dcd_change - handle a change of carrier detect state
+ *	@port: usb_serial_port structure for the open port
+ *	@tty: tty_struct structure for the port
+ *	@status: new carrier detect status, nonzero if active
+ */
+void usb_serial_handle_dcd_change(struct usb_serial_port *usb_port,
+				struct tty_struct *tty, unsigned int status)
+{
+	struct tty_port *port = &usb_port->port;
+
+	dbg("%s - port %d, status %d", __func__, usb_port->number, status);
+
+	if (status)
+		wake_up_interruptible(&port->open_wait);
+	else if (tty && !C_CLOCAL(tty))
+		tty_hangup(tty);
+}
+EXPORT_SYMBOL_GPL(usb_serial_handle_dcd_change);
+
 int usb_serial_generic_resume(struct usb_serial *serial)
 {
 	struct usb_serial_port *port;
drivers/usb/serial/keyspan_pda.c +0 -17
@@ -679,22 +679,6 @@ static void keyspan_pda_dtr_rts(struct u
 	}
 }
 
-static int keyspan_pda_carrier_raised(struct usb_serial_port *port)
-{
-	struct usb_serial *serial = port->serial;
-	unsigned char modembits;
-
-	/* If we can read the modem status and the DCD is low then
-	   carrier is not raised yet */
-	if (keyspan_pda_get_modem_info(serial, &modembits) >= 0) {
-		if (!(modembits & (1>>6)))
-			return 0;
-	}
-	/* Carrier raised, or we failed (eg disconnected) so
-	   progress accordingly */
-	return 1;
-}
-
 
 static int keyspan_pda_open(struct tty_struct *tty,
 					struct usb_serial_port *port)
@@ -881,7 +865,6 @@ static struct usb_serial_driver keyspan_
 	.id_table =		id_table_std,
 	.num_ports =		1,
 	.dtr_rts =		keyspan_pda_dtr_rts,
-	.carrier_raised	=	keyspan_pda_carrier_raised,
 	.open =			keyspan_pda_open,
 	.close =		keyspan_pda_close,
 	.write =		keyspan_pda_write,
drivers/usb/serial/pl2303.c +11 -0
@@ -677,9 +677,11 @@ static void pl2303_update_line_status(st
 {
 
 	struct pl2303_private *priv = usb_get_serial_port_data(port);
+	struct tty_struct *tty;
 	unsigned long flags;
 	u8 status_idx = UART_STATE;
 	u8 length = UART_STATE + 1;
+	u8 prev_line_status;
 	u16 idv, idp;
 
 	idv = le16_to_cpu(port->serial->dev->descriptor.idVendor);
@@ -701,11 +703,20 @@ static void pl2303_update_line_status(st
 
 	/* Save off the uart status for others to look at */
 	spin_lock_irqsave(&priv->lock, flags);
+	prev_line_status = priv->line_status;
 	priv->line_status = data[status_idx];
 	spin_unlock_irqrestore(&priv->lock, flags);
 	if (priv->line_status & UART_BREAK_ERROR)
 		usb_serial_handle_break(port);
 	wake_up_interruptible(&priv->delta_msr_wait);
+
+	tty = tty_port_tty_get(&port->port);
+	if (!tty)
+		return;
+	if ((priv->line_status ^ prev_line_status) & UART_DCD)
+		usb_serial_handle_dcd_change(port, tty,
+				priv->line_status & UART_DCD);
+	tty_kref_put(tty);
 }
 
 static void pl2303_read_int_callback(struct urb *urb)
drivers/usb/serial/spcp8x5.c +5 -1
@@ -133,7 +133,7 @@ struct spcp8x5_usb_ctrl_arg {
 
 /* how come ??? */
 #define UART_STATE			0x08
-#define UART_STATE_TRANSIENT_MASK	0x74
+#define UART_STATE_TRANSIENT_MASK	0x75
 #define UART_DCD			0x01
 #define UART_DSR			0x02
 #define UART_BREAK_ERROR		0x04
@@ -525,6 +525,10 @@ static void spcp8x5_process_read_urb(str
 		/* overrun is special, not associated with a char */
 		if (status & UART_OVERRUN_ERROR)
 			tty_insert_flip_char(tty, 0, TTY_OVERRUN);
+
+		if (status & UART_DCD)
+			usb_serial_handle_dcd_change(port, tty,
+				   priv->line_status & MSR_STATUS_LINE_DCD);
 	}
 
 	tty_insert_flip_string_fixed_flag(tty, data, tty_flag,
include/linux/usb/serial.h +3 -0
@@ -347,6 +347,9 @@ extern int usb_serial_generic_prepare_wr
 extern int usb_serial_handle_sysrq_char(struct usb_serial_port *port,
 					unsigned int ch);
 extern int usb_serial_handle_break(struct usb_serial_port *port);
+extern void usb_serial_handle_dcd_change(struct usb_serial_port *usb_port,
+					 struct tty_struct *tty,
+					 unsigned int status);
 
 
 extern int usb_serial_bus_register(struct usb_serial_driver *device);
author
#14 lore raw

PATCH 14/272 USB: CP210x Add two device IDs

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Craig Shelley <[email protected]>

commit faea63f7ccfddfb8fc19798799fcd38c58415172 upstream.

Device Ids added for IRZ Automation Teleport SG-10 GSM/GPRS Modem and DekTec DTA Plus VHF/UHF Booster/Attenuator.

---
 drivers/usb/serial/cp210x.c |    2 ++
 1 file changed, 2 insertions(+)
drivers/usb/serial/cp210x.c +2 -0
@@ -109,7 +109,9 @@ static const struct usb_device_id id_tab
 	{ USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */
 	{ USB_DEVICE(0x10C4, 0x8382) }, /* Cygnal Integrated Products, Inc. */
 	{ USB_DEVICE(0x10C4, 0x83A8) }, /* Amber Wireless AMB2560 */
+	{ USB_DEVICE(0x10C4, 0x83D8) }, /* DekTec DTA Plus VHF/UHF Booster/Attenuator */
 	{ USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */
+	{ USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */
 	{ USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */
 	{ USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */
 	{ USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
author
#15 lore raw

PATCH 15/272 USB: CP210x Removed incorrect device ID

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Craig Shelley <[email protected]>

commit 9926c0df7b31b2128eebe92e0e2b052f380ea464 upstream.

Device ID removed 0x10C4/0x8149 for West Mountain Radio Computerized Battery Analyzer. This device is actually based on a SiLabs C8051Fxxx, see http://www.etheus.net/SiUSBXp_Linux_Driver for further info.

---
 drivers/usb/serial/cp210x.c |    1 -
 1 file changed, 1 deletion(-)
drivers/usb/serial/cp210x.c +0 -1
@@ -86,7 +86,6 @@ static const struct usb_device_id id_tab
 	{ USB_DEVICE(0x10C4, 0x8115) }, /* Arygon NFC/Mifare Reader */
 	{ USB_DEVICE(0x10C4, 0x813D) }, /* Burnside Telecom Deskmobile */
 	{ USB_DEVICE(0x10C4, 0x813F) }, /* Tams Master Easy Control */
-	{ USB_DEVICE(0x10C4, 0x8149) }, /* West Mountain Radio Computerized Battery Analyzer */
 	{ USB_DEVICE(0x10C4, 0x814A) }, /* West Mountain Radio RIGblaster P&P */
 	{ USB_DEVICE(0x10C4, 0x814B) }, /* West Mountain Radio RIGtalk */
 	{ USB_DEVICE(0x10C4, 0x8156) }, /* B&G H3000 link cable */
author
#16 lore raw

PATCH 16/272 USB: qcaux: add Pantech UML290 device ID

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Dan Williams <[email protected]>

commit a58861fbde2a350df4d27fc62fb42905669b37ce upstream.

Another CDC-ACM + vendor specific interface layout for the QCDM port.

---
 drivers/usb/serial/qcaux.c |    2 ++
 1 file changed, 2 insertions(+)
drivers/usb/serial/qcaux.c +2 -0
@@ -36,6 +36,7 @@
 #define UTSTARCOM_PRODUCT_UM175_V1		0x3712
 #define UTSTARCOM_PRODUCT_UM175_V2		0x3714
 #define UTSTARCOM_PRODUCT_UM175_ALLTEL		0x3715
+#define PANTECH_PRODUCT_UML290_VZW		0x3718
 
 /* CMOTECH devices */
 #define CMOTECH_VENDOR_ID			0x16d8
@@ -66,6 +67,7 @@ static struct usb_device_id id_table[] =
 	{ USB_DEVICE_AND_INTERFACE_INFO(LG_VENDOR_ID, LG_PRODUCT_VX4400_6000, 0xff, 0xff, 0x00) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(SANYO_VENDOR_ID, SANYO_PRODUCT_KATANA_LX, 0xff, 0xff, 0x00) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_U520, 0xff, 0x00, 0x00) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML290_VZW, 0xff, 0xff, 0xff) },
 	{ },
 };
 MODULE_DEVICE_TABLE(usb, id_table);
author
#17 lore raw

PATCH 17/272 USB: usb-storage: unusual_devs update for Cypress ATACB

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Richard Schütz <[email protected]>

commit cae41118f50ef0c431e13159df6d7dd8bbd54004 upstream.

New device ID added for unusual Cypress ATACB device.

---
 drivers/usb/storage/unusual_cypress.h |    5 +++++
 1 file changed, 5 insertions(+)
drivers/usb/storage/unusual_cypress.h +5 -0
@@ -31,4 +31,9 @@ UNUSUAL_DEV(  0x04b4, 0x6831, 0x0000, 0x
 		"Cypress ISD-300LP",
 		USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0),
 
+UNUSUAL_DEV( 0x14cd, 0x6116, 0x0000, 0x9999,
+		"Super Top",
+		"USB 2.0  SATA BRIDGE",
+		USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0),
+
 #endif /* defined(CONFIG_USB_STORAGE_CYPRESS_ATACB) || ... */
author
#18 lore raw

PATCH 18/272 USB: usb-storage: unusual_devs update for TrekStor DataStation maxi g.u external hard drive enclosure

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: =?UTF-8?q?Richard=20Sch=C3=BCtz?= <[email protected]>

commit 7e1e7bd9dbd469267b6e6de1bf8d71a7d65ce86a upstream.

The TrekStor DataStation maxi g.u external hard drive enclosure uses a JMicron USB to SATA chip which needs the US_FL_IGNORE_RESIDUE flag to work properly.

---
 drivers/usb/storage/unusual_devs.h |    9 +++++++++
 1 file changed, 9 insertions(+)
drivers/usb/storage/unusual_devs.h +9 -0
@@ -1872,6 +1872,15 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0
 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
 		US_FL_NO_READ_DISC_INFO ),
 
+/* Patch by Richard Sch�tz <[email protected]>
+ * This external hard drive enclosure uses a JMicron chip which
+ * needs the US_FL_IGNORE_RESIDUE flag to work properly. */
+UNUSUAL_DEV(  0x1e68, 0x001b, 0x0000, 0x0000,
+		"TrekStor GmbH & Co. KG",
+		"DataStation maxi g.u",
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+		US_FL_IGNORE_RESIDUE | US_FL_SANE_SENSE ),
+
 UNUSUAL_DEV( 0x2116, 0x0320, 0x0001, 0x0001,
 		"ST",
 		"2A",
author
#19 lore raw

PATCH 19/272 USB: usb-storage: unusual_devs entry for CamSport Evo

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Alan Stern <[email protected]>

commit 12f68c480c7155a66bd2a76ab2fef28dd5f93fa2 upstream.

This patch (as1438) adds an unusual_devs entry for the MagicPixel FW_Omega2 chip, used in the CamSport Evo camera. The firmware incorrectly reports a vendor-specific bDeviceClass.

---
 drivers/usb/storage/unusual_devs.h |    9 +++++++++
 1 file changed, 9 insertions(+)
drivers/usb/storage/unusual_devs.h +9 -0
@@ -1044,6 +1044,15 @@ UNUSUAL_DEV(  0x084d, 0x0011, 0x0110, 0x
 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
 		US_FL_BULK32),
 
+/* Reported by <[email protected]>
+ * The device reports a vendor-specific device class, requiring an
+ * explicit vendor/product match.
+ */
+UNUSUAL_DEV(  0x0851, 0x1542, 0x0002, 0x0002,
+		"MagicPixel",
+		"FW_Omega2",
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL, 0),
+
 /* Andrew Lunn <[email protected]>
  * PanDigital Digital Picture Frame. Does not like ALLOW_MEDIUM_REMOVAL
  * on LUN 4.
author
#20 lore raw

PATCH 20/272 USB: usb-storage: unusual_devs entry for Coby MP3 player

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Alan Stern <[email protected]>

commit 3ea3c9b5a8464ec8223125f95e5dddb3bfd02a39 upstream.

This patch (as1444) adds an unusual_devs entry for an MP3 player from Coby electronics. The device has two nasty bugs.

---
 drivers/usb/storage/unusual_devs.h |    7 +++++++
 1 file changed, 7 insertions(+)
drivers/usb/storage/unusual_devs.h +7 -0
@@ -1890,6 +1890,13 @@ UNUSUAL_DEV(  0x1e68, 0x001b, 0x0000, 0x
 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
 		US_FL_IGNORE_RESIDUE | US_FL_SANE_SENSE ),
 
+/* Reported by Jasper Mackenzie <[email protected]> */
+UNUSUAL_DEV( 0x1e74, 0x4621, 0x0000, 0x0000,
+		"Coby Electronics",
+		"MP3 Player",
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+		US_FL_BULK_IGNORE_TAG | US_FL_MAX_SECTORS_64 ),
+
 UNUSUAL_DEV( 0x2116, 0x0320, 0x0001, 0x0001,
 		"ST",
 		"2A",
author
#21 lore raw

PATCH 21/272 USB: serial: Updated support for ICOM devices

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Pieter Maes <[email protected]>

commit a9d61bc49188e32d2ae9cf0f683cde3e1744feef upstream.

I found the original patch on the db0fhn repeater wiki (couldn't find the email of the origial author) I guess it was never commited.
I updated and added some Icom HAM-radio devices to the ftdi driver. Added extra comments to make clear what devices it are.

---
 drivers/usb/serial/ftdi_sio.c     |   12 +++++++++++-
 drivers/usb/serial/ftdi_sio_ids.h |   20 ++++++++++++++++----
 2 files changed, 27 insertions(+), 5 deletions(-)
drivers/usb/serial/ftdi_sio.c +11 -1
@@ -675,7 +675,17 @@ static struct usb_device_id id_table_com
 	{ USB_DEVICE(FTDI_VID, FTDI_PCDJ_DAC2_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_RRCIRKITS_LOCOBUFFER_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_ASK_RDR400_PID) },
-	{ USB_DEVICE(ICOM_ID1_VID, ICOM_ID1_PID) },
+	{ USB_DEVICE(ICOM_VID, ICOM_ID_1_PID) },
+	{ USB_DEVICE(ICOM_VID, ICOM_OPC_U_UC_PID) },
+	{ USB_DEVICE(ICOM_VID, ICOM_ID_RP2C1_PID) },
+	{ USB_DEVICE(ICOM_VID, ICOM_ID_RP2C2_PID) },
+	{ USB_DEVICE(ICOM_VID, ICOM_ID_RP2D_PID) },
+	{ USB_DEVICE(ICOM_VID, ICOM_ID_RP2VT_PID) },
+	{ USB_DEVICE(ICOM_VID, ICOM_ID_RP2VR_PID) },
+	{ USB_DEVICE(ICOM_VID, ICOM_ID_RP4KVT_PID) },
+	{ USB_DEVICE(ICOM_VID, ICOM_ID_RP4KVR_PID) },
+	{ USB_DEVICE(ICOM_VID, ICOM_ID_RP2KVT_PID) },
+	{ USB_DEVICE(ICOM_VID, ICOM_ID_RP2KVR_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_ACG_HFDUAL_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_YEI_SERVOCENTER31_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_THORLABS_PID) },
drivers/usb/serial/ftdi_sio_ids.h +16 -4
@@ -569,11 +569,23 @@
 #define OCT_US101_PID		0x0421	/* OCT US101 USB to RS-232 */
 
 /*
- * Icom ID-1 digital transceiver
+ * Definitions for Icom Inc. devices
  */
-
-#define ICOM_ID1_VID            0x0C26
-#define ICOM_ID1_PID            0x0004
+#define ICOM_VID		0x0C26 /* Icom vendor ID */
+/* Note: ID-1 is a communications tranceiver for HAM-radio operators */
+#define ICOM_ID_1_PID		0x0004 /* ID-1 USB to RS-232 */
+/* Note: OPC is an Optional cable to connect an Icom Tranceiver */
+#define ICOM_OPC_U_UC_PID	0x0018 /* OPC-478UC, OPC-1122U cloning cable */
+/* Note: ID-RP* devices are Icom Repeater Devices for HAM-radio */
+#define ICOM_ID_RP2C1_PID	0x0009 /* ID-RP2C Asset 1 to RS-232 */
+#define ICOM_ID_RP2C2_PID	0x000A /* ID-RP2C Asset 2 to RS-232 */
+#define ICOM_ID_RP2D_PID	0x000B /* ID-RP2D configuration port*/
+#define ICOM_ID_RP2VT_PID	0x000C /* ID-RP2V Transmit config port */
+#define ICOM_ID_RP2VR_PID	0x000D /* ID-RP2V Receive config port */
+#define ICOM_ID_RP4KVT_PID	0x0010 /* ID-RP4000V Transmit config port */
+#define ICOM_ID_RP4KVR_PID	0x0011 /* ID-RP4000V Receive config port */
+#define ICOM_ID_RP2KVT_PID	0x0012 /* ID-RP2000V Transmit config port */
+#define ICOM_ID_RP2KVR_PID	0x0013 /* ID-RP2000V Receive config port */
 
 /*
  * GN Otometrics (http://www.otometrics.com)
author
#22 lore raw

PATCH 22/272 USB: adding USB support for Cinterions HC2x, EU3 and PH8 products

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Nicolaus Colberg <[email protected]>

commit aa52b3a92918039b273fc9d1994bd34227c40269 upstream.

/drivers/usb/serial/option.c: Adding support for Cinterion's HC25, HC28, HC28J, EU3-E, EU3-P and PH8 by correcting/adding Cinterion's and Siemens' Vendor IDs as well as Product IDs and USB_DEVICE tuples

---
 drivers/usb/serial/option.c |   23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)
drivers/usb/serial/option.c +21 -2
@@ -382,7 +382,16 @@ static void option_instat_callback(struc
 #define HAIER_VENDOR_ID				0x201e
 #define HAIER_PRODUCT_CE100			0x2009
 
-#define CINTERION_VENDOR_ID			0x0681
+/* Cinterion (formerly Siemens) products */
+#define SIEMENS_VENDOR_ID				0x0681
+#define CINTERION_VENDOR_ID				0x1e2d
+#define CINTERION_PRODUCT_HC25_MDM		0x0047
+#define CINTERION_PRODUCT_HC25_MDMNET	0x0040
+#define CINTERION_PRODUCT_HC28_MDM		0x004C
+#define CINTERION_PRODUCT_HC28_MDMNET	0x004A /* same for HC28J */
+#define CINTERION_PRODUCT_EU3_E			0x0051
+#define CINTERION_PRODUCT_EU3_P			0x0052
+#define CINTERION_PRODUCT_PH8			0x0053
 
 /* Olivetti products */
 #define OLIVETTI_VENDOR_ID			0x0b3c
@@ -945,7 +954,17 @@ static const struct usb_device_id option
 	{ USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_100F) },
 	{ USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1011)},
 	{ USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1012)},
-	{ USB_DEVICE(CINTERION_VENDOR_ID, 0x0047) },
+	/* Cinterion */
+	{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_E) },
+	{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) },
+	{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8) },
+	{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) },
+	{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
+	{ USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDM) },
+	{ USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) },
+	{ USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, /* HC28 enumerates with Siemens or Cinterion VID depending on FW revision */
+	{ USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
+
 	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
 	{ USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
 	{ USB_DEVICE(ONDA_VENDOR_ID, ONDA_MT825UP) }, /* ONDA MT825UP modem */
author
#23 lore raw

PATCH 23/272 USB serial: add missing .usb_driver field in serial drivers

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Alan Stern <[email protected]>

commit 5620b5f7f19e9ee3fcf6ecf493fed7821b7b495b upstream.

This patch (as1443) fixes a bug found in many of the USB serial
drivers: They don't set the .usb_driver field in their usb_serial_driver structure. This field is needed for assigning dynamic IDs for device matching.

In addition, starting with the 2.6.37 kernel, the .usb_driver field is needed for proper autosuspend operation. Without it, attempts to open the device file will fail.

---
 drivers/usb/serial/io_tables.h   |    1 +
 drivers/usb/serial/iuu_phoenix.c |    1 +
 drivers/usb/serial/keyspan.h     |    4 ++++
 drivers/usb/serial/moto_modem.c  |    1 +
 drivers/usb/serial/oti6858.c     |    1 +
 drivers/usb/serial/qcaux.c       |    1 +
 drivers/usb/serial/siemens_mpi.c |    1 +
 drivers/usb/serial/spcp8x5.c     |    1 +
 drivers/usb/serial/usb-serial.c  |    8 ++++++--
 drivers/usb/serial/usb_debug.c   |    1 +
 10 files changed, 18 insertions(+), 2 deletions(-)
drivers/usb/serial/io_tables.h +1 -0
@@ -199,6 +199,7 @@ static struct usb_serial_driver epic_dev
 		.name		= "epic",
 	},
 	.description		= "EPiC device",
+	.usb_driver		= &io_driver,
 	.id_table		= Epic_port_id_table,
 	.num_ports		= 1,
 	.open			= edge_open,
drivers/usb/serial/iuu_phoenix.c +1 -0
@@ -1275,6 +1275,7 @@ static struct usb_serial_driver iuu_devi
 		   .name = "iuu_phoenix",
 		   },
 	.id_table = id_table,
+	.usb_driver = &iuu_driver,
 	.num_ports = 1,
 	.bulk_in_size = 512,
 	.bulk_out_size = 512,
drivers/usb/serial/keyspan.h +4 -0
@@ -546,6 +546,7 @@ static struct usb_serial_driver keyspan_
 		.name		= "keyspan_no_firm",
 	},
 	.description		= "Keyspan - (without firmware)",
+	.usb_driver		= &keyspan_driver,
 	.id_table		= keyspan_pre_ids,
 	.num_ports		= 1,
 	.attach			= keyspan_fake_startup,
@@ -557,6 +558,7 @@ static struct usb_serial_driver keyspan_
 		.name		= "keyspan_1",
 	},
 	.description		= "Keyspan 1 port adapter",
+	.usb_driver		= &keyspan_driver,
 	.id_table		= keyspan_1port_ids,
 	.num_ports		= 1,
 	.open			= keyspan_open,
@@ -579,6 +581,7 @@ static struct usb_serial_driver keyspan_
 		.name		= "keyspan_2",
 	},
 	.description		= "Keyspan 2 port adapter",
+	.usb_driver		= &keyspan_driver,
 	.id_table		= keyspan_2port_ids,
 	.num_ports		= 2,
 	.open			= keyspan_open,
@@ -601,6 +604,7 @@ static struct usb_serial_driver keyspan_
 		.name		= "keyspan_4",
 	},
 	.description		= "Keyspan 4 port adapter",
+	.usb_driver		= &keyspan_driver,
 	.id_table		= keyspan_4port_ids,
 	.num_ports		= 4,
 	.open			= keyspan_open,
drivers/usb/serial/moto_modem.c +1 -0
@@ -44,6 +44,7 @@ static struct usb_serial_driver moto_dev
 		.name =		"moto-modem",
 	},
 	.id_table =		id_table,
+	.usb_driver =		&moto_driver,
 	.num_ports =		1,
 };
 
drivers/usb/serial/oti6858.c +1 -0
@@ -157,6 +157,7 @@ static struct usb_serial_driver oti6858_
 		.name =		"oti6858",
 	},
 	.id_table =		id_table,
+	.usb_driver =		&oti6858_driver,
 	.num_ports =		1,
 	.open =			oti6858_open,
 	.close =		oti6858_close,
drivers/usb/serial/qcaux.c +1 -0
@@ -86,6 +86,7 @@ static struct usb_serial_driver qcaux_de
 		.name =		"qcaux",
 	},
 	.id_table =		id_table,
+	.usb_driver =		&qcaux_driver,
 	.num_ports =		1,
 };
 
drivers/usb/serial/siemens_mpi.c +1 -0
@@ -42,6 +42,7 @@ static struct usb_serial_driver siemens_
 		.name =		"siemens_mpi",
 	},
 	.id_table =		id_table,
+	.usb_driver =		&siemens_usb_mpi_driver,
 	.num_ports =		1,
 };
 
drivers/usb/serial/spcp8x5.c +1 -0
@@ -649,6 +649,7 @@ static struct usb_serial_driver spcp8x5_
 		.name =		"SPCP8x5",
 	},
 	.id_table		= id_table,
+	.usb_driver		= &spcp8x5_driver,
 	.num_ports		= 1,
 	.open 			= spcp8x5_open,
 	.dtr_rts		= spcp8x5_dtr_rts,
drivers/usb/serial/usb-serial.c +6 -2
@@ -1344,11 +1344,15 @@ int usb_serial_register(struct usb_seria
 		return -ENODEV;
 
 	fixup_generic(driver);
-	if (driver->usb_driver)
-		driver->usb_driver->supports_autosuspend = 1;
 
 	if (!driver->description)
 		driver->description = driver->driver.name;
+	if (!driver->usb_driver) {
+		WARN(1, "Serial driver %s has no usb_driver\n",
+				driver->description);
+		return -EINVAL;
+	}
+	driver->usb_driver->supports_autosuspend = 1;
 
 	/* Add this device to our list of devices */
 	mutex_lock(&table_lock);
drivers/usb/serial/usb_debug.c +1 -0
@@ -75,6 +75,7 @@ static struct usb_serial_driver debug_de
 		.name =		"debug",
 	},
 	.id_table =		id_table,
+	.usb_driver =		&debug_driver,
 	.num_ports =		1,
 	.bulk_out_size =	USB_DEBUG_MAX_PACKET_SIZE,
 	.break_ctl =		usb_debug_break_ctl,
author
#24 lore raw

PATCH 24/272 USB: EHCI: ASPM quirk of ISOC on AMD Hudson

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Alex He <[email protected]>

commit baab93afc2844b68d57b0dcca5e1d34c5d7cf411 upstream.

AMD Hudson also needs the same ASPM quirk as SB800

---
 drivers/usb/host/ehci-pci.c |   33 ++++++++++++++++++++-------------
 1 file changed, 20 insertions(+), 13 deletions(-)
drivers/usb/host/ehci-pci.c +20 -13
@@ -41,28 +41,35 @@ static int ehci_pci_reinit(struct ehci_h
 	return 0;
 }
 
-static int ehci_quirk_amd_SB800(struct ehci_hcd *ehci)
+static int ehci_quirk_amd_hudson(struct ehci_hcd *ehci)
 {
 	struct pci_dev *amd_smbus_dev;
 	u8 rev = 0;
 
 	amd_smbus_dev = pci_get_device(PCI_VENDOR_ID_ATI, 0x4385, NULL);
-	if (!amd_smbus_dev)
-		return 0;
-
-	pci_read_config_byte(amd_smbus_dev, PCI_REVISION_ID, &rev);
-	if (rev < 0x40) {
-		pci_dev_put(amd_smbus_dev);
-		amd_smbus_dev = NULL;
-		return 0;
+	if (amd_smbus_dev) {
+		pci_read_config_byte(amd_smbus_dev, PCI_REVISION_ID, &rev);
+		if (rev < 0x40) {
+			pci_dev_put(amd_smbus_dev);
+			amd_smbus_dev = NULL;
+			return 0;
+		}
+	} else {
+		amd_smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD, 0x780b, NULL);
+		if (!amd_smbus_dev)
+			return 0;
+		pci_read_config_byte(amd_smbus_dev, PCI_REVISION_ID, &rev);
+		if (rev < 0x11 || rev > 0x18) {
+			pci_dev_put(amd_smbus_dev);
+			amd_smbus_dev = NULL;
+			return 0;
+		}
 	}
 
 	if (!amd_nb_dev)
 		amd_nb_dev = pci_get_device(PCI_VENDOR_ID_AMD, 0x1510, NULL);
-	if (!amd_nb_dev)
-		ehci_err(ehci, "QUIRK: unable to get AMD NB device\n");
 
-	ehci_info(ehci, "QUIRK: Enable AMD SB800 L1 fix\n");
+	ehci_info(ehci, "QUIRK: Enable exception for AMD Hudson ASPM\n");
 
 	pci_dev_put(amd_smbus_dev);
 	amd_smbus_dev = NULL;
@@ -128,7 +135,7 @@ static int ehci_pci_setup(struct usb_hcd
 	/* cache this readonly data; minimize chip reads */
 	ehci->hcs_params = ehci_readl(ehci, &ehci->caps->hcs_params);
 
-	if (ehci_quirk_amd_SB800(ehci))
+	if (ehci_quirk_amd_hudson(ehci))
 		ehci->amd_l1_fix = 1;
 
 	retval = ehci_halt(ehci);
author
#25 lore raw

PATCH 25/272 USB: EHCI: fix DMA deallocation bug

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Alan Stern <[email protected]>

commit f75593ceaa08e6d27aec1a5de31cded19e850dd1 upstream.

This patch (as1440) fixes a bug in ehci-hcd. ehci->periodic_size is used to compute the size in a dma_alloc_coherent() call, but then it gets changed later on. As a result, the corresponding call to dma_free_coherent() passes a different size from the original allocation. Fix the problem by adjusting ehci->periodic_size before carrying out any of the memory allocations.

---
 drivers/usb/host/ehci-hcd.c |   19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)
drivers/usb/host/ehci-hcd.c +12 -7
@@ -572,6 +572,8 @@ static int ehci_init(struct usb_hcd *hcd
 	ehci->iaa_watchdog.function = ehci_iaa_watchdog;
 	ehci->iaa_watchdog.data = (unsigned long) ehci;
 
+	hcc_params = ehci_readl(ehci, &ehci->caps->hcc_params);
+
 	/*
 	 * hw default: 1K periodic list heads, one per frame.
 	 * periodic_size can shrink by USBCMD update if hcc_params allows.
@@ -579,11 +581,20 @@ static int ehci_init(struct usb_hcd *hcd
 	ehci->periodic_size = DEFAULT_I_TDPS;
 	INIT_LIST_HEAD(&ehci->cached_itd_list);
 	INIT_LIST_HEAD(&ehci->cached_sitd_list);
+
+	if (HCC_PGM_FRAMELISTLEN(hcc_params)) {
+		/* periodic schedule size can be smaller than default */
+		switch (EHCI_TUNE_FLS) {
+		case 0: ehci->periodic_size = 1024; break;
+		case 1: ehci->periodic_size = 512; break;
+		case 2: ehci->periodic_size = 256; break;
+		default:	BUG();
+		}
+	}
 	if ((retval = ehci_mem_init(ehci, GFP_KERNEL)) < 0)
 		return retval;
 
 	/* controllers may cache some of the periodic schedule ... */
-	hcc_params = ehci_readl(ehci, &ehci->caps->hcc_params);
 	if (HCC_ISOC_CACHE(hcc_params))		// full frame cache
 		ehci->i_thresh = 2 + 8;
 	else					// N microframes cached
@@ -637,12 +648,6 @@ static int ehci_init(struct usb_hcd *hcd
 		/* periodic schedule size can be smaller than default */
 		temp &= ~(3 << 2);
 		temp |= (EHCI_TUNE_FLS << 2);
-		switch (EHCI_TUNE_FLS) {
-		case 0: ehci->periodic_size = 1024; break;
-		case 1: ehci->periodic_size = 512; break;
-		case 2: ehci->periodic_size = 256; break;
-		default:	BUG();
-		}
 	}
 	if (HCC_LPM(hcc_params)) {
 		/* support link power management EHCI 1.1 addendum */
author
#26 lore raw

PATCH 26/272 USB: g_printer: fix bug in unregistration

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Alan Stern <[email protected]>

commit d5aa475180d03d45c5dc6134aa833f1b3e89c45e upstream.

This patch (as1441) fixes a bug in g_printer. The gadget driver, char device number, and class device should be unregistered in reverse order of registration. As it is now, when the module is unloaded the class device gets unregistered first, causing a crash when the unbind method tries to access it.

This fixes Bugzilla #25882.

---
 drivers/usb/gadget/printer.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/usb/gadget/printer.c +2 -3
@@ -1596,13 +1596,12 @@ cleanup(void)
 	int status;
 
 	mutex_lock(&usb_printer_gadget.lock_printer_io);
-	class_destroy(usb_gadget_class);
-	unregister_chrdev_region(g_printer_devno, 2);
-
 	status = usb_gadget_unregister_driver(&printer_driver);
 	if (status)
 		ERROR(dev, "usb_gadget_unregister_driver %x\n", status);
 
+	unregister_chrdev_region(g_printer_devno, 2);
+	class_destroy(usb_gadget_class);
 	mutex_unlock(&usb_printer_gadget.lock_printer_io);
 }
 module_exit(cleanup);
author
#27 lore raw

PATCH 27/272 USB: g_printer: fix bug in module parameter definitions

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Alan Stern <[email protected]>

commit ad84e4a9efb7c8ed322bafb6ebdb9c3a49a3d3a8 upstream.

This patch (as1442) fixes a bug in g_printer: Module parameters should not be marked "__initdata" if they are accessible in sysfs (i.e., if the mode value in the module_param() macro is nonzero). Otherwise attempts to access the parameters will cause addressing violations.

Character-string module parameters must not be marked "__initdata" if the module can be unloaded, because the kernel needs to access the parameter variable at unload time in order to free the dynamically-allocated string.

---
 drivers/usb/gadget/printer.c |   14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/usb/gadget/printer.c +7 -7
@@ -131,31 +131,31 @@ static struct printer_dev usb_printer_ga
  * parameters are in UTF-8 (superset of ASCII's 7 bit characters).
  */
 
-static ushort __initdata idVendor;
+static ushort idVendor;
 module_param(idVendor, ushort, S_IRUGO);
 MODULE_PARM_DESC(idVendor, "USB Vendor ID");
 
-static ushort __initdata idProduct;
+static ushort idProduct;
 module_param(idProduct, ushort, S_IRUGO);
 MODULE_PARM_DESC(idProduct, "USB Product ID");
 
-static ushort __initdata bcdDevice;
+static ushort bcdDevice;
 module_param(bcdDevice, ushort, S_IRUGO);
 MODULE_PARM_DESC(bcdDevice, "USB Device version (BCD)");
 
-static char *__initdata iManufacturer;
+static char *iManufacturer;
 module_param(iManufacturer, charp, S_IRUGO);
 MODULE_PARM_DESC(iManufacturer, "USB Manufacturer string");
 
-static char *__initdata iProduct;
+static char *iProduct;
 module_param(iProduct, charp, S_IRUGO);
 MODULE_PARM_DESC(iProduct, "USB Product string");
 
-static char *__initdata iSerialNum;
+static char *iSerialNum;
 module_param(iSerialNum, charp, S_IRUGO);
 MODULE_PARM_DESC(iSerialNum, "1");
 
-static char *__initdata iPNPstring;
+static char *iPNPstring;
 module_param(iPNPstring, charp, S_IRUGO);
 MODULE_PARM_DESC(iPNPstring, "MFG:linux;MDL:g_printer;CLS:PRINTER;SN:1;");
 
author
#28 lore raw

PATCH 28/272 USB: io_edgeport: fix the reported firmware major and minor

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Bjørn Mork <[email protected]>

commit 271c1150b4f8e1685e5a8cbf76e329ec894481da upstream.

The major and minor number saved in the product_info structure were copied from the address instead of the data, causing an inconsistency in the reported versions during firmware loading:

usb 4-1: firmware: requesting edgeport/down.fw /usr/src/linux/drivers/usb/serial/io_edgeport.c: downloading firmware version (930) 1.16.4 [..]
/usr/src/linux/drivers/usb/serial/io_edgeport.c: edge_startup - time 3 4328191260
/usr/src/linux/drivers/usb/serial/io_edgeport.c: FirmwareMajorVersion 0.0.4

This can cause some confusion whether firmware loaded successfully or not.

---
 drivers/usb/serial/io_edgeport.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/serial/io_edgeport.c +2 -2
@@ -2889,8 +2889,8 @@ static void load_application_firmware(st
 
 	dbg("%s %d.%d.%d", fw_info, rec->data[0], rec->data[1], build);
 
-	edge_serial->product_info.FirmwareMajorVersion = fw->data[0];
-	edge_serial->product_info.FirmwareMinorVersion = fw->data[1];
+	edge_serial->product_info.FirmwareMajorVersion = rec->data[0];
+	edge_serial->product_info.FirmwareMinorVersion = rec->data[1];
 	edge_serial->product_info.FirmwareBuildNumber = cpu_to_le16(build);
 
 	for (rec = ihex_next_binrec(rec); rec;
author
#29 lore raw

PATCH 29/272 USB: ti_usb: fix module removal

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Ionut Nicu <[email protected]>

commit b14de3857227cd978f515247853fd15cc2425d3e upstream.

If usb_deregister() is called after usb_serial_deregister() when the device is plugged in, the following Oops occurs:

[   95.337377] BUG: unable to handle kernel NULL pointer dereference at 00000010
[   95.338236] IP: [<c0776b2d>] klist_put+0x12/0x62
[   95.338356] *pdpt = 000000003001a001 *pde = 0000000000000000
[   95.338356] Oops: 0000 [#1] SMP
[   95.340499] last sysfs file: /sys/devices/pci0000:00/0000:00:1d.2/usb8/idVendor
[   95.340499] Modules linked in: ti_usb_3410_5052(-) usbserial cpufreq_ondemand acpi_cpufreq mperf iptable_nat nf_nat iptable_mangle ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_filter ip6_tables ipv6 uinput arc4 ecb iwlagn iwlcore mac80211 cfg80211 microcode pcspkr acer_wmi joydev wmi sky2 [last unloaded: scsi_wait_scan]
[   95.341908]
[   95.341908] Pid: 1532, comm: modprobe Not tainted 2.6.37-rc7+ #6 Eiger                          /Aspire 5930
[   95.341908] EIP: 0060:[<c0776b2d>] EFLAGS: 00010246 CPU: 0
[   95.341908] EIP is at klist_put+0x12/0x62
[   95.341908] EAX: 00000000 EBX: eedc0c84 ECX: c09c21b4 EDX: 00000001
[   95.341908] ESI: 00000000 EDI: efaa0c1c EBP: f214fe2c ESP: f214fe1c
[   95.341908]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[   95.341908] Process modprobe (pid: 1532, ti=f214e000 task=efaaf080 task.ti=f214e000)
[   95.341908] Stack:
[   95.341908]  f214fe24 eedc0c84 efaaf080 efaa0c1c f214fe34 c0776ba8 f214fe5c c0776c76
[   95.341908]  c09c21b4 c09c21b4 eedc0c84 efaaf080 00000000 c0634398 eafe2d1c f7b515f0
[   95.341908]  f214fe6c c0631b5c eafe2d50 eafe2d1c f214fe7c c0631ba2 eafe2d1c eafe2c00
[   95.341908] Call Trace:
[   95.341908]  [<c0776ba8>] ? klist_del+0xd/0xf
[   95.341908]  [<c0776c76>] ? klist_remove+0x48/0x74
[   95.341908]  [<c0634398>] ? devres_release_all+0x49/0x51
[   95.341908]  [<c0631b5c>] ? __device_release_driver+0x7b/0xa4
[   95.341908]  [<c0631ba2>] ? device_release_driver+0x1d/0x28
[   95.341908]  [<c06317c4>] ? bus_remove_device+0x92/0xa1
[   95.341908]  [<c062f3d8>] ? device_del+0xf9/0x13e
[   95.341908]  [<f7b06146>] ? usb_serial_disconnect+0xd9/0x116 [usbserial]
[   95.341908]  [<c0681e3f>] ? usb_disable_interface+0x32/0x40
[   95.341908]  [<c0683972>] ? usb_unbind_interface+0x48/0xfd
[   95.341908]  [<c0631b43>] ? __device_release_driver+0x62/0xa4
[   95.341908]  [<c06320b9>] ? driver_detach+0x62/0x81
[   95.341908]  [<c0631a41>] ? bus_remove_driver+0x8f/0xae
[   95.341908]  [<c063214c>] ? driver_unregister+0x50/0x57
[   95.341908]  [<c0682f95>] ? usb_deregister+0x77/0x84
[   95.341908]  [<f7b505b6>] ? ti_exit+0x26/0x28 [ti_usb_3410_5052]
[   95.341908]  [<c046a307>] ? sys_delete_module+0x181/0x1de
[   95.341908]  [<c04e2727>] ? path_put+0x1a/0x1d
[   95.341908]  [<c047f4c5>] ? audit_syscall_entry+0x116/0x138
[   95.341908]  [<c04094df>] ? sysenter_do_call+0x12/0x28
[   95.341908] Code: 00 83 7d f0 00 74 09 85 f6 74 05 89 f0 ff 55 f0 8b 43 04 5a 5b 5e 5f 5d c3 55 89 e5 57 56 53 89 c3 83 ec 04 8b 30 83 e6 fe 89 f0 <8b> 7e 10 88 55 f0 e8 47 26 01 00 8a 55 f0 84 d2 74 17 f6 03 01
[   95.341908] EIP: [<c0776b2d>] klist_put+0x12/0x62 SS:ESP 0068:f214fe1c
[   95.341908] CR2: 0000000000000010
[   95.342357] ---[ end trace 8124d00ad871ad18 ]---
---
 drivers/usb/serial/ti_usb_3410_5052.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/serial/ti_usb_3410_5052.c +1 -1
@@ -369,9 +369,9 @@ failed_1port:
 
 static void __exit ti_exit(void)
 {
+	usb_deregister(&ti_usb_driver);
 	usb_serial_deregister(&ti_1port_device);
 	usb_serial_deregister(&ti_2port_device);
-	usb_deregister(&ti_usb_driver);
 }
 
 
author
#30 lore raw

PATCH 30/272 USB: Storage: Add unusual_devs entry for VTech Kidizoom

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Nick Holloway <[email protected]>

commit c25f6b1591b158f7ae3b9132367d0fa6d632e70e upstream.

This device suffers from the off-by-one error when reporting the capacity, so add entry with US_FL_FIX_CAPACITY.

---
 drivers/usb/storage/unusual_devs.h |    7 +++++++
 1 file changed, 7 insertions(+)
drivers/usb/storage/unusual_devs.h +7 -0
@@ -1397,6 +1397,13 @@ UNUSUAL_DEV(  0x0f19, 0x0105, 0x0100, 0x
 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
 		US_FL_IGNORE_RESIDUE ),
 
+/* Submitted by Nick Holloway */
+UNUSUAL_DEV( 0x0f88, 0x042e, 0x0100, 0x0100,
+		"VTech",
+		"Kidizoom",
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+		US_FL_FIX_CAPACITY ),
+
 /* Reported by Michael Stattmann <[email protected]> */
 UNUSUAL_DEV(  0x0fce, 0xd008, 0x0000, 0x0000,
 		"Sony Ericsson",
author
#31 lore raw

PATCH 31/272 USB: ftdi_sio: add ST Micro Connect Lite uart support

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Jean-Christophe PLAGNIOL-VILLARD <[email protected]>

commit 6ec2f46c4b4abf48c88c0ae7c476f347b97e1105 upstream.

on ST Micro Connect Lite we have 4 port
Part A and B for the JTAG
Port C Uart
Port D for PIO

---
 drivers/usb/serial/ftdi_sio.c     |   26 ++++++++++++++++++++++++++
 drivers/usb/serial/ftdi_sio_ids.h |    6 ++++++
 2 files changed, 32 insertions(+)
drivers/usb/serial/ftdi_sio.c +26 -0
@@ -99,6 +99,7 @@ struct ftdi_sio_quirk {
 static int   ftdi_jtag_probe(struct usb_serial *serial);
 static int   ftdi_mtxorb_hack_setup(struct usb_serial *serial);
 static int   ftdi_NDI_device_setup(struct usb_serial *serial);
+static int   ftdi_stmclite_probe(struct usb_serial *serial);
 static void  ftdi_USB_UIRT_setup(struct ftdi_private *priv);
 static void  ftdi_HE_TIRA1_setup(struct ftdi_private *priv);
 
@@ -122,6 +123,10 @@ static struct ftdi_sio_quirk ftdi_HE_TIR
 	.port_probe = ftdi_HE_TIRA1_setup,
 };
 
+static struct ftdi_sio_quirk ftdi_stmclite_quirk = {
+	.probe	= ftdi_stmclite_probe,
+};
+
 /*
  * The 8U232AM has the same API as the sio except for:
  * - it can support MUCH higher baudrates; up to:
@@ -809,6 +814,8 @@ static struct usb_device_id id_table_com
 	{ USB_DEVICE(FTDI_VID, FTDI_DOTEC_PID) },
 	{ USB_DEVICE(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID),
 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+	{ USB_DEVICE(ST_VID, ST_STMCLT1030_PID),
+		.driver_info = (kernel_ulong_t)&ftdi_stmclite_quirk },
 	{ },					/* Optional parameter entry */
 	{ }					/* Terminating entry */
 };
@@ -1691,6 +1698,25 @@ static int ftdi_jtag_probe(struct usb_se
 }
 
 /*
+ * First and second port on STMCLiteadaptors is reserved for JTAG interface
+ * and the forth port for pio
+ */
+static int ftdi_stmclite_probe(struct usb_serial *serial)
+{
+	struct usb_device *udev = serial->dev;
+	struct usb_interface *interface = serial->interface;
+
+	dbg("%s", __func__);
+
+	if (interface == udev->actconfig->interface[2])
+		return 0;
+
+	dev_info(&udev->dev, "Ignoring serial port reserved for JTAG\n");
+
+	return -ENODEV;
+}
+
+/*
  * The Matrix Orbital VK204-25-USB has an invalid IN endpoint.
  * We have to correct it if we want to read from it.
  */
drivers/usb/serial/ftdi_sio_ids.h +6 -0
@@ -1034,6 +1034,12 @@
 #define WHT_PID			0x0004 /* Wireless Handheld Terminal */
 
 /*
+ * STMicroelectonics
+ */
+#define ST_VID			0x0483
+#define ST_STMCLT1030_PID	0x3747 /* ST Micro Connect Lite STMCLT1030 */
+
+/*
  * Papouch products (http://www.papouch.com/)
  * Submitted by Folkert van Heusden
  */
author
#32 lore raw

PATCH 32/272 USB: cdc-acm: Adding second ACM channel support for Nokia N8

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Arvid Ephraim Picciani <[email protected]>

commit 721d92fc6373dee15846216f9d178ec240ec0fd7 upstream.

This adds the N8 to the list of devices in cdc-acm, in order to get the secondary ACM device exposed.

In the spirit of:
http://kerneltrap.org/mailarchive/linux-usb/2010/9/4/6264554

---
 drivers/usb/class/cdc-acm.c |    1 +
 1 file changed, 1 insertion(+)
drivers/usb/class/cdc-acm.c +1 -0
@@ -1607,6 +1607,7 @@ static const struct usb_device_id acm_id
 	{ NOKIA_PCSUITE_ACM_INFO(0x0154), }, /* Nokia 5800 XpressMusic */
 	{ NOKIA_PCSUITE_ACM_INFO(0x04ce), }, /* Nokia E90 */
 	{ NOKIA_PCSUITE_ACM_INFO(0x01d4), }, /* Nokia E55 */
+	{ NOKIA_PCSUITE_ACM_INFO(0x0302), }, /* Nokia N8 */
 	{ SAMSUNG_PCSUITE_ACM_INFO(0x6651), }, /* Samsung GTi8510 (INNOV8) */
 
 	/* NOTE: non-Nokia COMM/ACM/0xff is likely MSFT RNDIS... NOT a modem! */
author
#33 lore raw

PATCH 33/272 USB: ftdi_sio: Add VID=0x0647, PID=0x0100 for Acton Research spectrograph

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Michael Williamson <[email protected]>

commit 28fe2eb0162a1d23370dd99ff7d0e35632b1ee91 upstream.

Add the USB Vendor ID and Product ID for a Acton Research Corp. spectrograph device with a FTDI chip for serial I/O.

---
 drivers/usb/serial/ftdi_sio.c     |    1 +
 drivers/usb/serial/ftdi_sio_ids.h |    6 ++++++
 2 files changed, 7 insertions(+)
drivers/usb/serial/ftdi_sio.c +1 -0
@@ -620,6 +620,7 @@ static struct usb_device_id id_table_com
 	{ USB_DEVICE(FTDI_VID, FTDI_OCEANIC_PID) },
 	{ USB_DEVICE(TTI_VID, TTI_QL355P_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_RM_CANVIEW_PID) },
+	{ USB_DEVICE(ACTON_VID, ACTON_SPECTRAPRO_PID) },
 	{ USB_DEVICE(CONTEC_VID, CONTEC_COM1USBH_PID) },
 	{ USB_DEVICE(BANDB_VID, BANDB_USOTL4_PID) },
 	{ USB_DEVICE(BANDB_VID, BANDB_USTL4_PID) },
drivers/usb/serial/ftdi_sio_ids.h +6 -0
@@ -518,6 +518,12 @@
 #define RATOC_PRODUCT_ID_USB60F	0xb020
 
 /*
+ * Acton Research Corp.
+ */
+#define ACTON_VID		0x0647	/* Vendor ID */
+#define ACTON_SPECTRAPRO_PID	0x0100
+
+/*
  * Contec products (http://www.contec.com)
  * Submitted by Daniel Sangorrin
  */
author
#34 lore raw

PATCH 34/272 USB: EHCI: fix scheduling while atomic during suspend

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Yin Kangkai <[email protected]>

commit 148fc55fd0449683a1d15bf219ad8d8b6fa17545 upstream.

There is a msleep with spin lock held during ehci pci suspend, which will cause kernel BUG: scheduling while atomic. Fix that.

[  184.139620] BUG: scheduling while atomic: kworker/u:11/416/0x00000002
[  184.139632] 4 locks held by kworker/u:11/416:
[  184.139640]  #0:  (events_unbound){+.+.+.}, at: [<c104ddd4>] process_one_work+0x1b3/0x4cb
[  184.139669]  #1:  ((&entry->work)){+.+.+.}, at: [<c104ddd4>] process_one_work+0x1b3/0x4cb
[  184.139686]  #2:  (&__lockdep_no_validate__){+.+.+.}, at: [<c127cde3>] __device_suspend+0x2c/0x154
[  184.139706]  #3:  (&(&ehci->lock)->rlock){-.-...}, at: [<c132f3d8>] ehci_pci_suspend+0x35/0x7b
[  184.139725] Modules linked in: serio_raw pegasus joydev mrst_gfx(C) battery
[  184.139748] irq event stamp: 52
[  184.139753] hardirqs last  enabled at (51): [<c14fdaac>] mutex_lock_nested+0x258/0x293
[  184.139766] hardirqs last disabled at (52): [<c14fe7b4>] _raw_spin_lock_irqsave+0xf/0x3e
[  184.139777] softirqs last  enabled at (0): [<c10371c1>] copy_process+0x3d2/0x109d
[  184.139789] softirqs last disabled at (0): [<  (null)>]   (null)
[  184.139802] Pid: 416, comm: kworker/u:11 Tainted: G         C  2.6.37-6.3-adaptation-oaktrail #37
[  184.139809] Call Trace:
[  184.139820]  [<c102eeff>] __schedule_bug+0x5e/0x65
[  184.139829]  [<c14fbca5>] schedule+0xac/0xc4c
[  184.139840]  [<c11d4845>] ? string+0x37/0x8b
[  184.139853]  [<c1044f21>] ? lock_timer_base+0x1f/0x3e
[  184.139863]  [<c14fe7da>] ? _raw_spin_lock_irqsave+0x35/0x3e
[  184.139876]  [<c1061590>] ? trace_hardirqs_off+0xb/0xd
[  184.139885]  [<c14fccdc>] schedule_timeout+0x283/0x2d9
[  184.139896]  [<c104516f>] ? process_timeout+0x0/0xa
[  184.139906]  [<c14fcd47>] schedule_timeout_uninterruptible+0x15/0x17
[  184.139916]  [<c104566a>] msleep+0x10/0x16
[  184.139926]  [<c132f316>] ehci_adjust_port_wakeup_flags+0x69/0xf6
[  184.139937]  [<c132f3eb>] ehci_pci_suspend+0x48/0x7b
[  184.139946]  [<c1326587>] suspend_common+0x52/0xbb
[  184.139956]  [<c1326625>] hcd_pci_suspend+0x26/0x28
[  184.139967]  [<c11e7182>] pci_pm_suspend+0x5f/0xd0
[  184.139976]  [<c127ca3a>] pm_op+0x5d/0xf0
[  184.139986]  [<c127ceac>] __device_suspend+0xf5/0x154
[  184.139996]  [<c127d2c8>] async_suspend+0x16/0x3a
[  184.140006]  [<c1058f54>] async_run_entry_fn+0x89/0x111
[  184.140016]  [<c104deb6>] process_one_work+0x295/0x4cb
[  184.140026]  [<c1058ecb>] ? async_run_entry_fn+0x0/0x111
[  184.140036]  [<c104e3d0>] worker_thread+0x17f/0x298
[  184.140045]  [<c104e251>] ? worker_thread+0x0/0x298
[  184.140055]  [<c105277f>] kthread+0x64/0x69
[  184.140064]  [<c105271b>] ? kthread+0x0/0x69
[  184.140075]  [<c1002efa>] kernel_thread_helper+0x6/0x1a
---
 drivers/usb/host/ehci-au1xxx.c |    2 +-
 drivers/usb/host/ehci-hub.c    |    7 +++++++
 drivers/usb/host/ehci-pci.c    |    2 +-
 3 files changed, 9 insertions(+), 2 deletions(-)
drivers/usb/host/ehci-au1xxx.c +1 -1
@@ -227,8 +227,8 @@ static int ehci_hcd_au1xxx_drv_suspend(s
 	 * mark HW unaccessible.  The PM and USB cores make sure that
 	 * the root hub is either suspended or stopped.
 	 */
-	spin_lock_irqsave(&ehci->lock, flags);
 	ehci_prepare_ports_for_controller_suspend(ehci, device_may_wakeup(dev));
+	spin_lock_irqsave(&ehci->lock, flags);
 	ehci_writel(ehci, 0, &ehci->regs->intr_enable);
 	(void)ehci_readl(ehci, &ehci->regs->intr_enable);
 
drivers/usb/host/ehci-hub.c +7 -0
@@ -111,6 +111,7 @@ static void ehci_adjust_port_wakeup_flag
 {
 	int		port;
 	u32		temp;
+	unsigned long	flags;
 
 	/* If remote wakeup is enabled for the root hub but disabled
 	 * for the controller, we must adjust all the port wakeup flags
@@ -120,6 +121,8 @@ static void ehci_adjust_port_wakeup_flag
 	if (!ehci_to_hcd(ehci)->self.root_hub->do_remote_wakeup || do_wakeup)
 		return;
 
+	spin_lock_irqsave(&ehci->lock, flags);
+
 	/* clear phy low-power mode before changing wakeup flags */
 	if (ehci->has_hostpc) {
 		port = HCS_N_PORTS(ehci->hcs_params);
@@ -131,7 +134,9 @@ static void ehci_adjust_port_wakeup_flag
 			temp = ehci_readl(ehci, hostpc_reg);
 			ehci_writel(ehci, temp & ~HOSTPC_PHCD, hostpc_reg);
 		}
+		spin_unlock_irqrestore(&ehci->lock, flags);
 		msleep(5);
+		spin_lock_irqsave(&ehci->lock, flags);
 	}
 
 	port = HCS_N_PORTS(ehci->hcs_params);
@@ -170,6 +175,8 @@ static void ehci_adjust_port_wakeup_flag
 	/* Does the root hub have a port wakeup pending? */
 	if (!suspending && (ehci_readl(ehci, &ehci->regs->status) & STS_PCD))
 		usb_hcd_resume_root_hub(ehci_to_hcd(ehci));
+
+	spin_unlock_irqrestore(&ehci->lock, flags);
 }
 
 static int ehci_bus_suspend (struct usb_hcd *hcd)
drivers/usb/host/ehci-pci.c +1 -1
@@ -360,8 +360,8 @@ static int ehci_pci_suspend(struct usb_h
 	 * mark HW unaccessible.  The PM and USB cores make sure that
 	 * the root hub is either suspended or stopped.
 	 */
-	spin_lock_irqsave (&ehci->lock, flags);
 	ehci_prepare_ports_for_controller_suspend(ehci, do_wakeup);
+	spin_lock_irqsave (&ehci->lock, flags);
 	ehci_writel(ehci, 0, &ehci->regs->intr_enable);
 	(void)ehci_readl(ehci, &ehci->regs->intr_enable);
 
author
#35 lore raw

PATCH 35/272 USB: prevent buggy hubs from crashing the USB stack

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Alan Stern <[email protected]>

commit d199c96d41d80a567493e12b8e96ea056a1350c1 upstream.

If anyone comes across a high-speed hub that (by mistake or by design) claims to have no Transaction Translators, plugging a full- or low-speed device into it will cause the USB stack to crash. This patch (as1446) prevents the problem by ignoring such devices, since the kernel has no way to communicate with them.

---
 drivers/usb/core/hub.c |    5 +++++
 1 file changed, 5 insertions(+)
drivers/usb/core/hub.c +5 -0
@@ -2723,6 +2723,11 @@ hub_port_init (struct usb_hub *hub, stru
 		udev->ttport = hdev->ttport;
 	} else if (udev->speed != USB_SPEED_HIGH
 			&& hdev->speed == USB_SPEED_HIGH) {
+		if (!hub->tt.hub) {
+			dev_err(&udev->dev, "parent hub has no TT\n");
+			retval = -EINVAL;
+			goto fail;
+		}
 		udev->tt = &hub->tt;
 		udev->ttport = port1;
 	}
author
#36 lore raw

PATCH 36/272 USB: fix race between root-hub resume and wakeup requests

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Alan Stern <[email protected]>

commit bf3d7d40e42a85ca73a34e1385ff34f092a384eb upstream.

The USB core keeps track of pending resume requests for root hubs, in order to resolve races between wakeup requests and suspends. However the code that does this is subject to another race (between wakeup requests and resumes) because the WAKEUP_PENDING flag is cleared before the resume occurs, leaving a window in which another wakeup request might arrive.

This patch (as1447) fixes the problem by clearing the WAKEUP_PENDING flag after the resume instead of before it.

This fixes Bugzilla #24952.

---
 drivers/usb/core/hcd.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/core/hcd.c +1 -1
@@ -1956,7 +1956,6 @@ int hcd_bus_resume(struct usb_device *rh
 
 	dev_dbg(&rhdev->dev, "usb %s%s\n",
 			(msg.event & PM_EVENT_AUTO ? "auto-" : ""), "resume");
-	clear_bit(HCD_FLAG_WAKEUP_PENDING, &hcd->flags);
 	if (!hcd->driver->bus_resume)
 		return -ENOENT;
 	if (hcd->state == HC_STATE_RUNNING)
@@ -1964,6 +1963,7 @@ int hcd_bus_resume(struct usb_device *rh
 
 	hcd->state = HC_STATE_RESUMING;
 	status = hcd->driver->bus_resume(hcd);
+	clear_bit(HCD_FLAG_WAKEUP_PENDING, &hcd->flags);
 	if (status == 0) {
 		/* TRSMRCY = 10 msec */
 		msleep(10);
author
#37 lore raw

PATCH 37/272 staging: zram: fix data corruption issue

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Nitin Gupta <[email protected]>

commit 5414e557fca545614ceedc3d3496f747457e2e3b upstream.

In zram_read() and zram_write() we were not incrementing the index number and thus were reading/writing values from/to incorrect sectors on zram disk, resulting in data corruption.

---
 drivers/staging/zram/zram_drv.c |    4 ++++
 1 file changed, 4 insertions(+)
drivers/staging/zram/zram_drv.c +4 -0
@@ -227,6 +227,7 @@ static int zram_read(struct zram *zram,
 
 		if (zram_test_flag(zram, index, ZRAM_ZERO)) {
 			handle_zero_page(page);
+			index++;
 			continue;
 		}
 
@@ -235,12 +236,14 @@ static int zram_read(struct zram *zram,
 			pr_debug("Read before write: sector=%lu, size=%u",
 				(ulong)(bio->bi_sector), bio->bi_size);
 			/* Do nothing */
+			index++;
 			continue;
 		}
 
 		/* Page is stored uncompressed since it's incompressible */
 		if (unlikely(zram_test_flag(zram, index, ZRAM_UNCOMPRESSED))) {
 			handle_uncompressed_page(zram, page, index);
+			index++;
 			continue;
 		}
 
@@ -320,6 +323,7 @@ static int zram_write(struct zram *zram,
 			mutex_unlock(&zram->lock);
 			zram_stat_inc(&zram->stats.pages_zero);
 			zram_set_flag(zram, index, ZRAM_ZERO);
+			index++;
 			continue;
 		}
 
author
#38 lore raw

PATCH 38/272 staging: r8712u: Add new device IDs

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: =?UTF-8?q?Axel=20K=C3=B6llhofer?= <[email protected]>

commit 6b28405395f7ec492ea69f541cc774adcb9e00ca upstream.

This patch adds several new device ids to the r8712u staging driver. The new ids were retrieved from latest vendor driver (v2.6.6.0.20101111) downloadable from www.realtek.com.tw

---
 drivers/staging/rtl8712/usb_intf.c |  145 ++++++++++++++++++++++++++++---------
 1 file changed, 113 insertions(+), 32 deletions(-)
drivers/staging/rtl8712/usb_intf.c +113 -32
@@ -47,54 +47,123 @@ static int r871xu_drv_init(struct usb_in
 static void r871xu_dev_remove(struct usb_interface *pusb_intf);
 
 static struct usb_device_id rtl871x_usb_id_tbl[] = {
-	/*92SU
-	 * Realtek */
-	{USB_DEVICE(0x0bda, 0x8171)},
-	{USB_DEVICE(0x0bda, 0x8172)},
+
+/* RTL8188SU */
+	/* Realtek */
+	{USB_DEVICE(0x0BDA, 0x8171)},
 	{USB_DEVICE(0x0bda, 0x8173)},
-	{USB_DEVICE(0x0bda, 0x8174)},
 	{USB_DEVICE(0x0bda, 0x8712)},
 	{USB_DEVICE(0x0bda, 0x8713)},
 	{USB_DEVICE(0x0bda, 0xC512)},
-	/* Abocom  */
+	/* Abocom */
 	{USB_DEVICE(0x07B8, 0x8188)},
+	/* ASUS */
+	{USB_DEVICE(0x0B05, 0x1786)},
+	{USB_DEVICE(0x0B05, 0x1791)}, /* 11n mode disable */
+	/* Belkin */
+	{USB_DEVICE(0x050D, 0x945A)},
 	/* Corega */
-	{USB_DEVICE(0x07aa, 0x0047)},
-	/* Dlink */
-	{USB_DEVICE(0x07d1, 0x3303)},
-	{USB_DEVICE(0x07d1, 0x3302)},
-	{USB_DEVICE(0x07d1, 0x3300)},
-	/* Dlink for Skyworth */
-	{USB_DEVICE(0x14b2, 0x3300)},
-	{USB_DEVICE(0x14b2, 0x3301)},
-	{USB_DEVICE(0x14b2, 0x3302)},
+	{USB_DEVICE(0x07AA, 0x0047)},
+	/* D-Link */
+	{USB_DEVICE(0x2001, 0x3306)},
+	{USB_DEVICE(0x07D1, 0x3306)}, /* 11n mode disable */
+	/* Edimax */
+	{USB_DEVICE(0x7392, 0x7611)},
 	/* EnGenius */
 	{USB_DEVICE(0x1740, 0x9603)},
-	{USB_DEVICE(0x1740, 0x9605)},
+	/* Hawking */
+	{USB_DEVICE(0x0E66, 0x0016)},
+	/* Hercules */
+	{USB_DEVICE(0x06F8, 0xE034)},
+	{USB_DEVICE(0x06F8, 0xE032)},
+	/* Logitec */
+	{USB_DEVICE(0x0789, 0x0167)},
+	/* PCI */
+	{USB_DEVICE(0x2019, 0xAB28)},
+	{USB_DEVICE(0x2019, 0xED16)},
+	/* Sitecom */
+	{USB_DEVICE(0x0DF6, 0x0057)},
+	{USB_DEVICE(0x0DF6, 0x0045)},
+	{USB_DEVICE(0x0DF6, 0x0059)}, /* 11n mode disable */
+	{USB_DEVICE(0x0DF6, 0x004B)},
+	{USB_DEVICE(0x0DF6, 0x0063)},
+	/* Sweex */
+	{USB_DEVICE(0x177F, 0x0154)},
+	/* Thinkware */
+	{USB_DEVICE(0x0BDA, 0x5077)},
+	/* Toshiba */
+	{USB_DEVICE(0x1690, 0x0752)},
+	/* - */
+	{USB_DEVICE(0x20F4, 0x646B)},
+	{USB_DEVICE(0x083A, 0xC512)},
+
+/* RTL8191SU */
+	/* Realtek */
+	{USB_DEVICE(0x0BDA, 0x8172)},
+	/* Amigo */
+	{USB_DEVICE(0x0EB0, 0x9061)},
+	/* ASUS/EKB */
+	{USB_DEVICE(0x0BDA, 0x8172)},
+	{USB_DEVICE(0x13D3, 0x3323)},
+	{USB_DEVICE(0x13D3, 0x3311)}, /* 11n mode disable */
+	{USB_DEVICE(0x13D3, 0x3342)},
+	/* ASUS/EKBLenovo */
+	{USB_DEVICE(0x13D3, 0x3333)},
+	{USB_DEVICE(0x13D3, 0x3334)},
+	{USB_DEVICE(0x13D3, 0x3335)}, /* 11n mode disable */
+	{USB_DEVICE(0x13D3, 0x3336)}, /* 11n mode disable */
+	/* ASUS/Media BOX */
+	{USB_DEVICE(0x13D3, 0x3309)},
 	/* Belkin */
-	{USB_DEVICE(0x050d, 0x815F)},
-	{USB_DEVICE(0x050d, 0x945A)},
-	{USB_DEVICE(0x050d, 0x845A)},
-	/* Guillemot */
-	{USB_DEVICE(0x06f8, 0xe031)},
+	{USB_DEVICE(0x050D, 0x815F)},
+	/* D-Link */
+	{USB_DEVICE(0x07D1, 0x3302)},
+	{USB_DEVICE(0x07D1, 0x3300)},
+	{USB_DEVICE(0x07D1, 0x3303)},
 	/* Edimax */
-	{USB_DEVICE(0x7392, 0x7611)},
 	{USB_DEVICE(0x7392, 0x7612)},
-	{USB_DEVICE(0x7392, 0x7622)},
-	/* Sitecom */
-	{USB_DEVICE(0x0DF6, 0x0045)},
+	/* EnGenius */
+	{USB_DEVICE(0x1740, 0x9605)},
+	/* Guillemot */
+	{USB_DEVICE(0x06F8, 0xE031)},
 	/* Hawking */
 	{USB_DEVICE(0x0E66, 0x0015)},
-	{USB_DEVICE(0x0E66, 0x0016)},
-	{USB_DEVICE(0x0b05, 0x1786)},
-	{USB_DEVICE(0x0b05, 0x1791)},    /* 11n mode disable */
-
+	/* Mediao */
 	{USB_DEVICE(0x13D3, 0x3306)},
-	{USB_DEVICE(0x13D3, 0x3309)},
+	/* PCI */
+	{USB_DEVICE(0x2019, 0xED18)},
+	{USB_DEVICE(0x2019, 0x4901)},
+	/* Sitecom */
+	{USB_DEVICE(0x0DF6, 0x0058)},
+	{USB_DEVICE(0x0DF6, 0x0049)},
+	{USB_DEVICE(0x0DF6, 0x004C)},
+	{USB_DEVICE(0x0DF6, 0x0064)},
+	/* Skyworth */
+	{USB_DEVICE(0x14b2, 0x3300)},
+	{USB_DEVICE(0x14b2, 0x3301)},
+	{USB_DEVICE(0x14B2, 0x3302)},
+	/* - */
+	{USB_DEVICE(0x04F2, 0xAFF2)},
+	{USB_DEVICE(0x04F2, 0xAFF5)},
+	{USB_DEVICE(0x04F2, 0xAFF6)},
+	{USB_DEVICE(0x13D3, 0x3339)},
+	{USB_DEVICE(0x13D3, 0x3340)}, /* 11n mode disable */
+	{USB_DEVICE(0x13D3, 0x3341)}, /* 11n mode disable */
 	{USB_DEVICE(0x13D3, 0x3310)},
-	{USB_DEVICE(0x13D3, 0x3311)},    /* 11n mode disable */
 	{USB_DEVICE(0x13D3, 0x3325)},
-	{USB_DEVICE(0x083A, 0xC512)},
+
+/* RTL8192SU */
+	/* Realtek */
+	{USB_DEVICE(0x0BDA, 0x8174)},
+	{USB_DEVICE(0x0BDA, 0x8174)},
+	/* Belkin */
+	{USB_DEVICE(0x050D, 0x845A)},
+	/* Corega */
+	{USB_DEVICE(0x07AA, 0x0051)},
+	/* Edimax */
+	{USB_DEVICE(0x7392, 0x7622)},
+	/* NEC */
+	{USB_DEVICE(0x0409, 0x02B6)},
 	{}
 };
 
@@ -103,8 +172,20 @@ MODULE_DEVICE_TABLE(usb, rtl871x_usb_id_
 static struct specific_device_id specific_device_id_tbl[] = {
 	{.idVendor = 0x0b05, .idProduct = 0x1791,
 		 .flags = SPEC_DEV_ID_DISABLE_HT},
+	{.idVendor = 0x0df6, .idProduct = 0x0059,
+		 .flags = SPEC_DEV_ID_DISABLE_HT},
+	{.idVendor = 0x13d3, .idProduct = 0x3306,
+		 .flags = SPEC_DEV_ID_DISABLE_HT},
 	{.idVendor = 0x13D3, .idProduct = 0x3311,
 		 .flags = SPEC_DEV_ID_DISABLE_HT},
+	{.idVendor = 0x13d3, .idProduct = 0x3335,
+		 .flags = SPEC_DEV_ID_DISABLE_HT},
+	{.idVendor = 0x13d3, .idProduct = 0x3336,
+		 .flags = SPEC_DEV_ID_DISABLE_HT},
+	{.idVendor = 0x13d3, .idProduct = 0x3340,
+		 .flags = SPEC_DEV_ID_DISABLE_HT},
+	{.idVendor = 0x13d3, .idProduct = 0x3341,
+		 .flags = SPEC_DEV_ID_DISABLE_HT},
 	{}
 };
 
author
#39 lore raw

PATCH 39/272 staging: comedi: add support for newer jr3 1-channel pci board

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Ruben Smits <[email protected]>

commit 6292817d58637f85dd623cfe563c7f5ec4f4c470 upstream.

add DEVICE_ID to table

---
 drivers/staging/comedi/drivers/jr3_pci.c |    7 +++++++
 1 file changed, 7 insertions(+)
drivers/staging/comedi/drivers/jr3_pci.c +7 -0
@@ -54,6 +54,7 @@ Devices: [JR3] PCI force sensor board (j
 
 #define PCI_VENDOR_ID_JR3 0x1762
 #define PCI_DEVICE_ID_JR3_1_CHANNEL 0x3111
+#define PCI_DEVICE_ID_JR3_1_CHANNEL_NEW 0x1111
 #define PCI_DEVICE_ID_JR3_2_CHANNEL 0x3112
 #define PCI_DEVICE_ID_JR3_3_CHANNEL 0x3113
 #define PCI_DEVICE_ID_JR3_4_CHANNEL 0x3114
@@ -73,6 +74,8 @@ static DEFINE_PCI_DEVICE_TABLE(jr3_pci_p
 	{
 	PCI_VENDOR_ID_JR3, PCI_DEVICE_ID_JR3_1_CHANNEL,
 		    PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, {
+	PCI_VENDOR_ID_JR3, PCI_DEVICE_ID_JR3_1_CHANNEL_NEW,
+		    PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, {
 	PCI_VENDOR_ID_JR3, PCI_DEVICE_ID_JR3_2_CHANNEL,
 		    PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, {
 	PCI_VENDOR_ID_JR3, PCI_DEVICE_ID_JR3_3_CHANNEL,
@@ -807,6 +810,10 @@ static int jr3_pci_attach(struct comedi_
 					devpriv->n_channels = 1;
 				}
 				break;
+			case PCI_DEVICE_ID_JR3_1_CHANNEL_NEW:{
+					devpriv->n_channels = 1;
+				}
+				break;
 			case PCI_DEVICE_ID_JR3_2_CHANNEL:{
 					devpriv->n_channels = 2;
 				}
author
#40 lore raw

PATCH 40/272 staging: comedi: ni_labpc: Use shared IRQ for PCMCIA card

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Ian Abbott <[email protected]>

commit d1ce318496f5943d2cc5e20171fc383a59a1421f upstream.

The ni_labpc driver module only requests a shared IRQ for PCI devices, requesting a non-shared IRQ for non-PCI devices.
As this module is also used by the ni_labpc_cs module for certain National Instruments PCMCIA cards, it also needs to request a shared IRQ for PCMCIA devices, otherwise you get a IRQ mismatch with the CardBus controller.

---
 drivers/staging/comedi/drivers/ni_labpc.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/staging/comedi/drivers/ni_labpc.c +2 -1
@@ -575,7 +575,8 @@ int labpc_common_attach(struct comedi_de
 	/* grab our IRQ */
 	if (irq) {
 		isr_flags = 0;
-		if (thisboard->bustype == pci_bustype)
+		if (thisboard->bustype == pci_bustype
+		    || thisboard->bustype == pcmcia_bustype)
 			isr_flags |= IRQF_SHARED;
 		if (request_irq(irq, labpc_interrupt, isr_flags,
 				driver_labpc.driver_name, dev)) {
author
#41 lore raw

PATCH 41/272 Staging: hv: fix sysfs symlink on hv block device

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Ky Srinivasan <[email protected]>

commit 268eff909afaca93188d2d14554cbf824f6a0e41 upstream.

The block device does not create the proper symlink in sysfs because we forgot to set up the gendisk structure properly. This patch fixes the issue.

---
 drivers/staging/hv/blkvsc_drv.c |    1 +
 1 file changed, 1 insertion(+)
drivers/staging/hv/blkvsc_drv.c +1 -0
@@ -368,6 +368,7 @@ static int blkvsc_probe(struct device *d
 		blkdev->gd->first_minor = 0;
 	blkdev->gd->fops = &block_ops;
 	blkdev->gd->private_data = blkdev;
+	blkdev->gd->driverfs_dev = &(blkdev->device_ctx->device);
 	sprintf(blkdev->gd->disk_name, "hd%c", 'a' + devnum);
 
 	blkvsc_do_inquiry(blkdev);
author
#42 lore raw

PATCH 42/272 staging: hv: fix netvsc sleeping while atomic

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <[email protected]>

commit d70c673153d42e8aefd5ac296c8159ef222d076b upstream.

The channel callbacks are called directly from vmbus_event_dpc which runs in tasklet context. These callbacks need to use GFP_ATOMIC.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=16701

---
 drivers/staging/hv/netvsc.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/hv/netvsc.c +1 -1
@@ -1236,7 +1236,7 @@ static void NetVscOnChannelCallback(void
 	/* ASSERT(device); */
 
 	packet = kzalloc(NETVSC_PACKET_SIZE * sizeof(unsigned char),
-			 GFP_KERNEL);
+			 GFP_ATOMIC);
 	if (!packet)
 		return;
 	buffer = packet;
author
#43 lore raw

PATCH 43/272 staging: hv: Removed unneeded call to netif_stop_queue() in hv_netvsc

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Hank Janssen <[email protected]>

commit a786f915274ba446865a996515c7790a930f04dd upstream.

Removed the call to netif_stop_queue() in netvsc_probe() as the queue is not initialized at that point and further call to it after queue initialization is really not necessary.

This change was prompted after an upstream change went into 2.6.37 (netif_tx_stop_queue) that now checks if netif_stop_queue is called before register with netdev is done.

This will eliminate the warning message to the log when hv_netvsc driver starts up.

---
 drivers/staging/hv/netvsc_drv.c |    1 -
 1 file changed, 1 deletion(-)
drivers/staging/hv/netvsc_drv.c +0 -1
@@ -355,7 +355,6 @@ static int netvsc_probe(struct device *d
 
 	/* Set initial state */
 	netif_carrier_off(net);
-	netif_stop_queue(net);
 
 	net_device_ctx = netdev_priv(net);
 	net_device_ctx->device_ctx = device_ctx;
author
#44 lore raw

PATCH 44/272 staging: hv: Enable sending GARP packet after live migration

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Haiyang Zhang <[email protected]>

commit 7c161d0b900ea9bd9fc5ea5d3fa9916e9eb0dd88 upstream.

The hv_netvsc gets RNDIS_STATUS_MEDIA_CONNECT event after the VM is live migrated. Adding call to netif_notify_peers() for this event to send GARP (Gratuitous ARP) to notify network peers. Otherwise, the VM's network connection may stop after a live migration.

This patch should also be applied to stable kernel 2.6.32 and later.

---
 drivers/staging/hv/netvsc_drv.c |    1 +
 1 file changed, 1 insertion(+)
drivers/staging/hv/netvsc_drv.c +1 -0
@@ -233,6 +233,7 @@ static void netvsc_linkstatus_callback(s
 	if (status == 1) {
 		netif_carrier_on(net);
 		netif_wake_queue(net);
+		netif_notify_peers(net);
 	} else {
 		netif_carrier_off(net);
 		netif_stop_queue(net);
author
#45 lore raw

PATCH 45/272 Staging: rt3090: Fix RT3090 scan AP function

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Chien-Chia Chen <[email protected]>

commit 1226056d9608d241db4b558a0d88a347ad5c66ae upstream.

Fix RT3090 scan AP function.

This patch fixes the rt3090 wireless module failed to scan AP around due to Windows driver causing rt3090 module unable to scan AP in Linux.

---
 drivers/staging/rt2860/chips/rt3090.c |    3 ++-
 drivers/staging/rt2860/chips/rt30xx.c |    2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)
drivers/staging/rt2860/chips/rt3090.c +2 -1
@@ -51,7 +51,8 @@ void NICInitRT3090RFRegisters(struct rt_
 	if (IS_RT3090(pAd)) {
 		/* Init RF calibration */
 		/* Driver should toggle RF R30 bit7 before init RF registers */
-		u32 RfReg = 0, data;
+		u8 RfReg;
+		u32 data;
 
 		RT30xxReadRFRegister(pAd, RF_R30, (u8 *)&RfReg);
 		RfReg |= 0x80;
drivers/staging/rt2860/chips/rt30xx.c +1 -1
@@ -53,7 +53,7 @@ struct rt_reg_pair RT30xx_RFRegTable[] =
 	,
 	{RF_R06, 0x02}
 	,
-	{RF_R07, 0x70}
+	{RF_R07, 0x60}
 	,
 	{RF_R09, 0x0F}
 	,
author
#46 lore raw

PATCH 46/272 Staging: rt2860: fix previous patch error

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Chien-Chia Chen <[email protected]>

commit 1f0613158ea14b399fd7a16470630a729ba9d0c3 upstream.

Somehow Greg messed up the last patch and missed a chunk. This patch contains the missing chunk.

---
 drivers/staging/rt2860/chips/rt30xx.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/rt2860/chips/rt30xx.c +1 -1
@@ -441,7 +441,7 @@ void RT30xxReverseRFSleepModeSetup(struc
 
 		/* VCO_IC, RF R7 register Bit 4 & Bit 5 to 1 */
 		RT30xxReadRFRegister(pAd, RF_R07, &RFValue);
-		RFValue |= 0x30;
+		RFValue |= 0x20;
 		RT30xxWriteRFRegister(pAd, RF_R07, RFValue);
 
 		/* Idoh, RF R9 register Bit 1, Bit 2 & Bit 3 to 1 */
author
#47 lore raw

PATCH 47/272 staging: rt2860: Fix incorrect netif_stop_queue usage warning

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Denis Kirjanov <[email protected]>

commit 9c33008412683eba91bce2dc4575f28c728b6bd1 upstream.

The TX queues are allocated inside register_netdev. It doesn't make any sense to stop the queue before allocation.

---
 drivers/staging/rt2860/rt_main_dev.c |    2 --
 1 file changed, 2 deletions(-)
drivers/staging/rt2860/rt_main_dev.c +0 -2
@@ -483,8 +483,6 @@ struct net_device *RtmpPhyNetDevInit(str
 	net_dev->ml_priv = (void *)pAd;
 	pAd->net_dev = net_dev;
 
-	netif_stop_queue(net_dev);
-
 	return net_dev;
 
 }
author
#48 lore raw

PATCH 48/272 Staging: speakup: &&/|| confusion in silent_store()

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: roel kluin <[email protected]>

commit e7bf352fcd85c33b0805da891fc97fea8b5e996e upstream.

Fix test: the branch is always taken.

---
 drivers/staging/speakup/kobjects.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/speakup/kobjects.c +1 -1
@@ -332,7 +332,7 @@ static ssize_t silent_store(struct kobje
 	unsigned long flags;
 
 	len = strlen(buf);
-	if (len > 0 || len < 3) {
+	if (len > 0 && len < 3) {
 		ch = buf[0];
 		if (ch == '\n')
 			ch = '0';
author
#49 lore raw

PATCH 49/272 staging: brcm80211: fix suspend/resume issue in brcmsmac

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Arend van Spriel <[email protected]>

commit 4032ec639af9b735fdd903fab09de567bd73eaa0 upstream.

PCI PM suspend callback took down the interface and resume brought it back up. In the mac80211 context this is done in subsequent calls. Rework implementation so that suspend only stores config, and sets PCI power state. The resume return to full power state (D0), restores the config, and brings hardware back up. Full bringup is done by subsequent mac80211 calls.

---
 drivers/staging/brcm80211/sys/wl_mac80211.c |   45 ++++++++++++++--------------
 1 file changed, 23 insertions(+), 22 deletions(-)
drivers/staging/brcm80211/sys/wl_mac80211.c +23 -22
@@ -299,11 +299,8 @@ static void wl_ops_stop(struct ieee80211
 	wl_info_t *wl = hw->priv;
 	ASSERT(wl);
 	WL_LOCK(wl);
-	wl_down(wl);
 	ieee80211_stop_queues(hw);
 	WL_UNLOCK(wl);
-
-	return;
 }
 
 static int
@@ -336,7 +333,14 @@ wl_ops_add_interface(struct ieee80211_hw
 static void
 wl_ops_remove_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 {
-	return;
+	struct wl_info *wl;
+
+	wl = HW_TO_WL(hw);
+
+	/* put driver in down state */
+	WL_LOCK(wl);
+	wl_down(wl);
+	WL_UNLOCK(wl);
 }
 
 static int
@@ -972,7 +976,7 @@ static wl_info_t *wl_attach(u16 vendor,
 	wl_found++;
 	return wl;
 
- fail:
+fail:
 	wl_free(wl);
 fail1:
 	return NULL;
@@ -1356,7 +1360,6 @@ wl_pci_probe(struct pci_dev *pdev, const
 	return 0;
 }
 
-#ifdef LINUXSTA_PS
 static int wl_suspend(struct pci_dev *pdev, pm_message_t state)
 {
 	wl_info_t *wl;
@@ -1371,11 +1374,12 @@ static int wl_suspend(struct pci_dev *pd
 		return -ENODEV;
 	}
 
+	/* only need to flag hw is down for proper resume */
 	WL_LOCK(wl);
-	wl_down(wl);
 	wl->pub->hw_up = false;
 	WL_UNLOCK(wl);
-	pci_save_state(pdev, wl->pci_psstate);
+
+	pci_save_state(pdev);
 	pci_disable_device(pdev);
 	return pci_set_power_state(pdev, PCI_D3hot);
 }
@@ -1399,7 +1403,7 @@ static int wl_resume(struct pci_dev *pde
 	if (err)
 		return err;
 
-	pci_restore_state(pdev, wl->pci_psstate);
+	pci_restore_state(pdev);
 
 	err = pci_enable_device(pdev);
 	if (err)
@@ -1411,13 +1415,12 @@ static int wl_resume(struct pci_dev *pde
 	if ((val & 0x0000ff00) != 0)
 		pci_write_config_dword(pdev, 0x40, val & 0xffff00ff);
 
-	WL_LOCK(wl);
-	err = wl_up(wl);
-	WL_UNLOCK(wl);
-
+	/*
+	*  done. driver will be put in up state
+	*  in wl_ops_add_interface() call.
+	*/
 	return err;
 }
-#endif				/* LINUXSTA_PS */
 
 static void wl_remove(struct pci_dev *pdev)
 {
@@ -1450,14 +1453,12 @@ static void wl_remove(struct pci_dev *pd
 }
 
 static struct pci_driver wl_pci_driver = {
- .name  = "brcm80211",
- .probe = wl_pci_probe,
-#ifdef LINUXSTA_PS
- .suspend = wl_suspend,
- .resume  = wl_resume,
-#endif				/* LINUXSTA_PS */
- .remove   = __devexit_p(wl_remove),
- .id_table = wl_id_table,
+	.name = "brcm80211",
+	.probe = wl_pci_probe,
+	.suspend = wl_suspend,
+	.resume = wl_resume,
+	.remove = __devexit_p(wl_remove),
+	.id_table = wl_id_table,
 };
 #endif				/* !BCMSDIO */
 
author
#50 lore raw

PATCH 50/272 mac80211: fix mesh forwarding when ratelimited too

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Milton Miller <[email protected]>

commit 919bbad580445801c22ef6ccbe624551fee652bd upstream.

Commit b51aff057c9d0ef6c529dc25fd9f775faf7b6c63 said:

Under memory pressure, the mac80211 mesh code may helpfully print a message that it failed to clone a mesh frame and then will proceed
to crash trying to use it anyway. Fix that.

Avoid the reference whenever the frame copy is unsuccessful regardless of the debug message being suppressed or printed.

---
 net/mac80211/rx.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
net/mac80211/rx.c +2 -2
@@ -1788,11 +1788,11 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
 
 			fwd_skb = skb_copy(skb, GFP_ATOMIC);
 
-			if (!fwd_skb && net_ratelimit()) {
+			if (!fwd_skb && net_ratelimit())
 				printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
 						   sdata->name);
+			if (!fwd_skb)
 				goto out;
-			}
 
 			fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
 			memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
author
#51 lore raw

PATCH 51/272 mac80211: add missing synchronize_rcu

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Johannes Berg <[email protected]>

commit d2460f4b2fa6dbdeec800414f9cf5b1fc8b71197 upstream.

commit ad0e2b5a00dbec303e4682b403bb6703d11dcdb2

Author: Johannes Berg <[email protected]>
Date:   Tue Jun 1 10:19:19 2010 +0200

mac80211: simplify key locking

removed the synchronization against RCU and thus opened a race window where we can use a key for TX while it is already freed. Put a synchronisation into the right place to close that window.

---
 net/mac80211/key.c |    6 ++++++
 1 file changed, 6 insertions(+)
net/mac80211/key.c +6 -0
@@ -366,6 +366,12 @@ static void __ieee80211_key_destroy(stru
 	if (!key)
 		return;
 
+	/*
+	 * Synchronize so the TX path can no longer be using
+	 * this key before we free/remove it.
+	 */
+	synchronize_rcu();
+
 	if (key->local)
 		ieee80211_key_disable_hw_accel(key);
 
author
#52 lore raw

PATCH 52/272 mac80211: use maximum number of AMPDU frames as default in BA RX

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Luciano Coelho <[email protected]>

commit 82694f764dad783a123394e2220b92b9be721b43 upstream.

When the buffer size is set to zero in the block ack parameter set field, we should use the maximum supported number of subframes. The existing code was bogus and was doing some unnecessary calculations that lead to wrong values.

Thanks Johannes for helping me figure this one out.

---
 net/mac80211/agg-rx.c |   11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)
net/mac80211/agg-rx.c +2 -9
@@ -187,8 +187,6 @@ void ieee80211_process_addba_request(str
 				     struct ieee80211_mgmt *mgmt,
 				     size_t len)
 {
-	struct ieee80211_hw *hw = &local->hw;
-	struct ieee80211_conf *conf = &hw->conf;
 	struct tid_ampdu_rx *tid_agg_rx;
 	u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num, status;
 	u8 dialog_token;
@@ -233,13 +231,8 @@ void ieee80211_process_addba_request(str
 		goto end_no_lock;
 	}
 	/* determine default buffer size */
-	if (buf_size == 0) {
-		struct ieee80211_supported_band *sband;
-
-		sband = local->hw.wiphy->bands[conf->channel->band];
-		buf_size = IEEE80211_MIN_AMPDU_BUF;
-		buf_size = buf_size << sband->ht_cap.ampdu_factor;
-	}
+	if (buf_size == 0)
+		buf_size = IEEE80211_MAX_AMPDU_BUF;
 
 
 	/* examine state machine */
author
#53 lore raw

PATCH 53/272 mac80211: fix a crash in ieee80211_beacon_get_tim on change_interface

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Felix Fietkau <[email protected]>

commit eb3e554b4b3a56386ef5214dbe0e3935a350178b upstream.

Some drivers (e.g. ath9k) do not always disable beacons when they're supposed to. When an interface is changed using the change_interface op, the mode specific sdata part is in an undefined state and trying to get a beacon at this point can produce weird crashes.

To fix this, add a check for ieee80211_sdata_running before using anything from the sdata.

---
 net/mac80211/tx.c |    3 +++
 1 file changed, 3 insertions(+)
net/mac80211/tx.c +3 -0
@@ -2207,6 +2207,9 @@ struct sk_buff *ieee80211_beacon_get_tim
 
 	sdata = vif_to_sdata(vif);
 
+	if (!ieee80211_sdata_running(sdata))
+		goto out;
+
 	if (tim_offset)
 		*tim_offset = 0;
 	if (tim_length)
author
#54 lore raw

PATCH 54/272 mac80211: fix initialization of skb->cb in ieee80211_subif_start_xmit

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Felix Fietkau <[email protected]>

commit 489ee9195a7de9e6bc833d639ff6b553ffdad90e upstream.

The change 'mac80211: Fix BUG in pskb_expand_head when transmitting shared skbs' added a check for copying the skb if it's shared, however the tx info variable still points at the cb of the old skb

---
 net/mac80211/tx.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
net/mac80211/tx.c +2 -1
@@ -1726,7 +1726,7 @@ netdev_tx_t ieee80211_subif_start_xmit(s
 {
 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	struct ieee80211_local *local = sdata->local;
-	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+	struct ieee80211_tx_info *info;
 	int ret = NETDEV_TX_BUSY, head_need;
 	u16 ethertype, hdrlen,  meshhdrlen = 0;
 	__le16 fc;
@@ -2017,6 +2017,7 @@ netdev_tx_t ieee80211_subif_start_xmit(s
 	skb_set_network_header(skb, nh_pos);
 	skb_set_transport_header(skb, h_pos);
 
+	info = IEEE80211_SKB_CB(skb);
 	memset(info, 0, sizeof(*info));
 
 	dev->trans_start = jiffies;
author
#55 lore raw

PATCH 55/272 iwlagn: enable only rfkill interrupt when device is down

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Stanislaw Gruszka <[email protected]>

commit 554d1d027b19265c4aa3f718b3126d2b86e09a08 upstream.

Since commit 6cd0b1cb872b3bf9fc5de4536404206ab74bafdd "iwlagn: fix hw-rfkill while the interface is down", we enable interrupts when device is not ready to receive them. However hardware, when it is in some inconsistent state, can generate other than rfkill interrupts and crash the system. I can reproduce crash with "kernel BUG at drivers/net/wireless/iwlwifi/iwl-agn.c:1010!" message, when forcing firmware restarts.

To fix only enable rfkill interrupt when down device and after probe. I checked patch on laptop with 5100 device, rfkill change is still passed to user space when device is down.

---
 drivers/net/wireless/iwlwifi/iwl-agn.c     |    9 +++++----
 drivers/net/wireless/iwlwifi/iwl-helpers.h |    6 ++++++
 2 files changed, 11 insertions(+), 4 deletions(-)
drivers/net/wireless/iwlwifi/iwl-agn.c +5 -4
@@ -3530,9 +3530,10 @@ static void iwl_mac_stop(struct ieee8021
 
 	flush_workqueue(priv->workqueue);
 
-	/* enable interrupts again in order to receive rfkill changes */
+	/* User space software may expect getting rfkill changes
+	 * even if interface is down */
 	iwl_write32(priv, CSR_INT, 0xFFFFFFFF);
-	iwl_enable_interrupts(priv);
+	iwl_enable_rfkill_int(priv);
 
 	IWL_DEBUG_MAC80211(priv, "leave\n");
 }
@@ -4515,14 +4516,14 @@ static int iwl_pci_probe(struct pci_dev
 	 * 8. Enable interrupts and read RFKILL state
 	 *********************************************/
 
-	/* enable interrupts if needed: hw bug w/a */
+	/* enable rfkill interrupt: hw bug w/a */
 	pci_read_config_word(priv->pci_dev, PCI_COMMAND, &pci_cmd);
 	if (pci_cmd & PCI_COMMAND_INTX_DISABLE) {
 		pci_cmd &= ~PCI_COMMAND_INTX_DISABLE;
 		pci_write_config_word(priv->pci_dev, PCI_COMMAND, pci_cmd);
 	}
 
-	iwl_enable_interrupts(priv);
+	iwl_enable_rfkill_int(priv);
 
 	/* If platform's RF_KILL switch is NOT set to KILL */
 	if (iwl_read32(priv, CSR_GP_CNTRL) & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW)
drivers/net/wireless/iwlwifi/iwl-helpers.h +6 -0
@@ -163,6 +163,12 @@ static inline void iwl_disable_interrupt
 	IWL_DEBUG_ISR(priv, "Disabled interrupts\n");
 }
 
+static inline void iwl_enable_rfkill_int(struct iwl_priv *priv)
+{
+	IWL_DEBUG_ISR(priv, "Enabling rfkill interrupt\n");
+	iwl_write32(priv, CSR_INT_MASK, CSR_INT_BIT_RF_KILL);
+}
+
 static inline void iwl_enable_interrupts(struct iwl_priv *priv)
 {
 	IWL_DEBUG_ISR(priv, "Enabling interrupts\n");
author
#56 lore raw

PATCH 56/272 iwlagn: Re-enable RF_KILL interrupt when down

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Don Fry <[email protected]>

commit 3dd823e6b86407aed1a025041d8f1df77e43a9c8 upstream.

With commit 554d1d027b19265c4aa3f718b3126d2b86e09a08 only one RF_KILL interrupt will be seen by the driver when the interface is down.

Re-enable the interrupt when it occurs to see all transitions.

---
 drivers/net/wireless/iwlwifi/iwl-agn.c |    6 ++++++
 1 file changed, 6 insertions(+)
drivers/net/wireless/iwlwifi/iwl-agn.c +6 -0
@@ -1319,6 +1319,9 @@ static void iwl_irq_tasklet_legacy(struc
 	/* only Re-enable if diabled by irq */
 	if (test_bit(STATUS_INT_ENABLED, &priv->status))
 		iwl_enable_interrupts(priv);
+	/* Re-enable RF_KILL if it occurred */
+	else if (handled & CSR_INT_BIT_RF_KILL)
+		iwl_enable_rfkill_int(priv);
 
 #ifdef CONFIG_IWLWIFI_DEBUG
 	if (iwl_get_debug_level(priv) & (IWL_DL_ISR)) {
@@ -1533,6 +1536,9 @@ static void iwl_irq_tasklet(struct iwl_p
 	/* only Re-enable if diabled by irq */
 	if (test_bit(STATUS_INT_ENABLED, &priv->status))
 		iwl_enable_interrupts(priv);
+	/* Re-enable RF_KILL if it occurred */
+	else if (handled & CSR_INT_BIT_RF_KILL)
+		iwl_enable_rfkill_int(priv);
 }
 
 /* the threshold ratio of actual_ack_cnt to expected_ack_cnt in percent */
author
#57 lore raw

PATCH 57/272 ath9k_htc: Handle pending URBs properly

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Sujith Manoharan <[email protected]>

commit ff8f59b5bbdf1527235b8c88d859c7d23691324f upstream.

When doing a channel change, the pending URBs have to be killed properly on calling htc_stop().

This fixes the probe response timeout seen when sending UDP traffic at a high rate and running background scan at the same time.

---
 drivers/net/wireless/ath/ath9k/hif_usb.c |   40 +++++++++++++++++++++++++++----
 drivers/net/wireless/ath/ath9k/hif_usb.h |    1 
 2 files changed, 37 insertions(+), 4 deletions(-)
drivers/net/wireless/ath/ath9k/hif_usb.c +36 -4
@@ -144,16 +144,36 @@ static void hif_usb_tx_cb(struct urb *ur
 	case -ENODEV:
 	case -ESHUTDOWN:
 		/*
-		 * The URB has been killed, free the SKBs
-		 * and return.
+		 * The URB has been killed, free the SKBs.
 		 */
 		ath9k_skb_queue_purge(hif_dev, &tx_buf->skb_queue);
-		return;
+
+		/*
+		 * If the URBs are being flushed, no need to add this
+		 * URB to the free list.
+		 */
+		spin_lock(&hif_dev->tx.tx_lock);
+		if (hif_dev->tx.flags & HIF_USB_TX_FLUSH) {
+			spin_unlock(&hif_dev->tx.tx_lock);
+			return;
+		}
+		spin_unlock(&hif_dev->tx.tx_lock);
+
+		/*
+		 * In the stop() case, this URB has to be added to
+		 * the free list.
+		 */
+		goto add_free;
 	default:
 		break;
 	}
 
-	/* Check if TX has been stopped */
+	/*
+	 * Check if TX has been stopped, this is needed because
+	 * this CB could have been invoked just after the TX lock
+	 * was released in hif_stop() and kill_urb() hasn't been
+	 * called yet.
+	 */
 	spin_lock(&hif_dev->tx.tx_lock);
 	if (hif_dev->tx.flags & HIF_USB_TX_STOP) {
 		spin_unlock(&hif_dev->tx.tx_lock);
@@ -305,6 +325,7 @@ static void hif_usb_start(void *hif_hand
 static void hif_usb_stop(void *hif_handle, u8 pipe_id)
 {
 	struct hif_device_usb *hif_dev = (struct hif_device_usb *)hif_handle;
+	struct tx_buf *tx_buf = NULL, *tx_buf_tmp = NULL;
 	unsigned long flags;
 
 	spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
@@ -312,6 +333,12 @@ static void hif_usb_stop(void *hif_handl
 	hif_dev->tx.tx_skb_cnt = 0;
 	hif_dev->tx.flags |= HIF_USB_TX_STOP;
 	spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
+
+	/* The pending URBs have to be canceled. */
+	list_for_each_entry_safe(tx_buf, tx_buf_tmp,
+				 &hif_dev->tx.tx_pending, list) {
+		usb_kill_urb(tx_buf->urb);
+	}
 }
 
 static int hif_usb_send(void *hif_handle, u8 pipe_id, struct sk_buff *skb,
@@ -578,6 +605,7 @@ free:
 static void ath9k_hif_usb_dealloc_tx_urbs(struct hif_device_usb *hif_dev)
 {
 	struct tx_buf *tx_buf = NULL, *tx_buf_tmp = NULL;
+	unsigned long flags;
 
 	list_for_each_entry_safe(tx_buf, tx_buf_tmp,
 				 &hif_dev->tx.tx_buf, list) {
@@ -588,6 +616,10 @@ static void ath9k_hif_usb_dealloc_tx_urb
 		kfree(tx_buf);
 	}
 
+	spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
+	hif_dev->tx.flags |= HIF_USB_TX_FLUSH;
+	spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
+
 	list_for_each_entry_safe(tx_buf, tx_buf_tmp,
 				 &hif_dev->tx.tx_pending, list) {
 		usb_kill_urb(tx_buf->urb);
drivers/net/wireless/ath/ath9k/hif_usb.h +1 -0
@@ -62,6 +62,7 @@ struct tx_buf {
 };
 
 #define HIF_USB_TX_STOP  BIT(0)
+#define HIF_USB_TX_FLUSH BIT(1)
 
 struct hif_usb_tx {
 	u8 flags;
author
#58 lore raw

PATCH 58/272 ath9k_hw: Fix XPABIAS level configuration for AR9003

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Vasanthakumar Thiagarajan <[email protected]>

commit 52a0e2477dac2106bc1688cbe9615cdafc9deb7d upstream.

Improper configuration of 0x16288 and 0x16290 would affect transmission.

---
 drivers/net/wireless/ath/ath9k/ar9003_eeprom.c |   14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/net/wireless/ath/ath9k/ar9003_eeprom.c +8 -6
@@ -22,12 +22,14 @@
 #define COMP_CKSUM_LEN 2
 
 #define AR_CH0_TOP (0x00016288)
-#define AR_CH0_TOP_XPABIASLVL (0x3)
+#define AR_CH0_TOP_XPABIASLVL (0x300)
 #define AR_CH0_TOP_XPABIASLVL_S (8)
 
 #define AR_CH0_THERM (0x00016290)
-#define AR_CH0_THERM_SPARE (0x3f)
-#define AR_CH0_THERM_SPARE_S (0)
+#define AR_CH0_THERM_XPABIASLVL_MSB 0x3
+#define AR_CH0_THERM_XPABIASLVL_MSB_S 0
+#define AR_CH0_THERM_XPASHORT2GND 0x4
+#define AR_CH0_THERM_XPASHORT2GND_S 2
 
 #define AR_SWITCH_TABLE_COM_ALL (0xffff)
 #define AR_SWITCH_TABLE_COM_ALL_S (0)
@@ -995,9 +997,9 @@ static s32 ar9003_hw_xpa_bias_level_get(
 static void ar9003_hw_xpa_bias_level_apply(struct ath_hw *ah, bool is2ghz)
 {
 	int bias = ar9003_hw_xpa_bias_level_get(ah, is2ghz);
-	REG_RMW_FIELD(ah, AR_CH0_TOP, AR_CH0_TOP_XPABIASLVL, (bias & 0x3));
-	REG_RMW_FIELD(ah, AR_CH0_THERM, AR_CH0_THERM_SPARE,
-		      ((bias >> 2) & 0x3));
+	REG_RMW_FIELD(ah, AR_CH0_TOP, AR_CH0_TOP_XPABIASLVL, bias);
+	REG_RMW_FIELD(ah, AR_CH0_THERM, AR_CH0_THERM_XPABIASLVL_MSB, bias >> 2);
+	REG_RMW_FIELD(ah, AR_CH0_THERM, AR_CH0_THERM_XPASHORT2GND, 1);
 }
 
 static u32 ar9003_hw_ant_ctrl_common_get(struct ath_hw *ah, bool is2ghz)
author
#59 lore raw

PATCH 59/272 ath9k: Fix bug in delimiter padding computation

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Vasanthakumar Thiagarajan <[email protected]>

commit 39ec2997c374b528cdbf65099b6d6b8593a67f7f upstream.

There is a roundng error in delimiter padding computation which causes severe throughput drop with some of AR9003.

---
 drivers/net/wireless/ath/ath9k/ath9k.h |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath9k/ath9k.h +2 -2
@@ -178,8 +178,8 @@ void ath_descdma_cleanup(struct ath_soft
 
 /* returns delimiter padding required given the packet length */
 #define ATH_AGGR_GET_NDELIM(_len)					\
-	(((((_len) + ATH_AGGR_DELIM_SZ) < ATH_AGGR_MINPLEN) ?           \
-	  (ATH_AGGR_MINPLEN - (_len) - ATH_AGGR_DELIM_SZ) : 0) >> 2)
+       (((_len) >= ATH_AGGR_MINPLEN) ? 0 :                             \
+        DIV_ROUND_UP(ATH_AGGR_MINPLEN - (_len), ATH_AGGR_DELIM_SZ))
 
 #define BAW_WITHIN(_start, _bawsz, _seqno) \
 	((((_seqno) - (_start)) & 4095) < (_bawsz))
author
#60 lore raw

PATCH 60/272 ath9k: fix assumptions for idle calls on suspend/resume

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Luis R. Rodriguez <[email protected]>

commit a08e7ade9ddf4fe79576f953cc5c1725e944d26c upstream.

mac80211 will notify drivers when to go idle and ath9k assumed that it would get further notifications for idle states after a device stop() config call but as per agreed semantics the idle state of the radio is left up to driver after mac80211 issues the stop() callback. The driver is resposnbile for ensuring the device remains idle after that even between suspend / resume calls.

This fixes suspend/resume when you issue suspend and resume twice on ath9k when ath9k_stop() was already called. We need to put the radio to full sleep in order for resume to work correctly.

What might seem fishy is we are turning the radio off after resume. The reason why we do this is because we know we should not have anything enabled after a mac80211 tells us to stop(), if we resume and never get a start() we won't get another stop() by mac80211 so to be safe always bring the 802.11 device with the radio disabled after resume, this ensures that if we suspend we already have the radio disabled and only a start() will ever trigger it on.

---
 drivers/net/wireless/ath/ath9k/main.c |    4 ++--
 drivers/net/wireless/ath/ath9k/pci.c  |    3 +++
 2 files changed, 5 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath9k/main.c +2 -2
@@ -1418,8 +1418,8 @@ static void ath9k_stop(struct ieee80211_
 	ath9k_hw_configpcipowersave(ah, 1, 1);
 	ath9k_ps_restore(sc);
 
-	/* Finally, put the chip in FULL SLEEP mode */
-	ath9k_setpower(sc, ATH9K_PM_FULL_SLEEP);
+	sc->ps_idle = true;
+	ath_radio_disable(sc, hw);
 
 	sc->sc_flags |= SC_OP_INVALID;
 
drivers/net/wireless/ath/ath9k/pci.c +3 -0
@@ -290,6 +290,9 @@ static int ath_pci_resume(struct pci_dev
 			    AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
 	ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, 1);
 
+	sc->ps_idle = true;
+	ath_radio_disable(sc, hw);
+
 	return 0;
 }
 
author
#61 lore raw

PATCH 61/272 ath9k: fix aphy / wiphy idle mismatch

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Luis R. Rodriguez <[email protected]>

commit afe68d0a8f5961652e26cea39d74e2cc820de841 upstream.

ath9k supports its own set of virtual wiphys, and it uses the mac80211 idle notifications to know when a device needs to be idle or not. We recently changed ath9k to force idle on driver stop() and on resume but forgot to take into account ath9k's own virtual wiphy idle states. These are used internally by ath9k to check if the device's radio should be powered down on each idle call. Without this change its possible that the device could have been forced off but the virtual wiphy idle was left on.

---
 drivers/net/wireless/ath/ath9k/main.c |    1 +
 drivers/net/wireless/ath/ath9k/pci.c  |    1 +
 2 files changed, 2 insertions(+)
drivers/net/wireless/ath/ath9k/main.c +1 -0
@@ -1419,6 +1419,7 @@ static void ath9k_stop(struct ieee80211_
 	ath9k_ps_restore(sc);
 
 	sc->ps_idle = true;
+	ath9k_set_wiphy_idle(aphy, true);
 	ath_radio_disable(sc, hw);
 
 	sc->sc_flags |= SC_OP_INVALID;
drivers/net/wireless/ath/ath9k/pci.c +1 -0
@@ -291,6 +291,7 @@ static int ath_pci_resume(struct pci_dev
 	ath9k_hw_set_gpio(sc->sc_ah, sc->sc_ah->led_pin, 1);
 
 	sc->ps_idle = true;
+	ath9k_set_wiphy_idle(aphy, true);
 	ath_radio_disable(sc, hw);
 
 	return 0;
author
#62 lore raw

PATCH 62/272 ath9k: fix beacon restart on channel change

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Rajkumar Manoharan <[email protected]>

commit 1186488b4a4d4871e40cb1604ba3ede3d4b7cc90 upstream.

Restart the beacon timers only if the beacon was already configured. Otherwise beacons timers are restarted unnecessarily in unassociated state too.

---
 drivers/net/wireless/ath/ath9k/main.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/main.c +2 -1
@@ -295,7 +295,8 @@ int ath_set_channel(struct ath_softc *sc
 	ath9k_hw_set_interrupts(ah, ah->imask);
 
 	if (!(sc->sc_flags & (SC_OP_OFFCHANNEL))) {
-		ath_beacon_config(sc, NULL);
+		if (sc->sc_flags & SC_OP_BEACONS)
+			ath_beacon_config(sc, NULL);
 		ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work, 0);
 		ath_start_ani(common);
 	}
author
#63 lore raw

PATCH 63/272 ath9k_hw: do PA offset calibration only on longcal interval

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Rajkumar Manoharan <[email protected]>

commit 811ea256b30b37091b5bbf41517404cf98ab56c1 upstream.

The power detector adc offset calibration has to be done on 4 minutes interval (longcal * pa_skip_count). But the commit "ath9k_hw: fix a noise floor calibration related race condition" makes the PA calibration executed more frequently beased on nfcal_pending value. Running PAOffset calibration lesser than longcal interval doesn't help anything and the worse part is that it causes NF load timeouts and RX deaf conditions.

In a very noisy environment, where the distance b/w AP & station is ~10 meter and running a downlink udp traffic with frequent background scan causes "Timeout while waiting for nf to load:
AR_PHY_AGC_CONTROL=0x40d1a" and moves the chip into deaf state. This issue was originaly reported in Android platform where the network-manager application does bgscan more frequently on AR9271 chips. (AR9285 family usb device).

---
 drivers/net/wireless/ath/ath9k/ar9002_calib.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/net/wireless/ath/ath9k/ar9002_calib.c +5 -5
@@ -681,10 +681,6 @@ static bool ar9002_hw_calibrate(struct a
 
 	/* Do NF cal only at longer intervals */
 	if (longcal || nfcal_pending) {
-		/* Do periodic PAOffset Cal */
-		ar9002_hw_pa_cal(ah, false);
-		ar9002_hw_olc_temp_compensation(ah);
-
 		/*
 		 * Get the value from the previous NF cal and update
 		 * history buffer.
@@ -699,8 +695,12 @@ static bool ar9002_hw_calibrate(struct a
 			ath9k_hw_loadnf(ah, ah->curchan);
 		}
 
-		if (longcal)
+		if (longcal) {
 			ath9k_hw_start_nfcal(ah, false);
+			/* Do periodic PAOffset Cal */
+			ar9002_hw_pa_cal(ah, false);
+			ar9002_hw_olc_temp_compensation(ah);
+		}
 	}
 
 	return iscaldone;
author
#64 lore raw

PATCH 64/272 ath9k_hw: disabled PAPRD for AR9003

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Luis R. Rodriguez <[email protected]>

commit 6f4810101a629b31b5427872a09ea092cfc5c4bd upstream.

AR9003's PAPRD was enabled prematurely, and is causing some large discrepancies on throughput and network connectivity. For example downlink (RX) throughput against an AR9280 AP can vary widlely from 43-73 Mbit/s while disabling this gets AR9382 (2x2) up to around 93 Mbit/s in a 2.4 GHz HT20 setup.

---
 drivers/net/wireless/ath/ath9k/hw.c |    6 +++++-
 drivers/net/wireless/ath/ath9k/hw.h |    1 +
 2 files changed, 6 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/hw.c +5 -1
@@ -385,6 +385,9 @@ static void ath9k_hw_init_config(struct
 	else
 		ah->config.ht_enable = 0;
 
+	/* PAPRD needs some more work to be enabled */
+	ah->config.paprd_disable = 1;
+
 	ah->config.rx_intr_mitigation = true;
 	ah->config.pcieSerDesWrite = true;
 
@@ -1949,7 +1952,8 @@ int ath9k_hw_fill_cap_info(struct ath_hw
 		pCap->rx_status_len = sizeof(struct ar9003_rxs);
 		pCap->tx_desc_len = sizeof(struct ar9003_txc);
 		pCap->txs_len = sizeof(struct ar9003_txs);
-		if (ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
+		if (!ah->config.paprd_disable &&
+		    ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
 			pCap->hw_caps |= ATH9K_HW_CAP_PAPRD;
 	} else {
 		pCap->tx_desc_len = sizeof(struct ath_desc);
drivers/net/wireless/ath/ath9k/hw.h +1 -0
@@ -215,6 +215,7 @@ struct ath9k_ops_config {
 	u32 pcie_waen;
 	u8 analog_shiftreg;
 	u8 ht_enable;
+	u8 paprd_disable;
 	u32 ofdm_trig_low;
 	u32 ofdm_trig_high;
 	u32 cck_trig_high;
author
#65 lore raw

PATCH 65/272 ath9k_hw: Fix system hang when resuming from S3/S4

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Rajkumar Manoharan <[email protected]>

commit 5b64aa72ead6f8be488d2be7af579f0d69fb7a6e upstream.

The bit 6 & 7 of AR_WA (0x4004) should be enabled only for the chips that are supporting L0s functionality while resuming back from S3/S4.

Enabling these bits for AR9280 is causing system hang within a few S3/S4-resume cycles.

---
 drivers/net/wireless/ath/ath9k/ar9002_hw.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/wireless/ath/ath9k/ar9002_hw.c +1 -2
@@ -444,9 +444,8 @@ static void ar9002_hw_configpcipowersave
 		}
 
 		/* WAR for ASPM system hang */
-		if (AR_SREV_9280(ah) || AR_SREV_9285(ah) || AR_SREV_9287(ah)) {
+		if (AR_SREV_9285(ah) || AR_SREV_9287(ah))
 			val |= (AR_WA_BIT6 | AR_WA_BIT7);
-		}
 
 		if (AR_SREV_9285E_20(ah))
 			val |= AR_WA_BIT23;
author
#66 lore raw

PATCH 66/272 ath: Missed to clear key4 of micentry

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Rajkumar Manoharan <[email protected]>

commit 998d516d9546eba04dd99ae49a78acb0cf770478 upstream.

key4 of micentry is used, if ATH_CRYPT_CAP_MIC_COMBINED is set. But is not cleared on key cache reset.

---
 drivers/net/wireless/ath/key.c |    2 ++
 1 file changed, 2 insertions(+)
drivers/net/wireless/ath/key.c +2 -0
@@ -60,6 +60,8 @@ bool ath_hw_keyreset(struct ath_common *
 		REG_WRITE(ah, AR_KEYTABLE_KEY1(micentry), 0);
 		REG_WRITE(ah, AR_KEYTABLE_KEY2(micentry), 0);
 		REG_WRITE(ah, AR_KEYTABLE_KEY3(micentry), 0);
+		if (common->crypt_caps & ATH_CRYPT_CAP_MIC_COMBINED)
+			REG_WRITE(ah, AR_KEYTABLE_KEY4(micentry), 0);
 
 	}
 
author
#67 lore raw

PATCH 67/272 qdio: use proper QEBSM operand for SIGA-R and SIGA-S

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Jan Glauber <[email protected]>

commit 958c0ba403cb6a693b54be2389f9ef53377fa259 upstream.

If QIOASSIST is enabled for a qdio device the SIGA instruction requires a modified function code. This function code modifier was missing for SIGA-R and SIGA-S which can lead to a kernel panic caused by an operand exception.

---
 drivers/s390/cio/qdio.h      |    6 ++++++
 drivers/s390/cio/qdio_main.c |   43 ++++++++++++++++++++++++++++---------------
 2 files changed, 34 insertions(+), 15 deletions(-)
drivers/s390/cio/qdio.h +6 -0
@@ -91,6 +91,12 @@ enum qdio_irq_states {
 #define AC1_SC_QEBSM_AVAILABLE		0x02	/* available for subchannel */
 #define AC1_SC_QEBSM_ENABLED		0x01	/* enabled for subchannel */
 
+/* SIGA flags */
+#define QDIO_SIGA_WRITE		0x00
+#define QDIO_SIGA_READ		0x01
+#define QDIO_SIGA_SYNC		0x02
+#define QDIO_SIGA_QEBSM_FLAG	0x80
+
 #ifdef CONFIG_64BIT
 static inline int do_sqbs(u64 token, unsigned char state, int queue,
 			  int *start, int *count)
drivers/s390/cio/qdio_main.c +28 -15

93 lines not on this page · raw message

author
#68 lore raw

PATCH 68/272 zcrypt: Fix check to look for facility bits 2 & 65

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Felix Beck <[email protected]>

commit 53ec24b1e6c7118a127cf029a1519a2ce55268ec upstream.

Fix the check for ap interupts to look for facility bits 2 and 65. Make sure that we only register interrupts for aps, if the machine has ap interrupt support.

This patch is relevant only for the 2.6.37 stable series.

---
 drivers/s390/crypto/ap_bus.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/s390/crypto/ap_bus.c +1 -1
@@ -154,7 +154,7 @@ static inline int ap_instructions_availa
  */
 static int ap_interrupts_available(void)
 {
-	return test_facility(1) && test_facility(2);
+	return test_facility(2) && test_facility(65);
 }
 
 /**
author
#69 lore raw

PATCH 69/272 fix medium error problems with some arrays which can cause data corruption

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: James Bottomley <[email protected]>

commit a8733c7baf457b071528e385a0b7d4aaec79287c upstream.

Our current handling of medium error assumes that data is returned up to the bad sector. This assumption holds good for all disk devices, all DIF arrays and most ordinary arrays. However, an LSI array engine was recently discovered which reports a medium error without returning any data. This means that when we report good data up to the medium error, we've reported junk originally in the buffer as good. Worse, if the read consists of requested data plus a readahead, and the error occurs in readahead, we'll just strip off the readahead and report junk up to userspace as good data with no error.

The fix for this is to have the error position computation take into account the amount of data returned by the driver using the scsi residual data. Unfortunately, not every driver fills in this data, but for those who don't, it's set to zero, which means we'll think a full set of data was transferred and the behaviour will be identical to the prior behaviour of the code (believe the buffer up to the error sector). All modern drivers seem to set the residual, so that should fix up the LSI failure/corruption case.

---
 drivers/scsi/sd.c |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/scsi/sd.c +8 -1
@@ -1175,6 +1175,12 @@ static unsigned int sd_completed_bytes(s
 	u64 end_lba = blk_rq_pos(scmd->request) + (scsi_bufflen(scmd) / 512);
 	u64 bad_lba;
 	int info_valid;
+	/*
+	 * resid is optional but mostly filled in.  When it's unused,
+	 * its value is zero, so we assume the whole buffer transferred
+	 */
+	unsigned int transferred = scsi_bufflen(scmd) - scsi_get_resid(scmd);
+	unsigned int good_bytes;
 
 	if (scmd->request->cmd_type != REQ_TYPE_FS)
 		return 0;
@@ -1208,7 +1214,8 @@ static unsigned int sd_completed_bytes(s
 	/* This computation should always be done in terms of
 	 * the resolution of the device's medium.
 	 */
-	return (bad_lba - start_lba) * scmd->device->sector_size;
+	good_bytes = (bad_lba - start_lba) * scmd->device->sector_size;
+	return min(good_bytes, transferred);
 }
 
 /**
author
#70 lore raw

PATCH 70/272 libsas: fix runaway error handler problem

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: James Bottomley <[email protected]>

commit 9ee91f7fb550a4c82f82d9818e42493484c754af upstream.

libsas makes use of scsi_schedule_eh() but forgets to clear the host_eh_scheduled flag in its error handling routine. Because of this, the error handler thread never gets to sleep; it's constantly awake and trying to run the error routine leading to console spew and inability to run anything else (at least on a UP system). The fix is to clear the flag as we splice the work queue.

---
 drivers/scsi/libsas/sas_scsi_host.c |    1 +
 1 file changed, 1 insertion(+)
drivers/scsi/libsas/sas_scsi_host.c +1 -0
@@ -647,6 +647,7 @@ void sas_scsi_recover_host(struct Scsi_H
 
 	spin_lock_irqsave(shost->host_lock, flags);
 	list_splice_init(&shost->eh_cmd_q, &eh_work_q);
+	shost->host_eh_scheduled = 0;
 	spin_unlock_irqrestore(shost->host_lock, flags);
 
 	SAS_DPRINTK("Enter %s\n", __func__);
author
#71 lore raw

PATCH 71/272 mpt2sas: fix Integrated Raid unsynced on shutdown problem

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Kashyap, Desai <[email protected]>

commit 3a9c913a3e57b170887d39456e04c18f2305ec67 upstream.

Issue:
IR shutdown(sending) and IR shutdown(complete) messages not listed in /var/log/messages when driver is removed.

The driver needs to issue a MPI2_RAID_ACTION_SYSTEM_SHUTDOWN_INITIATED request when the driver is unloaded so the IR metadata journal is updated. If this request is not sent, then the volume would need a "check consistency" issued on the next bootup if the volume was roamed from one initiator to another. The current driver supports this feature only when the system is rebooted, however this also need to be supported if the driver is unloaded

Fix:
To fix this issue, the driver is going
to need to call the _scsih_ir_shutdown prior to reporting the volumes missing from the OS, hence the device handles are still present.

---
 drivers/scsi/mpt2sas/mpt2sas_scsih.c |    1 +
 1 file changed, 1 insertion(+)
drivers/scsi/mpt2sas/mpt2sas_scsih.c +1 -0
@@ -6687,6 +6687,7 @@ _scsih_remove(struct pci_dev *pdev)
 		destroy_workqueue(wq);
 
 	/* release all the volumes */
+	_scsih_ir_shutdown(ioc);
 	list_for_each_entry_safe(raid_device, next, &ioc->raid_device_list,
 	    list) {
 		if (raid_device->starget) {
author
#72 lore raw

PATCH 72/272 fix incorrect value of SCSI_MAX_SG_CHAIN_SEGMENTS due to include file ordering

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: David Dillow <[email protected]>

commit ac61c46f4f7665ab4548e90430c37b2529e16cff upstream.

If the compiled object doesn't include linux/scatterlist.h before scsi/scsi.h, it will get an incorrect definition of SCSI_MAX_SG_CHAIN_SEGMENTS.

---
 include/scsi/scsi.h |    1 +
 1 file changed, 1 insertion(+)
include/scsi/scsi.h +1 -0
@@ -9,6 +9,7 @@
 #define _SCSI_SCSI_H
 
 #include <linux/types.h>
+#include <linux/scatterlist.h>
 
 struct scsi_cmnd;
 
author
#73 lore raw

PATCH 73/272 mpt2sas: Fix device removal handshake for zoned devices

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Kashyap, Desai <[email protected]>

commit 4dc2757a2e9a9d1f2faee4fc6119276fc0061c16 upstream.

When zoning end devices, the driver is not sending device removal handshake alogrithm to firmware. This results in controller firmware not sending sas topology add events the next time the device is added. The fix is the driver should be doing the device removal handshake even though the PHYSTATUS_VACANT bit is set in the PhyStatus of the event data. The current design is avoiding the handshake when the VACANT bit is set in the phy status.

---
 drivers/scsi/mpt2sas/mpt2sas_scsih.c |    3 ---
 1 file changed, 3 deletions(-)
drivers/scsi/mpt2sas/mpt2sas_scsih.c +0 -3
@@ -2957,9 +2957,6 @@ _scsih_check_topo_delete_events(struct M
 	u16 handle;
 
 	for (i = 0 ; i < event_data->NumEntries; i++) {
-		if (event_data->PHY[i].PhyStatus &
-		    MPI2_EVENT_SAS_TOPO_PHYSTATUS_VACANT)
-			continue;
 		handle = le16_to_cpu(event_data->PHY[i].AttachedDevHandle);
 		if (!handle)
 			continue;
author
#74 lore raw

PATCH 74/272 mpt2sas: fix internal device reset for older firmware prior to MPI Rev K

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Kashyap, Desai <[email protected]>

commit efe82a16bc0f9f9e1fc8fa706eb0309fcd57770a upstream.

The "internal device reset complete" event is not supported
for older firmware prior to MPI Rev K We added
a check in the driver so the "internal device reset" event is ignored for older firmware. When ignored, the tm_busy flag doesn't get set nor cleared. Without this fix, IO queues would be froozen indefinetly after the "internal device reset" event, as the "complete" event never sent to clear the flag.

---
 drivers/scsi/mpt2sas/mpt2sas_scsih.c |    6 ++++++
 1 file changed, 6 insertions(+)
drivers/scsi/mpt2sas/mpt2sas_scsih.c +6 -0
@@ -4939,6 +4939,12 @@ _scsih_sas_device_status_change_event(st
 		     event_data);
 #endif
 
+	/* In MPI Revision K (0xC), the internal device reset complete was
+	 * implemented, so avoid setting tm_busy flag for older firmware.
+	 */
+	if ((ioc->facts.HeaderVersion >> 8) < 0xC)
+		return;
+
 	if (event_data->ReasonCode !=
 	    MPI2_EVENT_SAS_DEV_STAT_RC_INTERNAL_DEVICE_RESET &&
 	   event_data->ReasonCode !=
author
#75 lore raw

PATCH 75/272 mpt2sas: Fix the race between broadcast asyn event and scsi command completion

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Kashyap, Desai <[email protected]>

commit ec07a053597bdab51cbd23619f9f9f392712508a upstream.

False timeout after hard resets, there were two issues which leads to timeout.
(1) Panic because of invalid memory access in the broadcast asyn event processing routine due to a race between accessing the scsi command pointer from broadcast asyn event processing thread and completing the same scsi command from the interrupt context.
(2) Broadcast asyn event notifcations are not handled due to events ignored while the broadcast asyn event is activity being processed from the event process kernel thread.

In addition, changed the ABRT_TASK_SET to ABORT_TASK in the
broadcast async event processing routine. This is less disruptive to other
request that generate Broadcast Asyn Primitives besides target reset. e.g clear reservations, microcode download,and mode select.

---
 drivers/scsi/mpt2sas/mpt2sas_scsih.c |   54 +++++++++++++++++++++++++++++------
 1 file changed, 45 insertions(+), 9 deletions(-)
drivers/scsi/mpt2sas/mpt2sas_scsih.c +45 -9
@@ -819,7 +819,7 @@ _scsih_is_end_device(u32 device_info)
 }
 
 /**
- * mptscsih_get_scsi_lookup - returns scmd entry
+ * _scsih_scsi_lookup_get - returns scmd entry
  * @ioc: per adapter object
  * @smid: system request message index
  *
@@ -832,6 +832,28 @@ _scsih_scsi_lookup_get(struct MPT2SAS_AD
 }
 
 /**
+ * _scsih_scsi_lookup_get_clear - returns scmd entry
+ * @ioc: per adapter object
+ * @smid: system request message index
+ *
+ * Returns the smid stored scmd pointer.
+ * Then will derefrence the stored scmd pointer.
+ */
+static inline struct scsi_cmnd *
+_scsih_scsi_lookup_get_clear(struct MPT2SAS_ADAPTER *ioc, u16 smid)
+{
+	unsigned long flags;
+	struct scsi_cmnd *scmd;
+
+	spin_lock_irqsave(&ioc->scsi_lookup_lock, flags);
+	scmd = ioc->scsi_lookup[smid - 1].scmd;
+	ioc->scsi_lookup[smid - 1].scmd = NULL;
+	spin_unlock_irqrestore(&ioc->scsi_lookup_lock, flags);
+
+	return scmd;
+}
+
+/**
  * _scsih_scsi_lookup_find_by_scmd - scmd lookup
  * @ioc: per adapter object
  * @smid: system request message index
@@ -3183,7 +3205,7 @@ _scsih_flush_running_cmds(struct MPT2SAS
 	u16 count = 0;
 
 	for (smid = 1; smid <= ioc->scsiio_depth; smid++) {
-		scmd = _scsih_scsi_lookup_get(ioc, smid);
+		scmd = _scsih_scsi_lookup_get_clear(ioc, smid);
 		if (!scmd)
 			continue;
 		count++;
@@ -3777,7 +3799,7 @@ _scsih_io_done(struct MPT2SAS_ADAPTER *i
 	u32 response_code = 0;
 
 	mpi_reply = mpt2sas_base_get_reply_virt_addr(ioc, reply);
-	scmd = _scsih_scsi_lookup_get(ioc, smid);
+	scmd = _scsih_scsi_lookup_get_clear(ioc, smid);
 	if (scmd == NULL)
 		return 1;
 
@@ -5039,6 +5061,7 @@ _scsih_sas_broadcast_primative_event(str
     struct fw_event_work *fw_event)
 {
 	struct scsi_cmnd *scmd;
+	struct scsi_device *sdev;
 	u16 smid, handle;
 	u32 lun;
 	struct MPT2SAS_DEVICE *sas_device_priv_data;
@@ -5049,12 +5072,17 @@ _scsih_sas_broadcast_primative_event(str
 	Mpi2EventDataSasBroadcastPrimitive_t *event_data = fw_event->event_data;
 #endif
 	u16 ioc_status;
+	unsigned long flags;
+	int r;
+
 	dewtprintk(ioc, printk(MPT2SAS_INFO_FMT "broadcast primative: "
 	    "phy number(%d), width(%d)\n", ioc->name, event_data->PhyNum,
 	    event_data->PortWidth));
 	dtmprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: enter\n", ioc->name,
 	    __func__));
 
+	spin_lock_irqsave(&ioc->scsi_lookup_lock, flags);
+	ioc->broadcast_aen_busy = 0;
 	termination_count = 0;
 	query_count = 0;
 	mpi_reply = ioc->tm_cmds.reply;
@@ -5062,7 +5090,8 @@ _scsih_sas_broadcast_primative_event(str
 		scmd = _scsih_scsi_lookup_get(ioc, smid);
 		if (!scmd)
 			continue;
-		sas_device_priv_data = scmd->device->hostdata;
+		sdev = scmd->device;
+		sas_device_priv_data = sdev->hostdata;
 		if (!sas_device_priv_data || !sas_device_priv_data->sas_target)
 			continue;
 		 /* skip hidden raid components */
@@ -5078,6 +5107,7 @@ _scsih_sas_broadcast_primative_event(str
 		lun = sas_device_priv_data->lun;
 		query_count++;
 
+		spin_unlock_irqrestore(&ioc->scsi_lookup_lock, flags);
 		mpt2sas_scsih_issue_tm(ioc, handle, 0, 0, lun,
 		    MPI2_SCSITASKMGMT_TASKTYPE_QUERY_TASK, smid, 30, NULL);
 		ioc->tm_cmds.status = MPT2_CMD_NOT_USED;
@@ -5087,14 +5117,20 @@ _scsih_sas_broadcast_primative_event(str
 		    (mpi_reply->ResponseCode ==
 		     MPI2_SCSITASKMGMT_RSP_TM_SUCCEEDED ||
 		     mpi_reply->ResponseCode ==
-		     MPI2_SCSITASKMGMT_RSP_IO_QUEUED_ON_IOC))
+		     MPI2_SCSITASKMGMT_RSP_IO_QUEUED_ON_IOC)) {
+			spin_lock_irqsave(&ioc->scsi_lookup_lock, flags);
 			continue;
-
-		mpt2sas_scsih_issue_tm(ioc, handle, 0, 0, lun,
-		    MPI2_SCSITASKMGMT_TASKTYPE_ABRT_TASK_SET, 0, 30, NULL);
+		}
+		r = mpt2sas_scsih_issue_tm(ioc, handle, sdev->channel, sdev->id,
+		    sdev->lun, MPI2_SCSITASKMGMT_TASKTYPE_ABORT_TASK, smid, 30,
+		    scmd);
+		if (r == FAILED)
+			sdev_printk(KERN_WARNING, sdev, "task abort: FAILED "
+			    "scmd(%p)\n", scmd);
 		termination_count += le32_to_cpu(mpi_reply->TerminationCount);
+		spin_lock_irqsave(&ioc->scsi_lookup_lock, flags);
 	}
-	ioc->broadcast_aen_busy = 0;
+	spin_unlock_irqrestore(&ioc->scsi_lookup_lock, flags);
 
 	dtmprintk(ioc, printk(MPT2SAS_INFO_FMT
 	    "%s - exit, query_count = %d termination_count = %d\n",
author
#76 lore raw

PATCH 76/272 mpt2sas: Correct resizing calculation for max_queue_depth

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Kashyap, Desai <[email protected]>

commit 11e1b961ab067ee3acaf723531da4d3f23e1d6f7 upstream.

The ioc->hba_queue_depth is not properly resized when the controller firmware reports that it supports more outstanding IO than what can be fit inside the reply descriptor pool depth. This is reproduced by setting the controller global credits larger than 30,000. The bug results in an incorrect sizing of the queues. The fix is to resize the queue_size by dividing queue_diff by two.

---
 drivers/scsi/mpt2sas/mpt2sas_base.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/scsi/mpt2sas/mpt2sas_base.c +3 -3
@@ -2057,9 +2057,9 @@ _base_allocate_memory_pools(struct MPT2S
 		/* adjust hba_queue_depth, reply_free_queue_depth,
 		 * and queue_size
 		 */
-		ioc->hba_queue_depth -= queue_diff;
-		ioc->reply_free_queue_depth -= queue_diff;
-		queue_size -= queue_diff;
+		ioc->hba_queue_depth -= (queue_diff / 2);
+		ioc->reply_free_queue_depth -= (queue_diff / 2);
+		queue_size = facts->MaxReplyDescriptorPostQueueDepth;
 	}
 	ioc->reply_post_queue_depth = queue_size;
 
author
#77 lore raw

PATCH 77/272 mpt2sas: add missing initialization of scsih_cmds

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Kashyap, Desai <[email protected]>

commit d685c262083dcd5fd98b7499b22a377a3225229c upstream.

Internal command scsih_cmds init is included in mpt2sas_base_attach.

---
 drivers/scsi/mpt2sas/mpt2sas_base.c |    5 +++++
 1 file changed, 5 insertions(+)
drivers/scsi/mpt2sas/mpt2sas_base.c +5 -0
@@ -3662,6 +3662,11 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPT
 	ioc->scsih_cmds.status = MPT2_CMD_NOT_USED;
 	mutex_init(&ioc->scsih_cmds.mutex);
 
+	/* scsih internal command bits */
+	ioc->scsih_cmds.reply = kzalloc(ioc->reply_sz, GFP_KERNEL);
+	ioc->scsih_cmds.status = MPT2_CMD_NOT_USED;
+	mutex_init(&ioc->scsih_cmds.mutex);
+
 	/* task management internal command bits */
 	ioc->tm_cmds.reply = kzalloc(ioc->reply_sz, GFP_KERNEL);
 	ioc->tm_cmds.status = MPT2_CMD_NOT_USED;
author
#78 lore raw

PATCH 78/272 mpt2sas: Kernel Panic during Large Topology discovery

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Kashyap, Desai <[email protected]>

commit 4224489f45b503f0a1f1cf310f76dc108f45689a upstream.

There was a configuration page timing out during the initial port enable at driver load time. The port enable would fail, and this would result in the driver unloading itself, meanwhile the driver was accessing freed memory in another context resulting in the panic. The fix is to prevent access to freed memory once the driver had issued the diag reset which woke up the sleeping port enable process. The routine _base_reset_handler was reorganized so the last sleeping process woken up was the port_enable.

---
 drivers/scsi/mpt2sas/mpt2sas_base.c |   13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/scsi/mpt2sas/mpt2sas_base.c +11 -2
@@ -3791,6 +3791,8 @@ mpt2sas_base_detach(struct MPT2SAS_ADAPT
 static void
 _base_reset_handler(struct MPT2SAS_ADAPTER *ioc, int reset_phase)
 {
+	mpt2sas_scsih_reset_handler(ioc, reset_phase);
+	mpt2sas_ctl_reset_handler(ioc, reset_phase);
 	switch (reset_phase) {
 	case MPT2_IOC_PRE_RESET:
 		dtmprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: "
@@ -3821,8 +3823,6 @@ _base_reset_handler(struct MPT2SAS_ADAPT
 		    "MPT2_IOC_DONE_RESET\n", ioc->name, __func__));
 		break;
 	}
-	mpt2sas_scsih_reset_handler(ioc, reset_phase);
-	mpt2sas_ctl_reset_handler(ioc, reset_phase);
 }
 
 /**
@@ -3876,6 +3876,7 @@ mpt2sas_base_hard_reset_handler(struct M
 {
 	int r;
 	unsigned long flags;
+	u8 pe_complete = ioc->wait_for_port_enable_to_complete;
 
 	dtmprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: enter\n", ioc->name,
 	    __func__));
@@ -3918,6 +3919,14 @@ mpt2sas_base_hard_reset_handler(struct M
 	if (r)
 		goto out;
 	_base_reset_handler(ioc, MPT2_IOC_AFTER_RESET);
+
+	/* If this hard reset is called while port enable is active, then
+	 * there is no reason to call make_ioc_operational
+	 */
+	if (pe_complete) {
+		r = -EFAULT;
+		goto out;
+	}
 	r = _base_make_ioc_operational(ioc, sleep_flag);
 	if (!r)
 		_base_reset_handler(ioc, MPT2_IOC_DONE_RESET);
author
#79 lore raw

PATCH 79/272 e1000: fix return value not set on error

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Dean Nelson <[email protected]>

commit 19a0b67afd174c4db261d587b5c67704dcd53c17 upstream.

Dean noticed that 'err' wasn't being set when the "goto err_dma" statement is executed in the following hunk from the commit. It's value will be zero as a result of a successful call to e1000_init_hw_struct().

This patch changes the error condition to be correctly propagated.

---
 drivers/net/e1000/e1000_main.c |   10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/net/e1000/e1000_main.c +6 -4
@@ -971,11 +971,13 @@ static int __devinit e1000_probe(struct
 		 */
 		dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(64));
 		pci_using_dac = 1;
-	} else if (!dma_set_mask(&pdev->dev, DMA_BIT_MASK(32))) {
-		dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
 	} else {
-		pr_err("No usable DMA config, aborting\n");
-		goto err_dma;
+		err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32));
+		if (err) {
+			pr_err("No usable DMA config, aborting\n");
+			goto err_dma;
+		}
+		dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
 	}
 
 	netdev->netdev_ops = &e1000_netdev_ops;
author
#80 lore raw

PATCH 80/272 cfg80211: pass the reg hint initiator to helpers

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Luis R. Rodriguez <[email protected]>

commit 7ca43d03b1291481bdf894bbaec5d580e7684e7d upstream.

This is required later.

---
 net/wireless/reg.c |   12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)
net/wireless/reg.c +8 -4
@@ -720,7 +720,9 @@ EXPORT_SYMBOL(freq_reg_info);
  * on the wiphy with the target_bw specified. Then we can simply use
  * that below for the desired_bw_khz below.
  */
-static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
+static void handle_channel(struct wiphy *wiphy,
+			   enum nl80211_reg_initiator initiator,
+			   enum ieee80211_band band,
 			   unsigned int chan_idx)
 {
 	int r;
@@ -784,7 +786,9 @@ static void handle_channel(struct wiphy
 		chan->max_power = (int) MBM_TO_DBM(power_rule->max_eirp);
 }
 
-static void handle_band(struct wiphy *wiphy, enum ieee80211_band band)
+static void handle_band(struct wiphy *wiphy,
+			enum ieee80211_band band,
+			enum nl80211_reg_initiator initiator)
 {
 	unsigned int i;
 	struct ieee80211_supported_band *sband;
@@ -793,7 +797,7 @@ static void handle_band(struct wiphy *wi
 	sband = wiphy->bands[band];
 
 	for (i = 0; i < sband->n_channels; i++)
-		handle_channel(wiphy, band, i);
+		handle_channel(wiphy, initiator, band, i);
 }
 
 static bool ignore_reg_update(struct wiphy *wiphy,
@@ -1030,7 +1034,7 @@ void wiphy_update_regulatory(struct wiph
 		goto out;
 	for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 		if (wiphy->bands[band])
-			handle_band(wiphy, band);
+			handle_band(wiphy, band, initiator);
 	}
 out:
 	reg_process_beacons(wiphy);
author
#81 lore raw

PATCH 81/272 cfg80211: fix allowing country IEs for WIPHY_FLAG_STRICT_REGULATORY

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Luis R. Rodriguez <[email protected]>

commit 749b527b21465fb079796c03ffb4302584dc31c1 upstream.

We should be enabling country IE hints for WIPHY_FLAG_STRICT_REGULATORY even if we haven't yet recieved regulatory domain hint for the driver if it needed one. Without this Country IEs are not passed on to drivers that have set WIPHY_FLAG_STRICT_REGULATORY, today this is just all Atheros chipset drivers: ath5k, ath9k, ar9170, carl9170.

This was part of the original design, however it was completely overlooked...

---
 include/net/cfg80211.h |   15 ++++++++-------
 net/wireless/reg.c     |    1 +
 2 files changed, 9 insertions(+), 7 deletions(-)
include/net/cfg80211.h +8 -7
@@ -1321,13 +1321,14 @@ struct cfg80211_ops {
  * 	initiator is %REGDOM_SET_BY_CORE).
  * @WIPHY_FLAG_STRICT_REGULATORY: tells us the driver for this device will
  *	ignore regulatory domain settings until it gets its own regulatory
- *	domain via its regulatory_hint(). After its gets its own regulatory
- *	domain it will only allow further regulatory domain settings to
- *	further enhance compliance. For example if channel 13 and 14 are
- *	disabled by this regulatory domain no user regulatory domain can
- *	enable these channels at a later time. This can be used for devices
- *	which do not have calibration information gauranteed for frequencies
- *	or settings outside of its regulatory domain.
+ *	domain via its regulatory_hint() unless the regulatory hint is
+ *	from a country IE. After its gets its own regulatory domain it will
+ *	only allow further regulatory domain settings to further enhance
+ *	compliance. For example if channel 13 and 14 are disabled by this
+ *	regulatory domain no user regulatory domain can enable these channels
+ *	at a later time. This can be used for devices which do not have
+ *	calibration information guaranteed for frequencies or settings
+ *	outside of its regulatory domain.
  * @WIPHY_FLAG_DISABLE_BEACON_HINTS: enable this if your driver needs to ensure
  *	that passive scan flags and beaconing flags may not be lifted by
  *	cfg80211 due to regulatory beacon hints. For more information on beacon
net/wireless/reg.c +1 -0
@@ -813,6 +813,7 @@ static bool ignore_reg_update(struct wip
 	 * desired regulatory domain set
 	 */
 	if (wiphy->flags & WIPHY_FLAG_STRICT_REGULATORY && !wiphy->regd &&
+	    initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
 	    !is_world_regdom(last_request->alpha2))
 		return true;
 	return false;
author
#82 lore raw

PATCH 82/272 cfg80211: fix disabling channels based on hints

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Luis R. Rodriguez <[email protected]>

commit ca4ffe8f2848169a8ded0ea8a60b2d81925564c9 upstream.

After a module loads you will have loaded the world roaming regulatory domain or a custom regulatory domain. Further regulatory hints are welcomed and should be respected unless the regulatory hint is coming from a country IE as the IEEE spec allows for a country IE to be a subset of what is allowed by the local regulatory agencies.

So disable all channels that do not fit a regulatory domain sent from a unless the hint is from a country IE and the country IE had no information about the band we are currently processing.

This fixes a few regulatory issues, for example for drivers that depend on CRDA and had no 5 GHz freqencies allowed were not properly disabling 5 GHz at all, furthermore it also allows users to restrict devices further as was intended.

If you recieve a country IE upon association we will also disable the channels that are not allowed if the country IE had at least one channel on the respective band we are procesing.

This was the original intention behind this design but it was completely overlooked...

---
 include/linux/nl80211.h |    6 +++++-
 net/wireless/reg.c      |   20 +++++++++++++++++++-
 2 files changed, 24 insertions(+), 2 deletions(-)
include/linux/nl80211.h +5 -1
@@ -1307,7 +1307,11 @@ enum nl80211_bitrate_attr {
  * 	wireless core it thinks its knows the regulatory domain we should be in.
  * @NL80211_REGDOM_SET_BY_COUNTRY_IE: the wireless core has received an
  * 	802.11 country information element with regulatory information it
- * 	thinks we should consider.
+ * 	thinks we should consider. cfg80211 only processes the country
+ *	code from the IE, and relies on the regulatory domain information
+ *	structure pased by userspace (CRDA) from our wireless-regdb.
+ *	If a channel is enabled but the country code indicates it should
+ *	be disabled we disable the channel and re-enable it upon disassociation.
  */
 enum nl80211_reg_initiator {
 	NL80211_REGDOM_SET_BY_CORE,
net/wireless/reg.c +19 -1
@@ -750,8 +750,26 @@ static void handle_channel(struct wiphy
 			  desired_bw_khz,
 			  &reg_rule);
 
-	if (r)
+	if (r) {
+		/*
+		 * We will disable all channels that do not match our
+		 * recieved regulatory rule unless the hint is coming
+		 * from a Country IE and the Country IE had no information
+		 * about a band. The IEEE 802.11 spec allows for an AP
+		 * to send only a subset of the regulatory rules allowed,
+		 * so an AP in the US that only supports 2.4 GHz may only send
+		 * a country IE with information for the 2.4 GHz band
+		 * while 5 GHz is still supported.
+		 */
+		if (initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE &&
+		    r == -ERANGE)
+			return;
+
+		REG_DBG_PRINT("cfg80211: Disabling freq %d MHz\n",
+			      chan->center_freq);
+		chan->flags = IEEE80211_CHAN_DISABLED;
 		return;
+	}
 
 	power_rule = &reg_rule->power_rule;
 	freq_range = &reg_rule->freq_range;
author
#83 lore raw

PATCH 83/272 radio-aimslab.c: Fix gcc 4.5+ bug

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Mauro Carvalho Chehab <[email protected]>

commit e3c92215198cb6aa00ad38db2780faa6b72e0a3f upstream.

gcc 4.5+ doesn't properly evaluate some inlined expressions. A previous patch were proposed by Andrew Morton using noinline. However, the entire inlined function is bogus, so let's just remove it and be happy.

---
 drivers/media/radio/radio-aimslab.c |   23 ++++++-----------------
 1 file changed, 6 insertions(+), 17 deletions(-)
drivers/media/radio/radio-aimslab.c +6 -17
@@ -31,7 +31,6 @@
 #include <linux/module.h>	/* Modules 			*/
 #include <linux/init.h>		/* Initdata			*/
 #include <linux/ioport.h>	/* request_region		*/
-#include <linux/delay.h>	/* udelay			*/
 #include <linux/videodev2.h>	/* kernel radio structs		*/
 #include <linux/version.h>	/* for KERNEL_VERSION MACRO	*/
 #include <linux/io.h>		/* outb, outb_p			*/
@@ -71,27 +70,17 @@ static struct rtrack rtrack_card;
 
 /* local things */
 
-static void sleep_delay(long n)
-{
-	/* Sleep nicely for 'n' uS */
-	int d = n / msecs_to_jiffies(1000);
-	if (!d)
-		udelay(n);
-	else
-		msleep(jiffies_to_msecs(d));
-}
-
 static void rt_decvol(struct rtrack *rt)
 {
 	outb(0x58, rt->io);		/* volume down + sigstr + on	*/
-	sleep_delay(100000);
+	msleep(100);
 	outb(0xd8, rt->io);		/* volume steady + sigstr + on	*/
 }
 
 static void rt_incvol(struct rtrack *rt)
 {
 	outb(0x98, rt->io);		/* volume up + sigstr + on	*/
-	sleep_delay(100000);
+	msleep(100);
 	outb(0xd8, rt->io);		/* volume steady + sigstr + on	*/
 }
 
@@ -120,7 +109,7 @@ static int rt_setvol(struct rtrack *rt,
 
 	if (vol == 0) {			/* volume = 0 means mute the card */
 		outb(0x48, rt->io);	/* volume down but still "on"	*/
-		sleep_delay(2000000);	/* make sure it's totally down	*/
+		msleep(2000);	/* make sure it's totally down	*/
 		outb(0xd0, rt->io);	/* volume steady, off		*/
 		rt->curvol = 0;		/* track the volume state!	*/
 		mutex_unlock(&rt->lock);
@@ -155,7 +144,7 @@ static void send_0_byte(struct rtrack *r
 		outb_p(128+64+16+8+  1, rt->io);  /* on + wr-enable + data low */
 		outb_p(128+64+16+8+2+1, rt->io);  /* clock */
 	}
-	sleep_delay(1000);
+	msleep(1);
 }
 
 static void send_1_byte(struct rtrack *rt)
@@ -169,7 +158,7 @@ static void send_1_byte(struct rtrack *r
 		outb_p(128+64+16+8+4+2+1, rt->io); /* clock */
 	}
 
-	sleep_delay(1000);
+	msleep(1);
 }
 
 static int rt_setfreq(struct rtrack *rt, unsigned long freq)
@@ -420,7 +409,7 @@ static int __init rtrack_init(void)
 
 	/* this ensures that the volume is all the way down  */
 	outb(0x48, rt->io);		/* volume down but still "on"	*/
-	sleep_delay(2000000);	/* make sure it's totally down	*/
+	msleep(2000);	/* make sure it's totally down	*/
 	outb(0xc0, rt->io);		/* steady volume, mute card	*/
 
 	if (video_register_device(&rt->vdev, VFL_TYPE_RADIO, radio_nr) < 0) {
author
#84 lore raw

PATCH 84/272 em28xx: Fix audio input for Terratec Grabby

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Mauro Carvalho Chehab <[email protected]>

commit a3fa904ec79b94f0db7faed010ff94d42f7d1d47 upstream.

The audio input line was wrong. Fix it.

---
 drivers/media/video/em28xx/em28xx-cards.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/video/em28xx/em28xx-cards.c +2 -2
@@ -1633,11 +1633,11 @@ struct em28xx_board em28xx_boards[] = {
 		.input           = { {
 			.type     = EM28XX_VMUX_COMPOSITE1,
 			.vmux     = SAA7115_COMPOSITE0,
-			.amux     = EM28XX_AMUX_VIDEO2,
+			.amux     = EM28XX_AMUX_LINE_IN,
 		}, {
 			.type     = EM28XX_VMUX_SVIDEO,
 			.vmux     = SAA7115_SVIDEO3,
-			.amux     = EM28XX_AMUX_VIDEO2,
+			.amux     = EM28XX_AMUX_LINE_IN,
 		} },
 	},
 	[EM2860_BOARD_TERRATEC_AV350] = {
author
#85 lore raw

PATCH 85/272 IX2505V: i2c transfer error code ignored

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Matthias Schwarzott <[email protected]>

commit 13d28e4917fb6cf6898e8998f01ab83b3f468aeb upstream.

It seems that ix2505v driver ignores a i2c error in ix2505v_read_status_reg. This looks like a typing error using (ret = 1) instead of correct (ret == 1).

---
 drivers/media/dvb/frontends/ix2505v.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/dvb/frontends/ix2505v.c +1 -1
@@ -72,7 +72,7 @@ static int ix2505v_read_status_reg(struc
 	ret = i2c_transfer(state->i2c, msg, 1);
 	deb_i2c("Read %s ", __func__);
 
-	return (ret = 1) ? (int) b2[0] : -1;
+	return (ret == 1) ? (int) b2[0] : -1;
 }
 
 static int ix2505v_write(struct ix2505v_state *state, u8 buf[], u8 count)
author
#86 lore raw

PATCH 86/272 ALSA: hda - Add missing NID 0x19 fixup for Sony VAIO

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Takashi Iwai <[email protected]>

commit 700b65cee958d81b16c48378d5759c46d01e24d0 upstream.

With GPIO2-fixup, another fixup for NID 0x19 was missing because the fixup is applied only once. Add the corresponding verb to the entry.

---
 sound/pci/hda/patch_realtek.c |    1 +
 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -14824,6 +14824,7 @@ static const struct alc_fixup alc269_fix
 			{0x01, AC_VERB_SET_GPIO_MASK, 0x04},
 			{0x01, AC_VERB_SET_GPIO_DIRECTION, 0x04},
 			{0x01, AC_VERB_SET_GPIO_DATA, 0x00},
+			{0x19, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_VREFGRD},
 			{ }
 		}
 	},
author
#87 lore raw

PATCH 87/272 ALSA: hda - Dont refer ELD when unplugged

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Takashi Iwai <[email protected]>

commit 6661702f2e803b55b50cc0471eb6b9254e99eef2 upstream.

When unplugged, we shouldn't refer to ELD information for PCM open any more.

---
 sound/pci/hda/patch_hdmi.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/hda/patch_hdmi.c +1 -1
@@ -827,7 +827,7 @@ static int hdmi_pcm_open(struct hda_pcm_
 		*codec_pars = *hinfo;
 
 	eld = &spec->sink_eld[idx];
-	if (eld->sad_count > 0) {
+	if (eld->eld_valid && eld->sad_count > 0) {
 		hdmi_eld_update_pcm_info(eld, hinfo, codec_pars);
 		if (hinfo->channels_min > hinfo->channels_max ||
 		    !hinfo->rates || !hinfo->formats)
author
#88 lore raw

PATCH 88/272 ALSA: hda - Fix NULL-derefence with a single mic in STAC auto-mic detection

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Takashi Iwai <[email protected]>

commit 80c678526d7da73bde4d46a4622449c2b3c88409 upstream.

When only one mic is available and it's an analog mic, the current IDT/STAC parser may give an Oops.

Reference: bko#25692

	https://bugzilla.kernel.org/show_bug.cgi?id=25692
---
 sound/pci/hda/patch_sigmatel.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/hda/patch_sigmatel.c +1 -1
@@ -3591,7 +3591,7 @@ static int stac_check_auto_mic(struct hd
 		if (check_mic_pin(codec, spec->dmic_nids[i],
 		    &fixed, &ext, &dock))
 			return 0;
-	if (!fixed && !ext && !dock)
+	if (!fixed || (!ext && !dock))
 		return 0; /* no input to switch */
 	if (!(get_wcaps(codec, ext) & AC_WCAP_UNSOL_CAP))
 		return 0; /* no unsol support */
author
#89 lore raw

PATCH 89/272 ALSA: hda - Fix multi-headphone handling for Realtek codecs

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Takashi Iwai <[email protected]>

commit b2d0576055bd1cafcd91a23cf85064815f1396cd upstream.

When multiple headphone pins are defined without line-out pins, the driver takes them as primary outputs. But it forgot to set line_out_type to HP by assuming there is some rest of HP pins. This results in some mis-handling of these pins for Realtek codec parser. It takes as if these are pure line-out jacks.

---
 sound/pci/hda/hda_codec.c |    3 +++
 1 file changed, 3 insertions(+)
sound/pci/hda/hda_codec.c +3 -0
@@ -4571,6 +4571,9 @@ int snd_hda_parse_pin_def_config(struct
 		}
 		memset(cfg->hp_pins + cfg->hp_outs, 0,
 		       sizeof(hda_nid_t) * (AUTO_CFG_MAX_OUTS - cfg->hp_outs));
+		if (!cfg->hp_outs)
+			cfg->line_out_type = AUTO_PIN_HP_OUT;
+
 	}
 
 	/* sort by sequence */
author
#90 lore raw

PATCH 90/272 ALSA: hda: Use vostro model quirk for Dell Vostro 1014

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Daniel T Chen <[email protected]>

commit ca6cd851d7d22767d68b674590d836f468d1913a upstream.

A user reported on the alsa-devel mailing list that he needs to use the vostro model quirk to have audible playback, so apply it for his PCI SSID.

---
 sound/pci/hda/patch_conexant.c |    1 +
 1 file changed, 1 insertion(+)
sound/pci/hda/patch_conexant.c +1 -0
@@ -3097,6 +3097,7 @@ static struct snd_pci_quirk cxt5066_cfg_
 	SND_PCI_QUIRK_MASK(0x1025, 0xff00, 0x0400, "Acer", CXT5066_IDEAPAD),
 	SND_PCI_QUIRK(0x1028, 0x02d8, "Dell Vostro", CXT5066_DELL_VOSTRO),
 	SND_PCI_QUIRK(0x1028, 0x02f5, "Dell Vostro 320", CXT5066_IDEAPAD),
+	SND_PCI_QUIRK(0x1028, 0x0401, "Dell Vostro 1014", CXT5066_DELL_VOSTRO),
 	SND_PCI_QUIRK(0x1028, 0x0402, "Dell Vostro", CXT5066_DELL_VOSTRO),
 	SND_PCI_QUIRK(0x1028, 0x0408, "Dell Inspiron One 19T", CXT5066_IDEAPAD),
 	SND_PCI_QUIRK(0x103c, 0x360b, "HP G60", CXT5066_HP_LAPTOP),
author
#91 lore raw

PATCH 91/272 ALSA: hda: Disable 4/6 channels on some NVIDIA GPUs.

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Nitin Daga <[email protected]>

commit 393004b2ea49524ee41a562cae8db67f50f372a5 upstream.

Added hardware constraint in patch_hdmi.c to disable channels 4/6 which are not supported by some older NVIDIA GPUs.

---
 sound/pci/hda/patch_hdmi.c |   42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)
sound/pci/hda/patch_hdmi.c +42 -0
@@ -1165,11 +1165,53 @@ static int nvhdmi_7x_init(struct hda_cod
 	return 0;
 }
 
+static unsigned int channels_2_6_8[] = {
+	2, 6, 8
+};
+
+static unsigned int channels_2_8[] = {
+	2, 8
+};
+
+static struct snd_pcm_hw_constraint_list hw_constraints_2_6_8_channels = {
+	.count = ARRAY_SIZE(channels_2_6_8),
+	.list = channels_2_6_8,
+	.mask = 0,
+};
+
+static struct snd_pcm_hw_constraint_list hw_constraints_2_8_channels = {
+	.count = ARRAY_SIZE(channels_2_8),
+	.list = channels_2_8,
+	.mask = 0,
+};
+
 static int simple_playback_pcm_open(struct hda_pcm_stream *hinfo,
 				    struct hda_codec *codec,
 				    struct snd_pcm_substream *substream)
 {
 	struct hdmi_spec *spec = codec->spec;
+	struct snd_pcm_hw_constraint_list *hw_constraints_channels = NULL;
+
+	switch (codec->preset->id) {
+	case 0x10de0002:
+	case 0x10de0003:
+	case 0x10de0005:
+	case 0x10de0006:
+		hw_constraints_channels = &hw_constraints_2_8_channels;
+		break;
+	case 0x10de0007:
+		hw_constraints_channels = &hw_constraints_2_6_8_channels;
+		break;
+	default:
+		break;
+	}
+
+	if (hw_constraints_channels != NULL) {
+		snd_pcm_hw_constraint_list(substream->runtime, 0,
+				SNDRV_PCM_HW_PARAM_CHANNELS,
+				hw_constraints_channels);
+	}
+
 	return snd_hda_multi_out_dig_open(codec, &spec->multiout);
 }
 
author
#92 lore raw

PATCH 92/272 ALSA: hda - Add static_hdmi_pcm option to HDMI codec parser

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Takashi Iwai <[email protected]>

commit 0ebaa24c6b1f62839bcd12d63fa76e3cf23b9bd0 upstream.

The dynamic PCM restriction based on ELD information may lead to the problem in some cases, e.g. when the receiver is turned off. Then it may send a TV HDMI default such as channels = 2. Since it's still plugged, the driver doesn't know whether it's the right configuration for future use. Now, when an app opens the device at this moment, then turn on the receiver, the app still sends channels=2.

The right solution is to implement some kind of notification and automatic re-open mechanism. But, this is a goal far ahead.

This patch provides a workaround for such a case by providing a new module option static_hdmi_pcm for snd-hda-codec-hdmi module. When this is set to true, the driver doesn't change PCM parameters per ELD information. For users who need the static configuration like the scenario above, set this to true.

The parameter can be changed dynamically via sysfs, too.

---
 sound/pci/hda/patch_hdmi.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)
sound/pci/hda/patch_hdmi.c +6 -1
@@ -31,10 +31,15 @@
 #include <linux/init.h>
 #include <linux/delay.h>
 #include <linux/slab.h>
+#include <linux/moduleparam.h>
 #include <sound/core.h>
 #include "hda_codec.h"
 #include "hda_local.h"
 
+static bool static_hdmi_pcm;
+module_param(static_hdmi_pcm, bool, 0644);
+MODULE_PARM_DESC(static_hdmi_pcm, "Don't restrict PCM parameters per ELD info");
+
 /*
  * The HDMI/DisplayPort configuration can be highly dynamic. A graphics device
  * could support two independent pipes, each of them can be connected to one or
@@ -827,7 +832,7 @@ static int hdmi_pcm_open(struct hda_pcm_
 		*codec_pars = *hinfo;
 
 	eld = &spec->sink_eld[idx];
-	if (eld->eld_valid && eld->sad_count > 0) {
+	if (!static_hdmi_pcm && eld->eld_valid && eld->sad_count > 0) {
 		hdmi_eld_update_pcm_info(eld, hinfo, codec_pars);
 		if (hinfo->channels_min > hinfo->channels_max ||
 		    !hinfo->rates || !hinfo->formats)
author
#93 lore raw

PATCH 93/272 ALSA : au88x0 - Limit number of channels to fix Oops via OSS emu

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Raymond Yau <[email protected]>

commit d9ab344336f74c012f6643ed3d1ad8ca0136de3b upstream.

Fix playback/capture channels patch to change supported playback channels of au8830 to 1,2,4 and capture channels to 1,2. This prevent oops when oss emulation use SNDCTL_DSP_CHANNELS to set 3 Channels

---
 sound/pci/au88x0/au88x0_pcm.c |   24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)
sound/pci/au88x0/au88x0_pcm.c +20 -4
@@ -42,11 +42,7 @@ static struct snd_pcm_hardware snd_vorte
 	.rate_min = 5000,
 	.rate_max = 48000,
 	.channels_min = 1,
-#ifdef CHIP_AU8830
-	.channels_max = 4,
-#else
 	.channels_max = 2,
-#endif
 	.buffer_bytes_max = 0x10000,
 	.period_bytes_min = 0x1,
 	.period_bytes_max = 0x1000,
@@ -115,6 +111,17 @@ static struct snd_pcm_hardware snd_vorte
 	.periods_max = 64,
 };
 #endif
+#ifdef CHIP_AU8830
+static unsigned int au8830_channels[3] = {
+	1, 2, 4,
+};
+
+static struct snd_pcm_hw_constraint_list hw_constraints_au8830_channels = {
+	.count = ARRAY_SIZE(au8830_channels),
+	.list = au8830_channels,
+	.mask = 0,
+};
+#endif
 /* open callback */
 static int snd_vortex_pcm_open(struct snd_pcm_substream *substream)
 {
@@ -156,6 +163,15 @@ static int snd_vortex_pcm_open(struct sn
 		if (VORTEX_PCM_TYPE(substream->pcm) == VORTEX_PCM_ADB
 		    || VORTEX_PCM_TYPE(substream->pcm) == VORTEX_PCM_I2S)
 			runtime->hw = snd_vortex_playback_hw_adb;
+#ifdef CHIP_AU8830
+		if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK &&
+			VORTEX_PCM_TYPE(substream->pcm) == VORTEX_PCM_ADB) {
+			runtime->hw.channels_max = 4;
+			snd_pcm_hw_constraint_list(runtime, 0,
+				SNDRV_PCM_HW_PARAM_CHANNELS,
+				&hw_constraints_au8830_channels);
+		}
+#endif
 		substream->runtime->private_data = NULL;
 	}
 #ifndef CHIP_AU8810
author
#94 lore raw

PATCH 94/272 ALSA: fix invalid hardware.h include in ac97c for AVR32 architecture

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Hans-Christian Egtvedt <[email protected]>

commit fd76804f3f5484b35e6a51214c91e916ebba05aa upstream.

This patch fixes the non-compiling AC97C driver for AVR32 architecture by include mach/hardware.h only for AT91 architecture. The AVR32 architecture does not supply the hardware.h include file.

---
 sound/atmel/ac97c.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
sound/atmel/ac97c.c +4 -1
@@ -33,9 +33,12 @@
 #include <linux/dw_dmac.h>
 
 #include <mach/cpu.h>
-#include <mach/hardware.h>
 #include <mach/gpio.h>
 
+#ifdef CONFIG_ARCH_AT91
+#include <mach/hardware.h>
+#endif
+
 #include "ac97c.h"
 
 enum {
author
#95 lore raw

PATCH 95/272 ALSA: HDA: Fix dmesg output of HDMI supported bits

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: David Henningsson <[email protected]>

commit d757534ed15387202e322854cd72dc58bbb975de upstream.

This typo caused the dmesg output of the supported bits of HDMI to be cut off early.

---
 sound/pci/hda/hda_eld.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/hda/hda_eld.c +1 -1
@@ -381,7 +381,7 @@ static void hdmi_show_short_audio_desc(s
 	snd_print_pcm_rates(a->rates, buf, sizeof(buf));
 
 	if (a->format == AUDIO_CODING_TYPE_LPCM)
-		snd_print_pcm_bits(a->sample_bits, buf2 + 8, sizeof(buf2 - 8));
+		snd_print_pcm_bits(a->sample_bits, buf2 + 8, sizeof(buf2) - 8);
 	else if (a->max_bitrate)
 		snprintf(buf2, sizeof(buf2),
 				", max bitrate = %d", a->max_bitrate);
author
#96 lore raw

PATCH 96/272 ALSA: hda - Fix memory leaks in conexant jack arrays

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Takashi Iwai <[email protected]>

commit 70f7db11c45a313b23922cacf248c613c3b2144c upstream.

The Conexant codec driver adds the jack arrays in init callback which may be called also in each PM resume. This results in the addition of new jack element at each time.

The fix is to check whether the requested jack is already present in the array.

Reference: Novell bug 668929

	https://bugzilla.novell.com/show_bug.cgi?id=668929
---
 sound/pci/hda/patch_conexant.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)
sound/pci/hda/patch_conexant.c +7 -1
@@ -403,10 +403,16 @@ static int conexant_add_jack(struct hda_
 	struct conexant_spec *spec;
 	struct conexant_jack *jack;
 	const char *name;
-	int err;
+	int i, err;
 
 	spec = codec->spec;
 	snd_array_init(&spec->jacks, sizeof(*jack), 32);
+
+	jack = spec->jacks.list;
+	for (i = 0; i < spec->jacks.used; i++, jack++)
+		if (jack->nid == nid)
+			return 0 ; /* already present */
+
 	jack = snd_array_new(&spec->jacks);
 	name = (type == SND_JACK_HEADPHONE) ? "Headphone" : "Mic" ;
 
author
#97 lore raw

PATCH 97/272 Input: i8042 - introduce notimeout blacklist for Dell Vostro V13

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Jiri Kosina <[email protected]>

commit f8313ef1f448006207f12c107123522c8bc00f15 upstream.

i8042 controller present in Dell Vostro V13 errorneously signals spurious timeouts.

Introduce i8042.notimeout parameter for ignoring i8042-signalled timeouts and apply this quirk automatically for Dell Vostro V13, based on DMI match.

In addition to that, this machine also needs to be added to nomux blacklist.

---
 Documentation/kernel-parameters.txt   |    1 +
 drivers/input/serio/i8042-x86ia64io.h |   21 +++++++++++++++++++++
 drivers/input/serio/i8042.c           |    6 +++++-
 3 files changed, 27 insertions(+), 1 deletion(-)
Documentation/kernel-parameters.txt +1 -0
@@ -884,6 +884,7 @@ and is between 256 and 4096 characters.
 			     controller
 	i8042.nopnp	[HW] Don't use ACPIPnP / PnPBIOS to discover KBD/AUX
 			     controllers
+	i8042.notimeout	[HW] Ignore timeout condition signalled by conroller
 	i8042.reset	[HW] Reset the controller during init and cleanup
 	i8042.unlock	[HW] Unlock (ignore) the keylock
 
drivers/input/serio/i8042-x86ia64io.h +21 -0
@@ -424,6 +424,13 @@ static const struct dmi_system_id __init
 			DMI_MATCH(DMI_PRODUCT_VERSION, "0100"),
 		},
 	},
+	{
+		/* Dell Vostro V13 */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Vostro V13"),
+		},
+	},
 	{ }
 };
 
@@ -545,6 +552,17 @@ static const struct dmi_system_id __init
 };
 #endif
 
+static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = {
+	{
+		/* Dell Vostro V13 */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Vostro V13"),
+		},
+	},
+	{ }
+};
+
 /*
  * Some Wistron based laptops need us to explicitly enable the 'Dritek
  * keyboard extension' to make their extra keys start generating scancodes.
@@ -897,6 +915,9 @@ static int __init i8042_platform_init(vo
 	if (dmi_check_system(i8042_dmi_nomux_table))
 		i8042_nomux = true;
 
+	if (dmi_check_system(i8042_dmi_notimeout_table))
+		i8042_notimeout = true;
+
 	if (dmi_check_system(i8042_dmi_dritek_table))
 		i8042_dritek = true;
 #endif /* CONFIG_X86 */
drivers/input/serio/i8042.c +5 -1
@@ -61,6 +61,10 @@ static bool i8042_noloop;
 module_param_named(noloop, i8042_noloop, bool, 0);
 MODULE_PARM_DESC(noloop, "Disable the AUX Loopback command while probing for the AUX port");
 
+static bool i8042_notimeout;
+module_param_named(notimeout, i8042_notimeout, bool, 0);
+MODULE_PARM_DESC(notimeout, "Ignore timeouts signalled by i8042");
+
 #ifdef CONFIG_X86
 static bool i8042_dritek;
 module_param_named(dritek, i8042_dritek, bool, 0);
@@ -503,7 +507,7 @@ static irqreturn_t i8042_interrupt(int i
 	} else {
 
 		dfl = ((str & I8042_STR_PARITY) ? SERIO_PARITY : 0) |
-		      ((str & I8042_STR_TIMEOUT) ? SERIO_TIMEOUT : 0);
+		      ((str & I8042_STR_TIMEOUT && !i8042_notimeout) ? SERIO_TIMEOUT : 0);
 
 		port_no = (str & I8042_STR_AUXDATA) ?
 				I8042_AUX_PORT_NO : I8042_KBD_PORT_NO;
author
#98 lore raw

PATCH 98/272 input: bcm5974: Add support for MacBookAir3

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Edgar (gimli) Hucek <[email protected]>

commit 6021afcf19d8c6f5db6d11cadcfb6a22d0c28a48 upstream.

This patch adds support for the MacBookAir3,1 and MacBookAir3,2 models.

---
 drivers/input/mouse/bcm5974.c |   40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
drivers/input/mouse/bcm5974.c +40 -0
@@ -55,6 +55,14 @@
 #define USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI	0x0236
 #define USB_DEVICE_ID_APPLE_WELLSPRING3_ISO	0x0237
 #define USB_DEVICE_ID_APPLE_WELLSPRING3_JIS	0x0238
+/* MacbookAir3,2 (unibody), aka wellspring5 */
+#define USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI	0x023f
+#define USB_DEVICE_ID_APPLE_WELLSPRING4_ISO	0x0240
+#define USB_DEVICE_ID_APPLE_WELLSPRING4_JIS	0x0241
+/* MacbookAir3,1 (unibody), aka wellspring4 */
+#define USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI	0x0242
+#define USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO	0x0243
+#define USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS	0x0244
 
 #define BCM5974_DEVICE(prod) {					\
 	.match_flags = (USB_DEVICE_ID_MATCH_DEVICE |		\
@@ -80,6 +88,14 @@ static const struct usb_device_id bcm597
 	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING3_ANSI),
 	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING3_ISO),
 	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING3_JIS),
+	/* MacbookAir3,2 */
+	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI),
+	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING4_ISO),
+	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING4_JIS),
+	/* MacbookAir3,1 */
+	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI),
+	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO),
+	BCM5974_DEVICE(USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS),
 	/* Terminating entry */
 	{}
 };
@@ -234,6 +250,30 @@ static const struct bcm5974_config bcm59
 		{ DIM_X, DIM_X / SN_COORD, -4460, 5166 },
 		{ DIM_Y, DIM_Y / SN_COORD, -75, 6700 }
 	},
+	{
+		USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI,
+		USB_DEVICE_ID_APPLE_WELLSPRING4_ISO,
+		USB_DEVICE_ID_APPLE_WELLSPRING4_JIS,
+		HAS_INTEGRATED_BUTTON,
+		0x84, sizeof(struct bt_data),
+		0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+		{ DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 },
+		{ DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
+		{ DIM_X, DIM_X / SN_COORD, -4620, 5140 },
+		{ DIM_Y, DIM_Y / SN_COORD, -150, 6600 }
+	},
+	{
+		USB_DEVICE_ID_APPLE_WELLSPRING4A_ANSI,
+		USB_DEVICE_ID_APPLE_WELLSPRING4A_ISO,
+		USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS,
+		HAS_INTEGRATED_BUTTON,
+		0x84, sizeof(struct bt_data),
+		0x81, TYPE2, FINGER_TYPE2, FINGER_TYPE2 + SIZEOF_ALL_FINGERS,
+		{ DIM_PRESSURE, DIM_PRESSURE / SN_PRESSURE, 0, 300 },
+		{ DIM_WIDTH, DIM_WIDTH / SN_WIDTH, 0, 2048 },
+		{ DIM_X, DIM_X / SN_COORD, -4616, 5112 },
+		{ DIM_Y, DIM_Y / SN_COORD, -142, 5234 }
+	},
 	{}
 };
 
author
#99 lore raw

PATCH 99/272 Input: rc-keymap - return KEY_RESERVED for unknown mappings

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Dmitry Torokhov <[email protected]>

commit 54e74b87e2a9941c6fa82189f270b47cceeba714 upstream.

Do not respond with -EINVAL to EVIOCGKEYCODE for not-yet-mapped scancodes, but rather return KEY_RESERVED.

This fixes breakage with Ubuntu's input-kbd utility that stopped returning full keymaps for remote controls.

---
 drivers/media/IR/ir-keytable.c |   28 +++++++++++++++++-----------
 1 file changed, 17 insertions(+), 11 deletions(-)
drivers/media/IR/ir-keytable.c +17 -11
@@ -374,21 +374,27 @@ static int ir_getkeycode(struct input_de
 		index = ir_lookup_by_scancode(rc_tab, scancode);
 	}
 
-	if (index >= rc_tab->len) {
-		if (!(ke->flags & INPUT_KEYMAP_BY_INDEX))
-			IR_dprintk(1, "unknown key for scancode 0x%04x\n",
-				   scancode);
+	if (index < rc_tab->len) {
+		entry = &rc_tab->scan[index];
+
+		ke->index = index;
+		ke->keycode = entry->keycode;
+		ke->len = sizeof(entry->scancode);
+		memcpy(ke->scancode, &entry->scancode, sizeof(entry->scancode));
+
+	} else if (!(ke->flags & INPUT_KEYMAP_BY_INDEX)) {
+		/*
+		 * We do not really know the valid range of scancodes
+		 * so let's respond with KEY_RESERVED to anything we
+		 * do not have mapping for [yet].
+		 */
+		ke->index = index;
+		ke->keycode = KEY_RESERVED;
+	} else {
 		retval = -EINVAL;
 		goto out;
 	}
 
-	entry = &rc_tab->scan[index];
-
-	ke->index = index;
-	ke->keycode = entry->keycode;
-	ke->len = sizeof(entry->scancode);
-	memcpy(ke->scancode, &entry->scancode, sizeof(entry->scancode));
-
 	retval = 0;
 
 out:
author
#100 lore raw

PATCH 100/272 hwmon: (lm63) Consider LM64 temperature offset

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Dirk Eibach <[email protected]>

commit 2778fb13ba0fed1b3e4a040e71f7881d399610a3 upstream.

LM64 has 16 degrees Celsius temperature offset on all remote sensor registers.
This was not considered When LM64 support was added to lm63.c.

---
 drivers/hwmon/lm63.c |   59 ++++++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 47 insertions(+), 12 deletions(-)
drivers/hwmon/lm63.c +47 -12
@@ -98,6 +98,9 @@ static const unsigned short normal_i2c[]
  * value, it uses signed 8-bit values with LSB = 1 degree Celsius.
  * For remote temperature, low and high limits, it uses signed 11-bit values
  * with LSB = 0.125 degree Celsius, left-justified in 16-bit registers.
+ * For LM64 the actual remote diode temperature is 16 degree Celsius higher
+ * than the register reading. Remote temperature setpoints have to be
+ * adapted accordingly.
  */
 
 #define FAN_FROM_REG(reg)	((reg) == 0xFFFC || (reg) == 0 ? 0 : \
@@ -165,6 +168,8 @@ struct lm63_data {
 	struct mutex update_lock;
 	char valid; /* zero until following fields are valid */
 	unsigned long last_updated; /* in jiffies */
+	int kind;
+	int temp2_offset;
 
 	/* registers values */
 	u8 config, config_fan;
@@ -247,16 +252,34 @@ static ssize_t show_pwm1_enable(struct d
 	return sprintf(buf, "%d\n", data->config_fan & 0x20 ? 1 : 2);
 }
 
-static ssize_t show_temp8(struct device *dev, struct device_attribute *devattr,
-			  char *buf)
+/*
+ * There are 8bit registers for both local(temp1) and remote(temp2) sensor.
+ * For remote sensor registers temp2_offset has to be considered,
+ * for local sensor it must not.
+ * So we need separate 8bit accessors for local and remote sensor.
+ */
+static ssize_t show_local_temp8(struct device *dev,
+				struct device_attribute *devattr,
+				char *buf)
 {
 	struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
 	struct lm63_data *data = lm63_update_device(dev);
 	return sprintf(buf, "%d\n", TEMP8_FROM_REG(data->temp8[attr->index]));
 }
 
-static ssize_t set_temp8(struct device *dev, struct device_attribute *dummy,
-			 const char *buf, size_t count)
+static ssize_t show_remote_temp8(struct device *dev,
+				 struct device_attribute *devattr,
+				 char *buf)
+{
+	struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+	struct lm63_data *data = lm63_update_device(dev);
+	return sprintf(buf, "%d\n", TEMP8_FROM_REG(data->temp8[attr->index])
+		       + data->temp2_offset);
+}
+
+static ssize_t set_local_temp8(struct device *dev,
+			       struct device_attribute *dummy,
+			       const char *buf, size_t count)
 {
 	struct i2c_client *client = to_i2c_client(dev);
 	struct lm63_data *data = i2c_get_clientdata(client);
@@ -274,7 +297,8 @@ static ssize_t show_temp11(struct device
 {
 	struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
 	struct lm63_data *data = lm63_update_device(dev);
-	return sprintf(buf, "%d\n", TEMP11_FROM_REG(data->temp11[attr->index]));
+	return sprintf(buf, "%d\n", TEMP11_FROM_REG(data->temp11[attr->index])
+		       + data->temp2_offset);
 }
 
 static ssize_t set_temp11(struct device *dev, struct device_attribute *devattr,
@@ -294,7 +318,7 @@ static ssize_t set_temp11(struct device
 	int nr = attr->index;
 
 	mutex_lock(&data->update_lock);
-	data->temp11[nr] = TEMP11_TO_REG(val);
+	data->temp11[nr] = TEMP11_TO_REG(val - data->temp2_offset);
 	i2c_smbus_write_byte_data(client, reg[(nr - 1) * 2],
 				  data->temp11[nr] >> 8);
 	i2c_smbus_write_byte_data(client, reg[(nr - 1) * 2 + 1],
@@ -310,6 +334,7 @@ static ssize_t show_temp2_crit_hyst(stru
 {
 	struct lm63_data *data = lm63_update_device(dev);
 	return sprintf(buf, "%d\n", TEMP8_FROM_REG(data->temp8[2])
+		       + data->temp2_offset
 		       - TEMP8_FROM_REG(data->temp2_crit_hyst));
 }
 
@@ -324,7 +349,7 @@ static ssize_t set_temp2_crit_hyst(struc
 	long hyst;
 
 	mutex_lock(&data->update_lock);
-	hyst = TEMP8_FROM_REG(data->temp8[2]) - val;
+	hyst = TEMP8_FROM_REG(data->temp8[2]) + data->temp2_offset - val;
 	i2c_smbus_write_byte_data(client, LM63_REG_REMOTE_TCRIT_HYST,
 				  HYST_TO_REG(hyst));
 	mutex_unlock(&data->update_lock);
@@ -355,16 +380,21 @@ static SENSOR_DEVICE_ATTR(fan1_min, S_IW
 static DEVICE_ATTR(pwm1, S_IWUSR | S_IRUGO, show_pwm1, set_pwm1);
 static DEVICE_ATTR(pwm1_enable, S_IRUGO, show_pwm1_enable, NULL);
 
-static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, show_temp8, NULL, 0);
-static SENSOR_DEVICE_ATTR(temp1_max, S_IWUSR | S_IRUGO, show_temp8,
-	set_temp8, 1);
+static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, show_local_temp8, NULL, 0);
+static SENSOR_DEVICE_ATTR(temp1_max, S_IWUSR | S_IRUGO, show_local_temp8,
+	set_local_temp8, 1);
 
 static SENSOR_DEVICE_ATTR(temp2_input, S_IRUGO, show_temp11, NULL, 0);
 static SENSOR_DEVICE_ATTR(temp2_min, S_IWUSR | S_IRUGO, show_temp11,
 	set_temp11, 1);
 static SENSOR_DEVICE_ATTR(temp2_max, S_IWUSR | S_IRUGO, show_temp11,
 	set_temp11, 2);
-static SENSOR_DEVICE_ATTR(temp2_crit, S_IRUGO, show_temp8, NULL, 2);
+/*
+ * On LM63, temp2_crit can be set only once, which should be job
+ * of the bootloader.
+ */
+static SENSOR_DEVICE_ATTR(temp2_crit, S_IRUGO, show_remote_temp8,
+	NULL, 2);
 static DEVICE_ATTR(temp2_crit_hyst, S_IWUSR | S_IRUGO, show_temp2_crit_hyst,
 	set_temp2_crit_hyst);
 
@@ -479,7 +509,12 @@ static int lm63_probe(struct i2c_client
 	data->valid = 0;
 	mutex_init(&data->update_lock);
 
-	/* Initialize the LM63 chip */
+	/* Set the device type */
+	data->kind = id->driver_data;
+	if (data->kind == lm64)
+		data->temp2_offset = 16000;
+
+	/* Initialize chip */
 	lm63_init_client(new_client);
 
 	/* Register sysfs hooks */
author
#101 lore raw

PATCH 101/272 tracing: Fix preempt count leak

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Li Zefan <[email protected]>

commit 1dbd1951f39e13da579ffe879cce19586d0462de upstream.

While running my ftrace stress test, this showed up:

BUG: sleeping function called from invalid context at mm/mmap.c:233

...
note: cat[3293] exited with preempt_count 1

The bug was introduced by commit 91e86e560d0b3ce4c5fc64fd2bbb99f856a30a4e ("tracing: Fix recursive user stack trace")

LKML-Reference: <[email protected]>

---
 kernel/trace/trace.c |    6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)
kernel/trace/trace.c +2 -4
@@ -1313,12 +1313,10 @@ ftrace_trace_userstack(struct ring_buffe
 
 	__this_cpu_inc(user_stack_count);
 
-
-
 	event = trace_buffer_lock_reserve(buffer, TRACE_USER_STACK,
 					  sizeof(*entry), flags, pc);
 	if (!event)
-		return;
+		goto out_drop_count;
 	entry	= ring_buffer_event_data(event);
 
 	entry->tgid		= current->tgid;
@@ -1333,8 +1331,8 @@ ftrace_trace_userstack(struct ring_buffe
 	if (!filter_check_discard(call, entry, buffer, event))
 		ring_buffer_unlock_commit(buffer, event);
 
+ out_drop_count:
 	__this_cpu_dec(user_stack_count);
-
  out:
 	preempt_enable();
 }
author
#102 lore raw

PATCH 102/272 ALSA: hrtimer: handle delayed timer interrupts

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Clemens Ladisch <[email protected]>

commit b1d4f7f4bdcf9915c41ff8cfc4425c84dabb1fde upstream.

If a timer interrupt was delayed too much, hrtimer_forward_now() will forward the timer expiry more than once. When this happens, the additional number of elapsed ALSA timer ticks must be passed to snd_timer_interrupt() to prevent the ALSA timer from falling behind.

This mostly fixes MIDI slowdown problems on highly-loaded systems with badly behaved interrupt handlers.

---
 sound/core/hrtimer.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
sound/core/hrtimer.c +3 -2
@@ -45,12 +45,13 @@ static enum hrtimer_restart snd_hrtimer_
 {
 	struct snd_hrtimer *stime = container_of(hrt, struct snd_hrtimer, hrt);
 	struct snd_timer *t = stime->timer;
+	unsigned long oruns;
 
 	if (!atomic_read(&stime->running))
 		return HRTIMER_NORESTART;
 
-	hrtimer_forward_now(hrt, ns_to_ktime(t->sticks * resolution));
-	snd_timer_interrupt(stime->timer, t->sticks);
+	oruns = hrtimer_forward_now(hrt, ns_to_ktime(t->sticks * resolution));
+	snd_timer_interrupt(stime->timer, t->sticks * oruns);
 
 	if (!atomic_read(&stime->running))
 		return HRTIMER_NORESTART;
author
#103 lore raw

PATCH 103/272 ALSA: hda - Fix missing CA initialization for HDMI/DP

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Takashi Iwai <[email protected]>

commit 11839aed21881d7edd65dd79f22a8eb18426f672 upstream.

The commit 53d7d69d8ffdfa60c5b66cc2e9ee0774aaaef5c0
ALSA: hdmi - support infoframe for DisplayPort
dropped the initialization of CA field accidentally. This resulted in only two-channel LPCM mode on Nvidia machines.

Reference: kernel bug 28592

	https://bugzilla.kernel.org/show_bug.cgi?id=28592
---
 sound/pci/hda/patch_hdmi.c |    2 ++
 1 file changed, 2 insertions(+)
sound/pci/hda/patch_hdmi.c +2 -0
@@ -642,6 +642,7 @@ static void hdmi_setup_audio_infoframe(s
 			hdmi_ai->ver		= 0x01;
 			hdmi_ai->len		= 0x0a;
 			hdmi_ai->CC02_CT47	= channels - 1;
+			hdmi_ai->CA		= ca;
 			hdmi_checksum_audio_infoframe(hdmi_ai);
 		} else if (spec->sink_eld[i].conn_type == 1) { /* DisplayPort */
 			struct dp_audio_infoframe *dp_ai;
@@ -651,6 +652,7 @@ static void hdmi_setup_audio_infoframe(s
 			dp_ai->len		= 0x1b;
 			dp_ai->ver		= 0x11 << 2;
 			dp_ai->CC02_CT47	= channels - 1;
+			dp_ai->CA		= ca;
 		} else {
 			snd_printd("HDMI: unknown connection type at pin %d\n",
 				   pin_nid);
author
#104 lore raw

PATCH 104/272 ALSA: HDA: Add subwoofer quirk for Acer Aspire 8942G

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: David Henningsson <[email protected]>

commit a6c47a85b8e7e4a8c47394607c5e5c43224b0892 upstream.

According to the reporter, node 0x15 needs to be muted for subwoofer to stop sounding. This pin is marked as unused by BIOS, so fix that.

---
 sound/pci/hda/patch_realtek.c |    1 +
 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -19380,6 +19380,7 @@ static const struct alc_fixup alc662_fix
 };
 
 static struct snd_pci_quirk alc662_fixup_tbl[] = {
+	SND_PCI_QUIRK(0x1025, 0x0308, "Acer Aspire 8942G", ALC662_FIXUP_ASPIRE),
 	SND_PCI_QUIRK(0x1025, 0x038b, "Acer Aspire 8943G", ALC662_FIXUP_ASPIRE),
 	SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD),
 	SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo Ideapad Y550P", ALC662_FIXUP_IDEAPAD),
author
#105 lore raw

PATCH 105/272 ASoC: When disabling WM8994 FLL force a source selection

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Mark Brown <[email protected]>

commit 4514e8997fbefd5befd6176ac9785e287b4daed4 upstream.

When we disable the WM8994 FLL code path sharing means that we end up writing out a configuration. Currently this is the currently active input and output frequency (which causes snd_soc_update_bits() to suppress actual writes both immediately and in the common case where we reenable the same configuration later) but we allow machine drivers to pass through a source of zero. Since the register values written are one less than the source constants this causes corruption of other bitfields in the register.

Fix this by using the most recently configured FLL source when none is provided.

---
 sound/soc/codecs/wm8994.c |    1 +
 1 file changed, 1 insertion(+)
sound/soc/codecs/wm8994.c +1 -0
@@ -2930,6 +2930,7 @@ static int _wm8994_set_fll(struct snd_so
 		/* Allow no source specification when stopping */
 		if (freq_out)
 			return -EINVAL;
+		src = wm8994->fll[id].src;
 		break;
 	case WM8994_FLL_SRC_MCLK1:
 	case WM8994_FLL_SRC_MCLK2:
author
#106 lore raw

PATCH 106/272 ASoC: WM8990: msleep() takes milliseconds not jiffies

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Dimitris Papastamos <[email protected]>

commit 7ebcf5d6021a696680ee77d9162a2edec2d671dd upstream.

---
 sound/soc/codecs/wm8990.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)
sound/soc/codecs/wm8990.c +5 -5
@@ -1183,7 +1183,7 @@ static int wm8990_set_bias_level(struct
 				     WM8990_VMIDTOG);
 
 			/* Delay to allow output caps to discharge */
-			msleep(msecs_to_jiffies(300));
+			msleep(300);
 
 			/* Disable VMIDTOG */
 			snd_soc_write(codec, WM8990_ANTIPOP2, WM8990_SOFTST |
@@ -1195,17 +1195,17 @@ static int wm8990_set_bias_level(struct
 			/* Enable outputs */
 			snd_soc_write(codec, WM8990_POWER_MANAGEMENT_1, 0x1b00);
 
-			msleep(msecs_to_jiffies(50));
+			msleep(50);
 
 			/* Enable VMID at 2x50k */
 			snd_soc_write(codec, WM8990_POWER_MANAGEMENT_1, 0x1f02);
 
-			msleep(msecs_to_jiffies(100));
+			msleep(100);
 
 			/* Enable VREF */
 			snd_soc_write(codec, WM8990_POWER_MANAGEMENT_1, 0x1f03);
 
-			msleep(msecs_to_jiffies(600));
+			msleep(600);
 
 			/* Enable BUFIOEN */
 			snd_soc_write(codec, WM8990_ANTIPOP2, WM8990_SOFTST |
@@ -1250,7 +1250,7 @@ static int wm8990_set_bias_level(struct
 		/* Disable VMID */
 		snd_soc_write(codec, WM8990_POWER_MANAGEMENT_1, 0x1f01);
 
-		msleep(msecs_to_jiffies(300));
+		msleep(300);
 
 		/* Enable all output discharge bits */
 		snd_soc_write(codec, WM8990_ANTIPOP1, WM8990_DIS_LLINE |
author
#107 lore raw

PATCH 107/272 ASoC: Blackfin AC97: fix build error after multi-component update

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Mike Frysinger <[email protected]>

commit e9c2048915048d605fd76539ddd96f00d593e1eb upstream.

We need to tweak how we query the active capture/playback state after the recent overhauls of common code.

---
 sound/soc/blackfin/bf5xx-ac97.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/blackfin/bf5xx-ac97.c +2 -2
@@ -260,9 +260,9 @@ static int bf5xx_ac97_suspend(struct snd
 	pr_debug("%s : sport %d\n", __func__, dai->id);
 	if (!dai->active)
 		return 0;
-	if (dai->capture.active)
+	if (dai->capture_active)
 		sport_rx_stop(sport);
-	if (dai->playback.active)
+	if (dai->playback_active)
 		sport_tx_stop(sport);
 	return 0;
 }
author
#108 lore raw

PATCH 108/272 ASoC: Blackfin TDM: fix missed snd_soc_dai_get_drvdata update

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Mike Frysinger <[email protected]>

commit 15d2e22b820bad62854d6ad99d8af8320adf4a91 upstream.

One spot was missed in this driver when converting from snd_soc_dai.private_data to snd_soc_dai_get_drvdata.

---
 sound/soc/blackfin/bf5xx-tdm.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/blackfin/bf5xx-tdm.c +1 -1
@@ -210,7 +210,7 @@ static int bf5xx_tdm_set_channel_map(str
 #ifdef CONFIG_PM
 static int bf5xx_tdm_suspend(struct snd_soc_dai *dai)
 {
-	struct sport_device *sport = dai->private_data;
+	struct sport_device *sport = snd_soc_dai_get_drvdata(dai);
 
 	if (!dai->active)
 		return 0;
author
#109 lore raw

PATCH 109/272 NFS: Dont use vm_map_ram() in readdir

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Trond Myklebust <[email protected]>

commit 6650239a4b01077e80d5a4468562756d77afaa59 upstream.

vm_map_ram() is not available on NOMMU platforms, and causes trouble on incoherrent architectures such as ARM when we access the page data through both the direct and the virtual mapping.

The alternative is to use the direct mapping to access page data for the case when we are not crossing a page boundary, but to copy the data into a linear scratch buffer when we are accessing data that spans page boundaries.

---
 fs/nfs/dir.c               |   44 ++++++------
 fs/nfs/nfs2xdr.c           |    6 -
 fs/nfs/nfs3xdr.c           |    6 -
 fs/nfs/nfs4xdr.c           |    6 -
 include/linux/sunrpc/xdr.h |    4 -
 net/sunrpc/xdr.c           |  155 ++++++++++++++++++++++++++++++++++++---------
 6 files changed, 148 insertions(+), 73 deletions(-)
fs/nfs/dir.c +21 -23
@@ -33,7 +33,6 @@
 #include <linux/namei.h>
 #include <linux/mount.h>
 #include <linux/sched.h>
-#include <linux/vmalloc.h>
 #include <linux/kmemleak.h>
 
 #include "delegation.h"
@@ -459,25 +458,26 @@ out:
 /* Perform conversion from xdr to cache array */
 static
 int nfs_readdir_page_filler(nfs_readdir_descriptor_t *desc, struct nfs_entry *entry,
-				void *xdr_page, struct page *page, unsigned int buflen)
+				struct page **xdr_pages, struct page *page, unsigned int buflen)
 {
 	struct xdr_stream stream;
-	struct xdr_buf buf;
-	__be32 *ptr = xdr_page;
+	struct xdr_buf buf = {
+		.pages = xdr_pages,
+		.page_len = buflen,
+		.buflen = buflen,
+		.len = buflen,
+	};
+	struct page *scratch;
 	struct nfs_cache_array *array;
 	unsigned int count = 0;
 	int status;
 
-	buf.head->iov_base = xdr_page;
-	buf.head->iov_len = buflen;
-	buf.tail->iov_len = 0;
-	buf.page_base = 0;
-	buf.page_len = 0;
-	buf.buflen = buf.head->iov_len;
-	buf.len = buf.head->iov_len;
-
-	xdr_init_decode(&stream, &buf, ptr);
+	scratch = alloc_page(GFP_KERNEL);
+	if (scratch == NULL)
+		return -ENOMEM;
 
+	xdr_init_decode(&stream, &buf, NULL);
+	xdr_set_scratch_buffer(&stream, page_address(scratch), PAGE_SIZE);
 
 	do {
 		status = xdr_decode(desc, entry, &stream);
@@ -506,6 +506,8 @@ int nfs_readdir_page_filler(nfs_readdir_
 		} else
 			status = PTR_ERR(array);
 	}
+
+	put_page(scratch);
 	return status;
 }
 
@@ -521,7 +523,6 @@ static
 void nfs_readdir_free_large_page(void *ptr, struct page **pages,
 		unsigned int npages)
 {
-	vm_unmap_ram(ptr, npages);
 	nfs_readdir_free_pagearray(pages, npages);
 }
 
@@ -530,9 +531,8 @@ void nfs_readdir_free_large_page(void *p
  * to nfs_readdir_free_large_page
  */
 static
-void *nfs_readdir_large_page(struct page **pages, unsigned int npages)
+int nfs_readdir_large_page(struct page **pages, unsigned int npages)
 {
-	void *ptr;
 	unsigned int i;
 
 	for (i = 0; i < npages; i++) {
@@ -541,13 +541,11 @@ void *nfs_readdir_large_page(struct page
 			goto out_freepages;
 		pages[i] = page;
 	}
+	return 0;
 
-	ptr = vm_map_ram(pages, npages, 0, PAGE_KERNEL);
-	if (!IS_ERR_OR_NULL(ptr))
-		return ptr;
 out_freepages:
 	nfs_readdir_free_pagearray(pages, i);
-	return NULL;
+	return -ENOMEM;
 }
 
 static
@@ -577,8 +575,8 @@ int nfs_readdir_xdr_to_array(nfs_readdir
 	memset(array, 0, sizeof(struct nfs_cache_array));
 	array->eof_index = -1;
 
-	pages_ptr = nfs_readdir_large_page(pages, array_size);
-	if (!pages_ptr)
+	status = nfs_readdir_large_page(pages, array_size);
+	if (status < 0)
 		goto out_release_array;
 	do {
 		unsigned int pglen;
@@ -587,7 +585,7 @@ int nfs_readdir_xdr_to_array(nfs_readdir
 		if (status < 0)
 			break;
 		pglen = status;
-		status = nfs_readdir_page_filler(desc, &entry, pages_ptr, page, pglen);
+		status = nfs_readdir_page_filler(desc, &entry, pages, page, pglen);
 		if (status < 0) {
 			if (status == -ENOSPC)
 				status = 0;
fs/nfs/nfs2xdr.c +0 -6
@@ -487,12 +487,6 @@ nfs_decode_dirent(struct xdr_stream *xdr
 
 	entry->d_type = DT_UNKNOWN;
 
-	p = xdr_inline_peek(xdr, 8);
-	if (p != NULL)
-		entry->eof = !p[0] && p[1];
-	else
-		entry->eof = 0;
-
 	return p;
 
 out_overflow:
fs/nfs/nfs3xdr.c +0 -6
@@ -647,12 +647,6 @@ nfs3_decode_dirent(struct xdr_stream *xd
 			memset((u8*)(entry->fh), 0, sizeof(*entry->fh));
 	}
 
-	p = xdr_inline_peek(xdr, 8);
-	if (p != NULL)
-		entry->eof = !p[0] && p[1];
-	else
-		entry->eof = 0;
-
 	return p;
 
 out_overflow:
fs/nfs/nfs4xdr.c +0 -6
@@ -6215,12 +6215,6 @@ __be32 *nfs4_decode_dirent(struct xdr_st
 	if (verify_attr_len(xdr, p, len) < 0)
 		goto out_overflow;
 
-	p = xdr_inline_peek(xdr, 8);
-	if (p != NULL)
-		entry->eof = !p[0] && p[1];
-	else
-		entry->eof = 0;
-
 	return p;
 
 out_overflow:
include/linux/sunrpc/xdr.h +3 -1
@@ -201,6 +201,8 @@ struct xdr_stream {
 
 	__be32 *end;		/* end of available buffer space */
 	struct kvec *iov;	/* pointer to the current kvec */
+	struct kvec scratch;	/* Scratch buffer */
+	struct page **page_ptr;	/* pointer to the current page */
 };
 
 extern void xdr_init_encode(struct xdr_stream *xdr, struct xdr_buf *buf, __be32 *p);
@@ -208,7 +210,7 @@ extern __be32 *xdr_reserve_space(struct
 extern void xdr_write_pages(struct xdr_stream *xdr, struct page **pages,
 		unsigned int base, unsigned int len);
 extern void xdr_init_decode(struct xdr_stream *xdr, struct xdr_buf *buf, __be32 *p);
-extern __be32 *xdr_inline_peek(struct xdr_stream *xdr, size_t nbytes);
+extern void xdr_set_scratch_buffer(struct xdr_stream *xdr, void *buf, size_t buflen);
 extern __be32 *xdr_inline_decode(struct xdr_stream *xdr, size_t nbytes);
 extern void xdr_read_pages(struct xdr_stream *xdr, unsigned int len);
 extern void xdr_enter_page(struct xdr_stream *xdr, unsigned int len);
net/sunrpc/xdr.c +124 -31

200 lines not on this page · raw message

author
#110 lore raw

PATCH 110/272 NFS: Fix NFSv3 exclusive open semantics

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Trond Myklebust <[email protected]>

commit 8a0eebf66e3b1deae036553ba641a9c2bdbae678 upstream.

Commit c0204fd2b8fe047b18b67e07e1bf2a03691240cd (NFS: Clean up nfs4_proc_create()) broke NFSv3 exclusive open by removing the code that passes the O_EXCL flag down to nfs3_proc_create(). This patch reverts that offending hunk from the original commit.

---
 fs/nfs/dir.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
fs/nfs/dir.c +5 -1
@@ -1577,6 +1577,7 @@ static int nfs_create(struct inode *dir,
 {
 	struct iattr attr;
 	int error;
+	int open_flags = 0;
 
 	dfprintk(VFS, "NFS: create(%s/%ld), %s\n",
 			dir->i_sb->s_id, dir->i_ino, dentry->d_name.name);
@@ -1584,7 +1585,10 @@ static int nfs_create(struct inode *dir,
 	attr.ia_mode = mode;
 	attr.ia_valid = ATTR_MODE;
 
-	error = NFS_PROTO(dir)->create(dir, dentry, &attr, 0, NULL);
+	if ((nd->flags & LOOKUP_CREATE) != 0)
+		open_flags = nd->intent.open.flags;
+
+	error = NFS_PROTO(dir)->create(dir, dentry, &attr, open_flags, NULL);
 	if (error != 0)
 		goto out_err;
 	return 0;
author
#111 lore raw

PATCH 111/272 NFS: Fix an NFS client lockdep issue

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Trond Myklebust <[email protected]>

commit e00b8a24041f37e56b4b8415ce4eba1cbc238065 upstream.

There is no reason to be freeing the delegation cred in the rcu callback, and doing so is resulting in a lockdep complaint that rpc_credcache_lock is being called from both softirq and non-softirq contexts.

---
 fs/nfs/delegation.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
fs/nfs/delegation.c +4 -2
@@ -23,8 +23,6 @@
 
 static void nfs_do_free_delegation(struct nfs_delegation *delegation)
 {
-	if (delegation->cred)
-		put_rpccred(delegation->cred);
 	kfree(delegation);
 }
 
@@ -37,6 +35,10 @@ static void nfs_free_delegation_callback
 
 static void nfs_free_delegation(struct nfs_delegation *delegation)
 {
+	if (delegation->cred) {
+		put_rpccred(delegation->cred);
+		delegation->cred = NULL;
+	}
 	call_rcu(&delegation->rcu, nfs_free_delegation_callback);
 }
 
author
#112 lore raw

PATCH 112/272 NFS: Fix "kernel BUG at fs/aio.c:554!"

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Chuck Lever <[email protected]>

commit 839f7ad6932d95f4d5ae7267b95c574714ff3d5b upstream.

Nick Piggin reports:

Quoted 16 lines

I'm getting use after frees in aio code in NFS

[ 2703.396766] Call Trace:
[ 2703.396858]  [<ffffffff8100b057>] ? native_sched_clock+0x27/0x80
[ 2703.396959]  [<ffffffff8108509e>] ? put_lock_stats+0xe/0x40
[ 2703.397058]  [<ffffffff81088348>] ? lock_release_holdtime+0xa8/0x140
[ 2703.397159]  [<ffffffff8108a2a5>] lock_acquire+0x95/0x1b0
[ 2703.397260]  [<ffffffff811627db>] ? aio_put_req+0x2b/0x60
[ 2703.397361]  [<ffffffff81039701>] ? get_parent_ip+0x11/0x50
[ 2703.397464]  [<ffffffff81612a31>] _raw_spin_lock_irq+0x41/0x80
[ 2703.397564]  [<ffffffff811627db>] ? aio_put_req+0x2b/0x60
[ 2703.397662]  [<ffffffff811627db>] aio_put_req+0x2b/0x60
[ 2703.397761]  [<ffffffff811647fe>] do_io_submit+0x2be/0x7c0
[ 2703.397895]  [<ffffffff81164d0b>] sys_io_submit+0xb/0x10
[ 2703.397995]  [<ffffffff8100307b>] system_call_fastpath+0x16/0x1b
Quoted 3 lines

Adding some tracing, it is due to nfs completing the request then returning something other than -EIOCBQUEUED, so aio.c also completes the request.

To address this, prevent the NFS direct I/O engine from completing async iocbs when the forward path returns an error without starting any I/O.

This fix appears to survive ^C during both "xfstest no. 208" and "fsx -Z."

It's likely this bug has existed for a very long while, as we are seeing very similar symptoms in OEL 5. Copying stable.

---
 fs/nfs/direct.c |   34 ++++++++++++++++++++--------------
 1 file changed, 20 insertions(+), 14 deletions(-)
fs/nfs/direct.c +20 -14
@@ -407,15 +407,18 @@ static ssize_t nfs_direct_read_schedule_
 		pos += vec->iov_len;
 	}
 
+	/*
+	 * If no bytes were started, return the error, and let the
+	 * generic layer handle the completion.
+	 */
+	if (requested_bytes == 0) {
+		nfs_direct_req_release(dreq);
+		return result < 0 ? result : -EIO;
+	}
+
 	if (put_dreq(dreq))
 		nfs_direct_complete(dreq);
-
-	if (requested_bytes != 0)
-		return 0;
-
-	if (result < 0)
-		return result;
-	return -EIO;
+	return 0;
 }
 
 static ssize_t nfs_direct_read(struct kiocb *iocb, const struct iovec *iov,
@@ -841,15 +844,18 @@ static ssize_t nfs_direct_write_schedule
 		pos += vec->iov_len;
 	}
 
+	/*
+	 * If no bytes were started, return the error, and let the
+	 * generic layer handle the completion.
+	 */
+	if (requested_bytes == 0) {
+		nfs_direct_req_release(dreq);
+		return result < 0 ? result : -EIO;
+	}
+
 	if (put_dreq(dreq))
 		nfs_direct_write_complete(dreq, dreq->inode);
-
-	if (requested_bytes != 0)
-		return 0;
-
-	if (result < 0)
-		return result;
-	return -EIO;
+	return 0;
 }
 
 static ssize_t nfs_direct_write(struct kiocb *iocb, const struct iovec *iov,
author
#113 lore raw

PATCH 113/272 nfsd4: name->id mapping should fail with BADOWNER not BADNAME

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: J. Bruce Fields <[email protected]>

commit f6af99ec1b261e21219d5eba99e3af48fc6c32d4 upstream.

According to rfc 3530 BADNAME is for strings that represent paths; BADOWNER is for user/group names that don't map.

And the too-long name should probably be BADOWNER as well; it's effectively the same as if we couldn't map it.

---
 fs/nfsd/nfs4idmap.c |    4 ++--
 fs/nfsd/nfsd.h      |    1 +
 fs/nfsd/nfsproc.c   |    2 +-
 3 files changed, 4 insertions(+), 3 deletions(-)
fs/nfsd/nfs4idmap.c +2 -2
@@ -524,13 +524,13 @@ idmap_name_to_id(struct svc_rqst *rqstp,
 	int ret;
 
 	if (namelen + 1 > sizeof(key.name))
-		return -EINVAL;
+		return -ESRCH; /* nfserr_badowner */
 	memcpy(key.name, name, namelen);
 	key.name[namelen] = '\0';
 	strlcpy(key.authname, rqst_authname(rqstp), sizeof(key.authname));
 	ret = idmap_lookup(rqstp, nametoid_lookup, &key, &nametoid_cache, &item);
 	if (ret == -ENOENT)
-		ret = -ESRCH; /* nfserr_badname */
+		ret = -ESRCH; /* nfserr_badowner */
 	if (ret)
 		return ret;
 	*id = item->id;
fs/nfsd/nfsd.h +1 -0
@@ -158,6 +158,7 @@ void		nfsd_lockd_shutdown(void);
 #define	nfserr_attrnotsupp	cpu_to_be32(NFSERR_ATTRNOTSUPP)
 #define	nfserr_bad_xdr		cpu_to_be32(NFSERR_BAD_XDR)
 #define	nfserr_openmode		cpu_to_be32(NFSERR_OPENMODE)
+#define	nfserr_badowner		cpu_to_be32(NFSERR_BADOWNER)
 #define	nfserr_locks_held	cpu_to_be32(NFSERR_LOCKS_HELD)
 #define	nfserr_op_illegal	cpu_to_be32(NFSERR_OP_ILLEGAL)
 #define	nfserr_grace		cpu_to_be32(NFSERR_GRACE)
fs/nfsd/nfsproc.c +1 -1
@@ -737,7 +737,7 @@ nfserrno (int errno)
 		{ nfserr_jukebox, -ERESTARTSYS },
 		{ nfserr_dropit, -EAGAIN },
 		{ nfserr_dropit, -ENOMEM },
-		{ nfserr_badname, -ESRCH },
+		{ nfserr_badowner, -ESRCH },
 		{ nfserr_io, -ETXTBSY },
 		{ nfserr_notsupp, -EOPNOTSUPP },
 		{ nfserr_toosmall, -ETOOSMALL },
author
#114 lore raw

PATCH 114/272 dynamic debug: Fix build issue with older gcc

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Jason Baron <[email protected]>

commit 2d75af2f2a7a6103a6d539a492fe81deacabde44 upstream.

On older gcc (3.3) dynamic debug fails to compile:

include/net/inet_connection_sock.h: In function `inet_csk_reset_xmit_timer':
include/net/inet_connection_sock.h:236: error: duplicate label declaration do_printk' include/net/inet_connection_sock.h:219: error: this is a previous declaration include/net/inet_connection_sock.h:236: error: duplicate label declaration out' include/net/inet_connection_sock.h:219: error: this is a previous declaration include/net/inet_connection_sock.h:236: error: duplicate label do_printk' include/net/inet_connection_sock.h:236: error: duplicate label out'

Fix, by reverting the usage of JUMP_LABEL() in dynamic debug for now.

---
 include/linux/dynamic_debug.h |   18 ++++--------------
 lib/dynamic_debug.c           |    9 ++++-----
 2 files changed, 8 insertions(+), 19 deletions(-)
include/linux/dynamic_debug.h +4 -14
@@ -44,34 +44,24 @@ int ddebug_add_module(struct _ddebug *ta
 extern int ddebug_remove_module(const char *mod_name);
 
 #define dynamic_pr_debug(fmt, ...) do {					\
-	__label__ do_printk;						\
-	__label__ out;							\
 	static struct _ddebug descriptor				\
 	__used								\
 	__attribute__((section("__verbose"), aligned(8))) =		\
 	{ KBUILD_MODNAME, __func__, __FILE__, fmt, __LINE__,		\
 		_DPRINTK_FLAGS_DEFAULT };				\
-	JUMP_LABEL(&descriptor.enabled, do_printk);			\
-	goto out;							\
-do_printk:								\
-	printk(KERN_DEBUG pr_fmt(fmt),	##__VA_ARGS__);			\
-out:	;								\
+	if (unlikely(descriptor.enabled))				\
+		printk(KERN_DEBUG pr_fmt(fmt),	##__VA_ARGS__);		\
 	} while (0)
 
 
 #define dynamic_dev_dbg(dev, fmt, ...) do {				\
-	__label__ do_printk;						\
-	__label__ out;							\
 	static struct _ddebug descriptor				\
 	__used								\
 	__attribute__((section("__verbose"), aligned(8))) =		\
 	{ KBUILD_MODNAME, __func__, __FILE__, fmt, __LINE__,		\
 		_DPRINTK_FLAGS_DEFAULT };				\
-	JUMP_LABEL(&descriptor.enabled, do_printk);			\
-	goto out;							\
-do_printk:								\
-	dev_printk(KERN_DEBUG, dev, fmt, ##__VA_ARGS__);		\
-out:	;								\
+	if (unlikely(descriptor.enabled))				\
+		dev_printk(KERN_DEBUG, dev, fmt, ##__VA_ARGS__);	\
 	} while (0)
 
 #else
lib/dynamic_debug.c +4 -5
@@ -141,11 +141,10 @@ static void ddebug_change(const struct d
 			else if (!dp->flags)
 				dt->num_enabled++;
 			dp->flags = newflags;
-			if (newflags) {
-				jump_label_enable(&dp->enabled);
-			} else {
-				jump_label_disable(&dp->enabled);
-			}
+			if (newflags)
+				dp->enabled = 1;
+			else
+				dp->enabled = 0;
 			if (verbose)
 				printk(KERN_INFO
 					"ddebug: changed %s:%d [%s]%s %s\n",
author
#115 lore raw

PATCH 115/272 RDMA/cxgb4: Dont re-init wait object in init/fini paths

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Steve Wise <[email protected]>

commit db8b10167126d72829653690f57b9c7ca53c4d54 upstream.

Re-initializing the wait object in rdma_init()/rdma_fini() causes a timing window which can lead to a deadlock during close. Once this deadlock hits, all RDMA activity over the T4 device will be stuck.

There's no need to re-init the wait object, so remove it.

---
 drivers/infiniband/hw/cxgb4/qp.c |    2 --
 1 file changed, 2 deletions(-)
drivers/infiniband/hw/cxgb4/qp.c +0 -2
@@ -1029,7 +1029,6 @@ static int rdma_fini(struct c4iw_dev *rh
 	wqe->cookie = (unsigned long) &ep->com.wr_wait;
 
 	wqe->u.fini.type = FW_RI_TYPE_FINI;
-	c4iw_init_wr_wait(&ep->com.wr_wait);
 	ret = c4iw_ofld_send(&rhp->rdev, skb);
 	if (ret)
 		goto out;
@@ -1125,7 +1124,6 @@ static int rdma_init(struct c4iw_dev *rh
 	if (qhp->attr.mpa_attr.initiator)
 		build_rtr_msg(qhp->attr.mpa_attr.p2p_type, &wqe->u.init);
 
-	c4iw_init_wr_wait(&qhp->ep->com.wr_wait);
 	ret = c4iw_ofld_send(&rhp->rdev, skb);
 	if (ret)
 		goto out;
author
#116 lore raw

PATCH 116/272 RDMA/cxgb4: Set the correct device physical function for iWARP connections

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Steve Wise <[email protected]>

commit 94788657c94169171971968c9d4b6222c5e704aa upstream.

The PF passed to FW was 0, causing PCI failures in an SR-IOV environment.

---
 drivers/infiniband/hw/cxgb4/cm.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/cxgb4/cm.c +1 -1
@@ -380,7 +380,7 @@ static void send_flowc(struct c4iw_ep *e
 					  16)) | FW_WR_FLOWID(ep->hwtid));
 
 	flowc->mnemval[0].mnemonic = FW_FLOWC_MNEM_PFNVFN;
-	flowc->mnemval[0].val = cpu_to_be32(0);
+	flowc->mnemval[0].val = cpu_to_be32(PCI_FUNC(ep->com.dev->rdev.lldi.pdev->devfn) << 8);
 	flowc->mnemval[1].mnemonic = FW_FLOWC_MNEM_CH;
 	flowc->mnemval[1].val = cpu_to_be32(ep->tx_chan);
 	flowc->mnemval[2].mnemonic = FW_FLOWC_MNEM_PORT;
author
#117 lore raw

PATCH 117/272 RDMA/cxgb4: Limit MAXBURST EQ context field to 256B

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Steve Wise <[email protected]>

commit 6a09a9d6946dd516d243d072bee83fae3c683471 upstream.

MAXBURST cannot exceed 256B for on-chip queues. With a 512B MAXBURST, we can lock up the chip.

---
 drivers/infiniband/hw/cxgb4/qp.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/infiniband/hw/cxgb4/qp.c +2 -2
@@ -220,7 +220,7 @@ static int create_qp(struct c4iw_rdev *r
 		V_FW_RI_RES_WR_DCAEN(0) |
 		V_FW_RI_RES_WR_DCACPU(0) |
 		V_FW_RI_RES_WR_FBMIN(2) |
-		V_FW_RI_RES_WR_FBMAX(3) |
+		V_FW_RI_RES_WR_FBMAX(2) |
 		V_FW_RI_RES_WR_CIDXFTHRESHO(0) |
 		V_FW_RI_RES_WR_CIDXFTHRESH(0) |
 		V_FW_RI_RES_WR_EQSIZE(eqsize));
@@ -243,7 +243,7 @@ static int create_qp(struct c4iw_rdev *r
 		V_FW_RI_RES_WR_DCAEN(0) |
 		V_FW_RI_RES_WR_DCACPU(0) |
 		V_FW_RI_RES_WR_FBMIN(2) |
-		V_FW_RI_RES_WR_FBMAX(3) |
+		V_FW_RI_RES_WR_FBMAX(2) |
 		V_FW_RI_RES_WR_CIDXFTHRESHO(0) |
 		V_FW_RI_RES_WR_CIDXFTHRESH(0) |
 		V_FW_RI_RES_WR_EQSIZE(eqsize));
author
#118 lore raw

PATCH 118/272 /proc/kcore: fix seeking

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Dave Anderson <[email protected]>

commit ceff1a770933e2ca2bf995b453dade4ec47a9878 upstream.

Commit 34aacb2920 ("procfs: Use generic_file_llseek in /proc/kcore") broke seeking on /proc/kcore. This changes it back to use default_llseek in order to restore the original behavior.

The problem with generic_file_llseek is that it only allows seeks up to inode->i_sb->s_maxbytes, which is 2GB-1 on procfs, where the memory file offset values in the /proc/kcore PT_LOAD segments may exceed or start beyond that offset value.

A similar revert was made for /proc/vmcore.

---
 fs/proc/kcore.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
fs/proc/kcore.c +1 -1
@@ -558,7 +558,7 @@ static int open_kcore(struct inode *inod
 static const struct file_operations proc_kcore_operations = {
 	.read		= read_kcore,
 	.open		= open_kcore,
-	.llseek		= generic_file_llseek,
+	.llseek		= default_llseek,
 };
 
 #ifdef CONFIG_MEMORY_HOTPLUG
author
#119 lore raw

PATCH 119/272 rtc-cmos: fix suspend/resume

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Paul Fox <[email protected]>

commit 2fb08e6ca9f00d1aedb3964983e9c8f84b36b807 upstream.

rtc-cmos was setting suspend/resume hooks at the device_driver level. However, the platform bus code (drivers/base/platform.c) only looks for resume hooks at the dev_pm_ops level, or within the platform_driver.

Switch rtc_cmos to use dev_pm_ops so that suspend/resume code is executed again.

Paul said:

: The user visible symptom in our (XO laptop) case was that rtcwake would : fail to wake the laptop. The RTC alarm would expire, but the wakeup : wasn't unmasked.
:
: As for severity, the impact may have been reduced because if I recall : correctly, the bug only affected platforms with CONFIG_PNP disabled.

---
 drivers/rtc/rtc-cmos.c |   16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/rtc/rtc-cmos.c +9 -7
@@ -36,6 +36,7 @@
 #include <linux/platform_device.h>
 #include <linux/mod_devicetable.h>
 #include <linux/log2.h>
+#include <linux/pm.h>
 
 /* this is for "generic access to PC-style RTC" using CMOS_READ/CMOS_WRITE */
 #include <asm-generic/rtc.h>
@@ -850,7 +851,7 @@ static void __exit cmos_do_remove(struct
 
 #ifdef	CONFIG_PM
 
-static int cmos_suspend(struct device *dev, pm_message_t mesg)
+static int cmos_suspend(struct device *dev)
 {
 	struct cmos_rtc	*cmos = dev_get_drvdata(dev);
 	unsigned char	tmp;
@@ -898,7 +899,7 @@ static int cmos_suspend(struct device *d
  */
 static inline int cmos_poweroff(struct device *dev)
 {
-	return cmos_suspend(dev, PMSG_HIBERNATE);
+	return cmos_suspend(dev);
 }
 
 static int cmos_resume(struct device *dev)
@@ -945,9 +946,9 @@ static int cmos_resume(struct device *de
 	return 0;
 }
 
+static SIMPLE_DEV_PM_OPS(cmos_pm_ops, cmos_suspend, cmos_resume);
+
 #else
-#define	cmos_suspend	NULL
-#define	cmos_resume	NULL
 
 static inline int cmos_poweroff(struct device *dev)
 {
@@ -1077,7 +1078,7 @@ static void __exit cmos_pnp_remove(struc
 
 static int cmos_pnp_suspend(struct pnp_dev *pnp, pm_message_t mesg)
 {
-	return cmos_suspend(&pnp->dev, mesg);
+	return cmos_suspend(&pnp->dev);
 }
 
 static int cmos_pnp_resume(struct pnp_dev *pnp)
@@ -1157,8 +1158,9 @@ static struct platform_driver cmos_platf
 	.shutdown	= cmos_platform_shutdown,
 	.driver = {
 		.name		= (char *) driver_name,
-		.suspend	= cmos_suspend,
-		.resume		= cmos_resume,
+#ifdef CONFIG_PM
+		.pm		= &cmos_pm_ops,
+#endif
 	}
 };
 
author
#120 lore raw

PATCH 120/272 kref: add kref_test_and_get

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Jerome Marchand <[email protected]>

commit e4a683c899cd5a49f8d684a054c95bd115a0c005 upstream.

Add kref_test_and_get() function, which atomically add a reference only if refcount is not zero. This prevent to add a reference to an object that is already being removed.

---
 include/linux/kref.h |    1 +
 lib/kref.c           |   12 ++++++++++++
 2 files changed, 13 insertions(+)
include/linux/kref.h +1 -0
@@ -23,6 +23,7 @@ struct kref {
 
 void kref_init(struct kref *kref);
 void kref_get(struct kref *kref);
+int kref_test_and_get(struct kref *kref);
 int kref_put(struct kref *kref, void (*release) (struct kref *kref));
 
 #endif /* _KREF_H_ */
lib/kref.c +12 -0
@@ -37,6 +37,18 @@ void kref_get(struct kref *kref)
 }
 
 /**
+ * kref_test_and_get - increment refcount for object only if refcount is not
+ * zero.
+ * @kref: object.
+ *
+ * Return non-zero if the refcount was incremented, 0 otherwise
+ */
+int kref_test_and_get(struct kref *kref)
+{
+	return atomic_inc_not_zero(&kref->refcount);
+}
+
+/**
  * kref_put - decrement refcount for object.
  * @kref: object.
  * @release: pointer to the function that will clean up the object when the
author
#121 lore raw

PATCH 121/272 block: fix accounting bug on cross partition merges

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Jerome Marchand <[email protected]>

commit 09e099d4bafea3b15be003d548bdf94b4b6e0e17 upstream.

/proc/diskstats would display a strange output as follows.

$ cat /proc/diskstats |grep sda
   8       0 sda 90524 7579 102154 20464 0 0 0 0 0 14096 20089
   8       1 sda1 19085 1352 21841 4209 0 0 0 0 4294967064 15689 4293424691
                                                ~~~~~~~~~~
   8       2 sda2 71252 3624 74891 15950 0 0 0 0 232 23995 1562390
   8       3 sda3 54 487 2188 92 0 0 0 0 0 88 92
   8       4 sda4 4 0 8 0 0 0 0 0 0 0 0
   8       5 sda5 81 2027 2130 138 0 0 0 0 0 87 137

Its reason is the wrong way of accounting hd_struct->in_flight. When a bio is merged into a request belongs to different partition by ELEVATOR_FRONT_MERGE.

The detailed root cause is as follows.

Assuming that there are two partition, sda1 and sda2.

1. A request for sda2 is in request_queue. Hence sda1's hd_struct->in_flight is 0 and sda2's one is 1.

        | hd_struct->in_flight
   ---------------------------
   sda1 |          0
   sda2 |          1

---------------------------

2. A bio belongs to sda1 is issued and is merged into the request mentioned on step1 by ELEVATOR_BACK_MERGE. The first sector of the request is changed from sda2 region to sda1 region. However the two partition's hd_struct->in_flight are not changed.

        | hd_struct->in_flight
   ---------------------------
   sda1 |          0
   sda2 |          1

---------------------------

3. The request is finished and blk_account_io_done() is called. In this case, sda2's hd_struct->in_flight, not a sda1's one, is decremented.

        | hd_struct->in_flight
   ---------------------------
   sda1 |         -1
   sda2 |          1

---------------------------

The patch fixes the problem by caching the partition lookup inside the request structure, hence making sure that the increment and decrement will always happen on the same partition struct. This also speeds up IO with accounting enabled, since it cuts down on the number of lookups we have to do.

Also add a refcount to struct hd_struct to keep the partition in memory as long as users exist. We use kref_test_and_get() to ensure we don't add a reference to a partition which is going away.

---
 block/blk-core.c       |   26 +++++++++++++++++++++-----
 block/blk-merge.c      |    3 ++-
 block/genhd.c          |    1 +
 fs/partitions/check.c  |   10 +++++++++-
 include/linux/blkdev.h |    1 +
 include/linux/genhd.h  |    2 ++
 6 files changed, 36 insertions(+), 7 deletions(-)
block/blk-core.c +21 -5
@@ -64,13 +64,27 @@ static void drive_stat_acct(struct reque
 		return;
 
 	cpu = part_stat_lock();
-	part = disk_map_sector_rcu(rq->rq_disk, blk_rq_pos(rq));
 
-	if (!new_io)
+	if (!new_io) {
+		part = rq->part;
 		part_stat_inc(cpu, part, merges[rw]);
-	else {
+	} else {
+		part = disk_map_sector_rcu(rq->rq_disk, blk_rq_pos(rq));
+		if (!kref_test_and_get(&part->ref)) {
+			/*
+			 * The partition is already being removed,
+			 * the request will be accounted on the disk only
+			 *
+			 * We take a reference on disk->part0 although that
+			 * partition will never be deleted, so we can treat
+			 * it as any other partition.
+			 */
+			part = &rq->rq_disk->part0;
+			kref_get(&part->ref);
+		}
 		part_round_stats(cpu, part);
 		part_inc_in_flight(part, rw);
+		rq->part = part;
 	}
 
 	part_stat_unlock();
@@ -128,6 +142,7 @@ void blk_rq_init(struct request_queue *q
 	rq->ref_count = 1;
 	rq->start_time = jiffies;
 	set_start_time_ns(rq);
+	rq->part = NULL;
 }
 EXPORT_SYMBOL(blk_rq_init);
 
@@ -1776,7 +1791,7 @@ static void blk_account_io_completion(st
 		int cpu;
 
 		cpu = part_stat_lock();
-		part = disk_map_sector_rcu(req->rq_disk, blk_rq_pos(req));
+		part = req->part;
 		part_stat_add(cpu, part, sectors[rw], bytes >> 9);
 		part_stat_unlock();
 	}
@@ -1796,13 +1811,14 @@ static void blk_account_io_done(struct r
 		int cpu;
 
 		cpu = part_stat_lock();
-		part = disk_map_sector_rcu(req->rq_disk, blk_rq_pos(req));
+		part = req->part;
 
 		part_stat_inc(cpu, part, ios[rw]);
 		part_stat_add(cpu, part, ticks[rw], duration);
 		part_round_stats(cpu, part);
 		part_dec_in_flight(part, rw);
 
+		kref_put(&part->ref, __delete_partition);
 		part_stat_unlock();
 	}
 }
block/blk-merge.c +2 -1
@@ -351,11 +351,12 @@ static void blk_account_io_merge(struct
 		int cpu;
 
 		cpu = part_stat_lock();
-		part = disk_map_sector_rcu(req->rq_disk, blk_rq_pos(req));
+		part = req->part;
 
 		part_round_stats(cpu, part);
 		part_dec_in_flight(part, rq_data_dir(req));
 
+		kref_put(&part->ref, __delete_partition);
 		part_stat_unlock();
 	}
 }
block/genhd.c +1 -0
@@ -1192,6 +1192,7 @@ struct gendisk *alloc_disk_node(int mino
 			return NULL;
 		}
 		disk->part_tbl->part[0] = &disk->part0;
+		kref_init(&disk->part0.ref);
 
 		disk->minors = minors;
 		rand_initialize_disk(disk);
fs/partitions/check.c +9 -1
@@ -372,6 +372,13 @@ static void delete_partition_rcu_cb(stru
 	put_device(part_to_dev(part));
 }
 
+void __delete_partition(struct kref *ref)
+{
+	struct hd_struct *part = container_of(ref, struct hd_struct, ref);
+
+	call_rcu(&part->rcu_head, delete_partition_rcu_cb);
+}
+
 void delete_partition(struct gendisk *disk, int partno)
 {
 	struct disk_part_tbl *ptbl = disk->part_tbl;
@@ -390,7 +397,7 @@ void delete_partition(struct gendisk *di
 	kobject_put(part->holder_dir);
 	device_del(part_to_dev(part));
 
-	call_rcu(&part->rcu_head, delete_partition_rcu_cb);
+	kref_put(&part->ref, __delete_partition);
 }
 
 static ssize_t whole_disk_show(struct device *dev,
@@ -489,6 +496,7 @@ struct hd_struct *add_partition(struct g
 	if (!dev_get_uevent_suppress(ddev))
 		kobject_uevent(&pdev->kobj, KOBJ_ADD);
 
+	kref_init(&p->ref);
 	return p;
 
 out_free_info:
include/linux/blkdev.h +1 -0
@@ -115,6 +115,7 @@ struct request {
 	void *elevator_private3;
 
 	struct gendisk *rq_disk;
+	struct hd_struct *part;
 	unsigned long start_time;
 #ifdef CONFIG_BLK_CGROUP
 	unsigned long long start_time_ns;
include/linux/genhd.h +2 -0
@@ -116,6 +116,7 @@ struct hd_struct {
 	struct disk_stats dkstats;
 #endif
 	struct rcu_head rcu_head;
+	struct kref ref;
 };
 
 #define GENHD_FL_REMOVABLE			1
@@ -583,6 +584,7 @@ extern struct hd_struct * __must_check a
 						     sector_t len, int flags,
 						     struct partition_meta_info
 						       *info);
+extern void __delete_partition(struct kref *ref);
 extern void delete_partition(struct gendisk *, int);
 extern void printk_all_partitions(void);
 
author
#122 lore raw

PATCH 122/272 mm: migration: use rcu_dereference_protected when dereferencing the radix tree slot during file page migration

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Mel Gorman <[email protected]>

commit 29c1f677d424e8c5683a837fc4f03fc9f19201d7 upstream.

migrate_pages() -> unmap_and_move() only calls rcu_read_lock() for anonymous pages, as introduced by git commit 989f89c57e6361e7d16fbd9572b5da7d313b073d ("fix rcu_read_lock() in page migraton"). The point of the RCU protection there is part of getting a stable reference to anon_vma and is only held for anon pages as file pages are locked which is sufficient protection against freeing.

However, while a file page's mapping is being migrated, the radix tree is double checked to ensure it is the expected page. This uses radix_tree_deref_slot() -> rcu_dereference() without the RCU lock held triggering the following warning.

[  173.674290] ===================================================
[  173.676016] [ INFO: suspicious rcu_dereference_check() usage. ]
[  173.676016] ---------------------------------------------------
[  173.676016] include/linux/radix-tree.h:145 invoked rcu_dereference_check() without protection!
[  173.676016]
[  173.676016] other info that might help us debug this:
[  173.676016]
[  173.676016]
[  173.676016] rcu_scheduler_active = 1, debug_locks = 0
[  173.676016] 1 lock held by hugeadm/2899:
[  173.676016]  #0:  (&(&inode->i_data.tree_lock)->rlock){..-.-.}, at: [<c10e3d2b>] migrate_page_move_mapping+0x40/0x1ab
[  173.676016]
[  173.676016] stack backtrace:
[  173.676016] Pid: 2899, comm: hugeadm Not tainted 2.6.37-rc5-autobuild
[  173.676016] Call Trace:
[  173.676016]  [<c128cc01>] ? printk+0x14/0x1b
[  173.676016]  [<c1063502>] lockdep_rcu_dereference+0x7d/0x86
[  173.676016]  [<c10e3db5>] migrate_page_move_mapping+0xca/0x1ab
[  173.676016]  [<c10e41ad>] migrate_page+0x23/0x39
[  173.676016]  [<c10e491b>] buffer_migrate_page+0x22/0x107
[  173.676016]  [<c10e48f9>] ? buffer_migrate_page+0x0/0x107
[  173.676016]  [<c10e425d>] move_to_new_page+0x9a/0x1ae
[  173.676016]  [<c10e47e6>] migrate_pages+0x1e7/0x2fa

This patch introduces radix_tree_deref_slot_protected() which calls rcu_dereference_protected(). Users of it must pass in the mapping->tree_lock that is protecting this dereference. Holding the tree lock protects against parallel updaters of the radix tree meaning that rcu_dereference_protected is allowable.

[[email protected]: remove unneeded casts]
Cc Minchan Kim <[email protected]>
Cc KAMEZAWA Hiroyuki <[email protected]>
Cc Milton Miller <[email protected]>
Cc Nick Piggin <[email protected]>
Cc Wu Fengguang <[email protected]>
---
 include/linux/radix-tree.h |   16 ++++++++++++++++
 mm/migrate.c               |    4 ++--
 2 files changed, 18 insertions(+), 2 deletions(-)
include/linux/radix-tree.h +16 -0
@@ -146,6 +146,22 @@ static inline void *radix_tree_deref_slo
 }
 
 /**
+ * radix_tree_deref_slot_protected	- dereference a slot without RCU lock but with tree lock held
+ * @pslot:	pointer to slot, returned by radix_tree_lookup_slot
+ * Returns:	item that was stored in that slot with any direct pointer flag
+ *		removed.
+ *
+ * Similar to radix_tree_deref_slot but only used during migration when a pages
+ * mapping is being moved. The caller does not hold the RCU read lock but it
+ * must hold the tree lock to prevent parallel updates.
+ */
+static inline void *radix_tree_deref_slot_protected(void **pslot,
+							spinlock_t *treelock)
+{
+	return rcu_dereference_protected(*pslot, lockdep_is_held(treelock));
+}
+
+/**
  * radix_tree_deref_retry	- check radix_tree_deref_slot
  * @arg:	pointer returned by radix_tree_deref_slot
  * Returns:	0 if retry is not required, otherwise retry is required
mm/migrate.c +2 -2
@@ -246,7 +246,7 @@ static int migrate_page_move_mapping(str
 
 	expected_count = 2 + page_has_private(page);
 	if (page_count(page) != expected_count ||
-			(struct page *)radix_tree_deref_slot(pslot) != page) {
+		radix_tree_deref_slot_protected(pslot, &mapping->tree_lock) != page) {
 		spin_unlock_irq(&mapping->tree_lock);
 		return -EAGAIN;
 	}
@@ -318,7 +318,7 @@ int migrate_huge_page_move_mapping(struc
 
 	expected_count = 2 + page_has_private(page);
 	if (page_count(page) != expected_count ||
-	    (struct page *)radix_tree_deref_slot(pslot) != page) {
+		radix_tree_deref_slot_protected(pslot, &mapping->tree_lock) != page) {
 		spin_unlock_irq(&mapping->tree_lock);
 		return -EAGAIN;
 	}
author
#123 lore raw

PATCH 123/272 mm: fix migration hangs on anon_vma lock

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Hugh Dickins <[email protected]>

commit 1ce82b69e96c838d007f316b8347b911fdfa9842 upstream.

Increased usage of page migration in mmotm reveals that the anon_vma locking in unmap_and_move() has been deficient since 2.6.36 (or even earlier). Review at the time of f18194275c39835cb84563500995e0d503a32d9a ("mm: fix hang on anon_vma->root->lock") missed the issue here: the anon_vma to which we get a reference may already have been freed back to its slab (it is in use when we check page_mapped, but that can change), and so its anon_vma->root may be switched at any moment by reuse in anon_vma_prepare.

Perhaps we could fix that with a get_anon_vma_unless_zero(), but let's
not: just rely on page_lock_anon_vma() to do all the hard thinking for us, then we don't need any rcu read locking over here.

In removing the rcu_unlock label: since PageAnon is a bit in page->mapping, it's impossible for a !page->mapping page to be anon; but insert VM_BUG_ON in case the implementation ever changes.

---
 mm/migrate.c |   48 +++++++++++++++++++-----------------------------
 1 file changed, 19 insertions(+), 29 deletions(-)
mm/migrate.c +19 -29
@@ -620,7 +620,6 @@ static int unmap_and_move(new_page_t get
 	int *result = NULL;
 	struct page *newpage = get_new_page(page, private, &result);
 	int remap_swapcache = 1;
-	int rcu_locked = 0;
 	int charge = 0;
 	struct mem_cgroup *mem = NULL;
 	struct anon_vma *anon_vma = NULL;
@@ -672,20 +671,26 @@ static int unmap_and_move(new_page_t get
 	/*
 	 * By try_to_unmap(), page->mapcount goes down to 0 here. In this case,
 	 * we cannot notice that anon_vma is freed while we migrates a page.
-	 * This rcu_read_lock() delays freeing anon_vma pointer until the end
+	 * This get_anon_vma() delays freeing anon_vma pointer until the end
 	 * of migration. File cache pages are no problem because of page_lock()
 	 * File Caches may use write_page() or lock_page() in migration, then,
 	 * just care Anon page here.
 	 */
 	if (PageAnon(page)) {
-		rcu_read_lock();
-		rcu_locked = 1;
-
-		/* Determine how to safely use anon_vma */
-		if (!page_mapped(page)) {
-			if (!PageSwapCache(page))
-				goto rcu_unlock;
-
+		/*
+		 * Only page_lock_anon_vma() understands the subtleties of
+		 * getting a hold on an anon_vma from outside one of its mms.
+		 */
+		anon_vma = page_lock_anon_vma(page);
+		if (anon_vma) {
+			/*
+			 * Take a reference count on the anon_vma if the
+			 * page is mapped so that it is guaranteed to
+			 * exist when the page is remapped later
+			 */
+			get_anon_vma(anon_vma);
+			page_unlock_anon_vma(anon_vma);
+		} else if (PageSwapCache(page)) {
 			/*
 			 * We cannot be sure that the anon_vma of an unmapped
 			 * swapcache page is safe to use because we don't
@@ -700,13 +705,7 @@ static int unmap_and_move(new_page_t get
 			 */
 			remap_swapcache = 0;
 		} else {
-			/*
-			 * Take a reference count on the anon_vma if the
-			 * page is mapped so that it is guaranteed to
-			 * exist when the page is remapped later
-			 */
-			anon_vma = page_anon_vma(page);
-			get_anon_vma(anon_vma);
+			goto uncharge;
 		}
 	}
 
@@ -723,16 +722,10 @@ static int unmap_and_move(new_page_t get
 	 * free the metadata, so the page can be freed.
 	 */
 	if (!page->mapping) {
-		if (!PageAnon(page) && page_has_private(page)) {
-			/*
-			 * Go direct to try_to_free_buffers() here because
-			 * a) that's what try_to_release_page() would do anyway
-			 * b) we may be under rcu_read_lock() here, so we can't
-			 *    use GFP_KERNEL which is what try_to_release_page()
-			 *    needs to be effective.
-			 */
+		VM_BUG_ON(PageAnon(page));
+		if (page_has_private(page)) {
 			try_to_free_buffers(page);
-			goto rcu_unlock;
+			goto uncharge;
 		}
 		goto skip_unmap;
 	}
@@ -746,14 +739,11 @@ skip_unmap:
 
 	if (rc && remap_swapcache)
 		remove_migration_ptes(page, page);
-rcu_unlock:
 
 	/* Drop an anon_vma reference if we took one */
 	if (anon_vma)
 		drop_anon_vma(anon_vma);
 
-	if (rcu_locked)
-		rcu_read_unlock();
 uncharge:
 	if (!charge)
 		mem_cgroup_end_migration(mem, page, newpage);
author
#124 lore raw

PATCH 124/272 mm: fix hugepage migration

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Hugh Dickins <[email protected]>

commit fd4a4663db293bfd5dc20fb4113977f62895e550 upstream.

2.6.37 added an unmap_and_move_huge_page() for memory failure recovery, but its anon_vma handling was still based around the 2.6.35 conventions. Update it to use page_lock_anon_vma, get_anon_vma, page_unlock_anon_vma, drop_anon_vma in the same way as we're now changing unmap_and_move().

I don't particularly like to propose this for stable when I've not seen its problems in practice nor tested the solution: but it's clearly out of synch at present.

---
 mm/migrate.c |   23 ++++++-----------------
 1 file changed, 6 insertions(+), 17 deletions(-)
mm/migrate.c +6 -17
@@ -805,7 +805,6 @@ static int unmap_and_move_huge_page(new_
 	int rc = 0;
 	int *result = NULL;
 	struct page *new_hpage = get_new_page(hpage, private, &result);
-	int rcu_locked = 0;
 	struct anon_vma *anon_vma = NULL;
 
 	if (!new_hpage)
@@ -820,12 +819,10 @@ static int unmap_and_move_huge_page(new_
 	}
 
 	if (PageAnon(hpage)) {
-		rcu_read_lock();
-		rcu_locked = 1;
-
-		if (page_mapped(hpage)) {
-			anon_vma = page_anon_vma(hpage);
-			atomic_inc(&anon_vma->external_refcount);
+		anon_vma = page_lock_anon_vma(hpage);
+		if (anon_vma) {
+			get_anon_vma(anon_vma);
+			page_unlock_anon_vma(anon_vma);
 		}
 	}
 
@@ -837,16 +834,8 @@ static int unmap_and_move_huge_page(new_
 	if (rc)
 		remove_migration_ptes(hpage, hpage);
 
-	if (anon_vma && atomic_dec_and_lock(&anon_vma->external_refcount,
-					    &anon_vma->lock)) {
-		int empty = list_empty(&anon_vma->head);
-		spin_unlock(&anon_vma->lock);
-		if (empty)
-			anon_vma_free(anon_vma);
-	}
-
-	if (rcu_locked)
-		rcu_read_unlock();
+	if (anon_vma)
+		drop_anon_vma(anon_vma);
 out:
 	unlock_page(hpage);
 
author
#125 lore raw

PATCH 125/272 genirq: Prevent irq storm on migration

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Thomas Gleixner <[email protected]>

commit f1a06390d013244e721372b3f9b66e39b6429c71 upstream.

move_native_irq() masks and unmasks the interrupt line unconditionally, but the interrupt line might be masked due to a threaded oneshot handler in progress. Unmasking the line in that case can lead to interrupt storms. Observed on PREEMPT_RT.

Originally-from: Ingo Molnar <[email protected]>

---
 kernel/irq/migration.c |   14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)
kernel/irq/migration.c +11 -3
@@ -56,6 +56,7 @@ void move_masked_irq(int irq)
 void move_native_irq(int irq)
 {
 	struct irq_desc *desc = irq_to_desc(irq);
+	bool masked;
 
 	if (likely(!(desc->status & IRQ_MOVE_PENDING)))
 		return;
@@ -63,8 +64,15 @@ void move_native_irq(int irq)
 	if (unlikely(desc->status & IRQ_DISABLED))
 		return;
 
-	desc->irq_data.chip->irq_mask(&desc->irq_data);
+	/*
+	 * Be careful vs. already masked interrupts. If this is a
+	 * threaded interrupt with ONESHOT set, we can end up with an
+	 * interrupt storm.
+	 */
+	masked = desc->status & IRQ_MASKED;
+	if (!masked)
+		desc->irq_data.chip->irq_mask(&desc->irq_data);
 	move_masked_irq(irq);
-	desc->irq_data.chip->irq_unmask(&desc->irq_data);
+	if (!masked)
+		desc->irq_data.chip->irq_unmask(&desc->irq_data);
 }
-
author
#126 lore raw

PATCH 126/272 writeback: integrated background writeback work

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Jan Kara <[email protected]>

commit 6585027a5e8cb490e3a761b2f3f3c3acf722aff2 upstream.

Check whether background writeback is needed after finishing each work.

When bdi flusher thread finishes doing some work check whether any kind of background writeback needs to be done (either because dirty_background_ratio is exceeded or because we need to start flushing old inodes). If so, just do background write back.

This way, bdi_start_background_writeback() just needs to wake up the flusher thread. It will do background writeback as soon as there is no other work.

This is a preparatory patch for the next patch which stops background writeback as soon as there is other work to do.

---
 fs/fs-writeback.c |   61 ++++++++++++++++++++++++++++++++++++++++--------------
 1 file changed, 46 insertions(+), 15 deletions(-)
fs/fs-writeback.c +46 -15
@@ -84,13 +84,9 @@ static inline struct inode *wb_inode(str
 	return list_entry(head, struct inode, i_wb_list);
 }
 
-static void bdi_queue_work(struct backing_dev_info *bdi,
-		struct wb_writeback_work *work)
+/* Wakeup flusher thread or forker thread to fork it. Requires bdi->wb_lock. */
+static void bdi_wakeup_flusher(struct backing_dev_info *bdi)
 {
-	trace_writeback_queue(bdi, work);
-
-	spin_lock_bh(&bdi->wb_lock);
-	list_add_tail(&work->list, &bdi->work_list);
 	if (bdi->wb.task) {
 		wake_up_process(bdi->wb.task);
 	} else {
@@ -98,15 +94,26 @@ static void bdi_queue_work(struct backin
 		 * The bdi thread isn't there, wake up the forker thread which
 		 * will create and run it.
 		 */
-		trace_writeback_nothread(bdi, work);
 		wake_up_process(default_backing_dev_info.wb.task);
 	}
+}
+
+static void bdi_queue_work(struct backing_dev_info *bdi,
+			   struct wb_writeback_work *work)
+{
+	trace_writeback_queue(bdi, work);
+
+	spin_lock_bh(&bdi->wb_lock);
+	list_add_tail(&work->list, &bdi->work_list);
+	if (!bdi->wb.task)
+		trace_writeback_nothread(bdi, work);
+	bdi_wakeup_flusher(bdi);
 	spin_unlock_bh(&bdi->wb_lock);
 }
 
 static void
 __bdi_start_writeback(struct backing_dev_info *bdi, long nr_pages,
-		bool range_cyclic, bool for_background)
+		      bool range_cyclic)
 {
 	struct wb_writeback_work *work;
 
@@ -126,7 +133,6 @@ __bdi_start_writeback(struct backing_dev
 	work->sync_mode	= WB_SYNC_NONE;
 	work->nr_pages	= nr_pages;
 	work->range_cyclic = range_cyclic;
-	work->for_background = for_background;
 
 	bdi_queue_work(bdi, work);
 }
@@ -144,7 +150,7 @@ __bdi_start_writeback(struct backing_dev
  */
 void bdi_start_writeback(struct backing_dev_info *bdi, long nr_pages)
 {
-	__bdi_start_writeback(bdi, nr_pages, true, false);
+	__bdi_start_writeback(bdi, nr_pages, true);
 }
 
 /**
@@ -152,13 +158,20 @@ void bdi_start_writeback(struct backing_
  * @bdi: the backing device to write from
  *
  * Description:
- *   This does WB_SYNC_NONE background writeback. The IO is only
- *   started when this function returns, we make no guarentees on
- *   completion. Caller need not hold sb s_umount semaphore.
+ *   This makes sure WB_SYNC_NONE background writeback happens. When
+ *   this function returns, it is only guaranteed that for given BDI
+ *   some IO is happening if we are over background dirty threshold.
+ *   Caller need not hold sb s_umount semaphore.
  */
 void bdi_start_background_writeback(struct backing_dev_info *bdi)
 {
-	__bdi_start_writeback(bdi, LONG_MAX, true, true);
+	/*
+	 * We just wake up the flusher thread. It will perform background
+	 * writeback as soon as there is no other work to do.
+	 */
+	spin_lock_bh(&bdi->wb_lock);
+	bdi_wakeup_flusher(bdi);
+	spin_unlock_bh(&bdi->wb_lock);
 }
 
 /*
@@ -718,6 +731,23 @@ static unsigned long get_nr_dirty_pages(
 		get_nr_dirty_inodes();
 }
 
+static long wb_check_background_flush(struct bdi_writeback *wb)
+{
+	if (over_bground_thresh()) {
+
+		struct wb_writeback_work work = {
+			.nr_pages	= LONG_MAX,
+			.sync_mode	= WB_SYNC_NONE,
+			.for_background	= 1,
+			.range_cyclic	= 1,
+		};
+
+		return wb_writeback(wb, &work);
+	}
+
+	return 0;
+}
+
 static long wb_check_old_data_flush(struct bdi_writeback *wb)
 {
 	unsigned long expired;
@@ -787,6 +817,7 @@ long wb_do_writeback(struct bdi_writebac
 	 * Check for periodic writeback, kupdated() style
 	 */
 	wrote += wb_check_old_data_flush(wb);
+	wrote += wb_check_background_flush(wb);
 	clear_bit(BDI_writeback_running, &wb->bdi->state);
 
 	return wrote;
@@ -873,7 +904,7 @@ void wakeup_flusher_threads(long nr_page
 	list_for_each_entry_rcu(bdi, &bdi_list, bdi_list) {
 		if (!bdi_has_dirty_io(bdi))
 			continue;
-		__bdi_start_writeback(bdi, nr_pages, false, false);
+		__bdi_start_writeback(bdi, nr_pages, false);
 	}
 	rcu_read_unlock();
 }
author
#127 lore raw

PATCH 127/272 writeback: stop background/kupdate works from livelocking other works

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Jan Kara <[email protected]>

commit aa373cf550994623efb5d49a4d8775bafd10bbc1 upstream.

Background writeback is easily livelockable in a loop in wb_writeback() by a process continuously re-dirtying pages (or continuously appending to a file). This is in fact intended as the target of background writeback is to write dirty pages it can find as long as we are over dirty_background_threshold.

But the above behavior gets inconvenient at times because no other work queued in the flusher thread's queue gets processed. In particular, since e.g. sync(1) relies on flusher thread to do all the IO for it, sync(1) can hang forever waiting for flusher thread to do the work.

Generally, when a flusher thread has some work queued, someone submitted the work to achieve a goal more specific than what background writeback does. Moreover by working on the specific work, we also reduce amount of dirty pages which is exactly the target of background writeout. So it makes sense to give specific work a priority over a generic page cleaning.

Thus we interrupt background writeback if there is some other work to do. We return to the background writeback after completing all the queued work.

This may delay the writeback of expired inodes for a while, however the expired inodes will eventually be flushed to disk as long as the other works won't livelock.

[[email protected]: update comment]
Cc Johannes Weiner <[email protected]>
Cc Dave Chinner <[email protected]>
Cc Christoph Hellwig <[email protected]>
Cc Jan Engelhardt <[email protected]>
Cc Jens Axboe <[email protected]>
---
 fs/fs-writeback.c |   10 ++++++++++
 1 file changed, 10 insertions(+)
fs/fs-writeback.c +10 -0
@@ -650,6 +650,16 @@ static long wb_writeback(struct bdi_writ
 			break;
 
 		/*
+		 * Background writeout and kupdate-style writeback may
+		 * run forever. Stop them if there is other work to do
+		 * so that e.g. sync can proceed. They'll be restarted
+		 * after the other works are all done.
+		 */
+		if ((work->for_background || work->for_kupdate) &&
+		    !list_empty(&wb->bdi->work_list))
+			break;
+
+		/*
 		 * For background writeout, stop when we are below the
 		 * background dirty threshold
 		 */
author
#128 lore raw

PATCH 128/272 writeback: avoid livelocking WB_SYNC_ALL writeback

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Jan Kara <[email protected]>

commit b9543dac5bbc4aef0a598965b6b34f6259ab9a9b upstream.

When wb_writeback() is called in WB_SYNC_ALL mode, work->nr_to_write is usually set to LONG_MAX. The logic in wb_writeback() then calls __writeback_inodes_sb() with nr_to_write == MAX_WRITEBACK_PAGES and we easily end up with non-positive nr_to_write after the function returns, if the inode has more than MAX_WRITEBACK_PAGES dirty pages at the moment.

When nr_to_write is <= 0 wb_writeback() decides we need another round of writeback but this is wrong in some cases! For example when a single large file is continuously dirtied, we would never finish syncing it because each pass would be able to write MAX_WRITEBACK_PAGES and inode dirty timestamp never gets updated (as inode is never completely clean). Thus __writeback_inodes_sb() would write the redirtied inode again and again.

Fix the issue by setting nr_to_write to LONG_MAX in WB_SYNC_ALL mode. We do not need nr_to_write in WB_SYNC_ALL mode anyway since write_cache_pages() does livelock avoidance using page tagging in WB_SYNC_ALL mode.

This makes wb_writeback() call __writeback_inodes_sb() only once on WB_SYNC_ALL. The latter function won't livelock because it works on

- a finite set of files by doing queue_io() once at the beginning
- a finite set of pages by PAGECACHE_TAG_TOWRITE page tagging

After this patch, program from http://lkml.org/lkml/2010/10/24/154 is no longer able to stall sync forever.

[[email protected]: fix locking comment]
Cc Johannes Weiner <[email protected]>
Cc Dave Chinner <[email protected]>
Cc Christoph Hellwig <[email protected]>
Cc Jan Engelhardt <[email protected]>
Cc Jens Axboe <[email protected]>
---
 fs/fs-writeback.c |   27 +++++++++++++++++++++++----
 1 file changed, 23 insertions(+), 4 deletions(-)
fs/fs-writeback.c +23 -4
@@ -629,6 +629,7 @@ static long wb_writeback(struct bdi_writ
 	};
 	unsigned long oldest_jif;
 	long wrote = 0;
+	long write_chunk;
 	struct inode *inode;
 
 	if (wbc.for_kupdate) {
@@ -641,6 +642,24 @@ static long wb_writeback(struct bdi_writ
 		wbc.range_end = LLONG_MAX;
 	}
 
+	/*
+	 * WB_SYNC_ALL mode does livelock avoidance by syncing dirty
+	 * inodes/pages in one big loop. Setting wbc.nr_to_write=LONG_MAX
+	 * here avoids calling into writeback_inodes_wb() more than once.
+	 *
+	 * The intended call sequence for WB_SYNC_ALL writeback is:
+	 *
+	 *      wb_writeback()
+	 *          __writeback_inodes_sb()     <== called only once
+	 *              write_cache_pages()     <== called once for each inode
+	 *                   (quickly) tag currently dirty pages
+	 *                   (maybe slowly) sync all tagged pages
+	 */
+	if (wbc.sync_mode == WB_SYNC_NONE)
+		write_chunk = MAX_WRITEBACK_PAGES;
+	else
+		write_chunk = LONG_MAX;
+
 	wbc.wb_start = jiffies; /* livelock avoidance */
 	for (;;) {
 		/*
@@ -667,7 +686,7 @@ static long wb_writeback(struct bdi_writ
 			break;
 
 		wbc.more_io = 0;
-		wbc.nr_to_write = MAX_WRITEBACK_PAGES;
+		wbc.nr_to_write = write_chunk;
 		wbc.pages_skipped = 0;
 
 		trace_wbc_writeback_start(&wbc, wb->bdi);
@@ -677,8 +696,8 @@ static long wb_writeback(struct bdi_writ
 			writeback_inodes_wb(wb, &wbc);
 		trace_wbc_writeback_written(&wbc, wb->bdi);
 
-		work->nr_pages -= MAX_WRITEBACK_PAGES - wbc.nr_to_write;
-		wrote += MAX_WRITEBACK_PAGES - wbc.nr_to_write;
+		work->nr_pages -= write_chunk - wbc.nr_to_write;
+		wrote += write_chunk - wbc.nr_to_write;
 
 		/*
 		 * If we consumed everything, see if we have more
@@ -693,7 +712,7 @@ static long wb_writeback(struct bdi_writ
 		/*
 		 * Did we write something? Try for more
 		 */
-		if (wbc.nr_to_write < MAX_WRITEBACK_PAGES)
+		if (wbc.nr_to_write < write_chunk)
 			continue;
 		/*
 		 * Nothing written. Wait for some inode to
author
#129 lore raw

PATCH 129/272 ext4: fix uninitialized variable in ext4_register_li_request

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Andrew Morton <[email protected]>

commit 6c5a6cb998854f3c579ecb2bc1423d302bcb1b76 upstream.

fs/ext4/super.c: In function 'ext4_register_li_request':
fs/ext4/super.c:2936: warning: 'ret' may be used uninitialized in this function

It looks buggy to me, too.

---
 fs/ext4/super.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/super.c +1 -1
@@ -2916,7 +2916,7 @@ static int ext4_register_li_request(stru
 	struct ext4_sb_info *sbi = EXT4_SB(sb);
 	struct ext4_li_request *elr;
 	ext4_group_t ngroups = EXT4_SB(sb)->s_groups_count;
-	int ret;
+	int ret = 0;
 
 	if (sbi->s_li_request != NULL)
 		return 0;
author
#130 lore raw

PATCH 130/272 ext4: fix trimming of a single group

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Jan Kara <[email protected]>

commit ca6e909f9bebe709bc65a3ee605ce32969db0452 upstream.

When ext4_trim_fs() is called to trim a part of a single group, the logic will wrongly set last block of the interval to 'len' instead of 'first_block + len'. Thus a shorter interval is possibly trimmed. Fix it.

---
 fs/ext4/mballoc.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/mballoc.c +1 -1
@@ -4851,7 +4851,7 @@ int ext4_trim_fs(struct super_block *sb,
 		if (len >= EXT4_BLOCKS_PER_GROUP(sb))
 			len -= (EXT4_BLOCKS_PER_GROUP(sb) - first_block);
 		else
-			last_block = len;
+			last_block = first_block + len;
 
 		if (e4b.bd_info->bb_free >= minlen) {
 			cnt = ext4_trim_all_free(sb, &e4b, first_block,
author
#131 lore raw

PATCH 131/272 ext4: fix memory leak in ext4_free_branches

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Theodore Ts'o <[email protected]>

commit 1c5b9e9065567876c2d4a7a16d78f0fed154a5bf upstream.

Commit 40389687 moved a call to ext4_forget() out of ext4_free_branches and let ext4_free_blocks() handle calling bforget(). But that change unfortunately did not replace the call to ext4_forget() with brelse(), which was needed to drop the in-use count of the indirect block's buffer head, which lead to a memory leak when deleting files that used indirect blocks. Fix this.

Thanks to Hugh Dickins for pointing this out.

---
 fs/ext4/inode.c |    1 +
 1 file changed, 1 insertion(+)
fs/ext4/inode.c +1 -0
@@ -4349,6 +4349,7 @@ static void ext4_free_branches(handle_t
 					(__le32 *) bh->b_data,
 					(__le32 *) bh->b_data + addr_per_block,
 					depth);
+			brelse(bh);
 
 			/*
 			 * Everything below this this pointer has been
author
#132 lore raw

PATCH 132/272 ext4: fix panic on module unload when stopping lazyinit thread

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Eric Sandeen <[email protected]>

commit 8f1f745331c1b560f53c0d60e55a4f4f43f7cce5 upstream.

https://bugzilla.kernel.org/show_bug.cgi?id=27652

If the lazyinit thread is running, the teardown function ext4_destroy_lazyinit_thread() has problems:

        ext4_clear_request_list();
        while (ext4_li_info->li_task) {
                wake_up(&ext4_li_info->li_wait_daemon);
                wait_event(ext4_li_info->li_wait_task,
                           ext4_li_info->li_task == NULL);
        }

Clearing the request list will cause the thread to exit and free ext4_li_info, so then we're waiting on something which is getting freed.

Fix this up by making the thread respond to kthread_stop, and exit, without the need to wait for that exit in some other homegrown way.

---
 fs/ext4/super.c |   27 ++++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)
fs/ext4/super.c +14 -13
@@ -77,6 +77,7 @@ static struct dentry *ext4_mount(struct
 		       const char *dev_name, void *data);
 static void ext4_destroy_lazyinit_thread(void);
 static void ext4_unregister_li_request(struct super_block *sb);
+static void ext4_clear_request_list(void);
 
 #if !defined(CONFIG_EXT3_FS) && !defined(CONFIG_EXT3_FS_MODULE) && defined(CONFIG_EXT4_USE_FOR_EXT23)
 static struct file_system_type ext3_fs_type = {
@@ -2704,6 +2705,8 @@ static void ext4_unregister_li_request(s
 	mutex_unlock(&ext4_li_info->li_list_mtx);
 }
 
+static struct task_struct *ext4_lazyinit_task;
+
 /*
  * This is the function where ext4lazyinit thread lives. It walks
  * through the request list searching for next scheduled filesystem.
@@ -2772,6 +2775,10 @@ cont_thread:
 		if (time_before(jiffies, next_wakeup))
 			schedule();
 		finish_wait(&eli->li_wait_daemon, &wait);
+		if (kthread_should_stop()) {
+			ext4_clear_request_list();
+			goto exit_thread;
+		}
 	}
 
 exit_thread:
@@ -2796,6 +2803,7 @@ exit_thread:
 	wake_up(&eli->li_wait_task);
 
 	kfree(ext4_li_info);
+	ext4_lazyinit_task = NULL;
 	ext4_li_info = NULL;
 	mutex_unlock(&ext4_li_mtx);
 
@@ -2818,11 +2826,10 @@ static void ext4_clear_request_list(void
 
 static int ext4_run_lazyinit_thread(void)
 {
-	struct task_struct *t;
-
-	t = kthread_run(ext4_lazyinit_thread, ext4_li_info, "ext4lazyinit");
-	if (IS_ERR(t)) {
-		int err = PTR_ERR(t);
+	ext4_lazyinit_task = kthread_run(ext4_lazyinit_thread,
+					 ext4_li_info, "ext4lazyinit");
+	if (IS_ERR(ext4_lazyinit_task)) {
+		int err = PTR_ERR(ext4_lazyinit_task);
 		ext4_clear_request_list();
 		del_timer_sync(&ext4_li_info->li_timer);
 		kfree(ext4_li_info);
@@ -2973,16 +2980,10 @@ static void ext4_destroy_lazyinit_thread
 	 * If thread exited earlier
 	 * there's nothing to be done.
 	 */
-	if (!ext4_li_info)
+	if (!ext4_li_info || !ext4_lazyinit_task)
 		return;
 
-	ext4_clear_request_list();
-
-	while (ext4_li_info->li_task) {
-		wake_up(&ext4_li_info->li_wait_daemon);
-		wait_event(ext4_li_info->li_wait_task,
-			   ext4_li_info->li_task == NULL);
-	}
+	kthread_stop(ext4_lazyinit_task);
 }
 
 static int ext4_fill_super(struct super_block *sb, void *data, int silent)
author
#133 lore raw

PATCH 133/272 ext4: unregister features interface on module unload

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Lukas Czerner <[email protected]>

commit 8f021222c1e2756ea4c9dde93b23e1d2a0a4ec37 upstream.

Ext4 features interface was not properly unregistered which led to problems while unloading/reloading ext4 module. This commit fixes that by adding proper kobject unregistration code into ext4_exit_fs() as well as fail-path of ext4_init_fs()

---
 fs/ext4/super.c |   12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)
fs/ext4/super.c +10 -2
@@ -4757,7 +4757,7 @@ static struct file_system_type ext4_fs_t
 	.fs_flags	= FS_REQUIRES_DEV,
 };
 
-int __init ext4_init_feat_adverts(void)
+static int __init ext4_init_feat_adverts(void)
 {
 	struct ext4_features *ef;
 	int ret = -ENOMEM;
@@ -4781,6 +4781,13 @@ out:
 	return ret;
 }
 
+static void ext4_exit_feat_adverts(void)
+{
+	kobject_put(&ext4_feat->f_kobj);
+	wait_for_completion(&ext4_feat->f_kobj_unregister);
+	kfree(ext4_feat);
+}
+
 static int __init ext4_init_fs(void)
 {
 	int err;
@@ -4827,7 +4834,7 @@ out1:
 out2:
 	ext4_exit_mballoc();
 out3:
-	kfree(ext4_feat);
+	ext4_exit_feat_adverts();
 	remove_proc_entry("fs/ext4", NULL);
 	kset_unregister(ext4_kset);
 out4:
@@ -4846,6 +4853,7 @@ static void __exit ext4_exit_fs(void)
 	destroy_inodecache();
 	ext4_exit_xattr();
 	ext4_exit_mballoc();
+	ext4_exit_feat_adverts();
 	remove_proc_entry("fs/ext4", NULL);
 	kset_unregister(ext4_kset);
 	ext4_exit_system_zone();
author
#134 lore raw

PATCH 134/272 ext4: Fix data corruption with multi-block writepages support

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Curt Wohlgemuth <[email protected]>

commit d50bdd5aa55127635fd8a5c74bd2abb256bd34e3 upstream.

This fixes a corruption problem with the multi-block writepages submittal change for ext4, from commit bd2d0210cf22f2bd0cef72eb97cf94fc7d31d8cc ("ext4: use bio layer instead of buffer layer in mpage_da_submit_io").

(Note that this corruption is not present in 2.6.37 on ext4, because the corruption was detected after the feature was merged in 2.6.37-rc1, and so it was turned off by adding a non-default mount option, mblk_io_submit. With this commit, which hopefully fixes the last of the bugs with this feature, we'll be able to turn on this performance feature by default in 2.6.38, and remove the mblk_io_submit option.)

The ext4 code path to bundle multiple pages for writeback in ext4_bio_write_page() had a bug: we should be clearing buffer head dirty flags *before* we submit the bio, not in the completion routine.

The patch below was tested on 2.6.37 under KVM with the postgresql script which was submitted by Jon Nelson as documented in commit 1449032be1.

Without the patch, I'd hit the corruption problem about 50-70% of the time. With the patch, I executed the script > 100 times with no corruption seen.

I also fixed a bug to make sure ext4_end_bio() doesn't dereference the bio after the bio_put() call.

---
 fs/ext4/page-io.c |   11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)
fs/ext4/page-io.c +6 -5
@@ -193,6 +193,7 @@ static void ext4_end_bio(struct bio *bio
 	struct inode *inode;
 	unsigned long flags;
 	int i;
+	sector_t bi_sector = bio->bi_sector;
 
 	BUG_ON(!io_end);
 	bio->bi_private = NULL;
@@ -210,9 +211,7 @@ static void ext4_end_bio(struct bio *bio
 		if (error)
 			SetPageError(page);
 		BUG_ON(!head);
-		if (head->b_size == PAGE_CACHE_SIZE)
-			clear_buffer_dirty(head);
-		else {
+		if (head->b_size != PAGE_CACHE_SIZE) {
 			loff_t offset;
 			loff_t io_end_offset = io_end->offset + io_end->size;
 
@@ -224,7 +223,6 @@ static void ext4_end_bio(struct bio *bio
 					if (error)
 						buffer_io_error(bh);
 
-					clear_buffer_dirty(bh);
 				}
 				if (buffer_delay(bh))
 					partial_write = 1;
@@ -260,7 +258,7 @@ static void ext4_end_bio(struct bio *bio
 			     (unsigned long long) io_end->offset,
 			     (long) io_end->size,
 			     (unsigned long long)
-			     bio->bi_sector >> (inode->i_blkbits - 9));
+			     bi_sector >> (inode->i_blkbits - 9));
 	}
 
 	/* Add the io_end to per-inode completed io list*/
@@ -383,6 +381,7 @@ int ext4_bio_write_page(struct ext4_io_s
 
 	blocksize = 1 << inode->i_blkbits;
 
+	BUG_ON(!PageLocked(page));
 	BUG_ON(PageWriteback(page));
 	set_page_writeback(page);
 	ClearPageError(page);
@@ -400,12 +399,14 @@ int ext4_bio_write_page(struct ext4_io_s
 	for (bh = head = page_buffers(page), block_start = 0;
 	     bh != head || !block_start;
 	     block_start = block_end, bh = bh->b_this_page) {
+
 		block_end = block_start + blocksize;
 		if (block_start >= len) {
 			clear_buffer_dirty(bh);
 			set_buffer_uptodate(bh);
 			continue;
 		}
+		clear_buffer_dirty(bh);
 		ret = io_submit_add_bh(io, io_page, inode, wbc, bh);
 		if (ret) {
 			/*
author
#135 lore raw

PATCH 135/272 ext4: make grpinfo slab cache names static

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Eric Sandeen <[email protected]>

commit 2892c15ddda6a76dc10b7499e56c0f3b892e5a69 upstream.

In 2.6.37 I was running into oopses with repeated module loads & unloads. I tracked this down to:

fb1813f4 ext4: use dedicated slab caches for group_info structures

(this was in addition to the features advert unload problem)

The kstrdup & subsequent kfree of the cache name was causing a double free. In slub, at least, if I read it right it allocates & frees the name itself, slab seems to do something different... so in slub I think we were leaking -our- cachep->name, and double freeing the one allocated by slub.

After getting lost in slab/slub/slob a bit, I just looked at other sized-caches that get allocated. jbd2, biovec, sgpool all do it more or less the way jbd2 does. Below patch follows the jbd2 method of dynamically allocating a cache at mount time from a list of static names.

(This might also possibly fix a race creating the caches with parallel mounts running).

[Folded in a fix from Dan Carpenter which fixed an off-by-one error in the original patch]

---
 fs/ext4/mballoc.c |  100 ++++++++++++++++++++++++++++++++----------------------
 1 file changed, 60 insertions(+), 40 deletions(-)
fs/ext4/mballoc.c +60 -40
@@ -342,10 +342,15 @@ static struct kmem_cache *ext4_free_ext_
 /* We create slab caches for groupinfo data structures based on the
  * superblock block size.  There will be one per mounted filesystem for
  * each unique s_blocksize_bits */
-#define NR_GRPINFO_CACHES	\
-	(EXT4_MAX_BLOCK_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE + 1)
+#define NR_GRPINFO_CACHES 8
 static struct kmem_cache *ext4_groupinfo_caches[NR_GRPINFO_CACHES];
 
+static const char *ext4_groupinfo_slab_names[NR_GRPINFO_CACHES] = {
+	"ext4_groupinfo_1k", "ext4_groupinfo_2k", "ext4_groupinfo_4k",
+	"ext4_groupinfo_8k", "ext4_groupinfo_16k", "ext4_groupinfo_32k",
+	"ext4_groupinfo_64k", "ext4_groupinfo_128k"
+};
+
 static void ext4_mb_generate_from_pa(struct super_block *sb, void *bitmap,
 					ext4_group_t group);
 static void ext4_mb_generate_from_freelist(struct super_block *sb, void *bitmap,
@@ -2414,6 +2419,55 @@ err_freesgi:
 	return -ENOMEM;
 }
 
+static void ext4_groupinfo_destroy_slabs(void)
+{
+	int i;
+
+	for (i = 0; i < NR_GRPINFO_CACHES; i++) {
+		if (ext4_groupinfo_caches[i])
+			kmem_cache_destroy(ext4_groupinfo_caches[i]);
+		ext4_groupinfo_caches[i] = NULL;
+	}
+}
+
+static int ext4_groupinfo_create_slab(size_t size)
+{
+	static DEFINE_MUTEX(ext4_grpinfo_slab_create_mutex);
+	int slab_size;
+	int blocksize_bits = order_base_2(size);
+	int cache_index = blocksize_bits - EXT4_MIN_BLOCK_LOG_SIZE;
+	struct kmem_cache *cachep;
+
+	if (cache_index >= NR_GRPINFO_CACHES)
+		return -EINVAL;
+
+	if (unlikely(cache_index < 0))
+		cache_index = 0;
+
+	mutex_lock(&ext4_grpinfo_slab_create_mutex);
+	if (ext4_groupinfo_caches[cache_index]) {
+		mutex_unlock(&ext4_grpinfo_slab_create_mutex);
+		return 0;	/* Already created */
+	}
+
+	slab_size = offsetof(struct ext4_group_info,
+				bb_counters[blocksize_bits + 2]);
+
+	cachep = kmem_cache_create(ext4_groupinfo_slab_names[cache_index],
+					slab_size, 0, SLAB_RECLAIM_ACCOUNT,
+					NULL);
+
+	mutex_unlock(&ext4_grpinfo_slab_create_mutex);
+	if (!cachep) {
+		printk(KERN_EMERG "EXT4: no memory for groupinfo slab cache\n");
+		return -ENOMEM;
+	}
+
+	ext4_groupinfo_caches[cache_index] = cachep;
+
+	return 0;
+}
+
 int ext4_mb_init(struct super_block *sb, int needs_recovery)
 {
 	struct ext4_sb_info *sbi = EXT4_SB(sb);
@@ -2421,9 +2475,6 @@ int ext4_mb_init(struct super_block *sb,
 	unsigned offset;
 	unsigned max;
 	int ret;
-	int cache_index;
-	struct kmem_cache *cachep;
-	char *namep = NULL;
 
 	i = (sb->s_blocksize_bits + 2) * sizeof(*sbi->s_mb_offsets);
 
@@ -2440,30 +2491,9 @@ int ext4_mb_init(struct super_block *sb,
 		goto out;
 	}
 
-	cache_index = sb->s_blocksize_bits - EXT4_MIN_BLOCK_LOG_SIZE;
-	cachep = ext4_groupinfo_caches[cache_index];
-	if (!cachep) {
-		char name[32];
-		int len = offsetof(struct ext4_group_info,
-					bb_counters[sb->s_blocksize_bits + 2]);
-
-		sprintf(name, "ext4_groupinfo_%d", sb->s_blocksize_bits);
-		namep = kstrdup(name, GFP_KERNEL);
-		if (!namep) {
-			ret = -ENOMEM;
-			goto out;
-		}
-
-		/* Need to free the kmem_cache_name() when we
-		 * destroy the slab */
-		cachep = kmem_cache_create(namep, len, 0,
-					     SLAB_RECLAIM_ACCOUNT, NULL);
-		if (!cachep) {
-			ret = -ENOMEM;
-			goto out;
-		}
-		ext4_groupinfo_caches[cache_index] = cachep;
-	}
+	ret = ext4_groupinfo_create_slab(sb->s_blocksize);
+	if (ret < 0)
+		goto out;
 
 	/* order 0 is regular bitmap */
 	sbi->s_mb_maxs[0] = sb->s_blocksize << 3;
@@ -2520,7 +2550,6 @@ out:
 	if (ret) {
 		kfree(sbi->s_mb_offsets);
 		kfree(sbi->s_mb_maxs);
-		kfree(namep);
 	}
 	return ret;
 }
@@ -2734,7 +2763,6 @@ int __init ext4_init_mballoc(void)
 
 void ext4_exit_mballoc(void)
 {
-	int i;
 	/*
 	 * Wait for completion of call_rcu()'s on ext4_pspace_cachep
 	 * before destroying the slab cache.
@@ -2743,15 +2771,7 @@ void ext4_exit_mballoc(void)
 	kmem_cache_destroy(ext4_pspace_cachep);
 	kmem_cache_destroy(ext4_ac_cachep);
 	kmem_cache_destroy(ext4_free_ext_cachep);
-
-	for (i = 0; i < NR_GRPINFO_CACHES; i++) {
-		struct kmem_cache *cachep = ext4_groupinfo_caches[i];
-		if (cachep) {
-			char *name = (char *)kmem_cache_name(cachep);
-			kmem_cache_destroy(cachep);
-			kfree(name);
-		}
-	}
+	ext4_groupinfo_destroy_slabs();
 	ext4_remove_debugfs_entry();
 }
 
author
#136 lore raw

PATCH 136/272 rapidio: fix hang on RapidIO doorbell queue full condition

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Thomas Taranowski <[email protected]>

commit 12a4dc43911785f51a596f771ae0701b18d436f1 upstream.

In fsl_rio_dbell_handler() the code currently simply acknowledges the QFI queue full interrupt, but does nothing to resolve the queue full condition. Instead, it jumps to the end of the isr. When a queue full condition occurs, the isr is then re-entered immediately and continually, forever.

The fix is to just fall through and read out current doorbell entries.

Cc Alexandre Bounine <[email protected]>
Cc Kumar Gala <[email protected]>
Cc Matt Porter <[email protected]>
Cc Li Yang <[email protected]>
Cc Thomas Moll <[email protected]>
Cc Micha Nelissen <[email protected]>
Cc Benjamin Herrenschmidt <[email protected]>
Cc Grant Likely <[email protected]>
---
 arch/powerpc/sysdev/fsl_rio.c |    1 -
 1 file changed, 1 deletion(-)
arch/powerpc/sysdev/fsl_rio.c +0 -1
@@ -973,7 +973,6 @@ fsl_rio_dbell_handler(int irq, void *dev
 	if (dsr & DOORBELL_DSR_QFI) {
 		pr_info("RIO: doorbell queue full\n");
 		out_be32(&priv->msg_regs->dsr, DOORBELL_DSR_QFI);
-		goto out;
 	}
 
 	/* XXX Need to check/dispatch until queue empty */
author
#137 lore raw

PATCH 137/272 atyfb: Fix bootup hangs on sparc64.

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: David S. Miller <[email protected]>

[ Upstream commit 09798eb9479da3413bdf96e7d22a84d8b21e05e1 ]

After commit 25edd6946a1d74e5e77813c2324a0908c68bcf9e ("sparc64: Get rid of indirect p1275 PROM call buffer.") we can't pass virtual addresses >4GB to PROM calls.

Largely this is never necessary in drivers because we have a copy of the entire PROM device tree in the kernel and a set of of_*() interfaces to access it.

Unfortunately there were some lingering prom calls in the atyfb driver, in particular prom_finddevice() was being called with an on-stack address which could be anywhere.

This code is actually probing for information we already have, the PROM choosen console output device is stored in of_console_device so all of this nasty code consolidates into a one-line comparison.

Next we have some prom_getintdefault() calls which are trivially transformed into the equivalent of_getintprop_default().

Special thanks to Fabio, who figured out exactly where the bootup was hanging. That made this bug trivial to fix.

---
 drivers/video/aty/atyfb_base.c |   27 +++++----------------------
 1 file changed, 5 insertions(+), 22 deletions(-)
drivers/video/aty/atyfb_base.c +5 -22
@@ -2969,10 +2969,8 @@ static int __devinit atyfb_setup_sparc(s
 {
 	struct atyfb_par *par = info->par;
 	struct device_node *dp;
-	char prop[128];
-	phandle node;
-	int len, i, j, ret;
 	u32 mem, chip_id;
+	int i, j, ret;
 
 	/*
 	 * Map memory-mapped registers.
@@ -3088,23 +3086,8 @@ static int __devinit atyfb_setup_sparc(s
 		aty_st_le32(MEM_CNTL, mem, par);
 	}
 
-	/*
-	 * If this is the console device, we will set default video
-	 * settings to what the PROM left us with.
-	 */
-	node = prom_getchild(prom_root_node);
-	node = prom_searchsiblings(node, "aliases");
-	if (node) {
-		len = prom_getproperty(node, "screen", prop, sizeof(prop));
-		if (len > 0) {
-			prop[len] = '\0';
-			node = prom_finddevice(prop);
-		} else
-			node = 0;
-	}
-
 	dp = pci_device_to_OF_node(pdev);
-	if (node == dp->phandle) {
+	if (dp == of_console_device) {
 		struct fb_var_screeninfo *var = &default_var;
 		unsigned int N, P, Q, M, T, R;
 		u32 v_total, h_total;
@@ -3112,9 +3095,9 @@ static int __devinit atyfb_setup_sparc(s
 		u8 pll_regs[16];
 		u8 clock_cntl;
 
-		crtc.vxres = prom_getintdefault(node, "width", 1024);
-		crtc.vyres = prom_getintdefault(node, "height", 768);
-		var->bits_per_pixel = prom_getintdefault(node, "depth", 8);
+		crtc.vxres = of_getintprop_default(dp, "width", 1024);
+		crtc.vyres = of_getintprop_default(dp, "height", 768);
+		var->bits_per_pixel = of_getintprop_default(dp, "depth", 8);
 		var->xoffset = var->yoffset = 0;
 		crtc.h_tot_disp = aty_ld_le32(CRTC_H_TOTAL_DISP, par);
 		crtc.h_sync_strt_wid = aty_ld_le32(CRTC_H_SYNC_STRT_WID, par);
author
#138 lore raw

PATCH 138/272 af_unix: Avoid socket->sk NULL OOPS in stream connect security hooks.

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: David S. Miller <[email protected]>

[ Upstream commit 3610cda53f247e176bcbb7a7cca64bc53b12acdb ]

unix_release() can asynchornously set socket->sk to NULL, and it does so without holding the unix_state_lock() on "other" during stream connects.

However, the reverse mapping, sk->sk_socket, is only transitioned to NULL under the unix_state_lock().

Therefore make the security hooks follow the reverse mapping instead of the forward mapping.

---
 include/linux/security.h   |   15 +++++++--------
 net/unix/af_unix.c         |    2 +-
 security/capability.c      |    2 +-
 security/security.c        |    3 +--
 security/selinux/hooks.c   |   10 +++++-----
 security/smack/smack_lsm.c |   14 +++++++-------
 6 files changed, 22 insertions(+), 24 deletions(-)
include/linux/security.h +7 -8
@@ -796,8 +796,9 @@ static inline void security_free_mnt_opt
  * @unix_stream_connect:
  *	Check permissions before establishing a Unix domain stream connection
  *	between @sock and @other.
- *	@sock contains the socket structure.
- *	@other contains the peer socket structure.
+ *	@sock contains the sock structure.
+ *	@other contains the peer sock structure.
+ *	@newsk contains the new sock structure.
  *	Return 0 if permission is granted.
  * @unix_may_send:
  *	Check permissions before connecting or sending datagrams from @sock to
@@ -1568,8 +1569,7 @@ struct security_operations {
 	int (*inode_getsecctx)(struct inode *inode, void **ctx, u32 *ctxlen);
 
 #ifdef CONFIG_SECURITY_NETWORK
-	int (*unix_stream_connect) (struct socket *sock,
-				    struct socket *other, struct sock *newsk);
+	int (*unix_stream_connect) (struct sock *sock, struct sock *other, struct sock *newsk);
 	int (*unix_may_send) (struct socket *sock, struct socket *other);
 
 	int (*socket_create) (int family, int type, int protocol, int kern);
@@ -2525,8 +2525,7 @@ static inline int security_inode_getsecc
 
 #ifdef CONFIG_SECURITY_NETWORK
 
-int security_unix_stream_connect(struct socket *sock, struct socket *other,
-				 struct sock *newsk);
+int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk);
 int security_unix_may_send(struct socket *sock,  struct socket *other);
 int security_socket_create(int family, int type, int protocol, int kern);
 int security_socket_post_create(struct socket *sock, int family,
@@ -2567,8 +2566,8 @@ void security_tun_dev_post_create(struct
 int security_tun_dev_attach(struct sock *sk);
 
 #else	/* CONFIG_SECURITY_NETWORK */
-static inline int security_unix_stream_connect(struct socket *sock,
-					       struct socket *other,
+static inline int security_unix_stream_connect(struct sock *sock,
+					       struct sock *other,
 					       struct sock *newsk)
 {
 	return 0;
net/unix/af_unix.c +1 -1
@@ -1156,7 +1156,7 @@ restart:
 		goto restart;
 	}
 
-	err = security_unix_stream_connect(sock, other->sk_socket, newsk);
+	err = security_unix_stream_connect(sk, other, newsk);
 	if (err) {
 		unix_state_unlock(sk);
 		goto out_unlock;
security/capability.c +1 -1
@@ -548,7 +548,7 @@ static int cap_sem_semop(struct sem_arra
 }
 
 #ifdef CONFIG_SECURITY_NETWORK
-static int cap_unix_stream_connect(struct socket *sock, struct socket *other,
+static int cap_unix_stream_connect(struct sock *sock, struct sock *other,
 				   struct sock *newsk)
 {
 	return 0;
security/security.c +1 -2
@@ -977,8 +977,7 @@ EXPORT_SYMBOL(security_inode_getsecctx);
 
 #ifdef CONFIG_SECURITY_NETWORK
 
-int security_unix_stream_connect(struct socket *sock, struct socket *other,
-				 struct sock *newsk)
+int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk)
 {
 	return security_ops->unix_stream_connect(sock, other, newsk);
 }
security/selinux/hooks.c +5 -5
@@ -3921,18 +3921,18 @@ static int selinux_socket_shutdown(struc
 	return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
 }
 
-static int selinux_socket_unix_stream_connect(struct socket *sock,
-					      struct socket *other,
+static int selinux_socket_unix_stream_connect(struct sock *sock,
+					      struct sock *other,
 					      struct sock *newsk)
 {
-	struct sk_security_struct *sksec_sock = sock->sk->sk_security;
-	struct sk_security_struct *sksec_other = other->sk->sk_security;
+	struct sk_security_struct *sksec_sock = sock->sk_security;
+	struct sk_security_struct *sksec_other = other->sk_security;
 	struct sk_security_struct *sksec_new = newsk->sk_security;
 	struct common_audit_data ad;
 	int err;
 
 	COMMON_AUDIT_DATA_INIT(&ad, NET);
-	ad.u.net.sk = other->sk;
+	ad.u.net.sk = other;
 
 	err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
 			   sksec_other->sclass,
security/smack/smack_lsm.c +7 -7
@@ -2408,22 +2408,22 @@ static int smack_setprocattr(struct task
 
 /**
  * smack_unix_stream_connect - Smack access on UDS
- * @sock: one socket
- * @other: the other socket
+ * @sock: one sock
+ * @other: the other sock
  * @newsk: unused
  *
  * Return 0 if a subject with the smack of sock could access
  * an object with the smack of other, otherwise an error code
  */
-static int smack_unix_stream_connect(struct socket *sock,
-				     struct socket *other, struct sock *newsk)
+static int smack_unix_stream_connect(struct sock *sock,
+				     struct sock *other, struct sock *newsk)
 {
-	struct inode *sp = SOCK_INODE(sock);
-	struct inode *op = SOCK_INODE(other);
+	struct inode *sp = SOCK_INODE(sock->sk_socket);
+	struct inode *op = SOCK_INODE(other->sk_socket);
 	struct smk_audit_info ad;
 
 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_NET);
-	smk_ad_setfield_u_net_sk(&ad, other->sk);
+	smk_ad_setfield_u_net_sk(&ad, other);
 	return smk_access(smk_of_inode(sp), smk_of_inode(op),
 				 MAY_READWRITE, &ad);
 }
author
#139 lore raw

PATCH 139/272 inet6: prevent network storms caused by linux IPv6 routers

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Alexey Kuznetsov <[email protected]>

[ Upstream commit 72b43d0898e97f588293b4a24b33c58c46633d81 ]

Linux IPv6 forwards unicast packets, which are link layer multicasts... The hole was present since day one. I was 100% this check is there, but it is not.

The problem shows itself, f.e. when Microsoft Network Load Balancer runs on a network. This software resolves IPv6 unicast addresses to multicast MAC addresses.

---
 net/ipv6/ip6_output.c |    3 +++
 1 file changed, 3 insertions(+)
net/ipv6/ip6_output.c +3 -0
@@ -401,6 +401,9 @@ int ip6_forward(struct sk_buff *skb)
 		goto drop;
 	}
 
+	if (skb->pkt_type != PACKET_HOST)
+		goto drop;
+
 	skb_forward_csum(skb);
 
 	/*
author
#140 lore raw

PATCH 140/272 net: add POLLPRI to sock_def_readable()

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Eric Dumazet <[email protected]>

[ Upstream commit 2c6607c611cb7bf0a6750bcea34a258144e302c5 ]

Leonardo Chiquitto found poll() could block forever on tcp sockets and Urgent data was received, if the event flag only contains POLLPRI.

He did a bisection and found commit 4938d7e0233 (poll: avoid extra wakeups in select/poll) was the source of the problem.

Problem is TCP sockets use standard sock_def_readable() function for their sk_data_ready() handler, and sock_def_readable() doesnt signal POLLPRI.

Only TCP is affected by the problem. Adding POLLPRI to the list of flags might trigger unnecessary schedules, but URGENT handling is such a seldom used feature this seems a good compromise.

Thanks a lot to Leonardo for providing the bisection result and a test program as well.

Reference : http://www.spinics.net/lists/netdev/msg151793.html

---
 net/core/sock.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/sock.c +1 -1
@@ -1907,7 +1907,7 @@ static void sock_def_readable(struct soc
 	rcu_read_lock();
 	wq = rcu_dereference(sk->sk_wq);
 	if (wq_has_sleeper(wq))
-		wake_up_interruptible_sync_poll(&wq->wait, POLLIN |
+		wake_up_interruptible_sync_poll(&wq->wait, POLLIN | POLLPRI |
 						POLLRDNORM | POLLRDBAND);
 	sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN);
 	rcu_read_unlock();
author
#141 lore raw

PATCH 141/272 ipv4: IP defragmentation must be ECN aware

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Eric Dumazet <[email protected]>

[ Upstream commit 6623e3b24a5ebb07e81648c478d286a1329ab891 ]

RFC3168 (The Addition of Explicit Congestion Notification to IP) states :

5.3. Fragmentation

ECN-capable packets MAY have the DF (Don't Fragment) bit set. Reassembly of a fragmented packet MUST NOT lose indications of congestion. In other words, if any fragment of an IP packet to be reassembled has the CE codepoint set, then one of two actions MUST be taken:

* Set the CE codepoint on the reassembled packet. However, this MUST NOT occur if any of the other fragments contributing to this reassembly carries the Not-ECT codepoint.

* The packet is dropped, instead of being reassembled, for any other reason.

This patch implements this requirement for IPv4, choosing the first action :

If one fragment had NO-ECT codepoint
reassembled frame has NO-ECT
ElIf one fragment had CE codepoint
reassembled frame has CE

---
 net/ipv4/ip_fragment.c |   34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)
net/ipv4/ip_fragment.c +34 -0
@@ -45,6 +45,7 @@
 #include <linux/udp.h>
 #include <linux/inet.h>
 #include <linux/netfilter_ipv4.h>
+#include <net/inet_ecn.h>
 
 /* NOTE. Logic of IP defragmentation is parallel to corresponding IPv6
  * code now. If you change something here, _PLEASE_ update ipv6/reassembly.c
@@ -70,11 +71,28 @@ struct ipq {
 	__be32		daddr;
 	__be16		id;
 	u8		protocol;
+	u8		ecn; /* RFC3168 support */
 	int             iif;
 	unsigned int    rid;
 	struct inet_peer *peer;
 };
 
+#define IPFRAG_ECN_CLEAR  0x01 /* one frag had INET_ECN_NOT_ECT */
+#define IPFRAG_ECN_SET_CE 0x04 /* one frag had INET_ECN_CE */
+
+static inline u8 ip4_frag_ecn(u8 tos)
+{
+	tos = (tos & INET_ECN_MASK) + 1;
+	/*
+	 * After the last operation we have (in binary):
+	 * INET_ECN_NOT_ECT => 001
+	 * INET_ECN_ECT_1   => 010
+	 * INET_ECN_ECT_0   => 011
+	 * INET_ECN_CE      => 100
+	 */
+	return (tos & 2) ? 0 : tos;
+}
+
 static struct inet_frags ip4_frags;
 
 int ip_frag_nqueues(struct net *net)
@@ -137,6 +155,7 @@ static void ip4_frag_init(struct inet_fr
 
 	qp->protocol = arg->iph->protocol;
 	qp->id = arg->iph->id;
+	qp->ecn = ip4_frag_ecn(arg->iph->tos);
 	qp->saddr = arg->iph->saddr;
 	qp->daddr = arg->iph->daddr;
 	qp->user = arg->user;
@@ -316,6 +335,7 @@ static int ip_frag_reinit(struct ipq *qp
 	qp->q.fragments = NULL;
 	qp->q.fragments_tail = NULL;
 	qp->iif = 0;
+	qp->ecn = 0;
 
 	return 0;
 }
@@ -328,6 +348,7 @@ static int ip_frag_queue(struct ipq *qp,
 	int flags, offset;
 	int ihl, end;
 	int err = -ENOENT;
+	u8 ecn;
 
 	if (qp->q.last_in & INET_FRAG_COMPLETE)
 		goto err;
@@ -339,6 +360,7 @@ static int ip_frag_queue(struct ipq *qp,
 		goto err;
 	}
 
+	ecn = ip4_frag_ecn(ip_hdr(skb)->tos);
 	offset = ntohs(ip_hdr(skb)->frag_off);
 	flags = offset & ~IP_OFFSET;
 	offset &= IP_OFFSET;
@@ -472,6 +494,7 @@ found:
 	}
 	qp->q.stamp = skb->tstamp;
 	qp->q.meat += skb->len;
+	qp->ecn |= ecn;
 	atomic_add(skb->truesize, &qp->q.net->mem);
 	if (offset == 0)
 		qp->q.last_in |= INET_FRAG_FIRST_IN;
@@ -583,6 +606,17 @@ static int ip_frag_reasm(struct ipq *qp,
 	iph = ip_hdr(head);
 	iph->frag_off = 0;
 	iph->tot_len = htons(len);
+	/* RFC3168 5.3 Fragmentation support
+	 * If one fragment had INET_ECN_NOT_ECT,
+	 *	reassembled frame also has INET_ECN_NOT_ECT
+	 * Elif one fragment had INET_ECN_CE
+	 *	reassembled frame also has INET_ECN_CE
+	 */
+	if (qp->ecn & IPFRAG_ECN_CLEAR)
+		iph->tos &= ~INET_ECN_MASK;
+	else if (qp->ecn & IPFRAG_ECN_SET_CE)
+		iph->tos |= INET_ECN_CE;
+
 	IP_INC_STATS_BH(net, IPSTATS_MIB_REASMOKS);
 	qp->q.fragments = NULL;
 	qp->q.fragments_tail = NULL;
author
#142 lore raw

PATCH 142/272 net_sched: pfifo_head_drop problem

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Eric Dumazet <[email protected]>

[ Upstream commit 44b8288308ac9da27eab7d7bdbf1375a568805c3 ]

commit 57dbb2d83d100ea (sched: add head drop fifo queue) introduced pfifo_head_drop, and broke the invariant that sch->bstats.bytes and sch->bstats.packets are COUNTER (increasing counters only)

This can break estimators because est_timer() handles unsigned deltas only. A decreasing counter can then give a huge unsigned delta.

My mid term suggestion would be to change things so that sch->bstats.bytes and sch->bstats.packets are incremented in dequeue() only, not at enqueue() time. We also could add drop_bytes/drop_packets and provide estimations of drop rates.

It would be more sensible anyway for very low speeds, and big bursts. Right now, if we drop packets, they still are accounted in byte/packets abolute counters and rate estimators.

Before this mid term change, this patch makes pfifo_head_drop behavior similar to other qdiscs in case of drops :
Dont decrement sch->bstats.bytes and sch->bstats.packets

---
 net/sched/sch_fifo.c |    2 --
 1 file changed, 2 deletions(-)
net/sched/sch_fifo.c +0 -2
@@ -54,8 +54,6 @@ static int pfifo_tail_enqueue(struct sk_
 
 	/* queue full, remove one skb to fulfill the limit */
 	skb_head = qdisc_dequeue_head(sch);
-	sch->bstats.bytes -= qdisc_pkt_len(skb_head);
-	sch->bstats.packets--;
 	sch->qstats.drops++;
 	kfree_skb(skb_head);
 
author
#143 lore raw

PATCH 143/272 sh: Fix up legacy PTEA space attribute mapping.

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Paul Mundt <[email protected]>

commit efb3e34b6176d30c4fe8635fa8e1beb6280cc2cd upstream.

When p3_ioremap() was converted to ioremap_prot() there was some breakage introduced where the 29-bit segmentation logic would trap the area range and return an identity mapping without having allowed the area specification to force mapping through page tables. This wires up a PCC mask for pgprot verification to work out whether to short-circuit the identity mapping on legacy parts, restoring the previous behaviour.

---
 arch/sh/include/asm/io.h         |   10 +++++++++-
 arch/sh/include/asm/pgtable_32.h |    7 ++++++-
 2 files changed, 15 insertions(+), 2 deletions(-)
arch/sh/include/asm/io.h +9 -1
@@ -322,7 +322,15 @@ __ioremap_29bit(phys_addr_t offset, unsi
 	 * mapping must be done by the PMB or by using page tables.
 	 */
 	if (likely(PXSEG(offset) < P3SEG && PXSEG(last_addr) < P3SEG)) {
-		if (unlikely(pgprot_val(prot) & _PAGE_CACHABLE))
+		u64 flags = pgprot_val(prot);
+
+		/*
+		 * Anything using the legacy PTEA space attributes needs
+		 * to be kicked down to page table mappings.
+		 */
+		if (unlikely(flags & _PAGE_PCC_MASK))
+			return NULL;
+		if (unlikely(flags & _PAGE_CACHABLE))
 			return (void __iomem *)P1SEGADDR(offset);
 
 		return (void __iomem *)P2SEGADDR(offset);
arch/sh/include/asm/pgtable_32.h +6 -1
@@ -76,6 +76,10 @@
 /* Wrapper for extended mode pgprot twiddling */
 #define _PAGE_EXT(x)		((unsigned long long)(x) << 32)
 
+#ifdef CONFIG_X2TLB
+#define _PAGE_PCC_MASK	0x00000000	/* No legacy PTEA support */
+#else
+
 /* software: moves to PTEA.TC (Timing Control) */
 #define _PAGE_PCC_AREA5	0x00000000	/* use BSC registers for area5 */
 #define _PAGE_PCC_AREA6	0x80000000	/* use BSC registers for area6 */
@@ -89,7 +93,8 @@
 #define _PAGE_PCC_ATR8	0x60000000	/* Attribute Memory space, 8 bit bus */
 #define _PAGE_PCC_ATR16	0x60000001	/* Attribute Memory space, 6 bit bus */
 
-#ifndef CONFIG_X2TLB
+#define _PAGE_PCC_MASK	0xe0000001
+
 /* copy the ptea attributes */
 static inline unsigned long copy_ptea_attributes(unsigned long x)
 {
author
#144 lore raw

PATCH 144/272 PCI: pci-stub: ignore zero-length id parameters

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Tejun Heo <[email protected]>

commit 99a0fadf561e1f553c08f0a29f8b2578f55dd5f0 upstream.

pci-stub uses strsep() to separate list of ids and generates a warning message when it fails to parse an id. However, not specifying the parameter results in ids set to an empty string. strsep() happily returns the empty string as the first token and thus triggers the warning message spuriously.

Make the tokner ignore zero length ids.

---
 drivers/pci/pci-stub.c |    3 +++
 1 file changed, 3 insertions(+)
drivers/pci/pci-stub.c +3 -0
@@ -54,6 +54,9 @@ static int __init pci_stub_init(void)
 			subdevice = PCI_ANY_ID, class=0, class_mask=0;
 		int fields;
 
+		if (!strlen(id))
+			continue;
+
 		fields = sscanf(id, "%x:%x:%x:%x:%x:%x",
 				&vendor, &device, &subvendor, &subdevice,
 				&class, &class_mask);
author
#145 lore raw

PATCH 145/272 virtio: remove virtio-pci root device

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Milton Miller <[email protected]>

commit 8b3bb3ecf1934ac4a7005ad9017de1127e2fbd2f upstream.

We sometimes need to map between the virtio device and the given pci device. One such use is OS installer that gets the boot pci device from BIOS and needs to find the relevant block device. Since it can't, installation fails.

Instead of creating a top-level devices/virtio-pci directory, create each device under the corresponding pci device node. Symlinks to all virtio-pci devices can be found under the pci driver link in bus/pci/drivers/virtio-pci/devices, and all virtio devices under drivers/bus/virtio/devices.

---
 drivers/virtio/virtio_pci.c |   20 ++------------------
 1 file changed, 2 insertions(+), 18 deletions(-)
drivers/virtio/virtio_pci.c +2 -18
@@ -96,11 +96,6 @@ static struct pci_device_id virtio_pci_i
 
 MODULE_DEVICE_TABLE(pci, virtio_pci_id_table);
 
-/* A PCI device has it's own struct device and so does a virtio device so
- * we create a place for the virtio devices to show up in sysfs.  I think it
- * would make more sense for virtio to not insist on having it's own device. */
-static struct device *virtio_pci_root;
-
 /* Convert a generic virtio device to our structure */
 static struct virtio_pci_device *to_vp_device(struct virtio_device *vdev)
 {
@@ -629,7 +624,7 @@ static int __devinit virtio_pci_probe(st
 	if (vp_dev == NULL)
 		return -ENOMEM;
 
-	vp_dev->vdev.dev.parent = virtio_pci_root;
+	vp_dev->vdev.dev.parent = &pci_dev->dev;
 	vp_dev->vdev.dev.release = virtio_pci_release_dev;
 	vp_dev->vdev.config = &virtio_pci_config_ops;
 	vp_dev->pci_dev = pci_dev;
@@ -717,17 +712,7 @@ static struct pci_driver virtio_pci_driv
 
 static int __init virtio_pci_init(void)
 {
-	int err;
-
-	virtio_pci_root = root_device_register("virtio-pci");
-	if (IS_ERR(virtio_pci_root))
-		return PTR_ERR(virtio_pci_root);
-
-	err = pci_register_driver(&virtio_pci_driver);
-	if (err)
-		root_device_unregister(virtio_pci_root);
-
-	return err;
+	return pci_register_driver(&virtio_pci_driver);
 }
 
 module_init(virtio_pci_init);
@@ -735,7 +720,6 @@ module_init(virtio_pci_init);
 static void __exit virtio_pci_exit(void)
 {
 	pci_unregister_driver(&virtio_pci_driver);
-	root_device_unregister(virtio_pci_root);
 }
 
 module_exit(virtio_pci_exit);
author
#146 lore raw

PATCH 146/272 jz4740-battery: Protect against concurrent battery readings

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Lars-Peter Clausen <[email protected]>

commit 8ec98fe0b4ffdedce4c1caa9fb3d550f52ad1c6b upstream.

We can not handle more then one ADC request at a time to the battery. The patch adds a mutex around the ADC read code to ensure this.

---
 drivers/power/jz4740-battery.c |    7 +++++++
 1 file changed, 7 insertions(+)
drivers/power/jz4740-battery.c +7 -0
@@ -47,6 +47,8 @@ struct jz_battery {
 
 	struct power_supply battery;
 	struct delayed_work work;
+
+	struct mutex lock;
 };
 
 static inline struct jz_battery *psy_to_jz_battery(struct power_supply *psy)
@@ -68,6 +70,8 @@ static long jz_battery_read_voltage(stru
 	unsigned long val;
 	long voltage;
 
+	mutex_lock(&battery->lock);
+
 	INIT_COMPLETION(battery->read_completion);
 
 	enable_irq(battery->irq);
@@ -91,6 +95,8 @@ static long jz_battery_read_voltage(stru
 	battery->cell->disable(battery->pdev);
 	disable_irq(battery->irq);
 
+	mutex_unlock(&battery->lock);
+
 	return voltage;
 }
 
@@ -291,6 +297,7 @@ static int __devinit jz_battery_probe(st
 	jz_battery->pdev = pdev;
 
 	init_completion(&jz_battery->read_completion);
+	mutex_init(&jz_battery->lock);
 
 	INIT_DELAYED_WORK(&jz_battery->work, jz_battery_work);
 
author
#147 lore raw

PATCH 147/272 ds2760_battery: Fix calculation of time_to_empty_now

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Sven Neumann <[email protected]>

commit 86af95039b69a90db15294eb1f9c147f1df0a8ea upstream.

A check against division by zero was modified in commit b0525b48. Since this change time_to_empty_now is always reported as zero while the battery is discharging and as a negative value while the battery is charging. This is because current is negative while the battery is discharging.

Fix the check introduced by commit b0525b48 so that time_to_empty_now is reported correctly during discharge and as zero while charging.

---
 drivers/power/ds2760_battery.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/power/ds2760_battery.c +1 -1
@@ -212,7 +212,7 @@ static int ds2760_battery_read_status(st
 	if (di->rem_capacity > 100)
 		di->rem_capacity = 100;
 
-	if (di->current_uA >= 100L)
+	if (di->current_uA < -100L)
 		di->life_sec = -((di->accum_current_uAh - di->empty_uAh) * 36L)
 					/ (di->current_uA / 100L);
 	else
author
#148 lore raw

PATCH 148/272 avr32: use syscall prototypes from asm-generic instead of arch

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Hans-Christian Egtvedt <[email protected]>

commit 664cb7142ced8b827e92e1851d1ed2cae922f225 upstream.

This patch removes the redundant syscalls prototypes in the architecture specific syscalls.h header file. These were identical with the ones in asm-generic/syscalls.h.

---
 arch/avr32/include/asm/syscalls.h |    9 ---------
 1 file changed, 9 deletions(-)
arch/avr32/include/asm/syscalls.h +0 -9
@@ -16,18 +16,9 @@
 #include <linux/signal.h>
 
 /* kernel/process.c */
-asmlinkage int sys_fork(struct pt_regs *);
 asmlinkage int sys_clone(unsigned long, unsigned long,
 			 unsigned long, unsigned long,
 			 struct pt_regs *);
-asmlinkage int sys_vfork(struct pt_regs *);
-asmlinkage int sys_execve(const char __user *, char __user *__user *,
-			  char __user *__user *, struct pt_regs *);
-
-/* kernel/signal.c */
-asmlinkage int sys_sigaltstack(const stack_t __user *, stack_t __user *,
-			       struct pt_regs *);
-asmlinkage int sys_rt_sigreturn(struct pt_regs *);
 
 /* mm/cache.c */
 asmlinkage int sys_cacheflush(int, void __user *, size_t);
author
#149 lore raw

PATCH 149/272 cpuidle: Make cpuidle_enable_device() call poll_idle_init()

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Rafael J. Wysocki <[email protected]>

commit d8c216cfa57e8a579f41729cbb88c97835d9ac8d upstream.

The following scenario is possible with the current cpuidle code and the ACPI cpuidle driver:
(1) acpi_processor_cst_has_changed() is called,
(2) cpuidle_disable_device() is called,
(3) cpuidle_remove_state_sysfs() is called to remove the (presumably outdated) states info from sysfs,
(3) acpi_processor_get_power_info() is called, the first entry in the

    pr->power.states[] table is filled with zeros,
(4) acpi_processor_setup_cpuidle() is called and it doesn't fill the
    first entry in pr->power.states[],

(5) cpuidle_enable_device() is called,
(6) __cpuidle_register_device() is _not_ called, since the device has already been registered,
(7) Consequently, poll_idle_init() is _not_ called either,
(8) cpuidle_add_state_sysfs() is called to create the sysfs attributes for the new states and it uses the bogus first table entry from acpi_processor_get_power_info() for creating state0.

This problem is avoided if cpuidle_enable_device() unconditionally calls poll_idle_init().

---
 drivers/cpuidle/cpuidle.c |   82 +++++++++++++++++++++++-----------------------
 1 file changed, 41 insertions(+), 41 deletions(-)
drivers/cpuidle/cpuidle.c +41 -41
@@ -154,6 +154,45 @@ void cpuidle_resume_and_unlock(void)
 
 EXPORT_SYMBOL_GPL(cpuidle_resume_and_unlock);
 
+#ifdef CONFIG_ARCH_HAS_CPU_RELAX
+static int poll_idle(struct cpuidle_device *dev, struct cpuidle_state *st)
+{
+	ktime_t	t1, t2;
+	s64 diff;
+	int ret;
+
+	t1 = ktime_get();
+	local_irq_enable();
+	while (!need_resched())
+		cpu_relax();
+
+	t2 = ktime_get();
+	diff = ktime_to_us(ktime_sub(t2, t1));
+	if (diff > INT_MAX)
+		diff = INT_MAX;
+
+	ret = (int) diff;
+	return ret;
+}
+
+static void poll_idle_init(struct cpuidle_device *dev)
+{
+	struct cpuidle_state *state = &dev->states[0];
+
+	cpuidle_set_statedata(state, NULL);
+
+	snprintf(state->name, CPUIDLE_NAME_LEN, "C0");
+	snprintf(state->desc, CPUIDLE_DESC_LEN, "CPUIDLE CORE POLL IDLE");
+	state->exit_latency = 0;
+	state->target_residency = 0;
+	state->power_usage = -1;
+	state->flags = CPUIDLE_FLAG_POLL;
+	state->enter = poll_idle;
+}
+#else
+static void poll_idle_init(struct cpuidle_device *dev) {}
+#endif /* CONFIG_ARCH_HAS_CPU_RELAX */
+
 /**
  * cpuidle_enable_device - enables idle PM for a CPU
  * @dev: the CPU
@@ -178,6 +217,8 @@ int cpuidle_enable_device(struct cpuidle
 			return ret;
 	}
 
+	poll_idle_init(dev);
+
 	if ((ret = cpuidle_add_state_sysfs(dev)))
 		return ret;
 
@@ -232,45 +273,6 @@ void cpuidle_disable_device(struct cpuid
 
 EXPORT_SYMBOL_GPL(cpuidle_disable_device);
 
-#ifdef CONFIG_ARCH_HAS_CPU_RELAX
-static int poll_idle(struct cpuidle_device *dev, struct cpuidle_state *st)
-{
-	ktime_t	t1, t2;
-	s64 diff;
-	int ret;
-
-	t1 = ktime_get();
-	local_irq_enable();
-	while (!need_resched())
-		cpu_relax();
-
-	t2 = ktime_get();
-	diff = ktime_to_us(ktime_sub(t2, t1));
-	if (diff > INT_MAX)
-		diff = INT_MAX;
-
-	ret = (int) diff;
-	return ret;
-}
-
-static void poll_idle_init(struct cpuidle_device *dev)
-{
-	struct cpuidle_state *state = &dev->states[0];
-
-	cpuidle_set_statedata(state, NULL);
-
-	snprintf(state->name, CPUIDLE_NAME_LEN, "C0");
-	snprintf(state->desc, CPUIDLE_DESC_LEN, "CPUIDLE CORE POLL IDLE");
-	state->exit_latency = 0;
-	state->target_residency = 0;
-	state->power_usage = -1;
-	state->flags = CPUIDLE_FLAG_POLL;
-	state->enter = poll_idle;
-}
-#else
-static void poll_idle_init(struct cpuidle_device *dev) {}
-#endif /* CONFIG_ARCH_HAS_CPU_RELAX */
-
 /**
  * __cpuidle_register_device - internal register function called before register
  * and enable routines
@@ -291,8 +293,6 @@ static int __cpuidle_register_device(str
 
 	init_completion(&dev->kobj_unregister);
 
-	poll_idle_init(dev);
-
 	/*
 	 * cpuidle driver should set the dev->power_specified bit
 	 * before registering the device if the driver provides
author
#150 lore raw

PATCH 150/272 intel_idle: open broadcast clock event

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Shaohua Li <[email protected]>

commit 2a2d31c8dc6f1ebcf5eab1d93a0cb0fb4ed57c7c upstream.

Intel_idle driver uses CLOCK_EVT_NOTIFY_BROADCAST_ENTER CLOCK_EVT_NOTIFY_BROADCAST_EXIT
for broadcast clock events. The _ENTER/_EXIT doesn't really open broadcast clock events, please see processor_idle.c for an example. In some situation, this will cause boot hang, because some CPUs enters idle but local APIC timer stalls.

---
 drivers/idle/intel_idle.c |   47 +++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 46 insertions(+), 1 deletion(-)
drivers/idle/intel_idle.c +46 -1
@@ -59,6 +59,8 @@
 #include <linux/hrtimer.h>	/* ktime_get_real() */
 #include <trace/events/power.h>
 #include <linux/sched.h>
+#include <linux/notifier.h>
+#include <linux/cpu.h>
 #include <asm/mwait.h>
 
 #define INTEL_IDLE_VERSION "0.4"
@@ -73,6 +75,7 @@ static int max_cstate = MWAIT_MAX_NUM_CS
 
 static unsigned int mwait_substates;
 
+#define LAPIC_TIMER_ALWAYS_RELIABLE 0xFFFFFFFF
 /* Reliable LAPIC Timer States, bit 1 for C1 etc.  */
 static unsigned int lapic_timer_reliable_states = (1 << 1);	 /* Default to only C1 */
 
@@ -244,6 +247,39 @@ static int intel_idle(struct cpuidle_dev
 	return usec_delta;
 }
 
+static void __setup_broadcast_timer(void *arg)
+{
+	unsigned long reason = (unsigned long)arg;
+	int cpu = smp_processor_id();
+
+	reason = reason ?
+		CLOCK_EVT_NOTIFY_BROADCAST_ON : CLOCK_EVT_NOTIFY_BROADCAST_OFF;
+
+	clockevents_notify(reason, &cpu);
+}
+
+static int __cpuinit setup_broadcast_cpuhp_notify(struct notifier_block *n,
+		unsigned long action, void *hcpu)
+{
+	int hotcpu = (unsigned long)hcpu;
+
+	switch (action & 0xf) {
+	case CPU_ONLINE:
+		smp_call_function_single(hotcpu, __setup_broadcast_timer,
+			(void *)true, 1);
+		break;
+	case CPU_DOWN_PREPARE:
+		smp_call_function_single(hotcpu, __setup_broadcast_timer,
+			(void *)false, 1);
+		break;
+	}
+	return NOTIFY_OK;
+}
+
+static struct notifier_block __cpuinitdata setup_broadcast_notifier = {
+	.notifier_call = setup_broadcast_cpuhp_notify,
+};
+
 /*
  * intel_idle_probe()
  */
@@ -306,7 +342,11 @@ static int intel_idle_probe(void)
 	}
 
 	if (boot_cpu_has(X86_FEATURE_ARAT))	/* Always Reliable APIC Timer */
-		lapic_timer_reliable_states = 0xFFFFFFFF;
+		lapic_timer_reliable_states = LAPIC_TIMER_ALWAYS_RELIABLE;
+	else {
+		smp_call_function(__setup_broadcast_timer, (void *)true, 1);
+		register_cpu_notifier(&setup_broadcast_notifier);
+	}
 
 	pr_debug(PREFIX "v" INTEL_IDLE_VERSION
 		" model 0x%X\n", boot_cpu_data.x86_model);
@@ -429,6 +469,11 @@ static void __exit intel_idle_exit(void)
 	intel_idle_cpuidle_devices_uninit();
 	cpuidle_unregister_driver(&intel_idle_driver);
 
+	if (lapic_timer_reliable_states != LAPIC_TIMER_ALWAYS_RELIABLE) {
+		smp_call_function(__setup_broadcast_timer, (void *)false, 1);
+		unregister_cpu_notifier(&setup_broadcast_notifier);
+	}
+
 	return;
 }
 
author
#151 lore raw

PATCH 151/272 fix a shutdown regression in intel_idle

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Shaohua Li <[email protected]>

commit ec30f343d61391ab23705e50a525da1d55395780 upstream.

Fix a shutdown regression caused by 2a2d31c8dc6f ("intel_idle: open broadcast clock event"). The clockevent framework can automatically shutdown broadcast timers for hotremove CPUs. And we get a shutdown regression when we shutdown broadcast timer for hot remove CPU, so just delete some code.

Also fix some section mismatch.

---
 drivers/idle/intel_idle.c |    8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/idle/intel_idle.c +2 -6
@@ -258,7 +258,7 @@ static void __setup_broadcast_timer(void
 	clockevents_notify(reason, &cpu);
 }
 
-static int __cpuinit setup_broadcast_cpuhp_notify(struct notifier_block *n,
+static int setup_broadcast_cpuhp_notify(struct notifier_block *n,
 		unsigned long action, void *hcpu)
 {
 	int hotcpu = (unsigned long)hcpu;
@@ -268,15 +268,11 @@ static int __cpuinit setup_broadcast_cpu
 		smp_call_function_single(hotcpu, __setup_broadcast_timer,
 			(void *)true, 1);
 		break;
-	case CPU_DOWN_PREPARE:
-		smp_call_function_single(hotcpu, __setup_broadcast_timer,
-			(void *)false, 1);
-		break;
 	}
 	return NOTIFY_OK;
 }
 
-static struct notifier_block __cpuinitdata setup_broadcast_notifier = {
+static struct notifier_block setup_broadcast_notifier = {
 	.notifier_call = setup_broadcast_cpuhp_notify,
 };
 
author
#152 lore raw

PATCH 152/272 p54: fix sequence no. accounting off-by-one error

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Christian Lamparter <[email protected]>

commit 3b5c5827d1f80ad8ae844a8b1183f59ddb90fe25 upstream.

P54_HDR_FLAG_DATA_OUT_SEQNR is meant to tell the
firmware that "the frame's sequence number has
already been set by the application."

Whereas IEEE80211_TX_CTL_ASSIGN_SEQ is set for
frames which lack a valid sequence number and
either the driver or firmware has to assign one.

Yup, it's the exact opposite!

---
 drivers/net/wireless/p54/txrx.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/p54/txrx.c +1 -1
@@ -618,7 +618,7 @@ static void p54_tx_80211_header(struct p
 	else
 		*burst_possible = false;
 
-	if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ)
+	if (!(info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ))
 		*flags |= P54_HDR_FLAG_DATA_OUT_SEQNR;
 
 	if (info->flags & IEEE80211_TX_CTL_PSPOLL_RESPONSE)
author
#153 lore raw

PATCH 153/272 i2c: Unregister dummy devices last on adapter removal

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Jean Delvare <[email protected]>

commit 5219bf884b6e2b54e734ca1799b6f0014bb2b4b7 upstream.

Remove real devices first and dummy devices last. This gives device driver which instantiated dummy devices themselves a chance to clean them up before we do.

---
 drivers/i2c/i2c-core.c |   14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/i2c/i2c-core.c +13 -1
@@ -1021,6 +1021,14 @@ static int i2c_do_del_adapter(struct i2c
 static int __unregister_client(struct device *dev, void *dummy)
 {
 	struct i2c_client *client = i2c_verify_client(dev);
+	if (client && strcmp(client->name, "dummy"))
+		i2c_unregister_device(client);
+	return 0;
+}
+
+static int __unregister_dummy(struct device *dev, void *dummy)
+{
+	struct i2c_client *client = i2c_verify_client(dev);
 	if (client)
 		i2c_unregister_device(client);
 	return 0;
@@ -1075,8 +1083,12 @@ int i2c_del_adapter(struct i2c_adapter *
 	mutex_unlock(&adap->userspace_clients_lock);
 
 	/* Detach any active clients. This can't fail, thus we do not
-	   checking the returned value. */
+	 * check the returned value. This is a two-pass process, because
+	 * we can't remove the dummy devices during the first pass: they
+	 * could have been instantiated by real devices wishing to clean
+	 * them up properly, so we give them a chance to do that first. */
 	res = device_for_each_child(&adap->dev, NULL, __unregister_client);
+	res = device_for_each_child(&adap->dev, NULL, __unregister_dummy);
 
 #ifdef CONFIG_I2C_COMPAT
 	class_compat_remove_link(i2c_adapter_compat_class, &adap->dev,
author
#154 lore raw

PATCH 154/272 ASoC: da8xx/omap-l1xx: match codec_name with i2c ids

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Sudhakar Rajashekhara <[email protected]>

commit dc5a460a1bfa44273653700e33d4e7051194cbfd upstream.

The codec_name entry for da8xx evm in sound/soc/davinci/davinci-evm.c is not matching with the i2c ids in the board file. Without this fix the soundcard does not get detected on da850/omap-l138/am18x evm.

---
 sound/soc/davinci/davinci-evm.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/davinci/davinci-evm.c +1 -1
@@ -224,7 +224,7 @@ static struct snd_soc_dai_link da8xx_evm
 	.stream_name = "AIC3X",
 	.cpu_dai_name= "davinci-mcasp.0",
 	.codec_dai_name = "tlv320aic3x-hifi",
-	.codec_name = "tlv320aic3x-codec.0-001a",
+	.codec_name = "tlv320aic3x-codec.1-0018",
 	.platform_name = "davinci-pcm-audio",
 	.init = evm_aic3x_init,
 	.ops = &evm_ops,
author
#155 lore raw

PATCH 155/272 ASoC: Fix AC97 registration unwind

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Mark Brown <[email protected]>

commit 7d8316df44053687625eef792d53b3ac62e82248 upstream.

soc_unregister_ac97_dai_link() takes a CODEC as an argument, not a rtd like the registration function, so give it what it's looking for.

---
 sound/soc/soc-core.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/soc-core.c +1 -1
@@ -1623,7 +1623,7 @@ static void snd_soc_instantiate_card(str
 		if (ret < 0) {
 			printk(KERN_ERR "asoc: failed to register AC97 %s\n", card->name);
 			while (--i >= 0)
-				soc_unregister_ac97_dai_link(&card->rtd[i]);
+				soc_unregister_ac97_dai_link(card->rtd[i].codec);
 			goto probe_dai_err;
 		}
 	}
author
#156 lore raw

PATCH 156/272 ASoC: correct link specifications for corgi, poodle and spitz

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Dmitry Eremin-Solenikov <[email protected]>

commit a3adfa00e8089aa72826c6ba04bcb18cfceaf0a9 upstream.

ASoC DAI link descriptions for Corgi, Poodle and Spitz platforms contained incorrect names for cpu_dai and codec, which effectievly disabled sound on theese platforms. Fix that errors.

---
 sound/soc/pxa/corgi.c  |    4 ++--
 sound/soc/pxa/poodle.c |    2 +-
 sound/soc/pxa/spitz.c  |    4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)
sound/soc/pxa/corgi.c +2 -2
@@ -305,10 +305,10 @@ static int corgi_wm8731_init(struct snd_
 static struct snd_soc_dai_link corgi_dai = {
 	.name = "WM8731",
 	.stream_name = "WM8731",
-	.cpu_dai_name = "pxa-is2-dai",
+	.cpu_dai_name = "pxa2xx-i2s",
 	.codec_dai_name = "wm8731-hifi",
 	.platform_name = "pxa-pcm-audio",
-	.codec_name = "wm8731-codec-0.001a",
+	.codec_name = "wm8731-codec-0.001b",
 	.init = corgi_wm8731_init,
 	.ops = &corgi_ops,
 };
sound/soc/pxa/poodle.c +1 -1
@@ -274,7 +274,7 @@ static struct snd_soc_dai_link poodle_da
 	.cpu_dai_name = "pxa2xx-i2s",
 	.codec_dai_name = "wm8731-hifi",
 	.platform_name = "pxa-pcm-audio",
-	.codec_name = "wm8731-codec.0-001a",
+	.codec_name = "wm8731-codec.0-001b",
 	.init = poodle_wm8731_init,
 	.ops = &poodle_ops,
 };
sound/soc/pxa/spitz.c +2 -2
@@ -313,10 +313,10 @@ static int spitz_wm8750_init(struct snd_
 static struct snd_soc_dai_link spitz_dai = {
 	.name = "wm8750",
 	.stream_name = "WM8750",
-	.cpu_dai_name = "pxa-is2",
+	.cpu_dai_name = "pxa2xx-i2s",
 	.codec_dai_name = "wm8750-hifi",
 	.platform_name = "pxa-pcm-audio",
-	.codec_name = "wm8750-codec.0-001a",
+	.codec_name = "wm8750-codec.0-001b",
 	.init = spitz_wm8750_init,
 	.ops = &spitz_ops,
 };
author
#157 lore raw

PATCH 157/272 ASoC: Handle low measured DC offsets for wm_hubs devices

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Mark Brown <[email protected]>

commit 20a4e7fc7e213365ea3771d7bf1e10a6bab853be upstream.

The DC servo codes are actually signed numbers so need to be treated as such.

---
 sound/soc/codecs/wm_hubs.c |   15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)
sound/soc/codecs/wm_hubs.c +7 -8
@@ -92,6 +92,7 @@ static void wait_for_dc_servo(struct snd
 static void calibrate_dc_servo(struct snd_soc_codec *codec)
 {
 	struct wm_hubs_data *hubs = snd_soc_codec_get_drvdata(codec);
+	s8 offset;
 	u16 reg, reg_l, reg_r, dcs_cfg;
 
 	/* Set for 32 series updates */
@@ -130,16 +131,14 @@ static void calibrate_dc_servo(struct sn
 		dev_dbg(codec->dev, "DCS input: %x %x\n", reg_l, reg_r);
 
 		/* HPOUT1L */
-		if (reg_l + hubs->dcs_codes > 0 &&
-		    reg_l + hubs->dcs_codes < 0xff)
-			reg_l += hubs->dcs_codes;
-		dcs_cfg = reg_l << WM8993_DCS_DAC_WR_VAL_1_SHIFT;
+		offset = reg_l;
+		offset += hubs->dcs_codes;
+		dcs_cfg = (u8)offset << WM8993_DCS_DAC_WR_VAL_1_SHIFT;
 
 		/* HPOUT1R */
-		if (reg_r + hubs->dcs_codes > 0 &&
-		    reg_r + hubs->dcs_codes < 0xff)
-			reg_r += hubs->dcs_codes;
-		dcs_cfg |= reg_r;
+		offset = reg_r;
+		offset += hubs->dcs_codes;
+		dcs_cfg |= (u8)offset;
 
 		dev_dbg(codec->dev, "DCS result: %x\n", dcs_cfg);
 
author
#158 lore raw

PATCH 158/272 ASoC: WM8994: fix wrong value in tristate function

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Qiao Zhou <[email protected]>

commit 78b3fb46753872fc79bffecc8d50355a8622b39b upstream.

fix wrong value in wm8994_set_tristate func. when updating reg bits, it should use "value", not "reg".

---
 sound/soc/codecs/wm8994.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/wm8994.c +1 -1
@@ -3513,7 +3513,7 @@ static int wm8994_set_tristate(struct sn
 	else
 		val = 0;
 
-	return snd_soc_update_bits(codec, reg, mask, reg);
+	return snd_soc_update_bits(codec, reg, mask, val);
 }
 
 #define WM8994_RATES SNDRV_PCM_RATE_8000_96000
author
#159 lore raw

PATCH 159/272 ASoC: Create an AIF1ADCDAT signal widget to match AIF2

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Mark Brown <[email protected]>

commit 7f94de483f4e37e14d646ad6e85a3c82f66fb487 upstream.

Due to the different routing for AIF1 and AIF2 we weren't using a single widget to represent the ADCDAT signal. For consistency add one.

---
 sound/soc/codecs/wm8994.c |   14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)
sound/soc/codecs/wm8994.c +10 -4
@@ -2536,18 +2536,18 @@ SND_SOC_DAPM_SUPPLY("DSPINTCLK", WM8994_
 SND_SOC_DAPM_SUPPLY("AIF1CLK", WM8994_AIF1_CLOCKING_1, 0, 0, NULL, 0),
 SND_SOC_DAPM_SUPPLY("AIF2CLK", WM8994_AIF2_CLOCKING_1, 0, 0, NULL, 0),
 
-SND_SOC_DAPM_AIF_OUT("AIF1ADC1L", "AIF1 Capture",
+SND_SOC_DAPM_AIF_OUT("AIF1ADC1L", NULL,
 		     0, WM8994_POWER_MANAGEMENT_4, 9, 0),
-SND_SOC_DAPM_AIF_OUT("AIF1ADC1R", "AIF1 Capture",
+SND_SOC_DAPM_AIF_OUT("AIF1ADC1R", NULL,
 		     0, WM8994_POWER_MANAGEMENT_4, 8, 0),
 SND_SOC_DAPM_AIF_IN("AIF1DAC1L", NULL, 0,
 		    WM8994_POWER_MANAGEMENT_5, 9, 0),
 SND_SOC_DAPM_AIF_IN("AIF1DAC1R", NULL, 0,
 		    WM8994_POWER_MANAGEMENT_5, 8, 0),
 
-SND_SOC_DAPM_AIF_OUT("AIF1ADC2L", "AIF1 Capture",
+SND_SOC_DAPM_AIF_OUT("AIF1ADC2L", NULL,
 		     0, WM8994_POWER_MANAGEMENT_4, 11, 0),
-SND_SOC_DAPM_AIF_OUT("AIF1ADC2R", "AIF1 Capture",
+SND_SOC_DAPM_AIF_OUT("AIF1ADC2R", NULL,
 		     0, WM8994_POWER_MANAGEMENT_4, 10, 0),
 SND_SOC_DAPM_AIF_IN("AIF1DAC2L", NULL, 0,
 		    WM8994_POWER_MANAGEMENT_5, 11, 0),
@@ -2588,6 +2588,7 @@ SND_SOC_DAPM_AIF_IN("AIF2DACR", NULL, 0,
 
 SND_SOC_DAPM_AIF_IN("AIF1DACDAT", "AIF1 Playback", 0, SND_SOC_NOPM, 0, 0),
 SND_SOC_DAPM_AIF_IN("AIF2DACDAT", "AIF2 Playback", 0, SND_SOC_NOPM, 0, 0),
+SND_SOC_DAPM_AIF_OUT("AIF1ADCDAT", "AIF1 Capture", 0, SND_SOC_NOPM, 0, 0),
 SND_SOC_DAPM_AIF_OUT("AIF2ADCDAT", "AIF2 Capture", 0, SND_SOC_NOPM, 0, 0),
 
 SND_SOC_DAPM_MUX("AIF1DAC Mux", SND_SOC_NOPM, 0, 0, &aif1dac_mux),
@@ -2783,6 +2784,11 @@ static const struct snd_soc_dapm_route i
 	{ "AIF2DAC2R Mixer", "Left Sidetone Switch", "Left Sidetone" },
 	{ "AIF2DAC2R Mixer", "Right Sidetone Switch", "Right Sidetone" },
 
+	{ "AIF1ADCDAT", NULL, "AIF1ADC1L" },
+	{ "AIF1ADCDAT", NULL, "AIF1ADC1R" },
+	{ "AIF1ADCDAT", NULL, "AIF1ADC2L" },
+	{ "AIF1ADCDAT", NULL, "AIF1ADC2R" },
+
 	{ "AIF2ADCDAT", NULL, "AIF2ADC Mux" },
 
 	/* AIF3 output */
author
#160 lore raw

PATCH 160/272 virtio_net: Add schedule check to napi_enable call

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Bruce Rogers <[email protected]>

commit 3e9d08ec0a68f6faf718d5a7e050fe5ca0ba004f upstream.

Under harsh testing conditions, including low memory, the guest would stop receiving packets. With this patch applied we no longer see any problems in the driver while performing these tests for extended periods of time.

Make sure napi is scheduled subsequent to each napi_enable.

---
 drivers/net/virtio_net.c |   27 ++++++++++++++++-----------
 1 file changed, 16 insertions(+), 11 deletions(-)
drivers/net/virtio_net.c +16 -11
@@ -446,6 +446,20 @@ static void skb_recv_done(struct virtque
 	}
 }
 
+static void virtnet_napi_enable(struct virtnet_info *vi)
+{
+	napi_enable(&vi->napi);
+
+	/* If all buffers were filled by other side before we napi_enabled, we
+	 * won't get another interrupt, so process any outstanding packets
+	 * now.  virtnet_poll wants re-enable the queue, so we disable here.
+	 * We synchronize against interrupts via NAPI_STATE_SCHED */
+	if (napi_schedule_prep(&vi->napi)) {
+		virtqueue_disable_cb(vi->rvq);
+		__napi_schedule(&vi->napi);
+	}
+}
+
 static void refill_work(struct work_struct *work)
 {
 	struct virtnet_info *vi;
@@ -454,7 +468,7 @@ static void refill_work(struct work_stru
 	vi = container_of(work, struct virtnet_info, refill.work);
 	napi_disable(&vi->napi);
 	still_empty = !try_fill_recv(vi, GFP_KERNEL);
-	napi_enable(&vi->napi);
+	virtnet_napi_enable(vi);
 
 	/* In theory, this can happen: if we don't get any buffers in
 	 * we will *never* try to fill again. */
@@ -638,16 +652,7 @@ static int virtnet_open(struct net_devic
 {
 	struct virtnet_info *vi = netdev_priv(dev);
 
-	napi_enable(&vi->napi);
-
-	/* If all buffers were filled by other side before we napi_enabled, we
-	 * won't get another interrupt, so process any outstanding packets
-	 * now.  virtnet_poll wants re-enable the queue, so we disable here.
-	 * We synchronize against interrupts via NAPI_STATE_SCHED */
-	if (napi_schedule_prep(&vi->napi)) {
-		virtqueue_disable_cb(vi->rvq);
-		__napi_schedule(&vi->napi);
-	}
+	virtnet_napi_enable(vi);
 	return 0;
 }
 
author
#161 lore raw

PATCH 161/272 virtio: console: Wake up outvq on host notifications

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Amit Shah <[email protected]>

commit 2770c5ea501be69989a7acf54ec4cb3554c47191 upstream.

The outvq needs to be woken up on host notifications so that buffers consumed by the host can be reclaimed, outvq freed, and application writes may proceed again.

The need for this is now finally noticed when I have qemu patches ready to use nonblocking IO and flow control.

---
 drivers/char/virtio_console.c |   15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)
drivers/char/virtio_console.c +13 -2
@@ -1462,6 +1462,17 @@ static void control_work_handler(struct
 	spin_unlock(&portdev->cvq_lock);
 }
 
+static void out_intr(struct virtqueue *vq)
+{
+	struct port *port;
+
+	port = find_port_by_vq(vq->vdev->priv, vq);
+	if (!port)
+		return;
+
+	wake_up_interruptible(&port->waitqueue);
+}
+
 static void in_intr(struct virtqueue *vq)
 {
 	struct port *port;
@@ -1566,7 +1577,7 @@ static int init_vqs(struct ports_device
 	 */
 	j = 0;
 	io_callbacks[j] = in_intr;
-	io_callbacks[j + 1] = NULL;
+	io_callbacks[j + 1] = out_intr;
 	io_names[j] = "input";
 	io_names[j + 1] = "output";
 	j += 2;
@@ -1580,7 +1591,7 @@ static int init_vqs(struct ports_device
 		for (i = 1; i < nr_ports; i++) {
 			j += 2;
 			io_callbacks[j] = in_intr;
-			io_callbacks[j + 1] = NULL;
+			io_callbacks[j + 1] = out_intr;
 			io_names[j] = "input";
 			io_names[j + 1] = "output";
 		}
author
#162 lore raw

PATCH 162/272 carl9170: fix typo in PS code

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Christian Lamparter <[email protected]>

commit 5820de5303f73d48dcc3a053c875d1f0da7eef67 upstream.

This patch fixes a off-by-one bug which bugged
the driver's PS-POLL capability.

---
 drivers/net/wireless/ath/carl9170/rx.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/carl9170/rx.c +1 -1
@@ -564,7 +564,7 @@ static void carl9170_ps_beacon(struct ar
 	cam = ieee80211_check_tim(tim_ie, tim_len, ar->common.curaid);
 
 	/* 2. Maybe the AP wants to send multicast/broadcast data? */
-	cam = !!(tim_ie->bitmap_ctrl & 0x01);
+	cam |= !!(tim_ie->bitmap_ctrl & 0x01);
 
 	if (!cam) {
 		/* back to low-power land. */
author
#163 lore raw

PATCH 163/272 68360serial: Plumb in rs_360_get_icount()

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Ben Hutchings <[email protected]>

commit 3e517f4b1de4787ecff87a73a9865a0b1aa2b10b upstream.

Commit 0587102cf9f427c185bfdeb2cef41e13ee0264b1 replaced a direct implementation of SIOCGICOUNT with an implementation of tty_operations::get_icount, but it did not actually set rs_360_ops.get_icount.

---
 drivers/serial/68360serial.c |    1 +
 1 file changed, 1 insertion(+)
drivers/serial/68360serial.c +1 -0
@@ -2428,6 +2428,7 @@ static const struct tty_operations rs_36
 	/* .read_proc = rs_360_read_proc, */
 	.tiocmget = rs_360_tiocmget,
 	.tiocmset = rs_360_tiocmset,
+	.get_icount = rs_360_get_icount,
 };
 
 static int __init rs_360_init(void)
author
#164 lore raw

PATCH 164/272 drivers: update to pl2303 usb-serial to support Motorola cables

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Dario Lombardo <[email protected]>

commit 96a3e79edff6f41b0f115a82f1a39d66218077a7 upstream.

Added 0x0307 device id to support Motorola cables to the pl2303 usb serial driver. This cable has a modified chip that is a pl2303, but declares itself as 0307. Fixed by adding the right device id to the supported devices list, assigning it the code labeled PL2303_PRODUCT_ID_MOTOROLA.

---
 drivers/usb/serial/pl2303.c |    1 +
 drivers/usb/serial/pl2303.h |    1 +
 2 files changed, 2 insertions(+)
drivers/usb/serial/pl2303.c +1 -0
@@ -50,6 +50,7 @@ static const struct usb_device_id id_tab
 	{ USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MMX) },
 	{ USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_GPRS) },
 	{ USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) },
+	{ USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MOTOROLA) },
 	{ USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
 	{ USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
 	{ USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
drivers/usb/serial/pl2303.h +1 -0
@@ -21,6 +21,7 @@
 #define PL2303_PRODUCT_ID_MMX		0x0612
 #define PL2303_PRODUCT_ID_GPRS		0x0609
 #define PL2303_PRODUCT_ID_HCR331	0x331a
+#define PL2303_PRODUCT_ID_MOTOROLA	0x0307
 
 #define ATEN_VENDOR_ID		0x0557
 #define ATEN_VENDOR_ID2		0x0547
author
#165 lore raw

PATCH 165/272 serial: unbreak billionton CF card

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Pavel Machek <[email protected]>

commit d0694e2aeb815042aa0f3e5036728b3db4446f1d upstream.

Unbreak Billionton CF bluetooth card. This actually fixes a regression on zaurus.

---
 drivers/serial/8250.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/serial/8250.c +2 -1
@@ -236,7 +236,8 @@ static const struct serial8250_config ua
 		.fifo_size	= 128,
 		.tx_loadsz	= 128,
 		.fcr		= UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10,
-		.flags		= UART_CAP_FIFO | UART_CAP_EFR | UART_CAP_SLEEP,
+		/* UART_CAP_EFR breaks billionon CF bluetooth card. */
+		.flags		= UART_CAP_FIFO | UART_CAP_SLEEP,
 	},
 	[PORT_16654] = {
 		.name		= "ST16654",
author
#166 lore raw

PATCH 166/272 ptrace: use safer wake up on ptrace_detach()

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Tejun Heo <[email protected]>

commit 01e05e9a90b8f4c3997ae0537e87720eb475e532 upstream.

The wake_up_process() call in ptrace_detach() is spurious and not interlocked with the tracee state. IOW, the tracee could be running or sleeping in any place in the kernel by the time wake_up_process() is called. This can lead to the tracee waking up unexpectedly which can be dangerous.

The wake_up is spurious and should be removed but for now reduce its toxicity by only waking up if the tracee is in TRACED or STOPPED state.

This bug can possibly be used as an attack vector. I don't think it will take too much effort to come up with an attack which triggers oops somewhere. Most sleeps are wrapped in condition test loops and should be safe but we have quite a number of places where sleep and wakeup conditions are expected to be interlocked. Although the window of opportunity is tiny, ptrace can be used by non-privileged users and with some loading the window can definitely be extended and exploited.

---
 kernel/ptrace.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/ptrace.c +1 -1
@@ -313,7 +313,7 @@ int ptrace_detach(struct task_struct *ch
 		child->exit_code = data;
 		dead = __ptrace_detach(current, child);
 		if (!child->exit_state)
-			wake_up_process(child);
+			wake_up_state(child, TASK_TRACED | TASK_STOPPED);
 	}
 	write_unlock_irq(&tasklist_lock);
 
author
#167 lore raw

PATCH 167/272 net: Fix ip link add netns oops

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Eric W. Biederman <[email protected]>

commit 13ad17745c2cbd437d9e24b2d97393e0be11c439 upstream.

Quoted 53 lines · Ed Swierk

On 2.6.35.7
ip link add link eth0 netns 9999 type macvlan
where 9999 is a nonexistent PID triggers an oops and causes all network functions to hang:

[10663.821898] BUG: unable to handle kernel NULL pointer dereference at 000000000000006d
 [10663.821917] IP: [<ffffffff8149c2fa>] __dev_alloc_name+0x9a/0x170
 [10663.821933] PGD 1d3927067 PUD 22f5c5067 PMD 0
 [10663.821944] Oops: 0000 [#1] SMP
 [10663.821953] last sysfs file: /sys/devices/system/cpu/cpu0/cpufreq/scaling_cur_freq
 [10663.821959] CPU 3
 [10663.821963] Modules linked in: macvlan ip6table_filter ip6_tables rfcomm ipt_MASQUERADE binfmt_misc iptable_nat nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack sco ipt_REJECT bnep l2cap xt_tcpudp iptable_filter ip_tables x_tables bridge stp vboxnetadp vboxnetflt vboxdrv kvm_intel kvm parport_pc ppdev snd_hda_codec_intelhdmi snd_hda_codec_conexant arc4 iwlagn iwlcore mac80211 snd_hda_intel snd_hda_codec snd_hwdep snd_pcm snd_seq_midi snd_rawmidi i915 snd_seq_midi_event snd_seq thinkpad_acpi drm_kms_helper btusb tpm_tis nvram uvcvideo snd_timer snd_seq_device bluetooth videodev v4l1_compat v4l2_compat_ioctl32 tpm drm tpm_bios snd cfg80211 psmouse serio_raw intel_ips soundcore snd_page_alloc intel_agp i2c_algo_bit video output netconsole configfs lp parport usbhid hid e1000e sdhci_pci ahci libahci sdhci led_class
 [10663.822155]
 [10663.822161] Pid: 6000, comm: ip Not tainted 2.6.35-23-generic #41-Ubuntu 2901CTO/2901CTO
 [10663.822167] RIP: 0010:[<ffffffff8149c2fa>] [<ffffffff8149c2fa>] __dev_alloc_name+0x9a/0x170
 [10663.822177] RSP: 0018:ffff88014aebf7b8 EFLAGS: 00010286
 [10663.822182] RAX: 00000000fffffff4 RBX: ffff8801ad900800 RCX: 0000000000000000
 [10663.822187] RDX: ffff880000000000 RSI: 0000000000000000 RDI: ffff88014ad63000
 [10663.822191] RBP: ffff88014aebf808 R08: 0000000000000041 R09: 0000000000000041
 [10663.822196] R10: 0000000000000000 R11: dead000000200200 R12: ffff88014aebf818
 [10663.822201] R13: fffffffffffffffd R14: ffff88014aebf918 R15: ffff88014ad62000
 [10663.822207] FS: 00007f00c487f700(0000) GS:ffff880001f80000(0000) knlGS:0000000000000000
 [10663.822212] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 [10663.822216] CR2: 000000000000006d CR3: 0000000231f19000 CR4: 00000000000026e0
 [10663.822221] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 [10663.822226] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
 [10663.822231] Process ip (pid: 6000, threadinfo ffff88014aebe000, task ffff88014afb16e0)
 [10663.822236] Stack:
 [10663.822240] ffff88014aebf808 ffffffff814a2bb5 ffff88014aebf7e8 00000000a00ee8d6
 [10663.822251] <0> 0000000000000000 ffffffffa00ef940 ffff8801ad900800 ffff88014aebf818
 [10663.822265] <0> ffff88014aebf918 ffff8801ad900800 ffff88014aebf858 ffffffff8149c413
 [10663.822281] Call Trace:
 [10663.822290] [<ffffffff814a2bb5>] ? dev_addr_init+0x75/0xb0
 [10663.822298] [<ffffffff8149c413>] dev_alloc_name+0x43/0x90
 [10663.822307] [<ffffffff814a85ee>] rtnl_create_link+0xbe/0x1b0
 [10663.822314] [<ffffffff814ab2aa>] rtnl_newlink+0x48a/0x570
 [10663.822321] [<ffffffff814aafcc>] ? rtnl_newlink+0x1ac/0x570
 [10663.822332] [<ffffffff81030064>] ? native_x2apic_icr_read+0x4/0x20
 [10663.822339] [<ffffffff814a8c17>] rtnetlink_rcv_msg+0x177/0x290
 [10663.822346] [<ffffffff814a8aa0>] ? rtnetlink_rcv_msg+0x0/0x290
 [10663.822354] [<ffffffff814c25d9>] netlink_rcv_skb+0xa9/0xd0
 [10663.822360] [<ffffffff814a8a85>] rtnetlink_rcv+0x25/0x40
 [10663.822367] [<ffffffff814c223e>] netlink_unicast+0x2de/0x2f0
 [10663.822374] [<ffffffff814c303e>] netlink_sendmsg+0x1fe/0x2e0
 [10663.822383] [<ffffffff81488533>] sock_sendmsg+0xf3/0x120
 [10663.822391] [<ffffffff815899fe>] ? _raw_spin_lock+0xe/0x20
 [10663.822400] [<ffffffff81168656>] ? __d_lookup+0x136/0x150
 [10663.822406] [<ffffffff815899fe>] ? _raw_spin_lock+0xe/0x20
 [10663.822414] [<ffffffff812b7a0d>] ? _atomic_dec_and_lock+0x4d/0x80
 [10663.822422] [<ffffffff8116ea90>] ? mntput_no_expire+0x30/0x110
 [10663.822429] [<ffffffff81486ff5>] ? move_addr_to_kernel+0x65/0x70
 [10663.822435] [<ffffffff81493308>] ? verify_iovec+0x88/0xe0
 [10663.822442] [<ffffffff81489020>] sys_sendmsg+0x240/0x3a0
[10663.822450] [<ffffffff8111e2a9>] ? __do_fault+0x479/0x560
 [10663.822457] [<ffffffff815899fe>] ? _raw_spin_lock+0xe/0x20
Quoted 8 lines
 [10663.822465] [<ffffffff8116cf4a>] ? alloc_fd+0x10a/0x150
 [10663.822473] [<ffffffff8158d76e>] ? do_page_fault+0x15e/0x350
 [10663.822482] [<ffffffff8100a0f2>] system_call_fastpath+0x16/0x1b
 [10663.822487] Code: 90 48 8d 78 02 be 25 00 00 00 e8 92 1d e2 ff 48 85 c0 75 cf bf 20 00 00 00 e8 c3 b1 c6 ff 49 89 c7 b8 f4 ff ff ff 4d 85 ff 74 bd <4d> 8b 75 70 49 8d 45 70 48 89 45 b8 49 83 ee 58 eb 28 48 8d 55
 [10663.822618] RIP [<ffffffff8149c2fa>] __dev_alloc_name+0x9a/0x170
 [10663.822627] RSP <ffff88014aebf7b8>
 [10663.822631] CR2: 000000000000006d
 [10663.822636] ---[ end trace 3dfd6c3ad5327ca7 ]---

This bug was introduced in:
commit 81adee47dfb608df3ad0b91d230fb3cef75f0060

Author: Eric W. Biederman <[email protected]>
Date:   Sun Nov 8 00:53:51 2009 -0800

net: Support specifying the network namespace upon device creation.

There is no good reason to not support userspace specifying the network namespace during device creation, and it makes it easier to create a network device and pass it to a child network namespace with a well known name.

We have to be careful to ensure that the target network namespace for the new device exists through the life of the call. To keep that logic clear I have factored out the network namespace grabbing logic into rtnl_link_get_net.

In addtion we need to continue to pass the source network namespace to the rtnl_link_ops.newlink method so that we can find the base device source network namespace.

Where apparently I forgot to add error handling to the path where we create a new network device in a new network namespace, and pass in an invalid pid.

---
 net/core/rtnetlink.c |    3 +++
 1 file changed, 3 insertions(+)
net/core/rtnetlink.c +3 -0
@@ -1510,6 +1510,9 @@ replay:
 			snprintf(ifname, IFNAMSIZ, "%s%%d", ops->kind);
 
 		dest_net = rtnl_link_get_net(net, tb);
+		if (IS_ERR(dest_net))
+			return PTR_ERR(dest_net);
+
 		dev = rtnl_create_link(net, dest_net, ifname, ops, tb);
 
 		if (IS_ERR(dev))
author
#168 lore raw

PATCH 168/272 x86, mtrr: Avoid MTRR reprogramming on BP during boot on UP platforms

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Suresh Siddha <[email protected]>

commit f7448548a9f32db38f243ccd4271617758ddfe2c upstream.

Markus Kohn ran into a hard hang regression on an acer aspire 1310, when acpi is enabled. git bisect showed the following commit as the bad one that introduced the boot regression.

	commit d0af9eed5aa91b6b7b5049cae69e5ea956fd85c3
	Author: Suresh Siddha <[email protected]>
	Date:   Wed Aug 19 18:05:36 2009 -0700

	    x86, pat/mtrr: Rendezvous all the cpus for MTRR/PAT init

Because of the UP configuration of that platform, native_smp_prepare_cpus() bailed out (in smp_sanity_check()) before doing the set_mtrr_aps_delayed_init()

Further down the boot path, native_smp_cpus_done() will call the delayed MTRR initialization for the AP's (mtrr_aps_init()) with mtrr_aps_delayed_init not set. This resulted in the boot processor reprogramming its MTRR's to the values seen during the start of the OS boot. While this is not needed ideally, this shouldn't have caused any side-effects. This is because the reprogramming of MTRR's (set_mtrr_state() that gets called via set_mtrr()) will check if the live register contents are different from what is being asked to write and will do the actual write only if they are different.

BP's mtrr state is read during the start of the OS boot and typically nothing would have changed when we ask to reprogram it on BP again because of the above scenario on an UP platform. So on a normal UP platform no reprogramming of BP MTRR MSR's happens and all is well.

However, on this platform, bios seems to be modifying the fixed mtrr range registers between the start of OS boot and when we double check the live registers for reprogramming BP MTRR registers. And as the live registers are modified, we end up reprogramming the MTRR's to the state seen during the start of the OS boot.

During ACPI initialization, something in the bios (probably smi handler?) don't like this fact and results in a hard lockup.

We didn't see this boot hang issue on this platform before the commit d0af9eed5aa91b6b7b5049cae69e5ea956fd85c3, because only the AP's (if any) will program its MTRR's to the value that BP had at the start of the OS boot.

Fix this issue by checking mtrr_aps_delayed_init before continuing further in the mtrr_aps_init(). Now, only AP's (if any) will program its MTRR's to the BP values during boot.

Addresses https://bugzilla.novell.com/show_bug.cgi?id=623393

[ By the way, this behavior of the bios modifying MTRR's after the start
of the OS boot is not common and the kernel is not prepared to handle this situation well. Irrespective of this issue, during suspend/resume, linux kernel will try to reprogram the BP's MTRR values to the values seen during the start of the OS boot. So suspend/resume might be already broken on this platform for all linux kernel versions. ]

Reported-and-bisected-by Markus Kohn <[email protected]>
Cc Thomas Renninger <[email protected]>
Cc Rafael Wysocki <[email protected]>
Cc Venkatesh Pallipadi <[email protected]>

LKML-Reference: <[email protected]>

---
 arch/x86/kernel/cpu/mtrr/main.c |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)
arch/x86/kernel/cpu/mtrr/main.c +9 -1
@@ -793,13 +793,21 @@ void set_mtrr_aps_delayed_init(void)
 }
 
 /*
- * MTRR initialization for all AP's
+ * Delayed MTRR initialization for all AP's
  */
 void mtrr_aps_init(void)
 {
 	if (!use_intel())
 		return;
 
+	/*
+	 * Check if someone has requested the delay of AP MTRR initialization,
+	 * by doing set_mtrr_aps_delayed_init(), prior to this point. If not,
+	 * then we are done.
+	 */
+	if (!mtrr_aps_delayed_init)
+		return;
+
 	set_mtrr(~0U, 0, 0, 0);
 	mtrr_aps_delayed_init = false;
 }
author
#169 lore raw

PATCH 169/272 fix jiffy calculations in calibrate_delay_direct to handle overflow

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Tim Deegan <[email protected]>

commit 70a062286b9dfcbd24d2e11601aecfead5cf709a upstream.

Fixes a hang when booting as dom0 under Xen, when jiffies can be quite large by the time the kernel init gets this far.

[[email protected]: !time_after() -> time_before_eq() as suggested by Jiri Slaby]
Cc Jiri Slaby <[email protected]>
Cc Jeremy Fitzhardinge <[email protected]>
---
 init/calibrate.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
init/calibrate.c +3 -3
@@ -66,7 +66,7 @@ static unsigned long __cpuinit calibrate
 		pre_start = 0;
 		read_current_timer(&start);
 		start_jiffies = jiffies;
-		while (jiffies <= (start_jiffies + 1)) {
+		while (time_before_eq(jiffies, start_jiffies + 1)) {
 			pre_start = start;
 			read_current_timer(&start);
 		}
@@ -74,8 +74,8 @@ static unsigned long __cpuinit calibrate
 
 		pre_end = 0;
 		end = post_start;
-		while (jiffies <=
-		       (start_jiffies + 1 + DELAY_CALIBRATION_TICKS)) {
+		while (time_before_eq(jiffies, start_jiffies + 1 +
+					       DELAY_CALIBRATION_TICKS)) {
 			pre_end = end;
 			read_current_timer(&end);
 		}
author
#170 lore raw

PATCH 170/272 ixgbe: fix for 82599 erratum on Header Splitting

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Don Skidmore <[email protected]>

commit a124339ad28389093ed15eca990d39c51c5736cc upstream.

We have found a hardware erratum on 82599 hardware that can lead to unpredictable behavior when Header Splitting mode is enabled. So we are no longer enabling this feature on affected hardware.

Please see the 82599 Specification Update for more information.

---
 drivers/net/ixgbe/ixgbe_main.c |   11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/net/ixgbe/ixgbe_main.c +9 -2
@@ -2912,9 +2912,16 @@ static void ixgbe_set_rx_buffer_len(stru
 	u32 mhadd, hlreg0;
 
 	/* Decide whether to use packet split mode or not */
+	/* On by default */
+	adapter->flags |= IXGBE_FLAG_RX_PS_ENABLED;
+
 	/* Do not use packet split if we're in SR-IOV Mode */
-	if (!adapter->num_vfs)
-		adapter->flags |= IXGBE_FLAG_RX_PS_ENABLED;
+	if (adapter->num_vfs)
+		adapter->flags &= ~IXGBE_FLAG_RX_PS_ENABLED;
+
+	/* Disable packet split due to 82599 erratum #45 */
+	if (hw->mac.type == ixgbe_mac_82599EB)
+		adapter->flags &= ~IXGBE_FLAG_RX_PS_ENABLED;
 
 	/* Set the RX buffer length according to the mode */
 	if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
author
#171 lore raw

PATCH 171/272 iio: Fixpoint formatted output bugfix

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Roland Stigge <[email protected]>

commit e71a7fd259943a2c2e11484880c80248ad139fe5 upstream.

Fix some ADC drivers' _scale interface to correct fixpoint formatted output

---
 drivers/staging/iio/adc/ad7476_core.c |    2 +-
 drivers/staging/iio/adc/ad799x_core.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/staging/iio/adc/ad7476_core.c +1 -1
@@ -68,7 +68,7 @@ static ssize_t ad7476_show_scale(struct
 	/* Corresponds to Vref / 2^(bits) */
 	unsigned int scale_uv = (st->int_vref_mv * 1000) >> st->chip_info->bits;
 
-	return sprintf(buf, "%d.%d\n", scale_uv / 1000, scale_uv % 1000);
+	return sprintf(buf, "%d.%03d\n", scale_uv / 1000, scale_uv % 1000);
 }
 static IIO_DEVICE_ATTR(in_scale, S_IRUGO, ad7476_show_scale, NULL, 0);
 
drivers/staging/iio/adc/ad799x_core.c +1 -1
@@ -432,7 +432,7 @@ static ssize_t ad799x_show_scale(struct
 	/* Corresponds to Vref / 2^(bits) */
 	unsigned int scale_uv = (st->int_vref_mv * 1000) >> st->chip_info->bits;
 
-	return sprintf(buf, "%d.%d\n", scale_uv / 1000, scale_uv % 1000);
+	return sprintf(buf, "%d.%03d\n", scale_uv / 1000, scale_uv % 1000);
 }
 
 static IIO_DEVICE_ATTR(in_scale, S_IRUGO, ad799x_show_scale, NULL, 0);
author
#172 lore raw

PATCH 172/272 Fix prlimit64 for suid/sgid processes

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Kacper Kornet <[email protected]>

commit aa5bd67dcfdf9af34c7fa36ebc87d4e1f7e91873 upstream.

Since check_prlimit_permission always fails in the case of SUID/GUID processes, such processes are not able to read or set their own limits. This commit changes this by assuming that process can always read/change its own limits.

---
 kernel/sys.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/sys.c +2 -1
@@ -1377,7 +1377,8 @@ static int check_prlimit_permission(stru
 	const struct cred *cred = current_cred(), *tcred;
 
 	tcred = __task_cred(task);
-	if ((cred->uid != tcred->euid ||
+	if (current != task &&
+	    (cred->uid != tcred->euid ||
 	     cred->uid != tcred->suid ||
 	     cred->uid != tcred->uid  ||
 	     cred->gid != tcred->egid ||
author
#173 lore raw

PATCH 173/272 ARM: S5PV310: Set bit 22 in the PL310 (cache controller) AuxCtlr register

In reply to Greg KH

2.6.37-stable review patch. If anyone has any objections, please let us know.

------------------

From: Changhwan Youn <[email protected]>

commit a50eb1c7680973f5441ca20ac4da0af2055d0d87 upstream.

This patch is applied according to the commit 1a8e41cd672f894bbd74874eac601e6cedf838fb (ARM: 6395/1: VExpress: Set bit 22 in the PL310 (cache controller) AuxCtlr register).

Actually, S5PV310 has same cache controller(PL310).

Following is from Catalin Marinas' commit.

Clearing bit 22 in the PL310 Auxiliary Control register (shared attribute override enable) has the side effect of transforming Normal Shared Non-cacheable reads into Cacheable no-allocate reads.

Coherent DMA buffers in Linux always have a Cacheable alias via the kernel linear mapping and the processor can speculatively load cache lines into the PL310 controller. With bit 22 cleared, Non-cacheable reads would unexpectedly hit such cache lines leading to buffer corruption.

---
 arch/arm/mach-s5pv310/cpu.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/mach-s5pv310/cpu.c +1 -1
@@ -168,7 +168,7 @@ static int __init s5pv310_l2x0_cache_ini
 	__raw_writel(L2X0_DYNAMIC_CLK_GATING_EN | L2X0_STNDBY_MODE_EN,
 		     S5P_VA_L2CC + L2X0_POWER_CTRL);
 
-	l2x0_init(S5P_VA_L2CC, 0x7C070001, 0xC200ffff);
+	l2x0_init(S5P_VA_L2CC, 0x7C470001, 0xC200ffff);
 
 	return 0;
 }